nolo-cli 0.211.0 → 0.213.0

package/{chunk-ZOO3WJIE.js → chunk-RSHTSUEG.js}

@@ -1,8 +1,3 @@
-import {
-  DEVIN_CONNECT_URL,
-  parseSseDataLineJson,
-  parseSseDataLineObject
-} from "./chunk-NTSRCTUX.js";
 import {
   applyChatCompletionDelta,
   applyResponsesToolEvent,
@@ -11,7 +6,12 @@ import {
   flushChatCompletionStream,
   providerHttpFailure,
   throwIfChatCompletionStreamFailed
-} from "./chunk-TCTSYFDM.js";
+} from "./chunk-OQPKUBPB.js";
+import {
+  DEVIN_CONNECT_URL,
+  parseSseDataLineJson,
+  parseSseDataLineObject
+} from "./chunk-CTPXME7U.js";
 import {
   readSseFrames
 } from "./chunk-HNUWUO75.js";
@@ -29,7 +29,7 @@ import {
 import {
   hasImageInRuntimeMessages,
   stripImagePartsFromMessages
-} from "./chunk-LNYHAKBP.js";
+} from "./chunk-W4S457LU.js";
 import {
   applyShapingCounts,
   attachProjectionFacts,
@@ -66,7 +66,7 @@ import {
   hashStablePrefixContent,
   resolveResponseGuidelines,
   resolveToolGuidedSections
-} from "./chunk-W5VC7F7V.js";
+} from "./chunk-5MQRBSMW.js";
 import {
   classifyUnparsableToolArgs,
   collectStablePromptPrefix,
@@ -90,7 +90,7 @@ import {
   toOpenAiCompatibleMessages,
   toResponsesTools,
   transferDowngradedToolTurnOrigin
-} from "./chunk-CVCRAO6Q.js";
+} from "./chunk-H5HF7TJA.js";
 import {
   TOOL_HAD_IMAGES,
   TOOL_IMAGES,
@@ -111,7 +111,6 @@ import {
   DEFAULT_SUBTASK_MAX_TOOL_CALLS,
   DEFAULT_SUBTASK_MAX_WALL_CLOCK_MS,
   NOLO_WORKSPACE_TOOL_NAMES,
-  applyToolSurfaceConstraints,
   buildDialogReadEnvelope,
   buildNoloWorkspaceCommandArgs,
   buildNoloWorkspaceOpenAiTools,
@@ -123,16 +122,20 @@ import {
   parseNoloWorkspaceToolArguments,
   readTextStreamUpToChars,
   resolveNoloDialogInput
-} from "./chunk-6HVBI6TI.js";
+} from "./chunk-RZOV7OMV.js";
+import {
+  applyToolSurfaceConstraints
+} from "./chunk-KC4XDTT3.js";
 import {
   clipToolText,
+  planContextUsage,
   resolveHistoricalToolContentCap,
   resolveToolOutputProfile
-} from "./chunk-2WZXXAQD.js";
+} from "./chunk-YB3YZK56.js";
 import {
   resolveAgentImageInputSupport,
   resolveToolImagePolicy
-} from "./chunk-DA7CTWT4.js";
+} from "./chunk-YWSEPJ7C.js";
 import {
   buildDialogFallbackTitleFromUserInput
 } from "./chunk-2MBTWINN.js";
@@ -147,25 +150,22 @@ import {
   resolveEmptyAssistantFallbackMessage,
   resolveEmptyAssistantOutcome,
   resolveTruncatedReasoningTailLog
-} from "./chunk-WTKYP6QO.js";
+} from "./chunk-V5Y3R6BT.js";
 import {
   COMPACTION_SUMMARY_SCHEMA_VERSION,
   COMPACTION_SUMMARY_SYSTEM_PROMPT,
-  TOOL_RESULT_TRUNCATE_CHARS,
+  buildBoundedCompactionRequest,
   buildCompactionMetricsFromPlan,
-  buildCompactionUserContent,
-  computeSummaryInputTokenCap,
   computeSummarySourceMetadata,
   formatCompactionMetricsLog,
-  formatFileOperationsFromMessages,
-  formatMessagesForSummaryWithTruncation,
+  getMessageTokenCount,
   getModelContextWindow,
   planCompression,
-  planContextUsage,
   resolveCompressionTriggerRatio,
+  resolveEffectiveCompactionBudgets,
   sha256Hex,
   truncateToolOutputForContext
-} from "./chunk-BTYQAODF.js";
+} from "./chunk-7BT37FK3.js";
 import {
   createProviderCallTimingTracker,
   finalizeProviderCallTiming,
@@ -176,6 +176,9 @@ import {
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
+import {
+  assertCredentialRef
+} from "./chunk-OQHIVPG4.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -191,7 +194,7 @@ import {
 import {
   canonicalizeToolName,
   canonicalizeToolNames
-} from "./chunk-AKE53VMW.js";
+} from "./chunk-ZCWRMUWT.js";
 import {
   buildInteractiveCommandBlockedResult,
   buildProcessTaskResultCapsule,
@@ -214,26 +217,29 @@ import {
   spillToolOutput,
   toProcessTaskView,
   truncateToolOutput
-} from "./chunk-XPHZK3PJ.js";
+} from "./chunk-H4UOTUOX.js";
 import {
   estimateTokenCount
 } from "./chunk-PSCNXBYA.js";
-import {
-  resolveNoloStateDir
-} from "./chunk-6UBGXX2W.js";
 import {
   buildProviderAuthHeaders,
   buildProviderExecutionPlan
-} from "./chunk-PV6JJAUB.js";
+} from "./chunk-TCZHTTUU.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
+import {
+  resolveNoloStateDir
+} from "./chunk-6UBGXX2W.js";
 import {
   dialogMessageKey,
   dialogMessageRange
@@ -250,9 +256,6 @@ import {
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
-import {
-  asTrimmedLowercaseString
-} from "./chunk-QSJ3HFEF.js";
 import {
   __export
 } from "./chunk-4VNS5WPM.js";
@@ -13243,6 +13246,14 @@ var SECRET_PATTERNS = [
     placeholder: "[REDACTED:API_KEY]",
     regex: /\bsk-[a-zA-Z0-9_\-]{24,}\b/g
   },
+  // 3b. BigModel / 智谱（GLM）API Key：32 位 hex + "." + 16 位字母数字
+  //     （2026-11 实证：这类 key 没有任何可辨识前缀，此前漏在清洗与入路隔离之外，
+  //     用户贴进对话后明文直接进了 prompt / 历史 / 工具日志。）
+  {
+    kind: "BIGMODEL_KEY",
+    placeholder: "[REDACTED:BIGMODEL_KEY]",
+    regex: /\b[0-9a-fA-F]{32}\.[A-Za-z0-9]{16}\b/g
+  },
   // 4. GitHub 访问令牌 (ghp_..., gho_..., github_pat_...)
   {
     kind: "GITHUB_TOKEN",
@@ -13278,9 +13289,11 @@ var QUICK_PROBE_SUBSTRINGS = [
   "PASSWD",
   "SECRET_KEY"
 ];
+var UNPREFIXED_PROBE_REGEX = /\b[0-9a-fA-F]{32}\.[A-Za-z0-9]{16}\b/;
 function hasPotentialSecrets(text2) {
   if (typeof text2 !== "string" || text2.length === 0) return false;
-  return QUICK_PROBE_SUBSTRINGS.some((probe) => text2.includes(probe));
+  if (QUICK_PROBE_SUBSTRINGS.some((probe) => text2.includes(probe))) return true;
+  return UNPREFIXED_PROBE_REGEX.test(text2);
 }
 function scrubSecrets(text2) {
   if (typeof text2 !== "string" || text2.length === 0) {
@@ -14481,41 +14494,86 @@ function buildDestructiveShellBlockedError(reason, request3) {
   error.permissionRequest = request3;
   return error;
 }
+var KEY_SHAPED_VALUE = /(?:^|[\s"'=])(?:sk-ant-[A-Za-z0-9_\-]{20,}|sk-[A-Za-z0-9_\-]{24,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,}|[0-9a-fA-F]{32}\.[A-Za-z0-9]{16})(?=$|[\s"'])/;
+var CREDENTIAL_REF_IN_TEXT = /(?:vault-cred-[A-Za-z0-9]+|\$nolo_cred:)/;
+function inspectCommandCredentialUse(command) {
+  const text2 = typeof command === "string" ? command : "";
+  if (!text2) return { hasCredential: false, hasRawSecret: false };
+  const hasRef = CREDENTIAL_REF_IN_TEXT.test(text2);
+  const hasRawSecret = KEY_SHAPED_VALUE.test(text2);
+  return { hasCredential: hasRef || hasRawSecret, hasRawSecret };
+}
+function buildCredentialUsePermissionRequest(command) {
+  return {
+    id: "permission-shell-credential-use",
+    tool: "execShell",
+    action: "shell_command_credential_use",
+    title: "\u786E\u8BA4\u5728\u547D\u4EE4\u4E2D\u4F7F\u7528\u51ED\u636E",
+    body: "\u8BE5\u547D\u4EE4\u5F15\u7528\u4E86\u51ED\u636E\uFF08API key \u6216 vault \u5F15\u7528\uFF09\u3002\u786E\u8BA4\u540E\u7531\u672C\u673A\u53D7\u63A7\u901A\u9053\u53D6\u7528\uFF1B\u660E\u6587\u4E0D\u4F1A\u5199\u8FDB\u547D\u4EE4\u5386\u53F2\u6216\u8BB0\u5F55\u3002",
+    ...command ? { command } : {},
+    suggestedRule: {
+      scope: "once",
+      pattern: { capability: "credential_use", target: "shell_command" }
+    }
+  };
+}
+function buildCredentialUseBlockedError(reason, command) {
+  const error = buildDestructiveShellBlockedError(
+    reason,
+    buildCredentialUsePermissionRequest(command)
+  );
+  error.code = "credential_use_requires_confirmation";
+  return error;
+}
 async function evaluateExecShellDestructiveGuard(input, ctx) {
   const guardEnabled = ctx.enableDestructiveShellGuard !== false;
   if (!guardEnabled || ctx.confirmed) {
-    return;
+    return null;
   }
   const rawCommand = resolveShellCommandArg(
     typeof input === "object" && input !== null ? input : { command: input }
   );
   const extraInput = typeof input === "object" && input !== null ? input.input : void 0;
-  if (!isDestructiveShellCommand({ command: rawCommand, input: extraInput })) {
-    return;
-  }
+  const destructive = isDestructiveShellCommand({ command: rawCommand, input: extraInput });
   const displayCommand = toDisplayCommand(rawCommand);
-  const request3 = buildDestructiveShellPermissionRequest(displayCommand);
+  const credentialUse = inspectCommandCredentialUse(displayCommand).hasCredential || typeof extraInput === "string" && inspectCommandCredentialUse(extraInput).hasCredential;
+  if (!destructive && !credentialUse) {
+    return null;
+  }
+  const request3 = destructive ? buildDestructiveShellPermissionRequest(displayCommand) : buildCredentialUsePermissionRequest(displayCommand);
   if (!ctx.confirmDestructiveAction) {
+    if (credentialUse) {
+      throw buildCredentialUseBlockedError(
+        "shell command carrying credentials blocked: no confirmation channel available",
+        displayCommand
+      );
+    }
     if (ctx.blockDestructiveWithoutConfirmation) {
       throw buildDestructiveShellBlockedError(
         "destructive shell command blocked: no confirmation channel available",
         request3
       );
     }
-    return;
+    return null;
   }
-  const confirmed = await ctx.confirmDestructiveAction(request3);
-  if (!confirmed) {
+  const decision = await ctx.confirmDestructiveAction(request3);
+  const approved = typeof decision === "boolean" ? decision : decision?.approved === true;
+  if (!approved) {
     throw buildDestructiveShellBlockedError(
       "destructive shell command blocked: user declined confirmation",
       request3
     );
   }
+  if (typeof decision === "object" && decision?.hostResult) {
+    return decision.hostResult;
+  }
+  return null;
 }
 async function evaluateCapabilityPolicy(capability, normalizedInput, ctx) {
   if (capability.name === "execShell") {
-    await evaluateExecShellDestructiveGuard(normalizedInput, ctx);
+    return await evaluateExecShellDestructiveGuard(normalizedInput, ctx);
   }
+  return null;
 }
 
 // packages/agent-runtime/capabilities/execShellCapability.ts
@@ -14890,7 +14948,10 @@ async function invokeCapability(capabilityOrName, input, ctx = {}) {
   const binding = authority && capability.name === "execShell" ? execShellExecutionBinding(normalizedInput, ctx) : void 0;
   const signal = ctx.abortSignal;
   const confirm = ctx.confirmDestructiveAction;
-  await evaluateCapabilityPolicy(capability, normalizedInput, ctx);
+  const hostExecutedResult = await evaluateCapabilityPolicy(capability, normalizedInput, ctx);
+  if (hostExecutedResult) {
+    return hostExecutedResult;
+  }
   if (ctx.onInvoke) {
     await ctx.onInvoke(capability.name, normalizedInput);
   }
@@ -14974,14 +15035,14 @@ var configuredConcurrency = Number(process.env.NOLO_VISUAL_RENDERER_CONCURRENCY
 var renderSlots = new VisualRenderSemaphore(Number.isFinite(configuredConcurrency) ? Math.max(1, Math.min(2, Math.floor(configuredConcurrency))) : 2);
 var require2 = createRequire(import.meta.url);
 function visualRendererCapability() {
-  if (process.env.NOLO_VISUAL_RENDERER_DISABLED === "1") return { available: false, reason: "Platform renderer disabled by NOLO_VISUAL_RENDERER_DISABLED=1 on this runtime host." };
+  if (process.env.NOLO_VISUAL_RENDERER_DISABLED === "1") return { available: false, reasonCode: "disabled", reason: "Platform renderer disabled by NOLO_VISUAL_RENDERER_DISABLED=1 on this runtime host." };
   try {
     const { chromium } = require2("playwright");
     const executablePath = [chromium.executablePath(), resolveExecutableOnPath("google-chrome"), resolveExecutableOnPath("chromium"), resolveExecutableOnPath("chromium-browser")].find((path) => !!path && existsSync(path));
-    if (!executablePath) return { available: false, reason: "No Chromium renderer installed. Install Playwright Chromium (playwright install chromium) or system Chromium/Google Chrome on the runtime host." };
+    if (!executablePath) return { available: false, reasonCode: "missing-browser", reason: "No Chromium renderer installed. Install Playwright Chromium (playwright install chromium) or system Chromium/Google Chrome on the runtime host." };
     return { available: true, chromium, executablePath };
   } catch {
-    return { available: false, reason: "Platform renderer unavailable: install the platform Playwright dependency and Chromium on the runtime host (not a workspace npm script)." };
+    return { available: false, reasonCode: "dependency-unavailable", reason: "Platform renderer unavailable: install the platform Playwright dependency and Chromium on the runtime host (not a workspace npm script)." };
   }
 }
 async function renderVisualPage(args2) {
@@ -15494,8 +15555,11 @@ function readProcessOwner(runtimeContext) {
   if (!dialogId) return null;
   const turnId = asNonEmptyString(runtimeContext.turnId);
   const ownerId = asNonEmptyString(runtimeContext.ownerId);
+  const getDepth = runtimeContext.getProcessCausalDepth;
+  const depth = typeof getDepth === "function" ? getDepth() : runtimeContext.processCausalDepth;
   return {
     dialogId,
+    ...typeof depth === "number" && Number.isSafeInteger(depth) && depth >= 0 ? { processCausalDepth: depth } : {},
     ...turnId ? { turnId } : {},
     ...ownerId ? { ownerId } : {}
   };
@@ -18290,7 +18354,10 @@ async function runExecShellGates(args2) {
       parsedInput = { command: parsedInput };
     }
   }
-  await evaluateExecShellDestructiveGuard(parsedInput, opts);
+  const hostExecutedResult = await evaluateExecShellDestructiveGuard(parsedInput, opts);
+  if (hostExecutedResult) {
+    return { kind: "handled", result: hostExecutedResult };
+  }
   opts.confirmed = true;
   return { kind: "pass", opts };
 }
@@ -18569,7 +18636,10 @@ async function executeToolCall(args2) {
           `${toolName} confirmation`
         );
         const gateResult = replacement?.metadata?.actionGateResult;
-        if (replacement !== void 0 && isCompletedActionGateResult(gateResult)) {
+        const hostExecuted = replacement?.metadata?.hostExecuted === true;
+        if (replacement !== void 0 && hostExecuted) {
+          toolResult = replacement;
+        } else if (replacement !== void 0 && isCompletedActionGateResult(gateResult)) {
           writeSession.approved = true;
         } else {
           toolResult = replacement ?? {
@@ -18850,6 +18920,7 @@ function toPlanCompressionMessages(history) {
     id: typeof message.id === "string" && message.id.length > 0 ? message.id : `local-${index}`,
     role: message.role,
     content: message.content ?? "",
+    ...typeof message.tool_call_id === "string" ? { tool_call_id: message.tool_call_id } : {},
     ...Array.isArray(message.tool_calls) ? { tool_calls: message.tool_calls } : {}
   }));
 }
@@ -18867,9 +18938,10 @@ function hashSummarySourceSlice(history, summarizedBeforeId) {
   const found = findSummaryAnchorIndex(bridged, summarizedBeforeId);
   if (found === -1) return void 0;
   const slice = bridged.slice(0, found + 1).map((message, index) => ({
-    ...message,
     id: `local-${index}`,
-    content: message.content ?? ""
+    role: message.role,
+    content: message.content ?? "",
+    ...Array.isArray(message.tool_calls) ? { tool_calls: message.tool_calls } : {}
   }));
   return sha256Hex(JSON.stringify(slice));
 }
@@ -18907,22 +18979,22 @@ function projectHistoryWithSummary(args2) {
     if (found !== -1) startIndex = found + 1;
   }
   const projected = args2.history.slice(startIndex);
-  const summaryMsg = args2.summary.trim().length > 0 ? [buildLocalSummaryHistoryMessage(args2.summary)] : [];
-  return [...summaryMsg, ...projected];
-}
-var COLD_RESUME_IDLE_MS = 60 * 60 * 1e3;
-function isColdResume(history, nowMs) {
-  for (let i = history.length - 1; i >= 0; i -= 1) {
-    const at = history[i]?.createdAt;
-    if (typeof at === "number" && Number.isFinite(at)) {
-      return nowMs - at > COLD_RESUME_IDLE_MS;
+  let latestUser = -1;
+  for (let i = args2.history.length - 1; i >= 0; i--) {
+    if (args2.history[i].role === "user") {
+      latestUser = i;
+      break;
     }
   }
-  return false;
+  const preservedUser = latestUser >= 0 && latestUser < startIndex ? [args2.history[latestUser]] : [];
+  const summaryMsg = args2.summary.trim().length > 0 ? [buildLocalSummaryHistoryMessage(args2.summary)] : [];
+  return [...summaryMsg, ...preservedUser, ...projected];
 }
+var COLD_RESUME_IDLE_MS = 60 * 60 * 1e3;
 async function runSummaryFallback(fallback, content, options) {
   try {
     const text2 = await fallback(content, options);
+    if (text2 === null) return { summary: null, error: "no summary" };
     if (typeof text2 !== "string") return { summary: null, error: "non-string output" };
     const trimmed = text2.trim();
     return trimmed.length > 0 ? { summary: trimmed } : { summary: null, error: "empty summary" };
@@ -19017,13 +19089,12 @@ async function maybeAutoCompactLocalHistory(args2) {
   const planAnchorId = summarizedBeforeId && /^local-(0|[1-9]\d*)$/.test(summarizedBeforeId) && legacyAnchorIndex >= 0 ? bridged[legacyAnchorIndex].id : summarizedBeforeId;
   const contextWindow = typeof args2.contextWindow === "number" && Number.isFinite(args2.contextWindow) && args2.contextWindow > 0 ? args2.contextWindow : getModelContextWindow(args2.model ?? "");
   const allMsgs = toPlanCompressionMessages(history);
-  const coldResume = isColdResume(history, args2.now?.() ?? Date.now());
   const plan = planCompression({
     allMsgs,
     summarizedBeforeId: planAnchorId,
     summary: existingSummary,
     contextWindow,
-    ...coldResume ? { coldResume: true, reason: "cold_resume" } : {},
+    preserveLatestUserByProjection: true,
     ...args2.realContextUsagePercent !== void 0 ? { realContextUsagePercent: args2.realContextUsagePercent } : {}
   });
   const projectExisting = () => {
@@ -19078,6 +19149,21 @@ async function maybeAutoCompactLocalHistory(args2) {
       }
     };
   }
+  const msgsToCompress = plan.msgsToCompress;
+  const bounded3 = buildBoundedCompactionRequest({
+    msgsToCompress,
+    previousSummary: existingSummary,
+    contextWindow,
+    canonicalizeToolName
+  });
+  if (bounded3.status === "blocked") {
+    const detail = `bounded compaction blocked: ${bounded3.reason}`;
+    console.warn(`[localLoop] ${detail}`);
+    return {
+      ...projectExisting(),
+      decision: { outcome: "skipped", skipReason: "bounded-request-blocked", detail }
+    };
+  }
   emitPhase({ kind: "compaction-start" });
   const compactionAttemptId = randomUUID();
   let compactionT0 = Date.now();
@@ -19118,23 +19204,9 @@ async function maybeAutoCompactLocalHistory(args2) {
     if (args2.abortSignal?.aborted) {
       throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
     }
-    const msgsToCompress = plan.msgsToCompress;
-    const messagesText = formatMessagesForSummaryWithTruncation(
-      msgsToCompress,
-      TOOL_RESULT_TRUNCATE_CHARS,
-      computeSummaryInputTokenCap(contextWindow)
-    );
-    const fileOpsText = formatFileOperationsFromMessages(
-      msgsToCompress,
-      canonicalizeToolName
-    );
-    const promptContent = buildCompactionUserContent({
-      previousSummary: existingSummary,
-      messagesText,
-      fileOpsText
-    });
+    const promptContent = bounded3.promptContent;
     emitPhase({ kind: "waiting-provider" });
-    compactionInputSource = messagesText;
+    compactionInputSource = promptContent;
     compactionPrevSummarySource = existingSummary;
     compactionT0 = Date.now();
     const timeoutMs = typeof args2.timeoutMs === "number" && Number.isFinite(args2.timeoutMs) && args2.timeoutMs > 0 ? args2.timeoutMs : void 0;
@@ -19151,7 +19223,7 @@ async function maybeAutoCompactLocalHistory(args2) {
         // 服务端 x-request-id 可对上，用于关联请求级证据。不进 prompt/摘要/持久化。
         requestId: compactionAttemptId,
         // Room for factual handoff, exact commands and file operations.
-        max_tokens: 8192,
+        max_tokens: bounded3.outputTokenBudget,
         reasoning_effort: "low"
       }
     ).then(
@@ -19195,7 +19267,8 @@ async function maybeAutoCompactLocalHistory(args2) {
         {
           signal: args2.abortSignal,
           deadlineMs: Date.now() + 3e4,
-          attemptId: compactionAttemptId
+          attemptId: compactionAttemptId,
+          maxOutputTokens: bounded3.outputTokenBudget
         }
       );
       fallbackElapsedMs = Date.now() - fallbackT0;
@@ -19243,15 +19316,69 @@ async function maybeAutoCompactLocalHistory(args2) {
         fallbackElapsedMs
       });
     }
+    const metricsReason = invalidSummary ? "invalid_summary" : "context_budget";
+    const metrics = buildCompactionMetricsFromPlan({
+      reason: metricsReason,
+      previousSummary: existingSummary,
+      plan: {
+        msgsToCompress: bounded3.coveredMessages,
+        msgsToKeep: [...msgsToCompress.slice(bounded3.coveredMessages.length), ...plan.msgsToKeep]
+      },
+      newSummary,
+      summaryUsage: result4?.usage
+    });
+    const projectedHistory = projectHistoryWithSummary({
+      history,
+      summary: newSummary,
+      summarizedBeforeId: bounded3.summarizedBeforeId
+    });
+    const projectedMessages = toPlanCompressionMessages(projectedHistory);
+    const projectedTokens = projectedMessages.reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0);
+    const projectedRetained = projectedMessages.slice(1);
+    metrics.retainedTokens = projectedRetained.reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0);
+    metrics.retainedCount = projectedRetained.length;
+    const { effectiveHistoryBudget } = resolveEffectiveCompactionBudgets({
+      contextWindow,
+      triggerRatio: plan.diagnostics.triggerRatio,
+      historyBudget: plan.diagnostics.historyBudget,
+      rawMessageBudget: plan.diagnostics.historyBudget,
+      summaryTokens: 0
+    });
+    const withinSafetyBudget = projectedTokens <= effectiveHistoryBudget;
+    if (!withinSafetyBudget) {
+      console.warn("[localLoop] compaction projection remains above safety budget", {
+        projectedTokens,
+        effectiveHistoryBudget
+      });
+    }
+    const oldProjection = projectExisting();
+    const beforeProjectedTokens = toPlanCompressionMessages(oldProjection.history).reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0);
+    const historyBudget = plan.diagnostics.historyBudget;
+    if (projectedTokens >= beforeProjectedTokens || projectedTokens >= historyBudget) {
+      const failureMessage = `compaction candidate rejected: ${projectedTokens >= beforeProjectedTokens ? "no token reduction" : "above history budget"} (before=${beforeProjectedTokens}, after=${projectedTokens}, budget=${historyBudget})`;
+      console.warn(`[localLoop] ${failureMessage}`);
+      recordCompactionFailure(dialogId, args2.now?.() ?? Date.now());
+      logCompactionTiming("empty", {});
+      emitPhase({ kind: "compaction-end" });
+      return {
+        ...oldProjection,
+        failureMessage,
+        ...result4?.usage ? { usage: result4.usage } : {},
+        decision: { outcome: "skipped", skipReason: "unsafe-projection", detail: failureMessage }
+      };
+    }
     const sourceMeta = await computeSummarySourceMetadata(
       toPlanCompressionMessages(history),
-      plan.newSummarizedBeforeId
+      bounded3.summarizedBeforeId
     );
+    if (args2.abortSignal?.aborted) {
+      throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
+    }
     const saveT0 = Date.now();
     await adapter.saveDialogSummary({
       dialogId,
       summary: newSummary,
-      summarizedBeforeId: plan.newSummarizedBeforeId,
+      summarizedBeforeId: bounded3.summarizedBeforeId,
       // 内容寻址失效检测：存锚点切片哈希与长度，供下轮载入校验。
       sourceHash: sourceMeta?.sourceHash,
       sourceCount: sourceMeta?.sourceCount ?? 0,
@@ -19263,14 +19390,6 @@ async function maybeAutoCompactLocalHistory(args2) {
       )
     });
     saveElapsedMs = Date.now() - saveT0;
-    const metricsReason = invalidSummary ? "invalid_summary" : coldResume ? "cold_resume" : "context_budget";
-    const metrics = buildCompactionMetricsFromPlan({
-      reason: metricsReason,
-      previousSummary: existingSummary,
-      plan,
-      newSummary,
-      summaryUsage: result4?.usage
-    });
     console.log(formatCompactionMetricsLog(metrics));
     logCompactionTiming("success", {
       model: result4?.model ?? args2.model ?? null,
@@ -19278,21 +19397,18 @@ async function maybeAutoCompactLocalHistory(args2) {
     });
     emitPhase({ kind: "compaction-end" });
     return {
-      history: projectHistoryWithSummary({
-        history,
-        summary: newSummary,
-        summarizedBeforeId: plan.newSummarizedBeforeId
-      }),
+      history: projectedHistory,
       compressed: true,
       summaryGenerated: true,
       reason: metricsReason,
-      beforeTokens: metrics.previousSummaryTokens + metrics.compressedTokens,
-      afterTokens: metrics.newSummaryTokens + metrics.retainedTokens,
+      beforeTokens: beforeProjectedTokens,
+      afterTokens: projectedTokens,
+      withinSafetyBudget,
       ...result4?.usage ? { usage: result4.usage } : {},
       metrics,
       decision: {
         outcome: "compressed",
-        trigger: invalidSummary ? "invalid-summary" : coldResume ? "cold-resume" : plan.diagnostics?.triggeredByRealUsage ? "real-usage" : "estimate",
+        trigger: invalidSummary ? "invalid-summary" : plan.diagnostics?.triggeredByRealUsage ? "real-usage" : "estimate",
         ...plan.diagnostics ? {
           estimatedTokens: plan.diagnostics.totalUsed,
           historyBudget: plan.diagnostics.historyBudget,
@@ -19330,7 +19446,7 @@ function emitCompactionPhaseEvent(boundary, phase, scope3) {
 function emitCompactionObservationEvent(boundary, compacted) {
   const decision = compacted.decision;
   if (decision?.outcome === "skipped") {
-    const isProtectionGap = decision.skipReason === "adapter-missing-summary-methods" || decision.skipReason === "load-summary-failed";
+    const isProtectionGap = decision.skipReason === "bounded-request-blocked" || decision.skipReason === "unsafe-projection" || decision.skipReason === "adapter-missing-summary-methods" || decision.skipReason === "load-summary-failed";
     const approachingBudget = decision.skipReason === "below-trigger" && typeof decision.estimatedTokens === "number" && typeof decision.historyBudget === "number" && decision.historyBudget > 0 && decision.estimatedTokens >= decision.historyBudget * 0.5;
     if (!isProtectionGap && !approachingBudget) return;
   }
@@ -19338,10 +19454,11 @@ function emitCompactionObservationEvent(boundary, compacted) {
     kind: "compaction",
     atMs: Date.now(),
     ...compacted.reason ? { reason: compacted.reason } : {},
+    ...compacted.withinSafetyBudget === false ? { detail: "Estimated projected history remains above the compaction safety budget" } : {},
     summaryGenerated: compacted.summaryGenerated,
     compressed: compacted.compressed,
     ...compacted.failureMessage ? { failed: true, detail: compacted.failureMessage } : {},
-    ...decision?.outcome === "skipped" ? { skipped: true, skipReason: decision.skipReason } : {},
+    ...decision?.outcome === "skipped" ? { skipped: true, skipReason: decision.skipReason, ...decision.detail ? { detail: decision.detail } : {} } : {},
     ...decision && "trigger" in decision && decision.trigger ? { trigger: decision.trigger } : {},
     ...decision && "estimatedTokens" in decision && decision.estimatedTokens !== void 0 ? { estimatedTokens: decision.estimatedTokens } : {},
     ...decision && "historyBudget" in decision && decision.historyBudget !== void 0 ? { historyBudget: decision.historyBudget } : {},
@@ -19972,13 +20089,23 @@ async function runLocalAgentTurn(input) {
       }
       return resolvedProvider;
     };
+    let resolvedSummaryProvider;
+    const resolveSummaryProviderOnce = async () => {
+      if (!resolvedSummaryProvider) {
+        resolvedSummaryProvider = await input.adapter.resolveProvider(agentConfig, {
+          toolNames: [],
+          prompt: ""
+        });
+      }
+      return resolvedSummaryProvider;
+    };
     const contextWindow = resolveAgentContextWindow(agentConfig);
     const compressionTriggerRatio = resolveCompressionTriggerRatio(contextWindow);
     const compaction = createTurnCompactionController({
       adapter: input.adapter,
       continueDialogId: input.continueDialogId,
       model: agentConfig.model,
-      resolveProvider: resolveProviderOnce,
+      resolveProvider: resolveSummaryProviderOnce,
       contextWindow,
       compressionTriggerRatio,
       abortSignal: input.abortSignal,
@@ -20115,6 +20242,7 @@ async function runLocalAgentTurn(input) {
       };
       const newDialogTelemetryKey = `new:${crypto.randomUUID()}`;
       let roundBudgetWarningInjected = false;
+      let subtaskToolBudgetWarningInjected = false;
       const roundWarningThreshold = input.roundBudgetWarningThreshold ?? DEFAULT_ROUND_BUDGET_WARNING_THRESHOLD;
       while (true) {
         partialContent = "";
@@ -20126,6 +20254,10 @@ async function runLocalAgentTurn(input) {
           transcript.push({ role: "user", content: prompt });
           roundBudgetWarningInjected = true;
         }
+        if (subtaskBudgetTracker && !subtaskToolBudgetWarningInjected && subtaskBudgetTracker.toolCallsExecuted > 0 && subtaskBudgetTracker.remainingToolCalls() > 0 && subtaskBudgetTracker.remainingToolCalls() <= Math.max(1, Math.ceil(subtaskBudgetTracker.limits.maxToolCalls * 0.1))) {
+          transcript.push({ role: "user", content: `\u5B50\u4EFB\u52A1\u5DE5\u5177\u9884\u7B97\u5373\u5C06\u7528\u5C3D\uFF08\u5269\u4F59 ${subtaskBudgetTracker.remainingToolCalls()} \u6B21\uFF09\u3002\u8BF7\u4F18\u5148\u6536\u5C3E\u5E76\u7ED9\u51FA\u53EF\u8BFB\u7684\u9636\u6BB5\u7ED3\u679C\u3002` });
+          subtaskToolBudgetWarningInjected = true;
+        }
         const preparedMessages = prepareMessagesForProviderCall(transcript.working());
         if (!supportsImages && hasImageInRuntimeMessages(preparedMessages.messages) && !imageDowngradeEmitted) {
           emitLoopEvent(observationBoundary, {
@@ -20490,12 +20622,98 @@ ${reasoningTailLog}
     } catch (error) {
       loopError = error;
     }
+    const finalBudgetExhaustion = budgetExhaustion;
+    let budgetWrapupFailure;
+    let budgetWrapupSucceeded = false;
+    if (!loopError && finalBudgetExhaustion && subtaskBudgetTracker && finalBudgetExhaustion.limit === "max-tool-calls" && !input.abortSignal?.aborted && subtaskBudgetTracker.elapsedMs() < subtaskBudgetTracker.limits.maxWallClockMs) {
+      const remainingMs = subtaskBudgetTracker.limits.maxWallClockMs - subtaskBudgetTracker.elapsedMs();
+      const timeoutMs = Math.min(3e4, remainingMs);
+      const controller = new AbortController();
+      let rejectCancelled = () => {
+      };
+      const cancelled = new Promise((_, reject) => {
+        rejectCancelled = reject;
+      });
+      const onAbort = () => {
+        controller.abort();
+        rejectCancelled(buildAbortedError());
+      };
+      input.abortSignal?.addEventListener("abort", onAbort, { once: true });
+      if (input.abortSignal?.aborted) onAbort();
+      let timer;
+      let wrapRequestStarted = false;
+      let wrapUsageCaptured = false;
+      let wrapOutcomeReceived = false;
+      try {
+        const deadline = new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error("budget wrap-up timed out"));
+          }, timeoutMs);
+        });
+        const work = async () => {
+          const wrapProvider = await input.adapter.resolveProvider(agentConfig, { toolNames: [], prompt: "", textOnly: true });
+          if (!wrapProvider.textOnly) throw new Error(`host ${input.adapter.host} does not support isolated text-only provider`);
+          if (controller.signal.aborted || input.abortSignal?.aborted || subtaskBudgetTracker.elapsedMs() >= subtaskBudgetTracker.limits.maxWallClockMs) throw new Error("budget wrap-up cancelled or deadline reached");
+          const wrapMessages = [
+            ...filterImagePartsFromMessages(prepareMessagesForProviderCall(transcript.working()).messages, supportsImages),
+            { role: "user", content: "\u5DE5\u5177\u9884\u7B97\u5DF2\u8017\u5C3D\u3002\u4E0D\u8981\u8C03\u7528\u5DE5\u5177\uFF1B\u4EC5\u57FA\u4E8E\u5DF2\u5B8C\u6210\u5185\u5BB9\uFF0C\u7B80\u8FF0\u7ED3\u679C\u3001\u8BC1\u636E\u4E0E\u672A\u5B8C\u6210\u4E8B\u9879\u3002" }
+          ];
+          const startedAt = Date.now();
+          const telemetry2 = buildRequestTelemetry({ dialogKey: input.continueDialogId || `budget:${crypto.randomUUID()}`, messages: wrapMessages, toolsHash: safeToolNamesHash([]) });
+          wrapRequestStarted = true;
+          const summary2 = await runCompleteWithTimeout({
+            provider: wrapProvider,
+            messages: wrapMessages,
+            options: { max_tokens: 1024, noRetries: true, timeoutMs, signal: controller.signal, ...input.continueDialogId ? { dialogId: input.continueDialogId } : {} },
+            timeoutMs,
+            round,
+            input,
+            boundary: observationBoundary,
+            providerName: agentConfig.provider,
+            model: wrapProvider.model
+          });
+          return { summary: summary2, telemetry: finalizeCallTelemetry(telemetry2, summary2, round, startedAt) };
+        };
+        const { summary, telemetry } = await Promise.race([work(), deadline, cancelled]);
+        wrapOutcomeReceived = true;
+        usageLedger.recordProviderCall({ usage: summary.usage, model: summary.model, provider: summary.provider, telemetry });
+        wrapUsageCaptured = Boolean(summary.usage);
+        if (summary.tool_calls?.length || summary.output?.some((block) => block.type === "toolCall")) throw new Error("text-only provider returned a tool call");
+        if (summary.error || typeof summary.content !== "string" || !summary.content.trim()) throw new Error("text-only provider returned no usable summary");
+        if (input.abortSignal?.aborted) throw buildAbortedError();
+        result4 = { ...result4, content: summary.content.trim().slice(0, 12e3) };
+        budgetWrapupSucceeded = true;
+      } catch (error) {
+        if (input.abortSignal?.aborted) {
+          const aborted = buildAbortedError();
+          if (wrapRequestStarted && !wrapUsageCaptured) {
+            aborted.message += "\uFF08\u65E0\u5DE5\u5177\u603B\u7ED3\u8BF7\u6C42\u53EF\u80FD\u5DF2\u8BA1\u8D39\uFF0C\u672A\u8FD4\u56DE\u7684\u7528\u91CF\u672A\u77E5\uFF09";
+            aborted.usageUnavailable = true;
+          }
+          loopError = aborted;
+        } else {
+          const detail = error instanceof Error ? error.message : "unknown error";
+          budgetWrapupFailure = scrubSecrets(detail).cleaned.slice(0, 300);
+          if (wrapRequestStarted && !wrapOutcomeReceived) budgetWrapupFailure += "\uFF1B\u8BF7\u6C42\u53EF\u80FD\u5DF2\u8BA1\u8D39\uFF0C\u672A\u8FD4\u56DE\u7684\u7528\u91CF\u672A\u77E5";
+        }
+      } finally {
+        if (timer) clearTimeout(timer);
+        controller.abort();
+        input.abortSignal?.removeEventListener("abort", onAbort);
+      }
+    }
+    if (!loopError && input.abortSignal?.aborted) loopError = buildAbortedError();
     if (budgetExhaustion) {
+      if (!budgetWrapupSucceeded && !budgetWrapupFailure) {
+        budgetWrapupFailure = input.abortSignal?.aborted ? "\u7528\u6237\u5DF2\u53D6\u6D88" : "\u5899\u949F\u9884\u7B97\u5DF2\u8017\u5C3D\uFF0C\u672A\u53D1\u8D77\u603B\u7ED3\u8BF7\u6C42";
+      }
       const previousContent = typeof result4?.content === "string" ? result4.content.trim() : "";
       result4 = {
         ...result4,
         content: [
           previousContent,
+          ...budgetWrapupFailure ? [`\u65E0\u5DE5\u5177\u603B\u7ED3\u672A\u5B8C\u6210\uFF08${budgetWrapupFailure}\uFF09\uFF1B\u4EE5\u4E0B\u662F\u4FDD\u7559\u7684\u5DF2\u6709\u5185\u5BB9\u548C\u9884\u7B97\u72B6\u6001\u3002`] : [],
           buildSubtaskBudgetExhaustedContent({
             exhaustion: budgetExhaustion,
             roundsCompleted: round,
@@ -21141,7 +21359,7 @@ async function executeOpenAiCompatibleChatCompletion(args2) {
     terminalIfEnabled(isAbortError(error) ? "aborted" : "network-error");
     throw error;
   }
-  if (res.status === 401 && args2.resolveApiKey) {
+  if (res.status === 401 && args2.resolveApiKey && !args2.noRetries) {
     const refreshed = await args2.resolveApiKey({ force: true });
     if (refreshed && refreshed !== apiKey) {
       diagnosticCall?.httpResult(diagnosticAttempt, {
@@ -21287,7 +21505,193 @@ async function resolveOpenAiCompatibleProviderConfig(args2) {
   };
 }
 
+// packages/agent-runtime/macOsKeychainCredentialBroker.ts
+import { spawn as spawn2 } from "node:child_process";
+var MACOS_KEYCHAIN_SERVICE_PREFIX = "nolo.credentials.keys";
+var MACOS_KEYCHAIN_ACCOUNT = "api-key";
+var SECURITY_ITEM_NOT_FOUND_EXIT = 44;
+var DEFAULT_SECURITY_BIN = "/usr/bin/security";
+function safeCredentialRef(ref) {
+  try {
+    return assertCredentialRef(ref);
+  } catch {
+    throw new Error("invalid_ref");
+  }
+}
+function credentialRefToMacOsKeychainService(ref, servicePrefix = MACOS_KEYCHAIN_SERVICE_PREFIX) {
+  const safe = safeCredentialRef(ref);
+  const hex = Buffer.from(safe, "utf8").toString("hex");
+  if (!hex) {
+    throw new Error("invalid_ref");
+  }
+  return `${servicePrefix}.${hex}`;
+}
+function rethrowBrokerError(op, _error) {
+  throw new Error(`credential_broker_${op}_failed`);
+}
+function createDefaultSecurityRunner(securityBin = DEFAULT_SECURITY_BIN) {
+  return function defaultSecurityRunner(input) {
+    return new Promise((resolve6) => {
+      let settled = false;
+      const finish = (result4) => {
+        if (settled) return;
+        settled = true;
+        resolve6(result4);
+      };
+      let child;
+      try {
+        child = spawn2(securityBin, input.args, {
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      } catch {
+        finish({ exitCode: -1, stdout: "", stderr: "" });
+        return;
+      }
+      let stdout = "";
+      let stderr = "";
+      child.stdout?.setEncoding("utf8");
+      child.stderr?.setEncoding("utf8");
+      child.stdout?.on("data", (chunk) => {
+        stdout += chunk;
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderr += chunk;
+      });
+      child.on("error", () => {
+        finish({ exitCode: -1, stdout: "", stderr: "" });
+      });
+      child.on("close", (code) => {
+        finish({
+          exitCode: typeof code === "number" ? code : -1,
+          stdout,
+          stderr
+        });
+      });
+      if (input.stdin !== void 0) {
+        child.stdin?.write(input.stdin);
+      }
+      child.stdin?.end();
+    });
+  };
+}
+function createMacOsKeychainCredentialBroker(options = {}) {
+  const runner = options.runner ?? createDefaultSecurityRunner(options.securityBin);
+  const servicePrefix = options.servicePrefix ?? MACOS_KEYCHAIN_SERVICE_PREFIX;
+  const account = options.account ?? MACOS_KEYCHAIN_ACCOUNT;
+  const serviceFor = (ref) => credentialRefToMacOsKeychainService(ref, servicePrefix);
+  return {
+    async get(ref) {
+      const safeRef = safeCredentialRef(ref);
+      const service4 = serviceFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "find-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4,
+            "-w"
+          ]
+        });
+      } catch (error) {
+        rethrowBrokerError("get", error);
+      }
+      if (result4.exitCode === SECURITY_ITEM_NOT_FOUND_EXIT) {
+        return null;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError("get");
+      }
+      const secret = result4.stdout.replace(/\n$/, "");
+      return secret.length > 0 ? secret : null;
+    },
+    async put(ref, secret) {
+      const safeRef = safeCredentialRef(ref);
+      const value = asTrimmedString(secret);
+      if (!value) {
+        throw new Error("Cannot store an empty credential secret.");
+      }
+      const service4 = serviceFor(safeRef);
+      const stdin = `${value}
+${value}
+`;
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "add-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4,
+            "-U",
+            "-w"
+          ],
+          stdin
+        });
+      } catch (error) {
+        rethrowBrokerError("put", error);
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError("put");
+      }
+    },
+    async delete(ref) {
+      const safeRef = safeCredentialRef(ref);
+      const service4 = serviceFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "delete-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4
+          ]
+        });
+      } catch (error) {
+        rethrowBrokerError("delete", error);
+      }
+      if (result4.exitCode === 0 || result4.exitCode === SECURITY_ITEM_NOT_FOUND_EXIT) {
+        return;
+      }
+      rethrowBrokerError("delete");
+    },
+    async has(ref) {
+      const safeRef = safeCredentialRef(ref);
+      const service4 = serviceFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: [
+            "find-generic-password",
+            "-a",
+            account,
+            "-s",
+            service4
+          ]
+        });
+      } catch (error) {
+        rethrowBrokerError("has", error);
+      }
+      if (result4.exitCode === SECURITY_ITEM_NOT_FOUND_EXIT) {
+        return false;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError("has");
+      }
+      return true;
+    }
+  };
+}
+
 // packages/agent-runtime/windowsCredentialManagerBroker.ts
+import { spawn as spawn3 } from "node:child_process";
+var WINDOWS_CREDENTIAL_TARGET_PREFIX = "nolo.credentials.keys";
+var WIN_ERROR_NOT_FOUND = 1168;
 var WINDOWS_CREDENTIAL_MANAGER_SCRIPT = `
 $ErrorActionPreference = 'Stop'
 try {
@@ -21410,6 +21814,419 @@ public class NoloCredNative {
   exit 1
 }
 `.trim();
+function safeCredentialRef2(ref) {
+  try {
+    return assertCredentialRef(ref);
+  } catch {
+    throw new Error("invalid_ref");
+  }
+}
+function credentialRefToWindowsCredentialTarget(ref, targetPrefix = WINDOWS_CREDENTIAL_TARGET_PREFIX) {
+  const safe = safeCredentialRef2(ref);
+  const hex = Buffer.from(safe, "utf8").toString("hex");
+  if (!hex) {
+    throw new Error("invalid_ref");
+  }
+  return `${targetPrefix}.${hex}`;
+}
+function rethrowBrokerError2(op, _error) {
+  throw new Error(`credential_broker_${op}_failed`);
+}
+function buildWindowsCredentialPowerShellArgs(script = WINDOWS_CREDENTIAL_MANAGER_SCRIPT) {
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  return [
+    "-NoProfile",
+    "-NonInteractive",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-EncodedCommand",
+    encoded
+  ];
+}
+function requestStdin(payload) {
+  return JSON.stringify(payload);
+}
+function parseGetSecretFromStdout(stdout) {
+  const trimmed = asTrimmedString(stdout);
+  if (!trimmed) {
+    rethrowBrokerError2("get");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    rethrowBrokerError2("get");
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || typeof parsed.secret !== "string") {
+    rethrowBrokerError2("get");
+  }
+  return parsed.secret;
+}
+function spawnShell(bin, args2, stdin) {
+  return new Promise((resolve6) => {
+    let settled = false;
+    const finish = (result4) => {
+      if (settled) return;
+      settled = true;
+      resolve6(result4);
+    };
+    let child;
+    try {
+      child = spawn3(bin, args2, {
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+    } catch {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", () => {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+    });
+    child.on("close", (code) => {
+      finish({
+        exitCode: typeof code === "number" ? code : -1,
+        stdout,
+        stderr
+      });
+    });
+    if (stdin !== void 0) {
+      child.stdin?.write(stdin);
+    }
+    child.stdin?.end();
+  });
+}
+function createDefaultWindowsCredentialRunner(shellBin) {
+  let resolvedBin = shellBin ?? null;
+  return async function defaultWindowsCredentialRunner(input) {
+    if (resolvedBin) {
+      return spawnShell(resolvedBin, input.args, input.stdin);
+    }
+    const first = await spawnShell("powershell.exe", input.args, input.stdin);
+    if (first.exitCode !== -1) {
+      resolvedBin = "powershell.exe";
+      return first;
+    }
+    const second = await spawnShell("pwsh", input.args, input.stdin);
+    if (second.exitCode !== -1) {
+      resolvedBin = "pwsh";
+    }
+    return second;
+  };
+}
+function createWindowsCredentialManagerBroker(options = {}) {
+  const runner = options.runner ?? createDefaultWindowsCredentialRunner(options.shellBin);
+  const targetPrefix = options.targetPrefix ?? WINDOWS_CREDENTIAL_TARGET_PREFIX;
+  const targetFor = (ref) => credentialRefToWindowsCredentialTarget(ref, targetPrefix);
+  const staticArgs = buildWindowsCredentialPowerShellArgs();
+  return {
+    async get(ref) {
+      const safeRef = safeCredentialRef2(ref);
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "get", target })
+        });
+      } catch (error) {
+        rethrowBrokerError2("get", error);
+      }
+      if (result4.exitCode === WIN_ERROR_NOT_FOUND) {
+        return null;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError2("get");
+      }
+      const secret = parseGetSecretFromStdout(result4.stdout);
+      return secret.length > 0 ? secret : null;
+    },
+    async put(ref, secret) {
+      const safeRef = safeCredentialRef2(ref);
+      const value = asTrimmedString(secret);
+      if (!value) {
+        throw new Error("Cannot store an empty credential secret.");
+      }
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "put", target, secret: value })
+        });
+      } catch (error) {
+        rethrowBrokerError2("put", error);
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError2("put");
+      }
+    },
+    async delete(ref) {
+      const safeRef = safeCredentialRef2(ref);
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "delete", target })
+        });
+      } catch (error) {
+        rethrowBrokerError2("delete", error);
+      }
+      if (result4.exitCode === 0 || result4.exitCode === WIN_ERROR_NOT_FOUND) {
+        return;
+      }
+      rethrowBrokerError2("delete");
+    },
+    async has(ref) {
+      const safeRef = safeCredentialRef2(ref);
+      const target = targetFor(safeRef);
+      let result4;
+      try {
+        result4 = await runner({
+          args: staticArgs,
+          stdin: requestStdin({ op: "has", target })
+        });
+      } catch (error) {
+        rethrowBrokerError2("has", error);
+      }
+      if (result4.exitCode === WIN_ERROR_NOT_FOUND) {
+        return false;
+      }
+      if (result4.exitCode !== 0) {
+        rethrowBrokerError2("has");
+      }
+      return true;
+    }
+  };
+}
+
+// packages/agent-runtime/linuxSecretServiceCredentialBroker.ts
+import { spawn as spawn4 } from "node:child_process";
+var LINUX_SECRET_SERVICE_ATTRIBUTE = "nolo-credential";
+var SECRET_TOOL_NO_MATCH_EXIT = 1;
+var DEFAULT_SECRET_TOOL_BIN = "secret-tool";
+function safeCredentialRef3(ref) {
+  try {
+    return assertCredentialRef(ref);
+  } catch {
+    throw new Error("invalid_ref");
+  }
+}
+function brokerFailure(op) {
+  throw new Error(`credential_broker_${op}_failed`);
+}
+function createDefaultSecretToolRunner(secretToolBin = DEFAULT_SECRET_TOOL_BIN) {
+  return (input) => new Promise((resolve6) => {
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (result4) => {
+      if (settled) return;
+      settled = true;
+      resolve6(result4);
+    };
+    let child;
+    try {
+      child = spawn4(secretToolBin, input.args, {
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    } catch {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+      return;
+    }
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", () => {
+      finish({ exitCode: -1, stdout: "", stderr: "" });
+    });
+    child.on("close", (code) => {
+      finish({
+        exitCode: typeof code === "number" ? code : -1,
+        stdout,
+        stderr
+      });
+    });
+    if (input.stdin !== void 0) {
+      child.stdin?.write(input.stdin);
+    }
+    child.stdin?.end();
+  });
+}
+function createLinuxSecretServiceCredentialBroker(options = {}) {
+  const runner = options.runner ?? createDefaultSecretToolRunner(options.secretToolBin);
+  const attribute = options.attribute ?? LINUX_SECRET_SERVICE_ATTRIBUTE;
+  const attrArgs = (ref) => [attribute, ref];
+  const lookup3 = async (ref) => {
+    try {
+      return await runner({ args: ["lookup", ...attrArgs(ref)] });
+    } catch {
+      brokerFailure("get");
+    }
+  };
+  return {
+    async get(ref) {
+      const safeRef = safeCredentialRef3(ref);
+      const result4 = await lookup3(safeRef);
+      if (result4.exitCode === SECRET_TOOL_NO_MATCH_EXIT) return null;
+      if (result4.exitCode !== 0) brokerFailure("get");
+      const secret = result4.stdout.replace(/\n$/, "");
+      return secret.length > 0 ? secret : null;
+    },
+    async put(ref, secret) {
+      const safeRef = safeCredentialRef3(ref);
+      const value = asTrimmedString(secret);
+      if (!value) {
+        throw new Error("Cannot store an empty credential secret.");
+      }
+      const args2 = [
+        "store",
+        `--label=nolo-credential:${safeRef}`,
+        ...attrArgs(safeRef)
+      ];
+      if (value.includes("\n") || args2.some((arg) => arg.includes(value))) {
+        brokerFailure("put");
+      }
+      let result4;
+      try {
+        result4 = await runner({ args: args2, stdin: value });
+      } catch {
+        brokerFailure("put");
+      }
+      if (result4.exitCode !== 0) brokerFailure("put");
+    },
+    async delete(ref) {
+      const safeRef = safeCredentialRef3(ref);
+      let result4;
+      try {
+        result4 = await runner({ args: ["clear", ...attrArgs(safeRef)] });
+      } catch {
+        brokerFailure("delete");
+      }
+      if (result4.exitCode === 0 || result4.exitCode === SECRET_TOOL_NO_MATCH_EXIT) {
+        return;
+      }
+      brokerFailure("delete");
+    },
+    async has(ref) {
+      const safeRef = safeCredentialRef3(ref);
+      const result4 = await lookup3(safeRef);
+      if (result4.exitCode === SECRET_TOOL_NO_MATCH_EXIT) return false;
+      if (result4.exitCode !== 0) brokerFailure("has");
+      return true;
+    }
+  };
+}
+
+// packages/agent-runtime/desktopHostCredentialBroker.ts
+function createClosedCredentialBroker(code = "credential_store_unavailable") {
+  const fail9 = () => {
+    throw new Error(code);
+  };
+  return {
+    get: fail9,
+    put: fail9,
+    delete: fail9,
+    has: () => false
+  };
+}
+function createHostCredentialBrokerChain(args2) {
+  const { strict, session, legacy, notifySessionFallback, notifyLegacyHit } = args2;
+  const legacyNoticed = /* @__PURE__ */ new Set();
+  let sessionNotified = false;
+  const noticeSession = () => {
+    if (sessionNotified || !notifySessionFallback) return;
+    sessionNotified = true;
+    try {
+      notifySessionFallback();
+    } catch {
+    }
+  };
+  return {
+    async get(ref) {
+      try {
+        const strictValue = await strict.get(ref);
+        if (strictValue !== null && strictValue !== void 0) return strictValue;
+      } catch {
+      }
+      const sessionValue = await session.get(ref);
+      if (sessionValue !== null && sessionValue !== void 0) return sessionValue;
+      if (!legacy) return null;
+      const legacyValue = await legacy.get(ref);
+      if (legacyValue !== null && legacyValue !== void 0) {
+        if (notifyLegacyHit && !legacyNoticed.has(ref)) {
+          legacyNoticed.add(ref);
+          try {
+            notifyLegacyHit(ref);
+          } catch {
+          }
+        }
+        return legacyValue;
+      }
+      return null;
+    },
+    async put(ref, secret) {
+      try {
+        await strict.put(ref, secret);
+        if (await strict.has(ref)) return;
+      } catch {
+      }
+      await session.put(ref, secret);
+      noticeSession();
+    },
+    async delete(ref) {
+      try {
+        await strict.delete(ref);
+      } catch {
+      }
+      try {
+        await session.delete(ref);
+      } catch {
+      }
+      if (legacy) await legacy.delete(ref);
+    },
+    async has(ref) {
+      try {
+        if (await strict.has(ref)) return true;
+      } catch {
+      }
+      if (await session.has(ref)) return true;
+      return legacy ? await legacy.has(ref) : false;
+    }
+  };
+}
+function createStrictHostCredentialBroker(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const override = String(env.NOLO_DESKTOP_CREDENTIAL_STORE ?? "").trim().toLowerCase();
+  if (override === "file") {
+    return createClosedCredentialBroker("credential_store_file_not_allowed");
+  }
+  if (platform === "darwin" || override === "keychain") {
+    return options.keychainBroker ?? (options.createKeychainBroker ?? (() => createMacOsKeychainCredentialBroker()))();
+  }
+  if (platform === "win32" || override === "credman") {
+    return options.windowsCredentialBroker ?? (options.createWindowsCredentialBroker ?? (() => createWindowsCredentialManagerBroker()))();
+  }
+  if (platform === "linux" || override === "secret-service") {
+    return options.linuxSecretServiceBroker ?? (options.createLinuxSecretServiceBroker ?? (() => createLinuxSecretServiceCredentialBroker()))();
+  }
+  return createClosedCredentialBroker("credential_store_unsupported");
+}
 
 // packages/agent-runtime/dialogMessageRecord.ts
 function dialogMessageRecordToAgentRuntimeMessage(record2) {
@@ -21767,9 +22584,23 @@ async function fetchHybridRemoteRecord(args2) {
       ...args2.signal ? { signal: args2.signal } : {}
     }
   );
-  if (!response.ok) return null;
-  const payload = await response.json().catch(() => null);
-  return normalizeHybridRecord(args2.dbKey, payload?.data ?? payload, args2.server);
+  if (!response.ok) {
+    if (response.status !== 404) args2.onUnavailable?.();
+    return null;
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    args2.onUnavailable?.();
+    return null;
+  }
+  const record2 = payload && typeof payload === "object" && "data" in payload ? payload.data : payload;
+  if (record2 !== null && (!record2 || typeof record2 !== "object" || Array.isArray(record2))) {
+    args2.onUnavailable?.();
+    return null;
+  }
+  return normalizeHybridRecord(args2.dbKey, record2, args2.server);
 }
 function shouldCacheHybridRemoteRecord(remoteRecord, localRecord) {
   if (!remoteRecord || typeof remoteRecord !== "object") return false;
@@ -21798,7 +22629,10 @@ function createHybridRecordStore(deps) {
         deps.fallbackServers
       )) {
         const remainingMs = fallbackDeadlineMs === null ? null : fallbackDeadlineMs - Date.now();
-        if (remainingMs !== null && remainingMs <= 0) break;
+        if (remainingMs !== null && remainingMs <= 0) {
+          options?.onRemoteUnavailable?.();
+          break;
+        }
         let remoteRecord = null;
         try {
           remoteRecord = await fetchHybridRemoteRecord({
@@ -21806,9 +22640,11 @@ function createHybridRecordStore(deps) {
             server,
             authToken: deps.authToken,
             fetchImpl,
+            onUnavailable: options?.onRemoteUnavailable,
             ...remainingMs !== null ? { signal: AbortSignal.timeout(remainingMs) } : {}
           });
         } catch {
+          options?.onRemoteUnavailable?.();
           continue;
         }
         if (!remoteRecord) continue;
@@ -21861,11 +22697,11 @@ async function readNoloProcessStream(readable) {
 async function runNoloWorkspaceCliTool(call, args2) {
   const cliArgs = buildNoloWorkspaceCommandArgs(call);
   const bunSpawn = globalThis.Bun?.spawn;
-  const spawn2 = args2.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
+  const spawn5 = args2.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
   const execPath = args2.processExecPath ?? process.execPath;
   const entrypoint = args2.cliEntrypoint;
   const cmd = entrypoint && entrypoint !== execPath ? [execPath, entrypoint, ...cliArgs] : [execPath, ...cliArgs];
-  const proc = spawn2({
+  const proc = spawn5({
     cmd,
     stdout: "pipe",
     stderr: "pipe",
@@ -21980,7 +22816,7 @@ function buildLoadSkillExecutor(args2) {
     const { resolveSkillByName } = await import("./skillDiscovery-XKHROSH2.js");
     const resolved = resolveSkillByName(args2.cwd, name);
     if (!resolved) {
-      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-HH75G5J3.js");
+      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-2QETTQPM.js");
       const builtin = resolveBuiltinSkillByName(name);
       if (builtin) {
         return {
@@ -22039,7 +22875,7 @@ async function loadPreciseSkill(cwd, parsed) {
     if (!nonEmpty(parsed.slug) || has2("projectBinding") || has2("relativePath")) {
       return reject("builtin requires only an exact slug.");
     }
-    const { listBuiltinSkills } = await import("./builtinSkillRegistry-HH75G5J3.js");
+    const { listBuiltinSkills } = await import("./builtinSkillRegistry-2QETTQPM.js");
     const builtin = listBuiltinSkills().find((entry) => entry.slug === parsed.slug);
     if (!builtin) return reject("builtin slug not found.");
     return {
@@ -22742,16 +23578,20 @@ function verifyOwnerRouteAck(headers, expectedRequestId) {
 }
 
 export {
+  createHostCredentialBrokerChain,
+  createStrictHostCredentialBroker,
   readCommandActionGatePayload,
   readActionGate,
   Option_exports,
   Duration_exports,
   Exit_exports,
   Effect_exports,
+  scrubSecrets,
   isDestructiveShellCommand,
   evaluateShellCommandPolicy,
   filterRetainedLedgerRecords,
   isLineRangeCovered,
+  runTaskStop,
   WORKSPACE_TOOL_NAMES,
   buildLocalWorkspaceToolset,
   buildLocalWorkspacePolicyToolNames,