@nowcrew/daemon 0.5.44 → 0.5.45

package/README.md

@@ -105,8 +105,10 @@ CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon doctor --profile dev
 CREW_DAEMON_HOME="$HOME/.crew/daemon-dev" crew-daemon status --profile dev
 ```
 
-If the descriptor has drifted, the profile is stopped, or another host descriptor is not registered, the
-daemon fails closed and remains manually upgradeable.
+If the target descriptor has drifted or the profile is stopped, the daemon fails closed and remains
+manually upgradeable. On macOS, another unregistered legacy LaunchAgent may coexist only when its plist
+exactly matches a generated NowCrew service and resolves to a different npm prefix. An unverifiable or
+same-prefix descriptor still fails closed.
 
 The daemon advertises `daemon_update_v1` only when all of these conditions hold:
 
@@ -115,7 +117,7 @@ The daemon advertises `daemon_update_v1` only when all of these conditions hold:
 | Platform | macOS LaunchAgent or Linux systemd user service |
 | Entrypoint | global `@nowcrew/daemon/dist/main.js`, not npx or source/tsx |
 | Startup | `crew-daemon serve --profile <name>` through the installed service |
-| Registry | every other NowCrew descriptor on the OS user account is registered and conflict-free; the exact target legacy descriptor may be adopted once |
+| Registry | registered descriptors remain conflict-free; the exact target legacy descriptor may be adopted once; an exact macOS legacy descriptor on another npm prefix may coexist |
 | Identity | service ID, descriptor, daemon home, Agent root, entrypoint, package root, and npm prefix match |
 | Service | the selected profile is running and holds the installation lease |
 | Install root | a standard writable Unix global npm prefix can be derived from the running entrypoint |

package/dist/computer-service.js

@@ -315,8 +315,30 @@ setTimeout(() => {
   let restarted;
   if (spec.platform === "darwin") {
     restarted = spawnSync("launchctl", ["kickstart", "-k", spec.target], { stdio: "ignore", shell: false });
-  } else {
+  } else if (spec.platform === "linux") {
     restarted = spawnSync("systemctl", ["--user", "--no-block", "restart", spec.id], { stdio: "ignore", shell: false });
+  } else {
+    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
+    const encodedExecutable = Buffer.from(spec.executable, "utf16le").toString("base64");
+    const encodedArguments = Buffer.from(spec.arguments, "utf16le").toString("base64");
+    const script = [
+      "$ErrorActionPreference='Stop';",
+      "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
+      "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
+      "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
+      "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
+      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+      "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
+      "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
+      "$p.Kill();",
+      "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
+      "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
+      "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
+      "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
+      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+      "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
+    ].join("");
+    restarted = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, String(spec.daemonPid), encodedName, encodedExecutable, encodedArguments, spec.processIdentity], { stdio: "ignore", shell: false });
   }
   if (restarted.status !== 0) process.send?.({ type: "restart-failed", status: restarted.status });
   setTimeout(() => {
@@ -326,16 +348,27 @@ setTimeout(() => {
 }, 250);
 `;
 export function scheduleServiceRestart(spec, spawnDetached = systemDetachedSpawn) {
-    if (spec.platform === "win32")
-        throw new Error("Windows detached restart is not supported");
-    if (spec.descriptorPath === null)
+    if (spec.platform !== "win32" && spec.descriptorPath === null) {
         throw new Error("service descriptor is required for restart");
+    }
     const payload = spec.platform === "darwin"
         ? {
             platform: spec.platform,
             target: `${spec.managerDomain}/${spec.id}`,
         }
-        : { platform: spec.platform, id: spec.id };
+        : spec.platform === "linux"
+            ? { platform: spec.platform, id: spec.id }
+            : {
+                platform: spec.platform,
+                id: spec.id,
+                daemonPid: process.pid,
+                executable: spec.daemonCommand[0],
+                arguments: spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "),
+                processIdentity: spec.runtimeProcessIdentity,
+            };
+    if (spec.platform === "win32" && !payload.processIdentity) {
+        throw new Error("Windows daemon process identity is required for restart");
+    }
     const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"], shell: false });
     child.unref();
     let settleFailure;

package/dist/daemon-installation.js

@@ -1,38 +1,55 @@
 import { realpathSync } from "node:fs";
-import { basename, dirname, resolve } from "node:path";
-function canonicalPath(path, realpath) {
+import { posix, win32 } from "node:path";
+function canonicalPath(path, platform, realpath) {
+    const paths = platform === "win32" ? win32 : posix;
     try {
         return realpath(path);
     }
     catch (error) {
         const code = error.code;
-        return code === "ENOENT" || code === "ENOTDIR" ? resolve(path) : null;
+        return code === "ENOENT" || code === "ENOTDIR" ? paths.resolve(path) : null;
     }
 }
+function samePath(left, right, platform) {
+    return platform === "win32"
+        ? left.toLowerCase() === right.toLowerCase()
+        : left === right;
+}
 export function daemonGlobalInstallation(entryPath, platform, realpath = realpathSync.native) {
-    if (platform !== "darwin" && platform !== "linux")
+    if (platform !== "darwin" && platform !== "linux" && platform !== "win32")
+        return null;
+    const paths = platform === "win32" ? win32 : posix;
+    const packageRoot = paths.resolve(paths.dirname(entryPath), "..");
+    const globalNodeModules = paths.resolve(packageRoot, "..", "..");
+    const modulesParent = paths.dirname(globalNodeModules);
+    if (paths.basename(globalNodeModules).toLowerCase() !== "node_modules")
         return null;
-    const packageRoot = resolve(dirname(entryPath), "..");
-    const globalNodeModules = resolve(packageRoot, "..", "..");
-    const libDirectory = dirname(globalNodeModules);
-    if (basename(globalNodeModules) !== "node_modules" || basename(libDirectory) !== "lib")
+    if (platform !== "win32" && paths.basename(modulesParent) !== "lib")
         return null;
-    if (resolve(entryPath) !== resolve(packageRoot, "dist", "main.js"))
+    if (!samePath(paths.resolve(entryPath), paths.resolve(packageRoot, "dist", "main.js"), platform))
         return null;
-    if (resolve(packageRoot) !== resolve(globalNodeModules, "@nowcrew", "daemon"))
+    if (!samePath(paths.resolve(packageRoot), paths.resolve(globalNodeModules, "@nowcrew", "daemon"), platform))
         return null;
-    const canonicalPackageRoot = canonicalPath(packageRoot, realpath);
-    const canonicalGlobalNodeModules = canonicalPath(globalNodeModules, realpath);
-    const canonicalNpmPrefix = canonicalPath(dirname(libDirectory), realpath);
+    const npmPrefix = platform === "win32" ? modulesParent : paths.dirname(modulesParent);
+    const canonicalPackageRoot = canonicalPath(packageRoot, platform, realpath);
+    const canonicalGlobalNodeModules = canonicalPath(globalNodeModules, platform, realpath);
+    const canonicalNpmPrefix = canonicalPath(npmPrefix, platform, realpath);
     if (canonicalPackageRoot === null || canonicalGlobalNodeModules === null || canonicalNpmPrefix === null)
         return null;
-    if (canonicalPackageRoot !== resolve(canonicalGlobalNodeModules, "@nowcrew", "daemon"))
+    const normalizeCanonical = (path) => paths.resolve(path);
+    const normalizedPackageRoot = normalizeCanonical(canonicalPackageRoot);
+    const normalizedGlobalNodeModules = normalizeCanonical(canonicalGlobalNodeModules);
+    const normalizedNpmPrefix = normalizeCanonical(canonicalNpmPrefix);
+    if (!samePath(normalizedPackageRoot, paths.resolve(normalizedGlobalNodeModules, "@nowcrew", "daemon"), platform))
         return null;
-    if (canonicalGlobalNodeModules !== resolve(canonicalNpmPrefix, "lib", "node_modules"))
+    const expectedModules = platform === "win32"
+        ? paths.resolve(normalizedNpmPrefix, "node_modules")
+        : paths.resolve(normalizedNpmPrefix, "lib", "node_modules");
+    if (!samePath(normalizedGlobalNodeModules, expectedModules, platform))
         return null;
     return {
-        packageRoot: canonicalPackageRoot,
-        globalNodeModules: canonicalGlobalNodeModules,
-        npmPrefix: canonicalNpmPrefix,
+        packageRoot: normalizedPackageRoot,
+        globalNodeModules: normalizedGlobalNodeModules,
+        npmPrefix: normalizedNpmPrefix,
     };
 }

package/dist/daemon-update-eligibility.js

@@ -1,11 +1,14 @@
 import { access } from "node:fs/promises";
 import { constants } from "node:fs";
+import { realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { daemonHome, loadProfile, resolveAgentsRoot } from "./computer-profile.js";
 import { builtDaemonEntry } from "./computer-cli.js";
 import { buildServiceSpec, readServiceDescriptor, serviceStatus, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { daemonInstallationLeaseHeld } from "./daemon-installation-lease.js";
+import { inspectLegacyServiceInstallation } from "./legacy-service-installation.js";
+import { inspectWindowsServiceUpdateScope } from "./windows-scheduled-task.js";
 import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, serviceDescriptorSha256, } from "./managed-service-registry.js";
 function defaults() {
     return {
@@ -22,16 +25,35 @@ function defaults() {
         serviceStatus,
         assertWritable: (path) => access(path, constants.W_OK),
         installationLeaseHeld: daemonInstallationLeaseHeld,
+        installationRealpath: realpathSync.native,
+        inspectWindowsServiceUpdateScope,
+        inspectLegacyDescriptorInstallation: (descriptorPath) => inspectLegacyServiceInstallation(descriptorPath, process.platform, homedir(), process.getuid?.()),
     };
 }
+async function registryCoversUpdateScope(services, descriptorPaths, targetDescriptorPath, npmPrefix, inspectLegacyDescriptorInstallation) {
+    for (const descriptorPath of descriptorPaths) {
+        if (descriptorPath === targetDescriptorPath)
+            continue;
+        try {
+            assertRegistryCoversDescriptors(services, [descriptorPath]);
+            continue;
+        }
+        catch {
+            const legacy = await inspectLegacyDescriptorInstallation(descriptorPath).catch(() => null);
+            if (legacy === null || legacy.npmPrefix === npmPrefix)
+                return false;
+        }
+    }
+    return true;
+}
 export async function detectDaemonUpdateEligibility(profileName, overrides = {}) {
     const deps = { ...defaults(), ...overrides };
-    if (deps.platform !== "darwin" && deps.platform !== "linux") {
+    if (deps.platform !== "darwin" && deps.platform !== "linux" && deps.platform !== "win32") {
         return { eligible: false, reason: "unsupported_platform" };
     }
     if (!profileName)
         return { eligible: false, reason: "profile_required" };
-    const installation = daemonGlobalInstallation(deps.entryPath, deps.platform);
+    const installation = daemonGlobalInstallation(deps.entryPath, deps.platform, deps.installationRealpath);
     if (installation === null)
         return { eligible: false, reason: "global_install_required" };
     let profile;
@@ -53,6 +75,33 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
         entryPath: deps.entryPath,
         profileHome: deps.profileHome,
     });
+    if (deps.platform === "win32") {
+        const scope = await deps.inspectWindowsServiceUpdateScope(spec, installation.npmPrefix)
+            .catch(() => ({ valid: false }));
+        if (!scope.valid) {
+            return { eligible: false, reason: "managed_service_identity_mismatch" };
+        }
+        if (!scope.running)
+            return { eligible: false, reason: "service_not_running" };
+        if (!scope.processIdentity) {
+            return { eligible: false, reason: "managed_service_identity_mismatch" };
+        }
+        if (!deps.installationLeaseHeld(installation.npmPrefix)) {
+            return { eligible: false, reason: "installation_lease_missing" };
+        }
+        try {
+            await deps.assertWritable(installation.globalNodeModules);
+        }
+        catch {
+            return { eligible: false, reason: "global_root_not_writable" };
+        }
+        return {
+            eligible: true,
+            profileName,
+            ...installation,
+            serviceSpec: { ...spec, runtimeProcessIdentity: scope.processIdentity },
+        };
+    }
     let selectedSpec = spec;
     let status = await deps.serviceStatus(spec);
     let services;
@@ -65,10 +114,7 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
     const registered = services.find((record) => record.serviceId === spec.id
         || (record.daemonHome === deps.profileHome && record.profile === profileName));
     if (registered !== undefined) {
-        try {
-            assertRegistryCoversDescriptors(services, await deps.listManagedDescriptorPaths());
-        }
-        catch {
+        if (!await registryCoversUpdateScope(services, await deps.listManagedDescriptorPaths(), spec.descriptorPath, installation.npmPrefix, deps.inspectLegacyDescriptorInstallation)) {
             return { eligible: false, reason: "managed_service_registry_incomplete" };
         }
         const descriptor = await deps.readServiceDescriptor(spec).catch(() => null);
@@ -109,12 +155,7 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
         if (legacyDescriptor !== legacySpec.descriptor) {
             return { eligible: false, reason: "managed_service_not_registered" };
         }
-        try {
-            const descriptorPaths = await deps.listManagedDescriptorPaths();
-            const targetPath = legacySpec.descriptorPath;
-            assertRegistryCoversDescriptors(services, descriptorPaths.filter((descriptorPath) => descriptorPath !== targetPath));
-        }
-        catch {
+        if (!await registryCoversUpdateScope(services, await deps.listManagedDescriptorPaths(), legacySpec.descriptorPath, installation.npmPrefix, deps.inspectLegacyDescriptorInstallation)) {
             return { eligible: false, reason: "managed_service_registry_incomplete" };
         }
         status = await deps.serviceStatus(legacySpec);

package/dist/daemon-updater.js

@@ -48,7 +48,7 @@ export async function installExactDaemonUpdate(input) {
         await release();
         return { ok: false, errorCode: "install_failed" };
     }
-    const result = await runner(process.platform === "win32" ? "npm.cmd" : "npm", [
+    const result = await runner((input.platform ?? process.platform) === "win32" ? "npm.cmd" : "npm", [
         "install",
         "--global",
         "--prefix",

package/dist/windows-scheduled-task.js

@@ -0,0 +1,64 @@
+import { systemCommandRunner, windowsCommandArg, } from "./computer-service.js";
+import { win32 } from "node:path";
+function encoded(value) {
+    return Buffer.from(value, "utf16le").toString("base64");
+}
+function sameWindowsPath(left, right) {
+    if (left === undefined)
+        return false;
+    return left.replaceAll("/", "\\").toLowerCase()
+        === right.replaceAll("/", "\\").toLowerCase();
+}
+export async function inspectWindowsServiceUpdateScope(spec, npmPrefix, daemonPid = process.pid, runner = systemCommandRunner) {
+    if (spec.platform !== "win32")
+        return { valid: false };
+    const expectedArguments = spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ");
+    const entryMarker = windowsCommandArg(win32.resolve(npmPrefix, "node_modules", "@nowcrew", "daemon", "dist", "main.js"));
+    const script = [
+        "$ErrorActionPreference='Stop';",
+        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
+        "$entry=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
+        "$pidValue=[int]$args[2];",
+        "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
+        "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
+        "$task=$tasks[0];",
+        "$scheduler=New-Object -ComObject 'Schedule.Service';$scheduler.Connect();",
+        "$registered=$scheduler.GetFolder('\\').GetTask($n);$instances=@($registered.GetInstances(0));",
+        "$current=Get-CimInstance Win32_Process -Filter ('ProcessId='+$pidValue) -ErrorAction Stop;",
+        "$ancestors=@();$cursor=$current;while($cursor.ParentProcessId -gt 0){$cursor=Get-CimInstance Win32_Process -Filter ('ProcessId='+$cursor.ParentProcessId) -ErrorAction SilentlyContinue;if($null -eq $cursor){break};$ancestors+=[int64]$cursor.ProcessId};",
+        "$processIdentity=(Get-Process -Id $pidValue -ErrorAction Stop).StartTime.ToUniversalTime().ToFileTimeUtc().ToString();",
+        "$actions=@($task.Actions);",
+        "$others=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -like 'NowCrew Daemon (*)' -and $_.TaskName -cne $n});",
+        "$conflicts=@($others|Where-Object{@($_.Actions|Where-Object{$_.Arguments.IndexOf($entry,[StringComparison]::OrdinalIgnoreCase) -ge 0}).Count -gt 0});",
+        "$enginePid=if($instances.Count -eq 1){[int64]$instances[0].EnginePID}else{0};",
+        "[pscustomobject]@{count=1;state=[int]$task.State;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};instanceCount=$instances.Count;enginePid=$enginePid;engineOwned=($enginePid -eq $pidValue -or $ancestors -contains $enginePid);processIdentity=$processIdentity;conflictingPrefixes=$conflicts.Count}|ConvertTo-Json -Compress;",
+    ].join("");
+    const result = await runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script,
+        encoded(spec.id), encoded(entryMarker), String(daemonPid),
+    ]);
+    if (result.exitCode !== 0)
+        return { valid: false };
+    let inspection;
+    try {
+        inspection = JSON.parse(result.stdout);
+    }
+    catch {
+        return { valid: false };
+    }
+    const running = inspection.state === 4;
+    if (inspection.count !== 1
+        || (running && (inspection.instanceCount !== 1 || inspection.engineOwned !== true
+            || typeof inspection.processIdentity !== "string" || inspection.processIdentity.length === 0))
+        || (!running && inspection.instanceCount !== 0)
+        || inspection.conflictingPrefixes !== 0
+        || !sameWindowsPath(inspection.execute, spec.daemonCommand[0])
+        || inspection.arguments !== expectedArguments) {
+        return { valid: false };
+    }
+    return {
+        valid: true,
+        running,
+        ...(running ? { processIdentity: inspection.processIdentity } : {}),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.5.44",
+  "version": "0.5.45",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -16,13 +16,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@nowcrew/cli": "^0.4.13",
@@ -40,5 +33,11 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
-}
+}