@kg-ai/kugou-skill 0.1.17 → 0.1.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
Binary file
|
package/bin/darwin-x64/kugou-cli
CHANGED
|
Binary file
|
|
Binary file
|
package/bin/linux-x64/kugou-cli
CHANGED
|
Binary file
|
|
Binary file
|
package/package.json
CHANGED
package/references/control.md
CHANGED
|
@@ -759,6 +759,11 @@ kugou-cli control doctor --json=false # 一行人类可读
|
|
|
759
759
|
| `environment.vbs_enabled` | bool \| null | VBS（`HKLM\...\DeviceGuard\EnableVirtualizationBasedSecurity`） |
|
|
760
760
|
| `environment.powershell_available` | bool \| null | `powershell.exe` 是否在 PATH |
|
|
761
761
|
| `environment.explorer_available` | bool \| null | `explorer.exe` 是否在 PATH |
|
|
762
|
+
| `environment.in_job_object` | bool \| null | 当前进程是否在 Job Object 里（Win 才有意义）。`true` 意味着 kugou-cli 派生的进程可能被 sandbox reap |
|
|
763
|
+
| `environment.job_breakaway_allowed` | bool \| null | Job 是否允许 `CREATE_BREAKAWAY_FROM_JOB`（设置 `JOB_OBJECT_LIMIT_BREAKAWAY_OK`）。`false` = 派生链逃不出 sandbox；`null` 字段省略 = 不在 Job 或读不到 Job handle |
|
|
764
|
+
| `environment.process_integrity_level` | string | Token 完整性级别：`Low`（AppContainer / LPAC）/`Medium`（普通）/`High`（elevated）/`System`/`Unknown`。`Low` 意味着 Job breakaway 也救不了 |
|
|
765
|
+
| `environment.parent_process` | string | `pid=N path=...` —— 当前进程的父进程，用于识别是否跑在 sandbox runner 下 |
|
|
766
|
+
| `environment.grandparent_process` | string | `pid=N path=...` —— 祖父进程，二级排查（"spawned by shell" vs "spawned directly by sandbox"） |
|
|
762
767
|
| `environment.home_dir` | string | 解析后的 `$HOME`/`$USERPROFILE` |
|
|
763
768
|
| `environment.home_dir_accessible` | bool | `.config/kugou-cli/` 是否可创建+写 |
|
|
764
769
|
| `hints` | string[] | 给用户的修复建议（HVCI 关、$HOME 设置、PowerShell 缺失等） |
|
|
@@ -808,9 +813,28 @@ agent wants to call control play
|
|
|
808
813
|
├─ fatal=1 → tell user to install client / fix $HOME, abort
|
|
809
814
|
└─ fatal=0 → proceed
|
|
810
815
|
├─ hints contain "HVCI" → warn user before start, ask before disabling HVCI
|
|
816
|
+
├─ hints contain "Job Object" or "AppContainer" → sandbox reap 问题,
|
|
817
|
+
│ kugou-cli 改不了,需要 sandbox 平台方配合或绕开 sandbox 启动
|
|
811
818
|
└─ no hints → just run control start, then control play
|
|
812
819
|
```
|
|
813
820
|
|
|
821
|
+
### Sandbox reap 诊断速查
|
|
822
|
+
|
|
823
|
+
`control start` 失败的"6 秒超时"对多种原因长得一模一样，**`doctor` 的 `environment` 字段把它们分开**：
|
|
824
|
+
|
|
825
|
+
| `in_job_object` | `job_breakaway_allowed` | `process_integrity_level` | 隔离类型 | `control start` 是否能拉起客户端 |
|
|
826
|
+
|---|---|---|---|---|
|
|
827
|
+
| `false` | (字段省略) | `Medium` | 无 Job 隔离 | ✅ 应能正常 |
|
|
828
|
+
| `true` | `true` | 任意 | Job 隔离，允许 breakaway | ✅ 派生链能逃出 Job |
|
|
829
|
+
| `true` | `false` | `Medium` | Job 隔离，**不允许** breakaway | ❌ 客户端会被 reap |
|
|
830
|
+
| `true` | (字段省略) | 任意 | Job 隔离，读不到 breakaway flag | ❌ 推测为不允许 |
|
|
831
|
+
| (字段省略) | (字段省略) | `Low` | **AppContainer / LPAC**（不走 Job） | ❌ Job breakaway 救不了 |
|
|
832
|
+
| (字段省略) | (字段省略) | (字段省略) | 非 Windows 平台 | N/A |
|
|
833
|
+
|
|
834
|
+
> 字段省略 (`omitempty`) = 该平台不探测，或探测失败导致值是 nil。要区分这两种情况，看 `platform` 字段：非 Windows 上所有 Win-only 字段都省略。
|
|
835
|
+
|
|
836
|
+
父进程链 (`parent_process` / `grandparent_process`) 用于识别"我是被什么 spawn 出来的"，对识别具体 sandbox runner（workbuddy / opencode / cloud-agent 等）有用，但 doctor 不内置 sandbox 名到 hint 的映射——这部分逻辑放在调用方，doctor 只负责给出**真实数据**。
|
|
837
|
+
|
|
814
838
|
### 与 `control detect` 的区别
|
|
815
839
|
|
|
816
840
|
| 维度 | `control detect` | `control doctor` |
|