@mininglamp-oss/octo-runtime 1.1.0 → 1.1.2

package/node_modules/@mininglamp-oss/octo-runtime-cli/dist/worker.js

@@ -0,0 +1,18 @@
+// CLI 自有执行 worker。顶层 Kernel 仍由 CLI 调用进程创建；SDK 原生入口不使用此装配。
+import { loadManifestAdapters } from "@mininglamp-oss/octo-runtime-executor-kernel/manifest-adapters";
+import { serveWorker } from "@mininglamp-oss/octo-runtime-executor-kernel";
+import { readExtraDirectory } from "@mininglamp-oss/octo-runtime-host-sdk";
+import { dirname, join } from "node:path";
+const adapters = await loadManifestAdapters();
+// 旧显式清单允许省略 type；以所选实例真实类型判断，不猜包名，也不在父进程重复实例化。
+if (adapters.some((adapter) => adapter.metadata.type === "openclaw")) {
+    const profileRoot = process.env.OCTO_RUNTIME_CLI_PROFILE_ROOT;
+    if (!profileRoot)
+        throw new Error("CLI_PROFILE_ROOT_REQUIRED");
+    const { initializeCliOpenClaw, syncCliOpenClawToolEnvironment } = await import("./openclaw.js");
+    await initializeCliOpenClaw(profileRoot);
+    if (process.env.OCTO_RUNTIME_CLI_SYNC_OPENCLAW_TOOLS === "1")
+        await syncCliOpenClawToolEnvironment(profileRoot, await readExtraDirectory(join(dirname(profileRoot), "extras")));
+}
+// 产品连接准备完成后才建立既有 list/probe 握手；所有实例仅交给唯一 Core 注册一次。
+serveWorker(adapters);

package/node_modules/@mininglamp-oss/octo-runtime-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mininglamp-oss/octo-runtime-cli",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "private": true,
   "type": "module",
   "bin": {
@@ -8,14 +8,28 @@
   },
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.0",
+    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.2",
     "json5": "2.2.3",
-    "@mininglamp-oss/octo-runtime-extra-channel-gateway": "1.1.0",
-    "@mininglamp-oss/octo-runtime-host-sdk": "1.1.0",
-    "@mininglamp-oss/octo-runtime-adapter-openclaw": "1.1.0",
-    "@mininglamp-oss/octo-runtime-cross-service": "1.1.0",
-    "@mininglamp-oss/octo-runtime-protocol": "1.1.0",
-    "@mininglamp-oss/octo-runtime-executor-kernel": "1.1.0",
-    "@mininglamp-oss/octo-runtime-executor-core": "1.1.0"
+    "@mininglamp-oss/octo-runtime-extra-channel-gateway": "1.1.2",
+    "@mininglamp-oss/octo-runtime-host-sdk": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-openclaw": "1.1.2",
+    "@mininglamp-oss/octo-runtime-cross-service": "1.1.2",
+    "@mininglamp-oss/octo-runtime-protocol": "1.1.2",
+    "@mininglamp-oss/octo-runtime-executor-kernel": "1.1.2",
+    "@mininglamp-oss/octo-runtime-executor-core": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-antigravity": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-claude-code": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-codebuddy": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-codex": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-hermes": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-grok-build": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-kimi-code": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-mcode": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-opencode": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-qodercli": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-qoderclicn": "1.1.2",
+    "@mininglamp-oss/octo-runtime-adapter-zcode-gui": "1.1.2",
+    "@mininglamp-oss/octo-runtime-extra-channel-wecom": "1.1.2",
+    "@mininglamp-oss/octo-runtime-extra-webui": "1.1.2"
   }
 }

package/node_modules/@mininglamp-oss/octo-runtime-cross-service/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mininglamp-oss/octo-runtime-cross-service",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "private": true,
   "description": "Native user-service lifecycle backends for Octo Runtime",
   "type": "module",
@@ -11,7 +11,7 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=24 <25"
+    "node": "^24.0.0 || ^26.0.0"
   },
   "dependencies": {}
 }

package/node_modules/@mininglamp-oss/octo-runtime-executor-core/dist/model-input.d.ts

@@ -1,5 +1,5 @@
 import type { ContextEnvelope, InvokeRequest } from "@mininglamp-oss/octo-runtime-protocol";
-/** 仅渲染允许进入模型的业务 Context，执行/安全配置不作为普通提示词；对象键排序使同一快照稳定。 */
+/** 仅渲染允许进入模型的本轮业务 Context；Markdown 指引保留原文，排序后的 payload 用 CDATA 包裹，不修改输入。 */
 export declare function renderModelContexts(context: ContextEnvelope): string;
 /**
  * Core 冻结原请求后、派发 Adapter 前调用一次；接入方不应预先渲染而造成 Context 重复。

package/node_modules/@mininglamp-oss/octo-runtime-executor-core/dist/model-input.js

@@ -1,20 +1,24 @@
 const MODEL_CONTEXT_PATTERNS = [/^extra\.[^/]+\/[^/]+$/, /^octo\.content\/(inline|references)$/];
-/** 仅渲染允许进入模型的业务 Context，执行/安全配置不作为普通提示词；对象键排序使同一快照稳定。 */
+/** 仅渲染允许进入模型的本轮业务 Context；Markdown 指引保留原文，排序后的 payload 用 CDATA 包裹，不修改输入。 */
 export function renderModelContexts(context) {
     const items = context.items.filter((item) => MODEL_CONTEXT_PATTERNS.some((pattern) => pattern.test(item.namespace + "/" + item.name)));
     if (!items.length)
         return "";
     return [
-        "<--- 上下文信息开始：以下内容为当前上下文信息 --->",
+        "<!-- Context information begins: the following is the current context -->",
         "<contexts>",
-        ...items.map((item) => [
-            `  <context-item namespace="${item.namespace}" name="${item.name}">`,
-            ...(item.guidance ? [`    指引: ${item.guidance}`] : []),
-            `    数据: ${JSON.stringify(sorted(item.payload))}`,
-            "  </context-item>"
-        ].join("\n")),
+        ...items.map((item) => {
+            // 拆分 CDATA 终止符为相邻区段，避免材料中的标记提前结束数据边界；不解析内部内容。
+            const data = JSON.stringify(sorted(item.payload)).replaceAll("]]>", "]]]]><![CDATA[>");
+            return [
+                `  <context-item namespace="${item.namespace}" name="${item.name}">`,
+                ...(item.guidance ? [`    <guidence>${item.guidance}</guidence>`] : []),
+                `    <data><![CDATA[${data}]]></data>`,
+                "  </context-item>"
+            ].join("\n");
+        }),
         "</contexts>",
-        "<--- 上下文信息结束 --->"
+        "<!-- Context information ends -->"
     ].join("\n");
 }
 function sorted(value) {

package/node_modules/@mininglamp-oss/octo-runtime-executor-core/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@mininglamp-oss/octo-runtime-executor-core",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "private": true,
   "type": "module",
   "exports": "./dist/index.js",
   "dependencies": {
-    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.0",
-    "@mininglamp-oss/octo-runtime-protocol": "1.1.0"
+    "@mininglamp-oss/octo-runtime-adapter-sdk": "1.1.2",
+    "@mininglamp-oss/octo-runtime-protocol": "1.1.2"
   },
   "types": "./dist/index.d.ts",
   "files": [

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/heartbeat.d.ts

@@ -0,0 +1,16 @@
+/** A paused supervisor cannot establish worker failure; require a fresh probe after a gap. */
+export declare class WorkerHeartbeat {
+    #private;
+    private readonly wallNow;
+    private readonly monotonicNow;
+    activeMs: number;
+    healthyMs: number;
+    constructor(wallNow?: () => number, monotonicNow?: () => number);
+    tick(): {
+        type: "ping";
+        id: number;
+    } | {
+        type: "waiting" | "expired";
+    };
+    pong(id: unknown): void;
+}

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/heartbeat.js

@@ -0,0 +1,59 @@
+import { performance } from "node:perf_hooks";
+/** A paused supervisor cannot establish worker failure; require a fresh probe after a gap. */
+export class WorkerHeartbeat {
+    wallNow;
+    monotonicNow;
+    #wall;
+    #mono;
+    #sequence = 0;
+    #pending;
+    #answered = false;
+    activeMs = 0;
+    healthyMs = 0;
+    constructor(wallNow = Date.now, monotonicNow = () => performance.now()) {
+        this.wallNow = wallNow;
+        this.monotonicNow = monotonicNow;
+        this.#wall = wallNow();
+        this.#mono = monotonicNow();
+    }
+    #gap(wall, mono) {
+        return (wall < this.#wall ||
+            mono < this.#mono ||
+            wall - this.#wall >= 5000 ||
+            mono - this.#mono >= 5000);
+    }
+    tick() {
+        const wall = this.wallNow(), mono = this.monotonicNow();
+        // Either clock can reveal suspend or a blocked supervisor; discard pre-gap liveness evidence.
+        if (this.#gap(wall, mono)) {
+            this.#pending = undefined;
+            this.#answered = false;
+            this.healthyMs = 0;
+        }
+        else {
+            const elapsed = mono - this.#mono;
+            this.activeMs += elapsed;
+            if (this.#answered)
+                this.healthyMs += elapsed;
+        }
+        this.#wall = wall;
+        this.#mono = mono;
+        this.#answered = false;
+        // Ordinary timer ticks never renew an unanswered probe's fixed deadline.
+        if (this.#pending)
+            return { type: mono >= this.#pending.deadline ? "expired" : "waiting" };
+        this.#pending = { id: ++this.#sequence, deadline: mono + 5000 };
+        return { type: "ping", id: this.#sequence };
+    }
+    pong(id) {
+        const wall = this.wallNow(), mono = this.monotonicNow();
+        // A queued or stale pong cannot establish post-resume health or extend the new deadline.
+        if (this.#gap(wall, mono) ||
+            !this.#pending ||
+            id !== this.#pending.id ||
+            mono >= this.#pending.deadline)
+            return;
+        this.#pending = undefined;
+        this.#answered = true;
+    }
+}

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/invocation-manifest.d.ts

@@ -31,4 +31,5 @@ export declare class InvocationManifest {
  * 无法验证身份时保留清单并报告 unsupported_identity；worker 已消失不证明 Windows 后代已清空。
  */
 export declare function reapOrphanedInvocationManifest(path: string): Promise<OrphanReapResult>;
+/** 查询系统启动时间以区分 PID 复用；失败时不返回可用于回收的身份，绝不以 PID 本身兜底。 */
 export declare function processStartIdentity(pid: number): Promise<string | undefined>;

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/invocation-manifest.js

@@ -110,6 +110,7 @@ export async function reapOrphanedInvocationManifest(path) {
     await rm(path, { force: true });
     return { found: true, reaped: true, pid: host.pid };
 }
+/** 查询系统启动时间以区分 PID 复用；失败时不返回可用于回收的身份，绝不以 PID 本身兜底。 */
 export async function processStartIdentity(pid) {
     if (!Number.isSafeInteger(pid) || pid < 1)
         return undefined;
@@ -141,7 +142,9 @@ export async function processStartIdentity(pid) {
                 "-NoProfile",
                 "-NonInteractive",
                 "-Command",
-                `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`
+                // 直接调用系统进程对象，避免 Get-Process 的命令发现/模块自动加载占用身份查询预算。
+                // 保持 UTC ticks 身份格式；不增加超时，也不缓存可能已经复用的 PID。
+                `$PSModuleAutoLoadingPreference='None'; $target=[System.Diagnostics.Process]::GetProcessById(${pid}); try { [Console]::Out.Write($target.StartTime.ToUniversalTime().Ticks.ToString([Globalization.CultureInfo]::InvariantCulture)) } finally { $target.Dispose() }`
             ], { encoding: "utf8", timeout: 10_000, windowsHide: true }, (error, stdout) => {
                 const value = stdout.trim();
                 resolve(error || !/^\d+$/.test(value) ? undefined : `windows:${value}`);

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/manifest-adapters.d.ts

@@ -0,0 +1,6 @@
+import type { HostedAdapter } from "./index.js";
+/**
+ * 仅供清单驱动的 worker 在自身进程装配：只实例化所选模块，返回后由入口注册及 serveWorker。
+ * CLI 可在注册前用实际 metadata 做产品准备；SDK 原生 import 入口不经过此文件加载边界。
+ */
+export declare function loadManifestAdapters(): Promise<HostedAdapter[]>;

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/manifest-adapters.js

@@ -0,0 +1,88 @@
+import { parseModuleManifest, readModuleManifest, resolveModuleSpecifier } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";
+/**
+ * 仅供清单驱动的 worker 在自身进程装配：只实例化所选模块，返回后由入口注册及 serveWorker。
+ * CLI 可在注册前用实际 metadata 做产品准备；SDK 原生 import 入口不经过此文件加载边界。
+ */
+export async function loadManifestAdapters() {
+    const index = process.argv.indexOf("--manifest");
+    const entries = process.argv.includes("--adapters-from-ipc")
+        ? await receiveAdapters()
+        : index >= 0 && process.argv[index + 1]
+            ? (await readModuleManifest(process.argv[index + 1], { legacy: true })).adapters
+            : (() => {
+                throw new Error("usage: octo-runtime-executor-kernel --manifest <file>");
+            })();
+    const adapters = [];
+    for (const entry of entries) {
+        const specifier = resolveModuleSpecifier(entry.module, entry.sourceManifest);
+        const loaded = await import(specifier);
+        const exports = asRecord(loaded, `adapter module ${entry.module}`);
+        const exported = exports[entry.export];
+        if (exported === undefined)
+            throw new Error(`missing export ${entry.export} from ${entry.module}`);
+        // 动态模块先校验工厂与 Adapter 形状，再交给唯一 Core 注册；不提前探测未选模块。
+        const instance = entry.factory ? callFactory(exported, entry) : exported;
+        if (!isHostedAdapter(instance))
+            throw new TypeError(`${entry.module}#${entry.export} is not an Octo Runtime adapter`);
+        if (entry.type && instance.metadata.type !== entry.type)
+            throw new Error(`manifest type ${entry.type} does not match adapter ${instance.metadata.type}`);
+        adapters.push(instance);
+    }
+    return adapters;
+}
+/** 内部启动消息只携带 JSON 模块声明，不传函数/实例；就绪仍沿用既有 list/probe 握手。 */
+function receiveAdapters() {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            clearTimeout(timer);
+            process.off("message", onMessage);
+            process.off("disconnect", onDisconnect);
+        };
+        const onDisconnect = () => {
+            cleanup();
+            reject(new Error("Adapter initialization channel disconnected"));
+        };
+        const onMessage = (message) => {
+            if (!isRecord(message) || message.type !== "kernel.adapters")
+                return;
+            cleanup();
+            try {
+                // 快照已经解析为绝对位置；这个路径只用于结构校验，不读取或生成任何文件。
+                resolve(parseModuleManifest({ version: 1, adapters: message.adapters, extras: [] }, process.cwd(), { legacy: true }).adapters);
+            }
+            catch (error) {
+                reject(error instanceof Error ? error : new Error("Invalid Adapter initialization"));
+            }
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error("Adapter initialization timed out"));
+        }, 15000);
+        process.on("message", onMessage);
+        process.once("disconnect", onDisconnect);
+        if (!process.connected)
+            onDisconnect();
+    });
+}
+function callFactory(value, entry) {
+    if (typeof value !== "function")
+        throw new TypeError(`${entry.module}#${entry.export} is marked as a factory but is not callable`);
+    return value(entry.options);
+}
+function isHostedAdapter(value) {
+    if (!isRecord(value) || !isRecord(value.metadata))
+        return false;
+    return (typeof value.metadata.type === "string" &&
+        Array.isArray(value.metadata.agentSources) &&
+        value.metadata.agentSources.length > 0 &&
+        value.metadata.agentSources.every((source) => source === "preset" || source === "provisioned") &&
+        typeof value.invoke === "function");
+}
+function asRecord(value, label) {
+    if (!isRecord(value))
+        throw new TypeError(`${label} must be an object`);
+    return value;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/module-specifier.d.ts

@@ -1,2 +1 @@
-/** 内部加载边界：按本机路径语义识别文件，避免把 Windows 盘符交给 ESM 当作 URL 协议。 */
-export declare function resolveAdapterModuleSpecifier(module: string, manifestPath: string): string;
+export { resolveModuleSpecifier as resolveAdapterModuleSpecifier } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/module-specifier.js

@@ -1,9 +1,2 @@
-import { dirname, isAbsolute, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-/** 内部加载边界：按本机路径语义识别文件，避免把 Windows 盘符交给 ESM 当作 URL 协议。 */
-export function resolveAdapterModuleSpecifier(module, manifestPath) {
-    // 相对路径属于 manifest 所在目录；包名及现有 URL 保持 Node 的解析语义。
-    return module.startsWith(".") || isAbsolute(module)
-        ? pathToFileURL(resolve(dirname(manifestPath), module)).href
-        : module;
-}
+// 内部兼容入口，CLI 与 runner 共用原始 manifest 锚点下的 ESM 解析。
+export { resolveModuleSpecifier as resolveAdapterModuleSpecifier } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/process.d.ts

@@ -2,14 +2,17 @@ import { type ChildProcess, type ChildProcessByStdio } from "node:child_process"
 import type { Readable, Writable } from "node:stream";
 import type { HostedAdapterMetadata } from "./index.js";
 import { WorkerRpcClient } from "./rpc.js";
+import type { AdapterModuleEntry } from "@mininglamp-oss/octo-runtime-adapter-sdk/module-manifest";
 export interface SpawnWorkerOptions {
     entrypoint: string;
     /** CLI JSON 来源；SDK 的直接 import 入口不需要此参数。 */
     manifest?: string;
+    /** CLI 已解析的不可变装配快照；与 manifest 互斥，不改变 SDK 自有 worker 的入口。 */
+    adapterModules?: AdapterModuleEntry[];
     env?: NodeJS.ProcessEnv;
     /** 取消就绪等待并请求回收子进程；POSIX 使用进程组，Windows taskkill 不保证父先退后的后代回收。 */
     signal?: AbortSignal;
-    /** Maximum time allowed for the initial RPC readiness handshake. */
+    /** 启动快照发送和首次 RPC 就绪握手共用的最大等待时间。 */
     readyTimeoutMs?: number;
     onSpawn?: (child: ChildProcess) => Promise<void>;
 }
@@ -21,10 +24,12 @@ export interface WorkerProcess {
     close(): Promise<void>;
     stderr(): string;
 }
+/** Kernel 内部传递关闭预算；公开 WorkerProcess.close() 仍然无参数。故障恢复不等待日志排空。 */
+export declare function closeWorker(worker: WorkerProcess, until: number, immediate?: boolean): Promise<void>;
 /**
  * 启动 Node worker，以首次 list RPC 成功作为就绪确认，再返回客户端与进程所有权。
  * 入口/manifest/环境错误在启动阶段携带有界 stderr 抛出；失败路径仍须回收已创建的进程。
  * owner 必须等待 close；清理失败不能当作可安全启动替代 worker 的普通启动错误。
  */
-export declare function spawnWorker({ entrypoint, manifest, env, signal, onSpawn, readyTimeoutMs }: SpawnWorkerOptions): Promise<WorkerProcess>;
+export declare function spawnWorker({ entrypoint, manifest, adapterModules, env, signal, onSpawn, readyTimeoutMs }: SpawnWorkerOptions): Promise<WorkerProcess>;
 export {};

package/node_modules/@mininglamp-oss/octo-runtime-executor-kernel/dist/process.js

@@ -1,19 +1,37 @@
 import { createProcessCleanup } from "@mininglamp-oss/octo-runtime-adapter-sdk/process-cleanup";
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { setTimeout as delay } from "node:timers/promises";
 import { WorkerRpcClient } from "./rpc.js";
+// Reserve more time for tree cleanup until the worker confirms it has started shutdown.
+// A cooperating worker can use its existing 2.5 s shutdown + 1 s logging bounds.
+const WINDOWS_CLOSE_GRACE_MS = 4_000;
+const WINDOWS_TREE_CLEANUP_RESERVE_MS = 1_900;
+const WINDOWS_COOPERATIVE_CLEANUP_RESERVE_MS = 1_000;
+const closeOptions = new WeakMap();
+/** Kernel 内部传递关闭预算；公开 WorkerProcess.close() 仍然无参数。故障恢复不等待日志排空。 */
+export function closeWorker(worker, until, immediate = false) {
+    closeOptions.set(worker, { until, immediate });
+    return worker.close();
+}
 /**
  * 启动 Node worker，以首次 list RPC 成功作为就绪确认，再返回客户端与进程所有权。
  * 入口/manifest/环境错误在启动阶段携带有界 stderr 抛出；失败路径仍须回收已创建的进程。
  * owner 必须等待 close；清理失败不能当作可安全启动替代 worker 的普通启动错误。
  */
-export async function spawnWorker({ entrypoint, manifest, env = process.env, signal, onSpawn, readyTimeoutMs = 15_000 }) {
+export async function spawnWorker({ entrypoint, manifest, adapterModules, env = process.env, signal, onSpawn, readyTimeoutMs = 15_000 }) {
     if (signal?.aborted)
         throw new Error("adapter-host spawn cancelled");
+    if (manifest && adapterModules !== undefined)
+        throw new TypeError("manifest and adapterModules are mutually exclusive");
     if (!Number.isFinite(readyTimeoutMs) || readyTimeoutMs < 1) {
         throw new Error("adapter-host readyTimeoutMs must be positive");
     }
-    // 跨进程只传程序入口及可选文件路径，不序列化 Adapter 实例或工厂函数。
-    const child = spawn(process.execPath, [entrypoint, ...(manifest ? ["--manifest", manifest] : [])], {
+    // 快照通过已有 Node IPC 发送，不占命令行/环境长度，不落盘；永不序列化模块实例。
+    const child = spawn(process.execPath, [
+        entrypoint,
+        ...(manifest ? ["--manifest", manifest] : []),
+        ...(adapterModules === undefined ? [] : ["--adapters-from-ipc"])
+    ], {
         argv0: "octo-runtime-executor-kernel",
         env,
         stdio: ["pipe", "pipe", "pipe", "ipc"],
@@ -38,8 +56,16 @@ export async function spawnWorker({ entrypoint, manifest, env = process.env, sig
     child.on("error", (error) => client.close(error));
     let adapters;
     try {
+        // 先登记进程所有权；快照发送也可能因子进程未读取 IPC 而阻塞，须纳入就绪预算。
         await onSpawn?.(child);
-        adapters = await waitForReady(client.list(), readyTimeoutMs, signal);
+        const initialize = async () => {
+            if (adapterModules !== undefined)
+                await new Promise((resolve, reject) => {
+                    child.send({ type: "kernel.adapters", adapters: adapterModules }, (error) => error ? reject(error) : resolve());
+                });
+            return client.list();
+        };
+        adapters = await waitForReady(initialize(), readyTimeoutMs, signal);
     }
     catch (error) {
         client.close(error instanceof Error ? error : new Error(errorMessage(error)));
@@ -51,18 +77,121 @@ export async function spawnWorker({ entrypoint, manifest, env = process.env, sig
         }
         throw new Error(`${errorMessage(error)}${stderr ? `: ${stderr}` : ""}`, { cause: error });
     }
-    return {
+    let closing;
+    const worker = {
         client,
         child,
         adapters,
-        // 先断开 RPC，再等待平台清理；POSIX 不以 leader exit 结束进程组回收。
-        // Windows 仅有 Node/taskkill 的常规树清理能力，不能承诺父进程提前退出后的后代已清空。
+        // 关闭 RPC 后等待正常收尾与平台清理；POSIX 不以 leader exit 结束进程组回收。
+        // Windows 排空后须保留 leader 到 taskkill；宽限内提前退出不能当作树已清空。
         close() {
+            if (closing)
+                return closing;
+            const { until = Date.now() + 5000, immediate = false } = closeOptions.get(worker) ?? {};
             client.close();
-            return cleanup();
+            // Windows 的 kill(SIGTERM) 是强制终止；先用 EOF 触发现有子进程收尾。
+            // S02：POSIX 仍回收整个所属进程组，不能只因 leader 退出而跳过 cleanup。
+            return (closing = (async () => {
+                const drained = process.platform === "win32" && !immediate
+                    ? await endWindowsWorkerInput(child, until)
+                    : undefined;
+                try {
+                    // 启动回滚与 POSIX 保留共享清理；Windows 正常关闭须验证本次 taskkill 的结果。
+                    // leader 在通知后退出时，不能再用它的退出状态掩盖 taskkill 未能找到树的错误。
+                    if (process.platform === "win32" && drained !== "skipped")
+                        await cleanupWindowsWorker(child, until);
+                    else
+                        await cleanup();
+                    // Reaping the OS tree does not erase an observed Adapter cleanup failure.
+                    if (drained === "incomplete")
+                        throw Object.assign(new Error("EXECUTOR_CLEANUP_INCOMPLETE"), {
+                            code: "EXECUTOR_CLEANUP_INCOMPLETE"
+                        });
+                }
+                finally {
+                    if (process.platform === "win32") {
+                        // 正常收尾或 fallback 结束后释放本层管道；回收失败仍向调用方传播。
+                        child.stdin.destroy();
+                        child.stdout.destroy();
+                        child.stderr.destroy();
+                    }
+                }
+            })());
         },
         stderr: () => stderr
     };
+    return worker;
+}
+/** 只回收本次 worker 的树。命令和退出确认共用截止时间，任何命令错误都保留为回收失败。 */
+async function cleanupWindowsWorker(child, until) {
+    const incomplete = (cause) => Object.assign(new Error("PROCESS_TREE_CLEANUP_INCOMPLETE", { cause }), {
+        code: "PROCESS_TREE_CLEANUP_INCOMPLETE"
+    });
+    if (child.pid === undefined || child.exitCode !== null || child.signalCode !== null)
+        throw incomplete();
+    const remaining = until - Date.now();
+    if (remaining <= 0)
+        throw incomplete();
+    await new Promise((resolve, reject) => {
+        execFile("taskkill", ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, timeout: remaining }, (error) => (error ? reject(incomplete(error)) : resolve()));
+    });
+    const confirmUntil = Math.min(until, Date.now() + 200);
+    while (child.exitCode === null && child.signalCode === null) {
+        const left = confirmUntil - Date.now();
+        if (left <= 0)
+            throw Object.assign(new Error("PROCESS_CLEANUP_TIMEOUT"), {
+                code: "PROCESS_CLEANUP_TIMEOUT"
+            });
+        await delay(Math.min(10, left));
+    }
+}
+/** 私有正常关闭阶段：EOF 触发排空，IPC 只确认排空结果，实际进程树仍由 cleanup 回收。 */
+function endWindowsWorkerInput(child, until) {
+    if (child.exitCode !== null || child.signalCode !== null || child.stdin.destroyed)
+        return Promise.resolve("skipped");
+    return new Promise((resolve) => {
+        const graceUntil = Math.min(Date.now() + WINDOWS_CLOSE_GRACE_MS, until - WINDOWS_COOPERATIVE_CLEANUP_RESERVE_MS);
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.off("close", fallback);
+            child.off("error", fallback);
+            child.stdin.off("error", fallback);
+            child.off("message", onMessage);
+            resolve(result);
+        };
+        const fallback = () => finish("fallback");
+        const onMessage = (message) => {
+            if (!message || typeof message !== "object" || !("type" in message))
+                return;
+            if (message.type === "worker.stopping") {
+                // This is progress, not cleanup success. Repeated messages never extend the deadline.
+                clearTimeout(timer);
+                timer = setTimeout(fallback, Math.max(0, graceUntil - Date.now()));
+                return;
+            }
+            if (message.type === "worker.drained" &&
+                "cleanup" in message &&
+                (message.cleanup === "complete" || message.cleanup === "incomplete"))
+                finish(message.cleanup);
+        };
+        let timer = setTimeout(fallback, Math.max(0, Math.min(graceUntil, until - WINDOWS_TREE_CLEANUP_RESERVE_MS) - Date.now()));
+        // 先监听再发送 EOF；worker 排空后仍存活，输出在通知/超时前持续消费。
+        child.once("close", fallback);
+        child.once("error", fallback);
+        child.stdin.once("error", fallback);
+        child.on("message", onMessage);
+        try {
+            child.stdin.end();
+        }
+        catch {
+            // EPIPE 等故障不新增公开错误合同；真正的回收失败仍由 cleanup 抛出。
+            fallback();
+        }
+    });
 }
 function waitForReady(operation, timeoutMs, signal) {
     return new Promise((resolve, reject) => {