@xyagent/cli 0.0.1

package/src-ext/core/agentlinkToolsRegistry.mjs

@@ -0,0 +1,323 @@
+// Agentlink 自定义工具的声明 + 执行器。
+//
+// 这些工具是暴露给 Claude / Codex / Hermes / OpenClaw 用的(通过 MCP 桥
+// + plugin tool injection)。不是给用户的。
+//
+// 设计原则:
+//   - 每个工具的 schema 明确、最小
+//   - 副作用只影响当前 session(change_title / notify_user / attach_file)
+//   - 未来要做"跨设备"动作(推送、日历等)在这里注册
+//
+// 每个工具的 handler 返回:
+//   { content: [{ type: "text", text: "..." }], isError?: boolean }
+// 符合 MCP tools/call 的标准 result 结构。
+//
+// ctx 注入:
+//   publishEvent(event)  bridge 的 worker.publishEvent 偏函数(已绑定当前
+//                        in-flight requestId)。无 in-flight 时是 no-op。
+//   runtime              "claude" / "codex" / "hermes" / "openclaw"
+//   log                  bridge logger
+//   relayConfig          { baseUrl, gatewayId, token } 给 cosUploadClient 用,
+//                        agentlink_attach_file 需要。caller 没传就 attach 工具
+//                        不可用(仅 list 不报)。
+
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import { uploadFileToCos, inferMime } from "./cosUploadClient.mjs";
+import { checkDenylist } from "./attachDenylist.mjs";
+import { appendAuditEntry } from "./attachAuditLog.mjs";
+
+// attach 工具的大小上限,与 spec D2 / relay 端一致(50 MiB)。
+const ATTACH_MAX_BYTES = 50 * 1024 * 1024;
+
+/**
+ * @param {{ publishEvent: (event:object)=>Promise<any>, runtime: string, log: any, relayConfig?: object, _uploadFn?: Function }} ctx
+ *   _uploadFn: 可选注入，用于单元测试覆盖 uploadFileToCos（避免真 COS 网络请求）
+ * @returns {{ list: Array<{name,description,inputSchema}>, dispatch: (name,args)=>Promise<any> }}
+ */
+export function createAgentlinkToolsRegistry(ctx) {
+  if (typeof ctx?.publishEvent !== "function") {
+    throw new Error("agentlinkTools: publishEvent function required");
+  }
+  if (!ctx?.log) throw new Error("agentlinkTools: log required");
+
+  const log = ctx.log.child({ comp: "mcp", side: "agentlink-tools" });
+
+  const tools = [
+    {
+      name: "agentlink_change_title",
+      description:
+        "Change the title of the current agentlink session. Visible to the user in the app's " +
+        "session list. Use sparingly.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          title: { type: "string", description: "New title text (<= 120 chars)." },
+        },
+        required: ["title"],
+      },
+    },
+    {
+      name: "agentlink_notify_user",
+      description:
+        "Send a one-shot notification message to the user's mobile app. Shows as a system " +
+        "bubble in the chat. Use for important status changes only.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          message: { type: "string" },
+          level: { type: "string", enum: ["info", "warn", "error"] },
+        },
+        required: ["message"],
+      },
+    },
+    {
+      name: "agentlink_attach_file",
+      description:
+        "Share a local file on this host with the user's mobile app. The mobile app cannot " +
+        "access host filesystem paths directly. Call this whenever the user might want to view " +
+        "a file you are referring to. The file is uploaded to cloud storage and an attachment " +
+        "event is sent to the app; the user sees a preview card and can tap to view contents. " +
+        "Files matching the privacy denylist (SSH keys, .env, credentials, .git, etc.) are " +
+        "rejected. Maximum file size is 50 MiB.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: {
+            type: "string",
+            description:
+              "Absolute path or '~/'-prefixed path on this host. Symlinks are resolved before processing.",
+          },
+          reason: {
+            type: "string",
+            description: "Optional short reason for sharing, recorded in the host's audit log.",
+          },
+        },
+        required: ["path"],
+      },
+    },
+  ];
+
+  async function dispatch(name, args) {
+    const input = args && typeof args === "object" ? args : {};
+    // attach_file 的 path/reason 对线下调试很关键(audit log 也会记一份,但是个
+    // dispatcher 入口 log 让我们看到"哪个 caller 触发"了 attach: agent 主动 vs
+    // bridgeAttachAutoScanner 自动)。reason="auto-scan" → 自动触发,其它 reason
+    // 是 agent 显式调用。
+    if (name === "agentlink_attach_file") {
+      log.info("mcp_bridge.forward", "agentlink tool called", {
+        name,
+        path: typeof input.path === "string" ? input.path : null,
+        reason: typeof input.reason === "string" ? input.reason : null,
+      });
+    } else {
+      log.info("mcp_bridge.forward", "agentlink tool called", { name });
+    }
+    switch (name) {
+      case "agentlink_change_title": {
+        const title = String(input.title || "").slice(0, 120);
+        if (!title) return errResult("title required");
+        await ctx.publishEvent({ event: "title_change", payload: { title } });
+        return okResult(`title changed to: ${title}`);
+      }
+      case "agentlink_notify_user": {
+        const message = String(input.message || "");
+        const level = input.level === "warn" || input.level === "error" ? input.level : "info";
+        if (!message) return errResult("message required");
+        await ctx.publishEvent({ event: "notification", payload: { message, level } });
+        return okResult(`notified user (level=${level})`);
+      }
+      case "agentlink_attach_file": {
+        // 完整流程见 spec host-file-attach-cos / Requirement: CLI exposes
+        // agentlink_attach_file MCP tool。注意点:
+        //   1. try/finally 保证每个 exit path 都写一行 audit
+        //   2. 失败时 throw 一个带 .reason 的对象,统一映射到 tool result
+        //      `ok: false, reason: <code>`(agent 拿到的)
+        //   3. publishEvent 失败不视为 attach 失败(对象已在 COS),只是 App
+        //      没收到事件;audit 记 publish_failed
+        const rawPath = String(input.path || "").trim();
+        const reason = String(input.reason || "").slice(0, 256);
+        const agentId = ctx.relayConfig?.gatewayId || null;
+        const auditBase = { agentId, reason: reason || undefined };
+        if (!rawPath) {
+          await appendAuditEntry({ ...auditBase, result: "denied", denylist_pattern: "<empty-path>" });
+          return errResult(JSON.stringify({ ok: false, reason: "denied" }));
+        }
+
+        // 1) 路径展开 + realpath。让 denylist 看到的就是用户文件系统上的实
+        //    际路径(symlink 解析后),防 ../ 之类的绕过。
+        let absPath = rawPath;
+        if (absPath.startsWith("~/")) {
+          absPath = path.join(os.homedir(), absPath.slice(2));
+        } else if (absPath === "~") {
+          absPath = os.homedir();
+        }
+        absPath = path.resolve(absPath);
+        try {
+          absPath = await fs.realpath(absPath);
+        } catch {
+          // realpath 失败往往因为文件不存在;留到 stat 阶段统一处理 not_found
+        }
+
+        // 2) denylist
+        const dl = checkDenylist(absPath);
+        if (dl.denied) {
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            result: "denied",
+            denylist_pattern: dl.pattern,
+          });
+          return errResult(JSON.stringify({ ok: false, reason: "denied" }));
+        }
+
+        // 3) stat + size check
+        let st;
+        try {
+          st = await fs.stat(absPath);
+        } catch (err) {
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            result: "not_found",
+            error: err?.code || err?.message?.slice(0, 80),
+          });
+          return errResult(JSON.stringify({ ok: false, reason: "not_found" }));
+        }
+        if (!st.isFile()) {
+          await appendAuditEntry({ ...auditBase, path: absPath, result: "not_found", error: "not a regular file" });
+          return errResult(JSON.stringify({ ok: false, reason: "not_found" }));
+        }
+        if (st.size > ATTACH_MAX_BYTES) {
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            size: st.size,
+            result: "too_large",
+          });
+          return errResult(JSON.stringify({ ok: false, reason: "too_large" }));
+        }
+
+        // 4) read + sha256 + mime
+        let content;
+        try {
+          content = await fs.readFile(absPath);
+        } catch (err) {
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            size: st.size,
+            result: "not_found",
+            error: err?.code || err?.message?.slice(0, 80),
+          });
+          return errResult(JSON.stringify({ ok: false, reason: "not_found" }));
+        }
+        const sha256 = crypto.createHash("sha256").update(content).digest("hex");
+        const basename = path.basename(absPath);
+        const mime = inferMime(basename);
+
+        // 5–7) sign → PUT → commit (cosUploadClient 内部分类)
+        if (!ctx.relayConfig?.baseUrl || !ctx.relayConfig?.gatewayId || !ctx.relayConfig?.token) {
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            sha256,
+            size: st.size,
+            mime,
+            result: "sign_failed",
+            error: "relayConfig missing on registry ctx",
+          });
+          return errResult(JSON.stringify({ ok: false, reason: "sign_failed" }));
+        }
+        // _uploadFn 可由单元测试注入以避免真 COS 网络请求；生产走 uploadFileToCos
+        const doUpload = ctx._uploadFn ?? uploadFileToCos;
+        let uploadResult;
+        try {
+          uploadResult = await doUpload({
+            name: basename,
+            content,
+            mime,
+            size: st.size,
+            sha256,
+            relayConfig: ctx.relayConfig,
+            log,
+          });
+        } catch (err) {
+          const kind = err?.kind || "sign_failed";
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            sha256,
+            size: st.size,
+            mime,
+            result: kind,
+            error: err?.message?.slice(0, 200),
+          });
+          return errResult(JSON.stringify({ ok: false, reason: kind }));
+        }
+
+        // 8) publishEvent — 失败不致命,但要 audit
+        // spec D6: payload 含 cosObjectKey，不含 publicUrl
+        const eventPayload = {
+          name: basename,
+          cosObjectKey: uploadResult.cosObjectKey,
+          mime,
+          size: st.size,
+          sha256,
+          // 故意不带 absPath: 不让本机文件系统布局泄到 App / 云端日志
+        };
+        let publishOk = true;
+        try {
+          await ctx.publishEvent({ event: "attachment", payload: eventPayload });
+        } catch (err) {
+          publishOk = false;
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            sha256,
+            size: st.size,
+            mime,
+            result: "publish_failed",
+            error: err?.message?.slice(0, 200),
+          });
+          // 此处仍然继续:对象已在 COS,返回 ok 给 agent,只是 App 端不感知本轮事件
+        }
+        if (publishOk) {
+          await appendAuditEntry({
+            ...auditBase,
+            path: absPath,
+            sha256,
+            size: st.size,
+            mime,
+            result: "ok",
+            cosObjectKey: uploadResult.cosObjectKey,
+            deduped: uploadResult.deduped || false,
+          });
+        }
+        // spec D6: tool result = { ok, cosObjectKey, sha256, deduped }，无 url 字段
+        return okResult(
+          JSON.stringify({
+            ok: true,
+            cosObjectKey: uploadResult.cosObjectKey,
+            sha256,
+            deduped: uploadResult.deduped || false,
+          }),
+        );
+      }
+      default:
+        return errResult(`unknown tool: ${name}`);
+    }
+  }
+
+  return { list: tools, dispatch };
+}
+
+function okResult(text) {
+  return { content: [{ type: "text", text }] };
+}
+
+function errResult(text) {
+  return { content: [{ type: "text", text }], isError: true };
+}

package/src-ext/core/agentlinkToolsServer.mjs

@@ -0,0 +1,109 @@
+// 本地 HTTP server：暴露 agentlink tools 给 agentlink-mcp-stdio.mjs 桥脚本。
+//
+// 协议是简化的 "MCP-ish" JSON over HTTP：
+//   POST /tools/list          → { tools: [...] }
+//   POST /tools/call          { name, arguments } → { content: [...], isError? }
+//
+// 和 Unix 标准 MCP 差别：这里不做 initialize，因为只给自家 stdio bridge 用，
+// 不对外通用。跨平台统一选 TCP 而非 UDS（见 docs/PLATFORM.md）。
+//
+// 鉴权：启动时生成 auth token，桥脚本用 header `X-Agentlink-Auth` 带过来。
+
+import http from "node:http";
+import { randomBytes } from "node:crypto";
+
+export async function startAgentlinkToolsServer({ registry, log }) {
+  if (!registry) throw new Error("startAgentlinkToolsServer: registry required");
+  if (!log) throw new Error("startAgentlinkToolsServer: log required");
+  const sLog = log.child({ comp: "mcp", side: "agentlink-tools-server" });
+
+  const authToken = randomBytes(16).toString("hex");
+
+  const server = http.createServer(async (req, res) => {
+    try {
+      if (req.method !== "POST") {
+        res.statusCode = 405;
+        res.end();
+        return;
+      }
+      // 接受 Authorization: Bearer <token>(标准 MCP / 与 agentlink-mcp-stdio
+      // 的 --discovery 流程一致)或 x-agentlink-auth: <token>(兼容老路径)。
+      const authz = req.headers["authorization"];
+      const bearerOk =
+        typeof authz === "string" &&
+        authz.toLowerCase().startsWith("bearer ") &&
+        authz.slice(7).trim() === authToken;
+      const legacyOk = req.headers["x-agentlink-auth"] === authToken;
+      if (!bearerOk && !legacyOk) {
+        sLog.warn("mcp_bridge.auth.invalid", "unauthenticated request", {
+          remote: req.socket?.remoteAddress,
+        });
+        res.statusCode = 401; res.end();
+        return;
+      }
+      const body = await readBody(req, 1 << 20);
+      let input = {};
+      if (body) {
+        try { input = JSON.parse(body.toString("utf8")); }
+        catch { res.statusCode = 400; res.end(); return; }
+      }
+      res.setHeader("Content-Type", "application/json");
+      if (req.url === "/tools/list") {
+        res.end(JSON.stringify({ tools: registry.list }));
+        return;
+      }
+      if (req.url === "/tools/call") {
+        const name = String(input.name || "");
+        const args = input.arguments || {};
+        const out = await registry.dispatch(name, args);
+        res.end(JSON.stringify(out || { content: [], isError: true }));
+        return;
+      }
+      res.statusCode = 404; res.end();
+    } catch (err) {
+      sLog.error("error.caught", "agentlink-tools-server handler threw", {
+        where: "agentlinkToolsServer.handler",
+        err: err?.message || String(err),
+      });
+      if (!res.headersSent) {
+        res.statusCode = 500;
+        res.end();
+      }
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+  const port = server.address().port;
+  const baseUrl = `http://127.0.0.1:${port}`;
+  sLog.info("mcp_bridge.server.listen", "tools server ready", { port });
+
+  return {
+    port,
+    baseUrl,
+    authToken,
+    close: () => new Promise((resolve) => {
+      sLog.info("mcp_bridge.server.close", "closing tools server");
+      server.close(() => resolve());
+    }),
+  };
+}
+
+function readBody(req, limit) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > limit) { req.destroy(); reject(new Error("body too large")); return; }
+      chunks.push(c);
+    });
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}

package/src-ext/core/approvalGateway.mjs

@@ -0,0 +1,132 @@
+// 审批闸门：Claude hook / Codex elicitation 都在这里收敛。
+//
+// 工作流：
+//   1. Hook/Elicit 触发 → openRequest({tool, input}) 返回 { requestId, promise }
+//   2. 调用方把 requestId + 工具信息通过 relay 发到 App（kind=tool_approval_request）
+//   3. 调用方 await promise —— 阻塞直到 settle()
+//   4. App 通过 SSE 回传 kind=tool_approval_response → CLI 的 SSE handler 调
+//      approvalGateway.settle(requestId, decision)
+//   5. promise resolve，Hook/Elicit 返回"允许/拒绝"到 agent
+//
+// 关键：
+//   - 每 60s 打 `approval.pending wait_s=N` 日志；手机一直不响应也不超时，
+//     但日志能看到等了多久。
+//   - dispose() 时强制 reject 所有 pending（CLI 关闭 → 告诉 Hook "被取消"）。
+
+import { randomBytes } from "node:crypto";
+
+const PENDING_LOG_INTERVAL_MS = 60_000;
+// audit 修复：settle 丢失（网络抖动 / App 离线）的请求此前永久挂在 pending。
+// 默认 10 分钟硬超时后按 reject 收尾（codex elicitation 自身也有秒级超时，
+// 10min 已远超任何正常交互窗口）。可经 opts.timeoutMs 覆盖。
+const DEFAULT_APPROVAL_TIMEOUT_MS = 10 * 60_000;
+
+export function createApprovalGateway({ log, timeoutMs = DEFAULT_APPROVAL_TIMEOUT_MS }) {
+  if (!log) throw new Error("createApprovalGateway: log required");
+  const agLog = log.child({ comp: "approval" });
+  const pending = new Map(); // requestId → { resolve, reject, openedAt, meta, tickerHandle }
+
+  function newRequestId() {
+    return "req_" + randomBytes(4).toString("hex");
+  }
+
+  function openRequest(meta = {}) {
+    const requestId = newRequestId();
+    let resolveFn, rejectFn;
+    const promise = new Promise((resolve, reject) => {
+      resolveFn = resolve;
+      rejectFn = reject;
+    });
+    const openedAt = Date.now();
+    const tickerHandle = setInterval(() => {
+      if (!pending.has(requestId)) return;
+      const waitMs = Date.now() - openedAt;
+      agLog.info("approval.pending", "still waiting for user", {
+        request_id: requestId,
+        tool: meta.tool_name || "",
+        wait_s: Math.round(waitMs / 1000),
+      });
+    }, PENDING_LOG_INTERVAL_MS);
+    tickerHandle.unref?.();
+
+    // 硬超时：超窗自动按 reject 收尾（与用户点「拒绝」同构，调用方无需特判）
+    let timeoutHandle = null;
+    if (timeoutMs > 0) {
+      timeoutHandle = setTimeout(() => {
+        if (!pending.has(requestId)) return;
+        agLog.warn("approval.timeout", "approval request timed out, auto-reject", {
+          request_id: requestId, tool: meta.tool_name || "", timeout_ms: timeoutMs,
+        });
+        settle(requestId, "reject", "approval-timeout");
+      }, timeoutMs);
+      timeoutHandle.unref?.();
+    }
+
+    pending.set(requestId, {
+      resolve: resolveFn,
+      reject: rejectFn,
+      openedAt,
+      meta,
+      tickerHandle,
+      timeoutHandle,
+    });
+
+    agLog.info("approval.request.sent", "approval request opened", {
+      request_id: requestId,
+      tool: meta.tool_name || "",
+      has_input: !!meta.tool_input,
+    });
+
+    return { requestId, promise };
+  }
+
+  function settle(requestId, decision, reason) {
+    const entry = pending.get(requestId);
+    if (!entry) {
+      agLog.warn("approval.settle.missing", "no pending request for id", {
+        request_id: requestId,
+        decision,
+      });
+      return false;
+    }
+    pending.delete(requestId);
+    clearInterval(entry.tickerHandle);
+    if (entry.timeoutHandle) clearTimeout(entry.timeoutHandle);
+    const waitMs = Date.now() - entry.openedAt;
+    agLog.info("approval.response.recv", "approval resolved", {
+      request_id: requestId,
+      tool: entry.meta.tool_name || "",
+      decision,
+      wait_ms: waitMs,
+    });
+    entry.resolve({ decision, reason: reason || "", wait_ms: waitMs });
+    return true;
+  }
+
+  // dispose：把所有 pending 以 "cancelled" reject 掉（例如 CLI 关闭）。
+  function dispose(reason = "gateway-disposed") {
+    const ids = [...pending.keys()];
+    for (const id of ids) {
+      const entry = pending.get(id);
+      if (!entry) continue;
+      pending.delete(id);
+      clearInterval(entry.tickerHandle);
+      if (entry.timeoutHandle) clearTimeout(entry.timeoutHandle);
+      agLog.warn("approval.dispose", "cancelling pending request", {
+        request_id: id, reason,
+      });
+      // Hook 那边收到 reject → 会走 deny 语义 (看 hookServer 怎么编码)
+      entry.reject(new Error(`approval cancelled: ${reason}`));
+    }
+  }
+
+  function pendingCount() {
+    return pending.size;
+  }
+
+  function hasPending(requestId) {
+    return pending.has(requestId);
+  }
+
+  return { openRequest, settle, dispose, pendingCount, hasPending };
+}

package/src-ext/core/attachAuditLog.mjs

@@ -0,0 +1,79 @@
+// attachAuditLog.mjs — agentlink_attach_file 工具的本地审计日志
+//
+// 每次 attach 调用(成功 / 拒绝 / 失败)都追加一行 NDJSON 到
+// `~/.agentlink/attach-log.ndjson`，让用户事后能追责（哪个 agent 在什么时候
+// attach 了哪个文件 / 为什么被拒）。
+//
+// 设计原则：
+//   - best-effort：FS 错误 swallow + console.error，绝不让 audit 写失败把
+//     工具 dispatch 拖崩
+//   - 同步串行：用 promise chain 保证多 attach 并发时也按顺序写盘
+//   - 不轮转：第一版不实现 size cap / rotation；用户 ndjson 文件不大，
+//     后续 change 再加（与其它 ~/.agentlink/ 下日志策略统一）
+//
+// spec ref: openspec/changes/host-file-cos-attachment/specs/host-file-attach-cos/spec.md
+//           Requirement: audit log
+
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+const HOME = os.homedir();
+const AGENTLINK_DIR = path.join(HOME, ".agentlink");
+const AUDIT_PATH = path.join(AGENTLINK_DIR, "attach-log.ndjson");
+
+// 串行化 write，避免并发 attach 时两次 appendFile 交错出乱行
+let writeChain = Promise.resolve();
+
+/**
+ * 追加一条审计记录。non-throwing：FS 错误时 console.error 但不 reject。
+ *
+ * entry 字段建议（spec 列了，工具 dispatcher 负责填）：
+ *   ts, agentId, path, sha256?, size?, mime?, result, denylist_pattern?, error?
+ *
+ * 调用方不需要 await，但如果想等写完（测试场景）可以 await 返回的 Promise。
+ *
+ * @param {Record<string, any>} entry
+ * @returns {Promise<void>}
+ */
+export function appendAuditEntry(entry) {
+  writeChain = writeChain.then(async () => {
+    try {
+      // ensure ~/.agentlink 存在（mode 0o700 = 仅 owner 读写执行）
+      await fs.mkdir(AGENTLINK_DIR, { recursive: true, mode: 0o700 });
+      // ts 字段未填的话兜底现在时刻
+      const record = {
+        ts: new Date().toISOString(),
+        ...entry,
+      };
+      const line = JSON.stringify(record) + "\n";
+      await fs.appendFile(AUDIT_PATH, line, { mode: 0o600 });
+    } catch (err) {
+      // 用 console.error 而不是 throw —— audit 不能让工具 dispatch 失败
+      console.error(`[attachAuditLog] append failed: ${err?.message || err}`);
+    }
+  });
+  return writeChain;
+}
+
+/**
+ * 暴露 audit 文件路径（测试 / 文档用）。
+ */
+export function getAuditLogPath() {
+  return AUDIT_PATH;
+}
+
+/**
+ * CLI 状态目录名常量（唯一来源）。
+ * 改名 agentlink 时只改这一处。
+ */
+export const CLI_STATE_DIR_NAME = ".agentlink";
+
+/**
+ * 暴露 ~/.agentlink/ 目录路径（其它模块如 toolsServerLifecycle 也用得到）。
+ * 注意：路径在模块加载时基于当时的 os.homedir() 固化。
+ * 若需动态跟随 HOME 变化（如测试），请自行用 CLI_STATE_DIR_NAME + os.homedir()。
+ */
+export function getAgentlinkDir() {
+  return AGENTLINK_DIR;
+}