nolo-cli 0.163.0-alpha.1 → 0.164.0-alpha.1

package/{chunk-PNACBSRF.js → chunk-KTFQFGMZ.js}

@@ -9,16 +9,19 @@ import {
   resolveRawAgentInput,
   resolveServerUrl,
   writeUsage
-} from "./chunk-U5U4WAFS.js";
+} from "./chunk-S53PIA3G.js";
 import {
   getReadableCliDb
 } from "./chunk-62TBKWTV.js";
 import {
+  INSTABOX_RUN_CONFIG_ENV,
   createCliLocalRuntimeAdapter,
   detectCurrentMachineId,
+  hashInstaboxDeliveryManifest,
   isBuiltinNoloAgentRef,
   isCliProviderAgentConfig,
   isDockerRuntimeKey,
+  isInstaboxBillingPolicy,
   isLiveAgentRunObservation,
   isMachineBoundLocalhostCustomProvider,
   isSubtaskRun,
@@ -26,8 +29,9 @@ import {
   resolveAuthToken as resolveAuthToken2,
   resolveBoundMachineId,
   resolveFileWriteGateEnabled,
-  resolveLocalUserId
-} from "./chunk-GXZZOTDM.js";
+  resolveLocalUserId,
+  validateInstaboxWorkspaceSelection
+} from "./chunk-WBTXES5L.js";
 import {
   clearCredentialAvailability,
   readCredentialEntry,
@@ -75,14 +79,14 @@ import {
 } from "./chunk-BMQ2MJUK.js";
 import {
   resolveCliLocalRuntimeKeyCapability
-} from "./chunk-QFL42TMV.js";
+} from "./chunk-ZEOGFBR3.js";
 import {
   isTransientFetchError
 } from "./chunk-KFHREHUQ.js";
 import {
   parseUiCard,
   uiCardFallback
-} from "./chunk-6QIBWOPT.js";
+} from "./chunk-HXFIFEBA.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -91,7 +95,7 @@ import {
   chooseMemoryOwners,
   loadMemoryCandidatesFromDb,
   resolveAgentMemoryPolicy
-} from "./chunk-4FDDVVCE.js";
+} from "./chunk-WBRBIRDG.js";
 import {
   API_REPORTED_COST_MULTIPLIER,
   estimateMessagesTokens,
@@ -99,7 +103,7 @@ import {
   resolveAgentContextWindow,
   resolveOccupancy,
   resolveOccupancyWindow
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-3WTD7IIQ.js";
 import {
   buildSkillDiscoveryContextLayer
 } from "./chunk-AU7AXHUL.js";
@@ -178,10 +182,11 @@ import {
   recordRunResultHeaderMeta,
   resolveResultServerMeta,
   resolveRunQueuePath,
+  resolveRunsDir,
   serverOriginForDialog,
   settleRunTerminalAuthoritatively,
   spawnLocalBackgroundRun
-} from "./chunk-SNAWGDXT.js";
+} from "./chunk-WJJL7RMW.js";
 import {
   formatAgentListCard,
   formatFinishedRunCard,
@@ -238,6 +243,148 @@ import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
 
+// packages/cli/client/instaboxRunConfigWrite.ts
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, normalize, resolve } from "node:path";
+var InstaboxRunConfigWriteError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(`instabox_run_config_write:${code}: ${message}`);
+    this.name = "InstaboxRunConfigWriteError";
+    this.code = `instabox_run_config_write:${code}`;
+  }
+};
+var fail = (code, msg) => {
+  throw new InstaboxRunConfigWriteError(code, msg);
+};
+function writeInstaboxRunConfig(options) {
+  const { workspaceMode, artifactDir, manifestPath, allowRemoteRelease } = options;
+  if (workspaceMode !== "empty" && workspaceMode !== "snapshot") {
+    fail("invalid_workspace_mode", 'workspaceMode \u5FC5\u987B\u662F "empty" \u6216 "snapshot"');
+  }
+  const trimmedArtifactDir = artifactDir?.trim();
+  if (!trimmedArtifactDir) {
+    fail("missing_artifact_dir", "artifactDir \u5FC5\u987B\u662F\u975E\u7A7A\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u672A\u914D\u7F6E\u6216\u9ED8\u8BA4\u5747\u88AB\u62D2\u7EDD");
+  }
+  if (!isAbsolute(trimmedArtifactDir) || trimmedArtifactDir.includes("\0") || trimmedArtifactDir.split("/").includes("..")) {
+    fail("invalid_artifact_dir", `artifactDir \u5FC5\u987B\u4E3A\u5408\u6CD5\u7684\u7EDD\u5BF9\u8DEF\u5F84\u4E14\u4E0D\u80FD\u5305\u542B .. \u6216\u7A7A\u5B57\u7B26: "${trimmedArtifactDir}"`);
+  }
+  const approvalId = `appr-${randomUUID()}`;
+  const bindingId = `bind-${randomUUID()}`;
+  const freeCreateEvidenceId = `fce-${randomUUID()}`;
+  const workspaceAuthorizationId = `wauth-${randomUUID()}`;
+  const recoverySupportId = `rcv-${randomUUID()}`;
+  let manifest = null;
+  let manifestSha256 = null;
+  let allowedPaths = [];
+  if (workspaceMode === "snapshot") {
+    const rawPath = manifestPath ? manifestPath.trim() : "";
+    if (!rawPath) {
+      fail("missing_manifest_path", 'workspaceMode \u4E3A "snapshot" \u65F6\u5FC5\u987B\u63D0\u4F9B manifest \u6587\u4EF6\u8DEF\u5F84');
+    }
+    const resolvedManifestPath = resolve(rawPath);
+    let rawText = "";
+    try {
+      const reader = options.readTextFile ?? ((p) => readFileSync(p, "utf8"));
+      rawText = reader(resolvedManifestPath);
+    } catch (err) {
+      fail(
+        "manifest_read_failed",
+        `\u8BFB\u53D6 manifest \u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    let parsedManifest;
+    try {
+      parsedManifest = JSON.parse(rawText);
+    } catch (err) {
+      fail(
+        "invalid_manifest_json",
+        `manifest \u6587\u4EF6 JSON \u89E3\u6790\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    try {
+      manifestSha256 = hashInstaboxDeliveryManifest(parsedManifest);
+      validateInstaboxWorkspaceSelection({
+        workspaceMode: "approved-snapshot",
+        manifest: parsedManifest,
+        approval: {
+          id: approvalId,
+          manifestSha256
+        }
+      });
+    } catch (err) {
+      fail(
+        "invalid_manifest_selection",
+        `manifest \u6821\u9A8C\u672A\u901A\u8FC7: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    manifest = parsedManifest;
+    allowedPaths = parsedManifest.files.map((f) => f.path);
+  } else {
+    if (manifestPath && manifestPath.trim()) {
+      fail("unexpected_manifest", 'workspaceMode \u4E3A "empty" \u65F6\u4E0D\u5F97\u63D0\u4F9B manifest');
+    }
+  }
+  const rawBillingPolicy = options.billingPolicy ?? (options.allowPaid ? "allow-paid" : "free-only");
+  if (!isInstaboxBillingPolicy(rawBillingPolicy)) {
+    fail("invalid_billing_policy", `billingPolicy \u5FC5\u987B\u4E3A "free-only" \u6216 "allow-paid"\uFF0C\u6536\u5230 "${rawBillingPolicy}"`);
+  }
+  const billingPolicy = rawBillingPolicy;
+  const env = options.env ?? process.env;
+  const isPaid = options.isPaidAccount === true || options.account?.isPaid === true || options.account?.kind === "paid" || options.account?.accountKind === "paid" || env?.INSTABOX_ACCOUNT_KIND === "paid" || env?.INSTABOX_ACCOUNT_TYPE === "paid" || env?.INSTABOX_PAID_ACCOUNT === "true" || env?.INSTABOX_PAID_ACCOUNT === "1";
+  if (isPaid && billingPolicy !== "allow-paid") {
+    fail("paid_account_disallowed", "\u4ED8\u8D39 Instabox \u8D26\u53F7\u9700\u663E\u5F0F --instabox-allow-paid");
+  }
+  const config = {
+    bindingId,
+    freeCreateEvidenceId,
+    workspaceAuthorizationId,
+    recoverySupportId,
+    workspaceMode: workspaceMode === "snapshot" ? "approved-snapshot" : "empty",
+    billingPolicy,
+    approvalId,
+    artifactRoot: trimmedArtifactDir,
+    allowRemoteRelease: Boolean(allowRemoteRelease),
+    allowedPaths
+  };
+  if (workspaceMode === "snapshot" && manifest && manifestSha256) {
+    config.manifest = manifest;
+    config.manifestSha256 = manifestSha256;
+  }
+  const runsDir = options.runsDir ?? resolveRunsDir(env);
+  const normalizedRunsDir = normalize(resolve(runsDir));
+  try {
+    mkdirSync(normalizedRunsDir, { recursive: true, mode: 448 });
+  } catch (err) {
+    fail("mkdir_failed", `\u521B\u5EFA runs \u76EE\u5F55\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const fileName = `instabox-run-${randomUUID()}.json`;
+  const targetPath = join(normalizedRunsDir, fileName);
+  try {
+    writeFileSync(targetPath, JSON.stringify(config, null, 2), {
+      flag: "wx",
+      mode: 384
+    });
+  } catch (err) {
+    fail("file_write_failed", `\u72EC\u5360\u521B\u5EFA\u53D7\u63A7\u914D\u7F6E\u6587\u4EF6\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const stats = lstatSync(targetPath);
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+      fail("symlink_rejected", `\u914D\u7F6E\u6587\u4EF6\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5\u6216\u975E\u5E38\u89C4\u6587\u4EF6: ${targetPath}`);
+    }
+  } catch (err) {
+    if (err instanceof InstaboxRunConfigWriteError) throw err;
+    fail("file_stat_failed", `\u68C0\u9A8C\u914D\u7F6E\u6587\u4EF6\u72B6\u6001\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  process.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  if (options.env) {
+    options.env[INSTABOX_RUN_CONFIG_ENV] = targetPath;
+  }
+  return { configPath: targetPath, config };
+}
+
 // packages/agent-runtime/modelLayerOverride.ts
 var MODEL_LAYER_KEYS = [
   "provider",
@@ -12728,7 +12875,7 @@ import * as nodeFs from "node:fs";
 var CLI_AUTO_ROUTE_AGENT_KEY = BUILTIN_NOLO_AGENT_KEY;
 
 // packages/agent-runtime/hostEnvironment.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import os from "node:os";
 function parseLinuxOsRelease(content) {
   let prettyName;
@@ -12767,9 +12914,9 @@ function probeHostEnvironment(options) {
     if (osReleaseText === void 0) {
       try {
         if (existsSync("/etc/os-release")) {
-          osReleaseText = readFileSync("/etc/os-release", "utf8");
+          osReleaseText = readFileSync2("/etc/os-release", "utf8");
         } else if (existsSync("/usr/lib/os-release")) {
-          osReleaseText = readFileSync("/usr/lib/os-release", "utf8");
+          osReleaseText = readFileSync2("/usr/lib/os-release", "utf8");
         }
       } catch {
       }
@@ -12835,16 +12982,16 @@ function buildHostEnvironmentLayer(options) {
 }
 
 // packages/agent-runtime/agentsMd.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { join } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { join as join2 } from "node:path";
 var AGENTS_MD_MAX_BYTES = 8192;
 var AGENTS_MD_CANDIDATES = ["AGENTS.md", "CLAUDE.md"];
 function readAgentsMdLayerFromDisk(cwd) {
   for (const name of AGENTS_MD_CANDIDATES) {
-    const filePath = join(cwd, name);
+    const filePath = join2(cwd, name);
     if (!existsSync2(filePath)) continue;
     try {
-      let content = readFileSync2(filePath, "utf8").trim();
+      let content = readFileSync3(filePath, "utf8").trim();
       if (!content) continue;
       if (Buffer.byteLength(content, "utf8") > AGENTS_MD_MAX_BYTES) {
         content = Buffer.from(content, "utf8").subarray(0, AGENTS_MD_MAX_BYTES).toString("utf8") + "\n\n<!-- AGENTS.md truncated -->";
@@ -12914,17 +13061,17 @@ function runDoDCommands(commands, cwd, deps = {}) {
 }
 
 // packages/cli/agentRunPrompts.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "node:fs";
-import { dirname, extname, isAbsolute, join as join2, relative as relativePath, resolve, sep } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
+import { dirname, extname, isAbsolute as isAbsolute2, join as join3, relative as relativePath, resolve as resolve2, sep } from "node:path";
 function workflowRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
-  return resolve(cwd, "docs", "workflows", `${fileName}.md`);
+  return resolve2(cwd, "docs", "workflows", `${fileName}.md`);
 }
 var SKILL_SEARCH_DIRS = [
   ".agents/skills"
@@ -12933,22 +13080,22 @@ function skillRefToCandidatePath(cwd, ref) {
   const normalized = ref.trim();
   if (!normalized) return "";
   if (normalized.endsWith(".md") || normalized.includes("/") || normalized.includes("\\")) {
-    const directPath = resolve(cwd, normalized);
+    const directPath = resolve2(cwd, normalized);
     if (existsSync3(directPath)) return directPath;
   }
   const fileName = normalized.replace(/[^a-zA-Z0-9一-鿿]+/g, "-").replace(/^-+|-+$/g, "");
   for (const dir of SKILL_SEARCH_DIRS) {
-    const skillMdPath = resolve(cwd, dir, fileName, "SKILL.md");
+    const skillMdPath = resolve2(cwd, dir, fileName, "SKILL.md");
     if (existsSync3(skillMdPath)) return skillMdPath;
   }
-  return resolve(cwd, ".agents", "skills", fileName, "SKILL.md");
+  return resolve2(cwd, ".agents", "skills", fileName, "SKILL.md");
 }
 async function resolveWorkflowReference(ref, cwd = process.cwd()) {
   const path2 = workflowRefToCandidatePath(cwd, ref);
   if (!path2 || !existsSync3(path2)) {
     throw new Error(`Workflow reference not found: ${ref}`);
   }
-  const markdown = readFileSync3(path2, "utf8");
+  const markdown = readFileSync4(path2, "utf8");
   const parsed = parseSkillDocProtocol(markdown);
   return {
     ref,
@@ -12958,15 +13105,15 @@ async function resolveWorkflowReference(ref, cwd = process.cwd()) {
 }
 function inlineRelativeRefs(body, skillDir) {
   const refPattern = /\[([^\]]+)\]\((\.\/[^)]+|[^)]+\/[^)]+)\)/g;
-  const normalizedSkillDir = resolve(skillDir) + sep;
+  const normalizedSkillDir = resolve2(skillDir) + sep;
   return body.replace(refPattern, (match, label, relPath) => {
     const cleaned = relPath.trim();
     if (!cleaned.startsWith("./") && !cleaned.startsWith("../")) return match;
-    const absPath = resolve(skillDir, cleaned);
+    const absPath = resolve2(skillDir, cleaned);
     const relative = relativePath(normalizedSkillDir, absPath);
-    if (relative.startsWith("..") || isAbsolute(relative)) return match;
+    if (relative.startsWith("..") || isAbsolute2(relative)) return match;
     if (!existsSync3(absPath) || !absPath.endsWith(".md")) return match;
-    const refContent = readFileSync3(absPath, "utf8");
+    const refContent = readFileSync4(absPath, "utf8");
     return `
 
 ### ${label}
@@ -12977,7 +13124,7 @@ ${refContent}
   });
 }
 function listSkillScripts(skillDir) {
-  const scriptsDir = join2(skillDir, "scripts");
+  const scriptsDir = join3(skillDir, "scripts");
   if (!existsSync3(scriptsDir) || !statSync2(scriptsDir).isDirectory()) return null;
   const entries = readdirSync(scriptsDir).filter((e) => !e.startsWith("."));
   if (entries.length === 0) return null;
@@ -13008,7 +13155,7 @@ async function resolveSkillReference(ref, options = {}) {
     if (!path2 || !existsSync3(path2)) {
       throw new Error(`Skill reference not found: ${ref}`);
     }
-    markdown = readFileSync3(path2, "utf8");
+    markdown = readFileSync4(path2, "utf8");
     filePath = path2;
     skillDir = dirname(path2);
   }
@@ -13112,9 +13259,9 @@ function prependSubjectDialogMarker(message, subjectDialogKey) {
 }
 function normalizeCliImageInput(input) {
   if (/^(https?:|data:|file:)/i.test(input)) return input;
-  const absolutePath = resolve(input);
+  const absolutePath = resolve2(input);
   if (!existsSync3(absolutePath)) return input;
-  const base64 = readFileSync3(absolutePath).toString("base64");
+  const base64 = readFileSync4(absolutePath).toString("base64");
   return `data:${imageMimeTypeForPath(absolutePath)};base64,${base64}`;
 }
 function imageMimeTypeForPath(path2) {
@@ -15658,6 +15805,22 @@ async function runAgentRunCommand(args, deps) {
   if (!localRuntimeCwd && (parsed.runtimeMode === "local" || hostRuntimeLocal)) {
     localRuntimeCwd = process.cwd();
   }
+  if (parsed.runtimeKey === "instabox") {
+    try {
+      writeInstaboxRunConfig({
+        workspaceMode: parsed.instaboxWorkspace,
+        artifactDir: parsed.instaboxArtifactDir,
+        manifestPath: parsed.instaboxManifestPath,
+        allowRemoteRelease: parsed.instaboxAllowRemoteRelease,
+        allowPaid: parsed.instaboxAllowPaid,
+        env
+      });
+    } catch (err) {
+      output.write(`[nolo] instabox \u914D\u7F6E\u751F\u6210\u5931\u8D25: ${toErrorMessage(err)}
+`);
+      return 1;
+    }
+  }
   const runEnv = buildLocalRunEnv({
     env,
     allowShell: parsed.allowShell

package/{chunk-FTHF2P2I.js → chunk-KVDB4IIT.js}

@@ -2,7 +2,7 @@ import {
   deleteDialog,
   runtime_default,
   toast
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-3WTD7IIQ.js";
 import {
   getCurrentSpaceId,
   getCurrentSpaceIdRaw,

package/{chunk-UUPXTEZA.js → chunk-NOFLIR3Z.js}

@@ -42,7 +42,7 @@ import {
 } from "./chunk-I42VC5KR.js";
 import {
   resolveRunsDir
-} from "./chunk-SNAWGDXT.js";
+} from "./chunk-WJJL7RMW.js";
 import {
   getDefaultCliLocalRuntimeDb
 } from "./chunk-GAGGEA7D.js";

package/{chunk-HRZW3SQN.js → chunk-Q2RZKBUU.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-62TBKWTV.js";
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-GXZZOTDM.js";
+} from "./chunk-WBTXES5L.js";
 import {
   readCredentialAvailability
 } from "./chunk-6MXDOUMH.js";

package/{chunk-7PDNSQZC.js → chunk-QKBEFLMA.js}

@@ -1,10 +1,10 @@
 import {
   fetchReferenceContents,
   resolveReferenceAssets
-} from "./chunk-JIAZK434.js";
+} from "./chunk-VVRYD7UL.js";
 import {
   updateTokensAction
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-3WTD7IIQ.js";
 import {
   applyUpdateTokensFulfilled
 } from "./chunk-OWYYDMGJ.js";

package/{chunk-U5U4WAFS.js → chunk-S53PIA3G.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-NBTY7YJF.js";
 import {
   resolveCliLocalRuntimeKeyCapability
-} from "./chunk-QFL42TMV.js";
+} from "./chunk-ZEOGFBR3.js";
 import {
   HIGH_RISK_MUTATION_TOOL_NAMES
 } from "./chunk-3M52COK5.js";
@@ -21,6 +21,7 @@ import {
 
 // packages/cli/agentRunArgs.ts
 import { readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
 function readFlagValue(args, flag) {
   const index = args.indexOf(flag);
   if (index < 0) return void 0;
@@ -78,7 +79,8 @@ var VALUELESS_FLAGS = {
   "--ephemeral": true,
   "--memory-only": true,
   "--read-only": true,
-  "--machine-shell": true
+  "--machine-shell": true,
+  "--instabox-allow-remote-release": true
 };
 function isValuelessFlag(arg) {
   return Object.prototype.hasOwnProperty.call(VALUELESS_FLAGS, arg);
@@ -150,7 +152,7 @@ function writeUsage(output, commandPath) {
     return;
   }
   output.write(
-    "Usage: nolo agent run <agent> <message> [--local|--server|--auto] [--runtime-key <key>] [--docker-workspace-mode git|empty] [--ephemeral|--memory-only] [--continue <dialogId>] [--cwd <path>]\n       nolo agent run --agent <agent> (--msg <message>|--msg-file <path>) [--image <url-or-path>] [--space <spaceId>] [--category <name>] [--inherit-from-dialog <dialog>] [--parent-dialog <dialog>] [--subject-dialog <dialog>] [--subject-ref <kind:id[:role]>] [--task-row-dbkey <key>] [--fallback-agent <agent>] (suggestions for agent to decide on quota) [--allowed-tool <tool>] [--blocked-tool <tool>] [--read-only] [--runtime-key <key>] [--docker-workspace-mode git|empty] [--machine-shell] [--dod <cmd>] [--bg] [--timeout-ms <n>] [--events jsonl] [--no-stream] [--skill <dbKey-or-md-path>]\n"
+    "Usage: nolo agent run <agent> <message> [--local|--server|--auto] [--runtime-key <key>] [--docker-workspace-mode git|empty] [--instabox-workspace empty|snapshot] [--instabox-manifest <path>] [--instabox-artifact-dir <path>] [--instabox-allow-remote-release] [--instabox-allow-paid] [--ephemeral|--memory-only] [--continue <dialogId>] [--cwd <path>]\n       nolo agent run --agent <agent> (--msg <message>|--msg-file <path>) [--image <url-or-path>] [--space <spaceId>] [--category <name>] [--inherit-from-dialog <dialog>] [--parent-dialog <dialog>] [--subject-dialog <dialog>] [--subject-ref <kind:id[:role]>] [--task-row-dbkey <key>] [--fallback-agent <agent>] (suggestions for agent to decide on quota) [--allowed-tool <tool>] [--blocked-tool <tool>] [--read-only] [--runtime-key <key>] [--docker-workspace-mode git|empty] [--instabox-workspace empty|snapshot] [--instabox-manifest <path>] [--instabox-artifact-dir <path>] [--instabox-allow-remote-release] [--instabox-allow-paid] [--machine-shell] [--dod <cmd>] [--bg] [--timeout-ms <n>] [--events jsonl] [--no-stream] [--skill <dbKey-or-md-path>]\n"
   );
 }
 function parseAgentRunArgs(args, options = {}) {
@@ -205,6 +207,32 @@ function parseAgentRunArgs(args, options = {}) {
       "\u4E0D\u80FD\u540C\u65F6\u6307\u5B9A --machine-shell \u4E0E --runtime-key\uFF1A--machine-shell \u5DF2\u628A\u6D3E\u53D1\u9501\u5230\u7ED1\u5B9A\u673A\u5668\u7684 server \u901A\u9053\uFF0CruntimeKey \u4F1A\u5931\u6548\uFF0C\u8BF7\u53EA\u4FDD\u7559\u5176\u4E2D\u4E00\u4E2A"
     );
   }
+  const rawInstaboxWorkspace = readFlagValue(args, "--instabox-workspace")?.trim();
+  const rawInstaboxManifest = readFlagValue(args, "--instabox-manifest")?.trim();
+  const rawInstaboxArtifactDir = readFlagValue(args, "--instabox-artifact-dir")?.trim();
+  const instaboxAllowRemoteRelease = args.includes("--instabox-allow-remote-release");
+  const instaboxAllowPaid = args.includes("--instabox-allow-paid");
+  const hasInstaboxFlags = args.includes("--instabox-workspace") || args.includes("--instabox-manifest") || args.includes("--instabox-artifact-dir") || instaboxAllowRemoteRelease || instaboxAllowPaid;
+  if (hasInstaboxFlags && runtimeKey !== "instabox") {
+    throw new Error("--instabox-* \u53C2\u6570\u4EC5\u9002\u7528\u4E8E --runtime-key instabox");
+  }
+  if (runtimeKey === "instabox") {
+    if (!rawInstaboxWorkspace || rawInstaboxWorkspace !== "empty" && rawInstaboxWorkspace !== "snapshot") {
+      throw new Error("--runtime-key instabox \u5FC5\u987B\u6307\u5B9A --instabox-workspace empty|snapshot");
+    }
+    if (!rawInstaboxArtifactDir) {
+      throw new Error("--runtime-key instabox \u5FC5\u987B\u6307\u5B9A --instabox-artifact-dir <\u7EDD\u5BF9\u8DEF\u5F84>");
+    }
+    if (!isAbsolute(rawInstaboxArtifactDir) || rawInstaboxArtifactDir.includes("\0") || rawInstaboxArtifactDir.split("/").includes("..")) {
+      throw new Error(`--instabox-artifact-dir \u5FC5\u987B\u4E3A\u5408\u6CD5\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\u4E14\u4E0D\u80FD\u5305\u542B .. \u6216\u7A7A\u5B57\u7B26: "${rawInstaboxArtifactDir}"`);
+    }
+    if (rawInstaboxWorkspace === "snapshot" && !rawInstaboxManifest) {
+      throw new Error("--instabox-workspace snapshot \u5FC5\u987B\u6307\u5B9A --instabox-manifest <\u6587\u4EF6\u8DEF\u5F84>");
+    }
+    if (rawInstaboxWorkspace === "empty" && args.includes("--instabox-manifest")) {
+      throw new Error("--instabox-workspace empty \u4E0D\u5F97\u6307\u5B9A --instabox-manifest");
+    }
+  }
   const runtimeMode = runtimeModeFromArgs(args);
   const continueDialogId = readFlagValue(args, "--continue") ?? readFlagValue(args, "--dialog");
   const spaceId = readFlagValue(args, "--space");
@@ -260,6 +288,11 @@ function parseAgentRunArgs(args, options = {}) {
     ...runtimeMode ? { runtimeMode } : !runtimeKey && (fullstackLocalWorkspaceDefault || explicitLocalCliAgentDefault || args.includes("--dangerously-allow-shell")) ? { runtimeMode: "local" } : {},
     ...runtimeKey ? { runtimeKey } : {},
     ...dockerWorkspaceMode ? { dockerWorkspaceMode } : {},
+    ...rawInstaboxWorkspace ? { instaboxWorkspace: rawInstaboxWorkspace } : {},
+    ...rawInstaboxManifest ? { instaboxManifestPath: rawInstaboxManifest } : {},
+    ...rawInstaboxArtifactDir ? { instaboxArtifactDir: rawInstaboxArtifactDir } : {},
+    ...instaboxAllowRemoteRelease ? { instaboxAllowRemoteRelease: true } : {},
+    ...instaboxAllowPaid ? { instaboxAllowPaid: true } : {},
     background: args.includes("--bg"),
     noStream: args.includes("--no-stream"),
     machineShell: args.includes("--machine-shell"),

package/{chunk-36IWXF25.js → chunk-VNPUBOKQ.js}

@@ -7,7 +7,7 @@ import {
   mergeReferences,
   resolveReferenceAssets,
   resolveToolsFromKeys
-} from "./chunk-JIAZK434.js";
+} from "./chunk-VVRYD7UL.js";
 import {
   UI_CARD_ENVELOPE_MAX_BYTES,
   getAllToolRuns,
@@ -20,7 +20,7 @@ import {
   selectSpaceContextLevel,
   selectUserTonePreset,
   uiCardFallback
-} from "./chunk-6QIBWOPT.js";
+} from "./chunk-HXFIFEBA.js";
 import {
   resolveToolBaseUrl
 } from "./chunk-MYOH447Z.js";
@@ -32,15 +32,15 @@ import {
 } from "./chunk-ZPKUJROL.js";
 import {
   getDocState
-} from "./chunk-K3N2DWLT.js";
+} from "./chunk-FKBWA3NN.js";
 import {
   getTableState
-} from "./chunk-FTHF2P2I.js";
+} from "./chunk-KVDB4IIT.js";
 import {
   PERSONALIZATION_DIALOG_CATEGORY,
   buildPersonalizationDialogPolicyContext,
   selectAllMsgs
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-3WTD7IIQ.js";
 import {
   getCurrentSpaceIdRaw,
   getViewMode

package/{chunk-JIAZK434.js → chunk-VVRYD7UL.js}

@@ -2,7 +2,7 @@ import {
   clipMultilineText,
   fetchAndSerializeTable,
   waitForAbortableDelay
-} from "./chunk-6QIBWOPT.js";
+} from "./chunk-HXFIFEBA.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -21,7 +21,7 @@ import {
 } from "./chunk-AGIM7IMJ.js";
 import {
   fetchAndCacheMessages
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-3WTD7IIQ.js";
 import {
   createSpaceKey
 } from "./chunk-UAD2WT54.js";

package/{chunk-4FDDVVCE.js → chunk-WBRBIRDG.js}

@@ -1,12 +1,12 @@
 import {
   addContentToSpace
-} from "./chunk-FTHF2P2I.js";
+} from "./chunk-KVDB4IIT.js";
 import {
   format,
   prepareAndPersistMessage,
   uiAskChoiceFunc,
   uiAskChoiceFunctionSchema
-} from "./chunk-2QQ7D3P5.js";
+} from "./chunk-3WTD7IIQ.js";
 import {
   formatISO
 } from "./chunk-ZRAU6T47.js";