nolo-cli 0.156.0-alpha.3 → 0.156.0

package/{chunk-6MJNEXUU.js → chunk-HGDKT2D6.js}

@@ -607,7 +607,11 @@ function createDockerToolChannel(runGrant, backend) {
 
 export {
   SANDBOX_WORKSPACE_ROOT,
+  SANDBOX_HELPER_PATH,
   buildSandboxHelperUploadArgv,
+  SANDBOX_OUTPUT_LIMITS,
+  buildWorkspaceHelperSource,
+  parseToolOutput,
   buildPrimaryExecutionTicket,
   dockerExecutionToolNames,
   createDockerToolChannel

package/{chunk-6KVZAZJA.js → chunk-HRZW3SQN.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-U4STABYN.js";
 import {
   getReadableCliDb
-} from "./chunk-P5QACQDK.js";
+} from "./chunk-62TBKWTV.js";
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-NQ64VVAI.js";
+} from "./chunk-GXZZOTDM.js";
 import {
   readCredentialAvailability
 } from "./chunk-6MXDOUMH.js";
@@ -19,17 +19,17 @@ import {
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-HKT6QXP3.js";
+} from "./chunk-5IKRTRRR.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-NBTY7YJF.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
 import {
   parseUserIdFromAuthToken,
   resolveAuthToken
 } from "./chunk-A7GB5UGH.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
 
 // packages/cli/agentRecordCommands.ts
 async function runAgentReadCommand(args, deps = {}) {
@@ -244,7 +244,7 @@ async function runAgentCreateCommand(args, deps = {}) {
     let verifyResult;
     if (parsed.verify) {
       try {
-        const { verifyCustomProvider } = await import("./agentProviderCommands-X2HQE6HY.js");
+        const { verifyCustomProvider } = await import("./agentProviderCommands-CXBHNONN.js");
         const rec = built.nextRecord;
         verifyResult = await verifyCustomProvider({
           providerUrl: rec.customProviderUrl,

package/{chunk-B2EGWZJG.js → chunk-I7S63QUU.js}

@@ -1,7 +1,7 @@
 import {
   generatePkcePair,
   startCallbackServer
-} from "./chunk-7KYVUFDG.js";
+} from "./chunk-G3VYRPTV.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";

package/{chunk-ROPSATAB.js → chunk-IF7V3CBU.js}

@@ -7,7 +7,7 @@ import {
 import {
   patch,
   selectById
-} from "./chunk-HP6O6LTV.js";
+} from "./chunk-CDLP56BS.js";
 
 // packages/chat/dialog/actions/setDialogExtraReferencesAction.ts
 var setDialogExtraReferencesAction = async (extraReferences, thunkApi) => {

package/{chunk-T6CBQ6BN.js → chunk-INFHX73M.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_AGENT_BASE_POLICY,
   DEFAULT_USER_PREFERENCE_PROFILE
-} from "./chunk-HXHSTRGH.js";
+} from "./chunk-VYNMQ6HW.js";
 
 // packages/ai/policy/runtimePolicy.ts
 var clampLevel = (value, fallback) => {

package/{chunk-YBNHPX4S.js → chunk-IW64YHXL.js}

@@ -4,15 +4,15 @@ import {
 import {
   DEFAULT_NOLO_SERVER_URL
 } from "./chunk-OLZBQWZU.js";
-import {
-  normalizeServerOrigin
-} from "./chunk-CF7PE763.js";
 import {
   loadProfileConfig
-} from "./chunk-TNIX77YM.js";
+} from "./chunk-R5GO3YZP.js";
 import {
   resolveDefaultSpawn
 } from "./chunk-Y6ROFCZO.js";
+import {
+  normalizeServerOrigin
+} from "./chunk-CF7PE763.js";
 
 // packages/cli/updateCommands.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, accessSync, constants } from "node:fs";
@@ -912,6 +912,144 @@ async function runShellScript(script, {
   ]);
   return exitCode;
 }
+function shellQuote(value) {
+  return "'" + value.replace(/'/g, "'\\''") + "'";
+}
+function buildStandaloneUpdateScript(args) {
+  const curl = "curl -fL --progress-bar --connect-timeout 20 --max-time 600 --speed-limit 1 --speed-time 60";
+  return `set -eu
+EXTRACT_DIR=${shellQuote(args.extractDir)}
+ENTRY=${shellQuote(args.symlinkPath)}
+CURRENT_VERSION=${shellQuote(args.currentVersion)}
+STAGING="$EXTRACT_DIR.new.$$"
+BACKUP="$EXTRACT_DIR.old.$$"
+LINK="$ENTRY.new.$$"
+old_moved=0
+new_moved=0
+committed=0
+cleanup() {
+  status=$?
+  trap - 0 HUP INT TERM
+  if [ "$committed" = 0 ]; then
+    if [ "$new_moved" = 1 ] && [ -d "$EXTRACT_DIR" ]; then
+      mv "$EXTRACT_DIR" "$STAGING" || exit 1
+    fi
+    if [ "$old_moved" = 1 ] && [ -d "$BACKUP" ]; then
+      mv "$BACKUP" "$EXTRACT_DIR" || exit 1
+    fi
+  fi
+  rm -rf "$STAGING" || true
+  rm -f "$LINK" || true
+  exit "$status"
+}
+# Refuse collisions before installing cleanup: never remove somebody else's path.
+if [ -e "$STAGING" ] || [ -L "$STAGING" ] ||
+   [ -e "$BACKUP" ] || [ -L "$BACKUP" ] ||
+   [ -e "$LINK" ] || [ -L "$LINK" ]; then
+  echo "Error: update staging path already exists" >&2
+  exit 1
+fi
+mkdir -p "\${EXTRACT_DIR%/*}"
+mkdir "$STAGING"
+trap cleanup 0
+trap 'exit 1' HUP INT TERM
+
+echo ${shellQuote(`Downloading nolo from ${args.tarballUrl}...`)}
+if ! ${curl} ${shellQuote(args.tarballUrl)} -o "$STAGING/bundle.tar.gz"; then
+  ${args.tarballUrl !== args.fallbackUrl ? `echo ${shellQuote(`Primary source unavailable, trying ${args.fallbackUrl}...`)}
+  if ! ${curl} ${shellQuote(args.fallbackUrl)} -o "$STAGING/bundle.tar.gz"; then
+    echo "Error: download failed" >&2
+    exit 1
+  fi` : `echo "Error: download failed" >&2
+  exit 1`}
+fi
+tar -xzf "$STAGING/bundle.tar.gz" -C "$STAGING"
+rm -f "$STAGING/bundle.tar.gz"
+chmod +x "$STAGING/nolo"
+# A failing, empty or malformed version response must not touch the live install.
+VERSION_TEXT=$("$STAGING/nolo" -v)
+case "$VERSION_TEXT" in
+  "nolo-cli "*) VERSION=\${VERSION_TEXT#nolo-cli } ;;
+  *) VERSION=$VERSION_TEXT ;;
+esac
+CORE=\${VERSION%%[-+]*}
+MAJOR=\${CORE%%.*}
+REST=\${CORE#*.}
+MINOR=\${REST%%.*}
+PATCH=\${REST#*.}
+case "$MAJOR:$MINOR:$PATCH" in
+  *[!0-9:]*|:*|*::*|*:) echo "Error: invalid bundle version" >&2; exit 1 ;;
+esac
+if [ "$CORE" != "$MAJOR.$MINOR.$PATCH" ]; then
+  echo "Error: invalid bundle version" >&2
+  exit 1
+fi
+case "$VERSION" in
+  *[!0-9A-Za-z.+-]*) echo "Error: invalid bundle version" >&2; exit 1 ;;
+esac
+case "$CURRENT_VERSION" in
+  "nolo-cli "*) CUR_VER=\${CURRENT_VERSION#nolo-cli } ;;
+  *) CUR_VER=$CURRENT_VERSION ;;
+esac
+CUR_CORE=\${CUR_VER%%[-+]*}
+CUR_MAJOR=\${CUR_CORE%%.*}
+CUR_REST=\${CUR_CORE#*.}
+CUR_MINOR=\${CUR_REST%%.*}
+CUR_PATCH=\${CUR_REST#*.}
+if [ -n "$CUR_MAJOR" ] && [ -n "$CUR_MINOR" ] && [ -n "$CUR_PATCH" ]; then
+  case "$CUR_MAJOR:$CUR_MINOR:$CUR_PATCH" in
+    *[!0-9:]*|:*|*::*|*:) ;;
+    *)
+      if [ "$CUR_CORE" = "$CUR_MAJOR.$CUR_MINOR.$CUR_PATCH" ]; then
+        is_downgrade=0
+        if [ "$MAJOR" -lt "$CUR_MAJOR" ]; then
+          is_downgrade=1
+        elif [ "$MAJOR" -eq "$CUR_MAJOR" ]; then
+          if [ "$MINOR" -lt "$CUR_MINOR" ]; then
+            is_downgrade=1
+          elif [ "$MINOR" -eq "$CUR_MINOR" ]; then
+            if [ "$PATCH" -lt "$CUR_PATCH" ]; then
+              is_downgrade=1
+            fi
+          fi
+        fi
+        if [ "$is_downgrade" = 1 ]; then
+          echo "Error: refusing downgrade from $CURRENT_VERSION to $VERSION" >&2
+          exit 11
+        fi
+      fi
+      ;;
+  esac
+fi
+if [ "$VERSION" = "$CURRENT_VERSION" ]; then
+  echo "\u2713 Already up to date (nolo-cli $VERSION)."
+  exit 10
+fi
+mkdir -p "\${ENTRY%/*}"
+# mv without -T is portable only when the destination is not a directory.
+if [ -d "$ENTRY" ] || [ -L "$EXTRACT_DIR" ]; then
+  echo "Error: refusing directory entrypoint or symlink bundle directory" >&2
+  exit 1
+fi
+ln -s "$EXTRACT_DIR/nolo" "$LINK"
+if [ -e "$EXTRACT_DIR" ]; then
+  old_moved=1
+  mv "$EXTRACT_DIR" "$BACKUP"
+fi
+new_moved=1
+mv "$STAGING" "$EXTRACT_DIR"
+mv -f "$LINK" "$ENTRY"
+committed=1
+# Retain only the newest recovery copy from this run; prune older backups.
+for old_copy in "$EXTRACT_DIR.old."*; do
+  if [ -d "$old_copy" ] && [ ! -L "$old_copy" ] && [ "$old_copy" != "$BACKUP" ]; then
+    rm -rf "$old_copy" || true
+  fi
+done
+# Retain the previous bundle as a recovery copy; never unlink the live entry.
+echo "nolo updated to $ENTRY"
+`;
+}
 async function runStandaloneBundleUpdate(options) {
   const output = options.output ?? process.stdout;
   const spawn2 = options.spawn ?? resolveDefaultSpawn();
@@ -937,33 +1075,13 @@ async function runStandaloneBundleUpdate(options) {
   const extractDir = join2(homedir2(), ".nolo", extractSubdir);
   const installDir = resolveStandaloneInstallDir();
   const symlinkPath = join2(installDir, "nolo");
-  const script = `set -euo pipefail
-TEMP_DIR=$(mktemp -d)
-trap 'rm -rf "$TEMP_DIR"' EXIT
-
-echo "Downloading nolo from ${tarballUrl}..."
-if ! curl -fL --progress-bar "${tarballUrl}" -o "$TEMP_DIR/${tarballName}"; then
-  ${tarballUrl !== fallbackUrl ? `echo "Primary source unavailable, trying ${fallbackUrl}..."
-  if ! curl -fL --progress-bar "${fallbackUrl}" -o "$TEMP_DIR/${tarballName}"; then
-    echo "Error: download failed from ${fallbackUrl}" >&2
-    exit 1
-  fi` : `echo "Error: download failed from ${tarballUrl}" >&2
-  exit 1`}
-fi
-
-mkdir -p "${extractDir}"
-tar -xzf "$TEMP_DIR/${tarballName}" -C "${extractDir}"
-chmod +x "${extractDir}/nolo"
-
-mkdir -p "${installDir}"
-if [ -e "${symlinkPath}" ] || [ -L "${symlinkPath}" ]; then
-  rm -f "${symlinkPath}"
-fi
-ln -s "${extractDir}/nolo" "${symlinkPath}"
-trap - EXIT
-
-echo "nolo updated to ${installDir}/nolo"
-`;
+  const script = buildStandaloneUpdateScript({
+    tarballUrl,
+    fallbackUrl,
+    extractDir,
+    symlinkPath,
+    currentVersion: readPackageInfo().version
+  });
   output.write(`
 Nolo Agent CLI Installer & Updater
 `);
@@ -980,6 +1098,11 @@ Nolo Agent CLI Installer & Updater
     env,
     useCustomSink
   });
+  if (exitCode === 10) {
+    output.write(`  ${renderProgressBar(100)}
+`);
+    return 0;
+  }
   if (exitCode === 0) {
     output.write(`  ${renderProgressBar(100)}
 `);
@@ -1167,6 +1290,7 @@ export {
   buildSelfUpdateCommand,
   resolveSelfUpdateServerUrl,
   buildCliDoctorText,
+  buildStandaloneUpdateScript,
   runStandaloneBundleUpdate,
   NOLO_UPDATE_CHECK_KILL_SWITCH,
   compareCliVersions,

package/{chunk-VSOWPETY.js → chunk-JIAZK434.js}

@@ -2,7 +2,7 @@ import {
   clipMultilineText,
   fetchAndSerializeTable,
   waitForAbortableDelay
-} from "./chunk-RUNKPFM5.js";
+} from "./chunk-6QIBWOPT.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -11,34 +11,37 @@ import {
   isCoreDrainingBody,
   normalizeNonNegativeMs,
   parseRetryAfterHeaderMs
-} from "./chunk-XPWGOTBQ.js";
+} from "./chunk-3L2WKC3W.js";
 import {
   resolvePageReadMarkdown,
   slateToSimplifiedMarkdown
-} from "./chunk-3XZKV7QQ.js";
+} from "./chunk-3L5MSPWX.js";
 import {
   extractCategorizedMentions
 } from "./chunk-AGIM7IMJ.js";
 import {
   fetchAndCacheMessages
-} from "./chunk-H4KACZMG.js";
+} from "./chunk-2QQ7D3P5.js";
 import {
   createSpaceKey
 } from "./chunk-UAD2WT54.js";
 import {
   read
-} from "./chunk-HP6O6LTV.js";
+} from "./chunk-CDLP56BS.js";
 import {
   getRuntimeServerContext
-} from "./chunk-Z6KQDSZW.js";
+} from "./chunk-43OFVLWJ.js";
 import {
   extractRuntimePageCapabilities,
   resolveBuiltinSkillPage,
   resolveSkillGraphFromRoots
-} from "./chunk-4Z245KOA.js";
+} from "./chunk-SH3XD4E2.js";
 import {
   isAbortError
 } from "./chunk-7DPNBQSV.js";
+import {
+  wrapHistoricalSummaryWithReplayGuard
+} from "./chunk-4VJAC32I.js";
 import {
   extractCustomId
 } from "./chunk-M2EJHDJP.js";
@@ -51,9 +54,6 @@ import {
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
-import {
-  wrapHistoricalSummaryWithReplayGuard
-} from "./chunk-4VJAC32I.js";
 
 // packages/ai/chat/errorDiagnostics.ts
 var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};

package/{chunk-K43ZF2C3.js → chunk-JPPQ3GUO.js}

@@ -1,6 +1,6 @@
 import {
   resolvePlatformAuthToken
-} from "./chunk-SUKSWFLP.js";
+} from "./chunk-PIG2IUVZ.js";
 import {
   getCredentialsDir
 } from "./chunk-ZWQUWF6W.js";

package/{chunk-TZTWMGE3.js → chunk-JWEXJ573.js}

@@ -4,14 +4,14 @@ import {
 import {
   patch,
   read
-} from "./chunk-HP6O6LTV.js";
+} from "./chunk-CDLP56BS.js";
 import {
   DEVICE_LOCAL_OWNER_ID,
   isDeviceLocalSpaceBody
-} from "./chunk-Z6KQDSZW.js";
+} from "./chunk-43OFVLWJ.js";
 import {
   selectIdentityUserId
-} from "./chunk-SEJ5OS6F.js";
+} from "./chunk-PXYBUFDB.js";
 
 // packages/create/space/utils/permissions.ts
 var checkSpaceMembership = (spaceData, userId) => {

package/{chunk-OH2M7WEU.js → chunk-K3N2DWLT.js}

@@ -7,7 +7,7 @@ import {
 import {
   patch,
   readAndWait
-} from "./chunk-HP6O6LTV.js";
+} from "./chunk-CDLP56BS.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -333,7 +333,7 @@ async function saveDocState(arg, { dispatch, getState }) {
     ).unwrap();
     if (dbSpaceId) {
       try {
-        const { updateContentTitle } = await import("./contentThunks-B3FRQGP7.js");
+        const { updateContentTitle } = await import("./contentThunks-5DNEHJ2Z.js");
         await dispatch(
           updateContentTitle({
             spaceId: dbSpaceId,
@@ -372,7 +372,7 @@ async function saveDocState(arg, { dispatch, getState }) {
   }
 }
 async function createDocState(args, thunkApi) {
-  const { createPageAction } = await import("./createPageAction-LDAVZDN7.js");
+  const { createPageAction } = await import("./createPageAction-37HHOXZ2.js");
   return createPageAction(args, thunkApi);
 }
 function subscribe(listener) {

package/{chunk-I2ZMGXXF.js → chunk-KFHREHUQ.js}

@@ -3,7 +3,7 @@ import {
   isCoreDrainingBody,
   normalizeNonNegativeMs,
   parseRetryAfterHeaderMs
-} from "./chunk-XPWGOTBQ.js";
+} from "./chunk-3L2WKC3W.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";

package/{chunk-3C2QLERX.js → chunk-KMDDG73K.js}

@@ -5,7 +5,7 @@ import {
   getAntigravityUserAgent,
   readAntigravityProjectId,
   resolveAntigravityCloudCodeBaseUrl
-} from "./chunk-JGRPBIZZ.js";
+} from "./chunk-SQX235S2.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";

package/{chunk-EM3YOZJ4.js → chunk-L2JMH4I5.js}

@@ -1,13 +1,13 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-G47IPDOK.js";
+} from "./chunk-W7FGZRLK.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-HKT6QXP3.js";
+} from "./chunk-5IKRTRRR.js";
 import {
   deriveCredentialGroup
-} from "./chunk-KX6LPG7W.js";
+} from "./chunk-WYJTNSVL.js";
 import {
   isTombstoneRecord
 } from "./chunk-D2MDMY2M.js";

package/{chunk-D4OWHT5Y.js → chunk-MAYW6V3E.js}

@@ -1,13 +1,13 @@
 import {
   getRuntimeServerContext,
   scheduleDeleteReplication
-} from "./chunk-Z6KQDSZW.js";
+} from "./chunk-43OFVLWJ.js";
 import {
   fetchFromClientDb
 } from "./chunk-6Q7UTJKR.js";
 import {
   selectIdentityToken
-} from "./chunk-SEJ5OS6F.js";
+} from "./chunk-PXYBUFDB.js";
 import {
   buildTombstoneRecord
 } from "./chunk-D2MDMY2M.js";

package/{chunk-IPAW7XLD.js → chunk-MFVOJ6KF.js}

@@ -1,6 +1,6 @@
 import {
   getModelPricing
-} from "./chunk-YANF2RR4.js";
+} from "./chunk-ZPKUJROL.js";
 import {
   PUBLIC_DEEPSEEK_V4_FLASH_AGENT_ID,
   PUBLIC_DEEPSEEK_V4_PRO_AGENT_ID,
@@ -23,7 +23,7 @@ import {
 } from "./chunk-M2EJHDJP.js";
 import {
   getModelConfig
-} from "./chunk-TRW43TSC.js";
+} from "./chunk-6EQD4AQL.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";

package/{chunk-CBHGZRCE.js → chunk-MYOH447Z.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-OWYYDMGJ.js";
 import {
   selectIdentityToken
-} from "./chunk-SEJ5OS6F.js";
+} from "./chunk-PXYBUFDB.js";
 import {
   compactWhitespace
 } from "./chunk-DWLEOOGR.js";

package/{chunk-6MPAEODB.js → chunk-NHEWV5FD.js}

@@ -7,7 +7,7 @@ import {
   scheduleExistingRecordReplication,
   shouldReplaceLocalWithRemoteRecord,
   shouldReplicateLocalRecord
-} from "./chunk-Z6KQDSZW.js";
+} from "./chunk-43OFVLWJ.js";
 import {
   fetchFromClientDb,
   fetchFromServer,
@@ -270,7 +270,7 @@ var readAction = async (payload, thunkApi) => {
       authorityServer: preferredServerOrigin ?? authority.authorityServer,
       serverOrigin: authority.serverOrigin
     });
-    const { preferredServer, fallbackServers, orderedServersForLocalHit } = partitionReadServers({
+    let { preferredServer, fallbackServers, orderedServersForLocalHit } = partitionReadServers({
       allServers: authorityPlannedServers,
       preferredServerOrigin: preferredServerOrigin ?? authority.authorityServer
     });
@@ -290,7 +290,17 @@ var readAction = async (payload, thunkApi) => {
         );
       }
     }
-    if (authorityPlannedServers.length === 0) {
+    let authoritativeServerOrigin = null;
+    if (typeof payload.authoritativeServerOrigin === "string") {
+      try {
+        const origin = new URL(payload.authoritativeServerOrigin.trim());
+        if ((origin.protocol === "https:" || origin.protocol === "http:") && origin.pathname === "/" && !origin.search && !origin.hash && !origin.username && !origin.password) {
+          authoritativeServerOrigin = origin.origin;
+        }
+      } catch {
+      }
+    }
+    if (authorityPlannedServers.length === 0 && (localData || !authoritativeServerOrigin)) {
       if (localData) {
         if (isDialogKey) {
           console.info("[readAction-perf] dialog offline-local-hit", {
@@ -342,6 +352,10 @@ var readAction = async (payload, thunkApi) => {
       }
       return normalizeReadRecord(dbKey, localData);
     }
+    if (authoritativeServerOrigin) {
+      preferredServer = authoritativeServerOrigin;
+      fallbackServers = [];
+    }
     if (preferredServer) {
       try {
         const preferredRemoteData = await fetchFromServer(

package/{chunk-SUKSWFLP.js → chunk-PIG2IUVZ.js}

@@ -4,7 +4,7 @@ import {
   resolvePlatformHostedCredentialProvider,
   resolvePlatformProxyChatGatewayEndpoint,
   resolvePlatformResponsesEndpoint
-} from "./chunk-I2RMFLLH.js";
+} from "./chunk-V7PCFWX3.js";
 import {
   CLI_PROVIDER_VALUES
 } from "./chunk-5BHQICF2.js";