OriginRouter CLI v0.4.8

OriginRouter CLI v0.4.8

English

This patch fixes cross-device session opening (device directory caching and verification) and repairs several Windows execution paths, including one that made originrouter login unusable.

Device encryption directory

• Scope the device directory cache to the account instead of a single sign-in. Every originrouter login previously started from a cold cache, discarding the pinned key history and leaving superseded files on disk with contradictory views of the same account. An existing session-scoped cache is carried over once and the superseded files are removed.
• Verify each device's key chain independently, so one unverifiable device no longer makes every other device unreachable. The device at fault is quarantined and reported with a specific reason; invalid signatures, unsigned rotations, and mutated pinned keys stay fatal for that device.
• Complete a chain the server serves starting above key version 1 using key history this installation already pinned, so a server-side omission no longer permanently prevents a session from opening. Only previously pinned key IDs are reused.
• Report the actual cause in peer errors, distinguishing a quarantined device from one that is absent or untrusted.
• Remove the superseded legacy_hmac_v2 local authentication path from the CLI and the App. The method is now always negotiated explicitly, and a client that cannot negotiate is told to update rather than falling back to the weaker path.

Windows

• Fix originrouter login opening a truncated URL. The launcher used cmd /c start, and cmd splits unquoted arguments at every &, so the browser received only the first query parameter and the device code was lost.
• Fix originrouter run -- and agent launches failing to execute npm-installed commands. These ship as .cmd shims, which CreateProcess cannot run. Bare names are now resolved against PATH/PATHEXT and shims are routed through cmd.exe. The same fix applies to the pty executor, which reported "File not found".
• Fix system proxy detection, so managed Python and uv can be downloaded from behind a proxy. The registry reader matched a single hardcoded value type and silently returned nothing for any other type.
• Terminate the whole process tree when stopping an agent. Windows has no POSIX process groups, so the previous path could not reach descendants.
• Expand both ~/path and ~\path in workspace, approval policy, audit store, autonomy policy, and agent catalog paths. Two of these only accepted the separator that does not appear on Windows.

Security

• Restrict the state directory holding credentials and device keys by ACL on Windows, where filesystem mode bits have no effect. Access is granted only to the current user and SYSTEM, inheritance is cleared so new secret files are covered automatically, and principals are addressed by SID so the hardening works on localized systems. Best-effort: a directory that refuses ACL edits stays usable and warns once.

Validation: the full CLI test suite passed, including a new Windows ACL test. The Windows fixes were verified on a real Windows 11 machine: the login URL arrives intact where the old path was truncated, a .cmd shim that failed with ENOENT now runs, and the state directory under a deliberately world-readable parent ends up granting only SYSTEM and the current user, with newly written key files inheriting the restriction. git diff --check passed.

After publishing @originrouter/cli@0.4.8 to npm, existing users can check and install the update with:

originrouter update check
originrouter update install

Interactive startup also checks for updates. The default mode prompts the user after a newer npm version is cached; users who selected automatic updates install it when the CLI next starts and the system is idle.

中文

本次修复跨设备会话打开（设备目录缓存与校验），并修复多处 Windows 执行路径问题，其中一处会导致 originrouter login 完全无法使用。

设备加密目录

• 设备目录缓存改为按账户划分，而不是按单次登录。此前每次 originrouter login 都从空缓存开始，丢弃已固定的密钥历史，并在磁盘上留下对同一账户持有矛盾视图的废弃文件。现在会一次性迁移已有的会话级缓存，并删除被取代的文件。
• 每台设备的密钥链独立校验，一台无法校验的设备不再导致其他所有设备不可用。出问题的设备被隔离并给出具体原因；签名无效、轮换未签名、已固定密钥被篡改，对该设备仍然是致命错误。
• 当服务端返回的密钥链从高于版本 1 的位置开始时，使用本机已固定的密钥历史补全该链，避免服务端的遗漏永久阻断会话打开。仅复用此前已固定的 key ID。
• 对端错误报告真实原因，区分「被隔离的设备」与「不存在或未受信的设备」。
• 从 CLI 和 App 两端移除已被取代的 legacy_hmac_v2 本地认证路径。认证方式现在始终显式协商；无法协商的客户端会被要求更新，而不是静默回退到更弱的路径。

Windows

• 修复 originrouter login 打开被截断的 URL。原启动方式使用 cmd /c start，而 cmd 会在每个未加引号的 & 处拆分参数，浏览器只收到第一个查询参数，设备码丢失。
• 修复 originrouter run -- 和 Agent 启动无法执行 npm 安装的命令。这类命令以 .cmd shim 形式安装，CreateProcess 无法直接执行。现在裸命令名会按 PATH/PATHEXT 解析，shim 通过 cmd.exe 执行。同一修复也应用于 pty 执行器（此前报 "File not found"）。
• 修复系统代理检测，使托管 Python 和 uv 能在代理后下载。注册表读取此前只匹配一种硬编码的值类型，其他类型会静默返回空。
• 停止 Agent 时终止整个进程树。Windows 没有 POSIX 进程组，原路径无法触及子进程。
• 在 workspace、审批策略、审计存储、自治策略和 Agent 目录路径中，同时展开 ~/path 和 ~\path。其中两处此前只接受 Windows 上不会出现的分隔符。

安全

• 在 Windows 上通过 ACL 限制存放凭据与设备密钥的状态目录（该平台文件系统权限位无效）。仅授予当前用户和 SYSTEM，并清除继承，使新写入的密钥文件自动受保护；主体按 SID 指定，因此在本地化系统上同样生效。该加固为尽力而为：无法修改 ACL 的目录仍可正常使用，并只警告一次。

验证：CLI 完整测试套件通过，包含新增的 Windows ACL 测试。Windows 修复已在真实 Windows 11 机器上验证：登录 URL 完整送达（旧路径会被截断），此前报 ENOENT 的 .cmd shim 现在可正常执行，在故意放宽权限的父目录下创建的状态目录最终只授予 SYSTEM 和当前用户，新写入的密钥文件继承该限制。git diff --check 通过。

将 @originrouter/cli@0.4.8 发布到 npm 后，已安装用户可以执行：

originrouter update check
originrouter update install

交互式启动也会检查更新。默认模式会在缓存到新版 npm 包后提示用户；选择自动更新模式的用户会在下次启动且系统空闲时安装。