nolo-cli 0.211.0 → 0.212.0-alpha.1

package/chunk-KC4XDTT3.js

@@ -0,0 +1,227 @@
+import {
+  canonicalizeToolName
+} from "./chunk-ZCWRMUWT.js";
+import {
+  isOwnedAgentKey
+} from "./chunk-M2EJHDJP.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedNonEmptyStringArray
+} from "./chunk-I42VC5KR.js";
+
+// packages/agent-runtime/runtimeToolSurface.ts
+var DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS = [
+  "listDialogs",
+  "readDialog",
+  "queryDialogsBySubjectRef",
+  "deleteDialogs",
+  "listAgents",
+  "readAgent",
+  "listSpaces",
+  "readSpace",
+  "readDoc",
+  "readSkillDoc",
+  "loadSkill",
+  "listTables",
+  "queryTableRows",
+  "cliWhoami",
+  "cliDoctor",
+  "list_cloud_resources",
+  "cloud_probe"
+  // cloud_exec 故意不在此清单：硬边界是「永不默认开 exec」。它只在 agent 显式启用时出现，
+  // 且只读 run 会被 HIGH_RISK_MUTATION_TOOL_NAMES 挡住（runtimeToolSurface.test.ts 钉住）。
+];
+var DEFAULT_SUBTASK_REFERENCE_NOLO_WORKSPACE_TOOLS = [
+  "readDialog",
+  "queryDialogsBySubjectRef",
+  "readDoc",
+  "queryTableRows"
+];
+var HIGH_RISK_MUTATION_TOOL_NAMES = [
+  "writeFile",
+  "editFile",
+  "deleteDialogs",
+  "deleteMemory",
+  "taskStop",
+  // 能力包（loadSkill 授予）里的写/删/部署/记忆写入/进程启动类工具：
+  // 只读 run 的授予通道会过同一份 blockedToolNames，名单缺项即可被绕过。
+  // 契约测试（runtimeToolSurface.test.ts）按名字关键字钉住 CAPABILITY_PACKS 的分类。
+  "applyEdit",
+  "applyLineEdits",
+  "launchProcess",
+  "rememberMemory",
+  "appFileWrite",
+  "appFileReplace",
+  "appDeploy",
+  "appDelete",
+  "createTable",
+  "addTableRow",
+  "addTableRows",
+  "updateTableRow",
+  "deleteTableRow",
+  // 媒体任务译文写回：改写 job 的 translate 产物（服务端零计费、无外部副作用），
+  // 但仍是「写」，只读 run 不该拿到写回能力；契约测试按名字关键字钉住这份分类。
+  "writeTranslations",
+  // 编排副作用：startAgentRun 会另起一次 run（子 run 的只读与否由调用方参数决定），
+  // controlAgentRun 能追加指令/停止它；只读 run 不应拿到这两个（review A-1）。
+  "startAgentRun",
+  "controlAgentRun",
+  // 受控云端执行：在用户拥有的云资源上跑任意命令，不可重放、副作用在云端。
+  // 硬边界：它永不进 DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS（见该清单注释），
+  // 必须由 agent 显式启用才出现；这里进名单保证只读 run 即使被显式要求也拿不到。
+  "cloud_exec"
+];
+function resolveReadOnlyToolConstraints(additionalBlockedTools) {
+  return {
+    blockedToolNames: [
+      ...HIGH_RISK_MUTATION_TOOL_NAMES,
+      ...additionalBlockedTools ?? []
+    ]
+  };
+}
+function applyToolSurfaceConstraints(surface, constraints) {
+  const allowed = constraints.allowedToolNames == null ? null : new Set(asTrimmedNonEmptyStringArray(constraints.allowedToolNames));
+  const blocked = new Set(asTrimmedNonEmptyStringArray(constraints.blockedToolNames ?? []));
+  const narrow = (names) => names.filter(
+    (name) => (allowed === null || allowed.has(name)) && !blocked.has(name)
+  );
+  return {
+    ...surface,
+    explicitToolNames: narrow(surface.explicitToolNames),
+    injectedToolNames: narrow(surface.injectedToolNames),
+    finalToolNames: narrow(surface.finalToolNames)
+  };
+}
+function resolveRequestToolSurface(args) {
+  const normalize = (name) => canonicalizeToolName(name.trim().replace(/^functions\./i, ""));
+  const names = (values) => new Set(values.map(normalize));
+  const allowed = args.profile?.allowedToolNames == null ? null : names(args.profile.allowedToolNames);
+  const blocked = names(args.profile?.blockedToolNames ?? []);
+  const supported = args.backend ? names(args.backend.toolNames) : null;
+  const scope = args.backend?.scopedToolNames ? names(args.backend.scopedToolNames) : null;
+  const filteredTools = [];
+  const finalToolNames = args.requestedToolNames.filter((toolName) => {
+    const name = normalize(toolName);
+    const reason = allowed && !allowed.has(name) ? "profile-not-allowed" : blocked.has(name) ? "profile-blocked" : supported && (!scope || scope.has(name)) && !supported.has(name) ? "backend-unsupported" : null;
+    if (!reason) return true;
+    filteredTools.push({ toolName, reason });
+    return false;
+  });
+  return { finalToolNames, filteredTools };
+}
+function uniqueToolNames(values) {
+  return [...new Set(asTrimmedNonEmptyStringArray(values))];
+}
+function canInjectPrivateDefaults(args) {
+  if (!args.currentUserId) return false;
+  if (args.invocationVisibility !== "private") return false;
+  if (args.agentOwnerId && args.agentOwnerId === args.currentUserId) return true;
+  if (args.trustedPrivateInvocation === true) return true;
+  return false;
+}
+function explicitOnlyReason(args) {
+  if (!args.currentUserId || !args.agentOwnerId) {
+    return "explicit-only-missing-identity";
+  }
+  if (args.invocationVisibility === "public") return "explicit-only-public";
+  if (args.invocationVisibility === "shared") return "explicit-only-shared";
+  if (args.agentOwnerId !== args.currentUserId) {
+    return "explicit-only-owner-mismatch";
+  }
+  return "explicit-only-anonymous";
+}
+function resolveRuntimeToolSurface(args) {
+  const explicitToolNames = uniqueToolNames(args.explicitToolNames ?? []);
+  if (canInjectPrivateDefaults(args)) {
+    const baseInjected = args.injectPrivateDefaults === false ? args.defaultInjectedToolNames ?? DEFAULT_SUBTASK_REFERENCE_NOLO_WORKSPACE_TOOLS : args.defaultInjectedToolNames ?? DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS;
+    const injectedToolNames2 = uniqueToolNames([
+      ...baseInjected,
+      ...args.additionalRequiredToolNames ?? []
+    ]);
+    return {
+      explicitToolNames,
+      injectedToolNames: injectedToolNames2,
+      finalToolNames: uniqueToolNames([
+        ...explicitToolNames,
+        ...injectedToolNames2
+      ]),
+      auditReason: "private-authenticated-defaults"
+    };
+  }
+  const injectedToolNames = uniqueToolNames(args.additionalRequiredToolNames ?? []);
+  return {
+    explicitToolNames,
+    injectedToolNames,
+    finalToolNames: uniqueToolNames([
+      ...explicitToolNames,
+      ...injectedToolNames
+    ]),
+    auditReason: explicitOnlyReason(args)
+  };
+}
+function isPublicRuntimeAgentRef(value) {
+  return typeof value === "string" && value.startsWith("agent-pub-");
+}
+function inferOwnerIdFromRuntimeAgentKey(value) {
+  if (typeof value !== "string") return null;
+  const privateAgentMatch = value.match(/^agent-([^-]+)-(.+)$/);
+  if (privateAgentMatch && privateAgentMatch[1] !== "pub") {
+    return privateAgentMatch[1];
+  }
+  return null;
+}
+function resolveRuntimeToolSurfaceForAgent(args) {
+  const agentKey = typeof args.agentKey === "string" ? args.agentKey : "";
+  const currentUserId = typeof args.currentUserId === "string" ? args.currentUserId : "";
+  const inferredOwnerId = args.agentOwnerId ?? (currentUserId && isOwnedAgentKey(agentKey, currentUserId) ? currentUserId : inferOwnerIdFromRuntimeAgentKey(agentKey));
+  const publicRef = isPublicRuntimeAgentRef(agentKey);
+  const visibility = args.trustedPrivateInvocation === true ? "private" : publicRef || args.isPublic === true || args.sharingLevel === "public" ? "public" : "private";
+  return resolveRuntimeToolSurface({
+    explicitToolNames: args.explicitToolNames,
+    currentUserId: args.currentUserId,
+    agentOwnerId: inferredOwnerId,
+    invocationVisibility: visibility,
+    runtimeHost: args.runtimeHost,
+    trustedPrivateInvocation: args.trustedPrivateInvocation,
+    injectPrivateDefaults: args.injectPrivateDefaults,
+    defaultInjectedToolNames: args.defaultInjectedToolNames,
+    additionalRequiredToolNames: args.additionalRequiredToolNames
+  });
+}
+var SECRET_FIELD_NAMES = [
+  "apikey",
+  "api_key",
+  "secret",
+  "token",
+  "authorization",
+  "credential",
+  "password"
+];
+function isSecretFieldName(key) {
+  const normalized = key.toLowerCase();
+  return SECRET_FIELD_NAMES.some((name) => normalized.includes(name));
+}
+function redactAgentRecordForWorkspaceTool(record) {
+  if (Array.isArray(record)) return record.map(redactAgentRecordForWorkspaceTool);
+  if (!isRecord(record)) return record;
+  const redacted = {};
+  for (const [key, value] of Object.entries(record)) {
+    if (isSecretFieldName(key)) {
+      redacted[key] = "[redacted]";
+      continue;
+    }
+    redacted[key] = Array.isArray(value) || isRecord(value) ? redactAgentRecordForWorkspaceTool(value) : value;
+  }
+  return redacted;
+}
+
+export {
+  HIGH_RISK_MUTATION_TOOL_NAMES,
+  resolveReadOnlyToolConstraints,
+  applyToolSurfaceConstraints,
+  resolveRequestToolSurface,
+  resolveRuntimeToolSurfaceForAgent,
+  redactAgentRecordForWorkspaceTool
+};

package/{chunk-PLYWH7XM.js → chunk-KIM6CLW5.js}

@@ -1,6 +1,6 @@
 import {
   trimTrailingSlash
-} from "./chunk-PV6JJAUB.js";
+} from "./chunk-TCZHTTUU.js";
 import {
   commandCodeModels,
   kimiCodeModels,
@@ -15,12 +15,6 @@ import {
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import {
-  asOptionalFiniteNumber
-} from "./chunk-WWC7I6TA.js";
-import {
-  asOptionalTrimmedString
-} from "./chunk-G3SUCT4W.js";
 import {
   PLATFORM_HOSTED_DEEPSEEK_FLASH_OFF_PEAK_PRICE,
   PLATFORM_HOSTED_DEEPSEEK_FLASH_PEAK_PRICE,
@@ -30,6 +24,12 @@ import {
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
+import {
+  asOptionalTrimmedString
+} from "./chunk-G3SUCT4W.js";
 
 // packages/agent-runtime/antigravityOAuth.ts
 var decodeBase64 = (s) => typeof Buffer !== "undefined" ? Buffer.from(s, "base64").toString("utf8") : typeof atob === "function" ? atob(s) : s;

package/{chunk-SCYQJPGA.js → chunk-M6RL5JCD.js}

@@ -4,22 +4,28 @@ import {
 import {
   getReadableCliDb
 } from "./chunk-J5JTMQIA.js";
+import {
+  BIGMODEL_PROVIDER_TARGET,
+  buildCredentialUseGrant,
+  verifyCredentialUseGrant
+} from "./chunk-XFYFMTOM.js";
+import {
+  clearCliLocalRuntimePreparedAgentCache
+} from "./chunk-D5RCRX4A.js";
+import {
+  readCredentialAvailability
+} from "./chunk-GSQNH63I.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
   normalizeAgentRecordForOutput,
   parseAgentUpdateArgs,
+  readBoundAgentCredential,
   refreshAgentRecordCache,
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-XDMGY5IU.js";
-import {
-  clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-M4NTDZG3.js";
-import {
-  readCredentialAvailability
-} from "./chunk-GSQNH63I.js";
+} from "./chunk-IF45XG7K.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-NBTY7YJF.js";
@@ -150,7 +156,9 @@ async function runAgentUpdateCommand(args, deps = {}) {
       db,
       fetchImpl,
       fallbackFetchImpl,
-      authToken
+      authToken,
+      credentialBroker: deps.credentialBroker,
+      hostApproval: deps.hostApproval
     });
     await writeAgentRecord({
       agentKey: built.agentKey,
@@ -159,7 +167,8 @@ async function runAgentUpdateCommand(args, deps = {}) {
       fetchImpl,
       serverUrl: built.serverUrl,
       userId,
-      record: built.nextRecord
+      record: built.nextRecord,
+      remoteIncludeApiKey: !deps.hostApproval?.gateId
     });
     await refreshAgentRecordCache({
       db,
@@ -223,7 +232,9 @@ async function runAgentCreateCommand(args, deps = {}) {
       db,
       fetchImpl,
       fallbackFetchImpl,
-      authToken
+      authToken,
+      credentialBroker: deps.credentialBroker,
+      hostApproval: deps.hostApproval
     });
     await writeAgentRecord({
       agentKey: built.agentKey,
@@ -232,7 +243,8 @@ async function runAgentCreateCommand(args, deps = {}) {
       fetchImpl,
       serverUrl: built.serverUrl,
       userId,
-      record: built.nextRecord
+      record: built.nextRecord,
+      remoteIncludeApiKey: !deps.hostApproval?.gateId
     });
     await db.put(built.agentKey, {
       ...built.nextRecord,
@@ -244,16 +256,131 @@ async function runAgentCreateCommand(args, deps = {}) {
     let verifyResult;
     if (parsed.verify) {
       try {
-        const { verifyCustomProvider } = await import("./agentProviderCommands-MN3ABDME.js");
+        const { verifyCustomProvider } = await import("./agentProviderCommands-Q5O33MED.js");
         const rec = built.nextRecord;
-        verifyResult = await verifyCustomProvider({
-          providerUrl: rec.customProviderUrl,
-          apiKey: rec.apiKey,
-          apiKeyHeader: rec.apiKeyHeader,
-          model: rec.model,
-          prompt: parsed.verifyPrompt,
-          fetchImpl
-        });
+        const verifyCredentialRef = typeof rec.credentialRef === "string" && rec.credentialRef.trim() ? rec.credentialRef.trim() : "";
+        if (verifyCredentialRef) {
+          const providerUrl = rec.customProviderUrl ?? "";
+          const hostGateId = (deps.hostApproval?.gateId ?? "").trim();
+          const confirmCredentialUse = hostGateId ? void 0 : deps.confirmCredentialUse;
+          let grantReason = "host-grant-unavailable: no in-process host approval in this entry point; credential not sent";
+          let grantedOrigin;
+          if (hostGateId) {
+            const gate = {
+              id: hostGateId,
+              kind: "confirm",
+              title: "Use pasted API key for this agent?",
+              body: `Target: ${providerUrl}`,
+              payload: { agentKey: built.agentKey, credentialRef: verifyCredentialRef }
+            };
+            const builtGrant = buildCredentialUseGrant({
+              gate,
+              result: { gateId: hostGateId, status: "completed", output: "confirmed" },
+              credentialRef: verifyCredentialRef,
+              agentKey: built.agentKey,
+              deviceId: deps.deviceId ?? "",
+              providerId: BIGMODEL_PROVIDER_TARGET.providerId,
+              providerUrl,
+              operations: ["verify"],
+              persistence: "os-store"
+            });
+            if (builtGrant.ok) {
+              const granted = verifyCredentialUseGrant({
+                grant: builtGrant.grant,
+                credentialRef: verifyCredentialRef,
+                agentKey: built.agentKey,
+                requestUrl: providerUrl,
+                operation: "verify"
+              });
+              if (granted.ok) {
+                grantedOrigin = builtGrant.grant.allowedOrigin;
+              } else {
+                grantReason = `host-grant-rejected: ${granted.reason}; credential not sent`;
+              }
+            } else {
+              grantReason = `host-grant-rejected: ${builtGrant.reason}; credential not sent`;
+            }
+          }
+          if (confirmCredentialUse) {
+            const gate = {
+              id: `credential-use-${built.agentKey}`,
+              kind: "confirm",
+              title: "Use pasted API key for this agent?",
+              body: `Target: ${providerUrl}`,
+              payload: { agentKey: built.agentKey, credentialRef: verifyCredentialRef }
+            };
+            const gateResult = await confirmCredentialUse(gate);
+            const builtGrant = buildCredentialUseGrant({
+              gate,
+              result: gateResult,
+              credentialRef: verifyCredentialRef,
+              agentKey: built.agentKey,
+              deviceId: deps.deviceId ?? "",
+              providerId: BIGMODEL_PROVIDER_TARGET.providerId,
+              providerUrl,
+              operations: ["verify"],
+              persistence: "os-store"
+            });
+            if (builtGrant.ok) {
+              const granted = verifyCredentialUseGrant({
+                grant: builtGrant.grant,
+                credentialRef: verifyCredentialRef,
+                agentKey: built.agentKey,
+                requestUrl: providerUrl,
+                operation: "verify"
+              });
+              if (granted.ok) {
+                grantedOrigin = builtGrant.grant.allowedOrigin;
+              } else {
+                grantReason = `host-grant-rejected: ${granted.reason}; credential not sent`;
+              }
+            } else {
+              grantReason = `host-grant-rejected: ${builtGrant.reason}; credential not sent`;
+            }
+          }
+          if (!grantedOrigin) {
+            if (grantReason.startsWith("host-grant-unavailable")) {
+              grantReason = "host-grant-unavailable: no in-process host approval for this credential/target in this entry point; credential not sent";
+            }
+          }
+          if (!grantedOrigin) {
+            verifyResult = {
+              ok: false,
+              providerUrl,
+              model: rec.model,
+              reason: grantReason
+            };
+          } else {
+            const secret = await readBoundAgentCredential(
+              verifyCredentialRef,
+              deps.credentialBroker
+            );
+            verifyResult = secret ? await verifyCustomProvider({
+              providerUrl,
+              apiKey: secret,
+              apiKeyHeader: rec.apiKeyHeader,
+              model: rec.model,
+              prompt: parsed.verifyPrompt,
+              fetchImpl,
+              // 实际请求目标必须等于授权的 origin；重定向一律拒绝。
+              allowedOrigin: grantedOrigin
+            }) : {
+              ok: false,
+              providerUrl,
+              model: rec.model,
+              reason: "host-grant-ok but credential is not readable from the OS store"
+            };
+          }
+        } else {
+          verifyResult = await verifyCustomProvider({
+            providerUrl: rec.customProviderUrl,
+            apiKey: rec.apiKey,
+            apiKeyHeader: rec.apiKeyHeader,
+            model: rec.model,
+            prompt: parsed.verifyPrompt,
+            fetchImpl
+          });
+        }
       } catch (error) {
         verifyResult = {
           ok: false,

package/chunk-MMA3LZ3W.js

@@ -0,0 +1,105 @@
+import {
+  __commonJS
+} from "./chunk-4VNS5WPM.js";
+
+// node_modules/@babel/runtime/helpers/interopRequireDefault.js
+var require_interopRequireDefault = __commonJS({
+  "node_modules/@babel/runtime/helpers/interopRequireDefault.js"(exports, module) {
+    function _interopRequireDefault(e) {
+      return e && e.__esModule ? e : {
+        "default": e
+      };
+    }
+    module.exports = _interopRequireDefault, module.exports.__esModule = true, module.exports["default"] = module.exports;
+  }
+});
+
+// node_modules/date-fns/_lib/requiredArgs/index.js
+var require_requiredArgs = __commonJS({
+  "node_modules/date-fns/_lib/requiredArgs/index.js"(exports, module) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.default = requiredArgs;
+    function requiredArgs(required, args) {
+      if (args.length < required) {
+        throw new TypeError(required + " argument" + (required > 1 ? "s" : "") + " required, but only " + args.length + " present");
+      }
+    }
+    module.exports = exports.default;
+  }
+});
+
+// node_modules/@babel/runtime/helpers/typeof.js
+var require_typeof = __commonJS({
+  "node_modules/@babel/runtime/helpers/typeof.js"(exports, module) {
+    function _typeof(o) {
+      "@babel/helpers - typeof";
+      return module.exports = _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
+        return typeof o2;
+      } : function(o2) {
+        return o2 && "function" == typeof Symbol && o2.constructor === Symbol && o2 !== Symbol.prototype ? "symbol" : typeof o2;
+      }, module.exports.__esModule = true, module.exports["default"] = module.exports, _typeof(o);
+    }
+    module.exports = _typeof, module.exports.__esModule = true, module.exports["default"] = module.exports;
+  }
+});
+
+// node_modules/date-fns/toDate/index.js
+var require_toDate = __commonJS({
+  "node_modules/date-fns/toDate/index.js"(exports, module) {
+    "use strict";
+    var _interopRequireDefault = require_interopRequireDefault().default;
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.default = toDate;
+    var _typeof2 = _interopRequireDefault(require_typeof());
+    var _index = _interopRequireDefault(require_requiredArgs());
+    function toDate(argument) {
+      (0, _index.default)(1, arguments);
+      var argStr = Object.prototype.toString.call(argument);
+      if (argument instanceof Date || (0, _typeof2.default)(argument) === "object" && argStr === "[object Date]") {
+        return new Date(argument.getTime());
+      } else if (typeof argument === "number" || argStr === "[object Number]") {
+        return new Date(argument);
+      } else {
+        if ((typeof argument === "string" || argStr === "[object String]") && typeof console !== "undefined") {
+          console.warn("Starting with v2.0.0-beta.1 date-fns doesn't accept strings as date arguments. Please use `parseISO` to parse strings. See: https://github.com/date-fns/date-fns/blob/master/docs/upgradeGuide.md#string-arguments");
+          console.warn(new Error().stack);
+        }
+        return /* @__PURE__ */ new Date(NaN);
+      }
+    }
+    module.exports = exports.default;
+  }
+});
+
+// node_modules/date-fns/_lib/addLeadingZeros/index.js
+var require_addLeadingZeros = __commonJS({
+  "node_modules/date-fns/_lib/addLeadingZeros/index.js"(exports, module) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.default = addLeadingZeros;
+    function addLeadingZeros(number, targetLength) {
+      var sign = number < 0 ? "-" : "";
+      var output = Math.abs(number).toString();
+      while (output.length < targetLength) {
+        output = "0" + output;
+      }
+      return sign + output;
+    }
+    module.exports = exports.default;
+  }
+});
+
+export {
+  require_interopRequireDefault,
+  require_typeof,
+  require_requiredArgs,
+  require_toDate,
+  require_addLeadingZeros
+};

package/{chunk-I5PBXF7O.js → chunk-MMNYUVLW.js}

@@ -1,7 +1,7 @@
 import {
   resolveBuiltinCapability,
   resolveBuiltinSkillEntry
-} from "./chunk-Y6M7KJOA.js";
+} from "./chunk-EZFQ6XRV.js";
 import {
   noloAgentId
 } from "./chunk-Y6ORVLSS.js";