nolo-cli 0.83.0 → 0.84.0

package/{chunk-6VFARHZW.js → chunk-52Q2IW2X.js}

@@ -5,13 +5,16 @@ import {
   finalizeResponsesToolCalls,
   flushChatCompletionStream,
   providerHttpFailure,
-  readSseFrames,
-  streamSseDataValues,
   throwIfChatCompletionStreamFailed
-} from "./chunk-ZCYXJSTU.js";
+} from "./chunk-H4AHY5BU.js";
 import {
-  DEVIN_CONNECT_URL
-} from "./chunk-Q5FJJ6XI.js";
+  DEVIN_CONNECT_URL,
+  parseSseDataLineJson,
+  parseSseDataLineObject
+} from "./chunk-FV3JEYR3.js";
+import {
+  readSseFrames
+} from "./chunk-GMZLP5DV.js";
 import {
   clipToolText,
   hasImageInRuntimeMessages,
@@ -20,7 +23,7 @@ import {
   resolveHistoricalToolContentCap,
   resolveToolOutputProfile,
   stripImagePartsFromMessages
-} from "./chunk-5H7KJX7J.js";
+} from "./chunk-4MK3I7Y4.js";
 import {
   downgradeUnparsableToolCalls,
   hasParsableObjectArguments,
@@ -35,6 +38,7 @@ import {
   finalizeAccumulatedToolCalls
 } from "./chunk-N7J63Q6C.js";
 import {
+  DELETE_SAFETY_RED_LINE,
   TOOL_GUIDED_SECTION_ORDER,
   buildIdentityBlock,
   buildRuntimeGuidanceBlocks,
@@ -46,7 +50,7 @@ import {
   requiresBareImageUrl,
   resolveToolGuidedSections,
   toBareImageUrlMessages
-} from "./chunk-L5UXH3B2.js";
+} from "./chunk-Z2PV6O2T.js";
 import {
   convertMessagesToResponsesInput,
   extractReasoningFromResponseOutput,
@@ -64,18 +68,14 @@ import {
   applyToolSurfaceConstraints,
   buildDialogReadEnvelope,
   buildNoloWorkspaceCommandArgs,
+  buildNoloWorkspaceOpenAiTools,
   createStreamingDialogReadProjector,
   noloPositiveIntegerString,
   noloStringArg,
   parseNoloWorkspaceToolArguments,
   readTextStreamUpToChars,
   resolveNoloDialogInput
-} from "./chunk-IIVGDG4I.js";
-import {
-  getAntigravityUserAgent,
-  readAntigravityProjectId,
-  resolveAntigravityCloudCodeBaseUrl
-} from "./chunk-UZGQNTVW.js";
+} from "./chunk-HCT7U36O.js";
 import {
   buildProviderAuthHeaders,
   buildProviderExecutionPlan
@@ -93,7 +93,7 @@ import {
   resolveEmptyAssistantFallbackMessage,
   resolveEmptyAssistantOutcome,
   resolveTruncatedReasoningTailLog
-} from "./chunk-4OEFYTWL.js";
+} from "./chunk-HKNXJGEC.js";
 import {
   COMPACTION_SUMMARY_SCHEMA_VERSION,
   COMPACTION_SUMMARY_SYSTEM_PROMPT,
@@ -112,7 +112,7 @@ import {
   resolveCompressionTriggerRatio,
   truncateToolOutputForContext,
   withProviderCallTimingFields
-} from "./chunk-DNCEALKX.js";
+} from "./chunk-P5EVSOPA.js";
 import {
   estimateTokenCount
 } from "./chunk-PSCNXBYA.js";
@@ -11900,6 +11900,7 @@ var toQueue = /* @__PURE__ */ dual(2, (self, options) => toQueueArray(self.chann
 var runIntoQueue = /* @__PURE__ */ dual(2, (self, queue) => runIntoQueueArray(self.channel, queue));
 
 // packages/agent-runtime/abortableKernel.ts
+var IDLE_WATCHDOG_SLICES = 20;
 function runAbortableWithTimeout(args2) {
   const taskEffect = Effect_exports.callback(
     (resume) => {
@@ -11935,12 +11936,26 @@ function runAbortableWithTimeout(args2) {
     raced = Effect_exports.raceFirst(taskEffect, abortEffect);
   }
   if (typeof args2.timeoutMs === "number") {
-    const inner = raced;
+    const outer = raced;
     const timeoutMs = args2.timeoutMs;
-    raced = Effect_exports.gen(function* () {
-      const outcome = yield* Effect_exports.timeoutOption(inner, Duration_exports.millis(timeoutMs));
-      return Option_exports.isNone(outcome) ? { kind: "timeout" } : outcome.value;
+    const activityVersion = args2.activityVersion;
+    const idleWatchdog = Effect_exports.gen(function* () {
+      const sliceCount = activityVersion ? IDLE_WATCHDOG_SLICES : 1;
+      const baseSliceMs = Math.max(1, Math.floor(timeoutMs / sliceCount));
+      let idleMs = 0;
+      for (; ; ) {
+        const versionAtSliceStart = activityVersion?.();
+        const sliceMs = Math.max(1, Math.min(timeoutMs - idleMs, baseSliceMs));
+        yield* Effect_exports.sleep(Duration_exports.millis(sliceMs));
+        idleMs += sliceMs;
+        if (activityVersion && activityVersion() !== versionAtSliceStart) {
+          idleMs = 0;
+          continue;
+        }
+        if (idleMs >= timeoutMs) return { kind: "timeout" };
+      }
     });
+    raced = Effect_exports.raceFirst(outer, idleWatchdog);
   }
   return args2.runtime ? args2.runtime.runPromise(raced) : Effect_exports.runPromise(raced);
 }
@@ -12627,6 +12642,13 @@ function isColdResume(history, nowMs) {
 }
 async function maybeAutoCompactLocalHistory(args2) {
   const { adapter, dialogId, history } = args2;
+  const emitPhase = (phase) => {
+    try {
+      args2.onPhase?.(phase);
+    } catch {
+    }
+  };
+  emitPhase({ kind: "validating-context" });
   const unchanged = (decision) => ({
     history,
     compressed: false,
@@ -12722,8 +12744,15 @@ async function maybeAutoCompactLocalHistory(args2) {
   if (!plan.shouldCompress) {
     return projectExisting();
   }
+  emitPhase({ kind: "compaction-start" });
   try {
+    if (args2.abortSignal?.aborted) {
+      throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
+    }
     const provider = await args2.resolveProvider();
+    if (args2.abortSignal?.aborted) {
+      throw Object.assign(new Error("auto-compaction aborted"), { compactionReason: "aborted" });
+    }
     const msgsToCompress = plan.msgsToCompress;
     const messagesText = formatMessagesForSummaryWithTruncation(msgsToCompress);
     const fileOpsText = formatFileOperationsFromMessages(
@@ -12735,20 +12764,55 @@ async function maybeAutoCompactLocalHistory(args2) {
       messagesText,
       fileOpsText
     });
-    const result4 = await provider.complete([
-      { role: "system", content: COMPACTION_SUMMARY_SYSTEM_PROMPT },
-      { role: "user", content: promptContent }
-    ]);
+    emitPhase({ kind: "waiting-provider" });
+    const timeoutMs = typeof args2.timeoutMs === "number" && Number.isFinite(args2.timeoutMs) && args2.timeoutMs > 0 ? args2.timeoutMs : void 0;
+    const requestController = new AbortController();
+    let timeoutHandle;
+    let abortListener;
+    const request3 = provider.complete(
+      [{ role: "system", content: COMPACTION_SUMMARY_SYSTEM_PROMPT }, { role: "user", content: promptContent }],
+      { signal: requestController.signal, ...timeoutMs ? { timeoutMs } : {} }
+    ).then(
+      (value) => ({ kind: "done", value }),
+      (error) => ({ kind: "provider-error", error })
+    );
+    const guards = [];
+    if (timeoutMs) guards.push(new Promise((resolve5) => {
+      timeoutHandle = setTimeout(() => {
+        requestController.abort();
+        resolve5({ kind: "timeout" });
+      }, timeoutMs);
+    }));
+    if (args2.abortSignal) guards.push(new Promise((resolve5) => {
+      abortListener = () => {
+        requestController.abort(args2.abortSignal?.reason);
+        resolve5({ kind: "aborted" });
+      };
+      args2.abortSignal?.addEventListener("abort", abortListener, { once: true });
+    }));
+    const outcome = guards.length ? await Promise.race([request3, ...guards]) : await request3;
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+    if (abortListener) args2.abortSignal?.removeEventListener("abort", abortListener);
+    if (outcome.kind !== "done") {
+      const reason = outcome.kind === "timeout" ? "timeout" : outcome.kind === "aborted" ? "aborted" : "provider-error";
+      const detail = outcome.kind === "provider-error" ? outcome.error instanceof Error ? outcome.error.message : String(outcome.error) : reason === "timeout" ? `auto-compaction timed out after ${timeoutMs}ms` : "auto-compaction aborted";
+      throw Object.assign(new Error(detail), { compactionReason: reason });
+    }
+    const result4 = outcome.value;
     const newSummary = typeof result4.content === "string" ? result4.content.trim() : "";
     if (!newSummary) {
       console.warn(
         "[localLoop] auto-compaction produced empty summary; keeping prior projection"
       );
+      const failureReason = "provider-error";
+      emitPhase({ kind: "compaction-failed", reason: failureReason });
       return {
         ...projectExisting(),
         failureMessage: "summary model returned empty content",
+        failureReason,
         decision: {
           outcome: "failed",
+          reason: failureReason,
           detail: "summary model returned empty content"
         }
       };
@@ -12775,6 +12839,7 @@ async function maybeAutoCompactLocalHistory(args2) {
       summaryUsage: result4.usage
     });
     console.log(formatCompactionMetricsLog(metrics));
+    emitPhase({ kind: "compaction-end" });
     return {
       history: projectHistoryWithSummary({
         history,
@@ -12802,10 +12867,13 @@ async function maybeAutoCompactLocalHistory(args2) {
   } catch (error) {
     console.warn("[localLoop] auto-compaction failed:", error);
     const failureMessage = error instanceof Error && error.message ? error.message.slice(0, 200) : String(error).slice(0, 200);
+    const failureReason = error instanceof Error && "compactionReason" in error ? error.compactionReason : "provider-error";
+    emitPhase({ kind: "compaction-failed", reason: failureReason });
     return {
       ...projectExisting(),
       failureMessage,
-      decision: { outcome: "failed", detail: failureMessage }
+      failureReason,
+      decision: { outcome: "failed", reason: failureReason, detail: failureMessage }
     };
   }
 }
@@ -12862,6 +12930,8 @@ function emitLoopEvent(boundary, event, bridge) {
   boundary.emit(bridge ? { event, bridge } : { event });
 }
 var LLM_REQUEST_TIMEOUT = "LLM_REQUEST_TIMEOUT";
+var DEFAULT_LLM_REQUEST_TIMEOUT_MS = 10 * 60 * 1e3;
+var DEFAULT_COMPACTION_TIMEOUT_MS = 60 * 1e3;
 var LOCAL_TURN_ABORTED_CODE = "LOCAL_TURN_ABORTED";
 function buildAbortedError() {
   const error = new Error("local agent turn aborted by user");
@@ -12889,8 +12959,11 @@ async function runAbortableToolTask(input, task, pendingToolName) {
 }
 function resolveLlmRequestTimeoutMs(input) {
   const raw = input.llmRequestTimeoutMs ?? input.timeoutMs;
-  if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return void 0;
-  return raw;
+  return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_LLM_REQUEST_TIMEOUT_MS;
+}
+function resolveCompactionTimeoutMs(input) {
+  const raw = input.compactionTimeoutMs;
+  return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_COMPACTION_TIMEOUT_MS;
 }
 async function runCompleteWithTimeout(args2) {
   const { provider, messages, options, timeoutMs, round, input, boundary, context: context3, providerName, model } = args2;
@@ -12913,6 +12986,7 @@ async function runCompleteWithTimeout(args2) {
       const outcome = await runAbortableWithTimeout({
         task: complete,
         timeoutMs: typeof timeoutMs === "number" ? timeoutMs : void 0,
+        activityVersion: args2.activityVersion,
         abortSignal: input.abortSignal,
         runtime: input.effectRuntime
       });
@@ -12923,7 +12997,7 @@ async function runCompleteWithTimeout(args2) {
       }
       if (outcome.kind === "timeout") {
         const timeoutError = new Error(
-          `LLM request timed out after ${timeoutMs}ms (round ${round})`
+          `LLM request timed out after ${timeoutMs}ms without new output (idle window, round ${round})`
         );
         timeoutError.code = LLM_REQUEST_TIMEOUT;
         throw timeoutError;
@@ -13604,6 +13678,9 @@ async function runLocalAgentTurn(input) {
       input.contextBlockScopes
     );
     const mergedContextBlockScopes = [
+      // 删除安全红线：系统层最高优先级约束，位于所有块之前（含身份信息块），
+      // owner 要求常驻「根本提示词」的最顶部（2026-09-26 批量误删事故）。
+      { content: DELETE_SAFETY_RED_LINE, cacheScope: "session" },
       { content: identityBlock, cacheScope: "session" },
       ...guidanceScopes,
       ...callerScopes
@@ -13636,6 +13713,16 @@ async function runLocalAgentTurn(input) {
       }
     }
     let compactionUsage;
+    const emitCompactionPhase = (phase, scope3) => {
+      const atMs = Date.now();
+      if (phase.kind === "validating-context") emitLoopEvent(observationBoundary, { kind: "turn-phase", phase: "validating-context", atMs, compactionScope: scope3 });
+      else if (phase.kind === "compaction-start") {
+        emitLoopEvent(observationBoundary, { kind: "turn-phase", phase: "compacting", atMs, compactionScope: scope3 });
+        emitLoopEvent(observationBoundary, { kind: "compaction-start", atMs, scope: scope3 });
+      } else if (phase.kind === "waiting-provider") emitLoopEvent(observationBoundary, { kind: "turn-phase", phase: "waiting-provider", atMs, compactionScope: scope3 });
+      else if (phase.kind === "compaction-end") emitLoopEvent(observationBoundary, { kind: "compaction-end", atMs, scope: scope3 });
+      else emitLoopEvent(observationBoundary, { kind: "compaction-failed", atMs, scope: scope3, reason: phase.reason });
+    };
     const emitCompactionObservation = (compacted) => {
       const decision = compacted.decision;
       if (decision?.outcome === "skipped") {
@@ -13669,7 +13756,10 @@ async function runLocalAgentTurn(input) {
         model: agentConfig.model,
         resolveProvider: resolveProviderOnce,
         contextWindow,
-        realContextUsagePercent
+        realContextUsagePercent,
+        abortSignal: input.abortSignal,
+        timeoutMs: resolveCompactionTimeoutMs(input),
+        onPhase: (phase) => emitCompactionPhase(phase, "initial")
       });
       history = compacted.history;
       compactionUsage = compacted.usage;
@@ -13775,7 +13865,10 @@ async function runLocalAgentTurn(input) {
           model: agentConfig.model,
           resolveProvider: resolveProviderOnce,
           contextWindow,
-          ...ratio !== void 0 ? { realContextUsagePercent: ratio } : {}
+          ...ratio !== void 0 ? { realContextUsagePercent: ratio } : {},
+          abortSignal: input.abortSignal,
+          timeoutMs: resolveCompactionTimeoutMs(input),
+          onPhase: (phase) => emitCompactionPhase(phase, "in-loop")
         });
         if (compacted.usage) {
           compactionUsage = addOutOfBandUsage(compactionUsage, compacted.usage);
@@ -13845,11 +13938,12 @@ async function runLocalAgentTurn(input) {
         const shouldPassToolEvents = Boolean(
           input.onToolEvent || input.onObservationEvent || input.observationBoundary
         );
+        let llmStreamActivity = 0;
         result4 = await runCompleteWithTimeout({
           provider,
           messages: requestMessages,
           options: {
-            ...typeof input.timeoutMs === "number" ? { timeoutMs: input.timeoutMs } : {},
+            timeoutMs: resolveLlmRequestTimeoutMs(input),
             // 用户取消信号穿进 provider options：providerStreamRetry 据此在
             // 取消后跳过重试，provider 分支（如 antigravity/openai-compatible）
             // 也可把 fetch 绑定到同一信号，实现真正的传输层取消。
@@ -13858,6 +13952,7 @@ async function runLocalAgentTurn(input) {
             // 归到具体对话而不是 chat-proxy 兜底桶。新对话首轮 id 尚未分配。
             ...input.continueDialogId ? { dialogId: input.continueDialogId } : {},
             ...shouldStreamDeltas ? { onTextDelta: (chunk) => {
+              llmStreamActivity += 1;
               partialContent += chunk;
               observationBoundary.emit({
                 kind: "text-delta",
@@ -13867,6 +13962,7 @@ async function runLocalAgentTurn(input) {
               });
             } } : {},
             ...shouldStreamReasoning ? { onReasoningDelta: (chunk) => {
+              llmStreamActivity += 1;
               observationBoundary.emit({
                 kind: "reasoning-delta",
                 chunk,
@@ -13875,6 +13971,7 @@ async function runLocalAgentTurn(input) {
               });
             } } : {},
             ...shouldPassToolEvents ? { onToolEvent: (event) => {
+              llmStreamActivity += 1;
               observationBoundary.emit({
                 kind: "tool-event",
                 event,
@@ -13885,6 +13982,7 @@ async function runLocalAgentTurn(input) {
             ...shouldPassToolEvents ? { toolEventRound: round } : {}
           },
           timeoutMs: resolveLlmRequestTimeoutMs(input),
+          activityVersion: () => llmStreamActivity,
           round,
           input,
           boundary: observationBoundary,
@@ -14366,23 +14464,6 @@ function kimiIdentityHeaders(url) {
   return isKimiEndpoint(url) ? { "User-Agent": KIMI_CODE_USER_AGENT } : {};
 }
 
-// packages/agent-runtime/sseDataLine.ts
-function parseSseDataLineJson(line) {
-  const trimmed = line.trim();
-  if (!trimmed.startsWith("data:")) return null;
-  const payload = trimmed.slice(5).trim();
-  if (!payload || payload === "[DONE]") return null;
-  try {
-    return JSON.parse(payload);
-  } catch {
-    return null;
-  }
-}
-function parseSseDataLineObject(line) {
-  const parsed = parseSseDataLineJson(line);
-  return parsed && typeof parsed === "object" ? parsed : null;
-}
-
 // packages/integrations/openai/responsesRequestBody.ts
 function buildResponsesRequestBody(body, model) {
   const tools = Array.isArray(body.tools) ? toResponsesTools(body.tools) : void 0;
@@ -15652,132 +15733,6 @@ async function evaluateCapabilityPolicy(capability, normalizedInput, ctx) {
   }
 }
 
-// packages/agent-runtime/localToolPolicy.ts
-var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "deleteSpaces",
-  "updateAgent",
-  "updateSelf",
-  "createAgent"
-]);
-var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "readFile",
-  "writeFile",
-  "editFile",
-  "globFiles",
-  "execShell",
-  "launchProcess",
-  "listProcesses",
-  // ProcessTask follow-up tools. Same tier as listProcesses: they observe/stop
-  // tasks the agent itself already spawned, so their blast radius is strictly
-  // narrower than launchProcess (which is default-enabled). Model-facing
-  // follow-ups are taskWait/taskStop only — lifecycle history (taskLogs) stays
-  // runtime-internal.
-  "taskWait",
-  "taskStop",
-  // Scheduling tools: forking/observing sub-agents is a declared capability
-  // of capable agents, and the blast radius is strictly narrower than
-  // execShell (already default-enabled). Requiring an env allowlist for these
-  // while execShell is open by default inverted the risk model and forced every
-  // new local user to hand-edit .env files before sub-agent tasks worked.
-  "startAgentRun",
-  "controlAgentRun"
-]);
-function parseToolAllowlist(value) {
-  return (value ?? "").split(",").flatMap((item) => {
-    const trimmed = item.trim();
-    return trimmed ? [trimmed] : [];
-  });
-}
-function normalizeLocalToolName(toolName) {
-  return canonicalizeToolName(
-    String(toolName ?? "").replace(/^functions\./, "").trim()
-  );
-}
-function isRestrictedLocalToolMode(env) {
-  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
-}
-function resolveLocalToolPolicy(args2) {
-  const toolName = normalizeLocalToolName(args2.toolName);
-  const restrictedMode = isRestrictedLocalToolMode(args2.env);
-  if (!toolName) {
-    return {
-      allowed: false,
-      toolName,
-      reason: "Tool name is required."
-    };
-  }
-  if (NEVER_LOCAL_TOOLS.has(toolName)) {
-    return {
-      allowed: false,
-      toolName,
-      reason: `${toolName} is blocked by the local runtime safety policy.`
-    };
-  }
-  const allowedByEnv = new Set(parseToolAllowlist(args2.env.NOLO_LOCAL_ALLOWED_TOOLS));
-  const agentTools = new Set(
-    (args2.agentToolNames ?? []).flatMap((item) => {
-      const normalized = normalizeLocalToolName(item);
-      return normalized ? [normalized] : [];
-    })
-  );
-  if (!restrictedMode && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  return {
-    allowed: false,
-    toolName,
-    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
-  };
-}
-async function executeLocalToolWithPolicy(args2) {
-  if (args2.runToolNames !== void 0 && !args2.runToolNames.includes(normalizeLocalToolName(args2.call.name))) {
-    throw new Error(`${args2.call.name} is outside the final run tool surface.`);
-  }
-  const decision = resolveLocalToolPolicy({
-    env: args2.env,
-    agentToolNames: args2.agentToolNames,
-    toolName: args2.call.name
-  });
-  if (!decision.allowed) throw new Error(decision.reason);
-  const executor = args2.executors?.[decision.toolName];
-  if (!executor) {
-    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
-  }
-  const opts = {
-    ...args2.abortSignal ? { abortSignal: args2.abortSignal } : {},
-    ...args2.detachMs !== void 0 ? { detachMs: args2.detachMs } : {},
-    ...args2.confirmed !== void 0 ? { confirmed: args2.confirmed } : {},
-    ...args2.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args2.enableDestructiveShellGuard } : {},
-    ...args2.confirmDestructiveAction ? { confirmDestructiveAction: args2.confirmDestructiveAction } : {},
-    ...args2.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args2.blockDestructiveWithoutConfirmation } : {}
-  };
-  if (decision.toolName === "execShell") {
-    let parsedInput = args2.call.arguments;
-    if (typeof parsedInput === "string") {
-      try {
-        parsedInput = JSON.parse(parsedInput);
-      } catch {
-        parsedInput = { command: parsedInput };
-      }
-    }
-    await evaluateExecShellDestructiveGuard(parsedInput, opts);
-    opts.confirmed = true;
-  }
-  return executor(
-    {
-      ...args2.call,
-      name: decision.toolName
-    },
-    opts
-  );
-}
-
 // packages/agent-runtime/localWorkspaceTools.ts
 import { existsSync as existsSync3 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
@@ -16576,29 +16531,6 @@ function getProcessRegistry() {
   return registry;
 }
 
-// packages/agent-runtime/processOwnership.ts
-var asNonEmptyString = (value) => {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed ? trimmed : null;
-};
-function readProcessOwner(runtimeContext) {
-  if (!runtimeContext || typeof runtimeContext !== "object") return null;
-  const dialogId = asNonEmptyString(runtimeContext.dialogId) ?? asNonEmptyString(runtimeContext.parentThreadId);
-  if (!dialogId) return null;
-  const turnId = asNonEmptyString(runtimeContext.turnId);
-  const ownerId = asNonEmptyString(runtimeContext.ownerId);
-  return {
-    dialogId,
-    ...turnId ? { turnId } : {},
-    ...ownerId ? { ownerId } : {}
-  };
-}
-
-// packages/agent-runtime/workspaceShell.ts
-import { resolve as resolve3 } from "node:path";
-import { spawn as spawnChildProcess2 } from "node:child_process";
-
 // packages/agent-runtime/processTaskResult.ts
 var PROCESS_RESULT_CAPSULE_TAIL_CHARS = 4e3;
 var PROCESS_RESULT_CAPSULE_SPILL_THRESHOLD_CHARS = 2e4;
@@ -16618,11 +16550,17 @@ function buildProcessTaskResultCapsule(args2) {
   const exitCode = args2.exitCode;
   const captureError = args2.captureError?.trim() || void 0;
   const durationMs = typeof args2.startedAt === "number" && Number.isFinite(args2.startedAt) ? Math.max(0, (args2.endedAt ?? Date.now()) - args2.startedAt) : void 0;
-  const stdoutTail = tailText(stdout, tailChars);
-  const stderrTail = tailText(stderr, tailChars);
+  const stdoutProvenance = args2.streamProvenance?.stdout;
+  const stderrProvenance = args2.streamProvenance?.stderr;
+  const ringEvicted = Boolean(stdoutProvenance?.evicted || stderrProvenance?.evicted);
+  const stdoutTailSource = typeof args2.stdoutTail === "string" ? args2.stdoutTail : stdout;
+  const stderrTailSource = typeof args2.stderrTail === "string" ? args2.stderrTail : stderr;
+  const stdoutTail = tailText(stdoutTailSource, tailChars);
+  const stderrTail = tailText(stderrTailSource, tailChars);
   const inlineSize = stdout.length + stderr.length;
   const inlineTruncated = stdoutTail.truncated || stderrTail.truncated;
-  const shouldSpill = inlineTruncated || inlineSize > spillThresholdChars;
+  const truncated = inlineTruncated || ringEvicted || Boolean(captureError);
+  const shouldSpill = truncated || inlineSize > spillThresholdChars;
   let spill;
   if (shouldSpill) {
     try {
@@ -16636,8 +16574,11 @@ function buildProcessTaskResultCapsule(args2) {
       });
       spill = {
         displayPath: result4.displayPath,
-        totalChars: result4.totalChars,
-        totalLines: result4.totalLines
+        // Prefer the caller's live provenance counters: they count every
+        // byte of the original stream, while the buffered content above may
+        // be a capped prefix of it.
+        totalChars: (stdoutProvenance?.totalChars ?? stdout.length) + (stderrProvenance?.totalChars ?? stderr.length),
+        totalLines: (stdoutProvenance?.totalLines ?? countLines(stdout)) + (stderrProvenance?.totalLines ?? countLines(stderr))
       };
     } catch {
     }
@@ -16648,12 +16589,33 @@ function buildProcessTaskResultCapsule(args2) {
     exitCode,
     ...durationMs !== void 0 ? { durationMs } : {},
     ...captureError ? { captureError } : {},
-    truncated: inlineTruncated || Boolean(captureError),
+    truncated,
     ...spill ? { spill } : {}
   };
 }
 
+// packages/agent-runtime/processOwnership.ts
+var asNonEmptyString = (value) => {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+};
+function readProcessOwner(runtimeContext) {
+  if (!runtimeContext || typeof runtimeContext !== "object") return null;
+  const dialogId = asNonEmptyString(runtimeContext.dialogId) ?? asNonEmptyString(runtimeContext.parentThreadId);
+  if (!dialogId) return null;
+  const turnId = asNonEmptyString(runtimeContext.turnId);
+  const ownerId = asNonEmptyString(runtimeContext.ownerId);
+  return {
+    dialogId,
+    ...turnId ? { turnId } : {},
+    ...ownerId ? { ownerId } : {}
+  };
+}
+
 // packages/agent-runtime/workspaceShell.ts
+import { resolve as resolve3 } from "node:path";
+import { spawn as spawnChildProcess2 } from "node:child_process";
 var EXEC_SHELL_TIMEOUT_ENV = "NOLO_EXEC_SHELL_TIMEOUT_MS";
 var EXEC_SHELL_DETACH_ENV = "NOLO_EXEC_SHELL_DETACH_MS";
 var DEFAULT_EXEC_SHELL_DETACH_MS = 12e4;
@@ -17522,68 +17484,230 @@ function runTasks(args2) {
   return { tasks, count: tasks.length };
 }
 
-// packages/agent-runtime/capabilities/execShellCapability.ts
-function buildExecShellToolDefinition(toolName = "execShell") {
-  return {
-    type: "function",
-    function: {
-      name: toolName,
-      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess. On Windows the resolved shell may be Windows PowerShell 5.1 (metadata.shellKind="powershell5"): it does not support '&&'/'||' or $PSStyle \u2014 join commands with ';' or split into multiple calls. metadata.shellKind="pwsh" means PowerShell 7+ with full syntax. Read resolvedShell/shellKind from any execShell result before writing Windows-specific syntax.`,
-      parameters: {
-        type: "object",
-        properties: {
-          command: {
-            type: "string",
-            description: "Shell command to run (non-empty)."
-          },
-          cmd: {
-            type: "string",
-            description: "Compatibility alias for command."
-          }
-        }
+// packages/agent-runtime/execShellCompletionWarnings.ts
+var BG_ESCAPE_WORD_PATTERN = /(?:^|[\s;|(&/\\])(nohup|disown|setsid|start-process)(?=$|[\s;|)&])/i;
+var SHELL_SPLIT_CHARS = /* @__PURE__ */ new Set([";", "|", "&", "(", ")", "<", ">", "\n", "	", " "]);
+function maskQuotedAndEscaped(command) {
+  const out = Array.from(command);
+  let quote = null;
+  for (let i = 0; i < out.length; i += 1) {
+    const ch = out[i];
+    if (quote) {
+      out[i] = " ";
+      if (ch === "\\" && quote !== "'") {
+        if (i + 1 < out.length) out[i + 1] = " ";
+        i += 1;
+      } else if (ch === quote) {
+        quote = null;
       }
+      continue;
     }
-  };
-}
-function normalizeExecShellInput(input) {
-  if (input === null || input === void 0) {
-    throw new Error("execShell requires a non-empty command.");
-  }
-  if (typeof input === "string") {
-    const trimmed = input.trim();
-    if (!trimmed) {
-      throw new Error("execShell requires a non-empty command.");
+    if (ch === "\\") {
+      out[i] = " ";
+      if (i + 1 < out.length) out[i + 1] = " ";
+      i += 1;
+      continue;
     }
-    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
-      try {
-        const parsed = JSON.parse(trimmed);
-        if (parsed && typeof parsed === "object") {
-          return normalizeExecShellInput(parsed);
-        }
-      } catch {
+    if (ch === "'" || ch === '"' || ch === "`") {
+      quote = ch;
+      out[i] = " ";
+      continue;
+    }
+    if (ch === "#" && (i === 0 || /[\s;]/.test(out[i - 1] ?? " "))) {
+      while (i < out.length && out[i] !== "\n") {
+        out[i] = " ";
+        i += 1;
       }
     }
-    return { command: trimmed };
   }
-  if (typeof input === "object") {
-    const record = input;
-    let rawCommand = resolveShellCommandArg(record);
-    if (typeof rawCommand !== "string" || !rawCommand.trim()) {
-      const fallback = record.command ?? record.cmd;
-      if (typeof fallback === "string" && fallback.trim()) {
-        rawCommand = fallback;
+  return out.join("");
+}
+function readRedirectTarget(original, start) {
+  let i = start;
+  while (i < original.length && /\s/.test(original[i] ?? "")) {
+    i += 1;
+  }
+  if (i >= original.length) return void 0;
+  let text = "";
+  let j = i;
+  while (j < original.length) {
+    const o = original[j];
+    if (o === "'" || o === '"' || o === "`") {
+      const quote = o;
+      j += 1;
+      while (j < original.length && original[j] !== quote) {
+        if (original[j] === "\\" && quote !== "'" && j + 1 < original.length) {
+          text += original[j + 1];
+          j += 2;
+          continue;
+        }
+        text += original[j];
+        j += 1;
       }
+      j += 1;
+      continue;
     }
-    const command = typeof rawCommand === "string" ? rawCommand.trim() : "";
+    if (/\s/.test(o) || SHELL_SPLIT_CHARS.has(o)) break;
+    text += o;
+    j += 1;
+  }
+  if (!text || text === "$") return void 0;
+  return { text, end: j };
+}
+function isIgnoredRedirectTarget(target) {
+  return target === "/dev/null";
+}
+function detectExecShellSynchronousWarnings(command, shell) {
+  const masked = maskQuotedAndEscaped(command);
+  const isPowerShell = shell?.resolvedShell === "powershell";
+  const redirectTargets = [];
+  let backgrounded = false;
+  let i = 0;
+  while (i < masked.length) {
+    const ch = masked[i];
+    if (ch === "&") {
+      const next = masked[i + 1];
+      if (next === "&") {
+        i += 2;
+        continue;
+      }
+      if (next === ">") {
+        let j = i + 2;
+        if (masked[j] === ">") j += 1;
+        const target = readRedirectTarget(command, j);
+        if (target && !isIgnoredRedirectTarget(target.text)) redirectTargets.push(target.text);
+        i = target ? target.end : j;
+        continue;
+      }
+      const prev = masked[i - 1];
+      if (prev === ">" || prev === "<") {
+        i += 1;
+        continue;
+      }
+      if (isPowerShell) {
+        i += 1;
+        continue;
+      }
+      backgrounded = true;
+      i += 1;
+      continue;
+    }
+    if (ch === ">") {
+      const prev = masked[i - 1];
+      if (prev === ">" || prev === "&" || prev === "<") {
+        i += 1;
+        continue;
+      }
+      let j = i + 1;
+      if (masked[j] === ">") j += 1;
+      if (masked[j] === "&") {
+        const ampTarget = readRedirectTarget(command, j + 1);
+        const isFdDuplication = ampTarget !== void 0 && (/^\d+$/.test(ampTarget.text) || ampTarget.text === "-");
+        if (ampTarget && !isFdDuplication && !isIgnoredRedirectTarget(ampTarget.text)) {
+          redirectTargets.push(ampTarget.text);
+        }
+        i = ampTarget ? ampTarget.end : j + 1;
+        continue;
+      }
+      const target = readRedirectTarget(command, j);
+      if (target && !isIgnoredRedirectTarget(target.text)) redirectTargets.push(target.text);
+      i = target ? target.end : j;
+      continue;
+    }
+    if (ch === "<") {
+      i += masked[i + 1] === "<" || masked[i + 1] === "&" ? 2 : 1;
+      continue;
+    }
+    i += 1;
+  }
+  const wordMatch = BG_ESCAPE_WORD_PATTERN.exec(masked);
+  if (wordMatch) backgrounded = true;
+  const warnings = [];
+  if (redirectTargets.length > 0) {
+    const target = redirectTargets[0];
+    warnings.push({
+      kind: "output-redirect",
+      redirectTarget: target,
+      message: `[wake-safety] This execShell call completed synchronously; its output was redirected to ${target}. That file is NOT delivered by any completion notification \u2014 no tracked background task was created. If you need the result, read that file in this turn.`
+    });
+  }
+  if (backgrounded) {
+    warnings.push({
+      kind: "shell-backgrounding",
+      message: `[wake-safety] Detected shell-internal backgrounding (lone \`&\`, nohup/disown/setsid/Start-Process or similar). Descendant processes are NOT tracked as platform tasks and will not produce completion notifications; text such as \`LAUNCHED\` printed by the command is plain stdout, not a platform receipt.`
+    });
+  }
+  return warnings;
+}
+
+// packages/agent-runtime/capabilities/execShellCapability.ts
+function buildExecShellToolDefinition(toolName = "execShell") {
+  return {
+    type: "function",
+    function: {
+      name: toolName,
+      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess. On Windows the resolved shell may be Windows PowerShell 5.1 (metadata.shellKind="powershell5"): it does not support '&&'/'||' or $PSStyle \u2014 join commands with ';' or split into multiple calls. metadata.shellKind="pwsh" means PowerShell 7+ with full syntax. Read resolvedShell/shellKind from any execShell result before writing Windows-specific syntax. LIFECYCLE CONTRACT (misreading this contract silenced a real dialog for 10 hours): (1) A normal command waits synchronously for at most 120 seconds; if it ends inside that window the call IS finished \u2014 a result containing exitCode means the command has already completed, never "still running". (2) Only a result with metadata.detached === true AND a taskId represents a tracked background task that may trigger completion wake-up (terminal completion turn carrying a bounded result capsule); that handle may be waited on with taskWait and will produce a completion notification. (3) Text the command itself prints (LAUNCHED, STARTED, BACKGROUND, ...) is plain stdout with zero lifecycle meaning \u2014 never read it as a platform receipt. (4) Shell-level backgrounding (\`&\`, nohup, disown, setsid, self-daemonizing scripts, PowerShell Start-Process) is NOT tracked: those descendants produce no completion notification, and the outer shell finishing tells you nothing about them. Use background: true to turn a finite job into a tracked background task immediately. When a synchronous result's core output was redirected to a file, read that file in the SAME turn \u2014 never end the turn promising a later automatic report without a taskId.`,
+      parameters: {
+        type: "object",
+        properties: {
+          command: {
+            type: "string",
+            description: "Shell command to run (non-empty)."
+          },
+          cmd: {
+            type: "string",
+            description: "Compatibility alias for command."
+          },
+          background: {
+            type: "boolean",
+            description: "Immediately detach this command into a tracked background task (no 120s synchronous wait): returns {detached: true, taskId}, and on completion the platform resumes this conversation with a bounded result capsule (exitCode, duration, stdout/stderr tail). Default false. Use for finite jobs (tests, builds, batch) whose result you need later; NOT for dev servers/watchers \u2014 use launchProcess for those."
+          }
+        }
+      }
+    }
+  };
+}
+function normalizeExecShellInput(input) {
+  if (input === null || input === void 0) {
+    throw new Error("execShell requires a non-empty command.");
+  }
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (!trimmed) {
+      throw new Error("execShell requires a non-empty command.");
+    }
+    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed && typeof parsed === "object") {
+          return normalizeExecShellInput(parsed);
+        }
+      } catch {
+      }
+    }
+    return { command: trimmed };
+  }
+  if (typeof input === "object") {
+    const record = input;
+    let rawCommand = resolveShellCommandArg(record);
+    if (typeof rawCommand !== "string" || !rawCommand.trim()) {
+      const fallback = record.command ?? record.cmd;
+      if (typeof fallback === "string" && fallback.trim()) {
+        rawCommand = fallback;
+      }
+    }
+    const command = typeof rawCommand === "string" ? rawCommand.trim() : "";
     if (!command) {
       throw new Error("execShell requires a non-empty command.");
     }
     const activity = extractActivity(record);
+    const background = record.background === true || typeof record.background === "string" && record.background.trim().toLowerCase() === "true";
     return {
       command,
       ...record.shell !== void 0 ? { shell: record.shell } : {},
       ...activity ? { activity } : {},
-      ...record.input !== void 0 ? { input: record.input } : {}
+      ...record.input !== void 0 ? { input: record.input } : {},
+      ...background ? { background: true } : {}
     };
   }
   throw new Error("execShell requires a non-empty command.");
@@ -17621,6 +17745,7 @@ var execShellCapability = {
       command,
       shell: normalized.shell
     });
+    const background = normalized.background === true;
     const result4 = await runWorkspaceCommand({
       workspaceRoot,
       command: shellPlan.argv,
@@ -17628,15 +17753,18 @@ var execShellCapability = {
       outputLimit: ctx.commandOutputLimit,
       commandPrefix: ctx.commandPrefix,
       abortSignal: ctx.abortSignal,
-      detachMs: isImmediateDetachShellCommand({ command }) ? 0 : ctx.detachMs,
+      detachMs: background ? 0 : isImmediateDetachShellCommand({ command }) ? 0 : ctx.detachMs,
       stdin: typeof normalized.input === "string" ? normalized.input : void 0,
       // Ownership of the turn that invoked this command: an auto-detached
       // command keeps its parent dialog so its terminal can resume that
       // conversation (see processOwnership.ts). Absent ctx.owner = unowned.
       owner: ctx.owner ?? null
     });
+    const warnings = result4.detached || result4.spawnFailed ? [] : detectExecShellSynchronousWarnings(command, {
+      resolvedShell: shellPlan.resolvedShell
+    });
     return {
-      content: result4.content,
+      content: warnings.length > 0 ? [result4.content, ...warnings.map((warning) => warning.message)].join("\n\n") : result4.content,
       metadata: {
         command,
         exitCode: result4.exitCode,
@@ -17651,8 +17779,21 @@ var execShellCapability = {
           // Phase 0: stable taskId from the pre-registered Execution
           // Envelope (additive; existing detached fields untouched).
           taskId: result4.taskId,
-          status: "running"
-        } : {},
+          status: "running",
+          // P0 machine-readable execution state: an explicit positive
+          // signal instead of requiring the model to infer "not detached"
+          // from absence. Mirrors the real lifecycle contract.
+          executionState: "detached",
+          trackedBackgroundTask: true,
+          completionNotification: "terminal-resume"
+        } : {
+          // P0 machine-readable execution state: the command already
+          // finished inside the synchronous window; no background task
+          // exists, so no completion notification will ever arrive.
+          executionState: "synchronous-complete",
+          trackedBackgroundTask: false,
+          completionNotification: "none"
+        },
         ...normalized.activity ? { activity: normalized.activity } : {}
       }
     };
@@ -17868,7 +18009,7 @@ function buildLaunchProcessTool() {
     type: "function",
     function: {
       name: "launchProcess",
-      description: "Start a long-running background process (dev server, watcher, REPL) and return immediately with {pid, label, status}. Use listProcesses to inspect or stop it.",
+      description: "Start a long-running ambient background process (dev server, watcher, REPL) and return immediately with {pid, label, taskId, status}. Real boundaries: this registers a tracked background task, but completion does NOT automatically start a new turn \u2014 the process is intentionally notice-only (an exited dev server must not silently burn a model turn). When it reaches a terminal state the bounded result (exitCode, duration, stdout/stderr tail) is recorded and surfaced as a notice injected only on your next real turn in the same conversation. Use listProcesses to inspect, taskWait to block for its terminal state, or taskStop to stop it. For a finite job (tests, builds, batch) whose result must resume the conversation automatically, use execShell with background: true instead.",
       parameters: {
         type: "object",
         properties: {
@@ -19009,6 +19150,55 @@ async function execShellTool(args2) {
     }
   );
 }
+var LAUNCH_PROCESS_STREAM_RING_CHARS = 65536;
+var LAUNCH_PROCESS_STREAM_CAPTURE_MAX_CHARS = 4e6;
+function createLaunchProcessStreamCapture() {
+  let ring = "";
+  let full = null;
+  let capturedChars = 0;
+  let totalChars = 0;
+  let totalNewlines = 0;
+  return {
+    push(chunk) {
+      const str = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      if (!str) return;
+      totalChars += str.length;
+      for (let i = 0; i < str.length; i += 1) {
+        if (str.charCodeAt(i) === 10) totalNewlines += 1;
+      }
+      const combined = ring + str;
+      if (combined.length <= LAUNCH_PROCESS_STREAM_RING_CHARS) {
+        ring = combined;
+        return;
+      }
+      if (full === null) {
+        full = [combined];
+        capturedChars = combined.length;
+      } else if (capturedChars < LAUNCH_PROCESS_STREAM_CAPTURE_MAX_CHARS) {
+        const room = LAUNCH_PROCESS_STREAM_CAPTURE_MAX_CHARS - capturedChars;
+        const slice = str.length <= room ? str : str.slice(0, room);
+        full.push(slice);
+        capturedChars += slice.length;
+      }
+      ring = combined.slice(-LAUNCH_PROCESS_STREAM_RING_CHARS);
+    },
+    text() {
+      return full === null ? ring : full.join("");
+    },
+    tailText() {
+      return ring;
+    },
+    evicted() {
+      return full !== null;
+    },
+    totalChars() {
+      return totalChars;
+    },
+    totalLines() {
+      return totalChars > 0 ? totalNewlines + 1 : 0;
+    }
+  };
+}
 async function launchProcessTool(args2) {
   const parsed = parseWorkspaceToolArguments(args2.call.arguments);
   const command = requireShellCommand(parsed, args2.call.name);
@@ -19036,6 +19226,14 @@ async function launchProcessTool(args2) {
     stdio: ["ignore", "pipe", "pipe"],
     detached
   });
+  const stdoutCapture = createLaunchProcessStreamCapture();
+  const stderrCapture = createLaunchProcessStreamCapture();
+  proc.stdout?.on("data", (chunk) => stdoutCapture.push(chunk));
+  proc.stderr?.on("data", (chunk) => stderrCapture.push(chunk));
+  proc.stdout?.on("error", () => {
+  });
+  proc.stderr?.on("error", () => {
+  });
   const pid = proc.pid;
   if (typeof pid !== "number") {
     return {
@@ -19076,7 +19274,38 @@ async function launchProcessTool(args2) {
       process.removeListener("SIGTERM", cleanupChildOnHostSignal);
       process.removeListener("SIGINT", cleanupChildOnHostSignal);
     }
-    registry2.markExited(pid, code ?? 1);
+    const exitCode = code ?? 1;
+    let capsule;
+    try {
+      capsule = buildProcessTaskResultCapsule({
+        // The full captured output (bounded prefix when the process was
+        // extremely chatty): the module tails it for the inline capsule and
+        // spills it for recovery. Provenance carries the live original-stream
+        // counters so truncated/spill metadata never derives from the ring.
+        stdout: stdoutCapture.text(),
+        stderr: stderrCapture.text(),
+        stdoutTail: stdoutCapture.tailText(),
+        stderrTail: stderrCapture.tailText(),
+        exitCode,
+        // Duration measured from the registry envelope's startedAt (spawn).
+        startedAt: envelope.startedAt,
+        workspaceRoot: args2.workspaceRoot,
+        streamProvenance: {
+          stdout: {
+            evicted: stdoutCapture.evicted(),
+            totalChars: stdoutCapture.totalChars(),
+            totalLines: stdoutCapture.totalLines()
+          },
+          stderr: {
+            evicted: stderrCapture.evicted(),
+            totalChars: stderrCapture.totalChars(),
+            totalLines: stderrCapture.totalLines()
+          }
+        }
+      });
+    } catch {
+    }
+    registry2.markExited(pid, exitCode, capsule);
   });
   const activity = extractActivity(parsed);
   const resultData = { pid, label, taskId: envelope.taskId, status: "running" };
@@ -19088,6 +19317,13 @@ async function launchProcessTool(args2) {
       label,
       status: "running",
       taskId: envelope.taskId,
+      // P0 machine-readable execution state (consistent with the real wake
+      // contract): a real background task from birth, but ambient — its
+      // terminal result rides the next real turn's notice, not an automatic
+      // completion turn.
+      executionState: "background",
+      trackedBackgroundTask: true,
+      completionNotification: "next-turn-notice",
       processLaunch: resultData,
       ...activity ? { activity } : {}
     }
@@ -19312,6 +19548,290 @@ function createLocalWorkspaceToolExecutors(args2) {
   };
 }
 
+// packages/agent-runtime/toolArgumentGate.ts
+var FIELD_ALIAS_GROUPS = [
+  // localWorkspaceTools.ts:336 导出常量（readFile/writeFile/editFile/globFiles）
+  PATH_FIELD_ALIASES,
+  // localWorkspaceTools.ts:339-340 导出常量（editFile）
+  OLD_TEXT_FIELD_ALIASES,
+  NEW_TEXT_FIELD_ALIASES,
+  // localWorkspaceTools.ts:733 `args.cmd || args.command`（launchProcess）；
+  // launchProcess 的 required ["command"] 见 localWorkspaceToolDefs.ts:283。
+  // 注：execShell 的 schema 无 required（command 在 executor 层强制，
+  // capabilities/execShellCapability.ts:42 声明 cmd 兼容字段），本组对它不产生拦截。
+  ["command", "cmd"],
+  // localWorkspaceTools.ts:698-699 `args.pattern ?? args.glob`（globFiles）
+  ["pattern", "glob"],
+  // noloWorkspaceTools.ts:492 `args.dialog ?? args.dialogId ?? args.id`（readDialog）
+  ["dialog", "dialogId", "id"],
+  // noloWorkspaceTools.ts:545 `args.agent ?? args.agentKey ?? args.id`（readAgent）
+  ["agent", "agentKey", "id"],
+  // noloWorkspaceTools.ts:552 `args.space ?? args.spaceId ?? args.id`（readSpace）
+  ["space", "spaceId", "id"],
+  // noloWorkspaceTools.ts:561/567 `args.doc ?? args.docKey ?? args.pageKey ?? args.key`
+  // （readDoc / readSkillDoc）
+  ["doc", "docKey", "pageKey", "key"],
+  // noloWorkspaceTools.node.ts:238 `parsed.name ?? parsed.skillName ?? parsed.skill`（loadSkill）
+  ["name", "skillName", "skill"],
+  // noloWorkspaceTools.ts:593 `args.table ?? args.tableId ?? args.metaKey`（queryTableRows）
+  ["table", "tableId", "metaKey"]
+];
+var TYPE_MATCHERS = {
+  string: (value) => typeof value === "string",
+  // 数字字符串视为可接受：executor 普遍 Number()/clamp 宽松处理，拦截会误报。
+  number: (value) => typeof value === "number" || typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value)),
+  integer: (value) => typeof value === "number" || typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value)),
+  boolean: (value) => typeof value === "boolean" || value === "true" || value === "false",
+  object: (value) => typeof value === "object" && value !== null && !Array.isArray(value),
+  array: (value) => Array.isArray(value)
+};
+function describeValueType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function isAliasSatisfied(args2, field) {
+  for (const group of FIELD_ALIAS_GROUPS) {
+    if (!group.includes(field)) continue;
+    if (group.some((alias) => args2[alias] !== void 0)) return true;
+  }
+  return false;
+}
+function readRequiredFields(parameters) {
+  const required = parameters.required;
+  if (!Array.isArray(required)) return [];
+  return required.filter((field) => typeof field === "string");
+}
+function readProperties(parameters) {
+  const properties = parameters.properties;
+  if (!properties || typeof properties !== "object" || Array.isArray(properties)) {
+    return {};
+  }
+  return properties;
+}
+function validateToolArguments(args2) {
+  const { toolName, rawArguments, parameters } = args2;
+  if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) {
+    return { ok: true, args: {} };
+  }
+  const schema = parameters;
+  const requiredFields = readRequiredFields(schema);
+  const properties = readProperties(schema);
+  if (requiredFields.length === 0 && Object.keys(properties).length === 0) {
+    return { ok: true, args: {} };
+  }
+  const raw = typeof rawArguments === "string" ? rawArguments.trim() : "";
+  let record = {};
+  if (raw !== "") {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return { ok: true, args: {} };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { ok: true, args: {} };
+    }
+    record = parsed;
+  }
+  for (const field of requiredFields) {
+    if (record[field] !== void 0) continue;
+    if (isAliasSatisfied(record, field)) continue;
+    return {
+      ok: false,
+      message: `${toolName} \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A\u7F3A\u5C11\u5FC5\u586B\u53C2\u6570 "${field}"\u3002\u8BF7\u8865\u4E0A\u540E\u91CD\u65B0\u8C03\u7528 ${toolName}\u3002`
+    };
+  }
+  for (const [field, spec] of Object.entries(properties)) {
+    const value = record[field];
+    if (value === void 0 || value === null) continue;
+    if (!spec || typeof spec !== "object" || Array.isArray(spec)) continue;
+    const declared = spec.type;
+    if (typeof declared !== "string") continue;
+    const matcher = TYPE_MATCHERS[declared];
+    if (!matcher) continue;
+    if (!matcher(value)) {
+      return {
+        ok: false,
+        message: `${toolName} \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A\u53C2\u6570 "${field}" \u5E94\u4E3A ${declared}\uFF0C\u5B9E\u9645\u6536\u5230 ${describeValueType(value)}\u3002\u8BF7\u4FEE\u6B63\u540E\u91CD\u65B0\u8C03\u7528 ${toolName}\u3002`
+      };
+    }
+  }
+  return { ok: true, args: record };
+}
+function buildToolParametersIndex(tools) {
+  const index = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    if (!tool || typeof tool !== "object") continue;
+    const fn3 = tool.function;
+    if (!fn3 || typeof fn3 !== "object") continue;
+    const name = fn3.name;
+    const parameters = fn3.parameters;
+    if (typeof name === "string" && name && parameters !== void 0) {
+      index.set(name, parameters);
+    }
+  }
+  return index;
+}
+var cachedAgentRuntimeIndex = null;
+function getAgentRuntimeToolParametersIndex() {
+  if (cachedAgentRuntimeIndex) return cachedAgentRuntimeIndex;
+  const index = /* @__PURE__ */ new Map();
+  try {
+    const workspaceTools = buildLocalWorkspaceOpenAiTools({
+      toolNames: [...WORKSPACE_TOOL_NAMES],
+      exposeShellTools: true
+    });
+    for (const [name, parameters] of buildToolParametersIndex(workspaceTools)) {
+      index.set(name, parameters);
+    }
+    const noloTools = buildNoloWorkspaceOpenAiTools({
+      toolNames: [...NOLO_WORKSPACE_TOOL_NAMES]
+    });
+    for (const [name, parameters] of buildToolParametersIndex(noloTools)) {
+      index.set(name, parameters);
+    }
+  } catch {
+  }
+  cachedAgentRuntimeIndex = index;
+  return index;
+}
+
+// packages/agent-runtime/localToolPolicy.ts
+var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "deleteSpaces",
+  "updateAgent",
+  "updateSelf",
+  "createAgent"
+]);
+var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "readFile",
+  "writeFile",
+  "editFile",
+  "globFiles",
+  "execShell",
+  "launchProcess",
+  "listProcesses",
+  // ProcessTask follow-up tools. Same tier as listProcesses: they observe/stop
+  // tasks the agent itself already spawned, so their blast radius is strictly
+  // narrower than launchProcess (which is default-enabled). Model-facing
+  // follow-ups are taskWait/taskStop only — lifecycle history (taskLogs) stays
+  // runtime-internal.
+  "taskWait",
+  "taskStop",
+  // Scheduling tools: forking/observing sub-agents is a declared capability
+  // of capable agents, and the blast radius is strictly narrower than
+  // execShell (already default-enabled). Requiring an env allowlist for these
+  // while execShell is open by default inverted the risk model and forced every
+  // new local user to hand-edit .env files before sub-agent tasks worked.
+  "startAgentRun",
+  "controlAgentRun"
+]);
+function parseToolAllowlist(value) {
+  return (value ?? "").split(",").flatMap((item) => {
+    const trimmed = item.trim();
+    return trimmed ? [trimmed] : [];
+  });
+}
+function normalizeLocalToolName(toolName) {
+  return canonicalizeToolName(
+    String(toolName ?? "").replace(/^functions\./, "").trim()
+  );
+}
+function isRestrictedLocalToolMode(env) {
+  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
+}
+function resolveLocalToolPolicy(args2) {
+  const toolName = normalizeLocalToolName(args2.toolName);
+  const restrictedMode = isRestrictedLocalToolMode(args2.env);
+  if (!toolName) {
+    return {
+      allowed: false,
+      toolName,
+      reason: "Tool name is required."
+    };
+  }
+  if (NEVER_LOCAL_TOOLS.has(toolName)) {
+    return {
+      allowed: false,
+      toolName,
+      reason: `${toolName} is blocked by the local runtime safety policy.`
+    };
+  }
+  const allowedByEnv = new Set(parseToolAllowlist(args2.env.NOLO_LOCAL_ALLOWED_TOOLS));
+  const agentTools = new Set(
+    (args2.agentToolNames ?? []).flatMap((item) => {
+      const normalized = normalizeLocalToolName(item);
+      return normalized ? [normalized] : [];
+    })
+  );
+  if (!restrictedMode && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  return {
+    allowed: false,
+    toolName,
+    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
+  };
+}
+async function executeLocalToolWithPolicy(args2) {
+  if (args2.runToolNames !== void 0 && !args2.runToolNames.includes(normalizeLocalToolName(args2.call.name))) {
+    throw new Error(`${args2.call.name} is outside the final run tool surface.`);
+  }
+  const decision = resolveLocalToolPolicy({
+    env: args2.env,
+    agentToolNames: args2.agentToolNames,
+    toolName: args2.call.name
+  });
+  if (!decision.allowed) throw new Error(decision.reason);
+  const executor = args2.executors?.[decision.toolName];
+  if (!executor) {
+    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
+  }
+  const parametersSchema = args2.toolParametersIndex?.get(decision.toolName);
+  if (parametersSchema !== void 0) {
+    const gate = validateToolArguments({
+      toolName: decision.toolName,
+      rawArguments: args2.call.arguments,
+      parameters: parametersSchema
+    });
+    if (!gate.ok) throw new Error(gate.message);
+  }
+  const opts = {
+    ...args2.abortSignal ? { abortSignal: args2.abortSignal } : {},
+    ...args2.detachMs !== void 0 ? { detachMs: args2.detachMs } : {},
+    ...args2.confirmed !== void 0 ? { confirmed: args2.confirmed } : {},
+    ...args2.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args2.enableDestructiveShellGuard } : {},
+    ...args2.confirmDestructiveAction ? { confirmDestructiveAction: args2.confirmDestructiveAction } : {},
+    ...args2.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args2.blockDestructiveWithoutConfirmation } : {}
+  };
+  if (decision.toolName === "execShell") {
+    let parsedInput = args2.call.arguments;
+    if (typeof parsedInput === "string") {
+      try {
+        parsedInput = JSON.parse(parsedInput);
+      } catch {
+        parsedInput = { command: parsedInput };
+      }
+    }
+    await evaluateExecShellDestructiveGuard(parsedInput, opts);
+    opts.confirmed = true;
+  }
+  return executor(
+    {
+      ...args2.call,
+      name: decision.toolName
+    },
+    opts
+  );
+}
+
 // packages/cli/client/localDialogRecords.ts
 var localDialogMessageRecordToRuntimeMessage = dialogMessageRecordToAgentRuntimeMessage;
 function buildLocalDialogWritePlan(args2) {
@@ -19451,7 +19971,7 @@ function buildLoadSkillExecutor(args2) {
     const { resolveSkillByName } = await import("./skillDiscovery-CYUCJMAG.js");
     const resolved = resolveSkillByName(args2.cwd, name);
     if (!resolved) {
-      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-FUAVTRVZ.js");
+      const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-Q2VVY3SC.js");
       const builtin = resolveBuiltinSkillByName(name);
       if (builtin) {
         return {
@@ -19509,737 +20029,8 @@ No skills were discovered in this workspace.`;
 Available skills: ${available.join(", ")}`;
 }
 
-// packages/core/chat/upstreamErrorBody.ts
-function parseUpstreamErrorBody(errorText, statusText) {
-  if (errorText) {
-    try {
-      const parsed = JSON.parse(errorText);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        const error = parsed.error;
-        if (error && typeof error === "object" && !Array.isArray(error)) {
-          return parsed;
-        }
-      }
-    } catch {
-    }
-  }
-  return { error: { message: errorText || statusText } };
-}
-
-// packages/agent-runtime/antigravityCloudCodeProvider.ts
-import { randomUUID } from "node:crypto";
-
-// packages/agent-runtime/antigravityWireModel.ts
-var WIRE_PROFILES = {
-  // Antigravity discovery exposes 3.7 Flash as one tiered wire model.
-  // The UI labels its effort variants (Low/Medium/High), but the literal
-  // -medium/-high ids return 404 from streamGenerateContent.
-  "gemini-3.7-flash-tiered": { modelEnum: "MODEL_PLACEHOLDER_M301", maxOutputTokens: 65536 },
-  // Gemini 3.8 Flash 沿用 3.7 的 tiered 兼容策略：仓库内暂无 Antigravity discovery
-  // 证据确认 3.8 的 wire modelEnum，禁止虚构，先只声明同档输出上限；enum 待
-  // discovery 证据到位后补齐。
-  "gemini-3.8-flash-tiered": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-low": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-medium": { maxOutputTokens: 65536 },
-  "gemini-3.6-flash-high": { maxOutputTokens: 65536 },
-  // 旧模型 wire 映射保留：存量自定义 agent 仍可能引用（注册表已下线不影响此处）。
-  "gemini-3.5-flash-extra-low": { modelEnum: "MODEL_PLACEHOLDER_M187", maxOutputTokens: 65536 },
-  "gemini-3.5-flash-low": { modelEnum: "MODEL_PLACEHOLDER_M20", maxOutputTokens: 65536 },
-  "gemini-3-flash-agent": { modelEnum: "MODEL_PLACEHOLDER_M132", maxOutputTokens: 65536 },
-  "gemini-3.1-pro-low": { modelEnum: "MODEL_PLACEHOLDER_M36", maxOutputTokens: 65535 },
-  "gemini-pro-agent": { modelEnum: "MODEL_PLACEHOLDER_M16", maxOutputTokens: 65535 },
-  "claude-sonnet-5": { maxOutputTokens: 64e3 },
-  "claude-sonnet-4-6": { maxOutputTokens: 64e3 },
-  "claude-opus-4-6-thinking": { maxOutputTokens: 64e3 },
-  "gemini-2.5-flash": { maxOutputTokens: 65536 },
-  "gemini-2.5-pro": { maxOutputTokens: 65536 }
-};
-function resolveAntigravityWireModel(logicalModelId) {
-  const id = logicalModelId.trim();
-  const lower = id.toLowerCase();
-  if (lower === "gemini-3.5-flash") {
-    const wireModelId = "gemini-3.5-flash-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.7-flash" || ["gemini-3.7-flash-low", "gemini-3.7-flash-medium", "gemini-3.7-flash-high"].includes(lower)) {
-    const wireModelId = "gemini-3.7-flash-tiered";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.8-flash" || ["gemini-3.8-flash-low", "gemini-3.8-flash-medium", "gemini-3.8-flash-high"].includes(lower)) {
-    const wireModelId = "gemini-3.8-flash-tiered";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.6-flash") {
-    const wireModelId = "gemini-3.6-flash-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (lower === "gemini-3.1-pro" || lower === "gemini-3.1-pro-preview") {
-    const wireModelId = "gemini-3.1-pro-low";
-    return { wireModelId, profile: WIRE_PROFILES[wireModelId] };
-  }
-  if (WIRE_PROFILES[id]) {
-    return { wireModelId: id, profile: WIRE_PROFILES[id] };
-  }
-  return { wireModelId: id };
-}
-
-// packages/agent-runtime/geminiNativeShared.ts
-var SKIP_THOUGHT_SIGNATURE = "skip_thought_signature_validator";
-function resolveGeminiModelQuirks(modelId) {
-  const lower = modelId.toLowerCase();
-  const isGemini3 = lower.includes("gemini-3");
-  const isStrictSignatureModel = lower.includes("gemini-3.5") || lower.includes("flash-preview");
-  const isClaude = lower.includes("claude");
-  return {
-    requiresThoughtSignature: isGemini3,
-    allowsThoughtSignatureSentinel: isGemini3 && !isStrictSignatureModel,
-    isClaudeCrossModel: isClaude
-  };
-}
-function isGemini3Model(modelId) {
-  return resolveGeminiModelQuirks(modelId).requiresThoughtSignature;
-}
-function messageText(content) {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return "";
-  return content.filter(
-    (part) => part?.type === "text"
-  ).map((part) => part.text).join("\n").trim();
-}
-function parseDataUrlToInlineData(url) {
-  const match7 = /^data:([A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+);base64,([A-Za-z0-9+/=]*)$/.exec(
-    url
-  );
-  if (!match7) return null;
-  return { mimeType: match7[1], data: match7[2] };
-}
-function extractInlineDataParts(content) {
-  if (!Array.isArray(content)) return [];
-  const parts2 = [];
-  for (const part of content) {
-    if (!part || typeof part !== "object") continue;
-    if (part.type !== "image_url") continue;
-    const url = part.image_url?.url;
-    if (typeof url !== "string" || !url.trim()) continue;
-    const inline = parseDataUrlToInlineData(url);
-    if (inline) parts2.push({ inlineData: inline });
-  }
-  return parts2;
-}
-function convertOpenAiMessagesToGemini(messages, options) {
-  const contents = [];
-  const systemTexts = [];
-  let toolCallIndex = 0;
-  let pendingFunctionCalls = [];
-  const pushOrMergeContent = (role, parts2) => {
-    if (parts2.length === 0) return;
-    const last = contents[contents.length - 1];
-    if (last && last.role === role) {
-      last.parts.push(...parts2);
-    } else {
-      contents.push({ role, parts: parts2 });
-    }
-  };
-  const flushPendingFunctionCalls = () => {
-    if (pendingFunctionCalls.length === 0) return;
-    const dummyResponses = pendingFunctionCalls.map(
-      ({ name, id }) => ({
-        functionResponse: {
-          name,
-          response: { output: "{}" },
-          ...id ? { id } : {}
-        }
-      })
-    );
-    pendingFunctionCalls = [];
-    pushOrMergeContent("user", dummyResponses);
-  };
-  for (const raw of messages) {
-    if (!raw || typeof raw !== "object" || !("role" in raw)) continue;
-    const role = String(raw.role);
-    const content = "content" in raw ? raw.content : null;
-    if (role === "system") {
-      const text = messageText(
-        content
-      );
-      if (text) systemTexts.push(text);
-      continue;
-    }
-    if (role === "user") {
-      flushPendingFunctionCalls();
-      const text = messageText(
-        content
-      );
-      const imageParts = extractInlineDataParts(
-        content
-      );
-      if (!text && imageParts.length === 0) continue;
-      const parts2 = [];
-      if (text) parts2.push({ text });
-      for (const img of imageParts) parts2.push(img);
-      pushOrMergeContent("user", parts2);
-      continue;
-    }
-    if (role === "assistant") {
-      flushPendingFunctionCalls();
-      const text = messageText(
-        content
-      );
-      const toolCalls = "tool_calls" in raw && Array.isArray(raw.tool_calls) ? raw.tool_calls ?? [] : [];
-      const parts2 = [];
-      if (text) {
-        parts2.push({ text });
-      }
-      for (const call of toolCalls) {
-        const name = call?.function?.name?.trim();
-        if (!name) continue;
-        const id = call.id?.trim() || `${name}_${toolCallIndex++}`;
-        pendingFunctionCalls.push({ name, id });
-        const realSignature = typeof call.thought_signature === "string" && call.thought_signature ? call.thought_signature : void 0;
-        const isFirstFunctionCallPart = !parts2.some(
-          (p) => "functionCall" in p
-        );
-        const signature = realSignature ?? (options.attachSkipThoughtSignature && isFirstFunctionCallPart ? SKIP_THOUGHT_SIGNATURE : void 0);
-        const part = {
-          functionCall: {
-            name,
-            args: parseToolArgs(call.function?.arguments),
-            ...id ? { id } : {}
-          },
-          ...signature ? { thoughtSignature: signature } : {}
-        };
-        parts2.push(part);
-      }
-      pushOrMergeContent("model", parts2);
-      continue;
-    }
-    if (role === "tool") {
-      const toolCallId = "tool_call_id" in raw && typeof raw.tool_call_id === "string" ? raw.tool_call_id : "";
-      const rawName = "name" in raw && typeof raw.name === "string" ? raw.name.trim() : "";
-      const pendingIndex = pendingFunctionCalls.findIndex(
-        (p) => toolCallId ? p.id === toolCallId : rawName ? p.name === rawName : true
-      );
-      if (pendingIndex === -1) continue;
-      const [{ name, id }] = pendingFunctionCalls.splice(pendingIndex, 1);
-      const output = messageText(content) || "{}";
-      pushOrMergeContent("user", [
-        {
-          functionResponse: {
-            name,
-            response: { output },
-            // 保留 OpenAI tool_call_id：antigravity Cloud Code Assist 网关把
-            // Gemini contents 转成 Claude messages 时需要 functionResponse →
-            // tool_result 的 tool_use_id；缺 id 时网关报
-            // "tool_result.tool_use_id: Field required"（HTTP 400）。
-            ...id ? { id } : {}
-          }
-        }
-      ]);
-    }
-  }
-  flushPendingFunctionCalls();
-  if (contents.length > 0 && contents[0]?.role === "model") {
-    contents.unshift({
-      role: "user",
-      parts: [{ text: "Continue the conversation." }]
-    });
-  }
-  return { contents, systemTexts };
-}
-function parseToolArgs(raw) {
-  if (typeof raw === "string") {
-    try {
-      const parsed = JSON.parse(raw);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        return parsed;
-      }
-    } catch {
-    }
-  }
-  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-    return raw;
-  }
-  return {};
-}
-function sanitizeGeminiSchemaNode(node, active) {
-  const out = {};
-  if (!node || typeof node !== "object" || Array.isArray(node)) {
-    return { type: "string" };
-  }
-  if (active?.has(node)) {
-    return { type: "object", description: "(circular schema reference)" };
-  }
-  const seen = active ?? /* @__PURE__ */ new WeakSet();
-  seen.add(node);
-  try {
-    return sanitizeGeminiSchemaNodeInner(node, out, seen);
-  } finally {
-    seen.delete(node);
-  }
-}
-function sanitizeGeminiSchemaNodeInner(src, out, seen) {
-  if (Array.isArray(src.type)) {
-    const firstNonNull = src.type.find((t) => t !== "null");
-    if (typeof firstNonNull === "string") out.type = firstNonNull;
-    out.nullable = true;
-  } else if (typeof src.type === "string") {
-    out.type = src.type;
-  }
-  if (typeof src.description === "string") out.description = src.description;
-  if (typeof src.minimum === "number") out.minimum = src.minimum;
-  if (typeof src.maximum === "number") out.maximum = src.maximum;
-  if (Array.isArray(src.enum) && src.enum.length > 0) out.enum = src.enum;
-  if (src.nullable === true) out.nullable = true;
-  if ("const" in src && src.const !== void 0 && !out.enum) {
-    out.enum = [src.const];
-  }
-  const variantBranches = [
-    ...Array.isArray(src.oneOf) ? src.oneOf : [],
-    ...Array.isArray(src.anyOf) ? src.anyOf : []
-  ];
-  if (variantBranches.length > 0) {
-    const mergedProperties = {};
-    let requiredIntersection;
-    for (const branch of variantBranches) {
-      const sanitized = sanitizeGeminiSchemaNode(branch, seen);
-      const branchProperties = sanitized.properties ?? {};
-      for (const [key, value] of Object.entries(branchProperties)) {
-        const previous = mergedProperties[key];
-        const prevEnum = previous?.enum;
-        const nextEnum = value?.enum;
-        if (prevEnum && nextEnum) {
-          mergedProperties[key] = {
-            ...value,
-            enum: [.../* @__PURE__ */ new Set([...prevEnum, ...nextEnum])]
-          };
-        } else {
-          mergedProperties[key] = value;
-        }
-      }
-      const branchRequired = Array.isArray(sanitized.required) ? sanitized.required : [];
-      requiredIntersection = requiredIntersection === void 0 ? [...branchRequired] : requiredIntersection.filter((r) => branchRequired.includes(r));
-    }
-    out.properties = {
-      ...out.properties ?? {},
-      ...mergedProperties
-    };
-    if (requiredIntersection !== void 0 && requiredIntersection.length > 0) {
-      out.required = requiredIntersection;
-    }
-    if (typeof out.type !== "string") out.type = "object";
-  }
-  if (Array.isArray(src.allOf)) {
-    for (const branch of src.allOf) {
-      const sanitized = sanitizeGeminiSchemaNode(branch, seen);
-      out.properties = {
-        ...out.properties ?? {},
-        ...sanitized.properties ?? {}
-      };
-      if (Array.isArray(sanitized.required)) {
-        out.required = [
-          .../* @__PURE__ */ new Set([
-            ...out.required ?? [],
-            ...sanitized.required ?? []
-          ])
-        ];
-      }
-    }
-    if (typeof out.type !== "string") out.type = "object";
-  }
-  if (src.properties && typeof src.properties === "object") {
-    const properties = {};
-    for (const [key, value] of Object.entries(
-      src.properties
-    )) {
-      properties[key] = sanitizeGeminiSchemaNode(value, seen);
-    }
-    out.properties = properties;
-    if (typeof out.type !== "string") out.type = "object";
-  }
-  if (Array.isArray(src.required)) {
-    const properties = out.properties ?? {};
-    const required = [...new Set(src.required)].filter(
-      (r) => typeof r === "string" && r in properties
-    );
-    if (required.length > 0) out.required = required;
-  }
-  if (src.items !== void 0) {
-    out.items = sanitizeGeminiSchemaNode(src.items, seen);
-    if (typeof out.type !== "string") out.type = "array";
-  }
-  if (typeof out.type !== "string") out.type = "object";
-  return out;
-}
-function convertOpenAiToolsToGemini(tools) {
-  if (!Array.isArray(tools) || tools.length === 0) return void 0;
-  const declarations = [];
-  for (const tool of tools) {
-    if (!tool || typeof tool !== "object" || !("function" in tool)) continue;
-    const fn3 = tool.function;
-    const name = typeof fn3.name === "string" ? fn3.name : "";
-    if (!name) continue;
-    declarations.push({
-      name,
-      description: typeof fn3.description === "string" ? fn3.description : "",
-      parameters: sanitizeGeminiSchemaNode(
-        fn3.parameters ?? { type: "object", properties: {} }
-      )
-    });
-  }
-  if (declarations.length === 0) return void 0;
-  return [{ functionDeclarations: declarations }];
-}
-function createGeminiAccumulatorState() {
-  return {
-    text: "",
-    toolCalls: [],
-    reasoning: "",
-    events: []
-  };
-}
-function applyGeminiChunk(chunk, state, options) {
-  if (!chunk || typeof chunk !== "object") return;
-  const response = "response" in chunk && chunk.response && typeof chunk.response === "object" ? chunk.response : chunk;
-  if ("usageMetadata" in response && response.usageMetadata && typeof response.usageMetadata === "object") {
-    const meta = response.usageMetadata;
-    const prompt = typeof meta.promptTokenCount === "number" ? meta.promptTokenCount : 0;
-    const candidates2 = typeof meta.candidatesTokenCount === "number" ? meta.candidatesTokenCount : 0;
-    const total = typeof meta.totalTokenCount === "number" ? meta.totalTokenCount : prompt + candidates2;
-    const cached3 = typeof meta.cachedContentTokenCount === "number" && Number.isFinite(meta.cachedContentTokenCount) ? (
-      // cached ⊆ prompt；对畸形上游防御性钳位，避免 cache_read > input 破坏归一化与计费
-      Math.min(Math.max(0, Math.floor(meta.cachedContentTokenCount)), prompt)
-    ) : 0;
-    state.usage = {
-      prompt_tokens: prompt,
-      completion_tokens: candidates2,
-      total_tokens: total,
-      ...cached3 > 0 ? { cache_read_input_tokens: cached3 } : {}
-    };
-    state.events.push({ kind: "usage", usage: state.usage });
-  }
-  const candidates = Array.isArray(response.candidates) ? response.candidates : [];
-  for (const candidate of candidates) {
-    if (!candidate || typeof candidate !== "object") continue;
-    const candidateFinishReason = candidate.finishReason;
-    if (typeof candidateFinishReason === "string" && candidateFinishReason.trim()) {
-      state.finishReason = candidateFinishReason.trim();
-      state.events.push({ kind: "finish", reason: state.finishReason });
-    }
-    const parts2 = Array.isArray(
-      candidate.content?.parts
-    ) ? candidate.content.parts : [];
-    for (const part of parts2) {
-      if (!part || typeof part !== "object") continue;
-      const partSignature = part.thoughtSignature;
-      const isThought = Boolean(part.thought);
-      if ("text" in part && typeof part.text === "string") {
-        const piece = part.text;
-        if (!isThought) {
-          state.text += piece;
-          if (piece) {
-            state.events.push({ kind: "text", text: piece });
-            if (options?.onTextDelta) options.onTextDelta(piece);
-          }
-        } else {
-          state.reasoning += piece;
-          if (piece) {
-            state.events.push({ kind: "reasoning", text: piece });
-            if (options?.onReasoningDelta) options.onReasoningDelta(piece);
-          }
-        }
-      }
-      if (isThought && typeof partSignature === "string" && partSignature) {
-        state.pendingThoughtSignature = partSignature;
-      }
-      if ("functionCall" in part && part.functionCall) {
-        const call = part.functionCall;
-        const name = typeof call.name === "string" ? call.name : "tool";
-        const id = typeof call.id === "string" ? call.id : `${name}_${state.toolCalls.length}`;
-        const argsObj = call.args && typeof call.args === "object" ? call.args : {};
-        const resolvedSignature = typeof partSignature === "string" && partSignature ? partSignature : state.pendingThoughtSignature;
-        state.pendingThoughtSignature = void 0;
-        const toolCall = {
-          id,
-          type: "function",
-          function: { name, arguments: JSON.stringify(argsObj) },
-          ...typeof resolvedSignature === "string" && resolvedSignature ? { thought_signature: resolvedSignature } : {}
-        };
-        state.toolCalls.push(toolCall);
-        state.events.push({ kind: "tool_call", toolCall });
-      }
-    }
-  }
-}
-function accumulateGeminiChunks(chunks2, options) {
-  const state = createGeminiAccumulatorState();
-  for (const chunk of chunks2) {
-    applyGeminiChunk(chunk, state, options);
-  }
-  return {
-    text: state.text,
-    toolCalls: state.toolCalls,
-    usage: state.usage,
-    finishReason: state.finishReason,
-    reasoningContent: state.reasoning,
-    events: state.events
-  };
-}
-async function accumulateGeminiStream(stream, options) {
-  const state = createGeminiAccumulatorState();
-  for await (const chunk of stream) {
-    applyGeminiChunk(chunk, state, options);
-  }
-  return {
-    text: state.text,
-    toolCalls: state.toolCalls,
-    usage: state.usage,
-    finishReason: state.finishReason,
-    reasoningContent: state.reasoning,
-    events: state.events
-  };
-}
-function shouldUseGeminiNativeToolRoute(provider, model, tools, isImageModel) {
-  return provider === "google" && !isImageModel(model) && isGemini3Model(model) && Array.isArray(tools) && tools.length > 0;
-}
-function buildGeminiGenerateContentRequest(args2) {
-  const { contents, systemTexts } = convertOpenAiMessagesToGemini(
-    args2.messages,
-    { attachSkipThoughtSignature: args2.attachSkipThoughtSignature }
-  );
-  const request3 = { contents };
-  if (systemTexts.length > 0) {
-    request3.systemInstruction = {
-      role: "user",
-      parts: systemTexts.map((text) => ({ text }))
-    };
-  }
-  const toolsResult = convertOpenAiToolsToGemini(args2.tools);
-  if (toolsResult) {
-    request3.tools = toolsResult;
-    request3.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
-  }
-  const generationConfig = {};
-  if (typeof args2.maxTokens === "number" && args2.maxTokens > 0) {
-    generationConfig.maxOutputTokens = args2.maxTokens;
-  }
-  if (typeof args2.temperature === "number") {
-    generationConfig.temperature = args2.temperature;
-  }
-  if (Object.keys(generationConfig).length > 0) {
-    request3.generationConfig = generationConfig;
-  }
-  return request3;
-}
-
-// packages/agent-runtime/antigravityCloudCodeProvider.ts
-var STREAM_PATH = "/v1internal:streamGenerateContent?alt=sse";
-function buildCloudCodeAssistPayload(args2) {
-  const projectId = readAntigravityProjectId(args2.metadata);
-  if (!projectId) {
-    throw new Error(
-      "Antigravity OAuth credential is missing metadata.projectId. Re-run `nolo auth antigravity`."
-    );
-  }
-  const logicalModel = asOptionalTrimmedString(args2.openAiBody.model) ?? asOptionalTrimmedString(args2.agentConfig.model) ?? "gemini-3.1-pro";
-  const { wireModelId: model, profile } = resolveAntigravityWireModel(logicalModel);
-  const rawMessages = Array.isArray(args2.openAiBody.messages) ? args2.openAiBody.messages : [];
-  const quirks = resolveGeminiModelQuirks(model);
-  const isClaude = quirks.isClaudeCrossModel;
-  const { contents, systemTexts } = convertOpenAiMessagesToGemini(rawMessages, {
-    attachSkipThoughtSignature: quirks.allowsThoughtSignatureSentinel
-  });
-  if (contents.length === 0) {
-    throw new Error("Antigravity Cloud Code Assist request has no user/model contents.");
-  }
-  const prompt = args2.agentConfig.prompt?.trim();
-  if (prompt) systemTexts.unshift(prompt);
-  const request3 = { contents };
-  if (systemTexts.length > 0) {
-    request3.systemInstruction = {
-      role: "user",
-      parts: systemTexts.map((text) => ({ text }))
-    };
-  }
-  const tools = convertOpenAiToolsToGemini(
-    Array.isArray(args2.openAiBody.tools) ? args2.openAiBody.tools : void 0
-  );
-  if (tools) {
-    request3.tools = tools;
-    request3.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
-  }
-  const generationConfig = {};
-  if (profile?.maxOutputTokens) {
-    generationConfig.maxOutputTokens = profile.maxOutputTokens;
-  } else if (typeof args2.agentConfig.max_tokens === "number" && args2.agentConfig.max_tokens > 0) {
-    generationConfig.maxOutputTokens = args2.agentConfig.max_tokens;
-  }
-  if (typeof args2.agentConfig.temperature === "number") {
-    generationConfig.temperature = args2.agentConfig.temperature;
-  }
-  if (Object.keys(generationConfig).length > 0) {
-    request3.generationConfig = generationConfig;
-  }
-  const agentId = randomUUID();
-  const trajectoryId = randomUUID();
-  const step = 2;
-  const requestId = `agent/${agentId}/${Date.now()}/${trajectoryId}/${step}`;
-  const labels = {
-    trajectory_id: trajectoryId,
-    last_step_index: String(step - 1),
-    used_claude: String(isClaude),
-    used_claude_conservative: String(isClaude)
-  };
-  if (profile?.modelEnum) {
-    labels.model_enum = profile.modelEnum;
-  }
-  request3.labels = labels;
-  request3.sessionId = `-${Math.floor(Math.random() * 9e15)}`;
-  return {
-    url: `${resolveAntigravityCloudCodeBaseUrl(args2.agentConfig.customProviderUrl)}${STREAM_PATH}`,
-    envelope: {
-      project: projectId,
-      model,
-      request: request3,
-      requestId,
-      requestType: "agent",
-      userAgent: "antigravity"
-    }
-  };
-}
-function resolveAntigravityFinishReason(upstream) {
-  const normalized = (upstream ?? "").trim().toUpperCase();
-  if (normalized === "MAX_TOKENS") return "length";
-  if (normalized === "SAFETY" || normalized === "RECITATION" || normalized === "PROHIBITED_CONTENT" || normalized === "BLOCKLIST") {
-    return "content_filter";
-  }
-  return "stop";
-}
-function normalizeAntigravityCompletion(decoded) {
-  const { text, toolCalls, usage, finishReason, reasoningContent, events } = decoded;
-  const normalizedFinishReason = (finishReason ?? "").trim().toUpperCase();
-  if (!text && !reasoningContent && toolCalls.length === 0 && !finishReason && !usage) {
-    const body = {
-      error: {
-        message: "antigravity upstream returned an empty stream (no content, finishReason or usage); channel degradation, not model emptiness"
-      },
-      provider_events: events
-    };
-    return {
-      status: 502,
-      text: "",
-      toolCalls: [],
-      providerEvents: events,
-      body
-    };
-  }
-  if (normalizedFinishReason === "MALFORMED_FUNCTION_CALL") {
-    const message2 = "antigravity upstream returned MALFORMED_FUNCTION_CALL (model generated an invalid function call or tool arguments were rejected by upstream)";
-    const providerFailure = {
-      kind: "provider_failure",
-      provider: "antigravity",
-      code: "MALFORMED_FUNCTION_CALL",
-      message: message2,
-      providerReason: "MALFORMED_FUNCTION_CALL",
-      retryable: false,
-      status: 502
-    };
-    return {
-      status: 502,
-      text: "",
-      toolCalls: [],
-      finishReason,
-      providerEvents: events,
-      providerFailure,
-      runtimeProviderFailure: {
-        message: providerFailure.message,
-        retryable: providerFailure.retryable
-      },
-      body: {
-        error: {
-          message: message2,
-          code: "MALFORMED_FUNCTION_CALL",
-          category: "malformed_function_call",
-          providerReason: "MALFORMED_FUNCTION_CALL",
-          retryable: false
-        },
-        provider_failure: providerFailure,
-        provider_events: events
-      }
-    };
-  }
-  const message = {
-    role: "assistant",
-    content: text || null
-  };
-  if (toolCalls.length > 0) message.tool_calls = toolCalls;
-  if (reasoningContent) message.reasoning_content = reasoningContent;
-  return {
-    status: 200,
-    text,
-    ...reasoningContent ? { reasoningContent } : {},
-    toolCalls,
-    ...usage ? { usage } : {},
-    ...finishReason ? { finishReason } : {},
-    providerEvents: events,
-    body: {
-      choices: [{
-        index: 0,
-        message,
-        finish_reason: toolCalls.length > 0 ? "tool_calls" : resolveAntigravityFinishReason(finishReason)
-      }],
-      ...usage ? { usage } : {},
-      provider_events: events
-    }
-  };
-}
-async function fetchAntigravityCloudCodeCompletion(args2) {
-  const fetchImpl = args2.fetchImpl ?? fetch;
-  const { url, envelope } = buildCloudCodeAssistPayload(args2);
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${args2.accessToken}`,
-      "Content-Type": "application/json",
-      "User-Agent": getAntigravityUserAgent()
-    },
-    body: JSON.stringify(envelope),
-    signal: args2.signal
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    return {
-      status: response.status,
-      text: "",
-      toolCalls: [],
-      providerEvents: [],
-      // 保留上游结构：Antigravity 的限流 body 同样携带结构化的重置信息，
-      // 压成字符串会让冷却退化成 5 分钟默认值。
-      body: parseUpstreamErrorBody(errorText, response.statusText)
-    };
-  }
-  const chunkStream = streamSseDataValues(response, parseSseDataLineJson);
-  const { text, toolCalls, usage, finishReason, reasoningContent, events } = await accumulateGeminiStream(chunkStream, {
-    onTextDelta: args2.onTextDelta,
-    onReasoningDelta: args2.onReasoningDelta
-  });
-  const normalized = normalizeAntigravityCompletion({
-    text,
-    toolCalls,
-    usage,
-    finishReason,
-    reasoningContent,
-    events
-  });
-  if (normalized.status !== 200 || !text && toolCalls.length === 0) {
-    console.warn(
-      `[antigravity] empty completion: finishReason=${JSON.stringify(finishReason)} reasoningLen=${reasoningContent?.length ?? 0} usage=${JSON.stringify(usage) ?? "none"} model=${String(envelope.model)} base=${new URL(url).host}`
-    );
-  }
-  return normalized;
-}
-
 // packages/agent-runtime/devin/devinProvider.ts
-import { randomBytes, randomUUID as randomUUID2 } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 var CLIENT_NAME = "chisel";
 var CLIENT_VERSION = "2026.8.18";
 function writeVarint(fieldNum, value) {
@@ -20301,7 +20092,7 @@ function encodeDevinClientMetadata(token) {
 function encodeDevinChatMessage(msg) {
   const source = msg.role === "assistant" ? 2 : msg.role === "tool" ? 4 : 1;
   return Buffer.concat([
-    writeStringField(1, randomUUID2()),
+    writeStringField(1, randomUUID()),
     writeVarint(2, source),
     writeStringField(3, msg.text),
     ...(msg.toolCalls ?? []).map(
@@ -20389,7 +20180,7 @@ ${item.text}`;
   const chatMessageBuffers = coalesced.map((m) => encodeDevinChatMessage(m));
   const completionConfig = buildCompletionConfig({ temperature });
   const modelConfig = Buffer.concat([
-    writeStringField(1, randomUUID2()),
+    writeStringField(1, randomUUID()),
     writeVarint(2, 1),
     writeVarint(3, 4)
   ]);
@@ -20401,7 +20192,7 @@ ${item.text}`;
     writeMessageField(8, completionConfig),
     ...tools.map((tool) => writeMessageField(10, encodeDevinToolDefinition(tool))),
     writeMessageField(15, modelConfig),
-    writeStringField(16, randomUUID2()),
+    writeStringField(16, randomUUID()),
     writeVarint(20, 1),
     writeStringField(21, model)
   ]);
@@ -20775,8 +20566,6 @@ export {
   LOCAL_AGENT_CONFIG_MISSING_CODE,
   LOCAL_TURN_ABORTED_CODE,
   runLocalAgentTurn,
-  parseSseDataLineJson,
-  parseSseDataLineObject,
   codexStreamFailureStatus,
   aggregateResponsesStream,
   buildOpenAiCompatibleChatCompletionRequest,
@@ -20792,8 +20581,6 @@ export {
   createHybridRecordStore,
   isDestructiveShellCommand,
   evaluateShellCommandPolicy,
-  resolveLocalToolPolicy,
-  executeLocalToolWithPolicy,
   filterRetainedLedgerRecords,
   isLineRangeCovered,
   getProcessRegistry,
@@ -20804,17 +20591,14 @@ export {
   internalSearchWorkspace,
   internalListWorkspaceEntries,
   createLocalWorkspaceToolExecutors,
+  buildToolParametersIndex,
+  getAgentRuntimeToolParametersIndex,
+  resolveLocalToolPolicy,
+  executeLocalToolWithPolicy,
   localDialogMessageRecordToRuntimeMessage,
   buildLocalDialogWritePlan,
   buildNoloWorkspaceCliToolExecutors,
   buildLoadSkillExecutor,
-  parseUpstreamErrorBody,
-  isGemini3Model,
-  accumulateGeminiChunks,
-  shouldUseGeminiNativeToolRoute,
-  buildGeminiGenerateContentRequest,
-  resolveAntigravityFinishReason,
-  fetchAntigravityCloudCodeCompletion,
   readDevinUpstreamFailure,
   createDevinProvider
 };