acer: extend kimi surface scanner to cover the exec substrate (closes acer's daimon catch)

liris's v1 scanner walks app.asar only — which structurally misses the local
code-execution substrate (it lives in resources/resources/, outside the asar).
Adds classifyExecSubstrate + probeExecSubstrate (read-only metadata: existence +
size, NEVER extracts the tar) and a KIMISURFACEEXEC row covering
daimon-bundle.tar.gz (python+uv+git), gateway.asar, runtime/node.exe.

Live-verified on acer's real install: daimon_bundle_present=1, ~527MB. This is the
mechanism behind "up to 300 local workers." Scanner unit 6/6, full pyramid 158/158.
Read-only throughout; no token/chat read; no Kimi action.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/kimi-desktop-surface-scan.unit.test.mjs

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict';
 import test from 'node:test';
 
 import {
+  classifyExecSubstrate,
   classifyKimiSurface,
   emitSurfaceRows,
   extractBridgeChannels,
@@ -40,11 +41,23 @@ test('classifies Kimi agent surfaces from a synthetic file table', () => {
 test('emits HBP rows without reading private stores or invoking Kimi actions', () => {
   const c = classifyKimiSurface(['node_modules/@agentclientprotocol/sdk/package.json']);
   const rows = emitSurfaceRows({ classification: c, appAsarPresent: true, webbridgePresent: true, webbridgeSize: 7 });
-  assert.equal(rows.length, 5);
+  assert.equal(rows.length, 6);
   assert.ok(rows.every((row) => row.endsWith('|json=0')));
   assert.ok(rows.join('\n').includes('no-token-read-no-private-chat-read-no-kimi-action'));
 });
 
+test('acer catch: exec substrate OUTSIDE app.asar is classified and emitted (read-only metadata)', () => {
+  const ex = classifyExecSubstrate({ daimonBundle: { present: true, size: 527000000 }, nodeRuntime: { present: true, size: 87000000 } });
+  assert.equal(ex.daimonBundle.present, true);
+  assert.equal(ex.daimonBundle.size, 527000000);
+  assert.equal(ex.gatewayAsar.present, false);
+  assert.equal(ex.gatewayAsar.size, 0);
+  const c = classifyKimiSurface([]);
+  const row = emitSurfaceRows({ classification: c, execSubstrate: ex }).find((r) => r.startsWith('KIMISURFACEEXEC|'));
+  assert.ok(row.includes('daimon_bundle_present=1') && row.includes('node_runtime_present=1'));
+  assert.ok(row.endsWith('|json=0'));
+});
+
 test('walkAsarPaths returns nested slash paths', () => {
   const paths = walkAsarPaths({ files: { a: { files: { b: { files: { 'c.js': { size: 1 } } } } } } });
   assert.deepEqual(paths, ['a', 'a/b', 'a/b/c.js']);

tests/kimi-desktop-surface-scan.unit.test.mjs.sha256

@@ -1 +1 @@
-A724851C0A60290D9342722077FA8EFBE2F1CC4B45F5D3C9A8D5A628E3982040  kimi-desktop-surface-scan.unit.test.mjs
+563c367cbbf42f5332a60ba64364cdbddf7ee4b2680e115b798afaeeb55accb8  kimi-desktop-surface-scan.unit.test.mjs

tools/behcs/kimi-desktop-surface-scan.hbp

@@ -1,6 +1,7 @@
-KIMISURFACETOOL|tool=tools/behcs/kimi-desktop-surface-scan.mjs|status=READONLY-INSPECTION-V1|scope=parse-Kimi-app.asar-file-table-and-webbridge-binary-metadata-only|json=0
-KIMISURFACEPRIVACY|never_reads=bridge-store-token-store+private-chat+localStorage+cookies+account-session|never_invokes=Kimi-IPC+MCP+Skill+Sandbox+WebAgent-actions|json=0
-KIMISURFACEOUTPUT|rows=KIMISURFACEHDR+KIMISURFACEPATHS+KIMISURFACEMARKERS+KIMISURFACEBRIDGE+KIMISURFACEABSORB|format=HBP-only-json0|json=0
+KIMISURFACETOOL|tool=tools/behcs/kimi-desktop-surface-scan.mjs|status=READONLY-INSPECTION-V1.1|scope=parse-Kimi-app.asar-file-table+webbridge-binary-metadata+resources-resources-exec-substrate-metadata-only|json=0
+KIMISURFACEPRIVACY|never_reads=bridge-store-token-store+private-chat+localStorage+cookies+account-session|never_invokes=Kimi-IPC+MCP+Skill+Sandbox+WebAgent-actions|never_extracts=daimon-bundle-tar-contents(presence+size-only)|json=0
+KIMISURFACEOUTPUT|rows=KIMISURFACEHDR+KIMISURFACEPATHS+KIMISURFACEMARKERS+KIMISURFACEBRIDGE+KIMISURFACEEXEC+KIMISURFACEABSORB|format=HBP-only-json0|json=0
+KIMISURFACEACERCATCH|added-by=acer-v1.1|catch=app.asar-only-walk-UNDER-REPORTS-the-local-exec-substrate|now-covered=resources/resources/daimon-bundle.tar.gz(python+uv+git)+gateway.asar+runtime/node.exe-metadata-presence-and-size|why=this-is-the-mechanism-behind-up-to-300-local-workers|json=0
 KIMISURFACEABSORB|patterns=ACP-client-protocol+MCP-registry+SkillService+SandboxService+WebAgent+local-webbridge+workspace-overrides+cron-workspace|target=Asolaria-readonly-observability-and-agent-bridge-design|json=0
 KIMISURFACEGUARD|classification=necessary-not-sufficient|present-marker-means-bundled-surface-not-proof-of-enabled-runtime-capability|json=0
 KIMISURFACEFTR|state=SEALED-READONLY-SCANNER|json=0

tools/behcs/kimi-desktop-surface-scan.hbp.sha256

@@ -1 +1 @@
-010109CA915837C86B77057BC277616DDF1CA3BF4FC67D529C2A5F843B862467  kimi-desktop-surface-scan.hbp
+2c616c64b1f49dbf58e79ef1ae6de77383e2a78e715650fd14c723b73c889f4c  kimi-desktop-surface-scan.hbp

tools/behcs/kimi-desktop-surface-scan.mjs

@@ -89,18 +89,49 @@ export function extractBridgeChannels(text) {
   return IPC_MARKERS.filter((marker) => channelText.includes(marker));
 }
 
+// acer catch (ACER-KIMI-DAIMON-CATCH): the local code-execution substrate lives
+// OUTSIDE app.asar in resources/resources/ -- daimon-bundle.tar.gz (bundles
+// CPython+uv+git), gateway.asar, runtime/node.exe. An app.asar-only walk misses it.
+// Pure classifier over a presence/size probe so it is testable with no Kimi install.
+export function classifyExecSubstrate(probe) {
+  const p = probe || {};
+  const pick = (k) => ({
+    present: Boolean(p[k] && p[k].present),
+    size: (p[k] && Number.isFinite(p[k].size) && p[k].size > 0) ? p[k].size : 0,
+  });
+  return { daimonBundle: pick('daimonBundle'), gatewayAsar: pick('gatewayAsar'), nodeRuntime: pick('nodeRuntime') };
+}
+
+// read-only metadata probe: existence + size only, NEVER extract the tar or read contents.
+export function probeExecSubstrate(resourcesResourcesDir) {
+  const base = resourcesResourcesDir || '';
+  const targets = {
+    daimonBundle: join(base, 'daimon-bundle.tar.gz'),
+    gatewayAsar: join(base, 'gateway.asar'),
+    nodeRuntime: join(base, 'runtime', 'node.exe'),
+  };
+  const probe = {};
+  for (const [k, f] of Object.entries(targets)) {
+    const present = Boolean(base) && existsSync(f);
+    probe[k] = { present, size: present ? statSync(f).size : 0 };
+  }
+  return classifyExecSubstrate(probe);
+}
+
 export function emitSurfaceRows(scan) {
   const s = scan || {};
   const c = s.classification || classifyKimiSurface([]);
   const found = c.found || {};
   const counts = c.counts || {};
   const present = Object.entries(found).filter(([, v]) => v).map(([k]) => k).sort();
+  const ex = s.execSubstrate || classifyExecSubstrate({});
   return [
     `KIMISURFACEHDR|scanner=${SCANNER_ID}|app_asar_present=${s.appAsarPresent ? 1 : 0}|webbridge_present=${s.webbridgePresent ? 1 : 0}|privacy=token-store-and-private-chat-not-read|json=0`,
     `KIMISURFACEPATHS|total_paths=${counts.totalPaths || 0}|kimi_proto_paths=${counts.kimiProtoCount || 0}|proto_service_paths=${counts.protoServiceCount || 0}|renderer_agent_assets=${counts.rendererAgentAssets || 0}|path_digest16=${c.digest || sha16('')}|json=0`,
     `KIMISURFACEMARKERS|present=${present.join('+') || 'none'}|missing=${Object.keys(found).filter((k) => !found[k]).sort().join('+') || 'none'}|json=0`,
     `KIMISURFACEBRIDGE|local_listener_observed=${s.localListenerObserved || 'not-observed-by-this-scanner'}|webbridge_size=${s.webbridgeSize || 0}|webbridge_version=${s.webbridgeVersion || 'unknown'}|json=0`,
-    `KIMISURFACEABSORB|patterns=ACP-client-protocol+MCP-registry+SkillService+SandboxService+WebAgent+local-webbridge+workspace-overrides+cron-workspace|guard=read-only-inspection-no-token-read-no-private-chat-read-no-kimi-action|json=0`,
+    `KIMISURFACEEXEC|daimon_bundle_present=${ex.daimonBundle.present ? 1 : 0}|gateway_asar_present=${ex.gatewayAsar.present ? 1 : 0}|node_runtime_present=${ex.nodeRuntime.present ? 1 : 0}|daimon_bundle_bytes=${ex.daimonBundle.size}|note=local-exec-substrate-OUTSIDE-app.asar-bundles-python-uv-git-metadata-only-NOT-extracted|json=0`,
+    `KIMISURFACEABSORB|patterns=ACP-client-protocol+MCP-registry+SkillService+SandboxService+WebAgent+local-webbridge+workspace-overrides+cron-workspace+daimon-bundle-local-exec-substrate|guard=read-only-inspection-no-token-read-no-private-chat-read-no-kimi-action|json=0`,
   ];
 }
 
@@ -110,6 +141,7 @@ export function scanKimiInstall(options = {}) {
   const appAsar = options.appAsar || join(localAppData, 'Programs', 'kimi-desktop', 'resources', 'app.asar');
   const webbridgeExe = options.webbridgeExe || join(userHome, '.kimi-webbridge', 'bin', 'kimi-webbridge.exe');
   const webbridgeVersionFile = options.webbridgeVersionFile || join(userHome, '.kimi-webbridge', 'bin', 'kimi-webbridge.version');
+  const resourcesResourcesDir = options.resourcesResourcesDir || join(localAppData, 'Programs', 'kimi-desktop', 'resources', 'resources');
 
   let paths = [];
   let appAsarPresent = false;
@@ -132,6 +164,7 @@ export function scanKimiInstall(options = {}) {
     webbridgeSize,
     webbridgeVersion,
     classification: classifyKimiSurface(paths),
+    execSubstrate: probeExecSubstrate(resourcesResourcesDir),
   };
 }
 
@@ -167,6 +200,10 @@ export function selfTest() {
     ['detects-bridge-protocol', c.found.bridgeProtocol],
     ['hbp-rows-only', emitSurfaceRows({ classification: c }).every((row) => row.endsWith('|json=0') && !row.includes('\n'))],
     ['channels-extract', extractBridgeChannels('GET_WORKSPACE_ROOT INSTALL_SKILL OPEN_AS_TEXT').length === 3],
+    ['detects-exec-substrate', classifyExecSubstrate({ daimonBundle: { present: true, size: 527 } }).daimonBundle.present
+      && classifyExecSubstrate({ daimonBundle: { present: true, size: 527 } }).gatewayAsar.present === false],
+    ['exec-row-emitted', emitSurfaceRows({ classification: c, execSubstrate: classifyExecSubstrate({ daimonBundle: { present: true, size: 5 } }) })
+      .some((row) => row.startsWith('KIMISURFACEEXEC|') && row.includes('daimon_bundle_present=1'))],
   ].map(([name, ok]) => ({ name, ok: Boolean(ok) }));
   return { ok: checks.every((c) => c.ok), checks };
 }

tools/behcs/kimi-desktop-surface-scan.mjs.sha256

@@ -1 +1 @@
-44BC130929C3DCA97F491561E4EEF518B4A5E6D020C2F982EEC641DF1EF87B98  kimi-desktop-surface-scan.mjs
+521f678f4547ed98a601f77ea1e6873d326eb02a769163a80c26fef88d5860e2  kimi-desktop-surface-scan.mjs