@love-moon/conductor-cli 0.2.22 → 0.2.24

package/bin/conductor-config.js

@@ -12,9 +12,10 @@ import { RUNTIME_SUPPORTED_BACKENDS } from "../src/runtime-backends.js";
 
 const CONFIG_DIR = path.join(os.homedir(), ".conductor");
 const CONFIG_FILE = path.join(CONFIG_DIR, "config.yaml");
+const packageJson = JSON.parse(
+  fs.readFileSync(new URL("../package.json", import.meta.url), "utf-8"),
+);
 
-// 市面上主流 Coding CLI 配置
-// 格式: { name: { command: string, description: string, execArgs?: string } }
 const DEFAULT_CLIs = {
   claude: {
     command: "claude",
@@ -26,21 +27,11 @@ const DEFAULT_CLIs = {
     execArgs: "--dangerously-bypass-approvals-and-sandbox --ask-for-approval never",
     description: "OpenAI Codex CLI"
   },
-  // gemini: {
-  //   command: "gemini",
-  //   execArgs: "",
-  //   description: "Google Gemini CLI"
-  // },
   opencode: {
     command: "opencode",
     execArgs: "",
     description: "OpenCode CLI (Conductor runs opencode serve with permission=allow)"
   },
-  // kimi: {
-  //   command: "kimi",
-  //   execArgs: "--yolo --print --prompt",
-  //   description: "Kimi CLI"
-  // },
 };
 
 const backendUrl =
@@ -48,8 +39,8 @@ const backendUrl =
   process.env.BACKEND_URL ||
   "https://conductor-ai.top";
 const defaultDaemonName = os.hostname() || "my-daemon";
+const cliVersion = packageJson.version || "unknown";
 
-// ANSI 颜色代码
 const COLORS = {
   yellow: "\x1b[33m",
   green: "\x1b[32m",
@@ -58,6 +49,8 @@ const COLORS = {
   bold: "\x1b[1m"
 };
 
+let lastDeviceAuthConfig = null;
+
 function colorize(text, color) {
   return `${COLORS[color] || ""}${text}${COLORS.reset}`;
 }
@@ -79,11 +72,15 @@ function buildConfigEntryLines(cli, info, { commented = false } = {}) {
 }
 
 async function main() {
-  // 解析命令行参数
   const argv = yargs(hideBin(process.argv))
     .option("token", {
       type: "string",
-      description: "Conductor token (optional, will prompt if not provided)"
+      description: "Conductor token"
+    })
+    .option("manual", {
+      type: "boolean",
+      default: false,
+      description: "Enter token manually instead of browser device authorization"
     })
     .option("force", {
       type: "boolean",
@@ -96,13 +93,13 @@ async function main() {
       description: "Show help"
     })
     .usage("Usage: conductor config [options]")
-    .example("conductor config", "Interactive configuration")
-    .example("conductor config --token <your-token>", "Configure with token")
+    .example("conductor config", "Authorize this device in the browser and write config")
+    .example("conductor config --manual", "Enter token manually")
+    .example("conductor config --token <token>", "Configure with token")
     .example("conductor config --token <token> --force", "Force overwrite existing config")
     .help()
     .argv;
 
-  // 检查配置文件是否存在
   if (fs.existsSync(CONFIG_FILE) && !argv.force) {
     process.stderr.write(
       colorize(`Config already exists at ${CONFIG_FILE}. Use --force to overwrite.\n`, "yellow")
@@ -110,66 +107,68 @@ async function main() {
     process.exit(1);
   }
 
-  // 获取 token
-  let token = argv.token;
-  if (!token) {
-    token = await promptForToken();
-    if (!token) {
-      process.stderr.write(colorize("No token provided. Aborting.\n", "yellow"));
-      process.exit(1);
-    }
-  }
-
-  // 检测已安装的 CLI
+  let resolvedBackendUrl = backendUrl;
+  let resolvedWebsocketUrl = null;
   const detectedCLIs = detectInstalledCLIs();
 
-  // 如果没有检测到任何 CLI，显示警告
   if (detectedCLIs.length === 0) {
     console.log("");
     console.log(colorize("=".repeat(70), "yellow"));
     console.log(colorize("⚠️  WARNING: No coding CLI detected!", "yellow"));
     console.log(colorize("=".repeat(70), "yellow"));
-    console.log(colorize("", "yellow"));
+    console.log("");
     console.log(colorize("Conductor requires at least one coding CLI to work properly.", "yellow"));
-    console.log(colorize("", "yellow"));
+    console.log("");
     console.log(colorize("Please install one of the following CLIs first:", "yellow"));
     console.log("");
-    
-    Object.entries(DEFAULT_CLIs).forEach(([key, info]) => {
+
+    Object.entries(DEFAULT_CLIs).forEach(([, info]) => {
       console.log(`  • ${colorize(info.command, "cyan")} - ${info.description}`);
     });
-    
+
     console.log("");
     console.log(colorize("After installing a CLI, run 'conductor config' again.", "yellow"));
     console.log(colorize("=".repeat(70), "yellow"));
     console.log("");
-    
-    // 询问是否继续创建配置
+
     const shouldContinue = await promptYesNo(
       "Do you want to continue creating the config anyway? (y/N): "
     );
-    
+
     if (!shouldContinue) {
       process.exit(1);
     }
   } else {
-    // 显示检测到的 CLI
     console.log("");
     console.log(colorize("✓ Detected the following coding CLIs:", "green"));
-    detectedCLIs.forEach(cli => {
+    detectedCLIs.forEach((cli) => {
       const info = DEFAULT_CLIs[cli];
       console.log(`  • ${colorize(info.command, "cyan")} - ${info.description}`);
     });
     console.log("");
   }
 
-  // 创建配置目录
+  let token = argv.token;
+  if (!token) {
+    if (argv.manual) {
+      token = await promptForToken();
+      if (!token) {
+        process.stderr.write(colorize("No token provided. Aborting.\n", "yellow"));
+        process.exit(1);
+      }
+    } else {
+      const authResult = await authorizeDeviceAndGetToken();
+      token = authResult.agentToken;
+      resolvedBackendUrl = authResult.backendUrl || resolvedBackendUrl;
+      resolvedWebsocketUrl = authResult.websocketUrl || null;
+    }
+  }
+
   fs.mkdirSync(CONFIG_DIR, { recursive: true });
 
-  // 构建配置内容
   const lines = [
     `agent_token: ${yamlQuote(token)}`,
-    `backend_url: ${yamlQuote(backendUrl)}`,
+    `backend_url: ${yamlQuote(resolvedBackendUrl)}`,
     `daemon_name: ${yamlQuote(defaultDaemonName)}`,
     "log_level: debug",
     "workspace: '~/ws/fires'",
@@ -178,14 +177,16 @@ async function main() {
     "allow_cli_list:"
   ];
 
-  // 添加检测到的 CLI 到配置
+  if (resolvedWebsocketUrl) {
+    lines.splice(2, 0, `websocket_url: ${yamlQuote(resolvedWebsocketUrl)}`);
+  }
+
   if (detectedCLIs.length > 0) {
-    detectedCLIs.forEach(cli => {
+    detectedCLIs.forEach((cli) => {
       const info = DEFAULT_CLIs[cli];
       lines.push(...buildConfigEntryLines(cli, info));
     });
   } else {
-    // 如果没有检测到任何 CLI，添加示例注释
     lines.push("  # No CLI detected. Add your installed CLI here:");
     Object.entries(DEFAULT_CLIs).forEach(([key, info]) => {
       lines.push(...buildConfigEntryLines(key, info, { commented: true }));
@@ -202,22 +203,18 @@ async function main() {
   );
 
   fs.writeFileSync(CONFIG_FILE, lines.join("\n"), "utf-8");
-  
+
   console.log(colorize(`✓ Wrote Conductor config to ${CONFIG_FILE}`, "green"));
-  
+
   if (detectedCLIs.length === 0) {
     console.log("");
     console.log(colorize("⚠️  Remember to install a coding CLI before using Conductor!", "yellow"));
   }
 }
 
-/**
- * 检测系统中已安装的 CLI
- * @returns {string[]} 已安装的 CLI key 列表
- */
 function detectInstalledCLIs() {
   const detected = [];
-  
+
   for (const [key, info] of Object.entries(DEFAULT_CLIs)) {
     if (!RUNTIME_SUPPORTED_BACKENDS.includes(key)) {
       continue;
@@ -226,52 +223,29 @@ function detectInstalledCLIs() {
       detected.push(key);
     }
   }
-  
+
   return detected;
 }
 
-/**
- * 检查命令是否在系统 PATH 中可用
- * @param {string} command - 命令名称
- * @returns {boolean}
- */
 function isCommandAvailable(command) {
   try {
     const platform = os.platform();
-    let checkCmd;
-    
-    if (platform === "win32") {
-      // Windows: 使用 where 命令
-      checkCmd = `where ${command}`;
-    } else {
-      // Unix/Linux/macOS: 使用 which 或 command -v
-      checkCmd = `command -v ${command}`;
-    }
-    
-    execSync(checkCmd, { 
+    const checkCmd = platform === "win32" ? `where ${command}` : `command -v ${command}`;
+    execSync(checkCmd, {
       stdio: "pipe",
-      timeout: 5000 
+      timeout: 5000
     });
     return true;
-  } catch (error) {
-    // 对于某些 CLI，可能有特定的检测方式
-    // 例如检查特定的配置文件或目录
+  } catch {
     return checkAlternativeInstallations(command);
   }
 }
 
-/**
- * 检查 CLI 的替代安装方式
- * @param {string} command - 命令名称
- * @returns {boolean}
- */
 function checkAlternativeInstallations(command) {
-  // 检查常见的全局安装路径
   const homeDir = os.homedir();
   const platform = os.platform();
-  
   const commonPaths = [];
-  
+
   if (platform === "win32") {
     commonPaths.push(
       path.join(homeDir, "AppData", "Roaming", "npm", `${command}.cmd`),
@@ -290,15 +264,89 @@ function checkAlternativeInstallations(command) {
       `/opt/${command}/bin/${command}`
     );
   }
-  
-  // 检查文件是否存在
-  for (const checkPath of commonPaths) {
-    if (fs.existsSync(checkPath)) {
-      return true;
+
+  return commonPaths.some((checkPath) => fs.existsSync(checkPath));
+}
+
+async function authorizeDeviceAndGetToken() {
+  const startResponse = await fetch(new URL("/api/auth/device/start", backendUrl), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      cli_version: cliVersion,
+      hostname: defaultDaemonName,
+      platform: os.platform(),
+      backend_url: backendUrl,
+    }),
+  });
+  const startData = await parseJsonResponse(startResponse);
+  if (!startResponse.ok) {
+    throw new Error(startData.error || `Failed to start device authorization (${startResponse.status})`);
+  }
+
+  console.log("");
+  console.log(colorize("Open this link in your browser to authorize this device:", "cyan"));
+  console.log("");
+  console.log(`Device code: ${colorize(startData.user_code, "bold")}`);
+  console.log(`Direct link: ${startData.verification_uri_complete}`);
+  console.log("");
+  console.log("Only approve the request if the web page shows the same device code.");
+  console.log("");
+  console.log("Waiting for authorization...");
+
+  const intervalSeconds =
+    typeof startData.interval === "number" && Number.isFinite(startData.interval)
+      ? Math.max(1, startData.interval)
+      : 3;
+  const expiresInSeconds =
+    typeof startData.expires_in === "number" && Number.isFinite(startData.expires_in)
+      ? Math.max(intervalSeconds, startData.expires_in)
+      : 600;
+  const deadlineAt = Date.now() + expiresInSeconds * 1000;
+
+  while (Date.now() <= deadlineAt) {
+    await sleep(intervalSeconds * 1000);
+
+    const pollResponse = await fetch(new URL("/api/auth/device/poll", backendUrl), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: startData.device_code }),
+    });
+    const pollData = await parseJsonResponse(pollResponse);
+    if (!pollResponse.ok) {
+      throw new Error(pollData.error || `Failed to poll device authorization (${pollResponse.status})`);
     }
+
+    if (pollData.status === "pending") {
+      continue;
+    }
+    if (pollData.status === "approved") {
+      const result = {
+        agentToken: pollData.agent_token,
+        backendUrl: pollData.backend_url || backendUrl,
+        websocketUrl: pollData.websocket_url || null,
+      };
+      lastDeviceAuthConfig = result;
+      console.log(colorize("✓ Device authorized", "green"));
+      return result;
+    }
+    if (pollData.status === "denied" || pollData.status === "expired" || pollData.status === "consumed") {
+      throw new Error(pollData.message || `Device authorization ${pollData.status}`);
+    }
+    if (pollData.error) {
+      throw new Error(pollData.error);
+    }
+  }
+
+  throw new Error("Device authorization timed out");
+}
+
+async function parseJsonResponse(response) {
+  try {
+    return await response.json();
+  } catch {
+    return {};
   }
-  
-  return false;
 }
 
 async function promptForToken() {
@@ -330,6 +378,12 @@ async function promptYesNo(question) {
   }
 }
 
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
 function yamlQuote(value) {
   return JSON.stringify(value);
 }

package/bin/conductor-update.js

@@ -17,6 +17,10 @@ import {
   isNewerVersion,
   detectPackageManager,
 } from "../src/version-check.js";
+import {
+  ensurePnpmOnlyBuiltDependencies,
+  repairAndVerifyGlobalNodePty,
+} from "../src/native-deps.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -140,41 +144,50 @@ async function confirmUpdate(version) {
 }
 
 async function performUpdate() {
-  return new Promise((resolve, reject) => {
-    // 检测使用的包管理器
-    const packageManager = detectPackageManager({
-      launcherPath: process.env.CONDUCTOR_LAUNCHER_SCRIPT || process.argv[1],
-      packageRoot: PKG_ROOT,
+  const packageManager = detectPackageManager({
+    launcherPath: process.env.CONDUCTOR_LAUNCHER_SCRIPT || process.argv[1],
+    packageRoot: PKG_ROOT,
+  });
+  console.log(`   Using package manager: ${colorize(packageManager, "cyan")}`);
+  console.log("");
+
+  if (packageManager === "pnpm") {
+    console.log("   Preparing pnpm native dependency allowlist...");
+    await ensurePnpmOnlyBuiltDependencies({
+      runCommand: runBufferedCommand,
+      dependencies: ["node-pty"],
+      global: true,
     });
-    console.log(`   Using package manager: ${colorize(packageManager, "cyan")}`);
     console.log("");
-    
-    let cmd, args;
-    
-    switch (packageManager) {
-      case "pnpm":
-        cmd = "pnpm";
-        args = ["add", "-g", `${PACKAGE_NAME}@latest`];
-        break;
-      case "yarn":
-        cmd = "yarn";
-        args = ["global", "add", `${PACKAGE_NAME}@latest`];
-        break;
-      case "npm":
-      default:
-        cmd = "npm";
-        args = ["install", "-g", `${PACKAGE_NAME}@latest`];
-        break;
-    }
-    
-    console.log(`   Running: ${colorize(`${cmd} ${args.join(" ")}`, "cyan")}`);
-    console.log("");
-    
+  }
+
+  let cmd, args;
+
+  switch (packageManager) {
+    case "pnpm":
+      cmd = "pnpm";
+      args = ["add", "-g", `${PACKAGE_NAME}@latest`];
+      break;
+    case "yarn":
+      cmd = "yarn";
+      args = ["global", "add", `${PACKAGE_NAME}@latest`];
+      break;
+    case "npm":
+    default:
+      cmd = "npm";
+      args = ["install", "-g", `${PACKAGE_NAME}@latest`];
+      break;
+  }
+
+  console.log(`   Running: ${colorize(`${cmd} ${args.join(" ")}`, "cyan")}`);
+  console.log("");
+
+  await new Promise((resolve, reject) => {
     const child = spawn(cmd, args, {
       stdio: "inherit",
       shell: true
     });
-    
+
     child.on("close", (code) => {
       if (code === 0) {
         resolve();
@@ -182,11 +195,59 @@ async function performUpdate() {
         reject(new Error(`Exit code ${code}`));
       }
     });
-    
+
     child.on("error", (error) => {
       reject(error);
     });
   });
+
+  console.log("   Repairing and verifying node-pty native binding...");
+  await repairAndVerifyGlobalNodePty({
+    packageManager,
+    packageName: PACKAGE_NAME,
+    runCommand: runBufferedCommand,
+    nodeExecutable: process.execPath,
+  });
+}
+
+function runBufferedCommand(command, args, options = {}) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    const child = spawn(command, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: false,
+      env: options.env || process.env,
+      cwd: options.cwd || process.cwd(),
+    });
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+        // ignore timeout failures
+      }
+    }, options.timeoutMs || 20_000);
+
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < 16_000) stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      if (stderr.length < 16_000) stderr += chunk.toString();
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({ success: code === 0, code, stdout, stderr });
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({
+        success: false,
+        code: -1,
+        stdout,
+        stderr: error instanceof Error ? error.message : String(error),
+      });
+    });
+  });
 }
 
 function showHelpMessage() {

package/bin/conductor-verify-node-pty.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+
+import process from "node:process";
+
+import { verifyNodePtyForPackageDirectory } from "../src/native-deps.js";
+
+async function main() {
+  const packageDirectory = process.argv[2];
+  if (!packageDirectory) {
+    process.stderr.write("Usage: conductor-verify-node-pty <package-directory>\n");
+    process.exit(1);
+    return;
+  }
+
+  await verifyNodePtyForPackageDirectory({
+    packageDirectory,
+  });
+  process.stdout.write("Verified node-pty native binding\n");
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exit(1);
+});

package/bin/conductor.js

@@ -87,7 +87,9 @@ const isDirectExecution = (() => {
     return false;
   }
   try {
-    return pathToFileURL(entryPath).href === import.meta.url;
+    const entryRealPath = fs.realpathSync(entryPath);
+    const currentRealPath = fs.realpathSync(__filename);
+    return pathToFileURL(entryRealPath).href === pathToFileURL(currentRealPath).href;
   } catch {
     return false;
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@love-moon/conductor-cli",
-  "version": "0.2.22",
-  "gitCommitId": "d04b18c",
+  "version": "0.2.24",
+  "gitCommitId": "1774cf6",
   "type": "module",
   "bin": {
     "conductor": "bin/conductor.js"
@@ -17,8 +17,8 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@love-moon/ai-sdk": "0.2.22",
-    "@love-moon/conductor-sdk": "0.2.22",
+    "@love-moon/ai-sdk": "0.2.24",
+    "@love-moon/conductor-sdk": "0.2.24",
     "dotenv": "^16.4.5",
     "enquirer": "^2.4.1",
     "js-yaml": "^4.1.1",

package/src/daemon.js

@@ -20,6 +20,10 @@ import {
   isInUpdateWindow,
   isManagedInstallPath,
 } from "./version-check.js";
+import {
+  ensurePnpmOnlyBuiltDependencies,
+  repairAndVerifyGlobalNodePty,
+} from "./native-deps.js";
 
 dotenv.config();
 
@@ -48,6 +52,39 @@ const DEFAULT_TERMINAL_RING_BUFFER_MAX_BYTES = 2 * 1024 * 1024;
 const DEFAULT_RTC_MODULE_CANDIDATES = ["@roamhq/wrtc", "wrtc"];
 let nodePtySpawnPromise = null;
 
+function resolveNodePtySpawnExport(mod) {
+  if (typeof mod?.spawn === "function") {
+    return mod.spawn;
+  }
+  if (mod?.default && typeof mod.default.spawn === "function") {
+    return mod.default.spawn.bind(mod.default);
+  }
+  throw new Error("node-pty spawn export not found");
+}
+
+export function probePtyTaskCapability({
+  requireFn = moduleRequire,
+  ensureSpawnHelperExecutableFn = ensureNodePtySpawnHelperExecutable,
+} = {}) {
+  try {
+    const spawnHelperInfo = ensureSpawnHelperExecutableFn();
+    const spawnPty = resolveNodePtySpawnExport(requireFn("node-pty"));
+    return {
+      enabled: true,
+      reason: null,
+      spawnHelperInfo,
+      spawnPty,
+    };
+  } catch (error) {
+    return {
+      enabled: false,
+      reason: error instanceof Error ? error.message : String(error),
+      spawnHelperInfo: null,
+      spawnPty: null,
+    };
+  }
+}
+
 function appendDaemonLog(line) {
   try {
     fs.mkdirSync(DAEMON_LOG_DIR, { recursive: true });
@@ -154,20 +191,48 @@ async function defaultCreatePty(command, args, options) {
     if (spawnHelperInfo?.updated) {
       log(`Enabled execute permission on node-pty spawn-helper: ${spawnHelperInfo.helperPath}`);
     }
-    nodePtySpawnPromise = import("node-pty").then((mod) => {
-      if (typeof mod.spawn === "function") {
-        return mod.spawn;
-      }
-      if (mod.default && typeof mod.default.spawn === "function") {
-        return mod.default.spawn.bind(mod.default);
-      }
-      throw new Error("node-pty spawn export not found");
-    });
+    nodePtySpawnPromise = Promise.resolve(resolveNodePtySpawnExport(moduleRequire("node-pty")));
   }
   const spawnPty = await nodePtySpawnPromise;
   return spawnPty(command, args, options);
 }
 
+export function resolveDefaultPtyShell({
+  explicitShell,
+  envShell = process.env.SHELL,
+  comspec = process.env.COMSPEC,
+  platform = process.platform,
+  existsSync = fs.existsSync,
+} = {}) {
+  const normalizedExplicitShell = normalizeOptionalString(explicitShell);
+  if (normalizedExplicitShell) {
+    return normalizedExplicitShell;
+  }
+
+  const normalizedEnvShell = normalizeOptionalString(envShell);
+  if (normalizedEnvShell) {
+    return normalizedEnvShell;
+  }
+
+  if (platform === "win32") {
+    return normalizeOptionalString(comspec) || "cmd.exe";
+  }
+
+  if (platform === "darwin") {
+    return "/bin/zsh";
+  }
+
+  if (existsSync("/bin/bash")) {
+    return "/bin/bash";
+  }
+
+  if (existsSync("/bin/sh")) {
+    return "/bin/sh";
+  }
+
+  return "/bin/bash";
+}
+
 export function ensureNodePtySpawnHelperExecutable(deps = {}) {
   const platform = deps.platform || process.platform;
   if (platform === "win32") {
@@ -284,6 +349,15 @@ export function startDaemon(config = {}, deps = {}) {
   let requestShutdown = async () => {};
   let shutdownSignalHandled = false;
   let forcedSignalExitHandled = false;
+  let processHandlersAttached = false;
+
+  const removeProcessListener = (eventName, handler) => {
+    if (typeof process.off === "function") {
+      process.off(eventName, handler);
+      return;
+    }
+    process.removeListener(eventName, handler);
+  };
 
   const exitAndReturn = (code) => {
     exitFn(code);
@@ -597,7 +671,6 @@ export function startDaemon(config = {}, deps = {}) {
     );
   };
 
-  process.on("exit", cleanupLock);
   const signalExitCode = (signal) => (signal === "SIGINT" ? 130 : 143);
   const handleSignal = (signal) => {
     if (shutdownSignalHandled) {
@@ -621,17 +694,33 @@ export function startDaemon(config = {}, deps = {}) {
       }
     })();
   };
-  process.on("SIGINT", () => {
+  const onSigInt = () => {
     handleSignal("SIGINT");
-  });
-  process.on("SIGTERM", () => {
+  };
+  const onSigTerm = () => {
     handleSignal("SIGTERM");
-  });
-  process.on("uncaughtException", (err) => {
+  };
+  const onUncaughtException = (err) => {
     logError(`Uncaught exception: ${err}`);
     cleanupLock();
     exitFn(1);
-  });
+  };
+  const detachProcessHandlers = () => {
+    if (!processHandlersAttached) {
+      return;
+    }
+    processHandlersAttached = false;
+    removeProcessListener("exit", cleanupLock);
+    removeProcessListener("SIGINT", onSigInt);
+    removeProcessListener("SIGTERM", onSigTerm);
+    removeProcessListener("uncaughtException", onUncaughtException);
+  };
+
+  process.on("exit", cleanupLock);
+  process.on("SIGINT", onSigInt);
+  process.on("SIGTERM", onSigTerm);
+  process.on("uncaughtException", onUncaughtException);
+  processHandlersAttached = true;
 
   if (config.CLEAN_ALL) {
     cleanAllAgents(BACKEND_HTTP, AGENT_TOKEN, fetchFn)
@@ -641,8 +730,11 @@ export function startDaemon(config = {}, deps = {}) {
       .catch((err) => {
         log(`Failed to clean daemons: ${err.message}`);
       })
-      .finally(() => exitFn(0));
-    return { close: () => {} };
+      .finally(() => {
+        detachProcessHandlers();
+        exitFn(0);
+      });
+    return { close: detachProcessHandlers };
   }
 
   log("Daemon starting...");
@@ -692,13 +784,40 @@ export function startDaemon(config = {}, deps = {}) {
   let rtcAvailabilityLogKey = null;
   const logCollector = createLogCollector(BACKEND_HTTP);
   const createPtyFn = deps.createPty || defaultCreatePty;
+  const resolvePtyTaskCapabilityFn =
+    deps.resolvePtyTaskCapability ||
+    (deps.createPty
+      ? (() => ({ enabled: true, reason: null, spawnHelperInfo: null, spawnPty: null }))
+      : probePtyTaskCapability);
+  let ptyTaskCapability;
+  try {
+    ptyTaskCapability = resolvePtyTaskCapabilityFn();
+  } catch (error) {
+    ptyTaskCapability = {
+      enabled: false,
+      reason: error instanceof Error ? error.message : String(error),
+      spawnHelperInfo: null,
+      spawnPty: null,
+    };
+  }
+  const ptyTaskCapabilityEnabled = ptyTaskCapability?.enabled !== false;
+  const ptyTaskCapabilityError = normalizeOptionalString(ptyTaskCapability?.reason);
+  if (ptyTaskCapability?.spawnHelperInfo?.updated) {
+    log(`Enabled execute permission on node-pty spawn-helper: ${ptyTaskCapability.spawnHelperInfo.helperPath}`);
+  }
+  if (!ptyTaskCapabilityEnabled) {
+    logError(`[pty] Disabled PTY capability: ${ptyTaskCapabilityError || "unknown error"}`);
+  }
+  const extraHeaders = {
+    "x-conductor-host": AGENT_NAME,
+    "x-conductor-backends": SUPPORTED_BACKENDS.join(","),
+    "x-conductor-version": cliVersion,
+  };
+  if (ptyTaskCapabilityEnabled) {
+    extraHeaders["x-conductor-capabilities"] = "pty_task";
+  }
   const client = createWebSocketClient(sdkConfig, {
-    extraHeaders: {
-      "x-conductor-host": AGENT_NAME,
-      "x-conductor-backends": SUPPORTED_BACKENDS.join(","),
-      "x-conductor-capabilities": "pty_task",
-      "x-conductor-version": cliVersion,
-    },
+    extraHeaders,
     onConnected: ({ isReconnect, connectedAt } = { isReconnect: false, connectedAt: Date.now() }) => {
       wsConnected = true;
       lastConnectedAt = connectedAt || Date.now();
@@ -1054,6 +1173,14 @@ export function startDaemon(config = {}, deps = {}) {
     });
   }
 
+  function runBufferedCommand(command, args, options = {}) {
+    return runCommand(
+      command,
+      args,
+      typeof options === "number" ? options : options?.timeoutMs ?? 120_000,
+    );
+  }
+
   async function readInstalledCliVersion() {
     const commandAttempts = versionCheckScript
       ? [{
@@ -1090,6 +1217,16 @@ export function startDaemon(config = {}, deps = {}) {
       packageRoot: installedPackageRoot,
     });
     const pkgSpec = `${PACKAGE_NAME}@${targetVersion}`;
+
+    if (pm === "pnpm") {
+      log("[auto-update] Preparing pnpm native dependency allowlist for node-pty");
+      await ensurePnpmOnlyBuiltDependencies({
+        runCommand: runBufferedCommand,
+        dependencies: ["node-pty"],
+        global: true,
+      });
+    }
+
     log(`[auto-update] Installing ${pkgSpec} via ${pm}...`);
 
     // Step 1: install
@@ -1118,7 +1255,19 @@ export function startDaemon(config = {}, deps = {}) {
       throw new Error(`Version verification failed: ${verifyErr?.message || verifyErr}`);
     }
 
-    log(`[auto-update] Verified ${targetVersion}. Restarting daemon...`);
+    // Step 4: repair and verify native dependencies before shutting down the healthy daemon.
+    try {
+      await repairAndVerifyGlobalNodePty({
+        packageManager: pm,
+        packageName: PACKAGE_NAME,
+        runCommand: runBufferedCommand,
+        nodeExecutable: process.execPath,
+      });
+    } catch (verifyErr) {
+      throw new Error(`Native dependency verification failed: ${verifyErr?.message || verifyErr}`);
+    }
+
+    log(`[auto-update] Verified ${targetVersion} and node-pty. Restarting daemon...`);
 
     let logFd = null;
     if (isBackgroundProcess) {
@@ -1133,10 +1282,10 @@ export function startDaemon(config = {}, deps = {}) {
       logFd = fs.openSync(DAEMON_LOG_PATH, "a");
     }
 
-    // Step 4: graceful shutdown
+    // Step 5: graceful shutdown
     await shutdownDaemon("auto-update");
 
-    // Step 5: re-spawn (only in background/nohup mode)
+    // Step 6: re-spawn (only in background/nohup mode)
     if (isBackgroundProcess) {
       const handoffToken = `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
       const handoffExpiresAt = Date.now() + 15_000;
@@ -1403,6 +1552,31 @@ export function startDaemon(config = {}, deps = {}) {
     });
   }
 
+  function rejectCreatePtyTaskUnavailable(payload) {
+    const taskId = payload?.task_id ? String(payload.task_id) : "";
+    const projectId = payload?.project_id ? String(payload.project_id) : "";
+    const ptySessionId = payload?.pty_session_id ? String(payload.pty_session_id) : null;
+    const requestId = payload?.request_id ? String(payload.request_id) : "";
+    const message = ptyTaskCapabilityError
+      ? `pty runtime unavailable: ${ptyTaskCapabilityError}`
+      : "pty runtime unavailable";
+    log(`Rejecting create_pty_task for ${taskId || "unknown"}: ${message}`);
+    sendAgentCommandAck({
+      requestId,
+      taskId,
+      eventType: "create_pty_task",
+      accepted: false,
+    }).catch(() => {});
+    sendTerminalEvent("terminal_error", {
+      task_id: taskId || undefined,
+      project_id: projectId || undefined,
+      pty_session_id: ptySessionId,
+      message,
+    }).catch((err) => {
+      logError(`Failed to report PTY capability rejection for ${taskId || "unknown"}: ${err?.message || err}`);
+    });
+  }
+
   function sendPtyTransportSignal(payload) {
     return client.sendJson({
       type: "pty_transport_signal",
@@ -1629,10 +1803,13 @@ export function startDaemon(config = {}, deps = {}) {
       normalizeOptionalString(normalizedLaunchConfig.toolPreset)
         ? "tool_preset"
         : "shell");
-    const preferredShell =
-      normalizeOptionalString(normalizedLaunchConfig.shell) ||
-      process.env.SHELL ||
-      "/bin/zsh";
+    const preferredShell = resolveDefaultPtyShell({
+      explicitShell: normalizedLaunchConfig.shell,
+      envShell: process.env.SHELL,
+      comspec: process.env.COMSPEC,
+      platform: process.platform,
+      existsSync: existsSyncFn,
+    });
     const cwd =
       normalizeOptionalString(normalizedLaunchConfig.cwd) ||
       fallbackCwd;
@@ -1880,6 +2057,16 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    if (daemonShuttingDown) {
+      rejectCreatePtyTaskDuringShutdown(payload);
+      return;
+    }
+
+    if (!ptyTaskCapabilityEnabled) {
+      rejectCreatePtyTaskUnavailable(payload);
+      return;
+    }
+
     if (requestId && !markRequestSeen(requestId)) {
       log(`Duplicate create_pty_task ignored for ${taskId} (request_id=${requestId})`);
       sendAgentCommandAck({
@@ -1891,11 +2078,6 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
-    if (daemonShuttingDown) {
-      rejectCreatePtyTaskDuringShutdown(payload);
-      return;
-    }
-
     if (activeTaskProcesses.has(taskId) || activePtySessions.has(taskId)) {
       log(`Duplicate create_pty_task ignored for ${taskId}: task already active`);
       sendAgentCommandAck({
@@ -2946,6 +3128,7 @@ export function startDaemon(config = {}, deps = {}) {
 
   return {
     close: () => {
+      detachProcessHandlers();
       void shutdownDaemon();
     },
   };

package/src/native-deps.js

@@ -0,0 +1,309 @@
+import path from "node:path";
+import process from "node:process";
+import { spawn as spawnProcess } from "node:child_process";
+
+function defaultRunCommand(command, args, options = {}) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    const child = spawnProcess(command, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: options.env || { ...process.env },
+      cwd: options.cwd || process.cwd(),
+    });
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+        // ignore timeout kill failures
+      }
+    }, options.timeoutMs || 20_000);
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < 16_000) {
+        stdout += chunk.toString();
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      if (stderr.length < 16_000) {
+        stderr += chunk.toString();
+      }
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({ success: code === 0, code, stdout, stderr });
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({
+        success: false,
+        code: -1,
+        stdout,
+        stderr: error instanceof Error ? error.message : String(error),
+      });
+    });
+  });
+}
+
+function quoteForSingleQuotedShell(value) {
+  return String(value).replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+
+export function normalizeBuiltDependencyList(value) {
+  if (Array.isArray(value)) {
+    return value
+      .map((entry) => (typeof entry === "string" ? entry.trim() : ""))
+      .filter(Boolean);
+  }
+  if (typeof value !== "string") {
+    return [];
+  }
+  const trimmed = value.trim();
+  if (!trimmed || trimmed === "undefined" || trimmed === "null") {
+    return [];
+  }
+  try {
+    return normalizeBuiltDependencyList(JSON.parse(trimmed));
+  } catch {
+    return trimmed
+      .split(",")
+      .map((entry) => entry.trim())
+      .filter(Boolean);
+  }
+}
+
+export function mergeBuiltDependencies(existing, required) {
+  const merged = new Set(normalizeBuiltDependencyList(existing));
+  for (const dependency of normalizeBuiltDependencyList(required)) {
+    merged.add(dependency);
+  }
+  return [...merged];
+}
+
+export async function ensurePnpmOnlyBuiltDependencies({
+  runCommand = defaultRunCommand,
+  dependencies = ["node-pty"],
+  global = true,
+} = {}) {
+  const scopeArgs = global ? ["--global"] : ["--location=project"];
+  const currentResult = await runCommand("pnpm", [
+    "config",
+    "get",
+    ...scopeArgs,
+    "onlyBuiltDependencies",
+    "--json",
+  ]);
+  const current = normalizeBuiltDependencyList(currentResult.stdout);
+  const merged = mergeBuiltDependencies(current, dependencies);
+  if (merged.length === current.length && merged.every((entry, index) => entry === current[index])) {
+    return merged;
+  }
+  const setResult = await runCommand("pnpm", [
+    "config",
+    "set",
+    ...scopeArgs,
+    "onlyBuiltDependencies",
+    JSON.stringify(merged),
+  ]);
+  if (!setResult.success) {
+    throw new Error(
+      `Failed to configure pnpm onlyBuiltDependencies: ${String(
+        setResult.stderr || setResult.stdout || "unknown error",
+      ).trim()}`,
+    );
+  }
+  return merged;
+}
+
+export async function resolveGlobalPackageDirectory({
+  packageManager,
+  packageName,
+  runCommand = defaultRunCommand,
+} = {}) {
+  if (!packageManager || !packageName) {
+    throw new Error("packageManager and packageName are required");
+  }
+
+  let command;
+  let args;
+  let normalizeRoot = (value) => value;
+
+  if (packageManager === "pnpm" || packageManager === "npm") {
+    command = packageManager;
+    args = ["root", "-g"];
+  } else if (packageManager === "yarn") {
+    command = "yarn";
+    args = ["global", "dir"];
+    normalizeRoot = (value) => path.join(value, "node_modules");
+  } else {
+    throw new Error(`Unsupported package manager: ${packageManager}`);
+  }
+
+  const result = await runCommand(command, args);
+  if (!result.success) {
+    throw new Error(
+      `Failed to resolve global package root via ${packageManager}: ${String(
+        result.stderr || result.stdout || "unknown error",
+      ).trim()}`,
+    );
+  }
+
+  const rawRoot = String(result.stdout || "")
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .at(-1);
+  if (!rawRoot) {
+    throw new Error(`Global package root for ${packageManager} is empty`);
+  }
+
+  return path.join(normalizeRoot(rawRoot), packageName);
+}
+
+export function buildNodePtyVerificationScript() {
+  return String.raw`
+const fs = require('node:fs');
+const path = require('node:path');
+const { createRequire } = require('node:module');
+
+const packageDir = process.argv[1];
+if (!packageDir) {
+  throw new Error('package directory is required');
+}
+const packageJsonPath = path.join(packageDir, 'package.json');
+const req = createRequire(packageJsonPath);
+const nodePty = req('node-pty');
+const spawn = typeof nodePty.spawn === 'function'
+  ? nodePty.spawn
+  : (nodePty.default && typeof nodePty.default.spawn === 'function'
+      ? nodePty.default.spawn.bind(nodePty.default)
+      : null);
+
+if (!spawn) {
+  throw new Error('node-pty spawn export not found');
+}
+
+const shell = process.platform === 'win32'
+  ? (process.env.COMSPEC || 'cmd.exe')
+  : (fs.existsSync('/bin/bash') ? '/bin/bash' : '/bin/sh');
+const shellArgs = process.platform === 'win32'
+  ? ['/d', '/s', '/c', 'exit 0']
+  : ['-lc', 'exit 0'];
+
+const child = spawn(shell, shellArgs, {
+  name: 'conductor-node-pty-check',
+  cols: 80,
+  rows: 24,
+  cwd: process.cwd(),
+  env: process.env,
+});
+
+let settled = false;
+const finish = (code, error) => {
+  if (settled) return;
+  settled = true;
+  clearTimeout(timer);
+  if (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+    return;
+  }
+  if (typeof code === 'number' && code !== 0) {
+    console.error('node-pty smoke test exited with code ' + code);
+    process.exit(1);
+    return;
+  }
+  console.log('Verified node-pty native binding');
+  process.exit(0);
+};
+
+const timer = setTimeout(() => {
+  try {
+    child.kill();
+  } catch {
+    // ignore kill failures
+  }
+  finish(null, new Error('node-pty smoke test timed out'));
+}, 5000);
+
+child.on('exit', (code) => finish(code, null));
+child.on('error', (error) => finish(null, error));
+`;
+}
+
+export async function verifyNodePtyForPackageDirectory({
+  packageDirectory,
+  runCommand = defaultRunCommand,
+  nodeExecutable = process.execPath,
+} = {}) {
+  if (!packageDirectory) {
+    throw new Error("packageDirectory is required");
+  }
+  const result = await runCommand(nodeExecutable, ["-e", buildNodePtyVerificationScript(), packageDirectory], {
+    timeoutMs: 15_000,
+  });
+  if (!result.success) {
+    throw new Error(
+      `node-pty verification failed for ${packageDirectory}: ${String(
+        result.stderr || result.stdout || "unknown error",
+      ).trim()}`,
+    );
+  }
+  return result;
+}
+
+export async function repairAndVerifyGlobalNodePty({
+  packageManager,
+  packageName,
+  runCommand = defaultRunCommand,
+  nodeExecutable = process.execPath,
+  dependencies = ["node-pty"],
+  packageSpec = null,
+} = {}) {
+  if (!packageManager || !packageName) {
+    throw new Error("packageManager and packageName are required");
+  }
+
+  if (packageManager === "pnpm") {
+    await ensurePnpmOnlyBuiltDependencies({ runCommand, dependencies, global: true });
+  }
+
+  if (packageManager === "pnpm") {
+    const rebuildResult = await runCommand("pnpm", ["rebuild", "-g", ...dependencies]);
+    if (!rebuildResult.success) {
+      throw new Error(
+        `pnpm rebuild failed: ${String(rebuildResult.stderr || rebuildResult.stdout || "unknown error").trim()}`,
+      );
+    }
+  } else if (packageManager === "npm") {
+    const rebuildArgs = ["rebuild", "-g"];
+    if (packageSpec) {
+      rebuildArgs.push(packageSpec);
+    } else {
+      rebuildArgs.push(packageName);
+    }
+    const rebuildResult = await runCommand("npm", rebuildArgs);
+    if (!rebuildResult.success) {
+      throw new Error(
+        `npm rebuild failed: ${String(rebuildResult.stderr || rebuildResult.stdout || "unknown error").trim()}`,
+      );
+    }
+  }
+
+  const packageDirectory = await resolveGlobalPackageDirectory({
+    packageManager,
+    packageName,
+    runCommand,
+  });
+  await verifyNodePtyForPackageDirectory({
+    packageDirectory,
+    runCommand,
+    nodeExecutable,
+  });
+  return packageDirectory;
+}
+
+export function buildNodePtyShellVerificationCommand(scriptPath, packageDirectory) {
+  const quotedScriptPath = quoteForSingleQuotedShell(scriptPath);
+  const quotedPackageDirectory = quoteForSingleQuotedShell(packageDirectory);
+  return `node '${quotedScriptPath}' '${quotedPackageDirectory}'`;
+}