@sleep2agi/agent-network 2.3.0-preview.9 → 2.3.0-preview.91

package/dist/src/normalize-runtime.d.ts

@@ -1,9 +1,36 @@
-export type RuntimeName = "claude-code-cli" | "codex-sdk" | "claude-agent-sdk" | "grok-build-acp";
-/** Operator-facing default for any runtime slot that comes in empty / missing / unrecognized. */
+export type RuntimeName = "claude-code-cli" | "codex-sdk" | "claude-agent-sdk" | "grok-build-acp" | "grok-build-cli" | "opencode-cli" | "codex-app-server";
+/** 一个 runtime 复用的是哪种**外部登录态**，而不是 API key。 */
+export type ReusedLogin = "claude" | "codex" | "grok";
+/**
+ * runtime → 它复用的外部登录。**只有一处定义**，VENDORS 的 `requiresAuth`
+ * 与登录态探测都引用这里。
+ *
+ * 不在表里 = 该 runtime 走 API key，不复用任何登录：
+ *   · `claude-agent-sdk` —— 走 ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY
+ *   · `opencode-cli`     —— 走 ANTHROPIC_API_KEY / OPENAI_API_KEY（vendor preset 从 env 读，不 prompt）
+ * 这条区分是有意写下来的：Vincent 那句「复用会员登录状态、不用自己输 key 和 url」
+ * 点名的是 Claude Code / Codex / Grok 三家，opencode 不在其中，别顺手加进来。
+ */
+export declare const RUNTIME_REUSED_LOGIN: Readonly<Partial<Record<RuntimeName, ReusedLogin>>>;
+/** 该 runtime 复用哪种登录；返回 undefined 表示它用 API key。 */
+export declare function reusedLoginFor(runtime: RuntimeName): ReusedLogin | undefined;
+/** Operator-facing default for a runtime slot that is empty or missing. */
 export declare const DEFAULT_RUNTIME: RuntimeName;
+export declare const SUPPORTED_RUNTIME_NAMES: readonly RuntimeName[];
 type ProfileLike = {
     runtime?: string;
     codexRuntime?: string;
 };
+/**
+ * Legacy normalization used by display and migration code. Missing, empty,
+ * and unknown values all use the safe default for backward compatibility.
+ * Security-sensitive create/start paths must call `normalizeRuntimeStrict`.
+ */
 export declare function normalizeRuntime(profileOrRuntime?: ProfileLike | string): RuntimeName;
+/**
+ * Canonicalize a runtime at an execution boundary. Missing/empty still means
+ * the documented default, but any non-empty unknown value is rejected so a
+ * typo or future runtime cannot silently execute as Claude.
+ */
+export declare function normalizeRuntimeStrict(profileOrRuntime?: ProfileLike | string): RuntimeName;
 export {};

package/dist/src/offline-age.d.ts

@@ -0,0 +1,29 @@
+/**
+ * #1648 — 名册上「刚停的节点」和「掉了三天没人发现的节点」渲染成同一个数字。
+ *
+ * `anet status` 原先只印 `N offline`。实测（2026-08-31，84 台 TM 相关节点）:
+ * 45 台 offline 里 27 台 >3 天、18 台 1–3 天、**近 6 小时内 0 台** ——
+ * 「当前没有活故障」和「有 45 台掉了」是完全不同的两个结论，而屏幕上只有后者。
+ */
+/**
+ * 🔴 hub 存的 `last_seen_at` 是 **UTC**，但字符串里**没有时区标记**
+ * （形如 `2026-08-30 21:11:24`）。直接 `new Date(raw)` 会被当成**本地时间**：
+ * 在 UTC+8 上就是整整 8 小时的偏差，而且它**不会报错** —— 只会把「4 分钟前」
+ * 读成「8 小时前」。这个错本人在 2026-08-31 亲自犯过一次，差点把
+ * 「舰队心跳陈旧」报出去。
+ */
+export declare function parseHubTimestamp(raw: unknown): number | null;
+export type OfflineAges = {
+    under1h: number;
+    h1to24: number;
+    d1to3: number;
+    over3d: number;
+    /** 🔴 没有可用时间戳的那些必须单独一格,不能并进任何一档 —— 见下 */
+    unknown: number;
+    total: number;
+};
+export declare function summarizeOfflineAges(offline: ReadonlyArray<{
+    last_seen_at?: unknown;
+}>, nowMs: number): OfflineAges;
+/** 返回空串表示「没有值得多说一句的东西」，调用方据此决定印不印。 */
+export declare function formatOfflineAges(a: OfflineAges): string;

package/dist/src/one-line-cell.d.ts

@@ -0,0 +1,20 @@
+/**
+ * CLI 里那几张对齐表(`anet status` 的 needs-attention / working,以及 Recent Tasks
+ * 和 `anet tasks`)把**用户提供的文本**直接 `slice(0, N)` 塞进一行。
+ *
+ * 🔴 任务正文里有换行时,截出来的那段会**把整张表打断**。实测(2026-08-31,
+ *    真跑 `anet status` 才看见,读代码看不出来):
+ *
+ *      grok-v1          blocked  【把你自己的名册状态修正过来 —— 两步，别做别的】
+ *
+ *      你今天两次在 22 秒内答了我的探测（G
+ *
+ *    第二行完全脱离了对齐,而且读起来像另一个节点的输出。
+ *
+ * 这里把所有空白(含 \n \r \t 和连续空格)折成单个空格再截。
+ *
+ * 🔴 **有意不加省略号**:加了会改变列宽,而列宽是这几张表现有的对齐依据。
+ *    「截断了却看不出来」是另一个问题(先存在于这里,本次不动),
+ *    不要顺手在一个修显示错位的改动里改掉它。
+ */
+export declare function oneLineCell(text: unknown, max: number): string;

package/dist/src/opencode-agent-node-pair.d.ts

@@ -0,0 +1,25 @@
+export declare const PAIRED_AGENT_NETWORK_VERSION = "2.3.0-preview.91";
+export declare const PAIRED_AGENT_NODE_VERSION = "2.5.0-preview.69";
+export declare const PAIRED_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.69";
+export declare const OPENCODE_AGENT_NETWORK_VERSION = "2.3.0-preview.91";
+export declare const OPENCODE_AGENT_NODE_VERSION = "2.5.0-preview.69";
+export declare const OPENCODE_AGENT_NODE_SPEC = "@sleep2agi/agent-node@2.5.0-preview.69";
+export type PairedAgentNodeResolution = {
+    spec: string;
+    args: string[];
+    allowPathGlobal: false;
+};
+/** The codex bridge must resolve the immutable release pair, independent of PATH. */
+export declare function pairedAgentNodeResolution(): PairedAgentNodeResolution;
+export declare function agentNodeHelpSupportsCodexAppServer(help: string): boolean;
+export declare function opencodeExactPairInstallCommand(): string;
+/** Runtime capability advertised by agent-node's operator-facing help. */
+export declare function agentNodeHelpSupportsOpencode(help: string): boolean;
+/**
+ * Resolve a package-owned agent-node entrypoint and verify its immutable
+ * release identity before it can receive `opencode-cli`. Capability text is
+ * not a security boundary: an older preview already advertised the runtime.
+ */
+export declare function validateAgentNodePackageEntrypoint(rawEntrypoint: string, packageSpec: string, expectedVersion?: string, forbiddenRoots?: readonly string[]): string;
+/** Skip invalid/local PATH shims and return the first exact trusted package. */
+export declare function resolveAgentNodePackageEntrypointFromPath(searchPath: string, packageSpec: string, expectedVersion: string, forbiddenRoots?: readonly string[]): string;

package/dist/src/opencode-auth-login.d.ts

@@ -0,0 +1,43 @@
+import type { OpencodePresetId } from "./opencode-preset";
+export declare const OPENCODE_AUTH_LOGIN_ROOT_PREFIX = "opencode-auth-login-";
+export declare const OPENCODE_AUTH_LOGIN_OWNER_FILE = ".owner.json";
+export declare const OPENCODE_AUTH_LOGIN_CLEANUP_PREFIX = ".anet-opencode-auth-cleanup-";
+export interface OpencodeAuthLoginSandbox {
+    readonly nodeWorkDir: string;
+    readonly provider: OpencodePresetId;
+    readonly root: string;
+    readonly cwd: string;
+    readonly authPath: string;
+    readonly env: Readonly<NodeJS.ProcessEnv>;
+}
+export interface CreateOpencodeAuthLoginSandboxOptions {
+    nodeWorkDir: string;
+    provider: OpencodePresetId | string;
+    parentEnv?: NodeJS.ProcessEnv;
+    /** Internal/test-only trusted external base override. */
+    launchBase?: string;
+}
+export interface OpencodeAuthLoginCredential {
+    provider: OpencodePresetId;
+    type: "api";
+    key: string;
+}
+/** Deterministic exact-1.18.1 login argv for the selected API-key flow. */
+export declare function buildOpencodeAuthLoginArgs(provider: OpencodePresetId | string): string[];
+/** Prepare a fresh, node-scoped environment for one interactive login. */
+export declare function createOpencodeAuthLoginSandbox(options: CreateOpencodeAuthLoginSandboxOptions): OpencodeAuthLoginSandbox;
+/** Repeat external-root ancestor and inode validation immediately before the
+ * vetted upstream binary is spawned. */
+export declare function revalidateOpencodeAuthLoginSandbox(sandbox: OpencodeAuthLoginSandbox): void;
+/**
+ * Read only the selected provider's exact API-key shape from the fresh root.
+ * OAuth/browser-login records and mixed/multi-provider documents are refused.
+ */
+export declare function readOpencodeAuthLoginCredential(sandbox: OpencodeAuthLoginSandbox): OpencodeAuthLoginCredential;
+/** Safely remove a sandbox created by this process. Idempotent after removal. */
+export declare function cleanupOpencodeAuthLoginSandbox(sandbox: OpencodeAuthLoginSandbox): void;
+/**
+ * Lifecycle helper for CLI integration. Spawn/wait/read the credential inside
+ * `action`; the fresh tree is cleaned on success, child failure, or throw.
+ */
+export declare function withOpencodeAuthLoginSandbox<T>(options: CreateOpencodeAuthLoginSandboxOptions, action: (sandbox: OpencodeAuthLoginSandbox) => T | Promise<T>): Promise<T>;

package/dist/src/opencode-launch-env.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Process-loader hooks that must never cross the opencode-cli launcher
+ * boundary. The exact agent-node package/entrypoint check happens before the
+ * node profile env is merged; allowing that profile to supply one of these
+ * variables would let code run before the verified entrypoint's first line.
+ */
+export declare const OPENCODE_AGENT_NODE_LOADER_ENV_KEYS: readonly ["NODE_OPTIONS", "NODE_PATH", "NODE_V8_COVERAGE", "NODE_REDIRECT_WARNINGS", "NODE_COMPILE_CACHE", "BUN_OPTIONS", "BUN_PRELOAD", "LD_PRELOAD", "LD_LIBRARY_PATH", "LD_AUDIT", "LD_DEBUG_OUTPUT", "DYLD_INSERT_LIBRARIES", "DYLD_LIBRARY_PATH", "DYLD_FRAMEWORK_PATH", "DYLD_FALLBACK_LIBRARY_PATH", "OPENSSL_CONF", "OPENSSL_ENGINES", "OPENSSL_MODULES"];
+/**
+ * Return a child env that preserves the launcher's original executable search
+ * path and removes pre-entrypoint loader/write hooks. Other operator settings
+ * (locale, proxy, custom CA, channel integration) remain backward-compatible.
+ */
+export declare function hardenOpencodeAgentNodeEnv(source: NodeJS.ProcessEnv, launcherPath: string | undefined): NodeJS.ProcessEnv;

package/dist/src/opencode-owner-mode.d.ts

@@ -0,0 +1,6 @@
+/** Linux user-private-group compatibility for ordinary umask 0002 installs. */
+export declare function opencodeOwnedPathModeIsSafe(stat: {
+    uid: number;
+    gid: number;
+    mode: number | bigint;
+}, runtimeUid?: number | undefined, runtimeGid?: number | undefined): boolean;

package/dist/src/opencode-package-binary.d.ts

@@ -0,0 +1,26 @@
+export interface ValidateOpencodePackageBinaryOptions {
+    expectedVersion: string;
+    /** A package payload may not be inside, or contain, the current project or
+     * node state tree. This rejects project-local same-version impersonators. */
+    forbiddenRoots?: readonly string[];
+}
+/** Current cwd plus every enclosing source-workspace boundary. This catches a
+ * monorepo root's node_modules when anet is invoked from packages/app. */
+export declare function discoverOpencodeForbiddenRoots(cwd?: string): string[];
+/**
+ * Bind an executable to the exact npm `opencode-ai` payload identity.
+ *
+ * `--version` output alone is not an identity boundary: a checkout can put a
+ * same-version credential-stealing shim first on PATH. Only the canonical
+ * package entrypoint with matching package metadata and trusted path modes is
+ * admitted. The returned path is the one callers must spawn verbatim.
+ */
+export declare function validateOpencodePackageBinary(rawBinary: string, options: ValidateOpencodePackageBinaryOptions): string;
+/** Resolve the first *valid package-owned* OpenCode entry on PATH. Invalid
+ * project-local shims are skipped so a later trusted global install can win. */
+/** #1845 层① —— 包身份校验只依赖 POSIX 的 lstat/uid/mode 语义,darwin 与 linux 等价
+ * (2026-09-07 Mac mini 真跑:home 前缀 npm 安装 → VALIDATE_OK;/tmp 下祖先 1777 仍被拒)。
+ * win32 没有 uid、也没有 0o111 可执行位,继续拦。平台可注入,便于在 Linux CI 上测三种分支。 */
+export declare const OPENCODE_VERIFIER_PLATFORMS: ReadonlySet<NodeJS.Platform>;
+export declare function opencodeVerifierSupportsPlatform(platform?: NodeJS.Platform): boolean;
+export declare function resolveOpencodePackageBinaryFromPath(searchPath: string, options: ValidateOpencodePackageBinaryOptions, platform?: NodeJS.Platform): string;

package/dist/src/opencode-pin.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Version this branch was validated against by the maintainers.
+ * Bumped when a new opencode-ai release passes the full Docker/E2E gate.
+ */
+export declare const OPENCODE_BUILTIN_PIN = "1.18.1";
+/** Exact upstream remediation shared by every CLI failure path. */
+export declare function opencodeExactInstallCommand(version?: string): string;
+/** Preserve package-identity diagnostics while always leaving a missing or
+ * untrusted install with an actionable exact-pin command. */
+export declare function formatOpencodePackageIdentityFailure(expectedVersion: string, detail: string): string;
+/** Where the per-machine override lives. Kept under `~/.anet/` so
+ *  it sits next to the other anet-local state. */
+export declare function opencodePinFilePath(homeDirOverride?: string): string;
+/** Shape of the override file written by `upgrade-pin`. */
+export interface OpencodePinOverride {
+    version: string;
+    /** ISO timestamp when the smoke test passed. Presence of this
+     *  field is REQUIRED for `readEffectivePin()` to trust the file —
+     *  a hand-edited version without a smoke marker is refused. */
+    smokePassedAt: string;
+    /** Free-form note about what the smoke checked (initialize +
+     *  session/new by default). Kept so a future review can tell what
+     *  bar the pin actually cleared. */
+    smokeNote?: string;
+}
+export interface EffectivePin {
+    version: string;
+    source: "override-file" | "builtin";
+    smokePassedAt?: string;
+}
+/**
+ * Recognize a validated override only when it records the exact built-in
+ * release pin. A different locally-smoked version is deliberately ignored:
+ * the lightweight ACP smoke does not replace the maintainer's full security
+ * and reply-path gate. Malformed/stale files also fall back to the built-in.
+ */
+export declare function readEffectivePin(homeDirOverride?: string): EffectivePin;
+/**
+ * Write the override — SHOULD ONLY be called after the smoke test
+ * has actually passed. The command layer in `bin/cli.ts` is
+ * responsible for gating this; this function does no
+ * verification of its own beyond shape.
+ */
+export declare function writePinOverride(version: string, smokePassedAt: string, smokeNote?: string, homeDirOverride?: string): void;

package/dist/src/opencode-preset.d.ts

@@ -0,0 +1,73 @@
+export type OpencodePresetId = "anthropic" | "openai";
+export interface OpencodePreset {
+    id: OpencodePresetId;
+    displayName: string;
+    envKey: string;
+    signupUrl: string;
+    /** How opencode's provider config identifies this vendor in the
+     *  `provider.<id>.options.baseUrl` config. Left null when we don't
+     *  need to override the built-in default. */
+    configProviderId: "anthropic" | "openai";
+}
+export declare const OPENCODE_PRESETS: OpencodePreset[];
+/**
+ * OpenCode tools disabled for the default `opencode-cli` profile.
+ *
+ * This policy reduces the model's ambient filesystem/shell surface. It is
+ * deliberately represented in the generated opencode.json so operators can
+ * inspect the default, but it is not an OS security boundary: a same-uid
+ * OpenCode process can still read files allowed by normal filesystem ACLs.
+ */
+export declare const OPENCODE_DEFAULT_DISABLED_TOOLS: readonly ["bash", "read", "glob", "grep", "edit", "write", "list", "task", "skill", "webfetch", "websearch", "question"];
+export declare function buildOpencodeDefaultToolsPolicy(): Record<string, false>;
+export declare function buildOpencodeDefaultPermissionPolicy(): Record<string, "deny">;
+export declare function findOpencodePreset(id: string): OpencodePreset | null;
+/**
+ * Look up the API key for a preset from the current process env.
+ * Callers MUST handle the `null` case (per RFC v0.3 D3 + 通信龙 PR③
+ * flag: "从 env 读, 别 prompt"). Returns null so the wizard can
+ * emit a clear message telling the operator to export the env var
+ * and re-run — rather than silently continuing without a key.
+ */
+export declare function readPresetKeyFromEnv(preset: OpencodePreset, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * opencode.ai's auth.json shape:
+ *   { "<providerId>": { "type": "api", "key": "..." } }
+ * Same shape verified against the release pin opencode-ai@1.18.1.
+ */
+export declare function buildAuthJsonBody(preset: OpencodePreset, apiKey: string): string;
+export type OpencodePrivateProfileFilename = "config.json" | ".env";
+/**
+ * Establish the boundary before saveProfile/rewritePlainSecrets writes the
+ * node token or dotenv key. The expected shape is exactly
+ * `<project>/.anet/nodes/<node>`. Every existing path is inspected with
+ * lstat + O_NOFOLLOW and inode checks; absent private directories are created
+ * one component at a time. A pre-planted node-root/config/.env symlink is a
+ * hard error before any secret-bearing write.
+ */
+export declare function prepareOpencodeNodeForProfileWrite(nodeWorkDir: string): string;
+export declare function readOpencodePrivateProfileFile(nodeWorkDir: string, filename: OpencodePrivateProfileFilename): string | undefined;
+export declare function writeOpencodePrivateProfileFile(nodeWorkDir: string, filename: OpencodePrivateProfileFilename, body: string): string;
+/**
+ * Write auth.json into the opencode config root that lives under
+ * `nodeWorkDir` (the per-node OpenCode data root). mode 0o600 limits
+ * filesystem access to the owning OS account; it does not prevent a
+ * same-uid OpenCode child from opening the file directly. Directory is
+ * created if missing.
+ *
+ * Returns the absolute path we wrote for logging.
+ */
+export declare function writeOpencodeAuthJson(nodeWorkDir: string, preset: OpencodePreset, apiKey: string): string;
+/**
+ * New keyless nodes must not inherit a private-but-preplanted credential.
+ * Keep the file present as an explicit empty object so the creation log's
+ * "auth not configured" statement matches the state OpenCode will consume.
+ */
+export declare function clearOpencodeAuthJson(nodeWorkDir: string): string;
+/**
+ * Companion opencode.json: records only the selected blessed provider
+ * identity and safe-by-default tool policy. Pre-existing model routing and
+ * arbitrary OpenCode integrations are stripped; operators may explicitly set
+ * a model after creation, which the runtime's separate safe renderer retains.
+ */
+export declare function writeOpencodeConfigJson(nodeWorkDir: string, preset: OpencodePreset): string;

package/dist/src/opencode-runtime-binding.d.ts

@@ -0,0 +1,30 @@
+export declare const OPENCODE_RUNTIME_BINDING_SCHEMA_VERSION: 1;
+export declare const OPENCODE_RUNTIME_BINDING_RUNTIME: "opencode-cli";
+export declare const OPENCODE_RUNTIME_BINDINGS_DIRECTORY = "opencode-runtime-bindings";
+export interface OpencodeRuntimeBinding {
+    schemaVersion: typeof OPENCODE_RUNTIME_BINDING_SCHEMA_VERSION;
+    runtime: typeof OPENCODE_RUNTIME_BINDING_RUNTIME;
+    projectRoot: string;
+    nodeId: string;
+}
+/** Windows reports synthetic POSIX permission bits; retain all other checks there. */
+export declare function isOpencodeRuntimeBindingModeSecure(mode: number, exactMode?: number, platform?: NodeJS.Platform): boolean;
+/** Resolve the deterministic binding path without creating HOME state. */
+export declare function opencodeRuntimeBindingPath(nodeWorkDir: string, homeDirectory?: string): string;
+/** Persist an external, immutable-by-config record that this node was created as OpenCode. */
+export declare function writeOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): string;
+/** Read and validate a binding. Missing bindings return undefined; unsafe or tampered state throws. */
+export declare function readOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): OpencodeRuntimeBinding | undefined;
+/**
+ * Remove only the exact, validated binding for this node. Missing exact state is
+ * idempotent; malformed, replaced, or unsafe state always fails closed.
+ */
+export declare function removeOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): boolean;
+/** Assert that the external record exists and exactly identifies this node as opencode-cli. */
+export declare function assertExactOpencodeRuntimeBinding(nodeWorkDir: string, homeDirectory?: string): OpencodeRuntimeBinding;
+/**
+ * Refuse OpenCode node state committed to a surrounding Git index. A normal
+ * non-Git project is allowed. Git is always invoked directly with argv and a
+ * literal pathspec; no shell or command interpolation is used.
+ */
+export declare function assertOpencodeNodeStateUntracked(nodeWorkDir: string): void;

package/dist/src/opencode-safe-root.d.ts

@@ -0,0 +1,36 @@
+/** Exact 1.18.1 project/instruction discovery surface plus project-root
+ * redirects. Any existing entry, including a broken symlink, is a refusal. */
+export declare const OPENCODE_SAFE_ANCESTOR_CANDIDATES: readonly ["opencode.jsonc", "opencode.json", ".opencode", "AGENTS.md", "CLAUDE.md", "CONTEXT.md", ".claude", ".agents", ".git"];
+interface PathIdentity {
+    path: string;
+    dev: number | bigint;
+    ino: number | bigint;
+}
+export interface OpencodeSafeExternalRoot {
+    readonly base: string;
+    readonly root: string;
+    readonly cwd: string;
+    readonly dev: number | bigint;
+    readonly ino: number | bigint;
+    readonly baseDev: number | bigint;
+    readonly baseIno: number | bigint;
+    readonly ancestors: readonly PathIdentity[];
+}
+/** #1845 层② —— 运行时隔离 base 的平台策略。规则(祖先不可符号链接、非 root 只能是本 uid、无 0o022 写位、
+ * base 本身 uid-owned 0700)三平台一样;不同的只有**默认 base 在哪**:
+ *   linux  → /run/user/<uid>(systemd 的每用户 0700 运行目录;缺失时仅 root 可建)
+ *   darwin → realpath($TMPDIR)(macOS 每用户 0700 的 /private/var/folders/xx/<hash>/T;2026-09-07 Mac mini 量过
+ *            全链:T 700 uid、<hash> 755 uid、其余 755 root,满足同一套祖先规则)
+ *   其它   → 拦(win32 没有 uid 语义)
+ * 显式 base(参数或 ANET_OPENCODE_SAFE_BASE)三平台通用。platform / env 可注入,便于在 Linux CI 上测 darwin 分支。 */
+export declare const OPENCODE_SAFE_ROOT_PLATFORMS: ReadonlySet<NodeJS.Platform>;
+export declare function defaultOpencodeRuntimeBase(uid: number, platform: NodeJS.Platform, env: NodeJS.ProcessEnv): string;
+export declare function resolveOpencodeTrustedRuntimeBase(explicit?: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): PathIdentity;
+export declare function createOpencodeSafeExternalRoot(options: {
+    prefix: string;
+    boundaries?: readonly string[];
+    base?: string;
+}): OpencodeSafeExternalRoot;
+export declare function revalidateOpencodeSafeExternalRoot(context: OpencodeSafeExternalRoot): void;
+export declare function cleanupOpencodeSafeExternalRoot(context: OpencodeSafeExternalRoot): void;
+export {};

package/dist/src/opencode-smoke-env.d.ts

@@ -0,0 +1 @@
+export declare function buildOpencodeSmokeEnv(parentEnv: NodeJS.ProcessEnv, smokeRoot: string, cwd?: string): NodeJS.ProcessEnv;

package/dist/src/outbound-attachments.d.ts

@@ -0,0 +1,60 @@
+/** One attachment as the Hub stores it. `file_id` comes from commhub_upload_file. */
+export interface OutboundAttachment {
+    type: "file";
+    file_id: string;
+    name?: string;
+    mime?: string;
+    size?: number;
+}
+export type NormalizeResult = {
+    ok: true;
+    attachments: OutboundAttachment[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Normalize caller-supplied attachments into what the Hub expects.
+ *
+ * Absent input is not an error and yields no `attachments` key at all — a call
+ * without attachments must produce a byte-identical request to before this
+ * existed, or every existing reply changes behaviour the day this ships.
+ */
+/** 2026-09-15 —— LLM 常把数组参数当成 JSON 字符串传(TM汇报马 真机:attachments 是 "[{...}]" 字符串,回复 ok:true 但 hub 里没有附件)。
+ *  字符串先 parse;parse 不出来是错误,不是「没有附件」。 */
+export declare function coerceAttachmentsArg(input: unknown): unknown;
+export declare function normalizeOutboundAttachments(input: unknown): NormalizeResult;
+/**
+ * Spread into a Hub request body. Empty → `{}`, so a call with no attachments
+ * is unchanged from before this module existed.
+ */
+export declare function attachmentsField(attachments: readonly OutboundAttachment[]): Record<string, unknown>;
+/** `send_task` carries them under `meta`, not at the top level. */
+export declare function attachmentsMeta(attachments: readonly OutboundAttachment[], existingMeta?: unknown): Record<string, unknown>;
+/** Shared wording for the two tool schemas, so they cannot drift apart. */
+export declare const ATTACHMENTS_SCHEMA: {
+    type: "array";
+    description: string;
+    items: {
+        type: "object";
+        properties: {
+            file_id: {
+                type: string;
+                description: string;
+            };
+            name: {
+                type: string;
+                description: string;
+            };
+            mime: {
+                type: string;
+                description: string;
+            };
+            size: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};

package/dist/src/outbound-tool-names.d.ts

@@ -0,0 +1 @@
+export declare const OUTBOUND_TOOL_NAMES: Set<string>;

package/dist/src/owned-roots.d.ts

@@ -0,0 +1,58 @@
+export type OwnedRootRole = "agent";
+export interface OwnedRoot {
+    pid: number;
+    birth: string;
+    role: OwnedRootRole;
+}
+/** 🔴 #1438 — 发现阶段(`ps`)与后续 `/proc/<pid>/stat` 读之间,pid 可能被回收。
+ *  为让 resolveOwnedRoots 能识别「pid 相同、进程不同」,发现阶段必须在
+ *  **同一次 `ps` 快照**里同时取 pid 与一个稳定的启动时刻签名(lstart),
+ *  并把这个签名一路带进来做比对。同一次 ps 内的 pid 与 lstart 无 TOCTOU。 */
+export interface OwnedRootCandidate {
+    pid: number;
+    /** 发现时刻的 `ps -o lstart=` 字符串(24 字符定宽),用于识别 pid 回收。 */
+    discoveredBirth: string;
+}
+export interface OwnedRootProbes {
+    /** 进程这一代的出生时刻(以「存储格式」返回,通常是 /proc/stat starttime jiffies);
+     *  读不到返回 null(可能已退出,也可能无权限)。用于写进 lifecycle 记录。 */
+    birth(pid: number): string | null;
+    /** 🔴 只有**确证**进程不存在时返回 true。无权限等一律视为存在。 */
+    vanished(pid: number): boolean;
+    /** 🔴 #1438 — 返回**当前**pid 的 lstart 签名,和发现阶段同格式。
+     *  用来识别 pid 回收:发现时是 A、现在读回来是 B ⇒ pid 已被复用。
+     *  读不到返回 null(进程已退出,或读 ps 失败)。 */
+    currentBirthSignature(pid: number): string | null;
+}
+/** 把 `ps` 发现的 (pid, birth) 候选冻结成 owned roots。
+ *
+ * · currentBirthSignature 与 discoveredBirth **相等** ⇒ 同一代,收下
+ * · currentBirthSignature 与 discoveredBirth **不等** ⇒ 🔴 #1438 pid 已被复用,
+ *     现在这个 pid 属于另一个进程 B。**跳过**(而不是收下 B 当我们的节点):
+ *     stop 的目的是让 A 没了;B 是无关进程,不能因为它恰好占了 A 的 pid 就被杀。
+ * · currentBirthSignature 为 null、**确证已消失**   ⇒ 跳过(stop 想要的结果)
+ * · currentBirthSignature 为 null、进程仍在        ⇒ throw(权限等真问题)
+ */
+export declare function resolveOwnedRoots(candidates: OwnedRootCandidate[], probes: OwnedRootProbes): OwnedRoot[];
+/** 🔴 正向判定「进程确实没了」,而不是「读失败就假设没了」。
+ *
+ * `kill(pid, 0)` 不送信号,只做存在性与权限探测:
+ *   · ESRCH  ⇒ 确证不存在
+ *   · EPERM  ⇒ 存在,只是不属于本用户
+ *   · 其他   ⇒ 保守当作存在(判据只在**确证**时放行)
+ */
+export declare function processVanished(pid: number, kill?: (p: number, s: number) => void): boolean;
+/** 🔴 #1458 — kill 前的 pid 回收保护:发现阶段捕获的 discoveredBirth 与
+ *  **当前**probeCurrentSignature(pid) 相等 ⇒ 同一代,可以信号。
+ *
+ *  · currentSig === discoveredBirth ⇒ true(同代,可 kill)
+ *  · currentSig !== discoveredBirth ⇒ false(pid 被回收,现在这个 pid 是另一
+ *    个进程 B。**不要 kill** —— B 与我们要 stop 的 agent 无关)
+ *  · currentSig === null            ⇒ false(pid 已消失或读不到;caller 判
+ *    是消失就该 skip,权限问题应额外处理但不该 kill 未知对象)
+ *
+ *  与 resolveOwnedRoots 内嵌的同款比较**在语义上一致**,但在**时间点上不同**:
+ *    resolveOwnedRoots 用于「冻结」时刻(装进 lifecycle owner)
+ *    isSameIncarnation 用于「发信号」前那一瞬(rename 的 kill 循环)
+ *  两个时刻中间可能又有窗口,所以这个检查要**离 process.kill 越近越好**。 */
+export declare function isSameIncarnation(pid: number, discoveredBirth: string, probeCurrentSignature: (pid: number) => string | null): boolean;

package/dist/src/owner-env-file.d.ts

@@ -0,0 +1,2 @@
+/** Load a reviewed owner-only env file without following a planted link. */
+export declare function loadOwnerOnlyEnvFile(path: string | undefined, env?: NodeJS.ProcessEnv): void;

package/dist/src/package-mode-preflight.d.ts

@@ -0,0 +1,41 @@
+export interface UmaskVerdict {
+    /** Will a freshly npm-extracted payload fail the (mode & 0o022) === 0 check? */
+    willProduceUnsafeModes: boolean;
+    /** Octal umask string as an operator would type it. */
+    umaskOctal: string;
+    /** Which write bits this umask fails to mask off. */
+    leaks: Array<"group" | "other">;
+}
+/**
+ * Read a umask value the way the package check will experience it.
+ *
+ * A umask bit SET means "withhold this permission". So group-write is withheld
+ * only when 0o020 is set in the umask; umask 0002 withholds other-write and
+ * nothing else, which is exactly the failing case.
+ */
+export declare function judgeUmask(umask: number): UmaskVerdict;
+/**
+ * One line for `anet doctor`, or null when there is nothing to say.
+ *
+ * 🔴 Windows gets a different sentence, not the same one. There, umask is always
+ *    0000 and this fires on every machine, while both remedies it names —
+ *    `umask 0022` and `chmod -R` — do not exist. The conclusion is still true
+ *    (opencode-cli will refuse), but for another reason entirely: its check is
+ *    `if (runtimeUid === undefined) return false`, and Windows has no getuid.
+ *    An always-on warning whose fix cannot be typed teaches people to ignore
+ *    the warnings that can be.
+ */
+export declare function describeUmaskRisk(verdict: UmaskVerdict, platform?: NodeJS.Platform): string | null;
+export interface ExtractedPayload {
+    path: string;
+    uid: number;
+    mode: number;
+}
+/**
+ * Which already-extracted payloads would be rejected right now.
+ *
+ * Reports facts about copies that exist on disk; it never fetches. An empty
+ * result means "nothing extracted yet", which is not the same as "safe" — the
+ * umask verdict is what speaks to the next fetch.
+ */
+export declare function rejectedPayloads(payloads: ExtractedPayload[], processUid: number): ExtractedPayload[];

package/dist/src/posix-codex-copresence.d.ts

@@ -0,0 +1,8 @@
+export type ProcRow = {
+    pid: number;
+    ppid: number;
+    start: string;
+};
+export declare function ownedConnectionFromSnapshot(rootPid: number, beforeStart: string | null, afterStart: string | null, rows: ProcRow[], socketOwners: ReadonlyMap<number, ReadonlySet<string>>, establishedInodes: ReadonlySet<string>, unread?: boolean): boolean;
+/** Fail-closed attribution of an exact loopback connection to a managed POSIX TUI tree. */
+export declare function probePosixOwnedLoopbackConnection(rootPid: number, port: number, platform?: NodeJS.Platform): boolean;

package/dist/src/posix-modes.d.ts

@@ -0,0 +1,36 @@
+export declare function posixFileModes(platform?: NodeJS.Platform): boolean;
+/** chmod where the platform has modes; a no-op where it does not. */
+export declare function chmodIfPosix(path: string, mode: number): void;
+/** fchmod where the platform has modes; a no-op where it does not. */
+export declare function fchmodIfPosix(fd: number, mode: number): void;
+/**
+ * Whether a stat's mode may be judged at all.
+ *
+ * Windows synthesises mode bits, so `(mode & 0o022) !== 0` is true for ordinary
+ * files there and every POSIX-shaped safety check reads as "unsafe". A check
+ * that can only ever return one answer is not a check.
+ */
+export declare function modeIsJudgeable(platform?: NodeJS.Platform): boolean;
+/**
+ * fsync a DIRECTORY handle, where the platform supports it.
+ *
+ * The durability barrier after an atomic rename: on POSIX, fsyncing the parent
+ * makes the rename itself survive a crash, not just the file's bytes. Windows
+ * has no equivalent — FlushFileBuffers works on files, and on a directory
+ * handle it fails:
+ *
+ *     [anet] FATAL: Error: EPERM: operation not permitted, fsync
+ *         at fsyncSync (node:fs:1285:11)
+ *
+ * which is `anet start <node>` dying on its first private-state write. Reported
+ * from the Windows box while it was running the previous fix, i.e. this is the
+ * next call in the same family, not a regression of that one.
+ *
+ * 🔴 Note what is NOT skipped: the fsync of the temp FILE before the rename.
+ *    That one works on Windows and carries the bytes. What is skipped is only
+ *    the parent-directory barrier, which the platform does not offer at all —
+ *    NTFS journals the rename's metadata itself. Skipping an operation the OS
+ *    cannot perform is not a weakened guarantee; crashing instead of writing
+ *    the file is a much larger one.
+ */
+export declare function fsyncDirectoryIfSupported(fd: number): void;

package/dist/src/primary-network.d.ts

@@ -0,0 +1,23 @@
+export interface PrimaryNetworkResponse {
+    ok?: boolean;
+    current_network?: unknown;
+    networks?: unknown;
+}
+export type PrimaryNetworkFetch = (input: string, init: {
+    headers: Record<string, string>;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<PrimaryNetworkResponse>;
+}>;
+export declare class PrimaryNetworkResolutionError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Resolve the authenticated user's active network from the server's explicit
+ * `/api/auth/me.current_network` field.
+ *
+ * Do not fall back to a network name or list position: both are presentation
+ * details, and guessing either can silently run a command in the wrong network.
+ */
+export declare function resolvePrimaryNetwork(hub: string, headers: Record<string, string>, fetchImpl?: PrimaryNetworkFetch): Promise<string>;