@nowcrew/daemon 0.6.15 → 0.6.17

package/dist/project-workspaces/resolver.js

@@ -0,0 +1,179 @@
+import { constants } from "node:fs";
+import { access, lstat, realpath, stat } from "node:fs/promises";
+import { posix, win32 } from "node:path";
+const UNAVAILABLE_CODE = "project_context_unavailable";
+const WINDOWS_EXTENDED_PREFIX = "\\\\?\\";
+const WINDOWS_EXTENDED_UNC_PREFIX = "\\\\?\\UNC\\";
+const WINDOWS_DEVICE_PREFIX = "\\\\.\\";
+const WINDOWS_DRIVE_ABSOLUTE = /^[A-Za-z]:\\/u;
+export class ProjectContextUnavailableError extends Error {
+    projectId;
+    code = UNAVAILABLE_CODE;
+    constructor(projectId) {
+        super(UNAVAILABLE_CODE);
+        this.projectId = projectId;
+        Object.defineProperty(this, "name", {
+            configurable: true,
+            value: "ProjectContextUnavailableError",
+        });
+    }
+    toJSON() {
+        return { projectId: this.projectId, code: this.code };
+    }
+}
+const compareProjectIds = (left, right) => {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+};
+const warningFor = (projectId) => Object.freeze({
+    projectId,
+    code: UNAVAILABLE_CODE,
+});
+const nodeFilesystem = { lstat, stat, access, realpath };
+/**
+ * Shape/access preflight only. In particular, fs.access cannot prove effective Windows ACL access;
+ * process launch remains authoritative and Windows capability enablement is owned outside this module.
+ */
+const preflightDirectory = async (root, filesystem) => {
+    try {
+        const entry = await filesystem.lstat(root);
+        if (!entry.isDirectory()) {
+            if (!entry.isSymbolicLink())
+                return false;
+            if (!(await filesystem.stat(root)).isDirectory())
+                return false;
+        }
+        await filesystem.access(root, constants.R_OK | constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const registryByProjectId = (registrations) => new Map(registrations.map((registration) => [registration.projectId, registration]));
+const hasUncServerAndShare = (root, prefixLength) => {
+    const [server, share] = root.slice(prefixLength).split("\\");
+    return server !== undefined && server.length > 0 && share !== undefined && share.length > 0;
+};
+const normalizeWindowsRoot = (root) => {
+    const normalized = win32.normalize(root);
+    const lower = normalized.toLowerCase();
+    const extendedPrefix = WINDOWS_EXTENDED_PREFIX.toLowerCase();
+    const extendedUncPrefix = WINDOWS_EXTENDED_UNC_PREFIX.toLowerCase();
+    if (normalized.startsWith(WINDOWS_DEVICE_PREFIX))
+        return null;
+    if (lower.startsWith(extendedUncPrefix)) {
+        return hasUncServerAndShare(normalized, WINDOWS_EXTENDED_UNC_PREFIX.length)
+            ? normalized
+            : null;
+    }
+    if (lower.startsWith(extendedPrefix)) {
+        return WINDOWS_DRIVE_ABSOLUTE.test(normalized.slice(WINDOWS_EXTENDED_PREFIX.length))
+            ? normalized
+            : null;
+    }
+    if (WINDOWS_DRIVE_ABSOLUTE.test(normalized))
+        return win32.resolve(normalized);
+    if (!normalized.startsWith("\\\\"))
+        return null;
+    return hasUncServerAndShare(normalized, 2) ? win32.resolve(normalized) : null;
+};
+const normalizeRegisteredRoot = (root, platform) => {
+    if (root.length === 0)
+        return null;
+    if (platform === "win32")
+        return normalizeWindowsRoot(root);
+    return posix.isAbsolute(root) ? posix.resolve(root) : null;
+};
+const rootIdentity = (root, platform) => {
+    if (platform !== "win32")
+        return root;
+    const lower = root.toLowerCase();
+    if (lower.startsWith(WINDOWS_EXTENDED_UNC_PREFIX.toLowerCase())) {
+        return win32.normalize(`\\\\${root.slice(WINDOWS_EXTENDED_UNC_PREFIX.length)}`).toLowerCase();
+    }
+    if (lower.startsWith(WINDOWS_EXTENDED_PREFIX.toLowerCase())) {
+        return win32.normalize(root.slice(WINDOWS_EXTENDED_PREFIX.length)).toLowerCase();
+    }
+    return root.toLowerCase();
+};
+export async function resolveProjectContext(snapshot, registry, options = {}) {
+    if (snapshot.projectIds.length === 0 && snapshot.primaryProjectId === undefined) {
+        return Object.freeze({
+            secondary: Object.freeze([]),
+            warnings: Object.freeze([]),
+        });
+    }
+    const platform = options.platform ?? process.platform;
+    const filesystem = options.filesystem ?? nodeFilesystem;
+    const sortedProjectIds = [...snapshot.projectIds].sort(compareProjectIds);
+    const primaryProjectId = snapshot.primaryProjectId;
+    let registrations;
+    try {
+        registrations = await registry.list();
+    }
+    catch {
+        registrations = Object.freeze([]);
+    }
+    const localProjects = registryByProjectId(registrations);
+    const seenRoots = new Set();
+    const resolveOne = async (projectId) => {
+        const registration = localProjects.get(projectId);
+        if (registration === undefined)
+            return { status: "unavailable" };
+        const root = normalizeRegisteredRoot(registration.root, platform);
+        if (root === null || !(await preflightDirectory(root, filesystem))) {
+            return { status: "unavailable" };
+        }
+        let physicalRoot;
+        try {
+            physicalRoot = await filesystem.realpath(root);
+        }
+        catch {
+            return { status: "unavailable" };
+        }
+        const normalizedPhysicalRoot = normalizeRegisteredRoot(physicalRoot, platform);
+        if (normalizedPhysicalRoot === null)
+            return { status: "unavailable" };
+        const identity = rootIdentity(normalizedPhysicalRoot, platform);
+        if (seenRoots.has(identity))
+            return { status: "duplicate" };
+        seenRoots.add(identity);
+        return {
+            status: "resolved",
+            project: Object.freeze({ projectId, root }),
+        };
+    };
+    let primary;
+    if (primaryProjectId !== undefined) {
+        if (!sortedProjectIds.includes(primaryProjectId)) {
+            throw new ProjectContextUnavailableError(primaryProjectId);
+        }
+        const resolvedPrimary = await resolveOne(primaryProjectId);
+        if (resolvedPrimary.status !== "resolved") {
+            throw new ProjectContextUnavailableError(primaryProjectId);
+        }
+        primary = resolvedPrimary.project;
+    }
+    const secondary = [];
+    const warnings = [];
+    for (const projectId of sortedProjectIds) {
+        if (projectId === primaryProjectId)
+            continue;
+        const resolved = await resolveOne(projectId);
+        if (resolved.status === "unavailable")
+            warnings.push(warningFor(projectId));
+        else if (resolved.status === "resolved")
+            secondary.push(resolved.project);
+    }
+    const base = {
+        secondary: Object.freeze(secondary),
+        warnings: Object.freeze(warnings),
+    };
+    return primary === undefined
+        ? Object.freeze(base)
+        : Object.freeze({ primary, ...base });
+}

package/dist/project-workspaces/types.js

@@ -0,0 +1 @@
+export {};

package/dist/prompt.js

@@ -20,6 +20,46 @@ const EXTERNAL_RESULT_READABILITY = `
 - 有足够重点时,只加粗三到五处真正决定性的数字、最终状态、风险、截止时间、负责人或行动项;不足三处时宁缺毋滥。加粗范围要短,不要整段加粗,不要把每个数字都加粗,不得强化未经验证的判断。
 - 需要颜色层级时,只在确有对应语义的短加粗重点前使用一个彩色圆点:🟢 绿色圆点表示已验证成功或健康,🟠 橙色圆点表示风险、临期或需要关注,🔴 红色圆点表示失败、阻塞或严重异常,🔵 蓝色圆点表示负责人、行动项或关键中性数据。每个短加粗重点前最多放一个;不要给普通段落、标题或每个要点都加标记。
 - 使用标题、列表、引用、彩色圆点和加粗形成在企微原生流式消息中稳定可见的层级;不得输出 \`<font>\` 或其它 HTML 标色标签。`;
+const compareProjectIds = (left, right) => {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+};
+const JSON_SINGLE_LINE_ESCAPE = /[\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/gu;
+const escapeJsonSingleLineControls = (json) => json.replace(JSON_SINGLE_LINE_ESCAPE, (character) => `\\u${character.codePointAt(0).toString(16).padStart(4, "0")}`);
+const canonicalJsonString = (value) => escapeJsonSingleLineControls(JSON.stringify(value));
+const canonicalJsonRecord = (value) => escapeJsonSingleLineControls(JSON.stringify(value));
+/**
+ * Resolved paths are daemon-local facts. JSON rows keep paths with spaces or Unicode as data,
+ * never as shell fragments; warning rows expose only logical IDs and stable codes, never roots.
+ */
+export function buildRuntimeWorkspacePrompt(projectContext) {
+    if (projectContext?.primary === undefined)
+        return "";
+    const projectRoles = [
+        { role: "primary", ...projectContext.primary },
+        ...[...projectContext.secondary]
+            .sort((left, right) => compareProjectIds(left.projectId, right.projectId))
+            .map((project) => ({ role: "secondary", ...project })),
+    ].map(({ role, projectId, root }) => `- ${canonicalJsonRecord({ role, projectId, root })}`);
+    const projectWarnings = [...projectContext.warnings]
+        .sort((left, right) => compareProjectIds(left.projectId, right.projectId)
+        || compareProjectIds(left.code, right.code))
+        .map(({ projectId, code }) => `- ${canonicalJsonRecord({ projectId, code })}`);
+    const warningsBlock = projectWarnings.length === 0
+        ? ""
+        : `\n\n## Daemon-local project warnings\n${projectWarnings.join("\n")}`;
+    return `\n\n## Runtime workspace boundaries
+Repository cwd: ${canonicalJsonString(projectContext.primary.root)}. Use it for source, builds, tests, and Git operations.
+Task state directory: $CREW_TASK_DIR. Put downloads, diagnostics, drafts, reports, and temporary artifacts there.
+Work log: $CREW_TASK_LOG. Do not treat the repository as NowWork task storage.
+Runtime permission and sandbox rules still govern repository writes; project binding grants no additional write access.
+
+## Daemon-local project roles
+${projectRoles.join("\n")}${warningsBlock}`;
+}
 export function capWorkLogForInject(workLog, cap = WORKLOG_INJECT_CAP) {
     if (workLog.length <= cap)
         return workLog;
@@ -89,12 +129,16 @@ export function buildSystemPrompt(ctx) {
     // scheduled 换成静默版表述(2026-07-13 复审 Minor 5)。
     const threadTaskRule = scheduled
         ? "\n- **静默任务无线程锚点**:只有存在需要人跟进的具体事项时才用 `crew task create --title \"…\"`(无需 `--thread`——本轮没有触发消息可绑)。"
-        : `\n- **线程 = 工作单元 / 一个请求一个 task(CRITICAL)**:一条对话(thread)对应一件事,最多绑**一个** task。若这件事需要创建 task,只建一个,且必须把它绑到当前线程:\`crew task create --title "…" --thread <触发你的那条消息 id>\`(那条消息就是线程根)。**一定要带 \`--thread\`**——不带会另起一条飘在顶层的新线程,task 就和你的讨论分家了(这正是要避免的)。**别把一个请求拆成多个 task**(如"拉代码"+"读文档"+"写记忆"是同一件事 → 一个 task,用 todo/进度推进,不要建第二个)。当前线程已有 task 时再建会被服务端拒绝(报错会提示你)。`;
+        : ctx.wakeMessageId
+            ? `\n- **线程 = 工作单元 / 一个请求一个 task(CRITICAL)**:一条对话(thread)对应一件事,最多绑**一个** task。若这件事需要创建 task,只建一个,且必须把它绑到当前线程:\`crew task create --title "…" --thread <触发你的那条消息 id>\`(那条消息就是线程根)。**一定要带 \`--thread\`**——不带会另起一条飘在顶层的新线程,task 就和你的讨论分家了(这正是要避免的)。**别把一个请求拆成多个 task**(如"拉代码"+"读文档"+"写记忆"是同一件事 → 一个 task,用 todo/进度推进,不要建第二个)。当前线程已有 task 时再建会被服务端拒绝(报错会提示你)。`
+            : `\n- **无线程锚点 / 一个请求一个 task(CRITICAL)**:当前来信位于频道顶层,没有可复用的当前线程。若这件事需要创建 task,只建一个,使用 \`crew task create --channel ${ctx.channelId} --new-thread --title "…"\` 创建并绑定新线程;之后以命令返回的线程根作为这件事的唯一线程。**别把一个请求拆成多个 task**(如"拉代码"+"读文档"+"写记忆"是同一件事 → 一个 task,用 todo/进度推进,不要建第二个)。`;
     const progressRule = alwaysReport
         ? "\n- **报告交由 daemon 投递**:只返回一个完整最终报告,不要调用 `crew message send`;本轮没有线程锚点。"
         : scheduled
             ? "\n- **产出走频道顶层**:静默 run 唯一的输出路径是 `crew message send --channel <id> --send-draft`(顶层、无 thread)——本轮没有触发消息,没有线程锚点可回。"
-            : "\n- **进度/产出回本线程**:这件事的认领/进度/完成汇报都用 `crew message send --thread <当前线程根>` 回复在**这个线程里**(线程根 = 触发你的那条消息 id,即 \$CREW_WAKE_MESSAGE_ID)。**严禁把进度发到别的线程或频道顶层。**";
+            : ctx.wakeMessageId
+                ? "\n- **进度/产出回本线程**:这件事的认领/进度/完成汇报都用 `crew message send --thread <当前线程根>` 回复在**这个线程里**(线程根 = 触发你的那条消息 id,即 \$CREW_WAKE_MESSAGE_ID)。**严禁把进度发到别的线程或频道顶层。**"
+                : `\n- **无线程锚点时的回复位置**:不创建 task 的直接答复用 \`crew message send --channel ${ctx.channelId}\` 回复频道顶层;创建 task 后,这件事的认领/进度/完成汇报都回复到命令返回的新线程根。不得虚构线程 id。`;
     const scheduleIntentRule = scheduled ? "" : `
 
 ## 定时任务创建与管理
@@ -115,12 +159,15 @@ export function buildSystemPrompt(ctx) {
     const actionRule = scheduled
         ? `- **判定规则**:直接执行本轮定时指令,执行前不需要 claim。${threadTaskRule}${progressRule}`
         : `- **判定规则**:定时任务创建与管理和 memory_prune 无需 task claim,只遵守各自唤醒指令;其它来信若需要你"回复之外的动作"(跑工具/改代码/做变更),先 claim;若只是回答问题或闲聊,无需 claim。${threadTaskRule}${progressRule}`;
+    const interactiveTaskCreateCommand = ctx.wakeMessageId
+        ? `6. **\`crew task create --channel <id> --title "<标题>" --thread <当前线程根msgId>\`** —— 新建任务并**绑定到当前线程**。\`--thread\` 传你读到的那条**触发消息 id**(线程根),任务就和讨论同处一个线程。省略 \`--thread\` 会另起新线程,**几乎总是错的——务必带上**。`
+        : `6. **\`crew task create --channel <id> --new-thread --title "<标题>"\`** —— 当前没有线程锚点时,新建任务并绑定到命令返回的新线程;后续回复使用返回的完整线程根消息 id。`;
     const taskAndScheduleCommands = alwaysReport
         ? `4. **\`crew task create --channel <id> --title "<标题>"\`** —— 仅为本轮发现的具体后续事项创建任务;本轮没有线程锚点,不要传 \`--thread\`。`
         : scheduled
             ? `5. **\`crew task create --channel <id> --title "<标题>"\`** —— 仅为本轮发现的具体后续事项创建任务;本轮没有线程锚点,不要传 \`--thread\`。`
             : `5. **\`crew task list --channel <id>\`** —— 看任务板。支持 \`--status <s>\` / \`--mine\`。
-6. **\`crew task create --channel <id> --title "<标题>" --thread <当前线程根msgId>\`** —— 新建任务并**绑定到当前线程**。\`--thread\` 传你读到的那条**触发消息 id**(线程根),任务就和讨论同处一个线程。省略 \`--thread\` 会另起新线程,**几乎总是错的——务必带上**。
+${interactiveTaskCreateCommand}
 7. **\`crew task claim <taskId>\`** —— 除定时任务创建与管理和 memory_prune 外,执行需要动作的工作前先认领任务。
 8. **\`crew task update <taskId> --status <in_progress|in_review|done>\`** —— 推进任务状态。
 9. **\`crew task unclaim <taskId>\`** —— 释放认领,把任务让给别人。
@@ -129,6 +176,14 @@ export function buildSystemPrompt(ctx) {
 12. **\`crew schedule list --channel <id> --agent <handle> [--json]\`** —— 查询本频道指定 agent 的定时任务,\`--json\` 返回完整字段。
 13. **\`crew schedule update <jobId> ...\`** —— 修改定时任务标题、指令、时间或输出策略。
 14. **\`crew schedule pause|resume|cancel|run-now <jobId>\`** —— 控制定时任务。`;
+    const memoryTaskReadRule = scheduled
+        ? ""
+        : ctx.wakeMessageId
+            ? `- 普通交互执行将写共享记忆前,先运行 crew thread read --thread "$CREW_WAKE_MESSAGE_ID"。crew thread read 返回的顶层 task 是当前线程任务的权威事实;不得把 parent.task 或同频道其它 task 当成当前线程任务。顶层 task 为 null 时按当前线程没有 task 处理。`
+            : `- 普通交互执行将写共享记忆前,先运行 crew message read --channel ${ctx.channelId}。当前没有线程锚点时不得运行 crew thread read;需要普通 task 时先用 crew task create --channel ${ctx.channelId} --new-thread --title "…" 创建新线程,再对返回的线程根运行 crew thread read --thread <线程根> 并以其顶层 task 为权威事实。不得把同频道其它 task 当成当前任务。`;
+    const messageThreadUsage = ctx.wakeMessageId
+        ? "被唤醒时优先使用环境变量 `$CREW_WAKE_MESSAGE_ID` 或唤醒提示里的完整 id,不要手动截短。"
+        : "当前没有线程锚点:频道顶层回复只带 `--channel`;创建 task 后再使用命令返回的完整线程根消息 id。";
     const communicationSection = alwaysReport
         ? `## 控制面工具 —— crew CLI
 需要读取频道或操作任务时使用 crew CLI;最终报告不得通过消息命令发送。可使用:
@@ -142,7 +197,7 @@ ${taskAndScheduleCommands}`
 2. **\`crew message read --channel <id>\`** —— 读频道历史(读取即自动推进你的已读/新鲜度游标)。支持 \`--after <seq>\` / \`--limit <n>\`。
 3. **\`crew message check --channel <id>\`** —— 非阻塞查看未读数。工作中可在自然断点随时用。
 4. **\`crew message send --channel <id>\`** —— 发消息。${messageBodyInput}
-   也可用 \`--content "<短正文>"\`。线程内回复:加 \`--thread <完整线程根消息 id>\`。被唤醒时优先使用环境变量 \`$CREW_WAKE_MESSAGE_ID\` 或唤醒提示里的完整 id,不要手动截短。
+   也可用 \`--content "<短正文>"\`。线程内回复:加 \`--thread <完整线程根消息 id>\`。${messageThreadUsage}
 ${taskAndScheduleCommands}`;
     const freshnessRule = alwaysReport
         ? ""
@@ -162,8 +217,11 @@ ${taskAndScheduleCommands}`;
                 : `
 - **本轮是 NowWork 内部唤醒**:普通 \`crew message send\` 只写入 NowWork。内部唤醒不得使用 \`--reply-origin\`，该参数只回答直接触发本轮的企微原消息。
 - **绑定会话主动通知**:用户明确要求同步，或最终结果有实质结论、变更或需群用户行动的阻塞时，才用一次 \`crew message send --notify-bound-im\`（同时带当前 channel/thread/content 参数）请求通知当前频道绑定的外部会话。Server 会校验绑定 owner 授权、绑定 Agent 和单轮边界；不能指定收件人。确认、进度、中间结果、无变化和重复内容一律留在 NowWork。${EXTERNAL_RESULT_READABILITY}`;
+    const newThreadRule = ctx.wakeMessageId
+        ? "- **毫不相关的新任务才另起线程**:只有要处理的事**和当前线程毫不相关**(或用户明确要求新建)时,才用 `crew task create --new-thread --title \"…\"`——系统另起一个子线程(parent=当前线程)绑新 task;之后这件事的回复要发到**这个新子线程**里。能不拆就不拆。"
+        : `- **当前没有线程锚点**:需要普通 task 时用 \`crew task create --channel ${ctx.channelId} --new-thread --title "…"\` 创建根线程;之后这件事的回复都发到返回的新线程里。`;
     const interactiveTaskRules = scheduled ? "" : `
-- **毫不相关的新任务才另起线程**:只有要处理的事**和当前线程毫不相关**(或用户明确要求新建)时,才用 \`crew task create --new-thread --title "…"\`——系统另起一个子线程(parent=当前线程)绑新 task;之后这件事的回复要发到**这个新子线程**里。能不拆就不拆。
+${newThreadRule}
 - 任务状态流:\`todo → in_progress → in_review → done\`。claim 后用 \`crew task update\` 推进:开工→in_progress、完成待验收→in_review、人类确认后→done。只有 assignee 能改自己任务的状态。
 - **交接(handoff)**:当你这一环干完、需要别的角色接手时(如开发完成 → 交给 QA 测试),用 \`crew task assign <taskId> --to <下家handle>\` 把任务交接出去,并在线程里给下家足够背景(分支名 / 改动摘要 / 测试建议)。交接后对方会被自动唤醒。**别让任务停在你手里无人跟进**。
 - **分诊(若你是总管)**:若你收到「【分诊请求】」唤醒,说明频道里有一个无人认领的任务需要你按团队职责分派。唤醒内容里已附上团队成员及其职责:判断谁最合适,用 \`crew task assign <taskId> --to <handle>\` 指派给他(若该你自己做就 \`crew task claim\`);确实没人合适时,在频道里 @发起人 说明并给建议,**不要让任务悬空**。`;
@@ -237,6 +295,7 @@ ${taskAndScheduleCommands}`;
 - **普通任务默认只写两处**:① 本任务的隔离 cwd(代码/草稿);② 本任务的工作日志 **\`$CREW_TASK_LOG\`**(每任务一份,别人不会碰)。默认不要修改共享 \`$CREW_HOME/MEMORY.md\` 或 notes/;只有当前用户明确要求更新或记住长期记忆,或明确表达具体且跨后续任务持续生效的规则、偏好或约束时,才按下方条件写入相关共享文件。在工作日志里记:当前阶段 / 下一步 / 卡在谁 / 关键结论(每条尽量 ≤3 行)。
 - **当前请求明确要求更新或记住长期记忆,明确表达需要跨后续任务持续生效的具体规则、偏好或约束,或当前消息是对本线程紧邻记忆方案的无歧义确认时**,可以按最小范围直接写共享记忆。例如“以后所有测试报告统一按五部分写”属于明确长期意图,即使没有使用“记忆”一词。先读取相关索引和 note,语义已存在时不重复追加,不要把 Agent 自己判断值得记住视为用户授权。
 - 本节的直接更新共享记忆和相关 task 流转仅适用于用户消息触发的普通交互执行。memory_prune 和 scheduled 执行只遵守各自唤醒指令,不得依据本节认领、创建、重开或推进 task。
+${memoryTaskReadRule}
 - 普通交互执行将写共享记忆时,使用当前线程唯一的普通 task:已有非终态 task 时先按归属规则确保当前 Agent 成功认领;当前线程没有 task 时先创建并认领一个普通 task;已有 task 为 done/closed 时不得由 Agent 重开,done 报告当前轻量方案无法安全复用终态 task,closed 保持人工终态。遇到终态或归属问题时报告冲突且不得创建第二个 task 或新的任务类型。完成写入后,只有任务本身的全部工作已完成时才推进终态以触发 prune。
 - 提出共享记忆修改方案并等待用户确认时,该 task 仍有剩余工作,保持 in_review 或其它非终态;收到无歧义确认后再执行写入,并仅在全部工作完成后推进终态。
 - 普通执行直接更新后，仍然保留任务结束后的专门收尾执行,不因已经写过而跳过 prune。

package/dist/runner.js

@@ -46,6 +46,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
         systemPrompt: ({ workspace, resuming }) => buildSystemPrompt({
             handle: input.handle,
             channelId: input.channelId,
+            ...(input.wakeMessageId ? { wakeMessageId: input.wakeMessageId } : {}),
             agentId: credential.agentId,
             homeDir: workspace.dir,
             productName: config.productName,

package/dist/runtimes/claude.js

@@ -1,6 +1,8 @@
 /**
  * Claude Code runtime 适配:print + stream-json 模式,headless 驱动。
  */
+import { realpath } from "node:fs/promises";
+import { posix, win32 } from "node:path";
 // cross-spawn:win32 上 npm CLI 是 .cmd shim,node 原生 spawn 不带 shell 无法执行(ENOENT/EINVAL)
 import spawn from "cross-spawn";
 // Claude Code 原生 --effort 档位(claude 2.1.196 实测:--help 与非法值告警均枚举这五档)。
@@ -9,6 +11,237 @@ export const CLAUDE_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 // 未配置/非法档位时的默认思考强度:medium 开启原生 thinking(终端透传要展示思考过程),
 // 又不至于 high/max 的 token 开销;agent 配置白名单档位可覆盖。
 export const CLAUDE_DEFAULT_EFFORT = "medium";
+export const CLAUDE_ADDITIONAL_DIRECTORY_INSTRUCTIONS_MIN_VERSION = "2.1.237";
+export const CLAUDE_ADDITIONAL_DIRECTORY_INSTRUCTIONS_ENV = "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD";
+const CLAUDE_VERSION_PROBE_TIMEOUT_MS = 1_000;
+const CLAUDE_VERSION_PROBE_KILL_GRACE_MS = 250;
+const CLAUDE_VERSION_PROBE_MAX_BUFFER = 8 * 1024;
+const CLAUDE_VERSION_PROBE_SUCCESS_TTL_MS = 30_000;
+const CLAUDE_REALPATH_TIMEOUT_MS = 250;
+const ignoreTerminalProbeError = () => undefined;
+const defaultVersionProbeSpawner = (file, args, options) => spawn(file, [...args], options);
+const versionProbeCache = new Map();
+const probeClaudeVersionOnce = (bin, env, start, dependencies) => {
+    // A .cmd launch creates an unmanaged cmd.exe process tree. Without a Job Object or another
+    // verifiable owner, a timeout cannot safely distinguish that tree from PID reuse. Fail closed:
+    // directory access remains available, but nested CLAUDE.md auto-loading stays unverified.
+    if ((dependencies.platform ?? process.platform) === "win32")
+        return Promise.resolve(null);
+    let child;
+    try {
+        child = start(bin, ["--version"], {
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            shell: false,
+        });
+    }
+    catch {
+        return Promise.resolve(null);
+    }
+    return new Promise((resolve) => {
+        let settled = false;
+        let timedOut = false;
+        let closed = false;
+        let output = Buffer.alloc(0);
+        let resolveClose;
+        const close = new Promise((closeResolve) => { resolveClose = closeResolve; });
+        const waitForClose = async () => {
+            let deadline;
+            try {
+                await Promise.race([
+                    close,
+                    new Promise((waitResolve) => {
+                        deadline = setTimeout(waitResolve, CLAUDE_VERSION_PROBE_KILL_GRACE_MS);
+                    }),
+                ]);
+            }
+            finally {
+                if (deadline !== undefined)
+                    clearTimeout(deadline);
+            }
+        };
+        const append = (chunk) => {
+            if (output.length >= CLAUDE_VERSION_PROBE_MAX_BUFFER)
+                return;
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+            const remaining = CLAUDE_VERSION_PROBE_MAX_BUFFER - output.length;
+            output = Buffer.concat([output, bytes.subarray(0, remaining)]);
+        };
+        child.stdout?.on("data", append);
+        child.stderr?.on("data", append);
+        const observeClose = () => {
+            if (closed)
+                return;
+            closed = true;
+            resolveClose();
+        };
+        const cleanup = () => {
+            child.stdout?.off("data", append);
+            child.stderr?.off("data", append);
+            child.off("error", onError);
+            child.off("close", onClose);
+            // ChildProcess can report a late error after its final close deadline. Retain one static sink:
+            // it captures no local state, creates no timer, and remains safe until the child is collected.
+            child.off("error", ignoreTerminalProbeError);
+            child.on("error", ignoreTerminalProbeError);
+            child.stdout?.destroy();
+            child.stderr?.destroy();
+        };
+        const settle = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutTimer);
+            cleanup();
+            resolve(value);
+        };
+        const onError = () => {
+            if (!timedOut)
+                settle(null);
+        };
+        const onClose = (code) => {
+            observeClose();
+            if (timedOut)
+                return;
+            const value = output.toString("utf8").trim();
+            settle(code === 0 && value !== "" ? value : null);
+        };
+        const timeoutTimer = setTimeout(() => {
+            timedOut = true;
+            void (async () => {
+                try {
+                    child.kill("SIGTERM");
+                }
+                catch { /* process already exited */ }
+                await waitForClose();
+                if (!closed) {
+                    try {
+                        child.kill("SIGKILL");
+                    }
+                    catch { /* process already exited */ }
+                    await waitForClose();
+                }
+                settle(null);
+            })();
+        }, CLAUDE_VERSION_PROBE_TIMEOUT_MS);
+        child.on("error", onError);
+        child.on("close", onClose);
+    });
+};
+/** Bounded local-only probe; errors and output never cross the execution protocol. */
+export function probeClaudeVersion(bin, env, start = defaultVersionProbeSpawner, dependencies = {}) {
+    if (start !== defaultVersionProbeSpawner) {
+        return probeClaudeVersionOnce(bin, env, start, dependencies);
+    }
+    const key = JSON.stringify([dependencies.platform ?? process.platform, bin, env.PATH ?? ""]);
+    const now = Date.now();
+    const cached = versionProbeCache.get(key);
+    if (cached !== undefined && (cached.expiresAt === null || cached.expiresAt > now)) {
+        return cached.promise;
+    }
+    if (cached !== undefined)
+        versionProbeCache.delete(key);
+    const pending = probeClaudeVersionOnce(bin, env, start, dependencies);
+    const inFlight = { promise: pending, expiresAt: null };
+    versionProbeCache.set(key, inFlight);
+    void pending.then((version) => {
+        if (versionProbeCache.get(key) !== inFlight)
+            return;
+        if (version === null) {
+            versionProbeCache.delete(key);
+            return;
+        }
+        versionProbeCache.set(key, {
+            promise: Promise.resolve(version),
+            expiresAt: Date.now() + CLAUDE_VERSION_PROBE_SUCCESS_TTL_MS,
+        });
+    });
+    return pending;
+}
+const canonicalDirectoryIdentity = (directory, platform) => {
+    if (platform !== "win32")
+        return posix.normalize(directory);
+    let normalized = directory.replaceAll("/", "\\");
+    const lower = normalized.toLowerCase();
+    if (lower.startsWith("\\\\?\\unc\\"))
+        normalized = `\\\\${normalized.slice(8)}`;
+    else if (lower.startsWith("\\\\?\\"))
+        normalized = normalized.slice(4);
+    return win32.normalize(normalized).toLowerCase();
+};
+export function orderedUniqueClaudeDirectories(directories, excluded = [], platform = process.platform) {
+    const seen = new Set(excluded.map((directory) => canonicalDirectoryIdentity(directory, platform)));
+    const ordered = [];
+    for (const directory of directories) {
+        const identity = canonicalDirectoryIdentity(directory, platform);
+        if (seen.has(identity))
+            continue;
+        seen.add(identity);
+        ordered.push(directory);
+    }
+    return Object.freeze(ordered);
+}
+const canonicalizeWithinDeadline = async (directory, canonicalize) => {
+    let timeout;
+    try {
+        return await Promise.race([
+            Promise.resolve().then(() => canonicalize(directory)).catch(() => directory),
+            new Promise((resolve) => {
+                timeout = setTimeout(() => resolve(directory), CLAUDE_REALPATH_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        if (timeout !== undefined)
+            clearTimeout(timeout);
+    }
+};
+/** Preserve caller order while collapsing physical aliases; inaccessible paths fall back to lexical identity. */
+export async function resolveOrderedUniqueClaudeDirectories(directories, excluded = [], canonicalize = realpath, platform = process.platform) {
+    const identity = async (directory) => {
+        const physical = await canonicalizeWithinDeadline(directory, canonicalize);
+        return canonicalDirectoryIdentity(physical, platform);
+    };
+    const [excludedIdentities, identities] = await Promise.all([
+        Promise.all(excluded.map(identity)),
+        Promise.all(directories.map(identity)),
+    ]);
+    const seen = new Set(excludedIdentities);
+    const ordered = [];
+    for (let index = 0; index < directories.length; index += 1) {
+        const directoryIdentity = identities[index];
+        if (seen.has(directoryIdentity))
+            continue;
+        seen.add(directoryIdentity);
+        ordered.push(directories[index]);
+    }
+    return Object.freeze(ordered);
+}
+const parseVersion = (value) => {
+    const match = /(?:^|[^0-9])(\d+)\.(\d+)\.(\d+)(?:[^0-9]|$)/u.exec(value);
+    if (match === null)
+        return null;
+    const version = match.slice(1, 4).map(Number);
+    return version.every(Number.isSafeInteger)
+        ? [version[0], version[1], version[2]]
+        : null;
+};
+export function isClaudeAdditionalDirectoryInstructionsSupported(versionOutput) {
+    if (versionOutput === null)
+        return false;
+    const version = parseVersion(versionOutput);
+    const minimum = parseVersion(CLAUDE_ADDITIONAL_DIRECTORY_INSTRUCTIONS_MIN_VERSION);
+    if (version === null || minimum === null)
+        return false;
+    for (let index = 0; index < version.length; index += 1) {
+        if (version[index] > minimum[index])
+            return true;
+        if (version[index] < minimum[index])
+            return false;
+    }
+    return true;
+}
 export function buildClaudeArgs(input) {
     const args = [
         "--print",
@@ -28,10 +261,8 @@ export function buildClaudeArgs(input) {
     if (input.sessionId) {
         args.push(input.resume ? "--resume" : "--session-id", input.sessionId);
     }
-    if (input.projectSkillsDirectory)
-        args.push("--add-dir", input.projectSkillsDirectory);
-    if (input.agentRootDirectory)
-        args.push("--add-dir", input.agentRootDirectory);
+    for (const directory of input.additionalDirectories ?? [])
+        args.push("--add-dir", directory);
     if (input.effectivePermission === undefined) {
         if (input.dangerous)
             args.push("--dangerously-skip-permissions");