@mininglamp-oss/octo-runtime 1.1.0 → 1.1.1

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/supervisor.js

@@ -1,6 +1,7 @@
-import { spawnWorker } from "./process.js";
+import { closeWorker, spawnWorker } from "./process.js";
 import { KernelError } from "./types.js";
-/** Kernel 独占 worker 的创建与回收；清理失败时禁止启动替代实例。 */
+import { WorkerHeartbeat } from "./heartbeat.js";
+/** Kernel exclusively owns worker replacement; incomplete cleanup prevents a second owner. */
 export class WorkerSupervisor {
     options;
     recordWorker;
@@ -11,12 +12,13 @@ export class WorkerSupervisor {
     #closing = false;
     #recovery;
     #timer;
-    #lastPong = 0;
-    #pendingPing = false;
-    #stableSince = 0;
+    #heartbeat;
+    #activeTime = 0;
     #attempts = [];
+    #slowRecovery = false;
     #abort = new AbortController();
     #cleanupFailure;
+    #closeUntil;
     constructor(options, recordWorker) {
         this.options = options;
         this.recordWorker = recordWorker;
@@ -63,35 +65,44 @@ export class WorkerSupervisor {
             throw error;
         }
         if (this.#closing) {
-            await worker.close();
+            try {
+                await closeWorker(worker, this.#closeUntil ?? Date.now() + 5000, true);
+            }
+            catch (error) {
+                // A late startup still owns resources; failed rollback must block every future replacement.
+                throw (this.#cleanupFailure = new AggregateError([error], "WORKER_CLEANUP_INCOMPLETE"));
+            }
             return;
         }
         this.#worker = worker;
         this.#generation++;
         this.#state = "ready";
-        this.#stableSince = Date.now();
-        this.#lastPong = Date.now();
-        this.#pendingPing = false;
+        const heartbeat = new WorkerHeartbeat();
+        this.#heartbeat = heartbeat;
+        let elapsed = 0;
         worker.child.on("message", (message) => {
             if (this.#worker === worker &&
                 message &&
                 typeof message === "object" &&
                 "type" in message &&
                 message.type === "worker.pong") {
-                this.#lastPong = Date.now();
-                this.#pendingPing = false;
+                heartbeat.pong("probe" in message ? message.probe : undefined);
             }
         });
         worker.child.once("exit", () => this.#failed(worker));
         worker.child.once("error", () => this.#failed(worker));
         this.#timer = setInterval(() => {
-            if (Date.now() - this.#lastPong >= 5000) {
+            if (this.#closing || this.#worker !== worker || this.#state !== "ready")
+                return;
+            const probe = heartbeat.tick();
+            this.#activeTime += heartbeat.activeMs - elapsed;
+            elapsed = heartbeat.activeMs;
+            if (probe.type === "expired") {
                 this.#failed(worker);
                 return;
             }
-            if (!this.#pendingPing && worker.child.connected) {
-                this.#pendingPing = true;
-                worker.child.send({ type: "kernel.ping" }, (error) => {
+            if (probe.type === "ping" && worker.child.connected) {
+                worker.child.send({ type: "kernel.ping", probe: probe.id }, (error) => {
                     if (error)
                         this.#failed(worker);
                 });
@@ -106,31 +117,39 @@ export class WorkerSupervisor {
             return;
         clearInterval(this.#timer);
         this.#state = "recovering";
-        // 先拒绝原 RPC，让 Run 源生成唯一 lost 终态；恢复只允许新 Run。
+        // Reject the old RPC first so its source emits one lost terminal. Recovery admits new work only.
         worker.client.close(new KernelError("WORKER_LOST"));
-        if (Date.now() - this.#stableSince >= 60_000) {
+        if ((this.#heartbeat?.healthyMs ?? 0) >= 60_000) {
             this.#attempts = [];
             this.#attempt = 0;
+            this.#slowRecovery = false;
         }
-        this.#recovery = this.#recover(worker).catch(() => {
-            this.#state = "exhausted";
+        this.#recovery = this.#recover(worker).catch((error) => {
+            // Only unconfirmed cleanup or ownership ends recovery; ordinary startup failures stay retryable.
+            this.#cleanupFailure ??= new AggregateError([error], "WORKER_RECOVERY_BLOCKED");
+            if (!this.#closing)
+                this.#state = "exhausted";
         });
     }
     async #recover(worker) {
-        // 旧 worker 清理成功才允许替换，避免两个 Provider 实例并行持有同一执行资源。
-        // 只恢复服务可用性，不重放旧 Run；旧流已由 #failed 标为 lost。
-        await worker.close();
+        // Reap the old worker before replacement to prevent concurrent Provider owners.
+        // Restore service availability only; #failed already marked old runs lost and never replays them.
+        // Preserve baseline recovery for leaders that exited before close began. On Windows this
+        // path cannot verify detached descendants; EOF-close checks require a live leader at entry.
+        if (worker.child.exitCode !== null || worker.child.signalCode !== null)
+            await worker.close();
+        else
+            await closeWorker(worker, Date.now() + 4800, true);
         await this.recordWorker?.(undefined);
         this.#worker = undefined;
-        for (let attempt = 0; attempt < 3; attempt++) {
-            if (this.#closing)
-                return;
-            this.#attempts = this.#attempts.filter((at) => Date.now() - at < 60_000);
+        while (!this.#closing) {
+            // Suspend time and clock changes must not replenish a recently exhausted restart budget.
+            this.#attempts = this.#attempts.filter((at) => this.#activeTime - at < 60_000);
             if (this.#attempts.length >= 3)
-                break;
-            const delay = [250, 1000, 4000][this.#attempts.length];
-            this.#attempts.push(Date.now());
-            this.#attempt++;
+                this.#slowRecovery = true;
+            // Exhausting the fast budget opens a bounded-rate recovery loop, not a permanent outage.
+            // Keep slow recovery across short-lived workers until 60 seconds of health is observed.
+            const delay = this.#slowRecovery ? 15_000 : [250, 1000, 4000][this.#attempts.length];
             await new Promise((resolve) => {
                 const finish = () => {
                     clearTimeout(timer);
@@ -142,6 +161,9 @@ export class WorkerSupervisor {
             });
             if (this.#closing)
                 return;
+            if (!this.#slowRecovery)
+                this.#attempts.push(this.#activeTime);
+            this.#attempt = Math.min(Number.MAX_SAFE_INTEGER, this.#attempt + 1);
             try {
                 await this.#spawn();
                 return;
@@ -149,17 +171,18 @@ export class WorkerSupervisor {
             catch (error) {
                 if (error instanceof AggregateError)
                     throw error;
-                /* 普通启动失败已回收；聚合清理错误禁止继续替换。 */
+                /* Ordinary startup failures are reaped; aggregate cleanup failures prevent replacement. */
             }
         }
-        this.#state = "exhausted";
     }
-    async close() {
+    async close(until = Date.now() + 5000) {
         this.#closing = true;
+        this.#closeUntil ??= until;
         this.#abort.abort();
         clearInterval(this.#timer);
         await this.#recovery;
-        await this.#worker?.close();
+        if (this.#worker)
+            await closeWorker(this.#worker, this.#closeUntil);
         if (this.#cleanupFailure)
             throw this.#cleanupFailure;
         await this.recordWorker?.(undefined);

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mininglamp-oss/octo-runtime-executor-kernel",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "private": true,
   "type": "module",
   "exports": {
@@ -8,27 +8,19 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
+    "./manifest-adapters": {
+      "types": "./dist/manifest-adapters.d.ts",
+      "import": "./dist/manifest-adapters.js"
+    },
     "./runner": {
       "types": "./dist/runner.d.ts",
       "import": "./dist/runner.js"
     }
   },
   "dependencies": {
-    "@mininglamp-oss/octo-runtime-executor-core": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-antigravity": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-claude-code": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-codebuddy": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-codex": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-hermes": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-kimi-code": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-mcode": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-openclaw": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-opencode": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-qodercli": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-qoderclicn": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-zcode-gui": "1.1.0",
-    "@mininglamp-oss/octo-runtime-protocol": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.0"
+    "@mininglamp-oss/octo-runtime-executor-core": "1.1.1",
+    "@mininglamp-oss/octo-runtime-protocol": "1.1.1",
+    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.1"
   },
   "types": "./dist/index.d.ts",
   "files": [

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/config-schema.json

@@ -6,12 +6,12 @@
   "$comment": "声明文件最多 1 MiB，POSIX 权限须为 0600；单 Bot JSON 最多 256 KiB。Bot 按规范化 api_url 与 bot_id 组合判重。路径可访问性、凭据、身份和 Space 授权、重试起点不大于上限等关系仍需运行时检查。Context 内部对象遵循 octo.context-envelope/v3，具体协议约束由现有运行时校验，本文件不重复展开。",
   "type": "object",
   "additionalProperties": false,
-  "required": ["module", "config"],
+  "required": ["config"],
   "properties": {
     "module": {
       "type": "string",
       "const": "@mininglamp-oss/octo-runtime-extra-channel-gateway",
-      "description": "必填。Octo IM Extra 的固定包入口；宿主须预先安装并确保模块可解析。此 schema 约束包名声明，宿主通过绝对路径加载同一模块时可自行调整该约束。插件实例名及 CLI 配置目录名为 channel-gateway。"
+      "description": "可选旧声明。CLI 从 manifest.json 选择模块；省略时使用有效清单，保留时须与清单文字一致。SDK 原生 import 不需要此字段。此 schema 约束固定包名，宿主使用其他公开路径时可自行调整。"
     },
     "enabled": {
       "type": "boolean",

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/application/im-channel.js

@@ -49,7 +49,6 @@ export class ImRuntime {
     #busyNotifications = new Map();
     #busyNotifiedAt = new Map();
     #retry = 0;
-    #everOnline = false;
     #disconnecting;
     constructor(config, dependencies) {
         this.dependencies = dependencies;
@@ -110,7 +109,6 @@ export class ImRuntime {
             this.dependencies.signal?.addEventListener("abort", this.#ownerStopped, { once: true });
             this.#delivery = new ImDeliveryDispatcher(this.#signal);
         }
-        this.#everOnline = false;
         this.#retry = 0;
         this.#error = undefined;
         this.#state = "connecting";
@@ -125,6 +123,9 @@ export class ImRuntime {
     async #connect(recovering) {
         if (this.#closed || this.#draining || this.#signal.aborted)
             return;
+        this.#log(recovering ? "channel.retry_started" : "channel.connecting", {
+            attempt: this.#retry
+        });
         this.#connectionAbort?.abort();
         try {
             await this.#disconnecting;
@@ -134,7 +135,7 @@ export class ImRuntime {
             this.#state = this.#closed ? "stopped" : "failed";
             if (!this.#closed)
                 this.#error = "IM_DISPOSE_FAILED";
-            this.#everOnline = false;
+            this.#diagnostic("IM_DISPOSE_FAILED");
             return;
         }
         if (this.#closed || this.#draining || this.#signal.aborted)
@@ -183,7 +184,6 @@ export class ImRuntime {
             if (disconnected)
                 throw disconnected;
             starting = false;
-            this.#everOnline = true;
             this.#state = "online";
             this.#log("channel.connected", { state: "online" });
             this.#error = undefined;
@@ -196,21 +196,19 @@ export class ImRuntime {
             const failure = connectionFailure(error);
             this.#connectionAbort.abort();
             this.#error = failure.message;
-            const retry = recovering && this.#everOnline && failure.retryable;
+            // Offline startup and later disconnects share recovery; only error semantics decide eligibility.
+            const retry = failure.retryable;
             this.#state = retry ? "retrying" : "failed";
             this.#log("channel.connection_failed", { state: this.#state, code: failure.message });
             try {
                 await connector.close();
             }
             catch {
-                this.#everOnline = false;
                 if (!this.#closed)
                     this.#state = "failed";
                 this.#diagnostic("IM_DISPOSE_FAILED");
                 return;
             }
-            if (!retry)
-                this.#everOnline = false;
             if (retry)
                 this.#scheduleReconnect(failure.retryAfterMs);
         }
@@ -218,12 +216,10 @@ export class ImRuntime {
     #lostConnection(connector, failure) {
         this.#log("channel.disconnected", { code: failure.message });
         this.#error = failure.message;
-        const retry = this.#everOnline && failure.retryable;
+        const retry = failure.retryable;
         this.#state = retry ? "retrying" : "failed";
-        if (!retry)
-            this.#everOnline = false;
         this.#connectionAbort?.abort();
-        // 先收回旧连接资源，再计时；停止信号与迟到回调不能建立第二条连接。
+        // Reap the old connection before backoff; shutdown and stale callbacks cannot create a second owner.
         this.#disconnecting = connector.close();
         void this.#disconnecting.then(() => {
             if (retry)
@@ -231,7 +227,6 @@ export class ImRuntime {
         }, () => {
             if (!this.#closed)
                 this.#state = "failed";
-            this.#everOnline = false;
             this.#diagnostic("IM_DISPOSE_FAILED");
         });
     }
@@ -242,9 +237,14 @@ export class ImRuntime {
             this.#state !== "retrying" ||
             this.#reconnect)
             return;
-        const delayMs = Math.max(Math.min(30_000, 5_000 * 2 ** this.#retry), retryAfterMs);
-        this.#retry = Math.min(3, this.#retry + 1);
-        // Node 超过 2^31-1 的 timeout 会变为 1ms；长 Retry-After 分段等待，不能绕过限流。
+        const delayMs = Math.max([5_000, 10_000, 15_000][Math.min(2, this.#retry)], retryAfterMs);
+        this.#retry = Math.min(Number.MAX_SAFE_INTEGER, this.#retry + 1);
+        this.#log("channel.retry_scheduled", {
+            state: "retrying",
+            delay_ms: delayMs,
+            attempt: this.#retry
+        });
+        // Node clamps oversized timers to 1ms. Partition long Retry-After waits without bypassing throttling.
         const deadline = performance.now() + delayMs;
         const wake = () => {
             if (this.#closed || this.#draining || this.#signal.aborted || this.#state !== "retrying")
@@ -1069,7 +1069,6 @@ export class ImRuntime {
         this.#state = "stopped";
         this.#log("channel.stopped", { state: "stopped" });
         this.#error = undefined;
-        this.#everOnline = false;
         this.#retry = 0;
         for (const preparation of this.#preparing.values())
             preparation.abort();

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mininglamp-oss/octo-runtime-extra-channel-gateway",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "private": true,
   "type": "module",
   "exports": {
@@ -18,11 +18,11 @@
     "docs"
   ],
   "dependencies": {
-    "@mininglamp-oss/octo-runtime-executor-kernel": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.0",
-    "@mininglamp-oss/octo-runtime-executor-core": "1.1.0",
-    "@mininglamp-oss/octo-runtime-host-sdk": "1.1.0",
-    "@mininglamp-oss/octo-runtime-protocol": "1.1.0",
+    "@mininglamp-oss/octo-runtime-executor-kernel": "1.1.1",
+    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.1",
+    "@mininglamp-oss/octo-runtime-executor-core": "1.1.1",
+    "@mininglamp-oss/octo-runtime-host-sdk": "1.1.1",
+    "@mininglamp-oss/octo-runtime-protocol": "1.1.1",
     "mdast-util-from-markdown": "2.1.0",
     "ws": "8.22.0"
   }

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-wecom/config-schema.json

@@ -6,12 +6,12 @@
   "$comment": "声明文件最多 1 MiB，POSIX 权限须为 0600。Bot 按 ws_url 与 bot_id 的组合判重；凭据文件权限、目标 Agent 是否存在、Provider 是否可用等仍需运行时检查。Context 内部对象遵循 octo.context-envelope/v3，具体协议约束由现有运行时校验，本文件不重复展开。",
   "type": "object",
   "additionalProperties": false,
-  "required": ["module", "config"],
+  "required": ["config"],
   "properties": {
     "module": {
       "type": "string",
       "const": "@mininglamp-oss/octo-runtime-extra-channel-wecom",
-      "description": "必填。企业微信 Extra 的固定包入口；宿主须预先安装并确保模块可解析。此 schema 约束包名声明，宿主通过绝对路径加载同一模块时可自行调整该约束。插件实例名及 CLI 配置目录名为 channel-wecom。"
+      "description": "可选旧声明。CLI 从 manifest.json 选择模块；省略时使用有效清单，保留时须与清单文字一致。SDK 原生 import 不需要此字段。此 schema 约束固定包名，宿主使用其他公开路径时可自行调整。"
     },
     "enabled": {
       "type": "boolean",

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-wecom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mininglamp-oss/octo-runtime-extra-channel-wecom",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "private": true,
   "type": "module",
   "exports": {
@@ -18,10 +18,10 @@
     "docs"
   ],
   "dependencies": {
-    "@mininglamp-oss/octo-runtime-host-sdk": "1.1.0",
-    "@mininglamp-oss/octo-runtime-executor-core": "1.1.0",
-    "@mininglamp-oss/octo-runtime-executor-kernel": "1.1.0",
+    "@mininglamp-oss/octo-runtime-host-sdk": "1.1.1",
+    "@mininglamp-oss/octo-runtime-executor-core": "1.1.1",
+    "@mininglamp-oss/octo-runtime-executor-kernel": "1.1.1",
     "ws": "8.22.0",
-    "@mininglamp-oss/octo-runtime-protocol": "1.1.0"
+    "@mininglamp-oss/octo-runtime-protocol": "1.1.1"
   }
 }

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/config-schema.json

@@ -6,12 +6,12 @@
   "$comment": "声明文件最多 1 MiB，POSIX 权限须为 0600。端口占用、路径可访问性、会话文件内容及文件权限仍需运行时检查。加载生命周期 loaded 不等于监听成功，宿主须检查插件状态中的 listening 与 errors。",
   "type": "object",
   "additionalProperties": false,
-  "required": ["module", "config"],
+  "required": ["config"],
   "properties": {
     "module": {
       "type": "string",
       "const": "@mininglamp-oss/octo-runtime-extra-webui",
-      "description": "必填。本地 WebUI Extra 的固定包入口；宿主须预先安装并确保模块可解析。此 schema 约束包名声明，宿主通过绝对路径加载同一模块时可自行调整该约束。插件实例名及 CLI 配置目录名为 webui。"
+      "description": "可选旧声明。CLI 从 manifest.json 选择模块；省略时使用有效清单，保留时须与清单文字一致。SDK 原生 import 不需要此字段。此 schema 约束固定包名，宿主使用其他公开路径时可自行调整。"
     },
     "enabled": {
       "type": "boolean",

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/dist/index.js

@@ -73,7 +73,7 @@ async function initialize(ctx, config) {
         errors.push("WEBUI_CONTEXT_INVALID");
         return;
     }
-    const store = new SessionStore(config.sessionStorePath);
+    const store = new SessionStore(config.sessionStorePath, ctx.log);
     try {
         await store.open();
     }

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/dist/store.d.ts

@@ -1,3 +1,4 @@
+import type { RuntimeLog } from "@mininglamp-oss/octo-runtime-host-sdk";
 export interface Session {
     id: string;
     title: string;
@@ -14,9 +15,11 @@ export declare function validMessages(value: unknown): value is unknown[];
 export declare function validBinding(value: unknown): value is Record<string, unknown>;
 export declare class SessionStore {
     readonly path: string;
+    private readonly log?;
     records: Session[];
     private queue;
-    constructor(path: string);
+    constructor(path: string, log?: RuntimeLog | undefined);
+    private cleanupError;
     open(): Promise<void>;
     change<T>(operation: (records: Session[]) => T): Promise<T>;
 }

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/dist/store.js

@@ -1,6 +1,26 @@
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+// 本机 Windows 的瞬态 EPERM 在约 1.6 秒后恢复；只重试替换，不重放业务变更。
+// 最多 8 次替换、3170 ms 退避；文件系统调用和调度本身的耗时不计入退避预算。
+const replacementDelays = [20, 50, 100, 200, 400, 800, 1600];
+async function replace(temporary, destination) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            await rename(temporary, destination);
+            return;
+        }
+        catch (error) {
+            // 返回结束重试的实际错误及其原生字段，不能让最初的 EPERM 掩盖后续错误。
+            if (process.platform !== "win32" ||
+                error.code !== "EPERM" ||
+                attempt === replacementDelays.length)
+                throw error;
+            await delay(replacementDelays[attempt]);
+        }
+    }
+}
 export function validMessages(value) {
     return (Array.isArray(value) &&
         value.every((message) => {
@@ -24,10 +44,21 @@ export function validBinding(value) {
 }
 export class SessionStore {
     path;
+    log;
     records = [];
     queue = Promise.resolve();
-    constructor(path) {
+    constructor(path, log) {
         this.path = path;
+        this.log = log;
+    }
+    cleanupError(event, error) {
+        // 清理可能因未释放句柄等原因失败；仅报告错误码，诊断失败不能覆盖保存错误。
+        try {
+            this.log?.("warn", event, { code: error?.code });
+        }
+        catch {
+            // 日志回调不能改变存储操作的结果。
+        }
     }
     async open() {
         try {
@@ -69,8 +100,27 @@ export class SessionStore {
                 throw new Error("WEBUI_STORE_TOO_LARGE");
             await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
             const temporary = `${this.path}.${randomUUID()}.tmp`;
-            await writeFile(temporary, text, { mode: 0o600, flag: "wx" });
-            await rename(temporary, this.path);
+            // 独占创建成功才取得所有权；open 失败不能删除可能属于其他写入者的文件。
+            const handle = await open(temporary, "wx", 0o600);
+            try {
+                try {
+                    await handle.writeFile(text);
+                }
+                catch (error) {
+                    await handle
+                        .close()
+                        .catch((closeError) => this.cleanupError("webui.store.close_failed", closeError));
+                    throw error;
+                }
+                // 关闭失败同样是保存失败，不能尝试替换或提交内存。
+                await handle.close();
+                await replace(temporary, this.path);
+            }
+            catch (error) {
+                await unlink(temporary).catch((cleanupError) => this.cleanupError("webui.store.temporary_cleanup_failed", cleanupError));
+                throw error;
+            }
+            // rename 成功就是提交点；此后没有可能将成功翻转成失败的日志或清理动作。
             this.records = next;
             return result;
         });

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mininglamp-oss/octo-runtime-extra-webui",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "private": true,
   "type": "module",
   "description": "Local Runtime workbench with canonical SSE presentation",
@@ -19,6 +19,6 @@
     "porting-map.md"
   ],
   "dependencies": {
-    "@mininglamp-oss/octo-runtime-protocol": "1.1.0"
+    "@mininglamp-oss/octo-runtime-protocol": "1.1.1"
   }
 }

package/node_modules/@mininglamp-oss/octo-runtime-host-sdk/dist/extra-config.d.ts

@@ -6,8 +6,15 @@ export interface ExtraDescriptor {
     enabled?: boolean;
     config: JsonObject;
 }
-export type StoredExtra = Omit<ExtraDescriptor, "name">;
+/** CLI 配置可由 manifest 提供模块；原生代码声明 ExtraDescriptor 仍显式指定模块。 */
+export interface StoredExtra {
+    module?: string;
+    enabled?: boolean;
+    config: JsonObject;
+}
 export declare function assertStoredExtra(value: unknown): asserts value is StoredExtra;
 export declare function extraRegistration(descriptor: ExtraDescriptor): ExtraRegistration;
 /** Called only by a host that explicitly selects this directory as its source. */
 export declare function readExtraDirectory(directory: string): Promise<ExtraRegistration[]>;
+/** 宿主显式选取的配置文件；保持凭据权限校验，不解析或导入模块。 */
+export declare function readStoredExtra(directory: string, name: string): Promise<StoredExtra>;

package/node_modules/@mininglamp-oss/octo-runtime-host-sdk/dist/extra-config.js

@@ -8,7 +8,7 @@ export function assertStoredExtra(value) {
     const item = value;
     if (Object.keys(item).some((key) => !["module", "enabled", "config"].includes(key)))
         throw new Error("EXTRA_CONFIG_FIELD_INVALID");
-    if (typeof item.module !== "string" || !validModule(item.module))
+    if (item.module !== undefined && (typeof item.module !== "string" || !validModule(item.module)))
         throw new Error("EXTRA_MODULE_INVALID");
     if (item.enabled !== undefined && typeof item.enabled !== "boolean")
         throw new Error("EXTRA_ENABLED_INVALID");
@@ -35,12 +35,15 @@ export function extraRegistration(descriptor) {
     assertExtraName(descriptor.name);
     const { name, ...stored } = descriptor;
     assertStoredExtra(stored);
+    const module = stored.module;
+    if (!module)
+        throw new Error("EXTRA_MODULE_REQUIRED");
     return {
         name,
-        module: stored.module,
+        module,
         config: stored.config,
         enabled: stored.enabled,
-        load: () => import(isAbsolute(stored.module) ? pathToFileURL(stored.module).href : stored.module)
+        load: () => import(isAbsolute(module) ? pathToFileURL(module).href : module)
     };
 }
 /** Called only by a host that explicitly selects this directory as its source. */
@@ -56,15 +59,14 @@ export async function readExtraDirectory(directory) {
             continue;
         assertExtraName(entry.name);
         try {
-            const file = join(directory, entry.name, "config.json");
-            const info = await lstat(file);
-            if (!info.isFile() || (process.platform !== "win32" && info.mode & 0o077))
-                throw new Error("EXTRA_CONFIG_PERMISSIONS_INVALID");
-            if (info.size > 1024 * 1024)
-                throw new Error("EXTRA_CONFIG_TOO_LARGE");
-            const stored = JSON.parse(await readFile(file, "utf8"));
-            assertStoredExtra(stored);
-            registrations.push(extraRegistration({ name: entry.name, ...stored }));
+            const stored = await readStoredExtra(directory, entry.name);
+            registrations.push(stored.module
+                ? extraRegistration({ ...stored, name: entry.name, module: stored.module })
+                : {
+                    ...stored,
+                    name: entry.name,
+                    load: () => Promise.reject(new Error("EXTRA_MODULE_REQUIRED"))
+                });
         }
         catch (error) {
             const code = error instanceof Error && /^EXTRA_[A-Z_]+$/.test(error.message)
@@ -79,6 +81,19 @@ export async function readExtraDirectory(directory) {
     }
     return registrations;
 }
+/** 宿主显式选取的配置文件；保持凭据权限校验，不解析或导入模块。 */
+export async function readStoredExtra(directory, name) {
+    assertExtraName(name);
+    const file = join(directory, name, "config.json");
+    const info = await lstat(file);
+    if (!info.isFile() || (process.platform !== "win32" && info.mode & 0o077))
+        throw new Error("EXTRA_CONFIG_PERMISSIONS_INVALID");
+    if (info.size > 1024 * 1024)
+        throw new Error("EXTRA_CONFIG_TOO_LARGE");
+    const stored = JSON.parse(await readFile(file, "utf8"));
+    assertStoredExtra(stored);
+    return stored;
+}
 function validModule(module) {
     if (isAbsolute(module))
         return true;