@skylandnpm/octopus-proxy 0.1.38 → 0.1.39

package/README.md

@@ -33,6 +33,31 @@ octopus-proxy doctor
 octopus-proxy restart
 ```
 
+Claw 新建终端时若出现 `posix_spawnp failed.`，错误来自 Proxy 主机上的 PTY 启动。`node-pty 1.1.0` 的 macOS 预编译 `spawn-helper` 存在安装后缺少执行权限的[上游问题](https://github.com/microsoft/node-pty/issues/850)；同一 macOS 版本的两台电脑也可能因安装方式、CPU 架构和安装目录不同而只有一台失败。
+
+Proxy 在新建终端前检查实际加载的辅助程序，并自动补齐缺失的执行权限。`octopus-proxy doctor` 会显示辅助程序路径及当前 Node 架构，`doctor --fix` 可修复权限；检查独立于配置是否有效。若安装目录不允许当前账号修改，诊断会提示由安装账号修复或重新安装，不会自动提权。辅助程序缺失需重新安装；权限正常仍失败时，终端错误会显示 shell、工作目录、辅助程序路径和 Node 版本，供进一步核查。诊断应在发生错误的 Proxy 主机、同一 Node 安装环境下运行，之后执行 `octopus-proxy restart` 并在 Claw 新建终端。
+
+尚未升级到含此修复的 Proxy 时，可在出错的 Mac 上运行以下临时修复。它从实际 `octopus-proxy` 命令解析其 `node-pty` 依赖，只修复正在使用的辅助程序。运行时的 Node 应与 Proxy 服务一致；权限正常仍失败时，请保留输出继续排查。
+
+```sh
+node - "$(command -v octopus-proxy)" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+const requireProxy = require('node:module').createRequire(fs.realpathSync(process.argv[2]));
+const utils = requireProxy.resolve('node-pty/lib/utils.js');
+const native = requireProxy(utils).loadNativeModule('pty');
+const helper = path.resolve(path.dirname(utils), native.dir, 'spawn-helper');
+const info = fs.statSync(helper);
+if (!info.isFile()) throw new Error('spawn-helper 不是普通文件');
+console.log({ helper, mode: (info.mode & 0o777).toString(8), arch: process.arch, node: process.version });
+try { fs.accessSync(helper, fs.constants.X_OK); }
+catch { fs.chmodSync(helper, (info.mode & 0o777) | 0o111); }
+fs.accessSync(helper, fs.constants.X_OK);
+console.log('spawn-helper 执行权限正常');
+NODE
+octopus-proxy restart
+```
+
 Claw 完成主机信任和账号认证后，通过端到端会话向 Proxy 发送只读 `runtime.snapshot` 命令。响应包含当前运行状态、Hub 和工具设置、授权项目路径，以及工具可提供的模型信息；机器人 Secret、工具密码和提供商凭据不会返回。工作区的“Proxy 信息”按钮可查看这些内容。
 
 Codex 和 ZCode 由 Proxy 按授权项目启动各自的 app-server，默认随 Proxy 自动启动；服务未就绪时也可在 Claw 点击“启动服务”。若命令不可执行或某个项目启动失败，工作区会显示失败项目及原因。修改命令路径或授权项目后，运行 `octopus-proxy restart` 使配置生效。
@@ -65,6 +90,18 @@ octopus-proxy onboard --tool pi
 
 协议和验证详情见 [Pi 接入说明](../../docs/pi-protocol-notes.md)。
 
+## 更新
+
+在交互式终端中运行：
+
+```sh
+octopus-proxy update
+```
+
+命令通过 `npm view @skylandnpm/octopus-proxy@latest version` 查询最新版本。存在新版本时，输入 `y` 或 `yes` 确认覆盖安装；直接回车或输入其他内容会取消。确认后依次停止已安装的服务、使用 npm 全局安装查到的版本、重启服务，并校验安装版本和运行状态后反馈结果。配置、主机身份和已有服务定义会保留；未安装服务时仅更新 npm 包。
+
+更新失败时会尝试恢复原先运行的服务，并报告安装及恢复结果；包安装失败不保证旧版本文件完整保留。已安装新版本但重启失败时会单独提示，可运行 `octopus-proxy doctor` 和 `octopus-proxy logs` 排查。此命令用于 npm 全局安装，停止服务前会检查 npm 安装目录是否与当前命令一致；源码、本地安装或 Node.js 环境不一致时会中止并给出提示。
+
 ## 发布
 
 在 `apps/octopus-proxy` 目录执行 `npm run publish`：先递增 `package.json` 的补丁版本，再编译，最后发布。即使编译或发布失败，版本号也会保留递增结果，重试时继续递增。版本更新不会自动创建 Git 提交或标签。先登录有权发布 `@skylandnpm` 包的 npm 账号：

package/dist/{chunk-6DTK4JVV.js → chunk-BYXUILAK.js}

@@ -402,11 +402,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants5) {
+      optimizeNames(names, constants6) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants5);
+          this.rhs = optimizeExpr(this.rhs, names, constants6);
         return this;
       }
       get names() {
@@ -423,10 +423,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants5) {
+      optimizeNames(names, constants6) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants5);
+        this.rhs = optimizeExpr(this.rhs, names, constants6);
         return this;
       }
       get names() {
@@ -487,8 +487,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants5) {
-        this.code = optimizeExpr(this.code, names, constants5);
+      optimizeNames(names, constants6) {
+        this.code = optimizeExpr(this.code, names, constants6);
         return this;
       }
       get names() {
@@ -517,12 +517,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants5) {
+      optimizeNames(names, constants6) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants5))
+          if (n.optimizeNames(names, constants6))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -575,12 +575,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants5) {
+      optimizeNames(names, constants6) {
         var _a;
-        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants5);
-        if (!(super.optimizeNames(names, constants5) || this.else))
+        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants6);
+        if (!(super.optimizeNames(names, constants6) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants5);
+        this.condition = optimizeExpr(this.condition, names, constants6);
         return this;
       }
       get names() {
@@ -603,10 +603,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants5) {
-        if (!super.optimizeNames(names, constants5))
+      optimizeNames(names, constants6) {
+        if (!super.optimizeNames(names, constants6))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants5);
+        this.iteration = optimizeExpr(this.iteration, names, constants6);
         return this;
       }
       get names() {
@@ -642,10 +642,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants5) {
-        if (!super.optimizeNames(names, constants5))
+      optimizeNames(names, constants6) {
+        if (!super.optimizeNames(names, constants6))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants5);
+        this.iterable = optimizeExpr(this.iterable, names, constants6);
         return this;
       }
       get names() {
@@ -687,11 +687,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants5) {
+      optimizeNames(names, constants6) {
         var _a, _b;
-        super.optimizeNames(names, constants5);
-        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants5);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants5);
+        super.optimizeNames(names, constants6);
+        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants6);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants6);
         return this;
       }
       get names() {
@@ -992,7 +992,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants5) {
+    function optimizeExpr(expr, names, constants6) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -1007,14 +1007,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants5[n.str];
+        const c = constants6[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants5[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants6[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -2976,7 +2976,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve4.call(this, root, ref);
+      let _sch = resolve5.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3003,7 +3003,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve4(root, ref) {
+    function resolve5(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3833,7 +3833,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve4(baseURI, relativeURI, options) {
+    function resolve5(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -4202,7 +4202,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve4,
+      resolve: resolve5,
       resolveComponent,
       equal,
       serialize,
@@ -12310,9 +12310,9 @@ async function ensureHostAuth(stateDirectory) {
   compiler.stderr.on("data", (chunk) => {
     diagnostics += String(chunk).slice(0, 4096);
   });
-  const exit = await new Promise((resolve4, reject) => {
+  const exit = await new Promise((resolve5, reject) => {
     compiler.on("error", reject);
-    compiler.on("exit", (code) => resolve4(code ?? 1));
+    compiler.on("exit", (code) => resolve5(code ?? 1));
   });
   if (exit !== 0) {
     await unlink4(temporary).catch(() => {
@@ -12343,9 +12343,9 @@ async function verifyHostPassword(stateDirectory, username, password) {
   });
   const timer = setTimeout(() => child.kill("SIGKILL"), 1e4);
   try {
-    const code = await new Promise((resolve4, reject) => {
+    const code = await new Promise((resolve5, reject) => {
       child.on("error", reject);
-      child.on("exit", (value) => resolve4(value ?? 1));
+      child.on("exit", (value) => resolve5(value ?? 1));
     });
     return code === 0 && output.trim() === "OK";
   } finally {
@@ -12359,12 +12359,12 @@ var ScreenLockError = class extends Error {
 var nativeErrors = {
   permission: "\u8BF7\u5728 Proxy \u4E3B\u673A\u201C\u7CFB\u7EDF\u8BBE\u7F6E \u2192 \u9690\u79C1\u4E0E\u5B89\u5168\u6027 \u2192 \u8F85\u52A9\u529F\u80FD\u201D\u4E2D\u6388\u6743\u5B9E\u9645\u8FD0\u884C Proxy \u7684\u7A0B\u5E8F\uFF0C\u5E76\u91CD\u542F Proxy\u3002",
   session: "\u65E0\u6CD5\u8BBF\u95EE Proxy \u7528\u6237\u7684\u6D3B\u52A8\u56FE\u5F62\u4F1A\u8BDD\uFF1B\u4E0D\u652F\u6301\u767B\u5F55\u524D\u3001FileVault \u542F\u52A8\u89E3\u9501\u6216\u5207\u6362\u5230\u5176\u4ED6\u7528\u6237\u7684\u5C4F\u5E55\u3002",
-  focus: "\u672A\u627E\u5230 loginwindow \u7684\u5BC6\u7801\u8F93\u5165\u6846\uFF0C\u8BF7\u5728\u4E3B\u673A\u663E\u793A\u5F53\u524D\u7528\u6237\u7684\u5BC6\u7801\u89E3\u9501\u754C\u9762\u540E\u91CD\u8BD5\u3002",
+  focus: "\u5DF2\u5524\u9192\u9501\u5C4F\u754C\u9762\uFF0C\u4F46\u7CFB\u7EDF\u672A\u63D0\u4F9B\u53EF\u8BBF\u95EE\u7684\u5BC6\u7801\u8F93\u5165\u6846\u3002\u8BF7\u786E\u8BA4 Proxy \u670D\u52A1\u7684\u8F85\u52A9\u529F\u80FD\u6388\u6743\u5DF2\u751F\u6548\u5E76\u91CD\u542F\u670D\u52A1\uFF1B\u82E5\u4ECD\u5931\u8D25\uFF0C\u8BF7\u63D0\u4F9B macOS \u7248\u672C\u4EE5\u68C0\u67E5\u9501\u5C4F\u754C\u9762\u517C\u5BB9\u6027\u3002",
   changed: "\u4E3B\u673A\u9501\u5C4F\u72B6\u6001\u6216\u5BC6\u7801\u8F93\u5165\u7126\u70B9\u5DF2\u53D8\u5316\uFF0C\u5DF2\u505C\u6B62\u8F93\u5165\uFF0C\u8BF7\u91CD\u8BD5\u3002",
   timeout: "\u4E3B\u673A\u5C4F\u5E55\u4ECD\u9501\u5B9A\uFF0C\u7CFB\u7EDF\u672A\u63A5\u53D7\u89E3\u9501\u8F93\u5165\uFF1B\u8BF7\u68C0\u67E5\u8F85\u52A9\u529F\u80FD\u6743\u9650\u548C\u9501\u5C4F\u754C\u9762\u540E\u91CD\u8BD5\u3002",
   password: "\u4E3B\u673A\u5BC6\u7801\u683C\u5F0F\u65E0\u6548\u3002"
 };
-var executeScreenLock = (file, args, input, signal) => new Promise((resolve4, reject) => {
+var executeScreenLock = (file, args, input, signal) => new Promise((resolve5, reject) => {
   if (signal?.aborted) {
     reject(new ScreenLockError("\u8FDE\u63A5\u5DF2\u5173\u95ED\uFF0C\u5C4F\u5E55\u89E3\u9501\u5DF2\u53D6\u6D88\u3002"));
     return;
@@ -12392,7 +12392,7 @@ var executeScreenLock = (file, args, input, signal) => new Promise((resolve4, re
     clearTimeout(timer);
     if (signal?.aborted) reject(new ScreenLockError("\u8FDE\u63A5\u5DF2\u5173\u95ED\uFF0C\u5C4F\u5E55\u89E3\u9501\u5DF2\u53D6\u6D88\u3002"));
     else if (code !== 0 || output.length > 4096) reject(new ScreenLockError(timedOut ? "\u5C4F\u5E55\u89E3\u9501\u64CD\u4F5C\u8D85\u65F6\uFF0C\u8BF7\u68C0\u67E5\u4E3B\u673A\u72B6\u6001\u540E\u91CD\u8BD5\u3002" : nativeErrors[diagnostic.trim()] ?? "\u5C4F\u5E55\u89E3\u9501\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u4E3B\u673A\u7684\u56FE\u5F62\u4F1A\u8BDD\u3001\u7CFB\u7EDF\u6743\u9650\u53CA\u4F9D\u8D56\u3002"));
-    else resolve4(output);
+    else resolve5(output);
   });
   child.stdin.end(input);
 });
@@ -15059,8 +15059,8 @@ var OpenCodeAdapter = class {
           return;
         }
         if (["failed", "expired"].includes(state.status)) throw new Error("OpenCode OAuth failed");
-        await new Promise((resolve4, reject) => {
-          const timer = setTimeout(resolve4, 1e3);
+        await new Promise((resolve5, reject) => {
+          const timer = setTimeout(resolve5, 1e3);
           controller.signal.addEventListener("abort", () => {
             clearTimeout(timer);
             reject(controller.signal.reason);
@@ -15120,7 +15120,7 @@ var OpenCodeAdapter = class {
         } catch {
           if (!controller.signal.aborted) this.emit(project, "octopus.disconnected", {});
         }
-        if (!controller.signal.aborted) await new Promise((resolve4) => setTimeout(resolve4, 2e3));
+        if (!controller.signal.aborted) await new Promise((resolve5) => setTimeout(resolve5, 2e3));
       }
     };
     void loop();
@@ -15172,8 +15172,8 @@ var OpenCodeAdapter = class {
           this.emit(project, "terminal.closed", { id: p.id });
         }
       });
-      await new Promise((resolve4, reject) => {
-        socket2.once("open", resolve4);
+      await new Promise((resolve5, reject) => {
+        socket2.once("open", resolve5);
         socket2.once("error", reject);
       });
       socket2.on("error", () => {
@@ -15356,8 +15356,8 @@ var Runtime = class {
         detached: true,
         stdio: ["ignore", log.fd, log.fd]
       });
-      await new Promise((resolve4, reject) => {
-        child.once("spawn", resolve4);
+      await new Promise((resolve5, reject) => {
+        child.once("spawn", resolve5);
         child.once("error", reject);
       });
       child.on("error", () => {
@@ -15385,7 +15385,7 @@ var Runtime = class {
     while (Date.now() < deadline) {
       if (child.exitCode !== null || child.signalCode !== null) break;
       if (await this.health()) return this.status();
-      await new Promise((resolve4) => setTimeout(resolve4, 250));
+      await new Promise((resolve5) => setTimeout(resolve5, 250));
     }
     if (child.exitCode === null && child.signalCode === null) child.kill("SIGTERM");
     await rm2(this.endpointStatePath, { force: true }).catch(() => {
@@ -15410,13 +15410,13 @@ var Runtime = class {
   async reserveFallbackUrl(configured) {
     const host = configured.hostname === "[::1]" ? "::1" : configured.hostname;
     const server = createServer();
-    await new Promise((resolve4, reject) => {
+    await new Promise((resolve5, reject) => {
       server.once("error", reject);
-      server.listen(0, host, resolve4);
+      server.listen(0, host, resolve5);
     });
     const address = server.address();
     const port = typeof address === "object" && address ? address.port : 0;
-    await new Promise((resolve4, reject) => server.close((error) => error ? reject(error) : resolve4()));
+    await new Promise((resolve5, reject) => server.close((error) => error ? reject(error) : resolve5()));
     if (!port) throw new Error("\u65E0\u6CD5\u4E3A OpenCode \u5206\u914D\u5907\u7528\u56DE\u73AF\u7AEF\u53E3");
     const fallback = new URL(configured.origin);
     fallback.port = String(port);
@@ -15483,7 +15483,7 @@ var LineRpc = class {
     return this.closed || this.child.exitCode !== null || this.child.signalCode !== null;
   }
   request(method, params, timeoutMs = 35e3) {
-    const attempt = (wrapped) => new Promise((resolve4, reject) => {
+    const attempt = (wrapped) => new Promise((resolve5, reject) => {
       if (this.closed) {
         reject(interrupted(`App server connection closed before ${method}`));
         return;
@@ -15493,7 +15493,7 @@ var LineRpc = class {
         this.pending.delete(String(id));
         reject(Object.assign(new Error(`Timed out waiting for ${method}`), { name: "TimeoutError" }));
       }, timeoutMs);
-      this.pending.set(String(id), { resolve: (value) => resolve4(value), reject, timer });
+      this.pending.set(String(id), { resolve: (value) => resolve5(value), reject, timer });
       try {
         this.write(this.protocol === "pi" ? { ...params, type: method, id: String(id) } : wrapped ? wrapEnvelope({ method, id, params }) : { method, id, params });
       } catch (error) {
@@ -15710,7 +15710,7 @@ var StdioRuntime = class {
     if (!child) return;
     this.refreshing.add(projectId);
     try {
-      const exited = child.exitCode !== null || child.signalCode !== null ? Promise.resolve() : new Promise((resolve4) => child.once("exit", () => resolve4()));
+      const exited = child.exitCode !== null || child.signalCode !== null ? Promise.resolve() : new Promise((resolve5) => child.once("exit", () => resolve5()));
       this.kill(projectId);
       await exited;
     } finally {
@@ -15837,8 +15837,8 @@ ${bytes.toString("utf8")}`);
         if (this.children.get(projectId) === child) this.onExited(projectId, `\u8FDB\u7A0B\u9000\u51FA\uFF08${code ?? signal}\uFF09`);
       });
       try {
-        await new Promise((resolve4, reject) => {
-          child.once("spawn", resolve4);
+        await new Promise((resolve5, reject) => {
+          child.once("spawn", resolve5);
           child.once("error", reject);
         });
         this.failures.delete(projectId);
@@ -17191,11 +17191,11 @@ ${bytes.toString("utf8")}`);
     this.processes.delete(key);
     const { child, rpc } = entry;
     if (!child.pid || child.exitCode !== null || child.signalCode !== null) return;
-    await new Promise((resolve4) => {
+    await new Promise((resolve5) => {
       const timer = setTimeout(() => child.kill("SIGKILL"), 5e3);
       child.once("exit", () => {
         clearTimeout(timer);
-        resolve4();
+        resolve5();
       });
       rpc.destroy();
       child.kill("SIGTERM");
@@ -17347,10 +17347,61 @@ var ProjectRegistry = class {
 
 // src/terminal.ts
 import { randomUUID as randomUUID16 } from "node:crypto";
-import { access } from "node:fs/promises";
-import { constants as constants4 } from "node:fs";
+import { access as access2, stat as stat10 } from "node:fs/promises";
+import { constants as constants5 } from "node:fs";
 import { platform as platform3, userInfo as userInfo4 } from "node:os";
 import * as pty from "node-pty";
+
+// src/terminal-support.ts
+import { createRequire } from "node:module";
+import { access, chmod as chmod4, stat as stat9 } from "node:fs/promises";
+import { constants as constants4 } from "node:fs";
+import { dirname as dirname6, resolve as resolve4 } from "node:path";
+var require2 = createRequire(import.meta.url);
+function terminalHelperPath() {
+  const utilsPath = require2.resolve("node-pty/lib/utils.js");
+  const native = require2(utilsPath).loadNativeModule("pty");
+  return resolve4(dirname6(utilsPath), native.dir, "spawn-helper");
+}
+async function prepareTerminalHelper(path, fix) {
+  const info = await stat9(path);
+  if (!info.isFile()) throw new Error(`\u7EC8\u7AEF\u8F85\u52A9\u7A0B\u5E8F\u4E0D\u662F\u666E\u901A\u6587\u4EF6\uFF1A${path}`);
+  try {
+    await access(path, constants4.X_OK);
+    return false;
+  } catch {
+    if (!fix) throw new Error(`\u7EC8\u7AEF\u8F85\u52A9\u7A0B\u5E8F\u7F3A\u5C11\u6267\u884C\u6743\u9650\uFF1A${path}\uFF1B\u8FD0\u884C octopus-proxy doctor --fix \u4FEE\u590D`);
+    try {
+      await chmod4(path, info.mode & 511 | 73);
+      await access(path, constants4.X_OK);
+      return true;
+    } catch (error) {
+      throw new Error(`\u65E0\u6CD5\u4FEE\u590D\u7EC8\u7AEF\u8F85\u52A9\u7A0B\u5E8F\u6267\u884C\u6743\u9650\uFF1A${path}\uFF1B\u8BF7\u7531\u5B89\u88C5\u8BE5 Proxy \u7684\u8D26\u53F7\u8FD0\u884C octopus-proxy doctor --fix\uFF0C\u6216\u91CD\u65B0\u5B89\u88C5 Proxy\u3002${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+async function ensureTerminalSupport(fix = true) {
+  if (process.platform !== "darwin") return { repaired: false };
+  const helper = terminalHelperPath();
+  try {
+    return { helper, repaired: await prepareTerminalHelper(helper, fix) };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(`\u7EC8\u7AEF\u8F85\u52A9\u7A0B\u5E8F\u7F3A\u5931\uFF1A${helper}\uFF1B\u8BF7\u91CD\u65B0\u5B89\u88C5 @skylandnpm/octopus-proxy`);
+    }
+    throw error;
+  }
+}
+async function checkTerminalSupport(fix) {
+  try {
+    const result = await ensureTerminalSupport(fix);
+    return { name: "\u7EC8\u7AEF PTY \u652F\u6301", status: "ok", detail: result.helper ? `${result.repaired ? "\u5DF2\u4FEE\u590D\u6267\u884C\u6743\u9650\uFF1A" : ""}${result.helper}\uFF08${process.arch}\uFF09` : "\u5F53\u524D\u5E73\u53F0\u65E0\u9700 macOS spawn-helper" };
+  } catch (error) {
+    return { name: "\u7EC8\u7AEF PTY \u652F\u6301", status: "fail", detail: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+// src/terminal.ts
 var TerminalManager = class {
   constructor(workspace, emit) {
     this.workspace = workspace;
@@ -17372,16 +17423,27 @@ var TerminalManager = class {
       const count = [...this.terminals.values()].filter((t) => t.owner === owner).length;
       if (count >= 8) throw new Error("Terminal limit reached");
       const cwd = await this.workspace.path(project, typeof p.cwd === "string" ? p.cwd : ".");
+      if (!(await stat10(cwd)).isDirectory()) throw new Error(`\u7EC8\u7AEF\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u76EE\u5F55\uFF1A${cwd}`);
       const shell = process.env.SHELL || (platform3() === "darwin" ? "/bin/zsh" : "/bin/sh");
-      await access(shell, constants4.X_OK);
+      try {
+        await access2(shell, constants5.X_OK);
+      } catch {
+        throw new Error(`\u7EC8\u7AEF Shell \u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u6267\u884C\uFF1A${shell}\uFF1B\u8BF7\u4FEE\u6B63 Proxy \u670D\u52A1\u7684 SHELL \u73AF\u5883\u53D8\u91CF`);
+      }
+      const { helper } = await ensureTerminalSupport();
       const id = randomUUID16();
-      const terminalProcess = pty.spawn(shell, [], {
-        name: "xterm-256color",
-        cols: 80,
-        rows: 24,
-        cwd,
-        env: { PATH: process.env.PATH || "/usr/bin:/bin", HOME: userInfo4().homedir, TERM: "xterm-256color", USER: userInfo4().username }
-      });
+      let terminalProcess;
+      try {
+        terminalProcess = pty.spawn(shell, [], {
+          name: "xterm-256color",
+          cols: 80,
+          rows: 24,
+          cwd,
+          env: { PATH: process.env.PATH || "/usr/bin:/bin", HOME: userInfo4().homedir, TERM: "xterm-256color", USER: userInfo4().username }
+        });
+      } catch (error) {
+        throw new Error(`\u7EC8\u7AEF\u542F\u52A8\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}\uFF08shell=${shell}\uFF0Ccwd=${cwd}${helper ? `\uFF0Chelper=${helper}` : ""}\uFF0C${process.platform}/${process.arch}\uFF0CNode ${process.version}\uFF09\uFF1B\u8BF7\u5728 Proxy \u4E3B\u673A\u8FD0\u884C octopus-proxy doctor --fix \u68C0\u67E5`);
+      }
       const terminal2 = { id, project, owner, process: terminalProcess, history: "" };
       this.terminals.set(id, terminal2);
       terminalProcess.onData((data) => {
@@ -17434,7 +17496,7 @@ var TerminalManager = class {
 import { execFile as execFile6 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
 import { createHash as createHash9, randomUUID as randomUUID17 } from "node:crypto";
-import { chmod as chmod4, mkdir as mkdir10, mkdtemp, readFile as readFile9, rename as rename5, rm as rm4, stat as stat9 } from "node:fs/promises";
+import { chmod as chmod5, mkdir as mkdir10, mkdtemp, readFile as readFile9, rename as rename5, rm as rm4, stat as stat11 } from "node:fs/promises";
 import { join as join13 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var DESKTOP_IMAGE_LIMIT = 20 * 1024 * 1024;
@@ -17504,12 +17566,12 @@ var PlatformDesktop = class {
       await mkdir10(this.stateDirectory, { recursive: true, mode: 448 });
       const target = join13(this.stateDirectory, "octopus-desktop-capture");
       const source = fileURLToPath5(new URL("../native/desktop-macos.m", import.meta.url));
-      const sourceInfo = await stat9(source), existing = await stat9(target).catch(() => null);
+      const sourceInfo = await stat11(source), existing = await stat11(target).catch(() => null);
       if (existing?.isFile() && existing.mtimeMs >= sourceInfo.mtimeMs && (existing.mode & 63) === 0) return target;
       const temporary = `${target}.${randomUUID17()}`;
       try {
         await this.execute("/usr/bin/clang", ["-O2", "-fobjc-arc", "-mmacosx-version-min=12.3", "-framework", "Foundation", "-framework", "AppKit", "-framework", "ScreenCaptureKit", "-framework", "CoreMedia", "-framework", "CoreVideo", "-framework", "VideoToolbox", "-framework", "ImageIO", source, "-o", temporary]);
-        await chmod4(temporary, 448);
+        await chmod5(temporary, 448);
         await rename5(temporary, target);
         return target;
       } finally {
@@ -17617,7 +17679,7 @@ var PlatformDesktop = class {
           await this.execute("import", args);
         }
       }
-      const info = await stat9(output);
+      const info = await stat11(output);
       if (!info.isFile() || !info.size || info.size > DESKTOP_IMAGE_LIMIT) throw new Error("\u684C\u9762\u622A\u56FE\u4E3A\u7A7A\u6216\u8D85\u8FC7 20 MiB \u4E0A\u9650\u3002");
       return { display, bytes: await readFile9(output) };
     } finally {
@@ -17834,6 +17896,7 @@ export {
   ensureHostIdentity,
   createRuntime,
   createAdapter,
+  checkTerminalSupport,
   DESKTOP_PERMISSION_GUIDANCE,
   requestDesktopPermission,
   checkDesktop,

package/dist/cli.js

@@ -9,6 +9,7 @@ import {
   Workspace,
   atomicJson,
   checkDesktop,
+  checkTerminalSupport,
   createAdapter,
   createRuntime,
   daemonEntryPath,
@@ -27,10 +28,10 @@ import {
   runDaemon,
   supportedPlatform,
   systemdUnitPath
-} from "./chunk-6DTK4JVV.js";
+} from "./chunk-BYXUILAK.js";
 
 // src/cli.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import { access as access4 } from "node:fs/promises";
 
 // src/doctor.ts
@@ -161,9 +162,9 @@ async function launchdUninstall() {
 }
 async function launchdStatus() {
   try {
-    const { stdout: stdout2 } = await run2("launchctl", ["print", `${guiDomain()}/${SERVICE_LABEL}`]);
-    const running = /state = running/.test(stdout2);
-    const pid = Number(/pid = (\d+)/.exec(stdout2)?.[1]);
+    const { stdout: stdout3 } = await run2("launchctl", ["print", `${guiDomain()}/${SERVICE_LABEL}`]);
+    const running = /state = running/.test(stdout3);
+    const pid = Number(/pid = (\d+)/.exec(stdout3)?.[1]);
     return { loaded: true, running, pid: Number.isFinite(pid) && pid > 0 ? pid : void 0 };
   } catch {
     return { loaded: false, running: false };
@@ -212,8 +213,8 @@ async function writeUnitFile(text) {
 }
 async function systemctl(args) {
   try {
-    const { stdout: stdout2 } = await run3("systemctl", ["--user", ...args]);
-    return stdout2;
+    const { stdout: stdout3 } = await run3("systemctl", ["--user", ...args]);
+    return stdout3;
   } catch (error) {
     const stderr = error instanceof Error ? error.stderr ?? error.message : String(error);
     if (/Failed to connect to bus|D-Bus connection/i.test(String(stderr))) {
@@ -342,6 +343,7 @@ var run4 = promisify4(execFile4);
 async function runDoctor(opts) {
   const results = [];
   const record = (name, status, detail) => results.push({ name, status, detail });
+  results.push(await checkTerminalSupport(opts.fix));
   let config;
   try {
     const info = await stat2(opts.configPath).catch((error) => {
@@ -377,8 +379,8 @@ async function runDoctor(opts) {
       record(checkName, "fail", `${command2} \u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u6267\u884C`);
     } else {
       try {
-        const { stdout: stdout2 } = await run4(command2, [...descriptor.versionArgs], { timeout: 15e3 });
-        const version = stdout2.trim().split("\n")[0].trim();
+        const { stdout: stdout3 } = await run4(command2, [...descriptor.versionArgs], { timeout: 15e3 });
+        const version = stdout3.trim().split("\n")[0].trim();
         if (version === descriptor.baseline) record(checkName, "ok", `${command2}\uFF08${version}\uFF09`);
         else if (descriptor.versionPolicy === "exact") record(checkName, "warn", `${command2} \u7248\u672C\u4E3A ${version}\uFF0C\u5DF2\u9A8C\u8BC1\u57FA\u7EBF\u662F ${descriptor.baseline}\uFF08\u8BF7\u786E\u8BA4\u5916\u90E8\u670D\u52A1 API \u517C\u5BB9\uFF09`);
         else record(checkName, "warn", `${command2} \u7248\u672C\u4E3A ${version}\uFF0C\u5DF2\u9A8C\u8BC1\u57FA\u7EBF\u662F ${descriptor.baseline}\uFF1B\u5DE5\u5177\u534F\u8BAE\u53EF\u80FD\u6F02\u79FB`);
@@ -719,6 +721,137 @@ async function manageProjects(configPath2, remove) {
   }
 }
 
+// src/update.ts
+import { execFile as execFile6, spawn } from "node:child_process";
+import { readFile as readFile3, realpath as realpath2 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+import { stdin as stdin2, stdout as stdout2 } from "node:process";
+import { createInterface as createInterface2 } from "node:readline/promises";
+import { setTimeout as delay } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+import { promisify as promisify6 } from "node:util";
+var PACKAGE = "@skylandnpm/octopus-proxy";
+var REGISTRY = "https://registry.npmjs.org";
+var packageDirectory = fileURLToPath(new URL("../", import.meta.url));
+var run6 = promisify6(execFile6);
+function parseVersion(version) {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*))?(?:\+[\da-zA-Z-]+(?:\.[\da-zA-Z-]+)*)?$/.exec(version);
+  if (!match) throw new Error(`\u65E0\u6548\u7684\u7248\u672C\u53F7\uFF1A${version}`);
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part.startsWith("0"))) throw new Error(`\u65E0\u6548\u7684\u7248\u672C\u53F7\uFF1A${version}`);
+  return { core: match.slice(1, 4).map((part) => BigInt(part)), prerelease };
+}
+function isNewerVersion(latest, current) {
+  const a = parseVersion(latest), b = parseVersion(current);
+  for (let i = 0; i < 3; i++) if (a.core[i] !== b.core[i]) return a.core[i] > b.core[i];
+  if (!a.prerelease.length || !b.prerelease.length) return !a.prerelease.length && b.prerelease.length > 0;
+  for (let i = 0; i < Math.max(a.prerelease.length, b.prerelease.length); i++) {
+    const x = a.prerelease[i], y = b.prerelease[i];
+    if (x === y) continue;
+    if (x === void 0 || y === void 0) return y === void 0;
+    const xNumeric = /^\d+$/.test(x), yNumeric = /^\d+$/.test(y);
+    if (xNumeric && yNumeric) return BigInt(x) > BigInt(y);
+    if (xNumeric !== yNumeric) return !xNumeric;
+    return x > y;
+  }
+  return false;
+}
+function message(error) {
+  if (!(error instanceof Error)) return String(error);
+  return String(error.stderr || error.message).trim();
+}
+async function npmOutput(args) {
+  try {
+    const { stdout: stdout3 } = await run6("npm", args, { timeout: 3e4, maxBuffer: 1024 * 1024 });
+    return stdout3.trim();
+  } catch (error) {
+    throw new Error(`npm ${args[0]} \u5931\u8D25\uFF1A${message(error)}`);
+  }
+}
+async function confirmUpdate(latest) {
+  if (!stdin2.isTTY) throw new Error("\u66F4\u65B0\u9700\u8981\u5728\u4EA4\u4E92\u5F0F\u7EC8\u7AEF\u4E2D\u786E\u8BA4\uFF1B\u8BF7\u5728\u7EC8\u7AEF\u8FD0\u884C octopus-proxy update");
+  const rl = createInterface2({ input: stdin2, output: stdout2 });
+  try {
+    return /^(y|yes|是|确认)$/i.test((await rl.question(`\u662F\u5426\u8986\u76D6\u5B89\u88C5 ${proxyVersion} \u2192 ${latest}\uFF1F\u66F4\u65B0\u4F1A\u505C\u6B62\u5E76\u91CD\u542F\u670D\u52A1 [y/N]: `)).trim());
+  } finally {
+    rl.close();
+  }
+}
+async function installVersion(version, prefix) {
+  const child = spawn("npm", ["install", "--global", "--prefix", prefix, `${PACKAGE}@${version}`, "--prefer-online", "--registry", REGISTRY], { stdio: "inherit" });
+  await new Promise((resolve2, reject) => {
+    child.once("error", (error) => reject(new Error(`\u65E0\u6CD5\u6267\u884C npm install\uFF1A${message(error)}`)));
+    child.once("exit", (code, signal) => code === 0 ? resolve2() : reject(new Error(`npm install \u5931\u8D25\uFF08${signal ? `\u4FE1\u53F7 ${signal}` : `\u9000\u51FA\u7801 ${code}`}\uFF09`)));
+  });
+}
+async function restartAndVerify() {
+  await controlService("restart");
+  for (let attempt = 0; attempt < 20; attempt++) {
+    if ((await serviceStatus()).active) return;
+    await delay(250);
+  }
+  throw new Error(`\u670D\u52A1\u91CD\u542F\u540E\u672A\u8FD0\u884C\uFF1B\u8BF7\u8FD0\u884C octopus-proxy doctor / logs \u68C0\u67E5\uFF08${logLocationHint()}\uFF09`);
+}
+async function runUpdate() {
+  console.log(`\u5F53\u524D\u7248\u672C\uFF1A${proxyVersion}\uFF1B\u6B63\u5728\u67E5\u8BE2 npm \u6700\u65B0\u7248\u672C\u2026`);
+  const output = await npmOutput(["view", `${PACKAGE}@latest`, "version", "--json", "--prefer-online", "--registry", REGISTRY]);
+  let latest;
+  try {
+    latest = JSON.parse(output);
+  } catch {
+    throw new Error("npm view \u8FD4\u56DE\u4E86\u65E0\u6548\u7684\u7248\u672C\u4FE1\u606F");
+  }
+  if (typeof latest !== "string") throw new Error("npm view \u8FD4\u56DE\u4E86\u65E0\u6548\u7684\u7248\u672C\u4FE1\u606F");
+  if (!isNewerVersion(latest, proxyVersion)) {
+    console.log(`\u65E0\u9700\u66F4\u65B0\uFF1A\u5F53\u524D\u7248\u672C ${proxyVersion}\uFF0Cnpm \u6700\u65B0\u7248\u672C ${latest}`);
+    return;
+  }
+  console.log(`\u53D1\u73B0\u65B0\u7248\u672C\uFF1A${latest}`);
+  if (!await confirmUpdate(latest)) {
+    console.log("\u5DF2\u53D6\u6D88\u66F4\u65B0");
+    return;
+  }
+  const prefix = await npmOutput(["prefix", "--global"]);
+  const target = join4(prefix, "lib", "node_modules", PACKAGE);
+  const installedDirectory = await realpath2(target).catch(() => null);
+  if (installedDirectory !== await realpath2(packageDirectory)) {
+    throw new Error("\u5F53\u524D\u547D\u4EE4\u4E0D\u5C5E\u4E8E npm \u7684\u5168\u5C40\u5B89\u88C5\u76EE\u5F55\uFF1B\u8BF7\u786E\u8BA4 npm \u4E0E octopus-proxy \u4F7F\u7528\u540C\u4E00\u5957 Node.js \u73AF\u5883\uFF0C\u5E76\u4ECE\u5168\u5C40\u5B89\u88C5\u8FD0\u884C update");
+  }
+  const state = await serviceStatus();
+  try {
+    if (state.installed) {
+      console.log("\u6B63\u5728\u505C\u6B62\u670D\u52A1\u2026");
+      await controlService("stop");
+      if ((await serviceStatus()).active) throw new Error("\u670D\u52A1\u4ECD\u5728\u8FD0\u884C\uFF0C\u5DF2\u4E2D\u6B62\u8986\u76D6\u5B89\u88C5");
+    }
+    console.log(`\u6B63\u5728\u5B89\u88C5 ${PACKAGE}@${latest}\u2026`);
+    await installVersion(latest, prefix);
+    const installed = JSON.parse(await readFile3(join4(target, "package.json"), "utf8"));
+    if (installed.version !== latest) throw new Error(`\u5B89\u88C5\u7248\u672C\u6821\u9A8C\u5931\u8D25\uFF1A\u671F\u671B ${latest}\uFF0C\u5B9E\u9645 ${installed.version ?? "\u672A\u77E5"}`);
+  } catch (error) {
+    let recovery = "";
+    if (state.active) {
+      console.log("\u66F4\u65B0\u5931\u8D25\uFF0C\u6B63\u5728\u5C1D\u8BD5\u6062\u590D\u670D\u52A1\u2026");
+      try {
+        await restartAndVerify();
+        recovery = "\uFF1B\u670D\u52A1\u5DF2\u6062\u590D\u8FD0\u884C";
+      } catch (restartError) {
+        recovery = `\uFF1B\u670D\u52A1\u6062\u590D\u5931\u8D25\uFF1A${message(restartError)}`;
+      }
+    }
+    throw new Error(`\u66F4\u65B0\u5931\u8D25\uFF1A${message(error)}${recovery}`);
+  }
+  if (state.installed) {
+    console.log("\u5B89\u88C5\u5B8C\u6210\uFF0C\u6B63\u5728\u91CD\u542F\u670D\u52A1\u2026");
+    try {
+      await restartAndVerify();
+    } catch (error) {
+      throw new Error(`\u5DF2\u66F4\u65B0\u81F3 ${latest}\uFF0C\u4F46\u670D\u52A1\u91CD\u542F\u5931\u8D25\uFF1A${message(error)}`);
+    }
+  }
+  console.log(`\u66F4\u65B0\u6210\u529F\uFF1A${proxyVersion} \u2192 ${latest}\uFF1B${state.installed ? "\u670D\u52A1\u5DF2\u91CD\u542F\u5E76\u8FD0\u884C" : "\u5C1A\u672A\u5B89\u88C5\u670D\u52A1\uFF0C\u53EF\u8FD0\u884C octopus-proxy install \u5B89\u88C5"}`);
+}
+
 // src/cli.ts
 var USAGE = `octopus-proxy \u2014 Octopus \u4E3B\u673A\u4EE3\u7406
 
@@ -729,6 +862,7 @@ var USAGE = `octopus-proxy \u2014 Octopus \u4E3B\u673A\u4EE3\u7406
   projects    \u5217\u51FA\u6388\u6743\u9879\u76EE\uFF1B\u53EF\u6309\u5E8F\u53F7\u5220\u9664\u9519\u8BEF\u914D\u7F6E\u9879
   install     \u6821\u9A8C\u914D\u7F6E\u540E\u5B89\u88C5/\u66F4\u65B0\u7CFB\u7EDF\u670D\u52A1\uFF08\u5E42\u7B49\uFF0C\u81EA\u52A8\u542F\u52A8\uFF09
   uninstall   \u505C\u6B62\u5E76\u79FB\u9664\u7CFB\u7EDF\u670D\u52A1\uFF08\u4FDD\u7559\u914D\u7F6E\u4E0E\u72B6\u6001\u6570\u636E\uFF09
+  update      \u68C0\u67E5 npm \u6700\u65B0\u7248\u672C\uFF0C\u786E\u8BA4\u540E\u505C\u6B62\u670D\u52A1\u3001\u8986\u76D6\u5B89\u88C5\u5E76\u91CD\u542F
   start       \u542F\u52A8\u670D\u52A1
   stop        \u505C\u6B62\u670D\u52A1
   restart     \u91CD\u542F\u670D\u52A1
@@ -804,7 +938,7 @@ function parse(argv) {
   return { command: command2, flags: flags2, projectArgs: projectArgs2 };
 }
 async function showLogs(follow) {
-  const child = isMacOS() ? spawn("tail", ["-n", "200", ...follow ? ["-F"] : [], launchdLogPath()], { stdio: "inherit" }) : spawn("journalctl", ["--user", "-u", SYSTEMD_UNIT, "-n", "200", ...follow ? ["-f"] : ["--no-pager"]], { stdio: "inherit" });
+  const child = isMacOS() ? spawn2("tail", ["-n", "200", ...follow ? ["-F"] : [], launchdLogPath()], { stdio: "inherit" }) : spawn2("journalctl", ["--user", "-u", SYSTEMD_UNIT, "-n", "200", ...follow ? ["-f"] : ["--no-pager"]], { stdio: "inherit" });
   if (isMacOS() && !await access4(launchdLogPath()).then(() => true, () => false)) {
     console.error(`\u65E5\u5FD7\u6587\u4EF6\u5C1A\u672A\u751F\u6210\uFF1A${launchdLogPath()}`);
     process.exit(1);
@@ -855,6 +989,9 @@ try {
     case "projects":
       await manageProjects(configPath, flags["--remove"]);
       break;
+    case "update":
+      await runUpdate();
+      break;
     case "identity": {
       const config = await loadConfig(configPath);
       const identity = await ensureHostIdentity(config.stateDirectory);

package/dist/main.js

@@ -2,7 +2,7 @@
 import {
   ConfigError,
   runDaemon
-} from "./chunk-6DTK4JVV.js";
+} from "./chunk-BYXUILAK.js";
 
 // src/main.ts
 runDaemon(process.env.OCTOPUS_PROXY_CONFIG ?? "proxy.json").catch((error) => {

package/native/screen-unlock-macos.m

@@ -2,6 +2,7 @@
 #import <ApplicationServices/ApplicationServices.h>
 #include <unistd.h>
 #include <string.h>
+#include <libproc.h>
 
 static void wipe(void *buffer, size_t length) {
   volatile unsigned char *bytes = buffer;
@@ -29,38 +30,166 @@ static void printStatus(BOOL locked) {
          AXIsProcessTrusted() && CGPreflightPostEventAccess() ? "true" : "false");
 }
 
-static AXUIElementRef passwordFocus(void) {
-  AXUIElementRef system = AXUIElementCreateSystemWide();
-  AXUIElementSetMessagingTimeout(system, 0.5);
-  CFTypeRef focused = NULL;
-  AXError result = AXUIElementCopyAttributeValue(system, kAXFocusedUIElementAttribute, &focused);
-  CFRelease(system);
-  if (result != kAXErrorSuccess || !focused || CFGetTypeID(focused) != AXUIElementGetTypeID()) {
-    if (focused) CFRelease(focused);
+// loginwindow belongs to a system process and is not guaranteed to appear in
+// NSRunningApplication. Verify its executable through libproc instead.
+static BOOL isLoginWindow(pid_t pid) {
+  char path[PROC_PIDPATHINFO_MAXSIZE] = {0};
+  return pid > 0 && proc_pidpath(pid, path, sizeof(path)) > 0 &&
+      strcmp(path, "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow") == 0;
+}
+
+static pid_t loginWindowPID(void) {
+  static pid_t cached = 0;
+  if (isLoginWindow(cached)) return cached;
+  int size = proc_listpids(PROC_ALL_PIDS, 0, NULL, 0);
+  if (size <= 0 || size > 1024 * 1024) return 0;
+  pid_t *pids = calloc(1, size);
+  if (!pids) return 0;
+  int actual = proc_listpids(PROC_ALL_PIDS, 0, pids, size);
+  cached = 0;
+  for (int i = 0; i < actual / (int)sizeof(pid_t); i++) {
+    char name[64] = {0};
+    if (proc_name(pids[i], name, sizeof(name)) > 0 && strcmp(name, "loginwindow") == 0 && isLoginWindow(pids[i])) {
+      cached = pids[i]; break;
+    }
+  }
+  free(pids);
+  return cached;
+}
+
+static CFTypeRef copyAttribute(AXUIElementRef element, CFStringRef attribute) {
+  CFTypeRef value = NULL;
+  AXUIElementSetMessagingTimeout(element, 0.1);
+  if (AXUIElementCopyAttributeValue(element, attribute, &value) != kAXErrorSuccess) {
+    if (value) CFRelease(value);
     return NULL;
   }
+  return value;
+}
+
+static BOOL isSecureField(AXUIElementRef field) {
+  if (!field || CFGetTypeID(field) != AXUIElementGetTypeID()) return NO;
   pid_t pid = 0;
-  AXUIElementRef field = (AXUIElementRef)focused;
-  AXUIElementSetMessagingTimeout(field, 0.5);
-  NSRunningApplication *app = nil;
-  if (AXUIElementGetPid(field, &pid) == kAXErrorSuccess) app = [NSRunningApplication runningApplicationWithProcessIdentifier:pid];
-  CFTypeRef subrole = NULL;
-  AXUIElementCopyAttributeValue(field, kAXSubroleAttribute, &subrole);
-  BOOL secure = subrole && CFEqual(subrole, kAXSecureTextFieldSubrole);
+  if (AXUIElementGetPid(field, &pid) != kAXErrorSuccess || !isLoginWindow(pid)) return NO;
+  CFTypeRef role = copyAttribute(field, kAXRoleAttribute);
+  CFTypeRef subrole = copyAttribute(field, kAXSubroleAttribute);
+  BOOL secure = (subrole && CFEqual(subrole, kAXSecureTextFieldSubrole)) ||
+      (role && CFEqual(role, kAXSecureTextFieldSubrole));
+  if (role) CFRelease(role);
   if (subrole) CFRelease(subrole);
-  if (!secure || ![app.bundleIdentifier isEqualToString:@"com.apple.loginwindow"] ||
-      ![app.executableURL.path isEqualToString:@"/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow"]) {
-    CFRelease(field); return NULL;
+  CFTypeRef enabled = copyAttribute(field, kAXEnabledAttribute);
+  if (enabled && CFEqual(enabled, kCFBooleanFalse)) secure = NO;
+  if (enabled) CFRelease(enabled);
+  CFTypeRef hidden = copyAttribute(field, CFSTR("AXHidden"));
+  if (hidden && CFEqual(hidden, kCFBooleanTrue)) secure = NO;
+  if (hidden) CFRelease(hidden);
+  return secure;
+}
+
+static AXUIElementRef copySecureFocus(AXUIElementRef root) {
+  CFTypeRef focused = copyAttribute(root, kAXFocusedUIElementAttribute);
+  if (focused && isSecureField((AXUIElementRef)focused)) return (AXUIElementRef)focused;
+  if (focused) CFRelease(focused);
+  return NULL;
+}
+
+static void collectSecureFields(AXUIElementRef root, CFMutableArrayRef fields,
+    CFMutableSetRef visited, int depth, CFAbsoluteTime deadline) {
+  if (!root || CFGetTypeID(root) != AXUIElementGetTypeID() || depth > 10 ||
+      CFSetGetCount(visited) >= 128 || CFAbsoluteTimeGetCurrent() >= deadline || CFSetContainsValue(visited, root)) return;
+  CFSetAddValue(visited, root);
+  if (isSecureField(root)) { CFArrayAppendValue(fields, root); return; }
+  // Some loginwindow versions expose windows separately from AXChildren.
+  CFStringRef attributes[] = { kAXChildrenAttribute, kAXWindowsAttribute };
+  for (int i = 0; i < 2; i++) {
+    CFTypeRef children = copyAttribute(root, attributes[i]);
+    if (children && CFGetTypeID(children) == CFArrayGetTypeID()) {
+      for (CFIndex j = 0; j < CFArrayGetCount(children); j++)
+        collectSecureFields((AXUIElementRef)CFArrayGetValueAtIndex(children, j), fields, visited, depth + 1, deadline);
+    }
+    if (children) CFRelease(children);
   }
+}
+
+static CFArrayRef copySecureFields(AXUIElementRef app) {
+  CFMutableArrayRef fields = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
+  CFMutableSetRef visited = CFSetCreateMutable(NULL, 0, &kCFTypeSetCallBacks);
+  collectSecureFields(app, fields, visited, 0, CFAbsoluteTimeGetCurrent() + 2);
+  CFRelease(visited);
+  return fields;
+}
+
+static AXUIElementRef passwordFocus(void) {
+  AXUIElementRef system = AXUIElementCreateSystemWide();
+  AXUIElementRef field = copySecureFocus(system);
+  CFRelease(system);
+  if (field) return field;
+  pid_t pid = loginWindowPID();
+  if (!pid) return NULL;
+  AXUIElementRef app = AXUIElementCreateApplication(pid);
+  field = copySecureFocus(app);
+  if (!field) {
+    // A locked console can lack the system-wide focused element while the
+    // password field itself or loginwindow still reports its local focus.
+    CFArrayRef fields = copySecureFields(app);
+    for (CFIndex i = 0; i < CFArrayGetCount(fields); i++) {
+      AXUIElementRef candidate = (AXUIElementRef)CFArrayGetValueAtIndex(fields, i);
+      CFTypeRef focused = copyAttribute(candidate, kAXFocusedAttribute);
+      BOOL active = focused && CFEqual(focused, kCFBooleanTrue);
+      if (focused) CFRelease(focused);
+      if (!active) continue;
+      if (field) { CFRelease(field); field = NULL; break; }
+      field = (AXUIElementRef)CFRetain(candidate);
+    }
+    CFRelease(fields);
+  }
+  CFRelease(app);
   return field;
 }
 
+static AXUIElementRef focusPasswordField(void) {
+  BOOL locked = NO;
+  if (!lockState(&locked) || !locked) return NULL;
+  AXUIElementRef focused = passwordFocus();
+  if (focused) return focused;
+  pid_t pid = loginWindowPID();
+  if (!pid) return NULL;
+  AXUIElementRef app = AXUIElementCreateApplication(pid);
+  CFArrayRef fields = copySecureFields(app);
+  CFRelease(app);
+  // Never guess between multiple password fields or use a generic text field.
+  if (CFArrayGetCount(fields) != 1) { CFRelease(fields); return NULL; }
+  AXUIElementRef field = (AXUIElementRef)CFArrayGetValueAtIndex(fields, 0);
+  if (!lockState(&locked) || !locked || !isSecureField(field)) { CFRelease(fields); return NULL; }
+  AXError activated = AXUIElementSetAttributeValue(field, kAXFocusedAttribute, kCFBooleanTrue);
+  if (activated != kAXErrorSuccess) AXUIElementPerformAction(field, kAXPressAction);
+  usleep(50000);
+  focused = passwordFocus();
+  if (focused && !CFEqual(field, focused)) { CFRelease(focused); focused = NULL; }
+  CFRelease(fields);
+  return focused;
+}
+
 static BOOL stillFocused(AXUIElementRef field) {
   BOOL locked = NO;
-  if (!lockState(&locked) || !locked) return NO;
-  AXUIElementRef current = passwordFocus();
+  if (!lockState(&locked) || !locked || !isSecureField(field)) return NO;
+  AXUIElementRef system = AXUIElementCreateSystemWide();
+  AXUIElementRef current = copySecureFocus(system);
+  CFRelease(system);
+  if (!current) {
+    pid_t pid = 0;
+    if (AXUIElementGetPid(field, &pid) != kAXErrorSuccess) return NO;
+    AXUIElementRef app = AXUIElementCreateApplication(pid);
+    current = copySecureFocus(app);
+    CFRelease(app);
+  }
   BOOL same = current && CFEqual(current, field);
-  if (current) CFRelease(current);
+  if (current) { CFRelease(current); return same; }
+  // Avoid traversing the entire AX tree per character on systems that only
+  // expose field-local focus. A false or unavailable focus is never accepted.
+  CFTypeRef focused = copyAttribute(field, kAXFocusedAttribute);
+  same = focused && CFEqual(focused, kCFBooleanTrue);
+  if (focused) CFRelease(focused);
   return same;
 }
 
@@ -76,12 +205,43 @@ static BOOL key(CGKeyCode code, CGEventFlags flags, const UniChar *text, size_t
   return YES;
 }
 
+static void printDiagnostics(BOOL locked) {
+  // Read-only diagnostics deliberately omit window titles, field values, and
+  // screenshots. Running this command never wakes, focuses, or types anything.
+  pid_t pid = loginWindowPID();
+  AXUIElementRef system = AXUIElementCreateSystemWide();
+  CFTypeRef global = NULL;
+  AXError globalError = AXUIElementCopyAttributeValue(system, kAXFocusedUIElementAttribute, &global);
+  CFRelease(system);
+  BOOL globalSecure = global && isSecureField((AXUIElementRef)global);
+  if (global) CFRelease(global);
+  AXError appError = kAXErrorNoValue;
+  CFIndex count = 0;
+  BOOL appSecure = NO;
+  if (pid && AXIsProcessTrusted()) {
+    AXUIElementRef app = AXUIElementCreateApplication(pid);
+    AXUIElementSetMessagingTimeout(app, 0.1);
+    CFTypeRef local = NULL;
+    appError = AXUIElementCopyAttributeValue(app, kAXFocusedUIElementAttribute, &local);
+    appSecure = local && isSecureField((AXUIElementRef)local);
+    if (local) CFRelease(local);
+    CFArrayRef fields = copySecureFields(app);
+    count = CFArrayGetCount(fields);
+    CFRelease(fields); CFRelease(app);
+  }
+  printf("{\"locked\":%s,\"canUnlock\":%s,\"loginwindowFound\":%s,\"globalFocusError\":%d,\"globalSecureFocus\":%s,\"applicationFocusError\":%d,\"applicationSecureFocus\":%s,\"secureFieldCount\":%ld}",
+    locked ? "true" : "false", AXIsProcessTrusted() && CGPreflightPostEventAccess() ? "true" : "false",
+    pid ? "true" : "false", globalError, globalSecure ? "true" : "false", appError,
+    appSecure ? "true" : "false", (long)count);
+}
+
 int main(int argc, const char *argv[]) {
   @autoreleasepool {
     if (getuid() == 0 || argc != 2) return fail("session");
     BOOL locked = NO;
     if (!lockState(&locked)) return fail("session");
     if (strcmp(argv[1], "status") == 0) { printStatus(locked); return 0; }
+    if (strcmp(argv[1], "diagnose") == 0) { printDiagnostics(locked); return 0; }
     if (strcmp(argv[1], "unlock") != 0) return fail("session");
     if (!locked) { printStatus(NO); return 0; }
     if (!AXIsProcessTrusted() || !CGPreflightPostEventAccess()) return fail("permission");
@@ -97,7 +257,18 @@ int main(int argc, const char *argv[]) {
     if (!lockState(&locked) || !locked) return fail("changed");
     if (!key(56, 0, NULL, 0)) return fail("focus");
     AXUIElementRef field = NULL;
-    for (int i = 0; i < 20 && !field; i++) { usleep(100000); field = passwordFocus(); }
+    field = focusPasswordField();
+    // Shift wakes the display but can leave the clock/wallpaper layer visible.
+    // Space reveals the sign-in controls without submitting a password.
+    if (!field) {
+      if (!lockState(&locked) || !locked) return fail("changed");
+      if (!key(49, 0, NULL, 0)) return fail("focus");
+      NSDate *deadline = [NSDate dateWithTimeIntervalSinceNow:6];
+      while (!field && deadline.timeIntervalSinceNow > 0) {
+        usleep(100000);
+        field = focusPasswordField();
+      }
+    }
     if (!field) return fail("focus");
     if (!stillFocused(field) || !key(0, kCGEventFlagMaskCommand, NULL, 0) ||
         !stillFocused(field) || !key(51, 0, NULL, 0)) { CFRelease(field); return fail("changed"); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skylandnpm/octopus-proxy",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "type": "module",
   "description": "Octopus host proxy: OpenCode, Codex, ZCode and Pi adapters with service installer CLI",
   "bin": {