nolo-cli 0.54.0 → 0.61.0-alpha.3

package/{chunk-KLIBF3BY.js → chunk-RDBARW6T.js}

@@ -3,12 +3,15 @@ import {
   resolvePlatformChatCompletionsEndpoint,
   resolvePlatformHostedCredentialProvider,
   resolvePlatformResponsesEndpoint
-} from "./chunk-N4JKMCY3.js";
+} from "./chunk-LJKICKVC.js";
+import {
+  CLI_PROVIDER_VALUES
+} from "./chunk-W7XHHYWM.js";
 import {
   CLIENT_VERSION_TOO_OLD_CODE,
   buildClientVersionGateErrorDetail,
   evaluatePlatformHostedClientVersionGate
-} from "./chunk-HPW5MNDQ.js";
+} from "./chunk-22BTGNSP.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
@@ -110,7 +113,9 @@ function hasDirectOpenAiCompatibleProvider(env) {
   );
 }
 function resolveAgentProviderMode(agentConfig) {
-  if (agentConfig.apiSource === "cli" || agentConfig.provider === "cli" || agentConfig.cliProvider) {
+  const cliProviderName = asTrimmedLowercaseString(agentConfig.cliProvider);
+  const hasRealCliProvider = Boolean(cliProviderName && CLI_PROVIDER_VALUES.includes(cliProviderName)) || asTrimmedLowercaseString(agentConfig.provider) === "cli";
+  if (agentConfig.apiSource === "cli" || hasRealCliProvider && agentConfig.apiSource !== "platform") {
     return "cli";
   }
   if (agentConfig.apiSource === "custom" || agentConfig.customProviderUrl) {

package/{chunk-ZVOHVJI3.js → chunk-RJ2SAFB5.js}

@@ -20,20 +20,6 @@ import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
 
-// packages/agent-runtime/agentRecordKeys.ts
-function buildAgentRuntimeAgentLookupKeys(args) {
-  if (/^agent(-pub)?-/.test(args.agentRef)) {
-    return [args.agentRef];
-  }
-  return [
-    ownedAgentKey(args.userId, args.agentRef),
-    publicAgentKey(args.agentRef)
-  ];
-}
-function shouldFetchAgentRuntimeRecordRemotely(dbKey) {
-  return /^agent(-pub)?-/.test(dbKey);
-}
-
 // packages/agent-runtime/runtimeToolSurface.ts
 var DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS = [
   "listDialogs",
@@ -51,6 +37,25 @@ var DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS = [
   "cliWhoami",
   "cliDoctor"
 ];
+var DEFAULT_SUBTASK_REFERENCE_NOLO_WORKSPACE_TOOLS = [
+  "readDialog",
+  "queryDialogsBySubjectRef",
+  "readDoc",
+  "queryTableRows"
+];
+function applyToolSurfaceConstraints(surface, constraints) {
+  const allowed = constraints.allowedToolNames == null ? null : new Set(asTrimmedNonEmptyStringArray(constraints.allowedToolNames));
+  const blocked = new Set(asTrimmedNonEmptyStringArray(constraints.blockedToolNames ?? []));
+  const narrow = (names) => names.filter(
+    (name) => (allowed === null || allowed.has(name)) && !blocked.has(name)
+  );
+  return {
+    ...surface,
+    explicitToolNames: narrow(surface.explicitToolNames),
+    injectedToolNames: narrow(surface.injectedToolNames),
+    finalToolNames: narrow(surface.finalToolNames)
+  };
+}
 function uniqueToolNames(values) {
   return [...new Set(asTrimmedNonEmptyStringArray(values))];
 }
@@ -75,21 +80,29 @@ function explicitOnlyReason(args) {
 function resolveRuntimeToolSurface(args) {
   const explicitToolNames = uniqueToolNames(args.explicitToolNames ?? []);
   if (canInjectPrivateDefaults(args)) {
-    const injectedToolNames = [...DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS];
+    const baseInjected = args.injectPrivateDefaults === false ? args.defaultInjectedToolNames ?? DEFAULT_SUBTASK_REFERENCE_NOLO_WORKSPACE_TOOLS : args.defaultInjectedToolNames ?? DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS;
+    const injectedToolNames2 = uniqueToolNames([
+      ...baseInjected,
+      ...args.additionalRequiredToolNames ?? []
+    ]);
     return {
       explicitToolNames,
-      injectedToolNames,
+      injectedToolNames: injectedToolNames2,
       finalToolNames: uniqueToolNames([
         ...explicitToolNames,
-        ...injectedToolNames
+        ...injectedToolNames2
       ]),
       auditReason: "private-authenticated-defaults"
     };
   }
+  const injectedToolNames = uniqueToolNames(args.additionalRequiredToolNames ?? []);
   return {
     explicitToolNames,
-    injectedToolNames: [],
-    finalToolNames: explicitToolNames,
+    injectedToolNames,
+    finalToolNames: uniqueToolNames([
+      ...explicitToolNames,
+      ...injectedToolNames
+    ]),
     auditReason: explicitOnlyReason(args)
   };
 }
@@ -116,7 +129,10 @@ function resolveRuntimeToolSurfaceForAgent(args) {
     agentOwnerId: inferredOwnerId,
     invocationVisibility: visibility,
     runtimeHost: args.runtimeHost,
-    trustedPrivateInvocation: args.trustedPrivateInvocation
+    trustedPrivateInvocation: args.trustedPrivateInvocation,
+    injectPrivateDefaults: args.injectPrivateDefaults,
+    defaultInjectedToolNames: args.defaultInjectedToolNames,
+    additionalRequiredToolNames: args.additionalRequiredToolNames
   });
 }
 var SECRET_FIELD_NAMES = [
@@ -146,6 +162,20 @@ function redactAgentRecordForWorkspaceTool(record) {
   return redacted;
 }
 
+// packages/agent-runtime/agentRecordKeys.ts
+function buildAgentRuntimeAgentLookupKeys(args) {
+  if (/^agent(-pub)?-/.test(args.agentRef)) {
+    return [args.agentRef];
+  }
+  return [
+    ownedAgentKey(args.userId, args.agentRef),
+    publicAgentKey(args.agentRef)
+  ];
+}
+function shouldFetchAgentRuntimeRecordRemotely(dbKey) {
+  return /^agent(-pub)?-/.test(dbKey);
+}
+
 // packages/ai/agent/agentSelectionPriority.ts
 function parseAgentTimestamp(value) {
   if (typeof value === "number" && Number.isFinite(value)) return value;
@@ -181,16 +211,26 @@ function compareAgentSelection(left, right) {
   const rightUpdated = parseAgentTimestamp(right.updatedAt ?? right.createdAt);
   return rightUpdated - leftUpdated;
 }
-var AGENT_SELECTION_PRIORITY_INSTRUCTIONS = `   - \u4F18\u5148\u7EA7\u5951\u7EA6\uFF08\u4E0E\u5217\u8868\u6392\u5E8F\u771F\u503C\u4E25\u683C\u4E00\u81F4\uFF09\uFF1A
-     1. \u6536\u85CF\u7684 OAuth / \u81EA\u5B9A\u4E49 Agent\uFF08isFavorite=true \u4E14 isOAuth=true \u6216 apiSource="custom"\uFF1A\u79C1\u6709\u8BA2\u9605/\u51ED\u636E\u4F18\u5148\uFF0C\u4E0D\u70E7\u5E73\u53F0 credits\uFF09
-     2. \u5176\u4ED6\u6536\u85CF Agent\uFF08isFavorite=true\uFF09
-     3. \u672A\u6536\u85CF\u7684 OAuth / \u81EA\u5B9A\u4E49 Agent\uFF08isOAuth=true \u6216 apiSource="custom"\uFF09
-     4. \u5176\u4ED6\u81EA\u5EFA Agent\uFF08isOwned=true\uFF09
-     5. \u516C\u5F00 / \u5E73\u53F0 Agent\uFF08apiSource="platform" \u6216\u793E\u533A\u516C\u5F00\uFF09
-     \u540C\u6863\u4F4D\u4E0B\u6536\u85CF\u9879\u6309\u6700\u8FD1\u6536\u85CF\uFF08favoritedAt\uFF09\u4F18\u5148\uFF0C\u5176\u4F59\u6309\u6700\u8FD1\u66F4\u65B0\uFF08updatedAt\uFF09\u4F18\u5148\u3002
-   - \u6536\u85CF\u4F18\u5148\u786C\u95E8\uFF08\u7528\u6237\u94A6\u5B9A\uFF0C\u8986\u76D6\u9876\u6863\u6210\u672C\u95E8\uFF09\uFF1A\u7981\u6B62\u5728\u6536\u85CF Agent \u53EF\u7528\u65F6\u6D3E\u5E73\u53F0\u901A\u9053\u3002\u6536\u85CF\u7684 OAuth/\u81EA\u5B9A\u4E49 Agent \u8D70\u7528\u6237\u79C1\u6709\u8BA2\u9605/\u51ED\u636E\uFF0C\u5373\u4F7F\u662F\u9876\u6863\u6A21\u578B\uFF08Opus\u3001GPT-5.6 \u7EA7\uFF09\u4E5F\u4E0D\u6784\u6210\u6210\u672C\u56DE\u907F\u7406\u7531\u3002\u6BCF\u6B21 startAgentRun \u90FD\u521B\u5EFA\u72EC\u7ACB\u7684 run/dialog\uFF1B\u5E76\u884C\u6D3E\u53D1\u65F6\u5FC5\u987B\u7528\u5404\u81EA\u7684 runId\uFF0C\u5E76\u7528 batchId \u7BA1\u7406\u6279\u6B21\uFF0C\u907F\u514D\u7F16\u6392\u5C42\u6DF7\u6DC6\u7ED3\u679C\u3002\u4EC5\u5F53\u6536\u85CF Agent \u786E\u8BA4\u4E0D\u53EF\u7528\u540E\u624D\u5141\u8BB8\u6D3E\u5E73\u53F0 Agent\uFF0C\u4E14\u5FC5\u987B\u5F53\u6B21\u544A\u77E5\u7528\u6237\u5C06\u6D88\u8017\u5E73\u53F0\u79EF\u5206\u3002
+var AGENT_SELECTION_PRIORITY_INSTRUCTIONS = `   - \u4F18\u5148\u7EA7\u5951\u7EA6\uFF1A\u4E24\u9636\u6BB5\u53D1\u73B0\u4E0E\u9009\u4EBA\u5951\u7EA6\uFF08listAgents \u9ED8\u8BA4 scope="preferred"\uFF09\uFF1A
+     1. \u9996\u8F6E\u53D1\u73B0\uFF1A\u9ED8\u8BA4\u8C03\u7528 listAgents()\uFF08\u5373 scope="preferred"\uFF09\uFF0C\u4EC5\u53D1\u73B0\u7528\u6237\u5DF2\u6709\u5173\u7CFB\u7684 preferred Agent\uFF08\u6536\u85CF\u3001\u81EA\u6709\u3001OAuth \u8BA2\u9605\u3001\u81EA\u5B9A\u4E49 API\u3001\u672C\u5730 Agent\uFF09\u3002
+     2. \u6210\u672C\u5F52\u5C5E\u8BC6\u522B\uFF1A\u6839\u636E billingSource \u660E\u786E\u5224\u5B9A\uFF08user_subscription\uFF1A\u7528\u6237\u8BA2\u9605/OAuth\uFF1Buser_api\uFF1A\u7528\u6237\u81EA\u5B9A\u4E49 API\uFF1Blocal\uFF1A\u672C\u5730\u8FD0\u884C\uFF1Bplatform_credits\uFF1A\u5E73\u53F0\u79EF\u5206\uFF09\u3002
+     3. \u4F18\u5148\u7EA7\u6392\u5E8F\uFF08\u4E0E\u5217\u8868\u6392\u5E8F\u771F\u503C\u4E00\u81F4\uFF09\uFF1A
+        (1) \u6536\u85CF\u7684 OAuth / \u81EA\u5B9A\u4E49 Agent\uFF08billingSource="user_subscription" \u6216 "user_api"\uFF0CisFavorite=true\uFF1A\u79C1\u6709\u8BA2\u9605/\u51ED\u636E\u4F18\u5148\uFF09
+        (2) \u5176\u4ED6\u6536\u85CF Agent\uFF08isFavorite=true\uFF09
+        (3) \u672A\u6536\u85CF\u7684 OAuth / \u81EA\u5B9A\u4E49 Agent\uFF08billingSource="user_subscription" \u6216 "user_api"\uFF09
+        (4) \u5176\u4ED6\u81EA\u5EFA Agent\uFF08isOwned=true\uFF09
+        (5) \u516C\u5F00 / \u5E73\u53F0 Agent\uFF08billingSource="platform_credits" \u6216\u793E\u533A\u516C\u5F00\uFF09
+        \u540C\u6863\u4F4D\u4E0B\u6536\u85CF\u9879\u6309\u6700\u8FD1\u6536\u85CF\uFF08favoritedAt\uFF09\u4F18\u5148\uFF0C\u5176\u4F59\u6309\u6700\u8FD1\u66F4\u65B0\uFF08updatedAt\uFF09\u4F18\u5148\u3002
+     4. \u516C\u5F00 Agent \u53D1\u73B0\uFF1A\u4EC5\u5F53 preferred \u5217\u8868\u4E2D\u6CA1\u6709\u9002\u5408\u4E14\u53EF\u7528\u7684\u5019\u9009\uFF0C\u6216\u7528\u6237\u660E\u786E\u8981\u6C42\u63A2\u7D22\u516C\u5F00 Agent \u65F6\uFF0C\u624D\u663E\u5F0F\u8C03\u7528 listAgents({ scope: "public" })\u3002\u516C\u5F00 Agent \u53EF\u80FD\u6D88\u8017 platform_credits\uFF0C\u5FC5\u987B\u5728\u83B7\u5F97\u7528\u6237\u660E\u786E\u6263\u8D39\u6388\u6743\u540E\u624D\u80FD\u8C03\u7528\u3002
+   - \u6536\u85CF\u4F18\u5148\u786C\u95E8\uFF08\u7528\u6237\u94A6\u5B9A\uFF0C\u8986\u76D6\u9876\u6863\u6210\u672C\u95E8\uFF09\uFF1A\u5F53\u5B58\u5728\u53EF\u7528\u4E14\u9002\u5408\u4EFB\u52A1\u7684\u6536\u85CF user_subscription / user_api / local Agent \u65F6\uFF0C\u7981\u6B62\u6539\u6D3E platform_credits\u3002favorite + platform_credits \u53EA\u8868\u793A\u7528\u6237\u8868\u8FBE\u8FC7\u504F\u597D\u5E76\u56E0\u6B64\u8FDB\u5165 preferred discovery\uFF0C\u4E0D\u4EE3\u8868\u514D\u8D39\u6216\u514D\u6388\u6743\uFF1B\u4F7F\u7528\u5B83\u4ECD\u987B\u9075\u5B88\u5E73\u53F0\u79EF\u5206\u6263\u8D39\u544A\u77E5/\u6388\u6743\u89C4\u5219\u3002\u6BCF\u6B21 startAgentRun \u90FD\u521B\u5EFA\u72EC\u7ACB\u7684 run/dialog\uFF1B\u5E76\u884C\u6D3E\u53D1\u65F6\u5FC5\u987B\u7528\u5404\u81EA\u7684 runId\uFF0C\u5E76\u7528 batchId \u7BA1\u7406\u6279\u6B21\uFF0C\u907F\u514D\u7F16\u6392\u5C42\u6DF7\u6DC6\u7ED3\u679C\u3002\u4EC5\u5F53\u6536\u85CF Agent \u786E\u8BA4\u4E0D\u53EF\u7528\u540E\u624D\u5141\u8BB8\u6D3E\u5E73\u53F0 Agent\uFF0C\u4E14\u5FC5\u987B\u5F53\u6B21\u544A\u77E5\u7528\u6237\u5C06\u6D88\u8017\u5E73\u53F0\u79EF\u5206\u3002
    - \u5339\u914D\u53C2\u8003\uFF1A\u6309\u4EFB\u52A1\u6240\u9700\u80FD\u529B\u7B5B tools \u5B57\u6BB5\uFF1B\u540C\u6863\u5019\u9009\u4F18\u5148\u6210\u672C\u4F4E\uFF08\u4F4E inputPrice\uFF09\u6216\u8D70\u7528\u6237\u79C1\u6709\u51ED\u636E\u7684\u901A\u9053\u3002tools \u5B57\u6BB5\u53EA\u53CD\u6620\u989D\u5916\u80FD\u529B\uFF0C\u4E0D\u53CD\u6620 coding \u80FD\u529B\u2014\u2014\u4EE3\u7801\u5DE5\u5177\u7531 host \u81EA\u52A8\u6CE8\u5165\uFF0Ctools=[] \u4E0D\u4EE3\u8868\u4E0D\u80FD\u5199\u4EE3\u7801\uFF0C\u4E0D\u8981\u636E\u6B64\u6392\u9664\u5019\u9009\u3002
-   - 429 \u9650\u6D41\u4E0E\u77E5\u60C5\u6743\u5951\u7EA6\uFF1A\u4EFB\u4F55\u7528\u6237\u79C1\u6709\u51ED\u636E\u4E0E\u81EA\u5EFA Agent\uFF08isOwned=true\u3001isOAuth=true \u6216 apiSource="custom" \u4E4B\u4E00\uFF09\u51FA\u73B0\u5728 listAgents \u7684 unavailableAgents\uFF08429 \u51B7\u5374\u671F\uFF09\u4E2D\u65F6\uFF0C\u7981\u6B62\u9759\u9ED8\u8DF3\u8FC7\uFF1B\u6539\u6D3E\u5E73\u53F0 Agent\uFF08\u6D88\u8017\u5E73\u53F0\u79EF\u5206\uFF09\u524D\u5FC5\u987B\u5728\u56DE\u590D\u4E2D\u544A\u77E5\u7528\u6237\uFF1A\u54EA\u4E2A\u8BA2\u9605/\u81EA\u5EFA agent \u9650\u6D41\u3001\u9884\u8BA1\u4F55\u65F6\u6062\u590D\uFF08nextAvailableAt\uFF09\u3001\u672C\u6B21\u5C06\u6263\u5E73\u53F0\u79EF\u5206\uFF1B\u4EFB\u52A1\u4E0D\u7D27\u6025\u5EFA\u8BAE\u7B49\u6062\u590D\u6216\u8BE2\u95EE\u7528\u6237\u3002`;
+   - isOwned=true\u3001isOAuth=true \u6216 apiSource="custom" \u7684\u5019\u9009\u6309\u4F18\u5148\u7EA7\u5951\u7EA6\u5904\u7406\u3002
+   - qualityContext \u662F task-domain-specific supporting evidence\uFF1A\u53EA\u5728\u5339\u914D\u7684 task domain \u5185\u3001suitable candidates \u4E2D\uFF0C\u5E76\u4E14\u4ECD\u6392\u5728\u73B0\u6709\u4F18\u5148\u7EA7 / \u6210\u672C / \u53EF\u7528\u6027\u89C4\u5219\u4E4B\u540E\u53C2\u8003\u3002
+     \u6BCF\u884C\u5F62\u5982 \`dimension [direction] (benchmark version): model=score\`\u3002\u6BCF\u4E2A dimension\uFF08preference / rubric / slop / repetition / length / task_success \u7B49\uFF09\u90FD\u662F\u4E00\u6761\u72EC\u7ACB evidence\uFF0C\u4E0D\u662F\u603B\u5206\u7684\u4E00\u90E8\u5206\u3002
+     direction \u53EA\u662F\u6307\u6807\u65B9\u5411\uFF1Ahigher_better \u8D8A\u9AD8\u8D8A\u597D\uFF0Clower_better \u8D8A\u4F4E\u8D8A\u597D\uFF0Cneutral \u53EA\u63CF\u8FF0\u884C\u4E3A\u7279\u5F81\uFF08\u5982\u8F93\u51FA\u957F\u5EA6\uFF09\uFF0C\u4E0D\u4EE3\u8868\u4F18\u52A3\u3002
+     \u7981\u6B62\u628A\u4E0D\u540C dimension \u76F8\u52A0 / \u5E73\u5747 / \u5F52\u4E00\u5316\uFF0C\u6216\u751F\u6210 overall score / winner / rank\uFF1B\u7981\u6B62\u8DE8 benchmark identity \u6BD4\u8F83 raw score\uFF1B\u540C\u4E00 dimension \u5185\u53EA\u6BD4\u8F83\u540C\u4E00\u884C\u7684\u540C\u7C7B benchmark evidence\u3002
+     \u672A\u5217\u51FA\u7684 model \u6216 dimension \u8868\u793A\u6CA1\u6709 curated evidence\uFF1A\u4E0D\u662F 0\uFF0C\u4E5F\u4E0D\u662F\u8F83\u5F31\u3002\u54EA\u4E9B dimension \u66F4\u91CD\u8981\u7531\u5F53\u524D\u4EFB\u52A1\u51B3\u5B9A\uFF0C\u4E0D\u8981\u5199\u6B7B\u6743\u91CD\u3002
+   - 429 \u9650\u6D41\u4E0E\u77E5\u60C5\u6743\u5951\u7EA6\uFF1A\u4EFB\u4F55\u7528\u6237\u79C1\u6709\u51ED\u636E\u4E0E\u81EA\u5EFA Agent\uFF08billingSource \u4E3A user_subscription / user_api / local\uFF0C\u6216 isOwned=true\uFF09\u51FA\u73B0\u5728 listAgents \u7684 unavailableAgents\uFF08429 \u51B7\u5374\u671F\uFF09\u4E2D\u65F6\uFF0C\u7981\u6B62\u9759\u9ED8\u8DF3\u8FC7\uFF1B\u6539\u6D3E\u5E73\u53F0 Agent\uFF08\u6D88\u8017\u5E73\u53F0\u79EF\u5206\uFF09\u524D\u5FC5\u987B\u5728\u56DE\u590D\u4E2D\u544A\u77E5\u7528\u6237\uFF1A\u54EA\u4E2A\u8BA2\u9605/\u81EA\u5EFA agent \u9650\u6D41\u3001\u9884\u8BA1\u4F55\u65F6\u6062\u590D\uFF08nextAvailableAt\uFF09\u3001\u672C\u6B21\u5C06\u6263\u5E73\u53F0\u79EF\u5206\uFF1B\u4EFB\u52A1\u4E0D\u7D27\u6025\u5EFA\u8BAE\u7B49\u6062\u590D\u6216\u8BE2\u95EE\u7528\u6237\u3002`;
 
 // packages/agent-runtime/noloWorkspaceTools.ts
 var NOLO_WORKSPACE_TOOL_NAMES = [
@@ -273,10 +313,12 @@ function buildNoloWorkspaceOpenAiTools(args) {
       description: "Confirmed dialog ids or dbKeys to delete."
     }
   }, ["query"]);
-  add("listAgents", "List the current user's agents with runnable agentKey for delegation. Copy the agentKey verbatim; do not infer it from the display name. Agents currently rate-limited (429) are hidden by default and summarized in `unavailableAgents` with `unavailableCount`; pass showUnavailable: true to include them in `agents`.", {
-    space: stringToolParam("Optional space id or URL."),
-    publicOnly: { type: "boolean", description: "Only show public agents." },
-    showUnavailable: { type: "boolean", description: "Include agents currently rate-limited (429). Default false." }
+  add("listAgents", "List agents for delegation. Default scope='preferred' returns the user's favorites, owned, OAuth, custom API, and local agents only; scope='public' discovers shared/marketplace agents; scope='all' returns their deduplicated union. Public agents may consume platform credits. Copy the agentKey verbatim; use the runnable agentKey exactly and do not infer it from the display name. publicOnly is deprecated compatibility for scope='public'. Rate-limited agents are hidden unless showUnavailable is true.", {
+    scope: { type: "string", enum: ["preferred", "public", "all"], description: "Discovery scope; preferred is the default and does not load the public marketplace." },
+    publicOnly: { type: "boolean", description: "Deprecated compatibility alias for scope='public'." },
+    showUnavailable: { type: "boolean", description: "Include agents currently rate-limited (429). Default false." },
+    verbose: { type: "boolean", description: "Return full safe-summary details when supported." },
+    space: stringToolParam("Optional space id or URL.")
   });
   add("readAgent", "Read one agent's full config by exact agentKey returned by listAgents (agent-<userId>-<id> or agent-pub-<id>); do not use the display name.", {
     agent: stringToolParam("Exact agentKey from listAgents (preferred; copy verbatim; plain id or URL are compatibility fallbacks).")
@@ -600,7 +642,11 @@ function buildNoloWorkspaceCommandArgs(call) {
       const cliArgs = ["agent", "list"];
       const space = noloStringArg(args.space);
       if (space) cliArgs.push("--space", space);
+      const scope = noloStringArg(args.scope);
+      if (scope) cliArgs.push("--scope", scope);
       if (args.publicOnly === true) cliArgs.push("--public-only");
+      if (args.showUnavailable === true) cliArgs.push("--show-unavailable");
+      if (args.verbose === true) cliArgs.push("--verbose");
       cliArgs.push("--json", "--safe");
       return cliArgs;
     }
@@ -666,12 +712,13 @@ function buildNoloWorkspaceCommandArgs(call) {
 }
 
 export {
+  applyToolSurfaceConstraints,
+  resolveRuntimeToolSurfaceForAgent,
+  redactAgentRecordForWorkspaceTool,
   compareAgentSelection,
   AGENT_SELECTION_PRIORITY_INSTRUCTIONS,
   buildAgentRuntimeAgentLookupKeys,
   shouldFetchAgentRuntimeRecordRemotely,
-  resolveRuntimeToolSurfaceForAgent,
-  redactAgentRecordForWorkspaceTool,
   NOLO_WORKSPACE_TOOL_NAMES,
   buildNoloWorkspaceOpenAiTools,
   noloPositiveIntegerString,

package/{chunk-MYMBBB6Q.js → chunk-RVWRKFUB.js}

@@ -4,12 +4,14 @@ import {
 import {
   patch,
   read
-} from "./chunk-7NYDJAQ7.js";
+} from "./chunk-DNNSCSA2.js";
 import {
   DEVICE_LOCAL_OWNER_ID,
-  isDeviceLocalSpaceBody,
+  isDeviceLocalSpaceBody
+} from "./chunk-KWSQR2KK.js";
+import {
   selectIdentityUserId
-} from "./chunk-XOJRZUPF.js";
+} from "./chunk-SEJ5OS6F.js";
 
 // packages/create/space/utils/permissions.ts
 var checkSpaceMembership = (spaceData, userId) => {

package/{chunk-43CXXVJD.js → chunk-RXX4GDIH.js}

@@ -4,7 +4,7 @@ import {
 
 // packages/cli/agentCommandSupport.ts
 async function getDefaultCliDb() {
-  const { getDefaultCliLocalRuntimeDb } = await import("./localRuntimeDb-PF7CFKDL.js");
+  const { getDefaultCliLocalRuntimeDb } = await import("./localRuntimeDb-P37ZTX55.js");
   return getDefaultCliLocalRuntimeDb();
 }
 function createNullCliDb() {

package/chunk-SEJ5OS6F.js

@@ -0,0 +1,49 @@
+// packages/identity/sessionSource.ts
+var IDENTITY_SESSION_READER = Symbol.for(
+  "nolo.identity.sessionReader"
+);
+var moduleFallbackReader = null;
+function getBoundSessionSnapshot() {
+  return moduleFallbackReader?.() ?? null;
+}
+function getSessionSnapshotForState(state) {
+  const reader = state?.[IDENTITY_SESSION_READER];
+  if (typeof reader === "function") {
+    return reader();
+  }
+  return getBoundSessionSnapshot();
+}
+
+// packages/identity/selectors.local.ts
+var LOCAL_USER_ID = (typeof process !== "undefined" ? process.env?.NOLO_LOCAL_USER_ID : void 0) || (typeof process !== "undefined" ? process.env?.NOLO_USER_ID : void 0) || "local";
+var LOCAL_USER = {
+  userId: LOCAL_USER_ID,
+  username: "Local User"
+};
+var selectIdentityUserId = (state) => {
+  const snapshot = getSessionSnapshotForState(state);
+  if (snapshot) return snapshot.activeAccountId ?? void 0;
+  return LOCAL_USER_ID;
+};
+var selectIdentityToken = (state) => {
+  return getSessionSnapshotForState(state)?.activeToken ?? void 0;
+};
+var selectIdentityUser = (state) => {
+  const snapshot = getSessionSnapshotForState(state);
+  if (snapshot) {
+    const active = snapshot.accounts.find(
+      (account) => account.userId === snapshot.activeAccountId
+    );
+    return active ?? null;
+  }
+  return LOCAL_USER;
+};
+var selectIdentityUserBalance = (state) => void 0;
+
+export {
+  getSessionSnapshotForState,
+  selectIdentityUserId,
+  selectIdentityToken,
+  selectIdentityUser,
+  selectIdentityUserBalance
+};

package/{chunk-JXIP6ZWH.js → chunk-SKIRVYEI.js}

@@ -1,16 +1,19 @@
 import {
   createCliLocalRuntimeAdapter,
   summarizeEndpoint
-} from "./chunk-5FCIPEKT.js";
+} from "./chunk-Z5MHFBJZ.js";
 import {
   clipMultilineText
-} from "./chunk-TR4DXUYX.js";
+} from "./chunk-CQ2OZMLQ.js";
 import {
   runLocalAgentTurn
-} from "./chunk-EJE33XNR.js";
+} from "./chunk-KSCXMC6U.js";
+import {
+  applyToolSurfaceConstraints
+} from "./chunk-RJ2SAFB5.js";
 import {
   resolveLocalRuntimeEnvFromPolicy
-} from "./chunk-CS6TCJ7E.js";
+} from "./chunk-3JQ2NRYU.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -431,12 +434,21 @@ async function defaultRunConnectorLocalRuntimeAgent(args) {
   const agentConfigRaw = readField(payload, "agentConfig");
   const payloadAgentConfig = asRecordOrEmpty(agentConfigRaw);
   const policy = runtimePolicyFromConnectorPayload(args.parsed);
-  const toolNames = mergeToolNames(
+  const candidateToolNames = mergeToolNames(
     readField(payloadAgentConfig, "toolNames"),
     readField(payloadAgentConfig, "tools"),
     policy?.agentTools,
     policy?.runtimeTools
   );
+  const runtimeContext = asRecordOrEmpty(readField(payload, "runtimeContext"));
+  const constrainedSurface = applyToolSurfaceConstraints(
+    { explicitToolNames: candidateToolNames, injectedToolNames: [], finalToolNames: candidateToolNames },
+    {
+      allowedToolNames: Array.isArray(readField(runtimeContext, "allowedToolNames")) ? readField(runtimeContext, "allowedToolNames") : void 0,
+      blockedToolNames: Array.isArray(readField(runtimeContext, "blockedToolNames")) ? readField(runtimeContext, "blockedToolNames") : void 0
+    }
+  );
+  const toolNames = constrainedSurface.finalToolNames;
   const apiSourceRaw = readField(payloadAgentConfig, "apiSource");
   const providerRaw = readField(payloadAgentConfig, "provider");
   const agentRecord = {
@@ -447,6 +459,7 @@ async function defaultRunConnectorLocalRuntimeAgent(args) {
     apiSource: typeof apiSourceRaw === "string" ? apiSourceRaw : "platform",
     provider: typeof providerRaw === "string" ? providerRaw : typeof apiSourceRaw === "string" ? apiSourceRaw : "openai",
     toolNames,
+    runScopedToolSurface: constrainedSurface,
     ...policy ? { runtimeToolPolicy: policy } : {}
   };
   const dispatchUserId = String(args.runtimeEnv.NOLO_USER_ID || "local");

package/{chunk-SAJSBPI2.js → chunk-SOJM57FX.js}

@@ -1,10 +1,13 @@
 import {
   getRuntimeServerContext,
   scheduleDeleteReplication
-} from "./chunk-XOJRZUPF.js";
+} from "./chunk-KWSQR2KK.js";
 import {
   fetchFromClientDb
 } from "./chunk-QOKAKDPE.js";
+import {
+  selectIdentityToken
+} from "./chunk-SEJ5OS6F.js";
 import {
   buildTombstoneRecord
 } from "./chunk-GBRG75BQ.js";
@@ -191,7 +194,7 @@ var removeAction = async (payload, thunkApi) => {
     preferredServerOrigin,
     currentServer,
     syncServers,
-    hasToken: Boolean(state?.auth?.currentToken)
+    hasToken: Boolean(selectIdentityToken(state))
   });
   const localData = await fetchFromClientDb(clientDb, dbKey);
   const hadLocalData = Boolean(localData);

package/{chunk-EKLRRZIN.js → chunk-SPAQ4PVV.js}

@@ -10,8 +10,6 @@ import {
 var CURRENT_OPERATOR_USER_ID = "0e95801d90";
 var NOLO_DEFAULT_AGENT_ID = "01NOLOAPPBLD000000019KCKT0";
 var NOLO_DEFAULT_AGENT_KEY = publicAgentKey(NOLO_DEFAULT_AGENT_ID);
-var NOLO_PROJECT_MANAGER_AGENT_ID = "01NOLOPROJMGR00000000MSVGG";
-var NOLO_PROJECT_MANAGER_AGENT_KEY = ownedAgentKey(CURRENT_OPERATOR_USER_ID, NOLO_PROJECT_MANAGER_AGENT_ID);
 var NOLO_FRONTEND_AGENT_ID = "01FRONTENDAG0000000115N4E1";
 var NOLO_FRONTEND_AGENT_KEY = ownedAgentKey(CURRENT_OPERATOR_USER_ID, NOLO_FRONTEND_AGENT_ID);
 var LOCAL_CODEX_AGENT_ID = "01LOCALCODEXCLI000000NEW";
@@ -27,8 +25,6 @@ var AGENT_ALIAS_TO_KEY = {
   "frontend agent": NOLO_FRONTEND_AGENT_KEY,
   "\u524D\u7AEFagent": NOLO_FRONTEND_AGENT_KEY,
   "\u524D\u7AEF agent": NOLO_FRONTEND_AGENT_KEY,
-  "project-manager": NOLO_PROJECT_MANAGER_AGENT_KEY,
-  pm: NOLO_PROJECT_MANAGER_AGENT_KEY,
   // Explicit local CLI agents. These are ordinary private agent records that
   // run through the current computer local runtime when unbound.
   "local-codex": LOCAL_CODEX_AGENT_KEY,
@@ -55,7 +51,6 @@ function isLocalCliAgentKey(agentKey) {
 export {
   NOLO_DEFAULT_AGENT_ID,
   NOLO_DEFAULT_AGENT_KEY,
-  NOLO_PROJECT_MANAGER_AGENT_KEY,
   LOCAL_CODEX_AGENT_ID,
   LOCAL_CODEX_AGENT_KEY,
   resolveCliAgentKeyInput,

package/{chunk-RHMDMTDK.js → chunk-SYNKICCB.js}

@@ -1,13 +1,13 @@
 import {
   i18n_default,
   toolRegistry
-} from "./chunk-TR4DXUYX.js";
+} from "./chunk-CQ2OZMLQ.js";
 import {
   canonicalizeToolNames
 } from "./chunk-O6OSWFZQ.js";
 import {
   isNoloHostedProvider
-} from "./chunk-HPW5MNDQ.js";
+} from "./chunk-22BTGNSP.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";