larkin 0.4.12 → 0.4.13

package/dist/app/agent-lark-cli-workspace.cjs

@@ -44,13 +44,14 @@ function managedOfficialLarkCli(agent, env, resolve = official_lark_cli_js_1.res
 }
 function readPrivateJson(file, label) {
     const directory = node_fs_1.default.lstatSync(node_path_1.default.dirname(file));
-    if (!directory.isDirectory() || directory.isSymbolicLink() || !(0, secure_metadata_js_1.exactMode)(directory, 0o700)
+    if (!directory.isDirectory() || directory.isSymbolicLink()
+        || (!(0, secure_metadata_js_1.exactMode)(directory, 0o700) && !(0, secure_metadata_js_1.exactMode)(directory, 0o500))
         || (typeof process.getuid === "function" && directory.uid !== process.getuid()))
         throw new Error(`${label} 目录不安全`);
     const fd = node_fs_1.default.openSync(file, node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NOFOLLOW || 0));
     try {
         const stat = node_fs_1.default.fstatSync(fd);
-        if (!stat.isFile() || !(0, secure_metadata_js_1.exactMode)(stat, 0o600)
+        if (!stat.isFile() || (!(0, secure_metadata_js_1.exactMode)(stat, 0o600) && !(0, secure_metadata_js_1.exactMode)(stat, 0o400))
             || (typeof process.getuid === "function" && stat.uid !== process.getuid()))
             throw new Error(`${label} 文件不安全`);
         return JSON.parse(node_fs_1.default.readFileSync(fd, "utf8"));

package/dist/app/agent-lark-cli-workspace.mjs

@@ -34,13 +34,14 @@ export function managedOfficialLarkCli(agent, env, resolve = resolveOfficialLark
 }
 function readPrivateJson(file, label) {
     const directory = fs.lstatSync(path.dirname(file));
-    if (!directory.isDirectory() || directory.isSymbolicLink() || !exactMode(directory, 0o700)
+    if (!directory.isDirectory() || directory.isSymbolicLink()
+        || (!exactMode(directory, 0o700) && !exactMode(directory, 0o500))
         || (typeof process.getuid === "function" && directory.uid !== process.getuid()))
         throw new Error(`${label} 目录不安全`);
     const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
     try {
         const stat = fs.fstatSync(fd);
-        if (!stat.isFile() || !exactMode(stat, 0o600)
+        if (!stat.isFile() || (!exactMode(stat, 0o600) && !exactMode(stat, 0o400))
             || (typeof process.getuid === "function" && stat.uid !== process.getuid()))
             throw new Error(`${label} 文件不安全`);
         return JSON.parse(fs.readFileSync(fd, "utf8"));

package/dist/app/local-control.mjs

@@ -462,11 +462,15 @@ export function removeControlAuthority(larkinHome, expectedToken) {
             throw error;
     }
 }
-export function createSupervisorControlServer({ larkinHome, authorityToken, ensureDashboard, }) {
+export function createSupervisorControlServer({ larkinHome, authorityToken, ensureDashboard, onAgentUpserted, }) {
     let socket = "";
     let socketRoot = "";
     let socketIdentity = null;
     const completed = new Map();
+    const operationConflict = (operationId, agentId) => ({
+        ok: false, operationId, ...(agentId ? { agentId } : {}), code: "operation_conflict",
+        error: "operationId 已绑定其他 Agent 或操作",
+    });
     let server = null;
     return {
         async start() {
@@ -490,9 +494,15 @@ export function createSupervisorControlServer({ larkinHome, authorityToken, ensu
                         let request;
                         try {
                             request = JSON.parse(line);
-                            if (!OPERATION_ID.test(String(request.operationId || "")) || request.operation !== "ensure-dashboard"
+                            const isDashboardRecovery = request.operation === "ensure-dashboard";
+                            const isAgentUpsert = request.operation === "agent-upserted";
+                            const allowedKeys = isDashboardRecovery
+                                ? ["operationId", "operation", "authorization"]
+                                : isAgentUpsert ? ["operationId", "operation", "authorization", "agentId"] : [];
+                            if (!OPERATION_ID.test(String(request.operationId || "")) || (!isDashboardRecovery && !isAgentUpsert)
                                 || !AUTHORIZATION.test(String(request.authorization || ""))
-                                || Object.keys(request).some((key) => !["operationId", "operation", "authorization"].includes(key))) {
+                                || (isAgentUpsert && !AGENT_ID.test(String(request.agentId || "")))
+                                || Object.keys(request).some((key) => !allowedKeys.includes(key))) {
                                 throw new Error("invalid supervisor control request");
                             }
                             const authority = assertSupervisorAuthority(larkinHome, authorityToken);
@@ -505,17 +515,28 @@ export function createSupervisorControlServer({ larkinHome, authorityToken, ensu
                         }
                         const replay = completed.get(request.operationId);
                         if (replay) {
-                            connection.end(`${JSON.stringify(replay)}\n`);
+                            const sameRequest = replay.operation === request.operation
+                                && replay.agentId === request.agentId;
+                            const response = sameRequest ? replay.response : operationConflict(request.operationId, request.agentId);
+                            connection.end(`${JSON.stringify(response)}\n`);
                             return;
                         }
                         let response;
                         try {
-                            response = { ok: true, operationId: request.operationId, state: await ensureDashboard() };
+                            if (request.operation === "agent-upserted") {
+                                await onAgentUpserted?.(request.agentId);
+                                response = { ok: true, operationId: request.operationId, state: "agent-recorded" };
+                            }
+                            else {
+                                response = { ok: true, operationId: request.operationId, state: await ensureDashboard() };
+                            }
                         }
                         catch (error) {
                             response = { ok: false, operationId: request.operationId, error: error instanceof Error ? error.message : String(error) };
                         }
-                        completed.set(request.operationId, response);
+                        completed.set(request.operationId, {
+                            operation: request.operation, agentId: request.agentId, response,
+                        });
                         while (completed.size > 256)
                             completed.delete(completed.keys().next().value);
                         connection.end(`${JSON.stringify(response)}\n`);
@@ -812,6 +833,43 @@ async function sendSupervisorRecovery(larkinHome, operationId, timeoutMs) {
         });
     });
 }
+async function sendSupervisorAgentUpsert(larkinHome, agentId, operationId, timeoutMs) {
+    const authority = assertSupervisorAuthority(larkinHome);
+    assertSecureSocketDirectory(authority.socketRoot);
+    const socket = authority.supervisorSocketPath;
+    const stat = fs.lstatSync(socket);
+    if (!stat.isSocket() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || !notGroupOrWorldAccessible(stat))
+        throw new Error("supervisor control socket 不安全");
+    return await new Promise((resolve, reject) => {
+        const client = net.createConnection(socket);
+        const timer = setTimeout(() => { client.destroy(); reject(new Error("supervisor agent upsert control timeout")); }, timeoutMs);
+        let input = "";
+        client.setEncoding("utf8");
+        client.once("error", (error) => { clearTimeout(timer); reject(error); });
+        client.once("connect", () => client.write(`${JSON.stringify({
+            operationId, operation: "agent-upserted", agentId, authorization: authority.token,
+        })}\n`));
+        client.on("data", (chunk) => {
+            input += chunk;
+            const newline = input.indexOf("\n");
+            if (newline < 0)
+                return;
+            clearTimeout(timer);
+            client.end();
+            try {
+                resolve(JSON.parse(input.slice(0, newline)));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    });
+}
+export async function requestSupervisorAgentUpsert({ larkinHome, agentId, operationId = crypto.randomUUID(), timeoutMs = 30_000, }) {
+    return sendSupervisorAgentUpsert(larkinHome, agentId, operationId, timeoutMs);
+}
 export async function requestDashboardRecovery({ larkinHome, operationId = crypto.randomUUID(), timeoutMs = 30_000, }) {
     const deadline = Date.now() + timeoutMs;
     let lastError;

package/dist/app/run.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath } from "node:url";
 import * as larkinConfig from "../platform/config.mjs";
 import { currentProcessMetadata } from "../platform/process-inspect.cjs";
 import { acquireProcessLock, readProcessState, terminateOwnedProcess, waitForProcessExit, } from "../platform/process-state.mjs";
-import { hydrateRuntimeAgent, syncAgentProfile } from "./runtime-agent-config.mjs";
+import { hydrateRuntimeAgent, syncAgentProfile, validateAgentProfile } from "./runtime-agent-config.mjs";
 import { cleanupStaleAgentControlSocket, createSupervisorControlServer, initializeControlAuthority, removeControlAuthority, requestDashboardRecovery, } from "./local-control.mjs";
 import { internalCommandSpec, processCommandToken } from "./internal-command.mjs";
 import { traceProcessBoundary } from "../platform/process-boundary-trace.mjs";
@@ -80,6 +80,9 @@ export async function main() {
     catch (error) {
         return die(error.message);
     }
+    // Capture this supervisor's startup membership before setup can persist a new
+    // Agent. Unqualified selection must not expand from later durable config.
+    const initialNames = new Set(names);
     const before = readProcessState(configDir);
     if (before.supervisor.state === "owned") {
         if (before.dashboard.state !== "owned") {
@@ -124,11 +127,16 @@ export async function main() {
         die("无法取得 supervisor start identity");
     }
     const controlToken = initializeControlAuthority(configDir, { pid: process.pid, processStartToken: supervisorStartToken });
+    // This supervisor's successful hot-attaches are the only membership additions
+    // that survive a daemon crash. Durable config apply state describes freshness,
+    // not which Agents this explicitly selected supervisor owns.
+    const hotAttachedNames = new Set();
     let ensureDashboardHandler = () => "starting";
     const supervisorControl = createSupervisorControlServer({
         larkinHome: configDir,
         authorityToken: controlToken,
         ensureDashboard: () => ensureDashboardHandler(),
+        onAgentUpserted: (agentId) => { hotAttachedNames.add(agentId); },
     });
     try {
         await supervisorControl.start();
@@ -141,16 +149,53 @@ export async function main() {
         catch { /* best effort */ }
         die(`supervisor control 启动失败：${error instanceof Error ? error.message : String(error)}`);
     }
-    const agents = [];
-    try {
-        for (const name of names) {
-            const stored = config.agents[name];
+    let agents = [];
+    const serverId = config.serverId;
+    if (!serverId)
+        die("配置缺少 serverId");
+    const runtimeEnv = {
+        ...process.env,
+        LARKIN_HOME: configDir,
+        LARKIN_CONFIG_DIR: configDir,
+        LARKIN_AGENT_TRANSPORT_MODULE: path.join(HERE, "..", "agent", "agent-transport.cjs"),
+        LARKIN_SERVER_ID: String(serverId),
+        LARKIN_AGENTS_CONFIG: "[]",
+        LARKIN_CONTROL_AUTHORIZATION: controlToken,
+    };
+    if (argv.includes("--dry-run"))
+        runtimeEnv.LARKIN_FEISHU_DRYRUN = "1";
+    // Re-read durable config for every daemon launch instead of reusing the startup
+    // snapshot: a hot attach updates the child and durable config, but cannot mutate
+    // this supervisor's old closure. Membership remains initialNames plus successful
+    // hot attaches recorded during this supervisor lifetime.
+    const refreshDaemonAgents = (reuseExistingProfiles) => {
+        const latest = larkinConfig.loadConfig(process.env);
+        if (latest.configDir !== configDir)
+            throw new Error("配置目录在 supervisor 运行期间发生变化");
+        if (!latest.config.serverId || !Object.keys(latest.config.agents).length)
+            throw new Error("配置缺少 serverId/agents");
+        const latestNames = [...new Set([...initialNames, ...hotAttachedNames])];
+        const refreshed = [];
+        for (const name of latestNames) {
+            const stored = latest.config.agents[name];
             if (!stored)
                 throw new Error(`Agent ${name} 不存在`);
             const agent = hydrateRuntimeAgent(configDir, stored);
-            syncAgentProfile(agent, { ...process.env, LARKIN_CONFIG_DIR: configDir });
-            agents.push(agent);
+            if (reuseExistingProfiles)
+                validateAgentProfile(agent);
+            else
+                syncAgentProfile(agent, { ...process.env, LARKIN_CONFIG_DIR: configDir });
+            refreshed.push(agent);
         }
+        agents = refreshed;
+        names = latestNames;
+        runtimeEnv.LARKIN_SERVER_ID = String(latest.config.serverId);
+        runtimeEnv.LARKIN_AGENTS_CONFIG = JSON.stringify(agents);
+        for (const agent of agents)
+            traceProcessBoundary(runtimeEnv, "supervisor:daemon-env-prepared", { configDir, agentId: agent.agentId, targetDir: path.join(configDir, "providers", "pi", agent.agentId) });
+    };
+    try {
+        refreshDaemonAgents(false);
     }
     catch (error) {
         await supervisorControl.close().catch(() => { });
@@ -183,22 +228,6 @@ export async function main() {
         launchLock.release();
         die(`dashboard PID ${before.dashboard.pid} 身份无法确认；拒绝替换`);
     }
-    const serverId = config.serverId;
-    if (!serverId)
-        die("配置缺少 serverId");
-    const runtimeEnv = {
-        ...process.env,
-        LARKIN_HOME: configDir,
-        LARKIN_CONFIG_DIR: configDir,
-        LARKIN_AGENT_TRANSPORT_MODULE: path.join(HERE, "..", "agent", "agent-transport.cjs"),
-        LARKIN_SERVER_ID: String(serverId),
-        LARKIN_AGENTS_CONFIG: JSON.stringify(agents),
-        LARKIN_CONTROL_AUTHORIZATION: controlToken,
-    };
-    if (argv.includes("--dry-run"))
-        runtimeEnv.LARKIN_FEISHU_DRYRUN = "1";
-    for (const agent of agents)
-        traceProcessBoundary(runtimeEnv, "supervisor:daemon-env-prepared", { configDir, agentId: agent.agentId, targetDir: path.join(configDir, "providers", "pi", agent.agentId) });
     let stopping = false;
     let dashboard = null;
     // Set when the daemon-restart path stops the dashboard on purpose (port
@@ -222,7 +251,19 @@ export async function main() {
     // exiting on transient failures (e.g. network/proxy ECONNRESET during Feishu
     // auth). Only when the budget is exhausted does the supervisor exit so the
     // external process manager (launchd) takes over as the final respawn layer.
+    let initialRefreshPending = true;
     const launchDaemon = () => {
+        if (initialRefreshPending)
+            initialRefreshPending = false;
+        else
+            try {
+                refreshDaemonAgents(true);
+            }
+            catch (error) {
+                console.error(`✗ daemon 启动前重新加载配置失败：${error instanceof Error ? error.message : String(error)}`);
+                resolveDaemonFinal?.({ code: null, signal: null });
+                return;
+            }
         daemon = spawn(daemonSpec.command, daemonSpec.args, { env: runtimeEnv, stdio: "inherit" });
         for (const agent of agents)
             traceProcessBoundary(runtimeEnv, "supervisor:daemon-spawned", { configDir, agentId: agent.agentId, targetDir: path.join(configDir, "providers", "pi", agent.agentId), childPid: daemon.pid ?? null });
@@ -257,7 +298,6 @@ export async function main() {
                 const oldDashboard = dashboard;
                 if (oldDashboard && oldDashboard.exitCode === null && oldDashboard.signalCode === null) {
                     intentionalDashboardExit = oldDashboard;
-                    dashboard = null;
                     oldDashboard.kill("SIGTERM");
                     // If the old dashboard ignores SIGTERM (observed in production holding
                     // the dashboard port for minutes), escalate so the port is released

package/dist/app/runtime-agent-config.mjs

@@ -17,6 +17,13 @@ function assertSecureProfileDirectory(directory) {
         || !exactMode(stat, 0o700))
         throw new Error("lark-cli profile 目录不安全");
 }
+function assertValidProfileDirectory(directory) {
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || (!exactMode(stat, 0o700) && !exactMode(stat, 0o500)))
+        throw new Error("lark-cli profile 目录不安全");
+}
 function captureProfileSnapshot(file) {
     let fd = null;
     try {
@@ -233,22 +240,44 @@ function runOfficialLarkCliAsync(command, args, env, dependencies) {
         });
     });
 }
+function expectedRuntimeCommandShim() {
+    const standalone = process.env.LARKIN_STANDALONE === "1";
+    const binaryEntry = fileURLToPath(new URL("./binary-entry.mjs", import.meta.url));
+    const argumentsPrefix = standalone ? [] : [binaryEntry];
+    const command = [process.execPath, ...argumentsPrefix].map(shellQuote).join(" ");
+    return `#!/bin/sh\nexec ${command} "$@"\n`;
+}
 export function installRuntimeCommandShims(agent) {
     const stateDir = path.resolve(agent.stateDir);
     const commandDir = path.join(stateDir, "runtime-bin");
     assertSecureRuntimeCommandDirectory(commandDir);
-    const standalone = process.env.LARKIN_STANDALONE === "1";
-    const binaryEntry = fileURLToPath(new URL("./binary-entry.mjs", import.meta.url));
-    for (const [name, argumentsPrefix] of [["larkin", standalone ? [] : [binaryEntry]]]) {
+    const fileContents = expectedRuntimeCommandShim();
+    for (const name of ["larkin"]) {
         const file = path.join(commandDir, name);
         const temporary = path.join(commandDir, `.${name}.${process.pid}.${crypto.randomUUID()}.tmp`);
-        const command = [process.execPath, ...argumentsPrefix].map(shellQuote).join(" ");
-        fs.writeFileSync(temporary, `#!/bin/sh\nexec ${command} "$@"\n`, { mode: 0o700, flag: "wx" });
+        fs.writeFileSync(temporary, fileContents, { mode: 0o700, flag: "wx" });
         fs.renameSync(temporary, file);
         fs.chmodSync(file, 0o700);
     }
     return commandDir;
 }
+function validateRuntimeCommandShims(agent) {
+    const commandDir = path.join(path.resolve(agent.stateDir), "runtime-bin");
+    const directory = fs.lstatSync(commandDir);
+    if (!directory.isDirectory() || directory.isSymbolicLink()
+        || (typeof process.getuid === "function" && directory.uid !== process.getuid())
+        || (!exactMode(directory, 0o700) && !exactMode(directory, 0o500)))
+        throw new Error("Runtime command shim 目录不安全");
+    const file = path.join(commandDir, "larkin");
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || (!exactMode(stat, 0o700) && !exactMode(stat, 0o500)))
+        throw new Error("Runtime command shim 不安全");
+    if (fs.readFileSync(file, "utf8") !== expectedRuntimeCommandShim()) {
+        throw new Error("Runtime command shim 内容无效");
+    }
+}
 export function sourceProjection(agent, env) {
     const configDir = path.resolve(env.LARKIN_CONFIG_DIR || "");
     if (!configDir)
@@ -299,7 +328,31 @@ function validateSourceProjection(file, agent) {
         throw new Error(`Agent ${agent.agentId} lark-channel source projection tenant mismatch`);
     }
 }
+export function validateAgentProfile(agent) {
+    // Validate the profile root before resolving any leaf paths. The supervisor's
+    // restart fast path must not follow a replaced symlink or unsafe root.
+    assertValidProfileDirectory(agent.larkConfigDir);
+    const sourceFile = larkChannelSourceConfigPath(agent);
+    const workspaceFile = larkChannelWorkspaceConfigPath(agent);
+    const source = captureProfileSnapshot(sourceFile);
+    if (!source)
+        throw new Error(`Agent ${agent.agentId} lark-channel source projection missing`);
+    validateSourceProjection(sourceFile, agent);
+    const workspace = captureProfileSnapshot(workspaceFile);
+    if (!workspace)
+        throw new Error(`Agent ${agent.agentId} lark-channel workspace config missing`);
+    validateExclusiveBotProfile(workspace, agent);
+    validateRuntimeCommandShims(agent);
+    assertAgentWorkspaceBound(agent);
+}
 export function syncAgentProfile(agent, env, dependencies = {}) {
+    if (!dependencies.forceRebind) {
+        try {
+            validateAgentProfile(agent);
+            return;
+        }
+        catch { /* absent or stale state requires exactly one bind */ }
+    }
     const expected = path.join(path.resolve(env.LARKIN_CONFIG_DIR || ""), "state", "agents", agent.agentId, "lark-cli-config");
     if (path.resolve(agent.larkConfigDir) !== expected)
         throw new Error("lark-cli profile 路径不是 canonical contained 路径");

package/dist/app/runtime-process.mjs

@@ -8,7 +8,7 @@ import { createRuntimeHost } from "../runtime/runtime-host.mjs";
 import { createAgentStateStore } from "../agent/agent-state-store.mjs";
 import { loadConfig, markConfigApplied, runtimeConfigSignature } from "../platform/config.mjs";
 import { traceProcessBoundary } from "../platform/process-boundary-trace.mjs";
-import { createAgentControlServer } from "./local-control.mjs";
+import { createAgentControlServer, requestSupervisorAgentUpsert } from "./local-control.mjs";
 import { hydrateRuntimeAgent, syncAgentProfile } from "./runtime-agent-config.mjs";
 import { loadTelemetryConfig } from "../platform/telemetry-config.mjs";
 import { telemetrySingleton } from "../platform/telemetry-tracing.mjs";
@@ -104,6 +104,11 @@ export async function main(env = process.env, overrides = {}) {
             // Only the selected profile is synchronized; active profiles and their directory
             // are never quarantined or rebuilt during hot attach.
             await hostShell.upsertAgent(agent);
+            const tracked = await requestSupervisorAgentUpsert({
+                larkinHome: env.LARKIN_HOME, agentId: agent.agentId, operationId: request.operationId,
+            });
+            if (!tracked.ok)
+                throw new Error(tracked.error || "supervisor 未记录 Agent 热挂载");
         },
         async resetSession(request) {
             const result = await hostShell.resetSession(request.agentId, request.waitReadyMs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkin",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "private": false,
   "larkinPackageRole": "npm-published",
   "files": [