nolo-cli 0.156.0-alpha.3 → 0.156.0

package/{chunk-L6EQV5OC.js → chunk-QXZH5UDF.js}

@@ -27,11 +27,11 @@ import {
   stablePromptCacheKey,
   toOpenAiCompatibleMessages,
   toResponsesTools
-} from "./chunk-6TF64IF2.js";
+} from "./chunk-4L4K6YR7.js";
 import {
   isMeaningfulChatCompletionOutput,
   isMeaningfulResponsesOutput
-} from "./chunk-2MTE2PEH.js";
+} from "./chunk-QA2C5NKI.js";
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
@@ -44,7 +44,7 @@ import {
   resolvePlatformAuthToken,
   resolvePlatformServerUrl,
   resolveProviderTransportDecision
-} from "./chunk-SUKSWFLP.js";
+} from "./chunk-PIG2IUVZ.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";

package/{chunk-TNIX77YM.js → chunk-R5GO3YZP.js}

@@ -34,6 +34,10 @@ function canonicalizeNoloServerUrl(value) {
 }
 
 // packages/cli/client/profileConfig.ts
+var PERMISSION_GRANT_KINDS = ["local", "remote"];
+function permissionGrantList(grants) {
+  return PERMISSION_GRANT_KINDS.filter((kind) => grants?.[kind] === true);
+}
 var normalizeProfileServerUrl = canonicalizeNoloServerUrl;
 function isProtectedHomeProfileWrite(path) {
   if (process.env.NODE_ENV !== "test") return false;
@@ -129,7 +133,11 @@ function buildEnvFromProfile(config) {
     ...getProfileTokens(config)[0] ? { AUTH_TOKEN: getProfileTokens(config)[0] } : {},
     ...profile.agentKey ? { NOLO_AGENT: profile.agentKey } : {},
     ...profile.agentName ? { NOLO_AGENT_NAME: profile.agentName } : {},
-    ...profile.locale ? { NOLO_LANG: profile.locale } : {}
+    ...profile.locale ? { NOLO_LANG: profile.locale } : {},
+    ...(() => {
+      const granted = permissionGrantList(profile.permissionGrants);
+      return granted.length > 0 ? { NOLO_PERMISSION_GRANTS: granted.join(",") } : {};
+    })()
   };
 }
 function buildCliRuntimeEnv(processEnv, config) {
@@ -164,6 +172,28 @@ function saveProfileLocale(locale, path = getDefaultProfileConfigPath()) {
 `, "utf8");
   return config;
 }
+function saveProfilePermissionGrant(kind, value, path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return null;
+  const config = loadProfileConfig(path);
+  if (!config) return null;
+  const profile = config.profiles[config.currentProfile];
+  if (!profile) return null;
+  const grants = { ...profile.permissionGrants ?? {} };
+  if (value === true) {
+    grants[kind] = true;
+  } else {
+    delete grants[kind];
+  }
+  if (permissionGrantList(grants).length > 0) {
+    profile.permissionGrants = grants;
+  } else {
+    delete profile.permissionGrants;
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+  return config;
+}
 function getAgentSelectionAuditPath(configPath = getDefaultProfileConfigPath()) {
   return join(dirname(configPath), "agent-selection.log");
 }
@@ -308,6 +338,8 @@ function saveProfileOAuthSync(provider, sync, path = getDefaultProfileConfigPath
 }
 
 export {
+  PERMISSION_GRANT_KINDS,
+  permissionGrantList,
   normalizeProfileServerUrl,
   isProtectedHomeProfileWrite,
   getDefaultProfileConfigPath,
@@ -320,6 +352,7 @@ export {
   buildCliRuntimeEnv,
   getCurrentProfile,
   saveProfileLocale,
+  saveProfilePermissionGrant,
   getAgentSelectionAuditPath,
   redactArgvSecrets,
   appendAgentSelectionAudit,

package/{chunk-4Z245KOA.js → chunk-SH3XD4E2.js}

@@ -6,11 +6,11 @@ import {
   buildBuiltinObjectSkillDbKey,
   buildBuiltinObjectSkillPageContent,
   buildCodeWorkDiscipline
-} from "./chunk-JZX2XLKC.js";
+} from "./chunk-YCRROBDY.js";
 import {
   buildSkillDocMarkdown,
   resolvePageSkillMetadata
-} from "./chunk-XETG4RIX.js";
+} from "./chunk-AETZ7AD6.js";
 import {
   nolotusId
 } from "./chunk-Y6ORVLSS.js";
@@ -1295,7 +1295,7 @@ var SECRETS_MANAGER_SKILL_DEFINITIONS = {
 1. **\u7EDD\u5BF9\u5B58\u50A8\u8DEF\u5F84**\uFF1A\`$NOLO_HOME/credentials/secrets.json\`\uFF08\u672A\u8BBE \`NOLO_HOME\` \u65F6\u56DE\u843D \`~/.nolo/credentials/secrets.json\`\uFF09\uFF0C\u6743\u9650\u4E25\u683C\u9501\u5B9A\u4E3A \`0600\`\uFF0C\u7236\u76EE\u5F55 \`0700\`\u3002
 2. **\u7981\u6B62\u56DE\u663E\u539F\u5219**\uFF1A
    - Agent \u65E0\u8BBA\u5728\u4EFB\u4F55\u60C5\u51B5\u4E0B\uFF0C**\u7EDD\u4E0D\u5728\u5BF9\u8BDD\u6D88\u606F\u3001\u65E5\u5FD7\u6216\u62A5\u544A\u4E2D\u6253\u5370\u4EFB\u4F55\u5BC6\u94A5\u660E\u6587**\uFF1B
-   - \u67E5\u770B\u5DF2\u4FDD\u5B58\u7684\u51ED\u636E\u4E00\u5F8B\u4F7F\u7528 \`nolo secret list\`\uFF08\u4EC5\u8F93\u51FA\u51ED\u636E\u540D\u79F0\uFF0C\u4E0D\u8F93\u51FA\u5185\u5BB9\uFF09\uFF1B
+   - \u67E5\u770B\u5DF2\u4FDD\u5B58\u7684\u51ED\u636E\u4E00\u5F8B\u4F7F\u7528 \`nolo secret list\`\uFF08\u4EBA\u7C7B\u53EF\u8BFB\uFF09\u6216 \`nolo secret list --json\`\uFF08\u673A\u5668\u53EF\u8BFB\uFF0C\u4EC5\u8F93\u51FA\u51ED\u636E\u540D\u79F0\u4E0E\u5F62\u6001\uFF0C\u4E0D\u8F93\u51FA\u5185\u5BB9\uFF09\uFF1B
    - Agent **\u4E0D\u5F97**\u6267\u884C \`nolo secret get\`\uFF08\u8BE5\u5B50\u547D\u4EE4\u53EA\u4F9B\u4EBA\u7C7B\u8C03\u8BD5\uFF09\uFF0C\u53EA\u5141\u8BB8 \`nolo secret run --with\`\u3002
 3. **\u7528\u6237\u6388\u6743\u95E8\u7981**\uFF1A
    - \u53EA\u6709\u5F53\u7528\u6237\u5728\u5BF9\u8BDD\u4E2D\u660E\u786E\u63D0\u5230\u201C\u5141\u8BB8\u83B7\u53D6 / \u4F7F\u7528\u672C\u5730\u4FDD\u5B58\u7684 xxx \u51ED\u636E\u201D\u65F6\uFF0CAgent \u624D\u88AB\u6388\u6743\u8C03\u7528\u8BE5\u51ED\u636E\uFF1B\u672A\u83B7\u7528\u6237\u660E\u786E\u6307\u793A\u65F6\uFF0C\u4E0D\u5F97\u8BFB\u53D6\u6216\u6CE8\u5165\u3002
@@ -1305,6 +1305,8 @@ var SECRETS_MANAGER_SKILL_DEFINITIONS = {
 \`\`\`bash
 # 1. \u67E5\u770B\u5DF2\u6709\u79D8\u5BC6\uFF08\u5B89\u5168\uFF0C\u4EC5\u8F93\u51FA\u540D\u79F0\u5217\u8868\uFF0C\u7EDD\u4E0D\u6253\u5370\u5BC6\u94A5\u503C\uFF09
 nolo secret list
+# \u673A\u5668\u53EF\u8BFB\u7248\uFF08\u4EC5\u540D\u79F0\u4E0E\u5F62\u6001\uFF0Cagent \u7528\u5B83\u6765\u53D1\u73B0"\u6211\u4EEC\u6709\u6CA1\u6709\u76F8\u5173\u51ED\u636E"\uFF09
+nolo secret list --json
 
 # 2. \u8BBE\u7F6E\u6216\u66F4\u65B0\u51ED\u636E\uFF08\u652F\u6301\u5B57\u7B26\u4E32\u6216 JSON \u5BF9\u8C61\uFF09
 nolo secret set amo '{"issuer":"user:<account-id>:<key-id>","secret":"<key>"}'
@@ -1338,7 +1340,9 @@ function buildSecretsManagerSkillConfig(slug) {
     id: buildSecretsManagerSkillId(slug),
     name: seed.title,
     description: seed.description,
-    triggerMode: "manual"
+    // 合法枚举是 explicit / required / recommended；"manual" 会被
+    // normalizeSkillEnumValue 静默丢弃，导致 front-matter 的 triggerMode 为空。
+    triggerMode: "explicit"
   };
 }
 function buildSecretsManagerSkillContentBySlug(slug) {

package/{chunk-MM3662RS.js → chunk-SNAWGDXT.js}

@@ -2,13 +2,13 @@ import {
   isAgentRunTerminalStatus,
   normalizeRunTitle
 } from "./chunk-PJNFNEJE.js";
-import {
-  resolvePlatformAuthToken
-} from "./chunk-SUKSWFLP.js";
 import {
   isCompiledBinary,
   resolveCliEntrypointPath
 } from "./chunk-A7GB5UGH.js";
+import {
+  resolvePlatformAuthToken
+} from "./chunk-PIG2IUVZ.js";
 
 // packages/cli/client/originShellApprovalTransport.ts
 import { realpathSync } from "node:fs";
@@ -324,6 +324,233 @@ import { dirname, isAbsolute as isAbsolute2, join, resolve } from "node:path";
 import * as nodeFs from "node:fs";
 import { execFileSync as nodeExecFileSync, spawn as nodeSpawn } from "node:child_process";
 
+// packages/cli/client/hostMemory.ts
+import { readFileSync, existsSync } from "node:fs";
+import { freemem as osFreemem, totalmem as osTotalmem } from "node:os";
+var PROC_MEMINFO_PATH = "/proc/meminfo";
+var PROC_MOUNTS_PATH = "/proc/mounts";
+var DEFAULT_CGROUP2_MOUNT = "/sys/fs/cgroup";
+var SANDBOX_MARKER_PATHS = ["/.dockerenv", "/run/.containerenv"];
+var PROC_SELF_CGROUP_PATH = "/proc/self/cgroup";
+var SANDBOX_CGROUP_PATTERN = /(docker|kubepods|instabox|containerd)/;
+var MEMORY_AVAILABLE_RATIO_THRESHOLD = 0.15;
+var SWAP_USED_RATIO_THRESHOLD = 0.7;
+var HOST_MEMORY_PRESSURE_HINT = "\u26A0 \u5185\u5B58\u504F\u7D27\uFF0C\u5EFA\u8BAE\u91CD\u6D3B\u653E\u6C99\u76D2/\u8FDC\u7AEF\u6216\u51CF\u5C11\u5E76\u53D1";
+var BYTES_PER_MB = 1024 * 1024;
+function toMbFromBytes(bytes) {
+  return Math.round(bytes / BYTES_PER_MB);
+}
+function kbToMb(kb) {
+  return Math.round(kb / 1024);
+}
+function tryReadText(deps, path) {
+  try {
+    const reader = deps.readFile ?? ((p) => readFileSync(p, "utf8"));
+    const text = reader(path);
+    return typeof text === "string" ? text : null;
+  } catch {
+    return null;
+  }
+}
+function tryExists(deps, path) {
+  try {
+    const checker = deps.exists ?? ((p) => existsSync(p));
+    return checker(path) === true;
+  } catch {
+    return false;
+  }
+}
+function readKbValue(text, key) {
+  const match = new RegExp(`^${key}:\\s*(\\d+)`, "m").exec(text);
+  if (!match) return null;
+  const value = Number.parseInt(match[1], 10);
+  return Number.isFinite(value) ? value : null;
+}
+function parseProcMeminfo(text) {
+  if (typeof text !== "string" || text.length === 0) return null;
+  const totalKb = readKbValue(text, "MemTotal");
+  const availableKb = readKbValue(text, "MemAvailable");
+  if (totalKb === null || availableKb === null) return null;
+  if (!(totalKb > 0)) return null;
+  const swapTotalKb = readKbValue(text, "SwapTotal") ?? 0;
+  const swapFreeKb = readKbValue(text, "SwapFree") ?? 0;
+  return {
+    source: "proc-meminfo",
+    totalMb: kbToMb(totalKb),
+    availableMb: kbToMb(Math.max(0, availableKb)),
+    swapTotalMb: kbToMb(Math.max(0, swapTotalKb)),
+    swapUsedMb: kbToMb(Math.max(0, swapTotalKb - swapFreeKb)),
+    hostAvailableMb: null
+  };
+}
+function detectSandbox(deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "linux") return false;
+  for (const marker of SANDBOX_MARKER_PATHS) {
+    if (tryExists(deps, marker)) return true;
+  }
+  const selfCgroup = tryReadText(deps, PROC_SELF_CGROUP_PATH);
+  return selfCgroup !== null && SANDBOX_CGROUP_PATTERN.test(selfCgroup);
+}
+function readOsView(deps) {
+  const os = deps.os ?? { totalmem: osTotalmem, freemem: osFreemem };
+  try {
+    const totalMb = toMbFromBytes(os.totalmem());
+    const availableMb = toMbFromBytes(os.freemem());
+    if (!(totalMb > 0) || !Number.isFinite(availableMb)) return null;
+    return {
+      source: "os",
+      totalMb,
+      availableMb: Math.max(0, availableMb),
+      // os 没有可移植的 swap 口径：按契约显示 n/a，而不是编一个数字。
+      swapTotalMb: null,
+      swapUsedMb: null,
+      hostAvailableMb: null
+    };
+  } catch {
+    return null;
+  }
+}
+function readHostView(deps) {
+  const platform = deps.platform ?? process.platform;
+  if (platform === "linux") {
+    const text = tryReadText(deps, PROC_MEMINFO_PATH);
+    if (text !== null) {
+      const parsed = parseProcMeminfo(text);
+      if (parsed) return parsed;
+    }
+  }
+  return readOsView(deps);
+}
+function parseCgroup2RelativePath(text) {
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const parts = trimmed.split(":");
+    if (parts.length < 3 || parts[0] !== "0" || parts[1] !== "") continue;
+    const path = parts.slice(2).join(":").trim();
+    if (!path) continue;
+    return path.startsWith("/") ? path : `/${path}`;
+  }
+  return null;
+}
+function parseCgroup2MountPoint(mountsText) {
+  for (const line of mountsText.split("\n")) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 3) continue;
+    if (fields[2] !== "cgroup2") continue;
+    const mountPoint = fields[1].replace(/\\040/g, " ");
+    if (mountPoint.startsWith("/")) return mountPoint;
+  }
+  return null;
+}
+function cgroupAncestorDirs(mountPoint, relativePath) {
+  const base = mountPoint.length > 1 && mountPoint.endsWith("/") ? mountPoint.slice(0, -1) : mountPoint;
+  const dirs = [];
+  if (relativePath && relativePath !== "/") {
+    const rel = relativePath.startsWith("/") ? relativePath : `/${relativePath}`;
+    const segments = rel.split("/").filter(Boolean);
+    for (let depth = segments.length; depth >= 1; depth -= 1) {
+      dirs.push(`${base}/${segments.slice(0, depth).join("/")}`);
+    }
+  }
+  dirs.push(base);
+  return dirs;
+}
+function readCgroupMaxMb(deps, dir) {
+  const maxText = tryReadText(deps, `${dir}/memory.max`);
+  if (maxText === null) return null;
+  const maxRaw = maxText.trim();
+  if (maxRaw === "" || maxRaw === "max") return null;
+  const maxBytes = Number.parseInt(maxRaw, 10);
+  if (!Number.isFinite(maxBytes) || maxBytes <= 0) return null;
+  const totalMb = toMbFromBytes(maxBytes);
+  return totalMb > 0 ? totalMb : null;
+}
+function buildCgroupSnapshot(deps, dir, totalMb, hostView) {
+  const currentText = tryReadText(deps, `${dir}/memory.current`);
+  let usedMb = null;
+  if (currentText !== null) {
+    const currentBytes = Number.parseInt(currentText.trim(), 10);
+    if (Number.isFinite(currentBytes)) {
+      usedMb = Math.min(totalMb, Math.max(0, toMbFromBytes(currentBytes)));
+    }
+  }
+  return {
+    source: "cgroup",
+    totalMb,
+    availableMb: usedMb === null ? null : Math.max(0, totalMb - usedMb),
+    // swap 不是 cgroup 配额的一部分，只能借宿主视角（Linux 上就是 /proc/meminfo）。
+    swapTotalMb: hostView?.swapTotalMb ?? null,
+    swapUsedMb: hostView?.swapUsedMb ?? null,
+    hostAvailableMb: hostView?.availableMb ?? null
+  };
+}
+function readCgroupLimitView(deps, hostView) {
+  const selfCgroupText = tryReadText(deps, PROC_SELF_CGROUP_PATH) ?? "";
+  const relativePath = parseCgroup2RelativePath(selfCgroupText);
+  const mountsText = tryReadText(deps, PROC_MOUNTS_PATH) ?? "";
+  const mountPoint = parseCgroup2MountPoint(mountsText) ?? DEFAULT_CGROUP2_MOUNT;
+  let limitingDir = null;
+  let limitingMb = Number.POSITIVE_INFINITY;
+  for (const dir of cgroupAncestorDirs(mountPoint, relativePath)) {
+    const totalMb = readCgroupMaxMb(deps, dir);
+    if (totalMb === null) continue;
+    if (totalMb < limitingMb) {
+      limitingMb = totalMb;
+      limitingDir = dir;
+    }
+  }
+  if (limitingDir === null) return null;
+  return buildCgroupSnapshot(deps, limitingDir, limitingMb, hostView);
+}
+function readHostMemory(deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "linux") {
+    return readHostView(deps);
+  }
+  const hostView = readHostView(deps);
+  const cgroupView = readCgroupLimitView(deps, hostView);
+  if (!cgroupView) return hostView;
+  return {
+    ...cgroupView,
+    scope: detectSandbox(deps) ? "sandbox" : "cgroup-limit"
+  };
+}
+function isHostMemoryTight(mem) {
+  if (!(mem.totalMb > 0)) return false;
+  if (mem.availableMb !== null && mem.availableMb / mem.totalMb < MEMORY_AVAILABLE_RATIO_THRESHOLD) {
+    return true;
+  }
+  if (mem.swapTotalMb !== null && mem.swapUsedMb !== null && mem.swapTotalMb > 0 && mem.swapUsedMb / mem.swapTotalMb > SWAP_USED_RATIO_THRESHOLD) {
+    return true;
+  }
+  return false;
+}
+function formatHostMemoryMb(mb) {
+  const value = Math.max(0, Math.round(Number.isFinite(mb) ? mb : 0));
+  if (value >= 1024) return `${(value / 1024).toFixed(1)}G`;
+  return `${value}M`;
+}
+function formatSwapPart(mem) {
+  if (mem.swapTotalMb === null || mem.swapUsedMb === null) return "swap n/a";
+  return `swap ${formatHostMemoryMb(mem.swapUsedMb)}/${formatHostMemoryMb(mem.swapTotalMb)}`;
+}
+function formatHostMemoryLine(mem) {
+  const usedMb = mem.availableMb === null ? null : Math.max(0, mem.totalMb - mem.availableMb);
+  let line;
+  if (mem.source === "cgroup") {
+    const hostAvailable = mem.hostAvailableMb === null ? "n/a" : formatHostMemoryMb(mem.hostAvailableMb);
+    const prefix = (mem.scope ?? "sandbox") === "cgroup-limit" ? "[\u9650\u989D] \u672C\u8FDB\u7A0B\u5185\u5B58" : "[sandbox] \u5BB9\u5668\u5185\u5B58";
+    const usage = usedMb === null ? "\u5360\u7528\u672A\u77E5" : formatHostMemoryMb(usedMb);
+    line = `${prefix} ${usage}/${formatHostMemoryMb(mem.totalMb)} \xB7 \u5BBF\u4E3B\u53EF\u7528 ${hostAvailable}`;
+  } else {
+    const available = mem.availableMb === null ? "n/a" : formatHostMemoryMb(mem.availableMb);
+    line = `\u672C\u5730\u5185\u5B58 ${formatHostMemoryMb(usedMb ?? 0)}/${formatHostMemoryMb(mem.totalMb)}\uFF08\u53EF\u7528 ${available}\uFF09\xB7 ${formatSwapPart(mem)}`;
+  }
+  return isHostMemoryTight(mem) ? `${line} \xB7 ${HOST_MEMORY_PRESSURE_HINT}` : line;
+}
+
 // packages/cli/client/localRuntimeHelpers.ts
 var REMOTE_DIALOG_SYNC_TIMEOUT_MS = 1e4;
 var remoteDialogSyncTimeoutMsForTest;
@@ -1183,6 +1410,29 @@ function buildAgentRunChildCommand(options, deps = {}) {
   }
   return { execPath, childArgs: [entrypoint, ...commandParts, ...strippedArgs] };
 }
+function safeReadHostMemory(reader) {
+  try {
+    return reader();
+  } catch {
+    return null;
+  }
+}
+function emitHostMemoryNotice(mem, output) {
+  if (!mem || !output) return void 0;
+  let notice;
+  try {
+    notice = formatHostMemoryLine(mem);
+  } catch {
+    return void 0;
+  }
+  try {
+    output.write(`${notice}
+`);
+  } catch {
+    return notice;
+  }
+  return notice;
+}
 async function spawnLocalBackgroundRun(input, deps = {}) {
   const env = deps.env ?? process.env;
   const homedir = deps.homedir ?? nodeHomedir;
@@ -1266,6 +1516,7 @@ async function spawnLocalBackgroundRun(input, deps = {}) {
     NOLO_AGENT_RUN_CHILD: "1",
     NOLO_AGENT_RUN_ID: runId
   };
+  const hostMemory = safeReadHostMemory(deps.readHostMemory ?? readHostMemory);
   const logFd = fs.openSync(logPath, "a");
   const proc = spawn(execPath, childArgs, {
     cwd: input.cwd,
@@ -1283,6 +1534,7 @@ async function spawnLocalBackgroundRun(input, deps = {}) {
     proc.channel?.unref?.();
   }
   proc.unref();
+  const hostMemoryNotice = emitHostMemoryNotice(hostMemory, input.output);
   if (typeof proc.pid === "number") {
     const processStartedAt = (deps.getProcessStartTime ?? defaultGetProcessStartTime)(proc.pid);
     withRunRecordLock(runId, deps, () => {
@@ -1292,7 +1544,14 @@ async function spawnLocalBackgroundRun(input, deps = {}) {
       writeRunRecord(latest, deps);
     });
   }
-  return { runId, pid: proc.pid, logPath, queuePath, batchId };
+  return {
+    runId,
+    pid: proc.pid,
+    logPath,
+    queuePath,
+    batchId,
+    ...hostMemoryNotice ? { hostMemoryNotice } : {}
+  };
 }
 function ackRunRecord(runId, deps = {}) {
   withRunRecordLock(runId, deps, () => {

package/{chunk-JGRPBIZZ.js → chunk-SQX235S2.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WWC7I6TA.js";
 import {
   trimTrailingSlash
-} from "./chunk-SUKSWFLP.js";
+} from "./chunk-PIG2IUVZ.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";

package/chunk-TT644UJD.js

@@ -0,0 +1,188 @@
+import {
+  shouldUseServerProxy
+} from "./chunk-F3SOW2EU.js";
+import {
+  ANTIGRAVITY_CLOUD_CODE_BASE_URL,
+  isAntigravityCloudCodeBaseUrl,
+  isAntigravityOAuthAgent
+} from "./chunk-SQX235S2.js";
+import {
+  isOpenAiResponsesModel,
+  resolvePlatformChatCompletionsEndpoint,
+  resolvePlatformResponsesEndpoint
+} from "./chunk-V7PCFWX3.js";
+import {
+  findModelConfig
+} from "./chunk-6EQD4AQL.js";
+import {
+  asOptionalTrimmedString
+} from "./chunk-G3SUCT4W.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
+
+// packages/agent-runtime/agentCallPlan.ts
+var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
+var CURSOR_AGENT_URL = "https://api2.cursor.sh/agent.v1.AgentService/Run";
+var DEVIN_CONNECT_URL = "https://server.codeium.com/exa.api_server_pb.ApiServerService/GetChatMessage";
+function resolveClientWire(plan) {
+  if (plan.upstreamWire === "gemini-cca") return "chat.completions";
+  if (plan.upstreamWire === "anthropic-messages") return "chat.completions";
+  if (plan.upstreamWire === "cursor-connect") return "chat.completions";
+  if (plan.upstreamWire === "devin-connect") return "chat.completions";
+  if (plan.upstreamWire === "custom-gemini") return "chat.completions";
+  if (plan.upstreamWire === "custom-openai-responses") return "chat.completions";
+  if (plan.upstreamWire === "custom-anthropic-messages") return "chat.completions";
+  if (plan.upstreamWire === "responses" && plan.authMethod.kind === "oauth" && plan.authMethod.ref === "chatgpt") {
+    return "chat.completions";
+  }
+  return plan.upstreamWire;
+}
+var XAI_CHAT_COMPLETIONS_URL = "https://api.x.ai/v1/chat/completions";
+var ANTHROPIC_MESSAGES_URL = "https://api.anthropic.com/v1/messages";
+var CODEX_REQUIRED_HEADERS = [
+  "chatgpt-account-id",
+  "OpenAI-Beta",
+  "originator",
+  "version"
+];
+var ANTIGRAVITY_REQUIRED_HEADERS = [
+  "User-Agent"
+  // antigravity-specific UA (matches getAntigravityUserAgent)
+];
+function agentShouldUseServerProxy(agentConfig) {
+  return shouldUseServerProxy(agentConfig);
+}
+function resolveCustomUpstreamWire(endpoint, nativeProtocol) {
+  const responsesEndpoint = endpoint.includes("/responses");
+  if (nativeProtocol === "openai-responses" && responsesEndpoint) return "responses";
+  if (nativeProtocol === "gemini") return "custom-gemini";
+  if (nativeProtocol === "openai-responses") return "custom-openai-responses";
+  if (nativeProtocol === "anthropic-messages") return "custom-anthropic-messages";
+  return responsesEndpoint ? "responses" : "chat.completions";
+}
+function hasOwnCustomProviderKey(agentConfig) {
+  const endpoint = asOptionalTrimmedString(agentConfig.customProviderUrl);
+  if (!endpoint) return false;
+  if (isAntigravityCloudCodeBaseUrl(endpoint)) return false;
+  return Boolean(asOptionalTrimmedString(agentConfig.apiKey));
+}
+function resolveAgentCallPlan(agentConfig, _env) {
+  const apiKeyRef = asTrimmedLowercaseString(agentConfig.apiKeyRef);
+  const provider = asTrimmedLowercaseString(
+    agentConfig.provider ?? agentConfig.apiSource
+  );
+  const ownCustomKeyWins = hasOwnCustomProviderKey(agentConfig);
+  const oauthApiKeyRef = ownCustomKeyWins ? "" : apiKeyRef;
+  if (!ownCustomKeyWins && isAntigravityOAuthAgent(agentConfig)) {
+    return {
+      authMethod: { kind: "oauth", ref: "antigravity" },
+      transport: "server-proxy",
+      upstreamWire: "gemini-cca",
+      endpoint: ANTIGRAVITY_CLOUD_CODE_BASE_URL,
+      requiredHeaders: [...ANTIGRAVITY_REQUIRED_HEADERS],
+      vendor: provider || "google-antigravity"
+    };
+  }
+  if (oauthApiKeyRef === "chatgpt") {
+    return {
+      authMethod: { kind: "oauth", ref: "chatgpt" },
+      transport: "server-proxy",
+      upstreamWire: "responses",
+      endpoint: CODEX_RESPONSES_URL,
+      requiredHeaders: [...CODEX_REQUIRED_HEADERS],
+      vendor: provider || "openai"
+    };
+  }
+  if (oauthApiKeyRef === "claude") {
+    return {
+      authMethod: { kind: "oauth", ref: "claude" },
+      transport: "server-proxy",
+      upstreamWire: "anthropic-messages",
+      endpoint: ANTHROPIC_MESSAGES_URL,
+      requiredHeaders: ["anthropic-version", "anthropic-beta"],
+      vendor: provider || "anthropic"
+    };
+  }
+  if (oauthApiKeyRef === "xai") {
+    return {
+      authMethod: { kind: "oauth", ref: "xai" },
+      transport: "server-proxy",
+      upstreamWire: "chat.completions",
+      endpoint: XAI_CHAT_COMPLETIONS_URL,
+      requiredHeaders: [],
+      vendor: provider || "xai"
+    };
+  }
+  if (oauthApiKeyRef === "cursor") {
+    return {
+      authMethod: { kind: "oauth", ref: "cursor" },
+      transport: "server-proxy",
+      upstreamWire: "cursor-connect",
+      endpoint: CURSOR_AGENT_URL,
+      requiredHeaders: [
+        "x-cursor-client-version",
+        "x-cursor-client-type",
+        "x-ghost-mode"
+      ],
+      vendor: provider || "cursor"
+    };
+  }
+  if (oauthApiKeyRef === "devin" || !ownCustomKeyWins && provider === "devin") {
+    return {
+      authMethod: { kind: "oauth", ref: "devin" },
+      transport: "server-proxy",
+      upstreamWire: "devin-connect",
+      endpoint: DEVIN_CONNECT_URL,
+      requiredHeaders: ["connect-protocol-version"],
+      vendor: provider || "devin"
+    };
+  }
+  if (agentConfig.cliProvider || agentConfig.apiSource === "cli" || provider === "cli") {
+    return {
+      authMethod: { kind: "cli", provider: agentConfig.cliProvider || provider || "codex" },
+      transport: "direct",
+      upstreamWire: "cli",
+      endpoint: "",
+      requiredHeaders: [],
+      vendor: provider || "cli"
+    };
+  }
+  if (agentConfig.customProviderUrl || agentConfig.apiSource === "custom") {
+    const transport2 = agentShouldUseServerProxy(agentConfig) ? "server-proxy" : "direct";
+    const endpoint2 = asOptionalTrimmedString(agentConfig.customProviderUrl) ?? "";
+    const upstreamWire2 = resolveCustomUpstreamWire(
+      endpoint2,
+      findModelConfig(provider, agentConfig.model ?? "")?.nativeProtocol
+    );
+    return {
+      authMethod: { kind: "custom-key" },
+      transport: transport2,
+      upstreamWire: upstreamWire2,
+      endpoint: endpoint2,
+      requiredHeaders: [],
+      vendor: provider || "custom"
+    };
+  }
+  const transport = agentShouldUseServerProxy(agentConfig) ? "server-proxy" : "direct";
+  const useResponses = isOpenAiResponsesModel({
+    provider,
+    model: agentConfig.model,
+    endpointKey: agentConfig.endpointKey
+  });
+  const upstreamWire = useResponses ? "responses" : "chat.completions";
+  const endpoint = upstreamWire === "responses" ? resolvePlatformResponsesEndpoint(provider, agentConfig.model) ?? "" : resolvePlatformChatCompletionsEndpoint(provider, agentConfig.model) ?? "";
+  return {
+    authMethod: { kind: "platform-key" },
+    transport,
+    upstreamWire,
+    endpoint,
+    requiredHeaders: [],
+    vendor: provider || "openai"
+  };
+}
+
+export {
+  resolveClientWire,
+  resolveAgentCallPlan
+};