@dsh-workbench/shared 1.1.14-beta.1 → 1.1.14

package/dist/host/patch.js

@@ -1,78 +1,7 @@
-import { renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
-const ID_LINE = /^- id:[ \t]*"?([^"\s#]+)/;
-const INSERT_LINE = /^- insert:[ \t]*$/;
-const NESTED_ID = /^[ \t]+-[ \t]*id:[ \t]*"?([^"\s#]+)/;
-const NAME_LINE = /^[ \t]*-?[ \t]*name:[ \t]*['"]?([^'"\s#]+)/;
-function trimmedTail(lines) {
-    let end = lines.length;
-    while (end > 0 && (lines[end - 1] ?? '').trim() === '')
-        end -= 1;
-    return lines.slice(0, end);
-}
-function matched(text, pattern) {
-    const found = pattern.exec(text);
-    return found === null ? undefined : found[1];
-}
-function blockOf(body, index) {
-    const lines = body.split('\n');
-    const first = lines[0] ?? '';
-    const id = matched(first, ID_LINE);
-    const nested = lines.flatMap((line) => {
-        const one = matched(line, NESTED_ID);
-        return one === undefined ? [] : [one];
-    });
-    const insert = id === undefined && INSERT_LINE.test(first);
-    const label = id ?? nested.join(', ');
-    const key = id !== undefined ? `id:${id}` : insert ? `insert:${nested.join(', ')}` : `block:${String(index)}`;
-    const names = lines.flatMap((line) => {
-        const one = matched(line, NAME_LINE);
-        return one === undefined ? [] : [one];
-    });
-    return { key, id: label === '' ? key : label, insert, body, names };
-}
-function spannedBlocks(text) {
-    const lines = text.split('\n');
-    const starts = [];
-    lines.forEach((line, index) => {
-        if (/^- /.test(line) || line === '-')
-            starts.push(index);
-    });
-    const blocks = [];
-    for (let i = 0; i < starts.length; i += 1) {
-        const from = starts[i] ?? 0;
-        const to = i + 1 < starts.length ? (starts[i + 1] ?? lines.length) : lines.length;
-        const body = trimmedTail(lines.slice(from, to)).join('\n');
-        if (body.trim() === '')
-            continue;
-        blocks.push({ ...blockOf(body, blocks.length), from, to });
-    }
-    return blocks;
-}
-export function patchBlocks(text) {
-    return spannedBlocks(text).map(({ from: _from, to: _to, ...block }) => block);
-}
-function patchMode(path) {
-    try {
-        return statSync(path).mode & 0o777;
-    }
-    catch {
-        return 0o644;
-    }
-}
+import { writeTextFile } from './fs-write.js';
+import { patchBlocks } from './patch-blocks.js';
+export { patchBlocks };
+/** 把 patch 文本写回原文件：原子写，保留已有权限位（新文件 0644）。 */
 export function writePatchFile(path, text) {
-    const mode = patchMode(path);
-    const tmp = `${path}.wb-sync-${String(process.pid)}`;
-    writeFileSync(tmp, text, { mode });
-    try {
-        renameSync(tmp, path);
-    }
-    catch (error) {
-        try {
-            unlinkSync(tmp);
-        }
-        catch {
-            throw error;
-        }
-        throw error;
-    }
+    writeTextFile(path, text, { mode: 'keep' });
 }

package/dist/host/plugin-source.d.ts

@@ -0,0 +1,33 @@
+import type { SupplySource } from '../contract/needs.js';
+import type { ProvisionProblem } from '../contract/plugin-source.js';
+export type { ProvisionProblem } from '../contract/plugin-source.js';
+export interface PluginSourceCommand {
+    readonly line: string;
+    readonly optional?: true;
+}
+export type ResolvedPluginSource = {
+    readonly ok: true;
+    readonly commands: readonly PluginSourceCommand[];
+    readonly line: string;
+} | {
+    readonly ok: false;
+    readonly problem: ProvisionProblem;
+    readonly env?: string;
+};
+export interface PluginSourceOptions {
+    readonly command?: string;
+    readonly plugin?: string;
+    readonly version?: string;
+    readonly mode?: 'install' | 'update';
+}
+export declare function npmRegistryOf(source: {
+    readonly registryEnv?: string;
+    readonly registryDefault?: string;
+}, env: Readonly<Record<string, string | undefined>>): {
+    readonly ok: true;
+    readonly value: string;
+} | {
+    readonly ok: false;
+    readonly env: string;
+};
+export declare function resolvePluginSource(source: SupplySource | undefined, env: Readonly<Record<string, string | undefined>>, options?: PluginSourceOptions): ResolvedPluginSource;

package/dist/host/plugin-source.js

@@ -0,0 +1,91 @@
+import { quoteShellArg } from './shell-text.js';
+import { npmCacheDir, toolchainOpencliDir, vendorPeerLink, vendorPrefix } from './paths.js';
+function mergeLines(commands) {
+    return commands.map((item) => (item.optional === true ? `(${item.line} || true)` : item.line)).join(' && ');
+}
+function envValue(env, name) {
+    const value = env[name]?.trim();
+    return value === undefined || value === '' ? { ok: false } : { ok: true, value };
+}
+export function npmRegistryOf(source, env) {
+    const name = source.registryEnv ?? '';
+    if (name !== '') {
+        const fromEnv = envValue(env, name);
+        if (fromEnv.ok)
+            return fromEnv;
+    }
+    const fallback = source.registryDefault?.trim();
+    if (fallback === undefined || fallback === '')
+        return { ok: false, env: name };
+    return { ok: true, value: fallback };
+}
+function installOne(command, spec) {
+    const line = `${quoteShellArg(command)} plugin install ${quoteShellArg(spec)}`;
+    return { ok: true, commands: [{ line }], line };
+}
+function pluginPackageOf(source, plugin) {
+    if (source.kind === 'npm') {
+        const pkg = source.package?.trim() ?? '';
+        if (pkg !== '')
+            return pkg;
+        return plugin.trim() === '' ? '' : `opencli-plugin-${plugin.trim()}`;
+    }
+    if (source.kind === 'git')
+        return source.url.trim();
+    return '';
+}
+function npmSource(source, env, options) {
+    const registry = npmRegistryOf(source, env);
+    if (!registry.ok)
+        return { ok: false, problem: 'env-missing', env: registry.env };
+    const { command = 'opencli', plugin = '', version = 'latest', mode = 'install' } = options;
+    const name = pluginPackageOf(source, plugin);
+    if (name === '')
+        return { ok: false, problem: 'malformed' };
+    const prefix = vendorPrefix();
+    const dirInPrefix = `${prefix}/node_modules/${name}`;
+    const peer = vendorPeerLink();
+    const commands = [
+        {
+            line: [
+                'npm i',
+                `--prefix ${quoteShellArg(prefix)}`,
+                quoteShellArg(`${name}@${version}`),
+                `--registry ${quoteShellArg(registry.value)}`,
+                `--cache ${quoteShellArg(npmCacheDir())}`,
+            ].join(' '),
+        },
+        {
+            line: `rm -rf ${quoteShellArg(peer.dir)} && mkdir -p ${quoteShellArg(peer.parent)} && ln -s ${quoteShellArg(toolchainOpencliDir())} ${quoteShellArg(peer.dir)}`,
+        },
+    ];
+    if (mode === 'install') {
+        if (plugin !== '') {
+            commands.push({
+                line: `${quoteShellArg(command)} plugin uninstall ${quoteShellArg(plugin)}`,
+                optional: true,
+            });
+        }
+        commands.push({
+            line: `NPM_CONFIG_REGISTRY=${quoteShellArg(registry.value)} ${quoteShellArg(command)} plugin install ${quoteShellArg(dirInPrefix)}`,
+        });
+    }
+    return { ok: true, commands, line: mergeLines(commands) };
+}
+export function resolvePluginSource(source, env, options = {}) {
+    if (source === undefined)
+        return { ok: false, problem: 'not-declared' };
+    const command = options.command ?? 'opencli';
+    if (source.kind === 'git') {
+        const url = source.url.trim();
+        return url === '' ? { ok: false, problem: 'malformed' } : installOne(command, url);
+    }
+    if (source.kind === 'npm')
+        return npmSource(source, env, options);
+    const value = source.env === undefined ? { ok: false } : envValue(env, source.env);
+    if (value.ok)
+        return installOne(command, value.value);
+    if (source.path !== undefined && source.path.trim() !== '')
+        return installOne(command, source.path.trim());
+    return { ok: false, problem: 'env-missing', env: source.env ?? '' };
+}

package/dist/host/port-types.d.ts

@@ -1,4 +1,5 @@
-import type { DshHostContext, DshShell } from '../api/dsh.js';
+import type { DshHostContext } from '../api/dsh.js';
+import type { Seam } from './seam/run.js';
 import type { RuntimeCapabilities, RuntimeProfile } from '../contract/capabilities.js';
 import type { PluginPackageKind } from '../contract/protocol/bundle-install.js';
 import type { LibNeed, SupplySource } from '../contract/needs.js';
@@ -40,20 +41,20 @@ export interface SupplyPluginInstallOptions {
     readonly pluginName?: string | undefined;
 }
 export interface SupplyLatestOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly name: string;
     readonly registry: string;
     readonly force?: boolean;
 }
 export interface SupplyMissingPartsOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly name: string;
     readonly registry: string;
     readonly version: string;
     readonly force?: boolean;
 }
 export interface SupplyProbeReleaseOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly package: string;
     readonly registry?: string | undefined;
     readonly force?: boolean;
@@ -97,7 +98,7 @@ export interface ModulePort {
     }[] | undefined;
     moduleDeclarationOf(dir: string | null, pkg: string): unknown;
     registryDeclarationOf(options: {
-        readonly shell: DshShell;
+        readonly seam: Seam;
         readonly name: string;
         readonly registry: string;
         readonly force?: boolean;
@@ -107,7 +108,7 @@ export interface ModulePort {
     refusalReason(): string;
     packageRouteOf(options: {
         readonly spec: string;
-        readonly shell?: DshShell | undefined;
+        readonly seam?: Seam | undefined;
         readonly registry?: string | undefined;
         readonly force?: boolean;
     }): Promise<SupplyPackageRoute | undefined>;
@@ -119,7 +120,7 @@ export interface SupplyPort extends EnvSupplyPort, ModulePort {
     readonly modules: ModulePort;
 }
 export interface ProbeUnitsOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly runtimeCommands: Readonly<Record<string, string>>;
     readonly units: readonly NeedProbeInput[];
     readonly force?: boolean;
@@ -127,7 +128,7 @@ export interface ProbeUnitsOptions {
 export interface ProbePreflightInput {
     readonly routes: RouteTable;
     readonly ctx: DshHostContext;
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly runtimeCommands: Readonly<Record<string, string>>;
     readonly runtimeCapabilities: RuntimeCapabilities;
     readonly runtimeCheck?: (() => Promise<RuntimeCheck>) | undefined;
@@ -167,7 +168,6 @@ export interface RuntimePort {
     runners(ctx: DshHostContext, data: DataReader): Readonly<Record<string, LibRunner>>;
     health(ctx: DshHostContext): Readonly<Record<string, RuntimeStatus>>;
     seed(ctx: DshHostContext, options: RuntimeSeedOptions): void;
-    warnUnwritableRoot(ctx: DshHostContext): void;
 }
 export interface PluginDeclarationSource {
     readonly pkg: string;

package/dist/host/profile-registries.js

@@ -1,6 +1,7 @@
 import { normalizeRegistry, sameRegistry, scopeOf } from './adapter-types.js';
 import fs from 'node:fs';
 import path from 'node:path';
+import { writeTextFile } from './fs-write.js';
 export const REGISTRY_MARKER = '# dsh-workbench 写的：这一行的包只在这个源上（dsh 卸载没有源参数，pnpm 得问得到）';
 function registryRootOf(name, tarball) {
     const at = tarball.indexOf(`/${name}/-/`);
@@ -91,9 +92,7 @@ function readNpmrc(file) {
     }
 }
 function writeNpmrc(file, text) {
-    const temp = `${file}.dsh-workbench.tmp`;
-    fs.writeFileSync(temp, text, { mode: 0o600 });
-    fs.renameSync(temp, file);
+    writeTextFile(file, text, { mode: 0o600 });
 }
 export function createRegistryNotebook(dir) {
     return {

package/dist/host/registry-declaration.d.ts

@@ -1,4 +1,4 @@
-import type { DshShell } from '../api/dsh.js';
+import type { Seam } from './seam/run.js';
 export interface RegistryDshLookup {
     readonly readable: boolean;
     readonly raw: unknown;
@@ -8,7 +8,7 @@ export interface RegistryLookup {
     registryDeclarationOf(options: RegistryDeclarationOptions): Promise<unknown | undefined>;
 }
 interface RegistryDshOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly name: string;
     readonly registry?: string | undefined;
     readonly force?: boolean;

package/dist/host/registry-declaration.js

@@ -1,4 +1,5 @@
-import { runShell } from './shell.js';
+import { now } from './time.js';
+import { productWrite } from './seam/intent.js';
 import { quoteShellArg } from './shell-text.js';
 import { parseJsonLoose } from '../lib/text.js';
 import { VERSION_CHECK_TIMEOUT_MS, VERSION_CHECK_TTL_MS } from '../config/constants.js';
@@ -16,18 +17,26 @@ export function createRegistryLookup() {
     };
 }
 async function dshOf(cache, options) {
-    const { shell, name, registry, force = false, cacheDir } = options;
+    const { seam, name, registry, force = false, cacheDir } = options;
     const key = `${registry ?? ''}|${name}`;
     const hit = cache.get(key);
-    if (!force && hit !== undefined && Date.now() - hit.at < VERSION_CHECK_TTL_MS) {
+    if (!force && hit !== undefined && now() - hit.at < VERSION_CHECK_TTL_MS) {
         return { readable: true, raw: hit.raw };
     }
     const at = registry === undefined ? '' : ` --registry ${quoteShellArg(registry)}`;
     const cached = cacheDir === undefined ? '' : ` --cache ${quoteShellArg(cacheDir)}`;
-    const result = await runShell(shell, `npm view ${quoteShellArg(name)} dsh --json${at}${cached}`, { timeoutMs: VERSION_CHECK_TIMEOUT_MS }).catch(() => undefined);
+    const result = await seam
+        .run({
+        command: `npm view ${quoteShellArg(name)} dsh --json${at}${cached}`,
+        intent: productWrite(),
+        retry: 'safe',
+        timeoutMs: VERSION_CHECK_TIMEOUT_MS,
+        bestEffort: true,
+    })
+        .catch(() => undefined);
     const parsed = result?.exitCode === 0 ? parseJsonLoose(result.stdout) : undefined;
     if (parsed === undefined)
         return { readable: false, raw: undefined };
-    cache.set(key, { at: Date.now(), raw: parsed });
+    cache.set(key, { at: now(), raw: parsed });
     return { readable: true, raw: parsed };
 }

package/dist/host/release-probe.d.ts

@@ -1,4 +1,4 @@
-import type { DshShell } from '../api/dsh.js';
+import type { Seam } from './seam/run.js';
 import type { PluginRelease } from '../contract/unit.js';
 export declare function parseLedgerVersion(stdout: string, name: string): string | undefined;
 export interface ReleaseProbe {
@@ -9,14 +9,14 @@ export interface ReleaseProbe {
 }
 export declare function createReleaseProbe(): ReleaseProbe;
 interface LatestVersionOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly name: string;
     readonly registry: string;
     readonly force?: boolean;
     readonly cacheDir?: string | undefined;
 }
 interface MissingPartsOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly name: string;
     readonly registry: string;
     readonly version: string;
@@ -24,7 +24,7 @@ interface MissingPartsOptions {
     readonly cacheDir?: string | undefined;
 }
 interface ProbeReleaseOptions {
-    readonly shell: DshShell;
+    readonly seam: Seam;
     readonly package: string;
     readonly registry?: string | undefined;
     readonly force?: boolean;

package/dist/host/release-probe.js

@@ -1,9 +1,10 @@
+import { now } from './time.js';
+import { productWrite } from './seam/intent.js';
 import { RELEASE_PACKAGES } from './release-packages.generated.js';
 import { VERSION_CHECK_TIMEOUT_MS, VERSION_CHECK_TTL_MS } from '../config/constants.js';
 import { isValidVersion } from './version.js';
 import { parseJsonLoose } from '../lib/text.js';
 import { quoteShellArg } from './shell-text.js';
-import { runShell } from './shell.js';
 function cacheFlag(cacheDir) {
     return cacheDir === undefined ? '' : ` --cache ${quoteShellArg(cacheDir)}`;
 }
@@ -38,40 +39,64 @@ export function createReleaseProbe() {
     };
 }
 async function latestVersionOf(latestCache, options) {
-    const { shell, name, registry, force = false, cacheDir } = options;
+    const { seam, name, registry, force = false, cacheDir } = options;
     const key = `${registry}|${name}`;
     const hit = latestCache.get(key);
-    if (!force && hit !== undefined && Date.now() - hit.at < VERSION_CHECK_TTL_MS)
+    if (!force && hit !== undefined && now() - hit.at < VERSION_CHECK_TTL_MS)
         return hit.value;
-    const result = await runShell(shell, `npm view ${quoteShellArg(name)} version --registry ${quoteShellArg(registry)}${cacheFlag(cacheDir)}`, { timeoutMs: VERSION_CHECK_TIMEOUT_MS }).catch(() => undefined);
+    const result = await seam
+        .run({
+        command: `npm view ${quoteShellArg(name)} version --registry ${quoteShellArg(registry)}${cacheFlag(cacheDir)}`,
+        intent: productWrite(),
+        retry: 'safe',
+        timeoutMs: VERSION_CHECK_TIMEOUT_MS,
+        bestEffort: true,
+    })
+        .catch(() => undefined);
     const read = result?.exitCode === 0 ? parseVersion(result.stdout) : undefined;
-    latestCache.set(key, { at: Date.now(), value: read });
+    latestCache.set(key, { at: now(), value: read });
     return read;
 }
 async function versionExists(existsCache, options) {
-    const { shell, name, version, registry, force = false, cacheDir } = options;
+    const { seam, name, version, registry, force = false, cacheDir } = options;
     const key = `${registry}|${name}@${version}`;
     const hit = existsCache.get(key);
-    if (!force && hit !== undefined && (hit.value || Date.now() - hit.at < VERSION_CHECK_TTL_MS))
+    if (!force && hit !== undefined && (hit.value || now() - hit.at < VERSION_CHECK_TTL_MS))
         return hit.value;
-    const result = await runShell(shell, `npm view ${quoteShellArg(`${name}@${version}`)} version --registry ${quoteShellArg(registry)}${cacheFlag(cacheDir)}`, { timeoutMs: VERSION_CHECK_TIMEOUT_MS }).catch(() => undefined);
+    const result = await seam
+        .run({
+        command: `npm view ${quoteShellArg(`${name}@${version}`)} version --registry ${quoteShellArg(registry)}${cacheFlag(cacheDir)}`,
+        intent: productWrite(),
+        retry: 'safe',
+        timeoutMs: VERSION_CHECK_TIMEOUT_MS,
+        bestEffort: true,
+    })
+        .catch(() => undefined);
     const value = result?.exitCode === 0 && parseVersion(result.stdout) !== undefined;
-    existsCache.set(key, { at: Date.now(), value });
+    existsCache.set(key, { at: now(), value });
     return value;
 }
 async function missingPartsOf(latestCache, existsCache, options) {
-    const { shell, name, registry, version, force = false, cacheDir } = options;
+    const { seam, name, registry, version, force = false, cacheDir } = options;
     const checked = await Promise.all(RELEASE_PACKAGES.filter((part) => part !== name).map(async (part) => ({
         part,
-        present: await versionExists(existsCache, { shell, name: part, version, registry, force, cacheDir }),
+        present: await versionExists(existsCache, { seam, name: part, version, registry, force, cacheDir }),
     })));
     return checked.filter((entry) => !entry.present).map((entry) => entry.part);
 }
 async function probeOf(latestCache, options) {
-    const { shell, package: pkg, registry, force = false, check = true, cacheDir, prefix } = options;
+    const { seam, package: pkg, registry, force = false, check = true, cacheDir, prefix } = options;
     if (pkg === "")
         return undefined;
-    const ledger = await runShell(shell, `npm ls --prefix ${quoteShellArg(prefix ?? '')} ${quoteShellArg(pkg)} --json --depth=0${cacheFlag(cacheDir)}`, { timeoutMs: VERSION_CHECK_TIMEOUT_MS }).catch(() => undefined);
+    const ledger = await seam
+        .run({
+        command: `npm ls --prefix ${quoteShellArg(prefix ?? '')} ${quoteShellArg(pkg)} --json --depth=0${cacheFlag(cacheDir)}`,
+        intent: productWrite(),
+        retry: 'safe',
+        timeoutMs: VERSION_CHECK_TIMEOUT_MS,
+        bestEffort: true,
+    })
+        .catch(() => undefined);
     const installed = ledger === undefined ? undefined : parseLedgerVersion(ledger.stdout, pkg);
     if (installed === undefined)
         return undefined;
@@ -80,7 +105,7 @@ async function probeOf(latestCache, options) {
         : registry.trim();
     const latest = source === undefined || !check
         ? undefined
-        : await latestVersionOf(latestCache, { shell, name: pkg, registry: source, force, cacheDir });
+        : await latestVersionOf(latestCache, { seam, name: pkg, registry: source, force, cacheDir });
     return {
         installed,
         ...(latest === undefined ? {} : { latest }),

package/dist/host/runner.d.ts

@@ -0,0 +1,26 @@
+import type { DataRequest, DataResult } from '../contract/data.js';
+/**
+ * 一条 opencli 命令的执行器：同一形状的 `execFile('opencli', args)`，结果只留 stdout。
+ */
+export type LibRunner = (args: readonly string[]) => Promise<{
+    readonly stdout: string;
+}>;
+export type OpencliRunner = LibRunner;
+/**
+ * 读缝（`DataReader.read`）的形状；模块直接把自己的 `data.read` 传进来即可。
+ */
+export type OpencliRead = (request: DataRequest) => Promise<DataResult<unknown>>;
+export interface OpencliRunnerOptions {
+    readonly timeoutMs?: number;
+}
+/**
+ * 把读缝包成一条 opencli 命令的执行器：给还按 `execFile('opencli', args)` 收结果的编排库用，
+ * 让它们跑在面板用的那份 opencli 上（同一套插件、同一份登录态）。
+ *
+ * 失败按 opencli 自己的约定还原：未登录是 `code: AUTH_REQUIRED` + 退出码 77，编排库的
+ * 「等登录再重试」才接得上；其它失败保留 `Command failed: opencli …` 那句外壳。
+ * @param read 模块手里的读缝（`data.read`）。
+ * @param options `timeoutMs` 透传给读缝；不传就用读缝自己的默认值。
+ * @returns 执行器；直接交给编排库的 `setOpencliRunner`。
+ */
+export declare function opencliRunnerOf(read: OpencliRead, options?: OpencliRunnerOptions): OpencliRunner;

package/dist/host/runner.js

@@ -0,0 +1,50 @@
+const AUTH_REQUIRED_EXIT_CODE = 77;
+function textOf(value) {
+    return typeof value === 'string' ? value : '';
+}
+function failedOf(args, error) {
+    const head = `Command failed: opencli ${args.join(' ')}`;
+    const auth = error?.pageCode === 'auth-required';
+    const helpUrl = textOf(error?.helpUrl);
+    const detail = textOf(error?.detail);
+    const hint = textOf(error?.hint);
+    const failed = new Error([
+        head,
+        ...(auth
+            ? ['code: AUTH_REQUIRED', `message: ${textOf(error?.message)}`]
+            : [textOf(error?.message) || 'opencli 这条命令没跑通']),
+        ...(detail === '' ? [] : [detail]),
+        ...(hint === '' ? [] : [hint]),
+        ...(auth && helpUrl !== ''
+            ? [`help: Please open Chrome or Chromium and log in to ${helpUrl}`]
+            : []),
+    ].join('\n'));
+    if (auth)
+        failed.code = AUTH_REQUIRED_EXIT_CODE;
+    return failed;
+}
+/**
+ * 把读缝包成一条 opencli 命令的执行器：给还按 `execFile('opencli', args)` 收结果的编排库用，
+ * 让它们跑在面板用的那份 opencli 上（同一套插件、同一份登录态）。
+ *
+ * 失败按 opencli 自己的约定还原：未登录是 `code: AUTH_REQUIRED` + 退出码 77，编排库的
+ * 「等登录再重试」才接得上；其它失败保留 `Command failed: opencli …` 那句外壳。
+ * @param read 模块手里的读缝（`data.read`）。
+ * @param options `timeoutMs` 透传给读缝；不传就用读缝自己的默认值。
+ * @returns 执行器；直接交给编排库的 `setOpencliRunner`。
+ */
+export function opencliRunnerOf(read, options = {}) {
+    return async (args) => {
+        const result = await read({
+            kind: 'command',
+            adapter: 'opencli',
+            argv: [...args],
+            ...(options.timeoutMs === undefined
+                ? {}
+                : { timeoutMs: options.timeoutMs }),
+        });
+        if (result.ok)
+            return { stdout: JSON.stringify(result.data) };
+        throw failedOf(args, result.error);
+    };
+}

package/dist/host/runtime-links.d.ts

@@ -0,0 +1,7 @@
+/**
+ * 让共用依赖也能 import opencli：把隔离运行时里那份 opencli 链接到 libs 的 node_modules。
+ * 跑在 libs 里的命令（比如 opencli-workflow 带的 gitops）会按包名找 @jackwener/opencli，
+ * 找不到就起不来 —— 它不在 libs 的依赖里，是运行时提供的那一份。
+ * @returns 这次真的建了链接就 `true`；已经有了、或运行时那份还没装，就是 `false`。
+ */
+export declare function ensureLibsOpencliPeer(): boolean;

package/dist/host/runtime-links.js

@@ -0,0 +1,25 @@
+import { existsSync, mkdirSync, symlinkSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { OPENCLI_NPM_PACKAGE, libsPrefix, toolchainOpencliDir } from './paths.js';
+/**
+ * 让共用依赖也能 import opencli：把隔离运行时里那份 opencli 链接到 libs 的 node_modules。
+ * 跑在 libs 里的命令（比如 opencli-workflow 带的 gitops）会按包名找 @jackwener/opencli，
+ * 找不到就起不来 —— 它不在 libs 的依赖里，是运行时提供的那一份。
+ * @returns 这次真的建了链接就 `true`；已经有了、或运行时那份还没装，就是 `false`。
+ */
+export function ensureLibsOpencliPeer() {
+    const link = `${libsPrefix()}/node_modules/${OPENCLI_NPM_PACKAGE}`;
+    if (existsSync(link))
+        return false;
+    const target = toolchainOpencliDir();
+    if (!existsSync(target))
+        return false;
+    try {
+        mkdirSync(dirname(link), { recursive: true });
+        symlinkSync(target, link);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/host/seam/denial.d.ts

@@ -0,0 +1,4 @@
+export declare function deniedPathOf(stderr: string, stdout?: string): string | undefined;
+export declare function sandboxDeniedOf(facts: {
+    readonly denied?: boolean | undefined;
+} | undefined): boolean;

package/dist/host/seam/denial.js

@@ -0,0 +1,24 @@
+const PATTERNS = [
+    /npm (?:error|ERR!) path (.+)$/m,
+    /(?:EPERM|EACCES):[^,\n]*, (?:open|unlink|mkdir|scandir|rename|access|stat|lstat|read|write|copyfile|rmdir|opendir|utimes|chmod|chown) '([^']+)'/i,
+    /(?:Operation not permitted|Permission denied)[^\n]*?'([^']+)'/i,
+    /fatal: could not create work tree dir '([^']+)'/i,
+    /mkdir: cannot create directory '([^']+)'/i,
+    /cannot (?:create|mkdir) (?:directory )?'([^']+)'/i,
+    /(?:Operation not permitted|Permission denied):\s*([^\s'\n]+)/i,
+];
+function firstMatch(text) {
+    for (const pattern of PATTERNS) {
+        const found = pattern.exec(text);
+        const value = found?.[1]?.trim();
+        if (value !== undefined && value !== '')
+            return value;
+    }
+    return undefined;
+}
+export function deniedPathOf(stderr, stdout = '') {
+    return firstMatch(stderr) ?? firstMatch(stdout);
+}
+export function sandboxDeniedOf(facts) {
+    return facts?.denied === true;
+}

package/dist/host/seam/env.d.ts

@@ -0,0 +1,15 @@
+import { type ProductEnvInput, type UnitEnvInput } from '../env-policy.js';
+export type SeamEnvInput = ProductEnvInput;
+export type SeamUnitEnvInput = UnitEnvInput;
+/**
+ * 产品域（运行时根）的受控 env：隔离 HOME、npm/pnpm 缓存钉在运行时根、真 npmrc/gitconfig 只读指过去。
+ * @param input 运行时根、可选的 HOME 与真实用户目录。
+ * @returns 产品域 env。
+ */
+export declare function seamProductEnv(input: SeamEnvInput): Record<string, string>;
+/**
+ * 模块单元的受控 env：HOME 与 npm/pnpm 目录钉到单元数据目录。
+ * @param input 运行时根、单元数据目录、可选的 TRUE 用户目录。
+ * @returns 单元 env。
+ */
+export declare function seamUnitEnv(input: SeamUnitEnvInput): Record<string, string>;