nolo-cli 0.102.0-alpha.1 → 0.102.1

package/{chunk-6VFARHZW.js → chunk-G53AA7RW.js}

@@ -1,3 +1,8 @@
+import {
+  DEVIN_CONNECT_URL,
+  parseSseDataLineJson,
+  parseSseDataLineObject
+} from "./chunk-OW4APERY.js";
 import {
   applyChatCompletionDelta,
   applyResponsesToolEvent,
@@ -5,13 +10,15 @@ import {
   finalizeResponsesToolCalls,
   flushChatCompletionStream,
   providerHttpFailure,
-  readSseFrames,
-  streamSseDataValues,
   throwIfChatCompletionStreamFailed
-} from "./chunk-ZCYXJSTU.js";
+} from "./chunk-V5OWQOJZ.js";
 import {
-  DEVIN_CONNECT_URL
-} from "./chunk-Q5FJJ6XI.js";
+  readSseFrames
+} from "./chunk-GMZLP5DV.js";
+import {
+  evaluateFileWritePolicy,
+  summarizeToolArguments
+} from "./chunk-CHOZJMJS.js";
 import {
   clipToolText,
   hasImageInRuntimeMessages,
@@ -20,7 +27,7 @@ import {
   resolveHistoricalToolContentCap,
   resolveToolOutputProfile,
   stripImagePartsFromMessages
-} from "./chunk-5H7KJX7J.js";
+} from "./chunk-SEB5HAUU.js";
 import {
   downgradeUnparsableToolCalls,
   hasParsableObjectArguments,
@@ -35,6 +42,7 @@ import {
   finalizeAccumulatedToolCalls
 } from "./chunk-N7J63Q6C.js";
 import {
+  DELETE_SAFETY_RED_LINE,
   TOOL_GUIDED_SECTION_ORDER,
   buildIdentityBlock,
   buildRuntimeGuidanceBlocks,
@@ -46,17 +54,18 @@ import {
   requiresBareImageUrl,
   resolveToolGuidedSections,
   toBareImageUrlMessages
-} from "./chunk-L5UXH3B2.js";
+} from "./chunk-7TKWCTSY.js";
 import {
   convertMessagesToResponsesInput,
   extractReasoningFromResponseOutput,
   extractTextFromResponseOutput,
   extractToolCallsFromResponseOutput,
   getUsageRequestOptions,
+  shouldReplayReasoningContentForOutbound,
   shouldStripReasoningContentForOutbound,
   toOpenAiCompatibleMessages,
   toResponsesTools
-} from "./chunk-PUOC4YRO.js";
+} from "./chunk-M7VLQGQP.js";
 import {
   BRIDGE_STREAM_MAX_CHARS,
   DEFAULT_READ_DIALOG_MAX_RESPONSE_CHARS,
@@ -64,22 +73,14 @@ import {
   applyToolSurfaceConstraints,
   buildDialogReadEnvelope,
   buildNoloWorkspaceCommandArgs,
+  buildNoloWorkspaceOpenAiTools,
   createStreamingDialogReadProjector,
   noloPositiveIntegerString,
   noloStringArg,
   parseNoloWorkspaceToolArguments,
   readTextStreamUpToChars,
   resolveNoloDialogInput
-} from "./chunk-IIVGDG4I.js";
-import {
-  getAntigravityUserAgent,
-  readAntigravityProjectId,
-  resolveAntigravityCloudCodeBaseUrl
-} from "./chunk-UZGQNTVW.js";
-import {
-  buildProviderAuthHeaders,
-  buildProviderExecutionPlan
-} from "./chunk-6OZ36FXI.js";
+} from "./chunk-4YSOUKUR.js";
 import {
   buildDialogFallbackTitleFromUserInput
 } from "./chunk-2MBTWINN.js";
@@ -93,13 +94,12 @@ import {
   resolveEmptyAssistantFallbackMessage,
   resolveEmptyAssistantOutcome,
   resolveTruncatedReasoningTailLog
-} from "./chunk-4OEFYTWL.js";
+} from "./chunk-LKERWYPX.js";
 import {
   COMPACTION_SUMMARY_SCHEMA_VERSION,
   COMPACTION_SUMMARY_SYSTEM_PROMPT,
   buildCompactionMetricsFromPlan,
   buildCompactionUserContent,
-  clipCompactText,
   createProviderCallTimingTracker,
   finalizeProviderCallTiming,
   formatCompactionMetricsLog,
@@ -112,37 +112,36 @@ import {
   resolveCompressionTriggerRatio,
   truncateToolOutputForContext,
   withProviderCallTimingFields
-} from "./chunk-DNCEALKX.js";
+} from "./chunk-7MMSLEPA.js";
+import {
+  clipCompactText
+} from "./chunk-5MMAK75Q.js";
+import {
+  asRecordOrEmpty
+} from "./chunk-KX6YBIHG.js";
 import {
   estimateTokenCount
 } from "./chunk-PSCNXBYA.js";
 import {
   resolveNoloStateDir
-} from "./chunk-ONXOABJR.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
+} from "./chunk-HNGRBWYF.js";
 import {
   buildDialogSummaryLayer
-} from "./chunk-DVINR3PL.js";
+} from "./chunk-HDLLCBRF.js";
 import {
   buildUserResponseLanguageContext
-} from "./chunk-2GRGFCF6.js";
+} from "./chunk-4VJAC32I.js";
 import {
   canonicalizeToolName,
   canonicalizeToolNames
-} from "./chunk-O6OSWFZQ.js";
-import {
-  asRecordOrEmpty
-} from "./chunk-KX6YBIHG.js";
+} from "./chunk-XUWRURDF.js";
 import {
-  asTrimmedNonEmptyStringArray,
-  dialogMessageKey,
-  dialogMessageRange
-} from "./chunk-VMFTFOWF.js";
+  buildProviderAuthHeaders,
+  buildProviderExecutionPlan
+} from "./chunk-27ONFIEY.js";
 import {
-  asOptionalFiniteNumber
-} from "./chunk-WWC7I6TA.js";
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
@@ -150,11 +149,19 @@ import {
   isRecord
 } from "./chunk-KUG52IAP.js";
 import {
-  asTrimmedString
-} from "./chunk-3EUW3WEO.js";
+  asTrimmedNonEmptyStringArray,
+  dialogMessageKey,
+  dialogMessageRange
+} from "./chunk-3AH7LNUB.js";
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
 import {
   asOptionalPositiveFiniteNumber
 } from "./chunk-U6VC4MU4.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
@@ -11900,6 +11907,7 @@ var toQueue = /* @__PURE__ */ dual(2, (self, options) => toQueueArray(self.chann
 var runIntoQueue = /* @__PURE__ */ dual(2, (self, queue) => runIntoQueueArray(self.channel, queue));
 
 // packages/agent-runtime/abortableKernel.ts
+var IDLE_WATCHDOG_SLICES = 20;
 function runAbortableWithTimeout(args2) {
   const taskEffect = Effect_exports.callback(
     (resume) => {
@@ -11935,12 +11943,26 @@ function runAbortableWithTimeout(args2) {
     raced = Effect_exports.raceFirst(taskEffect, abortEffect);
   }
   if (typeof args2.timeoutMs === "number") {
-    const inner = raced;
+    const outer = raced;
     const timeoutMs = args2.timeoutMs;
-    raced = Effect_exports.gen(function* () {
-      const outcome = yield* Effect_exports.timeoutOption(inner, Duration_exports.millis(timeoutMs));
-      return Option_exports.isNone(outcome) ? { kind: "timeout" } : outcome.value;
+    const activityVersion = args2.activityVersion;
+    const idleWatchdog = Effect_exports.gen(function* () {
+      const sliceCount = activityVersion ? IDLE_WATCHDOG_SLICES : 1;
+      const baseSliceMs = Math.max(1, Math.floor(timeoutMs / sliceCount));
+      let idleMs = 0;
+      for (; ; ) {
+        const versionAtSliceStart = activityVersion?.();
+        const sliceMs = Math.max(1, Math.min(timeoutMs - idleMs, baseSliceMs));
+        yield* Effect_exports.sleep(Duration_exports.millis(sliceMs));
+        idleMs += sliceMs;
+        if (activityVersion && activityVersion() !== versionAtSliceStart) {
+          idleMs = 0;
+          continue;
+        }
+        if (idleMs >= timeoutMs) return { kind: "timeout" };
+      }
     });
+    raced = Effect_exports.raceFirst(outer, idleWatchdog);
   }
   return args2.runtime ? args2.runtime.runPromise(raced) : Effect_exports.runPromise(raced);
 }
@@ -12039,26 +12061,6 @@ function createLocalLoopObservationBoundary(initialCallbacks) {
   };
 }
 
-// packages/agent-runtime/fileWritePolicy.ts
-function evaluateFileWritePolicy(args2) {
-  if (args2.sessionApproved) return { permissionDecision: "allow" };
-  return {
-    permissionDecision: "ask",
-    permissionRequest: {
-      id: "permission-file-write-session",
-      tool: args2.tool,
-      action: "file_write",
-      title: "\u786E\u8BA4\u5199\u5165\u6587\u4EF6",
-      body: `\u672C\u4F1A\u8BDD\u9996\u6B21\u5199\u5165\u6587\u4EF6\uFF1A${args2.path}\u3002\u6279\u51C6\u540E\u672C\u4F1A\u8BDD\u540E\u7EED\u5199\u5165\u4E0D\u518D\u9010\u6B21\u786E\u8BA4\u3002`,
-      command: args2.path,
-      suggestedRule: {
-        scope: "session",
-        pattern: { capability: "file_write", target: "session" }
-      }
-    }
-  };
-}
-
 // packages/agent-runtime/toolCallPairing.ts
 function readToolCallId(message) {
   if (typeof message.tool_call_id === "string" && message.tool_call_id) {
@@ -12160,50 +12162,6 @@ function sanitizeToolCallPairing(messages) {
   return output;
 }
 
-// packages/agent-runtime/parseToolArguments.ts
-function parseToolArgumentsJson(raw) {
-  if (!raw?.trim()) return {};
-  try {
-    return asRecordOrEmpty(JSON.parse(raw));
-  } catch {
-    return {};
-  }
-}
-
-// packages/agent-runtime/summarizeToolArguments.ts
-function clip(value, max4 = 240) {
-  return clipCompactText(value, max4);
-}
-function summarizeToolArguments(toolName, rawArgs) {
-  const args2 = parseToolArgumentsJson(rawArgs);
-  const pick = (...keys3) => {
-    for (const key of keys3) {
-      const value = asOptionalTrimmedString(args2[key]);
-      if (value) return value;
-    }
-    return "";
-  };
-  const command = pick("command", "cmd", "runCommand", "executeCommand", "bash");
-  if (command) return clip(command);
-  const query = pick("query", "pattern", "search", "q");
-  if (query) return clip(query);
-  const filePath = pick("filePath", "file_path", "path", "filename", "file");
-  if (filePath) return clip(filePath);
-  const keys2 = Object.keys(args2);
-  if (keys2.length === 0) return "";
-  return clip(
-    keys2.slice(0, 6).map((key) => {
-      const value = args2[key];
-      if (typeof value === "string") return `${key}=${clip(value, 80)}`;
-      if (typeof value === "number" || typeof value === "boolean") {
-        return `${key}=${String(value)}`;
-      }
-      if (Array.isArray(value)) return `${key}[${value.length}]`;
-      return `${key}=${value === null ? "null" : typeof value}`;
-    }).join(" ")
-  );
-}
-
 // packages/agent-runtime/progressGuard.ts
 var DEFAULT_MAX_CONSECUTIVE_IDENTICAL_ROUNDS = 5;
 var DEFAULT_MAX_CONSECUTIVE_STAGNANT_TOOL_ROUNDS = 8;
@@ -12627,6 +12585,13 @@ function isColdResume(history, nowMs) {
 }
 async function maybeAutoCompactLocalHistory(args2) {
   const { adapter, dialogId, history } = args2;
+  const emitPhase = (phase) => {
+    try {
+      args2.onPhase?.(phase);
+    } catch {
+    }
+  };
+  emitPhase({ kind: "validating-context" });
   const unchanged = (decision) => ({
     history,
     compressed: false,
@@ -12722,8 +12687,15 @@ async function maybeAutoCompactLocalHistory(args2) {
   if (!plan.shouldCompress) {
     return projectExisting();
   }
+  emitPhase({ kind: "compaction-start" });
   try {
+    if (args2.abortSignal?.aborted) {
+      throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
+    }
     const provider = await args2.resolveProvider();
+    if (args2.abortSignal?.aborted) {
+      throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
+    }
     const msgsToCompress = plan.msgsToCompress;
     const messagesText = formatMessagesForSummaryWithTruncation(msgsToCompress);
     const fileOpsText = formatFileOperationsFromMessages(
@@ -12735,20 +12707,55 @@ async function maybeAutoCompactLocalHistory(args2) {
       messagesText,
       fileOpsText
     });
-    const result4 = await provider.complete([
-      { role: "system", content: COMPACTION_SUMMARY_SYSTEM_PROMPT },
-      { role: "user", content: promptContent }
-    ]);
+    emitPhase({ kind: "waiting-provider" });
+    const timeoutMs = typeof args2.timeoutMs === "number" && Number.isFinite(args2.timeoutMs) && args2.timeoutMs > 0 ? args2.timeoutMs : void 0;
+    const requestController = new AbortController();
+    let timeoutHandle;
+    let abortListener;
+    const request3 = provider.complete(
+      [{ role: "system", content: COMPACTION_SUMMARY_SYSTEM_PROMPT }, { role: "user", content: promptContent }],
+      { signal: requestController.signal, ...timeoutMs ? { timeoutMs } : {} }
+    ).then(
+      (value) => ({ kind: "done", value }),
+      (error) => ({ kind: "provider-error", error })
+    );
+    const guards = [];
+    if (timeoutMs) guards.push(new Promise((resolve5) => {
+      timeoutHandle = setTimeout(() => {
+        requestController.abort();
+        resolve5({ kind: "timeout" });
+      }, timeoutMs);
+    }));
+    if (args2.abortSignal) guards.push(new Promise((resolve5) => {
+      abortListener = () => {
+        requestController.abort(args2.abortSignal?.reason);
+        resolve5({ kind: "aborted" });
+      };
+      args2.abortSignal?.addEventListener("abort", abortListener, { once: true });
+    }));
+    const outcome = guards.length ? await Promise.race([request3, ...guards]) : await request3;
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+    if (abortListener) args2.abortSignal?.removeEventListener("abort", abortListener);
+    if (outcome.kind !== "done") {
+      const reason = outcome.kind === "timeout" ? "timeout" : outcome.kind === "aborted" ? "aborted" : "provider-error";
+      const detail = outcome.kind === "provider-error" ? outcome.error instanceof Error ? outcome.error.message : String(outcome.error) : reason === "timeout" ? `auto-compaction timed out after ${timeoutMs}ms` : "auto-compaction aborted";
+      throw Object.assign(new Error(detail), { compactionReason: reason });
+    }
+    const result4 = outcome.value;
     const newSummary = typeof result4.content === "string" ? result4.content.trim() : "";
     if (!newSummary) {
       console.warn(
         "[localLoop] auto-compaction produced empty summary; keeping prior projection"
       );
+      const failureReason = "provider-error";
+      emitPhase({ kind: "compaction-failed", reason: failureReason });
       return {
         ...projectExisting(),
         failureMessage: "summary model returned empty content",
+        failureReason,
         decision: {
           outcome: "failed",
+          reason: failureReason,
           detail: "summary model returned empty content"
         }
       };
@@ -12775,6 +12782,7 @@ async function maybeAutoCompactLocalHistory(args2) {
       summaryUsage: result4.usage
     });
     console.log(formatCompactionMetricsLog(metrics));
+    emitPhase({ kind: "compaction-end" });
     return {
       history: projectHistoryWithSummary({
         history,
@@ -12802,10 +12810,13 @@ async function maybeAutoCompactLocalHistory(args2) {
   } catch (error) {
     console.warn("[localLoop] auto-compaction failed:", error);
     const failureMessage = error instanceof Error && error.message ? error.message.slice(0, 200) : String(error).slice(0, 200);
+    const failureReason = error instanceof Error && "compactionReason" in error ? error.compactionReason : "provider-error";
+    emitPhase({ kind: "compaction-failed", reason: failureReason });
     return {
       ...projectExisting(),
       failureMessage,
-      decision: { outcome: "failed", detail: failureMessage }
+      failureReason,
+      decision: { outcome: "failed", reason: failureReason, detail: failureMessage }
     };
   }
 }
@@ -12862,6 +12873,8 @@ function emitLoopEvent(boundary, event, bridge) {
   boundary.emit(bridge ? { event, bridge } : { event });
 }
 var LLM_REQUEST_TIMEOUT = "LLM_REQUEST_TIMEOUT";
+var DEFAULT_LLM_REQUEST_TIMEOUT_MS = 10 * 60 * 1e3;
+var DEFAULT_COMPACTION_TIMEOUT_MS = 60 * 1e3;
 var LOCAL_TURN_ABORTED_CODE = "LOCAL_TURN_ABORTED";
 function buildAbortedError() {
   const error = new Error("local agent turn aborted by user");
@@ -12889,8 +12902,11 @@ async function runAbortableToolTask(input, task, pendingToolName) {
 }
 function resolveLlmRequestTimeoutMs(input) {
   const raw = input.llmRequestTimeoutMs ?? input.timeoutMs;
-  if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return void 0;
-  return raw;
+  return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_LLM_REQUEST_TIMEOUT_MS;
+}
+function resolveCompactionTimeoutMs(input) {
+  const raw = input.compactionTimeoutMs;
+  return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_COMPACTION_TIMEOUT_MS;
 }
 async function runCompleteWithTimeout(args2) {
   const { provider, messages, options, timeoutMs, round, input, boundary, context: context3, providerName, model } = args2;
@@ -12913,6 +12929,7 @@ async function runCompleteWithTimeout(args2) {
       const outcome = await runAbortableWithTimeout({
         task: complete,
         timeoutMs: typeof timeoutMs === "number" ? timeoutMs : void 0,
+        activityVersion: args2.activityVersion,
         abortSignal: input.abortSignal,
         runtime: input.effectRuntime
       });
@@ -12923,7 +12940,7 @@ async function runCompleteWithTimeout(args2) {
       }
       if (outcome.kind === "timeout") {
         const timeoutError = new Error(
-          `LLM request timed out after ${timeoutMs}ms (round ${round})`
+          `LLM request timed out after ${timeoutMs}ms without new output (idle window, round ${round})`
         );
         timeoutError.code = LLM_REQUEST_TIMEOUT;
         throw timeoutError;
@@ -12967,16 +12984,16 @@ async function runCompleteWithTimeout(args2) {
     });
   }
 }
-function clip2(value, max4 = 240) {
+function clip(value, max4 = 240) {
   return clipCompactText(value, max4);
 }
 function projectSafeToolObservationMetadata(metadata) {
   if (!metadata || typeof metadata !== "object") return void 0;
   const safe = {};
   if (typeof metadata.exitCode === "number") safe.exitCode = metadata.exitCode;
-  if (typeof metadata.actionGate === "string") safe.actionGate = clip2(metadata.actionGate, 240);
-  if (typeof metadata.command === "string") safe.command = clip2(metadata.command, 240);
-  if (typeof metadata.path === "string") safe.path = clip2(metadata.path, 240);
+  if (typeof metadata.actionGate === "string") safe.actionGate = clip(metadata.actionGate, 240);
+  if (typeof metadata.command === "string") safe.command = clip(metadata.command, 240);
+  if (typeof metadata.path === "string") safe.path = clip(metadata.path, 240);
   if (typeof metadata.truncated === "boolean") safe.truncated = metadata.truncated;
   if (typeof metadata.byteCount === "number") safe.byteCount = metadata.byteCount;
   if (typeof metadata.lineCount === "number") safe.lineCount = metadata.lineCount;
@@ -12992,7 +13009,7 @@ function summarizeToolResult(content, metadata) {
       const lines = trimmed.split(/\r?\n/).length;
       parts2.push(`${lines} line${lines === 1 ? "" : "s"}`);
       parts2.push(`${trimmed.length} chars`);
-      const tail = clip2(trimmed.slice(-160), 160);
+      const tail = clip(trimmed.slice(-160), 160);
       if (tail) parts2.push(`tail="${tail}"`);
     } else {
       parts2.push("empty");
@@ -13604,6 +13621,9 @@ async function runLocalAgentTurn(input) {
       input.contextBlockScopes
     );
     const mergedContextBlockScopes = [
+      // 删除安全红线：系统层最高优先级约束，位于所有块之前（含身份信息块），
+      // owner 要求常驻「根本提示词」的最顶部（2026-09-26 批量误删事故）。
+      { content: DELETE_SAFETY_RED_LINE, cacheScope: "session" },
       { content: identityBlock, cacheScope: "session" },
       ...guidanceScopes,
       ...callerScopes
@@ -13636,6 +13656,16 @@ async function runLocalAgentTurn(input) {
       }
     }
     let compactionUsage;
+    const emitCompactionPhase = (phase, scope3) => {
+      const atMs = Date.now();
+      if (phase.kind === "validating-context") emitLoopEvent(observationBoundary, { kind: "turn-phase", phase: "validating-context", atMs, compactionScope: scope3 });
+      else if (phase.kind === "compaction-start") {
+        emitLoopEvent(observationBoundary, { kind: "turn-phase", phase: "compacting", atMs, compactionScope: scope3 });
+        emitLoopEvent(observationBoundary, { kind: "compaction-start", atMs, scope: scope3 });
+      } else if (phase.kind === "waiting-provider") emitLoopEvent(observationBoundary, { kind: "turn-phase", phase: "waiting-provider", atMs, compactionScope: scope3 });
+      else if (phase.kind === "compaction-end") emitLoopEvent(observationBoundary, { kind: "compaction-end", atMs, scope: scope3 });
+      else emitLoopEvent(observationBoundary, { kind: "compaction-failed", atMs, scope: scope3, reason: phase.reason });
+    };
     const emitCompactionObservation = (compacted) => {
       const decision = compacted.decision;
       if (decision?.outcome === "skipped") {
@@ -13669,7 +13699,10 @@ async function runLocalAgentTurn(input) {
         model: agentConfig.model,
         resolveProvider: resolveProviderOnce,
         contextWindow,
-        realContextUsagePercent
+        realContextUsagePercent,
+        abortSignal: input.abortSignal,
+        timeoutMs: resolveCompactionTimeoutMs(input),
+        onPhase: (phase) => emitCompactionPhase(phase, "initial")
       });
       history = compacted.history;
       compactionUsage = compacted.usage;
@@ -13775,7 +13808,10 @@ async function runLocalAgentTurn(input) {
           model: agentConfig.model,
           resolveProvider: resolveProviderOnce,
           contextWindow,
-          ...ratio !== void 0 ? { realContextUsagePercent: ratio } : {}
+          ...ratio !== void 0 ? { realContextUsagePercent: ratio } : {},
+          abortSignal: input.abortSignal,
+          timeoutMs: resolveCompactionTimeoutMs(input),
+          onPhase: (phase) => emitCompactionPhase(phase, "in-loop")
         });
         if (compacted.usage) {
           compactionUsage = addOutOfBandUsage(compactionUsage, compacted.usage);
@@ -13845,11 +13881,12 @@ async function runLocalAgentTurn(input) {
         const shouldPassToolEvents = Boolean(
           input.onToolEvent || input.onObservationEvent || input.observationBoundary
         );
+        let llmStreamActivity = 0;
         result4 = await runCompleteWithTimeout({
           provider,
           messages: requestMessages,
           options: {
-            ...typeof input.timeoutMs === "number" ? { timeoutMs: input.timeoutMs } : {},
+            timeoutMs: resolveLlmRequestTimeoutMs(input),
             // 用户取消信号穿进 provider options：providerStreamRetry 据此在
             // 取消后跳过重试，provider 分支（如 antigravity/openai-compatible）
             // 也可把 fetch 绑定到同一信号，实现真正的传输层取消。
@@ -13858,6 +13895,7 @@ async function runLocalAgentTurn(input) {
             // 归到具体对话而不是 chat-proxy 兜底桶。新对话首轮 id 尚未分配。
             ...input.continueDialogId ? { dialogId: input.continueDialogId } : {},
             ...shouldStreamDeltas ? { onTextDelta: (chunk) => {
+              llmStreamActivity += 1;
               partialContent += chunk;
               observationBoundary.emit({
                 kind: "text-delta",
@@ -13867,6 +13905,7 @@ async function runLocalAgentTurn(input) {
               });
             } } : {},
             ...shouldStreamReasoning ? { onReasoningDelta: (chunk) => {
+              llmStreamActivity += 1;
               observationBoundary.emit({
                 kind: "reasoning-delta",
                 chunk,
@@ -13875,6 +13914,7 @@ async function runLocalAgentTurn(input) {
               });
             } } : {},
             ...shouldPassToolEvents ? { onToolEvent: (event) => {
+              llmStreamActivity += 1;
               observationBoundary.emit({
                 kind: "tool-event",
                 event,
@@ -13885,6 +13925,7 @@ async function runLocalAgentTurn(input) {
             ...shouldPassToolEvents ? { toolEventRound: round } : {}
           },
           timeoutMs: resolveLlmRequestTimeoutMs(input),
+          activityVersion: () => llmStreamActivity,
           round,
           input,
           boundary: observationBoundary,
@@ -14356,33 +14397,6 @@ ${reasoningTailLog}
   }
 }
 
-// packages/agent-runtime/kimiUserAgent.ts
-var KIMI_CODE_CLI_VERSION = "0.29.2";
-var KIMI_CODE_USER_AGENT = `kimi-code-cli/${KIMI_CODE_CLI_VERSION} (nolo)`;
-function isKimiEndpoint(url) {
-  return url.includes("api.kimi.com");
-}
-function kimiIdentityHeaders(url) {
-  return isKimiEndpoint(url) ? { "User-Agent": KIMI_CODE_USER_AGENT } : {};
-}
-
-// packages/agent-runtime/sseDataLine.ts
-function parseSseDataLineJson(line) {
-  const trimmed = line.trim();
-  if (!trimmed.startsWith("data:")) return null;
-  const payload = trimmed.slice(5).trim();
-  if (!payload || payload === "[DONE]") return null;
-  try {
-    return JSON.parse(payload);
-  } catch {
-    return null;
-  }
-}
-function parseSseDataLineObject(line) {
-  const parsed = parseSseDataLineJson(line);
-  return parsed && typeof parsed === "object" ? parsed : null;
-}
-
 // packages/integrations/openai/responsesRequestBody.ts
 function buildResponsesRequestBody(body, model) {
   const tools = Array.isArray(body.tools) ? toResponsesTools(body.tools) : void 0;
@@ -14561,6 +14575,7 @@ async function readResponsesSseCompletion(args2) {
 }
 
 // packages/agent-runtime/openAiCompatibleProvider.ts
+var REASONING_REPLAY_PLACEHOLDER = "(reasoning not captured for this turn)";
 function isOpenAiResponsesEndpoint(endpoint) {
   return endpoint.includes("/responses");
 }
@@ -14574,9 +14589,14 @@ function buildOpenAiCompatibleChatCompletionRequest(args2) {
     args2.providerConfig.provider,
     args2.providerConfig.model
   );
+  const shouldReplayReasoning = shouldReplayReasoningContentForOutbound(
+    args2.providerConfig.provider,
+    args2.providerConfig.model
+  );
   const sanitizedMessages = sanitizeForOutbound(args2.messages, args2.tools);
   const messages = toOpenAiCompatibleMessages(sanitizedMessages, {
-    stripReasoningContent: shouldStripReasoning
+    stripReasoningContent: shouldStripReasoning,
+    ...shouldReplayReasoning && !shouldStripReasoning ? { replayReasoningPlaceholder: REASONING_REPLAY_PLACEHOLDER } : {}
   });
   const rawBody = {
     model: args2.providerConfig.model,
@@ -14605,9 +14625,9 @@ function buildOpenAiCompatibleChatCompletionRequest(args2) {
     ...buildProviderAuthHeaders({
       endpoint,
       apiKey: args2.providerConfig.apiKey,
-      apiKeyHeader: args2.providerConfig.apiKeyHeader
-    }),
-    ...kimiIdentityHeaders(endpoint)
+      apiKeyHeader: args2.providerConfig.apiKeyHeader,
+      sessionId: args2.sessionId
+    })
   };
   return {
     url: endpoint,
@@ -14710,7 +14730,8 @@ async function executeOpenAiCompatibleChatCompletion(args2) {
       providerConfig: apiKey2 === args2.providerConfig.apiKey ? args2.providerConfig : { ...args2.providerConfig, apiKey: apiKey2 },
       messages: args2.messages,
       tools: args2.tools,
-      stream: args2.stream
+      stream: args2.stream,
+      sessionId: args2.sessionId
     });
     return args2.fetchImpl(request3.url, {
       ...request3.init,
@@ -15652,132 +15673,6 @@ async function evaluateCapabilityPolicy(capability, normalizedInput, ctx) {
   }
 }
 
-// packages/agent-runtime/localToolPolicy.ts
-var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "deleteSpaces",
-  "updateAgent",
-  "updateSelf",
-  "createAgent"
-]);
-var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "readFile",
-  "writeFile",
-  "editFile",
-  "globFiles",
-  "execShell",
-  "launchProcess",
-  "listProcesses",
-  // ProcessTask follow-up tools. Same tier as listProcesses: they observe/stop
-  // tasks the agent itself already spawned, so their blast radius is strictly
-  // narrower than launchProcess (which is default-enabled). Model-facing
-  // follow-ups are taskWait/taskStop only — lifecycle history (taskLogs) stays
-  // runtime-internal.
-  "taskWait",
-  "taskStop",
-  // Scheduling tools: forking/observing sub-agents is a declared capability
-  // of capable agents, and the blast radius is strictly narrower than
-  // execShell (already default-enabled). Requiring an env allowlist for these
-  // while execShell is open by default inverted the risk model and forced every
-  // new local user to hand-edit .env files before sub-agent tasks worked.
-  "startAgentRun",
-  "controlAgentRun"
-]);
-function parseToolAllowlist(value) {
-  return (value ?? "").split(",").flatMap((item) => {
-    const trimmed = item.trim();
-    return trimmed ? [trimmed] : [];
-  });
-}
-function normalizeLocalToolName(toolName) {
-  return canonicalizeToolName(
-    String(toolName ?? "").replace(/^functions\./, "").trim()
-  );
-}
-function isRestrictedLocalToolMode(env) {
-  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
-}
-function resolveLocalToolPolicy(args2) {
-  const toolName = normalizeLocalToolName(args2.toolName);
-  const restrictedMode = isRestrictedLocalToolMode(args2.env);
-  if (!toolName) {
-    return {
-      allowed: false,
-      toolName,
-      reason: "Tool name is required."
-    };
-  }
-  if (NEVER_LOCAL_TOOLS.has(toolName)) {
-    return {
-      allowed: false,
-      toolName,
-      reason: `${toolName} is blocked by the local runtime safety policy.`
-    };
-  }
-  const allowedByEnv = new Set(parseToolAllowlist(args2.env.NOLO_LOCAL_ALLOWED_TOOLS));
-  const agentTools = new Set(
-    (args2.agentToolNames ?? []).flatMap((item) => {
-      const normalized = normalizeLocalToolName(item);
-      return normalized ? [normalized] : [];
-    })
-  );
-  if (!restrictedMode && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  return {
-    allowed: false,
-    toolName,
-    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
-  };
-}
-async function executeLocalToolWithPolicy(args2) {
-  if (args2.runToolNames !== void 0 && !args2.runToolNames.includes(normalizeLocalToolName(args2.call.name))) {
-    throw new Error(`${args2.call.name} is outside the final run tool surface.`);
-  }
-  const decision = resolveLocalToolPolicy({
-    env: args2.env,
-    agentToolNames: args2.agentToolNames,
-    toolName: args2.call.name
-  });
-  if (!decision.allowed) throw new Error(decision.reason);
-  const executor = args2.executors?.[decision.toolName];
-  if (!executor) {
-    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
-  }
-  const opts = {
-    ...args2.abortSignal ? { abortSignal: args2.abortSignal } : {},
-    ...args2.detachMs !== void 0 ? { detachMs: args2.detachMs } : {},
-    ...args2.confirmed !== void 0 ? { confirmed: args2.confirmed } : {},
-    ...args2.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args2.enableDestructiveShellGuard } : {},
-    ...args2.confirmDestructiveAction ? { confirmDestructiveAction: args2.confirmDestructiveAction } : {},
-    ...args2.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args2.blockDestructiveWithoutConfirmation } : {}
-  };
-  if (decision.toolName === "execShell") {
-    let parsedInput = args2.call.arguments;
-    if (typeof parsedInput === "string") {
-      try {
-        parsedInput = JSON.parse(parsedInput);
-      } catch {
-        parsedInput = { command: parsedInput };
-      }
-    }
-    await evaluateExecShellDestructiveGuard(parsedInput, opts);
-    opts.confirmed = true;
-  }
-  return executor(
-    {
-      ...args2.call,
-      name: decision.toolName
-    },
-    opts
-  );
-}
-
 // packages/agent-runtime/localWorkspaceTools.ts
 import { existsSync as existsSync3 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
@@ -16576,29 +16471,6 @@ function getProcessRegistry() {
   return registry;
 }
 
-// packages/agent-runtime/processOwnership.ts
-var asNonEmptyString = (value) => {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed ? trimmed : null;
-};
-function readProcessOwner(runtimeContext) {
-  if (!runtimeContext || typeof runtimeContext !== "object") return null;
-  const dialogId = asNonEmptyString(runtimeContext.dialogId) ?? asNonEmptyString(runtimeContext.parentThreadId);
-  if (!dialogId) return null;
-  const turnId = asNonEmptyString(runtimeContext.turnId);
-  const ownerId = asNonEmptyString(runtimeContext.ownerId);
-  return {
-    dialogId,
-    ...turnId ? { turnId } : {},
-    ...ownerId ? { ownerId } : {}
-  };
-}
-
-// packages/agent-runtime/workspaceShell.ts
-import { resolve as resolve3 } from "node:path";
-import { spawn as spawnChildProcess2 } from "node:child_process";
-
 // packages/agent-runtime/processTaskResult.ts
 var PROCESS_RESULT_CAPSULE_TAIL_CHARS = 4e3;
 var PROCESS_RESULT_CAPSULE_SPILL_THRESHOLD_CHARS = 2e4;
@@ -16618,11 +16490,17 @@ function buildProcessTaskResultCapsule(args2) {
   const exitCode = args2.exitCode;
   const captureError = args2.captureError?.trim() || void 0;
   const durationMs = typeof args2.startedAt === "number" && Number.isFinite(args2.startedAt) ? Math.max(0, (args2.endedAt ?? Date.now()) - args2.startedAt) : void 0;
-  const stdoutTail = tailText(stdout, tailChars);
-  const stderrTail = tailText(stderr, tailChars);
+  const stdoutProvenance = args2.streamProvenance?.stdout;
+  const stderrProvenance = args2.streamProvenance?.stderr;
+  const ringEvicted = Boolean(stdoutProvenance?.evicted || stderrProvenance?.evicted);
+  const stdoutTailSource = typeof args2.stdoutTail === "string" ? args2.stdoutTail : stdout;
+  const stderrTailSource = typeof args2.stderrTail === "string" ? args2.stderrTail : stderr;
+  const stdoutTail = tailText(stdoutTailSource, tailChars);
+  const stderrTail = tailText(stderrTailSource, tailChars);
   const inlineSize = stdout.length + stderr.length;
   const inlineTruncated = stdoutTail.truncated || stderrTail.truncated;
-  const shouldSpill = inlineTruncated || inlineSize > spillThresholdChars;
+  const truncated = inlineTruncated || ringEvicted || Boolean(captureError);
+  const shouldSpill = truncated || inlineSize > spillThresholdChars;
   let spill;
   if (shouldSpill) {
     try {
@@ -16636,8 +16514,11 @@ function buildProcessTaskResultCapsule(args2) {
       });
       spill = {
         displayPath: result4.displayPath,
-        totalChars: result4.totalChars,
-        totalLines: result4.totalLines
+        // Prefer the caller's live provenance counters: they count every
+        // byte of the original stream, while the buffered content above may
+        // be a capped prefix of it.
+        totalChars: (stdoutProvenance?.totalChars ?? stdout.length) + (stderrProvenance?.totalChars ?? stderr.length),
+        totalLines: (stdoutProvenance?.totalLines ?? countLines(stdout)) + (stderrProvenance?.totalLines ?? countLines(stderr))
       };
     } catch {
     }
@@ -16648,27 +16529,48 @@ function buildProcessTaskResultCapsule(args2) {
     exitCode,
     ...durationMs !== void 0 ? { durationMs } : {},
     ...captureError ? { captureError } : {},
-    truncated: inlineTruncated || Boolean(captureError),
+    truncated,
     ...spill ? { spill } : {}
   };
 }
 
-// packages/agent-runtime/workspaceShell.ts
-var EXEC_SHELL_TIMEOUT_ENV = "NOLO_EXEC_SHELL_TIMEOUT_MS";
-var EXEC_SHELL_DETACH_ENV = "NOLO_EXEC_SHELL_DETACH_MS";
-var DEFAULT_EXEC_SHELL_DETACH_MS = 12e4;
-function readTrimmedString(value) {
-  return asOptionalTrimmedString(value);
-}
-function extractActivityRefs(rawRefs) {
-  if (!Array.isArray(rawRefs)) return void 0;
-  const refs = rawRefs.flatMap((entry) => {
-    if (typeof entry === "string" && entry.trim()) {
-      return [{ type: "file", path: entry.trim() }];
-    }
-    if (!isRecord(entry)) return [];
-    const path = readTrimmedString(entry.path);
-    if (path) return [{ type: "file", path }];
+// packages/agent-runtime/processOwnership.ts
+var asNonEmptyString = (value) => {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+};
+function readProcessOwner(runtimeContext) {
+  if (!runtimeContext || typeof runtimeContext !== "object") return null;
+  const dialogId = asNonEmptyString(runtimeContext.dialogId) ?? asNonEmptyString(runtimeContext.parentThreadId);
+  if (!dialogId) return null;
+  const turnId = asNonEmptyString(runtimeContext.turnId);
+  const ownerId = asNonEmptyString(runtimeContext.ownerId);
+  return {
+    dialogId,
+    ...turnId ? { turnId } : {},
+    ...ownerId ? { ownerId } : {}
+  };
+}
+
+// packages/agent-runtime/workspaceShell.ts
+import { resolve as resolve3 } from "node:path";
+import { spawn as spawnChildProcess2 } from "node:child_process";
+var EXEC_SHELL_TIMEOUT_ENV = "NOLO_EXEC_SHELL_TIMEOUT_MS";
+var EXEC_SHELL_DETACH_ENV = "NOLO_EXEC_SHELL_DETACH_MS";
+var DEFAULT_EXEC_SHELL_DETACH_MS = 12e4;
+function readTrimmedString(value) {
+  return asOptionalTrimmedString(value);
+}
+function extractActivityRefs(rawRefs) {
+  if (!Array.isArray(rawRefs)) return void 0;
+  const refs = rawRefs.flatMap((entry) => {
+    if (typeof entry === "string" && entry.trim()) {
+      return [{ type: "file", path: entry.trim() }];
+    }
+    if (!isRecord(entry)) return [];
+    const path = readTrimmedString(entry.path);
+    if (path) return [{ type: "file", path }];
     const terminalId = readTrimmedString(entry.id);
     const terminalLabel = readTrimmedString(entry.label);
     if (entry.type === "terminal" || terminalId || terminalLabel) {
@@ -17522,13 +17424,169 @@ function runTasks(args2) {
   return { tasks, count: tasks.length };
 }
 
+// packages/agent-runtime/execShellCompletionWarnings.ts
+var BG_ESCAPE_WORD_PATTERN = /(?:^|[\s;|(&/\\])(nohup|disown|setsid|start-process)(?=$|[\s;|)&])/i;
+var SHELL_SPLIT_CHARS = /* @__PURE__ */ new Set([";", "|", "&", "(", ")", "<", ">", "\n", "	", " "]);
+function maskQuotedAndEscaped(command) {
+  const out = Array.from(command);
+  let quote = null;
+  for (let i = 0; i < out.length; i += 1) {
+    const ch = out[i];
+    if (quote) {
+      out[i] = " ";
+      if (ch === "\\" && quote !== "'") {
+        if (i + 1 < out.length) out[i + 1] = " ";
+        i += 1;
+      } else if (ch === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (ch === "\\") {
+      out[i] = " ";
+      if (i + 1 < out.length) out[i + 1] = " ";
+      i += 1;
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === "`") {
+      quote = ch;
+      out[i] = " ";
+      continue;
+    }
+    if (ch === "#" && (i === 0 || /[\s;]/.test(out[i - 1] ?? " "))) {
+      while (i < out.length && out[i] !== "\n") {
+        out[i] = " ";
+        i += 1;
+      }
+    }
+  }
+  return out.join("");
+}
+function readRedirectTarget(original, start) {
+  let i = start;
+  while (i < original.length && /\s/.test(original[i] ?? "")) {
+    i += 1;
+  }
+  if (i >= original.length) return void 0;
+  let text = "";
+  let j = i;
+  while (j < original.length) {
+    const o = original[j];
+    if (o === "'" || o === '"' || o === "`") {
+      const quote = o;
+      j += 1;
+      while (j < original.length && original[j] !== quote) {
+        if (original[j] === "\\" && quote !== "'" && j + 1 < original.length) {
+          text += original[j + 1];
+          j += 2;
+          continue;
+        }
+        text += original[j];
+        j += 1;
+      }
+      j += 1;
+      continue;
+    }
+    if (/\s/.test(o) || SHELL_SPLIT_CHARS.has(o)) break;
+    text += o;
+    j += 1;
+  }
+  if (!text || text === "$") return void 0;
+  return { text, end: j };
+}
+function isIgnoredRedirectTarget(target) {
+  return target === "/dev/null";
+}
+function detectExecShellSynchronousWarnings(command, shell) {
+  const masked = maskQuotedAndEscaped(command);
+  const isPowerShell = shell?.resolvedShell === "powershell";
+  const redirectTargets = [];
+  let backgrounded = false;
+  let i = 0;
+  while (i < masked.length) {
+    const ch = masked[i];
+    if (ch === "&") {
+      const next = masked[i + 1];
+      if (next === "&") {
+        i += 2;
+        continue;
+      }
+      if (next === ">") {
+        let j = i + 2;
+        if (masked[j] === ">") j += 1;
+        const target = readRedirectTarget(command, j);
+        if (target && !isIgnoredRedirectTarget(target.text)) redirectTargets.push(target.text);
+        i = target ? target.end : j;
+        continue;
+      }
+      const prev = masked[i - 1];
+      if (prev === ">" || prev === "<") {
+        i += 1;
+        continue;
+      }
+      if (isPowerShell) {
+        i += 1;
+        continue;
+      }
+      backgrounded = true;
+      i += 1;
+      continue;
+    }
+    if (ch === ">") {
+      const prev = masked[i - 1];
+      if (prev === ">" || prev === "&" || prev === "<") {
+        i += 1;
+        continue;
+      }
+      let j = i + 1;
+      if (masked[j] === ">") j += 1;
+      if (masked[j] === "&") {
+        const ampTarget = readRedirectTarget(command, j + 1);
+        const isFdDuplication = ampTarget !== void 0 && (/^\d+$/.test(ampTarget.text) || ampTarget.text === "-");
+        if (ampTarget && !isFdDuplication && !isIgnoredRedirectTarget(ampTarget.text)) {
+          redirectTargets.push(ampTarget.text);
+        }
+        i = ampTarget ? ampTarget.end : j + 1;
+        continue;
+      }
+      const target = readRedirectTarget(command, j);
+      if (target && !isIgnoredRedirectTarget(target.text)) redirectTargets.push(target.text);
+      i = target ? target.end : j;
+      continue;
+    }
+    if (ch === "<") {
+      i += masked[i + 1] === "<" || masked[i + 1] === "&" ? 2 : 1;
+      continue;
+    }
+    i += 1;
+  }
+  const wordMatch = BG_ESCAPE_WORD_PATTERN.exec(masked);
+  if (wordMatch) backgrounded = true;
+  const warnings = [];
+  if (redirectTargets.length > 0) {
+    const target = redirectTargets[0];
+    warnings.push({
+      kind: "output-redirect",
+      redirectTarget: target,
+      message: `[wake-safety] This execShell call completed synchronously; its output was redirected to ${target}. That file is NOT delivered by any completion notification \u2014 no tracked background task was created. If you need the result, read that file in this turn.`
+    });
+  }
+  if (backgrounded) {
+    warnings.push({
+      kind: "shell-backgrounding",
+      message: `[wake-safety] Detected shell-internal backgrounding (lone \`&\`, nohup/disown/setsid/Start-Process or similar). Descendant processes are NOT tracked as platform tasks and will not produce completion notifications; text such as \`LAUNCHED\` printed by the command is plain stdout, not a platform receipt.`
+    });
+  }
+  return warnings;
+}
+
 // packages/agent-runtime/capabilities/execShellCapability.ts
 function buildExecShellToolDefinition(toolName = "execShell") {
   return {
     type: "function",
     function: {
       name: toolName,
-      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess. On Windows the resolved shell may be Windows PowerShell 5.1 (metadata.shellKind="powershell5"): it does not support '&&'/'||' or $PSStyle \u2014 join commands with ';' or split into multiple calls. metadata.shellKind="pwsh" means PowerShell 7+ with full syntax. Read resolvedShell/shellKind from any execShell result before writing Windows-specific syntax.`,
+      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess. On Windows the resolved shell may be Windows PowerShell 5.1 (metadata.shellKind="powershell5"): it does not support '&&'/'||' or $PSStyle \u2014 join commands with ';' or split into multiple calls. metadata.shellKind="pwsh" means PowerShell 7+ with full syntax. Read resolvedShell/shellKind from any execShell result before writing Windows-specific syntax. LIFECYCLE CONTRACT (misreading this contract silenced a real dialog for 10 hours): (1) A normal command waits synchronously for at most 120 seconds; if it ends inside that window the call IS finished \u2014 a result containing exitCode means the command has already completed, never "still running". (2) Only a result with metadata.detached === true AND a taskId represents a tracked background task that may trigger completion wake-up (terminal completion turn carrying a bounded result capsule); that handle may be waited on with taskWait and will produce a completion notification. (3) Text the command itself prints (LAUNCHED, STARTED, BACKGROUND, ...) is plain stdout with zero lifecycle meaning \u2014 never read it as a platform receipt. (4) Shell-level backgrounding (\`&\`, nohup, disown, setsid, self-daemonizing scripts, PowerShell Start-Process) is NOT tracked: those descendants produce no completion notification, and the outer shell finishing tells you nothing about them. Use background: true to turn a finite job into a tracked background task immediately. When a synchronous result's core output was redirected to a file, read that file in the SAME turn \u2014 never end the turn promising a later automatic report without a taskId.`,
       parameters: {
         type: "object",
         properties: {
@@ -17539,6 +17597,10 @@ function buildExecShellToolDefinition(toolName = "execShell") {
           cmd: {
             type: "string",
             description: "Compatibility alias for command."
+          },
+          background: {
+            type: "boolean",
+            description: "Immediately detach this command into a tracked background task (no 120s synchronous wait): returns {detached: true, taskId}, and on completion the platform resumes this conversation with a bounded result capsule (exitCode, duration, stdout/stderr tail). Default false. Use for finite jobs (tests, builds, batch) whose result you need later; NOT for dev servers/watchers \u2014 use launchProcess for those."
           }
         }
       }
@@ -17579,11 +17641,13 @@ function normalizeExecShellInput(input) {
       throw new Error("execShell requires a non-empty command.");
     }
     const activity = extractActivity(record);
+    const background = record.background === true || typeof record.background === "string" && record.background.trim().toLowerCase() === "true";
     return {
       command,
       ...record.shell !== void 0 ? { shell: record.shell } : {},
       ...activity ? { activity } : {},
-      ...record.input !== void 0 ? { input: record.input } : {}
+      ...record.input !== void 0 ? { input: record.input } : {},
+      ...background ? { background: true } : {}
     };
   }
   throw new Error("execShell requires a non-empty command.");
@@ -17621,6 +17685,7 @@ var execShellCapability = {
       command,
       shell: normalized.shell
     });
+    const background = normalized.background === true;
     const result4 = await runWorkspaceCommand({
       workspaceRoot,
       command: shellPlan.argv,
@@ -17628,15 +17693,18 @@ var execShellCapability = {
       outputLimit: ctx.commandOutputLimit,
       commandPrefix: ctx.commandPrefix,
       abortSignal: ctx.abortSignal,
-      detachMs: isImmediateDetachShellCommand({ command }) ? 0 : ctx.detachMs,
+      detachMs: background ? 0 : isImmediateDetachShellCommand({ command }) ? 0 : ctx.detachMs,
       stdin: typeof normalized.input === "string" ? normalized.input : void 0,
       // Ownership of the turn that invoked this command: an auto-detached
       // command keeps its parent dialog so its terminal can resume that
       // conversation (see processOwnership.ts). Absent ctx.owner = unowned.
       owner: ctx.owner ?? null
     });
+    const warnings = result4.detached || result4.spawnFailed ? [] : detectExecShellSynchronousWarnings(command, {
+      resolvedShell: shellPlan.resolvedShell
+    });
     return {
-      content: result4.content,
+      content: warnings.length > 0 ? [result4.content, ...warnings.map((warning) => warning.message)].join("\n\n") : result4.content,
       metadata: {
         command,
         exitCode: result4.exitCode,
@@ -17651,8 +17719,21 @@ var execShellCapability = {
           // Phase 0: stable taskId from the pre-registered Execution
           // Envelope (additive; existing detached fields untouched).
           taskId: result4.taskId,
-          status: "running"
-        } : {},
+          status: "running",
+          // P0 machine-readable execution state: an explicit positive
+          // signal instead of requiring the model to infer "not detached"
+          // from absence. Mirrors the real lifecycle contract.
+          executionState: "detached",
+          trackedBackgroundTask: true,
+          completionNotification: "terminal-resume"
+        } : {
+          // P0 machine-readable execution state: the command already
+          // finished inside the synchronous window; no background task
+          // exists, so no completion notification will ever arrive.
+          executionState: "synchronous-complete",
+          trackedBackgroundTask: false,
+          completionNotification: "none"
+        },
         ...normalized.activity ? { activity: normalized.activity } : {}
       }
     };
@@ -17868,7 +17949,7 @@ function buildLaunchProcessTool() {
     type: "function",
     function: {
       name: "launchProcess",
-      description: "Start a long-running background process (dev server, watcher, REPL) and return immediately with {pid, label, status}. Use listProcesses to inspect or stop it.",
+      description: "Start a long-running ambient background process (dev server, watcher, REPL) and return immediately with {pid, label, taskId, status}. Real boundaries: this registers a tracked background task, but completion does NOT automatically start a new turn \u2014 the process is intentionally notice-only (an exited dev server must not silently burn a model turn). When it reaches a terminal state the bounded result (exitCode, duration, stdout/stderr tail) is recorded and surfaced as a notice injected only on your next real turn in the same conversation. Use listProcesses to inspect, taskWait to block for its terminal state, or taskStop to stop it. For a finite job (tests, builds, batch) whose result must resume the conversation automatically, use execShell with background: true instead.",
       parameters: {
         type: "object",
         properties: {
@@ -18654,6 +18735,87 @@ async function writeFileTool(args2) {
     }
   };
 }
+function extractSnippetWords(text) {
+  const tokens = [];
+  const latinWords = text.match(/[A-Za-z0-9_]{2,}/g);
+  if (latinWords) {
+    for (const w of latinWords) tokens.push(w.toLowerCase());
+  }
+  const cjkChars = text.match(new RegExp("\\p{Script=Han}", "gu"));
+  if (cjkChars) {
+    for (let i = 0; i < cjkChars.length - 1; i++) {
+      tokens.push(cjkChars[i] + cjkChars[i + 1]);
+    }
+    if (cjkChars.length === 1) tokens.push(cjkChars[0]);
+  }
+  return tokens;
+}
+function calculateEditLineSimilarity(a, b) {
+  if (a === b) return 1;
+  if (!a || !b) return 0;
+  if (a.includes(b) || b.includes(a)) return 0.8;
+  const wordsA = extractSnippetWords(a);
+  const wordsB = extractSnippetWords(b);
+  if (wordsA.length === 0 || wordsB.length === 0) return 0;
+  const setB = new Set(wordsB);
+  let matches = 0;
+  for (const w of wordsA) {
+    if (setB.has(w)) matches++;
+  }
+  return 2 * matches / (wordsA.length + wordsB.length);
+}
+function findClosestEditSnippet(content, oldText) {
+  const contentLines = content.split(/\r?\n/);
+  const oldLinesRaw = oldText.split(/\r?\n/);
+  const oldTrimmedLines = oldLinesRaw.map((l) => l.trim()).filter(Boolean);
+  if (contentLines.length === 0 || oldTrimmedLines.length === 0) return null;
+  if (oldTrimmedLines.length > 0 && contentLines.length >= oldTrimmedLines.length) {
+    for (let i = 0; i <= contentLines.length - oldTrimmedLines.length; i++) {
+      let allMatch = true;
+      for (let j = 0; j < oldTrimmedLines.length; j++) {
+        if (contentLines[i + j].trim() !== oldTrimmedLines[j]) {
+          allMatch = false;
+          break;
+        }
+      }
+      if (allMatch) {
+        const startLine2 = i + 1;
+        const endLine2 = i + oldTrimmedLines.length;
+        const snippetLines2 = [];
+        for (let k = i; k < i + oldTrimmedLines.length; k++) {
+          snippetLines2.push(`> ${k + 1}: ${contentLines[k]}`);
+        }
+        return `Exact match found with different indentation/whitespace (lines ${startLine2}-${endLine2}):
+${snippetLines2.join("\n")}`;
+      }
+    }
+  }
+  const candidateTargetLines = oldTrimmedLines.filter((l) => l.length >= 4);
+  const targetLine = candidateTargetLines[0] || oldTrimmedLines[0];
+  if (!targetLine || targetLine.length < 3) return null;
+  let bestIndex = -1;
+  let bestScore = 0;
+  for (let i = 0; i < contentLines.length; i++) {
+    const line = contentLines[i].trim();
+    if (!line || line.length < 3) continue;
+    const score = calculateEditLineSimilarity(line, targetLine);
+    if (score > bestScore && score >= 0.45) {
+      bestScore = score;
+      bestIndex = i;
+      if (score === 1) break;
+    }
+  }
+  if (bestIndex === -1) return null;
+  const startLine = Math.max(0, bestIndex - 2);
+  const endLine = Math.min(contentLines.length - 1, bestIndex + 2);
+  const snippetLines = [];
+  for (let i = startLine; i <= endLine; i++) {
+    const prefix = i === bestIndex ? "> " : "  ";
+    snippetLines.push(`${prefix}${i + 1}: ${contentLines[i]}`);
+  }
+  return `Closest match near line ${bestIndex + 1}:
+${snippetLines.join("\n")}`;
+}
 async function editFileTool(args2) {
   const parsed = parseWorkspaceToolArguments(args2.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
@@ -18672,8 +18834,11 @@ async function editFileTool(args2) {
     newText
   });
   if (replacementCount !== expectedReplacements) {
+    const hint = replacementCount === 0 ? findClosestEditSnippet(content, oldText) : null;
     throw new Error(
-      `editFile expected ${expectedReplacements} ${pluralizeReplacement(expectedReplacements)} but found ${replacementCount} in ${requestedPath} (matched after EOL normalization; verify the exact text).`
+      `editFile expected ${expectedReplacements} ${pluralizeReplacement(expectedReplacements)} but found ${replacementCount} in ${requestedPath} (matched after EOL normalization; verify the exact text).` + (hint ? `
+
+${hint}` : "")
     );
   }
   await writeFile(absolutePath, nextContent, "utf8");
@@ -19009,6 +19174,55 @@ async function execShellTool(args2) {
     }
   );
 }
+var LAUNCH_PROCESS_STREAM_RING_CHARS = 65536;
+var LAUNCH_PROCESS_STREAM_CAPTURE_MAX_CHARS = 4e6;
+function createLaunchProcessStreamCapture() {
+  let ring = "";
+  let full = null;
+  let capturedChars = 0;
+  let totalChars = 0;
+  let totalNewlines = 0;
+  return {
+    push(chunk) {
+      const str = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      if (!str) return;
+      totalChars += str.length;
+      for (let i = 0; i < str.length; i += 1) {
+        if (str.charCodeAt(i) === 10) totalNewlines += 1;
+      }
+      const combined = ring + str;
+      if (combined.length <= LAUNCH_PROCESS_STREAM_RING_CHARS) {
+        ring = combined;
+        return;
+      }
+      if (full === null) {
+        full = [combined];
+        capturedChars = combined.length;
+      } else if (capturedChars < LAUNCH_PROCESS_STREAM_CAPTURE_MAX_CHARS) {
+        const room = LAUNCH_PROCESS_STREAM_CAPTURE_MAX_CHARS - capturedChars;
+        const slice = str.length <= room ? str : str.slice(0, room);
+        full.push(slice);
+        capturedChars += slice.length;
+      }
+      ring = combined.slice(-LAUNCH_PROCESS_STREAM_RING_CHARS);
+    },
+    text() {
+      return full === null ? ring : full.join("");
+    },
+    tailText() {
+      return ring;
+    },
+    evicted() {
+      return full !== null;
+    },
+    totalChars() {
+      return totalChars;
+    },
+    totalLines() {
+      return totalChars > 0 ? totalNewlines + 1 : 0;
+    }
+  };
+}
 async function launchProcessTool(args2) {
   const parsed = parseWorkspaceToolArguments(args2.call.arguments);
   const command = requireShellCommand(parsed, args2.call.name);
@@ -19036,6 +19250,14 @@ async function launchProcessTool(args2) {
     stdio: ["ignore", "pipe", "pipe"],
     detached
   });
+  const stdoutCapture = createLaunchProcessStreamCapture();
+  const stderrCapture = createLaunchProcessStreamCapture();
+  proc.stdout?.on("data", (chunk) => stdoutCapture.push(chunk));
+  proc.stderr?.on("data", (chunk) => stderrCapture.push(chunk));
+  proc.stdout?.on("error", () => {
+  });
+  proc.stderr?.on("error", () => {
+  });
   const pid = proc.pid;
   if (typeof pid !== "number") {
     return {
@@ -19076,7 +19298,38 @@ async function launchProcessTool(args2) {
       process.removeListener("SIGTERM", cleanupChildOnHostSignal);
       process.removeListener("SIGINT", cleanupChildOnHostSignal);
     }
-    registry2.markExited(pid, code ?? 1);
+    const exitCode = code ?? 1;
+    let capsule;
+    try {
+      capsule = buildProcessTaskResultCapsule({
+        // The full captured output (bounded prefix when the process was
+        // extremely chatty): the module tails it for the inline capsule and
+        // spills it for recovery. Provenance carries the live original-stream
+        // counters so truncated/spill metadata never derives from the ring.
+        stdout: stdoutCapture.text(),
+        stderr: stderrCapture.text(),
+        stdoutTail: stdoutCapture.tailText(),
+        stderrTail: stderrCapture.tailText(),
+        exitCode,
+        // Duration measured from the registry envelope's startedAt (spawn).
+        startedAt: envelope.startedAt,
+        workspaceRoot: args2.workspaceRoot,
+        streamProvenance: {
+          stdout: {
+            evicted: stdoutCapture.evicted(),
+            totalChars: stdoutCapture.totalChars(),
+            totalLines: stdoutCapture.totalLines()
+          },
+          stderr: {
+            evicted: stderrCapture.evicted(),
+            totalChars: stderrCapture.totalChars(),
+            totalLines: stderrCapture.totalLines()
+          }
+        }
+      });
+    } catch {
+    }
+    registry2.markExited(pid, exitCode, capsule);
   });
   const activity = extractActivity(parsed);
   const resultData = { pid, label, taskId: envelope.taskId, status: "running" };
@@ -19088,6 +19341,13 @@ async function launchProcessTool(args2) {
       label,
       status: "running",
       taskId: envelope.taskId,
+      // P0 machine-readable execution state (consistent with the real wake
+      // contract): a real background task from birth, but ambient — its
+      // terminal result rides the next real turn's notice, not an automatic
+      // completion turn.
+      executionState: "background",
+      trackedBackgroundTask: true,
+      completionNotification: "next-turn-notice",
       processLaunch: resultData,
       ...activity ? { activity } : {}
     }
@@ -19190,7 +19450,7 @@ async function tasksTool(_args) {
 }
 async function openDesktopPreviewTool(args2) {
   const parsed = parseWorkspaceToolArguments(args2.call.arguments);
-  const url = typeof parsed.url === "string" ? parsed.url.trim() : "";
+  const url = asTrimmedString(parsed.url);
   if (!url) {
     return {
       content: JSON.stringify({ error: "openDesktopPreview requires a non-empty url." }),
@@ -19312,6 +19572,292 @@ function createLocalWorkspaceToolExecutors(args2) {
   };
 }
 
+// packages/agent-runtime/toolArgumentGate.ts
+var FIELD_ALIAS_GROUPS = [
+  // localWorkspaceTools.ts:336 导出常量（readFile/writeFile/editFile/globFiles）
+  PATH_FIELD_ALIASES,
+  // localWorkspaceTools.ts:339-340 导出常量（editFile）
+  OLD_TEXT_FIELD_ALIASES,
+  NEW_TEXT_FIELD_ALIASES,
+  // localWorkspaceTools.ts:733 `args.cmd || args.command`（launchProcess）；
+  // launchProcess 的 required ["command"] 见 localWorkspaceToolDefs.ts:283。
+  // 注：execShell 的 schema 无 required（command 在 executor 层强制，
+  // capabilities/execShellCapability.ts:42 声明 cmd 兼容字段），本组对它不产生拦截。
+  ["command", "cmd"],
+  // localWorkspaceTools.ts:698-699 `args.pattern ?? args.glob`（globFiles）
+  ["pattern", "glob"],
+  // noloWorkspaceTools.ts:492 `args.dialog ?? args.dialogId ?? args.id`（readDialog）
+  ["dialog", "dialogId", "id"],
+  // noloWorkspaceTools.ts:545 `args.agent ?? args.agentKey ?? args.id`（readAgent）
+  ["agent", "agentKey", "id"],
+  // noloWorkspaceTools.ts:552 `args.space ?? args.spaceId ?? args.id`（readSpace）
+  ["space", "spaceId", "id"],
+  // noloWorkspaceTools.ts:561/567 `args.doc ?? args.docKey ?? args.pageKey ?? args.key`
+  // （readDoc / readSkillDoc）
+  ["doc", "docKey", "pageKey", "key"],
+  // noloWorkspaceTools.node.ts:238 `parsed.name ?? parsed.skillName ?? parsed.skill`（loadSkill）
+  ["name", "skillName", "skill"],
+  // noloWorkspaceTools.ts:593 `args.table ?? args.tableId ?? args.metaKey`（queryTableRows）
+  ["table", "tableId", "metaKey"]
+];
+var TYPE_MATCHERS = {
+  string: (value) => typeof value === "string",
+  // 数字字符串视为可接受：executor 普遍 Number()/clamp 宽松处理，拦截会误报。
+  number: (value) => typeof value === "number" || typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value)),
+  integer: (value) => typeof value === "number" || typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value)),
+  boolean: (value) => typeof value === "boolean" || value === "true" || value === "false",
+  object: (value) => typeof value === "object" && value !== null && !Array.isArray(value),
+  array: (value) => Array.isArray(value)
+};
+function describeValueType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function isAliasSatisfied(args2, field) {
+  for (const group of FIELD_ALIAS_GROUPS) {
+    if (!group.includes(field)) continue;
+    if (group.some((alias) => args2[alias] !== void 0)) return true;
+  }
+  return false;
+}
+function readRequiredFields(parameters) {
+  const required = parameters.required;
+  if (!Array.isArray(required)) return [];
+  return required.filter((field) => typeof field === "string");
+}
+function readProperties(parameters) {
+  const properties = parameters.properties;
+  if (!properties || typeof properties !== "object" || Array.isArray(properties)) {
+    return {};
+  }
+  return properties;
+}
+function validateToolArguments(args2) {
+  const { toolName, rawArguments, parameters } = args2;
+  if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) {
+    return { ok: true, args: {} };
+  }
+  const schema = parameters;
+  const requiredFields = readRequiredFields(schema);
+  const properties = readProperties(schema);
+  if (requiredFields.length === 0 && Object.keys(properties).length === 0) {
+    return { ok: true, args: {} };
+  }
+  const raw = typeof rawArguments === "string" ? rawArguments.trim() : "";
+  let record = {};
+  if (raw !== "") {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return { ok: true, args: {} };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { ok: true, args: {} };
+    }
+    record = parsed;
+  }
+  for (const field of requiredFields) {
+    if (record[field] !== void 0) continue;
+    if (isAliasSatisfied(record, field)) continue;
+    return {
+      ok: false,
+      message: `${toolName} \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A\u7F3A\u5C11\u5FC5\u586B\u53C2\u6570 "${field}"\u3002\u8BF7\u8865\u4E0A\u540E\u91CD\u65B0\u8C03\u7528 ${toolName}\u3002`
+    };
+  }
+  for (const [field, spec] of Object.entries(properties)) {
+    const value = record[field];
+    if (value === void 0 || value === null) continue;
+    if (!spec || typeof spec !== "object" || Array.isArray(spec)) continue;
+    const declared = spec.type;
+    if (typeof declared !== "string") continue;
+    const matcher = TYPE_MATCHERS[declared];
+    if (!matcher) continue;
+    if (!matcher(value)) {
+      return {
+        ok: false,
+        message: `${toolName} \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A\u53C2\u6570 "${field}" \u5E94\u4E3A ${declared}\uFF0C\u5B9E\u9645\u6536\u5230 ${describeValueType(value)}\u3002\u8BF7\u4FEE\u6B63\u540E\u91CD\u65B0\u8C03\u7528 ${toolName}\u3002`
+      };
+    }
+  }
+  return { ok: true, args: record };
+}
+function buildToolParametersIndex(tools) {
+  const index = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    if (!tool || typeof tool !== "object") continue;
+    const fn3 = tool.function;
+    if (!fn3 || typeof fn3 !== "object") continue;
+    const name = fn3.name;
+    const parameters = fn3.parameters;
+    if (typeof name === "string" && name && parameters !== void 0) {
+      index.set(name, parameters);
+    }
+  }
+  return index;
+}
+var cachedAgentRuntimeIndex = null;
+function getAgentRuntimeToolParametersIndex() {
+  if (cachedAgentRuntimeIndex) return cachedAgentRuntimeIndex;
+  const index = /* @__PURE__ */ new Map();
+  try {
+    const workspaceTools = buildLocalWorkspaceOpenAiTools({
+      toolNames: [...WORKSPACE_TOOL_NAMES],
+      exposeShellTools: true
+    });
+    for (const [name, parameters] of buildToolParametersIndex(workspaceTools)) {
+      index.set(name, parameters);
+    }
+    const noloTools = buildNoloWorkspaceOpenAiTools({
+      toolNames: [...NOLO_WORKSPACE_TOOL_NAMES]
+    });
+    for (const [name, parameters] of buildToolParametersIndex(noloTools)) {
+      index.set(name, parameters);
+    }
+  } catch {
+  }
+  cachedAgentRuntimeIndex = index;
+  return index;
+}
+
+// packages/agent-runtime/localToolPolicy.ts
+var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "deleteSpaces",
+  "updateAgent",
+  "updateSelf",
+  "createAgent"
+]);
+var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "readFile",
+  "writeFile",
+  "editFile",
+  "globFiles",
+  "execShell",
+  "launchProcess",
+  "listProcesses",
+  // ProcessTask follow-up tools. Same tier as listProcesses: they observe/stop
+  // tasks the agent itself already spawned, so their blast radius is strictly
+  // narrower than launchProcess (which is default-enabled). Model-facing
+  // follow-ups are taskWait/taskStop only — lifecycle history (taskLogs) stays
+  // runtime-internal.
+  "taskWait",
+  "taskStop",
+  // Scheduling tools: forking/observing sub-agents is a declared capability
+  // of capable agents, and the blast radius is strictly narrower than
+  // execShell (already default-enabled). Requiring an env allowlist for these
+  // while execShell is open by default inverted the risk model and forced every
+  // new local user to hand-edit .env files before sub-agent tasks worked.
+  "startAgentRun",
+  "controlAgentRun"
+]);
+function parseToolAllowlist(value) {
+  return (value ?? "").split(",").flatMap((item) => {
+    const trimmed = item.trim();
+    return trimmed ? [trimmed] : [];
+  });
+}
+function normalizeLocalToolName(toolName) {
+  return canonicalizeToolName(
+    String(toolName ?? "").replace(/^functions\./, "").trim()
+  );
+}
+function isRestrictedLocalToolMode(env) {
+  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
+}
+function resolveLocalToolPolicy(args2) {
+  const toolName = normalizeLocalToolName(args2.toolName);
+  const restrictedMode = isRestrictedLocalToolMode(args2.env);
+  if (!toolName) {
+    return {
+      allowed: false,
+      toolName,
+      reason: "Tool name is required."
+    };
+  }
+  if (NEVER_LOCAL_TOOLS.has(toolName)) {
+    return {
+      allowed: false,
+      toolName,
+      reason: `${toolName} is blocked by the local runtime safety policy.`
+    };
+  }
+  const allowedByEnv = new Set(
+    parseToolAllowlist(args2.env.NOLO_LOCAL_ALLOWED_TOOLS).map(normalizeLocalToolName)
+  );
+  const agentTools = new Set(
+    (args2.agentToolNames ?? []).flatMap((item) => {
+      const normalized = normalizeLocalToolName(item);
+      return normalized ? [normalized] : [];
+    })
+  );
+  if (!restrictedMode && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  return {
+    allowed: false,
+    toolName,
+    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
+  };
+}
+async function executeLocalToolWithPolicy(args2) {
+  if (args2.runToolNames !== void 0 && !args2.runToolNames.map(normalizeLocalToolName).includes(normalizeLocalToolName(args2.call.name))) {
+    throw new Error(`${args2.call.name} is outside the final run tool surface.`);
+  }
+  const decision = resolveLocalToolPolicy({
+    env: args2.env,
+    agentToolNames: args2.agentToolNames,
+    toolName: args2.call.name
+  });
+  if (!decision.allowed) throw new Error(decision.reason);
+  const executor = args2.executors?.[decision.toolName];
+  if (!executor) {
+    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
+  }
+  const parametersSchema = args2.toolParametersIndex?.get(decision.toolName);
+  if (parametersSchema !== void 0) {
+    const gate = validateToolArguments({
+      toolName: decision.toolName,
+      rawArguments: args2.call.arguments,
+      parameters: parametersSchema
+    });
+    if (!gate.ok) throw new Error(gate.message);
+  }
+  const opts = {
+    ...args2.abortSignal ? { abortSignal: args2.abortSignal } : {},
+    ...args2.detachMs !== void 0 ? { detachMs: args2.detachMs } : {},
+    ...args2.confirmed !== void 0 ? { confirmed: args2.confirmed } : {},
+    ...args2.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args2.enableDestructiveShellGuard } : {},
+    ...args2.confirmDestructiveAction ? { confirmDestructiveAction: args2.confirmDestructiveAction } : {},
+    ...args2.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args2.blockDestructiveWithoutConfirmation } : {}
+  };
+  if (decision.toolName === "execShell") {
+    let parsedInput = args2.call.arguments;
+    if (typeof parsedInput === "string") {
+      try {
+        parsedInput = JSON.parse(parsedInput);
+      } catch {
+        parsedInput = { command: parsedInput };
+      }
+    }
+    await evaluateExecShellDestructiveGuard(parsedInput, opts);
+    opts.confirmed = true;
+  }
+  return executor(
+    {
+      ...args2.call,
+      name: decision.toolName
+    },
+    opts
+  );
+}
+
 // packages/cli/client/localDialogRecords.ts
 var localDialogMessageRecordToRuntimeMessage = dialogMessageRecordToAgentRuntimeMessage;
 function buildLocalDialogWritePlan(args2) {
@@ -19448,10 +19994,10 @@ function buildLoadSkillExecutor(args2) {
         metadata: { loadSkill: true, resolved: false }
       };
     }
-    const { resolveSkillByName } = await import("./skillDiscovery-CYUCJMAG.js");
+    const { resolveSkillByName } = await import("./skillDiscovery-ZBU76COE.js");
     const resolved = resolveSkillByName(args2.cwd, name);
     if (!resolved) {
-      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-FUAVTRVZ.js");
+      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-MAR5LPAC.js");
       const builtin = resolveBuiltinSkillByName(name);
       if (builtin) {
         return {
@@ -19494,7 +20040,7 @@ ${body}`,
   };
 }
 async function formatUnknownSkillMessage(cwd, requestedName) {
-  const { discoverSkills } = await import("./skillDiscovery-CYUCJMAG.js");
+  const { discoverSkills } = await import("./skillDiscovery-ZBU76COE.js");
   let available = [];
   try {
     available = discoverSkills(cwd).map((s) => s.name);
@@ -19509,739 +20055,29 @@ No skills were discovered in this workspace.`;
 Available skills: ${available.join(", ")}`;
 }
 
-// packages/core/chat/upstreamErrorBody.ts
-function parseUpstreamErrorBody(errorText, statusText) {
-  if (errorText) {
-    try {
-      const parsed = JSON.parse(errorText);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        const error = parsed.error;
-        if (error && typeof error === "object" && !Array.isArray(error)) {
-          return parsed;
-        }
-      }
-    } catch {
-    }
-  }
-  return { error: { message: errorText || statusText } };
-}
-
-// packages/agent-runtime/antigravityCloudCodeProvider.ts
-import { randomUUID } from "node:crypto";
-
-// packages/agent-runtime/antigravityWireModel.ts
-var WIRE_PROFILES = {
-  // Antigravity discovery exposes 3.7 Flash as one tiered wire model.
-  // The UI labels its effort variants (Low/Medium/High), but the literal
-  // -medium/-high ids return 404 from streamGenerateContent.
-  "gemini-3.7-flash-tiered": { modelEnum: "MODEL_PLACEHOLDER_M301", maxOutputTokens: 65536 },
-  // Gemini 3.8 Flash 沿用 3.7 的 tiered 兼容策略：仓库内暂无 Antigravity discovery
-  // 证据确认 3.8 的 wire modelEnum，禁止虚构，先只声明同档输出上限；enum 待
-  // discovery 证据到位后补齐。
-  "gemini-3.8-flash-tiered": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-low": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-medium": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-high": { maxOutputTokens: 65536 },
-  // 旧模型 wire 映射保留：存量自定义 agent 仍可能引用（注册表已下线不影响此处）。
-  "gemini-3.5-flash-extra-low": { modelEnum: "MODEL_PLACEHOLDER_M187", maxOutputTokens: 65536 },
-  "gemini-3.5-flash-low": { modelEnum: "MODEL_PLACEHOLDER_M20", maxOutputTokens: 65536 },
-  "gemini-3-flash-agent": { modelEnum: "MODEL_PLACEHOLDER_M132", maxOutputTokens: 65536 },
-  "gemini-3.1-pro-low": { modelEnum: "MODEL_PLACEHOLDER_M36", maxOutputTokens: 65535 },
-  "gemini-pro-agent": { modelEnum: "MODEL_PLACEHOLDER_M16", maxOutputTokens: 65535 },
-  "claude-sonnet-5": { maxOutputTokens: 64e3 },
-  "claude-sonnet-4-6": { maxOutputTokens: 64e3 },
-  "claude-opus-4-6-thinking": { maxOutputTokens: 64e3 },
-  "gemini-2.5-flash": { maxOutputTokens: 65536 },
-  "gemini-2.5-pro": { maxOutputTokens: 65536 }
-};
-function resolveAntigravityWireModel(logicalModelId) {
-  const id = logicalModelId.trim();
-  const lower = id.toLowerCase();
-  if (lower === "gemini-3.5-flash") {
-    const wireModelId = "gemini-3.5-flash-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.7-flash" || ["gemini-3.7-flash-low", "gemini-3.7-flash-medium", "gemini-3.7-flash-high"].includes(lower)) {
-    const wireModelId = "gemini-3.7-flash-tiered";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.8-flash" || ["gemini-3.8-flash-low", "gemini-3.8-flash-medium", "gemini-3.8-flash-high"].includes(lower)) {
-    const wireModelId = "gemini-3.8-flash-tiered";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.6-flash") {
-    const wireModelId = "gemini-3.6-flash-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.1-pro" || lower === "gemini-3.1-pro-preview") {
-    const wireModelId = "gemini-3.1-pro-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (WIRE_PROFILES[id]) {
-    return { wireModelId: id, profile: WIRE_PROFILES[id] };
-  }
-  return { wireModelId: id };
-}
-
-// packages/agent-runtime/geminiNativeShared.ts
-var SKIP_THOUGHT_SIGNATURE = "skip_thought_signature_validator";
-function resolveGeminiModelQuirks(modelId) {
-  const lower = modelId.toLowerCase();
-  const isGemini3 = lower.includes("gemini-3");
-  const isStrictSignatureModel = lower.includes("gemini-3.5") || lower.includes("flash-preview");
-  const isClaude = lower.includes("claude");
-  return {
-    requiresThoughtSignature: isGemini3,
-    allowsThoughtSignatureSentinel: isGemini3 && !isStrictSignatureModel,
-    isClaudeCrossModel: isClaude
-  };
-}
-function isGemini3Model(modelId) {
-  return resolveGeminiModelQuirks(modelId).requiresThoughtSignature;
-}
-function messageText(content) {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return "";
-  return content.filter(
-    (part) => part?.type === "text"
-  ).map((part) => part.text).join("\n").trim();
-}
-function parseDataUrlToInlineData(url) {
-  const match7 = /^data:([A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+);base64,([A-Za-z0-9+/=]*)$/.exec(
-    url
-  );
-  if (!match7) return null;
-  return { mimeType: match7[1], data: match7[2] };
-}
-function extractInlineDataParts(content) {
-  if (!Array.isArray(content)) return [];
-  const parts2 = [];
-  for (const part of content) {
-    if (!part || typeof part !== "object") continue;
-    if (part.type !== "image_url") continue;
-    const url = part.image_url?.url;
-    if (typeof url !== "string" || !url.trim()) continue;
-    const inline = parseDataUrlToInlineData(url);
-    if (inline) parts2.push({ inlineData: inline });
-  }
-  return parts2;
-}
-function convertOpenAiMessagesToGemini(messages, options) {
-  const contents = [];
-  const systemTexts = [];
-  let toolCallIndex = 0;
-  let pendingFunctionCalls = [];
-  const pushOrMergeContent = (role, parts2) => {
-    if (parts2.length === 0) return;
-    const last = contents[contents.length - 1];
-    if (last && last.role === role) {
-      last.parts.push(...parts2);
-    } else {
-      contents.push({ role, parts: parts2 });
-    }
-  };
-  const flushPendingFunctionCalls = () => {
-    if (pendingFunctionCalls.length === 0) return;
-    const dummyResponses = pendingFunctionCalls.map(
-      ({ name, id }) => ({
-        functionResponse: {
-          name,
-          response: { output: "{}" },
-          ...id ? { id } : {}
-        }
-      })
-    );
-    pendingFunctionCalls = [];
-    pushOrMergeContent("user", dummyResponses);
-  };
-  for (const raw of messages) {
-    if (!raw || typeof raw !== "object" || !("role" in raw)) continue;
-    const role = String(raw.role);
-    const content = "content" in raw ? raw.content : null;
-    if (role === "system") {
-      const text = messageText(
-        content
-      );
-      if (text) systemTexts.push(text);
-      continue;
-    }
-    if (role === "user") {
-      flushPendingFunctionCalls();
-      const text = messageText(
-        content
-      );
-      const imageParts = extractInlineDataParts(
-        content
-      );
-      if (!text && imageParts.length === 0) continue;
-      const parts2 = [];
-      if (text) parts2.push({ text });
-      for (const img of imageParts) parts2.push(img);
-      pushOrMergeContent("user", parts2);
-      continue;
-    }
-    if (role === "assistant") {
-      flushPendingFunctionCalls();
-      const text = messageText(
-        content
-      );
-      const toolCalls = "tool_calls" in raw && Array.isArray(raw.tool_calls) ? raw.tool_calls ?? [] : [];
-      const parts2 = [];
-      if (text) {
-        parts2.push({ text });
-      }
-      for (const call of toolCalls) {
-        const name = call?.function?.name?.trim();
-        if (!name) continue;
-        const id = call.id?.trim() || `${name}_${toolCallIndex++}`;
-        pendingFunctionCalls.push({ name, id });
-        const realSignature = typeof call.thought_signature === "string" && call.thought_signature ? call.thought_signature : void 0;
-        const isFirstFunctionCallPart = !parts2.some(
-          (p) => "functionCall" in p
-        );
-        const signature = realSignature ?? (options.attachSkipThoughtSignature && isFirstFunctionCallPart ? SKIP_THOUGHT_SIGNATURE : void 0);
-        const part = {
-          functionCall: {
-            name,
-            args: parseToolArgs(call.function?.arguments),
-            ...id ? { id } : {}
-          },
-          ...signature ? { thoughtSignature: signature } : {}
-        };
-        parts2.push(part);
-      }
-      pushOrMergeContent("model", parts2);
-      continue;
-    }
-    if (role === "tool") {
-      const toolCallId = "tool_call_id" in raw && typeof raw.tool_call_id === "string" ? raw.tool_call_id : "";
-      const rawName = "name" in raw && typeof raw.name === "string" ? raw.name.trim() : "";
-      const pendingIndex = pendingFunctionCalls.findIndex(
-        (p) => toolCallId ? p.id === toolCallId : rawName ? p.name === rawName : true
-      );
-      if (pendingIndex === -1) continue;
-      const [{ name, id }] = pendingFunctionCalls.splice(pendingIndex, 1);
-      const output = messageText(content) || "{}";
-      pushOrMergeContent("user", [
-        {
-          functionResponse: {
-            name,
-            response: { output },
-            // 保留 OpenAI tool_call_id：antigravity Cloud Code Assist 网关把
-            // Gemini contents 转成 Claude messages 时需要 functionResponse →
-            // tool_result 的 tool_use_id；缺 id 时网关报
-            // "tool_result.tool_use_id: Field required"（HTTP 400）。
-            ...id ? { id } : {}
-          }
-        }
-      ]);
-    }
-  }
-  flushPendingFunctionCalls();
-  if (contents.length > 0 && contents[0]?.role === "model") {
-    contents.unshift({
-      role: "user",
-      parts: [{ text: "Continue the conversation." }]
-    });
-  }
-  return { contents, systemTexts };
-}
-function parseToolArgs(raw) {
-  if (typeof raw === "string") {
-    try {
-      const parsed = JSON.parse(raw);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        return parsed;
-      }
-    } catch {
-    }
-  }
-  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-    return raw;
-  }
-  return {};
-}
-function sanitizeGeminiSchemaNode(node, active) {
-  const out = {};
-  if (!node || typeof node !== "object" || Array.isArray(node)) {
-    return { type: "string" };
-  }
-  if (active?.has(node)) {
-    return { type: "object", description: "(circular schema reference)" };
-  }
-  const seen = active ?? /* @__PURE__ */ new WeakSet();
-  seen.add(node);
-  try {
-    return sanitizeGeminiSchemaNodeInner(node, out, seen);
-  } finally {
-    seen.delete(node);
-  }
-}
-function sanitizeGeminiSchemaNodeInner(src, out, seen) {
-  if (Array.isArray(src.type)) {
-    const firstNonNull = src.type.find((t) => t !== "null");
-    if (typeof firstNonNull === "string") out.type = firstNonNull;
-    out.nullable = true;
-  } else if (typeof src.type === "string") {
-    out.type = src.type;
-  }
-  if (typeof src.description === "string") out.description = src.description;
-  if (typeof src.minimum === "number") out.minimum = src.minimum;
-  if (typeof src.maximum === "number") out.maximum = src.maximum;
-  if (Array.isArray(src.enum) && src.enum.length > 0) out.enum = src.enum;
-  if (src.nullable === true) out.nullable = true;
-  if ("const" in src && src.const !== void 0 && !out.enum) {
-    out.enum = [src.const];
-  }
-  const variantBranches = [
-    ...Array.isArray(src.oneOf) ? src.oneOf : [],
-    ...Array.isArray(src.anyOf) ? src.anyOf : []
-  ];
-  if (variantBranches.length > 0) {
-    const mergedProperties = {};
-    let requiredIntersection;
-    for (const branch of variantBranches) {
-      const sanitized = sanitizeGeminiSchemaNode(branch, seen);
-      const branchProperties = sanitized.properties ?? {};
-      for (const [key, value] of Object.entries(branchProperties)) {
-        const previous = mergedProperties[key];
-        const prevEnum = previous?.enum;
-        const nextEnum = value?.enum;
-        if (prevEnum && nextEnum) {
-          mergedProperties[key] = {
-            ...value,
-            enum: [.../* @__PURE__ */ new Set([...prevEnum, ...nextEnum])]
-          };
-        } else {
-          mergedProperties[key] = value;
-        }
-      }
-      const branchRequired = Array.isArray(sanitized.required) ? sanitized.required : [];
-      requiredIntersection = requiredIntersection === void 0 ? [...branchRequired] : requiredIntersection.filter((r) => branchRequired.includes(r));
-    }
-    out.properties = {
-      ...out.properties ?? {},
-      ...mergedProperties
-    };
-    if (requiredIntersection !== void 0 && requiredIntersection.length > 0) {
-      out.required = requiredIntersection;
-    }
-    if (typeof out.type !== "string") out.type = "object";
-  }
-  if (Array.isArray(src.allOf)) {
-    for (const branch of src.allOf) {
-      const sanitized = sanitizeGeminiSchemaNode(branch, seen);
-      out.properties = {
-        ...out.properties ?? {},
-        ...sanitized.properties ?? {}
-      };
-      if (Array.isArray(sanitized.required)) {
-        out.required = [
-          .../* @__PURE__ */ new Set([
-            ...out.required ?? [],
-            ...sanitized.required ?? []
-          ])
-        ];
-      }
-    }
-    if (typeof out.type !== "string") out.type = "object";
-  }
-  if (src.properties && typeof src.properties === "object") {
-    const properties = {};
-    for (const [key, value] of Object.entries(
-      src.properties
-    )) {
-      properties[key] = sanitizeGeminiSchemaNode(value, seen);
-    }
-    out.properties = properties;
-    if (typeof out.type !== "string") out.type = "object";
-  }
-  if (Array.isArray(src.required)) {
-    const properties = out.properties ?? {};
-    const required = [...new Set(src.required)].filter(
-      (r) => typeof r === "string" && r in properties
-    );
-    if (required.length > 0) out.required = required;
-  }
-  if (src.items !== void 0) {
-    out.items = sanitizeGeminiSchemaNode(src.items, seen);
-    if (typeof out.type !== "string") out.type = "array";
-  }
-  if (typeof out.type !== "string") out.type = "object";
-  return out;
-}
-function convertOpenAiToolsToGemini(tools) {
-  if (!Array.isArray(tools) || tools.length === 0) return void 0;
-  const declarations = [];
-  for (const tool of tools) {
-    if (!tool || typeof tool !== "object" || !("function" in tool)) continue;
-    const fn3 = tool.function;
-    const name = typeof fn3.name === "string" ? fn3.name : "";
-    if (!name) continue;
-    declarations.push({
-      name,
-      description: typeof fn3.description === "string" ? fn3.description : "",
-      parameters: sanitizeGeminiSchemaNode(
-        fn3.parameters ?? { type: "object", properties: {} }
-      )
-    });
-  }
-  if (declarations.length === 0) return void 0;
-  return [{ functionDeclarations: declarations }];
-}
-function createGeminiAccumulatorState() {
-  return {
-    text: "",
-    toolCalls: [],
-    reasoning: "",
-    events: []
-  };
-}
-function applyGeminiChunk(chunk, state, options) {
-  if (!chunk || typeof chunk !== "object") return;
-  const response = "response" in chunk && chunk.response && typeof chunk.response === "object" ? chunk.response : chunk;
-  if ("usageMetadata" in response && response.usageMetadata && typeof response.usageMetadata === "object") {
-    const meta = response.usageMetadata;
-    const prompt = typeof meta.promptTokenCount === "number" ? meta.promptTokenCount : 0;
-    const candidates2 = typeof meta.candidatesTokenCount === "number" ? meta.candidatesTokenCount : 0;
-    const total = typeof meta.totalTokenCount === "number" ? meta.totalTokenCount : prompt + candidates2;
-    const cached3 = typeof meta.cachedContentTokenCount === "number" && Number.isFinite(meta.cachedContentTokenCount) ? (
-      // cached ⊆ prompt；对畸形上游防御性钳位，避免 cache_read > input 破坏归一化与计费
-      Math.min(Math.max(0, Math.floor(meta.cachedContentTokenCount)), prompt)
-    ) : 0;
-    state.usage = {
-      prompt_tokens: prompt,
-      completion_tokens: candidates2,
-      total_tokens: total,
-      ...cached3 > 0 ? { cache_read_input_tokens: cached3 } : {}
-    };
-    state.events.push({ kind: "usage", usage: state.usage });
-  }
-  const candidates = Array.isArray(response.candidates) ? response.candidates : [];
-  for (const candidate of candidates) {
-    if (!candidate || typeof candidate !== "object") continue;
-    const candidateFinishReason = candidate.finishReason;
-    if (typeof candidateFinishReason === "string" && candidateFinishReason.trim()) {
-      state.finishReason = candidateFinishReason.trim();
-      state.events.push({ kind: "finish", reason: state.finishReason });
-    }
-    const parts2 = Array.isArray(
-      candidate.content?.parts
-    ) ? candidate.content.parts : [];
-    for (const part of parts2) {
-      if (!part || typeof part !== "object") continue;
-      const partSignature = part.thoughtSignature;
-      const isThought = Boolean(part.thought);
-      if ("text" in part && typeof part.text === "string") {
-        const piece = part.text;
-        if (!isThought) {
-          state.text += piece;
-          if (piece) {
-            state.events.push({ kind: "text", text: piece });
-            if (options?.onTextDelta) options.onTextDelta(piece);
-          }
-        } else {
-          state.reasoning += piece;
-          if (piece) {
-            state.events.push({ kind: "reasoning", text: piece });
-            if (options?.onReasoningDelta) options.onReasoningDelta(piece);
-          }
-        }
-      }
-      if (isThought && typeof partSignature === "string" && partSignature) {
-        state.pendingThoughtSignature = partSignature;
-      }
-      if ("functionCall" in part && part.functionCall) {
-        const call = part.functionCall;
-        const name = typeof call.name === "string" ? call.name : "tool";
-        const id = typeof call.id === "string" ? call.id : `${name}_${state.toolCalls.length}`;
-        const argsObj = call.args && typeof call.args === "object" ? call.args : {};
-        const resolvedSignature = typeof partSignature === "string" && partSignature ? partSignature : state.pendingThoughtSignature;
-        state.pendingThoughtSignature = void 0;
-        const toolCall = {
-          id,
-          type: "function",
-          function: { name, arguments: JSON.stringify(argsObj) },
-          ...typeof resolvedSignature === "string" && resolvedSignature ? { thought_signature: resolvedSignature } : {}
-        };
-        state.toolCalls.push(toolCall);
-        state.events.push({ kind: "tool_call", toolCall });
-      }
-    }
-  }
-}
-function accumulateGeminiChunks(chunks2, options) {
-  const state = createGeminiAccumulatorState();
-  for (const chunk of chunks2) {
-    applyGeminiChunk(chunk, state, options);
-  }
-  return {
-    text: state.text,
-    toolCalls: state.toolCalls,
-    usage: state.usage,
-    finishReason: state.finishReason,
-    reasoningContent: state.reasoning,
-    events: state.events
-  };
-}
-async function accumulateGeminiStream(stream, options) {
-  const state = createGeminiAccumulatorState();
-  for await (const chunk of stream) {
-    applyGeminiChunk(chunk, state, options);
-  }
-  return {
-    text: state.text,
-    toolCalls: state.toolCalls,
-    usage: state.usage,
-    finishReason: state.finishReason,
-    reasoningContent: state.reasoning,
-    events: state.events
-  };
-}
-function shouldUseGeminiNativeToolRoute(provider, model, tools, isImageModel) {
-  return provider === "google" && !isImageModel(model) && isGemini3Model(model) && Array.isArray(tools) && tools.length > 0;
-}
-function buildGeminiGenerateContentRequest(args2) {
-  const { contents, systemTexts } = convertOpenAiMessagesToGemini(
-    args2.messages,
-    { attachSkipThoughtSignature: args2.attachSkipThoughtSignature }
-  );
-  const request3 = { contents };
-  if (systemTexts.length > 0) {
-    request3.systemInstruction = {
-      role: "user",
-      parts: systemTexts.map((text) => ({ text }))
-    };
-  }
-  const toolsResult = convertOpenAiToolsToGemini(args2.tools);
-  if (toolsResult) {
-    request3.tools = toolsResult;
-    request3.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
-  }
-  const generationConfig = {};
-  if (typeof args2.maxTokens === "number" && args2.maxTokens > 0) {
-    generationConfig.maxOutputTokens = args2.maxTokens;
-  }
-  if (typeof args2.temperature === "number") {
-    generationConfig.temperature = args2.temperature;
-  }
-  if (Object.keys(generationConfig).length > 0) {
-    request3.generationConfig = generationConfig;
-  }
-  return request3;
-}
-
-// packages/agent-runtime/antigravityCloudCodeProvider.ts
-var STREAM_PATH = "/v1internal:streamGenerateContent?alt=sse";
-function buildCloudCodeAssistPayload(args2) {
-  const projectId = readAntigravityProjectId(args2.metadata);
-  if (!projectId) {
-    throw new Error(
-      "Antigravity OAuth credential is missing metadata.projectId. Re-run `nolo auth antigravity`."
-    );
-  }
-  const logicalModel = asOptionalTrimmedString(args2.openAiBody.model) ?? asOptionalTrimmedString(args2.agentConfig.model) ?? "gemini-3.1-pro";
-  const { wireModelId: model, profile } = resolveAntigravityWireModel(logicalModel);
-  const rawMessages = Array.isArray(args2.openAiBody.messages) ? args2.openAiBody.messages : [];
-  const quirks = resolveGeminiModelQuirks(model);
-  const isClaude = quirks.isClaudeCrossModel;
-  const { contents, systemTexts } = convertOpenAiMessagesToGemini(rawMessages, {
-    attachSkipThoughtSignature: quirks.allowsThoughtSignatureSentinel
-  });
-  if (contents.length === 0) {
-    throw new Error("Antigravity Cloud Code Assist request has no user/model contents.");
-  }
-  const prompt = args2.agentConfig.prompt?.trim();
-  if (prompt) systemTexts.unshift(prompt);
-  const request3 = { contents };
-  if (systemTexts.length > 0) {
-    request3.systemInstruction = {
-      role: "user",
-      parts: systemTexts.map((text) => ({ text }))
-    };
-  }
-  const tools = convertOpenAiToolsToGemini(
-    Array.isArray(args2.openAiBody.tools) ? args2.openAiBody.tools : void 0
-  );
-  if (tools) {
-    request3.tools = tools;
-    request3.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
-  }
-  const generationConfig = {};
-  if (profile?.maxOutputTokens) {
-    generationConfig.maxOutputTokens = profile.maxOutputTokens;
-  } else if (typeof args2.agentConfig.max_tokens === "number" && args2.agentConfig.max_tokens > 0) {
-    generationConfig.maxOutputTokens = args2.agentConfig.max_tokens;
-  }
-  if (typeof args2.agentConfig.temperature === "number") {
-    generationConfig.temperature = args2.agentConfig.temperature;
-  }
-  if (Object.keys(generationConfig).length > 0) {
-    request3.generationConfig = generationConfig;
-  }
-  const agentId = randomUUID();
-  const trajectoryId = randomUUID();
-  const step = 2;
-  const requestId = `agent/${agentId}/${Date.now()}/${trajectoryId}/${step}`;
-  const labels = {
-    trajectory_id: trajectoryId,
-    last_step_index: String(step - 1),
-    used_claude: String(isClaude),
-    used_claude_conservative: String(isClaude)
-  };
-  if (profile?.modelEnum) {
-    labels.model_enum = profile.modelEnum;
-  }
-  request3.labels = labels;
-  request3.sessionId = `-${Math.floor(Math.random() * 9e15)}`;
-  return {
-    url: `${resolveAntigravityCloudCodeBaseUrl(args2.agentConfig.customProviderUrl)}${STREAM_PATH}`,
-    envelope: {
-      project: projectId,
-      model,
-      request: request3,
-      requestId,
-      requestType: "agent",
-      userAgent: "antigravity"
-    }
-  };
-}
-function resolveAntigravityFinishReason(upstream) {
-  const normalized = (upstream ?? "").trim().toUpperCase();
-  if (normalized === "MAX_TOKENS") return "length";
-  if (normalized === "SAFETY" || normalized === "RECITATION" || normalized === "PROHIBITED_CONTENT" || normalized === "BLOCKLIST") {
-    return "content_filter";
-  }
-  return "stop";
-}
-function normalizeAntigravityCompletion(decoded) {
-  const { text, toolCalls, usage, finishReason, reasoningContent, events } = decoded;
-  const normalizedFinishReason = (finishReason ?? "").trim().toUpperCase();
-  if (!text && !reasoningContent && toolCalls.length === 0 && !finishReason && !usage) {
-    const body = {
-      error: {
-        message: "antigravity upstream returned an empty stream (no content, finishReason or usage); channel degradation, not model emptiness"
-      },
-      provider_events: events
-    };
-    return {
-      status: 502,
-      text: "",
-      toolCalls: [],
-      providerEvents: events,
-      body
-    };
-  }
-  if (normalizedFinishReason === "MALFORMED_FUNCTION_CALL") {
-    const message2 = "antigravity upstream returned MALFORMED_FUNCTION_CALL (model generated an invalid function call or tool arguments were rejected by upstream)";
-    const providerFailure = {
-      kind: "provider_failure",
-      provider: "antigravity",
-      code: "MALFORMED_FUNCTION_CALL",
-      message: message2,
-      providerReason: "MALFORMED_FUNCTION_CALL",
-      retryable: false,
-      status: 502
-    };
-    return {
-      status: 502,
-      text: "",
-      toolCalls: [],
-      finishReason,
-      providerEvents: events,
-      providerFailure,
-      runtimeProviderFailure: {
-        message: providerFailure.message,
-        retryable: providerFailure.retryable
-      },
-      body: {
-        error: {
-          message: message2,
-          code: "MALFORMED_FUNCTION_CALL",
-          category: "malformed_function_call",
-          providerReason: "MALFORMED_FUNCTION_CALL",
-          retryable: false
-        },
-        provider_failure: providerFailure,
-        provider_events: events
-      }
-    };
-  }
-  const message = {
-    role: "assistant",
-    content: text || null
-  };
-  if (toolCalls.length > 0) message.tool_calls = toolCalls;
-  if (reasoningContent) message.reasoning_content = reasoningContent;
-  return {
-    status: 200,
-    text,
-    ...reasoningContent ? { reasoningContent } : {},
-    toolCalls,
-    ...usage ? { usage } : {},
-    ...finishReason ? { finishReason } : {},
-    providerEvents: events,
-    body: {
-      choices: [{
-        index: 0,
-        message,
-        finish_reason: toolCalls.length > 0 ? "tool_calls" : resolveAntigravityFinishReason(finishReason)
-      }],
-      ...usage ? { usage } : {},
-      provider_events: events
-    }
-  };
-}
-async function fetchAntigravityCloudCodeCompletion(args2) {
-  const fetchImpl = args2.fetchImpl ?? fetch;
-  const { url, envelope } = buildCloudCodeAssistPayload(args2);
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${args2.accessToken}`,
-      "Content-Type": "application/json",
-      "User-Agent": getAntigravityUserAgent()
-    },
-    body: JSON.stringify(envelope),
-    signal: args2.signal
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    return {
-      status: response.status,
-      text: "",
-      toolCalls: [],
-      providerEvents: [],
-      // 保留上游结构：Antigravity 的限流 body 同样携带结构化的重置信息，
-      // 压成字符串会让冷却退化成 5 分钟默认值。
-      body: parseUpstreamErrorBody(errorText, response.statusText)
-    };
-  }
-  const chunkStream = streamSseDataValues(response, parseSseDataLineJson);
-  const { text, toolCalls, usage, finishReason, reasoningContent, events } = await accumulateGeminiStream(chunkStream, {
-    onTextDelta: args2.onTextDelta,
-    onReasoningDelta: args2.onReasoningDelta
-  });
-  const normalized = normalizeAntigravityCompletion({
-    text,
-    toolCalls,
-    usage,
-    finishReason,
-    reasoningContent,
-    events
-  });
-  if (normalized.status !== 200 || !text && toolCalls.length === 0) {
-    console.warn(
-      `[antigravity] empty completion: finishReason=${JSON.stringify(finishReason)} reasoningLen=${reasoningContent?.length ?? 0} usage=${JSON.stringify(usage) ?? "none"} model=${String(envelope.model)} base=${new URL(url).host}`
-    );
-  }
-  return normalized;
+// packages/agent-runtime/sessionIdentity.ts
+import { createHash as createHash4 } from "node:crypto";
+var SALT = "nolo-session-identity-v1";
+function isStableSessionIdentityEnabled(env = process.env) {
+  const v = env.NOLO_STABLE_SESSION_IDENTITY?.trim().toLowerCase();
+  return !(v === "0" || v === "false" || v === "off");
+}
+function deriveStableUuid(sessionKey, purpose) {
+  const h = createHash4("sha256").update(`${SALT}\0${purpose}\0${sessionKey}`).digest();
+  h[6] = h[6] & 15 | 80;
+  h[8] = h[8] & 63 | 128;
+  const x = h.subarray(0, 16).toString("hex");
+  return `${x.slice(0, 8)}-${x.slice(8, 12)}-${x.slice(12, 16)}-${x.slice(16, 20)}-${x.slice(20, 32)}`;
+}
+function resolveSessionKey(args2) {
+  const d = args2.dialogId?.trim();
+  return d ? `dialog:${d}` : void 0;
 }
 
 // packages/agent-runtime/devin/devinProvider.ts
-import { randomBytes, randomUUID as randomUUID2 } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 var CLIENT_NAME = "chisel";
-var CLIENT_VERSION = "2026.8.18";
+var CLIENT_VERSION = "3000.11.3";
 function writeVarint(fieldNum, value) {
   const tag = fieldNum << 3 | 0;
   const bytes = [];
@@ -20298,10 +20134,13 @@ function encodeDevinClientMetadata(token) {
     writeStringField(31, generateFingerprint())
   ]);
 }
-function encodeDevinChatMessage(msg) {
+function devinId(id, purpose) {
+  return id?.sessionKey && isStableSessionIdentityEnabled() ? deriveStableUuid(id.sessionKey, purpose) : randomUUID();
+}
+function encodeDevinChatMessage(msg, identity2, index = 0) {
   const source = msg.role === "assistant" ? 2 : msg.role === "tool" ? 4 : 1;
   return Buffer.concat([
-    writeStringField(1, randomUUID2()),
+    writeStringField(1, devinId(identity2, `msg:${index}:${msg.role}`)),
     writeVarint(2, source),
     writeStringField(3, msg.text),
     ...(msg.toolCalls ?? []).map(
@@ -20357,6 +20196,7 @@ function buildCompletionConfig(params) {
 }
 function buildGetChatMessageRequest(params) {
   const { token, messages, model, tools = [], temperature } = params;
+  const identity2 = { sessionKey: params.sessionKey };
   const metadata = encodeDevinClientMetadata(token);
   let systemPrompt = "";
   const filteredMessages = [];
@@ -20386,10 +20226,10 @@ ${item.text}`;
       coalesced.push({ ...item });
     }
   }
-  const chatMessageBuffers = coalesced.map((m) => encodeDevinChatMessage(m));
+  const chatMessageBuffers = coalesced.map((m, i) => encodeDevinChatMessage(m, identity2, i));
   const completionConfig = buildCompletionConfig({ temperature });
   const modelConfig = Buffer.concat([
-    writeStringField(1, randomUUID2()),
+    writeStringField(1, randomUUID()),
     writeVarint(2, 1),
     writeVarint(3, 4)
   ]);
@@ -20401,7 +20241,7 @@ ${item.text}`;
     writeMessageField(8, completionConfig),
     ...tools.map((tool) => writeMessageField(10, encodeDevinToolDefinition(tool))),
     writeMessageField(15, modelConfig),
-    writeStringField(16, randomUUID2()),
+    writeStringField(16, randomUUID()),
     writeVarint(20, 1),
     writeStringField(21, model)
   ]);
@@ -20616,6 +20456,11 @@ function decodeDevinResponsePayload(payload) {
   }
   return { content, reasoning, finishReason, events, usage };
 }
+function isMeaningfulDevinEvent(event) {
+  if (event.type === "reasoning" || event.type === "content") return event.text.length > 0;
+  if (event.type === "tool-call-start") return !!event.name;
+  return event.argsDelta.length > 0;
+}
 function createDevinProvider(options) {
   const { token, model = "swe-2-max", fetchImpl = fetch, tools = [], temperature } = options;
   return {
@@ -20627,9 +20472,11 @@ function createDevinProvider(options) {
         messages,
         model: selectedModel,
         tools,
-        temperature
+        temperature,
+        sessionKey: resolveSessionKey({ dialogId: opts?.dialogId })
       });
       const frame = buildDevinConnectFrame(requestPayload);
+      const timingTracker = createProviderCallTimingTracker();
       const response = await fetchImpl(DEVIN_CONNECT_URL, {
         method: "POST",
         headers: {
@@ -20687,6 +20534,7 @@ function createDevinProvider(options) {
             reasoning += delta.reasoning;
             if (delta.finishReason) finishReason = delta.finishReason;
             for (const event of delta.events) {
+              if (isMeaningfulDevinEvent(event)) observeMeaningfulProviderResponse(timingTracker);
               if (event.type === "reasoning") {
                 opts?.onReasoningDelta?.(event.text);
               } else if (event.type === "content") {
@@ -20735,13 +20583,14 @@ function createDevinProvider(options) {
       if (!text && !reasoning && toolCalls.length === 0) {
         throw new Error("Devin Connect upstream completed without content or tool calls");
       }
-      const usage = frameUsage ? {
+      const timing = finalizeProviderCallTiming(timingTracker);
+      const usage = frameUsage ? withProviderCallTimingFields({
         prompt_tokens: frameUsage.prompt + frameUsage.cacheRead,
         completion_tokens: frameUsage.completion ?? 0,
         total_tokens: frameUsage.prompt + frameUsage.cacheRead + (frameUsage.completion ?? 0) + frameUsage.cacheWrite,
         ...frameUsage.cacheRead > 0 ? { prompt_tokens_details: { cached_tokens: frameUsage.cacheRead } } : {},
         ...frameUsage.cacheWrite > 0 ? { cache_creation_input_tokens: frameUsage.cacheWrite } : {}
-      } : void 0;
+      }, timing) : void 0;
       return {
         content: text,
         model: selectedModel,
@@ -20763,20 +20612,16 @@ function createDevinProvider(options) {
 }
 
 export {
+  readCommandActionGatePayload,
+  readActionGate,
   Option_exports,
   Duration_exports,
   Exit_exports,
   Effect_exports,
-  readCommandActionGatePayload,
-  readActionGate,
-  evaluateFileWritePolicy,
-  summarizeToolArguments,
   formatToolOverflowMarker,
   LOCAL_AGENT_CONFIG_MISSING_CODE,
   LOCAL_TURN_ABORTED_CODE,
   runLocalAgentTurn,
-  parseSseDataLineJson,
-  parseSseDataLineObject,
   codexStreamFailureStatus,
   aggregateResponsesStream,
   buildOpenAiCompatibleChatCompletionRequest,
@@ -20792,8 +20637,6 @@ export {
   createHybridRecordStore,
   isDestructiveShellCommand,
   evaluateShellCommandPolicy,
-  resolveLocalToolPolicy,
-  executeLocalToolWithPolicy,
   filterRetainedLedgerRecords,
   isLineRangeCovered,
   getProcessRegistry,
@@ -20804,17 +20647,17 @@ export {
   internalSearchWorkspace,
   internalListWorkspaceEntries,
   createLocalWorkspaceToolExecutors,
+  buildToolParametersIndex,
+  getAgentRuntimeToolParametersIndex,
+  resolveLocalToolPolicy,
+  executeLocalToolWithPolicy,
   localDialogMessageRecordToRuntimeMessage,
   buildLocalDialogWritePlan,
   buildNoloWorkspaceCliToolExecutors,
   buildLoadSkillExecutor,
-  parseUpstreamErrorBody,
-  isGemini3Model,
-  accumulateGeminiChunks,
-  shouldUseGeminiNativeToolRoute,
-  buildGeminiGenerateContentRequest,
-  resolveAntigravityFinishReason,
-  fetchAntigravityCloudCodeCompletion,
+  isStableSessionIdentityEnabled,
+  deriveStableUuid,
+  resolveSessionKey,
   readDevinUpstreamFailure,
   createDevinProvider
 };