nolo-cli 0.157.0-alpha.1 → 0.158.0-alpha.1

package/{chunk-EJU23ST5.js → chunk-S72LMV7T.js}

@@ -1,13 +1,11 @@
 import {
   anthropicRefresh,
   cursorRefresh,
-  getWorkBuddyHeaders,
   refreshAntigravityOAuthToken,
   refreshOpenAiCodexToken,
   resolveServerSyncConfig,
-  workbuddyRefresh,
   xaiRefresh
-} from "./chunk-7KYVUFDG.js";
+} from "./chunk-IE5PXKVU.js";
 import {
   clearCredentialAvailability,
   markCredentialUnavailable,
@@ -18,14 +16,14 @@ import {
 import {
   agentRunCardLabels,
   t
-} from "./chunk-SW4S4XYB.js";
+} from "./chunk-2AB2HA4M.js";
 import {
   defaultLoopbackRequest
 } from "./chunk-VP3BINY7.js";
 import {
   OAUTH_PROVIDER_REFS,
   buildLocalAgentLookupKeys
-} from "./chunk-UUPR3TD7.js";
+} from "./chunk-7RF4O6AT.js";
 import {
   LOCAL_CODEX_AGENT_ID,
   LOCAL_CODEX_AGENT_KEY,
@@ -41,10 +39,14 @@ import {
   isCursorOAuthAgent
 } from "./chunk-VIWDGTDA.js";
 import {
+  SANDBOX_HELPER_PATH,
+  SANDBOX_OUTPUT_LIMITS,
   SANDBOX_WORKSPACE_ROOT,
   buildSandboxHelperUploadArgv,
-  dockerExecutionToolNames
-} from "./chunk-6MJNEXUU.js";
+  buildWorkspaceHelperSource,
+  dockerExecutionToolNames,
+  parseToolOutput
+} from "./chunk-HGDKT2D6.js";
 import {
   createChromeConnectorClientResolver,
   createVerifiedChromeConnectorClient,
@@ -58,11 +60,11 @@ import {
 } from "./chunk-ATNTHIZI.js";
 import {
   inferCaptureIntent
-} from "./chunk-T6CBQ6BN.js";
+} from "./chunk-INFHX73M.js";
 import {
   inlineImageUrlsForCustomProvider,
   prepareTools
-} from "./chunk-SKPPKHD3.js";
+} from "./chunk-BYQOCH75.js";
 import {
   getServerProviderSecret
 } from "./chunk-HS7MLR74.js";
@@ -84,18 +86,18 @@ import {
   resolveCliLocalRuntimeKeyCapability,
   resolveCliLocalSpawnDispatch,
   resolveStartAgentRunCwd
-} from "./chunk-XFKZ3MCV.js";
+} from "./chunk-YTXQ2U2X.js";
 import {
   deriveCredentialGroup,
   deriveCustomProviderCredentialGroup
-} from "./chunk-KX6LPG7W.js";
+} from "./chunk-KLA62VVE.js";
 import {
   fetchWithTransientRetry,
   isTransientFetchError
-} from "./chunk-I2ZMGXXF.js";
+} from "./chunk-KFHREHUQ.js";
 import {
   resolveAgentRequiredPackIds
-} from "./chunk-RUNKPFM5.js";
+} from "./chunk-CDWHHLK5.js";
 import {
   applyBuiltinAgentRuntimeOverride,
   applyTokenUsageToDayStats,
@@ -104,7 +106,7 @@ import {
   resolveBuiltinPlatformAgentConfig,
   runKeyed,
   validateAskChoiceInput
-} from "./chunk-H4KACZMG.js";
+} from "./chunk-WTFRBJT5.js";
 import {
   BUILTIN_DIALOG_LLM_CHAT_FALLBACK_MODEL,
   BUILTIN_TITLE_LLM_CONFIG
@@ -114,7 +116,7 @@ import {
 } from "./chunk-UKZX3NHN.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-X5SUT4CN.js";
+} from "./chunk-4UOEOHY3.js";
 import {
   isTombstoneRecord
 } from "./chunk-D2MDMY2M.js";
@@ -171,7 +173,7 @@ import {
   runExecShellGates,
   validateConfiguredRootExecutionLease,
   verifyOwnerRouteAck
-} from "./chunk-PEO24UB5.js";
+} from "./chunk-3TBHZPNG.js";
 import {
   accumulateGeminiChunks,
   buildGeminiGenerateContentRequest,
@@ -201,10 +203,7 @@ import {
 } from "./chunk-HNUWUO75.js";
 import {
   resolveAgentRuntimeConfigFromRecord
-} from "./chunk-ANJTRG52.js";
-import {
-  isDevinOAuthAgent
-} from "./chunk-5ZUL4CUO.js";
+} from "./chunk-G2WP7VPD.js";
 import {
   resolveHistoricalToolContentCap
 } from "./chunk-IYBIRCQV.js";
@@ -232,7 +231,10 @@ import {
 } from "./chunk-2MBTWINN.js";
 import {
   normalizeUsage
-} from "./chunk-ZWG3C7VI.js";
+} from "./chunk-C6FY7HWI.js";
+import {
+  isDevinOAuthAgent
+} from "./chunk-5ZUL4CUO.js";
 import {
   createProviderCallTimingTracker,
   finalizeProviderCallTiming,
@@ -3301,447 +3303,6 @@ var resolveDevinTransport = async (ctx) => {
   return null;
 };
 
-// packages/agent-runtime/workbuddyRequestAdapter.ts
-var DEFAULT_SYSTEM = "You are a helpful assistant.";
-var SAFE_NAME = /^[A-Za-z0-9_-]{1,64}$/;
-function record(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function safeName(name, reserved) {
-  const stem = name.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 48) || "tool";
-  let candidate = stem;
-  if (reserved.has(candidate)) {
-    let suffix = 1;
-    do
-      candidate = `${stem.slice(0, 64 - String(suffix).length - 1)}_${suffix++}`;
-    while (reserved.has(candidate));
-  }
-  reserved.add(candidate);
-  return candidate;
-}
-function adaptSchema(schema, path) {
-  if (!record(schema)) throw new TypeError(`${path} must be a JSON Schema object`);
-  if (schema.type !== "object" && schema.type !== "array" && schema.type !== "string" && schema.type !== "number" && schema.type !== "integer" && schema.type !== "boolean" && schema.type !== "null" && schema.type !== void 0) throw new TypeError(`${path}.type is unsupported`);
-  if (schema.properties !== void 0) {
-    if (!record(schema.properties)) throw new TypeError(`${path}.properties must be an object`);
-    for (const [key, value] of Object.entries(schema.properties)) adaptSchema(value, `${path}.properties.${key}`);
-  }
-  for (const key of ["items", "additionalProperties", "not", "if", "then", "else"]) {
-    const value = schema[key];
-    if (value === false || value === true) continue;
-    if (record(value)) adaptSchema(value, `${path}.${key}`);
-    else if (Array.isArray(value)) value.forEach((item, i) => adaptSchema(item, `${path}.${key}[${i}]`));
-  }
-  for (const key of ["oneOf", "anyOf", "allOf", "prefixItems"]) {
-    if (schema[key] !== void 0) {
-      if (!Array.isArray(schema[key])) throw new TypeError(`${path}.${key} must be an array`);
-      schema[key].forEach((item, i) => adaptSchema(item, `${path}.${key}[${i}]`));
-    }
-  }
-}
-function adaptWorkBuddyRequest(body) {
-  const adapted = structuredClone(body);
-  const originalNames = /* @__PURE__ */ Object.create(null);
-  const safeToOriginal = /* @__PURE__ */ new Map();
-  const tools = adapted.tools;
-  if (tools !== void 0 && !Array.isArray(tools)) throw new TypeError("tools must be an array");
-  const reserved = /* @__PURE__ */ new Set();
-  for (const tool of tools ?? []) {
-    if (!record(tool) || !record(tool.function) || typeof tool.function.name !== "string") throw new TypeError("Each tool must have a named function");
-    if (SAFE_NAME.test(tool.function.name)) reserved.add(tool.function.name);
-  }
-  for (const tool of tools ?? []) {
-    const fn = tool.function;
-    const original = fn.name;
-    if (!SAFE_NAME.test(original)) {
-      const safe = safeName(original, reserved);
-      Object.defineProperty(originalNames, safe, { value: original, enumerable: true, configurable: true, writable: true });
-      safeToOriginal.set(safe, original);
-      fn.name = safe;
-    }
-    if (fn.parameters !== void 0) {
-      if (!record(fn.parameters)) throw new TypeError(`Tool ${original} parameters must be a JSON Schema object`);
-      adaptSchema(fn.parameters, `Tool ${original} parameters`);
-      if (fn.parameters.type !== "object") throw new TypeError(`Tool ${original} parameters root must be type object`);
-    }
-  }
-  const safeFor = (name) => typeof name === "string" ? [...safeToOriginal].find(([, original]) => original === name)?.[0] : void 0;
-  if (Array.isArray(adapted.messages)) {
-    for (const message of adapted.messages) {
-      if (!record(message)) continue;
-      if (message.role === "developer") message.role = "system";
-      if (Array.isArray(message.tool_calls)) for (const call of message.tool_calls) {
-        if (record(call) && record(call.function)) call.function.name = safeFor(call.function.name) ?? call.function.name;
-      }
-      if (message.role === "tool") message.name = safeFor(message.name) ?? message.name;
-    }
-    if (!adapted.messages.some((message) => record(message) && message.role === "system")) adapted.messages.unshift({ role: "system", content: DEFAULT_SYSTEM });
-  } else adapted.messages = [{ role: "system", content: DEFAULT_SYSTEM }];
-  const choice = adapted.tool_choice;
-  if (choice === "none") delete adapted.tools;
-  else if (record(choice) && record(choice.function)) choice.function.name = safeFor(choice.function.name) ?? choice.function.name;
-  else if (typeof choice === "string" && !["auto", "required", "none"].includes(choice)) adapted.tool_choice = { type: "function", function: { name: safeFor(choice) ?? choice } };
-  if (adapted.max_completion_tokens !== void 0) {
-    if (adapted.max_tokens === void 0) adapted.max_tokens = adapted.max_completion_tokens;
-    delete adapted.max_completion_tokens;
-  }
-  adapted.stream = true;
-  return { body: adapted, originalNames };
-}
-function restoreWorkBuddyToolNames(payload, originalNames) {
-  const copy = structuredClone(payload);
-  if (!record(copy) || !Array.isArray(copy.choices)) return copy;
-  for (const choice of copy.choices) for (const part of [choice?.delta, choice?.message]) {
-    if (!record(part) || !Array.isArray(part.tool_calls)) continue;
-    for (const call of part.tool_calls) {
-      if (!record(call) || !record(call.function) || typeof call.function.name !== "string") continue;
-      if (Object.prototype.hasOwnProperty.call(originalNames, call.function.name)) call.function.name = originalNames[call.function.name];
-    }
-  }
-  return copy;
-}
-
-// packages/cli/client/providerResolution/workbuddyTransport.ts
-var WORKBUDDY_ENDPOINTS = {
-  workbuddy: "https://copilot.tencent.com/v2/chat/completions",
-  "workbuddy-ai": "https://www.workbuddy.ai/v2/chat/completions"
-};
-function resolveWorkBuddySite(agentConfig) {
-  const ref = agentConfig.apiKeyRef?.trim().toLowerCase();
-  const prov = agentConfig.provider?.trim().toLowerCase();
-  if (ref === "workbuddy-ai" || ref?.startsWith(["api-key", "workbuddy-ai"].join(":")) || prov === "workbuddy-ai") {
-    return "workbuddy-ai";
-  }
-  if (ref === "workbuddy" || ref?.startsWith(["api-key", "workbuddy"].join(":")) || prov === "workbuddy") {
-    return "workbuddy";
-  }
-  return null;
-}
-function record2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var QUOTA_EXCEEDED_MESSAGE = "WorkBuddy \u989D\u5EA6\u4E0D\u8DB3 (14018)\uFF1AWorkBuddy \u975E\u65E0\u9650\u514D\u8D39\u670D\u52A1\uFF0C\u5F53\u524D\u8D26\u53F7\u989D\u5EA6\u5DF2\u8017\u5C3D\u3002";
-function wrapWorkBuddySseResponse(response, names) {
-  if (!response.body) return response;
-  const decoder = new TextDecoder("utf-8");
-  const encoder = new TextEncoder();
-  let pending = "";
-  let lines = [];
-  const fragments = /* @__PURE__ */ new Map();
-  const processEvent = () => {
-    const dataLines = lines.filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, ""));
-    const data = dataLines.join("\n");
-    if (!data || data === "[DONE]") {
-      const result = lines.join("\n") + "\n\n";
-      lines = [];
-      return result;
-    }
-    let payload;
-    try {
-      payload = JSON.parse(data);
-    } catch {
-      const result = lines.join("\n") + "\n\n";
-      lines = [];
-      return result;
-    }
-    if (record2(payload)) {
-      if (payload.code === 14018 || payload.errcode === 14018 || record2(payload.error) && payload.error.code === 14018) {
-        throw new Error(QUOTA_EXCEEDED_MESSAGE);
-      }
-      const choices = Array.isArray(payload.choices) ? payload.choices : [];
-      for (const choice of choices) {
-        if (!record2(choice)) continue;
-        const delta = record2(choice.delta) ? choice.delta : void 0;
-        const toolCalls = delta && Array.isArray(delta.tool_calls) ? delta.tool_calls : [];
-        for (const call of toolCalls) {
-          if (!record2(call) || !record2(call.function) || typeof call.function.name !== "string") {
-            continue;
-          }
-          const key = `${choice.index ?? 0}:${call.index ?? 0}`;
-          const accumulated = (fragments.get(key) ?? "") + call.function.name;
-          if (Object.prototype.hasOwnProperty.call(names, accumulated)) {
-            call.function.name = accumulated;
-            fragments.delete(key);
-          } else if (Object.keys(names).some((safe) => safe.startsWith(accumulated))) {
-            fragments.set(key, accumulated);
-            call.function.name = "";
-          } else {
-            call.function.name = accumulated;
-            fragments.delete(key);
-          }
-        }
-      }
-    }
-    const restored = restoreWorkBuddyToolNames(payload, names);
-    const nonDataFields = lines.filter((line) => !line.startsWith("data:"));
-    lines = [];
-    return [...nonDataFields, `data: ${JSON.stringify(restored)}`, "", ""].join(
-      "\n"
-    );
-  };
-  const drain = (final) => {
-    let output = "";
-    while (true) {
-      const match = /[\r\n]/.exec(pending);
-      if (!match) break;
-      const i = match.index;
-      if (!final && pending[i] === "\r" && i === pending.length - 1) break;
-      const line = pending.slice(0, i);
-      pending = pending.slice(
-        i + (pending[i] === "\r" && pending[i + 1] === "\n" ? 2 : 1)
-      );
-      if (line === "") {
-        output += processEvent();
-      } else {
-        lines.push(line);
-      }
-    }
-    if (final) {
-      if (pending) {
-        lines.push(pending);
-        pending = "";
-      }
-      if (lines.length > 0) {
-        output += processEvent();
-      }
-    }
-    return output;
-  };
-  const transformStream = new TransformStream({
-    transform: (chunk, controller) => {
-      pending += decoder.decode(chunk, { stream: true });
-      const output = drain(false);
-      if (output) controller.enqueue(encoder.encode(output));
-    },
-    flush: (controller) => {
-      pending += decoder.decode();
-      const output = drain(true);
-      if (output) controller.enqueue(encoder.encode(output));
-    }
-  });
-  const body = response.body.pipeThrough(transformStream);
-  const headers = new Headers(response.headers);
-  headers.delete("content-length");
-  headers.delete("content-encoding");
-  return new Response(body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-async function wrapWorkBuddyJsonResponse(response, names) {
-  const rawText = await response.text();
-  let json;
-  try {
-    json = JSON.parse(rawText);
-  } catch {
-    return new Response(rawText, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: response.headers
-    });
-  }
-  if (record2(json) && (json.code === 14018 || json.errcode === 14018 || record2(json.error) && json.error.code === 14018 || rawText.includes("14018"))) {
-    throw new Error(QUOTA_EXCEEDED_MESSAGE);
-  }
-  const restored = restoreWorkBuddyToolNames(json, names);
-  return new Response(JSON.stringify(restored), {
-    status: response.status,
-    statusText: response.statusText,
-    headers: response.headers
-  });
-}
-var resolveWorkbuddyTransport = async (ctx) => {
-  const {
-    agentConfig,
-    deps,
-    fetchImpl,
-    additionalToolNames,
-    buildProviderOpenAiTools,
-    recordLocalAvailability,
-    apiKeyRefResolver
-  } = ctx;
-  const site = resolveWorkBuddySite(agentConfig);
-  if (!site) return null;
-  const fixedEndpoint = WORKBUDDY_ENDPOINTS[site];
-  if (agentConfig.customProviderUrl) {
-    const trimmedUrl = agentConfig.customProviderUrl.trim();
-    if (trimmedUrl && trimmedUrl !== fixedEndpoint) {
-      throw new Error(
-        `Custom provider URL "${trimmedUrl}" is forbidden for WorkBuddy (${site}). Requests must only target ${fixedEndpoint}.`
-      );
-    }
-  }
-  const rawRef = asTrimmedLowercaseString(agentConfig.apiKeyRef);
-  const isApiKeyRef = rawRef.startsWith("api-key:");
-  const providerRef = isApiKeyRef ? rawRef : site;
-  const initialToken = await apiKeyRefResolver(providerRef);
-  if (!initialToken) {
-    throw new Error(
-      `OAuth credential for "${site}" not found locally. Run \`nolo auth ${site}\`.`
-    );
-  }
-  const legacyCredentialMigration = { enableLegacyMigration: true };
-  let currentCredential = readOAuthCredential(
-    site,
-    void 0,
-    legacyCredentialMigration
-  );
-  if (!currentCredential || !currentCredential.accessToken) {
-    throw new Error(
-      `OAuth credential for "${site}" not found locally. Run \`nolo auth ${site}\`.`
-    );
-  }
-  const uid = typeof currentCredential.metadata?.uid === "string" && currentCredential.metadata.uid.trim() || typeof currentCredential.accountId === "string" && currentCredential.accountId.trim() || "";
-  if (!uid) {
-    throw new Error(
-      `WorkBuddy credential for "${site}" is missing uid. Re-run \`nolo auth ${site}\`.`
-    );
-  }
-  if (currentCredential.accessToken !== initialToken) {
-    currentCredential = { ...currentCredential, accessToken: initialToken };
-  }
-  const { requestedToolNames, tools } = resolveProviderOpenAiToolBundle(
-    agentConfig,
-    deps.env,
-    buildProviderOpenAiTools,
-    additionalToolNames
-  );
-  const resolveRequestApiKey = async ({
-    force
-  }) => {
-    if (isApiKeyRef && force) {
-      return currentCredential.accessToken;
-    }
-    const before = readOAuthCredential(
-      site,
-      void 0,
-      legacyCredentialMigration
-    );
-    if (before) {
-      currentCredential = before;
-    }
-    if (!force) {
-      return currentCredential.accessToken;
-    }
-    const refreshedToken = await apiKeyRefResolver(providerRef, {
-      force: true
-    });
-    const after = readOAuthCredential(
-      site,
-      void 0,
-      legacyCredentialMigration
-    );
-    if (after) {
-      currentCredential = after;
-    }
-    if (refreshedToken && currentCredential.accessToken !== refreshedToken) {
-      currentCredential = {
-        ...currentCredential,
-        accessToken: refreshedToken
-      };
-    }
-    return refreshedToken ?? currentCredential.accessToken;
-  };
-  const wrappedFetch = async (inputUrl, init) => {
-    const targetUrl = typeof inputUrl === "string" ? inputUrl : inputUrl instanceof URL ? inputUrl.toString() : inputUrl.url;
-    if (targetUrl !== fixedEndpoint) {
-      throw new Error(
-        `WorkBuddy request blocked: target URL "${targetUrl}" does not match fixed endpoint "${fixedEndpoint}". Token will not be sent.`
-      );
-    }
-    let originalNames = {};
-    let body = init?.body;
-    if (typeof body === "string") {
-      try {
-        const parsed = JSON.parse(body);
-        const adapted = adaptWorkBuddyRequest(parsed);
-        originalNames = adapted.originalNames;
-        body = JSON.stringify(adapted.body);
-      } catch {
-      }
-    }
-    const wbHeaders = getWorkBuddyHeaders(currentCredential);
-    const mergedHeaders = new Headers(init?.headers);
-    for (const [key, value] of Object.entries(wbHeaders)) {
-      mergedHeaders.set(key, value);
-    }
-    mergedHeaders.set("Content-Type", "application/json");
-    const upstreamRes = await fetchImpl(fixedEndpoint, {
-      ...init,
-      body,
-      headers: mergedHeaders,
-      redirect: "error"
-    });
-    if (upstreamRes.status === 401) {
-      return upstreamRes;
-    }
-    if (!upstreamRes.ok) {
-      const clone = upstreamRes.clone();
-      const errorText = await clone.text().catch(() => "");
-      if (errorText.includes("14018")) {
-        throw new Error(QUOTA_EXCEEDED_MESSAGE);
-      }
-      return upstreamRes;
-    }
-    const contentType = upstreamRes.headers.get("content-type") ?? "";
-    if (contentType.includes("text/event-stream")) {
-      return wrapWorkBuddySseResponse(upstreamRes, originalNames);
-    } else {
-      return wrapWorkBuddyJsonResponse(upstreamRes, originalNames);
-    }
-  };
-  return {
-    model: agentConfig.model || "gpt-4o",
-    complete: async (messages, options) => {
-      logLocalRuntimeDiagnostic("provider.request.start", {
-        agentKey: agentConfig.key,
-        transport: "workbuddy",
-        model: agentConfig.model ?? "gpt-4o",
-        messageCount: messages.length,
-        toolCount: tools.length,
-        requestedToolNames,
-        openAiToolNames: summarizeOpenAiToolNames(tools),
-        stream: true
-      });
-      try {
-        const result = await executeOpenAiCompatibleChatCompletion({
-          providerConfig: {
-            endpoint: fixedEndpoint,
-            apiKey: currentCredential.accessToken,
-            model: agentConfig.model || "gpt-4o",
-            provider: site
-          },
-          messages,
-          tools,
-          fetchImpl: wrappedFetch,
-          stream: true,
-          sessionId: asOptionalTrimmedString(options?.dialogId) ?? asOptionalTrimmedString(agentConfig.key),
-          onTextDelta: options?.onTextDelta,
-          onReasoningDelta: options?.onReasoningDelta,
-          onHttpResult: ({ status, body }) => recordLocalAvailability(status, body),
-          resolveApiKey: resolveRequestApiKey
-        });
-        await recordLocalAvailability(200);
-        logLocalRuntimeDiagnostic("provider.request.result", {
-          agentKey: agentConfig.key,
-          transport: "workbuddy",
-          ok: true,
-          contentChars: result.content.length,
-          toolCallCount: result.tool_calls?.length ?? 0
-        });
-        return result;
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (message.includes("14018")) {
-          throw new Error(QUOTA_EXCEEDED_MESSAGE);
-        }
-        throw error;
-      }
-    }
-  };
-};
-
 // packages/cli/client/providerResolution/directOpenAiCompatibleTransport.ts
 var resolveDirectOpenAiCompatibleTransport = async (ctx) => {
   const { agentConfig, deps, fetchImpl, loopbackRequest, additionalToolNames, buildProviderOpenAiTools, recordLocalAvailability, apiKeyRefResolver, credentialBroker, syncFetcher, serverUrl, authToken } = ctx;
@@ -4385,7 +3946,6 @@ var TRANSPORTS = [
   resolveCodexOAuthTransport,
   resolveCursorTransport,
   resolveDevinTransport,
-  resolveWorkbuddyTransport,
   resolveGeminiNativeToolTransport,
   // 三条 custom native wire（gemini / openai-responses / anthropic-messages）由
   // 这一个 resolver 按目录 `nativeProtocol` 分派：三种 wire 互斥（一个模型的
@@ -4556,11 +4116,11 @@ function withProviderStreamRetry(provider, deps) {
 
 // packages/cli/client/cliRemoteDialogSync.ts
 function prepareRemoteDialogEvidenceRecord(key, value) {
-  const record3 = isRecord(value) ? { ...value } : {};
-  if (key.includes("-msg-") && typeof record3.type !== "string") {
-    record3.type = "msg";
+  const record = isRecord(value) ? { ...value } : {};
+  if (key.includes("-msg-") && typeof record.type !== "string") {
+    record.type = "msg";
   }
-  return record3;
+  return record;
 }
 function normalizeRemoteSubjectRef(value) {
   if (!isRecord(value)) return null;
@@ -4852,13 +4412,13 @@ function resolveBuiltinLocalCliAgentConfig(agentRef, userId) {
 }
 async function readAgentFromStore(args) {
   for (const key of buildLocalAgentLookupKeys(args)) {
-    const record3 = await args.store.read(key);
-    if (!record3 || typeof record3 !== "object") continue;
+    const record = await args.store.read(key);
+    if (!record || typeof record !== "object") continue;
     return applyBuiltinAgentRuntimeOverride(
       args.agentRef,
       resolveAgentRuntimeConfigFromRecord(
         key,
-        applyPublicAgentCatalogOverride(record3)
+        applyPublicAgentCatalogOverride(record)
       )
     );
   }
@@ -4893,8 +4453,8 @@ async function readDialogMessages(args) {
 function createChildShellApprovalHostResolver(args) {
   return async (agentKey) => {
     const config = await args.readAgentConfig(agentKey);
-    const record3 = config?.rawRecord;
-    const ownerUserId = asOptionalTrimmedString(record3?.userId) ?? asOptionalTrimmedString(record3?.ownerUserId);
+    const record = config?.rawRecord;
+    const ownerUserId = asOptionalTrimmedString(record?.userId) ?? asOptionalTrimmedString(record?.ownerUserId);
     if (!ownerUserId) return void 0;
     const deviceId = asOptionalTrimmedString(await args.resolveDeviceId());
     if (!deviceId) return void 0;
@@ -5161,8 +4721,8 @@ function describeIssues(issues) {
 function asNonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value : null;
 }
-function resolveCreatedAtMs(record3) {
-  const raw = record3.createdAt;
+function resolveCreatedAtMs(record) {
+  const raw = record.createdAt;
   const ms = typeof raw === "number" ? raw : typeof raw === "string" ? Date.parse(raw) : Number.NaN;
   return Number.isFinite(ms) ? ms : null;
 }
@@ -5222,18 +4782,18 @@ function analyzeRemoteDialogRecords(args) {
     }
     seenIds.add(messageId);
     const key = dialogMessageKey(args.dialogId, messageId);
-    const record3 = {
+    const record = {
       ...raw,
       id: messageId,
       dbKey: key,
       ...asNonEmptyString(raw.dialogId) ? {} : { dialogId: args.dialogId }
     };
-    const message = dialogMessageRecordToAgentRuntimeMessage(record3);
+    const message = dialogMessageRecordToAgentRuntimeMessage(record);
     if (!message) {
       issues.push({ code: "unconvertible-record", detail: `${role} index ${index}` });
       continue;
     }
-    entries.push({ key, messageId, record: record3, message });
+    entries.push({ key, messageId, record, message });
   }
   const messages = entries.map((entry) => entry.message);
   for (const detail of findAgentStatePairingIssues(messages)) {
@@ -5507,14 +5067,27 @@ function buildServerPlatformToolExecutors(args) {
         }
         const body = {
           query: parsed.query,
-          numResults: parsed.numResults ?? 5,
-          useAutoprompt: parsed.useAutoprompt ?? true,
-          type: parsed.type ?? "neural",
-          // Model schema uses `includeContent` (boolean); the Exa API
-          // expects `contents: { text: true }`. Mirror exaSearchFunc's
-          // conversion so CLI proxy results match web behavior.
-          contents: parsed.includeContent !== false ? { text: true } : void 0
+          ...parsed.numResults !== void 0 ? { numResults: parsed.numResults } : {}
         };
+        if (typeof parsed.intent === "string" && parsed.intent) {
+          body.intent = parsed.intent;
+        }
+        if (typeof parsed.category === "string" && parsed.category) {
+          body.category = parsed.category;
+        }
+        if (typeof parsed.timeRange === "string" && parsed.timeRange) {
+          body.timeRange = parsed.timeRange;
+        }
+        if (Array.isArray(parsed.includeDomains) && parsed.includeDomains.length > 0) {
+          body.includeDomains = parsed.includeDomains;
+        }
+        if (Array.isArray(parsed.excludeDomains) && parsed.excludeDomains.length > 0) {
+          body.excludeDomains = parsed.excludeDomains;
+        }
+        if (typeof parsed.includeContent === "boolean") {
+          body.includeContent = parsed.includeContent;
+        }
+        if (call?.origin) body.origin = call.origin;
         const content = await postServer("/api/exa-search", body);
         return {
           content,
@@ -6094,9 +5667,9 @@ var boundedOutputPage = (items, total, offset, budget = 8 * 1024) => {
   return { items, hasMore: offset + items.length < total, nextOffset: offset + items.length };
 };
 var resolveNowMs = (deps) => typeof deps.nowMs === "function" ? deps.nowMs() : Date.now();
-function buildProgressField(record3, nowMs) {
-  const activity = record3.activity;
-  if (!activity || isAgentRunTerminalStatus(record3.status)) return {};
+function buildProgressField(record, nowMs) {
+  const activity = record.activity;
+  if (!activity || isAgentRunTerminalStatus(record.status)) return {};
   const lastEventAt = Date.parse(activity.lastEventAt ?? "");
   const inFlight = activity.inFlight;
   const progress = {
@@ -6193,15 +5766,15 @@ async function assertCredentialFanoutAllowed(deps, args) {
   }
   const { batchId, parentDialogId } = args;
   if (!batchId && !parentDialogId) return candidateGroup;
-  const active = queryRunRecords({ limit: 500 }, deps).runs.filter((record3) => {
-    if (isRunTerminalStatus(record3.status)) return false;
-    if (batchId && record3.batchId === batchId) return true;
-    if (parentDialogId && record3.parentDialogId === parentDialogId) return true;
+  const active = queryRunRecords({ limit: 500 }, deps).runs.filter((record) => {
+    if (isRunTerminalStatus(record.status)) return false;
+    if (batchId && record.batchId === batchId) return true;
+    if (parentDialogId && record.parentDialogId === parentDialogId) return true;
     return false;
-  }).map((record3) => ({
-    runId: record3.runId,
-    agentKey: record3.agentKey,
-    credentialGroup: record3.credentialGroup
+  }).map((record) => ({
+    runId: record.runId,
+    agentKey: record.agentKey,
+    credentialGroup: record.credentialGroup
   }));
   if (active.length === 0) return candidateGroup;
   const verdict = checkCredentialFanout({
@@ -6230,6 +5803,12 @@ function createCliStartAgentRunExecutor(deps = {}) {
       // F1：runtimeKey=local 是「在宿主文件系统上改代码」，需要调用方的显式确认
       // （allowHostWrites: true）；缺失即派发前拒绝（零 spawn、零 run 记录）。
       allowHostWrites: args.allowHostWrites,
+      // 政策第 5 条：显式宿主 cwd × 沙盒落点必须在派发前失败（沙盒不兑现宿主
+      // 路径，cwd 会被静默替换、改动随沙盒消失）。这里传的是调用方**原始**
+      // args.cwd —— `requestedCwd` 走 resolveStartAgentRunCwd，要读 fs 探测，
+      // 排在这条判定之后；守卫自己只认宿主绝对路径（相对/空白自行跳过，交给
+      // resolveStartAgentRunCwd 报「必须是绝对路径」）。
+      ...typeof args.cwd === "string" && args.cwd.trim() ? { cwd: args.cwd } : {},
       ...bindingMachineId ? { bindingMachineId } : {},
       ...localMachineId ? { localMachineId } : {}
     });
@@ -6438,16 +6017,16 @@ function createCliControlAgentRunExecutor(deps = {}) {
         },
         deps
       );
-      const runs = records.map((record4) => {
+      const runs = records.map((record2) => {
         return {
-          runId: record4.runId,
-          status: record4.status,
-          agentKey: record4.agentKey,
-          ...record4.agentName ? { agentName: record4.agentName.slice(0, 120) } : {},
-          ...typeof record4.title === "string" ? { title: record4.title.slice(0, 160) } : {},
-          ...record4.batchId ? { batchId: record4.batchId } : {},
-          pid: record4.pid ?? null,
-          startedAt: record4.startedAt
+          runId: record2.runId,
+          status: record2.status,
+          agentKey: record2.agentKey,
+          ...record2.agentName ? { agentName: record2.agentName.slice(0, 120) } : {},
+          ...typeof record2.title === "string" ? { title: record2.title.slice(0, 160) } : {},
+          ...record2.batchId ? { batchId: record2.batchId } : {},
+          pid: record2.pid ?? null,
+          startedAt: record2.startedAt
         };
       });
       const outputBudgetBytes = 8 * 1024;
@@ -6533,15 +6112,15 @@ function createCliControlAgentRunExecutor(deps = {}) {
       if (!args.runId) throw new Error(t("agentRunTool.appendMissingRunId"));
       const userInput = typeof args.userInput === "string" ? args.userInput.trim() : "";
       if (!userInput) throw new Error(t("agentRunTool.appendMissingUserInput"));
-      const record4 = findRunRecord(String(args.runId), deps);
-      if (!record4) {
+      const record2 = findRunRecord(String(args.runId), deps);
+      if (!record2) {
         const labels2 = agentRunCardLabels();
         return {
           content: JSON.stringify({ runId: args.runId, found: false }),
           metadata: { displayData: formatNotFoundRunCard(labels2) }
         };
       }
-      let reconciled2 = checkStaleRun(record4.runId, deps) ?? record4;
+      let reconciled2 = checkStaleRun(record2.runId, deps) ?? record2;
       if (!isAgentRunTerminalStatus(reconciled2.status)) {
         if (!reconciled2.queuePath) {
           throw new Error(t("agentRunTool.appendQueueUnsupported"));
@@ -6621,8 +6200,8 @@ function createCliControlAgentRunExecutor(deps = {}) {
       throw new Error(t("agentRunTool.unknownAction", String(action)));
     }
     if (!args.runId) throw new Error(t("agentRunTool.missingRunId", String(action)));
-    const record3 = findRunRecord(String(args.runId), deps);
-    if (!record3) {
+    const record = findRunRecord(String(args.runId), deps);
+    if (!record) {
       const labels2 = agentRunCardLabels();
       return {
         content: JSON.stringify({ runId: args.runId, found: false }),
@@ -6630,15 +6209,15 @@ function createCliControlAgentRunExecutor(deps = {}) {
       };
     }
     if (action === "status") {
-      const reconciled2 = checkStaleRun(record3.runId, deps) ?? record3;
-      const logTail = tailLines > 0 ? tailFile(record3.logPath, tailLines, resolveFs(deps)) : void 0;
+      const reconciled2 = checkStaleRun(record.runId, deps) ?? record;
+      const logTail = tailLines > 0 ? tailFile(record.logPath, tailLines, resolveFs(deps)) : void 0;
       return buildRunStatusPayload(reconciled2, deps, { logTail });
     }
     if (action === "wait") {
       const timeoutMs = typeof args.timeoutMs === "number" && args.timeoutMs > 0 ? args.timeoutMs : DEFAULT_WAIT_TIMEOUT_MS;
       let claimToken = null;
       const result = await waitForRunTerminal({
-        read: () => checkStaleRun(record3.runId, deps) ?? record3,
+        read: () => checkStaleRun(record.runId, deps) ?? record,
         isTerminal: (state) => isAgentRunTerminalStatus(state.status),
         pollIntervalMs: WAIT_POLL_INTERVAL_MS,
         timeoutMs,
@@ -6646,28 +6225,28 @@ function createCliControlAgentRunExecutor(deps = {}) {
         sleep: deps.sleep,
         claim: {
           acquire: () => {
-            claimToken = claimRunRecord(record3.runId, { ...deps, ttlMs: timeoutMs + ACK_LEASE_GRACE_MS });
+            claimToken = claimRunRecord(record.runId, { ...deps, ttlMs: timeoutMs + ACK_LEASE_GRACE_MS });
             return claimToken;
           },
           commit: (token) => {
-            if (token) commitRunRecordClaim(record3.runId, token, deps);
-            else ackRunRecord(record3.runId, deps);
+            if (token) commitRunRecordClaim(record.runId, token, deps);
+            else ackRunRecord(record.runId, deps);
           },
           release: (token) => {
-            if (token) releaseRunRecordAck(record3.runId, token, deps);
+            if (token) releaseRunRecordAck(record.runId, token, deps);
           }
         }
       });
       if (result.kind === "aborted") throw new Error(t("agentRunTool.waitAborted"));
       if (result.kind === "failed") throw result.error;
       if (result.kind === "timeout") {
-        const reconciled2 = result.lastState ?? record3;
+        const reconciled2 = result.lastState ?? record;
         const nowMs = resolveNowMs(deps);
         return { content: JSON.stringify({ runId: reconciled2.runId, found: true, status: "timeout", runStatus: reconciled2.status, pid: reconciled2.pid ?? null, agentKey: reconciled2.agentKey, ...reconciled2.agentName ? { agentName: reconciled2.agentName } : {}, startedAt: reconciled2.startedAt, waitedMs: result.waitedMs, timeoutMs, ...buildProgressField(reconciled2, nowMs) }), metadata: { displayData: t("agentRunWaitTimeout", String(Math.round(result.waitedMs / 1e3))) } };
       }
       return buildRunStatusPayload(result.state, deps);
     }
-    const reconciled = checkStaleRun(record3.runId, deps) ?? record3;
+    const reconciled = checkStaleRun(record.runId, deps) ?? record;
     if (isAgentRunTerminalStatus(reconciled.status)) {
       const labels2 = agentRunCardLabels();
       return {
@@ -6686,13 +6265,13 @@ function createCliControlAgentRunExecutor(deps = {}) {
       if (!confirmed) {
         return {
           content: JSON.stringify({
-            runId: record3.runId,
+            runId: record.runId,
             found: true,
             status: reconciled.status,
             stopConfirmed: false
           }),
           metadata: {
-            displayData: t("agentRunStopFailedAlive", String(record3.pid))
+            displayData: t("agentRunStopFailedAlive", String(record.pid))
           }
         };
       }
@@ -7160,12 +6739,10 @@ var REFRESH_BY_PROVIDER = {
   antigravity: refreshAntigravityOAuthToken,
   xai: xaiRefresh,
   claude: anthropicRefresh,
-  cursor: cursorRefresh,
-  workbuddy: workbuddyRefresh,
-  "workbuddy-ai": workbuddyRefresh
+  cursor: cursorRefresh
 };
 function isOAuthProvider(value) {
-  return value === "chatgpt" || value === "xai" || value === "antigravity" || value === "claude" || value === "cursor" || value === "devin" || value === "workbuddy" || value === "workbuddy-ai";
+  return value === "chatgpt" || value === "xai" || value === "antigravity" || value === "claude" || value === "cursor" || value === "devin";
 }
 function createOAuthApiKeyRefResolver(options = {}) {
   const pullServerAccessToken = options.pullServerAccessToken ?? createServerAccessTokenPuller({
@@ -7212,10 +6789,10 @@ function encodeFailure(error, stderr) {
 function readStreams(output) {
   if (typeof output === "string") return { stdout: output, stderr: "" };
   if (!output || typeof output !== "object") return { stdout: "", stderr: "" };
-  const record3 = output;
+  const record = output;
   return {
-    stdout: typeof record3.stdout === "string" ? record3.stdout : "",
-    stderr: typeof record3.stderr === "string" ? record3.stderr : ""
+    stdout: typeof record.stdout === "string" ? record.stdout : "",
+    stderr: typeof record.stderr === "string" ? record.stderr : ""
   };
 }
 function describeMessage(error) {
@@ -8622,8 +8199,8 @@ async function createLocalDockerWorkload(args) {
   }
   const createLifecycle = args.createLifecycle ?? (async () => {
     const [{ DockerWorkloadLifecycle, createDockerBindingAuthorizer }, accounts] = await Promise.all([
-      import("./workloadLifecycle-36DXRZKU.js"),
-      import("./accountResolver-7RYB4D2P.js")
+      import("./workloadLifecycle-6O6PMISX.js"),
+      import("./accountResolver-55EDKEIK.js")
     ]);
     const resolveAccount = args.resolveAccount ?? accounts.createDockerAccountResolver({
       env: args.env,
@@ -8640,7 +8217,28 @@ async function createLocalDockerWorkload(args) {
       resolveAccount
     });
   });
-  const lifecycle = await createLifecycle();
+  const phaseLogEnabled = () => {
+    const env = args.env;
+    return env.NOLO_DEBUG === "1" || env.NOLO_CLI_DEBUG_DETAIL === "1";
+  };
+  const phaseLog = (event, payload) => {
+    if (!phaseLogEnabled()) return;
+    console.warn(`[docker-workload-phase] ${event}`, payload);
+  };
+  const phase = async (name, operation) => {
+    const startedAt = Date.now();
+    phaseLog("start", { phase: name, runId: args.runId });
+    try {
+      const result = await operation();
+      phaseLog("complete", { phase: name, runId: args.runId, elapsedMs: Date.now() - startedAt });
+      return result;
+    } catch (error) {
+      const safeError = error && typeof error === "object" ? error : {};
+      phaseLog("failed", { phase: name, runId: args.runId, elapsedMs: Date.now() - startedAt, errorCode: typeof safeError.code === "string" ? safeError.code : void 0, errorName: typeof safeError.name === "string" ? safeError.name : void 0 });
+      throw error;
+    }
+  };
+  const lifecycle = await phase("create-lifecycle", () => createLifecycle());
   const grant = {
     version: 1,
     grantId: `grant-${args.runId}`,
@@ -8658,25 +8256,29 @@ async function createLocalDockerWorkload(args) {
     }
   };
   const workspaceRoot = args.workspaceRoot ?? process.cwd();
+  const workspaceMode = args.workspaceMode ?? "git";
   const prepareDelivery = args.prepareWorkspaceDelivery ?? prepareHostWorkspaceDelivery;
   const applyDelivery = args.applyWorkspaceDelivery ?? applyDockerWorkspaceDelivery;
   let deliveryApplied = false;
   const deliverWorkspace = async (runtime) => {
     if (deliveryApplied) return;
     deliveryApplied = true;
-    const prepared = prepareDelivery({ workspaceRoot });
-    if (!prepared.ok) {
-      throw new LocalWorkspaceDeliveryError(
-        prepared.code,
-        `${prepared.message}\uFF08\u5BBF\u4E3B\u4FA7\u6295\u9001\u51C6\u5907\u5931\u8D25\uFF0C\u672C run \u62D2\u7EDD\u8FDB\u5165\u5DE5\u5177\u5FAA\u73AF\uFF09`
-      );
-    }
+    const prepared = await phase("host-archive", () => {
+      const result = prepareDelivery({ workspaceRoot });
+      if (!result.ok) {
+        throw new LocalWorkspaceDeliveryError(
+          result.code,
+          `${result.message}\uFF08\u5BBF\u4E3B\u4FA7\u6295\u9001\u51C6\u5907\u5931\u8D25\uFF0C\u672C run \u62D2\u7EDD\u8FDB\u5165\u5DE5\u5177\u5FAA\u73AF\uFF09`
+        );
+      }
+      return result;
+    });
     if (args.signal?.aborted) {
       await prepared.cleanup();
       throw new LocalWorkspaceDeliveryError("delivery_cancelled", "run \u5DF2\u53D6\u6D88\uFF0C\u653E\u5F03\u5DE5\u4F5C\u533A\u6295\u9001\u3002");
     }
     try {
-      await applyDelivery(runtime, prepared.selection);
+      await phase("delivery", () => applyDelivery(runtime, prepared.selection));
     } catch (error) {
       const code = isDockerWorkspaceDeliveryError(error) ? error.code : "delivery_failed";
       throw new LocalWorkspaceDeliveryError(
@@ -8725,11 +8327,39 @@ async function createLocalDockerWorkload(args) {
     },
     async (workload2, runtime) => {
       if (runtime) {
-        const uploaded = await runtime.exec(buildSandboxHelperUploadArgv());
-        if (!uploaded.ok) throw new Error("docker_helper_upload_failed");
-        await deliverWorkspace(runtime);
+        await phase("sandbox-helper-upload", async () => {
+          const uploaded = await runtime.exec(buildSandboxHelperUploadArgv());
+          if (!uploaded.ok) {
+            throw Object.assign(new Error("docker_helper_upload_failed"), { code: "docker_helper_upload_failed" });
+          }
+        });
+        if (workspaceMode === "git") {
+          await deliverWorkspace(runtime);
+        } else {
+          await phase("empty-workspace-root", async () => {
+            const root = await runtime.exec([
+              "bash",
+              "-lc",
+              `mkdir -p '${SANDBOX_WORKSPACE_ROOT}' && test -d '${SANDBOX_WORKSPACE_ROOT}' && test -w '${SANDBOX_WORKSPACE_ROOT}'`
+            ]);
+            if (!root.ok) {
+              throw Object.assign(new Error("docker_empty_workspace_root_failed"), { code: "docker_empty_workspace_root_failed" });
+            }
+            const gitInstall = await runtime.exec(buildInstallGitArgv());
+            if (!gitInstall.ok) {
+              throw Object.assign(
+                new Error(`docker_empty_workspace_git_install_failed (exit ${gitInstall.exitCode})`),
+                { code: "docker_empty_workspace_git_install_failed" }
+              );
+            }
+            const gitProbe = await runtime.exec(["bash", "-lc", "command -v git"]);
+            if (!gitProbe.ok) {
+              throw Object.assign(new Error("docker_empty_workspace_git_missing"), { code: "docker_empty_workspace_git_missing" });
+            }
+          });
+        }
       }
-      resolveReady(workload2);
+      await phase("ready", () => resolveReady(workload2));
       await waitForReleaseOrAbort();
       return void 0;
     }
@@ -8786,6 +8416,7 @@ async function createLocalDockerWorkload(args) {
 var INSTABOX_BACKEND_ID = "instabox";
 var INSTABOX_DEFAULT_BASE_URL = "https://api.instabox.sh/v1";
 var INSTABOX_MAX_EXEC_SECONDS = 600;
+var INSTABOX_MAX_STDIN_BYTES = 1024 * 1024;
 var SAFE_MESSAGE3 = {
   "instabox_invalid_config": "Rejected: instabox backend needs an apiKey and a templateId",
   "instabox_invalid_ticket": "Rejected: execution ticket cannot be satisfied by the instabox backend",
@@ -8951,9 +8582,9 @@ var InstaboxBackend = class {
         `create HTTP ${created.status}${created.transportError ? ` ${created.transportError}` : ""}`
       );
     }
-    const record3 = asRecord(created.payload);
-    const machineId = readString2(record3?.machineId);
-    const operationId = readString2(record3?.id);
+    const record = asRecord(created.payload);
+    const machineId = readString2(record?.machineId);
+    const operationId = readString2(record?.id);
     if (!machineId || !operationId) {
       throw new InstaboxBackendError(
         "instabox_create_failed",
@@ -9019,12 +8650,7 @@ var InstaboxBackend = class {
         "argv must be a non-empty array"
       );
     }
-    if (request.stdin !== void 0) {
-      throw new InstaboxBackendError(
-        "instabox_unsupported_request",
-        "instabox exec has no stdin channel"
-      );
-    }
+    const stdin = this.#resolveStdin(request.stdin);
     const timeoutSeconds = this.#resolveExecTimeoutSeconds(request.timeoutMs);
     const cmd = this.#buildCommand(request);
     const executionId = `${entry.machineId}:${this.#now().toString(36)}`;
@@ -9033,7 +8659,7 @@ var InstaboxBackend = class {
     const response = await this.#call({
       method: "POST",
       path: `/machines/${encodeURIComponent(entry.machineId)}/exec`,
-      body: { cmd, timeoutSeconds }
+      body: { cmd, timeoutSeconds, ...stdin === void 0 ? {} : { stdin } }
     });
     if (!isSuccess(response.status)) {
       throw new InstaboxBackendError(
@@ -9161,6 +8787,27 @@ var InstaboxBackend = class {
     }
     return entry;
   }
+  /**
+   * stdin 直通校验：`undefined` = 请求里没提供（body 里也不加字段，保持原报文兼容）；
+   * 字符串（含空串）在 1 MiB / UTF-8 字节以内原样透传；其他类型或超限立即拒绝，
+   * 错误文案只带上限数字，**绝不回显输入内容**。
+   */
+  #resolveStdin(stdin) {
+    if (stdin === void 0) return void 0;
+    if (typeof stdin !== "string") {
+      throw new InstaboxBackendError(
+        "instabox_unsupported_request",
+        "stdin must be a string"
+      );
+    }
+    if (utf8ByteLengthExceeds(stdin, INSTABOX_MAX_STDIN_BYTES)) {
+      throw new InstaboxBackendError(
+        "instabox_unsupported_request",
+        `stdin exceeds the ${INSTABOX_MAX_STDIN_BYTES} byte limit`
+      );
+    }
+    return stdin;
+  }
   #resolveExecTimeoutSeconds(timeoutMs) {
     const boundMs = INSTABOX_MAX_EXEC_SECONDS * 1e3;
     if (timeoutMs === void 0) return this.#execTimeoutSeconds;
@@ -9178,7 +8825,7 @@ var InstaboxBackend = class {
     }
     return clampExecSeconds(Math.ceil(timeoutMs / 1e3));
   }
-  /** cwd / env 用 `cd` + 赋值前缀表达（Instabox exec 只有 cmd 一个入口）。 */
+  /** cwd / env 仍用 `cd` + 赋值前缀表达（exec body 只多一个可选 stdin，不承载 cwd/env）。 */
   #buildCommand(request) {
     const script = argvToInstaboxCommand(request.argv);
     const segments = [];
@@ -9236,15 +8883,15 @@ var InstaboxBackend = class {
       path: `/machines/${encodeURIComponent(machineId)}/usage`
     });
     if (!isSuccess(response.status)) return null;
-    const record3 = asRecord(response.payload);
-    const runningSeconds = readFiniteNumber(record3?.runningSeconds);
+    const record = asRecord(response.payload);
+    const runningSeconds = readFiniteNumber(record?.runningSeconds);
     if (runningSeconds === null) return null;
     const sample = { runningSeconds };
-    const vcpuSeconds = readFiniteNumber(record3?.vcpuSeconds);
+    const vcpuSeconds = readFiniteNumber(record?.vcpuSeconds);
     if (vcpuSeconds !== null) sample.vcpuSeconds = vcpuSeconds;
-    const memGiBSeconds = readFiniteNumber(record3?.memGiBSeconds);
+    const memGiBSeconds = readFiniteNumber(record?.memGiBSeconds);
     if (memGiBSeconds !== null) sample.memGiBSeconds = memGiBSeconds;
-    const diskGiBSeconds = readFiniteNumber(record3?.diskGiBSeconds);
+    const diskGiBSeconds = readFiniteNumber(record?.diskGiBSeconds);
     if (diskGiBSeconds !== null) sample.diskGiBSeconds = diskGiBSeconds;
     return sample;
   }
@@ -9264,13 +8911,13 @@ var InstaboxBackend = class {
         path: `/operations/${encodeURIComponent(args.operationId)}?wait=${this.#operationWaitSeconds}s`
       });
       lastStatus = response.status;
-      const record3 = isSuccess(response.status) ? asRecord(response.payload) : null;
-      const state = readString2(record3?.state);
+      const record = isSuccess(response.status) ? asRecord(response.payload) : null;
+      const state = readString2(record?.state);
       if (state === "succeeded") return;
       if (state === "failed") {
         throw new InstaboxBackendError(
           args.failCode,
-          `operation ${args.operationId} failed${readString2(record3?.error) ? `: ${readString2(record3?.error)}` : ""}`,
+          `operation ${args.operationId} failed${readString2(record?.error) ? `: ${readString2(record?.error)}` : ""}`,
           args.cleanupPendingOnFailure
         );
       }
@@ -9294,6 +8941,10 @@ function truncateOutput(value, limitChars) {
   if (value.length <= limitChars) return value;
   return `${value.slice(0, limitChars)}\u2026[truncated ${value.length - limitChars} chars]`;
 }
+function utf8ByteLengthExceeds(value, limit) {
+  if (value.length > limit) return true;
+  return new TextEncoder().encode(value).length > limit;
+}
 function createInstaboxExecutionBackend(options) {
   return new InstaboxBackend(options);
 }
@@ -9308,6 +8959,213 @@ function asExecutionBackend(backend) {
   };
 }
 
+// packages/cli/client/localInstaboxFileBridge.ts
+var INSTABOX_HELPER_PATH = SANDBOX_HELPER_PATH;
+var INSTABOX_WORKSPACE_ROOT = "/data/home";
+var INSTABOX_FILE_TOOL_NAMES = [
+  "readFile",
+  "writeFile",
+  "editFile",
+  "globFiles"
+];
+var PROBE_FILE_NAME = "nolo-bridge-probe";
+function escapeForShell(value) {
+  const cleaned = String(value).replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 40);
+  return cleaned || "run";
+}
+var PROBE_FILE_CONTENT = "nolo-bridge-ok";
+function posixQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+function buildInstaboxHelperSource(root) {
+  const source = buildWorkspaceHelperSource();
+  const rootLiteral = /const ROOT = "[^"]*";/;
+  if (!rootLiteral.test(source)) {
+    throw new Error("instabox_helper_root_patch_failed");
+  }
+  if (!root.startsWith("/") || root.includes('"') || root.includes("\\")) {
+    throw new Error("instabox_invalid_workspace_root");
+  }
+  return source.replace(rootLiteral, `const ROOT = "${root}";`);
+}
+function buildInstaboxBridgeBootstrapScript(root, probeId) {
+  let helperPayload;
+  if (!root.startsWith("/") || root.includes('"') || root.includes("\\")) {
+    return `printf 'NOLO_BRIDGE_REASON=root_unavailable
+'`;
+  }
+  try {
+    helperPayload = Buffer.from(buildInstaboxHelperSource(root), "utf8").toString("base64");
+  } catch (error) {
+    return `printf 'NOLO_BRIDGE_REASON=helper_source_invalid
+'`;
+  }
+  const dir = INSTABOX_HELPER_PATH.slice(0, INSTABOX_HELPER_PATH.lastIndexOf("/"));
+  return [
+    `root=${posixQuote(root)}`,
+    `mkdir -p "$root" 2>/dev/null || true`,
+    `if [ ! -w "$root" ]; then printf 'NOLO_BRIDGE_REASON=root_unavailable\\n'; exit 0; fi`,
+    `printf 'NOLO_BRIDGE_ROOT=%s\\n' "$root"`,
+    "rt=''",
+    `for cand in bun node; do if command -v "$cand" >/dev/null 2>&1; then rt="$cand"; break; fi; done`,
+    `printf 'NOLO_BRIDGE_RUNTIME=%s\\n' "\${rt:-none}"`,
+    `if [ -z "$rt" ]; then printf 'NOLO_BRIDGE_REASON=runtime_missing\\n'; exit 0; fi`,
+    `mkdir -p ${posixQuote(dir)} 2>/dev/null || true`,
+    `if ! printf %s ${posixQuote(helperPayload)} | base64 -d > ${posixQuote(INSTABOX_HELPER_PATH)}; then printf 'NOLO_BRIDGE_REASON=upload_failed\\n'; exit 0; fi`,
+    `chmod 0644 ${posixQuote(INSTABOX_HELPER_PATH)} 2>/dev/null || true`,
+    // 探针文件名带本次 run 的唯一 id：**只创建自己的**，绝不覆盖/删除同名既有文件
+    `probe=$root/${escapeForShell(probeId)}-${PROBE_FILE_NAME}`,
+    `if [ -e "$probe" ]; then printf 'NOLO_BRIDGE_REASON=probe_failed\\n'; exit 0; fi`,
+    `printf %s ${posixQuote(PROBE_FILE_CONTENT)} > "$probe" || { printf 'NOLO_BRIDGE_REASON=upload_failed\\n'; exit 0; }`,
+    `printf 'NOLO_BRIDGE_PROBE=%s\\n' "$probe"`,
+    `printf 'NOLO_BRIDGE_UPLOAD=ok\\n'`
+  ].join("\n");
+}
+function parseInstaboxBootstrapOutput(stdout) {
+  let root = null;
+  let probePath = null;
+  let runtime = null;
+  let reason;
+  let uploadOk = false;
+  for (const rawLine of stdout.split(String.fromCharCode(10))) {
+    const line = rawLine.trim();
+    if (line.startsWith("NOLO_BRIDGE_ROOT=")) {
+      const value = line.slice("NOLO_BRIDGE_ROOT=".length).trim();
+      root = value.startsWith("/") ? value : null;
+    } else if (line.startsWith("NOLO_BRIDGE_RUNTIME=")) {
+      const value = line.slice("NOLO_BRIDGE_RUNTIME=".length).trim();
+      runtime = value === "bun" || value === "node" ? value : null;
+    } else if (line.startsWith("NOLO_BRIDGE_UPLOAD=")) {
+      uploadOk = line.slice("NOLO_BRIDGE_UPLOAD=".length).trim() === "ok";
+    } else if (line.startsWith("NOLO_BRIDGE_PROBE=")) {
+      const value = line.slice("NOLO_BRIDGE_PROBE=".length).trim();
+      probePath = value.startsWith("/") ? value : null;
+    } else if (line.startsWith("NOLO_BRIDGE_REASON=")) {
+      const value = line.slice("NOLO_BRIDGE_REASON=".length).trim();
+      reason = value === "runtime_missing" || value === "root_unavailable" || value === "upload_failed" || value === "probe_failed" || value === "root_mismatch" || value === "helper_source_invalid" ? value : "probe_failed";
+    }
+  }
+  if (!root) return { root: null, runtime: null, probePath: null, reason: reason ?? "root_unavailable" };
+  if (!runtime) return { root, runtime: null, probePath, reason: reason ?? "runtime_missing" };
+  if (!uploadOk) return { root, runtime, probePath, reason: reason ?? "upload_failed" };
+  if (!probePath) return { root, runtime, probePath: null, reason: reason ?? "probe_failed" };
+  return { root, runtime, probePath };
+}
+function resolveInstaboxPath(root, input) {
+  if (typeof input !== "string" || !input.trim() || input.includes("\0")) {
+    return { ok: false, error: "invalid_path" };
+  }
+  const normalizedRoot = root.endsWith("/") ? root.slice(0, -1) : root;
+  const isAbs = input.startsWith("/");
+  if (isAbs && input !== normalizedRoot && !input.startsWith(`${normalizedRoot}/`)) {
+    return { ok: false, error: "path_outside_workspace" };
+  }
+  const resolved = isAbs ? posixNormalize(input) : posixNormalize(`${normalizedRoot}/${input}`);
+  if (resolved !== normalizedRoot && !resolved.startsWith(`${normalizedRoot}/`)) {
+    return { ok: false, error: "path_escape" };
+  }
+  return { ok: true, path: resolved };
+}
+function posixNormalize(input) {
+  const parts = [];
+  for (const segment of input.split("/")) {
+    if (!segment || segment === ".") continue;
+    if (segment === "..") {
+      parts.pop();
+      continue;
+    }
+    parts.push(segment);
+  }
+  return `/${parts.join("/")}`;
+}
+function buildInstaboxToolArgv(toolName, args, bridge) {
+  const validated = {};
+  let op;
+  switch (toolName) {
+    case "readFile": {
+      const res = resolveInstaboxPath(bridge.root, String(args.path ?? ""));
+      if (!res.ok) return { ok: false, error: res.error };
+      op = "readFile";
+      validated.path = res.path;
+      if (typeof args.lines === "string") validated.lines = args.lines;
+      break;
+    }
+    case "writeFile": {
+      if (typeof args.content !== "string") return { ok: false, error: "missing_content" };
+      if (Buffer.byteLength(args.content, "utf-8") > SANDBOX_OUTPUT_LIMITS.maxContentBytes) {
+        return { ok: false, error: "content_too_large" };
+      }
+      const res = resolveInstaboxPath(bridge.root, String(args.path ?? ""));
+      if (!res.ok) return { ok: false, error: res.error };
+      op = "writeFile";
+      validated.path = res.path;
+      validated.content = args.content;
+      break;
+    }
+    case "editFile": {
+      if (typeof args.oldText !== "string" || typeof args.newText !== "string") {
+        return { ok: false, error: "missing_edit_text" };
+      }
+      if (args.oldText === args.newText) return { ok: false, error: "edit_text_identical" };
+      if (Buffer.byteLength(args.newText, "utf-8") > SANDBOX_OUTPUT_LIMITS.maxContentBytes) {
+        return { ok: false, error: "content_too_large" };
+      }
+      const res = resolveInstaboxPath(bridge.root, String(args.path ?? ""));
+      if (!res.ok) return { ok: false, error: res.error };
+      op = "editFile";
+      validated.path = res.path;
+      validated.oldText = args.oldText;
+      validated.newText = args.newText;
+      break;
+    }
+    case "globFiles":
+    case "glob": {
+      if (typeof args.pattern !== "string" || !args.pattern.trim()) {
+        return { ok: false, error: "missing_pattern" };
+      }
+      op = "glob";
+      validated.pattern = args.pattern;
+      if (typeof args.path === "string" && args.path.trim()) {
+        const res = resolveInstaboxPath(bridge.root, args.path);
+        if (!res.ok) return { ok: false, error: res.error };
+        validated.path = res.path;
+      }
+      break;
+    }
+    default:
+      return { ok: false, error: "unsupported_tool" };
+  }
+  const payload = Buffer.from(JSON.stringify({ op, args: validated }), "utf-8").toString("base64");
+  if (payload.length > SANDBOX_OUTPUT_LIMITS.maxArgvBytes) {
+    return { ok: false, error: "content_too_large" };
+  }
+  return { ok: true, argv: [bridge.runtime, INSTABOX_HELPER_PATH, payload] };
+}
+function buildInstaboxBridgeProbeRequest(bridge, probePath) {
+  const payload = Buffer.from(
+    JSON.stringify({ op: "readFile", args: { path: probePath } }),
+    "utf-8"
+  ).toString("base64");
+  return { kind: "command", argv: [bridge.runtime, INSTABOX_HELPER_PATH, payload] };
+}
+function readInstaboxProbeResult(stdout) {
+  if (typeof stdout !== "string") return { ready: false, reason: "probe_failed" };
+  const text = stdout.trim();
+  if (!text) return { ready: false, reason: "probe_failed" };
+  if (text.includes('"ok":false') || text.includes("'ok':false")) {
+    return { ready: false, reason: "probe_failed" };
+  }
+  if (text.includes(PROBE_FILE_CONTENT)) return { ready: true };
+  const parsed = parseToolOutput(text);
+  if (!parsed.ok) return { ready: false, reason: "probe_failed" };
+  const value = parsed.value;
+  return typeof value === "object" && value !== null && typeof value.content === "string" && value.content.includes(PROBE_FILE_CONTENT) ? { ready: true } : { ready: false, reason: "probe_failed" };
+}
+function describeInstaboxBridgeUnavailable(bridge) {
+  const detail = bridge.reason === "runtime_missing" ? "Instabox \u6A21\u677F\u5185\u65E2\u6CA1\u6709 bun \u4E5F\u6CA1\u6709 node\uFF0C\u5BB9\u5668\u5185 helper \u65E0\u6CD5\u6267\u884C" : bridge.reason === "root_unavailable" ? "Instabox \u5BB9\u5668\u5185\u65E0\u6CD5\u521B\u5EFA\u53EF\u5199\u5DE5\u4F5C\u76EE\u5F55" : bridge.reason === "upload_failed" ? "\u5BB9\u5668\u5185 helper \u4E0A\u4F20\u5931\u8D25" : bridge.reason === "root_mismatch" ? "\u5BB9\u5668\u5185\u56FA\u5B9A\u5DE5\u4F5C\u76EE\u5F55\u4E0E helper ROOT \u4E0D\u4E00\u81F4" : bridge.reason === "helper_source_invalid" ? "\u5171\u4EAB helper \u6E90\u7801\u5F62\u72B6\u53D8\u5316\uFF0C\u65E0\u6CD5\u5B89\u5168\u6539\u5199 ROOT" : "\u5BB9\u5668\u5185 helper \u63A2\u9488\u8BFB\u56DE\u5931\u8D25";
+  return `instabox \u6587\u4EF6\u5DE5\u5177 bridge \u672A\u5C31\u7EEA\uFF08${bridge.reason ?? "probe_failed"}\uFF09\uFF1A${detail}\uFF1B\u6587\u4EF6\u5DE5\u5177\u5DF2\u663E\u5F0F\u62D2\u7EDD\uFF0C\u7EDD\u4E0D\u56DE\u843D\u5BBF\u4E3B\u6267\u884C\uFF08execShell \u4ECD\u53EF\u7528\uFF09\u3002`;
+}
+
 // packages/cli/client/localInstaboxWorkload.ts
 var LOCAL_INSTABOX_BACKEND_ID = INSTABOX_BACKEND_ID;
 function resolveInstaboxApiKey(env) {
@@ -9328,6 +9186,35 @@ function assertInstaboxPrerequisites(env) {
   }
   return apiKey;
 }
+function resolveInstaboxWorkspaceRoot(env) {
+  const override = env.INSTABOX_WORKSPACE_ROOT?.trim();
+  if (override && override.startsWith("/") && !override.includes('"')) return override;
+  return INSTABOX_WORKSPACE_ROOT;
+}
+function posixQuote2(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+async function prepareFileBridge(execDirect, root, probeId) {
+  const bootstrapStdout = await execDirect({
+    kind: "command",
+    argv: ["bash", "-lc", buildInstaboxBridgeBootstrapScript(root, probeId)]
+  });
+  const parsed = parseInstaboxBootstrapOutput(bootstrapStdout);
+  if (!parsed.root || !parsed.runtime || !parsed.probePath || parsed.reason) {
+    return {
+      root: parsed.root,
+      runtime: parsed.runtime,
+      ready: false,
+      reason: parsed.reason ?? "probe_failed"
+    };
+  }
+  const pinned = { root: parsed.root, runtime: parsed.runtime };
+  const probeStdout = await execDirect(
+    buildInstaboxBridgeProbeRequest(pinned, parsed.probePath)
+  );
+  const verdict = readInstaboxProbeResult(probeStdout);
+  return verdict.ready ? { root: pinned.root, runtime: pinned.runtime, ready: true } : { root: pinned.root, runtime: pinned.runtime, ready: false, reason: verdict.reason ?? "probe_failed" };
+}
 async function createLocalInstaboxWorkload(args) {
   if (args.runtimeKey.trim() !== "instabox") {
     throw new LocalRuntimeKeyUnsupportedError(
@@ -9342,6 +9229,7 @@ async function createLocalInstaboxWorkload(args) {
       templateId: args.templateId ?? args.env.INSTABOX_TEMPLATE_ID?.trim() ?? "universal"
     })
   );
+  const workspaceRoot = resolveInstaboxWorkspaceRoot(args.env);
   const ticket = {
     version: 1,
     ticketId: `ticket-${args.runId}`,
@@ -9351,12 +9239,14 @@ async function createLocalInstaboxWorkload(args) {
     callerUserId: args.authenticatedCaller || "local-caller",
     executionClass: "session",
     target: { kind: "server" },
-    toolNames: [EXECUTION_SHELL_TOOL],
+    // 本 workload 真的会执行这些工具（shell + 容器内结构化文件工具），授权声明必须一致
+    toolNames: [EXECUTION_SHELL_TOOL, ...INSTABOX_FILE_TOOL_NAMES],
     filesystem: {
-      readScope: "none",
-      readableRoots: [],
-      writeScope: "none",
-      writableRoots: []
+      // 钉住的固定工作目录：读写范围都声明成它，不写 "none" 再偷偷写文件
+      readScope: "configured-roots",
+      readableRoots: [workspaceRoot],
+      writeScope: "configured-roots",
+      writableRoots: [workspaceRoot]
     },
     shellAllowed: true,
     requestedIsolation: "container",
@@ -9371,37 +9261,118 @@ async function createLocalInstaboxWorkload(args) {
       `runtimeKey \u6307\u5411 instabox\uFF0C\u4F46\u4E91\u6C99\u76D2\u521D\u59CB\u5316\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}\u3002${instaboxFailureHint}`
     );
   }
+  let releaseState = "active";
+  let releasePromise = null;
+  const releaseBackend = () => {
+    if (releaseState === "released") return Promise.resolve();
+    if (releasePromise) return releasePromise;
+    releaseState = "releasing";
+    let attempt;
+    try {
+      attempt = Promise.resolve(backend.release(lease, "completed"));
+    } catch (error) {
+      attempt = Promise.reject(error);
+    }
+    releasePromise = attempt.then(
+      () => {
+        releaseState = "released";
+      },
+      (error) => {
+        releaseState = "cleanup_pending";
+        throw error;
+      }
+    ).finally(() => {
+      releasePromise = null;
+    });
+    return releasePromise;
+  };
+  const describeReleaseFailure = (error) => {
+    const record = error;
+    const cleanupPending = record?.cleanupPending === true || record?.code === "instabox_cleanup_pending";
+    const detail = error instanceof Error ? error.message : String(error);
+    return cleanupPending ? `\u4E14\u673A\u5668\u5220\u9664\u672A\u786E\u8BA4\uFF1Acleanup_pending\uFF08${detail}\uFF09\u2014\u2014\u4E91\u7AEF\u53EF\u80FD\u4ECD\u6709\u5B58\u6D3B\u673A\u5668\uFF0C\u4E0D\u5F97\u5F53\u4F5C\u5DF2\u6E05\u7406\uFF0C\u9700\u4EBA\u5DE5\u6838\u5BF9\u540E\u5220\u9664` : `\u4E14 release \u4E5F\u5931\u8D25\uFF08${detail}\uFF09`;
+  };
+  const execDirect = async (request) => {
+    const result = await backend.execute(lease, request);
+    const streams = result.output;
+    const stdout = typeof streams?.stdout === "string" ? streams.stdout : "";
+    const stderr = typeof streams?.stderr === "string" ? streams.stderr : "";
+    if (result.ok === false) {
+      throw new Error(`instabox \u5BB9\u5668\u5185\u6267\u884C\u5931\u8D25\uFF1A${stderr || `exit_code:${result.exitCode ?? "unknown"}`}`);
+    }
+    return stdout;
+  };
+  let bridge;
+  try {
+    bridge = await prepareFileBridge(execDirect, workspaceRoot, args.runId);
+  } catch (error) {
+    let cleanupNote = "\u672C\u6B21 lease \u5DF2\u91CA\u653E";
+    try {
+      await releaseBackend();
+    } catch (releaseError) {
+      cleanupNote = describeReleaseFailure(releaseError);
+    }
+    throw new LocalRuntimeKeyUnsupportedError(
+      "instabox_bridge_bootstrap_failed",
+      `runtimeKey \u6307\u5411 instabox\uFF0C\u4F46\u5BB9\u5668\u5185\u6587\u4EF6\u5DE5\u5177\u6865 bootstrap \u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}\uFF1B${cleanupNote}\u3002${instaboxFailureHint}`
+    );
+  }
   const rawChannel = createExecutionChannel({
     backend,
     lease,
-    timeoutMs: 10 * 60 * 1e3
+    timeoutMs: 10 * 60 * 1e3,
+    ...bridge.ready && bridge.root && bridge.runtime ? {
+      helper: {
+        path: INSTABOX_HELPER_PATH,
+        buildArgv: (toolName, toolArgs) => buildInstaboxToolArgv(toolName, toolArgs, {
+          root: bridge.root,
+          runtime: bridge.runtime
+        })
+      }
+    } : {}
   });
-  let released = false;
   const release = async () => {
-    if (released) return;
-    released = true;
-    try {
-      await backend.release(lease, "completed");
-    } catch {
-    }
+    await releaseBackend();
   };
   const channel = async (toolName, toolArgs, signal) => {
-    if (released) {
+    if (releaseState !== "active") {
       throw new Error(
-        "instabox workload \u5DF2\u91CA\u653E\uFF1A\u672C run \u7684 lease \u5DF2\u5931\u6548\uFF0C\u62D2\u7EDD\u5728\u5BBF\u4E3B\u6267\u884C\u5DE5\u5177"
+        releaseState === "cleanup_pending" ? "instabox workload cleanup_pending\uFF1A\u4E0A\u4E00\u6B21\u6E05\u7406\u672A\u786E\u8BA4\uFF0Clease \u72B6\u6001\u4E0D\u53EF\u4FE1\uFF0C\u62D2\u7EDD\u6267\u884C\u5DE5\u5177" : "instabox workload \u5DF2\u91CA\u653E\uFF1A\u672C run \u7684 lease \u5DF2\u5931\u6548\uFF0C\u62D2\u7EDD\u5728\u5BBF\u4E3B\u6267\u884C\u5DE5\u5177"
       );
     }
     if (toolName === "execShell") {
+      const command = typeof toolArgs.command === "string" ? toolArgs.command : void 0;
+      if (bridge.root && command !== void 0) {
+        return await rawChannel(EXECUTION_SHELL_TOOL, {
+          ...toolArgs,
+          command: `cd ${posixQuote2(bridge.root)} && ${command}`
+        }, signal);
+      }
       return await rawChannel(EXECUTION_SHELL_TOOL, toolArgs, signal);
     }
+    if (INSTABOX_FILE_TOOL_NAMES.includes(toolName)) {
+      if (!bridge.ready) {
+        throw new Error(describeInstaboxBridgeUnavailable(bridge));
+      }
+      const output = await rawChannel(toolName, toolArgs, signal);
+      const parsed = parseToolOutput(output);
+      if (!parsed.ok) {
+        return JSON.stringify({ ok: false, error: parsed.error, workloadLocation: "instabox" });
+      }
+      const value = parsed.value;
+      const payload = typeof value === "object" && value !== null ? { ok: true, ...value, value, workloadLocation: "instabox" } : { ok: true, value, workloadLocation: "instabox" };
+      return JSON.stringify(payload);
+    }
     throw new Error(
-      `instabox workload \u6682\u65E0\u6587\u4EF6\u5DE5\u5177 bridge\uFF08\u4EC5\u652F\u6301 execShell \u8FDC\u7A0B\u547D\u4EE4\uFF09\uFF1B\u5DE5\u5177 "${toolName}" \u62D2\u7EDD\u5728\u5BBF\u4E3B\u6267\u884C\u3002`
+      `instabox workload \u6682\u4E0D\u652F\u6301\u5DE5\u5177 "${toolName}"\uFF08\u672C\u5757\u53EA\u6865\u63A5 readFile/writeFile/editFile/globFiles\uFF09\uFF1B\u62D2\u7EDD\u5728\u5BBF\u4E3B\u6267\u884C\u3002`
     );
   };
   return {
     backendId: LOCAL_INSTABOX_BACKEND_ID,
     runId: args.runId,
     channel,
+    workspaceRoot: bridge.root,
+    fileBridge: bridge,
     release
   };
 }
@@ -9608,12 +9579,12 @@ function parseExecShellChannelOutput(raw) {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     return { stdout: text, exitCode: 0, ...isTruncated(text) ? { truncated: true } : {} };
   }
-  const record3 = parsed;
-  const output = record3.output && typeof record3.output === "object" ? record3.output : void 0;
-  const stdout = firstString(output?.stdout, record3.stdout, record3.output, record3.content) ?? "";
-  const truncated = record3.truncated === true || output?.truncated === true || isTruncated(stdout) || isTruncated(firstString(output?.stderr, record3.stderr) ?? "");
-  const explicitFailure = record3.ok === false || typeof record3.error === "string";
-  const rawExit = record3.exitCode ?? record3.exit_code;
+  const record = parsed;
+  const output = record.output && typeof record.output === "object" ? record.output : void 0;
+  const stdout = firstString(output?.stdout, record.stdout, record.output, record.content) ?? "";
+  const truncated = record.truncated === true || output?.truncated === true || isTruncated(stdout) || isTruncated(firstString(output?.stderr, record.stderr) ?? "");
+  const explicitFailure = record.ok === false || typeof record.error === "string";
+  const rawExit = record.exitCode ?? record.exit_code;
   const exitCode = typeof rawExit === "number" ? rawExit : explicitFailure ? 1 : 0;
   if (explicitFailure && stdout.trim() === "") return { stdout: "", exitCode: exitCode === 0 ? 1 : exitCode, ...truncated ? { truncated: true } : {} };
   return { stdout, exitCode, ...truncated ? { truncated: true } : {} };
@@ -9661,9 +9632,9 @@ async function exportRunDiffArtifact(args) {
     return null;
   }
   if (args.writeAudit) {
-    const record3 = { runId: args.runId, kind: "diff", key, ref };
+    const record = { runId: args.runId, kind: "diff", key, ref };
     try {
-      await args.writeAudit(record3);
+      await args.writeAudit(record);
     } catch (error) {
       warn(`run \u7EC8\u6001\u5BFC\u51FA\u5BA1\u8BA1\u5199\u5165\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD run \u7ED3\u679C\uFF09\uFF1A${describeError2(error)}`);
     }
@@ -9740,8 +9711,8 @@ async function exportRunWorktreeDiffArtifacts(args) {
   }
   return summary;
 }
-function serializeRunArtifactAudit(record3) {
-  return `${JSON.stringify(record3, null, 2)}
+function serializeRunArtifactAudit(record) {
+  return `${JSON.stringify(record, null, 2)}
 `;
 }
 
@@ -10306,9 +10277,9 @@ async function writeLocalTokenRecord(args) {
 function extractLastProviderInputTokens(input) {
   if (input.usageRecords && input.usageRecords.length > 0) {
     for (let i = input.usageRecords.length - 1; i >= 0; i--) {
-      const record3 = input.usageRecords[i];
-      if (!record3?.usage) continue;
-      const normalized = normalizeUsage(record3.usage);
+      const record = input.usageRecords[i];
+      if (!record?.usage) continue;
+      const normalized = normalizeUsage(record.usage);
       if (normalized.input_tokens > 0) {
         return normalized.input_tokens;
       }
@@ -10491,21 +10462,21 @@ function resolveCliDialogRecordKey(userId, dialogId) {
 }
 async function loadCliDialogSummary(args) {
   const dialogKey = resolveCliDialogRecordKey(args.userId, args.dialogId);
-  const record3 = await args.store.read(dialogKey);
-  if (!record3 || typeof record3 !== "object") return null;
-  const summary = typeof record3.summary === "string" ? record3.summary.trim() : "";
+  const record = await args.store.read(dialogKey);
+  if (!record || typeof record !== "object") return null;
+  const summary = typeof record.summary === "string" ? record.summary.trim() : "";
   if (!summary) return null;
-  const summarizedBeforeId = record3.summarizedBeforeId;
-  const sourceHash = record3.sourceHash;
-  const sourceCount = record3.sourceCount;
-  const schemaVersion = record3.schemaVersion;
+  const summarizedBeforeId = record.summarizedBeforeId;
+  const sourceHash = record.sourceHash;
+  const sourceCount = record.sourceCount;
+  const schemaVersion = record.schemaVersion;
   return {
     summary,
     ...typeof summarizedBeforeId === "string" && summarizedBeforeId ? { summarizedBeforeId } : {},
     ...typeof sourceHash === "string" && sourceHash ? { sourceHash } : {},
     ...typeof sourceCount === "number" && sourceCount > 0 ? { sourceCount } : {},
-    ..."schemaVersion" in record3 ? { schemaVersion } : {},
-    ...Array.isArray(record3.referenceKeys) ? { referenceKeys: record3.referenceKeys.filter((key) => typeof key === "string") } : {}
+    ..."schemaVersion" in record ? { schemaVersion } : {},
+    ...Array.isArray(record.referenceKeys) ? { referenceKeys: record.referenceKeys.filter((key) => typeof key === "string") } : {}
   };
 }
 async function saveCliDialogSummary(args) {
@@ -10534,9 +10505,9 @@ async function saveCliDialogSummary(args) {
 }
 async function loadCliDialogLastContextUsage(args) {
   const dialogKey = resolveCliDialogRecordKey(args.userId, args.dialogId);
-  const record3 = await args.store.read(dialogKey, { remote: false });
-  if (!record3 || typeof record3 !== "object") return null;
-  const lastInputTokens = record3.lastInputTokens;
+  const record = await args.store.read(dialogKey, { remote: false });
+  if (!record || typeof record !== "object") return null;
+  const lastInputTokens = record.lastInputTokens;
   if (typeof lastInputTokens === "number" && Number.isFinite(lastInputTokens) && lastInputTokens > 0) {
     return { inputTokens: lastInputTokens };
   }
@@ -10553,6 +10524,36 @@ function parseTitleUpdatedAtMs(existingDialog) {
 }
 
 // packages/cli/client/localRuntimeAdapter.ts
+var LOCAL_INSTABOX_TOOL_NAMES = [
+  EXECUTION_SHELL_TOOL,
+  ...INSTABOX_FILE_TOOL_NAMES
+];
+function resolveLocalInstaboxToolRoute(args) {
+  const toolName = normalizeLocalToolName(args.toolName);
+  if (!LOCAL_INSTABOX_TOOL_NAMES.includes(toolName)) {
+    return WORKSPACE_TOOL_NAMES.includes(toolName) ? {
+      action: "reject",
+      toolName,
+      reason: `instabox workload \u4E0D\u652F\u6301\u5DE5\u4F5C\u533A\u5DE5\u5177 "${toolName}"\uFF08instabox \u5DE5\u5177\u9762\uFF1A${LOCAL_INSTABOX_TOOL_NAMES.join(", ")}\uFF09\uFF1B\u62D2\u7EDD\u56DE\u843D\u5230\u5BBF\u4E3B\u6267\u884C`
+    } : { action: "passthrough", toolName };
+  }
+  const agentToolNames = (args.agentToolNames ?? []).map(
+    normalizeLocalToolName
+  );
+  const deniedBySurfaceOrPolicy = !agentToolNames.includes(toolName) || !resolveLocalToolPolicy({
+    env: args.env ?? {},
+    agentToolNames,
+    toolName
+  }).allowed;
+  if (deniedBySurfaceOrPolicy) {
+    return {
+      action: "reject",
+      toolName,
+      reason: `${toolName} is outside the run tool surface / policy \u2014 instabox workload \u4E0D\u662F\u7ED5\u8FC7 deny \u7684\u901A\u9053\uFF1B\u62D2\u7EDD\u5728\u5BBF\u4E3B\u6267\u884C\u5DE5\u4F5C\u533A\u5DE5\u5177`
+    };
+  }
+  return { action: "intercept", toolName };
+}
 var currentMetaFile = fileURLToPath(import.meta.url);
 var isJsBundle = extname(currentMetaFile) === ".js";
 var SOURCE_CLI_DIR = isJsBundle ? dirname4(currentMetaFile) : dirname4(dirname4(currentMetaFile));
@@ -10592,13 +10593,13 @@ async function recordLocalAvailabilityForAgent(args) {
     );
     return typeof entry?.nextAvailableAt === "number" ? entry.nextAvailableAt : action.nextAvailableAt;
   }
-  const record3 = current;
-  if (action.kind === "clear" && !("nextAvailableAt" in record3)) return void 0;
-  const next = { ...record3 };
+  const record = current;
+  if (action.kind === "clear" && !("nextAvailableAt" in record)) return void 0;
+  const next = { ...record };
   let effectiveNextAvailableAt;
   if (action.kind === "mark") {
     const merged = mergeAvailabilityDeadline(
-      record3.nextAvailableAt,
+      record.nextAvailableAt,
       action.nextAvailableAt
     );
     next.nextAvailableAt = merged;
@@ -10640,13 +10641,13 @@ function createCliLocalRuntimeAdapter(deps) {
   const additionalToolNames = deps.pastedTextStore ? ["readPastedText"] : [];
   const resolveAgentCredentialGroup = async (agentRef) => {
     try {
-      const record3 = await readAgentFromStore({
+      const record = await readAgentFromStore({
         agentRef,
         store: await getOrCreateSharedStore(deps),
         userId
       });
-      if (!record3 || typeof record3 !== "object") return void 0;
-      const rec = record3;
+      if (!record || typeof record !== "object") return void 0;
+      const rec = record;
       const existing = typeof rec.credentialGroup === "string" && rec.credentialGroup.trim() ? rec.credentialGroup.trim() : void 0;
       if (existing) return existing;
       const ref = typeof rec.apiKeyRef === "string" && rec.apiKeyRef.trim() ? rec.apiKeyRef : typeof rec.credentialRef === "string" && rec.credentialRef.trim() ? rec.credentialRef : void 0;
@@ -10660,13 +10661,13 @@ function createCliLocalRuntimeAdapter(deps) {
   };
   const resolveAgentDisplayName = async (agentRef) => {
     try {
-      const record3 = await readAgentFromStore({
+      const record = await readAgentFromStore({
         agentRef,
         store: await getOrCreateSharedStore(deps),
         userId
       });
-      if (!record3 || typeof record3 !== "object") return void 0;
-      const name = record3.name;
+      if (!record || typeof record !== "object") return void 0;
+      const name = record.name;
       return typeof name === "string" && name.trim() ? name.trim() : void 0;
     } catch {
       return void 0;
@@ -10674,12 +10675,12 @@ function createCliLocalRuntimeAdapter(deps) {
   };
   const resolveAgentRuntimeBindingMachineId = async (agentRef) => {
     try {
-      const record3 = await readAgentFromStore({
+      const record = await readAgentFromStore({
         agentRef,
         store: await getOrCreateSharedStore(deps),
         userId
       });
-      const rec = record3;
+      const rec = record;
       const binding = asRecordOrEmpty(rec?.runtimeBinding);
       return asOptionalTrimmedString(binding.machineId);
     } catch {
@@ -10723,16 +10724,24 @@ function createCliLocalRuntimeAdapter(deps) {
       authenticatedCaller: resolveLocalUserId(deps.env),
       agentKey: "cli-local-run",
       env: deps.env,
-      workspaceRoot
+      workspaceRoot,
+      ...deps.dockerWorkspaceMode ? { workspaceMode: deps.dockerWorkspaceMode } : {}
     }))();
     return dockerWorkloadLoad;
   };
   const instaboxRuntimeEnabled = runtimeKey === "instabox";
   let instaboxWorkloadLoad = null;
   let instaboxWorkloadReleased = false;
+  let instaboxReleasePending = false;
+  let instaboxReleasePromise = null;
   const createInstaboxWorkload = deps.createLocalInstaboxWorkload ?? createLocalInstaboxWorkload;
   const loadLocalInstaboxWorkload = () => {
     if (!instaboxRuntimeEnabled) return Promise.resolve(null);
+    if (instaboxReleasePending) {
+      return Promise.reject(
+        new Error("instabox workload cleanup_pending\uFF1Alease cleanup \u5C1A\u672A\u786E\u8BA4\uFF0C\u62D2\u7EDD\u6267\u884C\u5DE5\u5177")
+      );
+    }
     if (instaboxWorkloadReleased) {
       return Promise.reject(
         new Error(
@@ -10814,13 +10823,34 @@ function createCliLocalRuntimeAdapter(deps) {
   const loadLocalSandboxWorkload = () => localSandboxLoad ??= createSandboxWorkload({ workspaceRoot }).catch(
     () => null
   );
-  const releaseLocalInstaboxWorkload = async () => {
-    const loaded = instaboxWorkloadLoad ? await instaboxWorkloadLoad.catch(() => null) : null;
-    instaboxWorkloadReleased = true;
-    instaboxWorkloadLoad = null;
-    if (loaded) {
-      await loaded.release().catch(() => void 0);
-    }
+  const releaseLocalInstaboxWorkload = () => {
+    if (instaboxReleasePromise) return instaboxReleasePromise;
+    const attempt = (async () => {
+      const loaded = instaboxWorkloadLoad ? await instaboxWorkloadLoad.catch(() => null) : null;
+      if (!loaded) {
+        instaboxWorkloadReleased = true;
+        instaboxWorkloadLoad = null;
+        return;
+      }
+      try {
+        await loaded.release();
+        instaboxWorkloadReleased = true;
+        instaboxReleasePending = false;
+        instaboxWorkloadLoad = null;
+      } catch (error) {
+        instaboxReleasePending = true;
+        const record = error;
+        const code = record?.code === "instabox_cleanup_pending" || record?.cleanupPending === true ? "cleanup_pending" : "release_failed";
+        process.stderr.write(`[nolo] instabox_release_${code}
+`);
+        throw error;
+      }
+    })();
+    instaboxReleasePromise = attempt;
+    void attempt.finally(() => {
+      if (instaboxReleasePromise === attempt) instaboxReleasePromise = null;
+    }).catch(() => void 0);
+    return attempt;
   };
   const releaseLocalSandboxWorkload = async () => {
     await releaseLocalDockerWorkload();
@@ -11297,18 +11327,30 @@ function createCliLocalRuntimeAdapter(deps) {
         }
       }
       if (instaboxRuntimeEnabled) {
-        const instaboxHandle = await loadLocalInstaboxWorkload();
-        if (instaboxHandle) {
-          const instaboxToolName = normalizeLocalToolName(call.name);
+        const instaboxRoute = resolveLocalInstaboxToolRoute({
+          toolName: call.name,
+          env: deps.env,
+          agentToolNames: activeAgentToolNames
+        });
+        if (instaboxRoute.action === "reject") {
+          throw new Error(instaboxRoute.reason);
+        }
+        if (instaboxRoute.action === "intercept") {
+          const instaboxHandle = await loadLocalInstaboxWorkload();
+          if (!instaboxHandle) {
+            throw new Error(
+              `instabox workload \u4E0D\u53EF\u7528\uFF08\u65E0 handle\uFF09\uFF1A\u62D2\u7EDD\u5728\u5BBF\u4E3B\u6267\u884C\u5DE5\u4F5C\u533A\u5DE5\u5177 "${instaboxRoute.toolName}"`
+            );
+          }
           const instaboxArgs = parseToolArgumentsObject(injectedCall.arguments) ?? {};
           const instaboxOutput = await instaboxHandle.channel(
-            instaboxToolName,
+            instaboxRoute.toolName,
             instaboxArgs,
             opts?.abortSignal
           );
           if (typeof instaboxOutput !== "string") {
             throw new Error(
-              `instabox workload \u672A\u8FD4\u56DE\u7ED3\u679C\uFF08tool=${instaboxToolName}\uFF09\uFF1A\u62D2\u7EDD\u56DE\u843D\u5230\u5BBF\u4E3B\u6267\u884C`
+              `instabox workload \u672A\u8FD4\u56DE\u7ED3\u679C\uFF08tool=${instaboxRoute.toolName}\uFF09\uFF1A\u62D2\u7EDD\u56DE\u843D\u5230\u5BBF\u4E3B\u6267\u884C`
             );
           }
           return { content: instaboxOutput };
@@ -11506,6 +11548,7 @@ export {
   loadCliDialogSummary,
   saveCliDialogSummary,
   loadCliDialogLastContextUsage,
+  resolveLocalInstaboxToolRoute,
   recordLocalAvailabilityForAgent,
   setCliAutoCompactionSummaryFallback,
   getCliAutoCompactionSummaryFallback,