nolo-cli 0.149.0-alpha.1 → 0.151.0-alpha.2

package/chunk-UHTDNB5Y.js

@@ -0,0 +1,140 @@
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
+import {
+  getCredentialsDir,
+  getLegacyCredentialPath,
+  migrateLegacyCredentialFile
+} from "./chunk-ZWQUWF6W.js";
+
+// packages/agent-runtime/fileCredentialBroker.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// packages/agent-runtime/credentialBroker.ts
+function assertCredentialRef(ref) {
+  const trimmed = asTrimmedString(ref);
+  if (!trimmed) {
+    throw new Error("invalid_ref");
+  }
+  if (trimmed.includes("..") || trimmed.includes("/") || trimmed.includes("\\")) {
+    throw new Error("invalid_ref");
+  }
+  return trimmed;
+}
+
+// packages/agent-runtime/fileCredentialBroker.ts
+function getApiKeyCredentialsDir(homeDir) {
+  return join(getCredentialsDir(homeDir), "keys");
+}
+function credentialRefToFileName(ref) {
+  const safe = assertCredentialRef(ref).replace(/[^a-zA-Z0-9._-]+/g, "_");
+  if (!safe || safe === "." || safe === "..") {
+    throw new Error(`Credential ref is not filesystem-safe: ${ref}`);
+  }
+  return `${safe}.json`;
+}
+function getApiKeyCredentialPath(ref, homeDir) {
+  return join(getApiKeyCredentialsDir(homeDir), credentialRefToFileName(ref));
+}
+function ensurePrivateDir(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+}
+function writePrivateFile(path, body) {
+  writeFileSync(path, body, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function migrateApiKeyCredentialIfNeeded(ref, homeDir, migration) {
+  if (homeDir !== void 0 || !migration?.enableLegacyMigration) return;
+  const legacyHomeDir = migration.legacyHomeDir ?? homedir();
+  const relativePath = join("keys", credentialRefToFileName(ref));
+  migrateLegacyCredentialFile({
+    canonicalPath: getApiKeyCredentialPath(ref),
+    legacyPath: getLegacyCredentialPath(relativePath, legacyHomeDir),
+    mode: migration.mode ?? (migration.legacyHomeDir ? "test" : "production"),
+    isValid: (raw) => {
+      try {
+        const parsed = JSON.parse(raw);
+        return typeof parsed?.secret === "string" && Boolean(parsed.secret);
+      } catch {
+        return false;
+      }
+    }
+  });
+}
+function readApiKeyCredential(ref, homeDir, migration) {
+  migrateApiKeyCredentialIfNeeded(ref, homeDir, migration);
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  if (!existsSync(path)) return null;
+  try {
+    const raw = readFileSync(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.secret !== "string" || !parsed.secret) return null;
+    return parsed.secret;
+  } catch {
+    return null;
+  }
+}
+function writeApiKeyCredential(ref, secret, homeDir, now = Date.now()) {
+  const trimmedSecret = secret.trim();
+  if (!trimmedSecret) {
+    throw new Error("Cannot store an empty credential secret.");
+  }
+  assertCredentialRef(ref);
+  const dir = getApiKeyCredentialsDir(homeDir);
+  ensurePrivateDir(dir);
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  const payload = {
+    secret: trimmedSecret,
+    updatedAt: now
+  };
+  writePrivateFile(path, `${JSON.stringify(payload, null, 2)}
+`);
+}
+function removeApiKeyCredential(ref, homeDir) {
+  assertCredentialRef(ref);
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  if (!existsSync(path)) return;
+  unlinkSync(path);
+}
+function hasApiKeyCredential(ref, homeDir, migration) {
+  return readApiKeyCredential(ref, homeDir, migration) !== null;
+}
+function createFileCredentialBroker(options = {}) {
+  const homeDir = options.homeDir;
+  const migration = options.migration;
+  const now = options.now ?? Date.now;
+  return {
+    get(ref) {
+      return readApiKeyCredential(ref, homeDir, migration);
+    },
+    put(ref, secret) {
+      writeApiKeyCredential(ref, secret, homeDir, now());
+    },
+    delete(ref) {
+      removeApiKeyCredential(ref, homeDir);
+    },
+    has(ref) {
+      return hasApiKeyCredential(ref, homeDir, migration);
+    }
+  };
+}
+
+export {
+  createFileCredentialBroker
+};

package/{chunk-YYLHWIW6.js → chunk-UKZX3NHN.js}

@@ -35,7 +35,7 @@ var LOCAL_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0.0
 function isRemoteCustomEndpoint(url) {
   if (typeof url !== "string") return false;
   try {
-    const host = new URL(url).hostname.toLowerCase();
+    const host = new URL(url).hostname.toLowerCase().replace(/^\[|\]$/g, "");
     return !LOCAL_HOSTS.has(host);
   } catch {
     return false;

package/{chunk-OHOVNO7I.js → chunk-UOKFKFPO.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5ZUL4CUO.js";
 import {
   resolveAgentImageInputSupport
-} from "./chunk-PQWU42UQ.js";
+} from "./chunk-GCKHQECX.js";
 import {
   getModelContextWindow
-} from "./chunk-AKG5W4LG.js";
+} from "./chunk-BPMPOFWP.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
@@ -80,7 +80,9 @@ var devinChannelContextWindow = (model) => {
   if (!raw) return void 0;
   return DEVIN_CHANNEL_CONTEXT_WINDOWS[raw];
 };
-var resolveAgentContextWindow = (agent) => (isDevinOAuthAgent(agent) ? devinChannelContextWindow(agent.model) : void 0) ?? getModelContextWindow(agent.model ?? "");
+var resolveAgentContextWindow = (agent) => (isDevinOAuthAgent(agent) ? devinChannelContextWindow(agent.model) : void 0) ?? // provider 透传给全局解析：平台托管通道（CF）与 Codex OAuth 等通道对同一 id
+// 窗口不同，按通道取真值，不做全局取大/取小。
+getModelContextWindow(agent.model ?? "", agent.provider);
 
 // packages/agent-runtime/agentRecordConfig.ts
 function stringField(record, key) {
@@ -450,6 +452,7 @@ export {
   hasImageInRuntimeMessages,
   stripImagePartsFromMessages,
   stripImagePartsForTextOnlyAgent,
+  devinChannelContextWindow,
   resolveAgentContextWindow,
   resolveAgentRuntimeConfigFromRecord,
   buildDesktopAgentRuntimeAgentConfigSnapshot,

package/{chunk-XISEYOGH.js → chunk-USHQX6VT.js}

@@ -2,16 +2,16 @@ import {
   deleteDbRecord,
   queryUserRecords,
   readDbRecord
-} from "./chunk-ALGORS6Y.js";
+} from "./chunk-ZF6526IQ.js";
 import {
   mergeAndDedupUserData
-} from "./chunk-KQHGZWSV.js";
+} from "./chunk-OXME3PEE.js";
+import {
+  isTombstoneRecord
+} from "./chunk-D2MDMY2M.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import {
-  isTombstoneRecord
-} from "./chunk-GBRG75BQ.js";
 
 // packages/cli/globalRecordOperations.ts
 async function listUserRecordsFromServers(args) {

package/chunk-UUPR3TD7.js

@@ -0,0 +1,53 @@
+import {
+  buildAgentRuntimeAgentLookupKeys,
+  shouldFetchAgentRuntimeRecordRemotely
+} from "./chunk-QLQ573SU.js";
+
+// packages/agent-runtime/oauthProviderRefs.ts
+var OAUTH_PROVIDER_REFS = [
+  "chatgpt",
+  "xai",
+  "antigravity",
+  "claude",
+  "cursor",
+  "devin",
+  "workbuddy",
+  "workbuddy-ai"
+];
+var METERED_API_KEY_REF_PREFIX = "api-key:";
+var normalizeRef = (ref) => typeof ref === "string" ? ref.trim().toLowerCase() : "";
+var isKnownOAuthProviderRef = (ref) => OAUTH_PROVIDER_REFS.includes(normalizeRef(ref));
+var isMeteredApiKeyRef = (ref) => {
+  const trimmed = typeof ref === "string" ? ref.trim() : "";
+  return trimmed.length > METERED_API_KEY_REF_PREFIX.length && trimmed.slice(0, METERED_API_KEY_REF_PREFIX.length).toLowerCase() === METERED_API_KEY_REF_PREFIX;
+};
+var OAUTH_PROVIDER_REF_LIST_COPY = OAUTH_PROVIDER_REFS.join(" / ");
+function classifyAgentApiKeyRef(raw) {
+  const trimmed = typeof raw === "string" ? raw.trim() : "";
+  if (!trimmed) return { ok: true, kind: "empty" };
+  if (isKnownOAuthProviderRef(trimmed)) {
+    return {
+      ok: true,
+      kind: "oauth-provider",
+      provider: normalizeRef(trimmed)
+    };
+  }
+  if (isMeteredApiKeyRef(trimmed)) return { ok: true, kind: "metered-api-key" };
+  return { ok: false, kind: "unsupported-oauth-provider", ref: trimmed };
+}
+function formatUnsupportedAgentApiKeyRefMessage(raw) {
+  const shown = typeof raw === "string" ? raw.trim() : "";
+  return `apiKeyRef "${shown}" \u4E0D\u662F\u53D7\u652F\u6301\u7684\u53D6\u503C\uFF0C\u8BB0\u5F55\u672A\u5199\u5165\u3002\u5408\u6CD5\u53D6\u503C\uFF1AOAuth provider ref\uFF08${OAUTH_PROVIDER_REF_LIST_COPY}\uFF09\uFF0C\u6216\u8BA1\u91CF/\u8BBE\u5907 broker ref\uFF08\u4EE5 "${METERED_API_KEY_REF_PREFIX}" \u5F00\u5934\uFF0C\u5982 ${METERED_API_KEY_REF_PREFIX}agent-...\uFF09\u3002\u6539\u6CD5\uFF1A\u628A apiKeyRef \u6539\u6210\u4E0A\u9762\u67D0\u4E2A\u53D7\u652F\u6301\u7684\u53D6\u503C\uFF0C\u6216\u6539\u7528 ${METERED_API_KEY_REF_PREFIX}<id>\uFF1B\u82E5\u8981\u7528\u81EA\u5E26 API key\uFF0C\u8BF7\u6E05\u7A7A apiKeyRef \u5E76\u586B\u5199 apiKey\u3002`;
+}
+
+// packages/cli/client/localAgentRecords.ts
+var buildLocalAgentLookupKeys = buildAgentRuntimeAgentLookupKeys;
+var shouldReadAgentKeyRemotely = shouldFetchAgentRuntimeRecordRemotely;
+
+export {
+  OAUTH_PROVIDER_REFS,
+  classifyAgentApiKeyRef,
+  formatUnsupportedAgentApiKeyRefMessage,
+  buildLocalAgentLookupKeys,
+  shouldReadAgentKeyRemotely
+};

package/{chunk-HDLLCBRF.js → chunk-VEA7H5FG.js}

@@ -81,9 +81,9 @@ var buildSkillDiscoveryLayer = (skills, _boundFolder) => {
   if (skills.length === 0) return null;
   const lines = [
     "--- \u53EF\u7528\u6280\u80FD\uFF08Skills\uFF09---",
-    `\u5DE5\u4F5C\u533A\u4E2D\u53D1\u73B0\u4E86 ${skills.length} \u4E2A\u6280\u80FD\uFF08SKILL.md\uFF09\uFF0C\u6A21\u578B\u53EF\u6309\u9700\u7528 loadSkill \u6309\u540D\u52A0\u8F7D\u6216 readFile \u76F4\u63A5\u8BFB\u53D6\uFF1A`,
+    `\u5DE5\u4F5C\u533A\u4E2D\u53D1\u73B0\u4E86 ${skills.length} \u4E2A\u6280\u80FD\uFF08SKILL.md\uFF09\uFF0C\u6A21\u578B\u53EF\u6309\u9700\u7528 loadSkill \u6309\u540D\u52A0\u8F7D\u6216 readFile \u76F4\u63A5\u8BFB\u53D6\uFF08\u8DEF\u5F84\u89C4\u5219 .agents/skills/<name>/SKILL.md\uFF09\uFF1A`,
     ...skills.map(
-      (s) => `- ${s.name}: ${s.description} (path: ${s.relativePath})`
+      (s) => `- ${s.name}: ${s.description}`
     )
   ];
   return makeLayer("skill-discovery", lines.join("\n"), "session");

package/chunk-VHGD6FHV.js

@@ -0,0 +1,116 @@
+// packages/cli/tui/ciStatus.ts
+import { execFile } from "node:child_process";
+var DEFAULT_SSH_HOST = "alpha-raw";
+var DEFAULT_CI_PORT = "3900";
+function resolveSshTarget() {
+  const alias = process.env.NOLO_ALPHA_SSH_CONFIG_HOST?.trim();
+  if (alias) return alias;
+  const raw = process.env.NOLO_ALPHA_RAW_HOST?.trim();
+  if (raw) {
+    const user = process.env.NOLO_ALPHA_SSH_USER?.trim() || "root";
+    return `${user}@${raw}`;
+  }
+  return DEFAULT_SSH_HOST;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function asString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function extractFailedPhase(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  for (const entry of raw) {
+    const timing = asRecord(entry);
+    if (!timing) continue;
+    const status = timing.status;
+    const phase = asString(timing.phase);
+    if (phase && typeof status === "number" && status !== 0) return phase;
+  }
+  return void 0;
+}
+function toCiJob(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const jobId = asString(record.jobId);
+  const status = asString(record.status);
+  if (!jobId || !status) return void 0;
+  const durationMs = typeof record.durationMs === "number" ? record.durationMs : void 0;
+  return {
+    jobId,
+    kind: asString(record.kind) ?? "unknown",
+    status,
+    shortSha: asString(record.shortSha) ?? asString(record.sha) ?? "",
+    startedAt: asString(record.startedAt),
+    durationMs,
+    failedPhase: extractFailedPhase(record.phaseTimings)
+  };
+}
+function parseCiStatusPayload(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const root = asRecord(parsed);
+  if (!root) return void 0;
+  const jobs = root.jobs;
+  if (Array.isArray(jobs)) {
+    return jobs.map(toCiJob).filter((job) => job !== void 0);
+  }
+  const single = toCiJob(parsed);
+  return single ? [single] : void 0;
+}
+function buildRemoteCommand(limit) {
+  const rawPort = process.env.NOLO_CI_PORT?.trim() ?? "";
+  const port = /^\d{1,5}$/.test(rawPort) && Number(rawPort) > 0 && Number(rawPort) <= 65535 ? rawPort : DEFAULT_CI_PORT;
+  const safeLimit = Math.max(1, Math.min(20, Math.trunc(limit) || 5));
+  return `curl -s -m 3 "http://127.0.0.1:${port}/status?limit=${safeLimit}"`;
+}
+function fetchCiStatus(limit = 5, timeoutMs = 4e3) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let guard;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      if (guard) clearTimeout(guard);
+      resolve(value);
+    };
+    guard = setTimeout(() => finish(void 0), timeoutMs + 500);
+    guard.unref?.();
+    try {
+      execFile(
+        "ssh",
+        ["-o", "BatchMode=yes", "-o", `ConnectTimeout=3`, resolveSshTarget(), buildRemoteCommand(limit)],
+        { timeout: timeoutMs, encoding: "utf8", maxBuffer: 1024 * 1024 },
+        (error, stdout) => {
+          if (error) {
+            finish(void 0);
+            return;
+          }
+          finish(parseCiStatusPayload(stdout ?? ""));
+        }
+      );
+    } catch {
+      finish(void 0);
+    }
+  });
+}
+function summarizeLatest(jobs) {
+  const latest = jobs?.[0];
+  if (!latest) return void 0;
+  const sha = latest.shortSha ? latest.shortSha.slice(0, 7) : "???????";
+  if (latest.status === "running") return `ci:${sha} \u2026`;
+  if (latest.status === "succeeded") return `ci:${sha} \u2713`;
+  if (latest.status === "failed" || latest.status === "orphaned") {
+    return `ci:${sha} \u2717${latest.failedPhase ? ` ${latest.failedPhase}` : ""}`;
+  }
+  return `ci:${sha} ${latest.status}`;
+}
+
+export {
+  fetchCiStatus,
+  summarizeLatest
+};

package/chunk-VIWDGTDA.js

@@ -0,0 +1,8 @@
+// packages/agent-runtime/cursor/isCursorOAuthAgent.ts
+function isCursorOAuthAgent(agent) {
+  return agent.apiKeyRef?.trim().toLowerCase() === "cursor";
+}
+
+export {
+  isCursorOAuthAgent
+};

package/{chunk-GOH6RW6F.js → chunk-VJXHL6MH.js}

@@ -1,13 +1,16 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-XISEYOGH.js";
+} from "./chunk-USHQX6VT.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-ALGORS6Y.js";
+} from "./chunk-ZF6526IQ.js";
 import {
   deriveCredentialGroup
-} from "./chunk-DY7ANLKG.js";
+} from "./chunk-JKMLSTZK.js";
+import {
+  isTombstoneRecord
+} from "./chunk-D2MDMY2M.js";
 import {
   PUBLIC_AGENT_KEY_PREFIX,
   isOwnedAgentKey,
@@ -30,6 +33,7 @@ function buildCompanionKeys(rawId, userId) {
   };
 }
 function normalizeListedAgent(record) {
+  if (isTombstoneRecord(record)) return null;
   const privateKey = typeof record?.dbKey === "string" ? record.dbKey : "";
   const explicitId = typeof record?.id === "string" && record.id ? record.id : void 0;
   const ownerUserId = typeof record?.userId === "string" ? record.userId : "";
@@ -52,6 +56,9 @@ function normalizeListedAgent(record) {
     ...typeof record?.handle === "string" && record.handle ? { handle: record.handle } : {},
     ...typeof record?.introduction === "string" && record.introduction ? { introduction: record.introduction } : typeof record?.description === "string" && record.description ? { introduction: record.description } : {},
     ...typeof record?.provider === "string" && record.provider ? { provider: record.provider } : {},
+    // 仅供 resolveBillingSource 判定订阅端点（Step Plan / OpenCode Go 等），
+    // safe 投影不输出它。缺了它本地 agent list 会把订阅端点全报成 user_api。
+    ...typeof record?.customProviderUrl === "string" && record.customProviderUrl ? { customProviderUrl: record.customProviderUrl } : {},
     ...typeof record?.inputPrice === "number" && Number.isFinite(record.inputPrice) ? { inputPrice: record.inputPrice } : {},
     ...typeof record?.outputPrice === "number" && Number.isFinite(record.outputPrice) ? { outputPrice: record.outputPrice } : {},
     updatedAt: typeof record?.updatedAt === "string" || typeof record?.updatedAt === "number" ? record.updatedAt : typeof record?.createdAt === "string" || typeof record?.createdAt === "number" ? record.createdAt : typeof record?.created === "string" || typeof record?.created === "number" ? record.created : null,
@@ -104,6 +111,7 @@ async function listLocalCachedAgents(args) {
   for (const prefix of [ownedPrefix, PUBLIC_AGENT_KEY_PREFIX]) {
     for await (const [key, value] of args.db.iterator({ gte: prefix, lte: `${prefix}\uFFFF` })) {
       if (typeof key !== "string" || !value || typeof value !== "object") continue;
+      if (isTombstoneRecord(value)) continue;
       if (isOwnedAgentKey(key, args.userId)) {
         privateRecords.set(key, { ...value, dbKey: key });
         continue;
@@ -187,8 +195,11 @@ async function listFavoriteAgentIdsAcrossServers(args) {
           },
           body: JSON.stringify({ targetType: "agent" })
         });
-        if (!res.ok) return;
-        const data = await res.json().catch(() => ({}));
+        if (!res.ok) throw new Error("favorites request failed");
+        const data = await res.json();
+        if (!Array.isArray(data?.items) && !Array.isArray(data?.ids)) {
+          throw new Error("invalid favorites response");
+        }
         const items = Array.isArray(data?.items) ? data.items : [];
         for (const item of items) {
           const id = typeof item?.id === "string" ? item.id : "";
@@ -206,6 +217,7 @@ async function listFavoriteAgentIdsAcrossServers(args) {
           }
         }
       } catch {
+        args.onFailure?.(serverUrl);
       }
     })
   );
@@ -258,9 +270,11 @@ function findTightestQuotaWindow(quota, now = Date.now()) {
   return best ?? quota.windows[0];
 }
 function formatQuotaSummary(quota, now = Date.now(), options) {
-  const tightest = findTightestQuotaWindow(quota, now);
-  if (!tightest) return void 0;
   const compact = options?.compact === true;
+  const planText = formatPlanLabel(quota?.plan);
+  const planName = typeof quota?.plan?.name === "string" ? quota.plan.name.trim() : "";
+  const tightest = findTightestQuotaWindow(quota, now);
+  if (!tightest) return compact ? planName || void 0 : planText;
   const parts = [];
   if (typeof tightest.utilization === "number") {
     const pct = Math.round(tightest.utilization * 100);
@@ -272,7 +286,10 @@ function formatQuotaSummary(quota, now = Date.now(), options) {
       parts.push(`\u4F59${tightest.remaining}${tightest.unit ? ` ${tightest.unit}` : ""}`);
     }
   }
-  if (compact) return parts.length > 0 ? parts[0] : void 0;
+  if (compact) {
+    const head = parts.length > 0 ? parts[0] : void 0;
+    return [planName || void 0, head].filter(Boolean).join(" \xB7 ") || void 0;
+  }
   if (tightest.scope && tightest.scope !== "user" && tightest.scope !== "project" && tightest.scope !== tightest.unit) {
     parts.push(tightest.scope);
   }
@@ -290,9 +307,15 @@ function formatQuotaSummary(quota, now = Date.now(), options) {
       parts.push(`${days}d\u540E\u91CD\u7F6E`);
     }
   }
-  if (parts.length === 0) return void 0;
-  if (parts.length === 1 && parts[0] === tightest.scope) return void 0;
-  return parts.join(" \xB7 ");
+  const onlyScope = parts.length === 0 || parts.length === 1 && parts[0] === tightest.scope;
+  if (onlyScope) return planText;
+  return [planText, ...parts].filter(Boolean).join(" \xB7 ");
+}
+function formatPlanLabel(plan) {
+  const name = typeof plan?.name === "string" ? plan.name.trim() : "";
+  if (!name) return void 0;
+  const credits = typeof plan?.monthlyCreditsUsd === "number" && Number.isFinite(plan.monthlyCreditsUsd) && plan.monthlyCreditsUsd > 0 ? `\u6708\u5EA6\u989D\u5EA6 $${plan.monthlyCreditsUsd}` : void 0;
+  return [`${name} \u5957\u9910`, credits].filter(Boolean).join(" \xB7 ");
 }
 
 export {