nolo-cli 0.8.0-alpha.2 → 0.8.0-alpha.21

package/chunk-4SN6J65J.js

@@ -0,0 +1,38 @@
+// packages/core/localOrigins.ts
+var DEFAULT_LOCAL_HOST = "127.0.0.1";
+var DEFAULT_LOCAL_API_PORT = "38123";
+var DEFAULT_LOCAL_API_ORIGIN = `http://${DEFAULT_LOCAL_HOST}:${DEFAULT_LOCAL_API_PORT}`;
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
+  "127.0.0.1",
+  "localhost",
+  "::1"
+]);
+function isLoopbackHostname(hostname) {
+  if (typeof hostname !== "string") return false;
+  let normalized = hostname.trim().toLowerCase();
+  if (!normalized) return false;
+  if (normalized.startsWith("[") && normalized.endsWith("]")) {
+    normalized = normalized.slice(1, -1);
+  }
+  return LOOPBACK_HOSTNAMES.has(normalized);
+}
+function isLoopbackUrl(value) {
+  if (typeof value !== "string" || !value.trim()) return false;
+  try {
+    return isLoopbackHostname(new URL(value).hostname);
+  } catch {
+    return false;
+  }
+}
+var LOCAL_SERVER_URL_PATTERN = /^https?:\/\/(?:(?:\d{1,3}\.){3}\d{1,3}|localhost|nolotus\.local)(?::\d+)?$/i;
+function isLocalServerUrl(value) {
+  if (typeof value !== "string") return false;
+  return LOCAL_SERVER_URL_PATTERN.test(value.trim());
+}
+
+export {
+  DEFAULT_LOCAL_API_ORIGIN,
+  isLoopbackHostname,
+  isLoopbackUrl,
+  isLocalServerUrl
+};

package/chunk-4VNS5WPM.js

@@ -0,0 +1,42 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __require,
+  __commonJS,
+  __export,
+  __toESM
+};

package/chunk-4XENYTF5.js

@@ -0,0 +1,222 @@
+import {
+  clearCliLocalRuntimePreparedAgentCache
+} from "./chunk-RCSJFQPB.js";
+import {
+  getReadableCliDb
+} from "./chunk-W4NVOSFF.js";
+import {
+  buildCreatedAgentRecord,
+  buildUpdatedAgentRecord,
+  normalizeAgentRecordForOutput,
+  parseAgentUpdateArgs,
+  resolveAgentRecordFromHybridStore,
+  sanitizeAgentRecordForCliOutput,
+  writeAgentRecord
+} from "./chunk-SDJDLO5W.js";
+import {
+  resolveCliAgentKeyInput
+} from "./chunk-VHBWHNVT.js";
+import {
+  parseUserIdFromAuthToken,
+  resolveAuthToken
+} from "./chunk-ISNCLGUZ.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+
+// packages/cli/agentRecordCommands.ts
+async function runAgentReadCommand(args, deps = {}) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  const agentInput = args[0]?.trim();
+  if (!agentInput || agentInput === "--help" || agentInput === "-h") {
+    output.write("Usage: nolo agent read <agent>\n");
+    return agentInput ? 0 : 1;
+  }
+  const authToken = resolveAuthToken(args, env);
+  if (!authToken) {
+    output.write("[nolo] agent read requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+  const agentKey = resolveCliAgentKeyInput(agentInput);
+  const db = deps.db ?? await getReadableCliDb(output);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fallbackFetchImpl = deps.fallbackFetchImpl;
+  try {
+    const result = await resolveAgentRecordFromHybridStore({
+      agentInput,
+      cliArgs: args,
+      env,
+      db,
+      fetchImpl,
+      fallbackFetchImpl
+    });
+    if (!result) {
+      throw new Error(`agent not found: ${agentKey}`);
+    }
+    output.write(JSON.stringify({
+      ...normalizeAgentRecordForOutput(result.agentKey, authToken, result.record),
+      source: result.source
+    }, null, 2));
+    output.write("\n");
+    return 0;
+  } catch (error) {
+    output.write(
+      `[nolo] agent read failed: ${toErrorMessage(error)}
+`
+    );
+    return 1;
+  }
+}
+async function runAgentUpdateCommand(args, deps = {}) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  let parsed;
+  try {
+    parsed = parseAgentUpdateArgs(args);
+  } catch (error) {
+    output.write(`[nolo] agent update failed: ${toErrorMessage(error)}
+`);
+    return 1;
+  }
+  if (!parsed) {
+    output.write(
+      "Usage: nolo agent update <agent> [--model <id>] [--cli-provider <provider>] [--api-source <source>] [--max-concurrent <n>] [--expires-at <iso>] [--prompt <text> | --prompt-file <path> | --prompt-doc <pageKey>] [--tools <json>] [--copy-provider-from <agent>] [--field key=value]\n".replace("[--field key=value]", `[--handle <name>] [--field key=value]  (e.g. --field disabledTools='["exa_search"]' to disable default tools)`)
+    );
+    return args[0] ? 0 : 1;
+  }
+  const authToken = resolveAuthToken(args, env);
+  if (!authToken) {
+    output.write("[nolo] agent update requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+  const userId = parseUserIdFromAuthToken(authToken);
+  if (!userId) {
+    output.write("[nolo] agent update could not read userId from AUTH_TOKEN.\n");
+    return 1;
+  }
+  const db = deps.db ?? await getReadableCliDb(output);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fallbackFetchImpl = deps.fallbackFetchImpl;
+  try {
+    const built = await buildUpdatedAgentRecord({
+      cliArgs: args,
+      parsed,
+      env,
+      db,
+      fetchImpl,
+      fallbackFetchImpl,
+      authToken
+    });
+    await writeAgentRecord({
+      agentKey: built.agentKey,
+      authToken,
+      fallbackFetchImpl,
+      fetchImpl,
+      serverUrl: built.serverUrl,
+      userId,
+      record: built.nextRecord
+    });
+    await db.put(built.agentKey, {
+      ...built.nextRecord,
+      dbKey: built.agentKey,
+      key: built.nextRecord?.key || built.agentKey,
+      serverOrigin: built.serverUrl
+    });
+    clearCliLocalRuntimePreparedAgentCache();
+    output.write(JSON.stringify({
+      ok: true,
+      agentKey: built.agentKey,
+      baseUrl: built.serverUrl,
+      updates: sanitizeAgentRecordForCliOutput(built.updates),
+      record: sanitizeAgentRecordForCliOutput(built.nextRecord)
+    }, null, 2));
+    output.write("\n");
+    return 0;
+  } catch (error) {
+    output.write(
+      `[nolo] agent update failed: ${toErrorMessage(error)}
+`
+    );
+    return 1;
+  }
+}
+async function runAgentCreateCommand(args, deps = {}) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  let parsed;
+  try {
+    parsed = parseAgentUpdateArgs(args);
+  } catch (error) {
+    output.write(`[nolo] agent create failed: ${toErrorMessage(error)}
+`);
+    return 1;
+  }
+  if (!parsed) {
+    output.write(
+      "Usage: nolo agent create <agent> [--model <id>] [--cli-provider <provider>] [--api-source <source>] [--max-concurrent <n>] [--expires-at <iso>] [--prompt <text> | --prompt-file <path> | --prompt-doc <pageKey>] [--tools <json>] [--copy-provider-from <agent>] [--name <name>] [--custom-provider-url <url>] [--provider-api-key <key>] [--field key=value]\n".replace("[--field key=value]", "[--handle <name>] [--field key=value]")
+    );
+    return args[0] ? 0 : 1;
+  }
+  const authToken = resolveAuthToken(args, env);
+  if (!authToken) {
+    output.write("[nolo] agent create requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+  const userId = parseUserIdFromAuthToken(authToken);
+  if (!userId) {
+    output.write("[nolo] agent create could not read userId from AUTH_TOKEN.\n");
+    return 1;
+  }
+  const db = deps.db ?? await getReadableCliDb(output);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fallbackFetchImpl = deps.fallbackFetchImpl;
+  try {
+    const built = await buildCreatedAgentRecord({
+      cliArgs: args,
+      parsed,
+      env,
+      db,
+      fetchImpl,
+      fallbackFetchImpl,
+      authToken
+    });
+    await writeAgentRecord({
+      agentKey: built.agentKey,
+      authToken,
+      fallbackFetchImpl,
+      fetchImpl,
+      serverUrl: built.serverUrl,
+      userId,
+      record: built.nextRecord
+    });
+    await db.put(built.agentKey, {
+      ...built.nextRecord,
+      dbKey: built.agentKey,
+      key: built.nextRecord?.key || built.agentKey,
+      serverOrigin: built.serverUrl
+    });
+    clearCliLocalRuntimePreparedAgentCache();
+    output.write(JSON.stringify({
+      ok: true,
+      agentKey: built.agentKey,
+      baseUrl: built.serverUrl,
+      updates: sanitizeAgentRecordForCliOutput(built.updates),
+      record: sanitizeAgentRecordForCliOutput(built.nextRecord)
+    }, null, 2));
+    output.write("\n");
+    return 0;
+  } catch (error) {
+    output.write(
+      `[nolo] agent create failed: ${toErrorMessage(error)}
+`
+    );
+    return 1;
+  }
+}
+
+export {
+  runAgentReadCommand,
+  runAgentUpdateCommand,
+  runAgentCreateCommand
+};

package/chunk-4ZDM73SD.js

@@ -0,0 +1,34 @@
+// packages/chat/dialog/actions/builtinDialogLlm.ts
+var BASE_BUILTIN_DIALOG_LLM_CONFIG = {
+  apiSource: "platform",
+  useServerProxy: true
+};
+var BUILTIN_TITLE_LLM_CONFIG = {
+  ...BASE_BUILTIN_DIALOG_LLM_CONFIG,
+  provider: "deepseek",
+  id: "builtin-dialog-title-llm",
+  name: "Builtin Dialog Title LLM",
+  model: "deepseek-v4-flash",
+  prompt: "You are a title generator for chat history. \u4F60\u53EA\u505A\u4E00\u4EF6\u4E8B\uFF1A\u6839\u636E\u5BF9\u8BDD\u5185\u5BB9\u8F93\u51FA\u6700\u7EC8\u6807\u9898\u3002\u786C\u6027\u89C4\u5219\uFF1A1) \u53EA\u8F93\u51FA\u6807\u9898\u8FD9\u4E00\u884C\uFF1B\u4E25\u7981\u8F93\u51FA\u63A8\u7406\u3001\u5206\u6790\u3001\u6B65\u9AA4\u3001\u89E3\u91CA\u3001\u524D\u8A00\u3001\u540E\u8BB0\u3001\u7FFB\u8BD1\u3001\u81F4\u6B49\u6216\u4EFB\u4F55\u989D\u5916\u8BF4\u660E\u30022) \u4E0D\u8981\u56DE\u7B54\u7528\u6237\u8BF7\u6C42\uFF0C\u4E0D\u8981\u5199\u6458\u8981\uFF0C\u53EA\u7ED9\u6807\u9898\u7ED3\u679C\u30023) \u6807\u9898\u5C3D\u91CF\u77ED\uFF1A\u901A\u5E38 2-5 \u4E2A\u8BCD\uFF0C\u82F1\u6587\u4E0D\u8D85\u8FC7 6 \u4E2A\u8BCD\u30024) \u4F7F\u7528\u5BF9\u8BDD\u4E3B\u8BED\u8A00\uFF1B\u6DF7\u5408\u8BED\u8A00\u65F6\u4F18\u5148\u7528\u6237\u4E3B\u8981\u8BED\u8A00\u30025) \u4F18\u5148\u590D\u7528\u5BF9\u8BDD\u4E2D\u7684\u5177\u4F53\u4E3B\u9898\u8BCD\uFF0C\u907F\u514D issue\u3001help\u3001discussion\u3001analysis\u3001update \u8FD9\u7C7B\u7A7A\u6CDB\u8BCD\u30026) \u5FFD\u7565 tool JSON\u3001\u51FD\u6570\u540D\u3001branch label\u3001agent \u540D\u3001\u7CFB\u7EDF\u6307\u4EE4\u548C\u7F16\u6392\u75D5\u8FF9\uFF08\u5982 GPT\u3001Claude\u3001Gemini\uFF09\uFF1B\u6807\u9898\u8981\u843D\u5728\u7528\u6237\u771F\u6B63\u8BA8\u8BBA\u7684\u5BF9\u8C61\u6216\u51B3\u7B56\u4E0A\u30027) \u66F4\u504F\u597D\u201C\u5BF9\u8C61 + \u52A8\u4F5C/\u5224\u65AD\u201D\u7684\u77ED\u6807\u9898\uFF0C\u4F8B\u5982\u201CAI \u90AE\u4EF6\u52A9\u624B\u53D6\u820D\u201D\u201C\u4E1C\u4EAC\u56DB\u65E5\u6162\u65C5\u884C\u201D\u201C\u91CD\u590D\u6263\u8D39\u9000\u6B3E\u201D\u30028) \u7EAF\u6587\u672C\uFF0C\u4E0D\u8981\u9879\u76EE\u7B26\u53F7\u3001\u7F16\u53F7\u3001markdown\u3001emoji\u3002\u6700\u7EC8\u53EA\u8FD4\u56DE\u6807\u9898\u6587\u672C\u3002 Output only the title text."
+};
+var BUILTIN_SUMMARY_LLM_CONFIG = {
+  ...BASE_BUILTIN_DIALOG_LLM_CONFIG,
+  provider: "deepseek",
+  id: "builtin-dialog-summary-llm",
+  name: "Builtin Dialog Summary LLM",
+  model: "deepseek-v4-pro",
+  prompt: "\u4F60\u662F\u4E00\u4E2A\u4E13\u4E1A\u7684\u5BF9\u8BDD\u8BB0\u5FC6\u52A9\u7406\u3002\u8BF7\u57FA\u4E8E\u3010\u73B0\u6709\u8BB0\u5FC6\u3011\u548C\u3010\u65B0\u589E\u5BF9\u8BDD\u3011\uFF0C\u8F93\u51FA\u4E00\u4EFD\u66F4\u65B0\u540E\u7684\u5BF9\u8BDD\u8BB0\u5FC6\u6863\u6848\u3002\u4E25\u683C\u53EA\u8F93\u51FA\u4E0B\u9762\u4E24\u90E8\u5206\uFF0C\u6807\u9898\u5FC5\u987B\u5B8C\u5168\u4E00\u81F4\uFF1A\n\u5173\u952E\u4E8B\u5B9E\u6863\u6848\n- ...\n\u5BF9\u8BDD\u5267\u60C5\u6458\u8981\n- ...\n\u8981\u6C42\uFF1A1) \u4F7F\u7528\u5BF9\u8BDD\u4E3B\u8BED\u8A00\uFF1B\u6DF7\u5408\u8BED\u8A00\u65F6\u4F18\u5148\u8DDF\u968F\u7528\u6237\u4E3B\u8981\u8BED\u8A00\uFF0C\u4E13\u6709\u540D\u8BCD\u4FDD\u7559\u539F\u6587\u30022) \u5173\u952E\u4E8B\u5B9E\u6863\u6848\u53EA\u4FDD\u7559\u4E4B\u540E\u7EE7\u7EED\u5BF9\u8BDD\u4ECD\u6709\u4EF7\u503C\u7684\u4FE1\u606F\uFF0C\u4F8B\u5982\u7528\u6237\u504F\u597D\u3001\u76EE\u6807\u3001\u7EA6\u675F\u3001\u6280\u672F\u6808\u3001\u786E\u5B9A\u7684\u6587\u4EF6\u540D/\u53D8\u91CF\u540D\u3001\u6838\u5FC3\u51B3\u7B56\u3001\u5F85\u529E\u4E8B\u9879\u30023) \u5BF9\u8BDD\u5267\u60C5\u6458\u8981\u5148\u6781\u7B80\u6982\u62EC\u65E7\u4E0A\u4E0B\u6587\uFF0C\u518D\u66F4\u8BE6\u7EC6\u8BB0\u5F55\u6700\u8FD1\u65B0\u589E\u7684\u8FDB\u5C55\u3001\u5206\u6B67\u3001\u7ED3\u8BBA\u548C\u4E0B\u4E00\u6B65\u30024) \u5FFD\u7565\u5BD2\u6684\u3001\u91CD\u590D\u5C1D\u8BD5\u3001\u5DF2\u653E\u5F03\u65B9\u6848\u548C\u65E0\u4EF7\u503C\u5E9F\u8BDD\u30025) \u4E0D\u8981\u7F16\u9020\u672A\u51FA\u73B0\u7684\u4FE1\u606F\uFF0C\u4E0D\u8981\u8F93\u51FA\u5F00\u573A\u767D\u3001\u7ED3\u675F\u8BED\u3001markdown \u4EE3\u7801\u5757\u6216\u989D\u5916\u7AE0\u8282\u3002"
+};
+var buildBuiltinSummaryContent = (previousSummary, messagesText) => `
+\u3010\u73B0\u6709\u8BB0\u5FC6\u3011\uFF1A
+${previousSummary || "(\u65E0)"}
+
+\u3010\u65B0\u589E\u5BF9\u8BDD\u3011\uFF1A
+${messagesText}
+`.trim();
+
+export {
+  BUILTIN_TITLE_LLM_CONFIG,
+  BUILTIN_SUMMARY_LLM_CONFIG,
+  buildBuiltinSummaryContent
+};

package/chunk-5CS33IBL.js

@@ -0,0 +1,301 @@
+import {
+  getCredentialsDir
+} from "./chunk-JZPBVBIY.js";
+import {
+  asNonEmptyStringArray
+} from "./chunk-I42VC5KR.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
+import {
+  asOptionalPositiveFiniteNumber
+} from "./chunk-U6VC4MU4.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
+
+// packages/agent-runtime/fileCredentialBroker.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// packages/agent-runtime/credentialBroker.ts
+function assertCredentialRef(ref) {
+  const trimmed = asTrimmedString(ref);
+  if (!trimmed) {
+    throw new Error("invalid_ref");
+  }
+  if (trimmed.includes("..") || trimmed.includes("/") || trimmed.includes("\\")) {
+    throw new Error("invalid_ref");
+  }
+  return trimmed;
+}
+
+// packages/agent-runtime/fileCredentialBroker.ts
+function getApiKeyCredentialsDir(homeDir = homedir()) {
+  return join(getCredentialsDir(homeDir), "keys");
+}
+function credentialRefToFileName(ref) {
+  const safe = assertCredentialRef(ref).replace(/[^a-zA-Z0-9._-]+/g, "_");
+  if (!safe || safe === "." || safe === "..") {
+    throw new Error(`Credential ref is not filesystem-safe: ${ref}`);
+  }
+  return `${safe}.json`;
+}
+function getApiKeyCredentialPath(ref, homeDir = homedir()) {
+  return join(getApiKeyCredentialsDir(homeDir), credentialRefToFileName(ref));
+}
+function ensurePrivateDir(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+}
+function writePrivateFile(path, body) {
+  writeFileSync(path, body, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function readApiKeyCredential(ref, homeDir = homedir()) {
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  if (!existsSync(path)) return null;
+  try {
+    const raw = readFileSync(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.secret !== "string" || !parsed.secret) return null;
+    return parsed.secret;
+  } catch {
+    return null;
+  }
+}
+function writeApiKeyCredential(ref, secret, homeDir = homedir(), now = Date.now()) {
+  const trimmedSecret = secret.trim();
+  if (!trimmedSecret) {
+    throw new Error("Cannot store an empty credential secret.");
+  }
+  assertCredentialRef(ref);
+  const dir = getApiKeyCredentialsDir(homeDir);
+  ensurePrivateDir(dir);
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  const payload = {
+    secret: trimmedSecret,
+    updatedAt: now
+  };
+  writePrivateFile(path, `${JSON.stringify(payload, null, 2)}
+`);
+}
+function removeApiKeyCredential(ref, homeDir = homedir()) {
+  assertCredentialRef(ref);
+  const path = getApiKeyCredentialPath(ref, homeDir);
+  if (!existsSync(path)) return;
+  unlinkSync(path);
+}
+function hasApiKeyCredential(ref, homeDir = homedir()) {
+  return readApiKeyCredential(ref, homeDir) !== null;
+}
+function createFileCredentialBroker(options = {}) {
+  const homeDir = options.homeDir ?? homedir();
+  const now = options.now ?? Date.now;
+  return {
+    get(ref) {
+      return readApiKeyCredential(ref, homeDir);
+    },
+    put(ref, secret) {
+      writeApiKeyCredential(ref, secret, homeDir, now());
+    },
+    delete(ref) {
+      removeApiKeyCredential(ref, homeDir);
+    },
+    has(ref) {
+      return hasApiKeyCredential(ref, homeDir);
+    }
+  };
+}
+
+// packages/agent-runtime/migrateAgentSecrets.ts
+function buildAgentApiKeyCredentialRef(agentKey) {
+  const key = asTrimmedString(agentKey);
+  if (!key) throw new Error("agentKey is required to build a credential ref.");
+  return `api-key:${key}`;
+}
+function readRawApiKey(agent) {
+  return asTrimmedString(agent.apiKey);
+}
+function resolveTargetRef(agent) {
+  const fromCredential = asTrimmedString(agent.credentialRef);
+  if (fromCredential) return fromCredential;
+  const fromApiKeyRef = asTrimmedString(agent.apiKeyRef);
+  if (fromApiKeyRef.startsWith("api-key:")) return fromApiKeyRef;
+  return buildAgentApiKeyCredentialRef(agent.key);
+}
+async function brokerHas(broker, ref) {
+  return Boolean(await broker.has(ref));
+}
+async function brokerPut(broker, ref, secret) {
+  await broker.put(ref, secret);
+}
+async function migrateAgentSecrets(args) {
+  const { agent, broker } = args;
+  const raw = readRawApiKey(agent);
+  const migration = asTrimmedString(agent.credentialMigration);
+  if (migration === "done" && !raw) {
+    const ref = typeof agent.credentialRef === "string" && agent.credentialRef.trim() || (typeof agent.apiKeyRef === "string" && agent.apiKeyRef.startsWith("api-key:") ? agent.apiKeyRef.trim() : "") || void 0;
+    return {
+      updates: {},
+      status: "already-done",
+      ...ref ? { credentialRef: ref } : {},
+      phase: "complete"
+    };
+  }
+  if (!raw && migration !== "pending") {
+    return { updates: {}, status: "noop", phase: "none" };
+  }
+  const targetRef = resolveTargetRef(agent);
+  if (raw) {
+    await brokerPut(broker, targetRef, raw);
+    const stored2 = await brokerHas(broker, targetRef);
+    if (!stored2) {
+      return {
+        updates: {
+          credentialRef: targetRef,
+          credentialMigration: "pending"
+        },
+        status: "resumed-pending",
+        credentialRef: targetRef,
+        phase: "put"
+      };
+    }
+    return {
+      updates: {
+        apiKey: null,
+        credentialRef: targetRef,
+        // Keep apiKeyRef for resolution if not already an OAuth provider name.
+        // Prefer explicit credentialRef; set apiKeyRef only when empty so OAuth agents stay intact.
+        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {},
+        credentialMigration: "done"
+      },
+      status: migration === "pending" ? "resumed-pending" : "migrated",
+      credentialRef: targetRef,
+      phase: "strip"
+    };
+  }
+  const stored = await brokerHas(broker, targetRef);
+  if (stored) {
+    return {
+      updates: {
+        credentialRef: targetRef,
+        credentialMigration: "done",
+        ...!(typeof agent.apiKeyRef === "string" && agent.apiKeyRef.trim()) ? { apiKeyRef: targetRef } : {}
+      },
+      status: "resumed-pending",
+      credentialRef: targetRef,
+      phase: "complete"
+    };
+  }
+  return {
+    updates: {
+      credentialRef: targetRef,
+      credentialMigration: "pending"
+    },
+    status: "awaiting-secret",
+    credentialRef: targetRef,
+    phase: "put"
+  };
+}
+function applyAgentSecretMigrationUpdates(record, updates) {
+  const next = { ...record };
+  if ("apiKey" in updates) {
+    if (updates.apiKey === null || updates.apiKey === "") {
+      delete next.apiKey;
+    } else if (typeof updates.apiKey === "string") {
+      next.apiKey = updates.apiKey;
+    }
+  }
+  if (updates.apiKeyRef !== void 0) next.apiKeyRef = updates.apiKeyRef;
+  if (updates.credentialRef !== void 0) next.credentialRef = updates.credentialRef;
+  if (updates.credentialMigration !== void 0) {
+    next.credentialMigration = updates.credentialMigration;
+  }
+  return next;
+}
+
+// packages/agent-runtime/runtimeToolPolicy.ts
+function unique(values) {
+  return [...new Set(values)];
+}
+function normalizeAgentRuntimeToolPolicy(value) {
+  if (!isRecord(value)) return void 0;
+  return {
+    version: 1,
+    ...asNonEmptyStringArray(value.agentTools).length ? { agentTools: unique(asNonEmptyStringArray(value.agentTools)) } : {},
+    ...asNonEmptyStringArray(value.runtimeTools).length ? { runtimeTools: unique(asNonEmptyStringArray(value.runtimeTools)) } : {},
+    ...isRecord(value.workspace) ? { workspace: { ...value.workspace } } : {},
+    ...isRecord(value.shell) ? { shell: { ...value.shell } } : {},
+    ...isRecord(value.isolation) ? { isolation: { ...value.isolation } } : {},
+    ...isRecord(value.git) ? { git: { ...value.git } } : {},
+    ...isRecord(value.budget) ? { budget: { ...value.budget } } : {},
+    ...isRecord(value.audit) ? { audit: { ...value.audit } } : {}
+  };
+}
+function runtimeBindingRecord(runtimeBinding) {
+  return isRecord(runtimeBinding) ? runtimeBinding : void 0;
+}
+function runtimeToolNamesFromPolicy(policy) {
+  return asNonEmptyStringArray(policy?.runtimeTools);
+}
+function readPositiveNumber(value) {
+  return asOptionalPositiveFiniteNumber(Number(value));
+}
+function resolveRequestedRuntimeToolNames(args) {
+  const runtimeBinding = runtimeBindingRecord(args.agentConfig.runtimeBinding);
+  const bindingPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicy
+  );
+  const bindingSnapshotPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicySnapshot
+  );
+  return unique([
+    ...asNonEmptyStringArray(args.agentConfig.toolNames),
+    ...runtimeToolNamesFromPolicy(
+      normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy)
+    ),
+    ...runtimeToolNamesFromPolicy(bindingPolicy),
+    ...runtimeToolNamesFromPolicy(bindingSnapshotPolicy)
+  ]);
+}
+function resolveCurrentRunRuntimeToolPolicy(agentConfig) {
+  const runtimeBinding = runtimeBindingRecord(agentConfig?.runtimeBinding);
+  return normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicySnapshot ?? agentConfig?.runtimeToolPolicy ?? runtimeBinding?.runtimeToolPolicy
+  );
+}
+function resolveLocalRuntimeEnvFromPolicy(runtimeEnv, policy) {
+  return { ...runtimeEnv };
+}
+function resolveLocalWorkspaceExecutorOptionsFromPolicy(policy) {
+  const maxOutputBytes = readPositiveNumber(policy?.shell?.maxOutputBytes);
+  return {
+    ...maxOutputBytes ? { commandOutputLimit: Math.floor(maxOutputBytes) } : {}
+  };
+}
+
+export {
+  createFileCredentialBroker,
+  migrateAgentSecrets,
+  applyAgentSecretMigrationUpdates,
+  normalizeAgentRuntimeToolPolicy,
+  resolveRequestedRuntimeToolNames,
+  resolveCurrentRunRuntimeToolPolicy,
+  resolveLocalRuntimeEnvFromPolicy,
+  resolveLocalWorkspaceExecutorOptionsFromPolicy
+};