@nowcrew/daemon 0.5.36 → 0.5.37

package/dist/managed-service-registry.js

@@ -0,0 +1,285 @@
+import { createHash, randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { chmod, mkdir, open, readFile, readdir, rename, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, resolve } from "node:path";
+import { z } from "zod";
+import { acquireProfileSaveLock } from "./computer-profile-lock.js";
+const AbsolutePathSchema = z.string().min(1).refine(isAbsolute, "must be an absolute path");
+const ManagedServiceRecordSchema = z.object({
+    version: z.literal(1),
+    generation: z.string().uuid(),
+    platform: z.enum(["darwin", "linux"]),
+    serviceId: z.string().min(1).max(256),
+    profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/),
+    daemonHome: AbsolutePathSchema,
+    agentsRoot: AbsolutePathSchema,
+    nodePath: AbsolutePathSchema,
+    entryPath: AbsolutePathSchema,
+    packageRoot: AbsolutePathSchema,
+    npmPrefix: AbsolutePathSchema,
+    descriptorPath: AbsolutePathSchema,
+    descriptorSha256: z.string().regex(/^[0-9a-f]{64}$/),
+    createdAt: z.string().datetime({ offset: true }),
+}).strict();
+const ManagedServiceRegistrySchema = z.object({
+    version: z.literal(1),
+    services: z.array(ManagedServiceRecordSchema).max(256),
+}).strict();
+export class ManagedServiceRegistryError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "ManagedServiceRegistryError";
+    }
+}
+export class ManagedServiceConflictError extends ManagedServiceRegistryError {
+    resource;
+    owner;
+    constructor(resource, candidate, owner) {
+        super(`Managed service '${candidate.serviceId}' conflicts with '${owner.serviceId}' on ${resource}`);
+        this.name = "ManagedServiceConflictError";
+        this.resource = resource;
+        this.owner = owner;
+    }
+}
+function registryDirectory(userHome) {
+    return resolve(userHome, ".crew", "daemon", "managed-services");
+}
+export function managedServiceRegistryPath(userHome = homedir()) {
+    return resolve(registryDirectory(userHome), "registry.json");
+}
+export async function listManagedServiceDescriptorPaths(platform, userHome = homedir()) {
+    const directory = platform === "darwin"
+        ? resolve(userHome, "Library", "LaunchAgents")
+        : platform === "linux"
+            ? resolve(userHome, ".config", "systemd", "user")
+            : null;
+    if (directory === null)
+        return [];
+    const pattern = platform === "darwin"
+        ? /^com\.nowcrew\.daemon\.[a-z0-9][a-z0-9_-]{0,47}(?:\.[0-9a-f]{12})?\.plist$/
+        : /^nowcrew-daemon-[a-z0-9][a-z0-9_-]{0,47}(?:\.[0-9a-f]{12})?\.service$/;
+    try {
+        return (await readdir(directory, { withFileTypes: true }))
+            .filter((entry) => entry.isFile() && pattern.test(entry.name))
+            .map((entry) => resolve(directory, entry.name))
+            .sort();
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+export function assertRegistryCoversDescriptors(services, descriptorPaths) {
+    const registered = new Set(services.map((record) => canonicalizePath(record.descriptorPath)));
+    const unregistered = descriptorPaths.map(canonicalizePath).find((path) => !registered.has(path));
+    if (unregistered !== undefined) {
+        throw new ManagedServiceRegistryError(`Unregistered NowCrew service descriptor: ${unregistered}`);
+    }
+}
+export function normalizeManagedServiceRecord(input) {
+    const record = ManagedServiceRecordSchema.parse(input);
+    return ManagedServiceRecordSchema.parse({
+        ...record,
+        daemonHome: canonicalizePath(record.daemonHome),
+        agentsRoot: canonicalizePath(record.agentsRoot),
+        nodePath: canonicalizePath(record.nodePath),
+        entryPath: canonicalizePath(record.entryPath),
+        packageRoot: canonicalizePath(record.packageRoot),
+        npmPrefix: canonicalizePath(record.npmPrefix),
+        descriptorPath: canonicalizePath(record.descriptorPath),
+    });
+}
+function canonicalizePath(path) {
+    const absolute = resolve(path);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOTDIR")
+            return absolute;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    const missing = [];
+    let ancestor = absolute;
+    for (;;) {
+        const parent = dirname(ancestor);
+        if (parent === ancestor)
+            return absolute;
+        missing.unshift(ancestor.slice(parent.length + (parent.endsWith("/") ? 0 : 1)));
+        ancestor = parent;
+        try {
+            return resolve(realpathSync.native(ancestor), ...missing);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOTDIR")
+                return absolute;
+            if (code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function parseRegistry(path, raw) {
+    try {
+        const parsed = ManagedServiceRegistrySchema.parse(JSON.parse(raw));
+        const services = parsed.services.map(normalizeManagedServiceRecord);
+        for (let index = 0; index < services.length; index += 1) {
+            const candidate = services[index];
+            const conflict = managedServiceConflict(services.slice(0, index), candidate);
+            if (conflict !== null) {
+                throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
+            }
+        }
+        return services;
+    }
+    catch (error) {
+        throw new ManagedServiceRegistryError(`Invalid managed service registry: ${path}`, { cause: error });
+    }
+}
+export function serviceDescriptorSha256(descriptor) {
+    return createHash("sha256").update(descriptor).digest("hex");
+}
+export function managedServiceIdentityMatches(record, expected) {
+    const normalized = normalizeManagedServiceRecord(record);
+    return normalized.version === expected.version
+        && normalized.platform === expected.platform
+        && normalized.serviceId === expected.serviceId
+        && normalized.profile === expected.profile
+        && normalized.daemonHome === canonicalizePath(expected.daemonHome)
+        && normalized.agentsRoot === canonicalizePath(expected.agentsRoot)
+        && normalized.nodePath === canonicalizePath(expected.nodePath)
+        && normalized.entryPath === canonicalizePath(expected.entryPath)
+        && normalized.packageRoot === canonicalizePath(expected.packageRoot)
+        && normalized.npmPrefix === canonicalizePath(expected.npmPrefix)
+        && normalized.descriptorPath === canonicalizePath(expected.descriptorPath)
+        && normalized.descriptorSha256 === expected.descriptorSha256;
+}
+async function readRegistryFile(path) {
+    try {
+        return parseRegistry(path, await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function syncDirectory(path, platform) {
+    if (platform === "win32")
+        return;
+    const handle = await open(path, "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writeRegistryFile(path, services) {
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    let handle = null;
+    try {
+        handle = await open(temporary, "wx", 0o600);
+        await handle.writeFile(`${JSON.stringify({ version: 1, services }, null, 2)}\n`, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        await rename(temporary, path);
+        await chmod(path, 0o600);
+        await syncDirectory(directory, process.platform);
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+}
+function sameRecord(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+export function managedServiceConflict(services, candidate) {
+    for (const owner of services) {
+        if (owner.serviceId === candidate.serviceId)
+            return { resource: "serviceId", owner };
+        if (owner.daemonHome === candidate.daemonHome && owner.profile === candidate.profile) {
+            return { resource: "daemonProfile", owner };
+        }
+        if (owner.agentsRoot === candidate.agentsRoot)
+            return { resource: "agentsRoot", owner };
+        if (owner.npmPrefix === candidate.npmPrefix)
+            return { resource: "npmPrefix", owner };
+    }
+    return null;
+}
+export async function withManagedServiceRegistryLock(options, operation) {
+    const userHome = options.userHome ?? homedir();
+    const directory = registryDirectory(userHome);
+    const release = await acquireProfileSaveLock(directory, {
+        ...(options.lockTimeoutMs === undefined ? {} : { timeoutMs: options.lockTimeoutMs }),
+        ...(options.lockRetryMs === undefined ? {} : { retryMs: options.lockRetryMs }),
+    });
+    let operationError;
+    try {
+        const path = managedServiceRegistryPath(userHome);
+        const services = await readRegistryFile(path);
+        return await operation({
+            services,
+            replace: async (replacement) => {
+                const normalized = replacement.map(normalizeManagedServiceRecord);
+                for (let index = 0; index < normalized.length; index += 1) {
+                    const candidate = normalized[index];
+                    const conflict = managedServiceConflict(normalized.slice(0, index), candidate);
+                    if (conflict !== null) {
+                        throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
+                    }
+                }
+                await writeRegistryFile(path, normalized);
+            },
+        });
+    }
+    catch (error) {
+        operationError = error;
+        throw error;
+    }
+    finally {
+        try {
+            await release();
+        }
+        catch (releaseError) {
+            if (operationError === undefined)
+                throw releaseError;
+        }
+    }
+}
+export async function readManagedServiceRegistry(options = {}) {
+    return readRegistryFile(managedServiceRegistryPath(options.userHome ?? homedir()));
+}
+export async function registerManagedService(input, options = {}) {
+    const candidate = normalizeManagedServiceRecord(input);
+    await withManagedServiceRegistryLock(options, async ({ services, replace }) => {
+        const conflict = managedServiceConflict(services, candidate);
+        if (conflict !== null)
+            throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
+        await replace([...services, candidate].sort((left, right) => left.serviceId.localeCompare(right.serviceId)));
+    });
+}
+export async function unregisterManagedService(input, options = {}) {
+    const candidate = normalizeManagedServiceRecord(input);
+    await withManagedServiceRegistryLock(options, async ({ services, replace }) => {
+        const index = services.findIndex((record) => record.serviceId === candidate.serviceId
+            && record.daemonHome === candidate.daemonHome
+            && record.profile === candidate.profile);
+        if (index < 0)
+            throw new ManagedServiceRegistryError(`Managed service '${candidate.serviceId}' is not registered`);
+        if (!sameRecord(services[index], candidate)) {
+            throw new ManagedServiceRegistryError(`Managed service '${candidate.serviceId}' identity changed before removal`);
+        }
+        await replace(services.filter((_, candidateIndex) => candidateIndex !== index));
+    });
+}

package/dist/managed-service-startup.js

@@ -0,0 +1,86 @@
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { buildServiceSpec, readServiceDescriptor } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { ManagedServiceRegistryError, assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, serviceDescriptorSha256, } from "./managed-service-registry.js";
+export async function assertManagedServiceStartup(input) {
+    if (input.platform !== "darwin" && input.platform !== "linux")
+        return;
+    const spec = input.spec ?? buildServiceSpec({
+        platform: input.platform,
+        profile: input.profile,
+        userHome: input.userHome,
+        uid: input.uid,
+        nodePath: input.nodePath,
+        entryPath: input.entryPath,
+        profileHome: input.daemonHome,
+    });
+    const readRegistry = input.readManagedServices
+        ?? (() => readManagedServiceRegistry({ userHome: input.userHome }));
+    const listDescriptors = input.listManagedDescriptorPaths
+        ?? (() => listManagedServiceDescriptorPaths(input.platform, input.userHome));
+    const readDescriptor = input.readServiceDescriptor ?? readServiceDescriptor;
+    const [services, descriptorPaths, descriptor] = await Promise.all([
+        readRegistry(),
+        listDescriptors(),
+        readDescriptor(spec),
+    ]);
+    const registered = services.find((record) => record.serviceId === spec.id
+        || (record.daemonHome === input.daemonHome && record.profile === input.profile));
+    const defaultDaemonHome = resolve(input.userHome, ".crew", "daemon");
+    if (registered === undefined
+        && resolve(input.daemonHome) === defaultDaemonHome
+        && descriptor === spec.descriptor) {
+        return;
+    }
+    if (registered === undefined && descriptor === null) {
+        const legacySpec = buildServiceSpec({
+            platform: input.platform,
+            profile: input.profile,
+            userHome: input.userHome,
+            uid: input.uid,
+            nodePath: input.nodePath,
+            entryPath: input.entryPath,
+            profileHome: input.daemonHome,
+            legacyServiceId: true,
+        });
+        const legacyDescriptor = await readDescriptor(legacySpec);
+        if (legacyDescriptor === legacySpec.descriptor)
+            return;
+        if (descriptorPaths.length === 0)
+            return;
+    }
+    if (registered === undefined) {
+        throw new ManagedServiceRegistryError(`Managed service '${spec.id}' is installed but not registered`);
+    }
+    assertRegistryCoversDescriptors(services, descriptorPaths);
+    const installation = daemonGlobalInstallation(input.entryPath, input.platform);
+    if (installation === null || descriptor === null || spec.descriptorPath === null || spec.descriptor === null
+        || descriptor !== spec.descriptor
+        || !managedServiceIdentityMatches(registered, {
+            version: 1,
+            platform: input.platform,
+            serviceId: spec.id,
+            profile: input.profile,
+            daemonHome: input.daemonHome,
+            agentsRoot: input.agentsRoot,
+            nodePath: input.nodePath,
+            entryPath: input.entryPath,
+            packageRoot: installation.packageRoot,
+            npmPrefix: installation.npmPrefix,
+            descriptorPath: spec.descriptorPath,
+            descriptorSha256: serviceDescriptorSha256(descriptor),
+        })) {
+        throw new ManagedServiceRegistryError(`Managed service '${spec.id}' identity does not match its runtime`);
+    }
+}
+export function defaultManagedServiceStartupInput(input) {
+    return {
+        ...input,
+        platform: process.platform,
+        userHome: homedir(),
+        uid: process.getuid?.(),
+        nodePath: process.execPath,
+        entryPath: process.argv[1] ?? "",
+    };
+}

package/dist/serve.js

@@ -1120,6 +1120,7 @@ export function serve(config, opts = {}) {
             const webSocketClosed = closeWebSocketWithinDeadline(ws, deadline.signal);
             const pending = [
                 webSocketClosed,
+                updateController.drain(),
                 executionFrameQueue,
                 ...executionRuns.values(),
                 ...[...legacyRuns.values()].map((run) => run.done),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.5.36",
+  "version": "0.5.37",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -16,12 +16,19 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
+    "@nowcrew/cli": "workspace:^",
     "cross-spawn": "^7.0.6",
     "ws": "^8",
-    "zod": "^3.23.0",
-    "@nowcrew/cli": "^0.4.13"
+    "zod": "^3.23.0"
   },
   "optionalDependencies": {
     "koffi": "^2.9.0"
@@ -33,11 +40,5 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
-  },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
   }
-}
+}