@hanamesh/dsh-app-host 0.6.22 → 0.6.24

package/README.md

@@ -1,3 +1,13 @@
+PX3 跨平台候选：Windows 可以运行插件/公开服务、attach 应用、受控只读 CLI 与普通包安装；`owned` 应用仍在创建进程、数据目录及请求凭据之前明确拒绝 `PLATFORM_UNSUPPORTED`。Windows 单测保留真实 attach 的 HTTP/租约/网关断言，并验证 owned 的持久失败、无进程/文件写入及不消费凭据；这些断言不构成 Windows owned 运行支持。独立 Node 可用不扩大 owned 支持；受管 Node 准备仍遵守原平台限制。Windows 本地快照采用文件 flush 加同目录 rename，不承诺断电后目录项持久；Coding OAuth Gateway 文件源因缺私有 ACL 证明继续拒绝，HTTP 提供方不变。各平台实际结果以本分支 GitHub Actions 矩阵收据为准。
+
+R115返修（同0.6.23候选）：登录shell按退出结果和封装JSON解析成功，忽略正常stderr；所选CLI保留管理器PATH与XDG目录/缺省，不再用空临时XDG隐藏全局版本。真实Bash/asdf/mise启动链回归与工具来源见 [安装状态](docs/INSTALLATION_STATUS.md)。
+
+0.6.23 候选：install-target 对名单外有效网站提供精确CORS的固定403来源拒绝，GET预检以204和按需PNA头支持浏览器读回；不开放能力/清单/安装权限。同意检测后自动发现当前用户的 Claude Code / Codex 官方 CLI，无手动读取器入口；接受不低于 2.1.301 / 0.162.1 且版本格式与清单 JSON 校验通过的版本。安装布局、优先级、只读边界及具名预算见 [安装状态](docs/INSTALLATION_STATUS.md)。
+
+PK3 开发供给：`vendor/hanamesh-core-0.3.33.tgz` 是 Core 分支提交 `969a89a1f7e383fca7d6aefa7f27507d3a1605d5` 的正常归档，仅供开发与公开合约测试；SHA256 和来源见 `vendor/core-fixture.json`，安装仍严格检查真实 peers。这不是已发布的 npm Core，也不进入运行时依赖。
+
+PK1 兼容候选：开发输入更新为 DSH 0.2.2-rc.1 / Cordis 4.1.0 / Schemastery 3.19.0（适用者）。公开 peer 保留兼容范围，并显式包含 0.2.2 预发布；不锁定用户宿主版本。本分支尚未发布，安装和原生加载结果以 PK1 交件为准。
+
 0.6.21 候选：普通市场和网站交接消费 Indexer 的固定 GitHub SHA/子目录/包名/构建名单。客户端沿原确认页展示来源、完整 commit 与本机构建提示；确认回传同一目标，目录更新不得换 SHA。执行仍走受控官方 DSH CLI / pnpm，读回精确来源与启用项后报告需完全退出重开；没有改上游或另写安装器。详见 [安装目标](docs/INSTALL_TARGET.md)。初轮已完成隔离 DSH、网站及真实 DTO 验收；本轮 R25 另修未匹配固定目标时的拒绝与退休目录版本字段，仍待复审，不宣称已发布。
 
 0.6.22 候选：普通插件只执行目录固定目标；缺 installMethods 即拒绝。套件安装命令只消费 Core，删除普通包名的元数据查询和规则加载。
@@ -224,22 +234,14 @@ Actions runs on the standard public/free `macos-15` arm64 runner because the exi
 
 ## 发布检查：平台依赖闭包（不可关闭）
 
-`DSH_PNPM_PLATFORM_CLOSURE` 是正确性不变量，Mac/Windows/Linux 同样适用：DSH 自带 pnpm 11.7.0 处理不适用平台 optional 子包时可能安装完不退出，导致 DSH 持续等待。正常 tarball、bundled 包及完整锁定依赖闭包发现 os/cpu/libc 字段或平台子包 optionalDependencies 即拒绝，报具体包名/路径；缺闭包证据也拒绝。不能以开关、超时、重试、omit-optional 或静默兜底绕过；应改用单包内含多平台文件的中立依赖。
-
-运行 `npm run release:check` 正常打包并检查；发布仅用 `npm run release:publish`，发布已检查的同一 tarball。直接目录 npm publish 会被 prepublishOnly 明确拒绝。开发工具 `@hanamesh/release-platform-gate` 仅 devDependency，先按接线请求复制经 SHA 固定的正常工具包并更新冻结锁；CI 必须接入这个发布门。详细输出包含不可关闭的原因、正常包/锁 SHA 和扫描路径；absent optional peer 按 npm 定义列明，不等同 optionalDependencies。
-
-共享门已升级到 R2 PASS 的 0.1.10，原正常工具 tar SHA256 为 `c72010c96a5f22e36d65f6c1fd850e583dead7e843644eba1657b4416d9cbd0d`；最终 main 来源见 `vendor/release-platform-gate.json`。本仓接线仍须 R1 独审，不等于 npm 发布放行，本次不发布。
-
-`verify:pack` 原有 tarball 参数保持；正常消费者验证之后通过共享公开 checkRelease 核对同一个归档，CI沿该入口必经硬门，不另打一个包代替原包。接线没有复制扫描实现。
-
-有限依赖形态合同为正常开发工具包中的 `DEPENDENCY_SHAPES.md`（dependency-shapes-v1）：支持 registry/git/file/link/tarball/workspace/bundled/vendor 的明确子集，不能当作 npm/pnpm 的无限全集。合同外一律 `UNSUPPORTED_DEPENDENCY_SHAPE`，逐项公开 `package/path/shape/why/action/contract`；缓存、bundle、环境变量或额外 CLI 开关都不能绕过准入。已知缺证据、冻结漂移、完整性和平台违规仍各自具名拒绝，不能以“任意失败”代替正确理由。
+共享 `@hanamesh/release-platform-gate` **0.1.12** 已经 R119b 复审 PASS，来源 `hanamesh-docs/tools/release-platform-gate` 分支 `fix/pg1-leoventory-installer-risk-20261109`，提交 `95e54102f9380ea2e8e4d8a2e36eacd387c3f7e7`。正常工具 tgz SHA256 `caf78747649b1dd37cbe9ba331351c81f94a48dc9e779aee83c75336140068d1`；七载荷摘要、复审提交及冻结 SRI 见 `vendor/release-platform-gate.json`、`vendor/SHA256SUMS` 和锁。它仅为 devDependency，不进入运行时或产品 bundle。
 
-发布说明：DSH 内置 pnpm 11.7.0 处理不适用平台 optional 子包时可能安装后不退出，使 DSH 一直等安装结束；因此本门是正确性不变量（`disableable:false`），没有关闭开关。所有 OS/CPU/libc 都必须具备平台中立的完整安装依赖闭包，不能用本机已装、omit-optional、ignore-scripts、超时、重试、放宽断言或改客户端代替。每次 PASS/FAIL 的 JSON/receipt 都包含触发背景和不能关闭的 reason；release:check 正常 pack，release:publish 只发布同一已检查且再核 SHA 的 tar。源码目录发布由 prepublishOnly 拒绝，CI 的 verify:pack/preflight 必经该门；无可失败 job 或旁路入口。
+`DSH_PNPM_PLATFORM_CLOSURE` 是不可关闭的正确性不变量（disableable:false）。历史 DSH bundled pnpm 11.7.0 位于 pnpm#12297 风险系列，修复收录于 pnpm 11.23.0。原始 HanaMesh 挂起进程首错仍未找回，不能宣称历史身份/归因已闭合。合法 optional 平台字段和完整强 SRI 也不能独自证明安装器会退出。
 
-固定提供方 main 提交 `13ec0db3bc6aa6b6235f2105d3f0a6b998855ff5`，与 R2 审过的 0.1.10 正常包6载荷逐字一致；来源/归档摘要见 `vendor/release-platform-gate.json`。
+根及必需路径的 os/cpu/libc 继续 PLATFORM_FIELD 拒绝；可选子图先完整核锁、实际归档、名称/版本/范围/peer、选择器一致与强 SRI，再按 `dsh-pnpm-platform-exit-v1` 核安装矩阵。所有平台工件均扫描，不按检查机过滤。缺矩阵为 INSTALLATION_TARGETS_REQUIRED，旧风险组合为 PNPM_PLATFORM_HANG_RISK，未审组合为 INSTALLATION_TARGET_UNSUPPORTED；混入一个安全目标不能洗绿旧组合。未知依赖形态仍 UNSUPPORTED_DEPENDENCY_SHAPE，输出 shape / why / action / contract；有限 dependency-shapes-v1 与 INSTALLATION_RISK.md 均随正常工具包交付。没有 skip/关闭开关、环境推断、重试、超时、omit-optional 或白名单绕过。
 
-## Core 公开套件声明的测试依赖
+本次发布资格的完整目标明确保存在 `release/installation-targets.json`：DSH **0.2.2-rc.1 / pnpm 11.28.5 / darwin-arm64、linux-arm64**。这是 R119b 有退出证据的两个组合，不是检查机自动选择，也不把公开宽 peer 范围当作已通过的安装矩阵；其他宿主/安装器/架构不计入本次资格，旧组合仍拒绝。开发冻结安装的 pnpm 10.33.0 不是 bundled 11.28.5 的实装证据；后续 GT19 两机门必须核实际 pnpm 版本和完整闭包。
 
-源码测试通过 `@hanamesh/core/suite` 读取 Core 单源公开命令。`@hanamesh/core` 是仓库声明的 devDependency，按 npm 版本范围 `^0.3.30` 从公开 npm 安装，冻结 pnpm 锁记录实际版本与 SRI；许可证记录见 `docs/LICENSES.json`。Core 不成为运行时依赖或 bundled 包。
+`release:check` 与 `release:publish` 都显式传同一 `--installation-targets release/installation-targets.json`；`verify:pack` 在原消费者验证后通过共享公开 `checkRelease({installationTargets:...})` 检查同一归档，没有复制扫描实现或捕获忽略门错误。
 
-套件升级的执行定义来自可信 Cordis Core 声明 `upgrade.installation:{name,version,command,args}`；AppHost将实际profile与可选registry交给Core，使用返回的完整argv，不自行加flag、解析命令前缀或补默认npm源。缺定义时具名拒绝，参数纳入确认快照。该数据接口避免AppHost在Core新版本发布前依赖未发布SDK。
+运行 `npm run release:check` 产生正常归档并核验；`release:publish` 只发布同一已检查且复核 SHA 的 tar。`prepublishOnly` 的 source-guard 拒绝源码目录直接发布。CI 的既有 verify:pack / preflight 必经此门；无 continue-on-error 或旁路。此接线提交没有执行 npm publish、tag、部署或产品真机发布验收。

package/dist/client-ui.js

@@ -267,8 +267,8 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy261": "准备安装环境未完成。请查看技术详情中的准确原因；未自动换源或重试。",
     "copy262": "只在本机 127.0.0.1 上监听，请求的 Host 必须是 127.0.0.1 或 localhost 加监听端口",
     "copy263": "防止别的机器或 DNS 重绑定的网页冒充本机",
-    "copy264": "只有「允许交接的网站」里的网站能探测本客户端、交接安装、读交接状态；别的网站什么也读不到",
-    "copy265": "否则任何网页都能知道你装了什么客户端、缺什么，用来识别你",
+    "copy264": "只有「允许交接的网站」能读取客户端能力、交接安装和交接状态；未许可网站仅能读取固定的来源拒绝提示",
+    "copy265": "拒绝提示只说明本机监听拒绝了该网站，不透露客户端类型、能力、安装情况或允许名单",
     "copy266": "网站交接只会在应用库里弹出确认；只有你点「确认安装」才会安装",
     "copy267": "网站不能替你决定装什么",
     "copy268": "交接状态只给发起它的那个网站看",
@@ -568,8 +568,8 @@ window.__ModuleLoader__.load({id:'@hanamesh/dsh-app-host',factory:function(requi
     "copy261": "Installation environment preparation did not complete. See Technical details for the exact reason. No automatic source switching or retry occurred.",
     "copy262": "Listen only on 127.0.0.1. The request Host must be 127.0.0.1 or localhost with the listening port.",
     "copy263": "Prevents remote machines or DNS-rebinding pages from impersonating this machine.",
-    "copy264": "Only allowed websites can discover this client, hand off installation or read handoff status.",
-    "copy265": "Prevents unrelated websites from identifying you through installed clients or missing capabilities.",
+    "copy264": "Only allowed websites can read client capabilities, hand off installations or read handoff status. Other websites can read only a fixed origin-refusal message.",
+    "copy265": "The refusal reveals only that a local listener rejected the website, without client type, capabilities, installations or the allowlist.",
     "copy266": "Website handoffs only open market confirmation. Installation requires your Confirm installation action.",
     "copy267": "A website cannot decide what to install for you.",
     "copy268": "Handoff status is visible only to the website that created it.",

package/dist/dsh-compat.js

@@ -1,6 +1,6 @@
 import semver from 'semver';
 
 /** Public host compatibility; exact dependency versions in devDependencies remain reproducible test inputs. */
-export const DSH_RANGE='>=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0';
+export const DSH_RANGE='>=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0 || >=0.2.2-0 <0.3.0-0';
 /** saveExact entered the public PluginManager contract in 0.2.1-alpha.2. Unknown versions fail closed. */
 export function managerSupportsExactSave(version){return typeof version==='string'&&semver.satisfies(version,'>=0.2.1-alpha.2 <0.3.0-0',{includePrerelease:true});}

package/dist/dsh.d.ts

@@ -1,4 +1,3 @@
-import type {InstallationReaderConfig} from './installation-status.js';
 import type { AppHost, AppDefinition, AuthenticatedSubject, Awaitable, DshStorageBinding } from './index.js';
 export const name: 'hanamesh-app-host';
 export const DSH_TARGET: '>=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0';
@@ -13,7 +12,7 @@ export interface DshPluginConfig {
   /** `sources` undefined → the HanaMesh catalog source; explicit `[]` → none. `profileDir`/`profileName`/`dshBin` (and
    *  `nodeBinary`) are inferred from the proven Desktop layout or plain DSH when undefined — see docs/CONTRACT.md 「应用库配置」; explicit values win. */
   /** rc.28: the same keys serve the HanaMesh market (plugins + applications; routes `/hanamesh/library*`, see docs/CONTRACT.md「市场」). */
-  library?:{fixture?:string;sources?:Array<{manifestUrl:string;enabled?:boolean}>;profileDir?:string;profileName?:string;dshBin?:string;registry?:string;eventRetention?:number;installationReaders?:Partial<Record<'claude'|'codex',InstallationReaderConfig>>};
+  library?:{fixture?:string;sources?:Array<{manifestUrl:string;enabled?:boolean}>;profileDir?:string;profileName?:string;dshBin?:string;registry?:string;eventRetention?:number};
   applications?: AppDefinition[]; leaseTtlMs?: number; sweepIntervalMs?: number;
 }
 /** Adapt an open `ctx.storageDomain` handle (single layout, global snapshot) to the store binding. */

package/dist/dsh.js

@@ -76,8 +76,6 @@ export const Config = z.object({
     registry:z.string(),
     /** Publicly named event history capacity; a lost cursor reports resetRequired. */
     eventRetention:z.number().default(512),
-    /** Explicit official CLI readers; unset means unknown, never inferred from PATH or private files. */
-    installationReaders:z.union([z.any(),z.const(undefined)]),
     /** Website → client handoff listener (library/handoff.js). Unset fields use the defaults shown in the library
      *  settings page, where they can also be changed (saved values win over this config). */
     handoff:z.object({enabled:z.boolean(),ports:z.union([z.array(z.number()),z.const(undefined)]),
@@ -260,7 +258,7 @@ export async function apply(ctx, config) {
     };
     const identity=await detectClient({desktop});
     if(typeof ctx.logger?.info==='function')ctx.logger.info('hanamesh-app-host library: client %s (%s)',identity.client,identity.evidence);
-    library=createLibraryService({domain:{global:libraryDomain.global,close:closeLibraryDomain},host,config:libraryConfig,dataRoot,ledgerReader:provisionApi?.ledger??(async()=>({schema:1,items:{}})),installer,client:identity.client,unavailable,suiteSourceService:()=>suiteSourceService,installationStatus:nodeStatusBinding(()=>nodeRuntime.executable,workerNode=>createInstallationStatusReader({client:identity.client,core:()=>coreService,workerNode,readers:libraryConfig.installationReaders})),logger:ctx.logger});
+    library=createLibraryService({domain:{global:libraryDomain.global,close:closeLibraryDomain},host,config:libraryConfig,dataRoot,ledgerReader:provisionApi?.ledger??(async()=>({schema:1,items:{}})),installer,client:identity.client,unavailable,suiteSourceService:()=>suiteSourceService,installationStatus:nodeStatusBinding(()=>nodeRuntime.executable,workerNode=>createInstallationStatusReader({client:identity.client,core:()=>coreService,workerNode})),logger:ctx.logger});
     own('library', () => library.close());
     await library.init();
     // rc.27: app bundles register plain `app.json` (no package name); the installed scan knows which npm package ships

package/dist/git-command-worker.js

@@ -0,0 +1,12 @@
+// Live Windows tree anchor; its reaper closes the tree before removing trace files.
+import {spawn,spawnSync} from 'node:child_process';
+import {join} from 'node:path';
+const stop=()=>{spawnSync(join(process.env.SystemRoot,'System32','taskkill.exe'),['/PID',String(process.pid),'/T','/F'],{stdio:'ignore',windowsHide:true});process.exit(1);};
+process.once('disconnect',stop);
+process.once('message',({command,args,options})=>{
+ const {input,...spawnOptions}=options;
+ const child=spawn(command,args,{...spawnOptions,stdio:[input===undefined?'ignore':'pipe','inherit','inherit'],detached:false});
+ if(input!==undefined){child.stdin.on('error',()=>{});child.stdin.end(input);}
+ child.once('error',error=>{if(process.connected)process.send({error:{code:error.code??'SPAWN_FAILED'}});});
+ child.once('close',(code,signal)=>{if(process.connected)process.send({result:{code,status:code,signal}});});
+});

package/dist/git-process.js

@@ -7,6 +7,11 @@ const policy=Object.freeze({GIT_CONFIG_NOSYSTEM:'1',GIT_TERMINAL_PROMPT:'0',GIT_
   GIT_CONFIG_KEY_1:'credential.helper',GIT_CONFIG_VALUE_1:'!gh auth git-credential'});
 export function safeGitEnv(base=process.env){
  const env={...base};
+ // Nested guards share ownership only within the same explicitly selected temp root.
+ // A caller choosing a different scratch root starts an independent trace owner.
+ if(!env.HM_GIT_GUARD_PARENT_ROOT&&base.TMPDIR===process.env.TMPDIR&&process.env.HM_GIT_GUARD_PARENT_ROOT){
+  env.HM_GIT_GUARD_PARENT_ROOT=process.env.HM_GIT_GUARD_PARENT_ROOT;env.HM_GIT_GUARD_TMP_ROOT=process.env.HM_GIT_GUARD_TMP_ROOT;
+ }
  for(const key of Object.keys(env))if(/^GIT_CONFIG_(?:COUNT|KEY_\d+|VALUE_\d+|PARAMETERS)$/.test(key)||/^GIT_TRACE/.test(key)||['GIT_ASKPASS','SSH_ASKPASS'].includes(key))delete env[key];
  return {...env,...policy,npm_config_manage_package_manager_versions:'false',pnpm_config_manage_package_manager_versions:'false'};
 }
@@ -27,7 +32,7 @@ export function observeGitTrace(directory){
    let event;try{event=JSON.parse(line);}catch{throw Object.assign(new Error('Invalid Git credential trace.'),{code:'GIT_TRACE_INVALID'});}
    if(['child_start','exec'].includes(event.event)&&forbidden.test((event.argv??[]).join(' '))){failure=Object.assign(new Error('Forbidden macOS keychain helper was invoked; operation failed.'),{code:'GIT_KEYCHAIN_FORBIDDEN'});throw failure;}
   }
- },close(){if(closed)return;closed=true;try{closeSync(fd);}finally{rmSync(directory,{recursive:true,force:true});}}};
+ },close(){if(closed)return;closed=true;try{closeSync(fd);}finally{rmSync(directory,{recursive:true,force:true,maxRetries:4,retryDelay:25});}}};
 }
 export function guardNodeBinary({workerNode,versions=process.versions,execPath=process.execPath}={}){
  if(workerNode!==undefined)return typeof workerNode==='string'&&isAbsolute(workerNode)?workerNode:undefined;
@@ -43,7 +48,7 @@ export async function spawnGitSafe(command,args,options={}){
  try{
   if(signal?.aborted)throw Object.assign(new Error('Guarded command aborted.'),{name:'AbortError',code:'ABORT_ERR'});
   const stdio=options.stdio==='inherit'?['ignore','inherit','inherit','ipc']:['ignore','pipe','pipe','ipc'];
-  worker=fork(new URL('./git-worker.js',import.meta.url),[],{cwd:options.cwd,env:safeGitEnv(options.env??process.env),execArgv:[],execPath:nodeRuntime,detached:process.platform!=='win32',stdio});
+  worker=fork(new URL('./git-worker.js',import.meta.url),[],{cwd:options.cwd,env:safeGitEnv(options.env??process.env),execArgv:[],execPath:nodeRuntime,detached:true,windowsHide:true,stdio});
   worker.stdout?.on('data',chunk=>{stdout=(stdout+chunk.toString(encoding)).slice(-4*1024*1024);});
   worker.stderr?.on('data',chunk=>{stderr=(stderr+chunk.toString(encoding)).slice(-4*1024*1024);});
   signal?.addEventListener('abort',abort,{once:true});
@@ -59,6 +64,6 @@ export async function spawnGitSafe(command,args,options={}){
  }finally{
   clearTimeout(deadline);clearTimeout(abortFallback);signal?.removeEventListener('abort',abort);
   if(worker?.connected)worker.disconnect();
-  if(directory)rmSync(directory,{recursive:true,force:true});
+  if(directory)rmSync(directory,{recursive:true,force:true,maxRetries:4,retryDelay:25});
  }
 }

package/dist/git-worker.js

@@ -1,16 +1,32 @@
 // Internal IPC supervisor. The parent never detaches a package manager directly.
-import {spawn,spawnSync} from 'node:child_process';
+import {spawn,spawnSync,fork} from 'node:child_process';
 import {existsSync,mkdtempSync,writeFileSync,rmSync,realpathSync} from 'node:fs';
 import {tmpdir} from 'node:os';
 import {dirname,join,basename} from 'node:path';
+import {createWindowsJob} from './windows-job.js';
 import {observeGitTrace} from './git-process.js';
-let monitor,directory,timer,done=false,started=false;
-function finish(payload){
+let monitor,directory,timer,done=false,started=false,anchor,anchorClosed,windowsJob,jobStarting,jobController;
+async function finish(payload){
  if(done)return;done=true;clearInterval(timer);
+ if(process.platform==='win32'&&anchor){
+  try{
+   if(!windowsJob){jobController?.abort();try{await jobStarting}catch{}}
+   if(windowsJob)await windowsJob.stop();else if(anchor.exitCode===null&&anchor.signalCode===null)anchor.kill('SIGKILL');
+   await anchorClosed;
+  }catch{payload={error:{code:'GIT_TREE_CLEANUP_FAILED'}};}
+ }
+ finalize(payload);
+}
+async function commandResult(payload){
+ if(done)return;
+ if(!payload.error){try{while(!done&&await windowsJob.active()>1)await new Promise(resolve=>setTimeout(resolve,5));}catch{void finish({error:{code:'GIT_TREE_CLEANUP_FAILED'}});return;}}
+ if(!done)void finish(payload);
+}
+function finalize(payload){
  try{monitor?.check(true);}catch(error){payload={error:{code:error.code??'GIT_TRACE_INVALID'}};}
  try{if(monitor)monitor.close();else if(directory)rmSync(directory,{recursive:true,force:true});}catch{payload={error:{code:'GIT_TRACE_CLEANUP_FAILED'}};}
  const end=()=>{
-  if(process.platform==='win32'){spawnSync('taskkill',['/pid',String(process.pid),'/T','/F'],{stdio:'ignore'});process.exit(1);}
+  if(process.platform==='win32')process.exit(0);
   else process.kill(-process.pid,'SIGKILL');
  };
  if(process.connected)process.send(payload,end);else end();
@@ -19,15 +35,17 @@ function abort(code='ABORT_ERR'){finish({error:{code,...(code==='ABORT_ERR'?{nam
 process.once('disconnect',()=>abort());
 process.once('SIGTERM',()=>abort());process.once('SIGINT',()=>abort());
 if(!process.connected)process.exit(1);
-process.on('message',request=>{
+process.on('message',async request=>{
  if(request.abort)return abort();if(request.timeout)return abort('ETIMEDOUT');
  if(started)return;started=true;
  try{
   let {command,args,options}=request;
   // No caller-owned trace exists before this IPC worker can clean on disconnect.
-  directory=mkdtempSync(join(realpathSync(options.env.TMPDIR??tmpdir()),'hm-git-guard-'));
+  const temporaryRoot=realpathSync(options.env.TMPDIR??tmpdir());
+  const parentRoot=options.env.HM_GIT_GUARD_TMP_ROOT===temporaryRoot&&options.env.HM_GIT_GUARD_PARENT_ROOT?realpathSync(options.env.HM_GIT_GUARD_PARENT_ROOT):temporaryRoot;
+  directory=mkdtempSync(join(parentRoot,'hm-git-guard-'));
   writeFileSync(join(directory,'events.jsonl'),'',{mode:0o600});monitor=observeGitTrace(directory);
-  options.env={...options.env,GIT_TRACE2_EVENT:join(directory,'events.jsonl'),GIT_TRACE_REDACT:'1'};
+  options.env={...options.env,HM_GIT_GUARD_PARENT_ROOT:directory,HM_GIT_GUARD_TMP_ROOT:temporaryRoot,GIT_TRACE2_EVENT:join(directory,'events.jsonl'),GIT_TRACE_REDACT:'1'};
   if(!process.connected)return abort();
   process.send({directory},error=>{if(error)abort();});
   // Native Windows .cmd shims cannot be executed by spawn without a shell.
@@ -40,6 +58,18 @@ process.on('message',request=>{
    const cli=candidates.find(path=>existsSync(path));if(!cli)throw Object.assign(new Error('Package manager JS entry unavailable.'),{code:'PACKAGE_MANAGER_UNAVAILABLE'});
    command=process.execPath;args=[cli,...args];
   }
+  if(process.platform==='win32'){
+   anchor=fork(new URL('./git-command-worker.js',import.meta.url),[],{cwd:options.cwd,env:options.env,execArgv:[],stdio:['ignore','inherit','inherit','ipc']});
+   anchorClosed=new Promise(resolve=>anchor.once('close',resolve));
+   anchor.once('message',value=>{void commandResult(value)});anchor.once('error',error=>{void finish({error:{code:error.code??'SPAWN_FAILED'}})});
+   jobController=new AbortController();
+   jobStarting=createWindowsJob({pid:anchor.pid,env:{...options.env,TMPDIR:directory,TMP:directory,TEMP:directory},cwd:options.cwd,signal:jobController.signal});
+   windowsJob=await jobStarting;
+   if(done)return;
+   anchor.send({command,args,options});
+   timer=setInterval(()=>{try{monitor.check();}catch(error){finish({error:{code:error.code??'GIT_TRACE_INVALID'}});}},25);
+   return;
+  }
   const {input,...spawnOptions}=options;
   const child=spawn(command,args,{...spawnOptions,stdio:[input===undefined?'ignore':'pipe','inherit','inherit'],detached:false});
   if(input!==undefined){child.stdin.on('error',()=>{});child.stdin.end(input);}

package/dist/install-target/suite.js

@@ -5,7 +5,7 @@
  * real provider. Fixture data is a test catalog and is labelled as such in the market UI.
  */
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
+import { join, dirname, resolve } from 'node:path';
 import { createServer, request } from 'node:http';
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
@@ -95,7 +95,7 @@ export async function sourceRecoveryProfile({recovery},item={}){
   for(const [command,phase,skip] of item.inject??[])profile.fail(command,phase,skip);
   if(item.concurrent)profile.concurrentAdd('@fixture/concurrent','1.0.0');
   // The catalog fixture already supplies the exact reviewed version.
-  const installer=emit=>createLibraryInstaller({profileDir:profile.profileDir,profileName:profile.profileName,dataRoot:profile.dataRoot,nodeBinary:'/source-fixture/bin/node',dshBin:'/source-fixture/dsh/lib/bin.js',
+  const installer=emit=>createLibraryInstaller({profileDir:profile.profileDir,profileName:profile.profileName,dataRoot:profile.dataRoot,nodeBinary:resolve('/source-fixture/bin/node'),dshBin:resolve('/source-fixture/dsh/lib/bin.js'),
     fetchImpl:profile.fetchImpl({[app.packageName]:app.latest,[plugin.packageName]:plugin.latest}),spawn:profile.spawn,provision:profile.provision,remove:profile.remove,ledger:profile.ledger,emit});
   return{profile,target,installer};
 }

package/dist/installation-status.d.ts

@@ -1,13 +1,5 @@
 /** Advertised metadata only. Discovery performs no installation read. */
 export const INSTALLATION_STATUS_CAPABILITY:Readonly<{contract:'hanamesh.installation-status';contractVersion:'1';path:'/hanamesh/library/installation-status'}>;
-export interface InstallationReaderConfig {
- /** Absolute official executable and explicitly selected user/config directories. Never supplied by a website. */
- executable:string;home:string;configDir:string;
- /** Identity and exact HTTPS marketplace URL from the registered AgentPluginDTO. */
- pluginName:string;marketplace:string;marketplaceUrl:string;
- /** Required positive bounded operation budgets. No product default is inferred. */
- timeoutMs:number;maxOutputBytes:number;
-}
 export interface InstallationStatusRequest {contractVersion:'1';consent:'read-installations'}
 export interface InstallationObservation {
  channel:'hanamesh'|'dsh'|'claude'|'codex';

package/dist/library/handoff.js

@@ -1,4 +1,5 @@
 import { installationStatusCors, serveInstallationStatus } from './installation-status-http.js';
+import {serveInstallTargetProbe} from './install-target-http.js';
 /**
  * Website → client install handoff (C-MARKET, 2026-10-15 E/F). Upstream Desktop listens on an OS-assigned port that
  * nothing records, and a browser tab without the launch token gets 401, so a website can neither find nor enter the
@@ -33,7 +34,7 @@ const TIMER_MAX_MS = 2_147_483_647;
 /** Fixed rules (correctness, not policy): listed on the settings page with the reason they cannot be switched off. */
 export const HANDOFF_RULES = Object.freeze([
   { rule: '只在本机 127.0.0.1 上监听，请求的 Host 必须是 127.0.0.1 或 localhost 加监听端口', why: '防止别的机器或 DNS 重绑定的网页冒充本机' },
-  { rule: '只有「允许交接的网站」里的网站能探测本客户端、交接安装、读交接状态；别的网站什么也读不到', why: '否则任何网页都能知道你装了什么客户端、缺什么，用来识别你' },
+  { rule: '只有「允许交接的网站」能读取客户端能力、交接安装和交接状态；未许可网站仅能读取固定的来源拒绝提示', why: '拒绝提示只说明本机监听拒绝了该网站，不透露客户端类型、能力、安装情况或允许名单' },
   { rule: '网站交接只会在应用库里弹出确认；只有你点「确认安装」才会安装', why: '网站不能替你决定装什么' },
   { rule: '交接状态只给发起它的那个网站看', why: '一个网站不能读另一个网站的交接' },
   { rule: `交接请求体不超过 ${HANDOFF_BODY_MAX_BYTES} 字节`, why: '交接只包含目录身份、合约版本及已审核的结构化安装目标；正文上限为 4096 字节，不接受来源命令' },
@@ -168,16 +169,7 @@ export function createHandoffHandler({ library, queue, settings, port }) {
       requireCondition([`127.0.0.1:${bound}`, `localhost:${bound}`].includes(req.headers.host), 'HOST_DENIED', 'Unrecognized request host.', {}, 403);
       const url = new URL(req.url ?? '/', `http://${req.headers.host}`), path = url.pathname, origin = req.headers.origin;
       if (path === '/hanamesh/library/install-target') {
-        // A website not in allowedOrigins gets no CORS grant and no body: it cannot tell which client runs or what it lacks.
-        // Requests without an Origin are not from a website (a person's address bar, a local tool) and are answered.
-        if (origin !== undefined) {
-          requireCondition(settings().allowedOrigins.includes(origin), 'ORIGIN_DENIED', 'Not available.', undefined, 403);
-          cors = { 'access-control-allow-origin': origin, vary: 'Origin', 'access-control-allow-private-network': 'true' };
-        }
-        if (req.method === 'OPTIONS') { send(res, 204, undefined, { ...cors, 'access-control-allow-methods': 'GET' }); return; }
-        requireCondition(req.method === 'GET', 'METHOD_NOT_ALLOWED', 'Discovery requires GET.', {}, 405);
-        requireCondition(!url.search, 'UNKNOWN_FIELDS', 'Discovery takes no parameters.');
-        send(res, 200, { ...library.installTarget(), traceId }, cors); return;
+        serveInstallTargetProbe(req,res,{allowedOrigins:settings().allowedOrigins,read:()=>library.installTarget(),traceId,send});return;
       }
       if(path === '/hanamesh/library/installation-status'){
         cors=installationStatusCors(req,settings().allowedOrigins);

package/dist/library/install-target-http.js

@@ -0,0 +1,39 @@
+/** Public discovery only: an unapproved website may read one constant refusal, never client facts. */
+import {AppHostError,requireCondition} from '../errors.js';
+const PATH='/hanamesh/library/install-target';
+const VARY='Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Request-Private-Network';
+function browserOrigin(origin){
+ if(typeof origin!=='string')return false;
+ try{const url=new URL(origin);return ['https:','http:'].includes(url.protocol)&&url.origin===origin}catch{return false}
+}
+export function serveInstallTargetProbe(req,res,{allowedOrigins,read,traceId,send}){
+ let cors={};
+ try{
+  requireCondition(req.url?.startsWith('/')&&!req.url.startsWith('//')&&!req.url.includes('\\')&&req.url.split('?')[0]===PATH,'BAD_TARGET','Invalid discovery target.');
+  requireCondition(req.headers['sec-fetch-dest']!=='iframe','FRAME_CONTROL_DENIED','An application frame cannot inspect the host.',{},403);
+  const url=new URL(req.url,'http://127.0.0.1'),origin=req.headers.origin,approved=origin===undefined||allowedOrigins.includes(origin);
+  if(!approved){
+   requireCondition(browserOrigin(origin),'ORIGIN_DENIED','Not available.',{},403);
+   requireCondition(req.method==='GET'||req.method==='OPTIONS','METHOD_NOT_ALLOWED','Discovery requires GET.',{},405);
+   requireCondition(!url.search,'UNKNOWN_FIELDS','Discovery takes no parameters.');
+   requireCondition(req.headers.cookie===undefined&&req.headers.authorization===undefined,'CREDENTIALS_NOT_ACCEPTED','Discovery requires credentials: omit.',{},403);
+  }
+  if(req.method==='OPTIONS'){
+   const method=req.headers['access-control-request-method'],headers=req.headers['access-control-request-headers'],privateNetwork=req.headers['access-control-request-private-network'];
+   requireCondition(method==='GET'||(approved&&method===undefined),'METHOD_NOT_ALLOWED','Discovery preflight permits GET only.',{},405);
+   requireCondition(headers===undefined||headers.trim()==='','PREFLIGHT_HEADERS_DENIED','Discovery preflight accepts no additional request headers.',{},403);
+   requireCondition(privateNetwork===undefined||privateNetwork==='true','INVALID_PREFLIGHT','Invalid private-network preflight.');
+   cors=origin===undefined?{}:{'access-control-allow-origin':origin};
+   // A non-2xx preflight hides the subsequent refusal from fetch. This grants only the fixed GET response.
+   send(res,204,undefined,{...cors,vary:VARY,'access-control-allow-methods':'GET',...(origin!==undefined&&privateNetwork==='true'?{'access-control-allow-private-network':'true'}:{})});return;
+  }
+  cors=origin===undefined?{}:{'access-control-allow-origin':origin,vary:'Origin'};
+  if(!approved){send(res,403,{error:{code:'ORIGIN_DENIED',message:'This website is not allowed to read discovery.'}},cors);return;}
+  requireCondition(req.method==='GET','METHOD_NOT_ALLOWED','Discovery requires GET.',{},405);
+  requireCondition(!url.search,'UNKNOWN_FIELDS','Discovery takes no parameters.');
+  send(res,200,{...read(),traceId},cors);
+ }catch(error){
+  const trusted=error instanceof AppHostError;
+  send(res,trusted?error.status:500,{error:{code:trusted?error.code:'INTERNAL_ERROR',message:trusted?error.message:'The operation could not be completed.'},traceId},cors);
+ }
+}

package/dist/library/installation-cli.js

@@ -5,11 +5,33 @@ import {stat,realpath,rm} from 'node:fs/promises';
 import {tmpdir} from 'node:os';
 import {dirname,isAbsolute,delimiter} from 'node:path';
 import {AppHostError} from '../errors.js';
-const fail=code=>{throw new AppHostError(code,'The configured official installation reader could not complete.',{},503)};
-export const SUPPORTED_READER_VERSIONS=Object.freeze({claude:'2.1.301 (Claude Code)',codex:'codex-cli 0.162.1'});
+import semver from 'semver';
+export const INSTALLATION_MANAGER_ENV_KEYS=Object.freeze(['VOLTA_HOME','ASDF_DATA_DIR','ASDF_CONFIG_FILE','MISE_DATA_DIR','MISE_CONFIG_DIR','MISE_GLOBAL_CONFIG_FILE','MISE_CACHE_DIR','MISE_STATE_DIR','FNM_DIR','NVM_DIR','NVM_HOME','NVM_SYMLINK','PNPM_HOME']);
+export const INSTALLATION_ENV_KEYS=Object.freeze([...INSTALLATION_MANAGER_ENV_KEYS,'PATH','XDG_CONFIG_HOME','XDG_CACHE_HOME','XDG_DATA_HOME','XDG_STATE_HOME','XDG_RUNTIME_DIR','XDG_CONFIG_DIRS','XDG_DATA_DIRS']);
+const pathListKeys=new Set(['PATH','XDG_CONFIG_DIRS','XDG_DATA_DIRS']);
+const absolutePath=value=>typeof value==='string'&&isAbsolute(value)&&!/[\x00-\x1f]/.test(value);
+export function installationEnvironment(source,platform=process.platform){
+ const separator=platform==='win32'?';':':',result={};
+ for(const key of INSTALLATION_ENV_KEYS){const value=key==='PATH'?source.PATH??source.Path:source[key];
+  if(typeof value!=='string'||/[\x00-\x1f]/.test(value))continue;
+  if(pathListKeys.has(key))result[key]=value.split(separator).filter(absolutePath).join(separator);
+  else if(absolutePath(value))result[key]=value;
+ }
+ return result;
+}
+const fail=code=>{throw new AppHostError(code,'The automatically discovered official installation reader could not complete.',{},503)};
+export const MINIMUM_READER_VERSIONS=Object.freeze({claude:'2.1.301',codex:'0.162.1'});
+export function readerVersionFailure(channel,output){
+ const pattern=channel==='claude'?/^(\d+\.\d+\.\d+) \(Claude Code\)$/:/^codex-cli (\d+\.\d+\.\d+)$/;
+ const version=pattern.exec(output.trim())?.[1];
+ if(!version||semver.valid(version)!==version)return 'AGENT_READER_VERSION_INVALID';
+ return semver.gte(version,MINIMUM_READER_VERSIONS[channel])?null:'AGENT_READER_VERSION_UNSUPPORTED';
+}
 export function validReader(value){
  if(!value||typeof value!=='object'||Array.isArray(value))return false;
- const keys=['executable','home','configDir','pluginName','marketplace','marketplaceUrl','timeoutMs','maxOutputBytes'];
+ const keys=['executable','home','configDir','pluginName','marketplace','marketplaceUrl','timeoutMs','maxOutputBytes','nodeScript','runtimeEnv'];
+ if(value.nodeScript!==undefined&&typeof value.nodeScript!=='boolean')return false;
+ if(value.runtimeEnv!==undefined&&(!value.runtimeEnv||typeof value.runtimeEnv!=='object'||Array.isArray(value.runtimeEnv)||!Object.entries(value.runtimeEnv).every(([key,path])=>INSTALLATION_ENV_KEYS.includes(key)&&typeof path==='string'&&!/[\x00-\x1f]/.test(path)&&(pathListKeys.has(key)?path===''||path.split(delimiter).every(absolutePath):absolutePath(path)))))return false;
  if(Object.keys(value).some(key=>!keys.includes(key))||!['executable','home','configDir'].every(key=>typeof value[key]==='string'&&isAbsolute(value[key])&&!/[\x00-\x1f]/.test(value[key])))return false;
  if(!['pluginName','marketplace'].every(key=>typeof value[key]==='string'&&/^[a-z0-9][a-z0-9._-]{0,127}$/.test(value[key])))return false;
  try{const url=new URL(value.marketplaceUrl);if(url.protocol!=='https:'||url.username||url.password||url.hash||url.search||url.href!==value.marketplaceUrl)return false}catch{return false}
@@ -17,32 +39,35 @@ export function validReader(value){
 }
 export async function runOfficialInstallationCommand({channel,reader,args,signal,workerNode}){
  if(signal?.aborted)fail('INSTALLATION_STATUS_CANCELLED');
- if(process.platform==='win32')fail('AGENT_READER_PLATFORM_UNSUPPORTED');
- if(!validReader(reader))fail('AGENT_READER_CONFIG_INVALID');
+ if(!validReader(reader))fail('AGENT_READER_DISCOVERY_INVALID');
  const nodeRuntime=guardNodeBinary({workerNode});if(!nodeRuntime)fail('AGENT_READER_NODE_REQUIRED');
  for(const path of [reader.home,reader.configDir]){let value;try{value=await stat(path)}catch{fail('AGENT_PROFILE_UNAVAILABLE')}if(!value.isDirectory())fail('AGENT_PROFILE_UNAVAILABLE')}
- const temporaryRoot=await realpath(tmpdir());let cwd;
- // An exact configuration directory is explicit. Inherited model/API tokens, proxy, shell startup and askpass are absent.
- const env={PATH:[dirname(nodeRuntime),'/usr/bin','/bin','/usr/local/bin'].join(delimiter),HOME:reader.home,USERPROFILE:reader.home,
-  ...(channel==='claude'?{CLAUDE_CONFIG_DIR:reader.configDir,CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:'1',DISABLE_AUTOUPDATER:'1'}:{CODEX_HOME:reader.configDir}),
-  GIT_TERMINAL_PROMPT:'0',GIT_CONFIG_NOSYSTEM:'1',GIT_CONFIG_GLOBAL:'/dev/null',GIT_CONFIG_COUNT:'1',GIT_CONFIG_KEY_0:'credential.helper',GIT_CONFIG_VALUE_0:''};
+ const temporaryRoot=await realpath(tmpdir());let cwd,cleanupConfirmed=false;
+ // Keep the selected user's manager resolution conditions, without model/API tokens, proxy, preloads or askpass.
+ const systemRoot=process.platform==='win32'?(process.env.SystemRoot??'C:\\Windows'):undefined;
+ const inheritedPath=(reader.runtimeEnv?.PATH??'').split(delimiter).filter(absolutePath);
+ const env={...reader.runtimeEnv,PATH:[...new Set([dirname(nodeRuntime),dirname(reader.executable),...inheritedPath,...(systemRoot?[systemRoot,`${systemRoot}\\System32`]:['/usr/bin','/bin','/usr/local/bin'])])].join(delimiter),HOME:reader.home,USERPROFILE:reader.home,
+  ...(systemRoot?{SystemRoot:systemRoot,LOCALAPPDATA:process.env.LOCALAPPDATA??`${reader.home}\\AppData\\Local`,APPDATA:process.env.APPDATA??`${reader.home}\\AppData\\Roaming`}:{}),
+  ...(channel==='claude'?{CLAUDE_CONFIG_DIR:reader.configDir,CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:'1',DISABLE_AUTOUPDATER:'1'}:channel==='codex'?{CODEX_HOME:reader.configDir}:{}),
+  GIT_TERMINAL_PROMPT:'0',GIT_CONFIG_NOSYSTEM:'1',GIT_CONFIG_GLOBAL:systemRoot?'NUL':'/dev/null',GIT_CONFIG_COUNT:'1',GIT_CONFIG_KEY_0:'credential.helper',GIT_CONFIG_VALUE_0:''};
  try{return await new Promise((resolve,reject)=>{
   if(signal?.aborted){reject(new AppHostError('INSTALLATION_STATUS_CANCELLED','Installation read was cancelled.',{},499));return}
-  const child=fork(new URL('./installation-worker.js',import.meta.url),[],{cwd:temporaryRoot,env,execPath:nodeRuntime,execArgv:[],detached:true,stdio:['ignore','pipe','pipe','ipc']});
+  // The reaper must survive caller death on Windows too; libuv kills non-detached children with their creator.
+  const child=fork(new URL('./installation-worker.js',import.meta.url),[],{cwd:temporaryRoot,env,execPath:nodeRuntime,execArgv:[],detached:true,windowsHide:true,stdio:['ignore','pipe','pipe','ipc']});
   const chunks=[];let total=0,stderr=false,fault,exited=false,message;
-  const kill=code=>{fault??=code;if(!exited&&child.pid){child.kill('SIGTERM')}};
+  const kill=code=>{fault??=code;if(!exited&&child.pid){if(process.platform==='win32'){if(child.connected)child.send({abort:true},()=>{})}else child.kill('SIGTERM')}};
   const abort=()=>kill('INSTALLATION_STATUS_CANCELLED');signal?.addEventListener('abort',abort,{once:true});
   const timer=setTimeout(()=>kill('AGENT_READER_TIMEOUT'),reader.timeoutMs);
   child.stdout.on('data',chunk=>{total+=chunk.length;if(total>reader.maxOutputBytes)kill('AGENT_READER_OUTPUT_LIMIT');else chunks.push(chunk)});
   child.stderr.on('data',chunk=>{stderr=true;total+=chunk.length;if(total>reader.maxOutputBytes)kill('AGENT_READER_OUTPUT_LIMIT')});
-  child.on('message',value=>{if(typeof value.directory==='string')cwd=value.directory;else message=value});
+  child.on('message',value=>{if(typeof value.directory==='string')cwd=value.directory;else{message=value;cleanupConfirmed=value.cleanupComplete===true}});
   child.once('exit',()=>{exited=true});
   child.once('error',error=>{fault??=error.code==='EACCES'?'AGENT_READER_PERMISSION_DENIED':'AGENT_READER_UNAVAILABLE'});
   child.once('close',code=>{exited=true;clearTimeout(timer);signal?.removeEventListener('abort',abort);
-   if(fault||message?.error||message?.result!==0||stderr)reject(new AppHostError(fault??message?.error??(stderr?'AGENT_READER_DIAGNOSTIC':'AGENT_READER_FAILED'),'The configured official reader did not return a complete clean result.',{},503));
+   if(fault||message?.error||message?.result!==0||(stderr&&channel!=='shell'))reject(new AppHostError((cwd&&!cleanupConfirmed?'AGENT_READER_CLEANUP_FAILED':fault??message?.error)??(stderr&&channel!=='shell'?'AGENT_READER_DIAGNOSTIC':'AGENT_READER_FAILED'),'The official reader did not return a complete successful result.',{},503));
    else resolve(Buffer.concat(chunks).toString('utf8'));
   });
-  if(child.connected)child.send({executable:reader.executable,args,temporaryRoot,env},()=>{});
+  if(child.connected)child.send({executable:reader.nodeScript?nodeRuntime:reader.executable,args:reader.nodeScript?[reader.executable,...args]:args,temporaryRoot,env},()=>{});
   if(signal?.aborted)abort();
- })}finally{if(cwd)await rm(cwd,{recursive:true,force:true})}
+ })}finally{if(cwd&&cleanupConfirmed)await rm(cwd,{recursive:true,force:true,maxRetries:4,retryDelay:25})}
 }

package/dist/library/installation-command-worker.js

@@ -1,7 +1,8 @@
 /** Live command-group anchor. Its separate reaper removes the cwd only after this group has ended. */
-import {spawn} from 'node:child_process';
+import {spawn,spawnSync} from 'node:child_process';
+import {join} from 'node:path';
 let started=false,reported=false;
-const stopOwnedGroup=()=>process.kill(-process.pid,'SIGKILL');
+const stopOwnedGroup=()=>{if(process.platform==='win32'){spawnSync(join(process.env.SystemRoot,'System32','taskkill.exe'),['/pid',String(process.pid),'/T','/F'],{stdio:'ignore',windowsHide:true});process.exit(1)}else process.kill(-process.pid,'SIGKILL')};
 function report(payload){
  if(reported)return;reported=true;
  if(process.connected){try{process.send(payload,error=>{if(error)stopOwnedGroup()})}catch{stopOwnedGroup()}}else stopOwnedGroup();

package/dist/library/installation-discovery.js

@@ -0,0 +1,95 @@
+/** Host-only discovery. Lists executable directories, never authentication/config contents. */
+import {access,stat,readdir} from 'node:fs/promises';
+import {constants} from 'node:fs';
+import {homedir,userInfo} from 'node:os';
+import {join,isAbsolute} from 'node:path';
+import semver from 'semver';
+import {AppHostError} from '../errors.js';
+import {guardNodeBinary} from '../git-process.js';
+import {runOfficialInstallationCommand,INSTALLATION_ENV_KEYS,installationEnvironment} from './installation-cli.js';
+
+// Existing installation-command fixture budgets; automatic selection adds no retry or longer deadline.
+export const INSTALLATION_READ_BUDGET=Object.freeze({timeoutMs:2000,maxOutputBytes:20000});
+export const AGENT_INSTALLATION_TARGET=Object.freeze({pluginName:'hanamesh',marketplace:'hanamesh',marketplaceUrl:'https://github.com/yzsnstotz/hanamesh-plugins'});
+const absolute=value=>typeof value==='string'&&isAbsolute(value)&&!/[\x00-\x1f]/.test(value);
+const failure=code=>new AppHostError(code,'Automatic official CLI discovery could not complete.',{},503);
+const split=(value,platform)=>(value??'').split(platform==='win32'?';':':').filter(absolute);
+const unique=values=>[...new Set(values.filter(absolute))];
+async function exists(file,platform){try{if(!(await stat(file)).isFile())return false;await access(file,platform==='win32'?constants.F_OK:constants.X_OK);return true}catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return false;if(['EACCES','EPERM'].includes(error.code))throw failure('AGENT_READER_PERMISSION_DENIED');throw failure('AGENT_READER_UNAVAILABLE')}}
+async function versions(root,suffix){
+ let entries;try{entries=await readdir(root,{withFileTypes:true})}catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return[];throw failure(error.code==='EACCES'?'AGENT_READER_PERMISSION_DENIED':'AGENT_READER_UNAVAILABLE')}
+ return entries.filter(entry=>(entry.isDirectory()||entry.isSymbolicLink())&&semver.valid(entry.name.replace(/^v/,''))).sort((a,b)=>semver.rcompare(a.name.replace(/^v/,''),b.name.replace(/^v/,''))).map(entry=>join(root,entry.name,...suffix));
+}
+
+/** VS Code's framed login-shell environment pattern, narrowed to named infrastructure paths only. */
+export async function readLoginEnvironment({home=homedir(),env=process.env,signal,workerNode,timeoutMs=INSTALLATION_READ_BUDGET.timeoutMs,runCommand=runOfficialInstallationCommand}={}){
+ const shell=env.SHELL??userInfo().shell;
+ if(!absolute(shell))throw failure('AGENT_SHELL_ENV_UNAVAILABLE');
+ const node=guardNodeBinary({workerNode});if(!node)throw failure('AGENT_READER_NODE_REQUIRED');
+ const quote=value=>"'"+value.replaceAll("'","'\\''")+"'";
+ const script=`const env={};for(const key of ${JSON.stringify(INSTALLATION_ENV_KEYS)})if(process.env[key]!==undefined)env[key]=process.env[key];process.stdout.write('\\0HANAMESH_ENV\\0'+JSON.stringify(env)+'\\0');`;
+ const output=await runCommand({channel:'shell',reader:{executable:shell,home,configDir:home,...AGENT_INSTALLATION_TARGET,...INSTALLATION_READ_BUDGET,timeoutMs,runtimeEnv:installationEnvironment(env)},
+  args:['-ilc',`${quote(node)} -e ${quote(script)}`],signal,workerNode});
+ const parts=output.split('\0HANAMESH_ENV\0');
+ if(parts.length!==2||!parts[1].includes('\0'))throw failure('AGENT_SHELL_ENV_UNAVAILABLE');
+ let value;try{value=JSON.parse(parts[1].split('\0')[0])}catch{throw failure('AGENT_SHELL_ENV_UNAVAILABLE')}
+ if(!value||typeof value!=='object'||Array.isArray(value)||typeof value.PATH!=='string'||!Object.entries(value).every(([key,path])=>INSTALLATION_ENV_KEYS.includes(key)&&typeof path==='string'&&!/[\x00-\x1f]/.test(path)))throw failure('AGENT_SHELL_ENV_UNAVAILABLE');
+ return installationEnvironment(value);
+}
+export async function readLoginPath(options){return(await readLoginEnvironment(options)).PATH}
+
+/** Select once: inherited PATH, login PATH, then documented layouts; never try another CLI after execution. */
+export async function discoverOfficialReader({channel,home=process.env.HOME??process.env.USERPROFILE??homedir(),env=process.env,platform=process.platform,
+ systemBinDirs=platform==='win32'?[]:['/opt/homebrew/bin','/usr/local/bin','/home/linuxbrew/.linuxbrew/bin','/usr/bin','/bin'],loginPath,signal,workerNode}={}){
+ if(!['claude','codex'].includes(channel)||!absolute(home))throw failure('AGENT_PROFILE_UNAVAILABLE');
+ signal?.throwIfAborted();
+ const configDir=env[channel==='claude'?'CLAUDE_CONFIG_DIR':'CODEX_HOME']??join(home,channel==='claude'?'.claude':'.codex');
+ if(!absolute(configDir))throw failure('AGENT_PROFILE_UNAVAILABLE');
+ const appData=env.APPDATA??join(home,'AppData','Roaming'),local=env.LOCALAPPDATA??join(home,'AppData','Local');
+ const runtimeEnv=installationEnvironment(env,platform);
+ const reader={home,configDir,...AGENT_INSTALLATION_TARGET,...INSTALLATION_READ_BUDGET,runtimeEnv};
+ const find=async dirs=>{for(const dir of unique(dirs)){
+  signal?.throwIfAborted();
+  for(const name of platform==='win32'?[`${channel}.exe`,`${channel}.cmd`]:[channel]){
+   const executable=join(dir,name);if(!await exists(executable,platform))continue;
+   if(name.endsWith('.cmd')){
+    const entry=channel==='claude'?['@anthropic-ai','claude-code','cli.js']:['@openai','codex','bin','codex.js'];
+    const entries=[join(dir,'node_modules',...entry)];
+    if(dir===join(local,'Yarn','bin'))entries.push(join(local,'Yarn','Data','global','node_modules',...entry));
+    if(dir===join(home,'.yarn','bin'))entries.push(join(home,'.config','yarn','global','node_modules',...entry));
+    // pnpm's global layout has a numbered compatibility directory; inspect directory names only.
+    for(const base of unique([dir,...(dir===join(local,'pnpm','bin')?[join(local,'pnpm')]:[]),...(absolute(env.PNPM_HOME)&&dir===join(env.PNPM_HOME,'bin')?[env.PNPM_HOME]:[])])){
+     let global=[];try{global=await readdir(join(base,'global'))}catch(error){if(!['ENOENT','ENOTDIR'].includes(error.code))throw failure('AGENT_READER_ENTRYPOINT_UNAVAILABLE')}
+     for(const name of global.filter(name=>/^\d+$/.test(name)).sort((a,b)=>Number(b)-Number(a)))entries.push(join(base,'global',name,'node_modules',...entry));
+    }
+    let script;for(const candidate of entries)if(await exists(candidate,'win32')){script=candidate;break}
+    if(!script)throw failure('AGENT_READER_ENTRYPOINT_UNAVAILABLE');
+    return{...reader,executable:script,nodeScript:true};
+   }
+   return{...reader,executable};
+  }
+ }return null};
+ let selected=await find(split(env.PATH??env.Path,platform));if(selected)return selected;
+ let shellError;
+ if(platform!=='win32'){
+  try{const resolved=loginPath?{PATH:await loginPath({home,env,signal,workerNode})}:await readLoginEnvironment({home,env,signal,workerNode});Object.assign(runtimeEnv,resolved);selected=await find(split(resolved.PATH,platform));if(selected)return selected}
+  catch(error){if(signal?.aborted)throw error;shellError=error}
+ }
+ const nvm=runtimeEnv.NVM_DIR??join(home,'.nvm'),fnm=runtimeEnv.FNM_DIR??join(runtimeEnv.XDG_DATA_HOME??join(home,'.local','share'),'fnm'),asdf=runtimeEnv.ASDF_DATA_DIR??join(home,'.asdf'),mise=runtimeEnv.MISE_DATA_DIR??join(runtimeEnv.XDG_DATA_HOME??join(home,'.local','share'),'mise');
+ const fixed=[join(home,'.local','bin'),...(channel==='claude'?[join(home,'.claude','local'),join(home,'.claude','local','node_modules','.bin')]:[]),
+  env.CODEX_INSTALL_DIR,env.NVM_BIN,env.NVM_SYMLINK,env.FNM_MULTISHELL_PATH,
+  ...[env.npm_config_prefix,env.NPM_CONFIG_PREFIX,join(home,'.npm-global'),join(home,'.npm')].filter(absolute).map(root=>platform==='win32'?root:join(root,'bin')),
+  env.PNPM_HOME,...(absolute(env.PNPM_HOME)?[join(env.PNPM_HOME,'bin')]:[]),join(home,'.local','share','pnpm'),join(home,'.local','share','pnpm','bin'),join(home,'Library','pnpm'),join(home,'Library','pnpm','bin'),join(home,'.yarn','bin'),join(home,'.config','yarn','global','node_modules','.bin'),
+  join(env.VOLTA_HOME??join(home,'.volta'),'bin'),join(asdf,'shims'),join(mise,'shims'),
+  ...(platform==='win32'?[join(appData,'npm'),join(local,'pnpm'),join(local,'Yarn','bin'),join(local,'Programs','OpenAI','Codex','bin'),join(local,'Microsoft','WinGet','Links'),join(local,'Volta','bin'),...(absolute(env.ProgramFiles)?[join(env.ProgramFiles,'nodejs')]:[])]:[]),...systemBinDirs];
+ selected=await find(fixed);if(selected)return selected;
+ const managed=[];
+ for(const [root,suffix]of [[join(nvm,'versions','node'),['bin']],[env.NVM_HOME,[]],[join(fnm,'node-versions'),['installation',...(platform==='win32'?[]:['bin'])]],
+  [join(home,'Library','Application Support','fnm','node-versions'),['installation','bin']],[join(appData,'fnm','node-versions'),['installation']],
+  [join(asdf,'installs','nodejs'),['bin']],[join(mise,'installs','node'),['bin']]]){
+  if(absolute(root))managed.push(...await versions(root,suffix));
+ }
+ selected=await find(managed);if(selected)return selected;
+ if(shellError)throw failure(shellError.code==='AGENT_READER_TIMEOUT'?'AGENT_READER_TIMEOUT':'AGENT_SHELL_ENV_UNAVAILABLE');
+ throw failure('AGENT_READER_UNAVAILABLE');
+}