nolo-cli 0.157.0-alpha.1 → 0.157.0

package/{chunk-ZEHTARJA.js → chunk-NLFTBC6S.js}

@@ -9,16 +9,19 @@ import {
   resolveRawAgentInput,
   resolveServerUrl,
   writeUsage
-} from "./chunk-KOB75UNU.js";
+} from "./chunk-FHG46N5C.js";
 import {
   getReadableCliDb
-} from "./chunk-P5QACQDK.js";
+} from "./chunk-62TBKWTV.js";
 import {
+  INSTABOX_RUN_CONFIG_ENV,
   createCliLocalRuntimeAdapter,
   detectCurrentMachineId,
+  hashInstaboxDeliveryManifest,
   isBuiltinNoloAgentRef,
   isCliProviderAgentConfig,
   isDockerRuntimeKey,
+  isInstaboxBillingPolicy,
   isLiveAgentRunObservation,
   isMachineBoundLocalhostCustomProvider,
   isSubtaskRun,
@@ -26,8 +29,9 @@ import {
   resolveAuthToken as resolveAuthToken2,
   resolveBoundMachineId,
   resolveFileWriteGateEnabled,
-  resolveLocalUserId
-} from "./chunk-EJU23ST5.js";
+  resolveLocalUserId,
+  validateInstaboxWorkspaceSelection
+} from "./chunk-ZKVS36H3.js";
 import {
   clearCredentialAvailability,
   readCredentialEntry,
@@ -39,7 +43,7 @@ import {
   t,
   toolLabel,
   toolLabelVariants
-} from "./chunk-SW4S4XYB.js";
+} from "./chunk-2AB2HA4M.js";
 import {
   _appendEntityBatch,
   _appendEvidenceBatch,
@@ -54,10 +58,13 @@ import {
   loadMemoryVNextCatalog,
   putMemoryEvidenceVNext
 } from "./chunk-TY3TIUJK.js";
+import {
+  parsePositiveFiniteNumberOrFallback
+} from "./chunk-Y5GCAMGP.js";
 import {
   readDbRecord,
   resolveAgentRecordFromHybridStore
-} from "./chunk-HKT6QXP3.js";
+} from "./chunk-5IKRTRRR.js";
 import {
   isLocalCliAgentKey
 } from "./chunk-NBTY7YJF.js";
@@ -72,49 +79,46 @@ import {
 } from "./chunk-BMQ2MJUK.js";
 import {
   resolveCliLocalRuntimeKeyCapability
-} from "./chunk-XFKZ3MCV.js";
+} from "./chunk-MR3ITQEV.js";
 import {
   isTransientFetchError
-} from "./chunk-I2ZMGXXF.js";
+} from "./chunk-KFHREHUQ.js";
 import {
   parseUiCard,
   uiCardFallback
-} from "./chunk-RUNKPFM5.js";
+} from "./chunk-K6Y5T4GE.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
-import {
-  parsePositiveFiniteNumberOrFallback
-} from "./chunk-XPWGOTBQ.js";
 import {
   buildMemorySubjectsForAgent,
   chooseMemoryOwners,
   loadMemoryCandidatesFromDb,
   resolveAgentMemoryPolicy
-} from "./chunk-7A4LJCDR.js";
+} from "./chunk-B3ZIFOFI.js";
 import {
   API_REPORTED_COST_MULTIPLIER,
-  parseUiAskChoiceContent
-} from "./chunk-H4KACZMG.js";
+  estimateMessagesTokens,
+  parseUiAskChoiceContent,
+  resolveAgentContextWindow,
+  resolveOccupancy,
+  resolveOccupancyWindow
+} from "./chunk-XZIW3Q5B.js";
 import {
-  isOAuthApiKeyRef
-} from "./chunk-UKZX3NHN.js";
+  buildSkillDiscoveryContextLayer
+} from "./chunk-AU7AXHUL.js";
 import {
   parseExternalSkillMarkdown,
   parseSkillDocProtocol
-} from "./chunk-XETG4RIX.js";
+} from "./chunk-AETZ7AD6.js";
 import {
   LOCAL_AGENT_CONFIG_MISSING_CODE,
   LOCAL_TURN_ABORTED_CODE,
   readActionGate
-} from "./chunk-PEO24UB5.js";
+} from "./chunk-5E5VB7PS.js";
 import {
-  devinChannelContextWindow,
   resolveAgentRuntimeConfigFromRecord
-} from "./chunk-ANJTRG52.js";
-import {
-  isDevinOAuthAgent
-} from "./chunk-5ZUL4CUO.js";
+} from "./chunk-ULQAD7ZY.js";
 import {
   createThinkParserState,
   flushThinkParser,
@@ -136,11 +140,9 @@ import {
   resolveCredentialKeyWithFallback
 } from "./chunk-3MZAGMYY.js";
 import {
+  isOAuthApiKeyRef,
   normalizeUsage
-} from "./chunk-ZWG3C7VI.js";
-import {
-  findModelContextWindow
-} from "./chunk-2MTE2PEH.js";
+} from "./chunk-F3SOW2EU.js";
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
@@ -151,6 +153,13 @@ import {
   normalizeRuntimeToolPolicyOverride,
   resolveEffectiveRuntimeToolPolicy
 } from "./chunk-LIQJTQRN.js";
+import {
+  buildAgentsMdLayer,
+  buildMemoryOverlayLayer,
+  buildMemoryUseGuidanceLayer,
+  partitionScopedBlocks,
+  renderTurnContextBlocksWithScope
+} from "./chunk-VEA7H5FG.js";
 import {
   BUILTIN_NOLO_AGENT_KEY,
   BUILTIN_NOLO_AGENT_NAME,
@@ -164,9 +173,6 @@ import {
   createMemoryKey,
   ulid
 } from "./chunk-5EMSBTQ6.js";
-import {
-  isAntigravityOAuthAgent
-} from "./chunk-JGRPBIZZ.js";
 import {
   createRunActivityTracker,
   createShellApprovalChild,
@@ -176,10 +182,11 @@ import {
   recordRunResultHeaderMeta,
   resolveResultServerMeta,
   resolveRunQueuePath,
+  resolveRunsDir,
   serverOriginForDialog,
   settleRunTerminalAuthoritatively,
   spawnLocalBackgroundRun
-} from "./chunk-MM3662RS.js";
+} from "./chunk-LPO6AMQU.js";
 import {
   formatAgentListCard,
   formatFinishedRunCard,
@@ -190,29 +197,14 @@ import {
   formatStopRunCard,
   isAgentRunTerminalStatus
 } from "./chunk-PJNFNEJE.js";
-import {
-  estimateTokenCount
-} from "./chunk-PSCNXBYA.js";
-import {
-  resolveClientVersion
-} from "./chunk-SUKSWFLP.js";
-import {
-  findModelConfig
-} from "./chunk-TRW43TSC.js";
-import {
-  asTrimmedString
-} from "./chunk-3EUW3WEO.js";
 import {
   isCliAuthorityBrokerProtocolError,
   isCliAuthorityBrokerTimeoutError,
   isCliAuthorityBrokerUnavailableError
 } from "./chunk-EXAJ6DCR.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
 import {
   getDefaultCliLocalRuntimeDb
-} from "./chunk-FY4SDK2E.js";
+} from "./chunk-FDLDMJTM.js";
 import {
   getLogger,
   normalizeError
@@ -220,13 +212,28 @@ import {
 import {
   resolveAuthToken
 } from "./chunk-A7GB5UGH.js";
-import {
-  asOptionalTrimmedString
-} from "./chunk-G3SUCT4W.js";
 import {
   readPipeText,
   spawnProcess
 } from "./chunk-Y6ROFCZO.js";
+import {
+  isAntigravityOAuthAgent
+} from "./chunk-SQX235S2.js";
+import {
+  resolveClientVersion
+} from "./chunk-PIG2IUVZ.js";
+import {
+  findModelConfig
+} from "./chunk-6EQD4AQL.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import {
+  asOptionalTrimmedString
+} from "./chunk-G3SUCT4W.js";
 import {
   CLIENT_VERSION_TOO_OLD_CODE,
   NOLO_CLIENT_VERSION_HEADER,
@@ -235,16 +242,148 @@ import {
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
-import {
-  buildSkillDiscoveryContextLayer
-} from "./chunk-AU7AXHUL.js";
-import {
-  buildAgentsMdLayer,
-  buildMemoryOverlayLayer,
-  buildMemoryUseGuidanceLayer,
-  partitionScopedBlocks,
-  renderTurnContextBlocksWithScope
-} from "./chunk-VEA7H5FG.js";
+
+// packages/cli/client/instaboxRunConfigWrite.ts
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, normalize, resolve } from "node:path";
+var InstaboxRunConfigWriteError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(`instabox_run_config_write:${code}: ${message}`);
+    this.name = "InstaboxRunConfigWriteError";
+    this.code = `instabox_run_config_write:${code}`;
+  }
+};
+var fail = (code, msg) => {
+  throw new InstaboxRunConfigWriteError(code, msg);
+};
+function writeInstaboxRunConfig(options) {
+  const { workspaceMode, artifactDir, manifestPath, allowRemoteRelease } = options;
+  if (workspaceMode !== "empty" && workspaceMode !== "snapshot") {
+    fail("invalid_workspace_mode", 'workspaceMode \u5FC5\u987B\u662F "empty" \u6216 "snapshot"');
+  }
+  const trimmedArtifactDir = artifactDir?.trim();
+  if (!trimmedArtifactDir) {
+    fail("missing_artifact_dir", "artifactDir \u5FC5\u987B\u662F\u975E\u7A7A\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u672A\u914D\u7F6E\u6216\u9ED8\u8BA4\u5747\u88AB\u62D2\u7EDD");
+  }
+  if (!isAbsolute(trimmedArtifactDir) || trimmedArtifactDir.includes("\0") || trimmedArtifactDir.split("/").includes("..")) {
+    fail("invalid_artifact_dir", `artifactDir \u5FC5\u987B\u4E3A\u5408\u6CD5\u7684\u7EDD\u5BF9\u8DEF\u5F84\u4E14\u4E0D\u80FD\u5305\u542B .. \u6216\u7A7A\u5B57\u7B26: "${trimmedArtifactDir}"`);
+  }
+  const approvalId = `appr-${randomUUID()}`;
+  const bindingId = `bind-${randomUUID()}`;
+  const freeCreateEvidenceId = `fce-${randomUUID()}`;
+  const workspaceAuthorizationId = `wauth-${randomUUID()}`;
+  const recoverySupportId = `rcv-${randomUUID()}`;
+  let manifest = null;
+  let manifestSha256 = null;
+  let allowedPaths = [];
+  if (workspaceMode === "snapshot") {
+    const rawPath = manifestPath ? manifestPath.trim() : "";
+    if (!rawPath) {
+      fail("missing_manifest_path", 'workspaceMode \u4E3A "snapshot" \u65F6\u5FC5\u987B\u63D0\u4F9B manifest \u6587\u4EF6\u8DEF\u5F84');
+    }
+    const resolvedManifestPath = resolve(rawPath);
+    let rawText = "";
+    try {
+      const reader = options.readTextFile ?? ((p) => readFileSync(p, "utf8"));
+      rawText = reader(resolvedManifestPath);
+    } catch (err) {
+      fail(
+        "manifest_read_failed",
+        `\u8BFB\u53D6 manifest \u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    let parsedManifest;
+    try {
+      parsedManifest = JSON.parse(rawText);
+    } catch (err) {
+      fail(
+        "invalid_manifest_json",
+        `manifest \u6587\u4EF6 JSON \u89E3\u6790\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    try {
+      manifestSha256 = hashInstaboxDeliveryManifest(parsedManifest);
+      validateInstaboxWorkspaceSelection({
+        workspaceMode: "approved-snapshot",
+        manifest: parsedManifest,
+        approval: {
+          id: approvalId,
+          manifestSha256
+        }
+      });
+    } catch (err) {
+      fail(
+        "invalid_manifest_selection",
+        `manifest \u6821\u9A8C\u672A\u901A\u8FC7: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    manifest = parsedManifest;
+    allowedPaths = parsedManifest.files.map((f) => f.path);
+  } else {
+    if (manifestPath && manifestPath.trim()) {
+      fail("unexpected_manifest", 'workspaceMode \u4E3A "empty" \u65F6\u4E0D\u5F97\u63D0\u4F9B manifest');
+    }
+  }
+  const rawBillingPolicy = options.billingPolicy ?? (options.allowPaid ? "allow-paid" : "free-only");
+  if (!isInstaboxBillingPolicy(rawBillingPolicy)) {
+    fail("invalid_billing_policy", `billingPolicy \u5FC5\u987B\u4E3A "free-only" \u6216 "allow-paid"\uFF0C\u6536\u5230 "${rawBillingPolicy}"`);
+  }
+  const billingPolicy = rawBillingPolicy;
+  const env = options.env ?? process.env;
+  const isPaid = options.isPaidAccount === true || options.account?.isPaid === true || options.account?.kind === "paid" || options.account?.accountKind === "paid" || env?.INSTABOX_ACCOUNT_KIND === "paid" || env?.INSTABOX_ACCOUNT_TYPE === "paid" || env?.INSTABOX_PAID_ACCOUNT === "true" || env?.INSTABOX_PAID_ACCOUNT === "1";
+  if (isPaid && billingPolicy !== "allow-paid") {
+    fail("paid_account_disallowed", "\u4ED8\u8D39 Instabox \u8D26\u53F7\u9700\u663E\u5F0F --instabox-allow-paid");
+  }
+  const config = {
+    bindingId,
+    freeCreateEvidenceId,
+    workspaceAuthorizationId,
+    recoverySupportId,
+    workspaceMode: workspaceMode === "snapshot" ? "approved-snapshot" : "empty",
+    billingPolicy,
+    approvalId,
+    artifactRoot: trimmedArtifactDir,
+    allowRemoteRelease: Boolean(allowRemoteRelease),
+    allowedPaths
+  };
+  if (workspaceMode === "snapshot" && manifest && manifestSha256) {
+    config.manifest = manifest;
+    config.manifestSha256 = manifestSha256;
+  }
+  const runsDir = options.runsDir ?? resolveRunsDir(env);
+  const normalizedRunsDir = normalize(resolve(runsDir));
+  try {
+    mkdirSync(normalizedRunsDir, { recursive: true, mode: 448 });
+  } catch (err) {
+    fail("mkdir_failed", `\u521B\u5EFA runs \u76EE\u5F55\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const fileName = `instabox-run-${randomUUID()}.json`;
+  const targetPath = join(normalizedRunsDir, fileName);
+  try {
+    writeFileSync(targetPath, JSON.stringify(config, null, 2), {
+      flag: "wx",
+      mode: 384
+    });
+  } catch (err) {
+    fail("file_write_failed", `\u72EC\u5360\u521B\u5EFA\u53D7\u63A7\u914D\u7F6E\u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const stats = lstatSync(targetPath);
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+      fail("symlink_rejected", `\u914D\u7F6E\u6587\u4EF6\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5\u6216\u975E\u5E38\u89C4\u6587\u4EF6: ${targetPath}`);
+    }
+  } catch (err) {
+    if (err instanceof InstaboxRunConfigWriteError) throw err;
+    fail("file_stat_failed", `\u68C0\u9A8C\u914D\u7F6E\u6587\u4EF6\u72B6\u6001\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  process.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  if (options.env) {
+    options.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  }
+  return { configPath: targetPath, config };
+}
 
 // packages/agent-runtime/modelLayerOverride.ts
 var MODEL_LAYER_KEYS = [
@@ -434,40 +573,6 @@ ${cardText}` : cardText;
 // packages/chat/messages/attachmentWriteRollout.ts
 var ENABLE_REMOTE_ATTACHMENT_PART_WRITES = false;
 
-// packages/ai/context/contextOccupancy.ts
-function estimateMessagesTokens(messages) {
-  return messages.reduce((total, message) => {
-    const content = typeof message.content === "string" ? message.content : message.content == null ? "" : JSON.stringify(message.content);
-    return total + estimateTokenCount(content) + 4;
-  }, 0);
-}
-function historyTokensBeforeLatestAssistant(messages) {
-  const total = estimateMessagesTokens(messages);
-  const latest = messages[messages.length - 1];
-  if (latest?.role !== "assistant") return total;
-  return Math.max(0, total - estimateMessagesTokens([latest]));
-}
-function resolveOccupancy(input) {
-  if (input.authoritativeInput !== void 0 && input.authoritativeInput > 0) {
-    const generated = Math.max(0, input.generatedSinceAuthority ?? 0);
-    return {
-      tokens: input.authoritativeInput + generated,
-      estimated: generated > 0
-    };
-  }
-  return {
-    tokens: Math.max(0, input.baselineEstimate ?? 0),
-    estimated: true
-  };
-}
-function resolveOccupancyWindow(ref) {
-  if (!ref.model) return void 0;
-  if (isDevinOAuthAgent(ref)) {
-    return devinChannelContextWindow(ref.model) ?? findModelContextWindow(ref.model, ref.provider);
-  }
-  return findModelContextWindow(ref.model, ref.provider);
-}
-
 // packages/cli/client/tokenUsage.ts
 var PLATFORM_CREDIT_UNIT = "credits";
 var isUsableModelId = (model) => {
@@ -491,34 +596,10 @@ function resolveAgentModelIdentity(opts) {
     ...model ? { model } : {}
   };
 }
-function resolveAgentContextWindow(opts) {
+function resolveAgentContextWindow2(opts) {
   const model = resolveEffectiveModel(opts);
   if (model) return resolveContextWindow(model);
-  const byName = opts.agentName?.trim() ? resolveOccupancyWindow({ model: opts.agentName }) : void 0;
-  if (byName !== void 0) return byName;
-  const candidates = [
-    ...modelSlugCandidates(opts.agentKey, 2),
-    ...modelSlugCandidates(opts.agentName, 1)
-  ];
-  for (const candidate of candidates) {
-    const window = resolveOccupancyWindow({ model: candidate });
-    if (window !== void 0) return window;
-  }
-  return void 0;
-}
-var AGENT_KEY_PREFIX = /^agent-[a-z0-9]+-/i;
-function modelSlugCandidates(source, maxDrop) {
-  const raw = source?.trim();
-  if (!raw) return [];
-  const base = raw.replace(/\s+/g, "-").toLowerCase();
-  const seed = base.replace(AGENT_KEY_PREFIX, "");
-  const out = [seed];
-  if (seed !== base) out.push(base);
-  const segments = seed.split("-");
-  for (let drop = 1; drop <= maxDrop && drop < segments.length; drop++) {
-    out.push(segments.slice(drop).join("-"));
-  }
-  return [...new Set(out.filter(Boolean))];
+  return resolveAgentContextWindow(opts);
 }
 var PROVIDER_LOOKUP_ORDER = [
   "openrouter",
@@ -11204,6 +11285,51 @@ function findCollapsedPasteSpanAt(buffer, pos, opts = {}) {
   return null;
 }
 
+// packages/cli/idleHeapRelease.ts
+var IDLE_HEAP_RELEASE_DELAY_MS = 2e3;
+function releaseHeapPages(options = {}) {
+  const env = options.env ?? process.env;
+  if (env.NOLO_TUI_IDLE_HEAP_RELEASE === "0") return;
+  const bun = "bun" in options ? options.bun : globalThis.Bun;
+  if (typeof bun?.gc !== "function" || typeof bun?.shrink !== "function") return;
+  try {
+    bun.gc(true);
+    bun.shrink();
+  } catch {
+  }
+}
+function createIdleHeapReleaser(options = {}) {
+  const env = options.env ?? process.env;
+  const bun = "bun" in options ? options.bun : globalThis.Bun;
+  const disabled = env.NOLO_TUI_IDLE_HEAP_RELEASE === "0" || typeof bun?.gc !== "function" || typeof bun?.shrink !== "function";
+  if (disabled) return { schedule() {
+  }, cancel() {
+  } };
+  const delayMs = options.delayMs ?? IDLE_HEAP_RELEASE_DELAY_MS;
+  const setTimer = options.setTimer ?? ((fn, ms) => {
+    const handle = setTimeout(fn, ms);
+    handle.unref?.();
+    return handle;
+  });
+  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  let pending = null;
+  const release = () => {
+    pending = null;
+    releaseHeapPages({ env, bun });
+  };
+  return {
+    schedule() {
+      if (pending !== null) clearTimer(pending);
+      pending = setTimer(release, delayMs);
+    },
+    cancel() {
+      if (pending === null) return;
+      clearTimer(pending);
+      pending = null;
+    }
+  };
+}
+
 // packages/cli/client/agentRun.ts
 import { ulid as ulid2 } from "ulid";
 
@@ -11245,7 +11371,7 @@ function isBalanceExhaustedError(error) {
 
 // packages/cli/client/agentRun.ts
 async function loadRunLocalAgentTurn() {
-  const { runLocalAgentTurn } = await import("./agentRuntimeLocal-O5GDAFTN.js");
+  const { runLocalAgentTurn } = await import("./agentRuntimeLocal-J6I63NZC.js");
   return runLocalAgentTurn;
 }
 var stripDebugNoise = (s) => s.replace(/\s*raw="[\s\S]*"/g, "").replace(/\s*raw=\S+/g, "").replace(/\s*headers=\[[^\]]*\]/g, "").replace(/\s*headers=\S+/g, "").trim();
@@ -11342,7 +11468,8 @@ function buildDefaultLocalRuntimeAdapter(options) {
     // runtimeKey 接线：不传下去则本地 run 的 runtimeKey 在 agentRun 层就断了
     // ——adapter 收不到 → docker workload 永不创建，非 docker 云后端也不会
     // fail-closed（死代码）。
-    ...options.runtimeKey ? { runtimeKey: options.runtimeKey } : {}
+    ...options.runtimeKey ? { runtimeKey: options.runtimeKey } : {},
+    ...options.dockerWorkspaceMode ? { dockerWorkspaceMode: options.dockerWorkspaceMode } : {}
   });
 }
 function resolveLocalRuntimeAdapter(options) {
@@ -11350,7 +11477,8 @@ function resolveLocalRuntimeAdapter(options) {
     cwd: options.localRuntimeCwd,
     // 与 buildDefaultLocalRuntimeAdapter 同口径：注入式 factory 也必须拿到
     // runtimeKey，否则注入了 adapter 的本地 run 会静默丢掉 docker 语义。
-    ...options.runtimeKey ? { runtimeKey: options.runtimeKey } : {}
+    ...options.runtimeKey ? { runtimeKey: options.runtimeKey } : {},
+    ...options.dockerWorkspaceMode ? { dockerWorkspaceMode: options.dockerWorkspaceMode } : {}
   }) || buildDefaultLocalRuntimeAdapter(options);
 }
 function wrapAdapterEphemeral(adapter) {
@@ -12247,6 +12375,24 @@ async function runLocalAgentTurnForCli(options, settings) {
   }
 }
 async function runLocalAgentTurnForCliWithAdapter(options, settings, resolvedBaseAdapter) {
+  try {
+    return await executeLocalAgentTurnForCliWithAdapter(
+      options,
+      settings,
+      resolvedBaseAdapter
+    );
+  } finally {
+    try {
+      if (typeof options.releaseHeapPages === "function") {
+        options.releaseHeapPages();
+      } else {
+        releaseHeapPages({ env: options.env });
+      }
+    } catch {
+    }
+  }
+}
+async function executeLocalAgentTurnForCliWithAdapter(options, settings, resolvedBaseAdapter) {
   const baseAdapter = (() => {
     let adapter2 = resolvedBaseAdapter && options.modelOverride ? wrapLoadAgentConfigWithModelOverride(
       resolvedBaseAdapter,
@@ -12341,6 +12487,9 @@ async function runLocalAgentTurnForCliWithAdapter(options, settings, resolvedBas
       parentDialogId: options.parentDialogId,
       runtimeContext: runtimeContextWithOwnership,
       runKind: options.env.NOLO_AGENT_RUN_CHILD === "1" ? "subtask" : "interactive",
+      // 展示能力由宿主声明（TUI=narrow），非交互 CLI/后台留空 → unknown；
+      // 排版段只在能力已知时由 localLoop 注入，server 线不读该字段。
+      ...options.responseViewport ? { responseViewport: options.responseViewport } : {},
       background: options.background,
       noStream: options.noStream,
       ...options.contextBlockScopes?.length ? { contextBlockScopes: options.contextBlockScopes } : options.extraContextBlocks?.length ? { contextBlocks: options.extraContextBlocks } : {},
@@ -12726,7 +12875,7 @@ import * as nodeFs from "node:fs";
 var CLI_AUTO_ROUTE_AGENT_KEY = BUILTIN_NOLO_AGENT_KEY;
 
 // packages/agent-runtime/hostEnvironment.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import os from "node:os";
 function parseLinuxOsRelease(content) {
   let prettyName;
@@ -12765,9 +12914,9 @@ function probeHostEnvironment(options) {
     if (osReleaseText === void 0) {
       try {
         if (existsSync("/etc/os-release")) {
-          osReleaseText = readFileSync("/etc/os-release", "utf8");
+          osReleaseText = readFileSync2("/etc/os-release", "utf8");
         } else if (existsSync("/usr/lib/os-release")) {
-          osReleaseText = readFileSync("/usr/lib/os-release", "utf8");
+          osReleaseText = readFileSync2("/usr/lib/os-release", "utf8");
         }
       } catch {
       }
@@ -12833,16 +12982,16 @@ function buildHostEnvironmentLayer(options) {
 }
 
 // packages/agent-runtime/agentsMd.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { join } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { join as join2 } from "node:path";
 var AGENTS_MD_MAX_BYTES = 8192;
 var AGENTS_MD_CANDIDATES = ["AGENTS.md", "CLAUDE.md"];
 function readAgentsMdLayerFromDisk(cwd) {
   for (const name of AGENTS_MD_CANDIDATES) {
-    const filePath = join(cwd, name);
+    const filePath = join2(cwd, name);
     if (!existsSync2(filePath)) continue;
     try {
-      let content = readFileSync2(filePath, "utf8").trim();
+      let content = readFileSync3(filePath, "utf8").trim();
       if (!content) continue;
       if (Buffer.byteLength(content, "utf8") > AGENTS_MD_MAX_BYTES) {
         content = Buffer.from(content, "utf8").subarray(0, AGENTS_MD_MAX_BYTES).toString("utf8") + "\n\n<!-- AGENTS.md truncated -->";
@@ -12912,17 +13061,17 @@ function runDoDCommands(commands, cwd, deps = {}) {
 }
 
 // packages/cli/agentRunPrompts.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "node:fs";
-import { dirname, extname, isAbsolute, join as join2, relative as relativePath, resolve, sep } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
+import { dirname, extname, isAbsolute as isAbsolute2, join as join3, relative as relativePath, resolve as resolve2, sep } from "node:path";
 function workflowRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
-  return resolve(cwd, "docs", "workflows", `${fileName}.md`);
+  return resolve2(cwd, "docs", "workflows", `${fileName}.md`);
 }
 var SKILL_SEARCH_DIRS = [
   ".agents/skills"
@@ -12931,22 +13080,22 @@ function skillRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
   for (const dir of SKILL_SEARCH_DIRS) {
-    const skillMdPath = resolve(cwd, dir, fileName, "SKILL.md");
+    const skillMdPath = resolve2(cwd, dir, fileName, "SKILL.md");
     if (existsSync3(skillMdPath)) return skillMdPath;
   }
-  return resolve(cwd, ".agents", "skills", fileName, "SKILL.md");
+  return resolve2(cwd, ".agents", "skills", fileName, "SKILL.md");
 }
 async function resolveWorkflowReference(ref, cwd = process.cwd()) {
   const path2 = workflowRefToCandidatePath(cwd, ref);
   if (!path2 || !existsSync3(path2)) {
     throw new Error(`Workflow reference not found: ${ref}`);
   }
-  const markdown = readFileSync3(path2, "utf8");
+  const markdown = readFileSync4(path2, "utf8");
   const parsed = parseSkillDocProtocol(markdown);
   return {
     ref,
@@ -12956,15 +13105,15 @@ async function resolveWorkflowReference(ref, cwd = process.cwd()) {
 }
 function inlineRelativeRefs(body, skillDir) {
   const refPattern = /\[([^\]]+)\]\((\.\/[^)]+|[^)]+\/[^)]+)\)/g;
-  const normalizedSkillDir = resolve(skillDir) + sep;
+  const normalizedSkillDir = resolve2(skillDir) + sep;
   return body.replace(refPattern, (match, label, relPath) => {
     const cleaned = relPath.trim();
     if (!cleaned.startsWith("./") && !cleaned.startsWith("../")) return match;
-    const absPath = resolve(skillDir, cleaned);
+    const absPath = resolve2(skillDir, cleaned);
     const relative = relativePath(normalizedSkillDir, absPath);
-    if (relative.startsWith("..") || isAbsolute(relative)) return match;
+    if (relative.startsWith("..") || isAbsolute2(relative)) return match;
     if (!existsSync3(absPath) || !absPath.endsWith(".md")) return match;
-    const refContent = readFileSync3(absPath, "utf8");
+    const refContent = readFileSync4(absPath, "utf8");
     return `
 
 ### ${label}
@@ -12975,7 +13124,7 @@ ${refContent}
   });
 }
 function listSkillScripts(skillDir) {
-  const scriptsDir = join2(skillDir, "scripts");
+  const scriptsDir = join3(skillDir, "scripts");
   if (!existsSync3(scriptsDir) || !statSync2(scriptsDir).isDirectory()) return null;
   const entries = readdirSync(scriptsDir).filter((e) => !e.startsWith("."));
   if (entries.length === 0) return null;
@@ -13006,7 +13155,7 @@ async function resolveSkillReference(ref, options = {}) {
     if (!path2 || !existsSync3(path2)) {
       throw new Error(`Skill reference not found: ${ref}`);
     }
-    markdown = readFileSync3(path2, "utf8");
+    markdown = readFileSync4(path2, "utf8");
     filePath = path2;
     skillDir = dirname(path2);
   }
@@ -13110,9 +13259,9 @@ function prependSubjectDialogMarker(message, subjectDialogKey) {
 }
 function normalizeCliImageInput(input) {
   if (/^(https?:|data:|file:)/i.test(input)) return input;
-  const absolutePath = resolve(input);
+  const absolutePath = resolve2(input);
   if (!existsSync3(absolutePath)) return input;
-  const base64 = readFileSync3(absolutePath).toString("base64");
+  const base64 = readFileSync4(absolutePath).toString("base64");
   return `data:${imageMimeTypeForPath(absolutePath)};base64,${base64}`;
 }
 function imageMimeTypeForPath(path2) {
@@ -15656,6 +15805,22 @@ async function runAgentRunCommand(args, deps) {
   if (!localRuntimeCwd && (parsed.runtimeMode === "local" || hostRuntimeLocal)) {
     localRuntimeCwd = process.cwd();
   }
+  if (parsed.runtimeKey === "instabox") {
+    try {
+      writeInstaboxRunConfig({
+        workspaceMode: parsed.instaboxWorkspace,
+        artifactDir: parsed.instaboxArtifactDir,
+        manifestPath: parsed.instaboxManifestPath,
+        allowRemoteRelease: parsed.instaboxAllowRemoteRelease,
+        allowPaid: parsed.instaboxAllowPaid,
+        env
+      });
+    } catch (err) {
+      output.write(`[nolo] instabox \u914D\u7F6E\u751F\u6210\u5931\u8D25: ${toErrorMessage(err)}
+`);
+      return 1;
+    }
+  }
   const runEnv = buildLocalRunEnv({
     env,
     allowShell: parsed.allowShell
@@ -15770,6 +15935,12 @@ async function runAgentRunCommand(args, deps) {
       } } : {},
       agentName: targetAgentKey,
       agentKey: targetAgentKey,
+      // 当前执行链未提供可靠的最终展示能力，按约定使用 unknown（只注入行为段，不猜
+      // 宽/窄屏；`stdout.isTTY` 只说明是不是终端，说明不了宽度）。这不表示宿主永远
+      // 无法获得尺寸：将来接入时应传展示能力，不应由调用方拼接准则文本。
+      // 放在 buildRunOptions 这个唯一构造点上，首轮 / quota fallback / 队列 drain
+      // 三处 runner(...) 调用自动一致；远端分支走 server 线，不读该字段。
+      responseViewport: "unknown",
       serverUrl: resolveServerUrl(env),
       message: formatTurnMessage(turnMessage),
       imageUrls: parsed.imageUrls.map(normalizeCliImageInput),
@@ -15789,6 +15960,7 @@ async function runAgentRunCommand(args, deps) {
       // runtimeKey 与 machine-shell 的组合已在 parseAgentRunArgs 入口显式拒绝，
       // 这里直接透传即可（不再静默丢弃参数）。
       ...parsed.runtimeKey ? { runtimeKey: parsed.runtimeKey } : {},
+      ...parsed.dockerWorkspaceMode ? { dockerWorkspaceMode: parsed.dockerWorkspaceMode } : {},
       ...parsed.continueDialogId ? { continueDialogId: parsed.continueDialogId } : {},
       ...parsed.strictContinueHistory ? { strictContinueHistory: true } : {},
       ...parsed.spaceId ? { spaceId: parsed.spaceId } : {},
@@ -16059,10 +16231,8 @@ export {
   redactSecrets,
   safeAskText,
   TUI_TREE_MARKER,
-  estimateMessagesTokens,
-  historyTokensBeforeLatestAssistant,
   resolveAgentModelIdentity,
-  resolveAgentContextWindow,
+  resolveAgentContextWindow2 as resolveAgentContextWindow,
   platformCreditsFromUsage,
   formatCreditsChip,
   formatTokenCount,
@@ -16070,6 +16240,7 @@ export {
   computeBaselineContextTokens,
   resolveContextUsage,
   renderTokenStatus,
+  createIdleHeapReleaser,
   COLLAPSED_PASTE_PLACEHOLDER_RE,
   shouldCollapsePaste,
   createCollapsedPasteStore,