@yep-ai/cli 1.0.0 → 1.0.2

package/README.md

@@ -5,15 +5,14 @@
 ## 安装与使用
 
 ```sh
-npm install -g @yep-ai/cli
-yep --help
+npx --yes @yep-ai/cli@latest --help
 ```
 
-也可以无需全局安装直接运行：
+通过 npx 直接运行 npm 最新版，无需全局安装：
 
 ```sh
-npx --yes @yep-ai/cli --help
-npx --yes @yep-ai/cli device start --server https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest --help
+npx --yes @yep-ai/cli@latest device start
 ```
 
 本包包含完整实现。`yep-cli` 是计划中的同版本入口包，当前尚未发布本项目版本，请使用 `@yep-ai/cli`。
@@ -25,32 +24,33 @@ npx --yes @yep-ai/cli device start --server https://yep.nihao.cool
 ```sh
 npm install
 npm run yep -- --help
+npm run build:yep-node
 npm run pack:cli
-npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.0.0.tgz ./dist/cli/unscoped/yep-cli-1.0.0.tgz
+npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.0.2.tgz ./dist/cli/unscoped/yep-cli-1.0.2.tgz
 ./tmp/yep-install/node_modules/.bin/yep --version
 ```
 
-完整实现包为 `scoped/yep-ai-cli-1.0.0.tgz`，入口包为 `unscoped/yep-cli-1.0.0.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
+完整实现包为 `scoped/yep-ai-cli-1.0.2.tgz`，入口包为 `unscoped/yep-cli-1.0.2.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
 
 ## 市场与 Git 内容版本
 
 ```sh
-yep login --registry https://yep.nihao.cool
-yep whoami
-yep search assistant
-yep info @creator/demo
-yep client set codex,claude
-yep install @creator/demo --client codex
-yep list
-yep list --remote
-yep list --mine
-yep uninstall @creator/demo --client codex
-yep publish ./my-skill
-yep history @creator/demo
-yep diff @creator/demo --base published
-yep publish ./my-agent --kind agent
-yep submit @creator/demo --kind agent
-yep withdraw @creator/demo --kind agent
+npx --yes @yep-ai/cli@latest login --registry https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest whoami
+npx --yes @yep-ai/cli@latest search assistant
+npx --yes @yep-ai/cli@latest info @creator/demo
+npx --yes @yep-ai/cli@latest client set codex,claude
+npx --yes @yep-ai/cli@latest install @creator/demo --client codex
+npx --yes @yep-ai/cli@latest list
+npx --yes @yep-ai/cli@latest list --remote
+npx --yes @yep-ai/cli@latest list --mine
+npx --yes @yep-ai/cli@latest uninstall @creator/demo --client codex
+npx --yes @yep-ai/cli@latest publish ./my-skill
+npx --yes @yep-ai/cli@latest history @creator/demo
+npx --yes @yep-ai/cli@latest diff @creator/demo --base published
+npx --yes @yep-ai/cli@latest publish ./my-agent --kind agent
+npx --yes @yep-ai/cli@latest submit @creator/demo --kind agent
+npx --yes @yep-ai/cli@latest withdraw @creator/demo --kind agent
 ```
 
 默认资源类型为 `skill`，也支持 `--kind agent|plugin`。Skill 私有保存后从网页申请共享审核；Agent/Plugin 的发布会提交审核。审核通过才进入公开市场。`history` 和 `diff` 访问服务端保留的真实 Git 版本。
@@ -60,15 +60,22 @@ yep withdraw @creator/demo --kind agent
 ## 设备节点
 
 ```sh
-yep device login --server https://yep.nihao.cool
-yep device start "/path/to/documents" --server https://yep.nihao.cool
-yep device status
-yep device logout
+npx --yes @yep-ai/cli@latest device login
+npx --yes @yep-ai/cli@latest device start "/path/to/documents"
+npx --yes @yep-ai/cli@latest device status
+npx --yes @yep-ai/cli@latest device logout
 ```
 
 设备通过 HTTPS 配对和 WSS 出站连接；网页批准设备后，还需在某场咨询中选择目录和权限。目录不会整体上传。最多指定 5 个目录；指定目录时仅提供受限内置命令。不指定目录时，命令拥有当前系统用户的 shell 权限，可访问其他文件和网络。进程退出后节点离线，不安装后台服务。设备授权最长 24 小时，可以从网页或 CLI 撤销。
 
-`--server` 只接受 HTTPS 源站（回环开发地址允许 HTTP），显式指定后记住该源站；令牌按源站隔离。市场登录不等于设备授权。
+节点上线后，可在「设备节点」点击「打开终端」。不指定启动目录时，npm 包内的 Go `yep-node` 为每个标签启动独立的真实 Shell：Windows 使用 ConPTY + cmd，macOS / Linux 使用 PTY + 当前用户的 Shell。输入直接进入终端，工作目录、变量和交互程序状态保留；支持 Ctrl+C、窗口尺寸变化和最多 4 个独立网页会话。AI 操作与网页终端分别执行，不共用工作目录或进程。关闭标签、撤销授权、节点退出或网络连接断开会终止对应 Shell；重连创建新会话，不重放命令。
+
+原生程序随 npm 包一起分发，无需用户安装 Go。当前构建目标为 Windows x64 / ARM64、macOS Intel / Apple Silicon、Linux x64 / ARM64；Windows 需要支持 ConPTY 的 Windows 10 1809 / Server 2019 或更新版本。鸿蒙 / OpenHarmony 原生 ABI 尚未适配，不能将 Linux ARM64 包视为鸿蒙包。缺少原生程序时会明确提示并提供兼容的逐条命令模式；受限目录始终使用内置命令模式，不启动系统 Shell。
+
+设备配对和网络通道使用 HTTPS / WSS；服务端保存令牌摘要，客户端每小时轮换设备令牌并保留短暂交接窗口，轮换不会延长原有 24 小时授权。客户端先持久化待交接凭据，断线后继续完成交接。TLS 在站点入口终止，集群内部连接不属于端到端加密。
+指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes @yep-ai/cli@latest`，保留原目录参数。
+
+设备默认连接 `https://yep.nihao.cool`，使用本站时无需指定服务器。连接自建站点时可使用 `--server https://your-site.example`；只接受 HTTPS 源站（回环开发地址允许 HTTP），显式指定后记住该源站，令牌按源站隔离。市场登录不等于设备授权。
 
 ## 配置
 
@@ -86,4 +93,4 @@ yep device logout
 
 市场凭据保存为 `~/.config/yep/config.json`；设备身份和各源站的授权保存在 `~/.config/yep/devices/`。目录权限 `0700`、凭据文件 `0600`；Windows 使用当前用户专属 ACL。市场和设备令牌分别管理。域名改变后需要在新源站重新登录、配对，不会把旧源站令牌发送到新地址。
 
-执行 `yep --help` 或 `yep device --help` 查看全部选项。
+执行 `npx --yes @yep-ai/cli@latest --help` 或 `npx --yes @yep-ai/cli@latest device --help` 查看全部选项。

package/lib/device/client.js

@@ -4,7 +4,9 @@ import os from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import WebSocket from "ws";
-import { rootDescriptor, resolveSafe, list, execute } from "./tools.js";
+import { rootDescriptor, resolveSafe, list, execute, terminalDirectory } from "./tools.js";
+import { findNativeBinary, NativeTerminal } from "./native-terminal.js";
+import { rotateDeviceCredential } from "./credential-rotation.js";
 const PROTOCOL = 2;
 const DEFAULT_SERVER = "https://yep.nihao.cool";
 function serverOrigin(value) {
@@ -84,9 +86,22 @@ async function loadCredential(directory, server) {
 async function saveCredential(directory, server, value) {
   const location = credentialPath(directory, server);
   const temporary = location + "." + randomUUID();
-  await fs.writeFile(temporary, JSON.stringify({ ...value, server }), { mode: 384, flag: "wx" });
-  await protect(temporary);
-  await fs.rename(temporary, location);
+  try {
+    const file = await fs.open(temporary, "wx", 0o600);
+    try {
+      await file.writeFile(JSON.stringify({ ...value, server }));
+      await protect(temporary);
+      // Rotation must not reach the server before its recovery secret reaches disk.
+      await file.sync();
+    } finally { await file.close(); }
+    await fs.rename(temporary, location);
+    if (process.platform !== "win32") {
+      const parent = await fs.open(directory, "r");
+      try { await parent.sync(); } finally { await parent.close(); }
+    }
+  } finally {
+    await fs.unlink(temporary).catch(error => { if (error.code !== "ENOENT") throw error; });
+  }
 }
 async function loadDefaultServer(directory) {
   const location = path.join(directory, "default-server.json");
@@ -112,7 +127,9 @@ async function api(server, route, { token, body, method = "GET" } = {}) {
   try {
     result = await response.json();
   } catch {
-    throw new Error("Server returned an invalid response");
+    const error = new Error(response.ok ? "Server returned an invalid response" : `HTTP ${response.status}`);
+    if (!response.ok) error.status = response.status;
+    throw error;
   }
   ;
   if (!response.ok) {
@@ -156,6 +173,7 @@ ${verify.href}`);
     ;
     if (response.status === "denied") throw new Error("Device authorization was denied");
     if (response.status === "authorized") {
+      response.issuedAt = new Date().toISOString();
       await saveCredential(config.directory, server, response);
       console.log("设备授权已保存（最多24小时）。");
       return response;
@@ -185,16 +203,18 @@ async function systemRoots(privateDir) {
   }));
 }
 class DeviceAgent {
-  constructor(roots, { restricted = true, privateDir, token, connectionId, expiresAt } = {}) {
+  constructor(roots, { restricted = true, privateDir, token, connectionId, expiresAt, onTerminalOutput } = {}) {
     this.roots = roots;
     this.restricted = restricted;
     this.privateDir = privateDir;
     this.token = token;
     this.connectionId = connectionId;
     this.expiresAt = expiresAt;
+    this.onTerminalOutput = onTerminalOutput;
     this.closed = false;
     this.bindings = /* @__PURE__ */ new Map();
     this.active = /* @__PURE__ */ new Map();
+    this.terminalSessions = new Map();
   }
   publicRoots() {
     return this.roots.map(({ id, name }) => ({ id, name }));
@@ -202,7 +222,7 @@ class DeviceAgent {
   cancel(frame = {}) {
     const waiting = [];
     for (const [id, op] of this.active) {
-      if (!frame.id && !frame.roundId && !frame.bindingId || frame.id === id || frame.roundId === op.roundId || frame.bindingId === op.bindingId) {
+      if (frame.sessionId ? frame.sessionId === op.sessionId && (!frame.id || frame.id === id) : !frame.id && !frame.roundId && !frame.bindingId || frame.id && frame.id === id || frame.roundId && frame.roundId === op.roundId || frame.bindingId && frame.bindingId === op.bindingId) {
         op.abort.abort();
         waiting.push(op.done);
       }
@@ -213,6 +233,62 @@ class DeviceAgent {
     this.closed = true;
     this.cancel();
     this.bindings.clear();
+    for (const session of this.terminalSessions.values()) session.closed = true;
+    this.terminalSessions.clear();
+  }
+  async terminalFrame(frame) {
+    const base = { id: frame.id, sessionId: frame.sessionId };
+    if (typeof frame.sessionId !== "string" || !frame.sessionId || frame.sessionId.length > 200) throw new Error("Invalid terminal session");
+    if (["terminal_cancel", "terminal_close"].includes(frame.type)) {
+      if (frame.type === "terminal_close") {
+        const session = this.terminalSessions.get(frame.sessionId);
+        if (session) session.closed = true;
+        this.terminalSessions.delete(frame.sessionId);
+      }
+      await this.cancel({ sessionId: frame.sessionId, ...(frame.type === "terminal_cancel" && frame.id ? { id: frame.id } : {}) });
+      return null;
+    }
+    if (typeof frame.id !== "string" || !frame.id || frame.id.length > 200 || this.active.has(frame.id) || this.active.size >= 8) throw new Error("Too many or duplicate local operations");
+    if (typeof frame.command !== "string" || !frame.command.trim() || frame.command.length > 4096 || frame.command.includes("\0")) throw new Error("Invalid command");
+    const root = this.roots.find(item => item.id === frame.folderId);
+    if (!root) throw new Error("Unknown terminal root");
+    let session = this.terminalSessions.get(frame.sessionId);
+    if (!session) {
+      if (this.terminalSessions.size >= 8) throw new Error("Too many terminal sessions");
+      this.terminalSessions.set(frame.sessionId, session = { closed: false });
+    }
+    if ([...this.active.values()].some(op => op.sessionId === frame.sessionId)) throw new Error("Terminal command is still running");
+    const abort = new AbortController();
+    let complete;
+    const done = new Promise(resolve => { complete = resolve; });
+    this.active.set(frame.id, { abort, sessionId: frame.sessionId, done });
+    const valid = () => !this.closed && !session.closed && !abort.signal.aborted;
+    try {
+      const cwd = frame.path ?? "";
+      const changed = await terminalDirectory(root, cwd, frame.command, this.restricted);
+      if (!valid()) throw new Error("Operation canceled");
+      const output = changed !== null ? { stdout: "", stderr: "", exitCode: 0 } : await execute(root, { operation: "exec", path: cwd, command: frame.command }, {
+        restricted: this.restricted, signal: abort.signal, secrets: [this.token],
+        onOutput: (stream, data) => {
+          if (!valid()) return;
+          for (let offset = 0; offset < data.length;) {
+            let end = Math.min(data.length, offset + 4096);
+            const last = data.charCodeAt(end - 1);
+            if (end < data.length && last >= 0xd800 && last <= 0xdbff) end--;
+            this.onTerminalOutput?.({ ...base, type: "terminal_output", stream, data: data.slice(offset, end) });
+            offset = end;
+          }
+        },
+      });
+      if (!valid()) throw new Error("Operation canceled");
+      return { ...base, type: "terminal_result", folderId: root.id, path: changed ?? cwd, output };
+    } catch (error) {
+      if (abort.signal.aborted) return { ...base, type: "terminal_result", folderId: root.id, path: frame.path ?? "", output: error.output ?? { stdout: "", stderr: "", exitCode: null, canceled: true } };
+      throw error;
+    } finally {
+      this.active.delete(frame.id);
+      complete();
+    }
   }
   async frame(frame) {
     if (this.closed) throw new Error("Stale device connection");
@@ -220,6 +296,7 @@ class DeviceAgent {
       this.close();
       throw new Error("Device authorization expired");
     }
+    if (["terminal_exec", "terminal_cancel", "terminal_close"].includes(frame.type)) return this.terminalFrame(frame);
     const base = { id: frame.id, consultationId: frame.consultationId, bindingId: frame.bindingId, roundId: frame.roundId };
     if (frame.type === "cancel") {
       await this.cancel(frame);
@@ -294,63 +371,158 @@ async function start(server, config, credential, directories, { name, noOpen, si
   if (directories.length > 5) throw new Error("At most five startup directories");
   const roots = restricted ? await Promise.all(directories.map((p, i) => rootDescriptor("root-" + (i + 1), p, config.directory))) : await systemRoots(config.directory);
   if (!roots.length) throw new Error("No accessible filesystem roots");
+  const nativeBinary = restricted ? null : await findNativeBinary();
+  if (!restricted && !nativeBinary) console.warn("未找到当前平台的原生终端组件，使用兼容命令模式。");
   console.log(restricted ? "受限目录模式：仅内置命令，不能启动 shell 或外部程序。" : "完整系统模式：网页授权执行的命令拥有当前系统用户权限，可访问其他文件和网络；这不是沙箱。");
   let delay = 1e3;
+  const rotationInterval = 60 * 60 * 1000;
+  // Older credentials lack issuedAt. Their fixed 24-hour lifetime still gives
+  // an issuance bound, so reconnecting/restarting cannot postpone rotation.
+  const rotationDeadline = value => {
+    const base = Date.parse(value.rotatedAt || value.issuedAt);
+    const issued = Date.parse(value.expiresAt) - 24 * rotationInterval;
+    return (Number.isFinite(base) ? Math.min(base, Date.now()) : Math.min(issued, Date.now())) + rotationInterval;
+  };
+  let nextRotation = rotationDeadline(credential);
+  const retryDelay = () => new Promise(resolve => {
+    const finish = () => { clearTimeout(timer); signal?.removeEventListener("abort", finish); resolve(); };
+    const timer = setTimeout(finish, delay);
+    signal?.addEventListener("abort", finish, { once: true });
+    if (signal?.aborted) finish();
+  });
+  const recoverCredential = async () => {
+    const saved = credential.deviceId ? await loadCredential(config.directory, server) : null;
+    if (!saved) return;
+    if (saved.deviceId !== credential.deviceId) {
+      const error = new Error("Device credential changed");
+      error.code = "YEP_CREDENTIAL_CHANGED";
+      throw error;
+    }
+    credential = saved.pendingToken ? await rotateDeviceCredential(server, saved, { api, save: value => saveCredential(config.directory, server, value) }) : saved;
+    nextRotation = Math.min(nextRotation, rotationDeadline(credential));
+    if (!credential.pendingToken && saved.pendingToken) nextRotation = rotationDeadline(credential);
+  };
   while (!signal?.aborted) {
+    try {
+      // A previous rotate response or final save may have been lost. Recover
+      // from disk before presenting a bearer on a new WebSocket connection.
+      await recoverCredential();
+    } catch (error) {
+      if (error.code === "YEP_CREDENTIAL_CHANGED") throw error;
+      if ([401, 403].includes(error.status)) throw new Error("Device authorization expired or revoked");
+      console.log(`设备凭据同步暂时失败；${Math.ceil(delay / 1e3)}秒后重试。`);
+      await retryDelay();
+      delay = Math.min(delay * 2, 3e4);
+      continue;
+    }
     if (Date.now() >= Date.parse(credential.expiresAt)) throw new Error("Device authorization expired; run login again");
     let fatal;
+    let recoverableAuthorization = false;
     await new Promise((resolve, reject) => {
       const url = new URL("/api/local-cli/connect", server);
       url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
       const ws = new WebSocket(url, { headers: { Authorization: `Bearer ${credential.token}` }, maxPayload: 15 * 1024 * 1024, handshakeTimeout: 15e3, followRedirects: false });
-      const agent = new DeviceAgent(roots, { restricted, privateDir: config.directory, token: credential.token, expiresAt: credential.expiresAt });
+      const agent = new DeviceAgent(roots, { restricted, privateDir: config.directory, token: credential.token, expiresAt: credential.expiresAt,
+        onTerminalOutput: frame => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(frame)); },
+      });
+      const native = nativeBinary ? new NativeTerminal(nativeBinary, frame => {
+        if (ws.readyState !== WebSocket.OPEN) return;
+        if (ws.bufferedAmount > 2 * 1024 * 1024) { ws.terminate(); return; }
+        ws.send(JSON.stringify(frame));
+      }) : null;
       let ready = false;
       let heartbeat;
+      let receiveWatchdog;
+      let credentialRotation = false;
+      let rotationTask = null;
+      let awaitingCredential = false;
+      const received = () => {
+        if (ws.readyState !== WebSocket.OPEN || fatal || signal?.aborted) return;
+        clearTimeout(receiveWatchdog);
+        receiveWatchdog = setTimeout(() => {
+          ready = false;
+          native?.close();
+          agent.close();
+          ws.terminate();
+        }, 45000);
+      };
+      const updateCredential = () => {
+        if (awaitingCredential && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "credential_update", token: credential.token }));
+      };
+      const rotate = () => {
+        if (!credentialRotation || rotationTask || awaitingCredential || !ready || signal?.aborted) return;
+        rotationTask = (async () => {
+          const saved = await loadCredential(config.directory, server);
+          if (!saved || saved.deviceId !== credential.deviceId) throw new Error("Device credential changed");
+          const next = await rotateDeviceCredential(server, saved, { api, save: value => saveCredential(config.directory, server, value) });
+          credential = next;
+          agent.token = next.token;
+          nextRotation = Date.now() + rotationInterval;
+          if (ws.readyState === WebSocket.OPEN && ready) { awaitingCredential = true; updateCredential(); }
+        })().catch(() => { nextRotation = Date.now() + 60 * 1000; }).finally(() => { rotationTask = null; });
+      };
       const cleanup = () => {
         clearInterval(heartbeat);
+        clearTimeout(receiveWatchdog);
+        native?.close();
         agent.close();
         signal?.removeEventListener("abort", abort);
       };
       const abort = () => {
         ready = false;
+        native?.close();
         agent.close();
         ws.close();
       };
       signal?.addEventListener("abort", abort, { once: true });
       ws.on("open", () => {
-        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true }));
+        received();
+        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true, capabilities: ["terminal", ...(native ? ["pty"] : [])] }));
       });
+      ws.on("ping", received);
+      ws.on("pong", received);
       ws.on("unexpected-response", (_req, res) => {
         if ([401, 403].includes(res.statusCode)) {
           fatal = new Error("Device authorization expired or revoked");
-          ws.terminate();
+          recoverableAuthorization = true;
         }
+        // With this listener installed ws leaves response ownership to us.
+        // Explicitly end every rejected handshake, including transient 503s.
+        res.destroy();
+        ws.terminate();
       });
       ws.on("message", async (bytes) => {
         if (fatal || signal?.aborted) return;
+        received();
         let frame;
         try {
           frame = JSON.parse(bytes.toString());
           if (frame.type === "ready") {
             if (frame.protocol !== PROTOCOL) throw new Error("Unsupported server protocol");
             agent.connectionId = frame.connectionId;
+            credentialRotation = frame.credentialRotation === true;
             ready = true;
             delay = 1e3;
-            console.log("设备已上线。请在网页选择目录；退出此终端将断开。");
+            console.log("设备已上线。可在网页设备节点中打开终端，或在咨询中选择目录；退出此进程将断开。");
             heartbeat = setInterval(() => {
               if (Date.now() >= Date.parse(credential.expiresAt)) {
                 fatal = new Error("Device authorization expired");
+                native?.close();
                 agent.close();
                 ws.close();
                 return;
               }
               if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "ping" }));
+              updateCredential();
+              if (Date.now() >= nextRotation) rotate();
             }, 1e4);
             return;
           }
           if (["revoked", "expired", "replaced"].includes(frame.type)) {
             fatal = new Error(`Device ${frame.type}; local operations stopped`);
+            recoverableAuthorization = frame.type === "revoked";
             ready = false;
+            native?.close();
             agent.close();
             ws.close();
             return;
@@ -359,7 +531,18 @@ async function start(server, config, credential, directories, { name, noOpen, si
             ws.send(JSON.stringify({ type: "pong" }));
             return;
           }
+          if (frame.type === "credential_updated") { awaitingCredential = false; return; }
+          if (frame.type === "credential_update_error") { awaitingCredential = true; return; }
           if (!ready) return;
+          if (["pty_open", "pty_input", "pty_resize", "pty_close"].includes(frame.type)) {
+            try {
+              if (!native) throw new Error("Interactive terminal unavailable");
+              native.write(frame);
+            } catch (error) {
+              if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "pty_error", sessionId: frame.sessionId, error: String(error.message).slice(0, 1024) }));
+            }
+            return;
+          }
           const result = await agent.frame(frame);
           if (result && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(result));
         } catch (e) {
@@ -367,30 +550,33 @@ async function start(server, config, credential, directories, { name, noOpen, si
           if (frame?.id && ws.readyState === WebSocket.OPEN) {
             let error = String(e.message).split(credential.token).join("[REDACTED]").split(config.directory).join("[私有目录]");
             for (const root of [...agent.roots].sort((a, b) => b.absolute.length - a.absolute.length)) error = error.split(root.absolute).join("[授权目录]");
-            ws.send(JSON.stringify({ type: "result", id: frame.id, bindingId: frame.bindingId, consultationId: frame.consultationId, error: error.slice(0, 8192) }));
+            ws.send(JSON.stringify({ type: frame.type?.startsWith("terminal_") ? "terminal_error" : "result", id: frame.id, sessionId: frame.sessionId, bindingId: frame.bindingId, consultationId: frame.consultationId, error: error.slice(0, 8192) }));
           } else {
             fatal = e;
+            native?.close();
+            agent.close();
             ws.close();
           }
         }
       });
       ws.on("error", () => {
       });
-      ws.on("close", () => {
+      ws.on("close", async () => {
         cleanup();
+        if (rotationTask) await rotationTask;
         resolve();
       });
     });
-    if (fatal) throw fatal;
+    if (fatal) {
+      if (!recoverableAuthorization) throw fatal;
+      const saved = credential.deviceId ? await loadCredential(config.directory, server) : null;
+      if (!saved?.pendingToken) throw fatal;
+      // Local operations have already stopped. A pending secret can distinguish
+      // an expired overlap from an actual revocation on the next recovery pass.
+    }
     if (signal?.aborted) break;
     console.log(`连接已断开；${Math.ceil(delay / 1e3)}秒后重连。原咨询绑定已失效，重连后需重新选择。`);
-    await new Promise((resolve) => {
-      const t = setTimeout(resolve, delay);
-      signal?.addEventListener("abort", () => {
-        clearTimeout(t);
-        resolve();
-      }, { once: true });
-    });
+    await retryDelay();
     delay = Math.min(delay * 2, 3e4);
   }
 }

package/lib/device/command.js

@@ -2,7 +2,8 @@
 import fs from "node:fs/promises";
 import { readFileSync } from "node:fs";
 const { version } = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
-import { serverOrigin, initializeConfig, loadCredential, loadDefaultServer, rememberServer, credentialPath, login, start, api } from "./client.js";
+import { serverOrigin, initializeConfig, loadCredential, loadDefaultServer, rememberServer, credentialPath, login, start, api, saveCredential } from "./client.js";
+import { rotateDeviceCredential } from "./credential-rotation.js";
 const HELP = `Yep 本地设备节点 ${version} (协议2，Node.js 22+)
 
 yep device start [目录1 ... 目录5] [--server https://your-site.example]
@@ -45,6 +46,14 @@ export async function runDevice(args = process.argv.slice(2)) {
   if (server) await rememberServer(config.directory, server);
   else server = await loadDefaultServer(config.directory);
   let credential = await loadCredential(config.directory, server);
+  if (credential?.pendingToken) {
+    try {
+      credential = await rotateDeviceCredential(server, credential, { api, save: value => saveCredential(config.directory, server, value) });
+    } catch (error) {
+      if (command === "start" && (error.status === 401 || error.status === 403)) credential = null;
+      else throw error;
+    }
+  }
   const controller = new AbortController();
   const stop = () => controller.abort();
   process.once("SIGINT", stop);

package/lib/device/credential-rotation.js

@@ -0,0 +1,37 @@
+import { createHash, randomBytes } from "node:crypto";
+
+// Persist the next bearer first: either secret can then recover an interrupted rotation.
+export async function rotateDeviceCredential(server, credential, { api, save, createToken = () => randomBytes(32).toString("hex") }) {
+  let pending = credential.pendingToken;
+  if (!pending) {
+    pending = createToken();
+    if (!/^[0-9a-f]{64}$/.test(pending) || pending === credential.token) throw new Error("Invalid generated device credential");
+    credential = { ...credential, pendingToken: pending };
+    await save(credential);
+  }
+  const tokenHash = createHash("sha256").update(pending).digest("hex");
+  try {
+    await api(server, "/api/local-cli/rotate", { method: "POST", token: credential.token, body: { tokenHash } });
+  } catch (error) {
+    // The response may have been lost or the old overlap may have elapsed.
+    if (![401, 403, 404, 409].includes(error.status)) throw error;
+    let me;
+    try {
+      me = await api(server, "/api/local-cli/me", { token: pending });
+    } catch (pendingError) {
+      if (error.status !== 404 || ![401, 403].includes(pendingError.status)) throw pendingError;
+      // An older server may not implement rotation. Only discard an unaccepted
+      // pending secret after proving that the original credential still works.
+      const current = await api(server, "/api/local-cli/me", { token: credential.token });
+      if (current.deviceId !== credential.deviceId) throw new Error("Current credential belongs to another device");
+      const { pendingToken: _pending, ...unchanged } = credential;
+      await save(unchanged);
+      return unchanged;
+    }
+    if (me.deviceId !== credential.deviceId) throw new Error("Rotated credential belongs to another device");
+  }
+  const { pendingToken: _pending, ...rest } = credential;
+  const rotated = { ...rest, token: pending, rotatedAt: new Date().toISOString() };
+  await save(rotated);
+  return rotated;
+}

package/lib/device/native-terminal.js

@@ -0,0 +1,108 @@
+import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import { constants } from "node:fs";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const platforms = new Set(["win32-x64", "win32-arm64", "darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64"]);
+const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
+
+export function nativeBinaryPath(platform = process.platform, arch = process.arch) {
+  const target = `${platform}-${arch}`;
+  if (!platforms.has(target)) return null;
+  return path.join(packageRoot, "native", target, platform === "win32" ? "yep-node.exe" : "yep-node");
+}
+
+export async function findNativeBinary(platform = process.platform, arch = process.arch) {
+  const binary = nativeBinaryPath(platform, arch);
+  if (!binary) return null;
+  try { await access(binary, platform === "win32" ? constants.F_OK : constants.X_OK); return binary; }
+  catch (error) { if (error.code === "ENOENT" || error.code === "EACCES") return null; throw error; }
+}
+
+export class NativeTerminal {
+  constructor(binary, send) {
+    this.binary = binary;
+    this.send = send;
+    this.sessions = new Set();
+    this.opening = new Set();
+    this.closed = false;
+    this.failed = false;
+    this.startWorker();
+  }
+
+  startWorker() {
+    const child = spawn(this.binary, [], { stdio: ["pipe", "pipe", "ignore"], windowsHide: true });
+    const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
+    const worker = { child, lines };
+    this.worker = worker;
+    this.child = child;
+    this.lines = lines;
+    this.failed = false;
+    lines.on("line", line => {
+      if (this.closed || this.failed || this.worker !== worker) return;
+      if (line.length > 1024 * 1024) { failed(); return; }
+      let frame;
+      try { frame = JSON.parse(line); } catch { failed(); return; }
+      if (!frame || typeof frame.sessionId !== "string" || !this.sessions.has(frame.sessionId) || !["pty_ready", "pty_output", "pty_exit", "pty_error"].includes(frame.type)) return;
+      if (frame.type === "pty_ready") this.opening.delete(frame.sessionId);
+      if (frame.type === "pty_exit" || frame.type === "pty_error" && this.opening.has(frame.sessionId)) {
+        this.sessions.delete(frame.sessionId);
+        this.opening.delete(frame.sessionId);
+      }
+      this.send(frame);
+    });
+    const failed = () => {
+      if (this.closed || this.failed || this.worker !== worker) return;
+      this.failed = true;
+      const sessionIds = [...this.sessions];
+      this.sessions.clear();
+      this.opening.clear();
+      this.stopWorker(worker);
+      for (const sessionId of sessionIds) this.send({ type: "pty_error", sessionId, error: "Local terminal process stopped; open a new terminal to start a new shell" });
+    };
+    child.on("error", failed);
+    child.on("exit", failed);
+    child.stdin.on("error", failed);
+    child.stdout.on("error", failed);
+  }
+
+  stopWorker(worker) {
+    if (worker.stopping) return;
+    worker.stopping = true;
+    worker.lines.close();
+    // Keep draining output while the worker closes its PTYs and reaps shells.
+    worker.child.stdout.resume();
+    worker.child.stdin.end();
+    if (worker.child.exitCode !== null || worker.child.signalCode !== null) return;
+    const timeout = setTimeout(() => worker.child.kill("SIGKILL"), 2000);
+    timeout.unref();
+    worker.child.once("exit", () => clearTimeout(timeout));
+  }
+
+  write(frame) {
+    if (this.closed) throw new Error("Local terminal process is unavailable");
+    if (typeof frame.sessionId !== "string" || !frame.sessionId || frame.sessionId.length > 200) throw new Error("Invalid terminal session");
+    if (!['pty_open', 'pty_input', 'pty_resize', 'pty_close'].includes(frame.type)) throw new Error("Invalid terminal operation");
+    if (this.failed) {
+      if (frame.type !== "pty_open") throw new Error("Local terminal process stopped; open a new terminal to start a new shell");
+      this.startWorker();
+    }
+    if (this.child.stdin.writableLength > 1024 * 1024) throw new Error("Local terminal input is busy");
+    if (frame.type === "pty_open") {
+      if (this.sessions.has(frame.sessionId) || this.sessions.size >= 8) throw new Error("Too many or duplicate terminal sessions");
+      this.sessions.add(frame.sessionId);
+      this.opening.add(frame.sessionId);
+    } else if (!this.sessions.has(frame.sessionId)) throw new Error("Unknown terminal session");
+    this.child.stdin.write(JSON.stringify(frame) + "\n");
+  }
+
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.sessions.clear();
+    this.opening.clear();
+    this.stopWorker(this.worker);
+  }
+}

package/lib/device/tools.js

@@ -2,6 +2,8 @@ import fs from "node:fs/promises";
 import { constants as FS } from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
+import { windowsExecution } from "./windows-execution.js";
 const MAX_FILE = 10 * 1024 * 1024;
 const MAX_OUTPUT = 64 * 1024;
 function safeRelative(value = "") {
@@ -189,19 +191,93 @@ async function builtin(root, cwd, command) {
   if (cmd === "wc" && args.length === 2 && args[0] === "-l") return { text: String((await read(args[1])).split("\n").length - 1) + "\n" };
   throw new Error("Unsupported restricted command");
 }
-async function execute(root, request, { restricted = true, signal, secrets = [] } = {}) {
+function parseTerminalDirectory(command, windows = process.platform === "win32") {
+  if (!/^\s*cd(?:\s|$)/iu.test(command)) return null;
+  if (/[\0\r\n]/u.test(command)) throw new Error("Usage: cd [directory]; run other commands separately");
+  let target = command.trim().slice(2).trim();
+  if (windows && /^\/d(?:\s|$)/iu.test(target)) target = target.slice(2).trim();
+  if (!target) return "";
+  const quote = target[0];
+  if (quote === '"' || quote === "'") {
+    // A directory name is interpreted literally, never as shell source.
+    // Windows backslashes must survive quotation rather than become escapes.
+    if (target.at(-1) !== quote || target.slice(1, -1).includes(quote)) throw new Error("Usage: cd [directory]; run other commands separately");
+    return target.slice(1, -1);
+  }
+  if (/[\s|&;<>$`%!*?()[\]{}"']/u.test(target)) throw new Error("Usage: cd [directory]; run other commands separately");
+  return target;
+}
+async function terminalDirectory(root, cwd, command, restricted) {
+  let target;
+  try {
+    target = parseTerminalDirectory(command);
+  } catch (error) {
+    // Only a standalone literal cd changes the simulated terminal directory.
+    // In system mode, compound commands and shell expressions run normally in
+    // their own shell, whose working directory lasts for that command only.
+    if (!restricted) return null;
+    throw error;
+  }
+  if (target === null) return null;
+  await resolveSafe(root, cwd, "directory");
+  if (!restricted && (target === "~" || target.startsWith("~/"))) {
+    target = path.join(process.env.USERPROFILE || process.env.HOME || root.absolute, target.slice(2));
+  }
+  let relative;
+  if (path.isAbsolute(target)) {
+    if (restricted) throw new Error("Use a relative directory inside the authorized root");
+    relative = path.relative(root.absolute, path.resolve(target)).split(path.sep).join("/");
+  } else {
+    if (process.platform === "win32") target = target.replaceAll("\\", "/");
+    relative = target ? path.posix.normalize([cwd, target].filter(Boolean).join("/")) : "";
+  }
+  if (relative === ".") relative = "";
+  await resolveSafe(root, relative, "directory");
+  return relative;
+}
+// Retain an unfinished secret prefix across chunks so streaming cannot expose a
+// token that happened to cross a stdout/stderr packet boundary.
+function outputRedactor(secrets, emit) {
+  const values = [...new Set(secrets.filter(value => typeof value === "string" && value))].sort((a, b) => b.length - a.length);
+  let pending = "";
+  return (text, final = false, truncated = false) => {
+    pending += text;
+    for (const secret of values) pending = pending.split(secret).join("[REDACTED]");
+    let tail = 0;
+    for (const secret of values) {
+      for (let length = Math.min(secret.length - 1, pending.length); length > tail; length--) {
+        if (pending.endsWith(secret.slice(0, length))) { tail = length; break; }
+      }
+    }
+    if (final) {
+      if (truncated && tail) pending = pending.slice(0, -tail) + "[REDACTED]";
+      if (pending) emit(pending);
+      pending = "";
+    } else {
+      const ready = pending.slice(0, pending.length - tail);
+      pending = pending.slice(pending.length - tail);
+      if (ready) emit(ready);
+    }
+  };
+}
+async function execute(root, request, { restricted = true, signal, secrets = [], onOutput } = {}) {
+  if (signal?.aborted) throw new Error("Operation canceled");
   if (request.operation !== "exec") return fileOperation(root, request);
   if (restricted) {
     const result = await builtin(root, request.path ?? "", request.command);
-    return { stdout: result.text, stderr: "", exitCode: 0, truncated: result.truncated ?? false };
+    if (signal?.aborted) throw new Error("Operation canceled");
+    let stdout = "";
+    outputRedactor(secrets, text => { stdout += text; onOutput?.("stdout", text); })(result.text, true, result.truncated);
+    return { stdout, stderr: "", exitCode: 0, truncated: result.truncated ?? false };
   }
   const { absolute } = await resolveSafe(root, request.path ?? "", "directory");
   if (typeof request.command !== "string" || request.command.length > 4096 || request.command.includes("\0")) throw new Error("Invalid command");
   return new Promise((resolve, reject) => {
     const env = { ...process.env };
     for (const k of Object.keys(env)) if (/TOKEN|SECRET|PASSWORD|API_KEY|AUTHORIZATION/iu.test(k)) delete env[k];
-    const child = spawn(process.platform === "win32" ? process.env.ComSpec || "cmd.exe" : "/bin/sh", process.platform === "win32" ? ["/d", "/s", "/c", request.command] : ["-c", request.command], { cwd: absolute, env, detached: process.platform !== "win32", windowsHide: true });
-    let stdout = "", stderr = "", bytes = 0, truncated = false, timedOut = false;
+    const shell = process.platform === "win32" ? windowsExecution(request.command, env) : { executable: "/bin/sh", args: ["-c", request.command] };
+    const child = spawn(shell.executable, shell.args, { cwd: absolute, env, detached: process.platform !== "win32", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", bytes = 0, truncated = false, timedOut = false, streamError;
     const kill = () => {
       if (process.platform === "win32") {
         spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
@@ -220,13 +296,19 @@ async function execute(root, request, { restricted = true, signal, secrets = []
     const abort = () => kill();
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted) kill();
+    const decoders = { stdout: new StringDecoder("utf8"), stderr: new StringDecoder("utf8") };
+    const redact = Object.fromEntries(["stdout", "stderr"].map(which => [which, outputRedactor(secrets, text => {
+      if (which === "stdout") stdout += text;
+      else stderr += text;
+      if (!signal?.aborted && !streamError) {
+        try { onOutput?.(which, text); } catch (error) { streamError = error; kill(); }
+      }
+    })]));
     const append = (which, chunk) => {
       const room = Math.max(0, MAX_OUTPUT - bytes);
-      const s = chunk.subarray(0, room).toString("utf8");
       bytes += chunk.length;
       if (bytes > MAX_OUTPUT) truncated = true;
-      if (which === "stdout") stdout += s;
-      else stderr += s;
+      redact[which](decoders[which].write(chunk.subarray(0, room)));
     };
     child.stdout.on("data", (c) => append("stdout", c));
     child.stderr.on("data", (c) => append("stderr", c));
@@ -238,12 +320,13 @@ async function execute(root, request, { restricted = true, signal, secrets = []
     child.once("close", (code, sig) => {
       clearTimeout(timer);
       signal?.removeEventListener("abort", abort);
-      if (signal?.aborted) return reject(new Error("Operation canceled"));
-      for (const secret of secrets) if (secret) {
-        stdout = stdout.split(secret).join("[REDACTED]");
-        stderr = stderr.split(secret).join("[REDACTED]");
+      for (const which of ["stdout", "stderr"]) redact[which](decoders[which].end(), true, truncated);
+      if (signal?.aborted) {
+        const error = new Error("Operation canceled");
+        error.output = { stdout, stderr, exitCode: null, canceled: true, truncated, timedOut };
+        return reject(error);
       }
-      ;
+      if (streamError) return reject(streamError);
       resolve({ stdout, stderr, exitCode: code, signal: sig, truncated, timedOut });
     });
   });
@@ -256,5 +339,7 @@ export {
   list,
   resolveSafe,
   rootDescriptor,
-  safeRelative
+  safeRelative,
+  terminalDirectory,
+  parseTerminalDirectory
 };

package/lib/device/windows-execution.js

@@ -0,0 +1,31 @@
+import path from "node:path";
+
+// PowerShell prepares the console encoding, but cmd still interprets the user's
+// command. Pass cmd's command line directly rather than through PowerShell's
+// native-argument binder, which can rewrite nested quotes on Windows PowerShell.
+export function windowsExecution(command, env = process.env) {
+  const executable = env.SystemRoot
+    ? path.win32.join(env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+    : "powershell.exe";
+  const shell = env.ComSpec || env.COMSPEC || "cmd.exe";
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "$ProgressPreference = 'SilentlyContinue'",
+    "$utf8 = New-Object System.Text.UTF8Encoding($false)",
+    "[Console]::OutputEncoding = $utf8",
+    "$OutputEncoding = $utf8",
+    "$start = New-Object System.Diagnostics.ProcessStartInfo",
+    `$start.FileName = '${shell.replaceAll("'", "''")}'`,
+    `$command = '${command.replaceAll("'", "''")}'`,
+    "$start.Arguments = '/d /s /c \"' + $command + '\"'",
+    "$start.UseShellExecute = $false",
+    "$process = New-Object System.Diagnostics.Process",
+    "$process.StartInfo = $start",
+    "try {",
+    "  if (-not $process.Start()) { throw 'Unable to start command shell' }",
+    "  $process.WaitForExit()",
+    "  exit $process.ExitCode",
+    "} finally { $process.Dispose() }",
+  ].join("\r\n");
+  return { executable, args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-InputFormat", "Text", "-OutputFormat", "Text", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] };
+}

package/native/manifest.json

@@ -0,0 +1,36 @@
+{
+  "schema": 1,
+  "sourceSHA256": "800213014e6af32ed8b98749e832752b940ae638eaefa472aceb7b62e815b3e4",
+  "files": {
+    "win32-x64/yep-node.exe": {
+      "sha256": "b3b4ae3515f9408e2535af8d1a926b92099892968b1493fd781092a1299afdfd",
+      "goos": "windows",
+      "goarch": "amd64"
+    },
+    "win32-arm64/yep-node.exe": {
+      "sha256": "73e46d8bfa35c599411c3c02adef068cd9e0e7ba317b4fa309d778381d214aac",
+      "goos": "windows",
+      "goarch": "arm64"
+    },
+    "darwin-x64/yep-node": {
+      "sha256": "95bead46821a2800958d8dc865d67d9bfe83ac666b4796d046f2586b020989fc",
+      "goos": "darwin",
+      "goarch": "amd64"
+    },
+    "darwin-arm64/yep-node": {
+      "sha256": "6368ef2786d34168d6b2051d722fca2c4eaa7d261bfef29309dd10ef558718b7",
+      "goos": "darwin",
+      "goarch": "arm64"
+    },
+    "linux-x64/yep-node": {
+      "sha256": "e2d0cf28712d255b6aa7e4e010203abf6c3ea5f971b5a8db78a63ebd37314fad",
+      "goos": "linux",
+      "goarch": "amd64"
+    },
+    "linux-arm64/yep-node": {
+      "sha256": "c956a49fc196d2cbf5779fef63e1a1f21d86eb6cc67d4abbf583f954f3422d43",
+      "goos": "linux",
+      "goarch": "arm64"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yep-ai/cli",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Yep Marketplace unified CLI: skills, agents, plugins and authorized device nodes.",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
     "bin/market.js",
     "bin/clients.js",
     "lib",
+    "native",
     "README.md"
   ],
   "engines": {
@@ -25,6 +26,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
+    "prepack": "node ../../scripts/verify-yep-node.mjs",
     "build": "node bin/yep.js --version",
     "check": "node --check bin/yep.js && node --check bin/market.js && node --check lib/device/command.js && node --check lib/device/client.js && node --check lib/device/tools.js",
     "test": "node --test"