@lobehub/cli 0.0.54 → 0.0.55

package/dist/index.js

@@ -14,7 +14,7 @@ import { finished, pipeline } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark, pipeline as pipeline$1 } from "node:stream";
 import readline, { createInterface } from "node:readline";
 import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events";
-import fs$1, { access, mkdir, open, readFile, readdir, realpath, rename, rm, stat, unlink as unlink$1, writeFile } from "node:fs/promises";
+import fs$1, { access, copyFile, mkdir, open, readFile, readdir, realpath, rename, rm, stat, unlink as unlink$1, writeFile } from "node:fs/promises";
 import crypto$1, { X509Certificate, createHash, randomBytes, randomUUID, sign } from "node:crypto";
 import { text } from "node:stream/consumers";
 import crypto$2 from "crypto";
@@ -18857,7 +18857,7 @@ const INTEREST_AREA_KEYS = [
 const interestAreaKeySet = new Set(INTEREST_AREA_KEYS);
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/predicate/isPlainObject.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/predicate/isPlainObject.mjs
 /**
 * Checks if a given value is a plain object.
 *
@@ -18896,13 +18896,13 @@ function isPlainObject$2(object) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/_internal/getSymbols.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/_internal/getSymbols.mjs
 function getSymbols(object) {
 	return Object.getOwnPropertySymbols(object).filter((symbol) => Object.prototype.propertyIsEnumerable.call(object, symbol));
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/_internal/getTag.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/_internal/getTag.mjs
 /**
 * Gets the `toStringTag` of `value`.
 *
@@ -18916,7 +18916,7 @@ function getTag(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/_internal/tags.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/_internal/tags.mjs
 const regexpTag = "[object RegExp]";
 const stringTag = "[object String]";
 const numberTag = "[object Number]";
@@ -18941,13 +18941,13 @@ const float32ArrayTag = "[object Float32Array]";
 const float64ArrayTag = "[object Float64Array]";
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/_internal/globalThis.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/_internal/globalThis.mjs
 const globalThis_ = typeof globalThis === "object" && globalThis || typeof window === "object" && window || typeof self === "object" && self || typeof global === "object" && global || (function() {
 	return this;
 })();
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/predicate/isBuffer.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/predicate/isBuffer.mjs
 /**
 * Checks if the given value is a Buffer instance.
 *
@@ -18971,7 +18971,7 @@ function isBuffer(x) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/predicate/isLength.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/predicate/isLength.mjs
 /**
 * Checks if a given value is a valid length.
 *
@@ -18998,7 +18998,7 @@ function isLength(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/predicate/isArrayLike.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/predicate/isArrayLike.mjs
 /**
 * Checks if `value` is array-like.
 *
@@ -19018,15 +19018,18 @@ function isArrayLike(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/_internal/isUnsafeProperty.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/_internal/isUnsafeProperty.mjs
 /**
-* Checks if a property key is unsafe to modify directly.
+* Checks if a property key is unsafe to access or copy directly.
 *
-* This function is used in functions like `merge` to prevent prototype pollution attacks
-* by identifying property keys that could modify the object's prototype chain or constructor.
+* This function is used in functions like `get`, `unset`, and `merge` to prevent
+* prototype pollution attacks by identifying `__proto__`, which modifies the object's
+* prototype chain. `constructor` and `prototype` stay accessible here because lodash
+* keeps reads of them unrestricted; write paths use `isUnsafeToWriteProperty` instead,
+* which also blocks those keys.
 *
 * @param key - The property key to check
-* @returns `true` if the property is unsafe to modify directly, `false` otherwise
+* @returns `true` if the property is unsafe to access directly, `false` otherwise
 * @internal
 */
 function isUnsafeProperty(key) {
@@ -19034,7 +19037,7 @@ function isUnsafeProperty(key) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/predicate/isPrimitive.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/predicate/isPrimitive.mjs
 /**
 * Checks whether a value is a JavaScript primitive.
 * JavaScript primitives include null, undefined, strings, numbers, booleans, symbols, and bigints.
@@ -19061,7 +19064,7 @@ function isPrimitive(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/predicate/isTypedArray.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/predicate/isTypedArray.mjs
 /**
 * Checks if a value is a TypedArray.
 * @param x The value to check.
@@ -19082,7 +19085,7 @@ function isTypedArray$2(x) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/object/cloneDeepWith.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/object/cloneDeepWith.mjs
 /**
 * Deeply clones the given object.
 *
@@ -19118,7 +19121,9 @@ function isTypedArray$2(x) {
 * // Clone an array with a customizer
 * const arr = [1, 2, 3];
 * const clonedArr = cloneDeepWith(arr, (value) => {
-*   return value + 1; // Increment each value
+*   if (typeof value === 'number') {
+*     return value + 1; // Increment each number
+*   }
 * });
 * console.log(clonedArr); // [2, 3, 4]
 * console.log(clonedArr === arr); // false
@@ -19257,7 +19262,7 @@ function isCloneableObject(object) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/object/cloneDeepWith.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/object/cloneDeepWith.mjs
 /**
 * Creates a deep clone of the given object using a customizer function.
 *
@@ -19288,7 +19293,9 @@ function isCloneableObject(object) {
 * // Clone an array with a customizer
 * const arr = [1, 2, 3];
 * const clonedArr = cloneDeepWith(arr, (value) => {
-*   return value + 1; // Increment each value
+*   if (typeof value === 'number') {
+*     return value + 1; // Increment each number
+*   }
 * });
 * console.log(clonedArr); // [2, 3, 4]
 * console.log(clonedArr === arr); // false
@@ -19325,7 +19332,7 @@ function cloneDeepWith(obj, customizer) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/object/cloneDeep.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/object/cloneDeep.mjs
 /**
 * Creates a deep clone of the given object.
 *
@@ -19343,30 +19350,30 @@ function cloneDeepWith(obj, customizer) {
 * @example
 * // Clone an array
 * const arr = [1, 2, 3];
-* const clonedArr = clone(arr);
+* const clonedArr = cloneDeep(arr);
 * console.log(clonedArr); // [1, 2, 3]
 * console.log(clonedArr === arr); // false
 *
 * @example
 * // Clone an array with nested objects
 * const arr = [1, { a: 1 }, [1, 2, 3]];
-* const clonedArr = clone(arr);
+* const clonedArr = cloneDeep(arr);
 * arr[1].a = 2;
-* console.log(arr); // [2, { a: 2 }, [1, 2, 3]]
+* console.log(arr); // [1, { a: 2 }, [1, 2, 3]]
 * console.log(clonedArr); // [1, { a: 1 }, [1, 2, 3]]
 * console.log(clonedArr === arr); // false
 *
 * @example
 * // Clone an object
 * const obj = { a: 1, b: 'es-toolkit', c: [1, 2, 3] };
-* const clonedObj = clone(obj);
+* const clonedObj = cloneDeep(obj);
 * console.log(clonedObj); // { a: 1, b: 'es-toolkit', c: [1, 2, 3] }
 * console.log(clonedObj === obj); // false
 *
 * @example
 * // Clone an object with nested objects
 * const obj = { a: 1, b: { c: 1 } };
-* const clonedObj = clone(obj);
+* const clonedObj = cloneDeep(obj);
 * obj.b.c = 2;
 * console.log(obj); // { a: 1, b: { c: 2 } }
 * console.log(clonedObj); // { a: 1, b: { c: 1 } }
@@ -19377,7 +19384,7 @@ function cloneDeep(obj) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/predicate/isArguments.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/predicate/isArguments.mjs
 /**
 * Checks if the given value is an arguments object.
 *
@@ -19403,7 +19410,7 @@ function isArguments$1(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/predicate/isObjectLike.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/predicate/isObjectLike.mjs
 /**
 * Checks if the given value is object-like.
 *
@@ -19432,7 +19439,7 @@ function isObjectLike$1(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/predicate/isArrayLikeObject.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/predicate/isArrayLikeObject.mjs
 /**
 * Checks if the given value is a non-primitive, array-like object.
 *
@@ -19450,7 +19457,7 @@ function isArrayLikeObject(value) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/predicate/isTypedArray.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/predicate/isTypedArray.mjs
 /**
 * Checks if a value is a TypedArray.
 * @param x The value to check.
@@ -19471,7 +19478,7 @@ function isTypedArray$1(x) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/object/clone.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/object/clone.mjs
 /**
 * Creates a shallow clone of the given object.
 *
@@ -19530,7 +19537,7 @@ function clone$1(obj) {
 }
 
 //#endregion
-//#region ../../node_modules/.pnpm/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/object/mergeWith.mjs
+//#region ../../node_modules/.pnpm/es-toolkit@1.52.0/node_modules/es-toolkit/dist/compat/object/mergeWith.mjs
 /**
 * Merges the properties of one or more source objects into the target object using a customizer function.
 *
@@ -19594,7 +19601,7 @@ function mergeWithDeep(target, source, merge, stack) {
 	stack.set(source, target);
 	if (Array.isArray(source)) {
 		source = source.slice();
-		for (let i = 0; i < source.length; i++) source[i] = source[i] ?? void 0;
+		for (let i = 0; i < source.length; i++) if (!(i in source)) source[i] = void 0;
 	}
 	const sourceKeys = [...Object.keys(source), ...getSymbols(source)];
 	for (let i = 0; i < sourceKeys.length; i++) {
@@ -19683,7 +19690,7 @@ const MEMORY_SEARCH_TOP_K_LIMITS = {
 
 //#endregion
 //#region ../../package.json
-var version$2 = "2.2.16";
+var version$2 = "2.2.17";
 
 //#endregion
 //#region ../../packages/const/src/version.ts
@@ -20119,29 +20126,24 @@ const _clients = /* @__PURE__ */ new Map();
 const _toolsClients = /* @__PURE__ */ new Map();
 async function getAuthAndServer() {
 	const envJwt = process.env.LOBEHUB_JWT;
-	if (envJwt) {
-		const serverUrl = resolveServerUrl();
-		return {
-			headers: { "Oidc-Auth": envJwt },
-			serverUrl
-		};
-	}
+	if (envJwt) return {
+		headers: () => ({ "Oidc-Auth": process.env.LOBEHUB_JWT || envJwt }),
+		serverUrl: resolveServerUrl()
+	};
 	const envApiKey = readCliApiKeyEnv();
-	if (envApiKey) {
-		const serverUrl = resolveServerUrl();
-		return {
-			headers: { "X-API-Key": envApiKey },
-			serverUrl
-		};
-	}
+	if (envApiKey) return {
+		headers: () => ({ "X-API-Key": envApiKey }),
+		serverUrl: resolveServerUrl()
+	};
 	const result = await getValidToken();
 	if (!result) {
 		log$11.error(`No authentication found. Run '${"lh"} login' (or 'npx -y ${cliPackageName} login') first, or set ${CLI_API_KEY_ENV}.`);
 		process.exit(1);
 	}
 	const serverUrl = resolveServerUrl();
+	const { accessToken } = result.credentials;
 	return {
-		headers: { "Oidc-Auth": result.credentials.accessToken },
+		headers: () => ({ "Oidc-Auth": accessToken }),
 		serverUrl
 	};
 }
@@ -20152,7 +20154,7 @@ async function getTrpcClient(workspaceId) {
 	if (cached) return cached;
 	const { headers, serverUrl } = await getAuthAndServer();
 	const client = createTRPCClient({ links: [httpLink({
-		headers: withWorkspaceHeader(headers, wsId),
+		headers: () => withWorkspaceHeader(headers(), wsId),
 		transformer: SuperJSON,
 		url: `${serverUrl}/trpc/lambda`
 	})] });
@@ -20190,7 +20192,7 @@ async function getToolsTrpcClient(workspaceId) {
 	if (cached) return cached;
 	const { headers, serverUrl } = await getAuthAndServer();
 	const client = createTRPCClient({ links: [httpLink({
-		headers: withWorkspaceHeader(headers, wsId),
+		headers: () => withWorkspaceHeader(headers(), wsId),
 		transformer: SuperJSON,
 		url: `${serverUrl}/trpc/tools`
 	})] });
@@ -21608,6 +21610,80 @@ function registerAgentSpaceFsCommand(agentCommand) {
 	registerFsCommands(agentCommand.command("space").description("Manage agent document space").command("fs").description("Operate on the agent document VFS"));
 }
 
+//#endregion
+//#region ../../packages/utils/src/taskSlug.ts
+/**
+* Human-readable tail of a task detail URL, e.g. `/task/T-501/飞书适配器支持-post-图文消息`.
+*
+* The slug is cosmetic: `taskId` stays the only resolution key, so a stale or
+* hand-edited slug never breaks a link (see `useCanonicalTaskSlug`).
+*/
+/** Long enough to read the task at a glance, short enough to stay pasteable. */
+const TASK_SLUG_MAX_LENGTH = 60;
+/**
+* Ceiling on the code points a slug may carry, independent of how many
+* graphemes that is.
+*
+* Grapheme counting alone is not a size bound: a single cluster accepts an
+* unlimited run of combining marks, so `a` plus 10k accents is one grapheme and
+* a ~20KB path segment — past what browsers and proxies accept in a request
+* line. Titles arrive from imported and generated content, so the bound has to
+* hold for input nobody typed by hand.
+*/
+const TASK_SLUG_MAX_CODE_POINTS = 4 * 60;
+const SEPARATOR_RUN = /^-+|-+$/g;
+/**
+* Everything that isn't a Unicode letter, digit or combining mark collapses
+* into one `-`.
+*
+* `\p{M}` is not decoration: Devanagari matras, Thai vowel signs and Arabic
+* harakat are separate code points that NFKC does not fold into their base
+* letter, so dropping marks shreds those scripts one character at a time
+* (`कार्य पूरा करें` → `क-र-य-प-र-कर`). CJK happened to be unaffected, which is
+* why the original character class read as correct.
+*/
+const NON_SLUG_RUN = /[^\p{L}\p{N}\p{M}]+/gu;
+const trimSeparators = (value) => value.replaceAll(SEPARATOR_RUN, "");
+/**
+* Grapheme segmenter, built once — constructing one per call shows up on list
+* renders that build a link per row. `undefined` locale is deliberate: grapheme
+* boundaries are locale-independent for the scripts this has to protect.
+*/
+const graphemeSegmenter = typeof Intl !== "undefined" && "Segmenter" in Intl ? new Intl.Segmenter(void 0, { granularity: "grapheme" }) : void 0;
+/**
+* Split into user-perceived characters. Falls back to code points where
+* `Intl.Segmenter` is missing (Firefox < 125, older runtimes) — that still
+* keeps surrogate pairs intact, it just can't protect combining marks.
+*/
+const toGraphemes = (value) => graphemeSegmenter ? [...graphemeSegmenter.segment(value)].map((entry) => entry.segment) : [...value];
+/**
+* Build the slug segment for a task title.
+*
+* The output is restricted to Unicode letters, digits, combining marks and `-`,
+* which are all legal in a path segment — so the link needs no percent-encoding
+* and a copied URL stays readable. CJK titles keep their own characters rather
+* than being transliterated: losing them would defeat the point of the slug.
+*
+* Returns `''` for an empty or punctuation-only title, which keeps the URL at
+* its bare `/task/:taskId` form instead of appending a dangling segment.
+*/
+const taskTitleSlug = (title) => {
+	if (!title) return "";
+	const normalized = trimSeparators(title.normalize("NFKC").toLowerCase().replaceAll(NON_SLUG_RUN, "-"));
+	const graphemes = toGraphemes(normalized);
+	const kept = [];
+	let codePoints = 0;
+	for (const grapheme of graphemes) {
+		if (kept.length >= 60) break;
+		const size = [...grapheme].length;
+		if (codePoints + size > TASK_SLUG_MAX_CODE_POINTS) break;
+		kept.push(grapheme);
+		codePoints += size;
+	}
+	if (kept.length === graphemes.length) return normalized;
+	return trimSeparators(kept.join(""));
+};
+
 //#endregion
 //#region src/commands/task/url.ts
 const buildAppUrl = ({ pathname, serverUrl, workspaceSlug }) => {
@@ -25759,6 +25835,10 @@ var init_displayName = __esmMin((() => {}));
 //#region ../../packages/types/src/agent/document.ts
 var init_document$2 = __esmMin((() => {}));
 
+//#endregion
+//#region ../../packages/types/src/agent/executionTargetRules.ts
+var init_executionTargetRules = __esmMin((() => {}));
+
 //#endregion
 //#region ../../packages/types/src/agent/heterogeneousIntervention.ts
 var init_heterogeneousIntervention = __esmMin((() => {}));
@@ -25846,6 +25926,7 @@ var init_agent = __esmMin((() => {
 	init_chatConfig();
 	init_displayName();
 	init_document$2();
+	init_executionTargetRules();
 	init_heteroCliArgs();
 	init_heterogeneousAgent();
 	init_heterogeneousIntervention();
@@ -27073,6 +27154,10 @@ var init_documentComment = __esmMin((() => {}));
 //#region ../../packages/types/src/documentLike.ts
 var init_documentLike = __esmMin((() => {}));
 
+//#endregion
+//#region ../../packages/types/src/environment/index.ts
+var init_environment = __esmMin((() => {}));
+
 //#endregion
 //#region ../../packages/types/src/eval/agentEval.ts
 var init_agentEval = __esmMin((() => {}));
@@ -28044,26 +28129,12 @@ var init_aiModel = __esmMin((() => {
 
 //#endregion
 //#region ../../packages/types/src/topic/topic.ts
-var topicExecutionConfigSchema, topicScheduledRunClaimSchema, topicScheduledRunBaseSchema, resumeAfterRateLimitRunSchema, delayedStartRunSchema, topicScheduledRunSchema, legacyRateLimitRunSchema, chatTopicMetadataUpdateSchema, chatTopicCreateMetadataSchema, TOPIC_STATUSES, chatTopicStatusSchema;
+var topicScheduledRunClaimSchema, topicScheduledRunBaseSchema, resumeAfterRateLimitRunSchema, delayedStartRunSchema, topicScheduledRunSchema, legacyRateLimitRunSchema, chatTopicMetadataUpdateSchema, chatTopicCreateMetadataSchema, TOPIC_STATUSES, chatTopicStatusSchema;
 var init_topic$1 = __esmMin((() => {
 	init_aiModel();
 	init_zod$1();
 	init_agentHook();
 	init_device();
-	topicExecutionConfigSchema = object$2({
-		/** Automatic snapshots retain the workspace default's execution restrictions. */
-		inheritWorkspaceScope: boolean().optional(),
-		boundDeviceId: string().optional(),
-		executionTarget: _enum([
-			"auto",
-			"device",
-			"local",
-			"none",
-			"sandbox"
-		]).optional(),
-		localSandbox: boolean().optional(),
-		localSandboxNetwork: boolean().optional()
-	});
 	topicScheduledRunClaimSchema = object$2({
 		claimedAt: string(),
 		expiresAt: string(),
@@ -28139,7 +28210,6 @@ var init_topic$1 = __esmMin((() => {
 		userMessageId: string()
 	});
 	chatTopicMetadataUpdateSchema = object$2({
-		executionConfig: topicExecutionConfigSchema.optional(),
 		boundDeviceId: string().optional(),
 		heteroEffort: custom$1((value) => typeof value === "string").optional(),
 		heteroSessionBindingKey: string().optional(),
@@ -28219,7 +28289,6 @@ var init_topic$1 = __esmMin((() => {
 		workingDirectoryConfig: workingDirConfigSchema.optional()
 	});
 	chatTopicCreateMetadataSchema = chatTopicMetadataUpdateSchema.pick({
-		executionConfig: true,
 		heteroEffort: true,
 		reasoningConfig: true
 	});
@@ -28390,6 +28459,11 @@ var init_preference = __esmMin((() => {
 		/** Capture a conversation turn as an eval test case (developer-facing). */
 		enableEvalCapture: boolean().optional(),
 		/**
+		* route every agent run in this tab over one shared gateway WebSocket
+		* (protocol v2 mux) instead of one socket per run
+		*/
+		enableGatewayMux: boolean().optional(),
+		/**
 		* enable the per-topic acceptance tray above the composer (author a topic's
 		* delivery checklist inline)
 		*/
@@ -28885,6 +28959,10 @@ var init_acceptanceFlow = __esmMin((() => {
 	});
 }));
 
+//#endregion
+//#region ../../packages/types/src/oauthApp.ts
+var init_oauthApp = __esmMin((() => {}));
+
 //#endregion
 //#region ../../packages/types/src/openai/chat.ts
 var init_chat = __esmMin((() => {}));
@@ -28945,6 +29023,7 @@ var init_src$1 = __esmMin((() => {
 	init_documentComment();
 	init_documentLike();
 	init_entityId();
+	init_environment();
 	init_eval();
 	init_expertise();
 	init_export();
@@ -28989,6 +29068,7 @@ var init_src$1 = __esmMin((() => {
 	init_acceptanceComment();
 	init_acceptanceFlow();
 	init_agentRuntime();
+	init_oauthApp();
 	init_chat();
 	init_plugin();
 	init_subscription();
@@ -37453,7 +37533,7 @@ const isRecord$5 = (value) => isObjectLike(value) && !Array.isArray(value);
 const toRecord = (value) => isRecord$5(value) ? value : void 0;
 
 //#endregion
-//#region ../../node_modules/.pnpm/partial-json@0.1.7/node_modules/partial-json/dist/options.js
+//#region node_modules/.pnpm/partial-json@0.1.7/node_modules/partial-json/dist/options.js
 var require_options = /* @__PURE__ */ __commonJSMin(((exports) => {
 	/**
 	* Sometimes you don't allow every type to be partially parsed.
@@ -37544,7 +37624,7 @@ var require_options = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 
 //#endregion
-//#region ../../node_modules/.pnpm/partial-json@0.1.7/node_modules/partial-json/dist/index.js
+//#region node_modules/.pnpm/partial-json@0.1.7/node_modules/partial-json/dist/index.js
 var require_dist$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
 		if (k2 === void 0) k2 = k;
@@ -38156,6 +38236,7 @@ var init_formatCommandResult = __esmMin((() => {
 		}
 		if (stdout) parts.push(`Stdout:\n${stdout}`);
 		if (stderr) parts.push(`Stderr:\n${stderr}`);
+		if (!(!!stdout || !!stderr || !!outputFiles?.stdout?.path || !!outputFiles?.stderr?.path) && exitCode !== void 0) parts.push("(no output)");
 		return parts.join("\n\n");
 	};
 }));
@@ -38358,6 +38439,11 @@ var init_fileSystem = __esmMin((() => {
 	init_formatWriteResult();
 }));
 
+//#endregion
+//#region ../../packages/utils/src/artifactShare.ts
+const artifactSharePath = (deploymentId) => `/share/artifact/${deploymentId}`;
+const artifactShareUrl = (origin, deploymentId) => `${origin.replace(/\/+$/, "")}${artifactSharePath(deploymentId)}`;
+
 //#endregion
 //#region src/utils/artifactManifest.ts
 const MANIFEST_DIR = ".lobehub";
@@ -38571,13 +38657,17 @@ function registerArtifactCommand(program) {
 		}
 		const result = await deployments.commitWorkspaceHtmlUpload.mutate({ uploadId: prepared.data.uploadId });
 		if (persistsBinding && result.data.id) writeBinding(manifest, { deploymentId: result.data.id });
+		const publicUrl = result.data.id ? artifactShareUrl(resolveServerUrl(), result.data.id) : result.data.publicUrl;
+		const payload = {
+			...result.data,
+			publicUrl
+		};
 		if (options.json !== void 0) {
-			const fields = typeof options.json === "string" ? options.json : void 0;
-			outputJson(result.data, fields);
+			outputJson(payload, typeof options.json === "string" ? options.json : void 0);
 			return;
 		}
 		console.log(`${import_picocolors.default.green("✓")} Published ${import_picocolors.default.bold(title)} (${entries.length} file(s))`);
-		if (result.data.publicUrl) console.log(`  URL: ${import_picocolors.default.dim(result.data.publicUrl)}`);
+		if (publicUrl) console.log(`  URL: ${import_picocolors.default.dim(publicUrl)}`);
 		console.log(`  Deployment: ${import_picocolors.default.dim(result.data.id ?? "")}`);
 	});
 }
@@ -232618,6 +232708,54 @@ const defaultReadExternalAssetForPublish = async ({ path: filePath, workingDirec
 		};
 	}
 };
+const resolvePublishPath = (target, workingDirectory) => {
+	const expanded = expandHomePath(target);
+	return path.isAbsolute(expanded) ? expanded : path.resolve(expandHomePath(workingDirectory), expanded);
+};
+const realpathForCreate = async (target) => {
+	const missing = [];
+	let current = path.resolve(target);
+	for (;;) try {
+		return path.join(await realpath(current), ...missing);
+	} catch {
+		const parent = path.dirname(current);
+		if (parent === current) return path.join(current, ...missing);
+		missing.unshift(path.basename(current));
+		current = parent;
+	}
+};
+const defaultCopyAssetForPublish = async ({ from, to, workingDirectory }) => {
+	try {
+		if (!workingDirectory) return {
+			error: "Missing working directory",
+			success: false
+		};
+		const realRoot = await safeRealpath(expandHomePath(workingDirectory));
+		const target = await realpathForCreate(resolvePublishPath(to, workingDirectory));
+		if (!target.startsWith(`${realRoot}${path.sep}`)) return {
+			error: "Destination is outside the approved workspace",
+			success: false
+		};
+		const realSource = await realpath(resolvePublishPath(from, workingDirectory));
+		const stats = await stat(realSource);
+		if (!stats.isFile()) return {
+			error: "Path is not a file",
+			success: false
+		};
+		if (stats.size > EXTERNAL_PUBLISH_ASSET_MAX_BYTES) return {
+			error: "File is too large to publish",
+			success: false
+		};
+		await mkdir(path.dirname(target), { recursive: true });
+		await copyFile(realSource, target);
+		return { success: true };
+	} catch (error) {
+		return {
+			error: error.message,
+			success: false
+		};
+	}
+};
 
 //#endregion
 //#region ../../packages/device-control/src/projectFileSearchManager.ts
@@ -242201,6 +242339,7 @@ const executeDeviceRpc = async (method, params, deps) => {
 		case "searchProjectFiles": return deps.searchProjectFiles(params);
 		case "getLocalFilePreview": return deps.getLocalFilePreview(params);
 		case "readExternalAssetForPublish": return (deps.readExternalAssetForPublish ?? defaultReadExternalAssetForPublish)(params);
+		case "copyAssetForPublish": return (deps.copyAssetForPublish ?? defaultCopyAssetForPublish)(params);
 		case "moveLocalFiles": return moveLocalFiles(params);
 		case "renameLocalFile": return renameLocalFile(params);
 		case "writeLocalFile": return writeLocalFile(params);
@@ -297195,7 +297334,7 @@ var ComputerRuntime = class {
 			if (!result.success) return this.errorOutput(result, {
 				files: [],
 				totalCount: 0
-			});
+			}, true);
 			const files = result.result?.files || [];
 			const totalCount = result.result?.totalCount;
 			const state = {
@@ -297217,7 +297356,7 @@ var ComputerRuntime = class {
 				success: true
 			};
 		} catch (error) {
-			return this.handleError(error);
+			return this.handleError(error, true);
 		}
 	}
 	async readFile(args) {
@@ -297228,7 +297367,7 @@ var ComputerRuntime = class {
 				endLine: args.endLine,
 				path: args.path,
 				startLine: args.startLine
-			});
+			}, true);
 			const r = result.result || {};
 			if (r.isImage && r.imageUrl) {
 				const filename = r.filename || args.path;
@@ -297272,7 +297411,7 @@ var ComputerRuntime = class {
 				success: true
 			};
 		} catch (error) {
-			return this.handleError(error);
+			return this.handleError(error, true);
 		}
 	}
 	async writeFile(args) {
@@ -297333,7 +297472,7 @@ var ComputerRuntime = class {
 			if (!result.success) return this.errorOutput(result, {
 				results: [],
 				totalCount: 0
-			});
+			}, true);
 			const rawResults = result.result?.results || result.result;
 			const results = Array.isArray(rawResults) ? rawResults : [];
 			const state = {
@@ -297346,7 +297485,7 @@ var ComputerRuntime = class {
 				success: true
 			};
 		} catch (error) {
-			return this.handleError(error);
+			return this.handleError(error, true);
 		}
 	}
 	async moveFiles(args) {
@@ -297475,7 +297614,7 @@ var ComputerRuntime = class {
 					...sessionState,
 					error: result.error?.message,
 					success: false
-				});
+				}, true);
 				return {
 					...output,
 					content: formatSandboxRecreation(output.content, result.sessionExpiredAndRecreated)
@@ -297510,7 +297649,7 @@ var ComputerRuntime = class {
 				success: true
 			};
 		} catch (error) {
-			return this.handleError(error);
+			return this.handleError(error, true);
 		}
 	}
 	async killCommand(args) {
@@ -297547,7 +297686,7 @@ var ComputerRuntime = class {
 				matches: [],
 				pattern: args.pattern,
 				totalMatches: 0
-			});
+			}, true);
 			const r = result.result || {};
 			const matches = r.matches || [];
 			const totalMatches = r.totalMatches ?? r.total_matches ?? 0;
@@ -297565,7 +297704,7 @@ var ComputerRuntime = class {
 				success: true
 			};
 		} catch (error) {
-			return this.handleError(error);
+			return this.handleError(error, true);
 		}
 	}
 	async globFiles(args) {
@@ -297579,7 +297718,7 @@ var ComputerRuntime = class {
 				files: [],
 				pattern: args.pattern,
 				totalCount: 0
-			});
+			}, true);
 			const files = result.result?.files || [];
 			const totalCount = result.result?.totalCount ?? result.result?.total_files ?? files.length;
 			const state = {
@@ -297596,21 +297735,39 @@ var ComputerRuntime = class {
 				success: true
 			};
 		} catch (error) {
-			return this.handleError(error);
+			return this.handleError(error, true);
 		}
 	}
-	handleError(error) {
+	handleError(error, retrySafe = false) {
+		const diagnostics = error && typeof error === "object" ? error : void 0;
+		const errorMessage = error instanceof Error ? error.message : String(error);
 		return {
-			content: error instanceof Error ? error.message : String(error),
-			error,
+			content: errorMessage,
+			error: {
+				code: diagnostics?.code,
+				doc_url: diagnostics?.doc_url,
+				hint: diagnostics?.hint,
+				kind: retrySafe ? void 0 : "stop",
+				message: errorMessage,
+				name: diagnostics?.name,
+				status: diagnostics?.status
+			},
 			success: false
 		};
 	}
-	errorOutput(result, state) {
+	errorOutput(result, state, retrySafe = false) {
 		const errorText = result.error?.message || (result.error !== void 0 ? JSON.stringify(result.error) : void 0) || (typeof state?.stderr === "string" ? state.stderr : void 0) || (typeof state?.error === "string" ? state.error : void 0) || "[UNKNOWN_EXEC_ERROR] Tool execution failed";
 		return {
 			content: errorText,
-			error: { message: errorText },
+			error: {
+				code: result.error?.code,
+				doc_url: result.error?.doc_url,
+				hint: result.error?.hint,
+				kind: retrySafe ? void 0 : "stop",
+				message: errorText,
+				name: result.error?.name,
+				status: result.error?.status
+			},
 			state,
 			success: false
 		};
@@ -510095,14 +510252,28 @@ function printTick(result) {
 	if (result.taskId) console.log(`  ${import_picocolors.default.dim(`task: ${result.taskId}`)}`);
 	if (result.nodeId) console.log(`  ${import_picocolors.default.dim(`node: ${result.nodeId}`)}`);
 }
+/**
+* Whether this process runs with a server-minted operation token (device and
+* gateway runs) rather than the user's own login. Operation tokens are refused
+* on ordinary routes, so commands that act for the running conversation pick
+* the operation-authenticated endpoint instead.
+*/
+const hasOperationToken = () => {
+	const injectedJwt = process.env.LOBEHUB_JWT;
+	if (!injectedJwt) return false;
+	try {
+		return JSON.parse(Buffer.from(injectedJwt.split(".")[1], "base64url").toString()).purpose === "hetero-operation";
+	} catch {
+		return false;
+	}
+};
 function registerGoalCommand$1(program) {
 	const goal = program.command("goal").description("Run long-horizon Goal Graphs");
 	goal.command("plan <id>").description("Atomically submit the current main Agent plan").requiredOption("--file <path>", "JSON plan: action tasks/verify/retry/escalate, reason and action fields").requiredOption("--token <token>", "Current server-issued planning turn token").option("--operation <id>", "Defaults to LOBEHUB_OPERATION_ID").option("--json", "Output JSON").action(async (id, options) => {
 		const operationId = options.operation ?? process.env.LOBEHUB_OPERATION_ID;
 		if (!operationId) throw new Error("Current manager operation ID required");
 		const client = await getTrpcClient();
-		const injectedJwt = process.env.LOBEHUB_JWT;
-		const result = await (injectedJwt && JSON.parse(Buffer.from(injectedJwt.split(".")[1], "base64url").toString()).purpose === "hetero-operation" ? client.goal.submitOperationPlan : client.goal.submitPlan).mutate({
+		const result = await (hasOperationToken() ? client.goal.submitOperationPlan : client.goal.submitPlan).mutate({
 			id,
 			token: options.token,
 			operationId,
@@ -510111,14 +510282,15 @@ function registerGoalCommand$1(program) {
 		if (options.json) outputJson(result.data);
 		else console.log("Plan recorded; the coordinator will continue after this Agent turn exits.");
 	});
-	goal.command("create <title>").option("--max-manager-turns <n>", "Enable CLI manager planning with this turn limit").description("Create a standalone goal and seed its graph").option("-r, --requirement <text>", "Acceptance requirement").option("-i, --instruction <text>", "The ask in the user's own words, shown on the problem node").option("-t, --task <title...>", "Initial task node titles (omit to let the planner decompose)").option("--agent <id>", "Responsible agent ID").option("--project <id>", "Project ID").option("--explore <instruction>", "Explore alternatives using completed experiment results").option("--max-experiments <n>", "Maximum experiment nodes (requires --explore, default 10)").option("--supervise", "Enable bounded recovery supervision in an independent topic").option("--max-supervision-incidents <n>", "Maximum supervised interruptions (default 10, maximum 100)").option("--max-rounds <n>", "Maximum goal rounds").option("--max-cost <usd>", "Maximum total cost in USD").option("--max-attempts-per-task <n>", "Attempts per Task before opening a decision gate").option("--max-concurrent-tasks <n>", "How many of this goal's tasks may run at once (default 3)").option("--max-steps-per-run <n>", "Optional agent step cap per Task run (for example 500)").option("--operation-lease-timeout-ms <n>", "Reclaim a Task operation after this idle time (minimum: 60000)").option("--json [fields]", "Output JSON").action(async (title, options) => {
+	goal.command("create <title>").option("--max-manager-turns <n>", "Add a main Agent with this turn limit; it takes over problems the system planner cannot route").description("Create a standalone goal and seed its graph").option("-r, --requirement <text>", "Acceptance requirement").option("-i, --instruction <text>", "The ask in the user's own words, shown on the problem node").option("-t, --task <title...>", "Initial task node titles (omit to let the planner decompose)").option("--agent <id>", "Goal agent: supervises and plans the goal (defaults to the current agent)").option("--task-agent <id>", "Dedicated executor for the goal's tasks (defaults to the goal agent)").option("--project <id>", "Project ID").option("--explore <instruction>", "Explore alternatives using completed experiment results").option("--max-experiments <n>", "Maximum experiment nodes (requires --explore, default 10)").option("--supervise", "Enable bounded recovery supervision in an independent topic").option("--max-supervision-incidents <n>", "Maximum supervised interruptions (default 10, maximum 100)").option("--max-rounds <n>", "Maximum goal rounds").option("--max-cost <usd>", "Maximum total cost in USD").option("--max-attempts-per-task <n>", "Attempts per Task before opening a decision gate").option("--max-concurrent-tasks <n>", "How many of this goal's tasks may run at once (default 3)").option("--max-steps-per-run <n>", "Optional agent step cap per Task run (for example 500)").option("--operation-lease-timeout-ms <n>", "Reclaim a Task operation after this idle time (minimum: 60000)").option("--conversation", "Create the goal from the current conversation run (/goal): this agent supervises it from this conversation, and the output carries a turnToken for the first plan").option("--criterion <text...>", "Acceptance criterion (repeatable)").option("--json [fields]", "Output JSON").action(async (title, options) => {
 		if (options.maxExperiments && !options.explore) throw new Error("--max-experiments requires --explore");
+		const operationId = process.env.LOBEHUB_OPERATION_ID;
+		if (options.conversation && !operationId) throw new Error("--conversation must run inside an agent conversation (LOBEHUB_OPERATION_ID)");
 		const client = await getTrpcClient();
 		const buildUrl = await resolveAppUrlBuilder(client);
-		const result = await client.goal.create.mutate({
-			agentId: options.agent ?? process.env.LOBEHUB_AGENT_ID,
-			createdByAgentId: process.env.LOBEHUB_AGENT_ID,
-			config: options.maxManagerTurns || options.explore || options.supervise || options.maxAttemptsPerTask || options.maxStepsPerRun || options.operationLeaseTimeoutMs || options.maxConcurrentTasks ? {
+		const goalInput = {
+			config: options.maxManagerTurns || options.explore || options.supervise || options.maxAttemptsPerTask || options.maxStepsPerRun || options.operationLeaseTimeoutMs || options.maxConcurrentTasks || options.taskAgent ? {
+				taskAgentId: options.taskAgent,
 				manager: options.maxManagerTurns ? { maxTurns: Number(options.maxManagerTurns) } : void 0,
 				exploration: options.explore ? {
 					instruction: options.explore,
@@ -510135,6 +510307,7 @@ function registerGoalCommand$1(program) {
 					operationLeaseTimeoutMs: options.operationLeaseTimeoutMs ? Number.parseInt(options.operationLeaseTimeoutMs, 10) : void 0
 				}
 			} : void 0,
+			criteria: options.criterion?.map((criterion) => ({ title: criterion })),
 			maxRounds: options.maxRounds ? Number.parseInt(options.maxRounds, 10) : void 0,
 			maxTotalCost: options.maxCost ? Number.parseFloat(options.maxCost) : void 0,
 			problemDescription: options.instruction,
@@ -510142,14 +510315,30 @@ function registerGoalCommand$1(program) {
 			requirement: options.requirement,
 			title,
 			tasks: options.task
+		};
+		const result = options.conversation ? hasOperationToken() ? await client.goal.createConversationGoal.mutate({
+			...goalInput,
+			operationId
+		}) : await client.goal.create.mutate({
+			...goalInput,
+			agentId: process.env.LOBEHUB_AGENT_ID,
+			conversationOperationId: operationId,
+			conversationTopicId: process.env.LOBEHUB_TOPIC_ID
+		}) : await client.goal.create.mutate({
+			...goalInput,
+			agentId: options.agent ?? process.env.LOBEHUB_AGENT_ID,
+			createdByAgentId: process.env.LOBEHUB_AGENT_ID
 		});
+		const turnToken = "turnToken" in result ? result.turnToken : void 0;
 		const url = buildUrl(`/goal/${encodeURIComponent(result.data.goal.id)}`);
 		if (options.json !== void 0) return outputJson({
 			...result.data,
+			turnToken,
 			url
 		}, options.json);
 		printGraph(result.data);
 		console.log(`${import_picocolors.default.bold("goal")}: ${url}`);
+		if (turnToken) console.log(`${import_picocolors.default.bold("planning turn")}: lh goal plan ${result.data.goal.id} --token ${turnToken} --file <plan.json>`);
 	});
 	goal.command("list").description("List goals with their graph roll-up").option("--agent <id>", "Filter by responsible agent").option("--project <id>", "Filter by project").option("--status <status...>", "Filter by lifecycle status").option("--limit <n>", "Maximum rows", "50").option("--json [fields]", "Output JSON").action(async (options) => {
 		const result = await (await getTrpcClient()).goal.list.query({
@@ -510248,7 +510437,7 @@ function registerGoalCommand$1(program) {
 		});
 		log$11.info(result.message);
 	});
-	goal.command("set-agent <id> <agent>").description("Hand the goal to a different responsible agent (unfinished tasks follow)").option("--goal-only", "Only change the goal-level agent; leave existing tasks as assigned").action(async (id, agentId, options) => {
+	goal.command("set-agent <id> <agent>").description("Hand the goal to a different supervising agent (its unfinished tasks follow unless the goal has a task agent)").option("--goal-only", "Only change the goal-level agent; leave existing tasks as assigned").action(async (id, agentId, options) => {
 		const result = await (await getTrpcClient()).goal.setAgent.mutate({
 			agentId,
 			goalOnly: options.goalOnly,
@@ -510256,7 +510445,15 @@ function registerGoalCommand$1(program) {
 		});
 		log$11.info(result.message);
 	});
-	goal.command("restart <id>").description("Start every unfinished task over (cancel stale runs, reset to backlog)").option("--agent <id>", "Also hand the goal and restarted tasks to this agent").action(async (id, options) => {
+	goal.command("set-task-agent <id> <agent>").description("Route the goal's tasks to a dedicated executor; \"none\" hands them back to the goal agent").option("--goal-only", "Only change future tasks; leave existing tasks as assigned").action(async (id, agent, options) => {
+		const result = await (await getTrpcClient()).goal.setTaskAgent.mutate({
+			agentId: agent === "none" ? null : agent,
+			goalOnly: options.goalOnly,
+			id
+		});
+		log$11.info(result.message);
+	});
+	goal.command("restart <id>").description("Start every unfinished task over (cancel stale runs, reset to backlog)").option("--agent <id>", "Also hand the restarted tasks (and the goal's executor slot) to this agent").action(async (id, options) => {
 		const result = await (await getTrpcClient()).goal.restart.mutate({
 			agentId: options.agent,
 			id
@@ -523402,6 +523599,85 @@ const createOperationHeartbeat = ({ intervalMs = DEFAULT_OPERATION_HEARTBEAT_INT
 	};
 };
 
+//#endregion
+//#region src/utils/OperationTokenRenewal.ts
+/** Renew this long before expiry, so a slow or failed attempt still has room to retry. */
+const RENEW_BEFORE_EXPIRY_MS = 3600 * 1e3;
+const RETRY_DELAY_MS = 60 * 1e3;
+const MIN_DELAY_MS = 30 * 1e3;
+/**
+* The server will never renew after these: the token is gone, out of scope, the
+* run ended, or the server predates the renewal endpoint.
+*/
+const TERMINAL_CODES = new Set([
+	"CONFLICT",
+	"FORBIDDEN",
+	"NOT_FOUND",
+	"UNAUTHORIZED"
+]);
+/** Expiry of a server-minted operation token; undefined for any other credential. */
+const readOperationTokenExpiry = (jwt) => {
+	try {
+		const payload = JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8"));
+		return payload?.purpose === "hetero-operation" && typeof payload.exp === "number" ? payload.exp * 1e3 : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* Keep the operation token of a long `hetero exec` run valid.
+*
+* The server signs it for four hours, and a Goal Task can run far longer. Once
+* it expires every ingest is rejected — heartbeats included — so the lease stops
+* renewing and the server reclaims the operation as abandoned while the agent is
+* still working. Renewing writes the new token back to `LOBEHUB_JWT`, which the
+* tRPC clients read on every request.
+*
+* Only a `hetero-operation` token is renewed. A desktop run authenticates with
+* its own session token, which has its own refresh flow.
+*/
+const createOperationTokenRenewal = ({ operationId, renew }) => {
+	let timer;
+	let stopped = false;
+	const schedule = (delayMs) => {
+		if (stopped) return;
+		timer = setTimeout(() => void attempt(), Math.max(delayMs, MIN_DELAY_MS));
+		timer.unref?.();
+	};
+	const scheduleFromCurrentToken = () => {
+		const jwt = process.env.LOBEHUB_JWT;
+		const expiresAt = jwt ? readOperationTokenExpiry(jwt) : void 0;
+		if (expiresAt === void 0) return false;
+		schedule(expiresAt - RENEW_BEFORE_EXPIRY_MS - Date.now());
+		return true;
+	};
+	const attempt = async () => {
+		try {
+			const { jwt } = await renew(operationId);
+			if (stopped) return;
+			process.env.LOBEHUB_JWT = jwt;
+			scheduleFromCurrentToken();
+		} catch (error) {
+			const code = error?.data?.code;
+			const message = error instanceof Error ? error.message : String(error);
+			if (code && TERMINAL_CODES.has(code)) {
+				log$11.warn(`Operation token can no longer be renewed (${code}): ${message}`);
+				return;
+			}
+			log$11.warn(`Could not renew the operation token, retrying: ${message}`);
+			schedule(RETRY_DELAY_MS);
+		}
+	};
+	return {
+		/** Whether this run holds a token that gets renewed at all. */
+		active: scheduleFromCurrentToken(),
+		stop: () => {
+			stopped = true;
+			clearTimeout(timer);
+		}
+	};
+};
+
 //#endregion
 //#region src/utils/TrpcIngestSink.ts
 /**
@@ -523455,6 +523731,24 @@ var TrpcIngestSink = class {
 //#region src/commands/hetero.ts
 init_resolveCliCommand();
 const SUPPORTED_AGENT_TYPES = new Set(LOCAL_HETEROGENEOUS_AGENT_TYPES);
+/**
+* Extra env for the spawned agent process.
+*
+* In server-ingest mode the run's operation and conversation arrive as CLI
+* arguments, not env, so the agent's own shell could not name them. Commands it
+* runs on behalf of this conversation — `lh goal create --conversation` for
+* `/goal`, evidence ingests — read `LOBEHUB_OPERATION_ID` / `LOBEHUB_TOPIC_ID`,
+* so they are echoed into the child. A standalone run has no server identity
+* and passes none.
+*/
+const buildAgentProcessEnv = ({ operationId, pathEnv, topicId }) => {
+	const env = {
+		...pathEnv ? { PATH: pathEnv } : {},
+		...operationId ? { LOBEHUB_OPERATION_ID: operationId } : {},
+		...topicId ? { LOBEHUB_TOPIC_ID: topicId } : {}
+	};
+	return Object.keys(env).length > 0 ? env : void 0;
+};
 const SUPPORTED_AGENT_TITLES = HETEROGENEOUS_AGENT_CONFIGS.map(({ title }) => title).join(" / ");
 const SUPPORTED_AGENT_COMMANDS = HETEROGENEOUS_AGENT_CONFIGS.map(({ defaultCommand }) => `\`${defaultCommand}\``).join(", ");
 const CODEX_REASONING_EFFORT_CONFIG_KEY = "model_reasoning_effort";
@@ -523725,6 +524019,10 @@ const exec = async (options) => {
 		operationId,
 		push: (event) => serverIngester.push(event)
 	}) : void 0;
+	const operationTokenRenewal = serverIngester && operationId ? createOperationTokenRenewal({
+		operationId,
+		renew: async (id) => (await getTrpcClient()).aiAgent.refreshHeteroOperationToken.mutate({ operationId: id })
+	}) : void 0;
 	const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 	let askServer;
 	let askBridge;
@@ -523974,7 +524272,11 @@ const exec = async (options) => {
 	const interceptResume = !!options.resume;
 	const extraArgs = [...buildExtraArgs(options) ?? [], ...askMcpConfigPath ? ["--mcp-config", askMcpConfigPath] : []];
 	const resolvedCommand = await resolveHeteroSpawnCommand(agentType, options.command);
-	const commandEnv = resolvedCommand.pathEnv ? { PATH: resolvedCommand.pathEnv } : void 0;
+	const commandEnv = buildAgentProcessEnv({
+		operationId: serverIngest ? operationId : void 0,
+		pathEnv: resolvedCommand.pathEnv,
+		topicId: options.topic
+	});
 	const permissionMode = options.type === "devin" ? "bypass" : void 0;
 	const first = await runOneAgent({
 		agentType: options.type,
@@ -524049,6 +524351,7 @@ const exec = async (options) => {
 		finishDeliveryFailed = true;
 		log$11.error("Failed to send heteroFinish:", err instanceof Error ? err.message : String(err));
 	}
+	operationTokenRenewal?.stop();
 	askPollAbort.abort();
 	if (askServer) {
 		askServer.unregisterOperation(operationId);
@@ -526030,7 +526333,8 @@ function registerProjectCommand(program) {
 			parentTaskId: options.parent,
 			projectId
 		});
-		const url = buildUrl(`/task/${encodeURIComponent(result.data.identifier)}`);
+		const slug = taskTitleSlug(result.data.name);
+		const url = buildUrl(`/task/${encodeURIComponent(result.data.identifier)}${slug ? `/${slug}` : ""}`);
 		console.log(`${import_picocolors.default.green("✓")} Created task ${import_picocolors.default.bold(result.data.identifier)}`);
 		console.log(`${import_picocolors.default.bold("task")}: ${url}`);
 	});
@@ -527650,7 +527954,8 @@ function registerTaskCommand(program) {
 		if (options.priority) input.priority = Number.parseInt(options.priority, 10);
 		if (options.prefix) input.identifierPrefix = options.prefix;
 		const result = await client.task.create.mutate(input);
-		const url = buildUrl(`/task/${encodeURIComponent(result.data.identifier)}`);
+		const slug = taskTitleSlug(result.data.name);
+		const url = buildUrl(`/task/${encodeURIComponent(result.data.identifier)}${slug ? `/${slug}` : ""}`);
 		if (options.json !== void 0) {
 			outputJson({
 				...result.data,

package/man/man1/lh.1

@@ -1,6 +1,6 @@
 .\" Code generated by `npm run man:generate`; DO NOT EDIT.
 .\" Manual command details come from the Commander command tree.
-.TH LH 1 "" "@lobehub/cli 0.0.54" "User Commands"
+.TH LH 1 "" "@lobehub/cli 0.0.55" "User Commands"
 .SH NAME
 lh \- LobeHub CLI \- manage and connect to LobeHub services
 .SH SYNOPSIS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/cli",
-  "version": "0.0.54",
+  "version": "0.0.55",
   "type": "module",
   "bin": {
     "lh": "./dist/index.js",
@@ -39,19 +39,19 @@
     "typescript": "^6.0.3",
     "url-join": "^5.0.0",
     "vitest": "5.0.0",
-    "@lobechat/agent-gateway-client": "1.0.0",
-    "@lobechat/agent-tracing": "1.0.0",
     "@lobechat/device-control": "1.0.0",
+    "@lobechat/agent-tracing": "1.0.0",
     "@lobechat/const": "1.0.0",
+    "@lobechat/agent-gateway-client": "1.0.0",
     "@lobechat/device-gateway-client": "1.0.0",
     "@lobechat/device-identity": "1.0.0",
     "@lobechat/eval-rubric": "1.0.0",
     "@lobechat/heterogeneous-agents": "1.0.0",
-    "@lobechat/utils": "1.0.0",
-    "@lobechat/tool-runtime": "1.0.0",
     "@lobechat/html-artifact": "1.0.0",
+    "@lobechat/tool-runtime": "1.0.0",
     "@lobechat/local-file-shell": "1.0.0",
-    "@lobechat/types": "1.0.0"
+    "@lobechat/types": "1.0.0",
+    "@lobechat/utils": "1.0.0"
   },
   "engines": {
     "node": ">=22.15"