@aliyunrds/ctxdb 1.0.11-beta.1 → 1.0.12-beta.0

package/README.md

@@ -44,9 +44,9 @@ session remains available for `ctxdb setup --agent <name>` to retry. Hermes appr
 remain explicit, and successful setup includes the usual host restart/trust reminders.
 Ordinary setup preserves
 existing authentication and binds the default login only for an Agent without an authentication
-choice. Without `--base-url`, setup resets the selected credential's DATA endpoint to
-`https://api.cn-hangzhou.agentcontext.aliyuncs.com`, including existing keys and logins.
-All Agents sharing that login use its updated endpoint. `setup --all` applies the same policy to detected Agents.
+choice. Setup, setup --all, update and reauthorization retain each credential's saved DATA endpoint.
+A fresh installation defaults to China. To switch sites, authorize a new login with `--site`,
+or supply that site's API key with `setup --api-key ... --site ...`; setup never redirects an existing token.
 An explicit invalid `--base-url` (including a missing or empty value) fails before configuration
 changes and suggests the current production URL; it never acts like an omitted option.
 
@@ -85,13 +85,20 @@ Upgrade the CLI and the actual hooks/plugin artifacts together before enabling s
 New CLI reading old v2 configuration is supported; old CLI reading shared-login configuration is not.
 See [共享登录、完整命令与兼容契约](../../docs/cli-shared-login.md) for migration and concurrency details.
 
-The production Core origin `https://api.cn-hangzhou.agentcontext.aliyuncs.com` defaults to the console page
-`https://rdsnext.console.aliyun.com/contextDbCliAuthorization/cn-hangzhou`. CLI appends the current
-`user_code`; the console route uses the fixed `cn-hangzhou` region.
-Ordinary DATA requests and artifact-only `upgrade` keep the configured origin, without endpoint fallback.
-`setup` and every `login`, including reauthorization, use the default production origin unless
-`--base-url` is supplied. Relogin no longer inherits the previous session's origin.
-Explicitly selecting the legacy Core origin `https://context-database.aliyuncs.com` keeps the same console mapping.
+Official site presets live in `access_layer/shared/src/sites.ts` and are shared with debug policy.
+Use `ctxdb login --agent codex --site intl` for international Singapore, or `--site cn` for China.
+`setup --api-key <key> --site intl` and `openclaw ctxdb init --api-key <key> --site intl`
+select the same service. A matching `setup --site` preserves the credential's exact official alias.
+
+| Site | Core endpoint | Console authorization page |
+|---|---|---|
+| `cn` | `https://api.cn-hangzhou.agentcontext.aliyuncs.com` | `https://rdsnext.console.aliyun.com/contextDbCliAuthorization/cn-hangzhou` |
+| `intl` | `https://context-database.ap-southeast-1.aliyuncs.com` | `https://rds.console.alibabacloud.com/contextDbCliAuthorization/ap-southeast-1` |
+
+The China alias `https://context-database.aliyuncs.com` retains its China console mapping.
+Specifying the Singapore `--base-url` also selects the international authorization page automatically.
+CLI appends the current `user_code`. A site preset cannot be combined with `--base-url`, `--server`
+or `--login-url`; explicit `--site` uses its built-in authorization page.
 Use `--base-url` to select the Core service and `--login-url` to supply the HTTPS console page
 for this invocation. The latter does not change the service origin or persist a console mapping.
 The legacy `--server` alias for `--base-url` remains accepted; do not pass both.
@@ -411,7 +418,8 @@ hooks, plugins, or skills. It requires that profile to already exist.
 
 The official-production URL allowlist contains
 `https://api.cn-hangzhou.agentcontext.aliyuncs.com` and the legacy
-`https://context-database.aliyuncs.com` (a trailing slash is equivalent).
+`https://context-database.aliyuncs.com`, plus Singapore
+`https://context-database.ap-southeast-1.aliyuncs.com` (a trailing slash is equivalent).
 Policy is evaluated after profile/default inheritance and `CTXDB_BASE_URL`.
 Any other complete URL—including pre-production domains, numeric IPs,
 localhost, HTTP, alternate ports or paths—and any invalid URL forces effective
@@ -1021,3 +1029,10 @@ Codex 0.153.4 has completed the automatic lifecycle against a local test center/
 上传时可用 `ctxdb kb upload-text` 或 `ctxdb kb upload-file` 的 `--review-enabled` / `--no-review-enabled` 覆盖本次文档评审开关；不传时沿用服务端默认，不修改知识库策略。两标志互斥，分片上传保留同一选择。上传回执不代表评审或入库完成，应查询实际状态。
 
 `memory get <fact-id> --verbose` 通过原生 Fact 详情接口读取状态、关联实体 ID、来源及参考/记录时间；默认 `memory get` 的 mem0 输出保持兼容。召回统计可从同一身份的 `memory list` 中按 ID 对应读取。
+
+
+### 删除记忆与自动采集
+
+Agent 本轮实际调用 `ctxdb memory delete` / `memory batch-delete` 或已注册的 ContextDB 删除工具后，该轮自动采集返回 `memory_cleanup_skip`。即使删除失败，也不会把清理请求和结果汇报再次自动写入记忆；同轮其他业务信息也会跳过。查询、搜索、列出记忆正常采集，下一轮正常判断。
+
+该规则不改变删除接口，不新增配置项。自动采集只发送当前轮正文，不重复加入前序摘要。命令示例和帮助命令不触发；隐藏在自定义脚本、动态命令或直接 HTTP/SDK 请求内的删除不在首版检测保证范围。宿主完成条件与验收范围见 [hooks 支持矩阵](../../docs/hooks-support-matrix.md)。

package/dist/{chunk-CA7XEF4X.js → chunk-4GYXLFNU.js}

@@ -7,22 +7,27 @@ import {
   isConnectionError,
   resetCircuit,
   tripCircuit
-} from "./chunk-XWJAZAMN.js";
+} from "./chunk-7CZIQG6Z.js";
 import {
   CtxdbError,
   debug,
   extractSkillSignals,
   isDataApiReady,
   isDebug,
-  readTranscript,
+  normalizeTranscriptRows,
+  readTranscriptSnapshot,
   selectTurnRows,
   toKbDetectionMessages,
   toParsedMessages
-} from "./chunk-TZFDXKLJ.js";
+} from "./chunk-HUX2XS5P.js";
 
 // src/lib/capture-orchestrator.ts
 import {
   filterMessagesForExtraction,
+  detectMemoryCleanup,
+  captureToolCalls,
+  selectCaptureTurn,
+  captureCompletionReason,
   isKnowledgeBaseUploadTurn,
   selectTurnMessages
 } from "@aliyunrds/ctxdb-shared";
@@ -48,10 +53,23 @@ function getGitContext() {
 }
 
 // src/lib/capture-orchestrator.ts
-async function captureTurn(transcriptPath, cfg, client, agent = "default", sessionId) {
+async function captureTurn(transcriptPath, cfg, client, agent = "default", sessionId, completion = {}) {
   const preflight = capturePreflight(cfg, agent);
   if (preflight) return preflight;
-  const rows = readTranscript(transcriptPath);
+  const snapshot = readTranscriptSnapshot(transcriptPath);
+  if (snapshot.incomplete) return { captured: false, reason: "transcript_incomplete", messageCount: 0 };
+  const rawTurn = selectCaptureTurn(snapshot.rawRows);
+  const toolCalls = captureToolCalls(rawTurn);
+  const cleanup = detectMemoryCleanup(toolCalls);
+  if (cleanup.detected) {
+    debug("capture", "memory cleanup skipped", { agent, sessionId, turnId: completion.turnId, operation: cleanup.operation, source: cleanup.source });
+    return { captured: false, reason: "memory_cleanup_skip", messageCount: 0 };
+  }
+  const rows = normalizeTranscriptRows(rawTurn);
+  if (!rawTurn.length && snapshot.rows.length) {
+    const reason = toParsedMessages(snapshot.rows).length ? "empty_turn_slice" : `transcript_schema_mismatch: rows=${snapshot.rows.length} parsed=0`;
+    return { captured: false, reason, messageCount: 0 };
+  }
   if (rows.length === 0) {
     return { captured: false, reason: "empty_transcript", messageCount: 0 };
   }
@@ -69,12 +87,19 @@ async function captureTurn(transcriptPath, cfg, client, agent = "default", sessi
   if (dbg) debug("capture", "current turn rows", summarizeTranscriptRows(turnRows));
   return captureParsedMessages(parsed, cfg, client, agent, sessionId, {
     kbDetectionMessages: toKbDetectionMessages(turnRows),
-    skills: extractSkillSignals(rows)
+    skills: extractSkillSignals(rows),
+    toolCalls,
+    completionReason: captureCompletionReason(rawTurn, completion)
   });
 }
 async function captureParsedMessages(parsed, cfg, client, agent = "default", sessionId, options = {}) {
   const preflight = capturePreflight(cfg, agent);
   if (preflight) return preflight;
+  const cleanup = detectMemoryCleanup(options.toolCalls ?? captureToolCalls(options.kbDetectionMessages ?? []));
+  if (cleanup.detected) {
+    debug("capture", "memory cleanup skipped", { agent, sessionId, operation: cleanup.operation, source: cleanup.source });
+    return { captured: false, reason: "memory_cleanup_skip", messageCount: 0 };
+  }
   if (parsed.length === 0) {
     return { captured: false, reason: "empty_messages", messageCount: 0 };
   }
@@ -101,6 +126,7 @@ async function captureParsedMessages(parsed, cfg, client, agent = "default", ses
       messageCount: 0
     };
   }
+  if (options.completionReason) return { captured: false, reason: options.completionReason, messageCount: 0 };
   const rawMessages = turn.map((m) => ({ role: m.role, content: m.content }));
   const filtered = filterMessagesForExtraction(rawMessages);
   if (dbg) debug("capture", "filtered messages", summarizeTextMessages(filtered));

package/dist/{chunk-XWJAZAMN.js → chunk-7CZIQG6Z.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   configDir
-} from "./chunk-TZFDXKLJ.js";
+} from "./chunk-HUX2XS5P.js";
 
 // src/lib/circuit.ts
 import { statSync, writeFileSync, unlinkSync, mkdirSync, readdirSync, readFileSync } from "node:fs";

package/dist/{chunk-5HPYYOPH.js → chunk-BRCQTX2M.js}

@@ -2,7 +2,7 @@
 import {
   fetchKbCatalogBlock,
   recallTurn
-} from "./chunk-VMBCSFGF.js";
+} from "./chunk-C66FQHNI.js";
 
 // src/lib/user-prompt-submit-compose.ts
 async function composeUserPromptSubmit(cfg, agent, client, prompt, sessionId = null) {

package/dist/{chunk-VMBCSFGF.js → chunk-C66FQHNI.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import {
   listKnowledgeBases
-} from "./chunk-SZ3AZDMU.js";
+} from "./chunk-EX6SM7I3.js";
 import {
   isConnectionError,
   resetCircuit,
   tripCircuit
-} from "./chunk-XWJAZAMN.js";
+} from "./chunk-7CZIQG6Z.js";
 import {
   CtxdbError,
   isDataApiReady,
   resolveDataApiCredential
-} from "./chunk-TZFDXKLJ.js";
+} from "./chunk-HUX2XS5P.js";
 
 // src/lib/kb-catalog.ts
 function sanitizeKeyEntities(raw) {

package/dist/{chunk-SG4LQTOF.js → chunk-CGA7EITY.js}

@@ -2,10 +2,10 @@
 import {
   fetchKbCatalogBlock,
   recallTurn
-} from "./chunk-VMBCSFGF.js";
+} from "./chunk-C66FQHNI.js";
 import {
   debug
-} from "./chunk-TZFDXKLJ.js";
+} from "./chunk-HUX2XS5P.js";
 
 // src/lib/warmup-recall.ts
 import { execSync } from "node:child_process";

package/dist/{chunk-SZ3AZDMU.js → chunk-EX6SM7I3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CtxdbError
-} from "./chunk-TZFDXKLJ.js";
+} from "./chunk-HUX2XS5P.js";
 
 // src/lib/kb.ts
 import {

package/dist/{chunk-TZFDXKLJ.js → chunk-HUX2XS5P.js}

@@ -1891,24 +1891,31 @@ import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync5, readFileSync as readFileSync6 } from "node:fs";
 var ANTHROPIC_MESSAGE_TYPES = /* @__PURE__ */ new Set(["user", "assistant"]);
 var CODEX_RESPONSE_ITEM = "response_item";
-function readTranscript(path) {
-  if (!existsSync5(path)) return [];
+function readTranscriptSnapshot(path) {
+  const rawRows = [];
+  let incomplete = false;
+  if (!existsSync5(path)) return { rows: [], rawRows, incomplete };
   let text;
   try {
     text = readFileSync6(path, "utf-8");
   } catch {
-    return [];
+    return { rows: [], rawRows, incomplete };
   }
-  const out = [];
   for (const line of text.split("\n")) {
-    const s = line.trim();
-    if (!s) continue;
-    let obj;
+    if (!line.trim()) continue;
     try {
-      obj = JSON.parse(s);
+      const value = JSON.parse(line);
+      if (value && typeof value === "object" && !Array.isArray(value)) rawRows.push(value);
+      else incomplete = true;
     } catch {
-      continue;
+      incomplete = true;
     }
+  }
+  return { rows: normalizeTranscriptRows(rawRows), rawRows, incomplete };
+}
+function normalizeTranscriptRows(rawRows) {
+  const out = [];
+  for (const obj of rawRows) {
     if (!obj || typeof obj !== "object" || Array.isArray(obj)) continue;
     const o = obj;
     const rawType = typeof o.type === "string" ? o.type : "";
@@ -2136,6 +2143,7 @@ function toParsedMessages(rows) {
     const role = msg.role;
     if (role !== "user" && role !== "assistant") continue;
     const content = msg.content;
+    if (role === "user" && Array.isArray(content) && content.some((b) => b?.type === "tool_result")) continue;
     if (typeof content === "string") {
       push(role, content);
       continue;
@@ -3249,7 +3257,8 @@ export {
   getBinding,
   bindSession,
   verifiedClient,
-  readTranscript,
+  readTranscriptSnapshot,
+  normalizeTranscriptRows,
   toKbDetectionMessages,
   selectTurnRows,
   toParsedMessages,

package/dist/cli/main.js

@@ -4,6 +4,9 @@ import {
   completeUpdateNotification,
   runSelfUpdate
 } from "../chunk-G3MDJEX5.js";
+import {
+  resolveMemoryUploadAgentId
+} from "../chunk-SR3M7AL5.js";
 import {
   DEFAULT_FILE_INGEST_TIMEOUT_MS,
   DEFAULT_FILE_UPLOAD_TIMEOUT_MS,
@@ -36,10 +39,7 @@ import {
   uploadFile,
   uploadText,
   validateLocalFile
-} from "../chunk-SZ3AZDMU.js";
-import {
-  resolveMemoryUploadAgentId
-} from "../chunk-SR3M7AL5.js";
+} from "../chunk-EX6SM7I3.js";
 import {
   AGENT_CHOICES,
   CtxdbError,
@@ -100,7 +100,7 @@ import {
   withStateLock,
   writeInstalledPkgVersion,
   writeState
-} from "../chunk-TZFDXKLJ.js";
+} from "../chunk-HUX2XS5P.js";
 import {
   DISTRIBUTION_MANIFEST
 } from "../chunk-5ITT5GSP.js";
@@ -987,7 +987,8 @@ async function runSetupAll(options = {}, dependencies = {}) {
         agent,
         apiKey,
         login: options.login,
-        // Public setup resets the endpoint by default, including shared logins.
+        site: options.site,
+        // Public setup resolves site assertions and preserves each credential's endpoint.
         baseUrl: options.baseUrl ?? (publicAuth ? void 0 : existing?.baseUrl),
         userId: options.userId ?? existing?.userId,
         persistCredential: options.persistCredential,
@@ -2275,7 +2276,7 @@ async function runUpgrade(options = {}) {
 }
 
 // src/cli/setup-cli.ts
-import { validateDataBaseUrl as validateDataBaseUrl2 } from "@aliyunrds/ctxdb-shared";
+import { validateDataBaseUrl as validateDataBaseUrl2, parsePublicSite, siteBaseUrl } from "@aliyunrds/ctxdb-shared";
 var HELP = `ctxdb setup \u2014 configure an agent
 
 USAGE
@@ -2348,7 +2349,7 @@ async function setup(args) {
       ).replace(
         "  --base-url <url>      Server URL (default: https://api.cn-hangzhou.agentcontext.aliyuncs.com)\n",
         ""
-      ) : HELP.replace("[--api-key=K]", "[--api-key=K | --login=default|ID]").replace("  --api-key <key>       API key (required on first setup)", "  --api-key <key>       Replace this Agent's authentication with an API key\n  --login <default|ID>  Bind an existing login; ordinary setup preserves existing authentication").replace("BEHAVIOR\n", "BEHAVIOR\n  First-time auth binds default's login when available. Explicit unbind or invalid auth is preserved.\n")
+      ) : HELP.replace("[--base-url=URL]", "[--site=cn|intl | --base-url=URL]").replace("  --base-url <url>      Server URL (default: https://api.cn-hangzhou.agentcontext.aliyuncs.com)", "  --site <cn|intl>     Official site; intl selects Singapore\n  --base-url <url>      Custom service URL; omitted URL preserves existing credentials").replace("[--api-key=K]", "[--api-key=K | --login=default|ID]").replace("  --api-key <key>       API key (required on first setup)", "  --api-key <key>       Replace this Agent's authentication with an API key\n  --login <default|ID>  Bind an existing login; ordinary setup preserves existing authentication").replace("BEHAVIOR\n", "BEHAVIOR\n  First-time auth binds default's login when available. Explicit unbind or invalid auth is preserved.\n")
     );
     return 0;
   }
@@ -2376,6 +2377,15 @@ async function setup(args) {
     );
     return 2;
   }
+  let site;
+  try {
+    site = parsePublicSite(args.flags.site);
+    siteBaseUrl(site, args.flags["base-url"]);
+    if (site && DISTRIBUTION_MANIFEST.capabilities.managedCredentials) throw new Error("--site is supported only in the public distribution.");
+  } catch (error) {
+    process.stderr.write(error.message + "\n");
+    return 2;
+  }
   const baseUrl = args.flags["base-url"];
   if (baseUrl !== void 0) {
     try {
@@ -2394,6 +2404,7 @@ async function setup(args) {
     const result2 = await runSetupAll({
       apiKey: explicitApiKey,
       login,
+      site,
       baseUrl,
       userId: typeof args.flags["user-id"] === "string" ? args.flags["user-id"] : void 0,
       persistCredential,
@@ -2428,6 +2439,7 @@ ${highlightInlineCode(hint)}
     agent,
     apiKey: explicitApiKey,
     login,
+    site,
     baseUrl,
     userId: typeof args.flags["user-id"] === "string" ? args.flags["user-id"] : void 0,
     persistCredential,
@@ -6031,9 +6043,9 @@ function publicSetupSpec(managedCredentials) {
     option("--login", "Bind an existing login ID; default selects the default Agent's current login.", {
       valueName: "default|ID"
     }),
-    option("--base-url", "ContextDB DATA API base URL.", {
-      valueName: "url",
-      default: "https://api.cn-hangzhou.agentcontext.aliyuncs.com"
+    option("--site", "Official site: cn (China) or intl (Singapore).", { valueName: "cn|intl", choices: ["cn", "intl"] }),
+    option("--base-url", "Custom DATA URL; omitted URL preserves the saved endpoint.", {
+      valueName: "url"
     })
   ];
   return leaf(
@@ -6042,7 +6054,7 @@ function publicSetupSpec(managedCredentials) {
     setup,
     details({
       usage: [
-        `ctxdb setup [--agent <${SUPPORTED_AGENT_CHOICES}> | --all]${managedCredentials ? "" : " [--api-key=<key> | --login=<default|ID>] [--base-url=<url>]"} [--user-id=<id>] [--no-install-skill] [--no-validate] [--json]`
+        `ctxdb setup [--agent <${SUPPORTED_AGENT_CHOICES}> | --all]${managedCredentials ? "" : " [--api-key=<key> | --login=<default|ID>] [--site=<cn|intl> | --base-url=<url>]"} [--user-id=<id>] [--no-install-skill] [--no-validate] [--json]`
       ],
       options: [
         option("--agent", "Configure exactly one built-in Agent; omit for the CLI-only default profile.", {
@@ -6069,6 +6081,7 @@ function publicSetupSpec(managedCredentials) {
         "--agent and --all are mutually exclusive.",
         ...!managedCredentials ? [
           "--api-key and --login are mutually exclusive.",
+          "--site and --base-url are mutually exclusive. Switching sites requires login or a new API key.",
           "Unset CTXDB_ACCESS_TOKEN and CTXDB_API_KEY before explicitly switching persisted authentication."
         ] : []
       ],
@@ -7374,13 +7387,15 @@ import {
   rejectAuthEnvironment,
   releaseLogin,
   collectUnusedLogins,
-  validateDataBaseUrl as validateDataBaseUrl3
+  validateDataBaseUrl as validateDataBaseUrl3,
+  parsePublicSite as parsePublicSite2,
+  siteBaseUrl as siteBaseUrl2,
+  PUBLIC_SITES as PUBLIC_SITES2
 } from "@aliyunrds/ctxdb-shared";
 
 // src/lib/oauth-login-config.ts
 import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
-import { isOfficialProductionUrl, normalizeCoreOrigin } from "@aliyunrds/ctxdb-shared";
-var PRODUCTION_AUTHORIZATION_URL = "https://rdsnext.console.aliyun.com/contextDbCliAuthorization/cn-hangzhou";
+import { PUBLIC_SITES, publicSiteForUrl, normalizeCoreOrigin } from "@aliyunrds/ctxdb-shared";
 function authorizationPage(value2) {
   if (typeof value2 !== "string" || !value2.trim()) throw new Error();
   const url = new URL(value2);
@@ -7395,7 +7410,8 @@ function consoleAuthorizationBase(path, core, loginUrl) {
       throw new Error("--login-url requires an HTTPS page URL without credentials, query parameters or fragment. No authorization request was created.");
     }
   }
-  const fallback = isOfficialProductionUrl(core) ? PRODUCTION_AUTHORIZATION_URL : void 0;
+  const site = publicSiteForUrl(core);
+  const fallback = site ? PUBLIC_SITES[site].authorizationUrl : void 0;
   if (!existsSync7(path)) return fallback;
   try {
     const raw = JSON.parse(readFileSync3(path, "utf8"));
@@ -7439,7 +7455,7 @@ function openBrowser(url) {
 }
 
 // src/cli/device-auth-cli.ts
-var usage = "ctxdb login [--agent <name> | --login <default|ID>] [--base-url <core-origin> | --server <core-origin>] [--login-url <console-page>] [--yes] [--device-code] [--no-browser] [--json]\n";
+var usage = "ctxdb login [--agent <name> | --login <default|ID>] [--site <cn|intl> | --base-url <core-origin> | --server <core-origin>] [--login-url <console-page>] [--yes] [--device-code] [--no-browser] [--json]\n";
 function createPublicAuthCommands(dependencies = {}) {
   const env = () => dependencies.env ?? process.env;
   const stdout = dependencies.stdout ?? ((s) => {
@@ -7452,7 +7468,7 @@ function createPublicAuthCommands(dependencies = {}) {
   const launchBrowser = dependencies.openBrowser ?? openBrowser;
   const output = (value2, json) => stdout(json ? JSON.stringify(value2) + "\n" : String(value2) + "\n");
   function options(args, command) {
-    const allowed = ["agent", "json", "help", "h", ...command === "login" ? ["base-url", "login-url", "server", "device-code", "no-browser", "login", "yes"] : command === "logout" ? ["login", "yes"] : command === "status" ? ["all"] : []];
+    const allowed = ["agent", "json", "help", "h", ...command === "login" ? ["site", "base-url", "login-url", "server", "device-code", "no-browser", "login", "yes"] : command === "logout" ? ["login", "yes"] : command === "status" ? ["all"] : []];
     if (args.positional.length || Object.keys(args.flags).some((k) => !allowed.includes(k))) throw new Error("Unsupported authentication option.");
     for (const flag of ["json", "help", "h", "device-code", "no-browser", "yes", "all"]) {
       if (args.flags[flag] !== void 0 && args.flags[flag] !== true) throw new Error("Invalid boolean authentication option.");
@@ -7493,10 +7509,13 @@ function createPublicAuthCommands(dependencies = {}) {
       if (args.flags["base-url"] !== void 0 && args.flags.server !== void 0) throw new Error("Use --base-url or its legacy alias --server, not both.");
       const explicitBase = args.flags["base-url"] ?? args.flags.server;
       if (explicitBase !== void 0) validateDataBaseUrl3(explicitBase, true);
+      const site = parsePublicSite2(args.flags.site);
+      const presetBase = siteBaseUrl2(site, explicitBase);
+      if (site && args.flags["login-url"] !== void 0) throw new Error("--site and --login-url are mutually exclusive.");
       const pending = beginLogin(path, agent, name);
       await confirmImpact(name ? pending.users[0] ?? agent : agent, pending.users, args, "Reauthorizing this login");
-      const baseUrl = normalizeCoreOrigin2(explicitBase ?? DEFAULT_BASE_URL);
-      const consoleBase = consoleAuthorizationBase(join6(dirname2(path), "device-environments.json"), baseUrl, args.flags["login-url"]);
+      const baseUrl = normalizeCoreOrigin2(presetBase ?? explicitBase ?? pending.previous?.baseUrl ?? load({ path, agent, env: {} }).baseUrl ?? DEFAULT_BASE_URL);
+      const consoleBase = site ? PUBLIC_SITES2[site].authorizationUrl : consoleAuthorizationBase(join6(dirname2(path), "device-environments.json"), baseUrl, args.flags["login-url"]);
       const connection = client(baseUrl), controller = new AbortController();
       let browserOpening = Promise.resolve();
       const interrupt = () => controller.abort();
@@ -7720,10 +7739,11 @@ var ENVIRONMENT_CONSTRAINT = "Unset CTXDB_ACCESS_TOKEN and CTXDB_API_KEY before
 function publicCommands() {
   return [
     leaf("login", "Authorize a public Device Flow login and configure the selected Agent.", deviceLogin, details({
-      usage: ["ctxdb login [--agent=<name> | --login=<default|ID>] [--base-url=<core-origin> | --server=<core-origin>] [--login-url=<console-page>] [--device-code] [--no-browser] [--yes] [--json]"],
+      usage: ["ctxdb login [--agent=<name> | --login=<default|ID>] [--site=<cn|intl> | --base-url=<core-origin> | --server=<core-origin>] [--login-url=<console-page>] [--device-code] [--no-browser] [--yes] [--json]"],
       options: [
         AGENT_OPTION2,
         LOGIN_OPTION,
+        option("--site", "Official site: cn (China) or intl (Singapore).", { valueName: "cn|intl", choices: ["cn", "intl"] }),
         option("--base-url", "Core service origin for Device Flow and DATA requests.", { valueName: "core-origin" }),
         option("--server", "Legacy alias for --base-url; do not combine them.", { valueName: "core-origin" }),
         option("--login-url", "HTTPS console authorization page; CLI appends the current user_code.", { valueName: "console-page" }),
@@ -7732,8 +7752,9 @@ function publicCommands() {
         YES_OPTION,
         JSON_OPTION2
       ],
-      constraints: ["--agent and --login are mutually exclusive.", "--base-url and --server are mutually exclusive.", ENVIRONMENT_CONSTRAINT],
+      constraints: ["--agent and --login are mutually exclusive.", "--base-url and --server are mutually exclusive.", "--site cannot be combined with --base-url, --server or --login-url.", ENVIRONMENT_CONSTRAINT],
       notes: [
+        "With no site or URL override, reauthorization keeps the saved endpoint; a fresh installation defaults to cn.",
         "Default login creates or updates the default shared login; login for another Agent creates an independent login.",
         "--login reauthorizes the selected existing login while retaining its stable local ID.",
         "Device scope is fixed to default. A non-default Agent login also installs hooks/skills and validates connectivity; no separate setup command is needed.",
@@ -7747,6 +7768,7 @@ function publicCommands() {
       examples: [
         { command: "ctxdb login" },
         { command: "ctxdb login --agent=codex --json" },
+        { command: "ctxdb login --agent=codex --site=intl" },
         { command: "ctxdb login --login=default --yes --json" },
         { command: "ctxdb login --base-url=https://core.example.com --login-url=https://console.example.com/contextDbCliAuthorization/cn-hangzhou" }
       ]

package/dist/hooks/hermes-post-llm-call.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   captureParsedMessages
-} from "../chunk-CA7XEF4X.js";
+} from "../chunk-4GYXLFNU.js";
 import "../chunk-SR3M7AL5.js";
-import "../chunk-XWJAZAMN.js";
+import "../chunk-7CZIQG6Z.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
@@ -13,7 +13,7 @@ import {
   sessionBinding,
   setDebug,
   skillStopRows
-} from "../chunk-TZFDXKLJ.js";
+} from "../chunk-HUX2XS5P.js";
 import "../chunk-5ITT5GSP.js";
 import {
   shouldSkipHooks
@@ -22,6 +22,7 @@ import "../chunk-PI2SUS3M.js";
 
 // src/hooks/hermes-post-llm-call.ts
 import { pathToFileURL } from "node:url";
+import { selectCaptureTurn, captureText, captureToolCalls, captureCompletionReason } from "@aliyunrds/ctxdb-shared";
 function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -31,38 +32,15 @@ function firstString(...values) {
   }
   return "";
 }
-function textContent(content) {
-  if (typeof content === "string") return content.trim();
-  if (!Array.isArray(content)) return "";
-  const chunks = [];
-  for (const rawBlock of content) {
-    if (typeof rawBlock === "string") {
-      if (rawBlock.trim()) chunks.push(rawBlock.trim());
-      continue;
-    }
-    const block = asRecord(rawBlock);
-    const text = firstString(block.text, block.content);
-    if (text.trim()) chunks.push(text.trim());
-  }
-  return chunks.join("\n").trim();
-}
 function currentTurnHistory(history) {
-  const records = history.map(asRecord);
-  let start = -1;
-  for (let i = records.length - 1; i >= 0; i--) {
-    if (records[i].role === "user") {
-      start = i;
-      break;
-    }
-  }
-  return start >= 0 ? records.slice(start) : records;
+  return selectCaptureTurn(history).map(asRecord);
 }
 function parsedHistoryMessages(history) {
   const messages = [];
   for (const item of history) {
     const role = item.role;
     if (role !== "user" && role !== "assistant") continue;
-    const content = textContent(item.content);
+    const content = captureText(item).trim();
     if (!content) continue;
     messages.push({
       role,
@@ -147,7 +125,15 @@ function extractHermesPostLlmCall(event) {
   return {
     sessionId,
     messages: userMessage && assistantResponse ? explicitMessages : historyMessages.length > 0 ? historyMessages : explicitMessages,
-    kbDetectionMessages: toHermesKbDetectionMessages(turnHistory)
+    kbDetectionMessages: toHermesKbDetectionMessages(turnHistory),
+    toolCalls: captureToolCalls(turnHistory),
+    completionReason: userMessage && historyMessages.find((m) => m.role === "user")?.content !== userMessage ? "turn_unverified" : captureCompletionReason(turnHistory, {
+      // post_llm_call may fire for tool-producing intermediate calls. Require
+      // the host's final answer to match the final history message as well.
+      lastAssistantMessage: assistantResponse || void 0,
+      turnId: firstString(extra.turn_id, event.turn_id) || void 0,
+      sessionId
+    })
   };
 }
 async function readStdinJson() {
@@ -213,7 +199,7 @@ async function main() {
       client,
       agent,
       input.sessionId,
-      { kbDetectionMessages: input.kbDetectionMessages }
+      { kbDetectionMessages: input.kbDetectionMessages, toolCalls: input.toolCalls, completionReason: input.completionReason }
     );
     if (result.captured) {
       debug("hermes.post_llm_call", `ok (${result.messageCount} msgs)`, result);

package/dist/hooks/hermes-pre-llm-call.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
-import {
-  composeUserPromptSubmit
-} from "../chunk-5HPYYOPH.js";
 import {
   HOOK_TIMEOUT_MS,
   composeSessionStart
-} from "../chunk-SG4LQTOF.js";
+} from "../chunk-CGA7EITY.js";
+import {
+  composeUserPromptSubmit
+} from "../chunk-BRCQTX2M.js";
 import {
   fetchKbCatalogBlock
-} from "../chunk-VMBCSFGF.js";
-import "../chunk-SZ3AZDMU.js";
+} from "../chunk-C66FQHNI.js";
+import "../chunk-EX6SM7I3.js";
 import {
   isCircuitOpen
-} from "../chunk-XWJAZAMN.js";
+} from "../chunk-7CZIQG6Z.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
@@ -25,7 +25,7 @@ import {
   skillDeferredFeedback,
   skillPromptContext,
   skillSessionStart
-} from "../chunk-TZFDXKLJ.js";
+} from "../chunk-HUX2XS5P.js";
 import "../chunk-5ITT5GSP.js";
 import {
   shouldSkipHooks

package/dist/hooks/session-end.js

@@ -3,7 +3,7 @@ import {
   agentFromArgvWithFallback,
   receiveEnd,
   sessionBinding
-} from "../chunk-TZFDXKLJ.js";
+} from "../chunk-HUX2XS5P.js";
 import "../chunk-5ITT5GSP.js";
 import {
   shouldSkipHooks

package/dist/hooks/session-start.js

@@ -3,12 +3,12 @@ import {
   HOOK_TIMEOUT_MS,
   composeSessionStart,
   formatSessionStartStdout
-} from "../chunk-SG4LQTOF.js";
-import "../chunk-VMBCSFGF.js";
-import "../chunk-SZ3AZDMU.js";
+} from "../chunk-CGA7EITY.js";
+import "../chunk-C66FQHNI.js";
+import "../chunk-EX6SM7I3.js";
 import {
   isCircuitOpen
-} from "../chunk-XWJAZAMN.js";
+} from "../chunk-7CZIQG6Z.js";
 import {
   HttpClient,
   agentFromArgvWithFallback,
@@ -17,7 +17,7 @@ import {
   resolveDataApiCredential,
   setDebug,
   skillSessionStart
-} from "../chunk-TZFDXKLJ.js";
+} from "../chunk-HUX2XS5P.js";
 import "../chunk-5ITT5GSP.js";
 import {
   shouldSkipHooks