@zltquant/zlt-mcp 0.7.3 → 0.7.4

package/zlt-mcp-proxy.bundle.cjs

@@ -1147,7 +1147,7 @@ var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@13.1.0/node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path27 = require("node:path");
+    var path28 = require("node:path");
     var fs28 = require("node:fs");
     var process4 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
@@ -2147,9 +2147,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path27.resolve(baseDir, baseName);
+          const localBin = path28.resolve(baseDir, baseName);
           if (fs28.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path27.extname(baseName))) return void 0;
+          if (sourceExt.includes(path28.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
             (ext) => fs28.existsSync(`${localBin}${ext}`)
           );
@@ -2167,17 +2167,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path27.resolve(
-            path27.dirname(resolvedScriptPath),
+          executableDir = path28.resolve(
+            path28.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path27.basename(
+            const legacyName = path28.basename(
               this._scriptPath,
-              path27.extname(this._scriptPath)
+              path28.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2188,7 +2188,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path27.extname(executableFile));
+        launchWithNode = sourceExt.includes(path28.extname(executableFile));
         let proc;
         if (process4.platform !== "win32") {
           if (launchWithNode) {
@@ -3035,7 +3035,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path27.basename(filename, path27.extname(filename));
+        this._name = path28.basename(filename, path28.extname(filename));
         return this;
       }
       /**
@@ -3049,9 +3049,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path28) {
-        if (path28 === void 0) return this._executableDir;
-        this._executableDir = path28;
+      executableDir(path29) {
+        if (path29 === void 0) return this._executableDir;
+        this._executableDir = path29;
         return this;
       }
       /**
@@ -6516,8 +6516,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path27) {
-      let input = path27;
+    function removeDotSegments(path28) {
+      let input = path28;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -6716,8 +6716,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path27, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path27 && path27 !== "/" ? path27 : void 0;
+        const [path28, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path28 && path28 !== "/" ? path28 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -10098,7 +10098,7 @@ var require_windows = __commonJS({
     module2.exports = isexe;
     isexe.sync = sync;
     var fs28 = require("fs");
-    function checkPathExt(path27, options) {
+    function checkPathExt(path28, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -10109,25 +10109,25 @@ var require_windows = __commonJS({
       }
       for (var i = 0; i < pathext.length; i++) {
         var p = pathext[i].toLowerCase();
-        if (p && path27.substr(-p.length).toLowerCase() === p) {
+        if (p && path28.substr(-p.length).toLowerCase() === p) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path27, options) {
+    function checkStat(stat, path28, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path27, options);
+      return checkPathExt(path28, options);
     }
-    function isexe(path27, options, cb) {
-      fs28.stat(path27, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path27, options));
+    function isexe(path28, options, cb) {
+      fs28.stat(path28, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path28, options));
       });
     }
-    function sync(path27, options) {
-      return checkStat(fs28.statSync(path27), path27, options);
+    function sync(path28, options) {
+      return checkStat(fs28.statSync(path28), path28, options);
     }
   }
 });
@@ -10138,13 +10138,13 @@ var require_mode = __commonJS({
     module2.exports = isexe;
     isexe.sync = sync;
     var fs28 = require("fs");
-    function isexe(path27, options, cb) {
-      fs28.stat(path27, function(er, stat) {
+    function isexe(path28, options, cb) {
+      fs28.stat(path28, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
-    function sync(path27, options) {
-      return checkStat(fs28.statSync(path27), options);
+    function sync(path28, options) {
+      return checkStat(fs28.statSync(path28), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -10177,7 +10177,7 @@ var require_isexe = __commonJS({
     }
     module2.exports = isexe;
     isexe.sync = sync;
-    function isexe(path27, options, cb) {
+    function isexe(path28, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -10187,7 +10187,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve12, reject) {
-          isexe(path27, options || {}, function(er, is) {
+          isexe(path28, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
@@ -10196,7 +10196,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core(path27, options || {}, function(er, is) {
+      core(path28, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -10206,9 +10206,9 @@ var require_isexe = __commonJS({
         cb(er, is);
       });
     }
-    function sync(path27, options) {
+    function sync(path28, options) {
       try {
-        return core.sync(path27, options || {});
+        return core.sync(path28, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -10224,7 +10224,7 @@ var require_isexe = __commonJS({
 var require_which = __commonJS({
   "../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js"(exports2, module2) {
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path27 = require("path");
+    var path28 = require("path");
     var COLON = isWindows ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -10262,7 +10262,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve12(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path27.join(pathPart, cmd);
+        const pCmd = path28.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve12(subStep(p, i, 0));
       });
@@ -10289,7 +10289,7 @@ var require_which = __commonJS({
       for (let i = 0; i < pathEnv.length; i++) {
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path27.join(pathPart, cmd);
+        const pCmd = path28.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j = 0; j < pathExt.length; j++) {
           const cur = p + pathExt[j];
@@ -10337,7 +10337,7 @@ var require_path_key = __commonJS({
 var require_resolveCommand = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js"(exports2, module2) {
     "use strict";
-    var path27 = require("path");
+    var path28 = require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -10355,7 +10355,7 @@ var require_resolveCommand = __commonJS({
       try {
         resolved = which.sync(parsed.command, {
           path: env[getPathKey({ env })],
-          pathExt: withoutPathExt ? path27.delimiter : void 0
+          pathExt: withoutPathExt ? path28.delimiter : void 0
         });
       } catch (e) {
       } finally {
@@ -10364,7 +10364,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path27.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path28.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -10418,8 +10418,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path27, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary = path27.split("/").pop();
+      const [path28, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path28.split("/").pop();
       if (binary === "env") {
         return argument;
       }
@@ -10454,7 +10454,7 @@ var require_readShebang = __commonJS({
 var require_parse = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js"(exports2, module2) {
     "use strict";
-    var path27 = require("path");
+    var path28 = require("path");
     var resolveCommand = require_resolveCommand();
     var escape2 = require_escape();
     var readShebang = require_readShebang();
@@ -10479,7 +10479,7 @@ var require_parse = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path27.normalize(parsed.command);
+        parsed.command = path28.normalize(parsed.command);
         parsed.command = escape2.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape2.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -10801,10 +10801,20 @@ var COMMON_CALL_HELP = `
 Input: omitted arguments mean {}; use --args-json for a JSON object or --args-file
 for nested or shell-sensitive input. Read the current schema with
 list --tool <name> --json; schema properties are JSON keys, not CLI flags.
-Output: stdout contains the complete MCP JSON envelope by default. --output-json
-saves that envelope to a new file and prints a compact receipt. --evidence-dir
-saves an execution record in a new directory; it cannot be combined with
---output-json. Preserve stderr and the CLI exit code before parsing business data.
+Output: stdout carries the MCP JSON response by default. Its underlying
+business data may be large; size and completeness are controlled
+by the selected tool rather than this CLI.
+--output-json saves the complete envelope to a new file and prints a compact
+receipt. --evidence-dir saves an execution record in a new directory; it
+cannot be combined with --output-json. Preserve stderr and the CLI exit code
+before parsing business data. The complete result.json is evidence, not the
+default conversational payload.
+For more detail or smaller model context, use only schema-exposed
+reportSections, offset/limit, page/pageSize, or fields, selecting the smallest
+set needed for the next decision. Do not invent parameter names. includeReport,
+when exposed, may be large and is not promised to truncate. result.json saves
+the complete CLI response for the selected request; it cannot restore omitted
+business data. The detail contract does not change public CLI flags.
 For mcp-download-data, --verify-download submits once on one MCP connection,
 waits for that uuid, and only after a verifiable DONE collects range, disk-space,
 and bounded physical-file evidence. Files never prove continuous coverage.
@@ -10860,28 +10870,28 @@ var UNSUPPORTED_SCHEMA_KEYWORDS = [
   "propertyNames",
   "unevaluatedProperties"
 ];
-function unsupportedSchemaConstraint(schemaValue, path27 = "inputSchema") {
+function unsupportedSchemaConstraint(schemaValue, path28 = "inputSchema") {
   const schema = record(schemaValue);
-  if (!schema) return path27;
+  if (!schema) return path28;
   for (const keyword of UNSUPPORTED_SCHEMA_KEYWORDS) {
-    if (Object.prototype.hasOwnProperty.call(schema, keyword)) return `${path27}.${keyword}`;
+    if (Object.prototype.hasOwnProperty.call(schema, keyword)) return `${path28}.${keyword}`;
   }
   const properties = record(schema.properties);
   if (properties) {
     for (const [name, property] of Object.entries(properties)) {
-      const unsupported = unsupportedSchemaConstraint(property, `${path27}.properties.${name}`);
+      const unsupported = unsupportedSchemaConstraint(property, `${path28}.properties.${name}`);
       if (unsupported) return unsupported;
     }
   }
   if (schema.items !== void 0) {
-    const unsupported = unsupportedSchemaConstraint(schema.items, `${path27}.items`);
+    const unsupported = unsupportedSchemaConstraint(schema.items, `${path28}.items`);
     if (unsupported) return unsupported;
   }
   return void 0;
 }
-function explicitValue(schemaValue, path27) {
+function explicitValue(schemaValue, path28) {
   const schema = record(schemaValue);
-  if (!schema) return { available: false, missing: [path27] };
+  if (!schema) return { available: false, missing: [path28] };
   if (Object.prototype.hasOwnProperty.call(schema, "example")) {
     return { available: true, value: cloneValue(schema.example), missing: [] };
   }
@@ -10903,13 +10913,13 @@ function explicitValue(schemaValue, path27) {
     const value = {};
     const missing = [];
     for (const name of required2) {
-      const child = explicitValue(properties[name], path27 ? `${path27}.${name}` : name);
+      const child = explicitValue(properties[name], path28 ? `${path28}.${name}` : name);
       if (child.available) value[name] = child.value;
       missing.push(...child.missing);
     }
     return { available: missing.length === 0, value, missing };
   }
-  return { available: false, missing: [path27] };
+  return { available: false, missing: [path28] };
 }
 function buildArgumentExample(tool) {
   const schema = record(tool.inputSchema);
@@ -10975,7 +10985,11 @@ function buildCliUsage(tool, tools) {
       example: buildArgumentExample(tool)
     },
     output: {
-      default: "Read the complete MCP JSON envelope from stdout and preserve stderr and the CLI exit code.",
+      default: "Read the MCP JSON envelope from stdout and preserve stderr and the CLI exit code. The selected tool may return a large business payload; use schema-exposed reportSections, offset/limit, page/pageSize, or fields to select detail for routine model context.",
+      detail: {
+        contract: "Follow the selected tool schema and do not invent parameter names. includeReport may be large; it is not a promise of truncation or a substitute for explicit selection where the schema provides it.",
+        completeEvidence: "result.json in evidence mode is the complete CLI response for the selected request, page, and fields; it cannot recover underlying business data omitted by that request."
+      },
       outputJson: {
         option: "--output-json <new-file>",
         result: "The complete envelope is saved; stdout is a compact receipt."
@@ -11007,11 +11021,11 @@ function buildCliUsage(tool, tools) {
 
 // src/index.ts
 var fs27 = __toESM(require("node:fs"), 1);
-var path26 = __toESM(require("node:path"), 1);
+var path27 = __toESM(require("node:path"), 1);
 
 // src/cli.ts
 var fs15 = __toESM(require("fs"), 1);
-var path14 = __toESM(require("path"), 1);
+var path15 = __toESM(require("path"), 1);
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({
@@ -11208,10 +11222,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path27) {
-  if (!path27)
+function getElementAtPath(obj, path28) {
+  if (!path28)
     return obj;
-  return path27.reduce((acc, key) => acc?.[key], obj);
+  return path28.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11531,11 +11545,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path27, issues) {
+function prefixIssues(path28, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path27);
+    iss.path.unshift(path28);
     return iss;
   });
 }
@@ -18322,6 +18336,7 @@ var OFFICIAL_INSTALLERS = {
     full: {
       artifact: "zlt_client",
       version: "v1.14.2",
+      installedVersion: "2026.09.11.4",
       sha256: "B65F39EAE5F37545D79F1149C3DC436B5ED9E1BEC8F21893FB91BD5A09081B0F"
     },
     // 2026-08-15 抬到 2026.08.14.5：公网 OSS 与内网镜像是同一份字节（ETag 113b3cff…、
@@ -18338,9 +18353,11 @@ var OFFICIAL_INSTALLERS = {
     // VSCODE_INSTALL_TYPE），full 槽位只在已装 full 的机器上参与升级判定。
     // **本版没有装机验证**：本机停在 2026.08.28.7，08-30 对 .7 做的那轮活体复核
     // （三进程起得来、ZLTHQHost 管道在、两轮 check:npm-live 全绿）不适用于本版。
+    // Exact pinned bytes report FileVersion 2026.09.11.5; post-install InstallInfo.xml acceptance is pending.
     mini: {
       artifact: "zlt_plugin",
       version: "v1.14.2",
+      installedVersion: "2026.09.11.5",
       sha256: "4E96214F0DDA6A6560D5C820D6BC230466BFF06095336C5250A90C44B4A52BB6"
     }
   },
@@ -18349,11 +18366,13 @@ var OFFICIAL_INSTALLERS = {
     full: {
       artifact: "zlt_client",
       version: "v1.14.2",
+      installedVersion: "2026.09.11.4",
       sha256: "B65F39EAE5F37545D79F1149C3DC436B5ED9E1BEC8F21893FB91BD5A09081B0F"
     },
     mini: {
       artifact: "zlt_plugin",
       version: "v1.14.2",
+      installedVersion: "2026.09.11.5",
       sha256: "4E96214F0DDA6A6560D5C820D6BC230466BFF06095336C5250A90C44B4A52BB6"
     }
   }
@@ -18365,6 +18384,10 @@ function officialInstallerUrl(slot, mirror = "public") {
   const spec = OFFICIAL_INSTALLERS[mirror][slot];
   return `${OFFICIAL_MIRROR_ROOTS[mirror]}/pkg/${spec.artifact}_${spec.version}.exe`;
 }
+function officialInstallerVersionIndexUrl(slot, mirror = "public") {
+  const name = slot === "full" ? "zlt_client_versions.json" : "zlt_plugin_versions.json";
+  return `${OFFICIAL_MIRROR_ROOTS[mirror]}/pkg/${name}`;
+}
 function officialVersionIndexUrl(mirror = "public") {
   return `${OFFICIAL_MIRROR_ROOTS[mirror]}/VscodeMarketPlugin/zlt_quant_version_index.json`;
 }
@@ -18420,8 +18443,8 @@ var defaultAssistantRuntimeConfig = {
   // OFFICIAL_INSTALLERS，结构上不可能只改 URL 不改这里。
   backserviceDownloadVersion: {
     OFFICIAL: {
-      full: OFFICIAL_INSTALLERS.public.full.version,
-      mini: OFFICIAL_INSTALLERS.public.mini.version
+      full: OFFICIAL_INSTALLERS.public.full.installedVersion,
+      mini: OFFICIAL_INSTALLERS.public.mini.installedVersion
     },
     REL: { full: "", mini: "" },
     DEBUG: {
@@ -18678,7 +18701,7 @@ function applyInstallerMirror(config2, mirror) {
     },
     backserviceDownloadVersion: {
       ...config2.backserviceDownloadVersion,
-      OFFICIAL: { full: pins.full.version, mini: pins.mini.version }
+      OFFICIAL: { full: pins.full.installedVersion, mini: pins.mini.installedVersion }
     }
   };
 }
@@ -18940,7 +18963,7 @@ function pipeExists(clientRootDir, explicitPipeName) {
 // ../zlt-runtime-core/dist/runtime.js
 var fs7 = __toESM(require("fs"), 1);
 var os2 = __toESM(require("os"), 1);
-var path7 = __toESM(require("path"), 1);
+var path8 = __toESM(require("path"), 1);
 var import_child_process4 = require("child_process");
 
 // ../zlt-runtime-core/dist/assistant-ipc.js
@@ -19648,8 +19671,8 @@ async function waitForPipe(workRoot, pipePrefix, timeout) {
 }
 async function readZltContent(workRoot, temporaryZltFile) {
   const fs28 = await import("fs");
-  const path27 = await import("path");
-  const zltFile = path27.join(workRoot, temporaryZltFile || "Temporary/zlt");
+  const path28 = await import("path");
+  const zltFile = path28.join(workRoot, temporaryZltFile || "Temporary/zlt");
   return fs28.existsSync(zltFile) ? fs28.readFileSync(zltFile, "utf-8").trim() : "";
 }
 async function pipeExists2(pipeName) {
@@ -19986,6 +20009,7 @@ function inspectRuntimeProcess(pid) {
     "if ($p) { [pscustomobject]@{ pid=[int]$p.ProcessId; executablePath=[string]$p.ExecutablePath; creationTime=$p.CreationDate.ToUniversalTime().ToString('o') } | ConvertTo-Json -Compress }"
   ].join("; ");
   const result = (0, import_child_process2.spawnSync)(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", command], {
+    stdio: ["ignore", "pipe", "pipe"],
     encoding: "utf8",
     env: { ...process.env, ZLT_RUNTIME_PID: String(pid) },
     timeout: 1e4,
@@ -20020,6 +20044,7 @@ var defaultRuntimeLifecycleDeps = {
       "Stop-Process -Id $p.ProcessId -Force -ErrorAction Stop"
     ].join("; ");
     const result = (0, import_child_process2.spawnSync)(powershell, ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", command], {
+      stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8",
       env: {
         ...process.env,
@@ -20249,13 +20274,130 @@ function writeJson(filePath, value) {
 
 // ../zlt-runtime-core/dist/assistant-base-upgrade.js
 var fs5 = __toESM(require("fs"), 1);
-var path5 = __toESM(require("path"), 1);
+var path6 = __toESM(require("path"), 1);
 
 // ../zlt-runtime-core/dist/version-gates.js
 function versionGatesDisabled() {
   return ""?.trim() === "1";
 }
 
+// ../zlt-runtime-core/dist/assistant-installer-descriptor.js
+var path5 = __toESM(require("path"), 1);
+async function resolveAssistantInstallerDescriptor(config2, installType, options = {}) {
+  const normalized = normalizeAssistantInstallType(installType);
+  const fallback = resolvePinnedAssistantInstallerDescriptor(config2, normalized);
+  const mirror = matchingOfficialMirror(config2, normalized);
+  if (!mirror)
+    return fallback;
+  const indexUrl = officialInstallerVersionIndexUrl(normalized, mirror);
+  const fetchImpl = options.fetchImpl ?? ((url, init) => fetch(url, init));
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), config2.baseRequirementTimeout);
+  try {
+    const response = await fetchImpl(indexUrl, { signal: controller.signal });
+    if (!response.ok)
+      return { ...fallback, fallbackReason: `\u5B89\u88C5\u5305\u7248\u672C\u5217\u8868\u8BF7\u6C42\u5931\u8D25: HTTP ${response.status}` };
+    const body = await response.json();
+    if (!Array.isArray(body))
+      return { ...fallback, fallbackReason: "\u5B89\u88C5\u5305\u7248\u672C\u5217\u8868\u4E0D\u662F JSON \u6570\u7EC4" };
+    const records = body.filter((item) => Boolean(item) && typeof item === "object" && !Array.isArray(item)).flatMap((record5) => {
+      const version2 = normalizeStableProductVersion(record5.version);
+      return version2 ? [{ record: record5, version: version2 }] : [];
+    }).sort((left, right) => compareNumericVersion(right.version, left.version));
+    if (records.length === 0)
+      return { ...fallback, fallbackReason: "\u5B89\u88C5\u5305\u7248\u672C\u5217\u8868\u6CA1\u6709\u7A33\u5B9A\u8BED\u4E49\u7248\u672C" };
+    const latest = records[0];
+    const latestRecords = records.filter((item) => item.version === latest.version);
+    if (latestRecords.some((item) => JSON.stringify(item.record) !== JSON.stringify(latest.record))) {
+      return { ...fallback, fallbackReason: `\u6700\u65B0\u5B89\u88C5\u5305\u7248\u672C ${latest.version} \u5B58\u5728\u91CD\u590D\u8BB0\u5F55` };
+    }
+    const validated = validateLatestRecord(latest.record, normalized);
+    if (typeof validated === "string")
+      return { ...fallback, fallbackReason: `\u6700\u65B0\u5B89\u88C5\u5305\u8BB0\u5F55\u65E0\u6548: ${validated}` };
+    if (compareNumericVersion(validated.internalVersion, fallback.internalVersion) < 0) {
+      return { ...fallback, fallbackReason: "\u6700\u65B0\u5B89\u88C5\u5305 internalVersion \u4F4E\u4E8E\u5185\u7F6E fallback" };
+    }
+    return {
+      source: "dynamic",
+      installType: normalized,
+      url: new URL(validated.fileName, `${indexUrl.slice(0, indexUrl.lastIndexOf("/") + 1)}`).toString(),
+      productVersion: latest.version,
+      internalVersion: validated.internalVersion,
+      fileName: validated.fileName,
+      fileSize: validated.fileSize
+    };
+  } catch (error2) {
+    return {
+      ...fallback,
+      fallbackReason: `\u5B89\u88C5\u5305\u7248\u672C\u5217\u8868\u4E0D\u53EF\u7528: ${error2 instanceof Error ? error2.message : String(error2)}`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function resolvePinnedAssistantInstallerDescriptor(config2, installType) {
+  const normalized = normalizeAssistantInstallType(installType);
+  const url = config2.backserviceDownload[config2.envMode][normalized]?.trim() || "";
+  return {
+    source: "pinned",
+    installType: normalized,
+    url,
+    productVersion: path5.basename(safeUrlPath(url)).replace(/^zlt_(?:client|plugin)_/i, "").replace(/\.exe$/i, ""),
+    internalVersion: config2.backserviceDownloadVersion[config2.envMode][normalized]?.trim() || "",
+    fileName: path5.basename(safeUrlPath(url)) || "zlt-runtime-installer.exe",
+    sha256: config2.backserviceDownloadSha256[config2.envMode][normalized]?.trim() || void 0
+  };
+}
+function matchingOfficialMirror(config2, installType) {
+  if (config2.envMode !== "OFFICIAL")
+    return null;
+  for (const mirror of ["public", "internal"]) {
+    const pin = OFFICIAL_INSTALLERS[mirror][installType];
+    if (config2.backserviceDownload.OFFICIAL[installType] === officialInstallerUrl(installType, mirror) && config2.backserviceDownloadVersion.OFFICIAL[installType] === pin.installedVersion && config2.backserviceDownloadSha256.OFFICIAL[installType].toUpperCase() === pin.sha256)
+      return mirror;
+  }
+  return null;
+}
+function validateLatestRecord(record5, installType) {
+  const internalVersion = typeof record5.internalVersion === "string" ? record5.internalVersion.trim() : "";
+  if (!/^\d+(?:\.\d+)+$/.test(internalVersion) || internalVersion.split(".").some((part) => !Number.isSafeInteger(Number(part)))) {
+    return "internalVersion \u7F3A\u5931\u6216\u4E0D\u662F\u5B89\u5168\u7684\u6570\u5B57\u70B9\u5206\u7248\u672C";
+  }
+  const fileName = typeof record5.fileName === "string" ? record5.fileName.trim() : "";
+  if (!fileName || path5.basename(fileName) !== fileName || !/^[A-Za-z0-9._-]+\.exe$/i.test(fileName)) {
+    return "fileName \u5FC5\u987B\u662F\u7EAF\u6587\u4EF6\u540D";
+  }
+  const prefix = installType === "full" ? "zlt_client_" : "zlt_plugin_";
+  if (!fileName.toLowerCase().startsWith(prefix) || !fileName.toLowerCase().endsWith(".exe")) {
+    return `fileName \u5FC5\u987B\u5339\u914D ${prefix}*.exe`;
+  }
+  const fileSize = Number.isSafeInteger(record5.fileSize) && Number(record5.fileSize) > 0 ? Number(record5.fileSize) : void 0;
+  return { internalVersion, fileName, fileSize };
+}
+function normalizeStableProductVersion(value) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = value.trim().replace(/^v/i, "");
+  return /^\d+\.\d+\.\d+$/.test(normalized) && normalized.split(".").every((part) => Number.isSafeInteger(Number(part))) ? normalized : null;
+}
+function compareNumericVersion(left, right) {
+  const leftParts = left.split(".").map(Number);
+  const rightParts = right.split(".").map(Number);
+  for (let index = 0; index < Math.max(leftParts.length, rightParts.length); index++) {
+    const delta = (leftParts[index] || 0) - (rightParts[index] || 0);
+    if (delta !== 0)
+      return delta < 0 ? -1 : 1;
+  }
+  return 0;
+}
+function safeUrlPath(url) {
+  try {
+    return new URL(url).pathname;
+  } catch {
+    return url;
+  }
+}
+
 // ../zlt-runtime-core/dist/assistant-base-upgrade.js
 var INSTALL_INFO_FILE = "InstallInfo.xml";
 var REQUIREMENT_CACHE_TTL_MS = 5 * 6e4;
@@ -20263,7 +20405,7 @@ var requirementCache = /* @__PURE__ */ new Map();
 var requirementInFlight = /* @__PURE__ */ new Map();
 function readInstalledAssistantBaseVersion(workRoot) {
   try {
-    const content = fs5.readFileSync(path5.join(workRoot, INSTALL_INFO_FILE), "utf-8");
+    const content = fs5.readFileSync(path6.join(workRoot, INSTALL_INFO_FILE), "utf-8");
     const matched = content.match(/<InstallAppReleaseVer>(.*?)<\/InstallAppReleaseVer>/i);
     const version2 = matched?.[1]?.trim();
     return version2 ? version2 : null;
@@ -20272,8 +20414,8 @@ function readInstalledAssistantBaseVersion(workRoot) {
   }
 }
 function compareAssistantVersions(left, right) {
-  const leftParts = left.split(".");
-  const rightParts = right.split(".");
+  const leftParts = left.trim().replace(/^v(?=\d)/i, "").split(".");
+  const rightParts = right.trim().replace(/^v(?=\d)/i, "").split(".");
   const length = Math.max(leftParts.length, rightParts.length);
   for (let index = 0; index < length; index++) {
     const leftPart = parseVersionPart(leftParts[index]);
@@ -20314,7 +20456,9 @@ async function fetchRemoteBaseRequirement(config2, installType, options = {}) {
   return attempt;
 }
 async function checkAssistantBaseUpgrade(workRoot, config2, installType, options = {}) {
-  const pinnedVersion = resolveAssistantDownloadVersion(config2, installType);
+  const normalizedInstallType = normalizeAssistantInstallType(installType);
+  let installer = resolvePinnedAssistantInstallerDescriptor(config2, normalizedInstallType);
+  let pinnedVersion = installer.internalVersion || resolveAssistantDownloadVersion(config2, installType);
   if (versionGatesDisabled()) {
     return {
       updateAvailable: false,
@@ -20324,10 +20468,16 @@ async function checkAssistantBaseUpgrade(workRoot, config2, installType, options
       pinnedVersion,
       remoteMin: null,
       blockedByPlugin: false,
-      installType: normalizeAssistantInstallType(installType),
+      installType: normalizedInstallType,
+      installer,
+      installerFallbackReason: installer.fallbackReason,
       reason: "\u5185\u6D4B\u6784\u5EFA\u5DF2\u5173\u95ED\u667A\u80FD\u7BA1\u5BB6\u7248\u672C\u6821\u9A8C\uFF08ZLT_DISABLE_VERSION_GATES=1\uFF09\uFF0C\u8DF3\u8FC7\u672C\u4F53\u5347\u7EA7\u5224\u5B9A"
     };
   }
+  installer = await resolveAssistantInstallerDescriptor(config2, normalizedInstallType, {
+    fetchImpl: options.installerFetchImpl
+  });
+  pinnedVersion = installer.internalVersion || pinnedVersion;
   const requirement = await fetchRemoteBaseRequirement(config2, installType, options);
   const remoteMin = requirement?.min?.trim() || null;
   const installed = readInstalledAssistantBaseVersion(workRoot);
@@ -20342,7 +20492,9 @@ async function checkAssistantBaseUpgrade(workRoot, config2, installType, options
     remoteMin,
     // 远程要求高于我们钉住的安装包：装我们这份也满足不了，必须升级插件本身。
     blockedByPlugin: Boolean(remoteMin) && Boolean(pinnedVersion) && compareAssistantVersions(remoteMin, pinnedVersion) > 0,
-    installType: normalizeAssistantInstallType(installType)
+    installType: normalizedInstallType,
+    installer,
+    installerFallbackReason: installer.fallbackReason
   };
   if (!installed) {
     return { ...verdict, reason: `\u672A\u80FD\u4ECE ${INSTALL_INFO_FILE} \u8BFB\u53D6\u667A\u80FD\u7BA1\u5BB6\u672C\u4F53\u7248\u672C\uFF0C\u8DF3\u8FC7\u672C\u4F53\u5347\u7EA7\u5224\u5B9A` };
@@ -20400,7 +20552,7 @@ function parseVersionPart(part) {
 // ../zlt-runtime-core/dist/runtime-install.js
 var fs6 = __toESM(require("fs"), 1);
 var os = __toESM(require("os"), 1);
-var path6 = __toESM(require("path"), 1);
+var path7 = __toESM(require("path"), 1);
 var http = __toESM(require("http"), 1);
 var https = __toESM(require("https"), 1);
 var import_crypto3 = require("crypto");
@@ -20408,7 +20560,7 @@ var import_child_process3 = require("child_process");
 var MANAGED_PROCESS_EXIT_TIMEOUT_MS = 5e3;
 var MANAGED_PROCESS_EXIT_INTERVAL_MS = 200;
 var MANAGED_PROCESS_RESPAWN_RETRY_ROUNDS = 3;
-var ASSISTANT_UPGRADE_FINISH_LOCK = path6.join("Temporary", "upgradeFinsh.lock");
+var ASSISTANT_UPGRADE_FINISH_LOCK = path7.join("Temporary", "upgradeFinsh.lock");
 async function installRuntimeTransaction(host, options) {
   if (!options.installerPath && options.installModules === false) {
     const baseRoot = options.installDir || await host.readRegistryInstallLocationRaw(options.config);
@@ -20436,10 +20588,11 @@ async function installRuntimeTransaction(host, options) {
     }
   }
   const installDir = options.installDir || host.getDefaultInstallPath();
-  const installerPath = options.installerPath || await downloadRuntimeInstaller(options.config, options.onProgress, options.installType || "full");
+  const selectedInstaller = options.installerPath ? void 0 : options.installerDescriptor ?? await resolveAssistantInstallerDescriptor(options.config, options.installType || "full");
+  const installerPath = options.installerPath || await downloadRuntimeInstaller(options.config, options.onProgress, options.installType || "full", selectedInstaller);
   fs6.mkdirSync(installDir, { recursive: true });
-  const installerLogPath = path6.join(installDir, "Temporary", "logs", "install.log");
-  fs6.mkdirSync(path6.dirname(installerLogPath), { recursive: true });
+  const installerLogPath = path7.join(installDir, "Temporary", "logs", "install.log");
+  fs6.mkdirSync(path7.dirname(installerLogPath), { recursive: true });
   options.onProgress?.(`\u6267\u884C\u5B89\u88C5\u7A0B\u5E8F: ${installerPath}`);
   const exitCode = await executeInstallerProcess(installerPath, installDir, installerLogPath);
   options.onProgress?.(`\u5B89\u88C5\u8FDB\u7A0B\u9000\u51FA\u7801: ${exitCode}`);
@@ -20454,6 +20607,12 @@ async function installRuntimeTransaction(host, options) {
     options.onProgress?.(`\u5B89\u88C5\u7A0B\u5E8F\u9000\u51FA\u7801\u975E 0\uFF0C\u4F46\u57FA\u7840 runtime \u6587\u4EF6\u5DF2\u5B58\u5728\uFF0C\u7EE7\u7EED\u521D\u59CB\u5316: ${exitCode}`);
   }
   const workRoot = options.installModules === false ? await verifyInstalledBaseRoot(host, installDir, options.config, options.verifyTimeoutMs ?? 10 * 6e4, options.onProgress) : await verifyInstalledWorkRoot(host, installDir, options.config, options.verifyTimeoutMs ?? 10 * 6e4, options.onProgress);
+  if (selectedInstaller?.source === "dynamic") {
+    const installedVersion = readInstalledAssistantBaseVersion(workRoot);
+    if (!installedVersion || compareAssistantVersions(installedVersion, selectedInstaller.internalVersion) < 0) {
+      throw new Error(`\u667A\u80FD\u7BA1\u5BB6\u5B89\u88C5\u540E\u7248\u672C\u4E0D\u6EE1\u8DB3\u6240\u9009\u5B89\u88C5\u5305: \u5F53\u524D ${installedVersion || "\u672A\u77E5"}\uFF0C\u6240\u9009 ${selectedInstaller.internalVersion}`);
+    }
+  }
   if (options.installModules !== false) {
     await initializeInstalledRuntimeTransaction(host, workRoot, options.config, {
       installModules: true,
@@ -20474,7 +20633,7 @@ async function upgradeOutdatedInstalledBase(host, workRoot, config2, onProgress)
   if (!verdict.updateAvailable)
     return null;
   if (verdict.blockedByPlugin) {
-    onProgress?.(`\u5DF2\u5B89\u88C5\u7684\u667A\u80FD\u7BA1\u5BB6\u672C\u4F53\u4E3A ${verdict.installed ?? "\u672A\u77E5"}\uFF0C\u8981\u6C42 ${verdict.required}\uFF0C\u9AD8\u4E8E\u672C\u63D2\u4EF6\u5185\u7F6E\u7684\u5B89\u88C5\u5305\uFF0C\u8BF7\u5347\u7EA7 ZLT Quant \u63D2\u4EF6\u540E\u91CD\u8BD5`);
+    onProgress?.(`\u5DF2\u5B89\u88C5\u7684\u667A\u80FD\u7BA1\u5BB6\u672C\u4F53\u4E3A ${verdict.installed ?? "\u672A\u77E5"}\uFF0C\u8981\u6C42 ${verdict.required}\uFF0C\u9AD8\u4E8E\u5F53\u524D\u7248\u672C\u5217\u8868\u4E2D\u53EF\u7528\u7684\u5B89\u88C5\u5305\uFF0C\u8BF7\u7B49\u5F85\u5B89\u88C5\u5305\u7248\u672C\u5217\u8868\u66F4\u65B0\u540E\u91CD\u8BD5`);
     return null;
   }
   onProgress?.(`\u5DF2\u5B89\u88C5\u7684\u667A\u80FD\u7BA1\u5BB6\u672C\u4F53\u8FC7\u65E7\uFF08${verdict.installed ?? "\u672A\u77E5"} \u2192 ${verdict.required}\uFF09\uFF0C\u5148\u8986\u76D6\u5B89\u88C5\u672C\u4F53`);
@@ -20525,7 +20684,7 @@ async function installMissingBacktestModulesTransaction(host, workRoot, config2,
       if (moduleIndex !== clientModuleIndex && moduleIndex !== TY_MODULE_INDEX)
         return;
       if (moduleIndex === clientModuleIndex) {
-        fs6.rmSync(path6.join(workRoot, ASSISTANT_UPGRADE_FINISH_LOCK), { force: true });
+        fs6.rmSync(path7.join(workRoot, ASSISTANT_UPGRADE_FINISH_LOCK), { force: true });
       }
       await quiesceTyModuleProcesses(workRoot, onProgress, (selected) => {
         stoppedPayloadProcesses = [...stoppedPayloadProcesses, ...selected];
@@ -20544,7 +20703,7 @@ async function installMissingBacktestModulesTransaction(host, workRoot, config2,
       } else {
         await installBacktestModules(workRoot, upgradedZltContent, config2, onProgress, installHooks);
       }
-      fs6.rmSync(path6.join(workRoot, ASSISTANT_UPGRADE_FINISH_LOCK), { force: true });
+      fs6.rmSync(path7.join(workRoot, ASSISTANT_UPGRADE_FINISH_LOCK), { force: true });
     }
   } catch (error2) {
     if (runtimeStopped || stoppedPayloadProcesses.length > 0) {
@@ -20571,14 +20730,14 @@ function shouldInstallBacktestModules(workRoot, config2) {
 async function upgradeAssistantBaseTransaction(host, workRoot, config2, onProgress, options = {}) {
   const verdict = options.verdict ?? await checkAssistantBaseUpgrade(workRoot, config2, await host.readRegistryInstallType(config2));
   if (verdict.blockedByPlugin) {
-    throw new Error(`\u8FDC\u7A0B\u8981\u6C42\u7684\u667A\u80FD\u7BA1\u5BB6\u7248\u672C ${verdict.required} \u9AD8\u4E8E\u5F53\u524D\u63D2\u4EF6\u5185\u7F6E\u7684\u5B89\u88C5\u5305 ${verdict.pinnedVersion}\uFF0C\u8BF7\u5148\u5347\u7EA7 ZLT Quant \u63D2\u4EF6`);
+    throw new Error(`\u8FDC\u7A0B\u8981\u6C42\u7684\u667A\u80FD\u7BA1\u5BB6\u7248\u672C ${verdict.required} \u9AD8\u4E8E\u5F53\u524D\u7248\u672C\u5217\u8868\u4E2D\u53EF\u7528\u7684\u5B89\u88C5\u5305 ${verdict.pinnedVersion}`);
   }
   if (!verdict.updateAvailable)
     return verdict.installed || "";
   onProgress?.(`\u51C6\u5907\u8986\u76D6\u5B89\u88C5\u667A\u80FD\u7BA1\u5BB6\u672C\u4F53: ${verdict.installed} \u2192 ${verdict.required}`);
   const stopped = await quiesceRuntimeForBaseUpgrade(workRoot, config2, onProgress);
   try {
-    const installerPath = await downloadRuntimeInstaller(config2, onProgress, verdict.installType);
+    const installerPath = await downloadRuntimeInstaller(config2, onProgress, verdict.installType, verdict.installer);
     await installRuntimeTransaction(host, {
       config: config2,
       installerPath,
@@ -20617,14 +20776,14 @@ function ensurePythonToolchain(workRoot) {
   if (!fs6.existsSync(targetPython)) {
     throw new Error(`\u6295\u7814\u6A21\u5757\u5C1A\u672A\u4E0B\u53D1 Python \u8FD0\u884C\u65F6: ${targetPython}\u3002\u8BF7\u5728\u667A\u80FD\u7BA1\u5BB6\u4E2D\u5B89\u88C5\u6216\u4FEE\u590D\u6295\u7814\u6A21\u5757\u540E\u91CD\u8BD5\u3002`);
   }
-  const abiDll = path6.join(path6.dirname(targetPython), `python${PYTHON_SDK_ABI_TAG.replace(/^cp/, "")}.dll`);
+  const abiDll = path7.join(path7.dirname(targetPython), `python${PYTHON_SDK_ABI_TAG.replace(/^cp/, "")}.dll`);
   if (!fs6.existsSync(abiDll)) {
     throw new Error(`\u6295\u7814\u6A21\u5757\u4E0B\u53D1\u7684 Python \u4E0E zltsdk-plugin \u7684 ${PYTHON_SDK_ABI_TAG} wheel ABI \u4E0D\u5339\u914D\uFF1A\u672A\u627E\u5230 ${abiDll}\u3002\u8BF7\u5728\u667A\u80FD\u7BA1\u5BB6\u4E2D\u91CD\u65B0\u5B89\u88C5\u6295\u7814\u6A21\u5757\u3002`);
   }
   return targetPython;
 }
 function toolchainDownloadCacheDir() {
-  return path6.join(os.tmpdir(), "zlt-runtime-toolchains");
+  return path7.join(os.tmpdir(), "zlt-runtime-toolchains");
 }
 async function ensureVerifiedToolchainAsset(options) {
   const { label, url, sha256, destination, timeoutMs, onProgress } = options;
@@ -20646,8 +20805,8 @@ async function ensureVerifiedToolchainAsset(options) {
   onProgress?.(`${label} SHA256 \u6821\u9A8C\u901A\u8FC7: ${sha256}`);
 }
 async function ensureManagedPipWheel(workRoot, config2, onProgress) {
-  const destination = path6.join(toolchainDownloadCacheDir(), "pip-26.1.2-py3-none-any.whl");
-  fs6.mkdirSync(path6.dirname(destination), { recursive: true });
+  const destination = path7.join(toolchainDownloadCacheDir(), "pip-26.1.2-py3-none-any.whl");
+  fs6.mkdirSync(path7.dirname(destination), { recursive: true });
   await ensureVerifiedToolchainAsset({
     label: "pip 26.1.2 wheel",
     url: config2.pythonPipWheelUrl,
@@ -20668,27 +20827,27 @@ function assertFileSha256(filePath, expectedSha256) {
 async function quiesceTyModuleProcesses(workRoot, onProgress, onWillStop) {
   if (process.platform !== "win32")
     return [];
-  const managedCodePath = path6.resolve(workRoot, "vscode", "Code.exe");
-  const jsserviceRoot = `${path6.resolve(workRoot, "jsservice")}${path6.sep}`.toLowerCase();
-  const managedGitRoot = path6.resolve(workRoot, "mingit");
+  const managedCodePath = path7.resolve(workRoot, "vscode", "Code.exe");
+  const jsserviceRoot = `${path7.resolve(workRoot, "jsservice")}${path7.sep}`.toLowerCase();
+  const managedGitRoot = path7.resolve(workRoot, "mingit");
   assertPathInside(workRoot, managedGitRoot);
   const executablePaths = [
-    path6.join(workRoot, "zltaf", "zltaf.exe"),
-    path6.join(workRoot, "python", "python.exe"),
-    path6.join(workRoot, "mingit", "cmd", "git.exe"),
-    path6.join(workRoot, "zltHost", "ZltDcmClient.exe"),
+    path7.join(workRoot, "zltaf", "zltaf.exe"),
+    path7.join(workRoot, "python", "python.exe"),
+    path7.join(workRoot, "mingit", "cmd", "git.exe"),
+    path7.join(workRoot, "zltHost", "ZltDcmClient.exe"),
     managedCodePath
   ].map((candidate) => {
-    const resolved = path6.resolve(candidate);
+    const resolved = path7.resolve(candidate);
     assertPathInside(workRoot, resolved);
     return resolved;
   });
   const installedExecutablePaths = executablePaths.filter((candidate) => fs6.existsSync(candidate));
-  const installedExecutableRoots = fs6.existsSync(managedGitRoot) ? [`${managedGitRoot}${path6.sep}`] : [];
+  const installedExecutableRoots = fs6.existsSync(managedGitRoot) ? [`${managedGitRoot}${path7.sep}`] : [];
   if (installedExecutablePaths.length === 0 && installedExecutableRoots.length === 0)
     return [];
   const selectTyPayloadProcesses = () => listManagedRuntimeProcesses(installedExecutablePaths, installedExecutableRoots).filter((item) => {
-    if (path6.resolve(item.executablePath).toLowerCase() !== managedCodePath.toLowerCase())
+    if (path7.resolve(item.executablePath).toLowerCase() !== managedCodePath.toLowerCase())
       return true;
     const commandLine = item.commandLine.replaceAll("/", "\\").toLowerCase();
     return commandLine.includes(jsserviceRoot) && commandLine.includes("--ms-enable-electron-run-as-node");
@@ -20746,12 +20905,12 @@ async function stopManagedRuntimeProcesses(workRoot, config2, onProgress, messag
   if (process.platform !== "win32")
     return [];
   const executablePaths = [
-    path6.join(workRoot, config2.hostPath),
-    path6.join(workRoot, config2.backservicePath),
-    path6.join(workRoot, "zltHost", "zlthost.exe"),
-    path6.join(workRoot, "zltaf", "zltaf.exe")
+    path7.join(workRoot, config2.hostPath),
+    path7.join(workRoot, config2.backservicePath),
+    path7.join(workRoot, "zltHost", "zlthost.exe"),
+    path7.join(workRoot, "zltaf", "zltaf.exe")
   ].map((candidate) => {
-    const resolved = path6.resolve(candidate);
+    const resolved = path7.resolve(candidate);
     assertPathInside(workRoot, resolved);
     return resolved;
   });
@@ -20768,7 +20927,7 @@ async function stopManagedRuntimeProcesses(workRoot, config2, onProgress, messag
       throw new Error(`${messages.failed}: ${formatManagedProcessList(remaining)}\u3002\u8BF7\u5173\u95ED\u667A\u91CF\u901A\u76F8\u5173\u4EFB\u52A1\u540E\u91CD\u8BD5\u5B89\u88C5\u3002`);
     }
   }
-  const zltMarker = path6.resolve(workRoot, config2.temporaryZltFile || "Temporary/zlt");
+  const zltMarker = path7.resolve(workRoot, config2.temporaryZltFile || "Temporary/zlt");
   assertPathInside(workRoot, zltMarker);
   fs6.rmSync(zltMarker, { force: true });
   if (running.length > 0)
@@ -20779,6 +20938,7 @@ function killManagedRuntimeProcesses(running) {
   const taskkill = windowsSystemToolPath("taskkill.exe");
   for (const item of running) {
     (0, import_child_process3.spawnSync)(taskkill, ["/PID", String(item.pid), "/T", "/F"], {
+      stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8",
       timeout: 15e3,
       windowsHide: true
@@ -20812,6 +20972,7 @@ function listManagedRuntimeProcesses(executablePaths, executableRoots = []) {
     "-Command",
     command
   ], {
+    stdio: ["ignore", "pipe", "pipe"],
     encoding: "utf8",
     env: { ...process.env, ZLT_MANAGED_RUNTIME_PATHS: encodedPaths },
     timeout: 15e3,
@@ -20840,7 +21001,7 @@ ${result.stderr || ""}`);
       return [];
     return [{
       pid,
-      name: typeof item.Name === "string" ? item.Name : path6.basename(item.ExecutablePath),
+      name: typeof item.Name === "string" ? item.Name : path7.basename(item.ExecutablePath),
       executablePath: item.ExecutablePath,
       commandLine: typeof item.CommandLine === "string" ? item.CommandLine : ""
     }];
@@ -20848,10 +21009,10 @@ ${result.stderr || ""}`);
 }
 function windowsSystemToolPath(relativePath) {
   const systemRoot = process.env.SystemRoot || process.env.WINDIR;
-  if (!systemRoot || !path6.isAbsolute(systemRoot)) {
+  if (!systemRoot || !path7.isAbsolute(systemRoot)) {
     throw new Error("\u65E0\u6CD5\u5B89\u5168\u5B9A\u4F4D Windows \u7CFB\u7EDF\u5DE5\u5177: SystemRoot \u672A\u8BBE\u7F6E");
   }
-  return path6.join(systemRoot, "System32", ...relativePath.split("/"));
+  return path7.join(systemRoot, "System32", ...relativePath.split("/"));
 }
 function ensureGitToolchain(workRoot) {
   const targetGit = getGitExePath(workRoot);
@@ -20896,6 +21057,7 @@ function validatePythonSdkComplete(workRoot, config2) {
     "sys.exit(1 if missing else 0)"
   ].join("\n");
   const result = (0, import_child_process3.spawnSync)(pythonPath, ["-c", probe, JSON.stringify(pinned), JSON.stringify(imports)], {
+    stdio: ["ignore", "pipe", "pipe"],
     encoding: "utf8",
     timeout: config2.pythonSdkImportTimeout,
     windowsHide: true
@@ -21003,22 +21165,29 @@ function buildManagedPipEnvironment(runtimeIndexUrl, baseEnvironment = process.e
     no_proxy: noProxy
   };
 }
-async function downloadRuntimeInstaller(config2, onProgress, installType = "full") {
-  const url = resolveAssistantDownloadUrl(config2, installType);
-  const sha256 = resolveAssistantDownloadSha256(config2, installType);
-  const filename = path6.basename(new URL(url).pathname) || "zlt-runtime-installer.exe";
-  const dir = path6.join(os.tmpdir(), config2.downloadTempDir);
-  const destination = path6.join(dir, filename);
+async function downloadRuntimeInstaller(config2, onProgress, installType = "full", descriptor) {
+  const selected = descriptor ?? await resolveAssistantInstallerDescriptor(config2, installType);
+  const url = selected.url || resolveAssistantDownloadUrl(config2, installType);
+  if (selected.source === "pinned" && !/^[a-fA-F0-9]{64}$/.test(selected.sha256 || "")) {
+    throw new Error(`\u5F53\u524D\u73AF\u5883\u6A21\u5F0F ${config2.envMode} \u672A\u914D\u7F6E ${installType} \u5B89\u88C5\u5305 SHA256`);
+  }
+  const filename = selected.fileName || path7.basename(new URL(url).pathname) || "zlt-runtime-installer.exe";
+  const dir = path7.join(os.tmpdir(), config2.downloadTempDir);
+  const destination = path7.join(dir, filename);
   fs6.mkdirSync(dir, { recursive: true });
   onProgress?.(`\u4E0B\u8F7D\u5B89\u88C5\u5305: ${url}`);
+  if (selected.fallbackReason)
+    onProgress?.(`\u52A8\u6001\u5B89\u88C5\u5305\u4E0D\u53EF\u7528\uFF0C\u4F7F\u7528\u5185\u7F6E fallback: ${selected.fallbackReason}`);
   await downloadFile(url, destination);
   try {
-    assertFileSha256(destination, sha256);
+    if (selected.source !== "dynamic") {
+      assertFileSha256(destination, selected.sha256 || resolveAssistantDownloadSha256(config2, installType));
+    }
   } catch (error2) {
     fs6.rmSync(destination, { force: true });
     throw error2;
   }
-  onProgress?.(`\u5B89\u88C5\u5305 SHA256 \u6821\u9A8C\u901A\u8FC7: ${sha256}`);
+  onProgress?.(selected.source === "dynamic" ? `\u5B89\u88C5\u5305\u5DF2\u4E0B\u8F7D\uFF08\u7248\u672C\u5217\u8868 fileSize \u4EC5\u4F9B\u5C55\u793A: ${selected.fileSize ?? "\u672A\u63D0\u4F9B"}\uFF09` : `\u5B89\u88C5\u5305 SHA256 \u6821\u9A8C\u901A\u8FC7: ${selected.sha256}`);
   return destination;
 }
 function describeInstallerExitCode(exitCode) {
@@ -21151,7 +21320,7 @@ function downloadFile(url, destination, redirectCount = 0, timeoutMs = 0, initia
   if (redirectCount > 5) {
     return Promise.reject(new Error(`\u4E0B\u8F7D\u91CD\u5B9A\u5411\u8FC7\u591A: ${url}`));
   }
-  fs6.mkdirSync(path6.dirname(destination), { recursive: true });
+  fs6.mkdirSync(path7.dirname(destination), { recursive: true });
   const partialPath = `${destination}.${process.pid}.${(0, import_crypto3.randomUUID)()}.part`;
   return new Promise((resolve12, reject) => {
     let settled = false;
@@ -21237,10 +21406,10 @@ function delay(ms) {
   return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 function getPythonExePath(workRoot) {
-  return path6.join(workRoot, "python", "python.exe");
+  return path7.join(workRoot, "python", "python.exe");
 }
 function getGitExePath(workRoot) {
-  return path6.join(workRoot, "mingit", "cmd", "git.exe");
+  return path7.join(workRoot, "mingit", "cmd", "git.exe");
 }
 function resolveManagedPythonExe(workRoot) {
   return getPythonExePath(workRoot || getDefaultInstallPath());
@@ -21258,19 +21427,19 @@ function getDefaultInstallPath() {
   if (process.platform === "win32") {
     return fs6.existsSync("D:\\") ? "D:\\ZLTClient" : "C:\\ZLTClient";
   }
-  return path6.join(os.homedir(), "ZLTClient");
+  return path7.join(os.homedir(), "ZLTClient");
 }
 function getZltafExePath(workRoot) {
-  return path6.join(workRoot, "zltaf", "zltaf.exe");
+  return path7.join(workRoot, "zltaf", "zltaf.exe");
 }
 function getZltafConfigPath(workRoot) {
-  return path6.join(workRoot, "zltaf", "application-local.properties");
+  return path7.join(workRoot, "zltaf", "application-local.properties");
 }
 function assertPathInside(root2, targetPath) {
-  const resolvedRoot = path6.resolve(root2);
-  const resolvedTarget = path6.resolve(targetPath);
-  const relative2 = path6.relative(resolvedRoot, resolvedTarget);
-  if (relative2.startsWith("..") || path6.isAbsolute(relative2)) {
+  const resolvedRoot = path7.resolve(root2);
+  const resolvedTarget = path7.resolve(targetPath);
+  const relative2 = path7.relative(resolvedRoot, resolvedTarget);
+  if (relative2.startsWith("..") || path7.isAbsolute(relative2)) {
     throw new Error(`\u62D2\u7EDD\u5199\u5165\u5B89\u88C5\u76EE\u5F55\u5916\u8DEF\u5F84: ${resolvedTarget}`);
   }
 }
@@ -21286,7 +21455,7 @@ function normalizeRequiredPythonPackages(config2) {
 function areBundledSitePackagesPresent(workRoot, packages) {
   if (packages.some(hasPythonVersionSpecifier))
     return false;
-  const sitePackages = path6.join(workRoot, "python", "Lib", "site-packages");
+  const sitePackages = path7.join(workRoot, "python", "Lib", "site-packages");
   if (!fs6.existsSync(sitePackages))
     return false;
   let entries = [];
@@ -21300,10 +21469,10 @@ function areBundledSitePackagesPresent(workRoot, packages) {
     const normalized = normalizePythonPackageName(requirementName);
     const importName = pythonDistributionImportName(packageName);
     const candidateFiles = [
-      path6.join(sitePackages, requirementName, "__init__.py"),
-      path6.join(sitePackages, `${requirementName}.py`),
-      path6.join(sitePackages, importName, "__init__.py"),
-      path6.join(sitePackages, `${importName}.py`)
+      path7.join(sitePackages, requirementName, "__init__.py"),
+      path7.join(sitePackages, `${requirementName}.py`),
+      path7.join(sitePackages, importName, "__init__.py"),
+      path7.join(sitePackages, `${importName}.py`)
     ];
     return candidateFiles.some((candidate) => fs6.existsSync(candidate)) || entries.some((entry) => entry.startsWith(`${normalized}-`) && (entry.endsWith(".dist-info") || entry.endsWith(".egg-info")));
   });
@@ -21334,7 +21503,7 @@ function getDefaultInstallPath2() {
   if (process.platform === "win32") {
     return fs7.existsSync("D:\\") ? "D:\\ZLTClient" : "C:\\ZLTClient";
   }
-  return path7.join(os2.homedir(), "ZLTClient");
+  return path8.join(os2.homedir(), "ZLTClient");
 }
 function validateWorkRootComplete(workRoot, _config) {
   if (!fs7.existsSync(workRoot)) {
@@ -21354,7 +21523,7 @@ function validateWorkRootComplete(workRoot, _config) {
 function validateAssistantBaseComplete(workRoot, config2) {
   if (!fs7.existsSync(workRoot))
     return { complete: false, reason: `\u5DE5\u7A0B\u8DEF\u5F84\u4E0D\u5B58\u5728: ${workRoot}` };
-  const hostPath = path7.join(workRoot, config2.hostPath);
+  const hostPath = path8.join(workRoot, config2.hostPath);
   return fs7.existsSync(hostPath) ? { complete: true } : { complete: false, reason: `\u7F3A\u5C11\u667A\u80FD\u7BA1\u5BB6\u7A0B\u5E8F: ${hostPath}` };
 }
 function validateDependencyWorkRootComplete(workRoot, config2) {
@@ -21379,7 +21548,7 @@ function validateRuntimeLaunchReady(workRoot, config2) {
   return { complete: true };
 }
 function ensureUsersProjectsDirectory(workRoot) {
-  const projectsDir = path7.join(workRoot, "Users", "projects");
+  const projectsDir = path8.join(workRoot, "Users", "projects");
   if (fs7.existsSync(projectsDir)) {
     if (!fs7.statSync(projectsDir).isDirectory()) {
       throw new Error(`Users\\projects \u8DEF\u5F84\u5DF2\u5B58\u5728\u4F46\u4E0D\u662F\u76EE\u5F55: ${projectsDir}`);
@@ -21425,7 +21594,7 @@ async function resolveRuntimeRoot(config2, options = {}) {
     const workRoot = candidate?.trim();
     if (!workRoot)
       continue;
-    const key = path7.resolve(workRoot).toLowerCase();
+    const key = path8.resolve(workRoot).toLowerCase();
     if (seen.has(key))
       continue;
     seen.add(key);
@@ -21468,7 +21637,7 @@ async function runDoctor(config2, options = {}) {
   }
   const assistant = workRoot ? validateWorkRootComplete(workRoot, config2) : { complete: false, reason: "\u672A\u53D1\u73B0\u53EF\u7528 InstallLocation" };
   const dependency = workRoot ? validateDependencyWorkRootComplete(workRoot, config2) : { complete: false, reason: "\u672A\u53D1\u73B0\u53EF\u7528 InstallLocation" };
-  const zltFile = workRoot ? path7.join(workRoot, config2.temporaryZltFile) : void 0;
+  const zltFile = workRoot ? path8.join(workRoot, config2.temporaryZltFile) : void 0;
   let pipePath;
   let ipcReachable = false;
   const explicitPipeName = process.env.ZLT_PIPE_NAME?.trim();
@@ -21517,13 +21686,13 @@ function startZltafRuntime(workRoot, config2) {
   if (!fs7.existsSync(configPath)) {
     throw new Error(`ZLTAF \u914D\u7F6E\u4E0D\u5B58\u5728: ${configPath}`);
   }
-  const tmpDir = path7.join(workRoot, "zltaf", "tmp");
+  const tmpDir = path8.join(workRoot, "zltaf", "tmp");
   fs7.mkdirSync(tmpDir, { recursive: true });
   const child = (0, import_child_process4.spawn)(zltafPath, [
     `-Dconfig.path=${configPath}`,
     `-Djava.io.tmpdir=${tmpDir}`
   ], {
-    cwd: path7.dirname(zltafPath),
+    cwd: path8.dirname(zltafPath),
     detached: true,
     stdio: "ignore",
     windowsHide: true
@@ -21588,15 +21757,15 @@ async function ensureAssistantHostRunning(workRoot, config2, onProgress, options
     if (zltContent && masterPipeExists(zltContent))
       return zltContent;
   }
-  throw new Error(`\u7B49\u5F85\u667A\u80FD\u7BA1\u5BB6 IPC \u914D\u7F6E\u8D85\u65F6\uFF08\u540E\u7F00\u6587\u4EF6\u6216\u4E3B\u7BA1\u9053\u672A\u5C31\u7EEA\uFF09: ${path7.join(workRoot, config2.temporaryZltFile)}`);
+  throw new Error(`\u7B49\u5F85\u667A\u80FD\u7BA1\u5BB6 IPC \u914D\u7F6E\u8D85\u65F6\uFF08\u540E\u7F00\u6587\u4EF6\u6216\u4E3B\u7BA1\u9053\u672A\u5C31\u7EEA\uFF09: ${path8.join(workRoot, config2.temporaryZltFile)}`);
 }
-var ASSISTANT_UPGRADE_FINISH_LOCK2 = path7.join("Temporary", "upgradeFinsh.lock");
+var ASSISTANT_UPGRADE_FINISH_LOCK2 = path8.join("Temporary", "upgradeFinsh.lock");
 function launchAssistantHost(workRoot, config2, onProgress) {
-  const hostPath = path7.join(workRoot, config2.hostPath);
+  const hostPath = path8.join(workRoot, config2.hostPath);
   onProgress?.("\u542F\u52A8\u667A\u80FD\u7BA1\u5BB6");
   const { ELECTRON_RUN_AS_NODE: _dropped, ...env } = process.env;
   const child = (0, import_child_process4.spawn)(hostPath, ["startwithplugin", "selfstart"], {
-    cwd: path7.dirname(hostPath),
+    cwd: path8.dirname(hostPath),
     detached: true,
     stdio: "ignore",
     windowsHide: true,
@@ -21613,7 +21782,7 @@ async function locateInstalledRuntime(config2) {
   return workRoot;
 }
 async function waitForUpgradedAssistantClient(workRoot, config2, onProgress, versionBefore) {
-  const finishLockPath = path7.join(workRoot, ASSISTANT_UPGRADE_FINISH_LOCK2);
+  const finishLockPath = path8.join(workRoot, ASSISTANT_UPGRADE_FINISH_LOCK2);
   const finishStartedAt = Date.now();
   const versionRaised = () => {
     if (!versionBefore)
@@ -21676,21 +21845,21 @@ function delay2(ms) {
   return delay(ms);
 }
 function getZltafExePath2(workRoot) {
-  return path7.join(workRoot, "zltaf", "zltaf.exe");
+  return path8.join(workRoot, "zltaf", "zltaf.exe");
 }
 function getZltafConfigPath2(workRoot) {
-  return path7.join(workRoot, "zltaf", "application-local.properties");
+  return path8.join(workRoot, "zltaf", "application-local.properties");
 }
 function resolveZltafLaunchConfigPath(workRoot, config2) {
   if (config2.zltafConfigFile === ZLTAF_CONFIG_FILE_DEFAULT) {
     return getZltafConfigPath2(workRoot);
   }
-  const preferred = path7.join(workRoot, "zltaf", config2.zltafConfigFile);
+  const preferred = path8.join(workRoot, "zltaf", config2.zltafConfigFile);
   if (fs7.existsSync(preferred)) {
     return preferred;
   }
   const base = getZltafConfigPath2(workRoot);
-  process.stderr.write(`[zlt-runtime] ZLTAF \u914D\u7F6E ${config2.zltafConfigFile} \u4E0D\u5B58\u5728\uFF0C\u56DE\u9000\u5230 ${path7.basename(base)}
+  process.stderr.write(`[zlt-runtime] ZLTAF \u914D\u7F6E ${config2.zltafConfigFile} \u4E0D\u5B58\u5728\uFF0C\u56DE\u9000\u5230 ${path8.basename(base)}
 `);
   return base;
 }
@@ -21715,7 +21884,7 @@ async function waitForZltafPipe(workRoot, config2, options) {
 // ../zlt-runtime-core/dist/auth.js
 var fs9 = __toESM(require("fs"), 1);
 var os3 = __toESM(require("os"), 1);
-var path8 = __toESM(require("path"), 1);
+var path9 = __toESM(require("path"), 1);
 
 // ../zlt-runtime-core/dist/private-path.js
 var fs8 = __toESM(require("node:fs"), 1);
@@ -21766,13 +21935,13 @@ function resolveZltQuantHome(env = process.env) {
   const configuredHome = env.ZLTQUANT_HOME?.trim();
   if (configuredHome)
     return expandHome(configuredHome);
-  return path8.join(os3.homedir(), ".zltquant");
+  return path9.join(os3.homedir(), ".zltquant");
 }
 function resolveCredentialsPath(env = process.env) {
   const configuredPath = env.ZLTQUANT_CREDENTIALS?.trim();
   if (configuredPath)
     return expandHome(configuredPath);
-  return path8.join(resolveZltQuantHome(env), "credentials.json");
+  return path9.join(resolveZltQuantHome(env), "credentials.json");
 }
 function readCredentials(env = process.env) {
   const credentialsPath = resolveCredentialsPath(env);
@@ -21821,7 +21990,7 @@ function writeCredentials(input, env = process.env) {
     source,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  fs9.mkdirSync(path8.dirname(credentialsPath), { recursive: true });
+  fs9.mkdirSync(path9.dirname(credentialsPath), { recursive: true });
   const tempPath = `${credentialsPath}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`;
   try {
     if (source === "zlt-mcp-device-login") {
@@ -21928,9 +22097,9 @@ function expandHome(input) {
   if (input === "~")
     return os3.homedir();
   if (input.startsWith("~/") || input.startsWith("~\\")) {
-    return path8.join(os3.homedir(), input.slice(2));
+    return path9.join(os3.homedir(), input.slice(2));
   }
-  return path8.resolve(input);
+  return path9.resolve(input);
 }
 function tryReadCredentials(env) {
   try {
@@ -22040,7 +22209,7 @@ function persistDeviceAuthorization(grant, env) {
     throw new DeviceAuthorizationError("credentials_conflict", "Persisted device credential is not effective");
   return { status: "success", authStatus: authStatus2 };
 }
-async function requestJson(options, base, path27, payload, allowPoll400 = false) {
+async function requestJson(options, base, path28, payload, allowPoll400 = false) {
   const controller = new AbortController();
   const externalAbort = () => controller.abort();
   if (options.signal?.aborted)
@@ -22049,7 +22218,7 @@ async function requestJson(options, base, path27, payload, allowPoll400 = false)
     options.signal?.addEventListener("abort", externalAbort, { once: true });
   const timeout = setTimeout(() => controller.abort(), options.requestTimeoutMs ?? 15e3);
   try {
-    const response = await (options.fetch ?? globalThis.fetch)(new URL(path27, base), {
+    const response = await (options.fetch ?? globalThis.fetch)(new URL(path28, base), {
       method: "POST",
       redirect: "error",
       headers: { "content-type": "application/json" },
@@ -22183,7 +22352,7 @@ var import_node_crypto = require("node:crypto");
 var fs10 = __toESM(require("node:fs"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var os4 = __toESM(require("node:os"), 1);
-var path9 = __toESM(require("node:path"), 1);
+var path10 = __toESM(require("node:path"), 1);
 function urlEncode(value) {
   let result = "";
   for (const code of Buffer.from(value, "utf8")) {
@@ -22336,7 +22505,7 @@ var ZltafHttpPacket = class {
     }
   }
 };
-var LOG_FILE = path9.join(os4.tmpdir(), "zlt-mcp-proxy.log");
+var LOG_FILE = path10.join(os4.tmpdir(), "zlt-mcp-proxy.log");
 var pendingLogLines = [];
 var logWriteInFlight = false;
 function log(tag, message) {
@@ -22535,17 +22704,17 @@ __export(config_exports, {
   resolveDefaultRuntimeConfigPath: () => resolveDefaultRuntimeConfigPath
 });
 var fs11 = __toESM(require("fs"), 1);
-var path10 = __toESM(require("path"), 1);
+var path11 = __toESM(require("path"), 1);
 function loadConfig(configPath) {
   const raw = fs11.readFileSync(configPath, "utf-8");
   return JSON.parse(raw);
 }
 function resolveDefaultConfigPath() {
   if (process.env.ZLT_MCP_CONFIG) return process.env.ZLT_MCP_CONFIG;
-  const cwdCandidate = path10.resolve(process.cwd(), "config.json");
+  const cwdCandidate = path11.resolve(process.cwd(), "config.json");
   const candidates = [
-    path10.resolve(path10.dirname(process.argv[1] || ""), "..", "config.json"),
-    path10.resolve(path10.dirname(process.argv[1] || ""), "config.json"),
+    path11.resolve(path11.dirname(process.argv[1] || ""), "..", "config.json"),
+    path11.resolve(path11.dirname(process.argv[1] || ""), "config.json"),
     cwdCandidate
   ];
   for (const candidate of candidates) {
@@ -22556,9 +22725,9 @@ function resolveDefaultConfigPath() {
 function resolveDefaultRuntimeConfigPath() {
   if (process.env.ZLT_RUNTIME_CONFIG) return process.env.ZLT_RUNTIME_CONFIG;
   const candidates = [
-    path10.resolve(path10.dirname(process.argv[1] || ""), "..", "runtime.cfg.json"),
-    path10.resolve(path10.dirname(process.argv[1] || ""), "runtime.cfg.json"),
-    path10.resolve(process.cwd(), "runtime.cfg.json")
+    path11.resolve(path11.dirname(process.argv[1] || ""), "..", "runtime.cfg.json"),
+    path11.resolve(path11.dirname(process.argv[1] || ""), "runtime.cfg.json"),
+    path11.resolve(process.cwd(), "runtime.cfg.json")
   ];
   return candidates.find((candidate) => fs11.existsSync(candidate));
 }
@@ -22595,7 +22764,7 @@ function hasHighBytes(str) {
 
 // src/download-verification.ts
 var fs12 = __toESM(require("node:fs"), 1);
-var path11 = __toESM(require("node:path"), 1);
+var path12 = __toESM(require("node:path"), 1);
 var MAX_INVENTORY_ENTRIES = 25e3;
 var MAX_INVENTORY_DEPTH = 8;
 var SAFE_SEGMENT = /^[A-Za-z0-9_-]+$/;
@@ -22692,11 +22861,11 @@ async function downloadAndVerify(args, invoke, inventory, onUuid) {
 }
 function configuredDownloadHome(clientRootDir) {
   try {
-    const configPath = path11.join(clientRootDir, "zltHost", "moudles", "dcm.json");
+    const configPath = path12.join(clientRootDir, "zltHost", "moudles", "dcm.json");
     const config2 = JSON.parse(fs12.readFileSync(configPath, "utf8"));
     if (!isRecord2(config2) || typeof config2.download_home !== "string" || !config2.download_home.trim()) return null;
     const expanded = config2.download_home.trim().replace(/%HomePath%/gi, clientRootDir);
-    return path11.isAbsolute(expanded) ? path11.resolve(expanded) : path11.resolve(clientRootDir, expanded);
+    return path12.isAbsolute(expanded) ? path12.resolve(expanded) : path12.resolve(clientRootDir, expanded);
   } catch {
     return null;
   }
@@ -22705,7 +22874,7 @@ function diskSpaceDownloadHome(result) {
   const data = dataRecord(result);
   if (!data) return null;
   const value = data.download_home ?? data.downloadHome;
-  return typeof value === "string" && value.trim() ? path11.resolve(value.trim()) : null;
+  return typeof value === "string" && value.trim() ? path12.resolve(value.trim()) : null;
 }
 function requestedScopes(params) {
   if (!Array.isArray(params) || params.length === 0) return null;
@@ -22732,7 +22901,7 @@ function inventoryDownloadedFiles(clientRootDir, params, diskSpace, limits = {})
   if (!configured) return unknown2("download-home-config-unavailable");
   const reported = diskSpaceDownloadHome(diskSpace);
   if (!reported) return unknown2("disk-space-download-home-unavailable", configured);
-  if (path11.resolve(configured).toLowerCase() !== path11.resolve(reported).toLowerCase()) return unknown2("download-home-mismatch", configured);
+  if (path12.resolve(configured).toLowerCase() !== path12.resolve(reported).toLowerCase()) return unknown2("download-home-mismatch", configured);
   const scopes = requestedScopes(params);
   if (!scopes) return unknown2("invalid-request-scope", configured);
   if (scopes.some((scope) => !scope.exchangeId || !/^(dk|mk|tk)[a-z0-9_-]*$/.test(scope.dataType))) {
@@ -22759,7 +22928,7 @@ function inventoryDownloadedFiles(clientRootDir, params, diskSpace, limits = {})
         let candidate = root2;
         let present = true;
         for (const segment of ["hqdata", lane, scope.exchangeId, scope.dataType]) {
-          candidate = path11.join(candidate, segment);
+          candidate = path12.join(candidate, segment);
           let component;
           try {
             component = fs12.lstatSync(candidate);
@@ -22786,7 +22955,7 @@ function inventoryDownloadedFiles(clientRootDir, params, diskSpace, limits = {})
       for (const entry of fs12.readdirSync(current.dir, { withFileTypes: true })) {
         entries += 1;
         if (entries > (limits.maxEntries ?? MAX_INVENTORY_ENTRIES)) return unknown2("inventory-entry-limit", configured);
-        const full = path11.join(current.dir, entry.name);
+        const full = path12.join(current.dir, entry.name);
         if (entry.isSymbolicLink()) return unknown2("symlink-or-reparse-point", configured);
         const stat = fs12.lstatSync(full);
         const attrs = stat.attributes;
@@ -22809,7 +22978,7 @@ function inventoryDownloadedFiles(clientRootDir, params, diskSpace, limits = {})
 // src/local-auth-guard.ts
 var fs13 = __toESM(require("node:fs"), 1);
 var os5 = __toESM(require("node:os"), 1);
-var path12 = __toESM(require("node:path"), 1);
+var path13 = __toESM(require("node:path"), 1);
 var RECOVERY_HANDLERS = /* @__PURE__ */ new Set([
   "currentUser",
   "runtimeDoctor",
@@ -22822,8 +22991,8 @@ function resolveLocalCredentialsPath(env = process.env) {
   const configuredPath = env.ZLTQUANT_CREDENTIALS?.trim();
   if (configuredPath) return expandHome2(configuredPath);
   const configuredHome = env.ZLTQUANT_HOME?.trim();
-  const home = configuredHome ? expandHome2(configuredHome) : path12.join(os5.homedir(), ".zltquant");
-  return path12.join(home, "credentials.json");
+  const home = configuredHome ? expandHome2(configuredHome) : path13.join(os5.homedir(), ".zltquant");
+  return path13.join(home, "credentials.json");
 }
 function inspectLocalCredential(env = process.env) {
   const credentialsPath = resolveLocalCredentialsPath(env);
@@ -22891,8 +23060,8 @@ function preservedTaskIdentity(args) {
 }
 function expandHome2(input) {
   if (input === "~") return os5.homedir();
-  if (input.startsWith("~/") || input.startsWith("~\\")) return path12.join(os5.homedir(), input.slice(2));
-  return path12.resolve(input);
+  if (input.startsWith("~/") || input.startsWith("~\\")) return path13.join(os5.homedir(), input.slice(2));
+  return path13.resolve(input);
 }
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -22900,14 +23069,14 @@ function isRecord3(value) {
 
 // src/local-runtime-readiness.ts
 var fs14 = __toESM(require("node:fs"), 1);
-var path13 = __toESM(require("node:path"), 1);
+var path14 = __toESM(require("node:path"), 1);
 function inspectLocalRuntimeReadiness(workRoot) {
   const required2 = [
     ["\u5DE5\u7A0B\u8DEF\u5F84", workRoot],
-    ["ZLTAF \u7A0B\u5E8F", path13.join(workRoot, "zltaf", "zltaf.exe")],
-    ["ZLTAF \u914D\u7F6E", path13.join(workRoot, "zltaf", "application-local.properties")],
-    ["Python \u7A0B\u5E8F", path13.join(workRoot, "python", "python.exe")],
-    ["MinGit \u7A0B\u5E8F", path13.join(workRoot, "mingit", "cmd", "git.exe")]
+    ["ZLTAF \u7A0B\u5E8F", path14.join(workRoot, "zltaf", "zltaf.exe")],
+    ["ZLTAF \u914D\u7F6E", path14.join(workRoot, "zltaf", "application-local.properties")],
+    ["Python \u7A0B\u5E8F", path14.join(workRoot, "python", "python.exe")],
+    ["MinGit \u7A0B\u5E8F", path14.join(workRoot, "mingit", "cmd", "git.exe")]
   ];
   for (const [label, filePath] of required2) {
     if (!fs14.existsSync(filePath)) {
@@ -22939,13 +23108,13 @@ function ensureDir(dir) {
 function writeResponseFile(outputDir, content) {
   ensureDir(outputDir);
   const filename = `resp_${getTimestamp()}.json`;
-  const filePath = path14.join(outputDir, filename);
+  const filePath = path15.join(outputDir, filename);
   fs15.writeFileSync(filePath, content, "utf-8");
   return filePath;
 }
 function appendHistory(outputDir, uri, statusCode, contentSize, respFile) {
   ensureDir(outputDir);
-  const historyPath = path14.join(outputDir, "history.jsonl");
+  const historyPath = path15.join(outputDir, "history.jsonl");
   if (fs15.existsSync(historyPath)) {
     const lines = fs15.readFileSync(historyPath, "utf-8").split("\n").filter((l) => l.trim());
     if (lines.length > HISTORY_MAX_LINES) {
@@ -22970,7 +23139,7 @@ function cleanOutput(clientRootDir, maxDays = 1) {
   let removed = 0;
   for (const entry of fs15.readdirSync(outputDir)) {
     if (!entry.startsWith("resp_") || !entry.endsWith(".json")) continue;
-    const filePath = path14.join(outputDir, entry);
+    const filePath = path15.join(outputDir, entry);
     const stat = fs15.statSync(filePath);
     if (stat.mtimeMs < cutoff) {
       fs15.unlinkSync(filePath);
@@ -22981,7 +23150,7 @@ function cleanOutput(clientRootDir, maxDays = 1) {
 }
 async function execCommand(funcName, options) {
   const resolver = resolveDefaultConfigPath;
-  const configPath = typeof resolver === "function" ? resolver() : process.env.ZLT_MCP_CONFIG || path14.resolve(process.cwd(), "config.json");
+  const configPath = typeof resolver === "function" ? resolver() : process.env.ZLT_MCP_CONFIG || path15.resolve(process.cwd(), "config.json");
   const config2 = loadConfig2(configPath);
   const tool = config2.tools.find((t) => t.name === funcName);
   if (!tool) {
@@ -23167,7 +23336,7 @@ function backtestHandoff(result) {
   const rawCodePath = typeof record5.codePath === "string" ? record5.codePath.trim() : typeof evidence?.runDir === "string" ? evidence.runDir.trim() : "";
   return {
     runId,
-    ...rawCodePath && path14.isAbsolute(rawCodePath) ? { codePath: rawCodePath } : {},
+    ...rawCodePath && path15.isAbsolute(rawCodePath) ? { codePath: rawCodePath } : {},
     ...record5.attemptFence !== void 0 ? { attemptFence: record5.attemptFence } : {}
   };
 }
@@ -23184,7 +23353,7 @@ function mergeBacktestWait(launched, waited, handoff) {
   for (const id of [data.runId, data.backtestId]) {
     if (id !== void 0 && id !== handoff.runId) throw new Error("Backtest wait returned a different run ID");
   }
-  if (data.codePath !== void 0 && handoff.codePath && (typeof data.codePath !== "string" || path14.resolve(data.codePath).toLowerCase() !== path14.resolve(handoff.codePath).toLowerCase())) {
+  if (data.codePath !== void 0 && handoff.codePath && (typeof data.codePath !== "string" || path15.resolve(data.codePath).toLowerCase() !== path15.resolve(handoff.codePath).toLowerCase())) {
     throw new Error("Backtest wait returned a different run directory");
   }
   const status = typeof data.status === "number" || typeof data.status === "string" && data.status.trim() ? Number(data.status) : NaN;
@@ -23422,7 +23591,7 @@ function buildIpcTimeout(tool, options, defaultTimeout) {
 
 // src/skill-generator.ts
 var fs16 = __toESM(require("fs"), 1);
-var path15 = __toESM(require("path"), 1);
+var path16 = __toESM(require("path"), 1);
 function generateSkills(configPath, opts) {
   const config2 = loadConfig(configPath);
   const toolsWithSkills = config2.tools.filter((t) => t.skill);
@@ -23442,7 +23611,7 @@ ${content}
       if (!fs16.existsSync(outDir)) {
         fs16.mkdirSync(outDir, { recursive: true });
       }
-      const filePath = path15.join(outDir, `zlt-${tool.name.replace(/_/g, "-")}.md`);
+      const filePath = path16.join(outDir, `zlt-${tool.name.replace(/_/g, "-")}.md`);
       fs16.writeFileSync(filePath, content);
       process.stderr.write(`Generated: ${filePath}
 `);
@@ -24140,15 +24309,15 @@ var fs25 = __toESM(require("node:fs"), 1);
 // src/install-task.ts
 var fs17 = __toESM(require("node:fs"), 1);
 var os6 = __toESM(require("node:os"), 1);
-var path16 = __toESM(require("node:path"), 1);
+var path17 = __toESM(require("node:path"), 1);
 var import_node_child_process2 = require("node:child_process");
-var DEFAULT_TASK_ROOT = path16.join(os6.tmpdir(), "zlt-mcp-install-tasks");
+var DEFAULT_TASK_ROOT = path17.join(os6.tmpdir(), "zlt-mcp-install-tasks");
 var STARTUP_GRACE_MS = 3e4;
 function taskRoot() {
   return process.env.ZLT_MCP_INSTALL_TASK_ROOT || DEFAULT_TASK_ROOT;
 }
 function taskPath(taskId) {
-  return path16.join(taskRoot(), `${taskId}.json`);
+  return path17.join(taskRoot(), `${taskId}.json`);
 }
 function write(record5) {
   fs17.mkdirSync(taskRoot(), { recursive: true });
@@ -24221,7 +24390,7 @@ function startInstallTask(entrypoint, argsJson, spawnProcess = import_node_child
     status: "queued",
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     launcherPid: process.pid,
-    logPath: path16.join(taskRoot(), `${taskId}.log`)
+    logPath: path17.join(taskRoot(), `${taskId}.log`)
   };
   write(record5);
   let logFd;
@@ -24273,7 +24442,7 @@ var import_promises = require("node:timers/promises");
 
 // src/tool-pipeline.ts
 var fs24 = __toESM(require("node:fs"), 1);
-var path23 = __toESM(require("node:path"), 1);
+var path24 = __toESM(require("node:path"), 1);
 var import_node_crypto4 = require("node:crypto");
 
 // src/feature-set.ts
@@ -24285,7 +24454,7 @@ var MASKED_FUTURES_MESSAGE = "\u671F\u8D27\u56DE\u6D4B\u5728\u5F53\u524D\u7248\u
 
 // src/backtest-config.ts
 var fs18 = __toESM(require("node:fs"), 1);
-var path17 = __toESM(require("node:path"), 1);
+var path18 = __toESM(require("node:path"), 1);
 var import_node_crypto2 = require("node:crypto");
 var BACKTEST_CONFIG_KEYS = [
   "start",
@@ -24331,12 +24500,12 @@ function readBacktestBaseline(tool, args) {
   if (!create && tool !== "mcp-re-backtest") return void 0;
   const directory = args[create ? "strategyPath" : "codePath"];
   if (directory === void 0) return void 0;
-  if (typeof directory !== "string" || !path17.isAbsolute(directory)) throw new Error("Configuration baseline requires an absolute directory path");
+  if (typeof directory !== "string" || !path18.isAbsolute(directory)) throw new Error("Configuration baseline requires an absolute directory path");
   const root2 = fs18.realpathSync(directory);
-  if (create && path17.basename(path17.dirname(root2)).toLowerCase() === "backtest") {
+  if (create && path18.basename(path18.dirname(root2)).toLowerCase() === "backtest") {
     throw new Error("strategyPath must identify the strategy root, not a historical backtest directory");
   }
-  const file = path17.join(root2, ".vscode", "tradesetting.json");
+  const file = path18.join(root2, ".vscode", "tradesetting.json");
   const raw = fs18.readFileSync(file);
   let config2;
   try {
@@ -24398,7 +24567,7 @@ function reconcileBaselineCapital(params, overrides) {
 
 // src/backtest-execution-progress.ts
 var fs19 = __toESM(require("node:fs"), 1);
-var path18 = __toESM(require("node:path"), 1);
+var path19 = __toESM(require("node:path"), 1);
 var MAX_TAIL_BYTES = 128 * 1024;
 var FUTURE_SKEW_MS = 5e3;
 function beijingTimestamp(value) {
@@ -24413,9 +24582,9 @@ function readBacktestExecutionProgress(input) {
   const { runId, codePath, attemptStartedAtMs, nowMs = Date.now() } = input;
   if (!runId || !codePath || !Number.isFinite(attemptStartedAtMs) || attemptStartedAtMs <= 0 || !Number.isFinite(nowMs)) return void 0;
   try {
-    const config2 = JSON.parse(fs19.readFileSync(path18.join(codePath, ".vscode", "tradesetting.json"), "utf8"));
+    const config2 = JSON.parse(fs19.readFileSync(path19.join(codePath, ".vscode", "tradesetting.json"), "utf8"));
     if (config2?.backtest_id !== runId) return void 0;
-    const fd = fs19.openSync(path18.join(codePath, "log", "strategy.log"), "r");
+    const fd = fs19.openSync(path19.join(codePath, "log", "strategy.log"), "r");
     let text2;
     try {
       const before = fs19.fstatSync(fd);
@@ -24462,6 +24631,261 @@ function toFiniteNumber(value) {
   return Number.isFinite(n) ? n : 0;
 }
 
+// src/list-result-disclosure.ts
+var LIST_DISCLOSURE_TOOLS = /* @__PURE__ */ new Set([
+  "mcp-get-strategy-list",
+  "mcp-strategy-get-template-list",
+  "mcp-get-strategy-tree-list"
+]);
+var MAX_BYTES = 8 * 1024;
+var MAX_FIELDS = 50;
+var MAX_FIELD_NAME_BYTES = 128;
+var MAX_UNKNOWN_FIELDS = 50;
+var MAX_OMITTED_FIELDS = 100;
+function shapeListResultDisclosure(tool, args, result) {
+  if (!LIST_DISCLOSURE_TOOLS.has(tool.name) || result.isError) return result;
+  try {
+    const envelope = JSON.parse(result.content[0]?.text ?? "");
+    if (!isRecord4(envelope) || envelope.disclosure || Number(envelope.ErrNo ?? 0) !== 0) return result;
+    if (!Array.isArray(envelope.Data)) return result;
+    const source = envelope.Data;
+    const offset = integer2(args.offset, 0, 0, Number.MAX_SAFE_INTEGER);
+    const limit = integer2(args.limit, 20, 1, 50);
+    const fields = Array.isArray(args.fields) ? [...new Set(args.fields.filter((field) => typeof field === "string"))].slice(0, MAX_FIELDS).map((field) => field.slice(0, MAX_FIELD_NAME_BYTES)) : [];
+    const allAvailableFields = [...new Set(source.flatMap((row) => isRecord4(row) ? Object.keys(row) : []))];
+    const availableFields = allAvailableFields.slice(0, MAX_FIELDS).map((field) => field.slice(0, MAX_FIELD_NAME_BYTES));
+    const rows = [];
+    let nextCursor = offset;
+    const omittedFields = [];
+    const metadata = () => {
+      const detail = {
+        total: source.length,
+        offset,
+        returned: rows.length,
+        hasMore: nextCursor < source.length,
+        nextOffset: nextCursor < source.length ? nextCursor : null,
+        availableFields,
+        ...fields.length ? (() => {
+          const unknownFields = fields.filter((field) => !allAvailableFields.includes(field));
+          return {
+            unknownFields: unknownFields.slice(0, MAX_UNKNOWN_FIELDS).map((field) => field.slice(0, MAX_FIELD_NAME_BYTES)),
+            ...unknownFields.length > MAX_UNKNOWN_FIELDS ? { unknownFieldsTruncated: true } : {}
+          };
+        })() : {},
+        ...allAvailableFields.length > availableFields.length ? { availableFieldsTruncated: true } : {},
+        ...omittedFields.length ? {
+          omittedFields: omittedFields.slice(0, MAX_OMITTED_FIELDS).map((entry) => ({ ...entry, field: entry.field.slice(0, MAX_FIELD_NAME_BYTES) })),
+          ...omittedFields.length > MAX_OMITTED_FIELDS ? { omittedFieldsTruncated: true } : {},
+          nextAction: "Fields marked readable can be requested alone using fields at the same offset and limit:1. Fields marked readable:false exceed this bounded interface; inspect local raw data or use an additional interface. Repeating the list call cannot recover them."
+        } : {}
+      };
+      for (const key of ["omittedFields", "unknownFields", "availableFields"]) {
+        const entries = detail[key];
+        if (!Array.isArray(entries)) continue;
+        while (valueBytes(detail) > 2048 && entries.length) {
+          entries.pop();
+          detail[`${key}Truncated`] = true;
+        }
+      }
+      return detail;
+    };
+    const bytes = (candidateRows = rows) => Buffer.byteLength(JSON.stringify({ ...envelope, Data: candidateRows, disclosure: metadata() }), "utf8");
+    for (let index = offset; index < Math.min(source.length, offset + limit); index++) {
+      const raw = source[index];
+      const omissionStart = omittedFields.length;
+      let row = isRecord4(raw) ? Object.fromEntries(Object.entries(raw).filter(([key]) => !fields.length || fields.includes(key))) : raw;
+      if (bytes([...rows, row]) > MAX_BYTES && rows.length > 0 && bytes([row]) <= MAX_BYTES) break;
+      if (bytes([row]) > MAX_BYTES && isRecord4(row)) {
+        const largest = Object.keys(row).filter((key) => !/^(id|.*Id|name|title)$/i.test(key)).sort((a, b) => valueBytes(row[b]) - valueBytes(row[a]));
+        for (const field of largest) {
+          if (bytes([row]) <= MAX_BYTES) break;
+          const size = valueBytes(row[field]);
+          delete row[field];
+          omittedFields.push({ index, field, bytes: size, readable: size < MAX_BYTES - 1024, reason: "json-budget-exceeded" });
+        }
+        if (bytes([row]) > MAX_BYTES) {
+          const identity = Object.keys(row).filter((key) => /^(id|.*Id|name|title)$/i.test(key)).sort((a, b) => valueBytes(row[b]) - valueBytes(row[a]));
+          let identityRemoved = false;
+          for (const field of identity) {
+            if (bytes([row]) <= MAX_BYTES) break;
+            const size = valueBytes(row[field]);
+            delete row[field];
+            identityRemoved = true;
+            omittedFields.push({ index, field, bytes: size, readable: false, reason: "identity-field-exceeds-json-budget" });
+          }
+          if (identityRemoved || bytes([row]) > MAX_BYTES) {
+            row = { _omittedIndex: index, _omittedReason: "row-exceeds-json-budget" };
+            omittedFields.push({ index, field: "*row*", bytes: valueBytes(raw), readable: false, reason: "row-exceeds-json-budget" });
+          }
+        }
+      }
+      if (bytes([...rows, row]) > MAX_BYTES) {
+        if (rows.length === 0) {
+          row = { _omittedIndex: index, _omittedReason: "row-exceeds-json-budget" };
+          omittedFields.push({ index, field: "*row*", bytes: valueBytes(raw), readable: false, reason: "row-exceeds-json-budget" });
+          if (bytes([row]) <= MAX_BYTES) rows.push(row);
+        } else {
+          omittedFields.splice(omissionStart);
+          break;
+        }
+        nextCursor = index + 1;
+        break;
+      }
+      rows.push(row);
+      nextCursor = index + 1;
+    }
+    return replace(envelope, rows, metadata(), result);
+  } catch {
+    return result;
+  }
+}
+function integer2(value, fallback, min, max) {
+  return typeof value === "number" && Number.isInteger(value) ? Math.min(max, Math.max(min, value)) : fallback;
+}
+function valueBytes(value) {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function replace(envelope, data, disclosure, result) {
+  return { ...result, content: [{ type: "text", text: JSON.stringify({ ...envelope, Data: data, disclosure }) }] };
+}
+
+// src/data-result-disclosure.ts
+var ARRAY_BUDGET = 8 * 1024;
+var KIND = "data-result-page-v1";
+var DATA_DISCLOSURE_TOOLS = /* @__PURE__ */ new Set(["mcp-get-data-range", "mcp-get-cache-diff"]);
+var DECISION_FIELDS = /* @__PURE__ */ new Set([
+  "coverageStatus",
+  "blocksBacktest",
+  "assessment",
+  "nextAction",
+  "reasonCode",
+  "verificationEvidenceComplete",
+  "requestCoverage"
+]);
+function utf8Bytes(value) {
+  return Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+}
+function fitDataBudget(data, budget, preserveSeriesCoverage = false) {
+  const fitted = { ...data };
+  const omitted = {};
+  const keysBySize = () => Object.keys(fitted).filter((key) => key !== "disclosure" && key !== "disclosureOmitted" && !DECISION_FIELDS.has(key) && !["ranges", "series", "missing", "changed", "windows"].includes(key) && !(preserveSeriesCoverage && key === "seriesCoverage")).map((key) => ({ key, bytes: utf8Bytes(fitted[key]) })).sort((a, b) => b.bytes - a.bytes);
+  while (utf8Bytes(fitted) > budget) {
+    const candidate = keysBySize()[0];
+    if (!candidate) break;
+    const value = fitted[candidate.key];
+    omitted[candidate.key] = candidate.bytes;
+    delete fitted[candidate.key];
+  }
+  if (Object.keys(omitted).length > 0) fitted.disclosureOmitted = omitted;
+  return fitted;
+}
+function boundSeriesCoverage(data) {
+  const value = data.seriesCoverage;
+  if (!Array.isArray(value) || utf8Bytes(value) <= 2048) return data;
+  let keep = value.length;
+  while (keep > 0 && utf8Bytes(value.slice(0, keep)) > 2048) keep--;
+  return { ...data, seriesCoverage: value.slice(0, keep), seriesCoverageOmitted: value.length - keep };
+}
+function shapeDataResultDisclosure(tool, args, result) {
+  if (!DATA_DISCLOSURE_TOOLS.has(tool.name) || result.isError) return result;
+  try {
+    const parsed = JSON.parse(result.content[0]?.text ?? "");
+    if (!isRecord4(parsed) || !isRecord4(parsed.Data) || Number(parsed.ErrNo ?? 0) !== 0) return result;
+    const original = parsed.Data;
+    if (isRecord4(original.disclosure) && original.disclosure.kind === KIND) return result;
+    const units = [];
+    const totals = /* @__PURE__ */ new Map();
+    const selectedIndexes = /* @__PURE__ */ new Map();
+    const target = (path28) => /\.(ranges|series|missing|changed|windows)$/.test(path28);
+    const nested = (entry) => isRecord4(entry) && Object.entries(entry).some(([key, child]) => target(`.${key}`) && Array.isArray(child) && child.length > 0);
+    const scan = (value, jsonPath) => {
+      if (Array.isArray(value)) {
+        if (target(jsonPath)) {
+          totals.set(jsonPath, value.length);
+          value.forEach((entry, index) => {
+            if (!nested(entry)) units.push({ path: jsonPath, index });
+          });
+        }
+        value.forEach((entry, index) => scan(entry, `${jsonPath}[${index}]`));
+        return;
+      }
+      if (isRecord4(value)) for (const [key, child] of Object.entries(value)) scan(child, `${jsonPath}.${key}`);
+    };
+    const displaySource = fitDataBudget(boundSeriesCoverage(original), ARRAY_BUDGET - 2048, true);
+    scan(displaySource, "$.Data");
+    const explicit = args.offset !== void 0 || args.limit !== void 0;
+    const offset = Number.isInteger(args.offset) && Number(args.offset) >= 0 ? Number(args.offset) : 0;
+    const limit = Number.isInteger(args.limit) && Number(args.limit) > 0 ? Math.min(50, Number(args.limit)) : 20;
+    const selected = /* @__PURE__ */ new Set();
+    const render = (value, jsonPath) => {
+      if (Array.isArray(value)) {
+        const indexes = selectedIndexes.get(jsonPath);
+        if (target(jsonPath)) return value.flatMap((entry, index) => {
+          const entryPath = `${jsonPath}[${index}]`;
+          if (!indexes?.has(index) && ![...selected].some((key) => key.startsWith(`${entryPath}.`))) return [];
+          return [render(entry, entryPath)];
+        });
+        return value.map((entry, index) => render(entry, `${jsonPath}[${index}]`));
+      }
+      if (!isRecord4(value)) return value;
+      return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, render(child, `${jsonPath}.${key}`)]));
+    };
+    const arrayBytes = (value) => {
+      if (Array.isArray(value)) return Buffer.byteLength(JSON.stringify(value), "utf8");
+      return isRecord4(value) ? Object.values(value).reduce((sum, child) => sum + arrayBytes(child), 0) : 0;
+    };
+    if (!explicit && units.length <= limit && utf8Bytes(original) <= ARRAY_BUDGET) return result;
+    let cursor = Math.min(offset, units.length);
+    let oversized = 0;
+    while (cursor < units.length && selected.size < limit) {
+      const unit = units[cursor];
+      const key = `${unit.path}[${unit.index}]`;
+      selected.add(key);
+      const indexes = selectedIndexes.get(unit.path) ?? /* @__PURE__ */ new Set();
+      indexes.add(unit.index);
+      selectedIndexes.set(unit.path, indexes);
+      if (utf8Bytes(render(displaySource, "$.Data")) > ARRAY_BUDGET - 2048) {
+        selected.delete(key);
+        indexes.delete(unit.index);
+        if (selected.size > 0) break;
+        oversized++;
+      }
+      cursor++;
+    }
+    let data = render(displaySource, "$.Data");
+    data = fitDataBudget(data, ARRAY_BUDGET - 2048);
+    const paths = [...totals.keys()].filter((path28) => !path28.includes("[") || selectedIndexes.has(path28));
+    const shownPaths = paths.slice(0, 50);
+    const arrays = shownPaths.map((path28) => {
+      const returnedCount = new Set([...selected].filter((key) => key.startsWith(`${path28}[`)).map((key) => key.slice(path28.length + 1).split("]")[0])).size;
+      return { path: path28, total: totals.get(path28), returned: returnedCount, omitted: totals.get(path28) - returnedCount };
+    });
+    data.disclosure = {
+      kind: KIND,
+      unit: "leaf-array-entry",
+      offset,
+      limit,
+      total: units.length,
+      returned: selected.size,
+      omitted: units.length - selected.size,
+      hasMore: cursor < units.length,
+      nextOffset: cursor < units.length ? cursor : null,
+      arrayBytes: arrayBytes(data),
+      dataBytes: utf8Bytes(data),
+      dataByteBudget: ARRAY_BUDGET,
+      oversizedEntriesOmitted: oversized,
+      arrays,
+      omittedArrayMetadata: totals.size - shownPaths.length,
+      decisionsUseFullResult: true,
+      displayIsPartial: selected.size < units.length,
+      nextAction: "Repeat the same tool and params with offset=nextOffset; the cursor is over leaf array entries. Or narrow params by exchange_id/data_type (cache-diff also accepts start/end). Never treat this displayed page as complete coverage; retain the full-result coverageStatus/blocksBacktest/assessment and evidence."
+    };
+    return { ...result, content: [{ type: "text", text: JSON.stringify({ ...parsed, Data: data }) }, ...result.content.slice(1)] };
+  } catch {
+    return result;
+  }
+}
+
 // src/ipc-tool-result.ts
 function normalizeResponse(raw) {
   if (raw && typeof raw === "object" && "ErrNo" in raw) return raw;
@@ -24575,6 +24999,8 @@ function annotateSkippedCalculation(tool, result) {
   }
 }
 var FACTOR_DETECT_RESULT_KIND = "factor-detect";
+var FACTOR_REPORT_SECTION_MAX_BYTES = 8 * 1024;
+var FACTOR_REPORT_SECTION_MAX_ITEMS = 10;
 var FACTOR_DETECT_OMIT_KEYS = [
   "ranking",
   "returnsByQuantile",
@@ -24592,6 +25018,48 @@ function pickByPeriod(source, period, index) {
   if (isRecord4(source)) return numberOrNull(source[period]);
   return null;
 }
+function ownPathValue(root2, path28) {
+  const parts = path28.split(".").filter(Boolean);
+  if (parts.length === 0) return { found: false };
+  let current = root2;
+  for (const part of parts) {
+    if (!isRecord4(current) || !Object.prototype.hasOwnProperty.call(current, part)) return { found: false };
+    current = current[part];
+  }
+  return { found: true, value: current };
+}
+function reportPathParent(root2, path28) {
+  const parts = path28.split(".").filter(Boolean);
+  if (parts.length === 0) return void 0;
+  const parentPath = parts.slice(0, -1).join(".");
+  const parent = parentPath ? ownPathValue(root2, parentPath).value : root2;
+  if (!isRecord4(parent)) return void 0;
+  return { path: parentPath, fields: Object.keys(parent) };
+}
+function jsonBytes(value) {
+  return Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+}
+function reportType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function omitUndistillableReport(parsed, data, reportJson, reason, validJson) {
+  const { reportJson: _raw, ...scalars } = data;
+  return {
+    content: [{ type: "text", text: JSON.stringify({
+      ...parsed,
+      Data: {
+        ...scalars,
+        resultKind: FACTOR_DETECT_RESULT_KIND,
+        ...reason === "Invalid report JSON." ? { reportParseError: true } : {},
+        reportParse: { validJson, type: reportType(reportJson) },
+        reportOmitted: { bytes: jsonBytes(reportJson), reason },
+        nextAction: "The report was omitted from the default response. Use includeReport:true only for an explicit raw-evidence request."
+      }
+    }) }]
+  };
+}
 function distillFactorDetectReport(tool, args, result) {
   if (tool.name !== "mcp-factor-detect-detail" || result.isError) return result;
   if (args.includeReport === true) return result;
@@ -24601,14 +25069,58 @@ function distillFactorDetectReport(tool, args, result) {
     if (!isRecord4(parsed) || !isRecord4(parsed.Data)) return result;
     const data = parsed.Data;
     if (data.resultKind === FACTOR_DETECT_RESULT_KIND) return result;
-    if (typeof data.reportJson !== "string" || data.reportJson.length === 0) return result;
+    if (!Object.prototype.hasOwnProperty.call(data, "reportJson")) return result;
+    const rawReport = data.reportJson;
+    if (typeof rawReport !== "string") {
+      return omitUndistillableReport(parsed, data, rawReport, "Valid report JSON is not an object; raw report omitted.", false);
+    }
+    if (rawReport.length === 0) return omitUndistillableReport(parsed, data, rawReport, "Invalid report JSON.", false);
     let report;
     try {
-      report = JSON.parse(data.reportJson);
+      report = JSON.parse(rawReport);
     } catch {
-      return result;
+      return omitUndistillableReport(parsed, data, rawReport, "Invalid report JSON.", false);
+    }
+    if (!isRecord4(report)) return omitUndistillableReport(parsed, data, report, "Valid report JSON is not an object; raw report omitted.", true);
+    const requestedSections = Array.isArray(args.reportSections) ? [...new Set(args.reportSections.filter((section) => typeof section === "string"))].slice(0, FACTOR_REPORT_SECTION_MAX_ITEMS) : [];
+    const reportOffset = Math.max(0, Math.floor(Number(args.reportOffset) || 0));
+    const reportLimit = Math.min(50, Math.max(1, Math.floor(Number(args.reportLimit) || 20)));
+    const reportSections = /* @__PURE__ */ Object.create(null);
+    const unknownReportSections = [];
+    const availableReportFields = /* @__PURE__ */ Object.create(null);
+    const omittedReportSections = [];
+    let disclosedBytes = 0;
+    if (requestedSections.length > 0) {
+      for (const section of requestedSections) {
+        const selected = ownPathValue(report, section);
+        if (selected.found) {
+          const value = selected.value;
+          const total = Array.isArray(value) ? value.length : typeof value === "string" ? Array.from(value).length : void 0;
+          const paged = Array.isArray(value) ? { items: value.slice(reportOffset, reportOffset + reportLimit), total, offset: reportOffset, limit: reportLimit } : typeof value === "string" ? { value: Array.from(value).slice(reportOffset, reportOffset + reportLimit).join(""), total, offset: reportOffset, limit: reportLimit } : { value };
+          const shaped = total !== void 0 ? { ...paged, hasMore: reportOffset + reportLimit < total, ...reportOffset + reportLimit < total ? { nextOffset: reportOffset + reportLimit } : {} } : value;
+          const bytes = jsonBytes(shaped) + jsonBytes(section) + 1;
+          const remainingBytes = FACTOR_REPORT_SECTION_MAX_BYTES - disclosedBytes;
+          if (bytes <= remainingBytes) {
+            reportSections[section] = shaped;
+            disclosedBytes += bytes;
+          } else if (!omittedReportSections.some((item) => item.name === section)) {
+            omittedReportSections.push({
+              name: section,
+              bytes,
+              maxBytes: remainingBytes,
+              reason: "Section exceeds the remaining progressive-disclosure budget; narrow the path or page further."
+            });
+            if (isRecord4(value)) {
+              availableReportFields[section] = Object.keys(value);
+            }
+          }
+        } else if (!unknownReportSections.includes(section)) {
+          unknownReportSections.push(section);
+          const parent = reportPathParent(report, section);
+          if (parent) availableReportFields[parent.path] = parent.fields;
+        }
+      }
     }
-    if (!isRecord4(report)) return result;
     const alphalens = isRecord4(report.alphalens) ? report.alphalens : {};
     const ic = isRecord4(alphalens.ic) ? alphalens.ic : {};
     const periodNames = Array.isArray(alphalens.periods) ? alphalens.periods.filter((p) => typeof p === "string") : [];
@@ -24627,13 +25139,21 @@ function distillFactorDetectReport(tool, args, result) {
     const omittedKeys = {};
     let omittedBytes = 0;
     for (const key of FACTOR_DETECT_OMIT_KEYS) {
-      const source = key in report ? report[key] : alphalens[key];
+      const topLevel = Object.prototype.hasOwnProperty.call(report, key);
+      if (Object.prototype.hasOwnProperty.call(reportSections, topLevel ? key : "alphalens")) continue;
+      const source = topLevel ? report[key] : alphalens[key];
       if (source === void 0) continue;
-      const size = JSON.stringify(source).length;
+      const size = jsonBytes(source);
       omittedKeys[key] = size;
       omittedBytes += size;
     }
     const { reportJson, ...scalars } = data;
+    const disclosedSections = requestedSections.length > 0 ? {
+      reportSections,
+      ...unknownReportSections.length > 0 ? { unknownReportSections } : {},
+      ...Object.keys(availableReportFields).length > 0 ? { availableReportFields } : {},
+      ...omittedReportSections.length > 0 ? { omittedReportSections } : {}
+    } : {};
     return {
       content: [{
         type: "text",
@@ -24652,12 +25172,14 @@ function distillFactorDetectReport(tool, args, result) {
               effective: report.effectivePreprocess ?? null,
               stats: report.preprocessStats ?? null
             },
+            ...disclosedSections,
+            availableReportSections: Object.keys(report),
             reportOmitted: {
               bytes: omittedBytes,
               keys: omittedKeys,
               reason: "Alphalens plot series, not needed to read IC or layered returns."
             },
-            nextAction: "Read IC from periods[]: icMean/icIr with tStat and pValue for the SAME period. A near-zero icMean with |tStat| under 2 and pValue above 0.05 does not support any claim about the factor working \u2014 say so rather than reporting the sign. quantileMean holds the layered returns, verifyPassed the platform's own threshold verdict. The plot series listed in reportOmitted were dropped to keep this readable; pass includeReport:true to get the raw report back (it is over 1 MB and will be truncated)."
+            nextAction: `Read IC from periods[]: icMean/icIr with tStat and pValue for the SAME period. A near-zero icMean with |tStat| under 2 and pValue above 0.05 does not support any claim about the factor working \u2014 say so rather than reporting the sign. quantileMean holds the layered returns, verifyPassed the platform's own threshold verdict. The plot series listed in reportOmitted were dropped to keep this readable; pass reportSections:["path"] with reportOffset/reportLimit to disclose a narrow section or page (the combined disclosure budget is 8 KiB; unavailable fields are listed in availableReportFields), or use includeReport:true only for an explicit raw-evidence request.`
           }
         })
       }]
@@ -24815,7 +25337,7 @@ function buildIpcBody2(tool, args) {
   if (tool.bodyParamKey) {
     return JSON.stringify(args[tool.bodyParamKey] ?? {});
   }
-  return tool.bodyFromParams ? JSON.stringify(stripControlParams(args)) : "{}";
+  return tool.bodyFromParams ? JSON.stringify(stripControlParams(args, tool.name)) : "{}";
 }
 function buildIpcTimeout2(tool, args, defaultTimeout) {
   const declared = Number(tool.timeoutMs);
@@ -24836,9 +25358,24 @@ var CONTROL_PARAMS = [
   "__attemptStartedAtMs",
   "__resultBaseline"
 ];
-function stripControlParams(args) {
+function stripControlParams(args, toolName) {
   const filtered = { ...args };
   for (const key of CONTROL_PARAMS) delete filtered[key];
+  if (toolName && LIST_DISCLOSURE_TOOLS.has(toolName)) {
+    delete filtered.offset;
+    delete filtered.limit;
+    delete filtered.fields;
+  }
+  if (toolName && DATA_DISCLOSURE_TOOLS.has(toolName)) {
+    delete filtered.offset;
+    delete filtered.limit;
+  }
+  if (toolName === "mcp-factor-detect-detail") {
+    delete filtered.includeReport;
+    delete filtered.reportSections;
+    delete filtered.reportOffset;
+    delete filtered.reportLimit;
+  }
   return filtered;
 }
 function applySchemaDefaults(schema, value) {
@@ -24907,11 +25444,11 @@ function cloneDefaultValue(value) {
 
 // src/factor-operations.ts
 var fs21 = __toESM(require("node:fs"), 1);
-var path20 = __toESM(require("node:path"), 1);
+var path21 = __toESM(require("node:path"), 1);
 
 // src/data-result-transforms.ts
 var fs20 = __toESM(require("node:fs"), 1);
-var path19 = __toESM(require("node:path"), 1);
+var path20 = __toESM(require("node:path"), 1);
 var MARKET_ID_TO_NAME = {
   29544: "\u4E0A\u4EA4\u6240(sh)",
   29562: "\u6DF1\u4EA4\u6240(sz)",
@@ -24995,8 +25532,8 @@ function resolveDataRoots(clientRootDir) {
   const cached2 = Date.now() - readAt < DATA_ROOTS_TTL_MS ? dataRootsCache.get(clientRootDir) : void 0;
   if (cached2) return cached2;
   const root2 = clientRootDir.replace(/[\\/]+$/, "");
-  const dcSdk = readJsonFile(path19.join(root2, ...DC_SDK_CONFIG_SEGMENTS));
-  const dcm = readJsonFile(path19.join(root2, ...DCM_CONFIG_SEGMENTS));
+  const dcSdk = readJsonFile(path20.join(root2, ...DC_SDK_CONFIG_SEGMENTS));
+  const dcm = readJsonFile(path20.join(root2, ...DCM_CONFIG_SEGMENTS));
   const engineRoot = normalizeDataRoot(isRecord4(dcSdk?.mdf) ? dcSdk.mdf.path : void 0, root2);
   const downloadRoot = normalizeDataRoot(dcm?.download_home, root2);
   const resolved = Boolean(engineRoot && downloadRoot);
@@ -25066,7 +25603,7 @@ function engineHasHqSeries(engineRoot, series) {
   if (!engineRoot || !series.exchangeId || !HQ_DATA_FAMILIES.has(splitDataTypeToken(series.dataType).family)) {
     return void 0;
   }
-  const dir = path19.join(engineRoot, "hqdata", "his", series.exchangeId, series.dataType);
+  const dir = path20.join(engineRoot, "hqdata", "his", series.exchangeId, series.dataType);
   try {
     return fs20.readdirSync(dir).length > 0;
   } catch (error2) {
@@ -25647,18 +26184,18 @@ function resolveFactorProjectRoot(clientRootDir) {
   if (cached2) return cached2;
   const root2 = clientRootDir.replace(/[\\/]+$/, "");
   const configured = expandSlaveValue(
-    readSlaveProperties(path20.join(root2, ...ZLTAF_CONFIG_SEGMENTS)),
+    readSlaveProperties(path21.join(root2, ...ZLTAF_CONFIG_SEGMENTS)),
     "slave.factor.project-path",
     root2
   );
-  const resolved = configured ? path20.normalize(configured) : path20.join(root2, ...FALLBACK_FACTOR_PROJECT_PATH);
+  const resolved = configured ? path21.normalize(configured) : path21.join(root2, ...FALLBACK_FACTOR_PROJECT_PATH);
   factorProjectRootCache.set(clientRootDir, resolved);
   return resolved;
 }
 function resolveFactorWorkspacePath(clientRootDir, factorId) {
   if (!clientRootDir || !factorId) return void 0;
   const projectRoot = resolveFactorProjectRoot(clientRootDir);
-  return projectRoot ? path20.join(projectRoot, factorId) : void 0;
+  return projectRoot ? path21.join(projectRoot, factorId) : void 0;
 }
 var MODULE_LEVEL_FACTOR_EXPORT = /^(?:(?:async\s+)?def\s+get_factor\s*\(|get_factor\s*=(?!=)|Factor\s*=(?!=))/m;
 function checkFactorSourceLoadable(clientRootDir, factorId) {
@@ -25666,7 +26203,7 @@ function checkFactorSourceLoadable(clientRootDir, factorId) {
   if (!workspacePath) return null;
   let source;
   try {
-    source = fs21.readFileSync(path20.join(workspacePath, "main.py"), "utf8");
+    source = fs21.readFileSync(path21.join(workspacePath, "main.py"), "utf8");
   } catch {
     return null;
   }
@@ -26085,11 +26622,11 @@ async function queryFactorValuesForLatestRecord(tool, args, client2, timeout, se
 
 // src/strategy-operations.ts
 var fs22 = __toESM(require("node:fs"), 1);
-var path21 = __toESM(require("node:path"), 1);
+var path22 = __toESM(require("node:path"), 1);
 var STRATEGY_DOCS_TOOLS = /* @__PURE__ */ new Set(["mcp-create-strategy", "mcp-create-strategy-with-template"]);
 function resolveStrategyDocsPath(clientRootDir) {
   if (!clientRootDir) return void 0;
-  const docsPath = path21.join(
+  const docsPath = path22.join(
     clientRootDir,
     "python",
     "Lib",
@@ -26116,7 +26653,7 @@ function injectDebugRunId(tool, result) {
     const localPath = typeof parsed.Data.localPath === "string" ? parsed.Data.localPath.trim() : "";
     if (!localPath) return result;
     const settings = JSON.parse(
-      fs22.readFileSync(path21.join(localPath, ".vscode", "tradesetting.json"), "utf8")
+      fs22.readFileSync(path22.join(localPath, ".vscode", "tradesetting.json"), "utf8")
     );
     const debugRunId = isRecord4(settings) && typeof settings.backtest_id === "string" ? settings.backtest_id.trim() : "";
     if (!debugRunId) return result;
@@ -26521,7 +27058,7 @@ async function runWaitLoop(lane, client2, timeout, session, control) {
 
 // src/tool-steps.ts
 var fs23 = __toESM(require("node:fs"), 1);
-var path22 = __toESM(require("node:path"), 1);
+var path23 = __toESM(require("node:path"), 1);
 var import_node_crypto3 = require("node:crypto");
 async function executeSteps(steps, client2, initialBody, timeout, repairHint = identityRepairHint, toolName) {
   let body = { ...initialBody };
@@ -26665,7 +27202,7 @@ function preflightCreatedBacktestSource(toolName, body) {
   const runId = typeof body.runId === "string" ? body.runId.trim() : "";
   const codePath = typeof body.codePath === "string" ? body.codePath.trim() : "";
   if (!codePath || !fs23.existsSync(codePath)) return null;
-  const sourcePath = path22.join(codePath, "main.py");
+  const sourcePath = path23.join(codePath, "main.py");
   if (!fs23.existsSync(sourcePath)) return null;
   let source;
   try {
@@ -26814,8 +27351,8 @@ function validateToolCallArguments(tool, args) {
 }
 function validateDataRangeArguments(args) {
   const errors = [];
-  const error2 = (path27, message) => errors.push({ path: path27, message });
-  const input = stripControlParams(args);
+  const error2 = (path28, message) => errors.push({ path: path28, message });
+  const input = stripControlParams(args, "mcp-get-data-range");
   for (const key of Object.keys(input)) {
     if (key !== "params") error2(`$.${key}`, "Unsupported top-level field; query combinations belong in params[]. Date filters are not accepted.");
   }
@@ -26893,7 +27430,11 @@ async function dispatchSpecialTool(tool, args, client2, timeout, session, waitCo
     if (blocked) return blocked;
   }
   if (tool.name === "mcp-get-strategy-list") {
-    return listStrategies(client2, args, timeout, session.repairHint);
+    return shapeListResultDisclosure(
+      tool,
+      args,
+      await listStrategies(client2, args, timeout, session.repairHint)
+    );
   }
   if (tool.name === "mcp-create-strategy") {
     return rejectDuplicateStrategyName(client2, args, timeout, session.repairHint);
@@ -26935,7 +27476,8 @@ function shapeToolResult(tool, args, result, session) {
   const withWorkspace = echoFactorWorkspacePath(tool, skipAware, session.clientRootDir);
   const diagnosed = tool.name === "mcp-factor-calculate-detail" ? diagnoseFactorFailure(withWorkspace) : withWorkspace;
   const distilled = distillFactorDetectReport(tool, args, diagnosed);
-  return injectDebugRunId(tool, injectStrategyDocsHint(tool, distilled, session.docsPath));
+  const enriched = injectDebugRunId(tool, injectStrategyDocsHint(tool, distilled, session.docsPath));
+  return shapeDataResultDisclosure(tool, args, shapeListResultDisclosure(tool, args, enriched));
 }
 function backtestStatusNumber(status) {
   return typeof status === "number" || typeof status === "string" && status.trim() !== "" ? Number(status) : NaN;
@@ -27101,7 +27643,7 @@ function backtestWindowPreflightError(tool, reason, message, details) {
   }, true);
 }
 function isExistingAbsoluteDirectory(value) {
-  if (!value || !path23.isAbsolute(value)) return false;
+  if (!value || !path24.isAbsolute(value)) return false;
   try {
     return fs24.statSync(value).isDirectory();
   } catch {
@@ -27110,7 +27652,7 @@ function isExistingAbsoluteDirectory(value) {
 }
 function readBacktestIdFromCodePath(codePath) {
   try {
-    const tradesettingPath = path23.join(codePath, ".vscode", "tradesetting.json");
+    const tradesettingPath = path24.join(codePath, ".vscode", "tradesetting.json");
     if (!fs24.existsSync(tradesettingPath)) return void 0;
     const parsed = JSON.parse(fs24.readFileSync(tradesettingPath, "utf-8"));
     if (!isRecord4(parsed)) return void 0;
@@ -27580,7 +28122,7 @@ function applyBacktestResultGuards(tool, args, result, states, contexts, activeR
 }
 function readRunResultFile(codePath) {
   try {
-    const resultPath = path23.join(codePath, "log", "result.json");
+    const resultPath = path24.join(codePath, "log", "result.json");
     if (!fs24.existsSync(resultPath)) return null;
     const before = fs24.statSync(resultPath);
     const raw = fs24.readFileSync(resultPath);
@@ -27799,7 +28341,7 @@ function echoResolvedBacktestConfig(tool, args, result, contexts) {
 function hashBacktestSource(codePath) {
   if (!codePath) return void 0;
   try {
-    const sourcePath = path23.join(codePath, "main.py");
+    const sourcePath = path24.join(codePath, "main.py");
     if (!fs24.statSync(sourcePath).isFile()) return void 0;
     return (0, import_node_crypto4.createHash)("sha256").update(fs24.readFileSync(sourcePath)).digest("hex");
   } catch {
@@ -29433,7 +29975,7 @@ function runtimeRecoveryStopData(message, extra = {}, handler = "runtimeStart")
 
 // src/auth-cli.ts
 var fs26 = __toESM(require("node:fs"), 1);
-var path25 = __toESM(require("node:path"), 1);
+var path26 = __toESM(require("node:path"), 1);
 var import_node_crypto5 = require("node:crypto");
 var SOURCE = "zlt-mcp-device-login";
 var IGNORED_API_ENV = /* @__PURE__ */ new Set(["ZLTQUANT_API_KEY", "ZLTQUANT_API_BASE"]);
@@ -29465,14 +30007,14 @@ function buildShowWidgetPayload(s) {
     }
   };
 }
-var root = (e = process.env) => path25.join(resolveZltQuantHome(e), "device-auth-sessions");
+var root = (e = process.env) => path26.join(resolveZltQuantHome(e), "device-auth-sessions");
 function saveDeviceSession(s, e = process.env) {
   if (!validSession(s)) throw new Error("Invalid authentication session");
   const id = (0, import_node_crypto5.randomUUID)();
   fs26.mkdirSync(root(e), { recursive: true, mode: 448 });
   protectPrivatePath(root(e), true);
   fs26.writeFileSync(
-    path25.join(root(e), id + ".json"),
+    path26.join(root(e), id + ".json"),
     JSON.stringify({ authorization: s, expiresAt: s.issuedAt + s.expiresIn * 1e3 }),
     { mode: 384, flag: "wx" }
   );
@@ -29508,7 +30050,7 @@ function authErrorMessage(error2) {
 }
 function sessionPath(id, e = process.env) {
   if (!SESSION_ID.test(id)) throw Error("Invalid authentication session");
-  return path25.join(root(e), id + ".json");
+  return path26.join(root(e), id + ".json");
 }
 function validateAuthSessionId(id) {
   if (!SESSION_ID.test(id)) throw Error("Invalid authentication session");
@@ -29561,7 +30103,8 @@ async function runAuthLogin(o = {}) {
       status: "pending",
       verificationUri: s.verificationUri,
       userCode: s.userCode
-    }) + "\n" : `Open ${s.verificationUri} and enter code ${s.userCode}.
+    }) + "\n" : `Open ${s.verificationUriComplete}
+If needed, visit ${s.verificationUri} and enter code ${s.userCode}.
 `
   );
   return finish(s, e, c, o.json, o.emit !== false);
@@ -29795,7 +30338,7 @@ if (process.argv.length <= 2) {
       const args = parseMcpArgs(options.argsJson, options.argsFile);
       const timeoutMs = parseTimeoutOption(options.timeoutMs, "--timeout-ms");
       const maxTotalTimeoutMs = parseTimeoutOption(options.maxTotalTimeoutMs, "--max-total-timeout-ms");
-      const resultFile = evidence?.resultFile ?? (options.outputJson === void 0 ? void 0 : path26.resolve(options.outputJson));
+      const resultFile = evidence?.resultFile ?? (options.outputJson === void 0 ? void 0 : path27.resolve(options.outputJson));
       stage = "output_prepare";
       if (resultFile !== void 0) outputFd = fs27.openSync(resultFile, "wx");
       stage = "tool_call";
@@ -30028,9 +30571,9 @@ function resolveCliVersion() {
   return resolveCliPackageProvenance().packageVersion;
 }
 function resolveCliPackageProvenance() {
-  let current = path26.dirname(path26.resolve(process.argv[1] || process.cwd()));
+  let current = path27.dirname(path27.resolve(process.argv[1] || process.cwd()));
   for (let depth = 0; depth < 6; depth += 1) {
-    const manifestPath = path26.join(current, "package.json");
+    const manifestPath = path27.join(current, "package.json");
     try {
       const manifest = JSON.parse(fs27.readFileSync(manifestPath, "utf-8"));
       if ((manifest.name === "@zltquant/zlt-mcp" || manifest.name === "zlt-mcp-proxy") && typeof manifest.version === "string") {
@@ -30038,7 +30581,7 @@ function resolveCliPackageProvenance() {
       }
     } catch {
     }
-    const parent = path26.dirname(current);
+    const parent = path27.dirname(current);
     if (parent === current) break;
     current = parent;
   }