nolo-cli 0.54.0 → 0.61.0-alpha.2

package/{chunk-UNZDCI3O.js → chunk-2KDR4CWE.js}

@@ -54,18 +54,43 @@ function loadProfileConfig(path = getDefaultProfileConfigPath()) {
   }
   return parsed;
 }
+function normalizeProfileTokens(profile) {
+  const tokens = Array.isArray(profile.tokens) ? profile.tokens.filter((token) => typeof token === "string" && token.trim().length > 0) : [];
+  if (tokens.length > 0) return tokens;
+  return typeof profile.authToken === "string" && profile.authToken.trim() ? [profile.authToken.trim()] : [];
+}
 function clearProfileAuthToken(path = getDefaultProfileConfigPath()) {
   if (isProtectedHomeProfileWrite(path)) return false;
   const config = loadProfileConfig(path);
   if (!config) return false;
   const profile = config.profiles[config.currentProfile];
-  if (!profile?.authToken?.trim()) return false;
+  if (!profile || normalizeProfileTokens(profile).length === 0) return false;
   delete profile.authToken;
+  delete profile.tokens;
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, `${JSON.stringify(config, null, 2)}
 `, "utf8");
   return true;
 }
+function getProfileTokens(config) {
+  if (!config) return [];
+  const profile = config.profiles[config.currentProfile];
+  return profile ? normalizeProfileTokens(profile) : [];
+}
+function saveProfileTokens(tokens, path = getDefaultProfileConfigPath()) {
+  if (isProtectedHomeProfileWrite(path)) return null;
+  const config = loadProfileConfig(path);
+  if (!config) return null;
+  const profile = config.profiles[config.currentProfile];
+  if (!profile) return null;
+  const normalized = [...new Set(tokens.map((token) => token.trim()).filter(Boolean))];
+  profile.tokens = normalized;
+  delete profile.authToken;
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+  return config;
+}
 function saveDefaultProfile(path, profile) {
   if (isProtectedHomeProfileWrite(path)) {
     throw new Error(
@@ -73,10 +98,14 @@ function saveDefaultProfile(path, profile) {
     );
   }
   const existing = loadProfileConfig(path);
+  const existingDefault = existing?.profiles?.default;
+  const existingTokens = existingDefault ? normalizeProfileTokens(existingDefault) : [];
+  const authToken = profile.authToken.trim();
+  const { authToken: _legacyAuthToken, ...preserved } = existingDefault ?? {};
   const mergedDefault = {
-    ...existing?.profiles?.default ?? {},
+    ...preserved,
     serverUrl: normalizeProfileServerUrl(profile.serverUrl),
-    authToken: profile.authToken.trim()
+    tokens: [authToken, ...existingTokens.filter((token) => token !== authToken)]
   };
   const config = {
     currentProfile: "default",
@@ -97,7 +126,7 @@ function buildEnvFromProfile(config) {
   return {
     NOLO_PROFILE: config.currentProfile,
     NOLO_SERVER: profile.serverUrl,
-    ...profile.authToken?.trim() ? { AUTH_TOKEN: profile.authToken.trim() } : {},
+    ...getProfileTokens(config)[0] ? { AUTH_TOKEN: getProfileTokens(config)[0] } : {},
     ...profile.agentKey ? { NOLO_AGENT: profile.agentKey } : {},
     ...profile.agentName ? { NOLO_AGENT_NAME: profile.agentName } : {},
     ...profile.locale ? { NOLO_LANG: profile.locale } : {}
@@ -261,6 +290,8 @@ export {
   getDefaultProfileConfigPath,
   loadProfileConfig,
   clearProfileAuthToken,
+  getProfileTokens,
+  saveProfileTokens,
   saveDefaultProfile,
   buildEnvFromProfile,
   buildCliRuntimeEnv,

package/{chunk-3ZTR7ZO4.js → chunk-2PGGC63K.js}

@@ -199,7 +199,7 @@ async function readDocFunc(args, thunkApi) {
     throw new Error(`\u65E0\u6548\u7684\u9875\u9762 ID: ${id}\u3002\u9875\u9762 ID \u901A\u5E38\u4EE5 "page-" \u5F00\u5934\u3002`);
   }
   try {
-    const { readAction } = await import("./read-K4JU4MQC.js");
+    const { readAction } = await import("./read-2BYWW7AA.js");
     const pageData = await readAction({ dbKey: id }, thunkApi);
     if (!pageData) {
       throw new Error(`\u672A\u627E\u5230 ID \u4E3A ${id} \u7684\u9875\u9762\u3002`);

package/{chunk-JXIP6ZWH.js → chunk-37QVS7BU.js}

@@ -1,16 +1,19 @@
 import {
   createCliLocalRuntimeAdapter,
   summarizeEndpoint
-} from "./chunk-5FCIPEKT.js";
+} from "./chunk-7O7KH4X5.js";
 import {
   clipMultilineText
-} from "./chunk-TR4DXUYX.js";
+} from "./chunk-2HPRMEEZ.js";
 import {
   runLocalAgentTurn
-} from "./chunk-EJE33XNR.js";
+} from "./chunk-4C4ST2YE.js";
+import {
+  applyToolSurfaceConstraints
+} from "./chunk-RJ2SAFB5.js";
 import {
   resolveLocalRuntimeEnvFromPolicy
-} from "./chunk-CS6TCJ7E.js";
+} from "./chunk-3JQ2NRYU.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -431,12 +434,21 @@ async function defaultRunConnectorLocalRuntimeAgent(args) {
   const agentConfigRaw = readField(payload, "agentConfig");
   const payloadAgentConfig = asRecordOrEmpty(agentConfigRaw);
   const policy = runtimePolicyFromConnectorPayload(args.parsed);
-  const toolNames = mergeToolNames(
+  const candidateToolNames = mergeToolNames(
     readField(payloadAgentConfig, "toolNames"),
     readField(payloadAgentConfig, "tools"),
     policy?.agentTools,
     policy?.runtimeTools
   );
+  const runtimeContext = asRecordOrEmpty(readField(payload, "runtimeContext"));
+  const constrainedSurface = applyToolSurfaceConstraints(
+    { explicitToolNames: candidateToolNames, injectedToolNames: [], finalToolNames: candidateToolNames },
+    {
+      allowedToolNames: Array.isArray(readField(runtimeContext, "allowedToolNames")) ? readField(runtimeContext, "allowedToolNames") : void 0,
+      blockedToolNames: Array.isArray(readField(runtimeContext, "blockedToolNames")) ? readField(runtimeContext, "blockedToolNames") : void 0
+    }
+  );
+  const toolNames = constrainedSurface.finalToolNames;
   const apiSourceRaw = readField(payloadAgentConfig, "apiSource");
   const providerRaw = readField(payloadAgentConfig, "provider");
   const agentRecord = {
@@ -447,6 +459,7 @@ async function defaultRunConnectorLocalRuntimeAgent(args) {
     apiSource: typeof apiSourceRaw === "string" ? apiSourceRaw : "platform",
     provider: typeof providerRaw === "string" ? providerRaw : typeof apiSourceRaw === "string" ? apiSourceRaw : "openai",
     toolNames,
+    runScopedToolSurface: constrainedSurface,
     ...policy ? { runtimeToolPolicy: policy } : {}
   };
   const dispatchUserId = String(args.runtimeEnv.NOLO_USER_ID || "local");

package/{chunk-EA5OYZVD.js → chunk-37XDGCY7.js}

@@ -1,6 +1,6 @@
 import {
   requireTokenUser
-} from "./chunk-5UAYZEXO.js";
+} from "./chunk-UZPQSVM6.js";
 import {
   resolveServerUrl
 } from "./chunk-A7GB5UGH.js";

package/chunk-3BLB7QKO.js

@@ -0,0 +1,433 @@
+import {
+  isOAuthApiKeyRef
+} from "./chunk-YYLHWIW6.js";
+import {
+  compareAgentSelection
+} from "./chunk-RJ2SAFB5.js";
+import {
+  getModelAbility
+} from "./chunk-FKFMIBTT.js";
+import {
+  isOwnedAgentKey,
+  ownedAgentKey,
+  publicAgentKey
+} from "./chunk-BJIRLHJR.js";
+
+// packages/ai/agent/agentBilling.ts
+function resolveBillingSource(candidate) {
+  if (candidate?.local === true || candidate?.isLocal === true || candidate?.cliProvider === "local" || candidate?.apiSource === "local" || candidate?.provider === "local" || candidate?.billingSource === "local") return "local";
+  if (candidate?.isOwned !== true) return "platform_credits";
+  if (candidate?.isOAuth === true || candidate?.billingSource === "user_subscription" || candidate?.apiSource === "oauth" || isOAuthApiKeyRef(candidate?.apiKeyRef)) return "user_subscription";
+  if (candidate?.apiSource === "custom" || candidate?.billingSource === "user_api") {
+    return "user_api";
+  }
+  return "platform_credits";
+}
+
+// packages/ai/economics/economicsPolicy.ts
+var DEEPSEEK_PRICING_DOC = "https://api-docs.deepseek.com/quick_start/pricing";
+var BIGMODEL_CODING_PLAN_USAGE_NOTES = "https://docs.bigmodel.cn/cn/coding-plan/usage-notes";
+var WEEKDAYS_MON_FRI = [1, 2, 3, 4, 5];
+var DEEPSEEK_API_POLICY = {
+  id: "deepseek_api",
+  version: "2026-09-weekday-utc-peak-2x",
+  windows: [
+    { timezone: "UTC", weekdays: WEEKDAYS_MON_FRI, startMinute: 60, endMinute: 240 },
+    { timezone: "UTC", weekdays: WEEKDAYS_MON_FRI, startMinute: 360, endMinute: 600 }
+  ],
+  effectiveFrom: Date.UTC(2026, 7, 16, 16, 0, 0),
+  peakPriceMultiplier: 2,
+  offPeakPriceMultiplier: 1,
+  sourceUrl: DEEPSEEK_PRICING_DOC
+};
+var BIGMODEL_GLM_CODING_PLAN_POLICY = {
+  id: "bigmodel_glm_coding_plan",
+  version: "2026-09-coding-plan-sh-peak-14-18",
+  windows: [
+    { timezone: "Asia/Shanghai", weekdays: WEEKDAYS_MON_FRI, startMinute: 840, endMinute: 1080 }
+  ],
+  peakQuotaMultiplier: 1,
+  offPeakQuotaMultiplier: 0.5,
+  sourceUrl: BIGMODEL_CODING_PLAN_USAGE_NOTES
+};
+var ECONOMICS_POLICIES = [
+  DEEPSEEK_API_POLICY,
+  BIGMODEL_GLM_CODING_PLAN_POLICY
+];
+function resolveEconomicsSourceId(input) {
+  const provider = typeof input?.provider === "string" ? input.provider.trim().toLowerCase() : "";
+  if (input?.apiSource?.trim().toLowerCase() === "platform") return null;
+  const rawUrl = typeof input?.customProviderUrl === "string" ? input.customProviderUrl.trim() : "";
+  let hostname = "";
+  let pathname = "";
+  if (rawUrl) {
+    try {
+      const parsed = new URL(rawUrl);
+      hostname = parsed.hostname.toLowerCase();
+      pathname = parsed.pathname;
+    } catch {
+      return null;
+    }
+  }
+  if (provider === "deepseek") {
+    if (rawUrl && hostname !== "api.deepseek.com") return null;
+    return rawUrl ? "deepseek_api" : null;
+  }
+  if (provider === "bigmodel") {
+    if (hostname === "open.bigmodel.cn" && pathname.startsWith("/api/coding/")) {
+      return "bigmodel_glm_coding_plan";
+    }
+    return null;
+  }
+  return null;
+}
+
+// packages/ai/economics/economicsSnapshot.ts
+var wallClockFormatterCache = /* @__PURE__ */ new Map();
+function getWallClockFormatter(timezone) {
+  let formatter = wallClockFormatterCache.get(timezone);
+  if (!formatter) {
+    formatter = new Intl.DateTimeFormat("en-US", {
+      timeZone: timezone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit"
+    });
+    wallClockFormatterCache.set(timezone, formatter);
+  }
+  return formatter;
+}
+function getZonedWallClock(timezone, at) {
+  const parts = getWallClockFormatter(timezone).formatToParts(new Date(at));
+  const values = {};
+  for (const part of parts) {
+    if (part.type !== "literal") values[part.type] = Number(part.value);
+  }
+  const year = values.year;
+  const month = values.month;
+  const day = values.day;
+  const hour = values.hour;
+  const minute = values.minute;
+  const second = values.second;
+  const weekday = new Date(Date.UTC(year, month - 1, day)).getUTCDay();
+  return { year, month, day, hour, minute, second, weekday, minutesOfDay: hour * 60 + minute };
+}
+function getTimeZoneOffsetMs(timezone, at) {
+  const atSecond = Math.floor(at / 1e3) * 1e3;
+  const clock = getZonedWallClock(timezone, atSecond);
+  return Date.UTC(clock.year, clock.month - 1, clock.day, clock.hour, clock.minute, clock.second) - atSecond;
+}
+function zonedWallClockToEpochMs(timezone, year, month, day, minutesOfDay) {
+  const guess = Date.UTC(year, month - 1, day, Math.floor(minutesOfDay / 60), minutesOfDay % 60);
+  let instant = guess - getTimeZoneOffsetMs(timezone, guess);
+  instant = guess - getTimeZoneOffsetMs(timezone, instant);
+  return instant;
+}
+function resolveEconomicsPeriod(policy, at) {
+  for (const window of policy.windows) {
+    const clock = getZonedWallClock(window.timezone, at);
+    if (!window.weekdays.includes(clock.weekday)) continue;
+    if (clock.minutesOfDay >= window.startMinute && clock.minutesOfDay < window.endMinute) {
+      return "peak";
+    }
+  }
+  return "off_peak";
+}
+function findNextEconomicsBoundary(policy, at) {
+  let best;
+  for (const window of policy.windows) {
+    const anchor = getZonedWallClock(window.timezone, at);
+    for (let dayOffset = 0; dayOffset <= 7; dayOffset++) {
+      const dayUtc = new Date(Date.UTC(anchor.year, anchor.month - 1, anchor.day + dayOffset));
+      const weekday = dayUtc.getUTCDay();
+      if (!window.weekdays.includes(weekday)) continue;
+      const year = dayUtc.getUTCFullYear();
+      const month = dayUtc.getUTCMonth() + 1;
+      const day = dayUtc.getUTCDate();
+      for (const edge of [window.startMinute, window.endMinute]) {
+        const instant = zonedWallClockToEpochMs(window.timezone, year, month, day, edge);
+        if (instant > at && (best === void 0 || instant < best)) best = instant;
+      }
+    }
+  }
+  return best;
+}
+function selectEconomicsPolicyVersion(policies, sourceId, at) {
+  const applicable = policies.filter(
+    (policy) => policy.id === sourceId && (policy.effectiveFrom === void 0 || policy.effectiveFrom <= at) && (policy.effectiveUntil === void 0 || at < policy.effectiveUntil)
+  );
+  if (applicable.length === 0) return null;
+  return applicable.reduce(
+    (latest, candidate) => (candidate.effectiveFrom ?? -Infinity) >= (latest.effectiveFrom ?? -Infinity) ? candidate : latest
+  );
+}
+function findNextPolicyBoundary(policy, at, policies) {
+  const boundaries = [
+    policy.effectiveUntil,
+    ...policies.filter((candidate) => candidate.id === policy.id).map((candidate) => candidate.effectiveFrom).filter((value) => value !== void 0 && value > at)
+  ].filter((value) => value !== void 0 && value > at);
+  return boundaries.length > 0 ? Math.min(...boundaries) : void 0;
+}
+function resolveEconomicsSnapshot(input, at, policies = ECONOMICS_POLICIES) {
+  const sourceId = resolveEconomicsSourceId(input);
+  if (!sourceId) return null;
+  const policy = selectEconomicsPolicyVersion(policies, sourceId, at);
+  if (!policy) return null;
+  const period = resolveEconomicsPeriod(policy, at);
+  const priceMultiplier = period === "peak" ? policy.peakPriceMultiplier : policy.offPeakPriceMultiplier;
+  const quotaMultiplier = period === "peak" ? policy.peakQuotaMultiplier : policy.offPeakQuotaMultiplier;
+  const windowBoundary = findNextEconomicsBoundary(policy, at);
+  const policyBoundary = findNextPolicyBoundary(policy, at, policies);
+  const changesAt = [windowBoundary, policyBoundary].filter((value) => value !== void 0).sort((a, b) => a - b)[0];
+  return {
+    source: sourceId,
+    policyVersion: policy.version,
+    period,
+    ...priceMultiplier !== void 0 ? { priceMultiplier } : {},
+    ...quotaMultiplier !== void 0 ? { quotaMultiplier } : {},
+    ...changesAt !== void 0 ? { changesAt } : {}
+  };
+}
+
+// packages/ai/agent/safeAgentSummary.ts
+function parseTimestamp(val) {
+  if (typeof val === "number" && Number.isFinite(val)) return val;
+  if (typeof val === "string") return Date.parse(val) || 0;
+  return 0;
+}
+function safeTimestamp(val) {
+  if (typeof val === "number" && Number.isFinite(val)) return val;
+  if (typeof val === "string") return val;
+  return null;
+}
+function parseAgentRecordId(privateKey, explicitId) {
+  if (explicitId && typeof explicitId === "string" && explicitId.trim()) {
+    return explicitId.trim();
+  }
+  if (privateKey && typeof privateKey === "string") {
+    const match = privateKey.match(/^agent-[^-]+-(.+)$/i);
+    if (match?.[1]) return match[1];
+  }
+  return null;
+}
+function resolveFavoriteStatus(record, options) {
+  if (options?.isFavorite !== void 0) {
+    return {
+      isFavorite: !!options.isFavorite,
+      favoritedAt: safeTimestamp(options.favoritedAt)
+    };
+  }
+  if (record?.isFavorite === true) {
+    return {
+      isFavorite: true,
+      favoritedAt: safeTimestamp(record?.favoritedAt)
+    };
+  }
+  const favoritesMap = options?.favoritesMap;
+  if (!favoritesMap) {
+    return { isFavorite: false, favoritedAt: null };
+  }
+  const candidateKeys = [];
+  if (typeof record?.dbKey === "string" && record.dbKey) candidateKeys.push(record.dbKey);
+  if (typeof record?.privateKey === "string" && record.privateKey) candidateKeys.push(record.privateKey);
+  if (typeof record?.publicKey === "string" && record.publicKey) candidateKeys.push(record.publicKey);
+  if (typeof record?.id === "string" && record.id) {
+    candidateKeys.push(record.id);
+    candidateKeys.push(publicAgentKey(record.id));
+    if (options?.userId) {
+      candidateKeys.push(ownedAgentKey(options.userId, record.id));
+    }
+  }
+  let matched = false;
+  let highestFavAt = null;
+  let highestFavTime = -1;
+  for (const key of candidateKeys) {
+    const val = favoritesMap instanceof Map ? favoritesMap.get(key) : favoritesMap[key];
+    if (val !== void 0 && val !== false && val !== null) {
+      const favAt = val === true ? 1 : safeTimestamp(val);
+      if (favAt === null) continue;
+      matched = true;
+      const time = parseTimestamp(favAt);
+      if (time > highestFavTime) {
+        highestFavTime = time;
+        highestFavAt = favAt;
+      }
+    }
+  }
+  if (matched) {
+    return {
+      isFavorite: true,
+      favoritedAt: highestFavAt ?? 1
+    };
+  }
+  return { isFavorite: false, favoritedAt: null };
+}
+function toSafeAgentSummary(record, options) {
+  const rawId = parseAgentRecordId(
+    typeof record?.privateKey === "string" ? record.privateKey : record?.dbKey,
+    typeof record?.id === "string" ? record.id : void 0
+  );
+  const id = rawId ?? (typeof record?.id === "string" ? record.id : null);
+  const publicRecordDenied = record?.publicRecordExists === false || options?.publicRecordExists === false;
+  const publicRecordConfirmed = record?.publicRecordExists === true || options?.publicRecordExists === true;
+  let publicKey;
+  if (typeof record?.publicKey === "string" && record.publicKey && !publicRecordDenied) {
+    publicKey = record.publicKey;
+  } else if (publicRecordConfirmed && id) {
+    publicKey = publicAgentKey(id);
+  }
+  const name = typeof record?.name === "string" && record.name ? record.name : "(unnamed)";
+  const handle = typeof record?.handle === "string" && record.handle ? record.handle : null;
+  const introduction = typeof record?.introduction === "string" && record.introduction ? record.introduction : typeof record?.description === "string" && record.description ? record.description : null;
+  const model = typeof record?.model === "string" && record.model ? record.model : null;
+  const provider = typeof record?.provider === "string" && record.provider ? record.provider : typeof record?.apiSource === "string" && record.apiSource ? record.apiSource : null;
+  const apiSource = typeof record?.apiSource === "string" && record.apiSource ? record.apiSource : null;
+  const cliProvider = typeof record?.cliProvider === "string" && record.cliProvider ? record.cliProvider : null;
+  const tools = Array.isArray(record?.tools) ? record.tools.filter((t) => typeof t === "string") : [];
+  const inputPrice = typeof record?.inputPrice === "number" && Number.isFinite(record.inputPrice) ? record.inputPrice : null;
+  const outputPrice = typeof record?.outputPrice === "number" && Number.isFinite(record.outputPrice) ? record.outputPrice : null;
+  const modelAbility = model ? getModelAbility(model) ?? null : null;
+  const favStatus = resolveFavoriteStatus(record, options);
+  const isPublic = record?.isPublic === true || record?.isPublicFlag === true || record?.publicRecordExists === true;
+  const updatedAt = safeTimestamp(record?.updatedAt ?? record?.createdAt ?? record?.created);
+  const nextAvailableAt = typeof record?.nextAvailableAt === "number" && Number.isFinite(record.nextAvailableAt) ? record.nextAvailableAt : void 0;
+  const currentUserId = options?.userId;
+  const isOwnedByRecord = Boolean(currentUserId) && (typeof record?.userId === "string" && record.userId === currentUserId || typeof record?.ownerId === "string" && record.ownerId === currentUserId);
+  const ownedKey = currentUserId ? [record?.dbKey, record?.privateKey].find(
+    (key) => isOwnedAgentKey(key, currentUserId)
+  ) : void 0;
+  const isOwned = isOwnedByRecord || Boolean(ownedKey);
+  const isOAuth = isOAuthApiKeyRef(record?.apiKeyRef);
+  const billingSource = resolveBillingSource({
+    ...record,
+    isOAuth,
+    isOwned,
+    apiSource,
+    cliProvider,
+    provider,
+    isPublic
+  });
+  const economics = resolveEconomicsSnapshot(
+    {
+      provider,
+      apiSource,
+      customProviderUrl: typeof record?.customProviderUrl === "string" ? record.customProviderUrl : null
+    },
+    options?.now ?? Date.now()
+  );
+  let agentKey;
+  if (currentUserId) {
+    if (isOwned) {
+      agentKey = ownedKey ?? (id ? ownedAgentKey(currentUserId, id) : void 0);
+    } else if (publicKey) {
+      agentKey = publicKey;
+    }
+  }
+  return {
+    id,
+    ...agentKey !== void 0 ? { agentKey } : {},
+    ...publicKey !== void 0 ? { publicKey } : {},
+    name,
+    handle,
+    introduction,
+    model,
+    provider,
+    apiSource,
+    cliProvider,
+    billingSource,
+    tools,
+    inputPrice,
+    outputPrice,
+    modelAbility,
+    isFavorite: favStatus.isFavorite,
+    favoritedAt: favStatus.favoritedAt,
+    isPublic,
+    ...economics ? { economics } : {},
+    isOwned,
+    isOAuth,
+    ...nextAvailableAt !== void 0 ? { nextAvailableAt } : {},
+    updatedAt
+  };
+}
+function sortSafeAgentSummaries(agents) {
+  return [...agents].sort(compareAgentSelection);
+}
+var COMPACT_AGENT_SUMMARY_FIELDS = [
+  "agentKey",
+  "name",
+  "model",
+  "provider",
+  "apiSource",
+  "billingSource",
+  "isFavorite",
+  "isOAuth",
+  "isOwned",
+  "isPublic",
+  "tools",
+  // Phase 2A economics 快照（period/multipliers/changesAt 等小对象）。
+  // 只对 DeepSeek API / BigModel GLM Coding Plan 存在；不含完整 policy/windows。
+  "economics",
+  // 仅限流中的 agent 才会带（可用 agent 上不存在）。对"现在能不能选它"是
+  // 决策信息（CLI --show-unavailable 场景）；默认列表已把这类 agent 过滤掉，
+  // 所以通常根本不占字节。
+  "nextAvailableAt"
+];
+function omitNullishAgentSummaryFields(summary) {
+  const result = {};
+  for (const [key, value] of Object.entries(summary)) {
+    if (value !== null && value !== void 0) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function toCompactAgentSummary(summary) {
+  const compact = {};
+  for (const field of COMPACT_AGENT_SUMMARY_FIELDS) {
+    const value = summary[field];
+    if (value !== null && value !== void 0) {
+      compact[field] = value;
+    }
+  }
+  return compact;
+}
+var UNAVAILABLE_AGENT_SUMMARY_FIELDS = [
+  "agentKey",
+  "name",
+  "model",
+  "provider",
+  "apiSource",
+  "isFavorite",
+  "isOAuth",
+  "isOwned",
+  "nextAvailableAt",
+  "favoritedAt",
+  "updatedAt"
+];
+function toUnavailableAgentSummary(summary) {
+  const item = {
+    name: summary.name,
+    isFavorite: summary.isFavorite,
+    isOAuth: summary.isOAuth,
+    isOwned: summary.isOwned
+  };
+  for (const field of UNAVAILABLE_AGENT_SUMMARY_FIELDS) {
+    const value = summary[field];
+    if (value !== null && value !== void 0) {
+      item[field] = value;
+    }
+  }
+  return item;
+}
+
+export {
+  toSafeAgentSummary,
+  sortSafeAgentSummaries,
+  omitNullishAgentSummaryFields,
+  toCompactAgentSummary,
+  toUnavailableAgentSummary
+};

package/{chunk-CS6TCJ7E.js → chunk-3JQ2NRYU.js}

@@ -1,6 +1,8 @@
 import {
-  getCredentialsDir
-} from "./chunk-FD36SCCD.js";
+  getCredentialsDir,
+  getLegacyCredentialPath,
+  migrateLegacyCredentialFile
+} from "./chunk-ONXOABJR.js";
 import {
   asNonEmptyStringArray
 } from "./chunk-I42VC5KR.js";
@@ -23,6 +25,7 @@ import {
   unlinkSync,
   writeFileSync
 } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 
 // packages/agent-runtime/credentialBroker.ts
@@ -65,7 +68,26 @@ function writePrivateFile(path, body) {
   } catch {
   }
 }
-function readApiKeyCredential(ref, homeDir) {
+function migrateApiKeyCredentialIfNeeded(ref, homeDir, migration) {
+  if (homeDir !== void 0 || !migration?.enableLegacyMigration) return;
+  const legacyHomeDir = migration.legacyHomeDir ?? homedir();
+  const relativePath = join("keys", credentialRefToFileName(ref));
+  migrateLegacyCredentialFile({
+    canonicalPath: getApiKeyCredentialPath(ref),
+    legacyPath: getLegacyCredentialPath(relativePath, legacyHomeDir),
+    mode: migration.mode ?? (migration.legacyHomeDir ? "test" : "production"),
+    isValid: (raw) => {
+      try {
+        const parsed = JSON.parse(raw);
+        return typeof parsed?.secret === "string" && Boolean(parsed.secret);
+      } catch {
+        return false;
+      }
+    }
+  });
+}
+function readApiKeyCredential(ref, homeDir, migration) {
+  migrateApiKeyCredentialIfNeeded(ref, homeDir, migration);
   const path = getApiKeyCredentialPath(ref, homeDir);
   if (!existsSync(path)) return null;
   try {
@@ -99,15 +121,16 @@ function removeApiKeyCredential(ref, homeDir) {
   if (!existsSync(path)) return;
   unlinkSync(path);
 }
-function hasApiKeyCredential(ref, homeDir) {
-  return readApiKeyCredential(ref, homeDir) !== null;
+function hasApiKeyCredential(ref, homeDir, migration) {
+  return readApiKeyCredential(ref, homeDir, migration) !== null;
 }
 function createFileCredentialBroker(options = {}) {
   const homeDir = options.homeDir;
+  const migration = options.migration;
   const now = options.now ?? Date.now;
   return {
     get(ref) {
-      return readApiKeyCredential(ref, homeDir);
+      return readApiKeyCredential(ref, homeDir, migration);
     },
     put(ref, secret) {
       writeApiKeyCredential(ref, secret, homeDir, now());
@@ -116,7 +139,7 @@ function createFileCredentialBroker(options = {}) {
       removeApiKeyCredential(ref, homeDir);
     },
     has(ref) {
-      return hasApiKeyCredential(ref, homeDir);
+      return hasApiKeyCredential(ref, homeDir, migration);
     }
   };
 }

package/{chunk-RHMDMTDK.js → chunk-3JWKQDA4.js}

@@ -1,13 +1,13 @@
 import {
   i18n_default,
   toolRegistry
-} from "./chunk-TR4DXUYX.js";
+} from "./chunk-2HPRMEEZ.js";
 import {
   canonicalizeToolNames
 } from "./chunk-O6OSWFZQ.js";
 import {
   isNoloHostedProvider
-} from "./chunk-HPW5MNDQ.js";
+} from "./chunk-22BTGNSP.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";

package/{chunk-3LKZRP7E.js → chunk-3QGUVVX5.js}

@@ -6,10 +6,10 @@ import {
 } from "./chunk-AGGIDPCZ.js";
 import {
   getModelConfig
-} from "./chunk-SVDMVX4G.js";
+} from "./chunk-MMZ6ZTVO.js";
 import {
   isPlatformHostedImageModel
-} from "./chunk-HPW5MNDQ.js";
+} from "./chunk-22BTGNSP.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";