nolo-cli 0.1.30 → 0.1.31

package/agent-runtime/shellCommandPolicy.ts

@@ -0,0 +1,117 @@
+export type ShellCommandPolicyVerdict = "allowed" | "forbidden";
+
+export type ShellCommandPolicyResult =
+  | {
+      verdict: "allowed";
+    }
+  | {
+      verdict: "forbidden";
+      code: "destructive_action_requires_confirmation";
+      reason: string;
+      policy: {
+        capability: "destructive_action";
+        target: "shell_command";
+        detail: string;
+      };
+    };
+
+const DESTRUCTIVE_NEGATION_PATTERNS = [
+  "别删",
+  "别删除",
+  "不要删",
+  "不要删除",
+  "别乱删",
+  "别动",
+  "不要动",
+  "不要清理",
+  "不要清空",
+  "不要重置",
+  "don't delete",
+  "do not delete",
+  "don't remove",
+  "do not remove",
+  "without deleting",
+] as const;
+
+const EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS = [
+  "删除",
+  "删掉",
+  "移除",
+  "清理",
+  "清空",
+  "重置",
+  "drop",
+  "delete",
+  "remove",
+  "erase",
+  "clean up",
+  "reset",
+] as const;
+
+const SHELL_DESTRUCTIVE_PATTERNS = [
+  /\brm\s+(-[^\n\r]*\s+)?/i,
+  /\bremove-item\b/i,
+  /\bdel\s+\/?[a-z]*\s+/i,
+  /\berase\s+/i,
+  /\brmdir\s+/i,
+  /\brd\s+\/s\b/i,
+  /\bgit\s+reset\s+(--hard\b|--merge\b|--keep\b)/i,
+  /\bgit\s+clean\s+-[^\n\r]*f/i,
+  /\bgit\s+checkout\s+--\b/i,
+  /\bgit\s+restore\s+--source=/i,
+] as const;
+
+const normalizeUserInput = (value: unknown): string =>
+  typeof value === "string" ? value.trim().toLowerCase() : "";
+
+const containsAny = (text: string, patterns: readonly string[]): boolean =>
+  patterns.some((pattern) => text.includes(pattern));
+
+const hasExplicitDestructivePermission = (userInput: unknown): boolean => {
+  const normalized = normalizeUserInput(userInput);
+  if (!normalized) return false;
+  if (containsAny(normalized, DESTRUCTIVE_NEGATION_PATTERNS)) return false;
+  return containsAny(normalized, EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS);
+};
+
+const buildCombinedShellInput = (args: {
+  command?: unknown;
+  input?: unknown;
+}): string =>
+  [
+    typeof args.command === "string" ? args.command : "",
+    typeof args.input === "string" ? args.input : "",
+  ]
+    .filter(Boolean)
+    .join("\n");
+
+export function isDestructiveShellCommand(args: {
+  command?: unknown;
+  input?: unknown;
+}): boolean {
+  const combined = buildCombinedShellInput(args);
+  if (!combined.trim()) return false;
+  return SHELL_DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(combined));
+}
+
+export function evaluateShellCommandPolicy(args: {
+  command?: unknown;
+  input?: unknown;
+  userInput?: unknown;
+}): ShellCommandPolicyResult {
+  if (isDestructiveShellCommand(args) && !hasExplicitDestructivePermission(args.userInput)) {
+    return {
+      verdict: "forbidden",
+      code: "destructive_action_requires_confirmation",
+      reason:
+        "当前运行默认禁止自动执行可能删除用户内容的 shell 命令。只有当用户在当前请求里明确要求删除/清理时，才能继续；否则请停止并先说明限制。",
+      policy: {
+        capability: "destructive_action",
+        target: "shell_command",
+        detail: "execShell destructive command",
+      },
+    };
+  }
+
+  return { verdict: "allowed" };
+}

package/agent-runtime/toolGate.ts

@@ -0,0 +1,38 @@
+import { canonicalizeToolName } from "../ai/tools/toolNameAliases";
+
+export type RuntimeToolGateDecision =
+  | { allowed: true; toolName: string }
+  | { allowed: false; toolName: string; reason: string };
+
+function normalizeExposedToolNames(toolNames?: string[]): Set<string> {
+  return new Set(
+    (toolNames ?? [])
+      .map((toolName) => canonicalizeToolName(String(toolName ?? "").replace(/^functions\./, "").trim()))
+      .filter(Boolean),
+  );
+}
+
+export function resolveRuntimeToolGate(args: {
+  toolName: string;
+  exposedToolNames?: string[];
+  forbiddenReason?: string;
+}): RuntimeToolGateDecision {
+  const toolName = canonicalizeToolName(args.toolName.replace(/^functions\./, "").trim());
+  if (!toolName) {
+    return {
+      allowed: false,
+      toolName,
+      reason: "Tool name is required.",
+    };
+  }
+
+  if (normalizeExposedToolNames(args.exposedToolNames).has(toolName)) {
+    return { allowed: true, toolName };
+  }
+
+  return {
+    allowed: false,
+    toolName,
+    reason: args.forbiddenReason ?? `${toolName} is not exposed by this runtime turn.`,
+  };
+}

package/agentRecordCommands.ts

@@ -17,7 +17,7 @@ export async function runAgentReadCommand(
   const output = deps.output ?? process.stdout;
   const agentInput = args[0]?.trim();
   if (!agentInput || agentInput === "--help" || agentInput === "-h") {
-    output.write("Usage: nolo agent read <agent>\n");
+    output.write("Usage: nolo agent read <agent> [--server <url>]\n");
     return agentInput ? 0 : 1;
   }
 

package/agentRecordHelpers.ts

@@ -3,6 +3,7 @@ import { resolveCliAgentKeyInput } from "./agentAliases";
 import type { CliKvDb } from "./client/hybridRecordStore";
 import { buildLocalAgentLookupKeys, shouldReadAgentKeyRemotely } from "./client/localAgentRecords";
 import {
+  hasExplicitServerOverride,
   parseUserIdFromAuthToken,
   readOption,
   resolveAuthToken,
@@ -270,27 +271,13 @@ export async function resolveAgentRecordFromHybridStore(args: {
 }) {
   const agentKey = resolveCliAgentKeyInput(args.agentInput);
   const authToken = resolveAuthToken(args.cliArgs ?? [], args.env);
-  const defaultServerUrl = resolveServerUrl(args.cliArgs ?? [], args.env);
+  const cliArgs = args.cliArgs ?? [];
+  const defaultServerUrl = resolveServerUrl(cliArgs, args.env);
+  const serverCandidates = resolveServerCandidates(cliArgs, args.env, defaultServerUrl);
+  const preferRemote = hasExplicitServerOverride(cliArgs);
 
-  for (const key of buildLocalAgentLookupKeys({
-    agentRef: agentKey,
-    userId: parseUserIdFromAuthToken(authToken) || "local",
-  })) {
-    try {
-      const record = await args.db.get(key);
-      if (record && typeof record === "object") {
-        return {
-          agentKey: key,
-          record,
-          source: record?.serverOrigin ? "remote-cache" : "local-cache",
-        } as const;
-      }
-    } catch {
-      // local miss
-    }
-
-    if (!shouldReadAgentKeyRemotely(key)) continue;
-    for (const serverUrl of resolveServerCandidates(args.cliArgs ?? [], args.env, defaultServerUrl)) {
+  const readRemoteRecord = async (key: string) => {
+    for (const serverUrl of serverCandidates) {
       try {
         const remoteRecord = await readAgentRecord({
           agentKey: key,
@@ -310,6 +297,34 @@ export async function resolveAgentRecordFromHybridStore(args: {
         // try next
       }
     }
+    return null;
+  };
+
+  for (const key of buildLocalAgentLookupKeys({
+    agentRef: agentKey,
+    userId: parseUserIdFromAuthToken(authToken) || "local",
+  })) {
+    if (preferRemote && shouldReadAgentKeyRemotely(key)) {
+      const remoteFirst = await readRemoteRecord(key);
+      if (remoteFirst) return remoteFirst;
+    }
+
+    try {
+      const record = await args.db.get(key);
+      if (record && typeof record === "object") {
+        return {
+          agentKey: key,
+          record,
+          source: record?.serverOrigin ? "remote-cache" : "local-cache",
+        } as const;
+      }
+    } catch {
+      // local miss
+    }
+
+    if (!shouldReadAgentKeyRemotely(key)) continue;
+    const remoteFallback = await readRemoteRecord(key);
+    if (remoteFallback) return remoteFallback;
   }
 
   return null;

package/agentRunParsing.ts

@@ -1,6 +1,10 @@
 import { existsSync, readFileSync } from "node:fs";
 import { extname, resolve } from "node:path";
 
+import {
+  buildAgentRunDialogLineageFields,
+  normalizeAgentRunDialogLineage,
+} from "./ai/agent/agentRunDialogLineage";
 import { parseSkillDocProtocol, type WorkflowReferenceConfig } from "./ai/skills/skillDocProtocol";
 
 import { resolveCliAgentKeyInput } from "./agentAliases";
@@ -168,7 +172,10 @@ export function parseAgentRunArgs(
   if (!agentKey || !rawMessage.trim()) return null;
   const message = rawMessage.trim();
   const runtimeMode = runtimeModeFromArgs(args);
-  const continueDialogId = readFlagValue(args, "--continue") ?? readFlagValue(args, "--dialog");
+  const rawContinueDialogId = readFlagValue(args, "--continue") ?? readFlagValue(args, "--dialog");
+  const continueDialogId = normalizeAgentRunDialogLineage({
+    continueDialogId: rawContinueDialogId,
+  }).continueDialogId;
   const spaceId = readFlagValue(args, "--space");
   const category = readFlagValue(args, "--category");
   const inheritedFromDialog = readFlagValue(args, "--inherit-from-dialog");
@@ -219,11 +226,17 @@ export function parseAgentRunArgs(
     background: args.includes("--bg"),
     noStream: args.includes("--no-stream"),
     noDefaultTestRoot,
-    ...(continueDialogId ? { continueDialogId } : {}),
+    ...buildAgentRunDialogLineageFields({
+      continueDialogId,
+      inheritedFromDialogKey: inheritedRef?.dialogKey,
+      parentDialogId: inheritedRef?.dialogId,
+    }),
     ...(!continueDialogId && spaceId ? { spaceId } : {}),
-    ...(category ? { category } : !continueDialogId && !noDefaultTestRoot ? { category: DEFAULT_TEST_DIALOG_CATEGORY_ID } : {}),
-    ...(inheritedRef?.dialogKey ? { inheritedFromDialogKey: inheritedRef.dialogKey } : {}),
-    ...(inheritedRef?.dialogId ? { parentDialogId: inheritedRef.dialogId } : {}),
+    ...(category
+      ? { category }
+      : !continueDialogId && !noDefaultTestRoot
+        ? { category: DEFAULT_TEST_DIALOG_CATEGORY_ID }
+        : {}),
     ...(cwd ? { cwd } : {}),
     ...(typeof maxToolRounds === "number" ? { maxToolRounds } : {}),
     ...(typeof timeoutMs === "number" ? { timeoutMs } : {}),

package/agentRuntimeLocal.ts

@@ -1,7 +1,9 @@
 export {
+  createHostRuntimeConfig,
   buildOpenAiCompatibleChatCompletionRequest,
   buildPlatformChatCompletionRequest,
   canUsePlatformChatProvider,
+  createHostRuntimeCapabilities,
   hasDirectOpenAiCompatibleProvider,
   createHybridRecordStore,
   executeLocalToolWithPolicy,
@@ -16,9 +18,12 @@ export {
   parsePlatformChatCompletionData,
   parsePlatformChatCompletionResponse,
   resolveAgentRuntimeConfigFromRecord,
+  resolveHostRuntimeConfigFromEnv,
+  resolveHostRuntimeCapabilitiesFromEnv,
   resolvePlatformChatProviderConfig,
   resolveLocalToolPolicy,
   resolveOpenAiCompatibleProviderConfig,
+  resolveRequestedRuntimeToolNames,
   shouldUsePlatformChatProvider,
   shouldCacheHybridRemoteRecord,
   shouldFetchAgentRuntimeRecordRemotely,
@@ -27,6 +32,7 @@ export { runLocalAgentTurn } from "./agent-runtime/localLoop";
 export {
   buildLocalWorkspaceOpenAiTools,
   buildLocalWorkspacePolicyToolNames,
+  resolveLocalWorkspaceShellToolExposure,
   buildLocalWorkspaceToolset,
   createLocalWorkspaceToolExecutors,
 } from "./agent-runtime/localWorkspaceTools";
@@ -35,6 +41,10 @@ export type {
   AgentRuntimeHostAdapter,
   AgentRuntimeRequestedMode,
   AgentRuntimeSaveTurnInput,
+  HostRuntimeConfig,
+  HostRuntimeCapabilities,
+  HostRuntimeSurface,
+  HostRuntimeWorkspaceBinding,
   HybridRecordKvDb,
   HybridRecordStore,
   LocalToolPolicyDecision,

package/ai/agent/agentRunDialogLineage.ts

@@ -0,0 +1,56 @@
+export type AgentRunDialogLineageInput = {
+  continueDialogId?: string | null;
+  inheritedFromDialogKey?: string | null;
+  parentDialogId?: string | null;
+};
+
+export type NormalizedAgentRunDialogLineage = {
+  continueDialogId?: string;
+  inheritedFromDialogKey?: string;
+  parentDialogId?: string;
+  hasAuthoritativeContinueDialog: boolean;
+  hasConflictingLineage: boolean;
+};
+
+function pickOptionalString(value: unknown) {
+  if (typeof value !== "string") return undefined;
+  const normalized = value.trim();
+  return normalized.length > 0 ? normalized : undefined;
+}
+
+export function hasAuthoritativeContinueDialogId(value: unknown) {
+  return pickOptionalString(value) !== undefined;
+}
+
+export function normalizeAgentRunDialogLineage(
+  input: AgentRunDialogLineageInput
+): NormalizedAgentRunDialogLineage {
+  const continueDialogId = pickOptionalString(input.continueDialogId);
+  const inheritedFromDialogKey = pickOptionalString(input.inheritedFromDialogKey);
+  const parentDialogId = pickOptionalString(input.parentDialogId);
+  const hasAuthoritativeContinueDialog = hasAuthoritativeContinueDialogId(continueDialogId);
+
+  return {
+    continueDialogId,
+    inheritedFromDialogKey: hasAuthoritativeContinueDialog ? undefined : inheritedFromDialogKey,
+    parentDialogId: hasAuthoritativeContinueDialog ? undefined : parentDialogId,
+    hasAuthoritativeContinueDialog,
+    hasConflictingLineage:
+      hasAuthoritativeContinueDialog && Boolean(inheritedFromDialogKey || parentDialogId),
+  };
+}
+
+export function buildAgentRunDialogLineageFields(
+  input: AgentRunDialogLineageInput
+): Pick<AgentRunDialogLineageInput, "continueDialogId" | "inheritedFromDialogKey" | "parentDialogId"> {
+  const normalized = normalizeAgentRunDialogLineage(input);
+  return {
+    ...(hasAuthoritativeContinueDialogId(normalized.continueDialogId)
+      ? { continueDialogId: normalized.continueDialogId }
+      : {}),
+    ...(normalized.inheritedFromDialogKey
+      ? { inheritedFromDialogKey: normalized.inheritedFromDialogKey }
+      : {}),
+    ...(normalized.parentDialogId ? { parentDialogId: normalized.parentDialogId } : {}),
+  };
+}

package/ai/agent/agentSlice.ts

@@ -79,6 +79,24 @@ const normalizeAgentReferences = (references: any[]): ReferenceItem[] => {
   }));
 };
 
+const isLocalProviderUrl = (value: unknown) => {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  if (!normalized) return false;
+  try {
+    const hostname = new URL(normalized).hostname.toLowerCase();
+    return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1";
+  } catch {
+    return false;
+  }
+};
+
+const shouldPersistMachineBinding = (args: {
+  apiSource?: string;
+  customProviderUrl?: unknown;
+}) =>
+  args.apiSource === "cli" ||
+  (args.apiSource === "custom" && isLocalProviderUrl(args.customProviderUrl));
+
 /**
  * 创建场景：表单数据 -> 持久化数据（全量）
  */
@@ -104,7 +122,10 @@ const processAgentCreateForm = (formData: AgentFormData, userId: string) => {
   };
 
   delete result.machineId;
-  if (formData.apiSource === "cli" && machineId) {
+  if (machineId && shouldPersistMachineBinding({
+    apiSource: formData.apiSource,
+    customProviderUrl: formData.customProviderUrl,
+  })) {
     const binding: AgentRuntimeBinding = {
       ...(result.runtimeBinding && typeof result.runtimeBinding === "object"
         ? result.runtimeBinding
@@ -165,14 +186,22 @@ const processAgentUpdateChanges = (
   }
   if ("machineId" in data) {
     const machineId = String((data as any).machineId ?? "").trim();
-    
-    // Determine effective apiSource: prefer data.apiSource, fall back to previousAgent.apiSource
+
+    // Determine effective runtime source: prefer form data, fall back to previous agent config
     const effectiveApiSource = data.apiSource ?? previousAgent?.apiSource;
-    
+    const effectiveCustomProviderUrl =
+      data.customProviderUrl ?? previousAgent?.customProviderUrl;
+
     if (machineId) {
-      // Persist runtimeBinding when effective apiSource is 'cli' or undefined
-      // undefined = tool/legacy partial update without apiSource context → preserve backward compatibility
-      if (effectiveApiSource === "cli" || effectiveApiSource === undefined) {
+      // Persist runtimeBinding for CLI agents and localhost custom providers.
+      // undefined apiSource keeps backward compatibility for legacy partial updates.
+      if (
+        effectiveApiSource === undefined ||
+        shouldPersistMachineBinding({
+          apiSource: effectiveApiSource,
+          customProviderUrl: effectiveCustomProviderUrl,
+        })
+      ) {
         const binding: AgentRuntimeBinding = {
           ...((changes.runtimeBinding && typeof changes.runtimeBinding === "object")
             ? changes.runtimeBinding
@@ -182,10 +211,16 @@ const processAgentUpdateChanges = (
         };
         changes.runtimeBinding = binding;
       }
-      // If apiSource is explicitly non-cli and machineId is supplied, do not create binding
+      // If apiSource is explicitly incompatible with machine binding, do not create binding
     } else {
-      // CLEAR branch: clear runtimeBinding when effectiveApiSource is 'cli' or undefined (backward-compatible)
-      if (effectiveApiSource === "cli" || effectiveApiSource === undefined) {
+      // CLEAR branch: clear runtimeBinding when the effective runtime shape can be machine-bound.
+      if (
+        effectiveApiSource === undefined ||
+        shouldPersistMachineBinding({
+          apiSource: effectiveApiSource,
+          customProviderUrl: effectiveCustomProviderUrl,
+        })
+      ) {
         changes.runtimeBinding = null;
       }
     }

package/ai/agent/avatarUtils.ts

@@ -12,7 +12,7 @@ export function resolveAvatarUrl(
   avatarFileId: string | undefined | null,
   server: string | undefined | null
 ): string | null {
-  if (!avatarFileId) return null;
+  if (!avatarFileId || avatarFileId === "briefcase") return null;
   if (avatarFileId.startsWith("http") || avatarFileId.startsWith("blob:")) {
     return avatarFileId;
   }

package/ai/agent/buildSystemPrompt.ts

@@ -98,8 +98,7 @@ const AGENT_ORCHESTRATION_INSTRUCTIONS = `--- Agent 编排与协作 ---
 你所在的系统支持多个子 Agent 和工作流工具，请把自己视为"总协调者"：
 
 1）子 Agent 协作
-- 如果目标 Agent 记录已经声明 delegation.serverBase / runtimeServerBase，工具会自动路由到对应 nolo server；你不需要重复填写 serverBase。
-- 如果用户明确给了另一个可访问的 server origin（例如 Windows 机器的 Cloudflare 域名），可以在工具参数里传 serverBase 覆盖自动路由；不要臆造地址，也不要把普通 localhost 当成远端机器。
+- 如果用户明确给了另一个可访问的 server origin（例如 Windows 机器的 Cloudflare 域名），可以在工具参数里显式传 serverBase 把调用发到那台 server；不要臆造地址，也不要把普通 localhost 当成远端机器。
 - 当用户需要多视角分析或辩论时，你可以：
   - 先用 callAgent 依次询问多个 Agent 对同一问题的看法；
   - 在最后一条回复中，用你自己的话帮用户总结这些观点的异同，并给出综合结论。