nolo-cli 0.1.29 → 0.1.31

package/server/handlers/getDialogBillingHandler.ts

@@ -1,7 +1,7 @@
 import { authenticateRequest, CORS_HEADERS_AUTH } from "../../auth/utils";
 import { DataType } from "../../create/types";
 import { createKey, createTokenKey } from "../../database/keys";
-import serverDb from "../../database/server/db";
+import { getServerAuthorityStore } from "../../database/server/db";
 
 const json = (data: any, status = 200) =>
   new Response(JSON.stringify(data), {
@@ -32,6 +32,7 @@ const toNumber = (value: unknown) =>
   typeof value === "number" && Number.isFinite(value) ? value : 0;
 
 export const handleGetDialogBilling = async (req: any) => {
+  const store = getServerAuthorityStore();
   const authResult = await authenticateRequest(req);
   if (authResult instanceof Response) return authResult;
 
@@ -54,7 +55,7 @@ export const handleGetDialogBilling = async (req: any) => {
 
   let dialog: any;
   try {
-    dialog = await serverDb.get(dialogKey);
+    dialog = await store.get(dialogKey);
   } catch {
     return json(
       {
@@ -78,7 +79,7 @@ export const handleGetDialogBilling = async (req: any) => {
   const { start, end } = createTokenKey.rangeOfUser(userId);
   const records: BillingRecord[] = [];
 
-  for await (const [, value] of serverDb.iterator({
+  for await (const [, value] of store.iterator({
     gte: start,
     lte: end,
     reverse: true,

package/server/handlers/getTransactionsHandler.ts

@@ -2,11 +2,13 @@
 
 import { authenticateRequest } from "../../auth/utils";
 import { createTransactionKey } from "../../database/keys";
-import serverDb from "../../database/server/db";
+import { getServerAuthorityStore } from "../../database/server/db";
 import pino from "pino";
 
 const logger = pino({ name: "getTransactions" });
 
+const getTransactionsStore = () => getServerAuthorityStore();
+
 // 定义通用的 CORS 头
 const CORS_HEADERS = {
   "Access-Control-Allow-Origin": "*",
@@ -36,6 +38,7 @@ const createJsonResponse = (data: any, status: number = 200): Response => {
  */
 export const handleGetTransactions = async (req: Request) => {
   try {
+    const store = getTransactionsStore();
     // 步骤 1: 验证用户身份
     const authResult = await authenticateRequest(req);
     if (authResult instanceof Response) {
@@ -73,7 +76,7 @@ export const handleGetTransactions = async (req: Request) => {
     }
 
     // 步骤 4: 查询数据库
-    const iterator = serverDb.iterator(queryOptions);
+    const iterator = store.iterator(queryOptions);
     const transactions = [];
     for await (const [, value] of iterator) {
       transactions.push(value);

package/server/handlers/machines/machineBinding.ts

@@ -2,6 +2,7 @@ import type { MachineSummary } from "./machineRegistry";
 
 export type RuntimeBinding = {
   machineId?: string | null;
+  ownerUserId?: string | null;
   requiredCapabilities?: string[] | null;
 };
 

package/server/handlers/machines/machineHandlers.ts

@@ -34,14 +34,6 @@ type MachineHandlerDeps = {
 
 type SmokeCliProvider = "codex" | "copilot" | "claude" | "agy" | "gemini";
 
-const SMOKE_CAPABILITY_BY_PROVIDER: Record<SmokeCliProvider, string> = {
-  codex: "codex-cli",
-  copilot: "copilot-cli",
-  claude: "claude-code",
-  agy: "agy-cli",
-  gemini: "gemini-cli",
-};
-
 function normalizeSmokeProvider(value: unknown): SmokeCliProvider | null {
   if (
     value === "codex" ||
@@ -230,12 +222,6 @@ export function createMachineHandlers(deps: MachineHandlerDeps = {}) {
       if (!connectorRegistry.hasConnection(auth.userId, machineId)) {
         return json({ error: "Machine connector is not connected" }, 409);
       }
-
-      const requiredCapability = SMOKE_CAPABILITY_BY_PROVIDER[cliProvider];
-      if (!machine.capabilities.includes(requiredCapability)) {
-        return json({ error: `Machine is missing capability: ${requiredCapability}` }, 409);
-      }
-
       try {
         const result = await connectorRegistry.sendAgentRun(auth.userId, machineId, {
           agentKey: `machine-smoke-${cliProvider}`,

package/server/handlers/machines/machineInstallAssets.ts

@@ -331,13 +331,15 @@ function runCopilot(prompt, options) {
 }
 
 function runClaude(prompt, options) {
-  const args = ["-p", prompt, "--permission-mode", "bypassPermissions"];
-  if (options.model) args.push("--model", options.model);
+  const args = ["--add-dir", process.cwd(), "-p", prompt, "--permission-mode", "bypassPermissions"];
+  if (options.model && process.env.NOLO_CLAUDE_CLI_ALLOW_MODEL === "1") args.push("--model", options.model);
   return runProcess("claude", args, options);
 }
 
 function runAgy(prompt, options) {
   return runProcess("agy", [
+    "--add-dir",
+    process.cwd(),
     "--print",
     prompt,
     "--print-timeout",

package/server/handlers/notificationEmitter.ts

@@ -1,4 +1,4 @@
-import serverDb from "../../database/server/db";
+import { getServerAuthorityStore } from "../../database/server/db";
 import { parseSpaceMemberKey } from "../../database/server/spaceMemberAuthority";
 import {
   type NotificationRecord,
@@ -69,14 +69,16 @@ const mergePreservedFields = (
   };
 };
 
+const getNotificationStore = () => getServerAuthorityStore();
+
 const upsertNotificationRecord = async (
   notification: NotificationRecord
 ): Promise<NotificationRecord> => {
-  const existing = (await serverDb
+  const existing = (await getNotificationStore()
     .get(notification.dbKey)
     .catch(() => null)) as NotificationRecord | null;
   const merged = mergePreservedFields(notification, existing);
-  await serverDb.put(merged.dbKey, merged);
+  await getNotificationStore().put(merged.dbKey, merged);
   pushEvent(`user-${merged.userId}`, {
     type: "notification.upsert",
     notification: merged,

package/server/handlers/notificationsHandler.ts

@@ -1,6 +1,6 @@
 import { authenticateRequest, CORS_HEADERS_AUTH } from "../../auth/utils";
 import { createNotificationKey } from "../../database/keys";
-import serverDb, { ensureServerDbOpen } from "../../database/server/db";
+import { ensureServerDbOpen, getServerAuthorityStore } from "../../database/server/db";
 import type { NotificationRecord } from "../../app/notifications/model";
 
 const JSON_HEADERS = {
@@ -27,6 +27,8 @@ const isLevelLifecycleError = (error: unknown) => {
   return code === "LEVEL_DATABASE_NOT_OPEN" || code === "LEVEL_ITERATOR_NOT_OPEN";
 };
 
+const getNotificationsStore = () => getServerAuthorityStore();
+
 export const handleNotifications = async (req: Request): Promise<Response> => {
   if (req.method === "OPTIONS") {
     return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
@@ -57,9 +59,10 @@ export const handleNotifications = async (req: Request): Promise<Response> => {
 
   const { start, end } = createNotificationKey.rangeOfUser(auth.userId);
   const notifications: NotificationRecord[] = [];
+  const store = getNotificationsStore();
 
   try {
-    for await (const [key, value] of serverDb.iterator({ gte: start, lte: end })) {
+    for await (const [key, value] of store.iterator({ gte: start, lte: end })) {
       const record = value as NotificationRecord | null;
       if (!record || typeof record !== "object") continue;
       if (record.deletedAt) continue;

package/server/handlers/providerCallsRecentHandler.ts

@@ -0,0 +1,234 @@
+import type { ProviderCallEvent } from "../../ai/token/providerCall";
+import type { ProviderDispatchIntent } from "../../ai/token/providerDispatchIntent";
+
+const JSON_HEADERS = {
+  "content-type": "application/json; charset=utf-8",
+};
+
+type ProviderCallsRecentEnv = NodeJS.ProcessEnv & {
+  BILLING_LEDGER_AUDIT_SECRET?: string;
+};
+
+export type ProviderCallsRecentStore = {
+  iterator(options: { gte?: string; lte?: string }): AsyncIterable<[string, unknown]>;
+};
+
+const PROVIDER_CALL_PREFIX = "provider-call-";
+const PROVIDER_CALL_RANGE_END = `${PROVIDER_CALL_PREFIX}\uffff`;
+const PROVIDER_DISPATCH_INTENT_PREFIX = "provider-dispatch-intent-";
+const PROVIDER_DISPATCH_INTENT_RANGE_END = `${PROVIDER_DISPATCH_INTENT_PREFIX}\uffff`;
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+
+const parseOptionalTimestamp = (value: string | null) => {
+  if (!value) return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  if (/^\d+$/.test(trimmed)) return Number(trimmed);
+  const parsed = Date.parse(trimmed);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`invalid timestamp: ${value}`);
+  }
+  return parsed;
+};
+
+const parseLimit = (value: string | null) => {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return 50;
+  return Math.min(Math.max(Math.floor(parsed), 1), 500);
+};
+
+const eventTimestamp = (event: ProviderCallEvent) => {
+  if (event.status === "completed") return Date.parse(event.completedAt);
+  if (event.status === "failed") return Date.parse(event.failedAt);
+  return Date.parse(event.startedAt);
+};
+
+const isProviderCallEvent = (value: unknown): value is ProviderCallEvent =>
+  Boolean(
+    value &&
+      typeof value === "object" &&
+      typeof (value as { providerCallId?: unknown }).providerCallId === "string" &&
+      typeof (value as { eventId?: unknown }).eventId === "string" &&
+      typeof (value as { status?: unknown }).status === "string"
+  );
+
+const isProviderDispatchIntent = (value: unknown): value is ProviderDispatchIntent =>
+  Boolean(
+    value &&
+      typeof value === "object" &&
+      typeof (value as { providerCallId?: unknown }).providerCallId === "string" &&
+      typeof (value as { intentId?: unknown }).intentId === "string" &&
+      (value as { status?: unknown }).status === "dispatching"
+  );
+
+const resolveDefaultStore = async (): Promise<ProviderCallsRecentStore> => {
+  const dbModule = await import("../../database/server/db");
+  return dbModule.default as ProviderCallsRecentStore;
+};
+
+export async function buildProviderCallsRecentReport({
+  store,
+  sinceMs,
+  untilMs,
+  limit,
+  dialogId,
+  provider,
+  model,
+}: {
+  store: ProviderCallsRecentStore;
+  sinceMs: number;
+  untilMs: number;
+  limit: number;
+  dialogId?: string;
+  provider?: string;
+  model?: string;
+}) {
+  const byCall = new Map<
+    string,
+    {
+      events: ProviderCallEvent[];
+      dispatchIntents: ProviderDispatchIntent[];
+    }
+  >();
+
+  for await (const [, value] of store.iterator({
+    gte: PROVIDER_CALL_PREFIX,
+    lte: PROVIDER_CALL_RANGE_END,
+  })) {
+    if (!isProviderCallEvent(value)) continue;
+    const timestamp = eventTimestamp(value);
+    if (!Number.isFinite(timestamp) || timestamp < sinceMs || timestamp > untilMs) continue;
+    if (dialogId && value.dialogId !== dialogId) continue;
+    if (provider && value.provider !== provider) continue;
+    if (model && value.model !== model) continue;
+    const existing = byCall.get(value.providerCallId) ?? {
+      events: [],
+      dispatchIntents: [],
+    };
+    existing.events.push(value);
+    byCall.set(value.providerCallId, existing);
+  }
+
+  for await (const [, value] of store.iterator({
+    gte: PROVIDER_DISPATCH_INTENT_PREFIX,
+    lte: PROVIDER_DISPATCH_INTENT_RANGE_END,
+  })) {
+    if (!isProviderDispatchIntent(value)) continue;
+    const existing = byCall.get(value.providerCallId);
+    if (!existing) continue;
+    existing.dispatchIntents.push(value);
+  }
+
+  const rows = Array.from(byCall.entries())
+    .map(([providerCallId, state]) => {
+      const sortedEvents = [...state.events].sort(
+        (a, b) => eventTimestamp(a) - eventTimestamp(b)
+      );
+      const first = sortedEvents[0];
+      const last = sortedEvents[sortedEvents.length - 1];
+      return {
+        providerCallId,
+        userId: first.userId,
+        dialogId: first.dialogId,
+        agentId: first.agentId,
+        provider: first.provider,
+        model: first.model,
+        endpoint: first.endpoint,
+        serviceTier: first.serviceTier,
+        credential: first.credential,
+        startedAt: first.startedAt,
+        lastEventAt: new Date(eventTimestamp(last)).toISOString(),
+        statuses: sortedEvents.map((event) => event.status),
+        billingStatus:
+          last.status === "completed" || last.status === "failed"
+            ? last.billingStatus
+            : undefined,
+        events: sortedEvents.map((event) => ({
+          eventId: event.eventId,
+          status: event.status,
+          timestamp: new Date(eventTimestamp(event)).toISOString(),
+        })),
+        dispatchIntents: state.dispatchIntents
+          .sort((a, b) => Date.parse(a.createdAt) - Date.parse(b.createdAt))
+          .map((intent) => ({
+            intentId: intent.intentId,
+            createdAt: intent.createdAt,
+            credential: intent.credential,
+            request: {
+              url: intent.request.url,
+              method: intent.request.method,
+              bodyHash: intent.request.bodyHash,
+            },
+          })),
+      };
+    })
+    .sort((a, b) => Date.parse(b.lastEventAt) - Date.parse(a.lastEventAt))
+    .slice(0, limit);
+
+  return {
+    sinceMs,
+    untilMs,
+    summary: {
+      providerCallCount: rows.length,
+      eventCount: rows.reduce((sum, row) => sum + row.events.length, 0),
+      dispatchIntentCount: rows.reduce(
+        (sum, row) => sum + row.dispatchIntents.length,
+        0
+      ),
+    },
+    providerCalls: rows,
+  };
+}
+
+export function createProviderCallsRecentHandler({
+  store,
+  env = process.env,
+  nowMs,
+}: {
+  store?: ProviderCallsRecentStore;
+  env?: Partial<ProviderCallsRecentEnv>;
+  nowMs?: number;
+} = {}) {
+  return async function handleProviderCallsRecent(req: Request) {
+    const expectedSecret = String(env.BILLING_LEDGER_AUDIT_SECRET || "").trim();
+    if (!expectedSecret) {
+      return new Response("Not Found", { status: 404 });
+    }
+
+    const providedSecret =
+      req.headers.get("x-billing-ledger-audit-secret")?.trim() || "";
+    if (providedSecret !== expectedSecret) {
+      return json({ success: false, error: "Unauthorized" }, 401);
+    }
+
+    try {
+      const url = new URL(req.url);
+      const now = nowMs ?? Date.now();
+      const untilMs = parseOptionalTimestamp(url.searchParams.get("until")) ?? now;
+      const sinceMs =
+        parseOptionalTimestamp(url.searchParams.get("since")) ?? untilMs - 3600_000;
+      const report = await buildProviderCallsRecentReport({
+        store: store ?? (await resolveDefaultStore()),
+        sinceMs,
+        untilMs,
+        limit: parseLimit(url.searchParams.get("limit")),
+        dialogId: url.searchParams.get("dialogId")?.trim() || undefined,
+        provider: url.searchParams.get("provider")?.trim() || undefined,
+        model: url.searchParams.get("model")?.trim() || undefined,
+      });
+      return json({ success: true, report });
+    } catch (error) {
+      return json(
+        {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        },
+        400
+      );
+    }
+  };
+}
+
+export const handleProviderCallsRecent = createProviderCallsRecentHandler();

package/server/handlers/providerReconciliationRunHandler.ts

@@ -0,0 +1,180 @@
+import { createHash } from "node:crypto";
+import {
+  createBillingAdminAuditEvent,
+  type BillingAdminAuditAction,
+} from "../../ai/token/billingAdminAuditEvent";
+import { writeBillingAdminAuditEvent } from "../../ai/token/billingAdminAuditEventWriter";
+import type { NormalizedOfficialProviderBucket } from "../../ai/token/deepinfraReconciliation";
+import { runProviderReconciliation } from "../../ai/token/providerReconciliationRunner";
+import { ulid } from "ulid";
+
+const JSON_HEADERS = {
+  "content-type": "application/json; charset=utf-8",
+};
+
+type ProviderReconciliationRunEnv = NodeJS.ProcessEnv & {
+  BILLING_LEDGER_AUDIT_SECRET?: string;
+};
+
+type ProviderReconciliationRunStore = Parameters<typeof runProviderReconciliation>[0]["store"];
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+
+const resolveDefaultStore = async (): Promise<ProviderReconciliationRunStore> => {
+  const dbModule = await import("../../database/server/db");
+  return dbModule.default as ProviderReconciliationRunStore;
+};
+
+const ALLOWED_PROVIDERS = new Set(["deepinfra", "openai"]);
+
+const stableStringify = (value: unknown): string => {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const record = value as Record<string, unknown>;
+  return `{${Object.keys(record)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`)
+    .join(",")}}`;
+};
+
+const buildInputHash = (officialBuckets: NormalizedOfficialProviderBucket[]) =>
+  `sha256:${createHash("sha256")
+    .update(stableStringify(officialBuckets))
+    .digest("hex")}`;
+
+const isOfficialBucket = (value: unknown): value is NormalizedOfficialProviderBucket => {
+  if (!value || typeof value !== "object") return false;
+  const bucket = value as NormalizedOfficialProviderBucket;
+  return (
+    typeof bucket.provider === "string" &&
+    typeof bucket.bucketStart === "string" &&
+    typeof bucket.bucketEnd === "string" &&
+    Boolean(bucket.official) &&
+    typeof bucket.official.rawProviderCostUsd === "number" &&
+    typeof bucket.official.inputTokens === "number" &&
+    typeof bucket.official.outputTokens === "number" &&
+    typeof bucket.official.requestCount === "number"
+  );
+};
+
+export function createProviderReconciliationRunHandler({
+  store,
+  env = process.env,
+  now = () => new Date().toISOString(),
+  createEventId = () => `evt_${ulid()}`,
+}: {
+  store?: ProviderReconciliationRunStore;
+  env?: Partial<ProviderReconciliationRunEnv>;
+  now?: () => string;
+  createEventId?: () => string;
+} = {}) {
+  return async function handleProviderReconciliationRun(req: Request) {
+    const expectedSecret = String(env.BILLING_LEDGER_AUDIT_SECRET || "").trim();
+    if (!expectedSecret) {
+      return new Response("Not Found", { status: 404 });
+    }
+
+    const providedSecret =
+      req.headers.get("x-billing-ledger-audit-secret")?.trim() || "";
+    if (providedSecret !== expectedSecret) {
+      return json({ success: false, error: "Unauthorized" }, 401);
+    }
+
+    if (req.method !== "POST") {
+      return json({ success: false, error: "Method Not Allowed" }, 405);
+    }
+
+    try {
+      const payload = await req.json();
+      const officialBuckets = Array.isArray(payload?.officialBuckets)
+        ? payload.officialBuckets
+        : [];
+      if (officialBuckets.length === 0) {
+        throw new Error("officialBuckets must be a non-empty array");
+      }
+      if (!officialBuckets.every(isOfficialBucket)) {
+        throw new Error("officialBuckets contains invalid bucket records");
+      }
+      const provider = typeof payload.provider === "string" ? payload.provider.trim() : "";
+      if (!provider || !ALLOWED_PROVIDERS.has(provider)) {
+        throw new Error("provider must be one of: deepinfra, openai");
+      }
+      if (!officialBuckets.every((bucket) => bucket.provider === provider)) {
+        throw new Error("officialBuckets provider must match provider");
+      }
+
+      const inputHash = buildInputHash(officialBuckets);
+      const targetStore = store ?? (await resolveDefaultStore());
+      const dryRun = payload.dryRun === true;
+      const createdAt = typeof payload.createdAt === "string" ? payload.createdAt : now();
+      const preview = await runProviderReconciliation({
+        store: targetStore,
+        officialBuckets,
+        createdAt,
+        dryRun: true,
+      });
+
+      if (!dryRun) {
+        if (payload.confirmCommit !== true) {
+          throw new Error("confirmCommit must be true for non-dry-run reconciliation");
+        }
+        if (payload.inputHash !== inputHash) {
+          throw new Error("inputHash must match the officialBuckets hash");
+        }
+        const maxRiskCredits = Number(payload.maxRiskCredits);
+        if (!Number.isFinite(maxRiskCredits) || maxRiskCredits < 0) {
+          throw new Error("maxRiskCredits must be a non-negative number");
+        }
+        if (preview.riskPlatformCreditsProposed > maxRiskCredits) {
+          throw new Error("maxRiskCredits is below projected reconciliation risk");
+        }
+      }
+
+      const result = dryRun
+        ? preview
+        : await runProviderReconciliation({
+            store: targetStore,
+            officialBuckets,
+            createdAt,
+            dryRun: false,
+          });
+      const action: BillingAdminAuditAction = dryRun
+        ? "reconciliation_dry_run"
+        : "reconciliation_committed";
+      await writeBillingAdminAuditEvent({
+        store: targetStore,
+        event: createBillingAdminAuditEvent({
+          eventId: createEventId(),
+          actorId:
+            typeof payload.actorId === "string" && payload.actorId.trim()
+              ? payload.actorId
+              : "billing-admin-api",
+          action,
+          anomalyId: "provider-reconciliation",
+          planId: `provider-reconciliation:${provider}`,
+          inputSetHash: inputHash,
+          createdAt,
+          reason: JSON.stringify({
+            provider,
+            dryRun,
+            bucketCount: officialBuckets.length,
+            riskPlatformCreditsProposed: preview.riskPlatformCreditsProposed,
+          }),
+        }),
+      });
+
+      return json({ success: true, inputHash, result });
+    } catch (error) {
+      return json(
+        {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        },
+        400
+      );
+    }
+  };
+}
+
+export const handleProviderReconciliationRun = createProviderReconciliationRunHandler();