nolo-cli 0.1.41 → 0.1.42

package/render/table/types.ts

@@ -1,6 +1,7 @@
 // 文件: render/table/types.ts
 
 import { DataType } from "../../create/types";
+import type { ContentIcon } from "../contentIcon/types";
 
 /* --------------------------------------------------------------------------
  * 1. 列类型（TableColumn）
@@ -214,6 +215,15 @@ export interface TableMeta {
     /** 表显示名（可中文） */
     displayName?: string;
 
+    /** 表格自定义图标；未设置时 UI 使用默认表格图标。 */
+    icon?: ContentIcon | null;
+
+    /**
+     * 机器可读用途，用于在当前用户/space 范围内查找某类表。
+     * 例如 agent_eval_workbench。
+     */
+    purpose?: string;
+
     /**
      * 表用途说明，给人和 AI 都看的版本：
      * 建议包括：

package/scriptCommandEntries.ts

@@ -2,15 +2,12 @@ import { createScriptCommand, type CommandEntry } from "./cliCommandTypes";
 
 function getDocScriptCommands(): CommandEntry[] {
   return [
-    createScriptCommand(["doc", "create"], "createDoc.ts", "Create a normal doc"),
     createScriptCommand(["doc", "read"], "readDoc.ts", "Read a normal doc"),
     createScriptCommand(["doc", "update"], "updateDoc.ts", "Update a normal doc"),
     createScriptCommand(["doc", "delete"], "deleteDoc.ts", "Delete a normal doc"),
-    createScriptCommand(["skill-doc", "create"], "createSkillDoc.ts", "Create a skill doc"),
     createScriptCommand(["skill-doc", "read"], "readSkillDoc.ts", "Read a skill doc"),
     createScriptCommand(["skill-doc", "update"], "updateSkillDoc.ts", "Update a skill doc"),
     createScriptCommand(["skill-doc", "delete"], "deleteSkillDoc.ts", "Delete a skill doc"),
-    createScriptCommand(["skill", "create-doc"], "createSkillDoc.ts", "Create a skill-backed doc"),
   ];
 }
 

package/secretScan.ts

@@ -0,0 +1,31 @@
+export type SecretFinding = {
+  label: string;
+  line: number;
+  preview: string;
+};
+
+const SECRET_PATTERNS: Array<{ label: string; pattern: RegExp }> = [
+  { label: "password", pattern: /\bpassword\s*[:=]\s*["']?[^"',\s#]{8,}/i },
+  { label: "psk", pattern: /\bpsk\s*[:=]\s*["']?[^"',\s#]{8,}/i },
+  { label: "api key", pattern: /\b(api[_-]?key|apikey)\s*[:=]\s*["']?[^"',\s#]{12,}/i },
+  { label: "token", pattern: /\b(token|secret)\s*[:=]\s*["']?[^"',\s#]{12,}/i },
+  { label: "private key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+];
+
+export function findPotentialSecrets(text: string): SecretFinding[] {
+  return text
+    .split(/\r?\n/)
+    .flatMap((line, index) =>
+      SECRET_PATTERNS.filter(({ pattern }) => pattern.test(line)).map(({ label }) => ({
+        label,
+        line: index + 1,
+        preview: line.length > 120 ? `${line.slice(0, 117)}...` : line,
+      }))
+    );
+}
+
+export function formatSecretFindings(findings: SecretFinding[]) {
+  return findings
+    .map((finding) => `  line ${finding.line} (${finding.label}): ${finding.preview}`)
+    .join("\n");
+}

package/server/handlers/agentRun/types.ts

@@ -16,25 +16,32 @@ import type { AgentRuntimeOptions } from "../../../ai/agent/types";
 export type ChatMessage = AgentRuntimeChatMessage;
 
 export type AssistantToolCall = AgentRuntimeToolCall;
-
+
+export type AgentRunUserInputReferencePart = {
+    type: string;
+    name?: string;
+    pageKey?: string;
+    dialogKey?: string;
+};
+
+export type AgentRunUserInputPart =
+    | { type: "text"; text: string }
+    | {
+        type: "image_url";
+        image_url: { url: string };
+        google_native?: {
+            inlineData?: {
+                mimeType: string;
+                data: string;
+            };
+            thoughtSignature?: string;
+        };
+    }
+    | AgentRunUserInputReferencePart;
+
 export interface AgentRunRequest {
     agentKey: string;
-    userInput:
-        | string
-        | Array<
-            | { type: "text"; text: string }
-            | {
-                type: "image_url";
-                image_url: { url: string };
-                google_native?: {
-                    inlineData: {
-                        mimeType: string;
-                        data: string;
-                    };
-                    thoughtSignature?: string;
-                };
-            }
-        >;
+    userInput: string | AgentRunUserInputPart[];
     messages?: ChatMessage[]; // 历史对话，调用方自行管理（不持久化）
     runtimeContext?: AgentRunRuntimeContext;
     stream?: boolean;
@@ -61,12 +68,6 @@ export interface AgentRunRuntimeContext {
     runtime?: string;
     entrypoint?: string;
     capabilities?: string[];
-    taskRun?: {
-        rowDbKey?: string;
-        taskRunId?: string;
-        workItemId?: string;
-        artifactIds?: string[];
-    };
     subjectRefs?: DialogSubjectRef[];
 }
 

package/tableCommands.ts

@@ -55,6 +55,11 @@ function parseOutputMode(raw: string): OutputMode {
   throw new Error(`--output must be one of full, raw, items, json, jsonl; got ${raw}`);
 }
 
+function resolveQueryColumns(columns: string[] | undefined, includeActivity: boolean): string[] | undefined {
+  if (!includeActivity) return columns;
+  return Array.isArray(columns) ? includeTableActivityColumns(columns) : undefined;
+}
+
 function parseTableArg(raw: string): { tenantId?: string; tableId?: string } {
   const trimmed = raw.trim();
   if (!trimmed) return {};
@@ -66,6 +71,32 @@ function parseTableArg(raw: string): { tenantId?: string; tableId?: string } {
   };
 }
 
+function normalizeSpaceInput(raw: string): string {
+  const value = raw.trim();
+  if (!value) return "";
+  if (value.startsWith("http://") || value.startsWith("https://")) {
+    const match = new URL(value).pathname.match(/^\/space\/([^/]+)/);
+    return match?.[1] ? decodeURIComponent(match[1]).replace(/^space-/, "") : "";
+  }
+  return value.replace(/^space-/, "");
+}
+
+function getSpaceContentKeys(spaceRecord: any): Set<string> {
+  const keys = new Set<string>();
+  const contents = spaceRecord?.contents;
+  if (!contents || typeof contents !== "object") return keys;
+  for (const [entryKey, value] of Object.entries(contents)) {
+    keys.add(entryKey);
+    if (value && typeof value === "object") {
+      const contentKey = (value as any).contentKey;
+      if (typeof contentKey === "string" && contentKey.trim()) {
+        keys.add(contentKey.trim());
+      }
+    }
+  }
+  return keys;
+}
+
 function resolveServerUrl(args: string[], env: EnvLike): string {
   return (
     readOption(args, "--server-url") ||
@@ -89,16 +120,46 @@ function resolveAuthToken(args: string[], env: EnvLike): string {
 }
 
 function parseJwtTenantId(token: string): string | undefined {
-  const [, payload] = token.split(".");
-  if (!payload) return undefined;
-  try {
-    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
-    const decoded = Buffer.from(normalized, "base64").toString("utf8");
-    const parsed = JSON.parse(decoded);
-    return typeof parsed.userId === "string" ? parsed.userId : typeof parsed.sub === "string" ? parsed.sub : undefined;
-  } catch {
-    return undefined;
+  for (const parsed of parseJwtPayloadCandidates(token)) {
+    const userId = parsed.userId;
+    const sub = parsed.sub;
+    if (typeof userId === "string" && userId) return userId;
+    if (typeof sub === "string" && sub) return sub;
   }
+  return undefined;
+}
+
+function parseJwtUsername(token: string): string | undefined {
+  for (const parsed of parseJwtPayloadCandidates(token)) {
+    const username = parsed.username;
+    if (typeof username === "string" && username.trim()) return username.trim();
+  }
+  return undefined;
+}
+
+function parseJwtPayloadCandidates(token: string): Array<Record<string, unknown>> {
+  const trimmed = token.trim();
+  if (!trimmed) return [];
+  const parts = trimmed.split(".").filter(Boolean);
+  const payloadCandidates = parts.length >= 3 ? [parts[1], parts[0]] : [parts[0]];
+  const parsed: Array<Record<string, unknown>> = [];
+  for (const payload of payloadCandidates) {
+    try {
+      const decoded = Buffer.from(payload, "base64").toString("utf8");
+      const value = JSON.parse(decoded);
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        parsed.push(value as Record<string, unknown>);
+      }
+    } catch {}
+  }
+  return parsed;
+}
+
+function resolveUserId(args: string[], env: EnvLike, authToken: string): string | undefined {
+  const explicit = readOption(args, "--tenant-id") || env.USER_ID || parseJwtTenantId(authToken);
+  if (explicit) return explicit;
+  const username = parseJwtUsername(authToken);
+  return username && /^[a-z0-9_-]+$/i.test(username) ? username : undefined;
 }
 
 function formatOutput(input: { envelope: any; rawData: any; mode: OutputMode }): string {
@@ -133,6 +194,182 @@ function usage(): string {
   ].join("\n");
 }
 
+function listUsage(): string {
+  return [
+    "Usage:",
+    "  nolo table list [--limit <n>] [--title-query <text>] [--purpose <purpose>] [--output full|raw|items|json|jsonl]",
+    "",
+  ].join("\n");
+}
+
+function tableHasPurpose(table: any, purpose: string): boolean {
+  return typeof table?.purpose === "string" && table.purpose.toLowerCase() === purpose.toLowerCase();
+}
+
+function getComparableUpdatedAt(record: any): number {
+  const raw = record?.updatedAt ?? record?.updated_at ?? record?.createdAt ?? record?.created;
+  if (typeof raw === "number" && Number.isFinite(raw)) return raw;
+  if (typeof raw === "string") return Date.parse(raw) || 0;
+  return 0;
+}
+
+function formatTableListOutput(args: {
+  mode: OutputMode;
+  tables: any[];
+  envelope: any;
+}) {
+  if (args.mode === "full") return JSON.stringify(args.envelope, null, 2);
+  if (args.mode === "raw") return JSON.stringify(args.tables, null, 2);
+  if (args.mode === "items") return JSON.stringify(args.tables, null, 2);
+  return args.tables.map((item) => JSON.stringify(item)).join("\n");
+}
+
+export async function runTableListCommand(args: string[], deps: TableCommandDeps = {}): Promise<number> {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  if (hasFlag(args, "--help") || hasFlag(args, "-h")) {
+    output.write(listUsage());
+    return 0;
+  }
+
+  let outputMode: OutputMode;
+  try {
+    outputMode = parseOutputMode(readOption(args, "--output") || "items");
+  } catch (error) {
+    output.write(`[nolo] table list failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    return 1;
+  }
+
+  const authToken = resolveAuthToken(args, env);
+  const userId = resolveUserId(args, env, authToken);
+  if (!userId) {
+    output.write("[nolo] table list failed: user id is required. Pass --tenant-id or use a login token.\n");
+    return 1;
+  }
+  if (!authToken) {
+    output.write("[nolo] table list failed: AUTH_TOKEN is required.\n");
+    return 1;
+  }
+
+  const limit = Math.max(1, Math.min(Number(readOption(args, "--limit") || 50), 200));
+  const titleQuery = readOption(args, "--title-query").trim().toLowerCase();
+  const purpose = readOption(args, "--purpose").trim();
+  const spaceId = normalizeSpaceInput(readOption(args, "--space") || readOption(args, "--space-id"));
+  const scanLimit = titleQuery || purpose ? Math.max(limit * 5, 200) : limit;
+  const serverUrl = resolveServerUrl(args, env);
+
+  let records: any[];
+  try {
+    records = spaceId
+      ? await fetchSpaceTableRecords({
+          authToken,
+          fetchImpl,
+          serverUrl,
+          spaceId,
+        })
+      : await fetchUserTableRecords({
+          authToken,
+          fetchImpl,
+          limit: Math.min(scanLimit, 500),
+          serverUrl,
+          userId,
+        });
+  } catch (error) {
+    output.write(`[nolo] table list failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    return 1;
+  }
+  const tables = records
+    .filter((table: any) => table && typeof table === "object" && !table.deletedAt)
+    .filter((table: any) => !titleQuery || String(table.displayName ?? table.name ?? table.title ?? "").toLowerCase().includes(titleQuery))
+    .filter((table: any) => !purpose || tableHasPurpose(table, purpose))
+    .sort((left: any, right: any) => getComparableUpdatedAt(right) - getComparableUpdatedAt(left))
+    .slice(0, limit)
+    .map((table: any) => ({
+      dbKey: table.dbKey ?? null,
+      tableId: table.tableId ?? null,
+      displayName: table.displayName ?? table.name ?? table.title ?? "(untitled)",
+      spaceId: table.spaceId ?? null,
+      tenantId: table.tenantId ?? null,
+      columnCount: Array.isArray(table.columns) ? table.columns.length : 0,
+      createdAt: table.createdAt ?? null,
+      updatedAt: table.updatedAt ?? table.updated_at ?? null,
+    }));
+
+  const envelope = { success: true, userId, ...(spaceId ? { space: spaceId } : {}), total: tables.length, tables };
+  output.write(`${formatTableListOutput({ mode: outputMode, tables, envelope })}\n`);
+  return 0;
+}
+
+async function readJsonResponse(response: Response) {
+  const text = await response.text();
+  let payload: any;
+  try {
+    payload = text ? JSON.parse(text) : {};
+  } catch {
+    if (!response.ok) throw new Error(text || response.statusText);
+    return text;
+  }
+  if (!response.ok || payload?.error) {
+    throw new Error(payload?.error ?? response.statusText);
+  }
+  return payload;
+}
+
+async function fetchUserTableRecords(args: {
+  authToken: string;
+  fetchImpl: typeof fetch;
+  limit: number;
+  serverUrl: string;
+  userId: string;
+}) {
+  const response = await args.fetchImpl(
+    `${args.serverUrl}/api/v1/db/query/${encodeURIComponent(args.userId)}?limit=${args.limit}`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${args.authToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ type: "table" }),
+    }
+  );
+  const payload = await readJsonResponse(response);
+  return Array.isArray(payload?.data?.data)
+    ? payload.data.data
+    : Array.isArray(payload?.data)
+      ? payload.data
+      : [];
+}
+
+async function fetchSpaceTableRecords(args: {
+  authToken: string;
+  fetchImpl: typeof fetch;
+  serverUrl: string;
+  spaceId: string;
+}) {
+  const readRecord = async (dbKey: string) => {
+    const response = await args.fetchImpl(
+      `${args.serverUrl}/api/v1/db/read/${encodeURIComponent(dbKey)}`,
+      { headers: { Authorization: `Bearer ${args.authToken}` } }
+    );
+    const payload = await readJsonResponse(response);
+    return payload?.data ?? payload;
+  };
+  const space = await readRecord(`space-${args.spaceId}`);
+  const tableKeys = [...getSpaceContentKeys(space)].filter((key) => key.startsWith("meta-"));
+  const records = await Promise.all(
+    tableKeys.map(async (key) => {
+      try {
+        return await readRecord(key);
+      } catch {
+        return null;
+      }
+    })
+  );
+  return records.filter(Boolean);
+}
+
 export async function runTableQueryCommand(args: string[], deps: TableCommandDeps = {}): Promise<number> {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
@@ -159,7 +396,7 @@ export async function runTableQueryCommand(args: string[], deps: TableCommandDep
 
   const tableArg = parseTableArg(readOption(args, "--table"));
   const authToken = resolveAuthToken(args, env);
-  const tenantId = readOption(args, "--tenant-id") || tableArg.tenantId || env.USER_ID || parseJwtTenantId(authToken);
+  const tenantId = readOption(args, "--tenant-id") || tableArg.tenantId || resolveUserId(args, env, authToken);
   const tableId = tableArg.tableId;
   const hasSingleRowShortcut = Boolean(readOption(args, "--row") || readOption(args, "--row-id") || readOption(args, "--row-dbkey"));
   if (!tenantId || !tableId) {
@@ -184,9 +421,7 @@ export async function runTableQueryCommand(args: string[], deps: TableCommandDep
         tenantId,
         tableId,
         filters: filters ?? {},
-        columns: hasFlag(args, "--include-activity")
-          ? includeTableActivityColumns(columns)
-          : columns,
+        columns: resolveQueryColumns(columns, hasFlag(args, "--include-activity")),
         includeBaseFields: !hasFlag(args, "--no-base-fields"),
         limit: Number(readOption(args, "--limit") || (hasSingleRowShortcut ? 1 : 20)),
         offset: Number(readOption(args, "--offset") || 0),

package/workflowInternalCommandEntries.ts

@@ -1,11 +1,10 @@
 import { createEnvCommand } from "./cliCommandFactories";
 import type { CommandEntry } from "./cliCommandTypes";
-import { runTableQueryCommand } from "./tableCommands";
-import { runTaskRunCommand } from "./taskRunCommand";
+import { runTableListCommand, runTableQueryCommand } from "./tableCommands";
 
 export function getWorkflowInternalCommandEntries(): CommandEntry[] {
   return [
+    createEnvCommand(["table", "list"], "List table metadata", runTableListCommand),
     createEnvCommand(["table", "query"], "Query table rows", runTableQueryCommand),
-    createEnvCommand(["task-run"], "Update durable task-run state through the runner bridge", runTaskRunCommand),
   ];
 }

package/ai/tools/agent/taskRunTool.ts

@@ -1,112 +0,0 @@
-export const taskRunFunctionSchema = {
-  name: "taskRun",
-  description:
-    "读写任务卡里的轻量 task-run 上下文。用于 PM、实现 agent、reviewer 共享 workItems、artifact、blocker、review 状态；不直接执行代码、不固定具体工作流。",
-  parameters: {
-    type: "object",
-    properties: {
-      action: {
-        type: "string",
-        enum: [
-          "readContext",
-          "readTaskContext",
-          "queryReadyWorkItems",
-          "updateWorkItems",
-          "upsertWorkItem",
-          "claimOrDispatch",
-          "claimWorkItem",
-          "openDialog",
-          "recordArtifact",
-          "markBlocked",
-          "setBlocker",
-          "clearBlocker",
-          "requestReview",
-          "recordReview",
-          "submitOutcome",
-          "completeWorkItem",
-          "closeWorkItem",
-        ],
-        description:
-          "要执行的 task-run 原语动作。新 agent 优先使用 readTaskContext/queryReadyWorkItems/upsertWorkItem/claimWorkItem/openDialog/setBlocker/clearBlocker/submitOutcome/closeWorkItem；旧动作保留兼容。",
-      },
-      tenantId: { type: "string", description: "任务表所属用户/租户 ID。" },
-      tableId: { type: "string", description: "任务表 ID，例如 NOLOTASKBOARD。" },
-      rowId: { type: "string", description: "任务卡 rowId。" },
-      dbKey: { type: "string", description: "任务卡完整 dbKey；有 dbKey 时可不传 rowId。" },
-      workItems: {
-        type: "array",
-        description: "updateWorkItems 使用。每项是一个轻量工作项，可包含 dependsOn、writeScope、ownerAgent、reviewPolicy。",
-        items: { type: "object" },
-      },
-      workItemId: {
-        type: "string",
-        description: "claimWorkItem / openDialog / submitOutcome / closeWorkItem 等动作定位的 work item ID。",
-      },
-      targetWorkItemId: {
-        type: "string",
-        description: "recordReview 使用。明确被 review 的目标 work item ID；未提供时兼容使用 workItemId。",
-      },
-      agentKey: { type: "string", description: "claimWorkItem / openDialog 使用。接管或参与该 work item 的 agent key。" },
-      role: { type: "string", description: "claimWorkItem 使用。agent 在本任务里的角色标签。" },
-      dialogId: { type: "string", description: "相关 agent 对话 ID。" },
-      participantAgentKeys: {
-        type: "array",
-        items: { type: "string" },
-        description: "openDialog 使用。参与该对话的 agent key 列表。",
-      },
-      purpose: {
-        type: "string",
-        description: "openDialog 使用。对话目的，例如 assignment/review/status/question/handoff。",
-      },
-      message: {
-        type: "string",
-        description: "openDialog 使用。给目标 agent 的简短消息。",
-      },
-      artifact: {
-        type: "object",
-        description: "recordArtifact 使用。包含 kind/ref/summary，可选 producerRunId/workItemId。",
-      },
-      artifactIds: {
-        type: "array",
-        items: { type: "string" },
-        description: "requestReview / recordReview / submitOutcome 使用。被 review 或提交的 artifact id 列表。",
-      },
-      blocker: {
-        type: "object",
-        description: "setBlocker/markBlocked 使用。包含 layer/code/message，可选 evidence。",
-      },
-      blockerId: {
-        type: "string",
-        description: "clearBlocker 使用。要清除的 blocker id。",
-      },
-      reviewerAgentKey: {
-        type: "string",
-        description:
-          "requestReview / recordReview 使用。Reviewer agent key。requestReview 配合 workItemId 时会创建 review work item 和 review dialog link。",
-      },
-      reviewStatus: {
-        type: "string",
-        enum: ["passed", "needs_changes", "blocked"],
-        description: "recordReview 使用。",
-      },
-      findings: {
-        type: "array",
-        items: { type: "object" },
-        description: "recordReview 使用。review findings，包含 priority/summary/file/line/workItemId。",
-      },
-      summary: {
-        type: "string",
-        description: "submitOutcome / closeWorkItem 使用。对本次提交或关闭的简短总结。",
-      },
-      reason: {
-        type: "string",
-        description: "可选。说明本次状态变更原因；submitOutcome 未提供 summary 时可作为 summary。",
-      },
-    },
-    required: ["action"],
-  },
-};
-
-export async function taskRunFunc(): Promise<never> {
-  throw new Error("taskRun is a server-side agent tool. Use it through /api/agent/run.");
-}

package/cli/client/taskRunPrompt.ts

@@ -1,27 +0,0 @@
-export type TaskRunPromptContext = {
-  rowDbKey: string;
-  taskRunId?: string;
-  workItemId?: string;
-  artifactIds?: string[];
-};
-
-export function prependTaskRunPrompt(message: string, context?: TaskRunPromptContext): string {
-  if (!context?.rowDbKey) return message;
-  const artifactIds = context.artifactIds?.filter(Boolean) ?? [];
-  return [
-    "AI-native task-run context:",
-    "- This system is AI-native. The current task board is only the present observation and validation use case; different users, companies, and workflows may use different task owners later.",
-    "- Treat the task row meta as the durable execution context. Do not infer branch, runner, handoff, review, or blocker state from chat history alone.",
-    `- rowDbKey: ${context.rowDbKey}`,
-    ...(context.taskRunId ? [`- taskRunId: ${context.taskRunId}`] : []),
-    ...(context.workItemId ? [`- workItemId: ${context.workItemId}`] : []),
-    ...(artifactIds.length ? [`- artifactIds: ${artifactIds.join(",")}`] : []),
-    "- Handoff rule: start from the durable task context, then inspect existing refs such as workItems.dialogIds, workItems.outcome, review.dialogId, activityRefs, agentRuns.dialogId/resultSummary, and artifactRefs. Use dialog read/search for exact evidence.",
-    "- When you create, update, hand off, block, or review work, update the task context with `bun run task:run -- ...`.",
-    "- If this turn already includes a server TaskRun preflight snapshot, use that snapshot directly for read-only reporting or planning.",
-    "- Keep long reasoning and logs in the dialog; record only resumable references in task row meta.",
-    "",
-    "User task:",
-    message,
-  ].join("\n");
-}