nolo-cli 0.91.0-alpha.1 → 0.93.0-alpha.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (114) hide show
  1. package/{_executeModel-U5V7LOJX.js → _executeModel-F563Y35P.js} +34 -34
  2. package/{action-EXQVY3UO.js → action-5DATYWOM.js} +6 -6
  3. package/{addContentAction-6IXQSRD2.js → addContentAction-5OLTVWIE.js} +4 -4
  4. package/{addDialogAgentAction-FZOB4BYM.js → addDialogAgentAction-BRGMORV4.js} +3 -3
  5. package/{agentDeleteCommand-4MIJFQQB.js → agentDeleteCommand-YJXDOMW4.js} +20 -20
  6. package/{agentEmailCommands-JUXT36BY.js → agentEmailCommands-LVNRAZWD.js} +42 -42
  7. package/{agentListCommands-MUVKMMZ5.js → agentListCommands-3QXPNIW2.js} +22 -22
  8. package/{agentMachineCommands-56FTZLYV.js → agentMachineCommands-7FN4UTB4.js} +20 -20
  9. package/{agentProviderCommands-TOMVKJOV.js → agentProviderCommands-GNPTL5XR.js} +1 -1
  10. package/{agentRecordCommands-FST3KAKG.js → agentRecordCommands-RTJWULKJ.js} +41 -41
  11. package/{agentRunCommand-UMUEVIY2.js → agentRunCommand-LPNG7BNB.js} +41 -41
  12. package/{agentRuntimeLocal-NH6GSGAJ.js → agentRuntimeLocal-W2SEB6WH.js} +17 -17
  13. package/{agentSlice-YZK6KG73.js → agentSlice-LZFA5LBN.js} +4 -4
  14. package/{appDeleteCommands-U45KXYX7.js → appDeleteCommands-BAOVSCQP.js} +21 -21
  15. package/{appDeployCommands-LWQIQCFX.js → appDeployCommands-ZERJEXGT.js} +21 -21
  16. package/{appDeployStatusCommands-LZO33PGD.js → appDeployStatusCommands-LAQXCIGR.js} +21 -21
  17. package/{appGetCommands-OJSO6BCF.js → appGetCommands-2LEGP6ZO.js} +21 -21
  18. package/{appListCommands-NE56V7DI.js → appListCommands-XA3FLSXC.js} +21 -21
  19. package/{authCommand-U5LA6H4Y.js → authCommand-F4EFRRX6.js} +7 -7
  20. package/{builtinSkillRegistry-4NB7PCOF.js → builtinSkillRegistry-PJU2R6ST.js} +4 -4
  21. package/{chatQueueReduxAdapter-FRMSYX7N.js → chatQueueReduxAdapter-KFNYEK7L.js} +15 -15
  22. package/{chromeCommands-VOIRNJBL.js → chromeCommands-FZYAU75D.js} +1 -1
  23. package/{chromeOpsCommands-M7DPCX2T.js → chromeOpsCommands-62P2Q2YB.js} +31 -1
  24. package/{chunk-XAQAF25W.js → chunk-2L3O7RDP.js} +1 -1
  25. package/{chunk-HGRDL36J.js → chunk-2NNZWWFU.js} +3 -3
  26. package/{chunk-LSSBA2TN.js → chunk-2WHQZTB7.js} +1 -1
  27. package/{chunk-XGJAR4T5.js → chunk-3JIXYIXV.js} +53 -2
  28. package/{chunk-W2E6HIIK.js → chunk-46TSVHGZ.js} +1 -1
  29. package/{chunk-WON762L4.js → chunk-53HEEOTT.js} +1 -1
  30. package/{chunk-XLGHBHGP.js → chunk-5LRIZC2W.js} +1 -1
  31. package/{chunk-MBEEYLGL.js → chunk-6OZ36FXI.js} +2 -2
  32. package/{chunk-DM4UNXPK.js → chunk-6R425QS6.js} +2 -2
  33. package/{chunk-4JBZUECA.js → chunk-7CN36HIQ.js} +1 -1
  34. package/{chunk-E2NP7ZQU.js → chunk-7U4UXFKY.js} +2 -2
  35. package/chunk-ACTMNVHM.js +93 -0
  36. package/{chunk-S3UI4IUJ.js → chunk-AL57GIWB.js} +15 -15
  37. package/{chunk-DSX6K7C2.js → chunk-APMXUQQ3.js} +3 -3
  38. package/{chunk-7IBK6MYW.js → chunk-CJCST55W.js} +19 -19
  39. package/{chunk-SUERPXJZ.js → chunk-CKUJINDU.js} +21 -21
  40. package/{chunk-UDEFS2PV.js → chunk-EYAQT56M.js} +2 -2
  41. package/{chunk-X2ZTVRXP.js → chunk-FJ53BJAJ.js} +4 -4
  42. package/{chunk-YPYMGGPJ.js → chunk-G3HFIFGI.js} +3 -3
  43. package/{chunk-RZYQMSQA.js → chunk-GPCZ7UXG.js} +1 -1
  44. package/{chunk-ZHUTWJ3N.js → chunk-GQBOR3G6.js} +2 -2
  45. package/{chunk-G5X57NDE.js → chunk-HBO5CSMG.js} +2 -2
  46. package/{chunk-E3VQ6S3A.js → chunk-HHTJ4Q4S.js} +129 -4
  47. package/{chunk-KR3YI36B.js → chunk-HNUNYXYB.js} +1 -1
  48. package/{chunk-HWZAXNO7.js → chunk-HVRJWI67.js} +3 -3
  49. package/{chunk-YOXYA2GU.js → chunk-IP2RNQU3.js} +1 -0
  50. package/{chunk-RLEWGSM5.js → chunk-KQ4ONNQD.js} +3 -3
  51. package/{chunk-GRDSMV4V.js → chunk-LBVREL7A.js} +4 -4
  52. package/{chunk-QMASIHYZ.js → chunk-LMYZNIHV.js} +4 -4
  53. package/{chunk-WP6BC7OF.js → chunk-MHGCDRYE.js} +9 -9
  54. package/{chunk-BKP7CFUD.js → chunk-MZRO6HYV.js} +4 -4
  55. package/{chunk-ZKMYGRO7.js → chunk-NEAX3PNR.js} +5 -5
  56. package/{chunk-4CAPEGHN.js → chunk-OIVSQH2O.js} +12 -132
  57. package/{chunk-B4S7MR5S.js → chunk-P7JENWUV.js} +3 -3
  58. package/{chunk-U47DH2WO.js → chunk-PIOIPOSY.js} +2 -2
  59. package/{chunk-OH7H6LPC.js → chunk-PLZSKYQG.js} +3 -3
  60. package/{chunk-JTYPAMGP.js → chunk-Q67DOFOO.js} +59 -4
  61. package/{chunk-BF2K6MRF.js → chunk-RAYTIPJ5.js} +2 -2
  62. package/{chunk-VOOTT7HA.js → chunk-SATOEEL6.js} +1 -1
  63. package/{chunk-QCZX4FTW.js → chunk-SH43IESU.js} +173 -15
  64. package/{chunk-AQDH76OK.js → chunk-SLBCYLRL.js} +1 -1
  65. package/{chunk-3XMOAYRC.js → chunk-T5I2N3SE.js} +1 -1
  66. package/{chunk-546FPOW3.js → chunk-T67757YH.js} +1 -1
  67. package/{chunk-COM7GG76.js → chunk-TBBSYAJI.js} +1 -1
  68. package/{chunk-TMAZ3VHN.js → chunk-TUEPUNFO.js} +1 -1
  69. package/{chunk-OOLWKQSM.js → chunk-UT5NALV3.js} +1 -1
  70. package/{chunk-NKIH4Q7W.js → chunk-UZGQNTVW.js} +1 -1
  71. package/{chunk-WKEUHK57.js → chunk-VUHXTHIK.js} +2 -2
  72. package/{chunk-SASGLNUD.js → chunk-W2G2PPK5.js} +3 -3
  73. package/{chunk-R2YY6MWV.js → chunk-WV3VGX42.js} +9 -9
  74. package/{chunk-377KM42Z.js → chunk-XUSF3HZN.js} +12 -12
  75. package/{chunk-UBNV6CS6.js → chunk-XWK7DITR.js} +29 -29
  76. package/{chunk-IIKPWSPX.js → chunk-YDEMAQEY.js} +1 -1
  77. package/{chunk-F3UTRUDO.js → chunk-YNNVVLMV.js} +3 -3
  78. package/{contentThunks-TC3AENBY.js → contentThunks-SWQ7OJBY.js} +16 -16
  79. package/{createAgentAutomationAction-67EOD3WK.js → createAgentAutomationAction-NT4MFLPF.js} +16 -16
  80. package/{createDialogAction-4OCQC5MW.js → createDialogAction-C3OWANIW.js} +18 -18
  81. package/{createPageAction-JLGVP57B.js → createPageAction-I6PQVCKP.js} +16 -16
  82. package/{dbSlice-RDGCE5MU.js → dbSlice-NP52Y5TF.js} +3 -3
  83. package/{dialogCommands-JHSDKCR5.js → dialogCommands-URIDALS5.js} +23 -21
  84. package/{dialogSlice-I2DK32ZT.js → dialogSlice-6MTAO4BE.js} +15 -15
  85. package/{docCreateCommands-QUL6VWK2.js → docCreateCommands-6M3ZY3SP.js} +20 -20
  86. package/{docDeleteCommands-DMQ2MU6I.js → docDeleteCommands-6YKAYZBI.js} +21 -21
  87. package/{docReadCommands-FVHENBU6.js → docReadCommands-SMVVD2PW.js} +20 -20
  88. package/{docStore-OLC6MD7B.js → docStore-QR3S2FUW.js} +4 -4
  89. package/{docUpdateCommands-VA6V5C6L.js → docUpdateCommands-LFZEAPNZ.js} +20 -20
  90. package/{getPricing-YYXTEPBP.js → getPricing-LUSEABA6.js} +3 -3
  91. package/{handleSendMessageAction-GRDIRXAK.js → handleSendMessageAction-FSPSFUTP.js} +15 -15
  92. package/index.js +63 -54
  93. package/{machineCommands-IJJ66MYU.js → machineCommands-E3D7X6C3.js} +40 -40
  94. package/{machineWsRunDispatch-PP2ZBS6D.js → machineWsRunDispatch-6OQM66WB.js} +40 -40
  95. package/{memberThunks-WQGQWYYT.js → memberThunks-XJFHFZ5M.js} +4 -4
  96. package/{models-UN7YGMPM.js → models-T3SG6MJ5.js} +2 -2
  97. package/package.json +1 -1
  98. package/{providerPresetApply-NO73BG45.js → providerPresetApply-FG6NZ57W.js} +6 -6
  99. package/{providerRegistry-OVY4VKNN.js → providerRegistry-757OWH3O.js} +6 -6
  100. package/{read-S4WC2OUK.js → read-KFAALANF.js} +2 -2
  101. package/{readDocTool-PQNM63KV.js → readDocTool-XNMCT64I.js} +1 -1
  102. package/{readlineWorkspace-ASJECDJD.js → readlineWorkspace-3OR2MOVO.js} +44 -44
  103. package/{removeDialogAgentAction-YJZ6XJV6.js → removeDialogAgentAction-X3IS7JNU.js} +6 -6
  104. package/{runAgentClientLoop-KIOQSDRC.js → runAgentClientLoop-LOQPKDZM.js} +32 -32
  105. package/{setDialogExtraReferencesAction-E6A3WL4E.js → setDialogExtraReferencesAction-QTV3ZJNH.js} +4 -4
  106. package/{setPrimaryDialogAgentAction-WBLIVICQ.js → setPrimaryDialogAgentAction-EUUISNQ2.js} +6 -6
  107. package/{settingSlice-JR6S7TRD.js → settingSlice-UMATY3PD.js} +5 -5
  108. package/{spaceCommands-WDUNCAK5.js → spaceCommands-UKKLOTXO.js} +20 -20
  109. package/{streamAgentChatTurn-EGQDPMAO.js → streamAgentChatTurn-U3NEGRGE.js} +36 -36
  110. package/{switchDialogAgentAction-DTR36ZY2.js → switchDialogAgentAction-HWFDQNY5.js} +3 -3
  111. package/{tools-AOVE5LKM.js → tools-6IVRFLMV.js} +29 -29
  112. package/{tuiSummaryLlmCaller-XRQCSNYQ.js → tuiSummaryLlmCaller-IKFJ55N4.js} +10 -10
  113. package/{updateDialogTitleAction-T66TXHIR.js → updateDialogTitleAction-WEZ5OS6X.js} +16 -16
  114. package/chunk-4QKBQHPQ.js +0 -79
@@ -45,6 +45,8 @@ var PLATFORM_HOSTED_CLAUDE_SONNET_5_MODEL = "anthropic/claude-sonnet-5";
45
45
  var PLATFORM_HOSTED_CLAUDE_OPUS_5_MODEL = "anthropic/claude-opus-5";
46
46
  var PLATFORM_HOSTED_CLAUDE_FABLE_5_MODEL = "anthropic/claude-fable-5";
47
47
  var PLATFORM_HOSTED_CLAUDE_HAIKU_45_MODEL = "anthropic/claude-haiku-4-5";
48
+ var PLATFORM_HOSTED_CLAUDE_OPUS_5_5_MODEL = "anthropic/claude-opus-5-5";
49
+ var PLATFORM_HOSTED_CLAUDE_FABLE_5_1_MODEL = "anthropic/claude-fable-5-1";
48
50
  var PLATFORM_HOSTED_GROK_4_6_MODEL = "grok-4.6";
49
51
  var PLATFORM_HOSTED_GPT_6_ASTRA_MODEL = "gpt-6-astra";
50
52
  var PLATFORM_HOSTED_GPT_6_LUNA_MODEL = "gpt-6-luna";
@@ -183,8 +185,10 @@ var PLATFORM_HOSTED_ROUTING_TABLE = {
183
185
  agentRunHosted: true
184
186
  },
185
187
  // Claude 系(真实模型):DeepInfra 官方 id 与平台 id 同名,无需重映射。
186
- // DeepInfra 这批模型无缓存价(rate_per_input_token_cached=null),计费侧对
187
- // 无 inputCacheHit 的 deepinfra 模型按 input 全价计(见 calculatePrice)。
188
+ // 旧批模型无缓存价(rate_per_input_token_cached=null),计费侧对无
189
+ // inputCacheHit 的模型按 input 全价计(见 calculatePrice);Fable 5.1 起
190
+ // 官方给出缓存读价(输入 1/4),在 platformHosted.ts 的 price 里带
191
+ // inputCacheHit。
188
192
  [PLATFORM_HOSTED_CLAUDE_SONNET_5_MODEL]: {
189
193
  endpoint: "https://api.deepinfra.com/v1/openai/chat/completions",
190
194
  usageProvider: "deepinfra",
@@ -217,6 +221,23 @@ var PLATFORM_HOSTED_ROUTING_TABLE = {
217
221
  wire: "chat.completions",
218
222
  agentRunHosted: true
219
223
  },
224
+ // 新一代 Claude(2026-09-24 收进广场):同 DeepInfra 通道、官方 id 直传。
225
+ [PLATFORM_HOSTED_CLAUDE_OPUS_5_5_MODEL]: {
226
+ endpoint: "https://api.deepinfra.com/v1/openai/chat/completions",
227
+ usageProvider: "deepinfra",
228
+ keyName: "deepinfra",
229
+ upstreamModelId: PLATFORM_HOSTED_CLAUDE_OPUS_5_5_MODEL,
230
+ wire: "chat.completions",
231
+ agentRunHosted: true
232
+ },
233
+ [PLATFORM_HOSTED_CLAUDE_FABLE_5_1_MODEL]: {
234
+ endpoint: "https://api.deepinfra.com/v1/openai/chat/completions",
235
+ usageProvider: "deepinfra",
236
+ keyName: "deepinfra",
237
+ upstreamModelId: PLATFORM_HOSTED_CLAUDE_FABLE_5_1_MODEL,
238
+ wire: "chat.completions",
239
+ agentRunHosted: true
240
+ },
220
241
  // GPT-6 / GPT-5.6 系(OpenAI 官方 chat.completions):
221
242
  // 平台价按短上下文价目定(长上下文档差价由平台吸收),见 platformHosted.ts。
222
243
  [PLATFORM_HOSTED_GPT_6_ASTRA_MODEL]: {
@@ -534,6 +555,20 @@ var PLATFORM_HOSTED_CLAUDE_HAIKU_45_PRICE = {
534
555
  output: toPlatformCredits(5)
535
556
  // 40 credits
536
557
  };
558
+ var PLATFORM_HOSTED_CLAUDE_OPUS_5_5_PRICE = {
559
+ input: toPlatformCredits(4),
560
+ // 32 credits
561
+ output: toPlatformCredits(20)
562
+ // 160 credits
563
+ };
564
+ var PLATFORM_HOSTED_CLAUDE_FABLE_5_1_PRICE = {
565
+ input: toPlatformCredits(10),
566
+ // 80 credits
567
+ inputCacheHit: toPlatformCredits(2.5),
568
+ // 20 credits(官方缓存读 = 输入 1/4)
569
+ output: toPlatformCredits(50)
570
+ // 400 credits
571
+ };
537
572
  var PLATFORM_HOSTED_GPT_6_ASTRA_PRICE = {
538
573
  input: toPlatformCredits(10),
539
574
  // 80 credits
@@ -890,8 +925,8 @@ var platformHostedModels = [
890
925
  supportsTool: true,
891
926
  supportsReasoningEffort: true
892
927
  },
893
- // Claude 系(真实 DeepInfra 模型,官方 id 与平台 id 同名):无缓存价,
894
- // 计费按 input 全价(见 calculatePrice 的 deepinfra 分支)。
928
+ // Claude 系(真实 DeepInfra 模型,官方 id 与平台 id 同名):旧批无缓存价,
929
+ // 计费按 input 全价(见 calculatePrice);Fable 5.1 带官方缓存读价。
895
930
  {
896
931
  name: PLATFORM_HOSTED_CLAUDE_SONNET_5_MODEL,
897
932
  displayName: "Claude Sonnet 5",
@@ -928,6 +963,26 @@ var platformHostedModels = [
928
963
  contextWindow: 2e5,
929
964
  supportsTool: false
930
965
  },
966
+ {
967
+ // Claude Opus 5.5(2026-09-22 发布):官方 1M 上下文 / 128K 输出。
968
+ name: PLATFORM_HOSTED_CLAUDE_OPUS_5_5_MODEL,
969
+ displayName: "Claude Opus 5.5",
970
+ hasVision: true,
971
+ price: { ...PLATFORM_HOSTED_CLAUDE_OPUS_5_5_PRICE },
972
+ maxOutputTokens: 128e3,
973
+ contextWindow: 1e6,
974
+ supportsTool: false
975
+ },
976
+ {
977
+ // Claude Fable 5.1:输出上限未获官方数据,沿用 Fable 5 条目口径(4092)。
978
+ name: PLATFORM_HOSTED_CLAUDE_FABLE_5_1_MODEL,
979
+ displayName: "Claude Fable 5.1",
980
+ hasVision: true,
981
+ price: { ...PLATFORM_HOSTED_CLAUDE_FABLE_5_1_PRICE },
982
+ maxOutputTokens: 4092,
983
+ contextWindow: 1e6,
984
+ supportsTool: false
985
+ },
931
986
  // GPT-6 / GPT-5.6 系:OpenAI 官方 chat.completions,平台价按短上下文价目。
932
987
  {
933
988
  name: PLATFORM_HOSTED_GPT_6_ASTRA_MODEL,
@@ -6,10 +6,10 @@ import {
6
6
  } from "./chunk-DWLEOOGR.js";
7
7
  import {
8
8
  addContentAction
9
- } from "./chunk-XLGHBHGP.js";
9
+ } from "./chunk-5LRIZC2W.js";
10
10
  import {
11
11
  upload
12
- } from "./chunk-F3UTRUDO.js";
12
+ } from "./chunk-YNNVVLMV.js";
13
13
  import {
14
14
  getRuntimeServerContext
15
15
  } from "./chunk-UKWGR5SS.js";
@@ -7,7 +7,7 @@ import {
7
7
  import {
8
8
  patch,
9
9
  selectById
10
- } from "./chunk-F3UTRUDO.js";
10
+ } from "./chunk-YNNVVLMV.js";
11
11
  import {
12
12
  __toESM
13
13
  } from "./chunk-4VNS5WPM.js";
@@ -6,19 +6,146 @@ import {
6
6
  } from "./chunk-KUG52IAP.js";
7
7
 
8
8
  // packages/desktop-chrome-connector/chromeConnector.ts
9
- import { existsSync, readFileSync } from "node:fs";
10
- import { resolve } from "node:path";
9
+ import { existsSync as existsSync2, readFileSync } from "node:fs";
10
+ import { resolve as resolve2 } from "node:path";
11
+
12
+ // packages/desktop-chrome-connector/uploadSecurity.mjs
13
+ import { existsSync, realpathSync, statSync } from "node:fs";
14
+ import { isAbsolute, relative, resolve } from "node:path";
15
+ var DEFAULT_MAX_FILE_BYTES = 25 * 1024 * 1024;
16
+ var DEFAULT_MAX_FILES = 10;
17
+ var UploadSecurityError = class extends Error {
18
+ constructor(code, message) {
19
+ super(message);
20
+ this.name = "UploadSecurityError";
21
+ this.code = code;
22
+ }
23
+ };
24
+ function createUploadSecurityError(code, message) {
25
+ return new UploadSecurityError(code, message);
26
+ }
27
+ function isSubpath(parent, child) {
28
+ const rel = relative(parent, child);
29
+ return !rel.startsWith("..") && !isAbsolute(rel);
30
+ }
31
+ function parseAllowedRoots(env = process.env) {
32
+ const raw = env?.NOLO_CHROME_UPLOAD_ROOTS;
33
+ if (!raw || typeof raw !== "string") {
34
+ return [];
35
+ }
36
+ return raw.split(",").map((entry) => entry.trim()).filter(Boolean).filter((entry) => isAbsolute(entry)).map((entry) => {
37
+ const resolved = resolve(entry);
38
+ if (existsSync(resolved)) {
39
+ try {
40
+ return realpathSync(resolved);
41
+ } catch {
42
+ return resolved;
43
+ }
44
+ }
45
+ return resolved;
46
+ });
47
+ }
48
+ function validateUploadFiles(options = {}) {
49
+ const {
50
+ files,
51
+ env = process.env,
52
+ maxFiles = DEFAULT_MAX_FILES,
53
+ maxFileBytes = DEFAULT_MAX_FILE_BYTES
54
+ } = options;
55
+ if (!Array.isArray(files) || files.length === 0) {
56
+ throw createUploadSecurityError("no_files", "Provide at least one file to upload.");
57
+ }
58
+ if (files.length > maxFiles) {
59
+ throw createUploadSecurityError(
60
+ "too_many_files",
61
+ `Too many files: ${files.length} provided, maximum allowed is ${maxFiles}.`
62
+ );
63
+ }
64
+ const allowedRoots = parseAllowedRoots(env);
65
+ if (allowedRoots.length === 0) {
66
+ throw createUploadSecurityError(
67
+ "path_not_allowed",
68
+ "Upload roots not configured in NOLO_CHROME_UPLOAD_ROOTS; all uploads are refused."
69
+ );
70
+ }
71
+ const fileStats = [];
72
+ const canonicalFiles = [];
73
+ let totalBytes = 0;
74
+ for (const rawFile of files) {
75
+ if (typeof rawFile !== "string" || !rawFile.trim()) {
76
+ throw createUploadSecurityError("path_not_allowed", "File path must be a non-empty string.");
77
+ }
78
+ const trimmed = rawFile.trim();
79
+ const resolvedCandidate = resolve(trimmed);
80
+ if (!existsSync(resolvedCandidate)) {
81
+ throw createUploadSecurityError("path_not_allowed", `File not found or inaccessible: ${rawFile}`);
82
+ }
83
+ let real;
84
+ try {
85
+ real = realpathSync(resolvedCandidate);
86
+ } catch {
87
+ throw createUploadSecurityError("path_not_allowed", `Could not resolve canonical path for: ${rawFile}`);
88
+ }
89
+ let st;
90
+ try {
91
+ st = statSync(real);
92
+ } catch {
93
+ throw createUploadSecurityError("path_not_allowed", `Could not stat file: ${rawFile}`);
94
+ }
95
+ if (!st.isFile()) {
96
+ throw createUploadSecurityError("path_not_allowed", `Target path is not a regular file: ${rawFile}`);
97
+ }
98
+ if (st.size > maxFileBytes) {
99
+ throw createUploadSecurityError(
100
+ "too_large",
101
+ `File size ${st.size} bytes exceeds maximum allowed limit of ${maxFileBytes} bytes: ${rawFile}`
102
+ );
103
+ }
104
+ const realInside = allowedRoots.some((root) => isSubpath(root, real));
105
+ if (!realInside) {
106
+ throw createUploadSecurityError(
107
+ "path_not_allowed",
108
+ `Path '${rawFile}' (resolved: '${real}') is not within allowed upload roots.`
109
+ );
110
+ }
111
+ canonicalFiles.push(real);
112
+ fileStats.push({ path: real, bytes: st.size });
113
+ totalBytes += st.size;
114
+ }
115
+ return {
116
+ ok: true,
117
+ files: canonicalFiles,
118
+ fileStats,
119
+ totalBytes
120
+ };
121
+ }
122
+ function formatUploadAuditLog(entry = {}) {
123
+ const ts = entry.timestamp || (/* @__PURE__ */ new Date()).toISOString();
124
+ const safeTabId = String(entry.tabId ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
125
+ const safeTarget = String(entry.target ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
126
+ const files = Array.isArray(entry.files) ? entry.files : [];
127
+ const totalBytes = files.reduce((sum, f) => sum + (Number(f.bytes) || 0), 0);
128
+ const fileDetails = files.map((f) => `${String(f.path || "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ")}(${f.bytes || 0}B)`).join(", ");
129
+ return `[chrome-upload] ${ts} tabId=${safeTabId} target=${safeTarget} files=[${fileDetails}] totalBytes=${totalBytes}`;
130
+ }
131
+ function logUploadAudit(entry, logFn = console.warn) {
132
+ const line = formatUploadAuditLog(entry);
133
+ logFn(line);
134
+ return line;
135
+ }
136
+
137
+ // packages/desktop-chrome-connector/chromeConnector.ts
11
138
  var NOLO_CHROME_CONNECTOR_EXTENSION_ID = "ahpdoopadkamnglhlacfjdfnonpjdplg";
12
139
  var NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION = "2";
13
140
  function defaultTokenPath() {
14
- return resolve(
141
+ return resolve2(
15
142
  process.env.HOME || "",
16
143
  "Library/Application Support/Nolo/ChromeConnector/token"
17
144
  );
18
145
  }
19
146
  function readConnectorToken(tokenPath = defaultTokenPath()) {
20
147
  if (process.env.NOLO_CHROME_CONNECTOR_TOKEN) return process.env.NOLO_CHROME_CONNECTOR_TOKEN;
21
- if (!existsSync(tokenPath)) return "";
148
+ if (!existsSync2(tokenPath)) return "";
22
149
  return readFileSync(tokenPath, "utf8").trim();
23
150
  }
24
151
  var CHROME_TOOL_ACTIONS = {
@@ -32,7 +159,10 @@ var CHROME_TOOL_ACTIONS = {
32
159
  chrome_scroll: "scroll",
33
160
  chrome_screenshot: "screenshot",
34
161
  chrome_read_console: "read_console",
35
- chrome_read_network: "read_network"
162
+ chrome_read_network: "read_network",
163
+ chrome_set_files: "set_files",
164
+ chrome_upload_file: "set_files",
165
+ chrome_upload: "set_files"
36
166
  };
37
167
  function createConnectorError(code, message, details) {
38
168
  const error = new Error(message);
@@ -59,8 +189,8 @@ function errorPayload(error) {
59
189
  ...error?.details !== void 0 ? { details: error.details } : {}
60
190
  };
61
191
  }
62
- var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type"]);
63
- var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach"]);
192
+ var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type", "set_files"]);
193
+ var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach", "set_files"]);
64
194
  function validateChromeConnectorPayload(action, payload) {
65
195
  if (TAB_ID_REQUIRED_ACTIONS.has(action)) {
66
196
  const raw = payload.tabId;
@@ -71,16 +201,42 @@ function validateChromeConnectorPayload(action, payload) {
71
201
  `Provide the tabId from chrome_list_tabs before calling ${action}.`
72
202
  );
73
203
  }
74
- return;
204
+ if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
75
205
  }
76
206
  if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
77
- const elementRef = typeof payload.elementRef === "string" ? payload.elementRef.trim() : "";
207
+ const rawRef = typeof payload.elementRef === "string" ? payload.elementRef : typeof payload.ref === "string" ? payload.ref : "";
208
+ const elementRef = rawRef.trim();
78
209
  const selector = typeof payload.selector === "string" ? payload.selector.trim() : "";
79
- if (elementRef || selector) return;
80
- throw createConnectorError(
81
- "ELEMENT_TARGET_REQUIRED",
82
- "Provide elementRef from chrome_read_page or a CSS selector."
83
- );
210
+ if (!elementRef && !selector) {
211
+ throw createConnectorError(
212
+ "ELEMENT_TARGET_REQUIRED",
213
+ "Provide elementRef from chrome_read_page or a CSS selector."
214
+ );
215
+ }
216
+ if (action === "set_files") {
217
+ if (!Array.isArray(payload.files) || payload.files.length === 0) {
218
+ throw createConnectorError(
219
+ "no_files",
220
+ "Provide at least one file path in files array."
221
+ );
222
+ }
223
+ try {
224
+ const validated = validateUploadFiles({
225
+ files: payload.files,
226
+ env: process.env
227
+ });
228
+ payload.files = validated.files;
229
+ const targetStr = elementRef ? `ref:${elementRef}` : `selector:${selector}`;
230
+ logUploadAudit({
231
+ tabId: String(payload.tabId),
232
+ target: targetStr,
233
+ files: validated.fileStats
234
+ });
235
+ } catch (err) {
236
+ const code = err?.code ?? "path_not_allowed";
237
+ throw createConnectorError(code, toErrorMessage(err));
238
+ }
239
+ }
84
240
  }
85
241
  function createChromeConnectorClient(args) {
86
242
  if (args?.request) return { request: args.request };
@@ -90,6 +246,7 @@ function createChromeConnectorClient(args) {
90
246
  const token = args?.token ?? readConnectorToken(args?.tokenPath);
91
247
  return {
92
248
  async request(action, payload) {
249
+ validateChromeConnectorPayload(action, payload);
93
250
  let response;
94
251
  try {
95
252
  response = await fetchImpl(endpoint, {
@@ -131,7 +288,8 @@ var REQUIRED_CHROME_CONNECTOR_FEATURES = {
131
288
  screenshot: ["browser_debug"],
132
289
  read_console: ["browser_debug"],
133
290
  read_network: ["browser_debug"],
134
- detach: ["browser_debug"]
291
+ detach: ["browser_debug"],
292
+ set_files: ["compact_observation_v2", "file_upload"]
135
293
  };
136
294
  function requiredFeaturesForConnectorAction(action) {
137
295
  return [...REQUIRED_CHROME_CONNECTOR_FEATURES[action] ?? []];
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  fetchReferenceContents,
3
3
  resolveReferenceAssets
4
- } from "./chunk-377KM42Z.js";
4
+ } from "./chunk-XUSF3HZN.js";
5
5
 
6
6
  // packages/ai/agent/fetchAgentContexts.ts
7
7
  async function fetchAgentContexts(references, dispatch) {
@@ -2,7 +2,7 @@ import {
2
2
  deleteDbRecord,
3
3
  queryUserRecords,
4
4
  readDbRecord
5
- } from "./chunk-E2NP7ZQU.js";
5
+ } from "./chunk-7U4UXFKY.js";
6
6
  import {
7
7
  mergeAndDedupUserData
8
8
  } from "./chunk-KQHGZWSV.js";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  BUILTIN_NOLO_AGENT_KEY
3
- } from "./chunk-XGJAR4T5.js";
3
+ } from "./chunk-3JIXYIXV.js";
4
4
 
5
5
  // packages/ai/tools/agentCapabilities.ts
6
6
  var SYSTEM_AGENT_CAPABILITIES = [
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  readDbRecord,
3
3
  writeAgentRecord
4
- } from "./chunk-E2NP7ZQU.js";
4
+ } from "./chunk-7U4UXFKY.js";
5
5
  import {
6
6
  buildSkillSummaryMarker
7
7
  } from "./chunk-VF4K2QE6.js";
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  DEFAULT_AGENT_BASE_POLICY,
3
3
  DEFAULT_USER_PREFERENCE_PROFILE
4
- } from "./chunk-DM4UNXPK.js";
4
+ } from "./chunk-6R425QS6.js";
5
5
 
6
6
  // packages/ai/policy/runtimePolicy.ts
7
7
  var clampLevel = (value, fallback) => {
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  BUILTIN_PLATFORM_AGENT_KEYS
3
- } from "./chunk-XGJAR4T5.js";
3
+ } from "./chunk-3JIXYIXV.js";
4
4
  import {
5
5
  getRuntimeServerContext,
6
6
  partitionReadServers,
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  trimTrailingSlash
3
- } from "./chunk-MBEEYLGL.js";
3
+ } from "./chunk-6OZ36FXI.js";
4
4
  import {
5
5
  toErrorMessage
6
6
  } from "./chunk-HNMXYYJR.js";
@@ -6,7 +6,7 @@ import {
6
6
  buildBuiltinObjectSkillDbKey,
7
7
  buildBuiltinObjectSkillPageContent,
8
8
  buildCodeWorkDiscipline
9
- } from "./chunk-XAQAF25W.js";
9
+ } from "./chunk-2L3O7RDP.js";
10
10
  import {
11
11
  buildSkillDocMarkdown,
12
12
  resolvePageSkillMetadata
@@ -16,7 +16,7 @@ import {
16
16
  } from "./chunk-O6OSWFZQ.js";
17
17
  import {
18
18
  nolotusId
19
- } from "./chunk-546FPOW3.js";
19
+ } from "./chunk-T67757YH.js";
20
20
  import {
21
21
  asNonEmptyStringArray
22
22
  } from "./chunk-VMFTFOWF.js";
@@ -10,7 +10,7 @@ import {
10
10
  import {
11
11
  patch,
12
12
  readAndWait
13
- } from "./chunk-F3UTRUDO.js";
13
+ } from "./chunk-YNNVVLMV.js";
14
14
  import {
15
15
  asOptionalTrimmedString
16
16
  } from "./chunk-G3SUCT4W.js";
@@ -326,7 +326,7 @@ async function saveDocState(arg, { dispatch, getState }) {
326
326
  ).unwrap();
327
327
  if (dbSpaceId) {
328
328
  try {
329
- const { updateContentTitle } = await import("./contentThunks-TC3AENBY.js");
329
+ const { updateContentTitle } = await import("./contentThunks-SWQ7OJBY.js");
330
330
  await dispatch(
331
331
  updateContentTitle({
332
332
  spaceId: dbSpaceId,
@@ -365,7 +365,7 @@ async function saveDocState(arg, { dispatch, getState }) {
365
365
  }
366
366
  }
367
367
  async function createDocState(args, thunkApi) {
368
- const { createPageAction } = await import("./createPageAction-JLGVP57B.js");
368
+ const { createPageAction } = await import("./createPageAction-I6PQVCKP.js");
369
369
  return createPageAction(args, thunkApi);
370
370
  }
371
371
  function subscribe(listener) {
@@ -8,7 +8,7 @@ import {
8
8
  readSseFrames,
9
9
  streamSseDataValues,
10
10
  throwIfChatCompletionStreamFailed
11
- } from "./chunk-HWZAXNO7.js";
11
+ } from "./chunk-HVRJWI67.js";
12
12
  import {
13
13
  DEVIN_CONNECT_URL
14
14
  } from "./chunk-Q5FJJ6XI.js";
@@ -20,7 +20,7 @@ import {
20
20
  resolveHistoricalToolContentCap,
21
21
  resolveToolOutputProfile,
22
22
  stripImagePartsFromMessages
23
- } from "./chunk-G5X57NDE.js";
23
+ } from "./chunk-HBO5CSMG.js";
24
24
  import {
25
25
  downgradeUnparsableToolCalls,
26
26
  hasParsableObjectArguments,
@@ -44,7 +44,7 @@ import {
44
44
  requiresBareImageUrl,
45
45
  resolveToolGuidedSections,
46
46
  toBareImageUrlMessages
47
- } from "./chunk-DSX6K7C2.js";
47
+ } from "./chunk-APMXUQQ3.js";
48
48
  import {
49
49
  convertMessagesToResponsesInput,
50
50
  extractReasoningFromResponseOutput,
@@ -68,16 +68,16 @@ import {
68
68
  parseNoloWorkspaceToolArguments,
69
69
  readTextStreamUpToChars,
70
70
  resolveNoloDialogInput
71
- } from "./chunk-YOXYA2GU.js";
71
+ } from "./chunk-IP2RNQU3.js";
72
72
  import {
73
73
  getAntigravityUserAgent,
74
74
  readAntigravityProjectId,
75
75
  resolveAntigravityCloudCodeBaseUrl
76
- } from "./chunk-NKIH4Q7W.js";
76
+ } from "./chunk-UZGQNTVW.js";
77
77
  import {
78
78
  buildProviderAuthHeaders,
79
79
  buildProviderExecutionPlan
80
- } from "./chunk-MBEEYLGL.js";
80
+ } from "./chunk-6OZ36FXI.js";
81
81
  import {
82
82
  buildDialogFallbackTitleFromUserInput
83
83
  } from "./chunk-2MBTWINN.js";
@@ -91,7 +91,7 @@ import {
91
91
  resolveEmptyAssistantFallbackMessage,
92
92
  resolveEmptyAssistantOutcome,
93
93
  resolveTruncatedReasoningTailLog
94
- } from "./chunk-GRDSMV4V.js";
94
+ } from "./chunk-LBVREL7A.js";
95
95
  import {
96
96
  COMPACTION_SUMMARY_SCHEMA_VERSION,
97
97
  COMPACTION_SUMMARY_SYSTEM_PROMPT,
@@ -110,7 +110,7 @@ import {
110
110
  resolveCompressionTriggerRatio,
111
111
  truncateToolOutputForContext,
112
112
  withProviderCallTimingFields
113
- } from "./chunk-BF2K6MRF.js";
113
+ } from "./chunk-RAYTIPJ5.js";
114
114
  import {
115
115
  estimateTokenCount
116
116
  } from "./chunk-PSCNXBYA.js";
@@ -19373,7 +19373,7 @@ function buildLoadSkillExecutor(args2) {
19373
19373
  const { resolveSkillByName } = await import("./skillDiscovery-CYUCJMAG.js");
19374
19374
  const resolved = resolveSkillByName(args2.cwd, name);
19375
19375
  if (!resolved) {
19376
- const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-4NB7PCOF.js");
19376
+ const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-PJU2R6ST.js");
19377
19377
  const builtin = resolveBuiltinSkillByName(name);
19378
19378
  if (builtin) {
19379
19379
  return {
@@ -7,7 +7,7 @@ import {
7
7
  import {
8
8
  clipMultilineText,
9
9
  fetchAndSerializeTable
10
- } from "./chunk-UBNV6CS6.js";
10
+ } from "./chunk-XWK7DITR.js";
11
11
  import {
12
12
  isGatewayHttpStatus
13
13
  } from "./chunk-NF64D32W.js";
@@ -19,7 +19,7 @@ import {
19
19
  } from "./chunk-3L2WKC3W.js";
20
20
  import {
21
21
  slateToSimplifiedMarkdown
22
- } from "./chunk-KR3YI36B.js";
22
+ } from "./chunk-HNUNYXYB.js";
23
23
  import {
24
24
  waitForAbortableDelay
25
25
  } from "./chunk-N4G4PKQ6.js";
@@ -28,26 +28,26 @@ import {
28
28
  } from "./chunk-MEYIRKDN.js";
29
29
  import {
30
30
  fetchAndCacheMessages
31
- } from "./chunk-SUERPXJZ.js";
31
+ } from "./chunk-CKUJINDU.js";
32
32
  import {
33
33
  shouldUseServerProxy
34
34
  } from "./chunk-YYLHWIW6.js";
35
35
  import {
36
36
  fetchServerSyncedCredential
37
- } from "./chunk-X2ZTVRXP.js";
37
+ } from "./chunk-FJ53BJAJ.js";
38
38
  import {
39
39
  buildSkillGuidancePromptBlock,
40
40
  extractRuntimePageCapabilities,
41
41
  resolveBuiltinSkillPage,
42
42
  resolveSkillGraphFromRoots
43
- } from "./chunk-WKEUHK57.js";
43
+ } from "./chunk-VUHXTHIK.js";
44
44
  import {
45
45
  buildIdentityBlock,
46
46
  buildRuntimeGuidanceBlocks,
47
47
  compileContextLayers,
48
48
  normalizeChatCompletionsBodyForProvider,
49
49
  resolveToolGuidedSections
50
- } from "./chunk-DSX6K7C2.js";
50
+ } from "./chunk-APMXUQQ3.js";
51
51
  import {
52
52
  convertMessagesToResponsesInput,
53
53
  getUsageRequestOptions,
@@ -57,10 +57,10 @@ import {
57
57
  import {
58
58
  ANTIGRAVITY_CLOUD_CODE_BASE_URL,
59
59
  isAntigravityOAuthAgent
60
- } from "./chunk-NKIH4Q7W.js";
60
+ } from "./chunk-UZGQNTVW.js";
61
61
  import {
62
62
  buildProviderAuthHeaders
63
- } from "./chunk-MBEEYLGL.js";
63
+ } from "./chunk-6OZ36FXI.js";
64
64
  import {
65
65
  estimateTokenCount
66
66
  } from "./chunk-PSCNXBYA.js";
@@ -68,12 +68,12 @@ import {
68
68
  isOpenAiResponsesModel,
69
69
  resolvePlatformChatCompletionsEndpoint,
70
70
  resolvePlatformResponsesEndpoint
71
- } from "./chunk-ZHUTWJ3N.js";
71
+ } from "./chunk-GQBOR3G6.js";
72
72
  import {
73
73
  clampReasoningEffort,
74
74
  getModelConfig,
75
75
  isModelSupportReasoningEffort
76
- } from "./chunk-4CAPEGHN.js";
76
+ } from "./chunk-OIVSQH2O.js";
77
77
  import {
78
78
  createFileCredentialBroker
79
79
  } from "./chunk-HVURBGF3.js";
@@ -93,13 +93,13 @@ import {
93
93
  isFireworksKimiModel,
94
94
  isPlatformMimoProviderModel,
95
95
  resolveFireworksKimiModel
96
- } from "./chunk-JTYPAMGP.js";
96
+ } from "./chunk-Q67DOFOO.js";
97
97
  import {
98
98
  createSpaceKey
99
99
  } from "./chunk-UAD2WT54.js";
100
100
  import {
101
101
  read
102
- } from "./chunk-F3UTRUDO.js";
102
+ } from "./chunk-YNNVVLMV.js";
103
103
  import {
104
104
  asTrimmedLowercaseString
105
105
  } from "./chunk-QSJ3HFEF.js";