@skylandnpm/octopus-proxy 0.1.52 → 0.1.54

package/README.md

@@ -20,7 +20,7 @@ Proxy 主动连接 Hub 的 `/ws/proxy-chat`，无需开放入站端口或安装
 
 macOS 12.3 及以上运行 `octopus-proxy onboard` 时，配置保存后、服务启动前会准备截屏辅助程序并申请系统屏幕录制权限；已授权时不会重复弹窗。交互模式和 `--non-interactive` 均执行此步骤，`--no-install-service` 也会申请。请在系统弹窗中允许访问；拒绝、超时或辅助程序编译失败时，向导提示原因与授权路径，并继续初始化。在“系统设置 → 隐私与安全性 → 屏幕录制（或屏幕与系统音频录制）”中应授权弹窗显示的实际程序，可能是 Terminal、iTerm、编辑器或 node，不保证出现 `octopus-desktop-capture`。onboard 和 doctor 会显示辅助程序路径，文件名不等于系统授权名称。终端授权不代表后台服务已授权，需在 Claw 点击截屏，让实际服务申请权限，按实际名称授权后重启 Proxy。Linux 没有通用的截屏授权弹窗，需使用桌面用户的图形会话环境；平台依赖与设置见[桌面快照说明](../../docs/claw-desktop-snapshots.md)。
 
-添加授权项目时，填写项目 ID 后会询问是否继续添加；直接回车即可结束添加并继续保存配置。
+基础设置完成后，向导会提示至少需要配置一个工作项目。新项目依次填写项目 ID、名称（默认使用项目 ID）和目录；完成第一个项目后，可选择继续添加更多项目，或直接回车完成项目配置并继续保存。只有选择继续添加时，才会进入下一个项目 ID 的输入流程。
 
 `octopus-proxy doctor` 会显示“桌面截屏支持”和“屏幕录制权限”：macOS 检查系统版本、辅助程序、活动显示器和当前授权状态；未授权时给出 onboard 申请及系统设置指引。Linux 检查图形会话、显示器和截屏依赖，缺少依赖、无桌面或不支持的 Wayland 环境会显示具体提示；Linux 无统一的授权查询接口，因此会明确显示权限尚无法确认，需在 Claw 实际截屏验证。诊断不触发授权弹窗、不截屏，`doctor --fix` 也不会自动申请截屏权限。这些检查使用运行 doctor 的用户与环境；服务以其他启动程序或图形会话运行时，其权限与环境需要单独确认。
 
@@ -102,6 +102,33 @@ octopus-proxy update
 
 安装或版本校验失败时不会触发服务重启；包安装失败不保证旧版本文件完整保留。已安装新版本但重启失败时会单独提示，可运行 `octopus-proxy doctor` 和 `octopus-proxy logs` 排查。此命令用于 npm 全局安装，覆盖安装前会检查 npm 安装目录是否与当前命令一致；源码、本地安装或 Node.js 环境不一致时会中止并给出提示。
 
+## 服务启动时报 `Unexpected token '??='`
+
+这通常表示服务实际使用了旧版 Node.js。错误栈中 `.nvm/versions/node/v22.../lib/node_modules` 是包的安装位置，不能说明运行它的 Node.js 版本。安装器只会选择 Node.js 22 或更高版本；旧版安装器可能优先选中能执行 `--version` 的旧系统 Node。
+
+对于通过 NVM 安装的环境，可切换到安装 Proxy 的 Node.js 版本，并重写服务定义，明确指定服务使用的 Node。例如包安装在 `v22.22.0` 下时：
+
+```sh
+nvm use 22.22.0
+node --version
+octopus-proxy install --force --node-path "$(node -p 'process.execPath')"
+octopus-proxy status
+```
+
+`install --force` 会重写并重新加载服务定义，保留配置和状态数据；自定义配置时带上原来的 `--config <path>`。单独运行 `restart` 会继续使用已有服务定义中的 Node 路径。NVM 中被固定的版本需要保留，删除该版本后应重新安装服务。
+
+`octopus-proxy doctor` 会分别显示当前命令和已安装服务的 Node.js 路径、版本及最低要求（Node.js >= 22）。服务检查读取已保存的 launchd/systemd 定义，再执行其中 Node 的 `--version`；版本过低、路径失效或版本输出无法识别都会标记为失败。配置无效时仍会检查 Node；尚未安装服务时提示未检查服务版本。`doctor --fix` 重写服务定义后会重新检查保存的 Node 路径和版本。
+
+## 连接工作区时报 `ec_asn1.cc / p_ec.cc DECODE_ERROR`
+
+如果服务在线，但 Claw 在 TLS 握手时显示上述错误，可能是主机身份由 macOS 自带的 LibreSSL 生成，证书使用了客户端不支持的显式椭圆曲线参数。这与服务是否在线、密码是否正确是不同的检查阶段；旧版本更新包也会保留已有证书。
+
+这不是旧 macOS 独有的问题：在 macOS 26.6.2 的 `/usr/bin/openssl`（LibreSSL 3.3.6）上也已复现。Proxy 通过 PATH 查找 `openssl`，只用它生成身份文件；实际 TLS 连接使用 Node 自身的 OpenSSL。交互终端和 launchd 服务的 PATH 可能不同，因此终端安装新版 OpenSSL 不代表服务会使用它。升级 macOS 或替换命令不会自动转换已有身份文件。
+
+包含此修复的版本会在启动或运行 `octopus-proxy identity` 时检查身份编码，把旧的显式参数转换为 `named_curve` 并重新签发证书，保留原来的私钥数值和公钥。正常的命名曲线证书不会重写，已有指纹保持不变；TLS 1.3、主机密码认证和指纹校验保持原有要求。转换旧证书后，编码变化会使其 SHA-256 指纹变化；首次连接应与主机上的 `octopus-proxy identity` 输出核对。使用自定义配置时带上原来的 `--config <path>`。
+
+命名曲线编码遵循 [RFC 5480 §2.1.1](https://www.rfc-editor.org/rfc/rfc5480#section-2.1.1)，继续使用 P-256 和 SHA-256。兼容处理不启用旧 TLS 协议、不放宽客户端证书解析，也不自动覆盖已固定的主机指纹。macOS 26 及后续版本保持这些安全要求；当前实机验证环境为 macOS 26.6.2，后续系统版本仍需实际回归验证。
+
 ## 发布
 
 在 `apps/octopus-proxy` 目录执行 `npm run publish`：先递增 `package.json` 的补丁版本，再编译，最后发布。即使编译或发布失败，版本号也会保留递增结果，重试时继续递增。版本更新不会自动创建 Git 提交或标签。先登录有权发布 `@skylandnpm` 包的 npm 账号：

package/dist/{chunk-3KIA6HF6.js → chunk-NJNANA6A.js}

@@ -7600,8 +7600,8 @@ var proxyVersion = JSON.parse(readFileSync(new URL("../package.json", import.met
 
 // src/host-identity.ts
 import { execFile } from "node:child_process";
-import { createHash, randomUUID, X509Certificate } from "node:crypto";
-import { chmod, mkdir, open, readFile as readFile2, rename, stat as stat2, unlink } from "node:fs/promises";
+import { createHash, createPrivateKey, createPublicKey, randomUUID, X509Certificate } from "node:crypto";
+import { chmod, mkdir, open, readFile as readFile2, rename, stat as stat2, unlink, writeFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { promisify } from "node:util";
 var run = promisify(execFile);
@@ -7613,20 +7613,43 @@ async function ensureHostIdentity(stateDirectory) {
   const certPath = join2(stateDirectory, "host-identity-cert.pem");
   const keyExists = await stat2(keyPath).then(() => true, () => false);
   const certExists = await stat2(certPath).then(() => true, () => false);
+  for (const path of [keyPath, certPath]) {
+    const info = await stat2(path).catch((error) => {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    });
+    if (info && (info.mode & 63) !== 0) throw new Error("Host identity permissions must be 0600");
+  }
+  if (certExists && !keyExists) throw new Error("Host identity private key is missing");
   const suffix = randomUUID();
   const temporaryKey = join2(stateDirectory, `.host-key-${suffix}`);
   const temporaryCert = join2(stateDirectory, `.host-cert-${suffix}`);
   try {
     if (!keyExists) {
       await (await open(temporaryKey, "wx", 384)).close();
-      await run("openssl", ["genpkey", "-algorithm", "EC", "-pkeyopt", "ec_paramgen_curve:P-256", "-out", temporaryKey], { timeout: 15e3 });
+      await run("openssl", ["genpkey", "-algorithm", "EC", "-pkeyopt", "ec_paramgen_curve:P-256", "-pkeyopt", "ec_param_enc:named_curve", "-out", temporaryKey], { timeout: 15e3 });
       await chmod(temporaryKey, 384);
       await rename(temporaryKey, keyPath);
     }
-    if (!certExists) {
+    const privateKey = createPrivateKey(await readFile2(keyPath));
+    const existingCertificate = certExists ? new X509Certificate(await readFile2(certPath)) : void 0;
+    if (existingCertificate && !existingCertificate.checkPrivateKey(privateKey)) throw new Error("Host identity certificate does not match private key");
+    const normalizedKey = privateKey.asymmetricKeyType === "ec" ? createPrivateKey({ key: privateKey.export({ format: "jwk" }), format: "jwk" }) : privateKey;
+    const publicKey = createPublicKey(normalizedKey).export({ type: "spki", format: "der" });
+    const normalizeKey = !createPublicKey(privateKey).export({ type: "spki", format: "der" }).equals(publicKey);
+    const renewCertificate = !existingCertificate || !existingCertificate.publicKey.export({ type: "spki", format: "der" }).equals(publicKey);
+    if (normalizeKey || renewCertificate) {
+      await writeFile(temporaryKey, normalizedKey.export({ type: "pkcs8", format: "pem" }), { mode: 384, flag: "wx" });
+    }
+    if (renewCertificate) {
       await (await open(temporaryCert, "wx", 384)).close();
-      await run("openssl", ["req", "-new", "-x509", "-sha256", "-days", "3650", "-key", keyPath, "-out", temporaryCert, "-subj", "/CN=octopus-proxy"], { timeout: 15e3 });
+      await run("openssl", ["req", "-new", "-x509", "-sha256", "-days", "3650", "-key", temporaryKey, "-out", temporaryCert, "-subj", "/CN=octopus-proxy"], { timeout: 15e3 });
+      const certificate = new X509Certificate(await readFile2(temporaryCert));
+      if (!certificate.checkPrivateKey(normalizedKey) || !certificate.publicKey.export({ type: "spki", format: "der" }).equals(publicKey)) throw new Error("Host identity certificate normalization failed");
       await chmod(temporaryCert, 384);
+    }
+    if (normalizeKey || renewCertificate) await rename(temporaryKey, keyPath);
+    if (renewCertificate) {
       await rename(temporaryCert, certPath);
     }
   } finally {
@@ -7883,13 +7906,13 @@ import { basename as basename2, dirname as dirname3, join as join3 } from "node:
 import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
 
 // src/storage.ts
-import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile } from "node:fs/promises";
+import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname2 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 async function atomicJson(path, value) {
   await mkdir3(dirname2(path), { recursive: true, mode: 448 });
   const temp = `${path}.${randomUUID3()}.tmp`;
-  await writeFile(temp, JSON.stringify(value), { mode: 384 });
+  await writeFile2(temp, JSON.stringify(value), { mode: 384 });
   await rename2(temp, path);
 }
 async function readJson(path) {
@@ -8344,7 +8367,7 @@ function pageHistory(input, payload) {
 // src/artifacts.ts
 import { createHash as createHash5 } from "node:crypto";
 import { join as join5 } from "node:path";
-import { readFile as readFile4, writeFile as writeFile2, mkdir as mkdir4, stat as stat5 } from "node:fs/promises";
+import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir4, stat as stat5 } from "node:fs/promises";
 var Artifacts = class {
   constructor(workspace, directory, emit) {
     this.workspace = workspace;
@@ -8400,7 +8423,7 @@ var Artifacts = class {
         if (previous?.hash !== hash || previous.deleted) {
           const dir = join5(this.directory, project, "blobs");
           await mkdir4(dir, { recursive: true, mode: 448 });
-          await writeFile2(join5(dir, hash), data, { mode: 384 });
+          await writeFile3(join5(dir, hash), data, { mode: 384 });
           record2.revisions.push({ hash, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
           changed = true;
         }
@@ -8453,7 +8476,7 @@ var Artifacts = class {
 // src/secure-chat.ts
 import WebSocket from "ws";
 import { Duplex } from "node:stream";
-import { createPublicKey, randomUUID as randomUUID7, verify } from "node:crypto";
+import { createPublicKey as createPublicKey2, randomUUID as randomUUID7, verify } from "node:crypto";
 import { userInfo as userInfo2 } from "node:os";
 import { TLSSocket, createSecureContext } from "node:tls";
 
@@ -8741,7 +8764,7 @@ var SecureChat = class {
         if (key.length !== 32 || signature.length !== 64) throw new Error("Invalid device proof");
         const exporter = session.tls.exportKeyingMaterial(32, "EXPORTER-octopus-device-v1", Buffer.from(this.config.botId)).toString("base64");
         const proof = Buffer.from(`${this.config.botId}\0${id}\0${exporter}`);
-        if (!verify(null, proof, createPublicKey({ key: Buffer.concat([ED25519_SPKI, key]), format: "der", type: "spki" }), signature)) throw new Error("Invalid device proof");
+        if (!verify(null, proof, createPublicKey2({ key: Buffer.concat([ED25519_SPKI, key]), format: "der", type: "spki" }), signature)) throw new Error("Invalid device proof");
         const valid = await this.authenticate(this.config.stateDirectory, this.serviceAccount, String(message.password ?? ""));
         if (!valid) throw new Error("Host authentication failed");
         if (this.sessions.get(id) !== session) return;
@@ -10519,7 +10542,7 @@ function applyEdits(text, edits) {
 }
 
 // src/project-config.ts
-import { readFile as readFile5, writeFile as writeFile3, unlink as unlink6 } from "node:fs/promises";
+import { readFile as readFile5, writeFile as writeFile4, unlink as unlink6 } from "node:fs/promises";
 import { createHash as createHash7, randomUUID as randomUUID10 } from "node:crypto";
 var ProjectConfig = class {
   constructor(workspace, request) {
@@ -10573,7 +10596,7 @@ var ProjectConfig = class {
     else {
       const temporary = await this.workspace.path(project, `.octopus-config-${randomUUID10()}.tmp`, true);
       try {
-        await writeFile3(temporary, updated, { mode: 384, flag: "wx" });
+        await writeFile4(temporary, updated, { mode: 384, flag: "wx" });
         await this.workspace.publish(project, temporary, name);
       } finally {
         await unlink6(temporary).catch(() => {
@@ -11034,7 +11057,7 @@ function redact(value) {
 // src/runtime.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { mkdir as mkdir6, open as open5, readFile as readFile6, rm, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir6, open as open5, readFile as readFile6, rm, writeFile as writeFile5 } from "node:fs/promises";
 import { createServer } from "node:net";
 import { join as join7 } from "node:path";
 var Runtime = class {
@@ -11138,7 +11161,7 @@ var Runtime = class {
       throw new Error(`\u65E0\u6CD5\u6267\u884C OpenCode \u547D\u4EE4 ${this.config.tool.command}\uFF1A${error instanceof Error ? error.message : String(error)}`);
     }
     try {
-      await writeFile4(this.endpointStatePath, JSON.stringify({
+      await writeFile5(this.endpointStatePath, JSON.stringify({
         configuredBaseUrl: this.config.tool.baseUrl,
         baseUrl: url.origin,
         passwordHash: this.passwordHash,
@@ -13559,10 +13582,19 @@ import { join as join12 } from "node:path";
 import { homedir as homedir2, platform as platform4 } from "node:os";
 var run4 = promisify7(execFile7);
 var VERSION_MANAGED_SEGMENTS = /* @__PURE__ */ new Set([".nvm", "nvm", ".volta", "volta", ".fnm", "fnm", ".asdf", "asdf", ".mise", "mise"]);
+var MIN_NODE_MAJOR = 22;
+function parseNodeVersion(version) {
+  const match = /^v(\d+)\.\d+\.\d+(?:-[\w.-]+)?$/.exec(version);
+  if (!match) throw new Error(`\u65E0\u6CD5\u8BC6\u522B Node.js \u7248\u672C\uFF1A${version || "\u7A7A\u8F93\u51FA"}`);
+  return { version, supported: Number(match[1]) >= MIN_NODE_MAJOR };
+}
+async function probeNodeVersion(path) {
+  const { stdout } = await run4(path, ["--version"], { timeout: 5e3 });
+  return parseNodeVersion(stdout.trim());
+}
 var execProbe = async (path) => {
   try {
-    await run4(path, ["--version"], { timeout: 5e3 });
-    return true;
+    return (await probeNodeVersion(path)).supported;
   } catch {
     return false;
   }
@@ -13576,7 +13608,7 @@ function nodeCandidates() {
 async function resolveNodePath(options = {}) {
   const probe = options.probe ?? execProbe;
   if (options.pinned) {
-    if (!await probe(options.pinned)) throw new Error(`--node-path ${options.pinned} is not a working node executable`);
+    if (!await probe(options.pinned)) throw new Error(`--node-path ${options.pinned} is not a working Node.js >= ${MIN_NODE_MAJOR} executable; check ${options.pinned} --version`);
     return { nodePath: options.pinned, source: "pinned" };
   }
   let exec2 = options.execPath ?? process.execPath;
@@ -13894,6 +13926,9 @@ export {
   checkTerminalSupport,
   PlatformDesktopSession,
   RemoteManager,
+  MIN_NODE_MAJOR,
+  parseNodeVersion,
+  probeNodeVersion,
   isVersionManagedPath,
   resolveNodePath,
   toolSearchDirs,

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   ConfigError,
+  MIN_NODE_MAJOR,
   PlatformDesktopSession,
   RemoteManager,
   SERVICE_LABEL,
@@ -23,6 +24,8 @@ import {
   launchdLogPath,
   launchdPlistPath,
   loadConfig,
+  parseNodeVersion,
+  probeNodeVersion,
   proxyVersion,
   resolveCommandOnPath,
   resolveConfigPath,
@@ -31,7 +34,7 @@ import {
   supportedPlatform,
   systemdUnitPath,
   toolSearchDirs
-} from "./chunk-3KIA6HF6.js";
+} from "./chunk-NJNANA6A.js";
 import {
   DESKTOP_PERMISSION_GUIDANCE,
   PlatformDesktop,
@@ -45,7 +48,7 @@ import { access as access4 } from "node:fs/promises";
 
 // src/doctor.ts
 import { access as access2, chmod, constants, mkdir as mkdir3, stat } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join } from "node:path";
+import { isAbsolute as isAbsolute3, join } from "node:path";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 
@@ -233,7 +236,7 @@ async function readServiceFile() {
 async function buildServiceDefinition(opts) {
   const config = await loadConfig(opts.configPath);
   const resolution = await resolveNodePath({ pinned: opts.nodePath });
-  if (!resolution.nodePath) throw new Error("\u672A\u627E\u5230\u53EF\u7528\u7684 node \u53EF\u6267\u884C\u6587\u4EF6\uFF1B\u8BF7\u7528\u7CFB\u7EDF\u5305\u7BA1\u7406\u5668\u5B89\u88C5 node\uFF0C\u6216\u901A\u8FC7 --node-path \u6307\u5B9A\u7EDD\u5BF9\u8DEF\u5F84");
+  if (!resolution.nodePath) throw new Error(`\u672A\u627E\u5230 Node.js >= ${MIN_NODE_MAJOR} \u7684\u53EF\u6267\u884C\u6587\u4EF6\uFF1B\u8BF7\u5B89\u88C5\u53D7\u652F\u6301\u7684 Node.js\uFF0C\u6216\u901A\u8FC7 --node-path \u6307\u5B9A\u7EDD\u5BF9\u8DEF\u5F84`);
   const opencodeDir = isAbsolute(config.tool.command) ? [dirname3(config.tool.command)] : [];
   const pathEnv = [dirname3(resolution.nodePath), ...opencodeDir, "/usr/local/bin", "/usr/bin", "/bin"].filter((dir, index, all) => all.indexOf(dir) === index).join(":");
   return { def: { nodePath: resolution.nodePath, entryPath: daemonEntryPath(), configPath: resolve(opts.configPath), pathEnv }, warning: resolution.warning };
@@ -291,12 +294,47 @@ function logLocationHint() {
   return isMacOS() ? launchdLogPath() : "journalctl --user -u octopus-proxy";
 }
 
+// src/service-definition.ts
+import { isAbsolute as isAbsolute2 } from "node:path";
+function serviceNodePath(text, macOS) {
+  let path;
+  if (macOS) {
+    const match = /<key>\s*ProgramArguments\s*<\/key>\s*<array>\s*<string>([\s\S]*?)<\/string>/.exec(text);
+    const entities = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
+    path = match?.[1]?.replace(/&(amp|lt|gt|quot|apos);/g, (_, entity) => entities[entity]);
+  } else {
+    const match = /^[ \t]*ExecStart[ \t]*=[ \t]*(?:"((?:\\.|[^"\\])*)"|([^\s"]+))/m.exec(text);
+    path = (match?.[1] ?? match?.[2])?.replace(/\\(["\\])/g, "$1").replaceAll("%%", "%");
+  }
+  return path && isAbsolute2(path) ? path : null;
+}
+
 // src/doctor.ts
 import { randomUUID } from "node:crypto";
 var run3 = promisify3(execFile3);
+function nodeVersionCheck(name, path, info) {
+  return {
+    name,
+    status: info.supported ? "ok" : "fail",
+    detail: `${path}\uFF08${info.version}\uFF09\uFF1B\u8981\u6C42 Node.js >= ${MIN_NODE_MAJOR}${info.supported ? "" : "\uFF1B\u8BF7\u5347\u7EA7 Node.js\uFF0C\u5E76\u8FD0\u884C octopus-proxy install --force --node-path <Node\u7EDD\u5BF9\u8DEF\u5F84> \u91CD\u5199\u670D\u52A1\u5B9A\u4E49"}`
+  };
+}
+async function checkServiceNodeVersion() {
+  const name = "\u670D\u52A1 Node.js \u7248\u672C";
+  const existing = await readServiceFile();
+  if (existing === null) return { name, status: "warn", detail: "\u5C1A\u672A\u5B89\u88C5\u670D\u52A1\uFF0C\u65E0\u6CD5\u68C0\u67E5\u670D\u52A1\u4F7F\u7528\u7684 Node.js \u7248\u672C" };
+  const path = serviceNodePath(existing, isMacOS());
+  if (!path) return { name, status: "fail", detail: "\u65E0\u6CD5\u4ECE\u670D\u52A1\u5B9A\u4E49\u8BFB\u53D6 Node \u7EDD\u5BF9\u8DEF\u5F84\uFF1B\u8FD0\u884C octopus-proxy install --force \u91CD\u5199\u670D\u52A1\u5B9A\u4E49" };
+  try {
+    return nodeVersionCheck(name, path, await probeNodeVersion(path));
+  } catch (error) {
+    return { name, status: "fail", detail: `${path} --version \u68C0\u67E5\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}\uFF1B\u8BF7\u786E\u8BA4 Node \u8DEF\u5F84\u6709\u6548\u5E76\u8FD0\u884C octopus-proxy install --force \u91CD\u5199\u670D\u52A1\u5B9A\u4E49` };
+  }
+}
 async function runDoctor(opts) {
   const results = [];
   const record = (name, status, detail) => results.push({ name, status, detail });
+  results.push(nodeVersionCheck("\u5F53\u524D Node.js \u7248\u672C", process.execPath, parseNodeVersion(process.version)));
   results.push(await checkTerminalSupport(opts.fix));
   let config;
   try {
@@ -335,7 +373,7 @@ async function runDoctor(opts) {
     const descriptor = describeTool(config.tool.kind);
     const checkName = `${descriptor.label} \u547D\u4EE4`;
     const command2 = config.tool.command;
-    if (!isAbsolute2(command2)) {
+    if (!isAbsolute3(command2)) {
       record(checkName, "warn", `\u5F53\u524D\u4E3A\u300C${command2}\u300D\uFF0C\u4F9D\u8D56 PATH \u67E5\u627E\uFF1B\u670D\u52A1\u73AF\u5883\u5EFA\u8BAE\u6539\u7528\u7EDD\u5BF9\u8DEF\u5F84\uFF08\u91CD\u65B0\u8FD0\u884C onboard \u6216\u624B\u5DE5\u4FEE\u6539\u914D\u7F6E\uFF09`);
     } else if (!await access2(command2, constants.X_OK).then(() => true, () => false)) {
       record(checkName, "fail", `${command2} \u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u6267\u884C`);
@@ -399,6 +437,7 @@ async function runDoctor(opts) {
       record("\u670D\u52A1\u5B9A\u4E49", "fail", error instanceof Error ? error.message : String(error));
     }
   }
+  results.push(await checkServiceNodeVersion());
   const state = await serviceStatus();
   if (state.active) record("\u670D\u52A1\u72B6\u6001", "ok", `\u8FD0\u884C\u4E2D${state.pid ? `\uFF08pid ${state.pid}\uFF09` : ""}`);
   else if (!state.installed) record("\u670D\u52A1\u72B6\u6001", "warn", "\u5C1A\u672A\u5B89\u88C5\u670D\u52A1");
@@ -420,7 +459,7 @@ import { stdin, stdout } from "node:process";
 import { access as access3, constants as constants2, mkdir as mkdir4, stat as stat2 } from "node:fs/promises";
 import { execFile as execFile4 } from "node:child_process";
 import { platform } from "node:os";
-import { isAbsolute as isAbsolute3, join as join2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join2 } from "node:path";
 import { promisify as promisify4 } from "node:util";
 var DEFAULT_HUB_URL = "https://octopus.wuyehao.com";
 async function ask(rl, question, options = {}) {
@@ -459,7 +498,7 @@ var MACOS_TOOL_EXAMPLES = {
 };
 async function validateToolCommand(value, kind) {
   const command2 = expandHome(value);
-  if (!isAbsolute3(command2)) return "\u670D\u52A1\u73AF\u5883\u9700\u8981\u7EDD\u5BF9\u8DEF\u5F84";
+  if (!isAbsolute4(command2)) return "\u670D\u52A1\u73AF\u5883\u9700\u8981\u7EDD\u5BF9\u8DEF\u5F84";
   try {
     if (!(await stat2(command2)).isFile()) return "\u547D\u4EE4\u8DEF\u5F84\u5FC5\u987B\u6307\u5411\u53EF\u6267\u884C\u6587\u4EF6";
     await access3(command2, constants2.X_OK);
@@ -492,7 +531,7 @@ async function runOnboard(opts) {
     hubUrl = await ask(rl, `Hub \u5730\u5740\uFF08${hubUrl} , \u56DE\u8F66\u76F4\u63A5\u786E\u8BA4\uFF09`, { default: hubUrl, showDefault: false, validate: validUrl });
     botId = await ask(rl, "\u673A\u5668\u4EBA ID\uFF08\u5728 Claw \u6216 Taskhub \u4E2D\u521B\u5EFA\u5E76\u590D\u5236\uFF09", { default: botId || void 0, validate: validBotId });
     secretKey = await ask(rl, "\u673A\u5668\u4EBA Secret\uFF08\u5728 Claw \u6216 Taskhub \u521B\u5EFA\uFF1B\u8F93\u5165\u4F1A\u56DE\u663E\u5728\u7EC8\u7AEF\uFF09", { default: secretKey || void 0, defaultDisplay: existing?.secretKey ? "\u5DF2\u914D\u7F6E\uFF0C\u56DE\u8F66\u4FDD\u7559" : "\u5DF2\u63D0\u4F9B\uFF0C\u56DE\u8F66\u4F7F\u7528", validate: (value) => value.length >= 20 ? void 0 : "\u8BF7\u8F93\u5165\u5B8C\u6574\u7684\u673A\u5668\u4EBA Secret" });
-    stateDirectory = expandHome(await ask(rl, "\u72B6\u6001\u76EE\u5F55", { default: stateDirectory, validate: (value) => isAbsolute3(expandHome(value)) ? void 0 : "\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84" }));
+    stateDirectory = expandHome(await ask(rl, "\u72B6\u6001\u76EE\u5F55", { default: stateDirectory, validate: (value) => isAbsolute4(expandHome(value)) ? void 0 : "\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84" }));
     const previousToolKind = toolKind;
     toolKind = await ask(rl, `\u7F16\u7801\u5DE5\u5177\uFF08${TOOL_KINDS.join("/")}\uFF09`, { default: toolKind, validate: (value) => TOOL_KINDS.includes(value) ? void 0 : `\u8F93\u5165 ${TOOL_KINDS.join(" \u6216 ")}` });
     if (toolKind !== previousToolKind) toolCommand = toolKind === existing?.tool.kind ? existing.tool.command : "";
@@ -514,12 +553,13 @@ async function runOnboard(opts) {
       toolCommand = expandHome(await ask(rl, `${descriptor.label} \u547D\u4EE4\uFF08\u56DE\u8F66\u4F1A\u9A8C\u8BC1\u8DEF\u5F84\uFF09`, { default: toolCommand || found || example, validate: (value) => validateToolCommand(value, toolKind) }));
       console.log(`  \u5DF2\u786E\u8BA4 ${descriptor.label} \u547D\u4EE4\u53EF\u6267\u884C\uFF1A${toolCommand}`);
     }
+    console.log("\n\u57FA\u7840\u8BBE\u7F6E\u5DF2\u5B8C\u6210\uFF0C\u81F3\u5C11\u9700\u8981\u914D\u7F6E\u4E00\u4E2A\u5DE5\u4F5C\u9879\u76EE\u3002");
     if (projects.length) console.log("\n\u5DF2\u6709\u6388\u6743\u9879\u76EE\uFF08\u76F4\u63A5\u56DE\u8F66\u4FDD\u7559\u5404\u9879\uFF09\uFF1A");
     for (const [index, project] of projects.entries()) {
       project.name = await ask(rl, "  \u9879\u76EE\u540D\u79F0", { default: project.name });
       for (; ; ) {
         project.directory = expandHome(await ask(rl, `  \u300C${project.name}\u300D\u76EE\u5F55\uFF08\u7EDD\u5BF9\u8DEF\u5F84\uFF09`, { default: project.directory }));
-        if (!isAbsolute3(project.directory)) {
+        if (!isAbsolute4(project.directory)) {
           console.log("  \u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84");
           continue;
         }
@@ -531,14 +571,24 @@ async function runOnboard(opts) {
       }
       project.id = await ask(rl, "  \u9879\u76EE ID", { default: project.id ?? slug(project.name), validate: (value) => validateProjectId(value, projects.slice(0, index)) });
     }
-    console.log("\n\u6DFB\u52A0\u6388\u6743\u9879\u76EE\uFF08\u540D\u79F0\u7559\u7A7A\u7ED3\u675F\uFF09\uFF1A");
     for (; ; ) {
-      const name = (await rl.question("  \u9879\u76EE\u540D\u79F0: ")).trim();
-      if (!name) break;
+      if (projects.length) {
+        console.log(projects.length === 1 ? "\n\u60A8\u5DF2\u5B8C\u6210\u7B2C\u4E00\u4E2A\u9879\u76EE\u914D\u7F6E\uFF0C\u53EF\u4EE5\u7EE7\u7EED\u6DFB\u52A0\u66F4\u591A\u9879\u76EE\uFF0C\u6216\u8005\u5148\u5B8C\u6210\u9879\u76EE\u914D\u7F6E\u3002" : `
+\u60A8\u5DF2\u5B8C\u6210 ${projects.length} \u4E2A\u9879\u76EE\u914D\u7F6E\uFF0C\u53EF\u4EE5\u7EE7\u7EED\u6DFB\u52A0\u66F4\u591A\u9879\u76EE\uFF0C\u6216\u8005\u5148\u5B8C\u6210\u9879\u76EE\u914D\u7F6E\u3002`);
+        const addMore = await ask(rl, "  \u662F\u5426\u7EE7\u7EED\u6DFB\u52A0\u66F4\u591A\u9879\u76EE\uFF1F(y/N\uFF0C\u56DE\u8F66\u5B8C\u6210\u9879\u76EE\u914D\u7F6E)", {
+          default: "n",
+          showDefault: false,
+          validate: (value) => /^(y|yes|n|no)$/i.test(value) ? void 0 : "\u8BF7\u8F93\u5165 y \u6216 n"
+        });
+        if (!/^(y|yes)$/i.test(addMore)) break;
+      }
+      console.log("\n\u6DFB\u52A0\u5DE5\u4F5C\u9879\u76EE\uFF1A");
+      const id = await ask(rl, "  \u9879\u76EE ID", { validate: (value) => validateProjectId(value, projects) });
+      const name = await ask(rl, "  \u9879\u76EE\u540D\u79F0", { default: id });
       let directory = "";
       for (; ; ) {
         directory = expandHome(await ask(rl, `  \u300C${name}\u300D\u76EE\u5F55\uFF08\u7EDD\u5BF9\u8DEF\u5F84\uFF09`));
-        if (!isAbsolute3(directory)) {
+        if (!isAbsolute4(directory)) {
           console.log("  \u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84");
           continue;
         }
@@ -548,14 +598,7 @@ async function runOnboard(opts) {
         }
         break;
       }
-      const id = await ask(rl, "  \u9879\u76EE ID", { default: slug(name), validate: (value) => validateProjectId(value, projects) });
       projects.push({ id, name, directory });
-      const addMore = await ask(rl, "  \u7EE7\u7EED\u6DFB\u52A0\u66F4\u591A\u6388\u6743\u9879\u76EE\uFF1F(y/N)", {
-        default: "n",
-        showDefault: false,
-        validate: (value) => /^(y|yes|n|no)$/i.test(value) ? void 0 : "\u8BF7\u8F93\u5165 y \u6216 n"
-      });
-      if (!/^(y|yes)$/i.test(addMore)) break;
     }
     rl.close();
     if (!projects.length) throw new Error("\u81F3\u5C11\u9700\u8981\u5F55\u5165\u4E00\u4E2A\u6388\u6743\u9879\u76EE");
@@ -577,10 +620,10 @@ async function runOnboard(opts) {
       if (seenIds.has(project.id)) throw new Error(`\u9879\u76EE ID\u300C${project.id}\u300D\u91CD\u590D\uFF0C\u8BF7\u8C03\u6574\u9879\u76EE\u540D\u79F0\u6216\u624B\u5DE5\u6307\u5B9A\u4E0D\u540C ID`);
       seenIds.add(project.id);
     }
-    if (projects.some((project) => !isAbsolute3(project.directory))) throw new Error("--project \u7684\u76EE\u5F55\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84");
+    if (projects.some((project) => !isAbsolute4(project.directory))) throw new Error("--project \u7684\u76EE\u5F55\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84");
     const descriptor = describeTool(toolKind);
     toolCommand = toolCommand ? expandHome(toolCommand) : await resolveCommandOnPath(toolKind, toolSearchDirs(toolKind)) ?? descriptor.defaultCommand;
-    if (!isAbsolute3(toolCommand)) console.log(`\u63D0\u793A\uFF1A\u672A\u5728 PATH \u4E2D\u63A2\u6D4B\u5230 ${descriptor.label}\uFF0C\u914D\u7F6E\u4FDD\u7559\u547D\u4EE4\u540D\u300C${toolCommand}\u300D\uFF1B\u670D\u52A1\u73AF\u5883\u5EFA\u8BAE\u7EDD\u5BF9\u8DEF\u5F84\uFF08\u53EF\u7528 --tool-command \u6307\u5B9A\uFF09`);
+    if (!isAbsolute4(toolCommand)) console.log(`\u63D0\u793A\uFF1A\u672A\u5728 PATH \u4E2D\u63A2\u6D4B\u5230 ${descriptor.label}\uFF0C\u914D\u7F6E\u4FDD\u7559\u547D\u4EE4\u540D\u300C${toolCommand}\u300D\uFF1B\u670D\u52A1\u73AF\u5883\u5EFA\u8BAE\u7EDD\u5BF9\u8DEF\u5F84\uFF08\u53EF\u7528 --tool-command \u6307\u5B9A\uFF09`);
   }
   if (configExists) {
     if (opts.interactive) {

package/dist/main.js

@@ -2,7 +2,7 @@
 import {
   ConfigError,
   runDaemon
-} from "./chunk-3KIA6HF6.js";
+} from "./chunk-NJNANA6A.js";
 import "./chunk-XIJKEY4L.js";
 
 // src/main.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skylandnpm/octopus-proxy",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "type": "module",
   "description": "Octopus host proxy: OpenCode, Codex, ZCode and Pi adapters with service installer CLI",
   "bin": {