nolo-cli 0.211.0 → 0.213.0

package/chunk-MMA3LZ3W.js

@@ -0,0 +1,105 @@
+import {
+  __commonJS
+} from "./chunk-4VNS5WPM.js";
+
+// node_modules/@babel/runtime/helpers/interopRequireDefault.js
+var require_interopRequireDefault = __commonJS({
+  "node_modules/@babel/runtime/helpers/interopRequireDefault.js"(exports, module) {
+    function _interopRequireDefault(e) {
+      return e && e.__esModule ? e : {
+        "default": e
+      };
+    }
+    module.exports = _interopRequireDefault, module.exports.__esModule = true, module.exports["default"] = module.exports;
+  }
+});
+
+// node_modules/date-fns/_lib/requiredArgs/index.js
+var require_requiredArgs = __commonJS({
+  "node_modules/date-fns/_lib/requiredArgs/index.js"(exports, module) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.default = requiredArgs;
+    function requiredArgs(required, args) {
+      if (args.length < required) {
+        throw new TypeError(required + " argument" + (required > 1 ? "s" : "") + " required, but only " + args.length + " present");
+      }
+    }
+    module.exports = exports.default;
+  }
+});
+
+// node_modules/@babel/runtime/helpers/typeof.js
+var require_typeof = __commonJS({
+  "node_modules/@babel/runtime/helpers/typeof.js"(exports, module) {
+    function _typeof(o) {
+      "@babel/helpers - typeof";
+      return module.exports = _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
+        return typeof o2;
+      } : function(o2) {
+        return o2 && "function" == typeof Symbol && o2.constructor === Symbol && o2 !== Symbol.prototype ? "symbol" : typeof o2;
+      }, module.exports.__esModule = true, module.exports["default"] = module.exports, _typeof(o);
+    }
+    module.exports = _typeof, module.exports.__esModule = true, module.exports["default"] = module.exports;
+  }
+});
+
+// node_modules/date-fns/toDate/index.js
+var require_toDate = __commonJS({
+  "node_modules/date-fns/toDate/index.js"(exports, module) {
+    "use strict";
+    var _interopRequireDefault = require_interopRequireDefault().default;
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.default = toDate;
+    var _typeof2 = _interopRequireDefault(require_typeof());
+    var _index = _interopRequireDefault(require_requiredArgs());
+    function toDate(argument) {
+      (0, _index.default)(1, arguments);
+      var argStr = Object.prototype.toString.call(argument);
+      if (argument instanceof Date || (0, _typeof2.default)(argument) === "object" && argStr === "[object Date]") {
+        return new Date(argument.getTime());
+      } else if (typeof argument === "number" || argStr === "[object Number]") {
+        return new Date(argument);
+      } else {
+        if ((typeof argument === "string" || argStr === "[object String]") && typeof console !== "undefined") {
+          console.warn("Starting with v2.0.0-beta.1 date-fns doesn't accept strings as date arguments. Please use `parseISO` to parse strings. See: https://github.com/date-fns/date-fns/blob/master/docs/upgradeGuide.md#string-arguments");
+          console.warn(new Error().stack);
+        }
+        return /* @__PURE__ */ new Date(NaN);
+      }
+    }
+    module.exports = exports.default;
+  }
+});
+
+// node_modules/date-fns/_lib/addLeadingZeros/index.js
+var require_addLeadingZeros = __commonJS({
+  "node_modules/date-fns/_lib/addLeadingZeros/index.js"(exports, module) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.default = addLeadingZeros;
+    function addLeadingZeros(number, targetLength) {
+      var sign = number < 0 ? "-" : "";
+      var output = Math.abs(number).toString();
+      while (output.length < targetLength) {
+        output = "0" + output;
+      }
+      return sign + output;
+    }
+    module.exports = exports.default;
+  }
+});
+
+export {
+  require_interopRequireDefault,
+  require_typeof,
+  require_requiredArgs,
+  require_toDate,
+  require_addLeadingZeros
+};

package/{chunk-XDMGY5IU.js → chunk-MOIJOHA5.js}

@@ -1,12 +1,25 @@
-import {
-  buildLocalAgentLookupKeys,
-  classifyAgentApiKeyRef,
-  formatUnsupportedAgentApiKeyRefMessage,
-  shouldReadAgentKeyRemotely
-} from "./chunk-7AUQ3WCW.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-NBTY7YJF.js";
+import {
+  buildRestorePatch
+} from "./chunk-SVYO6AO7.js";
+import {
+  createHostCredentialBrokerChain,
+  createStrictHostCredentialBroker
+} from "./chunk-RSHTSUEG.js";
+import {
+  buildAgentRuntimeAgentLookupKeys,
+  shouldFetchAgentRuntimeRecordRemotely
+} from "./chunk-RZOV7OMV.js";
+import {
+  buildAgentApiKeyCredentialRef,
+  migrateAgentSecrets
+} from "./chunk-2QHFH3DR.js";
+import {
+  assertCredentialRef,
+  createFileCredentialBroker
+} from "./chunk-OQHIVPG4.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -23,16 +36,85 @@ import {
 } from "./chunk-4O22PGNQ.js";
 import {
   createAgentKey
-} from "./chunk-ECX3NKRD.js";
+} from "./chunk-JY5NGFFH.js";
+
+// packages/agent-runtime/sessionCredentialBroker.ts
+function createSessionMemoryCredentialBroker() {
+  const store = /* @__PURE__ */ new Map();
+  return {
+    get(ref) {
+      return store.get(assertCredentialRef(ref)) ?? null;
+    },
+    put(ref, secret) {
+      const safe = assertCredentialRef(ref);
+      const value = typeof secret === "string" ? secret.trim() : "";
+      if (!value) throw new Error("Cannot store an empty credential secret.");
+      store.set(safe, value);
+    },
+    delete(ref) {
+      store.delete(assertCredentialRef(ref));
+    },
+    has(ref) {
+      return store.has(assertCredentialRef(ref));
+    },
+    size() {
+      return store.size;
+    }
+  };
+}
+var sharedSessionBroker;
+function getSharedSessionCredentialBroker() {
+  if (!sharedSessionBroker) sharedSessionBroker = createSessionMemoryCredentialBroker();
+  return sharedSessionBroker;
+}
 
 // packages/cli/agentRecordHelpers.ts
 import { readFileSync } from "node:fs";
 
+// packages/agent-runtime/oauthProviderRefs.ts
+var OAUTH_PROVIDER_REFS = [
+  "chatgpt",
+  "xai",
+  "antigravity",
+  "claude",
+  "cursor",
+  "devin"
+];
+var METERED_API_KEY_REF_PREFIX = "api-key:";
+var normalizeRef = (ref) => typeof ref === "string" ? ref.trim().toLowerCase() : "";
+var isKnownOAuthProviderRef = (ref) => OAUTH_PROVIDER_REFS.includes(normalizeRef(ref));
+var isMeteredApiKeyRef = (ref) => {
+  const trimmed = typeof ref === "string" ? ref.trim() : "";
+  return trimmed.length > METERED_API_KEY_REF_PREFIX.length && trimmed.slice(0, METERED_API_KEY_REF_PREFIX.length).toLowerCase() === METERED_API_KEY_REF_PREFIX;
+};
+var OAUTH_PROVIDER_REF_LIST_COPY = OAUTH_PROVIDER_REFS.join(" / ");
+function classifyAgentApiKeyRef(raw) {
+  const trimmed = typeof raw === "string" ? raw.trim() : "";
+  if (!trimmed) return { ok: true, kind: "empty" };
+  if (isKnownOAuthProviderRef(trimmed)) {
+    return {
+      ok: true,
+      kind: "oauth-provider",
+      provider: normalizeRef(trimmed)
+    };
+  }
+  if (isMeteredApiKeyRef(trimmed)) return { ok: true, kind: "metered-api-key" };
+  return { ok: false, kind: "unsupported-oauth-provider", ref: trimmed };
+}
+function formatUnsupportedAgentApiKeyRefMessage(raw) {
+  const shown = typeof raw === "string" ? raw.trim() : "";
+  return `apiKeyRef "${shown}" \u4E0D\u662F\u53D7\u652F\u6301\u7684\u53D6\u503C\uFF0C\u8BB0\u5F55\u672A\u5199\u5165\u3002\u5408\u6CD5\u53D6\u503C\uFF1AOAuth provider ref\uFF08${OAUTH_PROVIDER_REF_LIST_COPY}\uFF09\uFF0C\u6216\u8BA1\u91CF/\u8BBE\u5907 broker ref\uFF08\u4EE5 "${METERED_API_KEY_REF_PREFIX}" \u5F00\u5934\uFF0C\u5982 ${METERED_API_KEY_REF_PREFIX}agent-...\uFF09\u3002\u6539\u6CD5\uFF1A\u628A apiKeyRef \u6539\u6210\u4E0A\u9762\u67D0\u4E2A\u53D7\u652F\u6301\u7684\u53D6\u503C\uFF0C\u6216\u6539\u7528 ${METERED_API_KEY_REF_PREFIX}<id>\uFF1B\u82E5\u8981\u7528\u81EA\u5E26 API key\uFF0C\u8BF7\u6E05\u7A7A apiKeyRef \u5E76\u586B\u5199 apiKey\u3002`;
+}
+
 // packages/core/agentHandle.ts
 function normalizeAgentHandle(value) {
   return typeof value === "string" && value.trim() ? value.trim().toLowerCase().replace(/\s+/g, " ") : void 0;
 }
 
+// packages/cli/client/localAgentRecords.ts
+var buildLocalAgentLookupKeys = buildAgentRuntimeAgentLookupKeys;
+var shouldReadAgentKeyRemotely = shouldFetchAgentRuntimeRecordRemotely;
+
 // packages/cli/agentRecordHelpers.ts
 var PROVIDER_COPY_FIELDS = [
   "apiSource",
@@ -243,6 +325,7 @@ function assertSupportedAgentApiKeyRef(record) {
 }
 async function writeAgentRecord(args) {
   assertSupportedAgentApiKeyRef(args.record);
+  const remoteRecord = args.remoteIncludeApiKey === false ? Object.fromEntries(Object.entries(args.record).filter(([field]) => field !== "apiKey")) : args.record;
   const res = await fetchWithTransportFallback(`${args.serverUrl}/api/v1/db/write/`, {
     method: "POST",
     headers: {
@@ -253,7 +336,7 @@ async function writeAgentRecord(args) {
       customKey: args.agentKey,
       userId: args.userId,
       data: {
-        ...args.record,
+        ...remoteRecord,
         dbKey: args.agentKey
       }
     })
@@ -494,6 +577,72 @@ function normalizeAgentRecordForOutput(agentKey, authToken, agent) {
     record: sanitizedRecord
   };
 }
+var INBOUND_CRED_REF_PREFIX = "$nolo_cred:";
+var VAULT_REF_PATTERN = /^vault-cred-[A-Za-z0-9]+$/;
+function detectVaultCredentialId(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  const candidate = trimmed.startsWith(INBOUND_CRED_REF_PREFIX) ? trimmed.slice(INBOUND_CRED_REF_PREFIX.length).trim() : trimmed;
+  return VAULT_REF_PATTERN.test(candidate) ? candidate : null;
+}
+var hostCredentialBrokerOverride;
+var credentialStorageWarnings = [];
+var CREDENTIAL_STORE_SESSION_FALLBACK_WARNING = "\u7CFB\u7EDF\u5B89\u5168\u533A\u4E0D\u53EF\u7528\uFF0C\u672C\u6B21\u4F1A\u8BDD\u5185\u6709\u6548\uFF0C\u672A\u6301\u4E45\u5316\uFF1B\u91CD\u542F\u540E\u9700\u91CD\u65B0\u63D0\u4F9B\u8BE5\u51ED\u636E\u3002";
+var CREDENTIAL_STORE_FALLBACK_WARNING = "\u7CFB\u7EDF\u5B89\u5168\u533A\u4E0D\u53EF\u7528\uFF0C\u5DF2\u56DE\u9000\u5230\u672C\u5730\u6587\u4EF6\u5B58\u50A8\uFF080600 \u660E\u6587\uFF09\u3002\u5EFA\u8BAE\u542F\u7528\u7CFB\u7EDF\u94A5\u5319\u4E32\uFF08Linux: Secret Service / gnome-keyring\uFF09\u3002";
+function resolveStrictCredentialBroker(broker) {
+  return broker ?? hostCredentialBrokerOverride ?? createStrictHostCredentialBroker();
+}
+var legacyReadNoticed = /* @__PURE__ */ new Set();
+function resolveHostCredentialBroker(broker) {
+  if (broker || hostCredentialBrokerOverride) return resolveStrictCredentialBroker(broker);
+  return createHostCredentialBrokerChain({
+    strict: createStrictHostCredentialBroker(),
+    session: getSharedSessionCredentialBroker(),
+    legacy: createFileCredentialBroker({ migration: { enableLegacyMigration: true } }),
+    notifySessionFallback: () => {
+      try {
+        process.stderr.write(`[nolo] Warning: ${CREDENTIAL_STORE_SESSION_FALLBACK_WARNING}
+`);
+      } catch {
+      }
+    },
+    notifyLegacyHit: (ref) => {
+      if (legacyReadNoticed.has(ref)) return;
+      legacyReadNoticed.add(ref);
+      try {
+        process.stderr.write(
+          `[nolo] Warning: \u51ED\u636E "${ref}" \u6765\u81EA\u9057\u7559\u672C\u5730\u660E\u6587\u5B58\u50A8\uFF08\u53EA\u8BFB\u56DE\u9000\uFF09\u3002\u5EFA\u8BAE\u91CD\u65B0\u5F55\u5165\u8BE5 API key \u4EE5\u8FC1\u5165\u7CFB\u7EDF\u5B89\u5168\u533A\u3002
+`
+        );
+      } catch {
+      }
+    }
+  });
+}
+async function storeAgentCredential(args) {
+  const broker = resolveStrictCredentialBroker(args.broker);
+  const credentialRef = buildAgentApiKeyCredentialRef(args.agentKey);
+  await migrateAgentSecrets({
+    agent: { key: args.agentKey, apiKey: args.secret, apiKeyRef: credentialRef },
+    broker
+  });
+  if (!await broker.has(credentialRef)) {
+    throw new Error(`failed to store the credential in the host credential store (${credentialRef}).`);
+  }
+  return { credentialRef };
+}
+async function bindVaultCredentialToAgent(args) {
+  const broker = resolveHostCredentialBroker(args.broker);
+  const secret = await broker.get(args.vaultId);
+  if (!secret) {
+    throw new Error(
+      `--api-key received a vault credential id (${args.vaultId}) but no secret is stored for it on this device. Re-paste the key in the chat so the runtime can isolate it again, or ask the user to run \`nolo secret set <name> --prompt\`.`
+    );
+  }
+  return await storeAgentCredential({ agentKey: args.agentKey, secret, broker: args.broker });
+}
+async function readBoundAgentCredential(credentialRef, broker) {
+  return await resolveHostCredentialBroker(broker).get(credentialRef);
+}
 function parseAgentUpdateArgs(args) {
   const agentInput = readOption(args, "--agent") ?? readOption(args, "--id") ?? args[0]?.trim();
   if (!agentInput || agentInput === "--help" || agentInput === "-h") return null;
@@ -552,13 +701,57 @@ function parseAgentUpdateArgs(args) {
   }
   return { agentInput, updates, promptDoc, copyProviderFrom, verify, verifyPrompt, presetId };
 }
+function looksLikePlaintextApiKey(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (trimmed.length < 12) return false;
+  if (/^(?:api-key:|vault-cred-)/i.test(trimmed)) return false;
+  const verdict = classifyAgentApiKeyRef(trimmed);
+  if (verdict.ok && verdict.kind !== "empty") return false;
+  return true;
+}
+async function applyVaultCredentialBinding(updates, agentKey, broker, fallbackProviderUrl, preservePlaintextApiKey) {
+  const vaultId = detectVaultCredentialId(updates.apiKey);
+  if (!vaultId) {
+    const rawApiKey = updates.apiKey;
+    if (!looksLikePlaintextApiKey(rawApiKey)) return;
+    try {
+      const { credentialRef: credentialRef2 } = await storeAgentCredential({
+        agentKey,
+        secret: String(rawApiKey).trim(),
+        broker
+      });
+      delete updates.apiKey;
+      updates.credentialRef = credentialRef2;
+      updates.apiKeyRef = credentialRef2;
+      if (preservePlaintextApiKey && typeof rawApiKey === "string") {
+        updates.apiKey = rawApiKey;
+      }
+      return;
+    } catch {
+      credentialStorageWarnings.push(CREDENTIAL_STORE_FALLBACK_WARNING);
+      process.stderr.write(`[nolo] Warning: ${CREDENTIAL_STORE_FALLBACK_WARNING}
+`);
+      return;
+    }
+  }
+  delete updates.apiKey;
+  const target = typeof updates.customProviderUrl === "string" && updates.customProviderUrl.trim() ? updates.customProviderUrl.trim() : (fallbackProviderUrl ?? "").trim();
+  if (!target) {
+    throw new Error(
+      "--api-key received a vault credential id, but no provider target was given. Pass --custom-provider-url <base> (or --preset <id>) so the credential has a known destination."
+    );
+  }
+  const { credentialRef } = await bindVaultCredentialToAgent({ agentKey, vaultId, broker });
+  updates.credentialRef = credentialRef;
+  updates.apiKeyRef = credentialRef;
+}
 async function buildCreatedAgentRecord(args) {
   const serverUrl = args.cliArgs ? resolveServerUrl(args.cliArgs, args.env) : resolveServerUrl(args.env);
   const userId = parseUserIdFromAuthToken(args.authToken);
   const resolvedAgentInput = resolveCliAgentKeyInput(args.parsed.agentInput);
   const agentKey = resolvedAgentInput.startsWith("agent-") ? resolvedAgentInput : createAgentKey.private(userId || "local", resolvedAgentInput);
   if (args.parsed.presetId) {
-    const { resolveProviderPresetFields } = await import("./providerPresetApply-ZYMLQA46.js");
+    const { resolveProviderPresetFields } = await import("./providerPresetApply-YXGV6NXB.js");
     const fields = resolveProviderPresetFields(args.parsed.presetId);
     if (fields.kind === "manual") {
       throw new Error(
@@ -617,13 +810,22 @@ async function buildCreatedAgentRecord(args) {
   if (args.parsed.updates.customProviderUrl && !args.parsed.updates.apiSource) {
     args.parsed.updates.apiSource = "custom";
   }
+  await applyVaultCredentialBinding(
+    args.parsed.updates,
+    agentKey,
+    args.credentialBroker,
+    void 0,
+    !args.hostApproval?.gateId
+  );
+  const now = Date.now();
   const nextRecord = {
     ...args.parsed.updates,
     dbKey: agentKey,
     key: agentKey,
     type: "agent" /* AGENT */,
-    createdAt: Date.now(),
-    updatedAt: Date.now(),
+    ...buildRestorePatch(new Date(now).toISOString()),
+    createdAt: now,
+    updatedAt: now,
     userId
   };
   return {
@@ -686,6 +888,15 @@ async function buildUpdatedAgentRecord(args) {
     }
     args.parsed.updates.prompt = promptBody;
   }
+  await applyVaultCredentialBinding(
+    args.parsed.updates,
+    agentKey,
+    args.credentialBroker,
+    typeof currentRecord?.customProviderUrl === "string" ? currentRecord.customProviderUrl : void 0,
+    // update 的来源判定与 create 一致：宿主代执行 → 严格（删明文只留 ref）；
+    // 用户自己终端敲 → 保持既有行为（明文照旧写进记录）。
+    !args.hostApproval?.gateId
+  );
   const nextRecord = {
     ...currentRecord,
     ...args.parsed.updates,
@@ -701,6 +912,9 @@ async function buildUpdatedAgentRecord(args) {
 }
 
 export {
+  getSharedSessionCredentialBroker,
+  OAUTH_PROVIDER_REFS,
+  buildLocalAgentLookupKeys,
   fetchWithTransportFallback,
   readAgentRecord,
   readDbRecord,
@@ -713,6 +927,8 @@ export {
   agentRecordHasConfiguredCredential,
   sanitizeAgentRecordForCliOutput,
   normalizeAgentRecordForOutput,
+  CREDENTIAL_STORE_SESSION_FALLBACK_WARNING,
+  readBoundAgentCredential,
   parseAgentUpdateArgs,
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord

package/{chunk-NLT32XBZ.js → chunk-NJLL224W.js}

@@ -1,9 +1,9 @@
 import {
   selectCurrentServer
-} from "./chunk-BSISWVB4.js";
+} from "./chunk-4I7ERB7F.js";
 import {
   patch
-} from "./chunk-UMEGDH6A.js";
+} from "./chunk-FW6YHHLI.js";
 import {
   getIsDesktopApp
 } from "./chunk-AGP3YSEC.js";

package/{chunk-JBOUVTZX.js → chunk-NOKUNJON.js}

@@ -15,10 +15,10 @@ import {
 } from "./chunk-4O22PGNQ.js";
 import {
   scheduleWindowsSelfUpdate
-} from "./chunk-LKDF3ATR.js";
+} from "./chunk-INUFILG6.js";
 import {
   t
-} from "./chunk-3RQVYR4B.js";
+} from "./chunk-VNYYOX3V.js";
 
 // packages/cli/updateCommands.ts
 import { existsSync, readFileSync, accessSync, constants } from "node:fs";
@@ -79,8 +79,17 @@ function resolveStandaloneBundleRepoBase(channel) {
 }
 function buildStandaloneManualUpdateHint(channel) {
   const repoBase = resolveStandaloneBundleRepoBase(channel);
+  if (channel === "alpha") {
+    return `curl -fsSL ${repoBase}/install-nolo.sh | NOLO_INSTALL_CHANNEL=alpha sh`;
+  }
   return `curl -fsSL ${repoBase}/install-nolo.sh | sh`;
 }
+function buildStandaloneBundleTarballName(tarballName, channel) {
+  if (channel !== "alpha") return tarballName;
+  const suffix = ".tar.gz";
+  const stem = tarballName.endsWith(suffix) ? tarballName.slice(0, -suffix.length) : tarballName;
+  return `${stem}-alpha.tar.gz`;
+}
 function resolveStandaloneInstallDir() {
   const candidates = [
     "/usr/local/bin",
@@ -356,8 +365,9 @@ async function runStandaloneBundleUpdate(options) {
   }
   const { tarballName, extractSubdir } = platform;
   const repoBase = resolveStandaloneBundleRepoBase(channel);
-  const tarballUrl = `${repoBase}/public/downloads/${tarballName}`;
-  const fallbackUrl = `https://nolo.chat/public/downloads/${tarballName}`;
+  const bundleName = buildStandaloneBundleTarballName(tarballName, channel);
+  const tarballUrl = `${repoBase}/public/downloads/${bundleName}`;
+  const fallbackUrl = `https://nolo.chat/public/downloads/${bundleName}`;
   const extractDir = join(homedir(), ".nolo", extractSubdir);
   const installDir = resolveStandaloneInstallDir();
   const symlinkPath = join(installDir, "nolo");
@@ -569,6 +579,7 @@ export {
   resolveStandaloneBundlePlatform,
   resolveStandaloneBundleRepoBase,
   buildStandaloneManualUpdateHint,
+  buildStandaloneBundleTarballName,
   readPackageInfo,
   buildCliVersionText,
   buildSelfUpdateCommand,

package/{chunk-C2XZM3K4.js → chunk-NSAPDIN2.js}

@@ -1,13 +1,14 @@
+import {
+  resolveRuntimeAuthToken,
+  resolveRuntimeServerUrl
+} from "./chunk-HRMJUN5J.js";
 import {
   isAgentRunTerminalStatus,
   normalizeRunTitle
-} from "./chunk-PJNFNEJE.js";
+} from "./chunk-ALQ3657A.js";
 import {
   findPowerShellExecutable
-} from "./chunk-XPHZK3PJ.js";
-import {
-  resolvePlatformAuthToken
-} from "./chunk-PV6JJAUB.js";
+} from "./chunk-H4UOTUOX.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
@@ -1073,22 +1074,6 @@ function reserveHostMemory(deps) {
   throw new Error("[host-memory-reservation] exclusive lock required");
 }
 
-// packages/cli/client/localRuntimeHelpers.ts
-var REMOTE_DIALOG_SYNC_TIMEOUT_MS = 1e4;
-var remoteDialogSyncTimeoutMsForTest;
-function setRemoteDialogSyncTimeoutForTest(ms) {
-  remoteDialogSyncTimeoutMsForTest = ms;
-}
-function remoteDialogSyncTimeout() {
-  return remoteDialogSyncTimeoutMsForTest ?? REMOTE_DIALOG_SYNC_TIMEOUT_MS;
-}
-function resolveRuntimeServerUrl(env) {
-  return (env?.NOLO_SERVER_URL || env?.NOLO_SERVER || env?.BASE_URL || "").replace(/\/+$/, "");
-}
-function resolveRuntimeAuthToken(env) {
-  return resolvePlatformAuthToken(env ?? {});
-}
-
 // packages/cli/agentRunResultFile.ts
 function resolveResultServerMeta(input) {
   const serverUrl = resolveRuntimeServerUrl(input.env);
@@ -2308,7 +2293,11 @@ async function spawnLocalBackgroundRun(input, deps = {}) {
   const childEnv = {
     ...env,
     NOLO_AGENT_RUN_CHILD: "1",
-    NOLO_AGENT_RUN_ID: runId
+    NOLO_AGENT_RUN_ID: runId,
+    ...input.subtaskBudgetLimits ? {
+      NOLO_SUBTASK_MAX_TOOL_CALLS: String(input.subtaskBudgetLimits.maxToolCalls),
+      NOLO_SUBTASK_MAX_WALL_CLOCK_MS: String(input.subtaskBudgetLimits.maxWallClockMs)
+    } : {}
   };
   let hostMemory = null;
   let reservation;
@@ -3148,14 +3137,10 @@ async function runAgentKillCommand(args, deps) {
 }
 
 export {
-  TAIL_LINES_MAX,
   createShellApprovalChild,
+  TAIL_LINES_MAX,
   readHostMemory,
   assertHostMemoryAdmission,
-  setRemoteDialogSyncTimeoutForTest,
-  remoteDialogSyncTimeout,
-  resolveRuntimeServerUrl,
-  resolveRuntimeAuthToken,
   resolveResultServerMeta,
   recordRunResultHeaderMeta,
   getRunResultHeaderMeta,

package/{chunk-PAFTGNWA.js → chunk-O2TZF4AI.js}

@@ -7,7 +7,7 @@ import {
   scheduleExistingRecordReplication,
   shouldReplaceLocalWithRemoteRecord,
   shouldReplicateLocalRecord
-} from "./chunk-UCPAVEQB.js";
+} from "./chunk-PYRUW7XN.js";
 import {
   fetchFromClientDb,
   fetchFromServer,
@@ -16,7 +16,7 @@ import {
 } from "./chunk-AGP3YSEC.js";
 import {
   shouldReplaceWithNextRecord
-} from "./chunk-D2MDMY2M.js";
+} from "./chunk-SVYO6AO7.js";
 import {
   isAbortError
 } from "./chunk-7DPNBQSV.js";

package/{chunk-UIOEHFF6.js → chunk-OQHIVPG4.js}

@@ -136,5 +136,6 @@ function createFileCredentialBroker(options = {}) {
 }
 
 export {
+  assertCredentialRef,
   createFileCredentialBroker
 };

package/{chunk-TCTSYFDM.js → chunk-OQPKUBPB.js}

@@ -22,15 +22,16 @@ import {
   extractToolCallsFromResponseOutput,
   getUsageRequestOptions,
   hasImageParts,
+  resolveReasoningReplayOptions,
   sanitizeForOutbound,
   shouldStripReasoningContentForOutbound,
   stablePromptCacheKey,
   toOpenAiCompatibleMessages,
   toResponsesTools
-} from "./chunk-CVCRAO6Q.js";
+} from "./chunk-H5HF7TJA.js";
 import {
   resolveToolImagePolicy
-} from "./chunk-DA7CTWT4.js";
+} from "./chunk-YWSEPJ7C.js";
 import {
   isMeaningfulChatCompletionOutput,
   isMeaningfulResponsesOutput
@@ -47,7 +48,7 @@ import {
   resolvePlatformAuthToken,
   resolvePlatformServerUrl,
   resolveProviderTransportDecision
-} from "./chunk-PV6JJAUB.js";
+} from "./chunk-TCZHTTUU.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
@@ -518,10 +519,15 @@ function buildPlatformChatCompletionRequest(args) {
   }
   const usesResponsesApi = isResponsesEndpoint(args.providerConfig.endpoint);
   const requestOptions = usesResponsesApi ? toResponsesRequestOptions(args.providerConfig.requestOptions) : args.providerConfig.requestOptions;
-  const shouldStripReasoning = shouldStripReasoningContentForOutbound(
+  const shouldStripReasoning = !usesResponsesApi && shouldStripReasoningContentForOutbound(
     args.providerConfig.provider,
     args.providerConfig.model
   );
+  const reasoningReplayOptions = resolveReasoningReplayOptions(
+    args.providerConfig.provider,
+    args.providerConfig.model,
+    shouldStripReasoning
+  );
   const sanitizedMessages = sanitizeForOutbound(args.messages, args.tools);
   const body = {
     model: args.providerConfig.model,
@@ -537,8 +543,15 @@ function buildPlatformChatCompletionRequest(args) {
             model: args.providerConfig.model,
             customProviderUrl: args.providerConfig.endpoint,
             hasVision: args.providerConfig.hasVision
-          })
-        })
+          }),
+          // 占位必须在**这一层**注入，不能只交给 responsesHelpers：
+          // `toOpenAiCompatibleMessages` 会用 preserveAgentStateFields 重建对象，
+          // 而非枚举 Symbol 标记（DOWNGRADED_TOOL_TURN_ORIGIN）不会跟着走，
+          // 所以「整体降级成纯文本的工具轮」到了 Responses 转换器那里已经认不出来。
+          // 在这里注入后，转换器只需读非空 reasoning_content 这条既有真值路径。
+          ...reasoningReplayOptions
+        }),
+        reasoningReplayOptions
       )
     } : {
       messages: toOpenAiCompatibleMessages(sanitizedMessages, {