nolo-cli 0.211.0 → 0.212.0-alpha.1

package/{agentListCommands-POKMEKMS.js → agentListCommands-HE7L2A6L.js}

@@ -10,61 +10,60 @@ import {
   listRemotePublicAgents,
   normalizeListedAgent,
   parseAgentListArgs
-} from "./chunk-ET2CWLIJ.js";
-import {
-  refreshSubscriptionQuotas
-} from "./chunk-YGILMZ7N.js";
+} from "./chunk-WXYLV624.js";
 import {
   buildSpaceLookup,
   getSpaceContentKeys
 } from "./chunk-ID4G2MAR.js";
 import {
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-4LEGTOSR.js";
+} from "./chunk-3AKFVZ2I.js";
+import {
+  refreshSubscriptionQuotas
+} from "./chunk-YGILMZ7N.js";
 import {
   getReadableCliDb
 } from "./chunk-J5JTMQIA.js";
-import {
-  queryUserRecords,
-  readDbRecord
-} from "./chunk-XDMGY5IU.js";
 import {
   applyCredentialAvailability,
   clearCredentialAvailabilityIfMarkedAt,
   readCredentialAvailability,
   readEffectiveCredentialEntry
 } from "./chunk-GSQNH63I.js";
-import "./chunk-7AUQ3WCW.js";
-import "./chunk-NBTY7YJF.js";
+import {
+  queryUserRecords,
+  readDbRecord
+} from "./chunk-IF45XG7K.js";
 import "./chunk-LKZPX6YH.js";
+import "./chunk-NBTY7YJF.js";
 import {
   buildAgentDiscoveryResult,
   matchesAgentQuery,
   resolvePaginationArgs,
   summarizeCredentialGroups,
   toDiscoverySafeAgentSummary
-} from "./chunk-YXOBCDNW.js";
+} from "./chunk-CJRONOYL.js";
 import "./chunk-OXME3PEE.js";
 import {
   resolveNoloHome
 } from "./chunk-GLKOYSRU.js";
 import "./chunk-UEILX4EV.js";
 import "./chunk-D2MDMY2M.js";
-import "./chunk-ZOO3WJIE.js";
+import "./chunk-FHU44LN3.js";
 import "./chunk-ZNFJWEN4.js";
-import "./chunk-NTSRCTUX.js";
-import "./chunk-TCTSYFDM.js";
+import "./chunk-4KH4J3G5.js";
+import "./chunk-CTPXME7U.js";
 import "./chunk-HNUWUO75.js";
 import "./chunk-CHOZJMJS.js";
 import "./chunk-PWTNI4N7.js";
 import "./chunk-Y63ZSOR6.js";
-import "./chunk-LNYHAKBP.js";
+import "./chunk-W4S457LU.js";
 import "./chunk-4KB6WQUL.js";
 import "./chunk-56GBUMO5.js";
-import "./chunk-W5VC7F7V.js";
-import "./chunk-CVCRAO6Q.js";
+import "./chunk-NOMIGOST.js";
+import "./chunk-UTV2AYEG.js";
 import "./chunk-E2BESSAW.js";
-import "./chunk-6HVBI6TI.js";
+import "./chunk-25JZEIXN.js";
 import {
   DEFAULT_PROVIDER_RETRY_MS,
   formatQuotaSummary,
@@ -74,34 +73,35 @@ import {
   resolveCredentialKeyWithFallback,
   shouldClearCooldownFromQuota
 } from "./chunk-YUXQAVRD.js";
+import "./chunk-KC4XDTT3.js";
 import "./chunk-2WZXXAQD.js";
-import "./chunk-DA7CTWT4.js";
+import "./chunk-YWSEPJ7C.js";
 import "./chunk-WJZOQR2J.js";
-import "./chunk-CKOO42G5.js";
+import "./chunk-UHJGXRJ4.js";
 import "./chunk-2MBTWINN.js";
-import "./chunk-WTKYP6QO.js";
-import "./chunk-5ZUL4CUO.js";
-import "./chunk-BTYQAODF.js";
+import "./chunk-JTDORD5P.js";
+import "./chunk-CZM5YTZ7.js";
 import "./chunk-H57T64RA.js";
+import "./chunk-5ZUL4CUO.js";
 import "./chunk-UKZX3NHN.js";
 import "./chunk-5MMAK75Q.js";
-import "./chunk-TRZP7JZ7.js";
-import "./chunk-UIOEHFF6.js";
+import "./chunk-2QHFH3DR.js";
+import "./chunk-OQHIVPG4.js";
 import "./chunk-KX6YBIHG.js";
 import "./chunk-DWLEOOGR.js";
 import "./chunk-7DPNBQSV.js";
-import "./chunk-G7Y4GXTY.js";
+import "./chunk-T43B7LB2.js";
 import "./chunk-ZRSNONOB.js";
 import "./chunk-4VJAC32I.js";
-import "./chunk-AKE53VMW.js";
+import "./chunk-CJEIOP3E.js";
+import "./chunk-ZCWRMUWT.js";
 import "./chunk-ZC3CMUKU.js";
 import "./chunk-LOEO7LRC.js";
 import "./chunk-M2EJHDJP.js";
-import "./chunk-PLYWH7XM.js";
-import "./chunk-XPHZK3PJ.js";
+import "./chunk-KIM6CLW5.js";
+import "./chunk-JNKSDZFS.js";
 import "./chunk-PSCNXBYA.js";
-import "./chunk-6UBGXX2W.js";
-import "./chunk-PV6JJAUB.js";
+import "./chunk-TCZHTTUU.js";
 import "./chunk-YUA6OAH5.js";
 import "./chunk-SM3NSZJV.js";
 import "./chunk-JRTNUU5Z.js";
@@ -109,6 +109,8 @@ import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
 import "./chunk-KUG52IAP.js";
+import "./chunk-GOO6G4PY.js";
+import "./chunk-QSJ3HFEF.js";
 import {
   parseUserIdFromAuthToken,
   readOption,
@@ -124,25 +126,25 @@ import "./chunk-4O22PGNQ.js";
 import {
   t
 } from "./chunk-3RQVYR4B.js";
+import "./chunk-G7Y4GXTY.js";
+import "./chunk-6UBGXX2W.js";
 import {
   createKey,
   createTokenKey
-} from "./chunk-ECX3NKRD.js";
+} from "./chunk-JY5NGFFH.js";
 import "./chunk-XJWWBO34.js";
 import "./chunk-I42VC5KR.js";
 import "./chunk-U6VC4MU4.js";
 import "./chunk-WWC7I6TA.js";
 import "./chunk-3EUW3WEO.js";
 import "./chunk-G3SUCT4W.js";
-import "./chunk-T43B7LB2.js";
-import "./chunk-GOO6G4PY.js";
-import "./chunk-QSJ3HFEF.js";
 import "./chunk-4VNS5WPM.js";
 
 // packages/ai/agent/speedSampleCache.ts
 var SPEED_SAMPLE_DISK_CACHE_TTL_MS = 10 * 6e4;
-var SPEED_SAMPLE_SCAN_BUDGET_MS = 8e3;
-var SPEED_SAMPLE_CACHE_VERSION = 1;
+var SPEED_SAMPLE_SCAN_BUDGET_MS = 2500;
+var SPEED_SAMPLE_CACHE_VERSION = 2;
+var SPEED_SAMPLE_LEGACY_CACHE_VERSION = 1;
 var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
 var sanitizeSample = (value) => {
   if (!value || typeof value !== "object") return null;
@@ -151,23 +153,25 @@ var sanitizeSample = (value) => {
   if (isFiniteNumber(sample.firstOutputMs)) clean.firstOutputMs = sample.firstOutputMs;
   if (isFiniteNumber(sample.callDurationMs)) clean.callDurationMs = sample.callDurationMs;
   if (isFiniteNumber(sample.output_tokens)) clean.output_tokens = sample.output_tokens;
+  if (isFiniteNumber(sample.t)) clean.t = sample.t;
   return clean.firstOutputMs === void 0 && clean.callDurationMs === void 0 ? null : clean;
 };
-async function readSpeedSamplesCache(cachePath, options) {
-  const ttlMs = isFiniteNumber(options.ttlMs) ? options.ttlMs : SPEED_SAMPLE_DISK_CACHE_TTL_MS;
+var SPEED_SAMPLE_STALE_SNAPSHOT_MAX_MS = 7 * 24 * 60 * 6e4;
+async function parseCacheFile(cachePath, userId) {
   try {
     const fs = await import("node:fs/promises");
     const raw = await fs.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return null;
-    if (parsed.version !== SPEED_SAMPLE_CACHE_VERSION) return null;
-    if (parsed.userId !== options.userId) return null;
+    const version = parsed.version;
+    if (version !== SPEED_SAMPLE_CACHE_VERSION && version !== SPEED_SAMPLE_LEGACY_CACHE_VERSION) {
+      return null;
+    }
+    if (parsed.userId !== userId) return null;
     if (!isFiniteNumber(parsed.at)) return null;
-    const age = options.now - parsed.at;
-    if (age < 0 || age >= ttlMs) return null;
-    const samples = /* @__PURE__ */ new Map();
     const source = parsed.samples;
     if (!source || typeof source !== "object") return null;
+    const samples = /* @__PURE__ */ new Map();
     for (const [model, list] of Object.entries(source)) {
       if (!model || !Array.isArray(list)) continue;
       const cleaned = [];
@@ -177,17 +181,42 @@ async function readSpeedSamplesCache(cachePath, options) {
       }
       samples.set(model, cleaned);
     }
-    return samples;
+    const complete = version === SPEED_SAMPLE_LEGACY_CACHE_VERSION ? true : parsed.complete === true;
+    const cursor = typeof parsed.cursor === "string" && parsed.cursor.length > 0 ? parsed.cursor : void 0;
+    return { samples, at: parsed.at, complete, cursor: complete ? void 0 : cursor };
   } catch {
     return null;
   }
 }
+async function readSpeedSamplesSnapshot(cachePath, options) {
+  const maxAgeMs = isFiniteNumber(options.maxAgeMs) ? options.maxAgeMs : SPEED_SAMPLE_STALE_SNAPSHOT_MAX_MS;
+  const parsed = await parseCacheFile(cachePath, options.userId);
+  if (!parsed || !parsed.complete) return null;
+  const age = options.now - parsed.at;
+  if (age < 0 || age >= maxAgeMs) return null;
+  return { samples: parsed.samples, ageMs: age };
+}
+async function readSpeedSamplesProgress(cachePath, userId) {
+  const parsed = await parseCacheFile(cachePath, userId);
+  if (!parsed) return null;
+  return {
+    samples: parsed.samples,
+    at: parsed.at,
+    complete: parsed.complete,
+    ...parsed.cursor === void 0 ? {} : { cursor: parsed.cursor }
+  };
+}
+function resolveSpeedSamplesProgressPath(cachePath) {
+  return `${cachePath}.progress`;
+}
 async function writeSpeedSamplesCache(cachePath, payload) {
   try {
     const fs = await import("node:fs/promises");
     const path2 = await import("node:path");
     await fs.mkdir(path2.dirname(cachePath), { recursive: true });
-    await fs.writeFile(cachePath, JSON.stringify(payload), "utf8");
+    const tmpPath = `${cachePath}.tmp-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+    await fs.writeFile(tmpPath, JSON.stringify(payload), "utf8");
+    await fs.rename(tmpPath, cachePath);
   } catch {
   }
 }
@@ -242,18 +271,28 @@ function resolveCandidateSpeedFacts(models, samplesByModel) {
 }
 var formatSeconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
 var formatTps = (tps) => String(Math.round(tps));
-var SPEED_CONTEXT_HEADER = "speed (observed=\u672C\u7528\u6237\u6700\u8FD1\u8C03\u7528\u4E2D\u4F4D\u6570, firstOutput \u542B\u63A8\u7406\u8F93\u51FA; tps=generation\uFF08\u4E0D\u542B\u7AEF\u5230\u7AEF\u53E3\u5F84\uFF09, tps=n/a \u8868\u793A\u65E0\u53EF\u4FE1\u541E\u5410\u6837\u672C\u3002\u672A\u5217\u51FA\u7684 model \u8868\u793A\u6CA1\u6709\u5B9E\u6D4B\u6837\u672C\uFF0C\u4E0D\u4EE3\u8868\u6162):";
-function formatCandidateSpeedFacts(facts) {
+var SPEED_CONTEXT_HEADER = "speed (observed=\u672C\u7528\u6237\u5B9E\u6D4B\u8C03\u7528\u4E2D\u4F4D\u6570, firstOutput \u542B\u63A8\u7406\u8F93\u51FA; tps=generation\uFF08\u4E0D\u542B\u7AEF\u5230\u7AEF\u53E3\u5F84\uFF09, tps=n/a \u8868\u793A\u65E0\u53EF\u4FE1\u541E\u5410\u6837\u672C\u3002\u672A\u5217\u51FA\u7684 model \u8868\u793A\u6CA1\u6709\u5B9E\u6D4B\u6837\u672C\uFF0C\u4E0D\u4EE3\u8868\u6162):";
+function formatSnapshotAge(ageMs) {
+  const minutes = Math.floor(ageMs / 6e4);
+  if (minutes < 1) return "<1min";
+  if (minutes < 60) return `${minutes}min`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h`;
+  return `${Math.floor(hours / 24)}d`;
+}
+function formatCandidateSpeedFacts(facts, options = {}) {
   if (facts.length === 0) return null;
   const lines = facts.map((fact) => {
     const tps = fact.outputTps !== void 0 ? formatTps(fact.outputTps) : "n/a";
     return `  ${fact.model}: firstOutput=${formatSeconds(fact.firstOutputMs ?? 0)} tps=${tps} [observed n=${fact.firstOutputSamples ?? 0} tpsN=${fact.tpsSamples ?? 0}]`;
   });
-  return `${SPEED_CONTEXT_HEADER}
+  const age = options.snapshotAgeMs;
+  const note = typeof age === "number" && age > 0 ? `  (snapshot=${formatSnapshotAge(age)}\u524D\u91C7\u96C6\u7684\u5B8C\u6574\u7A97\u53E3, \u975E\u672C\u6B21\u5B9E\u65F6\u626B\u63CF)` : "";
+  return `${SPEED_CONTEXT_HEADER}${note}
 ${lines.join("\n")}`;
 }
-function buildCandidateSpeedContext(models, samplesByModel) {
-  return formatCandidateSpeedFacts(resolveCandidateSpeedFacts(models, samplesByModel));
+function buildCandidateSpeedContext(models, samplesByModel, options = {}) {
+  return formatCandidateSpeedFacts(resolveCandidateSpeedFacts(models, samplesByModel), options);
 }
 var SPEED_SAMPLE_PAGE_SIZE = 2e3;
 var eventTime = (value) => {
@@ -275,13 +314,14 @@ function collectSample(collected, value) {
   });
   collected.set(model, list);
 }
-function finalizeSamples(collected) {
+function finalizeSamples(collected, keepTime = false) {
   const result = /* @__PURE__ */ new Map();
   for (const [model, list] of collected) {
     list.sort((a, b) => b.t - a.t);
+    const window = list.slice(0, OBSERVED_SPEED_WINDOW);
     result.set(
       model,
-      list.slice(0, OBSERVED_SPEED_WINDOW).map(({ t: _t, ...sample }) => sample)
+      keepTime ? window : window.map(({ t: _t, ...sample }) => sample)
     );
   }
   return result;
@@ -293,8 +333,9 @@ async function collectRecentSpeedSamples(db, userId, options = {}) {
   const failedPrefix = createKey("token", userId, "failed-call", "");
   const collected = /* @__PURE__ */ new Map();
   const startedAt = Date.now();
-  let lastKey;
+  let lastKey = options.startAfter;
   let budgetExhausted = false;
+  let scanned = 0;
   while (true) {
     if (Date.now() - startedAt >= budgetMs) {
       budgetExhausted = true;
@@ -311,6 +352,7 @@ async function collectRecentSpeedSamples(db, userId, options = {}) {
       if (typeof key !== "string") continue;
       if (lastKey !== void 0 && key <= lastKey) continue;
       accepted += 1;
+      scanned += 1;
       newestKey = key;
       if (key.startsWith(failedPrefix)) continue;
       if (!raw || typeof raw !== "object") continue;
@@ -319,31 +361,75 @@ async function collectRecentSpeedSamples(db, userId, options = {}) {
     if (accepted === 0 || accepted < pageSize) break;
     lastKey = newestKey;
   }
-  return { samples: finalizeSamples(collected), budgetExhausted };
+  return {
+    samples: finalizeSamples(collected, options.keepTime === true),
+    budgetExhausted,
+    scanned,
+    ...budgetExhausted && lastKey !== void 0 ? { nextCursor: lastKey } : {}
+  };
 }
-async function loadRecentSpeedSamples(db, userId, options = {}) {
-  const { samples } = await collectRecentSpeedSamples(db, userId, options);
-  return samples;
+function mergeNewestSamples(into, from) {
+  for (const [model, list] of from) {
+    const merged = [...into.get(model) ?? [], ...list];
+    merged.sort(
+      (a, b) => (b.t ?? 0) - (a.t ?? 0)
+    );
+    into.set(model, merged.slice(0, OBSERVED_SPEED_WINDOW));
+  }
 }
 async function loadSpeedSamplesWithDiskCache(db, userId, now, cache) {
   try {
     const ttlMs = isFiniteNumber2(cache.ttlMs) ? cache.ttlMs : SPEED_SAMPLE_DISK_CACHE_TTL_MS;
-    const cached = await readSpeedSamplesCache(cache.cachePath, { userId, now, ttlMs });
-    if (cached) return cached;
-    const { samples, budgetExhausted } = await collectRecentSpeedSamples(db, userId, {
-      pageSize: cache.pageSize,
-      budgetMs: isFiniteNumber2(cache.budgetMs) ? cache.budgetMs : SPEED_SAMPLE_SCAN_BUDGET_MS
-    });
-    if (budgetExhausted) return /* @__PURE__ */ new Map();
-    await writeSpeedSamplesCache(cache.cachePath, {
+    const snapshot = await readSpeedSamplesSnapshot(cache.cachePath, { userId, now });
+    if (snapshot && snapshot.ageMs < ttlMs) return { samples: snapshot.samples };
+    const progressPath = resolveSpeedSamplesProgressPath(cache.cachePath);
+    const progress = await readSpeedSamplesProgress(progressPath, userId);
+    const resumable = progress && !progress.complete && progress.cursor ? progress : void 0;
+    const collected = new Map(resumable?.samples ?? []);
+    let step;
+    try {
+      step = await collectRecentSpeedSamples(db, userId, {
+        pageSize: cache.pageSize,
+        budgetMs: isFiniteNumber2(cache.budgetMs) ? cache.budgetMs : SPEED_SAMPLE_SCAN_BUDGET_MS,
+        keepTime: true,
+        ...resumable?.cursor ? { startAfter: resumable.cursor } : {}
+      });
+    } catch {
+      return snapshot ? { samples: snapshot.samples, snapshotAgeMs: snapshot.ageMs } : { samples: /* @__PURE__ */ new Map() };
+    }
+    if (!resumable && step.scanned === 0 && !step.budgetExhausted) {
+      return snapshot ? { samples: snapshot.samples, snapshotAgeMs: snapshot.ageMs } : { samples: /* @__PURE__ */ new Map() };
+    }
+    mergeNewestSamples(collected, step.samples);
+    if (!step.budgetExhausted) {
+      await writeSpeedSamplesCache(cache.cachePath, {
+        version: SPEED_SAMPLE_CACHE_VERSION,
+        userId,
+        at: now,
+        complete: true,
+        samples: Object.fromEntries(collected)
+      });
+      await writeSpeedSamplesCache(progressPath, {
+        version: SPEED_SAMPLE_CACHE_VERSION,
+        userId,
+        at: now,
+        complete: true,
+        samples: {}
+      });
+      return { samples: collected };
+    }
+    await writeSpeedSamplesCache(progressPath, {
       version: SPEED_SAMPLE_CACHE_VERSION,
       userId,
-      at: now,
-      samples: Object.fromEntries(samples)
+      // Progress keeps the cycle's collection start so a later stale label stays honest.
+      at: resumable?.at ?? now,
+      complete: false,
+      samples: Object.fromEntries(collected),
+      ...step.nextCursor ? { cursor: step.nextCursor } : {}
     });
-    return samples;
+    return snapshot ? { samples: snapshot.samples, snapshotAgeMs: snapshot.ageMs } : { samples: /* @__PURE__ */ new Map() };
   } catch {
-    return /* @__PURE__ */ new Map();
+    return { samples: /* @__PURE__ */ new Map() };
   }
 }
 var samplesCache = /* @__PURE__ */ new Map();
@@ -359,12 +445,36 @@ function writeSamplesCache(userId, now, samples) {
     samplesCache.delete(oldest);
   }
 }
+var SPEED_SAMPLE_REFRESH_BUDGET_MS = 6e4;
+var snapshotRefreshes = /* @__PURE__ */ new Map();
+function startSpeedSnapshotRefresh(db, userId, now = Date.now()) {
+  const inFlight = snapshotRefreshes.get(userId);
+  if (inFlight) return inFlight;
+  const job = (async () => {
+    try {
+      const { samples, budgetExhausted } = await collectRecentSpeedSamples(db, userId, {
+        budgetMs: SPEED_SAMPLE_REFRESH_BUDGET_MS
+      });
+      if (!budgetExhausted) writeSamplesCache(userId, now, samples);
+    } catch {
+    }
+  })().finally(() => {
+    snapshotRefreshes.delete(userId);
+  });
+  snapshotRefreshes.set(userId, job);
+  return job;
+}
 async function loadCachedSpeedSamples(db, userId, now) {
   const hit = samplesCache.get(userId);
-  if (hit && now - hit.at < SPEED_SAMPLES_CACHE_TTL_MS) return hit.samples;
-  const samples = await loadRecentSpeedSamples(db, userId);
-  writeSamplesCache(userId, now, samples);
-  return samples;
+  if (hit) {
+    const age = now - hit.at;
+    if (age >= 0 && age < SPEED_SAMPLE_STALE_SNAPSHOT_MAX_MS) {
+      if (age >= SPEED_SAMPLES_CACHE_TTL_MS) void startSpeedSnapshotRefresh(db, userId);
+      return age >= SPEED_SAMPLES_CACHE_TTL_MS ? { samples: hit.samples, snapshotAgeMs: age } : { samples: hit.samples };
+    }
+  }
+  void startSpeedSnapshotRefresh(db, userId);
+  return { samples: /* @__PURE__ */ new Map() };
 }
 async function injectSpeedContextIntoListAgentsResult(result, options = {}) {
   try {
@@ -379,15 +489,18 @@ async function injectSpeedContextIntoListAgentsResult(result, options = {}) {
     if (models.length === 0) return result;
     const now = options.now ?? Date.now();
     let samples = /* @__PURE__ */ new Map();
+    let snapshotAgeMs;
     const userId = typeof options.userId === "string" ? options.userId.trim() : "";
     if (options.db && userId) {
       try {
-        samples = options.diskCache ? await loadSpeedSamplesWithDiskCache(options.db, userId, now, options.diskCache) : await loadCachedSpeedSamples(options.db, userId, now);
+        const loaded = options.diskCache ? await loadSpeedSamplesWithDiskCache(options.db, userId, now, options.diskCache) : await loadCachedSpeedSamples(options.db, userId, now);
+        samples = loaded.samples;
+        snapshotAgeMs = loaded.snapshotAgeMs;
       } catch {
         samples = /* @__PURE__ */ new Map();
       }
     }
-    const speedContext = buildCandidateSpeedContext(models, samples);
+    const speedContext = buildCandidateSpeedContext(models, samples, { snapshotAgeMs });
     return speedContext ? JSON.stringify({ ...parsed, speedContext }) : result;
   } catch {
     return result;

package/{agentMachineCommands-WJLZLBPI.js → agentMachineCommands-6TE4MBMP.js}

@@ -9,59 +9,59 @@ import {
   readAgentRecord,
   resolveAgentRecordFromHybridStore,
   writeAgentRecord
-} from "./chunk-XDMGY5IU.js";
-import "./chunk-7AUQ3WCW.js";
+} from "./chunk-IF45XG7K.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-NBTY7YJF.js";
 import "./chunk-NF64D32W.js";
 import "./chunk-3L2WKC3W.js";
-import "./chunk-ZOO3WJIE.js";
+import "./chunk-FHU44LN3.js";
 import "./chunk-ZNFJWEN4.js";
-import "./chunk-NTSRCTUX.js";
-import "./chunk-TCTSYFDM.js";
+import "./chunk-4KH4J3G5.js";
+import "./chunk-CTPXME7U.js";
 import "./chunk-HNUWUO75.js";
 import "./chunk-CHOZJMJS.js";
 import "./chunk-PWTNI4N7.js";
 import "./chunk-Y63ZSOR6.js";
-import "./chunk-LNYHAKBP.js";
+import "./chunk-W4S457LU.js";
 import "./chunk-4KB6WQUL.js";
 import "./chunk-56GBUMO5.js";
-import "./chunk-W5VC7F7V.js";
-import "./chunk-CVCRAO6Q.js";
+import "./chunk-NOMIGOST.js";
+import "./chunk-UTV2AYEG.js";
 import "./chunk-E2BESSAW.js";
-import "./chunk-6HVBI6TI.js";
+import "./chunk-25JZEIXN.js";
 import "./chunk-YUXQAVRD.js";
+import "./chunk-KC4XDTT3.js";
 import "./chunk-2WZXXAQD.js";
-import "./chunk-DA7CTWT4.js";
+import "./chunk-YWSEPJ7C.js";
 import "./chunk-WJZOQR2J.js";
-import "./chunk-CKOO42G5.js";
+import "./chunk-UHJGXRJ4.js";
 import "./chunk-2MBTWINN.js";
-import "./chunk-WTKYP6QO.js";
-import "./chunk-5ZUL4CUO.js";
-import "./chunk-BTYQAODF.js";
+import "./chunk-JTDORD5P.js";
+import "./chunk-CZM5YTZ7.js";
 import "./chunk-H57T64RA.js";
+import "./chunk-5ZUL4CUO.js";
 import "./chunk-UKZX3NHN.js";
 import "./chunk-5MMAK75Q.js";
-import "./chunk-TRZP7JZ7.js";
-import "./chunk-UIOEHFF6.js";
+import "./chunk-2QHFH3DR.js";
+import "./chunk-OQHIVPG4.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
 import "./chunk-DWLEOOGR.js";
 import "./chunk-7DPNBQSV.js";
-import "./chunk-G7Y4GXTY.js";
+import "./chunk-T43B7LB2.js";
 import "./chunk-ZRSNONOB.js";
 import "./chunk-4VJAC32I.js";
-import "./chunk-AKE53VMW.js";
+import "./chunk-CJEIOP3E.js";
+import "./chunk-ZCWRMUWT.js";
 import "./chunk-ZC3CMUKU.js";
 import "./chunk-LOEO7LRC.js";
 import "./chunk-M2EJHDJP.js";
-import "./chunk-PLYWH7XM.js";
-import "./chunk-XPHZK3PJ.js";
+import "./chunk-KIM6CLW5.js";
+import "./chunk-JNKSDZFS.js";
 import "./chunk-PSCNXBYA.js";
-import "./chunk-6UBGXX2W.js";
-import "./chunk-PV6JJAUB.js";
+import "./chunk-TCZHTTUU.js";
 import "./chunk-YUA6OAH5.js";
 import "./chunk-SM3NSZJV.js";
 import "./chunk-JRTNUU5Z.js";
@@ -69,6 +69,10 @@ import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
 import "./chunk-KUG52IAP.js";
+import "./chunk-GOO6G4PY.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
 import {
   parseUserIdFromAuthToken,
   readOption,
@@ -80,18 +84,15 @@ import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
 import "./chunk-4O22PGNQ.js";
-import "./chunk-ECX3NKRD.js";
+import "./chunk-G7Y4GXTY.js";
+import "./chunk-6UBGXX2W.js";
+import "./chunk-JY5NGFFH.js";
 import "./chunk-XJWWBO34.js";
 import "./chunk-I42VC5KR.js";
 import "./chunk-U6VC4MU4.js";
 import "./chunk-WWC7I6TA.js";
 import "./chunk-3EUW3WEO.js";
 import "./chunk-G3SUCT4W.js";
-import "./chunk-T43B7LB2.js";
-import "./chunk-GOO6G4PY.js";
-import {
-  asTrimmedLowercaseString
-} from "./chunk-QSJ3HFEF.js";
 import "./chunk-4VNS5WPM.js";
 
 // packages/cli/agentMachineCommands.ts
@@ -100,7 +101,7 @@ async function defaultExecuteCli(provider, prompt, options) {
   return executeCli(provider, prompt, options);
 }
 async function forwardConnectorRunMessage(machine, message, pushMessage, executeCli, env, fetchImpl) {
-  const { handleConnectorRunMessage } = await import("./machineWsRunDispatch-F2ZIXMYM.js");
+  const { handleConnectorRunMessage } = await import("./machineWsRunDispatch-R26P5V36.js");
   return handleConnectorRunMessage(message, pushMessage, executeCli, env, fetchImpl);
 }
 async function detectLaunchableMachineInfo() {

package/{agentProviderCommands-MN3ABDME.js → agentProviderCommands-Q5O33MED.js}

@@ -1,3 +1,6 @@
+import {
+  normalizeOrigin
+} from "./chunk-XFYFMTOM.js";
 import {
   customNativeAuthHeaders,
   detectDeclaredCustomNativeWire
@@ -71,7 +74,7 @@ ${AGENT_MODELS_USAGE}`);
       let diagnostic;
       if (res.status === 409 || body?.code === "PRESET_NOT_WHITELISTED") {
         try {
-          const { ALL_PROVIDER_REGISTRY } = await import("./providerRegistry-E34XWDLJ.js");
+          const { ALL_PROVIDER_REGISTRY } = await import("./providerRegistry-S6UL6UNA.js");
           const provider = ALL_PROVIDER_REGISTRY.find((p) => p.id === presetId) ?? ALL_PROVIDER_REGISTRY.find((p) => p.provider === presetId);
           const isOpenAICompatBearer = provider && provider.kind === "api_key_template" && "baseUrl" in provider && typeof provider.baseUrl === "string" && provider.baseUrl && (!("apiKeyHeader" in provider) || !provider.apiKeyHeader || provider.apiKeyHeader.toLowerCase() === "authorization");
           if (isOpenAICompatBearer) {
@@ -241,10 +244,26 @@ function extractVerifyReply(data) {
   if (responsesReply) return responsesReply;
   return (data.content ?? []).map((part) => typeof part?.text === "string" ? part.text : "").join("").trim();
 }
+function redactVerifyReason(error, apiKey) {
+  const raw = toErrorMessage(error);
+  if (!apiKey) return raw;
+  return raw.split(apiKey).join("[REDACTED:SECRET]");
+}
 async function verifyCustomProvider(options) {
   const { providerUrl, apiKey, model, prompt = "\u53EA\u56DE\u590D OK" } = options;
   const fetchImpl = options.fetchImpl ?? fetch;
   const provider = providerUrl?.replace(/\/+$/, "") ?? "";
+  if (options.allowedOrigin) {
+    const origin = normalizeOrigin(provider);
+    if (!origin || origin !== options.allowedOrigin) {
+      return {
+        ok: false,
+        providerUrl: provider,
+        model,
+        reason: "blocked-cross-origin: request target is not the authorized provider origin"
+      };
+    }
+  }
   if (!provider || !apiKey || !model) {
     return {
       ok: false,
@@ -266,13 +285,23 @@ async function verifyCustomProvider(options) {
     const res = await fetchImpl(targetUrl, {
       method: "POST",
       headers,
-      body: JSON.stringify(probeBody)
+      body: JSON.stringify(probeBody),
+      ...options.allowedOrigin ? { redirect: "manual" } : {}
     });
+    if (options.allowedOrigin && res.status >= 300 && res.status < 400) {
+      return {
+        ok: false,
+        status: res.status,
+        providerUrl: provider,
+        model,
+        reason: "blocked-redirect: provider answered with a redirect"
+      };
+    }
     const data = await res.json().catch(() => null);
     const reply = extractVerifyReply(data);
     return { ok: res.ok, status: res.status, providerUrl: provider, model, reply };
   } catch (error) {
-    return { ok: false, providerUrl: provider, model, reason: toErrorMessage(error) };
+    return { ok: false, providerUrl: provider, model, reason: redactVerifyReason(error, apiKey) };
   }
 }
 async function runAgentProvidersCommand(args, deps = {}) {
@@ -287,7 +316,7 @@ async function runAgentProvidersCommand(args, deps = {}) {
     const {
       CUSTOM_API_KEY_TEMPLATES,
       SUBSCRIPTION_OAUTH_PROVIDERS
-    } = await import("./providerRegistry-E34XWDLJ.js");
+    } = await import("./providerRegistry-S6UL6UNA.js");
     const keyTemplates = CUSTOM_API_KEY_TEMPLATES.map((p) => ({
       id: p.id,
       label: p.label,