@nowcrew/daemon 0.6.98-beta.7 → 0.6.98-beta.8

package/README.md

@@ -434,23 +434,27 @@ path-free inventory and logical `(projectId, skillName)` bindings. The local pat
 while an add command is forwarded to the selected online Computer; it is not written to the workspace
 database, structured logs, inventory frames, or responses. Project Skills are disabled on Windows.
 
-One binding set is projected into both Runtime discovery layouts:
+Skill entries may be real directories or directory symlinks, including relative, absolute, chained,
+and shared directories outside the project. Only direct, non-hidden entries are scanned. Broken,
+cyclic, inaccessible, and non-directory links count as invalid Skills without hiding healthy entries;
+the existing frontmatter, size, name-conflict, and inventory limits apply to linked Skills too.
+
+Each execution projects its binding set into a private Runtime discovery directory:
 
 ```text
-<agentsRoot>/<handle>/.agents/skills/<name>                         # Codex symlink
-<agentsRoot>/<handle>/.crew/claude-skills/.claude/skills/<name>    # Claude symlink
+<agentsRoot>/<handle>/.crew/project-skills/exec-<executionId>/runtime/.claude/skills/<name>
 ```
 
-The two complete directories switch under one per-Agent reconcile/launch lock. A failed switch restores
-the prior complete projection; a missing project or Skill removes only that link and does not block other
-work. These are ordinary writable symlinks, not snapshots or a sandbox: an Agent running as the daemon
-user can modify the source Skill through them. That write-through risk is intentionally accepted.
+The scanner retains the entry path. Binding checks and execution startup resolve its current real
+directory and check for `SKILL.md`; missing sources warn and are omitted without blocking other work.
+Each execution links to that resolved directory, so retargeting an entry affects subsequent executions
+while active executions keep their original target. Source file edits remain live. The projection is
+removed after the runtime process tree stops; source directories and user-created links are preserved.
+These are ordinary writable symlinks, not snapshots or a sandbox: an Agent running as the daemon user
+can modify the source Skill through them. That write-through risk is intentionally accepted.
 
-Codex protocol-v1 task directories are opaque
-`<agentsRoot>/<handle>/tasks/<safe-prefix>-<sha256>` paths. The daemon writes `.nowwork-root` at the Agent
-root and adds it to Codex `project_root_markers`, so upward discovery reaches `.agents/skills` without
-changing the task cwd. Claude receives
-`--add-dir <agentsRoot>/<handle>/.crew/claude-skills`; Claude treats those Skills as `projectSettings`,
+Codex registers the execution's `runtime/.claude/skills` through `skills/extraRoots/set`. Claude receives
+the execution's `runtime` directory through `--add-dir`; Claude treats those Skills as `projectSettings`,
 so a machine policy that disables project settings also disables this source even when the projection is
 healthy.
 
@@ -467,10 +471,10 @@ scope is merged. The policy version in Codex's session fingerprint cold-starts o
 once, then subsequent runs can resume normally. Explicit `shell_environment_policy.set` entries, shell
 startup scripts and Agent notes remain separate configuration; this change does not correct them.
 
-Binding changes reconcile immediately when the Computer is online. On reconnect the server sends the
-complete binding set for every Agent assigned to that Computer, including empty sets that clear stale
-links left by offline unbinds. Every non-empty execution snapshot is also reconciled immediately before
-Runtime launch, which recovers from a missed notification or daemon restart. Skill file content changes
+Binding changes are checked immediately when the Computer is online. On reconnect the server sends the
+complete binding set for every Agent assigned to that Computer, including empty sets. Each execution
+uses its server-snapshotted binding set and revalidates local source paths immediately before Runtime
+launch. Skill file content changes
 are visible through the symlink immediately; adding, deleting, renaming, or changing frontmatter requires
 a rescan. Web descriptions remain at the last inventory value until that rescan.
 

package/dist/automatic-daemon-installer.js

@@ -6,7 +6,8 @@ import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenS
 import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { buildManagedServiceRecord, installManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
-import { ManagedServiceConflictError, managedServiceConflict, managedServiceIdentityMatches, readManagedServiceRegistry, } from "./managed-service-registry.js";
+import { readManagedServiceRegistry, } from "./managed-service-registry.js";
+import { captureManagedServiceForSetup } from "./automatic-service-capture.js";
 import { resolveAutomaticInstallTarget, } from "./automatic-install-target.js";
 import { acquireDaemonInstallationLease, } from "./daemon-installation-lease.js";
 import { daemonVersion } from "./machine-info.js";
@@ -80,7 +81,6 @@ function defaultDependencies() {
         },
         captureService: async (spec, target) => {
             if (platform !== "win32") {
-                managedRecords = await readManagedServiceRegistry({ userHome, localHome: localHomeForTarget(target, platform) });
                 const entryPath = spec.daemonCommand[1];
                 const installation = daemonGlobalInstallation(entryPath, platform);
                 if (installation === null) {
@@ -94,14 +94,13 @@ function defaultDependencies() {
                     entryPath,
                     ...installation,
                 });
-                const { generation: _generation, createdAt: _createdAt, ...expected } = candidate;
-                previousManagedRecord = managedRecords.find((record) => managedServiceIdentityMatches(record, expected));
-                if (previousManagedRecord === undefined) {
-                    const conflict = managedServiceConflict(managedRecords, candidate);
-                    if (conflict !== null) {
-                        throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
-                    }
-                }
+                const captured = await captureManagedServiceForSetup({
+                    spec, record: candidate, runner,
+                    registry: { userHome, localHome: localHomeForTarget(target, platform) },
+                });
+                managedRecords = captured.managedRecords;
+                previousManagedRecord = captured.previousManagedRecord;
+                return captured.snapshot;
             }
             return captureExactService(spec, runner);
         },
@@ -175,7 +174,12 @@ function defaultDependencies() {
                 ? localHome
                 : localHomeForNpmPrefix(previousManagedRecord.npmPrefix, platform);
             const current = (await readManagedServiceRegistry({ userHome, localHome: restoreLocalHome })).find((record) => record.serviceId === spec.id);
-            if (current !== undefined && JSON.stringify(current) !== JSON.stringify(previousManagedRecord)) {
+            const onlyHashChanged = current !== undefined && previousManagedRecord !== undefined
+                && JSON.stringify({ ...current, descriptorSha256: previousManagedRecord.descriptorSha256 })
+                    === JSON.stringify(previousManagedRecord);
+            // Preflight may have captured the exact descriptor while leaving a stale
+            // registry hash untouched. Let installManagedService reconcile it in place.
+            if (current !== undefined && !onlyHashChanged && JSON.stringify(current) !== JSON.stringify(previousManagedRecord)) {
                 await uninstallManagedService({
                     spec,
                     record: current,

package/dist/automatic-service-capture.js

@@ -0,0 +1,27 @@
+import { captureExactService } from "./computer-service.js";
+import { ManagedServiceConflictError, ManagedServiceRegistryError, managedServiceConflict, managedServiceIdentityMatches, readManagedServiceRegistry, } from "./managed-service-registry.js";
+/** Read-only preflight; keep the record needed to restore the captured service. */
+export async function captureManagedServiceForSetup(input) {
+    const managedRecords = await readManagedServiceRegistry(input.registry);
+    const { generation: _generation, createdAt: _createdAt, ...expected } = input.record;
+    const registered = managedRecords.find((record) => managedServiceIdentityMatches(record, {
+        ...expected, descriptorSha256: record.descriptorSha256,
+    }));
+    if (registered === undefined) {
+        const conflict = managedServiceConflict(managedRecords, input.record);
+        if (conflict !== null) {
+            throw new ManagedServiceConflictError(conflict.resource, input.record, conflict.owner);
+        }
+    }
+    const snapshot = await captureExactService(input.spec, input.runner);
+    if (registered !== undefined && registered.descriptorSha256 !== expected.descriptorSha256
+        && (!snapshot.installed || !snapshot.exact)) {
+        throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match the requested identity`);
+    }
+    // A stale hash may be reconciled later under the registry lock. Rollback must
+    // refer to the descriptor we actually captured, not the stale registry hash.
+    const previousManagedRecord = registered === undefined ? undefined : {
+        ...registered, descriptorSha256: expected.descriptorSha256,
+    };
+    return { managedRecords, previousManagedRecord, snapshot };
+}

package/dist/execution-journal-lock.js

@@ -3,10 +3,25 @@ import { renameSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { join, resolve } from "node:path";
 import { z } from "zod";
+const ProtectedGroupSchema = z.object({ pid: z.number().int().positive(), processIdentity: z.string().min(1) }).strict();
+export async function inspectProtectedProcessGroup(pid) {
+    try {
+        process.kill(-pid, 0);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return false;
+        if (error.code === "EPERM")
+            return true;
+        throw error;
+    }
+}
 const OwnerSchema = z.object({
     pid: z.number().int().positive(),
     processIdentity: z.string().min(1),
     token: z.string().uuid(),
+    protectedGroup: ProtectedGroupSchema.optional(),
 }).strict();
 export class JournalLockedError extends Error {
     journalPath;
@@ -144,7 +159,8 @@ export async function inspectJournalLock(options) {
         let inspection;
         try {
             const identity = await options.inspectIdentity(owner.pid);
-            inspection = identity === owner.processIdentity
+            const protectedAlive = owner.protectedGroup !== undefined && await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(owner.protectedGroup.pid);
+            inspection = identity === owner.processIdentity || protectedAlive
                 ? {
                     status: "owned",
                     ownerPid: owner.pid,
@@ -333,7 +349,9 @@ export function createJournalLease(options) {
                 if (observed === null)
                     continue;
                 const identity = await options.inspectIdentity(observed.owner.pid);
-                if (identity === observed.owner.processIdentity) {
+                const protectedAlive = observed.owner.protectedGroup !== undefined
+                    && await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(observed.owner.protectedGroup.pid);
+                if (identity === observed.owner.processIdentity || protectedAlive) {
                     throw new JournalLockedError(`Execution journal is locked by process ${observed.owner.pid}`, { journalPath, ownerPid: observed.owner.pid });
                 }
                 await options.hooks?.beforeRemoveObservedOwner?.(observed.owner);
@@ -408,6 +426,9 @@ export function createJournalLease(options) {
             status = "closed";
             return;
         }
+        if (lease.owner.protectedGroup && await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(lease.owner.protectedGroup.pid)) {
+            throw new JournalLockedError("Protected maintenance process group is still alive", { journalPath, ownerPid: lease.owner.protectedGroup.pid });
+        }
         status = "closing";
         lease.releasing = true;
         await awaitAbortable((async () => {
@@ -426,8 +447,36 @@ export function createJournalLease(options) {
         status = "closed";
         void cleanupReleasedDirectory(releasedDirectory);
     };
+    const protectProcessGroup = async (raw) => {
+        const group = ProtectedGroupSchema.parse(raw);
+        const lease = registry.get(options.directory);
+        if (!attached || status !== "open" || !lease || lease.releasing || lease.refs !== 1)
+            throw new JournalLockedError("Lease cannot protect a worker", { journalPath });
+        await validateInstalledOwner(lease);
+        if (await options.inspectIdentity(group.pid) !== group.processIdentity
+            || !await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(group.pid))
+            throw new JournalLockedError("Worker identity is absent", { journalPath });
+        if (lease.owner.protectedGroup) {
+            if (JSON.stringify(lease.owner.protectedGroup) === JSON.stringify(group))
+                return;
+            throw new JournalLockedError("Lease already protects a worker", { journalPath });
+        }
+        const owner = { ...lease.owner, protectedGroup: group };
+        const temp = join(options.directory, `.journal-owner.${lease.owner.token}.${randomUUID()}.tmp`);
+        try {
+            await fileSystem.writeDurableFile(temp, `${JSON.stringify(owner)}\n`);
+            await fileSystem.rename(temp, join(lockDirectory, lease.ownerFile));
+            lease.owner = owner;
+            await options.syncDirectory(lockDirectory);
+            await options.syncDirectory(options.directory);
+        }
+        finally {
+            await fileSystem.rm(temp, { force: true }).catch(() => undefined);
+        }
+    };
     return {
         acquire,
+        protectProcessGroup,
         assertUsable: () => {
             if (status !== "open") {
                 throw new JournalLockedError(`Execution journal lease is ${status}`, { journalPath });

package/dist/execution-protocol.js

@@ -207,6 +207,8 @@ export const ExecutionStartSchema = z.object({
         model: z.string().optional(),
         reasoning: ReasoningSchema.optional(),
         timeoutMs: z.number().int().positive().optional(),
+        // Server-owned policy; 0 disables the total runtime timer. Capability-gated.
+        taskTimeoutMs: z.number().int().min(0).max(2_145_600_000).optional(),
     }).strict(),
     permissions: z.object({
         requested: PermissionSchema,

package/dist/execution-runner.js

@@ -416,7 +416,7 @@ export async function runExecution(config, input, dependencies) {
         return { kind: "rejected", frame };
     }
     const { permission } = checked;
-    const effectiveTimeoutMs = spec.runtime.timeoutMs ?? config.executionLimits.maxTimeoutMs;
+    const effectiveTimeoutMs = spec.runtime.taskTimeoutMs ?? spec.runtime.timeoutMs ?? config.executionLimits.maxTimeoutMs;
     const accepted = await dependencies.journal.accept(spec.executionId, specHash, {
         runtime: spec.runtime.name,
         ...(spec.runtime.model === undefined ? {} : { model: spec.runtime.model }),
@@ -492,6 +492,7 @@ export async function runExecution(config, input, dependencies) {
     let timeout;
     let timedOut = false;
     let firstOutputTimer;
+    let runtimeTimersStarted = false;
     let firstOutputTimedOut = false;
     let abandonedRuntimeRunningCompletion = null;
     let completion;
@@ -617,7 +618,8 @@ export async function runExecution(config, input, dependencies) {
                 if (dependencies.cancellation?.isRequested())
                     return;
                 const cancel = runtimeCancel;
-                if (cancel !== null && timeout === undefined && !dependencies.cancellation?.isRequested()) {
+                if (cancel !== null && !runtimeTimersStarted && !dependencies.cancellation?.isRequested()) {
+                    runtimeTimersStarted = true;
                     const firstOutputDeadline = config.executionLimits.maxFirstOutputWaitMs
                         + config.executionLimits.firstOutputGraceMs;
                     firstOutputTimer = setTimeout(() => {
@@ -629,15 +631,16 @@ export async function runExecution(config, input, dependencies) {
                             rejectCancellationFailure(error);
                         }
                     }, firstOutputDeadline);
-                    timeout = setTimeout(() => {
-                        timedOut = true;
-                        try {
-                            void cancel().catch(rejectCancellationFailure);
-                        }
-                        catch (error) {
-                            rejectCancellationFailure(error);
-                        }
-                    }, effectiveTimeoutMs);
+                    if (effectiveTimeoutMs > 0)
+                        timeout = setTimeout(() => {
+                            timedOut = true;
+                            try {
+                                void cancel().catch(rejectCancellationFailure);
+                            }
+                            catch (error) {
+                                rejectCancellationFailure(error);
+                            }
+                        }, effectiveTimeoutMs);
                 }
                 dependencies.onRuntimePhase?.("running", spec.runtime.name);
                 const journalStartedAt = Date.now();
@@ -706,9 +709,11 @@ export async function runExecution(config, input, dependencies) {
                     catch { /* best-effort activity omitted when its envelope cannot fit */ }
                 },
             } : {}),
-            ...(spec.reporting.streamConsole ? {
+            ...(spec.reporting.streamConsole || credential.observability ? {
                 onConsole: (chunk) => {
-                    if (firstOutputTimer !== undefined) {
+                    if (!spec.reporting.streamConsole && chunk.payload?.kind !== "agent_observation")
+                        return;
+                    if (chunk.payload?.kind !== "agent_observation" && firstOutputTimer !== undefined) {
                         clearTimeout(firstOutputTimer);
                         firstOutputTimer = undefined;
                     }
@@ -856,6 +861,7 @@ export async function runExecution(config, input, dependencies) {
             return appendAgentMemoryContext(base, recalledMemory, Math.max(Buffer.byteLength(base, "utf8"), baseSystemPromptBudget - (context.reservedPromptBytes ?? 0)));
         };
         const localInput = {
+            ...(credential.observability ? { observability: credential.observability } : {}),
             executionId: spec.executionId,
             handle: spec.agent.handle,
             channelId: spec.context.channelId,

package/dist/host-execution-coordinator.js

@@ -302,6 +302,16 @@ export function createHostExecutionCoordinator(options = {}) {
             }
             let releasePromise = null;
             return {
+                protectProcessGroup: async (pid) => {
+                    const processIdentity = await defaultProcessController.inspectIdentity(pid);
+                    if (processIdentity === null)
+                        throw new Error("maintenance worker identity is absent");
+                    for (const lease of leases) {
+                        if (!lease.protectProcessGroup)
+                            throw new Error("lease process-group protection is unavailable");
+                        await lease.protectProcessGroup({ pid, processIdentity });
+                    }
+                },
                 release: () => {
                     if (releasePromise !== null)
                         return releasePromise;

package/dist/local-executor.js

@@ -46,6 +46,7 @@ import { commitLocalMemoryResultAfterExit, initializeLocalMemoryV2ForWorkspace,
 import { prepareLocalMemoryPrompt } from "./local-memory/prompt.js";
 import { reportLocalMemoryV2Deferred, resolveLocalMemoryV2Rollout } from "./local-memory/rollout.js";
 import { localMemoryV2Environment } from "./config.js";
+import { observationEnvironment, safeRuntimeObservation } from "./runtime-observation.js";
 export class RuntimeRunningCallbackTimeoutError extends Error {
     constructor(runtime, timeoutMs) {
         super(`${runtime} runtime-running callback timed out after ${timeoutMs}ms`);
@@ -592,7 +593,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 systemPromptPath: workspace.systemPromptPath,
                 systemPrompt: effectiveSystemPrompt,
                 wakePrompt,
-                env: runtimeEnv,
+                env: observationEnvironment(runtimeEnv, input.observability),
                 effectivePermission: input.effectivePermission,
                 ...(launchModel === undefined ? {} : { model: launchModel }),
                 ...(launchReasoning === undefined ? {} : { reasoning: launchReasoning }),
@@ -787,6 +788,12 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const event = parseLine(line);
             if (!event)
                 return;
+            if (typeof event === "object" && "type" in event && event.type === "nowwork.observation") {
+                const payload = safeRuntimeObservation(event.observation, input.observability);
+                if (payload)
+                    callbacks.onConsole?.({ stream: "system", text: "", payload });
+                return;
+            }
             nativeThreadContext?.observe(event);
             localMemoryTelemetry?.observe(event);
             if (isRuntimeReadyEvent(runtime.name, event))

package/dist/machine-info.js

@@ -1,3 +1,4 @@
+import { RUNTIME_TOOL_UPDATES_CAPABILITY } from "./runtime-tool-update-protocol.js";
 import { MAINTENANCE_CAPABILITY } from "./marketplace-maintenance-protocol.js";
 import { retryHarnessProbe } from "./runtimes/harness-probe-retry.js";
 import { MARKETPLACE_CAPABILITY } from "./marketplace-protocol.js";
@@ -40,6 +41,8 @@ export const NATIVE_PROJECT_WORKSPACE_READINESS = Object.freeze({
     nativeRuntimeAdaptersReady: true,
 });
 export const DAEMON_CAPABILITIES = Object.freeze([
+    RUNTIME_TOOL_UPDATES_CAPABILITY,
+    "execution_task_timeout_v1",
     MARKETPLACE_CAPABILITY,
     MAINTENANCE_CAPABILITY,
     "scheduled_job_v1",
@@ -74,7 +77,7 @@ export const daemonCapabilities = (runtimePlatform = process.platform, readiness
     const nativeWorkspaceReady = nativeWorkspacePlatform
         && readiness.resolverReady
         && readiness.nativeRuntimeAdaptersReady;
-    return Object.freeze(DAEMON_CAPABILITIES.filter((capability) => (((capability !== MARKETPLACE_CAPABILITY && capability !== MAINTENANCE_CAPABILITY) || nativeWorkspacePlatform)
+    return Object.freeze(DAEMON_CAPABILITIES.filter((capability) => (((capability !== MARKETPLACE_CAPABILITY && capability !== MAINTENANCE_CAPABILITY && capability !== RUNTIME_TOOL_UPDATES_CAPABILITY) || nativeWorkspacePlatform)
         && (capability !== PROJECT_WORKSPACES_CAPABILITY || nativeWorkspaceReady)
         && (capability !== "message_file_preview_v1" || nativeWorkspacePlatform)
         && (nativeWorkspacePlatform

package/dist/machine-runtime-environment.js

@@ -138,6 +138,7 @@ export function createMachineRuntimeEnvironment(options) {
     };
     return {
         provider,
+        refresh: refreshRuntimes,
         prewarm: () => {
             if (stopped || warmed)
                 return;

package/dist/managed-service-lifecycle.js

@@ -103,6 +103,16 @@ export async function installManagedService(input) {
             && record.daemonHome === input.record.daemonHome);
         if (registered !== undefined && sameManagedResource(registered, input.record)) {
             const current = await readServiceDescriptor(input.spec);
+            // Descriptor replacement and registry commit can be interrupted separately.
+            // Adopt only the exact requested descriptor with all resource fields intact.
+            if (current === requestedDescriptor) {
+                assertRecordDescribesSpec(input);
+                await ensureServiceEnabled(input.spec, input.runner);
+                await replace(services.map((record) => record === registered
+                    ? { ...record, descriptorSha256: expectedDescriptorHash }
+                    : record));
+                return;
+            }
             if (current === null || serviceDescriptorSha256(current) !== registered.descriptorSha256) {
                 throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
             }

package/dist/project-skills/execution-projection.js

@@ -85,11 +85,10 @@ export async function materializeExecutionProjection(input) {
                 continue;
             let projected;
             try {
-                // `projectDirectory`'s symlink path never lstats the source (POSIX symlink() happily
-                // creates a dangling link), so a source that vanished between scan and materialize would
-                // otherwise be silently projected as a broken link instead of failing loudly.
-                const sourceExists = await lstat(record.sourcePath).then(() => true, () => false);
-                if (!sourceExists)
+                // 源路径已由 reconciler 解析;拒绝解析后消失、变成文件或被替换为链接的目录。
+                // POSIX symlink() 本身允许断链,不能用“创建链接成功”代替源目录检查。
+                const source = await lstat(record.sourcePath).catch(() => null);
+                if (!source?.isDirectory() || source.isSymbolicLink())
                     throw new ExecutionProjectionError("link_failed");
                 projected = await project(record.sourcePath, join(root.codexSkillRoot, record.skillName), platform);
             }

package/dist/project-skills/reconciler.js

@@ -1,13 +1,14 @@
 /**
  * Project Skill 解析 + 执行编排。
- * reconcile: server 同步绑定时只解析"哪些 skill 在本机可用",不碰磁盘。
+ * reconcile: server 同步绑定时只读取"哪些 skill 在本机可用",不写入投影。
  * prepareAndLaunch: 为这一次 execution 建独占投影目录 → 启动 runtime → 进程树确认退出后删除。
  * 没有共享目录,所以没有锁、租约、manifest、GC。ownership 未确认时目录保留,交给启动 sweep。
  */
-import { lstat, stat } from "node:fs/promises";
+import { stat } from "node:fs/promises";
 import { join, resolve, sep } from "node:path";
 import { ExecutionProjectionError, materializeExecutionProjection, removeExecutionProjection, } from "./execution-projection.js";
 import { projectSkillResolutionRecords } from "./scanner.js";
+import { resolveProjectSkillDirectory } from "./source-directory.js";
 import { compareProjectSkillRefs, } from "./types.js";
 export class ProjectProjectionError extends Error {
     code;
@@ -46,16 +47,14 @@ const canonicalConflictFreeBindings = (bindings) => {
     }
     return Object.freeze(unique);
 };
-/** 源目录必须是真实目录且有 SKILL.md,否则按 missing 处理(warning,不阻断)。 */
+/** 每次从扫描入口解析真实目录,固定本次执行的链接目标;不可用则 warning,不阻断。 */
 const actualResolutionRecords = async (bindings, projects, platform) => Object.freeze(await Promise.all(projectSkillResolutionRecords(bindings, projects, platform).map(async (record) => {
     if (record.mode === "missing" || record.sourcePath === null)
         return record;
-    const [source, skillFile] = await Promise.all([
-        lstat(record.sourcePath).catch(() => null),
-        stat(join(record.sourcePath, "SKILL.md")).catch(() => null),
-    ]);
-    if (source?.isDirectory() === true && !source.isSymbolicLink() && skillFile?.isFile() === true) {
-        return record;
+    const directory = await resolveProjectSkillDirectory(record.sourcePath);
+    const skillFile = directory === null ? null : await stat(join(directory, "SKILL.md")).catch(() => null);
+    if (directory !== null && skillFile?.isFile() === true) {
+        return Object.freeze({ ...record, sourcePath: directory });
     }
     return Object.freeze({
         projectId: record.projectId,

package/dist/project-skills/scanner.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { compareProjectSkillRefs, isProjectSkillName, MAX_MACHINE_PROJECT_SKILLS, MAX_PROJECT_SKILL_DESCRIPTION_LENGTH, MAX_PROJECT_SKILL_FILE_BYTES, MAX_PROJECT_SKILLS_PER_PROJECT, } from "./types.js";
 import { parseSkillFrontmatter } from "../skill-frontmatter.js";
 import { normalizeProjectSkillResolutionRecords } from "./resolution-records.js";
+import { resolveProjectSkillDirectory } from "./source-directory.js";
 const unavailable = (projectId, scannedAt, errorCode) => Object.freeze({
     inventory: Object.freeze({
         projectId,
@@ -45,10 +46,15 @@ export async function scanProject(project, now = () => new Date()) {
     let invalidSkillCount = 0;
     const candidates = [];
     for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-        if (entry.name.startsWith(".") || !entry.isDirectory())
+        if (entry.name.startsWith(".") || (!entry.isDirectory() && !entry.isSymbolicLink()))
             continue;
         const sourcePath = join(skillsRoot, entry.name);
-        const skillPath = join(sourcePath, "SKILL.md");
+        const directory = await resolveProjectSkillDirectory(sourcePath);
+        if (directory === null) {
+            invalidSkillCount += 1;
+            continue;
+        }
+        const skillPath = join(directory, "SKILL.md");
         const skillStat = await stat(skillPath).catch(() => null);
         if (!skillStat?.isFile() || skillStat.size > MAX_PROJECT_SKILL_FILE_BYTES) {
             invalidSkillCount += 1;
@@ -70,6 +76,7 @@ export async function scanProject(project, now = () => new Date()) {
             invalidSkillCount += 1;
             continue;
         }
+        // 保留入口:执行前重新解析,才能识别链接删除或改指。
         candidates.push(Object.freeze({ name, description, sourcePath }));
     }
     const counts = new Map();

package/dist/project-skills/source-directory.js

@@ -0,0 +1,13 @@
+import { lstat, realpath } from "node:fs/promises";
+/** 跟随用户放置的源链接;只在本次操作中使用真实目录,不把它缓存为扫描入口。 */
+export async function resolveProjectSkillDirectory(sourcePath) {
+    try {
+        const directory = await realpath(sourcePath);
+        const info = await lstat(directory);
+        return info.isDirectory() && !info.isSymbolicLink() ? directory : null;
+    }
+    catch {
+        // 断链、循环或权限不足只使这个 Skill 不可用,不影响其它 Skill。
+        return null;
+    }
+}