@bingjiang0611/rotom 0.1.0-alpha.0 → 0.1.0-alpha.2

package/README.md

@@ -9,7 +9,7 @@ npm 包名为 `@bingjiang0611/rotom`，Alpha 使用 `alpha` tag，CLI 仍为 `ro
 要求 Node.js 24+ 和 POSIX shell。当前验证范围为 macOS；Linux 安装/终端运行仍待真实验证，Windows 原生入口不受支持。
 
 ```sh
-npm install -g --ignore-scripts @bingjiang0611/rotom@alpha
+npm install -g --ignore-scripts @bingjiang0611/rotom@alpha --registry=https://registry.npmjs.org --prefer-online
 cd /path/to/your/project
 rotom
 ```
@@ -22,6 +22,12 @@ rotom
 
 升级重新执行上述 npm 安装命令；也支持将包名替换为已验证的本地 `.tgz` 路径安装。卸载用 `npm uninstall -g @bingjiang0611/rotom`。旧本地无 scope Alpha 包须先用 `npm uninstall -g rotom` 卸载，以免两个包争用同一个 CLI（不要使用 `--force` 覆盖）。不会自动删除用户凭据、会话或 Chrome relay 注册，后者需单独显式卸载。
 
+## Alpha 修复
+
+`0.1.0-alpha.2` 将用户级 Browser 目录统一为 `rotom`，扩展显示名改为 `rotom Browser Relay`；Native Host 与客户端使用同一新 socket 路径。保留旧目录、扩展 ID 和 Native Messaging Host ID，不扩大权限。
+
+`0.1.0-alpha.1` 修复 `setup browser` 在用户或项目存在 `.claude/skills` 时误收 session 参数、报「无效参数」的问题；不需要删除或移动 skills。普通 Pi 会话的 skills 发现行为保持不变。
+
 ## 配置 Chrome 浏览器（macOS）
 
 ```sh
@@ -34,7 +40,7 @@ rotom setup browser
 
 1. 打开 `chrome://extensions`，开启开发者模式。
 2. 点击「加载已解压的扩展程序」，选择命令显示的目录：
-   `~/Library/Application Support/pi-agent/browser-relay/extension`。
+   `~/Library/Application Support/rotom/browser-relay/extension`。
 3. 等待终端显示「浏览器已连接，协议兼容」。如果此前从 npm/源码目录加载过同一扩展，请手动移除旧条目，再加载这个固定目录。
 
 交互终端最多等候 120 秒，Ctrl+C 只结束等候；非交互默认只检查一次。也可以单独检查或设置等待时间：
@@ -48,6 +54,17 @@ rotom setup browser --help
 
 安装准备成功不等于 Chrome 已加载。`--status` 未就绪返回 3，无法确认/不可信状态返回 1；默认 setup 在文件已就绪但等待手动加载时可返回 0，终端会明确显示未连接。检查仅使用有界 hello 握手，验证 nonce、协议和必需能力，不请求页面内容。握手兼容不证明 Chrome 已重载最新文件。
 
+### 从旧 pi-agent 目录升级
+
+旧版使用 `~/Library/Application Support/pi-agent/browser-relay`。升级到 alpha.2 后：
+
+1. 在 `chrome://extensions` 手动停用旧扩展，等待旧 Host 退出。
+2. 运行 `rotom setup browser`。命令从当前包重建新目录并更新 Host 注册，不复制旧目录中的文件。
+3. 移除 Chrome 中旧路径的扩展条目，加载命令显示的 `rotom` 新目录；重新启动 rotom 会话。
+4. 用 `rotom setup browser --status` 确认新路径的连接。
+
+旧目录及其文件保留原状（安装期间只使用临时互斥锁）；不会自动删除、搬运、创建目录 symlink 或中断 Host。新/旧路径有活动或无法确认的 Host、旧安装锁、目录身份异常或未知 Host 注册时，拒绝覆盖。新客户端不回退到旧 socket，旧连接在线不算新配置已就绪。`dev.pi_agent.browser_relay` 与扩展 ID 是兼容协议身份，不是对外产品名。
+
 日常直接运行 `rotom`，Chrome 扩展负责启动 Host，工具按需连接。更新 rotom、变更安装位置或更换 Node 后重新运行 setup；固定扩展目录不变。若检测到活动 Host 且需要更新文件，会拒绝覆盖：请先手动停用扩展、等待 Host 退出，完成 setup 后重新启用/重载。未知文件、symlink、权限异常或未完成的安装锁会阻断，不自动清理、杀进程或重放写入。失败可能留下部分安装，需检查后明确重跑。
 
 当前只有 macOS 配置路径受支持。自动安装与连接分支通过隔离 HOME/模拟 relay 验证；真实 Chrome 首次加载和升级重载仍需人工验收。

package/bin/pi-agent

@@ -176,7 +176,9 @@ claude_user_skill_dir=
 if [ "${HOME+x}" = x ]; then
 	claude_user_skill_dir="$HOME/.claude/skills"
 fi
-if [ "$load_claude_project_skills" -eq 1 ]; then
+# Setup has no session skills: prepending --skill would corrupt its original
+# setup/browser argv before the checked dispatch below consumes those two words.
+if [ "$setup_browser" -eq 0 ] && [ "$load_claude_project_skills" -eq 1 ]; then
 	claude_repo_root=
 	claude_probe_dir=$PWD
 	while :; do
@@ -206,7 +208,7 @@ if [ "$load_claude_project_skills" -eq 1 ]; then
 		claude_scan_dir=$claude_parent_dir
 	done
 fi
-if [ -n "$claude_user_skill_dir" ] && [ -d "$claude_user_skill_dir" ]; then
+if [ "$setup_browser" -eq 0 ] && [ -n "$claude_user_skill_dir" ] && [ -d "$claude_user_skill_dir" ]; then
 	set -- --skill "$claude_user_skill_dir" "$@"
 fi
 

package/extensions/browser/browser-relay.ts

@@ -7,6 +7,7 @@ import { join } from "node:path";
 import { connect, type Socket } from "node:net";
 
 import { compatibleRelayReady } from "./relay-protocol.mjs";
+import { BROWSER_RELAY_SUPPORT_RELATIVE } from "../../runtime/product-config.mjs";
 export {
 	BROWSER_RELAY_PROTOCOL_REVISION_V1, BROWSER_RELAY_FULL_READ_CAPABILITY_V1,
 	BROWSER_RELAY_MULTI_CLIENT_CAPABILITY_V1, BROWSER_RELAY_COORDINATE_CLICK_CAPABILITY_V1,
@@ -26,7 +27,7 @@ const MAX_MODEL_NODES = 1_000;
 const MAX_STRING_BYTES = 4_096;
 
 export function browserRelaySocketPathV1(): string {
-	return join(homedir(), "Library", "Application Support", "pi-agent", "browser-relay", "relay.sock");
+	return join(homedir(), BROWSER_RELAY_SUPPORT_RELATIVE, "relay.sock");
 }
 
 function record(value: unknown): value is Record<string, unknown> {
@@ -349,12 +350,12 @@ export class BrowserRelayClientV1 {
 			if (handshakeRemainingMs <= 0) throw new Error("browser relay 连接超时；请确认 Chrome 扩展已启用");
 			const nonce = randomUUID();
 			const ready = await client.request("hello", { nonce }, { timeoutMs: Math.max(1, handshakeRemainingMs) });
-			if (!compatibleRelayReady(ready, nonce)) throw new Error("browser relay 版本过旧；请在 chrome://extensions 重载 Pi Agent Browser Relay");
+			if (!compatibleRelayReady(ready, nonce)) throw new Error("browser relay 版本过旧；请在 chrome://extensions 重载 rotom Browser Relay");
 			return client;
 		} catch (error) {
 			client.close();
 			const failure = error instanceof Error ? error : new Error(String(error));
-			if (/browser relay busy; another operation is active/iu.test(failure.message)) throw new Error("browser relay 协议过旧且仍使用单 client busy 仲裁；请在 chrome://extensions 重载 Pi Agent Browser Relay", { cause: failure });
+			if (/browser relay busy; another operation is active/iu.test(failure.message)) throw new Error("browser relay 协议过旧且仍使用单 client busy 仲裁；请在 chrome://extensions 重载 rotom Browser Relay", { cause: failure });
 			throw failure;
 		}
 	}

package/extensions/browser/chrome-extension/manifest.json

@@ -1,8 +1,8 @@
 {
   "manifest_version": 3,
-  "name": "Pi Agent Browser Relay",
-	"version": "0.9.0",
-  "description": "Connects Pi Agent to Chrome tabs with direct trusted-local inspection and interaction.",
+  "name": "rotom Browser Relay",
+  "version": "0.9.1",
+  "description": "Connects rotom to Chrome tabs with direct trusted-local inspection and interaction.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArCtbXZfW6PA0XsZFuZcFOxDP3k5PgUj5OnXjcsFQlkal7dq4g/FTg99qoiFj1d60bnGOtFrlPzkSImwREFz3R1ax9xwtSK8yAI8aUSqbY3UMoLoDSuD4gQ/eLBskCJju4b1UJ6aBH+047GEYPhC7532lrEuIeFoReXkkCJP4GPWmU2Ac0TrcYVni7nfet4LlnfbVnp7Sp2IRH0/WNpGUCHlGFvYwHqm9Kw4AzI9FcBe08cPPkNaCUr+bjpnkPkvi1/gQz2wDNPJlCTXzPsdYDog0BsWHn69Pm6y7N40TkNtj2jPZsmcd6KciZQpUkPAl895q/3f6hZnDovDOGJs4NQIDAQAB",
   "minimum_chrome_version": "125",
   "permissions": [
@@ -18,6 +18,6 @@
     "type": "module"
   },
   "action": {
-    "default_title": "Pi Agent Browser Relay"
+    "default_title": "rotom Browser Relay"
   }
 }

package/extensions/browser/install-chrome-relay.mjs

@@ -7,7 +7,7 @@ import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { probeRelay } from "./relay-setup-probe.mjs";
-import { DISTRIBUTION_PACKAGE_NAME } from "../../runtime/product-config.mjs";
+import { BROWSER_RELAY_SUPPORT_RELATIVE, DISTRIBUTION_PACKAGE_NAME, LEGACY_BROWSER_RELAY_SUPPORT_RELATIVE } from "../../runtime/product-config.mjs";
 
 const HOST_NAME = "dev.pi_agent.browser_relay";
 const EXTENSION_ID = "kgadcllokaodnoknakblocmhidemimdi";
@@ -62,14 +62,14 @@ async function context({ home = homedir(), sourceDir = ROOT, platform = process.
 	if (id !== EXTENSION_ID || manifest.manifest_version !== 3 || manifest.background?.service_worker !== "service-worker.js") throw new Error("Chrome extension identity 无效");
 	const nativeHostSource = join(sourceDir, "native-host.mjs");
 	await regularFile(nativeHostSource);
-	const supportRelative = "Library/Application Support/pi-agent/browser-relay";
+	const supportRelative = BROWSER_RELAY_SUPPORT_RELATIVE;
 	const chromeRelative = "Library/Application Support/Google/Chrome/NativeMessagingHosts";
 	const supportDir = join(home, supportRelative);
 	const extensionDir = join(supportDir, "extension");
 	const launcherPath = join(supportDir, "native-host-launcher.sh");
 	const nativeHostManifest = join(home, chromeRelative, `${HOST_NAME}.json`);
 	const launcher = Buffer.from(`#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(nativeHostSource)}\n`);
-	const nativeManifest = Buffer.from(`${JSON.stringify({ name: HOST_NAME, description: "Pi Agent Browser Relay Native Messaging Host", path: launcherPath, type: "stdio", allowed_origins: [`chrome-extension://${EXTENSION_ID}/`] }, null, 2)}\n`);
+	const nativeManifest = Buffer.from(`${JSON.stringify({ name: HOST_NAME, description: "rotom Browser Relay Native Messaging Host", path: launcherPath, type: "stdio", allowed_origins: [`chrome-extension://${EXTENSION_ID}/`] }, null, 2)}\n`);
 	return { home, files, supportRelative, chromeRelative, supportDir, extensionDir, launcherPath, nativeHostManifest, launcher, nativeManifest, socketPath: join(supportDir, "relay.sock"), extensionVersion: manifest.version };
 }
 
@@ -89,9 +89,16 @@ async function installationMatches(c) {
 		&& (await regularFile(c.nativeHostManifest, true)).equals(c.nativeManifest);
 }
 
+async function legacyDirectory(c) {
+	const path = join(c.home, LEGACY_BROWSER_RELAY_SUPPORT_RELATIVE);
+	try { await directory(c.home, LEGACY_BROWSER_RELAY_SUPPORT_RELATIVE, false, true); return { state: "present", path }; }
+	catch (error) { return { state: error.code === "ENOENT" ? "absent" : "blocked", path }; }
+}
+
 async function currentStatus(c) {
-	try { return { ...details(c), installed: await installationMatches(c) }; }
-	catch (error) { return { ...details(c), installed: false, reason: error.code === "ENOENT" ? "not-installed-or-partial" : "identity-or-permission-mismatch" }; }
+	const legacy = await legacyDirectory(c);
+	try { return { ...details(c), legacyDirectory: legacy, installed: await installationMatches(c) }; }
+	catch (error) { return { ...details(c), legacyDirectory: legacy, installed: false, reason: error.code === "ENOENT" ? "not-installed-or-partial" : "identity-or-permission-mismatch" }; }
 }
 
 export async function browserRelayStatus(options = {}) {
@@ -116,15 +123,24 @@ async function atomicWrite(c, path, bytes, mode) {
 
 export async function installBrowserRelay(options = {}) {
 	const c = await context(options); // Validate bundled bytes before any HOME writes.
-	await directory(c.home, "Library/Application Support/pi-agent", true, true);
+	const legacy = await legacyDirectory(c);
+	if (legacy.state === "blocked") throw new Error("旧 pi-agent relay 目录身份或权限不可信；保留原状，请人工检查");
+	await directory(c.home, dirname(c.supportRelative), true, true);
 	await directory(c.home, c.supportRelative, true, true);
 	await directory(c.home, c.chromeRelative, true);
-	const lockPath = join(c.supportDir, ".setup.lock");
-	let lock;
-	try { lock = await open(lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600); }
-	catch { throw new Error("setup 被锁定；另一次安装或未完成的安装需先确认，不能自动清理锁"); }
-	const lockIdentity = await lock.stat();
+	const locks = [];
 	try {
+		// Coordinate with an existing alpha.0/alpha.1 installer as well as new
+		// setup processes. Do not create a legacy tree on a fresh installation.
+		const directories = legacy.state === "present" ? [legacy.path, c.supportDir] : [c.supportDir];
+		for (const path of directories) {
+			await directory(c.home, path === legacy.path ? LEGACY_BROWSER_RELAY_SUPPORT_RELATIVE : c.supportRelative, false, true);
+			const lockPath = join(path, ".setup.lock");
+			let handle;
+			try { handle = await open(lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600); }
+			catch { throw new Error("setup 被锁定；另一次安装或未完成的安装需先确认，不能自动清理锁"); }
+			locks.push({ handle, path: lockPath, identity: await handle.stat() });
+		}
 		await directory(c.home, `${c.supportRelative}/extension`, true, true);
 		// Never delete unknown files or follow symlinks to make an install succeed.
 		for (const name of await readdir(c.extensionDir)) {
@@ -136,20 +152,34 @@ export async function installBrowserRelay(options = {}) {
 		}
 		const before = await currentStatus(c);
 		if (before.installed) return { ...before, changed: false, reloadRequired: false };
-		const connection = await probeRelay(c.socketPath);
-		if (connection.state !== "not-connected") throw new Error("检测到活动或无法确认的 relay；请先在 Chrome 停用扩展并等待 Host 退出，再运行 setup。不会中断会话");
+		// This manifest name is shared with the old installation. Only replace
+		// our two known launcher coordinates, never an unrelated registration.
+		try {
+			const registered = JSON.parse(await regularFile(c.nativeHostManifest, true));
+			if (registered.name !== HOST_NAME || registered.type !== "stdio" || JSON.stringify(registered.allowed_origins) !== JSON.stringify([`chrome-extension://${EXTENSION_ID}/`]) || ![c.launcherPath, join(legacy.path, "native-host-launcher.sh")].includes(registered.path)) throw new Error("未知 Native Host 注册；不会覆盖");
+		} catch (error) { if (error.code !== "ENOENT") throw error; }
+		for (const path of [c.socketPath, ...(legacy.state === "present" ? [join(legacy.path, "relay.sock")] : [])]) {
+			const connection = await probeRelay(path);
+			if (connection.state !== "not-connected") throw new Error("检测到新/旧目录中活动或无法确认的 relay；请先在 Chrome 停用旧扩展并等待 Host 退出，再运行 setup。不会中断会话");
+		}
 		// Manifest last: no claim of completion until all bytes read back exactly.
 		for (const [name, bytes] of c.files) if (name !== "manifest.json") await atomicWrite(c, join(c.extensionDir, name), bytes, 0o600);
 		await atomicWrite(c, join(c.extensionDir, "manifest.json"), c.files.get("manifest.json"), 0o600);
 		await atomicWrite(c, c.launcherPath, c.launcher, 0o700);
 		await atomicWrite(c, c.nativeHostManifest, c.nativeManifest, 0o600);
 		if (!await installationMatches(c)) throw new Error("setup readback 未通过；安装可能部分完成");
-		return { ...details(c), installed: true, changed: true, reloadRequired: true };
+		return { ...details(c), legacyDirectory: legacy, installed: true, changed: true, reloadRequired: true };
 	} finally {
-		await lock.close();
-		const current = await lstat(lockPath);
-		if (!current.isFile() || current.isSymbolicLink() || current.dev !== lockIdentity.dev || current.ino !== lockIdentity.ino) throw new Error("setup lock identity 漂移；未删除未知锁");
-		await unlink(lockPath);
+		let cleanupError;
+		for (const lock of locks.reverse()) {
+			try {
+				await lock.handle.close();
+				const current = await lstat(lock.path);
+				if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1 || current.dev !== lock.identity.dev || current.ino !== lock.identity.ino) throw new Error("setup lock identity 漂移；未删除未知锁");
+				await unlink(lock.path);
+			} catch (error) { cleanupError ??= error; }
+		}
+		if (cleanupError) throw cleanupError;
 	}
 }
 
@@ -175,6 +205,8 @@ export async function runBrowserSetup(args, { stdout = process.stdout, interacti
 	const installation = statusOnly ? await currentStatus(c) : await installBrowserRelay();
 	stdout.write(installation.installed ? "本机准备完成（不等于 Chrome 已加载扩展）。\n" : "本机安装缺失或漂移，请运行 rotom setup browser。\n");
 	stdout.write(`扩展目录：${installation.extensionDir}\n`);
+	if (installation.legacyDirectory.state === "present") stdout.write(`旧目录已保留：${installation.legacyDirectory.path}\n请移除 Chrome 中旧路径的扩展条目，再加载上面的 rotom 目录，并重启 rotom 会话。不会复制旧文件或自动删除旧目录。\n`);
+	if (installation.legacyDirectory.state === "blocked") stdout.write("旧目录身份或权限异常，无法确认迁移状态。\n");
 	stdout.write("首次使用：打开 chrome://extensions → 开启开发者模式 → 加载已解压的扩展程序 → 选择上述目录。\n已有旧路径安装时，请手动移除旧条目并加载此固定目录；不要同时加载同一扩展 ID。\n");
 	if (installation.reloadRequired) stdout.write("本次写入了文件：请加载/重载扩展。连接检查只证明协议兼容，不证明 Chrome 已重载最新文件。\n");
 	const deadline = Date.now() + seconds * 1000;
@@ -187,7 +219,7 @@ export async function runBrowserSetup(args, { stdout = process.stdout, interacti
 	}
 	stdout.write(connection.state === "connected" ? (installation.installed ? "浏览器已连接，协议兼容。\n" : "发现兼容连接，但当前本机安装尚未就绪。\n") : connection.state === "incompatible" ? "扩展协议不兼容，请在 Chrome 重载或更新扩展。\n" : "尚未确认浏览器连接；完成 Chrome 操作后运行 rotom setup browser --status。\n");
 	stdout.write(`${JSON.stringify({ installation, connection })}\n`);
-	if (connection.state === "unknown" || connection.state === "blocked") return 1;
+	if (connection.state === "unknown" || connection.state === "blocked" || installation.legacyDirectory.state === "blocked") return 1;
 	return statusOnly && (!installation.installed || connection.state !== "connected") || connection.state === "incompatible" ? 3 : 0;
 }
 
@@ -196,6 +228,9 @@ async function uninstall() {
 	for (const relative of [c.supportRelative, c.chromeRelative]) {
 		try { await directory(c.home, relative); } catch (error) { if (error.code !== "ENOENT") throw error; }
 	}
+	try {
+		if (!(await regularFile(c.nativeHostManifest, true)).equals(c.nativeManifest)) throw new Error("Host 注册不属于当前 rotom 安装；不会删除旧版或未知注册");
+	} catch (error) { if (error.code !== "ENOENT") throw error; }
 	for (const path of [c.nativeHostManifest, c.launcherPath]) {
 		try { await regularFile(path, true); await unlink(path); } catch (error) { if (error.code !== "ENOENT") throw error; }
 	}

package/extensions/browser/native-host.mjs

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 
-import { chmodSync, existsSync, lstatSync, mkdirSync, unlinkSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, realpathSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { BROWSER_RELAY_SUPPORT_RELATIVE } from "../../runtime/product-config.mjs";
 import { createConnection, createServer } from "node:net";
 
 const SCHEMA_VERSION = 1;
 const MAX_MESSAGE_BYTES = 1024 * 1024;
-const relayDir = join(homedir(), "Library", "Application Support", "pi-agent", "browser-relay");
+const relayDir = join(homedir(), BROWSER_RELAY_SUPPORT_RELATIVE);
 const socketPath = join(relayDir, "relay.sock");
+let boundSocketIdentity;
 let nativeBuffer = Buffer.alloc(0);
 const clients = new Set();
 const clientBuffers = new Map();
@@ -19,13 +21,16 @@ let stdoutChain = Promise.resolve();
 function ensurePrivateDirectory(path) {
 	if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });
 	const info = lstatSync(path);
-	if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o077) !== 0) throw new Error(`browser relay private directory 无效：${path}`);
+	if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(path) !== path || info.uid !== process.getuid() || (info.mode & 0o077) !== 0) throw new Error(`browser relay private directory 无效：${path}`);
 }
 
 function setupDirectories() {
 	const applicationSupport = join(homedir(), "Library", "Application Support");
-	if (!existsSync(applicationSupport) || !lstatSync(applicationSupport).isDirectory()) throw new Error("Application Support 目录不存在");
-	ensurePrivateDirectory(join(applicationSupport, "pi-agent"));
+	for (const path of [homedir(), join(homedir(), "Library"), applicationSupport]) {
+		const info = lstatSync(path);
+		if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(path) !== path || info.uid !== process.getuid() || (info.mode & 0o022) !== 0) throw new Error("browser relay parent directory 不可信");
+	}
+	ensurePrivateDirectory(dirname(relayDir));
 	ensurePrivateDirectory(relayDir);
 }
 
@@ -125,7 +130,10 @@ function cleanupClient(client) {
 
 function cleanupSocket() {
 	try {
-		if (existsSync(socketPath) && lstatSync(socketPath).isSocket()) unlinkSync(socketPath);
+		if (!boundSocketIdentity) return;
+		const info = lstatSync(socketPath);
+		if (info.isSocket() && !info.isSymbolicLink() && info.dev === boundSocketIdentity.dev && info.ino === boundSocketIdentity.ino) unlinkSync(socketPath);
+		boundSocketIdentity = undefined;
 	} catch { /* process exit cleanup is best effort; next start validates stale socket */ }
 }
 
@@ -142,9 +150,9 @@ async function listen(server) {
 async function socketIsLive() {
 	return new Promise((resolve) => {
 		const client = createConnection(socketPath);
-		const timer = setTimeout(() => { client.destroy(); resolve(false); }, 500);
-		client.once("connect", () => { clearTimeout(timer); client.destroy(); resolve(true); });
-		client.once("error", () => { clearTimeout(timer); resolve(false); });
+		const timer = setTimeout(() => { client.destroy(); resolve("unknown"); }, 500);
+		client.once("connect", () => { clearTimeout(timer); client.destroy(); resolve("live"); });
+		client.once("error", (error) => { clearTimeout(timer); resolve(error.code === "ECONNREFUSED" || error.code === "ENOENT" ? "stale" : "unknown"); });
 	});
 }
 
@@ -165,12 +173,16 @@ async function main() {
 		await listen(server);
 	} catch (error) {
 		if (error?.code !== "EADDRINUSE") throw error;
-		if (await socketIsLive()) throw new Error("另一个 browser relay native host 已运行");
-		const info = lstatSync(socketPath);
-		if (!info.isSocket() || info.isSymbolicLink()) throw new Error("browser relay stale path 不是 socket");
+		const before = lstatSync(socketPath);
+		if (!before.isSocket() || before.isSymbolicLink() || before.uid !== process.getuid() || (before.mode & 0o077) !== 0) throw new Error("browser relay existing socket 不可信");
+		if (await socketIsLive() !== "stale") throw new Error("另一个 browser relay native host 已运行或状态未知");
+		const after = lstatSync(socketPath);
+		if (before.dev !== after.dev || before.ino !== after.ino) throw new Error("browser relay stale socket identity 漂移");
 		unlinkSync(socketPath);
 		await listen(server);
 	}
+	// A failed second host must never unlink the first host's socket on exit.
+	boundSocketIdentity = lstatSync(socketPath);
 	server.on("error", () => process.exit(73));
 	chmodSync(socketPath, 0o600);
 	process.stdin.on("data", (chunk) => {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@bingjiang0611/rotom",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bingjiang0611/rotom",
-      "version": "0.1.0-alpha.0",
+      "version": "0.1.0-alpha.2",
       "license": "MIT",
       "os": [
         "darwin",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bingjiang0611/rotom",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.2",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org", "tag": "alpha" },
   "description": "Personal coding agent built on Pi, with explicit tools and runtime contracts",
   "license": "MIT",

package/runtime/product-config.mjs

@@ -1,4 +1,7 @@
 export const DISTRIBUTION_PACKAGE_NAME = "@bingjiang0611/rotom";
+export const BROWSER_RELAY_SUPPORT_RELATIVE = "Library/Application Support/rotom/browser-relay";
+// Migration detection only; new sessions never fall back to the old socket.
+export const LEGACY_BROWSER_RELAY_SUPPORT_RELATIVE = "Library/Application Support/pi-agent/browser-relay";
 export const VERIFIED_PI_PACKAGE = "@earendil-works/pi-coding-agent";
 export const DISTRIBUTION_PI_VERSION = "0.85.1";
 export const DISTRIBUTION_PI_INTEGRITY = "sha512-FGRN+OHbWaefBPGaTggAdLjrIHW+s2PzLyglz/5dfLzb9of7uuXMXYC0fJIeZTw+shS32o2cuQ9jF7YSDuL/oQ==";