shennian 0.3.86 → 0.3.88

package/README.md

@@ -19,7 +19,8 @@
 | `shennian pair --browser` | 浏览器授权配对；打不开时会保留 URL |
 | `shennian pair --token` | 使用现有二维码 / Token 配对，适合 SSH / headless |
 | `shennian start` | 启动后台服务 |
-| `shennian stop` | 停止后台服务 |
+| `shennian stop` | 停止后台服务，保留登录 |
+| `shennian logout` | 停止服务并清除本机神念登录与配对凭据，保留模型配置与历史 |
 | `shennian status` | 查看后台服务状态 |
 | `shennian logs -n 100` | 查看最近日志 |
 | `shennian config` | 查看本地配置 |
@@ -28,7 +29,7 @@
 | `shennian runtime add/list/remove` | 管理自定义 Agent Runtime |
 | `shennian upgrade` | 升级 CLI |
 
-`start`、`stop`、`status` 可选加 `--json`。`logs` 输出日志文本，不支持 `--json`。
+`start`、`stop`、`status`、`logout` 可选加 `--json`。`logs` 输出日志文本，不支持 `--json`。
 切换节点后运行 `shennian stop && shennian start` 让后台服务重新连接。
 
 ## 开发

package/dist/bin/shennian.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import '../src/index.js';
+import"../src/index.js";

package/dist/publish-build-manifest.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "jsMinified": true,
   "minifier": "esbuild",
-  "fileCount": 144,
+  "fileCount": 145,
   "files": [
     {
       "file": "bin/shennian.js",
@@ -46,8 +46,8 @@
     },
     {
       "file": "src/agents/codex.js",
-      "beforeBytes": 58249,
-      "afterBytes": 30328
+      "beforeBytes": 64672,
+      "afterBytes": 33374
     },
     {
       "file": "src/agents/command-spec.js",
@@ -199,6 +199,11 @@
       "beforeBytes": 827,
       "afterBytes": 468
     },
+    {
+      "file": "src/commands/logout.js",
+      "beforeBytes": 3040,
+      "afterBytes": 1558
+    },
     {
       "file": "src/commands/manager.js",
       "beforeBytes": 6845,
@@ -261,8 +266,8 @@
     },
     {
       "file": "src/daemon-ipc/paths.js",
-      "beforeBytes": 2006,
-      "afterBytes": 902
+      "beforeBytes": 2796,
+      "afterBytes": 997
     },
     {
       "file": "src/daemon-ipc/protocol.js",
@@ -311,8 +316,8 @@
     },
     {
       "file": "src/index.js",
-      "beforeBytes": 25818,
-      "afterBytes": 13311
+      "beforeBytes": 26931,
+      "afterBytes": 13804
     },
     {
       "file": "src/log-redaction.js",
@@ -351,8 +356,8 @@
     },
     {
       "file": "src/native-fusion/codex-parser.js",
-      "beforeBytes": 29358,
-      "afterBytes": 12136
+      "beforeBytes": 30250,
+      "afterBytes": 12466
     },
     {
       "file": "src/native-fusion/codex-user-input.js",
@@ -386,18 +391,18 @@
     },
     {
       "file": "src/native-fusion/parser-common.js",
-      "beforeBytes": 9178,
-      "afterBytes": 4005
+      "beforeBytes": 11340,
+      "afterBytes": 4643
     },
     {
       "file": "src/native-fusion/parsers.js",
-      "beforeBytes": 5850,
-      "afterBytes": 3235
+      "beforeBytes": 6594,
+      "afterBytes": 3602
     },
     {
       "file": "src/native-fusion/service.js",
-      "beforeBytes": 32663,
-      "afterBytes": 14792
+      "beforeBytes": 34698,
+      "afterBytes": 15552
     },
     {
       "file": "src/native-fusion/session-header.js",
@@ -461,8 +466,8 @@
     },
     {
       "file": "src/room/activation-service.js",
-      "beforeBytes": 21587,
-      "afterBytes": 10726
+      "beforeBytes": 21713,
+      "afterBytes": 10792
     },
     {
       "file": "src/room/attachment-cache.js",
@@ -501,8 +506,8 @@
     },
     {
       "file": "src/room/managed-prompt-composer.js",
-      "beforeBytes": 8751,
-      "afterBytes": 8603
+      "beforeBytes": 9264,
+      "afterBytes": 9441
     },
     {
       "file": "src/room/managed-room-binding.js",
@@ -511,13 +516,13 @@
     },
     {
       "file": "src/room/managed-room-ipc.js",
-      "beforeBytes": 11997,
-      "afterBytes": 5784
+      "beforeBytes": 12245,
+      "afterBytes": 5867
     },
     {
       "file": "src/room/mirror-sync-service.js",
-      "beforeBytes": 7714,
-      "afterBytes": 3498
+      "beforeBytes": 7894,
+      "afterBytes": 3589
     },
     {
       "file": "src/room/public-attachment-cache.js",
@@ -666,8 +671,8 @@
     },
     {
       "file": "src/session/manager.js",
-      "beforeBytes": 30970,
-      "afterBytes": 16083
+      "beforeBytes": 31103,
+      "afterBytes": 16179
     },
     {
       "file": "src/session/native-cleanup-outbox.js",
@@ -686,8 +691,8 @@
     },
     {
       "file": "src/session/queue.js",
-      "beforeBytes": 30478,
-      "afterBytes": 13987
+      "beforeBytes": 33159,
+      "afterBytes": 14816
     },
     {
       "file": "src/session/store.js",

package/dist/src/agents/adapter.js

@@ -1,19 +1 @@
-// @arch docs/architecture/cli/agent-adapters.md
-// @test src/__tests__/agents-e2e.ts
-import { EventEmitter } from 'node:events';
-export class AgentAdapter extends EventEmitter {
-}
-const registry = new Map();
-export function registerAgent(type, factory) {
-    registry.set(type, factory);
-}
-export function unregisterAgent(type) {
-    registry.delete(type);
-}
-export function createAgent(type) {
-    const factory = registry.get(type);
-    return factory ? factory() : null;
-}
-export function getRegisteredAgents() {
-    return [...registry.keys()];
-}
+import{EventEmitter as r}from"node:events";class s extends r{}const n=new Map;function g(e,t){n.set(e,t)}function i(e){n.delete(e)}function c(e){const t=n.get(e);return t?t():null}function p(){return[...n.keys()]}export{s as AgentAdapter,c as createAgent,p as getRegisteredAgents,g as registerAgent,i as unregisterAgent};

package/dist/src/agents/claude-managed-permissions.js

@@ -1,248 +1 @@
-// @arch docs/features/managed-agent-restricted-runtime.md
-// @test src/__tests__/claude-managed-permissions.test.ts
-import fs from 'node:fs';
-import path from 'node:path';
-import { resolveProtectedShennianDirectories } from '../security/managed-agent-credential-paths.js';
-const fullExternalCapabilitySupport = {
-    commandNetwork: { allow: true, deny: true },
-    webSearch: { allow: true, deny: true },
-    browser: { allow: true, deny: true },
-    // Claude Code's computer-use surface controls the real desktop and does not
-    // currently expose a Shennian-verifiable, non-interactive permission gate.
-    computerUse: { allow: false, deny: true },
-    mcp: { allow: true, deny: true },
-};
-/**
- * v2.1.260 is the first evidence baseline used by Shennian: it includes
- * restricted mode, source isolation, fail-closed sandbox startup, credential
- * scrubbing, outside-workspace read blocking, and the macOS fix for that read
- * boundary. Unknown and older builds therefore resolve as unverified.
- */
-export const CLAUDE_MANAGED_RUNTIME_SECURITY = {
-    minimumRuntimeVersion: '2.1.260',
-    maximumRuntimeVersionExclusive: '2.2.0',
-    platforms: {
-        darwin: {
-            level: 'hard',
-            fileAccess: { 'workspace-read': true, 'workspace-write': true, 'host-full': true },
-            externalCapabilities: fullExternalCapabilitySupport,
-        },
-        linux: {
-            level: 'partial',
-            fileAccess: { 'workspace-read': true, 'workspace-write': true, 'host-full': true },
-            externalCapabilities: fullExternalCapabilitySupport,
-            knownGaps: ['internalTransport.unixSocketGranularity'],
-        },
-        wsl: {
-            level: 'partial',
-            fileAccess: { 'workspace-read': true, 'workspace-write': true, 'host-full': true },
-            externalCapabilities: fullExternalCapabilitySupport,
-            knownGaps: ['internalTransport.unixSocketGranularity'],
-        },
-        win32: {
-            level: 'partial',
-            fileAccess: { 'workspace-read': false, 'workspace-write': false, 'host-full': true },
-            externalCapabilities: {
-                commandNetwork: { allow: true, deny: false },
-                webSearch: { allow: true, deny: true },
-                browser: { allow: true, deny: true },
-                computerUse: { allow: false, deny: true },
-                mcp: { allow: true, deny: true },
-            },
-            knownGaps: ['sandbox.nativeWindowsUnavailable'],
-        },
-    },
-};
-const SENSITIVE_PERMISSION_PATHS = [
-    '//**/.env',
-    '//**/.env.*',
-    '//**/*.key',
-    '//**/*.pem',
-    '~/.ssh/**',
-    '~/.aws/**',
-    '~/.azure/**',
-    '~/.config/gcloud/**',
-    '~/.netrc',
-    '~/.npmrc',
-    '~/.shennian/**',
-];
-const SENSITIVE_SANDBOX_PATHS = [
-    '/**/.env',
-    '/**/.env.*',
-    '/**/*.key',
-    '/**/*.pem',
-    '~/.ssh',
-    '~/.aws',
-    '~/.azure',
-    '~/.config/gcloud',
-    '~/.netrc',
-    '~/.npmrc',
-];
-const SHENNIAN_HOME_SANDBOX_PATH = '~/.shennian';
-const READ_TOOLS = ['Read', 'Glob', 'Grep', 'LSP'];
-const WRITE_TOOLS = ['Edit', 'Write', 'NotebookEdit'];
-/**
- * Converts the daemon-verified effective policy into Claude Code's native,
- * invocation-scoped permission and sandbox configuration. It never writes to
- * ~/.claude or the project's .claude directory.
- */
-export function compileClaudeManagedPermissions(enforcement, resolvedWorkDir, options = {}) {
-    const workDir = validateResolvedWorkDir(resolvedWorkDir);
-    const policy = enforcement.effectivePolicy;
-    const hardSandbox = enforcement.platform !== 'win32';
-    const internalReadPaths = normalizeAbsolutePaths(options.internalReadPaths);
-    const internalUnixSockets = normalizeAbsolutePaths(options.internalUnixSockets);
-    const fileRoot = normalizeForClaude(path.parse(workDir).root);
-    const normalizedWorkDir = normalizeForClaude(workDir);
-    const hostFull = policy.fileAccess === 'host-full';
-    const workspaceWritable = policy.fileAccess === 'workspace-write';
-    const shennianDirectories = resolveProtectedShennianDirectories();
-    const allowRules = [];
-    if (workspaceWritable)
-        allowRules.push('Edit(/**)');
-    if (hostFull)
-        allowRules.push('Read', 'Edit');
-    if (policy.externalCapabilities.webSearch)
-        allowRules.push('WebSearch', 'WebFetch');
-    if (policy.externalCapabilities.mcp)
-        allowRules.push('mcp__*');
-    // Native Windows has no Bash sandbox. The compiler has already widened the
-    // effective policy and required limited-protection confirmation before this
-    // unsandboxed command surface can be reached.
-    if (!hardSandbox)
-        allowRules.push('Bash', 'PowerShell');
-    const denyRules = [
-        ...SENSITIVE_PERMISSION_PATHS.flatMap((entry) => [`Read(${entry})`, `Edit(${entry})`]),
-        ...shennianDirectories.flatMap((entry) => [
-            `Read(${toClaudeAbsolutePermissionPattern(entry)}/**)`,
-            `Edit(${toClaudeAbsolutePermissionPattern(entry)}/**)`,
-        ]),
-        ...(!policy.externalCapabilities.webSearch ? ['WebSearch', 'WebFetch'] : []),
-        ...(!policy.externalCapabilities.mcp ? ['mcp__*'] : []),
-    ];
-    const filesystem = hardSandbox
-        ? {
-            disabled: false,
-            // Claude's sandbox allowRead entries take precedence over denyRead.
-            // This keeps the product-owned directory opaque while restoring only
-            // the exact daemon transport files needed by the scoped Room CLI.
-            allowRead: [...new Set([normalizedWorkDir, ...internalReadPaths])],
-            allowWrite: hostFull ? [fileRoot] : workspaceWritable ? [normalizedWorkDir] : [],
-            denyRead: [
-                ...SENSITIVE_SANDBOX_PATHS,
-                SHENNIAN_HOME_SANDBOX_PATH,
-                ...shennianDirectories,
-            ],
-            denyWrite: [
-                ...SENSITIVE_SANDBOX_PATHS,
-                SHENNIAN_HOME_SANDBOX_PATH,
-                ...shennianDirectories,
-                ...(!hostFull && !workspaceWritable ? [normalizedWorkDir] : []),
-            ],
-        }
-        : undefined;
-    const network = hardSandbox
-        ? {
-            allowedDomains: policy.externalCapabilities.commandNetwork ? ['*'] : [],
-            deniedDomains: policy.externalCapabilities.commandNetwork ? [] : ['*'],
-            strictAllowlist: true,
-            allowLocalBinding: policy.externalCapabilities.commandNetwork,
-            allowUnixSockets: enforcement.platform === 'darwin' ? internalUnixSockets : [],
-            // Linux/WSL only expose an all-or-nothing AF_UNIX switch. The
-            // filesystem layer still exposes only the exact daemon path, but the
-            // runtime declaration reports this platform as partial.
-            allowAllUnixSockets: (enforcement.platform === 'linux' || enforcement.platform === 'wsl') &&
-                internalUnixSockets.length > 0,
-        }
-        : undefined;
-    const settings = {
-        permissions: {
-            defaultMode: 'dontAsk',
-            disableBypassPermissionsMode: 'disable',
-            disableAutoMode: 'disable',
-            blockReadsOutsideWorkingDirectories: !hostFull,
-            allow: [...new Set(allowRules)].sort(),
-            deny: [...new Set(denyRules)].sort(),
-        },
-        disableArtifact: true,
-        disableRemoteControl: true,
-        disableWorkflows: true,
-        disableClaudeAiConnectors: !policy.externalCapabilities.mcp,
-        ...(hardSandbox
-            ? {
-                sandbox: {
-                    enabled: true,
-                    failIfUnavailable: true,
-                    autoAllowBashIfSandboxed: true,
-                    allowUnsandboxedCommands: false,
-                    excludedCommands: [],
-                    allowAppleEvents: false,
-                    filesystem,
-                    network,
-                    credentials: {
-                        files: SENSITIVE_SANDBOX_PATHS.map((entry) => ({ path: entry, mode: 'deny' })),
-                        envVars: normalizeEnvKeys(options.shellSubprocessPolicy?.deniedEnvKeys).map((name) => ({ name, mode: 'deny' })),
-                    },
-                },
-            }
-            : {}),
-    };
-    const tools = [
-        'Bash',
-        ...READ_TOOLS,
-        ...(workspaceWritable || hostFull ? WRITE_TOOLS : []),
-        ...(policy.externalCapabilities.webSearch ? ['WebSearch', 'WebFetch'] : []),
-    ];
-    const args = [
-        '--restricted',
-        '--setting-sources',
-        '',
-        '--settings',
-        JSON.stringify(settings),
-        '--permission-mode',
-        'dontAsk',
-        '--tools',
-        [...new Set(tools)].join(','),
-        policy.externalCapabilities.browser ? '--chrome' : '--no-chrome',
-    ];
-    if (hostFull)
-        args.push('--add-dir', fileRoot);
-    if (!policy.externalCapabilities.mcp) {
-        args.push('--strict-mcp-config', '--mcp-config', JSON.stringify({ mcpServers: {} }));
-    }
-    return { settings, args };
-}
-function validateResolvedWorkDir(value) {
-    const normalized = path.normalize(value.trim());
-    if (!normalized || !path.isAbsolute(normalized)) {
-        throw new Error('claude_managed_workdir_invalid');
-    }
-    let realPath;
-    try {
-        realPath = fs.realpathSync(normalized);
-    }
-    catch {
-        throw new Error('claude_managed_workdir_unavailable');
-    }
-    if (path.normalize(realPath) !== normalized) {
-        throw new Error('claude_managed_workdir_not_realpath');
-    }
-    return normalized;
-}
-function normalizeAbsolutePaths(values) {
-    return [...new Set(values ?? [])]
-        .map((entry) => path.normalize(entry.trim()))
-        .filter((entry) => entry && path.isAbsolute(entry))
-        .map(normalizeForClaude)
-        .sort();
-}
-function normalizeForClaude(value) {
-    return value.replaceAll('\\', '/');
-}
-function toClaudeAbsolutePermissionPattern(value) {
-    const normalized = normalizeForClaude(value);
-    return normalized.startsWith('/') ? `/${normalized}` : `//${normalized}`;
-}
-function normalizeEnvKeys(values) {
-    return [...new Set(values ?? [])].filter((value) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(value)).sort();
-}
+import g from"node:fs";import n from"node:path";import{resolveProtectedShennianDirectories as N}from"../security/managed-agent-credential-paths.js";const m={commandNetwork:{allow:!0,deny:!0},webSearch:{allow:!0,deny:!0},browser:{allow:!0,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!0,deny:!0}},M={minimumRuntimeVersion:"2.1.260",maximumRuntimeVersionExclusive:"2.2.0",platforms:{darwin:{level:"hard",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m},linux:{level:"partial",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m,knownGaps:["internalTransport.unixSocketGranularity"]},wsl:{level:"partial",fileAccess:{"workspace-read":!0,"workspace-write":!0,"host-full":!0},externalCapabilities:m,knownGaps:["internalTransport.unixSocketGranularity"]},win32:{level:"partial",fileAccess:{"workspace-read":!1,"workspace-write":!1,"host-full":!0},externalCapabilities:{commandNetwork:{allow:!0,deny:!1},webSearch:{allow:!0,deny:!0},browser:{allow:!0,deny:!0},computerUse:{allow:!1,deny:!0},mcp:{allow:!0,deny:!0}},knownGaps:["sandbox.nativeWindowsUnavailable"]}}},P=["//**/.env","//**/.env.*","//**/*.key","//**/*.pem","~/.ssh/**","~/.aws/**","~/.azure/**","~/.config/gcloud/**","~/.netrc","~/.npmrc","~/.shennian/**"],f=["/**/.env","/**/.env.*","/**/*.key","/**/*.pem","~/.ssh","~/.aws","~/.azure","~/.config/gcloud","~/.netrc","~/.npmrc"],x="~/.shennian",W=["Read","Glob","Grep","LSP"],z=["Edit","Write","NotebookEdit"];function G(a,e,l={}){const b=D(e),t=a.effectivePolicy,s=a.platform!=="win32",_=A(l.internalReadPaths),h=A(l.internalUnixSockets),S=d(n.parse(b).root),u=d(b),i=t.fileAccess==="host-full",c=t.fileAccess==="workspace-write",p=N(),o=[];c&&o.push("Edit(/**)"),i&&o.push("Read","Edit"),t.externalCapabilities.webSearch&&o.push("WebSearch","WebFetch"),t.externalCapabilities.mcp&&o.push("mcp__*"),s||o.push("Bash","PowerShell");const E=[...P.flatMap(r=>[`Read(${r})`,`Edit(${r})`]),...p.flatMap(r=>[`Read(${y(r)}/**)`,`Edit(${y(r)}/**)`]),...t.externalCapabilities.webSearch?[]:["WebSearch","WebFetch"],...t.externalCapabilities.mcp?[]:["mcp__*"]],C=s?{disabled:!1,allowRead:[...new Set([u,..._])],allowWrite:i?[S]:c?[u]:[],denyRead:[...f,x,...p],denyWrite:[...f,x,...p,...!i&&!c?[u]:[]]}:void 0,v=s?{allowedDomains:t.externalCapabilities.commandNetwork?["*"]:[],deniedDomains:t.externalCapabilities.commandNetwork?[]:["*"],strictAllowlist:!0,allowLocalBinding:t.externalCapabilities.commandNetwork,allowUnixSockets:a.platform==="darwin"?h:[],allowAllUnixSockets:(a.platform==="linux"||a.platform==="wsl")&&h.length>0}:void 0,k={permissions:{defaultMode:"dontAsk",disableBypassPermissionsMode:"disable",disableAutoMode:"disable",blockReadsOutsideWorkingDirectories:!i,allow:[...new Set(o)].sort(),deny:[...new Set(E)].sort()},disableArtifact:!0,disableRemoteControl:!0,disableWorkflows:!0,disableClaudeAiConnectors:!t.externalCapabilities.mcp,...s?{sandbox:{enabled:!0,failIfUnavailable:!0,autoAllowBashIfSandboxed:!0,allowUnsandboxedCommands:!1,excludedCommands:[],allowAppleEvents:!1,filesystem:C,network:v,credentials:{files:f.map(r=>({path:r,mode:"deny"})),envVars:I(l.shellSubprocessPolicy?.deniedEnvKeys).map(r=>({name:r,mode:"deny"}))}}}:{}},R=["Bash",...W,...c||i?z:[],...t.externalCapabilities.webSearch?["WebSearch","WebFetch"]:[]],w=["--restricted","--setting-sources","","--settings",JSON.stringify(k),"--permission-mode","dontAsk","--tools",[...new Set(R)].join(","),t.externalCapabilities.browser?"--chrome":"--no-chrome"];return i&&w.push("--add-dir",S),t.externalCapabilities.mcp||w.push("--strict-mcp-config","--mcp-config",JSON.stringify({mcpServers:{}})),{settings:k,args:w}}function D(a){const e=n.normalize(a.trim());if(!e||!n.isAbsolute(e))throw new Error("claude_managed_workdir_invalid");let l;try{l=g.realpathSync(e)}catch{throw new Error("claude_managed_workdir_unavailable")}if(n.normalize(l)!==e)throw new Error("claude_managed_workdir_not_realpath");return e}function A(a){return[...new Set(a??[])].map(e=>n.normalize(e.trim())).filter(e=>e&&n.isAbsolute(e)).map(d).sort()}function d(a){return a.replaceAll("\\","/")}function y(a){const e=d(a);return e.startsWith("/")?`/${e}`:`//${e}`}function I(a){return[...new Set(a??[])].filter(e=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)).sort()}export{M as CLAUDE_MANAGED_RUNTIME_SECURITY,G as compileClaudeManagedPermissions};