nolo-cli 0.106.0-alpha.1 → 0.106.2

package/{chunk-AEOE4Z6Q.js → chunk-XGOHDYM2.js}

@@ -1,17 +1,13 @@
 import {
   buildLocalAgentLookupKeys,
   shouldReadAgentKeyRemotely
-} from "./chunk-Z77CRGTW.js";
+} from "./chunk-KA5O5KQL.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-SV5IJK6K.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import {
-  readPipeText,
-  spawnProcess
-} from "./chunk-X7HHHIOZ.js";
 import {
   parseUserIdFromAuthToken,
   readOption,
@@ -19,9 +15,13 @@ import {
   resolveServerCandidates,
   resolveServerUrl
 } from "./chunk-A7GB5UGH.js";
+import {
+  readPipeText,
+  spawnProcess
+} from "./chunk-Y6ROFCZO.js";
 import {
   createAgentKey
-} from "./chunk-VMFTFOWF.js";
+} from "./chunk-OKGVNZTL.js";
 
 // packages/cli/agentRecordHelpers.ts
 import { readFileSync } from "node:fs";
@@ -252,6 +252,30 @@ async function writeAgentRecord(args) {
     throw new Error(`write failed: HTTP ${res.status} ${JSON.stringify(data)}`);
   }
 }
+async function invalidateAgentRecordCache(args) {
+  const invalidated = [];
+  for (const key of new Set(args.keys.filter((k) => typeof k === "string" && k))) {
+    try {
+      await args.db.del(key);
+      invalidated.push(key);
+    } catch {
+    }
+  }
+  return invalidated;
+}
+async function refreshAgentRecordCache(args) {
+  try {
+    await args.db.put(args.agentKey, {
+      ...args.record,
+      dbKey: args.agentKey,
+      key: args.record?.key || args.agentKey,
+      serverOrigin: args.serverOrigin,
+      cachedAt: Date.now()
+    });
+  } catch {
+    await invalidateAgentRecordCache({ db: args.db, keys: [args.agentKey] });
+  }
+}
 async function resolveAgentRecordFromHybridStore(args) {
   const agentKey = resolveCliAgentKeyInput(args.agentInput);
   const authToken = args.cliArgs ? resolveAuthToken(args.cliArgs, args.env) : resolveAuthToken(args.env);
@@ -484,7 +508,7 @@ function parseAgentUpdateArgs(args) {
   );
   const expiresAt = parseIsoTimestampOption(readOption(args, "--expires-at"), "--expires-at");
   const handle = readOption(args, "--handle")?.trim();
-  const promptSources = [prompt, promptFile, promptDoc].filter(Boolean);
+  const promptSources = [prompt, promptFile, promptDoc].filter((value) => value !== void 0);
   if (promptSources.length > 1) {
     throw new Error("--prompt / --prompt-file / --prompt-doc are mutually exclusive.");
   }
@@ -492,7 +516,7 @@ function parseAgentUpdateArgs(args) {
   if (cliProvider) updates.cliProvider = cliProvider;
   if (apiSource) updates.apiSource = apiSource;
   if (provider) updates.provider = provider;
-  if (prompt) updates.prompt = prompt;
+  if (prompt !== void 0) updates.prompt = prompt;
   if (promptFile) updates.prompt = readFileSync(promptFile, "utf8");
   if (tools) updates.tools = parseJsonishValue(tools);
   if (name) updates.name = name;
@@ -511,7 +535,7 @@ function parseAgentUpdateArgs(args) {
     updates[entry.slice(0, index)] = parseJsonishValue(entry.slice(index + 1));
   }
   if (Object.keys(updates).length === 0) {
-    if (!promptDoc && !copyProviderFrom) {
+    if (!promptDoc && !copyProviderFrom && !presetId) {
       throw new Error("No updates provided. Use --model / --cli-provider / --api-source / --field key=value.");
     }
   }
@@ -523,21 +547,19 @@ async function buildCreatedAgentRecord(args) {
   const resolvedAgentInput = resolveCliAgentKeyInput(args.parsed.agentInput);
   const agentKey = resolvedAgentInput.startsWith("agent-") ? resolvedAgentInput : createAgentKey.private(userId || "local", resolvedAgentInput);
   if (args.parsed.presetId) {
-    const { resolveProviderPresetFields } = await import("./providerPresetApply-FG6NZ57W.js");
+    const { resolveProviderPresetFields } = await import("./providerPresetApply-OJJXQ7NM.js");
     const fields = resolveProviderPresetFields(args.parsed.presetId);
     if (fields.kind === "manual") {
       throw new Error(
         `unknown --preset "${args.parsed.presetId}". Run \`nolo agent providers\` to list preset ids.`
       );
     }
-    if (fields.kind === "oauth" || fields.requiresDesktopOAuth) {
-      throw new Error(
-        `--preset "${args.parsed.presetId}" is an OAuth subscription; create it in Nolo Desktop (OAuth login required).`
-      );
-    }
     const u = args.parsed.updates;
     u.apiSource = "custom";
     u.provider = u.provider ?? fields.provider;
+    if (fields.apiKeyRef && !u.apiKeyRef) {
+      u.apiKeyRef = fields.apiKeyRef;
+    }
     if (fields.customProviderUrl && !u.customProviderUrl) {
       u.customProviderUrl = fields.customProviderUrl;
     }
@@ -670,6 +692,8 @@ export {
   queryUserRecords,
   deleteDbRecord,
   writeAgentRecord,
+  invalidateAgentRecordCache,
+  refreshAgentRecordCache,
   resolveAgentRecordFromHybridStore,
   agentRecordHasConfiguredCredential,
   sanitizeAgentRecordForCliOutput,

package/{chunk-53HEEOTT.js → chunk-XLWMNFBZ.js}

@@ -1,3 +1,6 @@
+import {
+  writeOAuthCredential
+} from "./chunk-HNGRBWYF.js";
 import {
   ANTIGRAVITY_AUTH_URL,
   ANTIGRAVITY_CALLBACK_PATH,
@@ -11,19 +14,16 @@ import {
   getAntigravityUserAgent,
   normalizeAntigravityTokenPayload,
   refreshAntigravityToken
-} from "./chunk-UZGQNTVW.js";
-import {
-  writeOAuthCredential
-} from "./chunk-ONXOABJR.js";
+} from "./chunk-BPLIXNC6.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import {
-  asOptionalFiniteNumber
-} from "./chunk-WWC7I6TA.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -367,6 +367,77 @@ async function refreshAntigravityOAuthToken(credential, deps = {}) {
 // packages/cli/oauth/flows/openai-codex.ts
 import { createHash as createHash2 } from "node:crypto";
 
+// packages/agent-runtime/oauthRefreshError.ts
+var PERMANENT_REFRESH_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  // OpenAI 令牌端点对失效/不存在的 refresh token 返回 401
+  // {"error":{"code":"invalid_refresh_token",...}}（2026-10-01 用必然无效的
+  // token 实测）。线上 chatgpt 凭据正是因为没认出它，被当成临时的
+  // "unauthorized"、每 15 分钟重试一次且永远不提示重新授权。
+  "invalid_refresh_token",
+  "refresh_token_reused",
+  "invalid_client"
+]);
+var SAFE_MESSAGES = {
+  invalid_grant: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_refresh_token: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  refresh_token_reused: "refresh token \u5DF2\u88AB\u5176\u4ED6\u526F\u672C\u4F7F\u7528\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_client: "OAuth \u5BA2\u6237\u7AEF\u88AB\u62D2\u7EDD\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  unauthorized: "\u4E0A\u6E38\u62D2\u7EDD\u4E86\u5237\u65B0\u8BF7\u6C42\uFF08401/403\uFF09",
+  rate_limited: "\u4E0A\u6E38\u9650\u6D41\uFF0C\u7A0D\u540E\u91CD\u8BD5",
+  http_5xx: "\u4E0A\u6E38\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528",
+  network: "\u65E0\u6CD5\u8FDE\u63A5\u4E0A\u6E38",
+  bad_response: "\u4E0A\u6E38\u8FD4\u56DE\u4E86\u65E0\u6CD5\u8BC6\u522B\u7684\u54CD\u5E94",
+  unknown: "\u5237\u65B0\u5931\u8D25"
+};
+var OAuthRefreshError = class extends Error {
+  code;
+  status;
+  retryAfterMs;
+  constructor(code, opts = {}) {
+    super(SAFE_MESSAGES[code]);
+    this.name = "OAuthRefreshError";
+    this.code = code;
+    if (opts.status !== void 0) this.status = opts.status;
+    if (opts.retryAfterMs !== void 0) this.retryAfterMs = opts.retryAfterMs;
+  }
+  get permanent() {
+    return PERMANENT_REFRESH_CODES.has(this.code);
+  }
+};
+function readErrorCode(payload) {
+  if (!payload || typeof payload !== "object") return void 0;
+  const err = payload.error;
+  if (typeof err === "string") return err;
+  if (err && typeof err === "object") {
+    const code = err.code;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+function classifyOAuthRefreshHttpFailure(status, payload, headers) {
+  const raw = readErrorCode(payload)?.toLowerCase();
+  if (raw === "invalid_grant") return new OAuthRefreshError("invalid_grant", { status });
+  if (raw === "invalid_refresh_token") {
+    return new OAuthRefreshError("invalid_refresh_token", { status });
+  }
+  if (raw === "refresh_token_reused") {
+    return new OAuthRefreshError("refresh_token_reused", { status });
+  }
+  if (raw === "invalid_client") return new OAuthRefreshError("invalid_client", { status });
+  if (status === 429) {
+    const seconds = Number(headers?.get("retry-after"));
+    return new OAuthRefreshError("rate_limited", {
+      status,
+      ...Number.isFinite(seconds) && seconds > 0 ? { retryAfterMs: seconds * 1e3 } : {}
+    });
+  }
+  if (status === 401 || status === 403) return new OAuthRefreshError("unauthorized", { status });
+  if (status >= 500) return new OAuthRefreshError("http_5xx", { status });
+  return new OAuthRefreshError("unknown", { status });
+}
+var TRANSIENT_MAX_MS = 15 * 6e4;
+
 // packages/agent-runtime/openaiCodexOAuth.ts
 var OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var OPENAI_CODEX_SCOPES = [
@@ -463,17 +534,14 @@ async function refreshOpenAiCodexToken(credential, deps = {}) {
       signal: AbortSignal.timeout(OPENAI_CODEX_TOKEN_REQUEST_TIMEOUT_MS)
     });
   } catch (error) {
-    throw new Error(
-      `OpenAI Codex token refresh failed: ${toErrorMessage(error)}`
-    );
+    throw new OAuthRefreshError("network");
   }
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" && payload.error_description ? payload.error_description : typeof payload.error === "string" && payload.error ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`OpenAI Codex token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("OpenAI Codex token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeOpenAiCodexTokenPayload({
@@ -1047,11 +1115,10 @@ async function refreshAnthropicToken(credential, deps = {}) {
   });
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`Claude token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("Claude token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeAnthropicTokenPayload({

package/{chunk-V4MJDUSR.js → chunk-YFU5EELM.js}

@@ -4,11 +4,11 @@ import {
 import {
   patch,
   read
-} from "./chunk-H62HCIUP.js";
+} from "./chunk-ZYM73IHG.js";
 import {
   DEVICE_LOCAL_OWNER_ID,
   isDeviceLocalSpaceBody
-} from "./chunk-UKWGR5SS.js";
+} from "./chunk-O7SVKKLY.js";
 import {
   selectIdentityUserId
 } from "./chunk-SEJ5OS6F.js";

package/{chunk-IUTWFZOX.js → chunk-YQFLBS6A.js}

@@ -7,7 +7,7 @@ import {
 import {
   clipMultilineText,
   fetchAndSerializeTable
-} from "./chunk-H56FOERC.js";
+} from "./chunk-XDQ7PHU3.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -18,104 +18,106 @@ import {
   parseRetryAfterHeaderMs
 } from "./chunk-3L2WKC3W.js";
 import {
+  resolvePageReadMarkdown,
   slateToSimplifiedMarkdown
-} from "./chunk-J4MOO56S.js";
+} from "./chunk-QDH32WF5.js";
 import {
   waitForAbortableDelay
 } from "./chunk-N4G4PKQ6.js";
 import {
   extractCategorizedMentions
-} from "./chunk-MEYIRKDN.js";
+} from "./chunk-AGIM7IMJ.js";
 import {
   fetchAndCacheMessages
-} from "./chunk-WC6UUQ2C.js";
+} from "./chunk-VYKXIHRP.js";
 import {
   shouldUseServerProxy
-} from "./chunk-YYLHWIW6.js";
+} from "./chunk-UKZX3NHN.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-XA2FJW4L.js";
+} from "./chunk-3SXZ6SUC.js";
 import {
   buildSkillGuidancePromptBlock,
   extractRuntimePageCapabilities,
   resolveBuiltinSkillPage,
   resolveSkillGraphFromRoots
-} from "./chunk-JRQFUXY7.js";
+} from "./chunk-OZ2IIIRP.js";
 import {
+  DELETE_SAFETY_RED_LINE,
   buildIdentityBlock,
   buildRuntimeGuidanceBlocks,
   compileContextLayers,
   detectDispatchIntentFromMessages,
   normalizeChatCompletionsBodyForProvider,
   resolveToolGuidedSections
-} from "./chunk-L5UXH3B2.js";
+} from "./chunk-BIH7KCDJ.js";
 import {
   convertMessagesToResponsesInput,
   getUsageRequestOptions,
   preserveAgentStateFields,
   stablePromptCacheKey
-} from "./chunk-PUOC4YRO.js";
+} from "./chunk-UM7TA3K4.js";
+import {
+  createFileCredentialBroker
+} from "./chunk-2U3NHADM.js";
+import {
+  estimateTokenCount
+} from "./chunk-PSCNXBYA.js";
+import {
+  createSpaceKey
+} from "./chunk-UAD2WT54.js";
+import {
+  read
+} from "./chunk-ZYM73IHG.js";
+import {
+  MEMORY_USE_GUIDANCE,
+  buildUserResponseLanguageContext,
+  wrapHistoricalSummaryWithReplayGuard
+} from "./chunk-4VJAC32I.js";
+import {
+  canonicalizeToolNames
+} from "./chunk-IHPDK6UD.js";
 import {
   ANTIGRAVITY_CLOUD_CODE_BASE_URL,
   isAntigravityOAuthAgent
-} from "./chunk-UZGQNTVW.js";
+} from "./chunk-BPLIXNC6.js";
 import {
   buildProviderAuthHeaders
-} from "./chunk-6OZ36FXI.js";
-import {
-  estimateTokenCount
-} from "./chunk-PSCNXBYA.js";
+} from "./chunk-SJ7CUF65.js";
 import {
   isOpenAiResponsesModel,
   resolvePlatformChatCompletionsEndpoint,
   resolvePlatformResponsesEndpoint
-} from "./chunk-GQBOR3G6.js";
+} from "./chunk-5F7UKMLN.js";
 import {
   clampReasoningEffort,
   getModelConfig,
   isModelSupportReasoningEffort
-} from "./chunk-OIVSQH2O.js";
-import {
-  createFileCredentialBroker
-} from "./chunk-HVURBGF3.js";
+} from "./chunk-GU7DC2TD.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import {
-  MEMORY_USE_GUIDANCE,
-  buildUserResponseLanguageContext,
-  wrapHistoricalSummaryWithReplayGuard
-} from "./chunk-2GRGFCF6.js";
-import {
-  canonicalizeToolNames
-} from "./chunk-O6OSWFZQ.js";
 import {
   isDeepInfraKimiModel,
   isFireworksKimiModel,
   isPlatformMimoProviderModel,
   resolveFireworksKimiModel
-} from "./chunk-Q67DOFOO.js";
-import {
-  createSpaceKey
-} from "./chunk-UAD2WT54.js";
-import {
-  read
-} from "./chunk-H62HCIUP.js";
+} from "./chunk-IYIXAIEB.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
-import {
-  extractCustomId
-} from "./chunk-M2EJHDJP.js";
 import {
   getRuntimeServerContext
-} from "./chunk-UKWGR5SS.js";
+} from "./chunk-O7SVKKLY.js";
 import {
-  isAbortError
-} from "./chunk-QOKAKDPE.js";
+  extractCustomId
+} from "./chunk-M2EJHDJP.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  isAbortError
+} from "./chunk-HIM3FCLF.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -648,6 +650,14 @@ ${contexts.userGlobalPrompt.trim()} ` : "";
   const dialogSummarySection = contexts.dialogSummary?.trim() ? `--- \u5386\u53F2\u5BF9\u8BDD\u6458\u8981 ---
 ${wrapHistoricalSummaryWithReplayGuard(contexts.dialogSummary)}` : "";
   return compileContextLayers([
+    // 删除安全红线：系统层最高优先级约束，位于所有层之前（含身份信息），
+    // owner 要求常驻「根本提示词」的最顶部（2026-09-26 批量误删事故）。
+    {
+      id: "delete-safety-red-line",
+      owner: "platform",
+      cacheScope: "static",
+      content: DELETE_SAFETY_RED_LINE
+    },
     { id: "identity", owner: "platform", cacheScope: "session", content: identitySection },
     { id: "user-response-language", owner: "platform", cacheScope: "session", content: buildUserResponseLanguageContext({ language: safeLanguage }) },
     { id: "startup-protocol", owner: "platform", cacheScope: "static", content: startupProtocol },
@@ -655,6 +665,7 @@ ${wrapHistoricalSummaryWithReplayGuard(contexts.dialogSummary)}` : "";
     { id: "tool-round-economy", owner: "platform", cacheScope: "session", content: toolSections.toolRoundEconomy },
     { id: "tool-use-guidance", owner: "platform", cacheScope: "session", content: toolSections.toolUseGuidance },
     { id: "privilege-escalation", owner: "platform", cacheScope: "session", content: toolSections.privilegeEscalation },
+    { id: "shell-task-lifecycle", owner: "platform", cacheScope: "session", content: toolSections.shellTaskLifecycle },
     { id: "agent-orchestration", owner: "platform", cacheScope: "session", content: toolSections.agentOrchestration },
     { id: "agent-collaboration", owner: "platform", cacheScope: "session", content: toolSections.agentCollaboration },
     { id: "web-access", owner: "platform", cacheScope: "session", content: toolSections.webAccess },
@@ -776,8 +787,13 @@ var buildRequestBody = (options) => {
     endpoint: customProviderUrl
   });
   Object.assign(bodyData, usageRequestOptions);
-  if (reasoning_effort && isModelSupportReasoningEffort(model)) {
-    const clamped = clampReasoningEffort(reasoning_effort, providerName);
+  const effectiveProviderForReasoning = providerName?.toLowerCase() === "openrouter" || customProviderUrl?.toLowerCase().includes("openrouter.ai") ? "openrouter" : providerName;
+  if (reasoning_effort && isModelSupportReasoningEffort(model, effectiveProviderForReasoning)) {
+    const clamped = clampReasoningEffort(
+      reasoning_effort,
+      effectiveProviderForReasoning,
+      model
+    );
     if (clamped) {
       bodyData.reasoning_effort = clamped;
     }
@@ -1208,7 +1224,7 @@ var buildProxyPayload = (bodyData, api, agentConfig, dialogId) => {
   };
 };
 var fetchDirectly = async (params) => {
-  const { api, agentConfig, bodyData, signal, currentServer, token } = params;
+  const { api, agentConfig, bodyData, signal, currentServer, token, dialogId } = params;
   try {
     const apiKey = await resolveDirectRequestApiKey(agentConfig, {
       syncFetcher: currentServer && token ? (ref) => fetchServerSyncedCredential({ currentServer, authToken: token }, ref) : void 0,
@@ -1228,7 +1244,8 @@ var fetchDirectly = async (params) => {
     const authHeaders = buildProviderAuthHeaders({
       endpoint: api,
       apiKey: apiKey ?? "",
-      apiKeyHeader: agentConfig.apiKeyHeader
+      apiKeyHeader: agentConfig.apiKeyHeader,
+      sessionId: dialogId || agentConfig.dbKey || agentConfig.key
     });
     return await fetch(api, {
       method: "POST",
@@ -1794,12 +1811,17 @@ ${tableMd}
 `;
 };
 var fetchSlateReference = async (dbKey, refContent, dispatch, options) => {
-  if (!refContent?.slateData) return null;
+  const hasSlate = Array.isArray(refContent?.slateData) && refContent.slateData.length > 0;
+  const legacyContent = hasSlate ? null : resolvePageReadMarkdown(refContent).trim() || null;
+  if (!hasSlate && !legacyContent) return null;
   const title = refContent.title || `Untitled (${dbKey})`;
   let contentString;
   let contentType;
   const inlineMentionMeta = options.inlineMentionMeta ?? options.format === "simplified_markdown";
-  switch (options.format) {
+  if (legacyContent) {
+    contentType = "Markdown (legacy content)";
+    contentString = legacyContent;
+  } else switch (options.format) {
     case "text":
       contentType = "Plain Text";
       contentString = slateToText(refContent.slateData);