@nowcrew/daemon 0.5.35 → 0.5.37

package/dist/daemon-installation.js

@@ -0,0 +1,38 @@
+import { realpathSync } from "node:fs";
+import { basename, dirname, resolve } from "node:path";
+function canonicalPath(path, realpath) {
+    try {
+        return realpath(path);
+    }
+    catch (error) {
+        const code = error.code;
+        return code === "ENOENT" || code === "ENOTDIR" ? resolve(path) : null;
+    }
+}
+export function daemonGlobalInstallation(entryPath, platform, realpath = realpathSync.native) {
+    if (platform !== "darwin" && platform !== "linux")
+        return null;
+    const packageRoot = resolve(dirname(entryPath), "..");
+    const globalNodeModules = resolve(packageRoot, "..", "..");
+    const libDirectory = dirname(globalNodeModules);
+    if (basename(globalNodeModules) !== "node_modules" || basename(libDirectory) !== "lib")
+        return null;
+    if (resolve(entryPath) !== resolve(packageRoot, "dist", "main.js"))
+        return null;
+    if (resolve(packageRoot) !== resolve(globalNodeModules, "@nowcrew", "daemon"))
+        return null;
+    const canonicalPackageRoot = canonicalPath(packageRoot, realpath);
+    const canonicalGlobalNodeModules = canonicalPath(globalNodeModules, realpath);
+    const canonicalNpmPrefix = canonicalPath(dirname(libDirectory), realpath);
+    if (canonicalPackageRoot === null || canonicalGlobalNodeModules === null || canonicalNpmPrefix === null)
+        return null;
+    if (canonicalPackageRoot !== resolve(canonicalGlobalNodeModules, "@nowcrew", "daemon"))
+        return null;
+    if (canonicalGlobalNodeModules !== resolve(canonicalNpmPrefix, "lib", "node_modules"))
+        return null;
+    return {
+        packageRoot: canonicalPackageRoot,
+        globalNodeModules: canonicalGlobalNodeModules,
+        npmPrefix: canonicalNpmPrefix,
+    };
+}

package/dist/daemon-update-controller.js

@@ -7,6 +7,7 @@ const DaemonUpdateMessageSchema = z.object({
 export function createDaemonUpdateController(deps) {
     const handled = new Set();
     let running = null;
+    let restartHandoff = null;
     const failed = (updateId, errorCode) => {
         deps.sendStatus({ type: "daemon:update-status", updateId, status: "failed", errorCode });
     };
@@ -19,6 +20,7 @@ export function createDaemonUpdateController(deps) {
         const installed = await deps.install({
             targetVersion: message.targetVersion,
             packageRoot: eligibility.packageRoot,
+            npmPrefix: eligibility.npmPrefix,
             onInstalling: () => {
                 deps.sendStatus({ type: "daemon:update-status", updateId: message.updateId, status: "installing" });
             },
@@ -27,16 +29,42 @@ export function createDaemonUpdateController(deps) {
             failed(message.updateId, installed.errorCode);
             return;
         }
+        let released = false;
+        const releaseOnce = async () => {
+            if (released)
+                return;
+            released = true;
+            await installed.release();
+        };
         deps.sendStatus({ type: "daemon:update-status", updateId: message.updateId, status: "restarting" });
         try {
-            deps.scheduleRestart(eligibility.serviceSpec);
+            const handoff = deps.scheduleRestart(eligibility.serviceSpec);
+            const state = {
+                release: releaseOnce,
+                shutdownBegun: false,
+                failureTask: Promise.resolve(),
+            };
+            state.failureTask = handoff.failed.then(async () => {
+                if (state.shutdownBegun)
+                    return;
+                await state.release();
+                failed(message.updateId, "restart_failed");
+            });
+            restartHandoff = state;
         }
         catch {
-            await installed.release();
+            await releaseOnce();
             failed(message.updateId, "restart_failed");
         }
     };
     return {
+        drain: async () => {
+            await running?.done;
+            if (restartHandoff !== null) {
+                restartHandoff.shutdownBegun = true;
+                await restartHandoff.release();
+            }
+        },
         handle: async (input) => {
             const parsed = DaemonUpdateMessageSchema.safeParse(input);
             if (!parsed.success)

package/dist/daemon-update-eligibility.js

@@ -1,12 +1,13 @@
 import { access } from "node:fs/promises";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { resolve } from "node:path";
-import { daemonHome, listProfiles } from "./computer-profile.js";
-import { builtDaemonEntry, isGlobalDaemonEntry } from "./computer-cli.js";
-import { buildServiceSpec, serviceStatus, systemCommandRunner, } from "./computer-service.js";
+import { daemonHome, loadProfile, resolveAgentsRoot } from "./computer-profile.js";
+import { builtDaemonEntry } from "./computer-cli.js";
+import { buildServiceSpec, readServiceDescriptor, serviceStatus, } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { daemonInstallationLeaseHeld } from "./daemon-installation-lease.js";
+import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, serviceDescriptorSha256, } from "./managed-service-registry.js";
 function defaults() {
-    const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
     return {
         platform: process.platform,
         profileHome: daemonHome(),
@@ -14,16 +15,13 @@ function defaults() {
         uid: process.getuid?.(),
         nodePath: process.execPath,
         entryPath: builtDaemonEntry(),
-        resolveGlobalNodeModules: async () => {
-            const result = await systemCommandRunner(npmCommand, ["root", "--global"]);
-            if (result.exitCode !== 0 || !result.stdout.trim()) {
-                throw new Error(result.stderr.trim() || "global npm root unavailable");
-            }
-            return result.stdout.trim();
-        },
-        listProfiles,
+        loadProfile,
+        readManagedServices: () => readManagedServiceRegistry(),
+        listManagedDescriptorPaths: () => listManagedServiceDescriptorPaths(process.platform, homedir()),
+        readServiceDescriptor,
         serviceStatus,
         assertWritable: (path) => access(path, constants.W_OK),
+        installationLeaseHeld: daemonInstallationLeaseHeld,
     };
 }
 export async function detectDaemonUpdateEligibility(profileName, overrides = {}) {
@@ -33,39 +31,73 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
     }
     if (!profileName)
         return { eligible: false, reason: "profile_required" };
-    let globalNodeModules;
+    const installation = daemonGlobalInstallation(deps.entryPath, deps.platform);
+    if (installation === null)
+        return { eligible: false, reason: "global_install_required" };
+    let profile;
     try {
-        globalNodeModules = await deps.resolveGlobalNodeModules();
+        profile = await deps.loadProfile(profileName, deps.profileHome, {
+            platform: deps.platform,
+            userHome: deps.userHome,
+        });
     }
     catch {
-        return { eligible: false, reason: "global_install_required" };
+        return { eligible: false, reason: "managed_service_identity_mismatch" };
     }
-    if (!isGlobalDaemonEntry(deps.entryPath, globalNodeModules)) {
-        return { eligible: false, reason: "global_install_required" };
+    const spec = buildServiceSpec({
+        platform: deps.platform,
+        profile: profileName,
+        userHome: deps.userHome,
+        uid: deps.uid,
+        nodePath: deps.nodePath,
+        entryPath: deps.entryPath,
+        profileHome: deps.profileHome,
+    });
+    const status = await deps.serviceStatus(spec);
+    if (!status.running)
+        return { eligible: false, reason: "service_not_running" };
+    let services;
+    try {
+        services = await deps.readManagedServices();
+    }
+    catch {
+        return { eligible: false, reason: "managed_service_registry_invalid" };
     }
-    const profiles = await deps.listProfiles(deps.profileHome);
-    const installed = [];
-    for (const profile of profiles) {
-        const spec = buildServiceSpec({
+    const registered = services.find((record) => record.serviceId === spec.id
+        || (record.daemonHome === deps.profileHome && record.profile === profileName));
+    if (registered === undefined) {
+        return { eligible: false, reason: "managed_service_not_registered" };
+    }
+    try {
+        assertRegistryCoversDescriptors(services, await deps.listManagedDescriptorPaths());
+    }
+    catch {
+        return { eligible: false, reason: "managed_service_registry_incomplete" };
+    }
+    const descriptor = await deps.readServiceDescriptor(spec).catch(() => null);
+    if (descriptor === null || spec.descriptorPath === null || spec.descriptor === null
+        || !managedServiceIdentityMatches(registered, {
+            version: 1,
             platform: deps.platform,
-            profile,
-            userHome: deps.userHome,
-            uid: deps.uid,
+            serviceId: spec.id,
+            profile: profileName,
+            daemonHome: deps.profileHome,
+            agentsRoot: resolveAgentsRoot(profile.agentsRoot, deps.userHome, deps.platform),
             nodePath: deps.nodePath,
             entryPath: deps.entryPath,
-            profileHome: deps.profileHome,
-        });
-        const status = await deps.serviceStatus(spec);
-        if (status.installed)
-            installed.push({ profile, spec, running: status.running });
+            packageRoot: installation.packageRoot,
+            npmPrefix: installation.npmPrefix,
+            descriptorPath: spec.descriptorPath,
+            descriptorSha256: serviceDescriptorSha256(descriptor),
+        })
+        || descriptor !== spec.descriptor) {
+        return { eligible: false, reason: "managed_service_identity_mismatch" };
+    }
+    if (!deps.installationLeaseHeld(installation.npmPrefix)) {
+        return { eligible: false, reason: "installation_lease_missing" };
     }
-    const current = installed.find((entry) => entry.profile === profileName);
-    if (!current?.running)
-        return { eligible: false, reason: "service_not_running" };
-    if (installed.length !== 1)
-        return { eligible: false, reason: "multiple_managed_profiles" };
     try {
-        await deps.assertWritable(globalNodeModules);
+        await deps.assertWritable(installation.globalNodeModules);
     }
     catch {
         return { eligible: false, reason: "global_root_not_writable" };
@@ -73,8 +105,7 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
     return {
         eligible: true,
         profileName,
-        globalNodeModules,
-        packageRoot: resolve(globalNodeModules, "@nowcrew", "daemon"),
-        serviceSpec: current.spec,
+        ...installation,
+        serviceSpec: spec,
     };
 }

package/dist/daemon-updater.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { systemCommandRunner } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
 const RELEASED_VERSION_RE = /^\d+\.\d+\.\d+$/;
 async function readPackageVersion(packageRoot) {
     const body = JSON.parse(await readFile(resolve(packageRoot, "package.json"), "utf8"));
@@ -10,6 +11,12 @@ export async function installExactDaemonUpdate(input) {
     if (!RELEASED_VERSION_RE.test(input.targetVersion)) {
         return { ok: false, errorCode: "ineligible" };
     }
+    const installation = daemonGlobalInstallation(input.currentEntryPath ?? process.argv[1] ?? "", input.platform ?? process.platform);
+    if (installation === null
+        || installation.packageRoot !== input.packageRoot
+        || installation.npmPrefix !== input.npmPrefix) {
+        return { ok: false, errorCode: "ineligible" };
+    }
     const local = input.localSlots.tryAcquireExclusive();
     if (local === null)
         return { ok: false, errorCode: "runtime_busy" };
@@ -26,6 +33,13 @@ export async function installExactDaemonUpdate(input) {
         await host.release();
         local.release();
     };
+    const lockedInstallation = daemonGlobalInstallation(input.currentEntryPath ?? process.argv[1] ?? "", input.platform ?? process.platform);
+    if (lockedInstallation === null
+        || lockedInstallation.packageRoot !== input.packageRoot
+        || lockedInstallation.npmPrefix !== input.npmPrefix) {
+        await release();
+        return { ok: false, errorCode: "ineligible" };
+    }
     const runner = input.runner ?? systemCommandRunner;
     try {
         await input.onInstalling?.();
@@ -37,6 +51,8 @@ export async function installExactDaemonUpdate(input) {
     const result = await runner(process.platform === "win32" ? "npm.cmd" : "npm", [
         "install",
         "--global",
+        "--prefix",
+        input.npmPrefix,
         "--ignore-scripts",
         "--no-audit",
         "--no-fund",

package/dist/i18n.js

@@ -42,7 +42,7 @@ const zh = {
     "Saved profile '{{name}}' with private credentials.": "已保存配置 '{{name}}'，凭证仅私有可读。",
     "Service '{{id}}' is not installed": "服务 '{{id}}' 尚未安装",
     "Upgraded daemon and restart request accepted for '{{name}}'. Verify with status.": "daemon 已升级，并已请求重启 '{{name}}'；请用 status 确认。",
-    "Upgraded daemon but skipped restart for '{{name}}': {{reason}}": "daemon 已升级，但已跳过 '{{name}}' 的重启：{{reason}}",
+    "Refused daemon upgrade for '{{name}}': {{reason}}": "已拒绝升级 daemon '{{name}}'：{{reason}}",
     "Upgraded daemon. Installed services were not restarted; pass --profile to restart one.": "daemon 已升级；已安装服务尚未重启，可传入 --profile 重启指定服务。",
     "Service lifecycle requires the built daemon entry (.js), not a TypeScript development entry": "服务生命周期必须使用已构建的 daemon 入口（.js），不能使用 TypeScript 开发入口",
     "Installed '{{id}}'. Use status to confirm runtime state.": "已安装 '{{id}}'；请用 status 确认运行状态。",

package/dist/local-executor.js

@@ -18,6 +18,19 @@ import { routeRuntimeAttachments, runtimeCapability, } from "./runtime-capabilit
 import { awaitWithCancellation, RuntimeCancelledError, } from "./runtime-cancellation.js";
 import { isRuntimeReadyEvent, } from "./runtime-startup-gate.js";
 import { dslog } from "./slog.js";
+import { inspectMemoryPruneFiles, parseMemoryPruneTraceId, } from "./memory-prune-diagnostics.js";
+function memoryPruneSnapshotFields(snapshot) {
+    const fields = {};
+    for (const [label, fact] of Object.entries(snapshot)) {
+        fields[`${label}_exists`] = fact.exists;
+        fields[`${label}_size`] = fact.size;
+        fields[`${label}_mtime_ms`] = fact.mtime_ms;
+        fields[`${label}_sha256`] = fact.sha256;
+        fields[`${label}_hash_skipped_reason`] = fact.hash_skipped_reason;
+        fields[`${label}_error`] = fact.error;
+    }
+    return fields;
+}
 function truncateUtf8(value, maxBytes) {
     if (maxBytes <= 0)
         return "";
@@ -204,6 +217,10 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     let materialized = null;
     let knownAttachmentDirectory = null;
     let startupReservation = null;
+    let memoryPruneTraceId = null;
+    let memoryPruneRuntimeExitCode;
+    let memoryPruneExecutorCompleted = false;
+    let memoryPruneFailurePhase = "diagnostics_before";
     try {
         if (isDeepSeekCodex && !providerConfig.providerApiKey) {
             throw new Error("DeepSeek API key is not configured for this Agent");
@@ -268,7 +285,20 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         const attachmentPlan = routeRuntimeAttachments(runtime.name, materialized?.attachments ?? []);
         const wakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
+        memoryPruneTraceId = parseMemoryPruneTraceId(wakePrompt);
+        if (memoryPruneTraceId !== null) {
+            const snapshot = await inspectMemoryPruneFiles(workspace.dir, workspace.workLogPath);
+            dslog("memory_prune.files_before", "长期记忆收尾执行前文件指纹", {
+                execution_id: input.executionId,
+                agent_handle: input.handle,
+                task_key: input.taskKey,
+                prune_trace_id: memoryPruneTraceId,
+                ...memoryPruneSnapshotFields(snapshot),
+            });
+        }
+        memoryPruneFailurePhase = "prompt_write";
         await awaitWithCancellation(writeFile(workspace.systemPromptPath, systemPrompt, "utf8"), dependencies.cancellation);
+        memoryPruneFailurePhase = "runtime_prepare";
         const inheritedEnv = { ...process.env };
         for (const key of Object.keys(inheritedEnv)) {
             if (key.startsWith("CREW_AGENT_MEMORY_"))
@@ -321,6 +351,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             }
         }
         const runtimeLaunchAt = Date.now();
+        memoryPruneFailurePhase = "runtime_launch";
         const launchRequest = {
             runtime: runtime.name,
             bin: runtime.name,
@@ -342,6 +373,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const child = input.projectSkills !== undefined && dependencies.projectSkills !== undefined
             ? await dependencies.projectSkills.prepareAndLaunch(input.launch.agentsRoot, input.handle, input.projectSkills, () => launchRuntime(launchRequest))
             : await launchRuntime(launchRequest);
+        memoryPruneFailurePhase = "runtime_execution";
         if (child.cancel !== undefined) {
             dependencies.cancellation?.register(child.cancel);
         }
@@ -456,6 +488,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             throw error;
         }
         const { exitCode, spawnError, terminationSignal } = runtimeExit;
+        memoryPruneRuntimeExitCode = exitCode;
         const errorTail = [
             stderrTail.trim(),
             spawnError,
@@ -470,6 +503,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             }
         }
         if (input.session.enabled && supportsNativeResume && sessionId) {
+            memoryPruneFailurePhase = "session_finalize";
             const contextTokens = usage
                 ? usage.inputTokens + usage.cacheReadTokens + usage.cacheCreationTokens
                 : (resuming ? prior?.contextTokens : undefined);
@@ -483,6 +517,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 ...(contextTokens === undefined ? {} : { contextTokens }),
             });
         }
+        memoryPruneExecutorCompleted = true;
         return {
             workspaceRunDir: workspace.runDir,
             exitCode,
@@ -505,6 +540,27 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     }
     finally {
         startupReservation?.release();
+        if (memoryPruneTraceId !== null) {
+            const snapshot = await inspectMemoryPruneFiles(workspace.dir, workspace.workLogPath);
+            dslog("memory_prune.files_after", "长期记忆收尾执行后文件指纹", {
+                execution_id: input.executionId,
+                agent_handle: input.handle,
+                task_key: input.taskKey,
+                prune_trace_id: memoryPruneTraceId,
+                runtime_exit_code: memoryPruneRuntimeExitCode,
+                executor_outcome: memoryPruneExecutorCompleted ? "succeeded" : "failed",
+                ...memoryPruneSnapshotFields(snapshot),
+            });
+            dslog("memory_prune.execution_completed", "长期记忆收尾执行结束", {
+                execution_id: input.executionId,
+                agent_handle: input.handle,
+                task_key: input.taskKey,
+                prune_trace_id: memoryPruneTraceId,
+                executor_outcome: memoryPruneExecutorCompleted ? "succeeded" : "failed",
+                runtime_exit_code: memoryPruneRuntimeExitCode,
+                ...(memoryPruneExecutorCompleted ? {} : { failure_phase: memoryPruneFailurePhase }),
+            });
+        }
         const attachmentDirectories = new Set([
             ...(knownAttachmentDirectory === null ? [] : [knownAttachmentDirectory]),
             ...(materialized === null ? [] : [materialized.directory]),

package/dist/main.js

@@ -14,10 +14,13 @@ import { runAgent } from "./runner.js";
 import { serve } from "./serve.js";
 import { initSlog, flushSlog } from "./slog.js";
 import { formatDaemonLogLine } from "./log-format.js";
-import { applyProfileToEnv, assertProfileAgentsRootUnique, daemonHome, loadProfile, PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, ProfileAgentsRootConflictError, } from "./computer-profile.js";
-import { runComputerCommand } from "./computer-cli.js";
+import { applyProfileToEnv, assertProfileAgentsRootUnique, daemonHome, loadProfile, PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, ProfileAgentsRootConflictError, resolveAgentsRoot, } from "./computer-profile.js";
+import { builtDaemonEntry, runComputerCommand } from "./computer-cli.js";
 import { runServeLifecycle } from "./serve-lifecycle.js";
 import { formatDaemonStartupError } from "./daemon-startup-error.js";
+import { assertManagedServiceStartup } from "./managed-service-startup.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
 async function main() {
     const computerResult = await runComputerCommand(process.argv.slice(2));
     if (computerResult !== null) {
@@ -57,8 +60,19 @@ async function main() {
     if (values.profile) {
         const home = daemonHome();
         const profile = await loadProfile(values.profile, home);
-        if (cmd === "serve")
+        if (cmd === "serve") {
             await assertProfileAgentsRootUnique(profile, home, homedir());
+            await assertManagedServiceStartup({
+                platform: process.platform,
+                profile: profile.name,
+                userHome: homedir(),
+                uid: process.getuid?.(),
+                daemonHome: home,
+                agentsRoot: resolveAgentsRoot(profile.agentsRoot, homedir(), process.platform),
+                nodePath: process.execPath,
+                entryPath: builtDaemonEntry(),
+            });
+        }
         applyProfileToEnv(profile, process.env);
     }
     // 命令行参数优先于环境变量,填回 env 供 loadConfig 读取
@@ -80,10 +94,18 @@ async function main() {
     }
     if (cmd === "serve") {
         process.stdout.write(formatDaemonLogLine(`🛰️  crew-daemon v${daemonVersion()} (cli v${cliVersion()}) ${td("resident, connecting to")} ${config.serverUrl} ${td("control plane")}...`) + "\n");
-        const service = serve(config, {
-            ...(values.profile === undefined ? {} : { profileName: values.profile }),
+        const installation = values.profile === undefined
+            ? null
+            : daemonGlobalInstallation(builtDaemonEntry(), process.platform);
+        const installationLease = installation === null
+            ? null
+            : await acquireDaemonInstallationLease(installation.npmPrefix);
+        await runWithDaemonInstallationLease(installationLease, async () => {
+            const service = serve(config, {
+                ...(values.profile === undefined ? {} : { profileName: values.profile }),
+            });
+            await runServeLifecycle(service);
         });
-        await runServeLifecycle(service);
         return;
     }
     if (!values.agent || !values.channel) {

package/dist/managed-service-diagnostics.js

@@ -0,0 +1,92 @@
+import { inspectDaemonInstallationLease } from "./daemon-installation-lease.js";
+import { readServiceDescriptor } from "./computer-service.js";
+import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, } from "./managed-service-registry.js";
+function errorDetail(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export async function inspectManagedServiceDiagnostics(input) {
+    const registry = input.registry ?? {};
+    const userHome = registry.userHome;
+    const readServices = input.readManagedServices
+        ?? (() => readManagedServiceRegistry(registry));
+    const listDescriptors = input.listManagedDescriptorPaths
+        ?? (() => listManagedServiceDescriptorPaths(input.spec.platform, userHome));
+    const readDescriptor = input.readDescriptor
+        ?? (() => readServiceDescriptor(input.spec));
+    const inspectLease = input.inspectInstallationLease
+        ?? (() => inspectDaemonInstallationLease(input.expectedRecord.npmPrefix, {
+            ...(userHome === undefined ? {} : { userHome }),
+        }));
+    let services = null;
+    let registryCheck;
+    try {
+        services = await readServices();
+        assertRegistryCoversDescriptors(services, await listDescriptors());
+        registryCheck = {
+            name: "managed-service-registry",
+            ok: true,
+            detail: `${services.length} registered service(s); all descriptors are covered`,
+        };
+    }
+    catch (error) {
+        registryCheck = {
+            name: "managed-service-registry",
+            ok: false,
+            detail: errorDetail(error),
+        };
+    }
+    let identityCheck;
+    const registered = services?.find((record) => record.serviceId === input.expectedRecord.serviceId
+        || (record.daemonHome === input.expectedRecord.daemonHome
+            && record.profile === input.expectedRecord.profile));
+    if (registered === undefined) {
+        identityCheck = {
+            name: "managed-service-identity",
+            ok: false,
+            detail: services === null
+                ? "identity unavailable because the registry is invalid"
+                : `managed service '${input.expectedRecord.serviceId}' is not registered`,
+        };
+    }
+    else {
+        try {
+            const { generation: _generation, createdAt: _createdAt, ...expectedIdentity } = input.expectedRecord;
+            const descriptor = await readDescriptor();
+            const matches = descriptor === input.spec.descriptor
+                && managedServiceIdentityMatches(registered, expectedIdentity);
+            identityCheck = {
+                name: "managed-service-identity",
+                ok: matches,
+                detail: matches
+                    ? `registry and descriptor match '${input.expectedRecord.serviceId}'`
+                    : `registry or descriptor identity does not match '${input.expectedRecord.serviceId}'`,
+            };
+        }
+        catch (error) {
+            identityCheck = {
+                name: "managed-service-identity",
+                ok: false,
+                detail: errorDetail(error),
+            };
+        }
+    }
+    let installationLease;
+    try {
+        installationLease = await inspectLease();
+    }
+    catch (error) {
+        installationLease = { status: "corrupt", detail: errorDetail(error) };
+    }
+    const leaseCheck = {
+        name: "installation-lease",
+        ok: installationLease.status === "owned" && installationLease.ownerAlive === true,
+        detail: installationLease.detail,
+    };
+    const checks = [registryCheck, identityCheck, leaseCheck];
+    return {
+        healthy: checks.every((check) => check.ok),
+        npmPrefix: input.expectedRecord.npmPrefix,
+        checks,
+        installationLease,
+    };
+}