nolo-cli 0.213.0 → 0.223.0-alpha.1

package/{chunk-RSHTSUEG.js → chunk-Z2PITYZN.js}

@@ -1,20 +1,8 @@
-import {
-  applyChatCompletionDelta,
-  applyResponsesToolEvent,
-  createResponsesToolAccumulator,
-  finalizeResponsesToolCalls,
-  flushChatCompletionStream,
-  providerHttpFailure,
-  throwIfChatCompletionStreamFailed
-} from "./chunk-OQPKUBPB.js";
 import {
   DEVIN_CONNECT_URL,
   parseSseDataLineJson,
   parseSseDataLineObject
-} from "./chunk-CTPXME7U.js";
-import {
-  readSseFrames
-} from "./chunk-HNUWUO75.js";
+} from "./chunk-3LMUPOHG.js";
 import {
   evaluateFileWritePolicy,
   summarizeToolArguments
@@ -25,11 +13,36 @@ import {
 import {
   formatImageSummary,
   readLocalImage
-} from "./chunk-Y63ZSOR6.js";
+} from "./chunk-AL3TYDIF.js";
+import {
+  applyChatCompletionDelta,
+  applyResponsesToolEvent,
+  createResponsesToolAccumulator,
+  finalizeResponsesToolCalls,
+  flushChatCompletionStream,
+  providerHttpFailure,
+  throwIfChatCompletionStreamFailed
+} from "./chunk-QNWG52I4.js";
+import {
+  readSseFrames
+} from "./chunk-HNUWUO75.js";
 import {
+  resolveToolExecutionContract
+} from "./chunk-LKA64WH4.js";
+import {
+  evaluateRequestBudget,
   hasImageInRuntimeMessages,
   stripImagePartsFromMessages
-} from "./chunk-W4S457LU.js";
+} from "./chunk-YU4ZPWVF.js";
+import {
+  clipToolText,
+  resolveHistoricalToolContentCap,
+  resolveToolOutputProfile
+} from "./chunk-2WZXXAQD.js";
+import {
+  resolveAgentImageInputSupport,
+  resolveToolImagePolicy
+} from "./chunk-OBWT45ZU.js";
 import {
   applyShapingCounts,
   attachProjectionFacts,
@@ -40,7 +53,7 @@ import {
   projectUserPartForModel,
   resolveOutboundDiagnosticSink,
   writeThinkingFacts
-} from "./chunk-4KB6WQUL.js";
+} from "./chunk-BGP2EDFG.js";
 import {
   createThinkParserState,
   createToolCallAccumulator,
@@ -66,7 +79,25 @@ import {
   hashStablePrefixContent,
   resolveResponseGuidelines,
   resolveToolGuidedSections
-} from "./chunk-5MQRBSMW.js";
+} from "./chunk-EIAI3PPH.js";
+import {
+  BRIDGE_STREAM_MAX_CHARS,
+  CLI_NOLO_WORKSPACE_TOOL_NAMES,
+  DEFAULT_READ_DIALOG_MAX_RESPONSE_CHARS,
+  NOLO_WORKSPACE_TOOL_NAMES,
+  buildDialogReadEnvelope,
+  buildNoloWorkspaceCommandArgs,
+  buildNoloWorkspaceOpenAiTools,
+  createStreamingDialogReadProjector,
+  noloPositiveIntegerString,
+  noloStringArg,
+  parseNoloWorkspaceToolArguments,
+  readTextStreamUpToChars,
+  resolveNoloDialogInput
+} from "./chunk-C4VAR65S.js";
+import {
+  applyToolSurfaceConstraints
+} from "./chunk-SOF4OWDM.js";
 import {
   classifyUnparsableToolArgs,
   collectStablePromptPrefix,
@@ -90,7 +121,7 @@ import {
   toOpenAiCompatibleMessages,
   toResponsesTools,
   transferDowngradedToolTurnOrigin
-} from "./chunk-H5HF7TJA.js";
+} from "./chunk-MAIITKBT.js";
 import {
   TOOL_HAD_IMAGES,
   TOOL_IMAGES,
@@ -105,37 +136,11 @@ import {
   withoutToolImages
 } from "./chunk-E2BESSAW.js";
 import {
-  BRIDGE_STREAM_MAX_CHARS,
-  CLI_NOLO_WORKSPACE_TOOL_NAMES,
-  DEFAULT_READ_DIALOG_MAX_RESPONSE_CHARS,
-  DEFAULT_SUBTASK_MAX_TOOL_CALLS,
-  DEFAULT_SUBTASK_MAX_WALL_CLOCK_MS,
-  NOLO_WORKSPACE_TOOL_NAMES,
-  buildDialogReadEnvelope,
-  buildNoloWorkspaceCommandArgs,
-  buildNoloWorkspaceOpenAiTools,
-  buildSubtaskBudgetExhaustedContent,
-  createStreamingDialogReadProjector,
-  createSubtaskBudgetTracker,
-  noloPositiveIntegerString,
-  noloStringArg,
-  parseNoloWorkspaceToolArguments,
-  readTextStreamUpToChars,
-  resolveNoloDialogInput
-} from "./chunk-RZOV7OMV.js";
-import {
-  applyToolSurfaceConstraints
-} from "./chunk-KC4XDTT3.js";
-import {
-  clipToolText,
-  planContextUsage,
-  resolveHistoricalToolContentCap,
-  resolveToolOutputProfile
-} from "./chunk-YB3YZK56.js";
+  isQuotaExhaustedError
+} from "./chunk-TLE77UJ5.js";
 import {
-  resolveAgentImageInputSupport,
-  resolveToolImagePolicy
-} from "./chunk-YWSEPJ7C.js";
+  isAgentSkillDisabled
+} from "./chunk-FS2XP5D7.js";
 import {
   buildDialogFallbackTitleFromUserInput
 } from "./chunk-2MBTWINN.js";
@@ -143,29 +148,34 @@ import {
   EMPTY_ASSISTANT_REPAIR_PROMPT,
   extractReferenceKeysFromMessage,
   hasAssistantVisibleOutput,
-  normalizeUsage,
-  readCacheCreationInputTokens,
-  readCacheReadInputTokens,
   resolveAgentContextWindow,
   resolveEmptyAssistantFallbackMessage,
   resolveEmptyAssistantOutcome,
   resolveTruncatedReasoningTailLog
-} from "./chunk-V5Y3R6BT.js";
+} from "./chunk-NIZ2BXFD.js";
 import {
   COMPACTION_SUMMARY_SCHEMA_VERSION,
   COMPACTION_SUMMARY_SYSTEM_PROMPT,
   buildBoundedCompactionRequest,
   buildCompactionMetricsFromPlan,
+  classifySummaryError,
   computeSummarySourceMetadata,
+  createSummaryBudget,
   formatCompactionMetricsLog,
   getMessageTokenCount,
   getModelContextWindow,
+  isTruncatedCompletion,
+  normalizeUsage,
   planCompression,
+  readCacheCreationInputTokens,
+  readCacheReadInputTokens,
   resolveCompressionTriggerRatio,
   resolveEffectiveCompactionBudgets,
+  runSummaryWithContract,
   sha256Hex,
+  summaryCompletionTokens,
   truncateToolOutputForContext
-} from "./chunk-7BT37FK3.js";
+} from "./chunk-RDH5CQ4T.js";
 import {
   createProviderCallTimingTracker,
   finalizeProviderCallTiming,
@@ -176,25 +186,38 @@ import {
 import {
   clipCompactText
 } from "./chunk-5MMAK75Q.js";
-import {
-  assertCredentialRef
-} from "./chunk-OQHIVPG4.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
+import {
+  assertCredentialRef
+} from "./chunk-SNBZZPYH.js";
+import {
+  isLevelNotFoundError
+} from "./chunk-OW765XBU.js";
 import {
   isAbortError
 } from "./chunk-7DPNBQSV.js";
 import {
-  buildDialogSummaryLayer
-} from "./chunk-ZRSNONOB.js";
-import {
-  buildUserResponseLanguageContext
-} from "./chunk-4VJAC32I.js";
+  WORKTREE_ISOLATION_PRELUDE
+} from "./chunk-PJCIP64Z.js";
 import {
   canonicalizeToolName,
   canonicalizeToolNames
-} from "./chunk-ZCWRMUWT.js";
+} from "./chunk-6OVNSQHN.js";
+import {
+  dialogMessageKey,
+  dialogMessageRange
+} from "./chunk-OJKUU3LP.js";
+import {
+  asTrimmedNonEmptyStringArray
+} from "./chunk-I42VC5KR.js";
+import {
+  buildDialogSummaryLayer
+} from "./chunk-JWXITTQB.js";
+import {
+  buildUserResponseLanguageContext
+} from "./chunk-L5I543VB.js";
 import {
   buildInteractiveCommandBlockedResult,
   buildProcessTaskResultCapsule,
@@ -209,56 +232,54 @@ import {
   formatToolOverflowMarker,
   getProcessRegistry,
   isProcessTaskTerminalStatus,
+  isSpilledToolOutput,
   reportedTaskStatus,
   resolveExecShellTimeoutMs,
   resolveExecutableOnPath,
   runWorkspaceCommand,
   spawnToWebStreams,
+  spillLargeToolOutput,
   spillToolOutput,
   toProcessTaskView,
   truncateToolOutput
-} from "./chunk-H4UOTUOX.js";
+} from "./chunk-KEN3N2TN.js";
 import {
   estimateTokenCount
 } from "./chunk-PSCNXBYA.js";
 import {
   buildProviderAuthHeaders,
   buildProviderExecutionPlan
-} from "./chunk-TCZHTTUU.js";
+} from "./chunk-I7WBYGBP.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  PLATFORM_HOSTED_DEEPSEEK_FLASH_MODEL
+} from "./chunk-CKG3PRZ7.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
-import {
-  normalizeServerOrigin
-} from "./chunk-CF7PE763.js";
-import {
-  resolveNoloStateDir
-} from "./chunk-6UBGXX2W.js";
-import {
-  dialogMessageKey,
-  dialogMessageRange
-} from "./chunk-XJWWBO34.js";
-import {
-  asTrimmedNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
 import {
   asOptionalPositiveFiniteNumber
 } from "./chunk-U6VC4MU4.js";
-import {
-  asTrimmedString
-} from "./chunk-3EUW3WEO.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
+import {
+  normalizeServerOrigin
+} from "./chunk-CF7PE763.js";
+import {
+  resolveNoloStateDir
+} from "./chunk-6UBGXX2W.js";
 import {
   __export
-} from "./chunk-4VNS5WPM.js";
+} from "./chunk-U67V476Y.js";
 
 // packages/agent-runtime/actionGate.ts
 function readCommandActionGatePayload(payload) {
@@ -302,6 +323,42 @@ function readTitleParams(value) {
   return Object.fromEntries(entries);
 }
 
+// packages/agent-runtime/contextRefusal.ts
+var machineIdentifier = (value) => value && /^[A-Z][A-Z0-9_]{0,63}$/.test(value) ? value : void 0;
+function classifyContextRefusal(args2) {
+  const { outcome, historyTokens, budget, droppedCount } = args2;
+  const largest = args2.largestMessageTokens;
+  const numbersKnown = Number.isFinite(historyTokens) && historyTokens >= 0 && Number.isFinite(budget) && budget >= 0 && largest !== void 0 && Number.isFinite(largest) && largest >= 0;
+  const base = { historyTokens, budget, droppedCount, largestMessageTokens: largest ?? -1 };
+  const result4 = (reason, detail) => ({ ...base, reason, detail });
+  if (!numbersKnown) return result4("unknown", "input-estimate-unavailable");
+  if (largest >= budget) return result4("single-message-too-large", "largest-message-at-or-above-budget");
+  const compacted = outcome?.result;
+  const decision = compacted?.decision;
+  const failure = outcome?.error ?? compacted?.failure;
+  if (failure || compacted?.failureReason || decision?.outcome === "failed") {
+    const code = machineIdentifier(failure?.code);
+    const errorType = failure?.errorType;
+    const status = failure?.status;
+    if (code === "PROVIDER_UNAVAILABLE" || code === "SUMMARY_PROVIDER_UNAVAILABLE") {
+      return result4("no-compactable-content", `code=${code}`);
+    }
+    const busy = status === 503 || status === 429 || !!code && /BUSY|RATE_LIMIT|CAPACITY|OVERLOAD|RESOURCE_EXHAUSTED/.test(code) || !!errorType && /^(?:capacity|overloaded|rate_limit)(?:_error)?$/.test(errorType);
+    const detail = [
+      status !== void 0 && Number.isInteger(status) && status >= 100 && status <= 599 ? `status=${status}` : "",
+      code ? `code=${code}` : "",
+      failure ? `category=${failure.category}` : `failure=${compacted?.failureReason ?? (decision?.outcome === "failed" ? decision.reason : "provider-error")}`
+    ].filter(Boolean).join(" ");
+    return result4(busy ? "summary-provider-busy" : "summary-failed", detail);
+  }
+  if (decision?.outcome === "skipped") {
+    if (decision.skipReason === "summary-empty") return result4("summary-failed", "summary-empty");
+    const bounded3 = decision.skipReason === "bounded-request-blocked" ? /\b(no-budget|invalid-window|empty-input|no-safe-group|group-too-large)\b/.exec(decision.detail ?? "")?.[1] : void 0;
+    return result4("no-compactable-content", `skip=${decision.skipReason}${bounded3 ? ` detail=${bounded3}` : ""}`);
+  }
+  return result4("unknown", decision ? "no-refusal-decision" : "compaction-not-evaluated");
+}
+
 // node_modules/effect/dist/Pipeable.js
 var pipeArguments = (self, args2) => {
   switch (args2.length) {
@@ -13125,6 +13182,30 @@ function createLoopTiming() {
   return { mark, flush: flush2 };
 }
 
+// packages/agent-runtime/toolExecutionFailure.ts
+function isToolExecutionFailure(args2) {
+  const metadata = args2.metadata;
+  if (metadata) {
+    if (metadata.error) return true;
+    const exitCode = metadata.exitCode;
+    if (typeof exitCode === "number" && Number.isFinite(exitCode) && exitCode !== 0) return true;
+    if (typeof exitCode === "string" && exitCode.trim() !== "") {
+      const parsedExitCode = Number(exitCode);
+      if (Number.isFinite(parsedExitCode) && parsedExitCode !== 0) return true;
+    }
+    if (metadata.timedOut === true) return true;
+  }
+  if (typeof args2.content !== "string" || !args2.content.trim()) return false;
+  try {
+    const parsed = JSON.parse(args2.content);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+    const record2 = parsed;
+    return Boolean(record2.error) || record2.ok === false || record2.success === false || record2.status === "error";
+  } catch {
+    return false;
+  }
+}
+
 // packages/agent-runtime/toolCallPairing.ts
 function readToolCallId(message) {
   if (typeof message.tool_call_id === "string" && message.tool_call_id) {
@@ -13483,7 +13564,7 @@ var OBSERVATION_ONLY_METADATA_KEYS = /* @__PURE__ */ new Set([
 ]);
 function formatToolMessageContent(args2) {
   const sanitizedContent = sanitizeToolOutputText(args2.content ?? "");
-  const scrubbedContent = scrubSecrets(sanitizedContent).cleaned;
+  const scrubbedContent = spillLargeToolOutput(scrubSecrets(sanitizedContent).cleaned, args2.toolName, args2.workspaceRoot);
   if (args2.toolName !== "globFiles" && args2.toolName !== "codeSearch" && args2.toolName !== "readFile" || !args2.metadata || Object.keys(args2.metadata).length === 0) {
     return scrubbedContent;
   }
@@ -13499,7 +13580,7 @@ function formatToolMessageContent(args2) {
 [tool metadata]
 ${JSON.stringify(visible)}`;
 }
-function blocksToOpenAiMessages(blocks) {
+function blocksToOpenAiMessages(blocks, workspaceRoot) {
   const out = [];
   let text2 = "";
   let reasoning = "";
@@ -13520,6 +13601,7 @@ function blocksToOpenAiMessages(blocks) {
         role: "tool",
         content: formatToolMessageContent({
           toolName: tc.function.name,
+          workspaceRoot,
           content: res?.content ?? "",
           ...res?.metadata ? { metadata: res.metadata } : {}
         }),
@@ -13586,42 +13668,6 @@ var TOOL_METADATA_KEYS = [
   "pasteId",
   "source"
 ];
-function trimHistoryToContextBudget(history, model, contextWindowOverride) {
-  if (history.length === 0) return { history, droppedCount: 0 };
-  const { rawMessageBudget } = planContextUsage({
-    contextWindow: contextWindowOverride ?? getModelContextWindow(model ?? ""),
-    summaryTokens: 0,
-    // localLoop 没有 web 端的负载分档器；medium 是中性默认值，
-    // 不为了省几个 token 在这里复制一份分类逻辑。
-    recentLoad: "medium"
-  });
-  const messageTokens = (message) => {
-    const toolCalls = message.tool_calls;
-    return estimateTokenCount(contentAsText(message.content)) + (Array.isArray(toolCalls) ? estimateTokenCount(JSON.stringify(toolCalls)) : 0);
-  };
-  let used = 0;
-  let start = history.length;
-  for (let i = history.length - 1; i >= 0; i -= 1) {
-    const cost = messageTokens(history[i]);
-    if (used + cost > rawMessageBudget && start < history.length) break;
-    used += cost;
-    start = i;
-  }
-  if (start === 0) return { history, droppedCount: 0 };
-  return {
-    history: sanitizeToolCallPairing(history.slice(start)),
-    droppedCount: start
-  };
-}
-function contentAsText(content) {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return "";
-  return content.map((part) => {
-    if (part?.type === "text") return part.text;
-    if (part?.type === "image_url") return part.image_url.url;
-    return "";
-  }).join("\n");
-}
 function contentCharCount(content) {
   if (typeof content === "string") return content.length;
   if (!Array.isArray(content)) return 0;
@@ -13655,6 +13701,7 @@ function projectToolContentForProvider(args2) {
   const rawContent = args2.content;
   const content = typeof rawContent === "string" ? sanitizeToolOutputText(rawContent) : rawContent;
   if (typeof content !== "string") return content;
+  if (isSpilledToolOutput(content)) return content;
   const metadataText = compactToolMetadata(args2.metadata);
   const embeddedMetadataIndex = metadataText ? content.indexOf("\n\n[tool metadata]\n") : -1;
   const contentForProjection = embeddedMetadataIndex >= 0 ? content.slice(0, embeddedMetadataIndex) : content;
@@ -13686,7 +13733,7 @@ ${metadataText}` : "";
         content: contentForProjection,
         toolName: args2.toolName
       });
-      spillNote = `; spillFile=${spill.displayPath}; totalLines=${spill.totalLines}; hint=read full output via readFile`;
+      spillNote = `; spillFile=${spill.displayPath}; totalLines=${spill.totalLines}; hint=read a range, not the whole spill (readFile lines=A-B or sed -n 'A,Bp'); a full read re-injects ${spill.totalChars} chars`;
     } catch {
     }
   }
@@ -13896,6 +13943,29 @@ ${args2.input}` : [
     } : {}
   };
 }
+function estimateLocalRequestInput(messages, toolSchemaTokens = 0) {
+  return messages.reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0) + toolSchemaTokens;
+}
+function evaluateLocalRequestBudget(args2) {
+  const estimate = estimateLocalRequestInput(args2.messages, args2.descriptor?.toolSchemaTokens ?? 0);
+  const ratio = Math.max(1, args2.calibrationRatio ?? 1);
+  const output = args2.descriptor?.output ?? { semantics: "unknown", fallbackReserveTokens: 8192 };
+  const boundedOutput = output.semantics === "unknown" ? { ...output, fallbackReserveTokens: Math.min(
+    output.fallbackReserveTokens,
+    Math.min(8192, Math.max(1, Math.floor(args2.contextWindow / 4)))
+  ) } : output;
+  return evaluateRequestBudget({
+    contextWindow: args2.contextWindow,
+    messageTokens: Math.ceil(estimate * ratio),
+    toolSchemaTokens: 0,
+    // already included in the calibrated full-input estimate
+    protocolReserveTokens: 0,
+    output: boundedOutput
+  });
+}
+function updateLocalRequestCalibration(previous, actual, estimated) {
+  return Number.isFinite(actual) && actual > 0 && Number.isFinite(estimated) && estimated > 0 ? Math.max(1, actual / estimated) : previous;
+}
 
 // packages/agent-runtime/toolArgsTruncationPolicy.ts
 import { createHash } from "node:crypto";
@@ -14736,12 +14806,13 @@ function detectExecShellSynchronousWarnings(command, shell) {
 }
 
 // packages/agent-runtime/capabilities/execShellCapability.ts
+var WINDOWS_SHELL_NOTE = process.platform === "win32" ? ` On Windows the runtime prefers pwsh (PowerShell 7+): it is resolved first (PATH, then the WindowsApps alias), and powershell.exe 5.1 is only a fallback when pwsh is absent. Read metadata.shellKind from the result \u2014 "pwsh" supports '&&'/'||' and $PSStyle, "powershell5" does not (join with ';' or split calls). Match the syntax to the kind you actually got; never assume the version.` : "";
 function buildExecShellToolDefinition(toolName = "execShell") {
   return {
     type: "function",
     function: {
       name: toolName,
-      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess. On Windows the resolved shell may be Windows PowerShell 5.1 (metadata.shellKind="powershell5"): it does not support '&&'/'||' or $PSStyle \u2014 join commands with ';' or split into multiple calls. metadata.shellKind="pwsh" means PowerShell 7+ with full syntax. Read resolvedShell/shellKind from any execShell result before writing Windows-specific syntax. LIFECYCLE CONTRACT (misreading this contract silenced a real dialog for 10 hours): (1) A normal command waits synchronously for at most 120 seconds; if it ends inside that window the call IS finished \u2014 a result containing exitCode means the command has already completed, never "still running"; parse it immediately (no later event will remind you). (2) Only a result with metadata.detached === true AND a taskId represents a tracked background task that may trigger completion wake-up (terminal completion turn carrying a bounded result capsule); that handle produces a completion notification when finished; to read its output without waiting for the wake-up, read the result file for that taskId with readFile (a launchProcess taskId only yields a notice on your next real turn, never a new turn). Note that sleep commands exceeding the detach threshold will detach and trigger a completion wake-up upon exit \u2014 do not run standalone sleep commands purely to pause execution. (3) Text the command itself prints (LAUNCHED, STARTED, BACKGROUND, ...) is plain stdout with zero lifecycle meaning \u2014 never read it as a platform receipt. (4) Shell-level backgrounding (\`&\`, nohup, disown, setsid, self-daemonizing scripts, PowerShell Start-Process) is NOT tracked: those descendants produce no completion notification, and the outer shell finishing tells you nothing about them. Use background: true to turn a finite job into a tracked background task immediately. When a synchronous result's core output was redirected to a file, read that file in the SAME turn ("read it later" means it is lost) \u2014 never end the turn promising a later automatic report without a taskId.`,
+      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess.${WINDOWS_SHELL_NOTE} LIFECYCLE CONTRACT: (1) A normal command waits synchronously for at most 120 seconds; if it ends inside that window the call IS finished \u2014 a result carrying exitCode means the command has already completed: parse it immediately, never read it as "still running" (no later event will remind you). (2) Only a result with metadata.detached === true AND a taskId can deliver an automatic completion turn; that taskId is an opaque handle, NOT a file path and NOT a result file \u2014 never search for, guess or readFile a path from it, and never rerun the command just to obtain its output. That terminal turn delivers the result inline as a bounded capsule; when the capsule was truncated it also carries a real full-output path in its overflow marker \u2014 read that actual path with readFile only when it is present. While waiting for that terminal notification, continue independent work on other parts of the task. A launchProcess taskId is a tracked task too, but it only yields a notice on your next real turn. (3) Text the command itself prints (LAUNCHED, STARTED, ...) is plain stdout with zero lifecycle meaning \u2014 never read it as a platform receipt. (4) Shell-level backgrounding (&, nohup, disown, setsid, self-daemonizing scripts, PowerShell Start-Process) is NOT tracked: those descendants produce no completion notification, and the outer shell finishing tells you nothing about them. Use background: true to turn a finite job into a tracked background task. Do not run standalone sleep commands purely to pause execution. When a synchronous result's core output was redirected to a file, read that file in the SAME turn ("read it later" means it is lost) \u2014 never end the turn promising a later automatic report without a taskId.`,
       parameters: {
         type: "object",
         properties: {
@@ -14759,7 +14830,7 @@ function buildExecShellToolDefinition(toolName = "execShell") {
           },
           label: {
             type: "string",
-            description: "Optional human-readable label for the resulting background task, shown in the task list and completion notices. Defaults to the command's last token, which is unhelpful for pipelines (e.g. '| tail -25' yields '-25')."
+            description: "Optional human-readable label for the resulting background task, shown in task lists and completion notices. Defaults to the last token."
           }
         }
       }
@@ -15317,6 +15388,52 @@ import { homedir } from "node:os";
 import { dirname as dirname2, relative as relative4, resolve as resolve4, sep as sep2 } from "node:path";
 import { spawn as spawnChildProcess2 } from "node:child_process";
 
+// packages/agent-runtime/runResultReadProjection.ts
+import { basename } from "node:path";
+function projectRunResultRead(path, content, raw = false) {
+  const unchanged = { content, projected: false };
+  if (raw || !basename(path).endsWith(".result.md") || !content.startsWith("---\n")) return unchanged;
+  const end3 = content.indexOf("\n---\n", 4);
+  if (end3 < 0) return unchanged;
+  const header = content.slice(0, end3).split("\n");
+  const runLine = header.find((line) => line.startsWith("runId: "));
+  const index = header.findIndex((line) => line.startsWith("acceptance: "));
+  if (!runLine || index < 0) return unchanged;
+  try {
+    const runId = JSON.parse(runLine.slice(7));
+    if (typeof runId !== "string" || basename(path) !== `${runId}.result.md`) return unchanged;
+    const encoded = JSON.parse(header[index].slice(12));
+    if (typeof encoded !== "string") return unchanged;
+    const acceptance = JSON.parse(encoded);
+    if (!isRecord(acceptance) || acceptance.schemaVersion !== 1 || acceptance.source !== "local-runtime" || !isRecord(acceptance.checks) || !Array.isArray(acceptance.checks.observations)) return unchanged;
+    const { observations, ...checks } = acceptance.checks;
+    let exitZero = 0;
+    let exitNonzero = 0;
+    let exitUnknown = 0;
+    for (const observation of observations) {
+      const code = isRecord(observation) ? observation.exitCode : void 0;
+      if (code === 0) exitZero++;
+      else if (typeof code === "number" && Number.isInteger(code)) exitNonzero++;
+      else exitUnknown++;
+    }
+    const projected = { ...acceptance, checks: { ...checks, observationSummary: {
+      count: observations.length,
+      exitZero,
+      exitNonzero,
+      exitUnknown,
+      evidence: "#/acceptance/checks/observations",
+      readOriginal: "readFile with raw:true (force:true if already read)",
+      limitation: "Exit counts are observations, not version-bound test or review approval."
+    } } };
+    const line = `acceptance: ${JSON.stringify(JSON.stringify(projected))}`;
+    if (line.length >= header[index].length) return unchanged;
+    header[index] = line;
+    return { content: header.join("\n") + content.slice(end3), projected: true };
+  } catch {
+    return unchanged;
+  }
+}
+
 // packages/core/readRangeLedger.ts
 function filterRetainedLedgerRecords(records, retainedCap) {
   return records.filter((record2) => record2.chars <= retainedCap);
@@ -15351,15 +15468,27 @@ function isLineRangeCovered(request3, covered) {
 
 // packages/agent-runtime/fileTextSearch.ts
 import { readdir, readFile as readFile3, stat as stat3 } from "node:fs/promises";
-import { basename, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename as basename2, relative as relative2, resolve as resolve2 } from "node:path";
 import { spawn as spawnChildProcess } from "node:child_process";
 
 // packages/agent-runtime/gitignore.ts
 import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { resolve } from "node:path";
+function isIgnorableFsError(err) {
+  if (err && typeof err === "object" && "code" in err) {
+    const code = err.code;
+    return code === "ENOENT" || code === "ENOTDIR";
+  }
+  return false;
+}
 async function readRootGitignorePatterns(workspaceRoot) {
-  const content = await readFile2(resolve(workspaceRoot, ".gitignore"), "utf8").catch(() => null);
-  if (content === null) return [];
+  let content;
+  try {
+    content = await readFile2(resolve(workspaceRoot, ".gitignore"), "utf8");
+  } catch (err) {
+    if (isIgnorableFsError(err)) return [];
+    throw err;
+  }
   return content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && !line.startsWith("!")).flatMap((line) => {
     const unanchored = line.replace(/^\//, "");
     if (unanchored.endsWith("/")) return [`${unanchored}**`];
@@ -15371,14 +15500,15 @@ async function hasRootGitignore(workspaceRoot) {
   try {
     await stat2(resolve(workspaceRoot, ".gitignore"));
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    if (isIgnorableFsError(err)) return false;
+    throw err;
   }
 }
 
 // packages/agent-runtime/fileTextSearch.ts
 var normalizePath = (value) => value.replaceAll("\\", "/");
-var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative2(root, file) || basename(file));
+var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative2(root, file) || basename2(file));
 var COMMAND_LIMIT_HEADROOM = 1;
 async function runCommand(binary, args2, cwd, maxResults) {
   const recordLimit = maxResults === void 0 ? 0 : Math.max(0, maxResults) + COMMAND_LIMIT_HEADROOM;
@@ -15404,6 +15534,17 @@ async function runCommand(binary, args2, cwd, maxResults) {
     }
   });
 }
+function extractGrepExcludeDir(pattern) {
+  const p = pattern.replaceAll("\\", "/");
+  if (!p) return null;
+  if (!/\/(\*{1,2})?$/.test(p)) return null;
+  const clean = p.replace(/\/(\*{1,2})?$/, "");
+  if (!clean || clean.includes("/") || /[*?{}[\]]/.test(clean)) return null;
+  return clean;
+}
+function isGrepExpressibleExclude(pattern) {
+  return extractGrepExcludeDir(pattern) !== null;
+}
 function commandArgs(o, binary, target) {
   const args2 = binary === "rg" ? ["--line-number", "--no-heading", "--color", "never", "--null"] : ["-RIn", "--binary-files=without-match", "--null"];
   if (binary === "rg") args2.push("--no-require-git");
@@ -15416,8 +15557,8 @@ function commandArgs(o, binary, target) {
     if (o.include) args2.push("--glob", o.include);
   } else {
     for (const x of o.exclude ?? []) {
-      const clean = x.replace(/\/\*\*$/, "");
-      if (clean && !clean.includes("/")) args2.push("--exclude-dir", clean);
+      const clean = extractGrepExcludeDir(x);
+      if (clean) args2.push("--exclude-dir", clean);
     }
     if (o.include) args2.push("--include", o.include);
   }
@@ -15465,7 +15606,7 @@ function globMatch(pattern, value) {
     else source += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
   }
   const r = new RegExp(`^${source}$`);
-  return r.test(value) || r.test(basename(value));
+  return r.test(value) || r.test(basename2(value));
 }
 var defaultReadTextFile = (filePath) => readFile3(filePath, "utf8").catch(() => "");
 async function jsSearch(o, targetPath) {
@@ -15513,6 +15654,23 @@ async function jsSearch(o, targetPath) {
   }
   return { matches: out, totalMatches: out.length, truncated: false, engine: "js" };
 }
+async function canGrepFulfillOptions(o) {
+  if (!o.includeIgnored) {
+    const gitignorePatterns = await readRootGitignorePatterns(o.root);
+    if (gitignorePatterns.length > 0) return false;
+  }
+  if (o.include) {
+    if (o.include.includes("/") || o.include.includes("\\") || o.include.includes("**") || /[{}[\]]/.test(o.include)) {
+      return false;
+    }
+  }
+  if (o.exclude && o.exclude.length > 0) {
+    for (const pattern of o.exclude) {
+      if (!isGrepExpressibleExclude(pattern)) return false;
+    }
+  }
+  return true;
+}
 var COMMAND_ENGINES = [
   { engine: "ripgrep", binaryOption: "resolveRipgrepBinary", binaryName: "rg", argsKey: "rg" },
   { engine: "grep", binaryOption: "resolveGrepBinary", binaryName: "grep", argsKey: "grep" }
@@ -15524,6 +15682,7 @@ async function searchFileTextMatches(o) {
   if (targetStat.isFile()) return jsSearch(o, targetPath);
   const run2 = o.runCommand ?? runCommand, max4 = o.maxResults;
   for (const entry of COMMAND_ENGINES) {
+    if (entry.engine === "grep" && !await canGrepFulfillOptions(o)) continue;
     const injectedResolver = o[entry.binaryOption];
     const binary = injectedResolver ? injectedResolver() : resolveExecutableOnPath(entry.binaryName);
     if (!binary) continue;
@@ -15708,13 +15867,15 @@ function runTaskLogs(args2) {
   const allEvents = registry.getTaskEvents(taskId, 0);
   const terminal = lastTerminalEvent(allEvents);
   const status = terminal ? reportedTaskStatus(terminal.type, terminal.exitCode) : record2 ? statusOf(record2) : "running";
+  const hint = events.length === 0 && !isProcessTaskTerminalStatus(status) ? `no new events since cursor ${cursor}; the task is still running and there is nothing more to read right now. Don't re-read the same cursor immediately: later events are returned once they exist. Where the host reports completions, wait for that signal; otherwise use taskWait with an explicit budget.` : void 0;
   return {
     outcome: "ok",
     taskId,
     cursor: registry.latestTaskSeq(taskId),
     events,
     status,
-    terminal: isProcessTaskTerminalStatus(status)
+    terminal: isProcessTaskTerminalStatus(status),
+    ...hint ? { hint } : {}
   };
 }
 function formatTaskLogsContent(result4, options) {
@@ -15876,7 +16037,11 @@ function buildReadWorkspaceParameters() {
     properties: {
       path,
       lines,
-      force
+      force,
+      raw: {
+        type: "boolean",
+        description: "Read original bytes including full runtime acceptance observations in *.result.md. Default compacts only machine observations; report text and physical line numbers are unchanged."
+      }
     },
     required: ["path"]
   };
@@ -16201,7 +16366,7 @@ function filterDeclaredWorkspaceToolNames(args2) {
 // packages/agent-runtime/workspacePathGuard.ts
 import { constants as fsConstants } from "node:fs";
 import { lstat, mkdir, open, readlink, realpath as realpath2 } from "node:fs/promises";
-import { basename as basename2, dirname, isAbsolute as isAbsolute2, join as join2, relative as relative3, resolve as resolve3, sep } from "node:path";
+import { basename as basename3, dirname, isAbsolute as isAbsolute2, join as join2, relative as relative3, resolve as resolve3, sep } from "node:path";
 function isPathInsideRoot(root, targetPath) {
   const rel = relative3(resolve3(root), resolve3(targetPath));
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute2(rel);
@@ -16224,7 +16389,7 @@ async function realpathAllowMissing(targetPath) {
       if (!isNotFoundError(error)) return null;
       const parent = dirname(current);
       if (parent === current) return null;
-      tail.push(basename2(current));
+      tail.push(basename3(current));
       current = parent;
     }
   }
@@ -16418,7 +16583,7 @@ async function createMissingDirectoryChain(guard) {
   }
   try {
     for (const target of missing.slice().reverse()) {
-      const name = basename2(target);
+      const name = basename3(target);
       if (!name || name === "." || name === "..") {
         throw workspacePathGuardError({
           ok: false,
@@ -16662,6 +16827,9 @@ function describeRejectedArgValue(value) {
   if (Array.isArray(value)) return "an array";
   return `a value of type ${typeof value}`;
 }
+function clipMarkerValue(text2, max4 = 60) {
+  return text2.length <= max4 ? text2 : `${text2.slice(0, max4)}\u2026(${text2.length} chars)`;
+}
 function readIntegerArg(args2) {
   if (isAbsentArg(args2.value)) return {};
   const min4 = args2.min ?? 1;
@@ -16720,16 +16888,16 @@ function parseLinesArg(value) {
 }
 function readFileSliceArgs(args2) {
   const warnings = [];
-  const withFallback = (slice2) => {
+  const withFallback = (slice2, invalidLines) => {
     warnings.push(
       `No usable line range remained; returned the first ${READ_FILE_SLICE_FALLBACK_LINES} lines instead of the whole file.`
     );
-    return { ...slice2, maxLines: READ_FILE_SLICE_FALLBACK_LINES, warnings };
+    return { ...slice2, maxLines: READ_FILE_SLICE_FALLBACK_LINES, warnings, invalidLines };
   };
-  if (isAbsentArg(args2.lines)) return { warnings };
+  if (isAbsentArg(args2.lines)) return { warnings, invalidLines: void 0 };
   const { slice, warning } = parseLinesArg(args2.lines);
   if (warning) warnings.push(warning);
-  return slice ? { ...slice, warnings } : withFallback({});
+  return slice ? { ...slice, warnings, invalidLines: void 0 } : withFallback({}, describeRejectedArgValue(args2.lines));
 }
 function buildReadFileSliceHint(totalLines) {
   return `File has ${totalLines} lines. Use lines: ${LINES_ARG_SYNTAX}, or omit it for the whole file.`;
@@ -16998,7 +17166,7 @@ var READ_FILE_LEDGER_MAX_KEYS = 256;
 async function readFileTool(args2) {
   const parsed = parseWorkspaceToolArguments(args2.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
-  const { warnings, ...sliceArgs } = readFileSliceArgs(parsed);
+  const { warnings, invalidLines, ...sliceArgs } = readFileSliceArgs(parsed);
   const approval = await resolveLocalWorkspaceToolApproval({
     workspaceRoot: args2.workspaceRoot,
     requestedPath,
@@ -17006,7 +17174,9 @@ async function readFileTool(args2) {
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
   const absolutePath = approval.path;
-  const content = await readGuardApprovedFile(approval);
+  const originalContent = await readGuardApprovedFile(approval);
+  const projection = projectRunResultRead(absolutePath, originalContent, parsed.raw === true);
+  const content = projection.content;
   const activity = extractActivity(parsed);
   const sliced = sliceReadFileContent({
     content,
@@ -17016,7 +17186,16 @@ async function readFileTool(args2) {
     content: sliced.content,
     totalLines: sliced.totalLines
   });
-  const isTruncated = sliced.truncated || truncatedRead.truncatedByCharLimit;
+  const invalidLinesMarker = invalidLines !== void 0 ? `[readFile] lines=${clipMarkerValue(invalidLines)} was rejected (only ONE range: ${LINES_ARG_SYNTAX}); returned lines ${sliced.startLine}-${sliced.endLine} instead. Fix the argument before relying on this window.
+` : "";
+  const finalRead = invalidLinesMarker.length > 0 ? defensivelyTruncateReadFile({
+    content: truncatedRead.content,
+    totalLines: sliced.totalLines,
+    limit: Math.max(1, READ_FILE_MAX_CHAR_LIMIT - invalidLinesMarker.length)
+  }) : truncatedRead;
+  const finalContent = invalidLinesMarker + finalRead.content;
+  const truncatedByCharLimit = truncatedRead.truncatedByCharLimit || finalRead.truncatedByCharLimit;
+  const isTruncated = sliced.truncated || truncatedByCharLimit;
   const relativePath = normalizeWorkspaceRelativePath({
     workspaceRoot: resolve4(args2.workspaceRoot),
     targetPath: absolutePath
@@ -17024,7 +17203,7 @@ async function readFileTool(args2) {
   const force = parsed.force === true;
   const ledger = args2.readLedger;
   const requestRange = { startLine: sliced.startLine, endLine: sliced.endLine };
-  const fingerprint = createHash3("sha1").update(content).digest("hex").slice(0, 20);
+  const fingerprint = createHash3("sha1").update(originalContent).update(parsed.raw === true ? "\0raw" : "\0default").digest("hex").slice(0, 20);
   let entry = ledger?.get(relativePath);
   if (entry && entry.fingerprint !== fingerprint) {
     entry = void 0;
@@ -17052,20 +17231,25 @@ async function readFileTool(args2) {
   }
   const metadata = {
     path: relativePath,
-    bytes: Buffer.byteLength(truncatedRead.content),
-    totalBytes: Buffer.byteLength(content),
+    bytes: Buffer.byteLength(finalContent),
+    totalBytes: Buffer.byteLength(originalContent),
+    ...projection.projected ? {
+      projection: "run-result-observations",
+      projectedTotalBytes: Buffer.byteLength(content),
+      rawReadHint: "readFile raw:true reads original evidence; line numbers are unchanged."
+    } : {},
     startLine: sliced.startLine,
     endLine: sliced.endLine,
     totalLines: sliced.totalLines,
     truncated: isTruncated,
-    ...truncatedRead.truncatedByCharLimit ? { truncatedByByteLimit: true, truncatedByCharLimit: true } : {},
+    ...truncatedByCharLimit ? { truncatedByByteLimit: true, truncatedByCharLimit: true } : {},
     ...sliceArgs.maxLines ? { maxLines: sliceArgs.maxLines } : {},
     ...sliceArgs.tailLines ? { tailLines: sliceArgs.tailLines } : {},
     ...warnings.length ? { warnings: [...warnings, buildReadFileSliceHint(sliced.totalLines)] } : {},
     ...activity ? { activity } : {}
   };
   if (!isTruncated && ledger) {
-    const persistedChars = truncatedRead.content.length + "\n\n[tool metadata]\n".length + JSON.stringify(metadata).length;
+    const persistedChars = finalContent.length + "\n\n[tool metadata]\n".length + JSON.stringify(metadata).length;
     const records = entry?.records ?? [];
     records.push({ ...requestRange, chars: persistedChars });
     ledger.delete(relativePath);
@@ -17079,7 +17263,7 @@ async function readFileTool(args2) {
       ledger.delete(oldestKey);
     }
   }
-  return { content: truncatedRead.content, metadata };
+  return { content: finalContent, metadata };
 }
 async function ensureGuardedParentDirectory(args2) {
   const directoryGuard = await resolveWorkspaceSafePath({
@@ -17978,7 +18162,8 @@ function createLocalWorkspaceToolExecutors(args2) {
       if (!Array.isArray(paths) || paths.length === 0 || paths.some((path) => typeof path !== "string" || !path.trim())) {
         throw new Error("read_image: paths must contain 1 to 4 non-empty string paths (maximum 4 images)");
       }
-      const results2 = await Promise.all(paths.map(async (path) => {
+      const imagePaths = paths.filter((path) => typeof path === "string");
+      const results2 = await Promise.all(imagePaths.map(async (path) => {
         try {
           const absolutePath = await resolveLocalWorkspaceToolPath({
             workspaceRoot: args2.workspaceRoot,
@@ -18225,6 +18410,13 @@ function getAgentRuntimeToolParametersIndex() {
 }
 
 // packages/agent-runtime/localToolPolicy.ts
+var shellLifecycles = /* @__PURE__ */ new WeakMap();
+function registerLocalShellLifecycle(executor, lifecycle) {
+  shellLifecycles.set(executor, lifecycle);
+}
+function getLocalShellLifecycle(executor) {
+  return executor ? shellLifecycles.get(executor) : void 0;
+}
 var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
   "deleteSpaces",
   "updateAgent",
@@ -18338,12 +18530,13 @@ async function runExecShellGates(args2) {
     return { kind: "pass", opts };
   }
   if (args2.execShellApproval) {
-    const result4 = await invokeCapability("execShell", args2.callArguments, {
+    const execute = () => invokeCapability("execShell", args2.callArguments, {
       ...opts,
       workspaceRoot: args2.workspaceRoot,
       commandOutputLimit: args2.commandOutputLimit,
       execShellApproval: args2.execShellApproval
     });
+    const result4 = await (args2.shellLifecycle ? args2.shellLifecycle(execute, args2.abortSignal) : execute());
     return { kind: "handled", result: result4 };
   }
   let parsedInput = args2.callArguments;
@@ -18387,6 +18580,7 @@ async function executeLocalToolWithPolicy(args2) {
   const gate = await runExecShellGates({
     toolName: decision.toolName,
     callArguments: args2.call.arguments,
+    shellLifecycle: getLocalShellLifecycle(executor),
     execShellApproval: args2.execShellApproval,
     workspaceRoot: args2.workspaceRoot,
     commandOutputLimit: args2.commandOutputLimit,
@@ -18407,7 +18601,41 @@ async function executeLocalToolWithPolicy(args2) {
   );
 }
 
+// packages/agent-runtime/credentialSinkPolicy.ts
+var CREDENTIAL_REF_ALLOWED_SINKS = /* @__PURE__ */ new Set();
+function classifyCredentialRefSink(toolName, allowlist = CREDENTIAL_REF_ALLOWED_SINKS) {
+  if (isCommandExecutingTool(toolName)) return "command";
+  if (allowlist.has(toolName)) return "allow";
+  return "confirm";
+}
+function buildCredentialSinkPermissionRequest(toolName) {
+  return {
+    id: `permission-credential-sink-${toolName}`,
+    tool: toolName,
+    action: "credential_unwrap_tool_use",
+    title: "\u786E\u8BA4\u5728\u5DE5\u5177\u53C2\u6570\u4E2D\u4F7F\u7528\u51ED\u636E",
+    body: `\u8BE5\u5DE5\u5177\uFF08${toolName}\uFF09\u7684\u53C2\u6570\u8981\u643A\u5E26\u51ED\u636E\uFF0C\u786E\u8BA4\u540E\u4EC5\u672C\u6B21\u8C03\u7528\u89E3\u5305\uFF1B\u660E\u6587\u4E0D\u4F1A\u5199\u5165\u5386\u53F2\u6216\u8BB0\u5F55\u3002`,
+    suggestedRule: {
+      scope: "once",
+      pattern: { capability: "credential_use", target: "tool_arguments" }
+    }
+  };
+}
+
 // packages/agent-runtime/toolCallTransaction.ts
+function buildCredentialSinkRefusal(toolName, gateId) {
+  return {
+    content: `\u9700\u8981\u7528\u6237\u786E\u8BA4\u624D\u80FD\u628A\u51ED\u636E\u7528\u4E8E ${toolName}\u3002\u53EF\u6539\u8D70\u53D7\u63A7\u901A\u9053\uFF1Anolo secret run --with <name> -- <cmd>\u3002`,
+    metadata: {
+      cancelled: true,
+      actionGateResult: {
+        status: "cancelled",
+        ...gateId ? { gateId } : {}
+      }
+    }
+  };
+}
+var credentialGateQueues = /* @__PURE__ */ new WeakMap();
 var LOCAL_TURN_ABORTED_CODE = "LOCAL_TURN_ABORTED";
 function buildAbortedError() {
   const error = new Error("local agent turn aborted by user");
@@ -18656,32 +18884,72 @@ async function executeToolCall(args2) {
       const rawArguments = toolCall.function.arguments;
       let unwrappedArguments = rawArguments;
       if (typeof rawArguments === "string" && rawArguments.includes("$nolo_cred:") && input.adapter.credentialBroker) {
-        if (isCommandExecutingTool(toolName)) {
+        const sink = classifyCredentialRefSink(toolName);
+        if (sink === "command") {
           throw new Error(
             `[security] \u62D2\u7EDD\u5728 ${toolName} \u547D\u4EE4\u884C\u4E2D\u76F4\u63A5\u89E3\u5305\u51ED\u8BC1\u5F15\u7528 ($nolo_cred:)\uFF0C\u4EE5\u9632\u5FA1\u63D0\u793A\u8BCD\u6CE8\u5165\u5916\u6CC4\u98CE\u9669\u3002\u8BF7\u4F7F\u7528\u53D7\u63A7\u8BA4\u8BC1\u901A\u9053\u3002`
           );
         }
-        unwrappedArguments = await unwrapToolArguments(rawArguments, input.adapter.credentialBroker);
-      }
-      const executePromise = input.adapter.executeTool({
-        id: toolCall.id,
-        name: toolName,
-        arguments: unwrappedArguments,
-        ...userInputText ? { userInput: userInputText } : {},
-        ...input.runtimeContext ? { runtimeContext: input.runtimeContext } : {},
-        ...args2.runToolNames ? { runToolNames: args2.runToolNames } : {},
-        ...input.abortSignal ? { abortSignal: input.abortSignal } : {},
-        // 定档信号：来源只由 turn 输入推导，不让模型/参数层参与。
-        // 三级判据见 plan §10——后台运行优先于子 run（后台派发的子 run 仍是
-        // 无人值守的，按 automation 报更保守）。
-        origin: input.background ? "automation" : input.runKind === "subtask" ? "agent" : "chat"
-      }, {
-        ...input.abortSignal ? { abortSignal: input.abortSignal } : {},
-        ...input.runtimeContext ? { runtimeContext: input.runtimeContext } : {}
-      });
-      const execStartedAtMs = Date.now();
-      toolResult = await runAbortableToolTask(input, executePromise, toolName);
-      toolExecMs = Date.now() - execStartedAtMs;
+        if (sink === "confirm") {
+          if (input.onActionGate) {
+            const permissionRequest = buildCredentialSinkPermissionRequest(toolName);
+            const gate = {
+              ...permissionRequest,
+              // [M1] id 带上 toolCall.id，避免同一轮同一工具两次请求 id 碰撞（对齐既有 ask 分支约定）。
+              id: `${permissionRequest.id}-${toolCall.id}`,
+              kind: "confirm",
+              toolName,
+              toolCallId: toolCall.id
+            };
+            const onActionGate = input.onActionGate;
+            const prev = credentialGateQueues.get(input) ?? Promise.resolve();
+            const next = prev.catch(() => void 0).then(
+              () => runAbortableToolTask(
+                input,
+                onActionGate(gate),
+                `${toolName} credential confirmation`
+              )
+            );
+            credentialGateQueues.set(input, next);
+            const replacement = await next.finally(() => {
+              if (credentialGateQueues.get(input) === next) {
+                credentialGateQueues.delete(input);
+              }
+            });
+            if (replacement !== void 0 && isCompletedActionGateResult(replacement?.metadata?.actionGateResult)) {
+              unwrappedArguments = await unwrapToolArguments(rawArguments, input.adapter.credentialBroker);
+            } else {
+              toolResult = buildCredentialSinkRefusal(toolName, gate.id);
+            }
+          } else {
+            toolResult = buildCredentialSinkRefusal(toolName);
+          }
+        }
+        if (sink === "allow") {
+          unwrappedArguments = await unwrapToolArguments(rawArguments, input.adapter.credentialBroker);
+        }
+      }
+      if (!toolResult) {
+        const executePromise = input.adapter.executeTool({
+          id: toolCall.id,
+          name: toolName,
+          arguments: unwrappedArguments,
+          ...userInputText ? { userInput: userInputText } : {},
+          ...input.runtimeContext ? { runtimeContext: input.runtimeContext } : {},
+          ...args2.runToolNames ? { runToolNames: args2.runToolNames } : {},
+          ...input.abortSignal ? { abortSignal: input.abortSignal } : {},
+          // 定档信号：来源只由 turn 输入推导，不让模型/参数层参与。
+          // 三级判据见 plan §10——后台运行优先于子 run（后台派发的子 run 仍是
+          // 无人值守的，按 automation 报更保守）。
+          origin: input.background ? "automation" : input.runKind === "subtask" ? "agent" : "chat"
+        }, {
+          ...input.abortSignal ? { abortSignal: input.abortSignal } : {},
+          ...input.runtimeContext ? { runtimeContext: input.runtimeContext } : {}
+        });
+        const execStartedAtMs = Date.now();
+        toolResult = await runAbortableToolTask(input, executePromise, toolName);
+        toolExecMs = Date.now() - execStartedAtMs;
+      }
     }
     if (tailDropNotice) {
       toolResult = {
@@ -18696,6 +18964,15 @@ ${toolResult.content}` : toolResult.content,
       toolCallId: toolCall.id,
       metadata: toolResult.metadata
     });
+    if (actionGate && !input.onActionGate && actionGate.kind === "input") {
+      toolResult = {
+        content: "\u5F53\u524D\u8FD0\u884C\u73AF\u5883\u6CA1\u6709\u4EA4\u4E92\u8F93\u5165\u9762\u677F\uFF0C\u65E0\u6CD5\u5F39\u51FA\u51ED\u636E\u586B\u5199\u754C\u9762\uFF0C\u8BE5\u8BF7\u6C42\u5DF2\u88AB\u53D6\u6D88\u3002\u8BF7\u8BA9\u7528\u6237\u5728\u684C\u9762\u7AEF\u6216 Web \u7AEF\u754C\u9762\u63D0\u4F9B\u51ED\u636E\uFF0C\u6216\u76F4\u63A5\u5728\u5BF9\u8BDD\u4E2D\u53D1\u9001\u51ED\u636E\u5185\u5BB9\uFF1B\u51ED\u636E\u4FDD\u5B58\u540E\u7528 nolo secret run --with <NAME> -- <cmd> \u6D88\u8D39\u3002",
+        metadata: {
+          cancelled: true,
+          actionGateResult: { gateId: actionGate.id, status: "cancelled" }
+        }
+      };
+    }
     if (actionGate && input.onActionGate) {
       const replacement = await runAbortableToolTask(input, input.onActionGate(actionGate), `${toolName} action gate`);
       if (replacement) {
@@ -18789,10 +19066,15 @@ function applyPersistedTurnInput(messages, persistedInput, persistedInputReferen
 }
 function createTurnTranscript(args2) {
   let working = args2.initialWorking;
-  const raw = args2.initialWorking.slice(
+  let raw = args2.initialWorking.slice(
     args2.prefixCount + args2.historyCount
   );
   const cap = args2.capToolMessage ?? ((msg) => msg);
+  function retract(callback4) {
+    const predicate = callback4;
+    working = working.filter((msg) => !predicate(msg));
+    raw = raw.filter((msg) => !predicate(msg));
+  }
   return {
     working: () => working,
     replaceWorkingHistory: (nextWorkingView) => {
@@ -18811,7 +19093,13 @@ function createTurnTranscript(args2) {
       raw.pop();
       return working.pop();
     },
-    persisted: (persistedInput, persistedInputReference) => applyPersistedTurnInput(raw.map(withoutToolImages), persistedInput, persistedInputReference)
+    retract,
+    persisted: (persistedInput, persistedInputReference) => {
+      const firstUser = raw.find(
+        (message) => message.role === "user"
+      );
+      return firstUser?.cliMessageId ? raw.map(withoutToolImages) : applyPersistedTurnInput(raw.map(withoutToolImages), persistedInput, persistedInputReference);
+    }
   };
 }
 
@@ -18863,10 +19151,10 @@ function createTurnUsageLedger(args2) {
     recordProviderCall: ({ usage, model, provider, telemetry }) => {
       turnUsage = mergeTurnUsage(turnUsage, usage);
       lastContextUsage = usage;
-      if (usage && Object.keys(usage).length > 0) {
+      if (usage && Object.keys(usage).length > 0 || telemetry?.requestState) {
         providerRecords.push({
-          callId: resolveRecordCallId(usage),
-          usage,
+          callId: resolveRecordCallId(usage ?? {}),
+          usage: usage ?? {},
           model: model || args2.model || "unknown",
           ...provider || args2.provider ? { provider: provider || args2.provider } : {},
           ...telemetry && Object.keys(telemetry).length > 0 ? { telemetry } : {},
@@ -18897,7 +19185,42 @@ function createTurnUsageLedger(args2) {
 }
 
 // packages/agent-runtime/leafFinalHandoff.ts
-var LEAF_FINAL_HANDOFF_INSTRUCTIONS = `Leaf subtask final: return only the result, blockers/findings, and minimal evidence the parent needs. Do not narrate your process or restate the task. Keep success minimal (a one-line result is enough); on failure include the blocker, severity when relevant, and an evidence reference (file:line, test command, commit, artifact, or run/dialog). If the task explicitly requires a long-form deliverable (document, translation, dataset, code, or other artifact), provide that deliverable in full and keep only the handoff around it concise. During execution, follow the brief as given: report only results incremental to the brief, new evidence, overturned assumptions, and remaining questions; only when new evidence would materially change the goal, risk, irreversibility, or DoD should you surface it as a blocker/finding \u2014 do not silently expand scope or re-litigate the settled direction. Keep success concise, but include evidence for required DoD items.`;
+var LEAF_FINAL_HANDOFF_INSTRUCTIONS = `Leaf subtask final: return only the result, blockers/findings, and minimal evidence the parent needs. Do not narrate your process or restate the task. Keep success minimal (a one-line result is enough); on failure include the blocker, severity when relevant, and an evidence reference (file:line, test command, commit, artifact, or run/dialog). If the task explicitly requires a long-form deliverable (document, translation, dataset, code, or other artifact), provide that deliverable in full and keep only the handoff around it concise. During execution, follow the brief as given: report only results incremental to the brief, new evidence, overturned assumptions, and remaining questions; only when new evidence would materially change the goal, risk, irreversibility, or DoD should you surface it as a blocker/finding \u2014 do not silently expand scope or re-litigate the settled direction. Own investigation, implementation, related checks and failure fixes within the brief\u2019s scope and budget; leave goals and critical decisions to the parent. For required DoD checks, include the worktree, checked version (including uncommitted change scope), command, check scope, pass/fail and original-output reference; explicitly mark checks not run or evidence unavailable. Reuse valid same-version evidence; additional checks are warranted for version changes, missing/conflicting evidence or integration risk. Do not invent version metadata or treat a completion summary as independent review approval. Keep success concise without omitting required evidence.`;
+
+// packages/agent-runtime/taskExecutionContract.ts
+var present = (value) => typeof value === "string" && value.trim().length > 0;
+function evaluateTaskExecutionContract(contract, outcome = {}) {
+  if (!contract) return void 0;
+  const result4 = (status, ...reasons) => ({ taskId: contract.taskId, status, reasons });
+  if (outcome.stopped) return result4("blocked", "stopped");
+  if (!present(contract.taskId) || !["owner", "implementation-leaf"].includes(contract.role) || !["active", "paused", "revoked"].includes(contract.authorization) || !["pending", "waived", "accepted", "unknown"].includes(contract.acceptance) || !["complete", "incomplete", "unknown"].includes(contract.implementation) || !["changed", "unchanged", "unknown"].includes(contract.changes)) {
+    return result4("blocked", "invalid_contract");
+  }
+  if (contract.authorization === "revoked") return result4("blocked", "authorization_revoked");
+  if (contract.authorization === "paused") return result4("blocked", "authorization_paused");
+  if (outcome.executionFailed) return result4("blocked", "execution_failed");
+  if (outcome.budgetExhausted) return result4("incomplete", "budget_exhausted");
+  if (contract.implementation !== "complete") return result4("incomplete", "implementation_incomplete");
+  if (contract.acceptance === "pending") return result4("waiting", "acceptance_pending");
+  if (contract.acceptance === "unknown") return result4("blocked", "acceptance_unknown");
+  if (contract.changes === "unknown") return result4("incomplete", "changes_unknown");
+  if (contract.role === "implementation-leaf" || contract.changes === "unchanged") return result4("completed");
+  if (!present(contract.revision)) return result4("incomplete", "revision_missing");
+  const review = contract.review;
+  if (!review || !present(review.evidenceRef)) return result4("incomplete", "review_missing");
+  if (review.revision !== contract.revision) return result4("incomplete", "review_stale");
+  if (!present(contract.authorInstanceId) || !present(review.reviewerInstanceId) || review.reviewerInstanceId === contract.authorInstanceId) return result4("blocked", "review_not_independent");
+  if (review.verdict !== "APPROVE" || review.hasCriticalOrHigh !== false) return result4("blocked", "review_rejected");
+  const commit = contract.commit;
+  if (!commit || !present(commit.commitId) || !present(commit.evidenceRef)) return result4("incomplete", "commit_missing");
+  if (commit.revision !== contract.revision) return result4("incomplete", "commit_stale");
+  const merge4 = contract.localMerge;
+  if (!merge4 || !present(merge4.targetBranch) || !present(merge4.mergeCommitId) || !present(merge4.evidenceRef)) {
+    return result4("incomplete", "local_merge_missing");
+  }
+  if (merge4.sourceCommitId !== commit.commitId) return result4("incomplete", "local_merge_mismatch");
+  return result4("completed");
+}
 
 // packages/agent-runtime/contextBlockScope.ts
 var isContextBlockScope = (value) => {
@@ -18913,6 +19236,34 @@ var normalizeContextBlockScopes = (legacyBlocks = void 0, scopes = void 0) => {
   return (Array.isArray(legacyBlocks) ? legacyBlocks : []).filter((block) => typeof block === "string").map((block) => block.trim()).filter((block) => block.length > 0).map((block) => ({ content: block, cacheScope: "turn" }));
 };
 
+// packages/agent-runtime/providerInputItemLimits.ts
+var PROVIDER_INPUT_ITEM_LIMITS = [
+  {
+    provider: "opendesign",
+    endpointHost: "open-design.ai",
+    // Upstream HTTP 400: "[code=context_length_exceeded] Input is too long:
+    // conversation history exceeds the limit on input items (1003 > 1000 items)."
+    // type=invalid_request_error, code=context_length_exceeded, param=messages.
+    maxInputItems: 1e3
+  }
+];
+function resolveProviderInputItemLimit(args2) {
+  const byProvider = PROVIDER_INPUT_ITEM_LIMITS.find(
+    (entry) => entry.provider === args2.provider?.toLowerCase()
+  );
+  if (byProvider) return byProvider.maxInputItems;
+  if (!args2.endpoint) return void 0;
+  let host;
+  try {
+    host = new URL(args2.endpoint.includes("://") ? args2.endpoint : `https://${args2.endpoint}`).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+  return PROVIDER_INPUT_ITEM_LIMITS.find(
+    (entry) => host === entry.endpointHost || host.endsWith(`.${entry.endpointHost}`)
+  )?.maxInputItems;
+}
+
 // packages/agent-runtime/localAutoCompaction.ts
 import { randomUUID } from "node:crypto";
 function toPlanCompressionMessages(history) {
@@ -18991,25 +19342,75 @@ function projectHistoryWithSummary(args2) {
   return [...summaryMsg, ...preservedUser, ...projected];
 }
 var COLD_RESUME_IDLE_MS = 60 * 60 * 1e3;
-async function runSummaryFallback(fallback, content, options) {
+async function completeRoutedCompactionSummary(args2) {
+  const budget = createSummaryBudget({ mode: "automatic", signal: args2.options.signal, deadlineMs: args2.options.deadlineMs });
   try {
-    const text2 = await fallback(content, options);
-    if (text2 === null) return { summary: null, error: "no summary" };
-    if (typeof text2 !== "string") return { summary: null, error: "non-string output" };
-    const trimmed = text2.trim();
-    return trimmed.length > 0 ? { summary: trimmed } : { summary: null, error: "empty summary" };
-  } catch (error) {
-    console.warn("[localLoop] auto-compaction summary fallback failed", {
-      attemptId: options.attemptId,
-      stage: "fallback"
+    const options = { ...args2.options, signal: budget.signal, deadlineMs: budget.deadlineMs };
+    const eligible = await budget.run(async () => {
+      try {
+        return await args2.fallback.preferPlatform?.(options) === true;
+      } catch (error) {
+        if (budget.signal.aborted || isAbortError(error) || error?.name === "TimeoutError") throw error;
+        return false;
+      }
     });
-    const message = error instanceof Error ? error.message : String(error);
-    return { summary: null, error: message };
+    let currentResult;
+    const result4 = await runSummaryWithContract({
+      budget,
+      eligibility: { userId: "authenticated-account", authenticated: eligible, platformAvailable: eligible, credits: eligible ? 1 : void 0 },
+      platform: {
+        model: PLATFORM_HOSTED_DEEPSEEK_FLASH_MODEL,
+        provider: "nolo",
+        attemptId: options.attemptId,
+        run: async () => args2.fallback.complete ? args2.fallback.complete(args2.content, options) : { text: await args2.fallback(args2.content, options) ?? "" }
+      },
+      current: { attemptId: options.attemptId, run: async () => {
+        currentResult = await args2.current();
+        return {
+          text: currentResult.content ?? "",
+          finishReason: currentResult.finish_reason,
+          maxOutputTokens: options.maxOutputTokens,
+          completionTokens: summaryCompletionTokens(currentResult.usage)
+        };
+      } }
+    });
+    if (result4.kind === "error" || result4.kind === "cancelled") {
+      throw Object.assign(new Error(result4.error.message), result4.error, {
+        type: result4.error.errorType,
+        name: result4.kind === "cancelled" ? "AbortError" : result4.error.category === "timeout" ? "TimeoutError" : "SummaryError"
+      });
+    }
+    if (result4.kind === "truncated") throw {
+      code: "SUMMARY_TRUNCATED",
+      stage: "decode",
+      finishReason: result4.completion?.finishReason,
+      maxOutputTokens: result4.completion?.maxOutputTokens ?? options.maxOutputTokens,
+      completionTokens: result4.completion?.completionTokens,
+      outputChars: result4.completion?.text.length,
+      responseStatus: result4.completion?.responseStatus,
+      incompleteReason: result4.completion?.incompleteReason,
+      model: result4.route === "platform" ? PLATFORM_HOSTED_DEEPSEEK_FLASH_MODEL : currentResult?.model,
+      provider: result4.route === "platform" ? "nolo" : currentResult?.provider
+    };
+    return result4.route === "current" && currentResult ? { ...currentResult, summaryCompletion: result4.completion } : {
+      content: result4.kind === "success" ? result4.text : "",
+      model: PLATFORM_HOSTED_DEEPSEEK_FLASH_MODEL,
+      provider: "nolo",
+      summaryCompletion: result4.completion
+    };
+  } finally {
+    budget.dispose();
   }
 }
 var COMPACTION_RETRY_BACKOFF_MS = 6e4;
 var COMPACTION_RETRY_BACKOFF_MAX_ENTRIES = 256;
 var compactionRetryBackoff = /* @__PURE__ */ new Map();
+var COMPACTION_RETRY_DELAYS_MS = [3e3, 8e3];
+var compactionRetryDelaysOverride;
+function compactionRetryDelayMs(retryCount) {
+  const table = compactionRetryDelaysOverride ?? COMPACTION_RETRY_DELAYS_MS;
+  return table[Math.min(retryCount, table.length - 1)];
+}
 function isCompactionBackedOff(dialogId, now) {
   for (const [key, until2] of compactionRetryBackoff) {
     if (until2 <= now) compactionRetryBackoff.delete(key);
@@ -19079,7 +19480,19 @@ async function maybeAutoCompactLocalHistory(args2) {
       reason = "hash-mismatch";
     }
     console.warn(
-      `[localLoop] invalidated dialog summary for ${dialogId} (${reason}); discarding and re-compressing`
+      `[localLoop] invalidated dialog summary for ${dialogId} (${reason}); discarding and re-compressing`,
+      // 诊断分项（**仅加日志，不改任何哈希/校验/重锚语义**）：区分「历史真被改写」
+      // 与「保存/重算口径不一致」。只记长度、条数、消息 id 与哈希前 8 位；
+      // 消息正文与摘要正文一律不进日志。重算哈希只发生在失效分支内，
+      // 健康路径零额外开销。
+      {
+        reason,
+        historyLength: history.length,
+        storedSourceCount: typeof invalidStored?.sourceCount === "number" ? invalidStored.sourceCount : null,
+        summarizedBeforeId: typeof invalidStored?.summarizedBeforeId === "string" ? invalidStored.summarizedBeforeId : null,
+        recomputedHashPrefix: hashSummarySourceSlice(history, invalidStored?.summarizedBeforeId)?.slice(0, 8) ?? null,
+        storedHashPrefix: typeof invalidStored?.sourceHash === "string" && invalidStored.sourceHash ? invalidStored.sourceHash.slice(0, 8) : null
+      }
     );
     stored = null;
   }
@@ -19088,18 +19501,34 @@ async function maybeAutoCompactLocalHistory(args2) {
   const legacyAnchorIndex = summarizedBeforeId ? findSummaryAnchorIndex(bridged, summarizedBeforeId) : -1;
   const planAnchorId = summarizedBeforeId && /^local-(0|[1-9]\d*)$/.test(summarizedBeforeId) && legacyAnchorIndex >= 0 ? bridged[legacyAnchorIndex].id : summarizedBeforeId;
   const contextWindow = typeof args2.contextWindow === "number" && Number.isFinite(args2.contextWindow) && args2.contextWindow > 0 ? args2.contextWindow : getModelContextWindow(args2.model ?? "");
-  const allMsgs = toPlanCompressionMessages(history);
+  const allMsgs = toPlanCompressionMessages(prepareHistoryForNextTurn(history, args2.contextReferenceResolver));
+  const maxInputItems = resolveProviderInputItemLimit({ provider: args2.provider, endpoint: args2.providerEndpoint });
+  const force = args2.force === true || args2.requestOverBudget?.(
+    existingSummary ? projectHistoryWithSummary({ history, summary: existingSummary, summarizedBeforeId }) : history
+  ) === true;
   const plan = planCompression({
     allMsgs,
     summarizedBeforeId: planAnchorId,
     summary: existingSummary,
     contextWindow,
+    // 失败路径补救：预算裁剪即将丢消息时由 localLoop 传入 force，交由 planCompression
+    // 的既有 force 语义产出待压缩切片（仍受最小条数/安全前缀约束）。
+    force,
+    ...force ? { reason: "budget_rescue" } : {},
+    availableHistoryTokens: args2.availableHistoryTokens,
     preserveLatestUserByProjection: true,
+    maxInputItems,
     ...args2.realContextUsagePercent !== void 0 ? { realContextUsagePercent: args2.realContextUsagePercent } : {}
   });
+  const itemDiagnostics = maxInputItems !== void 0 ? {
+    itemCount: plan.diagnostics?.itemCount,
+    maxInputItems,
+    triggeredByItemLimit: plan.diagnostics?.triggeredByItemLimit
+  } : {};
   const projectExisting = () => {
     const diag = plan.diagnostics;
     const diagSnapshot = diag ? {
+      ...itemDiagnostics,
       estimatedTokens: diag.totalUsed,
       historyBudget: diag.historyBudget,
       triggerRatio: diag.triggerRatio,
@@ -19107,7 +19536,7 @@ async function maybeAutoCompactLocalHistory(args2) {
     } : {};
     const skippedDecision = {
       outcome: "skipped",
-      skipReason: diag?.emptyReason === "no-pending" ? "no-pending" : diag?.emptyReason === "below-min-compress-count" ? "below-min-compress-count" : "below-trigger",
+      skipReason: diag?.emptyReason === "no-pending" ? "no-pending" : diag?.emptyReason === "below-min-compress-count" ? "below-min-compress-count" : diag?.emptyReason === "no-safe-prefix" ? "no-safe-prefix" : "below-trigger",
       ...diagSnapshot,
       ...diag ? { pendingMsgCount: diag.pendingMsgCount } : {},
       ...diag?.compressCount !== void 0 ? { compressCount: diag.compressCount } : {}
@@ -19121,6 +19550,13 @@ async function maybeAutoCompactLocalHistory(args2) {
       }),
       compressed: true,
       summaryGenerated: false,
+      selectedSummary: {
+        outcome: "loaded",
+        hash: sha256Hex(existingSummary),
+        ...summarizedBeforeId ? { anchorId: summarizedBeforeId } : {},
+        ...stored?.sourceHash ? { sourceHash: stored.sourceHash } : {},
+        ...stored?.sourceCount !== void 0 ? { sourceCount: stored.sourceCount } : {}
+      },
       decision: {
         outcome: "compressed",
         trigger: "existing-summary",
@@ -19141,6 +19577,7 @@ async function maybeAutoCompactLocalHistory(args2) {
         outcome: "skipped",
         skipReason: "retry-backoff",
         ...diag ? {
+          ...itemDiagnostics,
           estimatedTokens: diag.totalUsed,
           historyBudget: diag.historyBudget,
           triggerRatio: diag.triggerRatio,
@@ -19158,14 +19595,22 @@ async function maybeAutoCompactLocalHistory(args2) {
   });
   if (bounded3.status === "blocked") {
     const detail = `bounded compaction blocked: ${bounded3.reason}`;
-    console.warn(`[localLoop] ${detail}`);
+    console.warn(
+      `[localLoop] ${detail}`,
+      ...bounded3.diagnostics ? [bounded3.diagnostics] : []
+    );
     return {
       ...projectExisting(),
       decision: { outcome: "skipped", skipReason: "bounded-request-blocked", detail }
     };
   }
   emitPhase({ kind: "compaction-start" });
-  const compactionAttemptId = randomUUID();
+  let compactionAttemptId = randomUUID();
+  const maxAttempts = 3;
+  let attempt = 0;
+  let retryCount = 0;
+  let attemptRoute = "current";
+  let attemptTimingLogged = false;
   let compactionT0 = Date.now();
   let compactionInputTokens;
   let compactionPrevSummaryTokens;
@@ -19174,7 +19619,15 @@ async function maybeAutoCompactLocalHistory(args2) {
   let primaryElapsedMs;
   let fallbackElapsedMs;
   let saveElapsedMs;
+  let summaryDeadlineMs = Infinity;
+  let summaryModel = args2.model;
+  let summaryProvider = args2.provider;
+  let summaryDiagnostics = {
+    maxOutputTokens: bounded3.outputTokenBudget
+  };
   const logCompactionTiming = (outcome, fields) => {
+    if (attemptTimingLogged) return;
+    attemptTimingLogged = true;
     if (compactionInputTokens === void 0 && compactionInputSource !== void 0) {
       compactionInputTokens = estimateTokenCount(compactionInputSource);
     }
@@ -19184,10 +19637,20 @@ async function maybeAutoCompactLocalHistory(args2) {
     console.log(
       `[compaction-timing] ${JSON.stringify({
         attemptId: compactionAttemptId,
-        model: fields.model ?? args2.model ?? null,
+        attempt,
+        maxAttempts,
+        physicalAttempts: attempt,
+        route: attemptRoute,
+        model: fields.model ?? summaryModel ?? null,
+        provider: summaryProvider ?? null,
         inputTokens: compactionInputTokens ?? null,
         prevSummaryTokens: compactionPrevSummaryTokens ?? null,
-        outputChars: fields.outputChars ?? null,
+        outputChars: summaryDiagnostics.outputChars ?? fields.outputChars ?? null,
+        finishReason: summaryDiagnostics.finishReason ?? null,
+        responseStatus: summaryDiagnostics.responseStatus ?? null,
+        incompleteReason: summaryDiagnostics.incompleteReason ?? null,
+        maxOutputTokens: summaryDiagnostics.maxOutputTokens ?? null,
+        completionTokens: summaryDiagnostics.completionTokens ?? null,
         elapsedMs: Date.now() - compactionT0,
         primaryElapsedMs: primaryElapsedMs ?? null,
         fallbackElapsedMs: fallbackElapsedMs ?? null,
@@ -19197,10 +19660,11 @@ async function maybeAutoCompactLocalHistory(args2) {
     );
   };
   try {
-    if (args2.abortSignal?.aborted) {
-      throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
-    }
-    const provider = await args2.resolveProvider();
+    let reportAttemptUsage2 = function(value) {
+      const usage = value?.usage;
+      if (usage && typeof usage === "object") args2.onAttemptUsage?.(usage);
+    };
+    var reportAttemptUsage = reportAttemptUsage2;
     if (args2.abortSignal?.aborted) {
       throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
     }
@@ -19209,35 +19673,144 @@ async function maybeAutoCompactLocalHistory(args2) {
     compactionInputSource = promptContent;
     compactionPrevSummarySource = existingSummary;
     compactionT0 = Date.now();
-    const timeoutMs = typeof args2.timeoutMs === "number" && Number.isFinite(args2.timeoutMs) && args2.timeoutMs > 0 ? args2.timeoutMs : void 0;
+    const timeoutMs = Math.min(6e4, typeof args2.timeoutMs === "number" && Number.isFinite(args2.timeoutMs) && args2.timeoutMs > 0 ? args2.timeoutMs : 6e4);
+    const requestDeadlineMs = Date.now() + timeoutMs;
+    summaryDeadlineMs = requestDeadlineMs;
     const requestController = new AbortController();
     let timeoutHandle;
     let abortListener;
     if (args2.abortSignal?.aborted) requestController.abort(args2.abortSignal.reason);
-    const request3 = provider.complete(
-      [{ role: "system", content: COMPACTION_SUMMARY_SYSTEM_PROMPT }, { role: "user", content: promptContent }],
-      {
-        signal: requestController.signal,
-        ...timeoutMs ? { timeoutMs } : {},
-        // 仅日志用的 attempt id：让 compaction 埋点与 transport 诊断日志 /
-        // 服务端 x-request-id 可对上，用于关联请求级证据。不进 prompt/摘要/持久化。
-        requestId: compactionAttemptId,
-        // Room for factual handoff, exact commands and file operations.
-        max_tokens: bounded3.outputTokenBudget,
-        reasoning_effort: "low"
-      }
-    ).then(
-      (value) => ({ kind: "done", value }),
-      (error) => ({ kind: "provider-error", error })
-    );
-    const guards = [];
-    if (timeoutMs) guards.push(new Promise((resolve6) => {
-      timeoutHandle = setTimeout(() => {
-        requestController.abort();
-        resolve6({ kind: "timeout" });
-      }, timeoutMs);
-    }));
-    if (args2.abortSignal) guards.push(new Promise((resolve6) => {
+    let currentOnly = false;
+    const physicalRequest = async (route, operation) => {
+      if (attempt >= maxAttempts) throw { code: "SUMMARY_ATTEMPT_LIMIT" };
+      if (requestController.signal.aborted) throw requestController.signal.reason;
+      attempt++;
+      attemptRoute = route;
+      attemptTimingLogged = false;
+      compactionAttemptId = randomUUID();
+      compactionT0 = Date.now();
+      primaryElapsedMs = void 0;
+      summaryDiagnostics = { maxOutputTokens: bounded3.outputTokenBudget };
+      try {
+        const value = await operation();
+        reportAttemptUsage2(value);
+        return value;
+      } catch (error) {
+        reportAttemptUsage2(error);
+        const safe = classifySummaryError(error);
+        summaryDiagnostics = {
+          ...summaryDiagnostics,
+          finishReason: safe.finishReason,
+          responseStatus: safe.responseStatus,
+          incompleteReason: safe.incompleteReason,
+          completionTokens: safe.completionTokens,
+          outputChars: safe.outputChars,
+          maxOutputTokens: safe.maxOutputTokens ?? bounded3.outputTokenBudget
+        };
+        primaryElapsedMs = Date.now() - compactionT0;
+        logCompactionTiming(safe.category === "cancelled" ? "aborted" : safe.category === "timeout" ? "timeout" : "provider-error", {});
+        throw error;
+      }
+    };
+    const currentRequest = async () => {
+      currentOnly = true;
+      const provider = await args2.resolveProvider();
+      summaryModel = provider.model ?? args2.model;
+      summaryProvider = args2.provider;
+      if (requestController.signal.aborted) throw requestController.signal.reason ?? new DOMException("Summary cancelled", "AbortError");
+      try {
+        return await physicalRequest("current", () => provider.complete(
+          [{ role: "system", content: COMPACTION_SUMMARY_SYSTEM_PROMPT }, { role: "user", content: promptContent }],
+          {
+            signal: requestController.signal,
+            timeoutMs: Math.max(1, requestDeadlineMs - Date.now()),
+            // 仅日志用的 attempt id：让 compaction 埋点与 transport 诊断日志 /
+            // 服务端 x-request-id 可对上，用于关联请求级证据。不进 prompt/摘要/持久化。
+            requestId: compactionAttemptId,
+            // Room for factual handoff, exact commands and file operations.
+            max_tokens: bounded3.outputTokenBudget,
+            reasoning_effort: "low"
+          }
+        ));
+      } catch (cause) {
+        const safe = classifySummaryError(cause, { model: provider.model, provider: args2.provider ?? void 0, attemptId: compactionAttemptId });
+        throw Object.assign(new Error(safe.message), safe, {
+          type: safe.errorType,
+          name: safe.category === "cancelled" ? "AbortError" : safe.category === "timeout" ? "TimeoutError" : "SummaryError"
+        });
+      }
+    };
+    const fallback = args2.summaryFallback?.preferPlatform ? args2.summaryFallback : void 0;
+    let eligibility;
+    const routedFallback = fallback ? Object.assign(
+      async (content, options) => {
+        summaryModel = PLATFORM_HOSTED_DEEPSEEK_FLASH_MODEL;
+        summaryProvider = "nolo";
+        return physicalRequest("platform", () => fallback(content, { ...options, attemptId: compactionAttemptId }));
+      },
+      {
+        preferPlatform: (options) => eligibility ??= fallback.preferPlatform(options),
+        ...fallback.complete ? { complete: async (content, options) => {
+          summaryModel = PLATFORM_HOSTED_DEEPSEEK_FLASH_MODEL;
+          summaryProvider = "nolo";
+          return physicalRequest("platform", () => fallback.complete(content, { ...options, attemptId: compactionAttemptId }));
+        } } : {}
+      }
+    ) : void 0;
+    const requestOnce = () => routedFallback && !currentOnly ? completeRoutedCompactionSummary({
+      fallback: routedFallback,
+      content: promptContent,
+      options: {
+        signal: requestController.signal,
+        deadlineMs: requestDeadlineMs,
+        attemptId: compactionAttemptId,
+        maxOutputTokens: bounded3.outputTokenBudget
+      },
+      current: currentRequest
+    }) : currentRequest();
+    const request3 = (async () => {
+      for (; ; ) {
+        try {
+          return await requestOnce();
+        } catch (error) {
+          const safe = classifySummaryError(error);
+          const terminal = isQuotaExhaustedError(safe.status ?? 0, safe.code, safe.errorType) || safe.category === "cancelled" || safe.category === "timeout" || ["PROVIDER_UNAVAILABLE", "SUMMARY_TRUNCATED", "INSUFFICIENT_BALANCE"].includes(safe.code ?? "") || safe.errorType === "insufficient_balance_error";
+          const busy = !terminal && (safe.category === "http" && (safe.status === 503 || safe.status === 429) || /^(capacity|overload(?:ed)?|rate[_-]?limit(?:ed)?)(?:[_-](?:error|exceeded))?$/i.test(safe.errorType ?? "") || ["PLATFORM_LLM_BUSY", "RATE_LIMIT", "CAPACITY", "OVERLOAD", "RESOURCE_EXHAUSTED"].includes(safe.code ?? ""));
+          const delayMs = compactionRetryDelayMs(retryCount);
+          if (!busy || attempt >= maxAttempts || requestController.signal.aborted || requestDeadlineMs - Date.now() < delayMs + 5e3) throw error;
+          primaryElapsedMs = Date.now() - compactionT0;
+          logCompactionTiming("provider-error", {});
+          emitPhase({ kind: "compaction-retry", attempt: attempt + 1, maxAttempts });
+          await new Promise((resolve6, reject) => {
+            const signal = requestController.signal;
+            const cancel = () => {
+              clearTimeout(timer);
+              signal.removeEventListener("abort", cancel);
+              reject(signal.reason);
+            };
+            const timer = setTimeout(() => {
+              signal.removeEventListener("abort", cancel);
+              resolve6();
+            }, delayMs);
+            signal.addEventListener("abort", cancel, { once: true });
+            if (signal.aborted) cancel();
+          });
+          if (requestController.signal.aborted || requestDeadlineMs - Date.now() < 5e3) throw error;
+          retryCount++;
+        }
+      }
+    })().then(
+      (value) => ({ kind: "done", value }),
+      (error) => ({ kind: "provider-error", error })
+    );
+    const guards = [];
+    if (timeoutMs) guards.push(new Promise((resolve6) => {
+      timeoutHandle = setTimeout(() => {
+        requestController.abort(new DOMException("Summary deadline exceeded", "TimeoutError"));
+        resolve6({ kind: "timeout" });
+      }, timeoutMs);
+    }));
+    if (args2.abortSignal) guards.push(new Promise((resolve6) => {
       abortListener = () => {
         requestController.abort(args2.abortSignal?.reason);
         resolve6({ kind: "aborted" });
@@ -19250,71 +19823,37 @@ async function maybeAutoCompactLocalHistory(args2) {
     if (timeoutHandle) clearTimeout(timeoutHandle);
     if (abortListener) args2.abortSignal?.removeEventListener("abort", abortListener);
     const result4 = outcome.kind === "done" ? outcome.value : void 0;
-    let newSummary = result4?.finish_reason !== "length" && typeof result4?.content === "string" ? result4.content.trim() : "";
-    const primaryFailure = outcome.kind === "aborted" || args2.abortSignal?.aborted ? "aborted" : newSummary ? null : outcome.kind === "done" ? "provider-error" : outcome.kind;
-    if (primaryFailure === "aborted") {
-      throw Object.assign(new Error("auto-compaction aborted"), {
-        compactionReason: "aborted"
-      });
-    }
-    const summaryFallback = args2.summaryFallback;
-    let fallbackFailureDetail;
-    if (primaryFailure && summaryFallback) {
-      const fallbackT0 = Date.now();
-      const fallbackResult = await runSummaryFallback(
-        summaryFallback,
-        promptContent,
-        {
-          signal: args2.abortSignal,
-          deadlineMs: Date.now() + 3e4,
-          attemptId: compactionAttemptId,
-          maxOutputTokens: bounded3.outputTokenBudget
-        }
-      );
-      fallbackElapsedMs = Date.now() - fallbackT0;
-      if (args2.abortSignal?.aborted) {
-        throw Object.assign(new Error("auto-compaction aborted"), {
-          compactionReason: "aborted"
-        });
-      }
-      if (fallbackResult.summary) {
-        newSummary = fallbackResult.summary;
-      } else {
-        fallbackFailureDetail = fallbackResult.error ?? "no summary";
-      }
+    if (result4?.model) summaryModel = result4.model;
+    if (result4?.provider) summaryProvider = result4.provider;
+    if (outcome.kind === "aborted") throw Object.assign(new Error("Summary cancelled"), { name: "AbortError", compactionReason: "aborted" });
+    if (outcome.kind === "timeout") throw Object.assign(new Error("Summary deadline exceeded"), { compactionReason: "timeout" });
+    if (outcome.kind === "provider-error") throw outcome.error;
+    const completion = result4?.summaryCompletion;
+    const diagnostic = classifySummaryError({
+      finishReason: completion?.finishReason ?? result4?.finish_reason,
+      responseStatus: completion?.responseStatus,
+      incompleteReason: completion?.incompleteReason,
+      maxOutputTokens: completion?.maxOutputTokens ?? bounded3.outputTokenBudget,
+      completionTokens: completion?.completionTokens ?? summaryCompletionTokens(result4?.usage),
+      outputChars: completion?.text.length ?? result4?.content?.length
+    });
+    summaryDiagnostics = {
+      finishReason: diagnostic.finishReason,
+      responseStatus: diagnostic.responseStatus,
+      incompleteReason: diagnostic.incompleteReason,
+      maxOutputTokens: diagnostic.maxOutputTokens,
+      completionTokens: diagnostic.completionTokens,
+      outputChars: diagnostic.outputChars
+    };
+    if (isTruncatedCompletion({ ...completion, finishReason: completion?.finishReason ?? result4?.finish_reason })) {
+      throw { code: "SUMMARY_TRUNCATED", stage: "decode", ...summaryDiagnostics };
     }
+    const newSummary = result4?.content?.trim() ?? "";
     if (!newSummary) {
-      const failureNow = args2.now?.() ?? Date.now();
-      recordCompactionFailure(dialogId, failureNow);
-      const primaryDetail = outcome.kind === "provider-error" ? outcome.error instanceof Error ? outcome.error.message : String(outcome.error) : outcome.kind === "done" ? "summary model returned empty content" : `auto-compaction timed out after ${timeoutMs ?? primaryElapsedMs}ms`;
-      const primaryDiagnostic = `primary failed (${primaryElapsedMs ?? 0}ms): ${primaryDetail}`;
-      const fallbackDiagnostic = fallbackElapsedMs !== void 0 ? `; fallback failed (${fallbackElapsedMs}ms): ${fallbackFailureDetail ?? "no summary"}` : "";
-      const combinedDetail = `${primaryDiagnostic}${fallbackDiagnostic}`;
-      if (outcome.kind === "done") {
-        console.warn(
-          "[localLoop] auto-compaction produced empty summary; keeping prior projection"
-        );
-        logCompactionTiming("empty", {});
-        const failureReason = "provider-error";
-        emitPhase({ kind: "compaction-failed", reason: failureReason });
-        const failureMessage = combinedDetail.slice(0, 200);
-        return {
-          ...projectExisting(),
-          failureMessage,
-          failureReason,
-          decision: {
-            outcome: "failed",
-            reason: failureReason,
-            detail: failureMessage
-          }
-        };
-      }
-      const reason = primaryFailure ?? "provider-error";
-      throw Object.assign(new Error(combinedDetail), {
-        compactionReason: reason,
-        primaryElapsedMs,
-        fallbackElapsedMs
-      });
+      recordCompactionFailure(dialogId, args2.now?.() ?? Date.now());
+      logCompactionTiming("empty", { model: result4?.model });
+      emitPhase({ kind: "compaction-end" });
+      return { ...projectExisting(), failureMessage: "Summary empty", failureReason: "provider-error", decision: { outcome: "failed", reason: "provider-error", detail: "Summary empty", ...itemDiagnostics } };
     }
     const metricsReason = invalidSummary ? "invalid_summary" : "context_budget";
     const metrics = buildCompactionMetricsFromPlan({
@@ -19325,36 +19864,51 @@ async function maybeAutoCompactLocalHistory(args2) {
         msgsToKeep: [...msgsToCompress.slice(bounded3.coveredMessages.length), ...plan.msgsToKeep]
       },
       newSummary,
-      summaryUsage: result4?.usage
+      summaryUsage: result4?.usage,
+      summaryInput: {
+        inputTokens: bounded3.inputTokens,
+        capTokens: bounded3.capTokens,
+        expandedMessages: bounded3.expandedMessages,
+        omittedMessages: bounded3.omittedMessages
+      },
+      planCounts: {
+        pendingMessageCount: plan.diagnostics?.pendingMsgCount,
+        plannedCompressCount: plan.diagnostics?.compressCount
+      }
     });
     const projectedHistory = projectHistoryWithSummary({
       history,
       summary: newSummary,
       summarizedBeforeId: bounded3.summarizedBeforeId
     });
-    const projectedMessages = toPlanCompressionMessages(projectedHistory);
+    const projectedMessages = toPlanCompressionMessages(prepareHistoryForNextTurn(projectedHistory, args2.contextReferenceResolver));
     const projectedTokens = projectedMessages.reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0);
     const projectedRetained = projectedMessages.slice(1);
     metrics.retainedTokens = projectedRetained.reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0);
     metrics.retainedCount = projectedRetained.length;
-    const { effectiveHistoryBudget } = resolveEffectiveCompactionBudgets({
+    const { effectiveRawMessageBudget } = resolveEffectiveCompactionBudgets({
       contextWindow,
       triggerRatio: plan.diagnostics.triggerRatio,
-      historyBudget: plan.diagnostics.historyBudget,
-      rawMessageBudget: plan.diagnostics.historyBudget,
-      summaryTokens: 0
+      historyBudget: contextWindow,
+      rawMessageBudget: contextWindow,
+      summaryTokens: 0,
+      newSummaryTokenReserve: estimateTokenCount(newSummary)
     });
-    const withinSafetyBudget = projectedTokens <= effectiveHistoryBudget;
+    const effectiveHistoryBudget = effectiveRawMessageBudget + estimateTokenCount(newSummary);
+    const projectedItemCount = projectedHistory.length + 1;
+    const withinSafetyBudget = projectedTokens <= effectiveHistoryBudget && (maxInputItems === void 0 || projectedItemCount <= Math.floor(maxInputItems * 0.6));
     if (!withinSafetyBudget) {
       console.warn("[localLoop] compaction projection remains above safety budget", {
         projectedTokens,
-        effectiveHistoryBudget
+        effectiveHistoryBudget,
+        ...maxInputItems !== void 0 ? { projectedItemCount, maxInputItems } : {}
       });
     }
     const oldProjection = projectExisting();
-    const beforeProjectedTokens = toPlanCompressionMessages(oldProjection.history).reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0);
-    const historyBudget = plan.diagnostics.historyBudget;
-    if (projectedTokens >= beforeProjectedTokens || projectedTokens >= historyBudget) {
+    const beforeProjectedTokens = toPlanCompressionMessages(prepareHistoryForNextTurn(oldProjection.history, args2.contextReferenceResolver)).reduce((sum2, message) => sum2 + getMessageTokenCount(message), 0);
+    const historyBudget = Math.max(0, contextWindow - Math.min(8192, Math.max(1, Math.floor(contextWindow / 4))));
+    const candidateOverBudget = args2.requestOverBudget ? args2.requestOverBudget(projectedHistory) : projectedTokens > historyBudget;
+    if (projectedTokens >= beforeProjectedTokens || candidateOverBudget) {
       const failureMessage = `compaction candidate rejected: ${projectedTokens >= beforeProjectedTokens ? "no token reduction" : "above history budget"} (before=${beforeProjectedTokens}, after=${projectedTokens}, budget=${historyBudget})`;
       console.warn(`[localLoop] ${failureMessage}`);
       recordCompactionFailure(dialogId, args2.now?.() ?? Date.now());
@@ -19364,13 +19918,20 @@ async function maybeAutoCompactLocalHistory(args2) {
         ...oldProjection,
         failureMessage,
         ...result4?.usage ? { usage: result4.usage } : {},
-        decision: { outcome: "skipped", skipReason: "unsafe-projection", detail: failureMessage }
+        decision: {
+          outcome: "skipped",
+          skipReason: "unsafe-projection",
+          detail: failureMessage,
+          ...itemDiagnostics,
+          ...maxInputItems !== void 0 ? { projectedItemCount } : {}
+        }
       };
     }
     const sourceMeta = await computeSummarySourceMetadata(
       toPlanCompressionMessages(history),
       bounded3.summarizedBeforeId
     );
+    if (Date.now() >= summaryDeadlineMs) throw Object.assign(new Error("Summary deadline exceeded"), { compactionReason: "timeout" });
     if (args2.abortSignal?.aborted) {
       throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
     }
@@ -19400,6 +19961,13 @@ async function maybeAutoCompactLocalHistory(args2) {
       history: projectedHistory,
       compressed: true,
       summaryGenerated: true,
+      selectedSummary: {
+        outcome: "generated",
+        hash: sha256Hex(newSummary),
+        anchorId: bounded3.summarizedBeforeId,
+        ...sourceMeta?.sourceHash ? { sourceHash: sourceMeta.sourceHash } : {},
+        ...sourceMeta?.sourceCount !== void 0 ? { sourceCount: sourceMeta.sourceCount } : {}
+      },
       reason: metricsReason,
       beforeTokens: beforeProjectedTokens,
       afterTokens: projectedTokens,
@@ -19408,7 +19976,9 @@ async function maybeAutoCompactLocalHistory(args2) {
       metrics,
       decision: {
         outcome: "compressed",
-        trigger: invalidSummary ? "invalid-summary" : plan.diagnostics?.triggeredByRealUsage ? "real-usage" : "estimate",
+        trigger: invalidSummary ? "invalid-summary" : plan.diagnostics?.triggeredByItemLimit ? "item-limit" : plan.diagnostics?.triggeredByRealUsage ? "real-usage" : "estimate",
+        ...itemDiagnostics,
+        ...maxInputItems !== void 0 ? { projectedItemCount } : {},
         ...plan.diagnostics ? {
           estimatedTokens: plan.diagnostics.totalUsed,
           historyBudget: plan.diagnostics.historyBudget,
@@ -19418,18 +19988,39 @@ async function maybeAutoCompactLocalHistory(args2) {
       }
     };
   } catch (error) {
-    console.warn("[localLoop] auto-compaction failed:", error);
-    const failureMessage = error instanceof Error && error.message ? error.message.slice(0, 200) : String(error).slice(0, 200);
-    const failureReason = error instanceof Error && "compactionReason" in error ? error.compactionReason : "provider-error";
+    const safe = classifySummaryError(error, { model: summaryModel ?? void 0, provider: summaryProvider ?? void 0, attemptId: compactionAttemptId });
+    summaryModel = safe.model ?? summaryModel;
+    summaryProvider = safe.provider ?? summaryProvider;
+    const failureReason = args2.abortSignal?.aborted || safe.category === "cancelled" || error?.compactionReason === "aborted" ? "aborted" : safe.category === "timeout" || error?.compactionReason === "timeout" ? "timeout" : "provider-error";
+    const failureMessage = [safe.message, safe.code, safe.errorType, safe.balanceSource].filter(Boolean).join(" ");
+    if (failureReason !== "aborted") console.warn("[localLoop] auto-compaction failed:", safe);
+    summaryDiagnostics = {
+      ...summaryDiagnostics,
+      ...safe.finishReason === void 0 ? {} : { finishReason: safe.finishReason },
+      ...safe.responseStatus === void 0 ? {} : { responseStatus: safe.responseStatus },
+      ...safe.incompleteReason === void 0 ? {} : { incompleteReason: safe.incompleteReason },
+      ...safe.maxOutputTokens === void 0 ? {} : { maxOutputTokens: safe.maxOutputTokens },
+      ...safe.completionTokens === void 0 ? {} : { completionTokens: safe.completionTokens },
+      ...safe.outputChars === void 0 ? {} : { outputChars: safe.outputChars }
+    };
     logCompactionTiming(failureReason, {});
     const failureNow = args2.now?.() ?? Date.now();
     if (failureReason !== "aborted") recordCompactionFailure(dialogId, failureNow);
-    emitPhase({ kind: "compaction-failed", reason: failureReason });
+    if (failureReason === "aborted") emitPhase({ kind: "compaction-end" });
+    else emitPhase({ kind: "compaction-failed", reason: failureReason });
     return {
       ...projectExisting(),
       failureMessage,
       failureReason,
-      decision: { outcome: "failed", reason: failureReason, detail: failureMessage }
+      failure: safe,
+      decision: {
+        outcome: "failed",
+        reason: failureReason,
+        detail: failureMessage,
+        ...itemDiagnostics,
+        estimatedTokens: plan.diagnostics?.totalUsed,
+        historyBudget: plan.diagnostics?.historyBudget
+      }
     };
   }
 }
@@ -19440,13 +20031,14 @@ function emitCompactionPhaseEvent(boundary, phase, scope3) {
     emitLoopEvent(boundary, { kind: "turn-phase", phase: "compacting", atMs, compactionScope: scope3 });
     emitLoopEvent(boundary, { kind: "compaction-start", atMs, scope: scope3 });
   } else if (phase.kind === "waiting-provider") emitLoopEvent(boundary, { kind: "turn-phase", phase: "waiting-provider", atMs, compactionScope: scope3 });
+  else if (phase.kind === "compaction-retry") emitLoopEvent(boundary, { kind: "compaction-retry", atMs, scope: scope3, attempt: phase.attempt, maxAttempts: phase.maxAttempts });
   else if (phase.kind === "compaction-end") emitLoopEvent(boundary, { kind: "compaction-end", atMs, scope: scope3 });
   else emitLoopEvent(boundary, { kind: "compaction-failed", atMs, scope: scope3, reason: phase.reason });
 }
 function emitCompactionObservationEvent(boundary, compacted) {
   const decision = compacted.decision;
   if (decision?.outcome === "skipped") {
-    const isProtectionGap = decision.skipReason === "bounded-request-blocked" || decision.skipReason === "unsafe-projection" || decision.skipReason === "adapter-missing-summary-methods" || decision.skipReason === "load-summary-failed";
+    const isProtectionGap = decision.skipReason === "bounded-request-blocked" || decision.skipReason === "unsafe-projection" || decision.skipReason === "no-safe-prefix" || decision.skipReason === "adapter-missing-summary-methods" || decision.skipReason === "load-summary-failed";
     const approachingBudget = decision.skipReason === "below-trigger" && typeof decision.estimatedTokens === "number" && typeof decision.historyBudget === "number" && decision.historyBudget > 0 && decision.estimatedTokens >= decision.historyBudget * 0.5;
     if (!isProtectionGap && !approachingBudget) return;
   }
@@ -19454,7 +20046,7 @@ function emitCompactionObservationEvent(boundary, compacted) {
     kind: "compaction",
     atMs: Date.now(),
     ...compacted.reason ? { reason: compacted.reason } : {},
-    ...compacted.withinSafetyBudget === false ? { detail: "Estimated projected history remains above the compaction safety budget" } : {},
+    ...compacted.withinSafetyBudget === false ? { detail: "Projected history remains above the token or input-item safety budget" } : {},
     summaryGenerated: compacted.summaryGenerated,
     compressed: compacted.compressed,
     ...compacted.failureMessage ? { failed: true, detail: compacted.failureMessage } : {},
@@ -19464,6 +20056,12 @@ function emitCompactionObservationEvent(boundary, compacted) {
     ...decision && "historyBudget" in decision && decision.historyBudget !== void 0 ? { historyBudget: decision.historyBudget } : {},
     ...decision && "realUsageRatio" in decision && decision.realUsageRatio !== void 0 ? { realUsageRatio: decision.realUsageRatio } : {},
     ...decision && "triggerRatio" in decision && decision.triggerRatio !== void 0 ? { triggerRatio: decision.triggerRatio } : {},
+    ...decision?.maxInputItems !== void 0 ? {
+      itemCount: decision.itemCount,
+      maxInputItems: decision.maxInputItems,
+      triggeredByItemLimit: decision.triggeredByItemLimit,
+      ...decision.projectedItemCount !== void 0 ? { projectedItemCount: decision.projectedItemCount } : {}
+    } : {},
     ...compacted.beforeTokens !== void 0 ? { beforeTokens: compacted.beforeTokens } : {},
     ...compacted.afterTokens !== void 0 ? { afterTokens: compacted.afterTokens } : {},
     ...compacted.savedTokens !== void 0 ? { savedTokens: compacted.savedTokens } : {}
@@ -19482,7 +20080,7 @@ function createTurnCompactionController(args2) {
     }
   };
   const compactionDialogId = args2.continueDialogId ?? ephemeralDialogId;
-  const runInitial = async (history) => {
+  const runCompaction = async (history, force) => {
     let realContextUsagePercent;
     if (args2.continueDialogId && typeof args2.adapter.loadLastContextUsage === "function") {
       try {
@@ -19505,15 +20103,21 @@ function createTurnCompactionController(args2) {
         adapter: args2.adapter,
         dialogId: args2.continueDialogId,
         history,
+        contextReferenceResolver: args2.contextReferenceResolver,
         model: args2.model,
+        provider: args2.provider,
+        providerEndpoint: args2.providerEndpoint,
         resolveProvider: args2.resolveProvider,
         contextWindow: args2.contextWindow,
         realContextUsagePercent,
+        force,
         abortSignal: args2.abortSignal,
         timeoutMs: args2.timeoutMs,
         summaryFallback: args2.summaryFallback,
+        onAttemptUsage: args2.onUsage,
         onPhase: (phase) => emitPhase(phase, "initial")
       });
+      args2.onSelectedSummary?.(compacted.selectedSummary ?? { outcome: "absent" });
       emitObservation(compacted);
       return { history: compacted.history, usage: compacted.usage };
     } catch (error) {
@@ -19521,11 +20125,25 @@ function createTurnCompactionController(args2) {
       return { history };
     }
   };
-  const maybeCompactInLoop = async () => {
+  const runInitial = async (history) => runCompaction(history, false);
+  const forceCompact = async (history) => {
+    const result4 = await runCompaction(history, true);
+    return { history: result4.history, applied: result4.history !== history, usage: result4.usage };
+  };
+  let lastCompactionOutcome;
+  const prepareRequest = async (requestOverBudget, initial = false, availableHistoryTokens) => {
+    lastCompactionOutcome = void 0;
     const contextUsage = args2.getContextUsage();
-    const inputTokens = contextUsage ? normalizeUsage(contextUsage).input_tokens : 0;
+    let inputTokens = contextUsage ? normalizeUsage(contextUsage).input_tokens : 0;
+    if (initial && args2.continueDialogId && args2.adapter.loadLastContextUsage) {
+      try {
+        inputTokens = (await args2.adapter.loadLastContextUsage(args2.continueDialogId))?.inputTokens ?? 0;
+      } catch (error) {
+        console.warn("[localLoop] loadLastContextUsage failed:", error);
+      }
+    }
     const ratio = inputTokens > 0 ? Math.min(1, inputTokens / args2.contextWindow) : void 0;
-    if (ratio !== void 0 && ratio < args2.compressionTriggerRatio * 0.85) {
+    if (!requestOverBudget && ratio !== void 0 && ratio < args2.compressionTriggerRatio * 0.85 && resolveProviderInputItemLimit({ provider: args2.provider, endpoint: args2.providerEndpoint }) === void 0) {
       return;
     }
     try {
@@ -19538,18 +20156,22 @@ function createTurnCompactionController(args2) {
         // 锚点与 sourceHash 都必须按持久化形态计算——否则下轮从 store
         // 重载后重算 hash 必不匹配，摘要被判无效、白付一次摘要调用。
         history: args2.getCanonicalCompactionHistory(),
+        requestOverBudget,
+        availableHistoryTokens: availableHistoryTokens?.(),
+        contextReferenceResolver: args2.contextReferenceResolver,
         model: args2.model,
+        provider: args2.provider,
+        providerEndpoint: args2.providerEndpoint,
         resolveProvider: args2.resolveProvider,
         contextWindow: args2.contextWindow,
         ...ratio !== void 0 ? { realContextUsagePercent: ratio } : {},
         abortSignal: args2.abortSignal,
         timeoutMs: args2.timeoutMs,
         summaryFallback: args2.summaryFallback,
-        onPhase: (phase) => emitPhase(phase, "in-loop")
+        onAttemptUsage: args2.onUsage,
+        onPhase: (phase) => emitPhase(phase, initial ? "initial" : "in-loop")
       });
-      if (compacted.usage) {
-        args2.onUsage(compacted.usage);
-      }
+      lastCompactionOutcome = { result: compacted };
       if (compacted.compressed) {
         const rebuilt = composeProviderMessages({
           prefix: args2.getWorkingPrefix(),
@@ -19564,16 +20186,65 @@ function createTurnCompactionController(args2) {
         }
         args2.replaceWorkingView(rebuilt.messages);
       }
+      if (compacted.compressed || initial) {
+        args2.onSelectedSummary?.(compacted.selectedSummary ?? { outcome: initial ? "absent" : "unknown" });
+      }
       emitObservation(compacted);
     } catch (error) {
+      lastCompactionOutcome = { ...lastCompactionOutcome, error: classifySummaryError(error) };
       console.warn("[localLoop] in-loop auto-compaction failed:", error);
     }
   };
-  return { runInitial, maybeCompactInLoop };
+  return { getLastCompactionOutcome: () => lastCompactionOutcome, runInitial, maybeCompactInLoop: () => prepareRequest(), forceCompact, prepareRequest };
 }
 
 // packages/agent-runtime/providerCallTelemetry.ts
 import { createHash as createHash4 } from "node:crypto";
+var isCount = (v) => Number.isSafeInteger(v) && v >= 0;
+var isDigest = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
+var isMessageId = (v) => typeof v === "string" && /^(?:[0-9]{13}-[0-9]{3,6}|[0-9A-HJKMNP-TV-Z]{26}|local-[0-9]{1,12})$/.test(v);
+var isRecord2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function projectContextProvenance(value) {
+  if (!isRecord2(value) || value.schemaVersion !== 1) return void 0;
+  const transports = ["unknown", "local-cli", "direct-openai-compatible", "codex-oauth", "codex-responses", "owner-oauth-proxy", "server-proxy"];
+  const result4 = { schemaVersion: 1, transport: transports.includes(value.transport) ? value.transport : "unknown" };
+  if (Array.isArray(value.phases)) {
+    result4.phases = [];
+    for (const item of value.phases.slice(0, 8)) {
+      if (!isRecord2(item) || !["history-loaded", "summary-projected", "budget-trim", "final-request"].includes(item.phase)) continue;
+      const phase = { phase: item.phase };
+      if (["local", "remote", "partial", "none", "unknown"].includes(item.source)) phase.source = item.source;
+      for (const key of ["count", "droppedCount"]) if (isCount(item[key])) phase[key] = item[key];
+      for (const key of ["hash", "idsHash"]) if (isDigest(item[key])) phase[key] = item[key];
+      for (const key of ["firstId", "lastId"]) if (isMessageId(item[key])) phase[key] = item[key];
+      result4.phases.push(phase);
+    }
+  }
+  if (isRecord2(value.summary)) {
+    const input = value.summary;
+    const outcomes = ["absent", "loaded", "generated", "invalid", "skipped", "failed", "unknown"];
+    const summary = { outcome: outcomes.includes(input.outcome) ? input.outcome : "unknown" };
+    for (const key of ["summaryId", "hash", "sourceHash"]) if (isDigest(input[key])) summary[key] = input[key];
+    if (isMessageId(input.anchorId)) summary.anchorId = input.anchorId;
+    if (isCount(input.sourceCount)) summary.sourceCount = input.sourceCount;
+    result4.summary = summary;
+  }
+  return result4;
+}
+function contextPhase(phase, messages, options = {}) {
+  const digest = (value) => createHash4("sha256").update(JSON.stringify(value) ?? "null").digest("hex");
+  const ids = messages.map((m) => isRecord2(m) && isMessageId(m.cliMessageId) ? m.cliMessageId : null);
+  return {
+    phase,
+    count: messages.length,
+    hash: digest(messages),
+    idsHash: digest(ids),
+    ...ids[0] ? { firstId: ids[0] } : {},
+    ...ids.at(-1) ? { lastId: ids.at(-1) } : {},
+    ...options.source ? { source: options.source } : {},
+    ...isCount(options.droppedCount) ? { droppedCount: options.droppedCount } : {}
+  };
+}
 var shortHash = (value) => createHash4("sha1").update(value).digest("hex").slice(0, 12);
 var hashMessage = (message) => {
   let text2;
@@ -19613,6 +20284,7 @@ function createDivergeTracker(max4 = DIVERGE_TRACKER_MAX_DIALOGS) {
 var processDivergeTracker = createDivergeTracker();
 function buildRequestTelemetry(args2) {
   try {
+    const provenance = projectContextProvenance(args2.provenance);
     const hashes = args2.messages.map(hashMessage);
     let toolResultChars = 0;
     let toolResultCount = 0;
@@ -19628,6 +20300,7 @@ function buildRequestTelemetry(args2) {
     const diverge = (args2.tracker ?? processDivergeTracker).observe(args2.dialogKey, hashes);
     return {
       ...args2.toolsHash ? { toolsHash: args2.toolsHash } : {},
+      ...provenance ? { provenance } : {},
       msgCount: args2.messages.length,
       contentChars,
       toolResultChars,
@@ -19647,13 +20320,23 @@ function hashToolDefinitions(tools) {
 }
 
 // packages/agent-runtime/localLoop.ts
+var LocalContextCoverageError = class extends Error {
+  constructor(droppedCount, compactionUsage, diagnostics) {
+    super("Context protection: history cannot fit without losing messages not represented in the sending context. This pending provider request was not sent; canonical history and pending input are retained. Restore summary access/provider availability and retry this same input, or select a larger context window. An invalid summary must be rebuilt before retrying.");
+    this.droppedCount = droppedCount;
+    this.compactionUsage = compactionUsage;
+    this.diagnostics = diagnostics;
+    this.name = "LocalContextCoverageError";
+  }
+  code = "LOCAL_CONTEXT_COVERAGE_REQUIRED";
+};
 var LOCAL_AGENT_CONFIG_MISSING_CODE = "LOCAL_AGENT_CONFIG_MISSING";
 var LLM_REQUEST_TIMEOUT = "LLM_REQUEST_TIMEOUT";
 var DEFAULT_LLM_REQUEST_TIMEOUT_MS = 10 * 60 * 1e3;
 var DEFAULT_COMPACTION_TIMEOUT_MS = 60 * 1e3;
 var DEFAULT_ROUND_BUDGET_WARNING_THRESHOLD = 25;
 function buildRoundBudgetWarningPrompt(threshold) {
-  return `[\u7CFB\u7EDF\u63D0\u793A] \u5F53\u524D\u5355\u6B21\u4EFB\u52A1\u7684\u8FDE\u7EED\u5DE5\u5177\u8C03\u7528\u5DF2\u8FBE ${threshold} \u8F6E\uFF0C\u8BF7\u8FDB\u884C\u8FDB\u5C55\u4E0E\u6210\u672C\u68C0\u67E5\uFF1A\u82E5\u5DF2\u6388\u6743\u76EE\u6807\u672A\u5B8C\u6210\u4E14\u6301\u7EED\u6709\u8FDB\u5C55\uFF0C\u5E94\u7EE7\u7EED\u63A8\u8FDB\uFF0C\u4E0D\u5F97\u4EC5\u56E0\u8F6E\u6570\u4EA4\u63A5\uFF1B\u4EC5\u5728\u76EE\u6807\u5DF2\u5B8C\u6210\u3001\u9047\u5230\u771F\u5B9E\u963B\u585E\u6216\u89E6\u53CA\u786C\u9884\u7B97\u65F6\u624D\u6536\u5C3E\uFF1B\u82E5\u8FDB\u5C55\u505C\u6EDE\uFF0C\u8BF7\u53CA\u65F6\u66F4\u6362\u7B56\u7565\u3002`;
+  return `[\u7CFB\u7EDF\u63D0\u793A] \u5F53\u524D\u5355\u6B21\u4EFB\u52A1\u7684\u8FDE\u7EED\u5DE5\u5177\u8C03\u7528\u5DF2\u8FBE ${threshold} \u8F6E\uFF0C\u8BF7\u8FDB\u884C\u8FDB\u5C55\u4E0E\u6210\u672C\u68C0\u67E5\uFF1A\u82E5\u5DF2\u6388\u6743\u76EE\u6807\u672A\u5B8C\u6210\u4E14\u6301\u7EED\u6709\u8FDB\u5C55\uFF0C\u5E94\u7EE7\u7EED\u63A8\u8FDB\uFF0C\u4E0D\u5F97\u4EC5\u56E0\u8F6E\u6570\u4EA4\u63A5\uFF1B\u4EC5\u5728\u76EE\u6807\u5DF2\u5B8C\u6210\u3001\u9047\u5230\u771F\u5B9E\u963B\u585E\u6216\u7528\u6237\u660E\u786E\u505C\u6B62\u65F6\u624D\u6536\u5C3E\uFF1B\u82E5\u8FDB\u5C55\u505C\u6EDE\uFF0C\u8BF7\u53CA\u65F6\u66F4\u6362\u7B56\u7565\u3002`;
 }
 var ROUND_BUDGET_WARNING_PROMPT = buildRoundBudgetWarningPrompt(
   DEFAULT_ROUND_BUDGET_WARNING_THRESHOLD
@@ -19683,23 +20366,24 @@ var CONCURRENT_READONLY_TOOLS = /* @__PURE__ */ new Set([
 ]);
 function partitionToolCallsIntoBatches(toolCalls) {
   const batches = [];
-  let currentReadBatch = [];
-  for (let i = 0; i < toolCalls.length; i += 1) {
-    const toolCall = toolCalls[i];
-    const isReadOnly = CONCURRENT_READONLY_TOOLS.has(toolCall.function.name);
-    if (isReadOnly) {
-      currentReadBatch.push({ index: i, toolCall });
-    } else {
-      if (currentReadBatch.length > 0) {
-        batches.push({ isConcurrent: true, calls: currentReadBatch });
-        currentReadBatch = [];
-      }
-      batches.push({ isConcurrent: false, calls: [{ index: i, toolCall }] });
+  let currentBatch = [];
+  const flush2 = () => {
+    if (currentBatch.length) batches.push({ isConcurrent: true, calls: currentBatch });
+    currentBatch = [];
+  };
+  for (let index = 0; index < toolCalls.length; index += 1) {
+    const toolCall = toolCalls[index];
+    const contract = resolveToolExecutionContract(toolCall.function.name);
+    const isReadOnly = contract.interaction === "none" && contract.concurrency === "safe";
+    const legacyRead = contract.concurrency === "exclusive" && contract.interaction === "unknown" && CONCURRENT_READONLY_TOOLS.has(toolCall.function.name);
+    if (toolCall.function.name === "startAgentRun" || !isReadOnly && !legacyRead) {
+      flush2();
+      batches.push({ isConcurrent: false, calls: [{ index, toolCall }] });
+      continue;
     }
+    currentBatch.push({ index, toolCall });
   }
-  if (currentReadBatch.length > 0) {
-    batches.push({ isConcurrent: true, calls: currentReadBatch });
-  }
+  flush2();
   return batches;
 }
 function resolveLlmRequestTimeoutMs(input) {
@@ -19708,7 +20392,7 @@ function resolveLlmRequestTimeoutMs(input) {
 }
 function resolveCompactionTimeoutMs(input) {
   const raw = input.compactionTimeoutMs;
-  return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_COMPACTION_TIMEOUT_MS;
+  return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? Math.min(raw, DEFAULT_COMPACTION_TIMEOUT_MS) : DEFAULT_COMPACTION_TIMEOUT_MS;
 }
 function readHostCompactionSummaryFallback(adapter) {
   const value = adapter.compactionSummaryFallback;
@@ -19833,6 +20517,10 @@ function attachUsageRecordsToError(error, usageRecords) {
 }
 async function persistFailedLocalTurn(args2) {
   const errorMessage = toErrorMessage(args2.error);
+  const businessCompletion = evaluateTaskExecutionContract(args2.input.taskExecutionContract, {
+    stopped: args2.input.abortSignal?.aborted || args2.error instanceof Error && args2.error.code === LOCAL_TURN_ABORTED_CODE,
+    executionFailed: true
+  });
   try {
     const saved = await args2.adapter.saveTurn({
       agentKey: args2.agentKey,
@@ -19843,6 +20531,7 @@ async function persistFailedLocalTurn(args2) {
         toolCallCount: args2.toolCallCount ?? 0,
         error: true,
         errorMessage,
+        ...businessCompletion ? { businessCompletion } : {},
         ...args2.usage ? { usage: args2.usage } : {}
       },
       ...args2.accountingUsage ? { accountingUsage: args2.accountingUsage } : {},
@@ -19876,6 +20565,18 @@ async function loadAdapterDialogHistory(adapter, dialogId, options) {
   }
   return { messages: await adapter.loadDialogHistory(dialogId) };
 }
+function combineRollbackError(primary, rollbackError) {
+  const primaryError = primary instanceof Error ? primary : new Error(String(primary));
+  const rollbackErr = rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError));
+  const combined = new AggregateError(
+    [primaryError, rollbackErr],
+    `${primaryError.message} (additionally, injection rollback failed: ${rollbackErr.message})`
+  );
+  if (primary && typeof primary === "object") {
+    Object.assign(combined, primary);
+  }
+  return combined;
+}
 async function runLocalAgentTurn(input) {
   const legacyCallbacks = {
     onLoopEvent: input.onLoopEvent,
@@ -19889,17 +20590,6 @@ async function runLocalAgentTurn(input) {
     observationBoundary.attachCallbacks(legacyCallbacks);
   }
   const loopTiming = createLoopTiming();
-  const subtaskBudgetClock = input.subtaskBudgetNow ?? (() => Date.now());
-  const subtaskBudgetLimits = {
-    maxToolCalls: input.subtaskMaxToolCalls ?? input.subtaskBudgetLimits?.maxToolCalls ?? DEFAULT_SUBTASK_MAX_TOOL_CALLS,
-    maxWallClockMs: input.subtaskMaxWallClockMs ?? input.subtaskBudgetLimits?.maxWallClockMs ?? DEFAULT_SUBTASK_MAX_WALL_CLOCK_MS
-  };
-  const subtaskBudgetTracker = input.runKind === "subtask" ? createSubtaskBudgetTracker({
-    limits: subtaskBudgetLimits,
-    now: subtaskBudgetClock,
-    // 墙钟从 run 开始计（含 provider 初始化与首轮前的准备）。
-    startedAtMs: subtaskBudgetClock()
-  }) : null;
   try {
     loopTiming.mark("turnStart", 0);
     let agentConfig = await input.adapter.loadAgentConfig(input.agentRef);
@@ -19987,7 +20677,8 @@ async function runLocalAgentTurn(input) {
         if (input.strictContinueHistory && (loaded.source === "none" || loaded.source === "partial")) {
           throw new Error(`Strict continuation history unavailable: ${loaded.source}`);
         }
-        history = loaded.messages;
+        const currentIds = new Set(input.userMessages?.map((message) => message.cliMessageId));
+        history = loaded.messages.filter((message) => !currentIds.has(message.cliMessageId));
         dialogHistorySource = loaded.source;
       }
     } catch (error) {
@@ -20073,6 +20764,9 @@ async function runLocalAgentTurn(input) {
       // 平台风控纪律：无条件系统层块，沿用 session 占位约定。
       { content: PLATFORM_RISK_CONTROL_RULE, cacheScope: "session" },
       { content: buildConsultationModeBlock(), cacheScope: "session" },
+      // Git 任务隔离：系统层固定前置，四条装配线同序（请教模式之后、身份信息之前；
+      // skill 配置 disabled 也注入）。
+      { content: WORKTREE_ISOLATION_PRELUDE, cacheScope: "session" },
       { content: identityBlock, cacheScope: "session" },
       ...guidanceScopes,
       // 回复行为准则：local 线（CLI 非交互 / 桌面 / TUI）的唯一注入边界。
@@ -20092,19 +20786,29 @@ async function runLocalAgentTurn(input) {
     let resolvedSummaryProvider;
     const resolveSummaryProviderOnce = async () => {
       if (!resolvedSummaryProvider) {
-        resolvedSummaryProvider = await input.adapter.resolveProvider(agentConfig, {
+        const provider = await input.adapter.resolveProvider(agentConfig, {
+          textOnly: true,
           toolNames: [],
           prompt: ""
         });
+        if (provider.textOnly !== true) {
+          throw new Error("auto-compaction requires an isolated text-only provider");
+        }
+        resolvedSummaryProvider = provider;
       }
       return resolvedSummaryProvider;
     };
     const contextWindow = resolveAgentContextWindow(agentConfig);
     const compressionTriggerRatio = resolveCompressionTriggerRatio(contextWindow);
+    let selectedSummary = { outcome: "unknown" };
+    let summaryProjectedPhase = contextPhase("summary-projected", history);
+    const historyLoadedPhase = contextPhase("history-loaded", history, { source: dialogHistorySource ?? "unknown" });
     const compaction = createTurnCompactionController({
       adapter: input.adapter,
       continueDialogId: input.continueDialogId,
       model: agentConfig.model,
+      provider: agentConfig.provider,
+      providerEndpoint: agentConfig.customProviderUrl,
       resolveProvider: resolveSummaryProviderOnce,
       contextWindow,
       compressionTriggerRatio,
@@ -20125,19 +20829,18 @@ async function runLocalAgentTurn(input) {
         )
       ],
       getWorkingPrefix: () => transcript.working().slice(0, prefixCount),
-      replaceWorkingView: (next) => transcript.replaceWorkingHistory(next),
+      onSelectedSummary: (summary) => {
+        selectedSummary = summary;
+      },
+      replaceWorkingView: (next) => {
+        transcript.replaceWorkingHistory(next);
+        summaryProjectedPhase = contextPhase("summary-projected", next);
+      },
       contextReferenceResolver: input.adapter.host === "cli" ? input.contextReferenceResolver : void 0,
       onUsage: (usage) => usageLedger.addCompaction(usage)
     });
-    const initialCompaction = await compaction.runInitial(history);
-    history = initialCompaction.history;
-    const initialCompactionUsage = initialCompaction.usage;
-    loopTiming.mark("maybeAutoCompactLocalHistory", 0);
-    const trimmedHistory = trimHistoryToContextBudget(history, agentConfig.model, contextWindow);
-    if (trimmedHistory.droppedCount > 0) {
-      history = trimmedHistory.history;
-    }
-    loopTiming.mark("trimHistoryToContextBudget", 0);
+    throwIfAborted(input);
+    let budgetTrimPhase = contextPhase("budget-trim", history, { droppedCount: 0 });
     const builtMessages = buildMessages({
       prompt: agentConfig.prompt,
       contextBlockScopes: mergedContextBlockScopes,
@@ -20169,6 +20872,14 @@ async function runLocalAgentTurn(input) {
       ...msg,
       content: truncateToolOutputForContext(msg.content, contextWindow)
     } : msg;
+    if (input.userMessages?.length) {
+      const currentInputStart = builtMessages.prefixCount + history.length;
+      const sanitizedUsers = await Promise.all(input.userMessages.map(async (message) => ({
+        ...message,
+        content: await sanitizeInbound(message.content)
+      })));
+      messages.splice(currentInputStart, messages.length - currentInputStart, ...sanitizedUsers);
+    }
     const acceptToolImages = createToolImageLedger();
     const transcript = createTurnTranscript({
       initialWorking: messages,
@@ -20178,7 +20889,9 @@ async function runLocalAgentTurn(input) {
     });
     const userInputText = extractUserInputText(input.input);
     let toolCallCount = 0;
+    let requestCalibrationRatio = 1;
     let result4 = { content: "" };
+    let stopReason;
     const usageLedger = createTurnUsageLedger({
       model: agentConfig.model,
       provider: agentConfig.provider,
@@ -20187,77 +20900,126 @@ async function runLocalAgentTurn(input) {
         stablePrefixEstimatedTokens: builtMessages.stablePrefixEstimatedTokens
       } : {}
     });
-    if (initialCompactionUsage) usageLedger.addCompaction(initialCompactionUsage);
     let loopError;
+    let consumedInjectedMessages = false;
     let round = 0;
-    let budgetExhaustion = null;
-    const executedToolNameLog = [];
-    const markBudgetExhausted = () => {
-      if (!subtaskBudgetTracker || budgetExhaustion) return;
-      const exhaustion = subtaskBudgetTracker.exhaustion();
-      if (!exhaustion) return;
-      budgetExhaustion = exhaustion;
-      emitLoopEvent(observationBoundary, {
-        kind: "budget-exhausted",
-        limit: exhaustion.limit,
-        atMs: exhaustion.atMs,
-        maxToolCalls: exhaustion.limits.maxToolCalls,
-        maxWallClockMs: exhaustion.limits.maxWallClockMs,
-        toolCallsExecuted: exhaustion.toolCallsExecuted,
-        elapsedMs: exhaustion.elapsedMs,
-        round
-      });
-    };
     let emptyAssistantRepairPending = false;
     let emptyAssistantRepairUsed = false;
     let reasoningEmptyRepairCount = 0;
     let skipFinalAppend = false;
     let partialContent = "";
     const progressGuard = createLocalLoopProgressGuard(input.progressGuardConfig);
-    const budgetAdmissionGate = () => {
-      if (!subtaskBudgetTracker) return true;
-      if (!subtaskBudgetTracker.isExhausted()) return true;
-      markBudgetExhausted();
-      return false;
+    let pendingInjectionCommits = [];
+    let inFlightTransactions = [];
+    let rollbackInjectionCommits = async () => {
     };
     try {
       const provider = await resolveProviderOnce();
-      const applyPendingInjections = () => {
+      const applyPendingInjections = async () => {
         if (!input.drainInjections) return false;
-        let pending = [];
-        try {
-          pending = input.drainInjections() ?? [];
-        } catch (error) {
-          console.warn("[localLoop] drainInjections failed:", error);
-          return false;
-        }
+        const pending = await input.drainInjections() ?? [];
         let injected = false;
-        for (const text2 of pending) {
-          if (typeof text2 !== "string" || !text2.trim()) continue;
-          const safeText = scrubSecrets(text2).cleaned;
-          transcript.push({ role: "user", content: safeText });
+        for (const entry of pending) {
+          if (typeof entry === "string") {
+            if (!entry.trim()) continue;
+            transcript.push({ role: "user", content: scrubSecrets(entry).cleaned });
+          } else if (entry && typeof entry === "object" && "messages" in entry) {
+            for (const message of entry.messages) {
+              const content = typeof message.content === "string" ? scrubSecrets(message.content).cleaned : Array.isArray(message.content) ? message.content.map((part) => part?.type === "text" && typeof part.text === "string" ? { ...part, text: scrubSecrets(part.text).cleaned } : part) : message.content;
+              transcript.push({
+                role: "user",
+                content,
+                ...message.cliMessageId ? { cliMessageId: message.cliMessageId } : {}
+              });
+            }
+            pendingInjectionCommits.push({ commit: entry.commit, rollback: entry.rollback, messages: entry.messages });
+          } else if (entry && typeof entry === "object" && "content" in entry) {
+            const content = typeof entry.content === "string" ? scrubSecrets(entry.content).cleaned : Array.isArray(entry.content) ? entry.content.map((part) => part?.type === "text" && typeof part.text === "string" ? { ...part, text: scrubSecrets(part.text).cleaned } : part) : entry.content;
+            transcript.push({
+              role: "user",
+              content,
+              ...entry.cliMessageId ? { cliMessageId: entry.cliMessageId } : {}
+            });
+          } else {
+            continue;
+          }
+          consumedInjectedMessages = true;
           injected = true;
         }
         return injected;
       };
+      rollbackInjectionCommits = async (transactions) => {
+        const errors = [];
+        for (const transaction of transactions.slice().reverse()) {
+          try {
+            await transaction.rollback();
+          } catch (rollbackError) {
+            errors.push(rollbackError);
+          }
+          const ids = new Set(
+            transaction.messages.map((message) => message.cliMessageId).filter((id) => Boolean(id))
+          );
+          if (ids.size > 0) {
+            transcript.retract((msg) => {
+              const id = msg.cliMessageId;
+              return typeof id === "string" && ids.has(id);
+            });
+          }
+        }
+        if (errors.length > 0) {
+          throw new Error(
+            `injection rollback failed: ${errors.map((error) => error instanceof Error ? error.message : String(error)).join("; ")}`
+          );
+        }
+      };
       const newDialogTelemetryKey = `new:${crypto.randomUUID()}`;
       let roundBudgetWarningInjected = false;
-      let subtaskToolBudgetWarningInjected = false;
       const roundWarningThreshold = input.roundBudgetWarningThreshold ?? DEFAULT_ROUND_BUDGET_WARNING_THRESHOLD;
       while (true) {
         partialContent = "";
         throwIfAborted(input);
         loopTiming.mark("roundStart", round);
-        applyPendingInjections();
+        await applyPendingInjections();
         if (roundWarningThreshold > 0 && round >= roundWarningThreshold && !roundBudgetWarningInjected) {
           const prompt = buildRoundBudgetWarningPrompt(roundWarningThreshold);
           transcript.push({ role: "user", content: prompt });
           roundBudgetWarningInjected = true;
         }
-        if (subtaskBudgetTracker && !subtaskToolBudgetWarningInjected && subtaskBudgetTracker.toolCallsExecuted > 0 && subtaskBudgetTracker.remainingToolCalls() > 0 && subtaskBudgetTracker.remainingToolCalls() <= Math.max(1, Math.ceil(subtaskBudgetTracker.limits.maxToolCalls * 0.1))) {
-          transcript.push({ role: "user", content: `\u5B50\u4EFB\u52A1\u5DE5\u5177\u9884\u7B97\u5373\u5C06\u7528\u5C3D\uFF08\u5269\u4F59 ${subtaskBudgetTracker.remainingToolCalls()} \u6B21\uFF09\u3002\u8BF7\u4F18\u5148\u6536\u5C3E\u5E76\u7ED9\u51FA\u53EF\u8BFB\u7684\u9636\u6BB5\u7ED3\u679C\u3002` });
-          subtaskToolBudgetWarningInjected = true;
-        }
+        const projectRequest = (source) => {
+          const prepared = prepareMessagesForProviderCall(source);
+          const base = filterImagePartsFromMessages(prepared.messages, supportsImages);
+          return emptyAssistantRepairPending ? [...base, { role: "user", content: EMPTY_ASSISTANT_REPAIR_PROMPT }] : base;
+        };
+        const admissionProvider = await resolveProviderOnce();
+        throwIfAborted(input);
+        const requestOverBudget = (messages2) => !evaluateLocalRequestBudget({
+          messages: messages2,
+          contextWindow,
+          descriptor: admissionProvider.requestBudget,
+          calibrationRatio: requestCalibrationRatio
+        }).fitsEstimate;
+        const availableHistoryTokens = () => {
+          const decision = evaluateLocalRequestBudget({
+            messages: [],
+            contextWindow,
+            descriptor: admissionProvider.requestBudget,
+            calibrationRatio: requestCalibrationRatio
+          });
+          const prefixTokens = estimateLocalRequestInput(projectRequest(transcript.working().slice(0, prefixCount)));
+          return Math.max(0, Math.floor(decision.availableInputTokens / requestCalibrationRatio) - prefixTokens - (admissionProvider.requestBudget?.toolSchemaTokens ?? 0));
+        };
+        const historyTokensBeforeCompaction = Math.ceil(estimateLocalRequestInput(
+          projectRequest(transcript.working()).slice(prefixCount)
+        ) * requestCalibrationRatio);
+        await compaction.prepareRequest((source) => {
+          const projected = composeProviderMessages({
+            prefix: transcript.working().slice(0, prefixCount),
+            history: source,
+            contextReferenceResolver: input.adapter.host === "cli" ? input.contextReferenceResolver : void 0
+          });
+          return requestOverBudget(projectRequest(projected.messages));
+        }, round === 0, availableHistoryTokens);
+        throwIfAborted(input);
         const preparedMessages = prepareMessagesForProviderCall(transcript.working());
         if (!supportsImages && hasImageInRuntimeMessages(preparedMessages.messages) && !imageDowngradeEmitted) {
           emitLoopEvent(observationBoundary, {
@@ -20267,11 +21029,27 @@ async function runLocalAgentTurn(input) {
           });
           imageDowngradeEmitted = true;
         }
-        const baseRequestMessages = filterImagePartsFromMessages(
-          preparedMessages.messages,
-          supportsImages
-        );
-        const requestMessages = emptyAssistantRepairPending ? [...baseRequestMessages, { role: "user", content: EMPTY_ASSISTANT_REPAIR_PROMPT }] : baseRequestMessages;
+        const requestMessages = projectRequest(transcript.working());
+        if (requestOverBudget(requestMessages)) {
+          const budget = evaluateLocalRequestBudget({
+            messages: requestMessages,
+            contextWindow,
+            descriptor: admissionProvider.requestBudget,
+            calibrationRatio: requestCalibrationRatio
+          });
+          const largestMessageTokens = requestMessages.reduce((largest, message) => Math.max(
+            largest,
+            Math.ceil(estimateLocalRequestInput([message]) * requestCalibrationRatio)
+          ), 0);
+          throw new LocalContextCoverageError(0, void 0, classifyContextRefusal({
+            outcome: compaction.getLastCompactionOutcome(),
+            historyTokens: historyTokensBeforeCompaction,
+            budget: budget.availableInputTokens,
+            droppedCount: 0,
+            largestMessageTokens
+          }));
+        }
+        budgetTrimPhase = contextPhase("budget-trim", requestMessages, { droppedCount: 0 });
         const contextMetrics = {
           ...preparedMessages.metrics,
           messageCount: requestMessages.length,
@@ -20299,63 +21077,109 @@ async function runLocalAgentTurn(input) {
           // 无 dialogId 的新对话用本 turn 唯一键，避免不同新对话共用一个槽误报漂移。
           dialogKey: input.continueDialogId || newDialogTelemetryKey,
           messages: requestMessages,
+          provenance: {
+            schemaVersion: 1,
+            transport: provider.transport ?? "unknown",
+            phases: [historyLoadedPhase, summaryProjectedPhase, budgetTrimPhase, contextPhase("final-request", requestMessages)],
+            summary: selectedSummary
+          },
           toolsHash: safeToolNamesHash(agentTools)
         });
-        if (!budgetAdmissionGate()) {
-          break;
-        }
         resetToolImageDelivery(requestMessages.flatMap(toolImages));
-        result4 = await runCompleteWithTimeout({
-          provider,
-          messages: requestMessages,
-          options: {
+        if (pendingInjectionCommits.length > 0) {
+          inFlightTransactions = pendingInjectionCommits.splice(0);
+          try {
+            for (const transaction of inFlightTransactions) await transaction.commit();
+            if (input.abortSignal?.aborted) throw buildAbortedError();
+          } catch (error) {
+            const toRollback = inFlightTransactions;
+            inFlightTransactions = [];
+            try {
+              await rollbackInjectionCommits(toRollback);
+            } catch (rbErr) {
+              throw combineRollbackError(error, rbErr);
+            }
+            throw error;
+          }
+        }
+        let providerInvoked = false;
+        try {
+          result4 = await runCompleteWithTimeout({
+            provider: { complete: (messages2, options) => {
+              providerInvoked = true;
+              inFlightTransactions = [];
+              return provider.complete(messages2, options);
+            } },
+            messages: requestMessages,
+            options: {
+              timeoutMs: resolveLlmRequestTimeoutMs(input),
+              // 用户取消信号穿进 provider options：providerStreamRetry 据此在
+              // 取消后跳过重试，provider 分支（如 antigravity/openai-compatible）
+              // 也可把 fetch 绑定到同一信号，实现真正的传输层取消。
+              ...input.abortSignal ? { signal: input.abortSignal } : {},
+              // 计费归因：续聊轮次带上 dialogId，platform proxy 才能把 token 记录
+              // 归到具体对话而不是 chat-proxy 兜底桶。新对话首轮 id 尚未分配。
+              ...input.continueDialogId ? { dialogId: input.continueDialogId } : {},
+              ...shouldStreamDeltas ? { onTextDelta: (chunk) => {
+                llmStreamActivity += 1;
+                partialContent += chunk;
+                observationBoundary.emit({
+                  kind: "text-delta",
+                  chunk,
+                  round,
+                  atMs: Date.now()
+                });
+              } } : {},
+              ...shouldStreamReasoning ? { onReasoningDelta: (chunk) => {
+                llmStreamActivity += 1;
+                observationBoundary.emit({
+                  kind: "reasoning-delta",
+                  chunk,
+                  round,
+                  atMs: Date.now()
+                });
+              } } : {},
+              ...shouldPassToolEvents ? { onToolEvent: (event) => {
+                llmStreamActivity += 1;
+                observationBoundary.emit({
+                  kind: "tool-event",
+                  event,
+                  round,
+                  atMs: Date.now()
+                });
+              } } : {},
+              ...shouldPassToolEvents ? { toolEventRound: round } : {}
+            },
             timeoutMs: resolveLlmRequestTimeoutMs(input),
-            // 用户取消信号穿进 provider options：providerStreamRetry 据此在
-            // 取消后跳过重试，provider 分支（如 antigravity/openai-compatible）
-            // 也可把 fetch 绑定到同一信号，实现真正的传输层取消。
-            ...input.abortSignal ? { signal: input.abortSignal } : {},
-            // 计费归因：续聊轮次带上 dialogId，platform proxy 才能把 token 记录
-            // 归到具体对话而不是 chat-proxy 兜底桶。新对话首轮 id 尚未分配。
-            ...input.continueDialogId ? { dialogId: input.continueDialogId } : {},
-            ...shouldStreamDeltas ? { onTextDelta: (chunk) => {
-              llmStreamActivity += 1;
-              partialContent += chunk;
-              observationBoundary.emit({
-                kind: "text-delta",
-                chunk,
-                round,
-                atMs: Date.now()
-              });
-            } } : {},
-            ...shouldStreamReasoning ? { onReasoningDelta: (chunk) => {
-              llmStreamActivity += 1;
-              observationBoundary.emit({
-                kind: "reasoning-delta",
-                chunk,
-                round,
-                atMs: Date.now()
-              });
-            } } : {},
-            ...shouldPassToolEvents ? { onToolEvent: (event) => {
-              llmStreamActivity += 1;
-              observationBoundary.emit({
-                kind: "tool-event",
-                event,
-                round,
-                atMs: Date.now()
-              });
-            } } : {},
-            ...shouldPassToolEvents ? { toolEventRound: round } : {}
-          },
-          timeoutMs: resolveLlmRequestTimeoutMs(input),
-          activityVersion: () => llmStreamActivity,
-          round,
-          input,
-          boundary: observationBoundary,
-          context: contextMetrics,
-          providerName: agentConfig.provider,
-          model: provider.model
-        });
+            activityVersion: () => llmStreamActivity,
+            round,
+            input,
+            boundary: observationBoundary,
+            context: contextMetrics,
+            providerName: agentConfig.provider,
+            model: provider.model
+          });
+        } catch (error) {
+          if (!providerInvoked && inFlightTransactions.length > 0) {
+            const toRollback = inFlightTransactions;
+            inFlightTransactions = [];
+            try {
+              await rollbackInjectionCommits(toRollback);
+            } catch (rbErr) {
+              error = combineRollbackError(error, rbErr);
+            }
+          }
+          if (providerInvoked) usageLedger.recordProviderCall({
+            model: agentConfig.model,
+            telemetry: {
+              ...requestTelemetry,
+              round,
+              endTs: Date.now(),
+              requestState: input.abortSignal?.aborted ? "cancelled" : "failed"
+            }
+          });
+          throw error;
+        }
         acceptToolImages.discard(requestMessages.flatMap(toolImages).filter((image) => toolImageDelivery(image) === "impossible"));
         acceptToolImages.commit(
           requestMessages.flatMap(toolImages).filter((image) => toolImageDelivery(image) === "delivered"),
@@ -20365,13 +21189,25 @@ async function runLocalAgentTurn(input) {
           const pending = toolImages(message).filter((image) => supportsImages && !toolImageDelivery(image));
           return pending.length ? { ...message, [TOOL_IMAGES]: pending } : stripToolImages(message);
         }));
+        const actualInput = normalizeUsage(result4.usage).input_tokens;
+        const estimatedInput = estimateLocalRequestInput(
+          requestMessages,
+          admissionProvider.requestBudget?.toolSchemaTokens ?? 0
+        );
+        requestCalibrationRatio = updateLocalRequestCalibration(requestCalibrationRatio, actualInput, estimatedInput);
         loopTiming.mark("llmCall", round);
         usageLedger.recordProviderCall({
           usage: result4.usage,
           model: result4.model,
           provider: result4.provider,
-          telemetry: finalizeCallTelemetry(requestTelemetry, result4, round, callStartedAt)
+          telemetry: { ...finalizeCallTelemetry(requestTelemetry, result4, round, callStartedAt), requestState: "completed" }
         });
+        if (!result4.content && result4.output?.some((block) => block.type === "text") && !result4.output.some((block) => block.type === "toolCall")) {
+          result4 = {
+            ...result4,
+            content: result4.output.filter((block) => block.type === "text").map((block) => block.text).join("")
+          };
+        }
         const assistantGuardVerdict = progressGuard.observeAssistantResponse(result4);
         if (assistantGuardVerdict.action === "stall") {
           emitLoopEvent(observationBoundary, {
@@ -20389,11 +21225,11 @@ async function runLocalAgentTurn(input) {
           };
           break;
         }
-        if (result4.runtimeProviderFailure) {
+        if (result4.error || result4.runtimeProviderFailure) {
           result4 = {
             ...result4,
             error: true,
-            errorMessage: result4.runtimeProviderFailure.message
+            errorMessage: result4.runtimeProviderFailure?.message ?? result4.errorMessage
           };
           break;
         }
@@ -20456,13 +21292,14 @@ ${reasoningTailLog}
               ...result4.reasoning_content ? { reasoning_content: result4.reasoning_content } : {}
             };
             transcript.push(assistantMessage);
-            if (applyPendingInjections()) {
+            if (await applyPendingInjections()) {
               loopTiming.mark("roundEnd", round);
               round += 1;
               continue;
             }
             transcript.popLast();
           }
+          stopReason = "done";
           break;
         }
         const outputBlocks = result4.output ?? [];
@@ -20481,9 +21318,11 @@ ${reasoningTailLog}
             }
           }
           if (hasInlineExecutedTools) {
-            for (const blockMsg of blocksToOpenAiMessages(outputBlocks)) {
+            for (const blockMsg of blocksToOpenAiMessages(outputBlocks, input.adapter.workspaceRoot)) {
               transcript.pushTool(blockMsg);
             }
+            const inlineResults = outputBlocks.flatMap((block) => block.type === "toolCall" && block.result ? [block.result] : []);
+            stopReason = inlineResults.some(isToolExecutionFailure) ? "error" : inlineResults.some(({ metadata }) => metadata?.uiAskChoice === true && metadata.resolved !== true) ? "pending" : "done";
             skipFinalAppend = true;
             break;
           }
@@ -20500,15 +21339,10 @@ ${reasoningTailLog}
         const executedToolResults = [];
         loopTiming.mark("toolLoopStart", round);
         const slotResults = new Array(toolCalls.length);
-        const runSingleTool = async ({ index, toolCall }) => {
-          throwIfAborted(input);
-          if (!budgetAdmissionGate()) {
-            skippedToolCalls.push(toolCall);
-            return;
-          }
-          subtaskBudgetTracker?.recordToolCallExecuted();
+        const runSingleTool = async ({ index, toolCall }, executionInput = input, isClosed = () => false) => {
+          throwIfAborted(executionInput);
           const { toolResult, toolExecMs } = await executeToolCall({
-            input,
+            input: executionInput,
             toolCall,
             round,
             boundary: observationBoundary,
@@ -20521,12 +21355,12 @@ ${reasoningTailLog}
               ...result4.finish_reason ? { finishReason: result4.finish_reason } : {}
             }
           });
+          if (isClosed()) return;
           slotResults[index] = {
             toolName: toolCall.function.name,
             toolResult,
             toolExecMs
           };
-          executedToolNameLog.push(toolCall.function.name);
         };
         const commitSlot = (i) => {
           const toolCall = toolCalls[i];
@@ -20545,7 +21379,8 @@ ${reasoningTailLog}
             content: formatToolMessageContent({
               toolName,
               content: toolResult.content,
-              metadata: observedMetadata
+              metadata: observedMetadata,
+              workspaceRoot: input.adapter.workspaceRoot
             }),
             tool_call_id: toolCall.id,
             toolName,
@@ -20557,14 +21392,36 @@ ${reasoningTailLog}
             } } : {}
           });
         };
-        const skippedToolCalls = [];
         const batches = partitionToolCallsIntoBatches(toolCalls);
         for (const batch of batches) {
           throwIfAborted(input);
           let batchError;
           try {
             if (batch.isConcurrent && batch.calls.length > 1) {
-              await Promise.all(batch.calls.map(runSingleTool));
+              const controller = new AbortController();
+              const batchInput = {
+                ...input,
+                abortSignal: input.abortSignal ? AbortSignal.any([input.abortSignal, controller.signal]) : controller.signal
+              };
+              let closed = false;
+              let failed = false;
+              let firstError;
+              const tasks = batch.calls.map((call) => runAbortableToolTask(
+                batchInput,
+                runSingleTool(call, batchInput, () => closed),
+                call.toolCall.function.name
+              ).catch((error) => {
+                if (!failed) {
+                  failed = true;
+                  firstError = error;
+                  closed = true;
+                  controller.abort();
+                }
+                throw error;
+              }));
+              await Promise.allSettled(tasks);
+              closed = true;
+              if (failed) throw firstError;
             } else {
               for (const call of batch.calls) {
                 await runSingleTool(call);
@@ -20581,15 +21438,20 @@ ${reasoningTailLog}
           }
           if (batchError) throw batchError;
         }
-        for (const skipped of skippedToolCalls) {
-          transcript.pushTool({
-            role: "tool",
-            content: "[\u5B50\u4EFB\u52A1\u9884\u7B97\u4E0A\u9650\u5DF2\u89E6\u53D1] \u8BE5\u5DE5\u5177\u8C03\u7528\u672A\u6267\u884C\uFF1A\u5DF2\u8FBE\u5B50\u4EFB\u52A1\u9884\u7B97\u4E0A\u9650\uFF0C\u672C\u8F6E\u4E0D\u518D\u53D1\u8D77\u65B0\u7684\u5DE5\u5177\u8C03\u7528\u3002",
-            tool_call_id: skipped.id,
-            toolName: skipped.function.name
-          });
+        const handoff = executedToolResults.map(({ content }) => {
+          try {
+            return typeof content === "string" ? JSON.parse(content) : null;
+          } catch {
+            return null;
+          }
+        }).find((value) => value?.handoff && typeof value.content === "string" && value.content.trim());
+        if (handoff) {
+          result4 = { ...result4, content: handoff.content };
+          stopReason = "handoff";
+          break;
         }
-        if (budgetExhaustion) {
+        if (executedToolResults.some(({ metadata }) => metadata?.uiAskChoice === true && metadata.resolved !== true)) {
+          stopReason = "pending";
           break;
         }
         const toolExecutionGuardVerdict = progressGuard.observeToolExecution(
@@ -20612,117 +21474,28 @@ ${reasoningTailLog}
           };
           break;
         }
-        await compaction.maybeCompactInLoop();
-        if (!budgetAdmissionGate()) {
-          break;
-        }
         loopTiming.mark("roundEnd", round);
         round += 1;
       }
     } catch (error) {
-      loopError = error;
-    }
-    const finalBudgetExhaustion = budgetExhaustion;
-    let budgetWrapupFailure;
-    let budgetWrapupSucceeded = false;
-    if (!loopError && finalBudgetExhaustion && subtaskBudgetTracker && finalBudgetExhaustion.limit === "max-tool-calls" && !input.abortSignal?.aborted && subtaskBudgetTracker.elapsedMs() < subtaskBudgetTracker.limits.maxWallClockMs) {
-      const remainingMs = subtaskBudgetTracker.limits.maxWallClockMs - subtaskBudgetTracker.elapsedMs();
-      const timeoutMs = Math.min(3e4, remainingMs);
-      const controller = new AbortController();
-      let rejectCancelled = () => {
-      };
-      const cancelled = new Promise((_, reject) => {
-        rejectCancelled = reject;
-      });
-      const onAbort = () => {
-        controller.abort();
-        rejectCancelled(buildAbortedError());
-      };
-      input.abortSignal?.addEventListener("abort", onAbort, { once: true });
-      if (input.abortSignal?.aborted) onAbort();
-      let timer;
-      let wrapRequestStarted = false;
-      let wrapUsageCaptured = false;
-      let wrapOutcomeReceived = false;
+      const toRollback = [...pendingInjectionCommits.splice(0), ...inFlightTransactions];
+      inFlightTransactions = [];
+      let rollbackErr;
       try {
-        const deadline = new Promise((_, reject) => {
-          timer = setTimeout(() => {
-            controller.abort();
-            reject(new Error("budget wrap-up timed out"));
-          }, timeoutMs);
-        });
-        const work = async () => {
-          const wrapProvider = await input.adapter.resolveProvider(agentConfig, { toolNames: [], prompt: "", textOnly: true });
-          if (!wrapProvider.textOnly) throw new Error(`host ${input.adapter.host} does not support isolated text-only provider`);
-          if (controller.signal.aborted || input.abortSignal?.aborted || subtaskBudgetTracker.elapsedMs() >= subtaskBudgetTracker.limits.maxWallClockMs) throw new Error("budget wrap-up cancelled or deadline reached");
-          const wrapMessages = [
-            ...filterImagePartsFromMessages(prepareMessagesForProviderCall(transcript.working()).messages, supportsImages),
-            { role: "user", content: "\u5DE5\u5177\u9884\u7B97\u5DF2\u8017\u5C3D\u3002\u4E0D\u8981\u8C03\u7528\u5DE5\u5177\uFF1B\u4EC5\u57FA\u4E8E\u5DF2\u5B8C\u6210\u5185\u5BB9\uFF0C\u7B80\u8FF0\u7ED3\u679C\u3001\u8BC1\u636E\u4E0E\u672A\u5B8C\u6210\u4E8B\u9879\u3002" }
-          ];
-          const startedAt = Date.now();
-          const telemetry2 = buildRequestTelemetry({ dialogKey: input.continueDialogId || `budget:${crypto.randomUUID()}`, messages: wrapMessages, toolsHash: safeToolNamesHash([]) });
-          wrapRequestStarted = true;
-          const summary2 = await runCompleteWithTimeout({
-            provider: wrapProvider,
-            messages: wrapMessages,
-            options: { max_tokens: 1024, noRetries: true, timeoutMs, signal: controller.signal, ...input.continueDialogId ? { dialogId: input.continueDialogId } : {} },
-            timeoutMs,
-            round,
-            input,
-            boundary: observationBoundary,
-            providerName: agentConfig.provider,
-            model: wrapProvider.model
-          });
-          return { summary: summary2, telemetry: finalizeCallTelemetry(telemetry2, summary2, round, startedAt) };
-        };
-        const { summary, telemetry } = await Promise.race([work(), deadline, cancelled]);
-        wrapOutcomeReceived = true;
-        usageLedger.recordProviderCall({ usage: summary.usage, model: summary.model, provider: summary.provider, telemetry });
-        wrapUsageCaptured = Boolean(summary.usage);
-        if (summary.tool_calls?.length || summary.output?.some((block) => block.type === "toolCall")) throw new Error("text-only provider returned a tool call");
-        if (summary.error || typeof summary.content !== "string" || !summary.content.trim()) throw new Error("text-only provider returned no usable summary");
-        if (input.abortSignal?.aborted) throw buildAbortedError();
-        result4 = { ...result4, content: summary.content.trim().slice(0, 12e3) };
-        budgetWrapupSucceeded = true;
-      } catch (error) {
-        if (input.abortSignal?.aborted) {
-          const aborted = buildAbortedError();
-          if (wrapRequestStarted && !wrapUsageCaptured) {
-            aborted.message += "\uFF08\u65E0\u5DE5\u5177\u603B\u7ED3\u8BF7\u6C42\u53EF\u80FD\u5DF2\u8BA1\u8D39\uFF0C\u672A\u8FD4\u56DE\u7684\u7528\u91CF\u672A\u77E5\uFF09";
-            aborted.usageUnavailable = true;
-          }
-          loopError = aborted;
-        } else {
-          const detail = error instanceof Error ? error.message : "unknown error";
-          budgetWrapupFailure = scrubSecrets(detail).cleaned.slice(0, 300);
-          if (wrapRequestStarted && !wrapOutcomeReceived) budgetWrapupFailure += "\uFF1B\u8BF7\u6C42\u53EF\u80FD\u5DF2\u8BA1\u8D39\uFF0C\u672A\u8FD4\u56DE\u7684\u7528\u91CF\u672A\u77E5";
-        }
-      } finally {
-        if (timer) clearTimeout(timer);
-        controller.abort();
-        input.abortSignal?.removeEventListener("abort", onAbort);
+        await rollbackInjectionCommits(toRollback);
+      } catch (rbErr) {
+        rollbackErr = rbErr;
       }
+      loopError = rollbackErr ? combineRollbackError(error, rollbackErr) : error;
     }
     if (!loopError && input.abortSignal?.aborted) loopError = buildAbortedError();
-    if (budgetExhaustion) {
-      if (!budgetWrapupSucceeded && !budgetWrapupFailure) {
-        budgetWrapupFailure = input.abortSignal?.aborted ? "\u7528\u6237\u5DF2\u53D6\u6D88" : "\u5899\u949F\u9884\u7B97\u5DF2\u8017\u5C3D\uFF0C\u672A\u53D1\u8D77\u603B\u7ED3\u8BF7\u6C42";
-      }
-      const previousContent = typeof result4?.content === "string" ? result4.content.trim() : "";
-      result4 = {
-        ...result4,
-        content: [
-          previousContent,
-          ...budgetWrapupFailure ? [`\u65E0\u5DE5\u5177\u603B\u7ED3\u672A\u5B8C\u6210\uFF08${budgetWrapupFailure}\uFF09\uFF1B\u4EE5\u4E0B\u662F\u4FDD\u7559\u7684\u5DF2\u6709\u5185\u5BB9\u548C\u9884\u7B97\u72B6\u6001\u3002`] : [],
-          buildSubtaskBudgetExhaustedContent({
-            exhaustion: budgetExhaustion,
-            roundsCompleted: round,
-            recentToolNames: executedToolNameLog
-          })
-        ].filter((part) => part.length > 0).join("\n\n")
-      };
-    }
     if (loopError) {
+      if (loopError instanceof LocalContextCoverageError && round === 0 && !consumedInjectedMessages) {
+        if (input.continueDialogId) attachDialogIdToError(loopError, input.continueDialogId);
+        attachUsageRecordsToError(loopError, usageLedger.records());
+        await loopTiming.flush();
+        throw loopError;
+      }
       const turnMessages2 = transcript.persisted(
         sanitizedPersistedInput,
         input.persistedInputReference
@@ -20748,6 +21521,16 @@ ${reasoningTailLog}
       throw loopError;
     }
     result4 = result4;
+    result4 = {
+      ...result4,
+      stopReason: input.abortSignal?.aborted ? "aborted" : result4.error || result4.runtimeProviderFailure || result4.emptyAssistantFallbackReason ? "error" : stopReason
+    };
+    delete result4.businessCompletion;
+    const businessCompletion = evaluateTaskExecutionContract(input.taskExecutionContract, {
+      stopped: input.abortSignal?.aborted,
+      executionFailed: result4.error === true || !!result4.runtimeProviderFailure || !!result4.emptyAssistantFallbackReason
+    });
+    if (businessCompletion) result4.businessCompletion = businessCompletion;
     if (!skipFinalAppend) {
       const truncatedReasoningTailLog = resolveTruncatedReasoningTailLog(
         result4.emptyAssistantFallbackReason,
@@ -20834,6 +21617,231 @@ function buildResponsesRequestBody(body, model, options) {
   };
 }
 
+// packages/agent-runtime/responsesProtocolLeakSanitizer.ts
+var LEAKED_PROTOCOL_NOTICE = "\n\n[\u63D0\u793A\uFF1A\u5DF2\u62E6\u622A\u6A21\u578B\u751F\u6210\u7684\u672A\u6267\u884C\u5DE5\u5177\u534F\u8BAE\u7247\u6BB5]";
+var INLINE_MARKER_REGEXES = [
+  /\u3011\u3010\u3002\s*assistant\s+to\s*=\s*functions\./i,
+  /\u3011\u3010\u3002\s*functions\./i,
+  /<\|(?:im_start|start_header_id)\|>\s*assistant\s+to\s*=\s*functions\./i,
+  /<\|(?:im_start|start_header_id)\|>\s*functions\./i
+];
+var INLINE_MARKER_PREFIXES = [
+  "\u3011\u3010\u3002assistant to=functions.",
+  "\u3011\u3010\u3002functions.",
+  "<|im_start|>assistant to=functions.",
+  "<|im_start|>functions.",
+  "<|start_header_id|>assistant to=functions.",
+  "<|start_header_id|>functions."
+];
+var TAB_D_PREFIX = "	Dfunctions.".toLowerCase();
+function findLeakedMarker(text2, wasAtLineStart) {
+  let earliestIndex = -1;
+  let earliestLength = 0;
+  for (const regex of INLINE_MARKER_REGEXES) {
+    const match7 = regex.exec(text2);
+    if (match7 && match7.index !== void 0) {
+      if (earliestIndex === -1 || match7.index < earliestIndex) {
+        earliestIndex = match7.index;
+        earliestLength = match7[0].length;
+      }
+    }
+  }
+  const lineMarkerRegex = /(?:^|[\r\n])[ \t]*\tDfunctions\./gi;
+  let m;
+  while ((m = lineMarkerRegex.exec(text2)) !== null) {
+    const isNewline = m[0].startsWith("\n") || m[0].startsWith("\r");
+    const actualIndex = m.index + (isNewline ? 1 : 0);
+    if (actualIndex === 0 && !wasAtLineStart) {
+      continue;
+    }
+    if (earliestIndex === -1 || actualIndex < earliestIndex) {
+      earliestIndex = actualIndex;
+      earliestLength = m[0].length - (isNewline ? 1 : 0);
+    }
+    break;
+  }
+  return earliestIndex >= 0 ? { index: earliestIndex, length: earliestLength } : null;
+}
+function calculateHoldLength(buffer3, wasAtLineStart) {
+  let hold = 0;
+  const lower = buffer3.toLowerCase();
+  for (const prefix of INLINE_MARKER_PREFIXES) {
+    const pLower = prefix.toLowerCase();
+    const limit = Math.min(lower.length, pLower.length);
+    for (let len = limit; len > 0; len--) {
+      if (pLower.startsWith(lower.slice(-len))) {
+        if (len > hold) hold = len;
+        break;
+      }
+    }
+  }
+  const trailingLineMatch = /(?:^|[\r\n])[ \t]*$/.exec(buffer3);
+  if (trailingLineMatch) {
+    const isNewline = trailingLineMatch[0].startsWith("\n") || trailingLineMatch[0].startsWith("\r");
+    const len = trailingLineMatch[0].length - (isNewline ? 1 : 0);
+    if (len > 0 && (isNewline || wasAtLineStart)) {
+      if (len > hold) hold = len;
+    }
+  }
+  const trailingTabMatch = /(?:^|[\r\n])[ \t]*(\t[a-zA-Z0-9_\.]*)$/i.exec(lower);
+  if (trailingTabMatch) {
+    const candidate = trailingTabMatch[1];
+    if (TAB_D_PREFIX.startsWith(candidate)) {
+      const isNewline = trailingTabMatch[0].startsWith("\n") || trailingTabMatch[0].startsWith("\r");
+      const len = trailingTabMatch[0].length - (isNewline ? 1 : 0);
+      if (isNewline || wasAtLineStart) {
+        if (len > hold) hold = len;
+      }
+    }
+  }
+  const trailingFenceMatch = /(?:^|[\r\n])[ ]{0,3}(?:`{1,2}|~{1,2})$/.exec(buffer3);
+  if (trailingFenceMatch) {
+    const isNewline = trailingFenceMatch[0].startsWith("\n") || trailingFenceMatch[0].startsWith("\r");
+    const len = trailingFenceMatch[0].length - (isNewline ? 1 : 0);
+    if (isNewline || wasAtLineStart) {
+      if (len > hold) hold = len;
+    }
+  }
+  return hold;
+}
+function createResponsesProtocolLeakSanitizer(onTextDelta) {
+  let safeContent = "";
+  let buffer3 = "";
+  let inCodeFence = false;
+  let fenceChar = "";
+  let fenceLength = 0;
+  let intercepted = false;
+  let wasAtLineStart = true;
+  const emit = (text2) => {
+    safeContent += text2;
+    onTextDelta?.(text2);
+    if (text2.length > 0) {
+      const last = text2[text2.length - 1];
+      wasAtLineStart = last === "\n" || last === "\r";
+    }
+  };
+  const processBuffer = (isFinal) => {
+    if (intercepted) return;
+    while (buffer3.length > 0) {
+      if (!inCodeFence) {
+        let fenceIndex = -1;
+        let fenceMarkerStr = "";
+        let lineStartOffset = 0;
+        const fenceRegex = /(?:^|[\r\n])[ ]{0,3}(`{3,}|~{3,})[^\r\n]*(?:\r?\n|$)/g;
+        let m;
+        while ((m = fenceRegex.exec(buffer3)) !== null) {
+          const isNewlinePreceded = m[0].startsWith("\n") || m[0].startsWith("\r");
+          const actualStart = m.index + (isNewlinePreceded ? 1 : 0);
+          if (actualStart === 0 && !wasAtLineStart) {
+            continue;
+          }
+          fenceIndex = actualStart;
+          fenceMarkerStr = m[1];
+          lineStartOffset = m[0].length - (isNewlinePreceded ? 1 : 0);
+          break;
+        }
+        const markerMatch = findLeakedMarker(buffer3, wasAtLineStart);
+        const markerIndex = markerMatch ? markerMatch.index : -1;
+        if (markerIndex >= 0 && (fenceIndex === -1 || markerIndex < fenceIndex)) {
+          const normalPart = buffer3.slice(0, markerIndex);
+          emit(normalPart);
+          emit(LEAKED_PROTOCOL_NOTICE);
+          intercepted = true;
+          buffer3 = "";
+          return;
+        }
+        if (fenceIndex >= 0) {
+          if (!isFinal && !buffer3.slice(fenceIndex).includes("\n") && !buffer3.slice(fenceIndex).includes("\r")) {
+            const beforeFence2 = buffer3.slice(0, fenceIndex);
+            emit(beforeFence2);
+            buffer3 = buffer3.slice(fenceIndex);
+            return;
+          }
+          const beforeFence = buffer3.slice(0, fenceIndex);
+          emit(beforeFence);
+          inCodeFence = true;
+          fenceChar = fenceMarkerStr[0];
+          fenceLength = fenceMarkerStr.length;
+          emit(buffer3.slice(fenceIndex, fenceIndex + lineStartOffset));
+          buffer3 = buffer3.slice(fenceIndex + lineStartOffset);
+          continue;
+        }
+        if (isFinal) {
+          emit(buffer3);
+          buffer3 = "";
+          return;
+        }
+        const hold = calculateHoldLength(buffer3, wasAtLineStart);
+        if (hold === 0) {
+          emit(buffer3);
+          buffer3 = "";
+        } else if (hold < buffer3.length) {
+          emit(buffer3.slice(0, buffer3.length - hold));
+          buffer3 = buffer3.slice(buffer3.length - hold);
+        }
+        return;
+      } else {
+        const closeRegex = new RegExp(`(?:^|[\\r\\n])[ ]{0,3}${fenceChar}{${fenceLength},}[ ]*(?:\\r?\\n|$)`, "g");
+        const closeMatch = closeRegex.exec(buffer3);
+        if (closeMatch) {
+          const isNewlinePreceded = closeMatch[0].startsWith("\n") || closeMatch[0].startsWith("\r");
+          const actualStart = closeMatch.index + (isNewlinePreceded ? 1 : 0);
+          if (actualStart === 0 && !wasAtLineStart) {
+            emit(buffer3.slice(0, closeMatch.index + 1));
+            buffer3 = buffer3.slice(closeMatch.index + 1);
+            continue;
+          }
+          const closeEnd = closeMatch.index + closeMatch[0].length;
+          emit(buffer3.slice(0, closeEnd));
+          buffer3 = buffer3.slice(closeEnd);
+          inCodeFence = false;
+          fenceChar = "";
+          fenceLength = 0;
+          continue;
+        }
+        if (isFinal) {
+          emit(buffer3);
+          buffer3 = "";
+          return;
+        }
+        const trailingCloseMatch = new RegExp(`(?:^|[\\r\\n])[ ]{0,3}${fenceChar}{1,${fenceLength}}$`).exec(buffer3);
+        const hold = trailingCloseMatch ? trailingCloseMatch[0].length : 0;
+        if (hold === 0) {
+          emit(buffer3);
+          buffer3 = "";
+        } else if (hold < buffer3.length) {
+          emit(buffer3.slice(0, buffer3.length - hold));
+          buffer3 = buffer3.slice(buffer3.length - hold);
+        }
+        return;
+      }
+    }
+  };
+  return {
+    push(chunk) {
+      if (intercepted) return;
+      if (chunk.length === 0) {
+        emit("");
+        return;
+      }
+      buffer3 += chunk;
+      processBuffer(false);
+    },
+    finalize() {
+      processBuffer(true);
+      return {
+        content: safeContent,
+        intercepted
+      };
+    }
+  };
+}
+function sanitizeResponsesProtocolLeakText(text2) {
+  const sanitizer = createResponsesProtocolLeakSanitizer();
+  sanitizer.push(text2);
+  return sanitizer.finalize();
+}
+
 // packages/agent-runtime/responsesSseStream.ts
 function toResponsesStreamFailure(raw, fallbackPrefix = "Responses") {
   if (!raw || typeof raw !== "object") return void 0;
@@ -20870,6 +21878,8 @@ function hasNumericTokenCount(u) {
 function createResponsesStreamCollector(callbacks) {
   let content = "";
   let reasoning = "";
+  const textSanitizer = createResponsesProtocolLeakSanitizer(callbacks?.onTextDelta);
+  let sawNonEmptyOutputTextDelta = false;
   const toolCallsAcc = createResponsesToolAccumulator();
   let usage;
   let failure;
@@ -20921,8 +21931,8 @@ function createResponsesStreamCollector(callbacks) {
       return;
     }
     if (type === "response.output_text.delta" && typeof ev.delta === "string") {
-      content += ev.delta;
-      callbacks?.onTextDelta?.(ev.delta);
+      if (ev.delta.length > 0) sawNonEmptyOutputTextDelta = true;
+      textSanitizer.push(ev.delta);
       return;
     }
     if ((type === "response.reasoning_text.delta" || type === "response.reasoning.delta") && typeof ev.delta === "string") {
@@ -20932,11 +21942,11 @@ function createResponsesStreamCollector(callbacks) {
     }
     if (type === "response.output_item.added" || type === "response.output_item.done") {
       const item = ev.item;
-      if (item?.type === "message" && !content) {
+      if (item?.type === "message" && !sawNonEmptyOutputTextDelta) {
         const itemText = extractOutputTextFromItem(item);
         if (itemText) {
-          content = itemText;
-          callbacks?.onTextDelta?.(itemText);
+          sawNonEmptyOutputTextDelta = true;
+          textSanitizer.push(itemText);
         }
       }
       applyResponsesToolEvent(toolCallsAcc, ev);
@@ -21035,8 +22045,16 @@ function createResponsesStreamCollector(callbacks) {
     if (authoritativeCompletedTools && failure) {
       finalToolCalls = [];
     }
+    const sanitized = textSanitizer.finalize();
+    content = sanitized.content;
+    let intercepted = sanitized.intercepted;
     if (!content && completedResponse) {
-      content = extractTextFromResponseOutput(completedResponse);
+      const extracted = extractTextFromResponseOutput(completedResponse);
+      if (extracted) {
+        const sanitizedExtracted = sanitizeResponsesProtocolLeakText(extracted);
+        content = sanitizedExtracted.content;
+        if (sanitizedExtracted.intercepted) intercepted = true;
+      }
     }
     if (!reasoning && completedResponse) {
       reasoning = extractReasoningFromResponseOutput(completedResponse);
@@ -21051,6 +22069,7 @@ function createResponsesStreamCollector(callbacks) {
       ...streamComplete ? { finish_reason: finalToolCalls.length > 0 ? "tool_calls" : "stop" } : {},
       ...streamComplete ? { stream_complete: true } : {},
       ...streamTruncated ? { stream_truncated: true } : {},
+      ...intercepted ? { leaked_protocol_intercepted: true } : {},
       ...completedResponse ? { completed_response: completedResponse } : {},
       ...completedResponse && typeof completedResponse.id === "string" ? { response_id: completedResponse.id } : {},
       ...failure ? { failure } : {}
@@ -21432,6 +22451,7 @@ async function executeOpenAiCompatibleChatCompletion(args2) {
           ...streamed2.usage ? { usage: streamed2.usage } : {},
           ...streamed2.stream_complete ? { stream_complete: true } : {},
           ...streamed2.finish_reason ? { finish_reason: streamed2.finish_reason } : {},
+          ...streamed2.leaked_protocol_intercepted ? { leaked_protocol_intercepted: true } : {},
           trace: args2.messages
         });
       }
@@ -21479,6 +22499,16 @@ async function executeOpenAiCompatibleChatCompletion(args2) {
     throw error;
   }
 }
+function describeOpenAiCompatibleRequestBudget(args2) {
+  const request3 = buildOpenAiCompatibleChatCompletionRequest({ ...args2, messages: [] });
+  const body = JSON.parse(request3.init.body);
+  const cap = body.max_completion_tokens ?? body.max_output_tokens ?? body.max_tokens;
+  return {
+    toolSchemaTokens: estimateTokenCount(JSON.stringify(body.tools ?? [])),
+    // Explicit wire allowance is conservatively reserved. Omitted provider defaults are unknown.
+    output: typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? { semantics: "shared-window", finalWireCapTokens: cap } : { semantics: "unknown", fallbackReserveTokens: 8192 }
+  };
+}
 
 // packages/agent-runtime/openAiCompatibleProviderConfig.ts
 async function resolveOpenAiCompatibleProviderConfig(args2) {
@@ -22622,7 +23652,8 @@ function createHybridRecordStore(deps) {
       const normalizedLocalRecord = normalizeHybridRecord(dbKey, localRecord);
       if (normalizedLocalRecord && options?.remote !== true) return normalizedLocalRecord;
       if (options?.remote === false) return null;
-      const fallbackDeadlineMs = requestTimeoutMs > 0 ? Date.now() + requestTimeoutMs : null;
+      const effectiveTimeoutMs = typeof options?.timeoutMs === "number" && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : requestTimeoutMs;
+      const fallbackDeadlineMs = effectiveTimeoutMs > 0 ? Date.now() + effectiveTimeoutMs : null;
       for (const server of resolveHybridServers(
         deps.defaultServer,
         options?.preferredServerOrigin,
@@ -22673,6 +23704,267 @@ function createHybridRecordStore(deps) {
 var DEFAULT_SANDBOX_TMPFS_SIZE_BYTES = 128 * 1024 * 1024;
 var BWRAP_PROBE_TTL_MS = 5 * 6e4;
 
+// node_modules/async-mutex/index.mjs
+var E_TIMEOUT = new Error("timeout while waiting for mutex to become available");
+var E_ALREADY_LOCKED = new Error("mutex already locked");
+var E_CANCELED = new Error("request for lock canceled");
+var __awaiter$2 = function(thisArg, _arguments, P, generator) {
+  function adopt(value) {
+    return value instanceof P ? value : new P(function(resolve6) {
+      resolve6(value);
+    });
+  }
+  return new (P || (P = Promise))(function(resolve6, reject) {
+    function fulfilled(value) {
+      try {
+        step(generator.next(value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function rejected(value) {
+      try {
+        step(generator["throw"](value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function step(result4) {
+      result4.done ? resolve6(result4.value) : adopt(result4.value).then(fulfilled, rejected);
+    }
+    step((generator = generator.apply(thisArg, _arguments || [])).next());
+  });
+};
+var Semaphore = class {
+  constructor(_value, _cancelError = E_CANCELED) {
+    this._value = _value;
+    this._cancelError = _cancelError;
+    this._queue = [];
+    this._weightedWaiters = [];
+  }
+  acquire(weight = 1, priority = 0) {
+    if (weight <= 0)
+      throw new Error(`invalid weight ${weight}: must be positive`);
+    return new Promise((resolve6, reject) => {
+      const task = { resolve: resolve6, reject, weight, priority };
+      const i = findIndexFromEnd(this._queue, (other) => priority <= other.priority);
+      if (i === -1 && weight <= this._value) {
+        this._dispatchItem(task);
+      } else {
+        this._queue.splice(i + 1, 0, task);
+      }
+    });
+  }
+  runExclusive(callback_1) {
+    return __awaiter$2(this, arguments, void 0, function* (callback4, weight = 1, priority = 0) {
+      const [value, release3] = yield this.acquire(weight, priority);
+      try {
+        return yield callback4(value);
+      } finally {
+        release3();
+      }
+    });
+  }
+  waitForUnlock(weight = 1, priority = 0) {
+    if (weight <= 0)
+      throw new Error(`invalid weight ${weight}: must be positive`);
+    if (this._couldLockImmediately(weight, priority)) {
+      return Promise.resolve();
+    } else {
+      return new Promise((resolve6) => {
+        if (!this._weightedWaiters[weight - 1])
+          this._weightedWaiters[weight - 1] = [];
+        insertSorted(this._weightedWaiters[weight - 1], { resolve: resolve6, priority });
+      });
+    }
+  }
+  isLocked() {
+    return this._value <= 0;
+  }
+  getValue() {
+    return this._value;
+  }
+  setValue(value) {
+    this._value = value;
+    this._dispatchQueue();
+  }
+  release(weight = 1) {
+    if (weight <= 0)
+      throw new Error(`invalid weight ${weight}: must be positive`);
+    this._value += weight;
+    this._dispatchQueue();
+  }
+  cancel() {
+    this._queue.forEach((entry) => entry.reject(this._cancelError));
+    this._queue = [];
+  }
+  _dispatchQueue() {
+    this._drainUnlockWaiters();
+    while (this._queue.length > 0 && this._queue[0].weight <= this._value) {
+      this._dispatchItem(this._queue.shift());
+      this._drainUnlockWaiters();
+    }
+  }
+  _dispatchItem(item) {
+    const previousValue = this._value;
+    this._value -= item.weight;
+    item.resolve([previousValue, this._newReleaser(item.weight)]);
+  }
+  _newReleaser(weight) {
+    let called = false;
+    return () => {
+      if (called)
+        return;
+      called = true;
+      this.release(weight);
+    };
+  }
+  _drainUnlockWaiters() {
+    if (this._queue.length === 0) {
+      for (let weight = this._value; weight > 0; weight--) {
+        const waiters = this._weightedWaiters[weight - 1];
+        if (!waiters)
+          continue;
+        waiters.forEach((waiter) => waiter.resolve());
+        this._weightedWaiters[weight - 1] = [];
+      }
+    } else {
+      const queuedPriority = this._queue[0].priority;
+      for (let weight = this._value; weight > 0; weight--) {
+        const waiters = this._weightedWaiters[weight - 1];
+        if (!waiters)
+          continue;
+        const i = waiters.findIndex((waiter) => waiter.priority <= queuedPriority);
+        (i === -1 ? waiters : waiters.splice(0, i)).forEach((waiter) => waiter.resolve());
+      }
+    }
+  }
+  _couldLockImmediately(weight, priority) {
+    return (this._queue.length === 0 || this._queue[0].priority < priority) && weight <= this._value;
+  }
+};
+function insertSorted(a, v) {
+  const i = findIndexFromEnd(a, (other) => v.priority <= other.priority);
+  a.splice(i + 1, 0, v);
+}
+function findIndexFromEnd(a, predicate) {
+  for (let i = a.length - 1; i >= 0; i--) {
+    if (predicate(a[i])) {
+      return i;
+    }
+  }
+  return -1;
+}
+var __awaiter$1 = function(thisArg, _arguments, P, generator) {
+  function adopt(value) {
+    return value instanceof P ? value : new P(function(resolve6) {
+      resolve6(value);
+    });
+  }
+  return new (P || (P = Promise))(function(resolve6, reject) {
+    function fulfilled(value) {
+      try {
+        step(generator.next(value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function rejected(value) {
+      try {
+        step(generator["throw"](value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function step(result4) {
+      result4.done ? resolve6(result4.value) : adopt(result4.value).then(fulfilled, rejected);
+    }
+    step((generator = generator.apply(thisArg, _arguments || [])).next());
+  });
+};
+var Mutex = class {
+  constructor(cancelError) {
+    this._semaphore = new Semaphore(1, cancelError);
+  }
+  acquire() {
+    return __awaiter$1(this, arguments, void 0, function* (priority = 0) {
+      const [, releaser] = yield this._semaphore.acquire(1, priority);
+      return releaser;
+    });
+  }
+  runExclusive(callback4, priority = 0) {
+    return this._semaphore.runExclusive(() => callback4(), 1, priority);
+  }
+  isLocked() {
+    return this._semaphore.isLocked();
+  }
+  waitForUnlock(priority = 0) {
+    return this._semaphore.waitForUnlock(1, priority);
+  }
+  release() {
+    if (this._semaphore.isLocked())
+      this._semaphore.release();
+  }
+  cancel() {
+    return this._semaphore.cancel();
+  }
+};
+
+// packages/database-engine/dialogOwner.ts
+var dialogOwnerKey = (dialogId) => `dialogown-${dialogId}`;
+var locks = /* @__PURE__ */ new Map();
+async function registerDialogOwner(args2) {
+  const emit = (event) => {
+    try {
+      (args2.log ?? ((event2) => console.warn(event2)))(event);
+    } catch {
+    }
+  };
+  const key = dialogOwnerKey(args2.dialogId);
+  let mutex = locks.get(key);
+  if (!mutex) {
+    mutex = new Mutex();
+    locks.set(key, mutex);
+  }
+  try {
+    await mutex.runExclusive(async () => {
+      let existing;
+      try {
+        existing = await args2.store.get(key);
+      } catch (error) {
+        if (!isLevelNotFoundError(error)) throw error;
+        existing = null;
+      }
+      if (existing != null) {
+        if (existing.ownerId !== args2.ownerId) emit({
+          event: "dialog_owner_conflict",
+          dialogId: args2.dialogId,
+          existingOwnerId: existing.ownerId,
+          attemptedOwnerId: args2.ownerId,
+          source: args2.source
+        });
+        return;
+      }
+      await args2.store.put(key, {
+        dialogId: args2.dialogId,
+        ownerId: args2.ownerId,
+        ...args2.spaceId !== void 0 ? { spaceId: args2.spaceId } : {},
+        source: args2.source,
+        registeredAt: (args2.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))()
+      });
+    });
+  } catch (error) {
+    emit({
+      event: "dialog_owner_registration_failed",
+      dialogId: args2.dialogId,
+      source: args2.source,
+      error: error instanceof Error ? error.message : String(error)
+    });
+  } finally {
+    if (!mutex.isLocked() && locks.get(key) === mutex) locks.delete(key);
+  }
+}
+
 // packages/cli/client/localDialogRecords.ts
 var localDialogMessageRecordToRuntimeMessage = dialogMessageRecordToAgentRuntimeMessage;
 function buildLocalDialogWritePlan(args2) {
@@ -22689,6 +23981,138 @@ function buildLocalDialogWritePlan(args2) {
     ...args2.titleOverride ? { titleOverride: args2.titleOverride } : {}
   });
 }
+async function saveCliPendingUserMessages(args2) {
+  const dialogKey = `dialog-${args2.userId}-${args2.dialogId}`;
+  const existing = await args2.store.read(dialogKey, { remote: false });
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const ops = [];
+  if (!existing) ops.push({ type: "put", key: dialogKey, value: {
+    id: args2.dialogId,
+    dbKey: dialogKey,
+    type: "dialog",
+    userId: args2.userId,
+    primaryAgentKey: args2.agentKey,
+    cybots: [args2.agentKey],
+    createdAt: now,
+    updatedAt: now
+  } });
+  for (const request3 of args2.requests) {
+    if (!request3.messageId) throw new Error("Pending user message requires a stable messageId");
+    const key = `dialog-${args2.dialogId}-msg-${request3.messageId}`;
+    if (await args2.store.read(key, { remote: false })) continue;
+    ops.push({ type: "put", key, value: {
+      id: request3.messageId,
+      dbKey: key,
+      type: "message",
+      dialogId: args2.dialogId,
+      userId: args2.userId,
+      role: "user",
+      content: request3.text,
+      createdAt: now,
+      metadata: {
+        queueState: "pending",
+        source: request3.source ?? "tui",
+        imagePaths: request3.imagePaths,
+        mediaPaths: request3.mediaPaths
+      }
+    } });
+  }
+  await registerDialogOwner({
+    store: { get: (key) => args2.store.read(key, { remote: false }), put: (key, value) => args2.store.batch([{ type: "put", key, value }]) },
+    dialogId: args2.dialogId,
+    ownerId: args2.userId,
+    source: "cli-pending-user"
+  });
+  if (ops.length) await args2.store.batch(ops);
+}
+async function readCliPendingUserMessages(store, dialogId) {
+  const { readDialogMessageRecords } = await import("./cliLocalAgentRecordReader-MHHD4T7R.js");
+  const rows = await readDialogMessageRecords({ store, dialogId });
+  const uncertain = rows.filter(({ record: record2 }) => record2.metadata?.cliBatchPhase === "requested" && !record2.metadata?.cliBatchResolution);
+  const recovery = uncertain.length ? {
+    status: "unknown",
+    messageIds: uncertain.map((row) => row.messageId),
+    // Attribute each unknown batch to its own members via the tail receipt.
+    // `acceptedUserMessageIds` is written by `markCliUserBatchPhase`; older
+    // records carry the same field from the legacy admission path. Records with
+    // neither fall back to every accepted row (never attribute a completed
+    // batch's members to an unknown one when the receipt is available).
+    batches: uncertain.map((row) => {
+      const receiptIds = row.record.metadata?.acceptedUserMessageIds;
+      const memberIds = Array.isArray(receiptIds) && receiptIds.length ? receiptIds : rows.filter((message) => message.record.metadata?.queueState === "accepted").map((message) => message.messageId);
+      const memberSet = new Set(memberIds);
+      return { batchId: row.messageId, messages: rows.filter((message) => memberSet.has(message.messageId)).map((message) => ({ messageId: message.messageId, text: String(message.record.content ?? "") })) };
+    }),
+    message: `Batch provider outcome unknown for ${uncertain.map((row) => row.messageId).join(", ")}; pending history retained; resubmission paused to avoid duplicate billing`
+  } : { status: "ready", messageIds: [] };
+  const pending = rows.filter(({ record: record2 }) => record2.role === "user" && record2.metadata?.queueState === "pending").map(({ record: record2, messageId }) => ({
+    messageId,
+    source: record2.metadata?.source,
+    text: String(record2.content ?? ""),
+    event: { kind: "user", text: String(record2.content ?? "") },
+    imagePaths: record2.metadata?.imagePaths,
+    mediaPaths: record2.metadata?.mediaPaths
+  }));
+  return { pending, recovery };
+}
+async function markCliUserBatchPhase(store, dialogId, messageId, phase, messageIds, preparedMessages) {
+  const key = `dialog-${dialogId}-msg-${messageId}`;
+  const record2 = await store.read(key, { remote: false });
+  if (!record2) throw new Error("Missing durable batch receipt");
+  const current = record2.metadata?.cliBatchPhase;
+  if (phase === "requested" && (current === "requested" || current === "completed")) {
+    throw new Error(`Batch ${messageId} already requested; resubmission blocked`);
+  }
+  const ops = [];
+  for (const id of messageIds) {
+    const messageKey = `dialog-${dialogId}-msg-${id}`;
+    const message = await store.read(messageKey, { remote: false });
+    if (!message) throw new Error(`Missing batch user message ${id}`);
+    const prepared = preparedMessages?.find((item) => item.cliMessageId === id);
+    ops.push({ type: "put", key: messageKey, value: {
+      ...message,
+      ...prepared ? { content: prepared.content } : {},
+      metadata: {
+        ...message.metadata,
+        queueState: "accepted",
+        ...id === messageId ? { cliBatchPhase: phase, acceptedUserMessageIds: [...messageIds] } : {}
+      }
+    } });
+  }
+  await store.batch(ops);
+}
+async function rollbackCliUserBatchPhase(store, dialogId, batchId, messageIds) {
+  const ops = [];
+  for (const id of messageIds) {
+    const key = `dialog-${dialogId}-msg-${id}`;
+    const record2 = await store.read(key, { remote: false });
+    if (!record2) continue;
+    const metadata = { ...record2.metadata };
+    delete metadata.cliBatchPhase;
+    metadata.queueState = "pending";
+    ops.push({ type: "put", key, value: { ...record2, metadata } });
+  }
+  if (ops.length) await store.batch(ops);
+}
+async function buildCliBatchCompletionOp(store, dialogId, batchId) {
+  const key = `dialog-${dialogId}-msg-${batchId}`;
+  const record2 = await store.read(key, { remote: false });
+  if (!record2) throw new Error(`Missing batch user message ${batchId}`);
+  return { type: "put", key, value: {
+    ...record2,
+    metadata: { ...record2.metadata, cliBatchPhase: "completed" }
+  } };
+}
+async function resolveCliUnknownBatchWithoutResend(store, dialogId, batchId) {
+  const key = `dialog-${dialogId}-msg-${batchId}`;
+  const record2 = await store.read(key, { remote: false });
+  if (!record2 || record2.metadata?.cliBatchPhase !== "requested") throw new Error(`Unknown requested batch not found: ${batchId}`);
+  if (record2.metadata.cliBatchResolution) return;
+  await store.batch([{ type: "put", key, value: { ...record2, metadata: {
+    ...record2.metadata,
+    cliBatchResolution: { decision: "continue-without-resend", decidedBy: "user", decidedAt: (/* @__PURE__ */ new Date()).toISOString() }
+  } } }]);
+}
 
 // packages/agent-runtime/noloWorkspaceTools.node.ts
 async function readNoloProcessStream(readable) {
@@ -22804,7 +24228,7 @@ function buildLoadSkillExecutor(args2) {
     const parsed = parseNoloWorkspaceToolArguments(call.arguments);
     const referenceKeys = ["source", "slug", "projectBinding", "relativePath", "dbKey", "id", "skillId"];
     if (referenceKeys.some((key) => Object.hasOwn(parsed, key))) {
-      return loadPreciseSkill(args2.cwd, parsed);
+      return loadPreciseSkill(args2.cwd, parsed, args2.agentSkillSource, args2.resolveAgentSkillSource);
     }
     const name = noloStringArg(parsed.name ?? parsed.skillName ?? parsed.skill);
     if (!name) {
@@ -22813,12 +24237,14 @@ function buildLoadSkillExecutor(args2) {
         metadata: { loadSkill: true, resolved: false }
       };
     }
-    const { resolveSkillByName } = await import("./skillDiscovery-XKHROSH2.js");
+    const { resolveSkillByName } = await import("./skillDiscovery-B5V23AXP.js");
     const resolved = resolveSkillByName(args2.cwd, name);
     if (!resolved) {
-      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-2QETTQPM.js");
+      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-2ECA42FC.js");
       const builtin = resolveBuiltinSkillByName(name);
       if (builtin) {
+        const denied = await rejectDisabledBuiltin(args2.agentSkillSource, builtin.slug, name, args2.resolveAgentSkillSource);
+        if (denied) return denied;
         return {
           content: `Skill "${name}" loaded inline. Follow its instructions.
 
@@ -22858,7 +24284,25 @@ ${body}`,
     }
   };
 }
-async function loadPreciseSkill(cwd, parsed) {
+async function rejectDisabledBuiltin(source, slug, requestedName, resolveSource) {
+  if (resolveSource) {
+    try {
+      source = await resolveSource();
+    } catch {
+      source = null;
+    }
+    if (!source) return {
+      content: `Skill "${requestedName}" cannot be loaded: current agent policy is unavailable.`,
+      metadata: { loadSkill: true, resolved: false, builtin: true, policyUnavailable: true, slug, name: requestedName, requestedName }
+    };
+  }
+  if (!isAgentSkillDisabled(source, slug)) return null;
+  return {
+    content: `Skill "${requestedName}" \u5DF2\u88AB\u7981\u7528\uFF1A\u8BE5\u80FD\u529B\u5728\u6B64 agent \u4E0A\u4E0D\u53EF\u7528\uFF0C\u65E0\u6CD5\u52A0\u8F7D\u3002`,
+    metadata: { loadSkill: true, resolved: false, builtin: true, disabled: true, slug, name: requestedName, requestedName }
+  };
+}
+async function loadPreciseSkill(cwd, parsed, agentSkillSource, resolveAgentSkillSource) {
   const source = parsed.source;
   const has2 = (key) => Object.hasOwn(parsed, key);
   const reject = (reason) => ({
@@ -22875,9 +24319,11 @@ async function loadPreciseSkill(cwd, parsed) {
     if (!nonEmpty(parsed.slug) || has2("projectBinding") || has2("relativePath")) {
       return reject("builtin requires only an exact slug.");
     }
-    const { listBuiltinSkills } = await import("./builtinSkillRegistry-2QETTQPM.js");
+    const { listBuiltinSkills } = await import("./builtinSkillRegistry-2ECA42FC.js");
     const builtin = listBuiltinSkills().find((entry) => entry.slug === parsed.slug);
     if (!builtin) return reject("builtin slug not found.");
+    const denied = await rejectDisabledBuiltin(agentSkillSource, builtin.slug, builtin.slug, resolveAgentSkillSource);
+    if (denied) return { ...denied, metadata: { ...denied.metadata, source } };
     return {
       content: `Skill "${builtin.slug}" loaded inline. Follow its instructions.
 
@@ -22899,7 +24345,7 @@ ${builtin.content}`,
   }
   try {
     const { realpathSync, statSync, readFileSync } = await import("node:fs");
-    const { resolve: resolve6, relative: relative6, isAbsolute: isAbsolute5, basename: basename3, sep: sep3 } = await import("node:path");
+    const { resolve: resolve6, relative: relative6, isAbsolute: isAbsolute5, basename: basename4, sep: sep3 } = await import("node:path");
     const inside = (root, target) => {
       const rel = relative6(root, target);
       return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute5(rel);
@@ -22908,7 +24354,7 @@ ${builtin.content}`,
     if (!isAbsolute5(parsed.projectBinding) || realpathSync(parsed.projectBinding) !== realCwd) {
       return reject("projectBinding does not match the authorized cwd.");
     }
-    if (isAbsolute5(parsed.relativePath) || basename3(parsed.relativePath) !== "SKILL.md") {
+    if (isAbsolute5(parsed.relativePath) || basename4(parsed.relativePath) !== "SKILL.md") {
       return reject("relativePath must reference a project SKILL.md.");
     }
     const skillsRoot = resolve6(realCwd, ".agents", "skills");
@@ -22916,7 +24362,7 @@ ${builtin.content}`,
     if (!inside(skillsRoot, candidate)) return reject("path is outside cwd/.agents/skills/.");
     const realRoot = realpathSync(skillsRoot);
     const realPath = realpathSync(candidate);
-    if (realRoot !== skillsRoot || !inside(realRoot, realPath) || basename3(realPath) !== "SKILL.md") {
+    if (realRoot !== skillsRoot || !inside(realRoot, realPath) || basename4(realPath) !== "SKILL.md") {
       return reject("skill path escapes cwd/.agents/skills/ or is not SKILL.md.");
     }
     if (!statSync(realPath).isFile()) return reject("SKILL.md is not a file.");
@@ -22939,7 +24385,7 @@ ${body}`,
   }
 }
 async function formatUnknownSkillMessage(cwd, requestedName) {
-  const { discoverSkills } = await import("./skillDiscovery-XKHROSH2.js");
+  const { discoverSkills } = await import("./skillDiscovery-B5V23AXP.js");
   let available = [];
   try {
     available = discoverSkills(cwd).map((s) => s.name);
@@ -23604,12 +25050,16 @@ export {
   createLocalWorkspaceToolExecutors,
   buildToolParametersIndex,
   getAgentRuntimeToolParametersIndex,
+  registerLocalShellLifecycle,
+  getLocalShellLifecycle,
   normalizeLocalToolName,
   isCommandExecutingTool,
   resolveLocalToolPolicy,
   runExecShellGates,
   executeLocalToolWithPolicy,
   LOCAL_TURN_ABORTED_CODE,
+  evaluateTaskExecutionContract,
+  projectContextProvenance,
   hashToolDefinitions,
   LOCAL_AGENT_CONFIG_MISSING_CODE,
   runLocalAgentTurn,
@@ -23621,6 +25071,7 @@ export {
   parseOpenAiCompatibleChatCompletionResponse,
   readOpenAiCompatibleSseCompletion,
   executeOpenAiCompatibleChatCompletion,
+  describeOpenAiCompatibleRequestBudget,
   resolveOpenAiCompatibleProviderConfig,
   dialogMessageRecordToAgentRuntimeMessage,
   buildAgentRuntimeDialogWritePlan,
@@ -23628,8 +25079,15 @@ export {
   parseSyncServersEnv,
   DEFAULT_HYBRID_READ_TIMEOUT_MS,
   createHybridRecordStore,
+  registerDialogOwner,
   localDialogMessageRecordToRuntimeMessage,
   buildLocalDialogWritePlan,
+  saveCliPendingUserMessages,
+  readCliPendingUserMessages,
+  markCliUserBatchPhase,
+  rollbackCliUserBatchPhase,
+  buildCliBatchCompletionOp,
+  resolveCliUnknownBatchWithoutResend,
   buildNoloWorkspaceCliToolExecutors,
   buildLoadSkillExecutor,
   isStableSessionIdentityEnabled,