@zltquant/zlt-mcp 0.7.0 → 0.7.1-beta.0

package/zlt-mcp-proxy.bundle.cjs

@@ -1147,8 +1147,8 @@ var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@13.1.0/node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path18 = require("node:path");
-    var fs18 = require("node:fs");
+    var path19 = require("node:path");
+    var fs20 = require("node:fs");
     var process4 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -2129,7 +2129,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs18.existsSync(executableFile)) return;
+        if (fs20.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -2147,11 +2147,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path18.resolve(baseDir, baseName);
-          if (fs18.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path18.extname(baseName))) return void 0;
+          const localBin = path19.resolve(baseDir, baseName);
+          if (fs20.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path19.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs18.existsSync(`${localBin}${ext}`)
+            (ext) => fs20.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -2163,21 +2163,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs18.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs20.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path18.resolve(
-            path18.dirname(resolvedScriptPath),
+          executableDir = path19.resolve(
+            path19.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path18.basename(
+            const legacyName = path19.basename(
               this._scriptPath,
-              path18.extname(this._scriptPath)
+              path19.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2188,7 +2188,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path18.extname(executableFile));
+        launchWithNode = sourceExt.includes(path19.extname(executableFile));
         let proc;
         if (process4.platform !== "win32") {
           if (launchWithNode) {
@@ -3035,7 +3035,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path18.basename(filename, path18.extname(filename));
+        this._name = path19.basename(filename, path19.extname(filename));
         return this;
       }
       /**
@@ -3049,9 +3049,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path19) {
-        if (path19 === void 0) return this._executableDir;
-        this._executableDir = path19;
+      executableDir(path20) {
+        if (path20 === void 0) return this._executableDir;
+        this._executableDir = path20;
         return this;
       }
       /**
@@ -3068,9 +3068,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
           helpWidth: context.helpWidth,
           outputHasColors: context.hasColors
         });
-        const text = helper.formatHelp(this, helper);
-        if (context.hasColors) return text;
-        return this._outputConfiguration.stripColor(text);
+        const text2 = helper.formatHelp(this, helper);
+        if (context.hasColors) return text2;
+        return this._outputConfiguration.stripColor(text2);
       }
       /**
        * @typedef HelpContext
@@ -3224,7 +3224,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {(string | Function)} text - string to add, or a function returning a string
        * @return {Command} `this` command for chaining
        */
-      addHelpText(position, text) {
+      addHelpText(position, text2) {
         const allowedValues = ["beforeAll", "before", "after", "afterAll"];
         if (!allowedValues.includes(position)) {
           throw new Error(`Unexpected value for position to addHelpText.
@@ -3233,10 +3233,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const helpEvent = `${position}Help`;
         this.on(helpEvent, (context) => {
           let helpStr;
-          if (typeof text === "function") {
-            helpStr = text({ error: context.error, command: context.command });
+          if (typeof text2 === "function") {
+            helpStr = text2({ error: context.error, command: context.command });
           } else {
-            helpStr = text;
+            helpStr = text2;
           }
           if (helpStr) {
             context.write(`${helpStr}
@@ -6268,22 +6268,22 @@ var require_compile = __commonJS({
       }
     }
     exports2.compileSchema = compileSchema;
-    function resolveRef(root, baseId, ref) {
+    function resolveRef(root2, baseId, ref) {
       var _a;
       ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
-      const schOrFunc = root.refs[ref];
+      const schOrFunc = root2.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve10.call(this, root, ref);
+      let _sch = resolve10.call(this, root2, ref);
       if (_sch === void 0) {
-        const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
+        const schema = (_a = root2.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
         if (schema)
-          _sch = new SchemaEnv({ schema, schemaId, root, baseId });
+          _sch = new SchemaEnv({ schema, schemaId, root: root2, baseId });
       }
       if (_sch === void 0)
         return;
-      return root.refs[ref] = inlineOrCompile.call(this, _sch);
+      return root2.refs[ref] = inlineOrCompile.call(this, _sch);
     }
     exports2.resolveRef = resolveRef;
     function inlineOrCompile(sch) {
@@ -6301,23 +6301,23 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve10(root, ref) {
+    function resolve10(root2, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
-      return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
+      return sch || this.schemas[ref] || resolveSchema.call(this, root2, ref);
     }
-    function resolveSchema(root, ref) {
+    function resolveSchema(root2, ref) {
       const p = this.opts.uriResolver.parse(ref);
       const refPath = (0, resolve_1._getFullPath)(this.opts.uriResolver, p);
-      let baseId = (0, resolve_1.getFullPath)(this.opts.uriResolver, root.baseId, void 0);
-      if (Object.keys(root.schema).length > 0 && refPath === baseId) {
-        return getJsonPointer.call(this, p, root);
+      let baseId = (0, resolve_1.getFullPath)(this.opts.uriResolver, root2.baseId, void 0);
+      if (Object.keys(root2.schema).length > 0 && refPath === baseId) {
+        return getJsonPointer.call(this, p, root2);
       }
       const id = (0, resolve_1.normalizeId)(refPath);
       const schOrRef = this.refs[id] || this.schemas[id];
       if (typeof schOrRef == "string") {
-        const sch = resolveSchema.call(this, root, schOrRef);
+        const sch = resolveSchema.call(this, root2, schOrRef);
         if (typeof (sch === null || sch === void 0 ? void 0 : sch.schema) !== "object")
           return;
         return getJsonPointer.call(this, p, sch);
@@ -6332,7 +6332,7 @@ var require_compile = __commonJS({
         const schId = schema[schemaId];
         if (schId)
           baseId = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schId);
-        return new SchemaEnv({ schema, schemaId, root, baseId });
+        return new SchemaEnv({ schema, schemaId, root: root2, baseId });
       }
       return getJsonPointer.call(this, p, schOrRef);
     }
@@ -6344,7 +6344,7 @@ var require_compile = __commonJS({
       "dependencies",
       "definitions"
     ]);
-    function getJsonPointer(parsedRef, { baseId, schema, root }) {
+    function getJsonPointer(parsedRef, { baseId, schema, root: root2 }) {
       var _a;
       if (((_a = parsedRef.fragment) === null || _a === void 0 ? void 0 : _a[0]) !== "/")
         return;
@@ -6363,10 +6363,10 @@ var require_compile = __commonJS({
       let env;
       if (typeof schema != "boolean" && schema.$ref && !(0, util_1.schemaHasRulesButRef)(schema, this.RULES)) {
         const $ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, schema.$ref);
-        env = resolveSchema.call(this, root, $ref);
+        env = resolveSchema.call(this, root2, $ref);
       }
       const { schemaId } = this.opts;
-      env = env || new SchemaEnv({ schema, schemaId, root, baseId });
+      env = env || new SchemaEnv({ schema, schemaId, root: root2, baseId });
       if (env.schema !== env.root.schema)
         return env;
       return void 0;
@@ -6516,8 +6516,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path18) {
-      let input = path18;
+    function removeDotSegments(path19) {
+      let input = path19;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -6716,8 +6716,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path18, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path18 && path18 !== "/" ? path18 : void 0;
+        const [path19, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path19 && path19 !== "/" ? path19 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -7408,8 +7408,8 @@ var require_core = __commonJS({
           keyRef = sch;
         if (sch === void 0) {
           const { schemaId } = this.opts;
-          const root = new compile_1.SchemaEnv({ schema: {}, schemaId });
-          sch = compile_1.resolveSchema.call(this, root, keyRef);
+          const root2 = new compile_1.SchemaEnv({ schema: {}, schemaId });
+          sch = compile_1.resolveSchema.call(this, root2, keyRef);
           if (!sch)
             return;
           this.refs[keyRef] = sch;
@@ -7518,7 +7518,7 @@ var require_core = __commonJS({
       errorsText(errors = this.errors, { separator = ", ", dataVar = "data" } = {}) {
         if (!errors || errors.length === 0)
           return "No errors";
-        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text, msg) => text + separator + msg);
+        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text2, msg) => text2 + separator + msg);
       }
       $dataMetaSchema(metaSchema, keywordsJsonPointers) {
         const rules = this.RULES.all;
@@ -7770,20 +7770,20 @@ var require_ref = __commonJS({
       code(cxt) {
         const { gen, schema: $ref, it } = cxt;
         const { baseId, schemaEnv: env, validateName, opts, self } = it;
-        const { root } = env;
-        if (($ref === "#" || $ref === "#/") && baseId === root.baseId)
+        const { root: root2 } = env;
+        if (($ref === "#" || $ref === "#/") && baseId === root2.baseId)
           return callRootRef();
-        const schOrEnv = compile_1.resolveRef.call(self, root, baseId, $ref);
+        const schOrEnv = compile_1.resolveRef.call(self, root2, baseId, $ref);
         if (schOrEnv === void 0)
           throw new ref_error_1.default(it.opts.uriResolver, baseId, $ref);
         if (schOrEnv instanceof compile_1.SchemaEnv)
           return callValidate(schOrEnv);
         return inlineRefSchema(schOrEnv);
         function callRootRef() {
-          if (env === root)
+          if (env === root2)
             return callRef(cxt, validateName, env, env.$async);
-          const rootName = gen.scopeValue("root", { ref: root });
-          return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root, root.$async);
+          const rootName = gen.scopeValue("root", { ref: root2 });
+          return callRef(cxt, (0, codegen_1._)`${rootName}.validate`, root2, root2.$async);
         }
         function callValidate(sch) {
           const v = getValidate(cxt, sch);
@@ -10079,12 +10079,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs18, exportName) {
+    function addFormats(ajv, list, fs20, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs18[f]);
+        ajv.addFormat(f, fs20[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -10097,8 +10097,8 @@ var require_windows = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports2, module2) {
     module2.exports = isexe;
     isexe.sync = sync;
-    var fs18 = require("fs");
-    function checkPathExt(path18, options) {
+    var fs20 = require("fs");
+    function checkPathExt(path19, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -10109,25 +10109,25 @@ var require_windows = __commonJS({
       }
       for (var i = 0; i < pathext.length; i++) {
         var p = pathext[i].toLowerCase();
-        if (p && path18.substr(-p.length).toLowerCase() === p) {
+        if (p && path19.substr(-p.length).toLowerCase() === p) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path18, options) {
+    function checkStat(stat, path19, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path18, options);
+      return checkPathExt(path19, options);
     }
-    function isexe(path18, options, cb) {
-      fs18.stat(path18, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path18, options));
+    function isexe(path19, options, cb) {
+      fs20.stat(path19, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path19, options));
       });
     }
-    function sync(path18, options) {
-      return checkStat(fs18.statSync(path18), path18, options);
+    function sync(path19, options) {
+      return checkStat(fs20.statSync(path19), path19, options);
     }
   }
 });
@@ -10137,14 +10137,14 @@ var require_mode = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports2, module2) {
     module2.exports = isexe;
     isexe.sync = sync;
-    var fs18 = require("fs");
-    function isexe(path18, options, cb) {
-      fs18.stat(path18, function(er, stat) {
+    var fs20 = require("fs");
+    function isexe(path19, options, cb) {
+      fs20.stat(path19, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
-    function sync(path18, options) {
-      return checkStat(fs18.statSync(path18), options);
+    function sync(path19, options) {
+      return checkStat(fs20.statSync(path19), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -10168,7 +10168,7 @@ var require_mode = __commonJS({
 // ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports2, module2) {
-    var fs18 = require("fs");
+    var fs20 = require("fs");
     var core;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core = require_windows();
@@ -10177,7 +10177,7 @@ var require_isexe = __commonJS({
     }
     module2.exports = isexe;
     isexe.sync = sync;
-    function isexe(path18, options, cb) {
+    function isexe(path19, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -10187,7 +10187,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve10, reject) {
-          isexe(path18, options || {}, function(er, is) {
+          isexe(path19, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
@@ -10196,7 +10196,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core(path18, options || {}, function(er, is) {
+      core(path19, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -10206,9 +10206,9 @@ var require_isexe = __commonJS({
         cb(er, is);
       });
     }
-    function sync(path18, options) {
+    function sync(path19, options) {
       try {
-        return core.sync(path18, options || {});
+        return core.sync(path19, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -10224,7 +10224,7 @@ var require_isexe = __commonJS({
 var require_which = __commonJS({
   "../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js"(exports2, module2) {
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path18 = require("path");
+    var path19 = require("path");
     var COLON = isWindows ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -10262,7 +10262,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve10(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path18.join(pathPart, cmd);
+        const pCmd = path19.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve10(subStep(p, i, 0));
       });
@@ -10289,7 +10289,7 @@ var require_which = __commonJS({
       for (let i = 0; i < pathEnv.length; i++) {
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path18.join(pathPart, cmd);
+        const pCmd = path19.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j = 0; j < pathExt.length; j++) {
           const cur = p + pathExt[j];
@@ -10337,7 +10337,7 @@ var require_path_key = __commonJS({
 var require_resolveCommand = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js"(exports2, module2) {
     "use strict";
-    var path18 = require("path");
+    var path19 = require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -10355,7 +10355,7 @@ var require_resolveCommand = __commonJS({
       try {
         resolved = which.sync(parsed.command, {
           path: env[getPathKey({ env })],
-          pathExt: withoutPathExt ? path18.delimiter : void 0
+          pathExt: withoutPathExt ? path19.delimiter : void 0
         });
       } catch (e) {
       } finally {
@@ -10364,7 +10364,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path18.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path19.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -10418,8 +10418,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path18, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary = path18.split("/").pop();
+      const [path19, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path19.split("/").pop();
       if (binary === "env") {
         return argument;
       }
@@ -10432,16 +10432,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports2, module2) {
     "use strict";
-    var fs18 = require("fs");
+    var fs20 = require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs18.openSync(command, "r");
-        fs18.readSync(fd, buffer, 0, size, 0);
-        fs18.closeSync(fd);
+        fd = fs20.openSync(command, "r");
+        fs20.readSync(fd, buffer, 0, size, 0);
+        fs20.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -10454,7 +10454,7 @@ var require_readShebang = __commonJS({
 var require_parse = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js"(exports2, module2) {
     "use strict";
-    var path18 = require("path");
+    var path19 = require("path");
     var resolveCommand = require_resolveCommand();
     var escape2 = require_escape();
     var readShebang = require_readShebang();
@@ -10479,7 +10479,7 @@ var require_parse = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path18.normalize(parsed.command);
+        parsed.command = path19.normalize(parsed.command);
         parsed.command = escape2.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape2.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -10575,7 +10575,7 @@ var require_cross_spawn = __commonJS({
       enoent.hookChildProcess(spawned, parsed);
       return spawned;
     }
-    function spawnSync3(command, args, options) {
+    function spawnSync4(command, args, options) {
       const parsed = parse3(command, args, options);
       const result = cp.spawnSync(parsed.command, parsed.args, parsed.options);
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
@@ -10583,7 +10583,7 @@ var require_cross_spawn = __commonJS({
     }
     module2.exports = spawn4;
     module2.exports.spawn = spawn4;
-    module2.exports.sync = spawnSync3;
+    module2.exports.sync = spawnSync4;
     module2.exports._parse = parse3;
     module2.exports._enoent = enoent;
   }
@@ -10637,11 +10637,11 @@ var CliEvidence = class {
   logFd;
   teeWrite;
   constructor(directory, provenance, command) {
-    const root = path.resolve(directory);
-    fs.mkdirSync(root);
-    this.resultFile = path.join(root, "result.json");
-    this.diagnosticsFile = path.join(root, "diagnostics.log");
-    this.executionFile = path.join(root, "execution.json");
+    const root2 = path.resolve(directory);
+    fs.mkdirSync(root2);
+    this.resultFile = path.join(root2, "result.json");
+    this.diagnosticsFile = path.join(root2, "diagnostics.log");
+    this.executionFile = path.join(root2, "execution.json");
     this.state = {
       schemaVersion: 1,
       command,
@@ -10799,28 +10799,28 @@ var UNSUPPORTED_SCHEMA_KEYWORDS = [
   "propertyNames",
   "unevaluatedProperties"
 ];
-function unsupportedSchemaConstraint(schemaValue, path18 = "inputSchema") {
+function unsupportedSchemaConstraint(schemaValue, path19 = "inputSchema") {
   const schema = record(schemaValue);
-  if (!schema) return path18;
+  if (!schema) return path19;
   for (const keyword of UNSUPPORTED_SCHEMA_KEYWORDS) {
-    if (Object.prototype.hasOwnProperty.call(schema, keyword)) return `${path18}.${keyword}`;
+    if (Object.prototype.hasOwnProperty.call(schema, keyword)) return `${path19}.${keyword}`;
   }
   const properties = record(schema.properties);
   if (properties) {
     for (const [name, property] of Object.entries(properties)) {
-      const unsupported = unsupportedSchemaConstraint(property, `${path18}.properties.${name}`);
+      const unsupported = unsupportedSchemaConstraint(property, `${path19}.properties.${name}`);
       if (unsupported) return unsupported;
     }
   }
   if (schema.items !== void 0) {
-    const unsupported = unsupportedSchemaConstraint(schema.items, `${path18}.items`);
+    const unsupported = unsupportedSchemaConstraint(schema.items, `${path19}.items`);
     if (unsupported) return unsupported;
   }
   return void 0;
 }
-function explicitValue(schemaValue, path18) {
+function explicitValue(schemaValue, path19) {
   const schema = record(schemaValue);
-  if (!schema) return { available: false, missing: [path18] };
+  if (!schema) return { available: false, missing: [path19] };
   if (Object.prototype.hasOwnProperty.call(schema, "example")) {
     return { available: true, value: cloneValue(schema.example), missing: [] };
   }
@@ -10842,13 +10842,13 @@ function explicitValue(schemaValue, path18) {
     const value = {};
     const missing = [];
     for (const name of required2) {
-      const child = explicitValue(properties[name], path18 ? `${path18}.${name}` : name);
+      const child = explicitValue(properties[name], path19 ? `${path19}.${name}` : name);
       if (child.available) value[name] = child.value;
       missing.push(...child.missing);
     }
     return { available: missing.length === 0, value, missing };
   }
-  return { available: false, missing: [path18] };
+  return { available: false, missing: [path19] };
 }
 function buildArgumentExample(tool) {
   const schema = record(tool.inputSchema);
@@ -10939,11 +10939,11 @@ function buildCliUsage(tool, tools) {
 }
 
 // src/index.ts
-var fs17 = __toESM(require("node:fs"), 1);
-var path17 = __toESM(require("node:path"), 1);
+var fs19 = __toESM(require("node:fs"), 1);
+var path18 = __toESM(require("node:path"), 1);
 
 // src/cli.ts
-var fs11 = __toESM(require("fs"), 1);
+var fs12 = __toESM(require("fs"), 1);
 var path11 = __toESM(require("path"), 1);
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/core.js
@@ -11141,10 +11141,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path18) {
-  if (!path18)
+function getElementAtPath(obj, path19) {
+  if (!path19)
     return obj;
-  return path18.reduce((acc, key) => acc?.[key], obj);
+  return path19.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11464,11 +11464,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path18, issues) {
+function prefixIssues(path19, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path18);
+    iss.path.unshift(path19);
     return iss;
   });
 }
@@ -18612,12 +18612,12 @@ function applyInstallerMirror(config2, mirror) {
   };
 }
 function parseInstallerOverride(raw) {
-  const text = raw?.trim();
-  if (!text)
+  const text2 = raw?.trim();
+  if (!text2)
     return {};
   let parsed;
   try {
-    parsed = JSON.parse(text);
+    parsed = JSON.parse(text2);
   } catch (error2) {
     throw new Error(`ZLT_ASSISTANT_INSTALLER_OVERRIDE \u4E0D\u662F\u5408\u6CD5 JSON: ${error2 instanceof Error ? error2.message : String(error2)}`);
   }
@@ -19493,23 +19493,23 @@ var AssistantMasterIpcClient = class {
   }
 };
 async function startManualServices(workRoot, zltContent, config2, onProgress, trace = silentRuntimeTrace, options = {}) {
-  const client = new AssistantMasterIpcClient();
+  const client2 = new AssistantMasterIpcClient();
   try {
-    await trace.run("\u8FDE\u63A5\u667A\u80FD\u7BA1\u5BB6\u4E3B\u7BA1\u9053", () => client.connect(zltContent, config2, trace), { timeoutMs: config2.ipcConnectTimeout });
-    await trace.run(options.registerConsumerPid === false ? "\u542F\u52A8\u9ED8\u8BA4\u540E\u53F0\u670D\u52A1\uFF08\u72EC\u7ACBCLI\u4E0D\u767B\u8BB0PID\uFF09" : "\u542F\u52A8\u9ED8\u8BA4\u540E\u53F0\u670D\u52A1\u5E76\u767B\u8BB0\u5BBF\u4E3B\u8FDB\u7A0B", () => client.startDefaultServices(config2, onProgress, trace, options));
-    await trace.run("\u8F6E\u8BE2\u540E\u53F0\u670D\u52A1\u542F\u52A8\u72B6\u6001", () => client.pollStartupServices(config2, trace), { serviceIndices: config2.startupCheckIndices });
+    await trace.run("\u8FDE\u63A5\u667A\u80FD\u7BA1\u5BB6\u4E3B\u7BA1\u9053", () => client2.connect(zltContent, config2, trace), { timeoutMs: config2.ipcConnectTimeout });
+    await trace.run(options.registerConsumerPid === false ? "\u542F\u52A8\u9ED8\u8BA4\u540E\u53F0\u670D\u52A1\uFF08\u72EC\u7ACBCLI\u4E0D\u767B\u8BB0PID\uFF09" : "\u542F\u52A8\u9ED8\u8BA4\u540E\u53F0\u670D\u52A1\u5E76\u767B\u8BB0\u5BBF\u4E3B\u8FDB\u7A0B", () => client2.startDefaultServices(config2, onProgress, trace, options));
+    await trace.run("\u8F6E\u8BE2\u540E\u53F0\u670D\u52A1\u542F\u52A8\u72B6\u6001", () => client2.pollStartupServices(config2, trace), { serviceIndices: config2.startupCheckIndices });
     await trace.run("\u7B49\u5F85\u540E\u53F0\u670D\u52A1\u521B\u5EFAZLTAF\u7BA1\u9053", () => waitForPipe(workRoot, "ZLTAF", config2.zltafPipeWait), { timeoutMs: config2.zltafPipeWait });
   } finally {
-    await trace.run("\u65AD\u5F00\u4E34\u65F6\u667A\u80FD\u7BA1\u5BB6\u4E3B\u7BA1\u9053\u8FDE\u63A5", () => client.disconnect());
+    await trace.run("\u65AD\u5F00\u4E34\u65F6\u667A\u80FD\u7BA1\u5BB6\u4E3B\u7BA1\u9053\u8FDE\u63A5", () => client2.disconnect());
   }
 }
 async function installBacktestModules(workRoot, zltContent, config2, onProgress, hooks = {}) {
-  const client = new AssistantMasterIpcClient();
+  const client2 = new AssistantMasterIpcClient();
   try {
-    await client.connect(zltContent, config2);
-    return await client.installBacktestModules(workRoot, config2, onProgress, hooks);
+    await client2.connect(zltContent, config2);
+    return await client2.installBacktestModules(workRoot, config2, onProgress, hooks);
   } finally {
-    await client.disconnect();
+    await client2.disconnect();
   }
 }
 async function waitForPipe(workRoot, pipePrefix, timeout) {
@@ -19526,18 +19526,18 @@ async function waitForPipe(workRoot, pipePrefix, timeout) {
   throw new Error(`\u7B49\u5F85 ${pipePrefix} \u7BA1\u9053\u8D85\u65F6`);
 }
 async function readZltContent(workRoot, temporaryZltFile) {
-  const fs18 = await import("fs");
-  const path18 = await import("path");
-  const zltFile = path18.join(workRoot, temporaryZltFile || "Temporary/zlt");
-  return fs18.existsSync(zltFile) ? fs18.readFileSync(zltFile, "utf-8").trim() : "";
+  const fs20 = await import("fs");
+  const path19 = await import("path");
+  const zltFile = path19.join(workRoot, temporaryZltFile || "Temporary/zlt");
+  return fs20.existsSync(zltFile) ? fs20.readFileSync(zltFile, "utf-8").trim() : "";
 }
 async function pipeExists2(pipeName) {
-  const fs18 = await import("fs");
+  const fs20 = await import("fs");
   try {
     if (process.platform === "win32") {
-      return fs18.readdirSync("\\\\.\\pipe\\").includes(pipeName);
+      return fs20.readdirSync("\\\\.\\pipe\\").includes(pipeName);
     }
-    return fs18.existsSync(`/tmp/${pipeName}`);
+    return fs20.existsSync(`/tmp/${pipeName}`);
   } catch {
     return false;
   }
@@ -19588,18 +19588,18 @@ function serviceName(index) {
   }
 }
 function describeServiceStatus(response) {
-  const record4 = isRecord(response) ? response : {};
-  const data = isRecord(record4.data) ? record4.data : isRecord(record4.Data) ? record4.Data : record4;
+  const record5 = isRecord(response) ? response : {};
+  const data = isRecord(record5.data) ? record5.data : isRecord(record5.Data) ? record5.Data : record5;
   const rawStatus = data.status ?? data.Status;
-  const retCode = record4.iRet ?? record4.IRet ?? record4.ErrNo;
+  const retCode = record5.iRet ?? record5.IRet ?? record5.ErrNo;
   const ready = isServiceReady(response);
   const reason = ready ? "\u670D\u52A1\u72B6\u6001\u4E3A2\u4E14\u5E94\u7B54\u901A\u8FC7\u6210\u529F\u5224\u5B9A" : rawStatus === void 0 ? "\u5E94\u7B54\u7F3A\u5C11\u670D\u52A1\u72B6\u6001\u5B57\u6BB5" : Number(rawStatus) !== 2 ? "\u670D\u52A1\u72B6\u6001\u5C1A\u672A\u8FBE\u5230\u5C31\u7EEA\u503C2" : "\u72B6\u6001\u4E3A2\u4F46\u5E94\u7B54\u9519\u8BEF\u7801\u672A\u901A\u8FC7\u6210\u529F\u5224\u5B9A";
-  const serviceMessage = data.msg ?? data.message ?? data.ErrMsg ?? record4.msg ?? record4.message ?? record4.ErrMsg;
+  const serviceMessage = data.msg ?? data.message ?? data.ErrMsg ?? record5.msg ?? record5.message ?? record5.ErrMsg;
   return {
     ready,
     rawStatus: rawStatus ?? null,
     retCode: retCode ?? null,
-    success: record4.success ?? null,
+    success: record5.success ?? null,
     serviceMessage,
     reason,
     result: `${ready ? "\u5DF2\u5C31\u7EEA" : "\u672A\u5C31\u7EEA"}\uFF1A${reason}${serviceMessage ? `\uFF1B\u670D\u52A1\u6D88\u606F\uFF1A${serviceMessage}` : ""}`
@@ -19783,8 +19783,8 @@ async function updateRuntimeLeaseActiveJob(handle, runId, active2, options = {})
 async function releaseRuntimeLease(handle, options = {}) {
   const deps = options.deps ?? defaultRuntimeLifecycleDeps;
   return withLifecycleLock(handle.workRoot, deps, async (stateDir) => {
-    const record4 = readJson(leasePath(stateDir, handle.token));
-    if (record4 && sameIdentity(record4.holder, handle.holder)) {
+    const record5 = readJson(leasePath(stateDir, handle.token));
+    if (record5 && sameIdentity(record5.holder, handle.holder)) {
       fs4.rmSync(leasePath(stateDir, handle.token), { force: true });
     }
     const recordedOwner = readJson(ownerPath(stateDir));
@@ -19987,13 +19987,13 @@ function readAndPruneStore(stateDir, deps) {
     if (!entry.isFile() || !entry.name.endsWith(".json"))
       continue;
     const filePath = path4.join(leasesDir, entry.name);
-    const record4 = readJson(filePath);
-    const current = record4 ? deps.inspectProcess(record4.holder.pid) : null;
-    if (!record4 || !current || !sameIdentity(current, record4.holder)) {
+    const record5 = readJson(filePath);
+    const current = record5 ? deps.inspectProcess(record5.holder.pid) : null;
+    if (!record5 || !current || !sameIdentity(current, record5.holder)) {
       fs4.rmSync(filePath, { force: true });
       continue;
     }
-    leases.push(record4);
+    leases.push(record5);
   }
   let owner = normalizeRuntimeOwnerRecord(readJson(ownerPath(stateDir)));
   if (owner) {
@@ -20005,21 +20005,21 @@ function readAndPruneStore(stateDir, deps) {
   }
   return { owner, leases };
 }
-function normalizeRuntimeOwnerRecord(record4) {
-  if (!record4)
+function normalizeRuntimeOwnerRecord(record5) {
+  if (!record5)
     return null;
-  const activeJobIds = new Set(normalizeRunIds(record4.activeJobIds));
-  const legacyBoundJobIds = normalizeRunIds(record4.legacyBoundJobIds);
-  const legacyResolvedJobIds = new Set(normalizeRunIds(record4.legacyResolvedJobIds));
+  const activeJobIds = new Set(normalizeRunIds(record5.activeJobIds));
+  const legacyBoundJobIds = normalizeRunIds(record5.legacyBoundJobIds);
+  const legacyResolvedJobIds = new Set(normalizeRunIds(record5.legacyResolvedJobIds));
   for (const runId of legacyBoundJobIds) {
     activeJobIds.add(runId);
     legacyResolvedJobIds.delete(runId);
   }
   return {
-    process: record4.process,
-    startedAt: record4.startedAt,
+    process: record5.process,
+    startedAt: record5.startedAt,
     activeJobIds: [...activeJobIds].sort(),
-    legacyActiveJobs: record4.legacyActiveJobs === void 0 ? normalizeLegacyActiveJobs(record4.activeJobs) : normalizeLegacyActiveJobs(record4.legacyActiveJobs),
+    legacyActiveJobs: record5.legacyActiveJobs === void 0 ? normalizeLegacyActiveJobs(record5.activeJobs) : normalizeLegacyActiveJobs(record5.legacyActiveJobs),
     legacyBoundJobIds,
     legacyResolvedJobIds: [...legacyResolvedJobIds].sort()
   };
@@ -21324,8 +21324,8 @@ function downloadFile(url, destination, redirectCount = 0, timeoutMs = 0, initia
         fail2(error2);
       }
     };
-    const client = url.startsWith("https:") ? https : http;
-    const request = client.get(url, {
+    const client2 = url.startsWith("https:") ? https : http;
+    const request = client2.get(url, {
       headers: {
         "User-Agent": "ZLT-Quant-Runtime/0.1",
         Accept: "application/octet-stream,*/*;q=0.8"
@@ -21409,8 +21409,8 @@ function getGitExePath(workRoot) {
 function areBacktestModuleRuntimeFilesPresent(workRoot) {
   return fs6.existsSync(getZltafExePath(workRoot)) && fs6.existsSync(getZltafConfigPath(workRoot));
 }
-function assertPathInside(root, targetPath) {
-  const resolvedRoot = path6.resolve(root);
+function assertPathInside(root2, targetPath) {
+  const resolvedRoot = path6.resolve(root2);
   const resolvedTarget = path6.resolve(targetPath);
   const relative2 = path6.relative(resolvedRoot, resolvedTarget);
   if (relative2.startsWith("..") || path6.isAbsolute(relative2)) {
@@ -21490,9 +21490,54 @@ async function waitForZltafPipe(workRoot, config2, options) {
 }
 
 // ../zlt-runtime-core/dist/auth.js
-var fs7 = __toESM(require("fs"), 1);
+var fs8 = __toESM(require("fs"), 1);
 var os2 = __toESM(require("os"), 1);
 var path7 = __toESM(require("path"), 1);
+
+// ../zlt-runtime-core/dist/private-path.js
+var fs7 = __toESM(require("node:fs"), 1);
+var import_node_child_process = require("node:child_process");
+function protectPrivatePath(target, directory = false) {
+  if (fs7.lstatSync(target).isSymbolicLink())
+    throw new Error("Private authentication path is invalid");
+  if (process.platform !== "win32") {
+    fs7.chmodSync(target, directory ? 448 : 384);
+    return;
+  }
+  const script = `
+$ErrorActionPreference = 'Stop'
+$targetPath = $env:ZLT_AUTH_PRIVATE_PATH
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$isDirectory = $env:ZLT_AUTH_PRIVATE_DIRECTORY -eq '1'
+if ($isDirectory) {
+  $acl = New-Object System.Security.AccessControl.DirectorySecurity
+  $inheritance = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+} else {
+  $acl = New-Object System.Security.AccessControl.FileSecurity
+  $inheritance = [System.Security.AccessControl.InheritanceFlags]::None
+}
+$acl.SetOwner($identity)
+$acl.SetAccessRuleProtection($true, $false)
+$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($identity, 'FullControl', $inheritance, 'None', 'Allow')
+$acl.AddAccessRule($rule)
+if ($isDirectory) {
+  [System.IO.Directory]::SetAccessControl($targetPath, $acl)
+} else {
+  [System.IO.File]::SetAccessControl($targetPath, $acl)
+}
+`;
+  const result = (0, import_node_child_process.spawnSync)("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    env: { ...process.env, ZLT_AUTH_PRIVATE_PATH: target, ZLT_AUTH_PRIVATE_DIRECTORY: directory ? "1" : "0" },
+    windowsHide: true,
+    timeout: 15e3,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error || result.status !== 0)
+    throw new Error("Could not protect private authentication storage");
+}
+
+// ../zlt-runtime-core/dist/auth.js
 var DEFAULT_ZLTQUANT_API_BASE = "https://api.zltquant.com";
 function resolveZltQuantHome(env = process.env) {
   const configuredHome = env.ZLTQUANT_HOME?.trim();
@@ -21508,9 +21553,9 @@ function resolveCredentialsPath(env = process.env) {
 }
 function readCredentials(env = process.env) {
   const credentialsPath = resolveCredentialsPath(env);
-  if (!fs7.existsSync(credentialsPath))
+  if (!fs8.existsSync(credentialsPath))
     return null;
-  const parsed = JSON.parse(fs7.readFileSync(credentialsPath, "utf-8"));
+  const parsed = JSON.parse(fs8.readFileSync(credentialsPath, "utf-8"));
   const apiKey = typeof parsed.apiKey === "string" ? parsed.apiKey.trim() : "";
   if (!apiKey)
     return null;
@@ -21540,6 +21585,9 @@ function writeCredentials(input, env = process.env) {
     throw new Error("ZLTQuant API key is required");
   if (!source)
     throw new Error("ZLTQuant credential source is required");
+  if (source === "zlt-mcp-device-login" && env.ZLTQUANT_CREDENTIALS?.trim()) {
+    throw new Error("Device login cannot write a custom credential path");
+  }
   if (env.ZLTQUANT_CREDENTIALS?.trim() && tryReadCredentials(env)) {
     return getAuthStatus(env);
   }
@@ -21550,19 +21598,53 @@ function writeCredentials(input, env = process.env) {
     source,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  fs7.mkdirSync(path7.dirname(credentialsPath), { recursive: true });
+  fs8.mkdirSync(path7.dirname(credentialsPath), { recursive: true });
   const tempPath = `${credentialsPath}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`;
   try {
-    fs7.writeFileSync(tempPath, `${JSON.stringify(credentials, null, 2)}
+    if (source === "zlt-mcp-device-login") {
+      fs8.closeSync(fs8.openSync(tempPath, "wx", 384));
+      protectPrivatePath(tempPath);
+    }
+    fs8.writeFileSync(tempPath, `${JSON.stringify(credentials, null, 2)}
 `, { encoding: "utf-8", mode: 384 });
     chmodOwnerOnly(tempPath);
-    fs7.renameSync(tempPath, credentialsPath);
+    if (source === "zlt-mcp-device-login") {
+      try {
+        fs8.linkSync(tempPath, credentialsPath);
+      } catch (error2) {
+        if (error2.code !== "EEXIST")
+          throw error2;
+        return getAuthStatus(env);
+      }
+      fs8.rmSync(tempPath, { force: true });
+    } else {
+      fs8.renameSync(tempPath, credentialsPath);
+    }
     chmodOwnerOnly(credentialsPath);
   } finally {
-    fs7.rmSync(tempPath, { force: true });
+    fs8.rmSync(tempPath, { force: true });
   }
   return fileAuthStatus(credentialsPath, resolveZltQuantHome(env), credentials);
 }
+function removeCredentials(input, env = process.env) {
+  if (env.ZLTQUANT_CREDENTIALS?.trim())
+    return false;
+  const apiKey = input.apiKey.trim();
+  const source = input.source.trim();
+  if (!apiKey || !source)
+    return false;
+  const credentials = tryReadCredentials(env);
+  if (!credentials || credentials.apiKey !== apiKey || credentials.source !== source)
+    return false;
+  try {
+    fs8.unlinkSync(resolveCredentialsPath(env));
+    return true;
+  } catch (error2) {
+    if (error2.code === "ENOENT")
+      return false;
+    throw error2;
+  }
+}
 function getAuthStatus(env = process.env) {
   const credentialsPath = resolveCredentialsPath(env);
   const zltquantHome = resolveZltQuantHome(env);
@@ -21636,7 +21718,7 @@ function tryReadCredentials(env) {
 }
 function chmodOwnerOnly(filePath) {
   try {
-    fs7.chmodSync(filePath, 384);
+    fs8.chmodSync(filePath, 384);
   } catch {
   }
 }
@@ -21652,9 +21734,230 @@ function fileAuthStatus(credentialsPath, zltquantHome, credentials) {
   };
 }
 
+// ../zlt-runtime-core/dist/device-auth.js
+var DeviceAuthorizationError = class extends Error {
+  code;
+  constructor(code, message = code) {
+    super(message);
+    this.name = "DeviceAuthorizationError";
+    this.code = code;
+  }
+};
+var DEFAULT_API_BASE = "https://api.zltquant.com";
+var MAX_RESPONSE_BYTES = 64 * 1024;
+async function startDeviceAuthorization(options = {}) {
+  const base = validatedBase(options.apiBase || DEFAULT_API_BASE);
+  const issuedAt = (options.now ?? Date.now)();
+  const value = await requestJson(options, base, "/api/v1/auth/device/start", {});
+  if (!record3(value) || !text(value.deviceId) || !text(value.userCode) || !text(value.verificationUri) || !text(value.verificationUriComplete) || !positive(value.expiresIn) || !positive(value.interval))
+    malformed("start");
+  validateVerificationUri(value.verificationUri, base, false);
+  validateVerificationUri(value.verificationUriComplete, base, true, value.userCode);
+  return {
+    deviceId: value.deviceId,
+    userCode: value.userCode,
+    verificationUri: value.verificationUri,
+    verificationUriComplete: value.verificationUriComplete,
+    expiresIn: value.expiresIn,
+    interval: value.interval,
+    issuedAt,
+    gatewayOrigin: base.origin
+  };
+}
+async function pollDeviceAuthorization(session, options = {}) {
+  if (!validSession(session))
+    throw new DeviceAuthorizationError("malformed_response", "Device authorization session is invalid");
+  const deviceId = session.deviceId;
+  const now = options.now ?? Date.now;
+  const duration3 = options.maxDurationMs ?? session.expiresIn * 1e3;
+  const deadline = Math.min(session.issuedAt + session.expiresIn * 1e3, session.issuedAt + duration3);
+  const base = validatedBase(options.apiBase || DEFAULT_API_BASE);
+  if (base.origin !== session.gatewayOrigin)
+    throw new DeviceAuthorizationError("invalid_endpoint", "Polling endpoint has an unexpected origin");
+  let interval = Math.max(session.interval, 1);
+  for (let attempt = 0; attempt < (options.maxAttempts ?? 120); attempt += 1) {
+    if (now() >= deadline)
+      throw new DeviceAuthorizationError("expired_token", "Device authorization expired");
+    await wait(options.sleep, Math.min(interval * 1e3, deadline - now()), options.signal);
+    if (now() >= deadline)
+      throw new DeviceAuthorizationError("expired_token", "Device authorization expired");
+    const remaining = deadline - now();
+    const value = await requestJson({ ...options, requestTimeoutMs: Math.min(options.requestTimeoutMs ?? 15e3, remaining) }, base, "/api/v1/auth/device/poll", { deviceId }, true);
+    if (now() >= deadline)
+      throw new DeviceAuthorizationError("expired_token", "Device authorization expired");
+    if (!record3(value))
+      malformed("poll");
+    if (value.error === "authorization_pending")
+      continue;
+    if (value.error === "slow_down") {
+      interval += 5;
+      continue;
+    }
+    if (value.error === "expired_token" || value.error === "access_denied")
+      throw new DeviceAuthorizationError(value.error);
+    if (!text(value.apiKey) || !text(value.apiBase))
+      malformed("poll");
+    const apiBase = validatedBase(value.apiBase);
+    if (apiBase.origin !== base.origin)
+      throw new DeviceAuthorizationError("invalid_endpoint", "Authorized API endpoint has an unexpected origin");
+    return { apiKey: value.apiKey.trim(), apiBase: apiBase.href.replace(/\/$/, "") };
+  }
+  throw new DeviceAuthorizationError("expired_token", "Device authorization polling limit reached");
+}
+function persistDeviceAuthorization(grant, env) {
+  const current = getAuthStatus(env);
+  if (current.configured)
+    return { status: "already_configured", authStatus: current };
+  if (env?.ZLTQUANT_CREDENTIALS?.trim())
+    throw new DeviceAuthorizationError("credentials_conflict", "A custom credential path is configured");
+  writeCredentials({ ...grant, source: "zlt-mcp-device-login" }, env);
+  const credentials = readCredentials(env);
+  const authStatus2 = getAuthStatus(env);
+  if (!credentials || credentials.apiKey !== grant.apiKey.trim() || credentials.apiBase !== grant.apiBase.trim().replace(/\/$/, "") || credentials.source !== "zlt-mcp-device-login" || !authStatus2.configured || authStatus2.source !== "file")
+    throw new DeviceAuthorizationError("credentials_conflict", "Persisted device credential is not effective");
+  return { status: "success", authStatus: authStatus2 };
+}
+async function requestJson(options, base, path19, payload, allowPoll400 = false) {
+  const controller = new AbortController();
+  const externalAbort = () => controller.abort();
+  if (options.signal?.aborted)
+    controller.abort();
+  else
+    options.signal?.addEventListener("abort", externalAbort, { once: true });
+  const timeout = setTimeout(() => controller.abort(), options.requestTimeoutMs ?? 15e3);
+  try {
+    const response = await (options.fetch ?? globalThis.fetch)(new URL(path19, base), {
+      method: "POST",
+      redirect: "error",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: controller.signal
+    });
+    const body = await readBoundedJson(response);
+    if (!response.ok && !(allowPoll400 && response.status === 400 && record3(body) && ["authorization_pending", "slow_down", "expired_token", "access_denied"].includes(String(body.error))))
+      throw new DeviceAuthorizationError("http_error", "Device authorization request failed");
+    return body;
+  } catch (error2) {
+    if (error2 instanceof DeviceAuthorizationError)
+      throw error2;
+    if (controller.signal.aborted && options.signal?.aborted)
+      throw new DeviceAuthorizationError("aborted", "Device authorization was cancelled");
+    throw new DeviceAuthorizationError("transport", "Device authorization request failed");
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", externalAbort);
+  }
+}
+async function readBoundedJson(response) {
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength !== null) {
+    const length = Number(declaredLength);
+    if (!Number.isFinite(length) || length < 0 || length > MAX_RESPONSE_BYTES)
+      malformed("response");
+  }
+  const reader = response.body?.getReader();
+  if (!reader)
+    malformed("response");
+  const decoder = new TextDecoder();
+  let size = 0;
+  let text2 = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > MAX_RESPONSE_BYTES) {
+        await reader.cancel();
+        malformed("response");
+      }
+      text2 += decoder.decode(value, { stream: true });
+    }
+    text2 += decoder.decode();
+    try {
+      return JSON.parse(text2);
+    } catch {
+      malformed("response");
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+function validatedBase(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/")
+      throw 0;
+    return url;
+  } catch {
+    throw new DeviceAuthorizationError("invalid_endpoint", "Device authorization endpoint is invalid");
+  }
+}
+function validateVerificationUri(value, base, complete, userCode) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new DeviceAuthorizationError("invalid_endpoint", "Verification URI is invalid");
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.hash || url.origin !== base.origin || url.searchParams.has("device_id"))
+    throw new DeviceAuthorizationError("invalid_endpoint", "Verification URI is invalid");
+  const keys = [...url.searchParams.keys()];
+  if (complete && url.searchParams.get("user_code") !== userCode)
+    throw new DeviceAuthorizationError("invalid_endpoint", "Verification URI query is invalid");
+  if (!complete && keys.length || complete && (keys.length !== 1 || keys[0] !== "user_code"))
+    throw new DeviceAuthorizationError("invalid_endpoint", "Verification URI query is invalid");
+}
+function record3(value) {
+  return typeof value === "object" && value !== null;
+}
+function validSession(value) {
+  if (!record3(value))
+    return false;
+  try {
+    const shape = text(value.deviceId) && text(value.userCode) && text(value.verificationUri) && text(value.verificationUriComplete) && positive(value.expiresIn) && positive(value.interval) && typeof value.issuedAt === "number" && Number.isFinite(value.issuedAt) && text(value.gatewayOrigin) && new URL(value.verificationUri).origin === value.gatewayOrigin && new URL(value.verificationUriComplete).origin === value.gatewayOrigin;
+    if (!shape)
+      return false;
+    const base = validatedBase(value.gatewayOrigin);
+    validateVerificationUri(value.verificationUri, base, false);
+    validateVerificationUri(value.verificationUriComplete, base, true, value.userCode);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function text(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function positive(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function malformed(part) {
+  throw new DeviceAuthorizationError("malformed_response", `Device authorization ${part} response is invalid`);
+}
+async function wait(custom2, ms, signal) {
+  if (signal?.aborted)
+    throw new DeviceAuthorizationError("aborted", "Device authorization was cancelled");
+  const sleeper = custom2 ? custom2(ms, signal) : new Promise((resolve10, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      reject(new DeviceAuthorizationError("aborted", "Device authorization was cancelled"));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve10();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+  await sleeper;
+  if (signal?.aborted)
+    throw new DeviceAuthorizationError("aborted", "Device authorization was cancelled");
+}
+
 // ../zlt-runtime-core/dist/zltaf-ipc.js
 var import_node_crypto = require("node:crypto");
-var fs8 = __toESM(require("node:fs"), 1);
+var fs9 = __toESM(require("node:fs"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var os3 = __toESM(require("node:os"), 1);
 var path8 = __toESM(require("node:path"), 1);
@@ -21827,7 +22130,7 @@ function flushLogQueue() {
   logWriteInFlight = true;
   const batch = pendingLogLines.splice(0).join("");
   try {
-    fs8.appendFile(LOG_FILE, batch, "utf8", () => {
+    fs9.appendFile(LOG_FILE, batch, "utf8", () => {
       logWriteInFlight = false;
       flushLogQueue();
     });
@@ -22008,10 +22311,10 @@ __export(config_exports, {
   resolveDefaultConfigPath: () => resolveDefaultConfigPath,
   resolveDefaultRuntimeConfigPath: () => resolveDefaultRuntimeConfigPath
 });
-var fs9 = __toESM(require("fs"), 1);
+var fs10 = __toESM(require("fs"), 1);
 var path9 = __toESM(require("path"), 1);
 function loadConfig(configPath) {
-  const raw = fs9.readFileSync(configPath, "utf-8");
+  const raw = fs10.readFileSync(configPath, "utf-8");
   return JSON.parse(raw);
 }
 function resolveDefaultConfigPath() {
@@ -22023,7 +22326,7 @@ function resolveDefaultConfigPath() {
     cwdCandidate
   ];
   for (const candidate of candidates) {
-    if (fs9.existsSync(candidate)) return candidate;
+    if (fs10.existsSync(candidate)) return candidate;
   }
   return cwdCandidate;
 }
@@ -22034,7 +22337,7 @@ function resolveDefaultRuntimeConfigPath() {
     path9.resolve(path9.dirname(process.argv[1] || ""), "runtime.cfg.json"),
     path9.resolve(process.cwd(), "runtime.cfg.json")
   ];
-  return candidates.find((candidate) => fs9.existsSync(candidate));
+  return candidates.find((candidate) => fs10.existsSync(candidate));
 }
 var matchingPipeNames2 = matchingPipeNames;
 
@@ -22068,7 +22371,7 @@ function hasHighBytes(str) {
 }
 
 // src/download-verification.ts
-var fs10 = __toESM(require("node:fs"), 1);
+var fs11 = __toESM(require("node:fs"), 1);
 var path10 = __toESM(require("node:path"), 1);
 var MAX_INVENTORY_ENTRIES = 25e3;
 var MAX_INVENTORY_DEPTH = 8;
@@ -22079,10 +22382,10 @@ function isRecord2(value) {
 function payloadOf(result) {
   if (isRecord2(result.structuredContent)) return result.structuredContent;
   const content = Array.isArray(result.content) ? result.content : [];
-  const text = content.find((item) => isRecord2(item) && item.type === "text" && typeof item.text === "string");
-  if (!isRecord2(text)) return null;
+  const text2 = content.find((item) => isRecord2(item) && item.type === "text" && typeof item.text === "string");
+  if (!isRecord2(text2)) return null;
   try {
-    const parsed = JSON.parse(text.text);
+    const parsed = JSON.parse(text2.text);
     return isRecord2(parsed) ? parsed : null;
   } catch {
     return null;
@@ -22142,9 +22445,9 @@ async function downloadAndVerify(args, invoke, inventory, onUuid) {
   evidence.uuid = uuid2;
   onUuid?.(uuid2);
   try {
-    const wait = await invoke("mcp-wait", { kind: "download", id: uuid2 });
-    evidence.stages.wait = wait;
-    if (!doneAndVerifiable(wait, uuid2)) {
+    const wait2 = await invoke("mcp-wait", { kind: "download", id: uuid2 });
+    evidence.stages.wait = wait2;
+    if (!doneAndVerifiable(wait2, uuid2)) {
       evidence.nextAction = "inspect-wait-before-retry";
       return workflowResult(evidence);
     }
@@ -22167,7 +22470,7 @@ async function downloadAndVerify(args, invoke, inventory, onUuid) {
 function configuredDownloadHome(clientRootDir) {
   try {
     const configPath = path10.join(clientRootDir, "zltHost", "moudles", "dcm.json");
-    const config2 = JSON.parse(fs10.readFileSync(configPath, "utf8"));
+    const config2 = JSON.parse(fs11.readFileSync(configPath, "utf8"));
     if (!isRecord2(config2) || typeof config2.download_home !== "string" || !config2.download_home.trim()) return null;
     const expanded = config2.download_home.trim().replace(/%HomePath%/gi, clientRootDir);
     return path10.isAbsolute(expanded) ? path10.resolve(expanded) : path10.resolve(clientRootDir, expanded);
@@ -22212,14 +22515,14 @@ function inventoryDownloadedFiles(clientRootDir, params, diskSpace, limits = {})
   if (scopes.some((scope) => !scope.exchangeId || !/^(dk|mk|tk)[a-z0-9_-]*$/.test(scope.dataType))) {
     return unknown2("unsupported-physical-layout", configured);
   }
-  let root;
+  let root2;
   try {
-    const configuredStat = fs10.lstatSync(configured);
+    const configuredStat = fs11.lstatSync(configured);
     if (configuredStat.isSymbolicLink() || typeof configuredStat.attributes === "number" && (configuredStat.attributes & 1024) !== 0) {
       return unknown2("symlink-or-reparse-point", configured);
     }
-    root = fs10.realpathSync(configured);
-    if (!fs10.statSync(root).isDirectory()) return unknown2("download-home-not-directory", configured);
+    root2 = fs11.realpathSync(configured);
+    if (!fs11.statSync(root2).isDirectory()) return unknown2("download-home-not-directory", configured);
   } catch {
     return unknown2("download-home-unavailable", configured);
   }
@@ -22230,13 +22533,13 @@ function inventoryDownloadedFiles(clientRootDir, params, diskSpace, limits = {})
   try {
     for (const scope of scopes) {
       for (const lane of ["his", "rel"]) {
-        let candidate = root;
+        let candidate = root2;
         let present = true;
         for (const segment of ["hqdata", lane, scope.exchangeId, scope.dataType]) {
           candidate = path10.join(candidate, segment);
           let component;
           try {
-            component = fs10.lstatSync(candidate);
+            component = fs11.lstatSync(candidate);
           } catch (error2) {
             if (error2.code === "ENOENT") {
               present = false;
@@ -22257,12 +22560,12 @@ function inventoryDownloadedFiles(clientRootDir, params, diskSpace, limits = {})
     }
     while (queue.length > 0) {
       const current = queue.shift();
-      for (const entry of fs10.readdirSync(current.dir, { withFileTypes: true })) {
+      for (const entry of fs11.readdirSync(current.dir, { withFileTypes: true })) {
         entries += 1;
         if (entries > (limits.maxEntries ?? MAX_INVENTORY_ENTRIES)) return unknown2("inventory-entry-limit", configured);
         const full = path10.join(current.dir, entry.name);
         if (entry.isSymbolicLink()) return unknown2("symlink-or-reparse-point", configured);
-        const stat = fs10.lstatSync(full);
+        const stat = fs11.lstatSync(full);
         const attrs = stat.attributes;
         if (stat.isSymbolicLink() || typeof attrs === "number" && (attrs & 1024) !== 0) return unknown2("symlink-or-reparse-point", configured);
         if (entry.isDirectory()) {
@@ -22286,8 +22589,8 @@ var RESPONSE_FILE_THRESHOLD = 1024;
 var HISTORY_MAX_LINES = 1e3;
 var ASYNC_BACKTEST_TOOLS = /* @__PURE__ */ new Set(["mcp-create-and-run-backtest", "mcp-re-backtest"]);
 function getOutputDir(clientRootDir) {
-  const root = clientRootDir.replace(/\/+$/, "");
-  return root + "/Temporary/zlt-cli";
+  const root2 = clientRootDir.replace(/\/+$/, "");
+  return root2 + "/Temporary/zlt-cli";
 }
 function getTimestamp() {
   const d = /* @__PURE__ */ new Date();
@@ -22297,46 +22600,46 @@ function getTimestampISO() {
   return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").substring(0, 19);
 }
 function ensureDir(dir) {
-  fs11.mkdirSync(dir, { recursive: true });
+  fs12.mkdirSync(dir, { recursive: true });
 }
 function writeResponseFile(outputDir, content) {
   ensureDir(outputDir);
   const filename = `resp_${getTimestamp()}.json`;
   const filePath = path11.join(outputDir, filename);
-  fs11.writeFileSync(filePath, content, "utf-8");
+  fs12.writeFileSync(filePath, content, "utf-8");
   return filePath;
 }
 function appendHistory(outputDir, uri, statusCode, contentSize, respFile) {
   ensureDir(outputDir);
   const historyPath = path11.join(outputDir, "history.jsonl");
-  if (fs11.existsSync(historyPath)) {
-    const lines = fs11.readFileSync(historyPath, "utf-8").split("\n").filter((l) => l.trim());
+  if (fs12.existsSync(historyPath)) {
+    const lines = fs12.readFileSync(historyPath, "utf-8").split("\n").filter((l) => l.trim());
     if (lines.length > HISTORY_MAX_LINES) {
       const kept = lines.slice(lines.length - HISTORY_MAX_LINES);
-      fs11.writeFileSync(historyPath, kept.join("\n") + "\n", "utf-8");
+      fs12.writeFileSync(historyPath, kept.join("\n") + "\n", "utf-8");
     }
   }
-  const record4 = {
+  const record5 = {
     time: getTimestampISO(),
     uri,
     status: statusCode,
     size: contentSize
   };
-  if (respFile) record4.file = respFile;
-  fs11.appendFileSync(historyPath, JSON.stringify(record4) + "\n", "utf-8");
+  if (respFile) record5.file = respFile;
+  fs12.appendFileSync(historyPath, JSON.stringify(record5) + "\n", "utf-8");
 }
 function cleanOutput(clientRootDir, maxDays = 1) {
   const outputDir = getOutputDir(clientRootDir);
-  if (!fs11.existsSync(outputDir)) return 0;
+  if (!fs12.existsSync(outputDir)) return 0;
   const now = Date.now();
   const cutoff = now - maxDays * 864e5;
   let removed = 0;
-  for (const entry of fs11.readdirSync(outputDir)) {
+  for (const entry of fs12.readdirSync(outputDir)) {
     if (!entry.startsWith("resp_") || !entry.endsWith(".json")) continue;
     const filePath = path11.join(outputDir, entry);
-    const stat = fs11.statSync(filePath);
+    const stat = fs12.statSync(filePath);
     if (stat.mtimeMs < cutoff) {
-      fs11.unlinkSync(filePath);
+      fs12.unlinkSync(filePath);
       removed++;
     }
   }
@@ -22361,7 +22664,7 @@ async function execCommand(funcName, options) {
   }
   let bodyFromFile = bodyOverride || "";
   if (!bodyFromFile && bodyFile) {
-    bodyFromFile = fs11.readFileSync(bodyFile, "utf-8");
+    bodyFromFile = fs12.readFileSync(bodyFile, "utf-8");
   }
   const tool = config2.tools.find((t) => t.name === funcName);
   if (tool?.localHandler === "currentUser") {
@@ -22369,10 +22672,10 @@ async function execCommand(funcName, options) {
     return;
   }
   const pipePath = discoverPipePath2(clientRootDir, tool?.pipName || config2.zltconfig.pipName);
-  const client = new ZltafIpcClient();
+  const client2 = new ZltafIpcClient();
   const outputDir = getOutputDir(clientRootDir);
   try {
-    await client.connect(pipePath, config2.connection.timeout);
+    await client2.connect(pipePath, config2.connection.timeout);
     let ipcUri;
     let params = {};
     let body;
@@ -22392,7 +22695,7 @@ async function execCommand(funcName, options) {
       body = bodyFromFile || (Object.keys(bizOptions).length > 0 ? JSON.stringify(bizOptions) : "{}");
     }
     const timeout = tool ? buildIpcTimeout(tool, bizOptions, config2.connection.timeout) : config2.connection.timeout;
-    const response = await client.invoke(ipcUri, params, body, timeout, customHeaders);
+    const response = await client2.invoke(ipcUri, params, body, timeout, customHeaders);
     const output = response.content ? decodePipeText(response.content) : "";
     const contentSize = Buffer.byteLength(output, "utf-8");
     ensureDir(outputDir);
@@ -22420,14 +22723,14 @@ async function execCommand(funcName, options) {
 `);
     process.exitCode = 1;
   } finally {
-    await client.disconnect();
+    await client2.disconnect();
   }
 }
 function parseMcpArgs(argsJson, argsFile) {
   if (argsJson !== void 0 && argsFile !== void 0) {
     throw new Error("Use only one of --args-json and --args-file");
   }
-  const raw = argsFile !== void 0 ? fs11.readFileSync(argsFile, "utf-8") : argsJson !== void 0 ? argsJson : "{}";
+  const raw = argsFile !== void 0 ? fs12.readFileSync(argsFile, "utf-8") : argsJson !== void 0 ? argsJson : "{}";
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -22482,10 +22785,10 @@ function parseMcpResult(result) {
     return result.structuredContent;
   }
   const content = Array.isArray(result.content) ? result.content : [];
-  const text = content.find((item) => item && typeof item === "object" && item.type === "text" && typeof item.text === "string");
-  if (!text) return null;
+  const text2 = content.find((item) => item && typeof item === "object" && item.type === "text" && typeof item.text === "string");
+  if (!text2) return null;
   try {
-    const parsed = JSON.parse(text.text);
+    const parsed = JSON.parse(text2.text);
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -22496,17 +22799,17 @@ function backtestHandoff(result) {
   const payload = parseMcpResult(result);
   const data = payload?.Data;
   if (!data || typeof data !== "object" || Array.isArray(data)) return null;
-  const record4 = data;
-  const status = Number(record4.status);
+  const record5 = data;
+  const status = Number(record5.status);
   if (Number.isFinite(status) && status !== 0 && status !== 1) return null;
-  const runId = typeof record4.runId === "string" ? record4.runId.trim() : "";
+  const runId = typeof record5.runId === "string" ? record5.runId.trim() : "";
   if (!runId) return null;
-  const evidence = record4.evidence && typeof record4.evidence === "object" && !Array.isArray(record4.evidence) ? record4.evidence : void 0;
-  const rawCodePath = typeof record4.codePath === "string" ? record4.codePath.trim() : typeof evidence?.runDir === "string" ? evidence.runDir.trim() : "";
+  const evidence = record5.evidence && typeof record5.evidence === "object" && !Array.isArray(record5.evidence) ? record5.evidence : void 0;
+  const rawCodePath = typeof record5.codePath === "string" ? record5.codePath.trim() : typeof evidence?.runDir === "string" ? evidence.runDir.trim() : "";
   return {
     runId,
     ...rawCodePath && path11.isAbsolute(rawCodePath) ? { codePath: rawCodePath } : {},
-    ...record4.attemptFence !== void 0 ? { attemptFence: record4.attemptFence } : {}
+    ...record5.attemptFence !== void 0 ? { attemptFence: record5.attemptFence } : {}
   };
 }
 function mcpErrorCode(result) {
@@ -22554,18 +22857,18 @@ function mergeBacktestWait(launched, waited, handoff) {
   const payload = { ...waitPayload, Data: mergedData };
   const content = Array.isArray(waited.content) ? [...waited.content] : [];
   const textIndex = content.findIndex((item) => item && typeof item === "object" && item.type === "text");
-  const text = { type: "text", text: JSON.stringify(payload) };
-  if (textIndex < 0) content.push(text);
-  else content[textIndex] = text;
+  const text2 = { type: "text", text: JSON.stringify(payload) };
+  if (textIndex < 0) content.push(text2);
+  else content[textIndex] = text2;
   return { ...waited, content, ...waited.structuredContent ? { structuredContent: payload } : {} };
 }
 async function callMcpTool(name, args = {}, options = {}) {
   if (options.verifyDownload && name !== "mcp-download-data") {
     throw new Error("verifyDownload is supported only for mcp-download-data");
   }
-  const { client, transport } = createMcpClient(options);
+  const { client: client2, transport } = createMcpClient(options);
   try {
-    await client.connect(transport);
+    await client2.connect(transport);
     const timeout = options.timeoutMs ?? 6e4;
     const showProgress = options.showProgress !== false;
     const startedAt = Date.now();
@@ -22596,7 +22899,7 @@ async function callMcpTool(name, args = {}, options = {}) {
         cancellation.abort(new Error("MCP call exceeded --max-total-timeout-ms"));
       }, totalTimeoutMs) : void 0;
       try {
-        return await client.callTool({ name: tool, arguments: toolArgs }, void 0, {
+        return await client2.callTool({ name: tool, arguments: toolArgs }, void 0, {
           ...requestOptions,
           ...cancellation ? { signal: cancellation.signal } : {}
         });
@@ -22678,7 +22981,7 @@ async function callMcpTool(name, args = {}, options = {}) {
     }
     return result;
   } finally {
-    await client.close().catch((error2) => {
+    await client2.close().catch((error2) => {
       const message = error2 instanceof Error ? error2.message : String(error2);
       process.stderr.write(`[zlt-mcp-cli] close failed: ${message}
 `);
@@ -22686,19 +22989,19 @@ async function callMcpTool(name, args = {}, options = {}) {
   }
 }
 async function listMcpTools(options = {}) {
-  const { client, transport } = createMcpClient(options);
+  const { client: client2, transport } = createMcpClient(options);
   try {
-    await client.connect(transport);
+    await client2.connect(transport);
     const tools = [];
     let cursor;
     do {
-      const page = await client.listTools(cursor ? { cursor } : void 0);
+      const page = await client2.listTools(cursor ? { cursor } : void 0);
       tools.push(...page.tools);
       cursor = page.nextCursor;
     } while (cursor);
     return { tools };
   } finally {
-    await client.close().catch((error2) => {
+    await client2.close().catch((error2) => {
       const message = error2 instanceof Error ? error2.message : String(error2);
       process.stderr.write(`[zlt-mcp-cli] close failed: ${message}
 `);
@@ -22759,7 +23062,7 @@ function buildIpcTimeout(tool, options, defaultTimeout) {
 }
 
 // src/skill-generator.ts
-var fs12 = __toESM(require("fs"), 1);
+var fs13 = __toESM(require("fs"), 1);
 var path12 = __toESM(require("path"), 1);
 function generateSkills(configPath, opts) {
   const config2 = loadConfig(configPath);
@@ -22777,11 +23080,11 @@ ${content}
 `);
     } else {
       const outDir = opts.output || ".claude/skills/zlt";
-      if (!fs12.existsSync(outDir)) {
-        fs12.mkdirSync(outDir, { recursive: true });
+      if (!fs13.existsSync(outDir)) {
+        fs13.mkdirSync(outDir, { recursive: true });
       }
       const filePath = path12.join(outDir, `zlt-${tool.name.replace(/_/g, "-")}.md`);
-      fs12.writeFileSync(filePath, content);
+      fs13.writeFileSync(filePath, content);
       process.stderr.write(`Generated: ${filePath}
 `);
     }
@@ -23473,13 +23776,13 @@ var StdioServerTransport = class {
 };
 
 // src/mcp-server.ts
-var fs16 = __toESM(require("node:fs"), 1);
+var fs17 = __toESM(require("node:fs"), 1);
 
 // src/install-task.ts
-var fs13 = __toESM(require("node:fs"), 1);
+var fs14 = __toESM(require("node:fs"), 1);
 var os4 = __toESM(require("node:os"), 1);
 var path13 = __toESM(require("node:path"), 1);
-var import_node_child_process = require("node:child_process");
+var import_node_child_process2 = require("node:child_process");
 var DEFAULT_TASK_ROOT = path13.join(os4.tmpdir(), "zlt-mcp-install-tasks");
 var STARTUP_GRACE_MS = 3e4;
 function taskRoot() {
@@ -23488,25 +23791,25 @@ function taskRoot() {
 function taskPath(taskId) {
   return path13.join(taskRoot(), `${taskId}.json`);
 }
-function write(record4) {
-  fs13.mkdirSync(taskRoot(), { recursive: true });
-  const target = taskPath(record4.taskId);
+function write(record5) {
+  fs14.mkdirSync(taskRoot(), { recursive: true });
+  const target = taskPath(record5.taskId);
   const temporary = `${target}.${process.pid}.tmp`;
-  fs13.writeFileSync(temporary, `${JSON.stringify(record4)}
+  fs14.writeFileSync(temporary, `${JSON.stringify(record5)}
 `, "utf8");
-  fs13.renameSync(temporary, target);
+  fs14.renameSync(temporary, target);
 }
 function readRaw(taskId) {
   if (!/^[A-Za-z0-9_-]+$/.test(taskId)) return void 0;
   try {
-    const record4 = JSON.parse(fs13.readFileSync(taskPath(taskId), "utf8"));
-    return record4.taskId === taskId ? record4 : void 0;
+    const record5 = JSON.parse(fs14.readFileSync(taskPath(taskId), "utf8"));
+    return record5.taskId === taskId ? record5 : void 0;
   } catch {
     return void 0;
   }
 }
-function active(record4) {
-  return record4.status === "queued" || record4.status === "running";
+function active(record5) {
+  return record5.status === "queued" || record5.status === "running";
 }
 function alive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -23531,7 +23834,7 @@ function readInstallTask(taskId) {
   let pid = current.workerPid;
   if (!pid) {
     try {
-      pid = Number(fs13.readFileSync(`${taskPath(taskId)}.pid`, "utf8"));
+      pid = Number(fs14.readFileSync(`${taskPath(taskId)}.pid`, "utf8"));
     } catch {
     }
   }
@@ -23540,10 +23843,10 @@ function readInstallTask(taskId) {
   if (!pid && current.status === "queued" && age >= 0 && age < STARTUP_GRACE_MS && (!current.launcherPid || alive(current.launcherPid))) return current;
   return fail(taskId, INTERRUPTED);
 }
-function startInstallTask(entrypoint, argsJson, spawnProcess = import_node_child_process.spawn) {
+function startInstallTask(entrypoint, argsJson, spawnProcess = import_node_child_process2.spawn) {
   let files = [];
   try {
-    files = fs13.readdirSync(taskRoot());
+    files = fs14.readdirSync(taskRoot());
   } catch (error2) {
     if (error2.code !== "ENOENT") throw error2;
   }
@@ -23554,17 +23857,17 @@ function startInstallTask(entrypoint, argsJson, spawnProcess = import_node_child
     if (existing && active(existing)) return readInstallTask(taskId2);
   }
   const taskId = `install-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
-  const record4 = {
+  const record5 = {
     taskId,
     status: "queued",
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     launcherPid: process.pid,
     logPath: path13.join(taskRoot(), `${taskId}.log`)
   };
-  write(record4);
+  write(record5);
   let logFd;
   try {
-    logFd = fs13.openSync(record4.logPath, "a");
+    logFd = fs14.openSync(record5.logPath, "a");
     const child = spawnProcess(process.execPath, [entrypoint, "__install-worker", taskId, argsJson], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
@@ -23577,12 +23880,12 @@ function startInstallTask(entrypoint, argsJson, spawnProcess = import_node_child
     child.once("exit", (code, signal) => {
       fail(taskId, `${INTERRUPTED} (exit=${code}, signal=${signal})`);
     });
-    if (child.pid) fs13.writeFileSync(`${taskPath(taskId)}.pid`, String(child.pid), "utf8");
+    if (child.pid) fs14.writeFileSync(`${taskPath(taskId)}.pid`, String(child.pid), "utf8");
     child.unref();
   } catch (error2) {
     fail(taskId, `\u5B89\u88C5\u5DE5\u4F5C\u8FDB\u7A0B\u542F\u52A8\u5931\u8D25: ${error2 instanceof Error ? error2.message : String(error2)}`);
   } finally {
-    if (logFd !== void 0) fs13.closeSync(logFd);
+    if (logFd !== void 0) fs14.closeSync(logFd);
   }
   return readRaw(taskId);
 }
@@ -23610,7 +23913,7 @@ function updateInstallTask(taskId, update) {
 var import_promises = require("node:timers/promises");
 
 // src/tool-pipeline.ts
-var fs15 = __toESM(require("node:fs"), 1);
+var fs16 = __toESM(require("node:fs"), 1);
 var path15 = __toESM(require("node:path"), 1);
 var import_node_crypto3 = require("node:crypto");
 
@@ -23622,7 +23925,7 @@ var MASKED_FACTOR_MESSAGE = "\u56E0\u5B50\u7814\u7A76\u529F\u80FD\u5728\u5F53\u5
 var MASKED_FUTURES_MESSAGE = "\u671F\u8D27\u56DE\u6D4B\u5728\u5F53\u524D\u7248\u672C\u672A\u5F00\u653E\uFF1ArunParams.marketIds \u542B\u671F\u8D27\u4EA4\u6613\u6240\uFF08zj/zs/ds/sq/gq\uFF09\u6216 account_list \u7684 account_type \u4E3A\u671F\u8D27\u3002\u8BF7\u4F7F\u7528\u80A1\u7968\u5E02\u573A\uFF08sh/sz\uFF09\u4E0E account_type=1\u3002";
 
 // src/backtest-config.ts
-var fs14 = __toESM(require("node:fs"), 1);
+var fs15 = __toESM(require("node:fs"), 1);
 var path14 = __toESM(require("node:path"), 1);
 var import_node_crypto2 = require("node:crypto");
 var BACKTEST_CONFIG_KEYS = [
@@ -23662,7 +23965,7 @@ var FEE_KEYS = [
   "close_tax",
   "margin_ratio"
 ];
-var record3 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var record4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 var pick2 = (v, keys) => Object.fromEntries(keys.filter((k) => Object.prototype.hasOwnProperty.call(v, k)).map((k) => [k, v[k]]));
 function readBacktestBaseline(tool, args) {
   const create = tool === "mcp-create-and-run-backtest";
@@ -23670,40 +23973,40 @@ function readBacktestBaseline(tool, args) {
   const directory = args[create ? "strategyPath" : "codePath"];
   if (directory === void 0) return void 0;
   if (typeof directory !== "string" || !path14.isAbsolute(directory)) throw new Error("Configuration baseline requires an absolute directory path");
-  const root = fs14.realpathSync(directory);
-  if (create && path14.basename(path14.dirname(root)).toLowerCase() === "backtest") {
+  const root2 = fs15.realpathSync(directory);
+  if (create && path14.basename(path14.dirname(root2)).toLowerCase() === "backtest") {
     throw new Error("strategyPath must identify the strategy root, not a historical backtest directory");
   }
-  const file = path14.join(root, ".vscode", "tradesetting.json");
-  const raw = fs14.readFileSync(file);
+  const file = path14.join(root2, ".vscode", "tradesetting.json");
+  const raw = fs15.readFileSync(file);
   let config2;
   try {
     config2 = JSON.parse(raw.toString("utf8").replace(/^\uFEFF/, ""));
   } catch {
     throw new Error("Configuration baseline is not valid JSON");
   }
-  if (!record3(config2) || config2.strategy_id !== args.strategyId) throw new Error("Configuration baseline strategy_id is missing or mismatched");
+  if (!record4(config2) || config2.strategy_id !== args.strategyId) throw new Error("Configuration baseline strategy_id is missing or mismatched");
   if (!create && (typeof args.runId !== "string" || config2.backtest_id !== args.runId)) {
     throw new Error("Configuration baseline backtest_id does not match the requested runId");
   }
   const params = pick2(config2, [...BACKTEST_CONFIG_KEYS, ...INTERNAL_CONFIG_KEYS]);
   for (const key of ["base_tpl_obj", "ratio_tpl_obj"]) {
-    if (params[key] !== void 0 && !record3(params[key])) throw new Error(`Configuration baseline ${key} must be an object`);
+    if (params[key] !== void 0 && !record4(params[key])) throw new Error(`Configuration baseline ${key} must be an object`);
   }
-  if (record3(params.base_tpl_obj)) params.base_tpl_obj = pick2(params.base_tpl_obj, BASE_KEYS);
-  if (record3(params.ratio_tpl_obj)) {
+  if (record4(params.base_tpl_obj)) params.base_tpl_obj = pick2(params.base_tpl_obj, BASE_KEYS);
+  if (record4(params.ratio_tpl_obj)) {
     const fees = params.ratio_tpl_obj;
     for (const asset of ["stock", "future", "fund", "bond"]) {
-      if (fees[asset] !== void 0 && !record3(fees[asset])) throw new Error(`Configuration baseline fee section ${asset} must be an object`);
+      if (fees[asset] !== void 0 && !record4(fees[asset])) throw new Error(`Configuration baseline fee section ${asset} must be an object`);
     }
     params.ratio_tpl_obj = {
       ...pick2(fees, ["name", "zhCnName"]),
-      ...Object.fromEntries(["stock", "future", "fund", "bond"].filter((k) => record3(fees[k])).map((k) => [k, pick2(fees[k], FEE_KEYS)]))
+      ...Object.fromEntries(["stock", "future", "fund", "bond"].filter((k) => record4(fees[k])).map((k) => [k, pick2(fees[k], FEE_KEYS)]))
     };
   }
   if (Array.isArray(params.account_list)) {
     params.account_list = params.account_list.map((account) => {
-      if (!record3(account)) throw new Error("Configuration baseline account_list contains a non-object");
+      if (!record4(account)) throw new Error("Configuration baseline account_list contains a non-object");
       const result = pick2(account, ["pindex", "account_id", "cash", "account_type"]);
       if (create && typeof result.account_id === "string" && /^RN-[A-Za-z0-9-]+_\d+$/.test(result.account_id)) result.account_id = "";
       return result;
@@ -23717,7 +24020,7 @@ function readBacktestBaseline(tool, args) {
 }
 function reconcileBaselineCapital(params, overrides) {
   const accounts = params.account_list;
-  if (!Array.isArray(accounts) || !accounts.length || accounts.some((a) => !record3(a) || typeof a.cash !== "number" || !Number.isFinite(a.cash) || a.cash < 0)) {
+  if (!Array.isArray(accounts) || !accounts.length || accounts.some((a) => !record4(a) || typeof a.cash !== "number" || !Number.isFinite(a.cash) || a.cash < 0)) {
     throw new Error("Configuration baseline requires accounts with finite nonnegative cash");
   }
   const explicitCapital = Object.prototype.hasOwnProperty.call(overrides, "initial_capital");
@@ -23807,7 +24110,7 @@ function prepareToolCallArgs(tool, args, contexts) {
 }
 function validateDataRangeArguments(args) {
   const errors = [];
-  const error2 = (path18, message) => errors.push({ path: path18, message });
+  const error2 = (path19, message) => errors.push({ path: path19, message });
   const input = stripControlParams(args);
   for (const key of Object.keys(input)) {
     if (key !== "params") error2(`$.${key}`, "Unsupported top-level field; query combinations belong in params[]. Date filters are not accepted.");
@@ -23867,18 +24170,18 @@ function refuseMaskedFuturesBacktest(tool, args) {
     userAction: "\u5F53\u524D\u7248\u672C\u4EC5\u652F\u6301\u80A1\u7968\u56DE\u6D4B\uFF08sh/sz\uFF09\uFF1B\u671F\u8D27\u56DE\u6D4B\u8BF7\u7B49\u5F85\u540E\u7EED\u7248\u672C\u5F00\u653E\u3002"
   }, true);
 }
-async function dispatchSpecialTool(tool, args, client, timeout, session, waitControl) {
+async function dispatchSpecialTool(tool, args, client2, timeout, session, waitControl) {
   if (tool.name === "mcp-factor-task-status") {
-    return handleFactorTaskStatus(tool, args, client, timeout, session);
+    return handleFactorTaskStatus(tool, args, client2, timeout, session);
   }
   if (tool.name === "mcp-wait") {
-    return runWait(tool, args, client, timeout, session, waitControl);
+    return runWait(tool, args, client2, timeout, session, waitControl);
   }
   if (tool.name === "mcp-factor-value-query") {
     const hasRecord = typeof args.calculateRecordId === "string" && args.calculateRecordId.length > 0;
     const hasFactor = typeof args.factorId === "string" && args.factorId.length > 0;
-    if (!hasRecord && hasFactor) return queryFactorValuesForLatestRecord(tool, args, client, timeout, session);
-    if (hasRecord) return queryFactorValuesForGivenRecord(tool, args, client, timeout, session);
+    if (!hasRecord && hasFactor) return queryFactorValuesForLatestRecord(tool, args, client2, timeout, session);
+    if (hasRecord) return queryFactorValuesForGivenRecord(tool, args, client2, timeout, session);
   }
   if (tool.name === "mcp-factor-calculate-start" || tool.name === "mcp-factor-calculate-incremental-start") {
     const factorId = typeof args.factorId === "string" ? args.factorId : "";
@@ -23886,15 +24189,15 @@ async function dispatchSpecialTool(tool, args, client, timeout, session, waitCon
     if (blocked) return blocked;
   }
   if (tool.name === "mcp-get-strategy-list") {
-    return listStrategies(client, args, timeout, session.repairHint);
+    return listStrategies(client2, args, timeout, session.repairHint);
   }
   if (tool.name === "mcp-create-strategy") {
-    return rejectDuplicateStrategyName(client, args, timeout, session.repairHint);
+    return rejectDuplicateStrategyName(client2, args, timeout, session.repairHint);
   }
   if (tool.name === "mcp-create-strategy-with-template") {
     return injectDebugRunId(tool, injectStrategyDocsHint(
       tool,
-      await createStrategyWithTemplate(client, args, timeout, session.repairHint),
+      await createStrategyWithTemplate(client2, args, timeout, session.repairHint),
       session.docsPath
     ));
   }
@@ -23969,7 +24272,7 @@ function readSlaveProperties(filePath) {
   const entries = /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = fs15.readFileSync(filePath, "utf-8");
+    raw = fs16.readFileSync(filePath, "utf-8");
   } catch {
     return entries;
   }
@@ -23991,13 +24294,13 @@ function resolveFactorProjectRoot(clientRootDir) {
   if (!clientRootDir) return void 0;
   const cached2 = factorProjectRootCache.get(clientRootDir);
   if (cached2) return cached2;
-  const root = clientRootDir.replace(/[\\/]+$/, "");
+  const root2 = clientRootDir.replace(/[\\/]+$/, "");
   const configured = expandSlaveValue(
-    readSlaveProperties(path15.join(root, ...ZLTAF_CONFIG_SEGMENTS)),
+    readSlaveProperties(path15.join(root2, ...ZLTAF_CONFIG_SEGMENTS)),
     "slave.factor.project-path",
-    root
+    root2
   );
-  const resolved = configured ? path15.normalize(configured) : path15.join(root, ...FALLBACK_FACTOR_PROJECT_PATH);
+  const resolved = configured ? path15.normalize(configured) : path15.join(root2, ...FALLBACK_FACTOR_PROJECT_PATH);
   factorProjectRootCache.set(clientRootDir, resolved);
   return resolved;
 }
@@ -24012,7 +24315,7 @@ function checkFactorSourceLoadable(clientRootDir, factorId) {
   if (!workspacePath) return null;
   let source;
   try {
-    source = fs15.readFileSync(path15.join(workspacePath, "main.py"), "utf8");
+    source = fs16.readFileSync(path15.join(workspacePath, "main.py"), "utf8");
   } catch {
     return null;
   }
@@ -24036,11 +24339,11 @@ function checkFactorSourceLoadable(clientRootDir, factorId) {
 }
 function echoFactorWorkspacePath(tool, result, clientRootDir) {
   if (tool.name !== "mcp-factor-detail" || result.isError || !clientRootDir) return result;
-  const text = result.content?.[0]?.text;
-  if (typeof text !== "string") return result;
+  const text2 = result.content?.[0]?.text;
+  if (typeof text2 !== "string") return result;
   let parsed;
   try {
-    parsed = JSON.parse(text);
+    parsed = JSON.parse(text2);
   } catch {
     return result;
   }
@@ -24257,7 +24560,7 @@ function backtestWindowPreflightError(tool, reason, message, details) {
 function isExistingAbsoluteDirectory(value) {
   if (!value || !path15.isAbsolute(value)) return false;
   try {
-    return fs15.statSync(value).isDirectory();
+    return fs16.statSync(value).isDirectory();
   } catch {
     return false;
   }
@@ -24265,8 +24568,8 @@ function isExistingAbsoluteDirectory(value) {
 function readBacktestIdFromCodePath(codePath) {
   try {
     const tradesettingPath = path15.join(codePath, ".vscode", "tradesetting.json");
-    if (!fs15.existsSync(tradesettingPath)) return void 0;
-    const parsed = JSON.parse(fs15.readFileSync(tradesettingPath, "utf-8"));
+    if (!fs16.existsSync(tradesettingPath)) return void 0;
+    const parsed = JSON.parse(fs16.readFileSync(tradesettingPath, "utf-8"));
     if (!isRecord3(parsed)) return void 0;
     const value = parsed.backtest_id ?? parsed.backtestId;
     return typeof value === "string" && value.trim() ? value.trim() : void 0;
@@ -24504,9 +24807,9 @@ var DCM_PROGRESS_TOOL = {
   name: "mcp-get-download-progress",
   responseTransform: "downloadProgress"
 };
-async function probeDataPrep(client, timeout) {
+async function probeDataPrep(client2, timeout) {
   try {
-    const response = await client.invoke(
+    const response = await client2.invoke(
       DCM_PROGRESS_URI,
       {},
       JSON.stringify({ uuid: "0" }),
@@ -24531,8 +24834,8 @@ async function probeDataPrep(client, timeout) {
     return void 0;
   }
 }
-async function handleFactorTaskStatus(tool, args, client, timeout, session) {
-  const response = await client.invoke(
+async function handleFactorTaskStatus(tool, args, client2, timeout, session) {
+  const response = await client2.invoke(
     buildIpcUri2(tool, args),
     buildIpcParams(tool, args),
     buildIpcBody2(tool, args),
@@ -24546,7 +24849,7 @@ async function handleFactorTaskStatus(tool, args, client, timeout, session) {
     if (isRecord3(parsed) && isRecord3(parsed.Data)) {
       const data = parsed.Data;
       if (Number(data.status) === 1 && Number(data.progress) === 0) {
-        const dataPrep = await probeDataPrep(client, timeout);
+        const dataPrep = await probeDataPrep(client2, timeout);
         if (dataPrep) {
           enriched = {
             content: [{ type: "text", text: JSON.stringify({ ...parsed, Data: { ...data, dataPrep } }) }]
@@ -24618,9 +24921,9 @@ var FACTOR_LATEST_SUCCESS_TOOL = {
   name: "mcp-factor-calculate-latest-success",
   ipcUri: FACTOR_LATEST_SUCCESS_URI
 };
-async function resolveLatestCalculateRecordId(client, factorId, storageScope, timeout) {
+async function resolveLatestCalculateRecordId(client2, factorId, storageScope, timeout) {
   try {
-    const response = await client.invoke(
+    const response = await client2.invoke(
       FACTOR_LATEST_SUCCESS_URI,
       {},
       JSON.stringify({ factorId, storageScope }),
@@ -24693,9 +24996,9 @@ function extractEdmsRows(parsed) {
   }
   return rows;
 }
-async function readFactorCrossSection(client, readWith, dayStartMs, timeout) {
+async function readFactorCrossSection(client2, readWith, dayStartMs, timeout) {
   try {
-    const response = await client.invoke(
+    const response = await client2.invoke(
       ZLT_EDMS_GET_EXDATA_URI,
       {},
       buildEdmsExDataBody(readWith, dayStartMs),
@@ -24726,7 +25029,7 @@ function markResolvedRecordSource(result) {
     return result;
   }
 }
-async function fillFactorValuesFromEdms(base, args, client, timeout, recordEndDate) {
+async function fillFactorValuesFromEdms(base, args, client2, timeout, recordEndDate) {
   if (base.isError || base.content.length === 0) return base;
   let parsed;
   try {
@@ -24753,7 +25056,7 @@ async function fillFactorValuesFromEdms(base, args, client, timeout, recordEndDa
   let usedMs = anchor;
   for (let back = 0; back < attempts; back += 1) {
     usedMs = anchor - back * ZLT_EDMS_DAY_MS;
-    rows = await readFactorCrossSection(client, target, usedMs, timeout);
+    rows = await readFactorCrossSection(client2, target, usedMs, timeout);
     if (rows) break;
   }
   if (!rows) return base;
@@ -24784,23 +25087,23 @@ async function fillFactorValuesFromEdms(base, args, client, timeout, recordEndDa
     }]
   };
 }
-async function queryFactorValuesForGivenRecord(tool, args, client, timeout, session) {
+async function queryFactorValuesForGivenRecord(tool, args, client2, timeout, session) {
   try {
-    const response = await client.invoke(
+    const response = await client2.invoke(
       buildIpcUri2(tool, args),
       buildIpcParams(tool, args),
       buildIpcBody2(tool, args),
       timeout
     );
     const base = handleIpcResponse(response, tool, session.repairHint);
-    return await fillFactorValuesFromEdms(base, args, client, timeout, millisToChinaDate(Date.now()));
+    return await fillFactorValuesFromEdms(base, args, client2, timeout, millisToChinaDate(Date.now()));
   } catch {
     return null;
   }
 }
-async function queryFactorValuesForLatestRecord(tool, args, client, timeout, session) {
+async function queryFactorValuesForLatestRecord(tool, args, client2, timeout, session) {
   const factorId = typeof args.factorId === "string" ? args.factorId : "";
-  const resolved = await resolveLatestCalculateRecordId(client, factorId, FACTOR_RESEARCH_SCOPE, timeout);
+  const resolved = await resolveLatestCalculateRecordId(client2, factorId, FACTOR_RESEARCH_SCOPE, timeout);
   if (resolved.noRecord) {
     return jsonToolResult(
       10055,
@@ -24818,7 +25121,7 @@ async function queryFactorValuesForLatestRecord(tool, args, client, timeout, ses
   if (!resolved.id) return null;
   const finalArgs = { ...args, calculateRecordId: resolved.id };
   try {
-    const response = await client.invoke(
+    const response = await client2.invoke(
       buildIpcUri2(tool, finalArgs),
       buildIpcParams(tool, finalArgs),
       buildIpcBody2(tool, finalArgs),
@@ -24828,7 +25131,7 @@ async function queryFactorValuesForLatestRecord(tool, args, client, timeout, ses
     const filled = await fillFactorValuesFromEdms(
       base,
       args,
-      client,
+      client2,
       timeout,
       resolved.endDate ?? millisToChinaDate(Date.now())
     );
@@ -24963,9 +25266,9 @@ var FACTOR_FAILURE_SIGNATURES = [
 function factorFailureMessage(data) {
   if (typeof data.errorMessage === "string" && data.errorMessage) return data.errorMessage;
   for (const key of ["calculateRecord", "detectRecord"]) {
-    const record4 = data[key];
-    if (isRecord3(record4) && typeof record4.errorMessage === "string" && record4.errorMessage) {
-      return record4.errorMessage;
+    const record5 = data[key];
+    if (isRecord3(record5) && typeof record5.errorMessage === "string" && record5.errorMessage) {
+      return record5.errorMessage;
     }
   }
   return "";
@@ -25287,14 +25590,14 @@ function backtestWaitLane(runId, session, codePath, resultBaseline, attemptStart
     }
   };
 }
-async function runWaitLoop(lane, client, timeout, session, control) {
+async function runWaitLoop(lane, client2, timeout, session, control) {
   let failureCount = 0;
   for (; ; ) {
     if (control.abortSignal?.aborted) return waitError(10047, "\u5DF2\u53D6\u6D88\u7B49\u5F85\u3002");
     let response;
     try {
       const pollArgs = lane.pollArgs();
-      response = await client.invoke(
+      response = await client2.invoke(
         buildIpcUri2(lane.pollIdentity, pollArgs),
         buildIpcParams(lane.pollIdentity, pollArgs),
         buildIpcBody2(lane.pollIdentity, pollArgs),
@@ -25328,7 +25631,7 @@ async function runWaitLoop(lane, client, timeout, session, control) {
     await sleepUnlessAborted(WAIT_POLL_INTERVAL_MS, control.abortSignal);
   }
 }
-async function runWait(_tool, args, client, timeout, session, control) {
+async function runWait(_tool, args, client2, timeout, session, control) {
   const kind = typeof args.kind === "string" ? args.kind : "";
   const id = typeof args.id === "string" ? args.id.trim() : "";
   const suppliedCodePath = typeof args.codePath === "string" ? args.codePath.trim() : "";
@@ -25425,7 +25728,7 @@ async function runWait(_tool, args, client, timeout, session, control) {
       }
     );
   }
-  return runWaitLoop(lane, client, timeout, session, control);
+  return runWaitLoop(lane, client2, timeout, session, control);
 }
 function applyBacktestResultGuards(tool, args, result, states, contexts, activeRunIds) {
   const completionResult = applyBacktestCompletionGuard(tool, args, result, contexts);
@@ -25444,10 +25747,10 @@ function applyBacktestResultGuards(tool, args, result, states, contexts, activeR
 function readRunResultFile(codePath) {
   try {
     const resultPath = path15.join(codePath, "log", "result.json");
-    if (!fs15.existsSync(resultPath)) return null;
-    const before = fs15.statSync(resultPath);
-    const raw = fs15.readFileSync(resultPath);
-    const after = fs15.statSync(resultPath);
+    if (!fs16.existsSync(resultPath)) return null;
+    const before = fs16.statSync(resultPath);
+    const raw = fs16.readFileSync(resultPath);
+    const after = fs16.statSync(resultPath);
     if (before.mtimeMs !== after.mtimeMs || before.size !== after.size) return null;
     const parsed = JSON.parse(raw.toString("utf-8"));
     if (!isRecord3(parsed)) return null;
@@ -25663,8 +25966,8 @@ function hashBacktestSource(codePath) {
   if (!codePath) return void 0;
   try {
     const sourcePath = path15.join(codePath, "main.py");
-    if (!fs15.statSync(sourcePath).isFile()) return void 0;
-    return (0, import_node_crypto3.createHash)("sha256").update(fs15.readFileSync(sourcePath)).digest("hex");
+    if (!fs16.statSync(sourcePath).isFile()) return void 0;
+    return (0, import_node_crypto3.createHash)("sha256").update(fs16.readFileSync(sourcePath)).digest("hex");
   } catch {
     return void 0;
   }
@@ -25720,7 +26023,7 @@ function resolveStrategyDocsPath(clientRootDir) {
     "docs"
   );
   try {
-    if (!fs15.existsSync(docsPath)) return void 0;
+    if (!fs16.existsSync(docsPath)) return void 0;
   } catch {
     return void 0;
   }
@@ -25737,7 +26040,7 @@ function injectDebugRunId(tool, result) {
     const localPath = typeof parsed.Data.localPath === "string" ? parsed.Data.localPath.trim() : "";
     if (!localPath) return result;
     const settings = JSON.parse(
-      fs15.readFileSync(path15.join(localPath, ".vscode", "tradesetting.json"), "utf8")
+      fs16.readFileSync(path15.join(localPath, ".vscode", "tradesetting.json"), "utf8")
     );
     const debugRunId = isRecord3(settings) && typeof settings.backtest_id === "string" ? settings.backtest_id.trim() : "";
     if (!debugRunId) return result;
@@ -25936,13 +26239,13 @@ function handleIpcResponse(response, tool, repairHint = identityRepairHint, data
     };
   }
   const data = repairHint(parsed.data);
-  const text = typeof data === "string" ? applyResponseTransform(data, tool, dataRoots) : applyResponseTransform(JSON.stringify(data), tool, dataRoots);
+  const text2 = typeof data === "string" ? applyResponseTransform(data, tool, dataRoots) : applyResponseTransform(JSON.stringify(data), tool, dataRoots);
   return {
-    content: [{ type: "text", text }],
+    content: [{ type: "text", text: text2 }],
     isError: isIpcBusinessError(data) || void 0
   };
 }
-async function listStrategies(client, args, timeout, repairHint = identityRepairHint) {
+async function listStrategies(client2, args, timeout, repairHint = identityRepairHint) {
   const statusValue = Number(args.status);
   const status = Number.isFinite(statusValue) ? statusValue : 0;
   const treeIdValue = Number(args.treeId);
@@ -25950,13 +26253,13 @@ async function listStrategies(client, args, timeout, repairHint = identityRepair
   try {
     if (treeId !== 0) {
       return handleIpcResponse(
-        await client.invoke("/zltaf_slave/v1/strategy/list", {}, JSON.stringify({ status, treeId }), timeout),
+        await client2.invoke("/zltaf_slave/v1/strategy/list", {}, JSON.stringify({ status, treeId }), timeout),
         void 0,
         repairHint
       );
     }
     const treeResult = handleIpcResponse(
-      await client.invoke("/zltaf_slave/v1/strategy-tree/list", {}, JSON.stringify({ treeType: "strategy" }), timeout),
+      await client2.invoke("/zltaf_slave/v1/strategy-tree/list", {}, JSON.stringify({ treeType: "strategy" }), timeout),
       void 0,
       repairHint
     );
@@ -25965,7 +26268,7 @@ async function listStrategies(client, args, timeout, repairHint = identityRepair
     const merged = [];
     for (const tree of extractStrategyTreeIds(treeResult)) {
       const listResult = handleIpcResponse(
-        await client.invoke("/zltaf_slave/v1/strategy/list", {}, JSON.stringify({ status, treeId: tree }), timeout),
+        await client2.invoke("/zltaf_slave/v1/strategy/list", {}, JSON.stringify({ status, treeId: tree }), timeout),
         void 0,
         repairHint
       );
@@ -25989,10 +26292,10 @@ async function listStrategies(client, args, timeout, repairHint = identityRepair
     };
   }
 }
-async function rejectDuplicateStrategyName(client, args, timeout, repairHint = identityRepairHint) {
+async function rejectDuplicateStrategyName(client2, args, timeout, repairHint = identityRepairHint) {
   const strategyName = typeof args.name === "string" ? args.name.trim() : "";
   if (!strategyName) return null;
-  const listResult = await listStrategies(client, { status: 0, treeId: 0 }, timeout, repairHint);
+  const listResult = await listStrategies(client2, { status: 0, treeId: 0 }, timeout, repairHint);
   if (listResult.isError) return listResult;
   const existing = extractDataArray(listResult).find((item) => isRecord3(item) && typeof item.strategyName === "string" && item.strategyName.trim() === strategyName);
   if (!isRecord3(existing)) return null;
@@ -26010,10 +26313,10 @@ async function rejectDuplicateStrategyName(client, args, timeout, repairHint = i
     true
   );
 }
-async function createStrategyWithTemplate(client, args, timeout, repairHint = identityRepairHint) {
+async function createStrategyWithTemplate(client2, args, timeout, repairHint = identityRepairHint) {
   let createResponse;
   try {
-    createResponse = await client.invoke(
+    createResponse = await client2.invoke(
       "/zltaf_slave/v1/strategy/create-with-template",
       {},
       JSON.stringify(stripControlParams(args)),
@@ -26048,7 +26351,7 @@ async function createStrategyWithTemplate(client, args, timeout, repairHint = id
   const detailBody = { strategyId };
   if (typeof args.userId === "string" && args.userId.trim()) detailBody.userId = args.userId.trim();
   try {
-    const detailResponse = await client.invoke(
+    const detailResponse = await client2.invoke(
       "/zltaf_slave/v1/strategy/detail",
       {},
       JSON.stringify(detailBody),
@@ -26092,14 +26395,14 @@ function extractStrategyTreeIds(result) {
   }
   return ids;
 }
-async function executeSteps(steps, client, initialBody, timeout, repairHint = identityRepairHint, toolName) {
+async function executeSteps(steps, client2, initialBody, timeout, repairHint = identityRepairHint, toolName) {
   let body = { ...initialBody };
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
     const stepBody = buildStepBody(step, body);
     let response;
     try {
-      response = await client.invoke(step.uri, {}, JSON.stringify(stepBody), timeout);
+      response = await client2.invoke(step.uri, {}, JSON.stringify(stepBody), timeout);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       return {
@@ -26233,12 +26536,12 @@ function preflightCreatedBacktestSource(toolName, body) {
   if (toolName !== "mcp-create-and-run-backtest") return null;
   const runId = typeof body.runId === "string" ? body.runId.trim() : "";
   const codePath = typeof body.codePath === "string" ? body.codePath.trim() : "";
-  if (!codePath || !fs15.existsSync(codePath)) return null;
+  if (!codePath || !fs16.existsSync(codePath)) return null;
   const sourcePath = path15.join(codePath, "main.py");
-  if (!fs15.existsSync(sourcePath)) return null;
+  if (!fs16.existsSync(sourcePath)) return null;
   let source;
   try {
-    source = fs15.readFileSync(sourcePath, "utf8");
+    source = fs16.readFileSync(sourcePath, "utf8");
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
     return jsonToolResult(10061, "\u56DE\u6D4B\u4EE3\u7801\u5FEB\u7167\u65E0\u6CD5\u8BFB\u53D6\uFF0C\u672A\u542F\u52A8\u7B56\u7565\u5F15\u64CE\u3002", {
@@ -26320,12 +26623,12 @@ function isIpcBusinessError(value) {
   const errNo = Number(value.ErrNo);
   return Number.isFinite(errNo) && errNo !== 0;
 }
-function parseMalformedBusinessError(text) {
-  const codeMatch = text.match(/"code"\s*:\s*(-?\d+)/);
+function parseMalformedBusinessError(text2) {
+  const codeMatch = text2.match(/"code"\s*:\s*(-?\d+)/);
   if (!codeMatch) return null;
   const errNo = Number(codeMatch[1]);
   if (!Number.isFinite(errNo) || errNo === 0) return null;
-  const cleaned = text.replace(/\u0000/g, "");
+  const cleaned = text2.replace(/\u0000/g, "");
   const messageMatch = cleaned.match(/"message"\s*:\s*"([\s\S]*)"\s*\}?\s*$/);
   const errMsg = messageMatch ? messageMatch[1].replace(/\\"/g, '"') : cleaned;
   return {
@@ -26334,10 +26637,10 @@ function parseMalformedBusinessError(text) {
     Data: { raw: cleaned }
   };
 }
-function applyResponseTransform(text, tool, dataRoots) {
-  if (!tool?.responseTransform || !text) return text;
+function applyResponseTransform(text2, tool, dataRoots) {
+  if (!tool?.responseTransform || !text2) return text2;
   try {
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(text2);
     if (tool.responseTransform === "dataRange") {
       return JSON.stringify(formatDataRangeResult(parsed, dataRoots));
     }
@@ -26354,9 +26657,9 @@ function applyResponseTransform(text, tool, dataRoots) {
       return JSON.stringify(formatFactorValuesResult(parsed));
     }
   } catch {
-    return text;
+    return text2;
   }
-  return text;
+  return text2;
 }
 var FACTOR_VALUES_RESULT_KIND = "factor-values";
 function parseFactorOutputPath(outputPath) {
@@ -26478,7 +26781,7 @@ function normalizeDataRoot(raw, clientRootDir) {
 }
 function readJsonFile(filePath) {
   try {
-    const parsed = JSON.parse(fs15.readFileSync(filePath, "utf-8"));
+    const parsed = JSON.parse(fs16.readFileSync(filePath, "utf-8"));
     return isRecord3(parsed) ? parsed : void 0;
   } catch {
     return void 0;
@@ -26491,11 +26794,11 @@ function resolveDataRoots(clientRootDir) {
   const readAt = dataRootsReadAt.get(clientRootDir) ?? 0;
   const cached2 = Date.now() - readAt < DATA_ROOTS_TTL_MS ? dataRootsCache.get(clientRootDir) : void 0;
   if (cached2) return cached2;
-  const root = clientRootDir.replace(/[\\/]+$/, "");
-  const dcSdk = readJsonFile(path15.join(root, ...DC_SDK_CONFIG_SEGMENTS));
-  const dcm = readJsonFile(path15.join(root, ...DCM_CONFIG_SEGMENTS));
-  const engineRoot = normalizeDataRoot(isRecord3(dcSdk?.mdf) ? dcSdk.mdf.path : void 0, root);
-  const downloadRoot = normalizeDataRoot(dcm?.download_home, root);
+  const root2 = clientRootDir.replace(/[\\/]+$/, "");
+  const dcSdk = readJsonFile(path15.join(root2, ...DC_SDK_CONFIG_SEGMENTS));
+  const dcm = readJsonFile(path15.join(root2, ...DCM_CONFIG_SEGMENTS));
+  const engineRoot = normalizeDataRoot(isRecord3(dcSdk?.mdf) ? dcSdk.mdf.path : void 0, root2);
+  const downloadRoot = normalizeDataRoot(dcm?.download_home, root2);
   const resolved = Boolean(engineRoot && downloadRoot);
   const status = {
     engineRoot,
@@ -26525,7 +26828,7 @@ function engineHasAnyHqSeries(engineRoot, series) {
   for (const { exchangeId, dataType } of series) {
     const dir = path15.join(engineRoot, "hqdata", "his", exchangeId, dataType);
     try {
-      if (fs15.existsSync(dir) && fs15.readdirSync(dir).length > 0) return true;
+      if (fs16.existsSync(dir) && fs16.readdirSync(dir).length > 0) return true;
     } catch {
       return void 0;
     }
@@ -26930,8 +27233,8 @@ function describeDataRangeSecurityClass(legacyValue, tokenClass, idToName) {
   return idToName[nibble * 16] || `\u7C7B\u522B${tokenClass}`;
 }
 function compactDataRangeDate(value) {
-  const text = typeof value === "number" || typeof value === "string" ? String(value).trim() : "";
-  const match = text.match(/^((?:19|20)\d{2})(\d{2})(\d{2})/);
+  const text2 = typeof value === "number" || typeof value === "string" ? String(value).trim() : "";
+  const match = text2.match(/^((?:19|20)\d{2})(\d{2})(\d{2})/);
   if (!match) return null;
   const [, year, month, day] = match;
   const candidate = /* @__PURE__ */ new Date(`${year}-${month}-${day}T00:00:00Z`);
@@ -26953,7 +27256,7 @@ async function waitForCacheRead(probe, timeoutMs, control = {}, clock = { now: D
   const started = clock.now();
   let attempts = 0;
   let upstream;
-  const finish = (cacheRead, reason) => ({
+  const finish2 = (cacheRead, reason) => ({
     cacheRead,
     cacheWrite: "unverified",
     reason,
@@ -26964,36 +27267,36 @@ async function waitForCacheRead(probe, timeoutMs, control = {}, clock = { now: D
     stopAutoRetry: cacheRead !== "ready"
   });
   while (true) {
-    if (control.abortSignal?.aborted) return finish("unknown", "cancelled");
+    if (control.abortSignal?.aborted) return finish2("unknown", "cancelled");
     control.heartbeat?.(attempts, { message: "Checking cache.read readiness; cache.write remains unverified" });
     try {
       attempts++;
       upstream = await probe(timeoutMs === 0 ? 2e4 : Math.max(1, Math.min(2e4, timeoutMs - (clock.now() - started))));
     } catch (error2) {
       upstream = { message: error2 instanceof Error ? error2.message : String(error2) };
-      return finish("unknown", "probe-failed");
+      return finish2("unknown", "probe-failed");
     }
-    if (control.abortSignal?.aborted) return finish("unknown", "cancelled");
+    if (control.abortSignal?.aborted) return finish2("unknown", "cancelled");
     const envelope = isRecord3(upstream) ? upstream : {};
     if (envelope.ErrNo === 0) {
       const data = isRecord3(envelope.Data) ? envelope.Data : {};
       if (typeof data.download_home === "string" && data.download_home.trim() && (typeof data.disk_free === "number" || typeof data.disk_free === "string") && String(data.disk_free).trim() && Number.isFinite(Number(data.disk_free)) && Number(data.disk_free) >= 0) {
         upstream = { ErrNo: 0, ErrMsg: envelope.ErrMsg, Data: { download_home: data.download_home, disk_free: data.disk_free } };
-        return finish("ready", "diskspace-response");
+        return finish2("ready", "diskspace-response");
       }
-      return finish("unknown", "unrecognized-response");
+      return finish2("unknown", "unrecognized-response");
     }
     if (Number(envelope.ErrNo) !== 3 || !/^storage initializing; capability=cache\.read\s*$/i.test(String(envelope.ErrMsg ?? ""))) {
-      return finish("unknown", "upstream-error");
+      return finish2("unknown", "upstream-error");
     }
     const remaining = timeoutMs - (clock.now() - started);
-    if (remaining <= 0) return finish("initializing", "deadline");
+    if (remaining <= 0) return finish2("initializing", "deadline");
     try {
       await clock.sleep(Math.min(3e3, remaining), control.abortSignal);
     } catch {
-      return finish("unknown", "cancelled");
+      return finish2("unknown", "cancelled");
     }
-    if (clock.now() - started >= timeoutMs) return finish("initializing", "deadline");
+    if (clock.now() - started >= timeoutMs) return finish2("initializing", "deadline");
   }
 }
 
@@ -27102,9 +27405,9 @@ function readTextFileHead(filePath, maxBytes = 1048576) {
   }
 }
 function summarizeEngineDataView(runDir) {
-  const text = readTextFileHead(import_node_path.default.join(runDir, "log", "strategy.log"));
-  if (text === null) return { available: false };
-  const match = /Mdf Setting\((\{.*?\})\)/.exec(text);
+  const text2 = readTextFileHead(import_node_path.default.join(runDir, "log", "strategy.log"));
+  if (text2 === null) return { available: false };
+  const match = /Mdf Setting\((\{.*?\})\)/.exec(text2);
   if (!match) return { available: false };
   let payload;
   try {
@@ -27162,9 +27465,9 @@ function emptyEntrust() {
   };
 }
 function summarizeEntrust(runDir) {
-  const text = readTextFile(import_node_path.default.join(runDir, "log", "zlt_entrust.csv"));
-  if (text === null) return emptyEntrust();
-  const lines = text.split(/\r?\n/).filter((line) => line.trim().length > 0);
+  const text2 = readTextFile(import_node_path.default.join(runDir, "log", "zlt_entrust.csv"));
+  if (text2 === null) return emptyEntrust();
+  const lines = text2.split(/\r?\n/).filter((line) => line.trim().length > 0);
   if (lines.length === 0) return emptyEntrust();
   const header = parseCsvLine(lines[0]).map((name) => name.trim());
   const indexByName = /* @__PURE__ */ new Map();
@@ -27220,14 +27523,14 @@ function isFuturesSecurity(code) {
   return FUTURES_MARKET_IDS.has(normalized.slice(0, 2)) && /[a-z]/.test(normalized.slice(2));
 }
 function summarizeRejections(runDir) {
-  const text = readTextFile(import_node_path.default.join(runDir, "log", "strategy_user.log"));
-  if (text === null) {
+  const text2 = readTextFile(import_node_path.default.join(runDir, "log", "strategy_user.log"));
+  if (text2 === null) {
     return { available: false, total: 0, byReason: {}, structuralFailure: false, samples: [] };
   }
   const byReason = {};
   const samples = [];
   let total = 0;
-  for (const line of text.split(/\r?\n/)) {
+  for (const line of text2.split(/\r?\n/)) {
     if (!line.includes("[error]") && !line.includes("Traceback")) continue;
     total += 1;
     const matched = REJECTION_PATTERNS.find((pattern) => line.includes(pattern));
@@ -27320,9 +27623,9 @@ function evenStride(items, limit) {
   return Array.from({ length: limit }, (_, i) => items[Math.round(i * last / (limit - 1))]);
 }
 var UNITS_NOTE = "\u6536\u76CA\u7C7B\u5B57\u6BB5\uFF08*Pct\uFF09\u5DF2\u662F\u767E\u5206\u6570\uFF0C-15.62 \u5373 -15.62%\uFF1BwinRate / dailyWinRate \u662F 0-1 \u7684\u6BD4\u4F8B\u3002positionRatePct / turnoverRatePct \u6309\u5B9E\u6D4B\u53D6\u503C\u8303\u56F4\u5224\u4E3A\u767E\u5206\u6570\uFF08\u89C2\u6D4B\u5230 91.18 / 92.44\uFF09\uFF0C\u4E0A\u6E38\u672A\u7ED9\u51FA\u4E66\u9762\u53E3\u5F84\u3002";
-function numberOrNull2(text) {
-  if (text === void 0) return null;
-  const trimmed = text.trim();
+function numberOrNull2(text2) {
+  if (text2 === void 0) return null;
+  const trimmed = text2.trim();
   if (!trimmed) return null;
   const value = Number(trimmed);
   return Number.isFinite(value) ? value : null;
@@ -27340,9 +27643,9 @@ function deriveMaxDrawdownWindow(equity, reportedPct) {
       peakDate = point.date;
     }
     if (peak <= 0 || peakDate === void 0) continue;
-    const drop = (peak - asset) / peak * 100;
-    if (drop > worst) {
-      worst = drop;
+    const drop2 = (peak - asset) / peak * 100;
+    if (drop2 > worst) {
+      worst = drop2;
       window = { startDate: peakDate, endDate: point.date };
     }
   }
@@ -27360,12 +27663,12 @@ function checkRelativeReturn(performance) {
 }
 function summarizeBacktestProfit(runDir, options = {}) {
   const notes = [];
-  const text = readTextFile(import_node_path.default.join(runDir, "log", PROFIT_CSV));
-  if (text === null) {
+  const text2 = readTextFile(import_node_path.default.join(runDir, "log", PROFIT_CSV));
+  if (text2 === null) {
     notes.push(`\u672A\u627E\u5230 log/${PROFIT_CSV}\u3002\u56DE\u6D4B\u672A\u8DD1\u5B8C\u3001\u88AB\u53D6\u6D88\uFF0C\u6216 codePath \u6307\u5411\u4E86\u522B\u7684\u76EE\u5F55\u65F6\u4F1A\u8FD9\u6837\uFF1B\u5148\u7528 mcp-get-backtest-state \u786E\u8BA4 status=5\u3002`);
     return { runDir, available: false, rows: 0, notes };
   }
-  const lines = text.split(/\r?\n/).filter((line) => line.trim().length > 0);
+  const lines = text2.split(/\r?\n/).filter((line) => line.trim().length > 0);
   const header = lines.length > 0 ? parseCsvLine(lines[0]).map((name) => name.trim()) : [];
   const indexByName = /* @__PURE__ */ new Map();
   header.forEach((name, index) => {
@@ -27592,8 +27895,8 @@ async function startMcpServer() {
   };
   const recordActiveDownload = (result) => {
     if (!runtimeLease) return;
-    const text = result.content?.map((item) => item.type === "text" ? item.text : "").join("\n") ?? "";
-    const match = text.match(/"uuid"\s*:\s*"([^"]+)"/);
+    const text2 = result.content?.map((item) => item.type === "text" ? item.text : "").join("\n") ?? "";
+    const match = text2.match(/"uuid"\s*:\s*"([^"]+)"/);
     if (!match) return;
     leaseStateUpdate = leaseStateUpdate.then(() => updateRuntimeLeaseActiveJob(runtimeLease, "runtime:explicit-start", false)).then(() => updateRuntimeLeaseActiveJob(runtimeLease, `download:${match[1]}`, true)).catch((error2) => {
       process.stderr.write(`[zlt-mcp-proxy] runtime download lease update failed: ${error2 instanceof Error ? error2.message : String(error2)}
@@ -27609,9 +27912,9 @@ async function startMcpServer() {
   };
   const clearCompletedDownload = (requestedId, result) => {
     if (!runtimeLease) return;
-    const text = result.content?.map((item) => item.type === "text" ? item.text : "").join("\n") ?? "";
-    if (!/"terminal"\s*:\s*true|TASK_STATUS_(?:DONE|FAILED|PAUSED|STOPPED|CANCELLED)/i.test(text)) return;
-    const uuid2 = text.match(/"uuid"\s*:\s*"([^"]+)"/)?.[1] ?? requestedId;
+    const text2 = result.content?.map((item) => item.type === "text" ? item.text : "").join("\n") ?? "";
+    if (!/"terminal"\s*:\s*true|TASK_STATUS_(?:DONE|FAILED|PAUSED|STOPPED|CANCELLED)/i.test(text2)) return;
+    const uuid2 = text2.match(/"uuid"\s*:\s*"([^"]+)"/)?.[1] ?? requestedId;
     if (!uuid2 || uuid2 === "0") return;
     leaseStateUpdate = leaseStateUpdate.then(() => updateRuntimeLeaseActiveJob(runtimeLease, `download:${uuid2}`, false)).catch((error2) => {
       process.stderr.write(`[zlt-mcp-proxy] runtime download lease cleanup failed: ${error2 instanceof Error ? error2.message : String(error2)}
@@ -27622,13 +27925,13 @@ async function startMcpServer() {
     let entry = clients.get(pipePath);
     const isInitialConnection = !entry;
     if (!entry) {
-      const client = new ZltafIpcClient();
-      client.onDisconnect = () => {
+      const client2 = new ZltafIpcClient();
+      client2.onDisconnect = () => {
         const action = reconnectEnabled ? "\u4E0B\u6B21\u8C03\u7528\u65F6\u5C06\u81EA\u52A8\u91CD\u8FDE" : "\u81EA\u52A8\u91CD\u8FDE\u5DF2\u7981\u7528";
         process.stderr.write(`[zlt-mcp-proxy] IPC \u670D\u52A1\u7AEF\u5DF2\u65AD\u5F00\u8FDE\u63A5 (${pipePath})\uFF0C${action}
 `);
       };
-      entry = { client, reconnecting: null };
+      entry = { client: client2, reconnecting: null };
       clients.set(pipePath, entry);
     }
     if (entry.client.isConnected()) return entry.client;
@@ -27727,10 +28030,10 @@ async function startMcpServer() {
         runRuntimeDoctor,
         async (workRoot, timeoutMs) => {
           const pipe2 = discoverInstallPipePath(workRoot, process.env.ZLT_PIPE_NAME?.trim() || config2.zltconfig.pipName);
-          const client = await ensureConnected(pipe2);
-          if (!client) throw new Error("cache readiness pipe unavailable");
+          const client2 = await ensureConnected(pipe2);
+          if (!client2) throw new Error("cache readiness pipe unavailable");
           return waitForCacheRead(async (probeTimeoutMs) => {
-            const response = await client.invoke("/zltaf_slave/forward_ipc/zltdcm/diskspace", {}, "{}", probeTimeoutMs);
+            const response = await client2.invoke("/zltaf_slave/forward_ipc/zltdcm/diskspace", {}, "{}", probeTimeoutMs);
             const parsed = parseIpcRawResponse(response);
             if (!parsed.isSuccess) throw new Error(parsed.errorText);
             return parsed.data;
@@ -27831,9 +28134,9 @@ async function startMcpServer() {
     if (shutdownPromise) return shutdownPromise;
     shutdownPromise = (async () => {
       process.stderr.write("[zlt-mcp-proxy] \u6B63\u5728\u5173\u95ED\uFF0C\u65AD\u5F00\u6240\u6709 IPC \u8FDE\u63A5...\n");
-      for (const { client } of clients.values()) {
+      for (const { client: client2 } of clients.values()) {
         try {
-          await client.disconnect();
+          await client2.disconnect();
         } catch {
         }
       }
@@ -28330,7 +28633,7 @@ async function prepareRuntimeForIpc(options) {
 function buildRuntimeFallbackRoots(configuredRoot) {
   const roots = [configuredRoot, getDefaultInstallPath()];
   if (process.platform === "win32") roots.push("C:\\ZLTClient", "D:\\ZLTClient");
-  return [...new Set(roots.map((root) => root.trim()).filter(Boolean))];
+  return [...new Set(roots.map((root2) => root2.trim()).filter(Boolean))];
 }
 function barePipeName(value) {
   const windowsPrefix = "\\\\.\\pipe\\";
@@ -28356,7 +28659,7 @@ function syncCredentialsFromEnvAtStartup() {
 function inspectDoctorAuth() {
   try {
     const auth = getAuthStatus();
-    const invalidFile = !auth.configured && fs16.existsSync(auth.credentialsPath);
+    const invalidFile = !auth.configured && fs17.existsSync(auth.credentialsPath);
     return {
       configured: auth.configured,
       status: auth.configured ? "configured" : invalidFile ? "invalid-config" : "missing",
@@ -28476,6 +28779,163 @@ function runtimeRecoveryStopData(message, extra = {}, handler = "runtimeStart")
   };
 }
 
+// src/auth-cli.ts
+var fs18 = __toESM(require("node:fs"), 1);
+var path17 = __toESM(require("node:path"), 1);
+var import_node_crypto4 = require("node:crypto");
+var SOURCE = "zlt-mcp-device-login";
+var client = {
+  start: () => startDeviceAuthorization(),
+  poll: (s, o) => pollDeviceAuthorization(s, o),
+  persist: (grant, env) => persistDeviceAuthorization(grant, env)
+};
+function escapeWidgetHtml(v) {
+  return v.replace(
+    /[&<>"']/g,
+    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
+  );
+}
+function buildShowWidgetPayload(s) {
+  if (!validSession(s)) throw new Error("Invalid authentication session");
+  return {
+    name: "show_widget",
+    arguments: {
+      title: "ZLT Quant sign in",
+      widget_code: `<section style="font: 14px/1.6 var(--font-sans, sans-serif); padding: 16px; border: 1px solid var(--color-border-secondary, #ddd); border-radius: 12px"><h2 style="font-size: 16px; margin: 0 0 12px">\u767B\u5F55\u667A\u91CF\u901A</h2><p>\u5728\u667A\u91CF\u901A\u7F51\u5173\u767B\u5F55\uFF0C\u5E76\u6838\u5BF9\u6B64\u8BBE\u5907\u7801\uFF1A</p><p style="font: 24px var(--font-mono, monospace); letter-spacing: 3px">${escapeWidgetHtml(s.userCode)}</p><p><a target="_blank" rel="noopener noreferrer" href="${escapeWidgetHtml(s.verificationUriComplete)}">\u6253\u5F00\u767B\u5F55\u9875\u9762</a></p><p style="font-size: 12px">${escapeWidgetHtml(s.verificationUri)} \xB7 \u8BBE\u5907\u7801 ${Math.ceil(s.expiresIn / 60)} \u5206\u949F\u5185\u6709\u6548\u3002\u767B\u5F55\u5B8C\u6210\u540E\u8BF7\u8FD4\u56DE\u6B64\u5BF9\u8BDD\u3002</p></section>`,
+      loading_messages: JSON.stringify(["\u51C6\u5907\u767B\u5F55\u5361\u7247"])
+    }
+  };
+}
+var root = (e = process.env) => path17.join(resolveZltQuantHome(e), "device-auth-sessions");
+function saveDeviceSession(s, e = process.env) {
+  if (!validSession(s)) throw new Error("Invalid authentication session");
+  const id = (0, import_node_crypto4.randomUUID)();
+  fs18.mkdirSync(root(e), { recursive: true, mode: 448 });
+  protectPrivatePath(root(e), true);
+  fs18.writeFileSync(
+    path17.join(root(e), id + ".json"),
+    JSON.stringify({ authorization: s, expiresAt: s.issuedAt + s.expiresIn * 1e3 }),
+    { mode: 384, flag: "wx" }
+  );
+  return id;
+}
+function load(id, e = process.env) {
+  sessionPath(id, e);
+  try {
+    if (fs18.lstatSync(root(e)).isSymbolicLink()) throw Error();
+    const file = sessionPath(id, e);
+    const stat = fs18.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 8192) throw Error();
+    const saved = JSON.parse(fs18.readFileSync(file, "utf8"));
+    if (!saved || typeof saved !== "object" || !("authorization" in saved) || !validSession(saved.authorization)) throw Error();
+    return { authorization: saved.authorization };
+  } catch {
+    drop(id, e);
+    throw Error("Authentication session is missing or invalid; start login again");
+  }
+}
+function authErrorMessage(error2) {
+  if (error2 instanceof DeviceAuthorizationError) return `Device login failed (${error2.code})`;
+  const safe = [
+    "Invalid authentication session",
+    "Authentication session is missing or invalid; start login again",
+    "Authentication session is unavailable or already being waited on",
+    "Authentication is already configured",
+    "Sign in completed but credential is not effective",
+    "Could not protect private authentication storage"
+  ];
+  if (error2 instanceof Error && safe.includes(error2.message)) return error2.message;
+  return "Authentication operation failed; check local credential configuration and storage permissions. No credential was returned.";
+}
+function sessionPath(id, e = process.env) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)) throw Error("Invalid authentication session");
+  return path17.join(root(e), id + ".json");
+}
+function drop(id, e = process.env) {
+  fs18.rmSync(sessionPath(id, e), { force: true });
+}
+function preflight(e) {
+  if (e.ZLTQUANT_CREDENTIALS || e.ZLTQUANT_API_KEY || readCredentials(e))
+    throw Error("Authentication is already configured");
+}
+async function finish(s, e, c, json) {
+  const grant = await c.poll(s, {
+    maxDurationMs: s.expiresIn * 1e3
+  });
+  const receipt = c.persist(grant, e);
+  if (receipt.status !== "success" || !receipt.authStatus.configured || receipt.authStatus.source !== "file")
+    throw Error("Sign in completed but credential is not effective");
+  const a = receipt.authStatus;
+  const o = {
+    status: "success",
+    configured: true,
+    source: a.source,
+    apiKeyMask: a.apiKeyMask,
+    apiBase: a.apiBase
+  };
+  process.stdout.write(json ? JSON.stringify(o) + "\n" : `Signed in (${a.apiKeyMask}).
+`);
+  return o;
+}
+async function runAuthLogin(o = {}) {
+  const e = o.env || process.env;
+  preflight(e);
+  const c = o.client || client, s = await c.start();
+  if (o.widget) {
+    const out = {
+      status: "pending",
+      session: saveDeviceSession(s, e),
+      verificationUri: s.verificationUri,
+      verificationUriComplete: s.verificationUriComplete,
+      userCode: s.userCode,
+      expiresIn: s.expiresIn,
+      widget: buildShowWidgetPayload(s)
+    };
+    process.stdout.write(JSON.stringify(out) + "\n");
+    return out;
+  }
+  process.stdout.write(
+    o.json ? JSON.stringify({
+      status: "pending",
+      verificationUri: s.verificationUri,
+      userCode: s.userCode
+    }) + "\n" : `Open ${s.verificationUri} and enter code ${s.userCode}.
+`
+  );
+  return finish(s, e, c, o.json);
+}
+async function runAuthWait(id, o = {}) {
+  const e = o.env || process.env;
+  preflight(e);
+  const lockPath = sessionPath(id, e) + ".lock";
+  let lock;
+  try {
+    lock = fs18.openSync(lockPath, "wx", 384);
+  } catch {
+    throw Error("Authentication session is unavailable or already being waited on");
+  }
+  try {
+    const x = load(id, e);
+    const result = await finish(x.authorization, e, o.client || client, o.json);
+    drop(id, e);
+    return result;
+  } catch (error2) {
+    if (error2 instanceof DeviceAuthorizationError && ["expired_token", "access_denied"].includes(error2.code)) drop(id, e);
+    throw error2;
+  } finally {
+    fs18.closeSync(lock);
+    fs18.rmSync(lockPath, { force: true });
+  }
+}
+var authStatus = (e = process.env) => getAuthStatus(e);
+function authLogout(e = process.env) {
+  if (e.ZLTQUANT_CREDENTIALS || e.ZLTQUANT_API_KEY)
+    return { removed: false, status: getAuthStatus(e) };
+  const c = readCredentials(e);
+  const removed = !!c && c.source === SOURCE && removeCredentials({ apiKey: c.apiKey, source: SOURCE }, e);
+  return { removed, status: getAuthStatus(e) };
+}
+
 // src/index.ts
 var CLI_NAME = "zlt-mcp";
 var CLI_FALLBACK_PACKAGE_NAME = "@zltquant/zlt-mcp";
@@ -28516,6 +28976,50 @@ if (process.argv.length <= 2) {
     }));
   });
   program2.name(CLI_NAME).description("MCP proxy for ZLTHost IPC service").version(resolveCliVersion()).configureOutput({ outputError: writeCliArgumentError }).addHelpText("after", "\nDiscovery: list for names; list --tool <name> --json for one complete input schema.\nUse call --help for input, output and diagnostic handling.\nFor npx registry selection, put --registry before the package name; it is not a zlt-mcp option.");
+  const auth = program2.command("auth").description("Manage local ZLT Quant authentication");
+  auth.command("login").description("Sign in with a device code").option("--json", "Emit a JSON descriptor and status").option("--widget", "Return a login card immediately; render it before running auth wait").addHelpText("after", "\nAgent flow: auth login --widget --json returns a local session ID and widget descriptor.\nInvoke the host show_widget tool with widget.arguments, or show the login URL/code.\nThen run auth wait --session <returned-id> --json. The descriptor alone does not render a widget.\nWithout --widget this command waits in the foreground. Never paste keys or private session files into chat.").action(async (options) => {
+    try {
+      await runAuthLogin(options);
+    } catch (error2) {
+      process.stderr.write(`Error: ${authErrorMessage(error2)}
+`);
+      process.exitCode = 1;
+    }
+  });
+  auth.command("status").description("Show masked local authentication status").option("--json", "Emit JSON").action((options) => {
+    try {
+      const status = authStatus();
+      process.stdout.write(options.json ? `${JSON.stringify(status)}
+` : `${status.configured ? `Configured (${status.apiKeyMask})` : "Not configured"}
+`);
+    } catch (error2) {
+      process.stderr.write(`Error: ${authErrorMessage(error2)}
+`);
+      process.exitCode = 1;
+    }
+  });
+  auth.command("wait").description("Complete a saved device-code sign in").requiredOption("--session <id>", "Opaque local session ID from auth login --widget").option("--json", "Emit JSON").action(async (options) => {
+    try {
+      await runAuthWait(options.session, options);
+    } catch (error2) {
+      process.stderr.write(`Error: ${authErrorMessage(error2)}
+`);
+      process.exitCode = 1;
+    }
+  });
+  auth.command("logout").description("Remove only CLI-login-owned credentials locally; does not revoke the gateway key").option("--json", "Emit JSON").action((options) => {
+    try {
+      const result = authLogout();
+      const output = { removed: result.removed, configured: result.status.configured, source: result.status.source, apiKeyMask: result.status.apiKeyMask };
+      process.stdout.write(options.json ? `${JSON.stringify(output)}
+` : `${result.removed ? "Signed out locally." : "No removable credentials found."}
+`);
+    } catch (error2) {
+      process.stderr.write(`Error: ${authErrorMessage(error2)}
+`);
+      process.exitCode = 1;
+    }
+  });
   program2.command("call <tool>").description("Call any MCP tool through the bundled MCP server").configureOutput({ outputError: writeCliArgumentError }).option("--args-json <json>", "JSON object containing tool arguments").option("--args-file <path>", "Read the JSON argument object from a file").option("--output-json <path>", "Save the complete result to a new JSON file and print a compact receipt").option("--evidence-dir <path>", "Create a new directory for the result, diagnostics and execution status").option("--verify-download", "For mcp-download-data: wait once and collect verification evidence").option("--timeout-ms <ms>", "MCP request inactivity timeout in milliseconds").option("--max-total-timeout-ms <ms>", "Optional hard upper bound for the call, including install/backtest wait").option("--no-progress", "Suppress progress diagnostics on stderr").addHelpText("after", COMMON_CALL_HELP).action(async (tool, options) => {
     let outputFd;
     let stage = "arguments";
@@ -28529,9 +29033,9 @@ if (process.argv.length <= 2) {
       const args = parseMcpArgs(options.argsJson, options.argsFile);
       const timeoutMs = parseTimeoutOption(options.timeoutMs, "--timeout-ms");
       const maxTotalTimeoutMs = parseTimeoutOption(options.maxTotalTimeoutMs, "--max-total-timeout-ms");
-      const resultFile = evidence?.resultFile ?? (options.outputJson === void 0 ? void 0 : path17.resolve(options.outputJson));
+      const resultFile = evidence?.resultFile ?? (options.outputJson === void 0 ? void 0 : path18.resolve(options.outputJson));
       stage = "output_prepare";
-      if (resultFile !== void 0) outputFd = fs17.openSync(resultFile, "wx");
+      if (resultFile !== void 0) outputFd = fs19.openSync(resultFile, "wx");
       stage = "tool_call";
       evidence?.started(tool);
       toolExecution = "unknown";
@@ -28551,10 +29055,10 @@ if (process.argv.length <= 2) {
       if (outputFd !== void 0 && resultFile !== void 0) {
         stage = "output_write";
         try {
-          fs17.writeFileSync(outputFd, serialized, "utf-8");
+          fs19.writeFileSync(outputFd, serialized, "utf-8");
           const fd = outputFd;
           outputFd = void 0;
-          fs17.closeSync(fd);
+          fs19.closeSync(fd);
         } catch (error2) {
           process.stdout.write(serialized);
           throw new Error(`Tool returned a result, but saving ${resultFile} failed; complete result is on stdout. Do not repeat the tool automatically. ${String(error2)}`);
@@ -28597,7 +29101,7 @@ if (process.argv.length <= 2) {
         const fd = outputFd;
         outputFd = void 0;
         try {
-          fs17.closeSync(fd);
+          fs19.closeSync(fd);
         } catch (error2) {
           process.exitCode = 1;
           process.stderr.write(`Error: result file close failed; toolExecution=${toolExecution}; ${String(error2)}
@@ -28628,7 +29132,7 @@ if (process.argv.length <= 2) {
         const complete = withCliProvenance(result);
         const serialized = JSON.stringify(complete) + "\n";
         try {
-          fs17.writeFileSync(evidence.resultFile, serialized, { encoding: "utf8", flag: "wx" });
+          fs19.writeFileSync(evidence.resultFile, serialized, { encoding: "utf8", flag: "wx" });
           evidence.completed("not_reported", 0);
         } catch (error2) {
           process.stdout.write(serialized);
@@ -28756,17 +29260,17 @@ function resolveCliVersion() {
   return resolveCliPackageProvenance().packageVersion;
 }
 function resolveCliPackageProvenance() {
-  let current = path17.dirname(path17.resolve(process.argv[1] || process.cwd()));
+  let current = path18.dirname(path18.resolve(process.argv[1] || process.cwd()));
   for (let depth = 0; depth < 6; depth += 1) {
-    const manifestPath = path17.join(current, "package.json");
+    const manifestPath = path18.join(current, "package.json");
     try {
-      const manifest = JSON.parse(fs17.readFileSync(manifestPath, "utf-8"));
+      const manifest = JSON.parse(fs19.readFileSync(manifestPath, "utf-8"));
       if ((manifest.name === "@zltquant/zlt-mcp" || manifest.name === "zlt-mcp-proxy") && typeof manifest.version === "string") {
         return { packageName: manifest.name, packageVersion: manifest.version };
       }
     } catch {
     }
-    const parent = path17.dirname(current);
+    const parent = path18.dirname(current);
     if (parent === current) break;
     current = parent;
   }