@nowcrew/daemon 0.6.89 → 0.6.91-beta.1

package/dist/message-file-preview.js

@@ -0,0 +1,246 @@
+/**
+ * 消息授权后的按需单文件读取。Server 决定消息权限、原执行设备及项目 ID；
+ * 本模块只解析本机受控根、拒绝别名与越界，并有界读取，不持久化状态。
+ */
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import { isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+import { isInternalEnvironmentPath } from "./workspace-fs.js";
+import { opaqueKey, safeKey } from "./workspace.js";
+import { AgentHandleSchema } from "./execution-protocol.js";
+const MAX_BYTES = 256 * 1024;
+const MAX_BINARY_BYTES = 8 * 1024 * 1024;
+const MAX_CONCURRENT_READS = 4;
+let activeReads = 0;
+export const SharedFileRequestSchema = z.object({
+    type: z.literal("fs:read-shared"),
+    reqId: z.string().min(1).max(128),
+    handle: AgentHandleSchema.refine((handle) => !handle.startsWith(".")),
+    path: z.string().min(1).max(4096),
+    fileContext: z.object({
+        taskKey: z.string().min(1).max(200),
+        projectIds: z.array(z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/)).max(100),
+        primaryProjectId: z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/).optional(),
+    }).strict().refine((value) => !value.primaryProjectId || value.projectIds.includes(value.primaryProjectId)),
+}).strict();
+export class SharedFileError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "SharedFileError";
+    }
+}
+const inside = (root, target) => {
+    const rel = relative(root, target);
+    return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+};
+const parts = (path) => path.split(/[\\/]/).filter(Boolean);
+const privatePart = (part) => part.startsWith(".")
+    || /^(?:credentials?|secrets?|tokens?)(?:[._-]|$)/i.test(part)
+    || /^(?:id_rsa|id_ed25519|id_ecdsa|id_dsa|passwd|shadow|authorized_keys|known_hosts)$/i.test(part)
+    || /\.(?:pem|key|p12|pfx|keystore)$/i.test(part);
+function validatePath(path) {
+    // path 已由 Server 从 Markdown 解码，禁止再次解释编码、协议或设备路径。
+    if (/[\x00-\x1f\x7f]/.test(path) || /%[0-9a-f]{2}/i.test(path)
+        || path.startsWith("\\\\") || path.startsWith("//") || path.startsWith("~")
+        || parts(path).some((part) => part === "..")
+        || (process.platform !== "win32" && (/^[A-Za-z]:/.test(path) || path.includes("\\")))
+        || (process.platform === "win32" && path.slice(2).includes(":"))) {
+        throw new SharedFileError("file_not_viewable");
+    }
+}
+function restrictAgentTask(agentsRoot, agentRoot, path, taskNames) {
+    if (!inside(agentsRoot, path))
+        return;
+    if (!inside(agentRoot, path)) {
+        // 旧版托管项目位于 agentsRoot/repos；仍必须经过下方登记项目根检查。
+        if (inside(join(agentsRoot, "repos"), path))
+            return;
+        throw new SharedFileError("file_scope_unavailable");
+    }
+    const local = parts(relative(agentRoot, path));
+    const identity = (value) => process.platform === "win32" ? value.toLowerCase() : value;
+    if (identity(local[0] ?? "") === "tasks" && (!local[1] || !taskNames.map(identity).includes(identity(local[1])))) {
+        throw new SharedFileError("file_scope_unavailable");
+    }
+}
+async function checkedCandidate(candidate) {
+    const rel = relative(candidate.root, candidate.path);
+    if (!inside(candidate.root, candidate.path) || parts(rel).some(privatePart) || isInternalEnvironmentPath(candidate.path)) {
+        throw new SharedFileError("file_not_viewable");
+    }
+    try {
+        const before = await lstat(candidate.root, { bigint: true });
+        if (!before.isDirectory())
+            throw new SharedFileError("file_not_viewable");
+        const root = await realpath(candidate.root);
+        if (isInternalEnvironmentPath(root))
+            throw new SharedFileError("file_not_viewable");
+        const [current, canonical] = await Promise.all([
+            lstat(candidate.root, { bigint: true }), lstat(root, { bigint: true }),
+        ]);
+        if (![current, canonical].every((entry) => entry.isDirectory() && entry.dev === before.dev && entry.ino === before.ino)) {
+            throw new SharedFileError("file_changed");
+        }
+        const path = resolve(root, rel);
+        await assertRegularPath(root, path);
+        return { root, path };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function assertRegularPath(root, target) {
+    let current = root;
+    const segments = parts(relative(root, target));
+    if (segments.length === 0)
+        throw new SharedFileError("file_not_viewable");
+    for (let index = 0; index < segments.length; index++) {
+        const segment = segments[index];
+        if (privatePart(segment))
+            throw new SharedFileError("file_not_viewable");
+        current = join(current, segment);
+        const entry = await lstat(current);
+        if (entry.isSymbolicLink())
+            throw new SharedFileError("file_not_viewable");
+        if (index < segments.length - 1 ? !entry.isDirectory() : !entry.isFile() || entry.nlink !== 1) {
+            throw new SharedFileError("file_not_viewable");
+        }
+    }
+    if (await realpath(target) !== target)
+        throw new SharedFileError("file_not_viewable");
+}
+async function resolveCandidate(agentsRoot, request, registry) {
+    const agentRoot = resolve(agentsRoot, request.handle);
+    // 根本身不能是符号链接；缺失任务文件由候选阶段归一为 file_not_found。
+    try {
+        if (!(await lstat(agentRoot)).isDirectory())
+            throw new SharedFileError("file_not_viewable");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const taskNames = [...new Set([opaqueKey(request.fileContext.taskKey), safeKey(request.fileContext.taskKey)])];
+    const taskRoots = taskNames.map((name) => join(agentRoot, "tasks", name));
+    let candidates;
+    if (isAbsolute(request.path)) {
+        const target = resolve(request.path);
+        restrictAgentTask(resolve(agentsRoot), agentRoot, target, taskNames);
+        if (inside(agentRoot, target)) {
+            candidates = [{ root: agentRoot, path: target }];
+        }
+        else {
+            const registrations = await registry.list().catch(() => []);
+            const roots = registrations.filter((project) => request.fileContext.projectIds.includes(project.projectId)
+                && isAbsolute(project.root) && resolve(project.root) !== parse(resolve(project.root)).root
+                && inside(resolve(project.root), target));
+            if (roots.length === 0)
+                throw new SharedFileError("file_scope_unavailable");
+            // 嵌套项目取最具体的已授权根；同一实际文件不构成相对路径歧义。
+            const root = roots.map((project) => resolve(project.root)).sort((a, b) => b.length - a.length)[0];
+            candidates = [{ root, path: target }];
+        }
+    }
+    else {
+        const rel = request.path.replace(/^\.\//, "");
+        if (parts(rel).some(privatePart))
+            throw new SharedFileError("file_not_viewable");
+        const target = resolve(agentRoot, rel);
+        restrictAgentTask(resolve(agentsRoot), agentRoot, target, taskNames);
+        candidates = [{ root: agentRoot, path: target }, ...taskRoots.map((root) => ({ root: agentRoot, path: resolve(root, rel) }))];
+    }
+    const resolved = (await Promise.all(candidates.map(checkedCandidate))).filter((v) => v !== null);
+    const unique = [...new Map(resolved.map((value) => [value.path, value])).values()];
+    if (unique.length === 0)
+        throw new SharedFileError("file_not_found");
+    if (unique.length !== 1)
+        throw new SharedFileError("file_path_ambiguous");
+    return unique[0];
+}
+async function readCandidate(candidate) {
+    const before = await lstat(candidate.path, { bigint: true });
+    // Darwin SDK sys/fcntl.h 的 O_NOFOLLOW_ANY 原子拒绝任何父目录符号链接。
+    // Node 尚未导出该常量；Linux 则在下方通过已打开句柄的真实路径核验。
+    // Darwin 不允许 O_NOFOLLOW_ANY 与 O_NOFOLLOW 同时使用。
+    const noFollow = process.platform === "darwin" ? 0x20000000 : (constants.O_NOFOLLOW ?? 0);
+    const handle = await open(candidate.path, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | noFollow);
+    try {
+        const opened = await handle.stat({ bigint: true });
+        // 对照打开前身份并重新检查整条路径，拒绝检查与读取之间的替换。
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== before.dev || opened.ino !== before.ino) {
+            throw new SharedFileError("file_changed");
+        }
+        await assertRegularPath(candidate.root, candidate.path);
+        if (process.platform === "linux" && await realpath(`/proc/self/fd/${handle.fd}`) !== candidate.path) {
+            throw new SharedFileError("file_changed");
+        }
+        const current = await lstat(candidate.path, { bigint: true });
+        if (current.dev !== opened.dev || current.ino !== opened.ino || !current.isFile() || current.nlink !== 1n) {
+            throw new SharedFileError("file_changed");
+        }
+        const knownBinary = /\.(?:xlsx|xls|pdf|png|jpe?g|gif|webp|zip|docx|pptx)$/iu.test(candidate.path);
+        if (knownBinary && opened.size > BigInt(MAX_BINARY_BYTES))
+            throw new SharedFileError("file_too_large");
+        const buffer = Buffer.alloc(knownBinary ? Number(opened.size) : MAX_BYTES);
+        let length = 0;
+        while (length < buffer.length) {
+            const read = await handle.read(buffer, length, buffer.length - length, length);
+            if (read.bytesRead === 0)
+                break;
+            length += read.bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        const currentAfter = await lstat(candidate.path, { bigint: true });
+        if (after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs
+            || currentAfter.dev !== opened.dev || currentAfter.ino !== opened.ino || !currentAfter.isFile()) {
+            throw new SharedFileError("file_changed");
+        }
+        const bytes = buffer.subarray(0, length);
+        const truncated = opened.size > BigInt(length);
+        if (bytes.includes(0) || knownBinary) {
+            if (truncated)
+                throw new SharedFileError("file_too_large");
+            return { path: relative(candidate.root, candidate.path).split(sep).join("/"), content: bytes.toString("base64"), encoding: "base64", size: Number(opened.size), truncated };
+        }
+        let content;
+        try {
+            content = new TextDecoder("utf-8", { fatal: true }).decode(bytes, { stream: truncated });
+        }
+        catch {
+            throw new SharedFileError("file_binary");
+        }
+        return { path: relative(candidate.root, candidate.path).split(sep).join("/"), content, size: Number(opened.size), truncated };
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readSharedMessageFile(agentsRoot, rawRequest, registry) {
+    const parsed = SharedFileRequestSchema.safeParse(rawRequest);
+    if (!parsed.success)
+        throw new SharedFileError("file_not_viewable");
+    if (process.platform !== "darwin" && process.platform !== "linux")
+        throw new SharedFileError("file_scope_unavailable");
+    validatePath(parsed.data.path);
+    if (activeReads >= MAX_CONCURRENT_READS)
+        throw new SharedFileError("file_preview_busy");
+    activeReads++;
+    try {
+        return await readCandidate(await resolveCandidate(agentsRoot, parsed.data, registry));
+    }
+    catch (error) {
+        if (error instanceof SharedFileError)
+            throw error;
+        if (error.code === "ENOENT")
+            throw new SharedFileError("file_not_found");
+        throw new SharedFileError("file_not_viewable");
+    }
+    finally {
+        activeReads--;
+    }
+}

package/dist/pre-admission-rejection.js

@@ -0,0 +1,64 @@
+import { ExecutionCompletedSchema, ExecutionRejectedSchema } from "./execution-protocol.js";
+import { hashExecutionSpec } from "./execution-runner.js";
+import { dslog } from "./slog.js";
+/** Queue rejection is admission work too: own the ID before any asynchronous journal write. */
+export async function rejectQueuedAdmission(context, spec, executionClass, facts) {
+    const id = spec.executionId;
+    const hash = hashExecutionSpec(spec);
+    if (context.knownExecutionHashes.has(id) || context.executionRuns.has(id)) {
+        // A same-ID request won while the caller awaited journal.get. Its journal may
+        // still be pending; silence lets its real result arrive instead of rejecting it.
+        const existing = await context.journal.get(id);
+        if (existing?.specHash === hash)
+            context.replay(existing);
+        return;
+    }
+    context.knownExecutionHashes.set(id, hash);
+    const rejected = ExecutionRejectedSchema.parse({
+        type: "execution:rejected", protocolVersion: 1, executionId: id,
+        reason: "resource_limit", message: "Local machine execution queue is full", at: new Date().toISOString(),
+    });
+    dslog("execution.machine_queue_rejected", "机器执行队列已满", {
+        level: "WARN", execution_id: id, agent_handle: spec.agent.handle, execution_class: executionClass, ...facts,
+    });
+    const rejecting = persistPreAdmissionRejection(context.journal, spec, rejected)
+        .then(async (entry) => {
+        if (entry)
+            await context.report({ ...rejected, preAdmissionProof: { specHash: hash } });
+        else {
+            const existing = await context.journal.get(id);
+            if (existing?.specHash === hash)
+                context.replay(existing);
+        }
+    })
+        .catch(error => {
+        // A failed durable write has no safe rejection proof; a restart/sync will
+        // reconcile an accepted tombstone if this admission created one.
+        dslog("execution.admission_rejection_failed", "准入拒绝未取得持久停止证明", {
+            level: "ERROR", execution_id: id, error_message: String(error),
+        });
+    })
+        .finally(() => {
+        if (context.executionRuns.get(id) === rejecting) {
+            context.executionRuns.delete(id);
+            context.knownExecutionHashes.delete(id);
+        }
+    });
+    context.executionRuns.set(id, rejecting);
+    await rejecting;
+}
+/** The caller synchronously owns this admission ID. Never complete somebody else's record. */
+export async function persistPreAdmissionRejection(journal, spec, rejection) {
+    const accepted = await journal.accept(spec.executionId, hashExecutionSpec(spec), {
+        runtime: spec.runtime.name, ...(spec.runtime.model ? { model: spec.runtime.model } : {}), resumed: false,
+    });
+    if (accepted.kind !== "created")
+        return null;
+    return journal.complete(spec.executionId, ExecutionCompletedSchema.parse({
+        type: "execution:completed", protocolVersion: 1, executionId: spec.executionId,
+        outcome: "failed", errorCode: rejection.reason, errorMessage: rejection.message ?? "Admission rejected before runtime start",
+        runtime: spec.runtime.name, ...(spec.runtime.model ? { model: spec.runtime.model } : {}), resumed: false,
+        startedAt: accepted.acceptedAt,
+        finishedAt: new Date(Math.max(Date.now(), Date.parse(accepted.acceptedAt))).toISOString(),
+    }));
+}

package/dist/project-skills/execution-adapter.js

@@ -9,10 +9,11 @@ export function projectSkillExecutionProjection(bindings, generation) {
         });
 }
 /**
- * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时是 codex/claude 的执行
+ * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时支持受控目录的执行
  * 才会有投影目录,也才需要在停止无法证明时保留它。两处判定分开写过一次,结果 kimi + projectSkills
  * 会在取消路径上错抛 ownership 未确认。
  */
 export const projectSkillProjectionApplies = (spec) => spec.agent.projectSkills !== undefined
-    && (spec.runtime.name === "codex" || spec.runtime.name === "claude");
+    && (spec.runtime.name === "codex" || spec.runtime.name === "claude"
+        || spec.runtime.name === "deepseek-harness");
 export const projectSkillProjectionErrorCode = (error) => error instanceof ProjectProjectionError ? error.code : null;

package/dist/project-skills/runtime-launch.js

@@ -11,12 +11,26 @@ export function projectSkillRuntimeLaunchFacts(runtime, root) {
     if (runtime === "claude") {
         return Object.freeze({ claudeAdditionalDirectory: root.claudeAdditionalDirectory });
     }
+    if (runtime === "deepseek-harness") {
+        return Object.freeze({ harnessSkillRoot: root.codexSkillRoot });
+    }
     throw new ProjectProjectionError("skill_projection_failed");
 }
 /** Builds Runtime-native arrays while keeping v1 shared roots separate from v2 exact roots. */
 export async function projectSkillRuntimeDirectories(input) {
     const trainingProjectRoots = input.trainingProjectRoots ?? [];
     const facts = projectSkillRuntimeLaunchFacts(input.runtime, input.runtimeRoot);
+    if (input.runtime === "deepseek-harness") {
+        // Harness 的 local provider 接受直接包含 Skill 子目录的受控 root,不扫描项目/用户目录。
+        return Object.freeze({
+            codexSkillRoots: Object.freeze([]),
+            claudeAdditionalDirectories: Object.freeze([]),
+            harnessSkillRoots: Object.freeze([
+                ...(facts.harnessSkillRoot === undefined ? [] : [facts.harnessSkillRoot]),
+                ...(input.abilitySkillRoot === undefined ? [] : [input.abilitySkillRoot]),
+            ]),
+        });
+    }
     const codexSkillRoots = input.runtime === "codex"
         && (input.runtimeRoot !== undefined || input.projectContext !== undefined)
         ? Object.freeze([

package/dist/provider-env.js

@@ -10,7 +10,7 @@
  */
 import { join } from "node:path";
 import { DEEPSEEK_CODEX_KEY_ENV, deepSeekCodexHome, } from "./runtimes/codex-deepseek-config.js";
-import { DEEPSEEK_HARNESS_CONFIG_ENV } from "./runtimes/deepseek-harness.js";
+import { mergeRuntimeEnvironments } from "./runtime-environment-merge.js";
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const RESERVED_ENV = new Set([
     "PATH",
@@ -57,26 +57,26 @@ const CONFLICTING_CODEX_ENV = [
     DEEPSEEK_CODEX_KEY_ENV,
 ];
 /** 返回叠加了 provider 隔离的新 env(不改入参);不支持的 runtime/provider 组合原样返回。 */
-export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverride) {
+export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverride, platform = process.platform) {
     if (runtime === "codex" && cfg.provider === "deepseek") {
         const env = { ...base };
-        for (const key of CONFLICTING_CODEX_ENV)
-            delete env[key];
+        for (const key of Object.keys(env))
+            if (CONFLICTING_CODEX_ENV.includes(platform === "win32" ? key.toUpperCase() : key))
+                delete env[key];
         env.CODEX_HOME = deepSeekHomeOverride ?? deepSeekCodexHome(homeDir);
         if (cfg.providerApiKey)
             env[DEEPSEEK_CODEX_KEY_ENV] = cfg.providerApiKey;
         return env;
     }
     if (runtime === "codex") {
-        if (cfg.codexHomeMode === "private")
-            return { ...base, CODEX_HOME: join(homeDir, ".codex") };
         return base;
     }
     if (runtime !== "claude" || cfg.provider !== "custom")
         return base;
     const env = { ...base };
-    for (const k of CONFLICTING_ENV)
-        delete env[k];
+    for (const key of Object.keys(env))
+        if (CONFLICTING_ENV.includes(platform === "win32" ? key.toUpperCase() : key))
+            delete env[key];
     if (cfg.providerBaseUrl)
         env.ANTHROPIC_BASE_URL = cfg.providerBaseUrl;
     if (cfg.providerApiKey) {
@@ -94,20 +94,31 @@ export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverri
         env.ANTHROPIC_SMALL_FAST_MODEL = cfg.providerSmallFastModel;
         env.ANTHROPIC_DEFAULT_HAIKU_MODEL = cfg.providerSmallFastModel;
     }
-    return env;
+    return mergeRuntimeEnvironments([env], platform);
+}
+const deepSeekHarnessMachineOwnedKey = (key, platform) => {
+    const identity = platform === "win32" ? key.toUpperCase() : key;
+    return identity.startsWith("DEEPSEEK_") || identity.startsWith("NOWCREW_DEEPSEEK_HARNESS_") || identity.startsWith("DSH_");
+};
+/** 子命令切换目录后仍必须保留 provider 的鉴权/路由边界，包括被清除的键。 */
+export function providerOwnedEnvironmentKeys(runtime, cfg, candidateKeys, platform = process.platform) {
+    if (runtime === "claude" && cfg.provider === "custom")
+        return [...CONFLICTING_ENV, "CLAUDE_CONFIG_DIR"];
+    if (runtime === "codex" && cfg.provider === "deepseek")
+        return CONFLICTING_CODEX_ENV;
+    if (runtime === "deepseek-harness")
+        return candidateKeys.filter(key => deepSeekHarnessMachineOwnedKey(key, platform));
+    return [];
 }
-const deepSeekHarnessMachineOwnedKey = (key) => (key.startsWith("DEEPSEEK_")
-    || key === DEEPSEEK_HARNESS_CONFIG_ENV
-    || key.startsWith("DSH_"));
 /** Agent env remains available to tools, but cannot replace Harness process policy or credentials. */
-export function applyDeepSeekHarnessMachineEnv(base, machineEnv) {
+export function applyDeepSeekHarnessMachineEnv(base, machineEnv, platform = process.platform) {
     const env = { ...base };
     for (const key of Object.keys(env)) {
-        if (deepSeekHarnessMachineOwnedKey(key))
+        if (deepSeekHarnessMachineOwnedKey(key, platform))
             delete env[key];
     }
     for (const [key, value] of Object.entries(machineEnv)) {
-        if (deepSeekHarnessMachineOwnedKey(key) && value !== undefined)
+        if (deepSeekHarnessMachineOwnedKey(key, platform) && value !== undefined)
             env[key] = value;
     }
     return env;

package/dist/runner.js

@@ -1,7 +1,8 @@
+import { createMachineEnvironmentProvider } from "./machine-environment-cache.js";
 /** Legacy agent orchestration around the business-neutral local executor. */
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
-import { resolveReposRoot } from "./config.js";
+import { isLocalMemoryV2Enabled, resolveReposRoot } from "./config.js";
 import { mintAgentToken } from "./token.js";
 import { buildSystemPrompt, buildWakePrompt, capMemoryForInject, capWorkLogForInject } from "./prompt.js";
 import { deliverScheduledReport, } from "./scheduled-report.js";
@@ -24,6 +25,18 @@ function runtimeName(value) {
     throw new Error(`unsupported runtime: ${value}`);
 }
 export async function runAgent(config, input, onActivity = defaultPrint, onConsole = () => { }, dependencies = {}) {
+    const owned = dependencies.machineEnvironment === undefined;
+    const machineEnvironment = dependencies.machineEnvironment
+        ?? createMachineEnvironmentProvider({ mode: config.machineEnvironmentMode ?? "off" });
+    try {
+        return await runAgentWithMachineEnvironment(config, input, onActivity, onConsole, { ...dependencies, machineEnvironment });
+    }
+    finally {
+        if (owned)
+            await machineEnvironment.stop();
+    }
+}
+async function runAgentWithMachineEnvironment(config, input, onActivity = defaultPrint, onConsole = () => { }, dependencies = {}) {
     const threadId = input.scheduled ? undefined : input.threadId;
     const taskAnchor = threadId ?? input.wakeMessageId;
     // Old servers have no typed maintenance purpose. A legacy marker can only
@@ -36,7 +49,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
     }), dependencies.cancellation);
     const providerConfig = credential.config ?? {};
     const runtime = runtimeName(providerConfig.runtime ?? config.runtimeBin);
-    const localMemoryV2Enabled = config.localMemoryV2Handles?.has(input.handle) === true;
+    const localMemoryV2Enabled = isLocalMemoryV2Enabled(config, input.handle);
     const reasoning = ReasoningSchema.safeParse(providerConfig.reasoning);
     const baseWake = input.wake ?? buildWakePrompt(input.channelId);
     const executionId = input.runId ?? `legacy-${randomUUID()}`;
@@ -70,7 +83,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             memory: capMemoryForInject(workspace.memory),
             ...(resuming ? {} : { workLog: capWorkLogForInject(workspace.workLog) }),
             collaborationToolsEnabled: config.codexCollaborationTools && runtime === "codex",
-            localMemoryV2Enabled,
+            localMemoryV2Enabled: workspace.localMemoryV2Enabled ?? localMemoryV2Enabled,
         }),
         // Native adapters, not a launch-intent prompt, choose history versus delta.
         wakePrompt: () => baseWake,
@@ -91,7 +104,6 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             ...(config.qaReportRoot === undefined ? {} : { qaReportRoot: config.qaReportRoot }),
             cliPath: config.cliPath,
             providerConfig,
-            codexHomeMode: config.codexHomeMode,
             ...(providerConfig.description ? { description: providerConfig.description } : {}),
             systemEnv: {
                 ...(providerConfig.fastMode ? { CREW_FAST_MODE: "1" } : {}),
@@ -119,6 +131,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
         onRuntimeStarting: () => dependencies.onRuntimePhase?.("starting", runtime),
         onRuntimeRunning: () => dependencies.onRuntimePhase?.("running", runtime),
     }, {
+        ...(dependencies.machineEnvironment === undefined ? {} : { machineEnvironment: dependencies.machineEnvironment }),
         launchRuntime: dependencies.launchRuntime ?? ((request) => launchSupervisedRuntime(request, dependencies.startSupervisor, dependencies.cancellation, dependencies.platform)),
         ...(dependencies.cancellation === undefined ? {} : { cancellation: dependencies.cancellation }),
         ...(dependencies.startupGate === undefined ? {} : { startupGate: dependencies.startupGate }),

package/dist/runtime-environment-merge.js

@@ -0,0 +1,16 @@
+/** Keep layer order authoritative even when Windows keys use different casing. */
+export function mergeRuntimeEnvironments(layers, platform = process.platform) {
+    const entries = new Map();
+    for (const layer of layers) {
+        for (const [key, value] of Object.entries(layer)) {
+            if (value !== undefined)
+                entries.set(platform === "win32" ? key.toUpperCase() : key, [key, value]);
+        }
+    }
+    return Object.fromEntries(entries.values());
+}
+export function runtimeEnvironmentValue(env, key, platform = process.platform) {
+    if (platform !== "win32")
+        return env?.[key];
+    return Object.entries(env ?? {}).find(([candidate]) => candidate.toUpperCase() === key.toUpperCase())?.[1];
+}

package/dist/runtime-health-handler.js

@@ -3,3 +3,13 @@ export const runtimeHealthProbeHandler = (configuredProbe, executionRuntimesKnow
     ...(executionRuntimesKnown ? { availableRuntimes: detectedExecutionRuntimes } : {}),
 }));
 export const handleRuntimeHealthProbeFrame = (decoded, configuredProbe, executionRuntimesKnown, detectedExecutionRuntimes) => handleRuntimeProbeFrame(decoded, runtimeHealthProbeHandler(configuredProbe, executionRuntimesKnown, detectedExecutionRuntimes));
+/** 将探针结果按既有 RPC 帧返回，serve 只保留路由选择。 */
+export async function replyRuntimeHealthProbe(decoded, configuredProbe, known, runtimes, send) {
+    const result = await handleRuntimeHealthProbeFrame(decoded, configuredProbe, known, runtimes);
+    if (result !== null) {
+        try {
+            send({ type: "fs:result", ...result });
+        }
+        catch { /* Server 查询超时处理断连 */ }
+    }
+}

package/dist/runtime-health.js

@@ -123,7 +123,9 @@ export async function probeRuntimeHealth(request, dependencies = {}) {
     const now = dependencies.now ?? (() => new Date());
     const monotonicNow = dependencies.monotonicNow ?? (() => performance.now());
     const sourceEnv = dependencies.env ?? process.env;
-    const env = { ...sourceEnv, PATH: augmentedPath(sourceEnv) };
+    const env = dependencies.env === undefined
+        ? { ...sourceEnv, PATH: augmentedPath(sourceEnv) }
+        : { ...sourceEnv };
     const availableRuntimes = dependencies.availableRuntimes ?? parsed.availableRuntimes;
     const results = [];
     for (const target of parsed.runtimes) {

package/dist/runtime-path.js

@@ -8,24 +8,27 @@
  */
 import { existsSync } from "node:fs";
 import { win32, posix } from "node:path";
+import { runtimeEnvironmentValue } from "./runtime-environment-merge.js";
 const pathApi = (platform) => (platform === "win32" ? win32 : posix);
 /** 该平台常见 CLI 安装目录候选(是否真实存在稍后由 augmentedPath 校验)。 */
 export function commonBinDirs(env = process.env, platform = process.platform) {
     const p = pathApi(platform);
+    const value = (key) => runtimeEnvironmentValue(env, key, platform);
     if (platform === "win32") {
         const dirs = [];
-        if (env.USERPROFILE) {
-            dirs.push(p.join(env.USERPROFILE, ".kimi-code", "bin"), // Kimi 官方安装器默认落点
-            p.join(env.USERPROFILE, ".local", "bin"));
+        const userProfile = value("USERPROFILE"), appData = value("APPDATA"), localAppData = value("LOCALAPPDATA");
+        if (userProfile) {
+            dirs.push(p.join(userProfile, ".kimi-code", "bin"), // Kimi 官方安装器默认落点
+            p.join(userProfile, ".local", "bin"));
         }
-        if (env.APPDATA)
-            dirs.push(p.join(env.APPDATA, "npm"));
-        if (env.LOCALAPPDATA)
-            dirs.push(p.join(env.LOCALAPPDATA, "Microsoft", "WindowsApps"));
+        if (appData)
+            dirs.push(p.join(appData, "npm"));
+        if (localAppData)
+            dirs.push(p.join(localAppData, "Microsoft", "WindowsApps"));
         return dirs;
     }
     const dirs = [];
-    const home = env.HOME;
+    const home = value("HOME");
     if (home) {
         dirs.push(p.join(home, ".kimi-code", "bin"), // Kimi 官方安装器默认落点
         p.join(home, ".local", "bin"), // Claude 官方原生安装器默认落点
@@ -41,19 +44,26 @@ export function commonBinDirs(env = process.env, platform = process.platform) {
  * 在 `env.PATH` 基础上,把候选目录里「真实存在且尚未在 PATH 中」的去重后 prepend,返回新的 PATH 字符串。
  * 用户装的目录优先命中(prepend);全部已存在或都不在磁盘上时,原样返回 `env.PATH`。
  */
-export function augmentedPath(env = process.env, deps = {}, platform = process.platform) {
+export function augmentedPath(env = process.env, deps = {}, platform = process.platform, placement = "prepend") {
     const dirExists = deps.dirExists ?? existsSync;
     const sep = pathApi(platform).delimiter;
-    const current = env.PATH ?? "";
-    const existing = new Set(current.split(sep).filter((entry) => entry.length > 0));
+    const current = runtimeEnvironmentValue(env, "PATH", platform) ?? "";
+    const keyOf = (entry) => platform === "win32" ? entry.replace(/\//gu, "\\").toLowerCase() : entry;
+    const currentEntries = current.split(sep).filter((entry) => entry.length > 0);
+    const existing = new Set(currentEntries.map(keyOf));
     const extra = [];
     for (const dir of commonBinDirs(env, platform)) {
-        if (existing.has(dir) || extra.includes(dir))
+        if (existing.has(keyOf(dir)) || extra.some(entry => keyOf(entry) === keyOf(dir)))
             continue;
         if (!dirExists(dir))
             continue;
         extra.push(dir);
     }
+    if (placement === "append") {
+        const seen = new Set();
+        return [...currentEntries, ...extra].filter(entry => { const key = keyOf(entry); if (seen.has(key))
+            return false; seen.add(key); return true; }).join(sep);
+    }
     if (extra.length === 0)
         return current;
     return current.length > 0 ? `${extra.join(sep)}${sep}${current}` : extra.join(sep);