@nowcrew/daemon 0.6.88-beta.28 → 0.6.88-beta.29

package/dist/machine-windows-environment-script.js

@@ -0,0 +1,158 @@
+/** 固定可信脚本；无 profile、动态命令、注册表写入或桌面用户切换。 */
+export const WINDOWS_ENVIRONMENT_CAPTURE_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+try {
+  Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Security.Principal;
+using System.Text;
+using Microsoft.Win32;
+
+public sealed class NowWorkEnvironmentSnapshot {
+  public Dictionary<string, string> env;
+  public string[] sourceOwnedKeys;
+  public string accountSid;
+}
+
+public static class NowWorkNativeEnvironment {
+  private const int MaxBytes = 1048576;
+  private const int MaxKeys = 4096;
+  [DllImport("userenv.dll", SetLastError = true)]
+  [return: MarshalAs(UnmanagedType.Bool)]
+  private static extern bool CreateEnvironmentBlock(out IntPtr block, IntPtr token, [MarshalAs(UnmanagedType.Bool)] bool inherit);
+  [DllImport("userenv.dll", SetLastError = true)]
+  [return: MarshalAs(UnmanagedType.Bool)]
+  private static extern bool DestroyEnvironmentBlock(IntPtr block);
+
+  private static void CheckLength(long length) {
+    if (length > MaxBytes) throw new InvalidOperationException("capture_too_large");
+  }
+
+  private static void WriteRaw(BinaryWriter writer, object value) {
+    if (value == null) { writer.Write((byte)0); return; }
+    if (value is string) { writer.Write((byte)1); writer.Write((string)value); }
+    else if (value is int) { writer.Write((byte)2); writer.Write((int)value); }
+    else if (value is long) { writer.Write((byte)3); writer.Write((long)value); }
+    else if (value is byte[]) {
+      byte[] bytes = (byte[])value;
+      CheckLength(bytes.Length);
+      writer.Write((byte)4); writer.Write(bytes.Length); writer.Write(bytes);
+    } else if (value is string[]) {
+      string[] values = (string[])value;
+      writer.Write((byte)5); writer.Write(values.Length);
+      foreach (string item in values) { writer.Write(item); CheckLength(writer.BaseStream.Length); }
+    } else { throw new InvalidOperationException("capture_unavailable"); }
+    CheckLength(writer.BaseStream.Length);
+  }
+
+  private static void ReadRegistry(RegistryKey root, string path, BinaryWriter writer, HashSet<string> owned) {
+    using (RegistryKey key = root.OpenSubKey(path, false)) {
+      writer.Write(path);
+      writer.Write(key != null);
+      if (key == null) return;
+      string[] names = key.GetValueNames();
+      if (names.Length > MaxKeys) throw new InvalidOperationException("capture_too_large");
+      Array.Sort(names, StringComparer.Ordinal);
+      writer.Write(names.Length);
+      foreach (string name in names) {
+        writer.Write(name);
+        writer.Write((int)key.GetValueKind(name));
+        WriteRaw(writer, key.GetValue(name, null, RegistryValueOptions.DoNotExpandEnvironmentNames));
+        if (name.Length > 0 && name.IndexOf('=') < 0 && name.IndexOf('\0') < 0) owned.Add(name);
+        if (owned.Count > MaxKeys) throw new InvalidOperationException("capture_too_large");
+        CheckLength(writer.BaseStream.Length);
+      }
+    }
+  }
+
+  // 只在本地比较 key/type/raw-value 指纹，不输出原始值或指纹。
+  private static string Fingerprint(out string[] sourceOwnedKeys) {
+    HashSet<string> owned = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+    using (MemoryStream memory = new MemoryStream()) {
+      using (BinaryWriter writer = new BinaryWriter(memory, Encoding.UTF8, true)) {
+        ReadRegistry(Registry.LocalMachine, @"SYSTEM\CurrentControlSet\Control\Session Manager\Environment", writer, owned);
+        ReadRegistry(Registry.CurrentUser, "Environment", writer, owned);
+      }
+      sourceOwnedKeys = new string[owned.Count];
+      owned.CopyTo(sourceOwnedKeys);
+      Array.Sort(sourceOwnedKeys, StringComparer.OrdinalIgnoreCase);
+      using (SHA256 hash = SHA256.Create()) { return Convert.ToBase64String(hash.ComputeHash(memory.ToArray())); }
+    }
+  }
+
+  private static Dictionary<string, string> DecodeBlock(IntPtr block) {
+    Dictionary<string, string> values = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+    StringBuilder entry = new StringBuilder();
+    for (int offset = 0; offset < MaxBytes; offset += 2) {
+      char character = (char)Marshal.ReadInt16(block, offset);
+      if (character != '\0') { entry.Append(character); continue; }
+      if (entry.Length == 0) return values;
+      string text = entry.ToString();
+      entry.Length = 0;
+      int equals = text.IndexOf('=');
+      if (equals == 0) continue; // =C: 等驱动器工作目录条目不是普通环境变量。
+      if (equals < 1) throw new InvalidOperationException("capture_unavailable");
+      string name = text.Substring(0, equals);
+      if (values.ContainsKey(name)) throw new InvalidOperationException("capture_unavailable");
+      values.Add(name, text.Substring(equals + 1));
+      if (values.Count > MaxKeys) throw new InvalidOperationException("capture_too_large");
+    }
+    throw new InvalidOperationException("capture_too_large");
+  }
+
+  public static NowWorkEnvironmentSnapshot Capture() {
+    using (WindowsIdentity identity = WindowsIdentity.GetCurrent()) {
+      if (identity.User == null) throw new InvalidOperationException("capture_unavailable");
+      for (int attempt = 0; attempt < 4; attempt++) {
+        string[] owned;
+        string before = Fingerprint(out owned);
+        IntPtr block = IntPtr.Zero;
+        Dictionary<string, string> values;
+        try {
+          // bInherit=false：让 userenv 原生重建最新系统 + 当前账号环境，含 Path / REG_EXPAND_SZ。
+          if (!CreateEnvironmentBlock(out block, identity.Token, false)) throw new InvalidOperationException("capture_unavailable");
+          values = DecodeBlock(block);
+        } finally {
+          if (block != IntPtr.Zero && !DestroyEnvironmentBlock(block)) throw new InvalidOperationException("capture_unavailable");
+        }
+        string[] afterOwned;
+        string after = Fingerprint(out afterOwned);
+        if (before.Equals(after, StringComparison.Ordinal)) {
+          return new NowWorkEnvironmentSnapshot { env = values, sourceOwnedKeys = owned, accountSid = identity.User.Value };
+        }
+      }
+      throw new InvalidOperationException("capture_unavailable");
+    }
+  }
+}
+'@ -ErrorAction Stop | Out-Null
+  $snapshot = [NowWorkNativeEnvironment]::Capture()
+  $json = ConvertTo-Json -InputObject $snapshot -Depth 5 -Compress
+  if ([Text.Encoding]::UTF8.GetByteCount($json) -gt 1048576) { exit 12 }
+  [Console]::Write($json)
+  exit 0
+} catch {
+  # 不输出异常：它可能携带注册表值、编译器命令或用户路径。
+  if ($_.Exception.ToString().Contains('capture_too_large')) { exit 12 }
+  exit 11
+}
+`;
+export const WINDOWS_DAEMON_SID_SCRIPT = String.raw `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$identity = $null
+try {
+  $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+  $json = ConvertTo-Json -InputObject @{ accountSid = $identity.User.Value } -Compress
+  [Console]::Write($json)
+} catch { exit 11 } finally {
+  if ($null -ne $identity) { $identity.Dispose() }
+}
+`;

package/dist/message-file-preview.js

@@ -0,0 +1,239 @@
+/**
+ * 消息授权后的按需单文件读取。Server 决定消息权限、原执行设备及项目 ID；
+ * 本模块只解析本机受控根、拒绝别名与越界，并有界读取，不持久化状态。
+ */
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import { isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+import { isInternalEnvironmentPath } from "./workspace-fs.js";
+import { opaqueKey, safeKey } from "./workspace.js";
+import { AgentHandleSchema } from "./execution-protocol.js";
+const MAX_BYTES = 256 * 1024;
+const MAX_CONCURRENT_READS = 4;
+let activeReads = 0;
+export const SharedFileRequestSchema = z.object({
+    type: z.literal("fs:read-shared"),
+    reqId: z.string().min(1).max(128),
+    handle: AgentHandleSchema.refine((handle) => !handle.startsWith(".")),
+    path: z.string().min(1).max(4096),
+    fileContext: z.object({
+        taskKey: z.string().min(1).max(200),
+        projectIds: z.array(z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/)).max(100),
+        primaryProjectId: z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/).optional(),
+    }).strict().refine((value) => !value.primaryProjectId || value.projectIds.includes(value.primaryProjectId)),
+}).strict();
+export class SharedFileError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "SharedFileError";
+    }
+}
+const inside = (root, target) => {
+    const rel = relative(root, target);
+    return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+};
+const parts = (path) => path.split(/[\\/]/).filter(Boolean);
+const privatePart = (part) => part.startsWith(".")
+    || /^(?:credentials?|secrets?|tokens?)(?:[._-]|$)/i.test(part)
+    || /^(?:id_rsa|id_ed25519|id_ecdsa|id_dsa|passwd|shadow|authorized_keys|known_hosts)$/i.test(part)
+    || /\.(?:pem|key|p12|pfx|keystore)$/i.test(part);
+function validatePath(path) {
+    // path 已由 Server 从 Markdown 解码，禁止再次解释编码、协议或设备路径。
+    if (/[\x00-\x1f\x7f]/.test(path) || /%[0-9a-f]{2}/i.test(path)
+        || path.startsWith("\\\\") || path.startsWith("//") || path.startsWith("~")
+        || parts(path).some((part) => part === "..")
+        || (process.platform !== "win32" && (/^[A-Za-z]:/.test(path) || path.includes("\\")))
+        || (process.platform === "win32" && path.slice(2).includes(":"))) {
+        throw new SharedFileError("file_not_viewable");
+    }
+}
+function restrictAgentTask(agentsRoot, agentRoot, path, taskNames) {
+    if (!inside(agentsRoot, path))
+        return;
+    if (!inside(agentRoot, path)) {
+        // 旧版托管项目位于 agentsRoot/repos；仍必须经过下方登记项目根检查。
+        if (inside(join(agentsRoot, "repos"), path))
+            return;
+        throw new SharedFileError("file_scope_unavailable");
+    }
+    const local = parts(relative(agentRoot, path));
+    const identity = (value) => process.platform === "win32" ? value.toLowerCase() : value;
+    if (identity(local[0] ?? "") === "tasks" && (!local[1] || !taskNames.map(identity).includes(identity(local[1])))) {
+        throw new SharedFileError("file_scope_unavailable");
+    }
+}
+async function checkedCandidate(candidate) {
+    const rel = relative(candidate.root, candidate.path);
+    if (!inside(candidate.root, candidate.path) || parts(rel).some(privatePart) || isInternalEnvironmentPath(candidate.path)) {
+        throw new SharedFileError("file_not_viewable");
+    }
+    try {
+        const before = await lstat(candidate.root, { bigint: true });
+        if (!before.isDirectory())
+            throw new SharedFileError("file_not_viewable");
+        const root = await realpath(candidate.root);
+        if (isInternalEnvironmentPath(root))
+            throw new SharedFileError("file_not_viewable");
+        const [current, canonical] = await Promise.all([
+            lstat(candidate.root, { bigint: true }), lstat(root, { bigint: true }),
+        ]);
+        if (![current, canonical].every((entry) => entry.isDirectory() && entry.dev === before.dev && entry.ino === before.ino)) {
+            throw new SharedFileError("file_changed");
+        }
+        const path = resolve(root, rel);
+        await assertRegularPath(root, path);
+        return { root, path };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function assertRegularPath(root, target) {
+    let current = root;
+    const segments = parts(relative(root, target));
+    if (segments.length === 0)
+        throw new SharedFileError("file_not_viewable");
+    for (let index = 0; index < segments.length; index++) {
+        const segment = segments[index];
+        if (privatePart(segment))
+            throw new SharedFileError("file_not_viewable");
+        current = join(current, segment);
+        const entry = await lstat(current);
+        if (entry.isSymbolicLink())
+            throw new SharedFileError("file_not_viewable");
+        if (index < segments.length - 1 ? !entry.isDirectory() : !entry.isFile() || entry.nlink !== 1) {
+            throw new SharedFileError("file_not_viewable");
+        }
+    }
+    if (await realpath(target) !== target)
+        throw new SharedFileError("file_not_viewable");
+}
+async function resolveCandidate(agentsRoot, request, registry) {
+    const agentRoot = resolve(agentsRoot, request.handle);
+    // 根本身不能是符号链接；缺失任务文件由候选阶段归一为 file_not_found。
+    try {
+        if (!(await lstat(agentRoot)).isDirectory())
+            throw new SharedFileError("file_not_viewable");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const taskNames = [...new Set([opaqueKey(request.fileContext.taskKey), safeKey(request.fileContext.taskKey)])];
+    const taskRoots = taskNames.map((name) => join(agentRoot, "tasks", name));
+    let candidates;
+    if (isAbsolute(request.path)) {
+        const target = resolve(request.path);
+        restrictAgentTask(resolve(agentsRoot), agentRoot, target, taskNames);
+        if (inside(agentRoot, target)) {
+            candidates = [{ root: agentRoot, path: target }];
+        }
+        else {
+            const registrations = await registry.list().catch(() => []);
+            const roots = registrations.filter((project) => request.fileContext.projectIds.includes(project.projectId)
+                && isAbsolute(project.root) && resolve(project.root) !== parse(resolve(project.root)).root
+                && inside(resolve(project.root), target));
+            if (roots.length === 0)
+                throw new SharedFileError("file_scope_unavailable");
+            // 嵌套项目取最具体的已授权根；同一实际文件不构成相对路径歧义。
+            const root = roots.map((project) => resolve(project.root)).sort((a, b) => b.length - a.length)[0];
+            candidates = [{ root, path: target }];
+        }
+    }
+    else {
+        const rel = request.path.replace(/^\.\//, "");
+        if (parts(rel).some(privatePart))
+            throw new SharedFileError("file_not_viewable");
+        const target = resolve(agentRoot, rel);
+        restrictAgentTask(resolve(agentsRoot), agentRoot, target, taskNames);
+        candidates = [{ root: agentRoot, path: target }, ...taskRoots.map((root) => ({ root: agentRoot, path: resolve(root, rel) }))];
+    }
+    const resolved = (await Promise.all(candidates.map(checkedCandidate))).filter((v) => v !== null);
+    const unique = [...new Map(resolved.map((value) => [value.path, value])).values()];
+    if (unique.length === 0)
+        throw new SharedFileError("file_not_found");
+    if (unique.length !== 1)
+        throw new SharedFileError("file_path_ambiguous");
+    return unique[0];
+}
+async function readCandidate(candidate) {
+    const before = await lstat(candidate.path, { bigint: true });
+    // Darwin SDK sys/fcntl.h 的 O_NOFOLLOW_ANY 原子拒绝任何父目录符号链接。
+    // Node 尚未导出该常量；Linux 则在下方通过已打开句柄的真实路径核验。
+    // Darwin 不允许 O_NOFOLLOW_ANY 与 O_NOFOLLOW 同时使用。
+    const noFollow = process.platform === "darwin" ? 0x20000000 : (constants.O_NOFOLLOW ?? 0);
+    const handle = await open(candidate.path, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | noFollow);
+    try {
+        const opened = await handle.stat({ bigint: true });
+        // 对照打开前身份并重新检查整条路径，拒绝检查与读取之间的替换。
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== before.dev || opened.ino !== before.ino) {
+            throw new SharedFileError("file_changed");
+        }
+        await assertRegularPath(candidate.root, candidate.path);
+        if (process.platform === "linux" && await realpath(`/proc/self/fd/${handle.fd}`) !== candidate.path) {
+            throw new SharedFileError("file_changed");
+        }
+        const current = await lstat(candidate.path, { bigint: true });
+        if (current.dev !== opened.dev || current.ino !== opened.ino || !current.isFile() || current.nlink !== 1n) {
+            throw new SharedFileError("file_changed");
+        }
+        const buffer = Buffer.alloc(MAX_BYTES);
+        let length = 0;
+        while (length < buffer.length) {
+            const read = await handle.read(buffer, length, buffer.length - length, length);
+            if (read.bytesRead === 0)
+                break;
+            length += read.bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        const currentAfter = await lstat(candidate.path, { bigint: true });
+        if (after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs
+            || currentAfter.dev !== opened.dev || currentAfter.ino !== opened.ino || !currentAfter.isFile()) {
+            throw new SharedFileError("file_changed");
+        }
+        const bytes = buffer.subarray(0, length);
+        if (bytes.includes(0))
+            throw new SharedFileError("file_binary");
+        const truncated = opened.size > BigInt(length);
+        let content;
+        try {
+            content = new TextDecoder("utf-8", { fatal: true }).decode(bytes, { stream: truncated });
+        }
+        catch {
+            throw new SharedFileError("file_binary");
+        }
+        return { path: relative(candidate.root, candidate.path).split(sep).join("/"), content, size: Number(opened.size), truncated };
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readSharedMessageFile(agentsRoot, rawRequest, registry) {
+    const parsed = SharedFileRequestSchema.safeParse(rawRequest);
+    if (!parsed.success)
+        throw new SharedFileError("file_not_viewable");
+    if (process.platform !== "darwin" && process.platform !== "linux")
+        throw new SharedFileError("file_scope_unavailable");
+    validatePath(parsed.data.path);
+    if (activeReads >= MAX_CONCURRENT_READS)
+        throw new SharedFileError("file_preview_busy");
+    activeReads++;
+    try {
+        return await readCandidate(await resolveCandidate(agentsRoot, parsed.data, registry));
+    }
+    catch (error) {
+        if (error instanceof SharedFileError)
+            throw error;
+        if (error.code === "ENOENT")
+            throw new SharedFileError("file_not_found");
+        throw new SharedFileError("file_not_viewable");
+    }
+    finally {
+        activeReads--;
+    }
+}

package/dist/provider-env.js

@@ -10,6 +10,7 @@
  */
 import { join } from "node:path";
 import { DEEPSEEK_CODEX_KEY_ENV, deepSeekCodexHome, } from "./runtimes/codex-deepseek-config.js";
+import { mergeRuntimeEnvironments } from "./runtime-environment-merge.js";
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const RESERVED_ENV = new Set([
     "PATH",
@@ -56,11 +57,12 @@ const CONFLICTING_CODEX_ENV = [
     DEEPSEEK_CODEX_KEY_ENV,
 ];
 /** 返回叠加了 provider 隔离的新 env(不改入参);不支持的 runtime/provider 组合原样返回。 */
-export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverride) {
+export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverride, platform = process.platform) {
     if (runtime === "codex" && cfg.provider === "deepseek") {
         const env = { ...base };
-        for (const key of CONFLICTING_CODEX_ENV)
-            delete env[key];
+        for (const key of Object.keys(env))
+            if (CONFLICTING_CODEX_ENV.includes(platform === "win32" ? key.toUpperCase() : key))
+                delete env[key];
         env.CODEX_HOME = deepSeekHomeOverride ?? deepSeekCodexHome(homeDir);
         if (cfg.providerApiKey)
             env[DEEPSEEK_CODEX_KEY_ENV] = cfg.providerApiKey;
@@ -72,8 +74,9 @@ export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverri
     if (runtime !== "claude" || cfg.provider !== "custom")
         return base;
     const env = { ...base };
-    for (const k of CONFLICTING_ENV)
-        delete env[k];
+    for (const key of Object.keys(env))
+        if (CONFLICTING_ENV.includes(platform === "win32" ? key.toUpperCase() : key))
+            delete env[key];
     if (cfg.providerBaseUrl)
         env.ANTHROPIC_BASE_URL = cfg.providerBaseUrl;
     if (cfg.providerApiKey) {
@@ -91,20 +94,31 @@ export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverri
         env.ANTHROPIC_SMALL_FAST_MODEL = cfg.providerSmallFastModel;
         env.ANTHROPIC_DEFAULT_HAIKU_MODEL = cfg.providerSmallFastModel;
     }
-    return env;
+    return mergeRuntimeEnvironments([env], platform);
+}
+const deepSeekHarnessMachineOwnedKey = (key, platform) => {
+    const identity = platform === "win32" ? key.toUpperCase() : key;
+    return identity.startsWith("DEEPSEEK_") || identity.startsWith("NOWCREW_DEEPSEEK_HARNESS_") || identity.startsWith("DSH_");
+};
+/** 子命令切换目录后仍必须保留 provider 的鉴权/路由边界，包括被清除的键。 */
+export function providerOwnedEnvironmentKeys(runtime, cfg, candidateKeys, platform = process.platform) {
+    if (runtime === "claude" && cfg.provider === "custom")
+        return [...CONFLICTING_ENV, "CLAUDE_CONFIG_DIR"];
+    if (runtime === "codex" && cfg.provider === "deepseek")
+        return CONFLICTING_CODEX_ENV;
+    if (runtime === "deepseek-harness")
+        return candidateKeys.filter(key => deepSeekHarnessMachineOwnedKey(key, platform));
+    return [];
 }
-const deepSeekHarnessMachineOwnedKey = (key) => (key.toUpperCase().startsWith("DEEPSEEK_")
-    || key.toUpperCase().startsWith("NOWCREW_DEEPSEEK_HARNESS_")
-    || key.toUpperCase().startsWith("DSH_"));
 /** Agent env remains available to tools, but cannot replace Harness process policy or credentials. */
-export function applyDeepSeekHarnessMachineEnv(base, machineEnv) {
+export function applyDeepSeekHarnessMachineEnv(base, machineEnv, platform = process.platform) {
     const env = { ...base };
     for (const key of Object.keys(env)) {
-        if (deepSeekHarnessMachineOwnedKey(key))
+        if (deepSeekHarnessMachineOwnedKey(key, platform))
             delete env[key];
     }
     for (const [key, value] of Object.entries(machineEnv)) {
-        if (deepSeekHarnessMachineOwnedKey(key) && value !== undefined)
+        if (deepSeekHarnessMachineOwnedKey(key, platform) && value !== undefined)
             env[key] = value;
     }
     return env;

package/dist/runner.js

@@ -1,3 +1,4 @@
+import { createMachineEnvironmentProvider } from "./machine-environment-cache.js";
 /** Legacy agent orchestration around the business-neutral local executor. */
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
@@ -24,6 +25,18 @@ function runtimeName(value) {
     throw new Error(`unsupported runtime: ${value}`);
 }
 export async function runAgent(config, input, onActivity = defaultPrint, onConsole = () => { }, dependencies = {}) {
+    const owned = dependencies.machineEnvironment === undefined;
+    const machineEnvironment = dependencies.machineEnvironment
+        ?? createMachineEnvironmentProvider({ mode: config.machineEnvironmentMode ?? "off" });
+    try {
+        return await runAgentWithMachineEnvironment(config, input, onActivity, onConsole, { ...dependencies, machineEnvironment });
+    }
+    finally {
+        if (owned)
+            await machineEnvironment.stop();
+    }
+}
+async function runAgentWithMachineEnvironment(config, input, onActivity = defaultPrint, onConsole = () => { }, dependencies = {}) {
     const threadId = input.scheduled ? undefined : input.threadId;
     const taskAnchor = threadId ?? input.wakeMessageId;
     // Old servers have no typed maintenance purpose. A legacy marker can only
@@ -118,6 +131,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
         onRuntimeStarting: () => dependencies.onRuntimePhase?.("starting", runtime),
         onRuntimeRunning: () => dependencies.onRuntimePhase?.("running", runtime),
     }, {
+        ...(dependencies.machineEnvironment === undefined ? {} : { machineEnvironment: dependencies.machineEnvironment }),
         launchRuntime: dependencies.launchRuntime ?? ((request) => launchSupervisedRuntime(request, dependencies.startSupervisor, dependencies.cancellation, dependencies.platform)),
         ...(dependencies.cancellation === undefined ? {} : { cancellation: dependencies.cancellation }),
         ...(dependencies.startupGate === undefined ? {} : { startupGate: dependencies.startupGate }),

package/dist/runtime-environment-merge.js

@@ -0,0 +1,16 @@
+/** Keep layer order authoritative even when Windows keys use different casing. */
+export function mergeRuntimeEnvironments(layers, platform = process.platform) {
+    const entries = new Map();
+    for (const layer of layers) {
+        for (const [key, value] of Object.entries(layer)) {
+            if (value !== undefined)
+                entries.set(platform === "win32" ? key.toUpperCase() : key, [key, value]);
+        }
+    }
+    return Object.fromEntries(entries.values());
+}
+export function runtimeEnvironmentValue(env, key, platform = process.platform) {
+    if (platform !== "win32")
+        return env?.[key];
+    return Object.entries(env ?? {}).find(([candidate]) => candidate.toUpperCase() === key.toUpperCase())?.[1];
+}

package/dist/runtime-health.js

@@ -123,7 +123,9 @@ export async function probeRuntimeHealth(request, dependencies = {}) {
     const now = dependencies.now ?? (() => new Date());
     const monotonicNow = dependencies.monotonicNow ?? (() => performance.now());
     const sourceEnv = dependencies.env ?? process.env;
-    const env = { ...sourceEnv, PATH: augmentedPath(sourceEnv) };
+    const env = dependencies.env === undefined
+        ? { ...sourceEnv, PATH: augmentedPath(sourceEnv) }
+        : { ...sourceEnv };
     const availableRuntimes = dependencies.availableRuntimes ?? parsed.availableRuntimes;
     const results = [];
     for (const target of parsed.runtimes) {

package/dist/runtime-path.js

@@ -8,24 +8,27 @@
  */
 import { existsSync } from "node:fs";
 import { win32, posix } from "node:path";
+import { runtimeEnvironmentValue } from "./runtime-environment-merge.js";
 const pathApi = (platform) => (platform === "win32" ? win32 : posix);
 /** 该平台常见 CLI 安装目录候选(是否真实存在稍后由 augmentedPath 校验)。 */
 export function commonBinDirs(env = process.env, platform = process.platform) {
     const p = pathApi(platform);
+    const value = (key) => runtimeEnvironmentValue(env, key, platform);
     if (platform === "win32") {
         const dirs = [];
-        if (env.USERPROFILE) {
-            dirs.push(p.join(env.USERPROFILE, ".kimi-code", "bin"), // Kimi 官方安装器默认落点
-            p.join(env.USERPROFILE, ".local", "bin"));
+        const userProfile = value("USERPROFILE"), appData = value("APPDATA"), localAppData = value("LOCALAPPDATA");
+        if (userProfile) {
+            dirs.push(p.join(userProfile, ".kimi-code", "bin"), // Kimi 官方安装器默认落点
+            p.join(userProfile, ".local", "bin"));
         }
-        if (env.APPDATA)
-            dirs.push(p.join(env.APPDATA, "npm"));
-        if (env.LOCALAPPDATA)
-            dirs.push(p.join(env.LOCALAPPDATA, "Microsoft", "WindowsApps"));
+        if (appData)
+            dirs.push(p.join(appData, "npm"));
+        if (localAppData)
+            dirs.push(p.join(localAppData, "Microsoft", "WindowsApps"));
         return dirs;
     }
     const dirs = [];
-    const home = env.HOME;
+    const home = value("HOME");
     if (home) {
         dirs.push(p.join(home, ".kimi-code", "bin"), // Kimi 官方安装器默认落点
         p.join(home, ".local", "bin"), // Claude 官方原生安装器默认落点
@@ -41,19 +44,26 @@ export function commonBinDirs(env = process.env, platform = process.platform) {
  * 在 `env.PATH` 基础上,把候选目录里「真实存在且尚未在 PATH 中」的去重后 prepend,返回新的 PATH 字符串。
  * 用户装的目录优先命中(prepend);全部已存在或都不在磁盘上时,原样返回 `env.PATH`。
  */
-export function augmentedPath(env = process.env, deps = {}, platform = process.platform) {
+export function augmentedPath(env = process.env, deps = {}, platform = process.platform, placement = "prepend") {
     const dirExists = deps.dirExists ?? existsSync;
     const sep = pathApi(platform).delimiter;
-    const current = env.PATH ?? "";
-    const existing = new Set(current.split(sep).filter((entry) => entry.length > 0));
+    const current = runtimeEnvironmentValue(env, "PATH", platform) ?? "";
+    const keyOf = (entry) => platform === "win32" ? entry.replace(/\//gu, "\\").toLowerCase() : entry;
+    const currentEntries = current.split(sep).filter((entry) => entry.length > 0);
+    const existing = new Set(currentEntries.map(keyOf));
     const extra = [];
     for (const dir of commonBinDirs(env, platform)) {
-        if (existing.has(dir) || extra.includes(dir))
+        if (existing.has(keyOf(dir)) || extra.some(entry => keyOf(entry) === keyOf(dir)))
             continue;
         if (!dirExists(dir))
             continue;
         extra.push(dir);
     }
+    if (placement === "append") {
+        const seen = new Set();
+        return [...currentEntries, ...extra].filter(entry => { const key = keyOf(entry); if (seen.has(key))
+            return false; seen.add(key); return true; }).join(sep);
+    }
     if (extra.length === 0)
         return current;
     return current.length > 0 ? `${extra.join(sep)}${sep}${current}` : extra.join(sep);

package/dist/runtime-probe.js

@@ -9,8 +9,8 @@ export function createRuntimeProbeCoordinator() {
     const abort = new AbortController();
     const flights = new Map();
     return {
-        detect(installed, detector, connectionId) {
-            const key = [...installed].sort().join("\0");
+        detect(installed, detector, connectionId, environmentGeneration = "") {
+            const key = JSON.stringify([environmentGeneration, [...installed].sort()]);
             const existing = flights.get(key);
             const probeId = existing?.probeId ?? randomUUID();
             const fields = { probe_id: probeId, connection_id: connectionId, installed_runtimes: JSON.stringify(installed) };