@arcships/morula-runtime 0.1.0-alpha.5 → 0.1.0-alpha.7

package/dist/index.js

@@ -729,7 +729,7 @@ var BUILD_ID, BUILD_CONTEXTS, BUILD_DEFAULT_CONTEXT;
 var init_build_env = __esm({
   "../morula-cli-core/dist/build-env.js"() {
     "use strict";
-    BUILD_ID = "20260916084926.nogit";
+    BUILD_ID = "20260917073516.nogit";
     BUILD_CONTEXTS = {
       "local": "http://localhost:8080/api",
       "test": "https://morula.basecastle.com/api",
@@ -2042,10 +2042,219 @@ var init_dist2 = __esm({
   }
 });
 
+// src/daemon/spawn.ts
+var spawn_exports = {};
+__export(spawn_exports, {
+  findCliEntry: () => findCliEntry,
+  isSeaMode: () => isSeaMode,
+  resolveDaemonRunCommand: () => resolveDaemonRunCommand,
+  resolvePortalCommand: () => resolvePortalCommand,
+  spawnDaemonProcess: () => spawnDaemonProcess
+});
+import { spawn as spawn2 } from "node:child_process";
+import { closeSync, existsSync as existsSync2, openSync } from "node:fs";
+import { dirname as dirname2, join as join2, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+function findCliEntry() {
+  try {
+    const currentFile = fileURLToPath(import.meta.url);
+    if (currentFile.includes(`${sep}dist${sep}`))
+      return currentFile;
+    const srcDir = dirname2(dirname2(currentFile));
+    const srcEntry = join2(srcDir, "index.ts");
+    if (existsSync2(srcEntry))
+      return srcEntry;
+  } catch {
+  }
+  return null;
+}
+function isSeaMode() {
+  const base = process.execPath.split("/").pop() ?? "";
+  const isNode = base === "node" || base === "node.exe";
+  return !isNode || findCliEntry() === null;
+}
+function resolveDaemonRunCommand() {
+  const entry = findCliEntry();
+  if (entry) {
+    if (entry.endsWith(".ts"))
+      return { command: process.execPath, args: ["--import", "tsx", entry, "daemon", "run"] };
+    return { command: process.execPath, args: [entry, "daemon", "run"] };
+  }
+  return { command: process.execPath, args: ["daemon", "run"] };
+}
+function resolvePortalCommand() {
+  const entry = findCliEntry();
+  if (entry) {
+    if (entry.endsWith(".ts"))
+      return { command: process.execPath, args: ["--import", "tsx", entry, "daemon", "portal"] };
+    return { command: process.execPath, args: [entry, "daemon", "portal"] };
+  }
+  return { command: process.execPath, args: ["daemon", "portal"] };
+}
+function spawnDaemonProcess(opts) {
+  const { command, args } = resolveDaemonRunCommand();
+  let logFd;
+  try {
+    logFd = openSync(opts.logFile, "a", 384);
+  } catch (error) {
+    return { pid: 0, error: `\u65E0\u6CD5\u6253\u5F00\u65E5\u5FD7\u6587\u4EF6 ${opts.logFile}: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  try {
+    const child = spawn2(command, args, {
+      cwd: process.cwd(),
+      detached: true,
+      stdio: ["ignore", logFd, logFd],
+      env: { ...process.env, ...opts.env ?? {} }
+    });
+    child.on("error", () => {
+      try {
+        closeSync(logFd);
+      } catch {
+      }
+    });
+    child.unref();
+    return { pid: child.pid ?? 0 };
+  } catch (error) {
+    try {
+      closeSync(logFd);
+    } catch {
+    }
+    return { pid: 0, error: `\u65E0\u6CD5\u542F\u52A8 daemon: ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+var init_spawn = __esm({
+  "src/daemon/spawn.ts"() {
+    "use strict";
+  }
+});
+
+// src/daemon/portal-autostart.ts
+var portal_autostart_exports = {};
+__export(portal_autostart_exports, {
+  buildLaunchAgentPlist: () => buildLaunchAgentPlist,
+  launchAgentPath: () => launchAgentPath,
+  reloadLaunchAgent: () => reloadLaunchAgent,
+  removeAutostart: () => removeAutostart,
+  setupAutostart: () => setupAutostart
+});
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, rmSync as rmSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+function launchAgentPath() {
+  return join3(homedir2(), "Library", "LaunchAgents", `${LABEL}.plist`);
+}
+function legacyLaunchAgentPaths() {
+  return LEGACY_LABELS.map((label) => join3(homedir2(), "Library", "LaunchAgents", `${label}.plist`));
+}
+async function removeLegacyAutostart() {
+  const uid = typeof process.getuid === "function" ? process.getuid?.() : 0;
+  for (const legacyPath of legacyLaunchAgentPaths()) {
+    if (!existsSync3(legacyPath))
+      continue;
+    try {
+      execFileSync("launchctl", ["bootout", `gui:${uid}`, legacyPath], { stdio: "pipe" });
+    } catch {
+    }
+    rmSync2(legacyPath, { force: true });
+    console.error(`[portal] \u5DF2\u79FB\u9664\u5386\u53F2\u81EA\u542F ${legacyPath}`);
+  }
+}
+function escapePlistValue(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;");
+}
+function buildLaunchAgentPlist(spec) {
+  const envEntries = Object.entries(spec.environmentVariables ?? {}).map(([key, value]) => `    <key>${escapePlistValue(key)}</key>
+    <string>${escapePlistValue(value)}</string>`).join("\n");
+  const envSection = envEntries ? `
+  <key>EnvironmentVariables</key>
+  <dict>
+${envEntries}
+  </dict>` : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapePlistValue(spec.label)}</string>
+  <key>ProgramArguments</key>
+  <array>${[spec.command, ...spec.args].map((a) => `    <string>${escapePlistValue(a)}</string>`).join("\n")}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>${envSection}
+  <key>StandardOutPath</key>
+  <string>${escapePlistValue(spec.logFile)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapePlistValue(spec.errFile ?? spec.logFile)}</string>
+</dict>
+</plist>
+`;
+}
+async function reloadLaunchAgent(plistPath, log) {
+  const uid = typeof process.getuid === "function" ? process.getuid?.() : void 0;
+  const domain = `gui/${uid ?? process.env.UID ?? ""}`;
+  try {
+    execFileSync("launchctl", ["bootout", domain, plistPath], { stdio: "pipe" });
+  } catch {
+  }
+  try {
+    execFileSync("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
+    return true;
+  } catch (error) {
+    log(`launchctl bootstrap \u5931\u8D25\uFF08\u53EF\u624B\u52A8 launchctl load -w ${plistPath}\uFF09: ${error instanceof Error ? error.message : String(error)}`);
+    return false;
+  }
+}
+async function setupAutostart(context) {
+  if (process.platform !== "darwin")
+    return false;
+  await removeLegacyAutostart();
+  const { command, args } = resolvePortalCommand();
+  const stateDir2 = process.env.MORULA_CONFIG_DIR ?? join3(homedir2(), ".morula-cli");
+  const daemonDir2 = join3(stateDir2, "daemon");
+  mkdirSync2(daemonDir2, { recursive: true, mode: 448 });
+  const logFile = join3(daemonDir2, "portal.log");
+  const plist = buildLaunchAgentPlist({ label: LABEL, command, args, logFile });
+  const plistPath = launchAgentPath();
+  mkdirSync2(join3(plistPath, ".."), { recursive: true });
+  const fs = await import("node:fs");
+  fs.writeFileSync(plistPath, plist, { mode: 420 });
+  await reloadLaunchAgent(plistPath, (line) => context.err(`[portal] ${line}`));
+  return true;
+}
+async function removeAutostart(context) {
+  if (process.platform !== "darwin") {
+    context.err("[portal] \u5F53\u524D\u5E73\u53F0\u6682\u4E0D\u652F\u6301\u81EA\u542F\u79FB\u9664");
+    return;
+  }
+  await removeLegacyAutostart();
+  const plistPath = launchAgentPath();
+  const uid = typeof process.getuid === "function" ? process.getuid?.() : 0;
+  try {
+    execFileSync("launchctl", ["bootout", `gui:${uid}`, plistPath], { stdio: "pipe" });
+  } catch {
+  }
+  rmSync2(plistPath, { force: true });
+}
+var LABEL, LEGACY_LABELS;
+var init_portal_autostart = __esm({
+  "src/daemon/portal-autostart.ts"() {
+    "use strict";
+    init_spawn();
+    LABEL = "com.morula.runtime.portal";
+    LEGACY_LABELS = ["com.morula-cli.portal", "com.agentctl.portal"];
+  }
+});
+
 // src/daemon/daemon-config.ts
 import { randomUUID } from "node:crypto";
-import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { join as join5 } from "node:path";
 function loadDaemonConfig(store) {
   const config = store.load();
   const d = config?.[DAEMON_KEY];
@@ -2076,16 +2285,16 @@ var DEFAULT_WORKDIR, DEFAULT_MAX_CONCURRENT, DAEMON_KEY;
 var init_daemon_config = __esm({
   "src/daemon/daemon-config.ts"() {
     "use strict";
-    DEFAULT_WORKDIR = join2(homedir2(), ".morula", "daemon");
+    DEFAULT_WORKDIR = join5(homedir4(), ".morula", "daemon");
     DEFAULT_MAX_CONCURRENT = 6;
     DAEMON_KEY = "daemon";
   }
 });
 
 // src/daemon/daemon-lock.ts
-import { execFileSync } from "node:child_process";
-import { closeSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2, writeSync } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { closeSync as closeSync2, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync2, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync3, writeSync } from "node:fs";
+import { dirname as dirname4, join as join6 } from "node:path";
 function isProcessAlive(pid) {
   if (!pid || pid <= 0)
     return false;
@@ -2098,7 +2307,7 @@ function isProcessAlive(pid) {
 }
 function processCommandLine(pid) {
   try {
-    const out = execFileSync("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8", stdio: "pipe" }).trim();
+    const out = execFileSync3("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8", stdio: "pipe" }).trim();
     return out || null;
   } catch {
     return null;
@@ -2160,7 +2369,7 @@ function probeDaemonLock(lockPath) {
   return { state: "active", record };
 }
 function writeRecord(lockPath, record) {
-  writeFileSync2(lockPath, `${JSON.stringify(record, null, 2)}
+  writeFileSync3(lockPath, `${JSON.stringify(record, null, 2)}
 `, { mode: 384 });
 }
 function acquireDaemonLock(lockPath, input) {
@@ -2169,14 +2378,14 @@ function acquireDaemonLock(lockPath, input) {
     startedAt: (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
     workdir: input.workdir
   };
-  mkdirSync2(dirname2(lockPath), { recursive: true, mode: 448 });
+  mkdirSync4(dirname4(lockPath), { recursive: true, mode: 448 });
   try {
-    const fd = openSync(lockPath, "wx", 384);
+    const fd = openSync2(lockPath, "wx", 384);
     try {
       writeSync(fd, `${JSON.stringify(record, null, 2)}
 `);
     } finally {
-      closeSync(fd);
+      closeSync2(fd);
     }
     return { ok: true, handle: makeHandle(lockPath, record), tookOver: false, previous: null };
   } catch (error) {
@@ -2204,7 +2413,7 @@ function releaseDaemonLock(lockPath, pid) {
     if (read && "record" in read && read.record.pid !== pid)
       return;
   }
-  rmSync2(lockPath, { force: true });
+  rmSync4(lockPath, { force: true });
 }
 async function waitForExit(pid, timeoutMs, pollMs) {
   const deadline = Date.now() + timeoutMs;
@@ -2252,9 +2461,9 @@ __export(portal_instances_exports, {
   parseBaseUrl: () => parseBaseUrl,
   readPidFile: () => readPidFile
 });
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync, statSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync3, readdirSync, statSync } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname5, join as join7 } from "node:path";
 function parseBaseUrl(raw) {
   if (!raw)
     return null;
@@ -2279,7 +2488,7 @@ function normalizeBaseUrl2(raw) {
     return "";
   return `${parsed.protocol}//${parsed.host}:${parsed.port}${parsed.path}`;
 }
-function candidateConfigFiles(env = process.env, homeDir = homedir3()) {
+function candidateConfigFiles(env = process.env, homeDir = homedir5()) {
   const files = [];
   const push = (file) => {
     if (file && !files.includes(file))
@@ -2287,11 +2496,11 @@ function candidateConfigFiles(env = process.env, homeDir = homedir3()) {
   };
   if (env.MORULA_CONFIG)
     push(env.MORULA_CONFIG);
-  push(join4(env.MORULA_CONFIG_DIR ?? join4(homeDir, ".morula-cli"), "config.yaml"));
+  push(join7(env.MORULA_CONFIG_DIR ?? join7(homeDir, ".morula-cli"), "config.yaml"));
   try {
     for (const name of readdirSync(homeDir).sort()) {
       if (name.startsWith(".morula-cli-"))
-        push(join4(homeDir, name, "config.yaml"));
+        push(join7(homeDir, name, "config.yaml"));
     }
   } catch {
   }
@@ -2299,7 +2508,7 @@ function candidateConfigFiles(env = process.env, homeDir = homedir3()) {
     const item = raw.trim();
     if (!item)
       continue;
-    push(item.endsWith(".yaml") || item.endsWith(".yml") ? item : join4(item, "config.yaml"));
+    push(item.endsWith(".yaml") || item.endsWith(".yml") ? item : join7(item, "config.yaml"));
   }
   return files;
 }
@@ -2319,8 +2528,8 @@ function readContexts(file) {
   }
 }
 function readPidFile(configDir) {
-  const file = join4(configDir, "daemon", "daemon.pid");
-  if (!existsSync2(file))
+  const file = join7(configDir, "daemon", "daemon.pid");
+  if (!existsSync5(file))
     return 0;
   try {
     return Number(readFileSync3(file, "utf8").trim() || 0);
@@ -2332,7 +2541,7 @@ function createPortalEnvironmentResolver(options = {}) {
   const env = options.env ?? process.env;
   const log = options.log ?? (() => {
   });
-  const defaultConfigDir = dirname3(env.MORULA_CONFIG ?? join4(env.MORULA_CONFIG_DIR ?? join4(options.homeDir ?? homedir3(), ".morula-cli"), "config.yaml"));
+  const defaultConfigDir = dirname5(env.MORULA_CONFIG ?? join7(env.MORULA_CONFIG_DIR ?? join7(options.homeDir ?? homedir5(), ".morula-cli"), "config.yaml"));
   let index = [];
   let signature = "";
   function buildIndex() {
@@ -2349,7 +2558,7 @@ function createPortalEnvironmentResolver(options = {}) {
       const normalized = normalizeBaseUrl2(entry.url);
       if (!normalized)
         continue;
-      const configDir = dirname3(file);
+      const configDir = dirname5(file);
       built.push({
         configDir,
         context,
@@ -2397,7 +2606,7 @@ function createPortalEnvironmentResolver(options = {}) {
       hasToken: !!instance.token,
       runtimeId: () => {
         try {
-          return loadDaemonConfig(new FileConfigStore(join4(instance.configDir, "config.yaml")))?.runtimeId;
+          return loadDaemonConfig(new FileConfigStore(join7(instance.configDir, "config.yaml")))?.runtimeId;
         } catch {
           return void 0;
         }
@@ -2456,110 +2665,24 @@ var init_portal_instances = __esm({
   }
 });
 
-// src/daemon/spawn.ts
-var spawn_exports = {};
-__export(spawn_exports, {
-  findCliEntry: () => findCliEntry,
-  isSeaMode: () => isSeaMode,
-  resolveDaemonRunCommand: () => resolveDaemonRunCommand,
-  resolvePortalCommand: () => resolvePortalCommand,
-  spawnDaemonProcess: () => spawnDaemonProcess
-});
-import { spawn as spawn2 } from "node:child_process";
-import { closeSync as closeSync2, existsSync as existsSync3, openSync as openSync2 } from "node:fs";
-import { dirname as dirname4, join as join5, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-function findCliEntry() {
-  try {
-    const currentFile = fileURLToPath(import.meta.url);
-    if (currentFile.includes(`${sep}dist${sep}`))
-      return currentFile;
-    const srcDir = dirname4(dirname4(currentFile));
-    const srcEntry = join5(srcDir, "index.ts");
-    if (existsSync3(srcEntry))
-      return srcEntry;
-  } catch {
-  }
-  return null;
-}
-function isSeaMode() {
-  const base = process.execPath.split("/").pop() ?? "";
-  const isNode = base === "node" || base === "node.exe";
-  return !isNode || findCliEntry() === null;
-}
-function resolveDaemonRunCommand() {
-  const entry = findCliEntry();
-  if (entry) {
-    if (entry.endsWith(".ts"))
-      return { command: process.execPath, args: ["--import", "tsx", entry, "daemon", "run"] };
-    return { command: process.execPath, args: [entry, "daemon", "run"] };
-  }
-  return { command: process.execPath, args: ["daemon", "run"] };
-}
-function resolvePortalCommand() {
-  const entry = findCliEntry();
-  if (entry) {
-    if (entry.endsWith(".ts"))
-      return { command: process.execPath, args: ["--import", "tsx", entry, "daemon", "portal"] };
-    return { command: process.execPath, args: [entry, "daemon", "portal"] };
-  }
-  return { command: process.execPath, args: ["daemon", "portal"] };
-}
-function spawnDaemonProcess(opts) {
-  const { command, args } = resolveDaemonRunCommand();
-  let logFd;
-  try {
-    logFd = openSync2(opts.logFile, "a", 384);
-  } catch (error) {
-    return { pid: 0, error: `\u65E0\u6CD5\u6253\u5F00\u65E5\u5FD7\u6587\u4EF6 ${opts.logFile}: ${error instanceof Error ? error.message : String(error)}` };
-  }
-  try {
-    const child = spawn2(command, args, {
-      cwd: process.cwd(),
-      detached: true,
-      stdio: ["ignore", logFd, logFd],
-      env: { ...process.env, ...opts.env ?? {} }
-    });
-    child.on("error", () => {
-      try {
-        closeSync2(logFd);
-      } catch {
-      }
-    });
-    child.unref();
-    return { pid: child.pid ?? 0 };
-  } catch (error) {
-    try {
-      closeSync2(logFd);
-    } catch {
-    }
-    return { pid: 0, error: `\u65E0\u6CD5\u542F\u52A8 daemon: ${error instanceof Error ? error.message : String(error)}` };
-  }
-}
-var init_spawn = __esm({
-  "src/daemon/spawn.ts"() {
-    "use strict";
-  }
-});
-
 // src/daemon/portal-server.ts
 var portal_server_exports = {};
 __export(portal_server_exports, {
   DEFAULT_PORTAL_PORT: () => DEFAULT_PORTAL_PORT,
   PortalServer: () => PortalServer
 });
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { createServer as createServer2 } from "node:http";
-import { homedir as homedir4 } from "node:os";
-import { join as join6 } from "node:path";
+import { homedir as homedir6 } from "node:os";
+import { join as join8 } from "node:path";
 function stateDir() {
-  return process.env.MORULA_CONFIG_DIR ?? join6(homedir4(), ".morula-cli");
+  return process.env.MORULA_CONFIG_DIR ?? join8(homedir6(), ".morula-cli");
 }
 function pidFileIn(configDir) {
-  return join6(configDir, "daemon", "daemon.pid");
+  return join8(configDir, "daemon", "daemon.pid");
 }
 function daemonLogIn(configDir) {
-  return join6(configDir, "daemon", "daemon.log");
+  return join8(configDir, "daemon", "daemon.log");
 }
 function isPidAlive(pid) {
   if (!pid || pid <= 0)
@@ -2572,7 +2695,7 @@ function isPidAlive(pid) {
   }
 }
 function readPidFrom(file) {
-  if (!existsSync4(file))
+  if (!existsSync6(file))
     return 0;
   return Number(readFileSync4(file, "utf8").trim() || 0);
 }
@@ -2667,7 +2790,10 @@ var init_portal_server = __esm({
       /**
        * 解析请求声明的目标环境。
        * - 未声明 `server` → `{ target: undefined }`：沿用旧行为（portal 自身配置目录）
-       * - 声明了但解析不到 → 直接写出错误响应并返回 `{ failed: true }`
+       * - `server` 解析不到时按 `origin`（portal-token 下发的请求来源地址）兜底：dev 用 ngrok 等
+       *   隧道暴露 webhook 时 `server`（`APP_BASE_URL`）是隧道地址，而本机 daemon 实际注册的是本地地址
+       *   —— 两个 URL 指向同一服务进程，`origin` 能命中本机索引（docs/issues/dev-app-base-url-ngrok-portal-stop-404.md）
+       * - 两个键都只作为**本机索引内的查找键**，均未命中 → fail closed 404
        */
       resolveTarget(res, url) {
         const requested = url.searchParams.get("server");
@@ -2689,10 +2815,11 @@ var init_portal_server = __esm({
           });
           return { failed: true };
         }
-        const target = this.environments.resolve(requested);
+        const origin = url.searchParams.get("origin");
+        const target = this.environments.resolve(requested) ?? (origin && normalizeBaseUrl2(origin) ? this.environments.resolve(origin) : void 0);
         if (!target) {
           const indexed = this.environments.list();
-          this.log(`[portal] \u672A\u7D22\u5F15\u7684\u76EE\u6807\u73AF\u5883: ${normalizeBaseUrl2(requested)}\uFF1B\u5DF2\u7D22\u5F15 ${indexed.map((i) => `${i.context}(${i.baseUrl})`).join(", ") || "\uFF08\u7A7A\uFF09"}`);
+          this.log(`[portal] \u672A\u7D22\u5F15\u7684\u76EE\u6807\u73AF\u5883: ${normalizeBaseUrl2(requested)}${origin ? `\uFF08origin \u515C\u5E95 ${normalizeBaseUrl2(origin)} \u4E5F\u672A\u547D\u4E2D\uFF09` : ""}\uFF1B\u5DF2\u7D22\u5F15 ${indexed.map((i) => `${i.context}(${i.baseUrl})`).join(", ") || "\uFF08\u7A7A\uFF09"}`);
           this.json(res, 404, {
             ok: false,
             error: "UNKNOWN_ENV",
@@ -2758,7 +2885,7 @@ var init_portal_server = __esm({
           return;
         }
         try {
-          writeFileSync3(pidFile, String(result.pid), { mode: 384 });
+          writeFileSync4(pidFile, String(result.pid), { mode: 384 });
         } catch {
           try {
             process.kill(result.pid, "SIGTERM");
@@ -2829,8 +2956,8 @@ var init_portal_server = __esm({
 
 // src/daemon/dim-locate.ts
 import { accessSync, constants } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { join as join7 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join9 } from "node:path";
 function isExecutable(p) {
   try {
     accessSync(p, constants.X_OK);
@@ -2840,13 +2967,13 @@ function isExecutable(p) {
   }
 }
 function knownDimLocations() {
-  const home = homedir5();
+  const home = homedir7();
   return [
     "/Applications/DimAgent.app/Contents/Resources/runtime/cli/dim",
     "/Applications/Dim.app/Contents/Resources/runtime/cli/dim",
-    join7(home, "Applications", "DimAgent.app", "Contents", "Resources", "runtime", "cli", "dim"),
-    join7(home, ".dimcode", "bin", "dim"),
-    join7(home, ".local", "bin", "dim")
+    join9(home, "Applications", "DimAgent.app", "Contents", "Resources", "runtime", "cli", "dim"),
+    join9(home, ".dimcode", "bin", "dim"),
+    join9(home, ".local", "bin", "dim")
   ];
 }
 function resolveDimCandidates(primary) {
@@ -2859,7 +2986,7 @@ function resolveDimCandidates(primary) {
   for (const c of knownDimLocations())
     push(c);
   for (const dir of (process.env.PATH ?? "").split(":").filter(Boolean))
-    push(join7(dir, "dim"));
+    push(join9(dir, "dim"));
   return out;
 }
 function resolveDimBinary() {
@@ -2874,7 +3001,7 @@ function resolveDimBinary() {
   }
   const pathDirs = (process.env.PATH ?? "").split(":").filter(Boolean);
   for (const dir of pathDirs) {
-    const candidate = join7(dir, "dim");
+    const candidate = join9(dir, "dim");
     if (isExecutable(candidate)) {
       return candidate;
     }
@@ -2895,7 +3022,7 @@ __export(acp_connection_exports, {
   countDimAcpProcesses: () => countDimAcpProcesses,
   resolveAcpInitTimeoutMs: () => resolveAcpInitTimeoutMs
 });
-import { execFileSync as execFileSync2, spawn as spawn3 } from "node:child_process";
+import { execFileSync as execFileSync4, spawn as spawn3 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function resolveAcpInitTimeoutMs() {
   const raw = Number(process.env.MORULA_ACP_INIT_TIMEOUT_MS);
@@ -2905,7 +3032,7 @@ function resolveDimVersion(dimPath) {
   if (cachedDimVersion !== null)
     return cachedDimVersion;
   try {
-    cachedDimVersion = execFileSync2(dimPath, ["--version"], { encoding: "utf8", stdio: "pipe", timeout: 5e3 }).trim().split("\n")[0] || "unknown";
+    cachedDimVersion = execFileSync4(dimPath, ["--version"], { encoding: "utf8", stdio: "pipe", timeout: 5e3 }).trim().split("\n")[0] || "unknown";
   } catch {
     cachedDimVersion = "unknown";
   }
@@ -2915,7 +3042,7 @@ function countDimAcpProcesses() {
   if (process.platform === "win32")
     return null;
   try {
-    const out = execFileSync2("ps", ["-Ao", "args"], { encoding: "utf8", stdio: "pipe", timeout: 5e3 });
+    const out = execFileSync4("ps", ["-Ao", "args"], { encoding: "utf8", stdio: "pipe", timeout: 5e3 });
     return out.split("\n").filter((line) => /(^|\/)dim(\.exe)?\s+acp(\s|$)/.test(line.trim())).length;
   } catch {
     return null;
@@ -2976,9 +3103,9 @@ var init_acp_connection = __esm({
             process.stderr.write(`[daemon] dim spawn \u5931\u8D25 ${dimPath}\uFF08\u5C1D\u8BD5\u4E0B\u4E00\u4E2A\u5019\u9009\uFF09: ${message}
 `);
             try {
-              const { existsSync: existsSync18 } = await import("node:fs");
+              const { existsSync: existsSync19 } = await import("node:fs");
               process.stderr.write(
-                `[daemon]   diag: fileExists=${existsSync18(dimPath)} cwdExists=${this.options.cwd ? existsSync18(this.options.cwd) : "n/a"} PATH=${(process.env.PATH ?? "").slice(0, 140)} DYLD=${process.env.DYLD_LIBRARY_PATH ?? "-"} NODE_OPTIONS=${process.env.NODE_OPTIONS ?? "-"}
+                `[daemon]   diag: fileExists=${existsSync19(dimPath)} cwdExists=${this.options.cwd ? existsSync19(this.options.cwd) : "n/a"} PATH=${(process.env.PATH ?? "").slice(0, 140)} DYLD=${process.env.DYLD_LIBRARY_PATH ?? "-"} NODE_OPTIONS=${process.env.NODE_OPTIONS ?? "-"}
 `
               );
             } catch {
@@ -3135,7 +3262,7 @@ var init_acp_connection = __esm({
         this.exited = true;
         if (process.platform === "win32") {
           try {
-            execFileSync2("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
+            execFileSync4("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
           } catch {
           }
           return;
@@ -3250,12 +3377,12 @@ __export(dim_home_exports, {
   isolatedDimHome: () => isolatedDimHome,
   resolveIsolatedDimEnv: () => resolveIsolatedDimEnv
 });
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { chmodSync as chmodSync2, copyFileSync, existsSync as existsSync5, readFileSync as readFileSync5, rmSync as rmSync3 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join8 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { chmodSync as chmodSync2, copyFileSync, existsSync as existsSync7, readFileSync as readFileSync5, rmSync as rmSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join10 } from "node:path";
 function isolatedDimHome() {
-  return join8(homedir6(), ".morula", "dimcode");
+  return join10(homedir8(), ".morula", "dimcode");
 }
 function resolveIsolatedDimEnv() {
   return {};
@@ -3277,13 +3404,13 @@ __export(dim_model_exports, {
 });
 import { createRequire } from "node:module";
 import { spawnSync } from "node:child_process";
-import { closeSync as closeSync3, existsSync as existsSync8, openSync as openSync3, readFileSync as readFileSync7, unlinkSync } from "node:fs";
-import { homedir as homedir8, tmpdir } from "node:os";
-import { join as join11 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync10, openSync as openSync3, readFileSync as readFileSync7, unlinkSync } from "node:fs";
+import { homedir as homedir10, tmpdir } from "node:os";
+import { join as join13 } from "node:path";
 function dimSqlitePath(env) {
   const home = env?.DIMCODE_HOME?.trim();
-  const candidates = home && home !== "" ? [join11(home, "v2", "dimcode.sqlite"), join11(home, "dimcode.sqlite")] : [join11(homedir8(), ".dimcode", "v2", "dimcode.sqlite")];
-  return candidates.find((p) => existsSync8(p)) ?? null;
+  const candidates = home && home !== "" ? [join13(home, "v2", "dimcode.sqlite"), join13(home, "dimcode.sqlite")] : [join13(homedir10(), ".dimcode", "v2", "dimcode.sqlite")];
+  return candidates.find((p) => existsSync10(p)) ?? null;
 }
 function listDimModels(dimPath = "dim", env) {
   const fromCli = (() => {
@@ -3317,12 +3444,12 @@ function listDimModels(dimPath = "dim", env) {
 function hostDimEnv(env) {
   const home = env?.DIMCODE_HOME?.trim();
   if (home && home !== "" && home.includes(".morula") && home.includes("dimcode")) {
-    return { ...process.env, DIMCODE_HOME: join11(homedir8(), ".dimcode", "v2") };
+    return { ...process.env, DIMCODE_HOME: join13(homedir10(), ".dimcode", "v2") };
   }
   return env ? { ...env } : null;
 }
 function listDimModelsFromCli(dimPath, env) {
-  const tmpFile = join11(tmpdir(), `${DIM_MODELS_TMP_PREFIX}${process.pid}-${Date.now()}.json`);
+  const tmpFile = join13(tmpdir(), `${DIM_MODELS_TMP_PREFIX}${process.pid}-${Date.now()}.json`);
   const fd = openSync3(tmpFile, "w");
   let collected = "";
   try {
@@ -3359,9 +3486,9 @@ function listDimModelsFromCli(dimPath, env) {
 }
 function dimOAuthTokenPath(env) {
   const home = env?.DIMCODE_HOME?.trim();
-  const dir = home && home !== "" ? home : join11(homedir8(), ".dimcode", "v2");
-  for (const p of [join11(dir, "auth.json"), join11(dir, "v2", "auth.json")]) {
-    if (existsSync8(p))
+  const dir = home && home !== "" ? home : join13(homedir10(), ".dimcode", "v2");
+  for (const p of [join13(dir, "auth.json"), join13(dir, "v2", "auth.json")]) {
+    if (existsSync10(p))
       return p;
   }
   return null;
@@ -3498,138 +3625,92 @@ var init_dim_model = __esm({
   }
 });
 
-// src/daemon/portal-autostart.ts
-var portal_autostart_exports = {};
-__export(portal_autostart_exports, {
-  launchAgentPath: () => launchAgentPath,
-  removeAutostart: () => removeAutostart,
-  setupAutostart: () => setupAutostart
-});
-import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync10, rmSync as rmSync6 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join18 } from "node:path";
-function launchAgentPath() {
-  return join18(homedir10(), "Library", "LaunchAgents", `${LABEL}.plist`);
+// src/index.ts
+init_dist2();
+
+// src/commands/registry-runtime.ts
+init_dist2();
+
+// src/build-env.ts
+var BUILD_VERSION2 = "0.1.0-alpha.7";
+
+// src/commands/daemon.ts
+init_dist();
+init_dist2();
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync11, rmSync as rmSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import { dirname as dirname9, join as join20 } from "node:path";
+
+// src/daemon/daemon-autostart.ts
+init_portal_autostart();
+init_spawn();
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname3, join as join4 } from "node:path";
+var DAEMON_AUTOSTART_LABEL = "com.morula.runtime.daemon";
+var DAEMON_SUPERVISED_ENV = "MORULA_DAEMON_SUPERVISED";
+function daemonAutostartPlistPath() {
+  return join4(homedir3(), "Library", "LaunchAgents", `${DAEMON_AUTOSTART_LABEL}.plist`);
 }
-function legacyLaunchAgentPaths() {
-  return LEGACY_LABELS.map((label) => join18(homedir10(), "Library", "LaunchAgents", `${label}.plist`));
+function daemonAutostartEnabled() {
+  return process.platform === "darwin" && existsSync4(daemonAutostartPlistPath());
 }
-async function removeLegacyAutostart() {
-  const uid = typeof process.getuid === "function" ? process.getuid?.() : 0;
-  for (const legacyPath of legacyLaunchAgentPaths()) {
-    if (!existsSync15(legacyPath))
-      continue;
-    try {
-      execFileSync9("launchctl", ["bootout", `gui:${uid}`, legacyPath], { stdio: "pipe" });
-    } catch {
-    }
-    rmSync6(legacyPath, { force: true });
-    console.error(`[portal] \u5DF2\u79FB\u9664\u5386\u53F2\u81EA\u542F ${legacyPath}`);
-  }
+function daemonLogFile() {
+  const stateDir2 = process.env.MORULA_CONFIG_DIR ?? join4(homedir3(), ".morula-cli");
+  return join4(stateDir2, "daemon", "daemon.log");
 }
-function buildPlist(command, args, logFile, errFile) {
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${LABEL}</string>
-  <key>ProgramArguments</key>
-  <array>${[command, ...args].map((a) => `    <string>${a.replace(/&/g, "&amp;").replace(/</g, "&lt;")}</string>`).join("\n")}
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <dict>
-    <key>SuccessfulExit</key>
-    <false/>
-  </dict>
-  <key>StandardOutPath</key>
-  <string>${logFile}</string>
-  <key>StandardErrorPath</key>
-  <string>${errFile}</string>
-</dict>
-</plist>
-`;
+function planDaemonAutostart() {
+  const { command, args } = resolveDaemonRunCommand();
+  return {
+    label: DAEMON_AUTOSTART_LABEL,
+    plistPath: daemonAutostartPlistPath(),
+    program: [command, ...args].join(" "),
+    logFile: daemonLogFile()
+  };
 }
-async function setupAutostart(context) {
-  if (process.platform !== "darwin")
-    return false;
-  await removeLegacyAutostart();
-  const { command, args } = resolvePortalCommand();
-  const stateDir2 = process.env.MORULA_CONFIG_DIR ?? join18(homedir10(), ".morula-cli");
-  const daemonDir2 = join18(stateDir2, "daemon");
-  mkdirSync10(daemonDir2, { recursive: true, mode: 448 });
-  const logFile = join18(daemonDir2, "portal.log");
-  const plist = buildPlist(command, args, logFile, logFile);
-  const plistPath = launchAgentPath();
-  mkdirSync10(join18(plistPath, ".."), { recursive: true });
-  const fs = await import("node:fs");
-  fs.writeFileSync(plistPath, plist, { mode: 420 });
-  const uid = typeof process.getuid === "function" ? process.getuid?.() : void 0;
-  const domain = `gui/${uid ?? process.env.UID ?? ""}`;
-  try {
-    execFileSync9("launchctl", ["bootout", domain, plistPath], { stdio: "pipe" });
-  } catch {
-  }
-  try {
-    execFileSync9("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
-  } catch (error) {
-    context.err(`[portal] launchctl bootstrap \u5931\u8D25\uFF08\u53EF\u624B\u52A8 launchctl load -w ${plistPath}\uFF09: ${error instanceof Error ? error.message : String(error)}`);
-    return true;
-  }
-  return true;
+function buildDaemonAutostartPlist() {
+  const { command, args } = resolveDaemonRunCommand();
+  return buildLaunchAgentPlist({
+    label: DAEMON_AUTOSTART_LABEL,
+    command,
+    args,
+    logFile: daemonLogFile(),
+    environmentVariables: { [DAEMON_SUPERVISED_ENV]: "1" }
+  });
 }
-async function removeAutostart(context) {
-  if (process.platform !== "darwin") {
-    context.err("[portal] \u5F53\u524D\u5E73\u53F0\u6682\u4E0D\u652F\u6301\u81EA\u542F\u79FB\u9664");
+async function setupDaemonAutostart(log) {
+  const plan = planDaemonAutostart();
+  mkdirSync3(dirname3(plan.logFile), { recursive: true, mode: 448 });
+  mkdirSync3(dirname3(plan.plistPath), { recursive: true });
+  writeFileSync2(plan.plistPath, buildDaemonAutostartPlist(), { mode: 420 });
+  return await reloadLaunchAgent(plan.plistPath, (line) => log(`[autostart] ${line}`));
+}
+async function removeDaemonAutostart(log) {
+  const plistPath = daemonAutostartPlistPath();
+  if (!existsSync4(plistPath)) {
+    log("[autostart] \u672A\u6CE8\u518C\u8FC7 daemon \u5F00\u673A\u81EA\u542F\uFF08\u5E42\u7B49\uFF0C\u65E0\u64CD\u4F5C\uFF09");
     return;
   }
-  await removeLegacyAutostart();
-  const plistPath = launchAgentPath();
   const uid = typeof process.getuid === "function" ? process.getuid?.() : 0;
   try {
-    execFileSync9("launchctl", ["bootout", `gui:${uid}`, plistPath], { stdio: "pipe" });
+    execFileSync2("launchctl", ["bootout", `gui:${uid}`, plistPath], { stdio: "pipe" });
   } catch {
   }
-  rmSync6(plistPath, { force: true });
+  rmSync3(plistPath, { force: true });
 }
-var LABEL, LEGACY_LABELS;
-var init_portal_autostart = __esm({
-  "src/daemon/portal-autostart.ts"() {
-    "use strict";
-    init_spawn();
-    LABEL = "com.morula.runtime.portal";
-    LEGACY_LABELS = ["com.morula-cli.portal", "com.agentctl.portal"];
-  }
-});
-
-// src/index.ts
-init_dist2();
-
-// src/commands/registry-runtime.ts
-init_dist2();
-
-// src/build-env.ts
-var BUILD_VERSION2 = "0.1.0-alpha.5";
 
 // src/commands/daemon.ts
-init_dist();
-init_dist2();
 init_daemon_config();
 init_daemon_lock();
 init_portal_server();
-import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync11, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { dirname as dirname8, join as join19 } from "node:path";
 
 // src/daemon/runner.ts
 init_dist2();
-import { execFileSync as execFileSync8 } from "node:child_process";
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, statSync as statSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { execFileSync as execFileSync10 } from "node:child_process";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, statSync as statSync3, writeFileSync as writeFileSync9 } from "node:fs";
 import { arch, hostname } from "node:os";
-import { dirname as dirname6, join as join16 } from "node:path";
+import { dirname as dirname7, join as join18 } from "node:path";
 
 // src/daemon/acp/acp-connection-pool.ts
 var DEFAULT_IDLE_MS = 30 * 60 * 1e3;
@@ -4463,9 +4544,9 @@ function isFlagEnabled(name, defaultValue = true) {
 }
 
 // src/daemon/git-env.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join9 } from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join11 } from "node:path";
 var GIT_CANDIDATE_DIRS = ["/usr/bin", "/usr/local/bin", "/opt/homebrew/bin", "/opt/local/bin"];
 function prependToPath(dirs) {
   const cur = process.env.PATH ?? "";
@@ -4477,18 +4558,18 @@ function prependToPath(dirs) {
 }
 function ensureGitOnPath() {
   try {
-    execFileSync4("git", ["--version"], { stdio: "pipe" });
+    execFileSync6("git", ["--version"], { stdio: "pipe" });
     return;
   } catch {
   }
-  const missing = prependToPath(GIT_CANDIDATE_DIRS.filter((d) => existsSync6(join9(d, "git"))));
+  const missing = prependToPath(GIT_CANDIDATE_DIRS.filter((d) => existsSync8(join11(d, "git"))));
   if (missing.length) {
     console.warn(`[daemon] PATH \u7F3A\u5C11 git\uFF0C\u5DF2\u8865\u5145: ${missing.join(", ")}`);
   }
 }
 function ensureNodeOnPath() {
-  const nodeDir = process.execPath ? join9(process.execPath, "..") : "";
-  const candidates = [nodeDir, "/usr/local/bin", "/opt/homebrew/bin"].filter((d) => d && existsSync6(join9(d, "node")));
+  const nodeDir = process.execPath ? join11(process.execPath, "..") : "";
+  const candidates = [nodeDir, "/usr/local/bin", "/opt/homebrew/bin"].filter((d) => d && existsSync8(join11(d, "node")));
   const missing = prependToPath(candidates);
   if (missing.length) {
     console.warn(`[daemon] PATH \u7F3A\u5C11 node\uFF0C\u5DF2\u8865\u5145: ${missing.join(", ")}`);
@@ -4524,37 +4605,62 @@ function buildGitlabSshRemote(repoFullName, baseUrl) {
     return `ssh://git@${host}:${url.port}/${repoFullName}.git`;
   return `git@${host}:${repoFullName}.git`;
 }
-function ensureRepo(workdir, tenantId, repo, env, remoteUrl) {
-  const repoDir = join9(workdir, tenantId, repo);
-  if (existsSync6(join9(repoDir, ".git"))) {
+function buildDaemonRepoUrl(repoFullName, baseUrl) {
+  if (!baseUrl)
+    return `https://github.com/${repoFullName}.git`;
+  const url = new URL(baseUrl);
+  const path = repoFullName.replace(/^\/+/, "");
+  return `${url.protocol}//${url.host}/${path}.git`;
+}
+function ensureRepo(workdir, tenantId, repo, env, remoteUrl, daemonRemoteUrl) {
+  const repoDir = join11(workdir, tenantId, repo);
+  const fetchUrl = daemonRemoteUrl ?? remoteUrl ?? buildDaemonRepoUrl(repo);
+  if (existsSync8(join11(repoDir, ".git"))) {
     if (remoteUrl)
       syncRemoteUrl(repoDir, remoteUrl, env);
     try {
-      execFileSync4("git", ["-C", repoDir, "fetch", "origin", "--prune"], { env, stdio: "pipe" });
-    } catch {
+      if (daemonRemoteUrl) {
+        execFileSync6(
+          "git",
+          ["-C", repoDir, "fetch", "--prune", fetchUrl, "+refs/heads/*:refs/remotes/origin/*"],
+          { env, stdio: "pipe" }
+        );
+      } else {
+        execFileSync6("git", ["-C", repoDir, "fetch", "origin", "--prune"], { env, stdio: "pipe" });
+      }
+    } catch (err) {
+      throw new Error(`REPO_SYNC_FAILED: \u62C9\u53D6\u4ED3\u5E93\u5931\u8D25 ${repo}: ${gitErrorText(err)}`);
     }
     return repoDir;
   }
-  mkdirSync4(repoDir, { recursive: true });
-  execFileSync4("git", ["clone", "--filter=blob:none", remoteUrl ?? `https://github.com/${repo}`, repoDir], {
-    env,
-    stdio: "pipe"
-  });
+  mkdirSync6(repoDir, { recursive: true });
+  try {
+    execFileSync6("git", ["clone", "--filter=blob:none", fetchUrl, repoDir], { env, stdio: "pipe" });
+  } catch (err) {
+    throw new Error(`REPO_SYNC_FAILED: \u514B\u9686\u4ED3\u5E93\u5931\u8D25 ${repo}: ${gitErrorText(err)}`);
+  }
+  if (remoteUrl && remoteUrl !== fetchUrl)
+    syncRemoteUrl(repoDir, remoteUrl, env);
   return repoDir;
 }
+function gitErrorText(err) {
+  const e = err;
+  const stderr = e?.stderr ? e.stderr.toString().trim() : "";
+  return stderr || e?.message || String(err);
+}
 function syncRemoteUrl(repoDir, remoteUrl, env) {
   try {
-    const cur = execFileSync4("git", ["-C", repoDir, "remote", "get-url", "origin"], { env, stdio: "pipe" }).toString().trim();
+    const cur = execFileSync6("git", ["-C", repoDir, "remote", "get-url", "origin"], { env, stdio: "pipe" }).toString().trim();
     if (cur === remoteUrl)
       return;
-    execFileSync4("git", ["-C", repoDir, "remote", "set-url", "origin", remoteUrl], { env, stdio: "pipe" });
+    execFileSync6("git", ["-C", repoDir, "remote", "set-url", "origin", remoteUrl], { env, stdio: "pipe" });
   } catch {
   }
 }
 function isLinkedWorktree(repoDir) {
   try {
-    const gitDir = execFileSync4("git", ["-C", repoDir, "rev-parse", "--absolute-git-dir"], { encoding: "utf8", stdio: "pipe" }).trim();
-    return !!gitDir && existsSync6(join9(gitDir, "commondir"));
+    const gitDir = execFileSync6("git", ["-C", repoDir, "rev-parse", "--absolute-git-dir"], { encoding: "utf8", stdio: "pipe" }).trim();
+    return !!gitDir && existsSync8(join11(gitDir, "commondir"));
   } catch {
     return false;
   }
@@ -4562,7 +4668,7 @@ function isLinkedWorktree(repoDir) {
 function enableWorktreeConfig(repoDir) {
   const getLocal = () => {
     try {
-      return execFileSync4("git", ["-C", repoDir, "config", "--local", "--get", "extensions.worktreeConfig"], { encoding: "utf8", stdio: "pipe" }).trim();
+      return execFileSync6("git", ["-C", repoDir, "config", "--local", "--get", "extensions.worktreeConfig"], { encoding: "utf8", stdio: "pipe" }).trim();
     } catch {
       return null;
     }
@@ -4570,7 +4676,7 @@ function enableWorktreeConfig(repoDir) {
   if (getLocal() === "true")
     return true;
   try {
-    execFileSync4("git", ["-C", repoDir, "config", "--local", "extensions.worktreeConfig", "true"], { stdio: "pipe" });
+    execFileSync6("git", ["-C", repoDir, "config", "--local", "extensions.worktreeConfig", "true"], { stdio: "pipe" });
     return true;
   } catch {
     return getLocal() === "true";
@@ -4581,41 +4687,41 @@ function ensureGitIdentity(repoDir, personaName) {
   const email = `${personaName.replace(/[^a-z0-9-]/gi, "-").toLowerCase()}@morula.local`;
   if (isLinkedWorktree(repoDir)) {
     if (enableWorktreeConfig(repoDir)) {
-      execFileSync4("git", ["-C", repoDir, "config", "--worktree", "user.name", name], { stdio: "pipe" });
-      execFileSync4("git", ["-C", repoDir, "config", "--worktree", "user.email", email], { stdio: "pipe" });
+      execFileSync6("git", ["-C", repoDir, "config", "--worktree", "user.name", name], { stdio: "pipe" });
+      execFileSync6("git", ["-C", repoDir, "config", "--worktree", "user.email", email], { stdio: "pipe" });
       return;
     }
     console.warn(`[daemon] worktree \u7EA7 config \u4E0D\u53EF\u7528\uFF08extensions.worktreeConfig \u542F\u7528\u5931\u8D25\uFF09\uFF0C\u9000\u56DE\u5199\u5171\u4EAB config: ${repoDir}`);
   }
-  execFileSync4("git", ["-C", repoDir, "config", "user.name", name], { stdio: "pipe" });
-  execFileSync4("git", ["-C", repoDir, "config", "user.email", email], { stdio: "pipe" });
+  execFileSync6("git", ["-C", repoDir, "config", "user.name", name], { stdio: "pipe" });
+  execFileSync6("git", ["-C", repoDir, "config", "user.email", email], { stdio: "pipe" });
 }
 
 // src/daemon/outbox.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync6, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readdirSync as readdirSync2, readFileSync as readFileSync6, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { join as join12 } from "node:path";
 var OUTBOX_RETRY_SCHEDULE = [1e3, 4e3, 16e3, 6e4, 3e5];
 var OUTBOX_MAX_AGE_MS = 24 * 36e5;
 function outboxDir(configDir) {
-  const base = configDir ?? process.env.MORULA_CONFIG_DIR ?? join10(homedir7(), ".morula-cli");
-  return join10(base, "daemon", "outbox");
+  const base = configDir ?? process.env.MORULA_CONFIG_DIR ?? join12(homedir9(), ".morula-cli");
+  return join12(base, "daemon", "outbox");
 }
 function writeOutbox(entry, configDir) {
   const dir = outboxDir(configDir);
-  mkdirSync5(dir, { recursive: true, mode: 448 });
-  writeFileSync4(join10(dir, `${entry.taskId}.json`), JSON.stringify(entry), { mode: 384 });
+  mkdirSync7(dir, { recursive: true, mode: 448 });
+  writeFileSync5(join12(dir, `${entry.taskId}.json`), JSON.stringify(entry), { mode: 384 });
 }
 function readOutboxEntries(configDir) {
   const dir = outboxDir(configDir);
-  if (!existsSync7(dir))
+  if (!existsSync9(dir))
     return [];
   const entries = [];
   for (const file of readdirSync2(dir)) {
     if (!file.endsWith(".json"))
       continue;
     try {
-      const raw = readFileSync6(join10(dir, file), "utf8");
+      const raw = readFileSync6(join12(dir, file), "utf8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed.taskId === "string")
         entries.push(parsed);
@@ -4625,17 +4731,17 @@ function readOutboxEntries(configDir) {
   return entries;
 }
 function removeOutbox(taskId, configDir) {
-  rmSync4(join10(outboxDir(configDir), `${taskId}.json`), { force: true });
+  rmSync6(join12(outboxDir(configDir), `${taskId}.json`), { force: true });
 }
 function staleDir(configDir) {
-  return join10(outboxDir(configDir), "stale");
+  return join12(outboxDir(configDir), "stale");
 }
 function archiveOutbox(entry, reason, configDir) {
   const dir = staleDir(configDir);
-  mkdirSync5(dir, { recursive: true, mode: 448 });
+  mkdirSync7(dir, { recursive: true, mode: 448 });
   try {
-    writeFileSync4(
-      join10(dir, `${entry.taskId}.json`),
+    writeFileSync5(
+      join12(dir, `${entry.taskId}.json`),
       JSON.stringify({ ...entry, archivedReason: reason, archivedAt: (/* @__PURE__ */ new Date()).toISOString() }),
       { mode: 384 }
     );
@@ -5622,8 +5728,8 @@ var DimAgentAdapter = class {
     }
   }
   async probe() {
-    const { existsSync: existsSync18 } = await import("node:fs");
-    const installed = existsSync18(this.dimPath) || this.dimPath === "dim";
+    const { existsSync: existsSync19 } = await import("node:fs");
+    const installed = existsSync19(this.dimPath) || this.dimPath === "dim";
     let authStatus = installed ? "unknown" : "error";
     let lastProbeErrorCode = installed ? void 0 : "DIM_CLI_NOT_FOUND";
     let lastProbeError = installed ? void 0 : `\u672A\u627E\u5230 dim CLI\uFF08${this.dimPath}\uFF09`;
@@ -5914,68 +6020,95 @@ function pickLegacyDimModels(inventory) {
 }
 
 // src/daemon/repo-cache.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync6 } from "node:fs";
-import { dirname as dirname5, join as join12 } from "node:path";
+import { execFileSync as execFileSync7 } from "node:child_process";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8 } from "node:fs";
+import { dirname as dirname6, join as join14 } from "node:path";
 function ownerOf(repoFullName) {
   const idx = repoFullName.indexOf("/");
   return idx > 0 ? repoFullName.slice(0, idx) : "_default";
 }
 function buildRepoCachePath(workdir, tenantId, repoFullName) {
-  return join12(workdir, "repos", tenantId, ownerOf(repoFullName), repoFullName);
+  return join14(workdir, "repos", tenantId, ownerOf(repoFullName), repoFullName);
 }
-function openRepoCache(workdir, tenantId, repoFullName, env, remoteUrl) {
+function openRepoCache(workdir, tenantId, repoFullName, env, agentRemoteUrl, daemonRemoteUrl) {
   const repoCachePath = buildRepoCachePath(workdir, tenantId, repoFullName);
-  const url = remoteUrl ?? `https://github.com/${repoFullName}`;
+  const currentOrigin = () => {
+    if (!existsSync11(join14(repoCachePath, ".git")))
+      return null;
+    try {
+      return execFileSync7("git", ["-C", repoCachePath, "remote", "get-url", "origin"], { encoding: "utf8", env, stdio: "pipe" }).trim() || null;
+    } catch {
+      return null;
+    }
+  };
+  const fetchUrl = () => daemonRemoteUrl ?? currentOrigin() ?? agentRemoteUrl ?? `https://github.com/${repoFullName}.git`;
+  const originUrl = () => agentRemoteUrl ?? fetchUrl();
   return {
     repoCachePath,
     ensure() {
-      if (existsSync9(join12(repoCachePath, ".git"))) {
-        if (url)
-          syncRemoteUrl(repoCachePath, url, env);
+      if (existsSync11(join14(repoCachePath, ".git"))) {
+        syncRemoteUrl(repoCachePath, originUrl(), env);
         return;
       }
-      mkdirSync6(dirname5(repoCachePath), { recursive: true });
-      execFileSync5("git", ["clone", "--filter=blob:none", url, repoCachePath], {
-        env,
-        stdio: "pipe"
-      });
+      mkdirSync8(dirname6(repoCachePath), { recursive: true });
+      const cloneUrl = fetchUrl();
+      try {
+        execFileSync7("git", ["clone", "--filter=blob:none", cloneUrl, repoCachePath], { env, stdio: "pipe" });
+      } catch (err) {
+        throw new Error(`REPO_SYNC_FAILED: \u514B\u9686\u4ED3\u5E93\u5931\u8D25 ${repoFullName}: ${gitErrorText2(err)}`);
+      }
+      if (originUrl() !== cloneUrl)
+        syncRemoteUrl(repoCachePath, originUrl(), env);
     },
     fetch() {
       try {
-        execFileSync5("git", ["-C", repoCachePath, "fetch", "origin", "--prune"], { env, stdio: "pipe" });
-      } catch {
+        if (daemonRemoteUrl) {
+          execFileSync7(
+            "git",
+            ["-C", repoCachePath, "fetch", "--prune", daemonRemoteUrl, "+refs/heads/*:refs/remotes/origin/*"],
+            { env, stdio: "pipe" }
+          );
+        } else {
+          execFileSync7("git", ["-C", repoCachePath, "fetch", "origin", "--prune"], { env, stdio: "pipe" });
+        }
+      } catch (err) {
+        throw new Error(`REPO_SYNC_FAILED: \u62C9\u53D6\u4ED3\u5E93\u5931\u8D25 ${repoFullName}: ${gitErrorText2(err)}`);
       }
     }
   };
 }
+function gitErrorText2(err) {
+  const e = err;
+  const stderr = e?.stderr ? e.stderr.toString().trim() : "";
+  return stderr || e?.message || String(err);
+}
 
 // src/daemon/repo-checkout-service.ts
 import { createServer as createServer3 } from "node:http";
-import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync8, readdirSync as readdirSync4, writeFileSync as writeFileSync7 } from "node:fs";
-import { basename as basename2, join as join15 } from "node:path";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { existsSync as existsSync14, mkdirSync as mkdirSync10, readdirSync as readdirSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { basename as basename2, join as join17 } from "node:path";
 
 // src/daemon/worktree-manager.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync3, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync5, statSync as statSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename, join as join14, sep as sep2 } from "node:path";
+import { execFileSync as execFileSync8 } from "node:child_process";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync7, statSync as statSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename, join as join16, sep as sep2 } from "node:path";
 
 // src/daemon/workspace-marker.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join15 } from "node:path";
 var WORKTREE_MARKER_FILE = ".morula-worktree.json";
 var WORKTREE_MARKER_SCHEMA = 1;
 function markerPath(worktreePath) {
-  return join13(worktreePath, WORKTREE_MARKER_FILE);
+  return join15(worktreePath, WORKTREE_MARKER_FILE);
 }
 function writeWorktreeMarker(worktreePath, marker) {
-  writeFileSync5(markerPath(worktreePath), `${JSON.stringify(marker, null, 2)}
+  writeFileSync6(markerPath(worktreePath), `${JSON.stringify(marker, null, 2)}
 `, "utf8");
 }
 function readWorktreeMarker(worktreePath) {
   const p = markerPath(worktreePath);
-  if (!existsSync10(p))
+  if (!existsSync12(p))
     return null;
   try {
     const raw = JSON.parse(readFileSync8(p, "utf8"));
@@ -6002,42 +6135,42 @@ function buildTaskRootPath(workdir, tenantId, runtimeId, workContextId, code) {
     throw new Error("WORKTREE_RUNTIME_ID_MISSING: \u7F3A\u5C11 runtimeId\uFF0C\u65E0\u6CD5\u6784\u9020\u6309\u6267\u884C\u8005\u9694\u79BB\u7684 worktree \u8DEF\u5F84");
   }
   const dirName = code ? `${safeDirName(code)}-${workContextId.slice(0, 8)}` : workContextId;
-  return join14(workdir, "worktrees", tenantId, runtimeSegment, dirName);
+  return join16(workdir, "worktrees", tenantId, runtimeSegment, dirName);
 }
 function buildWorktreePath(workdir, tenantId, runtimeId, workContextId, code, repoFullName) {
-  return join14(buildTaskRootPath(workdir, tenantId, runtimeId, workContextId, code), safeDirName(repoFullName));
+  return join16(buildTaskRootPath(workdir, tenantId, runtimeId, workContextId, code), safeDirName(repoFullName));
 }
 function buildLegacyWorktreePath(workdir, tenantId, workContextId, code) {
   const dirName = code ? `${safeDirName(code)}-${workContextId.slice(0, 8)}` : workContextId;
-  return join14(workdir, "worktrees", tenantId, dirName);
+  return join16(workdir, "worktrees", tenantId, dirName);
 }
 var legacyPathWarned = /* @__PURE__ */ new Set();
 function warnLegacyWorktreeResidue(legacyPath) {
-  if (legacyPathWarned.has(legacyPath) || !existsSync11(legacyPath))
+  if (legacyPathWarned.has(legacyPath) || !existsSync13(legacyPath))
     return;
   legacyPathWarned.add(legacyPath);
   console.warn(`[daemon] \u68C0\u6D4B\u5230\u65E7\u5F62\u6001 worktree \u6B8B\u7559\uFF08\u4E0D\u542B runtimeId \u6BB5\uFF09: ${legacyPath} \u2014\u2014 \u8BE5\u8DEF\u5F84\u5DF2\u5F03\u7528\uFF0C\u65B0\u4EFB\u52A1\u4F7F\u7528 <worktree>/<tenant>/<runtimeId8>/<task>\uFF1B\u786E\u8BA4\u65E0\u9700\u4FDD\u7559\u540E\u53EF\u624B\u52A8\u5220\u9664\uFF08\u4E0D\u81EA\u52A8\u8FC1\u79FB/\u6E05\u7406\uFF09`);
 }
 var legacyLayoutWarned = /* @__PURE__ */ new Set();
 function warnLegacyLayoutWorktreeResidue(taskRoot, worktreePath) {
-  if (legacyLayoutWarned.has(taskRoot) || existsSync11(worktreePath) || !existsSync11(join14(taskRoot, WORKTREE_MARKER_FILE)))
+  if (legacyLayoutWarned.has(taskRoot) || existsSync13(worktreePath) || !existsSync13(join16(taskRoot, WORKTREE_MARKER_FILE)))
     return;
   legacyLayoutWarned.add(taskRoot);
   console.warn(`[daemon] \u68C0\u6D4B\u5230\u65E7\u5E03\u5C40\u4EFB\u52A1\u5DE5\u4F5C\u533A\uFF08\u4ED3\u5E93\u76F4\u63A5\u4F4D\u4E8E\u5DE5\u4F5C\u533A\u6839\uFF09: ${taskRoot} \u2014\u2014 \u65B0\u5E03\u5C40\u4F1A\u5728\u5176\u4E0B\u521B\u5EFA\u4ED3\u5E93\u5B50\u76EE\u5F55\uFF0C\u65E7\u76EE\u5F55\u5185\u5BB9\u4E0D\u518D\u88AB\u4F7F\u7528\uFF1B\u5176\u4E2D\u53EF\u80FD\u6709\u672A\u63A8\u9001\u6539\u52A8\uFF0C\u786E\u8BA4\u65E0\u9700\u4FDD\u7559\u540E\u53EF\u624B\u52A8\u5220\u9664\uFF08\u4E0D\u81EA\u52A8\u8FC1\u79FB/\u6E05\u7406\uFF09`);
 }
 function ensureMarkerIgnoredAndCommitted(worktreePath, env) {
-  const gitignorePath = join14(worktreePath, ".gitignore");
-  const existing = existsSync11(gitignorePath) ? readFileSync9(gitignorePath, "utf8") : "";
+  const gitignorePath = join16(worktreePath, ".gitignore");
+  const existing = existsSync13(gitignorePath) ? readFileSync9(gitignorePath, "utf8") : "";
   const requiredLines = [WORKTREE_MARKER_FILE];
   const missing = requiredLines.filter((l) => !existing.split("\n").some((line) => line.trim() === l));
   if (missing.length > 0) {
     const next = `${existing.trimEnd() ? `${existing.trimEnd()}
 ` : ""}${missing.join("\n")}
 `;
-    writeFileSync6(gitignorePath, next, "utf8");
+    writeFileSync7(gitignorePath, next, "utf8");
     try {
-      execFileSync6("git", ["-C", worktreePath, "add", ".gitignore"], { env, stdio: "pipe" });
-      execFileSync6(
+      execFileSync8("git", ["-C", worktreePath, "add", ".gitignore"], { env, stdio: "pipe" });
+      execFileSync8(
         "git",
         ["-C", worktreePath, "-c", "user.name=morula-daemon", "-c", "user.email=morula-daemon@morula.local", "commit", "-q", "-m", "chore: track morula worktree marker"],
         { env, stdio: "pipe" }
@@ -6048,7 +6181,7 @@ function ensureMarkerIgnoredAndCommitted(worktreePath, env) {
 }
 function currentBranch(repoPath) {
   try {
-    const out = execFileSync6("git", ["-C", repoPath, "symbolic-ref", "--short", "HEAD"], {
+    const out = execFileSync8("git", ["-C", repoPath, "symbolic-ref", "--short", "HEAD"], {
       encoding: "utf8",
       stdio: "pipe"
     }).trim();
@@ -6059,13 +6192,13 @@ function currentBranch(repoPath) {
 }
 function resolveDeliveryBranch(repoPath, env, snapshotBranch) {
   try {
-    const current = execFileSync6("git", ["-C", repoPath, "branch", "--show-current"], { encoding: "utf-8", env }).trim();
+    const current = execFileSync8("git", ["-C", repoPath, "branch", "--show-current"], { encoding: "utf-8", env }).trim();
     if (current)
       return current;
   } catch {
   }
   try {
-    const out = execFileSync6("git", ["-C", repoPath, "branch", "-r", "--contains", "HEAD"], { encoding: "utf-8", env }).trim();
+    const out = execFileSync8("git", ["-C", repoPath, "branch", "-r", "--contains", "HEAD"], { encoding: "utf-8", env }).trim();
     const first = out.split("\n").map((l) => l.trim()).find((l) => l && !l.includes("->"));
     if (first)
       return first.replace(/^origin\//, "");
@@ -6076,7 +6209,7 @@ function resolveDeliveryBranch(repoPath, env, snapshotBranch) {
 }
 function headCommitSubject(repoPath, env) {
   try {
-    const out = execFileSync6("git", ["-C", repoPath, "log", "-1", "--format=%s"], {
+    const out = execFileSync8("git", ["-C", repoPath, "log", "-1", "--format=%s"], {
       encoding: "utf8",
       stdio: "pipe",
       ...env ? { env } : {}
@@ -6088,7 +6221,7 @@ function headCommitSubject(repoPath, env) {
 }
 function hasLocalChanges(repoPath, env) {
   try {
-    const out = execFileSync6("git", ["-C", repoPath, "status", "--porcelain"], {
+    const out = execFileSync8("git", ["-C", repoPath, "status", "--porcelain"], {
       encoding: "utf8",
       stdio: "pipe",
       ...env ? { env } : {}
@@ -6114,27 +6247,27 @@ function sleepSync2(ms) {
 function backoffMs(baseMs, random = Math.random) {
   return Math.round(baseMs * (0.5 + random() * 0.5));
 }
-function gitErrorText(err) {
+function gitErrorText3(err) {
   const e = err;
   const stderr = e?.stderr ? e.stderr.toString() : "";
   return `${stderr}${stderr ? "\n" : ""}${e?.message ?? String(err)}`;
 }
 function isIndexLockConflict(err) {
-  const text = gitErrorText(err);
+  const text = gitErrorText3(err);
   return /index\.lock/i.test(text) || /另一个 git 进程|another git process/i.test(text);
 }
 function worktreeIndexLockPath(repoCachePath, worktreePath) {
-  return join14(repoCachePath, ".git", "worktrees", basename(worktreePath), "index.lock");
+  return join16(repoCachePath, ".git", "worktrees", basename(worktreePath), "index.lock");
 }
 function indexLockPathFromError(text) {
   const m = text.match(/[^\s'‘’"]*index\.lock/);
   return m && m[0].length > "index.lock".length ? m[0] : null;
 }
 function waitForIndexLockRelease(lockPath, timeoutMs = INDEX_LOCK_WAIT_MAX_MS, pollMs = INDEX_LOCK_POLL_MS) {
-  if (!existsSync11(lockPath))
+  if (!existsSync13(lockPath))
     return true;
   const deadline = Date.now() + timeoutMs;
-  while (existsSync11(lockPath)) {
+  while (existsSync13(lockPath)) {
     const remain = deadline - Date.now();
     if (remain <= 0)
       return false;
@@ -6144,7 +6277,7 @@ function waitForIndexLockRelease(lockPath, timeoutMs = INDEX_LOCK_WAIT_MAX_MS, p
 }
 function addWorktreeWithRetry(repoCachePath, worktreePath, ref, deps = {}) {
   const runAdd = deps.runAdd ?? ((argv2) => {
-    execFileSync6("git", argv2, { stdio: "pipe" });
+    execFileSync8("git", argv2, { stdio: "pipe" });
   });
   const argv = ["-C", repoCachePath, "worktree", "add", "--detach", worktreePath, ref];
   const waitMs = deps.indexLockWaitMs ?? INDEX_LOCK_WAIT_MAX_MS;
@@ -6161,7 +6294,7 @@ function addWorktreeWithRetry(repoCachePath, worktreePath, ref, deps = {}) {
         throw err;
       if (attempt === WORKTREE_ADD_MAX_ATTEMPTS)
         break;
-      const lockPath = indexLockPathFromError(gitErrorText(err)) ?? worktreeIndexLockPath(repoCachePath, worktreePath);
+      const lockPath = indexLockPathFromError(gitErrorText3(err)) ?? worktreeIndexLockPath(repoCachePath, worktreePath);
       const released = waitForIndexLockRelease(lockPath, waitMs);
       const backoff = backoffMs(WORKTREE_ADD_BACKOFF_MS[attempt - 1]);
       console.warn(
@@ -6170,7 +6303,7 @@ function addWorktreeWithRetry(repoCachePath, worktreePath, ref, deps = {}) {
       sleepSync2(backoff);
     }
   }
-  throw new Error(`WORKTREE_ADD_FAILED: worktree add \u8FDE\u7EED ${WORKTREE_ADD_MAX_ATTEMPTS} \u6B21\u5931\u8D25\uFF08${gitErrorText(lastErr).trim()}\uFF09`);
+  throw new Error(`WORKTREE_ADD_FAILED: worktree add \u8FDE\u7EED ${WORKTREE_ADD_MAX_ATTEMPTS} \u6B21\u5931\u8D25\uFF08${gitErrorText3(lastErr).trim()}\uFF09`);
 }
 var FOREIGN_RESIDUE_MAX_ENTRIES = 64;
 var FOREIGN_RESIDUE_SCAN_LIMIT = 2e3;
@@ -6200,7 +6333,7 @@ function inspectForeignDirectory(dir) {
       if (count >= FOREIGN_RESIDUE_SCAN_LIMIT)
         return;
       count++;
-      const full = join14(p, e.name);
+      const full = join16(p, e.name);
       try {
         const st = statSync2(full);
         bytes += st.size;
@@ -6232,13 +6365,13 @@ function reportForeignResidue(worktreePath, forensics, cleaned) {
     console.warn(`[daemon] ${detail}`);
 }
 function prepareWorktree(input) {
-  const cache = openRepoCache(input.workdir, input.tenantId, input.repoFullName, input.env, input.remoteUrl);
+  const cache = openRepoCache(input.workdir, input.tenantId, input.repoFullName, input.env, input.remoteUrl, input.daemonRemoteUrl);
   cache.ensure();
   cache.fetch();
   const requestedBase = input.baseBranch?.trim();
   const hasRef = (ref) => {
     try {
-      execFileSync6("git", ["-C", cache.repoCachePath, "rev-parse", "--verify", `origin/${ref}`], { stdio: "pipe" });
+      execFileSync8("git", ["-C", cache.repoCachePath, "rev-parse", "--verify", `origin/${ref}`], { stdio: "pipe" });
       return true;
     } catch {
       return false;
@@ -6250,14 +6383,14 @@ function prepareWorktree(input) {
     } else {
       const remoteHead = (() => {
         try {
-          const out = execFileSync6("git", ["-C", cache.repoCachePath, "symbolic-ref", "refs/remotes/origin/HEAD"], { encoding: "utf-8", stdio: "pipe" }).trim();
+          const out = execFileSync8("git", ["-C", cache.repoCachePath, "symbolic-ref", "refs/remotes/origin/HEAD"], { encoding: "utf-8", stdio: "pipe" }).trim();
           const name = out.replace(/^refs\/remotes\/origin\//, "");
           if (name && hasRef(name))
             return name;
         } catch {
         }
         try {
-          const out = execFileSync6("git", ["-C", cache.repoCachePath, "ls-remote", "--symref", "origin", "HEAD"], { encoding: "utf-8", stdio: "pipe" });
+          const out = execFileSync8("git", ["-C", cache.repoCachePath, "ls-remote", "--symref", "origin", "HEAD"], { encoding: "utf-8", stdio: "pipe" });
           const m = out.match(/^ref:\s+refs\/heads\/(\S+)\s+HEAD/m);
           return m?.[1] ?? null;
         } catch {
@@ -6276,10 +6409,10 @@ function prepareWorktree(input) {
   const worktreePath = buildWorktreePath(input.workdir, input.tenantId, input.runtimeId, input.workContextId, input.code, input.repoFullName);
   warnLegacyWorktreeResidue(buildLegacyWorktreePath(input.workdir, input.tenantId, input.workContextId, input.code));
   warnLegacyLayoutWorktreeResidue(taskRoot, worktreePath);
-  if (existsSync11(worktreePath)) {
+  if (existsSync13(worktreePath)) {
     const isGitRepo = (() => {
       try {
-        execFileSync6("git", ["-C", worktreePath, "rev-parse", "--git-dir"], { stdio: "pipe" });
+        execFileSync8("git", ["-C", worktreePath, "rev-parse", "--git-dir"], { stdio: "pipe" });
         return true;
       } catch {
         return false;
@@ -6288,7 +6421,7 @@ function prepareWorktree(input) {
     if (!isGitRepo) {
       const forensics = inspectForeignDirectory(worktreePath);
       try {
-        rmSync5(worktreePath, { recursive: true, force: true });
+        rmSync7(worktreePath, { recursive: true, force: true });
       } catch {
         reportForeignResidue(worktreePath, forensics, false);
         throw new Error(`WORKTREE_RESIDUE: \u76EE\u5F55 ${worktreePath} \u6B8B\u7559\u4E14\u6E05\u7406\u5931\u8D25\uFF0C\u8BF7\u4EBA\u5DE5\u5904\u7406`);
@@ -6306,11 +6439,11 @@ function prepareWorktree(input) {
       }
       const branch = currentBranch(worktreePath);
       if (!branch) {
-        const dirtyOut = execFileSync6("git", ["-C", worktreePath, "status", "--porcelain"], { encoding: "utf8", stdio: "pipe" }).trim();
+        const dirtyOut = execFileSync8("git", ["-C", worktreePath, "status", "--porcelain"], { encoding: "utf8", stdio: "pipe" }).trim();
         const dirty = dirtyOut.split("\n").filter(
           (l) => l.trim() && !l.trim().startsWith("?? .agents") && !l.trim().startsWith("?? .agent_context") && !l.trim().startsWith("?? .morula")
         ).join("\n");
-        const extraCommits = Number(execFileSync6(
+        const extraCommits = Number(execFileSync8(
           "git",
           ["-C", worktreePath, "rev-list", "--count", `origin/${input.baseBranch}..HEAD`],
           { encoding: "utf8", stdio: "pipe" }
@@ -6318,7 +6451,7 @@ function prepareWorktree(input) {
         const rescueTag = buildRescueTag(input.workContextId, input.code);
         if (dirty.length > 0) {
           try {
-            execFileSync6(
+            execFileSync8(
               "git",
               ["-C", worktreePath, "stash", "push", "-u", "-m", `morula-rescue ${rescueTag}`],
               { stdio: "pipe" }
@@ -6329,9 +6462,9 @@ function prepareWorktree(input) {
           }
         }
         if (extraCommits > 1) {
-          const headSha2 = execFileSync6("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8", stdio: "pipe" }).trim();
+          const headSha2 = execFileSync8("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8", stdio: "pipe" }).trim();
           try {
-            execFileSync6("git", ["-C", cache.repoCachePath, "update-ref", `refs/morula-rescue/${rescueTag}`, headSha2], { stdio: "pipe" });
+            execFileSync8("git", ["-C", cache.repoCachePath, "update-ref", `refs/morula-rescue/${rescueTag}`, headSha2], { stdio: "pipe" });
             console.warn(`[daemon] worktree \u6F02\u79FB\u81EA\u52A8\u6062\u590D: detached \u672A\u63A8\u9001\u63D0\u4EA4\u5DF2\u5B58 refs/morula-rescue/${rescueTag}\uFF08git -C ${cache.repoCachePath} log -1 refs/morula-rescue/${rescueTag} \u67E5\u770B\uFF09`);
           } catch {
             throw new Error("WORKTREE_BRANCH_DRIFT: worktree \u5904\u4E8E detached \u4E14\u542B\u672A\u63A8\u9001\u63D0\u4EA4\uFF0C\u81EA\u52A8\u5F15\u7528\u4FDD\u5168\u5931\u8D25\uFF0C\u62D2\u7EDD\u81EA\u52A8\u91CD\u5EFA\uFF08\u8BF7\u5148\u4EBA\u5DE5\u5904\u7406\uFF09");
@@ -6343,8 +6476,8 @@ function prepareWorktree(input) {
       }
     }
   }
-  if (!existsSync11(worktreePath)) {
-    mkdirSync7(join14(worktreePath, ".."), { recursive: true });
+  if (!existsSync13(worktreePath)) {
+    mkdirSync9(join16(worktreePath, ".."), { recursive: true });
     addWorktreeWithRetry(cache.repoCachePath, worktreePath, `origin/${input.baseBranch}`);
     writeWorktreeMarker(worktreePath, {
       schemaVersion: 1,
@@ -6360,9 +6493,9 @@ function prepareWorktree(input) {
   }
   {
     const dotMorulaRescue = `${worktreePath}.morula-rescue`;
-    if (existsSync11(dotMorulaRescue)) {
-      const dotMorulaDir = join14(worktreePath, ".morula");
-      if (!existsSync11(dotMorulaDir)) {
+    if (existsSync13(dotMorulaRescue)) {
+      const dotMorulaDir = join16(worktreePath, ".morula");
+      if (!existsSync13(dotMorulaDir)) {
         try {
           renameSync2(dotMorulaRescue, dotMorulaDir);
           console.warn(`[daemon] worktree \u6F02\u79FB\u81EA\u52A8\u6062\u590D: \u65E7\u7248 .morula/ \u5907\u4EFD\u5DF2\u5F52\u8FD8\uFF08checkout \u51ED\u636E\u4E0E\u6B21\u4ED3\u5E93\u4FDD\u7559\uFF09`);
@@ -6370,11 +6503,11 @@ function prepareWorktree(input) {
           console.warn(`[daemon] worktree \u6F02\u79FB\u81EA\u52A8\u6062\u590D: .morula/ \u5F52\u8FD8\u5931\u8D25\uFF0C\u5907\u4EFD\u4FDD\u7559\u5728 ${dotMorulaRescue}`);
         }
       } else {
-        rmSync5(dotMorulaRescue, { recursive: true, force: true });
+        rmSync7(dotMorulaRescue, { recursive: true, force: true });
       }
     }
   }
-  const headSha = execFileSync6("git", ["-C", worktreePath, "rev-parse", "HEAD"], {
+  const headSha = execFileSync8("git", ["-C", worktreePath, "rev-parse", "HEAD"], {
     encoding: "utf8",
     stdio: "pipe"
   }).trim();
@@ -6390,10 +6523,10 @@ function prepareWorktree(input) {
   };
 }
 function resolveWorkspaceLayout(root, expected) {
-  const primaryDir = join14(root, safeDirName(expected.repoFullName));
-  if (existsSync11(join14(primaryDir, WORKTREE_MARKER_FILE)))
+  const primaryDir = join16(root, safeDirName(expected.repoFullName));
+  if (existsSync13(join16(primaryDir, WORKTREE_MARKER_FILE)))
     return { primaryDir, legacy: false };
-  if (existsSync11(join14(root, WORKTREE_MARKER_FILE)))
+  if (existsSync13(join16(root, WORKTREE_MARKER_FILE)))
     return { primaryDir: root, legacy: true };
   return null;
 }
@@ -6408,7 +6541,7 @@ function validateRemovable(taskRoot, expected, repoCachePath) {
     return "MARKER_MISMATCH";
   const { primaryDir, legacy } = layout;
   try {
-    const status3 = execFileSync6("git", ["-C", primaryDir, "status", "--porcelain"], {
+    const status3 = execFileSync8("git", ["-C", primaryDir, "status", "--porcelain"], {
       encoding: "utf8",
       stdio: "pipe"
     }).trim();
@@ -6417,11 +6550,11 @@ function validateRemovable(taskRoot, expected, repoCachePath) {
     ).join("\n");
     if (statusRelevant.length > 0)
       return "WORKTREE_DIRTY";
-    const additionalActivity = legacy ? findActivityInReposDir(join14(primaryDir, ".morula", "repos")) : findAdditionalRepoActivity(taskRoot, { excludeDirs: [primaryDir] });
+    const additionalActivity = legacy ? findActivityInReposDir(join16(primaryDir, ".morula", "repos")) : findAdditionalRepoActivity(taskRoot, { excludeDirs: [primaryDir] });
     if (additionalActivity)
       return "WORKTREE_DIRTY";
     try {
-      const unpushed = execFileSync6("git", ["-C", primaryDir, "log", "--oneline", `${expected.branchName}@{upstream}..HEAD`], {
+      const unpushed = execFileSync8("git", ["-C", primaryDir, "log", "--oneline", `${expected.branchName}@{upstream}..HEAD`], {
         encoding: "utf8",
         stdio: "pipe"
       }).trim();
@@ -6437,13 +6570,13 @@ function validateRemovable(taskRoot, expected, repoCachePath) {
 }
 function repoHasActivity(repoPath) {
   try {
-    const status3 = execFileSync6("git", ["-C", repoPath, "status", "--porcelain"], { encoding: "utf8", stdio: "pipe" }).trim();
+    const status3 = execFileSync8("git", ["-C", repoPath, "status", "--porcelain"], { encoding: "utf8", stdio: "pipe" }).trim();
     if (status3)
       return true;
-    const branches = execFileSync6("git", ["-C", repoPath, "for-each-ref", "--format=%(refname:short)", "refs/heads/"], { encoding: "utf8", stdio: "pipe" }).trim().split("\n").filter(Boolean);
+    const branches = execFileSync8("git", ["-C", repoPath, "for-each-ref", "--format=%(refname:short)", "refs/heads/"], { encoding: "utf8", stdio: "pipe" }).trim().split("\n").filter(Boolean);
     for (const b of branches) {
       try {
-        const unpushed = execFileSync6("git", ["-C", repoPath, "log", "--oneline", b, "--not", "--remotes=origin"], { encoding: "utf8", stdio: "pipe" }).trim();
+        const unpushed = execFileSync8("git", ["-C", repoPath, "log", "--oneline", b, "--not", "--remotes=origin"], { encoding: "utf8", stdio: "pipe" }).trim();
         if (unpushed)
           return true;
       } catch {
@@ -6456,7 +6589,7 @@ function repoHasActivity(repoPath) {
   return false;
 }
 function findActivityInReposDir(reposDir) {
-  if (!existsSync11(reposDir))
+  if (!existsSync13(reposDir))
     return null;
   let names = [];
   try {
@@ -6465,8 +6598,8 @@ function findActivityInReposDir(reposDir) {
     return null;
   }
   for (const name of names) {
-    const repoPath = join14(reposDir, name);
-    if (!existsSync11(join14(repoPath, ".git")))
+    const repoPath = join16(reposDir, name);
+    if (!existsSync13(join16(repoPath, ".git")))
       continue;
     if (repoHasActivity(repoPath))
       return repoPath;
@@ -6481,16 +6614,16 @@ function findAdditionalRepoActivity(taskRoot, options = {}) {
   } catch {
     return null;
   }
-  const candidates = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => join14(taskRoot, e.name)).filter((dir) => !excluded.has(dir));
-  const legacyReposDir = join14(taskRoot, ".morula", "repos");
-  if (existsSync11(legacyReposDir)) {
+  const candidates = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => join16(taskRoot, e.name)).filter((dir) => !excluded.has(dir));
+  const legacyReposDir = join16(taskRoot, ".morula", "repos");
+  if (existsSync13(legacyReposDir)) {
     try {
-      candidates.push(...readdirSync3(legacyReposDir).map((n) => join14(legacyReposDir, n)));
+      candidates.push(...readdirSync3(legacyReposDir).map((n) => join16(legacyReposDir, n)));
     } catch {
     }
   }
   for (const repoPath of candidates) {
-    if (!existsSync11(join14(repoPath, ".git")))
+    if (!existsSync13(join16(repoPath, ".git")))
       continue;
     if (repoHasActivity(repoPath))
       return repoPath;
@@ -6498,18 +6631,18 @@ function findAdditionalRepoActivity(taskRoot, options = {}) {
   return null;
 }
 function cleanupInjectedSkills(dir) {
-  const injectedSkillsRoot = join14(dir, ".agents", "skills");
-  if (!existsSync11(injectedSkillsRoot))
+  const injectedSkillsRoot = join16(dir, ".agents", "skills");
+  if (!existsSync13(injectedSkillsRoot))
     return;
   try {
     for (const name of readdirSync3(injectedSkillsRoot)) {
       if (name === COLLABORATION_SKILL_NAME || /^[\w-]{1,64}$/.test(name)) {
-        rmSync5(join14(injectedSkillsRoot, name), { recursive: true, force: true });
+        rmSync7(join16(injectedSkillsRoot, name), { recursive: true, force: true });
       }
     }
     if (readdirSync3(injectedSkillsRoot).length === 0) {
-      rmSync5(join14(dir, ".agents", "skills"), { recursive: true, force: true });
-      rmSync5(join14(dir, ".agents"), { recursive: true, force: true });
+      rmSync7(join16(dir, ".agents", "skills"), { recursive: true, force: true });
+      rmSync7(join16(dir, ".agents"), { recursive: true, force: true });
     }
   } catch {
   }
@@ -6525,11 +6658,11 @@ function collectSiblingGitCommonDirs(taskRoot, excludeDir) {
   for (const e of entries) {
     if (!e.isDirectory() || e.name.startsWith("."))
       continue;
-    const repoPath = join14(taskRoot, e.name);
-    if (repoPath === excludeDir || !existsSync11(join14(repoPath, ".git")))
+    const repoPath = join16(taskRoot, e.name);
+    if (repoPath === excludeDir || !existsSync13(join16(repoPath, ".git")))
       continue;
     try {
-      const commonDir = execFileSync6("git", ["-C", repoPath, "rev-parse", "--path-format=absolute", "--git-common-dir"], { encoding: "utf8", stdio: "pipe" }).trim();
+      const commonDir = execFileSync8("git", ["-C", repoPath, "rev-parse", "--path-format=absolute", "--git-common-dir"], { encoding: "utf8", stdio: "pipe" }).trim();
       if (commonDir)
         dirs.add(commonDir);
     } catch {
@@ -6543,37 +6676,37 @@ function removeTaskWorkspace(repoCachePath, taskRoot, expected) {
     throw new Error("MARKER_MISMATCH");
   const { primaryDir, legacy } = layout;
   if (!legacy) {
-    if (primaryDir !== join14(taskRoot, safeDirName(expected.repoFullName)) || !isManagedWorkspaceRoot(taskRoot))
+    if (primaryDir !== join16(taskRoot, safeDirName(expected.repoFullName)) || !isManagedWorkspaceRoot(taskRoot))
       throw new Error("GIT_REMOVE_FAILED");
   }
   cleanupInjectedSkills(legacy ? primaryDir : taskRoot);
   const siblingCommonDirs = legacy ? [] : collectSiblingGitCommonDirs(taskRoot, primaryDir);
   try {
-    rmSync5(taskRoot, { recursive: true, force: true });
+    rmSync7(taskRoot, { recursive: true, force: true });
   } catch {
     throw new Error("GIT_REMOVE_FAILED");
   }
   for (const dir of [repoCachePath, ...siblingCommonDirs]) {
     try {
-      execFileSync6("git", ["-C", dir, "worktree", "prune"], { stdio: "pipe" });
+      execFileSync8("git", ["-C", dir, "worktree", "prune"], { stdio: "pipe" });
     } catch {
     }
   }
 }
 function removeWorktree(repoCachePath, worktreePath) {
-  if (!existsSync11(worktreePath))
+  if (!existsSync13(worktreePath))
     return;
   try {
     cleanupInjectedSkills(worktreePath);
-    execFileSync6("git", ["-C", repoCachePath, "worktree", "remove", "--force", worktreePath], { stdio: "pipe" });
-    execFileSync6("git", ["-C", repoCachePath, "worktree", "prune"], { stdio: "pipe" });
+    execFileSync8("git", ["-C", repoCachePath, "worktree", "remove", "--force", worktreePath], { stdio: "pipe" });
+    execFileSync8("git", ["-C", repoCachePath, "worktree", "prune"], { stdio: "pipe" });
   } catch {
     throw new Error("GIT_REMOVE_FAILED");
   }
 }
 
 // src/daemon/repo-checkout-service.ts
-var CHECKOUT_JSON_FILE = join15(".morula", "checkout.json");
+var CHECKOUT_JSON_FILE = join17(".morula", "checkout.json");
 var LocalRepoCheckoutService = class {
   constructor(opts) {
     this.opts = opts;
@@ -6661,9 +6794,9 @@ var LocalRepoCheckoutService = class {
       return;
     this.tasks.set(taskId, { workdir, checkToken, primaryRepoDir });
     try {
-      const dir = join15(workdir, ".morula");
-      mkdirSync8(dir, { recursive: true, mode: 448 });
-      writeFileSync7(join15(dir, "checkout.json"), JSON.stringify({
+      const dir = join17(workdir, ".morula");
+      mkdirSync10(dir, { recursive: true, mode: 448 });
+      writeFileSync8(join17(dir, "checkout.json"), JSON.stringify({
         taskId,
         port: this.boundPort,
         checkToken
@@ -6717,7 +6850,8 @@ var LocalRepoCheckoutService = class {
         this.opts.tenantId,
         repoFullName,
         env,
-        baseUrl ? buildGitlabSshRemote(repoFullName, baseUrl) : void 0
+        baseUrl ? buildGitlabSshRemote(repoFullName, baseUrl) : void 0,
+        baseUrl ? buildDaemonRepoUrl(repoFullName, baseUrl) : void 0
       );
       cache.ensure();
       cache.fetch();
@@ -6725,14 +6859,16 @@ var LocalRepoCheckoutService = class {
         repoCachePath: cache.repoCachePath,
         taskRoot: task.workdir,
         repoFullName,
+        baseBranch: serverRes.baseBranch,
+        ref: req.ref,
         env
       });
-      const headSha = execFileSync7("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8", env, stdio: "pipe" }).trim();
+      const headSha = execFileSync9("git", ["-C", worktreePath, "rev-parse", "HEAD"], { encoding: "utf8", env, stdio: "pipe" }).trim();
       return {
         ok: true,
         path: worktreePath,
         headSha,
-        branchName: execFileSync7("git", ["-C", worktreePath, "branch", "--show-current"], { encoding: "utf8", env, stdio: "pipe" }).trim() || null
+        branchName: execFileSync9("git", ["-C", worktreePath, "branch", "--show-current"], { encoding: "utf8", env, stdio: "pipe" }).trim() || null
       };
     } catch (e) {
       return { ok: false, code: "CHECKOUT_FAILED", error: e instanceof Error ? e.message : String(e) };
@@ -6778,7 +6914,8 @@ var LocalRepoCheckoutService = class {
         this.opts.tenantId,
         repoFullName,
         env,
-        baseUrl ? buildGitlabSshRemote(repoFullName, baseUrl) : void 0
+        baseUrl ? buildGitlabSshRemote(repoFullName, baseUrl) : void 0,
+        baseUrl ? buildDaemonRepoUrl(repoFullName, baseUrl) : void 0
       );
       cache.ensure();
       cache.fetch();
@@ -6792,7 +6929,7 @@ var LocalRepoCheckoutService = class {
         env
       });
       syncGitIdentity(task.primaryRepoDir ?? task.workdir, targetPath, env);
-      const headSha = execFileSync7("git", ["-C", targetPath, "rev-parse", "HEAD"], { encoding: "utf8", env, stdio: "pipe" }).trim();
+      const headSha = execFileSync9("git", ["-C", targetPath, "rev-parse", "HEAD"], { encoding: "utf8", env, stdio: "pipe" }).trim();
       this.recordPreparedRepo(req.taskId, repoFullName, {
         workContextId: serverRes.workContextId,
         baseBranch: baseBranch || void 0,
@@ -6823,38 +6960,90 @@ function isReadOnlyRepoDir(dirName) {
   return READ_ONLY_DIR_RE.test(dirName) || dirName.startsWith(LEGACY_READ_ONLY_DIR_PREFIX);
 }
 function resolveRepoTargetDir(taskRoot, base) {
-  const direct = join15(taskRoot, base);
-  if (!existsSync12(direct) || existsSync12(join15(direct, ".git")))
+  const direct = join17(taskRoot, base);
+  if (!existsSync14(direct) || existsSync14(join17(direct, ".git")))
     return direct;
   for (let i = 2; i < 100; i++) {
-    const candidate = join15(taskRoot, `${base}-${i}`);
-    if (!existsSync12(candidate))
+    const candidate = join17(taskRoot, `${base}-${i}`);
+    if (!existsSync14(candidate))
       return candidate;
   }
   throw new Error(`REPO_DIR_CONFLICT: ${taskRoot} \u4E0B\u65E0\u6CD5\u4E3A ${base} \u5206\u914D\u4ED3\u5E93\u76EE\u5F55`);
 }
 function materializeReadWorktree(input) {
   const worktreePath = resolveRepoTargetDir(input.taskRoot, `${safeRepoDirName(input.repoFullName)}${READ_ONLY_REPO_DIR_SUFFIX}`);
-  if (existsSync12(join15(worktreePath, ".git"))) {
-    execFileSync7("git", ["-C", worktreePath, "fetch", "origin", "--prune"], { env: input.env, stdio: "pipe" });
+  const targetRef = resolveReadRef(input.repoCachePath, input.env, input.ref, input.baseBranch);
+  if (existsSync14(join17(worktreePath, ".git"))) {
+    const current = currentBranchName(worktreePath);
+    if (current)
+      throw new Error(`READ_WORKTREE_DIRTY: \u53EA\u8BFB\u68C0\u51FA\u5DF2\u5207\u5230\u5206\u652F ${current}\uFF0C\u62D2\u7EDD\u81EA\u52A8\u66F4\u65B0\uFF08\u8BF7\u6E05\u7406\u8BE5\u76EE\u5F55\u540E\u91CD\u8BD5\uFF09`);
+    if (hasLocalChanges2(worktreePath, input.env))
+      throw new Error("READ_WORKTREE_DIRTY: \u53EA\u8BFB\u68C0\u51FA\u5B58\u5728\u672A\u63D0\u4EA4\u6539\u52A8\uFF0C\u62D2\u7EDD\u81EA\u52A8\u66F4\u65B0\uFF08\u8BF7\u6E05\u7406\u8BE5\u76EE\u5F55\u540E\u91CD\u8BD5\uFF09");
+    execFileSync9("git", ["-C", worktreePath, "checkout", "--detach", targetRef], { env: input.env, stdio: "pipe" });
   } else {
-    mkdirSync8(join15(worktreePath, ".."), { recursive: true });
-    execFileSync7("git", ["-C", input.repoCachePath, "worktree", "add", "--detach", worktreePath, resolveBaseRef(input.repoCachePath, input.env)], {
+    mkdirSync10(join17(worktreePath, ".."), { recursive: true });
+    execFileSync9("git", ["-C", input.repoCachePath, "worktree", "add", "--detach", worktreePath, targetRef], {
       env: input.env,
       stdio: "pipe"
     });
   }
   return worktreePath;
 }
-function resolveBaseRef(repoCachePath, env) {
-  for (const ref of ["origin/main", "origin/master", "HEAD"]) {
-    try {
-      execFileSync7("git", ["-C", repoCachePath, "rev-parse", "--verify", ref], { env, stdio: "pipe" });
+function resolveReadRef(repoCachePath, env, requestedRef, baseBranch) {
+  const requested = requestedRef?.trim();
+  if (requested) {
+    const candidates = requested.startsWith("refs/") ? [requested] : [`origin/${requested}`, requested];
+    for (const ref of candidates) {
+      if (refExists(repoCachePath, ref, env))
+        return ref;
+    }
+    throw new Error(`REF_NOT_FOUND: repo cache \u65E0\u53EF\u7528\u5F15\u7528 ${requested}`);
+  }
+  const explicitBase = baseBranch?.trim();
+  if (explicitBase) {
+    const ref = `origin/${explicitBase}`;
+    if (refExists(repoCachePath, ref, env))
       return ref;
+    throw new Error(`BASE_REF_NOT_FOUND: repo cache \u65E0\u9ED8\u8BA4\u5206\u652F ${explicitBase}`);
+  }
+  const remoteHead = (() => {
+    try {
+      const out = execFileSync9("git", ["-C", repoCachePath, "symbolic-ref", "refs/remotes/origin/HEAD"], { encoding: "utf8", env, stdio: "pipe" }).trim();
+      return out.replace(/^refs\/remotes\//, "");
     } catch {
+      return null;
     }
+  })();
+  for (const ref of [remoteHead, "origin/main", "origin/master"]) {
+    if (!ref || !refExists(repoCachePath, ref, env))
+      continue;
+    return ref;
+  }
+  throw new Error("BASE_REF_NOT_FOUND: repo cache \u65E0\u53EF\u7528\u8FDC\u7AEF\u5F15\u7528\uFF08origin/HEAD / origin/main / origin/master\uFF09");
+}
+function refExists(repoPath, ref, env) {
+  try {
+    execFileSync9("git", ["-C", repoPath, "rev-parse", "--verify", ref], { env, stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function currentBranchName(repoPath) {
+  try {
+    const out = execFileSync9("git", ["-C", repoPath, "branch", "--show-current"], { encoding: "utf8", stdio: "pipe" }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+function hasLocalChanges2(repoPath, env) {
+  try {
+    const out = execFileSync9("git", ["-C", repoPath, "status", "--porcelain"], { encoding: "utf8", env, stdio: "pipe" }).trim();
+    return out.length > 0;
+  } catch {
+    return true;
   }
-  throw new Error("BASE_REF_NOT_FOUND: repo cache \u65E0\u53EF\u7528\u5F15\u7528\uFF08origin/main / origin/master / HEAD\uFF09");
 }
 function listMaterializedRepoDirs(taskRoot, options = {}) {
   const excluded = new Set(options.excludeDirs ?? []);
@@ -6864,7 +7053,7 @@ function listMaterializedRepoDirs(taskRoot, options = {}) {
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => join15(taskRoot, e.name)).filter((dir) => !excluded.has(dir) && !isReadOnlyRepoDir(basename2(dir))).filter((dir) => existsSync12(join15(dir, ".git"))).sort();
+  return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => join17(taskRoot, e.name)).filter((dir) => !excluded.has(dir) && !isReadOnlyRepoDir(basename2(dir))).filter((dir) => existsSync14(join17(dir, ".git"))).sort();
 }
 function parseRepoFullNameFromRemoteUrl(url) {
   const raw = url?.trim();
@@ -6886,7 +7075,7 @@ function parseRepoFullNameFromRemoteUrl(url) {
 }
 function collectMaterializedRepoDeliveryTargets(input) {
   const excludedNames = new Set(input.excludeRepoFullNames?.filter(Boolean) ?? []);
-  const excludedDirs = [...excludedNames].map((name) => join15(input.taskRoot, safeRepoDirName(name)));
+  const excludedDirs = [...excludedNames].map((name) => join17(input.taskRoot, safeRepoDirName(name)));
   const recordsByDir = /* @__PURE__ */ new Map();
   const recordsByDirName = /* @__PURE__ */ new Map();
   for (const [repoFullName, record] of input.prepared ?? []) {
@@ -6895,7 +7084,7 @@ function collectMaterializedRepoDeliveryTargets(input) {
       recordsByDir.set(record.dir, entry);
     recordsByDirName.set(safeRepoDirName(repoFullName), entry);
   }
-  const runGit = input.gitRunner ?? ((dir, args) => execFileSync7("git", ["-C", dir, ...args], { encoding: "utf8", env: input.env, stdio: "pipe" }).trim());
+  const runGit = input.gitRunner ?? ((dir, args) => execFileSync9("git", ["-C", dir, ...args], { encoding: "utf8", env: input.env, stdio: "pipe" }).trim());
   const targets = [];
   for (const dir of listMaterializedRepoDirs(input.taskRoot, { excludeDirs: excludedDirs })) {
     const known = recordsByDir.get(dir) ?? recordsByDirName.get(basename2(dir));
@@ -6932,7 +7121,7 @@ function syncGitIdentity(primaryDir, targetDir, env) {
   const read = (key) => {
     for (const scope of ["--worktree", "--local"]) {
       try {
-        const out = execFileSync7("git", ["-C", primaryDir, "config", scope, key], { encoding: "utf8", env, stdio: "pipe" }).trim();
+        const out = execFileSync9("git", ["-C", primaryDir, "config", scope, key], { encoding: "utf8", env, stdio: "pipe" }).trim();
         if (out)
           return out;
       } catch {
@@ -6943,30 +7132,34 @@ function syncGitIdentity(primaryDir, targetDir, env) {
   const name = read("user.name") ?? "morula-daemon[bot]";
   const email = read("user.email") ?? "morula-daemon@morula.local";
   try {
-    execFileSync7("git", ["-C", targetDir, "config", "user.name", name], { env, stdio: "pipe" });
-    execFileSync7("git", ["-C", targetDir, "config", "user.email", email], { env, stdio: "pipe" });
+    execFileSync9("git", ["-C", targetDir, "config", "user.name", name], { env, stdio: "pipe" });
+    execFileSync9("git", ["-C", targetDir, "config", "user.email", email], { env, stdio: "pipe" });
   } catch {
   }
 }
 function materializeAdditionalRepo(input) {
-  if (existsSync12(join15(input.targetPath, ".git"))) {
-    execFileSync7("git", ["-C", input.targetPath, "fetch", "origin", "--prune"], { env: input.env, stdio: "pipe" });
+  if (existsSync14(join17(input.targetPath, ".git"))) {
+    const current = currentBranchName(input.targetPath);
+    if (!current && !hasLocalChanges2(input.targetPath, input.env)) {
+      const targetRef = resolveReadRef(input.repoCachePath, input.env, void 0, input.baseBranch);
+      execFileSync9("git", ["-C", input.targetPath, "checkout", "--detach", targetRef], { env: input.env, stdio: "pipe" });
+    }
     return input.targetPath;
   }
-  const candidates = input.baseBranch ? [`origin/${input.baseBranch}`, "origin/main", "origin/master", "HEAD"] : ["origin/main", "origin/master", "HEAD"];
+  const candidates = input.baseBranch ? [`origin/${input.baseBranch}`, "origin/main", "origin/master"] : ["origin/main", "origin/master"];
   let baseRef = null;
   for (const ref of candidates) {
     try {
-      execFileSync7("git", ["-C", input.repoCachePath, "rev-parse", "--verify", ref], { env: input.env, stdio: "pipe" });
+      execFileSync9("git", ["-C", input.repoCachePath, "rev-parse", "--verify", ref], { env: input.env, stdio: "pipe" });
       baseRef = ref;
       break;
     } catch {
     }
   }
   if (!baseRef)
-    throw new Error("BASE_REF_NOT_FOUND: repo cache \u65E0\u53EF\u7528\u5F15\u7528\uFF08origin/<base> / origin/main / origin/master / HEAD\uFF09");
-  mkdirSync8(join15(input.targetPath, ".."), { recursive: true });
-  execFileSync7("git", ["-C", input.repoCachePath, "worktree", "add", "--detach", input.targetPath, baseRef], {
+    throw new Error("BASE_REF_NOT_FOUND: repo cache \u65E0\u53EF\u7528\u8FDC\u7AEF\u5F15\u7528\uFF08origin/<base> / origin/main / origin/master\uFF09");
+  mkdirSync10(join17(input.targetPath, ".."), { recursive: true });
+  execFileSync9("git", ["-C", input.repoCachePath, "worktree", "add", "--detach", input.targetPath, baseRef], {
     env: input.env,
     stdio: "pipe"
   });
@@ -7435,6 +7628,14 @@ var DaemonRunner = class {
     if (this.running)
       return;
     this.running = true;
+    try {
+      await this.startInner();
+    } catch (error) {
+      this.stop();
+      throw error;
+    }
+  }
+  async startInner() {
     ensureGitOnPath();
     ensureNodeOnPath();
     {
@@ -8116,6 +8317,7 @@ var DaemonRunner = class {
       const wc = detail.workContext;
       repoBaseUrl = tokenRes.baseUrl;
       const remoteUrl = repoBaseUrl ? buildGitlabSshRemote(wc?.repoFullName ?? repo, repoBaseUrl) : void 0;
+      const daemonRemoteUrl = buildDaemonRepoUrl(wc?.repoFullName ?? repo, repoBaseUrl);
       env = { ...env, ...buildRepoEnv(tokenRes.token, repoBaseUrl) };
       if (wc?.baseBranch?.trim())
         env = { ...env, MORULA_BASE_BRANCH: wc.baseBranch.trim() };
@@ -8131,7 +8333,8 @@ var DaemonRunner = class {
           baseBranch: wc.baseBranch || "main",
           code: detail.code ?? null,
           env,
-          remoteUrl
+          remoteUrl,
+          daemonRemoteUrl
         });
         repoDir = managed.worktreePath;
         worktreePath = managed.worktreePath;
@@ -8140,7 +8343,7 @@ var DaemonRunner = class {
         });
         this.log(`[daemon] \u4EFB\u52A1 ${taskId} \u5DE5\u4F5C\u533A\u5C31\u7EEA: ${taskRoot}\uFF08\u4ED3\u5E93 ${repoDir}\uFF0Cbranch=${wc.branchName}\uFF09`);
       } else {
-        repoDir = ensureRepo(cfg.workdir, this.tenantId, repo, env, remoteUrl);
+        repoDir = ensureRepo(cfg.workdir, this.tenantId, repo, env, remoteUrl, daemonRemoteUrl);
         taskRoot = repoDir;
       }
       ensureGitIdentity(repoDir, detail.executor.executorName);
@@ -8157,12 +8360,12 @@ var DaemonRunner = class {
       });
       if (spaceToken?.token)
         env = { ...env, ...buildRepoEnv(spaceToken.token, spaceToken.baseUrl) };
-      repoDir = join16(cfg.workdir, "scratch", taskId);
+      repoDir = join18(cfg.workdir, "scratch", taskId);
       taskRoot = repoDir;
-      mkdirSync9(repoDir, { recursive: true });
-      const readme = join16(repoDir, "README.md");
-      if (!existsSync13(readme)) {
-        writeFileSync8(
+      mkdirSync11(repoDir, { recursive: true });
+      const readme = join18(repoDir, "README.md");
+      if (!existsSync15(readme)) {
+        writeFileSync9(
           readme,
           `# \u9694\u79BB\u5DE5\u4F5C\u533A\uFF08\u4EFB\u52A1 ${taskId}\uFF09
 
@@ -8448,7 +8651,7 @@ var DaemonRunner = class {
     };
     const resumeSessionId = providerKey === "dim" ? detail.dimSessionId ?? detail.lastRun?.dimSessionId ?? null : null;
     const resumeWorkDir = detail.dimWorkDir ?? detail.lastRun?.dimWorkDir ?? null;
-    const canResume = !!resumeSessionId && !!resumeWorkDir && existsSync13(resumeWorkDir);
+    const canResume = !!resumeSessionId && !!resumeWorkDir && existsSync15(resumeWorkDir);
     const input = {
       executionId: `${taskId}:1`,
       // task-workspace-layout：新会话 cwd = 任务工作区根（AGENTS.md/.agents 在根下，仓库在子目录）
@@ -8655,7 +8858,7 @@ var DaemonRunner = class {
     const headers = { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" };
     try {
       const execEnv = mergeExecEnv(env);
-      execFileSync8("git", ["-C", repoDir, "push", "-u", "origin", branch], { encoding: "utf-8", env: execEnv, stdio: "pipe" });
+      execFileSync10("git", ["-C", repoDir, "push", "-u", "origin", branch], { encoding: "utf-8", env: execEnv, stdio: "pipe" });
       this.log(`[daemon] \u4EFB\u52A1 ${taskId} \u5206\u652F\u5DF2\u8865\u63A8\u9001: ${branch}`);
       const listRes = await fetch(
         `${baseUrl}/api/v4/projects/${projectPath}/merge_requests?source_branch=${encodeURIComponent(branch)}&state=opened`,
@@ -8722,7 +8925,7 @@ var DaemonRunner = class {
       await this.api.submitCleanupResult(item.id, this.runtimeId, { ok: true });
       return;
     }
-    const managedRoot = join16(cfg.workdir, "worktrees", this.tenantId);
+    const managedRoot = join18(cfg.workdir, "worktrees", this.tenantId);
     if (!wc.worktreePath.startsWith(`${managedRoot}/`)) {
       await this.api.submitCleanupResult(item.id, this.runtimeId, {
         ok: false,
@@ -8770,38 +8973,38 @@ function isDebugLogEnabled() {
 var spaceTokenFailureLogged = false;
 function writeCustomSkills(targetDir, skills, log) {
   const NAME_RE = /^[\w-]{1,64}$/;
-  const base = join16(targetDir, ".agents", "skills");
+  const base = join18(targetDir, ".agents", "skills");
   for (const skill of skills) {
     const name = skill.name.trim();
     if (!NAME_RE.test(name)) {
       log?.(`[daemon] \u8DF3\u8FC7\u975E\u6CD5 skill \u540D\u79F0: ${JSON.stringify(name)}`);
       continue;
     }
-    const dir = join16(base, name);
-    if (dirname6(dir) !== base) {
+    const dir = join18(base, name);
+    if (dirname7(dir) !== base) {
       log?.(`[daemon] \u8DF3\u8FC7\u8D8A\u754C skill \u8DEF\u5F84: ${JSON.stringify(name)}`);
       continue;
     }
-    mkdirSync9(dir, { recursive: true });
+    mkdirSync11(dir, { recursive: true });
     const meta = ["---", `name: ${name}`];
     if (skill.description?.trim()) {
       meta.push(`description: ${skill.description.trim().replace(/\n/g, " ")}`);
     }
     meta.push("---", "");
-    writeFileSync8(join16(dir, "SKILL.md"), `${meta.join("\n")}
+    writeFileSync9(join18(dir, "SKILL.md"), `${meta.join("\n")}
 ${skill.content ?? ""}`, "utf8");
   }
 }
 function writeCollaborationSkill(targetDir, repo, repoBaseUrl, log, baseBranch, provider = repoBaseUrl ? "gitlab" : "github") {
-  const dir = join16(targetDir, ".agents", "skills", COLLABORATION_SKILL_NAME);
-  const refsDir = join16(dir, "references");
-  mkdirSync9(refsDir, { recursive: true });
+  const dir = join18(targetDir, ".agents", "skills", COLLABORATION_SKILL_NAME);
+  const refsDir = join18(dir, "references");
+  mkdirSync11(refsDir, { recursive: true });
   const isGitlab = provider === "gitlab" && !!repoBaseUrl;
   const front = isGitlab ? buildGitlabSkillFrontmatter() : COLLABORATION_SKILL_FRONTMATTER;
   const body = isGitlab ? buildGitlabSkillBody(repo ?? "", repoBaseUrl, baseBranch) : buildGithubSkillBody(baseBranch);
-  writeFileSync8(join16(dir, "SKILL.md"), `${front}
+  writeFileSync9(join18(dir, "SKILL.md"), `${front}
 ${body}`, "utf8");
-  writeFileSync8(join16(refsDir, "working-on-issues-source-map.md"), COLLABORATION_SKILL_SOURCE_MAP, "utf8");
+  writeFileSync9(join18(refsDir, "working-on-issues-source-map.md"), COLLABORATION_SKILL_SOURCE_MAP, "utf8");
   log?.(`[daemon] \u5DF2\u6CE8\u5165\u534F\u4F5C\u5951\u7EA6 skill ${COLLABORATION_SKILL_NAME}\uFF08${isGitlab ? "GitLab" : "GitHub"} \u7248\uFF0C\u4ED3\u5E93=${repo ?? "\u65E0"}\uFF09\u5230 .agents/skills/`);
 }
 function resolveContractPlatform(availableRepos, boundRepo, boundBaseUrl, boundBaseBranch) {
@@ -8832,8 +9035,8 @@ function resolveContractPlatform(availableRepos, boundRepo, boundBaseUrl, boundB
   };
 }
 function writeTaskContextBrief(targetDir, taskId, detail, repo, log) {
-  const briefDir = join16(targetDir, ".agent_context");
-  mkdirSync9(briefDir, { recursive: true });
+  const briefDir = join18(targetDir, ".agent_context");
+  mkdirSync11(briefDir, { recursive: true });
   const brief = `# \u4EFB\u52A1\u4E0A\u4E0B\u6587\uFF08Task Context\uFF09
 
 - \u672C AgentTask \u4EFB\u52A1 ID\uFF1A\`${taskId}\`
@@ -8842,7 +9045,7 @@ function writeTaskContextBrief(targetDir, taskId, detail, repo, log) {
 ---
 
 ${buildTaskPromptWithContract(detail, void 0)}`;
-  writeFileSync8(join16(briefDir, "task-context.md"), brief, "utf8");
+  writeFileSync9(join18(briefDir, "task-context.md"), brief, "utf8");
   log?.(`[daemon] \u5DF2\u6CE8\u5165\u4EFB\u52A1\u4E0A\u4E0B\u6587 brief \u5230 .agent_context/task-context.md`);
 }
 var PROJECT_AGENTS_MD_MAX_CHARS = 1e5;
@@ -8856,15 +9059,15 @@ function writeProjectAgentsMd(targetDir, agentsMd, log) {
     log?.(`[daemon] \u7A7A\u95F4 AGENTS.md \u5185\u5BB9\u8D85\u957F\uFF08${content.length} \u5B57\u7B26 > ${PROJECT_AGENTS_MD_MAX_CHARS}\uFF09\uFF0C\u5DF2\u622A\u65AD\u5199\u5165`);
     content = content.slice(0, PROJECT_AGENTS_MD_MAX_CHARS);
   }
-  mkdirSync9(targetDir, { recursive: true });
-  writeFileSync8(join16(targetDir, "AGENTS.md"), `${content}
+  mkdirSync11(targetDir, { recursive: true });
+  writeFileSync9(join18(targetDir, "AGENTS.md"), `${content}
 `, "utf8");
   log?.(`[daemon] \u5DF2\u6CE8\u5165\u7A7A\u95F4\u9879\u76EE\u8BF4\u660E\u5230 AGENTS.md\uFF08${content.length} \u5B57\u7B26\uFF0C\u4F5C\u4E3A project.instructions \u81EA\u52A8\u52A0\u8F7D\uFF09`);
   return true;
 }
 function gitHead(repoDir) {
   try {
-    return execFileSync8("git", ["-C", repoDir, "rev-parse", "HEAD"], { stdio: "pipe" }).toString().trim();
+    return execFileSync10("git", ["-C", repoDir, "rev-parse", "HEAD"], { stdio: "pipe" }).toString().trim();
   } catch {
     return null;
   }
@@ -8955,7 +9158,7 @@ async function reportRepoTargets(taskId, targets, env, ops) {
 }
 async function reportOneRepoTarget(taskId, target, env, ops) {
   const execEnv = mergeExecEnv(env);
-  if (!existsSync13(target.dir) || !existsSync13(join16(target.dir, ".git"))) {
+  if (!existsSync15(target.dir) || !existsSync15(join18(target.dir, ".git"))) {
     ops.log(`[daemon] \u4EFB\u52A1 ${taskId} \u4ED3\u5E93 ${target.repoFullName} \u4EA4\u4ED8\u8DF3\u8FC7\uFF1A\u5DE5\u4F5C\u76EE\u5F55\u5DF2\u4E0D\u5B58\u5728\uFF08cleanup/\u5206\u652F\u6539\u540D\u65F6\u5E8F\uFF09`);
     return;
   }
@@ -8970,7 +9173,7 @@ async function reportOneRepoTarget(taskId, target, env, ops) {
     ops.log(`[daemon] \u4EFB\u52A1 ${taskId} \u4ED3\u5E93 ${target.repoFullName} \u4EA4\u4ED8\u8DF3\u8FC7\uFF1A\u65E0\u53EF\u4EA4\u4ED8\u5206\u652F\uFF08branch=${branch ?? "null"}\uFF0C\u5360\u4F4D/\u4E3B\u5E72\u5206\u652F\u4E0D\u4EA4\u4ED8\uFF09`);
     return;
   }
-  const headSha = execFileSync8("git", ["-C", target.dir, "rev-parse", "HEAD"], { encoding: "utf-8", env: execEnv }).trim();
+  const headSha = execFileSync10("git", ["-C", target.dir, "rev-parse", "HEAD"], { encoding: "utf-8", env: execEnv }).trim();
   const headSubject = headCommitSubject(target.dir, execEnv);
   const probePushState = ops.pushState ?? resolveRemotePushState;
   let dirty = hasLocalChanges(target.dir, execEnv);
@@ -9010,7 +9213,7 @@ async function reportOneRepoTarget(taskId, target, env, ops) {
   }
 }
 function execGit(repoPath, args, env) {
-  return execFileSync8("git", ["-C", repoPath, ...args], {
+  return execFileSync10("git", ["-C", repoPath, ...args], {
     encoding: "utf8",
     stdio: "pipe",
     env,
@@ -9051,7 +9254,7 @@ async function ensurePullRequestTaskCode(repoDir, repo, code, env) {
   if (!taskCode)
     return;
   const execEnv = mergeExecEnv(env);
-  const branch = execFileSync8("git", ["branch", "--show-current"], { cwd: repoDir, encoding: "utf-8", env: execEnv }).trim();
+  const branch = execFileSync10("git", ["branch", "--show-current"], { cwd: repoDir, encoding: "utf-8", env: execEnv }).trim();
   if (!branch || branch === "main" || branch === "master")
     return;
   if (env.MORULA_GITLAB_URL && env.MORULA_GITLAB_TOKEN) {
@@ -9060,7 +9263,7 @@ async function ensurePullRequestTaskCode(repoDir, repo, code, env) {
   }
   let prList;
   try {
-    prList = execFileSync8("gh", ["pr", "list", "--head", branch, "--json", "number,title,body", "--limit", "1"], {
+    prList = execFileSync10("gh", ["pr", "list", "--head", branch, "--json", "number,title,body", "--limit", "1"], {
       cwd: repoDir,
       env: execEnv,
       encoding: "utf-8"
@@ -9080,7 +9283,7 @@ async function ensurePullRequestTaskCode(repoDir, repo, code, env) {
   const newBody = `${pr.body ?? ""}
 
 Task ref: ${taskCode}\uFF08\u7531 morula \u81EA\u52A8\u8865\u5145\uFF0C\u7528\u4E8E PR \u5173\u8054\u4E0E\u5173\u95ED\u8054\u52A8\uFF09`;
-  execFileSync8("gh", ["api", "--method", "PATCH", `repos/${repo}/pulls/${pr.number}`, "-f", `title=${newTitle}`, "-f", `body=${newBody}`], {
+  execFileSync10("gh", ["api", "--method", "PATCH", `repos/${repo}/pulls/${pr.number}`, "-f", `title=${newTitle}`, "-f", `body=${newBody}`], {
     cwd: repoDir,
     env: execEnv,
     encoding: "utf-8"
@@ -9123,12 +9326,12 @@ Task ref: ${taskCode}\uFF08\u7531 morula \u81EA\u52A8\u8865\u5145\uFF0C\u7528\u4
 
 // src/commands/doctor.ts
 init_dist2();
+import { existsSync as existsSync16, readFileSync as readFileSync10, realpathSync } from "node:fs";
+import { homedir as homedir11 } from "node:os";
+import { dirname as dirname8, join as join19 } from "node:path";
 init_daemon_config();
 init_daemon_lock();
 init_dim_locate();
-import { existsSync as existsSync14, readFileSync as readFileSync10, realpathSync } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { dirname as dirname7, join as join17 } from "node:path";
 async function doctorCommand(context) {
   const probe = context.parsed.flags.probe === true || context.parsed.flags.probe === "true";
   const { facts, checks } = await collectDoctor(context, probe);
@@ -9145,16 +9348,16 @@ async function doctorCommand(context) {
 async function collectDoctor(context, probe) {
   const checks = [];
   const env = context.env;
-  const configDir = env.MORULA_CONFIG_DIR ?? join17(homedir9(), ".morula-cli");
-  const configPath = env.MORULA_CONFIG ?? join17(configDir, "config.yaml");
-  const daemonPath = join17(dirname7(configPath), "daemon");
-  const logFile = join17(daemonPath, "daemon.log");
+  const configDir = env.MORULA_CONFIG_DIR ?? join19(homedir11(), ".morula-cli");
+  const configPath = env.MORULA_CONFIG ?? join19(configDir, "config.yaml");
+  const daemonPath = join19(dirname8(configPath), "daemon");
+  const logFile = join19(daemonPath, "daemon.log");
   const contextName = context.runtime.context ?? null;
   const baseUrl = context.runtime.baseUrl ?? null;
   const tokenPresent = Boolean(context.runtime.token);
   const tokenSource = context.runtime.tokenSource ?? null;
   let configReadable = false;
-  if (existsSync14(configPath)) {
+  if (existsSync16(configPath)) {
     try {
       readFileSync10(configPath, "utf8");
       configReadable = true;
@@ -9162,10 +9365,10 @@ async function collectDoctor(context, probe) {
       configReadable = false;
     }
   }
-  const lockPath = join17(daemonPath, DAEMON_LOCK_FILE);
+  const lockPath = join19(daemonPath, DAEMON_LOCK_FILE);
   const lock = probeDaemonLock(lockPath);
-  const pidFile = join17(daemonPath, "daemon.pid");
-  const filePid = existsSync14(pidFile) ? Number(readFileSync10(pidFile, "utf8").trim() || 0) : 0;
+  const pidFile = join19(daemonPath, "daemon.pid");
+  const filePid = existsSync16(pidFile) ? Number(readFileSync10(pidFile, "utf8").trim() || 0) : 0;
   const lockPid = lock.state === "active" ? lock.record.pid : 0;
   const daemonPid = lockPid || (isProcessAlive(filePid) ? filePid : 0) || null;
   const cfg = loadDaemonConfig(context.store);
@@ -9200,7 +9403,8 @@ async function collectDoctor(context, probe) {
     logFile,
     dimPath,
     dimFound,
-    envOverrides
+    envOverrides,
+    daemonAutostart: process.platform === "darwin" ? daemonAutostartEnabled() : null
   };
   checks.push(lock.state === "stale" ? {
     id: "daemon.lock",
@@ -9226,7 +9430,7 @@ async function collectDoctor(context, probe) {
       hint: "morula-runtime daemon doctor --probe\uFF08\u8054\u7F51\u786E\u8BA4\u767B\u5F55\u6001\uFF09"
     });
   }
-  checks.push(configReadable ? { id: "config.readable", status: "ok", message: `\u914D\u7F6E\u53EF\u8BFB\uFF1A${configPath}` } : existsSync14(configPath) ? { id: "config.readable", status: "fail", message: `\u914D\u7F6E\u5B58\u5728\u4F46\u4E0D\u53EF\u8BFB\uFF08\u6743\u9650\uFF1F\uFF09\uFF1A${configPath}`, hint: `ls -l ${configPath}` } : { id: "config.readable", status: "warn", message: `\u914D\u7F6E\u6587\u4EF6\u5C1A\u4E0D\u5B58\u5728\uFF1A${configPath}`, hint: "morula-runtime auth login\uFF08\u767B\u5F55\u540E\u751F\u6210\uFF09" });
+  checks.push(configReadable ? { id: "config.readable", status: "ok", message: `\u914D\u7F6E\u53EF\u8BFB\uFF1A${configPath}` } : existsSync16(configPath) ? { id: "config.readable", status: "fail", message: `\u914D\u7F6E\u5B58\u5728\u4F46\u4E0D\u53EF\u8BFB\uFF08\u6743\u9650\uFF1F\uFF09\uFF1A${configPath}`, hint: `ls -l ${configPath}` } : { id: "config.readable", status: "warn", message: `\u914D\u7F6E\u6587\u4EF6\u5C1A\u4E0D\u5B58\u5728\uFF1A${configPath}`, hint: "morula-runtime auth login\uFF08\u767B\u5F55\u540E\u751F\u6210\uFF09" });
   if (!dimFound) {
     checks.push({
       id: "dim.present",
@@ -9247,6 +9451,18 @@ async function collectDoctor(context, probe) {
   } else {
     checks.push({ id: "daemon.running", status: "ok", message: `daemon \u8FD0\u884C\u4E2D\uFF08pid=${daemonPid}\uFF09` });
   }
+  if (facts.daemonAutostart !== null) {
+    if (facts.daemonAutostart) {
+      checks.push({
+        id: "daemon.autostart",
+        status: "ok",
+        message: `daemon \u5F00\u673A\u81EA\u542F\uFF1Aon\uFF08${daemonAutostartPlistPath()}\uFF09`,
+        ...facts.daemonRunning ? {} : { hint: `tail -n 50 ${logFile}\uFF08\u81EA\u542F\u5B9E\u4F8B\u53EF\u80FD\u6CE8\u518C\u5931\u8D25\u540E\u5DF2\u9000\u51FA\uFF09` }
+      });
+    } else {
+      checks.push({ id: "daemon.autostart", status: "ok", message: "daemon \u5F00\u673A\u81EA\u542F\uFF1Aoff" });
+    }
+  }
   if (envOverrides.includes("MORULA_CONFIG_DIR") || envOverrides.includes("MORULA_CONFIG")) {
     checks.push({
       id: "config.override",
@@ -9322,10 +9538,10 @@ function detectInstallMode() {
 
 // src/commands/daemon.ts
 function configFilePath(env) {
-  return env.MORULA_CONFIG ?? join19(env.MORULA_CONFIG_DIR ?? join19(homedir11(), ".morula-cli"), "config.yaml");
+  return env.MORULA_CONFIG ?? join20(env.MORULA_CONFIG_DIR ?? join20(homedir12(), ".morula-cli"), "config.yaml");
 }
 function daemonDir(configPath) {
-  return join19(dirname8(configPath), "daemon");
+  return join20(dirname9(configPath), "daemon");
 }
 var PID_FILE = "daemon.pid";
 var LOG_FILE = "daemon.log";
@@ -9343,9 +9559,11 @@ async function daemonCommand(context) {
     return models(context);
   if (action === "portal")
     return portal(context);
+  if (action === "autostart")
+    return autostart(context);
   if (action === "doctor")
     return doctorCommand(context);
-  throw usage("usage: morula-runtime daemon <run|start|stop|status|models|portal|doctor>", {
+  throw usage("usage: morula-runtime daemon <run|start|stop|status|models|portal|autostart|doctor>", {
     hint: "morula-runtime daemon --help"
   });
 }
@@ -9356,29 +9574,29 @@ async function portal(context) {
   const { PortalServer: PortalServer2 } = await Promise.resolve().then(() => (init_portal_server(), portal_server_exports));
   const { createPortalEnvironmentResolver: createPortalEnvironmentResolver2 } = await Promise.resolve().then(() => (init_portal_instances(), portal_instances_exports));
   const port = Number(flagString(context.parsed.flags, "port") ?? process.env.MORULA_PORTAL_PORT ?? String(DEFAULT_PORTAL_PORT));
-  const autostart = flagString(context.parsed.flags, "autostart");
+  const autostart2 = flagString(context.parsed.flags, "autostart");
   const dryRun = isDryRun(context);
-  if (autostart === "on" || autostart === "off") {
+  if (autostart2 === "on" || autostart2 === "off") {
     const { setupAutostart: setupAutostart2, removeAutostart: removeAutostart2 } = await Promise.resolve().then(() => (init_portal_autostart(), portal_autostart_exports));
     if (dryRun) {
       return {
         ok: true,
         dryRun: true,
-        autostart,
+        autostart: autostart2,
         planned: {
-          action: autostart === "on" ? "register LaunchAgent (portal autostart)" : "remove LaunchAgent (portal autostart)",
+          action: autostart2 === "on" ? "register LaunchAgent (portal autostart)" : "remove LaunchAgent (portal autostart)",
           note: "no file was written"
         }
       };
     }
-    if (autostart === "on") {
+    if (autostart2 === "on") {
       const installed = await setupAutostart2(context);
       context.err(installed ? "[portal] \u5DF2\u6CE8\u518C\u5F00\u673A\u81EA\u542F" : "[portal] \u5F53\u524D\u5E73\u53F0\u6682\u4E0D\u652F\u6301\u81EA\u542F\u6CE8\u518C\uFF08macOS LaunchAgent \u5DF2\u652F\u6301\uFF09");
     } else {
       await removeAutostart2(context);
       context.err("[portal] \u5DF2\u79FB\u9664\u5F00\u673A\u81EA\u542F");
     }
-    return { ok: true, autostart };
+    return { ok: true, autostart: autostart2 };
   }
   if (dryRun) {
     return {
@@ -9425,6 +9643,75 @@ async function portal(context) {
   });
   return { running: true };
 }
+async function autostart(context) {
+  rejectUnknownFlags(context.parsed.flags, ["dry-run"]);
+  const state = context.parsed.positionals[0];
+  if (state !== "on" && state !== "off") {
+    throw usage("usage: morula-runtime daemon autostart <on|off>", {
+      hint: "morula-runtime daemon autostart --help"
+    });
+  }
+  const dryRun = isDryRun(context);
+  if (process.platform !== "darwin") {
+    context.err("[autostart] \u5F53\u524D\u5E73\u53F0\u6682\u4E0D\u652F\u6301\uFF08\u4EC5 macOS LaunchAgent\uFF09");
+    return { ok: true, autostart: state, supported: false };
+  }
+  const envOverridden = ["MORULA_ENV", "MORULA_CONFIG", "MORULA_CONFIG_DIR", "MORULA_API_URL", "MORULA_TOKEN", "MORULA_TASK_TOKEN"].filter((name) => Boolean(context.env[name]));
+  const flagOverridden = ["env", "url", "token"].filter((name) => context.parsed.flags[name] !== void 0);
+  if (envOverridden.length || flagOverridden.length) {
+    throw new CliError(
+      "USAGE",
+      EXIT.USAGE,
+      `\u5F00\u673A\u81EA\u542F\u53EA\u652F\u6301\u9ED8\u8BA4\u914D\u7F6E\u76EE\u5F55\uFF08launchd \u4E0D\u7EE7\u627F\u73AF\u5883\u53D8\u91CF/\u65D7\u6807\uFF09\uFF0C\u5F53\u524D\u4F1A\u8BDD\u5B58\u5728\u8986\u76D6\uFF1A${[...envOverridden.map((n) => `${n}`), ...flagOverridden.map((f) => `--${f}`)].join("\u3001")}`,
+      false,
+      { hint: "unset \u8986\u76D6\u53D8\u91CF\u540E\u91CD\u8BD5\uFF1B\u591A\u73AF\u5883\u5171\u5B58\u8BF7\u624B\u52A8\u542F\u505C\uFF08docs/research/runtime-dev-prod-coexist.md\uFF09" }
+    );
+  }
+  let identityError = null;
+  if (dryRun) {
+    try {
+      resolveDaemonIdentity(context, { quiet: true });
+    } catch (error) {
+      identityError = error instanceof Error ? error.message : String(error);
+    }
+  } else {
+    resolveDaemonIdentity(context, { quiet: true });
+  }
+  if (state === "on") {
+    const plan = planDaemonAutostart();
+    if (dryRun) {
+      return {
+        ok: true,
+        dryRun: true,
+        autostart: "on",
+        planned: {
+          action: "register LaunchAgent (daemon boot autostart)",
+          ...plan,
+          note: "no file was written"
+        },
+        ...identityError ? { blockedBy: { code: "NOT_LOGGED_IN", message: identityError, hint: "morula-runtime auth login" } } : {}
+      };
+    }
+    const installed = await setupDaemonAutostart((line) => context.err(line));
+    context.err(installed ? "[autostart] \u5DF2\u6CE8\u518C daemon \u5F00\u673A\u81EA\u542F\uFF08RunAtLoad \u5DF2\u62C9\u8D77\uFF1B\u91CD\u542F\u673A\u5668\u540E\u81EA\u52A8\u8FD0\u884C\uFF09" : "[autostart] plist \u5DF2\u5199\u5165\uFF0C\u4F46 launchctl bootstrap \u5931\u8D25\uFF08\u89C1\u4E0A\u65B9\u63D0\u793A\uFF09");
+    return { ok: true, autostart: "on", installed };
+  }
+  if (dryRun) {
+    return {
+      ok: true,
+      dryRun: true,
+      autostart: "off",
+      planned: {
+        action: "remove LaunchAgent (daemon boot autostart)",
+        plistPath: daemonAutostartPlistPath(),
+        note: "no file was written"
+      }
+    };
+  }
+  await removeDaemonAutostart((line) => context.err(line));
+  context.err("[autostart] \u5DF2\u79FB\u9664 daemon \u5F00\u673A\u81EA\u542F\uFF08\u6B63\u5728\u8FD0\u884C\u7684 daemon \u4E0D\u53D7\u5F71\u54CD\uFF09");
+  return { ok: true, autostart: "off" };
+}
 async function models(context) {
   rejectUnknownFlags(context.parsed.flags, ["provider"]);
   const { listDimModels: listDimModels2, DIM_DEFAULT_PROVIDER: DIM_DEFAULT_PROVIDER2 } = await Promise.resolve().then(() => (init_dim_model(), dim_model_exports));
@@ -9448,11 +9735,15 @@ async function run2(context) {
     saveDaemonConfig(context.store, { name, workdir, maxConcurrent });
   }
   const resolvedWorkdir = workdir ?? loadDaemonConfig(context.store)?.workdir ?? DEFAULT_WORKDIR;
-  mkdirSync11(resolvedWorkdir, { recursive: true });
-  const lockPath = join19(daemonDir(configFilePath(context.env)), DAEMON_LOCK_FILE);
+  mkdirSync12(resolvedWorkdir, { recursive: true });
+  const lockPath = join20(daemonDir(configFilePath(context.env)), DAEMON_LOCK_FILE);
   const acquired = acquireDaemonLock(lockPath, { workdir: resolvedWorkdir });
   if (!acquired.ok) {
     const pid = acquired.existing?.pid;
+    if (context.env.MORULA_DAEMON_SUPERVISED === "1") {
+      context.err(`[daemon] \u5DF2\u6709\u5B9E\u4F8B\u5728\u8FD0\u884C\uFF08pid=${pid ?? "\u672A\u77E5"}\uFF09\uFF0C\u81EA\u542F\u5B9E\u4F8B\u793C\u8BA9\u9000\u51FA`);
+      return { running: false, yieldedTo: pid ?? null };
+    }
     throw new CliError(
       "ALREADY_RUNNING",
       EXIT.CONFLICT,
@@ -9487,11 +9778,21 @@ async function run2(context) {
   context.err(`[daemon] morula-runtime daemon \u524D\u53F0\u8FD0\u884C\u4E2D\uFF08Ctrl+C \u9000\u51FA\uFF09`);
   try {
     await runner.start();
+  } catch (error) {
+    if (isAuthRejected(error)) {
+      context.err(`[daemon] \u6CE8\u518C\u88AB\u62D2\uFF08\u767B\u5F55\u6001\u5931\u6548\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`);
+      context.err("[daemon] \u8BF7\u91CD\u65B0\u767B\u5F55\u540E\u518D\u6B21\u542F\u52A8\uFF1Amorula-runtime auth login && morula-runtime daemon start");
+      return { running: false, stoppedReason: "auth" };
+    }
+    throw error;
   } finally {
     releaseLock();
   }
   return { running: false };
 }
+function isAuthRejected(error) {
+  return error instanceof MorulaApiError && (error.code === "UNAUTHENTICATED" || error.status === 401);
+}
 async function start(context) {
   rejectUnknownFlags(context.parsed.flags, ["name", "workdir", "max-concurrent", "dry-run"]);
   const name = flagString(context.parsed.flags, "name") ?? void 0;
@@ -9509,10 +9810,10 @@ async function start(context) {
   }
   const dir = daemonDir(configFilePath(context.env));
   if (!dryRun)
-    mkdirSync11(dir, { recursive: true, mode: 448 });
-  const pidFile = join19(dir, PID_FILE);
-  const logFile = join19(dir, LOG_FILE);
-  const lockPath = join19(dir, DAEMON_LOCK_FILE);
+    mkdirSync12(dir, { recursive: true, mode: 448 });
+  const pidFile = join20(dir, PID_FILE);
+  const logFile = join20(dir, LOG_FILE);
+  const lockPath = join20(dir, DAEMON_LOCK_FILE);
   const lock = probeDaemonLock(lockPath);
   if (lock.state === "active") {
     throw new CliError(
@@ -9523,7 +9824,7 @@ async function start(context) {
       { hint: "morula-runtime daemon status" }
     );
   }
-  if (existsSync16(pidFile)) {
+  if (existsSync17(pidFile)) {
     const pid = Number(readFileSync11(pidFile, "utf8").trim());
     if (isProcessAlive(pid)) {
       throw new CliError("ALREADY_RUNNING", EXIT.CONFLICT, `daemon \u5DF2\u5728\u8FD0\u884C\uFF08pid=${pid}\uFF09\uFF1B\u5982\u9700\u5F3A\u5236\u91CD\u542F\u8BF7\u5148\u6267\u884C kill -9 ${pid}`, false, {
@@ -9531,7 +9832,7 @@ async function start(context) {
       });
     }
     if (!dryRun)
-      rmSync7(pidFile, { force: true });
+      rmSync8(pidFile, { force: true });
   }
   const env = {
     ...process.env,
@@ -9569,12 +9870,12 @@ async function start(context) {
   const { spawnDaemonProcess: spawnDaemonProcess2 } = await Promise.resolve().then(() => (init_spawn(), spawn_exports));
   const result = spawnDaemonProcess2({ logFile, env });
   if (result.error || result.pid <= 0) {
-    rmSync7(pidFile, { force: true });
+    rmSync8(pidFile, { force: true });
     throw new CliError("DAEMON_START_FAILED", EXIT.OTHER, `[daemon] \u542F\u52A8\u5931\u8D25: ${result.error ?? `pid=${result.pid}`}`, false, {
       hint: `tail -n 50 ${logFile}`
     });
   }
-  writeFileSync9(pidFile, String(result.pid), { mode: 384 });
+  writeFileSync10(pidFile, String(result.pid), { mode: 384 });
   context.err(`[daemon] \u5DF2\u540E\u53F0\u542F\u52A8\uFF08pid=${result.pid}\uFF09\uFF0C\u65E5\u5FD7: ${logFile}`);
   return { running: true, pid: result.pid, logFile, lockFile: lockPath };
 }
@@ -9582,11 +9883,11 @@ async function stop(context) {
   rejectUnknownFlags(context.parsed.flags, ["dry-run"]);
   const dryRun = isDryRun(context);
   const dir = daemonDir(configFilePath(context.env));
-  const pidFile = join19(dir, PID_FILE);
-  const lockPath = join19(dir, DAEMON_LOCK_FILE);
+  const pidFile = join20(dir, PID_FILE);
+  const lockPath = join20(dir, DAEMON_LOCK_FILE);
   const lock = probeDaemonLock(lockPath);
   const lockPid = lock.state === "absent" ? null : lock.record?.pid ?? null;
-  const filePid = existsSync16(pidFile) ? Number(readFileSync11(pidFile, "utf8").trim()) : null;
+  const filePid = existsSync17(pidFile) ? Number(readFileSync11(pidFile, "utf8").trim()) : null;
   const pid = [lockPid, filePid].find((p) => p !== null && isProcessAlive(p)) ?? null;
   if (dryRun) {
     return {
@@ -9596,7 +9897,7 @@ async function stop(context) {
     };
   }
   if (!pid) {
-    rmSync7(pidFile, { force: true });
+    rmSync8(pidFile, { force: true });
     releaseDaemonLock(lockPath);
     return { running: false, message: "daemon \u672A\u5728\u8FD0\u884C\uFF08\u65E0\u5B58\u6D3B pid\uFF09" };
   }
@@ -9605,7 +9906,7 @@ async function stop(context) {
     releaseDaemonLock(lockPath);
   else
     releaseDaemonLock(lockPath, pid);
-  rmSync7(pidFile, { force: true });
+  rmSync8(pidFile, { force: true });
   if (result.outcome === "killed")
     context.err(`[daemon] pid=${pid} \u672A\u54CD\u5E94 SIGTERM\uFF0C\u5DF2 SIGKILL\uFF08\u9501\u5DF2\u91CA\u653E\uFF09`);
   return { running: false, stoppedPid: pid, outcome: result.outcome };
@@ -9614,11 +9915,11 @@ async function status2(context) {
   rejectUnknownFlags(context.parsed.flags, []);
   const cfg = loadDaemonConfig(context.store);
   const dir = daemonDir(configFilePath(context.env));
-  const pidFile = join19(dir, PID_FILE);
-  const lockPath = join19(dir, DAEMON_LOCK_FILE);
+  const pidFile = join20(dir, PID_FILE);
+  const lockPath = join20(dir, DAEMON_LOCK_FILE);
   const lock = probeDaemonLock(lockPath);
   const lockPid = lock.state === "active" ? lock.record.pid : null;
-  const filePid = existsSync16(pidFile) ? Number(readFileSync11(pidFile, "utf8").trim() || 0) : 0;
+  const filePid = existsSync17(pidFile) ? Number(readFileSync11(pidFile, "utf8").trim() || 0) : 0;
   const pid = lockPid ?? (isProcessAlive(filePid) ? filePid : null);
   return {
     running: pid !== null,
@@ -9628,7 +9929,7 @@ async function status2(context) {
     name: cfg?.name ?? null,
     workdir: cfg?.workdir ?? DEFAULT_WORKDIR,
     maxConcurrent: cfg?.maxConcurrent ?? DEFAULT_MAX_CONCURRENT,
-    logFile: join19(dir, LOG_FILE),
+    logFile: join20(dir, LOG_FILE),
     lockFile: lockPath
   };
 }
@@ -9658,32 +9959,32 @@ function parseMaxConcurrent(context) {
 init_dist2();
 
 // src/daemon/plugin-register.ts
-import { chmodSync as chmodSync3, cpSync, existsSync as existsSync17, mkdirSync as mkdirSync12, readdirSync as readdirSync5, readFileSync as readFileSync12, rmSync as rmSync8, statSync as statSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import { dirname as dirname9, join as join20 } from "node:path";
+import { chmodSync as chmodSync3, cpSync, existsSync as existsSync18, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync12, rmSync as rmSync9, statSync as statSync4, writeFileSync as writeFileSync11 } from "node:fs";
+import { homedir as homedir13 } from "node:os";
+import { dirname as dirname10, join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var PLUGIN_NAME = "morula-cli";
 var MANIFEST_DIR_NAME = ".codex-plugin";
-function legacyAgentsPluginDir(home = homedir12()) {
-  return join20(home, ".agents", "plugins", PLUGIN_NAME);
+function legacyAgentsPluginDir(home = homedir13()) {
+  return join21(home, ".agents", "plugins", PLUGIN_NAME);
 }
-function resolveDimcodeHome(env = process.env, home = homedir12()) {
+function resolveDimcodeHome(env = process.env, home = homedir13()) {
   const fromEnv = env.DIMCODE_HOME?.trim();
-  return fromEnv || join20(home, ".dimcode", "v2");
+  return fromEnv || join21(home, ".dimcode", "v2");
 }
-function defaultPluginsRoot(env = process.env, home = homedir12()) {
-  return join20(resolveDimcodeHome(env, home), "plugins");
+function defaultPluginsRoot(env = process.env, home = homedir13()) {
+  return join21(resolveDimcodeHome(env, home), "plugins");
 }
 function resolvePackagePaths(entryUrl) {
-  const distDir = dirname9(fileURLToPath2(entryUrl));
+  const distDir = dirname10(fileURLToPath2(entryUrl));
   return {
-    packageRoot: dirname9(distDir),
+    packageRoot: dirname10(distDir),
     distDir,
-    assetsDir: join20(distDir, "plugin")
+    assetsDir: join21(distDir, "plugin")
   };
 }
 function buildLauncherScript(opts) {
-  const entry = join20(opts.packageRoot, "dist", "morula.js");
+  const entry = join21(opts.packageRoot, "dist", "morula.js");
   return `#!/bin/sh
 # Morula \u4E1A\u52A1 CLI \u542F\u52A8\u5668\uFF08\u7531 \`morula-runtime setup\` \u751F\u6210\uFF1BNode \u5347\u7EA7\u540E\u91CD\u8DD1 setup \u5237\u65B0\uFF09\u3002
 # \u4E0D\u4F9D\u8D56\u8C03\u7528\u65B9 PATH \u91CC\u7684 node\uFF08agent \u6267\u884C\u73AF\u5883 PATH \u5E38\u88AB\u88C1\u526A\uFF09\uFF0C\u4EC5\u4F5C\u515C\u5E95\u3002
@@ -9697,15 +9998,15 @@ exec "$NODE" ${JSON.stringify(entry)} "$@"
 `;
 }
 function assetsReady(paths) {
-  return existsSync17(join20(paths.assetsDir, "plugin.json")) && existsSync17(join20(paths.assetsDir, "skills"));
+  return existsSync18(join21(paths.assetsDir, "plugin.json")) && existsSync18(join21(paths.assetsDir, "skills"));
 }
 function listSkillNames(assetsDir) {
-  const dir = join20(assetsDir, "skills");
-  if (!existsSync17(dir))
+  const dir = join21(assetsDir, "skills");
+  if (!existsSync18(dir))
     return [];
   return readdirSync5(dir).filter((name) => {
     try {
-      return statSync4(join20(dir, name)).isDirectory();
+      return statSync4(join21(dir, name)).isDirectory();
     } catch {
       return false;
     }
@@ -9714,24 +10015,24 @@ function listSkillNames(assetsDir) {
 function registerPlugin(opts) {
   const { pluginsRoot, paths, version } = opts;
   const nodePath = opts.nodePath ?? process.execPath;
-  const pluginDir = join20(pluginsRoot, PLUGIN_NAME);
+  const pluginDir = join21(pluginsRoot, PLUGIN_NAME);
   if (!assetsReady(paths))
     throw new Error(`plugin assets not found at ${paths.assetsDir}; run \`pnpm run build:dist\` (dev) or reinstall the package`);
-  const skillsSrc = join20(paths.assetsDir, "skills");
+  const skillsSrc = join21(paths.assetsDir, "skills");
   const skills = listSkillNames(paths.assetsDir);
-  const manifestDir = join20(pluginDir, MANIFEST_DIR_NAME);
-  mkdirSync12(manifestDir, { recursive: true });
-  const manifest = JSON.parse(readFileSync12(join20(paths.assetsDir, "plugin.json"), "utf8"));
-  writeFileSync10(join20(manifestDir, "plugin.json"), `${JSON.stringify({ ...manifest, version }, null, 2)}
+  const manifestDir = join21(pluginDir, MANIFEST_DIR_NAME);
+  mkdirSync13(manifestDir, { recursive: true });
+  const manifest = JSON.parse(readFileSync12(join21(paths.assetsDir, "plugin.json"), "utf8"));
+  writeFileSync11(join21(manifestDir, "plugin.json"), `${JSON.stringify({ ...manifest, version }, null, 2)}
 `);
-  const skillsDest = join20(pluginDir, "skills");
-  rmSync8(skillsDest, { recursive: true, force: true });
-  mkdirSync12(skillsDest, { recursive: true });
+  const skillsDest = join21(pluginDir, "skills");
+  rmSync9(skillsDest, { recursive: true, force: true });
+  mkdirSync13(skillsDest, { recursive: true });
   cpSync(skillsSrc, skillsDest, { recursive: true });
-  const binDir = join20(pluginDir, "bin");
-  mkdirSync12(binDir, { recursive: true });
-  const binPath = join20(binDir, "morula");
-  writeFileSync10(binPath, buildLauncherScript({ nodePath, packageRoot: paths.packageRoot }));
+  const binDir = join21(pluginDir, "bin");
+  mkdirSync13(binDir, { recursive: true });
+  const binPath = join21(binDir, "morula");
+  writeFileSync11(binPath, buildLauncherScript({ nodePath, packageRoot: paths.packageRoot }));
   chmodSync3(binPath, 493);
   const legacy = legacyAgentsPluginDir(opts.home);
   return {
@@ -9740,7 +10041,7 @@ function registerPlugin(opts) {
     skills,
     version,
     node: nodePath,
-    legacyDir: existsSync17(join20(legacy, MANIFEST_DIR_NAME)) ? legacy : null
+    legacyDir: existsSync18(join21(legacy, MANIFEST_DIR_NAME)) ? legacy : null
   };
 }
 
@@ -9917,6 +10218,21 @@ var SPEC = {
           idempotent: true,
           emits: ["running", "autostart", "ok"]
         },
+        {
+          action: "autostart",
+          summary: "register/remove the macOS LaunchAgent so the daemon starts at login and is relaunched by launchd on abnormal exit (unattended executor machines)",
+          args: [
+            { name: "state", required: true, description: "on = register LaunchAgent (RunAtLoad starts the daemon now and at every login); off = remove it (a running daemon is untouched)" }
+          ],
+          flags: [
+            { name: "dry-run", type: "boolean", description: "print the LaunchAgent plan without writing anything (read-only)" }
+          ],
+          examples: ["morula-runtime daemon autostart on", "morula-runtime daemon autostart off"],
+          writes: "local",
+          interactive: false,
+          idempotent: true,
+          emits: ["ok", "autostart", "installed", "dryRun", "planned", "blockedBy"]
+        },
         {
           action: "doctor",
           summary: "read-only diagnostics: node/cli/config/auth/daemon/dim facts plus checks[] with hints (offline by default; --probe goes online)",