nolo-cli 0.148.0-alpha.1 → 0.151.0-alpha.2

package/{chunk-B2XUQXQX.js → chunk-HIQ4GF53.js}

@@ -6,20 +6,20 @@ import {
   buildBuiltinObjectSkillDbKey,
   buildBuiltinObjectSkillPageContent,
   buildCodeWorkDiscipline
-} from "./chunk-6TPOEJMQ.js";
+} from "./chunk-JZX2XLKC.js";
 import {
   buildSkillDocMarkdown,
   resolvePageSkillMetadata
-} from "./chunk-AUDNYVRC.js";
-import {
-  canonicalizeToolNames
-} from "./chunk-XUWRURDF.js";
+} from "./chunk-XETG4RIX.js";
 import {
   nolotusId
-} from "./chunk-QDSINZM3.js";
+} from "./chunk-GKXCHNTE.js";
+import {
+  canonicalizeToolNames
+} from "./chunk-5EBLANFT.js";
 import {
   asNonEmptyStringArray
-} from "./chunk-3AH7LNUB.js";
+} from "./chunk-I42VC5KR.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -301,6 +301,7 @@ var CODING_SKILL_SEEDS = [
       "Verdict: APPROVE / WARNING / BLOCK",
       "```",
       "- APPROVE\uFF1A\u65E0 CRITICAL \u6216 HIGH\uFF0C\u542B\u96F6 finding \u5E72\u51C0 review\uFF1BWARNING\uFF1A\u4EC5 HIGH\uFF1BBLOCK\uFF1A\u6709 CRITICAL\u3002",
+      "- \u7ED3\u8BBA\u53EA\u7ED1\u5B9A\u88AB\u5BA1\u7684\u90A3\u4EFD diff\uFF1A\u88AB\u5BA1\u5185\u5BB9\u6B64\u540E\u6709\u4EFB\u4F55\u6539\u52A8\uFF08\u542B\u53EA\u91C7\u7EB3 nit\u3001\u542B\u53EA\u52A8\u6CE8\u91CA / \u6587\u6863\uFF09\u2192 \u672C\u6B21\u7ED3\u8BBA\u5931\u6548\uFF0C\u5FC5\u987B\u91CD\u5BA1\uFF1B\u4F5C\u8005\u81EA\u8BC4\u4E0D\u6784\u6210\u590D\u6838\u3002",
       "\u4E0D\u8981\u4E3A\u4E86\u663E\u5F97\u4E25\u683C\u800C\u62D2\u7EDD\u6279\u51C6\u3002diff \u5E72\u51C0\u5C31 APPROVE\u3002"
     ].join("\n")
   },
@@ -644,6 +645,12 @@ var SPECIALIST_SKILL_SEEDS = [
       "\u53EA\u6709\u5F97\u5230\u660E\u786E\u786E\u8BA4\u540E\uFF0C\u624D\u8C03\u7528 createAgent \u521B\u5EFA\u771F\u5B9E Agent\u3002",
       "\u7528\u6237\u53EA\u662F\u8BA8\u8BBA\u3001\u8865\u5145\u3001\u4FEE\u6539\u6216\u8BF4\u201C\u5148\u770B\u770B\u201D\u65F6\uFF0C\u4E0D\u8981\u8C03\u7528 createAgent\u3002",
       "\u9ED8\u8BA4\u6A21\u578B\u4F7F\u7528 provider=nolo, model=deepseek-v4-flash\uFF1B\u9664\u975E\u7528\u6237\u660E\u786E\u8981\u6C42\u4E14\u5E73\u53F0\u5DF2\u77E5\u652F\u6301\uFF0C\u4E0D\u8981\u9009\u62E9 Claude/Anthropic \u7B49\u5F53\u524D runtime \u4E0D\u652F\u6301\u7684 provider\u3002",
+      "\u81EA\u5E26\u8BA2\u9605\u4E0E API key \u8DEF\u7531\u89C4\u5219\uFF1A",
+      "- \u5F53\u7528\u6237\u660E\u786E\u8981\u6C42\u4F7F\u7528\u81EA\u5E26\u8BA2\u9605\uFF08\u5982 Step Plan\u3001Kimi Code\u3001OpenCode Go \u7B49\uFF09\u6216\u81EA\u5E26 API key / Custom Provider \u65F6\uFF0C\u4E25\u7981\u9759\u9ED8\u4F7F\u7528 createAgent \u521B\u5EFA\u5E73\u53F0\u9ED8\u8BA4\u8BA1\u8D39 Agent\u3002",
+      '- createAgent \u5DE5\u5177\u4EC5\u652F\u6301 apiSource="platform"\uFF08\u5E73\u53F0\u6258\u7BA1\u4E0E\u5E73\u53F0\u8BA1\u8D39\uFF09\uFF0C\u4E0D\u652F\u6301\u5B58\u50A8\u81EA\u5B9A\u4E49\u51ED\u636E\u6216\u914D\u7F6E\u79C1\u6709\u7AEF\u70B9\uFF1B\u81EA\u5E26\u8BA2\u9605\u4E0D\u66FF\u6362\u5E73\u53F0\u6309\u91CF\u8BA1\u8D39/\u5E73\u53F0\u6258\u7BA1\u6A21\u578B\u3002',
+      "- \u82E5\u5F53\u524D\u8FD0\u884C\u73AF\u5883\u652F\u6301 loadSkill \u6216\u5177\u5907 shell \u6267\u884C\u80FD\u529B\uFF0C\u8F6C\u5165\u5DF2\u6CE8\u518C\u7684 agent-provider-setup \u5185\u7F6E skill \u8D70\u6570\u636E\u9A71\u52A8\u7684 CLI/TUI \u81EA\u5EFA Provider Agent \u6D41\u7A0B\uFF08\u901A\u8FC7 nolo agent providers \u8BFB\u53D6\u5B9E\u65F6\u9884\u8BBE\uFF09\uFF0C\u5207\u52FF\u786C\u7F16\u7801 provider \u5217\u8868\u3002",
+      "- \u82E5\u5F53\u524D\u8FD0\u884C\u73AF\u5883\u65E0 shell\uFF08\u65E0\u6CD5\u6267\u884C execShell\uFF09\uFF0C\u660E\u786E\u544A\u77E5\u65E0\u6CD5\u901A\u8FC7\u5F53\u524D\u5BF9\u8BDD\u5DE5\u5177\u4EE3\u529E\u914D\u7F6E\u81EA\u5E26\u5BC6\u94A5\uFF0C\u5207\u52FF\u865A\u6784\u65E0\u9700 shell \u7684\u76F4\u63A5\u521B\u5EFA\u80FD\u529B\uFF1B\u5F15\u5BFC\u7528\u6237\u8FDB\u5165 /create/agent \u9875\u9762\u8FDB\u884C\u81EA\u4E3B\u5B89\u5168\u914D\u7F6E\uFF0C\u5E76\u6E05\u6670\u8BF4\u660E\u6B64\u9650\u5236\u3002",
+      "- \u4EA4\u4E92\u4E2D\u4E0D\u7D22\u8981\u7528\u6237\u5C06\u5BC6\u94A5\u8D34\u5165\u5BF9\u8BDD\uFF0C\u4E0D\u56DE\u663E\u6216\u590D\u8FF0\u5BC6\u94A5\uFF0C\u9884\u89C8\u4E2D\u7EDD\u4E0D\u51FA\u73B0\u771F\u5B9E\u5BC6\u94A5\u3002",
       "\u516C\u5F00\u72B6\u6001\u4FDD\u6301\u4FDD\u5B88\uFF1A\u4F60\u53EF\u4EE5\u5EFA\u8BAE\u516C\u5F00\uFF0C\u4F46\u53EA\u6709\u7528\u6237\u660E\u786E\u8981\u6C42\u516C\u5F00\u53D1\u5E03\u65F6\uFF0CcreateAgent \u7684 isPublic \u624D\u80FD\u4E3A true\u3002",
       "\u5982\u679C\u7528\u6237\u60F3\u624B\u52A8\u5FAE\u8C03\u6A21\u578B\u3001\u5DE5\u5177\u3001\u77E5\u8BC6\u5F15\u7528\u6216\u53D1\u5E03\u72B6\u6001\uFF0C\u53EF\u4EE5\u5F15\u5BFC\u7528\u6237\u8FDB\u5165 /create/agent \u9AD8\u7EA7\u7F16\u8F91\u9875\u3002"
     ].join("\n"),
@@ -653,7 +660,8 @@ var SPECIALIST_SKILL_SEEDS = [
       "createSkillDoc",
       "readDoc",
       "updateDoc",
-      "updateAgent"
+      "updateAgent",
+      "loadSkill"
     ]
   },
   {
@@ -1143,37 +1151,28 @@ function buildAutoReviewSkillConfig(slug) {
     id: buildAutoReviewSkillId(slug),
     name: "\u81EA\u52A8\u5BA1\u67E5\u5408\u5E76\uFF08auto-review\uFF09",
     triggerMode: "explicit",
-    description: "\u6539\u52A8\u5B8C\u6210\u540E\u81EA\u52A8\u8D70\u5B8C\u300C\u72EC\u7ACB reviewer \u5BA1\u67E5 \u2192 \u4FEE\u590D \u2192 \u63D0\u4EA4 \u2192 \u5408\u5E76\u5230\u672C\u5730\u96C6\u6210\u5206\u652F\u300D\u3002\u5F00\u542F\u5373\u6388\u6743 review \u901A\u8FC7\u540E\u81EA\u52A8\u63D0\u4EA4\u4E0E\u672C\u5730\u5408\u5E76\uFF0C\u4F46\u7EDD\u4E0D\u81EA\u52A8 push\u3001\u4E0D\u5408\u5E76\u8FDC\u7AEF\u6216\u4E3B\u5E72\u3001\u4E0D\u53D1\u5E03\u3002\u89E6\u53D1\u8BCD\uFF1Aauto-review\u3001\u81EA\u52A8\u5BA1\u67E5\u3001review \u540E\u81EA\u52A8\u5408\u5E76\u3001\u5BA1\u5B8C\u76F4\u63A5\u63D0\u4EA4\u5408\u5E76\u3001auto review\u3002\u4E0D\u9002\u7528\uFF1A\u53EA\u8BFB\u4EFB\u52A1\u3001\u7528\u6237\u8981\u5148\u9A8C\u6536\u6548\u679C\u7684\u6539\u52A8\uFF08\u5148\u4EA4\u4ED8\u4EA7\u7269\u7B49\u53CD\u9988\uFF09\u3002"
+    description: "\u663E\u5F0F\u5F00\u542F\u540E\uFF0C\u5728\u7528\u6237\u6307\u5B9A\u7684\u4EFB\u52A1\u3001\u5F53\u524D\u5BF9\u8BDD\u6216\u9879\u76EE\u4F5C\u7528\u57DF\u6301\u7EED\u6267\u884C\u72EC\u7ACB review\u3001\u4FEE\u590D\u3001\u63D0\u4EA4\u4E0E\u672C\u5730\u96C6\u6210\u5206\u652F\u5408\u5E76\uFF1B\u4E0D\u9ED8\u8BA4\u63A8\u8350\u3002push \u662F\u72EC\u7ACB\u6743\u9650\u3002\u89E6\u53D1\u8BCD\uFF1Aauto-review\u3001\u81EA\u52A8\u5BA1\u67E5\u3001review \u540E\u81EA\u52A8\u5408\u5E76\u3001\u5BA1\u5B8C\u76F4\u63A5\u63D0\u4EA4\u5408\u5E76\u3001auto review\u3002\u53EA\u8BFB\u4EFB\u52A1\u4E0D\u9002\u7528\u3002"
   };
 }
 var BODY = [
-  "\u4F60\u662F\u300C\u81EA\u52A8\u5BA1\u67E5\u5408\u5E76\u300D\u6D41\u7A0B\u7684\u6267\u884C\u8005\uFF1A\u6539\u52A8\u505A\u5B8C\u540E\uFF0C\u4E0D\u7B49\u7528\u6237\u9010\u6B65\u70B9\u5934\uFF0C\u81EA\u5DF1\u628A\u5BA1\u67E5\u3001\u63D0\u4EA4\u3001\u672C\u5730\u5408\u5E76\u8D70\u5B8C\u3002",
+  "\u4F60\u662F\u300C\u81EA\u52A8\u5BA1\u67E5\u5408\u5E76\u300D\u6D41\u7A0B\u7684\u6267\u884C\u8005\uFF1A\u7528\u6237\u663E\u5F0F\u5F00\u542F\u540E\uFF0C\u5728\u7528\u6237\u6307\u5B9A\u7684\u4F5C\u7528\u57DF\u6301\u7EED\u9002\u7528\uFF1B\u4E0D\u8981\u6C42\u6BCF\u4EFB\u52A1\u91CD\u590D\u5F00\u542F\u3002\u6388\u6743\u8986\u76D6\u7684\u672C\u5730 review\u3001\u4FEE\u590D\u3001\u63D0\u4EA4\u4E0E\u672C\u5730\u96C6\u6210\u5206\u652F\u5408\u5E76\u65E0\u9700\u9010\u6B65\u786E\u8BA4\u3002",
   "",
-  "## \u5F00\u542F\u6761\u4EF6\u4E0E\u8FB9\u754C",
-  "- \u4EC5\u5728\u7528\u6237\u663E\u5F0F\u5F00\u542F\uFF08\u8BF4 auto-review / \u81EA\u52A8\u5BA1\u67E5\u5408\u5E76\uFF09\u540E\u4F7F\u7528\uFF1B\u5F00\u542F\u53EA\u6388\u6743**\u672C\u5730\u63D0\u4EA4\u4E0E\u672C\u5730\u96C6\u6210\u5206\u652F\u5408\u5E76**\u3002",
-  "- \u6C38\u8FDC\u9700\u8981\u5F53\u6B21\u660E\u786E\u6279\u51C6\uFF1A`git push`\u3001\u5408\u5E76\u5230\u8FDC\u7AEF\u6216\u4E3B\u5E72\u5206\u652F\u3001\u53D1\u5E03/\u90E8\u7F72\u3001\u56DE\u6EDA\u3002\u5F00\u542F\u672C skill \u4E0D\u653E\u5BBD\u8FD9\u4E9B\u3002",
-  "- \u9700\u8981\u7528\u6237\u4EB2\u81EA\u9A8C\u6536\u7684\u6539\u52A8\uFF08UI\u3001\u4F53\u9A8C\u7C7B\uFF09\uFF1A\u5148\u4EA4\u4ED8\u53EF\u6D4B\u8BD5\u4EA7\u7269\u5E76\u505C\u4E0B\uFF0C\u7B49\u7528\u6237\u786E\u8BA4\u300C\u53EF\u4EE5\u300D\u518D\u8FDB\u5165\u4E0B\u9762\u6D41\u7A0B\u3002",
+  "## \u542F\u7528\u4E0E\u6743\u9650\u8FB9\u754C",
+  "- \u7528\u6237\u53EF\u6307\u5B9A\u4EFB\u52A1\u3001\u5F53\u524D\u5BF9\u8BDD\u6216\u9879\u76EE\u4F5C\u7528\u57DF\u3002\u5355\u6B21\u8986\u76D6\u3001\u6682\u505C\u6216\u5173\u95ED\u4F18\u5148\uFF1B\u6536\u5230 stop/\u505C\u6B62\u7ACB\u5373\u505C\u6B62\uFF0C\u4E0D\u91CD\u65B0\u89C4\u5212\u65E2\u5B9A\u65B9\u5411\u3002",
+  "- \u4F5C\u7528\u57DF\u6301\u7EED\u4E0D\u4EE3\u8868\u5E73\u53F0\u5DF2\u7ECF\u6301\u4E45\u4FDD\u5B58\u914D\u7F6E\u3002\u672A\u9A8C\u8BC1\u6301\u4E45\u914D\u7F6E\u80FD\u529B\u524D\uFF0C\u4E0D\u5F97\u58F0\u79F0\u8DE8\u5BF9\u8BDD\u81EA\u52A8\u4FDD\u5B58\u6216\u751F\u6548\uFF1B\u9879\u76EE\u542F\u7528\u6301\u4E45\u80FD\u529B\u4EE5\u73B0\u6709\u9879\u76EE\u914D\u7F6E\u5DF2\u52A0\u8F7D\u4E3A\u524D\u63D0\uFF0C\u4E0D\u65B0\u9020\u914D\u7F6E\u7CFB\u7EDF\u3002\u4FDD\u6301\u663E\u5F0F opt-in\uFF0C\u4E0D\u9ED8\u8BA4\u63A8\u8350\u6216\u81EA\u52A8\u542F\u7528\u4E8E\u6240\u6709\u9879\u76EE\u3002",
+  "- push \u662F\u72EC\u7ACB\u6743\u9650\uFF0C\u9ED8\u8BA4\u672A\u6388\u6743\uFF1B\u7B26\u5408\u4E0A\u5C42\u89C4\u5219\u7684\u5F53\u6B21\u660E\u786E\u6388\u6743\u540E\uFF0C\u53EF\u5728\u672C\u5730\u5408\u5E76\u540E\u7EE7\u7EED\u9A8C\u6536\u3001\u8BC1\u636E\u9884\u68C0\u4E0E push\u3002\u4E0D\u5F97\u58F0\u79F0 skill \u6216\u4ED3\u5E93\u89C4\u5219\u6388\u4E88\u6301\u7EED push \u6743\u3002main/production \u5408\u5E76\u3001\u53D1\u5E03\u3001\u56DE\u6EDA\u53E6\u9700\u5F53\u6B21\u6279\u51C6\u3002",
+  "- \u9700\u7528\u6237\u4EB2\u81EA\u9A8C\u6536\u7684\u6539\u52A8\uFF08\u5982 UI/\u4F53\u9A8C\uFF09\uFF1A\u5148\u4EA4\u4ED8\u53EF\u6D4B\u8BD5\u4EA7\u7269\uFF1B\u7528\u6237\u660E\u786E\u51C6\u5907\u63D0\u4EA4\u540E\u518D\u8FDB\u5165\u6700\u7EC8 review\u3002",
   "",
   "## \u6D41\u7A0B",
-  "1. **\u9694\u79BB**\uFF1A\u6539\u52A8\u5E94\u5DF2\u5728\u72EC\u7ACB worktree/\u5206\u652F\u91CC\uFF08\u89C1 `worktree-isolation`\uFF09\uFF1B\u4E0D\u5728\u5C31\u5148\u5EFA\u3002",
-  "2. **\u6D3E reviewer**\uFF1A\u4E0E\u4F5C\u8005\u4E0D\u540C\u7684 agent \u5B9E\u4F8B\uFF0C\u53EA\u8BFB\u5BA1 diff\uFF0C\u53EA\u4F20 worktree \u8DEF\u5F84\u4E0E\u6587\u4EF6\u6E05\u5355\uFF0C\u4E0D\u5185\u5D4C diff\u3002brief \u8981\u6C42\u6700\u7EC8\u6587\u672C\u542B Verdict\uFF08APPROVE / WARNING / BLOCK\uFF09\u4E0E\u5E26\u884C\u53F7\u7684 finding\u3002",
-  "3. **\u5224\u5B9A**\uFF1A",
-  "   - \u6700\u7EC8\u6587\u672C\u542B\u660E\u786E APPROVE \u4E14\u65E0 CRITICAL/HIGH \u2192 \u7EE7\u7EED\uFF1B",
-  "   - BLOCK \u2192 \u4FEE\u590D\u540E\u590D\u5BA1\uFF0C\u5FAA\u73AF\u76F4\u5230 APPROVE\uFF1B",
-  "   - WARNING\uFF08\u6709 HIGH\uFF09\u2192 \u505C\u4E0B\uFF0C\u628A finding \u62A5\u7ED9\u7528\u6237\u51B3\u5B9A\uFF0C\u4E0D\u81EA\u52A8\u5408\u5E76\uFF1B",
-  "   - \u7A7A\u56DE\u590D\u3001\u8D85\u65F6\u3001\u53EA\u8BF4\u300C\u6211\u5148\u68C0\u67E5\u300D\u90FD\u4E0D\u662F\u5BA1\u67E5\u8BC1\u636E\uFF1A\u6700\u591A\u91CD\u8BD5\u4E00\u6B21\uFF0C\u4ECD\u65E0\u7ED3\u8BBA\u5C31\u62A5\u544A `review incomplete`\uFF0C\u4EA4\u7528\u6237\u5904\u7406\u3002",
-  "4. **\u63D0\u4EA4**\uFF1A\u6309\u9879\u76EE\u7684\u63D0\u4EA4\u89C4\u8303\u5199 message\uFF1B\u5982\u5B9E\u8BB0\u5F55\u8C01\u5BA1\u7684\u3001\u7ED3\u8BBA\u662F\u4EC0\u4E48\u3002\u65E0 review \u4E0D\u63D0\u4EA4\uFF08\u22642 \u6B65\u96F6\u903B\u8F91\u98CE\u9669\u7684\u673A\u68B0\u6539\u52A8\u9664\u5916\uFF0C\u987B\u5728 message \u6CE8\u660E\u539F\u56E0\uFF09\u3002",
-  "5. **\u5408\u5E76**\uFF1A\u5728\u4E3B\u4ED3\u7528 `git merge --no-ff <\u5206\u652F>` \u5408\u5E76\u5230\u672C\u5730\u96C6\u6210\u5206\u652F\uFF0C\u4FDD\u7559\u5206\u652F\u5386\u53F2\u3002",
-  "6. **\u6E05\u7406**\uFF1A\u5408\u5E76\u6210\u529F\u540E\uFF0C\u4E3B\u52A8\u5217\u51FA\u672C\u6B21\u4EA7\u751F\u7684\u5F85\u6E05\u7406\u8D44\u6E90\u6E05\u5355\uFF08\u786E\u5207\u7684 worktree \u76F8\u5BF9\u8DEF\u5F84\u4E0E\u5206\u652F\u540D\u79F0\uFF09\uFF1B\u83B7\u5F97\u7528\u6237\u660E\u786E\u786E\u8BA4\u540E\uFF0C\u6267\u884C `git worktree remove <worktreePath>` \u4E0E `git branch -d <branchName>` \u5B8C\u6210\u6E05\u7406\u95ED\u73AF\uFF1B\u4E25\u7981\u9759\u9ED8\u5220\u9664\u6216\u5148\u5220\u540E\u62A5\u3002",
-  "7. **\u6536\u5C3E**\uFF1A\u6C47\u62A5 commit\u3001\u5408\u5E76\u4E0E\u6E05\u7406\u7ED3\u679C\u3001reviewer \u4E0E Verdict\u3001\u672A\u5904\u7406\u7684 WARNING\u3002\u5230\u6B64\u4E3A\u6B62\uFF0C\u4E0D push\u3002",
-  "",
-  "## \u9009 reviewer",
-  "- \u6309\u5E73\u53F0\u9009\u4EBA\u5951\u7EA6\uFF1A\u6536\u85CF\u7684\u79C1\u6709\u8BA2\u9605/\u81EA\u5E26 key agent \u4F18\u5148\uFF0C\u5176\u6B21\u5176\u4ED6\u6536\u85CF\uFF0C\u518D\u5176\u6B21\u672A\u6536\u85CF\u7684\u79C1\u6709 agent\uFF1B\u4F4E\u4EF7\u80DC\u4EFB\u8005\u5373\u53EF\u3002\u53EA\u6709\u67B6\u6784/\u8BA1\u8D39/\u5B89\u5168/\u6570\u636E\u5B8C\u6574\u6027\u9AD8\u98CE\u9669\u6539\u52A8\u624D\u7528\u9876\u6863\u3002",
-  "- \u4F1A\u6D88\u8017\u5E73\u53F0\u79EF\u5206\u7684 agent \u5FC5\u987B\u5148\u5F81\u5F97\u7528\u6237\u5F53\u6B21\u540C\u610F\u3002",
+  "1. **\u9694\u79BB**\uFF1A\u6539\u52A8\u5E94\u5728\u72EC\u7ACB worktree/\u5206\u652F\u4E2D\u8FDB\u884C\uFF1B\u4E0D\u5728\u5C31\u6309\u9879\u76EE\u65E2\u6709\u6D41\u7A0B\u5EFA\u7ACB\u3002",
+  "2. **\u6D3E reviewer**\uFF1A\u4F7F\u7528\u4E0E\u4F5C\u8005\u4E0D\u540C\u7684 agent \u5B9E\u4F8B\uFF0C\u53EA\u8BFB\u5BA1 diff\uFF1Bbrief \u4EC5\u4F20 worktree \u8DEF\u5F84\u4E0E\u6587\u4EF6\u6E05\u5355\uFF0C\u4E0D\u5185\u5D4C diff\u3002\u8981\u6C42\u6700\u7EC8\u6587\u672C\u542B Verdict\uFF08APPROVE / WARNING / BLOCK\uFF09\u53CA\u5E26\u884C\u53F7 finding\u3002\u9075\u5FAA\u5E73\u53F0\u9009\u4EBA\u53CA\u8D39\u7528\u6388\u6743\u89C4\u5219\u3002",
+  "3. **\u5224\u5B9A**\uFF1A\u6700\u7EC8\u6587\u672C\u660E\u786E APPROVE \u4E14\u65E0 CRITICAL/HIGH \u624D\u7EE7\u7EED\u3002BLOCK \u4FEE\u590D\u540E\u590D\u5BA1\uFF1BWARNING \u542B HIGH \u65F6\u505C\u4E0B\u62A5\u544A\u7528\u6237\u51B3\u5B9A\u3002APPROVE \u4EC5\u8986\u76D6\u8BE5\u7248\u672C\uFF0C\u4E4B\u540E\u4EFB\u4F55\u6539\u52A8\uFF08\u5305\u62EC\u6587\u6863/\u6CE8\u91CA\uFF09\u90FD\u987B\u590D\u5BA1\u3002\u7A7A\u56DE\u590D\u3001\u8D85\u65F6\u6216\u6CA1\u6709\u7ED3\u8BBA\u4E0D\u662F\u5BA1\u67E5\u8BC1\u636E\uFF1B\u6700\u591A\u91CD\u8BD5\u4E00\u6B21\uFF0C\u4ECD\u65E0\u7ED3\u8BBA\u5219\u62A5\u544A review incomplete \u5E76\u4EA4\u7528\u6237\u5904\u7406\u3002",
+  "4. **\u63D0\u4EA4**\uFF1A\u6309\u9879\u76EE\u63D0\u4EA4\u89C4\u8303\u5199 message\uFF0C\u5982\u5B9E\u8BB0\u5F55 reviewer \u4E0E\u7ED3\u8BBA\u3002\u6CA1\u6709\u5408\u683C review \u4E0D\u63D0\u4EA4\uFF08\u22642 \u6B65\u96F6\u903B\u8F91\u98CE\u9669\u7684\u673A\u68B0\u6539\u52A8\u4F8B\u5916\uFF0C\u987B\u5728 message \u6CE8\u660E\u539F\u56E0\uFF09\uFF1B\u9075\u5B88\u6D4B\u8BD5\u4E0E\u9879\u76EE\u95E8\u7981\u3002",
+  "5. **\u672C\u5730\u5408\u5E76**\uFF1A\u6309\u9879\u76EE\u8981\u6C42\u7528 `git merge --no-ff <branch>` \u5408\u5E76\u81F3\u672C\u5730\u96C6\u6210\u5206\u652F\u5E76\u4FDD\u7559\u5386\u53F2\u3002\u7528\u6237\u5DF2\u660E\u786E\u6388\u6743 auto-review \u7684\u666E\u901A\u4EFB\u52A1\uFF0C\u4E0D\u91CD\u590D\u7D22\u8981\u6BCF\u6B65\u786E\u8BA4\u3002",
+  "6. **\u6536\u5C3E**\uFF1A\u62A5\u544A review \u7ED3\u8BBA\u3001\u63D0\u4EA4/\u5408\u5E76\u7ED3\u679C\u53CA\u672A\u5904\u7406 finding\uFF1B\u6E05\u7406\u4E25\u683C\u9075\u5FAA\u5220\u9664\u5B89\u5168\u89C4\u5219\u3002push \u4EC5\u5728\u53D6\u5F97\u5F53\u6B21\u6388\u6743\u540E\u8FDB\u884C\uFF0C\u5E76\u9075\u5FAA\u9879\u76EE\u63A8\u524D\u8BC1\u636E\u9884\u68C0\u3002",
   "",
   "## Boundaries",
-  "- \u4E0D\u66FF\u4EE3 reviewer \u4FA7\u7684\u8D28\u91CF\u95E8\uFF0C\u4E5F\u4E0D\u66FF\u4EE3\u6D4B\u8BD5\uFF1B\u6D4B\u8BD5\u6CA1\u8DD1\u8FC7\u4E0D\u8981\u5408\u5E76\u3002",
-  "- \u4E0D\u4F2A\u9020 review \u8BC1\u636E\uFF1B\u4E0D\u7528 `--no-verify` \u7ED5\u8FC7\u63D0\u4EA4\u6216\u5408\u5E76\u94A9\u5B50\u3002"
+  "- \u4E0D\u66FF\u4EE3 reviewer \u8D28\u91CF\u95E8\u6216\u6D4B\u8BD5\uFF1B\u4E0D\u4F2A\u9020 review \u8BC1\u636E\uFF0C\u4E0D\u7ED5\u8FC7\u63D0\u4EA4/\u5408\u5E76\u4FDD\u62A4\u3002\u9879\u76EE\u7279\u6709\u547D\u4EE4\u3001trailer \u4E0E\u95E8\u7981\u7531\u9879\u76EE\u5C42\u8865\u5145\u3002"
 ].join("\n");
 function buildAutoReviewSkillContentBySlug(slug) {
   return buildSkillDocMarkdown({
@@ -1262,8 +1261,8 @@ function buildWorktreeSkillContentBySlug(slug) {
   });
 }
 
-// packages/ai/skills/systematicInvestigationSkill.ts
-var SYSTEMATIC_INVESTIGATION_SKILL_SLUGS = ["systematic-investigation"];
+// packages/ai/skills/secretsManagerSkill.ts
+var SECRETS_MANAGER_SKILL_SLUGS = ["secrets-manager"];
 function deterministicId8(prefix, seed) {
   let h = 2166136261;
   for (let i = 0; i < seed.length; i++) {
@@ -1276,9 +1275,99 @@ function deterministicId8(prefix, seed) {
 function normalizeSkillSeed7(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function buildSystematicinvestigationSkillId(slug) {
+function buildSecretsManagerSkillId(slug) {
   return deterministicId8("01SK", normalizeSkillSeed7(slug) || slug);
 }
+function buildSecretsManagerSkillPageKey(userId, slug) {
+  return `page-${userId}-${buildSecretsManagerSkillId(slug)}`;
+}
+var SECRETS_MANAGER_SKILL_DEFINITIONS = {
+  "secrets-manager": {
+    slug: "secrets-manager",
+    title: "Secrets Manager",
+    description: "\u89E6\u53D1\u8BCD\uFF1A\u672C\u5730\u5BC6\u94A5\u3001\u4FDD\u5B58\u5BC6\u94A5\u3001secrets\u3001AMO\u7B7E\u540D\u51ED\u636E\u3001\u51ED\u636E\u4FDD\u5B58\u3001nolo secret\u3001\u6CE8\u5165\u73AF\u5883\u53D8\u91CF\u6267\u884C\u3002Nolo \u5E73\u53F0\u7EA7\u5F00\u53D1\u8005\u672C\u5730\u79D8\u5BC6\u7BA1\u7406\uFF08~/.nolo/credentials/secrets.json\uFF0C\u6743\u9650 0600\uFF09\u3002",
+    body: `# Nolo Secrets Manager \u2014 \u672C\u5730\u5E73\u53F0\u7EA7\u5F00\u53D1\u8005\u51ED\u636E\u7BA1\u7406
+
+\u7528\u4E8E\u7EDF\u4E00\u5B89\u5168\u7BA1\u7406\u5BBF\u4E3B\u673A\u672C\u5730\u8FD0\u7EF4\u3001\u6253\u5305\u3001\u90E8\u7F72\u7B49\u5F00\u53D1\u8005\u5916\u90E8\u51ED\u636E\uFF08\u5982 Mozilla AMO \u7B7E\u540D\u5BC6\u94A5\u3001Docker Hub Token\u3001\u53D1\u5E03\u5BC6\u94A5\u7B49\uFF09\uFF0C\u5F7B\u5E95\u544A\u522B\u5BF9\u8BDD\u6846\u624B\u52A8\u590D\u5236\u7C98\u8D34\u5BC6\u94A5\u3002
+
+## \u5B58\u50A8\u5951\u7EA6\u4E0E\u5B89\u5168\u7EA2\u7EBF
+
+1. **\u7EDD\u5BF9\u5B58\u50A8\u8DEF\u5F84**\uFF1A\`$NOLO_HOME/credentials/secrets.json\`\uFF08\u672A\u8BBE \`NOLO_HOME\` \u65F6\u56DE\u843D \`~/.nolo/credentials/secrets.json\`\uFF09\uFF0C\u6743\u9650\u4E25\u683C\u9501\u5B9A\u4E3A \`0600\`\uFF0C\u7236\u76EE\u5F55 \`0700\`\u3002
+2. **\u7981\u6B62\u56DE\u663E\u539F\u5219**\uFF1A
+   - Agent \u65E0\u8BBA\u5728\u4EFB\u4F55\u60C5\u51B5\u4E0B\uFF0C**\u7EDD\u4E0D\u5728\u5BF9\u8BDD\u6D88\u606F\u3001\u65E5\u5FD7\u6216\u62A5\u544A\u4E2D\u6253\u5370\u4EFB\u4F55\u5BC6\u94A5\u660E\u6587**\uFF1B
+   - \u67E5\u770B\u5DF2\u4FDD\u5B58\u7684\u51ED\u636E\u4E00\u5F8B\u4F7F\u7528 \`nolo secret list\`\uFF08\u4EC5\u8F93\u51FA\u51ED\u636E\u540D\u79F0\uFF0C\u4E0D\u8F93\u51FA\u5185\u5BB9\uFF09\uFF1B
+   - Agent **\u4E0D\u5F97**\u6267\u884C \`nolo secret get\`\uFF08\u8BE5\u5B50\u547D\u4EE4\u53EA\u4F9B\u4EBA\u7C7B\u8C03\u8BD5\uFF09\uFF0C\u53EA\u5141\u8BB8 \`nolo secret run --with\`\u3002
+3. **\u7528\u6237\u6388\u6743\u95E8\u7981**\uFF1A
+   - \u53EA\u6709\u5F53\u7528\u6237\u5728\u5BF9\u8BDD\u4E2D\u660E\u786E\u63D0\u5230\u201C\u5141\u8BB8\u83B7\u53D6 / \u4F7F\u7528\u672C\u5730\u4FDD\u5B58\u7684 xxx \u51ED\u636E\u201D\u65F6\uFF0CAgent \u624D\u88AB\u6388\u6743\u8C03\u7528\u8BE5\u51ED\u636E\uFF1B\u672A\u83B7\u7528\u6237\u660E\u786E\u6307\u793A\u65F6\uFF0C\u4E0D\u5F97\u8BFB\u53D6\u6216\u6CE8\u5165\u3002
+
+## \u5E38\u7528 CLI \u547D\u4EE4
+
+\`\`\`bash
+# 1. \u67E5\u770B\u5DF2\u6709\u79D8\u5BC6\uFF08\u5B89\u5168\uFF0C\u4EC5\u8F93\u51FA\u540D\u79F0\u5217\u8868\uFF0C\u7EDD\u4E0D\u6253\u5370\u5BC6\u94A5\u503C\uFF09
+nolo secret list
+
+# 2. \u8BBE\u7F6E\u6216\u66F4\u65B0\u51ED\u636E\uFF08\u652F\u6301\u5B57\u7B26\u4E32\u6216 JSON \u5BF9\u8C61\uFF09
+nolo secret set amo '{"issuer":"user:<account-id>:<key-id>","secret":"<key>"}'
+nolo secret set docker_token 'my-secret-token'
+
+# 3. \u5B89\u5168\u6CE8\u5165\u73AF\u5883\u53D8\u91CF\u5E76\u6267\u884C\u547D\u4EE4\uFF08\u63A8\u8350\u7528\u6CD5\uFF0C\u5B50\u8FDB\u7A0B\u7ED3\u675F\u540E\u53D8\u91CF\u81EA\u52A8\u9500\u6BC1\uFF09
+# \u4F8B\u5982: amo \u81EA\u52A8\u6620\u5C04\u51FA WEB_EXT_API_KEY / WEB_EXT_API_SECRET / AMO_JWT_ISSUER / AMO_JWT_SECRET
+nolo secret run --with amo -- bunx web-ext sign --channel unlisted ...
+
+# 4. \u5220\u9664\u4E0D\u518D\u9700\u8981\u7684\u51ED\u636E
+nolo secret delete amo
+\`\`\`
+
+## \u5DF2\u652F\u6301\u7684\u81EA\u52A8\u5316\u6620\u5C04\u670D\u52A1
+
+- **\`amo\`**\uFF08Mozilla Add-ons\uFF09\uFF1A
+  - \u5B58\u50A8\u683C\u5F0F\uFF1A\`{"issuer": "...", "secret": "..."}\`
+  - \u81EA\u52A8\u6CE8\u5165\u73AF\u5883\u53D8\u91CF\uFF1A\`WEB_EXT_API_KEY\`, \`WEB_EXT_API_SECRET\`, \`AMO_JWT_ISSUER\`, \`AMO_JWT_SECRET\`
+- **\u901A\u7528\u51ED\u636E**\uFF1A
+  - \u5B57\u7B26\u4E32\uFF1A\u81EA\u52A8\u8F6C\u4E3A\u5927\u5199\u4E0B\u5212\u7EBF\u73AF\u5883\u53D8\u91CF\uFF08\u5982 \`my_api_key\` \u2192 \`MY_API_KEY\`\uFF09
+  - \u5BF9\u8C61\uFF1A\u81EA\u52A8\u5C55\u5F00\u4E3A\u524D\u7F00\u53D8\u91CF\uFF08\u5982 \`docker: { "user": "a", "token": "b" }\` \u2192 \`DOCKER_USER\`, \`DOCKER_TOKEN\`\uFF09
+`
+  }
+};
+function buildSecretsManagerSkillConfig(slug) {
+  const seed = SECRETS_MANAGER_SKILL_DEFINITIONS[slug];
+  if (!seed) throw new Error(`Unknown secrets-manager skill slug: ${slug}`);
+  return {
+    version: "0.1",
+    kind: "skill",
+    id: buildSecretsManagerSkillId(slug),
+    name: seed.title,
+    description: seed.description,
+    triggerMode: "manual"
+  };
+}
+function buildSecretsManagerSkillContentBySlug(slug) {
+  const seed = SECRETS_MANAGER_SKILL_DEFINITIONS[slug];
+  if (!seed) throw new Error(`Unknown secrets-manager skill slug: ${slug}`);
+  const skillConfig = buildSecretsManagerSkillConfig(slug);
+  return buildSkillDocMarkdown({
+    body: seed.body,
+    skillConfig
+  });
+}
+
+// packages/ai/skills/systematicInvestigationSkill.ts
+var SYSTEMATIC_INVESTIGATION_SKILL_SLUGS = ["systematic-investigation"];
+function deterministicId9(prefix, seed) {
+  let h = 2166136261;
+  for (let i = 0; i < seed.length; i++) {
+    h ^= seed.charCodeAt(i);
+    h = h * 16777619 >>> 0;
+  }
+  const suffix = h.toString(36).toUpperCase().padStart(14, "0");
+  return (prefix + suffix).slice(0, 26);
+}
+function normalizeSkillSeed8(input) {
+  return input.trim().toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function buildSystematicinvestigationSkillId(slug) {
+  return deterministicId9("01SK", normalizeSkillSeed8(slug) || slug);
+}
 function buildSystematicinvestigationSkillPageKey(userId, slug) {
   return `page-${userId}-${buildSystematicinvestigationSkillId(slug)}`;
 }
@@ -1301,7 +1390,7 @@ function buildSystematicinvestigationSkillContentBySlug(slug) {
 
 // packages/ai/skills/showMeSkill.ts
 var SHOW_ME_SKILL_SLUGS = ["show-me"];
-function deterministicId9(prefix, seed) {
+function deterministicId10(prefix, seed) {
   let h = 2166136261;
   for (let i = 0; i < seed.length; i++) {
     h ^= seed.charCodeAt(i);
@@ -1310,11 +1399,11 @@ function deterministicId9(prefix, seed) {
   const suffix = h.toString(36).toUpperCase().padStart(14, "0");
   return (prefix + suffix).slice(0, 26);
 }
-function normalizeSkillSeed8(input) {
+function normalizeSkillSeed9(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function buildShowmeSkillId(slug) {
-  return deterministicId9("01SK", normalizeSkillSeed8(slug) || slug);
+  return deterministicId10("01SK", normalizeSkillSeed9(slug) || slug);
 }
 function buildShowmeSkillPageKey(userId, slug) {
   return `page-${userId}-${buildShowmeSkillId(slug)}`;
@@ -1326,19 +1415,19 @@ function buildShowmeSkillConfig(slug) {
     id: buildShowmeSkillId(slug),
     name: "\u89C6\u89C9\u5316\u89E3\u91CA\uFF08show-me\uFF09",
     triggerMode: "recommended",
-    description: "\u4EE5\u89C6\u89C9\u76F4\u89C2\u7684\u65B9\u5F0F\uFF08\u7CBE\u70BC\u4F2A\u4EE3\u7801\u3001\u8C03\u7528\u6811\u3001\u7EC4\u4EF6\u6811\u3001Mermaid \u56FE\u8868\u3001\u7ED3\u6784\u5316 Diff \u6216\u72EC\u7ACB HTML \u6E32\u67D3\u5DE5\u4EF6\uFF09\u89E3\u91CA\u590D\u6742\u4E3B\u9898\u3001\u67B6\u6784\u903B\u8F91\u3001\u72B6\u6001\u6D41\u8F6C\u4E0E UI \u7ED3\u6784\u3002\u89E6\u53D1\u8BCD\uFF1A\u753B\u4E2A\u56FE\u3001\u753B\u56FE\u3001\u6D41\u7A0B\u56FE\u3001\u65F6\u5E8F\u56FE\u3001\u53EF\u89C6\u5316\u3001\u600E\u4E48\u8C03\u7528\u7684\u3001\u8C03\u7528\u94FE\u3001\u7EC4\u4EF6\u7ED3\u6784\u3001\u5BF9\u6BD4\u4E00\u4E0B\u3001show me\u3001visualize\u3001diagram\u3001artifact preview\u3002"
+    description: "\u4EE5\u89C6\u89C9\u76F4\u89C2\u7684\u65B9\u5F0F\uFF08\u7CBE\u70BC\u4F2A\u4EE3\u7801\u3001\u8C03\u7528\u6811\u3001\u7EC4\u4EF6\u6811\u3001Mermaid \u56FE\u8868\u3001\u7ED3\u6784\u5316 Diff\u3001\u5355\u6587\u4EF6 HTML \u539F\u578B\u6216\u5DE5\u4F5C\u53F0\u5206\u680F\u5C55\u793A\uFF09\u89E3\u91CA\u590D\u6742\u4E3B\u9898\u3001\u67B6\u6784\u903B\u8F91\u3001\u72B6\u6001\u6D41\u8F6C\u4E0E UI \u7ED3\u6784\u3002\u89E6\u53D1\u8BCD\uFF1A\u753B\u4E2A\u56FE\u3001\u753B\u56FE\u3001\u6D41\u7A0B\u56FE\u3001\u65F6\u5E8F\u56FE\u3001\u53EF\u89C6\u5316\u3001\u600E\u4E48\u8C03\u7528\u7684\u3001\u8C03\u7528\u94FE\u3001\u7EC4\u4EF6\u7ED3\u6784\u3001\u5BF9\u6BD4\u4E00\u4E0B\u3001show me\u3001visualize\u3001diagram\u3001artifact preview\u3002"
   };
 }
 function buildShowmeSkillContentBySlug(slug) {
   return buildSkillDocMarkdown({
-    body: "# Show Me (Visual-First \u7ED3\u6784\u5316\u8868\u8FBE\u6307\u5357)\n\n\u5F53\u89E3\u91CA\u590D\u6742\u7CFB\u7EDF\u3001\u6D41\u7A0B\u3001\u67B6\u6784\u8BBE\u8BA1\u3001\u6392\u9519\u6839\u56E0\u6216 UI \u53D8\u52A8\u65F6\uFF0C\u9075\u5FAA **\u201C\u89C6\u89C9\u4F18\u5148\uFF08Visual-First\uFF09\u201D** \u539F\u5219\u3002\n\u8DF3\u8FC7\u5197\u957F\u5F00\u573A\u767D\uFF0C\u4FDD\u6301\u6B63\u6587\u7B80\u660E\u627C\u8981\uFF0C\u9009\u62E9\u80FD\u8BB2\u6E05\u6838\u5FC3\u89C2\u70B9\u7684**\u6700\u5C0F\u5FC5\u8981\u89C6\u56FE\uFF08Smallest View\uFF09**\u3002\n\n---\n\n## \u6838\u5FC3\u53EF\u89C6\u5316\u6A21\u5F0F\n\n### 1. \u903B\u8F91\u4E0E\u7B97\u6CD5\u4F2A\u4EE3\u7801\n\u5C55\u793A\u5173\u952E\u5206\u652F\u5224\u65AD\u3001\u8BA1\u7B97\u987A\u5E8F\u6216\u6838\u5FC3\u7B97\u6CD5\u6B65\u9AA4\uFF1A\n\n```text\non(save)\n  if content is unchanged\n    return cached result\n  write new content\n  return fresh result\n```\n\n### 2. \u8FD0\u884C\u65F6\u63A7\u5236\u6D41 / \u8C03\u7528\u6811 (Call Tree)\n\u5C55\u793A\u65B9\u6CD5\u8C03\u7528\u5C42\u7EA7\u4E0E\u6570\u636E\u63A8\u8FDB\u94FE\u8DEF\uFF1A\n\n```text\nsubmitForm\n  validateInputs\n  createSession\n    persistPrompt\n    launchAgent\n      spawnWorker\n  navigateToSession\n```\n\n### 3. \u7EC4\u4EF6\u6811\u4E0E\u72B6\u6001\u8FB9\u754C (Component Tree)\n\u5C55\u793A\u524D\u7AEF UI \u7EC4\u4EF6\u5C42\u7EA7\u3001Props \u4F20\u9012\u4EE5\u53CA\u5C40\u90E8/\u5168\u5C40\u72B6\u6001\u6240\u5C5E\uFF1A\n\n```tsx\n(apps/web/src/pages/WorkspacePage.tsx)\n<WorkspaceProvider>                   // \u5168\u5C40 workspace context\n  <WorkspaceLayout>\n    <Sidebar />                       // activeNav, unreadBadges\n    <MainContent>\n      <ChatThread>                    // threadId, messages\n        <MessageList>\n          <MessageItem />             // content, sender\n        </MessageList>\n        <ChatInput />                 // draft, isSending\n      </ChatThread>\n    </MainContent>\n  </WorkspaceLayout>\n</WorkspaceProvider>\n```\n\n### 4. \u6D45\u5C42\u6587\u4EF6\u6811 (File Tree)\n\u5C55\u793A\u76EE\u5F55\u7EC4\u7EC7\u3001\u6A21\u5757\u5F52\u5C5E\u6216\u91CD\u6784\u8303\u56F4\uFF08\u4EC5\u4FDD\u7559\u4E0E\u95EE\u9898\u76F4\u63A5\u76F8\u5173\u7684\u5C42\u7EA7\uFF09\uFF1A\n\n```text\npackages/\n  client/\n    src/\n      components/    // UI \u5C55\u793A\u7EC4\u4EF6\n      hooks/         // \u6570\u636E\u6D41\u4E0E\u54CD\u5E94\u5F0F\u72B6\u6001\n  server/\n    src/\n      routes/        // API \u8DEF\u7531\u5165\u53E3\n      services/      // \u6838\u5FC3\u4E1A\u52A1\u5904\u7406\n```\n\n### 5. \u7ED3\u6784\u5316 Diff\n\u9664\u4E86\u4EE3\u7801\u53D8\u66F4\uFF0C\u8FD8\u53EF\u7528\u4E8E\u76F4\u89C2\u5BF9\u6BD4**\u67B6\u6784\u6F14\u8FDB\u3001\u8C03\u7528\u94FE\u4FEE\u6539\u3001\u6587\u4EF6\u91CD\u6784\u3001\u72B6\u6001\u7ED3\u6784\u53D8\u52A8**\uFF1A\n\n```diff\n  submitForm\n    validateInputs\n-   syncDirectSave\n+   dispatchAsyncJob\n+     queueWorker\n+     pollStatus\n    navigateToSession\n```\n\n### 6. Mermaid \u6D41\u7A0B\u56FE / \u65F6\u5E8F\u56FE / \u72B6\u6001\u673A\n\u7528\u4E8E\u8DE8\u670D\u52A1\u901A\u4FE1\u3001\u591A\u7AEF\u4EA4\u4E92\u3001\u751F\u547D\u5468\u671F\u4E0E\u72B6\u6001\u6D41\u8F6C\uFF08Web / Desktop \u5BA2\u6237\u7AEF\u53EF\u76F4\u63A5\u539F\u751F\u6E32\u67D3\uFF09\uFF1A\n\n```mermaid\nsequenceDiagram\n  autonumber\n  actor User as \u7528\u6237\n  participant Client as \u5BA2\u6237\u7AEF (Web/Desktop)\n  participant Server as Nolo Server\n  participant Agent as Agent Runtime\n\n  User->>Client: \u53D1\u9001\u6307\u4EE4\n  Client->>Server: POST /api/dialog/message\n  Server->>Agent: \u8C03\u5EA6 startAgentThread\n  Agent-->>Client: SSE \u6D41\u5F0F\u54CD\u5E94 (Token / Artifact)\n  Client-->>User: \u5B9E\u65F6\u754C\u9762\u66F4\u65B0\n```\n\n### 7. \u72EC\u7ACB HTML \u6E32\u67D3\u5DE5\u4EF6 (HTML Artifact)\n\u5F53\u6587\u672C\u3001\u6811\u5F62\u56FE\u6216 Mermaid \u65E0\u6CD5\u5145\u5206\u8868\u8FBE\u4E30\u5BCC\u7684\u4EA4\u4E92\u539F\u578B\u3001\u590D\u6742 UI \u5E03\u5C40\u5BF9\u6BD4\u3001\u4FE1\u606F\u56FE\u8868\u6216\u7B80\u62A5\u65F6\uFF0C\u751F\u6210\u4E00\u4EFD\u81EA\u5305\u542B\u7684\u5355\u4E2A HTML \u6587\u4EF6\u3002\n- \u91C7\u7528\u7B26\u5408\u73B0\u4EE3\u4EA7\u54C1\u6807\u51C6\u7684\u914D\u8272\u3001\u5B57\u4F53\u3001\u95F4\u8DDD\u4E0E\u54CD\u5E94\u5F0F\u5E03\u5C40\u3002\n- \u4F7F\u7528\u771F\u5B9E\u6807\u7B7E\u4E0E\u6A21\u62DF\u6570\u636E\uFF0C\u907F\u514D\u7A7A\u7070\u76D2\u3002\n- \u5199\u5165\u6587\u4EF6\u5E76\u901A\u8FC7\u7CFB\u7EDF\u6216 Browser Connector \u6253\u5F00\u7ED9\u7528\u6237\u9884\u89C8\u3002\n\n---\n\n## \u5B9E\u8DF5\u539F\u5219 (Guidance)\n\n1. **\u56FE\u6587\u5E76\u8302\uFF0C\u56FE\u5728\u6587\u5148**\uFF1A\u8BA9\u7ED3\u6784\u56FE\u7D27\u6328\u7740\u5176\u89E3\u91CA\u7684\u7B80\u8FF0\u6587\u5B57\uFF0C\u5148\u5448\u73B0\u6E05\u6670\u56FE\u8868\uFF0C\u518D\u7528 1~3 \u53E5\u8BDD\u8BF4\u660E\u91CD\u70B9\u3002\n2. **\u514B\u5236\u4E0E\u805A\u7126 (Smallest View)**\uFF1A\u53EA\u4FDD\u7559\u56DE\u7B54\u5F53\u524D\u95EE\u9898\u6240\u5FC5\u9700\u7684\u8C03\u7528\u3001\u5C5E\u6027\u3001\u72B6\u6001\u4E0E\u8FB9\u754C\uFF0C\u4E0D\u8981\u5806\u780C\u65E0\u610F\u4E49\u7684\u5168\u5C40\u5197\u4F59\u4EE3\u7801\u3002\n3. **\u9009\u578B\u6070\u5F53**\uFF1A\u901A\u5E38\u4E00\u6B21\u89E3\u91CA\u9009\u7528 1~2 \u79CD\u6700\u5951\u5408\u7684\u53EF\u89C6\u5316\u5F62\u5F0F\u5373\u53EF\uFF0C\u4E0D\u8981\u628A\u6240\u6709\u56FE\u8868\u90FD\u5806\u5728\u4E00\u8D77\u589E\u52A0\u8BA4\u77E5\u8D1F\u62C5\u3002\n4. **\u5BA2\u6237\u7AEF\u9002\u914D**\uFF1A\n   - \u5728 CLI / TUI \u7EC8\u7AEF\u4E2D\uFF0C\u4F18\u5148\u4F7F\u7528\u4F2A\u4EE3\u7801\u3001\u7F29\u8FDB\u8C03\u7528\u6811\u3001Unicode \u5B57\u7B26\u56FE\u4E0E Diff\uFF1B\n   - \u5728 Web / Desktop \u56FE\u5F62\u5BA2\u6237\u7AEF\u4E2D\uFF0C\u5145\u5206\u5229\u7528 Mermaid \u6E32\u67D3\u4E0E HTML Artifacts \u9884\u89C8\u3002",
+    body: '# Show Me (Visual-First \u7ED3\u6784\u5316\u8868\u8FBE\u6307\u5357)\n\n\u5F53\u89E3\u91CA\u590D\u6742\u7CFB\u7EDF\u3001\u6D41\u7A0B\u3001\u67B6\u6784\u8BBE\u8BA1\u3001\u6392\u9519\u6839\u56E0\u6216 UI \u53D8\u52A8\u65F6\uFF0C\u9075\u5FAA **\u201C\u89C6\u89C9\u4F18\u5148\uFF08Visual-First\uFF09\u201D** \u539F\u5219\u3002\n\u8DF3\u8FC7\u5197\u957F\u5F00\u573A\u767D\uFF0C\u4FDD\u6301\u6B63\u6587\u7B80\u660E\u627C\u8981\uFF0C\u9009\u62E9\u80FD\u8BB2\u6E05\u6838\u5FC3\u89C2\u70B9\u7684**\u6700\u5C0F\u5FC5\u8981\u89C6\u56FE\uFF08Smallest View\uFF09**\u3002\n\n---\n\n## \u6838\u5FC3\u53EF\u89C6\u5316\u6A21\u5F0F\n\n### 1. \u903B\u8F91\u4E0E\u7B97\u6CD5\u4F2A\u4EE3\u7801\n\u5C55\u793A\u5173\u952E\u5206\u652F\u5224\u65AD\u3001\u8BA1\u7B97\u987A\u5E8F\u6216\u6838\u5FC3\u7B97\u6CD5\u6B65\u9AA4\uFF1A\n\n```text\non(save)\n  if content is unchanged\n    return cached result\n  write new content\n  return fresh result\n```\n\n### 2. \u8FD0\u884C\u65F6\u63A7\u5236\u6D41 / \u8C03\u7528\u6811 (Call Tree)\n\u5C55\u793A\u65B9\u6CD5\u8C03\u7528\u5C42\u7EA7\u4E0E\u6570\u636E\u63A8\u8FDB\u94FE\u8DEF\uFF1A\n\n```text\nsubmitForm\n  validateInputs\n  createSession\n    persistPrompt\n    launchAgent\n      spawnWorker\n  navigateToSession\n```\n\n### 3. \u7EC4\u4EF6\u6811\u4E0E\u72B6\u6001\u8FB9\u754C (Component Tree)\n\u5C55\u793A\u524D\u7AEF UI \u7EC4\u4EF6\u5C42\u7EA7\u3001Props \u4F20\u9012\u4EE5\u53CA\u5C40\u90E8/\u5168\u5C40\u72B6\u6001\u6240\u5C5E\uFF1A\n\n```tsx\n(apps/web/src/pages/WorkspacePage.tsx)\n<WorkspaceProvider>                   // \u5168\u5C40 workspace context\n  <WorkspaceLayout>\n    <Sidebar />                       // activeNav, unreadBadges\n    <MainContent>\n      <ChatThread>                    // threadId, messages\n        <MessageList>\n          <MessageItem />             // content, sender\n        </MessageList>\n        <ChatInput />                 // draft, isSending\n      </ChatThread>\n    </MainContent>\n  </WorkspaceLayout>\n</WorkspaceProvider>\n```\n\n### 4. \u6D45\u5C42\u6587\u4EF6\u6811 (File Tree)\n\u5C55\u793A\u76EE\u5F55\u7EC4\u7EC7\u3001\u6A21\u5757\u5F52\u5C5E\u6216\u91CD\u6784\u8303\u56F4\uFF08\u4EC5\u4FDD\u7559\u4E0E\u95EE\u9898\u76F4\u63A5\u76F8\u5173\u7684\u5C42\u7EA7\uFF09\uFF1A\n\n```text\npackages/\n  client/\n    src/\n      components/    // UI \u5C55\u793A\u7EC4\u4EF6\n      hooks/         // \u6570\u636E\u6D41\u4E0E\u54CD\u5E94\u5F0F\u72B6\u6001\n  server/\n    src/\n      routes/        // API \u8DEF\u7531\u5165\u53E3\n      services/      // \u6838\u5FC3\u4E1A\u52A1\u5904\u7406\n```\n\n### 5. \u7ED3\u6784\u5316 Diff\n\u9664\u4E86\u4EE3\u7801\u53D8\u66F4\uFF0C\u8FD8\u53EF\u7528\u4E8E\u76F4\u89C2\u5BF9\u6BD4**\u67B6\u6784\u6F14\u8FDB\u3001\u8C03\u7528\u94FE\u4FEE\u6539\u3001\u6587\u4EF6\u91CD\u6784\u3001\u72B6\u6001\u7ED3\u6784\u53D8\u52A8**\uFF1A\n\n```diff\n  submitForm\n    validateInputs\n-   syncDirectSave\n+   dispatchAsyncJob\n+     queueWorker\n+     pollStatus\n    navigateToSession\n```\n\n### 6. Mermaid \u6D41\u7A0B\u56FE / \u65F6\u5E8F\u56FE / \u72B6\u6001\u673A\n\u7528\u4E8E\u8DE8\u670D\u52A1\u901A\u4FE1\u3001\u591A\u7AEF\u4EA4\u4E92\u3001\u751F\u547D\u5468\u671F\u4E0E\u72B6\u6001\u6D41\u8F6C\uFF08Web / Desktop \u5BA2\u6237\u7AEF\u53EF\u76F4\u63A5\u539F\u751F\u6E32\u67D3\uFF09\uFF1A\n\n```mermaid\nsequenceDiagram\n  autonumber\n  actor User as \u7528\u6237\n  participant Client as \u5BA2\u6237\u7AEF (Web/Desktop)\n  participant Server as Nolo Server\n  participant Agent as Agent Runtime\n\n  User->>Client: \u53D1\u9001\u6307\u4EE4\n  Client->>Server: POST /api/dialog/message\n  Server->>Agent: \u8C03\u5EA6 startAgentThread\n  Agent-->>Client: SSE \u6D41\u5F0F\u54CD\u5E94 (Token / Artifact)\n  Client-->>User: \u5B9E\u65F6\u754C\u9762\u66F4\u65B0\n```\n\n### 7. \u72EC\u7ACB HTML \u6E32\u67D3\u5DE5\u4EF6 (HTML Artifact) \u4E0E\u5DE5\u4F5C\u53F0\u5206\u680F\n\u5F53\u6587\u672C\u3001\u6811\u5F62\u56FE\u6216 Mermaid \u65E0\u6CD5\u5145\u5206\u8868\u8FBE\u4E30\u5BCC\u7684\u4EA4\u4E92\u539F\u578B\u3001\u590D\u6742 UI \u5E03\u5C40\u5BF9\u6BD4\u3001\u4FE1\u606F\u56FE\u8868\u6216\u5373\u7528\u5373\u5F03\u5355\u9875\u5E94\u7528\u65F6\uFF0C\u751F\u6210\u4E00\u4EFD\u81EA\u5305\u542B\u7684\u5355\u4E2A HTML \u6587\u4EF6\u3002\n- \u91C7\u7528\u7B26\u5408\u73B0\u4EE3\u4EA7\u54C1\u6807\u51C6\u7684\u914D\u8272\u3001\u5B57\u4F53\u3001\u95F4\u8DDD\u4E0E\u54CD\u5E94\u5F0F\u5E03\u5C40\u3002\n- \u4F7F\u7528\u771F\u5B9E\u6807\u7B7E\u4E0E\u6A21\u62DF\u6570\u636E\uFF0C\u907F\u514D\u7A7A\u7070\u76D2\u3002\n- \u5448\u73B0\u65B9\u5F0F\uFF08\u9075\u5FAA\u4E09\u5C42\u5C55\u793A\u5A92\u4ECB\uFF09\uFF1A\n  1. \u6C14\u6CE1\u5185\u8054\u4E0E\u5361\u7247\uFF1A\u4F7F\u7528 ```html preview="true" \u4EE3\u7801\u5757\uFF0C\u5728\u6D88\u606F\u5185\u5C55\u793A\u7F29\u7565\u5361\u7247\uFF0C\u5E76\u63D0\u4F9B\u3010\u5728\u5DE5\u4F5C\u53F0\u6253\u5F00\u3011\u5165\u53E3\uFF1B\u7B80\u5355\u4EA4\u4E92\u63A7\u4EF6\u53EF\u4F7F\u7528 ```jsx preview="true"\uFF08\u542B `function Example()`\uFF09\uFF1B\n  2. \u5DE5\u4F5C\u53F0\u5206\u680F\uFF08WorkbenchSplit\uFF09\uFF1A\u5B8C\u6574\u9875\u9762\u4E0E\u5373\u7528\u5373\u5F03\u4EA4\u4E92\u539F\u578B\u5728\u53F3\u4FA7\u6216\u5DE6\u4FA7\u5206\u680F\u4EE5\u5B89\u5168\u6C99\u7BB1\uFF08sandbox="allow-scripts"\uFF09\u5168\u666F\u5C55\u793A\uFF0C\u652F\u6301\u8FB9\u804A\u8FB9\u6539\uFF0C\u65E0\u9700\u8DF3\u51FA\u5916\u90E8\u7A97\u53E3\uFF1B\n  3. \u5916\u90E8\u6D4F\u89C8\u5668\uFF1A\u4EC5\u5728\u9700\u8981\u771F\u5B9E\u767B\u5F55\u6001\u3001Cookie \u6216\u91CD\u578B\u5168\u5C4F\u7CFB\u7EDF\u65F6\u624D\u8C03\u7528\u5916\u90E8\u6D4F\u89C8\u5668\u6216 Browser Connector \u6253\u5F00\u3002\n\n---\n\n## \u5B9E\u8DF5\u539F\u5219 (Guidance)\n\n1. **\u56FE\u6587\u5E76\u8302\uFF0C\u56FE\u5728\u6587\u5148**\uFF1A\u8BA9\u7ED3\u6784\u56FE\u7D27\u6328\u7740\u5176\u89E3\u91CA\u7684\u7B80\u8FF0\u6587\u5B57\uFF0C\u5148\u5448\u73B0\u6E05\u6670\u56FE\u8868\uFF0C\u518D\u7528 1~3 \u53E5\u8BDD\u8BF4\u660E\u91CD\u70B9\u3002\n2. **\u514B\u5236\u4E0E\u805A\u7126 (Smallest View)**\uFF1A\u53EA\u4FDD\u7559\u56DE\u7B54\u5F53\u524D\u95EE\u9898\u6240\u5FC5\u9700\u7684\u8C03\u7528\u3001\u5C5E\u6027\u3001\u72B6\u6001\u4E0E\u8FB9\u754C\uFF0C\u4E0D\u8981\u5806\u780C\u65E0\u610F\u4E49\u7684\u5168\u5C40\u5197\u4F59\u4EE3\u7801\u3002\n3. **\u9009\u578B\u6070\u5F53**\uFF1A\u901A\u5E38\u4E00\u6B21\u89E3\u91CA\u9009\u7528 1~2 \u79CD\u6700\u5951\u5408\u7684\u53EF\u89C6\u5316\u5F62\u5F0F\u5373\u53EF\uFF0C\u4E0D\u8981\u628A\u6240\u6709\u56FE\u8868\u90FD\u5806\u5728\u4E00\u8D77\u589E\u52A0\u8BA4\u77E5\u8D1F\u62C5\u3002\n4. **\u5BA2\u6237\u7AEF\u9002\u914D\u4E0E\u5C55\u793A\u5206\u5DE5**\uFF1A\n   - \u5728 CLI / TUI \u7EC8\u7AEF\u4E2D\uFF0C\u4F18\u5148\u4F7F\u7528\u4F2A\u4EE3\u7801\u3001\u7F29\u8FDB\u8C03\u7528\u6811\u3001Unicode \u5B57\u7B26\u56FE\u4E0E Diff\uFF1B\n   - \u5728 Web / Desktop \u56FE\u5F62\u5BA2\u6237\u7AEF\u4E2D\uFF0C\u5145\u5206\u5229\u7528 Mermaid \u6E32\u67D3\u3001\u6C14\u6CE1\u5185\u8054\u5361\u7247\u4E0E\u5DE5\u4F5C\u53F0\u5206\u680F\uFF08WorkbenchSplit\uFF09\u9884\u89C8\uFF1B\u9700\u8981\u5C55\u793A\u7F51\u9875\u6216\u539F\u578B\u65F6\u76F4\u63A5\u8FD4\u56DE\u94FE\u63A5\u6216\u751F\u6210\u5355\u6587\u4EF6\u5236\u54C1\uFF0C\u4E0D\u4E3B\u52A8\u8DF3\u51FA\u5916\u90E8\u72EC\u7ACB\u7A97\u53E3\u3002',
     skillConfig: buildShowmeSkillConfig(slug)
   });
 }
 
 // packages/ai/skills/cavemanSkill.ts
 var CAVEMAN_SKILL_SLUGS = ["caveman"];
-function deterministicId10(prefix, seed) {
+function deterministicId11(prefix, seed) {
   let h = 2166136261;
   for (let i = 0; i < seed.length; i++) {
     h ^= seed.charCodeAt(i);
@@ -1347,11 +1436,11 @@ function deterministicId10(prefix, seed) {
   const suffix = h.toString(36).toUpperCase().padStart(14, "0");
   return (prefix + suffix).slice(0, 26);
 }
-function normalizeSkillSeed9(input) {
+function normalizeSkillSeed10(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function buildCavemanSkillId(slug) {
-  return deterministicId10("01SK", normalizeSkillSeed9(slug) || slug);
+  return deterministicId11("01SK", normalizeSkillSeed10(slug) || slug);
 }
 function buildCavemanSkillPageKey(userId, slug) {
   return `page-${userId}-${buildCavemanSkillId(slug)}`;
@@ -1375,7 +1464,7 @@ function buildCavemanSkillContentBySlug(slug) {
 
 // packages/ai/skills/skillCreatorSkill.ts
 var SKILL_CREATOR_SKILL_SLUGS = ["skill-creator"];
-function deterministicId11(prefix, seed) {
+function deterministicId12(prefix, seed) {
   let h = 2166136261;
   for (let i = 0; i < seed.length; i++) {
     h ^= seed.charCodeAt(i);
@@ -1384,11 +1473,11 @@ function deterministicId11(prefix, seed) {
   const suffix = h.toString(36).toUpperCase().padStart(14, "0");
   return (prefix + suffix).slice(0, 26);
 }
-function normalizeSkillSeed10(input) {
+function normalizeSkillSeed11(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function buildSkillCreatorSkillId(slug) {
-  return deterministicId11("01SK", normalizeSkillSeed10(slug) || slug);
+  return deterministicId12("01SK", normalizeSkillSeed11(slug) || slug);
 }
 function buildSkillCreatorSkillPageKey(userId, slug) {
   return `page-${userId}-${buildSkillCreatorSkillId(slug)}`;
@@ -1412,7 +1501,7 @@ function buildSkillCreatorSkillContentBySlug(slug) {
 
 // packages/ai/skills/agentProviderSetupSkill.ts
 var AGENT_PROVIDER_SETUP_SKILL_SLUGS = ["agent-provider-setup"];
-function deterministicId12(prefix, seed) {
+function deterministicId13(prefix, seed) {
   let h = 2166136261;
   for (let i = 0; i < seed.length; i++) {
     h ^= seed.charCodeAt(i);
@@ -1421,11 +1510,11 @@ function deterministicId12(prefix, seed) {
   const suffix = h.toString(36).toUpperCase().padStart(14, "0");
   return (prefix + suffix).slice(0, 26);
 }
-function normalizeSkillSeed11(input) {
+function normalizeSkillSeed12(input) {
   return input.trim().toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function buildAgentProviderSetupSkillId(slug) {
-  return deterministicId12("01SK", normalizeSkillSeed11(slug) || slug);
+  return deterministicId13("01SK", normalizeSkillSeed12(slug) || slug);
 }
 function buildAgentProviderSetupSkillPageKey(userId, slug) {
   return `page-${userId}-${buildAgentProviderSetupSkillId(slug)}`;
@@ -1450,51 +1539,78 @@ function buildAgentProviderSetupSkillContentBySlug(slug) {
 
 The preset catalog is DATA-DRIVEN \u2014 do not hardcode provider names or base URLs. Always read the live list first.
 
+## CLI Environment & Portability
+
+- The \`nolo\` CLI is globally available once installed and logged in; execute commands directly without assuming the current working directory, a repo clone, or a repository nolo-cli skill.
+- **Shell-less environment check**: If the current runtime does NOT provide \`execShell\` (e.g. web chat without shell execution), you CANNOT directly create or configure custom-provider agents on behalf of the user. The platform \`createAgent\` tool only supports \`apiSource: "platform"\` with platform billing.
+  - Do NOT pretend to create the agent directly without a shell, and do NOT fall back to platform billing.
+  - Clearly explain this limitation to the user and direct them to the web configuration portal at \`/create/agent\` where they can securely configure their provider, model, and API key.
+
 ## Step 1 \u2014 List available presets
 
-Run (via execShell):
+When \`execShell\` is available, run:
 \`\`\`
 nolo agent providers --json
 \`\`\`
 This returns the registry presets grouped by \`group\`:
 - \`subscription\` \u2014 token-plan subscriptions (Step Plan, Kimi Code, OpenCode Go\u2026): need an API key + a locked baseUrl.
 - \`metered_api\` \u2014 pay-per-use own-key APIs (stepfun-api, deepseek-api, minimax\u2026).
-- \`subscription_oauth\` \u2014 OAuth brands (ChatGPT, Claude, Cursor\u2026): **cannot be created from a key here** \u2014 tell the user these require Nolo Desktop OAuth login, and stop.
+- \`subscription_oauth\` \u2014 OAuth brands (ChatGPT, Claude, Cursor\u2026): **cannot be created from a key here** \u2014 tell the user these require Nolo Desktop OAuth login (\`nolo auth <brand>\`), and stop.
 
-Match the user's request to a preset \`id\`. If the user already named one (e.g. "stepfun \u8BA2\u9605" \u2192 \`step-plan\`), skip straight to it. If ambiguous between subscription vs metered for the same vendor (e.g. \`step-plan\` vs \`stepfun-api\`), ask which they mean \u2014 subscription is the monthly-Credit plan, metered is pay-per-token.
+Match the user's request to a preset \`id\`. If the user already named one (e.g. "stepfun \u8BA2\u9605" \u2192 \`step-plan\`), skip straight to it. If ambiguous between subscription vs metered for the same vendor (e.g. \`step-plan\` vs \`stepfun-api\`), ask which they mean \u2014 subscription is a periodic plan with token quota, metered is pay-per-token. Subscriptions do NOT replace platform billing for platform-hosted models.
 
 ## Step 2 \u2014 Model & reasoning effort: fork on how much the user knows
 
-- **User is specific** (names a model or effort): use the preset's \`models[]\` list to confirm the choice is valid, and ask for reasoning effort only among what that model supports (\`low/medium/high\` for stepfun; check \`supportsReasoningEffort\`).
-- **User doesn't know / says "\u968F\u4FBF / \u4F60\u770B\u7740\u529E"**: just use the preset's \`defaultModel\` and default effort \u2014 do NOT interrogate them. The recommended model is already marked \`recommended:true\` in the list.
+- **User specifies a model**: Use the preset's \`models[]\` list to confirm the choice is valid. Do NOT interrogate the user about reasoning effort just because a model was named \u2014 use the model/preset's default effort unless the user explicitly requested a specific reasoning effort tier.
+- **User specifies reasoning effort**: Set it only among what the model supports (\`low/medium/high\`; check \`supportsReasoningEffort\`).
+- **User doesn't know / says "\u968F\u4FBF / \u4F60\u770B\u7740\u529E / \u9ED8\u8BA4"**: Just use the preset's \`defaultModel\` and default effort \u2014 do NOT interrogate them. The recommended model is already marked \`recommended:true\` in the list.
+- **Avoid redundant confirmations**: If the user has already made their preference or choice clear, do NOT re-ask the same question.
 
-## Step 3 \u2014 Collect the API key
+## Step 3 \u2014 Safe credential handling
 
-Show the preset's \`keyFormatHint\` if present (it says where to get the key). Ask the user to paste their API key. Never invent one.
+Show the preset's \`keyFormatHint\` if present (it explains where to obtain the key).
+- **Do not solicit raw keys in chat**: Do NOT prompt the user to paste their API key into the conversation transcript if avoidable.
+- **WARNING on \`--copy-provider-from\`**: Do NOT use or recommend \`--copy-provider-from\` for credential reuse. It does NOT copy API keys or \`credentialRef\` (leaving the new agent with 401 unconfigured credentials), and it silently overwrites explicit \`--model\` flags with the source agent's model.
+- **Recommended**: Guide the user to run the command directly in their local terminal:
+  \`\`\`
+  nolo agent create <slug> --preset <preset-id> [--model <model>] --api-key <YOUR_KEY> --verify
+  \`\`\`
+- If the user explicitly provides a key in chat or requests execution via \`execShell\`:
+  - **Never echo, quote, or repeat the key back** in messages.
+  - **Never show the real key** in draft previews or confirmation summaries (mask as \`***\`).
+  - Transparent security disclosure: Explain to the user that CLI \`--api-key\` passes the key via command line arguments (argv), which may be visible in process listings (\`ps\`) and tool execution logs. \`nolo agent create\` does not read \`CUSTOM_API_KEY\` from the environment, and setting an env var before running does NOT prevent argv exposure because the shell expands it. Do not claim environment variables make argv/logs naturally safe.
 
-## Step 4 \u2014 Confirm & create (sensitive \u2014 confirm first)
-
-Show the user the exact command you will run, with the key masked, and get an explicit yes before executing. Then run it with the key passed via env so it never lands on the command line / in logs:
+## Step 4 \u2014 Confirm & create (when authorization is needed)
 
+Show the resolved command with the key masked (\`--api-key "***"\`):
 \`\`\`
-CUSTOM_API_KEY='<the-key>' nolo agent create <slug> \\
-  --preset <preset-id> --api-key "$CUSTOM_API_KEY" --verify
+nolo agent create <slug> --preset <preset-id> --api-key <KEY> --verify
 \`\`\`
-
+- **Confirmation gate**: If the user's current request has already clearly authorized the creation and its parameters (e.g. "\u5E2E\u6211\u7528 step-plan \u5EFA\u4E2A agent\uFF0Ckey \u662F ..."), proceed to execute directly without redundant re-confirmation. Only pause for confirmation when authorization is missing or when introducing new unexpected expense/permissions.
 - \`--preset\` auto-fills provider/baseUrl/model from the registry; add \`--model <id>\` only if the user picked a non-default model.
-- \`--verify\` probes the endpoint end-to-end and confirms the key works.
+- \`--verify\` probes the endpoint end-to-end to verify that the key works.
 - For a metered preset use its \`metered_api\` id the same way.
 
-## Step 5 \u2014 Report
+## Step 5 \u2014 Verify behavior & report
 
-On success report the created agentKey and model. If \`--verify\` fails, relay the endpoint's error verbatim and suggest checking the key / plan tier.
+Understand the behavior of \`--verify\`:
+- \`nolo agent create ... --verify\` saves the agent record to the database **before** running the verification probe.
+- **Creation success does NOT equal verify success**: If the verification probe fails, the agent has already been created.
+- If \`--verify\` fails:
+  - **Do NOT blindly retry creation** \u2014 that will cause duplicate creation or overwrite errors.
+  - **Never echo raw error output** that might contain secrets, tokens, or authorization headers. Provide a sanitized diagnostic message (e.g. endpoint unreachable, HTTP 401 unauthorized, or model not found).
+  - Advise the user to verify their key, network, or plan tier, and update the existing agent via \`nolo agent update\` or \`/create/agent\` rather than re-creating it.
+- On complete success (both creation and probe passed), report the created agentKey and model.
 
 ## Hard rules
 
-- API key goes through the \`CUSTOM_API_KEY\` env var, never as a literal arg, never echoed back.
-- Always show the resolved command (key masked) and get confirmation before running \u2014 creating an agent + storing a credential is a sensitive action.
-- OAuth subscription presets \u2192 redirect to Nolo Desktop; do not attempt to create them via key.
-- If \`nolo agent providers\` fails or the list is empty, say so and ask the user for the provider's base URL + key to build a manual custom agent instead.`
+- Never invent or hardcode provider lists; always read \`nolo agent providers --json\`.
+- Never claim environment variables eliminate argv or log exposure risks when passing keys to CLI.
+- Never echo raw API keys back to the conversation.
+- Without shell (\`execShell\`), never pretend to create custom-provider agents; direct to \`/create/agent\`.
+- Do NOT demand redundant confirmation if the user already explicitly authorized the creation in context; confirm only when authorization is missing or scope changes.
+- Do NOT recommend \`--copy-provider-from\` for credential reuse; warn that it does not copy keys and overwrites \`--model\`.
+- OAuth subscription presets \u2192 redirect to Nolo Desktop (\`nolo auth <brand>\`); do not attempt to create them via key.`
   });
 }
 
@@ -1570,6 +1686,13 @@ var SOURCES = [
     buildConfig: buildWorktreeSkillConfig,
     buildContent: buildWorktreeSkillContentBySlug
   },
+  {
+    slugs: SECRETS_MANAGER_SKILL_SLUGS,
+    buildSkillId: buildSecretsManagerSkillId,
+    buildPageKey: buildSecretsManagerSkillPageKey,
+    buildConfig: buildSecretsManagerSkillConfig,
+    buildContent: buildSecretsManagerSkillContentBySlug
+  },
   {
     slugs: SYSTEMATIC_INVESTIGATION_SKILL_SLUGS,
     buildSkillId: buildSystematicinvestigationSkillId,

package/{chunk-YUWMM4US.js → chunk-HKX3ULQB.js}

@@ -1,27 +1,28 @@
 import {
   refreshSubscriptionQuotas
 } from "./chunk-U4STABYN.js";
+import {
+  getReadableCliDb
+} from "./chunk-P5QACQDK.js";
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-WRMKCKZ3.js";
+} from "./chunk-FJMRBOPO.js";
 import {
   readCredentialAvailability
-} from "./chunk-62IL3KQV.js";
-import {
-  getReadableCliDb
-} from "./chunk-CTUQJVQM.js";
+} from "./chunk-6MXDOUMH.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
   normalizeAgentRecordForOutput,
   parseAgentUpdateArgs,
+  refreshAgentRecordCache,
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-ALGORS6Y.js";
+} from "./chunk-ZF6526IQ.js";
 import {
   resolveCliAgentKeyInput
-} from "./chunk-SV5IJK6K.js";
+} from "./chunk-NBTY7YJF.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -160,10 +161,10 @@ async function runAgentUpdateCommand(args, deps = {}) {
       userId,
       record: built.nextRecord
     });
-    await db.put(built.agentKey, {
-      ...built.nextRecord,
-      dbKey: built.agentKey,
-      key: built.nextRecord?.key || built.agentKey,
+    await refreshAgentRecordCache({
+      db,
+      agentKey: built.agentKey,
+      record: built.nextRecord,
       serverOrigin: built.serverUrl
     });
     clearCliLocalRuntimePreparedAgentCache();
@@ -242,16 +243,25 @@ async function runAgentCreateCommand(args, deps = {}) {
     clearCliLocalRuntimePreparedAgentCache();
     let verifyResult;
     if (parsed.verify) {
-      const { verifyCustomProvider } = await import("./agentProviderCommands-YK2BIIXZ.js");
-      const rec = built.nextRecord;
-      verifyResult = await verifyCustomProvider({
-        providerUrl: rec.customProviderUrl,
-        apiKey: rec.apiKey,
-        model: rec.model,
-        prompt: parsed.verifyPrompt,
-        fetchImpl
-      });
+      try {
+        const { verifyCustomProvider } = await import("./agentProviderCommands-HL6MBLCL.js");
+        const rec = built.nextRecord;
+        verifyResult = await verifyCustomProvider({
+          providerUrl: rec.customProviderUrl,
+          apiKey: rec.apiKey,
+          model: rec.model,
+          prompt: parsed.verifyPrompt,
+          fetchImpl
+        });
+      } catch (error) {
+        verifyResult = {
+          ok: false,
+          reason: toErrorMessage(error)
+        };
+      }
     }
+    const isVerifyFailure = parsed.verify ? !verifyResult || !verifyResult.ok : false;
+    const verified = parsed.verify ? Boolean(verifyResult?.ok) : null;
     const apiKeyRef = String(built.updates?.apiKeyRef || "").trim();
     let authHint;
     const OAUTH_REFS = /* @__PURE__ */ new Set(["claude", "chatgpt", "xai", "antigravity", "cloudflare"]);
@@ -266,7 +276,9 @@ async function runAgentCreateCommand(args, deps = {}) {
       }
     }
     output.write(JSON.stringify({
-      ok: true,
+      ok: !isVerifyFailure,
+      created: true,
+      verified,
       agentKey: built.agentKey,
       baseUrl: built.serverUrl,
       updates: sanitizeAgentRecordForCliOutput(built.updates),
@@ -280,7 +292,7 @@ async function runAgentCreateCommand(args, deps = {}) {
       errorOutput.write(`[nolo] Hint: ${authHint}
 `);
     }
-    return 0;
+    return isVerifyFailure ? 2 : 0;
   } catch (error) {
     output.write(
       `[nolo] agent create failed: ${toErrorMessage(error)}