nolo-cli 0.33.0-alpha.8 → 0.34.0-alpha.1

package/{chunk-CHYAYZJH.js → chunk-OSCSEJJR.js}

@@ -23,7 +23,7 @@ import {
   shouldStripReasoningContentForOutbound,
   toOpenAiCompatibleMessages,
   toResponsesTools
-} from "./chunk-NNWHHCVP.js";
+} from "./chunk-BMB563Y6.js";
 import {
   buildProviderExecutionPlan,
   canUsePlatformChatProvider,
@@ -32,10 +32,10 @@ import {
   resolvePlatformAuthToken,
   resolvePlatformServerUrl,
   resolveProviderTransportDecision
-} from "./chunk-7YYHKBJP.js";
+} from "./chunk-GKHV4UH5.js";
 import {
   clipCompactText
-} from "./chunk-AOXVOC6D.js";
+} from "./chunk-FGLKRJDI.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
@@ -339,15 +339,22 @@ async function* readSseFrames(response) {
     const { done, value } = await reader.read();
     if (done) break;
     buffer += decoder.decode(value, { stream: true });
-    let boundary = buffer.indexOf("\n\n");
-    while (boundary !== -1) {
-      yield buffer.slice(0, boundary);
-      buffer = buffer.slice(boundary + 2);
-      boundary = buffer.indexOf("\n\n");
+    let boundary = findSseFrameBoundary(buffer);
+    while (boundary) {
+      yield buffer.slice(0, boundary.index);
+      buffer = buffer.slice(boundary.index + boundary.separatorLength);
+      boundary = findSseFrameBoundary(buffer);
     }
   }
   if (buffer.trim()) yield buffer;
 }
+function findSseFrameBoundary(buffer) {
+  const lfLf = buffer.indexOf("\n\n");
+  const crLfCrLf = buffer.indexOf("\r\n\r\n");
+  if (lfLf === -1 && crLfCrLf === -1) return null;
+  const useLf = lfLf !== -1 && (crLfCrLf === -1 || lfLf < crLfCrLf);
+  return useLf ? { index: lfLf, separatorLength: 2 } : { index: crLfCrLf, separatorLength: 4 };
+}
 async function* streamSseDataValues(response, parse) {
   const reader = response.body?.getReader();
   if (!reader) return;

package/{chunk-SCUETSRP.js → chunk-PV734VZX.js}

@@ -1,6 +1,6 @@
 import {
   trimTrailingSlash
-} from "./chunk-7YYHKBJP.js";
+} from "./chunk-GKHV4UH5.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";

package/{chunk-7E72JMBB.js → chunk-SMPAUSX5.js}

@@ -1,9 +1,9 @@
 import {
   resolveMachineId
-} from "./chunk-6HYVJV7B.js";
+} from "./chunk-ESHYE7WU.js";
 import {
   getDefaultCliLocalRuntimeDb
-} from "./chunk-Q5ITEGIN.js";
+} from "./chunk-N4XRDM26.js";
 import {
   buildCliRuntimeEnv,
   clearProfileAuthToken,
@@ -11,7 +11,7 @@ import {
   getDefaultProfileConfigPath,
   loadProfileConfig,
   saveDefaultProfile
-} from "./chunk-GE6IWA5N.js";
+} from "./chunk-UNZDCI3O.js";
 import {
   resolveAuthTokenFromEnv
 } from "./chunk-A7GB5UGH.js";
@@ -23,7 +23,7 @@ import {
   createMemoryOwnerIndexKey,
   createMemorySubjectKindIndexKey,
   memoryOwnerRange
-} from "./chunk-KMSZPTM6.js";
+} from "./chunk-2WKUUY2E.js";
 import {
   asTrimmedNonEmptyStringArray
 } from "./chunk-I42VC5KR.js";
@@ -40,6 +40,20 @@ import { stdin as input, stdout as output } from "node:process";
 import { spawn } from "node:child_process";
 
 // packages/ai/memory/delete.ts
+function hasExplicitDeleteFilters(filters) {
+  return Boolean(
+    filters.ids && filters.ids.length > 0 || typeof filters.contentSubstring === "string" && filters.contentSubstring.trim().length > 0 || filters.tags && filters.tags.length > 0 || typeof filters.sourceDialogId === "string" && filters.sourceDialogId.trim().length > 0 || typeof filters.patternKeyPrefix === "string" && filters.patternKeyPrefix.trim().length > 0 || filters.facets && filters.facets.length > 0 || typeof filters.subjectId === "string" && filters.subjectId.trim().length > 0
+  );
+}
+function generateMemoryDeletionToken(ownerId, itemIds) {
+  const sorted = [...itemIds].sort().join(",");
+  const seed = `${ownerId}:${sorted}`;
+  let hash = 0;
+  for (let i = 0; i < seed.length; i++) {
+    hash = (hash << 5) - hash + seed.charCodeAt(i) | 0;
+  }
+  return `tok-${Math.abs(hash).toString(36)}-${itemIds.length}`;
+}
 var normalizeSet = (values) => {
   if (!Array.isArray(values) || values.length === 0) return null;
   const normalized = asTrimmedNonEmptyStringArray(values);
@@ -66,6 +80,10 @@ var matchesFilters = (item, filters) => {
       if (!itemTags.has(tag)) return false;
     }
   }
+  const contentSub = asTrimmedString(filters.contentSubstring);
+  if (contentSub && !(item.content ?? "").toLowerCase().includes(contentSub.toLowerCase())) {
+    return false;
+  }
   return true;
 };
 var deleteMemoryItemWithIndexesInBatch = (batch, item) => {
@@ -89,6 +107,11 @@ var deleteMemoryItemWithIndexesInBatch = (batch, item) => {
   );
 };
 var deleteMemoriesForOwnerFromDb = async (db, owner, filters = {}) => {
+  if (!hasExplicitDeleteFilters(filters)) {
+    throw new Error(
+      "At least one filter is required; delete operation will not delete all memory implicitly."
+    );
+  }
   const range = memoryOwnerRange(owner.ownerType, owner.ownerId);
   const matchedItems = [];
   const limit = typeof filters.limit === "number" && filters.limit > 0 ? filters.limit : Number.POSITIVE_INFINITY;
@@ -108,6 +131,23 @@ var deleteMemoriesForOwnerFromDb = async (db, owner, filters = {}) => {
   if (matchedItems.length === 0) {
     return { deletedCount: 0, deletedIds: [], matchedItems: [] };
   }
+  const token = generateMemoryDeletionToken(
+    owner.ownerId,
+    matchedItems.map((i) => i.id)
+  );
+  if (filters.dryRun) {
+    return {
+      deletedCount: 0,
+      deletedIds: [],
+      matchedItems,
+      deletionToken: token
+    };
+  }
+  if (filters.deletionToken && filters.deletionToken !== token) {
+    throw new Error(
+      "deletionToken mismatch: memory dataset changed since preview; please rerun dry-run preview before confirming."
+    );
+  }
   const batch = db.batch();
   for (const item of matchedItems) {
     deleteMemoryItemWithIndexesInBatch(batch, item);
@@ -116,7 +156,8 @@ var deleteMemoriesForOwnerFromDb = async (db, owner, filters = {}) => {
   return {
     deletedCount: matchedItems.length,
     deletedIds: matchedItems.map((item) => item.id),
-    matchedItems
+    matchedItems,
+    deletionToken: token
   };
 };
 

package/{chunk-XCCGU6QB.js → chunk-U6QQLXWI.js}

@@ -7,7 +7,7 @@ import {
 import {
   patch,
   selectById
-} from "./chunk-57QJXIB6.js";
+} from "./chunk-23KKIMD5.js";
 import {
   __toESM
 } from "./chunk-4VNS5WPM.js";

package/{chunk-NUO3QFWD.js → chunk-UNHKVD2N.js}

@@ -4,7 +4,7 @@ import {
 
 // packages/cli/agentCommandSupport.ts
 async function getDefaultCliDb() {
-  const { getDefaultCliLocalRuntimeDb } = await import("./localRuntimeDb-DDZCJFQZ.js");
+  const { getDefaultCliLocalRuntimeDb } = await import("./localRuntimeDb-N3H3HQ7G.js");
   return getDefaultCliLocalRuntimeDb();
 }
 function createNullCliDb() {

package/{chunk-GE6IWA5N.js → chunk-UNZDCI3O.js}

@@ -1,5 +1,13 @@
 // packages/cli/client/profileConfig.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 
@@ -27,6 +35,10 @@ function canonicalizeNoloServerUrl(value) {
 
 // packages/cli/client/profileConfig.ts
 var normalizeProfileServerUrl = canonicalizeNoloServerUrl;
+function isProtectedHomeProfileWrite(path) {
+  if (process.env.NODE_ENV !== "test") return false;
+  return path === join(homedir(), ".nolo", "config.json");
+}
 function getDefaultProfileConfigPath() {
   const noloHome = process.env.NOLO_HOME?.trim();
   return noloHome ? join(noloHome, "config.json") : join(homedir(), ".nolo", "config.json");
@@ -43,6 +55,7 @@ function loadProfileConfig(path = getDefaultProfileConfigPath()) {
   return parsed;
 }
 function clearProfileAuthToken(path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return false;
   const config = loadProfileConfig(path);
   if (!config) return false;
   const profile = config.profiles[config.currentProfile];
@@ -54,6 +67,11 @@ function clearProfileAuthToken(path = getDefaultProfileConfigPath()) {
   return true;
 }
 function saveDefaultProfile(path, profile) {
+  if (isProtectedHomeProfileWrite(path)) {
+    throw new Error(
+      `Refusing to write the developer's real profile from a test process: ${path}. Pass a temp path or set NOLO_HOME.`
+    );
+  }
   const existing = loadProfileConfig(path);
   const mergedDefault = {
     ...existing?.profiles?.default ?? {},
@@ -89,9 +107,11 @@ function buildCliRuntimeEnv(processEnv, config) {
   const profileEnv = buildEnvFromProfile(config);
   const explicitAuthToken = processEnv.AUTH_TOKEN || processEnv.AUTH;
   const explicitServerUrl = processEnv.NOLO_SERVER || processEnv.NOLO_SERVER_URL || processEnv.BASE_URL;
+  const agentSource = processEnv.NOLO_AGENT?.trim() ? "env" : profileEnv.NOLO_AGENT ? "profile" : void 0;
   return {
     ...profileEnv,
     ...processEnv,
+    NOLO_AGENT_SOURCE: agentSource,
     ...explicitAuthToken ? { AUTH_TOKEN: explicitAuthToken } : {},
     ...explicitServerUrl ? {
       NOLO_SERVER: explicitServerUrl,
@@ -104,6 +124,7 @@ function getCurrentProfile(config) {
   return config.profiles[config.currentProfile] ?? null;
 }
 function saveProfileLocale(locale, path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return null;
   const config = loadProfileConfig(path);
   if (!config) return null;
   const profile = config.profiles[config.currentProfile];
@@ -114,13 +135,115 @@ function saveProfileLocale(locale, path = getDefaultProfileConfigPath()) {
 `, "utf8");
   return config;
 }
+function getAgentSelectionAuditPath(configPath = getDefaultProfileConfigPath()) {
+  return join(dirname(configPath), "agent-selection.log");
+}
+var AGENT_SELECTION_AUDIT_MAX_BYTES = 512 * 1024;
+var AGENT_SELECTION_AUDIT_KEEP_LINES = 200;
+var SECRET_ARGV_FLAGS = /* @__PURE__ */ new Set([
+  "--token",
+  "--auth",
+  "--auth-token",
+  "--key",
+  "--api-key",
+  "--app-key",
+  "--machine-key",
+  "--provider-api-key",
+  "--invite-token",
+  "--password",
+  "--secret"
+]);
+function redactArgvSecrets(argv) {
+  const redacted = [];
+  let maskNext = false;
+  for (const arg of argv) {
+    if (maskNext) {
+      maskNext = false;
+      redacted.push("[REDACTED]");
+      continue;
+    }
+    const equals = arg.indexOf("=");
+    if (equals > 0 && SECRET_ARGV_FLAGS.has(arg.slice(0, equals))) {
+      redacted.push(`${arg.slice(0, equals)}=[REDACTED]`);
+      continue;
+    }
+    maskNext = SECRET_ARGV_FLAGS.has(arg);
+    redacted.push(arg);
+  }
+  return redacted;
+}
+function appendAgentSelectionAudit(entry, auditPath = getAgentSelectionAuditPath(entry.configPath)) {
+  try {
+    const stack = (new Error().stack ?? "").split("\n").slice(2, 8).map((line2) => line2.trim()).filter(Boolean);
+    const line = `${JSON.stringify({
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      pid: process.pid,
+      // Distinguishes repo source / installed binary / bundled desktop build —
+      // the field that says whether a stale build is doing the writing.
+      execPath: process.execPath,
+      argv: redactArgvSecrets(process.argv),
+      cwd: process.cwd(),
+      previous: entry.previous,
+      next: entry.next,
+      stack
+    })}
+`;
+    mkdirSync(dirname(auditPath), { recursive: true });
+    const auditMode = 384;
+    if (existsSync(auditPath) && statSync(auditPath).size > AGENT_SELECTION_AUDIT_MAX_BYTES) {
+      const kept = readFileSync(auditPath, "utf8").split("\n").filter((entry2) => entry2.trim()).slice(-AGENT_SELECTION_AUDIT_KEEP_LINES).join("\n");
+      writeFileSync(auditPath, `${kept}
+`, {
+        encoding: "utf8",
+        mode: auditMode
+      });
+    }
+    appendFileSync(auditPath, line, { encoding: "utf8", mode: auditMode });
+    try {
+      chmodSync(auditPath, auditMode);
+    } catch {
+    }
+  } catch {
+  }
+}
+function readLastAgentSelectionAudit(auditPath = getAgentSelectionAuditPath()) {
+  try {
+    if (!existsSync(auditPath)) return { logExists: false, last: null };
+    const lines = readFileSync(auditPath, "utf8").trim().split("\n");
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      const raw = lines[index]?.trim();
+      if (!raw) continue;
+      const parsed = JSON.parse(raw);
+      if (!parsed.next) continue;
+      return {
+        logExists: true,
+        last: {
+          agentKey: parsed.next.agentKey ?? "",
+          agentName: parsed.next.agentName ?? ""
+        }
+      };
+    }
+    return { logExists: true, last: null };
+  } catch {
+    return { logExists: false, last: null };
+  }
+}
 function saveProfileAgentSelection(selection, path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return null;
   const config = loadProfileConfig(path);
   if (!config) return null;
   const profile = config.profiles[config.currentProfile];
   if (!profile) return null;
   const agentKey = selection.agentKey.trim();
   const agentName = selection.agentName.trim();
+  appendAgentSelectionAudit({
+    previous: {
+      ...profile.agentKey ? { agentKey: profile.agentKey } : {},
+      ...profile.agentName ? { agentName: profile.agentName } : {}
+    },
+    next: { agentKey, agentName },
+    configPath: path
+  });
   if (!agentKey) {
     delete profile.agentKey;
     delete profile.agentName;
@@ -143,5 +266,7 @@ export {
   buildCliRuntimeEnv,
   getCurrentProfile,
   saveProfileLocale,
+  getAgentSelectionAuditPath,
+  readLastAgentSelectionAudit,
   saveProfileAgentSelection
 };

package/{chunk-CPYYM4RJ.js → chunk-V5GA74HI.js}

@@ -1,16 +1,18 @@
 import {
   getModelConfig
-} from "./chunk-DFUPZE6V.js";
+} from "./chunk-C6ELZQ7H.js";
 import {
   PLATFORM_HOSTED_KIMI_K3_MODEL,
   isPlatformHostedClaudeModel,
   isPlatformHostedDeepseekModel,
+  isPlatformHostedGeminiImageModel,
   isPlatformHostedGeminiModel,
+  isPlatformHostedGlm53FlashModel,
   isPlatformHostedGlmModel,
   isPlatformHostedGrokModel,
   isPlatformHostedKimiK26Model,
-  isPlatformHostedQwen37FlashModel
-} from "./chunk-OR2HNLVO.js";
+  isPlatformHostedOpenAIImageModel
+} from "./chunk-X6EN3KJX.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
@@ -30,7 +32,9 @@ var PLATFORM_CHAT_COMPLETIONS_ENDPOINTS = {
   // Moonshot AI（月之暗面）开放平台 OpenAI 兼容模式（按量计费）
   moonshot: "https://api.moonshot.cn/v1/chat/completions",
   // 平台托管 Kimi K3 的实际上游
-  crof: "https://crof.ai/v1/chat/completions"
+  crof: "https://crof.ai/v1/chat/completions",
+  // 平台托管 GLM 5.3 Flash 的实际上游（RunInfra 独家廉价快档）
+  runinfra: "https://api.runinfra.ai/v1/chat/completions"
   // 无 nolo 默认上游：平台托管模型全部显式分流，未识别模型返回 undefined
 };
 function isOpenAiResponsesModel(args) {
@@ -46,6 +50,7 @@ function isOpenAiResponsesModel(args) {
   }
   if (provider === "deepseek" || provider === "nolo" || provider === "ollama-cloud") {
     if (isPlatformHostedDeepseekModel(args.model)) return true;
+    if (isPlatformHostedOpenAIImageModel(args.model)) return true;
   }
   return false;
 }
@@ -53,6 +58,9 @@ function resolvePlatformResponsesEndpoint(provider, model) {
   const normalized = asTrimmedLowercaseString(provider);
   if (normalized === "openai") return OPENAI_RESPONSES_ENDPOINT;
   if (normalized === "deepseek" || normalized === "nolo" || normalized === "ollama-cloud") {
+    if (isPlatformHostedOpenAIImageModel(model)) {
+      return OPENAI_RESPONSES_ENDPOINT;
+    }
     if (!model || isPlatformHostedDeepseekModel(model)) {
       return DEEPSEEK_RESPONSES_ENDPOINT;
     }
@@ -76,12 +84,18 @@ function resolvePlatformChatCompletionsEndpoint(provider, model) {
   if (aliased === "nolo" && (isPlatformHostedKimiK26Model(model) || isPlatformHostedGlmModel(model))) {
     return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.openrouter;
   }
+  if (aliased === "nolo" && isPlatformHostedGlm53FlashModel(model)) {
+    return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.runinfra;
+  }
   if (aliased === "nolo" && asTrimmedLowercaseString(model) === PLATFORM_HOSTED_KIMI_K3_MODEL) {
     return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.crof;
   }
-  if (aliased === "nolo" && (isPlatformHostedGeminiModel(model) || isPlatformHostedQwen37FlashModel(model))) {
+  if (aliased === "nolo" && (isPlatformHostedGeminiModel(model) || isPlatformHostedGeminiImageModel(model))) {
     return PLATFORM_CHAT_COMPLETIONS_ENDPOINTS.google;
   }
+  if (aliased === "nolo" && isPlatformHostedOpenAIImageModel(model)) {
+    return void 0;
+  }
   if (aliased === "nolo" && isPlatformHostedDeepseekModel(model)) {
     return void 0;
   }