nolo-cli 0.156.0 → 0.157.0

package/{chunk-UUPXTEZA.js → chunk-MLEANT7D.js}

@@ -42,7 +42,7 @@ import {
 } from "./chunk-I42VC5KR.js";
 import {
   resolveRunsDir
-} from "./chunk-SNAWGDXT.js";
+} from "./chunk-LPO6AMQU.js";
 import {
   getDefaultCliLocalRuntimeDb
 } from "./chunk-GAGGEA7D.js";

package/{chunk-7PDNSQZC.js → chunk-MMSQTZCJ.js}

@@ -1,10 +1,10 @@
 import {
   fetchReferenceContents,
   resolveReferenceAssets
-} from "./chunk-JIAZK434.js";
+} from "./chunk-4226O6F7.js";
 import {
   updateTokensAction
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-XZIW3Q5B.js";
 import {
   applyUpdateTokensFulfilled
 } from "./chunk-OWYYDMGJ.js";

package/{chunk-QFL42TMV.js → chunk-MR3ITQEV.js}

@@ -20,7 +20,7 @@ import {
   toolRunUpdated,
   uiCardFallback,
   waitForAbortableDelay
-} from "./chunk-6QIBWOPT.js";
+} from "./chunk-K6Y5T4GE.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -52,7 +52,7 @@ import {
 } from "./chunk-3L5MSPWX.js";
 import {
   markdownToSlate
-} from "./chunk-CNWKLQRL.js";
+} from "./chunk-KSTEXKL6.js";
 import {
   extractMentionsFromSlate
 } from "./chunk-AGIM7IMJ.js";
@@ -64,7 +64,7 @@ import {
 } from "./chunk-VF4K2QE6.js";
 import {
   createDocState
-} from "./chunk-K3N2DWLT.js";
+} from "./chunk-6Y3ETA2Y.js";
 import {
   addMemberSpace,
   fetchAuthoritativeRemoteSpace,
@@ -79,7 +79,7 @@ import {
 } from "./chunk-BAWAKW7X.js";
 import {
   createDialogAction
-} from "./chunk-4FDDVVCE.js";
+} from "./chunk-B3ZIFOFI.js";
 import {
   setDialogExtraReferencesAction
 } from "./chunk-IF7V3CBU.js";
@@ -102,7 +102,7 @@ import {
   updateContentCategory,
   updateContentTitle,
   writeStoredCollapsedCategories
-} from "./chunk-FTHF2P2I.js";
+} from "./chunk-IKOKYBYJ.js";
 import {
   buildDatabaseFileContentUrl,
   deleteDialog,
@@ -115,7 +115,7 @@ import {
   selectMsgById,
   uiAskChoiceFunc,
   uiAskChoiceFunctionSchema
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-XZIW3Q5B.js";
 import {
   buildMediaToolConfirmation,
   normalizeMediaConfirmExecutionRevision
@@ -126,7 +126,7 @@ import {
   runLlm,
   streamAgentChatTurn,
   updateAgent
-} from "./chunk-EDJND3FK.js";
+} from "./chunk-R7GCGOGZ.js";
 import {
   getCurrentSpaceId,
   getCurrentSpaceIdRaw,
@@ -3882,7 +3882,7 @@ async function deleteDialogsFunc(args, thunkApi) {
   const deletedDialogIds = [];
   const deletedDialogKeys = [];
   const failures = [];
-  const { deleteDialog: deleteDialog2 } = await import("./dialogSlice-2Z66AWEW.js");
+  const { deleteDialog: deleteDialog2 } = await import("./dialogSlice-WJEEPG4W.js");
   for (const target of targets) {
     try {
       await thunkApi.dispatch(deleteDialog2(target.dbKey)).unwrap();
@@ -14818,9 +14818,29 @@ function buildRuntimeCatalog(deps) {
     reason: dockerReadiness.reason ?? "not-configured",
     ...dockerReadiness.details ? { details: dockerReadiness.details } : {}
   };
+  const isInstaboxBound = deps.isInstaboxBound ? Boolean(deps.isInstaboxBound(ctx.owner)) : false;
+  const instaboxReady = Boolean(isInstaboxBound && deps.instaboxReadiness?.ready === true);
+  const instaboxKey = key(ctx.scope, ctx.owner, "instabox");
+  const instaboxSummary = instaboxReady ? {
+    runtimeKey: instaboxKey,
+    kind: "instabox",
+    name: "Instabox",
+    status: "ready",
+    selectable: true,
+    ...deps.instaboxReadiness?.quotaSnapshot ? { quotaSnapshot: deps.instaboxReadiness.quotaSnapshot } : {}
+  } : {
+    runtimeKey: instaboxKey,
+    kind: "instabox",
+    name: "Instabox",
+    status: "unavailable",
+    selectable: false,
+    reason: isInstaboxBound ? deps.instaboxReadiness?.reason ?? "quota-unverifiable" : "not-configured",
+    ...isInstaboxBound && !deps.instaboxReadiness ? { details: "Instabox credentials configured but readiness not probed" } : deps.instaboxReadiness?.details ? { details: deps.instaboxReadiness.details } : {}
+  };
   runtimes.push(
     summary("local", "Local (client only)", false, "unsupported-local"),
     dockerSummary,
+    instaboxSummary,
     summary("cloudflare", "Cloudflare", false, "not-configured")
   );
   return { runtimes, selectableCount: runtimes.filter((runtime) => runtime.selectable).length };
@@ -14847,6 +14867,7 @@ function formatRuntimeSummaryCard(runtimes) {
   return `Available Runtimes:
 ${lines.join("\n")}`;
 }
+var serverHooks;
 async function resolveTrustedDockerReadiness(thunkApi, trustedContext) {
   const source = trustedContext?.dockerReadinessSource ?? thunkApi?.extra?.dockerReadinessSource;
   if (source && typeof source.get === "function") {
@@ -14867,19 +14888,66 @@ async function resolveTrustedDockerReadiness(thunkApi, trustedContext) {
     dockerQuotaSnapshot: trustedContext?.dockerQuotaSnapshot ?? thunkApi?.extra?.dockerQuotaSnapshot
   });
 }
-async function loadDockerBindingIsBoundFallback() {
-  try {
-    const { getDockerBindingAuthorizer } = await import("../../../server/handlers/agentRun/dockerWorkloadLifecycle");
-    return (caller) => Boolean(getDockerBindingAuthorizer().isBound?.(caller));
-  } catch {
-    return void 0;
+function loadDockerBindingIsBoundFallback() {
+  if (serverHooks?.getDockerBindingAuthorizer) {
+    try {
+      const authorizer = serverHooks.getDockerBindingAuthorizer();
+      return (caller) => Boolean(authorizer?.isBound?.(caller));
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+async function loadInstaboxBoundFallback(callerUserId) {
+  if (!callerUserId) return false;
+  if (serverHooks?.isInstaboxBound) {
+    try {
+      return await serverHooks.isInstaboxBound(callerUserId);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+async function resolveTrustedInstaboxReadiness(callerUserId, thunkApi, trustedContext, isInstaboxBound) {
+  const source = trustedContext?.instaboxReadinessSource ?? thunkApi?.extra?.instaboxReadinessSource;
+  if (source && typeof source.get === "function" && callerUserId) {
+    try {
+      return await source.get(callerUserId);
+    } catch {
+      return {
+        ready: false,
+        reason: "quota-unverifiable",
+        details: "Instabox readiness source probe failed"
+      };
+    }
   }
+  const injected = trustedContext?.instaboxReadiness ?? thunkApi?.extra?.instaboxReadiness;
+  if (injected) return injected;
+  if (callerUserId && isInstaboxBound?.(callerUserId)) {
+    if (serverHooks?.getInstaboxReadiness) {
+      try {
+        return await serverHooks.getInstaboxReadiness(callerUserId);
+      } catch {
+        return void 0;
+      }
+    }
+  }
+  return void 0;
 }
 function resolveTrustedCallerUserId(thunkApi, trustedContext) {
-  const bound = trustedContext?.callerUserId;
-  if (bound !== void 0 && bound !== null) return bound;
-  const fromStore = selectIdentityUserId(thunkApi?.getState?.());
-  if (fromStore) return fromStore;
+  if (trustedContext && "callerUserId" in trustedContext) {
+    const bound = trustedContext.callerUserId;
+    return typeof bound === "string" ? bound : "";
+  }
+  if (typeof thunkApi?.getState === "function") {
+    const state2 = thunkApi.getState();
+    if (state2 != null) {
+      const fromStore = selectIdentityUserId(state2);
+      if (fromStore) return fromStore;
+    }
+  }
   const fromExtra = thunkApi?.extra?.userId;
   return typeof fromExtra === "string" ? fromExtra : void 0;
 }
@@ -14896,6 +14964,18 @@ async function listRuntimesToolFunc(_args, thunkApi, trustedContext) {
   const connectorSurface = trustedContext?.connectorSurface ?? "cli";
   const dockerReadiness = await resolveTrustedDockerReadiness(thunkApi, trustedContext);
   const isDockerBound = trustedContext?.isDockerBound ?? thunkApi?.extra?.isDockerBound ?? (trustedContext?.dockerSelectable === true ? () => true : void 0) ?? (trustedContext?.dockerReadinessSource ? () => true : void 0) ?? await loadDockerBindingIsBoundFallback();
+  const explicitInstaboxBound = trustedContext?.isInstaboxBound ?? thunkApi?.extra?.isInstaboxBound;
+  let isInstaboxBound = explicitInstaboxBound;
+  if (!isInstaboxBound && callerUserId) {
+    const bound = await loadInstaboxBoundFallback(callerUserId);
+    isInstaboxBound = (caller) => caller === callerUserId ? bound : false;
+  }
+  const instaboxReadiness = await resolveTrustedInstaboxReadiness(
+    callerUserId,
+    thunkApi,
+    trustedContext,
+    isInstaboxBound
+  );
   if (!callerUserId || !callerUserId.trim()) {
     return {
       rawData: {
@@ -14915,7 +14995,9 @@ async function listRuntimesToolFunc(_args, thunkApi, trustedContext) {
     machineRegistry,
     connectorConnections,
     dockerReadiness,
-    isDockerBound
+    isDockerBound,
+    isInstaboxBound,
+    instaboxReadiness
   });
   return {
     rawData: {
@@ -18481,7 +18563,7 @@ async function updateDocFunc(args, thunkApi) {
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     await dispatch(write({ data: updatedPageData, customKey: id })).unwrap();
-    const { getDocState, applyExternalDocUpdate } = await import("./docStore-XMTUF3GX.js");
+    const { getDocState, applyExternalDocUpdate } = await import("./docStore-7JPYT25V.js");
     if (getDocState().pageKey === id) {
       applyExternalDocUpdate({
         slateData: finalSlateData,

package/{chunk-PNACBSRF.js → chunk-NLFTBC6S.js}

@@ -9,16 +9,19 @@ import {
   resolveRawAgentInput,
   resolveServerUrl,
   writeUsage
-} from "./chunk-U5U4WAFS.js";
+} from "./chunk-FHG46N5C.js";
 import {
   getReadableCliDb
 } from "./chunk-62TBKWTV.js";
 import {
+  INSTABOX_RUN_CONFIG_ENV,
   createCliLocalRuntimeAdapter,
   detectCurrentMachineId,
+  hashInstaboxDeliveryManifest,
   isBuiltinNoloAgentRef,
   isCliProviderAgentConfig,
   isDockerRuntimeKey,
+  isInstaboxBillingPolicy,
   isLiveAgentRunObservation,
   isMachineBoundLocalhostCustomProvider,
   isSubtaskRun,
@@ -26,8 +29,9 @@ import {
   resolveAuthToken as resolveAuthToken2,
   resolveBoundMachineId,
   resolveFileWriteGateEnabled,
-  resolveLocalUserId
-} from "./chunk-GXZZOTDM.js";
+  resolveLocalUserId,
+  validateInstaboxWorkspaceSelection
+} from "./chunk-ZKVS36H3.js";
 import {
   clearCredentialAvailability,
   readCredentialEntry,
@@ -75,14 +79,14 @@ import {
 } from "./chunk-BMQ2MJUK.js";
 import {
   resolveCliLocalRuntimeKeyCapability
-} from "./chunk-QFL42TMV.js";
+} from "./chunk-MR3ITQEV.js";
 import {
   isTransientFetchError
 } from "./chunk-KFHREHUQ.js";
 import {
   parseUiCard,
   uiCardFallback
-} from "./chunk-6QIBWOPT.js";
+} from "./chunk-K6Y5T4GE.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -91,7 +95,7 @@ import {
   chooseMemoryOwners,
   loadMemoryCandidatesFromDb,
   resolveAgentMemoryPolicy
-} from "./chunk-4FDDVVCE.js";
+} from "./chunk-B3ZIFOFI.js";
 import {
   API_REPORTED_COST_MULTIPLIER,
   estimateMessagesTokens,
@@ -99,7 +103,7 @@ import {
   resolveAgentContextWindow,
   resolveOccupancy,
   resolveOccupancyWindow
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-XZIW3Q5B.js";
 import {
   buildSkillDiscoveryContextLayer
 } from "./chunk-AU7AXHUL.js";
@@ -178,10 +182,11 @@ import {
   recordRunResultHeaderMeta,
   resolveResultServerMeta,
   resolveRunQueuePath,
+  resolveRunsDir,
   serverOriginForDialog,
   settleRunTerminalAuthoritatively,
   spawnLocalBackgroundRun
-} from "./chunk-SNAWGDXT.js";
+} from "./chunk-LPO6AMQU.js";
 import {
   formatAgentListCard,
   formatFinishedRunCard,
@@ -238,6 +243,148 @@ import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
 
+// packages/cli/client/instaboxRunConfigWrite.ts
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, normalize, resolve } from "node:path";
+var InstaboxRunConfigWriteError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(`instabox_run_config_write:${code}: ${message}`);
+    this.name = "InstaboxRunConfigWriteError";
+    this.code = `instabox_run_config_write:${code}`;
+  }
+};
+var fail = (code, msg) => {
+  throw new InstaboxRunConfigWriteError(code, msg);
+};
+function writeInstaboxRunConfig(options) {
+  const { workspaceMode, artifactDir, manifestPath, allowRemoteRelease } = options;
+  if (workspaceMode !== "empty" && workspaceMode !== "snapshot") {
+    fail("invalid_workspace_mode", 'workspaceMode \u5FC5\u987B\u662F "empty" \u6216 "snapshot"');
+  }
+  const trimmedArtifactDir = artifactDir?.trim();
+  if (!trimmedArtifactDir) {
+    fail("missing_artifact_dir", "artifactDir \u5FC5\u987B\u662F\u975E\u7A7A\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u672A\u914D\u7F6E\u6216\u9ED8\u8BA4\u5747\u88AB\u62D2\u7EDD");
+  }
+  if (!isAbsolute(trimmedArtifactDir) || trimmedArtifactDir.includes("\0") || trimmedArtifactDir.split("/").includes("..")) {
+    fail("invalid_artifact_dir", `artifactDir \u5FC5\u987B\u4E3A\u5408\u6CD5\u7684\u7EDD\u5BF9\u8DEF\u5F84\u4E14\u4E0D\u80FD\u5305\u542B .. \u6216\u7A7A\u5B57\u7B26: "${trimmedArtifactDir}"`);
+  }
+  const approvalId = `appr-${randomUUID()}`;
+  const bindingId = `bind-${randomUUID()}`;
+  const freeCreateEvidenceId = `fce-${randomUUID()}`;
+  const workspaceAuthorizationId = `wauth-${randomUUID()}`;
+  const recoverySupportId = `rcv-${randomUUID()}`;
+  let manifest = null;
+  let manifestSha256 = null;
+  let allowedPaths = [];
+  if (workspaceMode === "snapshot") {
+    const rawPath = manifestPath ? manifestPath.trim() : "";
+    if (!rawPath) {
+      fail("missing_manifest_path", 'workspaceMode \u4E3A "snapshot" \u65F6\u5FC5\u987B\u63D0\u4F9B manifest \u6587\u4EF6\u8DEF\u5F84');
+    }
+    const resolvedManifestPath = resolve(rawPath);
+    let rawText = "";
+    try {
+      const reader = options.readTextFile ?? ((p) => readFileSync(p, "utf8"));
+      rawText = reader(resolvedManifestPath);
+    } catch (err) {
+      fail(
+        "manifest_read_failed",
+        `\u8BFB\u53D6 manifest \u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    let parsedManifest;
+    try {
+      parsedManifest = JSON.parse(rawText);
+    } catch (err) {
+      fail(
+        "invalid_manifest_json",
+        `manifest \u6587\u4EF6 JSON \u89E3\u6790\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    try {
+      manifestSha256 = hashInstaboxDeliveryManifest(parsedManifest);
+      validateInstaboxWorkspaceSelection({
+        workspaceMode: "approved-snapshot",
+        manifest: parsedManifest,
+        approval: {
+          id: approvalId,
+          manifestSha256
+        }
+      });
+    } catch (err) {
+      fail(
+        "invalid_manifest_selection",
+        `manifest \u6821\u9A8C\u672A\u901A\u8FC7: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    manifest = parsedManifest;
+    allowedPaths = parsedManifest.files.map((f) => f.path);
+  } else {
+    if (manifestPath && manifestPath.trim()) {
+      fail("unexpected_manifest", 'workspaceMode \u4E3A "empty" \u65F6\u4E0D\u5F97\u63D0\u4F9B manifest');
+    }
+  }
+  const rawBillingPolicy = options.billingPolicy ?? (options.allowPaid ? "allow-paid" : "free-only");
+  if (!isInstaboxBillingPolicy(rawBillingPolicy)) {
+    fail("invalid_billing_policy", `billingPolicy \u5FC5\u987B\u4E3A "free-only" \u6216 "allow-paid"\uFF0C\u6536\u5230 "${rawBillingPolicy}"`);
+  }
+  const billingPolicy = rawBillingPolicy;
+  const env = options.env ?? process.env;
+  const isPaid = options.isPaidAccount === true || options.account?.isPaid === true || options.account?.kind === "paid" || options.account?.accountKind === "paid" || env?.INSTABOX_ACCOUNT_KIND === "paid" || env?.INSTABOX_ACCOUNT_TYPE === "paid" || env?.INSTABOX_PAID_ACCOUNT === "true" || env?.INSTABOX_PAID_ACCOUNT === "1";
+  if (isPaid && billingPolicy !== "allow-paid") {
+    fail("paid_account_disallowed", "\u4ED8\u8D39 Instabox \u8D26\u53F7\u9700\u663E\u5F0F --instabox-allow-paid");
+  }
+  const config = {
+    bindingId,
+    freeCreateEvidenceId,
+    workspaceAuthorizationId,
+    recoverySupportId,
+    workspaceMode: workspaceMode === "snapshot" ? "approved-snapshot" : "empty",
+    billingPolicy,
+    approvalId,
+    artifactRoot: trimmedArtifactDir,
+    allowRemoteRelease: Boolean(allowRemoteRelease),
+    allowedPaths
+  };
+  if (workspaceMode === "snapshot" && manifest && manifestSha256) {
+    config.manifest = manifest;
+    config.manifestSha256 = manifestSha256;
+  }
+  const runsDir = options.runsDir ?? resolveRunsDir(env);
+  const normalizedRunsDir = normalize(resolve(runsDir));
+  try {
+    mkdirSync(normalizedRunsDir, { recursive: true, mode: 448 });
+  } catch (err) {
+    fail("mkdir_failed", `\u521B\u5EFA runs \u76EE\u5F55\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const fileName = `instabox-run-${randomUUID()}.json`;
+  const targetPath = join(normalizedRunsDir, fileName);
+  try {
+    writeFileSync(targetPath, JSON.stringify(config, null, 2), {
+      flag: "wx",
+      mode: 384
+    });
+  } catch (err) {
+    fail("file_write_failed", `\u72EC\u5360\u521B\u5EFA\u53D7\u63A7\u914D\u7F6E\u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const stats = lstatSync(targetPath);
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+      fail("symlink_rejected", `\u914D\u7F6E\u6587\u4EF6\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5\u6216\u975E\u5E38\u89C4\u6587\u4EF6: ${targetPath}`);
+    }
+  } catch (err) {
+    if (err instanceof InstaboxRunConfigWriteError) throw err;
+    fail("file_stat_failed", `\u68C0\u9A8C\u914D\u7F6E\u6587\u4EF6\u72B6\u6001\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  process.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  if (options.env) {
+    options.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  }
+  return { configPath: targetPath, config };
+}
+
 // packages/agent-runtime/modelLayerOverride.ts
 var MODEL_LAYER_KEYS = [
   "provider",
@@ -12728,7 +12875,7 @@ import * as nodeFs from "node:fs";
 var CLI_AUTO_ROUTE_AGENT_KEY = BUILTIN_NOLO_AGENT_KEY;
 
 // packages/agent-runtime/hostEnvironment.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import os from "node:os";
 function parseLinuxOsRelease(content) {
   let prettyName;
@@ -12767,9 +12914,9 @@ function probeHostEnvironment(options) {
     if (osReleaseText === void 0) {
       try {
         if (existsSync("/etc/os-release")) {
-          osReleaseText = readFileSync("/etc/os-release", "utf8");
+          osReleaseText = readFileSync2("/etc/os-release", "utf8");
         } else if (existsSync("/usr/lib/os-release")) {
-          osReleaseText = readFileSync("/usr/lib/os-release", "utf8");
+          osReleaseText = readFileSync2("/usr/lib/os-release", "utf8");
         }
       } catch {
       }
@@ -12835,16 +12982,16 @@ function buildHostEnvironmentLayer(options) {
 }
 
 // packages/agent-runtime/agentsMd.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { join } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { join as join2 } from "node:path";
 var AGENTS_MD_MAX_BYTES = 8192;
 var AGENTS_MD_CANDIDATES = ["AGENTS.md", "CLAUDE.md"];
 function readAgentsMdLayerFromDisk(cwd) {
   for (const name of AGENTS_MD_CANDIDATES) {
-    const filePath = join(cwd, name);
+    const filePath = join2(cwd, name);
     if (!existsSync2(filePath)) continue;
     try {
-      let content = readFileSync2(filePath, "utf8").trim();
+      let content = readFileSync3(filePath, "utf8").trim();
       if (!content) continue;
       if (Buffer.byteLength(content, "utf8") > AGENTS_MD_MAX_BYTES) {
         content = Buffer.from(content, "utf8").subarray(0, AGENTS_MD_MAX_BYTES).toString("utf8") + "\n\n<!-- AGENTS.md truncated -->";
@@ -12914,17 +13061,17 @@ function runDoDCommands(commands, cwd, deps = {}) {
 }
 
 // packages/cli/agentRunPrompts.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "node:fs";
-import { dirname, extname, isAbsolute, join as join2, relative as relativePath, resolve, sep } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
+import { dirname, extname, isAbsolute as isAbsolute2, join as join3, relative as relativePath, resolve as resolve2, sep } from "node:path";
 function workflowRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
-  return resolve(cwd, "docs", "workflows", `${fileName}.md`);
+  return resolve2(cwd, "docs", "workflows", `${fileName}.md`);
 }
 var SKILL_SEARCH_DIRS = [
   ".agents/skills"
@@ -12933,22 +13080,22 @@ function skillRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
   for (const dir of SKILL_SEARCH_DIRS) {
-    const skillMdPath = resolve(cwd, dir, fileName, "SKILL.md");
+    const skillMdPath = resolve2(cwd, dir, fileName, "SKILL.md");
     if (existsSync3(skillMdPath)) return skillMdPath;
   }
-  return resolve(cwd, ".agents", "skills", fileName, "SKILL.md");
+  return resolve2(cwd, ".agents", "skills", fileName, "SKILL.md");
 }
 async function resolveWorkflowReference(ref, cwd = process.cwd()) {
   const path2 = workflowRefToCandidatePath(cwd, ref);
   if (!path2 || !existsSync3(path2)) {
     throw new Error(`Workflow reference not found: ${ref}`);
   }
-  const markdown = readFileSync3(path2, "utf8");
+  const markdown = readFileSync4(path2, "utf8");
   const parsed = parseSkillDocProtocol(markdown);
   return {
     ref,
@@ -12958,15 +13105,15 @@ async function resolveWorkflowReference(ref, cwd = process.cwd()) {
 }
 function inlineRelativeRefs(body, skillDir) {
   const refPattern = /\[([^\]]+)\]\((\.\/[^)]+|[^)]+\/[^)]+)\)/g;
-  const normalizedSkillDir = resolve(skillDir) + sep;
+  const normalizedSkillDir = resolve2(skillDir) + sep;
   return body.replace(refPattern, (match, label, relPath) => {
     const cleaned = relPath.trim();
     if (!cleaned.startsWith("./") && !cleaned.startsWith("../")) return match;
-    const absPath = resolve(skillDir, cleaned);
+    const absPath = resolve2(skillDir, cleaned);
     const relative = relativePath(normalizedSkillDir, absPath);
-    if (relative.startsWith("..") || isAbsolute(relative)) return match;
+    if (relative.startsWith("..") || isAbsolute2(relative)) return match;
     if (!existsSync3(absPath) || !absPath.endsWith(".md")) return match;
-    const refContent = readFileSync3(absPath, "utf8");
+    const refContent = readFileSync4(absPath, "utf8");
     return `
 
 ### ${label}
@@ -12977,7 +13124,7 @@ ${refContent}
   });
 }
 function listSkillScripts(skillDir) {
-  const scriptsDir = join2(skillDir, "scripts");
+  const scriptsDir = join3(skillDir, "scripts");
   if (!existsSync3(scriptsDir) || !statSync2(scriptsDir).isDirectory()) return null;
   const entries = readdirSync(scriptsDir).filter((e) => !e.startsWith("."));
   if (entries.length === 0) return null;
@@ -13008,7 +13155,7 @@ async function resolveSkillReference(ref, options = {}) {
     if (!path2 || !existsSync3(path2)) {
       throw new Error(`Skill reference not found: ${ref}`);
     }
-    markdown = readFileSync3(path2, "utf8");
+    markdown = readFileSync4(path2, "utf8");
     filePath = path2;
     skillDir = dirname(path2);
   }
@@ -13112,9 +13259,9 @@ function prependSubjectDialogMarker(message, subjectDialogKey) {
 }
 function normalizeCliImageInput(input) {
   if (/^(https?:|data:|file:)/i.test(input)) return input;
-  const absolutePath = resolve(input);
+  const absolutePath = resolve2(input);
   if (!existsSync3(absolutePath)) return input;
-  const base64 = readFileSync3(absolutePath).toString("base64");
+  const base64 = readFileSync4(absolutePath).toString("base64");
   return `data:${imageMimeTypeForPath(absolutePath)};base64,${base64}`;
 }
 function imageMimeTypeForPath(path2) {
@@ -15658,6 +15805,22 @@ async function runAgentRunCommand(args, deps) {
   if (!localRuntimeCwd && (parsed.runtimeMode === "local" || hostRuntimeLocal)) {
     localRuntimeCwd = process.cwd();
   }
+  if (parsed.runtimeKey === "instabox") {
+    try {
+      writeInstaboxRunConfig({
+        workspaceMode: parsed.instaboxWorkspace,
+        artifactDir: parsed.instaboxArtifactDir,
+        manifestPath: parsed.instaboxManifestPath,
+        allowRemoteRelease: parsed.instaboxAllowRemoteRelease,
+        allowPaid: parsed.instaboxAllowPaid,
+        env
+      });
+    } catch (err) {
+      output.write(`[nolo] instabox \u914D\u7F6E\u751F\u6210\u5931\u8D25: ${toErrorMessage(err)}
+`);
+      return 1;
+    }
+  }
   const runEnv = buildLocalRunEnv({
     env,
     allowShell: parsed.allowShell

package/{chunk-Q5LVXPGT.js → chunk-OLUKIUX6.js}

@@ -1,9 +1,9 @@
 import {
   toolRegistry
-} from "./chunk-QFL42TMV.js";
+} from "./chunk-MR3ITQEV.js";
 import {
   runtime_default
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-XZIW3Q5B.js";
 import {
   canonicalizeToolNames
 } from "./chunk-5EBLANFT.js";

package/{chunk-EDJND3FK.js → chunk-R7GCGOGZ.js}

@@ -308,7 +308,7 @@ var slice = createSliceWithThunks({
       const overrides = {};
       if (args.systemPromptOverride !== void 0) overrides.prompt = args.systemPromptOverride;
       if (args.toolsOverride !== void 0) overrides.tools = args.toolsOverride;
-      const { _executeModel } = await import("./_executeModel-3FMHTHSS.js");
+      const { _executeModel } = await import("./_executeModel-ZIQHOREX.js");
       return _executeModel(
         {
           isStreaming: args.isStreaming ?? false,
@@ -329,7 +329,7 @@ var slice = createSliceWithThunks({
      * - 循环直到无工具调用或触发其他运行时停止条件
      */
     runAgent: create.asyncThunk(async (args, thunkApi) => {
-      const { runAgentClientLoop } = await import("./runAgentClientLoop-HHLHNMBE.js");
+      const { runAgentClientLoop } = await import("./runAgentClientLoop-TSNSRQEP.js");
       const { content: loopContent, toolCallCount } = await runAgentClientLoop(
         {
           agentKey: args.agentKey,
@@ -345,7 +345,7 @@ var slice = createSliceWithThunks({
      * 聊天轮次流式 Agent 调用
      */
     streamAgentChatTurn: create.asyncThunk(async (args, thunkApi) => {
-      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-KNPOLET7.js");
+      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-RJLDV4WZ.js");
       return streamAgentChatTurnHandler(args, thunkApi);
     }),
     /**