@yep-ai/cli 1.0.1 → 1.0.2

package/README.md

@@ -12,7 +12,7 @@ npx --yes @yep-ai/cli@latest --help
 
 ```sh
 npx --yes @yep-ai/cli@latest --help
-npx --yes @yep-ai/cli@latest device start --server https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest device start
 ```
 
 本包包含完整实现。`yep-cli` 是计划中的同版本入口包，当前尚未发布本项目版本，请使用 `@yep-ai/cli`。
@@ -24,12 +24,13 @@ npx --yes @yep-ai/cli@latest device start --server https://yep.nihao.cool
 ```sh
 npm install
 npm run yep -- --help
+npm run build:yep-node
 npm run pack:cli
-npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.0.1.tgz ./dist/cli/unscoped/yep-cli-1.0.1.tgz
+npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.0.2.tgz ./dist/cli/unscoped/yep-cli-1.0.2.tgz
 ./tmp/yep-install/node_modules/.bin/yep --version
 ```
 
-完整实现包为 `scoped/yep-ai-cli-1.0.1.tgz`，入口包为 `unscoped/yep-cli-1.0.1.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
+完整实现包为 `scoped/yep-ai-cli-1.0.2.tgz`，入口包为 `unscoped/yep-cli-1.0.2.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
 
 ## 市场与 Git 内容版本
 
@@ -59,19 +60,22 @@ npx --yes @yep-ai/cli@latest withdraw @creator/demo --kind agent
 ## 设备节点
 
 ```sh
-npx --yes @yep-ai/cli@latest device login --server https://yep.nihao.cool
-npx --yes @yep-ai/cli@latest device start "/path/to/documents" --server https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest device login
+npx --yes @yep-ai/cli@latest device start "/path/to/documents"
 npx --yes @yep-ai/cli@latest device status
 npx --yes @yep-ai/cli@latest device logout
 ```
 
 设备通过 HTTPS 配对和 WSS 出站连接；网页批准设备后，还需在某场咨询中选择目录和权限。目录不会整体上传。最多指定 5 个目录；指定目录时仅提供受限内置命令。不指定目录时，命令拥有当前系统用户的 shell 权限，可访问其他文件和网络。进程退出后节点离线，不安装后台服务。设备授权最长 24 小时，可以从网页或 CLI 撤销。
 
-节点上线后，可在「设备节点」点击「打开终端」，直接选择启动目录并发送命令，无需创建咨询。终端实时展示标准输出、错误输出和退出码，可以停止命令、清屏和重连。`cd 子目录`、`cd ..` 与 `cd` 可切换工作目录；每条命令独立执行，shell 变量不会跨命令保留。CLI 终端不提供交互式输入，`vim`、`top`、口令提示等需要真实终端的程序请使用 SSH 网页终端。单条命令最长运行 30 秒、输出最多 64 KiB；关闭终端、撤销授权或断线会停止正在执行的命令。
+节点上线后，可在「设备节点」点击「打开终端」。不指定启动目录时，npm 包内的 Go `yep-node` 为每个标签启动独立的真实 Shell：Windows 使用 ConPTY + cmd，macOS / Linux 使用 PTY + 当前用户的 Shell。输入直接进入终端，工作目录、变量和交互程序状态保留；支持 Ctrl+C、窗口尺寸变化和最多 4 个独立网页会话。AI 操作与网页终端分别执行，不共用工作目录或进程。关闭标签、撤销授权、节点退出或网络连接断开会终止对应 Shell；重连创建新会话，不重放命令。
 
-指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes @yep-ai/cli@latest`，保留原目录参数与 `--server` 地址。
+原生程序随 npm 包一起分发，无需用户安装 Go。当前构建目标为 Windows x64 / ARM64、macOS Intel / Apple Silicon、Linux x64 / ARM64；Windows 需要支持 ConPTY 的 Windows 10 1809 / Server 2019 或更新版本。鸿蒙 / OpenHarmony 原生 ABI 尚未适配，不能将 Linux ARM64 包视为鸿蒙包。缺少原生程序时会明确提示并提供兼容的逐条命令模式；受限目录始终使用内置命令模式，不启动系统 Shell。
 
-`--server` 只接受 HTTPS 源站（回环开发地址允许 HTTP），显式指定后记住该源站；令牌按源站隔离。市场登录不等于设备授权。
+设备配对和网络通道使用 HTTPS / WSS；服务端保存令牌摘要，客户端每小时轮换设备令牌并保留短暂交接窗口，轮换不会延长原有 24 小时授权。客户端先持久化待交接凭据，断线后继续完成交接。TLS 在站点入口终止，集群内部连接不属于端到端加密。
+指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes @yep-ai/cli@latest`，保留原目录参数。
+
+设备默认连接 `https://yep.nihao.cool`，使用本站时无需指定服务器。连接自建站点时可使用 `--server https://your-site.example`；只接受 HTTPS 源站（回环开发地址允许 HTTP），显式指定后记住该源站，令牌按源站隔离。市场登录不等于设备授权。
 
 ## 配置
 

package/lib/device/client.js

@@ -5,6 +5,8 @@ import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import WebSocket from "ws";
 import { rootDescriptor, resolveSafe, list, execute, terminalDirectory } from "./tools.js";
+import { findNativeBinary, NativeTerminal } from "./native-terminal.js";
+import { rotateDeviceCredential } from "./credential-rotation.js";
 const PROTOCOL = 2;
 const DEFAULT_SERVER = "https://yep.nihao.cool";
 function serverOrigin(value) {
@@ -84,9 +86,22 @@ async function loadCredential(directory, server) {
 async function saveCredential(directory, server, value) {
   const location = credentialPath(directory, server);
   const temporary = location + "." + randomUUID();
-  await fs.writeFile(temporary, JSON.stringify({ ...value, server }), { mode: 384, flag: "wx" });
-  await protect(temporary);
-  await fs.rename(temporary, location);
+  try {
+    const file = await fs.open(temporary, "wx", 0o600);
+    try {
+      await file.writeFile(JSON.stringify({ ...value, server }));
+      await protect(temporary);
+      // Rotation must not reach the server before its recovery secret reaches disk.
+      await file.sync();
+    } finally { await file.close(); }
+    await fs.rename(temporary, location);
+    if (process.platform !== "win32") {
+      const parent = await fs.open(directory, "r");
+      try { await parent.sync(); } finally { await parent.close(); }
+    }
+  } finally {
+    await fs.unlink(temporary).catch(error => { if (error.code !== "ENOENT") throw error; });
+  }
 }
 async function loadDefaultServer(directory) {
   const location = path.join(directory, "default-server.json");
@@ -112,7 +127,9 @@ async function api(server, route, { token, body, method = "GET" } = {}) {
   try {
     result = await response.json();
   } catch {
-    throw new Error("Server returned an invalid response");
+    const error = new Error(response.ok ? "Server returned an invalid response" : `HTTP ${response.status}`);
+    if (!response.ok) error.status = response.status;
+    throw error;
   }
   ;
   if (!response.ok) {
@@ -156,6 +173,7 @@ ${verify.href}`);
     ;
     if (response.status === "denied") throw new Error("Device authorization was denied");
     if (response.status === "authorized") {
+      response.issuedAt = new Date().toISOString();
       await saveCredential(config.directory, server, response);
       console.log("设备授权已保存（最多24小时）。");
       return response;
@@ -353,11 +371,53 @@ async function start(server, config, credential, directories, { name, noOpen, si
   if (directories.length > 5) throw new Error("At most five startup directories");
   const roots = restricted ? await Promise.all(directories.map((p, i) => rootDescriptor("root-" + (i + 1), p, config.directory))) : await systemRoots(config.directory);
   if (!roots.length) throw new Error("No accessible filesystem roots");
+  const nativeBinary = restricted ? null : await findNativeBinary();
+  if (!restricted && !nativeBinary) console.warn("未找到当前平台的原生终端组件，使用兼容命令模式。");
   console.log(restricted ? "受限目录模式：仅内置命令，不能启动 shell 或外部程序。" : "完整系统模式：网页授权执行的命令拥有当前系统用户权限，可访问其他文件和网络；这不是沙箱。");
   let delay = 1e3;
+  const rotationInterval = 60 * 60 * 1000;
+  // Older credentials lack issuedAt. Their fixed 24-hour lifetime still gives
+  // an issuance bound, so reconnecting/restarting cannot postpone rotation.
+  const rotationDeadline = value => {
+    const base = Date.parse(value.rotatedAt || value.issuedAt);
+    const issued = Date.parse(value.expiresAt) - 24 * rotationInterval;
+    return (Number.isFinite(base) ? Math.min(base, Date.now()) : Math.min(issued, Date.now())) + rotationInterval;
+  };
+  let nextRotation = rotationDeadline(credential);
+  const retryDelay = () => new Promise(resolve => {
+    const finish = () => { clearTimeout(timer); signal?.removeEventListener("abort", finish); resolve(); };
+    const timer = setTimeout(finish, delay);
+    signal?.addEventListener("abort", finish, { once: true });
+    if (signal?.aborted) finish();
+  });
+  const recoverCredential = async () => {
+    const saved = credential.deviceId ? await loadCredential(config.directory, server) : null;
+    if (!saved) return;
+    if (saved.deviceId !== credential.deviceId) {
+      const error = new Error("Device credential changed");
+      error.code = "YEP_CREDENTIAL_CHANGED";
+      throw error;
+    }
+    credential = saved.pendingToken ? await rotateDeviceCredential(server, saved, { api, save: value => saveCredential(config.directory, server, value) }) : saved;
+    nextRotation = Math.min(nextRotation, rotationDeadline(credential));
+    if (!credential.pendingToken && saved.pendingToken) nextRotation = rotationDeadline(credential);
+  };
   while (!signal?.aborted) {
+    try {
+      // A previous rotate response or final save may have been lost. Recover
+      // from disk before presenting a bearer on a new WebSocket connection.
+      await recoverCredential();
+    } catch (error) {
+      if (error.code === "YEP_CREDENTIAL_CHANGED") throw error;
+      if ([401, 403].includes(error.status)) throw new Error("Device authorization expired or revoked");
+      console.log(`设备凭据同步暂时失败；${Math.ceil(delay / 1e3)}秒后重试。`);
+      await retryDelay();
+      delay = Math.min(delay * 2, 3e4);
+      continue;
+    }
     if (Date.now() >= Date.parse(credential.expiresAt)) throw new Error("Device authorization expired; run login again");
     let fatal;
+    let recoverableAuthorization = false;
     await new Promise((resolve, reject) => {
       const url = new URL("/api/local-cli/connect", server);
       url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
@@ -365,53 +425,104 @@ async function start(server, config, credential, directories, { name, noOpen, si
       const agent = new DeviceAgent(roots, { restricted, privateDir: config.directory, token: credential.token, expiresAt: credential.expiresAt,
         onTerminalOutput: frame => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(frame)); },
       });
+      const native = nativeBinary ? new NativeTerminal(nativeBinary, frame => {
+        if (ws.readyState !== WebSocket.OPEN) return;
+        if (ws.bufferedAmount > 2 * 1024 * 1024) { ws.terminate(); return; }
+        ws.send(JSON.stringify(frame));
+      }) : null;
       let ready = false;
       let heartbeat;
+      let receiveWatchdog;
+      let credentialRotation = false;
+      let rotationTask = null;
+      let awaitingCredential = false;
+      const received = () => {
+        if (ws.readyState !== WebSocket.OPEN || fatal || signal?.aborted) return;
+        clearTimeout(receiveWatchdog);
+        receiveWatchdog = setTimeout(() => {
+          ready = false;
+          native?.close();
+          agent.close();
+          ws.terminate();
+        }, 45000);
+      };
+      const updateCredential = () => {
+        if (awaitingCredential && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "credential_update", token: credential.token }));
+      };
+      const rotate = () => {
+        if (!credentialRotation || rotationTask || awaitingCredential || !ready || signal?.aborted) return;
+        rotationTask = (async () => {
+          const saved = await loadCredential(config.directory, server);
+          if (!saved || saved.deviceId !== credential.deviceId) throw new Error("Device credential changed");
+          const next = await rotateDeviceCredential(server, saved, { api, save: value => saveCredential(config.directory, server, value) });
+          credential = next;
+          agent.token = next.token;
+          nextRotation = Date.now() + rotationInterval;
+          if (ws.readyState === WebSocket.OPEN && ready) { awaitingCredential = true; updateCredential(); }
+        })().catch(() => { nextRotation = Date.now() + 60 * 1000; }).finally(() => { rotationTask = null; });
+      };
       const cleanup = () => {
         clearInterval(heartbeat);
+        clearTimeout(receiveWatchdog);
+        native?.close();
         agent.close();
         signal?.removeEventListener("abort", abort);
       };
       const abort = () => {
         ready = false;
+        native?.close();
         agent.close();
         ws.close();
       };
       signal?.addEventListener("abort", abort, { once: true });
       ws.on("open", () => {
-        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true, capabilities: ["terminal"] }));
+        received();
+        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true, capabilities: ["terminal", ...(native ? ["pty"] : [])] }));
       });
+      ws.on("ping", received);
+      ws.on("pong", received);
       ws.on("unexpected-response", (_req, res) => {
         if ([401, 403].includes(res.statusCode)) {
           fatal = new Error("Device authorization expired or revoked");
-          ws.terminate();
+          recoverableAuthorization = true;
         }
+        // With this listener installed ws leaves response ownership to us.
+        // Explicitly end every rejected handshake, including transient 503s.
+        res.destroy();
+        ws.terminate();
       });
       ws.on("message", async (bytes) => {
         if (fatal || signal?.aborted) return;
+        received();
         let frame;
         try {
           frame = JSON.parse(bytes.toString());
           if (frame.type === "ready") {
             if (frame.protocol !== PROTOCOL) throw new Error("Unsupported server protocol");
             agent.connectionId = frame.connectionId;
+            credentialRotation = frame.credentialRotation === true;
             ready = true;
             delay = 1e3;
             console.log("设备已上线。可在网页设备节点中打开终端，或在咨询中选择目录；退出此进程将断开。");
             heartbeat = setInterval(() => {
               if (Date.now() >= Date.parse(credential.expiresAt)) {
                 fatal = new Error("Device authorization expired");
+                native?.close();
                 agent.close();
                 ws.close();
                 return;
               }
               if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "ping" }));
+              updateCredential();
+              if (Date.now() >= nextRotation) rotate();
             }, 1e4);
             return;
           }
           if (["revoked", "expired", "replaced"].includes(frame.type)) {
             fatal = new Error(`Device ${frame.type}; local operations stopped`);
+            recoverableAuthorization = frame.type === "revoked";
             ready = false;
+            native?.close();
             agent.close();
             ws.close();
             return;
@@ -420,7 +531,18 @@ async function start(server, config, credential, directories, { name, noOpen, si
             ws.send(JSON.stringify({ type: "pong" }));
             return;
           }
+          if (frame.type === "credential_updated") { awaitingCredential = false; return; }
+          if (frame.type === "credential_update_error") { awaitingCredential = true; return; }
           if (!ready) return;
+          if (["pty_open", "pty_input", "pty_resize", "pty_close"].includes(frame.type)) {
+            try {
+              if (!native) throw new Error("Interactive terminal unavailable");
+              native.write(frame);
+            } catch (error) {
+              if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "pty_error", sessionId: frame.sessionId, error: String(error.message).slice(0, 1024) }));
+            }
+            return;
+          }
           const result = await agent.frame(frame);
           if (result && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(result));
         } catch (e) {
@@ -431,27 +553,30 @@ async function start(server, config, credential, directories, { name, noOpen, si
             ws.send(JSON.stringify({ type: frame.type?.startsWith("terminal_") ? "terminal_error" : "result", id: frame.id, sessionId: frame.sessionId, bindingId: frame.bindingId, consultationId: frame.consultationId, error: error.slice(0, 8192) }));
           } else {
             fatal = e;
+            native?.close();
+            agent.close();
             ws.close();
           }
         }
       });
       ws.on("error", () => {
       });
-      ws.on("close", () => {
+      ws.on("close", async () => {
         cleanup();
+        if (rotationTask) await rotationTask;
         resolve();
       });
     });
-    if (fatal) throw fatal;
+    if (fatal) {
+      if (!recoverableAuthorization) throw fatal;
+      const saved = credential.deviceId ? await loadCredential(config.directory, server) : null;
+      if (!saved?.pendingToken) throw fatal;
+      // Local operations have already stopped. A pending secret can distinguish
+      // an expired overlap from an actual revocation on the next recovery pass.
+    }
     if (signal?.aborted) break;
     console.log(`连接已断开；${Math.ceil(delay / 1e3)}秒后重连。原咨询绑定已失效，重连后需重新选择。`);
-    await new Promise((resolve) => {
-      const t = setTimeout(resolve, delay);
-      signal?.addEventListener("abort", () => {
-        clearTimeout(t);
-        resolve();
-      }, { once: true });
-    });
+    await retryDelay();
     delay = Math.min(delay * 2, 3e4);
   }
 }

package/lib/device/command.js

@@ -2,7 +2,8 @@
 import fs from "node:fs/promises";
 import { readFileSync } from "node:fs";
 const { version } = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
-import { serverOrigin, initializeConfig, loadCredential, loadDefaultServer, rememberServer, credentialPath, login, start, api } from "./client.js";
+import { serverOrigin, initializeConfig, loadCredential, loadDefaultServer, rememberServer, credentialPath, login, start, api, saveCredential } from "./client.js";
+import { rotateDeviceCredential } from "./credential-rotation.js";
 const HELP = `Yep 本地设备节点 ${version} (协议2，Node.js 22+)
 
 yep device start [目录1 ... 目录5] [--server https://your-site.example]
@@ -45,6 +46,14 @@ export async function runDevice(args = process.argv.slice(2)) {
   if (server) await rememberServer(config.directory, server);
   else server = await loadDefaultServer(config.directory);
   let credential = await loadCredential(config.directory, server);
+  if (credential?.pendingToken) {
+    try {
+      credential = await rotateDeviceCredential(server, credential, { api, save: value => saveCredential(config.directory, server, value) });
+    } catch (error) {
+      if (command === "start" && (error.status === 401 || error.status === 403)) credential = null;
+      else throw error;
+    }
+  }
   const controller = new AbortController();
   const stop = () => controller.abort();
   process.once("SIGINT", stop);

package/lib/device/credential-rotation.js

@@ -0,0 +1,37 @@
+import { createHash, randomBytes } from "node:crypto";
+
+// Persist the next bearer first: either secret can then recover an interrupted rotation.
+export async function rotateDeviceCredential(server, credential, { api, save, createToken = () => randomBytes(32).toString("hex") }) {
+  let pending = credential.pendingToken;
+  if (!pending) {
+    pending = createToken();
+    if (!/^[0-9a-f]{64}$/.test(pending) || pending === credential.token) throw new Error("Invalid generated device credential");
+    credential = { ...credential, pendingToken: pending };
+    await save(credential);
+  }
+  const tokenHash = createHash("sha256").update(pending).digest("hex");
+  try {
+    await api(server, "/api/local-cli/rotate", { method: "POST", token: credential.token, body: { tokenHash } });
+  } catch (error) {
+    // The response may have been lost or the old overlap may have elapsed.
+    if (![401, 403, 404, 409].includes(error.status)) throw error;
+    let me;
+    try {
+      me = await api(server, "/api/local-cli/me", { token: pending });
+    } catch (pendingError) {
+      if (error.status !== 404 || ![401, 403].includes(pendingError.status)) throw pendingError;
+      // An older server may not implement rotation. Only discard an unaccepted
+      // pending secret after proving that the original credential still works.
+      const current = await api(server, "/api/local-cli/me", { token: credential.token });
+      if (current.deviceId !== credential.deviceId) throw new Error("Current credential belongs to another device");
+      const { pendingToken: _pending, ...unchanged } = credential;
+      await save(unchanged);
+      return unchanged;
+    }
+    if (me.deviceId !== credential.deviceId) throw new Error("Rotated credential belongs to another device");
+  }
+  const { pendingToken: _pending, ...rest } = credential;
+  const rotated = { ...rest, token: pending, rotatedAt: new Date().toISOString() };
+  await save(rotated);
+  return rotated;
+}

package/lib/device/native-terminal.js

@@ -0,0 +1,108 @@
+import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import { constants } from "node:fs";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const platforms = new Set(["win32-x64", "win32-arm64", "darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64"]);
+const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
+
+export function nativeBinaryPath(platform = process.platform, arch = process.arch) {
+  const target = `${platform}-${arch}`;
+  if (!platforms.has(target)) return null;
+  return path.join(packageRoot, "native", target, platform === "win32" ? "yep-node.exe" : "yep-node");
+}
+
+export async function findNativeBinary(platform = process.platform, arch = process.arch) {
+  const binary = nativeBinaryPath(platform, arch);
+  if (!binary) return null;
+  try { await access(binary, platform === "win32" ? constants.F_OK : constants.X_OK); return binary; }
+  catch (error) { if (error.code === "ENOENT" || error.code === "EACCES") return null; throw error; }
+}
+
+export class NativeTerminal {
+  constructor(binary, send) {
+    this.binary = binary;
+    this.send = send;
+    this.sessions = new Set();
+    this.opening = new Set();
+    this.closed = false;
+    this.failed = false;
+    this.startWorker();
+  }
+
+  startWorker() {
+    const child = spawn(this.binary, [], { stdio: ["pipe", "pipe", "ignore"], windowsHide: true });
+    const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
+    const worker = { child, lines };
+    this.worker = worker;
+    this.child = child;
+    this.lines = lines;
+    this.failed = false;
+    lines.on("line", line => {
+      if (this.closed || this.failed || this.worker !== worker) return;
+      if (line.length > 1024 * 1024) { failed(); return; }
+      let frame;
+      try { frame = JSON.parse(line); } catch { failed(); return; }
+      if (!frame || typeof frame.sessionId !== "string" || !this.sessions.has(frame.sessionId) || !["pty_ready", "pty_output", "pty_exit", "pty_error"].includes(frame.type)) return;
+      if (frame.type === "pty_ready") this.opening.delete(frame.sessionId);
+      if (frame.type === "pty_exit" || frame.type === "pty_error" && this.opening.has(frame.sessionId)) {
+        this.sessions.delete(frame.sessionId);
+        this.opening.delete(frame.sessionId);
+      }
+      this.send(frame);
+    });
+    const failed = () => {
+      if (this.closed || this.failed || this.worker !== worker) return;
+      this.failed = true;
+      const sessionIds = [...this.sessions];
+      this.sessions.clear();
+      this.opening.clear();
+      this.stopWorker(worker);
+      for (const sessionId of sessionIds) this.send({ type: "pty_error", sessionId, error: "Local terminal process stopped; open a new terminal to start a new shell" });
+    };
+    child.on("error", failed);
+    child.on("exit", failed);
+    child.stdin.on("error", failed);
+    child.stdout.on("error", failed);
+  }
+
+  stopWorker(worker) {
+    if (worker.stopping) return;
+    worker.stopping = true;
+    worker.lines.close();
+    // Keep draining output while the worker closes its PTYs and reaps shells.
+    worker.child.stdout.resume();
+    worker.child.stdin.end();
+    if (worker.child.exitCode !== null || worker.child.signalCode !== null) return;
+    const timeout = setTimeout(() => worker.child.kill("SIGKILL"), 2000);
+    timeout.unref();
+    worker.child.once("exit", () => clearTimeout(timeout));
+  }
+
+  write(frame) {
+    if (this.closed) throw new Error("Local terminal process is unavailable");
+    if (typeof frame.sessionId !== "string" || !frame.sessionId || frame.sessionId.length > 200) throw new Error("Invalid terminal session");
+    if (!['pty_open', 'pty_input', 'pty_resize', 'pty_close'].includes(frame.type)) throw new Error("Invalid terminal operation");
+    if (this.failed) {
+      if (frame.type !== "pty_open") throw new Error("Local terminal process stopped; open a new terminal to start a new shell");
+      this.startWorker();
+    }
+    if (this.child.stdin.writableLength > 1024 * 1024) throw new Error("Local terminal input is busy");
+    if (frame.type === "pty_open") {
+      if (this.sessions.has(frame.sessionId) || this.sessions.size >= 8) throw new Error("Too many or duplicate terminal sessions");
+      this.sessions.add(frame.sessionId);
+      this.opening.add(frame.sessionId);
+    } else if (!this.sessions.has(frame.sessionId)) throw new Error("Unknown terminal session");
+    this.child.stdin.write(JSON.stringify(frame) + "\n");
+  }
+
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.sessions.clear();
+    this.opening.clear();
+    this.stopWorker(this.worker);
+  }
+}

package/lib/device/tools.js

@@ -3,6 +3,7 @@ import { constants as FS } from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
+import { windowsExecution } from "./windows-execution.js";
 const MAX_FILE = 10 * 1024 * 1024;
 const MAX_OUTPUT = 64 * 1024;
 function safeRelative(value = "") {
@@ -274,7 +275,8 @@ async function execute(root, request, { restricted = true, signal, secrets = [],
   return new Promise((resolve, reject) => {
     const env = { ...process.env };
     for (const k of Object.keys(env)) if (/TOKEN|SECRET|PASSWORD|API_KEY|AUTHORIZATION/iu.test(k)) delete env[k];
-    const child = spawn(process.platform === "win32" ? process.env.ComSpec || "cmd.exe" : "/bin/sh", process.platform === "win32" ? ["/d", "/s", "/c", request.command] : ["-c", request.command], { cwd: absolute, env, detached: process.platform !== "win32", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const shell = process.platform === "win32" ? windowsExecution(request.command, env) : { executable: "/bin/sh", args: ["-c", request.command] };
+    const child = spawn(shell.executable, shell.args, { cwd: absolute, env, detached: process.platform !== "win32", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "", stderr = "", bytes = 0, truncated = false, timedOut = false, streamError;
     const kill = () => {
       if (process.platform === "win32") {

package/lib/device/windows-execution.js

@@ -0,0 +1,31 @@
+import path from "node:path";
+
+// PowerShell prepares the console encoding, but cmd still interprets the user's
+// command. Pass cmd's command line directly rather than through PowerShell's
+// native-argument binder, which can rewrite nested quotes on Windows PowerShell.
+export function windowsExecution(command, env = process.env) {
+  const executable = env.SystemRoot
+    ? path.win32.join(env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+    : "powershell.exe";
+  const shell = env.ComSpec || env.COMSPEC || "cmd.exe";
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "$ProgressPreference = 'SilentlyContinue'",
+    "$utf8 = New-Object System.Text.UTF8Encoding($false)",
+    "[Console]::OutputEncoding = $utf8",
+    "$OutputEncoding = $utf8",
+    "$start = New-Object System.Diagnostics.ProcessStartInfo",
+    `$start.FileName = '${shell.replaceAll("'", "''")}'`,
+    `$command = '${command.replaceAll("'", "''")}'`,
+    "$start.Arguments = '/d /s /c \"' + $command + '\"'",
+    "$start.UseShellExecute = $false",
+    "$process = New-Object System.Diagnostics.Process",
+    "$process.StartInfo = $start",
+    "try {",
+    "  if (-not $process.Start()) { throw 'Unable to start command shell' }",
+    "  $process.WaitForExit()",
+    "  exit $process.ExitCode",
+    "} finally { $process.Dispose() }",
+  ].join("\r\n");
+  return { executable, args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-InputFormat", "Text", "-OutputFormat", "Text", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] };
+}

package/native/manifest.json

@@ -0,0 +1,36 @@
+{
+  "schema": 1,
+  "sourceSHA256": "800213014e6af32ed8b98749e832752b940ae638eaefa472aceb7b62e815b3e4",
+  "files": {
+    "win32-x64/yep-node.exe": {
+      "sha256": "b3b4ae3515f9408e2535af8d1a926b92099892968b1493fd781092a1299afdfd",
+      "goos": "windows",
+      "goarch": "amd64"
+    },
+    "win32-arm64/yep-node.exe": {
+      "sha256": "73e46d8bfa35c599411c3c02adef068cd9e0e7ba317b4fa309d778381d214aac",
+      "goos": "windows",
+      "goarch": "arm64"
+    },
+    "darwin-x64/yep-node": {
+      "sha256": "95bead46821a2800958d8dc865d67d9bfe83ac666b4796d046f2586b020989fc",
+      "goos": "darwin",
+      "goarch": "amd64"
+    },
+    "darwin-arm64/yep-node": {
+      "sha256": "6368ef2786d34168d6b2051d722fca2c4eaa7d261bfef29309dd10ef558718b7",
+      "goos": "darwin",
+      "goarch": "arm64"
+    },
+    "linux-x64/yep-node": {
+      "sha256": "e2d0cf28712d255b6aa7e4e010203abf6c3ea5f971b5a8db78a63ebd37314fad",
+      "goos": "linux",
+      "goarch": "amd64"
+    },
+    "linux-arm64/yep-node": {
+      "sha256": "c956a49fc196d2cbf5779fef63e1a1f21d86eb6cc67d4abbf583f954f3422d43",
+      "goos": "linux",
+      "goarch": "arm64"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yep-ai/cli",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Yep Marketplace unified CLI: skills, agents, plugins and authorized device nodes.",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
     "bin/market.js",
     "bin/clients.js",
     "lib",
+    "native",
     "README.md"
   ],
   "engines": {
@@ -25,6 +26,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
+    "prepack": "node ../../scripts/verify-yep-node.mjs",
     "build": "node bin/yep.js --version",
     "check": "node --check bin/yep.js && node --check bin/market.js && node --check lib/device/command.js && node --check lib/device/client.js && node --check lib/device/tools.js",
     "test": "node --test"