nolo-cli 0.164.0-alpha.4 → 0.165.0-alpha.1

package/{chunk-3M52COK5.js → chunk-SLAZGVZN.js}

@@ -36,7 +36,11 @@ var DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS = [
   "listTables",
   "queryTableRows",
   "cliWhoami",
-  "cliDoctor"
+  "cliDoctor",
+  "list_cloud_resources",
+  "cloud_probe"
+  // cloud_exec 故意不在此清单：硬边界是「永不默认开 exec」。它只在 agent 显式启用时出现，
+  // 且只读 run 会被 HIGH_RISK_MUTATION_TOOL_NAMES 挡住（runtimeToolSurface.test.ts 钉住）。
 ];
 var DEFAULT_SUBTASK_REFERENCE_NOLO_WORKSPACE_TOOLS = [
   "readDialog",
@@ -72,7 +76,11 @@ var HIGH_RISK_MUTATION_TOOL_NAMES = [
   // 编排副作用：startAgentRun 会另起一次 run（子 run 的只读与否由调用方参数决定），
   // controlAgentRun 能追加指令/停止它；只读 run 不应拿到这两个（review A-1）。
   "startAgentRun",
-  "controlAgentRun"
+  "controlAgentRun",
+  // 受控云端执行：在用户拥有的云资源上跑任意命令，不可重放、副作用在云端。
+  // 硬边界：它永不进 DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS（见该清单注释），
+  // 必须由 agent 显式启用才出现；这里进名单保证只读 run 即使被显式要求也拿不到。
+  "cloud_exec"
 ];
 function resolveReadOnlyToolConstraints(additionalBlockedTools) {
   return {
@@ -770,9 +778,33 @@ var NOLO_WORKSPACE_TOOL_NAMES = [
   "listTables",
   "queryTableRows",
   "cliWhoami",
-  "cliDoctor"
+  "cliDoctor",
+  "list_cloud_resources",
+  "cloud_probe",
+  "cloud_exec"
 ];
+var SERVER_ONLY_NOLO_WORKSPACE_TOOL_NAMES = [
+  "list_cloud_resources",
+  "cloud_probe",
+  "cloud_exec"
+];
+var SERVER_ONLY_NOLO_WORKSPACE_TOOL_NAME_SET = new Set(SERVER_ONLY_NOLO_WORKSPACE_TOOL_NAMES);
+function isServerOnlyNoloWorkspaceTool(name) {
+  return SERVER_ONLY_NOLO_WORKSPACE_TOOL_NAME_SET.has(name);
+}
+var CLI_NOLO_WORKSPACE_TOOL_NAMES = NOLO_WORKSPACE_TOOL_NAMES.filter(
+  (name) => !isServerOnlyNoloWorkspaceTool(name)
+);
+function filterClientNoloWorkspaceToolNames(toolNames) {
+  if (!toolNames) return [...CLI_NOLO_WORKSPACE_TOOL_NAMES];
+  return toolNames.filter((name) => !isServerOnlyNoloWorkspaceTool(name));
+}
 var NOLO_WORKSPACE_TOOL_NAME_SET = new Set(NOLO_WORKSPACE_TOOL_NAMES);
+var CLOSED_OBJECT_SCHEMA_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "list_cloud_resources",
+  "cloud_probe",
+  "cloud_exec"
+]);
 var DIALOG_ID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
 var DIALOG_PATH_RE = /^\/(?:space\/([^/]+)\/)?dialog-(.+)-([0-9A-HJKMNP-TV-Z]{26})\/?$/i;
 function stringToolParam(description) {
@@ -791,6 +823,7 @@ function buildNoloWorkspaceOpenAiTools(args) {
         parameters: {
           type: "object",
           properties,
+          ...CLOSED_OBJECT_SCHEMA_TOOL_NAMES.has(name) ? { additionalProperties: false } : {},
           ...required.length ? { required } : {}
         }
       }
@@ -875,6 +908,39 @@ function buildNoloWorkspaceOpenAiTools(args) {
   }, ["table"]);
   add("cliWhoami", "Show the current Nolo CLI login state.", {});
   add("cliDoctor", "Show Nolo CLI doctor diagnostics.", {});
+  add("list_cloud_resources", "List accessible cloud resources for personal or organization scope. Never outputs credentials.", {
+    ownerKind: {
+      type: "string",
+      enum: ["user", "organization"],
+      description: "Owner scope kind. Defaults to user (caller)."
+    },
+    organizationId: stringToolParam("Required when ownerKind is organization."),
+    platformId: stringToolParam("Optional cloud platform filter (e.g. docker, cloudflare, gcp).")
+  });
+  add("cloud_probe", "Probe read-only connectivity and readiness of a cloud resource. Never accepts credential parameters.", {
+    resourceId: stringToolParam("Target cloud resource ID to probe.")
+  }, ["resourceId"]);
+  add("cloud_exec", 'Execute a shell task on an owned cloud resource through the server execution gate (authorization \u2192 capability \u2192 idempotent single-flight \u2192 audit \u2192 adapter). Never accepts credential parameters; refusals come back as { status: "blocked", reasonCode } instead of throwing.', {
+    resourceId: stringToolParam("Target cloud resource ID the caller owns or may use."),
+    task: {
+      type: "object",
+      properties: {
+        kind: { type: "string", enum: ["shell"], description: "Task kind. Only shell is supported." },
+        argv: {
+          type: "array",
+          items: { type: "string" },
+          description: "Command and arguments: 1..32 items, each at most 512 characters, no NUL."
+        },
+        timeoutMs: {
+          type: "integer",
+          description: "Optional timeout in milliseconds, clamped to 1000..120000."
+        }
+      },
+      additionalProperties: false,
+      required: ["kind", "argv"]
+    },
+    idempotencyKey: stringToolParam("Caller idempotency key, 8..128 characters of [A-Za-z0-9_.:-]; a concurrent duplicate is rejected.")
+  }, ["resourceId", "task", "idempotencyKey"]);
   return tools;
 }
 function noloPositiveIntegerString(value) {
@@ -1428,6 +1494,8 @@ export {
   BRIDGE_STREAM_MAX_CHARS,
   readTextStreamUpToChars,
   NOLO_WORKSPACE_TOOL_NAMES,
+  CLI_NOLO_WORKSPACE_TOOL_NAMES,
+  filterClientNoloWorkspaceToolNames,
   buildNoloWorkspaceOpenAiTools,
   noloPositiveIntegerString,
   noloStringArg,

package/{chunk-2AB2HA4M.js → chunk-TDX2L4W2.js}

@@ -180,8 +180,8 @@ var STRINGS = {
     zh: "\u672C\u6B21\u56DE\u590D\u51FA\u9519\u3002\u5DF2\u6392\u961F\u7684\u6D88\u606F\u4ECD\u4FDD\u7559\uFF0C\u6309 Enter \u53EF\u91CD\u65B0\u53D1\u9001\u3002"
   },
   quotaExhaustedHint: {
-    en: "This agent seems to have hit a quota/rate limit (HTTP 429).\nUse /agent to switch to another agent and keep going \u2014 the dialog context is preserved.",
-    zh: "\u5F53\u524D agent \u4F3C\u4E4E\u989D\u5EA6/\u901F\u7387\u53D7\u9650\uFF08429\uFF09\u3002\n\u53EF\u4EE5\u7528 /agent \u5207\u6362\u5230\u5176\u4ED6 agent \u540E\u7EE7\u7EED\uFF0C\u540C\u4E00\u5BF9\u8BDD\u4F1A\u4FDD\u7559\u4E0A\u4E0B\u6587\u3002"
+    en: "This agent is temporarily unavailable (HTTP 429).\nUse /agent to switch to another agent and keep going \u2014 the dialog context is preserved.",
+    zh: "\u5F53\u524D agent \u6682\u65F6\u4E0D\u53EF\u7528\uFF08HTTP 429\uFF09\u3002\n\u53EF\u4EE5\u7528 /agent \u5207\u6362\u5230\u5176\u4ED6 agent \u540E\u7EE7\u7EED\uFF0C\u540C\u4E00\u5BF9\u8BDD\u4F1A\u4FDD\u7559\u4E0A\u4E0B\u6587\u3002"
   },
   balanceExhaustedHint: {
     en: 'Your message is saved in this dialog \u2014 top up, then send again or say "continue" to pick up where you left off.',
@@ -406,6 +406,12 @@ var STRINGS = {
     en: "[nolo] Upstream rate limit ({0}): {1}",
     zh: "[nolo] \u4E0A\u6E38\u9650\u6D41\uFF08{0}\uFF09\uFF1A{1}"
   },
+  // 上游明确表示「服务容量饱和」（如 Codex 的 "is at capacity"）。这与账号额度
+  // 无关，用「额度」措辞会让人误以为是自己配额用完了。单独一档。
+  localRunRateLimitCapacity: {
+    en: "[nolo] Upstream service at capacity ({0}): {1}",
+    zh: "[nolo] \u4E0A\u6E38\u670D\u52A1\u5BB9\u91CF\u9971\u548C\uFF08{0}\uFF09\uFF1A{1}"
+  },
   // 第 2 行复位提示：沿用 extractRateLimitResetHint 抓到的上游原文（不换算），
   // 只作括号补充；没抓到就没有这段括号。
   localRunRateLimitResetNote: {

package/{chunk-DJ2BOPJY.js → chunk-TQGP2LAX.js}

@@ -1,7 +1,7 @@
 import {
   readDbRecord,
   writeAgentRecord
-} from "./chunk-5IKRTRRR.js";
+} from "./chunk-MCGCC5BA.js";
 import {
   buildSkillSummaryMarker
 } from "./chunk-VF4K2QE6.js";

package/{chunk-OC72ZET2.js → chunk-U7LNNRZJ.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-QYPE3TS3.js";
 import {
   runLlm
-} from "./chunk-ZKBZLQTG.js";
+} from "./chunk-QG7BPUGN.js";
 import {
   getApproxPricePerImage
 } from "./chunk-4JH2UMJR.js";
@@ -104,7 +104,7 @@ import {
   isOAuthApiKeyRef,
   normalizeUsage,
   resolveAutoExecutionProfile
-} from "./chunk-F3SOW2EU.js";
+} from "./chunk-HEC32F3G.js";
 import {
   isDevinOAuthAgent
 } from "./chunk-5ZUL4CUO.js";
@@ -121,7 +121,7 @@ import {
   getModelInfo,
   planCompression,
   serializeMessageContent
-} from "./chunk-QA2C5NKI.js";
+} from "./chunk-ASSNAASW.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -11062,7 +11062,7 @@ var messageSlice = createSliceWithThunks({
             runtimeOptions: args.runtimeOptions
           });
           if (agentKeyToUse) {
-            const { streamAgentChatTurn } = await import("./agentSlice-JOVX3KY3.js");
+            const { streamAgentChatTurn } = await import("./agentSlice-2WTAYXEB.js");
             await dispatch(
               streamAgentChatTurn({
                 agentKey: agentKeyToUse,
@@ -13879,7 +13879,7 @@ var deleteDialogThunk = async (payload, thunkApi) => {
   }
   if (isCurrentDialog) {
     await thunkApi.dispatch(resetMsgs());
-    const { clearPendingAttachments: clearPendingAttachments2 } = await import("./dialogSlice-YXRGO7UV.js");
+    const { clearPendingAttachments: clearPendingAttachments2 } = await import("./dialogSlice-KGVUUVND.js");
     dispatch(clearPendingAttachments2());
   }
   return { dialogKey, isCurrentDialog, attachmentPlan };
@@ -13887,15 +13887,15 @@ var deleteDialogThunk = async (payload, thunkApi) => {
 
 // packages/chat/dialog/dialogSlice.ts
 var runCreateDialogAction = async (args, thunkApi) => {
-  const { createDialogAction } = await import("./createDialogAction-4SHMWQYD.js");
+  const { createDialogAction } = await import("./createDialogAction-WPVWZ3VX.js");
   return createDialogAction(args, thunkApi);
 };
 var runCreateAgentAutomationAction = async (args, thunkApi) => {
-  const { createAgentAutomationAction } = await import("./createAgentAutomationAction-WSQ3VZ3X.js");
+  const { createAgentAutomationAction } = await import("./createAgentAutomationAction-TBWN2KX2.js");
   return createAgentAutomationAction(args, thunkApi);
 };
 var runUpdateDialogTitleAction = async (args, thunkApi) => {
-  const { updateDialogTitleAction } = await import("./updateDialogTitleAction-QERIYNOM.js");
+  const { updateDialogTitleAction } = await import("./updateDialogTitleAction-WDG2WGZJ.js");
   return updateDialogTitleAction(args, thunkApi);
 };
 var runAddDialogAgentAction = async (args, thunkApi) => {
@@ -13919,7 +13919,7 @@ var runSetDialogExtraReferencesAction = async (args, thunkApi) => {
   return setDialogExtraReferencesAction(args, thunkApi);
 };
 var runHandleSendMessageAction = async (args, thunkApi) => {
-  const { handleSendMessageAction } = await import("./handleSendMessageAction-SK6Q2N7Z.js");
+  const { handleSendMessageAction } = await import("./handleSendMessageAction-NCHW43LP.js");
   return handleSendMessageAction(args, thunkApi);
 };
 function clearDialogState() {
@@ -13932,7 +13932,7 @@ var createPageAndAddReference = createAsyncThunk(
   async (payload, { dispatch, getState, rejectWithValue }) => {
     const { slateData, jsonData, title, type, fileId, groupId, dialogKey } = payload;
     try {
-      const { createDocState } = await import("./docStore-2U6GZMDG.js");
+      const { createDocState } = await import("./docStore-YS6GP4CJ.js");
       const pageKey = await createDocState(
         { slateData, title },
         { dispatch, getState }

package/{chunk-647HBTHJ.js → chunk-VPHDNJWW.js}

@@ -2,7 +2,7 @@ import {
   clipMultilineText,
   fetchAndSerializeTable,
   waitForAbortableDelay
-} from "./chunk-RBMYJSZF.js";
+} from "./chunk-RVHXF55T.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -21,7 +21,7 @@ import {
 } from "./chunk-AGIM7IMJ.js";
 import {
   fetchAndCacheMessages
-} from "./chunk-OC72ZET2.js";
+} from "./chunk-U7LNNRZJ.js";
 import {
   createSpaceKey
 } from "./chunk-UAD2WT54.js";

package/{chunk-F3FISQL2.js → chunk-WYU4H7EV.js}

@@ -9,21 +9,21 @@ import {
 import {
   clearCredentialAvailability,
   markCredentialUnavailable,
-  readCredentialAvailability,
   readCredentialEntry,
+  readEffectiveCredentialEntry,
   recordCredentialProbe
-} from "./chunk-6MXDOUMH.js";
+} from "./chunk-R4BMKAR5.js";
 import {
   agentRunCardLabels,
   t
-} from "./chunk-2AB2HA4M.js";
+} from "./chunk-TDX2L4W2.js";
 import {
   defaultLoopbackRequest
 } from "./chunk-VP3BINY7.js";
 import {
   OAUTH_PROVIDER_REFS,
   buildLocalAgentLookupKeys
-} from "./chunk-BL4HFN6L.js";
+} from "./chunk-YL26TH2V.js";
 import {
   LOCAL_CODEX_AGENT_ID,
   LOCAL_CODEX_AGENT_KEY,
@@ -64,7 +64,7 @@ import {
 import {
   inlineImageUrlsForCustomProvider,
   prepareTools
-} from "./chunk-DE3RG4GV.js";
+} from "./chunk-BAAJVNIW.js";
 import {
   getServerProviderSecret
 } from "./chunk-HS7MLR74.js";
@@ -86,18 +86,18 @@ import {
   resolveCliLocalRuntimeKeyCapability,
   resolveCliLocalSpawnDispatch,
   resolveStartAgentRunCwd
-} from "./chunk-YTWGTCVW.js";
+} from "./chunk-NPTROADE.js";
 import {
   deriveCredentialGroup,
   deriveCustomProviderCredentialGroup
-} from "./chunk-WYJTNSVL.js";
+} from "./chunk-XKVWXU6D.js";
 import {
   fetchWithTransientRetry,
   isTransientFetchError
 } from "./chunk-KFHREHUQ.js";
 import {
   resolveAgentRequiredPackIds
-} from "./chunk-RBMYJSZF.js";
+} from "./chunk-RVHXF55T.js";
 import {
   applyBuiltinAgentRuntimeOverride,
   applyTokenUsageToDayStats,
@@ -106,14 +106,14 @@ import {
   resolveBuiltinPlatformAgentConfig,
   runKeyed,
   validateAskChoiceInput
-} from "./chunk-OC72ZET2.js";
+} from "./chunk-U7LNNRZJ.js";
 import {
   BUILTIN_DIALOG_LLM_CHAT_FALLBACK_MODEL,
   BUILTIN_TITLE_LLM_CONFIG
 } from "./chunk-523DITKR.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-ZKBZLQTG.js";
+} from "./chunk-QG7BPUGN.js";
 import {
   isTombstoneRecord
 } from "./chunk-D2MDMY2M.js";
@@ -170,7 +170,7 @@ import {
   runExecShellGates,
   validateConfiguredRootExecutionLease,
   verifyOwnerRouteAck
-} from "./chunk-5E5VB7PS.js";
+} from "./chunk-5N23SKBR.js";
 import {
   accumulateGeminiChunks,
   buildGeminiGenerateContentRequest,
@@ -193,35 +193,37 @@ import {
   readPlatformChatSseCompletion,
   resolvePlatformChatProviderConfig,
   shouldUsePlatformChatProvider
-} from "./chunk-QXZH5UDF.js";
+} from "./chunk-7NKZA46B.js";
 import {
   readSseDataValues,
   readSseFrames
 } from "./chunk-HNUWUO75.js";
 import {
   resolveAgentRuntimeConfigFromRecord
-} from "./chunk-ULQAD7ZY.js";
+} from "./chunk-YKTAUOS7.js";
 import {
   resolveHistoricalToolContentCap
-} from "./chunk-U34KT53V.js";
+} from "./chunk-6BNW7WC4.js";
 import {
   collectStablePromptPrefix,
   convertMessagesToResponsesInput,
   findAgentStatePairingIssues,
   stablePromptCacheKey,
   toResponsesTools
-} from "./chunk-4L4K6YR7.js";
+} from "./chunk-DI7ZFGDQ.js";
 import {
   buildNoloWorkspaceOpenAiTools,
+  filterClientNoloWorkspaceToolNames,
   parseNoloWorkspaceToolArguments,
   resolveRuntimeToolSurfaceForAgent
-} from "./chunk-3M52COK5.js";
+} from "./chunk-SLAZGVZN.js";
 import {
+  isCapacitySaturatedRateLimit,
   mergeAvailabilityDeadline,
   resolveAvailabilityAction,
   resolveCooldownGate,
   resolveCredentialKeyWithFallback
-} from "./chunk-3MZAGMYY.js";
+} from "./chunk-JLR5NWP2.js";
 import {
   buildDialogFallbackTitleFromUserInput,
   normalizeDialogTitle
@@ -229,7 +231,7 @@ import {
 import {
   isOAuthApiKeyRef,
   normalizeUsage
-} from "./chunk-F3SOW2EU.js";
+} from "./chunk-HEC32F3G.js";
 import {
   isDevinOAuthAgent
 } from "./chunk-5ZUL4CUO.js";
@@ -239,7 +241,7 @@ import {
   observeMeaningfulProviderResponse,
   observeMeaningfulProviderResponseAt,
   withProviderCallTimingFields
-} from "./chunk-QA2C5NKI.js";
+} from "./chunk-ASSNAASW.js";
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
@@ -1186,7 +1188,9 @@ function buildOpenAiTools(args) {
     }),
     ...buildCliChromeConnectorOpenAiTools({ toolNames: args.toolNames }),
     ...buildServerPlatformOpenAiTools({ toolNames: args.toolNames }),
-    ...buildNoloWorkspaceOpenAiTools({ toolNames: args.toolNames }),
+    ...buildNoloWorkspaceOpenAiTools({
+      toolNames: filterClientNoloWorkspaceToolNames(args.toolNames)
+    }),
     ...buildOrchestrationOpenAiTools({
       toolNameSet,
       env: args.env
@@ -3550,6 +3554,19 @@ async function readStructuredErrorCode(response) {
   }
 }
 async function shouldRetryOwnerProxyResponse(response) {
+  if (response.status === 429) {
+    try {
+      let body;
+      try {
+        body = await response.clone().json();
+      } catch {
+        body = await response.clone().text();
+      }
+      return isCapacitySaturatedRateLimit(body, Date.now(), response.headers);
+    } catch {
+      return false;
+    }
+  }
   if (response.status === 503) {
     try {
       const body = await response.clone().json();
@@ -9538,8 +9555,8 @@ async function createLocalDockerWorkload(args) {
   }
   const createLifecycle = args.createLifecycle ?? (async () => {
     const [{ DockerWorkloadLifecycle, createDockerBindingAuthorizer }, accounts] = await Promise.all([
-      import("./workloadLifecycle-6O6PMISX.js"),
-      import("./accountResolver-55EDKEIK.js")
+      import("./workloadLifecycle-MZ2V5L43.js"),
+      import("./accountResolver-JS7QDNNL.js")
     ]);
     const resolveAccount = args.resolveAccount ?? accounts.createDockerAccountResolver({
       env: args.env,
@@ -11836,6 +11853,65 @@ var isJsBundle = extname(currentMetaFile) === ".js";
 var SOURCE_CLI_DIR = isJsBundle ? dirname4(currentMetaFile) : dirname4(dirname4(currentMetaFile));
 var CLI_DIR = isCompiledBinary() ? dirname4(process.execPath) : SOURCE_CLI_DIR;
 var CLI_ENTRYPOINT = isCompiledBinary() ? process.execPath : isJsBundle ? currentMetaFile : join6(SOURCE_CLI_DIR, "index.ts");
+var KNOWN_HINT_LABELS = /* @__PURE__ */ new Map([
+  ["usage_limit_reached", "usage-limit"],
+  ["rate_limit_exceeded", "rate-limit"],
+  ["insufficient_quota", "insufficient-quota"],
+  ["quota_exceeded", "quota-exceeded"],
+  ["invalid_request_error", "invalid-request"],
+  ["authentication_error", "auth"],
+  ["permission_denied", "permission-denied"],
+  ["model_not_found", "model-not-found"],
+  ["context_length_exceeded", "context-length"],
+  ["proxy_failed", "proxy-failed"],
+  ["upstream_transport_error", "upstream-transport"],
+  ["core_draining", "core-draining"],
+  ["owner_origin_mismatch", "owner-origin-mismatch"],
+  ["overloaded", "overloaded"],
+  ["capacity", "capacity"]
+]);
+function hintLabelOf(raw) {
+  return KNOWN_HINT_LABELS.get(raw.trim().toLowerCase());
+}
+function collectSafeHints(body, out = [], depth = 0) {
+  if (depth > 2 || out.length >= 3) return out;
+  if (Array.isArray(body)) {
+    for (const item of body) collectSafeHints(item, out, depth + 1);
+    return out;
+  }
+  if (!body || typeof body !== "object") return out;
+  for (const [k, v] of Object.entries(body)) {
+    const normalizedKey = k.toLowerCase().replace(/[-_]/g, "");
+    if ((normalizedKey === "code" || normalizedKey === "type") && typeof v === "string") {
+      const label = hintLabelOf(v);
+      if (label && out.length < 3 && !out.includes(label)) {
+        out.push(label);
+      }
+    } else if (v && typeof v === "object") {
+      collectSafeHints(v, out, depth + 1);
+    }
+  }
+  return out;
+}
+function buildSafeBodyPreview(body, classification = "unknown") {
+  try {
+    const serialized = typeof body === "string" ? body : JSON.stringify(body ?? "");
+    const hints = collectSafeHints(body);
+    const parts = [`class=${classification}`, `len=${serialized.length}`];
+    if (hints.length > 0) parts.push(`hints=${hints.join("|")}`);
+    return parts.join(" ");
+  } catch {
+    return void 0;
+  }
+}
+function formatSafeIsoDeadline(epochMs) {
+  try {
+    const d = new Date(epochMs);
+    return Number.isFinite(d.getTime()) ? d.toISOString() : "";
+  } catch {
+    return "";
+  }
+}
 async function recordLocalAvailabilityForAgent(args) {
   const now = args.now ?? Date.now;
   const { deps, status } = args;
@@ -11845,6 +11921,39 @@ async function recordLocalAvailabilityForAgent(args) {
   const action = resolveAvailabilityAction(status, args.body, now());
   if (action.kind === "noop") return void 0;
   const credentialKey = resolveCredentialKeyWithFallback(agentConfig);
+  try {
+    if (action.kind === "mark") {
+      const payload = {
+        agentKey: key,
+        credentialKey,
+        status,
+        nextAvailableAt: action.nextAvailableAt,
+        nextAvailableAtIso: formatSafeIsoDeadline(action.nextAvailableAt)
+      };
+      const bodyClass = (() => {
+        try {
+          if (status === 429) {
+            return isCapacitySaturatedRateLimit(args.body, now()) ? "capacity-saturated" : "quota-or-unknown";
+          }
+          return status >= 500 ? "server-error" : "other";
+        } catch {
+          return "unclassified";
+        }
+      })();
+      const bodyPreview = buildSafeBodyPreview(args.body, bodyClass);
+      if (bodyPreview !== void 0) {
+        payload.bodyPreview = bodyPreview;
+      }
+      logLocalRuntimeDiagnostic("availability.mark", payload);
+    } else if (action.kind === "clear") {
+      logLocalRuntimeDiagnostic("availability.clear", {
+        agentKey: key,
+        credentialKey,
+        status
+      });
+    }
+  } catch {
+  }
   if (credentialKey) {
     if (action.kind === "mark") {
       await markCredentialUnavailable(
@@ -12027,6 +12136,7 @@ function createCliLocalRuntimeAdapter(deps) {
       );
     }
     instaboxWorkloadLoad ??= (async () => {
+      assertInstaboxPrerequisites(deps.env);
       let runConfig;
       try {
         runConfig = loadInstaboxRunConfig({ env: deps.env });
@@ -12463,8 +12573,10 @@ function createCliLocalRuntimeAdapter(deps) {
         const credentialKeyForGate = resolveCredentialKeyWithFallback(
           agentConfig
         );
-        const credentialCooldowns = credentialKeyForGate ? await readCredentialAvailability(deps.env, nowMs).catch(() => ({})) : {};
-        const credentialCooldownAt = credentialKeyForGate ? credentialCooldowns[credentialKeyForGate] : void 0;
+        const gateEntry = credentialKeyForGate ? await readEffectiveCredentialEntry(credentialKeyForGate, deps.env, nowMs).catch(
+          () => void 0
+        ) : void 0;
+        const credentialCooldownAt = gateEntry?.nextAvailableAt;
         const agentLevelNextAvailableAt = agentConfig.nextAvailableAt;
         const effectiveNextAvailableAt = typeof credentialCooldownAt === "number" ? mergeAvailabilityDeadline(
           agentLevelNextAvailableAt,
@@ -12477,9 +12589,6 @@ function createCliLocalRuntimeAdapter(deps) {
           body,
           now
         }).then(() => void 0);
-        const gateEntry = credentialKeyForGate ? await readCredentialEntry(credentialKeyForGate, deps.env, nowMs).catch(
-          () => void 0
-        ) : void 0;
         const gateDecision = resolveCooldownGate(
           {
             nextAvailableAt: effectiveNextAvailableAt,
@@ -12492,8 +12601,9 @@ function createCliLocalRuntimeAdapter(deps) {
             `agent temporarily unavailable until ${new Date(Number(effectiveNextAvailableAt)).toISOString()}`
           );
         }
-        if (gateDecision === "probe" && credentialKeyForGate) {
-          await recordCredentialProbe(credentialKeyForGate, deps.env, nowMs).catch(
+        const activeKeyForGate = gateEntry?.matchedKey || credentialKeyForGate;
+        if (gateDecision === "probe" && activeKeyForGate) {
+          await recordCredentialProbe(activeKeyForGate, deps.env, nowMs).catch(
             () => void 0
           );
         }
@@ -12844,6 +12954,7 @@ export {
   saveCliDialogSummary,
   loadCliDialogLastContextUsage,
   resolveLocalInstaboxToolRoute,
+  buildSafeBodyPreview,
   recordLocalAvailabilityForAgent,
   setCliAutoCompactionSummaryFallback,
   getCliAutoCompactionSummaryFallback,

package/{chunk-N665S3Z2.js → chunk-XI677N45.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-NBTY7YJF.js";
 import {
   resolveCliLocalRuntimeKeyCapability
-} from "./chunk-YTWGTCVW.js";
+} from "./chunk-NPTROADE.js";
 import {
   HIGH_RISK_MUTATION_TOOL_NAMES
-} from "./chunk-3M52COK5.js";
+} from "./chunk-SLAZGVZN.js";
 import {
   DEFAULT_NOLO_SERVER_URL
 } from "./chunk-OLZBQWZU.js";