@mininglamp-oss/octo-runtime 1.1.0 → 1.1.1

package/README.md

@@ -35,7 +35,9 @@ The Executor Kernel provides local execution. Channel Gateway and Loop Daemon ar
 
 ## Get Started
 
-You need **Node.js 24.x** and an installed, authenticated Provider. Runtime does not install Provider software or sign in for you.
+You need **Node.js 24.x or 26.x (LTS)** and an installed, authenticated Provider. Runtime does not install Provider software or sign in for you.
+
+The supported range is `^24.0.0 || ^26.0.0`. Node.js 25 and future majors are outside this range. CI checks installation, build, types, automated tests, and packed CLI/SDK consumption on both supported majors. New LTS majors are added after the same checks pass; support is reviewed at each LTS transition and before a supported major reaches end of life. Removal is announced in release notes before changing the engine range.
 
 ### 1. Install
 
@@ -117,7 +119,7 @@ The developer documentation covers architecture, your first SDK call, Kernel IPC
 
 ## Development
 
-Use Node.js 24.x and the pnpm version specified in `package.json`.
+Use Node.js 24.x or 26.x and the pnpm version specified in `package.json`. `.nvmrc`, Node.js type definitions, and publishing workflows intentionally stay on Node.js 24, the oldest supported baseline; this does not restrict consumers to 24.
 
 ```bash
 pnpm install

package/apps/cli/README.md

@@ -2,6 +2,8 @@
 
 CLI 是 Host SDK 的一个宿主，负责自己的 JSON 配置与原生用户服务。桌面或其他 HostApp 使用 SDK 接入。
 
+模块由 CLI 内置 `manifest.json` 与所选 Home 的 `manifest.json` 合并选择，均含 `adapters` 和 `extras`。默认发行全量；未启动 Extra 不导入，清单不保存业务凭据或启用设置。条目以原始清单文件为解析锚点，同名内置优先；显式 `--manifest` 完整替换两份默认来源。SDK 原生 import，不读取这些文件。双语说明见 [English](../../docs/en/concepts/module-loading.md) / [简体中文](../../docs/zh-CN/concepts/module-loading.md)。
+
 ## 命令
 
 ```text
@@ -53,7 +55,7 @@ octo-runtime channel-gateway restart
 octo-runtime extraget channel-gateway
 ```
 
-gateway.json 是完整声明 `{ "module": "@mininglamp-oss/octo-runtime-extra-channel-gateway", "config": { "bots": [] } }`。每次整份替换，保存文件权限为 POSIX 0600。extraset 不打印凭据；extraget 按显式请求返回完整配置，路径写入 stderr。
+gateway.json 可使用 `{ "config": { "bots": [] } }`，模块由 manifest 声明。旧 `module` 可保留，但必须与有效清单文字完全一致；自定义 Extra 先加入 Home 清单，冲突明确提示迁移。每次整份替换，保存文件权限为 POSIX 0600。extraset 不打印凭据；extraget 按显式请求返回完整配置，路径写入 stderr。
 
 ## 临时执行
 

package/apps/cli/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "commit": "d064cfe78f6818d3c451ecf803a280245f4b0496",
+  "commit": "20c377136288a55356300bd3d4a755d0f19a23ee",
   "dirty": false,
-  "buildTime": "2026-10-21T06:46:27.212Z"
+  "buildTime": "2026-10-22T07:38:35.134Z"
 }

package/apps/cli/dist/extras.d.ts

@@ -1,6 +1,8 @@
-import { type ExtraDescriptor, type StoredExtra } from "@mininglamp-oss/octo-runtime-host-sdk";
+import { type ExtraRegistration, type StoredExtra } from "@mininglamp-oss/octo-runtime-host-sdk";
 import { type RuntimePaths } from "./state.js";
+import { type ModuleManifest } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";
 /** Generic full replacement: no platform-specific CLI fields or validation. */
 export declare function setExtra(paths: RuntimePaths, name: string, input: NodeJS.ReadableStream): Promise<unknown>;
-export declare function readExtra(paths: RuntimePaths, name: string): Promise<ExtraDescriptor>;
+/** CLI 将模块目录与业务配置装配；仅 load 时解析/import，禁用项及未启动项不执行模块。 */
+export declare function readExtra(paths: RuntimePaths, name: string, manifest: ModuleManifest): Promise<ExtraRegistration>;
 export declare function getExtra(paths: RuntimePaths, name: string): Promise<StoredExtra>;

package/apps/cli/dist/extras.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
-import { assertExtraName, assertStoredExtra, readExtraDirectory } from "@mininglamp-oss/octo-runtime-host-sdk";
+import { assertExtraName, assertStoredExtra, readStoredExtra } from "@mininglamp-oss/octo-runtime-host-sdk";
 import { withSetupLock, writeJsonAtomic } from "./state.js";
+import { resolveModuleSpecifier } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";
 /** Generic full replacement: no platform-specific CLI fields or validation. */
 export async function setExtra(paths, name, input) {
     assertExtraName(name);
@@ -29,33 +30,31 @@ export async function setExtra(paths, name, input) {
         return { saved: true, name, file, reload_required: true };
     });
 }
-export async function readExtra(paths, name) {
+/** CLI 将模块目录与业务配置装配；仅 load 时解析/import，禁用项及未启动项不执行模块。 */
+export async function readExtra(paths, name, manifest) {
     assertExtraName(name);
-    const entries = await readExtraDirectory(join(paths.home, "extras"));
-    const entry = entries.find((item) => item.name === name);
+    const stored = await getExtra(paths, name);
+    const entry = manifest.extras.find((item) => item.name === name);
     if (!entry)
-        throw new Error("EXTRA_NOT_REGISTERED");
-    // Invalid stored declarations carry a controlled read error through their loader.
-    if (!entry.module)
-        await entry.load();
+        throw new Error("EXTRA_MANIFEST_DECLARATION_REQUIRED");
+    if (stored.module !== undefined && stored.module !== entry.module)
+        throw new Error("EXTRA_MODULE_MIGRATION_REQUIRED");
     return {
         name,
         module: entry.module,
-        config: entry.config,
-        ...(entry.enabled === undefined ? {} : { enabled: entry.enabled })
+        config: stored.config,
+        enabled: stored.enabled,
+        load: () => import(resolveModuleSpecifier(entry.module, entry.sourceManifest))
     };
 }
 export async function getExtra(paths, name) {
     assertExtraName(name);
-    const entries = await readExtraDirectory(join(paths.home, "extras"));
-    const entry = entries.find((item) => item.name === name);
-    if (!entry)
-        throw new Error("EXTRA_NOT_REGISTERED");
-    if (!entry.module)
-        await entry.load();
-    return {
-        module: entry.module,
-        ...(entry.enabled === undefined ? {} : { enabled: entry.enabled }),
-        config: entry.config
-    };
+    try {
+        return await readStoredExtra(join(paths.home, "extras"), name);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw new Error("EXTRA_NOT_REGISTERED", { cause: error });
+        throw error;
+    }
 }

package/apps/cli/dist/help.js

@@ -63,9 +63,11 @@ Commands:
   stop          Stop this service, preserving its autostart setting
   status        Show native service, IPC and component status
   run           Run this component in the foreground
+${component === "executor-kernel" ? "" : "  logs          Tail service status logs (no conversation content)\n"}
 
 Flags: --home <path> --profile <name> --manifest <path> --json --help
 Install: --autostart=true|false
+${component === "executor-kernel" ? "" : "Logs: --lines <1..10000> (default 200) --follow --json (NDJSON)\n"}
 Kernel and Extras have independent services and autostart settings.
 An Extra may start before Kernel and connect when Kernel becomes available.`;
     return `Octo Runtime CLI (${cliVersion})
@@ -75,6 +77,7 @@ Manage the local Agent runtime and independent services.
 Usage:
 octo-runtime executor-kernel uninstall|install|start|restart|stop|status|run
 octo-runtime <extra-name> uninstall|install|start|restart|stop|status|run
+octo-runtime <extra-name> logs [--lines 200] [--follow] [--json]
 octo-runtime status [--json]
 octo-runtime adapter list
 octo-runtime adapter probe <type>

package/apps/cli/dist/logs.d.ts

@@ -0,0 +1,10 @@
+export declare function showExtraLogs(options: {
+    home: string;
+    extra: string;
+    lines: number;
+    follow: boolean;
+    json: boolean;
+    output: (line: string, signal?: AbortSignal) => void | Promise<void>;
+    errorOutput: (line: string) => void;
+    signal?: AbortSignal;
+}): Promise<void>;

package/apps/cli/dist/logs.js

@@ -0,0 +1,186 @@
+import { constants } from "node:fs";
+import { lstat, open, opendir } from "node:fs/promises";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { extraStatusRecord } from "@mininglamp-oss/octo-runtime-adapter-sdk";
+const MAX_READ = 4 * 1024 * 1024;
+const MAX_LINE = 4096;
+function record(line, extra) {
+    if (Buffer.byteLength(line) > MAX_LINE)
+        return;
+    try {
+        const value = JSON.parse(line);
+        if (value.source !== "extra" || value.extra_type !== extra || typeof value.time !== "string")
+            return;
+        return extraStatusRecord(extra, value.level, value.event, value.data, value.time);
+    }
+    catch {
+        return;
+    }
+}
+async function files(home, extra) {
+    const directory = join(home, "logs", "extras");
+    for (const path of [join(home, "logs"), directory]) {
+        try {
+            const stat = await lstat(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                throw new Error("LOG_DIRECTORY_NOT_REGULAR");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        }
+    }
+    const pattern = new RegExp(`^${extra}-status-\\d{8}T\\d{2}\\.log$`);
+    // Keep only three candidates while scanning, without loading an unbounded directory listing.
+    const selected = [];
+    let count = 0;
+    for await (const entry of await opendir(directory)) {
+        if (++count > 10000)
+            throw new Error("LOG_SCAN_LIMIT");
+        if (!pattern.test(entry.name) || !entry.isFile() || entry.isSymbolicLink())
+            continue;
+        selected.push(join(directory, entry.name));
+        selected.sort();
+        if (selected.length > 3)
+            selected.shift();
+    }
+    return selected;
+}
+async function read(path, start, maximum) {
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1)
+            throw new Error("LOG_NOT_REGULAR_FILE");
+        const offset = start === undefined ? Math.max(0, stat.size - maximum) : Math.min(start, stat.size);
+        const buffer = Buffer.alloc(Math.min(maximum, stat.size - offset));
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
+        return {
+            text: buffer.subarray(0, bytesRead).toString("utf8"),
+            offset,
+            end: offset + bytesRead,
+            identity: `${stat.dev}:${stat.ino}`,
+            size: stat.size
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function showExtraLogs(options) {
+    if (!/^[a-z][a-z0-9-]{0,63}$/.test(options.extra) ||
+        !Number.isInteger(options.lines) ||
+        options.lines < 1 ||
+        options.lines > 10000)
+        throw new Error("INVALID_ARGUMENTS");
+    const controller = new AbortController();
+    const stop = () => controller.abort();
+    if (options.follow) {
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+        options.signal?.addEventListener("abort", stop, { once: true });
+        if (options.signal?.aborted)
+            stop();
+    }
+    const cursors = new Map();
+    const emit = async (value) => {
+        const text = options.json
+            ? JSON.stringify(value)
+            : `${value.time} ${value.level.toUpperCase()} ${value.extra_type} ${value.event}${Object.keys(value.data).length ? ` ${JSON.stringify(value.data)}` : ""}`;
+        await options.output(text, controller.signal);
+    };
+    try {
+        const selected = await files(options.home, options.extra);
+        let remaining = MAX_READ;
+        const chunks = [];
+        // Spend the shared byte budget newest-first, then emit complete records in file order.
+        for (const path of [...selected].reverse()) {
+            try {
+                const value = await read(path, undefined, remaining);
+                remaining -= Buffer.byteLength(value.text);
+                const lines = value.text.split("\n");
+                if (value.offset > 0)
+                    lines.shift();
+                const pending = lines.pop() ?? "";
+                cursors.set(path, {
+                    offset: value.end,
+                    identity: value.identity,
+                    pending: pending.length <= MAX_LINE ? pending : "",
+                    skipping: pending.length > MAX_LINE
+                });
+                chunks.unshift(lines
+                    .map((line) => record(line, options.extra))
+                    .filter((value) => !!value));
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        const tail = chunks.flat().slice(-options.lines);
+        for (const value of tail)
+            await emit(value);
+        if (!tail.length)
+            options.errorOutput(`${options.extra}: no service status logs`);
+        if (!options.follow)
+            return;
+        while (!controller.signal.aborted) {
+            await delay(500, undefined, { signal: controller.signal });
+            const current = await files(options.home, options.extra);
+            for (const path of cursors.keys())
+                if (!current.includes(path))
+                    cursors.delete(path);
+            let budget = MAX_READ;
+            for (const path of current) {
+                if (controller.signal.aborted || budget <= 0)
+                    break;
+                try {
+                    // Inode/size changes reset the cursor; preserve partial records across appends.
+                    let cursor = cursors.get(path);
+                    let value = await read(path, cursor?.offset ?? 0, budget);
+                    if (!cursor || cursor.identity !== value.identity || cursor.offset > value.size) {
+                        cursor = { offset: 0, identity: value.identity, pending: "", skipping: false };
+                        if (value.offset !== 0)
+                            value = await read(path, 0, budget);
+                    }
+                    budget -= Buffer.byteLength(value.text);
+                    const lines = (cursor.pending + value.text).split("\n");
+                    if (cursor.skipping) {
+                        if (lines.length === 1) {
+                            cursors.set(path, { ...cursor, offset: value.end });
+                            continue;
+                        }
+                        lines.shift();
+                    }
+                    const pending = lines.pop() ?? "";
+                    for (const line of lines) {
+                        const value = record(line, options.extra);
+                        if (value)
+                            await emit(value);
+                    }
+                    cursors.set(path, {
+                        offset: value.end,
+                        identity: value.identity,
+                        pending: pending.length <= MAX_LINE ? pending : "",
+                        skipping: pending.length > MAX_LINE
+                    });
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+            }
+        }
+    }
+    catch (error) {
+        if (!controller.signal.aborted)
+            throw error;
+    }
+    finally {
+        process.off("SIGINT", stop);
+        process.off("SIGTERM", stop);
+        options.signal?.removeEventListener("abort", stop);
+    }
+}

package/apps/cli/dist/main.d.ts

@@ -7,5 +7,6 @@ export interface CliDependencies extends ServiceControlOptions {
     sleep?: (ms: number) => Promise<void>;
     /** CLI 入口选择前台组件的退出策略；仅确认命令类型，不表示服务 ready。 */
     onComponentRun?: () => void;
+    logsSignal?: AbortSignal;
 }
 export declare function runCli(args: string[], dependencies?: CliDependencies): Promise<number>;

package/apps/cli/dist/main.js

@@ -1,16 +1,20 @@
 import net from "node:net";
 import { randomUUID } from "node:crypto";
-import { access, mkdir } from "node:fs/promises";
+import { once } from "node:events";
+import { lstat, mkdir } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { attachKernel, createKernelService, readAdapterConfigurations } from "@mininglamp-oss/octo-runtime-executor-kernel";
-import { componentEndpoint, createExtraService, extraRegistration } from "@mininglamp-oss/octo-runtime-host-sdk";
+import { componentEndpoint, createExtraService } from "@mininglamp-oss/octo-runtime-host-sdk";
 import { getExtra, readExtra, setExtra } from "./extras.js";
 import { cliVersionInfo, helpText } from "./help.js";
 import { runForegroundService } from "./foreground.js";
+import { showExtraLogs } from "./logs.js";
+import { StatusOutput } from "./status-output.js";
 import { defaultRuntimeHome, runtimePaths, withSetupLock, readJsonFile } from "./state.js";
 import { resolveServiceControl } from "./service-control.js";
-import { initializeCliOpenClaw, syncCliOpenClawToolEnvironment } from "./openclaw.js";
+import { loadCliManifest } from "./module-manifest.js";
+import { resolveAdapterModules } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";
 import { readExtraDirectory } from "@mininglamp-oss/octo-runtime-host-sdk";
 import { describeError, formatStatus, recordStartupFailure, readStartupFailure } from "./output.js";
 const components = ["executor-kernel", "channel-gateway"];
@@ -20,8 +24,11 @@ export async function runCli(args, dependencies = {}) {
     let json = args.includes("--json");
     let context = {};
     let runningComponent;
+    let statusOutput;
     try {
         const { flags, positional } = parse(args);
+        if ((flags.lines !== undefined || flags.follow !== undefined) && positional[1] !== "logs")
+            throw new Error("INVALID_ARGUMENTS");
         json = Boolean(flags.json);
         if (flags.version || positional[0] === "version") {
             output(cliVersionInfo);
@@ -37,16 +44,65 @@ export async function runCli(args, dependencies = {}) {
             return 0;
         }
         const home = resolve(flags.home ?? defaultRuntimeHome(dependencies.env, dependencies.platform));
+        // Route logs before config/module/manager access so offline failures remain diagnosable.
+        if (positional[1] === "logs") {
+            const extra = positional[0];
+            context = { component: extra, action: "logs", logs: join(home, "logs", "extras") };
+            if (positional.length !== 2 ||
+                extra === "executor-kernel" ||
+                !/^[a-z][a-z0-9-]{0,63}$/.test(extra) ||
+                flags.autostart !== undefined)
+                throw new Error("INVALID_ARGUMENTS");
+            if (!builtinComponents.includes(extra)) {
+                const registration = await lstat(join(home, "extras", extra, "config.json")).catch((error) => {
+                    if (error.code === "ENOENT")
+                        return undefined;
+                    throw error;
+                });
+                if (!registration?.isFile() || registration.isSymbolicLink())
+                    throw new Error("EXTRA_NOT_FOUND");
+            }
+            if (flags.lines !== undefined && !/^[1-9][0-9]{0,4}$/.test(flags.lines))
+                throw new Error("INVALID_ARGUMENTS");
+            await showExtraLogs({
+                home,
+                extra,
+                lines: Number(flags.lines ?? 200),
+                follow: Boolean(flags.follow),
+                json,
+                output: dependencies.output ??
+                    (async (line, signal) => {
+                        if (!process.stdout.write(`${line}\n`))
+                            await once(process.stdout, "drain", { signal });
+                    }),
+                errorOutput: dependencies.errorOutput ??
+                    ((line) => {
+                        process.stderr.write(`${line}\n`);
+                    }),
+                signal: dependencies.logsSignal
+            });
+            return 0;
+        }
         const root = await readJsonFile(runtimePaths(home, "default").rootConfig);
         const profile = flags.profile ?? root?.default_profile ?? "default";
         const paths = runtimePaths(home, profile, dependencies.platform);
         const endpoint = componentEndpoint(home, "executor-kernel", dependencies.platform);
         context = { component: positional[0], action: positional[1], logs: join(home, "logs") };
         const registrations = await readExtraDirectory(join(home, "extras"));
+        // 部署、停止及配置修复命令不启动模块，也不因尚未可读的启动清单而无法操作。
+        const needsManifest = positional[1] === "run" ||
+            (!builtinComponents.includes(positional[0]) &&
+                !registrations.some((entry) => entry.name === positional[0]) &&
+                ["install", "start", "restart", "stop", "uninstall", "status"].includes(positional[1]));
+        const manifest = needsManifest
+            ? await loadCliManifest(home, flags.manifest, dependencies.errorOutput ?? ((message) => process.stderr.write(`${message}\n`)))
+            : undefined;
         const componentNames = [
             ...new Set([...components, ...registrations.map((entry) => entry.name)])
         ];
-        const isComponent = (name) => builtinComponents.includes(name) || registrations.some((entry) => entry.name === name);
+        const isComponent = (name) => builtinComponents.includes(name) ||
+            registrations.some((entry) => entry.name === name) ||
+            manifest?.extras.some((entry) => entry.name === name) === true;
         if (positional.length === 1 && isComponent(positional[0])) {
             output(helpText(positional[0]));
             return 0;
@@ -159,41 +215,45 @@ export async function runCli(args, dependencies = {}) {
             return 0;
         }
         if (action === "run") {
+            if (!manifest)
+                throw new Error("MANIFEST_INVALID");
             runningComponent = component;
             dependencies.onComponentRun?.();
             await mkdir(home, { recursive: true, mode: 0o700 });
             let handle;
             if (component === "executor-kernel") {
-                // 显式清单不存在时在宿主边界保留 ENOENT，而非等待 worker 断开后丢失原因。
-                if (flags.manifest)
-                    await access(resolve(flags.manifest));
-                await initializeCliOpenClaw(paths.profileRoot, dependencies.env ?? process.env);
-                await syncCliOpenClawToolEnvironment(paths.profileRoot, await readExtraDirectory(join(home, "extras")));
                 const config = await readJsonFile(paths.profileConfig);
                 handle = createKernelService({
                     endpoint,
                     stateDirectory: join(home, "run"),
-                    workerEntrypoint: fileURLToPath(import.meta.resolve("@mininglamp-oss/octo-runtime-executor-kernel/runner")),
-                    manifest: flags.manifest
-                        ? resolve(flags.manifest)
-                        : fileURLToPath(new URL("./default_adapters.json", import.meta.url)),
+                    workerEntrypoint: fileURLToPath(new URL("./worker.js", import.meta.url)),
+                    adapterModules: resolveAdapterModules(manifest),
                     adapterConfigurations: readAdapterConfigurations(paths.profileRoot, config?.adapters),
                     env: {
                         ...(dependencies.env ?? process.env),
                         OCTO_RUNTIME_HOME: home,
+                        OCTO_RUNTIME_CLI_PROFILE_ROOT: paths.profileRoot,
+                        OCTO_RUNTIME_CLI_SYNC_OPENCLAW_TOOLS: "1",
                         OCTO_RUNTIME_LOGS_DIRECTORY: join(home, "logs")
                     }
                 });
             }
             else {
-                const registration = extraRegistration(await readExtra(paths, component));
+                const registration = await readExtra(paths, component, manifest);
                 const module = registration.enabled === false
                     ? { name: registration.name, default: () => () => { } }
                     : await registration.load();
                 if (module.name !== registration.name)
                     throw new Error("EXTRA_NAME_MISMATCH");
+                if (!dependencies.output)
+                    statusOutput = new StatusOutput(process.stdout);
                 handle = createExtraService({
-                    logging: { directory: join(home, "logs") },
+                    logging: {
+                        directory: join(home, "logs"),
+                        statusOutput: dependencies.output
+                            ? (record) => output(JSON.stringify(record))
+                            : statusOutput.write
+                    },
                     module,
                     config: registration.config,
                     dependencies: {},
@@ -202,7 +262,7 @@ export async function runCli(args, dependencies = {}) {
                     controlEndpoint: componentEndpoint(home, component, dependencies.platform)
                 });
             }
-            return runForegroundService(handle, () => publish({ component, state: "ready" }, `${component}: ready`), async (error) => {
+            return await runForegroundService(handle, () => publish({ component, state: "ready" }, `${component}: ready`), async (error) => {
                 try {
                     await recordStartupFailure(join(home, "logs"), component, error);
                 }
@@ -292,7 +352,7 @@ export async function runCli(args, dependencies = {}) {
         const failure = { ...describeError(error), ...context };
         const code = failure.code;
         if (json)
-            output(JSON.stringify({ error: failure }, null, 2));
+            output(JSON.stringify({ error: failure }, null, context.action === "logs" ? undefined : 2));
         else
             (dependencies.errorOutput ?? ((line) => process.stderr.write(`${line}\n`)))(`${[context.component, context.action].filter(Boolean).join(" ") || "octo-runtime"}: ${code}${failure.cause_code ? ` (${failure.cause_code})` : ""}\n${failure.message}${context.logs ? `\nLogs: ${context.logs}` : ""}`);
         return ["SERVICE_NOT_INSTALLED", "NOT_INSTALLED"].includes(code)
@@ -305,6 +365,9 @@ export async function runCli(args, dependencies = {}) {
                         ? 4
                         : 1;
     }
+    finally {
+        statusOutput?.close();
+    }
 }
 async function componentStatus(home, component, platform, requireReady = false) {
     const endpoint = componentEndpoint(home, component, platform);
@@ -372,11 +435,23 @@ function parse(args) {
         }
         const match = /^--([a-z-]+)(?:=(.*))?$/.exec(arg);
         if (!match ||
-            !["home", "profile", "manifest", "json", "help", "version", "autostart"].includes(match[1]) ||
+            ![
+                "home",
+                "profile",
+                "manifest",
+                "json",
+                "help",
+                "version",
+                "autostart",
+                "lines",
+                "follow"
+            ].includes(match[1]) ||
             Object.hasOwn(flags, match[1]))
             throw new Error("INVALID_ARGUMENTS");
         const key = match[1];
-        flags[key] = ["json", "help", "version"].includes(key) ? "true" : (match[2] ?? args[++i]);
+        flags[key] = ["json", "help", "version", "follow"].includes(key)
+            ? "true"
+            : (match[2] ?? args[++i]);
         if (!flags[key] ||
             flags[key].startsWith("--") ||
             (key === "autostart" && !["true", "false"].includes(flags[key])))

package/apps/cli/dist/{default_adapters.json → manifest.json}

@@ -61,5 +61,10 @@
       "module": "@mininglamp-oss/octo-runtime-adapter-antigravity",
       "export": "antigravityAdapter"
     }
+  ],
+  "extras": [
+    { "name": "channel-gateway", "module": "@mininglamp-oss/octo-runtime-extra-channel-gateway" },
+    { "name": "channel-wecom", "module": "@mininglamp-oss/octo-runtime-extra-channel-wecom" },
+    { "name": "webui", "module": "@mininglamp-oss/octo-runtime-extra-webui" }
   ]
 }

package/apps/cli/dist/module-manifest.d.ts

@@ -0,0 +1,3 @@
+import { type ModuleManifest } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";
+/** CLI 独占默认目录与 Home 扩展策略；SDK 原生装配不读取这两份文件。 */
+export declare function loadCliManifest(home: string, override?: string, report?: (message: string) => void): Promise<ModuleManifest>;

package/apps/cli/dist/module-manifest.js

@@ -0,0 +1,11 @@
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { mergeModuleManifests, readModuleManifest } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";
+/** CLI 独占默认目录与 Home 扩展策略；SDK 原生装配不读取这两份文件。 */
+export async function loadCliManifest(home, override, report = (message) => console.error(message)) {
+    if (override)
+        return readModuleManifest(resolve(override), { legacy: true });
+    const builtin = await readModuleManifest(fileURLToPath(new URL("./manifest.json", import.meta.url)));
+    const extension = await readModuleManifest(join(home, "manifest.json"), { optional: true });
+    return mergeModuleManifests(builtin, extension, report);
+}

package/apps/cli/dist/openclaw.js

@@ -1,7 +1,6 @@
 import { readFile, mkdir, writeFile, rename, lstat, chmod, rm } from "node:fs/promises";
 import { parseEnv, promisify } from "node:util";
 import { execFile } from "node:child_process";
-import { configuredCredential, validateImBots, octoCliEnvironment } from "@mininglamp-oss/octo-runtime-extra-channel-gateway";
 import { randomUUID } from "node:crypto";
 import { isIP } from "node:net";
 import { homedir, networkInterfaces } from "node:os";
@@ -103,15 +102,40 @@ export async function syncCliOpenClawToolEnvironment(runtimeRoot, extras) {
     if (!channel || channel.config.bots === undefined)
         return { written: false, restartRequired: false };
     const bots = channel.config.bots;
-    validateImBots(bots);
+    if (!Array.isArray(bots) || bots.length > 64)
+        throw new Error("IM_CONFIG_LIST_REQUIRED");
     let values;
-    for (const bot of bots) {
-        if (bot.enabled === false || bot.adapter.adapter_type !== "openclaw")
+    for (const value of bots) {
+        const bot = record(value);
+        if (!bot)
+            throw new Error("IM_CONFIG_INVALID");
+        if (bot.enabled === false || record(bot.adapter)?.adapter_type !== "openclaw")
             continue;
-        const token = configuredCredential(bot);
+        const token = typeof bot.bf_token === "string" ? bot.bf_token.trim() : undefined;
         if (!token)
             throw new Error("IM_CREDENTIALS_REQUIRED");
-        values = Object.fromEntries(octoCliEnvironment(bot.api_url, token).env_variables.map(({ key, value }) => [key, value]));
+        // CLI 仅校验自己要写入的工具身份；完整 Bot 配置由启动后的 Extra 校验。
+        // 不为 Kernel 的 dotenv 同步导入整个业务 Extra，否则未启动 Extra 缺包也会阻塞 Kernel。
+        if (!/^bf_[A-Za-z0-9_-]+$/.test(token))
+            throw new Error("IM_BOT_TOKEN_INVALID");
+        let url;
+        try {
+            if (typeof bot.api_url !== "string")
+                throw new Error();
+            url = new URL(bot.api_url);
+        }
+        catch {
+            throw new Error("IM_API_URL_INVALID");
+        }
+        if (url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            (url.protocol !== "https:" &&
+                !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))))
+            throw new Error("IM_API_URL_INVALID");
+        url.pathname = url.pathname.replace(/\/+$/, "").replace(/\/api$/, "");
+        values = { OCTO_BOT_TOKEN: token, OCTO_API_BASE_URL: url.href.replace(/\/+$/, "") };
     }
     if (!values)
         return { written: false, restartRequired: false };