@kvell007/embed-labs-cli 0.1.0-alpha.6 → 0.1.0-alpha.61

package/dist/index.js

@@ -1,24 +1,28 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
+import { createHash, createHmac, generateKeyPairSync, randomBytes, sign as signCrypto } from "node:crypto";
 import { constants } from "node:fs";
 import { spawn } from "node:child_process";
-import { access, cp, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { access, chmod, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { homedir, tmpdir } from "node:os";
+import { arch, hostname, homedir, platform, tmpdir } from "node:os";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { startServer } from "@embed-labs/local-bridge";
 import { composeBootLogoPackage } from "./image-compose.js";
-import { buildTaishanPiQtSmoke, compileTaishanPiSingleFile, currentLocalToolchain, installLocalToolchain, latestLocalToolchain, validateLocalToolchain } from "./local-toolchain.js";
+import { buildTaishanPiQtSmoke, compileTaishanPiSingleFile, currentLocalToolchain, installLocalToolchain, latestLocalToolchain, listLocalToolchainEnvironments, uninstallLocalToolchain, validateLocalToolchain, windowsWslInstall, windowsWslStatus } from "./local-toolchain.js";
 import { fail, ok } from "@embed-labs/protocol";
 const require = createRequire(import.meta.url);
 const CLI_MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 const SOURCE_CHECKOUT_ROOT = resolve(CLI_MODULE_DIR, "..", "..", "..");
 const qrcodeTerminal = require("qrcode-terminal");
 const DEFAULT_BRIDGE_URL = process.env.EMBED_BRIDGE_URL ?? "http://127.0.0.1:18083";
-const DEFAULT_CLOUD_API_URL = process.env.EMBED_CLOUD_API_URL ?? "http://127.0.0.1:18100";
+const DEFAULT_CLOUD_API_URL = process.env.EMBED_CLOUD_API_URL ?? "https://api.embedboard.com";
 const DEFAULT_AUTH_FILE = process.env.EMBED_AUTH_FILE ?? ".embed-labs/auth.json";
+const DEFAULT_DEVICE_FILE = process.env.EMBED_DEVICE_FILE ?? join(dirname(DEFAULT_AUTH_FILE), "device.json");
+const DEFAULT_DASHBOARD_URL = process.env.EMBED_DASHBOARD_URL ?? "https://api.embedboard.com/dashboard";
+const EMBED_CLIENT_NAME = "embedlabs-cli";
+const EMBED_CLIENT_VERSION = process.env.EMBED_CLIENT_VERSION ?? "0.1.0";
 const DEFAULT_AGENT_ARTIFACT_DIR = process.env.EMBED_AGENT_ARTIFACT_DIR ?? ".embed-labs/artifacts";
+const TOOL_INTEGRITY_RELOGIN_MESSAGE = "工具完整性校验失败，请在当前电脑重新执行 embedlabs auth login --token <key>";
 const DOCTOR_USAGE = "Usage: embed doctor [--json]";
 const DOCTOR_HTTP_TIMEOUT_MS = 8000;
 const MIN_NODE_MAJOR = 20;
@@ -27,7 +31,20 @@ const DEVICE_PROBE_USAGE = "Usage: embed device probe --host <host> --ports 22,1
 const QUERY_USAGE = "Usage: embed query <natural language request> [--account <account_id>] [--qr] [--json]";
 const DEFAULT_PLUGIN_RELEASE_URL = process.env.EMBED_PLUGIN_RELEASE_URL?.trim() || "https://api.embedboard.com/plugin-releases/agent-plugins/latest";
 const PLUGIN_LIST_USAGE = "Usage: embed plugin list [--release-dir <dir>] [--release-url <url>] [--json]";
+const CODEX_PLUGIN_NAME = "embed-labs";
+const CODEX_MARKETPLACE_NAME = "embed-labs";
+const MCP_START_USAGE = "Usage: embed mcp start [--bridge-path <path>]";
+const LEGACY_CODEX_PLUGIN_NAMES = [
+    "dbt-agent",
+    "Dbt Agent",
+    "development-board-toolchain",
+    "development-board-toolchain-dev",
+    "deve"
+];
+const LEGACY_CODEX_MARKETPLACE_NAMES = new Set(["embed-labs-plugins", "plugins", "Plugins", "deve"]);
 const PLUGIN_INSTALL_USAGE = "Usage: embed plugin install <codex|opencode|all> [--release-dir <dir>] [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--force] [--json]";
+const PLUGIN_UPDATE_CHECK_USAGE = "Usage: embed plugin update check [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]";
+const PLUGIN_UPDATE_USAGE = "Usage: embed plugin update <codex|opencode|all> [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]";
 const CLOUD_TASK_ARTIFACTS_USAGE = "Usage: embed cloud task artifacts <task_id> [--json]";
 const CLOUD_TASK_EVIDENCE_USAGE = "Usage: embed cloud task evidence <task_id> [--json]";
 const ARTIFACT_STATUS_USAGE = "Usage: embed artifact status <artifact_id> [--json]";
@@ -81,24 +98,36 @@ const BUILD_IMAGE_BOOT_LOGO_USAGE = "Usage: embed build image boot-logo --logo <
 const IMAGE_BOOT_LOGO_COMPOSE_USAGE = "Usage: embed image boot-logo compose --package <boot-logo-package.json> --base-image <boot.img|image.img> --output <image> [--manifest <manifest.json>] [--force] [--json]";
 const BUILD_IMAGE_DTB_USAGE = "Usage: embed build image dtb --dtb <local.dtb|local.dts> [--input-format auto|dtb|dts] [--account <account_id>] [--project <project_id>] [--board taishanpi] [--variant 1M-RK3566] [--output <package.json>] [--json]";
 const IMAGE_DTB_COMPOSE_USAGE = "Usage: embed image dtb compose --package <dtb-package.json> --base-image <boot.img|image.img> --output <image> [--manifest <manifest.json>] [--force] [--json]";
-const LOCAL_TOOLCHAIN_LATEST_USAGE = "Usage: embed local toolchain latest [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_LIST_USAGE = "Usage: embed local toolchain list [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--install-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_INSTALLED_USAGE = "Usage: embed local toolchain installed [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--install-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_LATEST_USAGE = "Usage: embed local toolchain latest [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--json]";
 const LOCAL_TOOLCHAIN_CURRENT_USAGE = "Usage: embed local toolchain current [--install-root <path>] [--json]";
-const LOCAL_TOOLCHAIN_INSTALL_USAGE = "Usage: embed local toolchain install [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--source-url <tar.gz-url>|--source-release-root <path>] [--install-root <path>] [--force] [--json]\nDefault source: the production download channel at download.embedboard.com.";
-const LOCAL_TOOLCHAIN_VALIDATE_USAGE = "Usage: embed local toolchain validate [--release-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_INSTALL_USAGE = "Usage: embed local toolchain install [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--source-url <tar.gz-url>|--source-release-root <path>] [--install-root <path>] [--mode minimal|runtime|compile|qt|firmware|full|images] [--force] [--json]\nDefault source: the production download channel at download.embedboard.com.";
+const LOCAL_TOOLCHAIN_UNINSTALL_USAGE = "Usage: embed local toolchain uninstall --board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor [--install-root <path>] [--json]";
+const LOCAL_TOOLCHAIN_VALIDATE_USAGE = "Usage: embed local toolchain validate [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--release-root <path>] [--mode minimal|runtime|compile|qt|firmware|full|images] [--json]";
+const LOCAL_WSL_STATUS_USAGE = "Usage: embed local wsl status [--json]";
+const LOCAL_WSL_INSTALL_USAGE = "Usage: embed local wsl install [--distribution Ubuntu] [--no-launch true|false] [--web-download true|false] [--timeout-ms 600000] [--json]";
 const LOCAL_COMPILE_TAISHANPI_USAGE = "Usage: embed local compile taishanpi --source <main.c|main.cpp> --output <artifact> [--release-root <path>] [--account <account_id>] [--json]";
-const LOCAL_BUILD_QT_SMOKE_USAGE = "Usage: embed local build qt-smoke --build-dir <dir> [--source <qt-smoke-dir>] [--release-root <path>] [--account <account_id>] [--json]";
+const LOCAL_BUILD_QT_SMOKE_USAGE = "Usage: embed local build qt-smoke --build-dir <dir> [--source <qt-cmake-dir>] [--target-name <executable>] [--release-root <path>] [--account <account_id>] [--json]";
+const AUTH_DEVICE_STATUS_USAGE = "Usage: embed auth device status [--json]";
+const AUTH_DEVICE_LIST_USAGE = "Usage: embed auth device list [--json]";
+const AUTH_DEVICE_REVOKE_USAGE = "Usage: embed auth device revoke <device_id> [--json]";
+const AUTH_DEVICE_RENAME_USAGE = "Usage: embed auth device rename <device_id> --label <name> [--json]";
 const BOARD_REGISTRY_LIST_USAGE = "Usage: embed board registry list [--json]";
 const BOARD_REGISTRY_SHOW_USAGE = "Usage: embed board registry show <template_id> [--json]";
 const BOARD_METHODS_USAGE = "Usage: embed board methods <template_id> [--json]";
 const BOARD_KNOWLEDGE_USAGE = "Usage: embed board knowledge <template_id> [--json]";
+const BOARD_KNOWLEDGE_SEARCH_USAGE = "Usage: embed board knowledge search <template_id> --query <text> [--source board_pack|build_template|registry] [--limit 5] [--json]";
 const BOARD_KNOWLEDGE_FILE_USAGE = "Usage: embed board knowledge file <template_id> --source board_pack|build_template|registry --path <relative_path> [--output <local_path>] [--json]";
 const MODEL_LIST_USAGE = "Usage: embed model list [--json]";
 const MODEL_DEFAULT_USAGE = "Usage: embed model default [--json]";
 const SERVICE_MODES_USAGE = "Usage: embed service modes [--json]";
-const AGENT_RUN_USAGE = "Usage: embed agent run --prompt <request> [--account <account_id>] [--workspace <workspace_id>] [--provider stub|openai|bai|cc|claude-code] [--model <model>] [--max-tool-calls 6] [--host <ip>] [--ports 22,15301] [--artifact <local_file>|--artifact-id <artifact_id>|--artifact-task <task_id>] [--artifact-output <path>] [--remote-path <path>] [--run] [--approve] [--json]";
+const AGENT_RUN_USAGE = "Usage: embed agent run --prompt <request> [--account <account_id>] [--workspace <workspace_id>] [--provider stub|openai|bai|cc|claude-code] [--model <model>] [--max-tool-calls 6] [--host <ip>] [--ports 22,15301] [--artifact <local_file>|--artifact-id <artifact_id>|--artifact-task <task_id>] [--artifact-output <path>] [--remote-path <path>] [--run-command <cmd>] [--run] [--approve] [--json]";
+let cachedLocalHardwareFingerprint;
 const TOOL_LIST_USAGE = "Usage: embed tool list [--json]";
 const TOOL_CALL_USAGE = "Usage: embed tool call <capability_id> [--input-json '<json>'] [--approve] [--json]";
-const BOARD_DEPLOY_TAISHANPI_USAGE = "Usage: embed deploy taishanpi --host <ip> --artifact <local_file> --approve [--user root] [--remote-path /userdata/embed-labs/apps/app] [--run] [--timeout 30] [--json]";
+const MCP_TOOL_EVENT_USAGE = "Usage: embed mcp log --tool <tool_name> [--client codex|opencode] [--mode local_ai|server_ai] [--local-device-id <id>] [--server-model-used true|false] [--success true|false] [--request-id <id>] [--duration-ms <ms>] [--input-summary <text>] [--output-summary <text>] [--json]";
+const BOARD_DEPLOY_TAISHANPI_USAGE = "Usage: embed deploy taishanpi --host <ip> --artifact <local_file> --approve [--user root] [--remote-path /userdata/embed-labs/apps/app] [--run-command <cmd>] [--run] [--timeout 30] [--json]";
 const CLOUD_TASK_EVENT_APPEND_USAGE = "Usage: embed cloud task event append <task_id> [--state <state>] [--progress-stage <stage>|--stage <stage>] [--progress-text <text>|--message <text>] [--progress-percent 0-100] [--severity info|warning|error] [--type <event_type>] [--artifact-json '<json>'] [--evidence-json '<json>'] [--json]";
 const TASK_STATES = new Set([
     "created",
@@ -147,15 +176,17 @@ async function main(argv) {
             return output(parsed, await bridgePost("/v1/board/taishanpi/deploy", request), renderBoardDeployResult);
         }
         if (area === "bridge" && action === "start") {
-            startServer({
-                host: stringFlag(parsed, "host"),
-                port: numberFlag(parsed, "port")
-            });
-            return await waitForever();
+            return await runBridgeStart(parsed);
         }
         if (area === "bridge" && action === "status") {
             return output(parsed, await bridgeGet("/healthz"), renderBridgeStatus);
         }
+        if (area === "mcp" && action === "start") {
+            return await runMcpStart(parsed);
+        }
+        if (area === "mcp") {
+            return output(parsed, fail("invalid_args", MCP_START_USAGE), undefined, 2);
+        }
         if (area === "cloud" && action === "status") {
             return output(parsed, await cloudGet("/healthz"), renderCloudStatus);
         }
@@ -216,6 +247,17 @@ async function main(argv) {
                 return output(parsed, await cloudGet(`/v1/board-registry/templates/${encodeURIComponent(idResult.value)}/methods`), renderBoardMethods);
             }
             if (action === "knowledge") {
+                if (parsed.command[2] === "search") {
+                    const request = boardKnowledgeSearchRequest(parsed);
+                    if (typeof request === "string") {
+                        return output(parsed, fail("invalid_args", request), undefined, 2);
+                    }
+                    const params = new URLSearchParams({ q: request.query, limit: String(request.limit) });
+                    if (request.source) {
+                        params.set("source", request.source);
+                    }
+                    return output(parsed, await cloudGet(`/v1/board-registry/templates/${encodeURIComponent(request.templateId)}/knowledge-search?${params.toString()}`), renderBoardKnowledgeSearch);
+                }
                 if (parsed.command[2] === "file") {
                     const request = boardKnowledgeFileRequest(parsed);
                     if (typeof request === "string") {
@@ -241,6 +283,7 @@ async function main(argv) {
                 BOARD_REGISTRY_SHOW_USAGE,
                 BOARD_METHODS_USAGE,
                 BOARD_KNOWLEDGE_USAGE,
+                BOARD_KNOWLEDGE_SEARCH_USAGE,
                 BOARD_KNOWLEDGE_FILE_USAGE
             ].join("\n")), undefined, 2);
         }
@@ -279,7 +322,18 @@ async function main(argv) {
                 const result = await pluginInstall(parsed);
                 return output(parsed, result, renderPluginInstall, result.ok ? 0 : 2);
             }
-            return output(parsed, fail("invalid_args", [PLUGIN_LIST_USAGE, PLUGIN_INSTALL_USAGE].join("\n")), undefined, 2);
+            if (action === "update") {
+                if (parsed.command[2] === "check") {
+                    const result = await pluginUpdateCheck(parsed);
+                    return output(parsed, result, renderPluginUpdateCheck, result.ok ? 0 : 2);
+                }
+                if (["codex", "opencode", "all"].includes(parsed.command[2] ?? "")) {
+                    const result = await pluginUpdate(parsed);
+                    return output(parsed, result, renderPluginInstall, result.ok ? 0 : 2);
+                }
+                return output(parsed, fail("invalid_args", [PLUGIN_UPDATE_CHECK_USAGE, PLUGIN_UPDATE_USAGE].join("\n")), undefined, 2);
+            }
+            return output(parsed, fail("invalid_args", [PLUGIN_LIST_USAGE, PLUGIN_INSTALL_USAGE, PLUGIN_UPDATE_CHECK_USAGE, PLUGIN_UPDATE_USAGE].join("\n")), undefined, 2);
         }
         if (area === "auth" && action === "login") {
             const result = await authLogin(parsed);
@@ -288,6 +342,31 @@ async function main(argv) {
         if (area === "auth" && action === "status") {
             return output(parsed, ok(await authStatus()), renderAuthStatus);
         }
+        if (area === "auth" && action === "device") {
+            const deviceAction = parsed.command[2] ?? "status";
+            if (deviceAction === "status") {
+                const result = await authDeviceStatus(parsed);
+                return output(parsed, result, renderAuthDeviceStatus, result.ok ? 0 : 2);
+            }
+            if (deviceAction === "list") {
+                const result = await authDeviceList(parsed);
+                return output(parsed, result, renderAuthDeviceList, result.ok ? 0 : 2);
+            }
+            if (deviceAction === "revoke") {
+                const result = await authDeviceRevoke(parsed);
+                return output(parsed, result, renderAuthDevice, result.ok ? 0 : 2);
+            }
+            if (deviceAction === "rename") {
+                const result = await authDeviceRename(parsed);
+                return output(parsed, result, renderAuthDevice, result.ok ? 0 : 2);
+            }
+            return output(parsed, fail("invalid_args", [
+                AUTH_DEVICE_STATUS_USAGE,
+                AUTH_DEVICE_LIST_USAGE,
+                AUTH_DEVICE_REVOKE_USAGE,
+                AUTH_DEVICE_RENAME_USAGE
+            ].join("\n")), undefined, 2);
+        }
         if (area === "auth" && action === "logout") {
             await rm(DEFAULT_AUTH_FILE, { force: true });
             return output(parsed, ok(await authStatus()), renderAuthStatus);
@@ -339,6 +418,9 @@ async function main(argv) {
                 ACCOUNT_KEY_REVOKE_USAGE
             ].join("\n")), undefined, 2);
         }
+        if (area === "usage" || area === "billing") {
+            return output(parsed, quotaAndBillingDisabled(), undefined, 2);
+        }
         if (area === "usage") {
             if (action === "record") {
                 const body = usageRecordBody(parsed);
@@ -367,6 +449,16 @@ async function main(argv) {
                 USAGE_EVENTS_USAGE
             ].join("\n")), undefined, 2);
         }
+        if (area === "mcp") {
+            if (action === "log" || action === "tool-event") {
+                const body = mcpToolEventBody(parsed);
+                if (typeof body === "string") {
+                    return output(parsed, fail("invalid_args", body), undefined, 2);
+                }
+                return output(parsed, await cloudPost("/v1/mcp/tool-events", body), renderMcpToolEvent);
+            }
+            return output(parsed, fail("invalid_args", MCP_TOOL_EVENT_USAGE), undefined, 2);
+        }
         if (area === "billing") {
             if (action === "statement") {
                 const request = billingStatementRequest(parsed);
@@ -506,6 +598,20 @@ async function main(argv) {
             return output(parsed, fail("invalid_args", [IMAGE_BOOT_LOGO_COMPOSE_USAGE, IMAGE_DTB_COMPOSE_USAGE].join("\n")), undefined, 2);
         }
         if (area === "local") {
+            if (action === "toolchain" && parsed.command[2] === "list") {
+                const request = localToolchainListRequest(parsed);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await listLocalToolchainEnvironments(request)), renderLocalToolchainList);
+            }
+            if (action === "toolchain" && parsed.command[2] === "installed") {
+                const request = localToolchainListRequest(parsed, LOCAL_TOOLCHAIN_INSTALLED_USAGE);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await listLocalToolchainEnvironments({ ...request, installedOnly: true })), renderLocalToolchainList);
+            }
             if (action === "toolchain" && parsed.command[2] === "latest") {
                 const request = localToolchainLatestRequest(parsed);
                 if (typeof request === "string") {
@@ -527,12 +633,34 @@ async function main(argv) {
                 }
                 return output(parsed, ok(await installLocalToolchain(request)), renderLocalToolchainInstall);
             }
+            if (action === "toolchain" && (parsed.command[2] === "uninstall" || parsed.command[2] === "remove")) {
+                const request = localToolchainUninstallRequest(parsed);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await uninstallLocalToolchain(request)), renderLocalToolchainUninstall);
+            }
             if (action === "toolchain" && parsed.command[2] === "validate") {
                 const request = localToolchainValidateRequest(parsed);
                 if (typeof request === "string") {
                     return output(parsed, fail("invalid_args", request), undefined, 2);
                 }
-                return output(parsed, ok(await validateLocalToolchain(request.releaseRoot)), renderLocalToolchainValidation);
+                return output(parsed, ok(await validateLocalToolchain(request)), renderLocalToolchainValidation);
+            }
+            if (action === "wsl" && parsed.command[2] === "status") {
+                const unknownFlag = firstUnknownFlag(parsed, ["json"]);
+                const extra = parsed.command.slice(3);
+                if (unknownFlag || extra.length > 0) {
+                    return output(parsed, fail("invalid_args", unknownFlag ? `Unknown flag --${unknownFlag}. ${LOCAL_WSL_STATUS_USAGE}` : LOCAL_WSL_STATUS_USAGE), undefined, 2);
+                }
+                return output(parsed, ok(await windowsWslStatus()), renderWindowsWslStatus);
+            }
+            if (action === "wsl" && parsed.command[2] === "install") {
+                const request = localWslInstallRequest(parsed);
+                if (typeof request === "string") {
+                    return output(parsed, fail("invalid_args", request), undefined, 2);
+                }
+                return output(parsed, ok(await windowsWslInstall(request)), renderWindowsWslInstall);
             }
             if (action === "compile" && parsed.command[2] === "taishanpi") {
                 const request = localCompileTaishanPiRequest(parsed, await authStatus());
@@ -549,10 +677,15 @@ async function main(argv) {
                 return output(parsed, ok(await buildTaishanPiQtSmoke(request)), renderLocalCompileResult);
             }
             return output(parsed, fail("invalid_args", [
+                LOCAL_TOOLCHAIN_LIST_USAGE,
+                LOCAL_TOOLCHAIN_INSTALLED_USAGE,
                 LOCAL_TOOLCHAIN_LATEST_USAGE,
                 LOCAL_TOOLCHAIN_CURRENT_USAGE,
                 LOCAL_TOOLCHAIN_INSTALL_USAGE,
+                LOCAL_TOOLCHAIN_UNINSTALL_USAGE,
                 LOCAL_TOOLCHAIN_VALIDATE_USAGE,
+                LOCAL_WSL_STATUS_USAGE,
+                LOCAL_WSL_INSTALL_USAGE,
                 LOCAL_COMPILE_TAISHANPI_USAGE,
                 LOCAL_BUILD_QT_SMOKE_USAGE
             ].join("\n")), undefined, 2);
@@ -984,11 +1117,18 @@ async function main(argv) {
         return output(parsed, fail("unknown_command", `Unknown command: ${parsed.command.join(" ")}`), undefined, 2);
     }
     catch (error) {
-        return output(parsed, fail("command_failed", error instanceof Error ? error.message : String(error), {
-            remediation: `Check that embed-local-bridge is running at ${DEFAULT_BRIDGE_URL}. Start it with: embed bridge start`
+        const message = error instanceof Error ? error.message : String(error);
+        return output(parsed, fail("command_failed", message, {
+            remediation: commandFailureRemediation(message)
         }), undefined, 1);
     }
 }
+function commandFailureRemediation(message) {
+    if (message.includes("TaishanPi") && message.includes("WSL2")) {
+        return "Run: embedlabs local wsl status";
+    }
+    return `Check that embed-local-bridge is running at ${DEFAULT_BRIDGE_URL}. Start it with: embed bridge start`;
+}
 function parseArgs(argv) {
     const command = [];
     const flags = {};
@@ -1098,6 +1238,7 @@ function flashBody(parsed, includeApproval) {
         variant_id: stringFlag(parsed, "variant"),
         hardware_profile_id: stringFlag(parsed, "hardware-profile"),
         profile_id: stringFlag(parsed, "profile"),
+        local_device_id: stringFlag(parsed, "local-device-id") ?? stringFlag(parsed, "device-id"),
         image_dir: stringFlag(parsed, "image-dir"),
         artifact_path: stringFlag(parsed, "artifact"),
         target_volume_path: stringFlag(parsed, "target-volume")
@@ -1126,11 +1267,11 @@ async function doctor() {
     const bridgeHealth = await apiDoctorCheck("bridge_health", "Local Bridge health", `${bridgeBaseUrl}/healthz`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderHealthSummary, healthStatus);
     checks.push(bridgeHealth);
     if (isUsableDoctorCheck(bridgeHealth)) {
-        checks.push(await apiDoctorCheck("device_scan", "Device scan", `${bridgeBaseUrl}/v1/devices`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderDeviceScanSummary, warningIfWarnings));
+        checks.push(await apiDoctorCheck("device_scan", "Device inventory", `${bridgeBaseUrl}/v1/devices`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderDeviceScanSummary, warningIfWarnings));
         checks.push(await apiDoctorCheck("debug_tools", "Debug tool scan", `${bridgeBaseUrl}/v1/debug/tools`, "bridge_unreachable", `Local Bridge is unreachable at ${bridgeBaseUrl}.`, renderDebugToolScanSummary, warningIfWarnings));
     }
     else {
-        checks.push(dependentDoctorCheck("device_scan", "Device scan", `${bridgeBaseUrl}/v1/devices`, "Device scan requires a reachable Local Bridge."));
+        checks.push(dependentDoctorCheck("device_scan", "Device inventory", `${bridgeBaseUrl}/v1/devices`, "Device inventory requires a reachable Local Bridge."));
         checks.push(dependentDoctorCheck("debug_tools", "Debug tool scan", `${bridgeBaseUrl}/v1/debug/tools`, "Debug tool scan requires a reachable Local Bridge."));
     }
     checks.push(await apiDoctorCheck("cloud_api_health", "Cloud API health", `${cloudBaseUrl}/healthz`, "cloud_api_unreachable", `Cloud API is unreachable at ${cloudBaseUrl}.`, renderHealthSummary, healthStatus));
@@ -1189,7 +1330,8 @@ function authDoctorCheck(status) {
             : {
                 code: "auth_not_ready",
                 message: "No CLI auth token is configured.",
-                remediation: "Run: embed auth login --token <token>"
+                remediation: cloudAuthSetupRemediation(),
+                details: cloudAuthSetupDetails()
             }
     };
 }
@@ -1322,7 +1464,7 @@ function warningIfWarnings(data) {
 }
 function renderDeviceScanSummary(result) {
     const warningText = result.warnings?.length ? ` ${result.warnings.length} warning(s).` : "";
-    return `Device scan completed: ${result.devices.length} device(s), ${result.usb.length} USB item(s), ${result.serial.length} serial port(s).${warningText}`;
+    return `Device inventory snapshot: ${result.devices.length} device(s), ${result.usb.length} USB item(s), ${result.serial.length} serial port(s).${warningText}`;
 }
 function renderDebugToolScanSummary(result) {
     const available = result.tools.filter((tool) => tool.available).length;
@@ -1340,16 +1482,142 @@ function isApiResponse(value) {
     return isJsonObject(error) && typeof error.code === "string" && typeof error.message === "string";
 }
 async function bridgeGet(path) {
-    const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`);
-    return await response.json();
+    return await bridgeRequest("GET", path);
 }
 async function bridgePost(path, body) {
-    const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(body)
+    return await bridgeRequest("POST", path, body);
+}
+async function bridgeRequest(method, path, body) {
+    const bodyText = body === undefined ? "" : JSON.stringify(body);
+    const makeRequest = async () => {
+        const response = await fetch(`${DEFAULT_BRIDGE_URL}${path}`, {
+            method,
+            headers: bridgeHeaders(method, path, method === "POST" ? bodyText : "", method === "POST" ? { "content-type": "application/json" } : {}),
+            body: method === "POST" ? bodyText : undefined
+        });
+        return await response.json();
+    };
+    try {
+        return await makeRequest();
+    }
+    catch (error) {
+        if (!isBridgeConnectionFailure(error)) {
+            throw error;
+        }
+        const started = await ensureBridgeStartedForRequest();
+        if (!started.ok) {
+            return started;
+        }
+        return await makeRequest();
+    }
+}
+function bridgeHeaders(method, path, bodyText, base = {}) {
+    const token = process.env.EMBED_BRIDGE_TOKEN?.trim();
+    if (!token) {
+        return base;
+    }
+    const headers = {
+        ...base,
+        authorization: `Bearer ${token}`
+    };
+    addBridgeRequestSignature(headers, method, path, bodyText, token);
+    return headers;
+}
+function addBridgeRequestSignature(headers, method, pathWithQuery, bodyText, token) {
+    if (process.env.EMBED_BRIDGE_SIGNING === "0") {
+        return;
+    }
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const nonce = randomBytes(16).toString("hex");
+    const bodySha256 = createHash("sha256").update(bodyText).digest("hex");
+    const keyId = createHash("sha256").update(token).digest("hex").slice(0, 16);
+    const canonical = cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256);
+    headers["x-embed-key-id"] = keyId;
+    headers["x-embed-timestamp"] = timestamp;
+    headers["x-embed-nonce"] = nonce;
+    headers["x-embed-body-sha256"] = bodySha256;
+    headers["x-embed-signature"] = createHmac("sha256", token).update(canonical).digest("hex");
+}
+function isBridgeConnectionFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes("fetch failed") ||
+        message.includes("ECONNREFUSED") ||
+        message.includes("ECONNRESET") ||
+        message.includes("UND_ERR_SOCKET");
+}
+async function ensureBridgeStartedForRequest() {
+    if (process.env.EMBED_BRIDGE_AUTO_START === "0") {
+        return fail("bridge_unavailable", `embed-local-bridge is not running at ${DEFAULT_BRIDGE_URL}.`, {
+            remediation: `Start it with: embed bridge start`
+        });
+    }
+    let bridgeURL;
+    try {
+        bridgeURL = new URL(DEFAULT_BRIDGE_URL);
+    }
+    catch {
+        return fail("bridge_url_invalid", `EMBED_BRIDGE_URL is not a valid URL: ${DEFAULT_BRIDGE_URL}`);
+    }
+    if (!isLocalBridgeURL(bridgeURL)) {
+        return fail("bridge_unavailable", `embed-local-bridge is not reachable at ${DEFAULT_BRIDGE_URL}.`, {
+            remediation: `Start the bridge for that host, or set EMBED_BRIDGE_URL to a local bridge URL.`
+        });
+    }
+    const launcher = await resolveBridgeLauncher();
+    const host = bridgeURL.hostname === "::1" ? "::1" : bridgeURL.hostname || "127.0.0.1";
+    const port = bridgeURL.port || "18083";
+    const env = {
+        ...process.env,
+        EMBED_BRIDGE_HOST: host,
+        EMBED_BRIDGE_PORT: port
+    };
+    const child = spawn(launcher.command, [...launcher.args, "--host", host, "--port", port], {
+        cwd: process.cwd(),
+        detached: true,
+        stdio: "ignore",
+        env
+    });
+    child.unref();
+    const ready = await waitForBridgeHealth(bridgeURL, 8000);
+    if (!ready.ok) {
+        return ready;
+    }
+    return ok({
+        started: true,
+        bridge_url: DEFAULT_BRIDGE_URL,
+        command: launcher.command
     });
-    return await response.json();
+}
+function isLocalBridgeURL(url) {
+    const host = url.hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+async function waitForBridgeHealth(bridgeURL, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let lastError = "";
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(new URL("/healthz", bridgeURL), {
+                headers: bridgeHeaders("GET", "/healthz", "")
+            });
+            const parsed = await response.json();
+            if (parsed.ok) {
+                return parsed;
+            }
+            lastError = parsed.error?.message ?? `HTTP ${response.status}`;
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error.message : String(error);
+        }
+        await delay(100);
+    }
+    return fail("bridge_start_failed", `embed-local-bridge did not become healthy at ${DEFAULT_BRIDGE_URL}.`, {
+        remediation: `Run embed bridge start in a separate terminal and retry.`,
+        details: { last_error: lastError }
+    });
+}
+function delay(ms) {
+    return new Promise((resolveDelay) => setTimeout(resolveDelay, ms));
 }
 async function cloudGet(path) {
     return await cloudRequest("GET", path);
@@ -1360,16 +1628,23 @@ async function cloudPost(path, body) {
 async function cloudDownloadArtifact(artifactId, outputPath) {
     try {
         const headers = {};
-        const token = await cloudAuthToken();
-        if (token) {
-            headers.authorization = `Bearer ${token}`;
+        const auth = await cloudAuthConfig();
+        if (auth.token) {
+            if (auth.device) {
+                const integrity = await validateLocalDeviceIntegrity(auth.device);
+                if (!integrity.ok) {
+                    return integrity;
+                }
+            }
+            headers.authorization = `Bearer ${auth.token}`;
+            addCloudRequestSignature(headers, "GET", `/v1/artifacts/${encodeURIComponent(artifactId)}/download`, "", auth.token, auth.device);
         }
         const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}/v1/artifacts/${encodeURIComponent(artifactId)}/download`, {
             headers: Object.keys(headers).length > 0 ? headers : undefined
         });
         if (!response.ok) {
             const parsed = await parseErrorResponse(response);
-            return parsed ?? fail("artifact_download_failed", `Artifact download failed with HTTP ${response.status}.`);
+            return parsed ? enrichCloudAuthFailure(parsed, Boolean(auth.token)) : fail("artifact_download_failed", `Artifact download failed with HTTP ${response.status}.`);
         }
         const bytes = Buffer.from(await response.arrayBuffer());
         const expectedSha256 = response.headers.get("x-embed-artifact-sha256")?.trim();
@@ -1398,19 +1673,28 @@ async function cloudDownloadArtifact(artifactId, outputPath) {
 async function cloudRequest(method, path, body) {
     try {
         const headers = {};
-        if (body !== undefined) {
+        const bodyText = body === undefined ? "" : JSON.stringify(body);
+        if (bodyText) {
             headers["content-type"] = "application/json";
         }
-        const token = await cloudAuthToken();
-        if (token) {
-            headers.authorization = `Bearer ${token}`;
+        const auth = await cloudAuthConfig();
+        if (auth.token) {
+            if (auth.device) {
+                const integrity = await validateLocalDeviceIntegrity(auth.device);
+                if (!integrity.ok) {
+                    return integrity;
+                }
+            }
+            headers.authorization = `Bearer ${auth.token}`;
+            addCloudRequestSignature(headers, method, path, bodyText, auth.token, auth.device);
         }
         const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}${path}`, {
             method,
             headers: Object.keys(headers).length > 0 ? headers : undefined,
-            body: body === undefined ? undefined : JSON.stringify(body)
+            body: body === undefined ? undefined : bodyText
         });
-        return await response.json();
+        const parsed = await response.json();
+        return enrichCloudAuthFailure(parsed, Boolean(auth.token));
     }
     catch (error) {
         return fail("cloud_api_unreachable", error instanceof Error ? error.message : String(error), {
@@ -1418,6 +1702,129 @@ async function cloudRequest(method, path, body) {
         });
     }
 }
+async function validateLocalDeviceIntegrity(device) {
+    const current = await localHardwareFingerprint();
+    if (current.fingerprint_hash === device.fingerprint_hash) {
+        return ok(undefined);
+    }
+    return fail("tool_integrity_check_failed", TOOL_INTEGRITY_RELOGIN_MESSAGE, {
+        remediation: [
+            "当前 Embed Labs CLI/插件配置绑定的电脑与本机硬件唯一码不一致。",
+            TOOL_INTEGRITY_RELOGIN_MESSAGE,
+            "如果账号设备数量已达上限，请先在原电脑或用户后台撤销旧设备。"
+        ].join("\n"),
+        details: {
+            expected_fingerprint_hash: device.fingerprint_hash,
+            current_fingerprint_hash: current.fingerprint_hash,
+            platform: current.platform,
+            arch: current.arch,
+            fingerprint_source: current.source
+        }
+    });
+}
+function enrichCloudAuthFailure(response, hadToken) {
+    if (response.ok) {
+        return response;
+    }
+    if (response.error.code.startsWith("device_") || response.error.code.startsWith("request_signature_")) {
+        return fail(response.error.code, response.error.message, {
+            remediation: [
+                "This computer is not fully registered for the configured Embed Labs API Token.",
+                "Run: embedlabs auth login --token <your_token>",
+                "Then verify with: embedlabs auth device status",
+                "If the account already has too many devices, revoke one with: embedlabs auth device revoke <device_id>"
+            ].join("\n"),
+            details: response.error.details
+        });
+    }
+    if (response.error.code !== "unauthorized") {
+        return response;
+    }
+    if (!hadToken) {
+        return fail("auth_token_missing", "Embed Labs API Token is not configured. Register or sign in, create an API Token, then configure it locally before using cloud and plugin services.", {
+            remediation: cloudAuthSetupRemediation(),
+            details: cloudAuthSetupDetails()
+        });
+    }
+    return fail("auth_token_rejected", "The configured Embed Labs API Token was rejected by the server. Recreate or copy a fresh token from the dashboard and sign in again.", {
+        remediation: cloudAuthSetupRemediation(),
+        details: cloudAuthSetupDetails()
+    });
+}
+function cloudAuthSetupRemediation() {
+    return [
+        `1. Open ${DEFAULT_DASHBOARD_URL} and register or sign in.`,
+        "2. Create or copy your Embed Labs API Token from the user dashboard.",
+        "3. Run: embedlabs auth login --token <your_token>",
+        "4. For automation, set: EMBED_API_TOKEN=<your_token>",
+        "5. Verify with: embedlabs auth status"
+    ].join("\n");
+}
+function cloudAuthSetupDetails() {
+    return {
+        dashboard_url: DEFAULT_DASHBOARD_URL,
+        login_command: "embedlabs auth login --token <your_token>",
+        env_var: "EMBED_API_TOKEN",
+        auth_status_command: "embedlabs auth status",
+        auth_file: DEFAULT_AUTH_FILE
+    };
+}
+function addCloudRequestSignature(headers, method, pathWithQuery, bodyText, token, device) {
+    if (process.env.EMBED_CLOUD_API_SIGNING === "0") {
+        return;
+    }
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const nonce = randomBytes(16).toString("hex");
+    const bodySha256 = createHash("sha256").update(bodyText).digest("hex");
+    const keyId = createHash("sha256").update(token).digest("hex").slice(0, 16);
+    const canonical = device
+        ? cloudRequestCanonicalStringV2(method, pathWithQuery, timestamp, nonce, bodySha256, device, EMBED_CLIENT_NAME, EMBED_CLIENT_VERSION)
+        : cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256);
+    headers["x-embed-key-id"] = keyId;
+    headers["x-embed-timestamp"] = timestamp;
+    headers["x-embed-nonce"] = nonce;
+    headers["x-embed-body-sha256"] = bodySha256;
+    if (device) {
+        headers["x-embed-signature-version"] = "v2";
+        headers["x-embed-device-id"] = device.device_id;
+        headers["x-embed-device-fingerprint-sha256"] = device.fingerprint_hash;
+        headers["x-embed-client-name"] = EMBED_CLIENT_NAME;
+        headers["x-embed-client-version"] = EMBED_CLIENT_VERSION;
+        headers["x-embed-device-signature"] = signCrypto(null, Buffer.from(canonical), device.private_key_pem).toString("base64url");
+    }
+    headers["x-embed-signature"] = createHmac("sha256", token).update(canonical).digest("hex");
+}
+function cloudRequestCanonicalString(method, pathWithQuery, timestamp, nonce, bodySha256) {
+    return [
+        method.toUpperCase(),
+        normalizeCloudPathForSignature(pathWithQuery),
+        timestamp,
+        nonce,
+        bodySha256
+    ].join("\n");
+}
+function cloudRequestCanonicalStringV2(method, pathWithQuery, timestamp, nonce, bodySha256, device, clientName, clientVersion) {
+    return [
+        method.toUpperCase(),
+        normalizeCloudPathForSignature(pathWithQuery),
+        timestamp,
+        nonce,
+        bodySha256,
+        device.device_id,
+        device.fingerprint_hash,
+        clientName,
+        clientVersion
+    ].join("\n");
+}
+function normalizeCloudPathForSignature(pathWithQuery) {
+    try {
+        const parsed = new URL(pathWithQuery, "http://embed.local");
+        return `${parsed.pathname}${parsed.search}`;
+    }
+    catch {
+        return pathWithQuery.startsWith("/") ? pathWithQuery : `/${pathWithQuery}`;
+    }
+}
 async function pluginList(parsed) {
     const releaseDir = stringFlag(parsed, "release-dir");
     const manifest = releaseDir ? await readPluginReleaseManifest(releaseDir) : undefined;
@@ -1517,13 +1924,112 @@ async function pluginInstall(parsed) {
         await rm(tempDir, { recursive: true, force: true });
     }
 }
+async function pluginUpdateCheck(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["release-url", "target", "codex-target", "opencode-target", "json"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${PLUGIN_UPDATE_CHECK_USAGE}`);
+    }
+    const unexpected = parsed.command.slice(3);
+    if (unexpected.length > 0) {
+        return fail("invalid_args", `Unexpected argument: ${unexpected[0]}. ${PLUGIN_UPDATE_CHECK_USAGE}`);
+    }
+    const remoteManifest = await fetchRemotePluginManifest(parsed);
+    if (!remoteManifest.ok) {
+        return remoteManifest;
+    }
+    const manifest = remoteManifest.data;
+    const codexPackage = manifest.packages?.find((item) => item.id === "codex-embed-labs");
+    const opencodePackage = manifest.packages?.find((item) => item.id === "opencode-embed-labs");
+    const codexTarget = join(codexPluginTargetRoot(parsed, true), CODEX_PLUGIN_NAME);
+    const openCodeTarget = openCodePluginTargetRoot(parsed, true);
+    return ok({
+        release_url: pluginReleaseBaseUrl(parsed),
+        latest_version: manifest.version,
+        release_notes: normalizedReleaseNotes(manifest.release_notes),
+        plugins: [
+            await pluginUpdateItem({
+                id: "codex",
+                displayName: "Embed Labs Codex plugin",
+                targetPath: codexTarget,
+                installedVersion: await installedCodexPluginVersion(codexTarget),
+                latestVersion: codexPackage?.version ?? manifest.version,
+                releaseFile: codexPackage?.file,
+                updateCommand: "embedlabs plugin update codex"
+            }),
+            await pluginUpdateItem({
+                id: "opencode",
+                displayName: "Embed Labs OpenCode plugin",
+                targetPath: openCodeTarget,
+                installedVersion: await installedOpenCodePluginVersion(openCodeTarget),
+                latestVersion: opencodePackage?.version ?? manifest.version,
+                releaseFile: opencodePackage?.file,
+                updateCommand: "embedlabs plugin update opencode"
+            })
+        ]
+    });
+}
+function normalizedReleaseNotes(notes) {
+    if (!Array.isArray(notes)) {
+        return [];
+    }
+    return notes
+        .filter((item) => typeof item === "string" && item.trim().length > 0)
+        .map((item) => item.trim());
+}
+async function pluginUpdate(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["release-url", "target", "codex-target", "opencode-target", "json"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${PLUGIN_UPDATE_USAGE}`);
+    }
+    const target = parsed.command[2];
+    if (!target || !["codex", "opencode", "all"].includes(target)) {
+        return fail("invalid_args", PLUGIN_UPDATE_USAGE);
+    }
+    const unexpected = parsed.command.slice(3);
+    if (unexpected.length > 0) {
+        return fail("invalid_args", `Unexpected argument: ${unexpected[0]}. ${PLUGIN_UPDATE_USAGE}`);
+    }
+    const installParsed = {
+        ...parsed,
+        command: ["plugin", "install", target],
+        flags: { ...parsed.flags, force: true }
+    };
+    return await pluginInstall(installParsed);
+}
+async function pluginUpdateItem(input) {
+    const installed = !!input.installedVersion;
+    const updateAvailable = !!input.latestVersion && input.installedVersion !== input.latestVersion;
+    const notes = [];
+    if (!installed) {
+        notes.push("Plugin is not installed in the selected target.");
+    }
+    else if (updateAvailable) {
+        notes.push("A newer plugin release is available. Run the update command, then restart Codex/OpenCode.");
+    }
+    else {
+        notes.push("Plugin is up to date for the selected release channel.");
+    }
+    return {
+        id: input.id,
+        display_name: input.displayName,
+        installed,
+        installed_version: input.installedVersion,
+        latest_version: input.latestVersion,
+        update_available: updateAvailable,
+        target_path: input.targetPath,
+        release_file: input.releaseFile,
+        update_command: input.updateCommand,
+        notes
+    };
+}
 async function installCodexPlugin(parsed, context) {
     const source = await resolveCodexPluginSource(context);
     if (!source.ok) {
         return source;
     }
     const targetRoot = codexPluginTargetRoot(parsed, context.installingAll);
-    const targetPath = join(targetRoot, "embed-labs");
+    const targetPath = join(targetRoot, CODEX_PLUGIN_NAME);
+    const legacyCleanup = await cleanupLegacyCodexPluginRemnants(targetRoot);
     if (await pathExists(targetPath) && !booleanFlag(parsed, "force")) {
         return fail("plugin_already_installed", `Codex plugin already exists at ${targetPath}.`, {
             remediation: "Pass --force to replace it, or pass --codex-target/--target to install into a different directory."
@@ -1533,16 +2039,24 @@ async function installCodexPlugin(parsed, context) {
     await mkdir(targetRoot, { recursive: true });
     await cp(source.data.sourcePath, targetPath, { recursive: true });
     const mcpRegistration = await maybeRegisterCodexMcp(parsed, targetRoot, targetPath);
+    const marketplaceRegistration = await maybeRegisterCodexMarketplace(parsed, targetRoot, targetPath);
     return ok({
         id: "codex",
         target_path: targetPath,
         source: source.data.sourceLabel,
         version: source.data.version,
         command_hint: mcpRegistration.registered
-            ? "Codex MCP was registered. Start a new Codex session to reload tools."
+            ? (marketplaceRegistration.registered
+                ? "Codex MCP and plugin marketplace entry were registered. Fully restart Codex to reload @Embed Labs."
+                : "Codex MCP was registered. Start a new Codex session to reload tools.")
             : mcpRegistration.hint,
+        warning: legacyCodexCleanupWarning(legacyCleanup),
         mcp_registered: mcpRegistration.registered,
-        mcp_warning: mcpRegistration.warning
+        mcp_warning: mcpRegistration.warning,
+        marketplace_registered: marketplaceRegistration.registered,
+        marketplace_path: marketplaceRegistration.marketplacePath,
+        marketplace_warning: marketplaceRegistration.warning,
+        cleanup: legacyCleanup
     });
 }
 async function installOpenCodePlugin(parsed, context) {
@@ -1551,8 +2065,10 @@ async function installOpenCodePlugin(parsed, context) {
         return source;
     }
     const targetRoot = openCodePluginTargetRoot(parsed, context.installingAll);
-    const wrapperPath = join(targetRoot, "plugins", "development-board-toolchain.js");
-    if (await pathExists(wrapperPath) && !booleanFlag(parsed, "force")) {
+    const globalInstall = isGlobalOpenCodeRoot(targetRoot);
+    const wrapperPath = join(targetRoot, "plugins", "embed-labs.js");
+    const legacyCleanup = await cleanupLegacyOpenCodePluginRemnants(targetRoot, globalInstall);
+    if (!globalInstall && await pathExists(wrapperPath) && !booleanFlag(parsed, "force")) {
         return fail("plugin_already_installed", `OpenCode plugin wrapper already exists at ${wrapperPath}.`, {
             remediation: "Pass --force to replace it, or pass --opencode-target/--target to install into a different directory."
         });
@@ -1578,15 +2094,25 @@ async function installOpenCodePlugin(parsed, context) {
         });
     }
     await ensureOpenCodeInstallPackageJson(targetRoot);
-    await writeFile(wrapperPath, `export { default, DevelopmentBoardToolchainPlugin } from "embed-labs";\n`, "utf8");
+    if (globalInstall) {
+        await rm(wrapperPath, { force: true });
+        legacyCleanup.legacy_removed_config_entries?.push(...await ensureOpenCodeGlobalPluginConfig());
+    }
+    else {
+        await writeFile(wrapperPath, `export { default, DevelopmentBoardToolchainPlugin } from "embed-labs";\n`, "utf8");
+    }
     const duplicateWarning = await openCodeDuplicatePluginWarning(targetRoot);
+    const cleanupWarning = legacyOpenCodeCleanupWarning(legacyCleanup);
     return ok({
         id: "opencode",
         target_path: targetRoot,
         source: source.data.sourceLabel,
         version: source.data.version,
-        command_hint: "Start OpenCode from the project containing this .opencode directory.",
-        warning: duplicateWarning
+        command_hint: globalInstall
+            ? "Restart OpenCode so the global embed-labs package plugin is reloaded."
+            : "Start OpenCode from the project containing this .opencode directory.",
+        warning: combineWarnings(cleanupWarning, duplicateWarning),
+        cleanup: legacyCleanup
     });
 }
 async function resolveCodexPluginSource(context) {
@@ -1800,14 +2326,465 @@ function openCodePluginTargetRoot(parsed, installingAll) {
     return resolve(target ?? defaultOpenCodeRoot());
 }
 function defaultCodexPluginRoot() {
-    return join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "plugins");
+    return join(defaultCodexHome(), "plugins");
+}
+function defaultCodexHome() {
+    return resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
+}
+function codexConfigPath() {
+    return join(defaultCodexHome(), "config.toml");
+}
+async function cleanupLegacyCodexPluginRemnants(targetRoot) {
+    const removedPaths = [];
+    const removedConfigTables = [];
+    const warnings = [];
+    const stoppedProcesses = await stopLegacyCodexPluginProcesses(warnings);
+    const legacyPaths = [
+        join(targetRoot, "cache", CODEX_MARKETPLACE_NAME, CODEX_PLUGIN_NAME)
+    ];
+    for (const marketplaceName of LEGACY_CODEX_MARKETPLACE_NAMES) {
+        legacyPaths.push(join(targetRoot, "cache", marketplaceName, CODEX_PLUGIN_NAME));
+    }
+    for (const pluginName of LEGACY_CODEX_PLUGIN_NAMES) {
+        legacyPaths.push(join(targetRoot, pluginName));
+        legacyPaths.push(join(targetRoot, "cache", pluginName));
+        for (const marketplaceName of [CODEX_MARKETPLACE_NAME, ...LEGACY_CODEX_MARKETPLACE_NAMES]) {
+            legacyPaths.push(join(targetRoot, "cache", marketplaceName, pluginName));
+        }
+    }
+    legacyPaths.push(...await discoverLegacyCodexCachePaths(targetRoot));
+    if (resolve(targetRoot) === resolve(defaultCodexPluginRoot())) {
+        legacyPaths.push(join(defaultCodexHome(), ".tmp", "plugins"), join(defaultCodexHome(), ".tmp", "plugins.sha"), join(defaultCodexHome(), "ambient-suggestions"), join(defaultCodexHome(), "skills", "dbt-agent"), join(defaultCodexHome(), "skills", "development-board-toolchain-dev"), join(defaultCodexHome(), "memories", "skills", "dbt-agent-live-board-ops"), join(defaultCodexHome(), "memories", "skills", "dbt-agent-platform-plugin-maintenance"));
+        legacyPaths.push(...legacyCodexLocalMarketplacePaths(), ...await discoverLegacyHomeAgentsMarketplacePaths(warnings), ...await discoverLegacyCodexProjectMarketplacePaths(warnings), ...legacyDevelopmentBoardRuntimePluginPaths());
+    }
+    for (const candidate of legacyPaths) {
+        try {
+            if (await pathExists(candidate)) {
+                await rm(candidate, { recursive: true, force: true });
+                removedPaths.push(candidate);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not remove ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (resolve(targetRoot) === resolve(defaultCodexPluginRoot())) {
+        const configPath = codexConfigPath();
+        try {
+            if (await pathExists(configPath)) {
+                const current = await readFile(configPath, "utf8");
+                const updated = removeLegacyCodexConfigTables(current);
+                if (updated.text !== current) {
+                    await writeFile(configPath, updated.text, "utf8");
+                }
+                removedConfigTables.push(...updated.removedTables);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not update ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    const removedHistoryEntries = await cleanupLegacyCodexTextState(warnings);
+    return {
+        legacy_removed_paths: Array.from(new Set(removedPaths)),
+        legacy_removed_config_tables: removedConfigTables,
+        legacy_removed_history_entries: removedHistoryEntries,
+        legacy_stopped_processes: stoppedProcesses,
+        ...(warnings.length > 0 ? { warnings } : {})
+    };
+}
+async function stopLegacyCodexPluginProcesses(warnings) {
+    if (process.platform === "win32")
+        return 0;
+    try {
+        const ps = await runLocalProcess("ps", ["-axo", "pid=,command="]);
+        if (ps.code !== 0)
+            return 0;
+        let stopped = 0;
+        for (const line of ps.stdout.split("\n")) {
+            const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+            if (!match)
+                continue;
+            const pid = Number(match[1]);
+            const command = match[2] || "";
+            if (!isLegacyCodexPluginProcess(command))
+                continue;
+            try {
+                process.kill(pid, "SIGTERM");
+                stopped += 1;
+            }
+            catch (error) {
+                warnings.push(`Could not stop legacy Codex plugin process ${pid}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return stopped;
+    }
+    catch (error) {
+        warnings.push(`Could not scan legacy Codex plugin processes: ${error instanceof Error ? error.message : String(error)}`);
+        return 0;
+    }
+}
+function isLegacyCodexPluginProcess(command) {
+    const trimmed = command.trim();
+    return /^\/.*\/dbt-agent-mcp-bridge(?:\s|$)/.test(trimmed)
+        || /^dbt-agent-mcp-bridge(?:\s|$)/.test(trimmed)
+        || legacyDevelopmentBoardRuntimeProcessPatterns().some((pattern) => pattern.test(trimmed));
+}
+function legacyDevelopmentBoardRuntimeProcessPatterns() {
+    const home = escapeRegExp(homedir());
+    return [
+        new RegExp(`^${home}/Library/development-board-toolchain/agent/bin/dbt-agentd(?:\\s|$)`),
+        new RegExp(`^${home}/Library/Application Support/development-board-toolchain/agent/bin/dbt-agentd(?:\\s|$)`),
+        new RegExp(`^${home}/Library/development-board-toolchain/runtime/dbtctl\\s+status(?:\\s|$)`),
+        new RegExp(`^${home}/Library/Application Support/development-board-toolchain/runtime/dbtctl\\s+status(?:\\s|$)`),
+        new RegExp(`^${home}/.*?/DBT-Agent\\.app/Contents/MacOS/DBT-Agent(?:\\s|$)`)
+    ];
+}
+function legacyDevelopmentBoardRuntimePluginPaths() {
+    return [
+        join(homedir(), "Library", "development-board-toolchain", "runtime", "editor_plugins"),
+        join(homedir(), "Library", "development-board-toolchain", "runtime", "opencode_plugin"),
+        join(homedir(), "Library", "Application Support", "development-board-toolchain", "runtime", "editor_plugins"),
+        join(homedir(), "Library", "Application Support", "development-board-toolchain", "runtime", "opencode_plugin")
+    ];
+}
+function legacyCodexLocalMarketplacePaths() {
+    return Array.from(LEGACY_CODEX_MARKETPLACE_NAMES)
+        .filter((name) => name !== CODEX_MARKETPLACE_NAME)
+        .map((name) => join(defaultCodexHome(), "local-marketplaces", name));
+}
+async function discoverLegacyHomeAgentsMarketplacePaths(warnings) {
+    const paths = [];
+    const pluginRoot = join(homedir(), ".agents", "plugins");
+    try {
+        const entries = await readdir(pluginRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.startsWith("marketplace.json"))
+                continue;
+            const filePath = join(pluginRoot, entry.name);
+            try {
+                const current = await readFile(filePath, "utf8");
+                if (isLegacyHomeAgentsMarketplace(current)) {
+                    paths.push(filePath);
+                }
+            }
+            catch (error) {
+                warnings.push(`Could not inspect legacy Codex home marketplace ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    catch {
+        return paths;
+    }
+    return paths;
+}
+function isLegacyHomeAgentsMarketplace(text) {
+    return marketplaceTextHasLegacyCodexPlugin(text);
+}
+async function discoverLegacyCodexProjectMarketplacePaths(warnings) {
+    const configPath = codexConfigPath();
+    let text = "";
+    try {
+        text = await readFile(configPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const paths = new Set();
+    for (const projectPath of legacyCodexProjectPathsFromConfig(text)) {
+        for (const candidate of [
+            join(projectPath, ".agents", "plugins", "marketplace.json"),
+            join(projectPath, "platform_plugin", ".agents", "plugins", "marketplace.json"),
+            join(projectPath, "platform_plugins", "codex_plugin", ".agents", "plugins", "marketplace.json")
+        ]) {
+            try {
+                if (!await pathExists(candidate))
+                    continue;
+                const current = await readFile(candidate, "utf8");
+                if (marketplaceTextHasLegacyCodexPlugin(current)) {
+                    paths.add(candidate);
+                }
+            }
+            catch (error) {
+                warnings.push(`Could not inspect legacy Codex project marketplace ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    return Array.from(paths);
+}
+function legacyCodexProjectPathsFromConfig(text) {
+    const paths = [];
+    const lines = text.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    for (const line of lines) {
+        const table = parseTomlTableHeader(line);
+        const match = table ? /^projects\."([^"]+)"$/.exec(table) : undefined;
+        if (match?.[1] && /DBT-Agent-Project|development-board-toolchain|dbt-agent/i.test(match[1])) {
+            paths.push(match[1].replace(/\\"/g, '"'));
+        }
+    }
+    return paths;
+}
+function marketplaceTextHasLegacyCodexPlugin(text) {
+    try {
+        const parsed = JSON.parse(text);
+        const marketplaceName = typeof parsed.name === "string" ? parsed.name : "";
+        const marketplaceDisplayName = typeof parsed.interface?.displayName === "string" ? parsed.interface.displayName : "";
+        const marketplaceLooksLegacy = legacyTextHasCodexPluginResidue(marketplaceName)
+            || legacyTextHasCodexPluginResidue(marketplaceDisplayName)
+            || LEGACY_CODEX_MARKETPLACE_NAMES.has(marketplaceName);
+        return (parsed.plugins ?? []).some((plugin) => {
+            const values = [
+                plugin.name,
+                plugin.category,
+                plugin.source?.path,
+                plugin.interface?.displayName
+            ].filter((value) => typeof value === "string");
+            return values.some(legacyTextHasCodexPluginResidue) || marketplaceLooksLegacy && values.some((value) => /embed-labs|dbt|development-board/i.test(value));
+        });
+    }
+    catch {
+        return legacyTextHasCodexPluginResidue(text);
+    }
+}
+async function discoverLegacyCodexCachePaths(targetRoot) {
+    const paths = [];
+    const cacheRoot = join(targetRoot, "cache");
+    try {
+        const marketplaces = await readdir(cacheRoot, { withFileTypes: true });
+        for (const entry of marketplaces) {
+            if (!entry.isDirectory())
+                continue;
+            if (LEGACY_CODEX_MARKETPLACE_NAMES.has(entry.name)) {
+                paths.push(join(cacheRoot, entry.name, CODEX_PLUGIN_NAME));
+            }
+            for (const pluginName of LEGACY_CODEX_PLUGIN_NAMES) {
+                paths.push(join(cacheRoot, entry.name, pluginName));
+            }
+        }
+    }
+    catch {
+        return paths;
+    }
+    return paths;
+}
+async function cleanupLegacyCodexTextState(warnings) {
+    let removed = 0;
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "history.jsonl"), warnings);
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "session_index.jsonl"), warnings);
+    removed += await cleanupLegacyCodexTextFile(join(defaultCodexHome(), "rules", "default.rules"), warnings);
+    return removed;
+}
+async function cleanupLegacyCodexTextFile(filePath, warnings) {
+    try {
+        if (!await pathExists(filePath))
+            return 0;
+        const current = await readFile(filePath, "utf8");
+        const lines = current.split("\n");
+        let removed = 0;
+        const kept = lines.filter((line) => {
+            if (!line)
+                return true;
+            if (isLegacyCodexHistoryMention(line)) {
+                removed += 1;
+                return false;
+            }
+            return true;
+        });
+        if (removed > 0) {
+            await writeFile(filePath, kept.join("\n"), "utf8");
+        }
+        return removed;
+    }
+    catch (error) {
+        warnings.push(`Could not clean Codex legacy text state ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+        return 0;
+    }
+}
+function isLegacyCodexHistoryMention(line) {
+    return line.includes("plugin://dbt-agent@plugins")
+        || line.includes("plugin://dbt-agent@embed-labs")
+        || line.includes("development-board-toolchain-dev")
+        || line.includes("development-board-toolchain")
+        || /plugin:\/\/Dbt Agent@/i.test(line)
+        || /plugin:\/\/deve@/i.test(line)
+        || /dbt-agent/i.test(line);
+}
+function removeLegacyCodexConfigTables(text) {
+    const lines = text.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+    const output = [];
+    const removedTables = [];
+    let skipping = false;
+    for (const line of lines) {
+        const table = parseTomlTableHeader(line);
+        if (table) {
+            skipping = isLegacyCodexConfigTable(table);
+            if (skipping) {
+                removedTables.push(table);
+                continue;
+            }
+        }
+        if (!skipping) {
+            output.push(line);
+        }
+    }
+    return { text: output.join("").replace(/\n{3,}/g, "\n\n"), removedTables };
+}
+function parseTomlTableHeader(line) {
+    const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line);
+    return match?.[1]?.trim();
+}
+function isLegacyCodexConfigTable(table) {
+    return /^plugins\."dbt-agent@[^"]+"$/.test(table)
+        || /^plugins\."Dbt Agent@[^"]+"$/i.test(table)
+        || /^plugins\."deve@[^"]+"$/i.test(table)
+        || isLegacyEmbedLabsCodexMarketplaceConfigTable(table)
+        || table === "mcp_servers.dbt-agent"
+        || table.startsWith("mcp_servers.dbt-agent.")
+        || table === 'mcp_servers."dbt-agent"'
+        || table.startsWith('mcp_servers."dbt-agent".')
+        || table === "mcp_servers.deve"
+        || table.startsWith("mcp_servers.deve.")
+        || /^projects\."[^"]*\/DBT-Agent-Project(?:\/[^"]*)?"$/.test(table);
+}
+function isLegacyEmbedLabsCodexMarketplaceConfigTable(table) {
+    for (const marketplaceName of LEGACY_CODEX_MARKETPLACE_NAMES) {
+        if (table === `marketplaces.${marketplaceName}`) {
+            return true;
+        }
+        if (table === `plugins."${CODEX_PLUGIN_NAME}@${marketplaceName}"`) {
+            return true;
+        }
+    }
+    return false;
+}
+function legacyTextHasCodexPluginResidue(value) {
+    return /dbt-agent|Dbt Agent|development-board-toolchain|development-board-toolchain-dev/i.test(value)
+        || value === "deve"
+        || value.replace(/\\/g, "/").includes("/plugins/deve")
+        || value.includes("plugin://deve@");
+}
+function legacyCodexCleanupWarning(cleanup) {
+    const parts = [];
+    if (cleanup.legacy_removed_paths.length > 0) {
+        parts.push(`removed ${cleanup.legacy_removed_paths.length} stale/legacy Codex plugin path(s)`);
+    }
+    if (cleanup.legacy_removed_config_tables?.length) {
+        parts.push(`removed ${cleanup.legacy_removed_config_tables.length} legacy Codex config table(s)`);
+    }
+    if (cleanup.legacy_removed_history_entries) {
+        parts.push(`removed ${cleanup.legacy_removed_history_entries} legacy Codex text-state mention(s)`);
+    }
+    if (cleanup.legacy_stopped_processes) {
+        parts.push(`stopped ${cleanup.legacy_stopped_processes} legacy Codex plugin process(es)`);
+    }
+    if (cleanup.warnings?.length) {
+        parts.push(`cleanup warning(s): ${cleanup.warnings.join("; ")}`);
+    }
+    return parts.length > 0 ? `Codex plugin cleanup: ${parts.join(", ")}.` : undefined;
+}
+async function cleanupLegacyOpenCodePluginRemnants(targetRoot, globalInstall) {
+    const removedPaths = [];
+    const warnings = [];
+    const legacyPaths = [
+        join(targetRoot, "plugins", "development-board-toolchain.js"),
+        join(targetRoot, "plugins", "development-board-toolchain-dev.js"),
+        join(targetRoot, "plugins", "dbt-agent.js"),
+        join(targetRoot, "plugins", "Dbt Agent.js"),
+        join(targetRoot, "plugins", "deve.js"),
+        join(targetRoot, "plugins", "deve"),
+        join(targetRoot, "node_modules", "development-board-toolchain"),
+        join(targetRoot, "node_modules", "development-board-toolchain-dev"),
+        join(targetRoot, "node_modules", "dbt-agent")
+    ];
+    if (globalInstall) {
+        legacyPaths.push(join(targetRoot, "plugins", "embed-labs.js"));
+        legacyPaths.push(...await discoverLegacyOpenCodeBackupPaths(targetRoot, warnings));
+        legacyPaths.push(...await discoverLegacyOpenCodePluginCachePaths(targetRoot, warnings));
+    }
+    for (const candidate of legacyPaths) {
+        try {
+            if (await pathExists(candidate)) {
+                await rm(candidate, { recursive: true, force: true });
+                removedPaths.push(candidate);
+            }
+        }
+        catch (error) {
+            warnings.push(`Could not remove ${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return {
+        legacy_removed_paths: removedPaths,
+        legacy_removed_config_entries: [],
+        ...(warnings.length > 0 ? { warnings } : {})
+    };
+}
+async function discoverLegacyOpenCodeBackupPaths(targetRoot, warnings) {
+    const paths = [];
+    try {
+        const entries = await readdir(targetRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.includes(".bak"))
+                continue;
+            const filePath = join(targetRoot, entry.name);
+            try {
+                const current = await readFile(filePath, "utf8");
+                if (legacyTextHasCodexPluginResidue(current)) {
+                    paths.push(filePath);
+                }
+            }
+            catch (error) {
+                warnings.push(`Could not inspect legacy OpenCode backup ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    catch {
+        return paths;
+    }
+    return paths;
+}
+async function discoverLegacyOpenCodePluginCachePaths(targetRoot, warnings) {
+    const paths = [];
+    const cacheRoot = join(targetRoot, ".embed-labs", "plugin-cache");
+    try {
+        const entries = await readdir(cacheRoot, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            if (/^(embed-labs|embed-labs-opencode-plugin)-\d+\.\d+\.\d+\.tgz$/.test(entry.name)) {
+                paths.push(join(cacheRoot, entry.name));
+            }
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            warnings.push(`Could not inspect OpenCode plugin cache ${cacheRoot}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return paths;
+}
+function legacyOpenCodeCleanupWarning(cleanup) {
+    const parts = [];
+    if (cleanup.legacy_removed_paths.length > 0) {
+        parts.push(`removed ${cleanup.legacy_removed_paths.length} legacy OpenCode plugin path(s)`);
+    }
+    if (cleanup.legacy_removed_config_entries?.length) {
+        parts.push(`removed ${cleanup.legacy_removed_config_entries.length} legacy OpenCode config entry(s)`);
+    }
+    if (cleanup.warnings?.length) {
+        parts.push(`cleanup warning(s): ${cleanup.warnings.join("; ")}`);
+    }
+    return parts.length > 0 ? `Legacy OpenCode cleanup: ${parts.join(", ")}.` : undefined;
+}
+function combineWarnings(...warnings) {
+    const actual = warnings.filter((warning) => Boolean(warning));
+    return actual.length > 0 ? actual.join(" ") : undefined;
 }
 async function maybeRegisterCodexMcp(parsed, targetRoot, targetPath) {
     const explicitTarget = Boolean(stringFlag(parsed, "target") || stringFlag(parsed, "codex-target"));
     if (explicitTarget && process.env.EMBED_CODEX_MCP_REGISTER !== "1") {
         return {
             registered: false,
-            hint: `Installed into a custom target. Register manually with: codex mcp add embed-labs -- node ${join(targetPath, "scripts", "embed-labs-mcp-bridge.mjs")}`
+            hint: "Installed into a custom target. Register manually with: codex mcp add embed-labs -- embedlabs mcp start"
         };
     }
     const bridgePath = join(targetPath, "scripts", "embed-labs-mcp-bridge.mjs");
@@ -1826,11 +2803,12 @@ async function maybeRegisterCodexMcp(parsed, targetRoot, targetPath) {
         };
     }
     const embedCliBin = process.env.EMBED_CLI_BIN?.trim() || await resolveExecutableOnPath("embedlabs") || await resolveExecutableOnPath("embed") || "";
+    const mcpLauncher = await resolveEmbedCliMcpLauncher(embedCliBin);
     const authFile = resolve(process.env.EMBED_AUTH_FILE?.trim() || DEFAULT_AUTH_FILE);
     const cloudUrl = pluginMcpCloudApiUrl(parsed);
     const existing = await runLocalProcess(codexBin, ["mcp", "get", "embed-labs", "--json"]);
-    if (existing.code === 0 && codexMcpAlreadyRegistered(existing.stdout, bridgePath, cloudUrl, authFile, embedCliBin)) {
-        const warning = await upsertCodexMcpRuntimeConfig(bridgePath);
+    if (existing.code === 0 && codexMcpAlreadyRegistered(existing.stdout, bridgePath, cloudUrl, authFile, embedCliBin, mcpLauncher.command, mcpLauncher.args)) {
+        const warning = await upsertCodexMcpRuntimeConfig(mcpLauncher.command, mcpLauncher.args);
         if (warning) {
             return { registered: true, warning };
         }
@@ -1844,31 +2822,152 @@ async function maybeRegisterCodexMcp(parsed, targetRoot, targetPath) {
         "--env",
         `EMBED_CLOUD_API_URL=${cloudUrl}`,
         "--env",
-        `EMBED_AUTH_FILE=${authFile}`
+        `EMBED_AUTH_FILE=${authFile}`,
+        "--env",
+        `EMBED_MCP_BRIDGE_PATH=${bridgePath}`
     ];
     if (embedCliBin) {
         args.push("--env", `EMBED_CLI_BIN=${embedCliBin}`);
     }
-    args.push("--", process.execPath, bridgePath);
+    args.push("--", mcpLauncher.command, ...mcpLauncher.args);
     const addResult = await runLocalProcess(codexBin, args);
     if (addResult.code !== 0) {
         return {
             registered: false,
-            hint: `Codex plugin installed. Register manually with: codex mcp add embed-labs -- ${process.execPath} ${bridgePath}`,
+            hint: "Codex plugin installed. Register manually with: codex mcp add embed-labs -- embedlabs mcp start",
             warning: `codex mcp add failed: ${addResult.stderr.trim() || addResult.stdout.trim() || `exit ${addResult.code}`}`
         };
     }
-    const warning = await upsertCodexMcpRuntimeConfig(bridgePath);
+    const warning = await upsertCodexMcpRuntimeConfig(mcpLauncher.command, mcpLauncher.args);
     return warning ? { registered: true, warning } : { registered: true };
 }
-function codexMcpAlreadyRegistered(stdout, bridgePath, cloudUrl, authFile, embedCliBin) {
+async function maybeRegisterCodexMarketplace(parsed, targetRoot, targetPath) {
+    const explicitTarget = Boolean(stringFlag(parsed, "target") || stringFlag(parsed, "codex-target"));
+    if (explicitTarget && process.env.EMBED_CODEX_MARKETPLACE_REGISTER !== "1") {
+        return {
+            registered: false,
+            warning: "Codex plugin marketplace entry was not registered because a custom target was used. Set EMBED_CODEX_MARKETPLACE_REGISTER=1 to register it anyway."
+        };
+    }
+    if (resolve(targetRoot) !== resolve(defaultCodexPluginRoot()) && process.env.EMBED_CODEX_MARKETPLACE_REGISTER !== "1") {
+        return {
+            registered: false,
+            warning: "Codex plugin marketplace entry was not registered because the install target is not the default Codex plugin root."
+        };
+    }
+    const marketplacePath = defaultCodexLocalMarketplaceRoot();
+    const marketplacePluginPath = join(marketplacePath, "plugins", CODEX_PLUGIN_NAME);
+    try {
+        if (!await pathExists(join(targetPath, ".codex-plugin", "plugin.json"))) {
+            return {
+                registered: false,
+                warning: `Codex plugin manifest was not found at ${join(targetPath, ".codex-plugin", "plugin.json")}.`
+            };
+        }
+        await rm(marketplacePluginPath, { recursive: true, force: true });
+        await mkdir(dirname(marketplacePluginPath), { recursive: true });
+        await cp(targetPath, marketplacePluginPath, { recursive: true });
+        await refreshCodexPluginCache(targetPath);
+        await writeCodexLocalMarketplaceManifest(marketplacePath);
+        const warning = await upsertCodexPluginMarketplaceConfig(marketplacePath);
+        return warning ? { registered: true, marketplacePath, warning } : { registered: true, marketplacePath };
+    }
+    catch (error) {
+        return {
+            registered: false,
+            marketplacePath,
+            warning: `Could not register Codex plugin marketplace entry: ${error instanceof Error ? error.message : String(error)}`
+        };
+    }
+}
+function defaultCodexLocalMarketplaceRoot() {
+    return join(defaultCodexHome(), "local-marketplaces", CODEX_PLUGIN_NAME);
+}
+async function refreshCodexPluginCache(targetPath) {
+    const manifestPath = join(targetPath, ".codex-plugin", "plugin.json");
+    const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+    const version = typeof manifest.version === "string" && manifest.version.trim()
+        ? manifest.version.trim()
+        : "local";
+    const cachePluginRoot = join(defaultCodexPluginRoot(), "cache", CODEX_MARKETPLACE_NAME, CODEX_PLUGIN_NAME);
+    const cacheVersionPath = join(cachePluginRoot, version);
+    await rm(cachePluginRoot, { recursive: true, force: true });
+    await mkdir(dirname(cacheVersionPath), { recursive: true });
+    await cp(targetPath, cacheVersionPath, { recursive: true });
+}
+async function writeCodexLocalMarketplaceManifest(marketplacePath) {
+    const manifestPath = join(marketplacePath, ".agents", "plugins", "marketplace.json");
+    const manifest = {
+        name: CODEX_MARKETPLACE_NAME,
+        interface: {
+            displayName: "Embed Labs"
+        },
+        plugins: [
+            {
+                name: CODEX_PLUGIN_NAME,
+                source: {
+                    source: "local",
+                    path: `./plugins/${CODEX_PLUGIN_NAME}`
+                },
+                policy: {
+                    installation: "AVAILABLE",
+                    authentication: "ON_USE"
+                },
+                category: "Developer Tools"
+            }
+        ]
+    };
+    await mkdir(dirname(manifestPath), { recursive: true });
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+}
+async function upsertCodexPluginMarketplaceConfig(marketplacePath) {
+    const configPath = codexConfigPath();
+    try {
+        await mkdir(dirname(configPath), { recursive: true });
+        let text = "";
+        try {
+            text = await readFile(configPath, "utf8");
+        }
+        catch {
+            text = "";
+        }
+        const original = text;
+        const cleaned = removeLegacyCodexConfigTables(text).text;
+        let updated = upsertTomlTableKeys(cleaned, `marketplaces.${CODEX_MARKETPLACE_NAME}`, {
+            source_type: tomlString("local"),
+            source: tomlString(marketplacePath),
+            last_updated: tomlString(new Date().toISOString().replace(/\.\d{3}Z$/, "Z"))
+        });
+        updated = upsertTomlTableKeys(updated, `plugins."${CODEX_PLUGIN_NAME}@${CODEX_MARKETPLACE_NAME}"`, {
+            enabled: "true"
+        });
+        if (updated !== original) {
+            await writeFile(configPath, updated, "utf8");
+        }
+        return undefined;
+    }
+    catch (error) {
+        return `${configPath} could not be updated with the Embed Labs plugin marketplace entry: ${error instanceof Error ? error.message : String(error)}`;
+    }
+}
+async function resolveEmbedCliMcpLauncher(embedCliBin) {
+    const explicit = embedCliBin?.trim();
+    if (explicit) {
+        return { command: explicit, args: ["mcp", "start"] };
+    }
+    const pathBin = await resolveExecutableOnPath("embedlabs") || await resolveExecutableOnPath("embed");
+    if (pathBin) {
+        return { command: pathBin, args: ["mcp", "start"] };
+    }
+    return { command: process.execPath, args: [join(CLI_MODULE_DIR, "index.js"), "mcp", "start"] };
+}
+function codexMcpAlreadyRegistered(stdout, bridgePath, cloudUrl, authFile, embedCliBin, mcpCommand, mcpArgs) {
     try {
         const parsed = JSON.parse(stdout);
         const transport = parsed.transport;
-        if (transport?.type !== "stdio" || transport.command !== process.execPath)
-            return false;
-        if (!transport.args?.includes(bridgePath))
+        if (transport?.type !== "stdio")
             return false;
+        const args = transport.args || [];
         const env = transport.env || {};
         if (env.EMBED_CLOUD_API_URL !== cloudUrl)
             return false;
@@ -1876,13 +2975,16 @@ function codexMcpAlreadyRegistered(stdout, bridgePath, cloudUrl, authFile, embed
             return false;
         if (embedCliBin && env.EMBED_CLI_BIN !== embedCliBin)
             return false;
-        return true;
+        const directBridge = transport.command === process.execPath && args.includes(bridgePath);
+        const cliMcp = transport.command === mcpCommand
+            && mcpArgs.every((arg, index) => args[index] === arg);
+        return directBridge || cliMcp;
     }
     catch {
         return false;
     }
 }
-async function upsertCodexMcpRuntimeConfig(bridgePath) {
+async function upsertCodexMcpRuntimeConfig(command, args) {
     const configPath = join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "config.toml");
     try {
         await mkdir(dirname(configPath), { recursive: true });
@@ -1894,8 +2996,8 @@ async function upsertCodexMcpRuntimeConfig(bridgePath) {
             text = "";
         }
         const updated = upsertTomlTableKeys(text, "mcp_servers.embed-labs", {
-            command: tomlString(process.execPath),
-            args: `[${tomlString(bridgePath)}]`,
+            command: tomlString(command),
+            args: `[${args.map(tomlString).join(", ")}]`,
             startup_timeout_sec: "120"
         });
         if (updated !== text) {
@@ -1972,11 +3074,229 @@ async function resolveExecutableOnPath(name) {
     }
     return undefined;
 }
+async function runBridgeStart(parsed) {
+    const host = stringFlag(parsed, "host");
+    const port = numberFlag(parsed, "port");
+    const bridge = await resolveBridgeLauncher();
+    const args = [...bridge.args];
+    if (host) {
+        args.push("--host", host);
+    }
+    if (port !== undefined) {
+        args.push("--port", String(port));
+    }
+    const env = {
+        ...process.env,
+        ...(host ? { EMBED_BRIDGE_HOST: host } : {}),
+        ...(port !== undefined ? { EMBED_BRIDGE_PORT: String(port) } : {})
+    };
+    const child = spawn(bridge.command, args, {
+        stdio: "inherit",
+        env
+    });
+    const forwardSignal = (signal) => {
+        if (!child.killed) {
+            child.kill(signal);
+        }
+    };
+    process.once("SIGINT", forwardSignal);
+    process.once("SIGTERM", forwardSignal);
+    return await new Promise((resolveCode) => {
+        child.on("error", (error) => {
+            process.off("SIGINT", forwardSignal);
+            process.off("SIGTERM", forwardSignal);
+            console.error(error instanceof Error ? error.message : String(error));
+            resolveCode(1);
+        });
+        child.on("close", (code, signal) => {
+            process.off("SIGINT", forwardSignal);
+            process.off("SIGTERM", forwardSignal);
+            if (signal === "SIGINT" || signal === "SIGTERM") {
+                resolveCode(0);
+            }
+            else {
+                resolveCode(code ?? 0);
+            }
+        });
+    });
+}
+async function runMcpStart(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["bridge-path"]);
+    const unexpected = parsed.command.slice(2);
+    if (unknownFlag || unexpected.length > 0) {
+        console.error(unknownFlag ? `Unknown flag --${unknownFlag}. ${MCP_START_USAGE}` : MCP_START_USAGE);
+        return 2;
+    }
+    const bridge = await resolveMcpBridgeLauncher(stringFlag(parsed, "bridge-path"));
+    if (!bridge) {
+        console.error([
+            "Embed Labs MCP bridge was not found.",
+            "Run npm run build in the source checkout, reinstall the embedlabs npm package, or set EMBED_MCP_BRIDGE_PATH to the bridge script.",
+            "Expected command shape for MCP clients: embedlabs mcp start"
+        ].join("\n"));
+        return 1;
+    }
+    const child = spawn(bridge.command, bridge.args, {
+        stdio: "inherit",
+        env: {
+            ...process.env,
+            EMBED_CLIENT_KIND: process.env.EMBED_CLIENT_KIND || "mcp_client",
+            EMBED_MCP_BRIDGE_PATH: bridge.bridgePath
+        }
+    });
+    const forwardSignal = (signal) => {
+        if (!child.killed) {
+            child.kill(signal);
+        }
+    };
+    process.once("SIGINT", forwardSignal);
+    process.once("SIGTERM", forwardSignal);
+    return await new Promise((resolveCode) => {
+        child.on("error", (error) => {
+            process.off("SIGINT", forwardSignal);
+            process.off("SIGTERM", forwardSignal);
+            console.error(error instanceof Error ? error.message : String(error));
+            resolveCode(1);
+        });
+        child.on("close", (code, signal) => {
+            process.off("SIGINT", forwardSignal);
+            process.off("SIGTERM", forwardSignal);
+            if (signal === "SIGINT" || signal === "SIGTERM") {
+                resolveCode(0);
+            }
+            else {
+                resolveCode(code ?? 0);
+            }
+        });
+    });
+}
+async function resolveMcpBridgeLauncher(overridePath) {
+    const explicitPath = overridePath?.trim() || process.env.EMBED_MCP_BRIDGE_PATH?.trim();
+    const candidates = [
+        explicitPath ? resolve(explicitPath) : "",
+        join(CLI_MODULE_DIR, "embed-labs-mcp-bridge.mjs"),
+        sourceCheckoutPath("platform_plugins", "codex_plugin", "plugins", "embed-labs", "scripts", "embed-labs-mcp-bridge.mjs"),
+        join(defaultCodexPluginRoot(), CODEX_PLUGIN_NAME, "scripts", "embed-labs-mcp-bridge.mjs")
+    ].filter(Boolean);
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, constants.R_OK);
+            return { command: process.execPath, args: [candidate], bridgePath: candidate };
+        }
+        catch {
+            // Keep looking.
+        }
+    }
+    return undefined;
+}
+async function resolveBridgeLauncher() {
+    const explicitBinary = process.env.EMBED_LOCAL_BRIDGE_BINARY?.trim();
+    if (explicitBinary) {
+        try {
+            await access(explicitBinary, constants.X_OK);
+            return { command: explicitBinary, args: [] };
+        }
+        catch {
+            // Fall through so the package launcher can print its clearer repair message.
+        }
+    }
+    const pathBinary = await resolveExecutableOnPath(process.platform === "win32" ? "embed-local-bridge.cmd" : "embed-local-bridge");
+    if (pathBinary) {
+        return { command: pathBinary, args: [] };
+    }
+    const packageLauncher = await resolveBridgePackageLauncher();
+    if (packageLauncher) {
+        return { command: process.execPath, args: [packageLauncher] };
+    }
+    return {
+        command: process.execPath,
+        args: [resolve(SOURCE_CHECKOUT_ROOT, "packages", "local-bridge", "dist", "index.js")]
+    };
+}
+async function resolveBridgePackageLauncher() {
+    const candidates = [];
+    try {
+        const packageJson = require.resolve("@embed-labs/local-bridge/package.json");
+        candidates.push(join(dirname(packageJson), "dist", "index.js"));
+    }
+    catch {
+        // Source checkout fallback below.
+    }
+    candidates.push(resolve(SOURCE_CHECKOUT_ROOT, "packages", "local-bridge", "dist", "index.js"));
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, constants.R_OK);
+            return candidate;
+        }
+        catch {
+            // Keep looking.
+        }
+    }
+    return undefined;
+}
 function defaultOpenCodeRoot() {
-    return join(process.cwd(), ".opencode");
+    return globalOpenCodeRoot();
+}
+function globalOpenCodeRoot() {
+    return join(homedir(), ".config", "opencode");
+}
+function isGlobalOpenCodeRoot(targetRoot) {
+    return resolve(targetRoot) === resolve(globalOpenCodeRoot());
+}
+async function ensureOpenCodeGlobalPluginConfig() {
+    const configPath = join(globalOpenCodeRoot(), "opencode.json");
+    let existing = {};
+    try {
+        const parsed = JSON.parse(await readFile(configPath, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            existing = parsed;
+        }
+    }
+    catch {
+        existing = {};
+    }
+    const configured = Array.isArray(existing.plugin)
+        ? existing.plugin.filter((item) => typeof item === "string")
+        : Array.isArray(existing.plugins)
+            ? existing.plugins.filter((item) => typeof item === "string")
+            : [];
+    const removed = configured.filter(isLegacyOpenCodePluginConfigEntry);
+    const cleaned = configured.filter((item) => !isLegacyOpenCodePluginConfigEntry(item));
+    if (!cleaned.includes("embed-labs")) {
+        cleaned.push("embed-labs");
+    }
+    await writeFile(configPath, `${JSON.stringify({
+        ...existing,
+        plugin: cleaned,
+        plugins: undefined
+    }, null, 2)}\n`, "utf8");
+    return removed;
+}
+function isLegacyOpenCodePluginConfigEntry(item) {
+    const normalized = item.trim().replace(/\\/g, "/");
+    const pathOnly = normalized.split(/[?#]/, 1)[0] || normalized;
+    return normalized === "dbt-agent"
+        || normalized === "Dbt Agent"
+        || normalized === "deve"
+        || normalized === "development-board-toolchain"
+        || normalized === "development-board-toolchain-dev"
+        || normalized === "./plugins/deve"
+        || normalized === "./plugins/deve.js"
+        || /(?:^|\/)plugins\/deve(?:\.js)?$/.test(pathOnly)
+        || /(?:^|\/)plugins\/dbt-agent(?:\.js)?$/.test(pathOnly)
+        || normalized === "./plugins/development-board-toolchain"
+        || normalized === "./plugins/development-board-toolchain.js"
+        || normalized === "./plugins/development-board-toolchain-dev"
+        || normalized === "./plugins/development-board-toolchain-dev.js"
+        || pathOnly.endsWith("/plugins/development-board-toolchain")
+        || pathOnly.endsWith("/plugins/development-board-toolchain.js")
+        || pathOnly.endsWith("/plugins/development-board-toolchain-dev")
+        || pathOnly.endsWith("/plugins/development-board-toolchain-dev.js")
+        || normalized.includes("dbt-agent")
+        || normalized.includes("development-board-toolchain");
 }
 async function openCodeDuplicatePluginWarning(targetRoot) {
-    const globalRoot = join(homedir(), ".config", "opencode");
+    const globalRoot = globalOpenCodeRoot();
     if (resolve(targetRoot) === resolve(globalRoot))
         return undefined;
     const configPath = join(globalRoot, "opencode.json");
@@ -2008,6 +3328,21 @@ async function localPluginVersion(kind) {
         return undefined;
     }
 }
+async function installedCodexPluginVersion(pluginPath) {
+    return await readPackageVersion(join(pluginPath, ".codex-plugin", "plugin.json"));
+}
+async function installedOpenCodePluginVersion(targetRoot) {
+    return await readPackageVersion(join(targetRoot, "node_modules", "embed-labs", "package.json"));
+}
+async function readPackageVersion(filePath) {
+    try {
+        const parsed = JSON.parse(await readFile(filePath, "utf8"));
+        return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function localPluginSourcesAvailable() {
     return await pathExists(sourceCheckoutPath("platform_plugins", "codex_plugin", "plugins", "embed-labs", ".codex-plugin", "plugin.json"))
         && await pathExists(sourceCheckoutPath("platform_plugins", "opencode_plugin", "package.json"));
@@ -2066,19 +3401,65 @@ async function parseErrorResponse(response) {
     return undefined;
 }
 async function cloudAuthToken() {
+    return (await cloudAuthConfig()).token;
+}
+async function cloudAuthConfig() {
     const envToken = process.env.EMBED_API_TOKEN?.trim();
     if (envToken) {
-        return envToken;
+        const fileConfig = await readLocalAuthFile();
+        return {
+            ...fileConfig,
+            token: envToken,
+            profile: process.env.EMBED_AUTH_PROFILE ?? fileConfig.profile ?? "default",
+            source: "env"
+        };
     }
+    const fileConfig = await readLocalAuthFile();
+    return {
+        ...fileConfig,
+        token: fileConfig.token?.trim() || undefined,
+        profile: fileConfig.profile ?? "default",
+        source: fileConfig.token ? "file" : undefined
+    };
+}
+async function readLocalAuthFile() {
     try {
         const parsed = JSON.parse(await readFile(DEFAULT_AUTH_FILE, "utf8"));
-        const fileToken = typeof parsed.token === "string" ? parsed.token.trim() : "";
-        return fileToken || undefined;
+        return normalizeLocalAuthFile(parsed);
     }
     catch {
-        return undefined;
+        return {};
     }
 }
+function normalizeLocalAuthFile(parsed) {
+    const device = isJsonObject(parsed.device) ? parsed.device : undefined;
+    const normalizedDevice = device && typeof device.device_id === "string" && typeof device.fingerprint_hash === "string" && typeof device.private_key_pem === "string"
+        ? {
+            device_id: device.device_id,
+            fingerprint_hash: device.fingerprint_hash,
+            private_key_pem: device.private_key_pem,
+            public_key_pem: typeof device.public_key_pem === "string" ? device.public_key_pem : undefined,
+            label: typeof device.label === "string" ? device.label : undefined,
+            platform: typeof device.platform === "string" ? device.platform : undefined,
+            arch: typeof device.arch === "string" ? device.arch : undefined,
+            hostname_hash: typeof device.hostname_hash === "string" ? device.hostname_hash : undefined,
+            registered_at: typeof device.registered_at === "string" ? device.registered_at : undefined
+        }
+        : undefined;
+    return {
+        profile: typeof parsed.profile === "string" ? parsed.profile : undefined,
+        token: typeof parsed.token === "string" ? parsed.token.trim() : undefined,
+        updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : undefined,
+        account_id: typeof parsed.account_id === "string" ? parsed.account_id : undefined,
+        api_key_id: typeof parsed.api_key_id === "string" ? parsed.api_key_id : undefined,
+        device: normalizedDevice
+    };
+}
+async function writeLocalAuthFile(config) {
+    await mkdir(dirname(DEFAULT_AUTH_FILE), { recursive: true });
+    await writeFile(DEFAULT_AUTH_FILE, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+    await chmod(DEFAULT_AUTH_FILE, 0o600).catch(() => undefined);
+}
 function serviceBaseUrl(url) {
     return url.replace(/\/+$/, "");
 }
@@ -2101,9 +3482,16 @@ async function naturalLanguageQuery(parsed) {
     }
     const text = parsed.command.slice(1).join(" ").trim();
     if (!text) {
-        return { response: fail("invalid_args", QUERY_USAGE, { remediation: "Try: embed query \"查一下我的额度\"." }) };
+        return { response: fail("invalid_args", QUERY_USAGE, { remediation: "Try: embed query \"当前支持哪些开发板\"." }) };
     }
     const normalized = text.toLowerCase();
+    if (isQuotaOrBillingIntent(normalized)) {
+        return {
+            response: fail("quota_not_supported", "当前 Embed Labs 服务器只提供 MCP 服务，不提供额度、充值、余额、账本或存储配额功能。", {
+                remediation: "请使用 embedlabs auth status 查看登录和设备绑定状态，或在 MCP 客户端中直接调用开发板、工具链、知识库和本地硬件相关工具。"
+            })
+        };
+    }
     const accountId = await queryAccountId(parsed);
     const needsAccount = queryNeedsAccount(normalized);
     if (needsAccount && !accountId.ok) {
@@ -2122,7 +3510,7 @@ async function naturalLanguageQuery(parsed) {
         if (!amountUsd) {
             return {
                 response: fail("amount_required", "Recharge requests need an amount.", {
-                    remediation: "Try: embed query \"用 USDC 链上充值 100 美元\"."
+                    remediation: "当前 MCP 服务不提供充值流程。"
                 })
             };
         }
@@ -2215,13 +3603,8 @@ async function naturalLanguageQuery(parsed) {
         response: fail("query_intent_unknown", "I could not map that request to a stable CLI action yet.", {
             remediation: [
                 "Supported examples:",
-                "embed query \"查一下我的额度\"",
-                "embed query \"用 USDC 链上充值 100 美元\"",
-                "embed query \"看一下 token 用量\"",
-                "embed query \"看一下磁盘空间\"",
                 "embed query \"列出我的 API key\"",
                 "embed query \"有哪些开发板模板\"",
-                "embed query \"当前可以用哪些模型\"",
                 "embed query \"本地有哪些工具能力\""
             ].join("\n")
         })
@@ -2434,6 +3817,10 @@ function agentRunToolInputs(parsed) {
     if (remotePath.error) {
         return remotePath.error;
     }
+    const runCommand = optionalTrimmedStringFlag(parsed, "run-command");
+    if (runCommand.error) {
+        return runCommand.error;
+    }
     const user = optionalTrimmedStringFlag(parsed, "user");
     if (user.error) {
         return user.error;
@@ -2487,6 +3874,7 @@ function agentRunToolInputs(parsed) {
             user: user.value,
             artifact_path: artifact.value,
             remote_path: remotePath.value,
+            run_command: runCommand.value,
             run: booleanFlag(parsed, "run") || undefined,
             timeout_seconds: timeout.value
         });
@@ -2567,13 +3955,15 @@ async function queryAccountId(parsed) {
     return { ok: true, value: auth.data.account_id };
 }
 function queryNeedsAccount(normalized) {
+    return isApiKeyIntent(normalized);
+}
+function isQuotaOrBillingIntent(normalized) {
     return isRechargeIntent(normalized)
         || isBalanceIntent(normalized)
         || isUsageIntent(normalized)
         || isBillingStatementIntent(normalized)
         || isStorageSettlementIntent(normalized)
-        || isStorageIntent(normalized)
-        || isApiKeyIntent(normalized);
+        || isStorageIntent(normalized);
 }
 function isRechargeIntent(normalized) {
     return /(充值|充钱|续费|购买额度|买额度|top\s*up|recharge|add credits|buy credits)/i.test(normalized);
@@ -3422,6 +4812,47 @@ function boardKnowledgeFileRequest(parsed) {
         outputPath: outputPath.value
     };
 }
+function boardKnowledgeSearchRequest(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "query", "source", "limit"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${BOARD_KNOWLEDGE_SEARCH_USAGE}`;
+    }
+    const templateId = parsed.command[3]?.trim();
+    if (!templateId) {
+        return BOARD_KNOWLEDGE_SEARCH_USAGE;
+    }
+    const extra = parsed.command.slice(4);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${BOARD_KNOWLEDGE_SEARCH_USAGE}`;
+    }
+    const query = optionalTrimmedStringFlag(parsed, "query");
+    if (query.error) {
+        return query.error;
+    }
+    if (!query.value) {
+        return BOARD_KNOWLEDGE_SEARCH_USAGE;
+    }
+    const source = optionalTrimmedStringFlag(parsed, "source");
+    if (source.error) {
+        return source.error;
+    }
+    if (source.value && !["board_pack", "build_template", "registry"].includes(source.value)) {
+        return BOARD_KNOWLEDGE_SEARCH_USAGE;
+    }
+    const limit = optionalPositiveIntegerFlag(parsed, "limit");
+    if (limit.error) {
+        return limit.error;
+    }
+    if (limit.value !== undefined && limit.value > 10) {
+        return "--limit must be between 1 and 10.";
+    }
+    return {
+        templateId,
+        query: query.value,
+        source: source.value,
+        limit: limit.value ?? 5
+    };
+}
 function toolCallRequest(parsed) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "input-json", "approve"]);
     if (unknownFlag) {
@@ -3469,7 +4900,7 @@ function isTaishanPiDeployCommand(parsed) {
         || area === "deploy";
 }
 function boardDeployTaishanPiRequest(parsed) {
-    const unknownFlag = firstUnknownFlag(parsed, ["json", "host", "user", "artifact", "artifact-path", "remote-path", "run", "timeout", "approve", "approved"]);
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "host", "user", "artifact", "artifact-path", "remote-path", "run-command", "run", "timeout", "approve", "approved"]);
     if (unknownFlag) {
         return `Unknown flag --${unknownFlag}. ${BOARD_DEPLOY_TAISHANPI_USAGE}`;
     }
@@ -3511,6 +4942,10 @@ function boardDeployTaishanPiRequest(parsed) {
     if (remotePath.error) {
         return remotePath.error;
     }
+    const runCommand = optionalTrimmedStringFlag(parsed, "run-command");
+    if (runCommand.error) {
+        return runCommand.error;
+    }
     const timeout = optionalNonNegativeIntegerFlag(parsed, "timeout");
     if (timeout.error) {
         return timeout.error;
@@ -3525,6 +4960,7 @@ function boardDeployTaishanPiRequest(parsed) {
         user: user.value,
         artifact_path: artifact.value,
         remote_path: remotePath.value,
+        run_command: runCommand.value,
         run: booleanFlag(parsed, "run") || undefined,
         timeout_seconds: timeout.value,
         approved: approval.value || undefined
@@ -3537,30 +4973,272 @@ async function authLogin(parsed) {
         return fail("invalid_args", "Usage: embed auth login --token <token> [--profile default] [--json]");
     }
     const updatedAt = new Date().toISOString();
-    await mkdir(dirname(DEFAULT_AUTH_FILE), { recursive: true });
-    await writeFile(DEFAULT_AUTH_FILE, `${JSON.stringify({ profile, token, updated_at: updatedAt }, null, 2)}\n`, "utf8");
-    return ok({ authenticated: true, profile, source: "file", updated_at: updatedAt });
+    const current = await readLocalAuthFile();
+    const localDevice = await buildLocalDeviceAuth(parsed, current.device);
+    const registration = await registerLocalDevice(token.trim(), localDevice.registration);
+    if (!registration.ok) {
+        return fail(registration.error.code, registration.error.message, {
+            remediation: registration.error.remediation,
+            details: registration.error.details
+        });
+    }
+    const device = {
+        device_id: registration.data.device.device_id,
+        fingerprint_hash: localDevice.device.fingerprint_hash,
+        private_key_pem: localDevice.device.private_key_pem,
+        public_key_pem: localDevice.device.public_key_pem,
+        label: registration.data.device.label ?? localDevice.device.label,
+        platform: registration.data.device.platform ?? localDevice.device.platform,
+        arch: registration.data.device.arch ?? localDevice.device.arch,
+        hostname_hash: registration.data.device.hostname_hash ?? localDevice.device.hostname_hash,
+        registered_at: registration.data.device.first_seen_at
+    };
+    await writeLocalAuthFile({
+        profile,
+        token: token.trim(),
+        updated_at: updatedAt,
+        account_id: registration.data.device.account_id,
+        api_key_id: registration.data.device.api_key_id,
+        device
+    });
+    return ok({
+        authenticated: true,
+        profile,
+        source: "file",
+        updated_at: updatedAt,
+        account_id: registration.data.device.account_id,
+        api_key_id: registration.data.device.api_key_id,
+        device_id: device.device_id,
+        device_fingerprint_hash: device.fingerprint_hash,
+        device_label: device.label,
+        device_registered_at: device.registered_at,
+        device_private_key_configured: true
+    });
 }
 async function authStatus() {
-    if (process.env.EMBED_API_TOKEN?.trim()) {
+    const envToken = process.env.EMBED_API_TOKEN?.trim();
+    const file = await readLocalAuthFile();
+    const deviceIntegrity = file.device
+        ? (await validateLocalDeviceIntegrity(file.device)).ok ? "ok" : "failed"
+        : "unbound";
+    if (envToken) {
         return {
             authenticated: true,
             profile: process.env.EMBED_AUTH_PROFILE ?? "default",
-            source: "env"
+            source: "env",
+            account_id: file.account_id,
+            api_key_id: file.api_key_id,
+            device_id: file.device?.device_id,
+            device_fingerprint_hash: file.device?.fingerprint_hash,
+            device_label: file.device?.label,
+            device_registered_at: file.device?.registered_at,
+            device_private_key_configured: Boolean(file.device?.private_key_pem),
+            device_integrity: deviceIntegrity
         };
     }
+    return {
+        authenticated: Boolean(file.token?.trim()),
+        profile: file.profile ?? "default",
+        source: file.token ? "file" : undefined,
+        updated_at: file.updated_at,
+        account_id: file.account_id,
+        api_key_id: file.api_key_id,
+        device_id: file.device?.device_id,
+        device_fingerprint_hash: file.device?.fingerprint_hash,
+        device_label: file.device?.label,
+        device_registered_at: file.device?.registered_at,
+        device_private_key_configured: Boolean(file.device?.private_key_pem),
+        device_integrity: deviceIntegrity
+    };
+}
+async function authDeviceStatus(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json"]);
+    const unexpected = parsed.command.slice(3);
+    if (unknownFlag || unexpected.length > 0) {
+        return fail("invalid_args", unknownFlag ? `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_STATUS_USAGE}` : AUTH_DEVICE_STATUS_USAGE);
+    }
+    const local = await authStatus();
+    const remote = local.authenticated ? await cloudGet("/v1/me/devices") : undefined;
+    if (remote && !remote.ok) {
+        return ok({ local });
+    }
+    return ok({ local, remote: remote?.data });
+}
+async function authDeviceList(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json"]);
+    const unexpected = parsed.command.slice(3);
+    if (unknownFlag || unexpected.length > 0) {
+        return fail("invalid_args", unknownFlag ? `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_LIST_USAGE}` : AUTH_DEVICE_LIST_USAGE);
+    }
+    return await cloudGet("/v1/me/devices");
+}
+async function authDeviceRevoke(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_REVOKE_USAGE}`);
+    }
+    const id = commandId(parsed, 3, "device_id", AUTH_DEVICE_REVOKE_USAGE);
+    if (!id.ok) {
+        return fail("invalid_args", id.error);
+    }
+    return await cloudPost(`/v1/me/devices/${encodeURIComponent(id.value)}/revoke`, {});
+}
+async function authDeviceRename(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "label"]);
+    if (unknownFlag) {
+        return fail("invalid_args", `Unknown flag --${unknownFlag}. ${AUTH_DEVICE_RENAME_USAGE}`);
+    }
+    const id = commandId(parsed, 3, "device_id", AUTH_DEVICE_RENAME_USAGE);
+    if (!id.ok) {
+        return fail("invalid_args", id.error);
+    }
+    const label = stringFlag(parsed, "label");
+    if (!label?.trim()) {
+        return fail("invalid_args", AUTH_DEVICE_RENAME_USAGE);
+    }
+    const updated = await cloudPost(`/v1/me/devices/${encodeURIComponent(id.value)}`, { label: label.trim() });
+    if (updated.ok) {
+        const auth = await readLocalAuthFile();
+        if (auth.device?.device_id === updated.data.device_id) {
+            await writeLocalAuthFile({ ...auth, device: { ...auth.device, label: updated.data.label } });
+        }
+    }
+    return updated;
+}
+async function buildLocalDeviceAuth(parsed, existing) {
+    const fingerprint = await localHardwareFingerprint();
+    const keyPair = existing?.fingerprint_hash === fingerprint.fingerprint_hash && existing.private_key_pem && existing.public_key_pem
+        ? { privateKeyPem: existing.private_key_pem, publicKeyPem: existing.public_key_pem }
+        : generateLocalDeviceKeyPair();
+    const label = stringFlag(parsed, "label")?.trim()
+        || existing?.label
+        || `${fingerprint.platform} ${fingerprint.arch}`;
+    const device = {
+        device_id: existing?.fingerprint_hash === fingerprint.fingerprint_hash ? existing.device_id : "",
+        fingerprint_hash: fingerprint.fingerprint_hash,
+        private_key_pem: keyPair.privateKeyPem,
+        public_key_pem: keyPair.publicKeyPem,
+        label,
+        platform: fingerprint.platform,
+        arch: fingerprint.arch,
+        hostname_hash: fingerprint.hostname_hash,
+        registered_at: existing?.registered_at
+    };
+    return {
+        device,
+        registration: {
+            fingerprint_hash: fingerprint.fingerprint_hash,
+            public_key: keyPair.publicKeyPem,
+            label,
+            platform: fingerprint.platform,
+            arch: fingerprint.arch,
+            hostname_hash: fingerprint.hostname_hash,
+            client_name: EMBED_CLIENT_NAME,
+            client_version: EMBED_CLIENT_VERSION,
+            metadata: {
+                fingerprint_version: "v1",
+                fingerprint_source: fingerprint.source
+            }
+        }
+    };
+}
+function generateLocalDeviceKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    return {
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString()
+    };
+}
+async function registerLocalDevice(token, body) {
     try {
-        const parsed = JSON.parse(await readFile(DEFAULT_AUTH_FILE, "utf8"));
-        return {
-            authenticated: typeof parsed.token === "string" && parsed.token.trim().length > 0,
-            profile: typeof parsed.profile === "string" ? parsed.profile : "default",
-            source: "file",
-            updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : undefined
+        const bodyText = JSON.stringify(body);
+        const headers = {
+            "content-type": "application/json",
+            authorization: `Bearer ${token}`
         };
+        addCloudRequestSignature(headers, "POST", "/v1/me/devices/register", bodyText, token);
+        const response = await fetch(`${serviceBaseUrl(DEFAULT_CLOUD_API_URL)}/v1/me/devices/register`, {
+            method: "POST",
+            headers,
+            body: bodyText
+        });
+        const parsed = await response.json();
+        return enrichCloudAuthFailure(parsed, true);
+    }
+    catch (error) {
+        return fail("cloud_api_unreachable", error instanceof Error ? error.message : String(error), {
+            remediation: `Check that embed cloud-api is running at ${DEFAULT_CLOUD_API_URL}. Start it with: npm run cloud-api`
+        });
+    }
+}
+async function localHardwareFingerprint() {
+    cachedLocalHardwareFingerprint ??= localHardwareFingerprintUncached();
+    return await cachedLocalHardwareFingerprint;
+}
+async function localHardwareFingerprintUncached() {
+    const platformName = platform();
+    const archName = arch();
+    const raw = await localHardwareId(platformName);
+    const fingerprintHash = createHash("sha256")
+        .update(`embed-labs:device:v1:${platformName}:${raw.value}`)
+        .digest("hex");
+    const hostnameHash = createHash("sha256")
+        .update(`embed-labs:hostname:v1:${hostname()}`)
+        .digest("hex");
+    return {
+        fingerprint_hash: fingerprintHash,
+        platform: platformName,
+        arch: archName,
+        hostname_hash: hostnameHash,
+        source: raw.source
+    };
+}
+async function localHardwareId(platformName) {
+    if (platformName === "darwin") {
+        const result = await runLocalProcess("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+        const match = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(result.stdout);
+        if (match?.[1]) {
+            return { value: match[1], source: "macos_ioplatformuuid" };
+        }
+    }
+    if (platformName === "win32") {
+        const result = await runLocalProcess("reg", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"]);
+        const match = /MachineGuid\s+REG_\w+\s+([^\r\n]+)/.exec(result.stdout);
+        if (match?.[1]?.trim()) {
+            return { value: match[1].trim(), source: "windows_machineguid" };
+        }
+    }
+    if (platformName === "linux") {
+        for (const pathValue of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+            try {
+                const value = (await readFile(pathValue, "utf8")).trim();
+                if (value) {
+                    return { value, source: `linux:${pathValue}` };
+                }
+            }
+            catch {
+                // Try the next stable machine id location.
+            }
+        }
+    }
+    const generated = await localGeneratedInstallId();
+    return { value: generated, source: "generated_install_id" };
+}
+async function localGeneratedInstallId() {
+    try {
+        const parsed = JSON.parse(await readFile(DEFAULT_DEVICE_FILE, "utf8"));
+        if (typeof parsed.generated_install_id === "string" && parsed.generated_install_id.trim()) {
+            return parsed.generated_install_id.trim();
+        }
     }
     catch {
-        return { authenticated: false, profile: "default" };
+        // Fall through and create a local-only fallback id.
     }
+    const generated = `install_${randomBytes(24).toString("base64url")}`;
+    await mkdir(dirname(DEFAULT_DEVICE_FILE), { recursive: true });
+    await writeFile(DEFAULT_DEVICE_FILE, `${JSON.stringify({ generated_install_id: generated, created_at: new Date().toISOString() }, null, 2)}\n`, "utf8");
+    await chmod(DEFAULT_DEVICE_FILE, 0o600).catch(() => undefined);
+    return generated;
 }
 function accountCreateBody(parsed) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "email", "display-name"]);
@@ -3716,6 +5394,80 @@ function usageRecordBody(parsed) {
         created_at: createdAtResult.value
     });
 }
+function mcpToolEventBody(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, [
+        "json",
+        "account",
+        "account-id",
+        "tool",
+        "client",
+        "mode",
+        "server-model-used",
+        "success",
+        "local-device-id",
+        "local_device_id",
+        "request-id",
+        "duration-ms",
+        "input-summary",
+        "output-summary"
+    ]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${MCP_TOOL_EVENT_USAGE}`;
+    }
+    const extra = parsed.command.slice(2);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${MCP_TOOL_EVENT_USAGE}`;
+    }
+    const toolResult = optionalTrimmedStringFlag(parsed, "tool");
+    if (toolResult.error)
+        return toolResult.error;
+    if (!toolResult.value)
+        return MCP_TOOL_EVENT_USAGE;
+    const accountResult = optionalTrimmedStringAliasFlag(parsed, ["account", "account-id"], "account or account-id");
+    if (accountResult.error)
+        return accountResult.error;
+    const clientResult = optionalTrimmedStringFlag(parsed, "client");
+    if (clientResult.error)
+        return clientResult.error;
+    const modeResult = optionalTrimmedStringFlag(parsed, "mode");
+    if (modeResult.error)
+        return modeResult.error;
+    const localDeviceResult = optionalTrimmedStringAliasFlag(parsed, ["local-device-id", "local_device_id"], "local-device-id");
+    if (localDeviceResult.error)
+        return localDeviceResult.error;
+    const requestIdResult = optionalTrimmedStringFlag(parsed, "request-id");
+    if (requestIdResult.error)
+        return requestIdResult.error;
+    const inputSummaryResult = optionalTrimmedStringFlag(parsed, "input-summary");
+    if (inputSummaryResult.error)
+        return inputSummaryResult.error;
+    const outputSummaryResult = optionalTrimmedStringFlag(parsed, "output-summary");
+    if (outputSummaryResult.error)
+        return outputSummaryResult.error;
+    const durationResult = optionalNonNegativeIntegerFlag(parsed, "duration-ms");
+    if (durationResult.error)
+        return durationResult.error;
+    const serverModelUsed = optionalBooleanFlag(parsed, "server-model-used");
+    if (typeof serverModelUsed === "string")
+        return serverModelUsed;
+    const success = optionalBooleanFlag(parsed, "success");
+    if (typeof success === "string")
+        return success;
+    return compactBody({
+        account_id: accountResult.value,
+        tool_name: toolResult.value,
+        client: clientResult.value,
+        mode: modeResult.value,
+        local_device_id: localDeviceResult.value,
+        server_model_used: serverModelUsed,
+        success,
+        request_id: requestIdResult.value,
+        duration_ms: durationResult.value,
+        input_summary: inputSummaryResult.value,
+        output_summary: outputSummaryResult.value,
+        metadata: localDeviceResult.value ? { local_device_id: localDeviceResult.value } : undefined
+    });
+}
 function usageSummaryRequest(parsed) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "account", "account-id", "api-key-id", "from", "to"]);
     if (unknownFlag) {
@@ -4051,6 +5803,29 @@ function billingSnapshotListRequest(parsed) {
     }
     return { path: `/v1/accounts/${encodeURIComponent(accountResult.value)}/billing/snapshots` };
 }
+function localToolchainListRequest(parsed, usage = LOCAL_TOOLCHAIN_LIST_USAGE) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "channel", "metadata-root", "install-root"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${usage}`;
+    }
+    const extra = parsed.command.slice(3);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${usage}`;
+    }
+    const board = optionalTrimmedStringAliasFlag(parsed, ["board", "board-id"], "board or board-id");
+    if (board.error)
+        return board.error;
+    const channel = optionalTrimmedStringFlag(parsed, "channel");
+    if (channel.error)
+        return channel.error;
+    const metadataRoot = optionalTrimmedStringFlag(parsed, "metadata-root");
+    if (metadataRoot.error)
+        return metadataRoot.error;
+    const installRoot = optionalTrimmedStringFlag(parsed, "install-root");
+    if (installRoot.error)
+        return installRoot.error;
+    return { boardId: board.value, channel: channel.value, metadataRoot: metadataRoot.value, installRoot: installRoot.value };
+}
 function localToolchainLatestRequest(parsed) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "channel", "metadata-root"]);
     if (unknownFlag) {
@@ -4071,6 +5846,32 @@ function localToolchainLatestRequest(parsed) {
         return metadataRoot.error;
     return { boardId: board.value, channel: channel.value, metadataRoot: metadataRoot.value };
 }
+function localWslInstallRequest(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "distribution", "distro", "no-launch", "web-download", "timeout-ms"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${LOCAL_WSL_INSTALL_USAGE}`;
+    }
+    const extra = parsed.command.slice(3);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${LOCAL_WSL_INSTALL_USAGE}`;
+    }
+    const distribution = stringFlag(parsed, "distribution") ?? stringFlag(parsed, "distro");
+    const noLaunch = optionalBooleanFlag(parsed, "no-launch");
+    if (typeof noLaunch === "string")
+        return noLaunch;
+    const webDownload = optionalBooleanFlag(parsed, "web-download");
+    if (typeof webDownload === "string")
+        return webDownload;
+    const timeoutMs = optionalIntegerFlag(parsed, "timeout-ms", 1_000, 3_600_000);
+    if (timeoutMs.error)
+        return timeoutMs.error;
+    return {
+        distribution,
+        noLaunch,
+        webDownload,
+        timeoutMs: timeoutMs.value
+    };
+}
 function localToolchainCurrentRequest(parsed) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "install-root"]);
     if (unknownFlag) {
@@ -4086,7 +5887,7 @@ function localToolchainCurrentRequest(parsed) {
     return { installRoot: installRoot.value };
 }
 function localToolchainInstallRequest(parsed) {
-    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "channel", "metadata-root", "source-url", "source-release-root", "install-root", "force"]);
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "channel", "metadata-root", "source-url", "source-release-root", "install-root", "mode", "force"]);
     if (unknownFlag) {
         return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_INSTALL_USAGE}`;
     }
@@ -4115,6 +5916,9 @@ function localToolchainInstallRequest(parsed) {
     const installRoot = optionalTrimmedStringFlag(parsed, "install-root");
     if (installRoot.error)
         return installRoot.error;
+    const mode = optionalTrimmedStringFlag(parsed, "mode");
+    if (mode.error)
+        return mode.error;
     return {
         boardId: board.value,
         channel: channel.value,
@@ -4122,11 +5926,32 @@ function localToolchainInstallRequest(parsed) {
         sourceUrl: sourceUrl.value,
         sourceReleaseRoot: sourceReleaseRoot.value,
         installRoot: installRoot.value,
+        mode: mode.value,
         force: booleanFlag(parsed, "force")
     };
 }
+function localToolchainUninstallRequest(parsed) {
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "install-root"]);
+    if (unknownFlag) {
+        return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_UNINSTALL_USAGE}`;
+    }
+    const extra = parsed.command.slice(3);
+    if (extra.length > 0) {
+        return `Unexpected argument: ${extra[0]}. ${LOCAL_TOOLCHAIN_UNINSTALL_USAGE}`;
+    }
+    const board = optionalTrimmedStringAliasFlag(parsed, ["board", "board-id"], "board or board-id");
+    if (board.error)
+        return board.error;
+    if (!board.value) {
+        return LOCAL_TOOLCHAIN_UNINSTALL_USAGE;
+    }
+    const installRoot = optionalTrimmedStringFlag(parsed, "install-root");
+    if (installRoot.error)
+        return installRoot.error;
+    return { boardId: board.value, installRoot: installRoot.value };
+}
 function localToolchainValidateRequest(parsed) {
-    const unknownFlag = firstUnknownFlag(parsed, ["json", "release-root"]);
+    const unknownFlag = firstUnknownFlag(parsed, ["json", "board", "board-id", "release-root", "mode"]);
     if (unknownFlag) {
         return `Unknown flag --${unknownFlag}. ${LOCAL_TOOLCHAIN_VALIDATE_USAGE}`;
     }
@@ -4138,7 +5963,15 @@ function localToolchainValidateRequest(parsed) {
     if (releaseRoot.error) {
         return releaseRoot.error;
     }
-    return { releaseRoot: releaseRoot.value };
+    const board = optionalTrimmedStringAliasFlag(parsed, ["board", "board-id"], "board or board-id");
+    if (board.error) {
+        return board.error;
+    }
+    const mode = optionalTrimmedStringFlag(parsed, "mode");
+    if (mode.error) {
+        return mode.error;
+    }
+    return { releaseRoot: releaseRoot.value, mode: mode.value, boardId: board.value };
 }
 function localCompileTaishanPiRequest(parsed, auth) {
     const unknownFlag = firstUnknownFlag(parsed, ["json", "source", "output", "release-root", "account", "account-id"]);
@@ -4223,7 +6056,9 @@ function localToolchainAuthContext(auth, accountId) {
         authenticated: auth.authenticated,
         profile: auth.profile,
         source: auth.source,
-        account_id: accountId
+        account_id: accountId,
+        api_key_id: auth.api_key_id,
+        device_id: auth.device_id
     };
 }
 function usageEventsRequest(parsed) {
@@ -4633,6 +6468,35 @@ function renderPluginList(result) {
         `install="${plugin.install_command}"`
     ].filter(Boolean).join(" ")).join("\n");
 }
+function renderPluginUpdateCheck(result) {
+    const lines = [
+        `release_url=${result.release_url}`,
+        result.latest_version ? `latest_version=${result.latest_version}` : ""
+    ].filter(Boolean);
+    if (result.release_notes.length > 0) {
+        lines.push("release_notes:");
+        for (const note of result.release_notes) {
+            lines.push(`  - ${note}`);
+        }
+    }
+    for (const plugin of result.plugins) {
+        lines.push("");
+        lines.push(`${plugin.display_name} (${plugin.id})`);
+        lines.push(`  installed=${plugin.installed}`);
+        lines.push(`  installed_version=${plugin.installed_version ?? "none"}`);
+        lines.push(`  latest_version=${plugin.latest_version ?? "unknown"}`);
+        lines.push(`  update_available=${plugin.update_available}`);
+        lines.push(`  target=${plugin.target_path}`);
+        lines.push(`  update_command=${plugin.update_command}`);
+        if (plugin.release_file) {
+            lines.push(`  release_file=${plugin.release_file}`);
+        }
+        for (const note of plugin.notes) {
+            lines.push(`  note=${note}`);
+        }
+    }
+    return lines.join("\n");
+}
 function renderPluginInstall(result) {
     const lines = ["Installed plugins:"];
     for (const item of result.installed) {
@@ -4654,6 +6518,15 @@ function renderPluginInstall(result) {
         if (item.mcp_warning) {
             lines.push(`    warning=${item.mcp_warning}`);
         }
+        if (item.marketplace_registered !== undefined) {
+            lines.push(`    codex_marketplace_registered=${item.marketplace_registered}`);
+        }
+        if (item.marketplace_path) {
+            lines.push(`    codex_marketplace=${item.marketplace_path}`);
+        }
+        if (item.marketplace_warning) {
+            lines.push(`    warning=${item.marketplace_warning}`);
+        }
     }
     return lines.join("\n");
 }
@@ -4685,9 +6558,53 @@ function renderAgentRunResult(result) {
     return lines.join("\n");
 }
 function renderAuthStatus(status) {
-    return status.authenticated
-        ? `Authenticated profile=${status.profile}${status.source ? ` source=${status.source}` : ""}`
-        : `Not authenticated profile=${status.profile}`;
+    if (!status.authenticated) {
+        return `Not authenticated profile=${status.profile}`;
+    }
+    return [
+        `Authenticated profile=${status.profile}${status.source ? ` source=${status.source}` : ""}`,
+        status.account_id ? `account=${status.account_id}` : "",
+        status.api_key_id ? `api_key=${status.api_key_id}` : "",
+        status.device_id ? `device=${status.device_id}` : "device=not_registered",
+        status.device_label ? `device_label=${status.device_label}` : "",
+        status.device_integrity ? `device_integrity=${status.device_integrity}` : "",
+        status.device_private_key_configured === false ? "device_private_key=missing" : ""
+    ].filter(Boolean).join("\n");
+}
+function renderAuthDeviceStatus(status) {
+    const lines = [renderAuthStatus(status.local)];
+    if (status.remote) {
+        const activeCount = status.remote.devices.filter((device) => device.status === "active").length;
+        lines.push(`remote_devices=${activeCount}/${status.remote.device_limit}`);
+        const localDevice = status.local.device_id
+            ? status.remote.devices.find((device) => device.device_id === status.local.device_id)
+            : undefined;
+        if (localDevice) {
+            lines.push(`remote_current=${renderAuthDevice(localDevice)}`);
+        }
+    }
+    return lines.join("\n");
+}
+function renderAuthDeviceList(result) {
+    if (result.devices.length === 0) {
+        return `No registered devices. device_limit=${result.device_limit}`;
+    }
+    return [
+        `device_limit=${result.device_limit}`,
+        ...result.devices.map(renderAuthDevice)
+    ].join("\n");
+}
+function renderAuthDevice(device) {
+    return [
+        `${device.device_id} account=${device.account_id}`,
+        device.api_key_id ? `api_key=${device.api_key_id}` : "",
+        `status=${device.status}`,
+        device.label ? `label=${device.label}` : "",
+        device.platform ? `platform=${device.platform}` : "",
+        device.arch ? `arch=${device.arch}` : "",
+        `last_seen_at=${device.last_seen_at}`,
+        device.revoked_at ? `revoked_at=${device.revoked_at}` : ""
+    ].filter(Boolean).join(" ");
 }
 function renderAccount(account) {
     return [
@@ -4737,6 +6654,20 @@ function renderUsageRecord(record) {
         `created_at=${record.created_at}`
     ].filter(Boolean).join(" ");
 }
+function renderMcpToolEvent(event) {
+    return [
+        `${event.event_id} tool=${event.tool_name}`,
+        event.account_id ? `account=${event.account_id}` : "",
+        event.api_key_id ? `api_key=${event.api_key_id}` : "",
+        `client=${event.client}`,
+        `mode=${event.mode}`,
+        `server_model_used=${event.server_model_used}`,
+        `success=${event.success}`,
+        event.request_id ? `request=${event.request_id}` : "",
+        event.duration_ms !== undefined ? `duration_ms=${event.duration_ms}` : "",
+        `created_at=${event.created_at}`
+    ].filter(Boolean).join(" ");
+}
 function renderUsageSummary(summary) {
     const lines = [
         summary.account_id ? `account=${summary.account_id}` : "",
@@ -5048,6 +6979,20 @@ function renderBoardKnowledge(data) {
         `title=${file.title}`
     ].join(" ")).join("\n");
 }
+function renderBoardKnowledgeSearch(data) {
+    const result = data;
+    const matches = Array.isArray(result.matches) ? result.matches : [];
+    if (matches.length === 0) {
+        return "No matching board knowledge snippets.";
+    }
+    return matches.map((match, index) => [
+        `#${index + 1}`,
+        `${match.source}:${match.path}`,
+        `score=${match.score}`,
+        `title=${match.title}`,
+        `excerpt=${match.excerpt.replace(/\s+/g, " ").trim()}`
+    ].join(" ")).join("\n");
+}
 function renderBoardKnowledgeFile(file) {
     return [
         `template=${file.template_id}`,
@@ -5260,6 +7205,194 @@ function renderBuildWorkspaceSourcePatch(result) {
     }
     return lines.join("\n");
 }
+function renderLocalToolchainList(result) {
+    const installedCount = result.environments.filter((environment) => !!environment.installed).length;
+    const availableCount = result.environments.filter((environment) => environment.status === "available").length;
+    const updateCount = result.environments.filter((environment) => environment.status === "update_available").length;
+    const lines = [
+        `Local development environments: ${result.environments.length}`,
+        `installed=${installedCount} available=${availableCount} updates=${updateCount}`,
+        `host=${result.host}`,
+        `channel=${result.channel}`,
+        result.metadata_source === "local_override" ? `metadata_override=${result.metadata_root}` : "metadata=production/built-in",
+        `install_root=${result.install_root}`,
+        `registry=${result.registry_path}`
+    ];
+    for (const environment of result.environments) {
+        lines.push("");
+        lines.push(`${environment.display_name} (${environment.board_id})`);
+        lines.push(`  status=${localToolchainStatusLabel(environment.status)}`);
+        lines.push(`  latest=${environment.latest.version}`);
+        if (environment.installed) {
+            lines.push(`  installed=${environment.installed.version ?? "unknown"} mode=${environment.installed.mode ?? "unknown"}`);
+            if (environment.installed.release_root) {
+                lines.push(`  release_root=${environment.installed.release_root}`);
+            }
+        }
+        lines.push(`  install_modes=${environment.install_modes.join(",")}`);
+        if (environment.execution) {
+            lines.push(`  execution=${environment.execution.kind} supported=${environment.execution.supported}`);
+            if (environment.execution.required_host) {
+                lines.push(`  execution_required_host=${environment.execution.required_host}`);
+            }
+            if (environment.execution.actual_host) {
+                lines.push(`  execution_actual_host=${environment.execution.actual_host}`);
+            }
+            if (environment.execution.reason) {
+                lines.push(`  execution_reason=${environment.execution.reason}`);
+            }
+        }
+        lines.push(`  install_command=${environment.install_command}`);
+        if (environment.status === "update_available") {
+            lines.push(`  update_command=${environment.update_command}`);
+        }
+        if (environment.components?.length) {
+            lines.push(`  component_catalog=${localToolchainComponentSummary(environment.components)}`);
+            if (environment.latest.default_mode) {
+                lines.push(`  default_mode_download=${environment.latest.default_mode}: ${localToolchainComponentSummaryForMode(environment.components, environment.latest.default_mode)}`);
+            }
+            if (environment.installed?.mode && environment.installed.mode !== environment.latest.default_mode) {
+                lines.push(`  installed_mode_components=${environment.installed.mode}: ${localToolchainComponentSummaryForMode(environment.components, environment.installed.mode)}`);
+            }
+            lines.push(`  mode_downloads=${localToolchainModeSummaries(environment.install_modes, environment.components).join("; ")}`);
+            lines.push(`  package_groups=${localToolchainComponentGroups(environment.components).join(", ")}`);
+            lines.push(`  detail_command=embedlabs local toolchain latest --board ${environment.board_id}${result.channel === "stable" ? "" : ` --channel ${result.channel}`}`);
+        }
+        if (environment.notes.length > 0) {
+            for (const note of environment.notes) {
+                lines.push(`  note=${note}`);
+            }
+        }
+    }
+    return lines.join("\n");
+}
+function localToolchainStatusLabel(status) {
+    if (status === "installed")
+        return "installed/已安装";
+    if (status === "available")
+        return "available/可安装";
+    if (status === "update_available")
+        return "update_available/可更新";
+    if (status === "unsupported_host")
+        return "unsupported_host/当前系统暂不支持";
+    return status;
+}
+function renderWindowsWslStatus(result) {
+    const lines = [
+        "Windows WSL2 status",
+        `host=${result.host}`,
+        `applicable=${result.applicable}`,
+        `wsl_available=${result.wsl_available}`,
+        `usable=${result.usable}`,
+        `taishanpi_execution=${result.taishanpi_execution.status} supported=${result.taishanpi_execution.supported}`,
+        `taishanpi_required_host=${result.taishanpi_execution.required_host}`,
+        result.taishanpi_execution.actual_host ? `taishanpi_actual_host=${result.taishanpi_execution.actual_host}` : "",
+        `taishanpi_reason=${result.taishanpi_execution.reason}`,
+        `checked_at=${result.checked_at}`,
+        `status_command=${result.commands.status}`,
+        `list_command=${result.commands.list}`,
+        `list_online_command=${result.commands.list_online}`,
+        `install_command=${result.commands.install_ubuntu}`
+    ].filter(Boolean);
+    if (result.distributions.length > 0) {
+        lines.push("distributions:");
+        for (const distro of result.distributions) {
+            lines.push(`  ${distro.default ? "*" : "-"} ${distro.name} state=${distro.state ?? "unknown"} version=${distro.version ?? "unknown"}`);
+        }
+    }
+    if (result.online_distributions.length > 0) {
+        lines.push("online_distributions:");
+        for (const distro of result.online_distributions) {
+            lines.push(`  ${distro.default ? "*" : "-"} ${distro.name}${distro.friendly_name ? ` (${distro.friendly_name})` : ""}`);
+        }
+    }
+    for (const note of result.notes) {
+        lines.push(`note=${note}`);
+    }
+    return lines.join("\n");
+}
+function renderWindowsWslInstall(result) {
+    const lines = [
+        "Windows WSL2 install",
+        `host=${result.host}`,
+        `command=${result.command.join(" ")}`,
+        `exit_code=${result.exit_code}`,
+        `usable_after=${result.status_after.usable}`
+    ];
+    if (result.stdout_tail.length > 0) {
+        lines.push("stdout_tail:");
+        for (const line of result.stdout_tail) {
+            lines.push(`  ${line}`);
+        }
+    }
+    if (result.stderr_tail.length > 0) {
+        lines.push("stderr_tail:");
+        for (const line of result.stderr_tail) {
+            lines.push(`  ${line}`);
+        }
+    }
+    for (const note of result.notes) {
+        lines.push(`note=${note}`);
+    }
+    return lines.join("\n");
+}
+function localToolchainComponentSummary(components) {
+    const totalBytes = components.reduce((total, component) => total + component.size_bytes, 0);
+    return `${components.length} components, ${formatByteSize(totalBytes)}`;
+}
+function localToolchainComponentSummaryForMode(components, mode) {
+    return localToolchainComponentSummary(localToolchainComponentsForMode(components, mode));
+}
+function localToolchainModeSummaries(modes, components) {
+    return modes.map((mode) => `${mode}=${localToolchainComponentSummaryForMode(components, mode)}`);
+}
+function localToolchainComponentsForMode(components, mode) {
+    return components.filter((component) => {
+        if (!component.install_modes?.length) {
+            return true;
+        }
+        return component.install_modes.includes(mode);
+    });
+}
+function localToolchainComponentGroups(components) {
+    const groups = new Set();
+    for (const component of components) {
+        const text = `${component.id} ${component.role ?? ""}`.toLowerCase();
+        if (text.includes("arm-none-eabi") || text.includes("bare-metal") || text.includes("compiler"))
+            groups.add("compiler/ARM 裸机编译器");
+        if (text.includes("pico-sdk") || text.includes("sdk-core"))
+            groups.add("pico-sdk/C/C++ SDK");
+        if (text.includes("sysroot") || text.includes("cross"))
+            groups.add("sysroot/交叉运行库");
+        if (text.includes("qt"))
+            groups.add("qt/Qt 应用支持");
+        if (text.includes("rockchip") || text.includes("boot") || text.includes("resource"))
+            groups.add("boot-flash/启动与烧写工具");
+        if (text.includes("image") || text.includes("rootfs"))
+            groups.add("images/镜像资源");
+        if (text.includes("initial-firmware"))
+            groups.add("initial-firmware/初始化镜像");
+        if (text.includes("rp2350-monitor"))
+            groups.add("rp2350-monitor/可选硬件监控镜像");
+        if (text.includes("meta"))
+            groups.add("metadata/知识与脚本元数据");
+    }
+    return groups.size > 0 ? [...groups] : ["runtime/运行时工具"];
+}
+function formatByteSize(bytes) {
+    if (!Number.isFinite(bytes) || bytes < 0) {
+        return "unknown size";
+    }
+    const units = ["B", "KB", "MB", "GB", "TB"];
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    const fixed = unit === 0 || value >= 10 ? value.toFixed(0) : value.toFixed(1);
+    return `${fixed} ${units[unit]}`;
+}
 function renderLocalToolchainLatest(result) {
     const lines = [
         `board=${result.board_id}`,
@@ -5267,11 +7400,26 @@ function renderLocalToolchainLatest(result) {
         `version=${result.version}`,
         `host=${result.host}`,
         result.metadata_root ? `metadata_root=${result.metadata_root}` : "metadata=built-in",
-        result.download ? `download=${result.download.mirror_kind}:${result.download.source_url}` : "",
-        result.download ? `archive_sha256=${result.download.archive.sha256}` : "",
-        result.download ? `archive_size_bytes=${result.download.archive.size_bytes}` : "",
+        result.download?.source_url ? `download=${result.download.mirror_kind}:${result.download.source_url}` : "",
+        result.download?.archive ? `archive_sha256=${result.download.archive.sha256}` : "",
+        result.download?.archive ? `archive_size_bytes=${result.download.archive.size_bytes}` : "",
+        result.download?.components?.length ? `components=${result.download.components.length}` : "",
+        result.download?.default_mode ? `default_mode=${result.download.default_mode}` : "",
         result.download_error ? `download_error=${result.download_error}` : ""
     ].filter(Boolean);
+    if (result.download?.components?.length) {
+        const modes = [...new Set(result.download.components.flatMap((component) => component.install_modes ?? ["all"]))].filter((mode) => mode !== "all");
+        if (result.download.default_mode) {
+            lines.push(`default_mode_download=${result.download.default_mode}: ${localToolchainDownloadComponentSummaryForMode(result.download.components, result.download.default_mode)}`);
+        }
+        if (modes.length > 0) {
+            lines.push(`mode_downloads=${modes.map((mode) => `${mode}=${localToolchainDownloadComponentSummaryForMode(result.download?.components ?? [], mode)}`).join("; ")}`);
+        }
+        lines.push("download_components:");
+        for (const component of result.download.components) {
+            lines.push(`  ${component.id}@${component.version} modes=${component.install_modes?.join(",") || "all"} size=${formatByteSize(component.archive.size_bytes)} file=${component.archive.file}`);
+        }
+    }
     if (result.packages.length > 0) {
         lines.push("packages:");
         for (const pkg of result.packages) {
@@ -5280,6 +7428,11 @@ function renderLocalToolchainLatest(result) {
     }
     return lines.join("\n");
 }
+function localToolchainDownloadComponentSummaryForMode(components, mode) {
+    const selected = localToolchainComponentsForMode(components ?? [], mode);
+    const totalBytes = selected.reduce((total, component) => total + component.archive.size_bytes, 0);
+    return `${selected.length} components, ${formatByteSize(totalBytes)}`;
+}
 function renderLocalToolchainCurrent(result) {
     if (!result.installed) {
         return [
@@ -5294,6 +7447,7 @@ function renderLocalToolchainCurrent(result) {
         `board=${result.board_id}`,
         result.version ? `version=${result.version}` : "",
         result.channel ? `channel=${result.channel}` : "",
+        result.mode ? `mode=${result.mode}` : "",
         result.release_root ? `release_root=${result.release_root}` : "",
         `install_root=${result.install_root}`,
         `registry=${result.registry_path}`
@@ -5306,13 +7460,21 @@ function renderLocalToolchainInstall(result) {
         `version=${result.version}`,
         `channel=${result.channel}`,
         `host=${result.host}`,
+        `mode=${result.mode}`,
         `install_root=${result.install_root}`,
         `release_root=${result.release_root}`,
         `registry=${result.registry_path}`,
         `source=${result.source.kind}:${result.source.value}`,
         result.source.downloaded_path ? `downloaded=${result.source.downloaded_path}` : "",
+        result.source.components?.length ? `components=${result.source.components.length}` : "",
         `validation=${result.validation.ok ? "ok" : "failed"}`
     ].filter(Boolean);
+    if (result.source.components?.length) {
+        lines.push("installed_components:");
+        for (const component of result.source.components) {
+            lines.push(`  ${component.id}@${component.version} ${component.mirror_kind || ""} bytes=${component.size_bytes}`);
+        }
+    }
     if (result.installed_paths.length > 0) {
         lines.push("installed_paths:");
         for (const installedPath of result.installed_paths) {
@@ -5327,16 +7489,50 @@ function renderLocalToolchainInstall(result) {
     }
     return lines.join("\n");
 }
+function renderLocalToolchainUninstall(result) {
+    const lines = [
+        result.removed ? "Local toolchain uninstalled." : "Local toolchain was not installed.",
+        `board=${result.board_id}`,
+        `install_root=${result.install_root}`,
+        `registry=${result.registry_path}`,
+        `removed_registry_entry=${result.removed_registry_entry}`,
+        `observed_at=${result.observed_at}`
+    ];
+    if (result.removed_paths.length > 0) {
+        lines.push("removed_paths:");
+        for (const removedPath of result.removed_paths) {
+            lines.push(`  ${removedPath}`);
+        }
+    }
+    if (result.remaining_installed_boards.length > 0) {
+        lines.push(`remaining_installed_boards=${result.remaining_installed_boards.join(",")}`);
+    }
+    return lines.join("\n");
+}
 function renderLocalToolchainValidation(result) {
     const lines = [
         result.ok ? "Local toolchain ready." : "Local toolchain not ready.",
         `board=${result.board_id}`,
+        `mode=${result.mode}`,
         `host=${result.host.platform}/${result.host.arch}`,
-        `release_root=${result.release_root}`
+        `release_root=${result.release_root}`,
+        `summary=${result.summary_for_user}`
     ];
+    if (!result.ok && result.missing_groups.length > 0) {
+        lines.push(`missing_groups=${result.missing_groups.join(", ")}`);
+    }
+    if (result.repair_command) {
+        lines.push(`repair_command=${result.repair_command}`);
+    }
     for (const check of result.checked_paths) {
         lines.push(`${check.exists ? "ok" : "missing"} ${check.label}: ${check.path}`);
     }
+    if (result.path_leaks.length > 0) {
+        lines.push("path_leaks:");
+        for (const leak of result.path_leaks) {
+            lines.push(`  ${leak.label}: ${leak.path} contains ${leak.forbidden}`);
+        }
+    }
     if (result.notes.length > 0) {
         lines.push("notes:");
         for (const note of result.notes) {
@@ -5785,6 +7981,22 @@ function stringFlag(parsed, name) {
 function booleanFlag(parsed, name) {
     return parsed.flags[name] === true;
 }
+function optionalBooleanFlag(parsed, name) {
+    const values = flagValues(parsed, name);
+    if (values.length === 0)
+        return undefined;
+    const value = values[values.length - 1];
+    if (value === true)
+        return true;
+    if (typeof value !== "string")
+        return `--${name} must be true or false.`;
+    const normalized = value.trim().toLowerCase();
+    if (["1", "true", "yes", "y", "on"].includes(normalized))
+        return true;
+    if (["0", "false", "no", "n", "off"].includes(normalized))
+        return false;
+    return `--${name} must be true or false.`;
+}
 function switchFlag(parsed, name) {
     const values = flagValues(parsed, name);
     for (const value of values) {
@@ -5948,6 +8160,24 @@ function optionalPositiveIntegerFlag(parsed, name) {
     }
     return { value };
 }
+function optionalIntegerFlag(parsed, name, min, max) {
+    const values = flagValues(parsed, name);
+    if (values.length === 0) {
+        return {};
+    }
+    if (values.some((value) => typeof value !== "string")) {
+        return { error: `--${name} requires a value.` };
+    }
+    const raw = values[values.length - 1].trim();
+    if (!/^-?\d+$/.test(raw)) {
+        return { error: `--${name} must be an integer.` };
+    }
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < min || value > max) {
+        return { error: `--${name} must be an integer from ${min} through ${max}.` };
+    }
+    return { value };
+}
 function jsonObjectListFlag(parsed, name) {
     const objects = [];
     for (const raw of flagValues(parsed, name)) {
@@ -6065,12 +8295,17 @@ async function waitForever() {
     });
     return 0;
 }
+function quotaAndBillingDisabled() {
+    return fail("quota_not_supported", "当前 Embed Labs 服务器只提供 MCP 服务，不提供额度、充值、余额、账本、存储配额或用量计费功能。", {
+        remediation: "请使用 auth、plugin、board、local toolchain、mcp start、device 和 Local Bridge 相关命令。"
+    });
+}
 function printHelp() {
     printCliHelp(`embed CLI
 
 Usage:
   embed <command> [options]
-  embed query "查一下我的额度"
+  embed query "当前支持哪些开发板"
   embed help getting-started
   embed help commands
 
@@ -6080,68 +8315,57 @@ Main workflow:
   2. Sign in with a token:
      embed auth login --token <token>
      # or set EMBED_API_TOKEN / create an account API key for automation.
-  3. Inspect server model routing:
+  3. Install or update local AI client plugins:
      embed plugin install codex
      embed plugin install opencode
-     embed service modes
-     embed model list
-     embed model default
+     embed plugin update check
   4. Run a natural-language local tool loop:
      embed agent run --prompt "验证开发板状态"
   5. Validate or use the local TaishanPi toolchain:
+     embed local toolchain list
+     embed local toolchain installed
      embed local toolchain latest
      embed local toolchain install
+     embed local toolchain uninstall --board pico2w-rp2350-monitor
      embed local toolchain validate
      embed local compile taishanpi --source ./main.c --output ./.embed-labs/build/main
      embed local build qt-smoke --build-dir ./.embed-labs/build/qt-smoke
-  6. Pick a cloud build template:
+     embed local build qt-smoke --source ./taishanpi-app --target-name app --build-dir ./.embed-labs/build/app
+  6. Query board knowledge and method metadata:
      embed board registry list
      embed board methods taishanpi-1m-rk3566
      embed board knowledge taishanpi-1m-rk3566
+     embed board knowledge search taishanpi-1m-rk3566 --query "UART pinout"
      embed build template list
      embed build template show <template_id>
-  7. Provision and populate a build workspace:
-     embed build workspace provision --account <account_id> --project <project_id> --template <template_id>
-     embed build resource lease create --workspace <workspace_id> --execution-mode cloud_worker
-     embed build workspace source put <workspace_id> --file ./main.c:src/main.c
-     embed build workspace source list <workspace_id>
-     embed build workspace source get <workspace_id> --path src/main.c --output ./main.c
-     embed build workspace source search <workspace_id> --query init --glob "**/*.c"
-     embed build workspace source patch <workspace_id> --patch ./fix.patch
-     embed build workspace release <workspace_id> --dry-run
-  8. Generate application source on the server and follow artifacts:
-     embed build application generate --workspace <workspace_id> --prompt "Create a minimal Linux app" --provider bai --model gpt-5.2
-     embed build application compile --workspace <workspace_id> --source app/generated.c --execution-mode docker_worker
-     embed build image generate --workspace <workspace_id> --prompt "Generate a minimal TaishanPi image"
+  7. Generate small image packages and compose locally:
      embed build image boot-logo --logo ./logo.png --board taishanpi --variant 1M-RK3566 --output ./boot-logo-package.json
      embed image boot-logo compose --package ./boot-logo-package.json --base-image ./boot.img --output ./boot-logo.img
      embed cloud task artifacts <task_id>
      embed artifact download <artifact_id> --output ./artifact.bin
-  9. Check credits or create a recharge QR:
-     embed billing balance --account <account_id>
-     embed billing tokens --account <account_id>
-     embed billing ledger --account <account_id>
-     embed billing storage --account <account_id>
-     embed billing storage settle --account <account_id> --dry-run
-     embed billing recharge create --account <account_id> --amount-usd 10 --provider onchain --qr
-
 Local hardware:
   embed bridge start
+  embed mcp start
   embed agent run --prompt "验证开发板状态"
   embed agent run --prompt "部署泰山派应用" --host 198.19.77.2 --artifact ./artifact.bin --remote-path /userdata/embed-labs/apps/app --approve --run
   embed agent run --prompt "部署生成的泰山派应用" --host 198.19.77.2 --artifact-task <task_id> --remote-path /userdata/embed-labs/apps/app --approve --run
   embed tool list
-  embed tool call device.probe --input-json '{"host":"198.19.77.2","ports":[22,15301]}'
+  embed tool call device.probe --input-json '{"host":"198.19.77.2","ports":[22]}'
   embed tool call wifi.scan --input-json '{"host":"198.19.77.2","user":"root"}'
+  embed tool call rp2350.monitor.spi.transfer --input-json '{"hex":"a55a3cc3"}' --approve
   embed tool call chip.temperature --input-json '{"host":"198.19.77.2","user":"root"}'
   embed tool call qml.runtime.status --input-json '{"host":"198.19.77.2","user":"root","port":18130}'
   embed device list
+  embed local toolchain list
+  embed local toolchain installed
   embed local toolchain latest
   embed local toolchain current
   embed local toolchain install
+  embed local toolchain uninstall --board pico2w-rp2350-monitor
   embed local toolchain validate
   embed local compile taishanpi --source ./main.c --output ./.embed-labs/build/main
   embed local build qt-smoke --build-dir ./.embed-labs/build/qt-smoke
+  embed local build qt-smoke --source ./taishanpi-app --target-name app --build-dir ./.embed-labs/build/app
   embed image boot-logo compose --package ./boot-logo-package.json --base-image ./boot.img --output ./boot-logo.img
   embed deploy taishanpi --host 198.19.77.2 --artifact ./artifact.bin --approve --run
   embed flash plan --board <rp2350|taishanpi>
@@ -6152,16 +8376,14 @@ Help:
 
 Environment:
   EMBED_BRIDGE_URL=http://127.0.0.1:18083
-  EMBED_CLOUD_API_URL=http://127.0.0.1:18100
+  EMBED_CLOUD_API_URL=https://api.embedboard.com
   EMBED_API_TOKEN=<token>
   CODEX_HOME=~/.codex
 
 Natural language:
-  embed query "查一下我的额度"
-  embed query "用 USDC 链上充值 100 美元"
-  embed query "看一下 token 用量"
-  embed query "看一下磁盘空间"
-  embed query "结算磁盘空间扣费"
+  embed query "当前支持哪些开发板"
+  embed query "验证开发板状态"
+  embed query "安装泰山派本地开发环境"
 `);
 }
 function printHelpTopic(topic) {
@@ -6207,20 +8429,21 @@ Install local AI client plugins explicitly:
   embed plugin list
   embed plugin install codex
   embed plugin install opencode
+  embed plugin update check
+  embed plugin update all
 
-Cloud build path:
+Local MCP service path:
 
-  embed service modes
-  embed model list
-  embed model default
   embed agent run --prompt "验证开发板状态"
   embed local toolchain validate
   embed local compile taishanpi --source ./main.c --output ./.embed-labs/build/main
   embed local build qt-smoke --build-dir ./.embed-labs/build/qt-smoke
+  embed local build qt-smoke --source ./taishanpi-app --target-name app --build-dir ./.embed-labs/build/app
   embed board registry list
   embed board registry show taishanpi-1m-rk3566
   embed board methods taishanpi-1m-rk3566
   embed board knowledge taishanpi-1m-rk3566
+  embed board knowledge search taishanpi-1m-rk3566 --query "UART pinout"
   embed build template list
   embed build template show <template_id>
   embed build workspace provision --account <account_id> --project <project_id> --template <template_id>
@@ -6231,9 +8454,6 @@ Cloud build path:
   embed build workspace source search <workspace_id> --query init --glob "**/*.c"
   embed build workspace source patch <workspace_id> --patch ./fix.patch
   embed build workspace release <workspace_id> --dry-run
-  embed build application generate --workspace <workspace_id> --prompt "Create a minimal Linux app" --provider bai --model gpt-5.2
-  embed build application compile --workspace <workspace_id> --source app/generated.c --execution-mode docker_worker
-  embed build image generate --workspace <workspace_id> --prompt "Generate a minimal TaishanPi image"
   embed build image boot-logo --logo ./logo.png --board taishanpi --variant 1M-RK3566 --output ./boot-logo-package.json
   embed image boot-logo compose --package ./boot-logo-package.json --base-image ./boot.img --output ./boot-logo.img
   embed cloud task status <task_id>
@@ -6242,29 +8462,18 @@ Cloud build path:
 
 Natural language shortcuts:
 
-  embed query "查一下我的额度"
-  embed query "用 USDC 链上充值 100 美元"
-  embed query "看一下 token 用量"
-  embed query "看一下磁盘空间"
-
-Billing path:
-
-  embed billing balance --account <account_id>
-  embed billing tokens --account <account_id>
-  embed billing ledger --account <account_id>
-  embed billing storage --account <account_id>
-  embed billing storage settle --account <account_id> --dry-run
-  embed billing recharge create --account <account_id> --amount-usd 10 --provider onchain --qr
-  embed billing recharge submit-tx <recharge_session_id> --tx-hash <hash>
-  embed billing recharge list --account <account_id>
+  embed query "当前支持哪些开发板"
+  embed query "验证开发板状态"
+  embed query "安装泰山派本地开发环境"
 
 Local hardware path:
 
   embed bridge start
+  embed mcp start
   embed run "验证开发板状态"
   embed tool list
   embed tool call debug.tools.scan
-  embed tool call device.probe --input-json '{"host":"198.19.77.2","ports":[22,15301]}'
+  embed tool call device.probe --input-json '{"host":"198.19.77.2","ports":[22]}'
   embed device list
   embed deploy taishanpi --host 198.19.77.2 --artifact ./artifact.bin --approve --run
   embed flash plan --board <rp2350|taishanpi> --artifact ./artifact.bin
@@ -6280,11 +8489,14 @@ Usage:
   embed query <natural language request> [--account <account_id>] [--qr] [--json]
   embed bridge start [--host 127.0.0.1] [--port 18083]
   embed bridge status [--json]
+  embed mcp start [--bridge-path <path>]
   embed auth login --token <token> [--profile default] [--json]
   embed auth status [--json]
   embed auth logout [--json]
   embed plugin list [--release-dir <dir>] [--release-url <url>] [--json]
   embed plugin install <codex|opencode|all> [--release-dir <dir>] [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--force] [--json]
+  embed plugin update check [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]
+  embed plugin update <codex|opencode|all> [--release-url <url>] [--target <dir>] [--codex-target <dir>] [--opencode-target <dir>] [--json]
   embed service modes [--json]
   embed model list [--json]
   embed model default [--json]
@@ -6292,6 +8504,7 @@ Usage:
   embed board registry show <template_id> [--json]
   embed board methods <template_id> [--json]
   embed board knowledge <template_id> [--json]
+  embed board knowledge search <template_id> --query <text> [--source board_pack|build_template|registry] [--limit 5] [--json]
   embed board knowledge file <template_id> --source board_pack|build_template|registry --path <relative_path> [--output <local_path>] [--json]
   embed agent run --prompt <request> [--account <account_id>] [--workspace <workspace_id>] [--provider stub|openai|bai|cc|claude-code] [--model <model>] [--max-tool-calls 6] [--host <ip>] [--ports 22,15301] [--artifact <local_file>|--artifact-id <artifact_id>|--artifact-task <task_id>] [--artifact-output <path>] [--remote-path <path>] [--run] [--approve] [--json]
   embed run <natural language request> [--provider stub|openai|bai|cc|claude-code] [--approve] [--json]
@@ -6302,23 +8515,6 @@ Usage:
   embed account keys create --account <account_id> [--name <name>] [--json]
   embed account keys list --account <account_id> [--json]
   embed account keys revoke <api_key_id> [--json]
-  embed usage record [--api-key <key>|--api-key-id <api_key_id>] --model <model> --input-tokens <n> --output-tokens <n> [--provider <name>] [--operation <name>] [--task <task_id>] [--request-id <id>] [--json]
-  embed usage summary --account <account_id>|--api-key-id <api_key_id> [--from <iso>] [--to <iso>] [--json]
-  embed usage events --account <account_id> [--api-key-id <api_key_id>] [--from <iso>] [--to <iso>] [--limit 100] [--json]
-  embed billing statement --account <account_id> [--from <iso>] [--to <iso>] [--json]
-  embed billing balance --account <account_id> [--json]
-  embed billing tokens --account <account_id> [--json]
-  embed billing ledger --account <account_id> [--json]
-  embed billing storage --account <account_id> [--json]
-  embed billing storage settle --account <account_id> [--dry-run] [--json]
-  embed billing recharge create --account <account_id> --amount-usd <amount> [--provider mock|stripe|onchain] [--chain <chain>] [--token <symbol>] [--success-url <url>] [--cancel-url <url>] [--qr] [--json]
-  embed billing recharge list --account <account_id> [--json]
-  embed billing recharge show <recharge_session_id> [--json]
-  embed billing recharge submit-tx <recharge_session_id> --tx-hash <hash> [--json]
-  embed billing recharge confirm <recharge_session_id> [--json]
-  embed billing snapshot create --account <account_id> [--from <iso>] [--to <iso>] [--json]
-  embed billing snapshot list --account <account_id> [--json]
-  embed billing snapshot show <billing_snapshot_id> [--json]
   embed service modes [--json]
   embed build template list [--json]
   embed build template show <template_id> [--json]
@@ -6340,13 +8536,16 @@ Usage:
   embed build image generate --workspace <workspace_id> --prompt <request> [--account <account_id>] [--image-profile <profile_id>] [--provider stub|openai|bai|cc|claude-code] [--model <model>] [--execution-mode cloud_worker|dry_run] [--worker-pool <pool>] [--json]
   embed build image boot-logo --logo <local_image> [--account <account_id>] [--project <project_id>] [--board taishanpi] [--variant 1M-RK3566] [--kernel-logo <local_image>] [--rotate -90] [--scale 100] [--output <package.json>] [--json]
   embed image boot-logo compose --package <boot-logo-package.json> --base-image <boot.img|image.img> --output <image> [--manifest <manifest.json>] [--force] [--json]
-  embed local toolchain latest [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--json]
+  embed local toolchain list [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--install-root <path>] [--json]
+  embed local toolchain installed [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--install-root <path>] [--json]
+  embed local toolchain latest [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--json]
   embed local toolchain current [--install-root <path>] [--json]
-  embed local toolchain install [--board taishanpi-1m-rk3566] [--channel stable] [--metadata-root <path>] [--source-url <tar.gz-url>|--source-release-root <path>] [--install-root <path>] [--force] [--json]
+  embed local toolchain install [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--channel stable] [--metadata-root <path>] [--source-url <tar.gz-url>|--source-release-root <path>] [--install-root <path>] [--mode minimal|runtime|compile|qt|firmware|full|images] [--force] [--json]
       Defaults to the production download channel at download.embedboard.com.
-  embed local toolchain validate [--release-root <path>] [--json]
+  embed local toolchain uninstall --board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor [--install-root <path>] [--json]
+  embed local toolchain validate [--board taishanpi-1m-rk3566|pico2w-rp2350-monitor|coloreasypico2-rp2350-monitor] [--release-root <path>] [--mode minimal|runtime|compile|qt|firmware|full|images] [--json]
   embed local compile taishanpi --source <main.c|main.cpp> --output <artifact> [--release-root <path>] [--account <account_id>] [--json]
-  embed local build qt-smoke --build-dir <dir> [--source <qt-smoke-dir>] [--release-root <path>] [--account <account_id>] [--json]
+  embed local build qt-smoke --build-dir <dir> [--source <qt-cmake-dir>] [--target-name <executable>] [--release-root <path>] [--account <account_id>] [--json]
   embed debug tools [--json]
   embed tool list [--json]
   embed tool call wifi.scan --input-json '{"host":"198.19.77.2","user":"root"}' [--json]
@@ -6355,6 +8554,18 @@ Usage:
   embed tool call chip.temperature --input-json '{"host":"198.19.77.2","user":"root"}' [--json]
   embed tool call qml.runtime.status --input-json '{"host":"198.19.77.2","user":"root","port":18130}' [--json]
   embed tool call qml.runtime.start --input-json '{"host":"198.19.77.2","user":"root","port":18130}' [--json]
+  embed tool call rp2350.monitor.capabilities [--json]
+  embed tool call rp2350.monitor.status [--json]
+  embed tool call rp2350.monitor.gpio.read --input-json '{"pins":[16,17]}' --approve [--json]
+  embed tool call rp2350.monitor.gpio.write --input-json '{"pin":16,"level":true}' --approve [--json]
+  embed tool call rp2350.monitor.uart.write --input-json '{"baud":115200,"text":"hello","line_ending":"lf"}' --approve [--json]
+  embed tool call rp2350.monitor.i2c.transfer --input-json '{"address":"0x50","write":"00","read_len":4}' --approve [--json]
+  embed tool call rp2350.monitor.spi.transfer --input-json '{"hex":"a55a3cc3"}' --approve [--json]
+  embed tool call rp2350.monitor.logic.capture --input-json '{"pin_base":16,"pin_count":4,"sample_rate":1000000,"samples":4096}' --approve [--json]
+  embed tool call rp2350.monitor.logic.decode --input-json '{"input_path":".embed-labs/rp2350-monitor/captures/logic.jsonl","decoder":"summary"}' [--json]
+  embed tool call rp2350.monitor.wifi.manage --input-json '{"action":"scan"}' --approve [--json]
+  embed tool call rp2350.monitor.probe.debug --input-json '{"action":"status"}' --approve [--json]
+  embed tool call rp2350.monitor.operation --input-json '{"action":"logic.stop","params":{}}' --approve [--json]
   embed deploy taishanpi --host <ip> --artifact <local_file> --approve [--remote-path /userdata/embed-labs/apps/app] [--run] [--json]
   embed board deploy taishanpi --host <ip> --artifact <local_file> --approve [--remote-path /userdata/embed-labs/apps/app] [--run] [--json]
   embed device list [--json]
@@ -6388,7 +8599,7 @@ Usage:
 
 Environment:
   EMBED_BRIDGE_URL=http://127.0.0.1:18083
-  EMBED_CLOUD_API_URL=http://127.0.0.1:18100
+  EMBED_CLOUD_API_URL=https://api.embedboard.com
   EMBED_API_TOKEN=<token>
   CODEX_HOME=~/.codex
 `);