nolo-cli 0.164.0-alpha.4 → 0.165.0-alpha.1

package/{chunk-EFGBXVOC.js → chunk-ANI67WCB.js}

@@ -1,12 +1,12 @@
 import {
   addContentToSpace
-} from "./chunk-ZMVXHANW.js";
+} from "./chunk-BYGWUVRX.js";
 import {
   format,
   prepareAndPersistMessage,
   uiAskChoiceFunc,
   uiAskChoiceFunctionSchema
-} from "./chunk-OC72ZET2.js";
+} from "./chunk-U7LNNRZJ.js";
 import {
   formatISO
 } from "./chunk-ZRAU6T47.js";

package/{chunk-QA2C5NKI.js → chunk-ASSNAASW.js}

@@ -34,7 +34,7 @@ var serializeMessageContent = (content, imagePlaceholder = "[\u56FE\u7247]") =>
 };
 
 // packages/core/sha256.ts
-import SHA256 from "crypto-js/sha256";
+import SHA256 from "crypto-js/sha256.js";
 function sha256Hex(text) {
   return SHA256(text).toString();
 }

package/{chunk-DE3RG4GV.js → chunk-BAAJVNIW.js}

@@ -1,9 +1,9 @@
 import {
   toolRegistry
-} from "./chunk-YTWGTCVW.js";
+} from "./chunk-NPTROADE.js";
 import {
   runtime_default
-} from "./chunk-OC72ZET2.js";
+} from "./chunk-U7LNNRZJ.js";
 import {
   canonicalizeToolNames
 } from "./chunk-5EBLANFT.js";

package/{chunk-ZMVXHANW.js → chunk-BYGWUVRX.js}

@@ -2,7 +2,7 @@ import {
   deleteDialog,
   runtime_default,
   toast
-} from "./chunk-OC72ZET2.js";
+} from "./chunk-U7LNNRZJ.js";
 import {
   getCurrentSpaceId,
   getCurrentSpaceIdRaw,

package/{chunk-TMVVCQCX.js → chunk-D2RSMFM5.js}

@@ -6,10 +6,10 @@ import {
 } from "./chunk-62TBKWTV.js";
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-F3FISQL2.js";
+} from "./chunk-WYU4H7EV.js";
 import {
   readCredentialAvailability
-} from "./chunk-6MXDOUMH.js";
+} from "./chunk-R4BMKAR5.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
@@ -19,7 +19,7 @@ import {
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-5IKRTRRR.js";
+} from "./chunk-MCGCC5BA.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-NBTY7YJF.js";

package/{chunk-4L4K6YR7.js → chunk-DI7ZFGDQ.js}

@@ -1,6 +1,6 @@
 import {
   getModelContextWindow
-} from "./chunk-QA2C5NKI.js";
+} from "./chunk-ASSNAASW.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";

package/{chunk-YVPQATSC.js → chunk-GPLUFN2E.js}

@@ -173,6 +173,8 @@ var DEFAULT_TTL_MINUTES = 15;
 var DEFAULT_MAX_OUTPUT_CHARS = 8e3;
 var DEFAULT_EXEC_TIMEOUT_MS = 6e4;
 var DEFAULT_MAX_ACTIVE_SANDBOXES_PER_ACCOUNT = 3;
+var DEFAULT_STOP_CONFIRM_ATTEMPTS = 6;
+var DEFAULT_STOP_CONFIRM_DELAY_MS = 2500;
 function resolveMaxActiveSandboxesFromEnv(env = process.env) {
   const raw = (env.NOLO_DOCKER_MAX_ACTIVE_SANDBOXES ?? "").trim();
   if (!raw) return null;
@@ -299,6 +301,10 @@ function createDockerSandboxExecutionBackend(deps = {}) {
   const shapeId = deps.shapeId ?? SANDBOX_DEFAULT_SHAPE;
   const ttlMinutes = deps.ttlMinutes ?? DEFAULT_TTL_MINUTES;
   const maxOutputChars = deps.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+  const stopConfirm = {
+    attempts: Math.max(1, deps.stopConfirm?.attempts ?? DEFAULT_STOP_CONFIRM_ATTEMPTS),
+    delayMs: Math.max(0, deps.stopConfirm?.delayMs ?? DEFAULT_STOP_CONFIRM_DELAY_MS)
+  };
   const leases = /* @__PURE__ */ new Map();
   const descriptor = {
     id: DOCKER_SANDBOX_BACKEND_ID,
@@ -628,7 +634,7 @@ function createDockerSandboxExecutionBackend(deps = {}) {
       const stop = await runSbx(["--cloud", "stop", entry.sandboxName], {
         timeoutMs: controlTimeoutMs
       });
-      if (stop.exitCode !== 0 || !await confirmDockerSandboxStopped(runSbx, entry.sandboxName, controlTimeoutMs)) {
+      if (stop.exitCode !== 0 || !await confirmDockerSandboxStopped(runSbx, entry.sandboxName, controlTimeoutMs, stopConfirm)) {
         throw new DockerSandboxBackendError("stop-unverified", void 0, true);
       }
       entry.released = true;

package/{chunk-Y2UYLA5L.js → chunk-H7GI62DA.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-HS7MLR74.js";
 import {
   performServerProxyFetchWithRetry
-} from "./chunk-647HBTHJ.js";
+} from "./chunk-VPHDNJWW.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-ZKBZLQTG.js";
+} from "./chunk-QG7BPUGN.js";
 import {
   buildSkillGuidancePromptBlock
 } from "./chunk-SH3XD4E2.js";
@@ -23,7 +23,7 @@ import {
   compileContextLayers,
   detectDispatchIntentFromMessages,
   resolveToolGuidedSections
-} from "./chunk-ZZDVBZOP.js";
+} from "./chunk-K3NJW7LY.js";
 import {
   convertMessagesToResponsesInput,
   getUsageRequestOptions,
@@ -32,11 +32,11 @@ import {
   resolveReasoningReplayOptions,
   shouldStripReasoningContentForOutbound,
   stablePromptCacheKey
-} from "./chunk-4L4K6YR7.js";
+} from "./chunk-DI7ZFGDQ.js";
 import {
   resolveAgentCallPlan,
   resolveClientWire
-} from "./chunk-TT644UJD.js";
+} from "./chunk-SAZSXMTR.js";
 import {
   createFileCredentialBroker
 } from "./chunk-UHTDNB5Y.js";

package/{chunk-F3SOW2EU.js → chunk-HEC32F3G.js}

@@ -4,7 +4,7 @@ import {
 import {
   getModelContextWindow,
   normalizeTimingMs
-} from "./chunk-QA2C5NKI.js";
+} from "./chunk-ASSNAASW.js";
 import {
   BUILTIN_NOLO_AGENT_KEY
 } from "./chunk-LOEO7LRC.js";

package/{chunk-W7FGZRLK.js → chunk-I72LPLCP.js}

@@ -2,7 +2,7 @@ import {
   deleteDbRecord,
   queryUserRecords,
   readDbRecord
-} from "./chunk-5IKRTRRR.js";
+} from "./chunk-MCGCC5BA.js";
 import {
   mergeAndDedupUserData
 } from "./chunk-OXME3PEE.js";

package/{chunk-VQOQH3DR.js → chunk-IQ37RGA5.js}

@@ -1,19 +1,19 @@
 import {
   createCliLocalRuntimeAdapter,
   summarizeEndpoint
-} from "./chunk-F3FISQL2.js";
+} from "./chunk-WYU4H7EV.js";
 import {
   t
-} from "./chunk-2AB2HA4M.js";
+} from "./chunk-TDX2L4W2.js";
 import {
   clipMultilineText
-} from "./chunk-RBMYJSZF.js";
+} from "./chunk-RVHXF55T.js";
 import {
   runLocalAgentTurn
-} from "./chunk-5E5VB7PS.js";
+} from "./chunk-5N23SKBR.js";
 import {
   applyToolSurfaceConstraints
-} from "./chunk-3M52COK5.js";
+} from "./chunk-SLAZGVZN.js";
 import {
   resolveLocalRuntimeEnvFromPolicy
 } from "./chunk-LIQJTQRN.js";

package/{chunk-LCKCG5TK.js → chunk-JGQTUD55.js}

@@ -9,7 +9,7 @@ import {
   resolveRawAgentInput,
   resolveServerUrl,
   writeUsage
-} from "./chunk-N665S3Z2.js";
+} from "./chunk-XI677N45.js";
 import {
   getReadableCliDb
 } from "./chunk-62TBKWTV.js";
@@ -31,19 +31,19 @@ import {
   resolveFileWriteGateEnabled,
   resolveLocalUserId,
   validateInstaboxWorkspaceSelection
-} from "./chunk-F3FISQL2.js";
+} from "./chunk-WYU4H7EV.js";
 import {
   clearCredentialAvailability,
-  readCredentialEntry,
+  readEffectiveCredentialEntry,
   recordCredentialProbe
-} from "./chunk-6MXDOUMH.js";
+} from "./chunk-R4BMKAR5.js";
 import {
   agentRunCardLabels,
   getCliLocale,
   t,
   toolLabel,
   toolLabelVariants
-} from "./chunk-2AB2HA4M.js";
+} from "./chunk-TDX2L4W2.js";
 import {
   _appendEntityBatch,
   _appendEvidenceBatch,
@@ -64,7 +64,7 @@ import {
 import {
   readDbRecord,
   resolveAgentRecordFromHybridStore
-} from "./chunk-5IKRTRRR.js";
+} from "./chunk-MCGCC5BA.js";
 import {
   isLocalCliAgentKey
 } from "./chunk-NBTY7YJF.js";
@@ -79,14 +79,14 @@ import {
 } from "./chunk-BMQ2MJUK.js";
 import {
   resolveCliLocalRuntimeKeyCapability
-} from "./chunk-YTWGTCVW.js";
+} from "./chunk-NPTROADE.js";
 import {
   isTransientFetchError
 } from "./chunk-KFHREHUQ.js";
 import {
   parseUiCard,
   uiCardFallback
-} from "./chunk-RBMYJSZF.js";
+} from "./chunk-RVHXF55T.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -95,7 +95,7 @@ import {
   chooseMemoryOwners,
   loadMemoryCandidatesFromDb,
   resolveAgentMemoryPolicy
-} from "./chunk-EFGBXVOC.js";
+} from "./chunk-ANI67WCB.js";
 import {
   API_REPORTED_COST_MULTIPLIER,
   estimateMessagesTokens,
@@ -103,7 +103,7 @@ import {
   resolveAgentContextWindow,
   resolveOccupancy,
   resolveOccupancyWindow
-} from "./chunk-OC72ZET2.js";
+} from "./chunk-U7LNNRZJ.js";
 import {
   buildSkillDiscoveryContextLayer
 } from "./chunk-AU7AXHUL.js";
@@ -115,10 +115,10 @@ import {
   LOCAL_AGENT_CONFIG_MISSING_CODE,
   LOCAL_TURN_ABORTED_CODE,
   readActionGate
-} from "./chunk-5E5VB7PS.js";
+} from "./chunk-5N23SKBR.js";
 import {
   resolveAgentRuntimeConfigFromRecord
-} from "./chunk-ULQAD7ZY.js";
+} from "./chunk-YKTAUOS7.js";
 import {
   createThinkParserState,
   flushThinkParser,
@@ -133,16 +133,18 @@ import {
 import {
   PROBE_INTERVAL_MS,
   QUOTA_ERROR_PATTERNS,
+  classifyFailureSubclass,
+  isCapacitySaturatedRateLimit,
   isQuotaExhaustedError,
-  isQuotaLimited403Body,
+  isQuotaExhaustedText,
   mergeAvailabilityDeadline,
   resolveCooldownGate,
   resolveCredentialKeyWithFallback
-} from "./chunk-3MZAGMYY.js";
+} from "./chunk-JLR5NWP2.js";
 import {
   isOAuthApiKeyRef,
   normalizeUsage
-} from "./chunk-F3SOW2EU.js";
+} from "./chunk-HEC32F3G.js";
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
@@ -11371,7 +11373,7 @@ function isBalanceExhaustedError(error) {
 
 // packages/cli/client/agentRun.ts
 async function loadRunLocalAgentTurn() {
-  const { runLocalAgentTurn } = await import("./agentRuntimeLocal-J6I63NZC.js");
+  const { runLocalAgentTurn } = await import("./agentRuntimeLocal-BCZRYS5T.js");
   return runLocalAgentTurn;
 }
 var stripDebugNoise = (s) => s.replace(/\s*raw="[\s\S]*"/g, "").replace(/\s*raw=\S+/g, "").replace(/\s*headers=\[[^\]]*\]/g, "").replace(/\s*headers=\S+/g, "").trim();
@@ -11643,7 +11645,7 @@ function looksLikeRateLimitedText(message) {
 var AUTH_TEXT_SIGNAL_RE = /\b401\b|unauthori[sz]ed|invalid[_\s-]?(?:api[_\s-]?key|token|credential)s?|(?:api[_\s-]?key|token|credential)s?[_\s-](?:invalid|expired|rejected|missing|not[_\s-]?found)|authentication[_\s-]?(?:error|failed|required)/i;
 var QUOTA_EXHAUSTED_EXTRA_RE = /insufficient[_\s-]?(?:quota|balance|credits?)|余额不足|额度已?用尽/i;
 function looksLikeQuotaExhaustedText(message) {
-  return isQuotaLimited403Body(message) || QUOTA_EXHAUSTED_EXTRA_RE.test(message);
+  return isQuotaExhaustedText(message) || QUOTA_EXHAUSTED_EXTRA_RE.test(message);
 }
 var BARE_UPSTREAM_5XX_RE = /\bHTTP[:\s]+(5\d\d)\b|\bstatus[:\s=]+(5\d\d)\b|\breturned error\s+(5\d\d)\b/i;
 function classifyLocalRunError(message) {
@@ -11890,7 +11892,7 @@ function formatRateLimitResetHint(hint, locale) {
   return parts.join(" ");
 }
 function buildRateLimitFailure(ctx) {
-  const headlineKey = ctx.quotaExhausted ? "localRunRateLimitQuota" : "localRunRateLimitThrottled";
+  const headlineKey = isCapacitySaturatedRateLimit(ctx.message, Date.now()) ? "localRunRateLimitCapacity" : ctx.quotaExhausted ? "localRunRateLimitQuota" : "localRunRateLimitThrottled";
   const lines = [
     t(
       headlineKey,
@@ -12228,8 +12230,15 @@ async function runHttpAgentTurn(options, authToken) {
     if (options.abortSignal?.aborted) {
       return { exitCode: 0, streamInterrupted: true };
     }
+    const failureSubclass = classifyFailureSubclass({
+      message: toErrorMessage(error),
+      body: error
+    });
     options.output.write(buildTransportErrorHint(options.serverUrl, error));
-    return { exitCode: 1 };
+    return {
+      exitCode: 1,
+      ...failureSubclass && failureSubclass !== "unknown" ? { failureSubclass } : {}
+    };
   }
   if (shouldStream && isGatewayHttpStatus(res.status)) {
     const failureMeta = await readAgentRunFailureMetadata(res);
@@ -12244,8 +12253,15 @@ async function runHttpAgentTurn(options, authToken) {
         res = await postAgentRun(false);
       } catch (error) {
         spinner.stop();
+        const failureSubclass = classifyFailureSubclass({
+          message: toErrorMessage(error),
+          body: error
+        });
         options.output.write(buildTransportErrorHint(options.serverUrl, error));
-        return { exitCode: 1 };
+        return {
+          exitCode: 1,
+          ...failureSubclass && failureSubclass !== "unknown" ? { failureSubclass } : {}
+        };
       }
     }
   }
@@ -12293,7 +12309,16 @@ async function runHttpAgentTurn(options, authToken) {
 `
       );
     }
-    return dialogIdText ? { exitCode: 1, dialogId: dialogIdText } : { exitCode: 1 };
+    const failureSubclass = classifyFailureSubclass({
+      status: res.status,
+      message: `${errorText || messageText} ${reasonText || ""} ${codeText || ""}`.trim(),
+      body: data
+    });
+    return {
+      exitCode: 1,
+      ...dialogIdText ? { dialogId: dialogIdText } : {},
+      ...failureSubclass && failureSubclass !== "unknown" ? { failureSubclass } : {}
+    };
   }
   const content = formatAssistantResponseForCli(
     String(data?.content ?? data?.message ?? "")
@@ -12604,6 +12629,10 @@ async function executeLocalAgentTurnForCliWithAdapter(options, settings, resolve
     return {
       exitCode: 1,
       localError: error,
+      failureSubclass: classifyFailureSubclass({
+        message: toErrorMessage(error),
+        body: error
+      }),
       ...savedDialogId ? { dialogId: savedDialogId } : {},
       ...abortedTurnCredits !== void 0 ? { turnCredits: abortedTurnCredits } : {},
       ...abortedUsageRecords?.length ? { usageRecords: abortedUsageRecords } : {}
@@ -12622,7 +12651,9 @@ async function checkLocalAvailabilityBeforeHttpDispatch(options) {
   }
   if (!config || typeof config !== "object") return null;
   const baseRecord = config.rawRecord ?? config;
-  let credentialKey = resolveCredentialKeyWithFallback(baseRecord);
+  let credentialKey = resolveCredentialKeyWithFallback(
+    baseRecord.agentKey || baseRecord.key ? baseRecord : { ...baseRecord, agentKey: options.agentKey }
+  );
   if (credentialKey && resolveOAuthChannelOwnerSkip(
     config,
     options
@@ -12636,19 +12667,30 @@ async function checkLocalAvailabilityBeforeHttpDispatch(options) {
   }
   const env = options.env;
   const now = Date.now();
-  const entry = credentialKey ? await readCredentialEntry(credentialKey, env, now).catch(() => void 0) : void 0;
+  let entry;
+  let matchedKey;
+  if (credentialKey) {
+    const effective = await readEffectiveCredentialEntry(credentialKey, env, now).catch(() => void 0);
+    if (effective) {
+      entry = effective;
+      matchedKey = effective.matchedKey;
+    }
+  }
   const entryAt = entry?.nextAvailableAt;
   const effectiveNextAvailableAt = typeof entryAt === "number" ? mergeAvailabilityDeadline(agentLevelNextAvailableAt, entryAt) : agentLevelNextAvailableAt;
-  if (typeof effectiveNextAvailableAt !== "number") return { credentialKey };
+  const activeKey = matchedKey || credentialKey;
+  if (typeof effectiveNextAvailableAt !== "number") {
+    return { credentialKey: credentialKey || activeKey, matchedKey };
+  }
   const gateDecision = resolveCooldownGate(
     { nextAvailableAt: effectiveNextAvailableAt, lastProbeAt: entry?.lastProbeAt },
     now
   );
-  if (gateDecision === "probe" && credentialKey) {
-    await recordCredentialProbe(credentialKey, env, now).catch(() => void 0);
-    return { credentialKey };
+  if (gateDecision === "probe" && activeKey) {
+    await recordCredentialProbe(activeKey, env, now).catch(() => void 0);
+    return { credentialKey: credentialKey || activeKey, matchedKey };
   }
-  if (gateDecision !== "blocked") return { credentialKey };
+  if (gateDecision !== "blocked") return { credentialKey: credentialKey || activeKey, matchedKey };
   options.output.write(
     `${t(
       "agentCooldownBlocked",
@@ -12659,7 +12701,7 @@ async function checkLocalAvailabilityBeforeHttpDispatch(options) {
     )}
 `
   );
-  return { exitCode: 1 };
+  return { exitCode: 1, failureSubclass: "rate_limit" };
 }
 function foldLocalResultForTui(localResult) {
   const folded = {
@@ -12685,7 +12727,8 @@ function foldLocalResultForTui(localResult) {
     // 上 finalText 永远到不了结算点 → agentRunCommand 的 settleRunTerminal-
     // Authoritatively 拿不到 lastAssistantText → `.result.md` 不写、status 无
     // resultFile，编排者只能去啃带 ANSI 的 .log（同坑位历史：turnCredits）。
-    ...localResult.finalText ? { finalText: localResult.finalText } : {}
+    ...localResult.finalText ? { finalText: localResult.finalText } : {},
+    ...localResult.failureSubclass ? { failureSubclass: localResult.failureSubclass } : {}
   };
   const headerMeta = getRunResultHeaderMeta(localResult);
   recordRunResultHeaderMeta(folded, headerMeta);
@@ -12760,9 +12803,14 @@ async function runAgentTurn(options) {
         }
       }
       const localErrorMessage = localResult.localError ? toErrorMessage(localResult.localError) : "local runtime failed";
+      const failureSubclass = localResult.failureSubclass ?? classifyFailureSubclass({
+        message: localErrorMessage,
+        body: localResult.localError
+      });
       options.output.write(describeLocalRunFailure(localErrorMessage, localResult.localError));
       return {
         exitCode: 1,
+        failureSubclass,
         ...localResult.dialogId ? { dialogId: localResult.dialogId } : {},
         // Keep localError so TUI can show balance/quota/dialog-preserved hints
         // instead of only the raw auto-runtime line.
@@ -12782,12 +12830,16 @@ async function runAgentTurn(options) {
   }
   const localAvailability = await checkLocalAvailabilityBeforeHttpDispatch(options);
   if (localAvailability?.exitCode) {
-    return { exitCode: localAvailability.exitCode };
+    return {
+      exitCode: localAvailability.exitCode,
+      failureSubclass: localAvailability.failureSubclass ?? "rate_limit"
+    };
   }
   const httpResult = await runHttpAgentTurn(options, authToken);
-  if (httpResult.exitCode === 0 && !httpResult.streamInterrupted && localAvailability?.credentialKey) {
+  if (httpResult.exitCode === 0 && !httpResult.streamInterrupted && (localAvailability?.credentialKey || localAvailability?.matchedKey)) {
+    const keyToClear = localAvailability.credentialKey || localAvailability.matchedKey;
     await clearCredentialAvailability(
-      localAvailability.credentialKey,
+      keyToClear,
       options.env
     ).catch(() => void 0);
   }