newmark-agent 0.4.4 → 0.4.6

package/dist/core/installUpdate.js

@@ -39,6 +39,15 @@ exports.normalizeReleaseVersion = normalizeReleaseVersion;
 exports.compareSemver = compareSemver;
 exports.checkGitHubUpdate = checkGitHubUpdate;
 exports.applyGitHubUpdate = applyGitHubUpdate;
+exports.listRunningNewmarkProcesses = listRunningNewmarkProcesses;
+exports.stopNewmarkProcesses = stopNewmarkProcesses;
+exports.listInstalledNewmarkProducts = listInstalledNewmarkProducts;
+exports.uninstallNewmarkProduct = uninstallNewmarkProduct;
+exports.installMsiPackage = installMsiPackage;
+exports.findLegacyNewmarkExecutables = findLegacyNewmarkExecutables;
+exports.removeLegacyNewmarkExecutables = removeLegacyNewmarkExecutables;
+exports.planManagedMsiInstall = planManagedMsiInstall;
+exports.executeManagedMsiInstall = executeManagedMsiInstall;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
@@ -518,4 +527,260 @@ async function applyGitHubUpdate(options) {
         };
     }
 }
+const NEWMARK_PROCESS_NAMES = ['Newmark Agent.exe', 'Newmark.exe'];
+const NEWMARK_LEGACY_EXECUTABLES = new Set(['newmark.exe', 'newmark agent.exe']);
+function normalizeWindowsPathForCompare(value) {
+    return path.resolve(String(value)).toLowerCase();
+}
+function isWithinOrEqual(candidate, parent) {
+    const child = normalizeWindowsPathForCompare(candidate);
+    const rootPath = normalizeWindowsPathForCompare(parent);
+    return child === rootPath || child.startsWith(rootPath.endsWith(path.sep) ? rootPath : rootPath + path.sep);
+}
+function runPowerShellJson(script) {
+    const args = ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script];
+    const stdout = (0, child_process_1.execFileSync)('powershell.exe', args, { encoding: 'utf-8', windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+    const trimmed = String(stdout || '').replace(/^\uFEFF/, '').trim();
+    if (!trimmed)
+        return [];
+    const parsed = JSON.parse(trimmed);
+    return Array.isArray(parsed) ? parsed.map(item => item) : [parsed];
+}
+function listRunningNewmarkProcesses() {
+    const rows = runPowerShellJson(`Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq 'Newmark Agent.exe' -or $_.Name -eq 'Newmark.exe' } | Select-Object ProcessId,Name,ExecutablePath | ConvertTo-Json -Compress`);
+    const skipPid = Number(process.env.NEWMARK_SKIP_PROCESS_PID || process.pid);
+    return rows
+        .map(row => ({
+        pid: Number(row.ProcessId || 0),
+        name: String(row.Name || ''),
+        executablePath: String(row.ExecutablePath || ''),
+    }))
+        .filter(proc => proc.pid > 0 && proc.pid !== skipPid);
+}
+function stopNewmarkProcesses(pids) {
+    const ids = Array.from(new Set((pids || []).map(Number).filter(pid => Number.isFinite(pid) && pid > 0)));
+    if (!ids.length)
+        return { stopped: [], errors: [] };
+    const script = `$ids = @(${ids.join(',')}); foreach ($id in $ids) { try { Stop-Process -Id $id -Force -ErrorAction Stop; Write-Output ('stopped:' + $id) } catch { Write-Output ('error:' + $id + ':' + $_.Exception.Message) } }`;
+    const args = ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script];
+    const stdout = String((0, child_process_1.execFileSync)('powershell.exe', args, { encoding: 'utf-8', windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }) || '');
+    const stopped = [];
+    const errors = [];
+    for (const line of stdout.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const stoppedMatch = trimmed.match(/^stopped:(\d+)$/);
+        const errorMatch = trimmed.match(/^error:(\d+):(.*)$/);
+        if (stoppedMatch)
+            stopped.push(Number(stoppedMatch[1]));
+        else if (errorMatch)
+            errors.push(`PID ${errorMatch[1]}: ${errorMatch[2]}`);
+    }
+    return { stopped, errors };
+}
+function listInstalledNewmarkProducts() {
+    const rows = runPowerShellJson(`$paths = @('HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'); Get-ItemProperty $paths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like '*Newmark Agent*' } | Select-Object PSChildName,DisplayName,InstallLocation,UninstallString,QuietUninstallString | ConvertTo-Json -Compress`);
+    return rows
+        .map(row => ({
+        productCode: String(row.PSChildName || ''),
+        displayName: String(row.DisplayName || ''),
+        installLocation: String(row.InstallLocation || ''),
+        uninstallString: String(row.UninstallString || row.QuietUninstallString || ''),
+    }))
+        .filter(product => product.productCode);
+}
+function runMsiExec(args) {
+    const result = (0, child_process_1.spawnSync)('msiexec.exe', args, { encoding: 'utf-8', windowsHide: true });
+    return {
+        exitCode: result.status === null ? -1 : result.status,
+        stdout: String(result.stdout || ''),
+        stderr: String(result.stderr || ''),
+    };
+}
+function windowsCommandQuote(value) {
+    const text = String(value);
+    return /\s/.test(text) ? `"${text.replace(/"/g, '\\"')}"` : text;
+}
+function runElevatedMsiExec(args) {
+    const argumentString = args.map(arg => windowsCommandQuote(arg)).join(' ');
+    const script = [
+        `$argumentList = '${argumentString.replace(/'/g, "''")}'`,
+        '$process = Start-Process -FilePath "msiexec.exe" -ArgumentList $argumentList -Verb RunAs -Wait -PassThru',
+        'Write-Output ("EXITCODE:" + $process.ExitCode)',
+    ].join('; ');
+    const result = (0, child_process_1.spawnSync)('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script], { encoding: 'utf-8', windowsHide: true });
+    const stdout = String(result.stdout || '');
+    const match = stdout.match(/EXITCODE:(\d+)/);
+    return {
+        exitCode: match ? Number(match[1]) : (result.status === null ? -1 : result.status),
+        stdout,
+        stderr: String(result.stderr || ''),
+    };
+}
+function uninstallNewmarkProduct(productCode, logPath) {
+    const args = ['/x', productCode, '/qn', '/norestart', '/l*v', logPath];
+    let result = runMsiExec(args);
+    if (result.exitCode !== 0)
+        result = runElevatedMsiExec(args);
+    return {
+        ok: result.exitCode === 0,
+        exitCode: result.exitCode,
+        logPath,
+        error: result.exitCode === 0 ? undefined : `msiexec uninstall exited ${result.exitCode}`,
+    };
+}
+function installMsiPackage(msiPath, options = {}) {
+    const logPath = path.join(options.logDir || os.tmpdir(), `newmark-msi-install-${process.pid}-${Date.now()}.log`);
+    const args = ['/i', path.resolve(msiPath), '/qn', '/norestart', '/l*v', logPath];
+    let result = runMsiExec(args);
+    if (result.exitCode !== 0 && options.allowElevate !== false)
+        result = runElevatedMsiExec(args);
+    return {
+        ok: result.exitCode === 0,
+        exitCode: result.exitCode,
+        logPath,
+        error: result.exitCode === 0 ? undefined : `msiexec install exited ${result.exitCode}`,
+    };
+}
+function findLegacyNewmarkExecutables(excludeRoots = []) {
+    const found = new Map();
+    for (const name of NEWMARK_PROCESS_NAMES) {
+        try {
+            const stdout = String((0, child_process_1.execFileSync)('where.exe', [name], { encoding: 'utf-8', windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }) || '');
+            for (const line of stdout.split(/\r?\n/)) {
+                const candidate = String(line || '').trim();
+                if (!candidate)
+                    continue;
+                const key = normalizeWindowsPathForCompare(candidate);
+                if (NEWMARK_LEGACY_EXECUTABLES.has(path.basename(candidate).toLowerCase()) && !found.has(key))
+                    found.set(key, candidate);
+            }
+        }
+        catch {
+            // where.exe returns non-zero when an executable is not found on PATH.
+        }
+    }
+    const exclude = (excludeRoots || []).filter(Boolean).map(root => normalizeWindowsPathForCompare(root));
+    return Array.from(found.values())
+        .filter(candidate => !exclude.some(root => isWithinOrEqual(candidate, root)))
+        .sort();
+}
+function removeLegacyNewmarkExecutables(paths) {
+    const removed = [];
+    const errors = [];
+    for (const candidate of Array.from(new Set(paths || []))) {
+        const full = path.resolve(candidate);
+        if (!NEWMARK_LEGACY_EXECUTABLES.has(path.basename(full).toLowerCase())) {
+            errors.push(`refusing non-Newmark executable: ${full}`);
+            continue;
+        }
+        try {
+            fs.unlinkSync(full);
+            removed.push(full);
+        }
+        catch (e) {
+            errors.push(`${full}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    return { removed, errors };
+}
+function planManagedMsiInstall(msiPath, options = {}) {
+    const fullPath = path.resolve(msiPath);
+    try {
+        if (!fs.existsSync(fullPath) || !fs.statSync(fullPath).isFile() || path.extname(fullPath).toLowerCase() !== '.msi') {
+            return {
+                ok: false,
+                msiPath: fullPath,
+                runningProcesses: [],
+                installedProducts: [],
+                legacyExecutables: [],
+                needsStopConfirmation: false,
+                needsLegacyRemovalConfirmation: false,
+                error: `MSI package does not exist or is not a .msi file: ${fullPath}`,
+            };
+        }
+        const runningProcesses = listRunningNewmarkProcesses();
+        const installedProducts = listInstalledNewmarkProducts();
+        const excludeRoots = [
+            ...(options.excludeRoots || []),
+            process.cwd(),
+            path.dirname(process.execPath || ''),
+            path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Newmark Agent'),
+            path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Newmark Agent'),
+            ...installedProducts.map(product => product.installLocation),
+        ];
+        const legacyExecutables = findLegacyNewmarkExecutables(excludeRoots);
+        return {
+            ok: true,
+            msiPath: fullPath,
+            runningProcesses,
+            installedProducts,
+            legacyExecutables,
+            needsStopConfirmation: runningProcesses.length > 0 && options.stopConfirmed !== true,
+            needsLegacyRemovalConfirmation: legacyExecutables.length > 0 && options.removeLegacyConfirmed !== true,
+        };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            msiPath: fullPath,
+            runningProcesses: [],
+            installedProducts: [],
+            legacyExecutables: [],
+            needsStopConfirmation: false,
+            needsLegacyRemovalConfirmation: false,
+            error: e instanceof Error ? e.message : String(e),
+        };
+    }
+}
+function executeManagedMsiInstall(msiPath, options = {}) {
+    const plan = planManagedMsiInstall(msiPath, options);
+    if (!plan.ok) {
+        return { ok: false, plan, stopped: [], uninstalled: [], removedLegacy: [], error: plan.error };
+    }
+    if (plan.needsStopConfirmation) {
+        return { ok: false, plan, stopped: [], uninstalled: [], removedLegacy: [], error: 'Running Newmark processes require confirmation before they can be stopped.' };
+    }
+    if (plan.needsLegacyRemovalConfirmation) {
+        return { ok: false, plan, stopped: [], uninstalled: [], removedLegacy: [], error: 'Legacy Newmark executables require confirmation before they can be removed.' };
+    }
+    const stopResult = plan.runningProcesses.length
+        ? stopNewmarkProcesses(plan.runningProcesses.map(process => process.pid))
+        : { stopped: [], errors: [] };
+    const uninstalled = [];
+    if (options.uninstallPrevious !== false) {
+        for (const product of plan.installedProducts) {
+            const logPath = path.join(options.logDir || os.tmpdir(), `newmark-msi-uninstall-${product.productCode}-${process.pid}-${Date.now()}.log`);
+            const uninstallResult = uninstallNewmarkProduct(product.productCode, logPath);
+            if (!uninstallResult.ok) {
+                return {
+                    ok: false,
+                    plan,
+                    stopped: stopResult.stopped,
+                    uninstalled,
+                    removedLegacy: [],
+                    exitCode: uninstallResult.exitCode,
+                    logPath: uninstallResult.logPath,
+                    error: `Failed to uninstall previous Newmark version ${product.productCode}: ${uninstallResult.error}`,
+                };
+            }
+            uninstalled.push(product.productCode);
+        }
+    }
+    const removeResult = plan.legacyExecutables.length
+        ? removeLegacyNewmarkExecutables(plan.legacyExecutables)
+        : { removed: [], errors: [] };
+    const installResult = installMsiPackage(plan.msiPath, { logDir: options.logDir, allowElevate: options.allowElevate });
+    return {
+        ok: installResult.ok,
+        plan,
+        stopped: stopResult.stopped,
+        uninstalled,
+        removedLegacy: removeResult.removed,
+        exitCode: installResult.exitCode,
+        logPath: installResult.logPath,
+        error: installResult.error,
+    };
+}
 //# sourceMappingURL=installUpdate.js.map

package/dist/core/mobilePairing.d.ts

@@ -0,0 +1,46 @@
+export declare const MOBILE_TOKEN_FILENAME = ".newmark-mobile-token";
+export declare const MOBILE_PAIRING_FILENAME = ".newmark-mobile-pairing.json";
+export declare const MOBILE_PORT = 47890;
+export declare const MOBILE_PAIRING_TTL_MS = 120000;
+export interface PairingSession {
+    pairingId: string;
+    token: string;
+    host: string;
+    hostname: string;
+    port: number;
+    issuedAt: number;
+    expiresAt: number;
+    url: string;
+    confirmed?: boolean;
+    confirmedAt?: number;
+}
+export interface PairingStatus {
+    pairingId: string;
+    issuedAt: number;
+    expiresAt: number;
+    confirmed: boolean;
+    confirmedAt: number;
+    active: boolean;
+    expired: boolean;
+}
+export declare function ensureMobileToken(root: string): string;
+export declare function tailscaleIpv4(): string | null;
+export declare function pairingHost(): string;
+export declare function createPairingSession(root: string, ttlMs?: number): PairingSession;
+export declare function pairingUrl(root: string): string;
+export declare function pairingTokenPath(root: string): string;
+export declare function pairingStatus(root: string): PairingStatus;
+export declare function confirmPairing(root: string, pairingId: string, token: string): {
+    ok: boolean;
+    error?: string;
+    status: PairingStatus;
+};
+export declare function pairingQrDataUrl(root: string, ttlMs?: number): Promise<{
+    dataUrl: string;
+    session: PairingSession;
+}>;
+export declare function pairingQrAscii(root: string, ttlMs?: number): Promise<{
+    ascii: string;
+    session: PairingSession;
+}>;
+//# sourceMappingURL=mobilePairing.d.ts.map

package/dist/core/mobilePairing.js

@@ -0,0 +1,207 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MOBILE_PAIRING_TTL_MS = exports.MOBILE_PORT = exports.MOBILE_PAIRING_FILENAME = exports.MOBILE_TOKEN_FILENAME = void 0;
+exports.ensureMobileToken = ensureMobileToken;
+exports.tailscaleIpv4 = tailscaleIpv4;
+exports.pairingHost = pairingHost;
+exports.createPairingSession = createPairingSession;
+exports.pairingUrl = pairingUrl;
+exports.pairingTokenPath = pairingTokenPath;
+exports.pairingStatus = pairingStatus;
+exports.confirmPairing = confirmPairing;
+exports.pairingQrDataUrl = pairingQrDataUrl;
+exports.pairingQrAscii = pairingQrAscii;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const QRCode = __importStar(require("qrcode"));
+exports.MOBILE_TOKEN_FILENAME = '.newmark-mobile-token';
+exports.MOBILE_PAIRING_FILENAME = '.newmark-mobile-pairing.json';
+exports.MOBILE_PORT = 47890;
+exports.MOBILE_PAIRING_TTL_MS = 120_000;
+function pairingStatePath(root) {
+    return path.join(root, exports.MOBILE_PAIRING_FILENAME);
+}
+function readPairingState(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(pairingStatePath(root), 'utf-8'));
+        if (!parsed || !parsed.pairingId || !parsed.token)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function writePairingState(root, state) {
+    fs.mkdirSync(root, { recursive: true });
+    fs.writeFileSync(pairingStatePath(root), JSON.stringify(state, null, 2), 'utf-8');
+}
+function ensureMobileToken(root) {
+    const tokenPath = path.join(root, exports.MOBILE_TOKEN_FILENAME);
+    try {
+        const existing = fs.readFileSync(tokenPath, 'utf-8').replace(/\s+/g, '').trim();
+        if (existing.length >= 32)
+            return existing;
+    }
+    catch {
+        // first start: no token file yet
+    }
+    const generated = (0, crypto_1.randomBytes)(24).toString('hex');
+    try {
+        fs.mkdirSync(root, { recursive: true });
+        fs.writeFileSync(tokenPath, generated, { encoding: 'utf-8', mode: 0o600 });
+    }
+    catch {
+        // keep the generated token for this process even if persistence fails
+    }
+    return generated;
+}
+function tailscaleIpv4() {
+    const exe = process.platform === 'win32' ? 'tailscale.exe' : 'tailscale';
+    try {
+        const result = (0, child_process_1.spawnSync)(exe, ['ip', '-4'], { encoding: 'utf-8', windowsHide: true, timeout: 3000 });
+        if (result.error || result.status !== 0)
+            return null;
+        const lines = String(result.stdout || '').split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+        return lines[0] || null;
+    }
+    catch {
+        return null;
+    }
+}
+function pairingHost() {
+    return tailscaleIpv4() || '127.0.0.1';
+}
+function buildPairingUrl(session) {
+    const query = new URLSearchParams({
+        token: session.token,
+        host: session.hostname,
+        port: String(session.port),
+        pairingId: session.pairingId,
+        issuedAt: String(session.issuedAt),
+        expiresAt: String(session.expiresAt),
+    });
+    return `newmark-pair://${session.host}:${session.port}?${query.toString()}`;
+}
+function createPairingSession(root, ttlMs = exports.MOBILE_PAIRING_TTL_MS) {
+    const token = ensureMobileToken(root);
+    const host = pairingHost();
+    const now = Date.now();
+    const session = {
+        pairingId: (0, crypto_1.randomBytes)(12).toString('hex'),
+        token,
+        host,
+        hostname: os.hostname(),
+        port: exports.MOBILE_PORT,
+        issuedAt: now,
+        expiresAt: now + Math.max(1000, Number(ttlMs) || exports.MOBILE_PAIRING_TTL_MS),
+        url: '',
+        confirmed: false,
+        confirmedAt: 0,
+    };
+    session.url = buildPairingUrl(session);
+    writePairingState(root, session);
+    return session;
+}
+function pairingUrl(root) {
+    return createPairingSession(root).url;
+}
+function pairingTokenPath(root) {
+    return path.join(root, exports.MOBILE_TOKEN_FILENAME);
+}
+function pairingStatus(root) {
+    const state = readPairingState(root);
+    if (!state) {
+        return { pairingId: '', issuedAt: 0, expiresAt: 0, confirmed: false, confirmedAt: 0, active: false, expired: true };
+    }
+    const now = Date.now();
+    const confirmed = state.confirmed === true;
+    const expired = now >= Number(state.expiresAt || 0);
+    return {
+        pairingId: state.pairingId,
+        issuedAt: Number(state.issuedAt || 0),
+        expiresAt: Number(state.expiresAt || 0),
+        confirmed,
+        confirmedAt: Number(state.confirmedAt || 0),
+        active: !confirmed && !expired,
+        expired: !confirmed && expired,
+    };
+}
+function confirmPairing(root, pairingId, token) {
+    const state = readPairingState(root);
+    const status = pairingStatus(root);
+    if (!state || !state.pairingId) {
+        return { ok: false, error: 'No pairing window is active.', status };
+    }
+    if (state.token !== token) {
+        return { ok: false, error: 'Pairing token does not match.', status };
+    }
+    if (state.pairingId !== pairingId) {
+        return { ok: false, error: 'Pairing window is stale.', status };
+    }
+    if (status.expired) {
+        return { ok: false, error: 'Pairing window expired.', status };
+    }
+    if (status.confirmed) {
+        return { ok: true, status };
+    }
+    const updated = { ...state, confirmed: true, confirmedAt: Date.now() };
+    writePairingState(root, updated);
+    return { ok: true, status: pairingStatus(root) };
+}
+async function pairingQrDataUrl(root, ttlMs) {
+    const session = createPairingSession(root, ttlMs);
+    const dataUrl = await QRCode.toDataURL(session.url, {
+        width: 420,
+        margin: 1,
+        errorCorrectionLevel: 'M',
+        color: { dark: '#101828', light: '#FFFFFF' },
+    });
+    return { dataUrl, session };
+}
+async function pairingQrAscii(root, ttlMs) {
+    const session = createPairingSession(root, ttlMs);
+    const ascii = await QRCode.toString(session.url, {
+        type: 'terminal',
+        small: true,
+        errorCorrectionLevel: 'M',
+    });
+    return { ascii, session };
+}
+//# sourceMappingURL=mobilePairing.js.map

package/dist/core/toolPolicy.js

@@ -181,21 +181,21 @@ function deletionVerbCount(text) {
     const matches = text.match(new RegExp(DELETE_VERB_BOUNDARY.source, 'gi'));
     return matches ? matches.length : 0;
 }
-/** 循环结构批量删除：foreach / for…in / for( / while( / bash do…done。 */
+/** 循环结构批量删除：foreach / for…in / for( / CMD for…do del / while( / bash do…done。 */
 function hasLoopDeletion(text) {
     const lower = text.toLowerCase();
     if (/\bforeach\b/.test(lower))
-        return true; // PowerShell foreach
+        return true; // PowerShell foreach / ForEach-Object
     if (/\bfor\b\s*[$({]/.test(lower))
-        return true; // PowerShell/C for(...)
+        return true; // PowerShell/C/bash for(...)
     if (/\bfor\b\s+\S+\s+in\b/.test(lower))
-        return true; // bash for f in ...
+        return true; // bash for f in ... / CMD for %f in (...)
+    if (/\bfor\b[^\n;&|]*\bdo\b[^\n;&|]*\b(?:del|rm|erase|remove-item|ri)\b/.test(lower))
+        return true; // CMD for ... do del
     if (/\bwhile\b\s*[({]/.test(lower))
         return true; // while(...)
     if (/\bwhile\b\s+\S/.test(lower) && /\bdo\b/.test(lower))
         return true; // bash while ... do
-    if (/\bdone\b/.test(lower))
-        return true; // bash 循环结束标记
     return false;
 }
 /** find -delete / find -exec rm / xargs rm 批量删除。 */
@@ -206,6 +206,17 @@ function hasFindXargsDeletion(text) {
         return true;
     return false;
 }
+/** git clean（非 dry-run）删除未跟踪文件 = 批量删除；`-n` / `--dry-run` 只预览放行。 */
+function hasGitCleanDeletion(text) {
+    const lower = text.toLowerCase();
+    if (!/\bgit\b\s+clean\b/.test(lower))
+        return false;
+    if (/(?:^|\s)-[a-z]*n[a-z]*(?:\s|$)/.test(lower))
+        return false;
+    if (/(?:^|\s)--dry-run(?:\s|$)/.test(lower))
+        return false;
+    return true;
+}
 /** 按 shell 语义切分参数：引号内的空格不拆分，返回去引号后的 token。 */
 function splitCommandArgs(args) {
     const tokens = [];
@@ -218,20 +229,20 @@ function splitCommandArgs(args) {
     }
     return tokens;
 }
-/** 管道接收端删除：上游产出多项，删除动词作为接收端即批量删除。 */
+/** 管道接收端删除：上游产出多项，删除动词作为接收端即批量删除。`||`（逻辑或）不是管道。 */
 function hasPipeDeletion(text) {
-    return new RegExp(`\\|\\s*${DELETE_VERB_SOURCE}\\b`, 'i').test(text);
+    return /(?<!\|)\|\s*(?:remove-item|rmdir|unlink|erase|del|rm|rd|ri)\b/i.test(text);
 }
-/** 递归删除标志：rm -r/-R/--recursive、Remove-Item -Recurse、rmdir/rd /s、del /s。 */
+/** 递归删除标志：rm -r/-R/--recursive、Remove-Item/ri -Recurse、rmdir/rd /s、del/erase /s。 */
 function hasRecursiveDeletionFlag(text) {
     const lower = text.toLowerCase();
     if (/\brm\b\s+(-[a-z]*r[a-z]*|--recursive)\b/.test(lower))
         return true;
-    if (/\bremove-item\b[^\n;&|]*\s+-(?:recurse|r)\b/.test(lower))
+    if (/\b(?:remove-item|ri)\b[^\n;&|]*\s+-(?:recurse|r)\b/.test(lower))
         return true;
     if (/\b(?:rmdir|rd)\b\s+(-r\b|\/[s]\b)/.test(lower))
         return true;
-    if (/\bdel\b\s+\/[s]\b/.test(lower))
+    if (/\b(?:del|erase)\b\s+\/[s]\b/.test(lower))
         return true;
     return false;
 }
@@ -271,9 +282,11 @@ function evaluateDeletionGuard(command) {
     const text = String(command || '');
     if (!text.trim())
         return { blocked: false };
-    // find -delete / find -exec rm 中，-delete 不含标准删除动词，需在入口单独识别为批量删除意图。
+    // find -delete / find -exec rm 中，-delete 不含标准删除动词；git clean 也不含删除动词，
+    // 均需在入口单独识别为批量删除意图。
     const findXargs = hasFindXargsDeletion(text);
-    if (!hasDeletionVerb(text) && !findXargs)
+    const gitClean = hasGitCleanDeletion(text);
+    if (!hasDeletionVerb(text) && !findXargs && !gitClean)
         return { blocked: false };
     const refuse = (kind) => ({
         blocked: true,
@@ -283,6 +296,8 @@ function evaluateDeletionGuard(command) {
         return refuse('Loop-based');
     if (findXargs)
         return refuse('find/xargs');
+    if (gitClean)
+        return refuse('git-clean');
     if (hasPipeDeletion(text))
         return refuse('Pipe-fed');
     if (hasRecursiveDeletionFlag(text))

package/dist/core/workspace.d.ts

@@ -21,6 +21,12 @@ export interface WorkspaceManagerOptions {
     /** Runtime workers receive an explicit workspace target and must not rewrite the shared registry. */
     detached?: boolean;
 }
+/**
+ * 把 Windows 盘符路径（`C:\...` / `C:/...`）转换为 WSL/Linux 挂载路径
+ * （`/mnt/c/...`）。非 Windows 盘符路径返回空字符串，由调用方决定回退。
+ * 纯函数、无 I/O：WSL 运行时文件工具与 bash 都依赖它做跨环境归一。
+ */
+export declare function windowsDrivePathToPosix(input: string): string;
 /** Normalize persisted Windows/WSL aliases and recover paths damaged by cross-host path.resolve calls. */
 export declare function normalizeHostWorkspacePath(input: string, platform?: NodeJS.Platform): string;
 /**

package/dist/core/workspace.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WorkspaceManager = void 0;
+exports.windowsDrivePathToPosix = windowsDrivePathToPosix;
 exports.normalizeHostWorkspacePath = normalizeHostWorkspacePath;
 exports.isProtectedInstallWorkspacePath = isProtectedInstallWorkspacePath;
 const fs = __importStar(require("fs"));
@@ -46,6 +47,19 @@ function lastEmbeddedWindowsPath(input) {
         lastIndex = match.index;
     return lastIndex >= 0 ? input.slice(lastIndex) : '';
 }
+/**
+ * 把 Windows 盘符路径（`C:\...` / `C:/...`）转换为 WSL/Linux 挂载路径
+ * （`/mnt/c/...`）。非 Windows 盘符路径返回空字符串，由调用方决定回退。
+ * 纯函数、无 I/O：WSL 运行时文件工具与 bash 都依赖它做跨环境归一。
+ */
+function windowsDrivePathToPosix(input) {
+    const raw = String(input || '').trim();
+    const drive = /^([A-Za-z]):[\\/](.*)$/.exec(raw);
+    if (!drive)
+        return '';
+    const rest = drive[2].replace(/\\/g, '/').replace(/^\/+/, '');
+    return `/mnt/${drive[1].toLowerCase()}/${rest}`;
+}
 /** Normalize persisted Windows/WSL aliases and recover paths damaged by cross-host path.resolve calls. */
 function normalizeHostWorkspacePath(input, platform = process.platform) {
     const raw = String(input || '').trim();