nolo-cli 0.158.0-alpha.1 → 0.158.0

package/{chunk-ZBXIKCZ4.js → chunk-KQT46A27.js}

@@ -9,16 +9,19 @@ import {
   resolveRawAgentInput,
   resolveServerUrl,
   writeUsage
-} from "./chunk-2SOS7OSQ.js";
+} from "./chunk-3GCLICFW.js";
 import {
   getReadableCliDb
-} from "./chunk-P5QACQDK.js";
+} from "./chunk-62TBKWTV.js";
 import {
+  INSTABOX_RUN_CONFIG_ENV,
   createCliLocalRuntimeAdapter,
   detectCurrentMachineId,
+  hashInstaboxDeliveryManifest,
   isBuiltinNoloAgentRef,
   isCliProviderAgentConfig,
   isDockerRuntimeKey,
+  isInstaboxBillingPolicy,
   isLiveAgentRunObservation,
   isMachineBoundLocalhostCustomProvider,
   isSubtaskRun,
@@ -26,20 +29,21 @@ import {
   resolveAuthToken as resolveAuthToken2,
   resolveBoundMachineId,
   resolveFileWriteGateEnabled,
-  resolveLocalUserId
-} from "./chunk-S72LMV7T.js";
+  resolveLocalUserId,
+  validateInstaboxWorkspaceSelection
+} from "./chunk-RCZMREV2.js";
 import {
   clearCredentialAvailability,
-  readCredentialEntry,
+  readEffectiveCredentialEntry,
   recordCredentialProbe
-} from "./chunk-6MXDOUMH.js";
+} from "./chunk-R4BMKAR5.js";
 import {
   agentRunCardLabels,
   getCliLocale,
   t,
   toolLabel,
   toolLabelVariants
-} from "./chunk-2AB2HA4M.js";
+} from "./chunk-TDX2L4W2.js";
 import {
   _appendEntityBatch,
   _appendEvidenceBatch,
@@ -60,7 +64,7 @@ import {
 import {
   readDbRecord,
   resolveAgentRecordFromHybridStore
-} from "./chunk-ZEY4NJRE.js";
+} from "./chunk-5IKRTRRR.js";
 import {
   isLocalCliAgentKey
 } from "./chunk-NBTY7YJF.js";
@@ -75,14 +79,14 @@ import {
 } from "./chunk-BMQ2MJUK.js";
 import {
   resolveCliLocalRuntimeKeyCapability
-} from "./chunk-YTXQ2U2X.js";
+} from "./chunk-M3IBEHBT.js";
 import {
   isTransientFetchError
 } from "./chunk-KFHREHUQ.js";
 import {
   parseUiCard,
   uiCardFallback
-} from "./chunk-CDWHHLK5.js";
+} from "./chunk-Y7F4Q7YP.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -91,7 +95,7 @@ import {
   chooseMemoryOwners,
   loadMemoryCandidatesFromDb,
   resolveAgentMemoryPolicy
-} from "./chunk-G476FQ7Q.js";
+} from "./chunk-TSTLLGAC.js";
 import {
   API_REPORTED_COST_MULTIPLIER,
   estimateMessagesTokens,
@@ -99,22 +103,22 @@ import {
   resolveAgentContextWindow,
   resolveOccupancy,
   resolveOccupancyWindow
-} from "./chunk-WTFRBJT5.js";
+} from "./chunk-HSY7F4PP.js";
 import {
-  isOAuthApiKeyRef
-} from "./chunk-UKZX3NHN.js";
+  buildSkillDiscoveryContextLayer
+} from "./chunk-AU7AXHUL.js";
 import {
   parseExternalSkillMarkdown,
   parseSkillDocProtocol
-} from "./chunk-XETG4RIX.js";
+} from "./chunk-AETZ7AD6.js";
 import {
   LOCAL_AGENT_CONFIG_MISSING_CODE,
   LOCAL_TURN_ABORTED_CODE,
   readActionGate
-} from "./chunk-3TBHZPNG.js";
+} from "./chunk-TTVMMYVH.js";
 import {
   resolveAgentRuntimeConfigFromRecord
-} from "./chunk-G2WP7VPD.js";
+} from "./chunk-YKTAUOS7.js";
 import {
   createThinkParserState,
   flushThinkParser,
@@ -129,15 +133,18 @@ import {
 import {
   PROBE_INTERVAL_MS,
   QUOTA_ERROR_PATTERNS,
+  classifyFailureSubclass,
+  isCapacitySaturatedRateLimit,
   isQuotaExhaustedError,
-  isQuotaLimited403Body,
+  isQuotaExhaustedText,
   mergeAvailabilityDeadline,
   resolveCooldownGate,
   resolveCredentialKeyWithFallback
-} from "./chunk-3MZAGMYY.js";
+} from "./chunk-JLR5NWP2.js";
 import {
+  isOAuthApiKeyRef,
   normalizeUsage
-} from "./chunk-C6FY7HWI.js";
+} from "./chunk-HEC32F3G.js";
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
@@ -148,6 +155,13 @@ import {
   normalizeRuntimeToolPolicyOverride,
   resolveEffectiveRuntimeToolPolicy
 } from "./chunk-LIQJTQRN.js";
+import {
+  buildAgentsMdLayer,
+  buildMemoryOverlayLayer,
+  buildMemoryUseGuidanceLayer,
+  partitionScopedBlocks,
+  renderTurnContextBlocksWithScope
+} from "./chunk-VEA7H5FG.js";
 import {
   BUILTIN_NOLO_AGENT_KEY,
   BUILTIN_NOLO_AGENT_NAME,
@@ -161,9 +175,6 @@ import {
   createMemoryKey,
   ulid
 } from "./chunk-5EMSBTQ6.js";
-import {
-  isAntigravityOAuthAgent
-} from "./chunk-JGRPBIZZ.js";
 import {
   createRunActivityTracker,
   createShellApprovalChild,
@@ -173,10 +184,11 @@ import {
   recordRunResultHeaderMeta,
   resolveResultServerMeta,
   resolveRunQueuePath,
+  resolveRunsDir,
   serverOriginForDialog,
   settleRunTerminalAuthoritatively,
   spawnLocalBackgroundRun
-} from "./chunk-MM3662RS.js";
+} from "./chunk-LPO6AMQU.js";
 import {
   formatAgentListCard,
   formatFinishedRunCard,
@@ -187,26 +199,14 @@ import {
   formatStopRunCard,
   isAgentRunTerminalStatus
 } from "./chunk-PJNFNEJE.js";
-import {
-  resolveClientVersion
-} from "./chunk-SUKSWFLP.js";
-import {
-  findModelConfig
-} from "./chunk-TRW43TSC.js";
-import {
-  asTrimmedString
-} from "./chunk-3EUW3WEO.js";
 import {
   isCliAuthorityBrokerProtocolError,
   isCliAuthorityBrokerTimeoutError,
   isCliAuthorityBrokerUnavailableError
 } from "./chunk-EXAJ6DCR.js";
-import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
 import {
   getDefaultCliLocalRuntimeDb
-} from "./chunk-FY4SDK2E.js";
+} from "./chunk-FDLDMJTM.js";
 import {
   getLogger,
   normalizeError
@@ -214,13 +214,28 @@ import {
 import {
   resolveAuthToken
 } from "./chunk-A7GB5UGH.js";
-import {
-  asOptionalTrimmedString
-} from "./chunk-G3SUCT4W.js";
 import {
   readPipeText,
   spawnProcess
 } from "./chunk-Y6ROFCZO.js";
+import {
+  isAntigravityOAuthAgent
+} from "./chunk-SQX235S2.js";
+import {
+  resolveClientVersion
+} from "./chunk-PIG2IUVZ.js";
+import {
+  findModelConfig
+} from "./chunk-6EQD4AQL.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
+import {
+  asOptionalTrimmedString
+} from "./chunk-G3SUCT4W.js";
 import {
   CLIENT_VERSION_TOO_OLD_CODE,
   NOLO_CLIENT_VERSION_HEADER,
@@ -229,16 +244,148 @@ import {
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
-import {
-  buildSkillDiscoveryContextLayer
-} from "./chunk-AU7AXHUL.js";
-import {
-  buildAgentsMdLayer,
-  buildMemoryOverlayLayer,
-  buildMemoryUseGuidanceLayer,
-  partitionScopedBlocks,
-  renderTurnContextBlocksWithScope
-} from "./chunk-VEA7H5FG.js";
+
+// packages/cli/client/instaboxRunConfigWrite.ts
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, normalize, resolve } from "node:path";
+var InstaboxRunConfigWriteError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(`instabox_run_config_write:${code}: ${message}`);
+    this.name = "InstaboxRunConfigWriteError";
+    this.code = `instabox_run_config_write:${code}`;
+  }
+};
+var fail = (code, msg) => {
+  throw new InstaboxRunConfigWriteError(code, msg);
+};
+function writeInstaboxRunConfig(options) {
+  const { workspaceMode, artifactDir, manifestPath, allowRemoteRelease } = options;
+  if (workspaceMode !== "empty" && workspaceMode !== "snapshot") {
+    fail("invalid_workspace_mode", 'workspaceMode \u5FC5\u987B\u662F "empty" \u6216 "snapshot"');
+  }
+  const trimmedArtifactDir = artifactDir?.trim();
+  if (!trimmedArtifactDir) {
+    fail("missing_artifact_dir", "artifactDir \u5FC5\u987B\u662F\u975E\u7A7A\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u672A\u914D\u7F6E\u6216\u9ED8\u8BA4\u5747\u88AB\u62D2\u7EDD");
+  }
+  if (!isAbsolute(trimmedArtifactDir) || trimmedArtifactDir.includes("\0") || trimmedArtifactDir.split("/").includes("..")) {
+    fail("invalid_artifact_dir", `artifactDir \u5FC5\u987B\u4E3A\u5408\u6CD5\u7684\u7EDD\u5BF9\u8DEF\u5F84\u4E14\u4E0D\u80FD\u5305\u542B .. \u6216\u7A7A\u5B57\u7B26: "${trimmedArtifactDir}"`);
+  }
+  const approvalId = `appr-${randomUUID()}`;
+  const bindingId = `bind-${randomUUID()}`;
+  const freeCreateEvidenceId = `fce-${randomUUID()}`;
+  const workspaceAuthorizationId = `wauth-${randomUUID()}`;
+  const recoverySupportId = `rcv-${randomUUID()}`;
+  let manifest = null;
+  let manifestSha256 = null;
+  let allowedPaths = [];
+  if (workspaceMode === "snapshot") {
+    const rawPath = manifestPath ? manifestPath.trim() : "";
+    if (!rawPath) {
+      fail("missing_manifest_path", 'workspaceMode \u4E3A "snapshot" \u65F6\u5FC5\u987B\u63D0\u4F9B manifest \u6587\u4EF6\u8DEF\u5F84');
+    }
+    const resolvedManifestPath = resolve(rawPath);
+    let rawText = "";
+    try {
+      const reader = options.readTextFile ?? ((p) => readFileSync(p, "utf8"));
+      rawText = reader(resolvedManifestPath);
+    } catch (err) {
+      fail(
+        "manifest_read_failed",
+        `\u8BFB\u53D6 manifest \u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    let parsedManifest;
+    try {
+      parsedManifest = JSON.parse(rawText);
+    } catch (err) {
+      fail(
+        "invalid_manifest_json",
+        `manifest \u6587\u4EF6 JSON \u89E3\u6790\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    try {
+      manifestSha256 = hashInstaboxDeliveryManifest(parsedManifest);
+      validateInstaboxWorkspaceSelection({
+        workspaceMode: "approved-snapshot",
+        manifest: parsedManifest,
+        approval: {
+          id: approvalId,
+          manifestSha256
+        }
+      });
+    } catch (err) {
+      fail(
+        "invalid_manifest_selection",
+        `manifest \u6821\u9A8C\u672A\u901A\u8FC7: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    manifest = parsedManifest;
+    allowedPaths = parsedManifest.files.map((f) => f.path);
+  } else {
+    if (manifestPath && manifestPath.trim()) {
+      fail("unexpected_manifest", 'workspaceMode \u4E3A "empty" \u65F6\u4E0D\u5F97\u63D0\u4F9B manifest');
+    }
+  }
+  const rawBillingPolicy = options.billingPolicy ?? (options.allowPaid ? "allow-paid" : "free-only");
+  if (!isInstaboxBillingPolicy(rawBillingPolicy)) {
+    fail("invalid_billing_policy", `billingPolicy \u5FC5\u987B\u4E3A "free-only" \u6216 "allow-paid"\uFF0C\u6536\u5230 "${rawBillingPolicy}"`);
+  }
+  const billingPolicy = rawBillingPolicy;
+  const env = options.env ?? process.env;
+  const isPaid = options.isPaidAccount === true || options.account?.isPaid === true || options.account?.kind === "paid" || options.account?.accountKind === "paid" || env?.INSTABOX_ACCOUNT_KIND === "paid" || env?.INSTABOX_ACCOUNT_TYPE === "paid" || env?.INSTABOX_PAID_ACCOUNT === "true" || env?.INSTABOX_PAID_ACCOUNT === "1";
+  if (isPaid && billingPolicy !== "allow-paid") {
+    fail("paid_account_disallowed", "\u4ED8\u8D39 Instabox \u8D26\u53F7\u9700\u663E\u5F0F --instabox-allow-paid");
+  }
+  const config = {
+    bindingId,
+    freeCreateEvidenceId,
+    workspaceAuthorizationId,
+    recoverySupportId,
+    workspaceMode: workspaceMode === "snapshot" ? "approved-snapshot" : "empty",
+    billingPolicy,
+    approvalId,
+    artifactRoot: trimmedArtifactDir,
+    allowRemoteRelease: Boolean(allowRemoteRelease),
+    allowedPaths
+  };
+  if (workspaceMode === "snapshot" && manifest && manifestSha256) {
+    config.manifest = manifest;
+    config.manifestSha256 = manifestSha256;
+  }
+  const runsDir = options.runsDir ?? resolveRunsDir(env);
+  const normalizedRunsDir = normalize(resolve(runsDir));
+  try {
+    mkdirSync(normalizedRunsDir, { recursive: true, mode: 448 });
+  } catch (err) {
+    fail("mkdir_failed", `\u521B\u5EFA runs \u76EE\u5F55\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const fileName = `instabox-run-${randomUUID()}.json`;
+  const targetPath = join(normalizedRunsDir, fileName);
+  try {
+    writeFileSync(targetPath, JSON.stringify(config, null, 2), {
+      flag: "wx",
+      mode: 384
+    });
+  } catch (err) {
+    fail("file_write_failed", `\u72EC\u5360\u521B\u5EFA\u53D7\u63A7\u914D\u7F6E\u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const stats = lstatSync(targetPath);
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+      fail("symlink_rejected", `\u914D\u7F6E\u6587\u4EF6\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5\u6216\u975E\u5E38\u89C4\u6587\u4EF6: ${targetPath}`);
+    }
+  } catch (err) {
+    if (err instanceof InstaboxRunConfigWriteError) throw err;
+    fail("file_stat_failed", `\u68C0\u9A8C\u914D\u7F6E\u6587\u4EF6\u72B6\u6001\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  process.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  if (options.env) {
+    options.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  }
+  return { configPath: targetPath, config };
+}
 
 // packages/agent-runtime/modelLayerOverride.ts
 var MODEL_LAYER_KEYS = [
@@ -11140,6 +11287,51 @@ function findCollapsedPasteSpanAt(buffer, pos, opts = {}) {
   return null;
 }
 
+// packages/cli/idleHeapRelease.ts
+var IDLE_HEAP_RELEASE_DELAY_MS = 2e3;
+function releaseHeapPages(options = {}) {
+  const env = options.env ?? process.env;
+  if (env.NOLO_TUI_IDLE_HEAP_RELEASE === "0") return;
+  const bun = "bun" in options ? options.bun : globalThis.Bun;
+  if (typeof bun?.gc !== "function" || typeof bun?.shrink !== "function") return;
+  try {
+    bun.gc(true);
+    bun.shrink();
+  } catch {
+  }
+}
+function createIdleHeapReleaser(options = {}) {
+  const env = options.env ?? process.env;
+  const bun = "bun" in options ? options.bun : globalThis.Bun;
+  const disabled = env.NOLO_TUI_IDLE_HEAP_RELEASE === "0" || typeof bun?.gc !== "function" || typeof bun?.shrink !== "function";
+  if (disabled) return { schedule() {
+  }, cancel() {
+  } };
+  const delayMs = options.delayMs ?? IDLE_HEAP_RELEASE_DELAY_MS;
+  const setTimer = options.setTimer ?? ((fn, ms) => {
+    const handle = setTimeout(fn, ms);
+    handle.unref?.();
+    return handle;
+  });
+  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  let pending = null;
+  const release = () => {
+    pending = null;
+    releaseHeapPages({ env, bun });
+  };
+  return {
+    schedule() {
+      if (pending !== null) clearTimer(pending);
+      pending = setTimer(release, delayMs);
+    },
+    cancel() {
+      if (pending === null) return;
+      clearTimer(pending);
+      pending = null;
+    }
+  };
+}
+
 // packages/cli/client/agentRun.ts
 import { ulid as ulid2 } from "ulid";
 
@@ -11181,7 +11373,7 @@ function isBalanceExhaustedError(error) {
 
 // packages/cli/client/agentRun.ts
 async function loadRunLocalAgentTurn() {
-  const { runLocalAgentTurn } = await import("./agentRuntimeLocal-NPJS2QDP.js");
+  const { runLocalAgentTurn } = await import("./agentRuntimeLocal-QL4SHNJJ.js");
   return runLocalAgentTurn;
 }
 var stripDebugNoise = (s) => s.replace(/\s*raw="[\s\S]*"/g, "").replace(/\s*raw=\S+/g, "").replace(/\s*headers=\[[^\]]*\]/g, "").replace(/\s*headers=\S+/g, "").trim();
@@ -11453,7 +11645,7 @@ function looksLikeRateLimitedText(message) {
 var AUTH_TEXT_SIGNAL_RE = /\b401\b|unauthori[sz]ed|invalid[_\s-]?(?:api[_\s-]?key|token|credential)s?|(?:api[_\s-]?key|token|credential)s?[_\s-](?:invalid|expired|rejected|missing|not[_\s-]?found)|authentication[_\s-]?(?:error|failed|required)/i;
 var QUOTA_EXHAUSTED_EXTRA_RE = /insufficient[_\s-]?(?:quota|balance|credits?)|余额不足|额度已?用尽/i;
 function looksLikeQuotaExhaustedText(message) {
-  return isQuotaLimited403Body(message) || QUOTA_EXHAUSTED_EXTRA_RE.test(message);
+  return isQuotaExhaustedText(message) || QUOTA_EXHAUSTED_EXTRA_RE.test(message);
 }
 var BARE_UPSTREAM_5XX_RE = /\bHTTP[:\s]+(5\d\d)\b|\bstatus[:\s=]+(5\d\d)\b|\breturned error\s+(5\d\d)\b/i;
 function classifyLocalRunError(message) {
@@ -11700,7 +11892,7 @@ function formatRateLimitResetHint(hint, locale) {
   return parts.join(" ");
 }
 function buildRateLimitFailure(ctx) {
-  const headlineKey = ctx.quotaExhausted ? "localRunRateLimitQuota" : "localRunRateLimitThrottled";
+  const headlineKey = isCapacitySaturatedRateLimit(ctx.message, Date.now()) ? "localRunRateLimitCapacity" : ctx.quotaExhausted ? "localRunRateLimitQuota" : "localRunRateLimitThrottled";
   const lines = [
     t(
       headlineKey,
@@ -12038,8 +12230,15 @@ async function runHttpAgentTurn(options, authToken) {
     if (options.abortSignal?.aborted) {
       return { exitCode: 0, streamInterrupted: true };
     }
+    const failureSubclass = classifyFailureSubclass({
+      message: toErrorMessage(error),
+      body: error
+    });
     options.output.write(buildTransportErrorHint(options.serverUrl, error));
-    return { exitCode: 1 };
+    return {
+      exitCode: 1,
+      ...failureSubclass && failureSubclass !== "unknown" ? { failureSubclass } : {}
+    };
   }
   if (shouldStream && isGatewayHttpStatus(res.status)) {
     const failureMeta = await readAgentRunFailureMetadata(res);
@@ -12054,8 +12253,15 @@ async function runHttpAgentTurn(options, authToken) {
         res = await postAgentRun(false);
       } catch (error) {
         spinner.stop();
+        const failureSubclass = classifyFailureSubclass({
+          message: toErrorMessage(error),
+          body: error
+        });
         options.output.write(buildTransportErrorHint(options.serverUrl, error));
-        return { exitCode: 1 };
+        return {
+          exitCode: 1,
+          ...failureSubclass && failureSubclass !== "unknown" ? { failureSubclass } : {}
+        };
       }
     }
   }
@@ -12103,7 +12309,16 @@ async function runHttpAgentTurn(options, authToken) {
 `
       );
     }
-    return dialogIdText ? { exitCode: 1, dialogId: dialogIdText } : { exitCode: 1 };
+    const failureSubclass = classifyFailureSubclass({
+      status: res.status,
+      message: `${errorText || messageText} ${reasonText || ""} ${codeText || ""}`.trim(),
+      body: data
+    });
+    return {
+      exitCode: 1,
+      ...dialogIdText ? { dialogId: dialogIdText } : {},
+      ...failureSubclass && failureSubclass !== "unknown" ? { failureSubclass } : {}
+    };
   }
   const content = formatAssistantResponseForCli(
     String(data?.content ?? data?.message ?? "")
@@ -12185,6 +12400,24 @@ async function runLocalAgentTurnForCli(options, settings) {
   }
 }
 async function runLocalAgentTurnForCliWithAdapter(options, settings, resolvedBaseAdapter) {
+  try {
+    return await executeLocalAgentTurnForCliWithAdapter(
+      options,
+      settings,
+      resolvedBaseAdapter
+    );
+  } finally {
+    try {
+      if (typeof options.releaseHeapPages === "function") {
+        options.releaseHeapPages();
+      } else {
+        releaseHeapPages({ env: options.env });
+      }
+    } catch {
+    }
+  }
+}
+async function executeLocalAgentTurnForCliWithAdapter(options, settings, resolvedBaseAdapter) {
   const baseAdapter = (() => {
     let adapter2 = resolvedBaseAdapter && options.modelOverride ? wrapLoadAgentConfigWithModelOverride(
       resolvedBaseAdapter,
@@ -12396,6 +12629,10 @@ async function runLocalAgentTurnForCliWithAdapter(options, settings, resolvedBas
     return {
       exitCode: 1,
       localError: error,
+      failureSubclass: classifyFailureSubclass({
+        message: toErrorMessage(error),
+        body: error
+      }),
       ...savedDialogId ? { dialogId: savedDialogId } : {},
       ...abortedTurnCredits !== void 0 ? { turnCredits: abortedTurnCredits } : {},
       ...abortedUsageRecords?.length ? { usageRecords: abortedUsageRecords } : {}
@@ -12414,7 +12651,9 @@ async function checkLocalAvailabilityBeforeHttpDispatch(options) {
   }
   if (!config || typeof config !== "object") return null;
   const baseRecord = config.rawRecord ?? config;
-  let credentialKey = resolveCredentialKeyWithFallback(baseRecord);
+  let credentialKey = resolveCredentialKeyWithFallback(
+    baseRecord.agentKey || baseRecord.key ? baseRecord : { ...baseRecord, agentKey: options.agentKey }
+  );
   if (credentialKey && resolveOAuthChannelOwnerSkip(
     config,
     options
@@ -12428,19 +12667,30 @@ async function checkLocalAvailabilityBeforeHttpDispatch(options) {
   }
   const env = options.env;
   const now = Date.now();
-  const entry = credentialKey ? await readCredentialEntry(credentialKey, env, now).catch(() => void 0) : void 0;
+  let entry;
+  let matchedKey;
+  if (credentialKey) {
+    const effective = await readEffectiveCredentialEntry(credentialKey, env, now).catch(() => void 0);
+    if (effective) {
+      entry = effective;
+      matchedKey = effective.matchedKey;
+    }
+  }
   const entryAt = entry?.nextAvailableAt;
   const effectiveNextAvailableAt = typeof entryAt === "number" ? mergeAvailabilityDeadline(agentLevelNextAvailableAt, entryAt) : agentLevelNextAvailableAt;
-  if (typeof effectiveNextAvailableAt !== "number") return { credentialKey };
+  const activeKey = matchedKey || credentialKey;
+  if (typeof effectiveNextAvailableAt !== "number") {
+    return { credentialKey: credentialKey || activeKey, matchedKey };
+  }
   const gateDecision = resolveCooldownGate(
     { nextAvailableAt: effectiveNextAvailableAt, lastProbeAt: entry?.lastProbeAt },
     now
   );
-  if (gateDecision === "probe" && credentialKey) {
-    await recordCredentialProbe(credentialKey, env, now).catch(() => void 0);
-    return { credentialKey };
+  if (gateDecision === "probe" && activeKey) {
+    await recordCredentialProbe(activeKey, env, now).catch(() => void 0);
+    return { credentialKey: credentialKey || activeKey, matchedKey };
   }
-  if (gateDecision !== "blocked") return { credentialKey };
+  if (gateDecision !== "blocked") return { credentialKey: credentialKey || activeKey, matchedKey };
   options.output.write(
     `${t(
       "agentCooldownBlocked",
@@ -12451,7 +12701,7 @@ async function checkLocalAvailabilityBeforeHttpDispatch(options) {
     )}
 `
   );
-  return { exitCode: 1 };
+  return { exitCode: 1, failureSubclass: "rate_limit" };
 }
 function foldLocalResultForTui(localResult) {
   const folded = {
@@ -12477,7 +12727,8 @@ function foldLocalResultForTui(localResult) {
     // 上 finalText 永远到不了结算点 → agentRunCommand 的 settleRunTerminal-
     // Authoritatively 拿不到 lastAssistantText → `.result.md` 不写、status 无
     // resultFile，编排者只能去啃带 ANSI 的 .log（同坑位历史：turnCredits）。
-    ...localResult.finalText ? { finalText: localResult.finalText } : {}
+    ...localResult.finalText ? { finalText: localResult.finalText } : {},
+    ...localResult.failureSubclass ? { failureSubclass: localResult.failureSubclass } : {}
   };
   const headerMeta = getRunResultHeaderMeta(localResult);
   recordRunResultHeaderMeta(folded, headerMeta);
@@ -12552,9 +12803,14 @@ async function runAgentTurn(options) {
         }
       }
       const localErrorMessage = localResult.localError ? toErrorMessage(localResult.localError) : "local runtime failed";
+      const failureSubclass = localResult.failureSubclass ?? classifyFailureSubclass({
+        message: localErrorMessage,
+        body: localResult.localError
+      });
       options.output.write(describeLocalRunFailure(localErrorMessage, localResult.localError));
       return {
         exitCode: 1,
+        failureSubclass,
         ...localResult.dialogId ? { dialogId: localResult.dialogId } : {},
         // Keep localError so TUI can show balance/quota/dialog-preserved hints
         // instead of only the raw auto-runtime line.
@@ -12574,12 +12830,16 @@ async function runAgentTurn(options) {
   }
   const localAvailability = await checkLocalAvailabilityBeforeHttpDispatch(options);
   if (localAvailability?.exitCode) {
-    return { exitCode: localAvailability.exitCode };
+    return {
+      exitCode: localAvailability.exitCode,
+      failureSubclass: localAvailability.failureSubclass ?? "rate_limit"
+    };
   }
   const httpResult = await runHttpAgentTurn(options, authToken);
-  if (httpResult.exitCode === 0 && !httpResult.streamInterrupted && localAvailability?.credentialKey) {
+  if (httpResult.exitCode === 0 && !httpResult.streamInterrupted && (localAvailability?.credentialKey || localAvailability?.matchedKey)) {
+    const keyToClear = localAvailability.credentialKey || localAvailability.matchedKey;
     await clearCredentialAvailability(
-      localAvailability.credentialKey,
+      keyToClear,
       options.env
     ).catch(() => void 0);
   }
@@ -12667,7 +12927,7 @@ import * as nodeFs from "node:fs";
 var CLI_AUTO_ROUTE_AGENT_KEY = BUILTIN_NOLO_AGENT_KEY;
 
 // packages/agent-runtime/hostEnvironment.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import os from "node:os";
 function parseLinuxOsRelease(content) {
   let prettyName;
@@ -12706,9 +12966,9 @@ function probeHostEnvironment(options) {
     if (osReleaseText === void 0) {
       try {
         if (existsSync("/etc/os-release")) {
-          osReleaseText = readFileSync("/etc/os-release", "utf8");
+          osReleaseText = readFileSync2("/etc/os-release", "utf8");
         } else if (existsSync("/usr/lib/os-release")) {
-          osReleaseText = readFileSync("/usr/lib/os-release", "utf8");
+          osReleaseText = readFileSync2("/usr/lib/os-release", "utf8");
         }
       } catch {
       }
@@ -12774,16 +13034,16 @@ function buildHostEnvironmentLayer(options) {
 }
 
 // packages/agent-runtime/agentsMd.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { join } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { join as join2 } from "node:path";
 var AGENTS_MD_MAX_BYTES = 8192;
 var AGENTS_MD_CANDIDATES = ["AGENTS.md", "CLAUDE.md"];
 function readAgentsMdLayerFromDisk(cwd) {
   for (const name of AGENTS_MD_CANDIDATES) {
-    const filePath = join(cwd, name);
+    const filePath = join2(cwd, name);
     if (!existsSync2(filePath)) continue;
     try {
-      let content = readFileSync2(filePath, "utf8").trim();
+      let content = readFileSync3(filePath, "utf8").trim();
       if (!content) continue;
       if (Buffer.byteLength(content, "utf8") > AGENTS_MD_MAX_BYTES) {
         content = Buffer.from(content, "utf8").subarray(0, AGENTS_MD_MAX_BYTES).toString("utf8") + "\n\n<!-- AGENTS.md truncated -->";
@@ -12853,17 +13113,17 @@ function runDoDCommands(commands, cwd, deps = {}) {
 }
 
 // packages/cli/agentRunPrompts.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "node:fs";
-import { dirname, extname, isAbsolute, join as join2, relative as relativePath, resolve, sep } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
+import { dirname, extname, isAbsolute as isAbsolute2, join as join3, relative as relativePath, resolve as resolve2, sep } from "node:path";
 function workflowRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
-  return resolve(cwd, "docs", "workflows", `${fileName}.md`);
+  return resolve2(cwd, "docs", "workflows", `${fileName}.md`);
 }
 var SKILL_SEARCH_DIRS = [
   ".agents/skills"
@@ -12872,22 +13132,22 @@ function skillRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
   for (const dir of SKILL_SEARCH_DIRS) {
-    const skillMdPath = resolve(cwd, dir, fileName, "SKILL.md");
+    const skillMdPath = resolve2(cwd, dir, fileName, "SKILL.md");
     if (existsSync3(skillMdPath)) return skillMdPath;
   }
-  return resolve(cwd, ".agents", "skills", fileName, "SKILL.md");
+  return resolve2(cwd, ".agents", "skills", fileName, "SKILL.md");
 }
 async function resolveWorkflowReference(ref, cwd = process.cwd()) {
   const path2 = workflowRefToCandidatePath(cwd, ref);
   if (!path2 || !existsSync3(path2)) {
     throw new Error(`Workflow reference not found: ${ref}`);
   }
-  const markdown = readFileSync3(path2, "utf8");
+  const markdown = readFileSync4(path2, "utf8");
   const parsed = parseSkillDocProtocol(markdown);
   return {
     ref,
@@ -12897,15 +13157,15 @@ async function resolveWorkflowReference(ref, cwd = process.cwd()) {
 }
 function inlineRelativeRefs(body, skillDir) {
   const refPattern = /\[([^\]]+)\]\((\.\/[^)]+|[^)]+\/[^)]+)\)/g;
-  const normalizedSkillDir = resolve(skillDir) + sep;
+  const normalizedSkillDir = resolve2(skillDir) + sep;
   return body.replace(refPattern, (match, label, relPath) => {
     const cleaned = relPath.trim();
     if (!cleaned.startsWith("./") && !cleaned.startsWith("../")) return match;
-    const absPath = resolve(skillDir, cleaned);
+    const absPath = resolve2(skillDir, cleaned);
     const relative = relativePath(normalizedSkillDir, absPath);
-    if (relative.startsWith("..") || isAbsolute(relative)) return match;
+    if (relative.startsWith("..") || isAbsolute2(relative)) return match;
     if (!existsSync3(absPath) || !absPath.endsWith(".md")) return match;
-    const refContent = readFileSync3(absPath, "utf8");
+    const refContent = readFileSync4(absPath, "utf8");
     return `
 
 ### ${label}
@@ -12916,7 +13176,7 @@ ${refContent}
   });
 }
 function listSkillScripts(skillDir) {
-  const scriptsDir = join2(skillDir, "scripts");
+  const scriptsDir = join3(skillDir, "scripts");
   if (!existsSync3(scriptsDir) || !statSync2(scriptsDir).isDirectory()) return null;
   const entries = readdirSync(scriptsDir).filter((e) => !e.startsWith("."));
   if (entries.length === 0) return null;
@@ -12947,7 +13207,7 @@ async function resolveSkillReference(ref, options = {}) {
     if (!path2 || !existsSync3(path2)) {
       throw new Error(`Skill reference not found: ${ref}`);
     }
-    markdown = readFileSync3(path2, "utf8");
+    markdown = readFileSync4(path2, "utf8");
     filePath = path2;
     skillDir = dirname(path2);
   }
@@ -13051,9 +13311,9 @@ function prependSubjectDialogMarker(message, subjectDialogKey) {
 }
 function normalizeCliImageInput(input) {
   if (/^(https?:|data:|file:)/i.test(input)) return input;
-  const absolutePath = resolve(input);
+  const absolutePath = resolve2(input);
   if (!existsSync3(absolutePath)) return input;
-  const base64 = readFileSync3(absolutePath).toString("base64");
+  const base64 = readFileSync4(absolutePath).toString("base64");
   return `data:${imageMimeTypeForPath(absolutePath)};base64,${base64}`;
 }
 function imageMimeTypeForPath(path2) {
@@ -15597,6 +15857,22 @@ async function runAgentRunCommand(args, deps) {
   if (!localRuntimeCwd && (parsed.runtimeMode === "local" || hostRuntimeLocal)) {
     localRuntimeCwd = process.cwd();
   }
+  if (parsed.runtimeKey === "instabox") {
+    try {
+      writeInstaboxRunConfig({
+        workspaceMode: parsed.instaboxWorkspace,
+        artifactDir: parsed.instaboxArtifactDir,
+        manifestPath: parsed.instaboxManifestPath,
+        allowRemoteRelease: parsed.instaboxAllowRemoteRelease,
+        allowPaid: parsed.instaboxAllowPaid,
+        env
+      });
+    } catch (err) {
+      output.write(`[nolo] instabox \u914D\u7F6E\u751F\u6210\u5931\u8D25: ${toErrorMessage(err)}
+`);
+      return 1;
+    }
+  }
   const runEnv = buildLocalRunEnv({
     env,
     allowShell: parsed.allowShell
@@ -16016,6 +16292,7 @@ export {
   computeBaselineContextTokens,
   resolveContextUsage,
   renderTokenStatus,
+  createIdleHeapReleaser,
   COLLAPSED_PASTE_PLACEHOLDER_RE,
   shouldCollapsePaste,
   createCollapsedPasteStore,