nolo-cli 0.29.2 → 0.30.0-alpha.1

package/{chunk-RJBTU7AS.js → chunk-GAGUBI42.js}

@@ -1,9 +1,6 @@
 import {
-  applyAgentSecretMigrationUpdates,
-  createFileCredentialBroker,
-  migrateAgentSecrets,
-  normalizeAgentRuntimeToolPolicy
-} from "./chunk-5CS33IBL.js";
+  getCredentialsDir
+} from "./chunk-JZPBVBIY.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -11,19 +8,28 @@ import {
   patch,
   remove,
   write
-} from "./chunk-G2BZ43DV.js";
-import {
-  createAgentKey,
-  toTrimmedString
-} from "./chunk-NRY4GCKJ.js";
+} from "./chunk-A4JDTA5T.js";
 import {
   asyncThunkCreator,
   buildCreateSlice,
   getRuntimeServerContext
-} from "./chunk-XMLRJUU5.js";
+} from "./chunk-ZFTCLBEX.js";
+import {
+  createAgentKey,
+  toTrimmedString
+} from "./chunk-WHLVPK32.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
+import {
+  asOptionalPositiveFiniteNumber
+} from "./chunk-U6VC4MU4.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
+import {
+  asNonEmptyStringArray
+} from "./chunk-I42VC5KR.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -83,6 +89,283 @@ var sanitizeOptionalModelString = (value) => {
 
 // packages/ai/agent/agentSlice.ts
 import { ulid } from "ulid";
+
+// packages/agent-runtime/fileCredentialBroker.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// packages/agent-runtime/credentialBroker.ts
+function assertCredentialRef(ref) {
+  const trimmed = asTrimmedString(ref);
+  if (!trimmed) {
+    throw new Error("invalid_ref");
+  }
+  if (trimmed.includes("..") || trimmed.includes("/") || trimmed.includes("\\")) {
+    throw new Error("invalid_ref");
+  }
+  return trimmed;
+}
+
+// packages/agent-runtime/fileCredentialBroker.ts
+function getApiKeyCredentialsDir(homeDir = homedir()) {
+  return join(getCredentialsDir(homeDir), "keys");
+}
+function credentialRefToFileName(ref) {
+  const safe = assertCredentialRef(ref).replace(/[^a-zA-Z0-9._-]+/g, "_");
+  if (!safe || safe === "." || safe === "..") {
+    throw new Error(`Credential ref is not filesystem-safe: ${ref}`);
+  }
+  return `${safe}.json`;
+}
+function getApiKeyCredentialPath(ref, homeDir = homedir()) {
+  return join(getApiKeyCredentialsDir(homeDir), credentialRefToFileName(ref));
+}
+function ensurePrivateDir(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+}
+function writePrivateFile(path, body) {
+  writeFileSync(path, body, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function readApiKeyCredential(ref, homeDir = homedir()) {
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  if (!existsSync(path)) return null;
+  try {
+    const raw = readFileSync(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.secret !== "string" || !parsed.secret) return null;
+    return parsed.secret;
+  } catch {
+    return null;
+  }
+}
+function writeApiKeyCredential(ref, secret, homeDir = homedir(), now = Date.now()) {
+  const trimmedSecret = secret.trim();
+  if (!trimmedSecret) {
+    throw new Error("Cannot store an empty credential secret.");
+  }
+  assertCredentialRef(ref);
+  const dir = getApiKeyCredentialsDir(homeDir);
+  ensurePrivateDir(dir);
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  const payload = {
+    secret: trimmedSecret,
+    updatedAt: now
+  };
+  writePrivateFile(path, `${JSON.stringify(payload, null, 2)}
+`);
+}
+function removeApiKeyCredential(ref, homeDir = homedir()) {
+  assertCredentialRef(ref);
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  if (!existsSync(path)) return;
+  unlinkSync(path);
+}
+function hasApiKeyCredential(ref, homeDir = homedir()) {
+  return readApiKeyCredential(ref, homeDir) !== null;
+}
+function createFileCredentialBroker(options = {}) {
+  const homeDir = options.homeDir ?? homedir();
+  const now = options.now ?? Date.now;
+  return {
+    get(ref) {
+      return readApiKeyCredential(ref, homeDir);
+    },
+    put(ref, secret) {
+      writeApiKeyCredential(ref, secret, homeDir, now());
+    },
+    delete(ref) {
+      removeApiKeyCredential(ref, homeDir);
+    },
+    has(ref) {
+      return hasApiKeyCredential(ref, homeDir);
+    }
+  };
+}
+
+// packages/agent-runtime/migrateAgentSecrets.ts
+function buildAgentApiKeyCredentialRef(agentKey) {
+  const key = asTrimmedString(agentKey);
+  if (!key) throw new Error("agentKey is required to build a credential ref.");
+  return `api-key:${key}`;
+}
+function readRawApiKey(agent) {
+  return asTrimmedString(agent.apiKey);
+}
+function resolveTargetRef(agent) {
+  const fromCredential = asTrimmedString(agent.credentialRef);
+  if (fromCredential) return fromCredential;
+  const fromApiKeyRef = asTrimmedString(agent.apiKeyRef);
+  if (fromApiKeyRef.startsWith("api-key:")) return fromApiKeyRef;
+  return buildAgentApiKeyCredentialRef(agent.key);
+}
+async function brokerHas(broker, ref) {
+  return Boolean(await broker.has(ref));
+}
+async function brokerPut(broker, ref, secret) {
+  await broker.put(ref, secret);
+}
+async function migrateAgentSecrets(args) {
+  const { agent, broker } = args;
+  const raw = readRawApiKey(agent);
+  const migration = asTrimmedString(agent.credentialMigration);
+  if (migration === "done" && !raw) {
+    const ref = typeof agent.credentialRef === "string" && agent.credentialRef.trim() || (typeof agent.apiKeyRef === "string" && agent.apiKeyRef.startsWith("api-key:") ? agent.apiKeyRef.trim() : "") || void 0;
+    return {
+      updates: {},
+      status: "already-done",
+      ...ref ? { credentialRef: ref } : {},
+      phase: "complete"
+    };
+  }
+  if (!raw && migration !== "pending") {
+    return { updates: {}, status: "noop", phase: "none" };
+  }
+  const targetRef = resolveTargetRef(agent);
+  if (raw) {
+    await brokerPut(broker, targetRef, raw);
+    const stored2 = await brokerHas(broker, targetRef);
+    if (!stored2) {
+      return {
+        updates: {
+          credentialRef: targetRef,
+          credentialMigration: "pending"
+        },
+        status: "resumed-pending",
+        credentialRef: targetRef,
+        phase: "put"
+      };
+    }
+    return {
+      updates: {
+        apiKey: null,
+        credentialRef: targetRef,
+        // Keep apiKeyRef for resolution if not already an OAuth provider name.
+        // Prefer explicit credentialRef; set apiKeyRef only when empty so OAuth agents stay intact.
+        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {},
+        credentialMigration: "done"
+      },
+      status: migration === "pending" ? "resumed-pending" : "migrated",
+      credentialRef: targetRef,
+      phase: "strip"
+    };
+  }
+  const stored = await brokerHas(broker, targetRef);
+  if (stored) {
+    return {
+      updates: {
+        credentialRef: targetRef,
+        credentialMigration: "done",
+        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {}
+      },
+      status: "resumed-pending",
+      credentialRef: targetRef,
+      phase: "complete"
+    };
+  }
+  return {
+    updates: {
+      credentialRef: targetRef,
+      credentialMigration: "pending"
+    },
+    status: "awaiting-secret",
+    credentialRef: targetRef,
+    phase: "put"
+  };
+}
+function applyAgentSecretMigrationUpdates(record, updates) {
+  const next = { ...record };
+  if ("apiKey" in updates) {
+    if (updates.apiKey === null || updates.apiKey === "") {
+      delete next.apiKey;
+    } else if (typeof updates.apiKey === "string") {
+      next.apiKey = updates.apiKey;
+    }
+  }
+  if (updates.apiKeyRef !== void 0) next.apiKeyRef = updates.apiKeyRef;
+  if (updates.credentialRef !== void 0) next.credentialRef = updates.credentialRef;
+  if (updates.credentialMigration !== void 0) {
+    next.credentialMigration = updates.credentialMigration;
+  }
+  return next;
+}
+
+// packages/agent-runtime/runtimeToolPolicy.ts
+function unique(values) {
+  return [...new Set(values)];
+}
+function normalizeAgentRuntimeToolPolicy(value) {
+  if (!isRecord(value)) return void 0;
+  return {
+    version: 1,
+    ...asNonEmptyStringArray(value.agentTools).length ? { agentTools: unique(asNonEmptyStringArray(value.agentTools)) } : {},
+    ...asNonEmptyStringArray(value.runtimeTools).length ? { runtimeTools: unique(asNonEmptyStringArray(value.runtimeTools)) } : {},
+    ...isRecord(value.workspace) ? { workspace: { ...value.workspace } } : {},
+    ...isRecord(value.shell) ? { shell: { ...value.shell } } : {},
+    ...isRecord(value.isolation) ? { isolation: { ...value.isolation } } : {},
+    ...isRecord(value.git) ? { git: { ...value.git } } : {},
+    ...isRecord(value.budget) ? { budget: { ...value.budget } } : {},
+    ...isRecord(value.audit) ? { audit: { ...value.audit } } : {}
+  };
+}
+function runtimeBindingRecord(runtimeBinding) {
+  return isRecord(runtimeBinding) ? runtimeBinding : void 0;
+}
+function runtimeToolNamesFromPolicy(policy) {
+  return asNonEmptyStringArray(policy?.runtimeTools);
+}
+function readPositiveNumber(value) {
+  return asOptionalPositiveFiniteNumber(Number(value));
+}
+function resolveRequestedRuntimeToolNames(args) {
+  const runtimeBinding = runtimeBindingRecord(args.agentConfig.runtimeBinding);
+  const bindingPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicy
+  );
+  const bindingSnapshotPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicySnapshot
+  );
+  return unique([
+    ...asNonEmptyStringArray(args.agentConfig.toolNames),
+    ...runtimeToolNamesFromPolicy(
+      normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy)
+    ),
+    ...runtimeToolNamesFromPolicy(bindingPolicy),
+    ...runtimeToolNamesFromPolicy(bindingSnapshotPolicy)
+  ]);
+}
+function resolveCurrentRunRuntimeToolPolicy(agentConfig) {
+  const runtimeBinding = runtimeBindingRecord(agentConfig?.runtimeBinding);
+  return normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicySnapshot ?? agentConfig?.runtimeToolPolicy ?? runtimeBinding?.runtimeToolPolicy
+  );
+}
+function resolveLocalRuntimeEnvFromPolicy(runtimeEnv, policy) {
+  return { ...runtimeEnv };
+}
+function resolveLocalWorkspaceExecutorOptionsFromPolicy(policy) {
+  const maxOutputBytes = readPositiveNumber(policy?.shell?.maxOutputBytes);
+  return {
+    ...maxOutputBytes ? { commandOutputLimit: Math.floor(maxOutputBytes) } : {}
+  };
+}
+
+// packages/ai/agent/agentSlice.ts
 var createAgentCredentialBroker = createFileCredentialBroker;
 function setAgentCredentialBrokerFactoryForTests(factory) {
   createAgentCredentialBroker = factory ?? createFileCredentialBroker;
@@ -300,7 +583,7 @@ var slice = createSliceWithThunks({
       const overrides = {};
       if (args.systemPromptOverride !== void 0) overrides.prompt = args.systemPromptOverride;
       if (args.toolsOverride !== void 0) overrides.tools = args.toolsOverride;
-      const { _executeModel } = await import("./_executeModel-BFVTGZXE.js");
+      const { _executeModel } = await import("./_executeModel-VBHHG7LT.js");
       return _executeModel(
         {
           isStreaming: args.isStreaming ?? false,
@@ -321,7 +604,7 @@ var slice = createSliceWithThunks({
      * - 循环直到无工具调用或触发其他运行时停止条件
      */
     runAgent: create.asyncThunk(async (args, thunkApi) => {
-      const { runAgentClientLoop } = await import("./runAgentClientLoop-5TGSUKHV.js");
+      const { runAgentClientLoop } = await import("./runAgentClientLoop-N3YDLTMS.js");
       const { content: loopContent, toolCallCount } = await runAgentClientLoop(
         {
           agentKey: args.agentKey,
@@ -337,7 +620,7 @@ var slice = createSliceWithThunks({
      * 聊天轮次流式 Agent 调用
      */
     streamAgentChatTurn: create.asyncThunk(async (args, thunkApi) => {
-      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-HRFMVSVC.js");
+      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-Q4U2CVMI.js");
       return streamAgentChatTurnHandler(args, thunkApi);
     }),
     /**
@@ -563,6 +846,11 @@ var agentSlice_default = agentReducer;
 export {
   fetchServerSyncedCredential,
   deleteServerSyncedCredential,
+  createFileCredentialBroker,
+  resolveRequestedRuntimeToolNames,
+  resolveCurrentRunRuntimeToolPolicy,
+  resolveLocalRuntimeEnvFromPolicy,
+  resolveLocalWorkspaceExecutorOptionsFromPolicy,
   setAgentCredentialBrokerFactoryForTests,
   slice,
   runLlm,

package/{chunk-NXMJ55RU.js → chunk-GVKTKT3O.js}

@@ -1,13 +1,13 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-DF7SMWEV.js";
+} from "./chunk-HLG6GAUD.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-QC6ZWDSV.js";
+} from "./chunk-56IUA7RU.js";
 import {
   toSafeAgentSummary
-} from "./chunk-HRJEPMZY.js";
+} from "./chunk-UTQZ73QQ.js";
 import {
   PUBLIC_AGENT_KEY_PREFIX,
   isOwnedAgentKey,

package/{chunk-5ZXNLOAG.js → chunk-HI7QZNWX.js}

@@ -1,16 +1,16 @@
 import {
   createCliLocalRuntimeAdapter,
   summarizeEndpoint
-} from "./chunk-H5S4XUGI.js";
-import {
-  clipMultilineText
-} from "./chunk-WMB7GVPN.js";
+} from "./chunk-MMCVBEAD.js";
 import {
   runLocalAgentTurn
-} from "./chunk-Z54ZAZZC.js";
+} from "./chunk-KW47OSRJ.js";
+import {
+  clipMultilineText
+} from "./chunk-OYK7PA5U.js";
 import {
   resolveLocalRuntimeEnvFromPolicy
-} from "./chunk-5CS33IBL.js";
+} from "./chunk-GAGUBI42.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -28,8 +28,8 @@ import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
 import {
-  asTrimmedNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
+  ownedAgentKey
+} from "./chunk-TOW4E763.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -39,6 +39,9 @@ import {
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedNonEmptyStringArray
+} from "./chunk-I42VC5KR.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -446,10 +449,14 @@ async function defaultRunConnectorLocalRuntimeAgent(args) {
     toolNames,
     ...policy ? { runtimeToolPolicy: policy } : {}
   };
+  const dispatchUserId = String(args.runtimeEnv.NOLO_USER_ID || "local");
+  const localUserId = String(
+    args.runtimeEnv.NOLO_LOCAL_USER_ID || args.runtimeEnv.NOLO_USER_ID || "local"
+  );
   const store = /* @__PURE__ */ new Map([
     [agentKey, agentRecord],
-    [`agent-${args.runtimeEnv.NOLO_USER_ID || "local"}-${agentKey}`, agentRecord],
-    [`agent-${args.runtimeEnv.NOLO_LOCAL_USER_ID || args.runtimeEnv.NOLO_USER_ID || "local"}-${agentKey}`, agentRecord]
+    [ownedAgentKey(dispatchUserId, agentKey), agentRecord],
+    [ownedAgentKey(localUserId, agentKey), agentRecord]
   ]);
   const env = localRuntimeEnvFromPolicy(
     withForwardedUserAuthToken(args.runtimeEnv, args.parsed),

package/{chunk-DF7SMWEV.js → chunk-HLG6GAUD.js}

@@ -2,7 +2,7 @@ import {
   deleteDbRecord,
   queryUserRecords,
   readDbRecord
-} from "./chunk-QC6ZWDSV.js";
+} from "./chunk-56IUA7RU.js";
 import {
   mergeAndDedupUserData
 } from "./chunk-KQHGZWSV.js";

package/{chunk-MQRZ5QUH.js → chunk-IXZX5CJK.js}

@@ -2,7 +2,7 @@ import {
   CORE_DRAIN_REASON,
   isGatewayHttpStatus,
   parseRetryAfterHeaderMs
-} from "./chunk-RQSOAMPJ.js";
+} from "./chunk-Z5MXSEOJ.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";

package/{chunk-IC7W63RM.js → chunk-IZ3CBMD5.js}

@@ -1,12 +1,12 @@
 import {
   selectCurrentServer
-} from "./chunk-R7LOFGRE.js";
+} from "./chunk-446VANPP.js";
 import {
   patch
-} from "./chunk-G2BZ43DV.js";
+} from "./chunk-A4JDTA5T.js";
 import {
   selectIdentityToken
-} from "./chunk-XMLRJUU5.js";
+} from "./chunk-ZFTCLBEX.js";
 import {
   getIsDesktopApp
 } from "./chunk-R5V5G73M.js";

package/{chunk-VHBWHNVT.js → chunk-K6QEHQZ3.js}

@@ -1,17 +1,21 @@
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
+import {
+  ownedAgentKey,
+  publicAgentKey
+} from "./chunk-TOW4E763.js";
 
 // packages/cli/agentAliases.ts
 var CURRENT_OPERATOR_USER_ID = "0e95801d90";
 var NOLO_DEFAULT_AGENT_ID = "01NOLOAPPBLD000000019KCKT0";
-var NOLO_DEFAULT_AGENT_KEY = `agent-pub-${NOLO_DEFAULT_AGENT_ID}`;
+var NOLO_DEFAULT_AGENT_KEY = publicAgentKey(NOLO_DEFAULT_AGENT_ID);
 var NOLO_PROJECT_MANAGER_AGENT_ID = "01NOLOPROJMGR00000000MSVGG";
-var NOLO_PROJECT_MANAGER_AGENT_KEY = `agent-${CURRENT_OPERATOR_USER_ID}-${NOLO_PROJECT_MANAGER_AGENT_ID}`;
+var NOLO_PROJECT_MANAGER_AGENT_KEY = ownedAgentKey(CURRENT_OPERATOR_USER_ID, NOLO_PROJECT_MANAGER_AGENT_ID);
 var NOLO_FRONTEND_AGENT_ID = "01FRONTENDAG0000000115N4E1";
-var NOLO_FRONTEND_AGENT_KEY = `agent-${CURRENT_OPERATOR_USER_ID}-${NOLO_FRONTEND_AGENT_ID}`;
+var NOLO_FRONTEND_AGENT_KEY = ownedAgentKey(CURRENT_OPERATOR_USER_ID, NOLO_FRONTEND_AGENT_ID);
 var LOCAL_CODEX_AGENT_ID = "01LOCALCODEXCLI000000NEW";
-var LOCAL_CODEX_AGENT_KEY = `agent-${CURRENT_OPERATOR_USER_ID}-${LOCAL_CODEX_AGENT_ID}`;
+var LOCAL_CODEX_AGENT_KEY = ownedAgentKey(CURRENT_OPERATOR_USER_ID, LOCAL_CODEX_AGENT_ID);
 var AGENT_ALIAS_TO_KEY = {
   nolo: NOLO_DEFAULT_AGENT_KEY,
   default: NOLO_DEFAULT_AGENT_KEY,