nolo-cli 0.32.0 → 0.33.0-alpha.11

package/{chunk-ODS2MVMU.js → chunk-66CWPJK2.js}

@@ -1,6 +1,9 @@
 import {
-  getCredentialsDir
-} from "./chunk-JZPBVBIY.js";
+  applyAgentSecretMigrationUpdates,
+  createFileCredentialBroker,
+  migrateAgentSecrets,
+  normalizeAgentRuntimeToolPolicy
+} from "./chunk-RQFO3CAF.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -8,28 +11,19 @@ import {
   patch,
   remove,
   write
-} from "./chunk-LAXMH7JY.js";
+} from "./chunk-UM4H3URE.js";
+import {
+  createAgentKey,
+  toTrimmedString
+} from "./chunk-KMSZPTM6.js";
 import {
   asyncThunkCreator,
   buildCreateSlice,
   getRuntimeServerContext
-} from "./chunk-2IJAKBK2.js";
-import {
-  createAgentKey,
-  toTrimmedString
-} from "./chunk-WHLVPK32.js";
+} from "./chunk-X664KVEV.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
-import {
-  asOptionalPositiveFiniteNumber
-} from "./chunk-U6VC4MU4.js";
-import {
-  isRecord
-} from "./chunk-KUG52IAP.js";
-import {
-  asNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -89,283 +83,6 @@ var sanitizeOptionalModelString = (value) => {
 
 // packages/ai/agent/agentSlice.ts
 import { ulid } from "ulid";
-
-// packages/agent-runtime/fileCredentialBroker.ts
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  unlinkSync,
-  writeFileSync
-} from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-// packages/agent-runtime/credentialBroker.ts
-function assertCredentialRef(ref) {
-  const trimmed = asTrimmedString(ref);
-  if (!trimmed) {
-    throw new Error("invalid_ref");
-  }
-  if (trimmed.includes("..") || trimmed.includes("/") || trimmed.includes("\\")) {
-    throw new Error("invalid_ref");
-  }
-  return trimmed;
-}
-
-// packages/agent-runtime/fileCredentialBroker.ts
-function getApiKeyCredentialsDir(homeDir = homedir()) {
-  return join(getCredentialsDir(homeDir), "keys");
-}
-function credentialRefToFileName(ref) {
-  const safe = assertCredentialRef(ref).replace(/[^a-zA-Z0-9._-]+/g, "_");
-  if (!safe || safe === "." || safe === "..") {
-    throw new Error(`Credential ref is not filesystem-safe: ${ref}`);
-  }
-  return `${safe}.json`;
-}
-function getApiKeyCredentialPath(ref, homeDir = homedir()) {
-  return join(getApiKeyCredentialsDir(homeDir), credentialRefToFileName(ref));
-}
-function ensurePrivateDir(dir) {
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  try {
-    chmodSync(dir, 448);
-  } catch {
-  }
-}
-function writePrivateFile(path, body) {
-  writeFileSync(path, body, { encoding: "utf8", mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
-}
-function readApiKeyCredential(ref, homeDir = homedir()) {
-  const path = getApiKeyCredentialPath(ref, homeDir);
-  if (!existsSync(path)) return null;
-  try {
-    const raw = readFileSync(path, "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed?.secret !== "string" || !parsed.secret) return null;
-    return parsed.secret;
-  } catch {
-    return null;
-  }
-}
-function writeApiKeyCredential(ref, secret, homeDir = homedir(), now = Date.now()) {
-  const trimmedSecret = secret.trim();
-  if (!trimmedSecret) {
-    throw new Error("Cannot store an empty credential secret.");
-  }
-  assertCredentialRef(ref);
-  const dir = getApiKeyCredentialsDir(homeDir);
-  ensurePrivateDir(dir);
-  const path = getApiKeyCredentialPath(ref, homeDir);
-  const payload = {
-    secret: trimmedSecret,
-    updatedAt: now
-  };
-  writePrivateFile(path, `${JSON.stringify(payload, null, 2)}
-`);
-}
-function removeApiKeyCredential(ref, homeDir = homedir()) {
-  assertCredentialRef(ref);
-  const path = getApiKeyCredentialPath(ref, homeDir);
-  if (!existsSync(path)) return;
-  unlinkSync(path);
-}
-function hasApiKeyCredential(ref, homeDir = homedir()) {
-  return readApiKeyCredential(ref, homeDir) !== null;
-}
-function createFileCredentialBroker(options = {}) {
-  const homeDir = options.homeDir ?? homedir();
-  const now = options.now ?? Date.now;
-  return {
-    get(ref) {
-      return readApiKeyCredential(ref, homeDir);
-    },
-    put(ref, secret) {
-      writeApiKeyCredential(ref, secret, homeDir, now());
-    },
-    delete(ref) {
-      removeApiKeyCredential(ref, homeDir);
-    },
-    has(ref) {
-      return hasApiKeyCredential(ref, homeDir);
-    }
-  };
-}
-
-// packages/agent-runtime/migrateAgentSecrets.ts
-function buildAgentApiKeyCredentialRef(agentKey) {
-  const key = asTrimmedString(agentKey);
-  if (!key) throw new Error("agentKey is required to build a credential ref.");
-  return `api-key:${key}`;
-}
-function readRawApiKey(agent) {
-  return asTrimmedString(agent.apiKey);
-}
-function resolveTargetRef(agent) {
-  const fromCredential = asTrimmedString(agent.credentialRef);
-  if (fromCredential) return fromCredential;
-  const fromApiKeyRef = asTrimmedString(agent.apiKeyRef);
-  if (fromApiKeyRef.startsWith("api-key:")) return fromApiKeyRef;
-  return buildAgentApiKeyCredentialRef(agent.key);
-}
-async function brokerHas(broker, ref) {
-  return Boolean(await broker.has(ref));
-}
-async function brokerPut(broker, ref, secret) {
-  await broker.put(ref, secret);
-}
-async function migrateAgentSecrets(args) {
-  const { agent, broker } = args;
-  const raw = readRawApiKey(agent);
-  const migration = asTrimmedString(agent.credentialMigration);
-  if (migration === "done" && !raw) {
-    const ref = typeof agent.credentialRef === "string" && agent.credentialRef.trim() || (typeof agent.apiKeyRef === "string" && agent.apiKeyRef.startsWith("api-key:") ? agent.apiKeyRef.trim() : "") || void 0;
-    return {
-      updates: {},
-      status: "already-done",
-      ...ref ? { credentialRef: ref } : {},
-      phase: "complete"
-    };
-  }
-  if (!raw && migration !== "pending") {
-    return { updates: {}, status: "noop", phase: "none" };
-  }
-  const targetRef = resolveTargetRef(agent);
-  if (raw) {
-    await brokerPut(broker, targetRef, raw);
-    const stored2 = await brokerHas(broker, targetRef);
-    if (!stored2) {
-      return {
-        updates: {
-          credentialRef: targetRef,
-          credentialMigration: "pending"
-        },
-        status: "resumed-pending",
-        credentialRef: targetRef,
-        phase: "put"
-      };
-    }
-    return {
-      updates: {
-        apiKey: null,
-        credentialRef: targetRef,
-        // Keep apiKeyRef for resolution if not already an OAuth provider name.
-        // Prefer explicit credentialRef; set apiKeyRef only when empty so OAuth agents stay intact.
-        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {},
-        credentialMigration: "done"
-      },
-      status: migration === "pending" ? "resumed-pending" : "migrated",
-      credentialRef: targetRef,
-      phase: "strip"
-    };
-  }
-  const stored = await brokerHas(broker, targetRef);
-  if (stored) {
-    return {
-      updates: {
-        credentialRef: targetRef,
-        credentialMigration: "done",
-        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {}
-      },
-      status: "resumed-pending",
-      credentialRef: targetRef,
-      phase: "complete"
-    };
-  }
-  return {
-    updates: {
-      credentialRef: targetRef,
-      credentialMigration: "pending"
-    },
-    status: "awaiting-secret",
-    credentialRef: targetRef,
-    phase: "put"
-  };
-}
-function applyAgentSecretMigrationUpdates(record, updates) {
-  const next = { ...record };
-  if ("apiKey" in updates) {
-    if (updates.apiKey === null || updates.apiKey === "") {
-      delete next.apiKey;
-    } else if (typeof updates.apiKey === "string") {
-      next.apiKey = updates.apiKey;
-    }
-  }
-  if (updates.apiKeyRef !== void 0) next.apiKeyRef = updates.apiKeyRef;
-  if (updates.credentialRef !== void 0) next.credentialRef = updates.credentialRef;
-  if (updates.credentialMigration !== void 0) {
-    next.credentialMigration = updates.credentialMigration;
-  }
-  return next;
-}
-
-// packages/agent-runtime/runtimeToolPolicy.ts
-function unique(values) {
-  return [...new Set(values)];
-}
-function normalizeAgentRuntimeToolPolicy(value) {
-  if (!isRecord(value)) return void 0;
-  return {
-    version: 1,
-    ...asNonEmptyStringArray(value.agentTools).length ? { agentTools: unique(asNonEmptyStringArray(value.agentTools)) } : {},
-    ...asNonEmptyStringArray(value.runtimeTools).length ? { runtimeTools: unique(asNonEmptyStringArray(value.runtimeTools)) } : {},
-    ...isRecord(value.workspace) ? { workspace: { ...value.workspace } } : {},
-    ...isRecord(value.shell) ? { shell: { ...value.shell } } : {},
-    ...isRecord(value.isolation) ? { isolation: { ...value.isolation } } : {},
-    ...isRecord(value.git) ? { git: { ...value.git } } : {},
-    ...isRecord(value.budget) ? { budget: { ...value.budget } } : {},
-    ...isRecord(value.audit) ? { audit: { ...value.audit } } : {}
-  };
-}
-function runtimeBindingRecord(runtimeBinding) {
-  return isRecord(runtimeBinding) ? runtimeBinding : void 0;
-}
-function runtimeToolNamesFromPolicy(policy) {
-  return asNonEmptyStringArray(policy?.runtimeTools);
-}
-function readPositiveNumber(value) {
-  return asOptionalPositiveFiniteNumber(Number(value));
-}
-function resolveRequestedRuntimeToolNames(args) {
-  const runtimeBinding = runtimeBindingRecord(args.agentConfig.runtimeBinding);
-  const bindingPolicy = normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicy
-  );
-  const bindingSnapshotPolicy = normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicySnapshot
-  );
-  return unique([
-    ...asNonEmptyStringArray(args.agentConfig.toolNames),
-    ...runtimeToolNamesFromPolicy(
-      normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy)
-    ),
-    ...runtimeToolNamesFromPolicy(bindingPolicy),
-    ...runtimeToolNamesFromPolicy(bindingSnapshotPolicy)
-  ]);
-}
-function resolveCurrentRunRuntimeToolPolicy(agentConfig) {
-  const runtimeBinding = runtimeBindingRecord(agentConfig?.runtimeBinding);
-  return normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicySnapshot ?? agentConfig?.runtimeToolPolicy ?? runtimeBinding?.runtimeToolPolicy
-  );
-}
-function resolveLocalRuntimeEnvFromPolicy(runtimeEnv, policy) {
-  return { ...runtimeEnv };
-}
-function resolveLocalWorkspaceExecutorOptionsFromPolicy(policy) {
-  const maxOutputBytes = readPositiveNumber(policy?.shell?.maxOutputBytes);
-  return {
-    ...maxOutputBytes ? { commandOutputLimit: Math.floor(maxOutputBytes) } : {}
-  };
-}
-
-// packages/ai/agent/agentSlice.ts
 var createAgentCredentialBroker = createFileCredentialBroker;
 function setAgentCredentialBrokerFactoryForTests(factory) {
   createAgentCredentialBroker = factory ?? createFileCredentialBroker;
@@ -445,6 +162,10 @@ var processAgentCreateForm = (formData, userId) => {
   if ("provider" in result) {
     result.provider = sanitizeOptionalModelString(result.provider);
   }
+  if ("cliProvider" in result) {
+    const cp = result.cliProvider;
+    result.cliProvider = cp || null;
+  }
   return result;
 };
 var processAgentUpdateChanges = (data, userId, previousAgent) => {
@@ -477,7 +198,7 @@ var processAgentUpdateChanges = (data, userId, previousAgent) => {
     changes.apiSource = data.apiSource;
   }
   if ("cliProvider" in data) {
-    changes.cliProvider = data.cliProvider || "";
+    changes.cliProvider = data.cliProvider || null;
   }
   if ("machineId" in data) {
     const machineId = String(data.machineId ?? "").trim();
@@ -583,7 +304,7 @@ var slice = createSliceWithThunks({
       const overrides = {};
       if (args.systemPromptOverride !== void 0) overrides.prompt = args.systemPromptOverride;
       if (args.toolsOverride !== void 0) overrides.tools = args.toolsOverride;
-      const { _executeModel } = await import("./_executeModel-LTMSIBS4.js");
+      const { _executeModel } = await import("./_executeModel-YXWAXPWQ.js");
       return _executeModel(
         {
           isStreaming: args.isStreaming ?? false,
@@ -604,7 +325,7 @@ var slice = createSliceWithThunks({
      * - 循环直到无工具调用或触发其他运行时停止条件
      */
     runAgent: create.asyncThunk(async (args, thunkApi) => {
-      const { runAgentClientLoop } = await import("./runAgentClientLoop-H7U53QB6.js");
+      const { runAgentClientLoop } = await import("./runAgentClientLoop-Y5UW544I.js");
       const { content: loopContent, toolCallCount } = await runAgentClientLoop(
         {
           agentKey: args.agentKey,
@@ -620,7 +341,7 @@ var slice = createSliceWithThunks({
      * 聊天轮次流式 Agent 调用
      */
     streamAgentChatTurn: create.asyncThunk(async (args, thunkApi) => {
-      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-RQ63QFQ7.js");
+      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-7DU4Z2VJ.js");
       return streamAgentChatTurnHandler(args, thunkApi);
     }),
     /**
@@ -846,11 +567,6 @@ var agentSlice_default = agentReducer;
 export {
   fetchServerSyncedCredential,
   deleteServerSyncedCredential,
-  createFileCredentialBroker,
-  resolveRequestedRuntimeToolNames,
-  resolveCurrentRunRuntimeToolPolicy,
-  resolveLocalRuntimeEnvFromPolicy,
-  resolveLocalWorkspaceExecutorOptionsFromPolicy,
   setAgentCredentialBrokerFactoryForTests,
   slice,
   runLlm,

package/{chunk-PTHDLIRB.js → chunk-6KOS7ZBZ.js}

@@ -1,7 +1,7 @@
 import {
   generatePkcePair,
   startCallbackServer
-} from "./chunk-SFWZUTCI.js";
+} from "./chunk-VBUQYOX7.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";

package/{chunk-MXFQHRSS.js → chunk-6XIE5ZGI.js}

@@ -1,6 +1,6 @@
 import {
   buildSkillDocMarkdown
-} from "./chunk-ZWJOGMKH.js";
+} from "./chunk-AETZ7AD6.js";
 
 // packages/cli/docPageHelpers.ts
 import { readFileSync } from "node:fs";

package/{chunk-ATK5WJOA.js → chunk-6YXDOOSH.js}

@@ -1,15 +1,15 @@
 import {
   selectCurrentServer
-} from "./chunk-G5GVZAXF.js";
+} from "./chunk-UNOTBWZZ.js";
 import {
   patch
-} from "./chunk-LAXMH7JY.js";
+} from "./chunk-UM4H3URE.js";
 import {
   selectIdentityToken
-} from "./chunk-2IJAKBK2.js";
+} from "./chunk-X664KVEV.js";
 import {
   getIsDesktopApp
-} from "./chunk-5RDLGLAP.js";
+} from "./chunk-WJSW43QZ.js";
 
 // packages/ai/agent/cliChatClient.ts
 function getCliChatRequestConfig(thunkApi) {

package/{chunk-SWYMCHM7.js → chunk-75U775RZ.js}

@@ -1,3 +1,7 @@
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+
 // packages/create/editor/transforms/slateToSimplifiedMarkdown.ts
 function renderTextNode(node) {
   if (!node || typeof node.text !== "string") return "";
@@ -148,6 +152,70 @@ function slateToSimplifiedMarkdown(nodes, options = {}) {
   return nodes.map((node) => renderNode(node, 0, options)).join("").trim() + "\n";
 }
 
+// packages/ai/tools/readDocTool.ts
+var readDocFunctionSchema = {
+  name: "readDoc",
+  description: [
+    "\u8BFB\u53D6\u6307\u5B9A\u9875\u9762\u7684\u5185\u5BB9\uFF0C\u5E76\u5C06\u7ED3\u6784\u5316\u7684\u6570\u636E\u8F6C\u6362\u4E3A Markdown \u683C\u5F0F\u8FD4\u56DE\u3002",
+    "\u5982\u679C\u4F60\u62FF\u5230\u4E86\u9875\u9762\u7684 dbKey\uFF08\u5982 page-xxx\uFF09\uFF0C\u8BF7\u4F7F\u7528\u6B64\u5DE5\u5177\u67E5\u770B\u9875\u9762\u5185\u5BB9\u3002"
+  ].join("\n"),
+  parameters: {
+    type: "object",
+    properties: {
+      id: {
+        type: "string",
+        description: "\u9875\u9762/\u6587\u6863\u7684\u6570\u636E\u5E93\u952E\uFF08dbKey\uFF09\uFF0C\u4F8B\u5982 page-xxx\u3002"
+      }
+    },
+    required: ["id"]
+  }
+};
+var readPageFunctionSchema = {
+  ...readDocFunctionSchema,
+  name: "readPage"
+};
+var buildReadDocResult = (pageData) => {
+  const markdownContent = slateToSimplifiedMarkdown(pageData.slateData || []);
+  const rawData = {
+    success: true,
+    id: pageData.dbKey,
+    title: pageData.title,
+    content: markdownContent,
+    metadata: {
+      spaceId: pageData.spaceId,
+      created: pageData.created
+    }
+  };
+  const displayData = `\u5DF2\u6210\u529F\u8BFB\u53D6\u9875\u9762\u300A${pageData.title}\u300B\u3002
+
+\u5185\u5BB9\u5982\u4E0B\uFF1A
+
+${markdownContent}`;
+  return { rawData, displayData };
+};
+async function readDocFunc(args, thunkApi) {
+  const id = args.id ?? args.doc ?? args.docKey ?? args.pageKey ?? args.key;
+  if (!id || !id.toLowerCase().startsWith("page-")) {
+    throw new Error(`\u65E0\u6548\u7684\u9875\u9762 ID: ${id}\u3002\u9875\u9762 ID \u901A\u5E38\u4EE5 "page-" \u5F00\u5934\u3002`);
+  }
+  try {
+    const { readAction } = await import("./read-2VHEHCAN.js");
+    const pageData = await readAction({ dbKey: id }, thunkApi);
+    if (!pageData) {
+      throw new Error(`\u672A\u627E\u5230 ID \u4E3A ${id} \u7684\u9875\u9762\u3002`);
+    }
+    return buildReadDocResult(pageData);
+  } catch (error) {
+    throw new Error(`\u8BFB\u53D6\u9875\u9762\u65F6\u51FA\u9519: ${toErrorMessage(error)}`);
+  }
+}
+var readPageFunc = readDocFunc;
+
 export {
-  slateToSimplifiedMarkdown
+  slateToSimplifiedMarkdown,
+  readDocFunctionSchema,
+  readPageFunctionSchema,
+  buildReadDocResult,
+  readDocFunc,
+  readPageFunc
 };

package/{chunk-UDA3ZYLW.js → chunk-7YYHKBJP.js}

@@ -1,19 +1,17 @@
 import {
-  getModelConfig
-} from "./chunk-2K4NDPT5.js";
-import {
-  isPlatformHostedClaudeModel,
-  isPlatformHostedGrokModel
-} from "./chunk-CAENRKNJ.js";
+  isOpenAiResponsesModel,
+  resolvePlatformChatCompletionsEndpoint,
+  resolvePlatformResponsesEndpoint
+} from "./chunk-CPYYM4RJ.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
-import {
-  normalizeServerOrigin
-} from "./chunk-CF7PE763.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
+import {
+  normalizeServerOrigin
+} from "./chunk-CF7PE763.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -30,68 +28,10 @@ function pickAgentRuntimeInferenceOptions(agentConfig) {
   };
 }
 
-// packages/agent-runtime/platformProviderEndpoints.ts
-var OPENAI_RESPONSES_ENDPOINT = "https://api.openai.com/v1/responses";
-var DEEPSEEK_RESPONSES_ENDPOINT = "https://api.deepseek.com/responses";
-var XAI_CHAT_COMPLETIONS_ENDPOINT = "https://api.x.ai/v1/chat/completions";
-var PLATFORM_CHAT_COMPLETIONS_ENDPOINTS = {
-  deepinfra: "https://api.deepinfra.com/v1/openai/chat/completions",
-  fireworks: "https://api.fireworks.ai/inference/v1/chat/completions",
-  google: "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions",
-  openai: "https://api.openai.com/v1/chat/completions",
-  openrouter: "https://openrouter.ai/api/v1/chat/completions",
-  // 千问 AI 平台 OpenAI 兼容模式
-  qwen: "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions",
-  // Moonshot AI（月之暗面）开放平台 OpenAI 兼容模式（按量计费）
-  moonshot: "https://api.moonshot.cn/v1/chat/completions",
-  // Non-DeepSeek hosted models use Ollama Cloud. DeepSeek Flash is routed
-  // separately to the official DeepSeek Responses endpoint.
-  nolo: "https://ollama.com/v1/chat/completions"
-};
-function isOpenAiResponsesModel(args) {
-  const provider = asTrimmedLowercaseString(args.provider);
-  if (provider === "nolo" || provider === "deepseek") {
-    const model = args.model?.trim().toLowerCase();
-    return model === "deepseek-v4-flash" || model === "deepseek-v4-pro";
-  }
-  if (provider !== "openai") return false;
-  if (args.endpointKey === "responses") return true;
-  if (!args.model) return false;
-  try {
-    return getModelConfig("openai", args.model).endpointKey === "responses";
-  } catch {
-    return false;
-  }
-}
-function resolvePlatformResponsesEndpoint(provider) {
-  const normalized = asTrimmedLowercaseString(provider);
-  if (normalized === "openai") return OPENAI_RESPONSES_ENDPOINT;
-  if (normalized === "nolo" || normalized === "deepseek") {
-    return DEEPSEEK_RESPONSES_ENDPOINT;
-  }
-  return void 0;
-}
-var PLATFORM_PROVIDER_ENDPOINT_ALIASES = {
-  "ollama-cloud": "nolo",
-  deepseek: "nolo"
-};
-function resolvePlatformChatCompletionsEndpoint(provider, model) {
-  const key = asTrimmedLowercaseString(provider);
-  if (!key) return void 0;
-  const aliased = PLATFORM_PROVIDER_ENDPOINT_ALIASES[key] ?? key;
-  if (aliased === "nolo" && isPlatformHostedClaudeModel(model)) {
-    return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.deepinfra;
-  }
-  if (aliased === "nolo" && isPlatformHostedGrokModel(model)) {
-    return XAI_CHAT_COMPLETIONS_ENDPOINT;
-  }
-  return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS[aliased];
-}
-
 // packages/agent-runtime/providerResolution.ts
 function resolvePlatformProviderEndpoint(agentConfig) {
   const customProviderUrl = agentConfig.customProviderUrl?.trim();
-  if (customProviderUrl) return resolveChatCompletionsEndpoint(customProviderUrl);
+  if (customProviderUrl) return resolveCustomProviderEndpoint(customProviderUrl);
   const provider = asTrimmedLowercaseString(
     agentConfig.provider ?? agentConfig.apiSource ?? "openai"
   );
@@ -132,6 +72,14 @@ function resolveChatCompletionsEndpoint(value) {
   const trimmed = trimTrailingSlash(value);
   return trimmed.endsWith("/chat/completions") ? trimmed : `${trimmed}/chat/completions`;
 }
+function resolveCustomProviderEndpoint(value) {
+  const trimmed = trimTrailingSlash(value);
+  if (!trimmed) return "";
+  if (/\/responses$/i.test(trimmed) || /\/chat\/completions$/i.test(trimmed)) {
+    return trimmed;
+  }
+  return `${trimmed}/chat/completions`;
+}
 function resolveOpenAiCompatibleBaseUrl(env) {
   return env.NOLO_LOCAL_OPENAI_BASE_URL || env.OPENAI_BASE_URL || "https://api.openai.com/v1";
 }
@@ -232,7 +180,7 @@ async function buildProviderExecutionPlan(args) {
     };
   }
   if (mode === "custom") {
-    const endpoint2 = resolveChatCompletionsEndpoint(agentConfig.customProviderUrl || resolveOpenAiCompatibleBaseUrl(env));
+    const endpoint2 = resolveCustomProviderEndpoint(agentConfig.customProviderUrl || resolveOpenAiCompatibleBaseUrl(env));
     let apiKey2 = "";
     const credentialRef2 = agentConfig.credentialRef?.trim();
     const apiKeyRef = agentConfig.apiKeyRef?.trim();
@@ -263,6 +211,20 @@ async function buildProviderExecutionPlan(args) {
         apiKey2 = trimmed;
       }
     }
+    if (!apiKey2 && apiKeyRef && apiKeyRef.startsWith("provider-key:") && args.syncFetcher) {
+      try {
+        const shared = await args.syncFetcher(apiKeyRef);
+        const trimmed = asTrimmedString(shared);
+        if (trimmed) {
+          try {
+            await args.credentialBroker?.put(apiKeyRef, trimmed);
+          } catch {
+          }
+          apiKey2 = trimmed;
+        }
+      } catch {
+      }
+    }
     if (!apiKey2 && apiKeyRef && args.apiKeyRefResolver) {
       const resolved = await args.apiKeyRefResolver(apiKeyRef);
       if (resolved) {
@@ -365,9 +327,6 @@ async function buildProviderExecutionPlan(args) {
 
 export {
   pickAgentRuntimeInferenceOptions,
-  isOpenAiResponsesModel,
-  resolvePlatformResponsesEndpoint,
-  resolvePlatformChatCompletionsEndpoint,
   trimTrailingSlash,
   resolvePlatformServerUrl,
   resolvePlatformAuthToken,