@cli-remote/local 0.3.2 → 0.3.4

package/dist/index.cjs

@@ -2265,7 +2265,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes3, createHash } = require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash2 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2933,7 +2933,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3302,7 +3302,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash } = require("crypto");
+    var { createHash: createHash2 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3609,7 +3609,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -9940,9 +9940,9 @@ var require_lib = __commonJS({
 
 // src/index.ts
 var import_node_fs5 = require("node:fs");
-var import_node_child_process3 = require("node:child_process");
-var import_node_os7 = require("node:os");
-var import_node_path7 = require("node:path");
+var import_node_child_process4 = require("node:child_process");
+var import_node_os8 = require("node:os");
+var import_node_path8 = require("node:path");
 var import_node_url = require("node:url");
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/wrapper.mjs
@@ -9957,11 +9957,11 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
 // src/client.ts
-var import_node_child_process2 = require("node:child_process");
+var import_node_child_process3 = require("node:child_process");
 var import_node_readline = require("node:readline");
 var import_node_fs4 = require("node:fs");
-var import_node_os6 = require("node:os");
-var import_node_path6 = require("node:path");
+var import_node_os7 = require("node:os");
+var import_node_path7 = require("node:path");
 
 // ../shared/src/codec.ts
 var import_msgpack = __toESM(require_dist(), 1);
@@ -10042,6 +10042,10 @@ function buildEnv() {
   }
   delete env.NO_COLOR;
   env.COLORTERM = "truecolor";
+  if (!env.LC_ALL && !env.LANG) {
+    env.LANG = process.env.PTY_LANG || "zh_CN.UTF-8";
+  }
+  env.TERM ||= "xterm-256color";
   if (process.env.PTY_HOME) env.HOME = process.env.PTY_HOME;
   return env;
 }
@@ -10602,18 +10606,148 @@ function startSetupCallback(timeoutMs = 3 * 6e4) {
 }
 
 // src/auth.ts
+var import_node_child_process2 = require("node:child_process");
+var import_node_crypto3 = require("node:crypto");
+var import_promises3 = require("node:fs/promises");
+var import_node_os6 = require("node:os");
+var import_node_path6 = require("node:path");
+var import_qrcode = __toESM(require_lib(), 1);
+
+// src/machine-id.ts
 var import_node_child_process = require("node:child_process");
 var import_node_crypto2 = require("node:crypto");
 var import_promises2 = require("node:fs/promises");
 var import_node_os5 = require("node:os");
 var import_node_path5 = require("node:path");
-var import_qrcode = __toESM(require_lib(), 1);
+var import_node_util = require("node:util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var MACHINE_ID_DOMAIN = "cli-remote.machineid.v1";
+function normalizeHardwareId(raw) {
+  return raw.trim().toLowerCase().replace(/\s+/g, " ");
+}
+var GARBAGE_VALUES = /* @__PURE__ */ new Set([
+  "",
+  "none",
+  "null",
+  "default string",
+  "system serial number",
+  "to be filled by o.e.m.",
+  "to be filled by oem",
+  "not specified",
+  "not available",
+  "unknown",
+  "chassis manufacturer",
+  "no enclosure",
+  "empty"
+]);
+function isValidHardwareId(raw) {
+  const v = normalizeHardwareId(raw);
+  if (v.length < 4) return false;
+  if (GARBAGE_VALUES.has(v)) return false;
+  const digits = v.replace(/[^0-9a-f]/g, "");
+  if (digits.length >= 8 && /^([0-9a-f])\1*$/.test(digits)) return false;
+  return true;
+}
+function deriveMachineId(tag, raw) {
+  const h = (0, import_node_crypto2.createHash)("sha256").update(`${MACHINE_ID_DOMAIN}|${tag}|${normalizeHardwareId(raw)}`).digest("hex");
+  return "m_" + h.slice(0, 32);
+}
+async function ioregValue(exec, key) {
+  try {
+    const { stdout } = await exec("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+    const m = stdout.match(new RegExp(`"${key}"\\s*=\\s*"([^"]*)"`));
+    return m?.[1] ? normalizeHardwareId(m[1]) : null;
+  } catch {
+    return null;
+  }
+}
+async function firstPhysicalMacMac(deps) {
+  try {
+    const names = (await deps.readDir("/sys/class/net")).sort();
+    for (const name of names) {
+      const base = (0, import_node_path5.join)("/sys/class/net", name);
+      if (!await deps.statOrNull((0, import_node_path5.join)(base, "device"))) continue;
+      const mac = await deps.readFile((0, import_node_path5.join)(base, "address"));
+      return normalizeHardwareId(mac);
+    }
+  } catch {
+  }
+  return null;
+}
+async function winMachineGuid(exec) {
+  try {
+    const { stdout } = await exec("reg", [
+      "query",
+      "HKLM\\SOFTWARE\\Microsoft\\Cryptography",
+      "/v",
+      "MachineGuid"
+    ]);
+    const m = stdout.match(/MachineGuid\s+REG_SZ\s+(\S+)/i);
+    return m?.[1] ? normalizeHardwareId(m[1]) : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveHardwareMachineId(deps = {}) {
+  const plat = deps.platform ?? (0, import_node_os5.platform)();
+  const readFileDeps = deps.readFile ?? ((p) => (0, import_promises2.readFile)(p, "utf-8"));
+  const execDeps = deps.exec ?? (async (cmd, args) => {
+    const { stdout } = await execFileAsync(cmd, args, { timeout: 3e3 });
+    return { stdout };
+  });
+  const candidates = [];
+  if (plat === "darwin") {
+    candidates.push(
+      { tag: "mac:serial", raw: await ioregValue(execDeps, "IOPlatformSerialNumber") },
+      { tag: "mac:platform-uuid", raw: await ioregValue(execDeps, "IOPlatformUUID") }
+    );
+  } else if (plat === "linux") {
+    const readFileOrNull = async (p) => {
+      try {
+        return await readFileDeps(p);
+      } catch {
+        return null;
+      }
+    };
+    candidates.push(
+      { tag: "linux:product-uuid", raw: await readFileOrNull("/sys/class/dmi/id/product_uuid") },
+      { tag: "linux:board-serial", raw: await readFileOrNull("/sys/class/dmi/id/board_serial") },
+      { tag: "linux:machine-id", raw: await readFileOrNull("/etc/machine-id") },
+      { tag: "linux:machine-id", raw: await readFileOrNull("/var/lib/dbus/machine-id") },
+      {
+        tag: "linux:nic-mac",
+        raw: await firstPhysicalMacMac({
+          readFile: readFileDeps,
+          readDir: deps.readDir ?? ((p) => (0, import_promises2.readdir)(p)),
+          statOrNull: deps.statOrNull ?? (async (p) => {
+            try {
+              await (0, import_promises2.stat)(p);
+              return true;
+            } catch {
+              return false;
+            }
+          })
+        })
+      }
+    );
+  } else if (plat === "win32") {
+    candidates.push({ tag: "win:machine-guid", raw: await winMachineGuid(execDeps) });
+  }
+  for (const c of candidates) {
+    if (c.raw !== null && isValidHardwareId(c.raw)) {
+      return { id: deriveMachineId(c.tag, c.raw), source: c.tag };
+    }
+  }
+  return null;
+}
+
+// src/auth.ts
 function credentialsPath() {
-  return (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
+  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
 }
 async function loadCredentials() {
   try {
-    const raw = JSON.parse(await (0, import_promises2.readFile)(credentialsPath(), "utf-8"));
+    const raw = JSON.parse(await (0, import_promises3.readFile)(credentialsPath(), "utf-8"));
     if (!raw.deviceId || !raw.accessToken || !raw.refreshToken) return null;
     return raw;
   } catch {
@@ -10622,10 +10756,10 @@ async function loadCredentials() {
 }
 async function saveCredentials(creds) {
   const path = credentialsPath();
-  await (0, import_promises2.mkdir)((0, import_node_path5.join)(path, ".."), { recursive: true });
-  await (0, import_promises2.writeFile)(path, JSON.stringify(creds, null, 2) + "\n", { mode: 384 });
+  await (0, import_promises3.mkdir)((0, import_node_path6.join)(path, ".."), { recursive: true });
+  await (0, import_promises3.writeFile)(path, JSON.stringify(creds, null, 2) + "\n", { mode: 384 });
   try {
-    await (0, import_promises2.chmod)(path, 384);
+    await (0, import_promises3.chmod)(path, 384);
   } catch {
   }
 }
@@ -10651,7 +10785,7 @@ function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = (0, import_node_child_process.spawn)(cmd, args, { stdio: "ignore", detached: true });
+    const child = (0, import_node_child_process2.spawn)(cmd, args, { stdio: "ignore", detached: true });
     child.unref();
   } catch {
   }
@@ -10673,15 +10807,15 @@ async function loginAndFetchRegistrationKey(baseUrl, email, password) {
   return { registrationKey: data.registrationKey, user: data.user?.email ?? email };
 }
 async function mergeLocalConfig(patch) {
-  const dir = (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR);
-  const path = (0, import_node_path5.join)(dir, CONFIG_FILE);
+  const dir = (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR);
+  const path = (0, import_node_path6.join)(dir, CONFIG_FILE);
   let existing = {};
   try {
-    existing = JSON.parse(await (0, import_promises2.readFile)(path, "utf-8"));
+    existing = JSON.parse(await (0, import_promises3.readFile)(path, "utf-8"));
   } catch {
   }
-  await (0, import_promises2.mkdir)(dir, { recursive: true });
-  await (0, import_promises2.writeFile)(path, JSON.stringify({ ...existing, ...patch }, null, 2) + "\n");
+  await (0, import_promises3.mkdir)(dir, { recursive: true });
+  await (0, import_promises3.writeFile)(path, JSON.stringify({ ...existing, ...patch }, null, 2) + "\n");
 }
 var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
 var AuthError = class extends Error {
@@ -10695,7 +10829,7 @@ async function deviceFlowAuthorize(baseUrl, registrationKey, deviceId) {
   const res = await postJson(`${baseUrl}/oauth/device_authorization`, {
     registrationKey,
     device_id: deviceId,
-    device_name: (0, import_node_os5.hostname)(),
+    device_name: (0, import_node_os6.hostname)(),
     platform: process.platform
   });
   if (res.status !== 200) {
@@ -10785,14 +10919,19 @@ async function ensureFreshAccessToken(baseUrl, creds) {
   return refreshInFlight;
 }
 async function ensureMachineId() {
-  const path = (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR, CONFIG_FILE);
+  const path = (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, CONFIG_FILE);
   try {
-    const cfg = JSON.parse(await (0, import_promises2.readFile)(path, "utf-8"));
+    const cfg = JSON.parse(await (0, import_promises3.readFile)(path, "utf-8"));
     if (typeof cfg.machineId === "string" && cfg.machineId) return cfg.machineId;
   } catch {
   }
-  const machineId = "m_" + (0, import_node_crypto2.randomBytes)(16).toString("hex");
-  await mergeLocalConfig({ machineId });
+  const hw = await resolveHardwareMachineId();
+  if (hw) {
+    await mergeLocalConfig({ machineId: hw.id, machineIdSource: hw.source });
+    return hw.id;
+  }
+  const machineId = "m_" + (0, import_node_crypto3.randomBytes)(16).toString("hex");
+  await mergeLocalConfig({ machineId, machineIdSource: "random" });
   return machineId;
 }
 async function stableDeviceId() {
@@ -10815,7 +10954,7 @@ function isPermanentAuthFailure(e) {
   return e instanceof AuthError && e.message.includes("invalid_grant");
 }
 async function loadConfig() {
-  const path = (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, CONFIG_FILE);
+  const path = (0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, CONFIG_FILE);
   try {
     return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf-8"));
   } catch {
@@ -10847,10 +10986,10 @@ function detectCommands() {
   for (const [cmd, bin] of bins) {
     let ok = false;
     if (process.platform === "win32") {
-      ok = (0, import_node_child_process2.spawnSync)("where", [bin], { timeout: 5e3 }).status === 0;
+      ok = (0, import_node_child_process3.spawnSync)("where", [bin], { timeout: 5e3 }).status === 0;
     } else {
       const shell = process.env.SHELL ?? "/bin/bash";
-      ok = (0, import_node_child_process2.spawnSync)(shell, ["-l", "-c", `command -v ${bin}`], {
+      ok = (0, import_node_child_process3.spawnSync)(shell, ["-l", "-c", `command -v ${bin}`], {
         timeout: 5e3
       }).status === 0;
     }
@@ -11425,10 +11564,10 @@ async function startLocal(opts = {}) {
   }
 }
 function credentialsPathOf() {
-  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "credentials.json");
+  return (0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "credentials.json");
 }
 function instanceLockPath() {
-  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "instance.lock");
+  return (0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "instance.lock");
 }
 function processAlive(pid) {
   try {
@@ -11448,7 +11587,7 @@ function acquireSingleInstanceLock() {
   } catch {
   }
   try {
-    (0, import_node_fs4.mkdirSync)((0, import_node_path6.join)(path, ".."), { recursive: true });
+    (0, import_node_fs4.mkdirSync)((0, import_node_path7.join)(path, ".."), { recursive: true });
     (0, import_node_fs4.writeFileSync)(path, String(process.pid));
   } catch {
   }
@@ -11478,10 +11617,10 @@ function toUint8(raw) {
   throw new Error("unexpected raw type");
 }
 function gatewayPidFile() {
-  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid");
+  return (0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid");
 }
 function writeGatewayPid() {
-  (0, import_node_fs4.mkdirSync)((0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR), { recursive: true });
+  (0, import_node_fs4.mkdirSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR), { recursive: true });
   (0, import_node_fs4.writeFileSync)(gatewayPidFile(), String(process.pid));
 }
 function removeGatewayPid() {
@@ -11526,11 +11665,11 @@ function resolveHere() {
     if (DEBUG) console.error("[debug] cannot resolve script path");
     return;
   }
-  const hereDir = (0, import_node_path7.dirname)(here);
+  const hereDir = (0, import_node_path8.dirname)(here);
   const candidates = [
-    (0, import_node_path7.join)(hereDir, "..", "node_modules", "node-pty", "prebuilds"),
-    (0, import_node_path7.join)(hereDir, "..", "..", "node-pty", "prebuilds"),
-    (0, import_node_path7.join)(hereDir, "..", "..", "..", "node_modules", "node-pty", "prebuilds")
+    (0, import_node_path8.join)(hereDir, "..", "node_modules", "node-pty", "prebuilds"),
+    (0, import_node_path8.join)(hereDir, "..", "..", "node-pty", "prebuilds"),
+    (0, import_node_path8.join)(hereDir, "..", "..", "..", "node_modules", "node-pty", "prebuilds")
   ];
   let prebuildsDir = null;
   for (const c of candidates) {
@@ -11545,7 +11684,7 @@ function resolveHere() {
   }
   let n = 0;
   for (const sub of (0, import_node_fs5.readdirSync)(prebuildsDir)) {
-    const helper = (0, import_node_path7.join)(prebuildsDir, sub, "spawn-helper");
+    const helper = (0, import_node_path8.join)(prebuildsDir, sub, "spawn-helper");
     if ((0, import_node_fs5.existsSync)(helper)) {
       try {
         (0, import_node_fs5.chmodSync)(helper, 493);
@@ -11559,7 +11698,7 @@ function resolveHere() {
 var argUrl = process.argv[2];
 var argMatch = argUrl && (argUrl.startsWith("ws://") || argUrl.startsWith("wss://"));
 function readVersion() {
-  if (true) return "0.3.2";
+  if (true) return "0.3.4";
   try {
     const pkg = JSON.parse(
       (0, import_node_fs5.readFileSync)(new URL("../package.json", import_meta.url), "utf-8")
@@ -11619,7 +11758,7 @@ example:
 }
 var LAUNCHD_LABEL = "net.cli-remote.local";
 function launchdPlistPath() {
-  return (0, import_node_path7.join)((0, import_node_os7.homedir)(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+  return (0, import_node_path8.join)((0, import_node_os8.homedir)(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
 }
 function entryScript() {
   const a1 = process.argv[1];
@@ -11632,7 +11771,7 @@ function entryScript() {
 }
 function run(cmd, args, okToFail = false) {
   try {
-    return (0, import_node_child_process3.execFileSync)(cmd, args, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+    return (0, import_node_child_process4.execFileSync)(cmd, args, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     if (okToFail) return null;
     throw e;
@@ -11643,7 +11782,7 @@ function launchdInstall(urlArg) {
     console.error(`[local] launchd \u5E38\u9A7B\u4EC5\u652F\u6301 macOS\uFF08\u5F53\u524D ${process.platform}\uFF09\uFF1BLinux \u8BF7\u7528 systemd --user \u81EA\u884C\u6258\u7BA1`);
     process.exit(1);
   }
-  const home = (0, import_node_os7.homedir)();
+  const home = (0, import_node_os8.homedir)();
   const entry = entryScript();
   if (!entry) {
     console.error("[local] \u5F53\u524D\u4EE5\u6E90\u7801\uFF08tsx\uFF09\u6A21\u5F0F\u8FD0\u884C\uFF0C\u65E0\u6CD5\u5B89\u88C5\u5E38\u9A7B\u670D\u52A1\u3002");
@@ -11651,9 +11790,9 @@ function launchdInstall(urlArg) {
     process.exit(1);
   }
   if (urlArg) {
-    const cfgDir = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR);
+    const cfgDir = (0, import_node_path8.join)(home, DEFAULT_CONFIG_DIR);
     (0, import_node_fs5.mkdirSync)(cfgDir, { recursive: true });
-    const cfgPath = (0, import_node_path7.join)(cfgDir, "config.json");
+    const cfgPath = (0, import_node_path8.join)(cfgDir, "config.json");
     let cfg = {};
     try {
       cfg = JSON.parse((0, import_node_fs5.readFileSync)(cfgPath, "utf-8"));
@@ -11663,15 +11802,15 @@ function launchdInstall(urlArg) {
     (0, import_node_fs5.writeFileSync)(cfgPath, JSON.stringify(cfg, null, 2) + "\n");
     console.log(`[local] relayUrl \u5DF2\u5199\u5165 ${cfgPath}`);
   }
-  const credPath = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
+  const credPath = (0, import_node_path8.join)(home, DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
   if (!(0, import_node_fs5.existsSync)(credPath)) {
     console.error("[local] \u5C1A\u672A\u6388\u6743\uFF08\u627E\u4E0D\u5230 credentials.json\uFF09\u3002");
     console.error("[local] \u8BF7\u5148\u4EA4\u4E92\u5F0F\u8FD0\u884C\u4E00\u6B21 cli-local \u5B8C\u6210\u914D\u7F6E\u4E0E\u6388\u6743\uFF0C\u518D\u5B89\u88C5\u5E38\u9A7B\u670D\u52A1\u3002");
     process.exit(1);
   }
   const plist = launchdPlistPath();
-  const logDir = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR, "logs");
-  (0, import_node_fs5.mkdirSync)((0, import_node_path7.dirname)(plist), { recursive: true });
+  const logDir = (0, import_node_path8.join)(home, DEFAULT_CONFIG_DIR, "logs");
+  (0, import_node_fs5.mkdirSync)((0, import_node_path8.dirname)(plist), { recursive: true });
   (0, import_node_fs5.mkdirSync)(logDir, { recursive: true });
   const xml = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -11686,8 +11825,8 @@ function launchdInstall(urlArg) {
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
   <key>ThrottleInterval</key><integer>30</integer>
-  <key>StandardOutPath</key><string>${(0, import_node_path7.join)(logDir, "daemon.out.log")}</string>
-  <key>StandardErrorPath</key><string>${(0, import_node_path7.join)(logDir, "daemon.err.log")}</string>
+  <key>StandardOutPath</key><string>${(0, import_node_path8.join)(logDir, "daemon.out.log")}</string>
+  <key>StandardErrorPath</key><string>${(0, import_node_path8.join)(logDir, "daemon.err.log")}</string>
 </dict>
 </plist>
 `;
@@ -11730,8 +11869,8 @@ if (argUrl && !argMatch && argUrl === "uninstall") {
 }
 if (argUrl === "pair") {
   void (async () => {
-    const home = (0, import_node_os7.homedir)();
-    const cfgPath = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR, "config.json");
+    const home = (0, import_node_os8.homedir)();
+    const cfgPath = (0, import_node_path8.join)(home, DEFAULT_CONFIG_DIR, "config.json");
     let cfg = {};
     try {
       cfg = JSON.parse((0, import_node_fs5.readFileSync)(cfgPath, "utf-8"));
@@ -11769,7 +11908,7 @@ if (argUrl === "pair") {
 }
 if (argUrl === "gateway") {
   let gatewayLogFile = function() {
-    return (0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "logs", "gateway.log");
+    return (0, import_node_path8.join)((0, import_node_os8.homedir)(), DEFAULT_CONFIG_DIR, "logs", "gateway.log");
   }, gatewayLogs = function() {
     const follow = rest.includes("-f") || rest.includes("--follow");
     const li = rest.findIndex((a) => a === "-n" || a === "--lines");
@@ -11813,10 +11952,10 @@ if (argUrl === "gateway") {
       console.log(`[gateway] already running (pid ${gatewayPid()})`);
       process.exit(0);
     }
-    const home = (0, import_node_os7.homedir)();
+    const home = (0, import_node_os8.homedir)();
     const entry = entryScript();
-    const cfgDir = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR);
-    const cfgPath = (0, import_node_path7.join)(cfgDir, "config.json");
+    const cfgDir = (0, import_node_path8.join)(home, DEFAULT_CONFIG_DIR);
+    const cfgPath = (0, import_node_path8.join)(cfgDir, "config.json");
     const hasCfg = (0, import_node_fs5.existsSync)(cfgPath);
     if (!entry) {
       console.error("[gateway] \u6E90\u7801\uFF08tsx\uFF09\u6A21\u5F0F\u4E0D\u652F\u6301\u540E\u53F0\u8FD0\u884C\uFF1B\u8BF7\u7528 npm \u5B89\u88C5\u7248\uFF1Anpm i -g @cli-remote/local");
@@ -11827,13 +11966,13 @@ if (argUrl === "gateway") {
       console.error("[gateway] \uFF08\u65E0\u51ED\u8BC1\u4E5F\u53EF\u4EE5\u542F\u52A8\uFF1Agateway \u4F1A\u8FDB\u5165 needs-pairing\uFF0C\u7B49 cli-local pair\uFF09");
       process.exit(1);
     }
-    (0, import_node_fs5.mkdirSync)((0, import_node_path7.dirname)(gatewayLogFile()), { recursive: true });
+    (0, import_node_fs5.mkdirSync)((0, import_node_path8.dirname)(gatewayLogFile()), { recursive: true });
     const out = (0, import_node_fs5.openSync)(gatewayLogFile(), "a");
     const env = {};
     for (const [k, v] of Object.entries(process.env)) if (v !== void 0) env[k] = v;
     const args = [entry, "gateway", "run"];
     if (hubArg) args.push("--hub", hubArg);
-    const child = (0, import_node_child_process3.spawn)(process.execPath, args, {
+    const child = (0, import_node_child_process4.spawn)(process.execPath, args, {
       detached: true,
       stdio: ["ignore", out, out],
       env
@@ -11859,12 +11998,12 @@ if (argUrl === "gateway") {
       while (Date.now() - t02 < 5e3 && gatewayAlive()) {
         await new Promise((res) => setTimeout(res, 150));
       }
-      (0, import_node_fs5.rmSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
+      (0, import_node_fs5.rmSync)((0, import_node_path8.join)((0, import_node_os8.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
       return;
     }
     const pid = gatewayPid();
     if (pid === null || !gatewayAlive()) {
-      (0, import_node_fs5.rmSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
+      (0, import_node_fs5.rmSync)((0, import_node_path8.join)((0, import_node_os8.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
       return;
     }
     try {
@@ -11875,7 +12014,7 @@ if (argUrl === "gateway") {
     while (Date.now() - t0 < 5e3 && gatewayAlive()) {
       await new Promise((res) => setTimeout(res, 150));
     }
-    (0, import_node_fs5.rmSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
+    (0, import_node_fs5.rmSync)((0, import_node_path8.join)((0, import_node_os8.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
   }
   async function gatewayStop() {
     const pid = gatewayPid();
@@ -11916,7 +12055,7 @@ if (argUrl === "gateway") {
     const pid = gatewayPid();
     let hub = "(\u672A\u914D\u7F6E)";
     try {
-      const cfg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "config.json"), "utf-8"));
+      const cfg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path8.join)((0, import_node_os8.homedir)(), DEFAULT_CONFIG_DIR, "config.json"), "utf-8"));
       hub = cfg.relayUrl ?? hub;
     } catch {
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cli-remote/local",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Local PTY agent for cli-remote — exposes your local CLI tools (claude/codex/kimi-cli/shell) to the mobile web client via a self-hosted hub.",
   "license": "MIT",
   "repository": {
@@ -22,12 +22,15 @@
     "cli-local": "./dist/index.cjs"
   },
   "files": [
-    "dist"
+    "dist",
+    "scripts"
   ],
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "node scripts/build.mjs",
+    "postinstall": "node scripts/fix-spawn-helper.mjs",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
     "prepublishOnly": "pnpm build"
   },
   "dependencies": {

package/scripts/build.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// esbuild wrapper: bundles src/index.ts → dist/index.cjs, injecting the
+// package version as CLI_LOCAL_VERSION (consumed by the -v/--version
+// handler in src/index.ts — single source of truth stays package.json).
+import { spawnSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+
+const version = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf-8')).version
+
+const res = spawnSync(
+  'esbuild',
+  [
+    'src/index.ts',
+    '--bundle',
+    '--platform=node',
+    '--format=cjs',
+    '--outfile=dist/index.cjs',
+    `--define:CLI_LOCAL_VERSION=${JSON.stringify(version)}`,
+    '--external:node-pty',
+    // NOTE: argv array goes straight to esbuild (no shell except win32), so
+    // the banner text must NOT be wrapped in quotes — literal quotes end up
+    // in the output and break the shebang.
+    '--banner:js=#!/usr/bin/env node',
+  ],
+  { stdio: 'inherit', shell: process.platform === 'win32' },
+)
+process.exit(res.status ?? 1)

package/scripts/fix-spawn-helper.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// Install-time fix: npm's tarball unpack sometimes strips the exec bit from
+// node-pty's spawn-helper, which makes every PTY spawn fail on macOS with
+// "posix_spawnp failed." (pit #1 in docs/HANDOFF.md). The runtime fallback in
+// src/index.ts (fixSpawnHelperPerms) only runs when the gateway process
+// starts — it cannot cover "npm i -g 升级后老 daemon 还在跑" — so this script
+// runs as the package's own postinstall to chmod +x at install time.
+import { chmodSync, existsSync, readdirSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+
+// <pkg>/scripts → node-pty, for npm -g (deps nest under the package) and
+// plain `npm install <pkg>` (deps hoist to the project root).
+const candidates = [
+  join(here, '..', 'node_modules', 'node-pty', 'prebuilds'),
+  join(here, '..', '..', 'node_modules', 'node-pty', 'prebuilds'),
+  join(here, '..', '..', '..', 'node-pty', 'prebuilds'),
+]
+
+// pnpm keeps deps under .pnpm — scan both likely locations.
+for (const base of [join(here, '..', 'node_modules'), join(here, '..', '..', 'node_modules')]) {
+  const pnpmDir = join(base, '.pnpm')
+  if (!existsSync(pnpmDir)) continue
+  for (const d of readdirSync(pnpmDir)) {
+    if (d.startsWith('node-pty@')) {
+      candidates.push(join(pnpmDir, d, 'node_modules', 'node-pty', 'prebuilds'))
+    }
+  }
+}
+
+let n = 0
+for (const dir of candidates) {
+  if (!existsSync(dir)) continue
+  for (const sub of readdirSync(dir)) {
+    const helper = join(dir, sub, 'spawn-helper')
+    if (!existsSync(helper)) continue
+    try {
+      chmodSync(helper, 0o755)
+      n++
+    } catch {
+      // best effort — runtime chmod in index.ts is the second line of defense
+    }
+  }
+}
+if (n) console.log(`[cli-local postinstall] chmod +x spawn-helper (${n} files)`)