@lumi-ai-lab/harness-data 0.0.15 → 0.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi-ai-lab/harness-data",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "Installer and updater for Harness Data",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -44,6 +44,8 @@ Commands:
 Install options:
   --dir PATH                         Runtime directory (default: current directory)
   --agent NAME                       claude, codex, pi, openclaw, hermes, both, or all
-  --github-token TOKEN               GitHub token for private Release assets`);
+  --github-token TOKEN               GitHub token for private Release assets
+  --cas-username USERNAME            CAS username (skip interactive prompt)
+  --cas-password PASSWORD            CAS password (skip interactive prompt)`);
   if (unknown) process.exitCode = 1;
 }

package/src/commands/install.js

@@ -37,6 +37,26 @@ async function prepareRuntimeDir(options) {
   return runtimeDir;
 }
 
+function replaceRuntimePath(runtimeDir, name, stagedRoot, backups) {
+  const target = path.join(runtimeDir, name);
+  const backup = fs.mkdtempSync(path.join(runtimeDir, `.install-backup-${name}-`));
+  fs.rmSync(backup, { recursive: true, force: true });
+  if (fs.existsSync(target)) fs.renameSync(target, backup);
+  backups.push({ name, target, backup });
+  fs.renameSync(path.join(stagedRoot, name), target);
+}
+
+function restoreRuntimeBackups(backups) {
+  for (const item of backups.slice().reverse()) {
+    fs.rmSync(item.target, { recursive: true, force: true });
+    if (fs.existsSync(item.backup)) fs.renameSync(item.backup, item.target);
+  }
+}
+
+function cleanupRuntimeBackups(backups) {
+  for (const item of backups) fs.rmSync(item.backup, { recursive: true, force: true });
+}
+
 export async function installRuntimeBundle(runtimeDir, options = {}) {
   if (!options.force && fs.existsSync(path.join(runtimeDir, "agents")) &&
       fs.existsSync(path.join(runtimeDir, "config")) &&
@@ -56,7 +76,7 @@ export async function installRuntimeBundle(runtimeDir, options = {}) {
   fs.mkdirSync(cacheDir, { recursive: true });
   const archive = path.join(cacheDir, assetName);
   action(`下载 harness-data-runtime ${tag}`);
-  await downloadReleaseAsset(asset, archive, options);
+  await downloadReleaseAsset(asset, archive, { ...options, progressLabel: assetName });
   if (shaAsset) {
     const shaFile = `${archive}.sha256`;
     await downloadReleaseAsset(shaAsset, shaFile, options);
@@ -69,20 +89,28 @@ export async function installRuntimeBundle(runtimeDir, options = {}) {
   }
 
   const extractDir = fs.mkdtempSync(path.join(cacheDir, "runtime-"));
-  await run("tar", ["-xzf", archive, "-C", extractDir]);
-  for (const dir of ["agents", "bootstrap"]) {
-    const source = path.join(extractDir, dir);
-    if (!fs.existsSync(source)) throw new Error(`runtime bundle missing ${dir}/`);
-    fs.rmSync(path.join(runtimeDir, dir), { recursive: true, force: true });
-    fs.cpSync(source, path.join(runtimeDir, dir), { recursive: true });
-  }
-  const configSource = path.join(extractDir, "config");
-  if (!fs.existsSync(configSource)) throw new Error("runtime bundle missing config/");
-  fs.mkdirSync(path.join(runtimeDir, "config"), { recursive: true });
-  for (const file of fs.readdirSync(configSource)) {
-    fs.copyFileSync(path.join(configSource, file), path.join(runtimeDir, "config", file));
+  const stagedRoot = fs.mkdtempSync(path.join(runtimeDir, ".install-new-runtime-"));
+  const backups = [];
+  try {
+    // 在 Git Bash 中 tar 无法处理 Windows 绝对路径（E:\...），使用相对路径执行
+    await run("tar", ["-xzf", path.relative(cacheDir, archive), "-C", path.relative(cacheDir, extractDir)], { cwd: cacheDir });
+    for (const dir of ["agents", "bootstrap"]) if (!fs.existsSync(path.join(extractDir, dir))) throw new Error(`runtime bundle missing ${dir}/`);
+    const configSource = path.join(extractDir, "config");
+    if (!fs.existsSync(configSource)) throw new Error("runtime bundle missing config/");
+
+    for (const dir of ["agents", "bootstrap"]) fs.cpSync(path.join(extractDir, dir), path.join(stagedRoot, dir), { recursive: true });
+    fs.mkdirSync(path.join(stagedRoot, "config"), { recursive: true });
+    for (const file of fs.readdirSync(configSource)) fs.copyFileSync(path.join(configSource, file), path.join(stagedRoot, "config", file));
+
+    for (const name of ["agents", "bootstrap", "config"]) replaceRuntimePath(runtimeDir, name, stagedRoot, backups);
+    cleanupRuntimeBackups(backups);
+  } catch (error) {
+    restoreRuntimeBackups(backups);
+    throw error;
+  } finally {
+    fs.rmSync(extractDir, { recursive: true, force: true });
+    fs.rmSync(stagedRoot, { recursive: true, force: true });
   }
-  fs.rmSync(extractDir, { recursive: true, force: true });
   ok(`runtime bundle ${tag}`);
   return { tag, skipped: false };
 }
@@ -165,8 +193,8 @@ function casConfigDir(runtimeDir) {
 }
 
 async function writeCasCredentials(runtimeDir, options = {}) {
-  const username = await ask("CAS 用户名：", options);
-  const password = await askSecret("CAS 密码：", options);
+  const username = options.casUsername || await ask("CAS 用户名：", options);
+  const password = options.casPassword || await askSecret("CAS 密码：", options);
   if (!username || !password) throw new Error("CAS username and password are required");
   const dir = casConfigDir(runtimeDir);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -205,8 +233,10 @@ export async function buildAndCheck(runtimeDir, options = {}) {
   return { ok: true, docs, recall, runtimeDocs };
 }
 
-export function printDoctorSummary(doctor) {
-  const failed = doctor.checks.filter((check) => !check.ok);
+export function printDoctorSummary(doctor, options = {}) {
+  const nonBlocking = options.nonBlocking || (() => false);
+  const failed = doctor.checks.filter((check) => !check.ok && !nonBlocking(check));
+  const warnings = doctor.checks.filter((check) => !check.ok && nonBlocking(check));
   if (!failed.length) {
     ok("runtime");
     ok("wikis/spec");
@@ -217,9 +247,11 @@ export function printDoctorSummary(doctor) {
     ok("CAS 凭证");
     ok("CMR Token");
     ok("Indicators Token");
-    ok("Agent Hook");
+    if (!warnings.some((check) => check.name.startsWith("Agent hook"))) ok("Agent Hook");
+    for (const check of warnings) warn(`${check.name}${check.detail ? ` (${check.detail})` : ""}`);
     return;
   }
+  for (const check of warnings) warn(`${check.name}${check.detail ? ` (${check.detail})` : ""}`);
   for (const check of failed) fail(`${check.name}${check.detail ? ` (${check.detail})` : ""}`);
 }
 
@@ -259,6 +291,17 @@ export async function installCommand(options = {}) {
   ok(`${Object.keys(manifest.installedTools || {}).length + Object.keys(localTools).length} 个 CLI 已安装到 bin/`);
   blank();
 
+  // 及时持久化 CLI 安装状态，后续步骤失败时重新安装可跳过已下载的 CLI
+  writeState(runtimeDir, {
+    installMode: tokenMode ? "github-token" : "local-path",
+    runtimeTag: bundle.tag,
+    localTools,
+    tools: manifest.installedTools || {},
+    manifestSha256: manifestDigest(manifest),
+    packageVersion: packageVersion()
+  });
+  blank();
+
   step(4, 8, "同步 Wikis 知识库");
   await installWikis(runtimeDir, options);
   blank();

package/src/commands/update.js

@@ -13,6 +13,10 @@ import { buildAndCheck, installRuntimeBundle, printDoctorSummary } from "./insta
 import { collectDoctor } from "./doctor.js";
 import { action, blank, header, ok, shortSha, skip, step, warn } from "../lib/log.js";
 
+export function isNonBlockingUpdateDoctorCheck(check) {
+  return check.name === "Agent hook" || check.name.startsWith("Agent hook .");
+}
+
 async function npmLatest() {
   try {
     const response = await fetch("https://registry.npmjs.org/@lumi-ai-lab%2Fharness-data/latest", { signal: AbortSignal.timeout(5000) });
@@ -184,8 +188,8 @@ export async function updateCommand(options = {}) {
   step(6, 6, "安装校验");
   if (changed) {
     const doctor = await collectDoctor(runtimeDir, trackingOptions);
-    printDoctorSummary(doctor);
-    if (doctor.checks.some((check) => !check.ok)) throw new Error("doctor failed; update is incomplete");
+    printDoctorSummary(doctor, { nonBlocking: isNonBlockingUpdateDoctorCheck });
+    if (doctor.checks.some((check) => !check.ok && !isNonBlockingUpdateDoctorCheck(check))) throw new Error("doctor failed; update is incomplete");
     writeState(runtimeDir, {
       ...state,
       runtimeTag,

package/src/lib/github.js

@@ -48,5 +48,10 @@ export function findReleaseAsset(release, name) {
 
 export async function downloadReleaseAsset(asset, file, options = {}) {
   const headers = { ...githubHeaders(options), Accept: "application/octet-stream" };
-  await download(asset.url, file, headers);
+  await download(asset.url, file, headers, {
+    progressLabel: options.progressLabel,
+    log: options.log,
+    progress: options.progress,
+    progressWriter: options.progressWriter
+  });
 }

package/src/lib/log.js

@@ -1,3 +1,7 @@
+// 在 Git Bash (Windows) 下，Node.js stdout 连接为 pipe 时默认缓冲输出。
+// setBlocking(true) 让每次写入即时刷新，避免下载进度等日志需要回车才显示。
+if (process.stdout._handle?.setBlocking) process.stdout._handle.setBlocking(true);
+
 export function header(title, version, rows = []) {
   console.log(`${title} ${version}`);
   console.log("");

package/src/lib/manifest.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import https from "node:https";
 import path from "node:path";
 import { commandExists, run } from "./exec.js";
-import { platformKey } from "./platform.js";
+import { binaryName, platformKey } from "./platform.js";
 import { action, skip, warn } from "./log.js";
 
 export function readManifest(file) {
@@ -14,14 +14,107 @@ export function manifestDigest(manifest) {
   return crypto.createHash("sha256").update(JSON.stringify(manifest)).digest("hex");
 }
 
-export function download(url, file, headers = {}) {
+function formatBytes(value) {
+  if (value < 1024) return `${value} B`;
+  if (value < 1024 * 1024) return `${(value / 1024).toFixed(1)} KB`;
+  return `${(value / 1024 / 1024).toFixed(1)} MB`;
+}
+
+function shouldShowProgress(options = {}) {
+  if (!options.progressLabel) return false;
+  if (options.progressWriter) return true;
+  if (options.log === false) return false;
+  if (options.progress === true) return true;
+  return Boolean(process.stdout.isTTY) && !process.env.CI;
+}
+
+function downloadProgress(label, total, options = {}) {
+  if (!shouldShowProgress(options)) return { tick() {}, done() {}, fail() {} };
+  const writer = options.progressWriter || process.stdout;
+  let downloaded = 0;
+  let lastLength = 0;
+  let lastRenderAt = 0;
+  let ended = false;
+  const width = 24;
+  const render = (done = false) => {
+    const now = Date.now();
+    if (!done && now - lastRenderAt < 80) return;
+    lastRenderAt = now;
+    const percent = total ? Math.min(100, Math.floor((downloaded / total) * 100)) : 0;
+    const filled = total ? Math.min(width, Math.floor((percent / 100) * width)) : Math.floor((downloaded / 1024) % width);
+    const bar = `${"=".repeat(filled)}${" ".repeat(width - filled)}`;
+    const size = total ? `${formatBytes(downloaded)}/${formatBytes(total)}` : formatBytes(downloaded);
+    const prefix = done ? "下载完成" : "下载中";
+    const line = `${prefix} ${label} [${bar}] ${total ? `${percent}% ` : ""}${size}`;
+    writer.write(`\r${line}${" ".repeat(Math.max(0, lastLength - line.length))}`);
+    lastLength = line.length;
+    if (done) writer.write("\n");
+  };
+  render();
+  return {
+    tick(chunk) {
+      if (ended) return;
+      downloaded += chunk.length;
+      render();
+    },
+    done() {
+      if (ended) return;
+      ended = true;
+      if (total) downloaded = total;
+      render(true);
+    },
+    fail() {
+      if (ended) return;
+      ended = true;
+      writer.write("\n");
+    }
+  };
+}
+
+function ghDownloadStatus(label, options = {}) {
+  const writer = options.progressWriter || process.stdout;
+  const enabled = Boolean(options.progressWriter) || (options.log !== false && Boolean(process.stdout.isTTY) && !process.env.CI);
+  if (!enabled) return { done() {}, fail() {} };
+  const frames = ["-", "\\", "|", "/"];
+  let index = 0;
+  let lastLength = 0;
+  let ended = false;
+  const render = (prefix) => {
+    const line = `${prefix} ${label}`;
+    writer.write(`\r${line}${" ".repeat(Math.max(0, lastLength - line.length))}`);
+    lastLength = line.length;
+  };
+  render(`下载中 ${frames[index]}`);
+  const timer = setInterval(() => {
+    index = (index + 1) % frames.length;
+    render(`下载中 ${frames[index]}`);
+  }, 120);
+  return {
+    done() {
+      if (ended) return;
+      ended = true;
+      clearInterval(timer);
+      render("下载完成");
+      writer.write("\n");
+    },
+    fail() {
+      if (ended) return;
+      ended = true;
+      clearInterval(timer);
+      writer.write("\n");
+    }
+  };
+}
+
+export function download(url, file, headers = {}, options = {}) {
   return new Promise((resolve, reject) => {
     const request = https.get(url, { headers }, (response) => {
       if ([301, 302, 307, 308].includes(response.statusCode) && response.headers.location) {
         const current = new URL(url);
         const next = new URL(response.headers.location, url);
         const nextHeaders = current.hostname === next.hostname ? headers : {};
-        download(response.headers.location, file, nextHeaders).then(resolve, reject);
+        response.resume();
+        download(response.headers.location, file, nextHeaders, options).then(resolve, reject);
         return;
       }
       if (response.statusCode !== 200) {
@@ -31,9 +124,25 @@ export function download(url, file, headers = {}) {
       }
       fs.mkdirSync(path.dirname(file), { recursive: true });
       const out = fs.createWriteStream(file);
+      const total = Number(response.headers["content-length"]) || 0;
+      const progress = downloadProgress(options.progressLabel, total, options);
+      let settled = false;
+      const rejectOnce = (error) => {
+        if (settled) return;
+        settled = true;
+        progress.fail();
+        reject(error);
+      };
+      response.on("data", (chunk) => progress.tick(chunk));
+      response.on("error", rejectOnce);
       response.pipe(out);
-      out.on("finish", () => out.close(resolve));
-      out.on("error", reject);
+      out.on("finish", () => out.close(() => {
+        if (settled) return;
+        settled = true;
+        progress.done();
+        resolve();
+      }));
+      out.on("error", rejectOnce);
     });
     request.on("error", reject);
   });
@@ -60,19 +169,61 @@ async function ghAuthenticated() {
   return result.code === 0;
 }
 
-async function downloadPrivateWithGh(asset, file) {
+async function downloadPrivateWithTokenValue(asset, file, token, options = {}) {
+  const apiUrl = await githubAssetApiUrl(asset, token);
+  if (!apiUrl) return false;
+  await download(apiUrl, file, {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/octet-stream",
+    "User-Agent": "harness-data-installer"
+  }, {
+    progressLabel: assetName(asset),
+    log: options.log,
+    progress: options.progress,
+    progressWriter: options.progressWriter
+  });
+  return true;
+}
+
+async function downloadPrivateWithGh(asset, file, options = {}) {
   const parts = githubAssetParts(asset);
   if (!parts || !(await ghAuthenticated())) return false;
+  const failures = options.failures || [];
+  const tokenResult = await run("gh", ["auth", "token"], { allowFailure: true });
+  const token = tokenResult.code === 0 ? tokenResult.stdout.trim() : "";
+  if (token) {
+    try {
+      if (await downloadPrivateWithTokenValue(asset, file, token, options)) return true;
+    } catch (error) {
+      failures.push(error.message);
+      // If Node cannot reach GitHub directly, keep the older gh download fallback available.
+    }
+  }
   const dir = fs.mkdtempSync(path.join(path.dirname(file), "gh-download-"));
+  const status = ghDownloadStatus(assetName(asset), options);
   try {
-    const result = await run("gh", ["release", "download", parts.tag, "--repo", parts.repo, "--pattern", parts.name, "--dir", dir], { allowFailure: true });
-    if (result.code !== 0) return false;
+    const result = await run("gh", ["release", "download", parts.tag, "--repo", parts.repo, "--pattern", parts.name, "--dir", dir], {
+      allowFailure: true,
+      stdio: "pipe"
+    });
+    if (result.code !== 0) {
+      status.fail();
+      const detail = result.stderr.trim() || result.stdout.trim();
+      failures.push(`gh release download failed${detail ? `: ${detail}` : ""}`);
+      return false;
+    }
     const downloaded = path.join(dir, parts.name);
-    if (!fs.existsSync(downloaded)) return false;
+    if (!fs.existsSync(downloaded)) {
+      status.fail();
+      failures.push(`gh release download did not produce ${parts.name}`);
+      return false;
+    }
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.renameSync(downloaded, file);
+    status.done();
     return true;
   } finally {
+    status.fail();
     fs.rmSync(dir, { recursive: true, force: true });
   }
 }
@@ -101,31 +252,43 @@ async function githubAssetApiUrl(asset, token) {
 async function downloadPrivateWithToken(asset, file, options = {}) {
   const token = githubToken(options);
   if (!token) return false;
-  const apiUrl = await githubAssetApiUrl(asset, token);
-  if (!apiUrl) return false;
-  await download(apiUrl, file, {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/octet-stream",
-    "User-Agent": "harness-data-installer"
-  });
-  return true;
+  return downloadPrivateWithTokenValue(asset, file, token, options);
 }
 
 async function downloadAsset(tool, asset, file, options = {}) {
+  if (!tool.private && !githubToken(options)) {
+    await download(asset.url, file, {}, { progressLabel: assetName(asset), log: options.log, progress: options.progress, progressWriter: options.progressWriter });
+    return;
+  }
+
   if (!tool.private) {
-    await download(asset.url, file);
+    try {
+      if (await downloadPrivateWithGh(asset, file, options)) return;
+      if (await downloadPrivateWithToken(asset, file, options)) return;
+    } catch {
+      // Public assets must remain downloadable when an unrelated GitHub token is stale or invalid.
+    }
+    await download(asset.url, file, {}, { progressLabel: assetName(asset), log: options.log, progress: options.progress, progressWriter: options.progressWriter });
     return;
   }
-  if (await downloadPrivateWithGh(asset, file)) return;
-  if (await downloadPrivateWithToken(asset, file, options)) return;
-  throw new Error(`private GitHub Release asset requires gh auth login, GITHUB_TOKEN, or --github-token: ${assetName(asset)}`);
+
+  const failures = [];
+  const privateOptions = { ...options, failures };
+  if (await downloadPrivateWithGh(asset, file, privateOptions)) return;
+  try {
+    if (await downloadPrivateWithToken(asset, file, privateOptions)) return;
+  } catch (error) {
+    failures.push(error.message);
+  }
+  const detail = failures.filter(Boolean).join("; ");
+  throw new Error(`private GitHub Release asset requires gh auth login, GITHUB_TOKEN, or --github-token: ${assetName(asset)}${detail ? ` (${detail})` : ""}`);
 }
 
 async function expectedSha256(tool, asset, options = {}) {
   if (asset.sha256) return asset.sha256;
   try {
     const tmp = path.join(fs.mkdtempSync(path.join(process.cwd(), ".bootstrap-cache-sha-")), "asset.sha256");
-    await downloadAsset(tool, { ...asset, url: `${asset.url}.sha256` }, tmp, options);
+    await downloadAsset(tool, { ...asset, url: `${asset.url}.sha256` }, tmp, { ...options, log: false, progress: false, progressWriter: null });
     return fs.readFileSync(tmp, "utf8").trim().split(/\s+/)[0];
   } catch {
     return "";
@@ -149,7 +312,7 @@ function reusableInstalledTool(workspace, tool, asset, options = {}) {
   const current = tool.version ? optionsStateTool(options, tool.name) : null;
   if (!current?.version || current.version !== tool.version) return null;
   if (!current.sha256) return null;
-  const binary = path.join(workspace, "bin", tool.binary);
+  const binary = path.join(workspace, "bin", binaryName(tool.binary));
   if (!executable(binary)) return null;
   const actualSha = fileSha256(binary);
   if (actualSha !== current.sha256) return null;
@@ -165,6 +328,25 @@ function optionsStateTool(options, name) {
   return options?.state?.tools?.[name] || null;
 }
 
+async function extractArchiveBinary(workspace, cacheDir, archive, binDir, tool) {
+  const extractDir = fs.mkdtempSync(path.join(cacheDir, `${tool.name}-extract-`));
+  try {
+    if (archive.endsWith(".zip")) {
+      await run("unzip", ["-o", path.relative(workspace, archive), "-d", path.relative(workspace, extractDir)], { cwd: workspace });
+    } else {
+      await run("tar", ["-xzf", path.relative(workspace, archive), "-C", path.relative(workspace, extractDir)], { cwd: workspace });
+    }
+    const extracted = path.join(extractDir, binaryName(tool.binary));
+    if (!fs.existsSync(extracted)) throw new Error(`${tool.binary} was not extracted to archive root`);
+    fs.chmodSync(extracted, 0o755);
+    const binary = path.join(binDir, binaryName(tool.binary));
+    fs.renameSync(extracted, binary);
+    return binary;
+  } finally {
+    fs.rmSync(extractDir, { recursive: true, force: true });
+  }
+}
+
 export async function installToolsFromManifest(workspace, manifestPath, options = {}) {
   const manifest = options.manifestOverride || readManifest(manifestPath);
   const only = options.tools ? new Set(options.tools) : null;
@@ -192,14 +374,7 @@ export async function installToolsFromManifest(workspace, manifestPath, options
     const actualSha = fileSha256(archive);
     if (sha && actualSha !== sha) throw new Error(`${tool.name} sha256 mismatch`);
     if (!sha) warn(`${tool.name} 未提供 sha256，已继续安装`);
-    if (archive.endsWith(".zip")) {
-      await run("unzip", ["-o", archive, "-d", binDir]);
-    } else {
-      await run("tar", ["-xzf", archive, "-C", binDir]);
-    }
-    const binary = path.join(binDir, tool.binary);
-    if (!fs.existsSync(binary)) throw new Error(`${tool.binary} was not extracted to bin/`);
-    fs.chmodSync(binary, 0o755);
+    const binary = await extractArchiveBinary(workspace, cacheDir, archive, binDir, tool);
     const binarySha = fileSha256(binary);
     installedTools[tool.name] = {
       version: tool.version || "",

package/src/lib/prompt.js

@@ -2,10 +2,16 @@ import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { Writable } from "node:stream";
 import { agentChoices, agentChoiceText } from "./config.js";
+import { run } from "./exec.js";
 
 export async function confirm(message, options = {}) {
   if (options.yes) return true;
   const suffix = options.defaultNo ? " [y/N] " : " [Y/n] ";
+  if (!process.stdin.isTTY) {
+    const answer = (await shellRead(message + suffix)).toLowerCase();
+    if (!answer) return !options.defaultNo;
+    return answer === "y" || answer === "yes";
+  }
   const rl = readline.createInterface({ input, output });
   try {
     const answer = (await rl.question(message + suffix)).trim().toLowerCase();
@@ -23,6 +29,12 @@ export async function chooseAgent(options = {}) {
     return value;
   }
   if (options.yes) return "all";
+  if (!process.stdin.isTTY) {
+    const answer = (await shellRead(`选择 Agent：${agentChoiceText} [all] `)).toLowerCase();
+    const value = answer || "all";
+    if (!agentChoices.includes(value)) throw new Error(`agent must be ${agentChoiceText}`);
+    return value;
+  }
   const rl = readline.createInterface({ input, output });
   try {
     const answer = (await rl.question(`选择 Agent：${agentChoiceText} [all] `)).trim().toLowerCase();
@@ -34,9 +46,22 @@ export async function chooseAgent(options = {}) {
   }
 }
 
+async function shellRead(prompt) {
+  const escaped = prompt.replace(/'/g, "'\\''");
+  const result = await run("bash", ["-c", `read -p '${escaped}' -r input && echo "$input"`], { stdio: ["inherit", "pipe", "inherit"] });
+  return result.stdout.trim();
+}
+
+async function shellReadSecret(prompt) {
+  const escaped = prompt.replace(/'/g, "'\\''");
+  const result = await run("bash", ["-c", `read -s -p '${escaped}' -r input && echo "$input"`], { stdio: ["inherit", "pipe", "inherit"] });
+  return result.stdout.trim();
+}
+
 export async function ask(message, options = {}) {
   if (options.value) return String(options.value);
   if (options.yes) throw new Error(`${message} is required`);
+  if (!process.stdin.isTTY) return shellRead(`${message} `);
   const rl = readline.createInterface({ input, output });
   try {
     return (await rl.question(`${message} `)).trim();
@@ -48,6 +73,7 @@ export async function ask(message, options = {}) {
 export async function askSecret(message, options = {}) {
   if (options.value) return String(options.value);
   if (options.yes) throw new Error(`${message} is required`);
+  if (!process.stdin.isTTY) return shellReadSecret(`${message} `);
   const muted = new Writable({
     write(_chunk, _encoding, callback) {
       callback();