ec-web 0.0.22 → 0.0.23

package/dist/index.js

@@ -5,7 +5,7 @@
  * 用法:
  *   ec-web [--port 42705] [--home <EVOLCORE_HOME>]
  *
- * 通过 EVOLCORE_HOME 定位 evolcore 数据目录，启动 HTTP+WS 服务，浏览器配对码登录。
+ * 通过 EVOLCORE_HOME 定位 evolcore 数据目录，启动 HTTP+WS 服务；配对码和访问 token 由 daemon 管理。
  * 与 evolcore daemon 通过 IPC socket（live 状态）+ 文件系统（历史数据）旁路通信。
  */
 import fs from 'fs';
@@ -106,7 +106,9 @@ for (const list of Object.values(ifaces)) {
     }
 }
 process.stdout.write(`\n${BOLD}${CYAN}EC Web — EvolCore${RST}  ${DIM}(home: ${p.root})${RST}\n\n`);
-process.stdout.write(`  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(5 分钟内有效，配对后 token 缓存 30 天，有访问自动续期)${RST}\n\n`);
+process.stdout.write(handle.pairingCode
+    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，5 分钟内有效，配对后 token 缓存 30 天，有访问自动续期)${RST}\n\n`
+    : `  ${BOLD}配对码:${RST}  ${YELLOW}daemon 暂不可用，请先启动 EvolCore${RST}\n\n`);
 process.stdout.write(`  ${BOLD}本机:${RST}    http://localhost:${handle.port}\n`);
 for (const ip of lanIps)
     process.stdout.write(`  ${BOLD}局域网:${RST}  http://${ip}:${handle.port}\n`);

package/dist/ipc-client.js

@@ -15,9 +15,14 @@ import path from 'path';
 const LOCAL_CONTROL_COMMANDS = new Set([
     'evolagent.list',
     'menu.exec',
+    'model.catalog',
     'monitor-snapshot',
     'monitor-subscribe',
     'monitor-unsubscribe',
+    'remote-auth.pair-code',
+    'remote-auth.issue-local',
+    'remote-auth.redeem',
+    'remote-auth.validate',
 ]);
 export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
     let request = cmd;

package/dist/server.js

@@ -3,10 +3,10 @@
  *
  * - HTTP: 静态资源 + 配对 API
  * - WebSocket: 订阅式实时推送（aid / msg / session）
- * - 鉴权: 6 位配对码（5 分钟有效）→ token（30 天，有访问自动续期），持久化到磁盘
+ * - 鉴权: daemon 通过本地 IPC 提供 6 位配对码（5 分钟有效）和远程访问 token（30 天滑动续期）
  * - 安全: 绑定 0.0.0.0（支持远程访问），token 校验；远程连接可执行受控管理操作，不能修改 daemon 配置或读取 secret
  *
- * 与 evolcore 的唯一通信：启动时发 ping 检查 protocolVersion（soft 校验）。
+ * 与 evolcore daemon 通过 IPC socket（状态、Menu 和远程访问凭据）+ 文件系统（历史数据）旁路通信。
  */
 import http from 'http';
 import fs from 'fs';
@@ -33,13 +33,11 @@ import { ccProjectsDir } from './paths.js';
 import { relationRolesSource, handleRelationRolesApi, handlePeerRoleApi } from './sources/relation-roles.js';
 import { roleDefinitionsSource, handleRoleDefinitionsApi } from './sources/role-definitions.js';
 import { handleModelsApi } from './sources/models.js';
-import { detectBaseAgents } from './sources/baseagent-detector.js';
+import { detectBaseAgentsAsync } from './sources/baseagent-detector.js';
 import { readCodexSessionResult } from './sources/session-codex.js';
 import { handleBasicSettingsApi } from './sources/basic-settings.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const STATIC_DIR = path.join(__dirname, 'static');
-const TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30天（滑动窗口：每次有效访问刷新 lastActive 自动续期）
-const PAIRING_TTL_MS = 5 * 60 * 1000; // 5min
 const DEFAULT_PORT = 42705;
 const PROTOCOL_VERSION = 1; // 与 evolcore ping response 对齐的软校验版本
 function daemonOwnerMenuAuth(localDirect, actorAid) {
@@ -61,14 +59,6 @@ function daemonTriggerControlToken() {
         return undefined;
     }
 }
-function matchesDaemonControlToken(value) {
-    const expected = daemonTriggerControlToken();
-    if (typeof value !== 'string' || !expected)
-        return false;
-    const provided = Buffer.from(value);
-    const target = Buffer.from(expected);
-    return provided.length === target.length && crypto.timingSafeEqual(provided, target);
-}
 const SOURCES = { agents: aidSource, msg: msgSource, session: sessionSource, cache: cacheSource, system: systemSource, triggers: triggersSource, monitor: monitorSource, logs: logsSource, gateway: gatewaySource, roles: relationRolesSource, roleDefinitions: roleDefinitionsSource };
 // ECWeb 自身版本：渲染 System 页时随快照下发（不走 daemon IPC，ECWeb 就是这个进程）。
 function readEcwebVersion() {
@@ -104,66 +94,21 @@ const MIME = {
 };
 const HTML_CACHE_CONTROL = 'no-cache';
 const STATIC_CACHE_CONTROL = 'public, max-age=0, must-revalidate';
-function tokenStorePath() {
-    const dir = resolvePaths().instanceDir;
-    const current = path.join(dir, 'ecweb-tokens.json');
-    const legacy = path.join(dir, 'watch-web-tokens.json');
-    if (!fs.existsSync(current) && fs.existsSync(legacy)) {
-        try {
-            fs.renameSync(legacy, current);
-        }
-        catch { }
-    }
-    return current;
-}
-function loadTokens() {
-    try {
-        const store = JSON.parse(fs.readFileSync(tokenStorePath(), 'utf-8'));
-        if (Array.isArray(store.tokens))
-            return store;
-    }
-    catch { }
-    return { tokens: [] };
+async function remoteAuth(type, payload = {}) {
+    const response = await ipcQuery(resolvePaths().socket, { type, ...payload }, 2_000);
+    return response && typeof response === 'object' ? response : null;
 }
-function saveTokens(store) {
-    try {
-        fs.mkdirSync(resolvePaths().instanceDir, { recursive: true });
-        const tmp = tokenStorePath() + '.tmp';
-        fs.writeFileSync(tmp, JSON.stringify(store, null, 2));
-        fs.renameSync(tmp, tokenStorePath());
-    }
-    catch { }
-}
-function pruneExpired(store, now) {
-    const before = store.tokens.length;
-    store.tokens = store.tokens.filter(t => now - t.lastActive < TOKEN_TTL_MS);
-    return store.tokens.length !== before;
-}
-function validAuthorizedBy(value) {
-    if (typeof value !== 'string')
-        return undefined;
-    const normalized = value.trim();
-    if (!normalized || normalized.length > 512 || /[\r\n]/.test(normalized))
-        return undefined;
-    return normalized;
-}
-function getValidTokenRecord(token, now) {
+async function validateRemoteToken(token) {
     if (!token)
         return null;
-    const store = loadTokens();
-    const changed = pruneExpired(store, now);
-    const rec = store.tokens.find(t => t.token === token);
-    if (rec) {
-        rec.lastActive = now;
-        saveTokens(store);
-        return rec;
-    }
-    if (changed)
-        saveTokens(store);
-    return null;
+    const result = await remoteAuth('remote-auth.validate', { token });
+    if (!result?.ok || result.valid !== true)
+        return null;
+    return result.authorizedBy ? { authorizedBy: result.authorizedBy } : {};
 }
-function validateAndRenew(token, now) {
-    return getValidTokenRecord(token, now) !== null;
+async function issueLocalRemoteToken(label) {
+    const result = await remoteAuth('remote-auth.issue-local', { label });
+    return result?.ok && typeof result.token === 'string' ? result.token : null;
 }
 // ── Static ──
 // 经 AUN Service Proxy 转发时，proxy-server 注入 x-forwarded-prefix 头，
@@ -469,11 +414,8 @@ function isLocalDirect(req) {
     const providerAid = req.headers['x-aun-provider-aid'];
     return !providerAid || (Array.isArray(providerAid) ? providerAid.length === 0 : !providerAid.trim());
 }
-function genPairingCode() {
-    return String(crypto.randomInt(0, 1000000)).padStart(6, '0');
-}
 // ── Pair handler ──
-function handlePair(req, res, pairingCode, pairingExpiry, authorizedBy, log) {
+function handlePair(req, res, log) {
     let body = '';
     req.on('data', (chunk) => { body += chunk; if (body.length > 4096)
         req.destroy(); });
@@ -484,47 +426,34 @@ function handlePair(req, res, pairingCode, pairingExpiry, authorizedBy, log) {
             code = String(JSON.parse(body).code || '');
         }
         catch { }
-        if (Date.now() > pairingExpiry) {
-            res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: '配对码已过期，请重启 watch' }));
-            log(`✗ 配对失败（码已过期） from ${ip}`);
-            return;
-        }
-        if (code !== pairingCode) {
-            res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: '配对码错误' }));
-            log(`✗ 配对失败（码错误: ${code}） from ${ip}`);
-            return;
-        }
-        const now = Date.now();
-        const token = crypto.randomBytes(32).toString('hex');
-        const store = loadTokens();
-        pruneExpired(store, now);
-        store.tokens.push({
-            token,
-            createdAt: now,
-            lastActive: now,
+        void remoteAuth('remote-auth.redeem', {
+            code,
             label: ip,
-            ...(authorizedBy ? { authorizedBy } : {}),
+        }).then(result => {
+            if (!result?.ok || typeof result.token !== 'string') {
+                const status = result?.code === 'PAIRING_EXPIRED' ? 403 : 403;
+                res.writeHead(status, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: result?.error ?? '配对失败' }));
+                log(`✗ 配对失败（${result?.code ?? 'daemon-unavailable'}） from ${ip}`);
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: true, token: result.token }));
+            log(`✓ 配对成功 from ${ip}（daemon token 缓存 30 天，有访问自动续期）`);
+        }).catch(error => {
+            res.writeHead(503, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: 'daemon unavailable' }));
+            log(`✗ 配对失败（daemon unavailable: ${error instanceof Error ? error.message : String(error)}） from ${ip}`);
         });
-        saveTokens(store);
-        res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: true, token }));
-        log(`✓ 配对成功 from ${ip}（token 缓存 30 天，有访问自动续期${authorizedBy ? `，批准者 ${authorizedBy}` : ''}）`);
     });
 }
 /**
  * 本地直连免配对：自动发 token。远程（隧道或真远程）需配对码。
  * 本地直连判定：socket 来源是回环 AND 无 x-aun-provider-aid 头（非隧道）。
  */
-function issueLocalDirectToken(req, log) {
+async function issueLocalDirectToken(req, log) {
     if (!isLocalDirect(req))
         return null;
-    const now = Date.now();
-    const token = crypto.randomBytes(32).toString('hex');
-    const store = loadTokens();
-    pruneExpired(store, now);
-    const ip = clientIp(req);
-    store.tokens.push({ token, createdAt: now, lastActive: now, label: `local-direct:${ip}` });
-    saveTokens(store);
-    log(`✓ 本地直连自动授权 from ${ip}`);
+    const token = await issueLocalRemoteToken(`local-direct:${clientIp(req)}`);
+    if (token)
+        log(`✓ 本地直连自动授权 from ${clientIp(req)}`);
     return token;
 }
 // ── WebSocket connection ──
@@ -808,26 +737,20 @@ export async function startWatchWebServer(opts = {}) {
     if (pingResp && pingResp.protocolVersion !== undefined && pingResp.protocolVersion < PROTOCOL_VERSION) {
         log(`⚠️  evolcore protocolVersion=${pingResp.protocolVersion}，watch 期望 >=${PROTOCOL_VERSION}，部分功能可能异常`);
     }
-    let pairingCode = genPairingCode();
-    let pairingExpiry = Date.now() + PAIRING_TTL_MS;
-    let pairingAuthorizedBy;
-    function freshPairing() {
-        if (Date.now() > pairingExpiry) {
-            pairingCode = genPairingCode();
-            pairingExpiry = Date.now() + PAIRING_TTL_MS;
-            pairingAuthorizedBy = undefined;
-            log(`↺ 配对码已刷新：${pairingCode}（5 分钟有效）`);
-        }
-        return { code: pairingCode, expiresAt: pairingExpiry };
-    }
-    const server = http.createServer((req, res) => {
+    const server = http.createServer(async (req, res) => {
         const pathname = requestPath(req.url || '');
         const localDirect = isLocalDirect(req);
         if (req.method === 'GET' && (req.url || '') === '/api/available-baseagents') {
             // Base agent 可用性检测 API
-            const available = detectBaseAgents();
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify(available));
+            try {
+                const available = await detectBaseAgentsAsync();
+                res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify(available));
+            }
+            catch (error) {
+                res.writeHead(500, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify({ success: false, error: error?.message || String(error) }));
+            }
         }
         else if (req.method === 'GET' && (req.url || '') === '/api/pair-code') {
             // 取码 API：仅真本地直连可用（socket 回环 + 无 x-aun-provider-aid）。
@@ -838,28 +761,24 @@ export async function startWatchWebServer(opts = {}) {
                 res.end(JSON.stringify({ error: 'forbidden' }));
                 return;
             }
-            const { code, expiresAt } = freshPairing();
-            // daemon 通过 localhost 取码时带上 AUN 已认证的 owner AID。只接受
-            // 第一次绑定，避免同一配对码在不同 owner 间被重新归属。
-            const ownerHeader = req.headers['x-evolcore-pair-authorized-by'];
-            const controlHeader = req.headers['x-evolcore-control-token'];
-            const requestedOwner = validAuthorizedBy(Array.isArray(ownerHeader) ? ownerHeader[0] : ownerHeader);
-            const suppliedControlToken = Array.isArray(controlHeader) ? controlHeader[0] : controlHeader;
-            if (!pairingAuthorizedBy && requestedOwner && matchesDaemonControlToken(suppliedControlToken)) {
-                pairingAuthorizedBy = requestedOwner;
+            const pair = await remoteAuth('remote-auth.pair-code');
+            if (!pair?.ok || typeof pair.code !== 'string' || typeof pair.expiresAt !== 'number') {
+                res.writeHead(503, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'daemon unavailable' }));
+                return;
             }
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ code, expiresAt }));
+            res.end(JSON.stringify({ code: pair.code, expiresAt: pair.expiresAt }));
         }
         else if (req.method === 'POST' && (req.url || '').startsWith('/api/pair')) {
-            // 配对 API：远程（隧道/真远程）需要配对码；本地直连自动发 token 跳过配对。
-            const autoToken = issueLocalDirectToken(req, log);
+            // 配对 API：远程（隧道/真远程）需要 daemon 配对码；本地直连自动发 daemon token。
+            const autoToken = await issueLocalDirectToken(req, log);
             if (autoToken) {
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: true, token: autoToken }));
                 return;
             }
-            handlePair(req, res, pairingCode, pairingExpiry, pairingAuthorizedBy, log);
+            handlePair(req, res, log);
         }
         else if (pathname === '/api/basic-settings' || pathname === '/api/basic-settings/secret') {
             const authHeader = req.headers.authorization || '';
@@ -867,11 +786,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !validateAndRenew(token, Date.now())) {
+            if (!token || !(await validateRemoteToken(token))) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ success: false, error: 'unauthorized' }));
                 return;
@@ -895,11 +814,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !validateAndRenew(token, Date.now())) {
+            if (!token || !(await validateRemoteToken(token))) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
                 return;
@@ -912,11 +831,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !validateAndRenew(token, Date.now())) {
+            if (!token || !(await validateRemoteToken(token))) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
                 return;
@@ -930,11 +849,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            const tokenRecord = token ? getValidTokenRecord(token, Date.now()) : null;
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
             if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
@@ -949,11 +868,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            const tokenRecord = token ? getValidTokenRecord(token, Date.now()) : null;
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
             if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
@@ -967,11 +886,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            const tokenRecord = token ? getValidTokenRecord(token, Date.now()) : null;
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
             if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
@@ -984,11 +903,11 @@ export async function startWatchWebServer(opts = {}) {
         }
     });
     const wss = new WebSocketServer({ noServer: true });
-    server.on('upgrade', (req, socket, head) => {
+    server.on('upgrade', async (req, socket, head) => {
         const { query } = parseUrl(req.url || '');
         // 本地直连免 token；远程需 token。
         const localDirect = isLocalDirect(req);
-        const tokenRecord = localDirect ? null : getValidTokenRecord(query.token || '', Date.now());
+        const tokenRecord = localDirect ? null : await validateRemoteToken(query.token || '');
         const authed = localDirect || tokenRecord !== null;
         wss.handleUpgrade(req, socket, head, (ws) => {
             if (!authed) {
@@ -1000,11 +919,12 @@ export async function startWatchWebServer(opts = {}) {
         });
     });
     const { port, displaced } = await bindPort(server, opts.port ?? DEFAULT_PORT, log);
+    const initialPair = await remoteAuth('remote-auth.pair-code');
     return {
         url: `http://0.0.0.0:${port}`,
         port,
         displaced,
-        pairingCode,
+        pairingCode: initialPair?.ok && typeof initialPair.code === 'string' ? initialPair.code : '',
         close() {
             return new Promise((resolve) => {
                 // 强制断开所有 WS 客户端（graceful close 握手可能永不完成）

package/dist/sources/baseagent-detector.js

@@ -1,117 +1,44 @@
 /**
  * Base agent 环境检测 — 检测本机可用的 Claude、Codex、Gemini 和内置 EC Agent。
  *
- * 检测条件：
- * 命令行工具优先按 PATH 检测；同时保留会话目录检测，兼容 CLI 不在当前 shell
- * PATH 但已经在本机初始化过的情况。ecagent 随 EvolCore 一起提供，始终作为可选
- * 基座展示，实际凭据和网关配置由配置校验负责。
+ * 检测条件与 ec init 共用：Claude/Gemini 按可执行文件检测，Codex 要求满足
+ * 版本及 app-server 条件，ecagent 随 EvolCore 内置。不会仅因历史会话目录存在
+ * 就判定 CLI 可用。
  */
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-import { createRequire } from 'module';
-import { spawnSync } from 'child_process';
-const requireFromHere = createRequire(import.meta.url);
-let _cached = null;
-/**
- * 检测 node:sqlite 模块是否可用（Node 22.5+）
- */
-function checkSqliteAvailable() {
-    try {
-        requireFromHere('node:sqlite');
-        return true;
-    }
-    catch {
-        return false;
+import { resolveParentDistModule, toFileUrl } from './parent-package.js';
+let sharedDetectorPromise = null;
+async function sharedDetector() {
+    if (!sharedDetectorPromise) {
+        sharedDetectorPromise = import(toFileUrl(resolveParentDistModule('agents', 'baseagent-availability.js')));
     }
-}
-/**
- * 检测 Codex state_*.sqlite 文件是否存在
- */
-function checkCodexStateDb() {
-    const codexHome = path.join(os.homedir(), '.codex');
-    if (!fs.existsSync(codexHome))
-        return false;
-    try {
-        const files = fs.readdirSync(codexHome).filter(f => /^state_\d+\.sqlite$/.test(f));
-        return files.length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * 检测 Claude projects 目录是否存在
- */
-function checkClaudeProjects() {
-    const claudeProjects = path.join(os.homedir(), '.claude', 'projects');
-    return fs.existsSync(claudeProjects);
-}
-function commandExists(command) {
-    try {
-        const result = process.platform === 'win32'
-            ? spawnSync('where', [command], { stdio: 'ignore', windowsHide: true })
-            : spawnSync('sh', ['-lc', `command -v ${JSON.stringify(command)}`], { stdio: 'ignore' });
-        return result.status === 0;
-    }
-    catch {
-        return false;
-    }
-}
-function checkGeminiHome() {
-    return fs.existsSync(path.join(os.homedir(), '.gemini'));
-}
-function detectSources(id) {
-    if (id === 'ecagent')
-        return ['内置'];
-    const sources = [];
-    if (commandExists(id))
-        sources.push('PATH');
-    if (id === 'claude' && checkClaudeProjects())
-        sources.push('~/.claude/projects');
-    if (id === 'codex') {
-        if (checkCodexSessions())
-            sources.push('~/.codex/sessions');
-        if (checkCodexStateDb())
-            sources.push('~/.codex/state_*.sqlite');
-        if (checkSqliteAvailable())
-            sources.push('node:sqlite');
-    }
-    if (id === 'gemini' && checkGeminiHome())
-        sources.push('~/.gemini');
-    return sources;
-}
-/**
- * 检测 Codex sessions 目录是否存在
- */
-function checkCodexSessions() {
-    const codexSessions = path.join(os.homedir(), '.codex', 'sessions');
-    return fs.existsSync(codexSessions);
+    return sharedDetectorPromise;
 }
 /**
  * 检测所有 base agent 的可用性
- * 结果会缓存，避免重复检测
+ * 每次调用都会重新探测，确保基础设置中的“重新检测”反映当前环境。
  */
-export function detectBaseAgents() {
-    if (_cached)
-        return _cached;
-    const claude = detectSources('claude').length > 0;
-    const codex = detectSources('codex').length > 0;
-    const gemini = detectSources('gemini').length > 0;
-    const ecagent = true;
-    _cached = { claude, codex, gemini, ecagent };
-    return _cached;
+export async function detectBaseAgentsAsync() {
+    const mod = await sharedDetector();
+    const detected = new Set(mod.detectAvailableBaseagents());
+    return {
+        claude: detected.has('claude'),
+        codex: detected.has('codex'),
+        gemini: detected.has('gemini'),
+        ecagent: detected.has('ecagent'),
+    };
 }
 /** Return display-oriented detection details for the Basic Settings API. */
-export function detectBaseAgentDetails(defaults = {}) {
+export async function detectBaseAgentDetails(defaults = {}) {
+    const mod = await sharedDetector();
+    const probes = mod.detectBaseagentDetails();
     const configured = isRecord(defaults?.baseagents) ? defaults.baseagents : {};
-    return ['claude', 'codex', 'gemini', 'ecagent'].map(id => {
-        const detectionSource = detectSources(id);
+    return probes.map((probe) => {
+        const id = probe.id;
         return {
             id,
-            detected: id === 'ecagent' || detectionSource.length > 0,
+            detected: probe.detected,
             configured: Object.prototype.hasOwnProperty.call(configured, id),
-            detectionSource,
+            detectionSource: probe.detectionSource,
         };
     });
 }
@@ -121,6 +48,4 @@ function isRecord(value) {
 /**
  * 重置缓存（测试用）
  */
-export function resetDetectionCache() {
-    _cached = null;
-}
+export function resetDetectionCache() { }

package/dist/sources/basic-settings.js

@@ -176,6 +176,10 @@ function baseagentPath(fieldPath) {
         return null;
     return { baseagent: match[1], field: match[2] };
 }
+function baseagentBlockPath(fieldPath) {
+    const match = fieldPath.match(/^baseagents\.([a-z0-9_-]+)$/);
+    return match?.[1] || null;
+}
 export function isAllowedBasicSettingsPath(file, fieldPath) {
     try {
         pathSegments(fieldPath);
@@ -187,6 +191,9 @@ export function isAllowedBasicSettingsPath(file, fieldPath) {
         return DAEMON_EXACT_PATHS.has(fieldPath);
     if (DEFAULTS_EXACT_PATHS.has(fieldPath))
         return true;
+    const block = baseagentBlockPath(fieldPath);
+    if (block)
+        return BASEAGENT_SET.has(block);
     const parsed = baseagentPath(fieldPath);
     return !!parsed && BASEAGENT_SET.has(parsed.baseagent) && BASEAGENT_FIELDS[parsed.baseagent]?.has(parsed.field);
 }
@@ -450,6 +457,11 @@ function validateDefaultsValue(fieldPath, value) {
     const parsed = baseagentPath(fieldPath);
     if (parsed)
         return validateBaseagentValue(parsed.baseagent, parsed.field, fieldPath, value);
+    if (baseagentBlockPath(fieldPath)) {
+        if (!isRecord(value) || Object.keys(value).length > 0)
+            throw new Error(`${fieldPath} must be an empty object`);
+        return;
+    }
     if (fieldPath === 'active_baseagent') {
         if (!BASEAGENT_SET.has(String(value)))
             throw new Error(`${fieldPath} is invalid`);
@@ -510,8 +522,7 @@ export function validateBasicSettingsChange(file, change) {
     else
         validateDefaultsValue(change.path, change.value);
 }
-function validateBaseagentAvailability(config, changes) {
-    const details = detectBaseAgentDetails(config);
+function validateBaseagentAvailability(changes, details) {
     const detected = new Set(details.filter(item => item.detected).map(item => item.id));
     const configured = new Set(details.filter(item => item.configured).map(item => item.id));
     for (const change of changes) {
@@ -522,6 +533,10 @@ function validateBaseagentAvailability(config, changes) {
         if (parsed && !detected.has(parsed.baseagent) && !configured.has(parsed.baseagent)) {
             throw Object.assign(new Error(`Base Agent is not available on this machine: ${parsed.baseagent}`), { statusCode: 400 });
         }
+        const block = baseagentBlockPath(change.path);
+        if (block && change.op === 'set' && !detected.has(block) && !configured.has(block)) {
+            throw Object.assign(new Error(`Base Agent is not available on this machine: ${block}`), { statusCode: 400 });
+        }
     }
 }
 function setAtPath(root, segments, value) {
@@ -675,7 +690,7 @@ async function readSnapshot(options = {}) {
         },
         secrets,
         secretRefs,
-        baseagents: detectBaseAgentDetails(rawDefaults),
+        baseagents: await detectBaseAgentDetails(rawDefaults),
         logTypes: logTypeStats.types,
         logTypeCounts: logTypeStats.counts,
     };
@@ -779,6 +794,8 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
             changes.forEach(change => validateBasicSettingsChange(file, change));
             const modules = await getConfigManager();
             const target = file === 'daemon' ? modules.ConfigTarget.Process : modules.ConfigTarget.Defaults;
+            const currentConfig = modules.read(target, undefined, { cache: false, expand: false }) ?? {};
+            const detection = file === 'defaults' ? await detectBaseAgentDetails(currentConfig) : [];
             const mutation = modules.mutateConfig(target, undefined, config => {
                 if (basicSettingsRevision(config) !== body.revision) {
                     throw Object.assign(new Error('Configuration changed after it was loaded. Reload and try again.'), {
@@ -786,7 +803,7 @@ export async function handleBasicSettingsApi(req, res, options = {}) {
                     });
                 }
                 if (file === 'defaults')
-                    validateBaseagentAvailability(config, changes);
+                    validateBaseagentAvailability(changes, detection);
                 applyBasicSettingsChanges(config, file, changes);
                 const errors = modules.validateConfig(target, config);
                 if (errors.length > 0) {