nolo-cli 0.211.0 → 0.213.0

package/{chunk-M4NTDZG3.js → chunk-UYD5HQ6T.js}

@@ -1,3 +1,17 @@
+import {
+  defaultLoopbackRequest
+} from "./chunk-VP3BINY7.js";
+import {
+  clearCredentialAvailability,
+  markCredentialUnavailable,
+  readCredentialEntry
+} from "./chunk-YTF4WH7J.js";
+import {
+  CREDENTIAL_STORE_SESSION_FALLBACK_WARNING,
+  OAUTH_PROVIDER_REFS,
+  buildLocalAgentLookupKeys,
+  getSharedSessionCredentialBroker
+} from "./chunk-MOIJOHA5.js";
 import {
   customNativeAuthHeaders,
   detectDeclaredCustomNativeWire,
@@ -15,26 +29,16 @@ import {
   resolveClaudeCodeVersion,
   resolveServerSyncConfig,
   xaiRefresh
-} from "./chunk-SN5XE6GQ.js";
-import {
-  defaultLoopbackRequest
-} from "./chunk-VP3BINY7.js";
+} from "./chunk-RPQXPZZF.js";
 import {
-  clearCredentialAvailability,
-  markCredentialUnavailable,
-  readCredentialEntry,
-  readEffectiveCredentialEntry,
-  recordCredentialProbe
-} from "./chunk-GSQNH63I.js";
-import {
-  OAUTH_PROVIDER_REFS,
-  buildLocalAgentLookupKeys
-} from "./chunk-7AUQ3WCW.js";
+  extractLastUserText,
+  localTurnHasSubjectRefs,
+  resolveLocalUserId,
+  withResolvedRuntimeToolSurface
+} from "./chunk-G7MLNNEX.js";
 import {
   LOCAL_CODEX_AGENT_ID,
-  LOCAL_CODEX_AGENT_KEY,
-  NOLO_DEFAULT_AGENT_ID,
-  NOLO_DEFAULT_AGENT_KEY
+  LOCAL_CODEX_AGENT_KEY
 } from "./chunk-NBTY7YJF.js";
 import {
   CliProviderQuotaError,
@@ -60,14 +64,14 @@ import {
 } from "./chunk-F7CI2ZC5.js";
 import {
   applyPublicAgentCatalogOverride
-} from "./chunk-RQ22OZD7.js";
+} from "./chunk-H2TJUNCH.js";
 import {
   buildCliPrompt
 } from "./chunk-ATNTHIZI.js";
 import {
   inlineImageUrlsForCustomProvider,
   prepareTools
-} from "./chunk-25M2K6OA.js";
+} from "./chunk-G2BQWAVT.js";
 import {
   getServerProviderSecret
 } from "./chunk-HS7MLR74.js";
@@ -89,7 +93,7 @@ import {
   resolveCliLocalRuntimeKeyCapability,
   resolveCliLocalSpawnDispatch,
   resolveStartAgentRunCwd
-} from "./chunk-LT3EAHJY.js";
+} from "./chunk-XHQC4PXX.js";
 import {
   fetchWithTransientRetry,
   isTransientFetchError
@@ -97,37 +101,39 @@ import {
 import {
   deriveCredentialGroup,
   deriveCustomProviderCredentialGroup
-} from "./chunk-YXOBCDNW.js";
+} from "./chunk-QG4AOSON.js";
 import {
   inferCaptureIntent,
   resolveUserSkillRuntime
-} from "./chunk-NEZGPBL7.js";
+} from "./chunk-ZNWI6OVT.js";
 import {
   resolveAgentRequiredPackIds,
   resolveUserEnabledSkills
-} from "./chunk-I5PBXF7O.js";
+} from "./chunk-R5O4QAWG.js";
 import {
   applyBuiltinAgentRuntimeOverride,
-  applyTokenUsageToDayStats,
-  format,
   prepareTokenUsageData,
   resolveBuiltinPlatformAgentConfig,
   runKeyed,
   validateAskChoiceInput
-} from "./chunk-MBS6CTZB.js";
+} from "./chunk-ZXOUUDCG.js";
+import {
+  applyTokenUsageToDayStats,
+  require_format
+} from "./chunk-7RFNTILS.js";
 import {
   BUILTIN_DIALOG_LLM_CHAT_FALLBACK_MODEL,
   BUILTIN_TITLE_LLM_CONFIG
 } from "./chunk-523DITKR.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-ADBWFYJD.js";
+} from "./chunk-KFLT5KAD.js";
 import {
   getDefaultCliLocalRuntimeDb
 } from "./chunk-AZMYUSVF.js";
 import {
   isTombstoneRecord
-} from "./chunk-D2MDMY2M.js";
+} from "./chunk-SVYO6AO7.js";
 import {
   FORCED_TOOLS,
   addDefaultLightWebToolsForConfiguredAgents,
@@ -137,7 +143,7 @@ import {
   applySystemBuiltinSkillFilter,
   expandEnabledPacks,
   resolveEffectiveEnabledPacks
-} from "./chunk-TPCDYNJK.js";
+} from "./chunk-EHGEOAHI.js";
 import {
   DEFAULT_HYBRID_READ_TIMEOUT_MS,
   Duration_exports,
@@ -153,9 +159,11 @@ import {
   buildNoloWorkspaceCliToolExecutors,
   codexStreamFailureStatus,
   createDevinProvider,
+  createHostCredentialBrokerChain,
   createHybridRecordStore,
   createLocalWorkspaceToolExecutors,
   createResponsesStreamCollector,
+  createStrictHostCredentialBroker,
   deriveStableUuid,
   dialogMessageRecordToAgentRuntimeMessage,
   executeLocalToolWithPolicy,
@@ -181,7 +189,18 @@ import {
   runExecShellGates,
   validateConfiguredRootExecutionLease,
   verifyOwnerRouteAck
-} from "./chunk-ZOO3WJIE.js";
+} from "./chunk-RSHTSUEG.js";
+import {
+  PlatformStreamInterruptedError,
+  buildPlatformChatCompletionRequest,
+  canUsePlatformChatProvider,
+  hasDirectOpenAiCompatibleProvider,
+  parsePlatformChatCompletionData,
+  parsePlatformChatCompletionResponse,
+  readPlatformChatSseCompletion,
+  resolvePlatformChatProviderConfig,
+  shouldUsePlatformChatProvider
+} from "./chunk-OQPKUBPB.js";
 import {
   accumulateGeminiChunks,
   buildGeminiGenerateContentRequest,
@@ -193,32 +212,21 @@ import {
   resolveAntigravityFinishReason,
   resolveGeminiModelQuirks,
   shouldUseGeminiNativeToolRoute
-} from "./chunk-NTSRCTUX.js";
-import {
-  PlatformStreamInterruptedError,
-  buildPlatformChatCompletionRequest,
-  canUsePlatformChatProvider,
-  hasDirectOpenAiCompatibleProvider,
-  parsePlatformChatCompletionData,
-  parsePlatformChatCompletionResponse,
-  readPlatformChatSseCompletion,
-  resolvePlatformChatProviderConfig,
-  shouldUsePlatformChatProvider
-} from "./chunk-TCTSYFDM.js";
+} from "./chunk-CTPXME7U.js";
 import {
   readSseDataValues,
   readSseFrames
 } from "./chunk-HNUWUO75.js";
 import {
   resolveAgentRuntimeConfigFromRecord
-} from "./chunk-LNYHAKBP.js";
+} from "./chunk-W4S457LU.js";
 import {
   collectStablePromptPrefix,
   convertMessagesToResponsesInput,
   findAgentStatePairingIssues,
   stablePromptCacheKey,
   toResponsesTools
-} from "./chunk-CVCRAO6Q.js";
+} from "./chunk-H5HF7TJA.js";
 import {
   EMPTY_TOOL_RESULT_TEXT,
   createToolImageBudget,
@@ -232,32 +240,39 @@ import {
   buildNoloWorkspaceOpenAiTools,
   filterClientNoloWorkspaceToolNames,
   parseNoloWorkspaceToolArguments,
-  resolveRequestToolSurface,
-  resolveRuntimeToolSurfaceForAgent
-} from "./chunk-6HVBI6TI.js";
+  resolveDispatchedSubtaskBudget
+} from "./chunk-RZOV7OMV.js";
 import {
+  extractQuotaSnapshot,
   isCapacitySaturatedRateLimit,
   mergeAvailabilityDeadline,
   resolveAvailabilityAction,
-  resolveCooldownGate,
   resolveCredentialKeyWithFallback
-} from "./chunk-YUXQAVRD.js";
+} from "./chunk-3UKL3HPD.js";
+import {
+  resolveRequestToolSurface
+} from "./chunk-KC4XDTT3.js";
 import {
   resolveHistoricalToolContentCap
-} from "./chunk-2WZXXAQD.js";
+} from "./chunk-YB3YZK56.js";
 import {
   resolveToolImagePolicy
-} from "./chunk-DA7CTWT4.js";
+} from "./chunk-YWSEPJ7C.js";
 import {
   buildDialogFallbackTitleFromUserInput,
   normalizeDialogTitle
 } from "./chunk-2MBTWINN.js";
 import {
-  normalizeUsage
-} from "./chunk-WTKYP6QO.js";
-import {
-  isDevinOAuthAgent
-} from "./chunk-5ZUL4CUO.js";
+  CODEX_OAUTH_CATALOG_RETRY_FLOOR_MS,
+  CODEX_OAUTH_CATALOG_TTL_MS,
+  codexOAuthCatalogAccountKey,
+  codexOAuthCatalogSnapshot,
+  commitCodexOAuthCatalogWindows,
+  isCodexOAuthAgent,
+  markCodexOAuthCatalogFailure,
+  normalizeUsage,
+  resolveCodexOAuthEffectiveModel
+} from "./chunk-V5Y3R6BT.js";
 import {
   createProviderCallTimingTracker,
   finalizeProviderCallTiming,
@@ -265,6 +280,9 @@ import {
   observeMeaningfulProviderResponseAt,
   withProviderCallTimingFields
 } from "./chunk-H57T64RA.js";
+import {
+  isDevinOAuthAgent
+} from "./chunk-5ZUL4CUO.js";
 import {
   isOAuthApiKeyRef
 } from "./chunk-UKZX3NHN.js";
@@ -275,35 +293,26 @@ import {
   resolveCurrentRunRuntimeToolPolicy,
   resolveLocalWorkspaceExecutorOptionsFromPolicy,
   resolveRequestedRuntimeToolNames
-} from "./chunk-TRZP7JZ7.js";
+} from "./chunk-2QHFH3DR.js";
 import {
   createFileCredentialBroker
-} from "./chunk-UIOEHFF6.js";
+} from "./chunk-OQHIVPG4.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
 import {
   compactWhitespace
 } from "./chunk-DWLEOOGR.js";
-import {
-  createOAuthTokenStore,
-  isTokenExpired,
-  readOAuthCredential,
-  resolveFreshAccessToken
-} from "./chunk-G7Y4GXTY.js";
 import {
   canonicalizeToolNames
-} from "./chunk-AKE53VMW.js";
+} from "./chunk-ZCWRMUWT.js";
 import {
   CHROME_CONNECTOR_ACCEPTED_TOOL_NAMES,
   canonicalizeChromeConnectorToolNames
 } from "./chunk-ZC3CMUKU.js";
-import {
-  isSystemBuiltinTrustedAgentKey
-} from "./chunk-LOEO7LRC.js";
 import {
   isAntigravityOAuthAgent
-} from "./chunk-PLYWH7XM.js";
+} from "./chunk-KIM6CLW5.js";
 import {
   ackRunRecord,
   appendRunQueue,
@@ -318,18 +327,21 @@ import {
   queryRunRecords,
   readHostMemory,
   releaseRunRecordAck,
-  remoteDialogSyncTimeout,
   resolveRunsDir,
-  resolveRuntimeAuthToken,
-  resolveRuntimeServerUrl,
   serializeQueueEntries,
   spawnLocalBackgroundRun,
   terminateRunProcess,
   transitionRunToTerminal,
   withQueueLock
-} from "./chunk-C2XZM3K4.js";
+} from "./chunk-NSAPDIN2.js";
+import {
+  remoteDialogSyncTimeout,
+  resolveRuntimeAuthToken,
+  resolveRuntimeServerUrl
+} from "./chunk-HRMJUN5J.js";
 import {
   TASK_PREVIEW_MAX,
+  formatControlRunMessageCard,
   formatListRunsCard,
   formatNotFoundRunCard,
   formatStartRunCard,
@@ -340,14 +352,14 @@ import {
   normalizeRunTitle,
   resolveRunLabel,
   shortRunId
-} from "./chunk-PJNFNEJE.js";
+} from "./chunk-ALQ3657A.js";
 import {
   estimateTokenCount
 } from "./chunk-PSCNXBYA.js";
 import {
   buildProviderSessionHeaders,
   resolvePlatformAuthToken
-} from "./chunk-PV6JJAUB.js";
+} from "./chunk-TCZHTTUU.js";
 import {
   anthropicOAuthModelMaxOutputTokens,
   findModelConfig,
@@ -363,6 +375,9 @@ import {
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
 import {
   getLogger
 } from "./chunk-EYLGAEB4.js";
@@ -387,13 +402,19 @@ import {
 import {
   agentRunCardLabels,
   t
-} from "./chunk-3RQVYR4B.js";
+} from "./chunk-VNYYOX3V.js";
+import {
+  createOAuthTokenStore,
+  isTokenExpired,
+  readOAuthCredential,
+  resolveFreshAccessToken
+} from "./chunk-G7Y4GXTY.js";
 import {
   createTokenDialogIndexKey,
   createTokenKey,
   createTokenStatsKey,
   createUserKey
-} from "./chunk-ECX3NKRD.js";
+} from "./chunk-JY5NGFFH.js";
 import {
   dialogMessageKey,
   dialogMessagePrefix,
@@ -406,8 +427,8 @@ import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
 import {
-  asTrimmedLowercaseString
-} from "./chunk-QSJ3HFEF.js";
+  __toESM
+} from "./chunk-4VNS5WPM.js";
 
 // packages/agent-runtime/anthropicMessagesProvider.ts
 import { randomUUID } from "node:crypto";
@@ -1047,7 +1068,7 @@ async function fetchAnthropicMessagesCompletion(args) {
     const errorBody = await response.json().catch(async () => ({
       error: { message: await response.text().catch(() => response.statusText) }
     }));
-    if (adoptRequiredClaudeCodeVersion(errorBody)) {
+    if (!args.noRetries && adoptRequiredClaudeCodeVersion(errorBody)) {
       response = await (args.fetchImpl ?? fetch)(ANTHROPIC_MESSAGES_URL, {
         method: "POST",
         headers: buildHeaders(),
@@ -1514,6 +1535,8 @@ var resolveAnthropicOAuthTransport = async (ctx) => {
         const result = await fetchAnthropicMessagesCompletion({
           agentConfig,
           accessToken,
+          signal: options?.signal,
+          ...options?.noRetries ? { noRetries: true } : {},
           openAiBody: {
             model: agentConfig.model || "claude-sonnet-5",
             messages,
@@ -1522,7 +1545,8 @@ var resolveAnthropicOAuthTransport = async (ctx) => {
           },
           fetchImpl: (url, init) => fetchWithTransientRetry(fetchImpl, url, init, {
             sleep: deps.sleep,
-            loopbackRequest
+            loopbackRequest,
+            ...options?.noRetries ? { maxAttempts: 1, coreDrainingMaxAttempts: 1 } : {}
           })
         });
         await recordLocalAvailability(result.status, result.body);
@@ -1836,61 +1860,6 @@ function summarizeEndpoint(value) {
   }
 }
 
-// packages/cli/client/cliAgentConfigHelpers.ts
-var BUILTIN_NOLO_AGENT_KEY = NOLO_DEFAULT_AGENT_KEY;
-var BUILTIN_NOLO_AGENT_ID = NOLO_DEFAULT_AGENT_ID;
-function resolveLocalUserId(env) {
-  const explicitUserId = env.NOLO_LOCAL_USER_ID || env.NOLO_USER_ID;
-  if (explicitUserId) return explicitUserId;
-  const tokenUserId = parseUserIdFromAuthToken(resolveRuntimeAuthToken(env));
-  return tokenUserId || "local";
-}
-function isBuiltinNoloAgentRef(ref) {
-  if (typeof ref !== "string") return false;
-  const normalized = ref.trim();
-  return normalized === BUILTIN_NOLO_AGENT_KEY || normalized === BUILTIN_NOLO_AGENT_ID || normalized.endsWith(`-${BUILTIN_NOLO_AGENT_ID}`);
-}
-function isBuiltinNoloAgentConfig(agentConfig) {
-  const key = agentConfig?.key || agentConfig?.rawRecord?.dbKey || agentConfig?.rawRecord?.agentKey;
-  const id = agentConfig?.rawRecord?.id;
-  return isBuiltinNoloAgentRef(key) || isBuiltinNoloAgentRef(id);
-}
-function withResolvedRuntimeToolSurface(agentConfig, env) {
-  if (!agentConfig) return agentConfig;
-  const currentUserId = resolveLocalUserId(env);
-  const rawRecord = agentConfig.rawRecord ?? {};
-  const ownerId = asOptionalTrimmedString(rawRecord.userId) ?? null;
-  const agentKey = rawRecord.dbKey ?? agentConfig.key;
-  const toolSurface = resolveRuntimeToolSurfaceForAgent({
-    explicitToolNames: agentConfig.toolNames,
-    currentUserId,
-    agentOwnerId: ownerId,
-    agentKey,
-    isPublic: !isBuiltinNoloAgentConfig(agentConfig) && rawRecord.isPublic === true,
-    sharingLevel: typeof rawRecord.sharingLevel === "string" ? rawRecord.sharingLevel : null,
-    trustedPrivateInvocation: isBuiltinNoloAgentConfig(agentConfig) || isSystemBuiltinTrustedAgentKey(agentKey),
-    runtimeHost: "cli"
-  });
-  return {
-    ...agentConfig,
-    toolNames: toolSurface.finalToolNames,
-    toolSurface,
-    prompt: agentConfig.prompt
-  };
-}
-function extractLastUserText(messages) {
-  const lastUser = [...messages].reverse().find((m) => m.role === "user");
-  if (!lastUser) return "";
-  if (typeof lastUser.content === "string") return lastUser.content;
-  if (Array.isArray(lastUser.content)) {
-    return lastUser.content.filter((part) => part?.type === "text").map((part) => part.text ?? "").join(" ");
-  }
-  return "";
-}
-function localTurnHasSubjectRefs(input) {
-  return Array.isArray(input.runtimeContext?.subjectRefs) && input.runtimeContext.subjectRefs.length > 0;
-}
-
 // packages/cli/client/providerResolution/antigravityTransport.ts
 var resolveAntigravityTransport = async (ctx) => {
   const {
@@ -1968,7 +1937,7 @@ var resolveAntigravityTransport = async (ctx) => {
             agentConfig,
             resolveCredential: resolveLocalCredential,
             // 非 OAuth（api-key ref）不重试：metered key 没有 refresh 语义。
-            supportsAuthRetry: !isApiKeyRef,
+            supportsAuthRetry: !isApiKeyRef && !options?.noRetries,
             openAiBody,
             ...options?.signal ? { signal: options.signal } : {},
             // whole-invocation timeout 透传：seam 最外层 timeoutOption 统一 interrupt
@@ -1978,7 +1947,8 @@ var resolveAntigravityTransport = async (ctx) => {
             onReasoningDelta: options?.onReasoningDelta,
             fetchImpl: (url, init) => fetchWithTransientRetry(fetchImpl, url, init, {
               sleep: deps.sleep,
-              loopbackRequest
+              loopbackRequest,
+              ...options?.noRetries ? { maxAttempts: 1, coreDrainingMaxAttempts: 1 } : {}
             })
           });
         } catch (error) {
@@ -2299,6 +2269,7 @@ function collectCliProviderImageInputs(messages) {
 var resolveCliProviderTransport = async (ctx) => {
   const { agentConfig, deps, workspaceRoot } = ctx;
   if (isCliProviderAgent(agentConfig)) {
+    if (ctx.textOnly) throw new Error("local CLI subprocess does not support isolated text-only mode");
     const provider = resolveCliProviderName(agentConfig);
     logLocalRuntimeDiagnostic("provider.selected", {
       agentKey: agentConfig.key,
@@ -2361,41 +2332,6 @@ var resolveCliProviderTransport = async (ctx) => {
 // packages/agent-runtime/codexResponsesProvider.ts
 import { createHash } from "node:crypto";
 import { randomUUID as randomUUID2 } from "node:crypto";
-
-// packages/agent-runtime/codexOAuthModelAliases.ts
-var CODEX_OAUTH_MODEL_ALIASES = {
-  // sol 家族最新：gpt-6.1-sol
-  "gpt-6-sol": {
-    aliasOf: "gpt-6.1-sol",
-    since: "2026-11-01",
-    reason: "\u540C\u5BB6\u65CF\u6362\u4EE3\uFF0Cowner \u51B3\u5B9A\u900F\u660E\u91CD\u5B9A\u5411\uFF08sol \u5BB6\u65CF\u6700\u65B0\u4E3A gpt-6.1-sol\uFF09\u3002"
-  },
-  "gpt-5.6-sol": {
-    aliasOf: "gpt-6.1-sol",
-    since: "2026-11-01",
-    reason: "\u540C\u5BB6\u65CF\u6362\u4EE3\uFF0Cowner \u51B3\u5B9A\u900F\u660E\u91CD\u5B9A\u5411\uFF08sol \u5BB6\u65CF\u6700\u65B0\u4E3A gpt-6.1-sol\uFF09\u3002"
-  },
-  // terra 家族最新：gpt-6.1-terra
-  "gpt-5.6-terra": {
-    aliasOf: "gpt-6.1-terra",
-    since: "2026-11-01",
-    reason: "\u540C\u5BB6\u65CF\u6362\u4EE3\uFF0Cowner \u51B3\u5B9A\u900F\u660E\u91CD\u5B9A\u5411\uFF08terra \u5BB6\u65CF\u6700\u65B0\u4E3A gpt-6.1-terra\uFF09\u3002"
-  },
-  // luna 家族最新：gpt-6-luna（上游无 6.1-luna，luna 家族最新即为 gpt-6-luna）
-  "gpt-5.6-luna": {
-    aliasOf: "gpt-6-luna",
-    since: "2026-11-01",
-    reason: "\u540C\u5BB6\u65CF\u6362\u4EE3\uFF0Cowner \u51B3\u5B9A\u900F\u660E\u91CD\u5B9A\u5411\uFF08luna \u5BB6\u65CF\u6700\u65B0\u4E3A gpt-6-luna\uFF09\u3002"
-  }
-};
-function resolveCodexOAuthEffectiveModel(model) {
-  const raw = asOptionalTrimmedString(model);
-  if (!raw) return void 0;
-  const normalized = raw.toLowerCase();
-  return CODEX_OAUTH_MODEL_ALIASES[normalized]?.aliasOf ?? raw;
-}
-
-// packages/agent-runtime/codexResponsesProvider.ts
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var CODEX_CLIENT_VERSION = "0.162.1";
 var CODEX_ORIGINATOR = "codex_cli_rs";
@@ -2546,6 +2482,8 @@ function buildCodexRequestBody(args, identity = createCodexRequestIdentity(), se
     prompt_cache_key: sessionKey && isStableSessionIdentityEnabled() ? identity.sessionId : stablePromptCacheKey([model, stableInstructions, tools ?? []], "nolo-codex"),
     client_metadata: identity.clientMetadata
   };
+  const reasoningEffort = args.openAiBody.reasoning_effort;
+  if (reasoningEffort === "low") body.reasoning = { effort: reasoningEffort };
   if (instructions) body.instructions = instructions;
   if (tools && tools.length > 0) {
     body.tools = tools;
@@ -2721,10 +2659,96 @@ async function fetchCodexResponsesCompletion(args) {
   }
   return result;
 }
-function isCodexOAuthAgent(agentConfig) {
-  if (!agentConfig) return false;
-  const apiKeyRef = asTrimmedLowercaseString(agentConfig.apiKeyRef);
-  return apiKeyRef === "chatgpt";
+
+// packages/agent-runtime/codexOAuthModelCatalog.ts
+var CODEX_OAUTH_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
+var CODEX_OAUTH_CATALOG_REQUEST_TIMEOUT_MS = 4e3;
+var inFlightCatalogFetches = /* @__PURE__ */ new Map();
+var catalogRequestUrl = () => `${CODEX_OAUTH_MODELS_URL}?client_version=${encodeURIComponent(CODEX_CLIENT_VERSION)}`;
+var parseCodexOAuthModelCatalog = (payload) => {
+  const models = payload?.models;
+  if (!Array.isArray(models)) return null;
+  const windows = {};
+  for (const entry of models) {
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry;
+    const slug = typeof record.slug === "string" ? record.slug.trim().toLowerCase() : "";
+    if (!slug) continue;
+    const contextWindow = record.context_window;
+    if (typeof contextWindow !== "number" || !Number.isInteger(contextWindow) || contextWindow <= 0) {
+      continue;
+    }
+    windows[slug] = contextWindow;
+  }
+  return windows;
+};
+var reportCodexOAuthCatalogFailure = (stage, accountId) => {
+  try {
+    const account = accountId ? accountId.slice(0, 6) : null;
+    console.debug(
+      `[codexOAuthModelCatalog] ${stage}${account ? ` account=${account}\u2026` : ""}`
+    );
+  } catch {
+  }
+};
+async function ensureCodexOAuthModelCatalog(args) {
+  const accessToken = args.accessToken?.trim();
+  if (!accessToken) return;
+  const accountId = args.accountId?.trim() || void 0;
+  const nowMs = () => args.now ? args.now() : Date.now();
+  const ttlMs = args.ttlMs ?? CODEX_OAUTH_CATALOG_TTL_MS;
+  const accountKey = codexOAuthCatalogAccountKey(accountId);
+  const snapshot = codexOAuthCatalogSnapshot(accountId);
+  const now = nowMs();
+  if (snapshot.fetchedAt !== null && now - snapshot.fetchedAt < ttlMs) return;
+  if (snapshot.lastFailureAt !== null && now - snapshot.lastFailureAt < CODEX_OAUTH_CATALOG_RETRY_FLOOR_MS) {
+    return;
+  }
+  const pending = inFlightCatalogFetches.get(accountKey);
+  if (pending) {
+    await pending;
+    return;
+  }
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const timeoutMs = args.timeoutMs ?? CODEX_OAUTH_CATALOG_REQUEST_TIMEOUT_MS;
+  const job = (async () => {
+    try {
+      const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        originator: CODEX_ORIGINATOR,
+        version: CODEX_CLIENT_VERSION,
+        Accept: "application/json"
+      };
+      if (accountId) headers["chatgpt-account-id"] = accountId;
+      const response = await fetchImpl(catalogRequestUrl(), {
+        method: "GET",
+        headers,
+        signal: typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" && timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : void 0
+      });
+      if (!response.ok) {
+        markCodexOAuthCatalogFailure({ accountId, now: nowMs() });
+        reportCodexOAuthCatalogFailure(`http ${response.status}`, accountId);
+        return;
+      }
+      const payload = await response.json();
+      const windows = parseCodexOAuthModelCatalog(payload);
+      if (!windows) {
+        markCodexOAuthCatalogFailure({ accountId, now: nowMs() });
+        reportCodexOAuthCatalogFailure("malformed payload", accountId);
+        return;
+      }
+      commitCodexOAuthCatalogWindows({ accountId, models: windows, now: nowMs() });
+    } catch {
+      markCodexOAuthCatalogFailure({ accountId, now: nowMs() });
+      reportCodexOAuthCatalogFailure("request failed", accountId);
+    }
+  })();
+  inFlightCatalogFetches.set(accountKey, job);
+  try {
+    await job;
+  } finally {
+    inFlightCatalogFetches.delete(accountKey);
+  }
 }
 
 // packages/cli/client/providerResolution/codexOAuthTransport.ts
@@ -2829,7 +2853,12 @@ var resolveCodexOAuthTransport = async (ctx) => {
           trace.log("headers", { attempt, status: res.status });
           return res;
         };
+        if (!options?.noRetries) void ensureCodexOAuthModelCatalog({
+          accessToken,
+          ...accountId ? { accountId } : {}
+        });
         const result = await fetchCodexResponsesCompletion({
+          ...options?.noRetries ? { maxAttempts: 1 } : {},
           agentConfig,
           accessToken,
           ...accountId ? { accountId } : {},
@@ -2837,7 +2866,8 @@ var resolveCodexOAuthTransport = async (ctx) => {
             model: agentConfig.model || "gpt-5.6-sol",
             messages,
             stream: false,
-            ...tools.length > 0 ? { tools } : {}
+            ...tools.length > 0 ? { tools } : {},
+            ...options?.reasoning_effort ? { reasoning_effort: options.reasoning_effort } : {}
           },
           sessionKey: resolveSessionKey({ dialogId: options?.dialogId }),
           signal: options?.signal,
@@ -2846,7 +2876,8 @@ var resolveCodexOAuthTransport = async (ctx) => {
           fetchImpl: (url, init) => fetchWithTransientRetry(observedFetch, url, init, {
             // 内层退避也要能被本次请求的 signal 打断（见 abortableSleep 注释）。
             sleep: (ms) => abortableSleep(deps.sleep, ms, init?.signal ?? options?.signal),
-            loopbackRequest
+            loopbackRequest,
+            ...options?.noRetries ? { maxAttempts: 1, coreDrainingMaxAttempts: 1 } : {}
           })
         });
         await recordLocalAvailability(result.status, result.body);
@@ -3233,7 +3264,11 @@ var resolveCursorTransport = async (ctx) => {
         }
       };
     };
-    const confirmExternalFileAccess = deps.confirmDestructiveAction;
+    const hostConfirm = deps.confirmDestructiveAction;
+    const confirmExternalFileAccess = hostConfirm ? async (request) => {
+      const decision = await hostConfirm(request);
+      return typeof decision === "boolean" ? decision : decision.approved === true;
+    } : void 0;
     const cursorSearchWorkspace = (args) => internalSearchWorkspace({
       workspaceRoot,
       query: args.query,
@@ -3255,9 +3290,11 @@ var resolveCursorTransport = async (ctx) => {
       model: agentConfig.model || "cursor-default",
       systemPrompt: agentConfig.prompt?.trim() || void 0,
       tools,
-      executeTool: cursorExecuteTool,
-      searchWorkspace: cursorSearchWorkspace,
-      listWorkspaceEntries: cursorListWorkspaceEntries
+      ...ctx.textOnly ? {} : {
+        executeTool: cursorExecuteTool,
+        searchWorkspace: cursorSearchWorkspace,
+        listWorkspaceEntries: cursorListWorkspaceEntries
+      }
     });
     return {
       model: agentConfig.model || "cursor-default",
@@ -3444,13 +3481,15 @@ var resolveDirectOpenAiCompatibleTransport = async (ctx) => {
         tools,
         fetchImpl: (url, init) => fetchWithTransientRetry(fetchImpl, url, init, {
           sleep: deps.sleep,
-          loopbackRequest
+          loopbackRequest,
+          ...options?.noRetries ? { maxAttempts: 1, coreDrainingMaxAttempts: 1 } : {}
         }),
         stream,
         sessionId: asOptionalTrimmedString(options?.dialogId) ?? asOptionalTrimmedString(agentConfig.key),
         onTextDelta: options?.onTextDelta,
         onReasoningDelta: options?.onReasoningDelta,
         signal: options?.signal,
+        ...options?.noRetries ? { noRetries: true } : {},
         outboundDiagnostics: options?.requestId ? { callId: options.requestId } : void 0,
         onHttpResult: ({ status, body }) => recordLocalAvailability(status, body),
         ...resolveRequestApiKey ? { resolveApiKey: resolveRequestApiKey } : {}
@@ -3780,14 +3819,8 @@ var resolveOwnerOAuthProxyTransport = async (ctx) => {
               retryNetworkErrors: false,
               // 内层预算按「剩余总额度」裁剪：普通可重试状态码 ≤ 3 次、503
               // core_draining 排空窗口 ≤ 30 次，且都不超过剩余总额度。
-              maxAttempts: Math.min(
-                OWNER_PROXY_GENERIC_MAX_ATTEMPTS,
-                remaining
-              ),
-              coreDrainingMaxAttempts: Math.min(
-                OWNER_PROXY_CORE_DRAINING_MAX_ATTEMPTS,
-                remaining
-              ),
+              maxAttempts: options?.noRetries ? 1 : Math.min(OWNER_PROXY_GENERIC_MAX_ATTEMPTS, remaining),
+              coreDrainingMaxAttempts: options?.noRetries ? 1 : Math.min(OWNER_PROXY_CORE_DRAINING_MAX_ATTEMPTS, remaining),
               // 注意：计数必须**无条件**挂在 onRetry 上——若只在有 activityReporter
               // 时才挂，innerRetries / usedAttempts 会漏计，重试预算就形同虚设。
               onRetry: ({ attempt, maxAttempts, delayMs }) => {
@@ -3802,7 +3835,7 @@ var resolveOwnerOAuthProxyTransport = async (ctx) => {
           usedAttempts += 1;
           return { response, innerRetried: innerRetries > 0 };
         };
-        const res = await sendWithOwnerOriginMismatchRetry(
+        const res = options?.noRetries ? (await send()).response : await sendWithOwnerOriginMismatchRetry(
           send,
           init.signal ?? void 0,
           deps.activityReporter ? ({ attempt, maxAttempts, delayMs }) => {
@@ -4005,6 +4038,7 @@ var resolvePlatformProxyTransport = async (ctx) => {
             {
               sleep: deps.sleep,
               loopbackRequest,
+              ...options?.noRetries ? { maxAttempts: 1, coreDrainingMaxAttempts: 1 } : {},
               // A chat POST is not safe to replay after an ambiguous network or
               // gateway failure: the server/provider may already have accepted
               // it. The client only waits through the server's explicit pre-
@@ -4155,6 +4189,27 @@ async function resolveLocalProvider(ctx) {
   );
 }
 
+// packages/cli/client/providerResolveOverrides.ts
+function resolveProviderResolveOverrides(agentConfig, options) {
+  if (!options) return agentConfig;
+  const { toolNames, prompt } = options;
+  if (toolNames === void 0 && prompt === void 0) return agentConfig;
+  const current = agentConfig;
+  return {
+    ...agentConfig,
+    ...toolNames !== void 0 ? {
+      toolNames,
+      exposedToolNames: toolNames,
+      toolSurface: { ...current.toolSurface, finalToolNames: toolNames },
+      runScopedToolSurface: {
+        ...current.runScopedToolSurface,
+        finalToolNames: toolNames
+      }
+    } : {},
+    ...prompt !== void 0 ? { prompt } : {}
+  };
+}
+
 // packages/cli/client/localRuntimePaths.ts
 import { dirname, extname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -4443,7 +4498,7 @@ function clipLocalWakeEvidence(value, max = 1200) {
 function buildLocalWakeDisplayText(args) {
   const failed = args.terminalStatus !== "done";
   const duration = typeof args.durationMs === "number" && args.durationMs >= 0 ? ` \xB7 ${Math.floor(args.durationMs / 6e4)}m${Math.floor(args.durationMs / 1e3) % 60}s` : "";
-  return `1 \u6761\u540E\u53F0 run \u5DF2\u5B8C\u6210 \xB7 ${failed ? "\u2717" : "\u2713"} ${args.label || "\u540E\u53F0 run"}${failed ? ` ${args.terminalStatus}` : ""}${duration}`;
+  return `1 \u6761\u540E\u53F0 run \u5DF2\u7ED3\u675F \xB7 ${failed ? "\u2717" : "\u2713"} ${args.label || "\u540E\u53F0 run"} [${args.terminalStatus}]${duration}`;
 }
 function buildLocalParentWakeMessage(args) {
   return [
@@ -5940,21 +5995,27 @@ var INSTABOX_DEFAULT_BASE_URL = "https://api.instabox.sh/v1";
 var INSTABOX_MAX_EXEC_SECONDS = 600;
 var INSTABOX_MAX_STDIN_BYTES = 1024 * 1024;
 var SAFE_MESSAGE = {
+  instabox_upload_failed: "Instabox file upload failed",
+  instabox_recovery_failed: "Instabox recovery persistence or authority validation failed",
+  instabox_recovery_unknown: "Instabox machine identity is unknown; manual reconciliation required",
   "instabox_invalid_config": "Rejected: instabox backend needs an apiKey and a templateId",
   "instabox_invalid_ticket": "Rejected: execution ticket cannot be satisfied by the instabox backend",
   "instabox_unsupported_request": "Request is not supported by the instabox backend",
   "instabox_lease_not_found": "Unknown execution lease",
   "instabox_lease_mismatch": "Lease does not match this backend or ticket",
   "instabox_lease_released": "Lease was already released",
+  "instabox_lease_stopping": "Lease stop was requested; execution is fenced",
   "instabox_create_failed": "Instabox machine create failed",
   "instabox_create_unconfirmed": "Instabox machine create could not be confirmed",
   "instabox_exec_failed": "Instabox exec could not be completed",
+  "instabox_delete_forbidden": "Instabox machine deletion is forbidden; machine was not cleaned up",
   "instabox_cleanup_pending": "Instabox machine delete could not be confirmed; cleanup is pending"
 };
 var InstaboxBackendError = class extends Error {
-  constructor(code, detail, cleanupPending = false, machineId, upstreamErrorCode) {
+  constructor(code, detail, cleanupPending = false, machineId, upstreamErrorCode, recovery) {
     super(detail ? `${SAFE_MESSAGE[code]} (${detail})` : SAFE_MESSAGE[code]);
     this.machineId = machineId;
+    this.recovery = recovery;
     this.name = "InstaboxBackendError";
     this.code = code;
     this.cleanupPending = cleanupPending;
@@ -5965,6 +6026,7 @@ var InstaboxBackendError = class extends Error {
   cleanupPending;
   upstreamErrorCode;
 };
+var INSTABOX_MAX_UPLOAD_BYTES = 5 * 1024 ** 3;
 var DEFAULT_OPERATION_WAIT_SECONDS = 20;
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 var DEFAULT_MAX_POLL_ATTEMPTS = 30;
@@ -6041,6 +6103,7 @@ var InstaboxBackend = class {
   #machineTimeoutSeconds;
   #createTimeoutMs;
   #deleteTimeoutMs;
+  #stopTimeoutMs;
   #operationWaitSeconds;
   #pollIntervalMs;
   #maxPollAttempts;
@@ -6049,9 +6112,23 @@ var InstaboxBackend = class {
   #creationPlan;
   #freeOrgObservation;
   #billingPolicy;
+  #deletionPolicy;
   #deleteMachineImpl;
+  #recovery;
   #leases = /* @__PURE__ */ new Map();
+  #recoveryWrites = /* @__PURE__ */ new WeakMap();
   constructor(options) {
+    if (options.deletionPolicy !== void 0 && options.deletionPolicy !== "legacy" && options.deletionPolicy !== "forbid") {
+      throw new InstaboxBackendError("instabox_invalid_config", "invalid deletion policy");
+    }
+    this.#deletionPolicy = options.deletionPolicy ?? "legacy";
+    if (options.recovery) {
+      const a = options.recovery.authority;
+      if (this.#deletionPolicy !== "forbid" || !options.creationPlan || !options.recovery.accountId?.trim() || !a?.ownerUserId?.trim() || !a.ticketId?.trim() || !a.grantId?.trim() || !Number.isSafeInteger(a.generation) || a.generation < 0) {
+        throw new InstaboxBackendError("instabox_invalid_config", "invalid recovery binding");
+      }
+      this.#recovery = { ...options.recovery, authority: structuredClone(a) };
+    }
     const apiKey = options.apiKey?.trim() ?? "";
     const templateId = options.templateId?.trim() ?? "";
     if (!apiKey || !templateId) {
@@ -6077,11 +6154,21 @@ var InstaboxBackend = class {
       ""
     );
     this.#now = options.now ?? Date.now;
-    this.#fetch = options.fetchImpl ?? ((url, init) => globalThis.fetch(url, init));
+    this.#fetch = options.fetchImpl ?? ((url, init) => {
+      const { rawBody, ...request } = init;
+      return globalThis.fetch(url, {
+        ...request,
+        ...rawBody === void 0 ? {} : { body: rawBody }
+      });
+    });
     this.#sleep = options.sleepImpl ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
     this.#machineTimeoutSeconds = options.machineTimeoutSeconds ?? 1800;
     this.#createTimeoutMs = options.createTimeoutMs ?? 18e4;
     this.#deleteTimeoutMs = options.deleteTimeoutMs ?? 12e4;
+    this.#stopTimeoutMs = options.stopTimeoutMs ?? 12e4;
+    if (!Number.isFinite(this.#stopTimeoutMs) || this.#stopTimeoutMs <= 0) {
+      throw new InstaboxBackendError("instabox_invalid_config");
+    }
     this.#operationWaitSeconds = options.operationWaitSeconds ?? DEFAULT_OPERATION_WAIT_SECONDS;
     this.#pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     this.#maxPollAttempts = options.maxPollAttempts ?? DEFAULT_MAX_POLL_ATTEMPTS;
@@ -6103,6 +6190,15 @@ var InstaboxBackend = class {
    * 成功时刻（不采信 202 响应时间，那是「已受理」不是「可用」）。
    */
   async prepare(ticket) {
+    const context = {};
+    try {
+      return await this.#prepare(ticket, context);
+    } catch (error) {
+      if (context.record) throw this.#withRecovery(error, context.record);
+      throw error;
+    }
+  }
+  async #prepare(ticket, context) {
     if (ticket.version !== 1 || !ticket.ticketId || !ticket.grantId) {
       throw new InstaboxBackendError("instabox_invalid_ticket");
     }
@@ -6116,23 +6212,61 @@ var InstaboxBackend = class {
       }
     }
     const machineName = plan?.name ?? buildInstaboxMachineName(ticket.ticketId, ticket.agentKey);
+    const createBody = plan ? {
+      name: plan.name,
+      templateId: plan.templateId,
+      orgId: plan.orgId,
+      vcpus: plan.vcpus,
+      memMiB: plan.memMiB
+    } : {
+      name: machineName,
+      templateId: this.#templateId,
+      timeoutSeconds: this.#machineTimeoutSeconds
+    };
+    const createKey2 = buildInstaboxCreateIdempotencyKey(ticket.ticketId);
+    if (this.#recovery && plan) {
+      const authority = this.#recovery.authority;
+      if (ticket.ticketId !== authority.ticketId || ticket.grantId !== authority.grantId || ticket.callerUserId !== authority.ownerUserId) {
+        throw new InstaboxBackendError("instabox_recovery_failed");
+      }
+      const expectedSpec = this.#freeOrgObservation.allowedSpecs.find(
+        (s) => s.vcpus === plan.vcpus && s.memMiB === plan.memMiB
+      );
+      context.record = {
+        version: 1,
+        recordId: crypto.randomUUID(),
+        revision: 0,
+        ...authority,
+        accountId: this.#recovery.accountId,
+        provider: "instabox",
+        baseUrl: this.#baseUrl,
+        plan: structuredClone(plan),
+        billingPolicy: this.#billingPolicy,
+        persistentDiskGiB: expectedSpec.persistentDiskGiB,
+        create: {
+          method: "POST",
+          path: "/machines",
+          body: JSON.stringify(createBody),
+          idempotencyKey: createKey2,
+          requestedAt,
+          state: "submitted-unknown"
+        },
+        stop: { intent: false, accepted: false }
+      };
+      await this.#saveRecovery(context.record);
+    }
     const created = await this.#call({
       method: "POST",
       path: "/machines",
-      idempotencyKey: buildInstaboxCreateIdempotencyKey(ticket.ticketId),
-      body: plan ? {
-        name: plan.name,
-        templateId: plan.templateId,
-        orgId: plan.orgId,
-        vcpus: plan.vcpus,
-        memMiB: plan.memMiB
-        // Ordinary API keys cannot change free maxRunMinutes. Do not send it.
-      } : {
-        name: machineName,
-        templateId: this.#templateId,
-        timeoutSeconds: this.#machineTimeoutSeconds
-      }
+      idempotencyKey: createKey2,
+      body: createBody
     });
+    if (context.record) {
+      context.record.machineId = readString2(asRecord(created.payload)?.machineId) ?? void 0;
+      context.record.createOperationId = readString2(asRecord(created.payload)?.id) ?? void 0;
+      if (isSuccess(created.status)) context.record.create.state = "responded";
+      await this.#saveRecovery(context.record);
+    }
     if (!isSuccess(created.status)) {
       const upstreamCode = extractInstaboxErrorCode(created.payload);
       let detail = `create HTTP ${created.status}`;
@@ -6205,6 +6339,7 @@ var InstaboxBackend = class {
       if (this.#billingPolicy === "free-only" && machine.maxRunMinutes !== 480) mismatches.push("maxRunMinutes mismatch");
       if (mismatches.length > 0) {
         const reason = mismatches.join("; ");
+        this.#assertDeletionAllowed(machineId, reason);
         try {
           if (this.#deleteMachineImpl) {
             await this.#deleteMachineImpl(machineId);
@@ -6250,6 +6385,7 @@ var InstaboxBackend = class {
     const usageBaselineRunningMs = baseline === null ? null : Math.round(baseline.runningSeconds * 1e3);
     const leaseId = `${machineId}:${ticket.ticketId}`;
     this.#leases.set(leaseId, {
+      recovery: context.record,
       machineId,
       ticketId: ticket.ticketId,
       grantId: ticket.grantId,
@@ -6258,7 +6394,9 @@ var InstaboxBackend = class {
       createOperationId: operationId,
       usageBaselineRunningMs,
       releasedAt: null,
-      releaseOutcome: null
+      releaseOutcome: null,
+      stopState: null,
+      stopAccepted: false
     });
     return {
       leaseId,
@@ -6269,6 +6407,7 @@ var InstaboxBackend = class {
       readableRoots: [...ticket.filesystem.readableRoots],
       writableRoots: [...ticket.filesystem.writableRoots],
       metadata: {
+        ...context.record ? { recoveryRecordId: context.record.recordId } : {},
         machineId,
         machineName,
         templateId: this.#templateId,
@@ -6279,11 +6418,92 @@ var InstaboxBackend = class {
       }
     };
   }
+  /** Official OpenAPI: upload-url is on the API's own origin, then PUT raw
+   * bytes with the signed token and NO API credential. No redirect is followed.
+   * Caller retains ownership of bytes and must not mutate them until completion.
+   * Provider follows target symlinks: lexical /workspace validation is not an OS
+   * containment guarantee. Deliver source before executing untrusted code. */
+  async uploadFile(lease, input) {
+    const entry = this.#requireEntry(lease);
+    const checkLease = () => {
+      if (entry.releasedAt !== null) throw new InstaboxBackendError("instabox_lease_released");
+      if (entry.stopState !== null) throw new InstaboxBackendError("instabox_lease_stopping");
+    };
+    const fail5 = () => new InstaboxBackendError("instabox_upload_failed");
+    checkLease();
+    if (!input || typeof input.path !== "string" || !input.path.startsWith("/workspace/") || input.path.endsWith("/") || input.path.split("/").some((p, i) => i > 0 && (!p || p === "." || p === "..")) || /[\\\x00-\x1f\x7f]/.test(input.path) || !(input.bytes instanceof Uint8Array) || input.bytes.byteLength > INSTABOX_MAX_UPLOAD_BYTES || !input.signal || !Number.isFinite(input.deadlineAt)) throw fail5();
+    let base;
+    try {
+      base = new URL(this.#baseUrl);
+    } catch {
+      throw fail5();
+    }
+    if (base.protocol !== "https:" || base.username || base.password || base.search || base.hash) throw fail5();
+    const controller = new AbortController();
+    const remaining = input.deadlineAt - this.#now();
+    if (input.signal.aborted || remaining <= 0) throw fail5();
+    const started = performance.now();
+    const timeLeft = () => Math.min(input.deadlineAt - this.#now(), remaining - (performance.now() - started));
+    let timer;
+    let onAbort;
+    const interrupted = new Promise((_resolve, reject) => {
+      onAbort = () => {
+        controller.abort();
+        reject(fail5());
+      };
+      input.signal.addEventListener("abort", onAbort, { once: true });
+      const tick = () => {
+        const left = timeLeft();
+        if (left <= 0) onAbort();
+        else timer = setTimeout(tick, Math.min(left, 2147483647));
+      };
+      tick();
+    });
+    const check = () => {
+      checkLease();
+      if (input.signal.aborted || controller.signal.aborted || timeLeft() <= 0) throw fail5();
+    };
+    try {
+      check();
+      const response = await Promise.race([this.#call({
+        method: "POST",
+        path: `/machines/${encodeURIComponent(entry.machineId)}/files/upload-url`,
+        body: { path: input.path, parents: true },
+        signal: controller.signal,
+        redirect: "error"
+      }), interrupted]);
+      check();
+      const payload = asRecord(response.payload);
+      if (response.status !== 201 || !payload || payload.method !== "PUT" || payload.path !== input.path || typeof payload.url !== "string" || typeof payload.expiresAt !== "string" || !Number.isSafeInteger(payload.maxBytes) || payload.maxBytes < input.bytes.byteLength || payload.maxBytes > INSTABOX_MAX_UPLOAD_BYTES || !Number.isFinite(Date.parse(payload.expiresAt)) || Date.parse(payload.expiresAt) <= this.#now()) throw fail5();
+      const url = new URL(payload.url);
+      if (url.protocol !== "https:" || url.origin !== base.origin || url.username || url.password || url.hash || url.pathname !== `${base.pathname}/machines/${encodeURIComponent(entry.machineId)}/files` || !url.searchParams.get("token")) throw fail5();
+      check();
+      const uploaded = await Promise.race([this.#fetch(url.href, {
+        method: "PUT",
+        headers: { "Content-Type": "application/octet-stream" },
+        rawBody: input.bytes,
+        signal: controller.signal,
+        redirect: "error"
+      }), interrupted]);
+      check();
+      if (uploaded.redirected || !isSuccess(uploaded.status)) throw fail5();
+    } catch (error) {
+      checkLease();
+      throw fail5();
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+      if (onAbort) input.signal.removeEventListener("abort", onAbort);
+      controller.abort();
+    }
+  }
   async execute(lease, request, onEvent) {
     const entry = this.#requireEntry(lease);
     if (entry.releasedAt !== null) {
       throw new InstaboxBackendError("instabox_lease_released");
     }
+    if (entry.stopState !== null) {
+      throw entry.recovery ? this.#withRecovery(new InstaboxBackendError("instabox_lease_stopping"), entry.recovery) : new InstaboxBackendError("instabox_lease_stopping");
+    }
     if (request.kind !== "command") {
       throw new InstaboxBackendError(
         "instabox_unsupported_request",
@@ -6302,11 +6522,17 @@ var InstaboxBackend = class {
     const executionId = `${entry.machineId}:${this.#now().toString(36)}`;
     const startedAt = this.#now();
     onEvent?.({ type: "started", executionId, at: startedAt });
+    if (entry.stopState !== null) {
+      throw entry.recovery ? this.#withRecovery(new InstaboxBackendError("instabox_lease_stopping"), entry.recovery) : new InstaboxBackendError("instabox_lease_stopping");
+    }
     const response = await this.#call({
       method: "POST",
       path: `/machines/${encodeURIComponent(entry.machineId)}/exec`,
       body: { cmd, timeoutSeconds, ...stdin === void 0 ? {} : { stdin } }
     });
+    if (entry.stopState !== null) {
+      throw entry.recovery ? this.#withRecovery(new InstaboxBackendError("instabox_lease_stopping"), entry.recovery) : new InstaboxBackendError("instabox_lease_stopping");
+    }
     if (!isSuccess(response.status)) {
       throw new InstaboxBackendError(
         "instabox_exec_failed",
@@ -6341,6 +6567,9 @@ var InstaboxBackend = class {
       usage: { wallMs: Math.max(0, this.#now() - startedAt) }
     });
     onEvent?.({ type: "exited", executionId, exitCode });
+    if (entry.stopState !== null) {
+      throw entry.recovery ? this.#withRecovery(new InstaboxBackendError("instabox_lease_stopping"), entry.recovery) : new InstaboxBackendError("instabox_lease_stopping");
+    }
     return {
       executionId,
       ok: !timedOut && exitCode === 0,
@@ -6353,6 +6582,114 @@ var InstaboxBackend = class {
       }
     };
   }
+  /**
+   * Official contract verified from https://api.instabox.sh/v1/openapi.json:
+   * POST /v1/machines/{id}/stop -> 202 Operation (not a Machine).
+   * GET /v1/machines/{id} -> Machine; only state=stopped confirms shutdown.
+   * No release/delete, and no inference from operation success, 404 or desiredState.
+   * State is process-local. Restart recovery requires a durable lease/machine binding,
+   * stop intent, idempotency key and reconciliation API owned by the caller.
+   * A caller publishing an already-resolved execute result must also fence its
+   * own run generation/cancellation state: this backend cannot revoke that result.
+   * The request deadline bounds observation, not transport cancellation; an HTTP
+   * request may settle late, so retries keep the same stop idempotency key.
+   */
+  async stop(lease) {
+    const entry = this.#requireEntry(lease);
+    if (entry.releasedAt !== null) {
+      throw new InstaboxBackendError("instabox_lease_released");
+    }
+    if (entry.stopState === "stopped") {
+      return { ok: true, state: "stopped", machineId: entry.machineId };
+    }
+    if (entry.stopTask) return entry.stopTask;
+    entry.stopState = "unknown";
+    const task = this.#stopEntry(entry);
+    entry.stopTask = task;
+    try {
+      return await task;
+    } catch (error) {
+      if (entry.recovery) throw this.#withRecovery(error, entry.recovery);
+      throw error;
+    } finally {
+      entry.stopTask = void 0;
+    }
+  }
+  async #stopEntry(entry) {
+    const startedAt = this.#now();
+    const wallStartedAt = Date.now();
+    const remaining = () => this.#stopTimeoutMs - Math.max(
+      this.#now() - startedAt,
+      Date.now() - wallStartedAt
+    );
+    if (entry.recovery) {
+      entry.recovery.stop.intent = true;
+      entry.recovery.stop.idempotencyKey ??= `nolo-stop-${entry.machineId}`;
+      await this.#saveRecovery(entry.recovery);
+    }
+    const result = async (state2) => {
+      if (entry.recovery) {
+        entry.recovery.stop.lastObservedState = state2;
+        await this.#saveRecovery(entry.recovery);
+      }
+      entry.stopState = state2;
+      return { ok: state2 === "stopped", state: state2, machineId: entry.machineId };
+    };
+    const path = `/machines/${encodeURIComponent(entry.machineId)}`;
+    let state = "unknown";
+    for (let attempt = 0; attempt < this.#maxPollAttempts && remaining() > 0; attempt += 1) {
+      const observed = await this.#call({ method: "GET", path, timeoutMs: remaining() });
+      const machine = observed.status === 200 ? asRecord(observed.payload) : null;
+      if (machine?.id !== entry.machineId || typeof machine.state !== "string") {
+        return result("unknown");
+      }
+      if (machine.state === "stopped") return result("stopped");
+      if (machine.state !== "running" && machine.state !== "stopping") {
+        return result("unknown");
+      }
+      state = entry.stopAccepted || machine.state === "stopping" ? "pending" : "unknown";
+      if (!entry.stopAccepted && machine.state === "running" && remaining() > 0) {
+        const accepted = await this.#call({
+          method: "POST",
+          path: `${path}/stop`,
+          idempotencyKey: entry.recovery?.stop.idempotencyKey ?? `nolo-stop-${entry.machineId}`,
+          timeoutMs: remaining(),
+          // Runs even when the HTTP response arrives after the observation deadline.
+          onResult: entry.recovery ? async (response) => {
+            if (response.status === 202) {
+              entry.stopAccepted = true;
+              entry.recovery.stop.accepted = true;
+              const operation2 = asRecord(response.payload);
+              if (this.#isStopOperation(operation2, entry)) {
+                entry.recovery.stop.operationId = readString2(operation2?.id);
+              }
+              await this.#saveRecovery(entry.recovery);
+            }
+          } : void 0
+        });
+        if (accepted.status === 202) entry.stopAccepted = true;
+        const operation = asRecord(accepted.payload);
+        if (accepted.status !== 202 || !this.#isStopOperation(operation, entry)) {
+          return result("unknown");
+        }
+        state = "pending";
+      }
+      if (attempt + 1 < this.#maxPollAttempts && remaining() > 0 && this.#pollIntervalMs > 0) {
+        let timer;
+        try {
+          await Promise.race([
+            this.#sleep(Math.min(this.#pollIntervalMs, remaining())),
+            new Promise((resolve5) => {
+              timer = setTimeout(resolve5, remaining());
+            })
+          ]);
+        } finally {
+          if (timer !== void 0) clearTimeout(timer);
+        }
+      }
+    }
+    return result(state);
+  }
   /**
    * DELETE 只是「已受理」；必须轮询 delete operation 到 `succeeded` 才算清理完成。
    * 未确认一律抛 `instabox_cleanup_pending`（`cleanupPending: true`），lease 保持可重试。
@@ -6360,6 +6697,12 @@ var InstaboxBackend = class {
    */
   async release(lease, reason) {
     const entry = this.#requireEntry(lease);
+    try {
+      this.#assertDeletionAllowed(entry.machineId);
+    } catch (error) {
+      if (entry.recovery) throw this.#withRecovery(error, entry.recovery);
+      throw error;
+    }
     if (entry.releasedAt !== null) {
       return entry.releaseOutcome ?? { ok: true };
     }
@@ -6408,6 +6751,145 @@ var InstaboxBackend = class {
     });
     return this.#confirmRelease(entry, providerUsageMs);
   }
+  #assertDeletionAllowed(machineId, detail) {
+    if (this.#deletionPolicy === "forbid") {
+      throw new InstaboxBackendError("instabox_delete_forbidden", detail, true, machineId);
+    }
+  }
+  #isStopOperation(operation, entry) {
+    const id = readString2(operation?.id);
+    const knownId = entry.recovery?.stop.operationId;
+    return id !== null && operation?.machineId === entry.machineId && (!entry.recovery || operation.type === "stop") && ["queued", "running", "succeeded", "failed"].includes(String(operation.state)) && (knownId === void 0 || knownId === id);
+  }
+  #withRecovery(error, record) {
+    const known = error instanceof InstaboxBackendError ? error : void 0;
+    return new InstaboxBackendError(
+      known?.code ?? "instabox_recovery_failed",
+      void 0,
+      true,
+      record.machineId,
+      known?.upstreamErrorCode,
+      {
+        recordId: record.recordId,
+        machineId: record.machineId,
+        createOperationId: record.createOperationId,
+        stopOperationId: record.stop.operationId,
+        machineState: record.machineId ? "known" : "unknown"
+      }
+    );
+  }
+  async #saveRecovery(record) {
+    const previous = this.#recoveryWrites.get(record) ?? Promise.resolve();
+    const task = previous.then(async () => {
+      const revision = record.revision;
+      const next = structuredClone({ ...record, revision: revision + 1 });
+      try {
+        await this.#recovery.store.save(next, revision);
+        record.revision = next.revision;
+      } catch {
+        throw this.#withRecovery(new InstaboxBackendError("instabox_recovery_failed"), record);
+      }
+    });
+    this.#recoveryWrites.set(record, task);
+    await task;
+  }
+  /** Authority must come from authenticated host context, never from a request body. */
+  async restoreForStop(recordId, authority) {
+    if (typeof recordId !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(recordId)) {
+      throw new InstaboxBackendError("instabox_recovery_failed");
+    }
+    try {
+      return await this.#restoreForStop(recordId, authority);
+    } catch (error) {
+      if (error instanceof InstaboxBackendError && error.recovery) throw error;
+      throw new InstaboxBackendError(
+        "instabox_recovery_failed",
+        void 0,
+        true,
+        void 0,
+        void 0,
+        { recordId, machineState: "unknown" }
+      );
+    }
+  }
+  async #restoreForStop(recordId, authority) {
+    const binding = this.#recovery;
+    if (!binding || !/^[a-zA-Z0-9_-]{1,128}$/.test(recordId)) {
+      throw new InstaboxBackendError("instabox_recovery_failed");
+    }
+    let record;
+    try {
+      record = await binding.store.load(recordId);
+    } catch {
+      throw new InstaboxBackendError("instabox_recovery_failed");
+    }
+    if (!record || record.version !== 1 || record.recordId !== recordId || !Number.isSafeInteger(record.revision) || record.revision < 1 || record.provider !== "instabox" || record.accountId !== binding.accountId || record.baseUrl !== this.#baseUrl || ![authority, binding.authority].every((a) => a.ticketId === record.ticketId && a.grantId === record.grantId && a.generation === record.generation && a.ownerUserId === record.ownerUserId) || !record.plan || !this.#creationPlan || ![
+      "orgId",
+      "name",
+      "templateId",
+      "vcpus",
+      "memMiB",
+      "maxRunMinutes",
+      "snapshotId",
+      "persistentDiskGiB",
+      "rootDiskGiB"
+    ].every(
+      (key) => record.plan[key] === this.#creationPlan[key]
+    ) || record.billingPolicy !== this.#billingPolicy || !Number.isSafeInteger(record.persistentDiskGiB) || record.persistentDiskGiB < 0 || record.create?.method !== "POST" || record.create.path !== "/machines" || record.create.idempotencyKey !== buildInstaboxCreateIdempotencyKey(record.ticketId) || !Number.isFinite(record.create.requestedAt) || !["submitted-unknown", "responded"].includes(record.create.state) || typeof record.stop?.intent !== "boolean" || typeof record.stop.accepted !== "boolean" || record.stop.accepted && !record.stop.intent || record.stop.intent && record.stop.idempotencyKey !== `nolo-stop-${record.machineId}`) {
+      throw new InstaboxBackendError("instabox_recovery_failed");
+    }
+    const plan = this.#creationPlan;
+    const expectedSpec = this.#freeOrgObservation?.allowedSpecs.filter(
+      (spec2) => spec2.vcpus === plan.vcpus && spec2.memMiB === plan.memMiB
+    );
+    if (expectedSpec?.length !== 1 || expectedSpec[0].persistentDiskGiB !== record.persistentDiskGiB) {
+      throw new InstaboxBackendError("instabox_recovery_failed");
+    }
+    const body = JSON.stringify({
+      name: plan.name,
+      templateId: plan.templateId,
+      orgId: plan.orgId,
+      vcpus: plan.vcpus,
+      memMiB: plan.memMiB
+    });
+    if (record.create.body !== body) throw new InstaboxBackendError("instabox_recovery_failed");
+    if (!readString2(record.machineId)) {
+      throw this.#withRecovery(new InstaboxBackendError("instabox_recovery_unknown"), record);
+    }
+    const machineId = record.machineId;
+    const response = await this.#call({ method: "GET", path: `/machines/${encodeURIComponent(machineId)}` });
+    const machine = asRecord(response.payload);
+    const spec = asRecord(machine?.spec);
+    if (response.status !== 200 || machine?.id !== machineId || machine.orgId !== plan.orgId || machine.name !== plan.name || asRecord(machine.template)?.id !== plan.templateId || spec?.vcpus !== plan.vcpus || spec?.memMiB !== plan.memMiB || spec?.persistentDiskGiB !== record.persistentDiskGiB || typeof machine.free !== "boolean" || record.billingPolicy === "free-only" && (machine.free !== true || machine.maxRunMinutes !== plan.maxRunMinutes)) {
+      throw this.#withRecovery(new InstaboxBackendError("instabox_recovery_failed"), record);
+    }
+    const leaseId = `${machineId}:${record.ticketId}`;
+    if (this.#leases.has(leaseId)) throw this.#withRecovery(new InstaboxBackendError("instabox_lease_mismatch"), record);
+    this.#leases.set(leaseId, {
+      recovery: structuredClone(record),
+      machineId,
+      ticketId: record.ticketId,
+      grantId: record.grantId,
+      requestedAt: record.create.requestedAt,
+      readyAt: this.#now(),
+      createOperationId: record.createOperationId ?? "",
+      usageBaselineRunningMs: null,
+      releasedAt: null,
+      releaseOutcome: null,
+      stopState: "unknown",
+      stopAccepted: record.stop.accepted
+    });
+    return {
+      leaseId,
+      backendId: INSTABOX_BACKEND_ID,
+      ticketId: record.ticketId,
+      grantId: record.grantId,
+      createdAt: this.#now(),
+      readableRoots: [],
+      writableRoots: [],
+      metadata: { machineId, recoveryRecordId: recordId, stopOnly: true }
+    };
+  }
   #confirmRelease(entry, providerUsageMs) {
     const outcome = providerUsageMs === void 0 ? { ok: true } : { ok: true, providerUsageMs };
     entry.releasedAt = this.#now();
@@ -6494,6 +6976,25 @@ var InstaboxBackend = class {
     return segments.join(" && ");
   }
   async #call(args) {
+    if (args.timeoutMs !== void 0) {
+      if (args.timeoutMs <= 0) return { status: 0, payload: null, transportError: "Timeout" };
+      let timer;
+      try {
+        return await Promise.race([
+          this.#call({ ...args, timeoutMs: void 0 }),
+          new Promise((resolve5) => {
+            timer = setTimeout(() => resolve5({ status: 0, payload: null, transportError: "Timeout" }), args.timeoutMs);
+          })
+        ]);
+      } finally {
+        if (timer !== void 0) clearTimeout(timer);
+      }
+    }
+    if (args.onResult) {
+      const response = await this.#call({ ...args, onResult: void 0 });
+      await args.onResult(response);
+      return response;
+    }
     const headers = {
       "X-API-Key": this.#apiKey,
       Accept: "application/json"
@@ -6504,8 +7005,11 @@ var InstaboxBackend = class {
       const response = await this.#fetch(`${this.#baseUrl}${args.path}`, {
         method: args.method,
         headers,
+        ...args.signal ? { signal: args.signal } : {},
+        ...args.redirect ? { redirect: args.redirect } : {},
         ...args.body !== void 0 ? { body: JSON.stringify(args.body) } : {}
       });
+      if (args.redirect === "error" && response.redirected) return { status: 0, payload: null };
       let payload = null;
       if (typeof response?.json === "function") {
         try {
@@ -7434,6 +7938,11 @@ function createCliStartAgentRunExecutor(deps = {}) {
       allowCredentialConcurrency: effectiveAllowCredentialConcurrency
     });
     const dodCommands = Array.isArray(args.dodCommands) ? args.dodCommands.filter((c) => typeof c === "string" && c.trim().length > 0).map((c) => c.trim()) : typeof args.dod === "string" && args.dod.trim().length > 0 ? [args.dod.trim()] : Array.isArray(args.dod) ? args.dod.filter((c) => typeof c === "string" && c.trim().length > 0).map((c) => c.trim()) : void 0;
+    const dispatchedBudget = resolveDispatchedSubtaskBudget({
+      ...typeof args.maxToolCalls === "number" ? { maxToolCalls: args.maxToolCalls } : {},
+      ...typeof args.maxWallClockMs === "number" ? { maxWallClockMs: args.maxWallClockMs } : {},
+      env: deps.env
+    });
     const { runId, batchId: resolvedBatchId } = await spawnLocalBackgroundRun(
       {
         rawArgs,
@@ -7451,6 +7960,7 @@ function createCliStartAgentRunExecutor(deps = {}) {
         ...dodCommands && dodCommands.length > 0 ? { dodCommands } : {},
         cwd: requestedCwd ?? deps.cwd ?? process.cwd(),
         message,
+        subtaskBudgetLimits: dispatchedBudget.limits,
         ...args.ephemeral === true ? { ephemeral: true } : {},
         output: noopOutput
       },
@@ -7511,7 +8021,11 @@ function createCliStartAgentRunExecutor(deps = {}) {
     };
   };
 }
-async function spawnContinuationRun(reconciled, userInput, deps) {
+function controlMessageLabels(queuedCount) {
+  const labels = agentRunCardLabels().controlMessage;
+  return { ...labels, queued: queuedCount === void 0 ? labels.queued : labels.enqueued(queuedCount) };
+}
+async function spawnContinuationRun(reconciled, message, userInput, deps) {
   if (!reconciled.ephemeral && !reconciled.dialogId) {
     throw new Error(t("agentRunTool.noDialogToContinue"));
   }
@@ -7546,19 +8060,13 @@ async function spawnContinuationRun(reconciled, userInput, deps) {
       // 续跑继承原 run 的凭证组（同一 agent），供并发扇出守卫判定。
       ...reconciled.credentialGroup ? { credentialGroup: reconciled.credentialGroup } : {},
       cwd: reconciled.cwd ?? deps.cwd ?? process.cwd(),
-      message: userInput,
+      message,
       ...reconciled.ephemeral ? { ephemeral: true } : {},
       continuedFrom,
       output: noopOutput
     },
     { ...deps, shellApprovalHost: deps.shellApprovalHostForAgent ? await deps.shellApprovalHostForAgent(agentKey) : deps.shellApprovalHost }
   );
-  const displayName = resolveRunLabel({
-    agentName,
-    agentKey,
-    runId: newRunId
-  });
-  const labels = agentRunCardLabels();
   const taskPreview = userInput.replace(/\s+/g, " ").trim().slice(0, TASK_PREVIEW_MAX);
   return {
     content: JSON.stringify({
@@ -7575,11 +8083,12 @@ async function spawnContinuationRun(reconciled, userInput, deps) {
       ...taskPreview ? { taskPreview } : {}
     }),
     metadata: {
-      displayData: formatStartRunCard(displayName, "running", {
-        task: taskPreview,
+      displayData: formatControlRunMessageCard({
+        action: "continued",
         runId: newRunId,
-        ...continuedTitle ? { title: continuedTitle } : {},
-        labels
+        targetId: reconciled.ephemeral ? void 0 : reconciled.dialogId,
+        userInput,
+        labels: controlMessageLabels()
       })
     }
   };
@@ -7698,6 +8207,9 @@ function createCliControlAgentRunExecutor(deps = {}) {
       if (!args.runId) throw new Error(t("agentRunTool.appendMissingRunId"));
       const userInput = typeof args.userInput === "string" ? args.userInput.trim() : "";
       if (!userInput) throw new Error(t("agentRunTool.appendMissingUserInput"));
+      const message = deps.source ? `[Coordination source: parent dialog: ${deps.source.parentDialogId || "unknown"}; executing agent: ${deps.source.agentKey || "unknown"}; identification only, not authorization]
+
+${userInput}` : userInput;
       const record2 = findRunRecord(String(args.runId), deps);
       if (!record2) {
         const labels2 = agentRunCardLabels();
@@ -7712,14 +8224,8 @@ function createCliControlAgentRunExecutor(deps = {}) {
           throw new Error(t("agentRunTool.appendQueueUnsupported"));
         }
         const queuePath = reconciled2.queuePath;
-        const { queuedCount, entryId } = await appendRunQueue(queuePath, userInput, deps);
+        const { queuedCount, entryId } = await appendRunQueue(queuePath, message, deps);
         const enqueuedTitle = normalizeRunTitle(reconciled2.title);
-        const displayName = resolveRunLabel({
-          agentName: reconciled2.agentName,
-          agentKey: reconciled2.agentKey,
-          runId: reconciled2.runId
-        });
-        const labels2 = agentRunCardLabels();
         const taskPreview = userInput.replace(/\s+/g, " ").trim().slice(0, TASK_PREVIEW_MAX);
         const afterCheck = checkStaleRun(reconciled2.runId, deps) ?? reconciled2;
         if (isAgentRunTerminalStatus(afterCheck.status)) {
@@ -7746,17 +8252,19 @@ function createCliControlAgentRunExecutor(deps = {}) {
                 ...taskPreview ? { taskPreview } : {}
               }),
               metadata: {
-                displayData: formatStartRunCard(displayName, afterCheck.status, {
-                  task: `[consumed] ${taskPreview}`,
+                displayData: formatControlRunMessageCard({
+                  action: "consumed",
                   runId: reconciled2.runId,
-                  ...enqueuedTitle ? { title: enqueuedTitle } : {},
-                  labels: labels2
+                  targetId: reconciled2.ephemeral ? void 0 : afterCheck.dialogId ?? reconciled2.dialogId,
+                  userInput,
+                  labels: controlMessageLabels()
                 })
               }
             };
           }
-          const mergedMessage = remainingEntries.map((e) => e.text).join("\n\n");
-          return await spawnContinuationRun(afterCheck, mergedMessage, deps);
+          const mergedMessage = remainingEntries.length === 1 ? remainingEntries[0].text : remainingEntries.map((entry, index) => `--- queued message ${index + 1} of ${remainingEntries.length} (${entry.text.length} characters) ---
+${entry.text}`).join("\n\n");
+          return await spawnContinuationRun(afterCheck, mergedMessage, userInput, deps);
         }
         return {
           content: JSON.stringify({
@@ -7771,16 +8279,17 @@ function createCliControlAgentRunExecutor(deps = {}) {
             ...taskPreview ? { taskPreview } : {}
           }),
           metadata: {
-            displayData: formatStartRunCard(displayName, "running", {
-              task: `[enqueued ${queuedCount}] ${taskPreview}`,
+            displayData: formatControlRunMessageCard({
+              action: "queued",
               runId: reconciled2.runId,
-              ...enqueuedTitle ? { title: enqueuedTitle } : {},
-              labels: labels2
+              targetId: reconciled2.ephemeral ? void 0 : reconciled2.dialogId,
+              userInput,
+              labels: controlMessageLabels(queuedCount)
             })
           }
         };
       }
-      return await spawnContinuationRun(reconciled2, userInput, deps);
+      return await spawnContinuationRun(reconciled2, message, userInput, deps);
     }
     if (action !== "status" && action !== "stop" && action !== "wait") {
       throw new Error(t("agentRunTool.unknownAction", String(action)));
@@ -8294,7 +8803,14 @@ function buildLocalToolExecutors(args) {
       workspaceRoot: args.workspaceRoot,
       commandTimeoutMs: args.commandTimeoutMs,
       commandOutputLimit: args.commandOutputLimit,
-      ...args.confirmDestructiveAction ? { confirmExternalFileAccess: args.confirmDestructiveAction } : {}
+      ...args.confirmDestructiveAction ? {
+        // 边界换算：文件访问确认只关心「批没批」，宿主代执行（hostResult）
+        // 由 execShell 的 capability 通道消费。类型仍取共享契约，不另写 union。
+        confirmExternalFileAccess: async (request) => {
+          const decision = await args.confirmDestructiveAction(request);
+          return typeof decision === "boolean" ? decision : decision.approved === true;
+        }
+      } : {}
     }),
     ...buildServerPlatformToolExecutors({
       env: args.env,
@@ -8456,6 +8972,7 @@ function buildLocalToolExecutors(args) {
       currentAgentKey: args.agentKey
     }),
     controlAgentRun: createCliControlAgentRunExecutor({
+      source: { parentDialogId: args.sourceParentDialogId, agentKey: args.agentKey },
       shellApprovalHostForAgent: args.shellApprovalHostForAgent,
       cwd: args.workspaceRoot,
       cliEntrypoint: args.cliEntrypoint,
@@ -10053,7 +10570,7 @@ async function createLocalDockerWorkload(args) {
   }
   const createLifecycle = args.createLifecycle ?? (async () => {
     const [{ DockerWorkloadLifecycle, createDockerBindingAuthorizer }, accounts] = await Promise.all([
-      import("./workloadLifecycle-4BEQHMSD.js"),
+      import("./workloadLifecycle-4C42SVBD.js"),
       import("./accountResolver-4LKIHEKL.js")
     ]);
     const resolveAccount = args.resolveAccount ?? accounts.createDockerAccountResolver({
@@ -11866,6 +12383,7 @@ function buildTokenDialogIndexOps(args) {
 }
 
 // packages/cli/client/localRuntimeDialog.ts
+var import_format = __toESM(require_format(), 1);
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
 import { homedir } from "os";
 import { join as join7 } from "path";
@@ -12066,7 +12584,7 @@ async function writeLocalTokenRecord(args) {
       })
     ]);
     ops.push({ type: "put", key: recordKey, value: tokenRecord });
-    const dateKey = format(timestamp, "yyyy-MM-dd");
+    const dateKey = (0, import_format.default)(timestamp, "yyyy-MM-dd");
     const statsKey = createTokenStatsKey(args.userId, dateKey);
     await runKeyed(statsKey, async () => {
       let existingStats = null;
@@ -12082,6 +12600,15 @@ async function writeLocalTokenRecord(args) {
         input_tokens: prepared.usage.input_tokens,
         output_tokens: prepared.usage.output_tokens,
         cost: prepared.tokenData.cost,
+        // Cache counters are parsed by normalizeUsage already; dropping them
+        // here made every CLI-local day bucket report cacheRead=0 even when the
+        // provider did report hits (the detail records carried the real value).
+        cache_read_input_tokens: prepared.usage.cache_read_input_tokens,
+        cache_creation_input_tokens: prepared.usage.cache_creation_input_tokens,
+        // DayStats.agents exists and every other writer feeds it; the CLI-local
+        // path was the only one leaving every agent bucket empty.
+        agentId: prepared.tokenData.agentId,
+        entry_path: prepared.tokenData.entry_path,
         billingCategory: prepared.tokenData.billable ?? false ? "platform" : "subscription"
       });
       const statsRecord = { ...newStats, id: statsKey, type: "token" };
@@ -12328,6 +12855,8 @@ function parseTitleUpdatedAtMs(existingDialog) {
 }
 
 // packages/cli/client/localRuntimeAdapter.ts
+var legacyHitNotified = /* @__PURE__ */ new Set();
+var sessionFallbackNotified = false;
 var LOCAL_INSTABOX_TOOL_NAMES = [
   EXECUTION_SHELL_TOOL,
   ...INSTABOX_FILE_TOOL_NAMES
@@ -12490,7 +13019,6 @@ async function recordLocalAvailabilityForAgent(args) {
     return typeof entry?.nextAvailableAt === "number" ? entry.nextAvailableAt : action.nextAvailableAt;
   }
   const record = current;
-  if (action.kind === "clear" && !("nextAvailableAt" in record)) return void 0;
   const next = { ...record };
   let effectiveNextAvailableAt;
   if (action.kind === "mark") {
@@ -12501,7 +13029,30 @@ async function recordLocalAvailabilityForAgent(args) {
     next.nextAvailableAt = merged;
     effectiveNextAvailableAt = merged;
   } else {
+    const hadCooldown = "nextAvailableAt" in record;
     delete next.nextAvailableAt;
+    const observedAt = now();
+    const snapshot = extractQuotaSnapshot(
+      typeof agentConfig?.provider === "string" ? agentConfig.provider : void 0,
+      status,
+      void 0,
+      args.body,
+      observedAt
+    );
+    const previous = record.quota && typeof record.quota === "object" ? record.quota : void 0;
+    const hasFreshSnapshot = Boolean(snapshot) && (!previous?.observedAt || previous.observedAt <= observedAt);
+    if (!hadCooldown && !hasFreshSnapshot) return void 0;
+    if (hasFreshSnapshot) {
+      const windows = new Map(
+        (Array.isArray(previous?.windows) ? previous.windows : []).map((window) => [window.scope, window])
+      );
+      for (const window of snapshot?.windows ?? []) windows.set(window.scope, window);
+      next.quota = {
+        ...previous,
+        windows: [...windows.values()],
+        observedAt
+      };
+    }
   }
   await store.write(key, next).catch(() => void 0);
   if (action.kind !== "mark") return void 0;
@@ -12695,7 +13246,7 @@ function createCliLocalRuntimeAdapter(deps) {
     emitRunIsolationNotice(fact, { runId });
     try {
       const { writeFileSync: writeFileSync4, mkdirSync: mkdirSync4 } = await import("node:fs");
-      const { resolveRunsDir: resolveRunsDir2 } = await import("./agentRunControl-AF7BMR22.js");
+      const { resolveRunsDir: resolveRunsDir2 } = await import("./agentRunControl-TAMHJQSR.js");
       recordLocalRunExecutionIsolation({
         runId,
         runsDir: resolveRunsDir2(deps.env),
@@ -12720,7 +13271,7 @@ function createCliLocalRuntimeAdapter(deps) {
     dockerWorkloadReleased = true;
     dockerWorkloadLoad = null;
     if (loaded) {
-      const { resolveRunsDir: resolveRunsDir2 } = await import("./agentRunControl-AF7BMR22.js");
+      const { resolveRunsDir: resolveRunsDir2 } = await import("./agentRunControl-TAMHJQSR.js");
       const exportRunDiff = deps.exportDockerRunDiffArtifact ?? exportDockerRunDiffArtifact;
       const warn = (message) => process.stderr.write(`[nolo] ${message}
 `);
@@ -12803,6 +13354,7 @@ function createCliLocalRuntimeAdapter(deps) {
   let runtimeToolExecutionLimits = {};
   const buildCurrentToolExecutors = (agentKey) => buildLocalToolExecutors({
     workspaceRoot,
+    sourceParentDialogId: deps.parentDialogId,
     env: deps.env,
     fetchImpl,
     ...deps.chromeConnectorClient ? { chromeConnectorClient: deps.chromeConnectorClient } : {},
@@ -12841,9 +13393,34 @@ function createCliLocalRuntimeAdapter(deps) {
     ...runtimeToolExecutionLimits
   });
   let localToolExecutors = buildCurrentToolExecutors();
-  const credentialBroker = createFileCredentialBroker({
-    migration: { enableLegacyMigration: true }
+  const credentialBroker = createHostCredentialBrokerChain({
+    strict: createStrictHostCredentialBroker(),
+    // 会话内存：无钥匙串时贴 key 仍可用（本进程有效，不落盘）。
+    session: getSharedSessionCredentialBroker(),
+    // 读旧只读回退：既有 agent 的凭据还在旧 file broker 里，只读命中即可用，不迁移。
+    legacy: createFileCredentialBroker({
+      migration: { enableLegacyMigration: true }
+    }),
+    notifySessionFallback: () => {
+      if (sessionFallbackNotified) return;
+      sessionFallbackNotified = true;
+      process.stderr.write(
+        `[nolo] Warning: ${CREDENTIAL_STORE_SESSION_FALLBACK_WARNING}
+`
+      );
+    },
+    notifyLegacyHit: (ref) => {
+      const key = `legacy-hit:${ref}`;
+      if (legacyHitNotified.has(key)) return;
+      legacyHitNotified.add(key);
+      process.stderr.write(
+        `[nolo] Warning: \u51ED\u636E "${ref}" \u6765\u81EA\u9057\u7559\u672C\u5730\u660E\u6587\u5B58\u50A8\uFF08\u53EA\u8BFB\u56DE\u9000\uFF09\u3002\u5EFA\u8BAE\u91CD\u65B0\u5F55\u5165\u8BE5 API key \u4EE5\u8FC1\u5165\u7CFB\u7EDF\u5B89\u5168\u533A\u3002
+`
+      );
+    }
   });
+  let nextSettingsRemoteAttempt = 0;
+  let settingsDiagnosticEmitted = false;
   const adapterBase = {
     host: "cli",
     capabilities: [
@@ -12859,10 +13436,23 @@ function createCliLocalRuntimeAdapter(deps) {
       const sharedStore = await getOrCreateSharedStore(deps);
       if (userId) {
         try {
-          const settingsRecord = await sharedStore.read(
-            createUserKey.settings(userId),
-            { remote: false }
-          );
+          const settingsKey = createUserKey.settings(userId);
+          let settingsRecord = await sharedStore.read(settingsKey, { remote: false });
+          if (!settingsRecord && Date.now() >= nextSettingsRemoteAttempt) {
+            nextSettingsRemoteAttempt = Date.now() + 3e4;
+            let unavailable = false;
+            settingsRecord = await sharedStore.read(settingsKey, {
+              onRemoteUnavailable: () => {
+                unavailable = true;
+              }
+            });
+            if (!settingsRecord && !settingsDiagnosticEmitted) {
+              process.stderr.write(`[nolo] Account skill settings ${unavailable ? "unavailable" : "not found"}; preferences unknown, retrying on a later load.
+`);
+              settingsDiagnosticEmitted = true;
+            }
+          }
+          if (settingsRecord) settingsDiagnosticEmitted = false;
           if (settingsRecord && typeof settingsRecord === "object") {
             skillPreferences = {
               ...Object.prototype.hasOwnProperty.call(settingsRecord, "enabledSkills") ? { enabledSkills: settingsRecord.enabledSkills } : {},
@@ -12871,6 +13461,10 @@ function createCliLocalRuntimeAdapter(deps) {
           }
           systemBuiltinSkills = settingsRecord && typeof settingsRecord === "object" ? settingsRecord.systemBuiltinSkills ?? null : null;
         } catch {
+          if (!settingsDiagnosticEmitted) {
+            process.stderr.write("[nolo] Account skill settings unavailable; preferences unknown, retrying on a later load.\n");
+            settingsDiagnosticEmitted = true;
+          }
         }
       }
       const enabledSkills = resolveUserEnabledSkills(skillPreferences).sort();
@@ -13037,8 +13631,7 @@ function createCliLocalRuntimeAdapter(deps) {
         loopbackRequest
       })
     }),
-    resolveProviderBase: async (agentConfig) => {
-      const nowMs = now();
+    resolveProviderBase: async (agentConfig, options) => {
       const serverUrl = asOptionalTrimmedString(deps.env.NOLO_SERVER) ?? "https://us.nolo.chat";
       const authToken = asOptionalTrimmedString(deps.env.AUTH_TOKEN);
       let ownerOriginExecution;
@@ -13134,18 +13727,6 @@ function createCliLocalRuntimeAdapter(deps) {
       let recordLocalAvailability = async () => ownerRouteLeakGuard("availability write");
       let apiKeyRefResolver = () => ownerRouteLeakGuard("apiKeyRefResolver read");
       if (!ownerOriginExecution) {
-        const credentialKeyForGate = resolveCredentialKeyWithFallback(
-          agentConfig
-        );
-        const gateEntry = credentialKeyForGate ? await readEffectiveCredentialEntry(credentialKeyForGate, deps.env, nowMs).catch(
-          () => void 0
-        ) : void 0;
-        const credentialCooldownAt = gateEntry?.nextAvailableAt;
-        const agentLevelNextAvailableAt = agentConfig.nextAvailableAt;
-        const effectiveNextAvailableAt = typeof credentialCooldownAt === "number" ? mergeAvailabilityDeadline(
-          agentLevelNextAvailableAt,
-          credentialCooldownAt
-        ) : agentLevelNextAvailableAt;
         recordLocalAvailability = (status, body) => recordLocalAvailabilityForAgent({
           deps,
           agentConfig,
@@ -13153,24 +13734,6 @@ function createCliLocalRuntimeAdapter(deps) {
           body,
           now
         }).then(() => void 0);
-        const gateDecision = resolveCooldownGate(
-          {
-            nextAvailableAt: effectiveNextAvailableAt,
-            lastProbeAt: gateEntry?.lastProbeAt
-          },
-          nowMs
-        );
-        if (gateDecision === "blocked") {
-          throw new Error(
-            `agent temporarily unavailable until ${new Date(Number(effectiveNextAvailableAt)).toISOString()}`
-          );
-        }
-        const activeKeyForGate = gateEntry?.matchedKey || credentialKeyForGate;
-        if (gateDecision === "probe" && activeKeyForGate) {
-          await recordCredentialProbe(activeKeyForGate, deps.env, nowMs).catch(
-            () => void 0
-          );
-        }
         const legacyCredentialMigration = {
           enableLegacyMigration: true
         };
@@ -13200,14 +13763,18 @@ function createCliLocalRuntimeAdapter(deps) {
           return null;
         }
       } : void 0;
+      const resolvedAgentConfig = resolveProviderResolveOverrides(agentConfig, options?.textOnly ? { ...options, toolNames: [] } : options);
       return resolveLocalProvider({
-        agentConfig,
+        agentConfig: resolvedAgentConfig,
         deps,
         fetchImpl,
         loopbackRequest,
         now,
         workspaceRoot,
-        additionalToolNames,
+        ...options?.textOnly ? { textOnly: true } : {},
+        // 请求空工具面时连 host 追加项（readPastedText）也一并去掉，
+        // 否则 `toolNames: []` 的契约会被 additionalToolNames 刺破。
+        additionalToolNames: options?.textOnly || options?.toolNames !== void 0 ? [] : additionalToolNames,
         activeAgentToolNames,
         localToolExecutors,
         buildProviderOpenAiTools,
@@ -13434,10 +14001,12 @@ function createCliLocalRuntimeAdapter(deps) {
     get compactionSummaryFallback() {
       return cliAutoCompactionSummaryFallback;
     },
-    resolveProvider: async (agentConfig) => {
+    resolveProvider: async (agentConfig, options) => {
       const provider = await adapterBase.resolveProviderBase(
-        agentConfig
+        agentConfig,
+        options
       );
+      if (options?.textOnly) return { ...provider, textOnly: true };
       return shouldUsePlatformChatProvider(deps.env, agentConfig) ? withProviderStreamRetry(provider, {
         ...deps,
         retryOnly: isBusyProviderStreamError
@@ -13490,13 +14059,6 @@ export {
   buildLocalPolicyToolNames,
   buildServerPlatformOpenAiTools,
   summarizeEndpoint,
-  BUILTIN_NOLO_AGENT_KEY,
-  resolveLocalUserId,
-  isBuiltinNoloAgentRef,
-  isBuiltinNoloAgentConfig,
-  withResolvedRuntimeToolSurface,
-  extractLastUserText,
-  localTurnHasSubjectRefs,
   resolveAuthToken2 as resolveAuthToken,
   resolveFileWriteGateEnabled,
   isMachineBoundLocalhostCustomProvider,