nolo-cli 0.108.0-alpha.2 → 0.108.0

package/{chunk-SH43IESU.js → chunk-KQ7DAEZ7.js}

@@ -1,17 +1,14 @@
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
-
-// packages/desktop-chrome-connector/chromeConnector.ts
-import { existsSync as existsSync2, readFileSync } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
 
 // packages/desktop-chrome-connector/uploadSecurity.mjs
-import { existsSync, realpathSync, statSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
+import { existsSync, lstatSync, mkdirSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve } from "node:path";
 var DEFAULT_MAX_FILE_BYTES = 25 * 1024 * 1024;
 var DEFAULT_MAX_FILES = 10;
 var UploadSecurityError = class extends Error {
@@ -28,22 +25,106 @@ function isSubpath(parent, child) {
   const rel = relative(parent, child);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-function parseAllowedRoots(env = process.env) {
-  const raw = env?.NOLO_CHROME_UPLOAD_ROOTS;
-  if (!raw || typeof raw !== "string") {
-    return [];
+var DEFAULT_UPLOAD_ROOT_SUFFIX = join(".nolo", "uploads");
+function resolveDefaultUploadRoot(env = process.env) {
+  let home;
+  try {
+    home = env?.HOME || homedir();
+  } catch (err) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      `Could not determine the home directory for the default upload root: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (typeof home !== "string" || !isAbsolute(home)) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      `Home directory '${String(home)}' must be an absolute path to derive the default upload root '${DEFAULT_UPLOAD_ROOT_SUFFIX}'.`
+    );
+  }
+  return resolve(join(home, DEFAULT_UPLOAD_ROOT_SUFFIX));
+}
+function splitConfiguredRoots(raw) {
+  const entries = typeof raw === "string" ? raw.split(",").map((entry) => entry.trim()).filter(Boolean) : [];
+  const absolute = [];
+  const dropped = [];
+  for (const entry of entries) {
+    (isAbsolute(entry) ? absolute : dropped).push(entry);
   }
-  return raw.split(",").map((entry) => entry.trim()).filter(Boolean).filter((entry) => isAbsolute(entry)).map((entry) => {
-    const resolved = resolve(entry);
-    if (existsSync(resolved)) {
+  return { absolute, dropped };
+}
+function resolveUploadRoots(env = process.env) {
+  const raw = env?.NOLO_CHROME_UPLOAD_ROOTS;
+  if (raw !== void 0) {
+    const { absolute, dropped } = splitConfiguredRoots(raw);
+    const roots = absolute.map((entry) => {
+      const resolved = resolve(entry);
+      if (!existsSync(resolved)) {
+        return resolved;
+      }
       try {
         return realpathSync(resolved);
       } catch {
         return resolved;
       }
+    });
+    return { configured: true, isDefault: false, roots, dropped };
+  }
+  const defaultDir = resolveDefaultUploadRoot(env);
+  return {
+    configured: false,
+    isDefault: true,
+    roots: [existsSync(defaultDir) ? inspectDefaultUploadRoot(defaultDir) : defaultDir],
+    dropped: []
+  };
+}
+function ensureDefaultUploadRoot(env = process.env) {
+  if (env?.NOLO_CHROME_UPLOAD_ROOTS !== void 0) {
+    return resolveUploadRoots(env);
+  }
+  const defaultDir = resolveDefaultUploadRoot(env);
+  if (!existsSync(defaultDir)) {
+    try {
+      mkdirSync(defaultDir, { recursive: true, mode: 448 });
+    } catch (err) {
+      throw createUploadSecurityError(
+        "path_not_allowed",
+        `Default upload root '${defaultDir}' could not be created: ${err instanceof Error ? err.message : String(err)}`
+      );
     }
-    return resolved;
-  });
+  }
+  return { configured: false, isDefault: true, roots: [inspectDefaultUploadRoot(defaultDir)], dropped: [] };
+}
+function inspectDefaultUploadRoot(defaultDir) {
+  let lst;
+  try {
+    lst = lstatSync(defaultDir);
+  } catch (err) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      `Default upload root '${defaultDir}' could not be inspected: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (lst.isSymbolicLink()) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      `Default upload root '${defaultDir}' is a symbolic link, which is not permitted. Set NOLO_CHROME_UPLOAD_ROOTS to the real directory if you need a custom location.`
+    );
+  }
+  if (!lst.isDirectory()) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      `Default upload root '${defaultDir}' is not a directory.`
+    );
+  }
+  try {
+    return realpathSync(defaultDir);
+  } catch (err) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      `Default upload root '${defaultDir}' canonical path could not be resolved: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
 }
 function validateUploadFiles(options = {}) {
   const {
@@ -61,11 +142,14 @@ function validateUploadFiles(options = {}) {
       `Too many files: ${files.length} provided, maximum allowed is ${maxFiles}.`
     );
   }
-  const allowedRoots = parseAllowedRoots(env);
+  const rootsInfo = ensureDefaultUploadRoot(env);
+  const allowedRoots = rootsInfo.roots;
   if (allowedRoots.length === 0) {
+    const dropped = rootsInfo.dropped ?? [];
+    const droppedHint = dropped.length ? ` Ignored entries: ${dropped.map((entry) => `'${entry}'`).join(", ")} (only absolute paths are accepted; '~' and relative paths are never expanded).` : "";
     throw createUploadSecurityError(
       "path_not_allowed",
-      "Upload roots not configured in NOLO_CHROME_UPLOAD_ROOTS; all uploads are refused."
+      `NOLO_CHROME_UPLOAD_ROOTS is set but contains no usable absolute path; all uploads are refused.${droppedHint}`
     );
   }
   const fileStats = [];
@@ -135,8 +219,29 @@ function logUploadAudit(entry, logFn = console.warn) {
 }
 
 // packages/desktop-chrome-connector/chromeConnector.ts
+import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
 var NOLO_CHROME_CONNECTOR_EXTENSION_ID = "ahpdoopadkamnglhlacfjdfnonpjdplg";
+var NOLO_FIREFOX_CONNECTOR_EXTENSION_ID = "nolo-browser-connector@nolo.chat";
+var NOLO_CONNECTOR_EXTENSION_IDS = [
+  NOLO_CHROME_CONNECTOR_EXTENSION_ID,
+  NOLO_FIREFOX_CONNECTOR_EXTENSION_ID
+];
 var NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION = "2";
+var NOLO_CHROME_CONNECTOR_DEFAULT_PORTS = {
+  chrome: 38947,
+  firefox: 38948
+};
+var CONNECTOR_BROWSER_EXTENSION_IDS = {
+  chrome: NOLO_CHROME_CONNECTOR_EXTENSION_ID,
+  firefox: NOLO_FIREFOX_CONNECTOR_EXTENSION_ID
+};
+function connectorEndpointForBrowser(browser, env = process.env) {
+  const explicitUrl = env.NOLO_CHROME_CONNECTOR_RPC_URL;
+  if (explicitUrl) return explicitUrl;
+  const port = browser === "firefox" ? env.NOLO_FIREFOX_CONNECTOR_PORT : env.NOLO_CHROME_CONNECTOR_PORT;
+  return `http://127.0.0.1:${port || NOLO_CHROME_CONNECTOR_DEFAULT_PORTS[browser]}/rpc`;
+}
 function defaultTokenPath() {
   return resolve2(
     process.env.HOME || "",
@@ -149,6 +254,18 @@ function readConnectorToken(tokenPath = defaultTokenPath()) {
   return readFileSync(tokenPath, "utf8").trim();
 }
 var CHROME_TOOL_ACTIONS = {
+  browser_list_tabs: "list_tabs",
+  browser_open_tab: "open_tab",
+  browser_close_tab: "close_tab",
+  browser_read_page: "read_page",
+  browser_click_element: "click",
+  browser_type: "type",
+  browser_press: "press",
+  browser_scroll: "scroll",
+  browser_screenshot: "screenshot",
+  browser_read_console: "read_console",
+  browser_read_network: "read_network",
+  // Legacy aliases (kept for existing agents/tests).
   chrome_list_tabs: "list_tabs",
   chrome_open_tab: "open_tab",
   chrome_close_tab: "close_tab",
@@ -164,6 +281,12 @@ var CHROME_TOOL_ACTIONS = {
   chrome_upload_file: "set_files",
   chrome_upload: "set_files"
 };
+for (const legacyName of ["chrome_set_files", "chrome_upload_file", "chrome_upload"]) {
+  const action = CHROME_TOOL_ACTIONS[legacyName];
+  if (action) {
+    CHROME_TOOL_ACTIONS[`browser_${legacyName.slice("chrome_".length)}`] = action;
+  }
+}
 function createConnectorError(code, message, details) {
   const error = new Error(message);
   error.code = code;
@@ -183,9 +306,13 @@ function parseArguments(raw) {
   }
 }
 function errorPayload(error) {
+  const code = error?.code ?? "CHROME_CONNECTOR_ERROR";
   return {
-    code: error?.code ?? "CHROME_CONNECTOR_ERROR",
+    code,
     message: toErrorMessage(error),
+    ...code === "CHROME_CONNECTOR_UNAVAILABLE" ? {
+      hint: "The Nolo Browser Connector is not reachable. It runs inside the user's own Chrome or Firefox \u2014 ask the user to open their browser with the Nolo Browser Connector extension enabled, or install it from https://nolo.chat/downloads (Firefox can install the signed .xpi directly), then retry."
+    } : {},
     ...error?.details !== void 0 ? { details: error.details } : {}
   };
 }
@@ -198,7 +325,7 @@ function validateChromeConnectorPayload(action, payload) {
     if (!tabId) {
       throw createConnectorError(
         "TAB_ID_REQUIRED",
-        `Provide the tabId from chrome_list_tabs before calling ${action}.`
+        `Provide the tabId from browser_list_tabs before calling ${action}.`
       );
     }
     if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
@@ -210,7 +337,7 @@ function validateChromeConnectorPayload(action, payload) {
   if (!elementRef && !selector) {
     throw createConnectorError(
       "ELEMENT_TARGET_REQUIRED",
-      "Provide elementRef from chrome_read_page or a CSS selector."
+      "Provide elementRef from browser_read_page or a CSS selector."
     );
   }
   if (action === "set_files") {
@@ -240,8 +367,8 @@ function validateChromeConnectorPayload(action, payload) {
 }
 function createChromeConnectorClient(args) {
   if (args?.request) return { request: args.request };
-  const defaultPort = process.env.NOLO_CHROME_CONNECTOR_PORT || "38947";
-  const endpoint = args?.endpoint ?? process.env.NOLO_CHROME_CONNECTOR_RPC_URL ?? `http://127.0.0.1:${defaultPort}/rpc`;
+  const browser = args?.browser ?? "chrome";
+  const endpoint = args?.endpoint ?? connectorEndpointForBrowser(browser);
   const fetchImpl = args?.fetchImpl ?? fetch;
   const token = args?.token ?? readConnectorToken(args?.tokenPath);
   return {
@@ -285,7 +412,10 @@ var REQUIRED_CHROME_CONNECTOR_FEATURES = {
   type: ["compact_observation_v2", "action_gate"],
   press: ["compact_observation_v2", "action_gate"],
   scroll: ["compact_observation_v2"],
-  screenshot: ["browser_debug"],
+  // Both browsers advertise the dedicated `screenshot` feature: Chrome serves it through
+  // Page.captureScreenshot (browser_debug-adjacent) while Firefox falls back to
+  // tabs.captureVisibleTab, so gating on browser_debug would wrongly refuse Firefox.
+  screenshot: ["screenshot"],
   read_console: ["browser_debug"],
   read_network: ["browser_debug"],
   detach: ["browser_debug"],
@@ -294,19 +424,43 @@ var REQUIRED_CHROME_CONNECTOR_FEATURES = {
 function requiredFeaturesForConnectorAction(action) {
   return [...REQUIRED_CHROME_CONNECTOR_FEATURES[action] ?? []];
 }
+function createChromeConnectorClientResolver(args) {
+  const cache = /* @__PURE__ */ new Map();
+  const overrides = args?.clients;
+  const resolve3 = (selector) => {
+    const existing = cache.get(selector);
+    if (existing) return existing;
+    let client;
+    if (selector === "chrome" || selector === "firefox") {
+      const inner = overrides?.[selector] ?? createChromeConnectorClient({ browser: selector });
+      client = createVerifiedChromeConnectorClient({
+        client: inner,
+        expectedBrowser: selector
+      });
+    } else {
+      client = overrides?.default ?? createVerifiedChromeConnectorClient({ client: createChromeConnectorClient() });
+    }
+    cache.set(selector, client);
+    return client;
+  };
+  return resolve3;
+}
 function createVerifiedChromeConnectorClient(args) {
   const client = args?.client ?? createChromeConnectorClient();
-  const expectedExtensionId = args?.expectedExtensionId ?? NOLO_CHROME_CONNECTOR_EXTENSION_ID;
+  const expectedExtensionIds = new Set(
+    args?.expectedExtensionIds ?? (args?.expectedBrowser ? [CONNECTOR_BROWSER_EXTENSION_IDS[args.expectedBrowser]] : args?.expectedExtensionId ? [args.expectedExtensionId] : NOLO_CONNECTOR_EXTENSION_IDS)
+  );
   let verified = null;
   let negotiatedFeatures = [];
   const verify = async () => {
     const connectorInfo = await client.request("connector_info", {});
     const receivedExtensionId = connectorInfo?.extensionId;
-    if (receivedExtensionId !== expectedExtensionId) {
+    if (typeof receivedExtensionId !== "string" || !expectedExtensionIds.has(receivedExtensionId)) {
+      const expectedList = [...expectedExtensionIds].join(", ");
       throw createConnectorError(
         "CHROME_CONNECTOR_EXTENSION_MISMATCH",
-        `Chrome connector extension id mismatch: expected ${expectedExtensionId}, received ${typeof receivedExtensionId === "string" ? receivedExtensionId : "unknown"}.`,
-        { expectedExtensionId, receivedExtensionId }
+        `Chrome connector extension id mismatch: expected one of ${expectedList}, received ${typeof receivedExtensionId === "string" ? receivedExtensionId : "unknown"}.`,
+        { expectedExtensionIds: [...expectedExtensionIds], receivedExtensionId }
       );
     }
     const receivedProtocolVersion = connectorInfo?.protocolVersion;
@@ -366,9 +520,21 @@ async function executeChromeConnectorTool(args) {
     };
   }
   try {
-    const payload = parseArguments(args.call.arguments);
+    const { target: rawTarget, ...payload } = parseArguments(args.call.arguments);
+    const target = typeof rawTarget === "string" && rawTarget.trim().length > 0 ? rawTarget.trim().toLowerCase() : void 0;
+    if (target !== void 0 && target !== "chrome" && target !== "firefox") {
+      throw createConnectorError(
+        "INVALID_BROWSER_TARGET",
+        `browser target must be "chrome" or "firefox", received "${rawTarget}".`,
+        { receivedTarget: rawTarget }
+      );
+    }
     validateChromeConnectorPayload(action, payload);
-    const result = await (args.client ?? createChromeConnectorClient()).request(action, payload);
+    const client = args.clientForTarget?.(target) ?? (target ? createVerifiedChromeConnectorClient({
+      client: createChromeConnectorClient({ browser: target }),
+      expectedBrowser: target
+    }) : args.client ?? createVerifiedChromeConnectorClient({ client: createChromeConnectorClient() }));
+    const result = await client.request(action, payload);
     return {
       content: JSON.stringify({ ok: true, result }),
       metadata: {
@@ -391,10 +557,14 @@ async function executeChromeConnectorTool(args) {
 var CHROME_CONNECTOR_TOOL_ACTIONS = { ...CHROME_TOOL_ACTIONS };
 
 export {
+  resolveUploadRoots,
   NOLO_CHROME_CONNECTOR_EXTENSION_ID,
+  NOLO_FIREFOX_CONNECTOR_EXTENSION_ID,
+  NOLO_CONNECTOR_EXTENSION_IDS,
   NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION,
   createChromeConnectorClient,
   REQUIRED_CHROME_CONNECTOR_FEATURES,
+  createChromeConnectorClientResolver,
   createVerifiedChromeConnectorClient,
   executeChromeConnectorTool
 };

package/{chunk-6OZ36FXI.js → chunk-KY6GPQ7O.js}

@@ -2,19 +2,12 @@ import {
   isOpenAiResponsesModel,
   resolvePlatformChatCompletionsEndpoint,
   resolvePlatformHostedCredentialProvider,
+  resolvePlatformProxyChatGatewayEndpoint,
   resolvePlatformResponsesEndpoint
-} from "./chunk-GQBOR3G6.js";
+} from "./chunk-NN4UUYGB.js";
 import {
   CLI_PROVIDER_VALUES
 } from "./chunk-W7XHHYWM.js";
-import {
-  CLIENT_VERSION_TOO_OLD_CODE,
-  buildClientVersionGateErrorDetail,
-  evaluatePlatformHostedClientVersionGate
-} from "./chunk-Q67DOFOO.js";
-import {
-  asTrimmedLowercaseString
-} from "./chunk-QSJ3HFEF.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -24,6 +17,14 @@ import {
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
+import {
+  CLIENT_VERSION_TOO_OLD_CODE,
+  buildClientVersionGateErrorDetail,
+  evaluatePlatformHostedClientVersionGate
+} from "./chunk-SZC4REES.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
 
 // packages/agent-runtime/agentConfigOptions.ts
 function pickAgentRuntimeInferenceOptions(agentConfig) {
@@ -52,8 +53,13 @@ function resolvePlatformProviderEndpoint(agentConfig) {
     model: agentConfig.model,
     endpointKey: agentConfig.endpointKey
   })) {
-    return resolvePlatformResponsesEndpoint(provider) ?? "";
+    return resolvePlatformResponsesEndpoint(provider, agentConfig.model) ?? "";
   }
+  const chatGateway = resolvePlatformProxyChatGatewayEndpoint(
+    provider,
+    agentConfig.model
+  );
+  if (chatGateway) return chatGateway;
   const endpoint = resolvePlatformChatCompletionsEndpoint(
     provider,
     agentConfig.model
@@ -164,10 +170,28 @@ function resolveProviderAuthHeaderName(args) {
   if (/xiaomimimo\.com/i.test(args.endpoint)) return "api-key";
   return "Authorization";
 }
+var OPENCODE_GO_ENDPOINT_RE = /^https?:\/\/opencode\.ai\/zen\/go\//i;
+var OPENCODE_SESSION_HEADER = "x-opencode-session";
+var OPENCODE_USER_AGENT = "nolo-agent/1.0";
+var PROCESS_FALLBACK_SESSION_ID = `nolo-${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+function isOpenCodeGoEndpoint(endpoint) {
+  return typeof endpoint === "string" && OPENCODE_GO_ENDPOINT_RE.test(endpoint.trim());
+}
+function buildProviderSessionHeaders(args) {
+  if (!isOpenCodeGoEndpoint(args.endpoint)) return {};
+  return {
+    [OPENCODE_SESSION_HEADER]: args.sessionId?.trim() || PROCESS_FALLBACK_SESSION_ID,
+    "User-Agent": OPENCODE_USER_AGENT
+  };
+}
 function buildProviderAuthHeaders(args) {
-  if (!args.apiKey) return {};
+  const sessionHeaders = buildProviderSessionHeaders(args);
+  if (!args.apiKey) return sessionHeaders;
   const headerName = resolveProviderAuthHeaderName(args);
-  return headerName.toLowerCase() === "authorization" ? { Authorization: `Bearer ${args.apiKey}` } : { [headerName]: args.apiKey };
+  return {
+    ...sessionHeaders,
+    ...headerName.toLowerCase() === "authorization" ? { Authorization: `Bearer ${args.apiKey}` } : { [headerName]: args.apiKey }
+  };
 }
 async function buildProviderExecutionPlan(args) {
   const { agentConfig, env } = args;