@nowcrew/daemon 0.6.88-beta.27 → 0.6.88-beta.29

package/dist/runtimes/kimi-acp-runner.js

@@ -136,10 +136,10 @@ function deepSeekPermissionMode(permission) {
         return "workspace-write";
     return "danger-full-access";
 }
-function providerEnv(provider, permission) {
+function providerEnv(provider, permission, env = process.env) {
     return provider === "deepseek-harness"
-        ? { ...process.env, DSH_PERMISSION_MODE: deepSeekPermissionMode(permission) }
-        : process.env;
+        ? { ...env, DSH_PERMISSION_MODE: deepSeekPermissionMode(permission) }
+        : env;
 }
 function providerDisplayName(provider) {
     if (provider === "deepseek-harness")
@@ -220,11 +220,12 @@ export async function probeKimiAcp(options, spawnProcess = spawn) {
         ...transport.fields(), spawn_confirmed_ms: spawnConfirmedMs, child_pid: child.pid,
         reason, protocol_version: protocolVersion, stderr_seen: stderrSeen, aborted: options.signal?.aborted ?? false });
     dslog("execution.acp_probe_started", "ACP 探测开始", { probe_id: probeId, runtime: provider, node_version: process.version });
-    const launchEnv = options.launchEnv ?? providerEnv(provider, permission);
+    const sourceEnv = options.env ?? { ...process.env, PATH: augmentedPath() };
+    const launchEnv = options.launchEnv ?? providerEnv(provider, permission, sourceEnv);
     const child = spawnProcess(options.bin, options.launchArgs ?? providerArgs(provider, options.configPath), {
         cwd: options.launchCwd ?? process.cwd(),
-        // 显式 launchEnv 也决定 PATH/HOME;不能把它与父进程 PATH 混用。
-        env: { ...launchEnv, PATH: augmentedPath(launchEnv) },
+        // 显式 launchEnv 已准备好 PATH/HOME，不能二次补 PATH 或混入父进程环境。
+        env: launchEnv,
         stdio: ["pipe", "pipe", "pipe"],
     });
     // spawn errors are emitted by ChildProcess, not its stdio streams. A missing

package/dist/runtimes/opencode.js

@@ -11,7 +11,7 @@ const REQUIRED_RUN_FLAGS = [
     "--variant",
     "--session",
 ];
-export async function probeOpenCodeRun(signal) {
+export async function probeOpenCodeRun(signal, env = { ...process.env, PATH: augmentedPath() }) {
     try {
         const { stdout, stderr } = await execFileP("opencode", ["run", "--help"], {
             shell: isWin(),
@@ -19,7 +19,7 @@ export async function probeOpenCodeRun(signal) {
             killSignal: "SIGKILL",
             maxBuffer: 1024 * 1024,
             signal,
-            env: { ...process.env, PATH: augmentedPath() },
+            env,
         });
         const help = `${stdout}\n${stderr}`;
         return REQUIRED_RUN_FLAGS.every((flag) => help.includes(flag));

package/dist/serve.js

@@ -1,7 +1,7 @@
-/**
- * 常驻模式 (M3c):连接 server 控制面 WS,注册机器,监听 agent:start 自动唤醒 agent。
- * 断线指数退避重连。一个 agent:start 进来就跑一次现有的 runAgent。
- */
+/** 常驻控制面桥接；按请求拉起本地 runtime。 */
+import { handleAgentEnvironmentFrame } from "./agent-environment-control.js";
+import { handleMachineEnvironmentFrame } from "./machine-environment-control.js";
+import { createMachineRuntimeEnvironment } from "./machine-runtime-environment.js";
 import { WebSocket } from "ws";
 import { persistPreAdmissionRejection, rejectQueuedAdmission } from "./pre-admission-rejection.js";
 import { join } from "node:path";
@@ -9,14 +9,11 @@ import { randomUUID } from "node:crypto";
 import { dslog, setSlogDefaults, drainSpool, flushSlog } from "./slog.js";
 import { mergeRunAgentResults, reportScheduledStartFailure, runAgent } from "./runner.js";
 import { buildOriginDecisionRetryPrompt, buildScheduledPrompt } from "./prompt.js";
-import { collectMachineHello, daemonCapabilities, daemonCapabilityBindings, detectExecutionRuntimesWithSignal, } from "./machine-info.js";
+import { daemonCapabilities, daemonCapabilityBindings, } from "./machine-info.js";
 import { reconcileExecutionJournal } from "./execution-recovery.js";
 import { initReleaseSlog, reportDaemonConnectionClose, reportReleaseError } from "./release-channel-guard.js";
-import { conservativeExecutionRuntimes, createRuntimeProbeCoordinator, } from "./runtime-probe.js";
-import { listWorkspace, readWorkspaceFile } from "./workspace-fs.js";
-import { listSkills } from "./skills.js";
+import { handleWorkspaceControlRequest } from "./workspace-control-handler.js";
 import { inspectRaftWorkspace, importRaftWorkspace } from "./workspace-import.js";
-import { listRuntimeModels } from "./list-models.js";
 import { normalizeScheduledContext } from "./scheduled-report.js";
 import { formatDaemonLogLine } from "./log-format.js";
 import { reportAgentRunComplete } from "./scheduled-run-report.js";
@@ -50,7 +47,7 @@ import { createProjectSkillsReconciler, } from "./project-skills/reconciler.js";
 import { initializedProjectSkillsReconciler } from "./project-skills/initialized-reconciler.js";
 import { parseMemoryPruneTraceId } from "./memory-prune-diagnostics.js";
 import { probeRuntimeHealth } from "./runtime-health.js";
-import { handleRuntimeHealthProbeFrame } from "./runtime-health-handler.js";
+import { createServeMarketplace } from "./marketplace-serve.js";
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
 import { bindStorageServerIdentity, createStorageIdentityAdmission, } from "./storage-serve-adapter.js";
@@ -79,9 +76,6 @@ export function serve(config, opts = {}) {
         ?? (config.agentMemory === null ? undefined : createAgentMemoryBridge(config.agentMemory));
     const executionTelemetry = createExecutionTelemetryJournal(config.agentsRoot);
     const executeProtocol = opts.execution?.runExecution ?? runExecution;
-    let detectedExecutionRuntimes = [], executionRuntimesKnown = false;
-    let runtimeFacts = null;
-    const runtimeProbe = createRuntimeProbeCoordinator();
     const localHome = opts.localHome ?? resolveDaemonLocalStateRootFromEnv();
     const hostCoordinator = opts.execution?.hostCoordinator
         ?? createHostExecutionCoordinator({
@@ -126,6 +120,7 @@ export function serve(config, opts = {}) {
             catch { /* reconnect/timeout reconciliation handles a lost status frame */ }
         },
     });
+    const marketplace = createServeMarketplace(config, localSlots, hostCoordinator);
     const storageIdentityAdmission = createStorageIdentityAdmission(opts.storageRuntime);
     const projectionCoordinator = createAgentProjectionCoordinator();
     const { projectRegistry, projectWorkspaceRegistry, projectDependencyProvisioner } = createProjectRegistryWiring(config.agentsRoot, opts.execution?.dependencies);
@@ -169,6 +164,16 @@ export function serve(config, opts = {}) {
         },
         onSent: (hello) => log(`📤 已上报机器信息: ${hello.hostname} · ${hello.os} · installed=[${hello.runtimes.join(",")}] · executable=[${hello.executionRuntimes.join(",")}] · agents=[${hello.agentHandles.join(",")}]`),
     });
+    const machineRuntime = createMachineRuntimeEnvironment({
+        config,
+        ...(opts.machineEnvironment === undefined ? {} : { provider: opts.machineEnvironment }),
+        ...(opts.machineInfo === undefined ? {} : { machineInfo: opts.machineInfo }),
+        ...(opts.profileName === undefined ? {} : { profileName: opts.profileName }),
+        additionalCapabilities: async () => managedDaemonCapabilities(updateEligibility),
+        publish: machineHelloPublisher.publish,
+        onError: (code, context) => dslog("execution.runtime_detection_failed", "机器环境或 runtime 探测失败", { level: "ERROR", error_code: code, ...context }),
+    });
+    machineRuntime.prewarm();
     const initializedProjectSkills = initializedProjectSkillsReconciler(() => projectSkillsController.ensureScanned(), projectSkillsReconciler);
     const configuredCapabilities = opts.machineInfo?.capabilities ?? daemonCapabilities(process.platform);
     const prepareCapabilities = async () => daemonCapabilityBindings(process.platform, [...configuredCapabilities, ...await managedDaemonCapabilities(updateEligibility)]);
@@ -285,12 +290,20 @@ export function serve(config, opts = {}) {
         if (stopped)
             return;
         const wsUrl = (opts.buildControlPlaneUrl ?? buildControlPlaneUrl)(config.serverUrl, config.machineToken, process.platform, undefined, capabilities.controlPlaneUrl);
-        ws = createWebSocket(wsUrl);
+        const connectionSocket = createWebSocket(wsUrl);
+        ws = connectionSocket;
+        const sendToConnection = (frame) => {
+            try {
+                if (!stopped && ws === connectionSocket && connectionSocket.readyState === WebSocket.OPEN)
+                    connectionSocket.send(JSON.stringify(frame));
+            }
+            catch { /* 旧连接请求由服务端超时处理。 */ }
+        };
         let connectionEpochToken;
-        ws.on("open", () => {
+        connectionSocket.on("open", () => {
             connectionEpochToken = projectSkillsController.beginConnectionEpoch();
             storageIdentityAdmission.beginIdentityBinding();
-            const openedSocket = ws;
+            const openedSocket = connectionSocket;
             const connectionId = randomUUID();
             backoff = 1000;
             connectedAt = Date.now();
@@ -299,60 +312,7 @@ export function serve(config, opts = {}) {
             // 连上了才有机会把离线期间(断连原因/退出前)落盘的日志补传上去
             void drainSpool();
             // 上报本机信息 (hostname/os/daemon 版本/已装 runtimes)
-            const { detectInstalled, detectExecutable = detectExecutionRuntimesWithSignal } = opts.machineInfo ?? {};
-            const helloPromise = (opts.machineInfo?.collect ?? collectMachineHello)(config.agentsRoot, config.executionLimits, process.platform, {
-                ...(detectInstalled ? { detectInstalled } : {}),
-                ...(opts.profileName === undefined ? {} : { profileName: opts.profileName }),
-                // First hello must not wait for third-party handshakes; optional transports arrive in the refresh.
-                detectExecutable: async (installed) => conservativeExecutionRuntimes(installed),
-                additionalCapabilities: async () => managedDaemonCapabilities(updateEligibility),
-                capabilities: capabilities.machineHello,
-            });
-            runtimeFacts = helloPromise
-                .then(async (hello) => {
-                if (hello.executionProtocol === undefined) {
-                    executionRuntimesKnown = true;
-                    dslog("runtime_probe.hello_refresh", "runtime hello 刷新决策", {
-                        connection_id: connectionId, reason: "protocol_unavailable",
-                        current_socket: ws === openedSocket, socket_open: openedSocket.readyState === WebSocket.OPEN,
-                        socket_ready_state: openedSocket.readyState, installed_runtimes: JSON.stringify(hello.runtimes),
-                        execution_runtimes: JSON.stringify(hello.executionRuntimes),
-                    });
-                    return [];
-                }
-                const detected = await runtimeProbe.detect(hello.runtimes, detectExecutable, connectionId);
-                executionRuntimesKnown = true;
-                const currentSocket = ws === openedSocket;
-                const socketOpen = openedSocket.readyState === WebSocket.OPEN;
-                const hasNewRuntime = detected.some((runtime) => !hello.executionRuntimes.includes(runtime));
-                dslog("runtime_probe.hello_refresh", "runtime hello 刷新决策", {
-                    connection_id: connectionId, current_socket: currentSocket, socket_open: socketOpen,
-                    socket_ready_state: openedSocket.readyState, installed_runtimes: JSON.stringify(hello.runtimes),
-                    initial_execution_runtimes: JSON.stringify(hello.executionRuntimes), execution_runtimes: JSON.stringify(detected),
-                    reason: !currentSocket ? "stale_connection" : !socketOpen ? "socket_not_open" : !hasNewRuntime ? "unchanged" : "publish",
-                });
-                if (currentSocket && socketOpen && hasNewRuntime) {
-                    detectedExecutionRuntimes = detected;
-                    machineHelloPublisher.publish({ ...hello, executionRuntimes: [...detected] }, openedSocket);
-                }
-                return detected;
-            })
-                .catch(() => {
-                executionRuntimesKnown = true;
-                dslog("execution.runtime_detection_failed", "runtime 探测失败", {
-                    level: "ERROR", reason: "detection_threw", connection_id: connectionId,
-                    current_socket: ws === openedSocket, socket_open: openedSocket.readyState === WebSocket.OPEN,
-                });
-                return [];
-            });
-            void helloPromise
-                .then(async (hello) => {
-                if (ws !== openedSocket || openedSocket.readyState !== WebSocket.OPEN)
-                    return;
-                detectedExecutionRuntimes = hello.executionRuntimes;
-                machineHelloPublisher.publish(hello, openedSocket);
-            })
-                .catch(() => { });
+            machineRuntime.open(openedSocket, { capabilities: capabilities.machineHello, beforePublish: Promise.resolve(), connectionId });
             opts.onOpen?.(ws);
             void sendSnapshot(`reconnect-${randomUUID()}`);
             void executionJournal.replay()
@@ -381,8 +341,8 @@ export function serve(config, opts = {}) {
                 });
             });
         });
-        ws.on("message", async (data) => {
-            if (stopped)
+        connectionSocket.on("message", async (data) => {
+            if (stopped || ws !== connectionSocket)
                 return;
             let decoded;
             try {
@@ -394,6 +354,10 @@ export function serve(config, opts = {}) {
             if (typeof decoded !== "object" || decoded === null)
                 return;
             const rawType = "type" in decoded && typeof decoded.type === "string" ? decoded.type : "";
+            if (rawType === "machine:environment:get" || rawType === "machine:environment:refresh") {
+                await handleMachineEnvironmentFrame(decoded, machineRuntime.provider, sendToConnection);
+                return;
+            }
             if (rawType === "daemon:update" || rawType === "daemon:restart") {
                 void updateController.handle(decoded).catch((error) => {
                     dslog("daemon.control_failed", "daemon 控制操作处理失败", {
@@ -665,9 +629,7 @@ export function serve(config, opts = {}) {
                     let availableRuntimes;
                     try {
                         availableRuntimes = opts.execution?.availableRuntimes?.()
-                            ?? (detectedExecutionRuntimes.includes(spec.runtime.name)
-                                ? detectedExecutionRuntimes
-                                : await (runtimeFacts ?? Promise.resolve(detectedExecutionRuntimes)));
+                            ?? await machineRuntime.availableRuntimes(spec.runtime.name);
                     }
                     catch (error) {
                         cleanupExecutionReservation("runtime_detection_failed");
@@ -684,6 +646,7 @@ export function serve(config, opts = {}) {
                     }
                     const execution = executeProtocol(config, spec, {
                         ...opts.execution?.dependencies,
+                        machineEnvironment: machineRuntime.provider,
                         capabilities: capabilities.executionRunner,
                         projectSkills: opts.execution?.dependencies?.projectSkills ?? initializedProjectSkills,
                         abilityRelease: opts.execution?.dependencies?.abilityRelease ?? agentAbilityRuntime.materializer,
@@ -829,15 +792,17 @@ export function serve(config, opts = {}) {
                 return;
             }
             if (msg.type === "runtime-health:probe") {
-                const result = await handleRuntimeHealthProbeFrame(msg, opts.runtimeHealth?.probe, executionRuntimesKnown, detectedExecutionRuntimes);
+                const result = await machineRuntime.health(msg, opts.runtimeHealth?.probe);
                 if (result !== null) {
-                    try {
-                        ws?.send(JSON.stringify({ type: "fs:result", ...result }));
-                    }
-                    catch { /* server 会超时 */ }
+                    sendToConnection({ type: "fs:result", ...result });
                 }
                 return;
             }
+            if (marketplace.handle(msg, frame => { try {
+                ws?.send(JSON.stringify(frame));
+            }
+            catch { /* server 会按请求超时处理 */ } }))
+                return;
             if (await agentAbilityRuntime.tryHandleControlMessage(msg, serverCapabilities, (frame) => ws?.send(JSON.stringify(frame))))
                 return;
             // 导入 raft agent 工作区:inspect 反填 name/description;import 复制用户内容
@@ -863,26 +828,11 @@ export function serve(config, opts = {}) {
                 }
                 return;
             }
-            // workspace 文件浏览 / skills 枚举请求 (只读、沙箱;见 workspace-fs.ts / skills.ts)
-            if (msg.type === "fs:list" || msg.type === "fs:read" || msg.type === "skills:list" || msg.type === "probe-models") {
-                const req = msg;
-                const root = join(config.agentsRoot, req.handle);
-                const reply = (r) => {
-                    try {
-                        ws?.send(JSON.stringify({ type: "fs:result", reqId: req.reqId, ...r }));
-                    }
-                    catch { /* 忽略 */ }
-                };
-                try {
-                    const data2 = req.type === "fs:list" ? await listWorkspace(root, req.path)
-                        : req.type === "fs:read" ? await readWorkspaceFile(root, req.path)
-                            : req.type === "skills:list" ? await listSkills(req.runtime)
-                                : { models: await listRuntimeModels(req.type === "probe-models" ? (req.runtime ?? "") : "") };
-                    reply({ ok: true, data: data2 });
-                }
-                catch (e) {
-                    reply({ ok: false, error: e.message });
-                }
+            if (await handleAgentEnvironmentFrame(msg, config.agentsRoot, sendToConnection))
+                return;
+            const fileResult = await handleWorkspaceControlRequest(msg, config.agentsRoot, projectWorkspaceRegistry, machineRuntime.models);
+            if (fileResult) {
+                sendToConnection(fileResult);
                 return;
             }
             if (msg.type !== "agent:start")
@@ -1090,6 +1040,7 @@ export function serve(config, opts = {}) {
                         ...(!scheduled && msg.wake?.seq !== undefined ? { wakeContextUpToSeq: msg.wake.seq } : {}),
                         ...(attemptWake ? { wake: attemptWake } : {}),
                     }, reportActivity, reportConsole, {
+                        machineEnvironment: machineRuntime.provider,
                         cancellation: controller.cancellation,
                         startupGate: runtimeStartupGate,
                         startupTimeoutMs: config.executionLimits.startupTimeoutMs,
@@ -1252,8 +1203,9 @@ export function serve(config, opts = {}) {
                 void flushSlog(); // 每轮收尾冲一次,保证 run.end 尽快可查
             }
         });
-        ws.on("close", (code) => {
-            if (stopped)
+        connectionSocket.on("close", (code) => {
+            machineRuntime.close(connectionSocket);
+            if (stopped || ws !== connectionSocket)
                 return;
             // server 能力随连接失效;下个连接的 ready 帧重新声明(防降级重连后沿用过期能力)。
             serverCapabilities = new Set();
@@ -1277,9 +1229,9 @@ export function serve(config, opts = {}) {
             }, backoff);
             backoff = Math.min(backoff * 2, maxBackoff);
         });
-        ws.on("error", () => {
+        connectionSocket.on("error", () => {
             if (!stopped)
-                ws?.close();
+                connectionSocket.close();
         });
     }
     const ready = (async () => {
@@ -1317,7 +1269,6 @@ export function serve(config, opts = {}) {
         stopPromise = (async () => {
             stopped = true;
             concurrencyTelemetry.stop();
-            runtimeProbe.stop();
             completionRetransmitter.stop();
             const deadline = createShutdownDeadline(shutdownTimeoutMs);
             if (reconnectTimer !== null) {
@@ -1326,8 +1277,10 @@ export function serve(config, opts = {}) {
             }
             const webSocketClosed = closeWebSocketWithinDeadline(ws, deadline.signal);
             const pending = [
+                machineRuntime.stop(),
                 webSocketClosed,
                 updateController.drain(),
+                marketplace.stop(),
                 executionFrameQueue,
                 ...executionRuns.values(),
                 ...[...legacyRuns.values()].map((run) => run.done),

package/dist/token.js

@@ -1,4 +1,3 @@
-/** 用机器令牌为某 agent 换取 per-launch 的 sk_agent_*。 */
 export async function mintAgentToken(serverUrl, machineToken, handle, displayName, options = {}, fetchImpl = fetch) {
     const res = await fetchImpl(`${serverUrl}/daemon/agents/token`, {
         method: "POST",

package/dist/workspace-control-handler.js

@@ -0,0 +1,27 @@
+/** 控制面文件/技能查看的按需处理，独立于执行生命周期。 */
+import { join } from "node:path";
+import { readSharedMessageFile } from "./message-file-preview.js";
+import { listWorkspace, readWorkspaceFile } from "./workspace-fs.js";
+import { listSkills } from "./skills.js";
+import { listRuntimeModels } from "./list-models.js";
+export async function handleWorkspaceControlRequest(raw, agentsRoot, registry, models = listRuntimeModels) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const request = raw;
+    if (!["fs:list", "fs:read", "fs:read-shared", "skills:list", "probe-models"].includes(request.type))
+        return null;
+    if (typeof request.reqId !== "string" || request.reqId.length > 128)
+        return null;
+    try {
+        const root = join(agentsRoot, request.handle);
+        const data = request.type === "fs:read-shared" ? await readSharedMessageFile(agentsRoot, raw, registry)
+            : request.type === "fs:list" ? await listWorkspace(root, request.path)
+                : request.type === "fs:read" ? await readWorkspaceFile(root, request.path)
+                    : request.type === "skills:list" ? await listSkills(request.runtime)
+                        : { models: await models(request.runtime ?? "") };
+        return { type: "fs:result", reqId: request.reqId, ok: true, data };
+    }
+    catch (error) {
+        return { type: "fs:result", reqId: request.reqId, ok: false, error: request.type === "probe-models" ? "runtime_model_probe_failed" : error.message };
+    }
+}

package/dist/workspace-fs.js

@@ -3,21 +3,31 @@
  *
  * 安全铁律:
  *  - 所有路径都 resolve 后必须仍落在 agent 根内 (防 `..` / 符号链接逃逸)。
- *  - 隐藏内部目录与点文件 (.crew / .git / 任何 . 开头)。
+ *  - 列表隐藏点文件；内部环境快照始终不可列出或读取，包括链接别名。
  *  - 只回文本文件,二进制拒绝;单文件大小上限,超出截断。
  *  - 仅 list / read,无写删。
  */
-import { realpath, readdir, readFile, stat } from "node:fs/promises";
-import { join, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { realpath, readdir, lstat, open, stat } from "node:fs/promises";
+import { join, relative, resolve, sep } from "node:path";
 export class FsError extends Error {
 }
 const MAX_FILE_BYTES = 256 * 1024; // 单文件查看上限 256KB
 const HIDDEN = new Set([".crew", ".git", ".slock"]);
 const isHidden = (name) => name.startsWith(".") || HIDDEN.has(name);
+/** 该命名空间包含完整机器环境，只允许本地执行 harness 使用。 */
+export const isInternalEnvironmentPath = (path) => path.split(/[\\/]/u)
+    .some((part) => part.toLowerCase().startsWith(".environment-"));
+const assertViewablePath = (path) => {
+    if (isInternalEnvironmentPath(path))
+        throw new FsError("file_not_viewable");
+};
 /** 把相对路径安全解析到 root 内的绝对路径;越界抛错。realpath 兜底符号链接逃逸。 */
 async function safeResolve(root, rel) {
+    assertViewablePath(rel);
     const rootResolved = await realpath(root);
     const target = resolve(rootResolved, rel.replace(/^\/+/, ""));
+    assertViewablePath(target);
     const withSep = rootResolved.endsWith(sep) ? rootResolved : rootResolved + sep;
     if (target !== rootResolved && !target.startsWith(withSep)) {
         throw new FsError("path escapes workspace");
@@ -33,6 +43,7 @@ async function safeResolve(root, rel) {
     if (real !== rootResolved && !real.startsWith(withSep)) {
         throw new FsError("path escapes workspace (symlink)");
     }
+    assertViewablePath(real);
     return real;
 }
 /** 列出某目录 (相对 root)。隐藏点文件/内部目录;目录在前、按名排序。 */
@@ -51,13 +62,15 @@ export async function listWorkspace(root, rel) {
     for (const name of names) {
         if (isHidden(name))
             continue;
-        const full = join(dir, name);
+        const full = await safeResolve(root, relative(rootResolved, join(dir, name))).catch(() => null);
+        if (full === null)
+            continue;
         const s = await stat(full).catch(() => null);
         if (!s)
             continue;
         if (s.isDirectory())
             entries.push({ name, type: "dir" });
-        else if (s.isFile())
+        else if (s.isFile() && s.nlink === 1)
             entries.push({ name, type: "file", size: s.size });
     }
     entries.sort((a, b) => a.type !== b.type ? (a.type === "dir" ? -1 : 1) : a.name.localeCompare(b.name));
@@ -66,15 +79,53 @@ export async function listWorkspace(root, rel) {
 /** 读取某文本文件 (相对 root)。二进制/超大拒绝或截断。 */
 export async function readWorkspaceFile(root, rel) {
     const file = await safeResolve(root, rel);
-    const s = await stat(file).catch(() => null);
-    if (!s || !s.isFile())
+    const before = await lstat(file, { bigint: true }).catch(() => null);
+    if (!before?.isFile())
         throw new FsError("not a file");
-    const buf = await readFile(file);
-    // 二进制探测:含 NUL 即视为二进制
-    const sample = buf.subarray(0, Math.min(buf.length, 8192));
-    if (sample.includes(0))
-        throw new FsError("binary file not viewable");
-    const truncated = buf.length > MAX_FILE_BYTES;
-    const content = buf.subarray(0, MAX_FILE_BYTES).toString("utf8");
-    return { path: rel.replace(/^\/+/, ""), content, truncated, size: buf.length };
+    // 真实路径不能辨认硬链接的私有来源，因此拒绝多链接文件。
+    if (before.nlink !== 1n)
+        throw new FsError("file_not_viewable");
+    // macOS 原子拒绝父目录链接；Linux 在打开后额外核对句柄的真实路径。
+    const noFollow = process.platform === "darwin" ? 0x20000000 : (constants.O_NOFOLLOW ?? 0);
+    const handle = await open(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | noFollow)
+        .catch(() => { throw new FsError("file_not_viewable"); });
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== before.dev || opened.ino !== before.ino)
+            throw new FsError("file_changed");
+        if (process.platform === "linux") {
+            const actual = await realpath(`/proc/self/fd/${handle.fd}`);
+            assertViewablePath(actual);
+            if (actual !== file)
+                throw new FsError("file_changed");
+        }
+        if (await safeResolve(root, rel) !== file)
+            throw new FsError("file_changed");
+        const buffer = Buffer.alloc(MAX_FILE_BYTES);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+            if (bytesRead === 0)
+                break;
+            length += bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        const current = await lstat(file, { bigint: true });
+        if (await safeResolve(root, rel) !== file || !current.isFile() || current.nlink !== 1n
+            || current.dev !== opened.dev || current.ino !== opened.ino || after.nlink !== 1n
+            || after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs)
+            throw new FsError("file_changed");
+        const bytes = buffer.subarray(0, length);
+        if (bytes.subarray(0, Math.min(length, 8192)).includes(0))
+            throw new FsError("binary file not viewable");
+        return { path: rel.replace(/^\/+/, ""), content: bytes.toString("utf8"), truncated: opened.size > BigInt(length), size: Number(opened.size) };
+    }
+    catch (error) {
+        if (error instanceof FsError)
+            throw error;
+        throw new FsError("file_changed");
+    }
+    finally {
+        await handle.close();
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.88-beta.27",
+  "version": "0.6.88-beta.29",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
-    "@nowcrew/cli": "0.4.14",
+    "@nowcrew/cli": "0.4.17",
     "cross-spawn": "^7.0.6",
     "semver": "7.8.5",
     "ws": "^8",