nolo-cli 0.154.0-alpha.1 → 0.154.1

package/{chunk-GJRCYN5X.js → chunk-FB5WLEOD.js}

@@ -5,7 +5,7 @@ import {
   inlineImageUrlsForCustomProvider,
   prepareTools,
   shouldInlineImageUrlsForAgent
-} from "./chunk-OU7WCUB5.js";
+} from "./chunk-OLVOR45M.js";
 import {
   CONFIRMATION_INPUT_KEYS,
   INVALID_TOOL_ARGS_REPLACEMENT,
@@ -14,16 +14,16 @@ import {
   performFetchRequest,
   sanitizeOutboundMessages,
   stripModelToolArgs
-} from "./chunk-LXTNZVD4.js";
+} from "./chunk-HW7EBEC5.js";
 import {
   findToolExecutor,
   toolDefinitionsByName
-} from "./chunk-UGN77YJU.js";
+} from "./chunk-2ZYCNT2O.js";
 import {
   classifyApiError,
   classifyGenerationError,
   extractErrorDiagnostics
-} from "./chunk-24UXUXPR.js";
+} from "./chunk-QZIOZDM6.js";
 import {
   createSSEParser,
   createToolRunId,
@@ -32,7 +32,7 @@ import {
   toolRunSetPending,
   toolRunStarted,
   toolRunSucceeded
-} from "./chunk-HHC5FJHS.js";
+} from "./chunk-FCUKCVKN.js";
 import {
   getPublicImageAgentMode
 } from "./chunk-VIDPVFP3.js";
@@ -42,10 +42,10 @@ import {
   messageStreaming,
   toolResultNeedsUserConfirmation,
   updateToolMessage
-} from "./chunk-RGBBF2RB.js";
+} from "./chunk-F5WASHQA.js";
 import {
   streamAgentChatTurn
-} from "./chunk-4WLENVCW.js";
+} from "./chunk-DT7EWFTY.js";
 import {
   getCurrentSpaceId
 } from "./chunk-ZJ7UHBJS.js";
@@ -56,16 +56,16 @@ import {
 } from "./chunk-OWYYDMGJ.js";
 import {
   selectCurrentServer
-} from "./chunk-QFEW2ULV.js";
+} from "./chunk-32ZKZET7.js";
 import {
   write
-} from "./chunk-A7HQF6YH.js";
+} from "./chunk-CDLP56BS.js";
 import {
   createAsyncThunk
-} from "./chunk-IJERIUXS.js";
+} from "./chunk-WRCZXJ4N.js";
 import {
   selectIdentityToken
-} from "./chunk-SEJ5OS6F.js";
+} from "./chunk-PXYBUFDB.js";
 import {
   classifyOutboundErrorCategory,
   createOutboundDiagnosticCall,
@@ -85,13 +85,13 @@ import {
 } from "./chunk-56GBUMO5.js";
 import {
   normalizeChatCompletionsBodyForProvider
-} from "./chunk-6TF64IF2.js";
+} from "./chunk-4L4K6YR7.js";
 import {
   EMPTY_ASSISTANT_REPAIR_PROMPT
-} from "./chunk-ZWG3C7VI.js";
+} from "./chunk-F3SOW2EU.js";
 import {
   getModelInfo
-} from "./chunk-2MTE2PEH.js";
+} from "./chunk-QA2C5NKI.js";
 import {
   isAbortError
 } from "./chunk-7DPNBQSV.js";
@@ -105,7 +105,7 @@ import {
 } from "./chunk-5EMSBTQ6.js";
 import {
   getApiEndpoint
-} from "./chunk-TRW43TSC.js";
+} from "./chunk-6EQD4AQL.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
@@ -573,7 +573,10 @@ var processToolData = createAsyncThunk(
       const toolResult = await found.executor(executionToolArgs, thunkApi, {
         parentMessageId,
         toolRunId,
-        agentKey
+        agentKey,
+        // 定档信号：这里是前台对话流式路径，来源恒为 chat；对话 id 用于数历史搜索。
+        ...args.dialogId ? { dialogId: args.dialogId } : {},
+        origin: "chat"
       });
       const rawData = toolResult?.rawData ?? toolResult;
       const llmContext = asOptionalTrimmedString(toolResult?.llmContext);
@@ -750,7 +753,8 @@ var handleToolCalls = createAsyncThunk(
             toolCall: { ...toolCall, id: toolCallId },
             parentMessageId: messageId,
             toolRunId,
-            agentKey: agentConfig.dbKey
+            agentKey: agentConfig.dbKey,
+            dialogId
           })
         ).unwrap();
         const toolName = result.toolName;

package/{chunk-HHC5FJHS.js → chunk-FCUKCVKN.js}

@@ -5,24 +5,24 @@ import {
   normalizePolicyLevelSetting,
   normalizeSystemBuiltinSkills,
   normalizeTonePresetSetting
-} from "./chunk-HXHSTRGH.js";
+} from "./chunk-VYNMQ6HW.js";
 import {
   fetchAndCacheTableRows
-} from "./chunk-ON3WLDG2.js";
+} from "./chunk-YR47Y7CN.js";
 import {
   require_react
 } from "./chunk-YDH3FDFQ.js";
 import {
   createAsyncThunk,
   createSelector
-} from "./chunk-IJERIUXS.js";
+} from "./chunk-WRCZXJ4N.js";
 import {
   selectIdentityUserId
-} from "./chunk-SEJ5OS6F.js";
+} from "./chunk-PXYBUFDB.js";
 import {
   resolveBuiltinCapability,
   resolveBuiltinSkillEntry
-} from "./chunk-4Z245KOA.js";
+} from "./chunk-SH3XD4E2.js";
 import {
   DEFAULT_SYSTEM_AGENT_CAPABILITIES
 } from "./chunk-EUGTFFO6.js";
@@ -287,7 +287,11 @@ var MODES = [
 var DEFAULT_RECOMMENDED_SKILL_SLUGS = [
   "worktree-isolation",
   "systematic-investigation",
-  "show-me"
+  "show-me",
+  // 凭据管理：仓库已有 nolo secret（set/list/run/bind），但技能发现只扫
+  // `.agents/skills`，内置的 secrets-manager 不会出现在"可用技能"里。放进默认
+  // 提示名单让它至少以一行提示出现（不授工具、不放宽权限）。
+  "secrets-manager"
 ];
 var asMode = (value) => typeof value === "string" && MODES.includes(value) ? value : null;
 var resolveAgentSkillConfig = (source) => {
@@ -517,7 +521,7 @@ var executeToolRun = createAsyncThunk(
     if (!executionInput) {
       throw new Error(`ToolRun ${id} has no input to execute with.`);
     }
-    const { findToolExecutor } = await import("./tools-XF5A6N2B.js");
+    const { findToolExecutor } = await import("./tools-23VQGJOX.js");
     const { executor } = findToolExecutor(run.toolName);
     toolRunStarted({
       id: run.id,
@@ -541,7 +545,7 @@ var executeToolRun = createAsyncThunk(
         const latestState = thunkApi.getState();
         const userId = selectIdentityUserId(latestState);
         if (userId) {
-          const { fetchUserSpaceMemberships } = await import("./memberThunks-VPTET5M2.js");
+          const { fetchUserSpaceMemberships } = await import("./memberThunks-AZINUM4S.js");
           await thunkApi.dispatch(fetchUserSpaceMemberships(userId));
         }
       }

package/{chunk-FY4SDK2E.js → chunk-FDLDMJTM.js}

@@ -14,7 +14,7 @@ function buildCliLocalRuntimeDbEnv(env = process.env) {
   };
 }
 async function getDefaultCliLocalRuntimeDb(options = {}) {
-  const { getDefaultCliLocalRuntimeDb: getAuthorityBackedDb } = await import("./localRuntimeAuthority-JDAD7CB6.js");
+  const { getDefaultCliLocalRuntimeDb: getAuthorityBackedDb } = await import("./localRuntimeAuthority-BPN5OAQG.js");
   return getAuthorityBackedDb(options);
 }
 

package/{chunk-EM3YOZJ4.js → chunk-FFHV45HO.js}

@@ -1,13 +1,13 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-G47IPDOK.js";
+} from "./chunk-O2IWR23M.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-HKT6QXP3.js";
+} from "./chunk-KABQ74UQ.js";
 import {
   deriveCredentialGroup
-} from "./chunk-KX6LPG7W.js";
+} from "./chunk-VXS4YYJ2.js";
 import {
   isTombstoneRecord
 } from "./chunk-D2MDMY2M.js";

package/{chunk-SWZEIKWQ.js → chunk-FZYKQFBQ.js}

@@ -1,10 +1,10 @@
 import {
   fetchReferenceContents,
   resolveReferenceAssets
-} from "./chunk-24UXUXPR.js";
+} from "./chunk-QZIOZDM6.js";
 import {
   updateTokensAction
-} from "./chunk-RGBBF2RB.js";
+} from "./chunk-F5WASHQA.js";
 import {
   applyUpdateTokensFulfilled
 } from "./chunk-OWYYDMGJ.js";
@@ -12,7 +12,7 @@ import {
   extractReasoningFromResponseOutput,
   extractTextFromResponseOutput,
   extractToolCallsFromResponseOutput
-} from "./chunk-6TF64IF2.js";
+} from "./chunk-4L4K6YR7.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";

package/{chunk-7KYVUFDG.js → chunk-G3VYRPTV.js}

@@ -1,3 +1,7 @@
+import {
+  buildEnvFromProfile,
+  loadProfileConfig
+} from "./chunk-R5GO3YZP.js";
 import {
   ANTIGRAVITY_AUTH_URL,
   ANTIGRAVITY_CALLBACK_PATH,
@@ -11,7 +15,7 @@ import {
   getAntigravityUserAgent,
   normalizeAntigravityTokenPayload,
   refreshAntigravityToken
-} from "./chunk-JGRPBIZZ.js";
+} from "./chunk-SQX235S2.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
@@ -24,10 +28,6 @@ import {
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import {
-  buildEnvFromProfile,
-  loadProfileConfig
-} from "./chunk-TNIX77YM.js";
 import {
   writeOAuthCredential
 } from "./chunk-ZWQUWF6W.js";
@@ -868,257 +868,6 @@ function resolveServerSyncConfig() {
   return null;
 }
 
-// packages/agent-runtime/workbuddyOAuth.ts
-var WORKBUDDY_APP_VERSION = "2.0.0";
-var WORKBUDDY_UA_VERSION = "5.5.6";
-var WORKBUDDY_POLL_INTERVAL_MS = 1e3;
-var WORKBUDDY_SIGN_IN_TIMEOUT_MS = 5 * 60 * 1e3;
-var WORKBUDDY_EARLY_REFRESH_SKEW_MS = 60 * 1e3;
-var WORKBUDDY_KEEP_RENEWED_MS = 60 * 1e3;
-var WORKBUDDY_REQUEST_TIMEOUT_MS = 3e4;
-var WORKBUDDY_SITES = {
-  workbuddy: {
-    id: "workbuddy",
-    name: "WorkBuddy",
-    endpoint: "https://copilot.tencent.com",
-    authId: "workbuddy-desktop",
-    platform: "workbuddy",
-    ai: false
-  },
-  "workbuddy-ai": {
-    id: "workbuddy-ai",
-    name: "WorkBuddy AI",
-    endpoint: "https://www.workbuddy.ai",
-    authId: "workbuddy-desktop-ai",
-    platform: "workbuddy-ai",
-    ai: true
-  }
-};
-function getWorkBuddySite(site) {
-  if (site === "workbuddy" || site === "workbuddy-ai") {
-    return WORKBUDDY_SITES[site];
-  }
-  throw new Error(`Unknown WorkBuddy site: "${String(site)}". Expected "workbuddy" or "workbuddy-ai".`);
-}
-function sanitizeWorkBuddyError(message) {
-  return message.replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(/([?&]|\b)(state|token|accessToken|refreshToken)=[^&\s]+/gi, "$1$2=[REDACTED]").replace(/(["']?(?:accessToken|refreshToken|state|token)["']?\s*:\s*["'])[^"']+["']/gi, '$1[REDACTED]"');
-}
-function sanitizeWorkBuddyDomain(rawDomain, defaultHost) {
-  if (typeof rawDomain !== "string" || !rawDomain.trim()) {
-    return defaultHost;
-  }
-  let domain = rawDomain.trim();
-  if (domain.startsWith("https://") || domain.startsWith("http://")) {
-    try {
-      domain = new URL(domain).host;
-    } catch {
-      return defaultHost;
-    }
-  }
-  const slashIdx = domain.indexOf("/");
-  if (slashIdx !== -1) domain = domain.slice(0, slashIdx);
-  const qIdx = domain.indexOf("?");
-  if (qIdx !== -1) domain = domain.slice(0, qIdx);
-  if (!/^[a-zA-Z0-9.-]+(?::[0-9]+)?$/.test(domain)) {
-    return defaultHost;
-  }
-  return domain;
-}
-function normalizeWorkBuddyTokenPayload(siteOrArgs, payloadArg, baseCredentialArg, nowArg) {
-  let site;
-  let payload;
-  let baseCredential;
-  let now;
-  if (typeof siteOrArgs === "object" && siteOrArgs !== null && "site" in siteOrArgs) {
-    site = siteOrArgs.site;
-    payload = siteOrArgs.payload ?? {};
-    baseCredential = siteOrArgs.baseCredential;
-    now = siteOrArgs.now ?? Date.now();
-  } else {
-    site = siteOrArgs;
-    payload = payloadArg ?? {};
-    baseCredential = baseCredentialArg;
-    now = nowArg ?? Date.now();
-  }
-  const siteConfig = getWorkBuddySite(site);
-  if (typeof payload.accessToken !== "string" || !payload.accessToken.trim()) {
-    throw new Error("WorkBuddy token response missing accessToken");
-  }
-  const accessToken = payload.accessToken.trim();
-  let expiresAt;
-  const rawExpiresAt = Number(payload.expiresAt);
-  const rawExpiresIn = Number(payload.expiresIn);
-  if (Number.isFinite(rawExpiresAt) && rawExpiresAt > 0) {
-    expiresAt = rawExpiresAt;
-  } else if (Number.isFinite(rawExpiresIn) && rawExpiresIn > 0) {
-    expiresAt = now + rawExpiresIn * 1e3;
-  } else if (typeof baseCredential?.expiresAt === "number") {
-    expiresAt = baseCredential.expiresAt;
-  } else {
-    expiresAt = now + 3600 * 1e3;
-  }
-  let refreshExpiresAt;
-  const rawRefExpAt = Number(payload.refreshExpiresAt);
-  const rawRefExpIn = Number(payload.refreshExpiresIn);
-  if (Number.isFinite(rawRefExpAt) && rawRefExpAt > 0) {
-    refreshExpiresAt = rawRefExpAt;
-  } else if (Number.isFinite(rawRefExpIn) && rawRefExpIn > 0) {
-    refreshExpiresAt = now + rawRefExpIn * 1e3;
-  } else if (typeof baseCredential?.metadata?.refreshExpiresAt === "number") {
-    refreshExpiresAt = baseCredential.metadata.refreshExpiresAt;
-  }
-  const refreshToken = typeof payload.refreshToken === "string" && payload.refreshToken.trim() ? payload.refreshToken.trim() : baseCredential?.refreshToken;
-  const uid = typeof payload.uid === "string" && payload.uid.trim() ? payload.uid.trim() : typeof baseCredential?.metadata?.uid === "string" && baseCredential.metadata.uid.trim() ? baseCredential.metadata.uid.trim() : baseCredential?.accountId ?? "";
-  const defaultHost = new URL(siteConfig.endpoint).host;
-  const domain = sanitizeWorkBuddyDomain(
-    payload.domain ?? baseCredential?.metadata?.domain,
-    defaultHost
-  );
-  const rawEnterpriseId = typeof payload.enterpriseId === "string" ? payload.enterpriseId : typeof baseCredential?.metadata?.enterpriseId === "string" ? baseCredential.metadata.enterpriseId : "";
-  const enterpriseId = rawEnterpriseId.trim();
-  const nickname = typeof payload.nickname === "string" && payload.nickname.trim() ? payload.nickname.trim() : typeof payload.phoneNumber === "string" && payload.phoneNumber.trim() ? payload.phoneNumber.trim() : typeof baseCredential?.metadata?.nickname === "string" ? baseCredential.metadata.nickname : void 0;
-  return {
-    ...baseCredential ?? {},
-    provider: site,
-    accessToken,
-    ...refreshToken ? { refreshToken } : {},
-    expiresAt,
-    obtainedAt: now,
-    accountId: uid || nickname || siteConfig.name,
-    metadata: {
-      site,
-      uid,
-      domain,
-      ...enterpriseId ? { enterpriseId } : {},
-      ...refreshExpiresAt ? { refreshExpiresAt } : {},
-      ...nickname ? { nickname } : {}
-    }
-  };
-}
-var renewing = /* @__PURE__ */ new Map();
-var renewed = /* @__PURE__ */ new Map();
-function getWorkBuddyRefreshKey(site, credential) {
-  const accountOrUid = credential.accountId || credential.metadata?.uid || "";
-  const token = credential.refreshToken || "";
-  return `${site}
-${accountOrUid}
-${token}`;
-}
-async function refreshWorkBuddyToken(credential, deps = {}) {
-  if (!credential.refreshToken) {
-    throw new Error("WorkBuddy credential has no refresh_token");
-  }
-  const now = deps.now?.() ?? Date.now();
-  const refreshExpiresAt = credential.metadata?.refreshExpiresAt;
-  if (typeof refreshExpiresAt === "number" && now >= refreshExpiresAt) {
-    throw new Error("this WorkBuddy account is signed out; sign in again");
-  }
-  const site = credential.metadata?.site === "workbuddy-ai" || credential.provider === "workbuddy-ai" ? "workbuddy-ai" : "workbuddy";
-  const siteConfig = getWorkBuddySite(site);
-  const key = getWorkBuddyRefreshKey(site, credential);
-  const cached = renewed.get(key);
-  if (cached && now - cached.at < WORKBUDDY_KEEP_RENEWED_MS) {
-    return cached.credential;
-  }
-  const inflight = renewing.get(key);
-  if (inflight) {
-    return inflight;
-  }
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const refreshPromise = (async () => {
-    const defaultHost = new URL(siteConfig.endpoint).host;
-    const domain = sanitizeWorkBuddyDomain(credential.metadata?.domain, defaultHost);
-    const enterpriseId = typeof credential.metadata?.enterpriseId === "string" ? credential.metadata.enterpriseId.trim() : "";
-    const headers = {
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      "User-Agent": `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
-      "X-Refresh-Token": credential.refreshToken,
-      "X-Auth-Refresh-Source": "plugin",
-      "X-Domain": domain,
-      ...enterpriseId ? { "X-Enterprise-Id": enterpriseId, "X-Tenant-Id": enterpriseId } : {}
-    };
-    let response;
-    try {
-      response = await fetchImpl(`${siteConfig.endpoint}/v2/plugin/auth/token/refresh`, {
-        method: "POST",
-        headers,
-        body: "{}",
-        signal: AbortSignal.timeout(WORKBUDDY_REQUEST_TIMEOUT_MS)
-      });
-    } catch (error) {
-      throw new Error(sanitizeWorkBuddyError(`WorkBuddy token refresh failed: ${toErrorMessage(error)}`));
-    }
-    let text = "";
-    try {
-      text = await response.text();
-    } catch {
-    }
-    let env = {};
-    try {
-      env = JSON.parse(text);
-    } catch {
-    }
-    const code = typeof env.code === "number" ? env.code : Number.parseInt(String(env.code ?? ""), 10) || 0;
-    if (!response.ok) {
-      const why = String(env.msg || env.message || text.slice(0, 200) || response.statusText);
-      throw new Error(
-        sanitizeWorkBuddyError(
-          `${siteConfig.name} token refresh failed: ${why} (HTTP ${response.status}${code ? `, code ${code}` : ""})`
-        )
-      );
-    }
-    if (code !== 0) {
-      const why = String(env.msg || env.message || "error");
-      throw new Error(
-        sanitizeWorkBuddyError(`${siteConfig.name} token refresh failed: ${why} (${code})`)
-      );
-    }
-    const data = env.data && typeof env.data === "object" ? env.data : env;
-    if (typeof data.accessToken !== "string" || !data.accessToken.trim()) {
-      throw new Error("WorkBuddy gave no refreshed token");
-    }
-    const nextCredential = normalizeWorkBuddyTokenPayload(site, data, credential, now);
-    renewed.set(key, { credential: nextCredential, at: now });
-    return nextCredential;
-  })().finally(() => {
-    renewing.delete(key);
-  });
-  renewing.set(key, refreshPromise);
-  return refreshPromise;
-}
-var workbuddyRefresh = refreshWorkBuddyToken;
-function getWorkBuddyHeaders(credential) {
-  const site = credential.metadata?.site === "workbuddy-ai" || credential.provider === "workbuddy-ai" ? "workbuddy-ai" : "workbuddy";
-  const siteConfig = getWorkBuddySite(site);
-  const defaultHost = new URL(siteConfig.endpoint).host;
-  const domain = sanitizeWorkBuddyDomain(credential.metadata?.domain, defaultHost);
-  const uid = typeof credential.metadata?.uid === "string" ? credential.metadata.uid.trim() : credential.accountId ?? "";
-  const rawEnterpriseId = typeof credential.metadata?.enterpriseId === "string" ? credential.metadata.enterpriseId.trim() : "";
-  const headers = {
-    Authorization: `Bearer ${credential.accessToken}`,
-    "X-User-Id": uid,
-    "X-Domain": domain,
-    "X-Product": "SaaS",
-    "X-IDE-Type": "WorkBuddy",
-    "User-Agent": `WorkBuddy/${WORKBUDDY_UA_VERSION}`,
-    "X-Requested-With": "XMLHttpRequest",
-    "X-Agent-Intent": "craft",
-    "X-Agent-Purpose": "conversation",
-    "X-IDE-Name": "WorkBuddy",
-    "X-IDE-Version": WORKBUDDY_UA_VERSION
-  };
-  if (rawEnterpriseId) {
-    const cleanEnterpriseId = rawEnterpriseId.replace(/[\r\n]/g, "");
-    headers["X-Enterprise-Id"] = cleanEnterpriseId;
-    headers["X-Tenant-Id"] = cleanEnterpriseId;
-  }
-  if (siteConfig.ai) {
-    headers["X-Agent-Type"] = "main";
-  }
-  return headers;
-}
-
 // packages/agent-runtime/xaiOAuth.ts
 var XAI_OAUTH_ISSUER = "https://auth.x.ai";
 var XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
@@ -1497,17 +1246,6 @@ async function refreshCursorToken(credential, deps = {}) {
 var cursorRefresh = refreshCursorToken;
 
 export {
-  WORKBUDDY_APP_VERSION,
-  WORKBUDDY_UA_VERSION,
-  WORKBUDDY_POLL_INTERVAL_MS,
-  WORKBUDDY_SIGN_IN_TIMEOUT_MS,
-  WORKBUDDY_REQUEST_TIMEOUT_MS,
-  getWorkBuddySite,
-  sanitizeWorkBuddyError,
-  sanitizeWorkBuddyDomain,
-  normalizeWorkBuddyTokenPayload,
-  workbuddyRefresh,
-  getWorkBuddyHeaders,
   startCallbackServer,
   runAntigravityOAuthLogin,
   refreshAntigravityOAuthToken,

package/{chunk-6MJNEXUU.js → chunk-HGDKT2D6.js}

@@ -607,7 +607,11 @@ function createDockerToolChannel(runGrant, backend) {
 
 export {
   SANDBOX_WORKSPACE_ROOT,
+  SANDBOX_HELPER_PATH,
   buildSandboxHelperUploadArgv,
+  SANDBOX_OUTPUT_LIMITS,
+  buildWorkspaceHelperSource,
+  parseToolOutput,
   buildPrimaryExecutionTicket,
   dockerExecutionToolNames,
   createDockerToolChannel