nolo-cli 0.1.44 → 0.1.46

package/agent-runtime/runtimeToolPolicy.ts

@@ -1,191 +0,0 @@
-import type { AgentRuntimeAgentConfig } from "./hostAdapter";
-import type { AgentRuntimeHost, AgentRuntimeToolPolicy } from "./types";
-
-type EnvLike = Record<string, string | undefined>;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-function stringArray(value: unknown): string[] {
-  if (!Array.isArray(value)) return [];
-  return value.filter((item): item is string => typeof item === "string" && !!item.trim());
-}
-
-function unique(values: string[]) {
-  return [...new Set(values)];
-}
-
-function mergeRecords<T extends Record<string, unknown>>(
-  base: T | undefined,
-  override: T | undefined,
-): T | undefined {
-  if (!base && !override) return undefined;
-  return {
-    ...(base ?? {}),
-    ...(override ?? {}),
-  } as T;
-}
-
-export function normalizeAgentRuntimeToolPolicy(
-  value: unknown,
-): AgentRuntimeToolPolicy | undefined {
-  if (!isRecord(value)) return undefined;
-  return {
-    version: 1,
-    ...(stringArray(value.agentTools).length
-      ? { agentTools: unique(stringArray(value.agentTools)) }
-      : {}),
-    ...(stringArray(value.runtimeTools).length
-      ? { runtimeTools: unique(stringArray(value.runtimeTools)) }
-      : {}),
-    ...(isRecord(value.workspace) ? { workspace: { ...value.workspace } } : {}),
-    ...(isRecord(value.shell) ? { shell: { ...value.shell } } : {}),
-    ...(isRecord(value.isolation) ? { isolation: { ...value.isolation } } : {}),
-    ...(isRecord(value.git) ? { git: { ...value.git } } : {}),
-    ...(isRecord(value.budget) ? { budget: { ...value.budget } } : {}),
-    ...(isRecord(value.audit) ? { audit: { ...value.audit } } : {}),
-  };
-}
-
-function runtimeBindingRecord(
-  runtimeBinding: unknown,
-): Record<string, unknown> | undefined {
-  return isRecord(runtimeBinding) ? runtimeBinding : undefined;
-}
-
-function runtimeToolNamesFromPolicy(policy: AgentRuntimeToolPolicy | undefined) {
-  return stringArray(policy?.runtimeTools);
-}
-
-function readPositiveNumber(value: unknown) {
-  const parsed = Number(value);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
-}
-
-export function mergeAgentRuntimeToolPolicies(
-  base?: AgentRuntimeToolPolicy,
-  override?: AgentRuntimeToolPolicy,
-): AgentRuntimeToolPolicy | undefined {
-  if (!base && !override) return undefined;
-  return {
-    version: 1,
-    agentTools: unique([
-      ...(base?.agentTools ?? []),
-      ...(override?.agentTools ?? []),
-    ]),
-    runtimeTools: unique([
-      ...(base?.runtimeTools ?? []),
-      ...(override?.runtimeTools ?? []),
-    ]),
-    workspace: {
-      ...(base?.workspace ?? {}),
-      ...(override?.workspace ?? {}),
-      writableRoots: unique([
-        ...(base?.workspace?.writableRoots ?? []),
-        ...(override?.workspace?.writableRoots ?? []),
-      ]),
-    },
-    shell: mergeRecords(base?.shell, override?.shell),
-    isolation: mergeRecords(base?.isolation, override?.isolation),
-    git: mergeRecords(base?.git, override?.git),
-    budget: mergeRecords(base?.budget, override?.budget),
-    audit: mergeRecords(base?.audit, override?.audit),
-  };
-}
-
-export function resolveRequestedRuntimeToolNames(args: {
-  agentConfig: Pick<
-    AgentRuntimeAgentConfig,
-    "toolNames" | "runtimeToolPolicy" | "runtimeBinding"
-  >;
-}) {
-  const runtimeBinding = runtimeBindingRecord(args.agentConfig.runtimeBinding);
-  const bindingPolicy = normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicy,
-  );
-  const bindingSnapshotPolicy = normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicySnapshot,
-  );
-  return unique([
-    ...stringArray(args.agentConfig.toolNames),
-    ...runtimeToolNamesFromPolicy(
-      normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy),
-    ),
-    ...runtimeToolNamesFromPolicy(bindingPolicy),
-    ...runtimeToolNamesFromPolicy(bindingSnapshotPolicy),
-  ]);
-}
-
-export function resolveCurrentRunRuntimeToolPolicy(
-  agentConfig: Pick<AgentRuntimeAgentConfig, "runtimeToolPolicy" | "runtimeBinding"> | null | undefined,
-): AgentRuntimeToolPolicy | undefined {
-  const runtimeBinding = runtimeBindingRecord(agentConfig?.runtimeBinding);
-  return normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicySnapshot ??
-      agentConfig?.runtimeToolPolicy ??
-      runtimeBinding?.runtimeToolPolicy,
-  );
-}
-
-export function resolveLocalRuntimeEnvFromPolicy(
-  runtimeEnv: EnvLike,
-  policy?: AgentRuntimeToolPolicy,
-): EnvLike {
-  void policy;
-  return { ...runtimeEnv };
-}
-
-export function resolveLocalWorkspaceExecutorOptionsFromPolicy(
-  policy?: AgentRuntimeToolPolicy,
-) {
-  const maxOutputBytes = readPositiveNumber(policy?.shell?.maxOutputBytes);
-  return {
-    ...(maxOutputBytes ? { commandOutputLimit: Math.floor(maxOutputBytes) } : {}),
-  };
-}
-
-function policyRequestsHostedWorkspace(policy: AgentRuntimeToolPolicy | undefined) {
-  if (!policy) return false;
-  const workspaceMode = policy.workspace?.mode;
-  return (
-    policy.shell?.enabled === true ||
-    policy.runtimeTools?.some((tool) => tool === "execShell") ||
-    workspaceMode === "lease"
-  );
-}
-
-function applyWebRuntimeSafetyBaseline(
-  policy: AgentRuntimeToolPolicy | undefined,
-): AgentRuntimeToolPolicy | undefined {
-  if (!policyRequestsHostedWorkspace(policy)) return policy;
-  return mergeAgentRuntimeToolPolicies(
-    policy,
-    {
-      version: 1,
-      shell: {
-        commandPolicy: "approval",
-        networkPolicy: "default-deny",
-      },
-      isolation: {
-        mode: "os-sandbox",
-      },
-      audit: {
-        logToolCalls: true,
-        logShellCommands: true,
-        writeToDialog: true,
-      },
-    },
-  );
-}
-
-export function resolveEffectiveRuntimeToolPolicy(args: {
-  agentConfig: Pick<AgentRuntimeAgentConfig, "runtimeToolPolicy" | "runtimeBinding">;
-  host?: AgentRuntimeHost;
-}): AgentRuntimeToolPolicy | undefined {
-  const agentPolicy = resolveCurrentRunRuntimeToolPolicy(args.agentConfig);
-  const effectivePolicy = mergeAgentRuntimeToolPolicies(agentPolicy);
-  return args.host === "web"
-    ? applyWebRuntimeSafetyBaseline(effectivePolicy)
-    : effectivePolicy;
-}

package/agent-runtime/runtimeToolSurface.ts

@@ -1,199 +0,0 @@
-export const DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS = [
-  "listDialogs",
-  "readDialog",
-  "listAgents",
-  "readAgent",
-  "listSpaces",
-  "readSpace",
-  "readDoc",
-  "readSkillDoc",
-  "listTables",
-  "queryTableRows",
-  "cliWhoami",
-  "cliDoctor",
-] as const;
-
-export type RuntimeToolSurfaceHost =
-  | "web"
-  | "cli"
-  | "desktop"
-  | "connector"
-  | "server";
-
-export type RuntimeToolSurfaceVisibility =
-  | "private"
-  | "public"
-  | "anonymous"
-  | "shared";
-
-export type RuntimeToolSurfaceInput = {
-  explicitToolNames?: string[] | null;
-  currentUserId?: string | null;
-  agentOwnerId?: string | null;
-  invocationVisibility?: RuntimeToolSurfaceVisibility;
-  runtimeHost: RuntimeToolSurfaceHost;
-  trustedPrivateInvocation?: boolean;
-};
-
-export type RuntimeToolSurfaceResult = {
-  explicitToolNames: string[];
-  injectedToolNames: string[];
-  finalToolNames: string[];
-  auditReason:
-    | "private-authenticated-defaults"
-    | "explicit-only-public"
-    | "explicit-only-anonymous"
-    | "explicit-only-shared"
-    | "explicit-only-missing-identity"
-    | "explicit-only-owner-mismatch";
-};
-
-export type RuntimeToolSurfaceForAgentInput = {
-  explicitToolNames?: string[] | null;
-  currentUserId?: string | null;
-  agentOwnerId?: string | null;
-  agentKey?: string | null;
-  isPublic?: boolean | null;
-  sharingLevel?: string | null;
-  runtimeHost: RuntimeToolSurfaceHost;
-  trustedPrivateInvocation?: boolean;
-};
-
-function uniqueToolNames(values: readonly string[]) {
-  return [
-    ...new Set(
-      values
-        .filter((value) => typeof value === "string")
-        .map((value) => value.trim())
-        .filter(Boolean)
-    ),
-  ];
-}
-
-function canInjectPrivateDefaults(args: RuntimeToolSurfaceInput) {
-  if (!args.currentUserId) return false;
-  if (args.invocationVisibility !== "private") return false;
-  if (args.agentOwnerId && args.agentOwnerId === args.currentUserId) return true;
-  if (args.trustedPrivateInvocation === true) return true;
-  return false;
-}
-
-function explicitOnlyReason(
-  args: RuntimeToolSurfaceInput
-): RuntimeToolSurfaceResult["auditReason"] {
-  if (!args.currentUserId || !args.agentOwnerId) {
-    return "explicit-only-missing-identity";
-  }
-  if (args.invocationVisibility === "public") return "explicit-only-public";
-  if (args.invocationVisibility === "shared") return "explicit-only-shared";
-  if (args.agentOwnerId !== args.currentUserId) {
-    return "explicit-only-owner-mismatch";
-  }
-  return "explicit-only-anonymous";
-}
-
-export function resolveRuntimeToolSurface(
-  args: RuntimeToolSurfaceInput
-): RuntimeToolSurfaceResult {
-  const explicitToolNames = uniqueToolNames(args.explicitToolNames ?? []);
-
-  if (canInjectPrivateDefaults(args)) {
-    const injectedToolNames = [...DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS];
-    return {
-      explicitToolNames,
-      injectedToolNames,
-      finalToolNames: uniqueToolNames([
-        ...explicitToolNames,
-        ...injectedToolNames,
-      ]),
-      auditReason: "private-authenticated-defaults",
-    };
-  }
-
-  return {
-    explicitToolNames,
-    injectedToolNames: [],
-    finalToolNames: explicitToolNames,
-    auditReason: explicitOnlyReason(args),
-  };
-}
-
-export function isPublicRuntimeAgentRef(value: unknown) {
-  return (
-    typeof value === "string" &&
-    (value.startsWith("agent-pub-") || value.startsWith("cybot-pub-"))
-  );
-}
-
-export function inferOwnerIdFromRuntimeAgentKey(value: unknown) {
-  if (typeof value !== "string") return null;
-  const privateAgentMatch = value.match(/^agent-([^-]+)-(.+)$/);
-  if (privateAgentMatch && privateAgentMatch[1] !== "pub") {
-    return privateAgentMatch[1];
-  }
-  const privateCybotMatch = value.match(/^cybot-([^-]+)-(.+)$/);
-  if (privateCybotMatch && privateCybotMatch[1] !== "pub") {
-    return privateCybotMatch[1];
-  }
-  return null;
-}
-
-export function resolveRuntimeToolSurfaceForAgent(
-  args: RuntimeToolSurfaceForAgentInput
-) {
-  const agentKey = typeof args.agentKey === "string" ? args.agentKey : "";
-  const currentUserId = typeof args.currentUserId === "string" ? args.currentUserId : "";
-  const inferredOwnerId =
-    args.agentOwnerId ??
-    (currentUserId &&
-    (agentKey.startsWith(`agent-${currentUserId}-`) ||
-      agentKey.startsWith(`cybot-${currentUserId}-`))
-      ? currentUserId
-      : inferOwnerIdFromRuntimeAgentKey(agentKey));
-  const publicRef = isPublicRuntimeAgentRef(agentKey);
-  const visibility =
-    args.trustedPrivateInvocation === true
-      ? "private"
-      : publicRef || args.isPublic === true || args.sharingLevel === "public"
-      ? "public"
-      : "private";
-  return resolveRuntimeToolSurface({
-    explicitToolNames: args.explicitToolNames,
-    currentUserId: args.currentUserId,
-    agentOwnerId: inferredOwnerId,
-    invocationVisibility: visibility,
-    runtimeHost: args.runtimeHost,
-    trustedPrivateInvocation: args.trustedPrivateInvocation,
-  });
-}
-
-const SECRET_FIELD_NAMES = [
-  "apikey",
-  "api_key",
-  "secret",
-  "token",
-  "authorization",
-  "credential",
-  "password",
-];
-
-function isSecretFieldName(key: string) {
-  const normalized = key.toLowerCase();
-  return SECRET_FIELD_NAMES.some((name) => normalized.includes(name));
-}
-
-export function redactAgentRecordForWorkspaceTool(record: unknown): unknown {
-  if (!record || typeof record !== "object") return record;
-  if (Array.isArray(record)) return record.map(redactAgentRecordForWorkspaceTool);
-  const redacted: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(record as Record<string, unknown>)) {
-    if (isSecretFieldName(key)) {
-      redacted[key] = "[redacted]";
-      continue;
-    }
-    redacted[key] = value && typeof value === "object"
-      ? redactAgentRecordForWorkspaceTool(value)
-      : value;
-  }
-  return redacted;
-}

package/agent-runtime/shellCommandPolicy.ts

@@ -1,120 +0,0 @@
-export type ShellCommandPolicyVerdict = "allowed" | "forbidden";
-
-export type ShellCommandPolicyResult =
-  | {
-      verdict: "allowed";
-    }
-  | {
-      verdict: "forbidden";
-      code: "destructive_action_requires_confirmation";
-      reason: string;
-      policy: {
-        capability: "destructive_action";
-        target: "shell_command";
-        detail: string;
-      };
-    };
-
-const DESTRUCTIVE_NEGATION_PATTERNS = [
-  "别删",
-  "别删除",
-  "不要删",
-  "不要删除",
-  "别乱删",
-  "别动",
-  "不要动",
-  "不要清理",
-  "不要清空",
-  "不要重置",
-  "don't delete",
-  "do not delete",
-  "don't remove",
-  "do not remove",
-  "without deleting",
-] as const;
-
-const EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS = [
-  "删除",
-  "删掉",
-  "移除",
-  "清理",
-  "清空",
-  "重置",
-  "drop",
-  "delete",
-  "remove",
-  "erase",
-  "clean up",
-  "reset",
-] as const;
-
-const SHELL_DESTRUCTIVE_PATTERNS = [
-  /\brm\s+(-[^\n\r]*\s+)?/i,
-  /\bremove-item\b/i,
-  /\bdel\s+\/?[a-z]*\s+/i,
-  /\berase\s+/i,
-  /\brmdir\s+/i,
-  /\brd\s+\/s\b/i,
-  /\bgit\s+reset\s+(--hard\b|--merge\b|--keep\b)/i,
-  /\bgit\s+clean\s+-[^\n\r]*f/i,
-  /\bgit\s+checkout\s+--\b/i,
-  /\bgit\s+restore\s+--source=/i,
-] as const;
-
-const normalizeUserInput = (value: unknown): string =>
-  typeof value === "string" ? value.trim().toLowerCase() : "";
-
-const containsAny = (text: string, patterns: readonly string[]): boolean =>
-  patterns.some((pattern) => text.includes(pattern));
-
-const hasExplicitDestructivePermission = (userInput: unknown): boolean => {
-  const normalized = normalizeUserInput(userInput);
-  if (!normalized) return false;
-  if (containsAny(normalized, DESTRUCTIVE_NEGATION_PATTERNS)) return false;
-  return containsAny(normalized, EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS);
-};
-
-const buildCombinedShellInput = (args: {
-  command?: unknown;
-  input?: unknown;
-}): string =>
-  [
-    typeof args.command === "string" ? args.command : "",
-    typeof args.input === "string" ? args.input : "",
-  ]
-    .filter(Boolean)
-    .join("\n");
-
-export function isDestructiveShellCommand(args: {
-  command?: unknown;
-  input?: unknown;
-}): boolean {
-  const combined = buildCombinedShellInput(args);
-  if (!combined.trim()) return false;
-  return SHELL_DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(combined));
-}
-
-export function evaluateShellCommandPolicy(args: {
-  command?: unknown;
-  input?: unknown;
-  userInput?: unknown;
-}): ShellCommandPolicyResult {
-  if (
-    isDestructiveShellCommand(args) &&
-    !hasExplicitDestructivePermission(args.userInput)
-  ) {
-    return {
-      verdict: "forbidden",
-      code: "destructive_action_requires_confirmation",
-      reason:
-        "当前运行默认禁止自动执行可能删除用户内容的 shell 命令。只有当用户在当前请求里明确要求删除/清理时，才能继续；否则请停止并先说明限制。",
-      policy: {
-        capability: "destructive_action",
-        target: "shell_command",
-        detail: "execShell destructive command",
-      },
-    };
-  }
-
-  return { verdict: "allowed" };
-}

package/agent-runtime/types.ts

@@ -1,137 +0,0 @@
-export type AgentRuntimeMode = "local" | "server";
-export type AgentRuntimeHost = "cli" | "desktop" | "web" | "server";
-export type AgentRuntimeRequestedMode = "auto" | AgentRuntimeMode;
-
-export const AGENT_RUNTIME_MESSAGE_ROLES = ["system", "user", "assistant", "tool"] as const;
-
-export type AgentRuntimeMessageContent =
-  | string
-  | Array<
-      | { type: "text"; text: string }
-      | {
-          type: "image_url";
-          image_url: { url: string };
-          google_native?: {
-            inlineData: {
-              mimeType: string;
-              data: string;
-            };
-            thoughtSignature?: string;
-          };
-        }
-    >
-  | null;
-
-export interface AgentRuntimeToolCall {
-  id: string;
-  type: "function";
-  function: { name: string; arguments: string };
-}
-
-export interface AgentRuntimeChatMessage {
-  role: (typeof AGENT_RUNTIME_MESSAGE_ROLES)[number];
-  content: AgentRuntimeMessageContent;
-  tool_call_id?: string;
-  tool_calls?: AgentRuntimeToolCall[];
-  tool_result_metadata?: Record<string, unknown>;
-  reasoning_content?: string;
-  cybotKey?: string;
-  agentKey?: string;
-  agentName?: string;
-  parallelSessionId?: string;
-  parallelBranchId?: string;
-  parallelLabel?: string;
-  parallelIndex?: number;
-}
-
-export interface AgentRuntimeResult {
-  content: string;
-  model: string;
-  provider?: string;
-  inputPrice?: number;
-  outputPrice?: number;
-  usage?: Record<string, any>;
-  trace?: AgentRuntimeChatMessage[];
-  tool_calls?: AgentRuntimeToolCall[];
-  reasoning_content?: string;
-  runtimeToolNames?: string[];
-  runtimeToolSurface?: unknown;
-  toolCallCount?: number;
-  policyState?: unknown;
-  latencyProfile?: {
-    totalMs: number;
-    llmRequestCount: number;
-    llmWaitMs: number;
-    llmJsonParseMs: number;
-    toolExecutionMs: number;
-    timeToFirstAssistantMs?: number;
-    timeToFirstToolResultMs?: number;
-    endedAt: number;
-  };
-}
-
-export type AgentRuntimeDecisionInput = {
-  requestedMode?: AgentRuntimeRequestedMode;
-  syncRequested?: boolean;
-  host?: AgentRuntimeHost;
-  hasLocalAgentConfig: boolean;
-  hasLocalProvider: boolean;
-  hasLocalPersistence: boolean;
-  missingLocalCapabilities?: string[];
-  requiresServer?: boolean;
-  serverFallbackAvailable: boolean;
-};
-
-export type AgentRuntimeWorkspaceMode = "none" | "current" | "lease";
-
-export type AgentRuntimeShellPolicy = {
-  enabled?: boolean;
-  mode?: "off" | "worktree";
-  commandPolicy?: "denylist" | "allowlist" | "approval";
-  networkPolicy?: "default-deny" | "allowed" | "approval";
-  maxOutputBytes?: number;
-};
-
-export type AgentRuntimeGitPolicy = {
-  canCommit?: boolean;
-  canPushAlpha?: boolean;
-  canMergeMain?: boolean;
-};
-
-export type AgentRuntimeAuditPolicy = {
-  logToolCalls?: boolean;
-  logShellCommands?: boolean;
-  writeToDialog?: boolean;
-  writeToTask?: boolean;
-};
-
-export type AgentRuntimeIsolationPolicy = {
-  mode?: "none" | "os-sandbox" | "container" | "gvisor" | "microvm" | "dedicated-vm";
-};
-
-export type AgentRuntimeToolPolicy = {
-  version?: 1;
-  agentTools?: string[];
-  runtimeTools?: string[];
-  workspace?: {
-    mode?: AgentRuntimeWorkspaceMode;
-    writableRoots?: string[];
-    cwd?: string;
-  };
-  shell?: AgentRuntimeShellPolicy;
-  isolation?: AgentRuntimeIsolationPolicy;
-  git?: AgentRuntimeGitPolicy;
-  budget?: {
-    dailyUsdLimit?: number;
-    maxRunSeconds?: number;
-  };
-  audit?: AgentRuntimeAuditPolicy;
-};
-
-export type AgentRuntimeDecision = {
-  mode: AgentRuntimeMode;
-  runnable: boolean;
-  reason: string;
-  missingLocalCapabilities: string[];
-  syncAfterRun: boolean;
-};