cofluxd 1.0.0 → 1.1.0

package/coflux.mjs

@@ -2,9 +2,22 @@
 // coflux：账号与本地、跨设备业务操作；不负责宿主生命周期。
 import { handlesAccountCommand, runAccountCommand } from "./account-client.mjs";
 import { parseArgs } from "node:util";
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const HOME = process.env.COFLUX_HOME || join(homedir(), ".coflux");
+// Delegate integration to the native CLI shipped with this device's runtime.
+if (process.argv[2] === "agent") {
+  const native = join(HOME, "bin", "coflux");
+  if (!existsSync(native)) {
+    console.error("Coflux integration is unavailable. Update this device with cofluxd update.");
+    process.exit(1);
+  }
+  const result = spawnSync(native, process.argv.slice(2), { stdio: "inherit" });
+  if (result.error) console.error(result.error.message);
+  process.exit(result.status ?? 1);
+}
 const DEFAULT_LOCAL_GATEWAY_PORT = 8788;
 const die = (message) => { console.error("✗ " + message); process.exit(1); };
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

package/cofluxd.mjs

@@ -254,7 +254,7 @@ async function resolveLatestTag() {
 async function ensureBinaries({ version, binDir, skipIfPresent }) {
   fs.mkdirSync(BIN_DIR, { recursive: true });
   if (binDir) {
-    const localArtifacts = ["coflux-supervisor", "coflux-worker"].map((name) => ({
+    const localArtifacts = ["coflux-supervisor", "coflux-worker", ...(fs.existsSync(join(binDir, "coflux")) ? ["coflux"] : [])].map((name) => ({
       name,
       path: join(binDir, name),
     }));
@@ -336,7 +336,7 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
     }
     const publicKey = loadReleasePublicKey();
     const staged = [];
-    for (const component of ["supervisor", "worker"]) {
+    for (const component of ["supervisor", "worker", ...(manifest.cli ? ["cli"] : [])]) {
       const entry = parseReleaseManifestEntry(manifest, component, releaseVersion, target);
       const artifactName = `coflux-${component}-${target}`;
       process.stdout.write(`下载并验签 ${artifactName} … `);
@@ -346,12 +346,12 @@ async function ensureBinaries({ version, binDir, skipIfPresent }) {
         artifactName,
       );
       verifyReleaseArtifact({ component, version: releaseVersion, entry, data, publicKey });
-      const source = join(stageDir, `coflux-${component}`);
+      const source = join(stageDir, component === "cli" ? "coflux" : `coflux-${component}`);
       fs.writeFileSync(source, data, { mode: 0o755 });
       fs.chmodSync(source, 0o755);
       staged.push({
         source,
-        destination: component === "supervisor" ? SUP_BIN : WRK_BIN,
+        destination: component === "cli" ? join(BIN_DIR, "coflux") : component === "supervisor" ? SUP_BIN : WRK_BIN,
       });
       console.log("✓");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cofluxd",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Coflux 无界面宿主（cofluxd）与统一操作工具（coflux）",
   "type": "module",
   "bin": {

package/release-trust.mjs

@@ -11,6 +11,8 @@ export const SUPERVISOR_RELEASE_STATEMENT_DOMAIN = Buffer.from(
   "utf8",
 );
 
+export const CLI_RELEASE_STATEMENT_DOMAIN = Buffer.from("coflux-cli-release-v1\0", "utf8");
+
 const STRICT_RELEASE_VERSION = /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
 const SHA256_HEX = /^[0-9a-f]{64}$/i;
 const ED25519_SIGNATURE_HEX = /^[0-9a-f]{128}$/i;
@@ -111,6 +113,10 @@ export function supervisorReleaseStatement(metadata) {
   return artifactReleaseStatement(SUPERVISOR_RELEASE_STATEMENT_DOMAIN, metadata);
 }
 
+export function cliReleaseStatement(metadata) {
+  return artifactReleaseStatement(CLI_RELEASE_STATEMENT_DOMAIN, metadata);
+}
+
 export function createReleasePublicKey(publicKeyHex) {
   const normalized = typeof publicKeyHex === "string" ? publicKeyHex.trim() : "";
   if (!ED25519_PUBLIC_KEY_HEX.test(normalized)) {
@@ -136,7 +142,7 @@ function isRecord(value) {
  */
 export function parseReleaseManifestEntry(manifest, component, version, target) {
   assertReleaseVersion(version);
-  if (component !== "worker" && component !== "supervisor") {
+  if (!["worker", "supervisor", "cli"].includes(component)) {
     throw new Error(`未知 release component: ${JSON.stringify(component)}`);
   }
   if (!isRecord(manifest) || manifest.schemaVersion !== 2 || manifest.version !== version) {
@@ -192,7 +198,7 @@ export function verifyReleaseArtifact({ component, version, entry, data, publicK
   const metadata = { version, target: entry.target, sha256, size: data.byteLength };
   const statement = component === "worker"
     ? workerReleaseStatement(metadata)
-    : supervisorReleaseStatement(metadata);
+    : component === "cli" ? cliReleaseStatement(metadata) : supervisorReleaseStatement(metadata);
   if (!crypto.verify(null, statement, publicKey, Buffer.from(entry.releaseSignature, "hex"))) {
     throw new Error(`${component} 产物 release Ed25519 签名无效`);
   }
@@ -205,11 +211,11 @@ export function verifyReleaseArtifact({ component, version, entry, data, publicK
 export function installStagedPair(staged) {
   if (
     !Array.isArray(staged) ||
-    staged.length !== 2 ||
+    ![2, 3].includes(staged.length) ||
     staged.some(({ source, destination }) =>
       typeof source !== "string" || !source || typeof destination !== "string" || !destination)
   ) {
-    throw new Error("daemon 安装必须提供两个合法的暂存文件");
+    throw new Error("daemon installation requires two or three valid staged artifacts");
   }
   const installed = [];
   const backups = [];

package/skills/coflux/SKILL.md

@@ -22,6 +22,20 @@ local daemon and never touch the center; `new`/`list`/`ports` are relayed to the
 daemon on your behalf (terminals must appear in the user's sidebar, preview URLs are minted by
 the center). You only ever talk to the local daemon.
 
+## Managed terminal integration
+
+Coflux terminals automatically load this capability for Claude Code and Codex. Use
+`coflux agent status` to inspect this terminal's integration acknowledgements; an
+unconfirmed run has not successfully executed its context hook. It does not prove
+that approval is pending. Codex asks for native hook review when needed; use `/hooks`
+to review it. Do not edit trust hashes or the user's global configuration.
+
+Each agent keeps its own immutable CLI and skill files. Relaunching the agent selects
+the installed device version, including from an already-open supported shell. Use
+`COFLUX_AGENT_INTEGRATION=off claude` or `COFLUX_AGENT_INTEGRATION=off codex` to bypass
+managed integration for one invocation. Use `coflux agent run <claude|codex> -- ...`
+when a custom shell alias takes precedence over automatic integration.
+
 ## Figure out where you are first
 
 With the coflux plugin installed, Claude Code and Codex receive a `<coflux-session>` block at