oasis_test 0.1.89 → 0.1.91

package/dist/index.js

@@ -6001,6 +6001,13 @@ var init_dispatcher = __esm({
        * 是否相对本会话推进过**（上游产新版才动 pin，天然排除驳回/人类改单）。运行时态、不进 oplog/重放，
        * 与 inFlight 同生同灭。 */
       inFlightPins = /* @__PURE__ */ new Map();
+      /**
+       * 本次会话的凭据清理器，与 inFlight 同生同灭。
+       * **必须在「只有槽位主人才能解锁」那个守卫里调**（见 handleSessionExit）——
+       * 无差别调用 = 拿僵尸会话的死讯删掉**活会话正在用的** creds 文件，
+       * 那比不清理更糟：活着的 agent 下一次 `gh` 就炸，且现场看起来像凭据凭空消失。
+       */
+      inFlightCleanup = /* @__PURE__ */ new Map();
       /** ADR-0094：本会话已确认不支持原生 append（codex/subprocess 远端报 unsupported，或会话在收尾）——
        *  停投，回落"等会话退出 + fresh 重派"。与 inFlight 同生同灭。 */
       appendSkip = /* @__PURE__ */ new Set();
@@ -6934,6 +6941,8 @@ var init_dispatcher = __esm({
           ...Object.keys(jobEnv).length > 0 ? { env: jobEnv } : {},
           ...provisioned?.wrapperPaths && provisioned.wrapperPaths.length > 0 ? { wrapperPaths: provisioned.wrapperPaths } : {},
           ...provisioned?.requiredTools && provisioned.requiredTools.length > 0 ? { requiredTools: provisioned.requiredTools } : {},
+          // 凭据本体随 job 下发，供**节点侧本机注入**（见上方 provision 注释）。
+          ...provisioned?.connectorCreds && provisioned.connectorCreds.length > 0 ? { connectorCreds: provisioned.connectorCreds } : {},
           // ADR-0078 D1/D3：把本次派发的 id 交给 adapter 当 handle.id——于是
           // `handle.id` = `agent_runs.id` = token 的 dispatchId claim，三处同值。
           dispatchId: attempt
@@ -6965,6 +6974,7 @@ var init_dispatcher = __esm({
         }
         this.inFlight.set(jobKey, session);
         this.inFlightActor.set(jobKey, dispatchSpec.actor);
+        if (provisioned?.cleanup) this.inFlightCleanup.set(jobKey, provisioned.cleanup);
         const dispatchedAtMs = Date.now();
         this.inFlightStartedAt.set(jobKey, dispatchedAtMs);
         const seqAtDispatch = seqNow;
@@ -7059,6 +7069,12 @@ var init_dispatcher = __esm({
           this.inFlightStartedAt.delete(jobKey);
           this.inFlightPins.delete(jobKey);
           this.appendSkip.delete(jobKey);
+          const cleanup = this.inFlightCleanup.get(jobKey);
+          if (cleanup) {
+            this.inFlightCleanup.delete(jobKey);
+            void cleanup().catch(() => {
+            });
+          }
         }
         const seqAtExit = kernel.model.lastSeq.get(spec.artifactId) ?? 0;
         const exitSessionKey = this.produceSessionKeyFor(spec);
@@ -142160,14 +142176,48 @@ async function prepareConnectorsForJob(job, deps) {
   }
   const keptLocal = localWrappers.filter((p2) => isStagedWrapperUsable(p2));
   const keptRemote = remoteWrappers.filter((p2) => (0, import_node_fs5.existsSync)(p2));
-  const dropped = remoteWrappers.length - keptRemote.length + (localWrappers.length - keptLocal.length);
-  if (dropped > 0) log("[node-connectors]", `\u4E22\u5F03 ${dropped} \u6761\u672C\u673A\u4E0D\u53EF\u7528\u7684 wrapper \u8DEF\u5F84`);
+  const droppedWrappers = remoteWrappers.length - keptRemote.length + (localWrappers.length - keptLocal.length);
+  if (droppedWrappers > 0) log("[node-connectors]", `\u4E22\u5F03 ${droppedWrappers} \u6761\u672C\u673A\u4E0D\u53EF\u7528\u7684 wrapper \u8DEF\u5F84`);
+  const staleKeys = /* @__PURE__ */ new Set();
+  const isolationKeys = /* @__PURE__ */ new Set();
+  for (const connector of createAllConnectors()) {
+    if (injected.has(connector.config.slug)) continue;
+    const isolation = new Set(connector.hostCredentialIsolationEnvKeys ?? []);
+    for (const key of connector.injectedEnvKeys) {
+      if (isolation.has(key)) isolationKeys.add(key);
+      else staleKeys.add(key);
+    }
+  }
   const basePath = job.env?.["PATH"] ?? process.env["PATH"] ?? "";
   const toolsBin = connectorToolsBinDir();
   const pathWithTools = basePath.split(":").includes(toolsBin) ? basePath : [toolsBin, basePath].filter(Boolean).join(":");
+  const jobEnv = { ...job.env ?? {}, ...envOverrides, PATH: pathWithTools };
+  let dropped = 0;
+  for (const key of staleKeys) {
+    if (jobEnv[key] === void 0) continue;
+    delete jobEnv[key];
+    dropped++;
+  }
+  if (isolationKeys.size > 0) {
+    const isolationRoot = await (0, import_promises6.mkdtemp)((0, import_node_path9.join)((0, import_node_os5.tmpdir)(), "oasis-node-isolate-"));
+    for (const key of isolationKeys) {
+      const dir = (0, import_node_path9.join)(isolationRoot, key.toLowerCase());
+      await (0, import_promises6.mkdir)(dir, { recursive: true, mode: 448 });
+      jobEnv[key] = dir;
+    }
+    cleanups.push(async () => {
+      await (0, import_promises6.rm)(isolationRoot, { recursive: true, force: true });
+    });
+  }
+  if (dropped > 0) {
+    log(
+      "[node-connectors]",
+      `\u26A0 \u6E05\u6389 ${dropped} \u4E2A\u6307\u5411\u522B\u7684\u673A\u5668\u7684\u8FDE\u63A5\u5668 env \u952E\uFF08server \u53D1\u4E86\u6307\u9488\u4F46\u6CA1\u53D1\u51ED\u636E\uFF09\u2014\u2014\u672C\u8F6E\u8FD9\u4E9B\u8FDE\u63A5\u5668**\u4E0D\u53EF\u7528**\uFF0Cagent \u5E94\u636E\u6B64\u5224\u5B9A\u300C\u6CA1\u6709\u8BE5\u80FD\u529B\u300D\uFF0C\u800C\u4E0D\u662F\u4EE5\u4E3A\u914D\u597D\u4E86\u3002`
+    );
+  }
   const preparedJob = {
     ...job,
-    env: { ...job.env ?? {}, ...envOverrides, PATH: pathWithTools },
+    env: jobEnv,
     wrapperPaths: [...keptLocal, ...keptRemote]
   };
   if (injected.size > 0 && (job.limits?.wallClockMs ?? 0) > SESSION_CREDENTIAL_RENEW_INTERVAL_MS) {
@@ -142225,11 +142275,14 @@ function fetchCredentialsFromServer(job) {
     return body.connectorCreds ?? [];
   };
 }
-var import_node_fs5, SESSION_CREDENTIAL_RENEW_INTERVAL_MS;
+var import_node_fs5, import_promises6, import_node_os5, import_node_path9, SESSION_CREDENTIAL_RENEW_INTERVAL_MS;
 var init_prepare_job = __esm({
   "../connectors/src/prepare-job.ts"() {
     "use strict";
     import_node_fs5 = require("node:fs");
+    import_promises6 = require("node:fs/promises");
+    import_node_os5 = require("node:os");
+    import_node_path9 = require("node:path");
     init_base();
     init_registry2();
     init_logger();
@@ -142572,8 +142625,8 @@ function materializeFiles(dir, files) {
   if (!files) return;
   for (const [rel, content] of Object.entries(files)) {
     try {
-      const file = import_node_path9.default.join(dir, rel);
-      import_node_fs6.default.mkdirSync(import_node_path9.default.dirname(file), { recursive: true });
+      const file = import_node_path10.default.join(dir, rel);
+      import_node_fs6.default.mkdirSync(import_node_path10.default.dirname(file), { recursive: true });
       import_node_fs6.default.writeFileSync(file, content);
     } catch {
     }
@@ -142589,7 +142642,7 @@ function resolveLegacyWorkRoot(workRoot) {
   if (workRoot) return workRoot;
   const env = process.env["OASIS_WORK_ROOT"];
   if (env) return env;
-  return import_node_os5.default.tmpdir();
+  return import_node_os6.default.tmpdir();
 }
 function resolveWorkRoots(workRoot) {
   return { workRoot: resolveWorkRoot(workRoot), legacyRoot: resolveLegacyWorkRoot(workRoot) };
@@ -142600,7 +142653,7 @@ function slug5(workdirKey) {
   return `${safe}-${h}`;
 }
 function sessionDirFor(workRoot, runtimeKind, workdirKey) {
-  return import_node_path9.default.join(resolveWorkRoot(workRoot), "sessions", runtimeKind, slug5(workdirKey));
+  return import_node_path10.default.join(resolveWorkRoot(workRoot), "sessions", runtimeKind, slug5(workdirKey));
 }
 function sessionDirKind(runtimeKind) {
   return runtimeKind === "claude-code" ? "claude" : runtimeKind;
@@ -142613,20 +142666,20 @@ function resolveSessionDirWithLegacy(args) {
   return import_node_fs6.default.existsSync(legacy) ? legacy : fresh;
 }
 function oneShotDirFor(workRoot, runtimeKind) {
-  const base = import_node_path9.default.join(resolveWorkRoot(workRoot), "tmp");
+  const base = import_node_path10.default.join(resolveWorkRoot(workRoot), "tmp");
   import_node_fs6.default.mkdirSync(base, { recursive: true });
-  return import_node_fs6.default.mkdtempSync(import_node_path9.default.join(base, `${runtimeKind}-`));
+  return import_node_fs6.default.mkdtempSync(import_node_path10.default.join(base, `${runtimeKind}-`));
 }
 function writeMeta(dir, meta) {
   try {
-    import_node_fs6.default.writeFileSync(import_node_path9.default.join(dir, META_FILE), `${JSON.stringify(meta, null, 2)}
+    import_node_fs6.default.writeFileSync(import_node_path10.default.join(dir, META_FILE), `${JSON.stringify(meta, null, 2)}
 `);
   } catch {
   }
 }
 function readMeta(dir) {
   try {
-    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path9.default.join(dir, META_FILE), "utf8"));
+    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path10.default.join(dir, META_FILE), "utf8"));
     if (!raw || typeof raw !== "object") return null;
     const m2 = raw;
     return typeof m2.kind === "string" && typeof m2.createdAt === "string" ? m2 : null;
@@ -142655,14 +142708,14 @@ function lockWorkdir(dir, pid, holder, workdirKey) {
     ...workdirKey !== void 0 ? { workdirKey } : {}
   };
   try {
-    import_node_fs6.default.writeFileSync(import_node_path9.default.join(dir, LOCK_FILE), `${JSON.stringify(lock)}
+    import_node_fs6.default.writeFileSync(import_node_path10.default.join(dir, LOCK_FILE), `${JSON.stringify(lock)}
 `);
   } catch {
   }
 }
 function readLock(dir) {
   try {
-    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path9.default.join(dir, LOCK_FILE), "utf8"));
+    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path10.default.join(dir, LOCK_FILE), "utf8"));
     if (!raw || typeof raw !== "object") return null;
     const l = raw;
     return Number.isInteger(l.pid) && l.pid > 0 ? l : null;
@@ -142672,14 +142725,14 @@ function readLock(dir) {
 }
 function unlockWorkdir(dir) {
   try {
-    import_node_fs6.default.unlinkSync(import_node_path9.default.join(dir, LOCK_FILE));
+    import_node_fs6.default.unlinkSync(import_node_path10.default.join(dir, LOCK_FILE));
   } catch {
   }
 }
 function isWorkdirLive(dir) {
   let raw;
   try {
-    raw = import_node_fs6.default.readFileSync(import_node_path9.default.join(dir, LOCK_FILE), "utf8");
+    raw = import_node_fs6.default.readFileSync(import_node_path10.default.join(dir, LOCK_FILE), "utf8");
   } catch {
     return false;
   }
@@ -142696,7 +142749,7 @@ function clearWorkdir(dir) {
     );
   }
   for (const entry of import_node_fs6.default.readdirSync(dir)) {
-    import_node_fs6.default.rmSync(import_node_path9.default.join(dir, entry), { recursive: true, force: true });
+    import_node_fs6.default.rmSync(import_node_path10.default.join(dir, entry), { recursive: true, force: true });
   }
 }
 function prepareWorkdir(args) {
@@ -142726,19 +142779,19 @@ function prepareWorkdir(args) {
   return dir;
 }
 function legacyChatSessionDir(workRoot, rtId) {
-  return import_node_path9.default.join(resolveLegacyWorkRoot(workRoot), "oasis-chat-sessions", rtId.replace(/[^a-zA-Z0-9_-]+/g, "_"));
+  return import_node_path10.default.join(resolveLegacyWorkRoot(workRoot), "oasis-chat-sessions", rtId.replace(/[^a-zA-Z0-9_-]+/g, "_"));
 }
-var import_node_crypto9, import_node_fs6, import_node_os5, import_node_path9, META_FILE, LOCK_FILE, NEW_WORK_ROOT, LEGACY_ROOTS, LEGACY_ONESHOT_PREFIX;
+var import_node_crypto9, import_node_fs6, import_node_os6, import_node_path10, META_FILE, LOCK_FILE, NEW_WORK_ROOT, LEGACY_ROOTS, LEGACY_ONESHOT_PREFIX;
 var init_session_paths = __esm({
   "../adapters/src/_core/session-paths.ts"() {
     "use strict";
     import_node_crypto9 = require("node:crypto");
     import_node_fs6 = __toESM(require("node:fs"), 1);
-    import_node_os5 = __toESM(require("node:os"), 1);
-    import_node_path9 = __toESM(require("node:path"), 1);
+    import_node_os6 = __toESM(require("node:os"), 1);
+    import_node_path10 = __toESM(require("node:path"), 1);
     META_FILE = ".oasis-meta.json";
     LOCK_FILE = ".oasis-lock";
-    NEW_WORK_ROOT = () => import_node_path9.default.join(import_node_os5.default.homedir(), ".oasis", "work");
+    NEW_WORK_ROOT = () => import_node_path10.default.join(import_node_os6.default.homedir(), ".oasis", "work");
     LEGACY_ROOTS = ["oasis-chat-sessions", "oasis-transcripts"];
     LEGACY_ONESHOT_PREFIX = "oasis-session-";
   }
@@ -143960,7 +144013,7 @@ async function discoverACPModels(bin, provider, args = ["acp"]) {
       clientCapabilities: {}
     });
     try {
-      tmpDir = (0, import_node_fs7.mkdtempSync)((0, import_node_path10.join)((0, import_node_os6.tmpdir)(), `oasis-acp-${provider}-`));
+      tmpDir = (0, import_node_fs7.mkdtempSync)((0, import_node_path11.join)((0, import_node_os7.tmpdir)(), `oasis-acp-${provider}-`));
     } catch {
       return fail();
     }
@@ -144016,14 +144069,14 @@ function parseACPSessionNewModels(result) {
 async function discoverOpenclawModels(bin) {
   throw new Error("discoverOpenclawModels: TODO");
 }
-var import_node_child_process9, import_node_fs7, import_node_os6, import_node_path10, modelCache, CACHE_TTL_MS;
+var import_node_child_process9, import_node_fs7, import_node_os7, import_node_path11, modelCache, CACHE_TTL_MS;
 var init_models = __esm({
   "../adapters/src/_core/models.ts"() {
     "use strict";
     import_node_child_process9 = require("node:child_process");
     import_node_fs7 = require("node:fs");
-    import_node_os6 = require("node:os");
-    import_node_path10 = require("node:path");
+    import_node_os7 = require("node:os");
+    import_node_path11 = require("node:path");
     modelCache = /* @__PURE__ */ new Map();
     CACHE_TTL_MS = 6e4;
   }
@@ -146590,7 +146643,7 @@ function dirSizeBytes(dir) {
       return;
     }
     for (const e of entries) {
-      const p2 = import_node_path11.default.join(d, e.name);
+      const p2 = import_node_path12.default.join(d, e.name);
       if (e.isSymbolicLink()) continue;
       if (e.isDirectory()) {
         walk(p2);
@@ -146607,40 +146660,40 @@ function dirSizeBytes(dir) {
 }
 function listWorkdirs(workRoot, legacyRoot) {
   const out = [];
-  const sessions = import_node_path11.default.join(workRoot, "sessions");
+  const sessions = import_node_path12.default.join(workRoot, "sessions");
   try {
     for (const kind of import_node_fs8.default.readdirSync(sessions)) {
-      const kindDir = import_node_path11.default.join(sessions, kind);
+      const kindDir = import_node_path12.default.join(sessions, kind);
       try {
-        for (const slug6 of import_node_fs8.default.readdirSync(kindDir)) out.push(import_node_path11.default.join(kindDir, slug6));
+        for (const slug6 of import_node_fs8.default.readdirSync(kindDir)) out.push(import_node_path12.default.join(kindDir, slug6));
       } catch {
       }
     }
   } catch {
   }
-  const tmp = import_node_path11.default.join(workRoot, "tmp");
+  const tmp = import_node_path12.default.join(workRoot, "tmp");
   try {
-    for (const d of import_node_fs8.default.readdirSync(tmp)) out.push(import_node_path11.default.join(tmp, d));
+    for (const d of import_node_fs8.default.readdirSync(tmp)) out.push(import_node_path12.default.join(tmp, d));
   } catch {
   }
   for (const legacy of LEGACY_ROOTS) {
-    const root = import_node_path11.default.join(legacyRoot, legacy);
+    const root = import_node_path12.default.join(legacyRoot, legacy);
     try {
-      for (const d of import_node_fs8.default.readdirSync(root)) out.push(import_node_path11.default.join(root, d));
+      for (const d of import_node_fs8.default.readdirSync(root)) out.push(import_node_path12.default.join(root, d));
     } catch {
     }
   }
   try {
     for (const d of import_node_fs8.default.readdirSync(legacyRoot)) {
-      if (d.startsWith(LEGACY_ONESHOT_PREFIX)) out.push(import_node_path11.default.join(legacyRoot, d));
+      if (d.startsWith(LEGACY_ONESHOT_PREFIX)) out.push(import_node_path12.default.join(legacyRoot, d));
     }
   } catch {
   }
   return [...new Set(out)];
 }
 function kindFromPath(workRoot, dir) {
-  const rel = import_node_path11.default.relative(workRoot, dir);
-  const parts = rel.split(import_node_path11.default.sep);
+  const rel = import_node_path12.default.relative(workRoot, dir);
+  const parts = rel.split(import_node_path12.default.sep);
   if (parts[0] === "sessions" && parts[1]) return parts[1];
   if (parts[0] === "tmp" && parts[1]) return parts[1].replace(/-[^-]*$/, "");
   return void 0;
@@ -146682,7 +146735,7 @@ async function runGcSweep(deps) {
   let deleted = 0;
   for (const d of decisions) {
     if (d.action !== "delete") continue;
-    if (import_node_fs8.default.existsSync(import_node_path11.default.join(d.dir, LOCK_FILE)) && isWorkdirLive(d.dir)) {
+    if (import_node_fs8.default.existsSync(import_node_path12.default.join(d.dir, LOCK_FILE)) && isWorkdirLive(d.dir)) {
       log3(`[gc] \u8DF3\u8FC7 ${d.dir}\uFF1A\u6267\u884C\u524D\u590D\u67E5\u53D1\u73B0\u5DF2\u88AB\u5360\u7528`);
       continue;
     }
@@ -146733,12 +146786,12 @@ function startGcLoop(deps) {
     clearInterval(timer);
   };
 }
-var import_node_fs8, import_node_path11;
+var import_node_fs8, import_node_path12;
 var init_gc_loop = __esm({
   "../adapters/src/_core/gc-loop.ts"() {
     "use strict";
     import_node_fs8 = __toESM(require("node:fs"), 1);
-    import_node_path11 = __toESM(require("node:path"), 1);
+    import_node_path12 = __toESM(require("node:path"), 1);
     init_session_paths();
     init_workdir_gc();
   }
@@ -146774,14 +146827,14 @@ var init_src4 = __esm({
 });
 
 // ../connectors/src/connector-adapter.ts
-var import_promises6, import_node_fs9, import_node_os7, import_node_path12, ConnectorAwareAdapter;
+var import_promises7, import_node_fs9, import_node_os8, import_node_path13, ConnectorAwareAdapter;
 var init_connector_adapter = __esm({
   "../connectors/src/connector-adapter.ts"() {
     "use strict";
-    import_promises6 = require("node:fs/promises");
+    import_promises7 = require("node:fs/promises");
     import_node_fs9 = require("node:fs");
-    import_node_os7 = require("node:os");
-    import_node_path12 = require("node:path");
+    import_node_os8 = require("node:os");
+    import_node_path13 = require("node:path");
     init_src4();
     init_base();
     init_prepare_job();
@@ -146804,11 +146857,11 @@ var init_connector_adapter = __esm({
         const wrapperPaths = [...prepared.job.wrapperPaths ?? [], ...sentinelWrappers];
         let extraEnv = { ...strippedEnv };
         if (wrapperPaths.length > 0) {
-          const wrapperBinDir = await (0, import_promises6.mkdtemp)((0, import_node_path12.join)((0, import_node_os7.tmpdir)(), "oasis-wrappers-"));
-          await (0, import_promises6.mkdir)(wrapperBinDir, { recursive: true });
+          const wrapperBinDir = await (0, import_promises7.mkdtemp)((0, import_node_path13.join)((0, import_node_os8.tmpdir)(), "oasis-wrappers-"));
+          await (0, import_promises7.mkdir)(wrapperBinDir, { recursive: true });
           for (const wp of wrapperPaths) {
-            const linkName = (0, import_node_path12.basename)(wp).replace(/\.sh$/, "");
-            await (0, import_promises6.symlink)(wp, (0, import_node_path12.join)(wrapperBinDir, linkName));
+            const linkName = (0, import_node_path13.basename)(wp).replace(/\.sh$/, "");
+            await (0, import_promises7.symlink)(wp, (0, import_node_path13.join)(wrapperBinDir, linkName));
           }
           extraEnv = { ...extraEnv, PATH: [wrapperBinDir, extraEnv["PATH"] ?? ""].filter(Boolean).join(":") };
           log("[adapter]", `  connectors injected  +${Date.now() - t0}ms  wrappers=${wrapperPaths.length}`);
@@ -149595,12 +149648,12 @@ async function startOasisServer(opts) {
               const actorCtx = await opts.resolveActorContext(body.actorId).catch(() => null);
               if (actorCtx) {
                 const { mkdtempSync: mkdtempSync5, mkdirSync: mkdirSync21, writeFileSync: writeFileSync13 } = await import("node:fs");
-                const { join: join31, dirname: dirname24 } = await import("node:path");
-                const { tmpdir: tmpdir9 } = await import("node:os");
-                const dir = mkdtempSync5(join31(tmpdir9(), "oasis-chat-"));
+                const { join: join32, dirname: dirname24 } = await import("node:path");
+                const { tmpdir: tmpdir10 } = await import("node:os");
+                const dir = mkdtempSync5(join32(tmpdir10(), "oasis-chat-"));
                 if (actorCtx.config?.prompt) {
                   for (const [rel, content] of Object.entries(splitIdentityFiles2(actorCtx.config.prompt))) {
-                    const file = join31(dir, rel);
+                    const file = join32(dir, rel);
                     mkdirSync21(dirname24(file), { recursive: true });
                     writeFileSync13(file, content);
                   }
@@ -149612,12 +149665,12 @@ async function startOasisServer(opts) {
                     const s2 = byId.get(id);
                     return s2 ? `- **${s2.name}** (\`${s2.id}\`): ${s2.description}` : `- \`${id}\`\uFF08\u672A\u5728\u6280\u80FD\u5E93\u4E2D\uFF0C\u53EF\u80FD\u5DF2\u5378\u8F7D\uFF09`;
                   });
-                  writeFileSync13(join31(dir, "SKILLS.md"), ["# \u53EF\u7528\u6280\u80FD", "", "\u4EE5\u4E0B\u6280\u80FD\u5DF2\u4E3A\u4F60\u542F\u7528\uFF0C\u53EF\u5728\u672C\u6B21\u4F1A\u8BDD\u4E2D\u76F4\u63A5\u4F7F\u7528\uFF1A", "", ...lines].join("\n"));
+                  writeFileSync13(join32(dir, "SKILLS.md"), ["# \u53EF\u7528\u6280\u80FD", "", "\u4EE5\u4E0B\u6280\u80FD\u5DF2\u4E3A\u4F60\u542F\u7528\uFF0C\u53EF\u5728\u672C\u6B21\u4F1A\u8BDD\u4E2D\u76F4\u63A5\u4F7F\u7528\uFF1A", "", ...lines].join("\n"));
                 }
                 if (opts.materializeSkills) {
                   const skillFiles = await opts.materializeSkills(body.actorId, "claude").catch(() => ({}));
                   for (const [rel, content] of Object.entries(skillFiles)) {
-                    const file = join31(dir, rel);
+                    const file = join32(dir, rel);
                     mkdirSync21(dirname24(file), { recursive: true });
                     writeFileSync13(file, content);
                   }
@@ -149631,7 +149684,7 @@ async function startOasisServer(opts) {
                     const modeNote = c.mode === "oauth" ? "OAuth \xB7 \u51ED\u8BC1\u7531\u5E73\u53F0\u7BA1\u7406\uFF0C\u901A\u8FC7\u5BF9\u5E94 CLI wrapper \u8C03\u7528" : "\u76F4\u63A5\u5199\u5165 \xB7 \u51ED\u8BC1\u5DF2\u6CE8\u5165\u73AF\u5883\u53D8\u91CF";
                     return `- **${c.name}** (\`${c.id}\`): ${statusNote} \xB7 ${modeNote}`;
                   });
-                  writeFileSync13(join31(dir, "CONNECTORS.md"), ["# \u53EF\u7528\u8FDE\u63A5\u5668", "", "\u4EE5\u4E0B\u8FDE\u63A5\u5668\u5DF2\u4E3A\u672C\u6B21\u4F1A\u8BDD\u914D\u7F6E\uFF0C\u51ED\u8BC1\u5DF2\u901A\u8FC7\u73AF\u5883\u53D8\u91CF\u6216 CLI wrapper \u6CE8\u5165\uFF0C\u65E0\u9700\u624B\u52A8\u914D\u7F6E\uFF1A", "", ...lines].join("\n"));
+                  writeFileSync13(join32(dir, "CONNECTORS.md"), ["# \u53EF\u7528\u8FDE\u63A5\u5668", "", "\u4EE5\u4E0B\u8FDE\u63A5\u5668\u5DF2\u4E3A\u672C\u6B21\u4F1A\u8BDD\u914D\u7F6E\uFF0C\u51ED\u8BC1\u5DF2\u901A\u8FC7\u73AF\u5883\u53D8\u91CF\u6216 CLI wrapper \u6CE8\u5165\uFF0C\u65E0\u9700\u624B\u52A8\u914D\u7F6E\uFF1A", "", ...lines].join("\n"));
                 }
                 spawnCwd = dir;
               }
@@ -158793,7 +158846,7 @@ var init_skill_materializer = __esm({
 
 // ../server/src/governance/connector-skills.ts
 function connectorSkillsDir(dataDir, connectorId) {
-  return (0, import_node_path13.join)(dataDir, "connector-skills", connectorId);
+  return (0, import_node_path14.join)(dataDir, "connector-skills", connectorId);
 }
 function parseConnectorSkillId(id) {
   if (!id.startsWith("connector:")) return null;
@@ -158803,17 +158856,17 @@ function parseConnectorSkillId(id) {
   return { connectorId: rest.slice(0, i), slug: rest.slice(i + 1) };
 }
 async function collect(root, dir, out) {
-  for (const e of await (0, import_promises7.readdir)(dir, { withFileTypes: true })) {
-    const abs = (0, import_node_path13.join)(dir, e.name);
+  for (const e of await (0, import_promises8.readdir)(dir, { withFileTypes: true })) {
+    const abs = (0, import_node_path14.join)(dir, e.name);
     if (e.isDirectory()) await collect(root, abs, out);
-    else if (e.isFile()) out[(0, import_node_path13.relative)(root, abs).split(/[\\/]/).join("/")] = await (0, import_promises7.readFile)(abs, "utf8");
+    else if (e.isFile()) out[(0, import_node_path14.relative)(root, abs).split(/[\\/]/).join("/")] = await (0, import_promises8.readFile)(abs, "utf8");
   }
 }
 async function readLocalPack(dataDir, connectorId) {
   const root = connectorSkillsDir(dataDir, connectorId);
   let slugs;
   try {
-    slugs = (await (0, import_promises7.readdir)(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = (await (0, import_promises8.readdir)(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
@@ -158821,7 +158874,7 @@ async function readLocalPack(dataDir, connectorId) {
   for (const slug6 of slugs) {
     const files = {};
     try {
-      await collect((0, import_node_path13.join)(root, slug6), (0, import_node_path13.join)(root, slug6), files);
+      await collect((0, import_node_path14.join)(root, slug6), (0, import_node_path14.join)(root, slug6), files);
     } catch {
       continue;
     }
@@ -158837,17 +158890,17 @@ async function readLocalPack(dataDir, connectorId) {
 async function writePack(dataDir, connectorId, pack) {
   const root = connectorSkillsDir(dataDir, connectorId);
   const tmp = `${root}.tmp`;
-  await (0, import_promises7.rm)(tmp, { recursive: true, force: true });
+  await (0, import_promises8.rm)(tmp, { recursive: true, force: true });
   for (const s2 of pack) {
     for (const [rel, content] of Object.entries(s2.files)) {
-      const abs = (0, import_node_path13.join)(tmp, s2.slug, rel);
-      await (0, import_promises7.mkdir)((0, import_node_path13.dirname)(abs), { recursive: true });
-      await (0, import_promises7.writeFile)(abs, content, "utf8");
+      const abs = (0, import_node_path14.join)(tmp, s2.slug, rel);
+      await (0, import_promises8.mkdir)((0, import_node_path14.dirname)(abs), { recursive: true });
+      await (0, import_promises8.writeFile)(abs, content, "utf8");
     }
   }
-  await (0, import_promises7.rm)(root, { recursive: true, force: true });
-  await (0, import_promises7.mkdir)((0, import_node_path13.dirname)(root), { recursive: true });
-  await (0, import_promises7.rename)(tmp, root);
+  await (0, import_promises8.rm)(root, { recursive: true, force: true });
+  await (0, import_promises8.mkdir)((0, import_node_path14.dirname)(root), { recursive: true });
+  await (0, import_promises8.rename)(tmp, root);
 }
 function packMatches(local, remote) {
   if (local.length !== remote.length) return false;
@@ -158874,12 +158927,12 @@ async function syncConnectorSkills(args) {
   log3(`[connector-skills] ${args.connectorId}\uFF1A\u5DF2\u4ECE\u5382\u5546\u540C\u6B65 ${fresh.length} \u4E2A\u6280\u80FD`);
   return { skills: fresh, outcome: "fetched" };
 }
-var import_promises7, import_node_path13, toId;
+var import_promises8, import_node_path14, toId;
 var init_connector_skills = __esm({
   "../server/src/governance/connector-skills.ts"() {
     "use strict";
-    import_promises7 = require("node:fs/promises");
-    import_node_path13 = require("node:path");
+    import_promises8 = require("node:fs/promises");
+    import_node_path14 = require("node:path");
     init_src5();
     toId = (connectorId, slug6) => `connector:${connectorId}/${slug6}`;
   }
@@ -159154,15 +159207,43 @@ function actorsDomain(opts) {
       const conn = await service.setActorConnectorEnabled(req.params.id, req.params.connectorId, b2.enabled);
       return { status: 200, body: conn };
     });
+    const requireVariableManager = (req) => {
+      if (!isHumanActor(req.auth.actor)) {
+        throw new ApiError(
+          403,
+          "VARIABLE_MANAGEMENT_FORBIDDEN",
+          "\u53D8\u91CF\u7684\u5217\u51FA/\u5199\u5165/\u5220\u9664\u4EC5\u9650\u4EBA\u7C7B\u63A7\u5236\u53F0\u7528\u6237\uFF1Bagent \u8BFB\u53D6\u51ED\u636E\u8BF7\u7528 `oasis var reveal <key>`"
+        );
+      }
+    };
+    const auditVariableChange = async (req, kind, variableKey, targetScope) => {
+      await opts.credentialAudit?.({
+        kind,
+        actor: req.auth.actor,
+        variableKey,
+        targetScope,
+        source: "console",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    };
     router.get("/api/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listVariables() } };
     });
     router.post("/api/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
-      const scope = b2.scope ?? "global";
+      if (b2.scope !== "global" && b2.scope !== "personal" && b2.scope !== "project") {
+        throw new ApiError(
+          400,
+          "BAD_REQUEST",
+          "\u5FC5\u987B\u663E\u5F0F\u63D0\u4F9B scope\uFF08global | personal | project\uFF09\u2014\u2014\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF0C\u4E0D\u8BBE\u7F3A\u7701"
+        );
+      }
+      const scope = b2.scope;
       if (scope === "project" && !b2.projectId) {
         throw new ApiError(400, "BAD_REQUEST", "scope=project \u5FC5\u987B\u63D0\u4F9B projectId");
       }
@@ -159172,6 +159253,13 @@ function actorsDomain(opts) {
       if (b2.deliveryMode !== void 0 && b2.deliveryMode !== "env" && b2.deliveryMode !== "ref") {
         throw new ApiError(400, "BAD_REQUEST", "deliveryMode \u53EA\u80FD\u662F env \u6216 ref");
       }
+      if (scope === "personal") {
+        throw new ApiError(
+          400,
+          "BAD_REQUEST",
+          "personal \u53D8\u91CF\u8BF7\u8D70 POST /api/actors/:id/variables\uFF08\u672C\u7AEF\u70B9\u65E0 actorId\uFF0C\u5199\u5165\u4F1A\u843D\u4E0B\u65E0\u5F52\u5C5E\u7684\u7578\u5F62\u884C\uFF09"
+        );
+      }
       if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
       await service.putVariable({
         key: b2.key,
@@ -159183,9 +159271,16 @@ function actorsDomain(opts) {
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
       });
+      await auditVariableChange(
+        req,
+        "credential_write",
+        b2.key,
+        scope === "project" ? `project:${b2.projectId}` : "global"
+      );
       return { status: 201, body: { ok: true } };
     });
     router.delete("/api/variables/:key", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const projectId = req.query.get("projectId") ?? void 0;
       await service.deleteVariable(
@@ -159193,13 +159288,21 @@ function actorsDomain(opts) {
         void 0,
         projectId ? { projectId } : void 0
       );
+      await auditVariableChange(
+        req,
+        "credential_delete",
+        req.params.key,
+        projectId ? `project:${projectId}` : "global"
+      );
       return { status: 200, body: { ok: true } };
     });
     router.get("/api/actors/:id/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listVariables(req.params.id) } };
     });
     router.post("/api/actors/:id/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const actorId = req.params.id;
       const b2 = req.body;
@@ -159229,11 +159332,14 @@ function actorsDomain(opts) {
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
       });
+      await auditVariableChange(req, "credential_write", b2.key, `personal:${actorId}`);
       return { status: 201, body: { ok: true } };
     });
     router.delete("/api/actors/:id/variables/:key", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       await service.deleteVariable(req.params.key, req.params.id);
+      await auditVariableChange(req, "credential_delete", req.params.key, `personal:${req.params.id}`);
       return { status: 200, body: { ok: true } };
     });
     router.post("/api/variables/reveal", async (req) => {
@@ -162311,10 +162417,10 @@ function nodesDomain(deps) {
       }
     }
     try {
-      const here = (0, import_node_path14.dirname)((0, import_node_url4.fileURLToPath)(__esm_import_meta_url));
+      const here = (0, import_node_path15.dirname)((0, import_node_url4.fileURLToPath)(__esm_import_meta_url));
       for (const rel of ["../../../../node-daemon/package.json", "../../../../../node-daemon/package.json"]) {
         try {
-          const raw = (0, import_node_fs11.readFileSync)((0, import_node_path14.resolve)(here, rel), "utf8");
+          const raw = (0, import_node_fs11.readFileSync)((0, import_node_path15.resolve)(here, rel), "utf8");
           const pkg = JSON.parse(raw);
           if (pkg.version) return { version: pkg.version, source: "monorepo" };
         } catch {
@@ -162626,14 +162732,14 @@ function nodesDomain(deps) {
     });
   };
 }
-var import_node_crypto26, import_node_fs11, import_node_url4, import_node_path14;
+var import_node_crypto26, import_node_fs11, import_node_url4, import_node_path15;
 var init_routes5 = __esm({
   "../server/src/domains/nodes/routes.ts"() {
     "use strict";
     import_node_crypto26 = require("node:crypto");
     import_node_fs11 = require("node:fs");
     import_node_url4 = require("node:url");
-    import_node_path14 = require("node:path");
+    import_node_path15 = require("node:path");
     init_src4();
     init_connect_script();
     init_node_health();
@@ -164008,12 +164114,12 @@ function nameKey(name) {
 function cleanName(name) {
   return name.trim().replace(/\s+/g, " ");
 }
-var import_node_fs12, import_node_path15, import_node_crypto27, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
+var import_node_fs12, import_node_path16, import_node_crypto27, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
 var init_tags = __esm({
   "../server/src/domains/collab/tags.ts"() {
     "use strict";
     import_node_fs12 = __toESM(require("node:fs"), 1);
-    import_node_path15 = __toESM(require("node:path"), 1);
+    import_node_path16 = __toESM(require("node:path"), 1);
     import_node_crypto27 = __toESM(require("node:crypto"), 1);
     SEP = "::";
     keyOf = (companyId, id) => `${companyId}${SEP}${id}`;
@@ -164099,7 +164205,7 @@ var init_tags = __esm({
       }
       persist() {
         try {
-          import_node_fs12.default.mkdirSync(import_node_path15.default.dirname(this.file), { recursive: true });
+          import_node_fs12.default.mkdirSync(import_node_path16.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs12.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs12.default.renameSync(tmp, this.file);
@@ -165055,10 +165161,10 @@ function tokenType(p2) {
 function parseOtlpMetricsUsage(body) {
   const req = body;
   const out = [];
-  for (const rm5 of req.resourceMetrics ?? []) {
-    const runId = attrString(rm5.resource?.attributes, "oasis.run_id");
+  for (const rm6 of req.resourceMetrics ?? []) {
+    const runId = attrString(rm6.resource?.attributes, "oasis.run_id");
     if (!runId) continue;
-    const actorId = attrString(rm5.resource?.attributes, "oasis.actor_id");
+    const actorId = attrString(rm6.resource?.attributes, "oasis.actor_id");
     let input = 0;
     let output = 0;
     let cacheRead = 0;
@@ -165066,7 +165172,7 @@ function parseOtlpMetricsUsage(body) {
     let costUsd = 0;
     let sawToken = false;
     let sawCost = false;
-    for (const sm of rm5.scopeMetrics ?? []) {
+    for (const sm of rm6.scopeMetrics ?? []) {
       for (const m2 of sm.metrics ?? []) {
         const name = (m2.name ?? "").toLowerCase();
         const points = m2.sum?.dataPoints ?? m2.gauge?.dataPoints ?? [];
@@ -167553,12 +167659,12 @@ function normalize(patch) {
     ...reviewRoles !== void 0 ? { reviewRoles: [...new Set(reviewRoles.map((r) => r.trim()).filter(Boolean))] } : {}
   };
 }
-var import_node_fs13, import_node_path16, SEP2, keyOf2, prefixOf2, MemoryPlaybookOverrideStore, FilePlaybookOverrideStore;
+var import_node_fs13, import_node_path17, SEP2, keyOf2, prefixOf2, MemoryPlaybookOverrideStore, FilePlaybookOverrideStore;
 var init_overrides = __esm({
   "../server/src/domains/playbooks/overrides.ts"() {
     "use strict";
     import_node_fs13 = __toESM(require("node:fs"), 1);
-    import_node_path16 = __toESM(require("node:path"), 1);
+    import_node_path17 = __toESM(require("node:path"), 1);
     SEP2 = "::";
     keyOf2 = (companyId, ref2, nodeKey) => `${companyId}${SEP2}${ref2}${SEP2}${nodeKey}`;
     prefixOf2 = (companyId, ref2) => `${companyId}${SEP2}${ref2}${SEP2}`;
@@ -167597,7 +167703,7 @@ var init_overrides = __esm({
       }
       persist() {
         try {
-          import_node_fs13.default.mkdirSync(import_node_path16.default.dirname(this.file), { recursive: true });
+          import_node_fs13.default.mkdirSync(import_node_path17.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs13.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs13.default.renameSync(tmp, this.file);
@@ -168036,12 +168142,12 @@ var init_daemon_adapter = __esm({
 });
 
 // ../server/src/side-map.ts
-var import_node_fs14, import_node_path17, FileSideMap;
+var import_node_fs14, import_node_path18, FileSideMap;
 var init_side_map = __esm({
   "../server/src/side-map.ts"() {
     "use strict";
     import_node_fs14 = __toESM(require("node:fs"), 1);
-    import_node_path17 = __toESM(require("node:path"), 1);
+    import_node_path18 = __toESM(require("node:path"), 1);
     FileSideMap = class {
       constructor(file) {
         this.file = file;
@@ -168068,7 +168174,7 @@ var init_side_map = __esm({
       }
       persist() {
         try {
-          import_node_fs14.default.mkdirSync(import_node_path17.default.dirname(this.file), { recursive: true });
+          import_node_fs14.default.mkdirSync(import_node_path18.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs14.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs14.default.renameSync(tmp, this.file);
@@ -169524,26 +169630,26 @@ ${ctx.nodeFault}
 
 // ../server/src/governance/builtin-skills.ts
 async function collectDir(root, dir, out) {
-  const entries = await (0, import_promises8.readdir)(dir, { withFileTypes: true });
+  const entries = await (0, import_promises9.readdir)(dir, { withFileTypes: true });
   for (const e of entries) {
-    const abs = (0, import_node_path18.join)(dir, e.name);
+    const abs = (0, import_node_path19.join)(dir, e.name);
     if (e.isDirectory()) {
       await collectDir(root, abs, out);
     } else if (e.isFile()) {
-      const info = await (0, import_promises8.stat)(abs);
+      const info = await (0, import_promises9.stat)(abs);
       if (info.size > MAX_FILE_BYTES3) {
         console.warn(`[builtin-skills] skip oversized file (${info.size}B): ${abs}`);
         continue;
       }
-      const rel = (0, import_node_path18.relative)(root, abs).split(/[\\/]/).join("/");
-      out[rel] = await (0, import_promises8.readFile)(abs, "utf8");
+      const rel = (0, import_node_path19.relative)(root, abs).split(/[\\/]/).join("/");
+      out[rel] = await (0, import_promises9.readFile)(abs, "utf8");
     }
   }
 }
 async function loadBuiltinSkills(skillsDir) {
   let dirents;
   try {
-    dirents = await (0, import_promises8.readdir)(skillsDir, { withFileTypes: true });
+    dirents = await (0, import_promises9.readdir)(skillsDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -169551,7 +169657,7 @@ async function loadBuiltinSkills(skillsDir) {
   for (const d of dirents) {
     if (!d.isDirectory()) continue;
     const slug6 = d.name;
-    const skillDir = (0, import_node_path18.join)(skillsDir, slug6);
+    const skillDir = (0, import_node_path19.join)(skillsDir, slug6);
     const files = {};
     try {
       await collectDir(skillDir, skillDir, files);
@@ -169579,12 +169685,12 @@ function materializeBuiltinSkills(builtins, skillsDirPrefix) {
   }
   return out;
 }
-var import_promises8, import_node_path18, MAX_FILE_BYTES3;
+var import_promises9, import_node_path19, MAX_FILE_BYTES3;
 var init_builtin_skills = __esm({
   "../server/src/governance/builtin-skills.ts"() {
     "use strict";
-    import_promises8 = require("node:fs/promises");
-    import_node_path18 = require("node:path");
+    import_promises9 = require("node:fs/promises");
+    import_node_path19 = require("node:path");
     init_skill_fetcher();
     init_skill_materializer();
     MAX_FILE_BYTES3 = 1 << 20;
@@ -182610,7 +182716,7 @@ var SessionManager = class {
 
 // ../cli/src/daemon/ws-client.ts
 init_wrapper();
-var import_node_os8 = require("node:os");
+var import_node_os9 = require("node:os");
 var import_node_crypto38 = require("node:crypto");
 init_src5();
 
@@ -182666,7 +182772,7 @@ function detectRuntimes() {
 
 // ../cli/src/daemon/workdir-handler.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 init_src4();
 init_src();
 var WORKDIR_READ_MAX_BYTES2 = 2 * 1024 * 1024;
@@ -182685,10 +182791,10 @@ function isSensitiveSegment(segment) {
 }
 function relPathIsSensitive(rel) {
   if (!rel) return false;
-  return rel.split(import_node_path19.default.sep).some((seg) => seg.length > 0 && isSensitiveSegment(seg));
+  return rel.split(import_node_path20.default.sep).some((seg) => seg.length > 0 && isSensitiveSegment(seg));
 }
 function withinBase(p2, base) {
-  return p2 === base || p2.startsWith(base + import_node_path19.default.sep);
+  return p2 === base || p2.startsWith(base + import_node_path20.default.sep);
 }
 function normalizeRel(raw) {
   const trimmed = (raw ?? "").trim();
@@ -182705,7 +182811,7 @@ async function trustedCanonicalContainer(req, logicalBase, dirKind) {
   } catch {
     return null;
   }
-  return isLegacy ? import_node_path19.default.join(trustedRootReal, "oasis-chat-sessions") : import_node_path19.default.join(trustedRootReal, "sessions", dirKind);
+  return isLegacy ? import_node_path20.default.join(trustedRootReal, "oasis-chat-sessions") : import_node_path20.default.join(trustedRootReal, "sessions", dirKind);
 }
 async function resolveWithinWorkdir(req) {
   const dirKind = sessionDirKind(req.runtimeKind);
@@ -182723,11 +182829,11 @@ async function resolveWithinWorkdir(req) {
   } catch {
     return { ok: false, code: "NOT_FOUND" };
   }
-  if (import_node_path19.default.dirname(base) !== canonicalContainer) return { ok: false, code: "PATH_ESCAPE" };
+  if (import_node_path20.default.dirname(base) !== canonicalContainer) return { ok: false, code: "PATH_ESCAPE" };
   const rel = normalizeRel(req.path);
-  const requested = import_node_path19.default.resolve(base, rel);
+  const requested = import_node_path20.default.resolve(base, rel);
   if (!withinBase(requested, base)) return { ok: false, code: "PATH_ESCAPE" };
-  const cleanRel = base === requested ? "" : import_node_path19.default.relative(base, requested);
+  const cleanRel = base === requested ? "" : import_node_path20.default.relative(base, requested);
   if (relPathIsSensitive(cleanRel)) return { ok: false, code: "SENSITIVE" };
   let real;
   try {
@@ -182737,7 +182843,7 @@ async function resolveWithinWorkdir(req) {
     return { ok: false, code: "PATH_ESCAPE" };
   }
   if (!withinBase(real, base)) return { ok: false, code: "PATH_ESCAPE" };
-  const realRel = base === real ? "" : import_node_path19.default.relative(base, real);
+  const realRel = base === real ? "" : import_node_path20.default.relative(base, real);
   if (relPathIsSensitive(realRel)) return { ok: false, code: "SENSITIVE" };
   return { ok: true, base, real };
 }
@@ -182773,7 +182879,7 @@ async function handleWorkdirList(req) {
       const slice = truncated ? visible.slice(0, WORKDIR_LIST_MAX_ENTRIES) : visible;
       const entries = [];
       for (const d of slice) {
-        const abs = import_node_path19.default.join(anchor, d.name);
+        const abs = import_node_path20.default.join(anchor, d.name);
         try {
           const st = await import_node_fs16.default.promises.lstat(abs);
           if (st.isSymbolicLink()) continue;
@@ -182805,7 +182911,7 @@ async function verifyOpenedFd(fh, base, fallback) {
   const fdReal = await fdCanonicalPath(fh);
   if (fdReal === null) return { anchor: fallback };
   if (!withinBase(fdReal, base)) return { error: { ok: false, code: "PATH_ESCAPE" } };
-  const fdRel = base === fdReal ? "" : import_node_path19.default.relative(base, fdReal);
+  const fdRel = base === fdReal ? "" : import_node_path20.default.relative(base, fdReal);
   if (relPathIsSensitive(fdRel)) return { error: { ok: false, code: "SENSITIVE" } };
   return { anchor: `/proc/self/fd/${fh.fd}` };
 }
@@ -182894,7 +183000,7 @@ function looksBinary(bytes) {
 function contentTypeFor(absPath, bytes) {
   const sniffed = sniffContentType(bytes);
   if (sniffed) return sniffed;
-  const ext = import_node_path19.default.extname(absPath).toLowerCase();
+  const ext = import_node_path20.default.extname(absPath).toLowerCase();
   if (EXT_CONTENT_TYPE[ext]) return EXT_CONTENT_TYPE[ext];
   return looksBinary(bytes) ? "application/octet-stream" : "text/plain; charset=utf-8";
 }
@@ -183237,7 +183343,7 @@ var DaemonWsClient = class {
   buildMeta() {
     const activeSessions = this.sessions.activeSessions();
     return {
-      hostname: (0, import_node_os8.hostname)(),
+      hostname: (0, import_node_os9.hostname)(),
       adapters: this.adapters,
       ...this.reportRuntimes ? { runtimes: this.runtimes } : {},
       nodeVersion: process.version,
@@ -183267,18 +183373,18 @@ var RuntimeRouterAdapter = class {
 
 // ../cli/src/daemon/reap-claude-projects.ts
 var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_os9 = __toESM(require("node:os"), 1);
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_os10 = __toESM(require("node:os"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 function claudeProjectSlug(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
 function claudeProjectsRoot() {
-  const configDir = process.env["CLAUDE_CONFIG_DIR"] || import_node_path20.default.join(import_node_os9.default.homedir(), ".claude");
-  return import_node_path20.default.join(configDir, "projects");
+  const configDir = process.env["CLAUDE_CONFIG_DIR"] || import_node_path21.default.join(import_node_os10.default.homedir(), ".claude");
+  return import_node_path21.default.join(configDir, "projects");
 }
 function reapClaudeProjects(workdir, runtimeKind) {
   if (runtimeKind !== "claude" && runtimeKind !== "claude-code") return;
-  const dir = import_node_path20.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
+  const dir = import_node_path21.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
   if (!import_node_fs17.default.existsSync(dir)) return;
   try {
     import_node_fs17.default.rmSync(dir, { recursive: true, force: true });
@@ -183288,7 +183394,7 @@ function reapClaudeProjects(workdir, runtimeKind) {
 
 // ../cli/src/node.ts
 init_src4();
-var import_node_os10 = __toESM(require("node:os"), 1);
+var import_node_os11 = __toESM(require("node:os"), 1);
 var RESILIENCE = {
   codex: { idleTimeoutMs: 6e5 }
 };
@@ -183352,7 +183458,7 @@ async function startNode(opts) {
   console.log(`[oasis node] ${opts.nodeId} \u2192 ${opts.serverUrl}`);
   client.start();
   const { workRoot, legacyRoot } = resolveWorkRoots(opts.workRoot);
-  const workRootIsEphemeral = workRoot.startsWith(import_node_os10.default.tmpdir());
+  const workRootIsEphemeral = workRoot.startsWith(import_node_os11.default.tmpdir());
   if (opts.gcEnabled === false && !workRootIsEphemeral) {
     console.warn(`[oasis node] \u26A0 \u56DE\u6536\u5668\u5DF2\u5173\u95ED\uFF0C\u800C\u5DE5\u4F5C\u533A\u5728\u6301\u4E45\u76D8\uFF08${workRoot}\uFF09\u2014\u2014\u6CA1\u6709\u4EFB\u4F55\u5783\u573E\u56DE\u6536\uFF0C\u5B9E\u6D4B\u4E24\u5468\u4F1A\u6DA8 12.4GB\u3002\u4EC5\u4F9B\u6392\u969C\uFF0C\u522B\u957F\u671F\u8FD9\u4E48\u8DD1\u3002`);
   }
@@ -183387,7 +183493,7 @@ async function startNode(opts) {
 var import_node_child_process16 = require("node:child_process");
 var import_node_fs18 = require("node:fs");
 var import_node_crypto39 = require("node:crypto");
-var import_node_os11 = require("node:os");
+var import_node_os12 = require("node:os");
 function linuxMachineId() {
   for (const p2 of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
     try {
@@ -183427,13 +183533,13 @@ function windowsMachineId() {
 }
 function fallbackFingerprint() {
   const macs = [];
-  const ifaces = (0, import_node_os11.networkInterfaces)();
+  const ifaces = (0, import_node_os12.networkInterfaces)();
   for (const name of Object.keys(ifaces).sort()) {
     for (const ni of ifaces[name] ?? []) {
       if (!ni.internal && ni.mac && ni.mac !== "00:00:00:00:00:00") macs.push(ni.mac);
     }
   }
-  return `fallback:${(0, import_node_os11.hostname)()}:${macs.sort()[0] ?? "no-mac"}`;
+  return `fallback:${(0, import_node_os12.hostname)()}:${macs.sort()[0] ?? "no-mac"}`;
 }
 function machineFingerprint() {
   const byOs = process.platform === "darwin" ? macMachineId() : process.platform === "win32" ? windowsMachineId() : linuxMachineId();
@@ -183443,7 +183549,7 @@ var defaultSources = {
   machineFingerprint,
   osUser: () => {
     try {
-      return (0, import_node_os11.userInfo)().username;
+      return (0, import_node_os12.userInfo)().username;
     } catch {
       return process.env["USER"] ?? process.env["USERNAME"] ?? "unknown";
     }
@@ -184449,17 +184555,53 @@ var COMMAND_DECLS = {
     examples: ['oasis artifact revision register --project oasis --artifact-id artifact:dev:abc --type dev --title "v1.0" --version 1 --content-ref ref-001']
   },
   var: {
-    usage: "oasis var <reveal> ...",
-    description: "\u51ED\u636E\u4FDD\u9669\u5E93\uFF1A\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u660E\u6587\uFF08ADR \u51ED\u636E\u4FDD\u9669\u5E93 \xA74.5\uFF09\u3002",
-    subCommands: ["var reveal"],
-    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD"]
+    usage: "oasis var <reveal|list|set|rm> ...",
+    description: "\u51ED\u636E\u4FDD\u9669\u5E93\uFF08ADR \u51ED\u636E\u4FDD\u9669\u5E93 / ADR 0125\uFF09\u3002reveal \u662F agent \u53D6\u660E\u6587\u7684\u5165\u53E3\uFF1Blist/set/rm \u662F\u7BA1\u7406\u9762\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    subCommands: ["var reveal", "var list", "var set", "var rm"],
+    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD", "oasis var list --scope project --project oasis"]
   },
   "var reveal": {
     usage: "oasis var reveal <key> [--source <tag>]",
-    description: "\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u7684\u660E\u6587\u3002env \u91CC\u82E5\u89C1 oasis://var/X\uFF08\u5F15\u7528\u975E\u660E\u6587\uFF09\u2192 \u7528\u672C\u547D\u4EE4\u53D6\u660E\u6587\u3002\u7F3A key/\u65E0\u6743\u8FD4\u56DE denied\uFF1B\u77ED\u65F6\u8BFB\u53D6\u8FC7\u591A\u4F1A\u9650\u6D41\u3002\u660E\u6587\u53EA\u8F93\u51FA\u5230 stdout\u3002",
+    description: "\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u7684\u660E\u6587\u3002env \u91CC\u82E5\u89C1 oasis://var/X\uFF08\u5F15\u7528\u975E\u660E\u6587\uFF09\u2192 \u7528\u672C\u547D\u4EE4\u53D6\u660E\u6587\u3002\u7F3A key/\u65E0\u6743\u8FD4\u56DE denied\uFF1B\u77ED\u65F6\u8BFB\u53D6\u8FC7\u591A\u4F1A\u9650\u6D41\u3002**\u8F93\u51FA\u4F1A\u8FDB\u5165\u4F1A\u8BDD\u8BB0\u5F55\u4E0E trace**\u2014\u2014\u80FD\u5305\u8FDB\u5B50\u8FDB\u7A0B\u5C31\u522B\u88F8\u8DD1\uFF0C\u7528 X=$(oasis var reveal K) \u63A5\u4F4F\u3002",
     positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key\uFF08\u53EF\u4F20\u88F8 key \u6216 oasis://var/<key> \u5F15\u7528\uFF0C\u4E8C\u8005\u7B49\u4EF7\uFF09" }],
     flags: [{ name: "source", desc: "\u8C03\u7528\u6765\u6E90\u6807\u8BB0\uFF08\u5BA1\u8BA1\u7528\uFF0C\u5982 smoke-test\uFF1B\u7F3A\u7701 agent-cli\uFF09", own: true }],
     examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD", "oasis var reveal oasis://var/GLM_API_KEY --source smoke-test"]
+  },
+  "var list": {
+    usage: "oasis var list [--scope global|project|personal] [--project <id>] [--actor <actorId>]",
+    description: "\u5217\u51FA\u53D8\u91CF\u5143\u6570\u636E\uFF08key / \u4F5C\u7528\u57DF / \u5F52\u5C5E / \u6295\u9012\u6A21\u5F0F\uFF09\u3002**\u503C\u4E0D\u51FA\u73B0**\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\uFF1Bagent \u8C03\u4F1A\u5F97\u5230 403\u3002",
+    flags: [
+      { name: "scope", desc: "\u53EA\u5217\u8FD9\u4E00\u6863\uFF1Aglobal | project | personal", own: true },
+      { name: "project", desc: "\u53EA\u5217\u8BE5\u9879\u76EE\u7684 project \u53D8\u91CF", own: true },
+      { name: "actor", desc: "\u5217\u8BE5\u5458\u5DE5\u53EF\u89C1\u7684\u53D8\u91CF\uFF08personal + global\uFF09", own: true }
+    ],
+    examples: ["oasis var list", "oasis var list --scope project --project oasis"]
+  },
+  "var set": {
+    usage: "oasis var set <key> --scope global|project|personal [--project <id>] [--actor <actorId>] [--delivery env|ref]",
+    description: "\u5199\u5165\u53D8\u91CF\u3002**\u503C\u53EA\u4ECE stdin \u8BFB**\u2014\u2014\u547D\u4EE4\u884C\u53C2\u6570\u4F1A\u8FDB shell history\u3001\u4E5F\u4F1A\u88AB\u540C\u673A\u4EFB\u4F55\u4EBA ps aux \u770B\u89C1\u3002--scope \u5FC5\u586B\u4E0D\u8BBE\u7F3A\u7701\uFF08\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF09\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key" }],
+    flags: [
+      { name: "scope", desc: "global=\u5168\u7EC4\u7EC7 / project=\u6302\u9879\u76EE / personal=\u6302\u5458\u5DE5\uFF08\u5FC5\u586B\uFF09", own: true },
+      { name: "project", desc: "\u9879\u76EE id\uFF08--scope project \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "actor", desc: "\u5458\u5DE5 actorId\uFF08--scope personal \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "delivery", desc: "\u6295\u9012\u6A21\u5F0F\uFF1Aenv=\u660E\u6587\u6CE8\u5165 / ref=\u5F15\u7528\u6CE8\u5165\uFF08\u654F\u611F\u9879\u7528\u8FD9\u4E2A\uFF09\uFF1B\u7F3A\u7701 env", own: true }
+    ],
+    examples: [
+      'printf %s "$SECRET" | oasis var set DEV_SPA_LOGIN_PASSWORD --scope project --project oasis --delivery ref',
+      "oasis var set TAVILY_API_KEY --scope global < key.txt"
+    ]
+  },
+  "var rm": {
+    usage: "oasis var rm <key> --scope global|project|personal [--project <id>] [--actor <actorId>]",
+    description: "\u5220\u9664\u4E00\u884C\u53D8\u91CF\u3002--scope \u5FC5\u586B\u2014\u2014\u540C\u4E00\u4E2A key \u53EF\u4EE5\u5728\u4E09\u6863\u5404\u6709\u4E00\u884C\uFF0C\u4E0D\u6307\u660E\u4F1A\u5220\u9519\u884C\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key" }],
+    flags: [
+      { name: "scope", desc: "\u8981\u5220\u54EA\u4E00\u6863\uFF1Aglobal | project | personal\uFF08\u5FC5\u586B\uFF09", own: true },
+      { name: "project", desc: "\u9879\u76EE id\uFF08--scope project \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "actor", desc: "\u5458\u5DE5 actorId\uFF08--scope personal \u65F6\u5FC5\u586B\uFF09", own: true }
+    ],
+    examples: ["oasis var rm STALE_KEY --scope project --project oasis"]
   }
 };
 function formatCommandHelp(decl) {
@@ -184678,6 +184820,12 @@ function needPos(positional, i, usage) {
   if (v2 === void 0) throw new Error(`\u7528\u6CD5: ${usage}`);
   return v2;
 }
+async function readStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(Buffer.from(c));
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
 function slugId(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || `artifact-${Date.now()}`;
 }
@@ -186149,8 +186297,98 @@ ${res.warning}`);
         }
         break;
       }
+      const forbidden = (e) => e instanceof ApiRequestError && e.status === 403 ? new Error("\u53D8\u91CF\u7684\u5217\u51FA/\u5199\u5165/\u5220\u9664\u4EC5\u9650\u4EBA\u7C7B\u63A7\u5236\u53F0\u7528\u6237\uFF08operator token\uFF09\u3002agent \u53D6\u51ED\u636E\u8BF7\u7528 `oasis var reveal <key>`\u3002") : void 0;
+      const readScope = () => {
+        const scope = flags.get("scope");
+        if (scope !== "global" && scope !== "project" && scope !== "personal") {
+          throw new Error("--scope \u5FC5\u586B\uFF0C\u53D6\u503C global | project | personal\n  global   \u5168\u7EC4\u7EC7\u901A\u7528\uFF0C\u6240\u6709 agent \u90FD\u62FF\u5F97\u5230\n  project  \u6302\u5728\u9879\u76EE\u4E0A\uFF08\u914D --project <id>\uFF09\uFF0C\u6D3E\u5230\u8BE5\u9879\u76EE\u7684 agent \u81EA\u52A8\u83B7\u5F97\n  personal \u6302\u5728\u5458\u5DE5\u4E0A\uFF08\u914D --actor <actorId>\uFF09\uFF0C\u53EA\u6709\u90A3\u4E2A agent \u62FF\u5F97\u5230\n\uFF08\u4E0D\u8BBE\u7F3A\u7701\uFF1A\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF0C\u731C\u9519\u5C31\u662F\u628A\u5B83\u53D1\u7ED9\u5168\u7EC4\u7EC7\u3002\uFF09");
+        }
+        if (scope === "project" && !flags.get("project")) throw new Error("--scope project \u5FC5\u987B\u914D --project <projectId>");
+        if (scope === "personal" && !flags.get("actor")) throw new Error("--scope personal \u5FC5\u987B\u914D --actor <actorId>");
+        return {
+          scope,
+          ...flags.get("project") ? { projectId: flags.get("project") } : {},
+          ...flags.get("actor") ? { actorId: flags.get("actor") } : {}
+        };
+      };
+      if (sub === "list") {
+        const want = flags.get("scope");
+        const actorFilter = flags.get("actor");
+        const path30 = actorFilter ? `/api/actors/${encodeURIComponent(actorFilter)}/variables` : "/api/variables";
+        let items;
+        try {
+          ({ items } = await api.request("GET", path30));
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        const rows = items.filter((v2) => !want || v2.scope === want).filter((v2) => !flags.get("project") || v2.projectId === flags.get("project"));
+        if (rows.length === 0) {
+          println("\u6CA1\u6709\u5339\u914D\u7684\u53D8\u91CF");
+          break;
+        }
+        for (const v2 of rows) {
+          const owner = v2.scope === "project" ? v2.projectId ?? "?" : v2.scope === "personal" ? v2.actorId ?? "?" : "-";
+          println(`${v2.key}	${v2.scope}	${owner}	${v2.deliveryMode ?? "env"}${v2.connectorId ? `	[connector:${v2.connectorId}]` : ""}`);
+        }
+        break;
+      }
+      if (sub === "set") {
+        const key = needPos(positional, 1, "oasis var set <key> --scope \u2026 \uFF08\u503C\u4ECE stdin \u8BFB\uFF09");
+        const { scope, projectId, actorId } = readScope();
+        const delivery = flags.get("delivery") ?? flags.get("delivery-mode");
+        if (delivery !== void 0 && delivery !== "env" && delivery !== "ref") {
+          throw new Error("--delivery \u53EA\u80FD\u662F env\uFF08\u660E\u6587\u6CE8\u5165\uFF09\u6216 ref\uFF08\u5F15\u7528\u6CE8\u5165\uFF0C\u654F\u611F\u9879\u7528\u8FD9\u4E2A\uFF09");
+        }
+        const value = await readStdin();
+        if (!value) {
+          throw new Error(`\u503C\u4ECE stdin \u8BFB\uFF0C\u547D\u4EE4\u884C\u4E0D\u63A5\u53D7 --value\uFF08\u4F1A\u8FDB shell history \u548C ps aux\uFF09\u3002\u7528\u6CD5\uFF1A
+  printf %s "$SECRET" | oasis var set ${key} --scope ${scope}${projectId ? ` --project ${projectId}` : ""}
+  oasis var set ${key} --scope ${scope} < secret.txt`);
+        }
+        const body = {
+          key,
+          value,
+          scope,
+          ...projectId ? { projectId } : {},
+          ...delivery ? { deliveryMode: delivery } : {},
+          encrypted: true
+        };
+        try {
+          if (scope === "personal") {
+            await api.request("POST", `/api/actors/${encodeURIComponent(actorId)}/variables`, { ...body, scope: "personal" });
+          } else {
+            await api.request("POST", "/api/variables", body);
+          }
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        const where = scope === "project" ? `\u9879\u76EE ${projectId}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7";
+        println(`\u5DF2\u5199\u5165 ${key}\uFF08${where}\uFF0C\u6295\u9012=${delivery ?? "env"}\uFF09`);
+        break;
+      }
+      if (sub === "rm") {
+        const key = needPos(positional, 1, "oasis var rm <key> --scope \u2026");
+        const { scope, projectId, actorId } = readScope();
+        try {
+          if (scope === "personal") {
+            await api.request("DELETE", `/api/actors/${encodeURIComponent(actorId)}/variables/${encodeURIComponent(key)}`);
+          } else {
+            const q = scope === "project" ? `?projectId=${encodeURIComponent(projectId)}` : "";
+            await api.request("DELETE", `/api/variables/${encodeURIComponent(key)}${q}`);
+          }
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        println(`\u5DF2\u5220\u9664 ${key}\uFF08${scope === "project" ? `\u9879\u76EE ${projectId}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7"}\uFF09`);
+        break;
+      }
       throw new Error(`\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Aoasis var ${sub ?? ""}
-\u53EF\u7528\uFF1Aoasis var reveal <key> [--source <tag>]`);
+\u53EF\u7528\uFF1A
+  oasis var reveal <key> [--source <tag>]        \u53D6\u660E\u6587\uFF08agent \u7528\uFF09
+  oasis var list [--scope s] [--project p] [--actor a]
+  oasis var set <key> --scope \u2026 [--delivery env|ref]   \uFF08\u503C\u4ECE stdin\uFF09
+  oasis var rm <key> --scope \u2026
+\u540E\u4E09\u4E2A\u662F\u7BA1\u7406\u9762\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002`);
     }
     case "pin": {
       const { message } = await api.cmd("pin", {
@@ -186851,7 +187089,7 @@ function syncRuntimeAssets(candidateRoots, binDir) {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "0.1.89" : "dev";
+var PKG_VERSION = true ? "0.1.91" : "dev";
 var OASIS_DIR = path29.join(os9.homedir(), ".oasis");
 var CONFIG_FILE = path29.join(OASIS_DIR, "node-config.json");
 var PID_FILE = path29.join(OASIS_DIR, "node.pid");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test",
-  "version": "0.1.89",
+  "version": "0.1.91",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"