@my-life-buddies/cli 0.6.0 → 0.9.0

package/dist/bin/core.js

@@ -1,53 +1,106 @@
-// packages/cli-core/src/config/models.ts
-var MODEL_IDS = Object.freeze([
-  "kimi-k2.6",
-  "kimi-k3",
-  "deepseek-v4-flash",
-  "deepseek-v4-pro"
-]);
-var DEFAULT_MODEL_ID = MODEL_IDS[0];
-
 // packages/cli-core/src/commands/models.ts
-var MODELS_COMMAND_HELP = `\u7528\u6CD5: buddy-cli models [--json]
-\u67E5\u770B CLI \u5185\u7F6E\u7684\u6A21\u578B ID\uFF0C\u65E0\u9700\u767B\u5F55\u3001\u8054\u7F51\u6216 Agent \u5DE5\u7A0B\u3002
-\u5C06\u6240\u9009 ID \u5199\u5165 buddy.agent.json.model\uFF1B\u6A21\u677F\u5728 initialState.model \u4E2D\u4F7F\u7528\u5B83\u3002`;
-function runModelsCommand(args, io) {
-  if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
-    io.write(MODELS_COMMAND_HELP);
-  } else if (args.length === 1 && args[0] === "--json") {
-    io.write(JSON.stringify({ models: MODEL_IDS }, null, 2));
-  } else if (args.length === 0) {
-    io.write("CLI \u5185\u7F6E\u6A21\u578B\u76EE\u5F55\uFF08Runtime 0.11.0\uFF09\uFF1A");
-    for (const id of MODEL_IDS) io.write(`- ${id}`);
-    io.write("\u5C06\u6240\u9009 ID \u5199\u5165 buddy.agent.json.model\uFF1B\u672A\u8BBE\u7F6E\u65F6\u6A21\u677F\u4F7F\u7528 kimi-k2.6\u3002\u81EA\u5B9A\u4E49\u4F1A\u8BDD\u5DE5\u5382\u4E5F\u53EF\u6309\u4F1A\u8BDD\u8BBE\u7F6E initialState.model\u3002");
-  } else {
-    io.writeError(`models \u53C2\u6570\u65E0\u6548\u3002
-${MODELS_COMMAND_HELP}`);
-    return { exitCode: 2 };
-  }
-  return { exitCode: 0 };
+import { resolve as resolve5 } from "node:path";
+
+// packages/cli-core/src/config/runtime-catalog.ts
+import { readFile, realpath } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+// packages/cli-core/src/config/runtime-dependency.ts
+var BUDDY_RUNTIME_PACKAGE = "@my-life-buddies/buddy-runtime";
+function runtimeDependencyVersion(pkg) {
+  if (typeof pkg !== "object" || pkg === null || !("dependencies" in pkg)) return void 0;
+  const dependencies2 = pkg.dependencies;
+  if (typeof dependencies2 !== "object" || dependencies2 === null || !(BUDDY_RUNTIME_PACKAGE in dependencies2)) return void 0;
+  const version = dependencies2[BUDDY_RUNTIME_PACKAGE];
+  return typeof version === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(version) ? version : void 0;
 }
 
-// packages/cli-core/src/commands/widgets.ts
-import { resolve as resolve5 } from "node:path";
+// packages/cli-core/src/config/runtime-catalog.ts
+async function loadRuntime(projectRoot) {
+  const packagePath = resolve(projectRoot, "package.json");
+  const expected = runtimeDependencyVersion(JSON.parse(await readFile(packagePath, "utf8")));
+  if (!expected) throw new Error(`package.json \u5FC5\u987B\u58F0\u660E ${BUDDY_RUNTIME_PACKAGE} \u7684\u51C6\u786E\u7248\u672C`);
+  const projectRequire = createRequire(packagePath);
+  let runtimePath;
+  try {
+    const installedPath = await realpath(resolve(projectRoot, "node_modules", BUDDY_RUNTIME_PACKAGE, "package.json"));
+    if (await realpath(projectRequire.resolve(`${BUDDY_RUNTIME_PACKAGE}/package.json`)) !== installedPath) {
+      throw new Error("Runtime \u5FC5\u987B\u5B89\u88C5\u5728\u5F53\u524D\u5DE5\u7A0B\u4E2D");
+    }
+    const installed = JSON.parse(await readFile(installedPath, "utf8"));
+    if (installed.version !== expected) throw new Error(`\u5DF2\u5B89\u88C5 ${installed.version}\uFF0C\u5DE5\u7A0B\u8981\u6C42 ${expected}`);
+    runtimePath = projectRequire.resolve(BUDDY_RUNTIME_PACKAGE);
+  } catch (cause) {
+    throw new Error(`\u5DE5\u7A0B\u7684 Runtime \u4F9D\u8D56\u672A\u6B63\u786E\u5B89\u88C5\uFF0C\u8BF7\u6309\u9501\u6587\u4EF6\u5B89\u88C5\u4F9D\u8D56\uFF1A${cause instanceof Error ? cause.message : String(cause)}`);
+  }
+  const runtime = await import(pathToFileURL(runtimePath).href);
+  return { runtime, runtimeVersion: expected, runtimePath };
+}
+async function readRuntimeDataCatalog(projectRoot) {
+  const { runtime, runtimeVersion: expected } = await loadRuntime(projectRoot);
+  const catalog = runtime.DATA_ACCESS_CAPABILITIES;
+  if (!Array.isArray(catalog)) {
+    throw new Error(`\u5DE5\u7A0B\u7684 Runtime ${expected} \u672A\u5BFC\u51FA DATA_ACCESS_CAPABILITIES\uFF0C\u8BF7\u4F7F\u7528\u5305\u542B\u6570\u636E\u76EE\u5F55\u7684\u65B0 Runtime \u5305\u3002`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const datasets = catalog.map((value) => {
+    if (!value || typeof value !== "object") throw new Error("Runtime \u6570\u636E\u76EE\u5F55\u683C\u5F0F\u65E0\u6548");
+    const item = value;
+    if (typeof item.id !== "string" || !item.id.trim() || seen.has(item.id) || typeof item.title !== "string" || !item.title.trim() || typeof item.source !== "string" || !item.source.trim() || !Number.isSafeInteger(item.schemaVersion) || item.schemaVersion < 1) {
+      throw new Error("Runtime \u6570\u636E\u76EE\u5F55\u683C\u5F0F\u65E0\u6548\u6216\u5305\u542B\u91CD\u590D ID");
+    }
+    seen.add(item.id);
+    return Object.freeze({ id: item.id, title: item.title, source: item.source, schemaVersion: item.schemaVersion });
+  });
+  return Object.freeze({ runtimeVersion: expected, datasets: Object.freeze(datasets) });
+}
+async function readRuntimeModelCatalog(projectRoot) {
+  const { runtime, runtimeVersion, runtimePath } = await loadRuntime(projectRoot);
+  let models = runtime.MODEL_IDS;
+  if (models === void 0) {
+    try {
+      models = (await import(new URL("./model.js", pathToFileURL(runtimePath)).href)).MODEL_IDS;
+    } catch (cause) {
+      throw new Error(`Runtime ${runtimeVersion} \u7684\u6A21\u578B\u76EE\u5F55\u4E0D\u53EF\u8BFB\u53D6\uFF1A${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+  }
+  if (!Array.isArray(models) || models.length === 0 || models.some((id) => typeof id !== "string" || !id.trim()) || new Set(models).size !== models.length) {
+    throw new Error(`Runtime ${runtimeVersion} \u7684 MODEL_IDS \u7F3A\u5931\u6216\u683C\u5F0F\u65E0\u6548`);
+  }
+  return Object.freeze({ runtimeVersion, models: Object.freeze([...models]) });
+}
+async function validateRuntimeModel(projectRoot, model) {
+  if (model === void 0) return;
+  const catalog = await readRuntimeModelCatalog(projectRoot);
+  if (!catalog.models.includes(model)) throw new Error(`/model\uFF1A\u5DE5\u7A0B Runtime ${catalog.runtimeVersion} \u4E0D\u652F\u6301 ${model}\uFF1B\u53EF\u9009 ${catalog.models.join("\u3001")}`);
+}
+async function validateRuntimeDatasets(projectRoot, requirements = []) {
+  const catalog = await readRuntimeDataCatalog(projectRoot);
+  const ids = new Set(catalog.datasets.map((item) => item.id));
+  for (const [index, item] of requirements.entries()) {
+    if (!ids.has(item.id)) throw new Error(`/datasets/${index}/id\uFF1A\u5DE5\u7A0B Runtime ${catalog.runtimeVersion} \u4E0D\u652F\u6301 ${item.id}`);
+  }
+}
 
 // packages/cli-core/src/project-context.ts
-import { lstat as lstat4, realpath } from "node:fs/promises";
-import { dirname, join as join3, resolve as resolve3 } from "node:path";
+import { lstat as lstat5, realpath as realpath2 } from "node:fs/promises";
+import { dirname, join as join5, resolve as resolve4 } from "node:path";
 
 // packages/cli-core/src/config/index.ts
 import {
   link,
-  lstat as lstat3,
-  mkdir as mkdir2,
+  lstat as lstat4,
+  mkdir as mkdir3,
   open as open2,
-  readFile as readFile2,
+  readFile as readFile5,
   readdir,
-  rename,
+  rename as rename2,
   unlink as unlink2
 } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { isAbsolute, join as join2, resolve as resolve2, win32 } from "node:path";
+import { isAbsolute, join as join4, resolve as resolve3, win32 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { Ajv2020 } from "ajv/dist/2020.js";
 
@@ -78,7 +131,7 @@ var buddy_agent_schema_default = {
       minLength: 1,
       maxLength: 128,
       pattern: "^[^\\s\\u0000-\\u001f\\u007f]+$",
-      description: "\u4ECE buddy-cli models \u79BB\u7EBF\u67E5\u770B CLI \u5185\u7F6E\u6A21\u578B ID\uFF1B\u6A21\u677F\u5C06\u9009\u62E9\u4F20\u7ED9 initialState.model"
+      description: "\u4ECE buddy-cli models \u67E5\u770B Runtime \u6A21\u578B\u76EE\u5F55\uFF1B\u5DE5\u7A0B\u5185\u8BFB\u53D6\u5B89\u88C5\u7248\u672C\uFF0C\u5DE5\u7A0B\u5916\u8BFB\u53D6 npm \u6700\u65B0\u7248\u3002\u8FD0\u884C\u4E0E\u4E0A\u4F20\u9884\u68C0\u6309\u5DE5\u7A0B Runtime \u6821\u9A8C\u3002"
     },
     datasets: {
       type: "array",
@@ -110,12 +163,177 @@ var buddy_agent_schema_default = {
 };
 
 // packages/cli-core/src/project-files.ts
-import { lstat as lstat2 } from "node:fs/promises";
+import { lstat as lstat3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+
+// packages/cli-core/src/init/scaffold.ts
+import { lstat as lstat2, mkdir as mkdir2, open, readFile as readFile4, rmdir, unlink } from "node:fs/promises";
+import { resolve as resolve2 } from "node:path";
+
+// packages/cli-core/src/config/models.ts
+var MODEL_IDS = Object.freeze([
+  "kimi-k2.6",
+  "kimi-k3",
+  "deepseek-v4-flash",
+  "deepseek-v4-pro"
+]);
+var DEFAULT_MODEL_ID = "kimi-k2.6";
+
+// packages/cli-core/src/init/runtime-template.ts
+import { execFile as execFile2 } from "node:child_process";
+import { mkdtemp as mkdtemp2, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join2 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+
+// packages/cli-core/src/config/runtime-package.ts
+import { execFile } from "node:child_process";
+import { lstat, mkdir, mkdtemp, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import { join } from "node:path";
+import { promisify } from "node:util";
+var RUNTIME_REGISTRY = "https://registry.npmjs.org/";
+var execute = promisify(execFile);
+async function latestRuntimeVersion(options = {}) {
+  options.signal?.throwIfAborted();
+  const timeout = AbortSignal.timeout(1e4);
+  const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+  const response = await (options.fetch ?? globalThis.fetch)(`${RUNTIME_REGISTRY}${encodeURIComponent(BUDDY_RUNTIME_PACKAGE)}/latest`, {
+    signal,
+    headers: { Accept: "application/json" },
+    redirect: "error"
+  });
+  if (!response.ok) throw new Error(`npm \u8FD4\u56DE HTTP ${response.status}`);
+  const metadata = await response.json();
+  if (metadata?.name !== BUDDY_RUNTIME_PACKAGE || typeof metadata.version !== "string" || !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u.test(metadata.version)) {
+    throw new Error("npm latest \u672A\u8FD4\u56DE\u6B64 Runtime \u7684\u51C6\u786E\u7A33\u5B9A\u7248\u672C");
+  }
+  return metadata.version;
+}
+async function cachedLatestRuntimeRoot(options = {}) {
+  options.report?.("\u6B63\u5728\u67E5\u8BE2\u516C\u5171 npm \u7684\u6700\u65B0 Runtime\u2026");
+  const version = await latestRuntimeVersion(options);
+  const cache = options.cacheDirectory ?? join(homedir(), ".cache", "buddy-cli", "runtimes");
+  const destination = join(cache, version);
+  let cacheExists = false;
+  try {
+    await lstat(destination);
+    cacheExists = true;
+  } catch (cause) {
+    if (cause.code !== "ENOENT") throw cause;
+  }
+  if (cacheExists) {
+    try {
+      const pkg = JSON.parse(await readFile2(join(destination, "package.json"), "utf8"));
+      const installed = JSON.parse(await readFile2(join(destination, "node_modules", BUDDY_RUNTIME_PACKAGE, "package.json"), "utf8"));
+      if (runtimeDependencyVersion(pkg) === version && installed.version === version) return destination;
+      throw new Error("\u7F13\u5B58\u7248\u672C\u4E0D\u5339\u914D");
+    } catch (cause) {
+      throw new Error(`Runtime ${version} \u7684\u7F13\u5B58\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u5220\u9664 ${destination} \u540E\u91CD\u8BD5`, { cause });
+    }
+  }
+  await mkdir(cache, { recursive: true });
+  const temporaryRoot = await mkdtemp(join(cache, `.install-${version}-`));
+  try {
+    await writeFile(join(temporaryRoot, "package.json"), JSON.stringify({
+      name: "buddy-runtime-catalog",
+      private: true,
+      type: "module",
+      dependencies: { [BUDDY_RUNTIME_PACKAGE]: version }
+    }));
+    const userConfig = join(temporaryRoot, ".npmrc");
+    await writeFile(userConfig, `registry=${RUNTIME_REGISTRY}
+`);
+    options.report?.(`\u6B63\u5728\u7F13\u5B58 Runtime ${version} \u7684\u80FD\u529B\u76EE\u5F55\uFF0C\u9996\u6B21\u4F7F\u7528\u9700\u8981\u4E0B\u8F7D\u4F9D\u8D56\u2026`);
+    const runNpm = options.runNpm ?? ((args, settings) => execute("npm", args, { ...settings, encoding: "utf8", maxBuffer: 4 * 1024 * 1024 }));
+    await runNpm([
+      "install",
+      "--ignore-scripts",
+      "--no-audit",
+      "--no-fund",
+      "--engine-strict",
+      `--registry=${RUNTIME_REGISTRY}`,
+      `--@my-life-buddies:registry=${RUNTIME_REGISTRY}`,
+      `--userconfig=${userConfig}`,
+      "--prefer-online",
+      "--fetch-retries=0",
+      "--fetch-timeout=20000"
+    ], { cwd: temporaryRoot, signal: options.signal, timeout: 18e4 });
+    const installed = JSON.parse(await readFile2(join(temporaryRoot, "node_modules", BUDDY_RUNTIME_PACKAGE, "package.json"), "utf8"));
+    if (installed.version !== version) throw new Error(`\u7F13\u5B58\u7684 Runtime \u7248\u672C\u4E0E npm latest ${version} \u4E0D\u4E00\u81F4`);
+    options.signal?.throwIfAborted();
+    try {
+      await rename(temporaryRoot, destination);
+    } catch (cause) {
+      if (!["EEXIST", "ENOTEMPTY"].includes(cause.code ?? "")) throw cause;
+    }
+    return destination;
+  } finally {
+    await rm(temporaryRoot, { recursive: true, force: true });
+  }
+}
+
+// packages/cli-core/src/init/runtime-template.ts
+var execute2 = promisify2(execFile2);
+async function latestRuntimeTemplate(template, options) {
+  const bundledVersion = runtimeDependencyVersion(JSON.parse(template.packageJson));
+  if (!bundledVersion) throw new Error("CLI \u5DE5\u7A0B\u6A21\u677F\u7F3A\u5C11 Runtime \u7684\u51C6\u786E\u7248\u672C");
+  let temporaryRoot;
+  try {
+    options.signal?.throwIfAborted();
+    options.report("\u6B63\u5728\u67E5\u8BE2\u516C\u5171 npm \u7684\u6700\u65B0 Runtime\u2026");
+    const version = await latestRuntimeVersion(options);
+    let result = template;
+    if (version !== bundledVersion) {
+      temporaryRoot = await mkdtemp2(join2(tmpdir(), "buddy-runtime-template-"));
+      await writeFile2(join2(temporaryRoot, "package.json"), template.packageJson);
+      await writeFile2(join2(temporaryRoot, "package-lock.json"), template.packageLock);
+      const userConfig = join2(temporaryRoot, ".npmrc");
+      await writeFile2(userConfig, `registry=${RUNTIME_REGISTRY}
+`);
+      options.report(`\u6B63\u5728\u4E3A Runtime ${version} \u751F\u6210\u4F9D\u8D56\u9501\u6587\u4EF6\u2026`);
+      const runNpm = options.runNpm ?? ((args, settings) => execute2("npm", args, { ...settings, encoding: "utf8", maxBuffer: 4 * 1024 * 1024 }));
+      await runNpm([
+        "install",
+        "--package-lock-only",
+        "--save-exact",
+        `${BUDDY_RUNTIME_PACKAGE}@${version}`,
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        "--engine-strict",
+        `--registry=${RUNTIME_REGISTRY}`,
+        `--@my-life-buddies:registry=${RUNTIME_REGISTRY}`,
+        `--userconfig=${userConfig}`,
+        "--prefer-online",
+        "--fetch-retries=0",
+        "--fetch-timeout=20000"
+      ], { cwd: temporaryRoot, signal: options.signal, timeout: 6e4 });
+      result = {
+        packageJson: await readFile3(join2(temporaryRoot, "package.json"), "utf8"),
+        packageLock: await readFile3(join2(temporaryRoot, "package-lock.json"), "utf8")
+      };
+    }
+    const pkg = JSON.parse(result.packageJson);
+    const lock = JSON.parse(result.packageLock);
+    const locked = lock.packages?.[`node_modules/${BUDDY_RUNTIME_PACKAGE}`];
+    if (runtimeDependencyVersion(pkg) !== version || runtimeDependencyVersion(lock.packages?.[""]) !== version || locked?.version !== version || typeof locked.integrity !== "string" || !locked.integrity || typeof locked.resolved !== "string" || !locked.resolved.startsWith(RUNTIME_REGISTRY)) {
+      throw new Error("\u751F\u6210\u7684 Runtime \u7248\u672C\u4E0E\u4F9D\u8D56\u9501\u6587\u4EF6\u4E0D\u4E00\u81F4");
+    }
+    options.signal?.throwIfAborted();
+    options.report(`\u5DF2\u4ECE\u516C\u5171 npm latest \u9501\u5B9A Runtime ${version}\uFF08package.json \u4E0E package-lock.json\uFF09\u3002`);
+    return result;
+  } catch (cause) {
+    if (options.signal?.aborted) throw new Error("Runtime \u7248\u672C\u9009\u62E9\u5DF2\u53D6\u6D88");
+    const reason = cause instanceof Error && !cause.message.includes("Command failed") ? cause.message : "npm \u672A\u5B8C\u6210\u9501\u6587\u4EF6\u751F\u6210";
+    options.report(`\u672A\u80FD\u9501\u5B9A\u6700\u65B0 Runtime\uFF1A${reason}\u3002\u672C\u6B21\u4F7F\u7528 CLI \u968F\u9644\u7684 Runtime ${bundledVersion} \u53CA\u5176\u9501\u6587\u4EF6\uFF1B\u5B89\u88C5\u540E\u53EF\u663E\u5F0F\u5347\u7EA7\u5DE5\u7A0B\u4F9D\u8D56\u3002`);
+    return template;
+  } finally {
+    if (temporaryRoot) await rm2(temporaryRoot, { recursive: true, force: true });
+  }
+}
 
 // packages/cli-core/src/init/scaffold.ts
-import { lstat, mkdir, open, readFile, rmdir, unlink } from "node:fs/promises";
-import { resolve } from "node:path";
 var BUDDY_PLATFORM_AGENT_ENTRY = "agent.md";
 var BUDDY_PLATFORM_FACTORY_ENTRY = "src/buddy-options.mjs";
 var BUDDY_PLATFORM_PACKAGE_JSON = "package.json";
@@ -206,11 +424,11 @@ try {
 }
 `;
 }
-async function scaffoldPlatformAgent(projectRoot, name) {
-  const path = resolve(projectRoot, BUDDY_PLATFORM_AGENT_ENTRY);
+async function scaffoldPlatformAgent(projectRoot, name, options = {}) {
+  const path = resolve2(projectRoot, BUDDY_PLATFORM_AGENT_ENTRY);
   const hasAlternateLockfile = (await Promise.all(["pnpm-lock.yaml", "yarn.lock"].map(async (name2) => {
     try {
-      if (!(await lstat(resolve(projectRoot, name2))).isFile()) {
+      if (!(await lstat2(resolve2(projectRoot, name2))).isFile()) {
         throw new TypeError(`\u4F9D\u8D56\u9501\u6587\u4EF6\u5FC5\u987B\u662F\u666E\u901A\u6587\u4EF6\uFF1A${name2}`);
       }
       return true;
@@ -221,23 +439,23 @@ async function scaffoldPlatformAgent(projectRoot, name) {
   }))).some(Boolean);
   const files = [
     { path, content: platformAgentTemplate(name) },
-    { path: resolve(projectRoot, BUDDY_PLATFORM_FACTORY_ENTRY), content: platformFactoryTemplate() },
-    { path: resolve(projectRoot, BUDDY_PLATFORM_PACKAGE_JSON), content: await readFile(new URL("../../resources/agent-template/package.json", import.meta.url), "utf8") },
-    ...hasAlternateLockfile ? [] : [{ path: resolve(projectRoot, BUDDY_PLATFORM_PACKAGE_LOCK), content: await readFile(new URL("../../resources/agent-template/package-lock.json", import.meta.url), "utf8") }],
-    { path: resolve(projectRoot, BUDDY_PLATFORM_START_ENTRY), content: platformStartTemplate() }
+    { path: resolve2(projectRoot, BUDDY_PLATFORM_FACTORY_ENTRY), content: platformFactoryTemplate() },
+    { path: resolve2(projectRoot, BUDDY_PLATFORM_PACKAGE_JSON), content: await readFile4(new URL("../../resources/agent-template/package.json", import.meta.url), "utf8") },
+    ...hasAlternateLockfile ? [] : [{ path: resolve2(projectRoot, BUDDY_PLATFORM_PACKAGE_LOCK), content: await readFile4(new URL("../../resources/agent-template/package-lock.json", import.meta.url), "utf8") }],
+    { path: resolve2(projectRoot, BUDDY_PLATFORM_START_ENTRY), content: platformStartTemplate() }
   ];
   const handles = [];
   const createdDirectories = [];
   try {
     for (const directory of PLATFORM_DIRECTORIES) {
-      const directoryPath = resolve(projectRoot, directory);
+      const directoryPath = resolve2(projectRoot, directory);
       try {
-        await mkdir(directoryPath, { mode: 448 });
+        await mkdir2(directoryPath, { mode: 448 });
         createdDirectories.push(directoryPath);
       } catch (cause) {
         if (cause.code !== "EEXIST") throw cause;
       }
-      if (!(await lstat(directoryPath)).isDirectory()) {
+      if (!(await lstat2(directoryPath)).isDirectory()) {
         throw new TypeError(`\u5B98\u65B9\u5DE5\u7A0B\u76EE\u5F55\u5FC5\u987B\u662F\u666E\u901A\u76EE\u5F55\uFF0C\u4E0D\u80FD\u4F7F\u7528\u6587\u4EF6\u6216\u7B26\u53F7\u94FE\u63A5\uFF1A${directoryPath}`);
       }
     }
@@ -246,11 +464,27 @@ async function scaffoldPlatformAgent(projectRoot, name) {
         handles.push({ path: file2.path, handle: await open(file2.path, "wx", 384) });
       } catch (cause) {
         if (cause.code !== "EEXIST") throw cause;
-        if (!(await lstat(file2.path)).isFile()) {
+        if (!(await lstat2(file2.path)).isFile()) {
           throw new TypeError(`\u5B98\u65B9\u5DE5\u7A0B\u6587\u4EF6\u5FC5\u987B\u662F\u666E\u901A\u6587\u4EF6\uFF0C\u4E0D\u80FD\u4F7F\u7528\u76EE\u5F55\u6216\u7B26\u53F7\u94FE\u63A5\uFF1A${file2.path}`);
         }
       }
     }
+    const packageFile = files.find((file2) => file2.path === resolve2(projectRoot, BUDDY_PLATFORM_PACKAGE_JSON));
+    const lockFile = files.find((file2) => file2.path === resolve2(projectRoot, BUDDY_PLATFORM_PACKAGE_LOCK));
+    if (options.resolveDependencies && lockFile && handles.some((file2) => file2.path === packageFile.path) && handles.some((file2) => file2.path === lockFile.path)) {
+      const template = await options.resolveDependencies({ packageJson: packageFile.content, packageLock: lockFile.content });
+      packageFile.content = template.packageJson;
+      lockFile.content = template.packageLock;
+    }
+    if (lockFile && (handles.some((file2) => file2.path === packageFile.path) || handles.some((file2) => file2.path === lockFile.path))) {
+      const packageContents = handles.some((file2) => file2.path === packageFile.path) ? packageFile.content : await readFile4(packageFile.path, "utf8");
+      const lockContents = handles.some((file2) => file2.path === lockFile.path) ? lockFile.content : await readFile4(lockFile.path, "utf8");
+      const declared = JSON.parse(packageContents).dependencies ?? {};
+      const locked = JSON.parse(lockContents).packages?.[""]?.dependencies ?? {};
+      if (JSON.stringify(Object.entries(declared).sort()) !== JSON.stringify(Object.entries(locked).sort())) {
+        throw new Error("\u5DF2\u6709 package.json \u4E0E\u5F85\u8865\u9F50\u7684\u9501\u6587\u4EF6\u4E0D\u4E00\u81F4\uFF0C\u8BF7\u7528\u5DE5\u7A0B\u7684\u5305\u7BA1\u7406\u5668\u6062\u590D\u5339\u914D\u7684\u4F9D\u8D56\u6587\u4EF6\u540E\u91CD\u8BD5");
+      }
+    }
     for (const { path: filePath, handle } of handles) {
       const file2 = files.find((candidate) => candidate.path === filePath);
       await handle.writeFile(file2.content, "utf8");
@@ -280,7 +514,7 @@ async function missingBuddyAgentFiles(projectRoot) {
   ];
   const missing = await Promise.all(entries.map(async ([path, kind]) => {
     try {
-      const entry = await lstat2(join(projectRoot, path));
+      const entry = await lstat3(join3(projectRoot, path));
       return (kind === "directory" ? entry.isDirectory() : entry.isFile()) ? void 0 : path;
     } catch (cause) {
       if (["ENOENT", "ENOTDIR"].includes(cause.code ?? "")) return path;
@@ -349,9 +583,6 @@ function validateBuddyProjectManifest(value) {
     return { ok: false, issues: schemaIssues(validateAgentSchema.errors) };
   }
   const manifest = value;
-  if (manifest.model !== void 0 && !MODEL_IDS.includes(manifest.model)) {
-    return { ok: false, issues: [{ path: "/model", message: `\u4E0D\u652F\u6301\u7684\u6A21\u578B ID\uFF1B\u53EF\u9009 ${MODEL_IDS.join("\u3001")}\uFF08buddy-cli models\uFF09` }] };
-  }
   const seen = /* @__PURE__ */ new Set();
   for (const [index, dataset] of (manifest.datasets ?? []).entries()) {
     if (seen.has(dataset.id)) {
@@ -410,7 +641,7 @@ var ProjectInitializationError = class extends Error {
 };
 async function pathState(targetPath) {
   try {
-    const entry = await lstat3(targetPath);
+    const entry = await lstat4(targetPath);
     if (!entry.isDirectory() || entry.isSymbolicLink()) return { kind: "other" };
     return { kind: "directory", identity: `${entry.dev}:${entry.ino}` };
   } catch (cause) {
@@ -430,7 +661,7 @@ function entryIdentity(entry) {
 }
 async function fileIdentity(targetPath) {
   try {
-    const entry = await lstat3(targetPath);
+    const entry = await lstat4(targetPath);
     return entry.isFile() && !entry.isSymbolicLink() ? entryIdentity(entry) : void 0;
   } catch (cause) {
     if (cause.code === "ENOENT") return void 0;
@@ -439,7 +670,7 @@ async function fileIdentity(targetPath) {
 }
 async function unlinkMatchingFile(targetPath, expectedIdentity) {
   try {
-    const entry = await lstat3(targetPath);
+    const entry = await lstat4(targetPath);
     if (!entry.isFile() || entry.isSymbolicLink() || entryIdentity(entry) !== expectedIdentity) {
       return false;
     }
@@ -477,7 +708,7 @@ async function readExistingManifest(agentConfigPath) {
       agentConfigPath
     );
   }
-  const entry = await lstat3(agentConfigPath);
+  const entry = await lstat4(agentConfigPath);
   if (!entry.isFile() || entry.isSymbolicLink()) {
     throw new ProjectInitializationError(
       "TARGET_CHANGED",
@@ -486,7 +717,7 @@ async function readExistingManifest(agentConfigPath) {
     );
   }
   try {
-    return parseBuddyProjectManifest(await readFile2(agentConfigPath, "utf8"));
+    return parseBuddyProjectManifest(await readFile5(agentConfigPath, "utf8"));
   } catch (cause) {
     throw new ProjectInitializationError(
       "TARGET_CHANGED",
@@ -497,8 +728,8 @@ async function readExistingManifest(agentConfigPath) {
   }
 }
 async function planBuddyDraftInitialization(directory) {
-  const rootDirectory = resolve2(directory);
-  const agentConfigPath = join2(rootDirectory, BUDDY_AGENT_FILENAME);
+  const rootDirectory = resolve3(directory);
+  const agentConfigPath = join4(rootDirectory, BUDDY_AGENT_FILENAME);
   const state2 = await pathState(rootDirectory);
   if (state2.kind === "other") {
     throw new ProjectInitializationError(
@@ -525,8 +756,8 @@ async function planBuddyDraftInitialization(directory) {
   };
 }
 async function planBuddyProjectInitialization(options) {
-  const rootDirectory = resolve2(options.directory);
-  const agentConfigPath = resolve2(rootDirectory, BUDDY_AGENT_FILENAME);
+  const rootDirectory = resolve3(options.directory);
+  const agentConfigPath = resolve3(rootDirectory, BUDDY_AGENT_FILENAME);
   const state2 = await pathState(rootDirectory);
   if (state2.kind === "other") {
     throw new ProjectInitializationError(
@@ -555,7 +786,7 @@ async function planBuddyProjectInitialization(options) {
 async function prepareInitializationDirectory(plan) {
   if (plan.createRootDirectory) {
     if ((await pathState(plan.rootDirectory)).kind !== "missing") throw targetChanged(plan);
-    const firstCreatedDirectory = await mkdir2(plan.rootDirectory, { recursive: true });
+    const firstCreatedDirectory = await mkdir3(plan.rootDirectory, { recursive: true });
     if (firstCreatedDirectory === void 0) throw targetChanged(plan);
     const created = await pathState(plan.rootDirectory);
     if (created.kind !== "directory") throw targetChanged(plan);
@@ -570,7 +801,7 @@ async function prepareInitializationDirectory(plan) {
 async function publishNewFile(options) {
   let temporaryHandle;
   let publishedHandle;
-  const temporaryPath = join2(
+  const temporaryPath = join4(
     options.rootDirectory,
     `.${options.temporaryLabel}.${process.pid}.${randomUUID()}.tmp`
   );
@@ -614,7 +845,7 @@ async function publishNewFile(options) {
     const afterPublish = await pathState(options.rootDirectory);
     const publishedFileIdentity = await fileIdentity(options.targetPath);
     const temporaryFileIdentity = await fileIdentity(temporaryPath);
-    const publishedContents = publishedFileIdentity ? await readFile2(options.targetPath, "utf8") : void 0;
+    const publishedContents = publishedFileIdentity ? await readFile5(options.targetPath, "utf8") : void 0;
     if (afterPublish.kind !== "directory" || afterPublish.identity !== options.directoryIdentity || !publishedIdentity || publishedFileIdentity !== publishedIdentity || temporaryFileIdentity !== temporaryIdentity || publishedContents !== options.contents) {
       if (afterPublish.kind === "directory" && afterPublish.identity === options.directoryIdentity && publishedIdentity) {
         await unlinkMatchingFile(options.targetPath, publishedIdentity);
@@ -641,7 +872,7 @@ async function publishNewFile(options) {
   }
 }
 async function replaceExistingFile(options) {
-  const temporaryPath = join2(
+  const temporaryPath = join4(
     options.rootDirectory,
     `.${options.temporaryLabel}.${process.pid}.${randomUUID()}.tmp`
   );
@@ -655,8 +886,8 @@ async function replaceExistingFile(options) {
   try {
     const root = await pathState(options.rootDirectory);
     if (root.kind !== "directory" || root.identity !== options.directoryIdentity || await fileIdentity(options.targetPath) !== options.expectedFileIdentity) throw targetChanged({ rootDirectory: options.rootDirectory });
-    await rename(temporaryPath, options.targetPath);
-    if (await readFile2(options.targetPath, "utf8") !== options.contents) {
+    await rename2(temporaryPath, options.targetPath);
+    if (await readFile5(options.targetPath, "utf8") !== options.contents) {
       throw targetChanged({ rootDirectory: options.rootDirectory });
     }
   } finally {
@@ -781,16 +1012,16 @@ async function initializeBuddyProject(options) {
   return applyBuddyProjectInitialization(plan, options.config);
 }
 async function readBuddyProjectManifest(projectRoot) {
-  const rootDirectory = resolve2(projectRoot);
-  return parseBuddyProjectManifest(await readFile2(resolve2(rootDirectory, BUDDY_AGENT_FILENAME), "utf8"));
+  const rootDirectory = resolve3(projectRoot);
+  return parseBuddyProjectManifest(await readFile5(resolve3(rootDirectory, BUDDY_AGENT_FILENAME), "utf8"));
 }
 async function readBuddyAgentConfig(projectRoot) {
-  const rootDirectory = resolve2(projectRoot);
-  const source = await readFile2(resolve2(rootDirectory, BUDDY_AGENT_FILENAME), "utf8");
+  const rootDirectory = resolve3(projectRoot);
+  const source = await readFile5(resolve3(rootDirectory, BUDDY_AGENT_FILENAME), "utf8");
   return parseBuddyAgentConfig(source);
 }
 async function readBuddyConfig(projectRoot) {
-  const rootDirectory = resolve2(projectRoot);
+  const rootDirectory = resolve3(projectRoot);
   return combineBuddyProject(await readBuddyAgentConfig(rootDirectory));
 }
 
@@ -806,10 +1037,10 @@ var BuddyProjectContextError = class extends Error {
   targetPath;
 };
 async function existingDirectory(target) {
-  const requested = resolve3(target);
+  const requested = resolve4(target);
   let entry;
   try {
-    entry = await lstat4(requested);
+    entry = await lstat5(requested);
   } catch (cause) {
     if (cause.code === "ENOENT") {
       throw new BuddyProjectContextError(
@@ -828,12 +1059,12 @@ async function existingDirectory(target) {
       requested
     );
   }
-  return realpath(requested);
+  return realpath2(requested);
 }
 async function projectFileState(directory, filename) {
-  const configPath = join3(directory, filename);
+  const configPath = join5(directory, filename);
   try {
-    const entry = await lstat4(configPath);
+    const entry = await lstat5(configPath);
     if (!entry.isFile() || entry.isSymbolicLink()) {
       throw new BuddyProjectContextError(
         "PROJECT_CONFIG_INVALID",
@@ -860,7 +1091,7 @@ async function findBuddyProjectRoot(startDirectory) {
   return searchUp(await existingDirectory(startDirectory));
 }
 async function requireBuddyProjectRoot(startDirectory) {
-  const requested = resolve3(startDirectory);
+  const requested = resolve4(startDirectory);
   const root = await findBuddyProjectRoot(requested);
   if (root !== void 0) return root;
   throw new BuddyProjectContextError(
@@ -874,7 +1105,7 @@ async function requireBuddyProjectRoot(startDirectory) {
 }
 async function requireBuddyAgentProjectRoot(startDirectory) {
   const root = await requireBuddyProjectRoot(startDirectory);
-  const agentPath = join3(root, BUDDY_AGENT_FILENAME);
+  const agentPath = join5(root, BUDDY_AGENT_FILENAME);
   try {
     await readBuddyAgentConfig(root);
     const missing = await missingBuddyAgentFiles(root);
@@ -893,10 +1124,10 @@ async function requireBuddyAgentProjectRoot(startDirectory) {
   }
 }
 async function nearestExistingDirectory(target) {
-  let candidate = resolve3(target);
+  let candidate = resolve4(target);
   while (true) {
     try {
-      const entry = await lstat4(candidate);
+      const entry = await lstat5(candidate);
       if (!entry.isDirectory()) {
         throw new BuddyProjectContextError(
           "PROJECT_DIRECTORY_INVALID",
@@ -904,7 +1135,7 @@ async function nearestExistingDirectory(target) {
           candidate
         );
       }
-      return realpath(candidate);
+      return realpath2(candidate);
     } catch (cause) {
       if (cause.code !== "ENOENT") throw cause;
       const parent = dirname(candidate);
@@ -914,7 +1145,7 @@ async function nearestExistingDirectory(target) {
   }
 }
 async function assertOutsideBuddyProject(target) {
-  const requested = resolve3(target);
+  const requested = resolve4(target);
   const container = await nearestExistingDirectory(requested);
   const projectRoot = await searchUp(container);
   if (projectRoot === void 0) return;
@@ -928,13 +1159,13 @@ async function assertOutsideBuddyProject(target) {
   );
 }
 async function assertInitializableBuddyTarget(target) {
-  const requested = resolve3(target);
+  const requested = resolve4(target);
   const container = await nearestExistingDirectory(requested);
   const projectRoot = await searchUp(container);
   if (projectRoot === void 0) return;
   let requestedRoot = requested;
   try {
-    requestedRoot = await realpath(requested);
+    requestedRoot = await realpath2(requested);
   } catch (cause) {
     if (cause.code !== "ENOENT") throw cause;
   }
@@ -945,7 +1176,7 @@ async function assertInitializableBuddyTarget(target) {
     } catch (cause) {
       throw new BuddyProjectContextError(
         "PROJECT_CONFIG_INVALID",
-        `${join3(projectRoot, BUDDY_AGENT_FILENAME)} \u4E0D\u662F\u6709\u6548\u7684\u9879\u76EE\u6E05\u5355\u3002`,
+        `${join5(projectRoot, BUDDY_AGENT_FILENAME)} \u4E0D\u662F\u6709\u6548\u7684\u9879\u76EE\u6E05\u5355\u3002`,
         requested,
         { cause }
       );
@@ -961,10 +1192,54 @@ async function assertInitializableBuddyTarget(target) {
   );
 }
 
+// packages/cli-core/src/commands/runtime-source.ts
+async function runtimeCatalogSource(directory, options = {}) {
+  const project = await findBuddyProjectRoot(directory);
+  if (project) return { root: project, source: "project" };
+  return { root: await (options.latestRuntimeRoot?.() ?? cachedLatestRuntimeRoot(options)), source: "npm" };
+}
+
+// packages/cli-core/src/commands/models.ts
+var MODELS_COMMAND_HELP = `\u7528\u6CD5: buddy-cli models [--directory <\u9879\u76EE\u76EE\u5F55>] [--json]
+\u5DE5\u7A0B\u5185\u8BFB\u53D6\u5DF2\u5B89\u88C5 Runtime \u7684\u6A21\u578B\u76EE\u5F55\uFF1B\u5DE5\u7A0B\u5916\u8054\u7F51\u8BFB\u53D6\u5E76\u7F13\u5B58\u516C\u5171 npm \u6700\u65B0 Runtime\u3002
+\u65E0\u9700\u767B\u5F55\u642D\u642D\u8D26\u53F7\u3002\u8F93\u51FA\u5305\u542B\u5B9E\u9645 Runtime \u7248\u672C\u548C\u6765\u6E90\u3002
+\u5C06\u6240\u9009 ID \u5199\u5165 buddy.agent.json.model\uFF1B\u6A21\u677F\u5728 initialState.model \u4E2D\u4F7F\u7528\u5B83\u3002`;
+async function runModelsCommand(args, io, cwd, options = {}) {
+  try {
+    if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
+      io.write(MODELS_COMMAND_HELP);
+      return { exitCode: 0 };
+    }
+    let directory;
+    let json = false;
+    for (let i = 0; i < args.length; i++) {
+      if (args[i] === "--json" && !json) json = true;
+      else if (args[i] === "--directory" && directory === void 0 && args[i + 1]?.trim() && !args[i + 1].startsWith("--")) directory = args[++i];
+      else throw new Error(`models \u53C2\u6570\u65E0\u6548\uFF1A${args[i]}
+${MODELS_COMMAND_HELP}`);
+    }
+    const { root, source } = await runtimeCatalogSource(resolve5(cwd, directory ?? "."), { report: (message) => io.writeError(message), ...options });
+    const catalog = await readRuntimeModelCatalog(root);
+    if (json) io.write(JSON.stringify({ source, ...catalog }, null, 2));
+    else {
+      io.write(`${source === "project" ? "\u5DE5\u7A0B" : "npm \u6700\u65B0"} Runtime ${catalog.runtimeVersion} \u63D0\u4F9B ${catalog.models.length} \u4E2A\u6A21\u578B\uFF1A`);
+      for (const id of catalog.models) io.write(`- ${id}`);
+      io.write("\u5C06\u6240\u9009 ID \u5199\u5165 buddy.agent.json.model\uFF1B\u81EA\u5B9A\u4E49\u4F1A\u8BDD\u5DE5\u5382\u4E5F\u53EF\u6309\u4F1A\u8BDD\u8BBE\u7F6E initialState.model\u3002");
+    }
+    return { exitCode: 0 };
+  } catch (cause) {
+    io.writeError(cause instanceof Error ? cause.message : String(cause));
+    return { exitCode: 2 };
+  }
+}
+
+// packages/cli-core/src/commands/widgets.ts
+import { resolve as resolve7 } from "node:path";
+
 // packages/cli-core/src/widget-delivery.ts
 import { createHash } from "node:crypto";
-import { lstat as lstat5, readFile as readFile3, realpath as realpath2, readdir as readdir2, mkdir as mkdir3, writeFile, rename as rename2 } from "node:fs/promises";
-import { join as join4, resolve as resolve4 } from "node:path";
+import { lstat as lstat6, readFile as readFile6, realpath as realpath3, readdir as readdir2, mkdir as mkdir4, writeFile as writeFile3, rename as rename3 } from "node:fs/promises";
+import { join as join6, resolve as resolve6 } from "node:path";
 var LOCK = "widget-design.lock.json";
 var IMPLEMENTATION = "widget-implementation.json";
 var RECEIPTS = ".buddy/widget-verification.json";
@@ -982,12 +1257,12 @@ function portable(path) {
 }
 async function file(root, path, optional = false) {
   portable(path);
-  const base = await realpath2(root);
+  const base = await realpath3(root);
   let cursor = base;
   const parts = path.split("/");
   for (const [index, part] of parts.entries()) {
-    cursor = join4(cursor, part);
-    const stat2 = await lstat5(cursor).catch((e) => {
+    cursor = join6(cursor, part);
+    const stat2 = await lstat6(cursor).catch((e) => {
       if (e.code === "ENOENT") return void 0;
       throw e;
     });
@@ -998,7 +1273,7 @@ async function file(root, path, optional = false) {
     if (stat2.isSymbolicLink() || (index < parts.length - 1 ? !stat2.isDirectory() : !stat2.isFile())) throw new Error(`\u4E0D\u63A5\u53D7\u7B26\u53F7\u94FE\u63A5\u6216\u7279\u6B8A\u6587\u4EF6\uFF1A${path}`);
     if (index === parts.length - 1 && stat2.size > 8 * 1024 * 1024) throw new Error(`\u6587\u4EF6\u8D85\u8FC7 8 MB\uFF1A${path}`);
   }
-  return readFile3(cursor);
+  return readFile6(cursor);
 }
 async function jsonFile(root, path, optional = false) {
   const bytes = await file(root, path, optional);
@@ -1011,19 +1286,19 @@ async function jsonFile(root, path, optional = false) {
 }
 async function save(root, path, value) {
   portable(path);
-  let cursor = resolve4(root);
+  let cursor = resolve6(root);
   for (const segment of path.split("/").slice(0, -1)) {
-    cursor = join4(cursor, segment);
-    await mkdir3(cursor).catch((e) => {
+    cursor = join6(cursor, segment);
+    await mkdir4(cursor).catch((e) => {
       if (e.code !== "EEXIST") throw e;
     });
-    const stat2 = await lstat5(cursor);
+    const stat2 = await lstat6(cursor);
     if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw new Error("\u5199\u5165\u76EE\u5F55\u4E0D\u5B89\u5168");
   }
   await file(root, path, true);
-  const target = join4(root, path), temp = `${target}.${process.pid}.${Date.now()}.tmp`;
-  await writeFile(temp, JSON.stringify(value, null, 2) + "\n", { flag: "wx", mode: 384 });
-  await rename2(temp, target);
+  const target = join6(root, path), temp = `${target}.${process.pid}.${Date.now()}.tmp`;
+  await writeFile3(temp, JSON.stringify(value, null, 2) + "\n", { flag: "wx", mode: 384 });
+  await rename3(temp, target);
 }
 function validateLock(value) {
   if (!object(value) || value.schemaVersion !== 1 || !text(value.buddyId) || !text(value.revision) || !hashPattern.test(value.catalogHash) || !Array.isArray(value.items) || value.items.length > 100) throw new Error("\u8BBE\u8BA1\u7ED1\u5B9A\u6587\u4EF6\u65E0\u6548\uFF0C\u8BF7\u8FD0\u884C buddy-cli widgets sync");
@@ -1091,14 +1366,14 @@ async function sourceSnapshot(root) {
   const result = [];
   const visit = async (path, depth = 0) => {
     if (depth > 32 || result.length > 1e4) throw new Error("\u5B9E\u73B0\u6E90\u7801\u8D85\u51FA\u68C0\u67E5\u8303\u56F4");
-    const stat2 = await lstat5(join4(root, path)).catch((e) => {
+    const stat2 = await lstat6(join6(root, path)).catch((e) => {
       if (e.code === "ENOENT") return void 0;
       throw e;
     });
     if (!stat2) return;
     if (stat2.isSymbolicLink()) throw new Error(`\u5B9E\u73B0\u4E0D\u80FD\u4F7F\u7528\u7B26\u53F7\u94FE\u63A5\uFF1A${path}`);
     if (stat2.isDirectory()) {
-      for (const name of (await readdir2(join4(root, path))).sort()) await visit(`${path}/${name}`, depth + 1);
+      for (const name of (await readdir2(join6(root, path))).sort()) await visit(`${path}/${name}`, depth + 1);
     } else result.push([path, sha(await file(root, path))]);
   };
   for (const name of ["src", "resources", "widgets", "start.mjs", "agent.md", "buddy.agent.json", "package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) await visit(name);
@@ -1259,7 +1534,7 @@ async function runWidgetsCommand(args, io, cwd) {
     }
     if (action !== "verify" && (flags.has("--id") || flags.has("--evidence"))) throw new Error("--id / --evidence \u4EC5\u7528\u4E8E verify");
     if (action !== "check" && flags.has("--json")) throw new Error("--json \u4EC5\u7528\u4E8E check");
-    const root = await findBuddyProjectRoot(resolve5(cwd, flags.get("--directory") ?? "."));
+    const root = await findBuddyProjectRoot(resolve7(cwd, flags.get("--directory") ?? "."));
     if (!root) throw new Error("\u8BF7\u5728\u642D\u5B50\u5DE5\u7A0B\u4E2D\u8FD0\u884C\uFF0C\u6216\u6307\u5B9A --directory");
     if (action === "sync") {
       await syncWidgetDesign(root);
@@ -1281,75 +1556,14 @@ async function runWidgetsCommand(args, io, cwd) {
 }
 
 // packages/cli-core/src/index.ts
-import { lstat as lstat10 } from "node:fs/promises";
-
-// packages/cli-core/src/commands/datasets.ts
-import { resolve as resolve7 } from "node:path";
-
-// packages/cli-core/src/config/runtime-catalog.ts
-import { readFile as readFile4, realpath as realpath3 } from "node:fs/promises";
-import { createRequire } from "node:module";
-import { resolve as resolve6 } from "node:path";
-import { pathToFileURL } from "node:url";
-
-// packages/cli-core/src/config/runtime-dependency.ts
-var BUDDY_RUNTIME_PACKAGE = "@my-life-buddies/buddy-runtime";
-function runtimeDependencyVersion(pkg) {
-  if (typeof pkg !== "object" || pkg === null || !("dependencies" in pkg)) return void 0;
-  const dependencies2 = pkg.dependencies;
-  if (typeof dependencies2 !== "object" || dependencies2 === null || !(BUDDY_RUNTIME_PACKAGE in dependencies2)) return void 0;
-  const version = dependencies2[BUDDY_RUNTIME_PACKAGE];
-  return typeof version === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(version) ? version : void 0;
-}
-
-// packages/cli-core/src/config/runtime-catalog.ts
-async function readRuntimeDataCatalog(projectRoot) {
-  const packagePath = resolve6(projectRoot, "package.json");
-  const expected = runtimeDependencyVersion(JSON.parse(await readFile4(packagePath, "utf8")));
-  if (!expected) throw new Error(`package.json \u5FC5\u987B\u58F0\u660E ${BUDDY_RUNTIME_PACKAGE} \u7684\u51C6\u786E\u7248\u672C`);
-  const projectRequire = createRequire(packagePath);
-  let runtimePath;
-  try {
-    const installedPath = await realpath3(resolve6(projectRoot, "node_modules", BUDDY_RUNTIME_PACKAGE, "package.json"));
-    if (await realpath3(projectRequire.resolve(`${BUDDY_RUNTIME_PACKAGE}/package.json`)) !== installedPath) {
-      throw new Error("Runtime \u5FC5\u987B\u5B89\u88C5\u5728\u5F53\u524D\u5DE5\u7A0B\u4E2D");
-    }
-    const installed = JSON.parse(await readFile4(installedPath, "utf8"));
-    if (installed.version !== expected) throw new Error(`\u5DF2\u5B89\u88C5 ${installed.version}\uFF0C\u5DE5\u7A0B\u8981\u6C42 ${expected}`);
-    runtimePath = projectRequire.resolve(BUDDY_RUNTIME_PACKAGE);
-  } catch (cause) {
-    throw new Error(`\u5DE5\u7A0B\u7684 Runtime \u4F9D\u8D56\u672A\u6B63\u786E\u5B89\u88C5\uFF0C\u8BF7\u6309\u9501\u6587\u4EF6\u5B89\u88C5\u4F9D\u8D56\uFF1A${cause instanceof Error ? cause.message : String(cause)}`);
-  }
-  const runtime = await import(pathToFileURL(runtimePath).href);
-  const catalog = runtime.DATA_ACCESS_CAPABILITIES;
-  if (!Array.isArray(catalog)) {
-    throw new Error(`\u5DE5\u7A0B\u7684 Runtime ${expected} \u672A\u5BFC\u51FA DATA_ACCESS_CAPABILITIES\uFF0C\u8BF7\u4F7F\u7528\u5305\u542B\u6570\u636E\u76EE\u5F55\u7684\u65B0 Runtime \u5305\u3002`);
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const datasets = catalog.map((value) => {
-    if (!value || typeof value !== "object") throw new Error("Runtime \u6570\u636E\u76EE\u5F55\u683C\u5F0F\u65E0\u6548");
-    const item = value;
-    if (typeof item.id !== "string" || !item.id.trim() || seen.has(item.id) || typeof item.title !== "string" || !item.title.trim() || typeof item.source !== "string" || !item.source.trim() || !Number.isSafeInteger(item.schemaVersion) || item.schemaVersion < 1) {
-      throw new Error("Runtime \u6570\u636E\u76EE\u5F55\u683C\u5F0F\u65E0\u6548\u6216\u5305\u542B\u91CD\u590D ID");
-    }
-    seen.add(item.id);
-    return Object.freeze({ id: item.id, title: item.title, source: item.source, schemaVersion: item.schemaVersion });
-  });
-  return Object.freeze({ runtimeVersion: expected, datasets: Object.freeze(datasets) });
-}
-async function validateRuntimeDatasets(projectRoot, requirements = []) {
-  const catalog = await readRuntimeDataCatalog(projectRoot);
-  const ids = new Set(catalog.datasets.map((item) => item.id));
-  for (const [index, item] of requirements.entries()) {
-    if (!ids.has(item.id)) throw new Error(`/datasets/${index}/id\uFF1A\u5DE5\u7A0B Runtime ${catalog.runtimeVersion} \u4E0D\u652F\u6301 ${item.id}`);
-  }
-}
+import { lstat as lstat11 } from "node:fs/promises";
 
 // packages/cli-core/src/commands/datasets.ts
+import { resolve as resolve8 } from "node:path";
 var DATASETS_COMMAND_HELP = `\u7528\u6CD5: buddy-cli datasets [--directory <\u9879\u76EE\u76EE\u5F55>] [--json]
-\u8BFB\u53D6\u5DE5\u7A0B\u6240\u5B89\u88C5 Runtime \u7684 DATA_ACCESS_CAPABILITIES\uFF0C\u65E0\u9700\u767B\u5F55\u6216\u8BF7\u6C42\u5E73\u53F0\u76EE\u5F55\u3002
-\u5148\u6309\u5DE5\u7A0B\u9501\u6587\u4EF6\u5B89\u88C5\u4F9D\u8D56\u3002\u5C06\u6240\u9009 id \u4E0E\u7528\u9014 purpose \u5199\u5165 buddy.agent.json.datasets\uFF1B\u76EE\u5F55\u4E0D\u4EE3\u8868\u7528\u6237\u5DF2\u6388\u6743\u3002`;
-async function runDatasetsCommand(args, io, cwd) {
+\u5DE5\u7A0B\u5185\u8BFB\u53D6\u5DF2\u5B89\u88C5 Runtime \u7684 DATA_ACCESS_CAPABILITIES\uFF1B\u5DE5\u7A0B\u5916\u8054\u7F51\u8BFB\u53D6\u5E76\u7F13\u5B58\u516C\u5171 npm \u6700\u65B0 Runtime\u3002
+\u65E0\u9700\u767B\u5F55\u642D\u642D\u8D26\u53F7\u3002\u5C06\u6240\u9009 id \u4E0E\u7528\u9014 purpose \u5199\u5165 buddy.agent.json.datasets\uFF1B\u76EE\u5F55\u4E0D\u4EE3\u8868\u7528\u6237\u5DF2\u6388\u6743\u3002`;
+async function runDatasetsCommand(args, io, cwd, options = {}) {
   try {
     if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
       io.write(DATASETS_COMMAND_HELP);
@@ -1363,13 +1577,14 @@ async function runDatasetsCommand(args, io, cwd) {
       else throw new Error(`datasets \u53C2\u6570\u65E0\u6548\uFF1A${args[i]}
 ${DATASETS_COMMAND_HELP}`);
     }
-    const root = await requireBuddyProjectRoot(resolve7(cwd, directory ?? "."));
+    const { root, source } = await runtimeCatalogSource(resolve8(cwd, directory ?? "."), { report: (message) => io.writeError(message), ...options });
     const catalog = await readRuntimeDataCatalog(root);
-    if (json) io.write(JSON.stringify(catalog, null, 2));
+    if (json) io.write(JSON.stringify({ source, ...catalog }, null, 2));
     else {
-      io.write(`\u5DE5\u7A0B Runtime ${catalog.runtimeVersion} \u63D0\u4F9B ${catalog.datasets.length} \u9879\u6570\u636E\u80FD\u529B\uFF1A`);
+      io.write(`${source === "project" ? "\u5DE5\u7A0B" : "npm \u6700\u65B0"} Runtime ${catalog.runtimeVersion} \u63D0\u4F9B ${catalog.datasets.length} \u9879\u6570\u636E\u80FD\u529B\uFF1A`);
       for (const item of catalog.datasets) io.write(`- ${item.id} \u2014 ${item.title}\uFF08${item.source}\uFF0CSchema ${item.schemaVersion}\uFF09`);
       io.write("\u5C06\u6240\u9009 id \u548C purpose \u5199\u5165 buddy.agent.json.datasets\uFF1B\u7528\u6237\u6388\u6743\u7531\u5E73\u53F0\u5904\u7406\u3002");
+      if (source === "project") io.write(`\u66F4\u65B0 CLI \u4E0D\u4F1A\u66F4\u65B0\u5DE5\u7A0B Runtime\u3002\u5982\u9700\u5347\u7EA7\u5230\u516C\u5171 npm \u6700\u65B0\u7248\uFF0C\u5728\u5DE5\u7A0B\u6839\u76EE\u5F55\u8FD0\u884C\uFF1Anpm install --save-exact ${BUDDY_RUNTIME_PACKAGE}@latest --registry=https://registry.npmjs.org/ --@my-life-buddies:registry=https://registry.npmjs.org/`);
     }
     return { exitCode: 0 };
   } catch (cause) {
@@ -1379,12 +1594,12 @@ ${DATASETS_COMMAND_HELP}`);
 }
 
 // packages/cli-core/src/index.ts
-import { join as join11, resolve as resolve15 } from "node:path";
+import { join as join13, resolve as resolve16 } from "node:path";
 
 // packages/cli-core/src/init/creator.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { link as link2, lstat as lstat6, mkdir as mkdir4, readFile as readFile5, unlink as unlink3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { link as link2, lstat as lstat7, mkdir as mkdir5, readFile as readFile7, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // packages/cli-core/src/init/development-handoff.ts
@@ -1462,11 +1677,13 @@ Tool \u548C Hook \u662F Runtime \u7684\u6269\u5C55\u70B9\uFF1BService \u53EA\u66
 
 \u5E73\u53F0\u80FD\u529B\u8981\u4EE5\u5B9E\u9645\u63A5\u5165\u4E3A\u51C6\u3002\u5F53\u524D Runtime \u63D0\u4F9B\u4F1A\u8BDD\u6D88\u606F\u3001Memory\u3001\u6388\u6743\u6570\u636E\u3001\u5C0F\u6302\u4EF6\u548C\u672C\u5730 Markdown \u8D44\u6599\u80FD\u529B\uFF1B\u6CA1\u6709\u63A5\u901A\u7684 Files\u3001Knowledge \u4E0D\u80FD\u56E0\u624B\u518C\u63D0\u5230\u5C31\u5BA3\u79F0\u53EF\u7528\u3002\u666E\u901A Tool \u4E5F\u4E0D\u4EE3\u8868\u5DF2\u7ECF\u63D0\u4F9B\u5B9A\u65F6\u3001\u957F\u671F\u4EFB\u52A1\u3001\u540E\u53F0\u8C03\u5EA6\u6216\u4E3B\u52A8\u89E6\u8FBE\u3002\u624B\u518C\u63CF\u8FF0\u7684\u4ED8\u8D39\u3001\u53D1\u5E03\u7B49\u670D\u52A1\u8BBE\u8BA1\u4E5F\u4E0D\u6784\u6210\u6267\u884C\u6536\u8D39\u6216\u53D1\u5E03\u52A8\u4F5C\u7684\u6388\u6743\u3002
 
-\u9700\u8981\u7528\u6237\u6570\u636E\u65F6\uFF0C\u5148\u5728\u5DE5\u7A0B\u76EE\u5F55\u6267\u884C \`buddy-cli datasets\`\uFF08\u811A\u672C\u53EF\u7528 \`--json\`\uFF09\uFF0C\u4ECE\u5F53\u524D\u5B89\u88C5\u7684 Runtime \u5BFC\u51FA\u8BFB\u53D6\u5168\u90E8\u6570\u636E\u96C6\uFF1B\u4E0D\u8981\u6C42\u767B\u5F55\uFF0C\u4E0D\u4ECE Server \u62C9\u76EE\u5F55\u3002Runtime 0.11.0 \u542B 10 \u9879\uFF0CCLI \u4E0D\u590D\u5236\u679A\u4E3E\u3002\u628A\u5B9E\u9645\u9700\u8981\u7684 \`id\` \u548C\u7528\u9014 \`purpose\` \u5199\u5165 \`buddy.agent.json.datasets\`\uFF0C\u540C\u4E00 ID \u53EA\u5199\u4E00\u6B21\uFF0C\u7528\u9014\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u6700\u591A 200 \u5B57\uFF1B\u65E0\u9700\u6C42\u65F6\u4FDD\u7559\u7A7A\u6570\u7EC4\u3002DEV \u548C\u58F0\u660E\u975E\u7A7A\u65F6\u7684 push \u9884\u68C0\u7528\u8FD9\u4EFD\u5DE5\u7A0B\u4F9D\u8D56\u6821\u9A8C ID\uFF1B\u9700\u8981\u5148\u5B89\u88C5\u4E0E package.json \u51C6\u786E\u7248\u672C\u4E00\u81F4\u7684 Runtime\u3002\u6E05\u5355\u58F0\u660E\u6570\u91CF\u4E0D\u7B49\u4E8E\u5355\u6B21\u67E5\u8BE2\u4E0A\u9650\uFF0C\u5F53\u524D\u4E00\u6B21\u67E5\u8BE2\u6700\u591A 8 \u9879\u3002
+\u9700\u8981\u7528\u6237\u6570\u636E\u65F6\uFF0C\u5148\u5728\u5DE5\u7A0B\u76EE\u5F55\u6267\u884C \`buddy-cli datasets\`\uFF08\u811A\u672C\u53EF\u7528 \`--json\`\uFF09\uFF0C\u4ECE\u5F53\u524D\u5B89\u88C5\u7684 Runtime \u5BFC\u51FA\u8BFB\u53D6\u5168\u90E8\u6570\u636E\u96C6\uFF1B\u4E0D\u8981\u6C42\u767B\u5F55\uFF0C\u4E0D\u4ECE Server \u62C9\u76EE\u5F55\u3002Runtime 0.12.2 \u542B 10 \u9879\uFF0CCLI \u4E0D\u590D\u5236\u679A\u4E3E\u3002\u628A\u5B9E\u9645\u9700\u8981\u7684 \`id\` \u548C\u7528\u9014 \`purpose\` \u5199\u5165 \`buddy.agent.json.datasets\`\uFF0C\u540C\u4E00 ID \u53EA\u5199\u4E00\u6B21\uFF0C\u7528\u9014\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u6700\u591A 200 \u5B57\uFF1B\u65E0\u9700\u6C42\u65F6\u4FDD\u7559\u7A7A\u6570\u7EC4\u3002DEV \u548C\u58F0\u660E\u975E\u7A7A\u65F6\u7684 push \u9884\u68C0\u7528\u8FD9\u4EFD\u5DE5\u7A0B\u4F9D\u8D56\u6821\u9A8C ID\uFF1B\u9700\u8981\u5148\u5B89\u88C5\u4E0E package.json \u51C6\u786E\u7248\u672C\u4E00\u81F4\u7684 Runtime\u3002\u6E05\u5355\u58F0\u660E\u6570\u91CF\u4E0D\u7B49\u4E8E\u5355\u6B21\u67E5\u8BE2\u4E0A\u9650\uFF0C\u5F53\u524D\u4E00\u6B21\u67E5\u8BE2\u6700\u591A 8 \u9879\u3002
 
 \`start.mjs\` \u5C06\u58F0\u660E\u4EA4\u7ED9 \`StartOptions.dataRequirements\`\u3002Runtime \u5728\u5B9E\u9645\u6570\u636E\u67E5\u8BE2\u3001HealthKit \u6388\u6743\u548C\u4E3B\u52A8\u670D\u52A1\u8BF7\u6C42\u4E2D\u643A\u5E26\u5B8C\u6574\u58F0\u660E\uFF0C\u7531 Server \u6821\u9A8C\u8303\u56F4\u4E0E\u7528\u6237\u540C\u610F\uFF1B\u586B\u5199\u914D\u7F6E\u4E0D\u8868\u793A\u5DF2\u7ECF\u6388\u6743\u3002\u670D\u52A1\u7AEF\u4ECE\u4E0A\u4F20\u5305\u89E3\u6790\u5E76\u7ED1\u5B9A\u53D1\u5E03\u7248\u672C\u4ECD\u5F85\u5B9E\u73B0\u3002
 
-\u6A21\u578B\u9700\u8981\u67E5\u6570\u636E\u65F6\uFF0C\u5728 \`src/buddy-options.mjs\` \u7684 \`initialState.tools\` \u4E2D\u52A0\u5165 \`conversation.tools.data_access_query\`\uFF1B\u9700\u8981\u5411\u7528\u6237\u7533\u8BF7\u65F6\u52A0\u5165 \`conversation.tools.data_access_request\`\uFF0C\u4F4D\u7F6E\u3001\u65E5\u5386\u7684\u4E00\u6B21\u6027\u7ED3\u679C\u901A\u8FC7 \`data_access_read_result\` \u8BFB\u53D6\uFF0CHealthKit \u5219\u91CD\u65B0\u67E5\u8BE2 Dataset\u3002\u4E1A\u52A1\u4EE3\u7801\u5BF9\u5E94\u4F7F\u7528 \`conversation.dataAccess.query/request/readResult\`\u3002\u5DE5\u7A0B\u6A21\u677F\u5DF2\u9501\u5B9A npm Runtime 0.11.0\u3002
+\u6A21\u578B\u9700\u8981\u67E5\u6570\u636E\u65F6\uFF0C\u5728 \`src/buddy-options.mjs\` \u7684 \`initialState.tools\` \u4E2D\u52A0\u5165 \`conversation.tools.data_access_query\`\uFF1B\u9700\u8981\u5411\u7528\u6237\u7533\u8BF7\u65F6\u52A0\u5165 \`conversation.tools.data_access_request\`\uFF0C\u4F4D\u7F6E\u3001\u65E5\u5386\u7684\u4E00\u6B21\u6027\u7ED3\u679C\u901A\u8FC7 \`data_access_read_result\` \u8BFB\u53D6\uFF0CHealthKit \u5219\u91CD\u65B0\u67E5\u8BE2 Dataset\u3002\u4E1A\u52A1\u4EE3\u7801\u5BF9\u5E94\u4F7F\u7528 \`conversation.dataAccess.query/request/readResult\`\u3002\u65B0\u5EFA\u5DE5\u7A0B\u52A8\u6001\u9009\u62E9\u516C\u5171 npm latest \u5E76\u9501\u5B9A\u51C6\u786E\u7248\u672C\uFF1B\u8054\u7F51\u5931\u8D25\u65F6\u660E\u786E\u63D0\u793A\u4F7F\u7528\u968F CLI \u9644\u5E26\u7684 Runtime 0.12.2\u3002\u5DF2\u6709\u5DE5\u7A0B\u901A\u8FC7\u5305\u7BA1\u7406\u5668\u663E\u5F0F\u5347\u7EA7\u4F9D\u8D56\u3002
+
+\u5C0F\u6302\u4EF6\u7684\u6A21\u578B\u5DE5\u5177\u4E3A \`widget_create\`\u3001\`widget_read\`\uFF08\u6574\u4E2A\u5C0F\u6302\u4EF6\uFF09\u3001\`widget_read_module\`\uFF08\u4E00\u4E2A\u6A21\u5757\uFF09\u3001\`widget_rename\`\u3001\`widget_write_record\`\u3001\`widget_delete_record\`\u3001\`widget_delete\`\uFF08\u6574\u4E2A\u5C0F\u6302\u4EF6\u8FDE\u8BB0\u5F55\uFF09\u548C \`widget_send\`\uFF0C\u6309\u4E1A\u52A1\u9700\u8981\u6CE8\u518C\u5230 \`initialState.tools\`\u3002\u4FEE\u6539\u8BB0\u5F55\u7528 \`conversation.widget.writeRecord(id, input)\`\uFF1B\u5220\u4E00\u6761\u8BB0\u5F55\u7528 \`conversation.widget.deleteRecord(id, module, recordId)\`\uFF0C\u4E0D\u80FD\u7528\u5220\u9664\u6574\u4E2A\u5C0F\u6302\u4EF6\u7684 \`conversation.widget.delete(id)\` \u4EE3\u66FF\u3002\u4E24\u4E2A\u8BFB\u53D6\u5DE5\u5177\u53EF\u7528\u4E8E\u4E3B\u52A8\u56DE\u5408\uFF0C\u5176\u4F59\u516D\u4E2A\u5199\u5165\u5DE5\u5177\u7531 Runtime \u963B\u6B62\u5728\u4E3B\u52A8\u56DE\u5408\u6267\u884C\u3002
 
 \u9700\u8981\u7528\u6237\u4ECE\u51E0\u4E2A\u9009\u9879\u4E2D\u9009\u62E9\u65F6\uFF0C\u5728 \`initialState.tools\` \u4E2D\u52A0\u5165 \`conversation.tools.ask_question\` \u5E76\u5728\u4EBA\u8BBE\u4E2D\u8BF4\u660E\u9002\u7528\u573A\u666F\u3002\u53D1\u9898\u5361\u6216\u6388\u6743\u5361\u540E\uFF0C\u672C\u8F6E\u7ED3\u675F\u5E76\u7B49\u5F85\u7528\u6237\uFF1BPreview \u80FD\u663E\u793A\u9009\u9879\u6587\u5B57\u5E76\u53D1\u9001\u7528\u6237\u7684\u6587\u5B57\u56DE\u7B54\uFF0C\u7CFB\u7EDF\u6570\u636E\u6388\u6743\u9700\u8981\u5728 App \u4E2D\u5B8C\u6210\u3002\u6A21\u677F\u7684 \`initialState.tools\` \u9ED8\u8BA4\u4E3A\u7A7A\u6570\u7EC4\uFF0C\u53EA\u52A0\u5165\u4E1A\u52A1\u5B9E\u9645\u9700\u8981\u7684\u5DE5\u5177\uFF1B\u8D44\u6599\u76EE\u5F55\u901A\u8FC7 \`resource_list\` \u53D1\u73B0\uFF0C\u4E0D\u81EA\u52A8\u6CE8\u5165\u7CFB\u7EDF\u63D0\u793A\u3002\u65B0\u4F1A\u8BDD\u7684\u95EE\u5019\u7531\u6A21\u578B\u6309\u4EBA\u8BBE\u751F\u6210\uFF0C\u4E0D\u53E6\u8BBE\u9759\u6001\u6B22\u8FCE\u8BED\u914D\u7F6E\u3002
 
@@ -1542,16 +1759,16 @@ var REQUIRED = [
 var CreatorPreparationError = class extends Error {
 };
 async function state(path) {
-  return lstat6(path).catch((cause) => {
+  return lstat7(path).catch((cause) => {
     if (cause.code === "ENOENT") return void 0;
     throw cause;
   });
 }
 async function safeDirectory(path) {
-  await mkdir4(path, { mode: 448 }).catch((cause) => {
+  await mkdir5(path, { mode: 448 }).catch((cause) => {
     if (cause.code !== "EEXIST") throw cause;
   });
-  if (!(await lstat6(path)).isDirectory()) {
+  if (!(await lstat7(path)).isDirectory()) {
     throw new CreatorPreparationError(`\u521B\u4F5C\u76EE\u5F55\u5FC5\u987B\u662F\u666E\u901A\u76EE\u5F55\uFF0C\u4E0D\u80FD\u4F7F\u7528\u7B26\u53F7\u94FE\u63A5\uFF1A${path}`);
   }
 }
@@ -1561,11 +1778,11 @@ async function safeRead(path) {
   if (!entry.isFile() || entry.size > MAX_LOCAL_FILE_BYTES) {
     throw new CreatorPreparationError(`\u521B\u4F5C\u6587\u4EF6\u4E0D\u662F\u666E\u901A\u6587\u4EF6\u6216\u8D85\u51FA\u5927\u5C0F\u9650\u5236\uFF1A${path}`);
   }
-  return readFile5(path);
+  return readFile7(path);
 }
 async function writeOnce(path, bytes) {
   const temporary = `${path}.${randomUUID2()}.tmp`;
-  await writeFile2(temporary, bytes, { flag: "wx", mode: 384 });
+  await writeFile4(temporary, bytes, { flag: "wx", mode: 384 });
   try {
     await link2(temporary, path).catch((cause) => {
       if (cause.code !== "EEXIST") throw cause;
@@ -1576,17 +1793,17 @@ async function writeOnce(path, bytes) {
 }
 async function bundledSkill(root) {
   for (const path of REQUIRED) {
-    if (!(await state(join5(root, path)))?.isFile()) {
+    if (!(await state(join7(root, path)))?.isFile()) {
       throw new CreatorPreparationError(`CLI \u5185\u7F6E Creator Skill \u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u5B89\u88C5 CLI\uFF08\u7F3A\u5C11 ${path}\uFF09\u3002\u4E0D\u4F1A\u5C1D\u8BD5\u5728\u7EBF\u4E0B\u8F7D\u6216\u8986\u76D6\u9879\u76EE\u8D44\u6599\u3002`);
     }
   }
   return root;
 }
 function handoffMarkdown(context, skillRoot, session, workspacePath) {
-  const contextPath = join5(context.projectRoot, ".buddy", "creator", "initial-context.json");
+  const contextPath = join7(context.projectRoot, ".buddy", "creator", "initial-context.json");
   const openArgs = [
     "-B",
-    join5(skillRoot, "scripts/buddy.py"),
+    join7(skillRoot, "scripts/buddy.py"),
     "open",
     "--workspace",
     workspacePath,
@@ -1616,7 +1833,7 @@ function handoffMarkdown(context, skillRoot, session, workspacePath) {
 
 ## \u73B0\u5728\u7531 Coding Agent \u6267\u884C
 
-1. \u5B8C\u6574\u8BFB\u53D6 ${JSON.stringify(join5(skillRoot, "SKILL.md"))} \u53CA\u5176\u6307\u5B9A\u7684 references\u3002\u4FDD\u7559\u539F\u6709\u56DB\u9636\u6BB5\u89C4\u5219\uFF0C\u7531\u5F53\u524D\u4E3B\u5BF9\u8BDD\u5B8C\u6210\u91C7\u8BBF\uFF1B\u65E0\u9700\u53E6\u8D77 Sub-agent \u6216\u8FD0\u884C\u91C7\u8BBF\u6A21\u578B\u670D\u52A1\u3002
+1. \u5B8C\u6574\u8BFB\u53D6 ${JSON.stringify(join7(skillRoot, "SKILL.md"))} \u53CA\u5176\u6307\u5B9A\u7684 references\u3002\u4FDD\u7559\u539F\u6709\u56DB\u9636\u6BB5\u89C4\u5219\uFF0C\u7531\u5F53\u524D\u4E3B\u5BF9\u8BDD\u5B8C\u6210\u91C7\u8BBF\uFF1B\u65E0\u9700\u53E6\u8D77 Sub-agent \u6216\u8FD0\u884C\u91C7\u8BBF\u6A21\u578B\u670D\u52A1\u3002
 2. \u67E5\u627E\u5BBF\u4E3B\u6216\u7CFB\u7EDF\u5B9E\u9645\u53EF\u7528\u7684 Python 3.9+\uFF0C\u68C0\u67E5\u7248\u672C\uFF0C\u4FDD\u5B58\u5176\u7EDD\u5BF9\u8DEF\u5F84\u3002\u4E0D\u8981\u5199\u6B7B\u672C\u673A\u8DEF\u5F84\uFF0C\u4E0D\u5B89\u88C5 pip/npm \u4F9D\u8D56\u3002\u6CA1\u6709 Python \u65F6\u62A5\u544A\u7F3A\u53E3\uFF0C\u4FDD\u7559\u672C\u5730\u9879\u76EE\u3002\u6240\u6709 Python \u8C03\u7528\u5747\u52A0 -B\uFF0C\u5E76\u8BBE\u7F6E\u8FDB\u7A0B\u73AF\u5883\u53D8\u91CF PYTHONDONTWRITEBYTECODE=1\uFF08\u7531\u9884\u89C8\u5B50\u8FDB\u7A0B\u7EE7\u627F\uFF09\uFF0C\u907F\u514D\u5411 CLI \u5B89\u88C5\u76EE\u5F55\u5199\u5165\u5B57\u8282\u7801\u7F13\u5B58\u3002
 3. \u4F7F\u7528\u5DE5\u5177\u4F20\u9012\u72EC\u7ACB\u53C2\u6570\uFF0C\u4E0D\u62FC\u63A5 shell \u5B57\u7B26\u4E32\u3002\u5DE5\u4F5C\u76EE\u5F55\u4E3A ${JSON.stringify(context.projectRoot)}\uFF1B\u4EE5\u5B9E\u9645 Python \u8DEF\u5F84\u4E3A executable\uFF0C\u9996\u6B21\u6253\u5F00\u7684 argv \u5982\u4E0B\uFF1A
 
@@ -1653,11 +1870,11 @@ ${DEVELOPMENT_HANDOFF}
 `;
 }
 async function prepareCreatorSkill(context, io, options = {}) {
-  const root = join5(context.projectRoot, ".buddy", "creator");
+  const root = join7(context.projectRoot, ".buddy", "creator");
   try {
-    await safeDirectory(join5(context.projectRoot, ".buddy"));
+    await safeDirectory(join7(context.projectRoot, ".buddy"));
     await safeDirectory(root);
-    const sessionPath = join5(root, "session.json");
+    const sessionPath = join7(root, "session.json");
     await writeOnce(sessionPath, JSON.stringify({
       schemaVersion: 1,
       platformBuddyId: context.buddyId,
@@ -1669,11 +1886,11 @@ async function prepareCreatorSkill(context, io, options = {}) {
     }
     options.signal?.throwIfAborted();
     const skillRoot = await bundledSkill(options.bundledSkillRoot ?? BUNDLED_CREATOR_SKILL_ROOT);
-    await safeDirectory(join5(root, "workspaces"));
-    const workspacePath = join5(root, "workspaces", session.creationKey);
+    await safeDirectory(join7(root, "workspaces"));
+    const workspacePath = join7(root, "workspaces", session.creationKey);
     const workspace = await state(workspacePath);
     if (workspace && !workspace.isDirectory()) throw new CreatorPreparationError("\u5DF2\u6709\u521B\u4F5C\u5DE5\u4F5C\u533A\u4E0D\u662F\u666E\u901A\u76EE\u5F55\u3002");
-    const contextPath = join5(root, "initial-context.json");
+    const contextPath = join7(root, "initial-context.json");
     await writeOnce(contextPath, JSON.stringify({
       source: "platform_meta",
       name: context.appName,
@@ -1689,7 +1906,7 @@ async function prepareCreatorSkill(context, io, options = {}) {
     } catch {
       throw new CreatorPreparationError(`\u5DF2\u6709\u521D\u59CB\u80CC\u666F\u65E0\u6548\uFF0C\u5DF2\u4FDD\u7559\u539F\u6587\u4EF6\uFF0C\u8BF7\u68C0\u67E5\uFF1A${contextPath}`);
     }
-    const handoffPath = join5(root, "HANDOFF.md");
+    const handoffPath = join7(root, "HANDOFF.md");
     const handoff = handoffMarkdown({
       ...context,
       appName: initial.name,
@@ -1700,11 +1917,11 @@ async function prepareCreatorSkill(context, io, options = {}) {
     if ((await safeRead(handoffPath))?.toString("utf8") !== handoff) {
       throw new CreatorPreparationError(`\u5DF2\u6709\u63A5\u7EED\u8BF4\u660E\u88AB\u4FEE\u6539\u6216\u9879\u76EE\u8DEF\u5F84\u5DF2\u53D8\u5316\uFF0C\u5DF2\u4FDD\u7559\u539F\u6587\u4EF6\u3002\u8BF7\u5907\u4EFD\u79FB\u8D70\u8BE5\u8BF4\u660E\u540E\u91CD\u8BD5\uFF1A${handoffPath}`);
     }
-    io.write(`\u4F7F\u7528 CLI \u5185\u7F6E Creator Skill\uFF0C\u65E0\u9700\u989D\u5916\u4E0B\u8F7D\uFF1A${join5(skillRoot, "SKILL.md")}`);
+    io.write(`\u4F7F\u7528 CLI \u5185\u7F6E Creator Skill\uFF0C\u65E0\u9700\u989D\u5916\u4E0B\u8F7D\uFF1A${join7(skillRoot, "SKILL.md")}`);
     io.write(`\u4E0B\u4E00\u6B65\u4EA4\u7ED9 Codex / Claude Code \u7B49 Coding Agent\uFF1A\u8BF7\u8BFB\u53D6 ${JSON.stringify(handoffPath)}\uFF0C\u6309\u5F53\u524D\u9636\u6BB5\u63A5\u7EED\uFF1BCreator \u5B8C\u6210\u540E\u8FD4\u56DE CLI \u5F00\u53D1\u6D41\u7A0B\u3002`);
     io.write(DEVELOPMENT_HANDOFF_SUMMARY);
     io.write("\u672C\u547D\u4EE4\u53EA\u8D1F\u8D23\u8EAB\u4EFD\u767B\u8BB0\u548C Skill \u51C6\u5907\uFF0C\u4E0D\u4EE3\u8868\u91C7\u8BBF\u3001Booklet \u6216 Agent \u5DF2\u5B8C\u6210\u3002\u8BF7\u6309\u5DF2\u6709\u4F5C\u54C1\u8FDB\u5EA6\u63A5\u7EED\uFF0C\u56DB\u518C\u53CA\u5C0F\u6302\u4EF6\u8BBE\u8BA1\u9A8C\u6536\u3001\u4EA4\u4ED8\u6821\u9A8C\u5B8C\u6210\u540E\u81EA\u52A8\u8FDB\u5165\u5B98\u65B9 Runtime \u5F00\u53D1\uFF1B\u91CD\u590D create \u4F1A\u590D\u7528\u540C\u4E00\u4F5C\u54C1\u3002");
-    return { exitCode: 0, creator: { skillPath: join5(skillRoot, "SKILL.md"), handoffPath, workspacePath } };
+    return { exitCode: 0, creator: { skillPath: join7(skillRoot, "SKILL.md"), handoffPath, workspacePath } };
   } catch (cause) {
     const message = cause instanceof CreatorPreparationError ? cause.message : "\u5185\u7F6E\u8D44\u6E90\u8BFB\u53D6\u6216\u672C\u5730\u5199\u5165\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5 CLI \u5B89\u88C5\u548C\u76EE\u5F55\u6743\u9650\u3002";
     io.writeError(`Creator Skill \u51C6\u5907\u5931\u8D25\uFF1A${message}`);
@@ -1746,7 +1963,7 @@ function validateBuddyAvatar(value) {
   if (value !== null) {
     let valid = false;
     if (typeof value === "string" && value.length > 0 && value.length <= 2048 && !/[\s\u0000-\u001f]/u.test(value)) {
-      valid = /^\/media\/[A-Za-z0-9_.-]+$/u.test(value);
+      valid = /^\/media\/[A-Za-z0-9_.-]+(?:\?v=[a-f0-9]{16})?$/u.test(value);
       if (!valid) {
         try {
           const url = new URL(value);
@@ -1758,9 +1975,13 @@ function validateBuddyAvatar(value) {
     if (!valid) invalidRequest("avatar \u5FC5\u987B\u4E3A\u5408\u6CD5\u56FE\u7247\u5730\u5740\u6216 null");
   }
 }
+function validateBuddyMetaUpdate(meta2) {
+  if (meta2.avatar !== void 0 && meta2.avatar !== null) invalidRequest("\u5934\u50CF\u5730\u5740\u7531\u5E73\u53F0\u751F\u6210\uFF0C\u8BF7\u4E0A\u4F20\u56FE\u7247\u6587\u4EF6\u6216\u4F20 null \u6E05\u9664");
+  if (Object.keys(meta2).some((key) => key !== "avatar")) validateBuddyMeta(meta2);
+}
 
 // packages/cli-core/src/commands/dev.ts
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 
 // packages/cli-core/src/platform-url.ts
 var DEFAULT_MLB_TEST_URL = "http://47.116.168.81:8788";
@@ -2058,15 +2279,15 @@ function buildAgentEnvironment(options) {
 
 // packages/cli-core/src/dev/orchestrator.ts
 import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile7 } from "node:fs/promises";
-import { join as join7, resolve as resolve9 } from "node:path";
+import { readFile as readFile9 } from "node:fs/promises";
+import { join as join9, resolve as resolve10 } from "node:path";
 
 // packages/cli-core/src/dev/launch.ts
 import { lstatSync, readFileSync } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname2, resolve as resolve8 } from "node:path";
+import { dirname as dirname2, resolve as resolve9 } from "node:path";
 async function officialAgentLaunchPlan(input) {
-  const entry = resolve8(input.projectRoot, BUDDY_PLATFORM_START_ENTRY);
+  const entry = resolve9(input.projectRoot, BUDDY_PLATFORM_START_ENTRY);
   for (const [filename, kind] of [
     [dirname2(BUDDY_PLATFORM_FACTORY_ENTRY), "directory"],
     [BUDDY_PLATFORM_START_ENTRY, "file"],
@@ -2074,7 +2295,7 @@ async function officialAgentLaunchPlan(input) {
     [BUDDY_PLATFORM_PACKAGE_JSON, "file"]
   ]) {
     try {
-      const entry2 = lstatSync(resolve8(input.projectRoot, filename));
+      const entry2 = lstatSync(resolve9(input.projectRoot, filename));
       if (!(kind === "directory" ? entry2.isDirectory() : entry2.isFile())) {
         throw new Error(`${filename} must be a regular ${kind}`);
       }
@@ -2087,7 +2308,7 @@ async function officialAgentLaunchPlan(input) {
       });
     }
   }
-  const packagePath = resolve8(input.projectRoot, BUDDY_PLATFORM_PACKAGE_JSON);
+  const packagePath = resolve9(input.projectRoot, BUDDY_PLATFORM_PACKAGE_JSON);
   try {
     const expected = runtimeDependencyVersion(JSON.parse(readFileSync(packagePath, "utf8")));
     if (!expected) throw new Error(`package.json \u7684 dependencies \u5FC5\u987B\u58F0\u660E ${BUDDY_RUNTIME_PACKAGE} \u7684\u51C6\u786E\u7248\u672C`);
@@ -2095,6 +2316,7 @@ async function officialAgentLaunchPlan(input) {
     const installed = JSON.parse(readFileSync(runtimePath, "utf8")).version;
     if (installed !== expected) throw new Error(`Runtime \u5DF2\u5B89\u88C5 ${installed}\uFF0C\u5DE5\u7A0B\u8981\u6C42 ${expected}`);
     await validateRuntimeDatasets(input.projectRoot, input.datasets);
+    await validateRuntimeModel(input.projectRoot, input.model);
   } catch (cause) {
     throw new BuddyDevError({
       code: "DEV_CONFIG_INVALID",
@@ -2137,16 +2359,16 @@ var NodeAgentProcessLauncher = class {
     }
     let hasExited = false;
     let spawned = false;
-    const exit = new Promise((resolve16) => {
+    const exit = new Promise((resolve17) => {
       child.once("error", (error2) => {
         if (!spawned) {
           hasExited = true;
-          resolve16({ code: null, signal: null, error: error2 });
+          resolve17({ code: null, signal: null, error: error2 });
         }
       });
       child.once("exit", (code2, signal) => {
         hasExited = true;
-        resolve16({ code: code2, signal });
+        resolve17({ code: code2, signal });
       });
     });
     child.stdout?.on("data", (chunk) => {
@@ -2162,11 +2384,11 @@ var NodeAgentProcessLauncher = class {
       }
     });
     try {
-      await new Promise((resolve16, reject) => {
+      await new Promise((resolve17, reject) => {
         const onSpawn = () => {
           spawned = true;
           child.off("error", onError);
-          resolve16();
+          resolve17();
         };
         const onError = (error2) => {
           child.off("spawn", onSpawn);
@@ -2205,11 +2427,11 @@ var NodeAgentProcessLauncher = class {
 };
 function waitForExit(process2, timeoutMs) {
   if (process2.hasExited()) return Promise.resolve(true);
-  return new Promise((resolve16) => {
-    const timeout = setTimeout(() => resolve16(false), timeoutMs);
+  return new Promise((resolve17) => {
+    const timeout = setTimeout(() => resolve17(false), timeoutMs);
     process2.exit.then(() => {
       clearTimeout(timeout);
-      resolve16(true);
+      resolve17(true);
     });
   });
 }
@@ -2292,7 +2514,7 @@ async function waitForGroupExit(pid, isGroupAlive, timeoutMs) {
   while (isGroupAlive(pid)) {
     const remaining = deadline - Date.now();
     if (remaining <= 0) return false;
-    await new Promise((resolve16) => setTimeout(resolve16, Math.min(25, remaining)));
+    await new Promise((resolve17) => setTimeout(resolve17, Math.min(25, remaining)));
   }
   return true;
 }
@@ -2307,9 +2529,9 @@ function processTreeControllerFor(platform) {
 
 // packages/cli-core/src/dev/instance-lock.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
-import { mkdir as mkdir5, readFile as readFile6, readdir as readdir3, rename as rename3, rmdir as rmdir2, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join as join6 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile8, readdir as readdir3, rename as rename4, rmdir as rmdir2, unlink as unlink4, writeFile as writeFile5 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join8 } from "node:path";
 function alreadyRunningError() {
   const message = "\u8FD9\u4E2A\u642D\u5B50\u5DF2\u6709 DEV \u5B9E\u4F8B\u5728\u8FD0\u884C\u3002\u8BF7\u5148\u5728\u539F\u9884\u89C8\u9875\u70B9\u51FB\u300C\u505C\u6B62 DEV\u300D\uFF0C\u6216\u5728\u8FD0\u884C dev \u7684\u7EC8\u7AEF\u6309 Ctrl+C\uFF0C\u518D\u542F\u52A8\u3002";
   return Object.assign(new BuddyDevError({ code: "DEV_ALREADY_RUNNING", phase: "launch", message }), { publicMessage: message });
@@ -2329,20 +2551,20 @@ function code(error2) {
   return error2?.code;
 }
 async function acquireDevInstanceLock(options) {
-  const root = options.directory ?? join6(homedir(), ".buddy", "dev-locks");
+  const root = options.directory ?? join8(homedir2(), ".buddy", "dev-locks");
   const key = createHash2("sha256").update(`${new URL(options.gatewayUrl).origin}
 ${options.devAgentId}`).digest("hex");
-  const path = join6(root, key);
+  const path = join8(root, key);
   const ownerName = `owner-${randomUUID3()}.json`;
-  const candidate = join6(root, `.pending-${randomUUID3()}`);
+  const candidate = join8(root, `.pending-${randomUUID3()}`);
   const owner = { pid: process.pid };
-  await mkdir5(root, { recursive: true, mode: 448 });
-  await mkdir5(candidate, { mode: 448 });
-  await writeFile3(join6(candidate, ownerName), JSON.stringify(owner), { mode: 384, flag: "wx" });
+  await mkdir6(root, { recursive: true, mode: 448 });
+  await mkdir6(candidate, { mode: 448 });
+  await writeFile5(join8(candidate, ownerName), JSON.stringify(owner), { mode: 384, flag: "wx" });
   try {
     for (let attempt = 0; ; attempt++) {
       try {
-        await rename3(candidate, path);
+        await rename4(candidate, path);
         break;
       } catch (error2) {
         if (!["EEXIST", "ENOTEMPTY"].includes(code(error2) ?? "")) throw error2;
@@ -2357,10 +2579,10 @@ ${options.devAgentId}`).digest("hex");
       }
       if (names.length === 0) continue;
       if (names.length !== 1 || !/^owner-[a-f0-9-]+\.json$/u.test(names[0])) throw alreadyRunningError();
-      const previousPath = join6(path, names[0]);
+      const previousPath = join8(path, names[0]);
       let previous;
       try {
-        previous = JSON.parse(await readFile6(previousPath, "utf8"));
+        previous = JSON.parse(await readFile8(previousPath, "utf8"));
       } catch (error2) {
         if (code(error2) === "ENOENT") continue;
         throw alreadyRunningError();
@@ -2377,17 +2599,17 @@ ${options.devAgentId}`).digest("hex");
       });
     }
   } finally {
-    await unlink4(join6(candidate, ownerName)).catch(() => void 0);
+    await unlink4(join8(candidate, ownerName)).catch(() => void 0);
     await rmdir2(candidate).catch(() => void 0);
   }
   let released = false;
   return {
     async attachRuntime(pid) {
       if (!validPid(pid)) throw new TypeError("Runtime PID is invalid");
-      const temporary = join6(root, `.update-${randomUUID3()}`);
+      const temporary = join8(root, `.update-${randomUUID3()}`);
       try {
-        await writeFile3(temporary, JSON.stringify({ ...owner, runtimePid: pid }), { mode: 384, flag: "wx" });
-        await rename3(temporary, join6(path, ownerName));
+        await writeFile5(temporary, JSON.stringify({ ...owner, runtimePid: pid }), { mode: 384, flag: "wx" });
+        await rename4(temporary, join8(path, ownerName));
       } finally {
         await unlink4(temporary).catch(() => void 0);
       }
@@ -2395,7 +2617,7 @@ ${options.devAgentId}`).digest("hex");
     async release() {
       if (released) return;
       released = true;
-      await unlink4(join6(path, ownerName)).catch((error2) => {
+      await unlink4(join8(path, ownerName)).catch((error2) => {
         if (code(error2) !== "ENOENT") throw error2;
       });
       await rmdir2(path).catch((error2) => {
@@ -2448,6 +2670,7 @@ function validateLaunchPlan(value) {
 async function launchPlanFor(config, options, projectRoot, signal) {
   const provider = options.platformLaunchPlan ?? ((context) => officialAgentLaunchPlan({
     datasets: config.datasets,
+    model: config.model,
     projectRoot: context.projectRoot
   }));
   try {
@@ -2638,7 +2861,7 @@ async function startBuddyDev(options) {
   const pollIntervalMs = positiveDuration(options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS, "pollIntervalMs");
   const stopGracePeriodMs = positiveDuration(options.stopGracePeriodMs ?? DEFAULT_STOP_GRACE_PERIOD_MS, "stopGracePeriodMs");
   const devAgentId = safeDevAgentId(options.devAgentId);
-  const projectRoot = resolve9(options.projectRoot);
+  const projectRoot = resolve10(options.projectRoot);
   const lifecycle = new AbortController();
   const signal = options.signal === void 0 ? lifecycle.signal : AbortSignal.any([lifecycle.signal, options.signal]);
   let agentProcess;
@@ -2656,7 +2879,7 @@ async function startBuddyDev(options) {
     let config;
     let configSource;
     try {
-      configSource = await readFile7(join7(projectRoot, BUDDY_AGENT_FILENAME), "utf8");
+      configSource = await readFile9(join9(projectRoot, BUDDY_AGENT_FILENAME), "utf8");
       config = combineBuddyProject(parseBuddyAgentConfig(configSource));
     } catch (cause) {
       throw new BuddyDevError({
@@ -2760,7 +2983,7 @@ async function startBuddyDev(options) {
 }
 
 // packages/cli-core/src/dev/starter.ts
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 function createBuddyDevStarter(options = {}) {
   const readManifest = options.readManifest ?? (async (projectRoot) => {
     const manifest = await readBuddyProjectManifest(projectRoot);
@@ -2769,7 +2992,7 @@ function createBuddyDevStarter(options = {}) {
   const startDev = options.startDev ?? startBuddyDev;
   return Object.freeze({
     async start(input) {
-      const projectRoot = resolve10(input.projectRoot);
+      const projectRoot = resolve11(input.projectRoot);
       const manifest = await readManifest(projectRoot);
       return startDev({
         ...input,
@@ -2860,7 +3083,7 @@ async function runDevCommand(args, io, options = {}) {
     return { exitCode: 0 };
   }
   try {
-    const requestedRoot = resolve11(options.cwd ?? process.cwd(), parsed.directory);
+    const requestedRoot = resolve12(options.cwd ?? process.cwd(), parsed.directory);
     const root = await (options.resolveProjectRoot ?? requireBuddyAgentProjectRoot)(requestedRoot);
     const environment = options.env ?? process.env;
     const url = appServerUrl(parsed.appServer, environment);
@@ -2913,7 +3136,34 @@ async function runDevCommand(args, io, options = {}) {
 }
 
 // packages/cli-core/src/commands/cloud.ts
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
+
+// packages/cli-core/src/cloud/avatar.ts
+import { open as open3 } from "node:fs/promises";
+import { basename } from "node:path";
+var MAX_BUDDY_AVATAR_BYTES = 5 * 1024 * 1024;
+async function readBuddyAvatarFile(path) {
+  const file2 = await open3(path, "r");
+  try {
+    const stat2 = await file2.stat();
+    if (!stat2.isFile()) throw new Error("\u5934\u50CF\u5FC5\u987B\u662F\u666E\u901A\u56FE\u7247\u6587\u4EF6");
+    if (!stat2.size || stat2.size > MAX_BUDDY_AVATAR_BYTES) throw new Error("\u5934\u50CF\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u4E0D\u80FD\u8D85\u8FC7 5 MiB");
+    const buffer = Buffer.alloc(MAX_BUDDY_AVATAR_BYTES + 1);
+    let size = 0;
+    while (size < buffer.length) {
+      const { bytesRead } = await file2.read(buffer, size, buffer.length - size, null);
+      if (!bytesRead) break;
+      size += bytesRead;
+    }
+    if (!size || size > MAX_BUDDY_AVATAR_BYTES) throw new Error("\u5934\u50CF\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u4E0D\u80FD\u8D85\u8FC7 5 MiB");
+    const bytes = buffer.subarray(0, size);
+    const mediaType = bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) ? "image/png" : bytes.subarray(0, 3).equals(Buffer.from([255, 216, 255])) ? "image/jpeg" : bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP" ? "image/webp" : void 0;
+    if (!mediaType) throw new Error("\u4EC5\u652F\u6301 PNG\u3001JPEG\u3001WebP \u56FE\u7247\u6587\u4EF6");
+    return { bytes, fileName: basename(path), mediaType };
+  } finally {
+    await file2.close();
+  }
+}
 
 // packages/cli-core/src/cloud/auth.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
@@ -3253,7 +3503,7 @@ var HttpDeveloperPlatformClient = class {
             "Content-Length": String(binaryBody.byteLength)
           }
         },
-        ...options.json !== void 0 ? { body: JSON.stringify(options.json) } : binaryBody === void 0 ? {} : { body: binaryBody },
+        ...options.form !== void 0 ? { body: options.form } : options.json !== void 0 ? { body: JSON.stringify(options.json) } : binaryBody === void 0 ? {} : { body: binaryBody },
         redirect: "error",
         signal: controller.signal
       });
@@ -3280,7 +3530,14 @@ var HttpDeveloperPlatformClient = class {
     return buddy(await this.#request("/cli/buddies", "POST", { json: { meta: request.meta } }), true);
   }
   async updateBuddy(request) {
-    validateBuddyMeta(request.meta);
+    validateBuddyMetaUpdate(request.meta);
+    if (request.avatar) {
+      if (request.meta.avatar === null) throw new CloudLifecycleError("INVALID_REQUEST", "\u4E0D\u80FD\u540C\u65F6\u4E0A\u4F20\u548C\u6E05\u9664\u5934\u50CF");
+      const form = new FormData();
+      form.set("meta", JSON.stringify(request.meta));
+      form.set("avatar", new Blob([new Uint8Array(request.avatar.bytes)], { type: request.avatar.mediaType }), request.avatar.fileName);
+      return buddy(await this.#request(`/cli/buddies/${encodeURIComponent(request.id)}/meta`, "PUT", { form }), true);
+    }
     return buddy(await this.#request(`/cli/buddies/${encodeURIComponent(request.id)}/meta`, "PUT", {
       json: request.meta
     }), true);
@@ -3408,10 +3665,10 @@ function browserCommand(url) {
 }
 async function openExternalUrl(url) {
   const launch = browserCommand(url);
-  await new Promise((resolve16, reject) => {
+  await new Promise((resolve17, reject) => {
     const child = spawn(launch.command, launch.args, { shell: false, stdio: "ignore", windowsHide: true });
     child.once("error", reject);
-    child.once("exit", (code2) => code2 === 0 ? resolve16() : reject(new Error(`browser launcher exited with ${code2 ?? "unknown"}`)));
+    child.once("exit", (code2) => code2 === 0 ? resolve17() : reject(new Error(`browser launcher exited with ${code2 ?? "unknown"}`)));
   });
 }
 async function write(res, status, title, message, webUrl, tone = "error") {
@@ -3423,10 +3680,10 @@ async function write(res, status, title, message, webUrl, tone = "error") {
     "referrer-policy": "no-referrer",
     "x-content-type-options": "nosniff"
   });
-  await new Promise((resolve16, reject) => {
+  await new Promise((resolve17, reject) => {
     res.once("error", reject);
-    res.once("close", resolve16);
-    res.end(renderLoginResult(title, message, webUrl, tone), resolve16);
+    res.once("close", resolve17);
+    res.end(renderLoginResult(title, message, webUrl, tone), resolve17);
   });
 }
 async function readJson(response) {
@@ -3461,11 +3718,11 @@ var LoopbackBrowserLoginAdapter = class {
     let settle;
     let reject;
     let settled = false;
-    const result = new Promise((resolve16, rejectResult) => {
+    const result = new Promise((resolve17, rejectResult) => {
       settle = (value) => {
         if (!settled) {
           settled = true;
-          resolve16(value);
+          resolve17(value);
         }
       };
       reject = (reason) => {
@@ -3484,9 +3741,9 @@ var LoopbackBrowserLoginAdapter = class {
         state: request.state
       }).then(settle, reject);
     });
-    await new Promise((resolve16, rejectListen) => {
+    await new Promise((resolve17, rejectListen) => {
       server.once("error", rejectListen);
-      server.listen(0, "127.0.0.1", () => resolve16());
+      server.listen(0, "127.0.0.1", () => resolve17());
     });
     const address = server.address();
     if (!address || typeof address === "string") {
@@ -3519,8 +3776,8 @@ var LoopbackBrowserLoginAdapter = class {
     } finally {
       clearTimeout(timer);
       request.signal?.removeEventListener("abort", abort);
-      await new Promise((resolve16) => {
-        server.close(() => resolve16());
+      await new Promise((resolve17) => {
+        server.close(() => resolve17());
         server.closeIdleConnections();
         server.closeAllConnections();
       });
@@ -3635,7 +3892,7 @@ function parse(source) {
   });
 }
 async function runCredentialCommand(input) {
-  return await new Promise((resolve16, reject) => {
+  return await new Promise((resolve17, reject) => {
     const child = spawn2(input.command, [...input.args], {
       shell: false,
       windowsHide: true,
@@ -3651,7 +3908,7 @@ async function runCredentialCommand(input) {
     child.stdout.on("data", (chunk) => collect(stdout, chunk));
     child.stderr.on("data", (chunk) => collect(stderr, chunk));
     child.once("error", reject);
-    child.once("close", (code2) => resolve16({
+    child.once("close", (code2) => resolve17({
       code: code2 ?? 1,
       stdout: Buffer.concat(stdout).toString("utf8"),
       stderr: Buffer.concat(stderr).toString("utf8")
@@ -3711,7 +3968,7 @@ var SystemCloudTokenStore = class {
 };
 
 // packages/cli-core/src/cloud/mock-client.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash5, randomBytes as randomBytes2 } from "node:crypto";
 var MockDeveloperPlatformClient = class {
   #now;
   #buddies = /* @__PURE__ */ new Map();
@@ -3737,7 +3994,10 @@ var MockDeveloperPlatformClient = class {
   }
   async updateBuddy(request) {
     const current = this.#require(request.id);
-    const next = this.#value({ ...current, meta: request.meta, updatedAt: this.#now() });
+    validateBuddyMetaUpdate(request.meta);
+    const onlyAvatar = Object.keys(request.meta).every((key) => key === "avatar");
+    const avatar = request.avatar ? `/media/avatar-${request.id}.webp?v=${createHash5("sha256").update(request.avatar.bytes).digest("hex").slice(0, 16)}` : request.meta.avatar === null ? null : current.meta?.avatar ?? null;
+    const next = this.#value({ ...current, meta: { ...onlyAvatar ? current.meta : request.meta, avatar }, updatedAt: this.#now() });
     this.#buddies.set(request.id, next);
     return structuredClone(next);
   }
@@ -3823,9 +4083,9 @@ var HELP = Object.freeze({
   logout: "\u7528\u6CD5: buddy-cli logout",
   push: "\u7528\u6CD5: buddy-cli push [--directory <\u9879\u76EE\u76EE\u5F55>] [--commit <\u672C\u6B21\u6539\u52A8\u8BF4\u660E>]",
   status: "\u7528\u6CD5: buddy-cli status [--directory <\u9879\u76EE\u76EE\u5F55>]",
-  avatar: `\u7528\u6CD5: buddy-cli avatar (--url <\u56FE\u7247\u5730\u5740> | --clear) [--directory <\u9879\u76EE\u76EE\u5F55> | --buddy-id <\u642D\u5B50 ID>]
+  avatar: `\u7528\u6CD5: buddy-cli avatar (--file <\u56FE\u7247\u6587\u4EF6> | --clear) [--directory <\u9879\u76EE\u76EE\u5F55> | --buddy-id <\u642D\u5B50 ID>]
 \u4FEE\u6539\u5F53\u524D\u9879\u76EE\u6216\u6307\u5B9A\u642D\u5B50\u7684\u4E91\u7AEF\u5934\u50CF\uFF0C\u4FDD\u7559\u5176\u4ED6\u8D44\u6599\uFF1B\u4E0D\u9700\u8981\u5B89\u88C5 Runtime \u6216\u4E0A\u4F20\u4EE3\u7801\u5305\u3002
---url \u63A5\u53D7 HTTP(S) \u56FE\u7247 URL \u6216\u5DF2\u6709\u7684 /media/... \u5730\u5740\uFF0C\u4E0D\u63A5\u53D7\u672C\u5730\u6587\u4EF6\u3002
+--file \u63A5\u53D7\u672C\u5730\u9759\u6001 PNG\u3001JPEG\u3001WebP \u56FE\u7247\uFF0C\u6700\u5927 5 MiB\uFF1BServer \u81EA\u52A8\u5904\u7406\u5E76\u751F\u6210\u5730\u5740\u3002
 \u9700\u8981\u5F53\u524D\u8D26\u53F7\u62E5\u6709\u8BE5\u642D\u5B50\uFF0C\u547D\u4EE4\u6267\u884C\u540E\u7ACB\u5373\u66F4\u65B0\u4E91\u7AEF\u8D44\u6599\u3002`
 });
 function parse2(args, command) {
@@ -3843,7 +4103,7 @@ function parse2(args, command) {
       values.set(flag2, "");
       continue;
     }
-    const allowed = command === "push" ? flag2 === "--directory" || flag2 === "--commit" : command === "avatar" ? ["--directory", "--buddy-id", "--url"].includes(flag2) : command === "status" && flag2 === "--directory";
+    const allowed = command === "push" ? flag2 === "--directory" || flag2 === "--commit" : command === "avatar" ? ["--directory", "--buddy-id", "--file"].includes(flag2) : command === "status" && flag2 === "--directory";
     if (!allowed) throw new CloudCommandUsageError(`\u672A\u77E5\u53C2\u6570 ${flag2}`);
     const value = args[index + 1];
     if (value === void 0 || !value.trim() || command === "avatar" && value.startsWith("--")) throw new CloudCommandUsageError(`${flag2} \u7F3A\u5C11\u503C`);
@@ -3880,7 +4140,7 @@ function dependencies(options) {
   return { session: options.session, client: options.client };
 }
 function requestedDirectory(options, parsed) {
-  return resolve12(options.cwd ?? process.cwd(), parsed.values.get("--directory") ?? ".");
+  return resolve13(options.cwd ?? process.cwd(), parsed.values.get("--directory") ?? ".");
 }
 function auditLabel(status) {
   if (status === "auditing") return "\u5BA1\u6838\u4E2D";
@@ -3955,17 +4215,18 @@ async function runPush(parsed, io, options) {
   return { exitCode: 0, buddyId: config.buddyId, version: receipt.version };
 }
 async function runAvatar(parsed, io, options) {
-  if (parsed.values.has("--url") === parsed.values.has("--clear")) {
-    throw new CloudCommandUsageError("\u5FC5\u987B\u9009\u62E9 --url <\u56FE\u7247\u5730\u5740> \u6216 --clear\uFF0C\u4E14\u4E0D\u80FD\u540C\u65F6\u4F7F\u7528");
+  if (parsed.values.has("--file") === parsed.values.has("--clear")) {
+    throw new CloudCommandUsageError("\u5FC5\u987B\u9009\u62E9 --file <\u56FE\u7247\u6587\u4EF6> \u6216 --clear\uFF0C\u4E14\u4E0D\u80FD\u540C\u65F6\u4F7F\u7528");
   }
   if (parsed.values.has("--buddy-id") && parsed.values.has("--directory")) {
     throw new CloudCommandUsageError("--buddy-id \u548C --directory \u4E0D\u80FD\u540C\u65F6\u4F7F\u7528");
   }
-  const avatar = parsed.values.get("--url") ?? null;
+  const file2 = parsed.values.get("--file");
+  let upload;
   try {
-    validateBuddyAvatar(avatar);
+    upload = file2 ? await readBuddyAvatarFile(resolve13(options.cwd ?? process.cwd(), file2)) : void 0;
   } catch (error2) {
-    throw new CloudCommandUsageError(error2 instanceof Error ? error2.message : "\u5934\u50CF\u5730\u5740\u65E0\u6548");
+    throw new CloudCommandUsageError(error2 instanceof Error ? error2.message : "\u65E0\u6CD5\u8BFB\u53D6\u5934\u50CF\u56FE\u7247");
   }
   let id = parsed.values.get("--buddy-id");
   if (id !== void 0 && !/^[A-Za-z0-9_-]{1,128}$/u.test(id)) throw new CloudCommandUsageError("--buddy-id \u5FC5\u987B\u662F\u6709\u6548\u7684\u642D\u5B50 ID");
@@ -3978,12 +4239,13 @@ async function runAvatar(parsed, io, options) {
   await session.token({ signal: options.signal });
   const current = await client.getBuddy({ id });
   if (current.id !== id) throw new CloudLifecycleError("PLATFORM_RESPONSE_INVALID", "\u5E73\u53F0\u8FD4\u56DE\u7684\u642D\u5B50\u8EAB\u4EFD\u4E0D\u5339\u914D");
-  const updated = await client.updateBuddy({ id, meta: { ...current.meta, avatar } });
-  if (updated.id !== id || updated.meta?.avatar !== avatar) {
+  const updated = await client.updateBuddy({ id, meta: upload ? {} : { avatar: null }, ...upload ? { avatar: upload } : {} });
+  const avatar = updated.meta?.avatar;
+  if (updated.id !== id || (upload ? typeof avatar !== "string" || !avatar : avatar !== null)) {
     throw new CloudLifecycleError("PLATFORM_RESPONSE_INVALID", "\u5E73\u53F0\u672A\u786E\u8BA4\u5934\u50CF\u66F4\u65B0\uFF0C\u8BF7\u67E5\u8BE2\u642D\u5B50\u8D44\u6599\u786E\u8BA4\u7ED3\u679C");
   }
   io.write(`${avatar === null ? "\u5DF2\u6E05\u9664" : "\u5DF2\u66F4\u65B0"}\u642D\u5B50\u5934\u50CF\uFF1A${updated.meta?.name ?? id}\uFF08${id}\uFF09`);
-  if (avatar !== null) io.write(`\u5934\u50CF\uFF1A${avatar}`);
+  if (typeof avatar === "string") io.write(`\u5934\u50CF\uFF1A${avatar}`);
   io.write("\u4E91\u7AEF\u8D44\u6599\u5DF2\u66F4\u65B0\uFF0C\u65E0\u9700 push \u6216\u91CD\u65B0\u53D1\u5E03\u7A0B\u5E8F\u5305\u3002");
   return { exitCode: 0, buddyId: id };
 }
@@ -4031,8 +4293,8 @@ async function runCloudCommand(command, args, io, options = {}) {
 var CLOUD_COMMAND_HELP = HELP;
 
 // packages/cli-core/src/migration/index.ts
-import { lstat as lstat7, open as open3, readdir as readdir4, realpath as realpath4, stat } from "node:fs/promises";
-import { extname, isAbsolute as isAbsolute2, join as join8, relative, resolve as resolve13, sep, win32 as win322 } from "node:path";
+import { lstat as lstat8, open as open4, readdir as readdir4, realpath as realpath4, stat } from "node:fs/promises";
+import { extname, isAbsolute as isAbsolute2, join as join10, relative, resolve as resolve14, sep, win32 as win322 } from "node:path";
 var DEFAULT_SKILL_SCAN_LIMITS = Object.freeze({
   maxFiles: 128,
   maxFileBytes: 256 * 1024,
@@ -4185,7 +4447,7 @@ async function existingProjectRoot(value) {
     return rejectScan("SKILL_PROJECT_ROOT_INVALID", ".", "projectRoot \u5FC5\u987B\u6307\u5411\u4E00\u4E2A\u5DF2\u6709\u9879\u76EE\u76EE\u5F55\u3002");
   }
   try {
-    const root = await realpath4(resolve13(value));
+    const root = await realpath4(resolve14(value));
     if (!(await stat(root)).isDirectory()) {
       return rejectScan("SKILL_PROJECT_ROOT_INVALID", ".", "projectRoot \u5FC5\u987B\u6307\u5411\u4E00\u4E2A\u5DF2\u6709\u9879\u76EE\u76EE\u5F55\u3002");
     }
@@ -4201,9 +4463,9 @@ async function existingProjectRoot(value) {
   }
 }
 async function existingSkillRoot(projectRoot, skillPath) {
-  const candidate = skillPath === "." ? projectRoot : join8(projectRoot, ...skillPath.split("/"));
+  const candidate = skillPath === "." ? projectRoot : join10(projectRoot, ...skillPath.split("/"));
   try {
-    await lstat7(candidate);
+    await lstat8(candidate);
   } catch (cause) {
     if (filesystemCode(cause) === "ENOENT") {
       return rejectScan("SKILL_ROOT_NOT_FOUND", skillPath, "\u627E\u4E0D\u5230\u6307\u5B9A\u7684 Skill \u76EE\u5F55\u3002");
@@ -4238,9 +4500,9 @@ async function existingSkillRoot(projectRoot, skillPath) {
 }
 async function assertEntrypoint(context) {
   const entryPath = reportChild(context.skillPath, "SKILL.md");
-  const candidate = join8(context.skillRoot, "SKILL.md");
+  const candidate = join10(context.skillRoot, "SKILL.md");
   try {
-    await lstat7(candidate);
+    await lstat8(candidate);
     const target = await realpath4(candidate);
     if (!isWithin(context.projectRoot, target) || !isWithin(context.skillRoot, target)) {
       rejectScan(
@@ -4342,7 +4604,7 @@ async function walkDirectory(actualDirectory, reportDirectory, ancestors, contex
   }
   for (const entry of entries) {
     const childReportPath = reportChild(reportDirectory, entry.name);
-    const childPath = join8(directory, entry.name);
+    const childPath = join10(directory, entry.name);
     let target;
     try {
       target = await realpath4(childPath);
@@ -4384,7 +4646,7 @@ async function scanFile(actualPath, reportPath, context) {
   }
   let handle;
   try {
-    handle = await open3(actualPath, "r");
+    handle = await open4(actualPath, "r");
   } catch (cause) {
     return rejectScan("SKILL_SCAN_IO_ERROR", reportPath, "\u65E0\u6CD5\u6253\u5F00 Skill \u6587\u4EF6\u3002", cause);
   }
@@ -4796,9 +5058,9 @@ async function scanExternalSkillPortability(options) {
 }
 
 // packages/cli-core/src/push/preflight.ts
-import { createHash as createHash5 } from "node:crypto";
-import { lstat as lstat8, open as open4, readdir as readdir5, realpath as realpath5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join9, relative as relative2, resolve as resolve14, sep as sep2, win32 as win323 } from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import { lstat as lstat9, open as open5, readdir as readdir5, realpath as realpath5 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join11, relative as relative2, resolve as resolve15, sep as sep2, win32 as win323 } from "node:path";
 
 // packages/cli-core/src/push/errors.ts
 var PushPreflightError = class extends Error {
@@ -4896,7 +5158,7 @@ function error(options) {
   throw new PushPreflightError(options);
 }
 function sha256(value) {
-  return `sha256:${createHash5("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash6("sha256").update(value).digest("hex")}`;
 }
 function positiveLimit(value, name, hardMaximum) {
   if (!Number.isSafeInteger(value) || value < 1 || value > hardMaximum) {
@@ -4986,10 +5248,10 @@ function normalizeBookletPath(value) {
   return normalized;
 }
 async function canonicalProjectRoot(projectRoot) {
-  const absolute = resolve14(projectRoot);
+  const absolute = resolve15(projectRoot);
   let entry;
   try {
-    entry = await lstat8(absolute);
+    entry = await lstat9(absolute);
   } catch (cause) {
     error({
       code: "PUSH_PROJECT_INVALID",
@@ -5017,10 +5279,10 @@ async function canonicalProjectRoot(projectRoot) {
   }
 }
 async function captureConfigWithinLimit(projectRoot, maxFileBytes, filename) {
-  const path = join9(projectRoot, filename);
+  const path = join11(projectRoot, filename);
   let entry;
   try {
-    entry = await lstat8(path);
+    entry = await lstat9(path);
   } catch (cause) {
     error({
       code: "PUSH_CONFIG_INVALID",
@@ -5127,7 +5389,7 @@ function sameFileIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs;
 }
 async function hashRegularFile(options) {
-  const handle = await open4(options.absolutePath, "r").catch((cause) => error({
+  const handle = await open5(options.absolutePath, "r").catch((cause) => error({
     code: "PUSH_PROJECT_INVALID",
     path: options.portablePath,
     message: `\u65E0\u6CD5\u8BFB\u53D6\u63D0\u4EA4\u6587\u4EF6\uFF1A${options.portablePath}`,
@@ -5142,7 +5404,7 @@ async function hashRegularFile(options) {
         message: `\u751F\u6210\u6E05\u5355\u65F6\u6587\u4EF6\u53D1\u751F\u53D8\u5316\uFF1A${options.portablePath}`
       });
     }
-    const hash = createHash5("sha256");
+    const hash = createHash6("sha256");
     const captured = [];
     const buffer = Buffer.allocUnsafe(READ_BUFFER_BYTES);
     let bytes = 0;
@@ -5220,10 +5482,10 @@ async function createManifest(options) {
         sensitiveEntriesExcluded += 1;
         continue;
       }
-      const absolutePath = join9(directory, name);
+      const absolutePath = join11(directory, name);
       let entry;
       try {
-        entry = await lstat8(absolutePath);
+        entry = await lstat9(absolutePath);
       } catch (cause) {
         error({
           code: "PUSH_FILE_CHANGED",
@@ -5472,8 +5734,8 @@ async function assertCapturedConfigStable(options) {
   }
   let current;
   try {
-    const path = join9(options.projectRoot, options.filename);
-    const entry = await lstat8(path);
+    const path = join11(options.projectRoot, options.filename);
+    const entry = await lstat9(path);
     if (!entry.isFile() || entry.isSymbolicLink()) {
       error({
         code: "PUSH_FILE_CHANGED",
@@ -5556,14 +5818,15 @@ async function createPushPreflight(options) {
     maxFileBytes: limits.maxFileBytes
   });
   const config = parseCapturedProject(agentEntry);
-  if (config.datasets?.length) {
+  if (config.datasets?.length || config.model !== void 0) {
     try {
-      await validateRuntimeDatasets(projectRoot, config.datasets);
+      if (config.datasets?.length) await validateRuntimeDatasets(projectRoot, config.datasets);
+      await validateRuntimeModel(projectRoot, config.model);
     } catch (cause) {
       error({
         code: "PUSH_CONFIG_INVALID",
         path: BUDDY_AGENT_FILENAME,
-        message: `\u65E0\u6CD5\u6309\u5DE5\u7A0B Runtime \u6821\u9A8C\u6570\u636E\u58F0\u660E\uFF1A${cause instanceof Error ? cause.message : String(cause)}`,
+        message: `\u65E0\u6CD5\u6309\u5DE5\u7A0B Runtime \u6821\u9A8C\u6A21\u578B\u6216\u6570\u636E\u58F0\u660E\uFF1A${cause instanceof Error ? cause.message : String(cause)}`,
         cause
       });
     }
@@ -5607,16 +5870,16 @@ async function createPushPreflight(options) {
 }
 
 // packages/cli-core/src/push/bundle.ts
-import { createHash as createHash6 } from "node:crypto";
-import { lstat as lstat9, readFile as readFile8, realpath as realpath6 } from "node:fs/promises";
-import { join as join10, relative as relative3, sep as sep3, win32 as win324 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { lstat as lstat10, readFile as readFile10, realpath as realpath6 } from "node:fs/promises";
+import { join as join12, relative as relative3, sep as sep3, win32 as win324 } from "node:path";
 import { Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
 import { pack } from "tar-stream";
 var MEDIA_TYPE = "application/gzip";
 function digest(bytes) {
-  return `sha256:${createHash6("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash7("sha256").update(bytes).digest("hex")}`;
 }
 function changed(path, message, cause) {
   throw new PushPreflightError({
@@ -5631,15 +5894,15 @@ function inside(root, target) {
   return path === "" || path !== ".." && !path.startsWith(`..${sep3}`) && !path.startsWith("/") && !win324.isAbsolute(path);
 }
 async function capture(root, file2) {
-  const absolute = join10(root, ...file2.path.split("/"));
+  const absolute = join12(root, ...file2.path.split("/"));
   try {
-    const entry = await lstat9(absolute);
+    const entry = await lstat10(absolute);
     if (!entry.isFile() || entry.isSymbolicLink() || entry.size !== file2.bytes) {
       changed(file2.path, `\u63D0\u4EA4\u524D\u6587\u4EF6\u53D1\u751F\u53D8\u5316\uFF1A${file2.path}`);
     }
     const canonical = await realpath6(absolute);
     if (!inside(root, canonical)) changed(file2.path, `\u63D0\u4EA4\u6587\u4EF6\u8D8A\u8FC7\u9879\u76EE\u6839\u76EE\u5F55\uFF1A${file2.path}`);
-    const contents = await readFile8(absolute);
+    const contents = await readFile10(absolute);
     if (contents.byteLength !== file2.bytes || digest(contents) !== file2.digest) {
       changed(file2.path, `\u63D0\u4EA4\u524D\u6587\u4EF6\u5185\u5BB9\u53D1\u751F\u53D8\u5316\uFF1A${file2.path}`);
     }
@@ -5665,7 +5928,7 @@ async function createPushSourceBundle(plan) {
     schemaVersion: "1",
     files: files.map((file2) => ({ path: file2.path, bytes: file2.bytes, digest: file2.digest }))
   });
-  const calculatedBundleDigest = `sha256:${createHash6("sha256").update(`buddy-push-bundle-v1\0${descriptor}`).digest("hex")}`;
+  const calculatedBundleDigest = `sha256:${createHash7("sha256").update(`buddy-push-bundle-v1\0${descriptor}`).digest("hex")}`;
   if (calculatedBundleDigest !== plan.bundleDigest) {
     changed(plan.projectRoot, "\u63D0\u4EA4\u6E05\u5355\u8EAB\u4EFD\u5728\u6253\u5305\u524D\u53D1\u751F\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C push");
   }
@@ -5720,25 +5983,29 @@ var HELP2 = `\u642D\u642D Developer Platform CLI
 
 \u7528\u6CD5:
   buddy-cli
+  buddy-cli --version [--json]
+  buddy-cli update [--check] [--json]
   buddy-cli init
   buddy-cli init --mode create --directory <\u9879\u76EE\u76EE\u5F55> --name <\u540D\u79F0> --tagline <\u4E00\u53E5\u8BDD\u4ECB\u7ECD> --intro <\u5B8C\u6574\u4ECB\u7ECD> [--buddy-id <\u5DF2\u6709\u642D\u5B50 ID>]
   buddy-cli init --mode direct --directory <\u9879\u76EE\u76EE\u5F55> --name <\u540D\u79F0> --tagline <\u4E00\u53E5\u8BDD\u4ECB\u7ECD> --intro <\u5B8C\u6574\u4ECB\u7ECD> [--buddy-id <\u5DF2\u6709\u642D\u5B50 ID>]
   buddy-cli dev [--app-server <URL>] [--directory <\u9879\u76EE\u76EE\u5F55>]
   buddy-cli login | logout | push | status
-  buddy-cli avatar (--url <\u56FE\u7247\u5730\u5740> | --clear) [--directory <\u9879\u76EE\u76EE\u5F55> | --buddy-id <\u642D\u5B50 ID>]
-  buddy-cli models [--json]
+  buddy-cli avatar (--file <\u56FE\u7247\u6587\u4EF6> | --clear) [--directory <\u9879\u76EE\u76EE\u5F55> | --buddy-id <\u642D\u5B50 ID>]
+  buddy-cli models [--directory <\u9879\u76EE\u76EE\u5F55>] [--json]
   buddy-cli widgets sync | check | verify
   buddy-cli datasets [--directory <\u9879\u76EE\u76EE\u5F55>] [--json]
   buddy-cli preview [--app-server <URL>] [--directory <\u9879\u76EE\u76EE\u5F55>]
   buddy-cli help
 
 \u547D\u4EE4:
+  --version \u67E5\u770B\u5F53\u524D\u8FD0\u884C\u7684 CLI \u7248\u672C\uFF08\u65E0\u9700\u8054\u7F51\u6216\u767B\u5F55\uFF09
+  update \u68C0\u67E5 npm \u6700\u65B0\u7248\u672C\u6216\u66F4\u65B0\u5168\u5C40 CLI\uFF08\u65E0\u9700\u767B\u5F55\u6216 Agent \u5DE5\u7A0B\uFF09
   init   \u521B\u5EFA\u6216\u6062\u590D\u642D\u5B50\uFF0C\u51C6\u5907\u5B98\u65B9 Runtime \u5DE5\u7A0B\u6216 Creator \u624B\u518C
   dev    \u542F\u52A8\u5B98\u65B9 Runtime \u5E76\u8FDE\u63A5 DEV App Server
   login  \u901A\u8FC7\u6D4F\u89C8\u5668\u767B\u5F55\u642D\u642D\u8D26\u53F7
   logout \u9000\u51FA\u642D\u642D\u5F00\u53D1\u8005\u8D26\u53F7\u5E76\u6E05\u9664\u672C\u673A\u767B\u5F55\u72B6\u6001
-  models \u67E5\u770B CLI \u5185\u7F6E\u6A21\u578B ID\uFF08\u65E0\u9700\u767B\u5F55\u3001\u8054\u7F51\u6216 Agent \u5DE5\u7A0B\uFF09
-  datasets \u8BFB\u53D6\u5DE5\u7A0B Runtime \u63D0\u4F9B\u7684\u6570\u636E\u96C6\u76EE\u5F55\uFF08\u65E0\u9700\u767B\u5F55\uFF09
+  models \u67E5\u770B Runtime \u6A21\u578B ID\uFF08\u5DE5\u7A0B\u5916\u8054\u7F51\u8BFB\u53D6\u6700\u65B0\u7248\uFF0C\u65E0\u9700\u767B\u5F55\uFF09
+  datasets \u67E5\u770B Runtime \u6570\u636E\u96C6\u76EE\u5F55\uFF08\u5DE5\u7A0B\u5916\u8054\u7F51\u8BFB\u53D6\u6700\u65B0\u7248\uFF0C\u65E0\u9700\u767B\u5F55\uFF09
   push   \u4E0A\u4F20 Agent \u5DE5\u7A0B\u548C commit\uFF0C\u63D0\u4EA4\u5E73\u53F0\u5BA1\u6838
   status \u67E5\u8BE2\u642D\u5B50\u7684\u8D44\u6599\u3001\u4EE3\u7801\u3001\u8FD0\u884C\u4E0E\u53D1\u5E03\u72B6\u6001
   avatar \u8BBE\u7F6E\u6216\u6E05\u9664\u642D\u5B50\u5934\u50CF\uFF0C\u4FDD\u7559\u5176\u4ED6\u4E91\u7AEF\u8D44\u6599
@@ -5947,7 +6214,7 @@ function defaultProjectDirectory(name) {
   return `./${folder}`;
 }
 async function initializeProjectRoute(route, args, io, options, application) {
-  const cwd = resolve15(options.cwd ?? process.cwd());
+  const cwd = resolve16(options.cwd ?? process.cwd());
   const { name, tagline, intro } = application;
   const directoryInput = await textAnswer(
     io,
@@ -5956,7 +6223,7 @@ async function initializeProjectRoute(route, args, io, options, application) {
     "\u9879\u76EE\u76EE\u5F55\uFF08\u7A7A\u76EE\u5F55\u6216\u5DF2\u6709\u642D\u642D\u5DE5\u7A0B\uFF09",
     defaultProjectDirectory(name)
   );
-  const rootDirectory = resolve15(cwd, directoryInput);
+  const rootDirectory = resolve16(cwd, directoryInput);
   await assertInitializableBuddyTarget(rootDirectory);
   const initializationTarget = { directory: rootDirectory, kind: "new" };
   const initializationPlan = options.initializeProject ? void 0 : await planBuddyProjectInitialization(initializationTarget);
@@ -6000,7 +6267,7 @@ async function initializeProjectRoute(route, args, io, options, application) {
 }
 async function runRoute(route, args, io, options) {
   if (!io.canPrompt) assertNonInteractiveProjectArguments(route, args);
-  const cwd = resolve15(options.cwd ?? process.cwd());
+  const cwd = resolve16(options.cwd ?? process.cwd());
   const name = await textAnswer(io, args.name, "--name", "\u642D\u5B50\u540D\u79F0", void 0, BUDDY_PROFILE_TEXT_LIMITS.name);
   const tagline = await textAnswer(
     io,
@@ -6028,7 +6295,7 @@ async function runRoute(route, args, io, options) {
     "\u9879\u76EE\u76EE\u5F55",
     defaultProjectDirectory(name)
   );
-  const rootDirectory = resolve15(cwd, directoryInput);
+  const rootDirectory = resolve16(cwd, directoryInput);
   await assertInitializableBuddyTarget(rootDirectory);
   const plan = await planBuddyDraftInitialization(rootDirectory);
   const existingBuddyId = plan.existingManifest?.buddyId;
@@ -6062,11 +6329,11 @@ async function runRoute(route, args, io, options) {
   return { ...result, route: "create", draft, buddyId };
 }
 async function resumeProjectArguments(args, cwd, options) {
-  const root = resolve15(cwd, args.directory?.trim() || ".");
+  const root = resolve16(cwd, args.directory?.trim() || ".");
   await assertInitializableBuddyTarget(root);
   let entry;
   try {
-    entry = await lstat10(join11(root, "buddy.agent.json"));
+    entry = await lstat11(join13(root, "buddy.agent.json"));
   } catch (cause) {
     if (cause.code === "ENOENT") return;
     throw cause;
@@ -6095,7 +6362,7 @@ async function runBuddyCli(args, io, options = {}) {
   try {
     const [command, ...rest] = args;
     if (!command) {
-      const cwd = resolve15(options.cwd ?? process.cwd());
+      const cwd = resolve16(options.cwd ?? process.cwd());
       let projectRoot;
       try {
         projectRoot = await findBuddyProjectRoot(cwd);
@@ -6123,13 +6390,13 @@ async function runBuddyCli(args, io, options = {}) {
       io.write(HELP2);
       return { exitCode: 0 };
     }
-    if (command === "models") return runModelsCommand(rest, io);
+    if (command === "models") return await runModelsCommand(rest, io, options.cwd ?? process.cwd(), options.runtimeCatalog);
     if (command === "widgets") return await runWidgetsCommand(rest, io, options.cwd ?? process.cwd());
     if (command === "preview") {
       return options.preview?.(rest, io) ?? failure("preview \u5BBF\u4E3B\u672A\u914D\u7F6E", io, true);
     }
     if (command === "datasets") {
-      return await runDatasetsCommand(rest, io, options.cwd ?? process.cwd());
+      return await runDatasetsCommand(rest, io, options.cwd ?? process.cwd(), options.runtimeCatalog);
     }
     if (command === "dev") {
       return await runDevCommand(rest, io, {
@@ -6151,11 +6418,11 @@ async function runBuddyCli(args, io, options = {}) {
       }
       let route = routeFromMode(parsed.mode);
       if (route === void 0 && !io.canPrompt) requireModeForNonInteractive();
-      const cwd = resolve15(options.cwd ?? process.cwd());
+      const cwd = resolve16(options.cwd ?? process.cwd());
       await assertInitializableBuddyTarget(cwd);
       if (parsed.directory !== void 0) {
         if (!parsed.directory.trim()) throw new CliUsageError("--directory \u4E0D\u80FD\u4E3A\u7A7A");
-        await assertInitializableBuddyTarget(resolve15(cwd, parsed.directory));
+        await assertInitializableBuddyTarget(resolve16(cwd, parsed.directory));
       }
       await authenticate(options);
       await resumeProjectArguments(parsed, cwd, options);
@@ -6308,6 +6575,7 @@ export {
   isAbortLike,
   isSafeProjectRelativePath,
   isWindowsReservedPathSegment,
+  latestRuntimeTemplate,
   normalizePlatformUrl,
   openExternalUrl,
   parseBuddyAgentConfig,