nolo-cli 0.32.0 → 0.33.0-alpha.3

package/{chunk-43EPBPZ2.js → chunk-XCCGU6QB.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-M76ECQRD.js";
 import {
   getActiveDialogKey
-} from "./chunk-3ASDTTEI.js";
+} from "./chunk-MRWGHF56.js";
 import {
   patch,
   selectById
-} from "./chunk-LAXMH7JY.js";
+} from "./chunk-57QJXIB6.js";
 import {
   __toESM
 } from "./chunk-4VNS5WPM.js";

package/chunk-Y5GCAMGP.js

@@ -0,0 +1,9 @@
+// packages/core/positiveFiniteNumberOrFallback.ts
+function parsePositiveFiniteNumberOrFallback(value, fallback) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+export {
+  parsePositiveFiniteNumberOrFallback
+};

package/{chunk-V42OE5HT.js → chunk-YDTYDA5W.js}

@@ -1,10 +1,10 @@
 import {
   buildLocalAgentLookupKeys,
   shouldReadAgentKeyRemotely
-} from "./chunk-VVEH6XUE.js";
+} from "./chunk-X2DAEZ3X.js";
 import {
   resolveCliAgentKeyInput
-} from "./chunk-K6QEHQZ3.js";
+} from "./chunk-EKLRRZIN.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -21,7 +21,7 @@ import {
 } from "./chunk-A7GB5UGH.js";
 import {
   createAgentKey
-} from "./chunk-WHLVPK32.js";
+} from "./chunk-KMSZPTM6.js";
 
 // packages/cli/agentRecordHelpers.ts
 import { readFileSync } from "node:fs";

package/chunk-YYLHWIW6.js

@@ -0,0 +1,48 @@
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
+
+// packages/agent-runtime/serverProxyPolicy.ts
+var OAUTH_APIKEY_REFS = /* @__PURE__ */ new Set([
+  "antigravity",
+  "xai",
+  "chatgpt",
+  "claude",
+  "cursor"
+]);
+function isGoogleFamilyProvider(provider) {
+  const normalized = asTrimmedLowercaseString(provider);
+  return normalized === "google" || normalized.startsWith("google-");
+}
+function isOAuthApiKeyRef(value) {
+  const ref = asTrimmedLowercaseString(value);
+  return ref.length > 0 && OAUTH_APIKEY_REFS.has(ref);
+}
+function shouldUseServerProxy(agentConfig, requestProvider) {
+  const effectiveProvider = (requestProvider || agentConfig.provider || "").toLowerCase();
+  if (isGoogleFamilyProvider(effectiveProvider)) {
+    return true;
+  }
+  if (isOAuthApiKeyRef(agentConfig.apiKeyRef)) {
+    return true;
+  }
+  if (agentConfig.apiSource === "custom" && isRemoteCustomEndpoint(agentConfig.customProviderUrl)) {
+    return true;
+  }
+  return !!agentConfig.useServerProxy;
+}
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0.0.0.0"]);
+function isRemoteCustomEndpoint(url) {
+  if (typeof url !== "string") return false;
+  try {
+    const host = new URL(url).hostname.toLowerCase();
+    return !LOCAL_HOSTS.has(host);
+  } catch {
+    return false;
+  }
+}
+
+export {
+  isOAuthApiKeyRef,
+  shouldUseServerProxy
+};

package/{chunk-AOS5IN2I.js → chunk-ZHYK3N56.js}

@@ -2,7 +2,7 @@ import {
   LOCAL_CODEX_AGENT_KEY,
   isLocalCliAgentKey,
   resolveCliAgentKeyInput
-} from "./chunk-K6QEHQZ3.js";
+} from "./chunk-EKLRRZIN.js";
 import {
   DEFAULT_NOLO_SERVER_URL
 } from "./chunk-OLZBQWZU.js";

package/{chunk-ODS2MVMU.js → chunk-ZJMME4DS.js}

@@ -1,6 +1,9 @@
 import {
-  getCredentialsDir
-} from "./chunk-JZPBVBIY.js";
+  applyAgentSecretMigrationUpdates,
+  createFileCredentialBroker,
+  migrateAgentSecrets,
+  normalizeAgentRuntimeToolPolicy
+} from "./chunk-5CS33IBL.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -8,28 +11,19 @@ import {
   patch,
   remove,
   write
-} from "./chunk-LAXMH7JY.js";
+} from "./chunk-57QJXIB6.js";
+import {
+  createAgentKey,
+  toTrimmedString
+} from "./chunk-KMSZPTM6.js";
 import {
   asyncThunkCreator,
   buildCreateSlice,
   getRuntimeServerContext
-} from "./chunk-2IJAKBK2.js";
-import {
-  createAgentKey,
-  toTrimmedString
-} from "./chunk-WHLVPK32.js";
+} from "./chunk-X664KVEV.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
-import {
-  asOptionalPositiveFiniteNumber
-} from "./chunk-U6VC4MU4.js";
-import {
-  isRecord
-} from "./chunk-KUG52IAP.js";
-import {
-  asNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -89,283 +83,6 @@ var sanitizeOptionalModelString = (value) => {
 
 // packages/ai/agent/agentSlice.ts
 import { ulid } from "ulid";
-
-// packages/agent-runtime/fileCredentialBroker.ts
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  unlinkSync,
-  writeFileSync
-} from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-// packages/agent-runtime/credentialBroker.ts
-function assertCredentialRef(ref) {
-  const trimmed = asTrimmedString(ref);
-  if (!trimmed) {
-    throw new Error("invalid_ref");
-  }
-  if (trimmed.includes("..") || trimmed.includes("/") || trimmed.includes("\\")) {
-    throw new Error("invalid_ref");
-  }
-  return trimmed;
-}
-
-// packages/agent-runtime/fileCredentialBroker.ts
-function getApiKeyCredentialsDir(homeDir = homedir()) {
-  return join(getCredentialsDir(homeDir), "keys");
-}
-function credentialRefToFileName(ref) {
-  const safe = assertCredentialRef(ref).replace(/[^a-zA-Z0-9._-]+/g, "_");
-  if (!safe || safe === "." || safe === "..") {
-    throw new Error(`Credential ref is not filesystem-safe: ${ref}`);
-  }
-  return `${safe}.json`;
-}
-function getApiKeyCredentialPath(ref, homeDir = homedir()) {
-  return join(getApiKeyCredentialsDir(homeDir), credentialRefToFileName(ref));
-}
-function ensurePrivateDir(dir) {
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  try {
-    chmodSync(dir, 448);
-  } catch {
-  }
-}
-function writePrivateFile(path, body) {
-  writeFileSync(path, body, { encoding: "utf8", mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
-}
-function readApiKeyCredential(ref, homeDir = homedir()) {
-  const path = getApiKeyCredentialPath(ref, homeDir);
-  if (!existsSync(path)) return null;
-  try {
-    const raw = readFileSync(path, "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed?.secret !== "string" || !parsed.secret) return null;
-    return parsed.secret;
-  } catch {
-    return null;
-  }
-}
-function writeApiKeyCredential(ref, secret, homeDir = homedir(), now = Date.now()) {
-  const trimmedSecret = secret.trim();
-  if (!trimmedSecret) {
-    throw new Error("Cannot store an empty credential secret.");
-  }
-  assertCredentialRef(ref);
-  const dir = getApiKeyCredentialsDir(homeDir);
-  ensurePrivateDir(dir);
-  const path = getApiKeyCredentialPath(ref, homeDir);
-  const payload = {
-    secret: trimmedSecret,
-    updatedAt: now
-  };
-  writePrivateFile(path, `${JSON.stringify(payload, null, 2)}
-`);
-}
-function removeApiKeyCredential(ref, homeDir = homedir()) {
-  assertCredentialRef(ref);
-  const path = getApiKeyCredentialPath(ref, homeDir);
-  if (!existsSync(path)) return;
-  unlinkSync(path);
-}
-function hasApiKeyCredential(ref, homeDir = homedir()) {
-  return readApiKeyCredential(ref, homeDir) !== null;
-}
-function createFileCredentialBroker(options = {}) {
-  const homeDir = options.homeDir ?? homedir();
-  const now = options.now ?? Date.now;
-  return {
-    get(ref) {
-      return readApiKeyCredential(ref, homeDir);
-    },
-    put(ref, secret) {
-      writeApiKeyCredential(ref, secret, homeDir, now());
-    },
-    delete(ref) {
-      removeApiKeyCredential(ref, homeDir);
-    },
-    has(ref) {
-      return hasApiKeyCredential(ref, homeDir);
-    }
-  };
-}
-
-// packages/agent-runtime/migrateAgentSecrets.ts
-function buildAgentApiKeyCredentialRef(agentKey) {
-  const key = asTrimmedString(agentKey);
-  if (!key) throw new Error("agentKey is required to build a credential ref.");
-  return `api-key:${key}`;
-}
-function readRawApiKey(agent) {
-  return asTrimmedString(agent.apiKey);
-}
-function resolveTargetRef(agent) {
-  const fromCredential = asTrimmedString(agent.credentialRef);
-  if (fromCredential) return fromCredential;
-  const fromApiKeyRef = asTrimmedString(agent.apiKeyRef);
-  if (fromApiKeyRef.startsWith("api-key:")) return fromApiKeyRef;
-  return buildAgentApiKeyCredentialRef(agent.key);
-}
-async function brokerHas(broker, ref) {
-  return Boolean(await broker.has(ref));
-}
-async function brokerPut(broker, ref, secret) {
-  await broker.put(ref, secret);
-}
-async function migrateAgentSecrets(args) {
-  const { agent, broker } = args;
-  const raw = readRawApiKey(agent);
-  const migration = asTrimmedString(agent.credentialMigration);
-  if (migration === "done" && !raw) {
-    const ref = typeof agent.credentialRef === "string" && agent.credentialRef.trim() || (typeof agent.apiKeyRef === "string" && agent.apiKeyRef.startsWith("api-key:") ? agent.apiKeyRef.trim() : "") || void 0;
-    return {
-      updates: {},
-      status: "already-done",
-      ...ref ? { credentialRef: ref } : {},
-      phase: "complete"
-    };
-  }
-  if (!raw && migration !== "pending") {
-    return { updates: {}, status: "noop", phase: "none" };
-  }
-  const targetRef = resolveTargetRef(agent);
-  if (raw) {
-    await brokerPut(broker, targetRef, raw);
-    const stored2 = await brokerHas(broker, targetRef);
-    if (!stored2) {
-      return {
-        updates: {
-          credentialRef: targetRef,
-          credentialMigration: "pending"
-        },
-        status: "resumed-pending",
-        credentialRef: targetRef,
-        phase: "put"
-      };
-    }
-    return {
-      updates: {
-        apiKey: null,
-        credentialRef: targetRef,
-        // Keep apiKeyRef for resolution if not already an OAuth provider name.
-        // Prefer explicit credentialRef; set apiKeyRef only when empty so OAuth agents stay intact.
-        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {},
-        credentialMigration: "done"
-      },
-      status: migration === "pending" ? "resumed-pending" : "migrated",
-      credentialRef: targetRef,
-      phase: "strip"
-    };
-  }
-  const stored = await brokerHas(broker, targetRef);
-  if (stored) {
-    return {
-      updates: {
-        credentialRef: targetRef,
-        credentialMigration: "done",
-        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {}
-      },
-      status: "resumed-pending",
-      credentialRef: targetRef,
-      phase: "complete"
-    };
-  }
-  return {
-    updates: {
-      credentialRef: targetRef,
-      credentialMigration: "pending"
-    },
-    status: "awaiting-secret",
-    credentialRef: targetRef,
-    phase: "put"
-  };
-}
-function applyAgentSecretMigrationUpdates(record, updates) {
-  const next = { ...record };
-  if ("apiKey" in updates) {
-    if (updates.apiKey === null || updates.apiKey === "") {
-      delete next.apiKey;
-    } else if (typeof updates.apiKey === "string") {
-      next.apiKey = updates.apiKey;
-    }
-  }
-  if (updates.apiKeyRef !== void 0) next.apiKeyRef = updates.apiKeyRef;
-  if (updates.credentialRef !== void 0) next.credentialRef = updates.credentialRef;
-  if (updates.credentialMigration !== void 0) {
-    next.credentialMigration = updates.credentialMigration;
-  }
-  return next;
-}
-
-// packages/agent-runtime/runtimeToolPolicy.ts
-function unique(values) {
-  return [...new Set(values)];
-}
-function normalizeAgentRuntimeToolPolicy(value) {
-  if (!isRecord(value)) return void 0;
-  return {
-    version: 1,
-    ...asNonEmptyStringArray(value.agentTools).length ? { agentTools: unique(asNonEmptyStringArray(value.agentTools)) } : {},
-    ...asNonEmptyStringArray(value.runtimeTools).length ? { runtimeTools: unique(asNonEmptyStringArray(value.runtimeTools)) } : {},
-    ...isRecord(value.workspace) ? { workspace: { ...value.workspace } } : {},
-    ...isRecord(value.shell) ? { shell: { ...value.shell } } : {},
-    ...isRecord(value.isolation) ? { isolation: { ...value.isolation } } : {},
-    ...isRecord(value.git) ? { git: { ...value.git } } : {},
-    ...isRecord(value.budget) ? { budget: { ...value.budget } } : {},
-    ...isRecord(value.audit) ? { audit: { ...value.audit } } : {}
-  };
-}
-function runtimeBindingRecord(runtimeBinding) {
-  return isRecord(runtimeBinding) ? runtimeBinding : void 0;
-}
-function runtimeToolNamesFromPolicy(policy) {
-  return asNonEmptyStringArray(policy?.runtimeTools);
-}
-function readPositiveNumber(value) {
-  return asOptionalPositiveFiniteNumber(Number(value));
-}
-function resolveRequestedRuntimeToolNames(args) {
-  const runtimeBinding = runtimeBindingRecord(args.agentConfig.runtimeBinding);
-  const bindingPolicy = normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicy
-  );
-  const bindingSnapshotPolicy = normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicySnapshot
-  );
-  return unique([
-    ...asNonEmptyStringArray(args.agentConfig.toolNames),
-    ...runtimeToolNamesFromPolicy(
-      normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy)
-    ),
-    ...runtimeToolNamesFromPolicy(bindingPolicy),
-    ...runtimeToolNamesFromPolicy(bindingSnapshotPolicy)
-  ]);
-}
-function resolveCurrentRunRuntimeToolPolicy(agentConfig) {
-  const runtimeBinding = runtimeBindingRecord(agentConfig?.runtimeBinding);
-  return normalizeAgentRuntimeToolPolicy(
-    runtimeBinding?.runtimeToolPolicySnapshot ?? agentConfig?.runtimeToolPolicy ?? runtimeBinding?.runtimeToolPolicy
-  );
-}
-function resolveLocalRuntimeEnvFromPolicy(runtimeEnv, policy) {
-  return { ...runtimeEnv };
-}
-function resolveLocalWorkspaceExecutorOptionsFromPolicy(policy) {
-  const maxOutputBytes = readPositiveNumber(policy?.shell?.maxOutputBytes);
-  return {
-    ...maxOutputBytes ? { commandOutputLimit: Math.floor(maxOutputBytes) } : {}
-  };
-}
-
-// packages/ai/agent/agentSlice.ts
 var createAgentCredentialBroker = createFileCredentialBroker;
 function setAgentCredentialBrokerFactoryForTests(factory) {
   createAgentCredentialBroker = factory ?? createFileCredentialBroker;
@@ -445,6 +162,10 @@ var processAgentCreateForm = (formData, userId) => {
   if ("provider" in result) {
     result.provider = sanitizeOptionalModelString(result.provider);
   }
+  if ("cliProvider" in result) {
+    const cp = result.cliProvider;
+    result.cliProvider = cp || null;
+  }
   return result;
 };
 var processAgentUpdateChanges = (data, userId, previousAgent) => {
@@ -477,7 +198,7 @@ var processAgentUpdateChanges = (data, userId, previousAgent) => {
     changes.apiSource = data.apiSource;
   }
   if ("cliProvider" in data) {
-    changes.cliProvider = data.cliProvider || "";
+    changes.cliProvider = data.cliProvider || null;
   }
   if ("machineId" in data) {
     const machineId = String(data.machineId ?? "").trim();
@@ -583,7 +304,7 @@ var slice = createSliceWithThunks({
       const overrides = {};
       if (args.systemPromptOverride !== void 0) overrides.prompt = args.systemPromptOverride;
       if (args.toolsOverride !== void 0) overrides.tools = args.toolsOverride;
-      const { _executeModel } = await import("./_executeModel-LTMSIBS4.js");
+      const { _executeModel } = await import("./_executeModel-RWPVI3YV.js");
       return _executeModel(
         {
           isStreaming: args.isStreaming ?? false,
@@ -604,7 +325,7 @@ var slice = createSliceWithThunks({
      * - 循环直到无工具调用或触发其他运行时停止条件
      */
     runAgent: create.asyncThunk(async (args, thunkApi) => {
-      const { runAgentClientLoop } = await import("./runAgentClientLoop-H7U53QB6.js");
+      const { runAgentClientLoop } = await import("./runAgentClientLoop-U7HYA3O5.js");
       const { content: loopContent, toolCallCount } = await runAgentClientLoop(
         {
           agentKey: args.agentKey,
@@ -620,7 +341,7 @@ var slice = createSliceWithThunks({
      * 聊天轮次流式 Agent 调用
      */
     streamAgentChatTurn: create.asyncThunk(async (args, thunkApi) => {
-      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-RQ63QFQ7.js");
+      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-T527EQTT.js");
       return streamAgentChatTurnHandler(args, thunkApi);
     }),
     /**
@@ -846,11 +567,6 @@ var agentSlice_default = agentReducer;
 export {
   fetchServerSyncedCredential,
   deleteServerSyncedCredential,
-  createFileCredentialBroker,
-  resolveRequestedRuntimeToolNames,
-  resolveCurrentRunRuntimeToolPolicy,
-  resolveLocalRuntimeEnvFromPolicy,
-  resolveLocalWorkspaceExecutorOptionsFromPolicy,
   setAgentCredentialBrokerFactoryForTests,
   slice,
   runLlm,

package/{chunk-PJ2DDQQM.js → chunk-ZURFOV5J.js}

@@ -1,9 +1,9 @@
 import {
   buildSkillDiscoveryLayer
-} from "./chunk-DOISARTV.js";
+} from "./chunk-2UECQ7RE.js";
 import {
   load
-} from "./chunk-WZSRQNQG.js";
+} from "./chunk-KHCLMKZZ.js";
 
 // packages/agent-runtime/skillDiscovery.ts
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

package/chunk-ZZ2MH7LE.js

@@ -0,0 +1,84 @@
+// packages/agent-runtime/toolNameAliases.ts
+var LEGACY_TOOL_NAME_ALIASES = {
+  createPage: "createDoc",
+  updatePage: "updateDoc",
+  update_page: "updateDoc",
+  create_page: "createDoc",
+  fetchwebpage: "fetchWebpage",
+  fetch_webpage: "fetchWebpage",
+  "fetch-page": "fetchWebpage",
+  exasearch: "exa_search",
+  "exa-search": "exa_search",
+  exa_search: "exa_search",
+  firecrawlscrape: "firecrawl_scrape",
+  "firecrawl-scrape": "firecrawl_scrape",
+  firecrawl_scrape: "firecrawl_scrape",
+  firecrawlsearch: "firecrawl_search",
+  "firecrawl-search": "firecrawl_search",
+  firecrawl_search: "firecrawl_search",
+  readDoc: "readDoc",
+  readpage: "readDoc",
+  read_page: "readDoc",
+  read_doc: "readDoc",
+  createdoc: "createDoc",
+  updateDocTool: "updateDoc",
+  terminalCommand: "execShell",
+  terminal_command: "execShell",
+  runCommand: "execShell",
+  run_command: "execShell",
+  runInBash: "execShell",
+  run_in_bash: "execShell",
+  executeCommand: "execShell",
+  execute_command: "execShell",
+  // Codex CLI 风格工具名 → nolo 原生工具名
+  bash: "execShell",
+  shell: "execShell",
+  read: "readFile",
+  edit: "editFile",
+  write: "writeFile",
+  glob: "globFiles",
+  grep: "searchFiles",
+  // 联网搜索别名
+  web_search: "exa_search",
+  websearch: "exa_search",
+  search_web: "exa_search",
+  searchweb: "exa_search",
+  webfetch: "fetchWebpage",
+  web_fetch: "fetchWebpage",
+  fetchweb: "fetchWebpage",
+  fetch_web: "fetchWebpage",
+  // 模型偶尔会把 loadSkill 幻觉成 readSkill（参数风格 name= 一致），
+  // 规范化到 loadSkill，避免 localToolPolicy 把这种调用直接拦死。
+  readSkill: "loadSkill"
+};
+var normalizeToolName = (name) => name.replace(/[-_]/g, "").toLowerCase();
+var canonicalizeToolName = (rawName) => {
+  const trimmedName = rawName.trim();
+  if (!trimmedName) return rawName;
+  if (LEGACY_TOOL_NAME_ALIASES[trimmedName]) {
+    return LEGACY_TOOL_NAME_ALIASES[trimmedName];
+  }
+  const normalizedRawName = normalizeToolName(trimmedName);
+  const matchedAlias = Object.entries(LEGACY_TOOL_NAME_ALIASES).find(
+    ([alias]) => normalizeToolName(alias) === normalizedRawName
+  );
+  return matchedAlias?.[1] ?? trimmedName;
+};
+var canonicalizeToolNames = (toolNames) => Array.from(
+  new Set(
+    toolNames.filter((toolName) => typeof toolName === "string").map(canonicalizeToolName)
+  )
+);
+var prioritizeToolNames = (toolNames, preferredToolNames) => {
+  const canonicalTools = canonicalizeToolNames(toolNames);
+  const preferred = new Set(canonicalizeToolNames(preferredToolNames));
+  const prioritized = canonicalTools.filter((toolName) => preferred.has(toolName));
+  const remaining = canonicalTools.filter((toolName) => !preferred.has(toolName));
+  return [...prioritized, ...remaining];
+};
+
+export {
+  canonicalizeToolName,
+  canonicalizeToolNames,
+  prioritizeToolNames
+};

package/{cliExecutor-BBUVQU4L.js → cliExecutor-DW3PHGEL.js}

@@ -12,11 +12,11 @@ import {
   isBufferedCliStreamingProvider,
   materializeCliImageInputs,
   startCliSession
-} from "./chunk-JDSUTNYY.js";
-import "./chunk-JBTJAPUF.js";
+} from "./chunk-SAQQLJZ5.js";
 import {
   buildCliPrompt
 } from "./chunk-ATNTHIZI.js";
+import "./chunk-JBTJAPUF.js";
 import "./chunk-4VNS5WPM.js";
 export {
   CLI_PROBE_BINARIES,