nolo-cli 0.1.33 → 0.1.34

package/cli/cliEnvHelpers.ts

@@ -3,19 +3,17 @@ import { NOLO_CLUSTER_SERVERS } from "../database/config";
 
 export type EnvLike = Record<string, string | undefined>;
 
-export function resolveServerUrl(env: EnvLike) {
+export function resolveServerUrlFromEnv(env: EnvLike) {
   return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
 }
 
-export function resolveServerCandidates(env: EnvLike, preferred?: string | null) {
-  const values = [
-    preferred?.trim(),
-    env.NOLO_SERVER,
-    env.BASE_URL,
-    env.NOLO_SERVER_URL,
-    DEFAULT_NOLO_SERVER_URL,
-    ...NOLO_CLUSTER_SERVERS,
-  ];
+type ResolverInput = string[] | EnvLike;
+
+function isCliArgs(value: ResolverInput): value is string[] {
+  return Array.isArray(value);
+}
+
+function buildServerCandidates(values: Array<string | null | undefined>) {
   return [...new Set(
     values
       .filter((value): value is string => typeof value === "string" && value.trim().length > 0)
@@ -23,8 +21,78 @@ export function resolveServerCandidates(env: EnvLike, preferred?: string | null)
   )];
 }
 
-export function resolveAuthToken(env: EnvLike) {
-  return env.AUTH_TOKEN || env.AUTH || "";
+export function resolveServerUrl(env: EnvLike): string;
+export function resolveServerUrl(args: string[], env: EnvLike): string;
+export function resolveServerUrl(input: ResolverInput, env?: EnvLike) {
+  if (isCliArgs(input)) {
+    const explicit =
+      readOption(input, "--server-url") ||
+      readOption(input, "--server");
+    return explicit?.replace(/\/+$/, "") || resolveServerUrlFromEnv(env ?? {});
+  }
+  return resolveServerUrlFromEnv(input);
+}
+
+export function resolveServerCandidates(env: EnvLike, preferred?: string | null): string[];
+export function resolveServerCandidates(
+  args: string[],
+  env: EnvLike,
+  preferred?: string | null,
+): string[];
+export function resolveServerCandidates(
+  input: ResolverInput,
+  envOrPreferred?: EnvLike | string | null,
+  preferred?: string | null,
+) {
+  if (isCliArgs(input)) {
+    const env = (envOrPreferred ?? {}) as EnvLike;
+    const explicitServer = resolveServerUrl(input, env);
+    return buildServerCandidates([
+      explicitServer,
+      preferred?.trim(),
+      env.NOLO_SERVER,
+      env.BASE_URL,
+      env.NOLO_SERVER_URL,
+      DEFAULT_NOLO_SERVER_URL,
+      ...NOLO_CLUSTER_SERVERS,
+    ]);
+  }
+
+  const env = input;
+  return buildServerCandidates([
+    typeof envOrPreferred === "string" ? envOrPreferred.trim() : undefined,
+    env.NOLO_SERVER,
+    env.BASE_URL,
+    env.NOLO_SERVER_URL,
+    DEFAULT_NOLO_SERVER_URL,
+    ...NOLO_CLUSTER_SERVERS,
+  ]);
+}
+
+export function resolveAuthTokenFromEnv(env: EnvLike, extraEnvKeys: string[] = []) {
+  for (const key of ["AUTH_TOKEN", "AUTH", ...extraEnvKeys]) {
+    const value = env[key];
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return "";
+}
+
+export function resolveAuthToken(env: EnvLike, extraEnvKeys?: string[]): string;
+export function resolveAuthToken(args: string[], env: EnvLike, extraEnvKeys?: string[]): string;
+export function resolveAuthToken(
+  input: ResolverInput,
+  envOrExtraEnvKeys?: EnvLike | string[],
+  extraEnvKeys: string[] = [],
+) {
+  if (isCliArgs(input)) {
+    const env = (envOrExtraEnvKeys ?? {}) as EnvLike;
+    return (
+      readOption(input, "--token") ||
+      readOption(input, "--machine-key") ||
+      resolveAuthTokenFromEnv(env, extraEnvKeys)
+    );
+  }
+  return resolveAuthTokenFromEnv(input, (envOrExtraEnvKeys as string[] | undefined) ?? []);
 }
 
 export function parseUserIdFromAuthToken(token: string) {

package/cli/client/agentRun.ts

@@ -778,6 +778,7 @@ async function runLocalAgentTurnForCli(
       background: options.background,
       noStream: options.noStream,
       maxToolRounds: options.maxToolRounds,
+      ...(typeof options.timeoutMs === "number" ? { timeoutMs: options.timeoutMs } : {}),
       ...(traceLocalTools || collectToolEvidence
         ? {
             onToolEvent: (event) => {

package/cli/client/localRuntimeAdapter.ts

@@ -16,6 +16,7 @@ import {
   parsePlatformChatCompletionData,
   parsePlatformChatCompletionResponse,
   resolvePlatformChatProviderConfig,
+  resolveRequestedRuntimeToolNames,
   shouldUsePlatformChatProvider,
 } from "../agentRuntimeLocal";
 import type { AgentRuntimeChatMessage } from "../../agent-runtime";
@@ -169,6 +170,12 @@ async function defaultLoopbackRequest(input: FetchInput, init?: FetchInit) {
       });
     });
     req.on("error", reject);
+    init?.signal?.addEventListener("abort", () => {
+      req.destroy(
+        init.signal?.reason instanceof Error ? init.signal.reason : new Error("request aborted")
+      );
+      reject(init.signal?.reason ?? new Error("request aborted"));
+    }, { once: true });
     if (body) req.write(body);
     req.end();
   });
@@ -191,6 +198,7 @@ async function fetchWithTransientRetry(
       }
       return await fetchImpl(input, init);
     } catch (error) {
+      if (init?.signal?.aborted) throw error;
       if (!isTransientFetchError(error)) throw error;
       lastError = error;
       if (attempt < TRANSIENT_FETCH_MAX_ATTEMPTS) {
@@ -201,6 +209,18 @@ async function fetchWithTransientRetry(
   throw lastError;
 }
 
+function buildRequestTimeoutSignal(timeoutMs?: number) {
+  if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    return undefined;
+  }
+  if (typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function") {
+    return AbortSignal.timeout(timeoutMs);
+  }
+  const controller = new AbortController();
+  setTimeout(() => controller.abort(new Error(`request timed out after ${timeoutMs}ms`)), timeoutMs);
+  return controller.signal;
+}
+
 function buildOpenAiTools(args: { toolNames?: string[]; env: EnvLike }) {
   const toolset = buildLocalWorkspaceToolsetForEnv(args);
   return [
@@ -428,8 +448,11 @@ export function createCliLocalRuntimeAdapter(
         store: await resolveStore(deps),
         userId,
       });
+      const requestedToolNames = agentConfig
+        ? resolveRequestedRuntimeToolNames({ agentConfig })
+        : [];
       activeAgentToolNames = buildLocalPolicyToolNames({
-        toolNames: agentConfig?.toolNames,
+        toolNames: requestedToolNames,
         env: deps.env,
       });
       await activateAgentWorkspaceSession({ agentRef, agentConfig });
@@ -455,9 +478,12 @@ export function createCliLocalRuntimeAdapter(
         });
         return {
           model: providerConfig.model,
-          complete: async (messages) => {
+          complete: async (messages, options) => {
+            const requestedToolNames = resolveRequestedRuntimeToolNames({
+              agentConfig,
+            });
             const tools = buildOpenAiTools({
-              toolNames: agentConfig.toolNames,
+              toolNames: requestedToolNames,
               env: deps.env,
             });
             const request = buildPlatformChatCompletionRequest({
@@ -465,7 +491,11 @@ export function createCliLocalRuntimeAdapter(
               messages,
               tools,
             });
-            const res = await fetchWithTransientRetry(fetchImpl, request.url, request.init, {
+            const signal = buildRequestTimeoutSignal(options?.timeoutMs);
+            const res = await fetchWithTransientRetry(fetchImpl, request.url, {
+              ...request.init,
+              ...(signal ? { signal } : {}),
+            }, {
               sleep: deps.sleep,
               loopbackRequest,
             });
@@ -488,9 +518,12 @@ export function createCliLocalRuntimeAdapter(
       });
       return {
         model: providerConfig.model,
-        complete: async (messages) => {
+        complete: async (messages, options) => {
+          const requestedToolNames = resolveRequestedRuntimeToolNames({
+            agentConfig,
+          });
           const tools = buildOpenAiTools({
-            toolNames: agentConfig.toolNames,
+            toolNames: requestedToolNames,
             env: deps.env,
           });
           const request = buildOpenAiCompatibleChatCompletionRequest({
@@ -498,7 +531,11 @@ export function createCliLocalRuntimeAdapter(
             messages,
             tools,
           });
-          const res = await fetchWithTransientRetry(fetchImpl, request.url, request.init, {
+          const signal = buildRequestTimeoutSignal(options?.timeoutMs);
+          const res = await fetchWithTransientRetry(fetchImpl, request.url, {
+            ...request.init,
+            ...(signal ? { signal } : {}),
+          }, {
             sleep: deps.sleep,
             loopbackRequest,
           });

package/cli/commandRegistry.ts

@@ -49,8 +49,8 @@ export function renderHelpText() {
     "  nolo connect",
     "  nolo connect --watch",
     "  nolo connect --ws",
-    "  nolo connect --ws --server-url https://api.nolo.chat --api-key sk_machine_xxx",
-    "  nolo connect --daemon --server-url https://api.nolo.chat --api-key sk_machine_xxx",
+    "  nolo connect --ws --server-url https://api.nolo.chat --machine-key sk_machine_xxx",
+    "  nolo connect --daemon --server-url https://api.nolo.chat --machine-key sk_machine_xxx",
     "  nolo machine status",
     "  nolo doctor",
     "  nolo doctor runtime",

package/cli/machineCommands.ts

@@ -95,7 +95,7 @@ function resolveConnectServerUrl(args: string[], env: EnvLike) {
 }
 
 function resolveConnectAuthToken(args: string[], env: EnvLike) {
-  return readOption(args, "--api-key") || readOption(args, "--token") || resolveAuthToken(env);
+  return readOption(args, "--machine-key") || readOption(args, "--token") || resolveAuthToken(env);
 }
 
 const defaultSleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));

package/cli/machineWsRunDispatch.ts

@@ -148,6 +148,7 @@ function hasExplicitMachinePermissions(agentConfig: any) {
 
 function runtimeWorkspacePermissionPolicy(
   runtimePolicy: ConnectorRuntimePolicy | undefined,
+  runtimeEnv: EnvLike,
   cwd: string
 ): PermissionPolicy | null {
   if (!requestsTaskWorktree(runtimePolicy)) return null;
@@ -155,7 +156,10 @@ function runtimeWorkspacePermissionPolicy(
     mode: "full_access",
     allowFilesystemRead: true,
     allowFilesystemWrite: true,
-    allowShell: runtimePolicy?.shell?.enabled !== false,
+    allowShell:
+      ["worktree", "dangerous", "1", "true"].includes(runtimeEnv.NOLO_LOCAL_SHELL_MODE || "") &&
+      Array.isArray(runtimePolicy?.runtimeTools) &&
+      runtimePolicy.runtimeTools.includes("execShell"),
     writableRoots: [cwd],
   };
 }
@@ -445,7 +449,7 @@ export async function handleConnectorRunMessage(
         artifactCwd = prepared.path;
       }
       const runtimePermissionPolicy = !hasExplicitMachinePermissions(agentConfig)
-        ? runtimeWorkspacePermissionPolicy(runtimePolicy, cwd)
+        ? runtimeWorkspacePermissionPolicy(runtimePolicy, runtimeEnv, cwd)
         : null;
       const effectivePermissionPolicy = scopePermissionPolicyToRuntimeWorkspace(
         runtimePermissionPolicy ?? machinePermissionPolicy,
@@ -499,21 +503,37 @@ export async function handleConnectorRunMessage(
       const heartbeat = setInterval(() => {
         sendProgress({
           ...progressBase,
-          message: "cli-running",
+        message: "cli-running",
           updatedAt: Date.now(),
         });
       }, 15_000);
+      const effectiveRuntimeEnv = withForwardedUserAuthToken(runtimeEnv, parsed);
       const result = await executeCli(provider, materializedPrompt.prompt, {
         model: agentConfig.model || undefined,
         timeout,
         cwd,
         yolo: true,
         env: {
-          NOLO_SERVER: runtimeEnv.NOLO_SERVER || runtimeEnv.NOLO_SERVER_URL || runtimeEnv.BASE_URL,
-          NOLO_SERVER_URL: runtimeEnv.NOLO_SERVER_URL || runtimeEnv.NOLO_SERVER || runtimeEnv.BASE_URL,
-          BASE_URL: runtimeEnv.BASE_URL || runtimeEnv.NOLO_SERVER || runtimeEnv.NOLO_SERVER_URL,
-          AUTH_TOKEN: runtimeEnv.AUTH_TOKEN || runtimeEnv.AUTH || runtimeEnv.NOLO_MACHINE_API_KEY,
-          NOLO_MACHINE_API_KEY: runtimeEnv.NOLO_MACHINE_API_KEY || runtimeEnv.AUTH_TOKEN || runtimeEnv.AUTH,
+          NOLO_SERVER:
+            effectiveRuntimeEnv.NOLO_SERVER ||
+            effectiveRuntimeEnv.NOLO_SERVER_URL ||
+            effectiveRuntimeEnv.BASE_URL,
+          NOLO_SERVER_URL:
+            effectiveRuntimeEnv.NOLO_SERVER_URL ||
+            effectiveRuntimeEnv.NOLO_SERVER ||
+            effectiveRuntimeEnv.BASE_URL,
+          BASE_URL:
+            effectiveRuntimeEnv.BASE_URL ||
+            effectiveRuntimeEnv.NOLO_SERVER ||
+            effectiveRuntimeEnv.NOLO_SERVER_URL,
+          AUTH_TOKEN:
+            effectiveRuntimeEnv.AUTH_TOKEN ||
+            effectiveRuntimeEnv.AUTH ||
+            effectiveRuntimeEnv.NOLO_MACHINE_API_KEY,
+          NOLO_MACHINE_API_KEY:
+            effectiveRuntimeEnv.NOLO_MACHINE_API_KEY ||
+            effectiveRuntimeEnv.AUTH_TOKEN ||
+            effectiveRuntimeEnv.AUTH,
         },
       }).finally(() => clearInterval(heartbeat));
       logConnectorRun("agent.run.cli.result", {
@@ -555,7 +575,7 @@ export async function handleConnectorRunMessage(
     baseSha = await readConnectorGitHead(cwd);
     const result = await runConnectorLocalRuntimeAgent({
       parsed,
-      runtimeEnv,
+      runtimeEnv: withForwardedUserAuthToken(runtimeEnv, parsed),
       cwd,
       fetchImpl,
       onProgress: sendProgress,

package/cli/offlineMarxistsAgentCommand.ts

@@ -28,7 +28,7 @@ type ParsedArgs = {
 
 const DEFAULT_USER_ID = "b2e06f801f";
 const DEFAULT_SPACE_ID = "01KKY77TT0DA9NY7TNW3R7255N";
-const DEFAULT_SOURCE_AGENT_ID = "01MIMO25MONTH00000001PGT4X";
+const DEFAULT_SOURCE_AGENT_ID = "01MIMO25MONTH0000000NEW001";
 const DEFAULT_TARGET_AGENT_ID = "01OFFMARXBOOK000000010AHL1";
 const DEFAULT_AGENT_NAME = "离线马克思主义文库书籍转换助手";
 const TOOL_NAME = "convertMarxistsBookToOfflineHtml";

package/cli/runtimeDoctorCommands.ts

@@ -64,13 +64,13 @@ async function defaultLocalRuntimeProbe(env: EnvLike): Promise<LocalRuntimeProbe
 }
 
 export async function runDoctorRuntimeCommand(
-  _args: string[],
+  args: string[],
   deps: AgentCommandDeps = {}
 ) {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
-  const authToken = resolveAuthToken(env);
-  const serverUrl = resolveServerUrl(env);
+  const authToken = resolveAuthToken(args, env);
+  const serverUrl = resolveServerUrl(args, env);
   const localProbe = await (deps.localRuntimeProbe ?? defaultLocalRuntimeProbe)(env);
   const hasLocalAgentConfig = detectLocalAgentConfig(env) && localProbe.ok && localProbe.agentFound;
   const hasLocalProvider = detectLocalProvider(env);
@@ -88,7 +88,13 @@ export async function runDoctorRuntimeCommand(
     hasLocalPersistence: true,
     missingLocalCapabilities,
     requiresServer: false,
-    serverFallbackAvailable: Boolean(authToken || env.NOLO_SERVER || env.BASE_URL),
+    serverFallbackAvailable: Boolean(
+      authToken ||
+      args.includes("--server") ||
+      args.includes("--server-url") ||
+      env.NOLO_SERVER ||
+      env.BASE_URL
+    ),
   });
 
   output.write(`Runtime: ${decision.mode}\n`);

package/cli/tableCommands.ts

@@ -80,7 +80,7 @@ function resolveServerUrl(args: string[], env: EnvLike): string {
 
 function resolveAuthToken(args: string[], env: EnvLike): string {
   return (
-    readOption(args, "--api-key") ||
+    readOption(args, "--machine-key") ||
     readOption(args, "--token") ||
     env.AUTH_TOKEN ||
     env.AUTH ||

package/cli/taskRunCommand.ts

@@ -82,7 +82,7 @@ function resolveServerUrl(args: string[], env: EnvLike) {
 
 function resolveAuthToken(args: string[], env: EnvLike) {
   return (
-    readOption(args, "--api-key") ||
+    readOption(args, "--machine-key") ||
     readOption(args, "--token") ||
     env.NOLO_TASK_RUN_TOKEN ||
     env.NOLO_MACHINE_API_KEY ||

package/cliCommandDispatch.ts

@@ -31,7 +31,7 @@ function readOption(args: string[], flag: string) {
 
 function buildDaemonEnv(args: string[], runtimeEnv: NodeJS.ProcessEnv) {
   const serverUrl = readOption(args, "--server-url") || readOption(args, "--server");
-  const apiKey = readOption(args, "--api-key") || readOption(args, "--token");
+  const apiKey = readOption(args, "--machine-key") || readOption(args, "--token");
   return {
     ...runtimeEnv,
     ...(serverUrl ? { NOLO_SERVER: serverUrl } : {}),
@@ -40,7 +40,7 @@ function buildDaemonEnv(args: string[], runtimeEnv: NodeJS.ProcessEnv) {
 }
 
 export function looksLikeDaemonShortcut(args: string[]) {
-  return args.includes("--server-url") || args.includes("--api-key");
+  return args.includes("--server-url") || args.includes("--machine-key");
 }
 
 export function createCliRuntimeContext(args: {

package/cliEnvHelpers.ts

@@ -3,19 +3,17 @@ import { NOLO_CLUSTER_SERVERS } from "./database/config";
 
 export type EnvLike = Record<string, string | undefined>;
 
-export function resolveServerUrl(env: EnvLike) {
+export function resolveServerUrlFromEnv(env: EnvLike) {
   return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
 }
 
-export function resolveServerCandidates(env: EnvLike, preferred?: string | null) {
-  const values = [
-    preferred?.trim(),
-    env.NOLO_SERVER,
-    env.BASE_URL,
-    env.NOLO_SERVER_URL,
-    DEFAULT_NOLO_SERVER_URL,
-    ...NOLO_CLUSTER_SERVERS,
-  ];
+type ResolverInput = string[] | EnvLike;
+
+function isCliArgs(value: ResolverInput): value is string[] {
+  return Array.isArray(value);
+}
+
+function buildServerCandidates(values: Array<string | null | undefined>) {
   return [...new Set(
     values
       .filter((value): value is string => typeof value === "string" && value.trim().length > 0)
@@ -23,8 +21,78 @@ export function resolveServerCandidates(env: EnvLike, preferred?: string | null)
   )];
 }
 
-export function resolveAuthToken(env: EnvLike) {
-  return env.AUTH_TOKEN || env.AUTH || "";
+export function resolveServerUrl(env: EnvLike): string;
+export function resolveServerUrl(args: string[], env: EnvLike): string;
+export function resolveServerUrl(input: ResolverInput, env?: EnvLike) {
+  if (isCliArgs(input)) {
+    const explicit =
+      readOption(input, "--server-url") ||
+      readOption(input, "--server");
+    return explicit?.replace(/\/+$/, "") || resolveServerUrlFromEnv(env ?? {});
+  }
+  return resolveServerUrlFromEnv(input);
+}
+
+export function resolveServerCandidates(env: EnvLike, preferred?: string | null): string[];
+export function resolveServerCandidates(
+  args: string[],
+  env: EnvLike,
+  preferred?: string | null,
+): string[];
+export function resolveServerCandidates(
+  input: ResolverInput,
+  envOrPreferred?: EnvLike | string | null,
+  preferred?: string | null,
+) {
+  if (isCliArgs(input)) {
+    const env = (envOrPreferred ?? {}) as EnvLike;
+    const explicitServer = resolveServerUrl(input, env);
+    return buildServerCandidates([
+      explicitServer,
+      preferred?.trim(),
+      env.NOLO_SERVER,
+      env.BASE_URL,
+      env.NOLO_SERVER_URL,
+      DEFAULT_NOLO_SERVER_URL,
+      ...NOLO_CLUSTER_SERVERS,
+    ]);
+  }
+
+  const env = input;
+  return buildServerCandidates([
+    typeof envOrPreferred === "string" ? envOrPreferred.trim() : undefined,
+    env.NOLO_SERVER,
+    env.BASE_URL,
+    env.NOLO_SERVER_URL,
+    DEFAULT_NOLO_SERVER_URL,
+    ...NOLO_CLUSTER_SERVERS,
+  ]);
+}
+
+export function resolveAuthTokenFromEnv(env: EnvLike, extraEnvKeys: string[] = []) {
+  for (const key of ["AUTH_TOKEN", "AUTH", ...extraEnvKeys]) {
+    const value = env[key];
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return "";
+}
+
+export function resolveAuthToken(env: EnvLike, extraEnvKeys?: string[]): string;
+export function resolveAuthToken(args: string[], env: EnvLike, extraEnvKeys?: string[]): string;
+export function resolveAuthToken(
+  input: ResolverInput,
+  envOrExtraEnvKeys?: EnvLike | string[],
+  extraEnvKeys: string[] = [],
+) {
+  if (isCliArgs(input)) {
+    const env = (envOrExtraEnvKeys ?? {}) as EnvLike;
+    return (
+      readOption(input, "--token") ||
+      readOption(input, "--machine-key") ||
+      resolveAuthTokenFromEnv(env, extraEnvKeys)
+    );
+  }
+  return resolveAuthTokenFromEnv(input, (envOrExtraEnvKeys as string[] | undefined) ?? []);
 }
 
 export function parseUserIdFromAuthToken(token: string) {

package/client/agentRun.ts

@@ -778,6 +778,7 @@ async function runLocalAgentTurnForCli(
       background: options.background,
       noStream: options.noStream,
       maxToolRounds: options.maxToolRounds,
+      ...(typeof options.timeoutMs === "number" ? { timeoutMs: options.timeoutMs } : {}),
       ...(traceLocalTools || collectToolEvidence
         ? {
             onToolEvent: (event) => {

package/client/localProviderResolver.test.ts

@@ -11,15 +11,18 @@ describe("CLI local provider resolver", () => {
         provider: "custom",
         apiSource: "custom",
         customProviderUrl: "https://provider.example/v1/chat/completions",
+        apiKey: "sk-agent-custom",
+        apiKeyHeader: "api-key",
       },
       env: {
-        OPENAI_API_KEY: "sk-env",
+        OPENAI_API_KEY: "sk-env-should-not-win",
         NOLO_LOCAL_OPENAI_BASE_URL: "http://127.0.0.1:11434/v1",
       },
     })).toEqual({
       model: "qwen-coder",
       endpoint: "https://provider.example/v1/chat/completions",
-      apiKey: "sk-env",
+      apiKey: "sk-agent-custom",
+      apiKeyHeader: "api-key",
       provider: "custom",
       requestOptions: {},
     });
@@ -53,6 +56,27 @@ describe("CLI local provider resolver", () => {
     });
   });
 
+  test("defaults Xiaomi custom endpoints to api-key auth header", () => {
+    expect(resolveCliOpenAiProviderConfig({
+      agentConfig: {
+        key: "agent-user-1-mimo",
+        provider: "custom",
+        apiSource: "custom",
+        model: "mimo-v2.5-pro",
+        customProviderUrl: "https://token-plan-cn.xiaomimimo.com/v1",
+        apiKey: "mimo-monthly-key",
+      },
+      env: {},
+    })).toEqual({
+      model: "mimo-v2.5-pro",
+      endpoint: "https://token-plan-cn.xiaomimimo.com/v1/chat/completions",
+      apiKey: "mimo-monthly-key",
+      apiKeyHeader: "api-key",
+      provider: "custom",
+      requestOptions: {},
+    });
+  });
+
   test("carries explicit agent inference options for request body construction", () => {
     expect(resolveCliOpenAiProviderConfig({
       agentConfig: {