nolo-cli 0.97.0-alpha.1 → 0.97.0

package/{chunk-53HEEOTT.js → chunk-O26PCYLS.js}

@@ -11,13 +11,13 @@ import {
   getAntigravityUserAgent,
   normalizeAntigravityTokenPayload,
   refreshAntigravityToken
-} from "./chunk-UZGQNTVW.js";
-import {
-  writeOAuthCredential
-} from "./chunk-ONXOABJR.js";
+} from "./chunk-S5XGT6GB.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
+import {
+  writeOAuthCredential
+} from "./chunk-HNGRBWYF.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
@@ -367,6 +367,77 @@ async function refreshAntigravityOAuthToken(credential, deps = {}) {
 // packages/cli/oauth/flows/openai-codex.ts
 import { createHash as createHash2 } from "node:crypto";
 
+// packages/agent-runtime/oauthRefreshError.ts
+var PERMANENT_REFRESH_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  // OpenAI 令牌端点对失效/不存在的 refresh token 返回 401
+  // {"error":{"code":"invalid_refresh_token",...}}（2026-10-01 用必然无效的
+  // token 实测）。线上 chatgpt 凭据正是因为没认出它，被当成临时的
+  // "unauthorized"、每 15 分钟重试一次且永远不提示重新授权。
+  "invalid_refresh_token",
+  "refresh_token_reused",
+  "invalid_client"
+]);
+var SAFE_MESSAGES = {
+  invalid_grant: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_refresh_token: "refresh token \u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  refresh_token_reused: "refresh token \u5DF2\u88AB\u5176\u4ED6\u526F\u672C\u4F7F\u7528\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  invalid_client: "OAuth \u5BA2\u6237\u7AEF\u88AB\u62D2\u7EDD\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743",
+  unauthorized: "\u4E0A\u6E38\u62D2\u7EDD\u4E86\u5237\u65B0\u8BF7\u6C42\uFF08401/403\uFF09",
+  rate_limited: "\u4E0A\u6E38\u9650\u6D41\uFF0C\u7A0D\u540E\u91CD\u8BD5",
+  http_5xx: "\u4E0A\u6E38\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528",
+  network: "\u65E0\u6CD5\u8FDE\u63A5\u4E0A\u6E38",
+  bad_response: "\u4E0A\u6E38\u8FD4\u56DE\u4E86\u65E0\u6CD5\u8BC6\u522B\u7684\u54CD\u5E94",
+  unknown: "\u5237\u65B0\u5931\u8D25"
+};
+var OAuthRefreshError = class extends Error {
+  code;
+  status;
+  retryAfterMs;
+  constructor(code, opts = {}) {
+    super(SAFE_MESSAGES[code]);
+    this.name = "OAuthRefreshError";
+    this.code = code;
+    if (opts.status !== void 0) this.status = opts.status;
+    if (opts.retryAfterMs !== void 0) this.retryAfterMs = opts.retryAfterMs;
+  }
+  get permanent() {
+    return PERMANENT_REFRESH_CODES.has(this.code);
+  }
+};
+function readErrorCode(payload) {
+  if (!payload || typeof payload !== "object") return void 0;
+  const err = payload.error;
+  if (typeof err === "string") return err;
+  if (err && typeof err === "object") {
+    const code = err.code;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+function classifyOAuthRefreshHttpFailure(status, payload, headers) {
+  const raw = readErrorCode(payload)?.toLowerCase();
+  if (raw === "invalid_grant") return new OAuthRefreshError("invalid_grant", { status });
+  if (raw === "invalid_refresh_token") {
+    return new OAuthRefreshError("invalid_refresh_token", { status });
+  }
+  if (raw === "refresh_token_reused") {
+    return new OAuthRefreshError("refresh_token_reused", { status });
+  }
+  if (raw === "invalid_client") return new OAuthRefreshError("invalid_client", { status });
+  if (status === 429) {
+    const seconds = Number(headers?.get("retry-after"));
+    return new OAuthRefreshError("rate_limited", {
+      status,
+      ...Number.isFinite(seconds) && seconds > 0 ? { retryAfterMs: seconds * 1e3 } : {}
+    });
+  }
+  if (status === 401 || status === 403) return new OAuthRefreshError("unauthorized", { status });
+  if (status >= 500) return new OAuthRefreshError("http_5xx", { status });
+  return new OAuthRefreshError("unknown", { status });
+}
+var TRANSIENT_MAX_MS = 15 * 6e4;
+
 // packages/agent-runtime/openaiCodexOAuth.ts
 var OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var OPENAI_CODEX_SCOPES = [
@@ -463,17 +534,14 @@ async function refreshOpenAiCodexToken(credential, deps = {}) {
       signal: AbortSignal.timeout(OPENAI_CODEX_TOKEN_REQUEST_TIMEOUT_MS)
     });
   } catch (error) {
-    throw new Error(
-      `OpenAI Codex token refresh failed: ${toErrorMessage(error)}`
-    );
+    throw new OAuthRefreshError("network");
   }
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" && payload.error_description ? payload.error_description : typeof payload.error === "string" && payload.error ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`OpenAI Codex token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("OpenAI Codex token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeOpenAiCodexTokenPayload({
@@ -1047,11 +1115,10 @@ async function refreshAnthropicToken(credential, deps = {}) {
   });
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) {
-    const detail = typeof payload.error_description === "string" ? payload.error_description : typeof payload.error === "string" ? payload.error : `HTTP ${response.status}`;
-    throw new Error(`Claude token refresh failed: ${detail}`);
+    throw classifyOAuthRefreshHttpFailure(response.status, payload, response.headers);
   }
   if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
-    throw new Error("Claude token refresh response missing access_token");
+    throw new OAuthRefreshError("bad_response");
   }
   const now = deps.now?.() ?? Date.now();
   return normalizeAnthropicTokenPayload({

package/{chunk-3DII57IT.js → chunk-O2OWEFII.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_AGENT_BASE_POLICY,
   DEFAULT_USER_PREFERENCE_PROFILE
-} from "./chunk-AFUORTY4.js";
+} from "./chunk-SONWNI3L.js";
 
 // packages/ai/policy/runtimePolicy.ts
 var clampLevel = (value, fallback) => {

package/{chunk-TDRTS7QW.js → chunk-O6JPWEEK.js}

@@ -1,17 +1,15 @@
 import {
   listUserRecordsFromServers,
   readLiveDbRecordAfterTombstoneMerge
-} from "./chunk-BLJWCTRL.js";
+} from "./chunk-AOPCEXTB.js";
 import {
   agentRecordHasConfiguredCredential
-} from "./chunk-76WEAXJB.js";
+} from "./chunk-SACTCJAC.js";
 import {
-  deriveCredentialGroup,
-  toSafeAgentSummary
-} from "./chunk-RG6JBBX5.js";
+  deriveCredentialGroup
+} from "./chunk-AWF3WO5R.js";
 import {
   PUBLIC_AGENT_KEY_PREFIX,
-  isOwnedAgentKey,
   ownedAgentKey,
   ownedAgentKeyPrefix,
   parseOwnedAgentId,
@@ -53,6 +51,9 @@ function normalizeListedAgent(record) {
     ...typeof record?.handle === "string" && record.handle ? { handle: record.handle } : {},
     ...typeof record?.introduction === "string" && record.introduction ? { introduction: record.introduction } : typeof record?.description === "string" && record.description ? { introduction: record.description } : {},
     ...typeof record?.provider === "string" && record.provider ? { provider: record.provider } : {},
+    // 仅供 resolveBillingSource 判定订阅端点（Step Plan / OpenCode Go 等），
+    // safe 投影不输出它。缺了它本地 agent list 会把订阅端点全报成 user_api。
+    ...typeof record?.customProviderUrl === "string" && record.customProviderUrl ? { customProviderUrl: record.customProviderUrl } : {},
     ...typeof record?.inputPrice === "number" && Number.isFinite(record.inputPrice) ? { inputPrice: record.inputPrice } : {},
     ...typeof record?.outputPrice === "number" && Number.isFinite(record.outputPrice) ? { outputPrice: record.outputPrice } : {},
     updatedAt: typeof record?.updatedAt === "string" || typeof record?.updatedAt === "number" ? record.updatedAt : typeof record?.createdAt === "string" || typeof record?.createdAt === "number" ? record.createdAt : typeof record?.created === "string" || typeof record?.created === "number" ? record.created : null,
@@ -67,16 +68,10 @@ function normalizeListedAgent(record) {
     ...credentialKind !== void 0 ? { credentialKind } : {},
     ...typeof record?.apiSource === "string" && record.apiSource ? { apiSource: record.apiSource } : {},
     ...typeof record?.cliProvider === "string" && record.cliProvider ? { cliProvider: record.cliProvider } : {},
-    ...typeof record?.nextAvailableAt === "number" && Number.isFinite(record.nextAvailableAt) ? { nextAvailableAt: record.nextAvailableAt } : {}
+    ...typeof record?.nextAvailableAt === "number" && Number.isFinite(record.nextAvailableAt) ? { nextAvailableAt: record.nextAvailableAt } : {},
+    ...record?.quota && typeof record.quota === "object" && Array.isArray(record.quota.windows) ? { quota: record.quota } : {}
   };
 }
-function toSafeListedAgentSummary(agent, options) {
-  const summary = toSafeAgentSummary(agent, options);
-  if (agent.publicRecordExists === false) {
-    delete summary.publicKey;
-  }
-  return summary;
-}
 function sortListedAgents(agents) {
   agents.sort((a, b) => {
     const ta = a.updatedAt == null ? 0 : new Date(a.updatedAt).getTime();
@@ -97,6 +92,7 @@ function parseAgentListArgs(args) {
     publicOnly: args.includes("--public-only"),
     idsOnly: args.includes("--ids-only"),
     scope: readArgValue(args, "--scope"),
+    query: readArgValue(args, "--query"),
     showUnavailable: args.includes("--show-unavailable"),
     // --safe 默认输出精简投影（与 server listAgents 一致，防大列表被截断）；
     // --verbose 拿回完整字段集排障。
@@ -110,7 +106,7 @@ async function listLocalCachedAgents(args) {
   for (const prefix of [ownedPrefix, PUBLIC_AGENT_KEY_PREFIX]) {
     for await (const [key, value] of args.db.iterator({ gte: prefix, lte: `${prefix}\uFFFF` })) {
       if (typeof key !== "string" || !value || typeof value !== "object") continue;
-      if (isOwnedAgentKey(key, args.userId)) {
+      if (key.startsWith(ownedPrefix)) {
         privateRecords.set(key, { ...value, dbKey: key });
         continue;
       }
@@ -237,14 +233,78 @@ async function decorateAgentsWithPublicStatusAcrossServers(args) {
   return args.agents;
 }
 
+// packages/ai/agent/quotaSnapshot.ts
+function findTightestQuotaWindow(quota, now = Date.now()) {
+  if (!quota || !Array.isArray(quota.windows) || quota.windows.length === 0) {
+    return void 0;
+  }
+  let best;
+  let bestScore = -Infinity;
+  for (const w of quota.windows) {
+    let score = 0;
+    if (typeof w.utilization === "number" && w.utilization >= 0) {
+      score = 500 + Math.min(w.utilization, 1) * 500;
+    } else if (typeof w.remaining === "number" && typeof w.limit === "number" && w.limit > 0) {
+      const util = Math.max(0, 1 - w.remaining / w.limit);
+      score = 500 + util * 500;
+    } else if (typeof w.resetAt === "number" && w.resetAt > now) {
+      score = 200;
+    } else if (typeof w.remaining === "number") {
+      score = 100;
+    }
+    if (score > bestScore) {
+      bestScore = score;
+      best = w;
+    }
+  }
+  return best ?? quota.windows[0];
+}
+function formatQuotaSummary(quota, now = Date.now(), options) {
+  const tightest = findTightestQuotaWindow(quota, now);
+  if (!tightest) return void 0;
+  const compact = options?.compact === true;
+  const parts = [];
+  if (typeof tightest.utilization === "number") {
+    const pct = Math.round(tightest.utilization * 100);
+    parts.push(`${pct}%\u5DF2\u7528`);
+  } else if (typeof tightest.remaining === "number") {
+    if (typeof tightest.limit === "number") {
+      parts.push(`${tightest.remaining}/${tightest.limit}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    } else {
+      parts.push(`\u4F59${tightest.remaining}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    }
+  }
+  if (compact) return parts.length > 0 ? parts[0] : void 0;
+  if (tightest.scope && tightest.scope !== "user" && tightest.scope !== "project" && tightest.scope !== tightest.unit) {
+    parts.push(tightest.scope);
+  }
+  if (typeof tightest.resetAt === "number" && tightest.resetAt > now) {
+    const diffSec = Math.round((tightest.resetAt - now) / 1e3);
+    if (diffSec < 60) {
+      parts.push(`${diffSec}s\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 3600) {
+      parts.push(`${Math.round(diffSec / 60)}m\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 86400) {
+      const hours = (diffSec / 3600).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${hours}h\u540E\u91CD\u7F6E`);
+    } else {
+      const days = (diffSec / 86400).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${days}d\u540E\u91CD\u7F6E`);
+    }
+  }
+  if (parts.length === 0) return void 0;
+  if (parts.length === 1 && parts[0] === tightest.scope) return void 0;
+  return parts.join(" \xB7 ");
+}
+
 export {
   normalizeListedAgent,
-  toSafeListedAgentSummary,
   parseAgentListArgs,
   listLocalCachedAgents,
   listRemotePublicAgents,
   listRemoteAgents,
   listRemoteAgentsAcrossServers,
   listFavoriteAgentIdsAcrossServers,
-  decorateAgentsWithPublicStatusAcrossServers
+  decorateAgentsWithPublicStatusAcrossServers,
+  formatQuotaSummary
 };

package/chunk-OCZKATRC.js

@@ -0,0 +1,129 @@
+// packages/ai/chat/parseApiError.ts
+var CONTEXT_OVERFLOW_ACTIONS = [
+  "compact-and-retry",
+  "new-dialog",
+  "switch-model",
+  "retry"
+];
+var CONTEXT_TOO_LARGE_ACTIONS = [
+  "new-dialog",
+  "switch-model",
+  "retry"
+];
+var truncateErrorMessage = (message, maxChars = 320) => message.length <= maxChars ? message : `${message.slice(0, maxChars)}\u2026`;
+var isContextOverflowText = (message) => /maximum context|context (length|window|overflow|limit)|context_length_exceed\w*|requested about .*tokens|too many tokens|prompt is too long|exceeds? (the )?(model|max)/i.test(
+  message
+);
+function classifyApiError(input) {
+  const { status, message, body, code } = input;
+  const errorMessage = message;
+  let defaultMessage = `\u72B6\u6001\u7801 ${status} ${input.statusText ?? ""}`;
+  switch (status) {
+    case 400:
+      if (isContextOverflowText(errorMessage) || isContextOverflowText(body) || code === "UPSTREAM_400") {
+        return {
+          kind: "context_overflow",
+          message: "\u4E0A\u4E0B\u6587\u8FC7\u957F\uFF1A\u672C\u8F6E\u6D88\u606F\u6216\u5DE5\u5177\u7ED3\u679C\u592A\u5927\u3002\u8BF7\u7F29\u5C0F\u8303\u56F4\uFF0C\u6216\u5148\u8BFB\u53D6\u66F4\u5C0F\u7247\u6BB5\u540E\u518D\u7EE7\u7EED\u3002",
+          code,
+          status,
+          retryable: true,
+          actions: [...CONTEXT_OVERFLOW_ACTIONS]
+        };
+      }
+      if (code === "MISSING_PROVIDER_API_KEY") {
+        return {
+          kind: "generic",
+          message: truncateErrorMessage(errorMessage),
+          code,
+          status,
+          retryable: false
+        };
+      }
+      if (errorMessage && errorMessage !== defaultMessage) {
+        return {
+          kind: "generic",
+          message: `\u8BF7\u6C42\u53C2\u6570\u9519\u8BEF: ${truncateErrorMessage(errorMessage)}`,
+          code,
+          status,
+          retryable: false
+        };
+      }
+      return { kind: "generic", message: "\u8BF7\u6C42\u53C2\u6570\u9519\u8BEF\uFF0C\u8BF7\u68C0\u67E5\u8F93\u5165", code, status, retryable: false };
+    case 413:
+      return {
+        kind: "context_too_large",
+        message: "\u8BF7\u6C42\u5185\u5BB9\u8FC7\u5927\uFF1A\u8BF7\u51CF\u5C11\u4E00\u6B21\u53D1\u9001\u7684\u6D88\u606F\u3001\u6587\u4EF6\u6216\u5DE5\u5177\u7ED3\u679C\u3002",
+        code,
+        status,
+        retryable: true,
+        actions: [...CONTEXT_TOO_LARGE_ACTIONS]
+      };
+    case 401:
+      return {
+        kind: "auth",
+        message: code === "AUTH_TOKEN_EXPIRED" ? "\u767B\u5F55\u72B6\u6001\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55" : code === "AUTH_ACCOUNT_INVALID" ? "\u8D26\u6237\u65E0\u6548\u6216\u5DF2\u88AB\u505C\u7528\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458" : code === "AUTH_NO_TOKEN" ? "\u672A\u68C0\u6D4B\u5230\u767B\u5F55\u72B6\u6001\uFF0C\u8BF7\u5148\u767B\u5F55" : code === "AUTH_INVALID_TOKEN" ? "\u767B\u5F55\u51ED\u8BC1\u65E0\u6548\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55" : code === "AUTH_TOKEN_NOT_ACTIVE" ? "\u4EE4\u724C\u5C1A\u672A\u751F\u6548\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5" : errorMessage && errorMessage !== `\u72B6\u6001\u7801 401 Unauthorized` ? `\u8BA4\u8BC1\u9519\u8BEF: ${truncateErrorMessage(errorMessage)}` : "\u8EAB\u4EFD\u9A8C\u8BC1\u5931\u8D25\uFF0C\u8BF7\u5148\u767B\u51FA\u540E\u91CD\u65B0\u767B\u5F55",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    case 503:
+      return {
+        kind: "server",
+        message: errorMessage && errorMessage !== `\u72B6\u6001\u7801 503 Service Unavailable` ? truncateErrorMessage(errorMessage) : "\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    case 504:
+      return {
+        kind: "timeout",
+        message: "\u8BF7\u6C42\u8D85\u65F6\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+    default:
+      return {
+        kind: "generic",
+        message: `API\u8BF7\u6C42\u5931\u8D25: ${truncateErrorMessage(errorMessage)}`,
+        code,
+        status,
+        retryable: true,
+        actions: ["retry"]
+      };
+  }
+}
+async function parseApiErrorInfo(response) {
+  const errorBody = await response.text();
+  let errorMessage = `\u72B6\u6001\u7801 ${response.status} ${response.statusText}`;
+  let errorCode = `E${response.status}`;
+  try {
+    const errorJson = JSON.parse(errorBody);
+    errorMessage = errorJson?.error?.message || errorJson?.message || errorJson?.msg || errorBody || errorMessage;
+    errorCode = errorJson?.error?.code || errorJson?.code || errorCode;
+  } catch (_e) {
+    if (errorBody) {
+      errorMessage = errorBody;
+    }
+  }
+  return classifyApiError({
+    status: response.status,
+    statusText: response.statusText,
+    message: errorMessage,
+    body: errorBody,
+    code: errorCode
+  });
+}
+async function parseApiError(response) {
+  return (await parseApiErrorInfo(response)).message;
+}
+
+export {
+  CONTEXT_OVERFLOW_ACTIONS,
+  CONTEXT_TOO_LARGE_ACTIONS,
+  isContextOverflowText,
+  parseApiError
+};

package/{chunk-6D6VBVEW.js → chunk-OTEMQQZI.js}

@@ -1,9 +1,19 @@
+import {
+  _appendRetiredStateBatch,
+  loadMemoryVNextCatalog
+} from "./chunk-TY3TIUJK.js";
 import {
   resolveMachineId
 } from "./chunk-ESHYE7WU.js";
 import {
   getDefaultCliLocalRuntimeDb
-} from "./chunk-2F7RJC6L.js";
+} from "./chunk-ZOVKKMF6.js";
+import {
+  resolveAuthTokenFromEnv
+} from "./chunk-A7GB5UGH.js";
+import {
+  DEFAULT_NOLO_SERVER_URL
+} from "./chunk-OLZBQWZU.js";
 import {
   buildCliRuntimeEnv,
   clearProfileAuthToken,
@@ -12,20 +22,14 @@ import {
   getProfileTokens,
   loadProfileConfig,
   saveDefaultProfile
-} from "./chunk-BYMV6QZG.js";
-import {
-  resolveAuthTokenFromEnv
-} from "./chunk-A7GB5UGH.js";
-import {
-  DEFAULT_NOLO_SERVER_URL
-} from "./chunk-OLZBQWZU.js";
+} from "./chunk-TNIX77YM.js";
 import {
   asTrimmedNonEmptyStringArray,
   createMemoryKey,
   createMemoryOwnerIndexKey,
   createMemorySubjectKindIndexKey,
   memoryOwnerRange
-} from "./chunk-VMFTFOWF.js";
+} from "./chunk-3AH7LNUB.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -39,6 +43,29 @@ import { stdin as input, stdout as output } from "node:process";
 import { spawn } from "node:child_process";
 
 // packages/ai/memory/delete.ts
+var VNEXT_STATE_ID_PREFIX = "vnext-state-";
+var toVNextMemoryItem = (state, owner) => ({
+  id: `${VNEXT_STATE_ID_PREFIX}${state.id}`,
+  ownerType: owner.ownerType,
+  ownerId: owner.ownerId,
+  visibility: "private",
+  subjectType: "user",
+  subjectId: owner.ownerId,
+  kind: "semantic",
+  content: state.text.trim(),
+  createdAt: state.createdAt,
+  lastActivatedAt: state.createdAt,
+  activationCount: 1,
+  importance: 0.9,
+  confidence: 0.9,
+  resident: state.facet === "preference" || state.facet === "style"
+});
+var matchesVNextFilters = (state, idSet, contentSub) => {
+  if (!idSet && !contentSub) return false;
+  if (idSet && !idSet.has(`${VNEXT_STATE_ID_PREFIX}${state.id}`)) return false;
+  if (contentSub && !state.text.toLowerCase().includes(contentSub)) return false;
+  return true;
+};
 function hasExplicitDeleteFilters(filters) {
   return Boolean(
     filters.ids && filters.ids.length > 0 || typeof filters.contentSubstring === "string" && filters.contentSubstring.trim().length > 0 || filters.tags && filters.tags.length > 0 || typeof filters.sourceDialogId === "string" && filters.sourceDialogId.trim().length > 0 || typeof filters.patternKeyPrefix === "string" && filters.patternKeyPrefix.trim().length > 0 || filters.facets && filters.facets.length > 0 || typeof filters.subjectId === "string" && filters.subjectId.trim().length > 0
@@ -127,8 +154,32 @@ var deleteMemoriesForOwnerFromDb = async (db, owner, filters = {}) => {
     matchedItems.push(item);
     if (matchedItems.length >= limit) break;
   }
+  const idSet = normalizeSet(filters.ids);
+  const contentSub = asTrimmedString(filters.contentSubstring).toLowerCase();
+  const vnextStateIdsToRetire = [];
+  const vnextStatesToRetire = [];
+  const vnextMatchedItems = [];
+  let vnextPrincipalId = null;
+  const hasScopingFilters = Boolean(
+    normalizeSet(filters.kinds) || normalizeSet(filters.facets) || normalizeSet(filters.tags) || asTrimmedString(filters.subjectType) || asTrimmedString(filters.subjectId) || asTrimmedString(filters.patternKeyPrefix) || asTrimmedString(filters.sourceDialogId)
+  );
+  const canMatchVNext = !hasScopingFilters && (contentSub.length > 0 || idSet !== null && [...idSet].some((id) => id.startsWith(VNEXT_STATE_ID_PREFIX)));
+  if (canMatchVNext) {
+    vnextPrincipalId = `${owner.ownerType}:${encodeURIComponent(owner.ownerId)}`;
+    const catalog = await loadMemoryVNextCatalog(db, vnextPrincipalId);
+    for (const state of catalog.states) {
+      if (matchedItems.length >= limit) break;
+      if (state.retiredAt) continue;
+      if (!matchesVNextFilters(state, idSet, contentSub)) continue;
+      vnextStateIdsToRetire.push(state.id);
+      vnextStatesToRetire.push(state);
+      const projected = toVNextMemoryItem(state, owner);
+      vnextMatchedItems.push(projected);
+      matchedItems.push(projected);
+    }
+  }
   if (matchedItems.length === 0) {
-    return { deletedCount: 0, deletedIds: [], matchedItems: [] };
+    return { deletedCount: 0, deletedIds: [], retiredIds: [], matchedItems: [] };
   }
   const token = generateMemoryDeletionToken(
     owner.ownerId,
@@ -138,6 +189,7 @@ var deleteMemoriesForOwnerFromDb = async (db, owner, filters = {}) => {
     return {
       deletedCount: 0,
       deletedIds: [],
+      retiredIds: [],
       matchedItems,
       deletionToken: token
     };
@@ -147,14 +199,28 @@ var deleteMemoriesForOwnerFromDb = async (db, owner, filters = {}) => {
       "deletionToken mismatch: memory dataset changed since preview; please rerun dry-run preview before confirming."
     );
   }
-  const batch = db.batch();
-  for (const item of matchedItems) {
-    deleteMemoryItemWithIndexesInBatch(batch, item);
+  const vnextMatchedIdSet = new Set(
+    vnextStateIdsToRetire.map((stateId) => `${VNEXT_STATE_ID_PREFIX}${stateId}`)
+  );
+  const legacyItems = matchedItems.filter((item) => !vnextMatchedIdSet.has(item.id));
+  const shouldRetireVNext = vnextStatesToRetire.length > 0;
+  if (legacyItems.length > 0 || shouldRetireVNext) {
+    const batch = db.batch();
+    for (const item of legacyItems) {
+      deleteMemoryItemWithIndexesInBatch(batch, item);
+    }
+    if (shouldRetireVNext) {
+      const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+      for (const state of vnextStatesToRetire) {
+        _appendRetiredStateBatch(batch, { ...state, retiredAt: nowIso });
+      }
+    }
+    await batch.write();
   }
-  await batch.write();
   return {
     deletedCount: matchedItems.length,
     deletedIds: matchedItems.map((item) => item.id),
+    retiredIds: vnextMatchedItems.map((item) => item.id),
     matchedItems,
     deletionToken: token
   };

package/{chunk-7OLPQSMQ.js → chunk-OYOWA3CP.js}

@@ -1,9 +1,9 @@
 import {
   clearCliLocalRuntimePreparedAgentCache
-} from "./chunk-YVIV7WT4.js";
+} from "./chunk-FD5K6MPI.js";
 import {
   getReadableCliDb
-} from "./chunk-LS2ZANRJ.js";
+} from "./chunk-CTUQJVQM.js";
 import {
   buildCreatedAgentRecord,
   buildUpdatedAgentRecord,
@@ -12,7 +12,7 @@ import {
   resolveAgentRecordFromHybridStore,
   sanitizeAgentRecordForCliOutput,
   writeAgentRecord
-} from "./chunk-76WEAXJB.js";
+} from "./chunk-SACTCJAC.js";
 import {
   resolveCliAgentKeyInput
 } from "./chunk-SV5IJK6K.js";
@@ -212,7 +212,7 @@ async function runAgentCreateCommand(args, deps = {}) {
     clearCliLocalRuntimePreparedAgentCache();
     let verifyResult;
     if (parsed.verify) {
-      const { verifyCustomProvider } = await import("./agentProviderCommands-GNPTL5XR.js");
+      const { verifyCustomProvider } = await import("./agentProviderCommands-EMZCM6VA.js");
       const rec = built.nextRecord;
       verifyResult = await verifyCustomProvider({
         providerUrl: rec.customProviderUrl,
@@ -222,15 +222,34 @@ async function runAgentCreateCommand(args, deps = {}) {
         fetchImpl
       });
     }
+    const apiKeyRef = String(built.updates?.apiKeyRef || "").trim();
+    let authHint;
+    const OAUTH_REFS = /* @__PURE__ */ new Set(["claude", "chatgpt", "xai", "antigravity", "cloudflare"]);
+    if (apiKeyRef && OAUTH_REFS.has(apiKeyRef)) {
+      try {
+        const { createOAuthTokenStore } = await import("./oauthTokenStore-ITEB663N.js");
+        const store = createOAuthTokenStore();
+        if (!store.read(apiKeyRef)) {
+          authHint = `Subscription "${apiKeyRef}" is not authorized yet. Run \`nolo auth ${apiKeyRef}\` to log in.`;
+        }
+      } catch {
+      }
+    }
     output.write(JSON.stringify({
       ok: true,
       agentKey: built.agentKey,
       baseUrl: built.serverUrl,
       updates: sanitizeAgentRecordForCliOutput(built.updates),
       record: sanitizeAgentRecordForCliOutput(built.nextRecord),
-      ...verifyResult ? { verify: verifyResult } : {}
+      ...verifyResult ? { verify: verifyResult } : {},
+      ...authHint ? { hint: authHint } : {}
     }, null, 2));
     output.write("\n");
+    if (authHint) {
+      const errorOutput = deps.error ?? process.stderr;
+      errorOutput.write(`[nolo] Hint: ${authHint}
+`);
+    }
     return 0;
   } catch (error) {
     output.write(