nolo-cli 0.92.0-alpha.1 → 0.92.0

package/{chunk-G3V74DVM.js → chunk-MV26343G.js}

@@ -1,22 +1,20 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-TLO2X5C6.js";
+} from "./chunk-LNUOUGIY.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-TZB6Y4OD.js";
+} from "./chunk-IBQ6NJI4.js";
 import {
-  deriveCredentialGroup,
-  toSafeAgentSummary
-} from "./chunk-CDS4FQMP.js";
+  deriveCredentialGroup
+} from "./chunk-5RUECWE2.js";
 import {
   PUBLIC_AGENT_KEY_PREFIX,
-  isOwnedAgentKey,
   ownedAgentKey,
   ownedAgentKeyPrefix,
   parseOwnedAgentId,
   publicAgentKey
-} from "./chunk-GII32WZW.js";
+} from "./chunk-M2EJHDJP.js";
 
 // packages/cli/agentListHelpers.ts
 function parseAgentRecordId(privateKey, explicitId) {
@@ -67,16 +65,10 @@ function normalizeListedAgent(record) {
     ...credentialKind !== void 0 ? { credentialKind } : {},
     ...typeof record?.apiSource === "string" && record.apiSource ? { apiSource: record.apiSource } : {},
     ...typeof record?.cliProvider === "string" && record.cliProvider ? { cliProvider: record.cliProvider } : {},
-    ...typeof record?.nextAvailableAt === "number" && Number.isFinite(record.nextAvailableAt) ? { nextAvailableAt: record.nextAvailableAt } : {}
+    ...typeof record?.nextAvailableAt === "number" && Number.isFinite(record.nextAvailableAt) ? { nextAvailableAt: record.nextAvailableAt } : {},
+    ...record?.quota && typeof record.quota === "object" && Array.isArray(record.quota.windows) ? { quota: record.quota } : {}
   };
 }
-function toSafeListedAgentSummary(agent, options) {
-  const summary = toSafeAgentSummary(agent, options);
-  if (agent.publicRecordExists === false) {
-    delete summary.publicKey;
-  }
-  return summary;
-}
 function sortListedAgents(agents) {
   agents.sort((a, b) => {
     const ta = a.updatedAt == null ? 0 : new Date(a.updatedAt).getTime();
@@ -97,6 +89,7 @@ function parseAgentListArgs(args) {
     publicOnly: args.includes("--public-only"),
     idsOnly: args.includes("--ids-only"),
     scope: readArgValue(args, "--scope"),
+    query: readArgValue(args, "--query"),
     showUnavailable: args.includes("--show-unavailable"),
     // --safe 默认输出精简投影（与 server listAgents 一致，防大列表被截断）；
     // --verbose 拿回完整字段集排障。
@@ -110,7 +103,7 @@ async function listLocalCachedAgents(args) {
   for (const prefix of [ownedPrefix, PUBLIC_AGENT_KEY_PREFIX]) {
     for await (const [key, value] of args.db.iterator({ gte: prefix, lte: `${prefix}\uFFFF` })) {
       if (typeof key !== "string" || !value || typeof value !== "object") continue;
-      if (isOwnedAgentKey(key, args.userId)) {
+      if (key.startsWith(ownedPrefix)) {
         privateRecords.set(key, { ...value, dbKey: key });
         continue;
       }
@@ -237,14 +230,78 @@ async function decorateAgentsWithPublicStatusAcrossServers(args) {
   return args.agents;
 }
 
+// packages/ai/agent/quotaSnapshot.ts
+function findTightestQuotaWindow(quota, now = Date.now()) {
+  if (!quota || !Array.isArray(quota.windows) || quota.windows.length === 0) {
+    return void 0;
+  }
+  let best;
+  let bestScore = -Infinity;
+  for (const w of quota.windows) {
+    let score = 0;
+    if (typeof w.utilization === "number" && w.utilization >= 0) {
+      score = 500 + Math.min(w.utilization, 1) * 500;
+    } else if (typeof w.remaining === "number" && typeof w.limit === "number" && w.limit > 0) {
+      const util = Math.max(0, 1 - w.remaining / w.limit);
+      score = 500 + util * 500;
+    } else if (typeof w.resetAt === "number" && w.resetAt > now) {
+      score = 200;
+    } else if (typeof w.remaining === "number") {
+      score = 100;
+    }
+    if (score > bestScore) {
+      bestScore = score;
+      best = w;
+    }
+  }
+  return best ?? quota.windows[0];
+}
+function formatQuotaSummary(quota, now = Date.now(), options) {
+  const tightest = findTightestQuotaWindow(quota, now);
+  if (!tightest) return void 0;
+  const compact = options?.compact === true;
+  const parts = [];
+  if (typeof tightest.utilization === "number") {
+    const pct = Math.round(tightest.utilization * 100);
+    parts.push(`${pct}%\u5DF2\u7528`);
+  } else if (typeof tightest.remaining === "number") {
+    if (typeof tightest.limit === "number") {
+      parts.push(`${tightest.remaining}/${tightest.limit}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    } else {
+      parts.push(`\u4F59${tightest.remaining}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    }
+  }
+  if (compact) return parts.length > 0 ? parts[0] : void 0;
+  if (tightest.scope && tightest.scope !== "user" && tightest.scope !== "project" && tightest.scope !== tightest.unit) {
+    parts.push(tightest.scope);
+  }
+  if (typeof tightest.resetAt === "number" && tightest.resetAt > now) {
+    const diffSec = Math.round((tightest.resetAt - now) / 1e3);
+    if (diffSec < 60) {
+      parts.push(`${diffSec}s\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 3600) {
+      parts.push(`${Math.round(diffSec / 60)}m\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 86400) {
+      const hours = (diffSec / 3600).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${hours}h\u540E\u91CD\u7F6E`);
+    } else {
+      const days = (diffSec / 86400).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${days}d\u540E\u91CD\u7F6E`);
+    }
+  }
+  if (parts.length === 0) return void 0;
+  if (parts.length === 1 && parts[0] === tightest.scope) return void 0;
+  return parts.join(" \xB7 ");
+}
+
 export {
   normalizeListedAgent,
-  toSafeListedAgentSummary,
   parseAgentListArgs,
   listLocalCachedAgents,
   listRemotePublicAgents,
   listRemoteAgents,
   listRemoteAgentsAcrossServers,
   listFavoriteAgentIdsAcrossServers,
-  decorateAgentsWithPublicStatusAcrossServers
+  decorateAgentsWithPublicStatusAcrossServers,
+  formatQuotaSummary
 };

package/{chunk-7S4YWN7P.js → chunk-MX574M24.js}

@@ -1,6 +1,6 @@
 import {
   dialogMessageRange
-} from "./chunk-VMFTFOWF.js";
+} from "./chunk-3AH7LNUB.js";
 import {
   isTombstoneRecord
 } from "./chunk-GBRG75BQ.js";

package/{chunk-U7HSBX3I.js → chunk-O26PCYLS.js}

@@ -11,13 +11,13 @@ import {
   getAntigravityUserAgent,
   normalizeAntigravityTokenPayload,
   refreshAntigravityToken
-} from "./chunk-ZKYHTHNE.js";
-import {
-  writeOAuthCredential
-} from "./chunk-ONXOABJR.js";
+} from "./chunk-S5XGT6GB.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
+import {
+  writeOAuthCredential
+} from "./chunk-HNGRBWYF.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
@@ -367,6 +367,77 @@ async function refreshAntigravityOAuthToken(credential, deps = {}) {
 // packages/cli/oauth/flows/openai-codex.ts
 import { createHash as createHash2 } from "node:crypto";
 
+// packages/agent-runtime/oauthRefreshError.ts
+var PERMANENT_REFRESH_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  // OpenAI 令牌端点对失效/不存在的 refresh token 返回 401
+  // {"error":{"code":"invalid_refresh_token",...}}（2026-10-01 用必然无效的
+  // token 实测）。线上 chatgpt 凭据正是因为没认出它，被当成临时的
+  // "unauthorized"、每 15 分钟重试一次且永远不提示重新授权。
+  "invalid_refresh_token",
+  "refresh_token_reused",
+  "invalid_client"
+]);
+var SAFE_MESSAGES = {
+  invalid_grant: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_refresh_token: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  refresh_token_reused: "refresh token \u5DF2\u88AB\u5176\u4ED6\u526F\u672C\u4F7F\u7528\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_client: "OAuth \u5BA2\u6237\u7AEF\u88AB\u62D2\u7EDD\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  unauthorized: "\u4E0A\u6E38\u62D2\u7EDD\u4E86\u5237\u65B0\u8BF7\u6C42\uFF08401/403\uFF09",
+  rate_limited: "\u4E0A\u6E38\u9650\u6D41\uFF0C\u7A0D\u540E\u91CD\u8BD5",
+  http_5xx: "\u4E0A\u6E38\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528",
+  network: "\u65E0\u6CD5\u8FDE\u63A5\u4E0A\u6E38",
+  bad_response: "\u4E0A\u6E38\u8FD4\u56DE\u4E86\u65E0\u6CD5\u8BC6\u522B\u7684\u54CD\u5E94",
+  unknown: "\u5237\u65B0\u5931\u8D25"
+};
+var OAuthRefreshError = class extends Error {
+  code;
+  status;
+  retryAfterMs;
+  constructor(code, opts = {}) {
+    super(SAFE_MESSAGES[code]);
+    this.name = "OAuthRefreshError";
+    this.code = code;
+    if (opts.status !== void 0) this.status = opts.status;
+    if (opts.retryAfterMs !== void 0) this.retryAfterMs = opts.retryAfterMs;
+  }
+  get permanent() {
+    return PERMANENT_REFRESH_CODES.has(this.code);
+  }
+};
+function readErrorCode(payload) {
+  if (!payload || typeof payload !== "object") return void 0;
+  const err = payload.error;
+  if (typeof err === "string") return err;
+  if (err && typeof err === "object") {
+    const code = err.code;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+function classifyOAuthRefreshHttpFailure(status, payload, headers) {
+  const raw = readErrorCode(payload)?.toLowerCase();
+  if (raw === "invalid_grant") return new OAuthRefreshError("invalid_grant", { status });
+  if (raw === "invalid_refresh_token") {
+    return new OAuthRefreshError("invalid_refresh_token", { status });
+  }
+  if (raw === "refresh_token_reused") {
+    return new OAuthRefreshError("refresh_token_reused", { status });
+  }
+  if (raw === "invalid_client") return new OAuthRefreshError("invalid_client", { status });
+  if (status === 429) {
+    const seconds = Number(headers?.get("retry-after"));
+    return new OAuthRefreshError("rate_limited", {
+      status,
+      ...Number.isFinite(seconds) && seconds > 0 ? { retryAfterMs: seconds * 1e3 } : {}
+    });
+  }
+  if (status === 401 || status === 403) return new OAuthRefreshError("unauthorized", { status });
+  if (status >= 500) return new OAuthRefreshError("http_5xx", { status });
+  return new OAuthRefreshError("unknown", { status });
+}
+var TRANSIENT_MAX_MS = 15 * 6e4;
+
 // packages/agent-runtime/openaiCodexOAuth.ts
 var OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var OPENAI_CODEX_SCOPES = [
@@ -463,17 +534,14 @@ async function refreshOpenAiCodexToken(credential, deps = {}) {
       signal: AbortSignal.timeout(OPENAI_CODEX_TOKEN_REQUEST_TIMEOUT_MS)
     });
   } catch (error) {
-    throw new Error(
-      `OpenAI Codex token refresh failed: ${toErrorMessage(error)}`
-    );
+    throw new OAuthRefreshError("network");
   }
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" && payload.error_description ? payload.error_description : typeof payload.error === "string" && payload.error ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`OpenAI Codex token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("OpenAI Codex token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeOpenAiCodexTokenPayload({
@@ -1047,11 +1115,10 @@ async function refreshAnthropicToken(credential, deps = {}) {
   });
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`Claude token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("Claude token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeAnthropicTokenPayload({

package/chunk-OCZKATRC.js

@@ -0,0 +1,129 @@
+// packages/ai/chat/parseApiError.ts
+var CONTEXT_OVERFLOW_ACTIONS = [
+  "compact-and-retry",
+  "new-dialog",
+  "switch-model",
+  "retry"
+];
+var CONTEXT_TOO_LARGE_ACTIONS = [
+  "new-dialog",
+  "switch-model",
+  "retry"
+];
+var truncateErrorMessage = (message, maxChars = 320) => message.length <= maxChars ? message : `${message.slice(0, maxChars)}\u2026`;
+var isContextOverflowText = (message) => /maximum context|context (length|window|overflow|limit)|context_length_exceed\w*|requested about .*tokens|too many tokens|prompt is too long|exceeds? (the )?(model|max)/i.test(
+  message
+);
+function classifyApiError(input) {
+  const { status, message, body, code } = input;
+  const errorMessage = message;
+  let defaultMessage = `\u72B6\u6001\u7801 ${status} ${input.statusText ?? ""}`;
+  switch (status) {
+    case 400:
+      if (isContextOverflowText(errorMessage) || isContextOverflowText(body) || code === "UPSTREAM_400") {
+        return {
+          kind: "context_overflow",
+          message: "\u4E0A\u4E0B\u6587\u8FC7\u957F\uFF1A\u672C\u8F6E\u6D88\u606F\u6216\u5DE5\u5177\u7ED3\u679C\u592A\u5927\u3002\u8BF7\u7F29\u5C0F\u8303\u56F4\uFF0C\u6216\u5148\u8BFB\u53D6\u66F4\u5C0F\u7247\u6BB5\u540E\u518D\u7EE7\u7EED\u3002",
+          code,
+          status,
+          retryable: true,
+          actions: [...CONTEXT_OVERFLOW_ACTIONS]
+        };
+      }
+      if (code === "MISSING_PROVIDER_API_KEY") {
+        return {
+          kind: "generic",
+          message: truncateErrorMessage(errorMessage),
+          code,
+          status,
+          retryable: false
+        };
+      }
+      if (errorMessage && errorMessage !== defaultMessage) {
+        return {
+          kind: "generic",
+          message: `\u8BF7\u6C42\u53C2\u6570\u9519\u8BEF: ${truncateErrorMessage(errorMessage)}`,
+          code,
+          status,
+          retryable: false
+        };
+      }
+      return { kind: "generic", message: "\u8BF7\u6C42\u53C2\u6570\u9519\u8BEF\uFF0C\u8BF7\u68C0\u67E5\u8F93\u5165", code, status, retryable: false };
+    case 413:
+      return {
+        kind: "context_too_large",
+        message: "\u8BF7\u6C42\u5185\u5BB9\u8FC7\u5927\uFF1A\u8BF7\u51CF\u5C11\u4E00\u6B21\u53D1\u9001\u7684\u6D88\u606F\u3001\u6587\u4EF6\u6216\u5DE5\u5177\u7ED3\u679C\u3002",
+        code,
+        status,
+        retryable: true,
+        actions: [...CONTEXT_TOO_LARGE_ACTIONS]
+      };
+    case 401:
+      return {
+        kind: "auth",
+        message: code === "AUTH_TOKEN_EXPIRED" ? "\u767B\u5F55\u72B6\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55" : code === "AUTH_ACCOUNT_INVALID" ? "\u8D26\u6237\u65E0\u6548\u6216\u5DF2\u88AB\u505C\u7528\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458" : code === "AUTH_NO_TOKEN" ? "\u672A\u68C0\u6D4B\u5230\u767B\u5F55\u72B6\u6001\uFF0C\u8BF7\u5148\u767B\u5F55" : code === "AUTH_INVALID_TOKEN" ? "\u767B\u5F55\u51ED\u8BC1\u65E0\u6548\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55" : code === "AUTH_TOKEN_NOT_ACTIVE" ? "\u4EE4\u724C\u5C1A\u672A\u751F\u6548\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5" : errorMessage && errorMessage !== `\u72B6\u6001\u7801 401 Unauthorized` ? `\u8BA4\u8BC1\u9519\u8BEF: ${truncateErrorMessage(errorMessage)}` : "\u8EAB\u4EFD\u9A8C\u8BC1\u5931\u8D25\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    case 503:
+      return {
+        kind: "server",
+        message: errorMessage && errorMessage !== `\u72B6\u6001\u7801 503 Service Unavailable` ? truncateErrorMessage(errorMessage) : "\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    case 504:
+      return {
+        kind: "timeout",
+        message: "\u8BF7\u6C42\u8D85\u65F6\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    default:
+      return {
+        kind: "generic",
+        message: `API\u8BF7\u6C42\u5931\u8D25: ${truncateErrorMessage(errorMessage)}`,
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+  }
+}
+async function parseApiErrorInfo(response) {
+  const errorBody = await response.text();
+  let errorMessage = `\u72B6\u6001\u7801 ${response.status} ${response.statusText}`;
+  let errorCode = `E${response.status}`;
+  try {
+    const errorJson = JSON.parse(errorBody);
+    errorMessage = errorJson?.error?.message || errorJson?.message || errorJson?.msg || errorBody || errorMessage;
+    errorCode = errorJson?.error?.code || errorJson?.code || errorCode;
+  } catch (_e) {
+    if (errorBody) {
+      errorMessage = errorBody;
+    }
+  }
+  return classifyApiError({
+    status: response.status,
+    statusText: response.statusText,
+    message: errorMessage,
+    body: errorBody,
+    code: errorCode
+  });
+}
+async function parseApiError(response) {
+  return (await parseApiErrorInfo(response)).message;
+}
+
+export {
+  CONTEXT_OVERFLOW_ACTIONS,
+  CONTEXT_TOO_LARGE_ACTIONS,
+  isContextOverflowText,
+  parseApiError
+};

package/{chunk-YNI45YOE.js → chunk-P4U2QMT5.js}

@@ -7,7 +7,7 @@ import {
 import {
   clipMultilineText,
   fetchAndSerializeTable
-} from "./chunk-MOH3ETXO.js";
+} from "./chunk-GA77XY7N.js";
 import {
   isGatewayHttpStatus
 } from "./chunk-NF64D32W.js";
@@ -17,37 +17,40 @@ import {
   normalizeNonNegativeMs,
   parseRetryAfterHeaderMs
 } from "./chunk-3L2WKC3W.js";
-import {
-  slateToSimplifiedMarkdown
-} from "./chunk-HNUNYXYB.js";
 import {
   waitForAbortableDelay
 } from "./chunk-N4G4PKQ6.js";
+import {
+  resolvePageReadMarkdown,
+  slateToSimplifiedMarkdown
+} from "./chunk-BJUDYFV5.js";
 import {
   extractCategorizedMentions
 } from "./chunk-MEYIRKDN.js";
 import {
   fetchAndCacheMessages
-} from "./chunk-NNJ4EAEH.js";
+} from "./chunk-6PPDYAMH.js";
 import {
   shouldUseServerProxy
 } from "./chunk-YYLHWIW6.js";
 import {
   fetchServerSyncedCredential
-} from "./chunk-YC2MP5NP.js";
+} from "./chunk-Q3SKC2TQ.js";
 import {
   buildSkillGuidancePromptBlock,
   extractRuntimePageCapabilities,
   resolveBuiltinSkillPage,
   resolveSkillGraphFromRoots
-} from "./chunk-VUHXTHIK.js";
+} from "./chunk-V2AB7ULS.js";
 import {
+  DELETE_SAFETY_RED_LINE,
   buildIdentityBlock,
   buildRuntimeGuidanceBlocks,
   compileContextLayers,
+  detectDispatchIntentFromMessages,
   normalizeChatCompletionsBodyForProvider,
   resolveToolGuidedSections
-} from "./chunk-FEAPBZQW.js";
+} from "./chunk-QL32RJFG.js";
 import {
   convertMessagesToResponsesInput,
   getUsageRequestOptions,
@@ -57,29 +60,32 @@ import {
 import {
   ANTIGRAVITY_CLOUD_CODE_BASE_URL,
   isAntigravityOAuthAgent
-} from "./chunk-ZKYHTHNE.js";
+} from "./chunk-S5XGT6GB.js";
 import {
   buildProviderAuthHeaders
-} from "./chunk-UYJKSCJ4.js";
+} from "./chunk-27ONFIEY.js";
 import {
   estimateTokenCount
 } from "./chunk-PSCNXBYA.js";
+import {
+  createFileCredentialBroker
+} from "./chunk-ESRMFY7G.js";
 import {
   isOpenAiResponsesModel,
   resolvePlatformChatCompletionsEndpoint,
   resolvePlatformResponsesEndpoint
-} from "./chunk-I2MX6JST.js";
+} from "./chunk-7KVZ5LDQ.js";
+import {
+  toErrorMessage
+} from "./chunk-HNMXYYJR.js";
 import {
   clampReasoningEffort,
   getModelConfig,
   isModelSupportReasoningEffort
-} from "./chunk-QTV7ZYBE.js";
-import {
-  createFileCredentialBroker
-} from "./chunk-HVURBGF3.js";
+} from "./chunk-3BXNTXYI.js";
 import {
-  toErrorMessage
-} from "./chunk-HNMXYYJR.js";
+  createSpaceKey
+} from "./chunk-UAD2WT54.js";
 import {
   MEMORY_USE_GUIDANCE,
   buildUserResponseLanguageContext,
@@ -87,34 +93,31 @@ import {
 } from "./chunk-2GRGFCF6.js";
 import {
   canonicalizeToolNames
-} from "./chunk-O6OSWFZQ.js";
+} from "./chunk-XUWRURDF.js";
 import {
   isDeepInfraKimiModel,
   isFireworksKimiModel,
   isPlatformMimoProviderModel,
   resolveFireworksKimiModel
-} from "./chunk-Q67DOFOO.js";
-import {
-  createSpaceKey
-} from "./chunk-UAD2WT54.js";
+} from "./chunk-Y3PMXGLH.js";
 import {
   read
-} from "./chunk-YNNVVLMV.js";
+} from "./chunk-QALRKMHF.js";
 import {
   asTrimmedLowercaseString
 } from "./chunk-QSJ3HFEF.js";
-import {
-  extractCustomId
-} from "./chunk-GII32WZW.js";
 import {
   getRuntimeServerContext
-} from "./chunk-UKWGR5SS.js";
+} from "./chunk-AUXHZ2M5.js";
 import {
   isAbortError
 } from "./chunk-QOKAKDPE.js";
 import {
   isRecord
 } from "./chunk-KUG52IAP.js";
+import {
+  extractCustomId
+} from "./chunk-M2EJHDJP.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -619,7 +622,9 @@ var buildSystemPromptContext = (options) => {
 ${mainPrompt}` : "";
   const agentTools = canonicalizeToolNames(agentConfig.tools ?? []);
   const hasAskTool = agentTools.includes("ask_user");
-  const toolSections = resolveToolGuidedSections(agentTools);
+  const toolSections = resolveToolGuidedSections(agentTools, {
+    dispatchIntent: options.dispatchIntent === true
+  });
   const {
     startupProtocol,
     contextLayerContract,
@@ -645,6 +650,14 @@ ${contexts.userGlobalPrompt.trim()} ` : "";
   const dialogSummarySection = contexts.dialogSummary?.trim() ? `--- \u5386\u53F2\u5BF9\u8BDD\u6458\u8981 ---
 ${wrapHistoricalSummaryWithReplayGuard(contexts.dialogSummary)}` : "";
   return compileContextLayers([
+    // 删除安全红线：系统层最高优先级约束，位于所有层之前（含身份信息），
+    // owner 要求常驻「根本提示词」的最顶部（2026-09-26 批量误删事故）。
+    {
+      id: "delete-safety-red-line",
+      owner: "platform",
+      cacheScope: "static",
+      content: DELETE_SAFETY_RED_LINE
+    },
     { id: "identity", owner: "platform", cacheScope: "session", content: identitySection },
     { id: "user-response-language", owner: "platform", cacheScope: "session", content: buildUserResponseLanguageContext({ language: safeLanguage }) },
     { id: "startup-protocol", owner: "platform", cacheScope: "static", content: startupProtocol },
@@ -652,6 +665,7 @@ ${wrapHistoricalSummaryWithReplayGuard(contexts.dialogSummary)}` : "";
     { id: "tool-round-economy", owner: "platform", cacheScope: "session", content: toolSections.toolRoundEconomy },
     { id: "tool-use-guidance", owner: "platform", cacheScope: "session", content: toolSections.toolUseGuidance },
     { id: "privilege-escalation", owner: "platform", cacheScope: "session", content: toolSections.privilegeEscalation },
+    { id: "shell-task-lifecycle", owner: "platform", cacheScope: "session", content: toolSections.shellTaskLifecycle },
     { id: "agent-orchestration", owner: "platform", cacheScope: "session", content: toolSections.agentOrchestration },
     { id: "agent-collaboration", owner: "platform", cacheScope: "session", content: toolSections.agentCollaboration },
     { id: "web-access", owner: "platform", cacheScope: "session", content: toolSections.webAccess },
@@ -699,8 +713,9 @@ var applyClaudeCache = (stableContent, dynamicContent) => {
 var prependPromptMessage = (messages, agentConfig, resolvedModel, language, contexts, prependSystemPrompt = true) => {
   if (!prependSystemPrompt) return messages;
   if (!contexts && !agentConfig.prompt) return messages;
+  const dispatchIntent = detectDispatchIntentFromMessages(messages);
   if (isClaudeModel(resolvedModel)) {
-    const compiled = buildSystemPromptContext({ agentConfig, language, contexts });
+    const compiled = buildSystemPromptContext({ agentConfig, language, contexts, dispatchIntent });
     if (!compiled.content.trim()) return messages;
     const content = applyClaudeCache(
       compiled.stablePrefixContent,
@@ -709,7 +724,7 @@ var prependPromptMessage = (messages, agentConfig, resolvedModel, language, cont
     const systemMessage2 = { role: "system", content };
     return [systemMessage2, ...messages];
   }
-  const promptContent = buildSystemPrompt({ agentConfig, language, contexts });
+  const promptContent = buildSystemPrompt({ agentConfig, language, contexts, dispatchIntent });
   if (!promptContent.trim()) return messages;
   const systemMessage = { role: "system", content: promptContent };
   return [systemMessage, ...messages];
@@ -772,8 +787,13 @@ var buildRequestBody = (options) => {
     endpoint: customProviderUrl
   });
   Object.assign(bodyData, usageRequestOptions);
-  if (reasoning_effort && isModelSupportReasoningEffort(model)) {
-    const clamped = clampReasoningEffort(reasoning_effort, providerName);
+  const effectiveProviderForReasoning = providerName?.toLowerCase() === "openrouter" || customProviderUrl?.toLowerCase().includes("openrouter.ai") ? "openrouter" : providerName;
+  if (reasoning_effort && isModelSupportReasoningEffort(model, effectiveProviderForReasoning)) {
+    const clamped = clampReasoningEffort(
+      reasoning_effort,
+      effectiveProviderForReasoning,
+      model
+    );
     if (clamped) {
       bodyData.reasoning_effort = clamped;
     }
@@ -892,7 +912,9 @@ function generateResponseRequestBody(agentConfig, msgs, contexts, prependSystemP
     const promptContent = buildSystemPrompt({
       agentConfig,
       language,
-      contexts
+      contexts,
+      // 按当前用户输入检测派发意图：无意图只注入最小派发协议（安全硬门常在）。
+      dispatchIntent: detectDispatchIntentFromMessages(msgs)
     });
     body.instructions = promptContent;
   }
@@ -1202,7 +1224,7 @@ var buildProxyPayload = (bodyData, api, agentConfig, dialogId) => {
   };
 };
 var fetchDirectly = async (params) => {
-  const { api, agentConfig, bodyData, signal, currentServer, token } = params;
+  const { api, agentConfig, bodyData, signal, currentServer, token, dialogId } = params;
   try {
     const apiKey = await resolveDirectRequestApiKey(agentConfig, {
       syncFetcher: currentServer && token ? (ref) => fetchServerSyncedCredential({ currentServer, authToken: token }, ref) : void 0,
@@ -1222,7 +1244,8 @@ var fetchDirectly = async (params) => {
     const authHeaders = buildProviderAuthHeaders({
       endpoint: api,
       apiKey: apiKey ?? "",
-      apiKeyHeader: agentConfig.apiKeyHeader
+      apiKeyHeader: agentConfig.apiKeyHeader,
+      sessionId: dialogId || agentConfig.dbKey || agentConfig.key
     });
     return await fetch(api, {
       method: "POST",
@@ -1788,12 +1811,17 @@ ${tableMd}
 `;
 };
 var fetchSlateReference = async (dbKey, refContent, dispatch, options) => {
-  if (!refContent?.slateData) return null;
+  const hasSlate = Array.isArray(refContent?.slateData) && refContent.slateData.length > 0;
+  const legacyContent = hasSlate ? null : resolvePageReadMarkdown(refContent).trim() || null;
+  if (!hasSlate && !legacyContent) return null;
   const title = refContent.title || `Untitled (${dbKey})`;
   let contentString;
   let contentType;
   const inlineMentionMeta = options.inlineMentionMeta ?? options.format === "simplified_markdown";
-  switch (options.format) {
+  if (legacyContent) {
+    contentType = "Markdown (legacy content)";
+    contentString = legacyContent;
+  } else switch (options.format) {
     case "text":
       contentType = "Plain Text";
       contentString = slateToText(refContent.slateData);