@jeffusion/tianshu 0.1.0 → 0.1.1

package/{dist/plugin/.codex-plugin → .codex-plugin}/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tianshu",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "author": {
     "name": "Jeffusion"
   },

package/{dist/plugin/.mcp.json → .mcp.json}

@@ -3,8 +3,9 @@
     "tianshu": {
       "command": "node",
       "args": [
-        "${PLUGIN_ROOT}/dist/server.mjs"
-      ]
+        "./dist/server.mjs"
+      ],
+      "cwd": "."
     }
   }
 }

package/README.md

@@ -5,7 +5,7 @@
 
 面向长期目标的智能协作工作台，以 Codex 本地插件交付。天枢将任务台账、执行聊天和验收证据连接起来，让跨聊天工作有持续的状态和明确的授权边界。
 
-**当前阶段：0.1.0，早期开发。** 已实现任务中心、MCP 工具和协调 Skill；完整自主规划、后台常驻执行和多客户端协作尚未实现。
+**当前阶段：0.1.1，早期开发。** 已实现任务中心、MCP 工具和协调 Skill；完整自主规划、后台常驻执行和多客户端协作尚未实现。
 
 ## 已实现
 
@@ -15,19 +15,25 @@
 - 删除任务保留独立验收归档；聊天空闲、回合结束和业务验收分别记录。
 - 明暗主题、只读浏览器预览、隔离测试与内容哈希构建标识。
 
-## npm 安装（正式渠道）
+## 安装
+
+发布物是 npm 包 `@jeffusion/tianshu`，由 Codex 原生插件机制下载和安装，无需全局安装天枢、克隆仓库或编译。
 
 ```sh
-npm install -g @jeffusion/tianshu
-tianshu install
-tianshu doctor
+codex plugin marketplace add jeffusion/tianshu
+codex plugin add tianshu@jeffusion
 ```
 
-命令安装后即可使用，无需克隆和构建源码；仍需本机 Node.js 24–26、Python 3.12+ 与 Codex CLI。npm 安装没有 postinstall 副作用，显式运行 install 才配置 Codex。安装后重开客户端、启用天枢并发送“@天枢 打开任务中心”。
+需要本机 Node.js 24–26、npm、Python 3.12+ 和支持 npm 插件源的 Codex。首次使用显式创建业务台账：
+
+```sh
+npx --yes @jeffusion/tianshu@0.1.1 init
+npx --yes @jeffusion/tianshu@0.1.1 doctor
+```
 
-已有台账使用 `tianshu install --config /absolute/path/to/config.json`，不会搬动或清空数据。升级命令、回滚与卸载见 [npm 分发说明](docs/npm-distribution.md)。安装标识 `tianshu@tianshu`，市场显示名“天枢”，Skill 为 `tianshu:coordinator`，MCP 服务名 `tianshu`。
+重开客户端、启用“天枢”，发送“@天枢 打开任务中心”。已有任务先按[配置说明](docs/configuration.md)接入既有台账；不要用另一份空库替代。市场标识 `jeffusion`，插件 `tianshu`，Skill `tianshu:coordinator`，MCP 服务名 `tianshu`。升级、卸载和版本发布见 [npm 分发说明](docs/npm-distribution.md)。
 
-源码克隆、npm ci、npm run demo 仅供开发测试。构建和测试不会更新当前 Codex 安装，也不会发布 npm 版本。
+源码安装只用于开发测试。构建和测试不会更新当前 Codex 安装，也不会自动发布 npm。
 
 ## 工作方式与边界
 
@@ -55,8 +61,9 @@ npm run check
 npm run build
 ```
 
-`check` 包含 TypeScript、生产构建、Node 协议测试、Python 台账测试和真实 npm 包生命周期测试，无需 API key、模型服务或业务数据库。构建产物位于 `dist/plugin` 和 `dist/marketplace`，`dist/build-info.json` 包含内容指纹。版本保持 `0.1.0`；本地测试不递增版本，不自动生成 ZIP、创建 release 或发布 npm。
+`check` 包含 TypeScript、生产构建、Node 协议测试、Python 台账测试和真实 npm tarball 回归，无需 API key、模型服务或业务数据库。可发布包位于 `dist/package`；插件清单、MCP、Skill 和运行产物直接位于包根目录。`build-info.json` 记录版本和内容指纹。
 
+本地测试不递增版本、不生成独立安装器。正式 npm 版本不可覆盖；本次 `0.1.1` 修正已发布 `0.1.0` 的安装结构。
 ## 工程结构
 
 | 目录 | 内容 |
@@ -66,7 +73,7 @@ npm run build
 | `src/contracts` | 产品元数据、任务和附件契约 |
 | `ledger` | 配置解析、只读投影、事务台账 |
 | `skills/coordinator` | 跨聊天协调规则与命令参考 |
-| `scripts` | 演示、开发、构建、本地同步 |
+| `scripts` | 演示、开发、构建、原生安装验收 |
 | `tests` | 独立 fixture 和回归测试 |
 
 参见[开发与验证](docs/development.md)、[贡献指南](CONTRIBUTING.md)、[安全说明](SECURITY.md)。私人配置、任务数据库、历史验收材料和安装产物不进入仓库。

package/{dist/plugin/THIRD_PARTY_NOTICES.txt → THIRD_PARTY_NOTICES.txt}

@@ -1731,7 +1731,7 @@ SOFTWARE.
     SOFTWARE
 
 
-===== @typescript/typescript-darwin-arm64@7.0.2 (Apache-2.0) =====
+===== @typescript/typescript-linux-x64@7.0.2 (Apache-2.0) =====
 
 
 --- LICENSE ---
@@ -3540,34 +3540,6 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
-===== fsevents@2.3.3 (MIT) =====
-
-
---- LICENSE ---
-MIT License
------------
-
-Copyright (C) 2010-2020 by Philipp Dunkel, Ben Noordhuis, Elan Shankar, Paul Miller
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-
 ===== function-bind@1.1.2 (MIT) =====
 
 
@@ -4452,7 +4424,7 @@ This Source Code Form is "Incompatible With Secondary Licenses", as
 defined by the Mozilla Public License, v. 2.0.
 
 
-===== lightningcss-darwin-arm64@1.33.0 (MPL-2.0) =====
+===== lightningcss-linux-x64-gnu@1.33.0 (MPL-2.0) =====
 
 
 --- LICENSE ---

package/build-info.json

@@ -0,0 +1,5 @@
+{
+  "name": "tianshu",
+  "version": "0.1.1",
+  "build_id": "e2f64d01ba77022f91e4"
+}

package/cli/main.mjs

@@ -1,193 +1,140 @@
-import {existsSync,readFileSync,writeFileSync,mkdirSync,cpSync,renameSync,rmSync,readdirSync,lstatSync,realpathSync} from 'node:fs';
-import {resolve,join,dirname,relative,isAbsolute} from 'node:path';
-import {homedir} from 'node:os';
-import {fileURLToPath} from 'node:url';
-import {execFileSync,spawn} from 'node:child_process';
-import {createHash,randomUUID} from 'node:crypto';
-import {probe} from './probe.mjs';
-const packageRoot=fileURLToPath(new URL('../',import.meta.url));
-const pkg=JSON.parse(readFileSync(join(packageRoot,'package.json'),'utf8'));
-const read=p=>JSON.parse(readFileSync(p,'utf8'));
-const print=value=>console.log(JSON.stringify(value,null,2));
-const help=`天枢 Tianshu ${pkg.version}\n\n  tianshu init                  初始化独立台账（已有配置不覆盖）\n  tianshu install               将已编译插件安装到 Codex\n  tianshu doctor                检查依赖、配置和已安装 MCP\n  tianshu upgrade               将当前 npm 包同步到插件，保留上一份\n  tianshu rollback              恢复上一份插件/未完成安装，保留台账\n  tianshu uninstall             移除 Codex 插件和市场，保留用户数据\n\n选项：--config <绝对路径>，--help，--version\n环境：TIANSHU_HOME、TIANSHU_PYTHON、TIANSHU_CODEX、CODEX_HOME\n安装 npm 包不会自动修改 Codex。需要 Node.js 24–26、Python 3.12+、Codex CLI。`;
+// cli/main.mjs
+import { existsSync, readFileSync, writeFileSync, mkdirSync, lstatSync } from "node:fs";
+import { join as join2, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileSync } from "node:child_process";
 
-function atomic(path,value){const temp=path+'.'+randomUUID()+'.tmp';writeFileSync(temp,JSON.stringify(value,null,2)+'\n',{mode:0o600,flag:'wx'});renameSync(temp,path);}
-function run(command,args,options={}){return execFileSync(command,args,{encoding:'utf8',timeout:30000,maxBuffer:4*1024*1024,stdio:['pipe','pipe','pipe'],env:{...process.env,PYTHONDONTWRITEBYTECODE:'1'},...options});}
-function canonical(path){const value=resolve(path);return existsSync(value)?realpathSync(value):value;}
-function defaultHome(){return process.platform==='darwin'?join(homedir(),'Library/Application Support/Tianshu'):join(process.env.XDG_DATA_HOME||join(homedir(),'.local/share'),'tianshu');}
-function environment(options){
-  const requestedHome=resolve(process.env.TIANSHU_HOME||defaultHome());
-  if(existsSync(requestedHome)&&lstatSync(requestedHome).isSymbolicLink())throw new Error('TIANSHU_HOME must not be a symbolic link');
-  const home=canonical(requestedHome);
-  const codexHome=canonical(process.env.CODEX_HOME||join(homedir(),'.codex'));
-  const context={home,codexHome,codex:process.env.TIANSHU_CODEX||'codex',python:process.env.TIANSHU_PYTHON||'python3',statePath:join(home,'installation.json'),journal:join(home,'operation.json'),market:join(home,'marketplace'),active:join(home,'marketplace/plugins/tianshu')};
-  if(existsSync(home)&&lstatSync(home).isSymbolicLink())throw new Error('TIANSHU_HOME must not be a symbolic link');
-  const state=existsSync(context.statePath)?read(context.statePath):null;
-  if(state&&(state.schema!==1||state.codex_home!==codexHome))throw new Error('Installation state belongs to a different CODEX_HOME or unsupported schema');
-  context.state=state;
-  const selected=options.config||process.env.TIANSHU_CONFIG||state?.config||join(home,'config.json');
-  if(!isAbsolute(selected))throw new Error('Config path must be absolute');
-  context.config=selected;context.explicitConfig=Boolean(options.config||process.env.TIANSHU_CONFIG);
-  return context;
+// cli/probe.mjs
+import { spawn } from "node:child_process";
+function probe(server, python, config) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [server], { env: { ...process.env, TIANSHU_PYTHON: python, TIANSHU_CONFIG: config, PYTHONDONTWRITEBYTECODE: "1" }, stdio: ["pipe", "pipe", "pipe"] });
+    let buffer = "", bytes = 0, finished = false;
+    const timer = setTimeout(() => finish(new Error("MCP health check timed out")), 12e3);
+    function finish(error, value) {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      child.kill();
+      const force = setTimeout(() => child.kill("SIGKILL"), 1e3);
+      force.unref();
+      child.once("close", () => clearTimeout(force));
+      error ? reject(error) : resolve(value);
+    }
+    const send = (value) => child.stdin.write(JSON.stringify(value) + "\n");
+    child.on("error", (error) => finish(error));
+    child.on("exit", () => {
+      if (!finished) finish(new Error("MCP server exited before health check completed"));
+    });
+    child.stdin.on("error", (error) => finish(error));
+    child.stderr.resume();
+    child.stdout.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > 4 * 1024 * 1024) return finish(new Error("MCP response exceeds health check limit"));
+      buffer += chunk.toString();
+      let newline;
+      while ((newline = buffer.indexOf("\n")) >= 0) {
+        const line = buffer.slice(0, newline);
+        buffer = buffer.slice(newline + 1);
+        if (!line.trim()) continue;
+        try {
+          const response = JSON.parse(line);
+          if (response.error) throw new Error("MCP health request rejected");
+          if (response.id === 1) {
+            if (response.result?.serverInfo?.name !== "tianshu") throw new Error("Unexpected MCP server identity");
+            send({ jsonrpc: "2.0", method: "notifications/initialized" });
+            send({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
+          } else if (response.id === 2) {
+            const tools = (response.result?.tools || []).map((t) => t.name).sort();
+            if (JSON.stringify(tools) !== JSON.stringify(["delete_task", "get_task", "list_tasks", "open_workspace"])) throw new Error("Unexpected MCP tool inventory");
+            send({ jsonrpc: "2.0", id: 3, method: "tools/call", params: { name: "list_tasks", arguments: {} } });
+          } else if (response.id === 3) {
+            const data = response.result?.structuredContent;
+            if (response.result?.isError || !data?.readonly || !data.sources?.length || data.sources.some((s) => !s.ok)) throw new Error("Configured ledger is not healthy/readable");
+            finish(null, { build: data.build, task_count: data.tasks.length, tools: 4 });
+          }
+        } catch (error) {
+          finish(error);
+        }
+      }
+    });
+    send({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2025-03-26", capabilities: {}, clientInfo: { name: "tianshu-doctor", version: "1" } } });
+  });
 }
-function owned(c,path){
-  const rel=relative(c.home,path);if(!rel||rel.startsWith('..')||isAbsolute(rel))throw new Error('Refusing operation outside managed home');
-  let current=c.home;
-  for(const part of rel.split(/[\\/]/)){current=join(current,part);if(existsSync(current)&&lstatSync(current).isSymbolicLink())throw new Error('Managed path must not contain symbolic links');}
+
+// src/contracts/config-path.mjs
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+function dataHome() {
+  return process.env.TIANSHU_HOME || (process.platform === "darwin" ? join(homedir(), "Library/Application Support/Tianshu") : join(process.env.XDG_DATA_HOME || join(homedir(), ".local/share"), "tianshu"));
+}
+function configPath(explicit) {
+  const path = explicit || process.env.TIANSHU_CONFIG || join(dataHome(), "config.json");
+  if (!isAbsolute(path)) throw new Error("Config path must be absolute");
   return path;
 }
-function stateWrite(c,state){owned(c,c.statePath);if(state)atomic(c.statePath,state);else rmSync(c.statePath,{force:true});}
-function preflight(c,needCodex=true){
-  if(process.platform==='win32')throw new Error('This release supports macOS/Linux; Windows installation is not validated');
-  const node=Number(process.versions.node.split('.')[0]);if(node<24||node>26)throw new Error('Node.js 24–26 is required');
-  const python=JSON.parse(run(c.python,['-c','import sys,json;print(json.dumps({"version":list(sys.version_info[:2]),"path":sys.executable}))']));
-  if(python.version[0]!==3||python.version[1]<12)throw new Error('Python 3.12+ is required');c.python=python.path;
-  if(needCodex)run(c.codex,['--version'],{env:{...process.env,CODEX_HOME:c.codexHome}});
+
+// cli/main.mjs
+var packageRoot = fileURLToPath(new URL("../", import.meta.url));
+var pkg = JSON.parse(readFileSync(join2(packageRoot, "package.json"), "utf8"));
+var print = (value) => console.log(JSON.stringify(value, null, 2));
+var help = `\u5929\u67A2 Tianshu ${pkg.version}
+
+  tianshu init     \u521D\u59CB\u5316\u72EC\u7ACB\u53F0\u8D26\uFF1B\u5DF2\u6709\u914D\u7F6E\u53EA\u6821\u9A8C\uFF0C\u4E0D\u8986\u76D6
+  tianshu doctor   \u68C0\u67E5\u672C\u5305\u4F9D\u8D56\u3001\u914D\u7F6E\u548C\u53EA\u8BFB MCP \u67E5\u8BE2
+
+\u9009\u9879\uFF1A--config <\u7EDD\u5BF9\u8DEF\u5F84>\uFF0C--help\uFF0C--version
+\u73AF\u5883\uFF1ATIANSHU_CONFIG\u3001TIANSHU_HOME\u3001TIANSHU_PYTHON
+\u63D2\u4EF6\u5B89\u88C5\u548C\u5378\u8F7D\u8BF7\u4F7F\u7528 Codex \u539F\u751F\u547D\u4EE4\uFF1B\u672C\u547D\u4EE4\u4E0D\u7BA1\u7406\u63D2\u4EF6\u3002`;
+function run(python, args) {
+  return execFileSync(python, args, { encoding: "utf8", timeout: 3e4, maxBuffer: 4 * 1024 * 1024, env: { ...process.env, PYTHONDONTWRITEBYTECODE: "1" } });
 }
-function codex(c,args){return JSON.parse(run(c.codex,args,{env:{...process.env,CODEX_HOME:c.codexHome}}));}
-function registeredMarket(c){const result=codex(c,['plugin','marketplace','list','--json']);const list=Array.isArray(result)?result:result.marketplaces;if(!Array.isArray(list))throw new Error('Unsupported Codex marketplace listing');return list.find(m=>m.name==='tianshu')||null;}
-function register(c,path){
-  if(registeredMarket(c))codex(c,['plugin','marketplace','remove','tianshu','--json']);
-  codex(c,['plugin','marketplace','add',path,'--json']);
-  const result=codex(c,['plugin','add','tianshu@tianshu','--json']);
-  return result.installedPath;
+function pythonRuntime() {
+  const node = Number(process.versions.node.split(".")[0]);
+  if (node < 24 || node > 26) throw new Error("Node.js 24\u201326 is required");
+  const executable = process.env.TIANSHU_PYTHON || "python3";
+  const info = JSON.parse(run(executable, ["-c", 'import sys,json;print(json.dumps({"version":list(sys.version_info[:2]),"path":sys.executable}))']));
+  if (info.version[0] !== 3 || info.version[1] < 12) throw new Error("Python 3.12+ is required");
+  return info.path;
 }
-function verifyBundle(plugin,manifest){
-  if(lstatSync(plugin).isSymbolicLink())throw new Error('Plugin root must not be a symlink');
-  const actual=[];
-  function walk(dir){for(const e of readdirSync(dir,{withFileTypes:true})){const p=join(dir,e.name);if(e.isSymbolicLink())throw new Error('Plugin payload contains symlinks');if(e.isDirectory())walk(p);else if(e.isFile())actual.push(relative(plugin,p).split('\\').join('/'));else throw new Error('Unsupported payload entry');}}
-  walk(plugin);const expected=Object.keys(manifest.files||{}).sort();
-  if(!expected.length||JSON.stringify(actual.sort())!==JSON.stringify(expected))throw new Error('Plugin payload inventory mismatch');
-  for(const path of expected){if(isAbsolute(path)||path.split(/[\\/]/).includes('..'))throw new Error('Invalid integrity path');const hash=createHash('sha256').update(readFileSync(join(plugin,path))).digest('hex');if(hash!==manifest.files[path])throw new Error('Plugin integrity check failed: '+path);}
-  const info=read(join(plugin,'build-info.json'));
-  if(info.name!=='tianshu'||!/^[0-9a-f]{20}$/.test(info.build_id)||!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(info.version))throw new Error('Invalid plugin identity');
-  return info;
+function validate(python, config) {
+  const result = JSON.parse(run(python, [join2(packageRoot, "ledger/read_ledger.py"), "--config", config]));
+  if (!result.sources?.length || result.sources.some((s) => !s.ok)) throw new Error("Configured ledger is missing or unhealthy; no replacement database was created");
 }
-function archive(c){
-  const source=join(packageRoot,'dist/plugin'),integrity=read(join(packageRoot,'dist/build-info.json'));
-  const info=verifyBundle(source,integrity),id=info.version+'-'+info.build_id;
-  const directory=owned(c,join(c.home,'releases',id));mkdirSync(owned(c,join(c.home,'releases')),{recursive:true,mode:0o700});
-  if(!existsSync(directory)){
-    const stage=owned(c,join(c.home,'releases','.stage-'+randomUUID()));mkdirSync(stage,{mode:0o700});
-    try{cpSync(source,join(stage,'plugin'),{recursive:true});atomic(join(stage,'integrity.json'),integrity);renameSync(stage,directory);}finally{rmSync(stage,{recursive:true,force:true});}
+async function main(argv = process.argv.slice(2)) {
+  if (!argv.length || argv.includes("--help")) return console.log(help);
+  if (argv.length === 1 && argv[0] === "--version") return console.log(pkg.version);
+  const [command, ...args] = argv;
+  if (!["init", "doctor"].includes(command)) throw new Error("Unsupported command. Use Codex native plugin commands for installation and removal.");
+  let explicit;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--config" && args[i + 1] && !explicit) explicit = args[++i];
+    else throw new Error("Unknown option: " + args[i]);
   }
-  if(JSON.stringify(read(join(directory,'integrity.json')).files)!==JSON.stringify(integrity.files))throw new Error('Build identity collision; existing release was preserved');
-  verifyBundle(owned(c,join(directory,'plugin')),read(owned(c,join(directory,'integrity.json'))));
-  return {id,directory,info};
-}
-function previousRelease(c,id){
-  if(!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?-[0-9a-f]{20}$/.test(id||''))throw new Error('No previous managed plugin is available');
-  const directory=owned(c,join(c.home,'releases',id)),info=verifyBundle(owned(c,join(directory,'plugin')),read(owned(c,join(directory,'integrity.json'))));
-  return {id,directory,info};
-}
-function validateConfig(c){
-  const result=JSON.parse(run(c.python,[join(packageRoot,'dist/plugin/ledger/read_ledger.py'),'--config',c.config]));
-  if(!result.sources?.length||result.sources.some(s=>!s.ok))throw new Error('Configured ledger is missing or unhealthy; no replacement database was created');
-  return result;
-}
-function initialize(c){
-  if(existsSync(c.config)){validateConfig(c);return false;}
-  if(c.explicitConfig)throw new Error('Explicit config does not exist; configure an existing ledger or run init without --config');
-  const data=owned(c,join(c.home,'data'));mkdirSync(data,{recursive:true,mode:0o700});
-  const db=owned(c,join(data,'coordinator.db'));
-  if(!existsSync(db))run(c.python,[join(packageRoot,'dist/plugin/ledger/coordinator.py'),'--db',db,'init']);
-  const temp=owned(c,join(c.home,'.config-'+randomUUID()+'.json'));
-  const config={sources:[{id:'daily',label:'日常任务',path:db}]};
-  try{atomic(temp,config);const candidate={...c,config:temp};validateConfig(candidate);writeFileSync(owned(c,c.config),JSON.stringify(config,null,2)+'\n',{flag:'wx',mode:0o600});}finally{rmSync(temp,{force:true});}
-  return true;
-}
-function marketplaceFile(c){
-  mkdirSync(owned(c,join(c.market,'.agents/plugins')),{recursive:true,mode:0o700});
-  atomic(join(c.market,'.agents/plugins/marketplace.json'),{name:'tianshu',interface:{displayName:'天枢'},plugins:[{name:'tianshu',source:{source:'local',path:'./plugins/tianshu'},policy:{installation:'AVAILABLE',authentication:'ON_INSTALL'},category:'Productivity'}]});
-}
-async function recover(c){
-  const journal=read(owned(c,c.journal));
-  if(journal.codex_home!==c.codexHome||!/^\.backup-[0-9a-f-]+$/.test(journal.backup))throw new Error('Invalid recovery record');
-  const backup=owned(c,join(c.home,journal.backup));
-  if(existsSync(backup)){rmSync(owned(c,c.active),{recursive:true,force:true});mkdirSync(dirname(c.active),{recursive:true});renameSync(backup,c.active);}
-  else if(!journal.had_active)rmSync(owned(c,c.active),{recursive:true,force:true});
-  if(journal.before_market){register(c,journal.before_market);}
-  else{codex(c,['plugin','remove','tianshu@tianshu','--json']);if(registeredMarket(c))codex(c,['plugin','marketplace','remove','tianshu','--json']);}
-  stateWrite(c,journal.before_state);rmSync(c.journal);return {recovered:true,data_preserved:true};
-}
-async function install(c,release){
-  const beforeMarket=registeredMarket(c);
-  if(beforeMarket&&canonical(beforeMarket.root)!==canonical(c.market)&&!c.explicitConfig&&!c.state)throw new Error('An existing Tianshu installation was found. Use --config with its existing configuration to preserve tasks.');
-  initialize(c);validateConfig(c);
-  const stage=owned(c,join(c.home,'.stage-'+randomUUID())),backup='.backup-'+randomUUID(),backupPath=owned(c,join(c.home,backup));
-  mkdirSync(stage,{mode:0o700});
-  try{
-    cpSync(join(release.directory,'plugin'),stage,{recursive:true});
-    atomic(join(stage,'runtime-config.json'),{config_path:c.config});
-    const cache=join(c.codexHome,'plugins/cache/tianshu/tianshu',release.info.version);
-    atomic(join(stage,'.mcp.json'),{mcpServers:{tianshu:{command:process.execPath,args:[join(cache,'dist/server.mjs')],env:{TIANSHU_PYTHON:c.python,TIANSHU_CONFIG:c.config,PYTHONDONTWRITEBYTECODE:'1'}}}});
-    await probe(join(stage,'dist/server.mjs'),c.python,c.config);
-    const journal={codex_home:c.codexHome,backup,had_active:existsSync(c.active),before_state:c.state,before_market:beforeMarket?.root||null};
-    atomic(owned(c,c.journal),journal);
-    try{
-      mkdirSync(owned(c,dirname(c.active)),{recursive:true,mode:0o700});
-      if(journal.had_active)renameSync(c.active,backupPath);renameSync(stage,c.active);marketplaceFile(c);
-      const installed=register(c,c.market);if(!installed||canonical(installed)!==canonical(cache))throw new Error('Unexpected Codex installed path: '+installed);
-      const health=await probe(join(cache,'dist/server.mjs'),c.python,c.config);
-      if(health.build?.build_id!==release.info.build_id)throw new Error('Installed build does not match requested build');
-      const previous=c.state?.active===release.id?c.state.previous:c.state?.active||null;
-      stateWrite(c,{schema:1,codex_home:c.codexHome,active:release.id,previous,config:c.config,installed:true,installed_at:new Date().toISOString(),adopted_marketplace:c.state?.adopted_marketplace||(beforeMarket?.root!==c.market?beforeMarket?.root:null)});
-      rmSync(c.journal);rmSync(backupPath,{recursive:true,force:true});
-      return {installed:true,plugin:'tianshu@tianshu',...release.info,health,data_preserved:true,reload_client:true};
-    }catch(error){
-      try{await recover(c);}catch{throw new Error('Install failed and recovery is incomplete. Run tianshu rollback after checking Codex availability; user data was preserved.');}
-      throw new Error('Install failed; previous plugin restored: '+error.message);
-    }
-  }finally{rmSync(stage,{recursive:true,force:true});}
-}
-async function lock(c){
-  mkdirSync(c.home,{recursive:true,mode:0o700});const path=owned(c,join(c.home,'lifecycle.lock'));
-  // Kernel flock is released on exit/crash. Never unlink the stable lock inode.
-  const code='import os,sys,fcntl; fd=os.open(sys.argv[1],os.O_CREAT|os.O_RDWR|os.O_NOFOLLOW,0o600); fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB); print("LOCKED",flush=True); sys.stdin.buffer.read()';
-  const child=spawn(c.python,['-c',code,path],{stdio:['pipe','pipe','pipe']});child.stderr.resume();
-  await new Promise((resolve,reject)=>{
-    const timer=setTimeout(()=>{child.kill();reject(new Error('Lifecycle lock timed out'));},5000);
-    child.once('error',error=>{clearTimeout(timer);reject(error);});
-    child.stdout.once('data',data=>{clearTimeout(timer);data.toString().trim()==='LOCKED'?resolve():reject(new Error('Lifecycle lock failed'));});
-    child.once('exit',()=>{clearTimeout(timer);reject(new Error('Another lifecycle operation is running or lock acquisition failed'));});
-  });
-  return ()=>new Promise(resolve=>{const timer=setTimeout(()=>child.kill('SIGKILL'),1000);child.once('close',()=>{clearTimeout(timer);resolve();});child.stdin.end();});
-}
-
-export async function main(argv=process.argv.slice(2)){
-  if(!argv.length||argv.includes('--help'))return console.log(help);
-  if(argv.length===1&&argv[0]==='--version')return console.log(pkg.version);
-  const command=argv.shift(),options={};
-  for(let i=0;i<argv.length;i++){if(argv[i]==='--config'&&argv[i+1])options.config=argv[++i];else throw new Error('Unknown option: '+argv[i]);}
-  if(!['init','install','upgrade','rollback','uninstall','doctor'].includes(command))throw new Error('Unknown command: '+command);
-  const c=environment(options);preflight(c,command!=='init');
-  if(command==='doctor'){
-    if(existsSync(c.journal))throw new Error('An interrupted lifecycle operation requires tianshu rollback');
-    if(!c.state?.installed)throw new Error('Plugin is not installed by this CLI; run tianshu install');
-    validateConfig(c);const release=previousRelease(c,c.state.active),cache=join(c.codexHome,'plugins/cache/tianshu/tianshu',release.info.version);
-    const market=registeredMarket(c);if(!market||canonical(market.root)!==canonical(c.market))throw new Error('Codex marketplace does not match this installation');
-    const health=await probe(join(cache,'dist/server.mjs'),c.python,c.config);if(health.build?.build_id!==release.info.build_id)throw new Error('Installed build drift detected');
-    return print({ok:true,home:c.home,config:c.config,health,host_ui_verified:false});
+  const python = pythonRuntime(), config = configPath(explicit);
+  if (command === "doctor") {
+    validate(python, config);
+    const health = await probe(join2(packageRoot, "dist/server.mjs"), python, config);
+    return print({ ok: true, config, health, scope: "this_package", host_ui_verified: false });
   }
-  if(command==='install')mkdirSync(c.codexHome,{recursive:true,mode:0o700});
-  const unlock=await lock(c);
-  try{
-    // Re-read mutable installation state only after acquiring the lifecycle lock.
-    const python=c.python;Object.assign(c,environment(options),{python});
-    if(existsSync(c.journal)){if(command!=='rollback')throw new Error('An interrupted operation requires tianshu rollback');return print(await recover(c));}
-    if(command==='init'){initialize(c);return print({initialized:true,config:c.config});}
-    if(command==='uninstall'){
-      const market=registeredMarket(c);if(market&&canonical(market.root)!==canonical(c.market))throw new Error('Refusing to remove an installation managed elsewhere');
-      if(market&&!c.state?.installed)throw new Error('Managed installation state is missing or inconsistent; reinstall before uninstalling');
-      if(c.state?.installed){
-        atomic(owned(c,c.journal),{codex_home:c.codexHome,backup:'.backup-'+randomUUID(),had_active:existsSync(c.active),before_state:c.state,before_market:market?.root||null});
-        try{codex(c,['plugin','remove','tianshu@tianshu','--json']);if(market)codex(c,['plugin','marketplace','remove','tianshu','--json']);stateWrite(c,{...c.state,installed:false});rmSync(c.journal);}
-        catch(error){try{await recover(c);}catch{throw new Error('Uninstall recovery is incomplete; run tianshu rollback. User data was preserved.');}throw new Error('Uninstall failed; previous plugin restored: '+error.message);}
-      }
-      return print({uninstalled:true,data_preserved:true,home:c.home});
-    }
-    if(command==='upgrade'&&!c.state?.installed)throw new Error('No managed installation; run tianshu install first');
-    const release=command==='rollback'?previousRelease(c,c.state?.previous):archive(c);
-    return print(await install(c,release));
-  }finally{await unlock();}
+  if (existsSync(config)) {
+    validate(python, config);
+    return print({ initialized: false, config, data_preserved: true });
+  }
+  if (explicit || process.env.TIANSHU_CONFIG) throw new Error("Explicit config does not exist; init never creates a replacement for a specified configuration");
+  const directory = dirname(config);
+  if (existsSync(directory) && lstatSync(directory).isSymbolicLink()) throw new Error("Data home must not be a symbolic link");
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  const data = join2(directory, "data");
+  if (existsSync(data) && lstatSync(data).isSymbolicLink()) throw new Error("Data directory must not be a symbolic link");
+  mkdirSync(data, { recursive: true, mode: 448 });
+  const db = join2(data, "coordinator.db");
+  if (!existsSync(db)) run(python, [join2(packageRoot, "ledger/coordinator.py"), "--db", db, "init"]);
+  const value = { sources: [{ id: "daily", label: "\u65E5\u5E38\u4EFB\u52A1", path: db }] };
+  run(python, ["-c", 'import sys;sys.path.insert(0,sys.argv[1]);from read_ledger import read_source;read_source({"id":"daily","label":"\u65E5\u5E38\u4EFB\u52A1","path":sys.argv[2]})', join2(packageRoot, "ledger"), db]);
+  writeFileSync(config, JSON.stringify(value, null, 2) + "\n", { flag: "wx", mode: 384 });
+  return print({ initialized: true, config, data_preserved: true });
 }
+export {
+  main
+};