@nowcrew/daemon 0.5.18 → 0.5.19

package/README.md

@@ -80,6 +80,25 @@ the local workspace/environment, and launches only a built-in runtime adapter (`
 `kimi`). It does not decide collaboration rules, scheduled output policy, fallback delivery, or thread
 behavior. Those are server responsibilities.
 
+The stable adapters keep prompts out of provider argv wherever the provider protocol allows it:
+
+| Runtime | Transport | System/wake input | Native resume |
+| --- | --- | --- | --- |
+| Claude | stream-json CLI | daemon-owned system prompt file | CLI session id |
+| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume` |
+| Kimi | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
+
+Kimi ACP currently requires a Kimi account even when the CLI has a working custom provider. Only for
+the explicit `Authentication required` response, the adapter retries once through Kimi's stream-json
+CLI and carries the same native session id; unrelated ACP failures stay failures. The CLI fallback is
+subject to the Windows UTF-16 argv guard, while protocol-v1 itself remains disabled on Windows until
+durable Job Object ownership is available.
+
+Codex and Kimi sessions use the same bounded per-task persistence and keyed lease as Claude when they
+run through protocol v1. A first-progress watchdog covers a provider that accepts a turn but remains
+semantically silent; after the first semantic event, the execution's configured total timeout remains
+authoritative so a legitimate long-running tool is not killed for quiet output.
+
 Protocol support and limits are advertised in `machine:hello`. `runtimes` reports every recognized CLI
 found on `PATH`; `executionRuntimes` separately reports the installed CLIs backed by a complete built-in
 adapter. The server must use the latter for admission and treats the former as diagnostic inventory only.
@@ -104,6 +123,10 @@ Before accepting work, the daemon writes a local journal entry under:
 running supervisors are identity-checked and terminated before interruption is reported. A lock prevents
 two daemon processes from sharing one journal.
 
+Protocol v1 is advertised only when the platform has a durable process-tree backend. POSIX uses an
+owned process group. Native Windows intentionally fails admission until a Job Object backend has passed
+crash-cleanup tests; `taskkill /T` is not treated as equivalent ownership.
+
 ## Local Policy
 
 Useful environment controls:

package/dist/attachments.js

@@ -0,0 +1,161 @@
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { basename, extname, resolve, sep } from "node:path";
+export const ATTACHMENT_MAX_FILE_BYTES = 25 * 1024 * 1024;
+export const ATTACHMENT_MAX_TOTAL_BYTES = 50 * 1024 * 1024;
+function truncateUtf8(value, maxBytes) {
+    let bytes = 0;
+    let output = "";
+    for (const character of value) {
+        const size = Buffer.byteLength(character, "utf8");
+        if (bytes + size > maxBytes)
+            break;
+        output += character;
+        bytes += size;
+    }
+    return output;
+}
+function safeFilename(value) {
+    const leaf = basename(value.replace(/\\/gu, "/"))
+        .replace(/[\u0000-\u001f\u007f]/gu, "_")
+        .replace(/^\.+/u, "")
+        .trim();
+    return truncateUtf8(leaf, 180) || "attachment";
+}
+function collisionName(filename, index) {
+    if (index === 1)
+        return filename;
+    const extension = extname(filename);
+    const stem = extension ? filename.slice(0, -extension.length) : filename;
+    return `${stem}-${index}${extension}`;
+}
+function containedPath(directory, filename) {
+    const target = resolve(directory, filename);
+    if (!target.startsWith(`${resolve(directory)}${sep}`)) {
+        throw new Error("Attachment path escapes the execution directory");
+    }
+    return target;
+}
+function checkedRedirect(value, base) {
+    const url = new URL(value, base);
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new Error("Attachment redirects must use credential-free HTTPS URLs");
+    }
+    return url;
+}
+async function readBounded(response, maxBytes) {
+    const declared = Number(response.headers.get("content-length") ?? "");
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        throw new Error(`Attachment exceeds the ${maxBytes} byte limit`);
+    }
+    if (!response.body)
+        throw new Error("Attachment response body is empty");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    while (true) {
+        const part = await reader.read();
+        if (part.done)
+            break;
+        const chunk = Buffer.from(part.value);
+        size += chunk.length;
+        if (size > maxBytes) {
+            await reader.cancel();
+            throw new Error(`Attachment exceeds the ${maxBytes} byte limit`);
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, size);
+}
+async function downloadAttachment(input) {
+    const initial = new URL(`/agent/attachments/${encodeURIComponent(input.attachment.id)}/download`, input.serverUrl);
+    if (!["http:", "https:"].includes(initial.protocol)
+        || initial.username || initial.password) {
+        throw new Error("Invalid NowWork attachment download URL");
+    }
+    let current = initial;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), input.timeoutMs);
+    try {
+        let response = await input.fetchImpl(current, {
+            redirect: "manual",
+            headers: { authorization: `Bearer ${input.token}` },
+            signal: controller.signal,
+        });
+        for (let redirects = 0; [301, 302, 303, 307, 308].includes(response.status); redirects += 1) {
+            if (redirects >= input.maxRedirects)
+                throw new Error("Attachment redirect limit exceeded");
+            const location = response.headers.get("location");
+            if (!location)
+                throw new Error("Attachment redirect is missing a location");
+            current = checkedRedirect(location, current);
+            response = await input.fetchImpl(current, { redirect: "manual", signal: controller.signal });
+        }
+        if (!response.ok)
+            throw new Error(`Attachment download failed with status ${response.status}`);
+        const data = await readBounded(response, input.maxFileBytes);
+        if (data.length !== input.attachment.sizeBytes) {
+            throw new Error(`Attachment size mismatch: expected ${input.attachment.sizeBytes}, received ${data.length}`);
+        }
+        return data;
+    }
+    catch (error) {
+        if (controller.signal.aborted) {
+            throw new Error(`Attachment download timed out after ${input.timeoutMs}ms`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function materializeAttachments(input) {
+    const maxFileBytes = input.maxFileBytes ?? ATTACHMENT_MAX_FILE_BYTES;
+    const maxTotalBytes = input.maxTotalBytes ?? ATTACHMENT_MAX_TOTAL_BYTES;
+    const total = input.attachments.reduce((sum, attachment) => sum + attachment.sizeBytes, 0);
+    if (input.attachments.some((attachment) => attachment.sizeBytes > maxFileBytes)
+        || total > maxTotalBytes) {
+        throw new Error("Attachment metadata exceeds the configured byte limit");
+    }
+    const attachmentsRoot = resolve(input.runDir, "attachments");
+    const executionKey = input.executionId.replace(/[^A-Za-z0-9._-]/gu, "_");
+    const directory = resolve(attachmentsRoot, executionKey);
+    if (!directory.startsWith(`${attachmentsRoot}${sep}`)) {
+        throw new Error("Attachment directory escapes the run directory");
+    }
+    await rm(directory, { recursive: true, force: true });
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const used = new Set();
+    const materialized = [];
+    try {
+        for (const attachment of input.attachments) {
+            const base = safeFilename(attachment.filename);
+            let collision = 1;
+            let filename = collisionName(base, collision);
+            while (used.has(filename.toLowerCase())) {
+                collision += 1;
+                filename = collisionName(base, collision);
+            }
+            used.add(filename.toLowerCase());
+            const path = containedPath(directory, filename);
+            const data = await downloadAttachment({
+                serverUrl: input.serverUrl,
+                token: input.token,
+                attachment,
+                fetchImpl: input.fetchImpl ?? fetch,
+                maxFileBytes,
+                maxRedirects: input.maxRedirects ?? 3,
+                timeoutMs: input.timeoutMs ?? 10_000,
+            });
+            await writeFile(path, data, { flag: "wx", mode: 0o600 });
+            materialized.push({ ...attachment, filename, path });
+        }
+        return { directory, attachments: materialized };
+    }
+    catch (error) {
+        await rm(directory, { recursive: true, force: true });
+        throw error;
+    }
+}
+export async function cleanupMaterializedAttachments(directory) {
+    await rm(directory, { recursive: true, force: true });
+}

package/dist/execution-event-limit.js

@@ -36,7 +36,7 @@ export function boundExecutionFrame(input, maxBytes) {
     if (input.type === "execution:activity") {
         frame = withBoundedString(frame, "detail", maxBytes, false);
     }
-    else if (input.type === "execution:console") {
+    else if (input.type === "execution:console" || input.type === "execution:output") {
         frame = withBoundedString(frame, "text", maxBytes, false);
     }
     else if (input.type === "execution:rejected") {

package/dist/execution-protocol.js

@@ -48,7 +48,7 @@ export const LegacyAgentStartSchema = z.object({
         content: z.string().optional(),
         senderHandle: z.string().optional(),
         threadId: z.string().optional(),
-        origin: z.enum(["wecom"]).optional(),
+        origin: z.enum(["wecom", "feishu"]).optional(),
     }).passthrough().optional(),
     scheduledRun: z.object({
         jobId: z.string().min(1),
@@ -85,6 +85,12 @@ export const ConsoleStreamSchema = z.enum([
     "result",
     "error",
 ]);
+export const ExecutionAttachmentSchema = z.object({
+    id: z.string().min(1).max(200),
+    filename: z.string().min(1).max(255),
+    mime: z.string().min(1).max(200),
+    sizeBytes: z.number().int().nonnegative().max(25 * 1024 * 1024),
+}).strict();
 export const ExecutionStartSchema = z.object({
     type: z.literal("execution:start"),
     protocolVersion: ProtocolVersionSchema,
@@ -115,6 +121,8 @@ export const ExecutionStartSchema = z.object({
         channelId: z.string().min(1),
         threadId: z.string().min(1).optional(),
         wakeMessageId: z.string().min(1).optional(),
+        externalResponseSessionId: ExecutionIdSchema.optional(),
+        attachments: z.array(ExecutionAttachmentSchema).max(20).optional(),
     }).strict(),
     reporting: z.object({
         captureFinal: z.boolean(),
@@ -185,6 +193,15 @@ export const ExecutionConsoleSchema = z.object({
     seq: SequenceSchema,
     at: TimestampSchema,
 }).strict();
+export const ExecutionOutputSchema = z.object({
+    type: z.literal("execution:output"),
+    protocolVersion: ProtocolVersionSchema,
+    executionId: ExecutionIdSchema,
+    channel: z.literal("external_answer"),
+    text: z.string().min(1),
+    seq: SequenceSchema,
+    at: TimestampSchema,
+}).strict();
 export const ExecutionUsageSchema = z.object({
     inputTokens: TokenCountSchema,
     outputTokens: TokenCountSchema,
@@ -312,6 +329,7 @@ const RawDaemonToServerExecutionFrameSchema = z.discriminatedUnion("type", [
     ExecutionStartedSchema,
     ExecutionActivitySchema,
     ExecutionConsoleSchema,
+    ExecutionOutputSchema,
     RawExecutionCompletedSchema,
     ExecutionSnapshotSchema,
 ]);

package/dist/execution-runner.js

@@ -8,7 +8,7 @@ import { mintAgentToken } from "./token.js";
 import { executeLocal, withLocalExecutionFacts, } from "./local-executor.js";
 import { startDormantSupervisor, } from "./execution-supervisor.js";
 import { buildClaudeArgs, CLAUDE_EFFORT_LEVELS } from "./runtimes/claude.js";
-import { buildCodexArgs, CODEX_EFFORT_LEVELS } from "./runtimes/codex.js";
+import { CODEX_EFFORT_LEVELS } from "./runtimes/codex.js";
 import { KIMI_EFFORT_LEVELS } from "./runtimes/kimi.js";
 import { executionBackendCapability } from "./execution-backend.js";
 import { readBoundImDecisionFile, resetBoundImDecisionFile } from "./bound-im-decision.js";
@@ -183,7 +183,7 @@ function launchProviderConfig(config) {
         ...(config.description === undefined ? {} : { description: config.description }),
     };
 }
-function supervisorLaunch(request) {
+export function supervisorLaunch(request) {
     const common = {
         wakePrompt: request.wakePrompt,
         dangerous: request.effectivePermission === "full_access",
@@ -211,11 +211,23 @@ function supervisorLaunch(request) {
     }
     if (request.runtime === "codex") {
         return {
-            command: request.bin,
-            args: buildCodexArgs(common),
+            command: process.execPath,
+            args: [
+                fileURLToPath(new URL("./runtimes/codex-app-server-runner.js", import.meta.url)),
+                "--bin", request.bin,
+            ],
             cwd: request.cwd,
             env: request.env,
-            stdinText: `${request.systemPrompt}\n\n${request.wakePrompt}`,
+            stdinText: JSON.stringify({
+                systemPrompt: request.systemPrompt,
+                wakePrompt: request.wakePrompt,
+                effectivePermission: request.effectivePermission,
+                ...(request.model === undefined ? {} : { model: request.model }),
+                ...(request.reasoning === undefined ? {} : { reasoning: request.reasoning }),
+                ...(request.sessionId === undefined ? {} : { sessionId: request.sessionId }),
+                ...(request.imagePaths === undefined ? {} : { imagePaths: request.imagePaths }),
+                resume: request.resume,
+            }),
         };
     }
     if (request.effectivePermission !== "full_access") {
@@ -227,6 +239,8 @@ function supervisorLaunch(request) {
             fileURLToPath(new URL("./runtimes/kimi-acp-runner.js", import.meta.url)),
             "--bin", request.bin,
             ...(request.model === undefined ? [] : ["--model", request.model]),
+            ...(request.sessionId === undefined ? [] : ["--session", request.sessionId]),
+            ...(request.resume ? ["--resume"] : []),
         ],
         cwd: request.cwd,
         env: request.env,
@@ -442,6 +456,7 @@ export async function runExecution(config, input, dependencies) {
         const providerConfig = launchProviderConfig(credential.config);
         let activitySequence = 0;
         let consoleSequence = 0;
+        let externalOutputSequence = 0;
         const callbacks = {
             ...(spec.reporting.streamActivity ? {
                 onActivity: (activity) => {
@@ -479,6 +494,23 @@ export async function runExecution(config, input, dependencies) {
                     catch { /* best-effort console omitted when its envelope cannot fit */ }
                 },
             } : {}),
+            ...(spec.context.externalResponseSessionId ? {
+                onExternalOutput: (text) => {
+                    const frame = DaemonToServerExecutionFrameSchema.parse({
+                        type: "execution:output",
+                        protocolVersion: 1,
+                        executionId: spec.executionId,
+                        channel: "external_answer",
+                        text,
+                        seq: externalOutputSequence++,
+                        at: now().toISOString(),
+                    });
+                    try {
+                        telemetry.enqueue(boundExecutionFrame(frame, config.executionLimits.maxEventBytes));
+                    }
+                    catch { /* final completion remains the authoritative repair */ }
+                },
+            } : {}),
         };
         const localDependencies = {
             launchRuntime: async (request) => {
@@ -543,6 +575,7 @@ export async function runExecution(config, input, dependencies) {
             taskKey: spec.workspace.taskKey,
             ...(spec.workspace.resumeKey === undefined ? {} : { resumeKey: spec.workspace.resumeKey }),
             ...(spec.context.wakeMessageId === undefined ? {} : { wakeMessageId: spec.context.wakeMessageId }),
+            ...(spec.context.attachments === undefined ? {} : { attachments: spec.context.attachments }),
             systemPrompt: withLocalExecutionFacts(spec.instructions.systemPrompt, config.executionLimits.maxPromptBytes
                 - Buffer.byteLength(spec.instructions.wakePrompt, "utf8")),
             wakePrompt: spec.instructions.wakePrompt,

package/dist/external-output.js

@@ -0,0 +1,86 @@
+export const EXTERNAL_ANSWER_OPEN = "<nowwork_external_answer>";
+export const EXTERNAL_ANSWER_CLOSE = "</nowwork_external_answer>";
+function retainedMarkerPrefix(value, marker) {
+    const maximum = Math.min(value.length, marker.length - 1);
+    for (let length = maximum; length > 0; length -= 1) {
+        if (marker.startsWith(value.slice(-length)))
+            return length;
+    }
+    return 0;
+}
+export class ExternalAnswerDecoder {
+    state = "outside";
+    pending = "";
+    push(text) {
+        if (!text)
+            return [];
+        const output = [];
+        this.consume(this.pending + text, output);
+        return output;
+    }
+    finish() {
+        this.pending = "";
+        this.state = "outside";
+        return [];
+    }
+    consume(value, output) {
+        this.pending = "";
+        const marker = this.state === "outside" ? EXTERNAL_ANSWER_OPEN : EXTERNAL_ANSWER_CLOSE;
+        const markerAt = value.indexOf(marker);
+        if (markerAt >= 0) {
+            if (this.state === "inside" && markerAt > 0)
+                output.push(value.slice(0, markerAt));
+            this.state = this.state === "outside" ? "inside" : "outside";
+            const remaining = value.slice(markerAt + marker.length);
+            if (remaining)
+                this.consume(remaining, output);
+            return;
+        }
+        const retained = retainedMarkerPrefix(value, marker);
+        const safe = retained > 0 ? value.slice(0, -retained) : value;
+        this.pending = retained > 0 ? value.slice(-retained) : "";
+        if (this.state === "inside" && safe)
+            output.push(safe);
+    }
+}
+export function decodeExternalOutputEvent(runtime, event, decoder) {
+    if (runtime === "claude") {
+        const candidate = (event ?? {});
+        const delta = candidate.event?.delta;
+        if (candidate.type !== "stream_event"
+            || candidate.event?.type !== "content_block_delta"
+            || delta?.type !== "text_delta"
+            || typeof delta.text !== "string")
+            return [];
+        return decoder.push(delta.text);
+    }
+    const candidate = (event ?? {});
+    if (runtime === "codex") {
+        return candidate.type === "item.completed"
+            && candidate.item?.type === "agent_message"
+            && typeof candidate.item.text === "string"
+            ? decoder.push(candidate.item.text)
+            : [];
+    }
+    return candidate.type === undefined
+        && candidate.role === "assistant"
+        && typeof candidate.content === "string"
+        ? decoder.push(candidate.content)
+        : [];
+}
+export function stripExternalAnswerMarkers(value) {
+    const sections = [];
+    let cursor = 0;
+    while (cursor < value.length) {
+        const openAt = value.indexOf(EXTERNAL_ANSWER_OPEN, cursor);
+        if (openAt < 0)
+            break;
+        const contentAt = openAt + EXTERNAL_ANSWER_OPEN.length;
+        const closeAt = value.indexOf(EXTERNAL_ANSWER_CLOSE, contentAt);
+        if (closeAt < 0)
+            return value.slice(contentAt).trim();
+        sections.push(value.slice(contentAt, closeAt));
+        cursor = closeAt + EXTERNAL_ANSWER_CLOSE.length;
+    }
+    return (sections.length > 0 ? sections.join("") : value).trim();
+}

package/dist/list-models.js

@@ -2,8 +2,15 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { isWin } from "./platform.js";
 const execFileRaw = promisify(execFile);
+const MODEL_PROBE_TIMEOUT_MS = 8_000;
+const MODEL_PROBE_MAX_BUFFER_BYTES = 1024 * 1024;
 // win32 上 npm CLI 是 .cmd shim,execFile 需 shell 才能执行;参数全是固定字面量,无注入面。
-const execFileP = (bin, args) => execFileRaw(bin, args, { shell: isWin() });
+const execFileP = (bin, args) => execFileRaw(bin, args, {
+    shell: isWin(),
+    timeout: MODEL_PROBE_TIMEOUT_MS,
+    killSignal: "SIGKILL",
+    maxBuffer: MODEL_PROBE_MAX_BUFFER_BYTES,
+});
 export async function listRuntimeModels(runtime) {
     switch (runtime) {
         case "codex":
@@ -21,15 +28,44 @@ export async function listRuntimeModels(runtime) {
 function parseCodexModels(stdout) {
     try {
         const parsed = JSON.parse(stdout);
-        const rows = Array.isArray(parsed.models) ? parsed.models : [];
-        return rows
-            .filter((m) => typeof m.id === "string" && (m.visibility == null || m.visibility === "list"))
-            .map((m, index) => ({ id: m.id, label: m.name || m.id, ...((m.default || index === 0) ? { default: true } : {}) }));
+        if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.models)) {
+            return [];
+        }
+        return normalizeCodexModels(parsed.models);
     }
     catch {
         return [];
     }
 }
+function normalizeCodexModels(rows) {
+    const normalized = rows.flatMap((value) => {
+        if (typeof value !== "object" || value === null)
+            return [];
+        const row = value;
+        if (row.visibility != null && row.visibility !== "list")
+            return [];
+        const id = nonEmptyString(row.slug) ?? nonEmptyString(row.id);
+        if (id === null)
+            return [];
+        return [{
+                id,
+                label: nonEmptyString(row.display_name) ?? nonEmptyString(row.name) ?? id,
+                explicitDefault: row.default === true,
+            }];
+    });
+    const hasExplicitDefault = normalized.some((model) => model.explicitDefault);
+    return normalized.map((model, index) => ({
+        id: model.id,
+        label: model.label,
+        ...((model.explicitDefault || (!hasExplicitDefault && index === 0)) ? { default: true } : {}),
+    }));
+}
+function nonEmptyString(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
 function parseCursorModels(stdout) {
     return stdout
         .split(/\r?\n/)

package/dist/local-executor.js

@@ -6,10 +6,14 @@ import { spawnClaude } from "./runtimes/claude.js";
 import { spawnCodex } from "./runtimes/codex.js";
 import { spawnKimi, KIMI_EFFORT_LEVELS } from "./runtimes/kimi.js";
 import { applyProviderEnv, providerFingerprint } from "./provider-env.js";
+import { augmentedPath } from "./runtime-path.js";
 import { extractFinalText, extractRunMeta, normalizeEvent, parseLine, } from "./normalize.js";
 import { readSession, writeSession, pickResumeId, isNearBudget } from "./session.js";
 import { toConsoleLines } from "./console.js";
 import { capMemoryForInject, capWorkLogForInject } from "./prompt.js";
+import { decodeExternalOutputEvent, ExternalAnswerDecoder, stripExternalAnswerMarkers, } from "./external-output.js";
+import { cleanupMaterializedAttachments as cleanupAttachments, materializeAttachments, } from "./attachments.js";
+import { routeRuntimeAttachments, runtimeCapability, } from "./runtime-capabilities.js";
 function truncateUtf8(value, maxBytes) {
     if (maxBytes <= 0)
         return "";
@@ -118,6 +122,7 @@ async function launchLegacyRuntime(request) {
         return wrapChild(spawnCodex({
             ...common,
             wakePrompt: `${request.systemPrompt}\n\n${request.wakePrompt}`,
+            ...(request.imagePaths === undefined ? {} : { imagePaths: request.imagePaths }),
         }));
     }
     return wrapChild(spawnKimi({
@@ -150,7 +155,10 @@ async function withKeyedLease(key, operation) {
     }
 }
 export async function executeLocal(input, callbacks = {}, dependencies = {}) {
-    if (input.runtime.name !== "claude" || !input.session.enabled) {
+    const stableProtocolRuntime = dependencies.launchRuntime !== undefined;
+    const supportsNativeResume = input.runtime.name === "claude"
+        || (stableProtocolRuntime && runtimeCapability(input.runtime.name).nativeResume);
+    if (!supportsNativeResume || !input.session.enabled) {
         return executeLocalUnlocked(input, callbacks, dependencies);
     }
     const leaseKey = JSON.stringify([
@@ -176,8 +184,10 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         ...(input.resumeKey === undefined ? {} : { resumeKey: input.resumeKey }),
         ...(input.launch.description ? { description: input.launch.description } : {}),
     });
+    let materialized = null;
     try {
-        const supportsNativeResume = runtime.name === "claude";
+        const supportsNativeResume = runtime.name === "claude"
+            || (dependencies.launchRuntime !== undefined && runtimeCapability(runtime.name).nativeResume);
         const prior = input.session.enabled && supportsNativeResume
             ? await readSession(workspace.sessionDir)
             : null;
@@ -197,13 +207,23 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             nearBudget,
         };
         const systemPrompt = resolvePrompt(input.systemPrompt, promptContext);
-        const wakePrompt = resolvePrompt(input.wakePrompt, promptContext);
+        if (input.attachments && input.attachments.length > 0) {
+            materialized = await (dependencies.materializeAttachments ?? materializeAttachments)({
+                serverUrl: input.launch.serverUrl,
+                token: input.launch.token,
+                runDir: workspace.runDir,
+                executionId: input.executionId,
+                attachments: input.attachments,
+            });
+        }
+        const attachmentPlan = routeRuntimeAttachments(runtime.name, materialized?.attachments ?? []);
+        const wakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
         await writeFile(workspace.systemPromptPath, systemPrompt, "utf8");
         const baseEnv = {
             ...process.env,
             ...sanitizeEnvVars(providerConfig.envVars),
             ...input.launch.systemEnv,
-            PATH: `${workspace.crewDir}${delimiter}${process.env.PATH ?? ""}`,
+            PATH: `${workspace.crewDir}${delimiter}${augmentedPath()}`,
             CREW_SERVER_URL: input.launch.serverUrl,
             CREW_TOKEN: input.launch.token,
             CREW_CHANNEL: input.channelId,
@@ -235,6 +255,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ...(runtime.reasoning === undefined ? {} : { reasoning: runtime.reasoning }),
             ...(launchSessionId === null ? {} : { sessionId: launchSessionId }),
             resume: resuming,
+            ...(attachmentPlan.nativeImagePaths.length > 0
+                ? { imagePaths: attachmentPlan.nativeImagePaths }
+                : {}),
         });
         const activities = [];
         let sessionId = launchSessionId;
@@ -242,6 +265,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         let observedModel = currentModel;
         let finalText = null;
         let sentViaCrew = false;
+        const externalOutput = new ExternalAnswerDecoder();
         const readline = createInterface({ input: child.stdout });
         readline.on("line", (line) => {
             const event = parseLine(line);
@@ -266,6 +290,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                     && "type" in event && event.type === "kimi.acp.text_delta";
                 finalText = incremental ? `${finalText ?? ""}${extracted}` : extracted;
             }
+            for (const text of decodeExternalOutputEvent(runtime.name, event, externalOutput)) {
+                callbacks.onExternalOutput?.(text);
+            }
             for (const chunk of toConsoleLines(event))
                 callbacks.onConsole?.(chunk);
         });
@@ -313,11 +340,22 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             resumed: resuming,
             sessionId,
             errorMessage: errorTail || null,
-            finalText: input.captureFinal ? finalText : null,
+            finalText: input.captureFinal && finalText !== null
+                ? stripExternalAnswerMarkers(finalText)
+                : null,
             sentViaCrew,
         };
     }
     finally {
+        if (materialized) {
+            try {
+                await (dependencies.cleanupMaterializedAttachments ?? cleanupAttachments)(materialized.directory);
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                process.stderr.write(`[execution] failed to remove attachments ${materialized.directory}: ${detail}\n`);
+            }
+        }
         try {
             await rm(workspace.systemPromptPath, { force: true });
         }

package/dist/machine-info.js

@@ -4,6 +4,7 @@
  */
 import { hostname, arch, platform as osPlatform } from "node:os";
 import { lookupCmd } from "./platform.js";
+import { augmentedPath } from "./runtime-path.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { readFileSync } from "node:fs";
@@ -21,6 +22,8 @@ export const DAEMON_CAPABILITIES = [
     "reply_origin_v1",
     "origin_decision_v1",
     "execution_telemetry_ack_v1",
+    "execution_external_output_v1",
+    "execution_attachments_v1",
 ];
 export const EXECUTION_PROTOCOL = Object.freeze({ min: 1, max: 1 });
 /** 候选 runtime CLI:展示名 → 可执行文件名。 */
@@ -36,7 +39,8 @@ const RUNTIME_BINS = [
 ];
 async function isInstalled(bin) {
     try {
-        await execFileP(lookupCmd(), [bin]);
+        // 用增强 PATH 探测:daemon 继承的 PATH 可能缺 ~/.local/bin 等用户级目录(Claude 原生安装器落点)。
+        await execFileP(lookupCmd(), [bin], { env: { ...process.env, PATH: augmentedPath() } });
         return true;
     }
     catch {

package/dist/origin-decision.js

@@ -27,7 +27,9 @@ export async function readOriginDecisionFile(path) {
     }
 }
 export function shouldRetryOriginDecision(wakeOrigin, decision, attempt) {
-    return wakeOrigin === "wecom" && decision?.decision !== "reply" && attempt === 0;
+    if (attempt !== 0 || wakeOrigin === undefined)
+        return false;
+    return wakeOrigin === "wecom" ? decision?.decision !== "reply" : decision === null;
 }
 export async function runWithOriginDecisionGuard(wakeOrigin, runAttempt) {
     const first = await runAttempt(0);