nolo-cli 0.1.40 → 0.1.42

package/integrations/xhs-reader/redaction.ts

@@ -0,0 +1,68 @@
+// XHS-specific sensitive value redaction.
+// Follows patterns from x-reader/redaction.ts but adds XHS-specific token fields.
+
+const XHS_SENSITIVE_KEY_PATTERN =
+  /^(xsecToken|xsec_token|cookie|web_session|a1|webId|galaxy_sessionid|customerClientId|authorization|access_token|refresh_token|secret|token)$/i;
+
+const XHS_COOKIE_PATTERN = /\b(a1|web_session|webId|galaxy_sessionid|customerClientId)=[^;\s]*/gi;
+
+const XHS_URL_TOKEN_PATTERN = /([?&])xsec_token=[^&#]*/gi;
+
+/**
+ * Recursively redact XHS-sensitive values from any JSON-serializable object.
+ * Redacts:
+ * - Object keys matching XHS_SENSITIVE_KEY_PATTERN (value becomes "[REDACTED]")
+ * - Cookie-like substrings within string values
+ * - xsec_token URL params within string values
+ */
+export function redactXhsSensitiveValue(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactXhsSensitiveValue(item));
+  }
+
+  if (value && typeof value === "object") {
+    const redacted: Record<string, unknown> = {};
+    for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+      if (XHS_SENSITIVE_KEY_PATTERN.test(key)) {
+        redacted[key] = "[REDACTED]";
+      } else {
+        redacted[key] = redactXhsSensitiveValue(child);
+      }
+    }
+    return redacted;
+  }
+
+  if (typeof value === "string") {
+    let result = value;
+    // Redact cookie-like patterns
+    result = result.replace(XHS_COOKIE_PATTERN, (match) => {
+      const eqIdx = match.indexOf("=");
+      return eqIdx >= 0 ? `${match.slice(0, eqIdx + 1)}[REDACTED]` : "[REDACTED]";
+    });
+    // Redact xsec_token in URLs
+    result = result.replace(XHS_URL_TOKEN_PATTERN, "$1xsec_token=[REDACTED]");
+    return result;
+  }
+
+  return value;
+}
+
+/**
+ * Check if a string contains any XHS-sensitive patterns.
+ * Useful for assertions in tests.
+ */
+export function containsSensitiveValue(text: string): boolean {
+  if (XHS_COOKIE_PATTERN.test(text)) {
+    // Reset regex state for subsequent calls
+    XHS_COOKIE_PATTERN.lastIndex = 0;
+    return true;
+  }
+  if (XHS_URL_TOKEN_PATTERN.test(text)) {
+    XHS_URL_TOKEN_PATTERN.lastIndex = 0;
+    return true;
+  }
+  // Check for raw xsecToken-looking values
+  if (/xsecToken['":\s]*[:=]/i.test(text)) return true;
+  if (/xsec_token['":\s]*[:=]/i.test(text)) return true;
+  return false;
+}

package/integrations/xhs-reader/types.ts

@@ -0,0 +1,277 @@
+// XHS Desktop Connector - Read-only types
+
+export type XhsFailureCode =
+  | "not_logged_in"
+  | "login_required"
+  | "blocked"
+  | "empty_profile_state"
+  | "profile_not_found"
+  | "note_not_found"
+  | "rate_limited"
+  | "network_error"
+  | "parse_error"
+  | "comment_disabled"
+  | "unknown";
+
+export type XhsReadFailure = {
+  ok: false;
+  code: XhsFailureCode;
+  message: string;
+  diagnostic?: XhsCollectorDiagnostic;
+  fetchedAt: string;
+};
+
+export type XhsReadSuccess<T> = {
+  ok: true;
+  data: T;
+  fetchedAt: string;
+};
+
+export type XhsReadResult<T> = XhsReadSuccess<T> | XhsReadFailure;
+
+// --- Collector diagnostics (redacted, no secrets) ---
+
+export type XhsCollectorDiagnostic = {
+  /** Why the collector returned empty or failed data. */
+  code: XhsFailureCode;
+  /** Human-readable explanation. */
+  message: string;
+  /** Page title at the time of collection (may be empty). */
+  pageTitle?: string;
+  /** Final page URL after navigation (may differ if redirected). */
+  finalUrl?: string;
+  /** Whether a login wall / prompt was detected on the page. */
+  loginDetected?: boolean;
+  /** Whether a visible login prompt close button was clicked before declaring the page blocked. */
+  loginPromptDismissed?: boolean;
+  /** Whether a captcha / verification wall was detected. */
+  captchaDetected?: boolean;
+  /** Whether __INITIAL_STATE__ was present and non-empty. */
+  initialStatePresent?: boolean;
+  /** Number of note-like keys found inside __INITIAL_STATE__. */
+  initialStateNoteCount?: number;
+  /** Number of user_posted API responses captured. */
+  capturedApiResponseCount?: number;
+  /** HTTP status of the first captured user_posted response (if any). */
+  firstApiResponseStatus?: number;
+  /** Whether the page URL after navigation looks like a redirect to login. */
+  redirectedToLogin?: boolean;
+  /** Length of visible body text sampled for diagnostics. */
+  bodyTextLength?: number;
+  /** Number of visible login close/dismiss candidates found on the page. */
+  visibleCloseCandidateCount?: number;
+  /** Number of visible XHS note links found on the page. */
+  visibleNoteLinkCount?: number;
+};
+
+// --- Profile ---
+
+export type XhsProfile = {
+  userId: string;
+  nickname: string;
+  redId?: string;
+  avatarUrl?: string;
+  desc?: string;
+  ipLocation?: string;
+  gender?: string; // "male" | "female" | "0" (unknown)
+  interactionCounts?: {
+    follows?: number;
+    fans?: number;
+    likesAndCollects?: number;
+  };
+};
+
+export type XhsNoteSummary = {
+  noteId: string;
+  title?: string;
+  coverUrl?: string;
+  type?: "normal" | "video";
+  likedCount?: number;
+  // kept from initial state / user_posted page
+  xsecToken?: string; // internal use only - must not appear in public exports
+  xsecSource?: string; // internal navigation hint only - must not appear in public exports
+};
+
+// --- Note Detail ---
+
+export type XhsNoteDetail = {
+  noteId: string;
+  title: string;
+  desc: string;
+  type: "normal" | "video";
+  userId: string;
+  nickname: string;
+  avatarUrl?: string;
+  imageUrls?: string[];
+  videoUrl?: string;
+  tagList?: string[];
+  ipLocation?: string;
+  metrics: {
+    likedCount: number;
+    collectedCount: number;
+    commentCount: number;
+    shareCount: number;
+  };
+  createdAt?: string;
+  lastUpdateTime?: string;
+};
+
+// --- Comments ---
+
+export type XhsComment = {
+  commentId: string;
+  userId: string;
+  nickname: string;
+  avatarUrl?: string;
+  content: string;
+  likeCount: number;
+  subCommentCount: number;
+  subComments?: XhsComment[]; // embedded samples only
+  ipLocation?: string;
+  createdAt?: string;
+};
+
+export type XhsCommentPage = {
+  comments: XhsComment[];
+  hasMore: boolean;
+  cursor?: string;
+};
+
+// --- Analyzed Result ---
+
+export type XhsTopNote = {
+  noteId: string;
+  title?: string;
+  count: number;
+};
+
+export type XhsCommentBucket = {
+  label: string;
+  count: number;
+  sampleCommentIds: string[];
+};
+
+export type XhsProfileAnalysis = {
+  totalNotes: number;
+  highestLikedNote: XhsTopNote | null;
+  highestCommentedNote: XhsTopNote | null;
+  highestCollectedNote: XhsTopNote | null;
+  highestSharedNote: XhsTopNote | null;
+  commentBuckets: XhsCommentBucket[];
+  topLikedComments: XhsComment[];
+};
+
+// --- Collection Status (assisted mode) ---
+
+export type XhsCollectionMode = "conservative" | "assisted";
+export type XhsAssistedAction =
+  | "snapshot"
+  | "read_more_notes"
+  | "read_visible_details"
+  | "discover_indexed_notes";
+
+export type XhsNextSuggestedAction = {
+  action:
+    | "read_more_notes"
+    | "read_visible_details"
+    | "discover_indexed_notes"
+    | "save_to_table"
+    | "stop_anonymous_unavailable";
+  label: string;
+  reason: string;
+};
+
+export type XhsCollectionStatus = {
+  mode: XhsCollectionMode;
+  action: XhsAssistedAction;
+  extendedCollectionConsent: boolean;
+  assistedStepCount: number;
+  limits: {
+    maxAssistedSteps: number;
+    maxScrollPages: number;
+    maxCommentPagesPerNote: number;
+    includeComments: boolean;
+  };
+  nextSuggestedAction?: XhsNextSuggestedAction;
+};
+
+// --- Full collection result ---
+
+export type XhsProfileCollection = {
+  profile: XhsProfile;
+  notes: XhsNoteSummary[];
+  noteDetails: XhsNoteDetail[];
+  commentsByNote: Record<string, XhsComment[]>;
+  analysis: XhsProfileAnalysis;
+  indexedDiscovery?: {
+    source: "external_index";
+    requestedNoteUrls: string[];
+    acceptedNoteUrls: string[];
+    verifiedNoteUrls: string[];
+  };
+  /** Present only when the collector detected an issue. Never contains secrets. */
+  diagnostic?: XhsCollectorDiagnostic;
+  /** Collection status for assisted automation mode. */
+  collectionStatus?: XhsCollectionStatus;
+};
+
+// --- URL parsing result ---
+
+export type XhsParsedProfileUrl = {
+  userId: string;
+  canonicalUrl: string;
+  navigationUrl: string;
+  xsecToken?: string; // preserved internally only
+  xsecSource?: string; // preserved internally only
+};
+
+export type XhsParsedNoteUrl = {
+  noteId: string;
+  canonicalUrl: string;
+  xsecToken?: string; // preserved internally only
+  xsecSource?: string; // preserved internally only
+};
+
+// --- Redaction ---
+
+export type XhsConnectorOptions = {
+  profileUrl: string;
+  maxScrollPages?: number; // default 0
+  enrichDetails?: boolean; // default false
+  includeComments?: boolean; // default false
+  maxCommentPagesPerNote?: number; // default 1
+  headless?: boolean; // default false
+  cookieDir?: string;
+  fetchImpl?: typeof fetch;
+  /** Assisted mode: "conservative" (default) or "assisted" */
+  collectionMode?: XhsCollectionMode;
+  /** Which action to perform in assisted mode */
+  assistedAction?: XhsAssistedAction;
+  /** Max assisted steps (1..3), bounds scroll/comment pages */
+  maxAssistedSteps?: number;
+  /** Public note URLs discovered from an external search index. */
+  indexedNoteUrls?: string[];
+};
+
+// Helper to create failure
+export function createXhsFailure(args: {
+  code: XhsFailureCode;
+  message: string;
+  diagnostic?: XhsCollectorDiagnostic;
+}): XhsReadFailure {
+  return {
+    ok: false,
+    code: args.code,
+    message: args.message,
+    ...(args.diagnostic ? { diagnostic: args.diagnostic } : {}),
+    fetchedAt: new Date().toISOString(),
+  };
+}
+
+export function createXhsSuccess<T>(data: T): XhsReadSuccess<T> {
+  return {
+    ok: true,
+    data,
+    fetchedAt: new Date().toISOString(),
+  };
+}

package/integrations/xhs-reader/url.ts

@@ -0,0 +1,80 @@
+import type { XhsParsedProfileUrl, XhsParsedNoteUrl } from "./types";
+
+const PROFILE_RE =
+  /(?:(?:https?:\/\/)?(?:www\.)?xiaohongshu\.com)?\/user\/profile\/([a-f0-9]{24})(?:\?[^#]*)?/i;
+
+const NOTE_RE =
+  /(?:(?:https?:\/\/)?(?:www\.)?xiaohongshu\.com)?\/(?:explore|discovery\/item)\/([a-f0-9]{24})(?:\?[^#]*)?/i;
+
+/**
+ * Parse a XHS profile URL and return userId + canonical URL.
+ * Accepts full URLs and path-only forms.
+ * The xsecToken query param is preserved in the result for internal navigation only.
+ */
+export function parseXhsProfileUrl(input: string): XhsParsedProfileUrl {
+  const match = input.match(PROFILE_RE);
+  if (!match) {
+    throw new Error(`Invalid XHS profile URL: ${input}`);
+  }
+  const userId = match[1];
+  const canonicalUrl = `https://www.xiaohongshu.com/user/profile/${userId}`;
+
+  let xsecToken: string | undefined;
+  let xsecSource: string | undefined;
+  try {
+    const urlObj = new URL(input.startsWith("http") ? input : `https://www.xiaohongshu.com${input}`);
+    xsecToken = urlObj.searchParams.get("xsec_token") ?? undefined;
+    xsecSource = urlObj.searchParams.get("xsec_source") ?? undefined;
+  } catch {
+    // The regex validation above already accepted path-like input; keep canonical navigation.
+  }
+
+  const navigationUrl = new URL(canonicalUrl);
+  if (xsecToken) navigationUrl.searchParams.set("xsec_token", xsecToken);
+  if (xsecSource) navigationUrl.searchParams.set("xsec_source", xsecSource);
+
+  return {
+    userId,
+    canonicalUrl,
+    navigationUrl: navigationUrl.toString(),
+    xsecToken,
+    xsecSource,
+  };
+}
+
+/**
+ * Parse a XHS note URL and return noteId + canonical URL.
+ * The xsecToken query param is preserved in the result for internal use only.
+ */
+export function parseXhsNoteUrl(input: string): XhsParsedNoteUrl {
+  const match = input.match(NOTE_RE);
+  if (!match) {
+    throw new Error(`Invalid XHS note URL: ${input}`);
+  }
+  const noteId = match[1];
+
+  // Extract xsec_token if present (internal use only)
+  let xsecToken: string | undefined;
+  let xsecSource: string | undefined;
+  try {
+    const urlObj = new URL(input.startsWith("http") ? input : `https://www.xiaohongshu.com${input}`);
+    xsecToken = urlObj.searchParams.get("xsec_token") ?? undefined;
+    xsecSource = urlObj.searchParams.get("xsec_source") ?? undefined;
+  } catch {
+    // ignore parse errors
+  }
+
+  return {
+    noteId,
+    canonicalUrl: `https://www.xiaohongshu.com/explore/${noteId}`,
+    xsecToken,
+    xsecSource,
+  };
+}
+
+/**
+ * Validate that a string looks like a valid XHS note ID (24 hex chars).
+ */
+export function isValidXhsId(id: string): boolean {
+  return /^[a-f0-9]{24}$/i.test(id);
+}

package/internalCommandEntries.ts

@@ -1,6 +1,8 @@
 import { getAgentInternalCommandEntries } from "./agentInternalCommandEntries";
 import { getDialogInternalCommandEntries } from "./dialogInternalCommandEntries";
+import { getDocInternalCommandEntries } from "./docInternalCommandEntries";
 import type { CommandEntry } from "./cliCommandTypes";
+import { getMemoryInternalCommandEntries } from "./memoryInternalCommandEntries";
 import { getSystemInternalCommandEntries } from "./systemInternalCommandEntries";
 import { getWorkflowInternalCommandEntries } from "./workflowInternalCommandEntries";
 
@@ -8,6 +10,8 @@ export function getInternalCommandEntries(renderHelpText: () => string): Command
   return [
     ...getAgentInternalCommandEntries(),
     ...getDialogInternalCommandEntries(),
+    ...getDocInternalCommandEntries(),
+    ...getMemoryInternalCommandEntries(),
     ...getWorkflowInternalCommandEntries(),
     ...getSystemInternalCommandEntries(renderHelpText),
   ];

package/machineCommands.ts

@@ -132,50 +132,34 @@ function detectLaunchableMachineInfo() {
   return detectMachineInfo({ probeLaunchable: true });
 }
 
-function inferTaskRunRole(agentKey: string, agentConfig: any) {
-  const haystack = [
-    agentKey,
-    agentConfig?.name,
-    agentConfig?.prompt,
-  ].filter(Boolean).join("\n").toLowerCase();
-  if (haystack.includes("frontend") || haystack.includes("前端")) return "frontend";
-  if (haystack.includes("fullstack") || haystack.includes("全栈")) return "fullstack";
-  if (haystack.includes("review") || haystack.includes("审查")) return "reviewer";
-  if (haystack.includes("project-manager") || haystack.includes("项目经理")) return "pm";
-  return "codex";
+function findTaskRowSubjectRef(runtimeContext: any) {
+  const subjectRefs = Array.isArray(runtimeContext?.subjectRefs) ? runtimeContext.subjectRefs : [];
+  for (const ref of subjectRefs) {
+    if (!ref || typeof ref !== "object" || Array.isArray(ref)) continue;
+    if (ref.kind !== "table-row") continue;
+    const id = typeof ref.id === "string" ? ref.id.trim() : "";
+    if (id) return id;
+  }
+  return "";
 }
 
-function buildTaskRunBridgePrompt(args: {
+function buildTaskEvidencePrompt(args: {
   agentKey: string;
   agentConfig: any;
   runtimeContext: any;
 }) {
-  const taskRun = args.runtimeContext?.taskRun;
-  const rowDbKey = typeof taskRun?.rowDbKey === "string" ? taskRun.rowDbKey.trim() : "";
+  const rowDbKey = findTaskRowSubjectRef(args.runtimeContext);
   if (!rowDbKey) return "";
-  const workItemId = typeof taskRun?.workItemId === "string" ? taskRun.workItemId.trim() : "";
-  const role = inferTaskRunRole(args.agentKey, args.agentConfig);
   return [
-    "--- Nolo task-run tool bridge ---",
+    "--- Nolo task evidence context ---",
     "This CLI runtime does not receive server-side function tools directly.",
-    "Use the local task-run bridge command for durable task state writes. Do not edit meta.taskRun with table or database commands.",
+    "Use the task row subjectRef and linked dialog/activity evidence as the durable task context.",
     "Run commands from the repository root. The runner already provides server URL and auth in the environment.",
     "Release boundary: after review passes, AI/reviewer/Codex may advance alpha for verification. Do not merge, push, or release main/release unless the human owner explicitly authorizes it in the current task context.",
-    "Cost boundary: read taskRun.control from context. Prefer low-cost/free-window models for routine work, and reserve Codex for supervision, quality gates, complex unblocking, and main/release decisions.",
-    "Handoff context: start from read-context, then inspect existing refs such as workItems.dialogIds, workItems.outcome, review.dialogId, activityRefs, agentRuns.dialogId/resultSummary, and artifactRefs. Use dialog read/search for exact evidence; do not infer completion from handoff text alone.",
-    `Read context: bun packages/cli/index.ts task-run read-context --row-dbkey ${JSON.stringify(rowDbKey)}`,
-    ...(workItemId
-      ? [
-          `Claim work item: bun packages/cli/index.ts task-run claim-work-item --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --agent-key ${JSON.stringify(args.agentKey)} --role ${role}`,
-          `Set blocker: bun packages/cli/index.ts task-run set-blocker --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --layer tool --code <CODE> --message <MESSAGE>`,
-          `Clear resolved blocker: bun packages/cli/index.ts task-run clear-blocker --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --blocker-id <BLOCKER_ID>`,
-          `Submit outcome: bun packages/cli/index.ts task-run submit-outcome --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --summary <SUMMARY>`,
-          `Request review: bun packages/cli/index.ts task-run request-review --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --reviewer-agent-key <AGENT_KEY> --message <MESSAGE>`,
-          `Record review: bun packages/cli/index.ts task-run record-review --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --review-status <passed|needs_changes|blocked> --reviewer-agent-key ${JSON.stringify(args.agentKey)} --findings <FINDINGS>`,
-          `Close work item: bun packages/cli/index.ts task-run close-work-item --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --summary <SUMMARY>`,
-        ]
-      : []),
-    "If a bridge command fails, report the exact command and error.",
+    "Handoff context: inspect activityRefs/latestActivityRef, dialog checkpoints, artifacts, commits, and test evidence. Use dialog read/search for exact evidence; do not infer completion from handoff text alone.",
+    `Read task row: bun packages/cli/index.ts table query --table meta-0e95801d90-NOLOTASKBOARD --row ${JSON.stringify(rowDbKey)} --include-activity --output json`,
+    "Then read linked activity dialog ids with: bun packages/cli/index.ts dialog read <dialogId>",
+    "Report progress, blockers, worktree, branch, commit/diff, tests, and unverified items in the dialog.",
   ].join("\n");
 }
 
@@ -186,7 +170,7 @@ function buildConnectorCliPrompt(agentConfig: any, userInput: string, bridgeArgs
   const policy = permissionPolicy ?? resolveMachineRunPermissionPolicy(agentConfig);
   return [
     typeof agentConfig?.prompt === "string" ? agentConfig.prompt.trim() : "",
-    bridgeArgs ? buildTaskRunBridgePrompt({
+    bridgeArgs ? buildTaskEvidencePrompt({
       agentKey: bridgeArgs.agentKey,
       agentConfig,
       runtimeContext: bridgeArgs.runtimeContext,