nolo-cli 0.157.0-alpha.1 → 0.158.0-alpha.1

package/{chunk-ZWG3C7VI.js → chunk-C6FY7HWI.js}

@@ -1,4 +1,8 @@
 import {
+  isDevinOAuthAgent
+} from "./chunk-5ZUL4CUO.js";
+import {
+  getModelContextWindow,
   normalizeTimingMs
 } from "./chunk-2MTE2PEH.js";
 import {
@@ -25,6 +29,35 @@ import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
 
+// packages/agent-runtime/devin/devinChannelWindows.ts
+var DEVIN_CHANNEL_CONTEXT_WINDOWS = {
+  // SWE-2 家族（catalog 无裸 swe-2 selector；旧点号/裸写法如 swe-2、
+  // swe-1.7 实测均 permission_denied，已不是可用 selector）。
+  "swe-2-max": 262e3,
+  "swe-2-high": 262e3,
+  "swe-2-medium": 262e3,
+  // SWE-1.7 家族。
+  "swe-1-7": 262e3,
+  "swe-1-7-medium": 262e3,
+  "swe-1-7-lightning": 202752,
+  // SWE-1.6 家族（免费档默认）。
+  "swe-1-6": 2e5,
+  "swe-1-6-fast": 2e5,
+  // 经 devin 通道转售、且与厂商原生窗口不同的模型（catalog 枚举型 selector）。
+  "MODEL_GPT_5_2_LOW": 384e3,
+  "MODEL_GPT_5_2_MEDIUM": 384e3,
+  "MODEL_GPT_5_2_HIGH": 384e3,
+  "MODEL_GPT_5_2_XHIGH": 384e3
+};
+var devinChannelContextWindow = (model) => {
+  const raw = model?.trim();
+  if (!raw) return void 0;
+  return DEVIN_CHANNEL_CONTEXT_WINDOWS[raw];
+};
+var resolveAgentContextWindow = (agent) => (isDevinOAuthAgent(agent) ? devinChannelContextWindow(agent.model) : void 0) ?? // provider 透传给全局解析：平台托管通道（CF）与 Codex OAuth 等通道对同一 id
+// 窗口不同，按通道取真值，不做全局取大/取小。
+getModelContextWindow(agent.model ?? "", agent.provider);
+
 // packages/agent-runtime/autoExecutionProfiles.ts
 var createProfile = (input) => ({
   id: input.id,
@@ -346,6 +379,8 @@ export {
   resolveAutoExecutionProfile,
   readCacheReadInputTokens,
   readCacheCreationInputTokens,
+  devinChannelContextWindow,
+  resolveAgentContextWindow,
   normalizeUsage,
   asOptionalJsonRecord,
   extractReferenceKeysFromMessage,

package/{chunk-RUNKPFM5.js → chunk-CDWHHLK5.js}

@@ -5,24 +5,24 @@ import {
   normalizePolicyLevelSetting,
   normalizeSystemBuiltinSkills,
   normalizeTonePresetSetting
-} from "./chunk-HXHSTRGH.js";
+} from "./chunk-VYNMQ6HW.js";
 import {
   fetchAndCacheTableRows
-} from "./chunk-VAZHH6FO.js";
+} from "./chunk-VDEVDGEM.js";
 import {
   require_react
 } from "./chunk-YDH3FDFQ.js";
 import {
   createAsyncThunk,
   createSelector
-} from "./chunk-7BSQK2UC.js";
+} from "./chunk-WRCZXJ4N.js";
 import {
   selectIdentityUserId
-} from "./chunk-SEJ5OS6F.js";
+} from "./chunk-PXYBUFDB.js";
 import {
   resolveBuiltinCapability,
   resolveBuiltinSkillEntry
-} from "./chunk-4Z245KOA.js";
+} from "./chunk-DC3SZCRR.js";
 import {
   DEFAULT_SYSTEM_AGENT_CAPABILITIES
 } from "./chunk-EUGTFFO6.js";
@@ -287,7 +287,11 @@ var MODES = [
 var DEFAULT_RECOMMENDED_SKILL_SLUGS = [
   "worktree-isolation",
   "systematic-investigation",
-  "show-me"
+  "show-me",
+  // 凭据管理：仓库已有 nolo secret（set/list/run/bind），但技能发现只扫
+  // `.agents/skills`，内置的 secrets-manager 不会出现在"可用技能"里。放进默认
+  // 提示名单让它至少以一行提示出现（不授工具、不放宽权限）。
+  "secrets-manager"
 ];
 var asMode = (value) => typeof value === "string" && MODES.includes(value) ? value : null;
 var resolveAgentSkillConfig = (source) => {
@@ -517,7 +521,7 @@ var executeToolRun = createAsyncThunk(
     if (!executionInput) {
       throw new Error(`ToolRun ${id} has no input to execute with.`);
     }
-    const { findToolExecutor } = await import("./tools-IWNXKK4Y.js");
+    const { findToolExecutor } = await import("./tools-RMT7NAMC.js");
     const { executor } = findToolExecutor(run.toolName);
     toolRunStarted({
       id: run.id,
@@ -541,7 +545,7 @@ var executeToolRun = createAsyncThunk(
         const latestState = thunkApi.getState();
         const userId = selectIdentityUserId(latestState);
         if (userId) {
-          const { fetchUserSpaceMemberships } = await import("./memberThunks-KRV5YXOB.js");
+          const { fetchUserSpaceMemberships } = await import("./memberThunks-2DWKLE6W.js");
           await thunkApi.dispatch(fetchUserSpaceMemberships(userId));
         }
       }

package/{chunk-ROPSATAB.js → chunk-CON6SI7N.js}

@@ -7,7 +7,7 @@ import {
 import {
   patch,
   selectById
-} from "./chunk-HP6O6LTV.js";
+} from "./chunk-ZVQHBIWV.js";
 
 // packages/chat/dialog/actions/setDialogExtraReferencesAction.ts
 var setDialogExtraReferencesAction = async (extraReferences, thunkApi) => {

package/{chunk-4Z245KOA.js → chunk-DC3SZCRR.js}

@@ -1295,7 +1295,7 @@ var SECRETS_MANAGER_SKILL_DEFINITIONS = {
 1. **\u7EDD\u5BF9\u5B58\u50A8\u8DEF\u5F84**\uFF1A\`$NOLO_HOME/credentials/secrets.json\`\uFF08\u672A\u8BBE \`NOLO_HOME\` \u65F6\u56DE\u843D \`~/.nolo/credentials/secrets.json\`\uFF09\uFF0C\u6743\u9650\u4E25\u683C\u9501\u5B9A\u4E3A \`0600\`\uFF0C\u7236\u76EE\u5F55 \`0700\`\u3002
 2. **\u7981\u6B62\u56DE\u663E\u539F\u5219**\uFF1A
    - Agent \u65E0\u8BBA\u5728\u4EFB\u4F55\u60C5\u51B5\u4E0B\uFF0C**\u7EDD\u4E0D\u5728\u5BF9\u8BDD\u6D88\u606F\u3001\u65E5\u5FD7\u6216\u62A5\u544A\u4E2D\u6253\u5370\u4EFB\u4F55\u5BC6\u94A5\u660E\u6587**\uFF1B
-   - \u67E5\u770B\u5DF2\u4FDD\u5B58\u7684\u51ED\u636E\u4E00\u5F8B\u4F7F\u7528 \`nolo secret list\`\uFF08\u4EC5\u8F93\u51FA\u51ED\u636E\u540D\u79F0\uFF0C\u4E0D\u8F93\u51FA\u5185\u5BB9\uFF09\uFF1B
+   - \u67E5\u770B\u5DF2\u4FDD\u5B58\u7684\u51ED\u636E\u4E00\u5F8B\u4F7F\u7528 \`nolo secret list\`\uFF08\u4EBA\u7C7B\u53EF\u8BFB\uFF09\u6216 \`nolo secret list --json\`\uFF08\u673A\u5668\u53EF\u8BFB\uFF0C\u4EC5\u8F93\u51FA\u51ED\u636E\u540D\u79F0\u4E0E\u5F62\u6001\uFF0C\u4E0D\u8F93\u51FA\u5185\u5BB9\uFF09\uFF1B
    - Agent **\u4E0D\u5F97**\u6267\u884C \`nolo secret get\`\uFF08\u8BE5\u5B50\u547D\u4EE4\u53EA\u4F9B\u4EBA\u7C7B\u8C03\u8BD5\uFF09\uFF0C\u53EA\u5141\u8BB8 \`nolo secret run --with\`\u3002
 3. **\u7528\u6237\u6388\u6743\u95E8\u7981**\uFF1A
    - \u53EA\u6709\u5F53\u7528\u6237\u5728\u5BF9\u8BDD\u4E2D\u660E\u786E\u63D0\u5230\u201C\u5141\u8BB8\u83B7\u53D6 / \u4F7F\u7528\u672C\u5730\u4FDD\u5B58\u7684 xxx \u51ED\u636E\u201D\u65F6\uFF0CAgent \u624D\u88AB\u6388\u6743\u8C03\u7528\u8BE5\u51ED\u636E\uFF1B\u672A\u83B7\u7528\u6237\u660E\u786E\u6307\u793A\u65F6\uFF0C\u4E0D\u5F97\u8BFB\u53D6\u6216\u6CE8\u5165\u3002
@@ -1305,6 +1305,8 @@ var SECRETS_MANAGER_SKILL_DEFINITIONS = {
 \`\`\`bash
 # 1. \u67E5\u770B\u5DF2\u6709\u79D8\u5BC6\uFF08\u5B89\u5168\uFF0C\u4EC5\u8F93\u51FA\u540D\u79F0\u5217\u8868\uFF0C\u7EDD\u4E0D\u6253\u5370\u5BC6\u94A5\u503C\uFF09
 nolo secret list
+# \u673A\u5668\u53EF\u8BFB\u7248\uFF08\u4EC5\u540D\u79F0\u4E0E\u5F62\u6001\uFF0Cagent \u7528\u5B83\u6765\u53D1\u73B0"\u6211\u4EEC\u6709\u6CA1\u6709\u76F8\u5173\u51ED\u636E"\uFF09
+nolo secret list --json
 
 # 2. \u8BBE\u7F6E\u6216\u66F4\u65B0\u51ED\u636E\uFF08\u652F\u6301\u5B57\u7B26\u4E32\u6216 JSON \u5BF9\u8C61\uFF09
 nolo secret set amo '{"issuer":"user:<account-id>:<key-id>","secret":"<key>"}'
@@ -1338,7 +1340,9 @@ function buildSecretsManagerSkillConfig(slug) {
     id: buildSecretsManagerSkillId(slug),
     name: seed.title,
     description: seed.description,
-    triggerMode: "manual"
+    // 合法枚举是 explicit / required / recommended；"manual" 会被
+    // normalizeSkillEnumValue 静默丢弃，导致 front-matter 的 triggerMode 为空。
+    triggerMode: "explicit"
   };
 }
 function buildSecretsManagerSkillContentBySlug(slug) {

package/{chunk-OH2M7WEU.js → chunk-EQGFFDNA.js}

@@ -7,7 +7,7 @@ import {
 import {
   patch,
   readAndWait
-} from "./chunk-HP6O6LTV.js";
+} from "./chunk-ZVQHBIWV.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -333,7 +333,7 @@ async function saveDocState(arg, { dispatch, getState }) {
     ).unwrap();
     if (dbSpaceId) {
       try {
-        const { updateContentTitle } = await import("./contentThunks-B3FRQGP7.js");
+        const { updateContentTitle } = await import("./contentThunks-DYQO4CTI.js");
         await dispatch(
           updateContentTitle({
             spaceId: dbSpaceId,
@@ -372,7 +372,7 @@ async function saveDocState(arg, { dispatch, getState }) {
   }
 }
 async function createDocState(args, thunkApi) {
-  const { createPageAction } = await import("./createPageAction-LDAVZDN7.js");
+  const { createPageAction } = await import("./createPageAction-PDACOLI6.js");
   return createPageAction(args, thunkApi);
 }
 function subscribe(listener) {

package/{chunk-ANJTRG52.js → chunk-G2WP7VPD.js}

@@ -1,12 +1,6 @@
-import {
-  isDevinOAuthAgent
-} from "./chunk-5ZUL4CUO.js";
 import {
   resolveAgentImageInputSupport
 } from "./chunk-IYBIRCQV.js";
-import {
-  getModelContextWindow
-} from "./chunk-2MTE2PEH.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
@@ -55,35 +49,6 @@ async function stripImagePartsForTextOnlyAgent(messages, agentConfig) {
   return { messages: !supportsVision && hasImages ? stripImagePartsFromMessages(messages) : messages };
 }
 
-// packages/agent-runtime/devin/devinChannelWindows.ts
-var DEVIN_CHANNEL_CONTEXT_WINDOWS = {
-  // SWE-2 家族（catalog 无裸 swe-2 selector；旧点号/裸写法如 swe-2、
-  // swe-1.7 实测均 permission_denied，已不是可用 selector）。
-  "swe-2-max": 262e3,
-  "swe-2-high": 262e3,
-  "swe-2-medium": 262e3,
-  // SWE-1.7 家族。
-  "swe-1-7": 262e3,
-  "swe-1-7-medium": 262e3,
-  "swe-1-7-lightning": 202752,
-  // SWE-1.6 家族（免费档默认）。
-  "swe-1-6": 2e5,
-  "swe-1-6-fast": 2e5,
-  // 经 devin 通道转售、且与厂商原生窗口不同的模型（catalog 枚举型 selector）。
-  "MODEL_GPT_5_2_LOW": 384e3,
-  "MODEL_GPT_5_2_MEDIUM": 384e3,
-  "MODEL_GPT_5_2_HIGH": 384e3,
-  "MODEL_GPT_5_2_XHIGH": 384e3
-};
-var devinChannelContextWindow = (model) => {
-  const raw = model?.trim();
-  if (!raw) return void 0;
-  return DEVIN_CHANNEL_CONTEXT_WINDOWS[raw];
-};
-var resolveAgentContextWindow = (agent) => (isDevinOAuthAgent(agent) ? devinChannelContextWindow(agent.model) : void 0) ?? // provider 透传给全局解析：平台托管通道（CF）与 Codex OAuth 等通道对同一 id
-// 窗口不同，按通道取真值，不做全局取大/取小。
-getModelContextWindow(agent.model ?? "", agent.provider);
-
 // packages/agent-runtime/agentRecordConfig.ts
 function stringField(record, key) {
   const value = record[key];
@@ -452,8 +417,6 @@ export {
   hasImageInRuntimeMessages,
   stripImagePartsFromMessages,
   stripImagePartsForTextOnlyAgent,
-  devinChannelContextWindow,
-  resolveAgentContextWindow,
   resolveAgentRuntimeConfigFromRecord,
   buildDesktopAgentRuntimeAgentConfigSnapshot,
   buildDesktopAgentRuntimeDialogHistorySnapshot,

package/{chunk-7A4LJCDR.js → chunk-G476FQ7Q.js}

@@ -1,12 +1,12 @@
 import {
   addContentToSpace
-} from "./chunk-VAZHH6FO.js";
+} from "./chunk-VDEVDGEM.js";
 import {
   format,
   prepareAndPersistMessage,
   uiAskChoiceFunc,
   uiAskChoiceFunctionSchema
-} from "./chunk-H4KACZMG.js";
+} from "./chunk-WTFRBJT5.js";
 import {
   formatISO
 } from "./chunk-ZRAU6T47.js";
@@ -16,13 +16,13 @@ import {
   removeCachedEntity,
   upsertSSREntity,
   write
-} from "./chunk-HP6O6LTV.js";
+} from "./chunk-ZVQHBIWV.js";
 import {
   isDevelopment
 } from "./chunk-6Q7UTJKR.js";
 import {
   selectIdentityUserId
-} from "./chunk-SEJ5OS6F.js";
+} from "./chunk-PXYBUFDB.js";
 import {
   buildBuiltinObjectSkillReference
 } from "./chunk-JZX2XLKC.js";

package/{chunk-DW7MGLMG.js → chunk-GAVUTXM5.js}

@@ -1,32 +1,32 @@
-import {
-  buildResponseGuidelines
-} from "./chunk-W4S6OTSC.js";
 import {
   getLocalProviderSecret
 } from "./chunk-HS7MLR74.js";
 import {
   performServerProxyFetchWithRetry
-} from "./chunk-VSOWPETY.js";
+} from "./chunk-2BKUVRC5.js";
 import {
   shouldUseServerProxy
 } from "./chunk-UKZX3NHN.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-X5SUT4CN.js";
+} from "./chunk-4UOEOHY3.js";
 import {
   buildSkillGuidancePromptBlock
-} from "./chunk-4Z245KOA.js";
+} from "./chunk-DC3SZCRR.js";
 import {
+  CREDENTIAL_HYGIENE_RULE,
   DELETE_SAFETY_RED_LINE,
+  DISPATCH_BACKEND_POLICY,
   PARALLEL_DISPATCH_DEFAULT_RULE,
   PLATFORM_RISK_CONTROL_RULE,
   buildConsultationModeBlock,
   buildIdentityBlock,
+  buildResponseGuidelines,
   buildRuntimeGuidanceBlocks,
   compileContextLayers,
   detectDispatchIntentFromMessages,
   resolveToolGuidedSections
-} from "./chunk-TYND6RDQ.js";
+} from "./chunk-LV4LV2B4.js";
 import {
   convertMessagesToResponsesInput,
   getUsageRequestOptions,
@@ -216,16 +216,6 @@ function resolveAgentCallPlan(agentConfig, _env) {
       vendor: provider || "anthropic"
     };
   }
-  if (oauthApiKeyRef === "workbuddy" || oauthApiKeyRef === "workbuddy-ai") {
-    return {
-      authMethod: { kind: "oauth", ref: oauthApiKeyRef },
-      transport: "server-proxy",
-      upstreamWire: "chat.completions",
-      endpoint: oauthApiKeyRef === "workbuddy" ? "https://copilot.tencent.com/v2/chat/completions" : "https://www.workbuddy.ai/v2/chat/completions",
-      requiredHeaders: [],
-      vendor: oauthApiKeyRef
-    };
-  }
   if (oauthApiKeyRef === "xai") {
     return {
       authMethod: { kind: "oauth", ref: "xai" },
@@ -455,6 +445,13 @@ ${wrapHistoricalSummaryWithReplayGuard(contexts.dialogSummary)}` : "";
       cacheScope: "static",
       content: DELETE_SAFETY_RED_LINE
     },
+    // 凭据纪律：与红线同为无条件系统层块，四条装配线同源。
+    {
+      id: "credential-hygiene",
+      owner: "platform",
+      cacheScope: "static",
+      content: CREDENTIAL_HYGIENE_RULE
+    },
     // 并行是默认：系统层固定块，紧随红线（同为无条件前缀，不随工具/轮次变化）。
     {
       id: "parallel-dispatch-default",
@@ -462,6 +459,13 @@ ${wrapHistoricalSummaryWithReplayGuard(contexts.dialogSummary)}` : "";
       cacheScope: "static",
       content: PARALLEL_DISPATCH_DEFAULT_RULE
     },
+    // 派发落点：并行派发纪律的下一层（派到哪个执行后端），紧随并行块。
+    {
+      id: "dispatch-backend-policy",
+      owner: "platform",
+      cacheScope: "static",
+      content: DISPATCH_BACKEND_POLICY
+    },
     // 平台风控纪律：无条件静态前缀，紧随并行派发块。
     {
       id: "platform-risk-control",

package/{chunk-PSJWPSKS.js → chunk-HB4XPBC7.js}

@@ -202,38 +202,6 @@ var MINIMAX_MODEL_OPTIONS = [
   { id: "MiniMax-M3", label: "MiniMax M3", hasVision: true }
 ];
 var SUBSCRIPTION_OAUTH_PROVIDERS = [
-  {
-    kind: "oauth",
-    id: "workbuddy",
-    label: "WorkBuddy",
-    description: "\u4F7F\u7528 WorkBuddy \u56FD\u5185\u8D26\u53F7\u53CA\u5176\u5957\u9910\u6743\u76CA\uFF1B\u53EF\u7528\u989D\u5EA6\u4E0E\u8D39\u7387\u53EF\u80FD\u968F\u6D3B\u52A8\u53D8\u5316\uFF0C\u5177\u4F53\u4EE5\u8D26\u53F7\u9875\u9762\u4E3A\u51C6\u3002",
-    apiKeyRef: "workbuddy",
-    provider: "workbuddy",
-    defaultModel: "auto",
-    modelOptions: [
-      { id: "auto", label: "Auto", recommended: true },
-      { id: "hy3", label: "Hy3" },
-      { id: "deepseek-v4.1-flash", label: "DeepSeek V4.1 Flash" },
-      { id: "glm-5.3", label: "GLM-5.3" },
-      { id: "kimi-k3-1", label: "Kimi K3" }
-    ]
-  },
-  {
-    kind: "oauth",
-    id: "workbuddy-ai",
-    label: "WorkBuddy AI",
-    description: "Use your WorkBuddy AI account and its package benefits. Available quota and rates may change with promotions; check your account for current details.",
-    apiKeyRef: "workbuddy-ai",
-    provider: "workbuddy-ai",
-    defaultModel: "default-model",
-    modelOptions: [
-      { id: "default-model", label: "Default", recommended: true },
-      { id: "fast-model", label: "Fast" },
-      { id: "balanced-model", label: "Balanced" },
-      { id: "gpt-5.5", label: "GPT-5.5" },
-      { id: "gemini-3.1-pro", label: "Gemini 3.1 Pro" }
-    ]
-  },
   {
     kind: "oauth",
     id: "chatgpt",

package/{chunk-6MJNEXUU.js → chunk-HGDKT2D6.js}

@@ -607,7 +607,11 @@ function createDockerToolChannel(runGrant, backend) {
 
 export {
   SANDBOX_WORKSPACE_ROOT,
+  SANDBOX_HELPER_PATH,
   buildSandboxHelperUploadArgv,
+  SANDBOX_OUTPUT_LIMITS,
+  buildWorkspaceHelperSource,
+  parseToolOutput,
   buildPrimaryExecutionTicket,
   dockerExecutionToolNames,
   createDockerToolChannel

package/{chunk-EM3YOZJ4.js → chunk-ICRRXBRN.js}

@@ -1,13 +1,13 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-G47IPDOK.js";
+} from "./chunk-QPY264HO.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-HKT6QXP3.js";
+} from "./chunk-ZEY4NJRE.js";
 import {
   deriveCredentialGroup
-} from "./chunk-KX6LPG7W.js";
+} from "./chunk-KLA62VVE.js";
 import {
   isTombstoneRecord
 } from "./chunk-D2MDMY2M.js";