freecodego 0.1.7-rc.2.2 → 0.1.7-rc.2.3

package/dist/bootstrap.js

@@ -2,9 +2,9 @@
 import { createRequire as createRequire2 } from "node:module";
 import path, { basename as basename2, delimiter, dirname as dirname2, extname, isAbsolute as isAbsolute2, join as join4, matchesGlob, normalize as normalize2, relative as relative2, resolve as resolve2, sep } from "node:path";
 import { credentialRef as credentialRef2 } from "@deepseek-ai/dsh-credentials";
-import { constants, createCipheriv, createHash as createHash3, createHmac, createPublicKey, publicEncrypt, randomBytes, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { constants, createCipheriv, createHash as createHash3, createHmac, createPublicKey, publicEncrypt, randomBytes, randomUUID as randomUUID4, timingSafeEqual } from "node:crypto";
 import fs, { appendFile, copyFile as copyFile2, mkdir as mkdir4, mkdtemp, open as open2, readFile as readFile3, readdir as readdir2, readlink, realpath, rename as rename3, rm as rm2, stat as stat2, symlink, unlink, writeFile as writeFile3 } from "node:fs/promises";
-import { availableParallelism, homedir, platform as platform2, release, tmpdir } from "node:os";
+import { availableParallelism, homedir, hostname, platform as platform2, release, tmpdir } from "node:os";
 import { deflateRawSync, gunzipSync, inflateRawSync, inflateSync } from "node:zlib";
 import { appendFileSync, chmodSync, constants as constants$1, createWriteStream, existsSync as existsSync2, lstatSync, mkdirSync, mkdtempSync, readFileSync as readFileSync2, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
@@ -16,7 +16,7 @@ import { AttachmentId, requestImageDimensions } from "@deepseek-ai/dsh-attachmen
 import { EventSourceParserStream } from "eventsource-parser/stream";
 
 // packages/freecodego/freecodego-api/lib/index.js
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 var FreeCodeGoMobileAuthClient = class {
   /**
@@ -383,11 +383,21 @@ var HarnessFreeCodeGoCredentialVault = class {
   * it — and erasing the session must not erase what the sign-in form prefills.
   */
   passwordRef;
+  /**
+  * The installation's device identity, kept beside the session pair.
+  *
+  * It is a separate value rather than a field of the pair because it outlives
+  * every rotation: the pair is replaced on each refresh and erased on sign-out,
+  * while this is what makes the next sign-out-and-in land on the same device
+  * row instead of adding one.
+  */
+  deviceRef;
   constructor(credentials, origin) {
     this.credentials = credentials;
     const digest2 = createHash("sha256").update(origin).digest("hex").slice(0, 24).toUpperCase();
     this.ref = credentialRef(`FREECODEGO_SESSION_${digest2}`);
     this.passwordRef = credentialRef(`FREECODEGO_PASSWORD_${digest2}`);
+    this.deviceRef = credentialRef(`FREECODEGO_DEVICE_${digest2}`);
   }
   async load(_origin) {
     const resolved = await this.credentials.resolve(this.ref);
@@ -414,6 +424,22 @@ var HarnessFreeCodeGoCredentialVault = class {
   async deletePassword(_origin) {
     await this.credentials.unset(this.passwordRef);
   }
+  /**
+  * Read this installation's device identity.
+  * @returns the stored identity, or undefined when this machine never named one.
+  */
+  async loadDeviceId(_origin) {
+    const resolved = await this.credentials.resolve(this.deviceRef);
+    const value = resolved === void 0 ? "" : resolved.value.trim();
+    return value === "" ? void 0 : value;
+  }
+  /**
+  * Persist this installation's device identity.
+  * @param deviceId - the identity every later sign-in and rotation presents.
+  */
+  async saveDeviceId(_origin, deviceId) {
+    await this.credentials.set(this.deviceRef, deviceId);
+  }
 };
 var FreeCodeGoAccountCoordinator = class {
   auth;
@@ -421,6 +447,21 @@ var FreeCodeGoAccountCoordinator = class {
   state = { status: "signed-out" };
   pendingMfaToken;
   refreshInFlight;
+  /**
+  * The settled resolution of this installation's device identity.
+  *
+  * Cached as the promise rather than the value so two concurrent sign-ins
+  * cannot each mint an identity and race the vault write; whichever asks first
+  * decides, and every later caller reads the same answer.
+  */
+  deviceIdInFlight;
+  /**
+  * Whether a rotation has already been spent on a pair that states no device.
+  *
+  * Spent at most once per process: a gateway that keeps answering with an
+  * unbound pair must not make every authorized call rotate the session.
+  */
+  unboundSessionRenewed = false;
   /** Set by logout() so an in-flight refresh never writes after the erase. */
   signingOut = false;
   /**
@@ -592,13 +633,75 @@ var FreeCodeGoAccountCoordinator = class {
   * @param signal - aborts the request when the caller cancels.
   * @returns the account state after the issued tokens were stored.
   */
+  /**
+  * This installation's device identity, creating and persisting one on first use.
+  *
+  * The gateway binds a session to the device that opened it and will not serve a
+  * model to a token whose device has no live session, so a sign-in that states
+  * no device is a sign-in the gateway later refuses — every model, every turn.
+  * The identity is therefore resolved once and reused for the life of the
+  * installation, in the same vault as the session pair so a restart keeps it.
+  *
+  * `fcg-<uuid>` mirrors the identity the vendor's own desktop client presents,
+  * which keeps a mixed account's device list readable rather than one scheme per
+  * client.
+  * @returns the stable device id this installation signs in with.
+  */
+  async deviceId() {
+    if (this.deviceIdInFlight === void 0) this.deviceIdInFlight = this.mintDeviceId();
+    return this.deviceIdInFlight;
+  }
+  /**
+  * The identity to sign in with, honoring a device the caller stated.
+  *
+  * A stated device is an assertion about which device this session belongs to,
+  * so it is remembered rather than merely forwarded: the next rotation resolves
+  * the installation identity, and rotating a session onto a different device is
+  * how a working pair stops being accepted.
+  * @param statedDeviceId - the device the caller named, if any.
+  * @returns the identity to present to the gateway.
+  */
+  async deviceIdFor(statedDeviceId) {
+    const stated = statedDeviceId?.trim() ?? "";
+    if (stated === "") return this.deviceId();
+    this.deviceIdInFlight = Promise.resolve(stated);
+    try {
+      await this.vault.saveDeviceId?.(this.auth.origin, stated);
+    } catch {
+    }
+    return stated;
+  }
+  /**
+  * Load the stored identity, or mint one and write it back.
+  *
+  * Both vault failures are recoverable rather than fatal: an unreadable entry is
+  * "no identity yet", and an unwritable one leaves the id live for this process
+  * — the session it binds is still usable, it just will not survive a restart.
+  * @returns the identity to present, stored when the vault accepts it.
+  */
+  async mintDeviceId() {
+    try {
+      const stored = await this.vault.loadDeviceId?.(this.auth.origin);
+      if (stored !== void 0) return stored;
+    } catch {
+    }
+    const created = `fcg-${randomUUID()}`;
+    try {
+      await this.vault.saveDeviceId?.(this.auth.origin, created);
+    } catch {
+    }
+    return created;
+  }
   async login(input, signal) {
     this.pendingRemember = input.remember;
     if (input.rememberPassword === void 0) this.pendingPassword = void 0;
     else if (input.rememberPassword) this.pendingPassword = { keep: input.password };
     else this.pendingPassword = { forget: true };
     try {
-      return await this.consumeLoginResult(await this.auth.login(input, signal));
+      return await this.consumeLoginResult(await this.auth.login({
+        ...input,
+        deviceId: await this.deviceIdFor(input.deviceId)
+      }, signal));
     } catch (error) {
       this.pendingRemember = void 0;
       this.pendingPassword = void 0;
@@ -613,7 +716,10 @@ var FreeCodeGoAccountCoordinator = class {
   async register(input, signal) {
     this.pendingRemember = input.remember;
     try {
-      return await this.consumeLoginResult(await this.auth.register(input, signal));
+      return await this.consumeLoginResult(await this.auth.register({
+        ...input,
+        deviceId: await this.deviceIdFor(input.deviceId)
+      }, signal));
     } catch (error) {
       this.pendingRemember = void 0;
       throw error;
@@ -622,12 +728,13 @@ var FreeCodeGoAccountCoordinator = class {
   /** Complete MFA and store credentials only after the second factor succeeds.
   * @param tempToken - the MFA challenge token the first factor issued.
   * @param totpCode - the code the user's authenticator produced.
-  * @param deviceId - device identifier recorded with the session.
+  * @param deviceId - device identifier recorded with the session; defaults to
+  * this installation's own, without which the session is not bound to a device.
   * @param signal - aborts the request when the caller cancels.
   * @returns the account state after the second factor succeeded.
   */
   async login2FA(tempToken, totpCode, deviceId, signal) {
-    return this.consumeLoginResult(await this.auth.login2FA(tempToken, totpCode, deviceId, signal));
+    return this.consumeLoginResult(await this.auth.login2FA(tempToken, totpCode, await this.deviceIdFor(deviceId), signal));
   }
   /** Complete the pending Host-owned MFA challenge without exposing its temp token.
   * @param totpCode - the code the user's authenticator produced.
@@ -704,7 +811,9 @@ var FreeCodeGoAccountCoordinator = class {
     };
   }
   /** Rotate the stored session token; callers reauthenticate after any failure.
-  * @param deviceId - device identifier recorded with the rotated session.
+  * @param deviceId - device identifier recorded with the rotated session;
+  * defaults to this installation's own, so a rotation never drops the binding
+  * the gateway checks.
   * @param signal - bounds this caller's wait; the shared rotation keeps running.
   */
   async refresh(deviceId, signal) {
@@ -723,7 +832,7 @@ var FreeCodeGoAccountCoordinator = class {
         this.state = { status: "signed-out" };
         return;
       }
-      const exchange = await this.exchangeRefresh(tokens2.refreshToken, deviceId);
+      const exchange = await this.exchangeRefresh(tokens2.refreshToken, await this.deviceIdFor(deviceId));
       if (!exchange.ok) {
         if (this.signingOut) throw exchange.error;
         if (erasableRefreshFailure(exchange.kinds)) {
@@ -786,6 +895,9 @@ var FreeCodeGoAccountCoordinator = class {
       await this.refresh(void 0, signal);
       tokens2 = await this.loadTokens();
       if (tokens2 === void 0) throw new Error("FreeCodeGo authentication is required after token refresh");
+    } else if (this.shouldRenewUnboundSession(tokens2.accessToken)) {
+      await this.refresh(void 0, signal).catch(() => void 0);
+      tokens2 = await this.loadTokens() ?? tokens2;
     }
     try {
       return await operation(tokens2.accessToken, signal);
@@ -801,6 +913,24 @@ var FreeCodeGoAccountCoordinator = class {
     }
   }
   /**
+  * Whether to spend this process's one rotation on a pair that states no device.
+  *
+  * The gateway serves no model to a token whose device has no live session and
+  * answers a device-less token with `401`. That answer is not about the token's
+  * age, so the expiry check above never fires: every turn fails identically for
+  * the whole life of the pair. One rotation repairs it, because refresh() now
+  * states this installation's identity — and the replacement is bound, so this
+  * answers false from then on.
+  * @param accessToken - the stored access token about to be presented.
+  * @returns whether an unbound pair should be rotated before this call.
+  */
+  shouldRenewUnboundSession(accessToken) {
+    if (this.unboundSessionRenewed) return false;
+    if (!tokenStatesNoDevice(accessToken)) return false;
+    this.unboundSessionRenewed = true;
+    return true;
+  }
+  /**
   * Store a token pair issued by an out-of-band flow (browser OAuth) without
   * returning it to the caller.
   *
@@ -948,6 +1078,16 @@ function tokenNeedsRefresh(accessToken) {
     return false;
   }
 }
+function tokenStatesNoDevice(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3) return false;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return typeof payload.device_id !== "string" || payload.device_id.trim() === "";
+  } catch {
+    return false;
+  }
+}
 function isUnauthorized(error) {
   const status = error !== null && typeof error === "object" && "status" in error && typeof error.status === "number" ? error.status : void 0;
   if (status !== void 0) return status === 401;
@@ -1280,6 +1420,47 @@ var FreeCodeGoApiClient = class {
     }), "revoke device session");
     return typeof payload.message === "string" ? payload.message.trim() : "";
   }
+  /**
+  * Read the announcements this account may see.
+  *
+  * The backend decides the audience: an announcement's targeting rules are
+  * applied server-side against the account's balance and subscriptions, so a
+  * row that comes back is one this account is meant to read. `read_at` is the
+  * account's own record, not the client's, which is what lets a dismissal made
+  * on one machine hold on the next.
+  * @param request - the request this call projects from, and whether read rows may be left out.
+  * @returns the visible announcements, newest first as the backend ordered them.
+  */
+  async getAnnouncements(request) {
+    const query2 = request.unreadOnly === true ? "?unread_only=1" : "";
+    return array(await this.authorized(`/api/v1/announcements${query2}`, request), "announcements").map((value, index) => {
+      const item = object(value, `announcements[${index}]`);
+      return {
+        id: finiteNumber(item.id, `announcements[${index}].id`),
+        title: string(item.title, `announcements[${index}].title`),
+        content: typeof item.content === "string" ? item.content : "",
+        notifyMode: announcementNotifyMode(item.notify_mode),
+        ...typeof item.read_at === "string" && item.read_at.trim() !== "" ? { readAt: item.read_at.trim() } : {},
+        ...typeof item.starts_at === "string" && item.starts_at.trim() !== "" ? { startsAt: item.starts_at.trim() } : {},
+        ...typeof item.ends_at === "string" && item.ends_at.trim() !== "" ? { endsAt: item.ends_at.trim() } : {},
+        createdAt: typeof item.created_at === "string" ? item.created_at : ""
+      };
+    });
+  }
+  /**
+  * Record that this account read one announcement.
+  *
+  * The backend owns the record, so closing a notice is an acknowledged fact
+  * rather than a client-side memory: the same announcement stays closed on the
+  * account's other machines, and the administrator's read report counts it.
+  * @param request - the request this call projects from, and the announcement to mark.
+  * @returns nothing; the backend's acknowledgement is not rendered.
+  */
+  async markAnnouncementRead(request) {
+    const id = request.announcementId;
+    if (!Number.isFinite(id) || id <= 0) throw new Error("FreeCodeGo announcement id is required");
+    await this.authorized(`/api/v1/announcements/${encodeURIComponent(String(id))}/read`, request, { method: "POST" });
+  }
   /** Revoke every session of the account and return how many the backend revoked.
   * @param request - the request this call projects from.
   * @returns how many sessions the backend revoked.
@@ -1978,6 +2159,9 @@ function freeAccessFlags(...sources) {
 function channelMonitorStatus(value) {
   return value === "operational" || value === "degraded" || value === "failed" || value === "error" ? value : "unknown";
 }
+function announcementNotifyMode(value) {
+  return value === "popup" ? "popup" : "silent";
+}
 function normalizeBaseUrl(value, allowInsecureLocalhost) {
   let url;
   try {
@@ -2030,7 +2214,7 @@ import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 // packages/freecodego/native-runtime-host/lib/index.js
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
-import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 
 // packages/freecodego/native-runtime-protocol/lib/index.js
 var REDACTED = "<redacted>";
@@ -3096,7 +3280,7 @@ var NativeRuntimeHost = class {
       return Promise.reject(error instanceof Error ? error : new Error(String(error)));
     }
     this.start();
-    const id = randomUUID();
+    const id = randomUUID2();
     const request = {
       id,
       method,
@@ -4752,7 +4936,7 @@ async function openCodexRootRuntime(runtime, options) {
 }
 
 // packages/freecodego/runtime-claude/lib/index.mjs
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir as mkdir3, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join3 } from "node:path";
 import { createSdkMcpServer, query, tool } from "@anthropic-ai/claude-agent-sdk";
@@ -5124,7 +5308,7 @@ var DirectClaudeSdkSession = class DirectClaudeSdkSession2 {
   }
   static async open(runtime, options) {
     await mkdir3(runtime.stateDirectory, { recursive: true });
-    const session = new DirectClaudeSdkSession2(runtime, options, options.nativeSessionId ?? randomUUID2());
+    const session = new DirectClaudeSdkSession2(runtime, options, options.nativeSessionId ?? randomUUID3());
     await options.prepare?.(async () => void 0);
     return session;
   }
@@ -5196,7 +5380,7 @@ var DirectClaudeSdkSession = class DirectClaudeSdkSession2 {
             behavior: "deny",
             message: sandboxDenial
           };
-          const requestId = randomUUID2();
+          const requestId = randomUUID3();
           const pending = this.pending(this.pendingPermissions, requestId);
           this.event("permission/requested", {
             requestId,
@@ -5315,7 +5499,7 @@ var DirectClaudeSdkSession = class DirectClaudeSdkSession2 {
     return promise.promise;
   }
   async askUser(questions) {
-    const requestId = randomUUID2();
+    const requestId = randomUUID3();
     const pending = this.pending(this.pendingQuestions, requestId);
     this.event("question/requested", {
       requestId,
@@ -5324,7 +5508,7 @@ var DirectClaudeSdkSession = class DirectClaudeSdkSession2 {
     return await pending;
   }
   async bridgeCall(bridge, op, input) {
-    const requestId = randomUUID2();
+    const requestId = randomUUID3();
     const pending = this.pending(this.pendingBridges, requestId);
     this.event("bridge/requested", {
       requestId,
@@ -9680,7 +9864,7 @@ var PlanFileStore = class {
   async write(sessionId, body) {
     const file = planFilePath(sessionId);
     await mkdir4(dirname2(file), { recursive: true });
-    const temporary = `${file}.${randomUUID3()}.tmp`;
+    const temporary = `${file}.${randomUUID4()}.tmp`;
     await writeFile3(temporary, body.endsWith("\n") ? body : `${body}
 `, "utf8");
     await rename3(temporary, file);
@@ -12726,6 +12910,11 @@ function mediaCategoryForManagedModel(model) {
   if (protocol === "audio_speech" || protocol === "audio-speech" || protocol === "audio_transcription" || protocol === "audio-transcription") return "audio";
   return inferMediaCategory(`${model.id} ${model.displayName}`);
 }
+function isTextConversationRoute(model, overrides = {}) {
+  const configured = overrides[mediaCategoryOverrideKey(model.provider, model.id)];
+  if (configured !== void 0) return configured === "text";
+  return mediaCategoryForManagedModel(model) === void 0;
+}
 function logfareMediaCategory(model) {
   const endpoints = model.endpoints.join(" ").toLowerCase();
   if (endpoints.includes("image")) return "image";
@@ -17018,7 +17207,7 @@ function cosyBuildPayload(info) {
     cosyVersion: COSY_VERSION,
     ideVersion: "",
     info,
-    requestId: randomUUID3(),
+    requestId: randomUUID4(),
     version: "v1"
   }), "utf8").toString("base64");
 }
@@ -17288,12 +17477,12 @@ function buildQoderChatBody(input, identity, defaults = {}) {
   }
   const prompt = lastUserPrompt(input.messages);
   const maxTokens = input.maxTokens !== void 0 && input.maxTokens > 0 ? input.maxTokens : defaults.defaultMaxTokens ?? 32768;
-  const requestId = randomUUID3();
-  const businessId = randomUUID3();
+  const requestId = randomUUID4();
+  const businessId = randomUUID4();
   const title = prompt.length > 30 ? prompt.slice(0, 30) : prompt;
   return {
     request_id: requestId,
-    request_set_id: randomUUID3(),
+    request_set_id: randomUUID4(),
     chat_record_id: requestId,
     stream: true,
     chat_task: "FREE_INPUT",
@@ -17320,7 +17509,7 @@ function buildQoderChatBody(input, identity, defaults = {}) {
     image_urls: null,
     is_reply: true,
     is_retry: false,
-    session_id: randomUUID3(),
+    session_id: randomUUID4(),
     code_language: "",
     source: 1,
     version: "3",
@@ -20793,7 +20982,9 @@ var FreeCodeGoManagedCatalogs = class {
       },
       inputModalities: imageInputModalities(model.id, model.displayName)
     });
-    const options = managed?.models.flatMap((model) => {
+    const modelCategories = this.deps.settings()?.get()?.modelCategories ?? {};
+    const chatModels = (managed?.models ?? []).filter((model) => isTextConversationRoute(model, modelCategories));
+    const options = chatModels.flatMap((model) => {
       const groupedChoices = model.choices.filter((choice) => choice.groupId !== void 0);
       return groupedChoices.length === 0 ? [] : [{
         model: model.id,
@@ -20813,7 +21004,7 @@ var FreeCodeGoManagedCatalogs = class {
         }))
       }];
     }) ?? [];
-    const rows = expandGroupPinnedModels(managed?.models.map(availabilityRow) ?? [], options).map((model) => {
+    const rows = expandGroupPinnedModels(chatModels.map(availabilityRow), options).map((model) => {
       const pinned = model.__groupLabel !== void 0;
       const name2 = pinned ? `${model.displayName} \xB7 ${model.__groupLabel}` : model.displayName;
       const groupBlock = modelRowGroupBlock(model);
@@ -23022,7 +23213,7 @@ var ClaudeProtocolBridge = class {
   async endpoint(provider, model, reasoningEffort) {
     await this.start();
     this.pruneRoutes();
-    const id = randomUUID3();
+    const id = randomUUID4();
     this.routes.set(id, {
       provider,
       model,
@@ -23042,7 +23233,7 @@ var ClaudeProtocolBridge = class {
   async openAIEndpoint(provider, model) {
     await this.start();
     this.pruneRoutes();
-    const id = randomUUID3();
+    const id = randomUUID4();
     this.routes.set(id, {
       provider,
       model,
@@ -23146,7 +23337,7 @@ var ClaudeProtocolBridge = class {
     writeEvent(writer, "message_start", {
       type: "message_start",
       message: {
-        id: `msg_${randomUUID3()}`,
+        id: `msg_${randomUUID4()}`,
         type: "message",
         role: "assistant",
         model,
@@ -23170,7 +23361,7 @@ var ClaudeProtocolBridge = class {
         index,
         content_block: {
           type: "tool_use",
-          id: call.id ?? `tool_${randomUUID3()}`,
+          id: call.id ?? `tool_${randomUUID4()}`,
           name: call.name ?? "tool",
           input: {}
         }
@@ -23353,8 +23544,8 @@ var ClaudeProtocolBridge = class {
       connection: "keep-alive"
     });
     const writer = new StreamWriter(res);
-    const responseId = `resp_${randomUUID3()}`;
-    const itemId = `msg_${randomUUID3()}`;
+    const responseId = `resp_${randomUUID4()}`;
+    const itemId = `msg_${randomUUID4()}`;
     writeData(writer, {
       type: "response.created",
       response: {
@@ -23416,7 +23607,7 @@ var ClaudeProtocolBridge = class {
         if (call === void 0) {
           call = {
             itemIndex: nextCall++,
-            itemId: `fc_${randomUUID3()}`,
+            itemId: `fc_${randomUUID4()}`,
             id: "",
             name: chunk.name ?? "tool",
             args: "",
@@ -23790,7 +23981,7 @@ async function anthropicMessages(value, resolve3) {
     if (part.type === "tool_use") {
       blocks.push({
         type: "tool-call",
-        id: callId$1(String(part.id ?? randomUUID3())),
+        id: callId$1(String(part.id ?? randomUUID4())),
         name: String(part.name ?? "tool"),
         arguments: JSON.stringify(part.input ?? {})
       });
@@ -23880,7 +24071,7 @@ function toNonStreamingResponse(chunks, model) {
   });
   for (const call of accumulateToolCalls(chunks)) blocks.push({
     type: "tool_use",
-    id: call.id !== "" ? call.id : `tool_${randomUUID3()}`,
+    id: call.id !== "" ? call.id : `tool_${randomUUID4()}`,
     name: call.name,
     input: parseArguments(call.args)
   });
@@ -23888,7 +24079,7 @@ function toNonStreamingResponse(chunks, model) {
   const usage2 = chunks.find((chunk) => chunk.type === "usage")?.usage;
   const stopReason2 = finish?.reason.kind === "tool-calls" ? "tool_use" : finish?.reason.kind === "max-tokens" ? "max_tokens" : finish?.reason.kind === "error" ? "stop_sequence" : "end_turn";
   return {
-    id: `msg_${randomUUID3()}`,
+    id: `msg_${randomUUID4()}`,
     type: "message",
     role: "assistant",
     model,
@@ -23904,7 +24095,7 @@ function toNonStreamingResponse(chunks, model) {
 function toResponsesObject(chunks, model) {
   const text2 = chunks.filter((chunk) => chunk.type === "text-delta").map((chunk) => chunk.text).join("");
   const output = [{
-    id: `msg_${randomUUID3()}`,
+    id: `msg_${randomUUID4()}`,
     type: "message",
     status: "completed",
     role: "assistant",
@@ -23917,10 +24108,10 @@ function toResponsesObject(chunks, model) {
   for (const call of accumulateToolCalls(chunks)) {
     hasCalls = true;
     output.push({
-      id: `fc_${randomUUID3()}`,
+      id: `fc_${randomUUID4()}`,
       type: "function_call",
       status: "completed",
-      call_id: call.id !== "" ? call.id : `call_${randomUUID3()}`,
+      call_id: call.id !== "" ? call.id : `call_${randomUUID4()}`,
       name: call.name,
       arguments: call.args
     });
@@ -23928,7 +24119,7 @@ function toResponsesObject(chunks, model) {
   const finish = chunks.find((chunk) => chunk.type === "finish");
   const usage2 = chunks.find((chunk) => chunk.type === "usage")?.usage;
   return {
-    id: `resp_${randomUUID3()}`,
+    id: `resp_${randomUUID4()}`,
     object: "response",
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     status: hasCalls || finish?.reason.kind !== "error" ? "completed" : "failed",
@@ -24688,7 +24879,7 @@ var GraphifyRuntimeManager = class {
     if (input.packageId === "existing-python" && !existsSync2(resolve2(requestedPython))) throw new Error("\u6307\u5B9A\u7684 Python \u53EF\u6267\u884C\u6587\u4EF6\u4E0D\u5B58\u5728\u3002");
     await this.ensurePrivateDirectory(this.rootDirectory);
     const uv = await this.ensureUv();
-    const staging = join4(this.rootDirectory, `.install-${randomUUID3()}`);
+    const staging = join4(this.rootDirectory, `.install-${randomUUID4()}`);
     await rm2(staging, {
       recursive: true,
       force: true
@@ -24826,8 +25017,8 @@ var GraphifyRuntimeManager = class {
     await this.ensurePrivateDirectory(tools);
     const executable = platform2() === "win32" ? "uv.exe" : "uv";
     const target = join4(tools, executable);
-    const staged = `${target}.${randomUUID3()}`;
-    const archivePath = join4(tools, `.uv-archive-${randomUUID3()}`);
+    const staged = `${target}.${randomUUID4()}`;
+    const archivePath = join4(tools, `.uv-archive-${randomUUID4()}`);
     await downloadVerifiedAsset({
       url: archive.url,
       digest: archive.digest,
@@ -26113,7 +26304,7 @@ var FreeCodeGoCapabilityRegistry = class {
     if (!this.configuration().mcpEnabled) throw new Error("MCP is disabled in FreeCodeGo settings");
     if (!name2.startsWith("mcp__") || !this.mcpTools(agent).some((tool2) => tool2.name === name2)) throw new Error(`MCP tool "${name2}" is not active`);
     const result = await this.ctx.tools.execute({
-      callId: callId2(`freecodego-mcp-${randomUUID3()}`),
+      callId: callId2(`freecodego-mcp-${randomUUID4()}`),
       name: name2,
       arguments: args,
       ...agent === void 0 ? {} : { agent },
@@ -26142,7 +26333,7 @@ var FreeCodeGoCapabilityRegistry = class {
   async executeHarnessTool(agent, name2, args, signal, options = {}) {
     if (!this.harnessTools(agent).some((tool2) => tool2.name === name2)) throw new Error(`Harness tool "${name2}" is not available to this native Agent`);
     const result = await this.ctx.tools.execute({
-      callId: callId2(`freecodego-harness-${randomUUID3()}`),
+      callId: callId2(`freecodego-harness-${randomUUID4()}`),
       name: name2,
       arguments: args,
       ...agent === void 0 ? {} : { agent },
@@ -26551,7 +26742,7 @@ function restoreRedactedMcpSecrets(input, previous) {
 }
 function normalizeMcpServer(input) {
   const server = {
-    id: input.id?.trim() || randomUUID3(),
+    id: input.id?.trim() || randomUUID4(),
     enabled: input.enabled,
     transport: input.transport,
     serverName: input.serverName.trim(),
@@ -26570,7 +26761,7 @@ function normalizeSkillRoot(input) {
   if (configuredPath === "") throw new Error("Skill root path is required");
   if (!isAbsolute2(configuredPath)) throw new Error("Skill root path must be absolute");
   return {
-    id: input.id?.trim() || randomUUID3(),
+    id: input.id?.trim() || randomUUID4(),
     enabled: input.enabled,
     path: resolve2(configuredPath)
   };
@@ -28024,7 +28215,7 @@ async function preparePendingUpdateStartup(profile, marker) {
 }
 async function writePendingUpdateMarker(profile, marker) {
   const file = pendingUpdateMarkerPath(profile);
-  const temporary = `${file}.${randomUUID3()}.tmp`;
+  const temporary = `${file}.${randomUUID4()}.tmp`;
   try {
     await writeFile3(temporary, `${JSON.stringify(marker)}
 `, {
@@ -30589,7 +30780,7 @@ var FreeCodeGoEngineCouncil = class {
         }
         const cwd = parent.session.header.cwd;
         if (cwd === void 0 || cwd.trim() === "") throw new Error("engineering council child requires a workspace-backed parent session");
-        const sessionId = SessionId(randomUUID3());
+        const sessionId = SessionId(randomUUID4());
         const agentOptions = {
           provider: runtime.provider,
           ...runtime.model === void 0 ? {} : { model: runtime.model },
@@ -30995,7 +31186,7 @@ function safeError(error) {
   return redactCredentialShapes2(error instanceof Error ? error.message : String(error));
 }
 function councilId() {
-  return `council_${randomUUID3().replaceAll("-", "")}`;
+  return `council_${randomUUID4().replaceAll("-", "")}`;
 }
 function projectIdFor$3(cwd) {
   return createHash3("sha256").update(resolve2(cwd).replaceAll("\\", "/").toLowerCase()).digest("hex").slice(0, 24);
@@ -31375,7 +31566,7 @@ var EngineeringMemoryStore = class {
     const hash2 = createHash3("sha256").update(`${projectId}\0${title}\0${body}\0${kind}\0${JSON.stringify([...tags].sort())}`).digest("hex");
     const duplicate = database.prepare("SELECT id, title, kind, trust, project_id, body, tags_json, source_engine, created_at FROM engineering_memories WHERE project_id = ? AND content_hash = ? ORDER BY created_at DESC LIMIT 1").get(projectId, hash2);
     if (duplicate !== void 0) return this.detailFor(database, duplicate);
-    const id = `mem_${randomUUID3().replaceAll("-", "")}`;
+    const id = `mem_${randomUUID4().replaceAll("-", "")}`;
     const now = Date.now();
     database.prepare("INSERT INTO engineering_memories(id, project_id, title, kind, trust, body, tags_json, source_engine, created_at, updated_at, content_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").run(id, projectId, title, kind, "draft", body, JSON.stringify(tags), sourceEngine ?? null, now, now, hash2);
     return {
@@ -31403,7 +31594,7 @@ var EngineeringMemoryStore = class {
     const payload = normalizeObservation(input);
     const projectId = projectIdFor$2(payload.cwd);
     const now = Date.now();
-    const id = `out_${randomUUID3().replaceAll("-", "")}`;
+    const id = `out_${randomUUID4().replaceAll("-", "")}`;
     return {
       queued: database.prepare("INSERT OR IGNORE INTO engineering_memory_outbox(id, project_id, generation_key, payload_json, state, attempts, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 0, ?, ?)").run(id, projectId, payload.generation, JSON.stringify(payload), "queued", now, now).changes === 1,
       id
@@ -31494,7 +31685,7 @@ var EngineeringMemoryStore = class {
     const hash2 = createHash3("sha256").update(`${projectId}\0${payload.generation}\0${title}\0${body}`).digest("hex");
     const duplicate = database.prepare("SELECT id, title, kind, trust, project_id, body, tags_json, source_engine, created_at FROM engineering_memories WHERE project_id = ? AND content_hash = ? LIMIT 1").get(projectId, hash2);
     if (duplicate !== void 0) return this.detailFor(database, duplicate);
-    const id = `mem_${randomUUID3().replaceAll("-", "")}`;
+    const id = `mem_${randomUUID4().replaceAll("-", "")}`;
     const now = Date.now();
     database.prepare("INSERT INTO engineering_memories(id, project_id, title, subject, kind, trust, body, tags_json, source_engine, created_at, updated_at, content_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").run(id, projectId, title, subject ?? null, payload.kind, "captured", body, JSON.stringify(payload.tags), payload.sourceEngine ?? null, now, now, hash2);
     const insertSource = database.prepare("INSERT INTO engineering_memory_sources(memory_id, source_index, session_id, event_sequence, event_type, turn, engine, provider, model, files_read_json, files_written_json, captured_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
@@ -31805,7 +31996,7 @@ var EngineeringMemoryStore = class {
   async backup() {
     const database = this.requireDatabase();
     const createdAt = Date.now();
-    const id = `backup_${createdAt}_${randomUUID3().replaceAll("-", "").slice(0, 12)}`;
+    const id = `backup_${createdAt}_${randomUUID4().replaceAll("-", "").slice(0, 12)}`;
     const directory = join4(dirname2(this.databasePath), "backups");
     await mkdir4(directory, {
       recursive: true,
@@ -33026,7 +33217,7 @@ var CodeGraphRuntimeManager = class {
     const archive = codegraphArchive();
     if (archive === void 0) throw new Error("\u5F53\u524D\u7CFB\u7EDF\u6CA1\u6709\u7ECF\u8FC7\u9A8C\u8BC1\u7684 CodeGraph \u5B98\u65B9\u5E73\u53F0\u5305\u3002");
     await ensurePrivateDirectory(this.rootDirectory, "CodeGraph");
-    const staging = join4(this.rootDirectory, `.install-${randomUUID3()}`);
+    const staging = join4(this.rootDirectory, `.install-${randomUUID4()}`);
     await rm2(staging, {
       recursive: true,
       force: true
@@ -33424,7 +33615,7 @@ var EngineeringVerificationJobs = class {
   */
   start(cwd, stages, probes = []) {
     const database = this.requireDatabase();
-    const id = `job_${randomUUID3().replaceAll("-", "")}`;
+    const id = `job_${randomUUID4().replaceAll("-", "")}`;
     const createdAt = Date.now();
     const projectId = projectIdFor$1(cwd);
     database.prepare("INSERT INTO engineering_jobs(id, project_id, kind, state, created_at) VALUES (?, ?, ?, ?, ?)").run(id, projectId, "verification", "queued", createdAt);
@@ -33468,7 +33659,7 @@ var EngineeringVerificationJobs = class {
         const current = this.get(job.id);
         if (current.verification !== void 0) return current.verification;
         if (current.state === "cancelled" || current.state === "interrupted" || current.state === "failed" || current.state === "completed") return {
-          id: `verify_${randomUUID3().replaceAll("-", "")}`,
+          id: `verify_${randomUUID4().replaceAll("-", "")}`,
           checkedAt: Date.now(),
           stages: [{
             id: "scope",
@@ -33590,7 +33781,7 @@ var EngineeringVerificationJobs = class {
       });
       const redacted = (summary2) => redactJobSummary(summary2);
       const view = {
-        id: `verify_${randomUUID3().replaceAll("-", "")}`,
+        id: `verify_${randomUUID4().replaceAll("-", "")}`,
         checkedAt: Date.now(),
         stages: result.stages.map((stage) => ({
           ...stage,
@@ -33843,7 +34034,7 @@ var EngineeringCheckpointStore = class {
       continue;
     }
     const checkpoint = {
-      id: `ckpt_${randomUUID3().replaceAll("-", "").slice(0, 24)}`,
+      id: `ckpt_${randomUUID4().replaceAll("-", "").slice(0, 24)}`,
       label: input.label.slice(0, 160).trim() || "checkpoint",
       createdAt: Date.now(),
       entries,
@@ -34128,7 +34319,7 @@ var EngineeringCheckpointStore = class {
       recursive: true,
       mode: 448
     });
-    const temporary = `${target}.${randomUUID3()}.tmp`;
+    const temporary = `${target}.${randomUUID4()}.tmp`;
     await writeFile3(temporary, content, { mode: 384 });
     try {
       await rename3(temporary, target);
@@ -34378,7 +34569,7 @@ var HunkTracker = class {
     const at2 = input.at ?? Date.now();
     const created = [];
     for (const change of diffLines(before, after)) {
-      const id = randomUUID3();
+      const id = randomUUID4();
       created.push({
         id,
         file,
@@ -41399,7 +41590,7 @@ async function generateVideoWithFallback(host, args, signal) {
   });
 }
 async function writeGeneratedMedia(file, bytes) {
-  const temporary = `${file}.${randomUUID3()}.tmp`;
+  const temporary = `${file}.${randomUUID4()}.tmp`;
   try {
     await fs.writeFile(temporary, bytes, {
       mode: 384,
@@ -41446,7 +41637,7 @@ async function generateAudioWithFallback(host, args, cwd, signal) {
     }
     const directory = path.join(cwd, ".freecodego", "generated-media");
     await fs.mkdir(directory, { recursive: true });
-    const file = path.join(directory, `audio-${Date.now()}-${randomUUID3().slice(0, 8)}.${extension}`);
+    const file = path.join(directory, `audio-${Date.now()}-${randomUUID4().slice(0, 8)}.${extension}`);
     await writeGeneratedMedia(file, bytes);
     const mimeType = contentType.includes("json") || contentType === "" ? `audio/${extension}` : contentType;
     return {
@@ -42454,7 +42645,7 @@ function validatePayloadFiles(files) {
   return { ok: true };
 }
 async function writeStateFile(fs2, path3, text2) {
-  const temp = `${path3}.${randomUUID3()}.tmp`;
+  const temp = `${path3}.${randomUUID4()}.tmp`;
   try {
     await fs2.writeFile(temp, text2);
     await fs2.rename(temp, path3);
@@ -42464,10 +42655,10 @@ async function writeStateFile(fs2, path3, text2) {
   }
 }
 function stagingPath(root) {
-  return join4(root, `.freecodego-staging-${randomUUID3()}`);
+  return join4(root, `.freecodego-staging-${randomUUID4()}`);
 }
 function backupPath(root) {
-  return join4(root, `.freecodego-backup-${randomUUID3()}`);
+  return join4(root, `.freecodego-backup-${randomUUID4()}`);
 }
 async function installSkill(request, fs2 = NODE_INSTALLER_FS) {
   const name2 = validateSkillName(request.payload.name);
@@ -50335,7 +50526,7 @@ var FolderTrustStore = class {
   */
   async write(record3) {
     await mkdir4(dirname2(this.file), { recursive: true });
-    const temporary = `${this.file}.${randomUUID3()}.tmp`;
+    const temporary = `${this.file}.${randomUUID4()}.tmp`;
     await writeFile3(temporary, `${JSON.stringify(record3, null, 2)}
 `, "utf8");
     await rename3(temporary, this.file);
@@ -58618,7 +58809,7 @@ var DEFAULT_REVIEW_PLAN_TOOLS = [
 ];
 async function runReview(deps, options) {
   const now = deps.now ?? Date.now;
-  const newId = deps.newId ?? randomUUID3;
+  const newId = deps.newId ?? randomUUID4;
   const limits = options.budget ?? DEFAULT_REVIEW_BUDGET;
   const signal = options.signal;
   const reviewerName = options.reviewerName ?? "reviewer";
@@ -59399,7 +59590,7 @@ function createSubagentFileReviewer(parent, options = {}) {
       freeCodeGoReadOnly: true
     };
     return wrapChild(await parent.ctx.agents.create({
-      sessionId: SessionId(randomUUID3()),
+      sessionId: SessionId(randomUUID4()),
       meta: {
         cwd,
         parentSession: parent.id,
@@ -60011,6 +60202,28 @@ function upstreamMessage(value, fallback) {
   const message2 = typeof value === "string" ? value.trim() : "";
   return redactCredentialShapes2(message2 === "" ? fallback : message2);
 }
+async function accountAnnouncements(host) {
+  if (host.account === void 0 || host.api === void 0) return [];
+  try {
+    await host.restoreAccount();
+    return await host.account.withAccessToken((accessToken) => host.api.getAnnouncements({ accessToken }));
+  } catch {
+    return [];
+  }
+}
+async function accountMarkAnnouncementRead(host, announcementId) {
+  if (host.account === void 0 || host.api === void 0) return false;
+  try {
+    await host.restoreAccount();
+    await host.account.withAccessToken((accessToken) => host.api.markAnnouncementRead({
+      accessToken,
+      announcementId
+    }));
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function accountStatus(host) {
   if (host.account === void 0 || host.api === void 0) return { status: "backend-not-configured" };
   try {
@@ -60304,13 +60517,38 @@ async function nvidiaSetKey(host, value) {
   host.ctx.emit("llm/adapters-updated");
   return host.nvidiaStatus();
 }
+async function bootstrapDeviceIdentity(host) {
+  try {
+    const deviceId = await host.account?.deviceId();
+    if (deviceId === void 0) return {};
+    const name2 = localDeviceName();
+    return name2 === void 0 ? { deviceId } : {
+      deviceId,
+      deviceName: name2
+    };
+  } catch {
+    return {};
+  }
+}
+function localDeviceName() {
+  try {
+    const name2 = hostname().trim();
+    return name2 === "" ? void 0 : name2;
+  } catch {
+    return;
+  }
+}
 async function backendBootstrap(host) {
   if (host.api === void 0 || host.account === void 0) return { status: "backend-not-configured" };
   try {
     await host.restoreAccount();
+    const identity = await bootstrapDeviceIdentity(host);
     return {
       status: "available",
-      data: toJsonValue2(await host.account.withAccessToken((accessToken) => host.api.getBootstrap({ accessToken })))
+      data: toJsonValue2(await host.account.withAccessToken((accessToken) => host.api.getBootstrap({
+        accessToken,
+        ...identity
+      })))
     };
   } catch (error) {
     return {
@@ -60397,7 +60635,11 @@ async function confirmAccountAuthorization(host, result) {
 async function deviceSessions(host) {
   if (host.api === void 0 || host.account === void 0) throw backendNotConfigured();
   await host.restoreAccount();
-  return host.account.withAccessToken((accessToken) => host.api.getDeviceSessions({ accessToken }));
+  const identity = await bootstrapDeviceIdentity(host);
+  return host.account.withAccessToken((accessToken) => host.api.getDeviceSessions({
+    accessToken,
+    ...identity
+  }));
 }
 async function revokeDeviceSession(host, deviceId) {
   if (host.api === void 0 || host.account === void 0) throw backendNotConfigured();
@@ -60972,7 +61214,7 @@ async function traeStartBrowserLogin(host, realmValue) {
   const loginUrl = buildTraeLoginUrl(identity, traeCallbackUrl(listener.port), realm);
   session = {
     attempt: {
-      state: randomUUID3(),
+      state: randomUUID4(),
       realm,
       loginUrl,
       machineId: identity.machineId,
@@ -75994,6 +76236,8 @@ var FreeCodeGoHarnessPlugin = (() => {
   let _refreshAccount_decorators;
   let _logout_decorators;
   let _deviceSessions_decorators;
+  let _announcements_decorators;
+  let _markAnnouncementRead_decorators;
   let _revokeDeviceSession_decorators;
   let _revokeAllSessions_decorators;
   let _backendCatalog_decorators;
@@ -76226,6 +76470,8 @@ var FreeCodeGoHarnessPlugin = (() => {
       _refreshAccount_decorators = [Remote("accountRefresh")];
       _logout_decorators = [Remote("accountLogout")];
       _deviceSessions_decorators = [Remote("accountDeviceSessions")];
+      _announcements_decorators = [Remote("accountAnnouncements")];
+      _markAnnouncementRead_decorators = [Remote("accountMarkAnnouncementRead")];
       _revokeDeviceSession_decorators = [Remote("accountRevokeDeviceSession")];
       _revokeAllSessions_decorators = [Remote("accountRevokeAllSessions")];
       _backendCatalog_decorators = [Remote("backendCatalog")];
@@ -77935,6 +78181,28 @@ var FreeCodeGoHarnessPlugin = (() => {
         },
         metadata: _metadata
       }, null, _instanceExtraInitializers);
+      __esDecorate(this, null, _announcements_decorators, {
+        kind: "method",
+        name: "announcements",
+        static: false,
+        private: false,
+        access: {
+          has: (obj) => "announcements" in obj,
+          get: (obj) => obj.announcements
+        },
+        metadata: _metadata
+      }, null, _instanceExtraInitializers);
+      __esDecorate(this, null, _markAnnouncementRead_decorators, {
+        kind: "method",
+        name: "markAnnouncementRead",
+        static: false,
+        private: false,
+        access: {
+          has: (obj) => "markAnnouncementRead" in obj,
+          get: (obj) => obj.markAnnouncementRead
+        },
+        metadata: _metadata
+      }, null, _instanceExtraInitializers);
       __esDecorate(this, null, _revokeDeviceSession_decorators, {
         kind: "method",
         name: "revokeDeviceSession",
@@ -82241,7 +82509,7 @@ ${detail.body}`
             ...outcome.fallbackReason === void 0 ? {} : { fallbackReason: outcome.fallbackReason }
           };
         },
-        newSessionId: () => randomUUID3(),
+        newSessionId: () => randomUUID4(),
         callerOf: (exec) => {
           const agent = exec?.agent;
           const cwd = agent?.session?.header?.cwd;
@@ -83868,6 +84136,25 @@ ${plan.text}
       return deviceSessions(this.accountRemotesHost);
     }
     /**
+    * Read the announcements the backend published to this account.
+    *
+    * Read by the notice bar on the chat surface, which polls it — the plugin has
+    * no push channel to the backend, so "in time" means the next poll, not a
+    * socket. An empty list is the answer for a signed-out or unreachable backend.
+    * @returns the visible announcements, in the backend's own order.
+    */
+    async announcements() {
+      return accountAnnouncements(this.accountRemotesHost);
+    }
+    /**
+    * Mark one announcement read for this account, so closing it holds everywhere.
+    * @param announcementId - the announcement the user closed.
+    * @returns whether the backend recorded the read.
+    */
+    async markAnnouncementRead(announcementId) {
+      return accountMarkAnnouncementRead(this.accountRemotesHost, announcementId);
+    }
+    /**
     * Revoke one device session and report the sessions that remain.
     * @param deviceId - id of the device session to revoke.
     * @returns the sessions the account still has.