@mininglamp-oss/octo-runtime 0.0.0-stage → 1.0.0-rc1

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Mininglamp Technology
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,36 @@
-# Temporary Holding Version
+# Octo Runtime
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+提供 `octo-runtime` 命令的本地 Agent Runtime。要求 Node.js 24 或以上。
+
+```bash
+npm install -g @mininglamp-oss/octo-runtime
+octo-runtime --help
+```
+
+也可以在项目内安装，通过 `npx octo-runtime --help` 调用。
+
+内部模块随 CLI 一起打包、升级，只发布一个 npm 包。第三方插件可使用以下类型与工具入口：
+
+```ts
+import type { ExtraPlugin, ExtraContext, CanonicalEvent } from "@mininglamp-oss/octo-runtime/extra";
+import { InvokeInput, isTerminal } from "@mininglamp-oss/octo-runtime/protocol";
+```
+
+`/extra` 提供完整插件生命周期、声明、JSON 配置、注入执行端口和协议类型；`/protocol` 提供全部协议类型，以及输入检查、Context/事件/帧/交互校验和终态工具。invoke 使用 ctx.adapterHost 注入实例，支持 native/canonical 类型推导。客户 TS 工程局部安装本包及 TypeScript、@types/node，以 NodeNext/ESM 编译为 JS，再通过 extraset 配置入口绝对路径并重启 daemon 加载。
+
+三个内置 Extra 的完整原始 JSON Schema 可从以下公开子路径读取：
+
+- `@mininglamp-oss/octo-runtime/extras/channel-gateway/config-schema.json`
+- `@mininglamp-oss/octo-runtime/extras/channel-wecom/config-schema.json`
+- `@mininglamp-oss/octo-runtime/extras/webui/config-schema.json`
+
+使用 `import.meta.resolve(上述路径)` 获取本机文件位置，按需读取或交给自己的校验工具。schema 覆盖整个 `{ module, enabled?, config }` 声明，包含字段用途、必填关系、条件约束、当前省略行为及占位示例。Channel 的可选 `context` 只声明固定的 v3 协议标识和 `items` 对象数组；配置后在执行 AgentRun 时固定附带，内部 item 结构遵循 octo-runtime Context v3 协议，此处不展开。schema 不自动填值、不强制校验或引入 Zod；配置来源、模型及校验方式仍由业务方决定，`load` 继续接收原始 JSON 对象。凭据有效性、文件权限、Provider 可用性及 Context 语义继续由运行时校验。
+
+根入口和未声明的内部子路径继续拒绝包名导入；不提供独立宿主 SDK 工厂。此限制不提供源码加密或文件访问隔离。第三方 Adapter 公开入口及 extra_adapters.json 加载仍待实施，不是本版本已有功能。
+Provider 程序由宿主或用户另行选择安装，安装此包不会自动下载 Provider。
+升级程序保留已有 Runtime Home、身份与配置；已运行的进程需要重启才能使用新版本。
+
+## 许可证
+
+本项目采用 Apache License 2.0，完整条款见随包分发的 `LICENSE` 文件。Copyright 2026 Mininglamp Technology。
+随包分发的第三方依赖保留各自许可证与版权声明。

package/apps/cli/README.md

@@ -0,0 +1,244 @@
+# Octo Runtime CLI
+
+`pnpm build` 固化当前源码的 Git commit。`octo-runtime`、`octo-runtime --version` 和 `octo-runtime version` 显示版本及 `commit:<12 位短 SHA>`；工作树有未提交修改时附带 `(dirty)`。安装包携带构建元数据，不依赖运行目录的 Git；无 Git 来源时显示 `commit:unknown`。
+
+管理本地 Agent Runtime、Provider Adapter 和后台服务。直接执行 `octo-runtime` 显示用途、发行版本及命令列表；`octo-runtime --version`（或 `-v`、`version`）输出根 `package.json` 的版本。
+
+帮助采用 `Usage`、`Available Commands`、`Flags` 与 `Global Flags` 分层格式。命令组 `octo-runtime daemon` 和 `octo-runtime adapter` 默认显示帮助；启动前台进程必须显式执行 `octo-runtime daemon run`。使用 `octo-runtime help daemon start` 或 `octo-runtime daemon start --help` 查看具体命令。
+
+daemon 子命令顺序为 `start`、`stop`、`restart`、`status`、`install`、`uninstall`、`run`。开发调试命令 `playboard` 排在主帮助末尾，`playboard --help` 包含完整请求示例与本文件路径。
+
+## Extra plugins
+
+`octo-runtime extraget <name>` 向 stderr 输出一行 `Config file: <绝对路径>`，stdout 只输出保存的完整 `{module, enabled?, config}` JSON，可重定向到文件，也可作为后续 `extraset` 输入。不加载模块、不启动 daemon、不补默认字段；读取继续校验名称、权限、大小和声明结构。输出保留原配置内容，包括其中的凭据。
+
+```sh
+octo-runtime extraget channel-gateway > channel-gateway.json
+octo-runtime daemon status
+octo-runtime daemon status --json
+```
+
+`status` 与 `daemon status --json` 在每个已加载 Extra 的生命周期旁添加 `status`，原样保留插件的 JSON；`daemon status` 的终端摘要也展开这些 JSON。未加载插件仅显示真实生命周期；查询失败提供 `status_error: EXTRA_STATUS_FAILED`，不冒充空状态。这里的运行状态与 `extraget` 读取的持久配置分开。
+
+`octo-runtime extraset <name>` 从 stdin 读取完整 `{module, enabled?, config}` 并以 0600 权限替换 `HOME/extras/<name>/config.json`，不回显配置或启动插件。保存后执行 `octo-runtime daemon restart` 应用变更。CLI 不再提供 `extra status/load/unload`；嵌入式宿主继续通过 SDK 管理插件生命周期。
+
+The native HTTP/Bearer/SSE demonstration and full here-string examples are documented in [Extra plugins](../../.octospec/rules/extras.md). This is a generic configuration command, not a platform-specific setup flow.
+
+现行设计见 [Runtime 本地存在与按需在线合同](../../.octospec/rules/runtime-lifecycle.md)。当前 CLI／原生服务仍保留云端 profile 引导与连接恢复，IM 配置入口已提供；最终在线开关尚待实施；客户 SDK 无需使用该 CLI。
+
+> 全局 Context 约束：本轮模型上下文由业务方选择，selection 等业务项可不发送，可传空或显式重复。必要执行配置独立校验且不注入 LLM。底层只转发并渲染本轮数据，不按 sessionId 缓存、补齐、合并、去重或省略；reset／新 Provider 会话／resume 失败后由业务方重新提供必要背景。见 [分类矩阵](../../.octospec/rules/context-input.md) 与 [IPD-SE 0.3](../../.octospec/rules/context-input.md)；执行侧旧 Compiler/Pipeline 已移除。
+
+`octo-runtime` 面向无显示器的独立设备，负责启动 daemon 和共享 AdapterHost、配置多个 IM 接入，以及 Runtime 登录、服务生命周期和本地诊断。IM 配置用法见接入指南第 1.4 节。运行时要求 Node.js 24.x。
+
+## 最终架构期望
+
+2026-10-14 目标：先初始化并保存稳定的本地 Runtime ID，本地 Host IPC 就绪即为启动成功。注册由独立显式命令触发，不再是安装、启动或本地调用的前置条件，不创建默认 Agent。
+
+CLI 统一使用 `extraset <name>` 从 stdin 接收完整插件声明 `{ module, enabled?, config }`，保存在 `<home>/extras/<name>/config.json`。框架只校验声明及 JSON 结构，业务配置由插件解释；同名插件每次整份替换。
+
+渠道的 Bot 配置、凭据和执行设置由插件解释。多个 Bot 一次写入完整的 `config.bots` 数组。OpenClaw 连接由宿主通过通用 Adapter 配置入口明确配置，daemon 不根据 Bot 列表探测或写入 Provider 配置。示例见 [CLI 使用指南](../../CLI_USAGE_GUIDE.md#4-接入-octo-im)。
+
+设备／Runtime 注册使用独立命令，候选名称为 `octo-runtime devices register`，最终命令名与参数待冻结。配置频道不隐式注册设备，注册也不隐式启用所有连接。
+
+设备在线选择保存本地，与 IM 频道启用独立；关闭时不加载设备连接并停止已有连接，本地 Host 继续运行。access 目前仅确认设备与 Runtime 注册职责，设备 WS／heartbeat 等对外链路待最终架构评审。验收分别记录本地就绪、注册 ACK、设备连接和频道连接。详见 [IPD-SE 基线](../../.octospec/rules/runtime-lifecycle.md)。
+
+下文说明现有 CLI 入口。设备注册等目标命令尚未全部交付；本地安装和运行无需登录。
+
+## 全局参数
+
+```text
+--home PATH       覆盖 Runtime Home
+--profile NAME    选择 profile，默认 default
+```
+
+macOS/Linux 默认 Home 是 `~/.octo-runtime`，Windows 是 `%LOCALAPPDATA%\OctoRuntime`。一个 Home 运行一个 daemon，并可包含多个 profile；每个 profile 独立保存 Runtime 身份、credential、WSS 与内存重放窗口。不同 OS 用户或互不信任的身份仍必须使用不同 OS account。
+
+## 本地初始化
+
+直接执行 `octo-runtime daemon start` 后台启动，或执行 `octo-runtime daemon run` 前台运行。`start` 在原生用户服务缺失时自动安装并启用服务，无需先手动执行 `install`。这些入口使用相同的默认 Runtime Home，也支持 `--home PATH` 与 `OCTO_RUNTIME_HOME`；首次使用自动创建缺失的本地配置和 machine identity，已有配置与身份保持原样。
+
+CLI 不提供 `login` 命令及其更新入口。登录、登记和共享属于按需接入的 Extra，不是设备本地存在、安装或执行的条件。
+
+## Daemon 生命周期
+
+服务管理命令默认输出即时进度与简短摘要。`start` 在安装前、后台启动前及等待 IPC 就绪时分别提示；启动后列出识别到的 Adapter、已加载 Extra 和其他 Extra 的真实阶段。Extra 的 loaded 只表示初始化完成，不代表外部连接在线。使用 `--json` 输出完整结构化结果并关闭进度，例如 `octo-runtime daemon start --json`；前台 `run` 保持已有日志输出。
+
+```bash
+octo-runtime daemon install
+octo-runtime daemon uninstall
+octo-runtime daemon run
+octo-runtime daemon start
+octo-runtime daemon stop
+octo-runtime daemon restart
+octo-runtime daemon status
+```
+
+- `install` 准备缺失的本地默认配置，把 Runtime Home 注册为当前用户的原生服务，也可重复执行以修复 definition drift；默认启用登录自启但不启动，可用 `--no-autostart` 禁用自启。
+- `uninstall` 直接停止并从原生服务管理器中真实删除服务：systemd user unit、macOS LaunchAgent 或 Windows 当前用户计划任务。身份、credential、本地状态和日志全部保留。
+- `run` 在前台运行并响应 `SIGINT`/`SIGTERM`；PID 文件保证一个 Home 只有一个 daemon。
+- `run` 默认在 stderr 输出彩色、脱敏的生命周期状态；`--quiet` 关闭终端输出，`--verbose`
+  显示详细 operational records 和完整启动异常堆栈。RPC/provider 敏感内容仍只进入受保护日志。
+- `start` 先检查原生用户服务，未安装时自动安装并启用登录自启，再由系统服务管理器后台启动；已安装时沿用原有启动逻辑，不重装或修改自启设置。等待本地 IPC 就绪后返回。已禁用的服务仍明确报错；`--wait-online` 不再支持。
+- `stop`、`restart` 直接操作原生服务，不等待活动 Run 完成。
+- 生命周期命令作用于整个 Home。daemon 自动发现 Home 下包含合法 `config.json` 的 profile，并由一个 supervisor 管理各自的 credential、`runtime_id`、WSS 和内存重放窗口。
+- 锁屏不会结束已登录用户的服务；注销会结束 macOS LaunchAgent 和默认 Windows 用户任务。Linux 注销后是否继续取决于管理员是否启用 linger。
+
+## Extra 配置
+
+`octo-runtime extraset <name> < config.json` 原子保存完整插件声明，POSIX 文件权限为 `0600`，输出不回显配置或凭据。CLI daemon 启动时统一读取 `<home>/extras/<name>/config.json`，不设置渠道专用文件入口。
+
+`config` 是插件自己的 JSON 对象；CLI/daemon 不解释、合并或补写 Bot 字段。Octo 插件在 `config.bots` 数组中配置多个机器人，`bot_name` 的默认值也由该插件处理。重新执行 `extraset` 会替换整个插件声明，必须提交希望保留的完整数组；重启 daemon 后加载文件变更。SDK 宿主显式提供 Extra 声明，不扫描配置文件。
+
+Gateway、WeCom、WebUI 均使用两阶段 Extra 入口，CLI 传空函数依赖。三个插件的新配置 Schema 和完整示例显式带固定人设“我是明略科技的Octo助理”：两个 Channel 使用 `config.bots[i].context`，WebUI 使用 `config.context`，均为 Context v3 的 octo.control/instructions，entries 只含 text。已有空配置不自动补齐，旧 source 不再接受；完整 JSON 见[配置指南](../../.octospec/guides/extra-configuration.md)。
+
+## Doctor
+
+```bash
+octo-runtime doctor
+octo-runtime --home /path/to/work-home --profile work doctor
+```
+
+`doctor` 是服务诊断入口，当前检查 Node.js 版本、profile/identity/credential 文件、POSIX credential mode、service program 绝对路径、原生 manager、definition drift、本地 IPC 和所选 Runtime 的云端连接。所有检查通过返回 0，否则返回 1，并为失败项输出 remediation。Host 调试日志用于看执行数据，不替代 doctor。
+
+## 本地数据与 Run 诊断
+
+```bash
+octo-runtime status
+octo-runtime adapter list
+octo-runtime adapter probe codex
+```
+
+这些命令通过 Home 级 Unix socket 或 Windows named pipe 读取本地状态。Worker 仅管理对应远程执行，源事件窗口不能当作完整历史；本地会话及完整 trajectory 由宿主业务存储负责。
+
+统一日志默认关闭；前台使用 `octo-runtime daemon run --logs-dir /absolute/logs`，后台使用 `octo-runtime daemon install --logs-dir /absolute/logs` 后重启服务。目录由宿主明确指定，SDK 对应 `logging: { directory: "/absolute/logs" }`，不自动从 Home 推导。旧 OCTO_RUNTIME_DEBUG 不再启用独立 Host debug 文件。
+
+按 UTC 小时命名：内核 `kernel-YYYYMMDDTHH.log`，Extra `extras/<extra_type>-YYYYMMDDTHH.log`；每序列保留最近 3 个实际文件（含当前文件），单文件最多 100 MiB。空闲或停机跨天仍保留这 3 个文件，产生第四个时淘汰最旧归档，不按“最近 3 小时”清理。日志仅记身份、状态、耗时和输入/Context 项数，不记正文、原始错误或凭据。写入线程和队列有界，失败不影响执行；必要 stderr 继续可见，不删除旧固定日志或用户文件。详见[运维说明](../../.octospec/guides/operations.md)。
+
+## Playboard: standalone local trials
+
+For development, testing, and integration debugging only. Do not integrate production
+applications by spawning this CLI subcommand.
+
+`playboard` 从 stdin 读取一个完整 JSON，通过统一启动入口拉起临时 daemon，
+经 Unix Socket / Windows Named Pipe 执行并输出 NDJSON，结束后回收本次 daemon、Host 和临时状态。
+无需登录、enrollment、Access、Worker 或预先启动 daemon。已有常驻 daemon 不参与本次执行。
+临时执行复用所选 Home/profile 的 Provider 装配，不加载已配置 Extra，不同步渠道工具凭据。
+Provider 安装、认证以及 OpenClaw Gateway 等外部服务仍须预先就绪。
+既有 Home、profile、身份和 Provider 连接配置不随临时执行销毁。
+It does not install providers. Provider tools can act on your workspace.
+
+For Bash/zsh, a complete example is:
+
+```bash
+octo-runtime playboard <<< '{
+  "inputs": [{ "type": "text", "text": "Reply with OK. Do not use tools." }],
+  "contexts": { "schema": "octo.context-envelope/v3", "items": [] },
+  "sessionId": "playboard-demo",
+  "protocol_mode": "canonical"
+}'
+```
+
+Or save the same JSON and run `octo-runtime playboard < request.json`.
+Input can span lines; stdout is NDJSON, not a JSON array. Diagnostics go to stderr.
+No extra summary is appended to stdout. Help is available with `playboard --help`.
+
+| JSON field | Contract |
+| --- | --- |
+| `inputs` | Required, non-empty `ModelInputPart[]`. Text is `{ "type": "text", "text": "..." }`; images use the existing validated base64/mimeType/byteSize/sha256 contract. |
+| `contexts` | Required Context v3 envelope. Empty `items` is valid. Business context retains its submitted order and is rendered by the shared Host. |
+| `sessionId` | Optional local caller session identity, otherwise generated. Reusing it does not restore history or a provider session. Each invocation gets fresh run/invocation IDs. |
+| `protocol_mode` | `native` (default) or `canonical`. Native preserves provider payloads; unsupported modes fail without fallback. |
+| `agentSource` | `provisioned` (default), or `preset` (default for OpenClaw), subject to adapter support. |
+| `providerSession` | Optional opaque provider binding, including a non-empty `sessionId`. Pass back the real binding returned in Host events to request continuation. |
+| `continuityMode` | Defaults to `continue` when `providerSession` is supplied, otherwise `fresh`. Explicit `continue` requires the binding; `fresh` forbids it. The provider determines whether resume succeeds. |
+
+Local execution defaults are codex, the current directory (for provisioned execution),
+`approval_policy.mode=ask`, and `limits.run_timeout_ms=120000`. Override execution
+settings in `contexts.items`, for example:
+
+```json
+[
+  { "namespace": "octo.execution", "name": "adapter", "payload": { "type": "claude-code" } },
+  { "namespace": "octo.execution", "name": "workspace", "payload": { "mode": "fixed", "path": "/absolute/workspace" } },
+  { "namespace": "octo.execution", "name": "model", "payload": { "selection": { "id": "your-provider-model" } } },
+  { "namespace": "extra.playboard", "name": "background", "payload": { "text": "Only this turn's background." } }
+]
+```
+
+OpenClaw uses an existing local agent and its provider-owned workspace by default:
+
+```bash
+node apps/cli/dist/index.js playboard <<< '{"inputs":[{"type":"text","text":"回复 OK"}],"contexts":{"schema":"octo.context-envelope/v3","items":[{"namespace":"octo.execution","name":"adapter","payload":{"type":"openclaw"}}]},"protocol_mode":"canonical"}'
+```
+
+For this CLI shorthand, an omitted `provider_agent_id` resolves to `main` before
+Context validation. To select another existing agent, add `"provider_agent_id":"researcher"`
+to the adapter payload. Explicit invalid IDs are rejected; a missing agent is never
+created or replaced with another target. daemon 的统一启动编排刷新所选 profile 的连接；Adapter 只读取装配后的配置并验证目标。Other protocol entry points still require
+an explicit OpenClaw `provider_agent_id`.
+
+Workspace selection uses the local resolver: provisioned runs require a fixed absolute
+path; random workspace allocation is not provided. Model, reasoning, limits, envs,
+and MCP configuration use the existing execution protocol. Control instructions use
+the existing independent control channel. Execution configuration is never injected
+as business context. Empty or repeated business items are not supplemented from any
+previous invocation. Provide needed background again after reset or failed resume.
+
+This is a one-shot trial: stdin EOF finishes reading the request, **not execution**.
+If the provider requests approval or user input, its interaction frame is emitted,
+then the CLI cancels and fails with `PLAYBOARD_INTERACTION_REQUIRED`; it never silently
+approves or waits for a reply on closed stdin. Ctrl+C cancels and cleans up the Host.
+Exit codes: `0` completed, `1` validation/startup/provider/interaction failure,
+`130` cancelled or interrupted, `143` SIGTERM. An interrupted or rejected stream may
+end without a terminal frame; consumers must also check the process exit code/stderr.
+Requests are limited to 32 MiB of UTF-8 JSON, including embedded images and Context.
+
+`--manifest /absolute/adapters.json` selects an explicit adapter manifest for adapter
+experiments or fake-provider tests; the default is the CLI-owned `apps/cli/src/default_adapters.json` (built as `apps/cli/dist/default_adapters.json`),
+resolved relative to the installed CLI. Playboard does not read daemon profiles or
+provider bindings from Runtime Home. It tests execution, not remote scheduling,
+leases, persistence, or production end-to-end delivery.
+
+## 状态目录
+
+Runtime 不创建 SQLite 数据库，不归档 Run 请求或事件。进程重启后旧回放窗口失效；业务历史和恢复由调用方管理。
+
+```text
+<home>/config.json
+<home>/machine.json                         # shared installation grouping label
+<home>/octo-daemon.pid
+<home>/sockets/octo-runtime-daemon.sock       # POSIX
+<home>/<profile>/config.json
+<home>/<profile>/identity/runtime.json
+<home>/<profile>/credentials/runtime-token.json
+<home>/logs/
+```
+
+One Runtime Home runs one daemon and adapter-host. Each discovered profile has its own server-assigned `runtime_id`, credential, and WSS connection, while sharing the Home-global `machine_id` and provider concurrency limits. Profile names allow 1-128 characters. The identity file must include the exact bound profile; identities without it are unsupported and require fresh enrollment after the Worker database reset.
+
+`octo-daemon.pid` contains only a process PID. Profile identity is stored in `identity/runtime.json`; POSIX credentials use mode `0600`. Existing `system_id`/`device_id` identities are unsupported after this breaking reset: freshly enroll profiles against the recreated Worker database. Program files do not live inside Runtime Home.
+
+daemon 服务管理命令默认输出终端摘要，显式 `--json` 输出 JSON；其他普通控制命令仍输出 JSON。错误输出到 stderr 并返回非零。`--help` 和 `daemon --help` 不依赖网络或已运行 daemon。
+
+## 模块责任边界
+
+- 负责：提供现有 octo-runtime 命令、Home/profile 配置、服务管理和本地诊断。
+- 不负责：实现 Worker/IM 协议、直接启动每个 provider。
+- 协作边界：见 [根架构与包边界](../../README.md#模块责任边界)。所有执行来源共用 adapter-host IPC；模块按职责提供协议、执行或宿主能力。
+
+### 已撤回的注册 Agent 行为
+
+原 `--agent-identity`／`--agent-name` 及注册时创建默认 `main` Agent 的行为退出，不属于最终 CLI 合同。Runtime 注册只登记设备与 Runtime；助手、分身及其 defaults／mandatory 由业务方管理。CLI 参数、profile 字段和重连请求中的旧 Agent 创建信息须同步删除。OpenClaw 的 `provider_agent_id` 仍是本轮执行选择，与本次删除 Worker Agent registry 不同。
+
+
+## Runtime 的 OpenClaw 连接
+
+CLI daemon 启动时准备并探测本地 OpenClaw 连接。缺失或不可用的 Gateway 不阻止本地 Host 就绪。连接存于 `<home>/<profile>/adapters/openclaw/connection.json`；凭据存于该 profile 的 `credentials` 目录。
+
+```sh
+octo-runtime --home /path/to/harness --profile work adapter probe openclaw
+```
+
+CLI 不再提供 `adapter connect`。启动时复用已保存连接，首次初始化读取 `OPENCLAW_HOME` 或成对的 `OPENCLAW_GATEWAY_URL` / `OPENCLAW_GATEWAY_TOKEN`，否则使用 `~/.openclaw`。宿主通过 SDK 显式管理连接配置。
+
+`playboard` 支持 `--home` 和 `--profile`，无须登录即可使用该 profile 的连接来源。完整概念与执行合同见 [统一合同](../../.octospec/rules/openclaw.md)。

package/apps/cli/dist/build-info.json

@@ -0,0 +1,4 @@
+{
+  "commit": "62d10ac46e7c2c3505b42c362229f7b91f328e5b",
+  "dirty": false
+}

package/apps/cli/dist/daemon-output.d.ts

@@ -0,0 +1 @@
+export declare function formatDaemonResult(value: unknown): string;

package/apps/cli/dist/daemon-output.js

@@ -0,0 +1,49 @@
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+export function formatDaemonResult(value) {
+    const result = record(value);
+    const service = record(result.service);
+    const application = record(result.readiness ?? result.application);
+    const action = result.action;
+    const lines = [
+        action === "start"
+            ? "Backend started successfully."
+            : action === "restart"
+                ? "Backend restarted successfully."
+                : action === "stop"
+                    ? "Backend stopped successfully."
+                    : action === "install"
+                        ? "Background service installed successfully."
+                        : action === "uninstall"
+                            ? "Background service removed. Runtime Home and credentials preserved."
+                            : `Backend: ${application.ready === true ? "ready" : "not ready"}`,
+        `Service: ${typeof service.state === "string" ? service.state : "unknown"} (${typeof service.manager === "string" ? service.manager : "unknown"})`
+    ];
+    if (action === "install")
+        lines.push(`Start at login: ${service.enabled === true ? "enabled" : "disabled"}`, "Start the backend: octo-runtime daemon start");
+    if (application.ready === true || application.extras !== undefined) {
+        const adapters = Array.isArray(application.adapters)
+            ? application.adapters.filter((item) => typeof item === "string")
+            : [];
+        lines.push(`Adapters (${adapters.length}): ${adapters.join(", ") || "none detected"}`);
+        const extras = Object.entries(record(application.extras));
+        const active = extras
+            .filter(([, state]) => record(state).phase === "loaded")
+            .map(([name]) => name);
+        lines.push(`Active Extras: ${active.join(", ") || "none"}`);
+        for (const [name, state] of extras) {
+            const phase = record(state).phase;
+            if (phase !== "loaded")
+                lines.push(`  ${name}: ${typeof phase === "string" ? phase : "unknown"}`);
+            if (Object.hasOwn(record(state), "status")) {
+                lines.push(`\nExtra ${name}:`, JSON.stringify(record(state).status, null, 2));
+            }
+            if (record(state).status_error)
+                lines.push(`  ${name}: status query failed (EXTRA_STATUS_FAILED)`);
+        }
+    }
+    return lines.join("\n");
+}

package/apps/cli/dist/default_adapters.json

@@ -0,0 +1,65 @@
+{
+  "version": 1,
+  "adapters": [
+    {
+      "type": "codex",
+      "module": "@mininglamp-oss/octo-runtime-adapter-codex",
+      "export": "codexAdapter"
+    },
+    {
+      "type": "claude-code",
+      "module": "@mininglamp-oss/octo-runtime-adapter-claude-code",
+      "export": "claudeCodeAdapter"
+    },
+    {
+      "type": "codebuddy",
+      "module": "@mininglamp-oss/octo-runtime-adapter-codebuddy",
+      "export": "codebuddyAdapter"
+    },
+    {
+      "type": "hermes",
+      "module": "@mininglamp-oss/octo-runtime-adapter-hermes",
+      "export": "hermesAdapter"
+    },
+    {
+      "type": "kimi-code",
+      "module": "@mininglamp-oss/octo-runtime-adapter-kimi-code",
+      "export": "kimiCodeAdapter"
+    },
+    {
+      "type": "mcode",
+      "module": "@mininglamp-oss/octo-runtime-adapter-mcode",
+      "export": "mcodeAdapter"
+    },
+    {
+      "type": "opencode",
+      "module": "@mininglamp-oss/octo-runtime-adapter-opencode",
+      "export": "opencodeAdapter"
+    },
+    {
+      "type": "openclaw",
+      "module": "@mininglamp-oss/octo-runtime-adapter-openclaw",
+      "export": "openclawAdapter"
+    },
+    {
+      "type": "qodercli",
+      "module": "@mininglamp-oss/octo-runtime-adapter-qodercli",
+      "export": "qoderCliAdapter"
+    },
+    {
+      "type": "qoderclicn",
+      "module": "@mininglamp-oss/octo-runtime-adapter-qoderclicn",
+      "export": "qoderCliCnAdapter"
+    },
+    {
+      "type": "zcode-gui",
+      "module": "@mininglamp-oss/octo-runtime-adapter-zcode-gui",
+      "export": "zcodeGuiAdapter"
+    },
+    {
+      "type": "antigravity",
+      "module": "@mininglamp-oss/octo-runtime-adapter-antigravity",
+      "export": "antigravityAdapter"
+    }
+  ]
+}

package/apps/cli/dist/extras.d.ts

@@ -0,0 +1,6 @@
+import { type ExtraDescriptor, type StoredExtra } from "@mininglamp-oss/octo-runtime-daemon";
+import { type RuntimePaths } from "./state.js";
+/** Generic full replacement: no platform-specific CLI fields or validation. */
+export declare function setExtra(paths: RuntimePaths, name: string, input: NodeJS.ReadableStream): Promise<unknown>;
+export declare function readExtra(paths: RuntimePaths, name: string): Promise<ExtraDescriptor>;
+export declare function getExtra(paths: RuntimePaths, name: string): Promise<StoredExtra>;