@actiondock/core 2.19.0 → 2.21.0

package/dist/project/transactions.js

@@ -1,4 +1,3 @@
-import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
@@ -7,6 +6,7 @@ import { isProcessAlive } from "../utils/index.js";
 import { ActionDockError, PROJECT_BUSY, PROJECT_RECOVERY_REQUIRED } from "../errors.js";
 import { LOCKFILE_NAME } from "./lockfile.js";
 import { MANIFEST_FILE_NAME } from "./manifest.js";
+import { runPackageManager } from "./package-manager.js";
 export const SNAPSHOT_TRACKED_FILES = [
     "package.json",
     MANIFEST_FILE_NAME,
@@ -76,58 +76,12 @@ export function acquireProjectLock(projectRoot, options = {}) {
         handle.release();
     };
 }
-/**
- * 异步执行子进程并收集退出状态与输出流。
- *
- * 异步化取舍说明：
- * - 避免在事务回滚与恢复链路中执行同步阻塞调用导致事件循环停顿；
- * - Windows 兼容性保留：npm 在 Windows 上是 .cmd 批处理脚本，启用 shell 以防直接调用抛错；
- * - 命令与参数由系统内部锁文件逻辑决定，不接受外部未受控入参。
- */
-function execSubprocessAsync(command, args, options) {
-    return new Promise((resolve, reject) => {
-        try {
-            const proc = spawn(command, args, {
-                cwd: options?.cwd,
-                stdio: "pipe",
-                shell: process.platform === "win32",
-                env: options?.env,
-            });
-            let stdout = "";
-            let stderr = "";
-            if (proc.stdout) {
-                proc.stdout.on("data", (chunk) => {
-                    stdout += chunk.toString();
-                });
-            }
-            if (proc.stderr) {
-                proc.stderr.on("data", (chunk) => {
-                    stderr += chunk.toString();
-                });
-            }
-            let settled = false;
-            proc.on("error", (err) => {
-                if (!settled) {
-                    settled = true;
-                    reject(err);
-                }
-            });
-            proc.on("close", (status) => {
-                if (!settled) {
-                    settled = true;
-                    resolve({ status, stdout, stderr });
-                }
-            });
-        }
-        catch (err) {
-            reject(err);
-        }
-    });
-}
 /**
  * 依据恢复后的锁文件异步执行禁用安装脚本的冻结安装，使 node_modules 与声明重新一致。
  */
-export async function runFrozenInstall(projectRoot) {
+export async function runFrozenInstall(projectRoot, options) {
+    const signal = options instanceof AbortSignal ? options : options?.signal;
+    signal?.throwIfAborted();
     if (process.env.ACTIONDOCK_AUTO_INSTALL === "false") {
         return;
     }
@@ -137,45 +91,41 @@ export async function runFrozenInstall(projectRoot) {
     }
     const hasBunLock = existsSync(join(projectRoot, "bun.lock")) || existsSync(join(projectRoot, "bun.lockb"));
     const hasNpmLock = existsSync(join(projectRoot, "package-lock.json")) || existsSync(join(projectRoot, "npm-shrinkwrap.json"));
-    let cmd = "npm";
+    let pm = "npm";
     let args = ["install", "--ignore-scripts"];
     if (hasBunLock) {
-        cmd = "bun";
+        pm = "bun";
         args = ["install", "--frozen-lockfile", "--ignore-scripts"];
     }
     else if (hasNpmLock) {
-        cmd = "npm";
+        pm = "npm";
         args = ["ci", "--ignore-scripts"];
     }
-    try {
-        const check = await execSubprocessAsync(cmd, ["--version"]);
-        if (check.status !== 0) {
-            cmd = "npm";
-            args = ["install", "--ignore-scripts"];
-        }
-    }
-    catch {
-        cmd = "npm";
-        args = ["install", "--ignore-scripts"];
-    }
+    const env = {
+        ...process.env,
+        npm_config_allow_scripts: "",
+        NPM_CONFIG_ALLOW_SCRIPTS: "",
+        npm_config_ignore_scripts: "true",
+        NPM_CONFIG_IGNORE_SCRIPTS: "true",
+    };
     let proc;
     try {
-        proc = await execSubprocessAsync(cmd, args, {
+        proc = await runPackageManager(pm, args, {
             cwd: projectRoot,
-            env: {
-                ...process.env,
-                npm_config_allow_scripts: "",
-                NPM_CONFIG_ALLOW_SCRIPTS: "",
-            },
+            env,
+            signal,
         });
     }
     catch (err) {
+        if (signal?.aborted || err?.name === "AbortError") {
+            throw err;
+        }
         const errorMsg = err?.message || "Unknown error";
-        throw new ActionDockError(PROJECT_RECOVERY_REQUIRED, `PROJECT_RECOVERY_REQUIRED: Frozen install failed during recovery in ${projectRoot}: ${errorMsg}`);
+        throw new ActionDockError(PROJECT_RECOVERY_REQUIRED, `PROJECT_RECOVERY_REQUIRED: Frozen install failed during recovery in ${projectRoot}: ${errorMsg}`, { stage: "recovery-install", projectRoot, manager: pm, cause: err });
     }
     if (proc.status !== 0) {
-        const errorMsg = proc.stderr || proc.stdout || "Unknown error";
-        throw new ActionDockError(PROJECT_RECOVERY_REQUIRED, `PROJECT_RECOVERY_REQUIRED: Frozen install failed during recovery in ${projectRoot}: ${errorMsg}`);
+        const errorMsg = (proc.stderr || proc.stdout || "Unknown error").trim();
+        throw new ActionDockError(PROJECT_RECOVERY_REQUIRED, `PROJECT_RECOVERY_REQUIRED: Frozen install failed during recovery in ${projectRoot}: ${errorMsg}`, { stage: "recovery-install", projectRoot, manager: pm, status: proc.status, stderr: proc.stderr, stdout: proc.stdout });
     }
 }
 /**
@@ -214,6 +164,9 @@ export function hasPendingTransactions(projectRoot) {
 export async function beginTransaction(projectRoot, description) {
     const releaseLock = acquireProjectLock(projectRoot);
     try {
+        if (hasPendingTransactions(projectRoot)) {
+            throw new ActionDockError(PROJECT_RECOVERY_REQUIRED, `PROJECT_RECOVERY_REQUIRED: Cannot begin transaction in '${projectRoot}': pending transaction exists. Recovery is required.`);
+        }
         const txId = `${Date.now()}-${randomUUID().slice(0, 8)}`;
         const txDir = join(projectRoot, ".actiondock", "transactions", txId);
         const snapshotDir = join(txDir, "snapshot");
@@ -300,6 +253,7 @@ export async function beginTransaction(projectRoot, description) {
  * 依据事务日志恢复所有待恢复的悬空事务快照，并在成功后执行冻结安装。
  */
 export async function recoverPendingTransactions(projectRoot, options) {
+    options?.signal?.throwIfAborted();
     const txBaseDir = join(projectRoot, ".actiondock", "transactions");
     if (!existsSync(txBaseDir)) {
         return [];
@@ -315,6 +269,7 @@ export async function recoverPendingTransactions(projectRoot, options) {
         throw err;
     }
     try {
+        options?.signal?.throwIfAborted();
         const recoveredIds = [];
         const entries = readdirSync(txBaseDir);
         for (const entry of entries) {
@@ -330,6 +285,11 @@ export async function recoverPendingTransactions(projectRoot, options) {
                 continue;
             }
             if (meta.status === "pending") {
+                options?.signal?.throwIfAborted();
+                if (options?.frozenInstall !== false &&
+                    (options?.allowInstall === false || process.env.ACTIONDOCK_AUTO_INSTALL === "false")) {
+                    throw new ActionDockError(PROJECT_RECOVERY_REQUIRED, `PROJECT_RECOVERY_REQUIRED: Project at '${projectRoot}' has pending transactions requiring recovery install, but installation is disabled (--no-install or ACTIONDOCK_AUTO_INSTALL=false).`);
+                }
                 const snapshotDir = join(txDir, "snapshot");
                 for (const rec of meta.files) {
                     const targetPath = join(projectRoot, rec.name);
@@ -346,7 +306,7 @@ export async function recoverPendingTransactions(projectRoot, options) {
                     }
                 }
                 if (options?.frozenInstall !== false) {
-                    await runFrozenInstall(projectRoot);
+                    await runFrozenInstall(projectRoot, { signal: options?.signal });
                 }
                 meta.status = "rolled_back";
                 try {
@@ -362,6 +322,6 @@ export async function recoverPendingTransactions(projectRoot, options) {
         return recoveredIds;
     }
     finally {
-        releaseLock();
+        releaseLock?.();
     }
 }

package/dist/project/types.d.ts

@@ -2,6 +2,34 @@
  * 配置项的值类型枚举。用于自动类型推断与环境变量自动转换。
  */
 export type ConfigValueType = "string" | "number" | "boolean" | "object" | "array";
+/**
+ * 配置值受限模式定义契约。
+ * 仅允许受支持的纯受限关键字集合，禁止动态计算或高级条件指令。
+ */
+export interface ConfigValueSchema {
+    /** 节点数据类型 */
+    type?: "object" | "array" | "string" | "integer" | "number" | "boolean";
+    /** 对象属性字段子模式映射 */
+    properties?: Record<string, ConfigValueSchema>;
+    /** 必填属性字段列表 */
+    required?: string[];
+    /** 额外属性放行策略（布尔开关或子模式） */
+    additionalProperties?: boolean | ConfigValueSchema;
+    /** 数组元素子模式 */
+    items?: ConfigValueSchema;
+    /** 枚举有效值列表 */
+    enum?: unknown[];
+    /** 字符串最小字符长度 */
+    minLength?: number;
+    /** 字符串最大字符长度 */
+    maxLength?: number;
+    /** 数值最小值约束 */
+    minimum?: number;
+    /** 数值最大值约束 */
+    maximum?: number;
+    /** 是否为敏感字段（仅可在模式节点中扩展指定） */
+    secret?: boolean;
+}
 /**
  * 在 actiondock.json 中声明的单项配置定义。
  */
@@ -20,6 +48,8 @@ export interface ConfigItemDefinition {
     required?: boolean;
     /** 是否允许单次调用覆盖 */
     allowInvocationOverride?: boolean;
+    /** 配置值验证与字段级脱敏所绑定的受限模式定义 */
+    schema?: ConfigValueSchema;
 }
 /**
  * 单个 Action 在 actiondock.json 清单中的声明项。

package/dist/runtime/context.d.ts

@@ -1,7 +1,9 @@
-import type { ActionContext, ActionRef, Config, Logger, ProcessAPI, ProgressReporter, StateStore } from "@actiondock/sdk";
+import type { ActionContext, ActionInvokeOptions, ActionRef, Config, Logger, ProcessAPI, ProgressReporter, StateStore } from "@actiondock/sdk";
 import type { ProjectConfig } from "../project/types.js";
+import type { ConfigItemDefinition } from "../project/types.js";
 import type { RuntimeStorage } from "../storage/types.js";
 import { ProcessManager, type ProcessOwner } from "../process/index.js";
+import type { ConfigSource } from "../service/types.js";
 /**
  * 生产级配置解析器实现。
  * 严格践行 5 层配置解析优先级链：
@@ -21,17 +23,37 @@ export declare class RuntimeConfig implements Config {
     get<T = unknown>(key: string): T | undefined;
     get<T = unknown>(key: string, defaultValue: T): T;
     has(key: string): boolean;
+    /**
+     * 含历史保护声明的配置解析结果视图。
+     */
+    describeWithProtection<T = unknown>(key: string): ConfigResolutionWithProtection<T>;
     /**
      * 结构化解析指定配置项的来源与取值视图。
      *
-     * 作为五层优先级链的唯一事实源读取视图，供 app 层 getConfig 安全视图直接委托，
-     * 避免重复实现解析链导致行为漂移。
+     * 委托 describeWithProtection 五层优先级链单一事实源，剥出既有公开契约视图，
+     * 避免双实现漂移；历史保护声明仅由管理视图消费。
+     * source 仅表达实际生效值来源；undefined 统一视为未命中并继续向低优先级解析，
+     * null/false/0/空串均为真实值；整链未命中时 source 为 null。
      */
     describe<T = unknown>(key: string): {
-        source: "overrides" | "package" | "global" | "env" | "default";
+        source: ConfigSource | null;
         value: T | undefined;
     };
 }
+/**
+ * 含历史保护声明的配置解析结果视图。
+ */
+export interface ConfigResolutionWithProtection<T = unknown> {
+    /** 实际生效值来源；整链未命中为 null */
+    source: ConfigSource | null;
+    /** 实际生效值 */
+    value: T | undefined;
+    /**
+     * 值来源存储持久化的历史保护声明（仅 package/global 来源可能存在）。
+     * 与值取自同一次原子读取，避免并发删除造成值与规则错配。
+     */
+    protection?: readonly ConfigItemDefinition[];
+}
 /**
  * 生产级状态存储实现，将状态持久化到 SQLite 中，完整支持命名空间分段隔离与 TTL。
  *
@@ -81,7 +103,7 @@ export interface ContextOptions {
     owner?: ProcessOwner;
     progress?: ProgressReporter;
     logger?: Logger;
-    onActionInvoke?: (action: ActionRef | string, input: unknown, parentRunId?: string) => Promise<unknown>;
+    onActionInvoke?: (action: ActionRef | string, input: unknown, parentRunId?: string, options?: ActionInvokeOptions) => Promise<unknown>;
 }
 /**
  * 构建并装配传递给 Action 的完整 ActionContext 运行时上下文。

package/dist/runtime/context.js

@@ -1,7 +1,9 @@
+import { assertConcreteConfigKey, assertValidConfigDeclarations, resolveConfigDeclaration, validateConfigValue } from "../project/config-declarations.js";
+import { readConfigWithProtection } from "../storage/index.js";
 import { MemoryProcessDriver, ProcessManager } from "../process/index.js";
 import { createDefaultProcessOwner } from "../invocation/types.js";
 import { resolveEnvValue } from "./env.js";
-import { ActionDockError, INVALID_ACTION_REF, INVALID_STATE } from "../errors.js";
+import { ActionDockError, isConfigEncryptionError, INVALID_ACTION_REF, INVALID_ARGUMENT, INVALID_STATE, } from "../errors.js";
 /**
  * 生产级配置解析器实现。
  * 严格践行 5 层配置解析优先级链：
@@ -20,58 +22,95 @@ export class RuntimeConfig {
     constructor(storage, overrides = {}, projectConfig, globalStorage) {
         this.storage = storage;
         this.overrides = new Map(Object.entries(overrides));
+        assertValidConfigDeclarations(projectConfig?.config);
         this.projectConfig = projectConfig;
         this.globalStorage = globalStorage;
     }
     get(key, defaultValue) {
-        // 委托 describe 五层解析链唯一事实源：整链未命中（source 为 default 且无值）时回退调用方默认值
+        // 委托 describe 五层解析链唯一事实源：整链未命中（source 为 null 且无值）时回退调用方默认值
         const resolved = this.describe(key);
-        if (resolved.source === "default" && resolved.value === undefined) {
+        if (resolved.source === null && resolved.value === undefined) {
             return defaultValue;
         }
+        const resolvedDecl = resolveConfigDeclaration(this.projectConfig?.config, key);
+        validateConfigValue(key, resolved.value, resolvedDecl?.item);
         return resolved.value;
     }
     has(key) {
-        // 委托 describe 五层解析链唯一事实源：default 来源且无值即视为未配置
+        // 委托 describe 五层解析链唯一事实源：来源 null 且无值即视为未配置
         const resolved = this.describe(key);
-        return !(resolved.source === "default" && resolved.value === undefined);
+        return !(resolved.source === null && resolved.value === undefined);
     }
     /**
-     * 结构化解析指定配置项的来源与取值视图。
-     *
-     * 作为五层优先级链的唯一事实源读取视图，供 app 层 getConfig 安全视图直接委托，
-     * 避免重复实现解析链导致行为漂移。
+     * 含历史保护声明的配置解析结果视图。
      */
-    describe(key) {
-        // 1. CLI 临时参数覆写
+    describeWithProtection(key) {
+        assertConcreteConfigKey(key);
+        // 1. 运行时固定覆盖与单次调用覆盖（值为 undefined 视为未命中，继续解析链）
         if (this.overrides.has(key)) {
-            return { source: "overrides", value: this.overrides.get(key) };
+            const overrideValue = this.overrides.get(key);
+            if (overrideValue !== undefined) {
+                return { source: "override", value: overrideValue };
+            }
         }
-        // 2. 包级持久化存储
-        const stored = this.storage.getConfig(key);
-        if (stored !== undefined) {
-            return { source: "package", value: stored };
+        // 2. 包级持久化存储：原子快照配对读取值与历史保护声明；
+        //    加密错误直接透传，绝不降级继续解析链（旧版库已在打开时自动迁移）
+        const resolvedDecl = resolveConfigDeclaration(this.projectConfig?.config, key);
+        const packageSnapshot = readConfigWithProtection(this.storage, key);
+        if (packageSnapshot !== undefined) {
+            return {
+                source: "package",
+                value: packageSnapshot.value,
+                ...(packageSnapshot.protection !== undefined
+                    ? { protection: packageSnapshot.protection }
+                    : {}),
+            };
         }
-        // 3. 全局持久化存储（读取异常时降级继续解析链，但记录警告确保不静默吞没）
+        // 3. 全局持久化存储（一般读取异常降级继续解析链并告警；
+        //    加密错误严禁回退，必须原样透传）
         if (this.globalStorage) {
             try {
-                const globalStored = this.globalStorage.getConfig(key);
-                if (globalStored !== undefined) {
-                    return { source: "global", value: globalStored };
+                const globalSnapshot = readConfigWithProtection(this.globalStorage, key);
+                if (globalSnapshot !== undefined) {
+                    return {
+                        source: "global",
+                        value: globalSnapshot.value,
+                        ...(globalSnapshot.protection !== undefined
+                            ? { protection: globalSnapshot.protection }
+                            : {}),
+                    };
                 }
             }
             catch (err) {
+                if (isConfigEncryptionError(err)) {
+                    throw err;
+                }
                 console.warn(`[actiondock] global config read failed for ${key}: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
         // 4. 环境变量
-        const itemDef = this.projectConfig?.config?.[key];
+        const itemDef = resolvedDecl?.item;
         const envResolved = resolveEnvValue(key, itemDef, this.projectConfig?.id);
         if (envResolved !== undefined) {
             return { source: "env", value: envResolved.value };
         }
-        // 5. 项目声明的默认值
-        return { source: "default", value: itemDef?.default };
+        // 5. 项目声明的默认值；仅存在真实生效的 default 值才报 default，整链未命中为 null
+        if (itemDef?.default !== undefined) {
+            return { source: "default", value: itemDef.default };
+        }
+        return { source: null, value: undefined };
+    }
+    /**
+     * 结构化解析指定配置项的来源与取值视图。
+     *
+     * 委托 describeWithProtection 五层优先级链单一事实源，剥出既有公开契约视图，
+     * 避免双实现漂移；历史保护声明仅由管理视图消费。
+     * source 仅表达实际生效值来源；undefined 统一视为未命中并继续向低优先级解析，
+     * null/false/0/空串均为真实值；整链未命中时 source 为 null。
+     */
+    describe(key) {
+        const resolved = this.describeWithProtection(key);
+        return { source: resolved.source, value: resolved.value };
     }
 }
 /**
@@ -156,6 +195,38 @@ export class StderrLogger {
         process.stderr.write(this.format("error", message, data) + "\n");
     }
 }
+/**
+ * 校验并规范化 ActionInvokeOptions 调用选项。
+ *
+ * 针对第三参数运行时检查：
+ * - 必须为普通对象或 undefined（2 参数兼容）
+ * - 严禁未知字段（如 profile、server、token 等）
+ * - binding 若存在必须为非空且非全空白字符串
+ */
+function validateActionInvokeOptions(options) {
+    if (options === undefined) {
+        return undefined;
+    }
+    if (typeof options !== "object" ||
+        options === null ||
+        Array.isArray(options) ||
+        (Object.getPrototypeOf(options) !== Object.prototype && Object.getPrototypeOf(options) !== null)) {
+        throw new ActionDockError(INVALID_ARGUMENT, "INVALID_ARGUMENT: ActionInvokeOptions must be a plain object");
+    }
+    const allowedKeys = new Set(["binding"]);
+    for (const key of Reflect.ownKeys(options)) {
+        if (typeof key !== "string" || !allowedKeys.has(key)) {
+            throw new ActionDockError(INVALID_ARGUMENT, `INVALID_ARGUMENT: Unknown option '${String(key)}' in ActionInvokeOptions. Only 'binding' is allowed.`);
+        }
+    }
+    const rawBinding = options.binding;
+    if (rawBinding !== undefined) {
+        if (typeof rawBinding !== "string" || rawBinding.trim() === "") {
+            throw new ActionDockError(INVALID_ARGUMENT, "INVALID_ARGUMENT: 'binding' option must be a non-empty string");
+        }
+    }
+    return options;
+}
 /**
  * 构建并装配传递给 Action 的完整 ActionContext 运行时上下文。
  *
@@ -169,17 +240,18 @@ export function createActionContext(options) {
     const signal = options.signal ?? new AbortController().signal;
     const currentRunId = options.runId || crypto.randomUUID();
     const currentRootRunId = options.rootRunId || options.parentRunId || currentRunId;
-    const invoke = async (action, input) => {
+    const invoke = async (action, input, rawOptions) => {
         if (typeof action !== "string" &&
             (!action || typeof action !== "object" || typeof action.run === "function" || !("actionId" in action))) {
             throw new ActionDockError(INVALID_ACTION_REF, "INVALID_ACTION_REF: ctx.actions.invoke strictly accepts only ActionRef or string, passing ActionDefinition or function is prohibited");
         }
+        const validatedOptions = validateActionInvokeOptions(rawOptions);
         if (options.onActionInvoke) {
-            return (await options.onActionInvoke(action, input, currentRunId));
+            return (await options.onActionInvoke(action, input, currentRunId, validatedOptions));
         }
         throw new ActionDockError(INVALID_STATE, "ActionInvoker not configured with an invocation delegate");
     };
-    const invokerFn = (ref, input) => invoke(ref, input);
+    const invokerFn = (ref, input, invokeOpts) => invoke(ref, input, invokeOpts);
     const invoker = Object.assign(invokerFn, { invoke });
     const defaultOwner = createDefaultProcessOwner();
     const effectiveOwner = options.owner || defaultOwner;

package/dist/runtime/env.js

@@ -142,7 +142,21 @@ export function resolveEnvValue(key, itemDef, packageId) {
     // 4. 原始键名 (例如 apiKey)
     candidateKeys.add(key);
     // 按优先级顺序依次检索环境变量
-    const effectiveType = itemDef?.type || inferTypeFromDefault(itemDef?.default);
+    let effectiveType = itemDef?.type;
+    if (!effectiveType && itemDef?.schema?.type) {
+        if (itemDef.schema.type === "integer" || itemDef.schema.type === "number") {
+            effectiveType = "number";
+        }
+        else if (itemDef.schema.type === "string" ||
+            itemDef.schema.type === "boolean" ||
+            itemDef.schema.type === "object" ||
+            itemDef.schema.type === "array") {
+            effectiveType = itemDef.schema.type;
+        }
+    }
+    if (!effectiveType) {
+        effectiveType = inferTypeFromDefault(itemDef?.default);
+    }
     for (const envKey of candidateKeys) {
         const rawVal = process.env[envKey];
         if (rawVal !== undefined) {

package/dist/runtime/run-persistence.d.ts

@@ -63,7 +63,7 @@ export interface RunFinalizer {
     /** 竞态监听句柄注销函数列表（finalize 时统一清理，覆盖成功路径） */
     raceListenerRemovers: Array<() => void>;
     /** 绑定取消控制器并启动超时定时器 */
-    startTimeout(controller: AbortController, timeoutMs: number): void;
+    startTimeout(controller: AbortController, timeoutMs: number, displayTimeoutMs?: number): void;
     /** 写入终态（幂等，自动清理超时定时器与全部监听句柄） */
     finalize(status: TerminalRunStatus, output?: unknown, error?: RuntimeError): void;
 }

package/dist/runtime/run-persistence.js

@@ -1,4 +1,4 @@
-import { ActionDockError, RUN_PERSISTENCE_FAILED, RUN_REPOSITORY_UNAVAILABLE } from "../errors.js";
+import { ActionDockError, ACTION_TIMEOUT, RUN_PERSISTENCE_FAILED, RUN_REPOSITORY_UNAVAILABLE } from "../errors.js";
 import { snapshotRunOrigin } from "./run-origin.js";
 /**
  * 构建运行初始记录（RunRecord 组装单一事实源）。
@@ -79,11 +79,12 @@ export function createRunFinalizer(storage, runId) {
         signal: undefined,
         onAbort: undefined,
         raceListenerRemovers: [],
-        startTimeout: (controller, timeoutMs) => {
+        startTimeout: (controller, timeoutMs, displayTimeoutMs) => {
             finalizer.controller = controller;
+            const display = displayTimeoutMs ?? timeoutMs;
             finalizer.timeoutTimer = setTimeout(() => {
                 finalizer.isTimeout = true;
-                finalizer.controller?.abort(new Error(`Action exceeded timeout of ${timeoutMs}ms`));
+                finalizer.controller?.abort(new ActionDockError(ACTION_TIMEOUT, `Action exceeded timeout of ${display}ms`, { timeoutMs: display }));
             }, timeoutMs);
         },
         finalize: (status, output, error) => {

package/dist/runtime/standalone-commands.d.ts

@@ -14,5 +14,5 @@ export interface CommandContext {
 export declare function handleList(ctx: CommandContext, subArgs: string[]): Promise<number>;
 export declare function handleDescribe(ctx: CommandContext, subArgs: string[]): Promise<number>;
 export declare function handleRun(ctx: CommandContext, subArgs: string[], actionArgs: string[], signal?: AbortSignal): Promise<number>;
-export declare function handleConfig(ctx: CommandContext, subArgs: string[]): Promise<number>;
-export declare function handleState(ctx: CommandContext, subArgs: string[]): Promise<number>;
+export declare function handleConfig(ctx: CommandContext, subArgs: string[], flatArgs?: string[], signal?: AbortSignal, stdin?: NodeJS.ReadableStream): Promise<number>;
+export declare function handleState(ctx: CommandContext, subArgs: string[], flatArgs?: string[], signal?: AbortSignal, stdin?: NodeJS.ReadableStream): Promise<number>;