@my-life-buddies/cli 0.13.0 → 0.14.1

package/dist/bin/core.js

@@ -16,6 +16,12 @@ function runtimeDependencyVersion(pkg) {
   const version = dependencies2[BUDDY_RUNTIME_PACKAGE];
   return typeof version === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(version) ? version : void 0;
 }
+function runtimeUsesEnvironmentIdentity(pkg) {
+  const version = runtimeDependencyVersion(pkg);
+  if (!version) return false;
+  const [major, minor] = version.split(".").map(Number);
+  return major > 0 || minor >= 16;
+}
 
 // packages/cli-core/src/config/runtime-catalog.ts
 async function loadRuntime(projectRoot) {
@@ -529,7 +535,7 @@ import { lstat as lstat4 } from "node:fs/promises";
 import { join as join5 } from "node:path";
 
 // packages/cli-core/src/init/scaffold.ts
-import { lstat as lstat3, mkdir as mkdir4, open as open2, readFile as readFile6, rmdir as rmdir2, unlink as unlink3 } from "node:fs/promises";
+import { lstat as lstat3, mkdir as mkdir4, open as open2, readFile as readFile6, rmdir as rmdir2, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
 import { resolve as resolve3 } from "node:path";
 
 // packages/cli-core/src/config/models.ts
@@ -766,8 +772,6 @@ process.on("SIGTERM", stop);
 let runtime;
 try {
   runtime = await BuddyServer.start({
-    buddyId: process.env.BUDDY_ID,
-    token: process.env.BUDDY_TOKEN,
     dataRequirements: config.datasets ?? [],
     buddy: createBuddyOptions,
   });
@@ -786,6 +790,32 @@ try {
 }
 `;
 }
+function legacyPlatformStartTemplate() {
+  return platformStartTemplate().replace("    dataRequirements: config.datasets ?? [],", "    buddyId: process.env.BUDDY_ID,\n    token: process.env.BUDDY_TOKEN,\n    dataRequirements: config.datasets ?? [],");
+}
+async function migrateRuntimeStartup(projectRoot) {
+  const packagePath = resolve3(projectRoot, BUDDY_PLATFORM_PACKAGE_JSON);
+  const entryPath = resolve3(projectRoot, BUDDY_PLATFORM_START_ENTRY);
+  for (const path of [packagePath, entryPath]) {
+    if (!(await lstat3(path)).isFile()) throw new Error("\u542F\u52A8\u6587\u4EF6\u5FC5\u987B\u662F\u666E\u901A\u6587\u4EF6\uFF0C\u4E0D\u80FD\u4F7F\u7528\u7B26\u53F7\u94FE\u63A5");
+  }
+  const pkg = JSON.parse(await readFile6(packagePath, "utf8"));
+  if (!runtimeUsesEnvironmentIdentity(pkg)) return false;
+  const current = await readFile6(entryPath, "utf8");
+  const latest = platformStartTemplate();
+  const legacy = legacyPlatformStartTemplate();
+  let changed2 = false;
+  if (current.replace(/\r\n/gu, "\n") === legacy) {
+    await writeFile5(entryPath, latest, "utf8");
+    changed2 = true;
+  }
+  if (pkg.scripts?.start === "node start.mjs") {
+    pkg.scripts.start = "node --env-file-if-exists=.env start.mjs";
+    await writeFile5(packagePath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    changed2 = true;
+  }
+  return changed2;
+}
 async function scaffoldPlatformAgent(projectRoot, name, options = {}) {
   const path = resolve3(projectRoot, BUDDY_PLATFORM_AGENT_ENTRY);
   const hasAlternateLockfile = (await Promise.all(["pnpm-lock.yaml", "yarn.lock"].map(async (name2) => {
@@ -804,7 +834,9 @@ async function scaffoldPlatformAgent(projectRoot, name, options = {}) {
     { path: resolve3(projectRoot, BUDDY_PLATFORM_FACTORY_ENTRY), content: platformFactoryTemplate() },
     { path: resolve3(projectRoot, BUDDY_PLATFORM_PACKAGE_JSON), content: await readFile6(new URL("../../resources/agent-template/package.json", import.meta.url), "utf8") },
     ...hasAlternateLockfile ? [] : [{ path: resolve3(projectRoot, BUDDY_PLATFORM_PACKAGE_LOCK), content: await readFile6(new URL("../../resources/agent-template/package-lock.json", import.meta.url), "utf8") }],
-    { path: resolve3(projectRoot, BUDDY_PLATFORM_START_ENTRY), content: platformStartTemplate() }
+    { path: resolve3(projectRoot, BUDDY_PLATFORM_START_ENTRY), content: platformStartTemplate() },
+    { path: resolve3(projectRoot, ".gitignore"), content: "node_modules/\n/.env\n" },
+    { path: resolve3(projectRoot, ".env.example"), content: "# \u9996\u6B21\u8FD0\u884C buddy-cli dev \u6216\u5728\u540E\u53F0\u542F\u52A8 DEV \u65F6\uFF0CCLI \u4F1A\u51C6\u5907 .env\u3002\nBUDDY_ID=\nBUDDY_TOKEN=\n# \u53EF\u9009\uFF1A\u4F7F\u7528\u5176\u4ED6\u5E73\u53F0\u65F6\u8BBE\u7F6E MLB_GATEWAY_URL\u3002\n" }
   ];
   const handles = [];
   const createdDirectories = [];
@@ -847,12 +879,17 @@ async function scaffoldPlatformAgent(projectRoot, name, options = {}) {
         throw new Error("\u5DF2\u6709 package.json \u4E0E\u5F85\u8865\u9F50\u7684\u9501\u6587\u4EF6\u4E0D\u4E00\u81F4\uFF0C\u8BF7\u7528\u5DE5\u7A0B\u7684\u5305\u7BA1\u7406\u5668\u6062\u590D\u5339\u914D\u7684\u4F9D\u8D56\u6587\u4EF6\u540E\u91CD\u8BD5");
       }
     }
+    const effectivePackage = handles.some((file) => file.path === packageFile.path) ? packageFile.content : await readFile6(packageFile.path, "utf8");
+    if (!runtimeUsesEnvironmentIdentity(JSON.parse(effectivePackage))) {
+      files.find((file) => file.path === resolve3(projectRoot, BUDDY_PLATFORM_START_ENTRY)).content = legacyPlatformStartTemplate();
+    }
     for (const { path: filePath, handle } of handles) {
       const file = files.find((candidate) => candidate.path === filePath);
       await handle.writeFile(file.content, "utf8");
       await handle.sync();
     }
-    return Object.freeze({ path, created: handles.length > 0 || createdDirectories.length > 0 });
+    const migrated = await migrateRuntimeStartup(projectRoot);
+    return Object.freeze({ path, created: migrated || handles.length > 0 || createdDirectories.length > 0 });
   } catch (cause) {
     await Promise.all(handles.map(({ handle }) => handle.close().catch(() => void 0)));
     await Promise.all(handles.map(({ path: createdPath }) => unlink3(createdPath).catch(() => void 0)));
@@ -1635,7 +1672,7 @@ ${DATASETS_COMMAND_HELP}`);
 
 // packages/cli-core/src/commands/knowledge.ts
 import { createHash as createHash2, randomUUID as randomUUID4 } from "node:crypto";
-import { lstat as lstat7, mkdir as mkdir6, readFile as readFile8, rename as rename5, unlink as unlink5, writeFile as writeFile5 } from "node:fs/promises";
+import { lstat as lstat7, mkdir as mkdir6, readFile as readFile8, rename as rename5, unlink as unlink5, writeFile as writeFile6 } from "node:fs/promises";
 import { dirname as dirname2, join as join8, resolve as resolve8 } from "node:path";
 var MANIFEST = "knowledge-manifest.json";
 var INDEX = "resources/knowledge/index.md";
@@ -1705,7 +1742,7 @@ async function atomicWrite(root, path, value) {
   const full = await safePath(root, path);
   await mkdir6(dirname2(full), { recursive: true });
   const temporary = `${full}.${randomUUID4()}.tmp`;
-  await writeFile5(temporary, value, { flag: "wx", mode: 384 });
+  await writeFile6(temporary, value, { flag: "wx", mode: 384 });
   try {
     await rename5(temporary, full);
   } finally {
@@ -1947,11 +1984,11 @@ ${KNOWLEDGE_HELP}`);
 }
 
 // packages/cli-core/src/index.ts
-import { join as join15, resolve as resolve16 } from "node:path";
+import { join as join16, resolve as resolve16 } from "node:path";
 
 // packages/cli-core/src/init/creator.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { link as link2, lstat as lstat8, mkdir as mkdir7, readFile as readFile9, unlink as unlink6, writeFile as writeFile6 } from "node:fs/promises";
+import { link as link2, lstat as lstat8, mkdir as mkdir7, readFile as readFile9, unlink as unlink6, writeFile as writeFile7 } from "node:fs/promises";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -2022,7 +2059,7 @@ ${KNOWLEDGE_GUIDE}
 | \u56DE\u7B54\u65F6\u9700\u8981\u53C2\u8003\u7684\u5386\u53F2\u3001\u8BA1\u5212\u548C\u72B6\u6001 | Runtime \u4F1A\u4ECE MLB \u91CD\u5EFA\u4F1A\u8BDD\u5386\u53F2\uFF1B\u957F\u671F\u8BA1\u5212\u548C\u7ED3\u6784\u5316\u72B6\u6001\u4E0D\u80FD\u53EA\u4F9D\u8D56\u5B83\u4E00\u76F4\u7559\u5728\u6700\u8FD1\u804A\u5929\u91CC\u3002\u6309\u9700\u6C42\u4F7F\u7528 Memory\u3001\u6388\u6743\u6570\u636E\u6216\u4E1A\u52A1 Tool\uFF0C\u4E0D\u8981\u627F\u8BFA\u9ED8\u8BA4\u914D\u7F6E\u5DF2\u7ECF\u8986\u76D6\u3002 |
 | \u6A21\u578B\u548C\u5E73\u53F0\u8D44\u6E90 | \u5DF2\u786E\u5B9A\u7684\u6A21\u578B\u76F4\u63A5\u6CBF\u7528\uFF1B\u672A\u6307\u5B9A\u65F6\u67E5\u8BE2 \`buddy-cli models\`\uFF0C\u6838\u5BF9\u53EF\u7528\u6027\u5E76\u91C7\u7528\u6EE1\u8DB3\u9700\u6C42\u7684\u9009\u62E9\uFF0C\u4E0D\u9ED8\u8BA4\u518D\u95EE\u4E00\u8F6E\u9009\u578B\u95EE\u9898\uFF0C\u4E5F\u4E0D\u7F16\u9020\u4EF7\u683C\u6216\u80FD\u529B\u3002\u6A21\u677F\u628A\u914D\u7F6E\u4E2D\u7684\u6A21\u578B\u4EA4\u7ED9 \`initialState.model\`\uFF1B\u81EA\u5B9A\u4E49\u5DE5\u5382\u4E5F\u53EF\u6309\u4F1A\u8BDD\u9009\u62E9\u53D7\u652F\u6301\u6A21\u578B\uFF1B\u4F1A\u4EA7\u751F\u65B0\u7684\u8D39\u7528\u3001\u6570\u636E\u4F7F\u7528\u6216\u6743\u9650\u8FB9\u754C\u65F6\u5148\u786E\u8BA4\u3002 |
 
-\`src/buddy-options.mjs\` \u662F\u6BCF\u573A\u4F1A\u8BDD\u7684\u4E1A\u52A1\u88C5\u914D\u5165\u53E3\uFF0C\u5BFC\u51FA \`createBuddyOptions(conversation)\`\uFF0C\u8FD4\u56DE \`initialState\`\u3001\u5728 \`initialState.tools\` \u6CE8\u518C\u7684\u4E1A\u52A1\u53CA\u5E73\u53F0\u5DE5\u5177\u548C\u53EF\u9009\u56DE\u5408\u94A9\u5B50\u3002\`start.mjs\` \u4ECE \`./src/buddy-options.mjs\` \u5BFC\u5165\u5DE5\u5382\u5E76\u4F20\u7ED9 \`BuddyServer.start({ buddyId: process.env.BUDDY_ID, token: process.env.BUDDY_TOKEN, dataRequirements: config.datasets ?? [], buddy: createBuddyOptions })\`\uFF1B\u7EC4\u88C5\u5668\u8BFB\u53D6 \`buddy.agent.json.model\`\uFF0C\u7701\u7565\u65F6\u7528 \`kimi-k2.6\`\uFF0C\u653E\u5165 \`initialState.model\`\uFF1B\u7528 \`new URL("../agent.md", import.meta.url)\` \u8BFB\u53D6\u6839\u76EE\u5F55 Prompt\u3002\u9ED8\u8BA4\u6A21\u677F\u53EA\u662F\u8D77\u70B9\uFF0C\u53EA\u6539\u8BF4\u660E\u4E0D\u7B49\u4E8E\u6539\u53D8\u4E86\u4FDD\u5B58\u3001\u67E5\u8BE2\u6216\u5904\u7406\u903B\u8F91\u3002
+\`src/buddy-options.mjs\` \u662F\u6BCF\u573A\u4F1A\u8BDD\u7684\u4E1A\u52A1\u88C5\u914D\u5165\u53E3\uFF0C\u5BFC\u51FA \`createBuddyOptions(conversation)\`\uFF0C\u8FD4\u56DE \`initialState\`\u3001\u5728 \`initialState.tools\` \u6CE8\u518C\u7684\u4E1A\u52A1\u53CA\u5E73\u53F0\u5DE5\u5177\u548C\u53EF\u9009\u56DE\u5408\u94A9\u5B50\u3002\`start.mjs\` \u4ECE \`./src/buddy-options.mjs\` \u5BFC\u5165\u5DE5\u5382\u5E76\u4F20\u7ED9 \`BuddyServer.start({ dataRequirements: config.datasets ?? [], buddy: createBuddyOptions })\`\uFF1B\u7EC4\u88C5\u5668\u8BFB\u53D6 \`buddy.agent.json.model\`\uFF0C\u7701\u7565\u65F6\u7528 \`kimi-k2.6\`\uFF0C\u653E\u5165 \`initialState.model\`\uFF1B\u7528 \`new URL("../agent.md", import.meta.url)\` \u8BFB\u53D6\u6839\u76EE\u5F55 Prompt\u3002\u9ED8\u8BA4\u6A21\u677F\u53EA\u662F\u8D77\u70B9\uFF0C\u53EA\u6539\u8BF4\u660E\u4E0D\u7B49\u4E8E\u6539\u53D8\u4E86\u4FDD\u5B58\u3001\u67E5\u8BE2\u6216\u5904\u7406\u903B\u8F91\u3002 Runtime 0.16.0 \u4ECE\u73AF\u5883\u53D8\u91CF\u8BFB\u53D6\u8EAB\u4EFD\u548C\u4EE4\u724C\uFF1B\u9996\u6B21\u542F\u52A8 DEV \u65F6 CLI \u51C6\u5907\u5DE5\u7A0B \`.env\`\uFF0CNode \u7528 \`--env-file-if-exists=.env\` \u52A0\u8F7D\u3002\u4E0D\u8981\u5C06 token \u5199\u5165\u4E1A\u52A1\u4EE3\u7801\u3002
 
 ### \u6309\u76EE\u5F55\u804C\u8D23\u7EC4\u7EC7\u5B9E\u73B0
 
@@ -2052,11 +2089,11 @@ Tool \u548C Hook \u662F Runtime \u7684\u6269\u5C55\u70B9\uFF1BService \u53EA\u66
 
 \u5E73\u53F0\u80FD\u529B\u8981\u4EE5\u5B9E\u9645\u63A5\u5165\u4E3A\u51C6\u3002\u5F53\u524D Runtime \u63D0\u4F9B\u4F1A\u8BDD\u6D88\u606F\u3001Memory\u3001\u6388\u6743\u6570\u636E\u3001\u5C0F\u6302\u4EF6\u548C\u672C\u5730 Markdown \u8D44\u6599\u80FD\u529B\uFF1B\u6CA1\u6709\u63A5\u901A\u7684 Files\u3001Knowledge \u4E0D\u80FD\u56E0\u624B\u518C\u63D0\u5230\u5C31\u5BA3\u79F0\u53EF\u7528\u3002\u666E\u901A Tool \u4E5F\u4E0D\u4EE3\u8868\u5DF2\u7ECF\u63D0\u4F9B\u5B9A\u65F6\u3001\u957F\u671F\u4EFB\u52A1\u3001\u540E\u53F0\u8C03\u5EA6\u6216\u4E3B\u52A8\u89E6\u8FBE\u3002\u624B\u518C\u63CF\u8FF0\u7684\u4ED8\u8D39\u3001\u53D1\u5E03\u7B49\u670D\u52A1\u8BBE\u8BA1\u4E5F\u4E0D\u6784\u6210\u6267\u884C\u6536\u8D39\u6216\u53D1\u5E03\u52A8\u4F5C\u7684\u6388\u6743\u3002
 
-\u9700\u8981\u7528\u6237\u6570\u636E\u65F6\uFF0C\u5148\u5728\u5DE5\u7A0B\u76EE\u5F55\u6267\u884C \`buddy-cli datasets\`\uFF08\u811A\u672C\u53EF\u7528 \`--json\`\uFF09\uFF0C\u4ECE\u5F53\u524D\u5B89\u88C5\u7684 Runtime \u5BFC\u51FA\u8BFB\u53D6\u5168\u90E8\u6570\u636E\u96C6\uFF1B\u4E0D\u8981\u6C42\u767B\u5F55\uFF0C\u4E0D\u4ECE Server \u62C9\u76EE\u5F55\u3002Runtime 0.12.2 \u542B 10 \u9879\uFF0CCLI \u4E0D\u590D\u5236\u679A\u4E3E\u3002\u628A\u5B9E\u9645\u9700\u8981\u7684 \`id\` \u548C\u7528\u9014 \`purpose\` \u5199\u5165 \`buddy.agent.json.datasets\`\uFF0C\u540C\u4E00 ID \u53EA\u5199\u4E00\u6B21\uFF0C\u7528\u9014\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u6700\u591A 200 \u5B57\uFF1B\u65E0\u9700\u6C42\u65F6\u4FDD\u7559\u7A7A\u6570\u7EC4\u3002DEV \u548C\u58F0\u660E\u975E\u7A7A\u65F6\u7684 push \u9884\u68C0\u7528\u8FD9\u4EFD\u5DE5\u7A0B\u4F9D\u8D56\u6821\u9A8C ID\uFF1B\u9700\u8981\u5148\u5B89\u88C5\u4E0E package.json \u51C6\u786E\u7248\u672C\u4E00\u81F4\u7684 Runtime\u3002\u6E05\u5355\u58F0\u660E\u6570\u91CF\u4E0D\u7B49\u4E8E\u5355\u6B21\u67E5\u8BE2\u4E0A\u9650\uFF0C\u5F53\u524D\u4E00\u6B21\u67E5\u8BE2\u6700\u591A 8 \u9879\u3002
+\u9700\u8981\u7528\u6237\u6570\u636E\u65F6\uFF0C\u5148\u5728\u5DE5\u7A0B\u76EE\u5F55\u6267\u884C \`buddy-cli datasets\`\uFF08\u811A\u672C\u53EF\u7528 \`--json\`\uFF09\uFF0C\u4ECE\u5F53\u524D\u5B89\u88C5\u7684 Runtime \u5BFC\u51FA\u8BFB\u53D6\u5168\u90E8\u6570\u636E\u96C6\uFF1B\u4E0D\u8981\u6C42\u767B\u5F55\uFF0C\u4E0D\u4ECE Server \u62C9\u76EE\u5F55\u3002\u4EE5\u5DE5\u7A0B\u5B89\u88C5\u7248\u672C\u5BFC\u51FA\u7684\u76EE\u5F55\u4E3A\u51C6\uFF0CCLI \u4E0D\u590D\u5236\u679A\u4E3E\u3002\u628A\u5B9E\u9645\u9700\u8981\u7684 \`id\` \u548C\u7528\u9014 \`purpose\` \u5199\u5165 \`buddy.agent.json.datasets\`\uFF0C\u540C\u4E00 ID \u53EA\u5199\u4E00\u6B21\uFF0C\u7528\u9014\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u6700\u591A 200 \u5B57\uFF1B\u65E0\u9700\u6C42\u65F6\u4FDD\u7559\u7A7A\u6570\u7EC4\u3002DEV \u548C\u58F0\u660E\u975E\u7A7A\u65F6\u7684 push \u9884\u68C0\u7528\u8FD9\u4EFD\u5DE5\u7A0B\u4F9D\u8D56\u6821\u9A8C ID\uFF1B\u9700\u8981\u5148\u5B89\u88C5\u4E0E package.json \u51C6\u786E\u7248\u672C\u4E00\u81F4\u7684 Runtime\u3002\u6E05\u5355\u58F0\u660E\u6570\u91CF\u4E0D\u7B49\u4E8E\u5355\u6B21\u67E5\u8BE2\u4E0A\u9650\uFF0C\u5F53\u524D\u4E00\u6B21\u67E5\u8BE2\u6700\u591A 8 \u9879\u3002
 
 \`start.mjs\` \u5C06\u58F0\u660E\u4EA4\u7ED9 \`StartOptions.dataRequirements\`\u3002Runtime \u5728\u5B9E\u9645\u6570\u636E\u67E5\u8BE2\u3001HealthKit \u6388\u6743\u548C\u4E3B\u52A8\u670D\u52A1\u8BF7\u6C42\u4E2D\u643A\u5E26\u5B8C\u6574\u58F0\u660E\uFF0C\u7531 Server \u6821\u9A8C\u8303\u56F4\u4E0E\u7528\u6237\u540C\u610F\uFF1B\u586B\u5199\u914D\u7F6E\u4E0D\u8868\u793A\u5DF2\u7ECF\u6388\u6743\u3002\u670D\u52A1\u7AEF\u4ECE\u4E0A\u4F20\u5305\u89E3\u6790\u5E76\u7ED1\u5B9A\u53D1\u5E03\u7248\u672C\u4ECD\u5F85\u5B9E\u73B0\u3002
 
-\u6A21\u578B\u9700\u8981\u67E5\u6570\u636E\u65F6\uFF0C\u5728 \`src/buddy-options.mjs\` \u7684 \`initialState.tools\` \u4E2D\u52A0\u5165 \`conversation.tools.data_access_query\`\uFF1B\u9700\u8981\u5411\u7528\u6237\u7533\u8BF7\u65F6\u52A0\u5165 \`conversation.tools.data_access_request\`\uFF0C\u4F4D\u7F6E\u3001\u65E5\u5386\u7684\u4E00\u6B21\u6027\u7ED3\u679C\u901A\u8FC7 \`data_access_read_result\` \u8BFB\u53D6\uFF0CHealthKit \u5219\u91CD\u65B0\u67E5\u8BE2 Dataset\u3002\u4E1A\u52A1\u4EE3\u7801\u5BF9\u5E94\u4F7F\u7528 \`conversation.dataAccess.query/request/readResult\`\u3002\u65B0\u5EFA\u5DE5\u7A0B\u52A8\u6001\u9009\u62E9\u516C\u5171 npm latest \u5E76\u9501\u5B9A\u51C6\u786E\u7248\u672C\uFF1B\u8054\u7F51\u5931\u8D25\u65F6\u660E\u786E\u63D0\u793A\u4F7F\u7528\u968F CLI \u9644\u5E26\u7684 Runtime 0.12.2\u3002\u5DF2\u6709\u5DE5\u7A0B\u901A\u8FC7\u5305\u7BA1\u7406\u5668\u663E\u5F0F\u5347\u7EA7\u4F9D\u8D56\u3002
+\u6A21\u578B\u9700\u8981\u67E5\u6570\u636E\u65F6\uFF0C\u5728 \`src/buddy-options.mjs\` \u7684 \`initialState.tools\` \u4E2D\u52A0\u5165 \`conversation.tools.data_access_query\`\uFF1B\u9700\u8981\u5411\u7528\u6237\u7533\u8BF7\u65F6\u52A0\u5165 \`conversation.tools.data_access_request\`\uFF0C\u4F4D\u7F6E\u3001\u65E5\u5386\u7684\u4E00\u6B21\u6027\u7ED3\u679C\u901A\u8FC7 \`data_access_read_result\` \u8BFB\u53D6\uFF0CHealthKit \u5219\u91CD\u65B0\u67E5\u8BE2 Dataset\u3002\u4E1A\u52A1\u4EE3\u7801\u5BF9\u5E94\u4F7F\u7528 \`conversation.dataAccess.query/request/readResult\`\u3002\u65B0\u5EFA\u5DE5\u7A0B\u52A8\u6001\u9009\u62E9\u516C\u5171 npm latest \u5E76\u9501\u5B9A\u51C6\u786E\u7248\u672C\uFF1B\u8054\u7F51\u5931\u8D25\u65F6\u660E\u786E\u63D0\u793A\u4F7F\u7528\u968F CLI \u9644\u5E26\u7684 Runtime 0.16.0\u3002\u5DF2\u6709\u5DE5\u7A0B\u901A\u8FC7\u5305\u7BA1\u7406\u5668\u663E\u5F0F\u5347\u7EA7\u4F9D\u8D56\u3002
 
 \u5C0F\u6302\u4EF6\u7684\u6A21\u578B\u5DE5\u5177\u4E3A \`widget_create\`\u3001\`widget_read\`\uFF08\u6574\u4E2A\u5C0F\u6302\u4EF6\uFF09\u3001\`widget_read_module\`\uFF08\u4E00\u4E2A\u6A21\u5757\uFF09\u3001\`widget_rename\`\u3001\`widget_write_record\`\u3001\`widget_delete_record\`\u3001\`widget_delete\`\uFF08\u6574\u4E2A\u5C0F\u6302\u4EF6\u8FDE\u8BB0\u5F55\uFF09\u548C \`widget_send\`\uFF0C\u6309\u4E1A\u52A1\u9700\u8981\u6CE8\u518C\u5230 \`initialState.tools\`\u3002\u4FEE\u6539\u8BB0\u5F55\u7528 \`conversation.widget.writeRecord(id, input)\`\uFF1B\u5220\u4E00\u6761\u8BB0\u5F55\u7528 \`conversation.widget.deleteRecord(id, module, recordId)\`\uFF0C\u4E0D\u80FD\u7528\u5220\u9664\u6574\u4E2A\u5C0F\u6302\u4EF6\u7684 \`conversation.widget.delete(id)\` \u4EE3\u66FF\u3002\u4E24\u4E2A\u8BFB\u53D6\u5DE5\u5177\u53EF\u7528\u4E8E\u4E3B\u52A8\u56DE\u5408\uFF0C\u5176\u4F59\u516D\u4E2A\u5199\u5165\u5DE5\u5177\u7531 Runtime \u963B\u6B62\u5728\u4E3B\u52A8\u56DE\u5408\u6267\u884C\u3002
 
@@ -2153,7 +2190,7 @@ async function safeRead(path) {
 }
 async function writeOnce(path, bytes) {
   const temporary = `${path}.${randomUUID5()}.tmp`;
-  await writeFile6(temporary, bytes, { flag: "wx", mode: 384 });
+  await writeFile7(temporary, bytes, { flag: "wx", mode: 384 });
   try {
     await link2(temporary, path).catch((cause) => {
       if (cause.code !== "EEXIST") throw cause;
@@ -2376,6 +2413,13 @@ function resolvePlatformUrl(options = {}) {
   return normalizePlatformUrl(options.override ?? configured ?? DEFAULT_MLB_TEST_URL);
 }
 
+// packages/cli-core/src/dev/project-env.ts
+import { constants } from "node:fs";
+import { open as open4, rename as rename6, unlink as unlink7 } from "node:fs/promises";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { join as join10 } from "node:path";
+import { parseEnv } from "node:util";
+
 // packages/cli-core/src/dev/errors.ts
 var BuddyDevError = class extends Error {
   code;
@@ -2404,6 +2448,124 @@ function throwIfDevAborted(signal) {
   if (signal?.aborted) throw abortedDevError(signal);
 }
 
+// packages/cli-core/src/dev/project-env.ts
+function invalid(message) {
+  return new BuddyDevError({ code: "DEV_CONFIG_INVALID", phase: "config", message });
+}
+async function readLocalFile(path) {
+  let file;
+  try {
+    file = await open4(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stat2 = await file.stat();
+    if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > 256 * 1024) throw invalid("\u672C\u5730\u914D\u7F6E\u5FC5\u987B\u662F\u5C0F\u4E8E 256 KB \u7684\u666E\u901A\u6587\u4EF6\uFF0C\u4E0D\u80FD\u4F7F\u7528\u94FE\u63A5\u3002");
+    return await file.readFile("utf8");
+  } catch (cause) {
+    if (cause.code === "ENOENT") return "";
+    if (cause instanceof BuddyDevError) throw cause;
+    throw invalid("\u65E0\u6CD5\u8BFB\u53D6\u5DE5\u7A0B\u672C\u5730\u914D\u7F6E\uFF0C\u8BF7\u68C0\u67E5 .env \u548C .gitignore \u7684\u6587\u4EF6\u7C7B\u578B\u4E0E\u6743\u9650\u3002");
+  } finally {
+    await file?.close();
+  }
+}
+async function readProjectEnvironment(projectRoot, buddyId) {
+  const source = await readLocalFile(join10(projectRoot, ".env"));
+  let values;
+  try {
+    values = parseEnv(source);
+  } catch {
+    throw invalid("\u5DE5\u7A0B .env \u683C\u5F0F\u65E0\u6548\uFF0C\u8BF7\u68C0\u67E5\u540E\u91CD\u8BD5\u3002");
+  }
+  if (values.BUDDY_ID && values.BUDDY_ID !== buddyId) throw invalid(".env \u7684 BUDDY_ID \u4E0E buddy.agent.json \u4E0D\u4E00\u81F4\uFF0C\u8BF7\u5148\u4FEE\u6B63\u5DE5\u7A0B\u8EAB\u4EFD\u3002");
+  return values;
+}
+async function projectBuddyToken(projectRoot, buddyId, gatewayUrl) {
+  const values = await readProjectEnvironment(projectRoot, buddyId);
+  if (!values.BUDDY_TOKEN) return void 0;
+  if (!values.BUDDY_ID) throw invalid(".env \u4E2D\u6709 BUDDY_TOKEN\uFF0C\u4F46\u7F3A\u5C11 BUDDY_ID\uFF0C\u8BF7\u8865\u9F50\u540E\u91CD\u8BD5\u3002");
+  if (values.MLB_GATEWAY_URL) {
+    let gateway;
+    try {
+      gateway = normalizePlatformUrl(values.MLB_GATEWAY_URL);
+    } catch {
+      throw invalid(".env \u4E2D\u7684 MLB_GATEWAY_URL \u65E0\u6548\u3002");
+    }
+    if (gateway.href !== gatewayUrl.href) throw invalid(".env \u7684\u5E73\u53F0\u5730\u5740\u4E0E\u672C\u6B21\u542F\u52A8\u4E0D\u540C\uFF1B\u8BF7\u786E\u8BA4\u5E73\u53F0\u540E\u4F7F\u7528 --refresh-token \u91CD\u65B0\u9886\u53D6\u5F00\u53D1\u4EE4\u724C\u3002");
+  }
+  if (!values.BUDDY_TOKEN.trim() || /[\u0000-\u001f\u007f]/u.test(values.BUDDY_TOKEN)) throw invalid(".env \u4E2D\u7684\u5F00\u53D1\u4EE4\u724C\u683C\u5F0F\u65E0\u6548\uFF0C\u8BF7\u4F7F\u7528 --refresh-token \u91CD\u65B0\u9886\u53D6\u3002");
+  return values.BUDDY_TOKEN;
+}
+function quote(value) {
+  if (/[\u0000-\u001f\u007f]/u.test(value)) throw invalid("\u672C\u5730\u8FD0\u884C\u914D\u7F6E\u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26\u3002");
+  const delimiter = ["'", '"', "`"].find((character) => !value.includes(character));
+  if (!delimiter) throw invalid("\u672C\u5730\u8FD0\u884C\u914D\u7F6E\u5305\u542B\u65E0\u6CD5\u5199\u5165 .env \u7684\u5F15\u53F7\u7EC4\u5408\u3002");
+  return `${delimiter}${value}${delimiter}`;
+}
+function updateValues(source, values) {
+  const assignment = /^[\t ]*(?:export[\t ]+)?([A-Za-z_][A-Za-z0-9_]*)[\t ]*=[\t ]*/gm;
+  let output = "", cursor = 0, match;
+  const written = /* @__PURE__ */ new Set();
+  while (match = assignment.exec(source)) {
+    const valueStart = assignment.lastIndex;
+    let end = source.indexOf("\n", valueStart);
+    if (end < 0) end = source.length;
+    let commentStart = valueStart;
+    const delimiter = source[valueStart];
+    if (delimiter && ["'", '"', "`"].includes(delimiter)) {
+      const close = source.indexOf(delimiter, valueStart + 1);
+      if (close < 0) throw invalid(".env \u4E2D\u6709\u672A\u95ED\u5408\u7684\u5F15\u53F7\uFF0C\u8BF7\u4FEE\u6B63\u540E\u91CD\u8BD5\u3002");
+      commentStart = close + 1;
+      end = source.indexOf("\n", close + 1);
+      if (end < 0) end = source.length;
+    }
+    assignment.lastIndex = end;
+    const name = match[1];
+    if (!(name in values)) continue;
+    const comment = source.slice(commentStart, end).match(/[\t ]*#[^\r\n]*/u)?.[0] ?? "";
+    output += source.slice(cursor, match.index);
+    output += written.has(name) ? comment : `${name}=${quote(values[name])}${comment ? ` ${comment.trimStart()}` : ""}`;
+    if (source[end - 1] === "\r") output += "\r";
+    cursor = end;
+    written.add(name);
+  }
+  output += source.slice(cursor);
+  const newline = source.includes("\r\n") ? "\r\n" : "\n";
+  for (const [name, value] of Object.entries(values)) if (!written.has(name)) {
+    if (output && !output.endsWith("\n")) output += newline;
+    output += `${name}=${quote(value)}${newline}`;
+  }
+  const parsed = parseEnv(output);
+  if (Object.entries(values).some(([name, value]) => parsed[name] !== value)) throw invalid("\u65E0\u6CD5\u5B8C\u6574\u66F4\u65B0 .env\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u3002");
+  return output;
+}
+async function replaceFile(path, contents, mode) {
+  const temporary = `${path}.${randomUUID6()}.tmp`;
+  let file;
+  try {
+    file = await open4(temporary, "wx", mode);
+    await file.writeFile(contents, "utf8");
+    await file.sync();
+    await file.close();
+    file = void 0;
+    await rename6(temporary, path);
+  } finally {
+    await file?.close();
+    await unlink7(temporary).catch((cause) => {
+      if (cause.code !== "ENOENT") throw cause;
+    });
+  }
+}
+async function writeProjectEnvironment(projectRoot, values) {
+  await readProjectEnvironment(projectRoot, values.BUDDY_ID);
+  const envPath = join10(projectRoot, ".env"), ignorePath = join10(projectRoot, ".gitignore");
+  const contents = updateValues(await readLocalFile(envPath), values);
+  const ignored = await readLocalFile(ignorePath);
+  if (ignored.trimEnd().split(/\r?\n/u).at(-1) !== "/.env") {
+    await replaceFile(ignorePath, `${ignored}${ignored && !ignored.endsWith("\n") ? "\n" : ""}/.env
+`, 420);
+  }
+  await replaceFile(envPath, contents, 384);
+}
+
 // packages/cli-core/src/dev/app-server.ts
 var MAX_JSON_BODY_LENGTH = 1048576;
 function safeCredential(value, name) {
@@ -2465,10 +2627,14 @@ var MlbDevRegistrationClient = class {
   #baseUrl;
   #developerToken;
   #fetch;
+  #tokenStoreFor;
+  #refreshToken;
   constructor(options) {
     this.#baseUrl = normalizePlatformUrl(options.baseUrl);
     this.#developerToken = safeCredential(options.developerToken, "developerToken");
     this.#fetch = options.fetch ?? globalThis.fetch;
+    this.#tokenStoreFor = options.tokenStoreFor;
+    this.#refreshToken = options.refreshToken ?? false;
     if (typeof this.#fetch !== "function") {
       throw new TypeError("A Fetch API implementation is required");
     }
@@ -2538,6 +2704,18 @@ var MlbDevRegistrationClient = class {
         message: "buddy.agent.json \u4E2D\u7684 buddyId \u65E0\u6548\u3002"
       });
     }
+    options.signal.throwIfAborted();
+    if (request.projectRoot) {
+      await readProjectEnvironment(request.projectRoot, request.devAgentId);
+      const localToken = this.#refreshToken ? void 0 : await projectBuddyToken(request.projectRoot, request.devAgentId, this.#baseUrl);
+      if (localToken !== void 0) return Object.freeze({ devAgentId: request.devAgentId, appServerUrl: new URL(this.#baseUrl), agentToken: localToken });
+    }
+    const store = this.#tokenStoreFor?.(request.devAgentId);
+    const cached = this.#refreshToken ? void 0 : await store?.load();
+    if (cached !== void 0) {
+      options.signal.throwIfAborted();
+      return Object.freeze({ devAgentId: request.devAgentId, appServerUrl: new URL(this.#baseUrl), agentToken: safeCredential(cached, "agentToken") });
+    }
     const body = object2(await this.#request(
       `/cli/buddies/${encodeURIComponent(request.devAgentId)}`,
       {
@@ -2552,10 +2730,13 @@ var MlbDevRegistrationClient = class {
         message: "\u642D\u5B50\u8BE6\u60C5\u54CD\u5E94\u7F3A\u5C11\u5339\u914D\u7684 id \u6216 Buddy token\u3002"
       });
     }
+    const token = safeCredential(body.token, "agentToken");
+    options.signal.throwIfAborted();
+    if (!request.projectRoot) await store?.save(token);
     return Object.freeze({
       devAgentId: request.devAgentId,
       appServerUrl: new URL(this.#baseUrl),
-      agentToken: safeCredential(body.token, "agentToken")
+      agentToken: token
     });
   }
   async listOnline(options) {
@@ -2653,7 +2834,7 @@ function buildAgentEnvironment(options) {
 // packages/cli-core/src/dev/orchestrator.ts
 import { createHash as createHash4 } from "node:crypto";
 import { readFile as readFile10 } from "node:fs/promises";
-import { join as join11, resolve as resolve10 } from "node:path";
+import { join as join12, resolve as resolve10 } from "node:path";
 
 // packages/cli-core/src/dev/launch.ts
 import { lstatSync, readFileSync } from "node:fs";
@@ -2698,9 +2879,10 @@ async function officialAgentLaunchPlan(input) {
       cause
     });
   }
+  await migrateRuntimeStartup(input.projectRoot);
   return Object.freeze({
     command: process.execPath,
-    args: Object.freeze([entry2])
+    args: Object.freeze(["--env-file-if-exists=.env", entry2])
   });
 }
 
@@ -2903,14 +3085,14 @@ function processTreeControllerFor(platform) {
 // packages/cli-core/src/dev/instance-lock.ts
 import { createHash as createHash3 } from "node:crypto";
 import { homedir as homedir2 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function alreadyRunningError() {
   const message = "\u8FD9\u4E2A\u642D\u5B50\u5DF2\u6709 DEV \u5B9E\u4F8B\u5728\u8FD0\u884C\u3002\u8BF7\u5148\u5728\u539F\u9884\u89C8\u9875\u70B9\u51FB\u300C\u505C\u6B62 DEV\u300D\uFF0C\u6216\u5728\u8FD0\u884C dev \u7684\u7EC8\u7AEF\u6309 Ctrl+C\uFF0C\u518D\u542F\u52A8\u3002";
   return Object.assign(new BuddyDevError({ code: "DEV_ALREADY_RUNNING", phase: "launch", message }), { publicMessage: message });
 }
 async function acquireDevInstanceLock(options) {
   return acquireProcessLock({
-    directory: options.directory ?? join10(homedir2(), ".buddy", "dev-locks"),
+    directory: options.directory ?? join11(homedir2(), ".buddy", "dev-locks"),
     key: createHash3("sha256").update(`${new URL(options.gatewayUrl).origin}
 ${options.devAgentId}`).digest("hex"),
     busyError: alreadyRunningError
@@ -2942,7 +3124,7 @@ function validateRegistration(value, expectedAgentId) {
     throw new BuddyDevError({
       code: "DEV_APP_SERVER_RESPONSE_INVALID",
       phase: "registration",
-      message: "DEV \u6302\u53F7\u6CA1\u6709\u8FD4\u56DE\u5339\u914D\u7684 Buddy \u8EAB\u4EFD\u4E0E\u77ED\u671F Buddy token\u3002"
+      message: "DEV \u6302\u53F7\u6CA1\u6709\u8FD4\u56DE\u5339\u914D\u7684 Buddy \u8EAB\u4EFD\u4E0E\u5F00\u53D1 Token\u3002"
     });
   }
   return value;
@@ -2979,6 +3161,7 @@ async function launchPlanFor(config, options, projectRoot, signal) {
 async function registerDevAgent(options) {
   try {
     return validateRegistration(await options.client.register({
+      projectRoot: options.projectRoot,
       devAgentId: options.devAgentId,
       configSource: options.configSource,
       configDigest: options.configDigest
@@ -3169,7 +3352,7 @@ async function startBuddyDev(options) {
     let config;
     let configSource;
     try {
-      configSource = await readFile10(join11(projectRoot, BUDDY_AGENT_FILENAME), "utf8");
+      configSource = await readFile10(join12(projectRoot, BUDDY_AGENT_FILENAME), "utf8");
       config = combineBuddyProject(parseBuddyAgentConfig(configSource));
     } catch (cause) {
       throw new BuddyDevError({
@@ -3179,8 +3362,10 @@ async function startBuddyDev(options) {
         cause
       });
     }
+    await readProjectEnvironment(projectRoot, devAgentId);
     const launchPlan = await launchPlanFor(config, options, projectRoot, signal);
     const registration = await registerDevAgent({
+      projectRoot,
       client: options.registrationClient,
       devAgentId,
       configSource,
@@ -3204,13 +3389,19 @@ async function startBuddyDev(options) {
       buddyToken: registration.agentToken,
       gatewayUrl: registration.appServerUrl
     });
+    await writeProjectEnvironment(projectRoot, {
+      BUDDY_ID: environment.BUDDY_ID,
+      BUDDY_TOKEN: environment.BUDDY_TOKEN,
+      MLB_GATEWAY_URL: environment.MLB_GATEWAY_URL
+    });
+    const { BUDDY_ID: _id, BUDDY_TOKEN: _token, MLB_GATEWAY_URL: _gateway, ...childEnvironment } = environment;
     const launcher = options.processLauncher ?? new NodeAgentProcessLauncher();
     processTree = options.processTree ?? processTreeControllerFor(platform);
     agentProcess = await launcher.spawn({
       command: launchPlan.command,
       args: launchPlan.args,
       cwd: projectRoot,
-      env: environment,
+      env: childEnvironment,
       shell: false,
       detached: platform === "darwin",
       ...options.onLog === void 0 ? {} : {
@@ -3291,6 +3482,183 @@ function createBuddyDevStarter(options = {}) {
   });
 }
 
+// packages/cli-core/src/dev/token-store.ts
+import { createHash as createHash5 } from "node:crypto";
+
+// packages/cli-core/src/cloud/credential-store.ts
+import { spawn } from "node:child_process";
+var DEFAULT_SERVICE = "com.xiaohongshu.buddy.developer-cli";
+var DEFAULT_ACCOUNT = "developer-session";
+var MAX_CREDENTIAL_BYTES = 32 * 1024;
+function safeLabel(value, fallback, name) {
+  const result = value ?? fallback;
+  if (!result || result !== result.trim() || /[\u0000-\u001f\u007f]/u.test(result) || result.length > 256) {
+    throw new TypeError(`${name} is invalid`);
+  }
+  return result;
+}
+function serialize(token) {
+  const value = JSON.stringify(token);
+  if (Buffer.byteLength(value, "utf8") > MAX_CREDENTIAL_BYTES) {
+    throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u4E91\u7AEF\u4F1A\u8BDD\u51ED\u636E\u8FC7\u5927\uFF0C\u672A\u4FDD\u5B58");
+  }
+  return value;
+}
+function parse(source) {
+  if (Buffer.byteLength(source, "utf8") > MAX_CREDENTIAL_BYTES) {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  const record2 = value;
+  if (Object.keys(record2).length !== 3 || typeof record2.accessToken !== "string" || typeof record2.subject !== "string" || !Number.isSafeInteger(record2.expiresAt)) {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  return Object.freeze({
+    accessToken: record2.accessToken,
+    subject: record2.subject,
+    expiresAt: record2.expiresAt
+  });
+}
+async function runCredentialCommand(input) {
+  return await new Promise((resolve17, reject) => {
+    const child = spawn(input.command, [...input.args], {
+      shell: false,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const stdout = [];
+    const stderr = [];
+    let outputBytes = 0;
+    const collect = (target, chunk) => {
+      outputBytes += chunk.byteLength;
+      if (outputBytes <= MAX_CREDENTIAL_BYTES) target.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect(stdout, chunk));
+    child.stderr.on("data", (chunk) => collect(stderr, chunk));
+    child.once("error", reject);
+    child.once("close", (code2) => resolve17({
+      code: code2 ?? 1,
+      stdout: Buffer.concat(stdout).toString("utf8"),
+      stderr: Buffer.concat(stderr).toString("utf8")
+    }));
+    child.stdin.on("error", () => void 0);
+    child.stdin.end(input.input ?? "");
+  });
+}
+var SystemCredentialStore = class {
+  #platform;
+  #service;
+  #account;
+  #run;
+  constructor(options = {}) {
+    this.#platform = options.platform ?? process.platform;
+    this.#service = safeLabel(options.service, DEFAULT_SERVICE, "service");
+    this.#account = safeLabel(options.account, DEFAULT_ACCOUNT, "account");
+    this.#run = options.commandRunner ?? runCredentialCommand;
+    if (this.#platform !== "darwin") {
+      throw new CloudLifecycleError("INVALID_REQUEST", "\u642D\u642D CLI V1 \u7684\u5B89\u5168\u51ED\u636E\u5B58\u50A8\u76EE\u524D\u53EA\u652F\u6301 macOS Keychain");
+    }
+  }
+  async load() {
+    const result = await this.#run({
+      command: "security",
+      args: ["find-generic-password", "-s", this.#service, "-a", this.#account, "-w"]
+    });
+    if (result.code === 44) return void 0;
+    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u8BFB\u53D6 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u51ED\u636E");
+    const raw = result.stdout.trimEnd();
+    return /^(?:[a-fA-F0-9]{2})+$/u.test(raw) ? Buffer.from(raw, "hex").toString("utf8") : raw;
+  }
+  async save(source) {
+    if (!source || /[\u0000-\u001f\u007f]/u.test(source)) throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+    const line = ["add-generic-password", "-U", "-s", this.#service, "-a", this.#account, "-w", source].map((part) => `"${part.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`).join(" ") + "\n";
+    if (Buffer.byteLength(line, "utf8") >= 4096) {
+      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u51ED\u636E\u8D85\u8FC7 macOS \u5199\u5165\u957F\u5EA6\u9650\u5236\uFF0C\u672A\u4FDD\u5B58\uFF1B\u8BF7\u8054\u7CFB\u5E73\u53F0\u5904\u7406");
+    }
+    const result = await this.#run({
+      command: "security",
+      args: ["-i", "-q"],
+      input: line
+    });
+    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u628A\u642D\u642D\u51ED\u636E\u5199\u5165 macOS \u94A5\u5319\u4E32");
+    const saved = await this.load();
+    if (!saved || saved !== source) throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u51ED\u636E\u5199\u5165\u540E\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u8BD5");
+  }
+  async clear() {
+    const result = await this.#run({
+      command: "security",
+      args: ["delete-generic-password", "-s", this.#service, "-a", this.#account]
+    });
+    if (result.code !== 0 && result.code !== 44) {
+      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u6E05\u9664 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u51ED\u636E");
+    }
+  }
+};
+var SystemCloudTokenStore = class {
+  #store;
+  constructor(options = {}) {
+    this.#store = new SystemCredentialStore(options);
+  }
+  async load() {
+    const raw = await this.#store.load();
+    return raw === void 0 ? void 0 : parse(raw);
+  }
+  async save(token) {
+    await this.#store.save(serialize(token));
+  }
+  async clear() {
+    await this.#store.clear();
+  }
+};
+
+// packages/cli-core/src/dev/token-store.ts
+var SystemBuddyTokenStore = class {
+  #store;
+  constructor(options) {
+    if (![options.subject, options.buddyId].every((value) => value.trim() && !/[\u0000-\u001f\u007f]/u.test(value))) throw new TypeError("\u5F00\u53D1 Token \u7684\u8D26\u53F7\u548C\u642D\u5B50 ID \u65E0\u6548");
+    const scope = JSON.stringify([normalizePlatformUrl(options.platformUrl).origin, options.subject, options.buddyId]);
+    this.#store = new SystemCredentialStore({
+      service: "com.xiaohongshu.buddy.developer-cli.dev-token",
+      account: createHash5("sha256").update(scope).digest("hex"),
+      platform: options.platform,
+      commandRunner: options.commandRunner
+    });
+  }
+  async load() {
+    const raw = await this.#store.load();
+    if (raw === void 0) return void 0;
+    let value;
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      throw corrupt();
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value) || Object.keys(value).length !== 1 || !("token" in value)) throw corrupt();
+    return validateToken(value.token);
+  }
+  async save(token) {
+    await this.#store.save(JSON.stringify({ token: validateToken(token) }));
+  }
+  async clear() {
+    await this.#store.clear();
+  }
+};
+function corrupt() {
+  return new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u672C\u673A\u5F00\u53D1\u51ED\u636E\u683C\u5F0F\u65E0\u6548\uFF0C\u8BF7\u4F7F\u7528 --refresh-token \u91CD\u65B0\u9886\u53D6");
+}
+function validateToken(value) {
+  if (typeof value !== "string" || !value.trim() || /[\u0000-\u001f\u007f]/u.test(value) || value.length > 1024) throw corrupt();
+  return value;
+}
+
 // packages/cli-core/src/commands/dev.ts
 var DevCommandUsageError = class extends Error {
   constructor(message) {
@@ -3299,12 +3667,13 @@ var DevCommandUsageError = class extends Error {
   }
 };
 var DEV_COMMAND_HELP = `\u7528\u6CD5:
-  buddy-cli dev [--app-server <App Server URL>] [--directory <\u9879\u76EE\u76EE\u5F55>]
+  buddy-cli dev [--app-server <App Server URL>] [--directory <\u9879\u76EE\u76EE\u5F55>] [--refresh-token]
 
 \u8BF4\u660E:
   \u672A\u914D\u7F6E\u5730\u5740\u65F6\u8FDE\u63A5 MLB \u6D4B\u8BD5\u73AF\u5883 ${DEFAULT_MLB_TEST_URL}\uFF08HTTP \u4EC5\u9650\u6D4B\u8BD5\uFF09\u3002
   CLI \u7EDF\u4E00\u542F\u52A8\u5E76\u7BA1\u7406\u5DE5\u7A0B\u4E2D\u7684\u5B98\u65B9 Runtime\u3002
-  DEV \u4F1A\u901A\u8FC7\u6D4F\u89C8\u5668\u767B\u5F55\u83B7\u53D6\u5F00\u53D1\u8005\u4F1A\u8BDD\uFF0C\u518D\u8BFB\u53D6\u5F53\u524D buddy.agent.json \u4E2D\u7684 buddyId \u5BF9\u5E94\u7684 Buddy token\u3002`;
+  DEV \u4F1A\u901A\u8FC7\u6D4F\u89C8\u5668\u767B\u5F55\u83B7\u53D6\u5F00\u53D1\u8005\u4F1A\u8BDD\uFF0C\u5C06\u5F53\u524D\u642D\u5B50\u7684\u5F00\u53D1 Token \u5199\u5165\u5DE5\u7A0B .env\uFF0C\u540E\u7EED\u4F18\u5148\u590D\u7528\uFF1B\u767B\u5F55\u51ED\u636E\u4ECD\u4F7F\u7528\u7CFB\u7EDF\u51ED\u636E\u5B58\u50A8\u3002
+  --refresh-token \u91CD\u65B0\u9886\u53D6\u5DF2\u6709\u5F00\u53D1 Token\uFF0C\u7528\u4E8E\u670D\u52A1\u7AEF\u91CD\u7F6E\u540E\u7684\u672C\u673A\u66F4\u65B0\uFF1B\u4E0D\u4F1A\u751F\u6210\u65B0\u5BC6\u94A5\u3002`;
 function valueAfter(args, index, flag2) {
   const value = args[index + 1];
   if (value === void 0 || !value.trim()) throw new DevCommandUsageError(`${flag2} \u7F3A\u5C11\u503C`);
@@ -3319,6 +3688,7 @@ function parseDevArguments(args) {
   let directorySet = false;
   let appServer;
   let help = false;
+  let refreshToken = false;
   for (let index = 0; index < args.length; index += 1) {
     const flag2 = args[index];
     if (flag2 === "--help" || flag2 === "-h") {
@@ -3326,6 +3696,11 @@ function parseDevArguments(args) {
       help = true;
       continue;
     }
+    if (flag2 === "--refresh-token") {
+      if (refreshToken) throw new DevCommandUsageError("--refresh-token \u4E0D\u80FD\u91CD\u590D");
+      refreshToken = true;
+      continue;
+    }
     const value = valueAfter(args, index, flag2 ?? "\u53C2\u6570");
     index += 1;
     switch (flag2) {
@@ -3341,7 +3716,7 @@ function parseDevArguments(args) {
         throw new DevCommandUsageError(`\u672A\u77E5 dev \u53C2\u6570 ${flag2}`);
     }
   }
-  return { directory, appServer, help };
+  return { directory, appServer, help, refreshToken };
 }
 function appServerUrl(override, env) {
   try {
@@ -3375,7 +3750,7 @@ async function runDevCommand(args, io, options = {}) {
     const root = await (options.resolveProjectRoot ?? requireBuddyAgentProjectRoot)(requestedRoot);
     const environment = options.env ?? process.env;
     const url = appServerUrl(parsed.appServer, environment);
-    const authorizationInput = { appServerUrl: url };
+    const authorizationInput = { appServerUrl: url, ...parsed.refreshToken ? { refreshToken: true } : {} };
     if (!options.authorize) {
       throw new DevCommandUsageError("\u5F53\u524D CLI Host \u5C1A\u672A\u914D\u7F6E\u642D\u642D\u8D26\u53F7\u767B\u5F55 Adapter");
     }
@@ -3427,7 +3802,7 @@ async function runDevCommand(args, io, options = {}) {
 import { resolve as resolve13 } from "node:path";
 
 // packages/cli-core/src/cloud/auth.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 
 // packages/cli-core/src/cloud/validation.ts
 function record(value, path = "request") {
@@ -3478,7 +3853,7 @@ var MemoryCloudTokenStore = class {
     return this.#token === void 0 ? void 0 : frozenClone(this.#token);
   }
   async save(token) {
-    this.#token = validateToken(token);
+    this.#token = validateToken2(token);
   }
   async clear() {
     this.#token = void 0;
@@ -3495,7 +3870,7 @@ var CloudAuthenticator = class {
     this.#adapter = adapter;
     this.#store = store;
     this.#now = options.now ?? Date.now;
-    this.#createState = options.createState ?? randomUUID6;
+    this.#createState = options.createState ?? randomUUID7;
     this.#minimumValidityMs = options.minimumValidityMs ?? 3e4;
     if (!Number.isSafeInteger(this.#minimumValidityMs) || this.#minimumValidityMs < 0) {
       throw new TypeError("minimumValidityMs must be a non-negative safe integer");
@@ -3534,7 +3909,7 @@ var CloudAuthenticator = class {
     }
     if (stored === void 0) return void 0;
     try {
-      const token = validateToken(stored);
+      const token = validateToken2(stored);
       if (token.expiresAt > this.#now() + this.#minimumValidityMs) return token;
     } catch {
     }
@@ -3555,7 +3930,7 @@ var CloudAuthenticator = class {
         "\u6D4F\u89C8\u5668\u767B\u5F55\u8FD4\u56DE\u7684 state \u4E0D\u5339\u914D\uFF1B\u51ED\u636E\u672A\u4FDD\u5B58"
       );
     }
-    const token = validateToken(resultRecord.token);
+    const token = validateToken2(resultRecord.token);
     if (token.expiresAt <= this.#now() + this.#minimumValidityMs) {
       throw new CloudLifecycleError("AUTH_TOKEN_EXPIRED", "\u6D4F\u89C8\u5668\u767B\u5F55\u8FD4\u56DE\u4E86\u5DF2\u8FC7\u671F\u6216\u5373\u5C06\u8FC7\u671F\u7684\u4F1A\u8BDD");
     }
@@ -3563,7 +3938,7 @@ var CloudAuthenticator = class {
     return token;
   }
 };
-function validateToken(value) {
+function validateToken2(value) {
   try {
     const input = record(value, "cloud token");
     exactKeys(input, ["accessToken", "subject", "expiresAt"], [], "cloud token");
@@ -3597,17 +3972,17 @@ function positiveTimeout(value, fallback, name) {
 }
 function object3(value, path) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw invalid(`${path} \u5FC5\u987B\u662F\u5BF9\u8C61`);
+    throw invalid2(`${path} \u5FC5\u987B\u662F\u5BF9\u8C61`);
   }
   return value;
 }
-function invalid(message) {
+function invalid2(message) {
   return new CloudLifecycleError("PLATFORM_RESPONSE_INVALID", message);
 }
 function safeText(value, path, allowNewlines = false, allowEmpty = false) {
-  if (typeof value !== "string" || !allowEmpty && !value.trim()) throw invalid(`${path} \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32`);
+  if (typeof value !== "string" || !allowEmpty && !value.trim()) throw invalid2(`${path} \u5FC5\u987B\u662F\u975E\u7A7A\u5B57\u7B26\u4E32`);
   const invalidControl = allowNewlines ? /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u : /[\u0000-\u001f\u007f]/u;
-  if (invalidControl.test(value)) throw invalid(`${path} \u5305\u542B\u975E\u6CD5\u63A7\u5236\u5B57\u7B26`);
+  if (invalidControl.test(value)) throw invalid2(`${path} \u5305\u542B\u975E\u6CD5\u63A7\u5236\u5B57\u7B26`);
   return value;
 }
 function optionalText(value, path, allowNewlines = false) {
@@ -3629,23 +4004,23 @@ function meta(value, path) {
   });
 }
 function flag(value, path) {
-  if (typeof value !== "boolean") throw invalid(`${path} \u5FC5\u987B\u662F boolean`);
+  if (typeof value !== "boolean") throw invalid2(`${path} \u5FC5\u987B\u662F boolean`);
   return value;
 }
 function timestamp(value, path) {
-  if (!Number.isSafeInteger(value) || value < 0) throw invalid(`${path} \u5FC5\u987B\u662F\u975E\u8D1F\u6BEB\u79D2\u65F6\u95F4\u6233`);
+  if (!Number.isSafeInteger(value) || value < 0) throw invalid2(`${path} \u5FC5\u987B\u662F\u975E\u8D1F\u6BEB\u79D2\u65F6\u95F4\u6233`);
   return value;
 }
 function nullableText(value, path) {
   return value === null ? null : safeText(value, path);
 }
 function nonNegativeInteger(value, path) {
-  if (!Number.isSafeInteger(value) || value < 0) throw invalid(`${path} \u5FC5\u987B\u662F\u975E\u8D1F\u6574\u6570`);
+  if (!Number.isSafeInteger(value) || value < 0) throw invalid2(`${path} \u5FC5\u987B\u662F\u975E\u8D1F\u6574\u6570`);
   return value;
 }
 function auditStatus(value, path) {
   if (value !== "auditing" && value !== "approved" && value !== "rejected") {
-    throw invalid(`${path} \u5FC5\u987B\u662F auditing\u3001approved \u6216 rejected`);
+    throw invalid2(`${path} \u5FC5\u987B\u662F auditing\u3001approved \u6216 rejected`);
   }
   return value;
 }
@@ -3693,7 +4068,7 @@ async function boundedJson(response) {
       total += item.value.byteLength;
       if (total > MAX_RESPONSE_BYTES) {
         void reader.cancel().catch(() => void 0);
-        throw invalid("\u5E73\u53F0\u54CD\u5E94\u8D85\u8FC7 1 MiB");
+        throw invalid2("\u5E73\u53F0\u54CD\u5E94\u8D85\u8FC7 1 MiB");
       }
       chunks.push(item.value);
     }
@@ -3709,7 +4084,7 @@ async function boundedJson(response) {
   try {
     return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
   } catch {
-    throw invalid("\u5E73\u53F0\u54CD\u5E94\u4E0D\u662F\u6709\u6548 JSON");
+    throw invalid2("\u5E73\u53F0\u54CD\u5E94\u4E0D\u662F\u6709\u6548 JSON");
   }
 }
 function serverError(response, body) {
@@ -3780,7 +4155,7 @@ var HttpDeveloperPlatformClient = class {
     const mediaType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
     if (mediaType !== "application/json") {
       await response.body?.cancel().catch(() => void 0);
-      throw invalid(`\u5E73\u53F0\u54CD\u5E94 Content-Type \u65E0\u6548\uFF08HTTP ${response.status}\uFF09`);
+      throw invalid2(`\u5E73\u53F0\u54CD\u5E94 Content-Type \u65E0\u6548\uFF08HTTP ${response.status}\uFF09`);
     }
     const payload = await boundedJson(response);
     if (!response.ok) throw serverError(response, payload);
@@ -3805,7 +4180,7 @@ var HttpDeveloperPlatformClient = class {
   }
   async listBuddies() {
     const source = object3(await this.#request("/cli/buddies", "GET"), "response");
-    if (!Array.isArray(source.buddies)) throw invalid("response.buddies \u5FC5\u987B\u662F\u6570\u7EC4");
+    if (!Array.isArray(source.buddies)) throw invalid2("response.buddies \u5FC5\u987B\u662F\u6570\u7EC4");
     return Object.freeze({
       buddies: Object.freeze(source.buddies.map((item) => buddy(item, false)))
     });
@@ -3825,7 +4200,7 @@ var HttpDeveloperPlatformClient = class {
       `/cli/buddies/${encodeURIComponent(request.id)}/packages${suffix}`,
       "GET"
     ), "response");
-    if (!Array.isArray(source.items)) throw invalid("response.items \u5FC5\u987B\u662F\u6570\u7EC4");
+    if (!Array.isArray(source.items)) throw invalid2("response.items \u5FC5\u987B\u662F\u6570\u7EC4");
     return Object.freeze({
       total: nonNegativeInteger(source.total, "response.total"),
       page: nonNegativeInteger(source.page, "response.page"),
@@ -3861,13 +4236,13 @@ var HttpDeveloperPlatformClient = class {
   }
   async logout(accessToken) {
     const source = object3(await this.#request("/cli/auth/logout", "POST", { accessToken }), "response");
-    if (source.ok !== true) throw invalid("response.ok \u5FC5\u987B\u662F true");
+    if (source.ok !== true) throw invalid2("response.ok \u5FC5\u987B\u662F true");
   }
 };
 
 // packages/cli-core/src/cloud/browser-login.ts
-import { createHash as createHash5, randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
+import { createHash as createHash6, randomBytes } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
 import { createServer } from "node:http";
 
 // packages/cli-core/src/cloud/login-result.ts
@@ -3927,7 +4302,7 @@ function browserCommand(url) {
 async function openExternalUrl(url) {
   const launch = browserCommand(url);
   await new Promise((resolve17, reject) => {
-    const child = spawn(launch.command, launch.args, { shell: false, stdio: "ignore", windowsHide: true });
+    const child = spawn2(launch.command, launch.args, { shell: false, stdio: "ignore", windowsHide: true });
     child.once("error", reject);
     child.once("exit", (code2) => code2 === 0 ? resolve17() : reject(new Error(`browser launcher exited with ${code2 ?? "unknown"}`)));
   });
@@ -3974,7 +4349,7 @@ var LoopbackBrowserLoginAdapter = class {
     if (request.signal?.aborted) throw request.signal.reason;
     const callbackSecret = randomBytes(24).toString("hex");
     const codeVerifier = randomBytes(32).toString("base64url");
-    const codeChallenge = createHash5("sha256").update(codeVerifier).digest("base64url");
+    const codeChallenge = createHash6("sha256").update(codeVerifier).digest("base64url");
     let requestId = "";
     let settle;
     let reject;
@@ -4110,126 +4485,8 @@ var LoopbackBrowserLoginAdapter = class {
   }
 };
 
-// packages/cli-core/src/cloud/credential-store.ts
-import { spawn as spawn2 } from "node:child_process";
-var DEFAULT_SERVICE = "com.xiaohongshu.buddy.developer-cli";
-var DEFAULT_ACCOUNT = "developer-session";
-var MAX_CREDENTIAL_BYTES = 32 * 1024;
-function safeLabel(value, fallback, name) {
-  const result = value ?? fallback;
-  if (!result || result !== result.trim() || /[\u0000-\u001f\u007f]/u.test(result) || result.length > 256) {
-    throw new TypeError(`${name} is invalid`);
-  }
-  return result;
-}
-function serialize(token) {
-  const value = JSON.stringify(token);
-  if (Buffer.byteLength(value, "utf8") > MAX_CREDENTIAL_BYTES) {
-    throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u4E91\u7AEF\u4F1A\u8BDD\u51ED\u636E\u8FC7\u5927\uFF0C\u672A\u4FDD\u5B58");
-  }
-  return value;
-}
-function parse(source) {
-  if (Buffer.byteLength(source, "utf8") > MAX_CREDENTIAL_BYTES) {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  let value;
-  try {
-    value = JSON.parse(source);
-  } catch {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  const record2 = value;
-  if (Object.keys(record2).length !== 3 || typeof record2.accessToken !== "string" || typeof record2.subject !== "string" || !Number.isSafeInteger(record2.expiresAt)) {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  return Object.freeze({
-    accessToken: record2.accessToken,
-    subject: record2.subject,
-    expiresAt: record2.expiresAt
-  });
-}
-async function runCredentialCommand(input) {
-  return await new Promise((resolve17, reject) => {
-    const child = spawn2(input.command, [...input.args], {
-      shell: false,
-      windowsHide: true,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const stdout = [];
-    const stderr = [];
-    let outputBytes = 0;
-    const collect = (target, chunk) => {
-      outputBytes += chunk.byteLength;
-      if (outputBytes <= MAX_CREDENTIAL_BYTES) target.push(chunk);
-    };
-    child.stdout.on("data", (chunk) => collect(stdout, chunk));
-    child.stderr.on("data", (chunk) => collect(stderr, chunk));
-    child.once("error", reject);
-    child.once("close", (code2) => resolve17({
-      code: code2 ?? 1,
-      stdout: Buffer.concat(stdout).toString("utf8"),
-      stderr: Buffer.concat(stderr).toString("utf8")
-    }));
-    child.stdin.on("error", () => void 0);
-    child.stdin.end(input.input ?? "");
-  });
-}
-var SystemCloudTokenStore = class {
-  #platform;
-  #service;
-  #account;
-  #run;
-  constructor(options = {}) {
-    this.#platform = options.platform ?? process.platform;
-    this.#service = safeLabel(options.service, DEFAULT_SERVICE, "service");
-    this.#account = safeLabel(options.account, DEFAULT_ACCOUNT, "account");
-    this.#run = options.commandRunner ?? runCredentialCommand;
-    if (this.#platform !== "darwin") {
-      throw new CloudLifecycleError("INVALID_REQUEST", "\u642D\u642D CLI V1 \u7684\u5B89\u5168\u767B\u5F55\u5B58\u50A8\u76EE\u524D\u53EA\u652F\u6301 macOS Keychain");
-    }
-  }
-  async load() {
-    const result = await this.#run({
-      command: "security",
-      args: ["find-generic-password", "-s", this.#service, "-a", this.#account, "-w"]
-    });
-    if (result.code === 44) return void 0;
-    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u8BFB\u53D6 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u767B\u5F55\u72B6\u6001");
-    const raw = result.stdout.trimEnd();
-    return parse(/^(?:[a-fA-F0-9]{2})+$/u.test(raw) ? Buffer.from(raw, "hex").toString("utf8") : raw);
-  }
-  async save(token) {
-    const source = serialize(token);
-    const line = ["add-generic-password", "-U", "-s", this.#service, "-a", this.#account, "-w", source].map((part) => `"${part.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`).join(" ") + "\n";
-    if (Buffer.byteLength(line, "utf8") >= 4096) {
-      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u767B\u5F55\u51ED\u636E\u8D85\u8FC7 macOS \u5199\u5165\u957F\u5EA6\u9650\u5236\uFF0C\u672A\u4FDD\u5B58\uFF1B\u8BF7\u8054\u7CFB\u5E73\u53F0\u5904\u7406");
-    }
-    const result = await this.#run({
-      command: "security",
-      args: ["-i", "-q"],
-      input: line
-    });
-    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u628A\u642D\u642D\u767B\u5F55\u72B6\u6001\u5199\u5165 macOS \u94A5\u5319\u4E32");
-    const saved = await this.load();
-    if (!saved || serialize(saved) !== source) throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u767B\u5F55\u51ED\u636E\u5199\u5165\u540E\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");
-  }
-  async clear() {
-    const result = await this.#run({
-      command: "security",
-      args: ["delete-generic-password", "-s", this.#service, "-a", this.#account]
-    });
-    if (result.code !== 0 && result.code !== 44) {
-      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u6E05\u9664 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u767B\u5F55\u72B6\u6001");
-    }
-  }
-};
-
 // packages/cli-core/src/cloud/mock-client.ts
-import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
 var MockDeveloperPlatformClient = class {
   #now;
   #buddies = /* @__PURE__ */ new Map();
@@ -4257,7 +4514,7 @@ var MockDeveloperPlatformClient = class {
     const current = this.#require(request.id);
     validateBuddyMetaUpdate(request.meta);
     const onlyAvatar = Object.keys(request.meta).every((key) => key === "avatar");
-    const avatar = request.avatar ? `/media/avatar-${request.id}.webp?v=${createHash6("sha256").update(request.avatar.bytes).digest("hex").slice(0, 16)}` : request.meta.avatar === null ? null : current.meta?.avatar ?? null;
+    const avatar = request.avatar ? `/media/avatar-${request.id}.webp?v=${createHash7("sha256").update(request.avatar.bytes).digest("hex").slice(0, 16)}` : request.meta.avatar === null ? null : current.meta?.avatar ?? null;
     const next = this.#value({ ...current, meta: { ...onlyAvatar ? current.meta : request.meta, avatar }, updatedAt: this.#now() });
     this.#buddies.set(request.id, next);
     return structuredClone(next);
@@ -4554,8 +4811,8 @@ async function runCloudCommand(command, args, io, options = {}) {
 var CLOUD_COMMAND_HELP = HELP;
 
 // packages/cli-core/src/migration/index.ts
-import { lstat as lstat9, open as open4, readdir as readdir4, realpath as realpath3, stat } from "node:fs/promises";
-import { extname, isAbsolute as isAbsolute2, join as join12, relative, resolve as resolve14, sep, win32 as win322 } from "node:path";
+import { lstat as lstat9, open as open5, readdir as readdir4, realpath as realpath3, stat } from "node:fs/promises";
+import { extname, isAbsolute as isAbsolute2, join as join13, relative, resolve as resolve14, sep, win32 as win322 } from "node:path";
 var DEFAULT_SKILL_SCAN_LIMITS = Object.freeze({
   maxFiles: 128,
   maxFileBytes: 256 * 1024,
@@ -4724,7 +4981,7 @@ async function existingProjectRoot(value) {
   }
 }
 async function existingSkillRoot(projectRoot, skillPath) {
-  const candidate = skillPath === "." ? projectRoot : join12(projectRoot, ...skillPath.split("/"));
+  const candidate = skillPath === "." ? projectRoot : join13(projectRoot, ...skillPath.split("/"));
   try {
     await lstat9(candidate);
   } catch (cause) {
@@ -4761,7 +5018,7 @@ async function existingSkillRoot(projectRoot, skillPath) {
 }
 async function assertEntrypoint(context) {
   const entryPath = reportChild(context.skillPath, "SKILL.md");
-  const candidate = join12(context.skillRoot, "SKILL.md");
+  const candidate = join13(context.skillRoot, "SKILL.md");
   try {
     await lstat9(candidate);
     const target = await realpath3(candidate);
@@ -4865,7 +5122,7 @@ async function walkDirectory(actualDirectory, reportDirectory, ancestors, contex
   }
   for (const entry2 of entries) {
     const childReportPath = reportChild(reportDirectory, entry2.name);
-    const childPath = join12(directory, entry2.name);
+    const childPath = join13(directory, entry2.name);
     let target;
     try {
       target = await realpath3(childPath);
@@ -4907,7 +5164,7 @@ async function scanFile(actualPath, reportPath, context) {
   }
   let handle;
   try {
-    handle = await open4(actualPath, "r");
+    handle = await open5(actualPath, "r");
   } catch (cause) {
     return rejectScan("SKILL_SCAN_IO_ERROR", reportPath, "\u65E0\u6CD5\u6253\u5F00 Skill \u6587\u4EF6\u3002", cause);
   }
@@ -5319,9 +5576,9 @@ async function scanExternalSkillPortability(options) {
 }
 
 // packages/cli-core/src/push/preflight.ts
-import { createHash as createHash7 } from "node:crypto";
-import { lstat as lstat10, open as open5, readdir as readdir5, realpath as realpath4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join13, relative as relative2, resolve as resolve15, sep as sep2, win32 as win323 } from "node:path";
+import { createHash as createHash8 } from "node:crypto";
+import { lstat as lstat10, open as open6, readdir as readdir5, realpath as realpath4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join14, relative as relative2, resolve as resolve15, sep as sep2, win32 as win323 } from "node:path";
 
 // packages/cli-core/src/push/errors.ts
 var PushPreflightError = class extends Error {
@@ -5419,7 +5676,7 @@ function error(options) {
   throw new PushPreflightError(options);
 }
 function sha256(value) {
-  return `sha256:${createHash7("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash8("sha256").update(value).digest("hex")}`;
 }
 function positiveLimit(value, name, hardMaximum) {
   if (!Number.isSafeInteger(value) || value < 1 || value > hardMaximum) {
@@ -5540,7 +5797,7 @@ async function canonicalProjectRoot(projectRoot) {
   }
 }
 async function captureConfigWithinLimit(projectRoot, maxFileBytes, filename) {
-  const path = join13(projectRoot, filename);
+  const path = join14(projectRoot, filename);
   let entry2;
   try {
     entry2 = await lstat10(path);
@@ -5650,7 +5907,7 @@ function sameFileIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
 async function hashRegularFile(options) {
-  const handle = await open5(options.absolutePath, "r").catch((cause) => error({
+  const handle = await open6(options.absolutePath, "r").catch((cause) => error({
     code: "PUSH_PROJECT_INVALID",
     path: options.portablePath,
     message: `\u65E0\u6CD5\u8BFB\u53D6\u63D0\u4EA4\u6587\u4EF6\uFF1A${options.portablePath}`,
@@ -5665,7 +5922,7 @@ async function hashRegularFile(options) {
         message: `\u751F\u6210\u6E05\u5355\u65F6\u6587\u4EF6\u53D1\u751F\u53D8\u5316\uFF1A${options.portablePath}`
       });
     }
-    const hash3 = createHash7("sha256");
+    const hash3 = createHash8("sha256");
     const captured = [];
     const buffer = Buffer.allocUnsafe(READ_BUFFER_BYTES);
     let bytes = 0;
@@ -5743,7 +6000,7 @@ async function createManifest(options) {
         sensitiveEntriesExcluded += 1;
         continue;
       }
-      const absolutePath = join13(directory, name);
+      const absolutePath = join14(directory, name);
       let entry2;
       try {
         entry2 = await lstat10(absolutePath);
@@ -5969,11 +6226,12 @@ function assertOfficialProjectIncluded(files) {
       message: `package.json \u7684 dependencies \u5FC5\u987B\u58F0\u660E ${BUDDY_RUNTIME_PACKAGE} \u7684\u51C6\u786E\u7248\u672C\uFF0C\u5E76\u63D0\u4EA4\u76F8\u5E94\u9501\u6587\u4EF6\u3002`
     });
   }
-  if (typeof pkg !== "object" || pkg === null || Array.isArray(pkg) || !("scripts" in pkg) || typeof pkg.scripts !== "object" || pkg.scripts === null || !("start" in pkg.scripts) || pkg.scripts.start !== `node ${BUDDY_PLATFORM_START_ENTRY}`) {
+  const expectedStart = `node ${runtimeUsesEnvironmentIdentity(pkg) ? "--env-file-if-exists=.env " : ""}${BUDDY_PLATFORM_START_ENTRY}`;
+  if (typeof pkg !== "object" || pkg === null || Array.isArray(pkg) || !("scripts" in pkg) || typeof pkg.scripts !== "object" || pkg.scripts === null || !("start" in pkg.scripts) || pkg.scripts.start !== expectedStart) {
     error({
       code: "PUSH_PROJECT_INVALID",
       path: BUDDY_PLATFORM_PACKAGE_JSON,
-      message: `\u5B98\u65B9 Runtime \u5DE5\u7A0B\u7684 package.json \u5FC5\u987B\u8BBE\u7F6E scripts.start \u4E3A "node ${BUDDY_PLATFORM_START_ENTRY}"\uFF0C\u4F7F\u4E91\u7AEF\u4E0E\u672C\u5730\u4F7F\u7528\u540C\u4E00\u542F\u52A8\u5165\u53E3\u3002`
+      message: `\u5B98\u65B9 Runtime \u5DE5\u7A0B\u7684 package.json \u5FC5\u987B\u8BBE\u7F6E scripts.start \u4E3A "${expectedStart}"\uFF0C\u4F7F\u4E91\u7AEF\u4E0E\u672C\u5730\u4F7F\u7528\u540C\u4E00\u542F\u52A8\u5165\u53E3\u3002`
     });
   }
 }
@@ -5995,7 +6253,7 @@ async function assertCapturedConfigStable(options) {
   }
   let current;
   try {
-    const path = join13(options.projectRoot, options.filename);
+    const path = join14(options.projectRoot, options.filename);
     const entry2 = await lstat10(path);
     if (!entry2.isFile() || entry2.isSymbolicLink()) {
       error({
@@ -6124,16 +6382,16 @@ async function createPushPreflight(options) {
 }
 
 // packages/cli-core/src/push/bundle.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { lstat as lstat11, readFile as readFile11, realpath as realpath5 } from "node:fs/promises";
-import { join as join14, relative as relative3, sep as sep3, win32 as win324 } from "node:path";
+import { join as join15, relative as relative3, sep as sep3, win32 as win324 } from "node:path";
 import { Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
 import { pack } from "tar-stream";
 var MEDIA_TYPE = "application/gzip";
 function digest2(bytes) {
-  return `sha256:${createHash8("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash9("sha256").update(bytes).digest("hex")}`;
 }
 function changed(path, message, cause) {
   throw new PushPreflightError({
@@ -6148,7 +6406,7 @@ function inside(root, target) {
   return path === "" || path !== ".." && !path.startsWith(`..${sep3}`) && !path.startsWith("/") && !win324.isAbsolute(path);
 }
 async function capture(root, file) {
-  const absolute = join14(root, ...file.path.split("/"));
+  const absolute = join15(root, ...file.path.split("/"));
   try {
     const entry2 = await lstat11(absolute);
     if (!entry2.isFile() || entry2.isSymbolicLink() || entry2.size !== file.bytes) {
@@ -6182,7 +6440,7 @@ async function createPushSourceBundle(plan) {
     schemaVersion: "1",
     files: files.map((file) => ({ path: file.path, bytes: file.bytes, digest: file.digest }))
   });
-  const calculatedBundleDigest = `sha256:${createHash8("sha256").update(`buddy-push-bundle-v1\0${descriptor}`).digest("hex")}`;
+  const calculatedBundleDigest = `sha256:${createHash9("sha256").update(`buddy-push-bundle-v1\0${descriptor}`).digest("hex")}`;
   if (calculatedBundleDigest !== plan.bundleDigest) {
     changed(plan.projectRoot, "\u63D0\u4EA4\u6E05\u5355\u8EAB\u4EFD\u5728\u6253\u5305\u524D\u53D1\u751F\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C push");
   }
@@ -6607,7 +6865,7 @@ async function resumeProjectArguments(args, cwd, options) {
   await assertInitializableBuddyTarget(root);
   let entry2;
   try {
-    entry2 = await lstat12(join15(root, "buddy.agent.json"));
+    entry2 = await lstat12(join16(root, "buddy.agent.json"));
   } catch (cause) {
     if (cause.code === "ENOENT") {
       const draft = await readMetaDraft(root);
@@ -6840,6 +7098,7 @@ export {
   PromptCancelledError,
   PushPreflightError,
   SkillPortabilityScanError,
+  SystemBuddyTokenStore,
   SystemCloudTokenStore,
   abortedDevError,
   applyBuddyDraftInitialization,
@@ -6861,6 +7120,7 @@ export {
   isSafeProjectRelativePath,
   isWindowsReservedPathSegment,
   latestRuntimeTemplate,
+  migrateRuntimeStartup,
   normalizePlatformUrl,
   openExternalUrl,
   parseBuddyAgentConfig,