@khorsheed/dsh-ankh-guard 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # 变更记录
 
+## 0.1.1（2026-08-23）
+
+- 修复：随包 skill 在目录里可见、调用即炸——宿主在 load 时才校验注册的 `source` 字段，之前没传；已补 `source: 'runtime'`，并加了真实 SkillRegistry 往返测试（list + load）防回归
+
 ## 0.1.0（2026-08-22）
 
 首个公开发布。

package/lib/cli.js

@@ -74,17 +74,36 @@ function sandboxGate(verb, options, io) {
 	io.stderr(`${verb} refused: this environment is sandboxed (a probe write outside the workspace was denied), so a detached restart/watchdog process would be reaped when the turn ends. You cannot switch the sandbox yourself — ask the user to run /permission danger-full-access in THIS session (a yes/no "authorization" changes nothing), then verify with \`dsh-ankh-guard check-env\` and retry. Certain the probe is wrong? Re-run with --force\n`);
 	return false;
 }
+/**
+* Whether the pid named by this raw pid/lock-file content is alive. Empty
+* content reads as NO holder: Number('') is 0 and kill(0, 0) probes our own
+* process group (always succeeds), which once read as "alive" and refused
+* every restart forever — the bug that had to be fixed in two copies of this
+* logic before it was consolidated here.
+*/
+function pidAlive(raw) {
+	const pid = Number(raw);
+	if (raw === "" || !Number.isInteger(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** The live pid named by a pid/lock file (as the raw string), or null when absent/stale. */
+function livePidIn(file) {
+	try {
+		const raw = readFileSync(file, "utf8").trim();
+		return pidAlive(raw) ? raw : null;
+	} catch {
+		return null;
+	}
+}
 /** The live supervising watchdog's pid, or null when none is (pidfile + kill 0). */
 function liveWatchdogPid(stateDir) {
-	try {
-		const raw = readFileSync(stateFile(stateDir, "watchdogPid"), "utf8").trim();
-		const pid = Number(raw);
-		if (raw !== "" && Number.isInteger(pid) && pid > 0) {
-			process.kill(pid, 0);
-			return pid;
-		}
-	} catch {}
-	return null;
+	const raw = livePidIn(stateFile(stateDir, "watchdogPid"));
+	return raw === null ? null : Number(raw);
 }
 /**
 * Cross-session restart mutual exclusion: two concurrent restarts would both
@@ -116,14 +135,10 @@ function acquireRestartLock(stateDir, holderPid = process.pid) {
 				holder: `unreadable (${String(error)})`
 			};
 		}
-		const pid = Number(holder);
-		if (holder !== "" && Number.isInteger(pid) && pid > 0) try {
-			process.kill(pid, 0);
-			return {
-				ok: false,
-				holder
-			};
-		} catch {}
+		if (pidAlive(holder)) return {
+			ok: false,
+			holder
+		};
 		try {
 			unlinkSync(file);
 		} catch (error) {
@@ -456,18 +471,6 @@ function restartMarkerState(stateDir) {
 		return "stale";
 	}
 }
-/** The restart lock's live holder pid (as a string), or null when free/stale. */
-function liveRestartLockHolder(stateDir) {
-	try {
-		const raw = readFileSync(stateFile(stateDir, "restartLock"), "utf8").trim();
-		const pid = Number(raw);
-		if (raw !== "" && Number.isInteger(pid) && pid > 0) try {
-			process.kill(pid, 0);
-			return raw;
-		} catch {}
-	} catch {}
-	return null;
-}
 /** Captured preflight output is diagnostics, not a log — cap it before it can grow without bound. */
 const PREFLIGHT_OUTPUT_CAP = 65536;
 /**
@@ -1150,46 +1153,50 @@ async function runCli(argv, io) {
 			if (!sandboxGate("schedule-exit", options, io)) return 1;
 			if (!await preflightGate("schedule-exit", resolveProfileName(options), options.preflightTimeoutMs ?? DEFAULT_PREFLIGHT_TIMEOUT_MS, io, resolveHarnessRoot(options.repoDir))) return 1;
 			if (liveWatchdogPid(stateDir) === null) io.stderr(NO_WATCHDOG_HINT);
-			const markerFile = stateFile(stateDir, "restartRequested");
-			const markerState = restartMarkerState(stateDir);
-			if (markerState === "fresh") {
-				io.stderr("schedule-exit refused: a restart is already scheduled (restart-requested.json still pending); a stale marker expires on its own after 15 minutes\n");
-				return 1;
-			}
-			if (markerState === "stale" && existsSync(markerFile)) io.stderr("warning: overwriting a stale restart marker (a previous schedule never completed)\n");
-			const inFlight = liveRestartLockHolder(stateDir);
-			if (inFlight !== null) {
-				io.stderr(`schedule-exit refused: a restart is in flight (pid ${inFlight}) — the exit agent would kill the instance it is starting\n`);
+			const lock = acquireRestartLock(stateDir);
+			if (!lock.ok) {
+				io.stderr(`schedule-exit refused: a restart is in flight (pid ${lock.holder}) — the exit agent would kill the instance it is starting\n`);
 				return 1;
 			}
-			const initiator = options.initiator ?? process.env.DSH_SESSION_ID;
-			mkdirSync(stateDir, { recursive: true });
-			writeFileSync(stateFile(stateDir, "restartRequested"), `${JSON.stringify({
-				reason: "scheduled self-restart",
-				requestedAt: Date.now(),
-				...initiator !== void 0 ? { initiator } : {}
-			})}\n`);
-			const resultFile = stateFile(stateDir, "lastRestart");
-			const logPath = options.log ?? stateFile(stateDir, "scheduleExitLog");
-			mkdirSync(dirname(logPath), { recursive: true });
-			const child = spawn(process.execPath, exitAgentInvocation(), {
-				detached: true,
-				stdio: [
-					"ignore",
-					openSync(logPath, "a"),
-					openSync(logPath, "a")
-				],
-				env: {
-					...process.env,
-					WD_PORT: String(port),
-					WD_DELAY_MS: String(delayMs),
-					WD_RESULT_FILE: resultFile,
-					...initiator !== void 0 ? { WD_INITIATOR: initiator } : {}
+			try {
+				const markerFile = stateFile(stateDir, "restartRequested");
+				const markerState = restartMarkerState(stateDir);
+				if (markerState === "fresh") {
+					io.stderr("schedule-exit refused: a restart is already scheduled (restart-requested.json still pending); a stale marker expires on its own after 15 minutes\n");
+					return 1;
 				}
-			});
-			child.unref();
-			io.stdout(`exit scheduled in ${delayMs} ms (agent pid ${child.pid ?? "unknown"}) — watchdog will respawn and run the canary\n`);
-			return 0;
+				if (markerState === "stale" && existsSync(markerFile)) io.stderr("warning: overwriting a stale restart marker (a previous schedule never completed)\n");
+				const initiator = options.initiator ?? process.env.DSH_SESSION_ID;
+				mkdirSync(stateDir, { recursive: true });
+				writeFileSync(stateFile(stateDir, "restartRequested"), `${JSON.stringify({
+					reason: "scheduled self-restart",
+					requestedAt: Date.now(),
+					...initiator !== void 0 ? { initiator } : {}
+				})}\n`);
+				const resultFile = stateFile(stateDir, "lastRestart");
+				const logPath = options.log ?? stateFile(stateDir, "scheduleExitLog");
+				mkdirSync(dirname(logPath), { recursive: true });
+				const child = spawn(process.execPath, exitAgentInvocation(), {
+					detached: true,
+					stdio: [
+						"ignore",
+						openSync(logPath, "a"),
+						openSync(logPath, "a")
+					],
+					env: {
+						...process.env,
+						WD_PORT: String(port),
+						WD_DELAY_MS: String(delayMs),
+						WD_RESULT_FILE: resultFile,
+						...initiator !== void 0 ? { WD_INITIATOR: initiator } : {}
+					}
+				});
+				child.unref();
+				io.stdout(`exit scheduled in ${delayMs} ms (agent pid ${child.pid ?? "unknown"}) — watchdog will respawn and run the canary\n`);
+				return 0;
+			} finally {
+				lock.release();
+			}
 		}
 		default:
 			io.stderr(`unknown command ${command}\n\n${USAGE}`);

package/lib/index.js

@@ -68,7 +68,8 @@ function registerRestartSkill(ctx, stateDir) {
 		ctx.effect(() => skills.register({
 			name,
 			description,
-			content
+			content,
+			source: "runtime"
 		}));
 		writeSkillRegistration(stateDir, {
 			registered: true,

package/lib/types/cli.js

@@ -80,20 +80,39 @@ function sandboxGate(verb, options, io) {
     io.stderr(`${verb} refused: this environment is sandboxed (a probe write outside the workspace was denied), so a detached restart/watchdog process would be reaped when the turn ends. You cannot switch the sandbox yourself — ask the user to run /permission danger-full-access in THIS session (a yes/no "authorization" changes nothing), then verify with \`dsh-ankh-guard check-env\` and retry. Certain the probe is wrong? Re-run with --force\n`);
     return false;
 }
-/** The live supervising watchdog's pid, or null when none is (pidfile + kill 0). */
-function liveWatchdogPid(stateDir) {
+/**
+ * Whether the pid named by this raw pid/lock-file content is alive. Empty
+ * content reads as NO holder: Number('') is 0 and kill(0, 0) probes our own
+ * process group (always succeeds), which once read as "alive" and refused
+ * every restart forever — the bug that had to be fixed in two copies of this
+ * logic before it was consolidated here.
+ */
+function pidAlive(raw) {
+    const pid = Number(raw);
+    if (raw === '' || !Number.isInteger(pid) || pid <= 0)
+        return false;
     try {
-        const raw = readFileSync(stateFile(stateDir, 'watchdogPid'), 'utf8').trim();
-        const pid = Number(raw);
-        // raw '' → 0, and kill(0, 0) always succeeds (it probes our own process
-        // group): an empty pidfile must read as NO watchdog, never as alive.
-        if (raw !== '' && Number.isInteger(pid) && pid > 0) {
-            process.kill(pid, 0);
-            return pid;
-        }
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
     }
-    catch { /* no pidfile or a dead owner */ }
-    return null;
+}
+/** The live pid named by a pid/lock file (as the raw string), or null when absent/stale. */
+function livePidIn(file) {
+    try {
+        const raw = readFileSync(file, 'utf8').trim();
+        return pidAlive(raw) ? raw : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The live supervising watchdog's pid, or null when none is (pidfile + kill 0). */
+function liveWatchdogPid(stateDir) {
+    const raw = livePidIn(stateFile(stateDir, 'watchdogPid'));
+    return raw === null ? null : Number(raw);
 }
 /**
  * Cross-session restart mutual exclusion: two concurrent restarts would both
@@ -125,14 +144,8 @@ function acquireRestartLock(stateDir, holderPid = process.pid) {
             catch (error) {
                 return { ok: false, holder: `unreadable (${String(error)})` };
             }
-            const pid = Number(holder);
-            if (holder !== '' && Number.isInteger(pid) && pid > 0) {
-                try {
-                    process.kill(pid, 0);
-                    return { ok: false, holder };
-                }
-                catch { /* dead holder — reclaim below */ }
-            }
+            if (pidAlive(holder))
+                return { ok: false, holder };
             try {
                 unlinkSync(file);
             }
@@ -443,22 +456,6 @@ function restartMarkerState(stateDir) {
         return 'stale'; // unparseable is stale by definition
     }
 }
-/** The restart lock's live holder pid (as a string), or null when free/stale. */
-function liveRestartLockHolder(stateDir) {
-    try {
-        const raw = readFileSync(stateFile(stateDir, 'restartLock'), 'utf8').trim();
-        const pid = Number(raw);
-        if (raw !== '' && Number.isInteger(pid) && pid > 0) {
-            try {
-                process.kill(pid, 0);
-                return raw;
-            }
-            catch { /* dead holder */ }
-        }
-    }
-    catch { /* no lock file */ }
-    return null;
-}
 /** Captured preflight output is diagnostics, not a log — cap it before it can grow without bound. */
 const PREFLIGHT_OUTPUT_CAP = 64 * 1024;
 /**
@@ -1282,64 +1279,74 @@ export async function runCli(argv, io) {
             if (liveWatchdogPid(stateDir) === null) {
                 io.stderr(NO_WATCHDOG_HINT);
             }
-            // One scheduled restart at a time: the marker carries a single
-            // initiator, so overwriting a FRESH one would silently reassign the
-            // pending report. A marker past the TTL is stale (the watchdog died
-            // mid-flow without clearing it) — overwrite with a warning instead of
-            // refusing forever.
-            const markerFile = stateFile(stateDir, 'restartRequested');
-            const markerState = restartMarkerState(stateDir);
-            if (markerState === 'fresh') {
-                io.stderr('schedule-exit refused: a restart is already scheduled (restart-requested.json still pending); a stale marker expires on its own after 15 minutes\n');
+            // One scheduled restart at a time, and never while a restart is in
+            // flight. Both checks must hold ATOMICALLY with writing the marker and
+            // spawning the exit agent: an earlier version checked without holding
+            // the lock, and the narrow read→write window let a concurrent restart
+            // pass its own checks in between — the scheduled exit agent then
+            // SIGTERMed the instance that restart had just started. Taking the
+            // restart lock here serializes the two verbs on the same primitive
+            // (restart's own marker check stays: it guards against an exit agent
+            // scheduled BEFORE its acquisition, already past this window).
+            const lock = acquireRestartLock(stateDir);
+            if (!lock.ok) {
+                io.stderr(`schedule-exit refused: a restart is in flight (pid ${lock.holder}) — the exit agent would kill the instance it is starting\n`);
                 return 1;
             }
-            if (markerState === 'stale' && existsSync(markerFile)) {
-                io.stderr('warning: overwriting a stale restart marker (a previous schedule never completed)\n');
+            try {
+                // The marker carries a single initiator, so overwriting a FRESH one
+                // would silently reassign the pending report. A marker past the TTL
+                // is stale (the watchdog died mid-flow without clearing it) —
+                // overwrite with a warning instead of refusing forever.
+                const markerFile = stateFile(stateDir, 'restartRequested');
+                const markerState = restartMarkerState(stateDir);
+                if (markerState === 'fresh') {
+                    io.stderr('schedule-exit refused: a restart is already scheduled (restart-requested.json still pending); a stale marker expires on its own after 15 minutes\n');
+                    return 1;
+                }
+                if (markerState === 'stale' && existsSync(markerFile)) {
+                    io.stderr('warning: overwriting a stale restart marker (a previous schedule never completed)\n');
+                }
+                // Intentional-restart marker: the supervising watchdog runs the canary
+                // after the respawn and clears this on pass. The initiator (the session
+                // that requested the exit) rides along so the restart report can return
+                // to that session instead of racing to whichever root agent resumes
+                // first. Everything lands in stateDir directly — the same directory the
+                // plugin reads (see the supervise case for why no home is derived).
+                const initiator = options.initiator ?? process.env.DSH_SESSION_ID;
+                mkdirSync(stateDir, { recursive: true });
+                writeFileSync(stateFile(stateDir, 'restartRequested'), `${JSON.stringify({
+                    reason: 'scheduled self-restart',
+                    requestedAt: Date.now(),
+                    ...(initiator !== undefined ? { initiator } : {}),
+                })}\n`);
+                // A DETACHED exit agent (setsid via node spawn): it cannot be reaped by
+                // the sandbox/harness process group, so the scheduled kill actually
+                // lands even after the scheduling turn ends — the fix for "the kill
+                // never happened" seen with `(sleep N; kill) &` from a managed shell.
+                // The agent is a real shipped file (typechecked, linted, unit-tested),
+                // spawned with the same source/built split as guardInvocation().
+                const resultFile = stateFile(stateDir, 'lastRestart');
+                const logPath = options.log ?? stateFile(stateDir, 'scheduleExitLog');
+                mkdirSync(dirname(logPath), { recursive: true });
+                const child = spawn(process.execPath, exitAgentInvocation(), {
+                    detached: true,
+                    stdio: ['ignore', openSync(logPath, 'a'), openSync(logPath, 'a')],
+                    env: {
+                        ...process.env,
+                        WD_PORT: String(port),
+                        WD_DELAY_MS: String(delayMs),
+                        WD_RESULT_FILE: resultFile,
+                        ...(initiator !== undefined ? { WD_INITIATOR: initiator } : {}),
+                    },
+                });
+                child.unref();
+                io.stdout(`exit scheduled in ${delayMs} ms (agent pid ${child.pid ?? 'unknown'}) — watchdog will respawn and run the canary\n`);
+                return 0;
             }
-            // And the other direction of the same invariant: a restart in flight
-            // (live lock holder) means an instance is being stopped/started right
-            // now — scheduling an exit would SIGTERM the one it just started.
-            const inFlight = liveRestartLockHolder(stateDir);
-            if (inFlight !== null) {
-                io.stderr(`schedule-exit refused: a restart is in flight (pid ${inFlight}) — the exit agent would kill the instance it is starting\n`);
-                return 1;
+            finally {
+                lock.release();
             }
-            // Intentional-restart marker: the supervising watchdog runs the canary
-            // after the respawn and clears this on pass. The initiator (the session
-            // that requested the exit) rides along so the restart report can return
-            // to that session instead of racing to whichever root agent resumes
-            // first. Everything lands in stateDir directly — the same directory the
-            // plugin reads (see the supervise case for why no home is derived).
-            const initiator = options.initiator ?? process.env.DSH_SESSION_ID;
-            mkdirSync(stateDir, { recursive: true });
-            writeFileSync(stateFile(stateDir, 'restartRequested'), `${JSON.stringify({
-                reason: 'scheduled self-restart',
-                requestedAt: Date.now(),
-                ...(initiator !== undefined ? { initiator } : {}),
-            })}\n`);
-            // A DETACHED exit agent (setsid via node spawn): it cannot be reaped by
-            // the sandbox/harness process group, so the scheduled kill actually
-            // lands even after the scheduling turn ends — the fix for "the kill
-            // never happened" seen with `(sleep N; kill) &` from a managed shell.
-            // The agent is a real shipped file (typechecked, linted, unit-tested),
-            // spawned with the same source/built split as guardInvocation().
-            const resultFile = stateFile(stateDir, 'lastRestart');
-            const logPath = options.log ?? stateFile(stateDir, 'scheduleExitLog');
-            mkdirSync(dirname(logPath), { recursive: true });
-            const child = spawn(process.execPath, exitAgentInvocation(), {
-                detached: true,
-                stdio: ['ignore', openSync(logPath, 'a'), openSync(logPath, 'a')],
-                env: {
-                    ...process.env,
-                    WD_PORT: String(port),
-                    WD_DELAY_MS: String(delayMs),
-                    WD_RESULT_FILE: resultFile,
-                    ...(initiator !== undefined ? { WD_INITIATOR: initiator } : {}),
-                },
-            });
-            child.unref();
-            io.stdout(`exit scheduled in ${delayMs} ms (agent pid ${child.pid ?? 'unknown'}) — watchdog will respawn and run the canary\n`);
-            return 0;
         }
         default:
             io.stderr(`unknown command ${command}\n\n${USAGE}`);

package/lib/types/index.js

@@ -56,7 +56,7 @@ function registerRestartSkill(ctx, stateDir) {
             writeSkillRegistration(stateDir, { registered: false, reason: 'shipped SKILL.md malformed', at: Date.now() });
             return;
         }
-        ctx.effect(() => skills.register({ name, description, content }));
+        ctx.effect(() => skills.register({ name, description, content, source: 'runtime' }));
         writeSkillRegistration(stateDir, { registered: true, at: Date.now() });
     }
     catch (error) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@khorsheed/dsh-ankh-guard",
   "description": "Hard gate for self-modification restarts: a green-build credential bound to the git HEAD, checked before any restart of the running instance",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -57,7 +57,8 @@
     "@types/node": "^22.0.0",
     "tsdown": "^0.22.2",
     "typescript": "^5.9.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.0.0",
+    "@deepseek-ai/dsh-skill": "^0.1.0-rc.8"
   },
   "keywords": [
     "dsh",