nolo-cli 0.33.0-alpha.2 → 0.33.0-alpha.21

package/{chunk-6SXC35F4.js → chunk-RO3AEN3L.js}

@@ -1,17 +1,17 @@
 import {
   addContentToSpace
-} from "./chunk-MPZJVZDC.js";
+} from "./chunk-2UDMTJOM.js";
 import {
   prepareAndPersistMessage,
   uiAskChoiceFunc,
   uiAskChoiceFunctionSchema
-} from "./chunk-73GINUCW.js";
+} from "./chunk-JL2PUYVS.js";
 import {
   require_date_fns
 } from "./chunk-M76ECQRD.js";
 import {
   TOOL_PACKS
-} from "./chunk-WLH5BAKX.js";
+} from "./chunk-YYTTDOWA.js";
 import {
   buildSkillDocMarkdown
 } from "./chunk-AETZ7AD6.js";
@@ -19,14 +19,14 @@ import {
   PLATFORM_HOSTED_DEEPSEEK_FLASH_MODEL,
   PLATFORM_HOSTED_DEEPSEEK_FLASH_PEAK_PRICE,
   PLATFORM_HOSTED_KIMI_PROVIDER
-} from "./chunk-OR2HNLVO.js";
+} from "./chunk-7EPNNOL4.js";
 import {
   read,
   readAndWait,
   removeCachedEntity,
   upsertSSREntity,
   write
-} from "./chunk-57QJXIB6.js";
+} from "./chunk-6YH4UR3E.js";
 import {
   createAgentKey,
   createDialogKey,

package/{chunk-5CS33IBL.js → chunk-RQFO3CAF.js}

@@ -1,6 +1,6 @@
 import {
   getCredentialsDir
-} from "./chunk-JZPBVBIY.js";
+} from "./chunk-QTZD6HBK.js";
 import {
   asNonEmptyStringArray
 } from "./chunk-I42VC5KR.js";
@@ -23,7 +23,6 @@ import {
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
 
 // packages/agent-runtime/credentialBroker.ts
@@ -39,7 +38,7 @@ function assertCredentialRef(ref) {
 }
 
 // packages/agent-runtime/fileCredentialBroker.ts
-function getApiKeyCredentialsDir(homeDir = homedir()) {
+function getApiKeyCredentialsDir(homeDir) {
   return join(getCredentialsDir(homeDir), "keys");
 }
 function credentialRefToFileName(ref) {
@@ -49,7 +48,7 @@ function credentialRefToFileName(ref) {
   }
   return `${safe}.json`;
 }
-function getApiKeyCredentialPath(ref, homeDir = homedir()) {
+function getApiKeyCredentialPath(ref, homeDir) {
   return join(getApiKeyCredentialsDir(homeDir), credentialRefToFileName(ref));
 }
 function ensurePrivateDir(dir) {
@@ -66,7 +65,7 @@ function writePrivateFile(path, body) {
   } catch {
   }
 }
-function readApiKeyCredential(ref, homeDir = homedir()) {
+function readApiKeyCredential(ref, homeDir) {
   const path = getApiKeyCredentialPath(ref, homeDir);
   if (!existsSync(path)) return null;
   try {
@@ -78,7 +77,7 @@ function readApiKeyCredential(ref, homeDir = homedir()) {
     return null;
   }
 }
-function writeApiKeyCredential(ref, secret, homeDir = homedir(), now = Date.now()) {
+function writeApiKeyCredential(ref, secret, homeDir, now = Date.now()) {
   const trimmedSecret = secret.trim();
   if (!trimmedSecret) {
     throw new Error("Cannot store an empty credential secret.");
@@ -94,17 +93,17 @@ function writeApiKeyCredential(ref, secret, homeDir = homedir(), now = Date.now(
   writePrivateFile(path, `${JSON.stringify(payload, null, 2)}
 `);
 }
-function removeApiKeyCredential(ref, homeDir = homedir()) {
+function removeApiKeyCredential(ref, homeDir) {
   assertCredentialRef(ref);
   const path = getApiKeyCredentialPath(ref, homeDir);
   if (!existsSync(path)) return;
   unlinkSync(path);
 }
-function hasApiKeyCredential(ref, homeDir = homedir()) {
+function hasApiKeyCredential(ref, homeDir) {
   return readApiKeyCredential(ref, homeDir) !== null;
 }
 function createFileCredentialBroker(options = {}) {
-  const homeDir = options.homeDir ?? homedir();
+  const homeDir = options.homeDir;
   const now = options.now ?? Date.now;
   return {
     get(ref) {

package/{chunk-GMXWYXAF.js → chunk-SBPGB6TF.js}

@@ -1,6 +1,6 @@
 import {
   updateContentTitle
-} from "./chunk-MPZJVZDC.js";
+} from "./chunk-2UDMTJOM.js";
 import {
   require_date_fns
 } from "./chunk-M76ECQRD.js";
@@ -13,7 +13,7 @@ import {
 import {
   patch,
   readAndWait
-} from "./chunk-57QJXIB6.js";
+} from "./chunk-6YH4UR3E.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -367,7 +367,7 @@ async function saveDocState(arg, { dispatch, getState }) {
   }
 }
 async function createDocState(args, thunkApi) {
-  const { createPageAction } = await import("./createPageAction-5YXOG2M4.js");
+  const { createPageAction } = await import("./createPageAction-HZHQGQO6.js");
   return createPageAction(args, thunkApi);
 }
 function subscribe(listener) {

package/{chunk-FSSX3XRY.js → chunk-U2FRXKC7.js}

@@ -1,7 +1,7 @@
 import {
   fetchReferenceContents,
   resolveReferenceAssets
-} from "./chunk-WHD6BG7M.js";
+} from "./chunk-37LDAHQN.js";
 
 // packages/ai/agent/fetchAgentContexts.ts
 async function fetchAgentContexts(references, dispatch) {

package/{chunk-NUO3QFWD.js → chunk-UNHKVD2N.js}

@@ -4,7 +4,7 @@ import {
 
 // packages/cli/agentCommandSupport.ts
 async function getDefaultCliDb() {
-  const { getDefaultCliLocalRuntimeDb } = await import("./localRuntimeDb-DDZCJFQZ.js");
+  const { getDefaultCliLocalRuntimeDb } = await import("./localRuntimeDb-N3H3HQ7G.js");
   return getDefaultCliLocalRuntimeDb();
 }
 function createNullCliDb() {

package/{chunk-GE6IWA5N.js → chunk-UNZDCI3O.js}

@@ -1,5 +1,13 @@
 // packages/cli/client/profileConfig.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 
@@ -27,6 +35,10 @@ function canonicalizeNoloServerUrl(value) {
 
 // packages/cli/client/profileConfig.ts
 var normalizeProfileServerUrl = canonicalizeNoloServerUrl;
+function isProtectedHomeProfileWrite(path) {
+  if (process.env.NODE_ENV !== "test") return false;
+  return path === join(homedir(), ".nolo", "config.json");
+}
 function getDefaultProfileConfigPath() {
   const noloHome = process.env.NOLO_HOME?.trim();
   return noloHome ? join(noloHome, "config.json") : join(homedir(), ".nolo", "config.json");
@@ -43,6 +55,7 @@ function loadProfileConfig(path = getDefaultProfileConfigPath()) {
   return parsed;
 }
 function clearProfileAuthToken(path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return false;
   const config = loadProfileConfig(path);
   if (!config) return false;
   const profile = config.profiles[config.currentProfile];
@@ -54,6 +67,11 @@ function clearProfileAuthToken(path = getDefaultProfileConfigPath()) {
   return true;
 }
 function saveDefaultProfile(path, profile) {
+  if (isProtectedHomeProfileWrite(path)) {
+    throw new Error(
+      `Refusing to write the developer's real profile from a test process: ${path}. Pass a temp path or set NOLO_HOME.`
+    );
+  }
   const existing = loadProfileConfig(path);
   const mergedDefault = {
     ...existing?.profiles?.default ?? {},
@@ -89,9 +107,11 @@ function buildCliRuntimeEnv(processEnv, config) {
   const profileEnv = buildEnvFromProfile(config);
   const explicitAuthToken = processEnv.AUTH_TOKEN || processEnv.AUTH;
   const explicitServerUrl = processEnv.NOLO_SERVER || processEnv.NOLO_SERVER_URL || processEnv.BASE_URL;
+  const agentSource = processEnv.NOLO_AGENT?.trim() ? "env" : profileEnv.NOLO_AGENT ? "profile" : void 0;
   return {
     ...profileEnv,
     ...processEnv,
+    NOLO_AGENT_SOURCE: agentSource,
     ...explicitAuthToken ? { AUTH_TOKEN: explicitAuthToken } : {},
     ...explicitServerUrl ? {
       NOLO_SERVER: explicitServerUrl,
@@ -104,6 +124,7 @@ function getCurrentProfile(config) {
   return config.profiles[config.currentProfile] ?? null;
 }
 function saveProfileLocale(locale, path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return null;
   const config = loadProfileConfig(path);
   if (!config) return null;
   const profile = config.profiles[config.currentProfile];
@@ -114,13 +135,115 @@ function saveProfileLocale(locale, path = getDefaultProfileConfigPath()) {
 `, "utf8");
   return config;
 }
+function getAgentSelectionAuditPath(configPath = getDefaultProfileConfigPath()) {
+  return join(dirname(configPath), "agent-selection.log");
+}
+var AGENT_SELECTION_AUDIT_MAX_BYTES = 512 * 1024;
+var AGENT_SELECTION_AUDIT_KEEP_LINES = 200;
+var SECRET_ARGV_FLAGS = /* @__PURE__ */ new Set([
+  "--token",
+  "--auth",
+  "--auth-token",
+  "--key",
+  "--api-key",
+  "--app-key",
+  "--machine-key",
+  "--provider-api-key",
+  "--invite-token",
+  "--password",
+  "--secret"
+]);
+function redactArgvSecrets(argv) {
+  const redacted = [];
+  let maskNext = false;
+  for (const arg of argv) {
+    if (maskNext) {
+      maskNext = false;
+      redacted.push("[REDACTED]");
+      continue;
+    }
+    const equals = arg.indexOf("=");
+    if (equals > 0 && SECRET_ARGV_FLAGS.has(arg.slice(0, equals))) {
+      redacted.push(`${arg.slice(0, equals)}=[REDACTED]`);
+      continue;
+    }
+    maskNext = SECRET_ARGV_FLAGS.has(arg);
+    redacted.push(arg);
+  }
+  return redacted;
+}
+function appendAgentSelectionAudit(entry, auditPath = getAgentSelectionAuditPath(entry.configPath)) {
+  try {
+    const stack = (new Error().stack ?? "").split("\n").slice(2, 8).map((line2) => line2.trim()).filter(Boolean);
+    const line = `${JSON.stringify({
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      pid: process.pid,
+      // Distinguishes repo source / installed binary / bundled desktop build —
+      // the field that says whether a stale build is doing the writing.
+      execPath: process.execPath,
+      argv: redactArgvSecrets(process.argv),
+      cwd: process.cwd(),
+      previous: entry.previous,
+      next: entry.next,
+      stack
+    })}
+`;
+    mkdirSync(dirname(auditPath), { recursive: true });
+    const auditMode = 384;
+    if (existsSync(auditPath) && statSync(auditPath).size > AGENT_SELECTION_AUDIT_MAX_BYTES) {
+      const kept = readFileSync(auditPath, "utf8").split("\n").filter((entry2) => entry2.trim()).slice(-AGENT_SELECTION_AUDIT_KEEP_LINES).join("\n");
+      writeFileSync(auditPath, `${kept}
+`, {
+        encoding: "utf8",
+        mode: auditMode
+      });
+    }
+    appendFileSync(auditPath, line, { encoding: "utf8", mode: auditMode });
+    try {
+      chmodSync(auditPath, auditMode);
+    } catch {
+    }
+  } catch {
+  }
+}
+function readLastAgentSelectionAudit(auditPath = getAgentSelectionAuditPath()) {
+  try {
+    if (!existsSync(auditPath)) return { logExists: false, last: null };
+    const lines = readFileSync(auditPath, "utf8").trim().split("\n");
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      const raw = lines[index]?.trim();
+      if (!raw) continue;
+      const parsed = JSON.parse(raw);
+      if (!parsed.next) continue;
+      return {
+        logExists: true,
+        last: {
+          agentKey: parsed.next.agentKey ?? "",
+          agentName: parsed.next.agentName ?? ""
+        }
+      };
+    }
+    return { logExists: true, last: null };
+  } catch {
+    return { logExists: false, last: null };
+  }
+}
 function saveProfileAgentSelection(selection, path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return null;
   const config = loadProfileConfig(path);
   if (!config) return null;
   const profile = config.profiles[config.currentProfile];
   if (!profile) return null;
   const agentKey = selection.agentKey.trim();
   const agentName = selection.agentName.trim();
+  appendAgentSelectionAudit({
+    previous: {
+      ...profile.agentKey ? { agentKey: profile.agentKey } : {},
+      ...profile.agentName ? { agentName: profile.agentName } : {}
+    },
+    next: { agentKey, agentName },
+    configPath: path
+  });
   if (!agentKey) {
     delete profile.agentKey;
     delete profile.agentName;
@@ -143,5 +266,7 @@ export {
   buildCliRuntimeEnv,
   getCurrentProfile,
   saveProfileLocale,
+  getAgentSelectionAuditPath,
+  readLastAgentSelectionAudit,
   saveProfileAgentSelection
 };

package/{chunk-JMPYDFHY.js → chunk-V44VE7R4.js}

@@ -1,6 +1,6 @@
 import {
   getReadableCliDb
-} from "./chunk-NUO3QFWD.js";
+} from "./chunk-UNHKVD2N.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
@@ -12,7 +12,7 @@ import {
 } from "./chunk-YDTYDA5W.js";
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-O6GEBMIY.js";
+} from "./chunk-XTSVOICC.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-EKLRRZIN.js";

package/{chunk-IL545V3E.js → chunk-V4MT7AEN.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-A7GB5UGH.js";
 import {
   createSpaceKey
-} from "./chunk-JTSGWTYZ.js";
+} from "./chunk-KMMQFY5O.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";

package/{chunk-FXFGNOT2.js → chunk-VFVCYIRQ.js}

@@ -1,6 +1,6 @@
 import {
   loadProfileConfig
-} from "./chunk-GE6IWA5N.js";
+} from "./chunk-UNZDCI3O.js";
 import {
   resolveDefaultSpawn
 } from "./chunk-IDZTNRP2.js";

package/chunk-VIRTYWWE.js

@@ -0,0 +1,97 @@
+import {
+  getModelConfig
+} from "./chunk-7SLMYTSF.js";
+import {
+  PLATFORM_HOSTED_KIMI_K3_MODEL,
+  isPlatformHostedClaudeModel,
+  isPlatformHostedDeepseekModel,
+  isPlatformHostedGeminiModel,
+  isPlatformHostedGlmModel,
+  isPlatformHostedGrokModel,
+  isPlatformHostedKimiK26Model
+} from "./chunk-7EPNNOL4.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
+
+// packages/agent-runtime/platformProviderEndpoints.ts
+var OPENAI_RESPONSES_ENDPOINT = "https://api.openai.com/v1/responses";
+var DEEPSEEK_RESPONSES_ENDPOINT = "https://api.deepseek.com/responses";
+var XAI_CHAT_COMPLETIONS_ENDPOINT = "https://api.x.ai/v1/chat/completions";
+var PLATFORM_CHAT_COMPLETIONS_ENDPOINTS = {
+  deepinfra: "https://api.deepinfra.com/v1/openai/chat/completions",
+  fireworks: "https://api.fireworks.ai/inference/v1/chat/completions",
+  google: "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions",
+  openai: "https://api.openai.com/v1/chat/completions",
+  openrouter: "https://openrouter.ai/api/v1/chat/completions",
+  // 千问 AI 平台 OpenAI 兼容模式
+  qwen: "https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions",
+  // Moonshot AI（月之暗面）开放平台 OpenAI 兼容模式（按量计费）
+  moonshot: "https://api.moonshot.cn/v1/chat/completions",
+  // 平台托管 Kimi K3 的实际上游
+  crof: "https://crof.ai/v1/chat/completions"
+  // 无 nolo 默认上游：平台托管模型全部显式分流，未识别模型返回 undefined
+};
+function isOpenAiResponsesModel(args) {
+  const provider = asTrimmedLowercaseString(args.provider);
+  if (provider === "openai") {
+    if (args.endpointKey === "responses") return true;
+    if (!args.model) return false;
+    try {
+      return getModelConfig("openai", args.model).endpointKey === "responses";
+    } catch {
+      return false;
+    }
+  }
+  if (provider === "deepseek" || provider === "nolo" || provider === "ollama-cloud") {
+    if (isPlatformHostedDeepseekModel(args.model)) return true;
+  }
+  return false;
+}
+function resolvePlatformResponsesEndpoint(provider, model) {
+  const normalized = asTrimmedLowercaseString(provider);
+  if (normalized === "openai") return OPENAI_RESPONSES_ENDPOINT;
+  if (normalized === "deepseek" || normalized === "nolo" || normalized === "ollama-cloud") {
+    if (!model || isPlatformHostedDeepseekModel(model)) {
+      return DEEPSEEK_RESPONSES_ENDPOINT;
+    }
+  }
+  return void 0;
+}
+var PLATFORM_PROVIDER_ENDPOINT_ALIASES = {
+  "ollama-cloud": "nolo",
+  deepseek: "nolo"
+};
+function resolvePlatformChatCompletionsEndpoint(provider, model) {
+  const key = asTrimmedLowercaseString(provider);
+  if (!key) return void 0;
+  const aliased = PLATFORM_PROVIDER_ENDPOINT_ALIASES[key] ?? key;
+  if (aliased === "nolo" && isPlatformHostedClaudeModel(model)) {
+    return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.deepinfra;
+  }
+  if (aliased === "nolo" && isPlatformHostedGrokModel(model)) {
+    return XAI_CHAT_COMPLETIONS_ENDPOINT;
+  }
+  if (aliased === "nolo" && (isPlatformHostedKimiK26Model(model) || isPlatformHostedGlmModel(model))) {
+    return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.openrouter;
+  }
+  if (aliased === "nolo" && asTrimmedLowercaseString(model) === PLATFORM_HOSTED_KIMI_K3_MODEL) {
+    return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.crof;
+  }
+  if (aliased === "nolo" && isPlatformHostedGeminiModel(model)) {
+    return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.google;
+  }
+  if (aliased === "nolo" && isPlatformHostedDeepseekModel(model)) {
+    return void 0;
+  }
+  if (aliased === "nolo") {
+    return void 0;
+  }
+  return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS[aliased];
+}
+
+export {
+  isOpenAiResponsesModel,
+  resolvePlatformResponsesEndpoint,
+  resolvePlatformChatCompletionsEndpoint
+};

package/{chunk-ZJMME4DS.js → chunk-XS543SNR.js}

@@ -3,7 +3,7 @@ import {
   createFileCredentialBroker,
   migrateAgentSecrets,
   normalizeAgentRuntimeToolPolicy
-} from "./chunk-5CS33IBL.js";
+} from "./chunk-RQFO3CAF.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -11,7 +11,7 @@ import {
   patch,
   remove,
   write
-} from "./chunk-57QJXIB6.js";
+} from "./chunk-6YH4UR3E.js";
 import {
   createAgentKey,
   toTrimmedString
@@ -304,7 +304,7 @@ var slice = createSliceWithThunks({
       const overrides = {};
       if (args.systemPromptOverride !== void 0) overrides.prompt = args.systemPromptOverride;
       if (args.toolsOverride !== void 0) overrides.tools = args.toolsOverride;
-      const { _executeModel } = await import("./_executeModel-RWPVI3YV.js");
+      const { _executeModel } = await import("./_executeModel-XKWVTZAY.js");
       return _executeModel(
         {
           isStreaming: args.isStreaming ?? false,
@@ -325,7 +325,7 @@ var slice = createSliceWithThunks({
      * - 循环直到无工具调用或触发其他运行时停止条件
      */
     runAgent: create.asyncThunk(async (args, thunkApi) => {
-      const { runAgentClientLoop } = await import("./runAgentClientLoop-U7HYA3O5.js");
+      const { runAgentClientLoop } = await import("./runAgentClientLoop-5I2R74NR.js");
       const { content: loopContent, toolCallCount } = await runAgentClientLoop(
         {
           agentKey: args.agentKey,
@@ -341,7 +341,7 @@ var slice = createSliceWithThunks({
      * 聊天轮次流式 Agent 调用
      */
     streamAgentChatTurn: create.asyncThunk(async (args, thunkApi) => {
-      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-T527EQTT.js");
+      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-UDYSE2ES.js");
       return streamAgentChatTurnHandler(args, thunkApi);
     }),
     /**