nolo-cli 0.80.0-alpha.2 → 0.80.0

package/{chunk-QCZX4FTW.js → chunk-SH43IESU.js}

@@ -6,19 +6,146 @@ import {
 } from "./chunk-KUG52IAP.js";
 
 // packages/desktop-chrome-connector/chromeConnector.ts
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// packages/desktop-chrome-connector/uploadSecurity.mjs
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+var DEFAULT_MAX_FILE_BYTES = 25 * 1024 * 1024;
+var DEFAULT_MAX_FILES = 10;
+var UploadSecurityError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "UploadSecurityError";
+    this.code = code;
+  }
+};
+function createUploadSecurityError(code, message) {
+  return new UploadSecurityError(code, message);
+}
+function isSubpath(parent, child) {
+  const rel = relative(parent, child);
+  return !rel.startsWith("..") && !isAbsolute(rel);
+}
+function parseAllowedRoots(env = process.env) {
+  const raw = env?.NOLO_CHROME_UPLOAD_ROOTS;
+  if (!raw || typeof raw !== "string") {
+    return [];
+  }
+  return raw.split(",").map((entry) => entry.trim()).filter(Boolean).filter((entry) => isAbsolute(entry)).map((entry) => {
+    const resolved = resolve(entry);
+    if (existsSync(resolved)) {
+      try {
+        return realpathSync(resolved);
+      } catch {
+        return resolved;
+      }
+    }
+    return resolved;
+  });
+}
+function validateUploadFiles(options = {}) {
+  const {
+    files,
+    env = process.env,
+    maxFiles = DEFAULT_MAX_FILES,
+    maxFileBytes = DEFAULT_MAX_FILE_BYTES
+  } = options;
+  if (!Array.isArray(files) || files.length === 0) {
+    throw createUploadSecurityError("no_files", "Provide at least one file to upload.");
+  }
+  if (files.length > maxFiles) {
+    throw createUploadSecurityError(
+      "too_many_files",
+      `Too many files: ${files.length} provided, maximum allowed is ${maxFiles}.`
+    );
+  }
+  const allowedRoots = parseAllowedRoots(env);
+  if (allowedRoots.length === 0) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      "Upload roots not configured in NOLO_CHROME_UPLOAD_ROOTS; all uploads are refused."
+    );
+  }
+  const fileStats = [];
+  const canonicalFiles = [];
+  let totalBytes = 0;
+  for (const rawFile of files) {
+    if (typeof rawFile !== "string" || !rawFile.trim()) {
+      throw createUploadSecurityError("path_not_allowed", "File path must be a non-empty string.");
+    }
+    const trimmed = rawFile.trim();
+    const resolvedCandidate = resolve(trimmed);
+    if (!existsSync(resolvedCandidate)) {
+      throw createUploadSecurityError("path_not_allowed", `File not found or inaccessible: ${rawFile}`);
+    }
+    let real;
+    try {
+      real = realpathSync(resolvedCandidate);
+    } catch {
+      throw createUploadSecurityError("path_not_allowed", `Could not resolve canonical path for: ${rawFile}`);
+    }
+    let st;
+    try {
+      st = statSync(real);
+    } catch {
+      throw createUploadSecurityError("path_not_allowed", `Could not stat file: ${rawFile}`);
+    }
+    if (!st.isFile()) {
+      throw createUploadSecurityError("path_not_allowed", `Target path is not a regular file: ${rawFile}`);
+    }
+    if (st.size > maxFileBytes) {
+      throw createUploadSecurityError(
+        "too_large",
+        `File size ${st.size} bytes exceeds maximum allowed limit of ${maxFileBytes} bytes: ${rawFile}`
+      );
+    }
+    const realInside = allowedRoots.some((root) => isSubpath(root, real));
+    if (!realInside) {
+      throw createUploadSecurityError(
+        "path_not_allowed",
+        `Path '${rawFile}' (resolved: '${real}') is not within allowed upload roots.`
+      );
+    }
+    canonicalFiles.push(real);
+    fileStats.push({ path: real, bytes: st.size });
+    totalBytes += st.size;
+  }
+  return {
+    ok: true,
+    files: canonicalFiles,
+    fileStats,
+    totalBytes
+  };
+}
+function formatUploadAuditLog(entry = {}) {
+  const ts = entry.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+  const safeTabId = String(entry.tabId ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
+  const safeTarget = String(entry.target ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
+  const files = Array.isArray(entry.files) ? entry.files : [];
+  const totalBytes = files.reduce((sum, f) => sum + (Number(f.bytes) || 0), 0);
+  const fileDetails = files.map((f) => `${String(f.path || "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ")}(${f.bytes || 0}B)`).join(", ");
+  return `[chrome-upload] ${ts} tabId=${safeTabId} target=${safeTarget} files=[${fileDetails}] totalBytes=${totalBytes}`;
+}
+function logUploadAudit(entry, logFn = console.warn) {
+  const line = formatUploadAuditLog(entry);
+  logFn(line);
+  return line;
+}
+
+// packages/desktop-chrome-connector/chromeConnector.ts
 var NOLO_CHROME_CONNECTOR_EXTENSION_ID = "ahpdoopadkamnglhlacfjdfnonpjdplg";
 var NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION = "2";
 function defaultTokenPath() {
-  return resolve(
+  return resolve2(
     process.env.HOME || "",
     "Library/Application Support/Nolo/ChromeConnector/token"
   );
 }
 function readConnectorToken(tokenPath = defaultTokenPath()) {
   if (process.env.NOLO_CHROME_CONNECTOR_TOKEN) return process.env.NOLO_CHROME_CONNECTOR_TOKEN;
-  if (!existsSync(tokenPath)) return "";
+  if (!existsSync2(tokenPath)) return "";
   return readFileSync(tokenPath, "utf8").trim();
 }
 var CHROME_TOOL_ACTIONS = {
@@ -32,7 +159,10 @@ var CHROME_TOOL_ACTIONS = {
   chrome_scroll: "scroll",
   chrome_screenshot: "screenshot",
   chrome_read_console: "read_console",
-  chrome_read_network: "read_network"
+  chrome_read_network: "read_network",
+  chrome_set_files: "set_files",
+  chrome_upload_file: "set_files",
+  chrome_upload: "set_files"
 };
 function createConnectorError(code, message, details) {
   const error = new Error(message);
@@ -59,8 +189,8 @@ function errorPayload(error) {
     ...error?.details !== void 0 ? { details: error.details } : {}
   };
 }
-var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type"]);
-var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach"]);
+var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type", "set_files"]);
+var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach", "set_files"]);
 function validateChromeConnectorPayload(action, payload) {
   if (TAB_ID_REQUIRED_ACTIONS.has(action)) {
     const raw = payload.tabId;
@@ -71,16 +201,42 @@ function validateChromeConnectorPayload(action, payload) {
         `Provide the tabId from chrome_list_tabs before calling ${action}.`
       );
     }
-    return;
+    if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
   }
   if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
-  const elementRef = typeof payload.elementRef === "string" ? payload.elementRef.trim() : "";
+  const rawRef = typeof payload.elementRef === "string" ? payload.elementRef : typeof payload.ref === "string" ? payload.ref : "";
+  const elementRef = rawRef.trim();
   const selector = typeof payload.selector === "string" ? payload.selector.trim() : "";
-  if (elementRef || selector) return;
-  throw createConnectorError(
-    "ELEMENT_TARGET_REQUIRED",
-    "Provide elementRef from chrome_read_page or a CSS selector."
-  );
+  if (!elementRef && !selector) {
+    throw createConnectorError(
+      "ELEMENT_TARGET_REQUIRED",
+      "Provide elementRef from chrome_read_page or a CSS selector."
+    );
+  }
+  if (action === "set_files") {
+    if (!Array.isArray(payload.files) || payload.files.length === 0) {
+      throw createConnectorError(
+        "no_files",
+        "Provide at least one file path in files array."
+      );
+    }
+    try {
+      const validated = validateUploadFiles({
+        files: payload.files,
+        env: process.env
+      });
+      payload.files = validated.files;
+      const targetStr = elementRef ? `ref:${elementRef}` : `selector:${selector}`;
+      logUploadAudit({
+        tabId: String(payload.tabId),
+        target: targetStr,
+        files: validated.fileStats
+      });
+    } catch (err) {
+      const code = err?.code ?? "path_not_allowed";
+      throw createConnectorError(code, toErrorMessage(err));
+    }
+  }
 }
 function createChromeConnectorClient(args) {
   if (args?.request) return { request: args.request };
@@ -90,6 +246,7 @@ function createChromeConnectorClient(args) {
   const token = args?.token ?? readConnectorToken(args?.tokenPath);
   return {
     async request(action, payload) {
+      validateChromeConnectorPayload(action, payload);
       let response;
       try {
         response = await fetchImpl(endpoint, {
@@ -131,7 +288,8 @@ var REQUIRED_CHROME_CONNECTOR_FEATURES = {
   screenshot: ["browser_debug"],
   read_console: ["browser_debug"],
   read_network: ["browser_debug"],
-  detach: ["browser_debug"]
+  detach: ["browser_debug"],
+  set_files: ["compact_observation_v2", "file_upload"]
 };
 function requiredFeaturesForConnectorAction(action) {
   return [...REQUIRED_CHROME_CONNECTOR_FEATURES[action] ?? []];

package/{chunk-FSFQ3A7S.js → chunk-SNPMM7H3.js}

@@ -7,10 +7,10 @@ import {
   listUserRecordsFromServers,
   readDbRecordFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-AFIWC5NH.js";
+} from "./chunk-BLJWCTRL.js";
 import {
   fetchWithTransientRetry
-} from "./chunk-5XTOKQLW.js";
+} from "./chunk-5UTFL4QJ.js";
 import {
   DRAIN_EXHAUSTED_USER_MESSAGE,
   isDrainExhaustedResponse
@@ -18,7 +18,7 @@ import {
 import {
   buildDialogAttachmentPlan,
   extractFileContentIds
-} from "./chunk-HQUORJTM.js";
+} from "./chunk-3BMYXEUW.js";
 import {
   isLevelLockError
 } from "./chunk-URMS4XY2.js";
@@ -30,7 +30,7 @@ import {
   boundSummaryText,
   buildDialogReadEnvelope,
   projectDialogReadForAgent
-} from "./chunk-V3ZKNK5D.js";
+} from "./chunk-IIVGDG4I.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -51,19 +51,19 @@ import {
 import {
   asNonEmptyStringArray,
   asTrimmedNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
+} from "./chunk-VMFTFOWF.js";
 import {
   createClientLogger
 } from "./chunk-QOKAKDPE.js";
 import {
   isLevelNotFoundError
 } from "./chunk-OW765XBU.js";
-import {
-  asTrimmedString
-} from "./chunk-3EUW3WEO.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
 import {
   DEFAULT_LOCAL_API_ORIGIN
 } from "./chunk-4SN6J65J.js";
@@ -210,7 +210,8 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--token",
   "--machine-key",
   "--user",
-  "--max-response-chars"
+  "--max-response-chars",
+  "--per-dialog"
 ]);
 function hasFlag(args, flag) {
   return args.includes(flag);
@@ -724,7 +725,7 @@ function isExplicitDialogIdMismatch(meta, dialogId) {
   return meta && typeof meta === "object" && "id" in meta && meta.id != null && String(meta.id) !== dialogId;
 }
 async function readDialogFromLocalDb(dialogKey, dialogId, limit, readLocalDialog) {
-  const reader = readLocalDialog ?? (await import("./localDialogRead-PUQKFI73.js")).readDialogFromLocalDb;
+  const reader = readLocalDialog ?? (await import("./localDialogRead-BTFJ4V2I.js")).readDialogFromLocalDb;
   const result = await reader({ dialogKey, dialogId, limit });
   return {
     ...result,
@@ -741,7 +742,7 @@ async function readLocalDialogAtDbPathDefault(args) {
   const [{ Level }, { safeJsonEncoding }, { fetchMessages }] = await Promise.all([
     import("./levelLazyShim-GZBKODGI.js"),
     import("./serverStoreFactory-YMXDF4NI.js"),
-    import("./fetchMessages-DRABNDPZ.js")
+    import("./fetchMessages-EIU7UFFK.js")
   ]);
   const db = new Level(args.dbPath, {
     valueEncoding: safeJsonEncoding,
@@ -1820,6 +1821,129 @@ async function runDialogDeleteCommand(args, deps = {}) {
   }
   return hasErrors ? 1 : 0;
 }
+function printSearchUsage(output) {
+  output.write(`Usage:
+  nolo dialog search <query> [--limit <n>] [--per-dialog <n>] [--json]
+
+Options:
+  --limit <n>       Max dialogs to return (default 20, max 50).
+  --per-dialog <n>  Max match snippets per dialog (default 3, max 10).
+  --json            Print machine-readable JSON.
+  --server <url>    Override NOLO_SERVER/BASE_URL.
+  --token <jwt>     Override AUTH_TOKEN.
+
+Searches messages across the current user's dialogs via the server endpoint.
+Server requires NOLO_DIALOG_SEARCH=1 to be enabled.
+`);
+}
+async function runDialogSearchCommand(args, deps = {}) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  if (hasFlag(args, "--help") || hasFlag(args, "-h")) {
+    printSearchUsage(output);
+    return 0;
+  }
+  const query = readFirstPositional(args);
+  if (!query) {
+    output.write("[nolo] dialog search requires a search query.\n\n");
+    printSearchUsage(output);
+    return 1;
+  }
+  const authToken = resolveAuthToken(args, env);
+  if (!authToken) {
+    output.write("[nolo] dialog search requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const serverUrl = resolveServerUrl(args, env);
+  const serverUrls = resolveServerCandidates(args, env, serverUrl);
+  const limitRaw = readOption(args, "--limit");
+  const perDialogRaw = readOption(args, "--per-dialog");
+  const queryParams = new URLSearchParams({ q: query });
+  if (limitRaw) queryParams.set("limit", limitRaw);
+  if (perDialogRaw) queryParams.set("perDialog", perDialogRaw);
+  const isJson = hasFlag(args, "--json");
+  let lastError = null;
+  let lastStatus = null;
+  let searchResult = null;
+  for (const candidateBase of serverUrls) {
+    const trimmedBase = candidateBase.replace(/\/+$/, "");
+    const targetUrl = `${trimmedBase}/api/dialog-search?${queryParams.toString()}`;
+    try {
+      const res = await fetchImpl(targetUrl, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${authToken}`
+        }
+      });
+      lastStatus = res.status;
+      if (!res.ok) {
+        const errorData = await res.json().catch(() => ({}));
+        if (res.status === 403) {
+          const hint = errorData?.hint ? ` (${errorData.hint})` : "";
+          const msg = errorData?.message ? `: ${errorData.message}` : "";
+          throw new Error(`Server returned 403 Forbidden${hint}${msg}. Please ensure NOLO_DIALOG_SEARCH=1 is enabled on the server.`);
+        }
+        if (res.status === 401) {
+          throw new Error(`Server returned 401 Unauthorized. Please check your AUTH_TOKEN.`);
+        }
+        throw new Error(`HTTP ${res.status}: ${JSON.stringify(errorData)}`);
+      }
+      searchResult = await res.json();
+      break;
+    } catch (err) {
+      lastError = err;
+    }
+  }
+  if (!searchResult) {
+    const errorMsg = lastError ? toErrorMessage(lastError) : "Failed to connect to candidate servers";
+    if (isJson) {
+      output.write(JSON.stringify({ error: errorMsg, status: lastStatus }, null, 2) + "\n");
+    } else {
+      output.write(`[nolo] dialog search failed: ${errorMsg}
+`);
+    }
+    return 1;
+  }
+  if (isJson) {
+    output.write(JSON.stringify(searchResult, null, 2) + "\n");
+    return 0;
+  }
+  const { dialogs, totalMatches, scannedDialogs, scannedMessages, elapsedMs, truncated } = searchResult;
+  output.write(`query: ${query}
+`);
+  output.write(`scanned: ${scannedDialogs} dialogs, ${scannedMessages} messages (${elapsedMs}ms)
+`);
+  output.write(`matches: ${totalMatches} total match(es) across ${dialogs?.length ?? 0} dialog(s)`);
+  if (truncated) {
+    output.write(" [truncated]");
+  }
+  output.write("\n");
+  if (!Array.isArray(dialogs) || dialogs.length === 0) {
+    output.write("\nNo matching dialog messages found.\n");
+    return 0;
+  }
+  for (const d of dialogs) {
+    output.write(`
+${d.title}
+`);
+    output.write(`id=${d.dialogId}
+`);
+    output.write(`updatedAt=${d.updatedAt ?? "-"}
+`);
+    output.write(`matches=${d.matchCount}
+`);
+    if (Array.isArray(d.matches) && d.matches.length > 0) {
+      for (const m of d.matches) {
+        const role = m.role ? `[${m.role}]` : "";
+        const snippet = String(m.snippet ?? "").replace(/\r?\n/g, " ");
+        output.write(`  - ${role} ${snippet}
+`);
+      }
+    }
+  }
+  return 0;
+}
 
 export {
   normalizeDialogRecord,
@@ -1832,5 +1956,6 @@ export {
   runDialogStatusCommand,
   runDialogQueryCommand,
   runDialogListCommand,
-  runDialogDeleteCommand
+  runDialogDeleteCommand,
+  runDialogSearchCommand
 };

package/{chunk-P7FA2HMM.js → chunk-SQZDZXP5.js}

@@ -9,7 +9,7 @@ import {
   initReactI18next,
   instance,
   toast
-} from "./chunk-D74EWXL4.js";
+} from "./chunk-LBEDNSMY.js";
 import {
   require_date_fns
 } from "./chunk-M76ECQRD.js";
@@ -18,7 +18,7 @@ import {
 } from "./chunk-YDH3FDFQ.js";
 import {
   isSystemAdmin
-} from "./chunk-XWNRAIUL.js";
+} from "./chunk-QDSINZM3.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -27,7 +27,7 @@ import {
   addContentAction,
   checkSpaceMembership,
   localSpaceAuthorityPatchStamp
-} from "./chunk-ZZCJUXUI.js";
+} from "./chunk-V4MJDUSR.js";
 import {
   createSpaceKey,
   normalizeSpaceId
@@ -41,9 +41,10 @@ import {
   uploadFileAction,
   upsertSSREntity,
   write
-} from "./chunk-YFADVSZE.js";
+} from "./chunk-H62HCIUP.js";
 import {
   SEPARATOR,
+  asTrimmedNonEmptyStringArray,
   createKey,
   fileKey,
   isAgentKey,
@@ -52,16 +53,13 @@ import {
   rowKey,
   splitKey,
   ulid
-} from "./chunk-NHRQCXIQ.js";
+} from "./chunk-VMFTFOWF.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
-import {
-  asTrimmedNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
 import {
   extractUserId
-} from "./chunk-BJIRLHJR.js";
+} from "./chunk-M2EJHDJP.js";
 import {
   DEVICE_LOCAL_OWNER_ID,
   createAsyncThunk,
@@ -70,7 +68,7 @@ import {
   resolveReplicationServers,
   scheduleDeleteReplication,
   scheduleWriteReplication
-} from "./chunk-3RAG2NAD.js";
+} from "./chunk-UKWGR5SS.js";
 import {
   createClientLogger,
   isAbortError
@@ -81,15 +79,15 @@ import {
 import {
   buildTombstoneRecord
 } from "./chunk-GBRG75BQ.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
 import {
   asOptionalPositiveFiniteNumber
 } from "./chunk-U6VC4MU4.js";
-import {
-  isRecord
-} from "./chunk-KUG52IAP.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -1455,11 +1453,11 @@ var ENTITY_DELETE_STRATEGIES = {
     await dispatch(deleteTable({ dbKey: key })).unwrap();
   },
   file: async (key, { thunkAPI }) => {
-    const { deleteFileAction } = await import("./deleteFile-LWSR674W.js");
+    const { deleteFileAction } = await import("./deleteFile-YG6QMJLU.js");
     await deleteFileAction(key, thunkAPI);
   },
   image: async (key, { thunkAPI }) => {
-    const { deleteFileAction } = await import("./deleteFile-LWSR674W.js");
+    const { deleteFileAction } = await import("./deleteFile-YG6QMJLU.js");
     await deleteFileAction(key, thunkAPI);
   },
   agent: async (key, { dispatch, userId, sourceServerOrigin }) => {

package/{chunk-SPAQ4PVV.js → chunk-SV5IJK6K.js}

@@ -4,7 +4,7 @@ import {
 import {
   ownedAgentKey,
   publicAgentKey
-} from "./chunk-BJIRLHJR.js";
+} from "./chunk-M2EJHDJP.js";
 
 // packages/cli/agentAliases.ts
 var CURRENT_OPERATOR_USER_ID = "0e95801d90";

package/{chunk-BJCWNHVU.js → chunk-TOP2VXOR.js}

@@ -1,9 +1,9 @@
 import {
   selectCurrentServer
-} from "./chunk-XWNRAIUL.js";
+} from "./chunk-AFUORTY4.js";
 import {
   patch
-} from "./chunk-YFADVSZE.js";
+} from "./chunk-H62HCIUP.js";
 import {
   getIsDesktopApp
 } from "./chunk-QOKAKDPE.js";