dsh-cliworker-now 0.7.6 → 0.7.8

package/lib/native-launch.mjs

@@ -1,9 +1,12 @@
 // Inspect fixed launcher data; never ask a shell to interpret CLI arguments.
 import { openSync, readSync, fstatSync, closeSync, realpathSync, statSync, existsSync } from 'node:fs'
-import { dirname, extname, isAbsolute, resolve, sep, delimiter, join } from 'node:path'
+import { basename, dirname, extname, isAbsolute, relative, resolve, sep, delimiter, join } from 'node:path'
 import { homedir, userInfo } from 'node:os'
 
-const invalid = () => new Error('CLI 启动入口无法确认，请配置原生程序或固定 Node/Bun 入口')
+const invalid = () => Object.assign(
+  new Error('CLI 启动入口无法确认，请配置原生程序或固定 Node/Bun 入口'),
+  { code: 'CLI_LAUNCHER_UNSUPPORTED' },
+)
 const batch = (value) => /\.(?:cmd|bat)$/i.test(value)
 function text(path, limit = 128 * 1024) {
   const descriptor = openSync(path, 'r')
@@ -73,6 +76,45 @@ function runtimeProgram(runtime, platform, launcherDirectory) {
   if (!candidate) throw new Error('未找到 Bun，请安装该 CLI 所需的 Bun 运行时')
   return file(candidate)
 }
+/** npm's native bin shim is data, not a batch program to execute. */
+function nativePackageBin(shim, suffix) {
+  const parts = suffix.replace(/\\/g, '/').split('/')
+  if (parts[0] !== 'node_modules' || parts.some((part) => !part || part === '.' || part === '..'))
+    throw invalid()
+  const scoped = parts[1]?.startsWith('@')
+  const name = parts.slice(1, scoped ? 3 : 2).join('/')
+  if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(name)) throw invalid()
+  const root = fileDirectory(resolve(dirname(shim), ...parts.slice(0, scoped ? 3 : 2)))
+  const entry = file(resolve(dirname(shim), ...parts))
+  const inside = relative(root, entry)
+  if (!inside || inside === '..' || inside.startsWith('..' + sep) || isAbsolute(inside)) throw invalid()
+  const manifest = JSON.parse(text(join(root, 'package.json')))
+  const command = basename(shim, extname(shim))
+  const declared = typeof manifest.bin === 'string'
+    ? name.split('/').at(-1) === command ? manifest.bin : undefined
+    : manifest.bin?.[command]
+  if (manifest.name !== name || typeof declared !== 'string' || isAbsolute(declared) ||
+    declared.replace(/\\/g, '/').split('/').includes('..') || file(resolve(root, declared)) !== entry)
+    throw invalid()
+  const descriptor = openSync(entry, 'r')
+  try {
+    const header = Buffer.alloc(64), signature = Buffer.alloc(4)
+    const size = fstatSync(descriptor).size
+    if (readSync(descriptor, header, 0, 64, 0) !== 64 || header.toString('ascii', 0, 2) !== 'MZ')
+      throw invalid()
+    const offset = header.readUInt32LE(0x3c)
+    if (offset < 64 || offset + 4 > size || readSync(descriptor, signature, 0, 4, offset) !== 4 ||
+      signature.toString('hex') !== '50450000') throw invalid()
+  } finally {
+    closeSync(descriptor)
+  }
+  return entry
+}
+function fileDirectory(path) {
+  const canonical = realpathSync(path)
+  if (!statSync(canonical).isDirectory()) throw invalid()
+  return canonical
+}
 function inspectBatch(executable, platform) {
   const source = text(file(executable)).trim().replace(/\r\n/g, '\n')
   // Nous' official fallback contains just a fixed interpreter and its encoded
@@ -101,8 +143,14 @@ function inspectBatch(executable, platform) {
     // npm cmd-shim's standard final control prefix is launcher boilerplate;
     // it is discarded, and nothing from it is executed by this module.
     line = line.replace(/^endLocal & goto #_undefined_# 2>NUL \|\| title [^&\n]+ & /i, '')
+    const native = /^@?"%(?:~dp0[\\/]?|dp0%[\\/])([^"\n%]+\.exe)"\s+%\*$/i.exec(line)
+    if (native) {
+      entries.add(nativePackageBin(executable, native[1]))
+      runtimes.add('native')
+      continue
+    }
     const command =
-      /^@?(?:(node|bun)|"%_prog%"|"%(?:~dp0|dp0%)[\\/](node|bun)\.exe")\s+"%(?:~dp0|dp0%)[\\/]([^"\n%]+)"\s+%\*$/i.exec(
+      /^@?(?:(node|bun)|"%_prog%"|"%(?:~dp0[\\/]?|dp0%[\\/])(node|bun)\.exe")\s+"%(?:~dp0[\\/]?|dp0%[\\/])([^"\n%]+)"\s+%\*$/i.exec(
         line,
       )
     if (command) {
@@ -112,7 +160,7 @@ function inspectBatch(executable, platform) {
       if (command[1] || command[2]) runtimes.add((command[1] || command[2]).toLowerCase())
       continue
     }
-    const program = /^@?set "?_prog=(?:%(?:~dp0|dp0%)[\\/])?(node|bun)(?:\.exe)?"?$/i.exec(line)
+    const program = /^@?set "?_prog=(?:%(?:~dp0[\\/]?|dp0%[\\/]))?(node|bun)(?:\.exe)?"?$/i.exec(line)
     if (program) {
       runtimes.add(program[1].toLowerCase())
       continue
@@ -121,7 +169,7 @@ function inspectBatch(executable, platform) {
       /^@?(?:goto start|:find_dp0|:start|set dp0=%~dp0|exit \/b|setlocal|endlocal|call :find_dp0)$/i.test(
         line,
       ) ||
-      /^@?if (?:not )?exist "%(?:~dp0|dp0%)[\\/](?:node|bun)\.exe" \($/i.test(line) ||
+      /^@?if (?:not )?exist "%(?:~dp0[\\/]?|dp0%[\\/])(?:node|bun)\.exe" \($/i.test(line) ||
       /^\)(?: else \()?$/i.test(line) ||
       /^@?set pathext=%pathext:;\.js;=;%$/i.test(line) ||
       /^@?if (?:not )?defined node_path \($/i.test(line) ||
@@ -133,6 +181,7 @@ function inspectBatch(executable, platform) {
   if (entries.size !== 1 || runtimes.size !== 1) throw invalid()
   const entry = [...entries][0],
     runtime = [...runtimes][0]
+  if (runtime === 'native') return { kind: 'native', argv: [entry] }
   if (scriptRuntime(entry) !== runtime) throw invalid()
   return { kind: runtime, argv: [runtimeProgram(runtime, platform, dirname(executable)), entry] }
 }
@@ -151,10 +200,16 @@ export function resolveNativeEntry(executable, platform = process.platform) {
     if (candidate) executable = candidate
   }
   if (!batch(executable)) return executable
-  const inspected = inspectBatch(executable, platform)
+  let inspected
+  try {
+    inspected = inspectBatch(executable, platform)
+  } catch {
+    // A present but invalid shim is not an absent CLI. Never forward raw paths or script text.
+    throw invalid()
+  }
   // Keep Bun's fixed shim identity: it may pin a bundled bun.exe beside the
   // shim which cannot be recovered from only the package's JS path.
-  return inspected.kind === 'node' ? inspected.argv[1] : executable
+  return inspected.kind === 'node' ? inspected.argv[1] : inspected.kind === 'native' ? inspected.argv[0] : executable
 }
 
 /** Windows CreateProcess accepts real programs, not npm command files. */

package/lib/native-spawn.mjs

@@ -0,0 +1,32 @@
+import { spawn } from 'node:child_process'
+
+/** Native CLI descendants keep their pipes/ConPTY and the enclosing Host Job.
+ * Window presentation is per child: hiding a wrapper does not hide its children.
+ * Node ignores windowsHide on POSIX, so both platforms use this one boundary.
+ */
+export function spawnNativeProcess(executable, argv, options) {
+  return spawn(executable, argv, { ...options, windowsHide: true })
+}
+
+/** Relay ordinary background pipes as bytes with Node's stream backpressure.
+ * Numeric/inherited descriptors make libuv omit CREATE_NO_WINDOW on Windows.
+ * This must never be used for a ConPTY: its console handles stay inherited. */
+export function forwardNativeStdio(child) {
+  const stopInput = () => {
+    process.stdin.unpipe(child.stdin)
+    process.stdin.destroy()
+  }
+  const fail = () => { child.kill('SIGTERM'); process.exitCode = 1 }
+  child.stdin.on('error', error => { stopInput(); if (error.code !== 'EPIPE') fail() })
+  child.stdin.once('close', stopInput)
+  child.once('exit', stopInput)
+  child.once('error', stopInput)
+  process.stdin.on('error', fail)
+  process.stdout.on('error', fail)
+  process.stderr.on('error', fail)
+  child.stdout.on('error', fail)
+  child.stderr.on('error', fail)
+  process.stdin.pipe(child.stdin)
+  child.stdout.pipe(process.stdout, { end: false })
+  child.stderr.pipe(process.stderr, { end: false })
+}

package/lib/pi-installation.mjs

@@ -1,13 +1,14 @@
 // One verified Pi package for the Host, account UI, native catalog and RPC entry.
 // Resolve installation metadata only; never execute an arbitrary shell launcher.
 import { readFileSync, realpathSync, statSync } from 'node:fs'
-import { basename, dirname, join } from 'node:path'
+import { createHash } from 'node:crypto'
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { resolveNativeEntry } from './native-launch.mjs'
 
-const versions = new Set(['1.0.2', '1.0.4'])
+const versions = new Set(['1.0.2', '1.0.4', '1.1.0'])
 const failure = () =>
   Object.assign(
-    new Error('Pi 安装身份或原生接口不匹配；需要 Pi Coding Agent 1.0.2 或 1.0.4，不能使用 OMP 入口'),
+    new Error('Pi 安装身份或原生接口不匹配；需要 Pi Coding Agent 1.0.2、1.0.4 或 1.1.0，不能使用 OMP 入口'),
     { code: 'CLI_IDENTITY_MISMATCH' },
   )
 function metadata(path) {
@@ -15,6 +16,27 @@ function metadata(path) {
   if (!info.isFile() || info.size > 128 * 1024) throw failure()
   return readFileSync(path, 'utf8')
 }
+// Exact official Windows managed launcher inspected from Pi 1.1.0. It is read as
+// installation metadata, never evaluated. Unknown bootstrap code fails closed.
+const managedWindowsLauncherSHA256 = '3d8b27bb3f5c07543303b0ee774ce215e4d6ae2b0ae43311c4acf51f517ffd13'
+function windowsManagedEntry(launcher) {
+  const source = metadata(launcher).trim().replace(/\r\n/g, '\n')
+  if (createHash('sha256').update(source).digest('hex') !== managedWindowsLauncherSHA256) throw failure()
+  const install = join(dirname(dirname(launcher)), 'install')
+  const version = metadata(join(install, 'current-version')).trim()
+  if (!versions.has(version)) throw failure()
+  const directory = resolve(install, 'releases', version, 'node_modules/@earendil-works/pi-coding-agent')
+  // A version pointer/package symlink must not select code outside this release.
+  if (realpathSync(directory) !== directory) throw failure()
+  const manifest = JSON.parse(metadata(join(directory, 'package.json')))
+  const bin = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin?.pi
+  if (manifest.name !== '@earendil-works/pi-coding-agent' || manifest.version !== version ||
+    !['dist/cli.js', 'dist/bundle/cli.js'].includes(bin)) throw failure()
+  const entry = realpathSync(resolve(directory, bin))
+  const inside = relative(directory, entry)
+  if (!inside || inside === '..' || inside.startsWith('..' + sep) || isAbsolute(inside)) throw failure()
+  return entry
+}
 
 export function inspectPiInstallation(entry) {
   try {
@@ -34,6 +56,8 @@ export function inspectPiInstallation(entry) {
       }
     }
     executable = realpathSync(resolveNativeEntry(executable))
+    if (basename(executable).toLowerCase() === 'pi-launcher.js' && basename(dirname(executable)) === 'bin')
+      executable = windowsManagedEntry(executable)
     let directory = dirname(executable)
     for (let depth = 0; depth < 5; depth++, directory = dirname(directory)) {
       let manifest

package/lib/pi-native-catalog.mjs

@@ -1,7 +1,7 @@
 // Native metadata only. No prompts, API keys, OAuth objects, headers or raw errors leave this boundary.
 import { join } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { spawn } from 'node:child_process'
+import { spawnNativeProcess } from './native-spawn.mjs'
 import { inspectPiInstallation } from './pi-installation.mjs'
 import { nativeLaunchArgv } from './native-launch.mjs'
 
@@ -144,7 +144,7 @@ async function nativeCandidates(
   }
   const args = ['models', '--json', '--no-extensions', '--config', join(directory, 'config.yml')]
   const nativeArgs = nativeLaunchArgv([executable, ...args])
-  const child = spawn(nativeArgs[0], nativeArgs.slice(1), {
+  const child = spawnNativeProcess(nativeArgs[0], nativeArgs.slice(1), {
     cwd: directory,
     env,
     stdio: ['ignore', 'pipe', 'pipe'],
@@ -196,16 +196,23 @@ async function nativeCandidates(
 // Availability is deliberately separate from native catalog presence. A model
 // is selectable only through current account scope or a declared exact API route.
 async function privateJSON(path, fallback = {}) {
-  const { open } = await import('node:fs/promises')
+  const { open, lstat } = await import('node:fs/promises')
   const { constants } = await import('node:fs')
-  let handle
+  let handle, entry
   try {
+    // Windows does not implement O_NOFOLLOW. Check the directory entry before
+    // opening and bind it to the descriptor and final entry on every platform.
+    entry = await lstat(path)
+    if (entry.isSymbolicLink() || !entry.isFile() || entry.nlink !== 1)
+      throw new Error('Unsafe private metadata input')
     handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
     const info = await handle.stat()
-    if (!info.isFile() || info.nlink !== 1 || info.size > 2 * 1024 * 1024)
+    if (!info.isFile() || info.nlink !== 1 || info.size > 2 * 1024 * 1024 ||
+        info.dev !== entry.dev || info.ino !== entry.ino)
       throw new Error('Unsafe private metadata input')
     const text = await handle.readFile('utf8')
     const after = await handle.stat()
+    const current = await lstat(path)
     const value = JSON.parse(text)
     if (
       !value ||
@@ -213,12 +220,15 @@ async function privateJSON(path, fallback = {}) {
       Array.isArray(value) ||
       Buffer.byteLength(text) > 2 * 1024 * 1024 ||
       info.size !== after.size ||
-      info.mtimeMs !== after.mtimeMs
+      info.mtimeMs !== after.mtimeMs ||
+      current.isSymbolicLink() || !current.isFile() || current.nlink !== 1 ||
+      current.dev !== info.dev || current.ino !== info.ino ||
+      current.size !== after.size || current.mtimeMs !== after.mtimeMs
     )
       throw new Error('Invalid private metadata input')
     return value
   } catch (error) {
-    if (error?.code === 'ENOENT') return fallback
+    if (!entry && error?.code === 'ENOENT') return fallback
     throw error
   } finally {
     await handle?.close()

package/lib/pi-omp-bridge.mjs

@@ -1,6 +1,6 @@
 // Subprocess protocol bridge. The Host owns the external sandbox, credentials,
 // deadlines, directory/session locks, and descendant cleanup. No shell is used.
-import { spawn } from 'node:child_process'
+import { spawnNativeProcess } from './native-spawn.mjs'
 import { createHash, randomBytes } from 'node:crypto'
 import { mkdir, writeFile, rename, realpath, unlink, rmdir, lstat, open, rm } from 'node:fs/promises'
 import { constants } from 'node:fs'
@@ -360,7 +360,7 @@ try {
     ]
     const launch = nativeLaunchArgv([config.executable, ...nativeArgs])
     if (stopped) throw new Error('任务已停止')
-    child = spawn(launch[0], launch.slice(1), {
+    child = spawnNativeProcess(launch[0], launch.slice(1), {
       cwd: config.project,
       env,
       detached: false,

package/lib/pi-omp-refresh.mjs

@@ -2,7 +2,7 @@ import { constants } from 'node:fs'
 import { lstat, open, realpath, rename, rm, writeFile } from 'node:fs/promises'
 import { createHash, randomUUID } from 'node:crypto'
 import { createRequire } from 'node:module'
-import { dirname, join } from 'node:path'
+import { dirname, join, toNamespacedPath } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { DatabaseSync } from 'node:sqlite'
 import { inspectPiInstallation } from './pi-installation.mjs'
@@ -138,7 +138,7 @@ export async function assertPiOmpRefreshSources(root, expected) {
     let current
     if (receipt.cli === 'pi') current = (await refreshJson(entry.path, false))[entry.provider]
     else {
-      const db = new DatabaseSync(entry.path, { readOnly: true })
+      const db = new DatabaseSync(toNamespacedPath(entry.path), { readOnly: true })
       try {
         current = rowCredential(
           db
@@ -173,7 +173,7 @@ async function refreshedEntries(root, receipt) {
       if (refreshFingerprint(data[entry.provider]) !== entry.hash) throw unsafe()
     for (const entry of receipt.entries) result.push([entry, data[entry.provider]])
   } else {
-    const db = new DatabaseSync(join(root, 'agent/agent.db'), { readOnly: true })
+    const db = new DatabaseSync(toNamespacedPath(join(root, 'agent/agent.db')), { readOnly: true })
     try {
       const rows = db
         .prepare('SELECT rowid AS id,provider,credential_type,data,disabled_cause FROM auth_credentials')

package/lib/private-launch.mjs

@@ -1,9 +1,13 @@
 // Set a private file-creation mask without mutating the shared Harness process.
-import { spawn } from 'node:child_process'
+import { forwardNativeStdio, spawnNativeProcess } from './native-spawn.mjs'
 import { nativeLaunchArgv } from './native-launch.mjs'
 process.umask(0o077)
 const [executable, ...argv] = nativeLaunchArgv(process.argv.slice(2))
-const child = spawn(executable, argv, { env: process.env, stdio: 'inherit' })
+// This helper is also used under POSIX PTYs, whose original handles must stay.
+// Windows ConPTY account launch unwraps it in windows-account-launch.mjs.
+const backgroundPipes = process.platform === 'win32'
+const child = spawnNativeProcess(executable, argv, { env: process.env, stdio: backgroundPipes ? ['pipe', 'pipe', 'pipe'] : 'inherit' })
+if (backgroundPipes) forwardNativeStdio(child)
 let stopped = false
 for (const signal of ['SIGTERM', 'SIGINT'])
   process.on(signal, () => {

package/lib/terminal-bridge.mjs

@@ -1,12 +1,12 @@
 // The native terminal owner tracks descendants across their own process groups.
 // Keep this root alive until the Host acknowledges cleanup; never merge stderr
 // into the CLI JSON protocol. Envelopes are transport only, not agent events.
-import { spawn } from 'node:child_process'
+import { spawnNativeProcess } from './native-spawn.mjs'
 import { nativeLaunchArgv } from './native-launch.mjs'
 const [executable, ...args] = nativeLaunchArgv(process.argv.slice(2))
 const send = (channel, fields) => process.stdout.write(JSON.stringify({ channel, ...fields }) + '\n')
 const keepAlive = setInterval(() => {}, 60000)
-const child = spawn(executable, args, { stdio: ['ignore', 'pipe', 'pipe'] })
+const child = spawnNativeProcess(executable, args, { stdio: ['ignore', 'pipe', 'pipe'] })
 child.stdout.on('data', (bytes) => send('stdout', { bytes: bytes.toString('base64') }))
 child.stderr.on('data', (bytes) => send('stderr', { bytes: bytes.toString('base64') }))
 child.on('error', (error) => send('error', { message: error.message }))