nolo-cli 0.211.0 → 0.212.0-alpha.1

package/{chunk-ZOO3WJIE.js → chunk-FHU44LN3.js}

@@ -1,8 +1,3 @@
-import {
-  DEVIN_CONNECT_URL,
-  parseSseDataLineJson,
-  parseSseDataLineObject
-} from "./chunk-NTSRCTUX.js";
 import {
   applyChatCompletionDelta,
   applyResponsesToolEvent,
@@ -11,7 +6,12 @@ import {
   flushChatCompletionStream,
   providerHttpFailure,
   throwIfChatCompletionStreamFailed
-} from "./chunk-TCTSYFDM.js";
+} from "./chunk-4KH4J3G5.js";
+import {
+  DEVIN_CONNECT_URL,
+  parseSseDataLineJson,
+  parseSseDataLineObject
+} from "./chunk-CTPXME7U.js";
 import {
   readSseFrames
 } from "./chunk-HNUWUO75.js";
@@ -29,7 +29,7 @@ import {
 import {
   hasImageInRuntimeMessages,
   stripImagePartsFromMessages
-} from "./chunk-LNYHAKBP.js";
+} from "./chunk-W4S457LU.js";
 import {
   applyShapingCounts,
   attachProjectionFacts,
@@ -66,7 +66,7 @@ import {
   hashStablePrefixContent,
   resolveResponseGuidelines,
   resolveToolGuidedSections
-} from "./chunk-W5VC7F7V.js";
+} from "./chunk-NOMIGOST.js";
 import {
   classifyUnparsableToolArgs,
   collectStablePromptPrefix,
@@ -90,7 +90,7 @@ import {
   toOpenAiCompatibleMessages,
   toResponsesTools,
   transferDowngradedToolTurnOrigin
-} from "./chunk-CVCRAO6Q.js";
+} from "./chunk-UTV2AYEG.js";
 import {
   TOOL_HAD_IMAGES,
   TOOL_IMAGES,
@@ -111,7 +111,6 @@ import {
   DEFAULT_SUBTASK_MAX_TOOL_CALLS,
   DEFAULT_SUBTASK_MAX_WALL_CLOCK_MS,
   NOLO_WORKSPACE_TOOL_NAMES,
-  applyToolSurfaceConstraints,
   buildDialogReadEnvelope,
   buildNoloWorkspaceCommandArgs,
   buildNoloWorkspaceOpenAiTools,
@@ -123,7 +122,10 @@ import {
   parseNoloWorkspaceToolArguments,
   readTextStreamUpToChars,
   resolveNoloDialogInput
-} from "./chunk-6HVBI6TI.js";
+} from "./chunk-25JZEIXN.js";
+import {
+  applyToolSurfaceConstraints
+} from "./chunk-KC4XDTT3.js";
 import {
   clipToolText,
   resolveHistoricalToolContentCap,
@@ -132,7 +134,7 @@ import {
 import {
   resolveAgentImageInputSupport,
   resolveToolImagePolicy
-} from "./chunk-DA7CTWT4.js";
+} from "./chunk-YWSEPJ7C.js";
 import {
   buildDialogFallbackTitleFromUserInput
 } from "./chunk-2MBTWINN.js";
@@ -147,7 +149,7 @@ import {
   resolveEmptyAssistantFallbackMessage,
   resolveEmptyAssistantOutcome,
   resolveTruncatedReasoningTailLog
-} from "./chunk-WTKYP6QO.js";
+} from "./chunk-JTDORD5P.js";
 import {
   COMPACTION_SUMMARY_SCHEMA_VERSION,
   COMPACTION_SUMMARY_SYSTEM_PROMPT,
@@ -165,7 +167,7 @@ import {
   resolveCompressionTriggerRatio,
   sha256Hex,
   truncateToolOutputForContext
-} from "./chunk-BTYQAODF.js";
+} from "./chunk-CZM5YTZ7.js";
 import {
   createProviderCallTimingTracker,
   finalizeProviderCallTiming,
@@ -176,6 +178,9 @@ import {
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
+import {
+  assertCredentialRef
+} from "./chunk-OQHIVPG4.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -191,7 +196,7 @@ import {
 import {
   canonicalizeToolName,
   canonicalizeToolNames
-} from "./chunk-AKE53VMW.js";
+} from "./chunk-ZCWRMUWT.js";
 import {
   buildInteractiveCommandBlockedResult,
   buildProcessTaskResultCapsule,
@@ -214,26 +219,29 @@ import {
   spillToolOutput,
   toProcessTaskView,
   truncateToolOutput
-} from "./chunk-XPHZK3PJ.js";
+} from "./chunk-JNKSDZFS.js";
 import {
   estimateTokenCount
 } from "./chunk-PSCNXBYA.js";
-import {
-  resolveNoloStateDir
-} from "./chunk-6UBGXX2W.js";
 import {
   buildProviderAuthHeaders,
   buildProviderExecutionPlan
-} from "./chunk-PV6JJAUB.js";
+} from "./chunk-TCZHTTUU.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
+import {
+  resolveNoloStateDir
+} from "./chunk-6UBGXX2W.js";
 import {
   dialogMessageKey,
   dialogMessageRange
@@ -250,9 +258,6 @@ import {
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
-import {
-  asTrimmedLowercaseString
-} from "./chunk-QSJ3HFEF.js";
 import {
   __export
 } from "./chunk-4VNS5WPM.js";
@@ -13243,6 +13248,14 @@ var SECRET_PATTERNS = [
     placeholder: "[REDACTED:API_KEY]",
     regex: /\bsk-[a-zA-Z0-9_\-]{24,}\b/g
   },
+  // 3b. BigModel / 智谱（GLM）API Key：32 位 hex + "." + 16 位字母数字
+  //     （2026-11 实证：这类 key 没有任何可辨识前缀，此前漏在清洗与入路隔离之外，
+  //     用户贴进对话后明文直接进了 prompt / 历史 / 工具日志。）
+  {
+    kind: "BIGMODEL_KEY",
+    placeholder: "[REDACTED:BIGMODEL_KEY]",
+    regex: /\b[0-9a-fA-F]{32}\.[A-Za-z0-9]{16}\b/g
+  },
   // 4. GitHub 访问令牌 (ghp_..., gho_..., github_pat_...)
   {
     kind: "GITHUB_TOKEN",
@@ -13278,9 +13291,11 @@ var QUICK_PROBE_SUBSTRINGS = [
   "PASSWD",
   "SECRET_KEY"
 ];
+var UNPREFIXED_PROBE_REGEX = /\b[0-9a-fA-F]{32}\.[A-Za-z0-9]{16}\b/;
 function hasPotentialSecrets(text2) {
   if (typeof text2 !== "string" || text2.length === 0) return false;
-  return QUICK_PROBE_SUBSTRINGS.some((probe) => text2.includes(probe));
+  if (QUICK_PROBE_SUBSTRINGS.some((probe) => text2.includes(probe))) return true;
+  return UNPREFIXED_PROBE_REGEX.test(text2);
 }
 function scrubSecrets(text2) {
   if (typeof text2 !== "string" || text2.length === 0) {
@@ -14481,41 +14496,86 @@ function buildDestructiveShellBlockedError(reason, request3) {
   error.permissionRequest = request3;
   return error;
 }
+var KEY_SHAPED_VALUE = /(?:^|[\s"'=])(?:sk-ant-[A-Za-z0-9_\-]{20,}|sk-[A-Za-z0-9_\-]{24,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,}|[0-9a-fA-F]{32}\.[A-Za-z0-9]{16})(?=$|[\s"'])/;
+var CREDENTIAL_REF_IN_TEXT = /(?:vault-cred-[A-Za-z0-9]+|\$nolo_cred:)/;
+function inspectCommandCredentialUse(command) {
+  const text2 = typeof command === "string" ? command : "";
+  if (!text2) return { hasCredential: false, hasRawSecret: false };
+  const hasRef = CREDENTIAL_REF_IN_TEXT.test(text2);
+  const hasRawSecret = KEY_SHAPED_VALUE.test(text2);
+  return { hasCredential: hasRef || hasRawSecret, hasRawSecret };
+}
+function buildCredentialUsePermissionRequest(command) {
+  return {
+    id: "permission-shell-credential-use",
+    tool: "execShell",
+    action: "shell_command_credential_use",
+    title: "\u786E\u8BA4\u5728\u547D\u4EE4\u4E2D\u4F7F\u7528\u51ED\u636E",
+    body: "\u8BE5\u547D\u4EE4\u5F15\u7528\u4E86\u51ED\u636E\uFF08API key \u6216 vault \u5F15\u7528\uFF09\u3002\u786E\u8BA4\u540E\u7531\u672C\u673A\u53D7\u63A7\u901A\u9053\u53D6\u7528\uFF1B\u660E\u6587\u4E0D\u4F1A\u5199\u8FDB\u547D\u4EE4\u5386\u53F2\u6216\u8BB0\u5F55\u3002",
+    ...command ? { command } : {},
+    suggestedRule: {
+      scope: "once",
+      pattern: { capability: "credential_use", target: "shell_command" }
+    }
+  };
+}
+function buildCredentialUseBlockedError(reason, command) {
+  const error = buildDestructiveShellBlockedError(
+    reason,
+    buildCredentialUsePermissionRequest(command)
+  );
+  error.code = "credential_use_requires_confirmation";
+  return error;
+}
 async function evaluateExecShellDestructiveGuard(input, ctx) {
   const guardEnabled = ctx.enableDestructiveShellGuard !== false;
   if (!guardEnabled || ctx.confirmed) {
-    return;
+    return null;
   }
   const rawCommand = resolveShellCommandArg(
     typeof input === "object" && input !== null ? input : { command: input }
   );
   const extraInput = typeof input === "object" && input !== null ? input.input : void 0;
-  if (!isDestructiveShellCommand({ command: rawCommand, input: extraInput })) {
-    return;
-  }
+  const destructive = isDestructiveShellCommand({ command: rawCommand, input: extraInput });
   const displayCommand = toDisplayCommand(rawCommand);
-  const request3 = buildDestructiveShellPermissionRequest(displayCommand);
+  const credentialUse = inspectCommandCredentialUse(displayCommand).hasCredential || typeof extraInput === "string" && inspectCommandCredentialUse(extraInput).hasCredential;
+  if (!destructive && !credentialUse) {
+    return null;
+  }
+  const request3 = destructive ? buildDestructiveShellPermissionRequest(displayCommand) : buildCredentialUsePermissionRequest(displayCommand);
   if (!ctx.confirmDestructiveAction) {
+    if (credentialUse) {
+      throw buildCredentialUseBlockedError(
+        "shell command carrying credentials blocked: no confirmation channel available",
+        displayCommand
+      );
+    }
     if (ctx.blockDestructiveWithoutConfirmation) {
       throw buildDestructiveShellBlockedError(
         "destructive shell command blocked: no confirmation channel available",
         request3
       );
     }
-    return;
+    return null;
   }
-  const confirmed = await ctx.confirmDestructiveAction(request3);
-  if (!confirmed) {
+  const decision = await ctx.confirmDestructiveAction(request3);
+  const approved = typeof decision === "boolean" ? decision : decision?.approved === true;
+  if (!approved) {
     throw buildDestructiveShellBlockedError(
       "destructive shell command blocked: user declined confirmation",
       request3
     );
   }
+  if (typeof decision === "object" && decision?.hostResult) {
+    return decision.hostResult;
+  }
+  return null;
 }
 async function evaluateCapabilityPolicy(capability, normalizedInput, ctx) {
   if (capability.name === "execShell") {
-    await evaluateExecShellDestructiveGuard(normalizedInput, ctx);
+    return await evaluateExecShellDestructiveGuard(normalizedInput, ctx);
   }
+  return null;
 }
 
 // packages/agent-runtime/capabilities/execShellCapability.ts
@@ -14890,7 +14950,10 @@ async function invokeCapability(capabilityOrName, input, ctx = {}) {
   const binding = authority && capability.name === "execShell" ? execShellExecutionBinding(normalizedInput, ctx) : void 0;
   const signal = ctx.abortSignal;
   const confirm = ctx.confirmDestructiveAction;
-  await evaluateCapabilityPolicy(capability, normalizedInput, ctx);
+  const hostExecutedResult = await evaluateCapabilityPolicy(capability, normalizedInput, ctx);
+  if (hostExecutedResult) {
+    return hostExecutedResult;
+  }
   if (ctx.onInvoke) {
     await ctx.onInvoke(capability.name, normalizedInput);
   }
@@ -18290,7 +18353,10 @@ async function runExecShellGates(args2) {
       parsedInput = { command: parsedInput };
     }
   }
-  await evaluateExecShellDestructiveGuard(parsedInput, opts);
+  const hostExecutedResult = await evaluateExecShellDestructiveGuard(parsedInput, opts);
+  if (hostExecutedResult) {
+    return { kind: "handled", result: hostExecutedResult };
+  }
   opts.confirmed = true;
   return { kind: "pass", opts };
 }
@@ -18569,7 +18635,10 @@ async function executeToolCall(args2) {
           `${toolName} confirmation`
         );
         const gateResult = replacement?.metadata?.actionGateResult;
-        if (replacement !== void 0 && isCompletedActionGateResult(gateResult)) {
+        const hostExecuted = replacement?.metadata?.hostExecuted === true;
+        if (replacement !== void 0 && hostExecuted) {
+          toolResult = replacement;
+        } else if (replacement !== void 0 && isCompletedActionGateResult(gateResult)) {
           writeSession.approved = true;
         } else {
           toolResult = replacement ?? {
@@ -21287,7 +21356,193 @@ async function resolveOpenAiCompatibleProviderConfig(args2) {
   };
 }
 
+// packages/agent-runtime/macOsKeychainCredentialBroker.ts
+import { spawn as spawn2 } from "node:child_process";
+var MACOS_KEYCHAIN_SERVICE_PREFIX = "nolo.credentials.keys";
+var MACOS_KEYCHAIN_ACCOUNT = "api-key";
+var SECURITY_ITEM_NOT_FOUND_EXIT = 44;
+var DEFAULT_SECURITY_BIN = "/usr/bin/security";
+function safeCredentialRef(ref) {
+  try {
+    return assertCredentialRef(ref);
+  } catch {
+    throw new Error("invalid_ref");
+  }
+}
+function credentialRefToMacOsKeychainService(ref, servicePrefix = MACOS_KEYCHAIN_SERVICE_PREFIX) {
+  const safe = safeCredentialRef(ref);
+  const hex = Buffer.from(safe, "utf8").toString("hex");
+  if (!hex) {
+    throw new Error("invalid_ref");
+  }
+  return `${servicePrefix}.${hex}`;
+}
+function rethrowBrokerError(op, _error) {
+  throw new Error(`credential_broker_${op}_failed`);
+}
+function createDefaultSecurityRunner(securityBin = DEFAULT_SECURITY_BIN) {
+  return function defaultSecurityRunner(input) {
+    return new Promise((resolve6) => {
+      let settled = false;
+      const finish = (result4) => {
+        if (settled) return;
+        settled = true;
+        resolve6(result4);
+      };
+      let child;
+      try {
+        child = spawn2(securityBin, input.args, {
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      } catch {
+        finish({ exitCode: -1, stdout: "", stderr: "" });
+        return;
+      }
+      let stdout = "";
+      let stderr = "";
+      child.stdout?.setEncoding("utf8");
+      child.stderr?.setEncoding("utf8");
+      child.stdout?.on("data", (chunk) => {
+        stdout += chunk;
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderr += chunk;
+      });
+      child.on("error", () => {
+        finish({ exitCode: -1, stdout: "", stderr: "" });
+      });
+      child.on("close", (code) => {
+        finish({
+          exitCode: typeof code === "number" ? code : -1,
+          stdout,
+          stderr
+        });
+      });
+      if (input.stdin !== void 0) {
+        child.stdin?.write(input.stdin);
+      }
+      child.stdin?.end();
+    });
+  };
+}
+function createMacOsKeychainCredentialBroker(options = {}) {
+  const runner = options.runner ?? createDefaultSecurityRunner(options.securityBin);
+  const servicePrefix = options.servicePrefix ?? MACOS_KEYCHAIN_SERVICE_PREFIX;
+  const account = options.account ?? MACOS_KEYCHAIN_ACCOUNT;
+  const serviceFor = (ref) => credentialRefToMacOsKeychainService(ref, servicePrefix);
+  return {
+    async get(ref) {
+      const safeRef = safeCredentialRef(ref);
+      const service4 = serviceFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "find-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4,
+            "-w"
+          ]
+        });
+      } catch (error) {
+        rethrowBrokerError("get", error);
+      }
+      if (result4.exitCode === SECURITY_ITEM_NOT_FOUND_EXIT) {
+        return null;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError("get");
+      }
+      const secret = result4.stdout.replace(/\n$/, "");
+      return secret.length > 0 ? secret : null;
+    },
+    async put(ref, secret) {
+      const safeRef = safeCredentialRef(ref);
+      const value = asTrimmedString(secret);
+      if (!value) {
+        throw new Error("Cannot store an empty credential secret.");
+      }
+      const service4 = serviceFor(safeRef);
+      const stdin = `${value}
+${value}
+`;
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "add-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4,
+            "-U",
+            "-w"
+          ],
+          stdin
+        });
+      } catch (error) {
+        rethrowBrokerError("put", error);
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError("put");
+      }
+    },
+    async delete(ref) {
+      const safeRef = safeCredentialRef(ref);
+      const service4 = serviceFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "delete-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4
+          ]
+        });
+      } catch (error) {
+        rethrowBrokerError("delete", error);
+      }
+      if (result4.exitCode === 0 || result4.exitCode === SECURITY_ITEM_NOT_FOUND_EXIT) {
+        return;
+      }
+      rethrowBrokerError("delete");
+    },
+    async has(ref) {
+      const safeRef = safeCredentialRef(ref);
+      const service4 = serviceFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "find-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4
+          ]
+        });
+      } catch (error) {
+        rethrowBrokerError("has", error);
+      }
+      if (result4.exitCode === SECURITY_ITEM_NOT_FOUND_EXIT) {
+        return false;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError("has");
+      }
+      return true;
+    }
+  };
+}
+
 // packages/agent-runtime/windowsCredentialManagerBroker.ts
+import { spawn as spawn3 } from "node:child_process";
+var WINDOWS_CREDENTIAL_TARGET_PREFIX = "nolo.credentials.keys";
+var WIN_ERROR_NOT_FOUND = 1168;
 var WINDOWS_CREDENTIAL_MANAGER_SCRIPT = `
 $ErrorActionPreference = 'Stop'
 try {
@@ -21410,6 +21665,419 @@ public class NoloCredNative {
   exit 1
 }
 `.trim();
+function safeCredentialRef2(ref) {
+  try {
+    return assertCredentialRef(ref);
+  } catch {
+    throw new Error("invalid_ref");
+  }
+}
+function credentialRefToWindowsCredentialTarget(ref, targetPrefix = WINDOWS_CREDENTIAL_TARGET_PREFIX) {
+  const safe = safeCredentialRef2(ref);
+  const hex = Buffer.from(safe, "utf8").toString("hex");
+  if (!hex) {
+    throw new Error("invalid_ref");
+  }
+  return `${targetPrefix}.${hex}`;
+}
+function rethrowBrokerError2(op, _error) {
+  throw new Error(`credential_broker_${op}_failed`);
+}
+function buildWindowsCredentialPowerShellArgs(script = WINDOWS_CREDENTIAL_MANAGER_SCRIPT) {
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  return [
+    "-NoProfile",
+    "-NonInteractive",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-EncodedCommand",
+    encoded
+  ];
+}
+function requestStdin(payload) {
+  return JSON.stringify(payload);
+}
+function parseGetSecretFromStdout(stdout) {
+  const trimmed = asTrimmedString(stdout);
+  if (!trimmed) {
+    rethrowBrokerError2("get");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    rethrowBrokerError2("get");
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || typeof parsed.secret !== "string") {
+    rethrowBrokerError2("get");
+  }
+  return parsed.secret;
+}
+function spawnShell(bin, args2, stdin) {
+  return new Promise((resolve6) => {
+    let settled = false;
+    const finish = (result4) => {
+      if (settled) return;
+      settled = true;
+      resolve6(result4);
+    };
+    let child;
+    try {
+      child = spawn3(bin, args2, {
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+    } catch {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", () => {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+    });
+    child.on("close", (code) => {
+      finish({
+        exitCode: typeof code === "number" ? code : -1,
+        stdout,
+        stderr
+      });
+    });
+    if (stdin !== void 0) {
+      child.stdin?.write(stdin);
+    }
+    child.stdin?.end();
+  });
+}
+function createDefaultWindowsCredentialRunner(shellBin) {
+  let resolvedBin = shellBin ?? null;
+  return async function defaultWindowsCredentialRunner(input) {
+    if (resolvedBin) {
+      return spawnShell(resolvedBin, input.args, input.stdin);
+    }
+    const first = await spawnShell("powershell.exe", input.args, input.stdin);
+    if (first.exitCode !== -1) {
+      resolvedBin = "powershell.exe";
+      return first;
+    }
+    const second = await spawnShell("pwsh", input.args, input.stdin);
+    if (second.exitCode !== -1) {
+      resolvedBin = "pwsh";
+    }
+    return second;
+  };
+}
+function createWindowsCredentialManagerBroker(options = {}) {
+  const runner = options.runner ?? createDefaultWindowsCredentialRunner(options.shellBin);
+  const targetPrefix = options.targetPrefix ?? WINDOWS_CREDENTIAL_TARGET_PREFIX;
+  const targetFor = (ref) => credentialRefToWindowsCredentialTarget(ref, targetPrefix);
+  const staticArgs = buildWindowsCredentialPowerShellArgs();
+  return {
+    async get(ref) {
+      const safeRef = safeCredentialRef2(ref);
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "get", target })
+        });
+      } catch (error) {
+        rethrowBrokerError2("get", error);
+      }
+      if (result4.exitCode === WIN_ERROR_NOT_FOUND) {
+        return null;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError2("get");
+      }
+      const secret = parseGetSecretFromStdout(result4.stdout);
+      return secret.length > 0 ? secret : null;
+    },
+    async put(ref, secret) {
+      const safeRef = safeCredentialRef2(ref);
+      const value = asTrimmedString(secret);
+      if (!value) {
+        throw new Error("Cannot store an empty credential secret.");
+      }
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "put", target, secret: value })
+        });
+      } catch (error) {
+        rethrowBrokerError2("put", error);
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError2("put");
+      }
+    },
+    async delete(ref) {
+      const safeRef = safeCredentialRef2(ref);
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "delete", target })
+        });
+      } catch (error) {
+        rethrowBrokerError2("delete", error);
+      }
+      if (result4.exitCode === 0 || result4.exitCode === WIN_ERROR_NOT_FOUND) {
+        return;
+      }
+      rethrowBrokerError2("delete");
+    },
+    async has(ref) {
+      const safeRef = safeCredentialRef2(ref);
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "has", target })
+        });
+      } catch (error) {
+        rethrowBrokerError2("has", error);
+      }
+      if (result4.exitCode === WIN_ERROR_NOT_FOUND) {
+        return false;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError2("has");
+      }
+      return true;
+    }
+  };
+}
+
+// packages/agent-runtime/linuxSecretServiceCredentialBroker.ts
+import { spawn as spawn4 } from "node:child_process";
+var LINUX_SECRET_SERVICE_ATTRIBUTE = "nolo-credential";
+var SECRET_TOOL_NO_MATCH_EXIT = 1;
+var DEFAULT_SECRET_TOOL_BIN = "secret-tool";
+function safeCredentialRef3(ref) {
+  try {
+    return assertCredentialRef(ref);
+  } catch {
+    throw new Error("invalid_ref");
+  }
+}
+function brokerFailure(op) {
+  throw new Error(`credential_broker_${op}_failed`);
+}
+function createDefaultSecretToolRunner(secretToolBin = DEFAULT_SECRET_TOOL_BIN) {
+  return (input) => new Promise((resolve6) => {
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (result4) => {
+      if (settled) return;
+      settled = true;
+      resolve6(result4);
+    };
+    let child;
+    try {
+      child = spawn4(secretToolBin, input.args, {
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    } catch {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+      return;
+    }
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", () => {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+    });
+    child.on("close", (code) => {
+      finish({
+        exitCode: typeof code === "number" ? code : -1,
+        stdout,
+        stderr
+      });
+    });
+    if (input.stdin !== void 0) {
+      child.stdin?.write(input.stdin);
+    }
+    child.stdin?.end();
+  });
+}
+function createLinuxSecretServiceCredentialBroker(options = {}) {
+  const runner = options.runner ?? createDefaultSecretToolRunner(options.secretToolBin);
+  const attribute = options.attribute ?? LINUX_SECRET_SERVICE_ATTRIBUTE;
+  const attrArgs = (ref) => [attribute, ref];
+  const lookup3 = async (ref) => {
+    try {
+      return await runner({ args: ["lookup", ...attrArgs(ref)] });
+    } catch {
+      brokerFailure("get");
+    }
+  };
+  return {
+    async get(ref) {
+      const safeRef = safeCredentialRef3(ref);
+      const result4 = await lookup3(safeRef);
+      if (result4.exitCode === SECRET_TOOL_NO_MATCH_EXIT) return null;
+      if (result4.exitCode !== 0) brokerFailure("get");
+      const secret = result4.stdout.replace(/\n$/, "");
+      return secret.length > 0 ? secret : null;
+    },
+    async put(ref, secret) {
+      const safeRef = safeCredentialRef3(ref);
+      const value = asTrimmedString(secret);
+      if (!value) {
+        throw new Error("Cannot store an empty credential secret.");
+      }
+      const args2 = [
+        "store",
+        `--label=nolo-credential:${safeRef}`,
+        ...attrArgs(safeRef)
+      ];
+      if (value.includes("\n") || args2.some((arg) => arg.includes(value))) {
+        brokerFailure("put");
+      }
+      let result4;
+      try {
+        result4 = await runner({ args: args2, stdin: value });
+      } catch {
+        brokerFailure("put");
+      }
+      if (result4.exitCode !== 0) brokerFailure("put");
+    },
+    async delete(ref) {
+      const safeRef = safeCredentialRef3(ref);
+      let result4;
+      try {
+        result4 = await runner({ args: ["clear", ...attrArgs(safeRef)] });
+      } catch {
+        brokerFailure("delete");
+      }
+      if (result4.exitCode === 0 || result4.exitCode === SECRET_TOOL_NO_MATCH_EXIT) {
+        return;
+      }
+      brokerFailure("delete");
+    },
+    async has(ref) {
+      const safeRef = safeCredentialRef3(ref);
+      const result4 = await lookup3(safeRef);
+      if (result4.exitCode === SECRET_TOOL_NO_MATCH_EXIT) return false;
+      if (result4.exitCode !== 0) brokerFailure("has");
+      return true;
+    }
+  };
+}
+
+// packages/agent-runtime/desktopHostCredentialBroker.ts
+function createClosedCredentialBroker(code = "credential_store_unavailable") {
+  const fail9 = () => {
+    throw new Error(code);
+  };
+  return {
+    get: fail9,
+    put: fail9,
+    delete: fail9,
+    has: () => false
+  };
+}
+function createHostCredentialBrokerChain(args2) {
+  const { strict, session, legacy, notifySessionFallback, notifyLegacyHit } = args2;
+  const legacyNoticed = /* @__PURE__ */ new Set();
+  let sessionNotified = false;
+  const noticeSession = () => {
+    if (sessionNotified || !notifySessionFallback) return;
+    sessionNotified = true;
+    try {
+      notifySessionFallback();
+    } catch {
+    }
+  };
+  return {
+    async get(ref) {
+      try {
+        const strictValue = await strict.get(ref);
+        if (strictValue !== null && strictValue !== void 0) return strictValue;
+      } catch {
+      }
+      const sessionValue = await session.get(ref);
+      if (sessionValue !== null && sessionValue !== void 0) return sessionValue;
+      if (!legacy) return null;
+      const legacyValue = await legacy.get(ref);
+      if (legacyValue !== null && legacyValue !== void 0) {
+        if (notifyLegacyHit && !legacyNoticed.has(ref)) {
+          legacyNoticed.add(ref);
+          try {
+            notifyLegacyHit(ref);
+          } catch {
+          }
+        }
+        return legacyValue;
+      }
+      return null;
+    },
+    async put(ref, secret) {
+      try {
+        await strict.put(ref, secret);
+        if (await strict.has(ref)) return;
+      } catch {
+      }
+      await session.put(ref, secret);
+      noticeSession();
+    },
+    async delete(ref) {
+      try {
+        await strict.delete(ref);
+      } catch {
+      }
+      try {
+        await session.delete(ref);
+      } catch {
+      }
+      if (legacy) await legacy.delete(ref);
+    },
+    async has(ref) {
+      try {
+        if (await strict.has(ref)) return true;
+      } catch {
+      }
+      if (await session.has(ref)) return true;
+      return legacy ? await legacy.has(ref) : false;
+    }
+  };
+}
+function createStrictHostCredentialBroker(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const override = String(env.NOLO_DESKTOP_CREDENTIAL_STORE ?? "").trim().toLowerCase();
+  if (override === "file") {
+    return createClosedCredentialBroker("credential_store_file_not_allowed");
+  }
+  if (platform === "darwin" || override === "keychain") {
+    return options.keychainBroker ?? (options.createKeychainBroker ?? (() => createMacOsKeychainCredentialBroker()))();
+  }
+  if (platform === "win32" || override === "credman") {
+    return options.windowsCredentialBroker ?? (options.createWindowsCredentialBroker ?? (() => createWindowsCredentialManagerBroker()))();
+  }
+  if (platform === "linux" || override === "secret-service") {
+    return options.linuxSecretServiceBroker ?? (options.createLinuxSecretServiceBroker ?? (() => createLinuxSecretServiceCredentialBroker()))();
+  }
+  return createClosedCredentialBroker("credential_store_unsupported");
+}
 
 // packages/agent-runtime/dialogMessageRecord.ts
 function dialogMessageRecordToAgentRuntimeMessage(record2) {
@@ -21861,11 +22529,11 @@ async function readNoloProcessStream(readable) {
 async function runNoloWorkspaceCliTool(call, args2) {
   const cliArgs = buildNoloWorkspaceCommandArgs(call);
   const bunSpawn = globalThis.Bun?.spawn;
-  const spawn2 = args2.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
+  const spawn5 = args2.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
   const execPath = args2.processExecPath ?? process.execPath;
   const entrypoint = args2.cliEntrypoint;
   const cmd = entrypoint && entrypoint !== execPath ? [execPath, entrypoint, ...cliArgs] : [execPath, ...cliArgs];
-  const proc = spawn2({
+  const proc = spawn5({
     cmd,
     stdout: "pipe",
     stderr: "pipe",
@@ -21980,7 +22648,7 @@ function buildLoadSkillExecutor(args2) {
     const { resolveSkillByName } = await import("./skillDiscovery-XKHROSH2.js");
     const resolved = resolveSkillByName(args2.cwd, name);
     if (!resolved) {
-      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-HH75G5J3.js");
+      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-3YOIGEF6.js");
       const builtin = resolveBuiltinSkillByName(name);
       if (builtin) {
         return {
@@ -22039,7 +22707,7 @@ async function loadPreciseSkill(cwd, parsed) {
     if (!nonEmpty(parsed.slug) || has2("projectBinding") || has2("relativePath")) {
       return reject("builtin requires only an exact slug.");
     }
-    const { listBuiltinSkills } = await import("./builtinSkillRegistry-HH75G5J3.js");
+    const { listBuiltinSkills } = await import("./builtinSkillRegistry-3YOIGEF6.js");
     const builtin = listBuiltinSkills().find((entry) => entry.slug === parsed.slug);
     if (!builtin) return reject("builtin slug not found.");
     return {
@@ -22742,12 +23410,15 @@ function verifyOwnerRouteAck(headers, expectedRequestId) {
 }
 
 export {
+  createHostCredentialBrokerChain,
+  createStrictHostCredentialBroker,
   readCommandActionGatePayload,
   readActionGate,
   Option_exports,
   Duration_exports,
   Exit_exports,
   Effect_exports,
+  scrubSecrets,
   isDestructiveShellCommand,
   evaluateShellCommandPolicy,
   filterRetainedLedgerRecords,