nolo-cli 0.188.0-alpha.2 → 0.188.0

package/{chunk-HVV4B6OL.js → chunk-ADTJJVDJ.js}

@@ -145,7 +145,7 @@ import {
   resolveEmptyAssistantFallbackMessage,
   resolveEmptyAssistantOutcome,
   resolveTruncatedReasoningTailLog
-} from "./chunk-S4W4GV3B.js";
+} from "./chunk-K6TZSON4.js";
 import {
   COMPACTION_SUMMARY_SCHEMA_VERSION,
   COMPACTION_SUMMARY_SYSTEM_PROMPT,
@@ -12720,8 +12720,8 @@ function sanitizeToolCallPairing(messages) {
 }
 
 // packages/agent-runtime/toolSpillStore.ts
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { constants, copyFileSync, createReadStream, existsSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import { isAbsolute, join as join2, relative } from "node:path";
 var DEFAULT_MAX_SPILL_DIR_BYTES = 50 * 1024 * 1024;
 var DEFAULT_SPILL_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -12747,6 +12747,127 @@ function countLines(text2) {
   }
   return lines;
 }
+var SPILL_PUBLICATION_GRACE_MS = 6e4;
+async function hashFileStreaming(path) {
+  const hash2 = createHash("sha256");
+  await new Promise((resolve7, reject) => {
+    const stream = createReadStream(path);
+    stream.on("data", (chunk) => hash2.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", () => resolve7());
+  });
+  return hash2.digest("hex");
+}
+async function promoteToolSpillFile(sourcePath, options) {
+  const injected = options?.ops ?? {};
+  const ops = {
+    now: injected.now ?? (() => Date.now()),
+    statSize: injected.statSize ?? ((path) => statSync(path).size),
+    rename: injected.rename ?? ((from, to) => renameSync(from, to)),
+    copyExclusive: injected.copyExclusive ?? ((from, to) => {
+      copyFileSync(from, to, constants.COPYFILE_EXCL);
+    }),
+    unlink: injected.unlink ?? ((path) => unlinkSync(path)),
+    exists: injected.exists ?? ((path) => existsSync(path)),
+    mkdirp: injected.mkdirp ?? ((dir) => mkdirSync(dir, { recursive: true })),
+    touch: injected.touch ?? ((path, atMs) => {
+      const at = new Date(atMs);
+      utimesSync(path, at, at);
+    }),
+    hashFile: injected.hashFile ?? hashFileStreaming,
+    cleanup: injected.cleanup ?? ((dir) => cleanupExpiredSpills(dir, { throttleMs: 0 })),
+    randomId: injected.randomId ?? (() => randomUUID())
+  };
+  const preservedIfPresent = () => {
+    try {
+      return ops.exists(sourcePath) ? sourcePath : void 0;
+    } catch {
+      return sourcePath;
+    }
+  };
+  let size3 = 0;
+  try {
+    size3 = ops.statSize(sourcePath);
+  } catch {
+    const preservedPath = preservedIfPresent();
+    return preservedPath ? { ok: false, reason: "unverified", preservedPath } : { ok: false, reason: "missing" };
+  }
+  if (size3 <= 0) return { ok: false, reason: "empty" };
+  let expectedHash = "";
+  try {
+    expectedHash = await ops.hashFile(sourcePath);
+  } catch {
+    const preservedPath = preservedIfPresent();
+    return preservedPath ? { ok: false, reason: "unverified", preservedPath } : { ok: false, reason: "missing" };
+  }
+  const workspaceRoot = options?.workspaceRoot;
+  const candidateDirs = Array.from(
+    new Set(
+      [
+        resolveSpillDirectory({ workspaceRoot }),
+        resolveNoloStateDir("spills")
+      ].filter(Boolean)
+    )
+  );
+  for (const dir of candidateDirs) {
+    const id = ops.randomId();
+    const final = join2(dir, `spill-execshell-${id}.log`);
+    const stage = join2(dir, `.spill-execshell-${id}.${ops.randomId()}.copying`);
+    let stageOwnedByMove = false;
+    let stageOwnedByCopy = false;
+    try {
+      ops.mkdirp(dir);
+      try {
+        ops.rename(sourcePath, stage);
+        stageOwnedByMove = true;
+      } catch (error) {
+        if (error?.code !== "EXDEV") throw error;
+        ops.copyExclusive(sourcePath, stage);
+        stageOwnedByCopy = true;
+      }
+      const actualHash = await ops.hashFile(stage);
+      if (actualHash !== expectedHash) throw new Error("spill verification failed");
+      ops.touch(stage, ops.now());
+      ops.rename(stage, final);
+      if (ops.exists(sourcePath)) {
+        try {
+          ops.unlink(sourcePath);
+        } catch {
+        }
+      }
+      try {
+        ops.cleanup(dir);
+      } catch {
+      }
+      const displayPath = workspaceRoot && isAbsolute(workspaceRoot) && dir === candidateDirs[0] ? (() => {
+        const rel = relative(workspaceRoot, final);
+        return !rel.startsWith("..") && !isAbsolute(rel) ? rel : final;
+      })() : final;
+      return { ok: true, spillPath: final, displayPath };
+    } catch {
+      if (stageOwnedByCopy) {
+        try {
+          ops.unlink(stage);
+        } catch {
+        }
+        continue;
+      }
+      if (stageOwnedByMove) {
+        try {
+          ops.rename(stage, sourcePath);
+          continue;
+        } catch {
+          return { ok: false, reason: "publish-failed", preservedPath: stage };
+        }
+      }
+    }
+  }
+  return {
+    ok: false,
+    reason: "publish-failed",
+    preservedPath: preservedIfPresent()
+  };
+}
 function cleanupExpiredSpills(spillDir, options) {
   if (!existsSync(spillDir)) return;
   const throttleMs = options?.throttleMs ?? 0;
@@ -12773,14 +12894,16 @@ function cleanupExpiredSpills(spillDir, options) {
       const fullPath = join2(spillDir, entry.name);
       try {
         const stats = statSync(fullPath);
-        if (now - stats.mtimeMs > maxAge || isOrphanTmp) {
+        const protectedByPublication = isSpillLog && entry.name.startsWith("spill-execshell-") && now - stats.mtimeMs < SPILL_PUBLICATION_GRACE_MS;
+        if (!protectedByPublication && (now - stats.mtimeMs > maxAge || isOrphanTmp)) {
           unlinkSync(fullPath);
         } else {
           spillFiles.push({
             name: entry.name,
             fullPath,
             mtimeMs: stats.mtimeMs,
-            size: stats.size
+            size: stats.size,
+            protectedByPublication
           });
         }
       } catch {
@@ -12791,6 +12914,7 @@ function cleanupExpiredSpills(spillDir, options) {
       spillFiles.sort((a, b) => a.mtimeMs - b.mtimeMs);
       for (const file of spillFiles) {
         if (totalSize <= maxBytes) break;
+        if (file.protectedByPublication) continue;
         try {
           unlinkSync(file.fullPath);
           totalSize -= file.size;
@@ -14311,10 +14435,10 @@ function detectExecShellSynchronousWarnings(command, shell) {
 }
 
 // packages/agent-runtime/workspaceShell.ts
-import { createWriteStream, mkdirSync as mkdirSync2 } from "node:fs";
+import { createWriteStream, mkdirSync as mkdirSync2, rmSync } from "node:fs";
 import { dirname, join as join4, resolve } from "node:path";
 import { spawn as spawnChildProcess } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { tmpdir } from "node:os";
 
 // packages/agent-runtime/runtimeCompat.ts
@@ -15251,11 +15375,18 @@ function truncateToolOutput(value, limit = 2e4, options) {
 ${tail}`;
 }
 var DEFAULT_MAX_STREAM_BUFFER_BYTES = 5 * 1024 * 1024;
+function removeSpillFile(path) {
+  try {
+    rmSync(path, { force: true });
+  } catch {
+  }
+}
 function readNodeStream(stream, maxBytesOrOptions = DEFAULT_MAX_STREAM_BUFFER_BYTES) {
   if (!stream) return Promise.resolve("");
   const options = typeof maxBytesOrOptions === "number" ? { maxBytes: maxBytesOrOptions } : maxBytesOrOptions ?? {};
   const maxBytes = typeof options.maxBytes === "number" && Number.isFinite(options.maxBytes) && options.maxBytes >= 0 ? options.maxBytes : DEFAULT_MAX_STREAM_BUFFER_BYTES;
   const spillPath = asOptionalTrimmedString(options.spillPath);
+  const spillRetention = options.spillRetention ?? "keep";
   const createSink = options.spillSinkFactory ?? ((path) => createWriteStream(path));
   return new Promise((resolveStream, rejectStream) => {
     const chunks2 = [];
@@ -15264,6 +15395,8 @@ function readNodeStream(stream, maxBytesOrOptions = DEFAULT_MAX_STREAM_BUFFER_BY
     let truncated = false;
     let spillState = spillPath ? "idle" : "disabled";
     let spillError = null;
+    let spillRetainedPath = null;
+    let sourceEnded = false;
     let spillSink = null;
     let sourcePausedForSpill = false;
     let sinkFinished = false;
@@ -15344,20 +15477,42 @@ function readNodeStream(stream, maxBytesOrOptions = DEFAULT_MAX_STREAM_BUFFER_BY
       for (const head3 of headChunks) writeToSink(head3);
       writeToSink(crossingChunk);
     };
+    const settleSpillRetention = async () => {
+      if (!spillPath || spillRetention === "keep") {
+        if (spillPath && spillRetention === "keep" && spillState === "ok") {
+          spillRetainedPath = spillPath;
+        }
+        return;
+      }
+      if (spillRetention === "promote" && spillState === "ok" && sourceEnded) {
+        const promoted = await promoteToolSpillFile(spillPath, {
+          workspaceRoot: options.spillWorkspaceRoot
+        });
+        if (promoted.ok) {
+          spillRetainedPath = promoted.displayPath;
+          return;
+        }
+        if (promoted.preservedPath) {
+          return;
+        }
+      }
+      removeSpillFile(spillPath);
+    };
     const finalize2 = (wasTruncated) => {
       if (settled) return;
       settled = true;
       const truncatedNow = wasTruncated || truncated;
       const baseText = Buffer.concat(chunks2).toString("utf8");
-      const done4 = () => {
+      const done4 = async () => {
+        await settleSpillRetention();
         let text2 = baseText;
         if (truncatedNow) {
           const notes = [`output exceeded ${formatLimit} buffer limit`];
-          if (spillState === "ok") {
-            notes.push(`full output: ${spillPath}`);
+          if (spillRetainedPath && sourceEnded) {
+            notes.push(`full output: ${spillRetainedPath}`);
           } else if (spillPath) {
             notes.push(
-              `spill failed${spillError ? ` (${spillError})` : ""}; output incomplete`
+              spillState === "failed" ? `spill failed${spillError ? ` (${spillError})` : ""}; output incomplete` : `spill output not retained; output incomplete`
             );
           }
           text2 += `
@@ -15368,7 +15523,7 @@ function readNodeStream(stream, maxBytesOrOptions = DEFAULT_MAX_STREAM_BUFFER_BY
       };
       const sink = spillSink;
       if (!sink || spillState !== "open") {
-        done4();
+        void done4();
         return;
       }
       let closed = false;
@@ -15380,7 +15535,7 @@ function readNodeStream(stream, maxBytesOrOptions = DEFAULT_MAX_STREAM_BUFFER_BY
         } else if (spillState === "open") {
           spillState = "ok";
         }
-        done4();
+        void done4();
       };
       if (sink.destroyed === true) {
         settleSink(true, new Error("spill writable closed before finish"));
@@ -15434,9 +15589,13 @@ function readNodeStream(stream, maxBytesOrOptions = DEFAULT_MAX_STREAM_BUFFER_BY
         }
       }
       resumeSourceIfPaused();
+      void settleSpillRetention();
       rejectStream(error);
     });
-    stream.on("end", () => finalize2(false));
+    stream.on("end", () => {
+      sourceEnded = true;
+      finalize2(false);
+    });
     stream.on("close", () => finalize2(false));
   });
 }
@@ -15547,10 +15706,18 @@ async function runWorkspaceCommand(args2) {
   };
   exitPromise.then(detachSignalCleanup, detachSignalCleanup);
   const stdoutCapture = stdoutPromiseResult(
-    readNodeStream(proc.stdout, { spillPath: join4(tmpdir(), `nolo-stream-${randomUUID()}.log`) })
+    readNodeStream(proc.stdout, {
+      spillPath: join4(tmpdir(), `nolo-stream-${randomUUID2()}.log`),
+      spillRetention: "promote",
+      spillWorkspaceRoot: args2.workspaceRoot
+    })
   );
   const stderrCapture = stdoutPromiseResult(
-    readNodeStream(proc.stderr, { spillPath: join4(tmpdir(), `nolo-stream-${randomUUID()}-stderr.log`) })
+    readNodeStream(proc.stderr, {
+      spillPath: join4(tmpdir(), `nolo-stream-${randomUUID2()}-stderr.log`),
+      spillRetention: "promote",
+      spillWorkspaceRoot: args2.workspaceRoot
+    })
   );
   const killChild = (signal) => {
     if (detached && typeof proc.pid === "number") {
@@ -15967,18 +16134,18 @@ import { createHash as createHash4 } from "node:crypto";
 import { createRequire } from "node:module";
 import { existsSync as existsSync4 } from "node:fs";
 import { realpath, stat, readFile } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative2, win32 } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative3, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { lookup as lookup2 } from "node:dns/promises";
 import { isIP } from "node:net";
 function isVisualPathOutside(rel) {
-  return rel === ".." || /^\.\.[\\/]/.test(rel) || isAbsolute2(rel) || win32.isAbsolute(rel);
+  return rel === ".." || /^\.\.[\\/]/.test(rel) || isAbsolute3(rel) || win32.isAbsolute(rel);
 }
 async function validateVisualUrl(input, workspaceRoot) {
   const url = new URL(input);
   if (url.protocol === "file:") {
     const [root, path] = await Promise.all([realpath(workspaceRoot), realpath(fileURLToPath(url))]);
-    const rel = relative2(root, path);
+    const rel = relative3(root, path);
     if (isVisualPathOutside(rel)) throw new Error("Renderer file URL is outside workspaceRoot.");
     if (!(await stat(path)).isFile()) throw new Error("Renderer file URL must point to a file, not a directory.");
     return pathToFileURL(path);
@@ -16052,10 +16219,10 @@ async function renderVisualPage(args2) {
   if (typeof args2.persistScreenshot !== "function") {
     throw new Error("renderVisualPage: persistScreenshot is required (expected a function that stores the PNG bytes)");
   }
-  if (!isAbsolute2(args2.workspaceRoot)) {
+  if (!isAbsolute3(args2.workspaceRoot)) {
     throw new Error("renderVisualPage: workspaceRoot must be an absolute path");
   }
-  if (!isAbsolute2(args2.screenshotPath) || !relative2(args2.workspaceRoot, args2.screenshotPath) || isVisualPathOutside(relative2(args2.workspaceRoot, args2.screenshotPath))) {
+  if (!isAbsolute3(args2.screenshotPath) || !relative3(args2.workspaceRoot, args2.screenshotPath) || isVisualPathOutside(relative3(args2.workspaceRoot, args2.screenshotPath))) {
     throw new Error("renderVisualPage: screenshotPath must be a file path inside workspaceRoot");
   }
   if (args2.timeoutMs !== void 0 && (typeof args2.timeoutMs !== "number" || !Number.isFinite(args2.timeoutMs) || args2.timeoutMs <= 0)) {
@@ -16312,7 +16479,7 @@ var captureHostWindow = createHostWindowCapture();
 // packages/agent-runtime/localWorkspaceTools.ts
 import { lstat as lstat2, readdir as readdir2, readFile as readFile4, realpath as realpath3, stat as stat4 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname3, relative as relative5, resolve as resolve5, sep as sep2 } from "node:path";
+import { dirname as dirname3, relative as relative6, resolve as resolve5, sep as sep2 } from "node:path";
 import { spawn as spawnChildProcess3 } from "node:child_process";
 
 // packages/core/readRangeLedger.ts
@@ -16349,7 +16516,7 @@ function isLineRangeCovered(request3, covered) {
 
 // packages/agent-runtime/fileTextSearch.ts
 import { readdir, readFile as readFile3, stat as stat3 } from "node:fs/promises";
-import { basename, relative as relative3, resolve as resolve3 } from "node:path";
+import { basename, relative as relative4, resolve as resolve3 } from "node:path";
 import { spawn as spawnChildProcess2 } from "node:child_process";
 
 // packages/agent-runtime/gitignore.ts
@@ -16376,7 +16543,7 @@ async function hasRootGitignore(workspaceRoot) {
 
 // packages/agent-runtime/fileTextSearch.ts
 var normalizePath = (value) => value.replaceAll("\\", "/");
-var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative3(root, file) || basename(file));
+var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative4(root, file) || basename(file));
 var COMMAND_LIMIT_HEADROOM = 1;
 async function runCommand(binary, args2, cwd, maxResults) {
   const recordLimit = maxResults === void 0 ? 0 : Math.max(0, maxResults) + COMMAND_LIMIT_HEADROOM;
@@ -17191,10 +17358,10 @@ function filterDeclaredWorkspaceToolNames(args2) {
 // packages/agent-runtime/workspacePathGuard.ts
 import { constants as fsConstants } from "node:fs";
 import { lstat, mkdir, open, readlink, realpath as realpath2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute3, join as join5, relative as relative4, resolve as resolve4, sep } from "node:path";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute4, join as join5, relative as relative5, resolve as resolve4, sep } from "node:path";
 function isPathInsideRoot(root, targetPath) {
-  const rel = relative4(resolve4(root), resolve4(targetPath));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute3(rel);
+  const rel = relative5(resolve4(root), resolve4(targetPath));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute4(rel);
 }
 function isNotFoundError(error) {
   const code = error?.code;
@@ -17281,7 +17448,7 @@ async function resolveOpenedFilePath(handle) {
   for (const root of FD_LINK_ROOTS) {
     try {
       const linked = await readlink(`${root}/${handle.fd}`);
-      if (isAbsolute3(linked)) return linked.replace(/ \(deleted\)$/, "");
+      if (isAbsolute4(linked)) return linked.replace(/ \(deleted\)$/, "");
     } catch {
     }
   }
@@ -17590,11 +17757,11 @@ function parseWorkspaceToolArguments(raw) {
   }
 }
 function normalizeWorkspaceRelativePath(args2) {
-  const relativePath = relative5(args2.workspaceRoot, args2.targetPath);
+  const relativePath = relative6(args2.workspaceRoot, args2.targetPath);
   return relativePath || ".";
 }
 function isPathInsideWorkspace(args2) {
-  const relativePath = relative5(args2.workspaceRoot, args2.targetPath);
+  const relativePath = relative6(args2.workspaceRoot, args2.targetPath);
   return relativePath === "" || !relativePath.startsWith("..") && !relativePath.includes(`..${sep2}`);
 }
 var PATH_FIELD_ALIASES = ["path", "file_path", "filePath", "filename", "file", "target_file", "targetFile", "file_to_read", "fileToRead", "target_path", "read_path", "path_to_read", "pathToRead"];
@@ -18258,7 +18425,7 @@ async function listWorkspaceEntries(args2) {
       if (truncated) break;
       const absolutePath = resolve5(dirPath, name);
       const info = await stat4(absolutePath);
-      const relativePath = relative5(args2.dirPath, absolutePath) || ".";
+      const relativePath = relative6(args2.dirPath, absolutePath) || ".";
       const isDirectory = info.isDirectory();
       entries.push(isDirectory ? `${relativePath}/` : relativePath);
       if (args2.maxResults && entries.length >= args2.maxResults) {
@@ -19873,7 +20040,7 @@ var normalizeContextBlockScopes = (legacyBlocks = void 0, scopes = void 0) => {
 };
 
 // packages/agent-runtime/localAutoCompaction.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 function toPlanCompressionMessages(history) {
   return history.map((message, index) => ({
     id: typeof message.id === "string" && message.id.length > 0 ? message.id : `local-${index}`,
@@ -20108,7 +20275,7 @@ async function maybeAutoCompactLocalHistory(args2) {
     };
   }
   emitPhase({ kind: "compaction-start" });
-  const compactionAttemptId = randomUUID2();
+  const compactionAttemptId = randomUUID3();
   let compactionT0 = Date.now();
   let compactionInputTokens;
   let compactionPrevSummaryTokens;
@@ -22985,7 +23152,7 @@ function buildLoadSkillExecutor(args2) {
     const { resolveSkillByName } = await import("./skillDiscovery-F3TMVQOJ.js");
     const resolved = resolveSkillByName(args2.cwd, name);
     if (!resolved) {
-      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-2VN6JG4U.js");
+      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-7MBUY5EY.js");
       const builtin = resolveBuiltinSkillByName(name);
       if (builtin) {
         return {
@@ -23063,7 +23230,7 @@ function resolveSessionKey(args2) {
 }
 
 // packages/agent-runtime/devin/devinProvider.ts
-import { randomBytes, randomUUID as randomUUID3 } from "node:crypto";
+import { randomBytes, randomUUID as randomUUID4 } from "node:crypto";
 var CLIENT_NAME = "chisel";
 var CLIENT_VERSION = "3000.11.3";
 function writeVarint(fieldNum, value) {
@@ -23123,7 +23290,7 @@ function encodeDevinClientMetadata(token) {
   ]);
 }
 function devinId(id, purpose) {
-  return id?.sessionKey && isStableSessionIdentityEnabled() ? deriveStableUuid(id.sessionKey, purpose) : randomUUID3();
+  return id?.sessionKey && isStableSessionIdentityEnabled() ? deriveStableUuid(id.sessionKey, purpose) : randomUUID4();
 }
 function encodeDevinChatMessage(msg, identity2, index = 0) {
   const source = msg.role === "assistant" ? 2 : msg.role === "tool" ? 4 : 1;
@@ -23217,7 +23384,7 @@ ${item.text}`;
   const chatMessageBuffers = coalesced.map((m, i) => encodeDevinChatMessage(m, identity2, i));
   const completionConfig = buildCompletionConfig({ temperature });
   const modelConfig = Buffer.concat([
-    writeStringField(1, randomUUID3()),
+    writeStringField(1, randomUUID4()),
     writeVarint(2, 1),
     writeVarint(3, 4)
   ]);
@@ -23229,7 +23396,7 @@ ${item.text}`;
     writeMessageField(8, completionConfig),
     ...tools.map((tool) => writeMessageField(10, encodeDevinToolDefinition(tool))),
     writeMessageField(15, modelConfig),
-    writeStringField(16, randomUUID3()),
+    writeStringField(16, randomUUID4()),
     writeVarint(20, 1),
     writeStringField(21, model)
   ]);
@@ -23600,17 +23767,17 @@ function createDevinProvider(options) {
 }
 
 // packages/agent-runtime/executionLeaseValidation.ts
-import { isAbsolute as isAbsolute5, relative as relative6, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute6, relative as relative7, resolve as resolve6 } from "node:path";
 function withinRoot(root, child) {
-  if (!isAbsolute5(root) || !isAbsolute5(child)) return false;
+  if (!isAbsolute6(root) || !isAbsolute6(child)) return false;
   const canonicalRoot = resolve6(root);
   const canonicalChild = resolve6(child);
-  const suffix = relative6(canonicalRoot, canonicalChild);
-  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute5(suffix);
+  const suffix = relative7(canonicalRoot, canonicalChild);
+  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute6(suffix);
 }
 function subsetOf(allowed, actual) {
   return actual.every(
-    (root) => isAbsolute5(root) && allowed.some((parent) => withinRoot(parent, root))
+    (root) => isAbsolute6(root) && allowed.some((parent) => withinRoot(parent, root))
   );
 }
 function validateConfiguredRootExecutionLease(ticket, lease) {

package/{chunk-Y2ZDNW2H.js → chunk-B2N5GZBU.js}

@@ -53,7 +53,7 @@ import {
 import {
   fileKey,
   getFileIdFromKey
-} from "./chunk-WMHWFFTE.js";
+} from "./chunk-ECX3NKRD.js";
 import {
   ulid
 } from "./chunk-XJWWBO34.js";
@@ -782,7 +782,7 @@ var dbSlice = createSliceWithThunks({
     // 这里改成动态 import，运行期才解析，彻底断开这条边。
     share: create.asyncThunk(
       async (config, thunkApi) => {
-        const { shareResourceAction } = await import("./action-HQXK4ZT4.js");
+        const { shareResourceAction } = await import("./action-BHWB4MOK.js");
         return shareResourceAction(config, thunkApi);
       }
     ),

package/{chunk-7SJG5ZNX.js → chunk-B6EZB6DW.js}

@@ -4,7 +4,7 @@ import {
 import {
   patch,
   read
-} from "./chunk-Y2ZDNW2H.js";
+} from "./chunk-B2N5GZBU.js";
 import {
   DEVICE_LOCAL_OWNER_ID,
   isDeviceLocalSpaceBody

package/{chunk-H6FUDBS3.js → chunk-CGKSIL4D.js}

@@ -1,12 +1,12 @@
 import {
   addContentToSpace
-} from "./chunk-RGTPR57U.js";
+} from "./chunk-YARN6MCX.js";
 import {
   format,
   prepareAndPersistMessage,
   uiAskChoiceFunc,
   uiAskChoiceFunctionSchema
-} from "./chunk-RBVR7P3M.js";
+} from "./chunk-63JHZKGZ.js";
 import {
   formatISO
 } from "./chunk-ZRAU6T47.js";
@@ -16,7 +16,7 @@ import {
   removeCachedEntity,
   upsertSSREntity,
   write
-} from "./chunk-Y2ZDNW2H.js";
+} from "./chunk-B2N5GZBU.js";
 import {
   isDevelopment
 } from "./chunk-6Q7UTJKR.js";
@@ -25,7 +25,7 @@ import {
 } from "./chunk-PXYBUFDB.js";
 import {
   buildBuiltinObjectSkillReference
-} from "./chunk-OXOXPREC.js";
+} from "./chunk-SM56M7N7.js";
 import {
   extractCustomId
 } from "./chunk-M2EJHDJP.js";
@@ -37,7 +37,7 @@ import {
   createMemoryKey,
   memoryOwnerRange,
   memorySubjectKindRange
-} from "./chunk-WMHWFFTE.js";
+} from "./chunk-ECX3NKRD.js";
 import {
   createDialogKey,
   dialogMessageRange

package/{chunk-CLGAGPEM.js → chunk-CNMQATUF.js}

@@ -21,7 +21,7 @@ import {
   sanitizeShareData,
   shareKey,
   toNonEmptyString
-} from "./chunk-WMHWFFTE.js";
+} from "./chunk-ECX3NKRD.js";
 
 // packages/share/action.ts
 var generateToken = () => {

package/{chunk-ER4UTWWS.js → chunk-DFF6B7P7.js}

@@ -7,7 +7,7 @@ import {
 import {
   patch,
   selectById
-} from "./chunk-Y2ZDNW2H.js";
+} from "./chunk-B2N5GZBU.js";
 
 // packages/chat/dialog/actions/setDialogExtraReferencesAction.ts
 var setDialogExtraReferencesAction = async (extraReferences, thunkApi) => {

package/{chunk-WMHWFFTE.js → chunk-ECX3NKRD.js}

@@ -2990,6 +2990,47 @@ var createTokenKey = {
     end: createKey("token", userId, "\uFFFF")
   })
 };
+var TOKEN_DIALOG_INDEX_PREFIX = "idx-token-dialog";
+var encodeTokenIndexSegment = (segment) => {
+  let out = "";
+  for (const ch of segment) {
+    if (/[A-Za-z0-9]/.test(ch)) {
+      out += ch;
+      continue;
+    }
+    for (const byte of new TextEncoder().encode(ch)) {
+      out += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+  }
+  return out;
+};
+var createTokenDialogIndexKey = Object.assign(
+  (userId, dialogId, callId) => createKey(
+    TOKEN_DIALOG_INDEX_PREFIX,
+    encodeTokenIndexSegment(userId),
+    encodeTokenIndexSegment(dialogId),
+    encodeTokenIndexSegment(callId)
+  ),
+  {
+    /** 某个用户在某个对话下的全部索引项范围（范围扫描用） */
+    rangeOfDialog: (userId, dialogId) => ({
+      start: createKey(
+        TOKEN_DIALOG_INDEX_PREFIX,
+        encodeTokenIndexSegment(userId),
+        encodeTokenIndexSegment(dialogId),
+        ""
+      ),
+      end: createKey(
+        TOKEN_DIALOG_INDEX_PREFIX,
+        encodeTokenIndexSegment(userId),
+        encodeTokenIndexSegment(dialogId),
+        "\uFFFF"
+      )
+    })
+  }
+);
+var TOKEN_DIALOG_INDEX_FORMAT = "v2";
+var createTokenDialogBackfillKey = (userId) => createKey("idx-tokendlg-backfill", encodeTokenIndexSegment(userId));
 var createTokenStatsKey = Object.assign(
   (userId, dateKey) => createKey("token", "stats", "day", "user", userId, dateKey),
   {
@@ -3461,6 +3502,11 @@ export {
   memorySubjectKindRange,
   createTransactionKey,
   createTokenKey,
+  TOKEN_DIALOG_INDEX_PREFIX,
+  encodeTokenIndexSegment,
+  createTokenDialogIndexKey,
+  TOKEN_DIALOG_INDEX_FORMAT,
+  createTokenDialogBackfillKey,
   createTokenStatsKey,
   createTokenStatsAppliedKey,
   isTokenStatsKey,