nolo-cli 0.84.0-alpha.1 → 0.84.0

package/{chunk-T25L377S.js → chunk-RPJUFEGR.js}

@@ -1,19 +1,19 @@
 import {
   createCliLocalRuntimeAdapter,
   summarizeEndpoint
-} from "./chunk-GHEJJGJI.js";
+} from "./chunk-LMREEBWT.js";
 import {
   clipMultilineText
-} from "./chunk-RZOJRTKR.js";
+} from "./chunk-3BGIKIPF.js";
 import {
   runLocalAgentTurn
-} from "./chunk-PF6O3GR3.js";
+} from "./chunk-52Q2IW2X.js";
 import {
   applyToolSurfaceConstraints
-} from "./chunk-ZVN6I33J.js";
+} from "./chunk-HCT7U36O.js";
 import {
   resolveLocalRuntimeEnvFromPolicy
-} from "./chunk-3JQ2NRYU.js";
+} from "./chunk-HVURBGF3.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -32,19 +32,19 @@ import {
 } from "./chunk-KX6YBIHG.js";
 import {
   asTrimmedNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
+} from "./chunk-VMFTFOWF.js";
 import {
   ownedAgentKey
-} from "./chunk-BJIRLHJR.js";
+} from "./chunk-M2EJHDJP.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
 import {
   asOptionalPositiveFiniteNumber
 } from "./chunk-U6VC4MU4.js";
-import {
-  isRecord
-} from "./chunk-KUG52IAP.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";

package/{chunk-QCZX4FTW.js → chunk-SH43IESU.js}

@@ -6,19 +6,146 @@ import {
 } from "./chunk-KUG52IAP.js";
 
 // packages/desktop-chrome-connector/chromeConnector.ts
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// packages/desktop-chrome-connector/uploadSecurity.mjs
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+var DEFAULT_MAX_FILE_BYTES = 25 * 1024 * 1024;
+var DEFAULT_MAX_FILES = 10;
+var UploadSecurityError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "UploadSecurityError";
+    this.code = code;
+  }
+};
+function createUploadSecurityError(code, message) {
+  return new UploadSecurityError(code, message);
+}
+function isSubpath(parent, child) {
+  const rel = relative(parent, child);
+  return !rel.startsWith("..") && !isAbsolute(rel);
+}
+function parseAllowedRoots(env = process.env) {
+  const raw = env?.NOLO_CHROME_UPLOAD_ROOTS;
+  if (!raw || typeof raw !== "string") {
+    return [];
+  }
+  return raw.split(",").map((entry) => entry.trim()).filter(Boolean).filter((entry) => isAbsolute(entry)).map((entry) => {
+    const resolved = resolve(entry);
+    if (existsSync(resolved)) {
+      try {
+        return realpathSync(resolved);
+      } catch {
+        return resolved;
+      }
+    }
+    return resolved;
+  });
+}
+function validateUploadFiles(options = {}) {
+  const {
+    files,
+    env = process.env,
+    maxFiles = DEFAULT_MAX_FILES,
+    maxFileBytes = DEFAULT_MAX_FILE_BYTES
+  } = options;
+  if (!Array.isArray(files) || files.length === 0) {
+    throw createUploadSecurityError("no_files", "Provide at least one file to upload.");
+  }
+  if (files.length > maxFiles) {
+    throw createUploadSecurityError(
+      "too_many_files",
+      `Too many files: ${files.length} provided, maximum allowed is ${maxFiles}.`
+    );
+  }
+  const allowedRoots = parseAllowedRoots(env);
+  if (allowedRoots.length === 0) {
+    throw createUploadSecurityError(
+      "path_not_allowed",
+      "Upload roots not configured in NOLO_CHROME_UPLOAD_ROOTS; all uploads are refused."
+    );
+  }
+  const fileStats = [];
+  const canonicalFiles = [];
+  let totalBytes = 0;
+  for (const rawFile of files) {
+    if (typeof rawFile !== "string" || !rawFile.trim()) {
+      throw createUploadSecurityError("path_not_allowed", "File path must be a non-empty string.");
+    }
+    const trimmed = rawFile.trim();
+    const resolvedCandidate = resolve(trimmed);
+    if (!existsSync(resolvedCandidate)) {
+      throw createUploadSecurityError("path_not_allowed", `File not found or inaccessible: ${rawFile}`);
+    }
+    let real;
+    try {
+      real = realpathSync(resolvedCandidate);
+    } catch {
+      throw createUploadSecurityError("path_not_allowed", `Could not resolve canonical path for: ${rawFile}`);
+    }
+    let st;
+    try {
+      st = statSync(real);
+    } catch {
+      throw createUploadSecurityError("path_not_allowed", `Could not stat file: ${rawFile}`);
+    }
+    if (!st.isFile()) {
+      throw createUploadSecurityError("path_not_allowed", `Target path is not a regular file: ${rawFile}`);
+    }
+    if (st.size > maxFileBytes) {
+      throw createUploadSecurityError(
+        "too_large",
+        `File size ${st.size} bytes exceeds maximum allowed limit of ${maxFileBytes} bytes: ${rawFile}`
+      );
+    }
+    const realInside = allowedRoots.some((root) => isSubpath(root, real));
+    if (!realInside) {
+      throw createUploadSecurityError(
+        "path_not_allowed",
+        `Path '${rawFile}' (resolved: '${real}') is not within allowed upload roots.`
+      );
+    }
+    canonicalFiles.push(real);
+    fileStats.push({ path: real, bytes: st.size });
+    totalBytes += st.size;
+  }
+  return {
+    ok: true,
+    files: canonicalFiles,
+    fileStats,
+    totalBytes
+  };
+}
+function formatUploadAuditLog(entry = {}) {
+  const ts = entry.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+  const safeTabId = String(entry.tabId ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
+  const safeTarget = String(entry.target ?? "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ");
+  const files = Array.isArray(entry.files) ? entry.files : [];
+  const totalBytes = files.reduce((sum, f) => sum + (Number(f.bytes) || 0), 0);
+  const fileDetails = files.map((f) => `${String(f.path || "").replace(/[\x00-\x1f\x7f-\x9f]+/g, " ")}(${f.bytes || 0}B)`).join(", ");
+  return `[chrome-upload] ${ts} tabId=${safeTabId} target=${safeTarget} files=[${fileDetails}] totalBytes=${totalBytes}`;
+}
+function logUploadAudit(entry, logFn = console.warn) {
+  const line = formatUploadAuditLog(entry);
+  logFn(line);
+  return line;
+}
+
+// packages/desktop-chrome-connector/chromeConnector.ts
 var NOLO_CHROME_CONNECTOR_EXTENSION_ID = "ahpdoopadkamnglhlacfjdfnonpjdplg";
 var NOLO_CHROME_CONNECTOR_PROTOCOL_VERSION = "2";
 function defaultTokenPath() {
-  return resolve(
+  return resolve2(
     process.env.HOME || "",
     "Library/Application Support/Nolo/ChromeConnector/token"
   );
 }
 function readConnectorToken(tokenPath = defaultTokenPath()) {
   if (process.env.NOLO_CHROME_CONNECTOR_TOKEN) return process.env.NOLO_CHROME_CONNECTOR_TOKEN;
-  if (!existsSync(tokenPath)) return "";
+  if (!existsSync2(tokenPath)) return "";
   return readFileSync(tokenPath, "utf8").trim();
 }
 var CHROME_TOOL_ACTIONS = {
@@ -32,7 +159,10 @@ var CHROME_TOOL_ACTIONS = {
   chrome_scroll: "scroll",
   chrome_screenshot: "screenshot",
   chrome_read_console: "read_console",
-  chrome_read_network: "read_network"
+  chrome_read_network: "read_network",
+  chrome_set_files: "set_files",
+  chrome_upload_file: "set_files",
+  chrome_upload: "set_files"
 };
 function createConnectorError(code, message, details) {
   const error = new Error(message);
@@ -59,8 +189,8 @@ function errorPayload(error) {
     ...error?.details !== void 0 ? { details: error.details } : {}
   };
 }
-var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type"]);
-var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach"]);
+var TARGET_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["click", "type", "set_files"]);
+var TAB_ID_REQUIRED_ACTIONS = /* @__PURE__ */ new Set(["close_tab", "detach", "set_files"]);
 function validateChromeConnectorPayload(action, payload) {
   if (TAB_ID_REQUIRED_ACTIONS.has(action)) {
     const raw = payload.tabId;
@@ -71,16 +201,42 @@ function validateChromeConnectorPayload(action, payload) {
         `Provide the tabId from chrome_list_tabs before calling ${action}.`
       );
     }
-    return;
+    if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
   }
   if (!TARGET_REQUIRED_ACTIONS.has(action)) return;
-  const elementRef = typeof payload.elementRef === "string" ? payload.elementRef.trim() : "";
+  const rawRef = typeof payload.elementRef === "string" ? payload.elementRef : typeof payload.ref === "string" ? payload.ref : "";
+  const elementRef = rawRef.trim();
   const selector = typeof payload.selector === "string" ? payload.selector.trim() : "";
-  if (elementRef || selector) return;
-  throw createConnectorError(
-    "ELEMENT_TARGET_REQUIRED",
-    "Provide elementRef from chrome_read_page or a CSS selector."
-  );
+  if (!elementRef && !selector) {
+    throw createConnectorError(
+      "ELEMENT_TARGET_REQUIRED",
+      "Provide elementRef from chrome_read_page or a CSS selector."
+    );
+  }
+  if (action === "set_files") {
+    if (!Array.isArray(payload.files) || payload.files.length === 0) {
+      throw createConnectorError(
+        "no_files",
+        "Provide at least one file path in files array."
+      );
+    }
+    try {
+      const validated = validateUploadFiles({
+        files: payload.files,
+        env: process.env
+      });
+      payload.files = validated.files;
+      const targetStr = elementRef ? `ref:${elementRef}` : `selector:${selector}`;
+      logUploadAudit({
+        tabId: String(payload.tabId),
+        target: targetStr,
+        files: validated.fileStats
+      });
+    } catch (err) {
+      const code = err?.code ?? "path_not_allowed";
+      throw createConnectorError(code, toErrorMessage(err));
+    }
+  }
 }
 function createChromeConnectorClient(args) {
   if (args?.request) return { request: args.request };
@@ -90,6 +246,7 @@ function createChromeConnectorClient(args) {
   const token = args?.token ?? readConnectorToken(args?.tokenPath);
   return {
     async request(action, payload) {
+      validateChromeConnectorPayload(action, payload);
       let response;
       try {
         response = await fetchImpl(endpoint, {
@@ -131,7 +288,8 @@ var REQUIRED_CHROME_CONNECTOR_FEATURES = {
   screenshot: ["browser_debug"],
   read_console: ["browser_debug"],
   read_network: ["browser_debug"],
-  detach: ["browser_debug"]
+  detach: ["browser_debug"],
+  set_files: ["compact_observation_v2", "file_upload"]
 };
 function requiredFeaturesForConnectorAction(action) {
   return [...REQUIRED_CHROME_CONNECTOR_FEATURES[action] ?? []];

package/{chunk-SPAQ4PVV.js → chunk-SV5IJK6K.js}

@@ -4,7 +4,7 @@ import {
 import {
   ownedAgentKey,
   publicAgentKey
-} from "./chunk-BJIRLHJR.js";
+} from "./chunk-M2EJHDJP.js";
 
 // packages/cli/agentAliases.ts
 var CURRENT_OPERATOR_USER_ID = "0e95801d90";

package/{chunk-BKJO7LDP.js → chunk-U4OKDZFH.js}

@@ -1,9 +1,9 @@
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-GHEJJGJI.js";
+} from "./chunk-LMREEBWT.js";
 import {
   getReadableCliDb
-} from "./chunk-RXX4GDIH.js";
+} from "./chunk-LS2ZANRJ.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
@@ -12,10 +12,10 @@ import {
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-NRALD3CC.js";
+} from "./chunk-QSHEEA5N.js";
 import {
   resolveCliAgentKeyInput
-} from "./chunk-SPAQ4PVV.js";
+} from "./chunk-SV5IJK6K.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -167,7 +167,7 @@ async function runAgentCreateCommand(args, deps = {}) {
   }
   if (!parsed) {
     output.write(
-      "Usage: nolo agent create <agent> [--model <id>] [--cli-provider <provider>] [--api-source <source>] [--max-concurrent <n>] [--expires-at <iso>] [--prompt <text> | --prompt-file <path> | --prompt-doc <pageKey>] [--tools <json>] [--copy-provider-from <agent>] [--name <name>] [--custom-provider-url <url>] [--api-key <key>|--provider-api-key <key>] [--verify] [--field key=value]\n".replace("[--field key=value]", "[--handle <name>] [--field key=value]")
+      "Usage: nolo agent create <agent> [--preset <id>] [--model <id>] [--cli-provider <provider>] [--api-source <source>] [--max-concurrent <n>] [--expires-at <iso>] [--prompt <text> | --prompt-file <path> | --prompt-doc <pageKey>] [--tools <json>] [--copy-provider-from <agent>] [--name <name>] [--custom-provider-url <url>] [--api-key <key>|--provider-api-key <key>] [--verify] [--field key=value]\n" + "  --preset <id> resolves a `nolo agent providers` preset (e.g. step-plan) into provider/baseUrl/model; explicit flags override it.\n".replace("[--field key=value]", "[--handle <name>] [--field key=value]")
     );
     return args[0] ? 0 : 1;
   }
@@ -212,7 +212,7 @@ async function runAgentCreateCommand(args, deps = {}) {
     clearCliLocalRuntimePreparedAgentCache();
     let verifyResult;
     if (parsed.verify) {
-      const { verifyCustomProvider } = await import("./agentProviderCommands-65ZC2WB4.js");
+      const { verifyCustomProvider } = await import("./agentProviderCommands-X3UNW77C.js");
       const rec = built.nextRecord;
       verifyResult = await verifyCustomProvider({
         providerUrl: rec.customProviderUrl,

package/{chunk-DM4FBSWG.js → chunk-UDVH2P4A.js}

@@ -3,7 +3,7 @@ import {
   createFileCredentialBroker,
   migrateAgentSecrets,
   normalizeAgentRuntimeToolPolicy
-} from "./chunk-3JQ2NRYU.js";
+} from "./chunk-HVURBGF3.js";
 import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
@@ -11,16 +11,16 @@ import {
   patch,
   remove,
   write
-} from "./chunk-YFADVSZE.js";
+} from "./chunk-VRTTFDBM.js";
 import {
   createAgentKey,
   toTrimmedString
-} from "./chunk-NHRQCXIQ.js";
+} from "./chunk-VMFTFOWF.js";
 import {
   asyncThunkCreator,
   buildCreateSlice,
   getRuntimeServerContext
-} from "./chunk-3RAG2NAD.js";
+} from "./chunk-UKWGR5SS.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -304,7 +304,7 @@ var slice = createSliceWithThunks({
       const overrides = {};
       if (args.systemPromptOverride !== void 0) overrides.prompt = args.systemPromptOverride;
       if (args.toolsOverride !== void 0) overrides.tools = args.toolsOverride;
-      const { _executeModel } = await import("./_executeModel-IULR47HG.js");
+      const { _executeModel } = await import("./_executeModel-BPUR2QYH.js");
       return _executeModel(
         {
           isStreaming: args.isStreaming ?? false,
@@ -325,7 +325,7 @@ var slice = createSliceWithThunks({
      * - 循环直到无工具调用或触发其他运行时停止条件
      */
     runAgent: create.asyncThunk(async (args, thunkApi) => {
-      const { runAgentClientLoop } = await import("./runAgentClientLoop-7TQM7IAR.js");
+      const { runAgentClientLoop } = await import("./runAgentClientLoop-TA4SSPHE.js");
       const { content: loopContent, toolCallCount } = await runAgentClientLoop(
         {
           agentKey: args.agentKey,
@@ -341,7 +341,7 @@ var slice = createSliceWithThunks({
      * 聊天轮次流式 Agent 调用
      */
     streamAgentChatTurn: create.asyncThunk(async (args, thunkApi) => {
-      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-6EF6TVFK.js");
+      const { streamAgentChatTurnHandler } = await import("./streamAgentChatTurn-X5ENGUIS.js");
       return streamAgentChatTurnHandler(args, thunkApi);
     }),
     /**

package/{chunk-4EJ5QYB5.js → chunk-UEVXFHQB.js}

@@ -1,13 +1,13 @@
 import {
   getActiveDialogKey
-} from "./chunk-6YTOJY35.js";
+} from "./chunk-6D2JFXLY.js";
 import {
   require_date_fns
 } from "./chunk-M76ECQRD.js";
 import {
   patch,
   selectById
-} from "./chunk-YFADVSZE.js";
+} from "./chunk-VRTTFDBM.js";
 import {
   __toESM
 } from "./chunk-4VNS5WPM.js";

package/{chunk-JYYZCK2Z.js → chunk-V7E4PXQD.js}

@@ -2,7 +2,7 @@ import {
   LOCAL_CODEX_AGENT_KEY,
   isLocalCliAgentKey,
   resolveCliAgentKeyInput
-} from "./chunk-SPAQ4PVV.js";
+} from "./chunk-SV5IJK6K.js";
 import {
   DEFAULT_NOLO_SERVER_URL
 } from "./chunk-OLZBQWZU.js";

package/{chunk-NHRQCXIQ.js → chunk-VMFTFOWF.js}

@@ -1,9 +1,6 @@
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
-import {
-  asNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -2393,6 +2390,17 @@ var require_rambda = __commonJS({
   }
 });
 
+// packages/core/stringArray.ts
+function asNonEmptyStringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (item) => typeof item === "string" && !!item.trim()
+  );
+}
+function asTrimmedNonEmptyStringArray(value) {
+  return asNonEmptyStringArray(value).map((item) => item.trim());
+}
+
 // packages/core/toTrimmedString.ts
 function toTrimmedString(value) {
   return typeof value === "string" ? value.trim() : value == null ? "" : String(value).trim();
@@ -3169,6 +3177,8 @@ var sanitizeShareData = (data) => {
 };
 
 export {
+  asNonEmptyStringArray,
+  asTrimmedNonEmptyStringArray,
   ulid,
   toTrimmedString,
   toNonEmptyString,

package/{chunk-YFADVSZE.js → chunk-VRTTFDBM.js}

@@ -2,17 +2,17 @@ import {
   fileKey,
   getFileIdFromKey,
   ulid
-} from "./chunk-NHRQCXIQ.js";
+} from "./chunk-VMFTFOWF.js";
 import {
   loadFileFromIndexedDb,
   removeAction,
   saveFileToIndexedDb
-} from "./chunk-SREASRV5.js";
+} from "./chunk-ABQYVJBJ.js";
 import {
   readAction,
   readRequestManager,
   resolveAgentReadServers
-} from "./chunk-5J7W2VWW.js";
+} from "./chunk-WV42OMV7.js";
 import {
   asyncThunkCreator,
   buildCreateSlice,
@@ -32,7 +32,7 @@ import {
   shouldReplaceLocalWithRemoteRecord,
   shouldReplicateLocalRecord,
   uploadToCurrentServer
-} from "./chunk-3RAG2NAD.js";
+} from "./chunk-UKWGR5SS.js";
 import {
   fetchFromClientDb,
   fetchFromServer,
@@ -712,7 +712,7 @@ var dbSlice = createSliceWithThunks({
     // 动态 import 在调用期解析，避开 TDZ/求值顺序问题（同下方 share）。
     read: create.asyncThunk(
       async (payload, thunkApi) => {
-        const { readAction: readAction2 } = await import("./read-LC6HVYBN.js");
+        const { readAction: readAction2 } = await import("./read-COE3ZYR6.js");
         return readAction2(payload, thunkApi);
       },
       {
@@ -786,7 +786,7 @@ var dbSlice = createSliceWithThunks({
     // 这里改成动态 import，运行期才解析，彻底断开这条边。
     share: create.asyncThunk(
       async (config, thunkApi) => {
-        const { shareResourceAction } = await import("./action-D22U6CTH.js");
+        const { shareResourceAction } = await import("./action-P4TNFGAD.js");
         return shareResourceAction(config, thunkApi);
       }
     ),
@@ -824,6 +824,7 @@ export {
   toTimestampMs,
   resolveFileCategory,
   uploadFileAction,
+  readFileContentAction,
   dbAdapter,
   selectById,
   selectEntities,

package/{chunk-U7YP7ECK.js → chunk-WP5UXDA5.js}

@@ -1,21 +1,86 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-WL2RKIBF.js";
+} from "./chunk-3YIAR5UI.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-NRALD3CC.js";
+} from "./chunk-QSHEEA5N.js";
 import {
   deriveCredentialGroup,
   toSafeAgentSummary
-} from "./chunk-73BR2IQT.js";
+} from "./chunk-CWQINZEA.js";
 import {
   PUBLIC_AGENT_KEY_PREFIX,
   isOwnedAgentKey,
   ownedAgentKey,
+  ownedAgentKeyPrefix,
   parseOwnedAgentId,
   publicAgentKey
-} from "./chunk-BJIRLHJR.js";
+} from "./chunk-M2EJHDJP.js";
+
+// packages/ai/agent/quotaSnapshot.ts
+function findTightestQuotaWindow(quota, now = Date.now()) {
+  if (!quota || !Array.isArray(quota.windows) || quota.windows.length === 0) {
+    return void 0;
+  }
+  let best;
+  let bestScore = -Infinity;
+  for (const w of quota.windows) {
+    let score = 0;
+    if (typeof w.utilization === "number" && w.utilization >= 0) {
+      score = 500 + Math.min(w.utilization, 1) * 500;
+    } else if (typeof w.remaining === "number" && typeof w.limit === "number" && w.limit > 0) {
+      const util = Math.max(0, 1 - w.remaining / w.limit);
+      score = 500 + util * 500;
+    } else if (typeof w.resetAt === "number" && w.resetAt > now) {
+      score = 200;
+    } else if (typeof w.remaining === "number") {
+      score = 100;
+    }
+    if (score > bestScore) {
+      bestScore = score;
+      best = w;
+    }
+  }
+  return best ?? quota.windows[0];
+}
+function formatQuotaSummary(quota, now = Date.now(), options) {
+  const tightest = findTightestQuotaWindow(quota, now);
+  if (!tightest) return void 0;
+  const compact = options?.compact === true;
+  const parts = [];
+  if (typeof tightest.utilization === "number") {
+    const pct = Math.round(tightest.utilization * 100);
+    parts.push(`${pct}%\u5DF2\u7528`);
+  } else if (typeof tightest.remaining === "number") {
+    if (typeof tightest.limit === "number") {
+      parts.push(`${tightest.remaining}/${tightest.limit}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    } else {
+      parts.push(`\u4F59${tightest.remaining}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    }
+  }
+  if (compact) return parts.length > 0 ? parts[0] : void 0;
+  if (tightest.scope && tightest.scope !== "user" && tightest.scope !== "project" && tightest.scope !== tightest.unit) {
+    parts.push(tightest.scope);
+  }
+  if (typeof tightest.resetAt === "number" && tightest.resetAt > now) {
+    const diffSec = Math.round((tightest.resetAt - now) / 1e3);
+    if (diffSec < 60) {
+      parts.push(`${diffSec}s\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 3600) {
+      parts.push(`${Math.round(diffSec / 60)}m\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 86400) {
+      const hours = (diffSec / 3600).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${hours}h\u540E\u91CD\u7F6E`);
+    } else {
+      const days = (diffSec / 86400).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${days}d\u540E\u91CD\u7F6E`);
+    }
+  }
+  if (parts.length === 0) return void 0;
+  if (parts.length === 1 && parts[0] === tightest.scope) return void 0;
+  return parts.join(" \xB7 ");
+}
 
 // packages/cli/agentListHelpers.ts
 function parseAgentRecordId(privateKey, explicitId) {
@@ -66,7 +131,8 @@ function normalizeListedAgent(record) {
     ...credentialKind !== void 0 ? { credentialKind } : {},
     ...typeof record?.apiSource === "string" && record.apiSource ? { apiSource: record.apiSource } : {},
     ...typeof record?.cliProvider === "string" && record.cliProvider ? { cliProvider: record.cliProvider } : {},
-    ...typeof record?.nextAvailableAt === "number" && Number.isFinite(record.nextAvailableAt) ? { nextAvailableAt: record.nextAvailableAt } : {}
+    ...typeof record?.nextAvailableAt === "number" && Number.isFinite(record.nextAvailableAt) ? { nextAvailableAt: record.nextAvailableAt } : {},
+    ...record?.quota && typeof record.quota === "object" && Array.isArray(record.quota.windows) ? { quota: record.quota } : {}
   };
 }
 function toSafeListedAgentSummary(agent, options) {
@@ -96,6 +162,7 @@ function parseAgentListArgs(args) {
     publicOnly: args.includes("--public-only"),
     idsOnly: args.includes("--ids-only"),
     scope: readArgValue(args, "--scope"),
+    query: readArgValue(args, "--query"),
     showUnavailable: args.includes("--show-unavailable"),
     // --safe 默认输出精简投影（与 server listAgents 一致，防大列表被截断）；
     // --verbose 拿回完整字段集排障。
@@ -105,14 +172,17 @@ function parseAgentListArgs(args) {
 async function listLocalCachedAgents(args) {
   const privateRecords = /* @__PURE__ */ new Map();
   const publicKeys = /* @__PURE__ */ new Set();
-  for await (const [key, value] of args.db.iterator({ gte: "", lte: "\uFFFF" })) {
-    if (typeof key !== "string" || !value || typeof value !== "object") continue;
-    if (isOwnedAgentKey(key, args.userId)) {
-      privateRecords.set(key, { ...value, dbKey: key });
-      continue;
-    }
-    if (key.startsWith(PUBLIC_AGENT_KEY_PREFIX)) {
-      publicKeys.add(key);
+  const ownedPrefix = ownedAgentKeyPrefix(args.userId);
+  for (const prefix of [ownedPrefix, PUBLIC_AGENT_KEY_PREFIX]) {
+    for await (const [key, value] of args.db.iterator({ gte: prefix, lte: `${prefix}\uFFFF` })) {
+      if (typeof key !== "string" || !value || typeof value !== "object") continue;
+      if (isOwnedAgentKey(key, args.userId)) {
+        privateRecords.set(key, { ...value, dbKey: key });
+        continue;
+      }
+      if (key.startsWith(PUBLIC_AGENT_KEY_PREFIX)) {
+        publicKeys.add(key);
+      }
     }
   }
   const agents = sortListedAgents(
@@ -234,6 +304,7 @@ async function decorateAgentsWithPublicStatusAcrossServers(args) {
 }
 
 export {
+  formatQuotaSummary,
   normalizeListedAgent,
   toSafeListedAgentSummary,
   parseAgentListArgs,