@kin-tio/cli 0.6.2 → 0.7.0

package/.env.example

@@ -28,8 +28,10 @@ WECOM_AUTH_CONFIRMATION=Code accepted. You can continue the conversation.
 # WECOM_MCP_OBSERVE_MS=5000
 # SHUTDOWN_TIMEOUT_MS=10000
 
-# Optional Weixin iLink channel. Generate a 32-byte base64url key and keep it in
-# the deployment secret store; Bot and context tokens are encrypted with it.
+# Enable Weixin iLink inside the combined `kintio start` runtime. Standalone
+# `kintio ilink login` and `kintio ilink start` do not require this flag.
+# Generate a 32-byte base64url key and keep it in the deployment secret store;
+# Bot and context tokens are encrypted with it.
 ILINK_ENABLED=false
 # Prefer a deployment-secret value. If omitted, the service creates a private
 # 0600 key file beside SQLite; never register that key with a chat Agent.

package/CHANGELOG.md

@@ -4,6 +4,32 @@ This file records important user-visible changes after the first public release.
 
 ## Unreleased
 
+## 0.7.0
+
+- Added `kintio ilink login`, which reuses the iLink enrollment state machine
+  while rendering its five-minute QR code directly in an interactive terminal;
+  no WeChat KF conversation or Agent turn is required. Accounts
+  enrolled locally receive host-level Agent access and inherit the host runtime
+  configuration, while remotely offered iLink accounts remain restricted
+  ([#54](https://github.com/Gkxie/kintio/issues/54)).
+- Added an explicit `--qr-output <file>` view for `kintio ilink login`, allowing
+  graphical and non-terminal callers to consume a temporary raw PNG directly
+  from the QR payload without parsing ANSI terminal output. The file is created
+  exclusively and removed when the login attempt ends
+  ([#57](https://github.com/Gkxie/kintio/issues/57)).
+- Made iLink a standalone lifecycle: `kintio ilink login` now initializes and
+  persists an account without setup, an environment file, Hono, or a running
+  Worker, while safely delegating to a running instance when present;
+  `kintio ilink start` starts polling and the host Agent in the foreground without
+  a public HTTP listener. The iLink Runtime configuration no longer contains a
+  synthetic WeChat KF adapter
+  ([#59](https://github.com/Gkxie/kintio/issues/59)).
+- Added per-account `kintio ilink list`, `start`, `stop`, and confirmed `delete`
+  lifecycle commands. One Runtime can reconcile multiple selected listeners;
+  complete deletion atomically purges the selected account and all Kintio data
+  scoped to it while preserving unrelated accounts and channels
+  ([#60](https://github.com/Gkxie/kintio/issues/60)).
+
 ## 0.6.2
 
 - Added a custom Kintio wordmark and its circular-safe TIO avatar to the English

package/README.md

@@ -67,33 +67,67 @@ Prerequisites:
 
 ```bash
 npm install --global @kin-tio/cli
-kintio setup
 codex login status
 ```
 
-`kintio setup` creates a private instance under `~/.kintio`, installs the bundled Agent
-skill, and writes the channel configuration template. POSIX systems use mode `0600`;
-Windows keeps the instance inside the current user's profile. No adapter is enabled
-by default. Follow the [setup guide](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)
-and edit `~/.kintio/.env` to configure one adapter:
+For an iLink-only instance, no setup file or public HTTP listener is required:
 
-- For WeChat KF API, set its callback token, EncodingAESKey, CorpID, and secret. A temporary
-  `WECOM_AUTH_TRIGGER` can authorize the first user without knowing their
-  `external_userid` in advance.
-- For an existing Weixin iLink binding, set `ILINK_ENABLED=true`. Creating a new binding
-  currently starts from an authorized WeChat KF conversation.
+```bash
+kintio ilink login
+kintio ilink start
+```
 
-Start Kintio:
+`ilink login` performs one encrypted enrollment, starts no listener, and exits. `ilink start` then runs provider
+polling and the host Agent in the foreground without Hono or a TCP listener. Both commands
+use `~/.kintio` by default and accept `--home`. With multiple accounts, use `ilink list`
+and pass the displayed provider ID or account key through `--account`. Repeated `start`
+commands add accounts to the live runtime; `stop` removes one.
+
+For a callback-based adapter, create and edit the deployment configuration instead:
 
 ```bash
+kintio setup
 kintio start
 kintio status
 kintio logs --lines 100
 ```
 
-After startup, confirm that `kintio logs` contains `Hono server is listening on port 8888`.
-Complete the callback or binding checks described in the setup guide before sending traffic.
-Use `kintio run` when a foreground process is preferable to the native daemon.
+`kintio setup` creates a private instance under `~/.kintio`, installs the managed Agent
+skill, and writes the channel configuration template. Follow the
+[setup guide](https://github.com/Gkxie/kintio/blob/master/docs/setup.md):
+
+- For WeChat KF API, set its callback token, EncodingAESKey, CorpID, and secret. A temporary
+  `WECOM_AUTH_TRIGGER` can authorize the first user without knowing their
+  `external_userid` in advance.
+- A combined callback + iLink deployment may additionally set `ILINK_ENABLED=true`.
+
+For a graphical or non-terminal caller, select a temporary raw PNG instead of ANSI blocks:
+
+```bash
+kintio ilink login --qr-output ~/.kintio/ilink-login.png
+```
+
+The target must be directly inside the selected Kintio instance directory and must not
+already exist. Kintio removes the PNG when login succeeds, expires, is cancelled, or fails;
+the QR payload is never printed. Without `--qr-output`, the command
+requires an interactive terminal. Both forms stop waiting after five minutes and never
+start an Agent turn. The resulting iLink identity represents
+the local operator and inherits the host Agent configuration without Kintio's untrusted-
+channel capability restrictions. Show this QR code only to someone authorized to control
+the host Agent. Run `kintio ilink start` after enrollment to process messages without Hono.
+
+To permanently remove an account and every Kintio record scoped to it, use:
+
+```bash
+kintio ilink delete --account <provider-id-or-account-key> --yes
+```
+
+The explicit confirmation is mandatory. Credentials, conversations, messages, media,
+delivery records, and enrollment audit rows for that account are deleted atomically.
+
+For callback deployments, confirm that `kintio logs` contains
+`Hono server is listening on port 8888`. Use `kintio run` when a foreground process is
+preferable to the native daemon.
 Existing source-based deployments can keep their current state after the one-time
 process-manager migration described in the setup guide.
 
@@ -111,6 +145,9 @@ Source builds and contributor setup are documented in
   Hono route; every action still requires a short-lived conversation capability.
 - Project-level Agent capability restrictions are not an operating-system sandbox. Use a
   dedicated system account and additional isolation appropriate to the Agent's real powers.
+- An iLink account enrolled by `kintio ilink login` is explicitly host-authorized; its owner
+  receives the capabilities allowed by the host Agent configuration. Accounts enrolled from
+  a remote adapter remain restricted, and chat input cannot change this persisted trust level.
 - A provider accepting an outbound request does not prove that a client displayed it;
   uncertain outcomes remain explicit to avoid duplicate delivery.
 

package/README.zh-CN.md

@@ -43,25 +43,49 @@
 
 ```bash
 npm install --global @kin-tio/cli
-kintio setup
 codex login status
 ```
 
-`kintio setup` 会在 `~/.kintio` 创建私有实例目录、安装内置 Agent Skill，并生成渠道配置
-模板 `.env`。macOS/Linux 使用 `0600`，Windows 则限定在当前用户目录的 ACL
-边界内。默认不启用任何适配器；请按英文
-[部署指南](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)配置 WeChat KF API，或为已有 Weixin iLink 绑定设置
-`ILINK_ENABLED=true`。
+iLink 可以完全独立使用，不需要 `setup`、`.env` 或公网 HTTP：
 
 ```bash
+kintio ilink login
+kintio ilink start
+```
+
+`ilink login` 完成一次扫码、加密保存凭据后退出，不会自行启动监听；`ilink start` 不启动 Hono 或 TCP 端口，
+只以前台方式运行 iLink 长轮询和宿主 Agent。两者默认使用 `~/.kintio`。
+存在多个账号时，先用 `kintio ilink list` 查看账号，再通过 `--account` 指定
+`start`、`stop` 或 `delete` 的目标；正在运行时可继续执行 `start` 增加监听账号。
+
+需要部署公网回调渠道时，再使用：
+
+```bash
+kintio setup
 kintio start
 kintio status
 kintio logs --lines 100
 ```
 
-启动后应确认 `kintio logs` 包含 `Hono server is listening on port 8888`；投入使用前仍需按
-部署指南完成回调或绑定验证。需要前台进程时使用 `kintio run`；现有源码目录部署可以在完成
-部署指南中的一次性进程管理器迁移后，继续使用原数据库和配置。
+具体配置见英文[部署指南](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)。
+
+图形界面或非交互调用方可以显式选择临时的原始 PNG，而不是解析终端字符：
+
+```bash
+kintio ilink login --qr-output ~/.kintio/ilink-login.png
+```
+
+目标文件必须直接位于所选 Kintio 实例目录中且不能预先存在；登录成功、过期、取消或失败后，Kintio 会自动删除该文件，并且
+不会打印二维码原始内容。二维码五分钟后过期；该命令不会唤醒 Agent。通过本机命令建立的 iLink 身份代表宿主机
+所有者的明确授权，后续对话直接继承宿主 Agent 配置，不再套用不可信渠道的能力限制。
+只应让获准控制宿主 Agent 的人扫描该二维码。登录后运行 `kintio ilink start` 即可在不
+启动 Hono 的情况下处理消息。
+
+`kintio ilink delete --account <账号> --yes` 会不可恢复地删除该账号及其在 Kintio
+中的凭据、会话、消息、媒体、发送记录和登录审计；`--yes` 为强制确认参数。
+
+公网回调部署启动后，应确认 `kintio logs` 包含
+`Hono server is listening on port 8888`。
 源码构建与贡献者开发环境见英文
 [贡献指南](https://github.com/Gkxie/kintio/blob/master/CONTRIBUTING.md)。
 

package/dist/src/cli.js

@@ -5,9 +5,12 @@ import path from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { parseArgs } from 'node:util';
 import crossSpawn from 'cross-spawn';
-import { DAEMON_STOP_TIMEOUT_MS, loadConfig, parseStartTimeout, resolveProjectRoot, WORKER_GRACEFUL_TIMEOUT_MS, } from './config.js';
+import { DAEMON_STOP_TIMEOUT_MS, loadConfig, loadIlinkEnrollmentConfig, loadIlinkRuntimeConfig, parseStartTimeout, resolveProjectRoot, WORKER_GRACEFUL_TIMEOUT_MS, } from './config.js';
 import { isPathInside, samePath } from './lib/path-identity.js';
 import { assertTrustedDirectory, ensureContainedDirectory, ensurePrivateDirectory, } from './lib/private-directory.js';
+import { runIlinkCliLogin } from './ilink/cli-login.js';
+import { runIlinkAccountCommand } from './ilink/cli-accounts.js';
+import { startIlinkCliRuntime } from './ilink/cli-start.js';
 import { daemonRecordPath, readDaemonRecord, requestControl, } from './runtime/daemon-protocol.js';
 import { acquireSingleInstanceLock, processIsAlive, SingleInstanceLockError, } from './runtime/single-instance-lock.js';
 import { installManagedSkill } from './runtime/managed-skill.js';
@@ -22,6 +25,11 @@ Commands:
   restart               Restart Kintio with the current installation and config
   status                Show the background process status
   logs                  Follow Kintio logs
+  ilink login [options] Connect an iLink account with a QR code
+  ilink list            List enrolled iLink accounts
+  ilink start [options] Start one iLink account without Hono
+  ilink stop [options]  Stop one iLink account
+  ilink delete [options] Permanently delete one iLink account and its data
 
 Options:
   --home <directory>     Instance directory (default: ~/.kintio)
@@ -30,7 +38,132 @@ Options:
   --no-follow            Print logs without following
   -h, --help             Show this help
   -v, --version          Show the Kintio version
+
+Run "kintio ilink --help" for iLink account commands.
+`;
+const ILINK_LOGIN_HELP = `Usage: kintio ilink login [options]
+
+Connect one iLink account, save its encrypted credentials, and exit. This
+command does not require setup, an environment file, Hono, or a running Kintio
+instance. By default, the QR code is rendered directly in an interactive
+terminal and expires after five minutes.
+
+The PNG option is required when stdout is not an interactive terminal. Whoever
+scans this locally issued QR receives the capabilities allowed by the host Agent
+configuration; show it only to an authorized operator.
+
+Options:
+  --qr-output <file>     Write a temporary raw QR PNG instead of terminal blocks
+                         The file must be directly inside the instance directory
+                         The file is removed when the login attempt ends
+  --home <directory>     Instance directory (default: ~/.kintio)
+  --config <file>        Optional environment overrides
+  -h, --help             Show this help
+`;
+const ILINK_START_HELP = `Usage: kintio ilink start [options]
+
+Run iLink long polling and the host Agent in the foreground without starting
+Hono or opening a TCP listener. This command does not require setup or an
+environment file. One account is selected automatically; multiple accounts
+require --account. While this runtime is active, additional start commands add
+accounts to the same process.
+
+Options:
+  --account <id>        Provider account ID or Kintio account key
+  --home <directory>     Instance directory (default: ~/.kintio)
+  --config <file>        Optional environment overrides
+  -h, --help             Show this help
+`;
+const ILINK_STOP_HELP = `Usage: kintio ilink stop [options]
+
+Stop one iLink account. Stopping the last account also exits a foreground
+"kintio ilink start" runtime. One account is selected automatically; multiple
+accounts require --account.
+
+Options:
+  --account <id>        Provider account ID or Kintio account key
+  --home <directory>    Instance directory (default: ~/.kintio)
+  --config <file>       Optional environment overrides
+  -h, --help            Show this help
+`;
+const ILINK_LIST_HELP = `Usage: kintio ilink list [options]
+
+List enrolled iLink accounts and whether each account is currently running.
+
+Options:
+  --home <directory>    Instance directory (default: ~/.kintio)
+  --config <file>       Optional environment overrides
+  -h, --help            Show this help
+`;
+const ILINK_DELETE_HELP = `Usage: kintio ilink delete [options]
+
+Permanently delete one iLink account and all Kintio data scoped to it,
+including credentials, conversations, messages, media, send records, and
+enrollment audit records. This operation cannot be undone.
+
+Options:
+  --account <id>        Provider account ID or Kintio account key
+  --yes                 Confirm permanent deletion
+  --home <directory>    Instance directory (default: ~/.kintio)
+  --config <file>       Optional environment overrides
+  -h, --help            Show this help
+`;
+const ILINK_HELP = `Usage: kintio ilink <command>
+
+Commands:
+  login [options]        Connect an iLink account with a QR code
+  list                   List enrolled accounts
+  start [options]        Start one account without Hono
+  stop [options]         Stop one account
+  delete [options]       Permanently delete one account and its data
+
+Run "kintio ilink <command> --help" for command options.
 `;
+const ILINK_COMMANDS = new Set(['login', 'list', 'start', 'stop', 'delete']);
+const COMMANDS = new Set([
+    'setup',
+    'start',
+    'run',
+    'stop',
+    'restart',
+    'status',
+    'logs',
+    'ilink',
+]);
+const ILINK_SIGNALS = process.platform === 'win32'
+    ? ['SIGINT', 'SIGTERM']
+    : ['SIGINT', 'SIGTERM', 'SIGHUP'];
+function signalExitCode(signal) {
+    if (signal === 'SIGHUP')
+        return 129;
+    if (signal === 'SIGTERM')
+        return 143;
+    return 130;
+}
+async function runWithIlinkSignals(operation) {
+    const controller = new AbortController();
+    let interruptedBy;
+    const interrupt = (signal) => {
+        interruptedBy ||= signal;
+        controller.abort();
+    };
+    const listeners = ILINK_SIGNALS.map((signal) => ({
+        signal,
+        listener: () => interrupt(signal),
+    }));
+    for (const { signal, listener } of listeners)
+        process.once(signal, listener);
+    try {
+        const result = await operation(controller.signal);
+        return result === 130 && interruptedBy
+            ? signalExitCode(interruptedBy)
+            : result;
+    }
+    finally {
+        for (const { signal, listener } of listeners)
+            process.off(signal, listener);
+    }
+}
 function defaultExecute(request) {
     return new Promise((resolve, reject) => {
         const child = crossSpawn(request.file, [...request.args], {
@@ -108,6 +241,11 @@ function runtimeDefaults() {
         launchDaemon: defaultLaunchDaemon,
         stdout: (text) => process.stdout.write(text),
         stderr: (text) => process.stderr.write(text),
+        stdoutIsTTY: Boolean(process.stdout.isTTY),
+        stdoutColumns: process.stdout.columns || 80,
+        ilinkLogin: runIlinkCliLogin,
+        ilinkAccount: runIlinkAccountCommand,
+        ilinkStart: startIlinkCliRuntime,
     };
 }
 function resolveInputPath(value, cwd) {
@@ -508,6 +646,9 @@ export async function runCli(args, overrides = {}) {
                 config: { type: 'string' },
                 lines: { type: 'string' },
                 'no-follow': { type: 'boolean' },
+                'qr-output': { type: 'string' },
+                account: { type: 'string' },
+                yes: { type: 'boolean' },
                 help: { type: 'boolean', short: 'h' },
                 version: { type: 'boolean', short: 'v' },
             },
@@ -517,18 +658,118 @@ export async function runCli(args, overrides = {}) {
             return 0;
         }
         const command = parsed.positionals[0];
-        if (parsed.values.help || !command || command === 'help') {
+        const subcommand = parsed.positionals[1];
+        if (!command) {
+            if (parsed.values['qr-output'] !== undefined) {
+                throw new Error('--qr-output is valid only for "kintio ilink login"');
+            }
             runtime.stdout(HELP);
             return 0;
         }
-        if (parsed.positionals.length !== 1) {
-            throw new Error(`Unexpected argument: ${parsed.positionals[1]}`);
+        if (command === 'help') {
+            if (parsed.positionals.length !== 1) {
+                throw new Error(`Unexpected argument: ${subcommand}`);
+            }
+            runtime.stdout(HELP);
+            return 0;
+        }
+        if (!COMMANDS.has(command))
+            throw new Error(`Unknown command: ${command}`);
+        if (command === 'ilink') {
+            if (parsed.values.help && parsed.positionals.length === 1) {
+                runtime.stdout(ILINK_HELP);
+                return 0;
+            }
+            if (!subcommand || !ILINK_COMMANDS.has(subcommand) ||
+                parsed.positionals.length !== 2) {
+                throw new Error('Usage: kintio ilink <login|list|start|stop|delete>');
+            }
+        }
+        else if (parsed.positionals.length !== 1) {
+            throw new Error(`Unexpected argument: ${subcommand}`);
+        }
+        if (parsed.values.help) {
+            runtime.stdout(command !== 'ilink'
+                ? HELP
+                : subcommand === 'login' ? ILINK_LOGIN_HELP
+                    : subcommand === 'list' ? ILINK_LIST_HELP
+                        : subcommand === 'start' ? ILINK_START_HELP
+                            : subcommand === 'stop' ? ILINK_STOP_HELP
+                                : ILINK_DELETE_HELP);
+            return 0;
         }
         if (command !== 'logs' &&
             (parsed.values.lines !== undefined || parsed.values['no-follow'])) {
             throw new Error('--lines and --no-follow are valid only for "kintio logs"');
         }
+        if ((command !== 'ilink' || subcommand !== 'login') &&
+            parsed.values['qr-output'] !== undefined) {
+            throw new Error('--qr-output is valid only for "kintio ilink login"');
+        }
+        if (parsed.values['qr-output'] === '') {
+            throw new Error('--qr-output requires a non-empty file path');
+        }
+        if (parsed.values.account !== undefined &&
+            (command !== 'ilink' || !['start', 'stop', 'delete'].includes(subcommand || ''))) {
+            throw new Error('--account is valid only for "kintio ilink start|stop|delete"');
+        }
+        if (parsed.values.account === '') {
+            throw new Error('--account requires a non-empty account ID or key');
+        }
+        if (parsed.values.yes && (command !== 'ilink' || subcommand !== 'delete')) {
+            throw new Error('--yes is valid only for "kintio ilink delete"');
+        }
         const location = instanceLocation(parsed.values, runtime);
+        const qrOutputPath = parsed.values['qr-output'] === undefined
+            ? undefined
+            : resolveInputPath(parsed.values['qr-output'], runtime.cwd);
+        if (qrOutputPath && !samePath(path.dirname(qrOutputPath), location.home)) {
+            throw new Error('iLink QR output must be directly inside the instance directory');
+        }
+        if (command === 'ilink') {
+            if (privateFile(location.configFile, 'Kintio config')) {
+                assertTrustedDirectory(path.dirname(location.configFile), 'Kintio config directory', false);
+            }
+            prepareDirectories(location.home);
+            return await runWithIlinkSignals(async (signal) => {
+                const enrollmentConfig = loadIlinkEnrollmentConfig({
+                    environment: { ...runtime.env },
+                    envFile: location.configFile,
+                    root: location.home,
+                });
+                if (subcommand === 'login') {
+                    return await runtime.ilinkLogin({
+                        config: enrollmentConfig,
+                        packageRoot: runtime.packageRoot,
+                        stdout: runtime.stdout,
+                        stdoutIsTTY: runtime.stdoutIsTTY,
+                        stdoutColumns: runtime.stdoutColumns,
+                        ...(qrOutputPath ? { qrOutputPath } : {}),
+                        signal,
+                    });
+                }
+                const commandResult = await runtime.ilinkAccount({
+                    command: subcommand,
+                    ...(parsed.values.account ? { selector: parsed.values.account } : {}),
+                    confirmed: Boolean(parsed.values.yes),
+                    config: enrollmentConfig,
+                    packageRoot: runtime.packageRoot,
+                    signal,
+                    stdout: runtime.stdout,
+                });
+                if (subcommand !== 'start' || !commandResult.startForeground)
+                    return 0;
+                return await runtime.ilinkStart({
+                    config: loadIlinkRuntimeConfig({
+                        environment: { ...runtime.env },
+                        envFile: location.configFile,
+                        root: location.home,
+                    }),
+                    signal,
+                    stdout: runtime.stdout,
+                });
+            });
+        }
         if (command === 'setup')
             return setup(location, runtime);
         if (command === 'start')

package/dist/src/config.js

@@ -124,6 +124,40 @@ function parseBoundedText(value, fallback, name, maxBytes) {
     }
     return parsed;
 }
+function createIlinkEnrollmentConfig(environment = process.env, root, platform = process.platform) {
+    environment = copyEnvironment(environment);
+    const home = path.resolve(root || resolveInstanceRoot(environment));
+    const storageKey = String(environment.ILINK_STORAGE_KEY || '').trim();
+    if (storageKey && !/^[A-Za-z0-9_-]{43}$/u.test(storageKey)) {
+        throw new Error('ILINK_STORAGE_KEY must be a canonical 32-byte base64url value');
+    }
+    const state = resolveStateFiles(environment, home);
+    const storageKeyFile = path.resolve(home, environment.ILINK_STORAGE_KEY_FILE ||
+        path.join(path.dirname(state.databaseFile), 'ilink-storage.key'));
+    if (platform === 'win32') {
+        for (const [name, filePath] of [
+            ['KINTIO_DB_FILE', state.databaseFile],
+            ['Kintio state lock', state.lockFile],
+            ['ILINK_STORAGE_KEY_FILE', storageKeyFile],
+        ]) {
+            if (!isPathInside(home, filePath)) {
+                throw new Error(`${name} must stay inside KINTIO_HOME on Windows`);
+            }
+        }
+    }
+    return Object.freeze({
+        home,
+        state,
+        ilink: Object.freeze({
+            storageKey,
+            storageKeyFile,
+            baseUrl: environment.ILINK_BASE_URL || 'https://ilinkai.weixin.qq.com/',
+            apiTimeoutMs: parsePositiveInteger(environment.ILINK_API_TIMEOUT_MS, 15_000, 'ILINK_API_TIMEOUT_MS', 120_000),
+            longPollTimeoutMs: parsePositiveInteger(environment.ILINK_LONG_POLL_TIMEOUT_MS, 35_000, 'ILINK_LONG_POLL_TIMEOUT_MS', 120_000),
+            maxAccounts: parsePositiveInteger(environment.ILINK_MAX_ACCOUNTS, 20, 'ILINK_MAX_ACCOUNTS', 1_000),
+        }),
+    });
+}
 export function createConfig(environment = process.env, root, platform = process.platform) {
     environment = copyEnvironment(environment);
     const instanceRoot = path.resolve(root || resolveInstanceRoot(environment));
@@ -150,22 +184,14 @@ export function createConfig(environment = process.env, root, platform = process
     }
     const ilinkEnabled = parseBoolean(environment.ILINK_ENABLED, false);
     const codexEnabled = parseBoolean(environment.CODEX_ENABLED, apiEnabled || ilinkEnabled);
-    const ilinkStorageKey = String(environment.ILINK_STORAGE_KEY || '').trim();
-    if (ilinkStorageKey && !/^[A-Za-z0-9_-]{43}$/u.test(ilinkStorageKey)) {
-        throw new Error('ILINK_STORAGE_KEY must be a canonical 32-byte base64url value');
-    }
-    const { databaseFile, lockFile } = resolveStateFiles(environment, instanceRoot);
+    const enrollment = createIlinkEnrollmentConfig(environment, instanceRoot, platform);
+    const { databaseFile, lockFile } = enrollment.state;
     const codexWorkingDirectory = path.resolve(instanceRoot, environment.CODEX_WORKING_DIRECTORY ||
         'codex-workspace');
-    const ilinkStorageKeyFile = path.resolve(instanceRoot, environment.ILINK_STORAGE_KEY_FILE ||
-        path.join(path.dirname(databaseFile), 'ilink-storage.key'));
     const codexImageTempDirectory = path.resolve(instanceRoot, environment.CODEX_IMAGE_TMP_DIR ||
         'data/codex-input');
     if (platform === 'win32') {
         for (const [name, filePath] of [
-            ['KINTIO_DB_FILE', databaseFile],
-            ['Kintio state lock', lockFile],
-            ['ILINK_STORAGE_KEY_FILE', ilinkStorageKeyFile],
             ['CODEX_IMAGE_TMP_DIR', codexImageTempDirectory],
         ]) {
             if (!isPathInside(instanceRoot, filePath)) {
@@ -201,12 +227,7 @@ export function createConfig(environment = process.env, root, platform = process
         }),
         ilink: Object.freeze({
             enabled: ilinkEnabled,
-            storageKey: ilinkStorageKey,
-            storageKeyFile: ilinkStorageKeyFile,
-            baseUrl: environment.ILINK_BASE_URL || 'https://ilinkai.weixin.qq.com/',
-            apiTimeoutMs: parsePositiveInteger(environment.ILINK_API_TIMEOUT_MS, 15_000, 'ILINK_API_TIMEOUT_MS', 120_000),
-            longPollTimeoutMs: parsePositiveInteger(environment.ILINK_LONG_POLL_TIMEOUT_MS, 35_000, 'ILINK_LONG_POLL_TIMEOUT_MS', 120_000),
-            maxAccounts: parsePositiveInteger(environment.ILINK_MAX_ACCOUNTS, 20, 'ILINK_MAX_ACCOUNTS', 1_000),
+            ...enrollment.ilink,
         }),
         state: Object.freeze({
             databaseFile,
@@ -222,6 +243,10 @@ export function createConfig(environment = process.env, root, platform = process
     });
 }
 export function loadConfig(options = {}) {
+    const loaded = loadConfigurationEnvironment(options);
+    return createConfig(loaded.environment, loaded.root);
+}
+function loadConfigurationEnvironment(options) {
     const environment = copyEnvironment(options.environment || process.env);
     const configuredEnvFile = options.envFile || environment.KINTIO_CONFIG_FILE;
     const defaultRoot = path.join(path.resolve(options.homeDirectory || os.homedir()), '.kintio');
@@ -233,5 +258,35 @@ export function loadConfig(options = {}) {
     const envFile = path.resolve(configuredEnvFile || path.join(initialRoot, '.env'));
     loadEnvironmentFile(envFile, environment);
     const root = path.resolve(options.root || environment.KINTIO_HOME || initialRoot);
-    return createConfig(environment, root);
+    return { environment, root };
+}
+export function loadIlinkEnrollmentConfig(options = {}) {
+    const loaded = loadConfigurationEnvironment(options);
+    return createIlinkEnrollmentConfig(loaded.environment, loaded.root);
+}
+export function loadIlinkRuntimeConfig(options = {}) {
+    const { environment, root } = loadConfigurationEnvironment(options);
+    const enrollment = createIlinkEnrollmentConfig(environment, root);
+    const workingDirectory = path.resolve(root, environment.CODEX_WORKING_DIRECTORY || 'codex-workspace');
+    const imageTempDirectory = path.resolve(root, environment.CODEX_IMAGE_TMP_DIR || 'data/codex-input');
+    if (process.platform === 'win32' && !isPathInside(root, imageTempDirectory)) {
+        throw new Error('CODEX_IMAGE_TMP_DIR must stay inside KINTIO_HOME on Windows');
+    }
+    const shutdownTimeoutMs = parsePositiveInteger(environment.SHUTDOWN_TIMEOUT_MS, 10_000, 'SHUTDOWN_TIMEOUT_MS', MAX_SHUTDOWN_TIMEOUT_MS);
+    if (shutdownTimeoutMs < 1_000) {
+        throw new Error('SHUTDOWN_TIMEOUT_MS must be at least 1000');
+    }
+    return Object.freeze({
+        state: Object.freeze({
+            ...enrollment.state,
+            shutdownTimeoutMs,
+        }),
+        ilink: Object.freeze({ enabled: true, ...enrollment.ilink }),
+        codex: Object.freeze({
+            enabled: true,
+            imageTempDirectory,
+            workingDirectory,
+            generatedImageDirectory: path.join(workingDirectory, 'generated_images'),
+        }),
+    });
 }