@ganglion/xacpx 0.9.3 → 0.10.1

package/README.md

@@ -258,6 +258,7 @@ xacpx doctor
 xacpx doctor --verbose
 xacpx doctor --smoke
 xacpx doctor --smoke --agent codex --workspace backend
+xacpx doctor --fix
 ```
 
 Notes:
@@ -266,6 +267,7 @@ Notes:
 - `--smoke` additionally runs a minimal real transport-level prompt check
 - `--agent` / `--workspace` only affect `--smoke`
 - Without `--smoke`, the related checks show as `SKIP`
+- `--fix` applies safe local repairs (runtime dir permissions, stale locks, invalid state records) and re-checks; state-mutating repairs are withheld while the daemon runs — see [docs/doctor-command.md](docs/doctor-command.md)
 
 ### How to use `update`
 

package/dist/bridge/bridge-main.js

@@ -210,6 +210,54 @@ var init_spawn_command = __esm(() => {
   SCRIPT_FILE_PATTERN = /\.(c|m)?js$/i;
 });
 
+// src/process/terminate-process-tree.ts
+import { spawn } from "node:child_process";
+async function terminateProcessTree(pid, options = {}, platform = process.platform, runCommand = defaultRunProcessCommand, killProcess = (targetPid, signal) => {
+  process.kill(targetPid, signal);
+}, isProcessRunning = defaultIsProcessRunning) {
+  if (pid <= 0) {
+    return;
+  }
+  if (platform === "win32") {
+    try {
+      await runCommand("taskkill", ["/PID", String(pid), "/T", "/F"]);
+    } catch {}
+    return;
+  }
+  const targetPid = options.detachedProcessGroup ? -pid : pid;
+  try {
+    killProcess(targetPid, "SIGTERM");
+  } catch {
+    return;
+  }
+  const deadline = Date.now() + 5000;
+  while (Date.now() < deadline) {
+    if (!isProcessRunning(targetPid)) {
+      return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  try {
+    killProcess(targetPid, "SIGKILL");
+  } catch {}
+}
+function defaultIsProcessRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function defaultRunProcessCommand(command, args) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: "ignore" });
+    child.on("error", reject);
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}
+var init_terminate_process_tree = () => {};
+
 // src/transport/prompt-media.ts
 import { mkdtemp, open, rm, writeFile } from "node:fs/promises";
 import { tmpdir as defaultTmpdir } from "node:os";
@@ -645,7 +693,7 @@ var init_streaming_prompt = __esm(() => {
 });
 
 // src/recovery/discover-parent-package-paths.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import { createRequire as createRequire2 } from "node:module";
 import { access } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -739,7 +787,7 @@ async function defaultQueryPackageManagerRoot(tool) {
     };
     let child;
     try {
-      child = spawn(spec.cmd, spec.args, {
+      child = spawn2(spec.cmd, spec.args, {
         stdio: ["ignore", "pipe", "pipe"],
         shell: process.platform === "win32"
       });
@@ -778,54 +826,6 @@ var init_discover_parent_package_paths = __esm(() => {
   require2 = createRequire2(import.meta.url);
 });
 
-// src/process/terminate-process-tree.ts
-import { spawn as spawn2 } from "node:child_process";
-async function terminateProcessTree(pid, options = {}, platform = process.platform, runCommand = defaultRunProcessCommand, killProcess = (targetPid, signal) => {
-  process.kill(targetPid, signal);
-}, isProcessRunning = defaultIsProcessRunning) {
-  if (pid <= 0) {
-    return;
-  }
-  if (platform === "win32") {
-    try {
-      await runCommand("taskkill", ["/PID", String(pid), "/T", "/F"]);
-    } catch {}
-    return;
-  }
-  const targetPid = options.detachedProcessGroup ? -pid : pid;
-  try {
-    killProcess(targetPid, "SIGTERM");
-  } catch {
-    return;
-  }
-  const deadline = Date.now() + 5000;
-  while (Date.now() < deadline) {
-    if (!isProcessRunning(targetPid)) {
-      return;
-    }
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
-  try {
-    killProcess(targetPid, "SIGKILL");
-  } catch {}
-}
-function defaultIsProcessRunning(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function defaultRunProcessCommand(command, args) {
-  return await new Promise((resolve, reject) => {
-    const child = spawn2(command, args, { stdio: "ignore" });
-    child.on("error", reject);
-    child.on("close", (code) => resolve(code ?? 1));
-  });
-}
-var init_terminate_process_tree = () => {};
-
 // src/util/text.ts
 function truncateText(text, maxLength, ellipsis = "…") {
   if (text.length <= maxLength)
@@ -860,6 +860,11 @@ var init_session = __esm(() => {
     currentLabel: "[current]",
     sessionListItem: (alias, agent, workspace) => `- ${alias} (${agent} @ ${workspace})`,
     sessionCreated: (alias) => `Session "${alias}" created and switched.`,
+    sessionAlreadyExists: (alias, agent, workspace) => [
+      `Session "${alias}" already exists (${agent} @ ${workspace}).`,
+      `Switch to it with /use ${alias}, or remove it first with /session rm ${alias}.`
+    ].join(`
+`),
     sessionAttachNotFound: (alias, agent, workspace) => [
       "No existing session found to attach.",
       `Check the session name and retry: /session attach ${alias} --agent ${agent} --ws ${workspace} --name <session-name>`
@@ -896,6 +901,7 @@ var init_session = __esm(() => {
     sessionBlockedByTasksHint: "Use /tasks to list tasks, or /task cancel <id> to cancel one.",
     sessionRemoved: (alias) => `Session "${alias}" removed.`,
     sessionRemovedWasActive: "This was the active session. Its chat context has been cleared.",
+    sessionRemovedWasActivePromoted: (alias) => `This was the active session. Switched back to the previous session "${alias}".`,
     sessionTransportShared: (transportSession, count) => `Note: backend session "${transportSession}" is still referenced by ${count} other session(s) and was not closed.`,
     sessionOrchestrationPurgeFailed: (warning) => `Note: failed to purge orchestration references (${warning}). Run /tasks clean manually to clean up.`,
     sessionTransportTeardownFailed: (warning) => `Note: backend session could not be closed automatically (${warning}). Run acpx sessions close manually if needed.`,
@@ -1189,7 +1195,7 @@ var init_later = __esm(() => {
     helpNote2: "Time must be at least 10 seconds and at most 7 days away",
     helpNote3: "By default runs in a new temporary session that is destroyed after completion",
     helpNote4: "Use --bind to send to the session that was current when the task was created (configurable via later.defaultMode)",
-    helpNote5: "/lt list shows all pending tasks globally; in group chats only the owner can cancel",
+    helpNote5: "/lt list shows only this chat's pending tasks; in group chats only the owner can cancel",
     helpNote6: "Scheduling slash-prefixed xacpx commands is not supported",
     helpNote7: "Full time format reference: docs/later-command.md"
   };
@@ -1682,6 +1688,8 @@ var init_plugin_cli = __esm(() => {
     noPlugins: "No plugins installed yet.",
     pluginListHeader: "Plugins:",
     unrecognizedArgs: (args) => `Unrecognized arguments: ${args}`,
+    pluginSpecHasDoubleQuote: (spec) => `Invalid plugin spec ${spec}: double quotes (") are never valid in an npm package spec.`,
+    pluginSpecHasPercentOnWindows: (spec) => `Invalid plugin spec ${spec}: "%" would be mangled by cmd.exe on Windows. Install the package with npm directly instead.`,
     pluginInstallFailed: (packageSpec, error) => `Plugin ${packageSpec} install failed: ${error}`,
     pluginValidateFailed: (recordedName, error) => `Plugin ${recordedName} validation failed: ${error}`,
     pluginInstalled: (recordedName) => `Plugin ${recordedName} installed`,
@@ -1793,8 +1801,6 @@ var init_weixin = __esm(() => {
     debugEnabled: "Debug mode enabled",
     debugDisabled: "Debug mode disabled",
     sessionCleared: "✅ Session cleared. Starting a fresh conversation.",
-    noAccountsLoggedIn: "No accounts are currently logged in.",
-    logoutSuccess: "✅ Logged out. All account credentials cleared.",
     commandFailed: (detail) => `❌ Command failed: ${detail}`
   };
 });
@@ -1832,6 +1838,7 @@ var init_misc = __esm(() => {
     quotaOverflowSummary: (count) => `(${count} progress updates omitted due to message limit; see final result below)`,
     finalHeadsUp: (total, sentSoFar, remaining) => `—
 \uD83D\uDCC4 Result: ${total} parts total, ${sentSoFar} sent. Reply /jx to see the next ${remaining} parts.`,
+    finalAllParked: (count) => `\uD83D\uDCC4 Message limit reached: the result (${count} parts) is parked. Reply /jx to receive it.`,
     quotedMessagePrefix: (parts) => `[Quote: ${parts}]`,
     scheduledTaskFailed: (message) => `Scheduled task failed: ${message}`,
     orchestrationTaskCompleted: (taskId, workerSession, result) => `Delegation task "${taskId}" completed
@@ -1860,6 +1867,8 @@ var init_misc = __esm(() => {
     delegateQPackageInstr3: "Do not forward the human's exact words to the worker",
     commandAccessDeniedSuffix: " is restricted to group owner only.",
     commandAccessDeniedHint: "To perform control operations, have the owner send them in the group, or use a private chat.",
+    commandAccessDeniedChatTypeMissingSuffix: " was blocked: this channel did not report the chat type (direct or group), so control commands are disabled here.",
+    commandAccessDeniedChatTypeMissingHint: "Read-only commands and prompts still work. This is a channel metadata issue — update or report the channel plugin.",
     commandLabelThisMessage: "This message",
     sessionResetNoCurrentSession: "No session is currently selected. Run /session new ... or /use <alias> first.",
     sessionResetFailed: (alias) => `Session "${alias}" reset failed. The new backend session was not created, please try again later.`,
@@ -1930,6 +1939,11 @@ var init_session2 = __esm(() => {
     currentLabel: "[当前]",
     sessionListItem: (alias, agent2, workspace2) => `- ${alias} (${agent2} @ ${workspace2})`,
     sessionCreated: (alias) => `会话「${alias}」已创建并切换`,
+    sessionAlreadyExists: (alias, agent2, workspace2) => [
+      `会话「${alias}」已存在（${agent2} @ ${workspace2}）。`,
+      `发送 /use ${alias} 切换到它，或先执行 /session rm ${alias} 删除后再创建。`
+    ].join(`
+`),
     sessionAttachNotFound: (alias, agent2, workspace2) => [
       "没有找到可绑定的已有会话。",
       `请确认会话名是否正确，然后重新执行：/session attach ${alias} --agent ${agent2} --ws ${workspace2} --name <会话名>`
@@ -1966,6 +1980,7 @@ var init_session2 = __esm(() => {
     sessionBlockedByTasksHint: "使用 /tasks 查看任务列表，或 /task cancel <id> 取消任务。",
     sessionRemoved: (alias) => `已删除会话「${alias}」。`,
     sessionRemovedWasActive: "该会话是当前活跃会话，已自动清除相关聊天上下文。",
+    sessionRemovedWasActivePromoted: (alias) => `该会话是当前活跃会话，已切换回上一个会话「${alias}」。`,
     sessionTransportShared: (transportSession, count) => `提示：后端会话「${transportSession}」仍被其他 ${count} 个会话引用，未关闭。`,
     sessionOrchestrationPurgeFailed: (warning) => `提示：清理任务编排引用失败（${warning}），请稍后执行 /tasks clean 手动清理。`,
     sessionTransportTeardownFailed: (warning) => `提示：后端会话未能自动关闭（${warning}），如有残留请手动执行 acpx sessions close。`,
@@ -2259,7 +2274,7 @@ var init_later2 = __esm(() => {
     helpNote2: "时间必须在 10 秒之后、7 天之内",
     helpNote3: "默认在为本次任务新建的临时会话里执行，跑完即销毁",
     helpNote4: "加 --bind 改为发送到创建时绑定的当前会话（默认模式可用 later.defaultMode 配置）",
-    helpNote5: "/lt list 显示全局待执行任务；群聊中只有群主可取消",
+    helpNote5: "/lt list 只显示本聊天创建的待执行任务；群聊中只有群主可取消",
     helpNote6: "不支持延迟执行 / 开头的 xacpx 命令",
     helpNote7: "完整时间格式与说明见 docs/later-command.md"
   };
@@ -2752,6 +2767,8 @@ var init_plugin_cli2 = __esm(() => {
     noPlugins: "还没有安装插件。",
     pluginListHeader: "插件：",
     unrecognizedArgs: (args) => `未识别的参数：${args}`,
+    pluginSpecHasDoubleQuote: (spec) => `非法插件 spec ${spec}：npm 包 spec 不允许包含双引号 (")。`,
+    pluginSpecHasPercentOnWindows: (spec) => `非法插件 spec ${spec}：Windows 上 cmd.exe 会展开 %，无法安全传递。请改用 npm 直接安装该包。`,
     pluginInstallFailed: (packageSpec, error) => `插件 ${packageSpec} 安装失败：${error}`,
     pluginValidateFailed: (recordedName, error) => `插件 ${recordedName} 校验失败：${error}`,
     pluginInstalled: (recordedName) => `插件 ${recordedName} 已安装`,
@@ -2863,8 +2880,6 @@ var init_weixin2 = __esm(() => {
     debugEnabled: "Debug 模式已开启",
     debugDisabled: "Debug 模式已关闭",
     sessionCleared: "✅ 会话已清除，重新开始对话",
-    noAccountsLoggedIn: "当前没有已登录的账号",
-    logoutSuccess: "✅ 已退出登录，清除所有账号凭证",
     commandFailed: (detail) => `❌ 指令执行失败: ${detail}`
   };
 });
@@ -2902,6 +2917,7 @@ var init_misc2 = __esm(() => {
     quotaOverflowSummary: (count) => `（因消息次数限制省略 ${count} 条进度，请继续查看下方最终结果）`,
     finalHeadsUp: (total, sentSoFar, remaining) => `—
 \uD83D\uDCC4 结果共 ${total} 段，已发 ${sentSoFar} 段。回复 /jx 续看后 ${remaining} 段。`,
+    finalAllParked: (count) => `\uD83D\uDCC4 已达消息上限：结果共 ${count} 段已暂存。回复 /jx 接收。`,
     quotedMessagePrefix: (parts) => `[引用: ${parts}]`,
     scheduledTaskFailed: (message) => `定时任务执行失败：${message}`,
     orchestrationTaskCompleted: (taskId, workerSession, result) => `委派任务「${taskId}」已完成
@@ -2930,6 +2946,8 @@ var init_misc2 = __esm(() => {
     delegateQPackageInstr3: "不要直接把 human 原话转发给 worker",
     commandAccessDeniedSuffix: " 仅限群创建者/频道 owner 使用。",
     commandAccessDeniedHint: "如果需要执行控制类操作，请由 owner 在群内发送，或改用私聊。",
+    commandAccessDeniedChatTypeMissingSuffix: " 已被拦截：该频道未上报会话类型（直聊/群聊），控制类命令在此暂不可用。",
+    commandAccessDeniedChatTypeMissingHint: "只读命令与普通对话不受影响。这是频道元数据问题，请升级或反馈该频道插件。",
     commandLabelThisMessage: "该消息",
     sessionResetNoCurrentSession: "当前还没有选中的会话。请先执行 /session new ... 或 /use <alias>。",
     sessionResetFailed: (alias) => `会话「${alias}」重置失败。
@@ -3351,6 +3369,19 @@ function normalizeBridgePermissionMode(value) {
 function normalizeBridgeNonInteractivePermissions(value) {
   return value === "deny" || value === "fail" ? value : "deny";
 }
+function normalizeBridgePermissionPolicy(value) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    return;
+  }
+  return value;
+}
+function normalizeBridgeSessionInitTimeoutMs(value) {
+  if (value === undefined || value.trim().length === 0) {
+    return;
+  }
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
 function normalizeBridgeQueueOwnerTtlSeconds(value) {
   if (value === undefined) {
     return;
@@ -3396,6 +3427,7 @@ class BridgeRequestScheduler {
 
 // src/bridge/bridge-runtime.ts
 init_spawn_command();
+init_terminate_process_tree();
 init_prompt_output();
 init_prompt_media();
 init_streaming_prompt();
@@ -3431,6 +3463,16 @@ class EnsureSessionFailedError extends Error {
     this.data = data;
   }
 }
+var DEFAULT_SESSION_INIT_TIMEOUT_MS = 120000;
+
+class CommandTimeoutError extends Error {
+  timeoutMs;
+  constructor(timeoutMs, command) {
+    super(`acpx command timed out after ${timeoutMs / 1000}s: ${command}`);
+    this.timeoutMs = timeoutMs;
+    this.name = "CommandTimeoutError";
+  }
+}
 
 class BridgeRuntime {
   command;
@@ -3483,12 +3525,25 @@ class BridgeRuntime {
       "--resume-session",
       input.agentSessionId
     ], { format: "quiet" }));
-    const result = await this.runSessionCreate(spawnSpec.command, spawnSpec.args, input.cwd);
+    const timeoutMs = this.sessionInitTimeoutMs();
+    let result;
+    try {
+      result = await this.runSessionCreate(spawnSpec.command, spawnSpec.args, input.cwd, { timeoutMs });
+    } catch (error) {
+      if (error instanceof CommandTimeoutError) {
+        throw new Error(`session initialization timed out after ${timeoutMs / 1000}s`);
+      }
+      throw error;
+    }
     if (result.code !== 0) {
       throw new Error(result.stderr || result.stdout || "sessions resume failed");
     }
     return {};
   }
+  sessionInitTimeoutMs() {
+    const value = this.options.sessionInitTimeoutMs;
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : DEFAULT_SESSION_INIT_TIMEOUT_MS;
+  }
   async hasSession(input) {
     const spawnSpec = resolveSpawnCommand(this.command, this.buildSessionArgs(input, [
       "sessions",
@@ -3520,6 +3575,11 @@ class BridgeRuntime {
   }
   async ensureSession(input, onProgress) {
     onProgress?.("spawn");
+    const timeoutMs = this.sessionInitTimeoutMs();
+    const now = this.options.now ?? Date.now;
+    const deadline = now() + timeoutMs;
+    const remainingTimeoutMs = () => Math.max(deadline - now(), 1);
+    const sessionInitTimedOutError = () => new EnsureSessionFailedError(`session initialization timed out after ${timeoutMs / 1000}s`, "generic");
     const onStderrLine = onProgress ? (line) => {
       const trimmed = line.replace(/\r$/, "").trimEnd();
       if (trimmed.length === 0)
@@ -3527,41 +3587,58 @@ class BridgeRuntime {
       onProgress({ kind: "note", text: trimmed });
     } : undefined;
     const runWithVerboseFallback = async (tailArgs, runner) => {
-      const useVerbose = this.acpxVerboseSupported !== false;
-      const spec = resolveSpawnCommand(this.command, this.buildSessionArgs(input, tailArgs, { verbose: useVerbose }));
-      const result = await runner(spec.command, spec.args);
-      if (result.code === 0) {
-        if (useVerbose)
-          this.acpxVerboseSupported = true;
+      try {
+        const useVerbose = this.acpxVerboseSupported !== false;
+        const spec = resolveSpawnCommand(this.command, this.buildSessionArgs(input, tailArgs, { verbose: useVerbose }));
+        const result = await runner(spec.command, spec.args);
+        if (result.code === 0) {
+          if (useVerbose)
+            this.acpxVerboseSupported = true;
+          return result;
+        }
+        if (useVerbose && isUnknownVerboseOption(result.stderr, result.stdout)) {
+          this.acpxVerboseSupported = false;
+          const retrySpec = resolveSpawnCommand(this.command, this.buildSessionArgs(input, tailArgs, { verbose: false }));
+          return await runner(retrySpec.command, retrySpec.args);
+        }
         return result;
+      } catch (error) {
+        if (error instanceof CommandTimeoutError) {
+          throw sessionInitTimedOutError();
+        }
+        throw error;
       }
-      if (useVerbose && isUnknownVerboseOption(result.stderr, result.stdout)) {
-        this.acpxVerboseSupported = false;
-        const retrySpec = resolveSpawnCommand(this.command, this.buildSessionArgs(input, tailArgs, { verbose: false }));
-        return await runner(retrySpec.command, retrySpec.args);
-      }
-      return result;
     };
-    const ensured = await runWithVerboseFallback(["sessions", "ensure", "--name", input.name], (command, args) => this.run(command, args, { onStderrLine }));
+    const ensured = await runWithVerboseFallback(["sessions", "ensure", "--name", input.name], (command, args) => this.run(command, args, { onStderrLine, timeoutMs: remainingTimeoutMs() }));
     if (ensured.code === 0) {
       onProgress?.("ready");
       return {};
     }
     const existingSpec = resolveSpawnCommand(this.command, this.buildSessionArgs(input, ["sessions", "show", input.name]));
-    const existing = await this.run(existingSpec.command, existingSpec.args);
+    const runShowProbe = async () => {
+      try {
+        return await this.run(existingSpec.command, existingSpec.args, { timeoutMs: remainingTimeoutMs() });
+      } catch (error) {
+        if (error instanceof CommandTimeoutError) {
+          throw sessionInitTimedOutError();
+        }
+        throw error;
+      }
+    };
+    const existing = await runShowProbe();
     if (existing.code === 0) {
       onProgress?.("ready");
       return {};
     }
     onProgress?.("initializing");
-    const created = await runWithVerboseFallback(["sessions", "new", "--name", input.name], (command, args) => this.runSessionCreate(command, args, input.cwd, { onStderrLine }));
+    const created = await runWithVerboseFallback(["sessions", "new", "--name", input.name], (command, args) => this.runSessionCreate(command, args, input.cwd, { onStderrLine, timeoutMs: remainingTimeoutMs() }));
     if (created.code === 0) {
       onProgress?.("ready");
       return {};
     }
     const output = created.stderr || created.stdout || "";
     if (output.includes("EPERM") && await this.repairSessionIndex()) {
-      const repaired = await this.run(existingSpec.command, existingSpec.args);
+      const repaired = await runShowProbe();
       if (repaired.code === 0) {
         onProgress?.("ready");
         return {};
@@ -3762,12 +3839,18 @@ class BridgeRuntime {
 }
 function spawnCapture(command, args, options) {
   return new Promise((resolve, reject) => {
-    const child = spawn4(command, args, { cwd: options?.cwd, stdio: ["ignore", "pipe", "pipe"] });
+    const spawnFn = options?.spawnFn ?? spawn4;
+    const child = spawnFn(command, args, { cwd: options?.cwd, stdio: ["ignore", "pipe", "pipe"] });
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     let stdout = "";
     let stderr = "";
     let stderrTail = "";
+    const timeoutId = typeof options?.timeoutMs === "number" && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? setTimeout(() => {
+      const kill = options.killProcessTreeFn ?? ((pid) => terminateProcessTree(pid, { detachedProcessGroup: false }));
+      kill(child.pid ?? 0);
+      reject(new CommandTimeoutError(options.timeoutMs, [command, ...args].join(" ")));
+    }, options.timeoutMs) : undefined;
     child.stdout.on("data", (chunk) => {
       stdout += String(chunk);
     });
@@ -3783,8 +3866,14 @@ function spawnCapture(command, args, options) {
         options.onStderrLine(line);
       }
     });
-    child.on("error", reject);
+    child.on("error", (error) => {
+      if (timeoutId)
+        clearTimeout(timeoutId);
+      reject(error);
+    });
     child.on("close", (code) => {
+      if (timeoutId)
+        clearTimeout(timeoutId);
       if (options?.onStderrLine && stderrTail.length > 0) {
         options.onStderrLine(stderrTail);
       }
@@ -3857,7 +3946,7 @@ async function defaultPromptRunner(command, args, onEvent, options) {
   return await runStreamingPrompt(command, args, onEvent, options);
 }
 async function shellSessionCreateRunner(command, args, cwd, options) {
-  return await spawnCapture(command, args, { cwd, onStderrLine: options?.onStderrLine });
+  return await spawnCapture(command, args, { ...options, cwd });
 }
 function selectLatestAcpxSessionIndexTmp(files) {
   let latestTmp = null;
@@ -4006,7 +4095,8 @@ class BridgeServer {
       case "updatePermissionPolicy":
         return await this.runtime.updatePermissionPolicy({
           permissionMode: requirePermissionMode(params, "permissionMode"),
-          nonInteractivePermissions: requireNonInteractivePermissions(params, "nonInteractivePermissions")
+          nonInteractivePermissions: requireNonInteractivePermissions(params, "nonInteractivePermissions"),
+          permissionPolicy: asOptionalString(params.permissionPolicy)
         });
       case "hasSession":
         return await this.runtime.hasSession({
@@ -4315,7 +4405,9 @@ async function runBridgeMain() {
   const server = new BridgeServer(new BridgeRuntime(coreEnv("BRIDGE_ACPX_COMMAND") ?? "acpx", undefined, undefined, {
     permissionMode: normalizeBridgePermissionMode(coreEnv("BRIDGE_PERMISSION_MODE")),
     nonInteractivePermissions: normalizeBridgeNonInteractivePermissions(coreEnv("BRIDGE_NON_INTERACTIVE_PERMISSIONS")),
-    queueOwnerTtlSeconds: normalizeBridgeQueueOwnerTtlSeconds(coreEnv("BRIDGE_QUEUE_OWNER_TTL_SECONDS"))
+    permissionPolicy: normalizeBridgePermissionPolicy(coreEnv("BRIDGE_PERMISSION_POLICY")),
+    queueOwnerTtlSeconds: normalizeBridgeQueueOwnerTtlSeconds(coreEnv("BRIDGE_QUEUE_OWNER_TTL_SECONDS")),
+    sessionInitTimeoutMs: normalizeBridgeSessionInitTimeoutMs(coreEnv("BRIDGE_SESSION_INIT_TIMEOUT_MS"))
   }));
   const input = createInterface({
     input: process.stdin,

package/dist/channels/types.d.ts

@@ -96,8 +96,19 @@ export interface MessageChannelRuntime {
     id: string;
     isLoggedIn(): boolean;
     login(): Promise<string>;
+    /**
+     * Destructive credential removal. Reached only via the explicit
+     * `xacpx logout` CLI path — never as part of a normal shutdown.
+     */
     logout(): void;
     start(input: ChannelStartInput): Promise<void>;
+    /**
+     * Non-destructive shutdown: release runtime resources without touching
+     * stored credentials. Optional for compatibility with already-published
+     * plugin channels; when absent, the registry falls back to `logout()`
+     * (which for those plugins is a benign client stop).
+     */
+    stop?(): void | Promise<void>;
     createConsumerLock?(options?: ConsumerLockOptions): ConsumerLock;
     configureOrchestration?(callbacks: OrchestrationDeliveryCallbacks): void;
     notifyTaskCompletion(task: OrchestrationTaskRecord): Promise<void>;

package/dist/channels/weixin-channel.d.ts

@@ -15,6 +15,14 @@ export declare class WeixinChannel implements MessageChannelRuntime {
     isLoggedIn(): boolean;
     login(): Promise<string>;
     logout(): void;
+    /**
+     * Non-destructive shutdown. The monitor loop is already stopped via the
+     * abort signal passed to start(); this only drops runtime references and
+     * MUST NOT touch the credential files on disk (a graceful daemon stop or
+     * restart must not force a QR re-login). Destructive credential removal
+     * happens only through logout() (the explicit `xacpx logout` CLI path).
+     */
+    stop(): void;
     createConsumerLock(options?: ConsumerLockOptions): ConsumerLock;
     configureOrchestration(callbacks: OrchestrationDeliveryCallbacks): void;
     start(input: ChannelStartInput): Promise<void>;