@nowcrew/daemon 0.6.88-beta.3 → 0.6.88-beta.30

package/dist/marketplace-runner.js

@@ -0,0 +1,234 @@
+/** 固定市场操作的短命 CLI 适配；原始命令输出不离开设备。 */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createHash } from "node:crypto";
+import { readFile, readdir, realpath, lstat, mkdtemp, rm } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { join, resolve, isAbsolute, relative, sep } from "node:path";
+import { applyProviderEnv } from "./provider-env.js";
+import { augmentedPath } from "./runtime-path.js";
+import { MARKETPLACE, PLUGIN } from "./marketplace-protocol.js";
+const exec = promisify(execFile);
+const SELECTOR = `${PLUGIN}@${MARKETPLACE}`;
+const SOURCE = "git@codeup.aliyun.com:6128d2e757e7cd986dfae5ab/pm/AIinterview-agent-skill.git";
+const SOURCE_PATH = "plugins/AIinterview-plugin";
+export class MarketplaceFailure extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+export const runMarketplaceCommand = async (bin, args, options) => {
+    try {
+        const result = await exec(bin, [...args], { ...options, timeout: 120_000, maxBuffer: 4 * 1024 * 1024,
+            killSignal: "SIGKILL", encoding: "utf8" });
+        return result.stdout;
+    }
+    catch (error) {
+        const value = error;
+        throw new MarketplaceFailure(value.code === "ENOENT" ? "cli_missing" : value.killed ? "command_timeout" : "command_failed");
+    }
+};
+const obj = (x) => x !== null && typeof x === "object" && !Array.isArray(x) ? x : {};
+const parse = (text) => { try {
+    return JSON.parse(text);
+}
+catch {
+    throw new MarketplaceFailure("invalid_inventory");
+} };
+const version = (x) => typeof x === "string" && /^[A-Za-z0-9][A-Za-z0-9._+-]{0,79}$/.test(x) ? x : null;
+const sha = (x) => typeof x === "string" && /^[a-f0-9]{40}$/.test(x) ? x : null;
+const within = (root, candidate) => {
+    const child = relative(root, candidate);
+    return child === "" || (child !== ".." && !child.startsWith(`..${sep}`) && !isAbsolute(child));
+};
+const canonical = async (path) => realpath(path).catch(() => resolve(path));
+export async function resolveMarketplaceScopes(targets, agentsRoot, inherited = process.env) {
+    const scopes = new Map();
+    const trustedHome = await canonical(inherited.HOME ?? homedir());
+    for (const target of targets) {
+        const home = target.handle ? join(agentsRoot, target.handle, ".home") : homedir();
+        const agentHome = target.handle ? await canonical(home) : null;
+        const allowedHomeRoots = [trustedHome, ...(agentHome === null ? [] : [agentHome])];
+        const sharedConfigRoot = join(trustedHome, target.runtime === "codex" ? ".codex" : ".claude");
+        const agentConfigRoot = agentHome === null ? null : join(agentHome, target.runtime === "codex" ? ".codex" : ".claude");
+        const allowedConfigRoots = [sharedConfigRoot, ...(agentConfigRoot === null ? [] : [agentConfigRoot])];
+        const suppliedHome = target.paths.HOME;
+        if (suppliedHome !== undefined && !within(allowedHomeRoots[0], await canonical(suppliedHome))
+            && (agentHome === null || !within(agentHome, await canonical(suppliedHome))))
+            throw new MarketplaceFailure("scope_unavailable");
+        const suppliedConfig = target.runtime === "codex" ? target.paths.CODEX_HOME : target.paths.CLAUDE_CONFIG_DIR;
+        const suppliedConfigPath = suppliedConfig === undefined ? null : await canonical(suppliedConfig);
+        if (suppliedConfigPath !== null && !allowedConfigRoots.some(root => within(root, suppliedConfigPath)))
+            throw new MarketplaceFailure("scope_unavailable");
+        // 与 local-executor 使用同一 provider 解析；凭据存在性只用于选择已配置的 provider，不传递凭据内容。
+        const env = applyProviderEnv({ ...inherited, ...target.paths }, target.runtime, target.handle ? {
+            provider: target.provider, providerApiKey: target.hasProviderKey ? "configured" : null,
+        } : {}, home);
+        for (const key of Object.keys(env))
+            if (/^(CREW_|ANTHROPIC_|OPENAI_|DEEPSEEK_)/.test(key))
+                delete env[key];
+        for (const key of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR"])
+            delete env[key];
+        env.PATH = augmentedPath(inherited);
+        env.GIT_TERMINAL_PROMPT = "0";
+        env.CI = "1";
+        const raw = target.runtime === "codex" ? env.CODEX_HOME ?? join(env.HOME ?? homedir(), ".codex")
+            : env.CLAUDE_CONFIG_DIR ?? join(env.HOME ?? homedir(), ".claude");
+        if (!isAbsolute(raw))
+            throw new MarketplaceFailure("scope_unavailable");
+        const configHome = await realpath(raw).catch(() => resolve(raw));
+        if (!allowedConfigRoots.some(root => within(root, configHome)))
+            throw new MarketplaceFailure("scope_unavailable");
+        if (target.runtime === "codex")
+            env.CODEX_HOME = configHome;
+        else
+            env.CLAUDE_CONFIG_DIR = configHome;
+        const key = `${target.runtime}:${configHome}`;
+        const prior = scopes.get(key);
+        if (prior) {
+            if (target.handle && !prior.agents.includes(target.handle))
+                prior.agents.push(target.handle);
+            prior.shared ||= !target.handle;
+        }
+        else
+            scopes.set(key, { runtime: target.runtime, configHome, env, agents: target.handle ? [target.handle] : [], shared: !target.handle });
+    }
+    return [...scopes.values()];
+}
+export function parsePluginInventory(runtime, value, configHome) {
+    const rows = Array.isArray(value) ? value : obj(value).installed;
+    if (!Array.isArray(rows))
+        throw new MarketplaceFailure("invalid_inventory");
+    const found = rows.map(obj).filter(x => (x.id ?? x.pluginId) === SELECTOR);
+    if (found.length === 0)
+        return null;
+    if (found.length !== 1)
+        throw new MarketplaceFailure("unsupported_installation");
+    const item = found[0];
+    const v = version(item.version);
+    if (!v || typeof item.enabled !== "boolean")
+        throw new MarketplaceFailure("invalid_inventory");
+    if (runtime === "claude" && item.scope !== "user")
+        throw new MarketplaceFailure("unsupported_installation");
+    const path = runtime === "claude" ? item.installPath : join(configHome, "plugins/cache", MARKETPLACE, PLUGIN, v);
+    if (typeof path !== "string" || !isAbsolute(path))
+        throw new MarketplaceFailure("invalid_inventory");
+    return { version: v, enabled: item.enabled, path, revision: sha(obj(item.source).sha) };
+}
+/** 逐字节比对固定 Git 源子目录，不能只凭 CLI 退出码或版本字符串证明安装完成。 */
+export async function verifyInstalledContent(path, revision, env, command) {
+    const temporary = await mkdtemp(join(tmpdir(), "nowwork-plugin-verify-"));
+    const options = { env, cwd: temporary };
+    try {
+        await command("git", ["init", "--bare", "."], options);
+        await command("git", ["fetch", "--depth=1", SOURCE, revision], options);
+        const tree = await command("git", ["ls-tree", "-rz", `${revision}:${SOURCE_PATH}`], options);
+        const expected = new Map();
+        for (const entry of tree.split("\0").filter(Boolean)) {
+            const match = /^(100644|100755) blob ([a-f0-9]{40})\t(.+)$/.exec(entry);
+            if (!match || match[3].split("/").some(x => x === ".." || x === "."))
+                throw new MarketplaceFailure("verification_failed");
+            expected.set(match[3], match[2]);
+        }
+        if (!expected.size || expected.size > 2000)
+            throw new MarketplaceFailure("verification_failed");
+        const actual = new Map();
+        let bytes = 0;
+        const walk = async (dir, prefix = "") => {
+            for (const name of await readdir(dir)) {
+                if (name === "__pycache__" || name === ".DS_Store")
+                    continue;
+                const entry = join(dir, name);
+                const key = prefix + name;
+                const info = await lstat(entry);
+                if (info.isSymbolicLink())
+                    throw new MarketplaceFailure("verification_failed");
+                if (info.isDirectory())
+                    await walk(entry, key + "/");
+                else if (info.isFile()) {
+                    bytes += info.size;
+                    if (bytes > 100 * 1024 * 1024 || actual.size > 2000)
+                        throw new MarketplaceFailure("verification_failed");
+                    const data = await readFile(entry);
+                    actual.set(key, createHash("sha1").update(`blob ${data.length}\0`).update(data).digest("hex"));
+                }
+                else
+                    throw new MarketplaceFailure("verification_failed");
+            }
+        };
+        await walk(path);
+        if (actual.size !== expected.size || [...expected].some(([name, hash]) => actual.get(name) !== hash))
+            throw new MarketplaceFailure("verification_failed");
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}
+export async function runMarketplaceScope(scope, mode, command = runMarketplaceCommand, verify = verifyInstalledContent) {
+    let result = { runtime: scope.runtime, scopeId: createHash("sha256").update(`${scope.runtime}:${scope.configHome}`).digest("hex").slice(0, 16),
+        agents: scope.agents, shared: scope.shared, status: "failed", beforeVersion: null, afterVersion: null, targetVersion: null,
+        marketRevision: null, installedRevision: null, enabled: null, activation: "unverified", errorCode: null };
+    const options = { env: scope.env, cwd: scope.configHome };
+    const run = (args) => command(scope.runtime, args, options);
+    const inventory = async () => parsePluginInventory(scope.runtime, parse(await run(["plugin", "list", "--json"])), scope.configHome);
+    try {
+        if (!(await lstat(scope.configHome)).isDirectory())
+            throw new MarketplaceFailure("scope_unavailable");
+        const markets = parse(await run(["plugin", "marketplace", "list", "--json"]));
+        const rows = Array.isArray(markets) ? markets : obj(markets).marketplaces;
+        if (!Array.isArray(rows))
+            throw new MarketplaceFailure("invalid_inventory");
+        const market = rows.map(obj).filter(x => x.name === MARKETPLACE);
+        if (market.length !== 1)
+            throw new MarketplaceFailure("market_not_registered");
+        const root = market[0].root ?? market[0].installLocation;
+        if (typeof root !== "string" || !isAbsolute(root))
+            throw new MarketplaceFailure("invalid_inventory");
+        const before = await inventory();
+        result = { ...result, beforeVersion: before?.version ?? null, afterVersion: before?.version ?? null, enabled: before?.enabled ?? null };
+        if (mode !== "inspect")
+            await run(["plugin", "marketplace", scope.runtime === "claude" ? "update" : "upgrade", MARKETPLACE]);
+        const revision = sha((await command("git", ["-C", root, "rev-parse", "HEAD"], options)).trim());
+        if (!revision)
+            throw new MarketplaceFailure("verification_failed");
+        const manifest = obj(parse(await readFile(join(root, scope.runtime === "claude" ? ".claude-plugin" : ".agents/plugins", "marketplace.json"), "utf8")));
+        const plugins = manifest.plugins;
+        const target = Array.isArray(plugins) ? plugins.map(obj).find(x => x.name === PLUGIN) : undefined;
+        const source = obj(target?.source);
+        const targetVersion = version(target?.version);
+        const targetSha = sha(source.sha);
+        result = { ...result, marketRevision: revision, targetVersion };
+        if (mode === "refresh")
+            return { ...result, status: "refreshed", activation: "not_changed" };
+        if (!before)
+            return { ...result, status: "not_installed", activation: "not_changed" };
+        if (mode === "inspect") {
+            const installed = obj(parse(await readFile(join(before.path, scope.runtime === "claude" ? ".claude-plugin" : ".codex-plugin", "plugin.json"), "utf8")));
+            const actualVersion = version(installed.version);
+            result = { ...result, afterVersion: actualVersion };
+            if (installed.name !== PLUGIN || actualVersion !== before.version)
+                throw new MarketplaceFailure("verification_failed");
+            // 清单可能来自市场元数据；没有文件内容核验就不报告已安装源提交。
+            return { ...result, status: "checked", installedRevision: null, activation: "unverified" };
+        }
+        if (!targetVersion || !targetSha || source.url !== SOURCE || source.path !== SOURCE_PATH || source.source !== "git-subdir")
+            throw new MarketplaceFailure("unsupported_installation");
+        // Codex add 会启用插件；不偷偷改变用户已禁用的状态。
+        if (!before.enabled)
+            throw new MarketplaceFailure("unsupported_installation");
+        await run(scope.runtime === "claude" ? ["plugin", "update", SELECTOR, "--scope", "user", "--json"] : ["plugin", "add", SELECTOR, "--json"]);
+        const after = await inventory();
+        result = { ...result, afterVersion: after?.version ?? null, enabled: after?.enabled ?? null };
+        if (!after || after.version !== targetVersion || after.enabled !== before.enabled)
+            throw new MarketplaceFailure("verification_failed");
+        await verify(after.path, targetSha, scope.env, command);
+        return { ...result, status: before.version === after.version && before.revision === targetSha ? "unchanged" : "updated",
+            installedRevision: targetSha, activation: "reload_required" };
+    }
+    catch (error) {
+        const code = error instanceof MarketplaceFailure ? error.code : "scope_unavailable";
+        return { ...result, status: code === "cli_missing" ? "missing_cli" : "failed", errorCode: code };
+    }
+}

package/dist/marketplace-serve.js

@@ -0,0 +1,17 @@
+import { createMarketplaceController } from "./marketplace-controller.js";
+import { prepareDaemonRestart } from "./daemon-updater.js";
+export function createServeMarketplace(config, localSlots, hostCoordinator) {
+    const controller = createMarketplaceController({ agentsRoot: config.agentsRoot,
+        acquire: async () => { const result = await prepareDaemonRestart({ localSlots, hostCoordinator }); return result.ok ? result : null; } });
+    return {
+        handle(raw, send) {
+            if (!raw || typeof raw !== "object" || !("type" in raw) || raw.type !== "marketplace:operation")
+                return false;
+            const { reqId, ...request } = raw;
+            if (typeof reqId === "string")
+                send({ type: "fs:result", reqId, ...controller.handle(request) });
+            return true;
+        },
+        stop: controller.stop,
+    };
+}

package/dist/message-file-preview.js

@@ -0,0 +1,246 @@
+/**
+ * 消息授权后的按需单文件读取。Server 决定消息权限、原执行设备及项目 ID；
+ * 本模块只解析本机受控根、拒绝别名与越界，并有界读取，不持久化状态。
+ */
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import { isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+import { isInternalEnvironmentPath } from "./workspace-fs.js";
+import { opaqueKey, safeKey } from "./workspace.js";
+import { AgentHandleSchema } from "./execution-protocol.js";
+const MAX_BYTES = 256 * 1024;
+const MAX_BINARY_BYTES = 8 * 1024 * 1024;
+const MAX_CONCURRENT_READS = 4;
+let activeReads = 0;
+export const SharedFileRequestSchema = z.object({
+    type: z.literal("fs:read-shared"),
+    reqId: z.string().min(1).max(128),
+    handle: AgentHandleSchema.refine((handle) => !handle.startsWith(".")),
+    path: z.string().min(1).max(4096),
+    fileContext: z.object({
+        taskKey: z.string().min(1).max(200),
+        projectIds: z.array(z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/)).max(100),
+        primaryProjectId: z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/).optional(),
+    }).strict().refine((value) => !value.primaryProjectId || value.projectIds.includes(value.primaryProjectId)),
+}).strict();
+export class SharedFileError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "SharedFileError";
+    }
+}
+const inside = (root, target) => {
+    const rel = relative(root, target);
+    return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+};
+const parts = (path) => path.split(/[\\/]/).filter(Boolean);
+const privatePart = (part) => part.startsWith(".")
+    || /^(?:credentials?|secrets?|tokens?)(?:[._-]|$)/i.test(part)
+    || /^(?:id_rsa|id_ed25519|id_ecdsa|id_dsa|passwd|shadow|authorized_keys|known_hosts)$/i.test(part)
+    || /\.(?:pem|key|p12|pfx|keystore)$/i.test(part);
+function validatePath(path) {
+    // path 已由 Server 从 Markdown 解码，禁止再次解释编码、协议或设备路径。
+    if (/[\x00-\x1f\x7f]/.test(path) || /%[0-9a-f]{2}/i.test(path)
+        || path.startsWith("\\\\") || path.startsWith("//") || path.startsWith("~")
+        || parts(path).some((part) => part === "..")
+        || (process.platform !== "win32" && (/^[A-Za-z]:/.test(path) || path.includes("\\")))
+        || (process.platform === "win32" && path.slice(2).includes(":"))) {
+        throw new SharedFileError("file_not_viewable");
+    }
+}
+function restrictAgentTask(agentsRoot, agentRoot, path, taskNames) {
+    if (!inside(agentsRoot, path))
+        return;
+    if (!inside(agentRoot, path)) {
+        // 旧版托管项目位于 agentsRoot/repos；仍必须经过下方登记项目根检查。
+        if (inside(join(agentsRoot, "repos"), path))
+            return;
+        throw new SharedFileError("file_scope_unavailable");
+    }
+    const local = parts(relative(agentRoot, path));
+    const identity = (value) => process.platform === "win32" ? value.toLowerCase() : value;
+    if (identity(local[0] ?? "") === "tasks" && (!local[1] || !taskNames.map(identity).includes(identity(local[1])))) {
+        throw new SharedFileError("file_scope_unavailable");
+    }
+}
+async function checkedCandidate(candidate) {
+    const rel = relative(candidate.root, candidate.path);
+    if (!inside(candidate.root, candidate.path) || parts(rel).some(privatePart) || isInternalEnvironmentPath(candidate.path)) {
+        throw new SharedFileError("file_not_viewable");
+    }
+    try {
+        const before = await lstat(candidate.root, { bigint: true });
+        if (!before.isDirectory())
+            throw new SharedFileError("file_not_viewable");
+        const root = await realpath(candidate.root);
+        if (isInternalEnvironmentPath(root))
+            throw new SharedFileError("file_not_viewable");
+        const [current, canonical] = await Promise.all([
+            lstat(candidate.root, { bigint: true }), lstat(root, { bigint: true }),
+        ]);
+        if (![current, canonical].every((entry) => entry.isDirectory() && entry.dev === before.dev && entry.ino === before.ino)) {
+            throw new SharedFileError("file_changed");
+        }
+        const path = resolve(root, rel);
+        await assertRegularPath(root, path);
+        return { root, path };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function assertRegularPath(root, target) {
+    let current = root;
+    const segments = parts(relative(root, target));
+    if (segments.length === 0)
+        throw new SharedFileError("file_not_viewable");
+    for (let index = 0; index < segments.length; index++) {
+        const segment = segments[index];
+        if (privatePart(segment))
+            throw new SharedFileError("file_not_viewable");
+        current = join(current, segment);
+        const entry = await lstat(current);
+        if (entry.isSymbolicLink())
+            throw new SharedFileError("file_not_viewable");
+        if (index < segments.length - 1 ? !entry.isDirectory() : !entry.isFile() || entry.nlink !== 1) {
+            throw new SharedFileError("file_not_viewable");
+        }
+    }
+    if (await realpath(target) !== target)
+        throw new SharedFileError("file_not_viewable");
+}
+async function resolveCandidate(agentsRoot, request, registry) {
+    const agentRoot = resolve(agentsRoot, request.handle);
+    // 根本身不能是符号链接；缺失任务文件由候选阶段归一为 file_not_found。
+    try {
+        if (!(await lstat(agentRoot)).isDirectory())
+            throw new SharedFileError("file_not_viewable");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const taskNames = [...new Set([opaqueKey(request.fileContext.taskKey), safeKey(request.fileContext.taskKey)])];
+    const taskRoots = taskNames.map((name) => join(agentRoot, "tasks", name));
+    let candidates;
+    if (isAbsolute(request.path)) {
+        const target = resolve(request.path);
+        restrictAgentTask(resolve(agentsRoot), agentRoot, target, taskNames);
+        if (inside(agentRoot, target)) {
+            candidates = [{ root: agentRoot, path: target }];
+        }
+        else {
+            const registrations = await registry.list().catch(() => []);
+            const roots = registrations.filter((project) => request.fileContext.projectIds.includes(project.projectId)
+                && isAbsolute(project.root) && resolve(project.root) !== parse(resolve(project.root)).root
+                && inside(resolve(project.root), target));
+            if (roots.length === 0)
+                throw new SharedFileError("file_scope_unavailable");
+            // 嵌套项目取最具体的已授权根；同一实际文件不构成相对路径歧义。
+            const root = roots.map((project) => resolve(project.root)).sort((a, b) => b.length - a.length)[0];
+            candidates = [{ root, path: target }];
+        }
+    }
+    else {
+        const rel = request.path.replace(/^\.\//, "");
+        if (parts(rel).some(privatePart))
+            throw new SharedFileError("file_not_viewable");
+        const target = resolve(agentRoot, rel);
+        restrictAgentTask(resolve(agentsRoot), agentRoot, target, taskNames);
+        candidates = [{ root: agentRoot, path: target }, ...taskRoots.map((root) => ({ root: agentRoot, path: resolve(root, rel) }))];
+    }
+    const resolved = (await Promise.all(candidates.map(checkedCandidate))).filter((v) => v !== null);
+    const unique = [...new Map(resolved.map((value) => [value.path, value])).values()];
+    if (unique.length === 0)
+        throw new SharedFileError("file_not_found");
+    if (unique.length !== 1)
+        throw new SharedFileError("file_path_ambiguous");
+    return unique[0];
+}
+async function readCandidate(candidate) {
+    const before = await lstat(candidate.path, { bigint: true });
+    // Darwin SDK sys/fcntl.h 的 O_NOFOLLOW_ANY 原子拒绝任何父目录符号链接。
+    // Node 尚未导出该常量；Linux 则在下方通过已打开句柄的真实路径核验。
+    // Darwin 不允许 O_NOFOLLOW_ANY 与 O_NOFOLLOW 同时使用。
+    const noFollow = process.platform === "darwin" ? 0x20000000 : (constants.O_NOFOLLOW ?? 0);
+    const handle = await open(candidate.path, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | noFollow);
+    try {
+        const opened = await handle.stat({ bigint: true });
+        // 对照打开前身份并重新检查整条路径，拒绝检查与读取之间的替换。
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== before.dev || opened.ino !== before.ino) {
+            throw new SharedFileError("file_changed");
+        }
+        await assertRegularPath(candidate.root, candidate.path);
+        if (process.platform === "linux" && await realpath(`/proc/self/fd/${handle.fd}`) !== candidate.path) {
+            throw new SharedFileError("file_changed");
+        }
+        const current = await lstat(candidate.path, { bigint: true });
+        if (current.dev !== opened.dev || current.ino !== opened.ino || !current.isFile() || current.nlink !== 1n) {
+            throw new SharedFileError("file_changed");
+        }
+        const knownBinary = /\.(?:xlsx|xls|pdf|png|jpe?g|gif|webp|zip|docx|pptx)$/iu.test(candidate.path);
+        if (knownBinary && opened.size > BigInt(MAX_BINARY_BYTES))
+            throw new SharedFileError("file_too_large");
+        const buffer = Buffer.alloc(knownBinary ? Number(opened.size) : MAX_BYTES);
+        let length = 0;
+        while (length < buffer.length) {
+            const read = await handle.read(buffer, length, buffer.length - length, length);
+            if (read.bytesRead === 0)
+                break;
+            length += read.bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        const currentAfter = await lstat(candidate.path, { bigint: true });
+        if (after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs
+            || currentAfter.dev !== opened.dev || currentAfter.ino !== opened.ino || !currentAfter.isFile()) {
+            throw new SharedFileError("file_changed");
+        }
+        const bytes = buffer.subarray(0, length);
+        const truncated = opened.size > BigInt(length);
+        if (bytes.includes(0) || knownBinary) {
+            if (truncated)
+                throw new SharedFileError("file_too_large");
+            return { path: relative(candidate.root, candidate.path).split(sep).join("/"), content: bytes.toString("base64"), encoding: "base64", size: Number(opened.size), truncated };
+        }
+        let content;
+        try {
+            content = new TextDecoder("utf-8", { fatal: true }).decode(bytes, { stream: truncated });
+        }
+        catch {
+            throw new SharedFileError("file_binary");
+        }
+        return { path: relative(candidate.root, candidate.path).split(sep).join("/"), content, size: Number(opened.size), truncated };
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readSharedMessageFile(agentsRoot, rawRequest, registry) {
+    const parsed = SharedFileRequestSchema.safeParse(rawRequest);
+    if (!parsed.success)
+        throw new SharedFileError("file_not_viewable");
+    if (process.platform !== "darwin" && process.platform !== "linux")
+        throw new SharedFileError("file_scope_unavailable");
+    validatePath(parsed.data.path);
+    if (activeReads >= MAX_CONCURRENT_READS)
+        throw new SharedFileError("file_preview_busy");
+    activeReads++;
+    try {
+        return await readCandidate(await resolveCandidate(agentsRoot, parsed.data, registry));
+    }
+    catch (error) {
+        if (error instanceof SharedFileError)
+            throw error;
+        if (error.code === "ENOENT")
+            throw new SharedFileError("file_not_found");
+        throw new SharedFileError("file_not_viewable");
+    }
+    finally {
+        activeReads--;
+    }
+}

package/dist/native-thread-context.js

@@ -0,0 +1,59 @@
+import { readFile, writeFile, rm } from "node:fs/promises";
+export function isolateMaintenanceSession(input) {
+    if (input.maintenancePurpose === undefined)
+        return input;
+    const { resumeKey: _ignored, ...rest } = input;
+    return { ...rest, session: { ...input.session, enabled: false } };
+}
+/** A per-execution runtime handoff, not a transcript or daemon business store. */
+export class NativeThreadContext {
+    path;
+    threadRoot;
+    runtime;
+    requestedSessionId;
+    prior;
+    confirmed = false;
+    constructor(path, threadRoot, runtime, requestedSessionId, prior) {
+        this.path = path;
+        this.threadRoot = threadRoot;
+        this.runtime = runtime;
+        this.requestedSessionId = requestedSessionId;
+        this.prior = prior;
+    }
+    snapshot() {
+        const reusable = this.requestedSessionId !== null && this.prior?.sessionId === this.requestedSessionId
+            && this.prior?.threadRoot === this.threadRoot && this.prior?.runtime === this.runtime;
+        return { schemaVersion: 1, threadRoot: this.threadRoot, resumeConfirmed: this.confirmed,
+            historyComplete: false, readSeq: 0,
+            resumeCandidate: reusable ? { sessionId: this.requestedSessionId,
+                historyComplete: this.prior?.threadHistoryComplete === true, readSeq: this.prior?.threadContextSeq ?? 0 } : null };
+    }
+    async initialize() { await writeFile(this.path, JSON.stringify(this.snapshot()), { mode: 0o600 }); }
+    observe(raw) {
+        if (this.confirmed || !this.requestedSessionId || !raw || typeof raw !== "object")
+            return;
+        const event = raw;
+        const confirmed = (this.runtime === "claude" || this.runtime === "codex")
+            && event.type === "nowwork.native_resume" && event.session_id === this.requestedSessionId
+            && (event.runtime === undefined || event.runtime === this.runtime);
+        if (!confirmed)
+            return;
+        this.confirmed = true;
+        // Telemetry only. The native adapter verifies its handshake directly and
+        // commits accepted input itself. Writing here could race that commit and
+        // reset the delivered cursor when parent stdout consumption is delayed.
+    }
+    async checkpoint() {
+        try {
+            const state = JSON.parse(await readFile(this.path, "utf8"));
+            if (state.schemaVersion !== 1 || state.threadRoot !== this.threadRoot
+                || !Number.isSafeInteger(state.readSeq) || state.readSeq < 0)
+                return null;
+            return { threadContextSeq: state.readSeq, threadHistoryComplete: state.historyComplete === true };
+        }
+        catch {
+            return null;
+        }
+    }
+    async cleanup() { await rm(this.path, { force: true }); }
+}

package/dist/pre-admission-rejection.js

@@ -0,0 +1,64 @@
+import { ExecutionCompletedSchema, ExecutionRejectedSchema } from "./execution-protocol.js";
+import { hashExecutionSpec } from "./execution-runner.js";
+import { dslog } from "./slog.js";
+/** Queue rejection is admission work too: own the ID before any asynchronous journal write. */
+export async function rejectQueuedAdmission(context, spec, executionClass, facts) {
+    const id = spec.executionId;
+    const hash = hashExecutionSpec(spec);
+    if (context.knownExecutionHashes.has(id) || context.executionRuns.has(id)) {
+        // A same-ID request won while the caller awaited journal.get. Its journal may
+        // still be pending; silence lets its real result arrive instead of rejecting it.
+        const existing = await context.journal.get(id);
+        if (existing?.specHash === hash)
+            context.replay(existing);
+        return;
+    }
+    context.knownExecutionHashes.set(id, hash);
+    const rejected = ExecutionRejectedSchema.parse({
+        type: "execution:rejected", protocolVersion: 1, executionId: id,
+        reason: "resource_limit", message: "Local machine execution queue is full", at: new Date().toISOString(),
+    });
+    dslog("execution.machine_queue_rejected", "机器执行队列已满", {
+        level: "WARN", execution_id: id, agent_handle: spec.agent.handle, execution_class: executionClass, ...facts,
+    });
+    const rejecting = persistPreAdmissionRejection(context.journal, spec, rejected)
+        .then(async (entry) => {
+        if (entry)
+            await context.report({ ...rejected, preAdmissionProof: { specHash: hash } });
+        else {
+            const existing = await context.journal.get(id);
+            if (existing?.specHash === hash)
+                context.replay(existing);
+        }
+    })
+        .catch(error => {
+        // A failed durable write has no safe rejection proof; a restart/sync will
+        // reconcile an accepted tombstone if this admission created one.
+        dslog("execution.admission_rejection_failed", "准入拒绝未取得持久停止证明", {
+            level: "ERROR", execution_id: id, error_message: String(error),
+        });
+    })
+        .finally(() => {
+        if (context.executionRuns.get(id) === rejecting) {
+            context.executionRuns.delete(id);
+            context.knownExecutionHashes.delete(id);
+        }
+    });
+    context.executionRuns.set(id, rejecting);
+    await rejecting;
+}
+/** The caller synchronously owns this admission ID. Never complete somebody else's record. */
+export async function persistPreAdmissionRejection(journal, spec, rejection) {
+    const accepted = await journal.accept(spec.executionId, hashExecutionSpec(spec), {
+        runtime: spec.runtime.name, ...(spec.runtime.model ? { model: spec.runtime.model } : {}), resumed: false,
+    });
+    if (accepted.kind !== "created")
+        return null;
+    return journal.complete(spec.executionId, ExecutionCompletedSchema.parse({
+        type: "execution:completed", protocolVersion: 1, executionId: spec.executionId,
+        outcome: "failed", errorCode: rejection.reason, errorMessage: rejection.message ?? "Admission rejected before runtime start",
+        runtime: spec.runtime.name, ...(spec.runtime.model ? { model: spec.runtime.model } : {}), resumed: false,
+        startedAt: accepted.acceptedAt,
+        finishedAt: new Date(Math.max(Date.now(), Date.parse(accepted.acceptedAt))).toISOString(),
+    }));
+}

package/dist/project-skills/execution-adapter.js

@@ -9,10 +9,11 @@ export function projectSkillExecutionProjection(bindings, generation) {
         });
 }
 /**
- * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时是 codex/claude 的执行
+ * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时支持受控目录的执行
  * 才会有投影目录,也才需要在停止无法证明时保留它。两处判定分开写过一次,结果 kimi + projectSkills
  * 会在取消路径上错抛 ownership 未确认。
  */
 export const projectSkillProjectionApplies = (spec) => spec.agent.projectSkills !== undefined
-    && (spec.runtime.name === "codex" || spec.runtime.name === "claude");
+    && (spec.runtime.name === "codex" || spec.runtime.name === "claude"
+        || spec.runtime.name === "deepseek-harness");
 export const projectSkillProjectionErrorCode = (error) => error instanceof ProjectProjectionError ? error.code : null;