@hanamesh/dsh-app-host 0.6.22 → 0.6.24

package/dist/library/installation-status.js

@@ -2,7 +2,8 @@
 import semver from 'semver';
 import {AppHostError} from '../errors.js';
 import {SUITE_BUNDLE,createCoreSuiteAdapter,SUITE_PACKAGES} from './suite.js';
-import {SUPPORTED_READER_VERSIONS,validReader,runOfficialInstallationCommand} from './installation-cli.js';
+import {readerVersionFailure,validReader,runOfficialInstallationCommand} from './installation-cli.js';
+import {discoverOfficialReader} from './installation-discovery.js';
 const object=x=>x!==null&&typeof x==='object'&&!Array.isArray(x);
 const exact=x=>typeof x==='string'&&semver.valid(x)===x?x:null;
 const reason=(code,message,action)=>({code,message,action});
@@ -48,11 +49,11 @@ function parseInventory(channel,plugins,marketplaces,target){
  return{status:failed?'incomplete':'installed',version,components:[{name:target.pluginName,version,active:row.enabled}],
   reason:failed?reason(channel==='claude'?'AGENT_PLUGIN_LOAD_FAILED':'AGENT_PLUGIN_PAYLOAD_MISSING','官方清单报告插件负载或加载问题。','在该官方客户端的插件详情中检查并修复。'):version===null?reason('AGENT_VERSION_UNAVAILABLE','已确认该作用域的安装记录，但实际版本未知。','在该官方客户端插件详情中核对实际版本。'):null};
 }
-const failureCodes=new Set(['AGENT_READER_UNAVAILABLE','AGENT_READER_PERMISSION_DENIED','AGENT_READER_PLATFORM_UNSUPPORTED','AGENT_READER_NODE_REQUIRED','AGENT_PROFILE_UNAVAILABLE','AGENT_READER_TIMEOUT','AGENT_READER_OUTPUT_LIMIT','AGENT_READER_CLEANUP_FAILED','AGENT_READER_DIAGNOSTIC','AGENT_READER_FAILED','AGENT_INVENTORY_INVALID','AGENT_INVENTORY_CONFLICT','AGENT_MARKETPLACE_SOURCE_MISMATCH','AGENT_MARKETPLACE_SOURCE_UNAVAILABLE','AGENT_SCOPE_UNOBSERVABLE']);
-/** Trusted static configuration only; `core` is the optional public protocol-1 Cordis service accessor. */
-export function createInstallationStatusReader({client='dsh',core=()=>undefined,readers={},workerNode,runCommand=runOfficialInstallationCommand}={}){
+const failureCodes=new Set(['AGENT_SHELL_ENV_UNAVAILABLE','AGENT_READER_DISCOVERY_INVALID','AGENT_READER_ENTRYPOINT_UNAVAILABLE','AGENT_READER_UNAVAILABLE','AGENT_READER_PERMISSION_DENIED','AGENT_READER_NODE_REQUIRED','AGENT_PROFILE_UNAVAILABLE','AGENT_READER_TIMEOUT','AGENT_READER_OUTPUT_LIMIT','AGENT_READER_CLEANUP_FAILED','AGENT_READER_DIAGNOSTIC','AGENT_READER_FAILED','AGENT_INVENTORY_INVALID','AGENT_INVENTORY_CONFLICT','AGENT_MARKETPLACE_SOURCE_MISMATCH','AGENT_MARKETPLACE_SOURCE_UNAVAILABLE','AGENT_SCOPE_UNOBSERVABLE']);
+/** Automatic current-user discovery only; `core` is the optional public protocol-1 Cordis service accessor. */
+export function createInstallationStatusReader({client='dsh',core=()=>undefined,workerNode,runCommand=runOfficialInstallationCommand,discoverReader=discoverOfficialReader}={}){
  if(!['dsh','hanamesh'].includes(client))throw new TypeError('client must be dsh or hanamesh');
- const settings=structuredClone(readers??{}),active=new Set();let closed=false;
+ const active=new Set();let closed=false;
  const suite=createCoreSuiteAdapter({core});
  async function runtime(signal){
   const row=base(client,'current-runtime','responding-runtime',client==='dsh'?'当前响应的 DSH runtime':'当前响应的 HanaMesh 客户端 runtime');
@@ -64,20 +65,20 @@ export function createInstallationStatusReader({client='dsh',core=()=>undefined,
   }catch(error){if(signal.aborted)throw interrupted();const code=['CORE_SUITE_DECLARATION_MISSING','CORE_SUITE_DECLARATION_INVALID'].includes(error.code)?error.code:'CORE_SUITE_READ_FAILED';return unknown(row,code,code==='CORE_SUITE_DECLARATION_MISSING'?'本 runtime 未提供 Core 套件声明方法。':'本次 Core 套件声明读取失败。','启用支持 protocol 1 getSuiteDeclaration 的 Core，查看其设置并重新检测。')}
  }
  async function agent(channel,signal){
-  const initial=agentBase(channel),config=settings[channel];
-  if(config===undefined)return unknown(initial,'AGENT_READER_NOT_CONFIGURED','尚未配置该渠道的官方只读清单读取器。','在 AppHost library.installationReaders 中配置官方命令、用户资料、登记目标与读取预算后重新检测。');
-  if(!validReader(config))return unknown(initial,'AGENT_READER_CONFIG_INVALID','官方读取器缺少有效的显式配置。','核对 library.installationReaders 的绝对路径、登记插件名/市场来源和必填读取预算。');
-  const row={...initial,identity:{pluginName:config.pluginName,marketplace:config.marketplace}};
-  const invoke=args=>abortable(runCommand({channel,reader:config,args,signal,workerNode}),signal);
+  const initial=agentBase(channel);let row=initial;
   try{
-   const version=(await invoke(['--version'])).trim();
-   if(version!==SUPPORTED_READER_VERSIONS[channel])return unknown(row,'AGENT_READER_VERSION_UNSUPPORTED','该官方 CLI 版本尚未验证此读取协议。','使用提供方正文列明的支持版本，或先核实新版本官方清单协议。');
+   const config=await abortable(discoverReader({channel,signal,workerNode}),signal);
+   if(!validReader(config))throw new AppHostError('AGENT_READER_DISCOVERY_INVALID','Invalid automatic reader.',{},503);
+   row={...initial,identity:{pluginName:config.pluginName,marketplace:config.marketplace}};
+   const invoke=args=>abortable(runCommand({channel,reader:config,args,signal,workerNode}),signal);
+   const versionFailure=readerVersionFailure(channel,await invoke(['--version']));
+   if(versionFailure)return unknown(row,versionFailure,versionFailure==='AGENT_READER_VERSION_INVALID'?'官方 CLI 版本输出格式无效。':'官方 CLI 低于支持的最低版本。','通过官方渠道升级 Claude Code 至 2.1.301 或以上、Codex CLI 至 0.162.1 或以上，再重新检测。');
    const suffix=channel==='codex'?['--disable','remote_plugin']:[];
    const text=await invoke(['plugin','list','--json',...suffix]);
    const sourceText=await invoke(['plugin','marketplace','list','--json',...suffix]);
    let plugins,marketplaces;try{plugins=JSON.parse(text);marketplaces=JSON.parse(sourceText)}catch{inventoryError()}
    return{...row,...parseInventory(channel,plugins,marketplaces,config)};
-  }catch(error){if(signal.aborted||error.code==='INSTALLATION_STATUS_CANCELLED')throw interrupted();const code=failureCodes.has(error.code)?error.code:'AGENT_READER_FAILED';return unknown(row,code,'本次官方清单读取未能提供完整且一致的安装事实。','在对应官方 CLI 的已配置用户资料中检查插件与市场清单、权限或诊断，修复后显式重检。')}
+  }catch(error){if(signal.aborted||error.code==='INSTALLATION_STATUS_CANCELLED')throw interrupted();const code=failureCodes.has(error.code)?error.code:'AGENT_READER_FAILED';const messages={AGENT_READER_UNAVAILABLE:'未在当前用户的 PATH 或常见安装位置找到官方 CLI。',AGENT_SHELL_ENV_UNAVAILABLE:'登录 shell 的 PATH 未能读取。',AGENT_PROFILE_UNAVAILABLE:'当前用户的官方资料目录不存在或不可访问。',AGENT_READER_TIMEOUT:'本次官方只读检测超时。',AGENT_INVENTORY_INVALID:'官方清单 JSON 不符合受支持的格式。',AGENT_READER_DISCOVERY_INVALID:'自动发现的官方 CLI 信息无效。',AGENT_READER_ENTRYPOINT_UNAVAILABLE:'已发现 Windows 命令入口，但官方 npm 程序文件缺失。'};return unknown(row,code,messages[code]??'本次官方清单读取未能提供完整且一致的安装事实。','在终端确认官方 CLI 可运行，并在其用户级插件页面检查清单、权限和市场来源后重新检测。')}
  }
  const read=async({signal}={})=>{
   if(closed||signal?.aborted)throw interrupted();const controller=new AbortController();active.add(controller);const combined=signal?AbortSignal.any([signal,controller.signal]):controller.signal;

package/dist/library/installation-worker.js

@@ -1,13 +1,52 @@
 /** Detached reaper: it outlives the caller and owns the neutral directory, outside the command group. */
-import {fork} from 'node:child_process';
-import {mkdtempSync,realpathSync,rmSync} from 'node:fs';
+import {fork,spawnSync} from 'node:child_process';
+import {mkdtempSync,realpathSync,rmSync,lstatSync} from 'node:fs';
 import {join} from 'node:path';
-let started=false,finishing=false,finalized=false,directory,anchor,anchorExited=false,payload;
-function finalize(){
+import {createWindowsJob} from '../windows-job.js';
+let started=false,finishing=false,finalized=false,directory,anchor,anchorExited=false,payload,windowsJob,jobStarting,jobController,stopping;
+function groupMetadata(){
+ const result=spawnSync('/bin/ps',['-axo','pid=,pgid=,uid=,stat='],{encoding:'utf8',stdio:['ignore','pipe','ignore']});
+ if(result.status!==0)throw new Error('Owned group metadata is unavailable.');
+ const rows=result.stdout.trim().split('\n').filter(Boolean).map(line=>{
+  const match=/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s*$/.exec(line);
+  if(!match)throw new Error('Owned group metadata is invalid.');
+  return{pid:Number(match[1]),pgid:Number(match[2]),uid:Number(match[3]),state:match[4]};
+ });
+ return rows.filter(row=>row.pgid===anchor.pid);
+}
+async function confirmOwnedGroupGone(){
+ if(process.platform==='win32'){if(stopping)await stopping;return}if(!anchor)return;
+ // Observe only the PGID created by this anchor, never send another termination
+ // signal after its PID could be reused. close(anchor) alone does not reap descendants.
+ const deadline=Date.now()+1000;const observed=new Set();
+ while(true){
+  try{process.kill(-anchor.pid,0)}catch(error){
+   if(error.code==='ESRCH')return;
+   if(error.code!=='EPERM')throw error;
+   // Darwin may return EPERM for an empty or zombie-only process group. Read
+   // metadata only (never argv/commands); a foreign UID or unknown state fails closed.
+   const members=groupMetadata();
+   if(members.some(row=>row.uid!==process.getuid()||!/^[-A-Za-z+<>]+$/.test(row.state)))throw error;
+   for(const row of members)observed.add(row.pid);
+   if(members.length===0){
+    let remaining=false;for(const pid of observed){try{process.kill(pid,0);remaining=true}catch(probe){if(probe.code!=='ESRCH')throw probe}}
+    if(!remaining)return;
+   }
+  }
+  if(Date.now()>=deadline)throw new Error('Owned command group did not finish reaping.');
+  await new Promise(resolve=>setTimeout(resolve,5));
+ }
+}
+async function finalize(){
  if(finalized)return;finalized=true;
+ let cleanupComplete=false;
  // Normal owned shutdown reaches here after the live group was killed and its anchor closed.
  // An external SIGKILL/native crash of an internal supervisor is outside automatic recovery.
- if(directory){try{rmSync(directory,{recursive:true,force:true})}catch{payload={error:'AGENT_READER_CLEANUP_FAILED'}}}
+ try{await confirmOwnedGroupGone();
+  if(directory){rmSync(directory,{recursive:true,force:true,maxRetries:4,retryDelay:25});try{lstatSync(directory);throw new Error('Owned neutral directory survived cleanup.')}catch(error){if(error.code!=='ENOENT')throw error}}
+  cleanupComplete=true;
+ }catch{payload={error:'AGENT_READER_CLEANUP_FAILED'}}
+ payload={...payload,cleanupComplete};
  let flushed=0;const complete=()=>{if(++flushed!==2)return;const exit=()=>process.exit(0);
   if(process.connected){try{process.send(payload,exit)}catch{exit()}}else exit();
  };
@@ -15,10 +54,23 @@ function finalize(){
 }
 function finish(value){
  if(finishing)return;finishing=true;payload=value;
- if(anchor&&!anchorExited){
-  // The IPC anchor deliberately stays alive after command completion. Kill only its still-owned group.
-  try{process.kill(-anchor.pid,'SIGKILL')}catch{payload={error:'AGENT_READER_FAILED'}}
- }else if(!anchor)finalize();
+ if(anchor&&(process.platform==='win32'||!anchorExited)){
+  // The anchor is not released until the entire exact command ownership has ended.
+  if(process.platform==='win32'){
+   stopping=(async()=>{
+    if(!windowsJob){jobController?.abort();try{await jobStarting}catch{};try{anchor.kill('SIGKILL')}catch(error){if(error.code!=='ESRCH')throw error}}
+    else await windowsJob.stop();
+   })();
+   stopping.catch(()=>{payload={error:'AGENT_READER_CLEANUP_FAILED'}});
+  }else try{process.kill(-anchor.pid,'SIGKILL')}catch{payload={error:'AGENT_READER_FAILED'}}
+ }else if(!anchor)void finalize();
+}
+async function commandResult(value){
+ if(finishing)return;
+ if(process.platform==='win32'&&!value.error){
+  try{while(!finishing){if(await windowsJob.active()<=1)break;await new Promise(resolve=>setTimeout(resolve,5));}if(finishing)return;}catch{finish({error:'AGENT_READER_FAILED'});return}
+ }
+ finish(value);
 }
 process.once('disconnect',()=>finish({error:'INSTALLATION_STATUS_CANCELLED'}));
 process.once('SIGTERM',()=>finish({error:'INSTALLATION_STATUS_CANCELLED'}));
@@ -27,18 +79,24 @@ process.once('uncaughtException',()=>finish({error:'AGENT_READER_FAILED'}));
 process.once('unhandledRejection',()=>finish({error:'AGENT_READER_FAILED'}));
 if(!process.connected)process.exit(1);
 process.on('message',request=>{
+ if(request.abort){finish({error:'INSTALLATION_STATUS_CANCELLED'});return}
  if(started)return;started=true;
  try{
   if(!process.connected){finish({error:'INSTALLATION_STATUS_CANCELLED'});return}
   directory=mkdtempSync(join(realpathSync(request.temporaryRoot),'hanamesh-installation-read-'));
   process.send({directory},error=>{if(error)finish({error:'INSTALLATION_STATUS_CANCELLED'})});
-  const env={...request.env,XDG_CONFIG_HOME:join(directory,'config'),XDG_CACHE_HOME:join(directory,'cache'),XDG_STATE_HOME:join(directory,'state'),TMPDIR:directory,TMP:directory,TEMP:directory};
-  anchor=fork(new URL('./installation-command-worker.js',import.meta.url),[],{cwd:directory,env,execArgv:[],detached:true,stdio:['ignore','pipe','pipe','ipc']});
+  const env={...request.env,TMPDIR:directory,TMP:directory,TEMP:directory};
+  anchor=fork(new URL('./installation-command-worker.js',import.meta.url),[],{cwd:directory,env,execArgv:[],detached:process.platform!=='win32',stdio:['ignore','pipe','pipe','ipc']});
   anchor.stdout.pipe(process.stdout,{end:false});anchor.stderr.pipe(process.stderr,{end:false});
-  anchor.on('message',value=>finish(value));
+  anchor.on('message',value=>{void commandResult(value)});
   anchor.once('exit',()=>{anchorExited=true});
   anchor.once('error',()=>{if(!finishing){finishing=true;payload={error:'AGENT_READER_UNAVAILABLE'}}});
-  anchor.once('close',()=>{if(!finishing){finishing=true;payload={error:'AGENT_READER_FAILED'}}finalize()});
-  anchor.send({executable:request.executable,args:request.args},error=>{if(error)finish({error:'AGENT_READER_UNAVAILABLE'})});
+  anchor.once('close',()=>{if(!finishing)finish({error:'AGENT_READER_FAILED'});void finalize()});
+  const launch=()=>{if(!finishing)anchor.send({executable:request.executable,args:request.args},error=>{if(error)finish({error:'AGENT_READER_UNAVAILABLE'})});};
+  if(process.platform==='win32'){
+   jobController=new AbortController();
+   jobStarting=createWindowsJob({pid:anchor.pid,env,cwd:request.temporaryRoot,signal:jobController.signal});
+   void jobStarting.then(job=>{windowsJob=job;if(!finishing)launch();},()=>finish({error:'AGENT_READER_UNAVAILABLE'}));
+  }else launch();
  }catch{finish({error:'AGENT_READER_UNAVAILABLE'})}
 });

package/dist/library/routes.js

@@ -1,4 +1,5 @@
 import { installationStatusCors, serveInstallationStatus } from './installation-status-http.js';
+import {serveInstallTargetProbe} from './install-target-http.js';
 import { randomUUID } from 'node:crypto';
 import { AppHostError, requireCondition } from '../errors.js';
 import { controlOrigins } from '../control-origin.js';
@@ -33,16 +34,7 @@ export function createLibraryHttpHandler(library,{parentOrigin,transportOrigin,a
       await serveInstallationStatus(req,res,{read:library.installationStatus,maxBodyBytes:HANDOFF_BODY_MAX_BYTES,traceId,cors,send});return;
     }
     if(path==='/hanamesh/library/install-target'){
-      // Match the website handoff policy; same-origin workspace and non-browser local reads remain available.
-      const origin=req.headers.origin;
-      if(origin!==undefined){
-        requireCondition(origin===requestOrigin||origins.acceptsOrigin(origin)||library.handoffSettings().allowedOrigins.includes(origin),'ORIGIN_DENIED','Not available.',undefined,403);
-        cors={'access-control-allow-origin':origin,vary:'Origin','access-control-allow-private-network':'true'};
-      }
-      if(req.method==='OPTIONS'){send(res,204,undefined,{...cors,'access-control-allow-methods':'GET'});return;}
-      requireCondition(req.method==='GET','METHOD_NOT_ALLOWED','Discovery requires GET.',{},405);
-      requireCondition(!url.search,'UNKNOWN_FIELDS','Discovery takes no parameters.');
-      send(res,200,{...library.installTarget(),traceId},cors);return;
+      serveInstallTargetProbe(req,res,{allowedOrigins:[requestOrigin,origins.parent,...library.handoffSettings().allowedOrigins],read:()=>library.installTarget(),traceId,send});return;
     }
     const readOnly=req.method==='GET'&&READ_ROUTES.has(path);
     requireCondition(readOnly||(req.method==='POST'&&!['/hanamesh/library/installedPlugins','/hanamesh/library/target','/hanamesh/library/handoffs'].includes(path)),'METHOD_NOT_ALLOWED','Unsupported library method.',{},405);

package/dist/node-runtime/service.js

@@ -19,7 +19,7 @@ const checkScript="console.log(JSON.stringify({version:process.versions.node,pla
 export async function probeStandaloneNode(binary,{platform,version,signal}={}){
  requireCondition(typeof binary==='string'&&isAbsolute(binary),'NODE_BINARY_INVALID','独立 Node 路径必须是绝对路径。');
  await access(binary,constants.X_OK);
- const {stdout}=await run(binary,['-e',checkScript],{env:{PATH:''},maxBuffer:4096,signal});
+ const {stdout}=await run(binary,['-e',checkScript],{env:{PATH:''},timeout:2_000,maxBuffer:4096,signal});
  let actual;try{actual=JSON.parse(stdout);}catch{throw new AppHostError('NODE_NOT_STANDALONE','所选文件没有返回独立 Node 的检查结果；Electron 包装脚本不能代替独立 Node。');}
  requireCondition(actual.electron===null&&/^24\./.test(actual.version)&&(Number(actual.version.split('.')[1])>13||Number(actual.version.split('.')[1])===13&&Number(actual.version.split('.')[2])>=1)&&(!version||actual.version===version)&&`${actual.platform}-${actual.arch}`===platform,'NODE_NOT_STANDALONE','需要当前平台的独立 Node.js 24（24.13.1 或更新）；所选文件的版本、平台或 Electron 检查未通过。');
  return actual;
@@ -47,8 +47,8 @@ export function createNodeRuntime({domain,dataRoot,config={},initialBinary,platf
   requireCondition(next.mode!=='external'||isAbsolute(next.externalBinary),'NODE_BINARY_INVALID','已有独立 Node 路径必须是绝对路径。');
   return {...next,sourceBase:source.href.replace(/\/$/,'')};
  }
- const externalCheck=()=>requireCondition(['darwin-arm64','darwin-x64','linux-arm64','linux-x64'].includes(platform),'NODE_PLATFORM_UNSUPPORTED','当前平台尚未完成独立 Node 的进程守护支持；Windows 不支持本安装流程。');
- const supportedCheck=()=>requireCondition(supported,'NODE_PLATFORM_UNSUPPORTED','一键准备当前仅支持 macOS 13.5 及以上的 arm64 / x64；Windows 安装与进程守护尚未接通。');
+ const externalCheck=()=>requireCondition(['darwin-arm64','darwin-x64','linux-arm64','linux-x64','win32-x64'].includes(platform),'NODE_PLATFORM_UNSUPPORTED','当前平台尚未完成已有独立 Node 的受控 CLI 支持。');
+ const supportedCheck=()=>requireCondition(supported,'NODE_PLATFORM_UNSUPPORTED','一键准备当前仅支持 macOS 13.5 及以上的 arm64 / x64；Windows 受管准备和 owned 应用守护尚未接通。');
  async function publish(next){const whole={...next,revision:state.revision+1};await domain.global.set(whole);state=whole;}
  function manifest(p){return {schema:1,sources:[{id:'confirmed-source',kind:'https',base:new URL(`v${p.version}/`,p.sourceBase+'/').href}],items:[{id:'node',version:p.version,kind:'tar.gz',installTo:'runtime',platforms:{[platform]:{asset:p.asset,sha256:p.sha256,size:p.bytes,strip:1}},verify:{exec:'bin/node',args:['-e',checkScript],expect:JSON.stringify({version:p.version,platform:'darwin',arch:platform.slice(7),electron:null})}}]};}
  async function verifyActive(active,signal,heldLock){
@@ -66,7 +66,7 @@ export function createNodeRuntime({domain,dataRoot,config={},initialBinary,platf
     else if(state.active){supportedCheck();executable=await verifyActive(state.active);}
    }catch(e){operation={id:null,state:'failed',phase:'restore',error:{message:'安装环境尚未就绪：'+causeText(e),code:e.code??'NODE_CHECK_FAILED'}};}
   },
-  status(){return copy({settings,names:NODE_SETTING_NAMES,versions:[...new Set(catalog.archives.map(a=>a.version))],platform,supported,ready:!!executable,executable:executable??null,active:state?.active??null,operation,limitations:'一键准备支持 macOS 13.5+ arm64 / x64；Windows 尚不支持。下载仅在确认后开始；不重试、不切换来源。'});},
+  status(){return copy({settings,names:NODE_SETTING_NAMES,versions:[...new Set(catalog.archives.map(a=>a.version))],platform,supported,ready:!!executable,executable:executable??null,active:state?.active??null,operation,limitations:'一键准备支持 macOS 13.5+ arm64 / x64；Windows x64 可使用已验证的已有独立 Node 运行受控 CLI，受管准备和 owned 应用守护仍不支持。下载仅在确认后开始；不重试、不切换来源。'});},
   async save(input){exact(input,['settings']);idle();const next=validate(input.settings);saving=true;plan=null;
    try{await safeAncestors(next.storageRoot);let external;
     if(next.mode==='external'){externalCheck();await probe(next.externalBinary,{platform});external=next.externalBinary;}

package/dist/router/sources.js

@@ -36,9 +36,12 @@ export function createProviderSources({ credentials, apps, llm = () => undefined
     if (!dshHome) return null;
     const path = join(dshHome,'.coding-oauth-gateway.json');
     let fileStat, value;
-    try { fileStat = await stat(path); value = JSON.parse(await readFile(path,'utf8')); } catch { return null; }
-    if ((fileStat.mode & 0o077) !== 0) return { id:'coding-oauth-gateway', source:'coding-oauth-gateway', kind:'api-key',
+    try { fileStat = await stat(path); } catch { return null; }
+    // Node mode bits cannot prove a private Windows ACL. Refuse file-mode
+    // secrets before reading them; the authenticated HTTP provider remains available.
+    if (process.platform === 'win32' || (fileStat.mode & 0o077) !== 0) return { id:'coding-oauth-gateway', source:'coding-oauth-gateway', kind:'api-key',
       displayName:'Coding OAuth Gateway', state:'unreachable' };
+    try { value = JSON.parse(await readFile(path,'utf8')); } catch { return null; }
     const base = { id:'coding-oauth-gateway', source:'coding-oauth-gateway', kind:'api-key', displayName:'Coding OAuth Gateway',
       ...(Array.isArray(value.models) ? { models:value.models } : {}), ...(value.keyHint ? { keyHint:value.keyHint } : {}) };
     if (!value.enabled) return { ...base, state:'gateway-off' };

package/dist/runtime.js

@@ -22,6 +22,16 @@ export async function resolveNodeBinary(nodeBinary) {
   }
   try { await access(selected, constants.X_OK); }
   catch { throw new AppHostError('NODE_RUNTIME_REQUIRED', 'nodeBinary must be an absolute executable path.'); }
+  if (process.platform === 'win32') {
+    // Windows X_OK only checks existence. Verify the selected native runtime
+    // with a fixed expression before it can become a guardian executable.
+    try {
+      const {stdout} = await exec(selected, ['-p', 'JSON.stringify({node:process.release.name,electron:process.versions.electron??null})'],
+        {timeout:2_000,maxBuffer:1024,windowsHide:true,env:guardianEnvironment(selected)});
+      const result=JSON.parse(stdout);
+      if(result.node!=='node'||result.electron!==null)throw new Error('Not a standalone Node executable.');
+    } catch { throw new AppHostError('NODE_RUNTIME_REQUIRED','nodeBinary must be a standalone executable Node.js runtime.'); }
+  }
   return selected;
 }
 export function guardianEnvironment(nodeBinary, source = process.env) {
@@ -30,7 +40,11 @@ export function guardianEnvironment(nodeBinary, source = process.env) {
     if (typeof source[key] === 'string' && source[key].length) env[key] = source[key];
   }
   if (!env.LANG) env.LANG = 'C.UTF-8';
-  env.PATH = `${dirname(nodeBinary)}:/usr/bin:/bin`;
+  if(process.platform==='win32') {
+    const systemRoot=source.SystemRoot??source.SYSTEMROOT??process.env.SystemRoot??process.env.SYSTEMROOT;
+    if(systemRoot)env.SystemRoot=systemRoot;
+    env.PATH=dirname(nodeBinary);
+  } else env.PATH = `${dirname(nodeBinary)}:/usr/bin:/bin`;
   return env;
 }
 export async function freePort() {

package/dist/store.js

@@ -1,6 +1,6 @@
 import { constants } from 'node:fs';
 import { mkdir, readFile, open, rename, unlink, lstat, realpath } from 'node:fs/promises';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve, parse, sep } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { AppHostError, SerialQueue, copy, requireCondition } from './errors.js';
 import { processIdentity } from './runtime.js';
@@ -42,8 +42,9 @@ export function validateSnapshot(s) {
 // Only use under an explicitly selected local profile root. Reject symlink components.
 export async function secureDirectory(path) {
   requireCondition(isAbsolute(path), 'INVALID_ROOT', 'An absolute data directory is required.');
-  const parts = resolve(path).split('/').filter(Boolean);
-  let current = '/';
+  const absolute = resolve(path), root = parse(absolute).root;
+  const parts = absolute.slice(root.length).split(sep).filter(Boolean);
+  let current = root;
   for (const part of parts) {
     current = join(current, part);
     await mkdir(current, { mode: 0o700 }).catch(e => { if (e.code !== 'EEXIST') throw e; });
@@ -218,8 +219,14 @@ export class AtomicFileStore {
         await this.checkpoint('snapshot-temp-fsynced', copy(image));
         await fd.close(); fd = undefined;
         await rename(temp, this.path); renamed = true;
-        const directory = await open(dirname(this.path), constants.O_RDONLY);
-        try { await directory.sync(); } finally { await directory.close(); }
+        // Node cannot open a directory for fsync on Windows. The completed
+        // file sync and same-directory rename still publish one whole image;
+        // only POSIX additionally synchronizes the directory entry. Do not
+        // reinterpret an arbitrary POSIX fsync failure as success.
+        if (process.platform !== 'win32') {
+          const directory = await open(dirname(this.path), constants.O_RDONLY);
+          try { await directory.sync(); } finally { await directory.close(); }
+        }
         await this.checkpoint('snapshot-published', copy(image));
       } catch (e) {
         // Post-rename failure is an ambiguous commit, not a guaranteed rollback.

package/dist/windows-job.js

@@ -0,0 +1,30 @@
+/** A Windows Job Object assigned before an IPC anchor is allowed to spawn commands. */
+import {spawn} from 'node:child_process';
+import {join} from 'node:path';
+import {fileURLToPath} from 'node:url';
+export function createWindowsJob({pid,env,cwd,signal}){
+ if(process.platform!=='win32'||!Number.isSafeInteger(pid)||pid<=1)throw new Error('A live Windows anchor PID is required.');
+ const command=join(env.SystemRoot??'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+ const child=spawn(command,['-NoLogo','-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',fileURLToPath(new URL('./windows-job.ps1',import.meta.url)),'-AnchorPid',String(pid)],{env,cwd,signal,windowsHide:true,stdio:['pipe','pipe','pipe']});
+ let pending='',fault,closed=false,readyResolve,readyReject,stopPromise;const requests=[];
+ const ready=new Promise((resolve,reject)=>{readyResolve=resolve;readyReject=reject});
+ const exit=new Promise(resolve=>child.once('close',()=>{closed=true;fail(new Error('Windows ownership helper closed.'));resolve()}));
+ function fail(error){fault??=error;readyReject(error);for(const request of requests.splice(0))request.reject(error);if(!child.stdin.destroyed)child.stdin.end()}
+ child.once('error',fail);child.stdin.on('error',fail);
+ child.stderr.on('data',()=>fail(new Error('Windows ownership helper failed.')));
+ child.stdout.on('data',chunk=>{
+  pending+=chunk.toString('utf8');if(pending.length>4096){fail(new Error('Invalid Windows job response.'));child.stdin.end();return}
+  const lines=pending.split(/\r?\n/);pending=lines.pop();
+  for(const line of lines){if(line==='READY'){readyResolve();continue}const request=requests.shift();
+   if(!request||!request.pattern.test(line)){fail(new Error('Invalid Windows job control response.'));child.stdin.end();return}request.resolve(line);
+  }
+ });
+ const send=(text,pattern)=>new Promise((resolve,reject)=>{
+  if(fault||closed){reject(fault??new Error('Windows ownership helper is closed.'));return}
+  requests.push({resolve,reject,pattern});child.stdin.write(text+'\n',error=>{if(error)fail(error)});
+ });
+ return ready.then(()=>({
+  active:async()=>Number((await send('ACTIVE',/^ACTIVE \d+$/)).slice(7)),
+  stop:()=>stopPromise??=(async()=>{try{await send('STOP',/^STOPPED$/)}finally{child.stdin.end();await exit}})(),
+ }),async error=>{child.stdin.end();await exit;throw error;});
+}

package/dist/windows-job.ps1

@@ -0,0 +1,75 @@
+param([Parameter(Mandatory=$true)][int]$AnchorPid)
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$PSModuleAutoLoadingPreference = 'None'
+Import-Module ($PSHOME+'\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1') -ErrorAction Stop
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Threading;
+public static class HanaMeshOwnedJob {
+  [StructLayout(LayoutKind.Sequential)] struct BasicLimits {
+    public long ProcessTime, JobTime;
+    public uint Flags;
+    public UIntPtr MinimumWorkingSet, MaximumWorkingSet;
+    public uint ActiveLimit;
+    public UIntPtr Affinity;
+    public uint PriorityClass, SchedulingClass;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct IoCounters {
+    public ulong ReadOperations, WriteOperations, OtherOperations, ReadBytes, WriteBytes, OtherBytes;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct ExtendedLimits {
+    public BasicLimits Basic;
+    public IoCounters Io;
+    public UIntPtr ProcessMemory, JobMemory, PeakProcessMemory, PeakJobMemory;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct Accounting {
+    public long UserTime, KernelTime, PeriodUserTime, PeriodKernelTime;
+    public uint PageFaults, TotalProcesses, ActiveProcesses, TerminatedProcesses;
+  }
+  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern IntPtr CreateJobObject(IntPtr attributes, string name);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool SetInformationJobObject(IntPtr job, int infoClass, ref ExtendedLimits info, uint length);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool QueryInformationJobObject(IntPtr job, int infoClass, out Accounting info, uint length, IntPtr returnedLength);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool TerminateJobObject(IntPtr job, uint exitCode);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  static Exception Failure(string operation) { return new InvalidOperationException(operation+":"+Marshal.GetLastWin32Error()); }
+  static uint Active(IntPtr job) {
+    Accounting info;
+    if(!QueryInformationJobObject(job, 1, out info, (uint)Marshal.SizeOf(typeof(Accounting)), IntPtr.Zero)) throw Failure("query-job");
+    return info.ActiveProcesses;
+  }
+  public static void Run(int pid) {
+    IntPtr job=CreateJobObject(IntPtr.Zero,null), process=IntPtr.Zero;
+    if(job==IntPtr.Zero) throw Failure("create-job");
+    try {
+      ExtendedLimits limits=new ExtendedLimits(); limits.Basic.Flags=0x2000; // JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+      if(!SetInformationJobObject(job,9,ref limits,(uint)Marshal.SizeOf(typeof(ExtendedLimits)))) throw Failure("limit-job");
+      process=OpenProcess(0x0101,false,pid); // PROCESS_SET_QUOTA | PROCESS_TERMINATE
+      if(process==IntPtr.Zero) throw Failure("open-anchor");
+      if(!AssignProcessToJobObject(job,process)) throw Failure("assign-anchor");
+      CloseHandle(process); process=IntPtr.Zero;
+      Console.WriteLine("READY"); Console.Out.Flush();
+      string line;
+      while((line=Console.ReadLine())!=null) {
+        if(line=="ACTIVE") { Console.WriteLine("ACTIVE "+Active(job)); Console.Out.Flush(); }
+        else if(line=="STOP") {
+          if(!TerminateJobObject(job,1)) throw Failure("terminate-job");
+          DateTime deadline=DateTime.UtcNow.AddSeconds(1);
+          while(Active(job)!=0) {
+            if(DateTime.UtcNow>=deadline) throw new InvalidOperationException("job-not-empty");
+            Thread.Sleep(5);
+          }
+          Console.WriteLine("STOPPED"); Console.Out.Flush(); return;
+        } else throw new InvalidOperationException("invalid-job-control");
+      }
+    } finally {
+      if(process!=IntPtr.Zero) CloseHandle(process);
+      CloseHandle(job); // EOF or any helper failure kills the entire assigned tree.
+    }
+  }
+}
+'@
+[HanaMeshOwnedJob]::Run($AnchorPid)

package/docs/CONTRACT.md

@@ -1,4 +1,4 @@
-0.6.7 adds the explicitly consented public installation-status capability on both existing library listeners. Full request/response, strict refusals, configured official-reader support and scope/lifecycle are defined in [INSTALLATION_STATUS.md](INSTALLATION_STATUS.md); it does not authorize installation or alter recording consent.
+0.6.7 adds the explicitly consented public installation-status capability on both existing library listeners. Full request/response, strict refusals, automatic official-reader discovery and minimum-version support and scope/lifecycle are defined in [INSTALLATION_STATUS.md](INSTALLATION_STATUS.md); it does not authorize installation or alter recording consent.
 
 # 公开契约 v1（候选，0.1.0-rc.41；rc.41 卸载 runtime 时清理生成的 Python 字节码缓存、未知残留仍 fail-closed；rc.40 市场只读查询待启动实例，ready 后一次 resume；前台即时 heartbeat 与失效帧显式清理；rc.39 Market seat 内打开应用时将原有应用帧固定铺满原生窗口并覆盖 Settings，同一回执/租约/关闭动作；rc.38 投射时仅提升 shell.overlay 层级以盖过原生 Settings；rc.35 市场开关按钮即时反馈、owned 应用已退出时提前结束 TERM 等待并确认精确进程组终止；rc.34 内置市场消费 heartbeat/视图清理；rc.33 owned 回收与启动握手分阶段限时；rc.32 客户端 `market` 席位与 dshmarket 互斥、壳内重启改走 postMessage 桥（见「市场席位」）；rc.28 HanaMesh 市场：插件与应用同路径装卸、已装含插件、可升级/需重启、`installedPlugins` 与 `plugins/*` 路由、`LIB-PROVISION-INPUT` 400（见「市场」）；rc.27 应用使用证据经 usage 插件 record 座位上报（见「应用使用证据」）；rc.26 应用库默认目录源 + 纯 DSH 位置推断（见「应用库配置」）；rc.15 目录条目校验补 updatedAt；rc.16 应用库默认 category=hanamesh-app、q/cursor 透传；rc.13/rc.14 与 rc.12 契约相同：rc.13 补许可证/repository/精确 peer，rc.14 去掉客户端对 hanameshCore 的读取）
 
@@ -222,7 +222,7 @@ Authenticated same-origin routes (normal workspace CSRF and connection cookie):
 
 Public install-target remains read-only and unchanged. Preparation never weakens authentication/CORS or guardian admission. Subsequent AppHost spawns, library CLI supervisors and installation readers capture the new standalone binding without restarting DSH. In-flight operations retain their delegate; settings/preparation reject while library/host operations are in use.
 
-Support implementation: macOS13.5+ arm64/x64, known Node24.13.1 or24.22.0 (default24.22.0). Windows is explicitly unsupported: POSIX-owned process supervision, cancellation and reader chain need separate implementation and real-host proof. No Windows ready claim. mac x64 native proof is tracked separately from its signed archive integrity. No client or upstream files change. No npm lifecycle download.
+Support implementation: macOS13.5+ arm64/x64, known Node24.13.1 or24.22.0 (default24.22.0). Windows managed Node preparation remains unsupported (`supported:false` describes managed preparation). Windows x64 accepts an explicitly selected existing standalone Node for controlled CLI and installation-reader operations only, after the fixed probe verifies actual Node 24 version, OS/architecture and absence of Electron; a verified external selection may report `ready:true`. Owned application launch remains unsupported and fails before spawn or credential projection. Automatic installation readers have a separate Windows discovery/owned-tree implementation; their native proof remains required. mac x64 native proof is tracked separately from its signed archive integrity. No client or upstream files change. No npm lifecycle download.
 
 Storage space budget is archive bytes + twice measured regular-file payload (new tree + staging); never delete another version or unknown files to make space. lib-provision alone owns staging/ledger/manifests; interrupted or cancelled downloads may leave its resumable owned cache. Another attempt requires a new visible confirmation. Existing versions remain until an explicit owned cleanup is designed; no automatic deletion or implied rollback. Offline startup verifies an existing active tree/ledger and standalone executable; failures are visible and never trigger a download.
 

package/docs/INSTALLATION_STATUS.md

@@ -48,35 +48,44 @@ interface InstallationObservation {
 }
 ```
 
-The five distinct observations are: responding runtime, the other DSH/HanaMesh runtime (always `unknown`, not observed by this responder), Claude Code configured user-level CLI scope, Codex CLI configured local-marketplace user scope, and Codex/ChatGPT desktop App scope (always named `unknown`). CLI labels explicitly exclude project/other isolated profiles and desktop App. A valid absence is absence **only in the named configured scope**; never show it as a machine-wide uninstall. Preserve every responder/scope; ports are not durable instance identities. Conflicts between responders are unknown, never resolved by choosing one installed result.
+The five distinct observations are: responding runtime, the other DSH/HanaMesh runtime (always `unknown`, not observed by this responder), Claude Code current-user CLI scope, Codex CLI current-user local-marketplace scope, and Codex/ChatGPT desktop App scope (always named `unknown`). CLI labels explicitly exclude project/other isolated profiles and desktop App. A valid absence is absence **only in the named current-user scope**; never show it as a machine-wide uninstall. Preserve every responder/scope; ports are not durable instance identities. Conflicts between responders are unknown, never resolved by choosing one installed result.
 
 Current runtime status/version/components come only from the optional public Core protocol `'1'` `getSuiteDeclaration()` **without an argument**, through the existing Core adapter. No registry request, health substitution, physical file-count completeness, version-range/peer/source algorithm or local upgrade selection is added. Complete maps to installed; incomplete stays incomplete; unknown stays unknown with top-level version null but known component versions and sanitized named blocked codes retained. Missing method, malformed declaration and read failure have distinct reasons. Each detection re-reads; Core removal/invalidation cannot reuse an old installed answer. Agent distribution version is independent of the DSH suite bundle version. Missing active fields remain absent.
 
-## Explicit agent reader settings
+## Automatic official CLI discovery
 
-`DshPluginConfig.library.installationReaders` may configure `claude` and/or `codex`. Each reader requires all these fields; **there are no inferred/default values**:
+AppHost 0.6.23 discovers Claude Code and Codex for the current OS user after the consented request. There is no manual reader setting; the former `library.installationReaders` option and public reader configuration type are removed. Browser requests cannot supply paths, commands, environment or profile selection. The registered suite identity is `hanamesh@hanamesh`, with the exact HTTPS source `https://github.com/yzsnstotz/hanamesh-plugins`, as in the existing suite catalog contract.
 
-| Field | Required value |
+Selection is deterministic: the first executable in the inherited absolute PATH directories wins; if absent on macOS/Linux, query the user's interactive login shell once (`-ilc`), extracting only the named infrastructure-path environment in a framed JSON value. This follows [VS Code's shell environment practice](https://code.visualstudio.com/docs/configure/command-line#_how-do-i-detect-when-a-shell-was-launched-by-vs-code). No full environment dump is collected. Like [VS Code's implementation](https://github.com/microsoft/vscode/blob/main/src/vs/platform/shell/node/shellEnv.ts), shell stderr is separate from success: exit/result and a valid framed payload decide success. Normal Bash non-TTY diagnostics are discarded, not treated as failure; both streams still count toward the existing byte budget. Plugin inventory commands retain their clean-stderr requirement. Shell startup noise and stderr never enter public output. Next search the fixed layouts below in listed order. Finally, scan the listed manager version directories in order, newest Node SemVer first within each directory. Relative/empty PATH segments are excluded. Do not run every candidate or switch to a second CLI when the selected command fails, is old or returns an invalid inventory. Executable names alone are not a signature guarantee; the fixed official version syntax and inventory schema are validated before returning facts.
+
+| Layout | Searched locations and source |
 |---|---|
-| executable | Absolute path to the person's official CLI executable |
-| home | Absolute explicitly selected user's home directory |
-| configDir | Absolute existing official config directory for that selected profile (`CLAUDE_CONFIG_DIR` or `CODEX_HOME`) |
-| pluginName / marketplace | Exact registered canonical AgentPluginDTO identity; not a guessed hanamesh@hanamesh |
-| marketplaceUrl | Exact registered `installation.marketplaceUrl`, canonical credential-free HTTPS, no query/fragment |
-| timeoutMs / maxOutputBytes | Required positive safe-integer read budgets; timeout at most Node's 2147483647 limit |
+| Official native / standalone | `~/.local/bin/claude[.exe]` ([Claude setup](https://code.claude.com/docs/en/setup#auto-updates)); native launcher symlinks resolve through normal OS execution. Codex `~/.local/bin/codex`, `CODEX_INSTALL_DIR`, Windows `%LOCALAPPDATA%/Programs/OpenAI/Codex/bin/codex.exe` ([official installer variables](https://learn.chatgpt.com/docs/config-file/environment-variables#installer-variables), [installation](https://learn.chatgpt.com/docs/cli)). Standalone release binaries in custom directories are found through inherited/login PATH or `CODEX_INSTALL_DIR`; unlinked archives are not guessed. |
+| Legacy Claude local | `~/.claude/local/claude`, `~/.claude/local/node_modules/.bin/claude`. These are historical npm-local layouts, not the current native default; [upstream issue with the original launcher path](https://github.com/anthropics/claude-code/issues/2824). No `.claude.json` or installMethod file is read. |
+| npm global | `npm_config_prefix` / `NPM_CONFIG_PREFIX` (`bin` on POSIX, prefix itself on Windows), `~/.npm-global/bin`, `~/.npm/bin`, `%APPDATA%/npm`, `%ProgramFiles%/nodejs`; system prefixes and active Node manager bins below. [npm folder rules](https://docs.npmjs.com/cli/v11/configuring-npm/folders/). No npmrc read or npm config command. |
+| pnpm global | `PNPM_HOME` and its `bin`, `~/.local/share/pnpm[/bin]`, `~/Library/pnpm[/bin]`, `%LOCALAPPDATA%/pnpm`. [pnpm setup](https://pnpm.io/cli/setup). Both earlier direct-bin and current bin-subdirectory layouts are recognized. |
+| Yarn Classic | `~/.yarn/bin`, `~/.config/yarn/global/node_modules/.bin`, custom prefix via PATH/login shell. [Yarn global](https://classic.yarnpkg.com/lang/en/docs/cli/global/). |
+| Volta / asdf / mise | `VOLTA_HOME/bin` or `~/.volta/bin`, `%LOCALAPPDATA%/Volta/bin`; `ASDF_DATA_DIR/shims` or `~/.asdf/shims`; `MISE_DATA_DIR/shims` or `~/.local/share/mise/shims`. [Volta](https://docs.volta.sh/guide/understanding), [asdf](https://asdf-vm.com/manage/configuration.html), [mise](https://mise.jdx.dev/directories.html). |
+| Homebrew / system | `/opt/homebrew/bin`, `/usr/local/bin`, `/home/linuxbrew/.linuxbrew/bin`, `/usr/bin`, `/bin`. [Homebrew prefixes](https://docs.brew.sh/Installation); [Claude Homebrew setup](https://code.claude.com/docs/en/setup), [Codex distribution](https://learn.chatgpt.com/docs/cli). Brew-linked native binaries use the same discovery path. |
+| nvm / fnm / installed manager versions | `NVM_BIN`, `NVM_SYMLINK`; `NVM_DIR/versions/node/*/bin` or `~/.nvm/versions/node/*/bin`; Windows `NVM_HOME/*`; `FNM_MULTISHELL_PATH`; `FNM_DIR/node-versions/*/installation[/bin]`, `~/.local/share/fnm/node-versions/*/installation/bin`, `~/Library/Application Support/fnm/node-versions/*/installation/bin`, `%APPDATA%/fnm/node-versions/*/installation`; asdf `installs/nodejs/*/bin`, mise `installs/node/*/bin`. Only SemVer directory names are scanned. [nvm](https://github.com/nvm-sh/nvm), [fnm](https://github.com/Schniz/fnm/blob/master/docs/commands.md), [asdf](https://asdf-vm.com/manage/configuration.html), [mise](https://mise.jdx.dev/directories.html). |
+| Windows native links / npm shims | `%LOCALAPPDATA%/Microsoft/WinGet/Links` ([Claude WinGet](https://code.claude.com/docs/en/setup)). `.exe` precedes `.cmd` per directory. A `.cmd` is never sent to a shell: resolve only the adjacent official npm `node_modules/@anthropic-ai/claude-code/cli.js` or `node_modules/@openai/codex/bin/codex.js`, run it with the verified standalone Node. Missing JS is a named failure, not a guessed shell command. |
+
+HOME is the host user's HOME/USERPROFILE. Honor existing `CLAUDE_CONFIG_DIR` / `CODEX_HOME` environment paths, otherwise use `~/.claude` / `~/.codex`. These directories must already exist; discovery never creates them, reads their contents, or reads credentials, sessions or private configuration files. Only official read commands observe plugin inventory. The named profile scope is not a machine-wide inventory. Electron hosts retain the existing verified standalone Node requirement.
 
-No website body can set these fields, executable arguments, environment or filesystem paths. No PATH/profile discovery or direct reading of private authentication/chat/config inventories is implemented. An absent/invalid reader is an actionable unknown, not “not installed”. Missing directories are not created. Windows readers are explicitly unsupported in this implementation; runtime Core reads still work. Electron hosts need the existing verified standalone `nodeBinary` for the process supervisor; absent Node is named unknown, not an Electron workaround.
+Named automatic read budgets are `INSTALLATION_READ_BUDGET.timeoutMs=2000` and `maxOutputBytes=20000`, retaining the existing installation-command fixtures' values without extending deadlines or adding retries. **待追认:** the former product configuration had required budgets but no defaults; adopting those existing fixture values for automatic product reads requires owner acknowledgement. They are code constants documented here, with no manual reader form.
 
-Exact verified protocols (other CLI versions return `AGENT_READER_VERSION_UNSUPPORTED`):
+Minimum CLI version and fixed syntax (no new upper bound):
 
-| Channel | Verified `--version` result | Fixed subsequent read argv |
+| Channel | Minimum version / accepted `--version` syntax | Fixed subsequent read argv |
 |---|---|---|
-| Claude Code | `2.1.301 (Claude Code)` | `plugin list --json`; `plugin marketplace list --json` |
-| Codex CLI | `codex-cli 0.162.1` | `plugin list --json --disable remote_plugin`; `plugin marketplace list --json --disable remote_plugin` |
+| Claude Code | `>=2.1.301`, `MAJOR.MINOR.PATCH (Claude Code)` | `plugin list --json`; `plugin marketplace list --json` |
+| Codex CLI | `>=0.162.1`, `codex-cli MAJOR.MINOR.PATCH` | `plugin list --json --disable remote_plugin`; `plugin marketplace list --json --disable remote_plugin` |
 
-The Codex flag was checked through this exact CLI's public `features list`; it excludes remote directory reads. A version match is necessary but not sufficient: both JSON shapes must validate. Claude uses the official installed array's `id`, user `scope`, enabled/version and load diagnostics. Other project-only target rows are unknown for this reader. Codex uses the official `installed` array and its qualified identity, installed/enabled/version. The exact target marketplace must match the registered HTTPS source in marketplace list; Codex's per-install `marketplaceSource` must also be present, supported and consistent. A local/different/unreadable source, duplicate/conflicting target or malformed/truncated/empty raw output is unknown. Only a complete valid clean inventory with no target in the configured scope is not-installed. A known install may have version null; consumers must show version unknown. Official load/payload issues produce incomplete, not successful readiness. No plugin MCP/hook definitions, unrelated inventory or CLI raw diagnostics are returned.
+Malformed version output is `AGENT_READER_VERSION_INVALID`; below-minimum versions are `AGENT_READER_VERSION_UNSUPPORTED`; JSON parse/shape failure is `AGENT_INVENTORY_INVALID`. New versions such as 2.1.319 / 0.167.0 must pass exactly the existing inventory validation.
 
-Commands run with an empty stdin in a disposable neutral cwd, only named HOME/config/platform paths, no inherited model/API keys, proxy/auth/askpass/Node preload, and disabled Git credential helpers. No model/install/upgrade/marketplace refresh command runs. A detached IPC reaper owns the neutral cwd outside a separate live command-group anchor. The anchor remains alive until output closes; abort, budget exhaustion, overflow, provider disposal or parent IPC disconnect makes the surviving reaper terminate only that live anchor's group. The reaper waits for group close before removing the cwd, so active writers cannot race deletion, including after caller death. No released PID/PGID or arbitrary process name is used. The caller also performs exact-path cleanup when alive. There is no retry or stale-result cache. Automatic recovery after an internal reaper/anchor itself is externally SIGKILLed or suffers a native crash is outside this lifecycle guarantee; an external intervention can leave command processes or temporary files and is never reported as an installed/absent inventory.
+The Codex flag was checked through this exact CLI's public `features list`; it excludes remote directory reads. Passing the version floor is necessary but not sufficient: both JSON shapes must validate. Claude uses the official installed array's `id`, user `scope`, enabled/version and load diagnostics. Other project-only target rows are unknown for this reader. Codex uses the official `installed` array and its qualified identity, installed/enabled/version. The exact target marketplace must match the registered HTTPS source in marketplace list; Codex's per-install `marketplaceSource` must also be present, supported and consistent. A local/different/unreadable source, duplicate/conflicting target or malformed/truncated/empty raw output is unknown. Only a complete valid clean inventory with no target in the observed user scope is not-installed. A known install may have version null; consumers must show version unknown. Official load/payload issues produce incomplete, not successful readiness. No plugin MCP/hook definitions, unrelated inventory or CLI raw diagnostics are returned.
+
+Commands run with an empty stdin in a disposable neutral cwd, only named HOME/config/platform paths, only the selected inherited/recovered absolute PATH plus allowlisted manager and standard XDG directory variables, no inherited model/API keys, proxy/auth/askpass/Node preload, and disabled Git credential helpers. The verified Node and selected executable directories prefix the selected PATH; retain its manager binary directories, so an official asdf shim can resolve `asdf`. Preserve existing XDG_CONFIG_HOME/CACHE_HOME/DATA_HOME/STATE_HOME/RUNTIME_DIR and CONFIG_DIRS/DATA_DIRS; absent variables stay absent and retain manager OS defaults. The supervisor never overwrites XDG paths with empty temporary directories. Only TMPDIR/TMP/TEMP and cwd use the owned disposable directory. Manager paths additionally include ASDF_CONFIG_FILE, MISE_CONFIG_DIR/GLOBAL_CONFIG_FILE/CACHE_DIR/STATE_DIR alongside the earlier manager-home keys; credentials, proxy, Node preloads and askpass remain excluded. Recovered shell manager/XDG paths follow the same allowlist; there is no fallback to a different installation. No model/install/upgrade/marketplace refresh command runs. On POSIX, a detached IPC reaper owns the neutral cwd outside a separate live command-group anchor. The anchor remains alive until output closes; abort, budget exhaustion, overflow, provider disposal or parent IPC disconnect makes the surviving reaper terminate only that live anchor's group. The reaper waits for group close before removing the cwd, so active writers cannot race deletion, including after caller death. No released PID/PGID or arbitrary process name is used. The caller also performs exact-path cleanup when alive. On Windows the same live anchor/reaper ownership uses the OS taskkill tree operation for its precise owned anchor; no process-name match or command-shell execution. Windows/Linux runtime evidence is separate from macOS fixture execution. There is no retry or stale-result cache. Automatic recovery after an internal reaper/anchor itself is externally SIGKILLed or suffers a native crash is outside this lifecycle guarantee; an external intervention can leave command processes or temporary files and is never reported as an installed/absent inventory.
 
 ## Refusals, unknown reasons, and lifecycle
 
@@ -86,7 +95,7 @@ Per-scope unknown reasons always include a safe code/message/action:
 
 - `CORE_SUITE_DECLARATION_MISSING`, `CORE_SUITE_DECLARATION_INVALID`, `CORE_SUITE_READ_FAILED`, `CORE_SUITE_DECLARATION_UNKNOWN`; incomplete: `CORE_SUITE_CURRENT_INCOMPLETE`, plus Core blocked codes.
 - `OTHER_RUNTIME_NOT_OBSERVED`, `CODEX_DESKTOP_SCOPE_UNOBSERVABLE`.
-- `AGENT_READER_NOT_CONFIGURED`, `AGENT_READER_CONFIG_INVALID`, `AGENT_READER_VERSION_UNSUPPORTED`, `AGENT_READER_PLATFORM_UNSUPPORTED`, `AGENT_READER_NODE_REQUIRED`.
+- `AGENT_READER_VERSION_INVALID`, `AGENT_READER_VERSION_UNSUPPORTED`, `AGENT_READER_NODE_REQUIRED`, `AGENT_SHELL_ENV_UNAVAILABLE`, `AGENT_READER_ENTRYPOINT_UNAVAILABLE`, `AGENT_READER_DISCOVERY_INVALID`.
 - `AGENT_PROFILE_UNAVAILABLE`, `AGENT_READER_UNAVAILABLE`, `AGENT_READER_PERMISSION_DENIED`, `AGENT_READER_TIMEOUT`, `AGENT_READER_OUTPUT_LIMIT`, `AGENT_READER_DIAGNOSTIC`, `AGENT_READER_CLEANUP_FAILED`, `AGENT_READER_FAILED`.
 - `AGENT_INVENTORY_INVALID`, `AGENT_INVENTORY_CONFLICT`, `AGENT_SCOPE_UNOBSERVABLE`, `AGENT_MARKETPLACE_SOURCE_UNAVAILABLE`, `AGENT_MARKETPLACE_SOURCE_MISMATCH`.
 - An installed record with unobserved version uses `AGENT_VERSION_UNAVAILABLE`; incomplete uses `AGENT_PLUGIN_LOAD_FAILED` / `AGENT_PLUGIN_PAYLOAD_MISSING`.
@@ -96,3 +105,5 @@ Start each explicit detection by clearing previous observations. Cancel fetch wh
 Official command references: [Claude Code plugin commands](https://code.claude.com/docs/en/plugins/cli-reference), [Codex CLI plugin reference](https://learn.chatgpt.com/docs/cli/reference). [OpenAI local plugin scope documentation](https://developers.openai.com/plugins/build/plugins) describes multiple client scopes; CLI installation is not used here as proof of the desktop App.
 
 For DSH/HanaMesh runtime observations, versionKind is suite-bundle and version is the installed @hanamesh/hanamesh version. Component rows retain their physical versions. Agent distribution observations retain their existing semantics.
+
+R115 regression fixtures execute real non-TTY Bash, asdf 0.20.2 official shim and mise 2026.11.4 with default/custom/shell-defined global XDG selection. Tool provenance, hashes and the explicit test-only binary inputs are in source `tests/fixtures/installation-managers/README.md`; binaries do not enter the npm package.