@sleep2agi/agent-network 2.3.0-preview.85 → 2.3.0-preview.87

package/dist/src/opencode-agent-node-pair.d.ts

@@ -1,9 +1,9 @@
-export declare const PAIRED_AGENT_NETWORK_VERSION = "2.3.0-preview.85";
-export declare const PAIRED_AGENT_NODE_VERSION = "2.5.0-preview.66";
-export declare const PAIRED_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.66";
-export declare const OPENCODE_AGENT_NETWORK_VERSION = "2.3.0-preview.85";
-export declare const OPENCODE_AGENT_NODE_VERSION = "2.5.0-preview.66";
-export declare const OPENCODE_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.66";
+export declare const PAIRED_AGENT_NETWORK_VERSION = "2.3.0-preview.87";
+export declare const PAIRED_AGENT_NODE_VERSION = "2.5.0-preview.67";
+export declare const PAIRED_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.67";
+export declare const OPENCODE_AGENT_NETWORK_VERSION = "2.3.0-preview.87";
+export declare const OPENCODE_AGENT_NODE_VERSION = "2.5.0-preview.67";
+export declare const OPENCODE_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.67";
 export type PairedAgentNodeResolution = {
     spec: string;
     args: string[];

package/dist/src/opencode-package-binary.d.ts

@@ -18,4 +18,9 @@ export declare function discoverOpencodeForbiddenRoots(cwd?: string): string[];
 export declare function validateOpencodePackageBinary(rawBinary: string, options: ValidateOpencodePackageBinaryOptions): string;
 /** Resolve the first *valid package-owned* OpenCode entry on PATH. Invalid
  * project-local shims are skipped so a later trusted global install can win. */
-export declare function resolveOpencodePackageBinaryFromPath(searchPath: string, options: ValidateOpencodePackageBinaryOptions): string;
+/** #1845 层① —— 包身份校验只依赖 POSIX 的 lstat/uid/mode 语义,darwin 与 linux 等价
+ * (2026-09-07 Mac mini 真跑:home 前缀 npm 安装 → VALIDATE_OK;/tmp 下祖先 1777 仍被拒)。
+ * win32 没有 uid、也没有 0o111 可执行位,继续拦。平台可注入,便于在 Linux CI 上测三种分支。 */
+export declare const OPENCODE_VERIFIER_PLATFORMS: ReadonlySet<NodeJS.Platform>;
+export declare function opencodeVerifierSupportsPlatform(platform?: NodeJS.Platform): boolean;
+export declare function resolveOpencodePackageBinaryFromPath(searchPath: string, options: ValidateOpencodePackageBinaryOptions, platform?: NodeJS.Platform): string;

package/dist/src/opencode-safe-root.d.ts

@@ -16,7 +16,16 @@ export interface OpencodeSafeExternalRoot {
     readonly baseIno: number | bigint;
     readonly ancestors: readonly PathIdentity[];
 }
-export declare function resolveOpencodeTrustedRuntimeBase(explicit?: string): PathIdentity;
+/** #1845 层② —— 运行时隔离 base 的平台策略。规则(祖先不可符号链接、非 root 只能是本 uid、无 0o022 写位、
+ * base 本身 uid-owned 0700)三平台一样;不同的只有**默认 base 在哪**:
+ *   linux  → /run/user/<uid>(systemd 的每用户 0700 运行目录;缺失时仅 root 可建)
+ *   darwin → realpath($TMPDIR)(macOS 每用户 0700 的 /private/var/folders/xx/<hash>/T;2026-09-07 Mac mini 量过
+ *            全链:T 700 uid、<hash> 755 uid、其余 755 root,满足同一套祖先规则)
+ *   其它   → 拦(win32 没有 uid 语义)
+ * 显式 base(参数或 ANET_OPENCODE_SAFE_BASE)三平台通用。platform / env 可注入,便于在 Linux CI 上测 darwin 分支。 */
+export declare const OPENCODE_SAFE_ROOT_PLATFORMS: ReadonlySet<NodeJS.Platform>;
+export declare function defaultOpencodeRuntimeBase(uid: number, platform: NodeJS.Platform, env: NodeJS.ProcessEnv): string;
+export declare function resolveOpencodeTrustedRuntimeBase(explicit?: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): PathIdentity;
 export declare function createOpencodeSafeExternalRoot(options: {
     prefix: string;
     boundaries?: readonly string[];

package/dist/src/sibling-agent-node.d.ts

@@ -7,7 +7,15 @@ export interface SiblingAgentNode {
 export interface SiblingFs {
     exists(path: string): boolean;
     readJson(path: string): unknown;
+    /**
+     * #1832 —— npm -g / --prefix 布局下 process.argv[1] 是 `<prefix>/bin/anet` 符号链接,真实文件在
+     * `<prefix>/lib/node_modules/@sleep2agi/agent-network/…`;不解析就从 `<prefix>/bin` 往上找不到
+     * node_modules,旁边的 agent-node 永远命不中。可选:不提供或抛错时按传入路径原样找。
+     */
+    realpath?(path: string): string;
 }
+/** 入口路径先走 realpath(符号链接 → 真实文件);失败(不存在 / 无权限)退回原路径。 */
+export declare function resolveCliEntry(cliEntry: string, fs: SiblingFs): string;
 /** 从 anet 入口文件路径往上,返回最近的 `…/node_modules` 目录;找不到返回 null。 */
 export declare function nearestNodeModules(cliEntry: string): string | null;
 /** package.json 的 bin 可以是字符串或 { name: path };只认名为 agent-node 的那条。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/agent-network",
-  "version": "2.3.0-preview.85",
+  "version": "2.3.0-preview.87",
   "description": "AI Agent Network CLI — Local-first multi-agent orchestration across 6 runtimes (Claude Code CLI / Claude Agent SDK / Codex SDK / Codex app-server / Grok Build ACP / OpenCode CLI) and 8+ LLM providers. Apache 2.0.",
   "type": "module",
   "main": "dist/src/client.js",