nolo-cli 0.149.0-alpha.1 → 0.151.0-alpha.2

package/{chunk-I4OPU5TK.js → chunk-XS47QOFV.js}

@@ -11,17 +11,7 @@ import {
   getAntigravityUserAgent,
   normalizeAntigravityTokenPayload,
   refreshAntigravityToken
-} from "./chunk-S5XGT6GB.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
-import {
-  writeOAuthCredential
-} from "./chunk-ZWQUWF6W.js";
-import {
-  buildEnvFromProfile,
-  loadProfileConfig
-} from "./chunk-TNIX77YM.js";
+} from "./chunk-XZNCX52W.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
@@ -31,6 +21,16 @@ import {
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import {
+  buildEnvFromProfile,
+  loadProfileConfig
+} from "./chunk-TNIX77YM.js";
+import {
+  writeOAuthCredential
+} from "./chunk-ZWQUWF6W.js";
 
 // packages/cli/oauth/callback-server.ts
 import { createServer } from "node:http";
@@ -868,6 +868,257 @@ function resolveServerSyncConfig() {
   return null;
 }
 
+// packages/agent-runtime/workbuddyOAuth.ts
+var WORKBUDDY_APP_VERSION = "2.0.0";
+var WORKBUDDY_UA_VERSION = "5.5.6";
+var WORKBUDDY_POLL_INTERVAL_MS = 1e3;
+var WORKBUDDY_SIGN_IN_TIMEOUT_MS = 5 * 60 * 1e3;
+var WORKBUDDY_EARLY_REFRESH_SKEW_MS = 60 * 1e3;
+var WORKBUDDY_KEEP_RENEWED_MS = 60 * 1e3;
+var WORKBUDDY_REQUEST_TIMEOUT_MS = 3e4;
+var WORKBUDDY_SITES = {
+  workbuddy: {
+    id: "workbuddy",
+    name: "WorkBuddy",
+    endpoint: "https://copilot.tencent.com",
+    authId: "workbuddy-desktop",
+    platform: "workbuddy",
+    ai: false
+  },
+  "workbuddy-ai": {
+    id: "workbuddy-ai",
+    name: "WorkBuddy AI",
+    endpoint: "https://www.workbuddy.ai",
+    authId: "workbuddy-desktop-ai",
+    platform: "workbuddy-ai",
+    ai: true
+  }
+};
+function getWorkBuddySite(site) {
+  if (site === "workbuddy" || site === "workbuddy-ai") {
+    return WORKBUDDY_SITES[site];
+  }
+  throw new Error(`Unknown WorkBuddy site: "${String(site)}". Expected "workbuddy" or "workbuddy-ai".`);
+}
+function sanitizeWorkBuddyError(message) {
+  return message.replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(/([?&]|\b)(state|token|accessToken|refreshToken)=[^&\s]+/gi, "$1$2=[REDACTED]").replace(/(["']?(?:accessToken|refreshToken|state|token)["']?\s*:\s*["'])[^"']+["']/gi, '$1[REDACTED]"');
+}
+function sanitizeWorkBuddyDomain(rawDomain, defaultHost) {
+  if (typeof rawDomain !== "string" || !rawDomain.trim()) {
+    return defaultHost;
+  }
+  let domain = rawDomain.trim();
+  if (domain.startsWith("https://") || domain.startsWith("http://")) {
+    try {
+      domain = new URL(domain).host;
+    } catch {
+      return defaultHost;
+    }
+  }
+  const slashIdx = domain.indexOf("/");
+  if (slashIdx !== -1) domain = domain.slice(0, slashIdx);
+  const qIdx = domain.indexOf("?");
+  if (qIdx !== -1) domain = domain.slice(0, qIdx);
+  if (!/^[a-zA-Z0-9.-]+(?::[0-9]+)?$/.test(domain)) {
+    return defaultHost;
+  }
+  return domain;
+}
+function normalizeWorkBuddyTokenPayload(siteOrArgs, payloadArg, baseCredentialArg, nowArg) {
+  let site;
+  let payload;
+  let baseCredential;
+  let now;
+  if (typeof siteOrArgs === "object" && siteOrArgs !== null && "site" in siteOrArgs) {
+    site = siteOrArgs.site;
+    payload = siteOrArgs.payload ?? {};
+    baseCredential = siteOrArgs.baseCredential;
+    now = siteOrArgs.now ?? Date.now();
+  } else {
+    site = siteOrArgs;
+    payload = payloadArg ?? {};
+    baseCredential = baseCredentialArg;
+    now = nowArg ?? Date.now();
+  }
+  const siteConfig = getWorkBuddySite(site);
+  if (typeof payload.accessToken !== "string" || !payload.accessToken.trim()) {
+    throw new Error("WorkBuddy token response missing accessToken");
+  }
+  const accessToken = payload.accessToken.trim();
+  let expiresAt;
+  const rawExpiresAt = Number(payload.expiresAt);
+  const rawExpiresIn = Number(payload.expiresIn);
+  if (Number.isFinite(rawExpiresAt) && rawExpiresAt > 0) {
+    expiresAt = rawExpiresAt;
+  } else if (Number.isFinite(rawExpiresIn) && rawExpiresIn > 0) {
+    expiresAt = now + rawExpiresIn * 1e3;
+  } else if (typeof baseCredential?.expiresAt === "number") {
+    expiresAt = baseCredential.expiresAt;
+  } else {
+    expiresAt = now + 3600 * 1e3;
+  }
+  let refreshExpiresAt;
+  const rawRefExpAt = Number(payload.refreshExpiresAt);
+  const rawRefExpIn = Number(payload.refreshExpiresIn);
+  if (Number.isFinite(rawRefExpAt) && rawRefExpAt > 0) {
+    refreshExpiresAt = rawRefExpAt;
+  } else if (Number.isFinite(rawRefExpIn) && rawRefExpIn > 0) {
+    refreshExpiresAt = now + rawRefExpIn * 1e3;
+  } else if (typeof baseCredential?.metadata?.refreshExpiresAt === "number") {
+    refreshExpiresAt = baseCredential.metadata.refreshExpiresAt;
+  }
+  const refreshToken = typeof payload.refreshToken === "string" && payload.refreshToken.trim() ? payload.refreshToken.trim() : baseCredential?.refreshToken;
+  const uid = typeof payload.uid === "string" && payload.uid.trim() ? payload.uid.trim() : typeof baseCredential?.metadata?.uid === "string" && baseCredential.metadata.uid.trim() ? baseCredential.metadata.uid.trim() : baseCredential?.accountId ?? "";
+  const defaultHost = new URL(siteConfig.endpoint).host;
+  const domain = sanitizeWorkBuddyDomain(
+    payload.domain ?? baseCredential?.metadata?.domain,
+    defaultHost
+  );
+  const rawEnterpriseId = typeof payload.enterpriseId === "string" ? payload.enterpriseId : typeof baseCredential?.metadata?.enterpriseId === "string" ? baseCredential.metadata.enterpriseId : "";
+  const enterpriseId = rawEnterpriseId.trim();
+  const nickname = typeof payload.nickname === "string" && payload.nickname.trim() ? payload.nickname.trim() : typeof payload.phoneNumber === "string" && payload.phoneNumber.trim() ? payload.phoneNumber.trim() : typeof baseCredential?.metadata?.nickname === "string" ? baseCredential.metadata.nickname : void 0;
+  return {
+    ...baseCredential ?? {},
+    provider: site,
+    accessToken,
+    ...refreshToken ? { refreshToken } : {},
+    expiresAt,
+    obtainedAt: now,
+    accountId: uid || nickname || siteConfig.name,
+    metadata: {
+      site,
+      uid,
+      domain,
+      ...enterpriseId ? { enterpriseId } : {},
+      ...refreshExpiresAt ? { refreshExpiresAt } : {},
+      ...nickname ? { nickname } : {}
+    }
+  };
+}
+var renewing = /* @__PURE__ */ new Map();
+var renewed = /* @__PURE__ */ new Map();
+function getWorkBuddyRefreshKey(site, credential) {
+  const accountOrUid = credential.accountId || credential.metadata?.uid || "";
+  const token = credential.refreshToken || "";
+  return `${site}
+${accountOrUid}
+${token}`;
+}
+async function refreshWorkBuddyToken(credential, deps = {}) {
+  if (!credential.refreshToken) {
+    throw new Error("WorkBuddy credential has no refresh_token");
+  }
+  const now = deps.now?.() ?? Date.now();
+  const refreshExpiresAt = credential.metadata?.refreshExpiresAt;
+  if (typeof refreshExpiresAt === "number" && now >= refreshExpiresAt) {
+    throw new Error("this WorkBuddy account is signed out; sign in again");
+  }
+  const site = credential.metadata?.site === "workbuddy-ai" || credential.provider === "workbuddy-ai" ? "workbuddy-ai" : "workbuddy";
+  const siteConfig = getWorkBuddySite(site);
+  const key = getWorkBuddyRefreshKey(site, credential);
+  const cached = renewed.get(key);
+  if (cached && now - cached.at < WORKBUDDY_KEEP_RENEWED_MS) {
+    return cached.credential;
+  }
+  const inflight = renewing.get(key);
+  if (inflight) {
+    return inflight;
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const refreshPromise = (async () => {
+    const defaultHost = new URL(siteConfig.endpoint).host;
+    const domain = sanitizeWorkBuddyDomain(credential.metadata?.domain, defaultHost);
+    const enterpriseId = typeof credential.metadata?.enterpriseId === "string" ? credential.metadata.enterpriseId.trim() : "";
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+      "X-Refresh-Token": credential.refreshToken,
+      "X-Auth-Refresh-Source": "plugin",
+      "X-Domain": domain,
+      ...enterpriseId ? { "X-Enterprise-Id": enterpriseId, "X-Tenant-Id": enterpriseId } : {}
+    };
+    let response;
+    try {
+      response = await fetchImpl(`${siteConfig.endpoint}/v2/plugin/auth/token/refresh`, {
+        method: "POST",
+        headers,
+        body: "{}",
+        signal: AbortSignal.timeout(WORKBUDDY_REQUEST_TIMEOUT_MS)
+      });
+    } catch (error) {
+      throw new Error(sanitizeWorkBuddyError(`WorkBuddy token refresh failed: ${toErrorMessage(error)}`));
+    }
+    let text = "";
+    try {
+      text = await response.text();
+    } catch {
+    }
+    let env = {};
+    try {
+      env = JSON.parse(text);
+    } catch {
+    }
+    const code = typeof env.code === "number" ? env.code : Number.parseInt(String(env.code ?? ""), 10) || 0;
+    if (!response.ok) {
+      const why = String(env.msg || env.message || text.slice(0, 200) || response.statusText);
+      throw new Error(
+        sanitizeWorkBuddyError(
+          `${siteConfig.name} token refresh failed: ${why} (HTTP ${response.status}${code ? `, code ${code}` : ""})`
+        )
+      );
+    }
+    if (code !== 0) {
+      const why = String(env.msg || env.message || "error");
+      throw new Error(
+        sanitizeWorkBuddyError(`${siteConfig.name} token refresh failed: ${why} (${code})`)
+      );
+    }
+    const data = env.data && typeof env.data === "object" ? env.data : env;
+    if (typeof data.accessToken !== "string" || !data.accessToken.trim()) {
+      throw new Error("WorkBuddy gave no refreshed token");
+    }
+    const nextCredential = normalizeWorkBuddyTokenPayload(site, data, credential, now);
+    renewed.set(key, { credential: nextCredential, at: now });
+    return nextCredential;
+  })().finally(() => {
+    renewing.delete(key);
+  });
+  renewing.set(key, refreshPromise);
+  return refreshPromise;
+}
+var workbuddyRefresh = refreshWorkBuddyToken;
+function getWorkBuddyHeaders(credential) {
+  const site = credential.metadata?.site === "workbuddy-ai" || credential.provider === "workbuddy-ai" ? "workbuddy-ai" : "workbuddy";
+  const siteConfig = getWorkBuddySite(site);
+  const defaultHost = new URL(siteConfig.endpoint).host;
+  const domain = sanitizeWorkBuddyDomain(credential.metadata?.domain, defaultHost);
+  const uid = typeof credential.metadata?.uid === "string" ? credential.metadata.uid.trim() : credential.accountId ?? "";
+  const rawEnterpriseId = typeof credential.metadata?.enterpriseId === "string" ? credential.metadata.enterpriseId.trim() : "";
+  const headers = {
+    Authorization: `Bearer ${credential.accessToken}`,
+    "X-User-Id": uid,
+    "X-Domain": domain,
+    "X-Product": "SaaS",
+    "X-IDE-Type": "WorkBuddy",
+    "User-Agent": `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
+    "X-Requested-With": "XMLHttpRequest",
+    "X-Agent-Intent": "craft",
+    "X-Agent-Purpose": "conversation",
+    "X-IDE-Name": "WorkBuddy",
+    "X-IDE-Version": WORKBUDDY_UA_VERSION
+  };
+  if (rawEnterpriseId) {
+    const cleanEnterpriseId = rawEnterpriseId.replace(/[\r\n]/g, "");
+    headers["X-Enterprise-Id"] = cleanEnterpriseId;
+    headers["X-Tenant-Id"] = cleanEnterpriseId;
+  }
+  if (siteConfig.ai) {
+    headers["X-Agent-Type"] = "main";
+  }
+  return headers;
+}
+
 // packages/agent-runtime/xaiOAuth.ts
 var XAI_OAUTH_ISSUER = "https://auth.x.ai";
 var XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
@@ -1246,6 +1497,17 @@ async function refreshCursorToken(credential, deps = {}) {
 var cursorRefresh = refreshCursorToken;
 
 export {
+  WORKBUDDY_APP_VERSION,
+  WORKBUDDY_UA_VERSION,
+  WORKBUDDY_POLL_INTERVAL_MS,
+  WORKBUDDY_SIGN_IN_TIMEOUT_MS,
+  WORKBUDDY_REQUEST_TIMEOUT_MS,
+  getWorkBuddySite,
+  sanitizeWorkBuddyError,
+  sanitizeWorkBuddyDomain,
+  normalizeWorkBuddyTokenPayload,
+  workbuddyRefresh,
+  getWorkBuddyHeaders,
   startCallbackServer,
   runAntigravityOAuthLogin,
   refreshAntigravityOAuthToken,

package/{chunk-S5XGT6GB.js → chunk-XZNCX52W.js}

@@ -1,18 +1,18 @@
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
 import {
   trimTrailingSlash
-} from "./chunk-27ONFIEY.js";
+} from "./chunk-K2AER7RX.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
 import {
-  asOptionalFiniteNumber
-} from "./chunk-WWC7I6TA.js";
+  asOptionalTrimmedString
+} from "./chunk-G3SUCT4W.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
-import {
-  asOptionalTrimmedString
-} from "./chunk-G3SUCT4W.js";
 
 // packages/agent-runtime/antigravityOAuth.ts
 var decodeBase64 = (s) => typeof Buffer !== "undefined" ? Buffer.from(s, "base64").toString("utf8") : typeof atob === "function" ? atob(s) : s;
@@ -39,9 +39,27 @@ var ANTIGRAVITY_ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
 var ANTIGRAVITY_TOKEN_REQUEST_TIMEOUT_MS = 3e4;
 var ANTIGRAVITY_CLOUD_CODE_BASE_URL = "https://daily-cloudcode-pa.googleapis.com";
 var ANTIGRAVITY_CLOUD_CODE_HOST = "cloudcode-pa.googleapis.com";
+var ANTIGRAVITY_CLOUD_CODE_HOSTS = [
+  ANTIGRAVITY_CLOUD_CODE_HOST,
+  "daily-cloudcode-pa.googleapis.com"
+];
+function isAntigravityCloudCodeHostname(rawHost) {
+  const hostname = asTrimmedLowercaseString(rawHost ?? "").replace(/\.+$/, "");
+  if (!hostname) return false;
+  return ANTIGRAVITY_CLOUD_CODE_HOSTS.includes(hostname);
+}
+function isAntigravityCloudCodeBaseUrl(raw) {
+  const value = typeof raw === "string" ? raw.trim() : "";
+  if (!value) return false;
+  try {
+    return isAntigravityCloudCodeHostname(new URL(value).hostname);
+  } catch {
+    return false;
+  }
+}
 var ANTIGRAVITY_LEGACY_GENERIC_BASE_RE = /^https?:\/\/cloudcode-pa\.googleapis\.com$/i;
 function getAntigravityUserAgent() {
-  const version = process.env.NOLO_ANTIGRAVITY_VERSION || "2.18.1";
+  const version = process.env.NOLO_ANTIGRAVITY_VERSION || "2.23.1";
   const os = process.platform === "win32" ? "windows" : process.platform;
   const arch = process.arch === "x64" ? "amd64" : process.arch === "ia32" ? "386" : process.arch;
   return `antigravity/hub/${version} ${os}/${arch}`;
@@ -50,7 +68,7 @@ function resolveAntigravityCloudCodeBaseUrl(customProviderUrl) {
   const raw = (customProviderUrl ?? "").trim();
   if (!raw) return ANTIGRAVITY_CLOUD_CODE_BASE_URL;
   const trimmed = trimTrailingSlash(raw);
-  if (trimmed.includes(ANTIGRAVITY_CLOUD_CODE_HOST)) {
+  if (isAntigravityCloudCodeBaseUrl(trimmed)) {
     const base = trimmed.replace(/\/v1internal:.*$/i, "").replace(/\/$/, "");
     if (ANTIGRAVITY_LEGACY_GENERIC_BASE_RE.test(base)) {
       return ANTIGRAVITY_CLOUD_CODE_BASE_URL;
@@ -64,7 +82,9 @@ function isAntigravityOAuthAgent(agentConfig) {
   const apiKeyRef = asTrimmedLowercaseString(agentConfig.apiKeyRef);
   const provider = asTrimmedLowercaseString(agentConfig.provider);
   const url = asTrimmedLowercaseString(agentConfig.customProviderUrl);
-  return apiKeyRef === "antigravity" || provider === "google-antigravity" || url.includes(ANTIGRAVITY_CLOUD_CODE_HOST);
+  return apiKeyRef === "antigravity" || provider === "google-antigravity" || // 只看解析后的 hostname（同 resolver）：后缀 host / userinfo / path 里的官方串
+  // 都不构成 antigravity 身份。
+  isAntigravityCloudCodeBaseUrl(url);
 }
 function readAntigravityProjectId(metadata) {
   return asOptionalTrimmedString(metadata?.projectId);
@@ -155,6 +175,7 @@ export {
   ANTIGRAVITY_CALLBACK_PATH,
   ANTIGRAVITY_SCOPES,
   ANTIGRAVITY_CLOUD_CODE_BASE_URL,
+  isAntigravityCloudCodeBaseUrl,
   getAntigravityUserAgent,
   resolveAntigravityCloudCodeBaseUrl,
   isAntigravityOAuthAgent,