nolo-cli 0.54.0 → 0.61.0-alpha.3

package/{chunk-5FCIPEKT.js → chunk-Z5MHFBJZ.js}

@@ -4,10 +4,27 @@ import {
   refreshAntigravityOAuthToken,
   refreshOpenAiCodexToken,
   xaiRefresh
-} from "./chunk-NFLA6GSU.js";
+} from "./chunk-MXUDQZXQ.js";
 import {
   defaultLoopbackRequest
 } from "./chunk-EADNWBAZ.js";
+import {
+  ackRunRecord,
+  appendRunQueue,
+  checkStaleRun,
+  claimRunRecord,
+  commitRunRecordClaim,
+  findRunRecord,
+  gcRunRecords,
+  popAllQueueEntries,
+  queryRunRecords,
+  releaseRunRecordAck,
+  serializeQueueEntries,
+  spawnLocalBackgroundRun,
+  terminateRunProcess,
+  transitionRunToTerminal,
+  withQueueLock
+} from "./chunk-45YO6H7P.js";
 import {
   clearCredentialAvailability,
   markCredentialUnavailable,
@@ -15,57 +32,33 @@ import {
   readCredentialEntry,
   recordCredentialProbe,
   resolveCredentialKeyWithFallback
-} from "./chunk-NI2BS6UD.js";
+} from "./chunk-DWUCB2A3.js";
 import {
   buildLocalAgentLookupKeys
-} from "./chunk-JON2PHYT.js";
+} from "./chunk-CTCW7U7N.js";
 import {
   LOCAL_CODEX_AGENT_ID,
   LOCAL_CODEX_AGENT_KEY,
   NOLO_DEFAULT_AGENT_ID,
   NOLO_DEFAULT_AGENT_KEY
-} from "./chunk-EKLRRZIN.js";
+} from "./chunk-SPAQ4PVV.js";
 import {
   CliProviderQuotaError,
   executeCli
-} from "./chunk-JDSUTNYY.js";
-import {
-  ackRunRecord,
-  appendRunQueue,
-  checkStaleRun,
-  claimRunRecord,
-  commitRunRecordClaim,
-  finalizeRunRecord,
-  findRunRecord,
-  gcRunRecords,
-  popAllQueueEntries,
-  queryRunRecords,
-  releaseRunRecordAck,
-  resolveRunReportPath,
-  serializeQueueEntries,
-  spawnLocalBackgroundRun,
-  terminateRunProcess,
-  withQueueLock
-} from "./chunk-SSXTSPSG.js";
+} from "./chunk-MP64VFGD.js";
 import {
   inferCaptureIntent
-} from "./chunk-EICIFHVS.js";
+} from "./chunk-LAFC3B2I.js";
 import {
   buildCliPrompt
 } from "./chunk-ATNTHIZI.js";
 import {
   inlineImageUrlsForCustomProvider,
   prepareTools
-} from "./chunk-RHMDMTDK.js";
+} from "./chunk-SYNKICCB.js";
 import {
   getServerProviderSecret
 } from "./chunk-HS7MLR74.js";
-import {
-  getAntigravityUserAgent,
-  isAntigravityOAuthAgent,
-  readAntigravityProjectId,
-  resolveAntigravityCloudCodeBaseUrl
-} from "./chunk-BG7J6Y5X.js";
 import {
   CONTROL_AGENT_RUN_ACTIONS,
   buildControlAgentRunFunctionSchema,
@@ -79,7 +72,7 @@ import {
   rememberMemoryFunctionSchema,
   resolveAgentRequiredPackIds,
   setTodoListFunc
-} from "./chunk-TR4DXUYX.js";
+} from "./chunk-CQ2OZMLQ.js";
 import {
   fetchWithTransientRetry,
   isTransientFetchError
@@ -95,26 +88,26 @@ import {
   isAgentRunTerminalStatus,
   resolveRunLabel,
   shortRunId
-} from "./chunk-KXKQO4Q6.js";
+} from "./chunk-NTW5GWDM.js";
 import {
   applyBuiltinAgentRuntimeOverride,
   applyTokenUsageToDayStats,
   prepareTokenUsageData,
   resolveBuiltinPlatformAgentConfig,
   runKeyed
-} from "./chunk-YBFJQC2M.js";
+} from "./chunk-TBHAHL33.js";
 import {
   BUILTIN_TITLE_LLM_CONFIG
 } from "./chunk-EVBFYPDC.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-TC6P4NDR.js";
+} from "./chunk-F44FAXP2.js";
 import {
   require_date_fns
 } from "./chunk-M76ECQRD.js";
 import {
   getDefaultCliLocalRuntimeDb
-} from "./chunk-IA3A5373.js";
+} from "./chunk-C3FZR5EC.js";
 import {
   FORCED_TOOLS,
   addDefaultLightWebToolsForConfiguredAgents,
@@ -124,10 +117,16 @@ import {
   applySystemBuiltinSkillFilter,
   expandEnabledPacks,
   resolveEffectiveEnabledPacks
-} from "./chunk-O5FLGN2L.js";
+} from "./chunk-ZRSJ3JEH.js";
 import {
   DEFAULT_HYBRID_READ_TIMEOUT_MS,
+  Duration_exports,
+  Effect_exports,
+  Exit_exports,
+  Option_exports,
+  accumulateGeminiChunks,
   aggregateResponsesStream,
+  buildGeminiGenerateContentRequest,
   buildLoadSkillExecutor,
   buildLocalDialogWritePlan,
   buildLocalWorkspaceOpenAiTools,
@@ -139,62 +138,77 @@ import {
   evaluateFileWritePolicy,
   executeLocalToolWithPolicy,
   executeOpenAiCompatibleChatCompletion,
+  fetchAntigravityCloudCodeCompletion,
   filterRetainedLedgerRecords,
   internalListWorkspaceEntries,
   internalSearchWorkspace,
+  isGemini3Model,
   isLineRangeCovered,
   localDialogMessageRecordToRuntimeMessage,
   parseSseDataLineJson,
   parseSseDataLineObject,
   parseSyncServersEnv,
+  parseUpstreamErrorBody,
+  resolveAntigravityFinishReason,
   resolveOpenAiCompatibleProviderConfig,
+  shouldUseGeminiNativeToolRoute,
   summarizeToolArguments
-} from "./chunk-EJE33XNR.js";
+} from "./chunk-KSCXMC6U.js";
 import {
+  PlatformStreamInterruptedError,
   buildPlatformChatCompletionRequest,
   canUsePlatformChatProvider,
-  collectStablePromptPrefix,
   hasDirectOpenAiCompatibleProvider,
   parsePlatformChatCompletionData,
   parsePlatformChatCompletionResponse,
   readPlatformChatSseCompletion,
   readSseDataValues,
   resolvePlatformChatProviderConfig,
-  shouldUsePlatformChatProvider,
-  stablePromptCacheKey,
-  streamSseDataValues
-} from "./chunk-3Y2K5O2R.js";
+  shouldUsePlatformChatProvider
+} from "./chunk-7A3RRUCQ.js";
 import {
   resolveAgentRuntimeConfigFromRecord,
   resolveHistoricalToolContentCap
-} from "./chunk-A65UV3M5.js";
+} from "./chunk-XOKOSO35.js";
 import {
+  collectStablePromptPrefix,
   convertMessagesToResponsesInput,
+  stablePromptCacheKey,
   toResponsesTools
-} from "./chunk-VZMUOPYG.js";
+} from "./chunk-XTJTN3RW.js";
+import {
+  isAntigravityOAuthAgent
+} from "./chunk-QEW2MFDQ.js";
 import {
   resolvePlatformAuthToken
-} from "./chunk-KLIBF3BY.js";
+} from "./chunk-RDBARW6T.js";
 import {
   buildNoloWorkspaceOpenAiTools,
   parseNoloWorkspaceToolArguments,
   resolveRuntimeToolSurfaceForAgent
-} from "./chunk-ZVOHVJI3.js";
+} from "./chunk-RJ2SAFB5.js";
 import {
   mergeAvailabilityDeadline,
   resolveAvailabilityAction,
   resolveCooldownGate
-} from "./chunk-IWUMSAQF.js";
+} from "./chunk-CJCJF5XB.js";
 import {
   buildDialogFallbackTitleFromUserInput,
   normalizeDialogTitle
 } from "./chunk-2MBTWINN.js";
 import {
-  clipCompactText
-} from "./chunk-BBTN4NQD.js";
+  clipCompactText,
+  createProviderCallTimingTracker,
+  finalizeProviderCallTiming,
+  observeMeaningfulProviderResponseAt,
+  withProviderCallTimingFields
+} from "./chunk-Z4QSJILV.js";
+import {
+  estimateTokenCount
+} from "./chunk-PSCNXBYA.js";
 import {
   isAdaptiveThinkingModelId
-} from "./chunk-SVDMVX4G.js";
+} from "./chunk-MMZ6ZTVO.js";
 import {
   compactWhitespace
 } from "./chunk-DWLEOOGR.js";
@@ -203,13 +217,13 @@ import {
   resolveCurrentRunRuntimeToolPolicy,
   resolveLocalWorkspaceExecutorOptionsFromPolicy,
   resolveRequestedRuntimeToolNames
-} from "./chunk-CS6TCJ7E.js";
+} from "./chunk-3JQ2NRYU.js";
 import {
   createOAuthTokenStore,
   isTokenExpired,
   readOAuthCredential,
   resolveFreshAccessToken
-} from "./chunk-FD36SCCD.js";
+} from "./chunk-ONXOABJR.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -229,21 +243,24 @@ import {
   createUserKey,
   dialogMessageRange
 } from "./chunk-NHRQCXIQ.js";
-import {
-  asTrimmedNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
 import {
   isSystemBuiltinTrustedAgentKey
-} from "./chunk-2WBFJHQA.js";
+} from "./chunk-L7B47JXR.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
 import {
   NOLO_CLUSTER_SERVERS
 } from "./chunk-LCBAMY2M.js";
+import {
+  isLoopbackUrl
+} from "./chunk-4SN6J65J.js";
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
@@ -360,11 +377,30 @@ function initCliLocale(env = process.env) {
 function newlineHint(platform = process.platform) {
   return platform === "win32" ? "Ctrl+J" : "Shift+Enter";
 }
+var WELCOME_TIPS = {
+  en: [
+    `Tip: ${newlineHint()} for a newline; /help lists all commands.`,
+    "Tip: paste a screenshot or drag an image into the terminal \u2014 nolo can see it.",
+    "Tip: /doc attach <doc> brings a doc into this conversation's context.",
+    "Tip: /theme switches colors; terminal mode follows your terminal's day/night.",
+    "Tip: /history resumes a recent dialog; /agents lists your agents."
+  ],
+  zh: [
+    `\u63D0\u793A\uFF1A${newlineHint()} \u6362\u884C\uFF1B/help \u5217\u51FA\u5168\u90E8\u547D\u4EE4\u3002`,
+    "\u63D0\u793A\uFF1A\u76F4\u63A5\u7C98\u8D34\u622A\u56FE\u6216\u628A\u56FE\u7247\u62D6\u8FDB\u7EC8\u7AEF\uFF0Cnolo \u770B\u5F97\u61C2\u3002",
+    "\u63D0\u793A\uFF1A/doc attach <doc> \u628A\u6587\u6863\u6302\u8FDB\u5F53\u524D\u5BF9\u8BDD\u7684\u4E0A\u4E0B\u6587\u3002",
+    "\u63D0\u793A\uFF1A/theme \u5207\u6362\u914D\u8272\uFF1Bterminal \u6A21\u5F0F\u8DDF\u968F\u7EC8\u7AEF\u7684\u65E5\u591C\u4E3B\u9898\u3002",
+    "\u63D0\u793A\uFF1A/history \u56DE\u5230\u6700\u8FD1\u5BF9\u8BDD\uFF1B/agents \u67E5\u770B\u53EF\u7528 Agent\u3002"
+  ]
+};
+function dailyWelcomeTip(now = Date.now()) {
+  const tips = WELCOME_TIPS[currentLocale];
+  const day = Math.floor(now / 864e5);
+  return tips[day % tips.length];
+}
 var STRINGS = {
-  welcomeHint: {
-    en: `Tell nolo what you want. Use /help for commands. ${newlineHint()} for newline.`,
-    zh: `\u544A\u8BC9 nolo \u4F60\u60F3\u8981\u4EC0\u4E48\u3002\u8F93\u5165 /help \u67E5\u770B\u547D\u4EE4\u3002${newlineHint()} \u6362\u884C\u3002`
-  },
+  // Welcome hint lives in WELCOME_TIPS + dailyWelcomeTip() (rotating daily
+  // tips); the composer placeholder already covers "type / for commands".
   promptLabel: {
     en: "\u276F ",
     zh: "\u276F "
@@ -617,6 +653,14 @@ var STRINGS = {
   // --- Tool trace copy ------------------------------------------------------
   // The compact trace shows only status, never timing or output size: a line
   // count told the user nothing actionable and the ms figure read as noise.
+  thinkingActive: {
+    en: "Thinking\u2026",
+    zh: "\u601D\u8003\u4E2D\u2026"
+  },
+  thinkingActivePreview: {
+    en: "Thinking: {0}",
+    zh: "\u601D\u8003\u4E2D\uFF1A{0}"
+  },
   thinkingTraceLine: {
     en: "\u273B Thought for {0}",
     zh: "\u273B \u601D\u8003 {0}"
@@ -878,7 +922,7 @@ var STRINGS = {
       "  /customize            Describe how you want to tune nolo",
       "  /tasks                List background process tasks (aliases: /jobs, /procs)",
       "  /stop <pid|all>       Stop background process tasks",
-      "  /login                Show login/profile hint",
+      "  /login                Show login/profile hint (/login --server <url> to log in here)",
       "  /profile              Show active profile",
       "  /update               Update the nolo CLI install",
       "  /version              Show version/update hint",
@@ -916,7 +960,7 @@ var STRINGS = {
       "  /customize            \u63CF\u8FF0\u4F60\u60F3\u600E\u4E48\u8C03\u6559 nolo",
       "  /tasks                \u5217\u51FA\u540E\u53F0\u5B50\u8FDB\u7A0B\u4EFB\u52A1\uFF08\u522B\u540D\uFF1A/jobs, /procs\uFF09",
       "  /stop <pid|all>       \u505C\u6B62\u6307\u5B9A\u7684\u540E\u53F0\u4EFB\u52A1",
-      "  /login                \u67E5\u770B\u767B\u5F55 / \u914D\u7F6E\u63D0\u793A",
+      "  /login                \u67E5\u770B\u767B\u5F55 / \u914D\u7F6E\u63D0\u793A\uFF08/login --server <url> \u53EF\u5728\u672C\u4F1A\u8BDD\u5185\u767B\u5F55\uFF09",
       "  /profile              \u67E5\u770B\u5F53\u524D\u914D\u7F6E\u73AF\u5883",
       "  /update               \u66F4\u65B0 nolo CLI",
       "  /version              \u67E5\u770B\u7248\u672C\u4E0E\u66F4\u65B0\u63D0\u793A",
@@ -1049,14 +1093,56 @@ Use /switch, /switch list, /switch minimax-m3, or a full agent key.`,
     en: "MVP login uses profile/env auth. Set AUTH_TOKEN, NOLO_SERVER, or NOLO_PROFILE before starting nolo.",
     zh: "MVP \u767B\u5F55\u8D70 profile/\u73AF\u5883\u53D8\u91CF\u8BA4\u8BC1\u3002\u542F\u52A8 nolo \u524D\u8BF7\u8BBE\u7F6E AUTH_TOKEN\u3001NOLO_SERVER \u6216 NOLO_PROFILE\u3002"
   },
+  loginTuiStart: {
+    en: "Or run `/login --server <url>` to log in right here (opens a browser authorization URL).",
+    zh: "\u4E5F\u53EF\u4EE5\u6267\u884C /login --server <url> \u76F4\u63A5\u5728\u8FD9\u91CC\u767B\u5F55\uFF08\u4F1A\u7ED9\u51FA\u6D4F\u89C8\u5668\u6388\u6743\u94FE\u63A5\uFF09\u3002"
+  },
+  loginUsage: {
+    en: "Usage: /login [--server <url>]. Unsupported flags: {0}",
+    zh: "\u7528\u6CD5\uFF1A/login [--server <url>]\u3002\u4E0D\u652F\u6301\u7684\u53C2\u6570\uFF1A{0}"
+  },
+  loginStarted: {
+    en: "Open this URL to authorize nolo-cli:\n{0}\nCode: {1}",
+    zh: "\u6253\u5F00\u8FD9\u4E2A\u94FE\u63A5\u6388\u6743 nolo-cli\uFF1A\n{0}\n\u6388\u6743\u7801\uFF1A{1}"
+  },
+  loginBrowserFailed: {
+    en: "Could not open a browser automatically. Paste the URL above into a browser.",
+    zh: "\u65E0\u6CD5\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u8BF7\u628A\u4E0A\u9762\u7684\u94FE\u63A5\u7C98\u8D34\u5230\u6D4F\u89C8\u5668\u91CC\u3002"
+  },
+  loginWaiting: {
+    en: "[nolo] Waiting for browser authorization ({0} remaining)... (Ctrl+C to cancel)",
+    zh: "[nolo] \u7B49\u5F85\u6D4F\u89C8\u5668\u6388\u6743\uFF08\u5269\u4F59 {0}\uFF09\u2026\u2026\u6309 Ctrl+C \u53D6\u6D88"
+  },
+  loginStillWaiting: {
+    en: "[nolo] Still waiting... ({0} remaining)",
+    zh: "[nolo] \u4ECD\u5728\u7B49\u5F85\u2026\u2026\uFF08\u5269\u4F59 {0}\uFF09"
+  },
+  loginSuccess: {
+    en: "Logged in. Token saved to profile; this session now uses it immediately.",
+    zh: "\u767B\u5F55\u6210\u529F\u3002Token \u5DF2\u5199\u5165 profile\uFF0C\u5F53\u524D\u4F1A\u8BDD\u7ACB\u5373\u751F\u6548\u3002"
+  },
+  loginFailed: {
+    en: "Login failed: {0}",
+    zh: "\u767B\u5F55\u5931\u8D25\uFF1A{0}"
+  },
+  loginTimeout: {
+    en: "Login timed out. Run /login again, or use `nolo login --token <jwt>` in a shell.",
+    zh: "\u767B\u5F55\u8D85\u65F6\u3002\u8BF7\u91CD\u65B0\u6267\u884C /login\uFF0C\u6216\u5728 shell \u91CC\u7528 nolo login --token <jwt>\u3002"
+  },
+  loginCancelled: {
+    en: "Login cancelled.",
+    zh: "\u5DF2\u53D6\u6D88\u767B\u5F55\u3002"
+  },
   versionInfo: {
     en: "nolo {0}\nUpdate this install with: nolo update\nIf repo-local output differs, publish/install the latest npm package first.",
     zh: "nolo {0}\n\u7528 nolo update \u66F4\u65B0\u5F53\u524D\u5B89\u88C5\u3002\n\u5982\u679C\u672C\u5730\u4ED3\u5E93\u8F93\u51FA\u7684\u7248\u672C\u4E0D\u540C\uFF0C\u8BF7\u5148\u53D1\u5E03/\u5B89\u88C5\u6700\u65B0\u7684 npm \u5305\u3002"
   },
   versionUnknown: { en: "unknown version", zh: "\u672A\u77E5\u7248\u672C" },
   updateAvailable: {
-    en: "New nolo {0} available (you have {1}) \u2014 run /update to upgrade",
-    zh: "\u65B0\u7248\u672C nolo {0} \u53EF\u7528\uFF08\u5F53\u524D {1}\uFF09\u2014 \u8FD0\u884C /update \u5347\u7EA7"
+    // 保持短：这行在窄终端物理换行会破坏 banner 重绘的行数计算。当前版本
+    // 号上一行 version line 已有，不重复。
+    en: "\u2191 nolo {0} available \u2014 /update to upgrade",
+    zh: "\u2191 nolo {0} \u53EF\u7528 \u2014 /update \u5347\u7EA7"
   },
   // --- Dialog list / timestamps -----------------------------------------
   recentDialogs: { en: "Recent dialogs:", zh: "\u6700\u8FD1\u5BF9\u8BDD\uFF1A" },
@@ -1466,6 +1552,7 @@ function mapAnthropicMessageToOpenAi(payload) {
   };
 }
 async function fetchAnthropicMessagesCompletion(args) {
+  const timingTracker = createProviderCallTimingTracker();
   const response = await (args.fetchImpl ?? fetch)(ANTHROPIC_MESSAGES_URL, {
     method: "POST",
     headers: {
@@ -1484,7 +1571,16 @@ async function fetchAnthropicMessagesCompletion(args) {
     error: { message: await response.text().catch(() => response.statusText) }
   }));
   if (!response.ok) return { status: response.status, body: payload, headers: response.headers };
-  return { status: 200, body: mapAnthropicMessageToOpenAi(payload) };
+  const mapped = mapAnthropicMessageToOpenAi(payload);
+  const timing = finalizeProviderCallTiming(timingTracker);
+  const usage = mapped.usage;
+  if (usage && typeof usage === "object" && timing.callDurationMs !== void 0) {
+    mapped.usage = {
+      ...usage,
+      callDurationMs: timing.callDurationMs
+    };
+  }
+  return { status: 200, body: mapped };
 }
 function isAnthropicOAuthAgent(agent) {
   return agent.apiKeyRef?.trim().toLowerCase() === "claude";
@@ -1523,6 +1619,7 @@ var LOCAL_SERVER_MEMORY_TOOL_NAME_SET = new Set(
 // packages/cli/client/localRuntimeTools.ts
 function buildOpenAiTools(args) {
   const toolset = buildLocalWorkspaceToolsetForEnv(args);
+  const workspaceToolNames = toolset.toolNames;
   const toolNameSet = new Set(args.toolNames ?? []);
   const uiAskChoiceTools = toolNameSet.has("ask_user") ? prepareTools(["ask_user"]) : [];
   const readPastedTextTools = toolNameSet.has("readPastedText") ? [
@@ -1564,7 +1661,7 @@ function buildOpenAiTools(args) {
     ...uiAskChoiceTools,
     ...readPastedTextTools,
     ...buildLocalWorkspaceOpenAiTools({
-      toolNames: toolset.toolNames,
+      toolNames: args.effectiveToolNames ?? workspaceToolNames,
       exposeShellTools: toolset.exposeShellTools
     }),
     ...buildServerPlatformOpenAiTools({ toolNames: args.toolNames }),
@@ -1583,8 +1680,15 @@ function buildOrchestrationOpenAiTools(args) {
   const waitCapableActions = CONTROL_AGENT_RUN_ACTIONS.filter(
     (action) => action !== "wait"
   );
-  const controlSchema = hasRunWakeChannel(args.env) ? buildControlAgentRunFunctionSchema({ actions: waitCapableActions }) : buildControlAgentRunFunctionSchema();
-  const startSchema = buildStartAgentRunFunctionSchema({ supportsWait: false });
+  const wakeChannel = hasRunWakeChannel(args.env);
+  const controlSchema = buildControlAgentRunFunctionSchema({
+    ...wakeChannel ? { actions: waitCapableActions } : {},
+    wakeEnabled: wakeChannel
+  });
+  const startSchema = buildStartAgentRunFunctionSchema({
+    supportsWait: false,
+    wakeEnabled: wakeChannel
+  });
   return prepareTools(names).map((tool) => {
     if (tool?.function?.name === "controlAgentRun") {
       return { ...tool, function: controlSchema };
@@ -1596,8 +1700,8 @@ function buildOrchestrationOpenAiTools(args) {
   });
 }
 var CLI_DEFAULT_TOOLS = ["exa_search", "fetchWebpage", "ask_user"];
-function addDefaultCliCoreTools(toolNames, env) {
-  const declaredOnly = env && shouldUseDeclaredOnlyLocalWorkspaceTools(env);
+function addDefaultCliCoreTools(toolNames, env, args) {
+  const declaredOnly = args?.skipHostDefaults === true || (env ? shouldUseDeclaredOnlyLocalWorkspaceTools(env) : false);
   const injected = declaredOnly ? [...FORCED_TOOLS] : [...FORCED_TOOLS, ...CLI_DEFAULT_TOOLS];
   return [.../* @__PURE__ */ new Set([...toolNames, ...injected])];
 }
@@ -1605,6 +1709,10 @@ function resolveCliEffectiveEnabledPacks(args) {
   return resolveEffectiveEnabledPacks({
     enabledPacks: resolveAgentRequiredPackIds(args),
     declaredOnly: args.declaredOnly,
+    // 子任务不继承 ALWAYS_ON 交互默认（memory/skills）——agent 显式声明
+    // （enabledPacks / required skill packs）的包照常展开；code 兜底是
+    // host-required，子任务保留（否则零声明叶子上没有任何文件/shell 工具）。
+    includeAlwaysOnPacks: args.isSubtask !== true,
     emptyFallbackPacks: ["code"]
   });
 }
@@ -1626,46 +1734,48 @@ function withRuntimeEnabledPacksAndPrompt(config) {
 }
 function resolveCliRequestedToolNames(agentConfig, env, systemBuiltinSkills) {
   const declaredOnly = shouldUseDeclaredOnlyLocalWorkspaceTools(env);
-  const expanded = addDefaultLightWebToolsForConfiguredAgents(
-    addDefaultCliCoreTools(
-      canonicalizeToolNames(
-        expandEnabledPacks(
-          resolveCliEffectiveEnabledPacks({
-            enabledPacks: agentConfig?.enabledPacks,
-            skills: agentConfig?.skills,
-            declaredOnly
-          }),
-          resolveRequestedRuntimeToolNames({ agentConfig })
-        )
-      ),
-      env
+  const isSubtask = isSubtaskRun(env);
+  const coreExpanded = addDefaultCliCoreTools(
+    canonicalizeToolNames(
+      expandEnabledPacks(
+        resolveCliEffectiveEnabledPacks({
+          enabledPacks: agentConfig?.enabledPacks,
+          skills: agentConfig?.skills,
+          declaredOnly,
+          isSubtask
+        }),
+        resolveRequestedRuntimeToolNames({ agentConfig })
+      )
     ),
-    agentConfig
+    env,
+    { skipHostDefaults: isSubtask }
   );
+  const expanded = isSubtask ? coreExpanded : addDefaultLightWebToolsForConfiguredAgents(coreExpanded, agentConfig);
   const filtered = applySystemBuiltinSkillFilter(
     // Default-on system capabilities (agent-orchestration) are mounted for
-    // every non-declared-only agent before the global filter runs, so the
-    // user's global "off" still wins. declared-only (ablation) runs keep
-    // their strict surface.
-    declaredOnly ? expanded : addDefaultSystemCapabilityTools(expanded),
+    // every non-declared-only interactive agent before the global filter runs,
+    // so the user's global "off" still wins. declared-only (ablation) and
+    // subtask runs keep their strict surface.
+    declaredOnly || isSubtask ? expanded : addDefaultSystemCapabilityTools(expanded),
     systemBuiltinSkills
   );
   const afterDisabled = applyDisabledTools(
     filtered,
     agentConfig?.disabledTools
   );
-  return filterToolNamesForRunKind(afterDisabled, isSubtaskRun(env));
+  return filterToolNamesForRunKind(afterDisabled, isSubtask);
 }
 function resolveProviderOpenAiToolBundle(agentConfig, env, buildTools = buildOpenAiTools, additionalToolNames = []) {
   const requestedToolNames = [
     .../* @__PURE__ */ new Set([
-      ...resolveCliRequestedToolNames(agentConfig, env, null),
+      ...Array.isArray(agentConfig.runScopedToolSurface?.finalToolNames) ? agentConfig.runScopedToolSurface.finalToolNames : resolveCliRequestedToolNames(agentConfig, env, null),
       ...additionalToolNames
     ])
   ];
   const tools = buildTools({
     agentKey: agentConfig.key,
     toolNames: requestedToolNames,
+    ...Array.isArray(agentConfig.runScopedToolSurface?.finalToolNames) ? { effectiveToolNames: requestedToolNames } : {},
     env
   });
   return { requestedToolNames, tools };
@@ -1674,9 +1784,9 @@ function buildLocalWorkspaceToolsetForEnv(args) {
   const toolset = buildLocalWorkspaceToolset({
     declaredToolNames: args.toolNames,
     exposeShellTools: true,
-    useDeclaredToolNamesOnly: shouldUseDeclaredOnlyLocalWorkspaceTools(
-      args.env
-    )
+    // The requested list is already the effective run surface. Re-expanding
+    // shell/workspace defaults here would bypass run-scoped constraints.
+    useDeclaredToolNamesOnly: args.useDeclaredToolNamesOnly === true || args.useDeclaredToolNamesOnly === void 0 && shouldUseDeclaredOnlyLocalWorkspaceTools(args.env)
   });
   return toolset;
 }
@@ -1807,9 +1917,11 @@ var resolveAnthropicOAuthTransport = async (ctx) => {
           provider: "anthropic",
           ...tool_calls ? { tool_calls } : {},
           // fetchAnthropicMessagesCompletion 已把 Anthropic Messages 响应归一化成
-          // OpenAI chat.completions 形状：choices[0] + usage（prompt_tokens/
-          // output_tokens/cache_*）。必须透传，否则 localLoop 的 lastUsage 无
-          // token 数，TUI context chip 拿不到更新（与 Codex OAuth 分支同因）。
+          // OpenAI chat.completions 形状：choices[0].finish_reason（"stop"/"tool_calls"）
+          // + usage（prompt_tokens/output_tokens/cache_*）。必须透传，否则 localLoop 在
+          // 收尾轮无 finish_reason / stream_complete 时会误判成 stream_truncated（与 Antigravity 同理）。
+          finish_reason: typeof choice?.finish_reason === "string" ? choice.finish_reason : void 0,
+          stream_complete: true,
           usage: result.body?.usage,
           trace: messages
         };
@@ -1819,519 +1931,256 @@ var resolveAnthropicOAuthTransport = async (ctx) => {
   return null;
 };
 
-// packages/core/chat/upstreamErrorBody.ts
-function parseUpstreamErrorBody(errorText, statusText) {
-  if (errorText) {
-    try {
-      const parsed = JSON.parse(errorText);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        const error = parsed.error;
-        if (error && typeof error === "object" && !Array.isArray(error)) {
-          return parsed;
-        }
+// packages/agent-runtime/antigravityInvocation.ts
+var AUTH_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403]);
+function antigravityAttemptEffect(args) {
+  return Effect_exports.suspend(() => {
+    const attemptController = new AbortController();
+    const externalSignal = args.externalSignal;
+    let onExternalAbort;
+    const forwardExternalAbort = () => {
+      if (!attemptController.signal.aborted) attemptController.abort(externalSignal?.reason);
+    };
+    if (externalSignal) {
+      if (externalSignal.aborted) forwardExternalAbort();
+      else {
+        onExternalAbort = forwardExternalAbort;
+        externalSignal.addEventListener("abort", onExternalAbort, { once: true });
       }
-    } catch {
     }
-  }
-  return { error: { message: errorText || statusText } };
+    const removeExternalListener = () => {
+      if (onExternalAbort) {
+        externalSignal?.removeEventListener("abort", onExternalAbort);
+        onExternalAbort = void 0;
+      }
+    };
+    const attempt = Effect_exports.callback((resume, fiberSignal) => {
+      const onFiberAbort = () => forwardExternalAbort();
+      if (fiberSignal?.aborted) forwardExternalAbort();
+      else fiberSignal?.addEventListener("abort", onFiberAbort);
+      const removeFiberListener = () => {
+        if (onFiberAbort) fiberSignal?.removeEventListener("abort", onFiberAbort);
+      };
+      if (attemptController.signal.aborted) {
+        removeFiberListener();
+        removeExternalListener();
+        resume(Effect_exports.fail(buildInvocationError(
+          "ANTIGRAVITY_INVOCATION_ABORTED",
+          "Antigravity invocation aborted before request."
+        )));
+        return Effect_exports.succeed(void 0);
+      }
+      const pending = fetchAntigravityCloudCodeCompletion({
+        agentConfig: args.agentConfig,
+        accessToken: args.credential.accessToken,
+        metadata: args.credential.metadata,
+        openAiBody: args.openAiBody,
+        signal: attemptController.signal,
+        fetchImpl: args.fetchImpl,
+        ...args.onTextDelta ? { onTextDelta: args.onTextDelta } : {},
+        ...args.onReasoningDelta ? { onReasoningDelta: args.onReasoningDelta } : {}
+      });
+      pending.then(
+        (result) => resume(Effect_exports.succeed(result)),
+        (error) => resume(Effect_exports.fail(error))
+      );
+      return Effect_exports.sync(() => {
+        removeFiberListener();
+        removeExternalListener();
+      });
+    }).pipe(
+      // 兜底：winner 路径（正常 settle）也要摘 listener；timeout 赢时 attempt
+      // 是输家 fiber，callback cleanup 已由 race/timeout 的 interrupt 触发，
+      // 这里保证任何出口 listener 都被移除。
+      Effect_exports.ensuring(Effect_exports.sync(() => {
+        removeExternalListener();
+      }))
+    );
+    return attempt;
+  });
 }
-
-// packages/agent-runtime/antigravityCloudCodeProvider.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-
-// packages/agent-runtime/antigravityWireModel.ts
-var WIRE_PROFILES = {
-  // Antigravity discovery exposes 3.7 Flash as one tiered wire model.
-  // The UI labels its effort variants (Low/Medium/High), but the literal
-  // -medium/-high ids return 404 from streamGenerateContent.
-  "gemini-3.7-flash-tiered": { modelEnum: "MODEL_PLACEHOLDER_M301", maxOutputTokens: 65536 },
-  // Gemini 3.8 Flash 沿用 3.7 的 tiered 兼容策略：仓库内暂无 Antigravity discovery
-  // 证据确认 3.8 的 wire modelEnum，禁止虚构，先只声明同档输出上限；enum 待
-  // discovery 证据到位后补齐。
-  "gemini-3.8-flash-tiered": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-low": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-medium": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-high": { maxOutputTokens: 65536 },
-  // 旧模型 wire 映射保留：存量自定义 agent 仍可能引用（注册表已下线不影响此处）。
-  "gemini-3.5-flash-extra-low": { modelEnum: "MODEL_PLACEHOLDER_M187", maxOutputTokens: 65536 },
-  "gemini-3.5-flash-low": { modelEnum: "MODEL_PLACEHOLDER_M20", maxOutputTokens: 65536 },
-  "gemini-3-flash-agent": { modelEnum: "MODEL_PLACEHOLDER_M132", maxOutputTokens: 65536 },
-  "gemini-3.1-pro-low": { modelEnum: "MODEL_PLACEHOLDER_M36", maxOutputTokens: 65535 },
-  "gemini-pro-agent": { modelEnum: "MODEL_PLACEHOLDER_M16", maxOutputTokens: 65535 },
-  "claude-sonnet-5": { maxOutputTokens: 64e3 },
-  "claude-sonnet-4-6": { maxOutputTokens: 64e3 },
-  "claude-opus-4-6-thinking": { maxOutputTokens: 64e3 },
-  "gemini-2.5-flash": { maxOutputTokens: 65536 }
-};
-function resolveAntigravityWireModel(logicalModelId) {
-  const id = logicalModelId.trim();
-  const lower = id.toLowerCase();
-  if (lower === "gemini-3.5-flash") {
-    const wireModelId = "gemini-3.5-flash-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.7-flash" || ["gemini-3.7-flash-low", "gemini-3.7-flash-medium", "gemini-3.7-flash-high"].includes(lower)) {
-    const wireModelId = "gemini-3.7-flash-tiered";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
+function attemptWithAbort(args) {
+  const externalSignal = args.externalSignal;
+  if (!externalSignal) {
+    return antigravityAttemptEffect(args);
   }
-  if (lower === "gemini-3.8-flash" || ["gemini-3.8-flash-low", "gemini-3.8-flash-medium", "gemini-3.8-flash-high"].includes(lower)) {
-    const wireModelId = "gemini-3.8-flash-tiered";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.6-flash") {
-    const wireModelId = "gemini-3.6-flash-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.1-pro" || lower === "gemini-3.1-pro-preview") {
-    const wireModelId = "gemini-3.1-pro-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (WIRE_PROFILES[id]) {
-    return { wireModelId: id, profile: WIRE_PROFILES[id] };
-  }
-  return { wireModelId: id };
-}
-
-// packages/agent-runtime/geminiNativeShared.ts
-var SKIP_THOUGHT_SIGNATURE = "skip_thought_signature_validator";
-function resolveGeminiModelQuirks(modelId) {
-  const lower = modelId.toLowerCase();
-  const isGemini3 = lower.includes("gemini-3");
-  const isStrictSignatureModel = lower.includes("gemini-3.5") || lower.includes("flash-preview");
-  const isClaude = lower.includes("claude");
-  return {
-    requiresThoughtSignature: isGemini3,
-    allowsThoughtSignatureSentinel: isGemini3 && !isStrictSignatureModel,
-    isClaudeCrossModel: isClaude
+  let abortListener;
+  const removeAbortListener = () => {
+    if (abortListener) externalSignal.removeEventListener("abort", abortListener);
+    abortListener = void 0;
   };
-}
-function isGemini3Model(modelId) {
-  return resolveGeminiModelQuirks(modelId).requiresThoughtSignature;
-}
-function messageText(content) {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return "";
-  return content.filter(
-    (part) => part?.type === "text"
-  ).map((part) => part.text).join("\n").trim();
-}
-function parseDataUrlToInlineData(url) {
-  const match = /^data:([A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+);base64,([A-Za-z0-9+/=]*)$/.exec(
-    url
+  const abortEffect = Effect_exports.callback((resume) => {
+    const finish = () => resume(Effect_exports.succeed("aborted"));
+    if (externalSignal.aborted) {
+      finish();
+      return;
+    }
+    abortListener = () => finish();
+    externalSignal.addEventListener("abort", abortListener, { once: true });
+    return Effect_exports.sync(removeAbortListener);
+  }).pipe(Effect_exports.ensuring(Effect_exports.sync(removeAbortListener)));
+  return Effect_exports.raceFirst(
+    antigravityAttemptEffect(args),
+    abortEffect
   );
-  if (!match) return null;
-  return { mimeType: match[1], data: match[2] };
 }
-function extractInlineDataParts(content) {
-  if (!Array.isArray(content)) return [];
-  const parts = [];
-  for (const part of content) {
-    if (!part || typeof part !== "object") continue;
-    if (part.type !== "image_url") continue;
-    const url = part.image_url?.url;
-    if (typeof url !== "string" || !url.trim()) continue;
-    const inline = parseDataUrlToInlineData(url);
-    if (inline) parts.push({ inlineData: inline });
-  }
-  return parts;
-}
-function convertOpenAiMessagesToGemini(messages, options) {
-  const contents = [];
-  const systemTexts = [];
-  let toolCallIndex = 0;
-  let pendingFunctionCalls = [];
-  const pushOrMergeContent = (role, parts) => {
-    if (parts.length === 0) return;
-    const last = contents[contents.length - 1];
-    if (last && last.role === role) {
-      last.parts.push(...parts);
-    } else {
-      contents.push({ role, parts });
-    }
-  };
-  const flushPendingFunctionCalls = () => {
-    if (pendingFunctionCalls.length === 0) return;
-    const dummyResponses = pendingFunctionCalls.map(
-      ({ name, id }) => ({
-        functionResponse: {
-          name,
-          response: { output: "{}" },
-          ...id ? { id } : {}
-        }
-      })
+function invokeAntigravityEffect(args) {
+  const authRetryable = args.authRetryableStatuses ?? AUTH_RETRYABLE_STATUSES;
+  const timeoutMs = typeof args.timeoutMs === "number" && args.timeoutMs > 0 ? args.timeoutMs : void 0;
+  const runOneAttempt = (credential) => Effect_exports.suspend(
+    () => attemptWithAbort({
+      agentConfig: args.agentConfig,
+      credential,
+      openAiBody: args.openAiBody,
+      externalSignal: args.signal,
+      fetchImpl: args.fetchImpl ?? fetch,
+      ...args.onTextDelta ? { onTextDelta: args.onTextDelta } : {},
+      ...args.onReasoningDelta ? { onReasoningDelta: args.onReasoningDelta } : {}
+    })
+  );
+  const orchestration = Effect_exports.gen(function* () {
+    const firstCredential = yield* Effect_exports.tryPromise({
+      try: () => args.resolveCredential({ forceRefresh: false }),
+      catch: (error) => error
+    });
+    const first = yield* Effect_exports.exit(
+      runOneAttempt(firstCredential)
     );
-    pendingFunctionCalls = [];
-    pushOrMergeContent("user", dummyResponses);
-  };
-  for (const raw of messages) {
-    if (!raw || typeof raw !== "object" || !("role" in raw)) continue;
-    const role = String(raw.role);
-    const content = "content" in raw ? raw.content : null;
-    if (role === "system") {
-      const text = messageText(
-        content
-      );
-      if (text) systemTexts.push(text);
-      continue;
-    }
-    if (role === "user") {
-      flushPendingFunctionCalls();
-      const text = messageText(
-        content
-      );
-      const imageParts = extractInlineDataParts(
-        content
-      );
-      if (!text && imageParts.length === 0) continue;
-      const parts = [];
-      if (text) parts.push({ text });
-      for (const img of imageParts) parts.push(img);
-      pushOrMergeContent("user", parts);
-      continue;
-    }
-    if (role === "assistant") {
-      flushPendingFunctionCalls();
-      const text = messageText(
-        content
+    if (Exit_exports.isFailure(first)) {
+      const errorOption = Exit_exports.findErrorOption(first);
+      const error = Option_exports.isSome(errorOption) ? errorOption.value : first.cause;
+      if (isAntigravityAbortErrorValue(error)) {
+        return { kind: "aborted" };
+      }
+      return { kind: "failed", error };
+    }
+    let current = first.value;
+    if (typeof current !== "string" && supportsAuthRetry(args.supportsAuthRetry, current.status, authRetryable)) {
+      const refreshed = yield* Effect_exports.exit(
+        Effect_exports.tryPromise({
+          try: () => args.resolveCredential({ forceRefresh: true }),
+          catch: (error) => error
+        })
       );
-      const toolCalls = "tool_calls" in raw && Array.isArray(raw.tool_calls) ? raw.tool_calls ?? [] : [];
-      const parts = [];
-      if (text) {
-        parts.push({ text });
-      }
-      for (const call of toolCalls) {
-        const name = call?.function?.name?.trim();
-        if (!name) continue;
-        const id = call.id?.trim() || `${name}_${toolCallIndex++}`;
-        pendingFunctionCalls.push({ name, id });
-        const realSignature = typeof call.thought_signature === "string" && call.thought_signature ? call.thought_signature : void 0;
-        const isFirstFunctionCallPart = !parts.some(
-          (p) => "functionCall" in p
+      if (Exit_exports.isSuccess(refreshed) && credentialChanged(firstCredential, refreshed.value)) {
+        const retried = yield* Effect_exports.exit(
+          runOneAttempt(refreshed.value)
         );
-        const signature = realSignature ?? (options.attachSkipThoughtSignature && isFirstFunctionCallPart ? SKIP_THOUGHT_SIGNATURE : void 0);
-        const part = {
-          functionCall: {
-            name,
-            args: parseToolArgs(call.function?.arguments),
-            ...id ? { id } : {}
-          },
-          ...signature ? { thoughtSignature: signature } : {}
-        };
-        parts.push(part);
-      }
-      pushOrMergeContent("model", parts);
-      continue;
-    }
-    if (role === "tool") {
-      const toolCallId = "tool_call_id" in raw && typeof raw.tool_call_id === "string" ? raw.tool_call_id : "";
-      const rawName = "name" in raw && typeof raw.name === "string" ? raw.name.trim() : "";
-      const pendingIndex = pendingFunctionCalls.findIndex(
-        (p) => toolCallId ? p.id === toolCallId : rawName ? p.name === rawName : true
-      );
-      if (pendingIndex === -1) continue;
-      const [{ name, id }] = pendingFunctionCalls.splice(pendingIndex, 1);
-      const output = messageText(content) || "{}";
-      pushOrMergeContent("user", [
-        {
-          functionResponse: {
-            name,
-            response: { output },
-            // 保留 OpenAI tool_call_id：antigravity Cloud Code Assist 网关把
-            // Gemini contents 转成 Claude messages 时需要 functionResponse →
-            // tool_result 的 tool_use_id；缺 id 时网关报
-            // "tool_result.tool_use_id: Field required"（HTTP 400）。
-            ...id ? { id } : {}
-          }
+        if (Exit_exports.isSuccess(retried)) {
+          current = retried.value;
         }
-      ]);
-    }
-  }
-  flushPendingFunctionCalls();
-  if (contents.length > 0 && contents[0]?.role === "model") {
-    contents.unshift({
-      role: "user",
-      parts: [{ text: "Continue the conversation." }]
-    });
-  }
-  return { contents, systemTexts };
-}
-function parseToolArgs(raw) {
-  if (typeof raw === "string") {
-    try {
-      const parsed = JSON.parse(raw);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        return parsed;
       }
-    } catch {
     }
-  }
-  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-    return raw;
-  }
-  return {};
+    if (current === "aborted") return { kind: "aborted" };
+    return { kind: "done", result: current };
+  }).pipe(Effect_exports.catch((error) => Effect_exports.succeed({
+    kind: "failed",
+    error
+  })));
+  if (typeof timeoutMs !== "number") return orchestration;
+  return Effect_exports.gen(function* () {
+    const outcome = yield* Effect_exports.timeoutOption(orchestration, Duration_exports.millis(timeoutMs));
+    return Option_exports.isNone(outcome) ? { kind: "timeout" } : outcome.value;
+  });
 }
-function convertOpenAiToolsToGemini(tools) {
-  if (!Array.isArray(tools) || tools.length === 0) return void 0;
-  const declarations = [];
-  for (const tool of tools) {
-    if (!tool || typeof tool !== "object" || !("function" in tool)) continue;
-    const fn = tool.function;
-    const name = typeof fn.name === "string" ? fn.name : "";
-    if (!name) continue;
-    declarations.push({
-      name,
-      description: typeof fn.description === "string" ? fn.description : "",
-      parameters: fn.parameters ?? { type: "object", properties: {} }
-    });
-  }
-  if (declarations.length === 0) return void 0;
-  return [{ functionDeclarations: declarations }];
+function supportsAuthRetry(supports, status, authRetryable) {
+  return supports && authRetryable.has(status);
 }
-function createGeminiAccumulatorState() {
-  return {
-    text: "",
-    toolCalls: []
-  };
+function isAntigravityAbortErrorValue(error) {
+  const code = error?.code;
+  return code === "ANTIGRAVITY_INVOCATION_ABORTED" || error instanceof Error && error.name === "AbortError" || typeof DOMException !== "undefined" && error instanceof DOMException && error.name === "AbortError";
 }
-function applyGeminiChunk(chunk, state, options) {
-  if (!chunk || typeof chunk !== "object") return;
-  const response = "response" in chunk && chunk.response && typeof chunk.response === "object" ? chunk.response : chunk;
-  if ("usageMetadata" in response && response.usageMetadata && typeof response.usageMetadata === "object") {
-    const meta = response.usageMetadata;
-    const prompt = typeof meta.promptTokenCount === "number" ? meta.promptTokenCount : 0;
-    const candidates2 = typeof meta.candidatesTokenCount === "number" ? meta.candidatesTokenCount : 0;
-    const total = typeof meta.totalTokenCount === "number" ? meta.totalTokenCount : prompt + candidates2;
-    const cached = typeof meta.cachedContentTokenCount === "number" && Number.isFinite(meta.cachedContentTokenCount) ? (
-      // cached ⊆ prompt；对畸形上游防御性钳位，避免 cache_read > input 破坏归一化与计费
-      Math.min(Math.max(0, Math.floor(meta.cachedContentTokenCount)), prompt)
-    ) : 0;
-    state.usage = {
-      prompt_tokens: prompt,
-      completion_tokens: candidates2,
-      total_tokens: total,
-      ...cached > 0 ? { cache_read_input_tokens: cached } : {}
-    };
+function credentialChanged(before, after) {
+  return before.accessToken !== after.accessToken || before.accountId !== after.accountId || before.projectId !== after.projectId || JSON.stringify(before.metadata) !== JSON.stringify(after.metadata);
+}
+async function invokeAntigravity(args) {
+  const outcome = await (args.runtime ? args.runtime.runPromise(invokeAntigravityEffect(args)) : Effect_exports.runPromise(invokeAntigravityEffect(args)));
+  if (outcome.kind === "done") return outcome.result;
+  if (outcome.kind === "timeout") {
+    throw buildInvocationError("ANTIGRAVITY_INVOCATION_TIMEOUT", "Antigravity invocation timed out.");
   }
-  const candidates = Array.isArray(response.candidates) ? response.candidates : [];
-  for (const candidate of candidates) {
-    if (!candidate || typeof candidate !== "object") continue;
-    const parts = Array.isArray(
-      candidate.content?.parts
-    ) ? candidate.content.parts : [];
-    for (const part of parts) {
-      if (!part || typeof part !== "object") continue;
-      const partSignature = part.thoughtSignature;
-      const isThought = Boolean(part.thought);
-      if ("text" in part && typeof part.text === "string") {
-        const piece = part.text;
-        if (!isThought) {
-          state.text += piece;
-          if (piece && options?.onTextDelta) {
-            options.onTextDelta(piece);
-          }
-        } else {
-          if (piece && options?.onReasoningDelta) {
-            options.onReasoningDelta(piece);
-          }
-        }
-      }
-      if (isThought && typeof partSignature === "string" && partSignature) {
-        state.pendingThoughtSignature = partSignature;
-      }
-      if ("functionCall" in part && part.functionCall) {
-        const call = part.functionCall;
-        const name = typeof call.name === "string" ? call.name : "tool";
-        const id = typeof call.id === "string" ? call.id : `${name}_${state.toolCalls.length}`;
-        const argsObj = call.args && typeof call.args === "object" ? call.args : {};
-        const resolvedSignature = typeof partSignature === "string" && partSignature ? partSignature : state.pendingThoughtSignature;
-        state.pendingThoughtSignature = void 0;
-        state.toolCalls.push({
-          id,
-          type: "function",
-          function: { name, arguments: JSON.stringify(argsObj) },
-          ...typeof resolvedSignature === "string" && resolvedSignature ? { thought_signature: resolvedSignature } : {}
-        });
-      }
-    }
+  if (outcome.kind === "aborted") {
+    throw buildInvocationError("ANTIGRAVITY_INVOCATION_ABORTED", "Antigravity invocation aborted.");
   }
+  throw outcome.error ?? new Error("Antigravity invocation failed.");
 }
-function accumulateGeminiChunks(chunks, options) {
-  const state = createGeminiAccumulatorState();
-  for (const chunk of chunks) {
-    applyGeminiChunk(chunk, state, options);
-  }
-  return {
-    text: state.text,
-    toolCalls: state.toolCalls,
-    usage: state.usage
-  };
+function buildInvocationError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
 }
-async function accumulateGeminiStream(stream, options) {
-  const state = createGeminiAccumulatorState();
-  for await (const chunk of stream) {
-    applyGeminiChunk(chunk, state, options);
-  }
+function isAntigravityInvocationAbortError(error) {
+  const code = error?.code;
+  return error instanceof Error && (code === "ANTIGRAVITY_INVOCATION_ABORTED" || code === "ANTIGRAVITY_INVOCATION_TIMEOUT");
+}
+
+// packages/agent-runtime/antigravityCredential.ts
+function createAntigravityCredentialPlan(args) {
+  const owner = asOptionalTrimmedString(args.credentialOwnerUserId);
+  if (!owner) throw new Error("Antigravity credential owner is required.");
   return {
-    text: state.text,
-    toolCalls: state.toolCalls,
-    usage: state.usage
+    provider: "antigravity",
+    credentialOwnerUserId: owner,
+    source: args.source,
+    forceRefresh: args.forceRefresh === true
   };
 }
-function shouldUseGeminiNativeToolRoute(provider, model, tools, isImageModel) {
-  return provider === "google" && !isImageModel(model) && isGemini3Model(model) && Array.isArray(tools) && tools.length > 0;
-}
-function buildGeminiGenerateContentRequest(args) {
-  const { contents, systemTexts } = convertOpenAiMessagesToGemini(
-    args.messages,
-    { attachSkipThoughtSignature: args.attachSkipThoughtSignature }
-  );
-  const request = { contents };
-  if (systemTexts.length > 0) {
-    request.systemInstruction = {
-      role: "user",
-      parts: systemTexts.map((text) => ({ text }))
-    };
+function resolveAntigravityCredential(args) {
+  if (args.plan.provider !== "antigravity") {
+    throw new Error("Unsupported Antigravity credential plan provider.");
   }
-  const toolsResult = convertOpenAiToolsToGemini(args.tools);
-  if (toolsResult) {
-    request.tools = toolsResult;
-    request.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
-  }
-  const generationConfig = {};
-  if (typeof args.maxTokens === "number" && args.maxTokens > 0) {
-    generationConfig.maxOutputTokens = args.maxTokens;
-  }
-  if (typeof args.temperature === "number") {
-    generationConfig.temperature = args.temperature;
-  }
-  if (Object.keys(generationConfig).length > 0) {
-    request.generationConfig = generationConfig;
-  }
-  return request;
+  return toResolvedAntigravityCredential(args);
 }
-
-// packages/agent-runtime/antigravityCloudCodeProvider.ts
-var STREAM_PATH = "/v1internal:streamGenerateContent?alt=sse";
-function buildCloudCodeAssistPayload(args) {
-  const projectId = readAntigravityProjectId(args.metadata);
+function toResolvedAntigravityCredential(args) {
+  const accessToken = asOptionalTrimmedString(args.accessToken);
+  const projectId = asOptionalTrimmedString(args.metadata?.projectId);
+  if (!accessToken) throw new Error("Antigravity credential access token is missing.");
   if (!projectId) {
     throw new Error(
       "Antigravity OAuth credential is missing metadata.projectId. Re-run `nolo auth antigravity`."
     );
   }
-  const logicalModel = asOptionalTrimmedString(args.openAiBody.model) ?? asOptionalTrimmedString(args.agentConfig.model) ?? "gemini-3.1-pro";
-  const { wireModelId: model, profile } = resolveAntigravityWireModel(logicalModel);
-  const rawMessages = Array.isArray(args.openAiBody.messages) ? args.openAiBody.messages : [];
-  const quirks = resolveGeminiModelQuirks(model);
-  const isClaude = quirks.isClaudeCrossModel;
-  const { contents, systemTexts } = convertOpenAiMessagesToGemini(rawMessages, {
-    attachSkipThoughtSignature: quirks.allowsThoughtSignatureSentinel
-  });
-  if (contents.length === 0) {
-    throw new Error("Antigravity Cloud Code Assist request has no user/model contents.");
-  }
-  const prompt = args.agentConfig.prompt?.trim();
-  if (prompt) systemTexts.unshift(prompt);
-  const request = { contents };
-  if (systemTexts.length > 0) {
-    request.systemInstruction = {
-      role: "user",
-      parts: systemTexts.map((text) => ({ text }))
-    };
-  }
-  const tools = convertOpenAiToolsToGemini(
-    Array.isArray(args.openAiBody.tools) ? args.openAiBody.tools : void 0
-  );
-  if (tools) {
-    request.tools = tools;
-    request.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
-  }
-  const generationConfig = {};
-  if (profile?.maxOutputTokens) {
-    generationConfig.maxOutputTokens = profile.maxOutputTokens;
-  } else if (typeof args.agentConfig.max_tokens === "number" && args.agentConfig.max_tokens > 0) {
-    generationConfig.maxOutputTokens = args.agentConfig.max_tokens;
-  }
-  if (typeof args.agentConfig.temperature === "number") {
-    generationConfig.temperature = args.agentConfig.temperature;
-  }
-  if (Object.keys(generationConfig).length > 0) {
-    request.generationConfig = generationConfig;
-  }
-  const agentId = randomUUID2();
-  const trajectoryId = randomUUID2();
-  const step = 2;
-  const requestId = `agent/${agentId}/${Date.now()}/${trajectoryId}/${step}`;
-  const labels = {
-    trajectory_id: trajectoryId,
-    last_step_index: String(step - 1),
-    used_claude: String(isClaude),
-    used_claude_conservative: String(isClaude)
-  };
-  if (profile?.modelEnum) {
-    labels.model_enum = profile.modelEnum;
-  }
-  request.labels = labels;
-  request.sessionId = `-${Math.floor(Math.random() * 9e15)}`;
   return {
-    url: `${resolveAntigravityCloudCodeBaseUrl(args.agentConfig.customProviderUrl)}${STREAM_PATH}`,
-    envelope: {
-      project: projectId,
-      model,
-      request,
-      requestId,
-      requestType: "agent",
-      userAgent: "antigravity"
-    }
+    provider: "antigravity",
+    accessToken,
+    projectId,
+    metadata: { ...args.metadata ?? {}, projectId },
+    accountId: asOptionalTrimmedString(args.accountId) ?? null
   };
 }
-async function fetchAntigravityCloudCodeCompletion(args) {
-  const fetchImpl = args.fetchImpl ?? fetch;
-  const { url, envelope } = buildCloudCodeAssistPayload(args);
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${args.accessToken}`,
-      "Content-Type": "application/json",
-      "User-Agent": getAntigravityUserAgent()
-    },
-    body: JSON.stringify(envelope),
-    signal: args.signal
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    return {
-      status: response.status,
-      // 保留上游结构：Antigravity 的限流 body 同样携带结构化的重置信息，
-      // 压成字符串会让冷却退化成 5 分钟默认值。
-      body: parseUpstreamErrorBody(errorText, response.statusText)
-    };
-  }
-  const chunkStream = streamSseDataValues(response, parseSseDataLineJson);
-  const { text, toolCalls, usage } = await accumulateGeminiStream(chunkStream, {
-    onTextDelta: args.onTextDelta,
-    onReasoningDelta: args.onReasoningDelta
-  });
-  const message = {
-    role: "assistant",
-    content: text || null
-  };
-  if (toolCalls.length > 0) {
-    message.tool_calls = toolCalls;
+async function resolveLocalAntigravityCredential(args) {
+  const rawRef = asTrimmedLowercaseString(args.apiKeyRef);
+  const isApiKeyRef = rawRef.startsWith("api-key:");
+  const providerRef = isApiKeyRef ? rawRef : rawRef || "antigravity";
+  if (isApiKeyRef && args.forceRefresh) {
+    throw new Error(`Cannot force-refresh non-OAuth API key ref "${rawRef}".`);
   }
-  return {
-    status: 200,
-    body: {
-      choices: [
-        {
-          index: 0,
-          message,
-          finish_reason: toolCalls.length > 0 ? "tool_calls" : "stop"
-        }
-      ],
-      ...usage ? { usage } : {}
+  const token = await args.apiKeyRefResolver(
+    providerRef,
+    args.forceRefresh ? { force: true } : void 0
+  );
+  const trimmedToken = asOptionalTrimmedString(token);
+  if (!trimmedToken) {
+    if (isApiKeyRef) {
+      throw new Error(`API key for "${rawRef}" not found locally.`);
     }
-  };
+    throw new Error(
+      'OAuth credential for "antigravity" not found locally. Run `nolo auth antigravity`.'
+    );
+  }
+  const read = args.readCredential ?? readOAuthCredential;
+  const raw = read("antigravity");
+  const plan = createAntigravityCredentialPlan({
+    credentialOwnerUserId: args.credentialOwnerUserId || "local",
+    source: args.source || "local",
+    forceRefresh: args.forceRefresh === true
+  });
+  return resolveAntigravityCredential({
+    plan,
+    accessToken: trimmedToken,
+    metadata: raw?.metadata ?? args.metadata ?? null,
+    accountId: raw?.accountId ?? args.accountId ?? null
+  });
 }
 
 // packages/core/summarizeEndpoint.ts
@@ -2345,21 +2194,98 @@ function summarizeEndpoint(value) {
   }
 }
 
+// packages/cli/client/localRuntimeHelpers.ts
+var REMOTE_DIALOG_SYNC_TIMEOUT_MS = 1e4;
+var remoteDialogSyncTimeoutMsForTest;
+function remoteDialogSyncTimeout() {
+  return remoteDialogSyncTimeoutMsForTest ?? REMOTE_DIALOG_SYNC_TIMEOUT_MS;
+}
+function resolveRuntimeServerUrl(env) {
+  return (env?.NOLO_SERVER_URL || env?.NOLO_SERVER || env?.BASE_URL || "").replace(/\/+$/, "");
+}
+function resolveRuntimeAuthToken(env) {
+  return resolvePlatformAuthToken(env ?? {});
+}
+
+// packages/cli/client/cliAgentConfigHelpers.ts
+var BUILTIN_NOLO_AGENT_KEY = NOLO_DEFAULT_AGENT_KEY;
+var BUILTIN_NOLO_AGENT_ID = NOLO_DEFAULT_AGENT_ID;
+function resolveLocalUserId(env) {
+  const explicitUserId = env.NOLO_LOCAL_USER_ID || env.NOLO_USER_ID;
+  if (explicitUserId) return explicitUserId;
+  const tokenUserId = parseUserIdFromAuthToken(resolveRuntimeAuthToken(env));
+  return tokenUserId || "local";
+}
+function isBuiltinNoloAgentRef(ref) {
+  if (typeof ref !== "string") return false;
+  const normalized = ref.trim();
+  return normalized === BUILTIN_NOLO_AGENT_KEY || normalized === BUILTIN_NOLO_AGENT_ID || normalized.endsWith(`-${BUILTIN_NOLO_AGENT_ID}`);
+}
+function isBuiltinNoloAgentConfig(agentConfig) {
+  const key = agentConfig?.key || agentConfig?.rawRecord?.dbKey || agentConfig?.rawRecord?.agentKey;
+  const id = agentConfig?.rawRecord?.id;
+  return isBuiltinNoloAgentRef(key) || isBuiltinNoloAgentRef(id);
+}
+function withResolvedRuntimeToolSurface(agentConfig, env) {
+  if (!agentConfig) return agentConfig;
+  const currentUserId = resolveLocalUserId(env);
+  const rawRecord = agentConfig.rawRecord ?? {};
+  const ownerId = asOptionalTrimmedString(rawRecord.userId) ?? null;
+  const agentKey = rawRecord.dbKey ?? agentConfig.key;
+  const toolSurface = resolveRuntimeToolSurfaceForAgent({
+    explicitToolNames: agentConfig.toolNames,
+    currentUserId,
+    agentOwnerId: ownerId,
+    agentKey,
+    isPublic: !isBuiltinNoloAgentConfig(agentConfig) && rawRecord.isPublic === true,
+    sharingLevel: typeof rawRecord.sharingLevel === "string" ? rawRecord.sharingLevel : null,
+    trustedPrivateInvocation: isBuiltinNoloAgentConfig(agentConfig) || isSystemBuiltinTrustedAgentKey(agentKey),
+    runtimeHost: "cli"
+  });
+  return {
+    ...agentConfig,
+    toolNames: toolSurface.finalToolNames,
+    toolSurface,
+    prompt: agentConfig.prompt
+  };
+}
+function extractLastUserText(messages) {
+  const lastUser = [...messages].reverse().find((m) => m.role === "user");
+  if (!lastUser) return "";
+  if (typeof lastUser.content === "string") return lastUser.content;
+  if (Array.isArray(lastUser.content)) {
+    return lastUser.content.filter((part) => part?.type === "text").map((part) => part.text ?? "").join(" ");
+  }
+  return "";
+}
+function localTurnHasSubjectRefs(input) {
+  return Array.isArray(input.runtimeContext?.subjectRefs) && input.runtimeContext.subjectRefs.length > 0;
+}
+
 // packages/cli/client/providerResolution/antigravityTransport.ts
 var resolveAntigravityTransport = async (ctx) => {
-  const { agentConfig, deps, fetchImpl, loopbackRequest, additionalToolNames, buildProviderOpenAiTools, recordLocalAvailability, apiKeyRefResolver } = ctx;
+  const {
+    agentConfig,
+    deps,
+    fetchImpl,
+    loopbackRequest,
+    additionalToolNames,
+    buildProviderOpenAiTools,
+    recordLocalAvailability,
+    apiKeyRefResolver
+  } = ctx;
+  const legacyCredentialMigration = { enableLegacyMigration: true };
   if (isAntigravityOAuthAgent(agentConfig)) {
-    const resolveAccessToken = async () => {
-      const accessToken = await apiKeyRefResolver("antigravity");
-      if (!accessToken) {
-        throw new Error(
-          'OAuth credential for "antigravity" not found locally. Run `nolo auth antigravity`.'
-        );
-      }
-      return accessToken;
-    };
-    await resolveAccessToken();
-    const credential = readOAuthCredential("antigravity");
+    const credentialOwnerUserId = resolveLocalUserId(deps.env) || "local";
+    const apiKeyRef = asTrimmedLowercaseString(agentConfig.apiKeyRef);
+    const isApiKeyRef = apiKeyRef.startsWith("api-key:");
+    const initialCredential = await resolveLocalAntigravityCredential({
+      credentialOwnerUserId,
+      apiKeyRefResolver,
+      apiKeyRef: agentConfig.apiKeyRef,
+      readCredential: () => readOAuthCredential("antigravity", void 0, legacyCredentialMigration),
+      migration: legacyCredentialMigration
+    });
     const { requestedToolNames, tools } = resolveProviderOpenAiToolBundle(
       agentConfig,
       deps.env,
@@ -2374,7 +2300,7 @@ var resolveAntigravityTransport = async (ctx) => {
       model: agentConfig.model ?? null,
       customProviderEndpoint: summarizeEndpoint(agentConfig.customProviderUrl) ?? null,
       hasApiKey: true,
-      hasProjectId: Boolean(credential?.metadata?.projectId)
+      hasProjectId: Boolean(initialCredential?.projectId)
     });
     return {
       model: agentConfig.model || "gemini-3.1-pro",
@@ -2394,52 +2320,79 @@ var resolveAntigravityTransport = async (ctx) => {
           requestedToolNames,
           openAiToolNames: summarizeOpenAiToolNames(tools)
         });
-        const accessToken = await resolveAccessToken();
-        const sendCcaRequest = (token) => fetchAntigravityCloudCodeCompletion({
-          agentConfig,
-          accessToken: token,
-          metadata: credential?.metadata ?? null,
-          openAiBody,
-          signal: options?.signal,
-          onTextDelta: options?.onTextDelta,
-          onReasoningDelta: options?.onReasoningDelta,
-          fetchImpl: (url, init) => fetchWithTransientRetry(fetchImpl, url, init, {
-            sleep: deps.sleep,
-            loopbackRequest
-          })
+        const resolveLocalCredential = async ({ forceRefresh }) => resolveLocalAntigravityCredential({
+          credentialOwnerUserId,
+          apiKeyRefResolver,
+          apiKeyRef: agentConfig.apiKeyRef,
+          readCredential: () => readOAuthCredential("antigravity", void 0, legacyCredentialMigration),
+          migration: legacyCredentialMigration,
+          forceRefresh
         });
-        let result = await sendCcaRequest(accessToken);
-        if (result.status === 401) {
-          try {
-            const refreshed = await apiKeyRefResolver("antigravity", {
-              force: true
-            });
-            if (refreshed && refreshed !== accessToken) {
-              logLocalRuntimeDiagnostic("provider.request.auth_retry", {
-                agentKey: agentConfig.key,
-                transport: "antigravity-cloud-code"
-              });
-              result = await sendCcaRequest(refreshed);
-            }
-          } catch (error) {
-            logLocalRuntimeDiagnostic("provider.request.auth_retry_failed", {
-              agentKey: agentConfig.key,
-              transport: "antigravity-cloud-code",
-              error: toErrorMessage(error)
-            });
-          }
+        let result;
+        try {
+          result = await invokeAntigravity({
+            agentConfig,
+            resolveCredential: resolveLocalCredential,
+            // 非 OAuth（api-key ref）不重试：metered key 没有 refresh 语义。
+            supportsAuthRetry: !isApiKeyRef,
+            openAiBody,
+            ...options?.signal ? { signal: options.signal } : {},
+            // whole-invocation timeout 透传：seam 最外层 timeoutOption 统一 interrupt
+            // 整个 orchestration（resolve/attempt/refresh 共享预算）并真实 abort fetch/SSE。
+            ...typeof options?.timeoutMs === "number" ? { timeoutMs: options.timeoutMs } : {},
+            onTextDelta: options?.onTextDelta,
+            onReasoningDelta: options?.onReasoningDelta,
+            fetchImpl: (url, init) => fetchWithTransientRetry(fetchImpl, url, init, {
+              sleep: deps.sleep,
+              loopbackRequest
+            })
+          });
+        } catch (error) {
+          if (isAntigravityInvocationAbortError(error)) throw error;
+          logLocalRuntimeDiagnostic("provider.request.result", {
+            agentKey: agentConfig.key,
+            transport: "antigravity-cloud-code",
+            ok: false,
+            error: toErrorMessage(error)
+          });
+          throw error;
         }
         await recordLocalAvailability(result.status, result.body);
+        if (result.providerFailure) {
+          logLocalRuntimeDiagnostic("provider.request.failure", {
+            agentKey: agentConfig.key,
+            transport: "antigravity-cloud-code",
+            code: result.providerFailure.code,
+            providerReason: result.providerFailure.providerReason,
+            retryable: result.providerFailure.retryable
+          });
+          return {
+            content: "",
+            model: agentConfig.model || "gemini-3.1-pro",
+            provider: agentConfig.provider || "google-antigravity",
+            finish_reason: "error",
+            stream_complete: true,
+            error: true,
+            errorMessage: result.providerFailure.message,
+            providerEvents: result.providerEvents,
+            providerFailure: result.providerFailure,
+            runtimeProviderFailure: result.runtimeProviderFailure,
+            trace: messages
+          };
+        }
         if (result.status < 200 || result.status >= 300) {
           const errMsg = result.body && typeof result.body === "object" && result.body.error && typeof result.body.error.message === "string" ? result.body.error.message : JSON.stringify(result.body);
           throw new Error(
             `local antigravity provider failed: HTTP ${result.status} ${errMsg}`
           );
         }
-        const choice = Array.isArray(result.body.choices) ? result.body.choices[0] : void 0;
+        const choice = Array.isArray(result.body?.choices) ? result.body.choices[0] : void 0;
         const message = choice?.message ?? {};
-        const content = typeof message.content === "string" ? message.content : message.content == null ? "" : String(message.content);
-        const tool_calls = Array.isArray(message.tool_calls) ? message.tool_calls : void 0;
+        const tool_calls = Array.isArray(result.toolCalls) && result.toolCalls.length > 0 ? result.toolCalls : Array.isArray(message.tool_calls) ? message.tool_calls : void 0;
+        const content = typeof result.text === "string" ? result.text : typeof message.content === "string" ? message.content : message.content == null ? "" : String(message.content);
+        const reasoning_content = typeof result.reasoningContent === "string" ? result.reasoningContent : typeof message.reasoning_content === "string" ? message.reasoning_content : void 0;
+        const finish_reason = tool_calls && tool_calls.length > 0 ? "tool_calls" : typeof result.finishReason === "string" ? resolveAntigravityFinishReason(result.finishReason) : typeof choice?.finish_reason === "string" ? choice.finish_reason : void 0;
+        const usage = result.usage ?? result.body?.usage;
         logLocalRuntimeDiagnostic("provider.request.result", {
           agentKey: agentConfig.key,
           transport: "antigravity-cloud-code",
@@ -2452,12 +2405,14 @@ var resolveAntigravityTransport = async (ctx) => {
           model: agentConfig.model || "gemini-3.1-pro",
           provider: agentConfig.provider || "google-antigravity",
           ...tool_calls ? { tool_calls } : {},
-          // fetchAntigravityCloudCodeCompletion 已把 CCA 流聚合完毕并归一化成
-          // OpenAI chat.completions 形状：choices[0] + usage
-          // （prompt_tokens/completion_tokens/total_tokens）。必须透传，否则
-          // localLoop 的 lastUsage 无 token 数，TUI context chip 拿不到更新。
-          usage: result.body?.usage,
-          trace: messages
+          ...reasoning_content ? { reasoning_content } : {},
+          finish_reason,
+          stream_complete: true,
+          ...usage ? { usage } : {},
+          trace: messages,
+          providerEvents: result.providerEvents,
+          ...result.providerFailure ? { providerFailure: result.providerFailure } : {},
+          ...result.runtimeProviderFailure ? { runtimeProviderFailure: result.runtimeProviderFailure } : {}
         };
       }
     };
@@ -2465,14 +2420,136 @@ var resolveAntigravityTransport = async (ctx) => {
   return null;
 };
 
+// packages/cli/client/agentRunTypes.ts
+function resolveAuthToken(env) {
+  return resolvePlatformAuthToken(env);
+}
+function resolveFileWriteGateEnabled(env) {
+  const raw = (env.NOLO_CLI_WRITE_GATE ?? "").trim().toLowerCase();
+  return raw !== "off" && raw !== "0" && raw !== "false";
+}
+function isMachineBoundLocalhostCustomProvider(agentConfig) {
+  const machineId = agentConfig?.runtimeBinding && typeof agentConfig.runtimeBinding === "object" ? String(agentConfig.runtimeBinding.machineId ?? "").trim() : "";
+  const providerUrl = asTrimmedString(agentConfig?.customProviderUrl);
+  if (!machineId || !providerUrl) return false;
+  return isLoopbackUrl(providerUrl);
+}
+function resolveBoundMachineId(agentConfig) {
+  return agentConfig?.runtimeBinding && typeof agentConfig.runtimeBinding === "object" ? String(agentConfig.runtimeBinding.machineId ?? "").trim() : "";
+}
+var CLI_PROVIDER_NAMES = /* @__PURE__ */ new Set([
+  "agy",
+  "claude",
+  "codex",
+  "copilot",
+  "gemini",
+  "grok",
+  "kimi",
+  "opencode",
+  "qoder"
+]);
+function isCliProviderAgentConfig(agentConfig) {
+  if (asTrimmedLowercaseString(agentConfig?.apiSource) === "cli") return true;
+  const cliProvider = asTrimmedLowercaseString(agentConfig?.cliProvider);
+  if (cliProvider && CLI_PROVIDER_NAMES.has(cliProvider)) return true;
+  const provider = asTrimmedLowercaseString(agentConfig?.provider);
+  if (provider === "cli") return true;
+  return CLI_PROVIDER_NAMES.has(provider);
+}
+async function detectCurrentMachineId(env) {
+  const fromEnv = (env.NOLO_CURRENT_MACHINE_ID || env.NOLO_MACHINE_ID || "").trim();
+  if (fromEnv) return fromEnv;
+  try {
+    const { detectMachineInfo } = await import("./machineInfo-66ZFUMLE.js");
+    const machine = await detectMachineInfo({ probeLaunchable: true });
+    return asOptionalTrimmedString(machine?.machineId);
+  } catch {
+    return void 0;
+  }
+}
+
 // packages/cli/client/cliProviderHelpers.ts
+function buildDelegatedTaskContent(task, input) {
+  if (input === void 0 || input === null) {
+    return task;
+  }
+  if (typeof input === "string") {
+    const trimmedInput = input.trim();
+    if (!trimmedInput || trimmedInput === task.trim()) {
+      return task;
+    }
+    return `${task}
+
+--- INPUT (text) ---
+${input}`;
+  }
+  let jsonStr;
+  try {
+    const serialized = JSON.stringify(input, null, 2);
+    if (serialized === void 0) {
+      return task;
+    }
+    jsonStr = serialized;
+  } catch {
+    jsonStr = "[Unserializable Input]";
+  }
+  return `${task}
+
+--- INPUT (json) ---
+${jsonStr}`;
+}
+function calculateDelegatedPayloadMetrics(task, input, delegatedContent) {
+  const taskText = typeof task === "string" ? task : "";
+  const taskChars = taskText.length;
+  let inputChars = 0;
+  let serializedInputForTokens = void 0;
+  if (input !== void 0 && input !== null) {
+    if (typeof input === "string") {
+      inputChars = input.length;
+      serializedInputForTokens = input;
+    } else {
+      try {
+        const serialized = JSON.stringify(input, null, 2);
+        if (serialized !== void 0) {
+          inputChars = serialized.length;
+          serializedInputForTokens = serialized;
+        } else {
+          inputChars = 0;
+        }
+      } catch {
+        const fallback = "[Unserializable Input]";
+        inputChars = fallback.length;
+        serializedInputForTokens = fallback;
+      }
+    }
+  }
+  const finalContent = delegatedContent ?? buildDelegatedTaskContent(task, input);
+  const totalChars = finalContent.length;
+  const estimatedTaskTokens = estimateTokenCount(taskText);
+  const estimatedTotalTokens = estimateTokenCount(finalContent);
+  const estimatedInputTokens = serializedInputForTokens && inputChars > 0 ? estimateTokenCount(serializedInputForTokens) : 0;
+  return {
+    taskChars,
+    inputChars,
+    totalChars,
+    estimatedTaskTokens,
+    estimatedInputTokens,
+    estimatedTotalTokens
+  };
+}
 function isCliProviderAgent(agentConfig) {
-  return Boolean(
-    agentConfig.apiSource === "cli" || agentConfig.provider === "cli" || agentConfig.cliProvider
-  );
+  const providerName = asTrimmedLowercaseString(agentConfig.cliProvider);
+  if (providerName && CLI_PROVIDER_NAMES.has(providerName)) return true;
+  if (agentConfig.apiSource === "cli") return true;
+  if (asTrimmedLowercaseString(agentConfig.provider) === "cli") return true;
+  return false;
 }
 function resolveCliProviderName(agentConfig) {
-  return (agentConfig.cliProvider || agentConfig.provider || "codex").trim() || "codex";
+  const explicit = asTrimmedLowercaseString(agentConfig.cliProvider);
+  if (explicit && CLI_PROVIDER_NAMES.has(explicit)) return explicit;
+  const providerName = asTrimmedLowercaseString(agentConfig.provider);
+  if (providerName && CLI_PROVIDER_NAMES.has(providerName)) return providerName;
+  return "codex";
 }
 function stringifyRuntimeMessageContent(content) {
   if (typeof content === "string") return content;
@@ -2578,13 +2655,13 @@ var resolveCliProviderTransport = async (ctx) => {
 };
 
 // packages/agent-runtime/codexResponsesProvider.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
-var CODEX_CLIENT_VERSION = "0.144.1";
+var CODEX_CLIENT_VERSION = "0.154.0";
 var CODEX_ORIGINATOR = "codex_cli_rs";
 var CODEX_OPENAI_BETA = "responses=experimental";
 var OPENAI_AUTH_CLAIM = "https://api.openai.com/auth";
-var CODEX_INSTALLATION_ID = randomUUID3();
+var CODEX_INSTALLATION_ID = randomUUID2();
 function decodeCodexAccountId(accessToken) {
   const parts = accessToken.split(".");
   if (parts.length < 2) return void 0;
@@ -2600,10 +2677,10 @@ function decodeCodexAccountId(accessToken) {
   }
 }
 function createCodexRequestIdentity(installationId = CODEX_INSTALLATION_ID) {
-  const sessionId = randomUUID3();
-  const threadId = randomUUID3();
-  const windowId = randomUUID3();
-  const turnId = randomUUID3();
+  const sessionId = randomUUID2();
+  const threadId = randomUUID2();
+  const windowId = randomUUID2();
+  const turnId = randomUUID2();
   const turnMetadata = {
     installation_id: installationId,
     session_id: sessionId,
@@ -2723,7 +2800,7 @@ async function readSseEvents(response) {
   });
 }
 var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-async function callCodexResponsesOnce(args, accountId) {
+async function callCodexResponsesOnce(args, accountId, timingTracker) {
   const fetchImpl = args.fetchImpl ?? fetch;
   const identity = createCodexRequestIdentity();
   const body = buildCodexRequestBody(args, identity);
@@ -2743,7 +2820,17 @@ async function callCodexResponsesOnce(args, accountId) {
     };
   }
   const events = await readSseEvents(response);
-  const { text, toolCalls, usage, failure } = aggregateResponsesStream(events);
+  let firstAcceptedOutputAt;
+  const { text, toolCalls, usage, failure } = aggregateResponsesStream(events, {
+    onMeaningfulDelta: () => {
+      firstAcceptedOutputAt ??= timingTracker.now();
+    }
+  });
+  if (!failure && firstAcceptedOutputAt !== void 0) {
+    observeMeaningfulProviderResponseAt(timingTracker, firstAcceptedOutputAt);
+  }
+  const timingFields = finalizeProviderCallTiming(timingTracker);
+  const usageWithTiming = withProviderCallTimingFields(usage, timingFields);
   if (failure) {
     return {
       status: codexStreamFailureStatus(failure),
@@ -2771,7 +2858,7 @@ async function callCodexResponsesOnce(args, accountId) {
           finish_reason: toolCalls.length > 0 ? "tool_calls" : "stop"
         }
       ],
-      ...usage ? { usage } : {}
+      ...usageWithTiming ? { usage: usageWithTiming } : {}
     }
   };
 }
@@ -2790,12 +2877,13 @@ async function fetchCodexResponsesCompletion(args) {
   const sleep = args.sleep ?? defaultSleep;
   const requestedMaxAttempts = Number(args.maxAttempts);
   const maxAttempts = Number.isFinite(requestedMaxAttempts) ? Math.min(10, Math.max(1, Math.floor(requestedMaxAttempts))) : CODEX_STREAM_MAX_ATTEMPTS;
-  let result = await callCodexResponsesOnce(args, accountId);
+  const timingTracker = createProviderCallTimingTracker(args.now);
+  let result = await callCodexResponsesOnce(args, accountId, timingTracker);
   for (let attempt = 1; attempt < maxAttempts; attempt += 1) {
     if (!RETRYABLE_CODEX_STREAM_STATUSES.has(result.status)) break;
     if (args.signal?.aborted) break;
     await sleep(CODEX_STREAM_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
-    result = await callCodexResponsesOnce(args, accountId);
+    result = await callCodexResponsesOnce(args, accountId, timingTracker);
   }
   return result;
 }
@@ -2891,7 +2979,7 @@ var resolveCodexOAuthTransport = async (ctx) => {
 };
 
 // packages/agent-runtime/cursor/cursorProvider.ts
-import { createHash, randomUUID as randomUUID4 } from "node:crypto";
+import { createHash, randomUUID as randomUUID3 } from "node:crypto";
 import http2 from "node:http2";
 
 // node_modules/@bufbuild/protobuf/dist/esm/is-message.js
@@ -7650,7 +7738,7 @@ function deterministicUuid(seed) {
   const hex = hash.slice(0, 32);
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
-function createCursorUserMessage(content, text, messageId = randomUUID4()) {
+function createCursorUserMessage(content, text, messageId = randomUUID3()) {
   const images = extractImages(content);
   return create(UserMessageSchema, {
     text,
@@ -7669,7 +7757,7 @@ function extractImages(content) {
     const match = url.match(/^data:([^;,]+);base64,(.+)$/s);
     if (!match) return null;
     return create(SelectedImageSchema, {
-      uuid: randomUUID4(),
+      uuid: randomUUID3(),
       mimeType: match[1],
       dataOrBlobId: {
         case: "data",
@@ -7680,7 +7768,7 @@ function extractImages(content) {
 }
 function buildCursorRunRequestBytes(args) {
   const blobStore = args.blobStore ?? /* @__PURE__ */ new Map();
-  const conversationId = args.conversationId ?? randomUUID4();
+  const conversationId = args.conversationId ?? randomUUID3();
   const systemPromptIds = buildCursorSystemPromptJsons(
     args.systemPrompt ? [args.systemPrompt] : void 0
   ).map(
@@ -7818,7 +7906,7 @@ function processCursorServerMessage(msg, state, onTextDelta, onReasoningDelta) {
 async function streamCursorChat(messages, options) {
   const baseUrl = options.baseUrl || CURSOR_API_URL;
   const clientVersion = options.clientVersion || CURSOR_CLIENT_VERSION;
-  const conversationId = options.conversationId ?? randomUUID4();
+  const conversationId = options.conversationId ?? randomUUID3();
   const toolCalls = [];
   const state = createStreamState();
   const execCtx = {
@@ -7856,7 +7944,7 @@ async function streamCursorChat(messages, options) {
     "x-ghost-mode": "true",
     "x-cursor-client-version": clientVersion,
     "x-cursor-client-type": "cli",
-    "x-request-id": randomUUID4()
+    "x-request-id": randomUUID3()
   };
   try {
     h2Client = http2.connect(baseUrl);
@@ -8411,7 +8499,7 @@ async function handleExecServerMessage(execMsg, h2Request, ctx) {
   switch (execCase) {
     case "readArgs": {
       const args = execMsg.message.value;
-      if (!args.toolCallId) args.toolCallId = randomUUID4();
+      if (!args.toolCallId) args.toolCallId = randomUUID3();
       const path = args.path;
       const toolCallBlock = synthesizeCursorExecToolCall(ctx, args.toolCallId, "readFile", { path });
       let result;
@@ -8471,7 +8559,7 @@ async function handleExecServerMessage(execMsg, h2Request, ctx) {
     case "shellArgs":
     case "shellStreamArgs": {
       const args = execMsg.message.value;
-      if (!args.toolCallId) args.toolCallId = randomUUID4();
+      if (!args.toolCallId) args.toolCallId = randomUUID3();
       const command = args.command;
       const workingDirectory = args.workingDirectory || process.cwd();
       const shellTimeout = args.timeout && args.timeout > 0 ? args.timeout : void 0;
@@ -8570,7 +8658,7 @@ async function handleExecServerMessage(execMsg, h2Request, ctx) {
     }
     case "grepArgs": {
       const args = execMsg.message.value;
-      if (!args.toolCallId) args.toolCallId = randomUUID4();
+      if (!args.toolCallId) args.toolCallId = randomUUID3();
       const searchPath = args.glob ? `${args.path || "."}/${args.glob}` : args.path || ".";
       const pattern = args.pattern || "";
       const toolCallBlock = synthesizeCursorExecToolCall(ctx, args.toolCallId, "searchWorkspace", {
@@ -8638,7 +8726,7 @@ async function handleExecServerMessage(execMsg, h2Request, ctx) {
     }
     case "writeArgs": {
       const args = execMsg.message.value;
-      if (!args.toolCallId) args.toolCallId = randomUUID4();
+      if (!args.toolCallId) args.toolCallId = randomUUID3();
       const path = args.path;
       const content = args.fileText ?? new TextDecoder().decode(args.fileBytes ?? new Uint8Array());
       const toolCallBlock = synthesizeCursorExecToolCall(ctx, args.toolCallId, "writeFile", { path, content });
@@ -8701,7 +8789,7 @@ async function handleExecServerMessage(execMsg, h2Request, ctx) {
     }
     case "deleteArgs": {
       const args = execMsg.message.value;
-      if (!args.toolCallId) args.toolCallId = randomUUID4();
+      if (!args.toolCallId) args.toolCallId = randomUUID3();
       const path = args.path;
       const toolCallBlock = synthesizeCursorExecToolCall(ctx, args.toolCallId, "deleteFile", { path });
       let result;
@@ -8760,7 +8848,7 @@ async function handleExecServerMessage(execMsg, h2Request, ctx) {
     }
     case "lsArgs": {
       const args = execMsg.message.value;
-      if (!args.toolCallId) args.toolCallId = randomUUID4();
+      if (!args.toolCallId) args.toolCallId = randomUUID3();
       const path = args.path;
       const toolCallBlock = synthesizeCursorExecToolCall(ctx, args.toolCallId, "listWorkspaceEntries", { path: path || "." });
       let result;
@@ -8821,7 +8909,7 @@ async function handleExecServerMessage(execMsg, h2Request, ctx) {
       for (const [key, value] of Object.entries(args.args ?? {})) {
         decodedArgs[key] = decodeMcpArgValue(value);
       }
-      if (!args.toolCallId) args.toolCallId = randomUUID4();
+      if (!args.toolCallId) args.toolCallId = randomUUID3();
       const toolCallBlock = synthesizeCursorExecToolCall(ctx, args.toolCallId, toolName, decodedArgs);
       let result;
       if (ctx.executeTool) {
@@ -9261,6 +9349,8 @@ var resolveGeminiNativeToolTransport = async (ctx) => {
             content: text,
             model,
             tool_calls: toolCalls.length > 0 ? toolCalls : void 0,
+            finish_reason: toolCalls.length > 0 ? "tool_calls" : "stop",
+            stream_complete: true,
             ...usage ? { usage } : {},
             trace: messages
           };
@@ -9322,6 +9412,7 @@ var resolvePlatformProxyTransport = async (ctx) => {
     return {
       model: providerConfig.model,
       complete: async (messages, options) => {
+        const requestId = crypto.randomUUID();
         const usesResponsesApi = providerConfig.endpoint.includes("/responses");
         const stream = Boolean(options?.onTextDelta);
         const request = buildPlatformChatCompletionRequest({
@@ -9329,6 +9420,7 @@ var resolvePlatformProxyTransport = async (ctx) => {
           messages,
           tools,
           stream,
+          requestId,
           ...options?.dialogId ? { dialogId: options.dialogId } : {}
         });
         logLocalRuntimeDiagnostic("provider.request.start", {
@@ -9341,93 +9433,122 @@ var resolvePlatformProxyTransport = async (ctx) => {
           toolCount: tools.length,
           requestedToolNames,
           openAiToolNames: summarizeOpenAiToolNames(tools),
-          stream
+          stream,
+          requestId
         });
-        let res = await fetchWithTransientRetry(
-          fetchImpl,
-          request.url,
-          {
-            ...request.init
-          },
-          {
-            sleep: deps.sleep,
-            loopbackRequest,
-            // A chat POST is not safe to replay after an ambiguous network or
-            // gateway failure: the server/provider may already have accepted
-            // it. The client only waits through the server's explicit pre-
-            // admission deployment drain signal.
-            retryableStatuses: /* @__PURE__ */ new Set([503]),
-            shouldRetryResponse: shouldRetryPlatformProxyResponse,
-            retryNetworkErrors: false,
-            onRetry: deps.activityReporter ? ({ attempt, maxAttempts, delayMs }) => {
-              deps.activityReporter(
-                `\u81EA\u52A8\u91CD\u8BD5 ${attempt}/${maxAttempts} \xB7 ${Math.ceil(delayMs / 1e3)}s`
-              );
-            } : void 0
-          }
-        );
-        if (!res.ok) {
-          const raw2 = await res.text().catch(() => "");
-          const data2 = parsePlatformChatCompletionData(raw2);
-          await recordLocalAvailability(res.status, data2);
-          const rawPreview = raw2.length > 200 ? `${raw2.slice(0, 200)}\u2026(${raw2.length}b)` : raw2;
-          const gatewayHeaders = [
-            "server",
-            "cf-ray",
-            "cf-cache-status",
-            "content-length"
-          ].map((h) => {
-            const v = res.headers.get(h);
-            return v ? `${h}=${v}` : null;
-          }).filter(Boolean).join(" ");
-          throw new Error(
-            `platform provider failed: HTTP ${res.status} ${JSON.stringify(data2)}` + (rawPreview ? ` raw="${rawPreview}"` : "") + (gatewayHeaders ? ` headers=[${gatewayHeaders}]` : "")
+        try {
+          let res = await fetchWithTransientRetry(
+            fetchImpl,
+            request.url,
+            {
+              ...request.init
+            },
+            {
+              sleep: deps.sleep,
+              loopbackRequest,
+              // A chat POST is not safe to replay after an ambiguous network or
+              // gateway failure: the server/provider may already have accepted
+              // it. The client only waits through the server's explicit pre-
+              // admission deployment drain signal.
+              retryableStatuses: /* @__PURE__ */ new Set([503]),
+              shouldRetryResponse: shouldRetryPlatformProxyResponse,
+              retryNetworkErrors: false,
+              onRetry: deps.activityReporter ? ({ attempt, maxAttempts, delayMs }) => {
+                deps.activityReporter(
+                  `\u81EA\u52A8\u91CD\u8BD5 ${attempt}/${maxAttempts} \xB7 ${Math.ceil(delayMs / 1e3)}s`
+                );
+              } : void 0
+            }
           );
-        }
-        await recordLocalAvailability(res.status);
-        const contentType = res.headers.get("content-type") ?? "";
-        const shouldStream = Boolean(stream && options?.onTextDelta) && contentType.includes("text/event-stream");
-        if (shouldStream && options?.onTextDelta) {
-          const streamed = await readPlatformChatSseCompletion({
-            response: res,
-            usesResponsesApi,
-            onTextDelta: options.onTextDelta,
-            onReasoningDelta: options.onReasoningDelta
-          });
+          if (!res.ok) {
+            const raw2 = await res.text().catch(() => "");
+            const data2 = parsePlatformChatCompletionData(raw2);
+            await recordLocalAvailability(res.status, data2);
+            const rawPreview = raw2.length > 200 ? `${raw2.slice(0, 200)}\u2026(${raw2.length}b)` : raw2;
+            const gatewayHeaders = [
+              "server",
+              "cf-ray",
+              "cf-cache-status",
+              "content-length"
+            ].map((h) => {
+              const v = res.headers.get(h);
+              return v ? `${h}=${v}` : null;
+            }).filter(Boolean).join(" ");
+            throw new Error(
+              `platform provider failed: HTTP ${res.status} ${JSON.stringify(data2)}` + (rawPreview ? ` raw="${rawPreview}"` : "") + (gatewayHeaders ? ` headers=[${gatewayHeaders}]` : "")
+            );
+          }
+          await recordLocalAvailability(res.status);
+          const contentType = res.headers.get("content-type") ?? "";
+          const shouldStream = Boolean(stream && options?.onTextDelta) && contentType.includes("text/event-stream");
+          if (shouldStream && options?.onTextDelta) {
+            const streamed = await readPlatformChatSseCompletion({
+              response: res,
+              usesResponsesApi,
+              onTextDelta: options.onTextDelta,
+              onReasoningDelta: options.onReasoningDelta
+            });
+            if (streamed.streamTruncated) {
+              logLocalRuntimeDiagnostic("provider.stream.truncated", {
+                phase: "streaming",
+                contentChars: streamed.content.length,
+                toolCallCount: streamed.tool_calls?.length ?? 0,
+                requestId,
+                ...options?.dialogId ? { dialogId: options.dialogId } : {}
+              });
+            }
+            logLocalRuntimeDiagnostic("provider.request.result", {
+              agentKey: agentConfig.key,
+              transport: "platform-proxy",
+              ok: true,
+              stream: true,
+              contentChars: streamed.content.length,
+              toolCallCount: streamed.tool_calls?.length ?? 0
+            });
+            return {
+              content: streamed.content,
+              model: providerConfig.model,
+              provider: providerConfig.provider,
+              ...streamed.tool_calls ? { tool_calls: streamed.tool_calls } : {},
+              ...streamed.reasoning_content ? { reasoning_content: streamed.reasoning_content } : {},
+              ...streamed.usage ? { usage: streamed.usage } : {},
+              ...streamed.finish_reason ? { finish_reason: streamed.finish_reason } : {},
+              ...streamed.stream_complete ? { stream_complete: streamed.stream_complete } : {},
+              ...streamed.streamTruncated ? { stream_truncated: true } : {},
+              trace: messages
+            };
+          }
+          const raw = await res.text().catch(() => "");
           logLocalRuntimeDiagnostic("provider.request.result", {
             agentKey: agentConfig.key,
             transport: "platform-proxy",
-            ok: true,
-            stream: true,
-            contentChars: streamed.content.length,
-            toolCallCount: streamed.tool_calls?.length ?? 0
+            status: res.status,
+            ok: res.ok,
+            responseBytes: raw.length
           });
-          return {
-            content: streamed.content,
-            model: providerConfig.model,
-            provider: providerConfig.provider,
-            ...streamed.tool_calls ? { tool_calls: streamed.tool_calls } : {},
-            ...streamed.reasoning_content ? { reasoning_content: streamed.reasoning_content } : {},
-            ...streamed.usage ? { usage: streamed.usage } : {},
-            ...streamed.finish_reason ? { finish_reason: streamed.finish_reason } : {},
-            ...streamed.stream_complete ? { stream_complete: streamed.stream_complete } : {},
+          const data = parsePlatformChatCompletionData(raw);
+          return parsePlatformChatCompletionResponse({
+            providerConfig,
+            data,
             trace: messages
-          };
+          });
+        } catch (error) {
+          if (error instanceof PlatformStreamInterruptedError) {
+            logLocalRuntimeDiagnostic("provider.stream.interrupted", {
+              phase: error.phase,
+              frameCount: error.frameCount,
+              textChars: error.textChars,
+              sawDone: error.sawDone,
+              sawUsage: error.sawUsage,
+              sawFinishReason: error.sawFinishReason,
+              elapsedMs: error.elapsedMs,
+              requestId,
+              ...options?.dialogId ? { dialogId: options.dialogId } : {},
+              cause: error.cause instanceof Error ? error.cause.message : typeof error.cause === "string" ? error.cause : error.message
+            });
+          }
+          throw error;
         }
-        const raw = await res.text().catch(() => "");
-        logLocalRuntimeDiagnostic("provider.request.result", {
-          agentKey: agentConfig.key,
-          transport: "platform-proxy",
-          status: res.status,
-          ok: res.ok,
-          responseBytes: raw.length
-        });
-        const data = parsePlatformChatCompletionData(raw);
-        return parsePlatformChatCompletionResponse({
-          providerConfig,
-          data,
-          trace: messages
-        });
       }
     };
   }
@@ -9520,19 +9641,6 @@ function withProviderStreamRetry(provider, deps) {
   };
 }
 
-// packages/cli/client/localRuntimeHelpers.ts
-var REMOTE_DIALOG_SYNC_TIMEOUT_MS = 1e4;
-var remoteDialogSyncTimeoutMsForTest;
-function remoteDialogSyncTimeout() {
-  return remoteDialogSyncTimeoutMsForTest ?? REMOTE_DIALOG_SYNC_TIMEOUT_MS;
-}
-function resolveRuntimeServerUrl(env) {
-  return (env?.NOLO_SERVER_URL || env?.NOLO_SERVER || env?.BASE_URL || "").replace(/\/+$/, "");
-}
-function resolveRuntimeAuthToken(env) {
-  return resolvePlatformAuthToken(env ?? {});
-}
-
 // packages/cli/client/cliRemoteDialogSync.ts
 function prepareRemoteDialogEvidenceRecord(key, value) {
   const record = isRecord(value) ? { ...value } : {};
@@ -9541,9 +9649,6 @@ function prepareRemoteDialogEvidenceRecord(key, value) {
   }
   return record;
 }
-function normalizeRemoteStringList(value) {
-  return [...new Set(asTrimmedNonEmptyStringArray(value))];
-}
 function normalizeRemoteSubjectRef(value) {
   if (!isRecord(value)) return null;
   const kind = asOptionalTrimmedString(value.kind);
@@ -9694,15 +9799,6 @@ async function maybeWakeParentDialogAfterLocalSync(args) {
     args.childDialogRecord.subjectRefs,
     [{ kind: "dialog", id: childDialogId, role: "completed-child-dialog" }]
   );
-  const allowedChildAgentKeys = normalizeRemoteStringList(
-    args.input.runtimeContext?.allowedChildAgentKeys
-  );
-  const allowedToolNames = normalizeRemoteStringList(
-    args.input.runtimeContext?.allowedToolNames
-  );
-  const blockedToolNames = normalizeRemoteStringList(
-    args.input.runtimeContext?.blockedToolNames
-  );
   const wakeResponse = await args.fetchImpl(`${args.serverUrl}/api/agent/run`, {
     method: "POST",
     headers: {
@@ -9730,10 +9826,7 @@ async function maybeWakeParentDialogAfterLocalSync(args) {
           label: args.childDialogRecord.taskLabel ?? args.childDialogRecord.title,
           terminalStatus: "done"
         }),
-        subjectRefs,
-        ...allowedChildAgentKeys.length ? { allowedChildAgentKeys } : {},
-        ...allowedToolNames.length ? { allowedToolNames } : {},
-        ...blockedToolNames.length ? { blockedToolNames } : {}
+        subjectRefs
       }
     })
   });
@@ -9866,61 +9959,6 @@ async function readDialogMessages(args) {
   return messages;
 }
 
-// packages/cli/client/cliAgentConfigHelpers.ts
-var BUILTIN_NOLO_AGENT_KEY = NOLO_DEFAULT_AGENT_KEY;
-var BUILTIN_NOLO_AGENT_ID = NOLO_DEFAULT_AGENT_ID;
-function resolveLocalUserId(env) {
-  const explicitUserId = env.NOLO_LOCAL_USER_ID || env.NOLO_USER_ID;
-  if (explicitUserId) return explicitUserId;
-  const tokenUserId = parseUserIdFromAuthToken(resolveRuntimeAuthToken(env));
-  return tokenUserId || "local";
-}
-function isBuiltinNoloAgentRef(ref) {
-  if (typeof ref !== "string") return false;
-  const normalized = ref.trim();
-  return normalized === BUILTIN_NOLO_AGENT_KEY || normalized === BUILTIN_NOLO_AGENT_ID || normalized.endsWith(`-${BUILTIN_NOLO_AGENT_ID}`);
-}
-function isBuiltinNoloAgentConfig(agentConfig) {
-  const key = agentConfig?.key || agentConfig?.rawRecord?.dbKey || agentConfig?.rawRecord?.agentKey;
-  const id = agentConfig?.rawRecord?.id;
-  return isBuiltinNoloAgentRef(key) || isBuiltinNoloAgentRef(id);
-}
-function withResolvedRuntimeToolSurface(agentConfig, env) {
-  if (!agentConfig) return agentConfig;
-  const currentUserId = resolveLocalUserId(env);
-  const rawRecord = agentConfig.rawRecord ?? {};
-  const ownerId = asOptionalTrimmedString(rawRecord.userId) ?? null;
-  const agentKey = rawRecord.dbKey ?? agentConfig.key;
-  const toolSurface = resolveRuntimeToolSurfaceForAgent({
-    explicitToolNames: agentConfig.toolNames,
-    currentUserId,
-    agentOwnerId: ownerId,
-    agentKey,
-    isPublic: !isBuiltinNoloAgentConfig(agentConfig) && rawRecord.isPublic === true,
-    sharingLevel: typeof rawRecord.sharingLevel === "string" ? rawRecord.sharingLevel : null,
-    trustedPrivateInvocation: isBuiltinNoloAgentConfig(agentConfig) || isSystemBuiltinTrustedAgentKey(agentKey),
-    runtimeHost: "cli"
-  });
-  return {
-    ...agentConfig,
-    toolNames: toolSurface.finalToolNames,
-    toolSurface,
-    prompt: agentConfig.prompt
-  };
-}
-function extractLastUserText(messages) {
-  const lastUser = [...messages].reverse().find((m) => m.role === "user");
-  if (!lastUser) return "";
-  if (typeof lastUser.content === "string") return lastUser.content;
-  if (Array.isArray(lastUser.content)) {
-    return lastUser.content.filter((part) => part?.type === "text").map((part) => part.text ?? "").join(" ");
-  }
-  return "";
-}
-function localTurnHasSubjectRefs(input) {
-  return Array.isArray(input.runtimeContext?.subjectRefs) && input.runtimeContext.subjectRefs.length > 0;
-}
-
 // packages/core/fetchWebpageShaping.ts
 var FETCH_WEBPAGE_PREVIEW_LENGTH = 1200;
 var FETCH_WEBPAGE_MAX_CONTENT_LENGTH = 12 * 1024;
@@ -10246,6 +10284,60 @@ function buildServerPlatformToolExecutors(args) {
 
 // packages/cli/client/cliAgentRunToolExecutors.ts
 import * as nodeFs2 from "node:fs";
+
+// packages/agent-runtime/waitForRunTerminal.ts
+var readEffect = (read) => Effect_exports.tryPromise({ try: () => Promise.resolve(read()), catch: (error) => error });
+function waitForRunTerminal(args) {
+  let lastState;
+  let token = null;
+  let committed = false;
+  const abort = args.abortSignal;
+  let removeAbortListener;
+  const abortEffect = abort ? Effect_exports.callback((resume) => {
+    const listener = () => resume(Effect_exports.succeed("aborted"));
+    if (abort.aborted) {
+      listener();
+      return;
+    }
+    removeAbortListener = () => {
+      abort.removeEventListener("abort", listener);
+      removeAbortListener = void 0;
+    };
+    abort.addEventListener("abort", listener, { once: true });
+    return Effect_exports.sync(() => removeAbortListener?.());
+  }).pipe(Effect_exports.ensuring(Effect_exports.sync(() => removeAbortListener?.()))) : void 0;
+  const sleep = (ms) => {
+    const effect = args.sleep ? Effect_exports.tryPromise({ try: () => Promise.resolve(args.sleep(ms)), catch: (error) => error }) : Effect_exports.sleep(Duration_exports.millis(ms));
+    return abortEffect ? Effect_exports.raceFirst(effect, abortEffect) : effect;
+  };
+  const loop = Effect_exports.gen(function* () {
+    token = args.claim?.acquire() ?? null;
+    while (true) {
+      const state = yield* readEffect(args.read);
+      lastState = state;
+      if (args.isTerminal(state)) {
+        if (args.claim) {
+          args.claim.commit(token);
+          committed = true;
+        }
+        return { kind: "terminal", state };
+      }
+      const slept = yield* sleep(args.pollIntervalMs);
+      if (slept === "aborted") return { kind: "aborted" };
+    }
+  }).pipe(
+    Effect_exports.timeoutOption(Duration_exports.millis(args.timeoutMs)),
+    Effect_exports.map((result) => Option_exports.isNone(result) ? { kind: "timeout", waitedMs: args.timeoutMs, lastState } : result.value),
+    Effect_exports.catch((error) => Effect_exports.succeed({ kind: "failed", error })),
+    Effect_exports.ensuring(Effect_exports.sync(() => {
+      if (args.claim && !committed) args.claim.release(token);
+    }))
+  );
+  const run = args.runtime ? args.runtime.runPromise(loop) : Effect_exports.runPromise(loop);
+  return run;
+}
+
+// packages/cli/client/cliAgentRunToolExecutors.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 
 // packages/cli/client/agentRunSnapshot.ts
@@ -10333,6 +10425,24 @@ function parseAgentRunEvent(event) {
   if (!snapshot.runId) return null;
   return { kind: "status", snapshot };
 }
+function isFailedToolEvent(event) {
+  if (event.type === "tool-error") return true;
+  if (event.metadata?.actionGate) return false;
+  const exitCode = event.metadata?.exitCode;
+  if (typeof exitCode === "number" && exitCode !== 0) return true;
+  if (event.metadata?.failed || event.metadata?.timedOut) return true;
+  return false;
+}
+var LIVE_RUN_STATUSES = /* @__PURE__ */ new Set(["running", "pending"]);
+function isLiveAgentRunObservation(event, parsed) {
+  if (event.type !== "tool-result") return false;
+  if (event.toolName !== "controlAgentRun") return false;
+  if (isFailedToolEvent(event)) return false;
+  const resolved = parsed !== void 0 ? parsed : parseAgentRunEvent(event);
+  if (!resolved || resolved.kind !== "status") return false;
+  if (!LIVE_RUN_STATUSES.has(resolved.snapshot.status)) return false;
+  return true;
+}
 
 // packages/ai/tools/agent/batchAggregation.ts
 var DEFAULT_BATCH_TIMEOUT_MS = 30 * 60 * 1e3;
@@ -10624,9 +10734,6 @@ function buildRunStatusPayload(reconciled, deps, opts = {}) {
   const logLines = opts.logTail ? opts.logTail.split("\n") : void 0;
   const name = resolveRunLabel(reconciled);
   const labels = agentRunCardLabels();
-  const fs = resolveFs(deps);
-  const reportPath = resolveRunReportPath(reconciled.runId, deps.env, deps.homedir);
-  const reportExists = Boolean(fs.existsSync?.(reportPath));
   return {
     content: JSON.stringify({
       runId: reconciled.runId,
@@ -10646,7 +10753,6 @@ function buildRunStatusPayload(reconciled, deps, opts = {}) {
         ephemeral: true,
         dialogNote: "\u6B64 run \u672A\u6301\u4E45\u5316 dialog\uFF0C\u7ED3\u679C\u89C1 run \u8F93\u51FA"
       } : reconciled.dialogId ? { dialogId: reconciled.dialogId } : {},
-      ...reportExists ? { reportPath } : {},
       // Progress is what makes tailLines:0 an actual answer to "is it
       // stuck?". Without it a poll returns `running` and a pid, so the only
       // way to tell a working run from a wedged one was to pull 30 lines of
@@ -10658,7 +10764,6 @@ function buildRunStatusPayload(reconciled, deps, opts = {}) {
       ...logLines ? { logLines } : {}
     }),
     metadata: {
-      ...reportExists ? { reportPath } : {},
       displayData: formatStatusRunCard(name, reconciled.status, {
         runId: reconciled.runId,
         timing: {
@@ -10679,10 +10784,8 @@ function createCliStartAgentRunExecutor(deps = {}) {
     if (!agentKey) throw new Error("startAgentRun: \u7F3A\u5C11 agentKey \u53C2\u6570\u3002");
     if (!task) throw new Error("startAgentRun: \u7F3A\u5C11\u6709\u6548\u7684 task \u6587\u672C\u63CF\u8FF0\u3002");
     const nowMs = resolveNowMs(deps);
-    const message = typeof args.input === "undefined" ? task : `${task}
-
---- \u9644\u52A0\u8F93\u5165 ---
-${JSON.stringify(args.input)}`;
+    const message = buildDelegatedTaskContent(task, args.input);
+    const payloadMetrics = calculateDelegatedPayloadMetrics(task, args.input, message);
     const rawArgs = [
       "--agent",
       agentKey,
@@ -10749,14 +10852,16 @@ ${JSON.stringify(args.input)}`;
         // even when the caller didn't supply one, a fresh id was generated.
         batchId: resolvedBatchId,
         ...agentName ? { agentName } : {},
-        ...taskPreview ? { taskPreview } : {}
+        ...taskPreview ? { taskPreview } : {},
+        payloadMetrics
       }),
       metadata: {
         displayData: formatStartRunCard(displayName, "running", {
           task: taskPreview,
           runId,
           labels
-        })
+        }),
+        payloadMetrics
       }
     };
   };
@@ -10937,21 +11042,21 @@ function createCliControlAgentRunExecutor(deps = {}) {
           metadata: { displayData: formatNotFoundRunCard(labels2) }
         };
       }
-      let reconciled = checkStaleRun(record2.runId, deps) ?? record2;
-      if (!isAgentRunTerminalStatus(reconciled.status)) {
-        if (!reconciled.queuePath) {
+      let reconciled2 = checkStaleRun(record2.runId, deps) ?? record2;
+      if (!isAgentRunTerminalStatus(reconciled2.status)) {
+        if (!reconciled2.queuePath) {
           throw new Error("\u8BE5 run \u542F\u52A8\u65F6\u4E0D\u652F\u6301\u8FD0\u884C\u4E2D\u5165\u961F\uFF08\u65E0\u961F\u5217\u901A\u9053\uFF09\uFF0C\u8BF7\u7B49\u7EC8\u6001\u540E\u518D append");
         }
-        const queuePath = reconciled.queuePath;
+        const queuePath = reconciled2.queuePath;
         const { queuedCount, entryId } = await appendRunQueue(queuePath, userInput, deps);
         const displayName = resolveRunLabel({
-          agentName: reconciled.agentName,
-          agentKey: reconciled.agentKey,
-          runId: reconciled.runId
+          agentName: reconciled2.agentName,
+          agentKey: reconciled2.agentKey,
+          runId: reconciled2.runId
         });
         const labels2 = agentRunCardLabels();
         const taskPreview = userInput.replace(/\s+/g, " ").trim().slice(0, TASK_PREVIEW_MAX);
-        const afterCheck = checkStaleRun(reconciled.runId, deps) ?? reconciled;
+        const afterCheck = checkStaleRun(reconciled2.runId, deps) ?? reconciled2;
         if (isAgentRunTerminalStatus(afterCheck.status)) {
           const remainingEntries = await popAllQueueEntries(queuePath, deps);
           const ourEntryFound = remainingEntries.some((e) => e.id === entryId);
@@ -10965,19 +11070,19 @@ function createCliControlAgentRunExecutor(deps = {}) {
             }
             return {
               content: JSON.stringify({
-                runId: reconciled.runId,
+                runId: reconciled2.runId,
                 // ephemeral 不外泄合成 dialogId；非 ephemeral 保持原 dialogId 透出。
-                ...reconciled.ephemeral ? { ephemeral: true } : afterCheck.dialogId || reconciled.dialogId ? { dialogId: afterCheck.dialogId ?? reconciled.dialogId } : {},
+                ...reconciled2.ephemeral ? { ephemeral: true } : afterCheck.dialogId || reconciled2.dialogId ? { dialogId: afterCheck.dialogId ?? reconciled2.dialogId } : {},
                 mode: "enqueue",
                 consumed: true,
                 status: afterCheck.status,
-                ...reconciled.agentName ? { agentName: reconciled.agentName } : {},
+                ...reconciled2.agentName ? { agentName: reconciled2.agentName } : {},
                 ...taskPreview ? { taskPreview } : {}
               }),
               metadata: {
                 displayData: formatStartRunCard(displayName, afterCheck.status, {
                   task: `[consumed] ${taskPreview}`,
-                  runId: reconciled.runId,
+                  runId: reconciled2.runId,
                   labels: labels2
                 })
               }
@@ -10988,25 +11093,25 @@ function createCliControlAgentRunExecutor(deps = {}) {
         }
         return {
           content: JSON.stringify({
-            runId: reconciled.runId,
+            runId: reconciled2.runId,
             // ephemeral 不外泄合成 dialogId（enqueue 场景同样收敛）。
-            ...reconciled.ephemeral ? { ephemeral: true } : reconciled.dialogId ? { dialogId: reconciled.dialogId } : {},
+            ...reconciled2.ephemeral ? { ephemeral: true } : reconciled2.dialogId ? { dialogId: reconciled2.dialogId } : {},
             mode: "enqueue",
             queued: queuedCount,
             status: "running",
-            ...reconciled.agentName ? { agentName: reconciled.agentName } : {},
+            ...reconciled2.agentName ? { agentName: reconciled2.agentName } : {},
             ...taskPreview ? { taskPreview } : {}
           }),
           metadata: {
             displayData: formatStartRunCard(displayName, "running", {
               task: `[enqueued ${queuedCount}] ${taskPreview}`,
-              runId: reconciled.runId,
+              runId: reconciled2.runId,
               labels: labels2
             })
           }
         };
       }
-      return await spawnContinuationRun(reconciled, userInput, deps);
+      return await spawnContinuationRun(reconciled2, userInput, deps);
     }
     if (action !== "status" && action !== "stop" && action !== "wait") {
       throw new Error(`controlAgentRun: \u672A\u77E5 action "${action}"\u3002`);
@@ -11021,82 +11126,65 @@ function createCliControlAgentRunExecutor(deps = {}) {
       };
     }
     if (action === "status") {
-      const reconciled = checkStaleRun(record.runId, deps) ?? record;
+      const reconciled2 = checkStaleRun(record.runId, deps) ?? record;
       const logTail = tailLines > 0 ? tailFile(record.logPath, tailLines, resolveFs(deps)) : void 0;
-      return buildRunStatusPayload(reconciled, deps, { logTail });
+      return buildRunStatusPayload(reconciled2, deps, { logTail });
     }
     if (action === "wait") {
       const timeoutMs = typeof args.timeoutMs === "number" && args.timeoutMs > 0 ? args.timeoutMs : DEFAULT_WAIT_TIMEOUT_MS;
-      const claimToken = claimRunRecord(record.runId, {
-        ...deps,
-        ttlMs: timeoutMs + ACK_LEASE_GRACE_MS
-      });
-      let claimConsumed = false;
-      try {
-        const startMs = resolveNowMs(deps);
-        const deadline = startMs + timeoutMs;
-        const baseSleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-        const sleep = abortSignal ? (ms) => new Promise((resolve, reject) => {
-          const done = () => {
-            abortSignal.removeEventListener("abort", done);
-            resolve();
-          };
-          abortSignal.addEventListener("abort", done, { once: true });
-          Promise.resolve(baseSleep(ms)).then(done).catch((err) => {
-            abortSignal.removeEventListener("abort", done);
-            reject(err);
-          });
-        }) : baseSleep;
-        let reconciled = record;
-        for (; ; ) {
-          reconciled = checkStaleRun(record.runId, deps) ?? record;
-          if (isAgentRunTerminalStatus(reconciled.status)) break;
-          if (abortSignal?.aborted) {
-            throw new Error("controlAgentRun(wait) \u5DF2\u88AB\u4E2D\u6B62\u3002");
-          }
-          const nowMs = resolveNowMs(deps);
-          const waitedMs = nowMs - startMs;
-          if (nowMs >= deadline) {
-            return {
-              content: JSON.stringify({
-                runId: reconciled.runId,
-                found: true,
-                status: "timeout",
-                runStatus: reconciled.status,
-                pid: reconciled.pid ?? null,
-                agentKey: reconciled.agentKey,
-                ...reconciled.agentName ? { agentName: reconciled.agentName } : {},
-                startedAt: reconciled.startedAt,
-                waitedMs,
-                timeoutMs,
-                ...buildProgressField(reconciled, nowMs)
-              }),
-              metadata: {
-                displayData: `\u23F3 wait \u8D85\u65F6\uFF08${Math.round(waitedMs / 1e3)}s\uFF09\uFF0Crun \u4ECD\u5728\u8FD0\u884C\uFF1A\u53EF\u7A0D\u540E\u518D wait\uFF0C\u6216\u6539\u7528 status/stop`
-              }
-            };
+      let claimToken = null;
+      const result = await waitForRunTerminal({
+        read: () => checkStaleRun(record.runId, deps) ?? record,
+        isTerminal: (state) => isAgentRunTerminalStatus(state.status),
+        pollIntervalMs: WAIT_POLL_INTERVAL_MS,
+        timeoutMs,
+        abortSignal,
+        sleep: deps.sleep,
+        claim: {
+          acquire: () => {
+            claimToken = claimRunRecord(record.runId, { ...deps, ttlMs: timeoutMs + ACK_LEASE_GRACE_MS });
+            return claimToken;
+          },
+          commit: (token) => {
+            if (token) commitRunRecordClaim(record.runId, token, deps);
+            else ackRunRecord(record.runId, deps);
+          },
+          release: (token) => {
+            if (token) releaseRunRecordAck(record.runId, token, deps);
           }
-          await sleep(WAIT_POLL_INTERVAL_MS);
-        }
-        const payload = buildRunStatusPayload(reconciled, deps);
-        if (claimToken) commitRunRecordClaim(record.runId, claimToken, deps);
-        else ackRunRecord(reconciled.runId, deps);
-        claimConsumed = true;
-        return payload;
-      } finally {
-        if (!claimConsumed && claimToken) {
-          releaseRunRecordAck(record.runId, claimToken, deps);
         }
+      });
+      if (result.kind === "aborted") throw new Error("controlAgentRun(wait) \u5DF2\u88AB\u4E2D\u6B62\u3002");
+      if (result.kind === "failed") throw result.error;
+      if (result.kind === "timeout") {
+        const reconciled2 = result.lastState ?? record;
+        const nowMs = resolveNowMs(deps);
+        return { content: JSON.stringify({ runId: reconciled2.runId, found: true, status: "timeout", runStatus: reconciled2.status, pid: reconciled2.pid ?? null, agentKey: reconciled2.agentKey, ...reconciled2.agentName ? { agentName: reconciled2.agentName } : {}, startedAt: reconciled2.startedAt, waitedMs: result.waitedMs, timeoutMs, ...buildProgressField(reconciled2, nowMs) }), metadata: { displayData: `\u23F3 wait \u8D85\u65F6\uFF08${Math.round(result.waitedMs / 1e3)}s\uFF09\uFF0Crun \u4ECD\u5728\u8FD0\u884C\uFF1A\u53EF\u7A0D\u540E\u518D wait\uFF0C\u6216\u6539\u7528 status/stop` } };
       }
+      return buildRunStatusPayload(result.state, deps);
+    }
+    const reconciled = checkStaleRun(record.runId, deps) ?? record;
+    if (isAgentRunTerminalStatus(reconciled.status)) {
+      const labels2 = agentRunCardLabels();
+      return {
+        content: JSON.stringify({
+          runId: reconciled.runId,
+          found: true,
+          status: reconciled.status
+        }),
+        metadata: {
+          displayData: formatStopRunCard(reconciled.status, labels2)
+        }
+      };
     }
-    if (typeof record.pid === "number") {
-      const confirmed = await terminateRunProcess(record, "SIGTERM", deps);
+    if (typeof reconciled.pid === "number") {
+      const confirmed = await (deps.terminateRunProcess ?? terminateRunProcess)(reconciled, "SIGTERM", deps);
       if (!confirmed) {
         return {
           content: JSON.stringify({
             runId: record.runId,
             found: true,
-            status: record.status,
+            status: reconciled.status,
             stopConfirmed: false
           }),
           metadata: {
@@ -11105,11 +11193,21 @@ function createCliControlAgentRunExecutor(deps = {}) {
         };
       }
     }
-    finalizeRunRecord(record.runId, { status: "killed" }, deps);
+    const transition = transitionRunToTerminal(reconciled.runId, { status: "killed" }, deps);
+    const finalRecord = transition.kind === "not_found" ? reconciled : transition.record;
     const labels = agentRunCardLabels();
     return {
-      content: JSON.stringify({ runId: record.runId, found: true, status: "killed" }),
-      metadata: { displayData: formatStopRunCard("killed", labels) }
+      content: JSON.stringify({
+        runId: finalRecord.runId,
+        found: true,
+        status: finalRecord.status,
+        // 进程已确认终止、但 terminal 记录被并发 writer 占住（待 reconcile）：
+        // 如实标记 terminal 未落盘，不偷偷重写 killed。
+        ...transition.kind === "contended" ? { terminalPersisted: false } : {}
+      }),
+      metadata: {
+        displayData: transition.kind === "contended" ? `${formatStopRunCard(finalRecord.status, labels)} (pending reconcile)` : formatStopRunCard(finalRecord.status, labels)
+      }
     };
   };
 }
@@ -11408,7 +11506,7 @@ function buildLocalToolExecutors(args) {
 var REFRESH_BY_PROVIDER = {
   chatgpt: refreshOpenAiCodexToken,
   // Previously only chatgpt was wired; expired antigravity/xai tokens then
-  // surfaced as "OAuth credential not found" even when ~/.nolo/credentials
+  // surfaced as "OAuth credential not found" even when `$NOLO_HOME/credentials` (or `~/.nolo/credentials` when `NOLO_HOME` is unset)
   // still held a valid refresh_token.
   antigravity: refreshAntigravityOAuthToken,
   xai: xaiRefresh,
@@ -11426,11 +11524,12 @@ function createOAuthApiKeyRefResolver(options = {}) {
     const token = await resolveFreshAccessToken({
       provider,
       ...options.homeDir ? { homeDir: options.homeDir } : {},
+      ...options.migration ? { migration: options.migration } : {},
       ...refresh ? { refresh } : {},
       ...opts?.force ? { force: true } : {}
     });
     if (token) return token;
-    const store = createOAuthTokenStore(options.homeDir);
+    const store = createOAuthTokenStore(options.homeDir, options.migration);
     const credential = store.read(provider);
     if (credential && isTokenExpired(credential)) {
       throw new Error(
@@ -11451,7 +11550,7 @@ function resolveFallbackServers(env) {
   ].filter((value) => typeof value === "string" && value.trim().length > 0);
   return [...new Set(values.map(normalizeServerOrigin))];
 }
-function resolveAuthToken(env) {
+function resolveAuthToken2(env) {
   return resolvePlatformAuthToken(env);
 }
 function resolveHybridReadTimeoutMs(env = process.env) {
@@ -11470,7 +11569,7 @@ function createCliHybridRecordStore(deps) {
       deps.env.NOLO_SERVER || deps.env.BASE_URL || DEFAULT_NOLO_SERVER_URL
     ),
     fallbackServers: resolveFallbackServers(deps.env),
-    authToken: resolveAuthToken(deps.env),
+    authToken: resolveAuthToken2(deps.env),
     fetchImpl: deps.fetchImpl,
     requestTimeoutMs: resolveHybridReadTimeoutMs(deps.env)
   });
@@ -12258,10 +12357,15 @@ function createCliLocalRuntimeAdapter(deps) {
         deps.env,
         systemBuiltinSkills
       ) : [];
+      const effectiveToolNames = [...requestedToolNames, ...additionalToolNames];
       activeAgentToolNames = buildLocalPolicyToolNames({
         agentKey: agentConfig?.key,
-        toolNames: [...requestedToolNames, ...additionalToolNames],
-        env: deps.env
+        toolNames: effectiveToolNames,
+        env: deps.env,
+        buildProviderOpenAiTools: (toolArgs) => buildOpenAiTools({
+          ...toolArgs,
+          effectiveToolNames
+        })
       });
       runtimeToolExecutionLimits = resolveLocalWorkspaceExecutorOptionsFromPolicy(
         resolveCurrentRunRuntimeToolPolicy(agentConfig)
@@ -12322,8 +12426,12 @@ function createCliLocalRuntimeAdapter(deps) {
       output: deps.output,
       cwd: workspaceRoot,
       titleGenerator: createLocalDialogTitleGenerator(deps, {
-        apiKeyRefResolver: createOAuthApiKeyRefResolver(),
-        credentialBroker: createFileCredentialBroker(),
+        apiKeyRefResolver: createOAuthApiKeyRefResolver({
+          migration: { enableLegacyMigration: true }
+        }),
+        credentialBroker: createFileCredentialBroker({
+          migration: { enableLegacyMigration: true }
+        }),
         loopbackRequest
       })
     }),
@@ -12366,8 +12474,15 @@ function createCliLocalRuntimeAdapter(deps) {
           () => void 0
         );
       }
-      const apiKeyRefResolver = createOAuthApiKeyRefResolver();
-      const credentialBroker = createFileCredentialBroker();
+      const legacyCredentialMigration = {
+        enableLegacyMigration: true
+      };
+      const apiKeyRefResolver = createOAuthApiKeyRefResolver({
+        migration: legacyCredentialMigration
+      });
+      const credentialBroker = createFileCredentialBroker({
+        migration: legacyCredentialMigration
+      });
       const serverUrl = asOptionalTrimmedString(deps.env.NOLO_SERVER) ?? "https://us.nolo.chat";
       const authToken = asOptionalTrimmedString(deps.env.AUTH_TOKEN);
       const syncFetcher = authToken ? async (ref) => {
@@ -12442,6 +12557,7 @@ function createCliLocalRuntimeAdapter(deps) {
       const result = await executeLocalToolWithPolicy({
         env: deps.env,
         agentToolNames: activeAgentToolNames,
+        runToolNames: activeAgentToolNames,
         call: injectedCall,
         executors: localToolExecutors,
         abortSignal: opts?.abortSignal,
@@ -12497,13 +12613,22 @@ export {
   isSubtaskRun,
   RUN_WAKE_CHANNEL_ENV,
   summarizeEndpoint,
+  resolveLocalUserId,
   isBuiltinNoloAgentRef,
+  resolveAuthToken,
+  resolveFileWriteGateEnabled,
+  isMachineBoundLocalhostCustomProvider,
+  resolveBoundMachineId,
+  isCliProviderAgentConfig,
+  detectCurrentMachineId,
   readTimestamp,
   parseAgentRunEvent,
+  isLiveAgentRunObservation,
   parseCliLocale,
   getCliLocale,
   setCliLocale,
   initCliLocale,
+  dailyWelcomeTip,
   t,
   toolLabel,
   agentRunCardLabels,