@nowcrew/daemon 0.5.48 → 0.5.49

package/README.md

@@ -5,13 +5,14 @@ WebSocket open, and launches coding runtimes on that machine. Product policy rem
 
 ## Run
 
-Use the connection command generated by **Add Computer**:
+For a temporary foreground connection, run:
 
 ```bash
 npx @nowcrew/daemon@latest --server-url https://nowwork.example --api-key sk_machine_...
 ```
 
-The process stays resident and reconnects with backoff. For local development, run
+This compatibility form stays resident in the current terminal and reconnects with backoff. New
+**Add Computer** commands use the managed automatic installation described below. For local development, run
 `pnpm --filter @nowcrew/daemon daemon`. `crew-daemon run --agent <handle> --channel <id>` is the legacy
 manual one-shot entry.
 
@@ -31,7 +32,30 @@ Profile files live under `~/.crew/daemon/profiles`. Unix writes use mode `0600`;
 encrypted with CurrentUser DPAPI and the profile ACL is restricted to the current user. Windows refuses
 legacy plaintext profiles and fails the save if DPAPI or ACL hardening is unavailable.
 
-Install and operate the profile as a user service:
+The connection command generated by **Add Computer** installs the package into an isolated stable prefix,
+saves the private profile, installs the native user service, starts it, and verifies that it is running:
+
+```bash
+npx -y --registry https://registry.npmjs.org @nowcrew/daemon@latest install \
+  --server-url https://nowwork-dev.nowcoder.com --api-key sk_machine_...
+```
+
+The installer selects the fixed `in` layout for `nowwork-in.nowcoder.com` and the fixed `dev` layout for
+`nowwork-dev.nowcoder.com`. It compares the parsed hostname exactly; lookalike suffixes are not accepted.
+An unknown hostname is rejected before any write and reports how to retry with an explicit custom profile:
+
+```bash
+npx -y --registry https://registry.npmjs.org @nowcrew/daemon@latest install \
+  --server-url https://lab.example.com --api-key sk_machine_... --profile lab
+```
+
+Custom profiles use `~/.crew/daemon-<profile>`, `~/.crew/agents-<profile>`, and
+`~/.crew/daemon-runtimes/<profile>`. The names `in` and `dev` remain reserved for their known domains.
+Re-running the command updates the exact isolated package, rotates the saved machine credential, repairs the
+exact selected service, and verifies it again. An exact generated pre-namespace service is migrated only for
+the selected profile; a drifted, duplicate, wrong-user, or otherwise unverifiable service fails closed.
+
+The lower-level lifecycle commands remain available for diagnostics and manual operation:
 
 ```bash
 npm install --global @nowcrew/daemon@latest
@@ -50,8 +74,10 @@ the host registry, exact service identity, and installation lease. It is read-on
 state is reported but never acquired, repaired, or removed. Use these checks when the Web update action is
 hidden.
 
-Lifecycle installation is intentionally refused from an `npx`/temporary cache entry because the service
-must keep a stable executable path across cache cleanup and upgrades.
+Descriptor-only `install --profile` is intentionally refused from an `npx`/temporary cache entry because
+the service must keep a stable executable path across cache cleanup and upgrades. The automatic
+`install --server-url` mode is allowed from npx because it first installs the invoking package's exact
+version under the profile-specific stable prefix and points the service at that entry.
 
 macOS uses a user LaunchAgent, Linux uses a systemd user unit, and Windows uses Task Scheduler at logon.
 On macOS `install` writes the plist, `start` bootstraps it, and `stop` boots it out, so `KeepAlive` cannot
@@ -122,8 +148,10 @@ The daemon advertises `daemon_update_v1` only when all of these conditions hold:
 | Service | the selected profile is running and holds the installation lease |
 | Install root | a standard writable Unix global npm prefix can be derived from the running entrypoint |
 
-Windows, npx/source runs, stopped or uninstalled services, legacy unregistered descriptors, shared roots,
+Foreground npx/source runs, stopped or uninstalled services, legacy unregistered descriptors, shared roots,
 and read-only global package roots remain manually upgradeable. These shapes do not show an update button.
+Windows Scheduled Tasks are eligible only when the task action, current-user principal, running instance,
+process identity, isolated npm prefix, and installation lease all match exactly.
 For the default daemon home, `install` adopts only an exact legacy descriptor; the following restart makes
 the daemon reconnect and advertise the newly registered capability. A pre-namespace service in a non-default
 daemon home must be migrated with `uninstall` followed by `install`, because the new service ID includes the

package/dist/automatic-daemon-installer.js

@@ -0,0 +1,326 @@
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
+import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { buildManagedServiceRecord, installManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
+import { ManagedServiceConflictError, managedServiceConflict, managedServiceIdentityMatches, readManagedServiceRegistry, } from "./managed-service-registry.js";
+import { resolveAutomaticInstallTarget, } from "./automatic-install-target.js";
+import { acquireDaemonInstallationLease, } from "./daemon-installation-lease.js";
+import { daemonVersion } from "./machine-info.js";
+import { discoverExactLegacyService, } from "./automatic-service-migration.js";
+function profileStorage(platform, userHome, runner) {
+    return {
+        platform,
+        userHome,
+        ...(platform === "win32"
+            ? {
+                protector: windowsDpapiProtector,
+                harden: (path) => hardenWindowsProfile(path, runner),
+            }
+            : {}),
+    };
+}
+function sameHostname(left, right) {
+    return new URL(left).hostname.toLowerCase() === new URL(right).hostname.toLowerCase();
+}
+function defaultDependencies() {
+    const platform = process.platform;
+    const userHome = homedir();
+    const runner = systemCommandRunner;
+    const storage = profileStorage(platform, userHome, runner);
+    let managedRecords = [];
+    let previousManagedRecord;
+    return {
+        platform,
+        userHome,
+        uid: process.getuid?.(),
+        nodePath: process.execPath,
+        version: daemonVersion(),
+        ...(process.env.PATH ? { runtimePath: process.env.PATH } : {}),
+        runner,
+        captureProfile: async (target) => (await listProfiles(target.daemonHome)).includes(target.profile)
+            ? loadProfile(target.profile, target.daemonHome, storage)
+            : null,
+        assertProfileTarget: async (target, previous) => {
+            if (previous !== null && !sameHostname(previous.serverUrl, target.serverUrl)) {
+                throw new Error(`Profile '${target.profile}' belongs to server hostname '${new URL(previous.serverUrl).hostname}'`);
+            }
+            await assertProfileAgentsRootUnique({
+                name: target.profile,
+                serverUrl: target.serverUrl,
+                agentsRoot: target.agentsRoot,
+            }, target.daemonHome, userHome, storage);
+        },
+        captureService: async (spec, target) => {
+            if (platform !== "win32") {
+                managedRecords = await readManagedServiceRegistry({ userHome });
+                const entryPath = spec.daemonCommand[1];
+                const installation = daemonGlobalInstallation(entryPath, platform);
+                if (installation === null) {
+                    throw new Error(`Stable daemon package path is invalid: '${entryPath}'`);
+                }
+                const candidate = buildManagedServiceRecord({
+                    spec,
+                    daemonHome: target.daemonHome,
+                    agentsRoot: target.agentsRoot,
+                    nodePath: spec.daemonCommand[0],
+                    entryPath,
+                    ...installation,
+                });
+                const { generation: _generation, createdAt: _createdAt, ...expected } = candidate;
+                previousManagedRecord = managedRecords.find((record) => managedServiceIdentityMatches(record, expected));
+                if (previousManagedRecord === undefined) {
+                    const conflict = managedServiceConflict(managedRecords, candidate);
+                    if (conflict !== null) {
+                        throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
+                    }
+                }
+            }
+            return captureExactService(spec, runner);
+        },
+        discoverLegacyService: (spec, target) => discoverExactLegacyService({
+            desired: spec,
+            profileHome: target.daemonHome,
+            userHome,
+            uid: process.getuid?.(),
+            runner,
+            managedServices: managedRecords,
+        }),
+        stopService: (spec) => serviceAction(spec, "stop", runner),
+        acquireInstallationLease: (npmPrefix) => acquireDaemonInstallationLease(npmPrefix, { userHome }),
+        installPackage: installExactDaemonPackage,
+        saveTargetProfile: async (profile, daemonHome) => {
+            await saveProfile(profile, daemonHome, storage);
+        },
+        replaceService: async (spec, target) => {
+            if (platform === "win32") {
+                await replaceExactService(spec, runner);
+                return;
+            }
+            const entryPath = stableDaemonEntry(target, platform);
+            const installation = daemonGlobalInstallation(entryPath, platform);
+            if (installation === null) {
+                throw new Error(`Stable daemon package is missing at '${entryPath}'`);
+            }
+            const record = buildManagedServiceRecord({
+                spec,
+                daemonHome: target.daemonHome,
+                agentsRoot: target.agentsRoot,
+                nodePath: process.execPath,
+                entryPath,
+                ...installation,
+            });
+            await installManagedService({
+                spec,
+                record,
+                runner,
+                registry: { userHome },
+            });
+        },
+        removeLegacyService: async (legacy) => {
+            await uninstallService(legacy.spec, runner);
+        },
+        startService: (spec) => serviceAction(spec, "start", runner),
+        verifyService: async (spec) => {
+            const status = await waitForServiceRunning(spec, (candidate) => serviceStatus(candidate, runner));
+            if (!status.running)
+                return status;
+            const exact = await captureExactService(spec, runner);
+            if (!exact.exact)
+                throw new Error(`Service '${spec.id}' changed before verification`);
+            return { running: exact.running };
+        },
+        restoreProfile: async (target, previous) => {
+            if (previous === null)
+                await removeProfile(target.profile, target.daemonHome);
+            else
+                await saveProfile(previous, target.daemonHome, storage);
+        },
+        restoreService: async (spec, previous) => {
+            if (platform === "win32") {
+                await restoreExactService(spec, previous, runner);
+                return;
+            }
+            const current = (await readManagedServiceRegistry({ userHome })).find((record) => record.serviceId === spec.id);
+            if (current !== undefined && JSON.stringify(current) !== JSON.stringify(previousManagedRecord)) {
+                await uninstallManagedService({
+                    spec,
+                    record: current,
+                    runner,
+                    registry: { userHome },
+                });
+            }
+            if (previousManagedRecord !== undefined) {
+                await installManagedService({
+                    spec,
+                    record: previousManagedRecord,
+                    runner,
+                    registry: { userHome },
+                });
+                if (previous.running)
+                    await serviceAction(spec, "start", runner);
+                return;
+            }
+            await restoreExactService(spec, previous, runner);
+        },
+        restoreLegacyService: async (legacy) => {
+            await restoreExactService(legacy.spec, legacy.snapshot, runner);
+        },
+    };
+}
+export function stableDaemonEntry(target, platform) {
+    const paths = platform === "win32" ? win32 : posix;
+    return platform === "win32"
+        ? paths.join(target.npmPrefix, "node_modules", "@nowcrew", "daemon", "dist", "main.js")
+        : paths.join(target.npmPrefix, "lib", "node_modules", "@nowcrew", "daemon", "dist", "main.js");
+}
+export async function installExactDaemonPackage(npmPrefix, version, platform, runner) {
+    const command = platform === "win32" ? "npm.cmd" : "npm";
+    const result = await runner(command, [
+        "install",
+        "--global",
+        "--prefix",
+        npmPrefix,
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        `@nowcrew/daemon@${version}`,
+    ]);
+    if (result.exitCode !== 0) {
+        throw new Error(`Daemon package installation failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`}`);
+    }
+}
+export async function waitForServiceRunning(spec, status, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const pollMs = options.pollMs ?? 100;
+    const now = options.now ?? Date.now;
+    const wait = options.wait ?? ((milliseconds) => new Promise((resolve) => {
+        setTimeout(resolve, milliseconds);
+    }));
+    const deadline = now() + timeoutMs;
+    while (true) {
+        const current = await status(spec);
+        if (current.running || now() >= deadline)
+            return current;
+        await wait(Math.min(pollMs, Math.max(0, deadline - now())));
+    }
+}
+function recoveryError(primary, failures) {
+    const original = primary instanceof Error ? primary : new Error(String(primary));
+    if (failures.length === 0)
+        return original;
+    return new Error(`${original.message}; recovery failed: ${failures.map((error) => error.message).join("; ")}`, { cause: original });
+}
+export async function installDaemonAutomatically(input, dependencies = defaultDependencies()) {
+    const machineToken = MachineTokenSchema.parse(input.machineToken);
+    const target = resolveAutomaticInstallTarget({
+        serverUrl: input.serverUrl,
+        ...(input.requestedProfile === undefined ? {} : { requestedProfile: input.requestedProfile }),
+        userHome: dependencies.userHome,
+        platform: dependencies.platform,
+    });
+    const spec = buildServiceSpec({
+        platform: dependencies.platform,
+        profile: target.profile,
+        userHome: dependencies.userHome,
+        uid: dependencies.uid,
+        nodePath: dependencies.nodePath,
+        entryPath: stableDaemonEntry(target, dependencies.platform),
+        profileHome: target.daemonHome,
+    });
+    const previousProfile = await dependencies.captureProfile(target);
+    await dependencies.assertProfileTarget(target, previousProfile);
+    const previousService = await dependencies.captureService(spec, target);
+    if (previousService.installed && !previousService.exact) {
+        throw new Error(`Installed service '${spec.id}' does not match the requested identity`);
+    }
+    const legacyService = await dependencies.discoverLegacyService(spec, target);
+    if (previousService.installed && legacyService !== null) {
+        throw new Error(`Both managed service '${spec.id}' and legacy service '${legacyService.spec.id}' are installed`);
+    }
+    let stopped = false;
+    let legacyRemovalStarted = false;
+    let profileSaved = false;
+    let serviceReplacementStarted = false;
+    try {
+        if (previousService.running) {
+            stopped = true;
+            await dependencies.stopService(spec);
+        }
+        const lease = await dependencies.acquireInstallationLease(target.npmPrefix);
+        let installFailure;
+        try {
+            await dependencies.installPackage(target.npmPrefix, dependencies.version, dependencies.platform, dependencies.runner);
+        }
+        catch (error) {
+            installFailure = error;
+        }
+        finally {
+            try {
+                await lease.close();
+            }
+            catch (error) {
+                if (installFailure === undefined)
+                    installFailure = error;
+                else
+                    installFailure = new Error(`${installFailure.message}; installation lease release failed: ${error.message}`, { cause: installFailure });
+            }
+        }
+        if (installFailure !== undefined)
+            throw installFailure;
+        if (legacyService !== null) {
+            legacyRemovalStarted = true;
+            await dependencies.removeLegacyService(legacyService);
+        }
+        profileSaved = true;
+        await dependencies.saveTargetProfile({
+            version: 1,
+            name: target.profile,
+            serverUrl: target.serverUrl,
+            machineToken,
+            agentsRoot: target.agentsRoot,
+            ...(dependencies.runtimePath === undefined ? {} : { runtimePath: dependencies.runtimePath }),
+        }, target.daemonHome);
+        serviceReplacementStarted = true;
+        await dependencies.replaceService(spec, target);
+        await dependencies.startService(spec);
+        const status = await dependencies.verifyService(spec);
+        if (!status.running)
+            throw new Error(`Service '${spec.id}' did not reach running state`);
+        return {
+            profile: target.profile,
+            version: dependencies.version,
+            serviceId: spec.id,
+            running: true,
+        };
+    }
+    catch (error) {
+        const failures = [];
+        if (profileSaved) {
+            try {
+                await dependencies.restoreProfile(target, previousProfile);
+            }
+            catch (restoreError) {
+                failures.push(restoreError);
+            }
+        }
+        if (serviceReplacementStarted || stopped) {
+            try {
+                await dependencies.restoreService(spec, previousService, target);
+            }
+            catch (restoreError) {
+                failures.push(restoreError);
+            }
+        }
+        if (legacyRemovalStarted && legacyService !== null) {
+            try {
+                await dependencies.restoreLegacyService(legacyService);
+            }
+            catch (restoreError) {
+                failures.push(restoreError);
+            }
+        }
+        throw recoveryError(error, failures);
+    }
+}

package/dist/automatic-install-target.js

@@ -0,0 +1,76 @@
+import { posix, win32 } from "node:path";
+const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
+const KNOWN_TARGETS = {
+    "nowwork-in.nowcoder.com": {
+        profile: "in",
+        daemonDirectory: "daemon",
+        agentsDirectory: "agents",
+    },
+    "nowwork-dev.nowcoder.com": {
+        profile: "dev",
+        daemonDirectory: "daemon-dev",
+        agentsDirectory: "agents-dev",
+    },
+};
+function parseServerUrl(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error("Invalid server URL; expected an HTTP(S) URL");
+    }
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        || parsed.username.length > 0
+        || parsed.password.length > 0
+        || value.length > 2048) {
+        throw new Error("Invalid server URL; expected an HTTP(S) URL without embedded credentials");
+    }
+    return parsed;
+}
+function normalizedServerUrl(parsed) {
+    const serialized = parsed.toString();
+    return parsed.pathname === "/" && parsed.search === "" && parsed.hash === ""
+        ? serialized.slice(0, -1)
+        : serialized;
+}
+function requireCustomProfile(hostname, value) {
+    if (value === undefined) {
+        throw new Error(`Unknown server hostname '${hostname}'; rerun with --profile <name>`);
+    }
+    if (!PROFILE_NAME.test(value)) {
+        throw new Error("Invalid custom profile; expected a lowercase name of 1-48 letters, digits, '_' or '-'");
+    }
+    if (value === "in" || value === "dev") {
+        throw new Error(`Profile '${value}' is reserved for a known NowWork hostname`);
+    }
+    return value;
+}
+export function resolveAutomaticInstallTarget(input) {
+    const parsed = parseServerUrl(input.serverUrl);
+    const hostname = parsed.hostname.toLowerCase();
+    const paths = input.platform === "win32" ? win32 : posix;
+    const known = KNOWN_TARGETS[hostname];
+    if (known !== undefined) {
+        if (input.requestedProfile !== undefined && input.requestedProfile !== known.profile) {
+            throw new Error(`Server hostname '${hostname}' requires profile '${known.profile}'`);
+        }
+        return Object.freeze({
+            kind: "known",
+            profile: known.profile,
+            serverUrl: normalizedServerUrl(parsed),
+            daemonHome: paths.join(input.userHome, ".crew", known.daemonDirectory),
+            agentsRoot: paths.join(input.userHome, ".crew", known.agentsDirectory),
+            npmPrefix: paths.join(input.userHome, ".crew", "daemon-runtimes", known.profile),
+        });
+    }
+    const profile = requireCustomProfile(hostname, input.requestedProfile);
+    return Object.freeze({
+        kind: "custom",
+        profile,
+        serverUrl: normalizedServerUrl(parsed),
+        daemonHome: paths.join(input.userHome, ".crew", `daemon-${profile}`),
+        agentsRoot: paths.join(input.userHome, ".crew", `agents-${profile}`),
+        npmPrefix: paths.join(input.userHome, ".crew", "daemon-runtimes", profile),
+    });
+}

package/dist/automatic-service-migration.js

@@ -0,0 +1,209 @@
+import { readFile } from "node:fs/promises";
+import { posix, win32 } from "node:path";
+import { buildServiceSpec, serviceStatus, windowsCommandArg, } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { inspectLegacyServiceInstallationDetails } from "./legacy-service-installation.js";
+function encoded(value) {
+    return Buffer.from(value, "utf16le").toString("base64");
+}
+function samePath(left, right, platform) {
+    const paths = platform === "win32" ? win32 : posix;
+    const normalizedLeft = paths.resolve(left);
+    const normalizedRight = paths.resolve(right);
+    return platform === "win32"
+        ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+        : normalizedLeft === normalizedRight;
+}
+function legacyIdentity(input) {
+    return buildServiceSpec({
+        platform: input.desired.platform,
+        profile: input.desired.profile,
+        userHome: input.userHome,
+        uid: input.uid,
+        nodePath: input.desired.daemonCommand[0],
+        entryPath: input.desired.daemonCommand[1],
+        profileHome: input.profileHome,
+        legacyServiceId: true,
+    });
+}
+function parseGeneratedSystemdArguments(descriptor) {
+    const line = /^ExecStart=(.+)$/m.exec(descriptor)?.[1];
+    if (line === undefined)
+        return null;
+    const values = [];
+    let offset = 0;
+    while (offset < line.length) {
+        while (line[offset] === " ")
+            offset += 1;
+        if (offset >= line.length)
+            break;
+        if (line[offset] !== '"')
+            return null;
+        offset += 1;
+        let value = "";
+        let closed = false;
+        while (offset < line.length) {
+            const character = line[offset];
+            offset += 1;
+            if (character === '"') {
+                closed = true;
+                break;
+            }
+            if (character === "\\") {
+                if (offset >= line.length)
+                    return null;
+                value += line[offset];
+                offset += 1;
+            }
+            else {
+                value += character;
+            }
+        }
+        if (!closed || (offset < line.length && line[offset] !== " "))
+            return null;
+        values.push(value.replaceAll("%%", "%"));
+    }
+    return values;
+}
+async function discoverLinux(input, identity) {
+    if (identity.descriptorPath === null)
+        return null;
+    let descriptor;
+    try {
+        descriptor = await readFile(identity.descriptorPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const args = parseGeneratedSystemdArguments(descriptor);
+    if (args === null || args.length !== 7
+        || args[2] !== "serve"
+        || args[3] !== "--profile"
+        || args[4] !== input.desired.profile
+        || args[5] !== "--daemon-home"
+        || !samePath(args[6], input.profileHome, "linux")
+        || !posix.isAbsolute(args[0])
+        || daemonGlobalInstallation(args[1], "linux") === null) {
+        throw new Error(`Legacy service '${identity.id}' does not match a generated NowCrew service`);
+    }
+    const spec = buildServiceSpec({
+        platform: "linux",
+        profile: input.desired.profile,
+        userHome: input.userHome,
+        uid: input.uid,
+        nodePath: args[0],
+        entryPath: args[1],
+        profileHome: input.profileHome,
+        legacyServiceId: true,
+    });
+    if (spec.descriptor !== descriptor) {
+        throw new Error(`Legacy service '${identity.id}' does not match a generated NowCrew service`);
+    }
+    const status = await serviceStatus(spec, input.runner);
+    return { spec, snapshot: { installed: true, running: status.running } };
+}
+async function discoverDarwin(input, identity) {
+    if (identity.descriptorPath === null)
+        return null;
+    const details = await inspectLegacyServiceInstallationDetails(identity.descriptorPath, "darwin", input.userHome, input.uid, input.runner);
+    if (details === null) {
+        try {
+            await readFile(identity.descriptorPath, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+        throw new Error(`Legacy service '${identity.id}' does not match a generated NowCrew service`);
+    }
+    if (details.profile !== input.desired.profile
+        || !samePath(details.profileHome, input.profileHome, "darwin")) {
+        throw new Error(`Legacy service '${identity.id}' does not match the selected profile`);
+    }
+    const spec = buildServiceSpec({
+        platform: "darwin",
+        profile: details.profile,
+        userHome: input.userHome,
+        uid: input.uid,
+        nodePath: details.nodePath,
+        entryPath: details.entryPath,
+        profileHome: details.profileHome,
+        legacyServiceId: true,
+    });
+    const status = await serviceStatus(spec, input.runner);
+    return { spec, snapshot: { installed: true, running: status.running } };
+}
+async function discoverWindows(input, identity) {
+    const script = [
+        "$ErrorActionPreference='Stop';",
+        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
+        "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
+        "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
+        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
+        "[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+    ].join("");
+    const result = await input.runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encoded(identity.id),
+    ]);
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to inspect legacy scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
+    }
+    let definition;
+    try {
+        definition = JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error("Legacy scheduled task returned invalid JSON");
+    }
+    if (definition.count === 0)
+        return null;
+    const match = typeof definition.arguments === "string"
+        ? /^"([^"]+)" "serve" "--profile" "([^"]+)" "--daemon-home" "([^"]+)"$/.exec(definition.arguments)
+        : null;
+    if (definition.count !== 1
+        || definition.actionCount !== 1
+        || definition.principalMatches !== true
+        || !win32.isAbsolute(definition.execute ?? "")
+        || match === null
+        || match[2] !== input.desired.profile
+        || !samePath(match[3], input.profileHome, "win32")
+        || daemonGlobalInstallation(match[1], "win32") === null) {
+        throw new Error(`Legacy service '${identity.id}' does not match a generated NowCrew service`);
+    }
+    const spec = buildServiceSpec({
+        platform: "win32",
+        profile: input.desired.profile,
+        userHome: input.userHome,
+        uid: input.uid,
+        nodePath: definition.execute,
+        entryPath: match[1],
+        profileHome: input.profileHome,
+        legacyServiceId: true,
+    });
+    if (definition.arguments !== spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ")) {
+        throw new Error(`Legacy service '${identity.id}' does not match a generated NowCrew service`);
+    }
+    return {
+        spec,
+        snapshot: { installed: true, running: definition.state === 4 },
+    };
+}
+export async function discoverExactLegacyService(input) {
+    const identity = legacyIdentity(input);
+    if (identity.id === input.desired.id)
+        return null;
+    const legacy = input.desired.platform === "linux"
+        ? await discoverLinux(input, identity)
+        : input.desired.platform === "darwin"
+            ? await discoverDarwin(input, identity)
+            : await discoverWindows(input, identity);
+    if (legacy !== null && input.managedServices?.some((record) => record.platform === legacy.spec.platform
+        && (record.serviceId === legacy.spec.id
+            || (legacy.spec.descriptorPath !== null && record.descriptorPath === legacy.spec.descriptorPath))) === true) {
+        throw new Error(`Legacy service '${legacy.spec.id}' is registered and cannot be migrated automatically`);
+    }
+    return legacy;
+}

package/dist/computer-cli.js

@@ -12,6 +12,7 @@ import { acquireDaemonInstallationLease, } from "./daemon-installation-lease.js"
 import { assertManagedServiceIdentity, buildManagedServiceRecord, installManagedService, uninstallUnregisteredManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
 import { inspectManagedServiceDiagnostics } from "./managed-service-diagnostics.js";
 import { readManagedServiceRegistry } from "./managed-service-registry.js";
+import { installDaemonAutomatically, } from "./automatic-daemon-installer.js";
 const COMPUTER_COMMANDS = new Set(["profile", "doctor", "install", "uninstall", "start", "stop", "restart", "status", "upgrade"]);
 export function builtDaemonEntry(moduleUrl = import.meta.url) {
     return moduleUrl.endsWith(".js")
@@ -37,6 +38,7 @@ function defaults() {
             return result.stdout.trim();
         },
         acquireInstallationLease: acquireDaemonInstallationLease,
+        installAutomatically: installDaemonAutomatically,
         readStdin: async () => {
             if (process.stdin.isTTY)
                 throw new Error("--token-stdin requires a token on standard input");
@@ -57,6 +59,7 @@ function usage(td) {
         td("Computer lifecycle:"),
         "  crew-daemon profile save <name> --server-url <url> [--agents-root <path>] [--token-stdin]",
         "  crew-daemon profile list|show|remove [<name>]",
+        "  crew-daemon install --server-url <url> --api-key <sk_machine_*> [--profile <custom-name>]",
         "  crew-daemon doctor|install|uninstall|start|stop|restart|status --profile <name>",
         "  crew-daemon upgrade [--profile <name>]",
         "",
@@ -96,6 +99,8 @@ export async function runComputerCommand(argv, overrides = {}) {
                 "server-url": { type: "string" },
                 "agents-root": { type: "string" },
                 "token-stdin": { type: "boolean", default: false },
+                "api-key": { type: "string" },
+                token: { type: "string" },
                 help: { type: "boolean", short: "h", default: false },
             },
         });
@@ -104,6 +109,36 @@ export async function runComputerCommand(argv, overrides = {}) {
             return 0;
         }
         const [, action, positionalName] = parsed.positionals;
+        const profileName = parsed.values.profile;
+        const automaticInstall = command === "install" && parsed.values["server-url"] !== undefined;
+        const tokenOption = parsed.values["api-key"] !== undefined
+            ? "--api-key"
+            : parsed.values.token !== undefined
+                ? "--token"
+                : null;
+        if (tokenOption !== null && !automaticInstall) {
+            throw new Error(`Unknown option '${tokenOption}'`);
+        }
+        if (automaticInstall) {
+            if (parsed.values["agents-root"] !== undefined || parsed.values["token-stdin"]) {
+                throw new Error(td("Automatic installation derives its directories and accepts the machine token through --api-key"));
+            }
+            if (parsed.values["api-key"] !== undefined && parsed.values.token !== undefined) {
+                throw new Error(td("Choose one machine token source: --api-key or --token"));
+            }
+            const machineToken = (parsed.values["api-key"]
+                ?? parsed.values.token
+                ?? deps.env.CREW_MACHINE_TOKEN)?.trim();
+            if (!machineToken)
+                throw new Error(td("Missing machine token for automatic installation"));
+            const result = await deps.installAutomatically({
+                serverUrl: parsed.values["server-url"],
+                machineToken,
+                ...(profileName === undefined ? {} : { requestedProfile: profileName }),
+            });
+            deps.stdout(`${td("Installed daemon {{version}} for profile '{{profile}}'; service '{{service}}' is running.", { version: result.version, profile: result.profile, service: result.serviceId })}\n`);
+            return 0;
+        }
         const home = daemonHome(deps.env);
         const profileStorage = {
             platform: deps.platform,
@@ -157,7 +192,6 @@ export async function runComputerCommand(argv, overrides = {}) {
             deps.stdout(`${td("Saved profile '{{name}}' with private credentials.", { name })}\n`);
             return 0;
         }
-        const profileName = parsed.values.profile;
         if (command === "upgrade") {
             const installation = daemonGlobalInstallation(deps.entryPath, deps.platform);
             const restartProfile = profileName

package/dist/computer-profile.js

@@ -9,6 +9,7 @@ import { acquireProfileSaveLock, } from "./computer-profile-lock.js";
 import { formatDaemonText } from "./i18n.js";
 import { atomicPrivateWrite } from "./atomic-private-write.js";
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
+export const MachineTokenSchema = z.string().startsWith("sk_machine_").max(4096);
 const ServerUrlSchema = z.string().url().max(2048).refine((value) => {
     const url = new URL(value);
     return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
@@ -17,7 +18,7 @@ const ProfileSchema = z.object({
     version: z.literal(1),
     name: z.string().regex(PROFILE_NAME),
     serverUrl: ServerUrlSchema,
-    machineToken: z.string().startsWith("sk_machine_").max(4096),
+    machineToken: MachineTokenSchema,
     agentsRoot: z.string().min(1).optional(),
     runtimePath: z.string().min(1).max(32768).refine((value) => !value.includes("\0") && !value.includes("\n") && !value.includes("\r"), "runtimePath must be a single line").optional(),
 }).strict();

package/dist/computer-service.js

@@ -137,6 +137,40 @@ async function checked(runner, command, args, action) {
     }
     return result;
 }
+function sameWindowsPath(left, right) {
+    return left !== undefined
+        && left.replaceAll("/", "\\").toLowerCase() === right.replaceAll("/", "\\").toLowerCase();
+}
+async function windowsTaskDefinitionMatches(spec, runner) {
+    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
+    const script = [
+        "$ErrorActionPreference='Stop';",
+        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
+        "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
+        "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
+        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
+        "[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+    ].join("");
+    const result = await runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
+    ]);
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to inspect scheduled task definition: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
+    }
+    let definition;
+    try {
+        definition = JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error("Scheduled task definition returned invalid JSON");
+    }
+    const expectedArguments = spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ");
+    return definition.count === 1
+        && definition.actionCount === 1
+        && definition.principalMatches === true
+        && sameWindowsPath(definition.execute, spec.daemonCommand[0])
+        && definition.arguments === expectedArguments;
+}
 async function windowsTaskState(spec, runner) {
     const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
     const script = [
@@ -413,6 +447,38 @@ export async function serviceStatus(spec, runner = systemCommandRunner) {
         : result.exitCode === 0;
     return { ...result, installed: true, loaded: spec.platform === "darwin" ? result.exitCode === 0 : true, running };
 }
+export async function captureExactService(spec, runner) {
+    const status = await serviceStatus(spec, runner);
+    if (!status.installed)
+        return { installed: false, running: false, exact: true };
+    const exact = spec.platform === "win32"
+        ? await windowsTaskDefinitionMatches(spec, runner)
+        : spec.descriptor !== null && await readServiceDescriptor(spec) === spec.descriptor;
+    return { installed: true, running: status.running, exact };
+}
+export async function replaceExactService(spec, runner = systemCommandRunner) {
+    const snapshot = await captureExactService(spec, runner);
+    if (snapshot.installed && !snapshot.exact) {
+        throw new Error(`Installed service '${spec.id}' does not match the requested identity`);
+    }
+    if (snapshot.installed)
+        await uninstallService(spec, runner);
+    await installService(spec, runner);
+    return { installed: snapshot.installed, running: snapshot.running };
+}
+export async function restoreExactService(spec, snapshot, runner = systemCommandRunner) {
+    const current = await captureExactService(spec, runner);
+    if (current.installed && !current.exact) {
+        throw new Error(`Installed service '${spec.id}' changed before recovery`);
+    }
+    if (current.installed)
+        await uninstallService(spec, runner);
+    if (!snapshot.installed)
+        return;
+    await installService(spec, runner);
+    if (snapshot.running)
+        await serviceAction(spec, "start", runner);
+}
 export async function doctorService(spec, profilePrivate, runner = systemCommandRunner) {
     const nodeMajor = Number(process.versions.node.split(".")[0]);
     const tool = spec.platform === "darwin" ? "launchctl" : spec.platform === "linux" ? "systemctl" : "schtasks.exe";

package/dist/i18n.js

@@ -33,6 +33,10 @@ const zh = {
     "activities": "活动数",
     "Computer lifecycle:": "电脑生命周期：",
     "profile save reads the machine token from CREW_MACHINE_TOKEN, or stdin with --token-stdin.": "profile save 从 CREW_MACHINE_TOKEN 或 --token-stdin 的标准输入读取机器令牌。",
+    "Automatic installation derives its directories and accepts the machine token through --api-key": "自动安装会自行派生目录，并通过 --api-key 接收机器令牌",
+    "Choose one machine token source: --api-key or --token": "--api-key 与 --token 只能选择一种机器令牌来源",
+    "Missing machine token for automatic installation": "自动安装缺少机器令牌",
+    "Installed daemon {{version}} for profile '{{profile}}'; service '{{service}}' is running.": "已为配置 '{{profile}}' 安装 daemon {{version}}；服务 '{{service}}' 正在运行。",
     "Missing {{name}}": "缺少 {{name}}",
     "Service '{{id}}' is still installed; uninstall it before removing the profile": "服务 '{{id}}' 仍已安装；请先卸载服务再删除配置",
     "Removed profile '{{name}}'.": "已删除配置 '{{name}}'。",

package/dist/legacy-service-installation.js

@@ -18,7 +18,7 @@ const LegacyLaunchAgentSchema = z.object({
     KeepAlive: z.literal(true),
     ProcessType: z.literal("Background"),
 }).strict();
-export async function inspectLegacyServiceInstallation(descriptorPath, platform, userHome = homedir(), uid = process.getuid?.(), runner = systemCommandRunner) {
+export async function inspectLegacyServiceInstallationDetails(descriptorPath, platform, userHome = homedir(), uid = process.getuid?.(), runner = systemCommandRunner) {
     if (platform !== "darwin" || uid === undefined)
         return null;
     const result = await runner("/usr/bin/plutil", ["-convert", "json", "-o", "-", descriptorPath]);
@@ -52,5 +52,15 @@ export async function inspectLegacyServiceInstallation(descriptorPath, platform,
         return null;
     if (await readFile(descriptorPath, "utf8").catch(() => null) !== spec.descriptor)
         return null;
-    return { npmPrefix: installation.npmPrefix };
+    return {
+        npmPrefix: installation.npmPrefix,
+        nodePath,
+        entryPath,
+        profile,
+        profileHome,
+    };
+}
+export async function inspectLegacyServiceInstallation(descriptorPath, platform, userHome = homedir(), uid = process.getuid?.(), runner = systemCommandRunner) {
+    const details = await inspectLegacyServiceInstallationDetails(descriptorPath, platform, userHome, uid, runner);
+    return details === null ? null : { npmPrefix: details.npmPrefix };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.5.48",
+  "version": "0.5.49",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",