@nowcrew/daemon 0.5.18 → 0.5.20

package/README.md

@@ -80,6 +80,25 @@ the local workspace/environment, and launches only a built-in runtime adapter (`
 `kimi`). It does not decide collaboration rules, scheduled output policy, fallback delivery, or thread
 behavior. Those are server responsibilities.
 
+The stable adapters keep prompts out of provider argv wherever the provider protocol allows it:
+
+| Runtime | Transport | System/wake input | Native resume |
+| --- | --- | --- | --- |
+| Claude | stream-json CLI | daemon-owned system prompt file | CLI session id |
+| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume` |
+| Kimi | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
+
+Kimi ACP currently requires a Kimi account even when the CLI has a working custom provider. Only for
+the explicit `Authentication required` response, the adapter retries once through Kimi's stream-json
+CLI and carries the same native session id; unrelated ACP failures stay failures. The CLI fallback is
+subject to the Windows UTF-16 argv guard, while protocol-v1 itself remains disabled on Windows until
+durable Job Object ownership is available.
+
+Codex and Kimi sessions use the same bounded per-task persistence and keyed lease as Claude when they
+run through protocol v1. A first-progress watchdog covers a provider that accepts a turn but remains
+semantically silent; after the first semantic event, the execution's configured total timeout remains
+authoritative so a legitimate long-running tool is not killed for quiet output.
+
 Protocol support and limits are advertised in `machine:hello`. `runtimes` reports every recognized CLI
 found on `PATH`; `executionRuntimes` separately reports the installed CLIs backed by a complete built-in
 adapter. The server must use the latter for admission and treats the former as diagnostic inventory only.
@@ -104,6 +123,10 @@ Before accepting work, the daemon writes a local journal entry under:
 running supervisors are identity-checked and terminated before interruption is reported. A lock prevents
 two daemon processes from sharing one journal.
 
+Protocol v1 is advertised only when the platform has a durable process-tree backend. POSIX uses an
+owned process group. Native Windows intentionally fails admission until a Job Object backend has passed
+crash-cleanup tests; `taskkill /T` is not treated as equivalent ownership.
+
 ## Local Policy
 
 Useful environment controls:

package/dist/attachments.js

@@ -0,0 +1,196 @@
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { basename, extname, resolve, sep } from "node:path";
+export const ATTACHMENT_MAX_FILE_BYTES = 25 * 1024 * 1024;
+export const ATTACHMENT_MAX_TOTAL_BYTES = 50 * 1024 * 1024;
+const throwIfAborted = (signal) => {
+    if (signal?.aborted)
+        throw signal.reason ?? new Error("Attachment materialization aborted");
+};
+function truncateUtf8(value, maxBytes) {
+    let bytes = 0;
+    let output = "";
+    for (const character of value) {
+        const size = Buffer.byteLength(character, "utf8");
+        if (bytes + size > maxBytes)
+            break;
+        output += character;
+        bytes += size;
+    }
+    return output;
+}
+function safeFilename(value) {
+    const leaf = basename(value.replace(/\\/gu, "/"))
+        .replace(/[\u0000-\u001f\u007f]/gu, "_")
+        .replace(/^\.+/u, "")
+        .trim();
+    return truncateUtf8(leaf, 180) || "attachment";
+}
+function collisionName(filename, index) {
+    if (index === 1)
+        return filename;
+    const extension = extname(filename);
+    const stem = extension ? filename.slice(0, -extension.length) : filename;
+    return `${stem}-${index}${extension}`;
+}
+function containedPath(directory, filename) {
+    const target = resolve(directory, filename);
+    if (!target.startsWith(`${resolve(directory)}${sep}`)) {
+        throw new Error("Attachment path escapes the execution directory");
+    }
+    return target;
+}
+function checkedRedirect(value, base) {
+    const url = new URL(value, base);
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new Error("Attachment redirects must use credential-free HTTPS URLs");
+    }
+    return url;
+}
+async function readBounded(response, maxBytes) {
+    const declared = Number(response.headers.get("content-length") ?? "");
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        throw new Error(`Attachment exceeds the ${maxBytes} byte limit`);
+    }
+    if (!response.body)
+        throw new Error("Attachment response body is empty");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    while (true) {
+        const part = await reader.read();
+        if (part.done)
+            break;
+        const chunk = Buffer.from(part.value);
+        size += chunk.length;
+        if (size > maxBytes) {
+            await reader.cancel();
+            throw new Error(`Attachment exceeds the ${maxBytes} byte limit`);
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, size);
+}
+async function downloadAttachment(input) {
+    const initial = new URL(`/agent/attachments/${encodeURIComponent(input.attachment.id)}/download`, input.serverUrl);
+    if (!["http:", "https:"].includes(initial.protocol)
+        || initial.username || initial.password) {
+        throw new Error("Invalid NowWork attachment download URL");
+    }
+    let current = initial;
+    const controller = new AbortController();
+    let timedOut = false;
+    const onAbort = () => controller.abort(input.signal?.reason ?? new Error("Attachment materialization aborted"));
+    input.signal?.addEventListener("abort", onAbort, { once: true });
+    if (input.signal?.aborted)
+        onAbort();
+    const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort(new Error(`Attachment download timed out after ${input.timeoutMs}ms`));
+    }, input.timeoutMs);
+    try {
+        let response = await input.fetchImpl(current, {
+            redirect: "manual",
+            headers: { authorization: `Bearer ${input.token}` },
+            signal: controller.signal,
+        });
+        for (let redirects = 0; [301, 302, 303, 307, 308].includes(response.status); redirects += 1) {
+            if (redirects >= input.maxRedirects)
+                throw new Error("Attachment redirect limit exceeded");
+            const location = response.headers.get("location");
+            if (!location)
+                throw new Error("Attachment redirect is missing a location");
+            current = checkedRedirect(location, current);
+            response = await input.fetchImpl(current, { redirect: "manual", signal: controller.signal });
+        }
+        if (!response.ok)
+            throw new Error(`Attachment download failed with status ${response.status}`);
+        const data = await readBounded(response, input.maxFileBytes);
+        throwIfAborted(input.signal);
+        if (data.length !== input.attachment.sizeBytes) {
+            throw new Error(`Attachment size mismatch: expected ${input.attachment.sizeBytes}, received ${data.length}`);
+        }
+        return data;
+    }
+    catch (error) {
+        if (input.signal?.aborted) {
+            throw input.signal.reason ?? new Error("Attachment materialization aborted");
+        }
+        if (timedOut) {
+            throw new Error(`Attachment download timed out after ${input.timeoutMs}ms`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        input.signal?.removeEventListener("abort", onAbort);
+    }
+}
+export function executionAttachmentDirectory(runDir, executionId) {
+    const attachmentsRoot = resolve(runDir, "attachments");
+    const executionKey = executionId.replace(/[^A-Za-z0-9._-]/gu, "_");
+    const directory = resolve(attachmentsRoot, executionKey);
+    if (!directory.startsWith(`${attachmentsRoot}${sep}`)) {
+        throw new Error("Attachment directory escapes the run directory");
+    }
+    return directory;
+}
+export async function materializeAttachments(input) {
+    throwIfAborted(input.signal);
+    const maxFileBytes = input.maxFileBytes ?? ATTACHMENT_MAX_FILE_BYTES;
+    const maxTotalBytes = input.maxTotalBytes ?? ATTACHMENT_MAX_TOTAL_BYTES;
+    const total = input.attachments.reduce((sum, attachment) => sum + attachment.sizeBytes, 0);
+    if (input.attachments.some((attachment) => attachment.sizeBytes > maxFileBytes)
+        || total > maxTotalBytes) {
+        throw new Error("Attachment metadata exceeds the configured byte limit");
+    }
+    const directory = executionAttachmentDirectory(input.runDir, input.executionId);
+    const used = new Set();
+    const materialized = [];
+    try {
+        await rm(directory, { recursive: true, force: true });
+        throwIfAborted(input.signal);
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        throwIfAborted(input.signal);
+        for (const attachment of input.attachments) {
+            const base = safeFilename(attachment.filename);
+            let collision = 1;
+            let filename = collisionName(base, collision);
+            while (used.has(filename.toLowerCase())) {
+                collision += 1;
+                filename = collisionName(base, collision);
+            }
+            used.add(filename.toLowerCase());
+            const path = containedPath(directory, filename);
+            const data = await downloadAttachment({
+                serverUrl: input.serverUrl,
+                token: input.token,
+                attachment,
+                fetchImpl: input.fetchImpl ?? fetch,
+                maxFileBytes,
+                maxRedirects: input.maxRedirects ?? 3,
+                timeoutMs: input.timeoutMs ?? 10_000,
+                ...(input.signal === undefined ? {} : { signal: input.signal }),
+            });
+            throwIfAborted(input.signal);
+            await writeFile(path, data, {
+                flag: "wx",
+                mode: 0o600,
+                ...(input.signal === undefined ? {} : { signal: input.signal }),
+            });
+            materialized.push({ ...attachment, filename, path });
+        }
+        return { directory, attachments: materialized };
+    }
+    catch (error) {
+        try {
+            await rm(directory, { recursive: true, force: true });
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "Attachment materialization failed and its execution directory could not be removed");
+        }
+        throw error;
+    }
+}
+export async function cleanupMaterializedAttachments(directory) {
+    await rm(directory, { recursive: true, force: true });
+}

package/dist/computer-cli.js

@@ -2,8 +2,10 @@ import { parseArgs } from "node:util";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { daemonHome, listProfiles, loadProfile, profileIsPrivate, profilePath, publicProfile, removeProfile, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
+import { assertProfileAgentsRootUnique, daemonHome, inspectProfileAgentsRoot, listProfiles, loadProfile, PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, ProfileAgentsRootConflictError, profileIsPrivate, profilePath, publicProfile, removeProfile, resolveAgentsRoot, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
 import { buildServiceSpec, doctorService, hardenWindowsProfile, installService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, upgradeDaemon, windowsProfileIsPrivate, } from "./computer-service.js";
+import { defaultProcessController } from "./execution-journal.js";
+import { inspectJournalLock } from "./execution-journal-lock.js";
 import { detectDaemonLang, formatDaemonText } from "./i18n.js";
 const COMPUTER_COMMANDS = new Set(["profile", "doctor", "install", "uninstall", "start", "stop", "restart", "status", "upgrade"]);
 export function builtDaemonEntry(moduleUrl = import.meta.url) {
@@ -60,6 +62,17 @@ function requireValue(value, name, td) {
         throw new Error(td("Missing {{name}}", { name }));
     return value;
 }
+function translatedError(error, td) {
+    if (error instanceof ProfileAgentsRootConflictError) {
+        return td(PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, {
+            profile: error.profile,
+            conflict: error.conflict,
+            agentsRoot: error.agentsRoot,
+            command: error.command,
+        });
+    }
+    return td(error.message);
+}
 export async function runComputerCommand(argv, overrides = {}) {
     const command = argv[0];
     if (!command || !COMPUTER_COMMANDS.has(command))
@@ -88,6 +101,7 @@ export async function runComputerCommand(argv, overrides = {}) {
         const home = daemonHome(deps.env);
         const profileStorage = {
             platform: deps.platform,
+            userHome: deps.userHome,
             ...(deps.profileProtector ? { protector: deps.profileProtector } : {}),
             ...(deps.platform === "win32"
                 ? { harden: (path) => hardenWindowsProfile(path, deps.runner) }
@@ -124,22 +138,28 @@ export async function runComputerCommand(argv, overrides = {}) {
             const machineToken = (fromStdin ? await deps.readStdin() : deps.env.CREW_MACHINE_TOKEN)?.trim();
             if (!machineToken)
                 throw new Error(td("Missing machine token; use CREW_MACHINE_TOKEN or --token-stdin"));
-            await saveProfile({
+            const profile = {
                 name,
                 serverUrl: requireValue(parsed.values["server-url"], "--server-url", td),
                 machineToken,
-                ...(parsed.values["agents-root"] ? { agentsRoot: resolve(parsed.values["agents-root"]) } : {}),
+                ...(parsed.values["agents-root"]
+                    ? { agentsRoot: resolveAgentsRoot(parsed.values["agents-root"], deps.userHome, deps.platform) }
+                    : {}),
                 ...(deps.env.PATH ? { runtimePath: deps.env.PATH } : {}),
-            }, home, profileStorage);
+            };
+            await saveProfile(profile, home, profileStorage);
             deps.stdout(`${td("Saved profile '{{name}}' with private credentials.", { name })}\n`);
             return 0;
         }
         const profileName = parsed.values.profile;
         if (command === "upgrade") {
-            const spec = profileName
+            const restartProfile = profileName
+                ? await loadProfile(profileName, home, profileStorage)
+                : null;
+            const spec = restartProfile
                 ? buildServiceSpec({
                     ...deps,
-                    profile: (await loadProfile(profileName, home, profileStorage)).name,
+                    profile: restartProfile.name,
                     profileHome: home,
                 })
                 : null;
@@ -152,9 +172,18 @@ export async function runComputerCommand(argv, overrides = {}) {
                     throw new Error(td("Service '{{id}}' is not installed", { id: spec.id }));
             }
             await upgradeDaemon(deps.platform, deps.runner);
-            if (profileName) {
+            if (restartProfile) {
+                try {
+                    await assertProfileAgentsRootUnique(restartProfile, home, deps.userHome, profileStorage);
+                }
+                catch (error) {
+                    if (!(error instanceof ProfileAgentsRootConflictError))
+                        throw error;
+                    deps.stdout(`${td("Upgraded daemon but skipped restart for '{{name}}': {{reason}}", { name: restartProfile.name, reason: translatedError(error, td) })}\n`);
+                    return 0;
+                }
                 await serviceAction(spec, "restart", deps.runner);
-                deps.stdout(`${td("Upgraded daemon and restart request accepted for '{{name}}'. Verify with status.", { name: profileName })}\n`);
+                deps.stdout(`${td("Upgraded daemon and restart request accepted for '{{name}}'. Verify with status.", { name: restartProfile.name })}\n`);
             }
             else {
                 deps.stdout(`${td("Upgraded daemon. Installed services were not restarted; pass --profile to restart one.")}\n`);
@@ -162,7 +191,10 @@ export async function runComputerCommand(argv, overrides = {}) {
             return 0;
         }
         const name = requireValue(profileName, "--profile", td);
-        await loadProfile(name, home, profileStorage);
+        const profile = await loadProfile(name, home, profileStorage);
+        if (command === "install" || command === "start" || command === "restart") {
+            await assertProfileAgentsRootUnique(profile, home, deps.userHome, profileStorage);
+        }
         if (!deps.entryPath.endsWith(".js")) {
             throw new Error(td("Service lifecycle requires the built daemon entry (.js), not a TypeScript development entry"));
         }
@@ -199,16 +231,44 @@ export async function runComputerCommand(argv, overrides = {}) {
             const privateFile = deps.platform === "win32"
                 ? await windowsProfileIsPrivate(profilePath(name, home), deps.runner)
                 : await profileIsPrivate(name, home, deps.platform);
-            const checks = await doctorService(spec, privateFile, deps.runner);
+            const serviceChecks = await doctorService(spec, privateFile, deps.runner);
+            const rootInspection = await inspectProfileAgentsRoot(profile, home, deps.userHome, profileStorage);
+            const journalPath = resolve(rootInspection.agentsRoot, ".crew", "executions");
+            const journalLock = await inspectJournalLock({
+                directory: journalPath,
+                inspectIdentity: defaultProcessController.inspectIdentity,
+            });
+            const checks = [
+                ...serviceChecks,
+                {
+                    name: "agents-root-unique",
+                    ok: rootInspection.duplicateProfiles.length === 0,
+                    detail: rootInspection.duplicateProfiles.length === 0
+                        ? "unique"
+                        : `also used by: ${rootInspection.duplicateProfiles.join(", ")}`,
+                },
+                {
+                    name: "journal-lock-health",
+                    ok: journalLock.status === "unlocked" || journalLock.status === "owned",
+                    detail: journalLock.detail,
+                },
+            ];
             const registered = (await serviceStatus(spec, deps.runner)).installed;
-            deps.stdout(`${JSON.stringify({ checks, registered }, null, 2)}\n`);
+            deps.stdout(`${JSON.stringify({
+                agentsRoot: rootInspection.agentsRoot,
+                journalPath,
+                duplicateProfiles: rootInspection.duplicateProfiles,
+                journalLock,
+                checks,
+                registered,
+            }, null, 2)}\n`);
             return checks.every((check) => check.ok) ? 0 : 4;
         }
         deps.stderr(usage(td));
         return 2;
     }
     catch (error) {
-        deps.stderr(`crew-daemon: ${td(error.message)}\n`);
+        deps.stderr(`crew-daemon: ${translatedError(error, td)}\n`);
         return 1;
     }
 }