@nowcrew/daemon 0.5.52 → 0.6.1

package/dist/agent-ability/resolver.js

@@ -0,0 +1,409 @@
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { cp, lstat, mkdir, readdir, readFile, rename, rm } from "node:fs/promises";
+import { dirname, extname, join, relative, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+import { parse } from "yaml";
+import { z } from "zod";
+import { abilityWorkspaceProjectionPath, DaemonAbilityLockSchema, DaemonAbilityManifestSchema, matchesAbilityBranch, } from "./types.js";
+const runFile = promisify(execFile);
+const MAX_FILES = 5_000;
+const MAX_TOTAL_BYTES = 25 * 1024 * 1024;
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+const MAX_INSTRUCTIONS_BYTES = 96 * 1024;
+const MAX_MEMORY_BYTES = 64 * 1024;
+const DEFAULT_GIT_HOSTS = ["codeup.aliyun.com", "github.com", "gitlab.com", "bitbucket.org"];
+const EvalSuiteSchema = z.object({
+    schemaVersion: z.literal("nowcrew-eval-suite/v1"),
+    name: z.string().min(1).max(128),
+    cases: z.array(z.object({
+        id: z.string().min(1).max(128),
+        input: z.string().max(64 * 1024),
+        expected: z.object({
+            instructionPath: z.string().optional(),
+            skillNames: z.array(z.string()).max(500).optional(),
+            forbiddenSkillNames: z.array(z.string()).max(500).optional(),
+            memoryIds: z.array(z.string()).max(1_000).optional(),
+            workspaceRefs: z.array(z.string()).max(1_000).optional(),
+            evalSuite: z.string().optional(),
+            dependency: z.string().optional(),
+            commit: z.string().optional(),
+            refusalReason: z.string().optional(),
+        }).passthrough(),
+        assertions: z.array(z.string().min(1).max(128)).max(1_000),
+    }).strict()).max(1_000),
+}).strict();
+const GIT_ARGS = ["-c", "core.hooksPath=/dev/null", "-c", "filter.lfs.smudge=", "-c", "filter.lfs.required=false"];
+const gitEnv = () => ({
+    ...process.env,
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
+    GIT_TERMINAL_PROMPT: "0",
+});
+export const abilitySha256 = (content) => `sha256:${createHash("sha256").update(content).digest("hex")}`;
+export const safeAbilityName = (value) => value.replace(/[^A-Za-z0-9._-]/gu, "_").slice(0, 128);
+export const validateAbilityGitHost = (repositoryUrl, configuredHosts = process.env.CREW_AGENT_ABILITY_GIT_HOSTS ?? "") => {
+    const scpHost = repositoryUrl.match(/^git@([a-z0-9.-]+):/iu)?.[1];
+    let hostname = scpHost;
+    if (!hostname) {
+        try {
+            hostname = new URL(repositoryUrl).hostname;
+        }
+        catch { /* URL schema reports the syntax error. */ }
+    }
+    const allowed = new Set([
+        ...DEFAULT_GIT_HOSTS,
+        ...configuredHosts.split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean),
+    ]);
+    if (!hostname || !allowed.has(hostname.toLowerCase()))
+        throw new Error("ability_repository_host_not_allowed");
+    return hostname.toLowerCase();
+};
+const comparePosixPaths = (left, right) => {
+    const leftParts = left.split("/");
+    const rightParts = right.split("/");
+    for (let index = 0; index < Math.min(leftParts.length, rightParts.length); index += 1) {
+        if (leftParts[index] === rightParts[index])
+            continue;
+        return leftParts[index] < rightParts[index] ? -1 : 1;
+    }
+    return leftParts.length - rightParts.length;
+};
+const git = async (args, cwd) => {
+    const result = await runFile("git", [...GIT_ARGS, ...args], {
+        ...(cwd ? { cwd } : {}), env: gitEnv(), timeout: 60_000, maxBuffer: 16 * 1024 * 1024,
+    });
+    return result.stdout.trim();
+};
+export const collectAbilityFiles = async (root) => {
+    const files = [];
+    let totalBytes = 0;
+    const visit = async (directory) => {
+        const entries = await readdir(directory, { withFileTypes: true });
+        for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+            if (entry.name === ".git" || entry.name === ".DS_Store" || entry.name === "__pycache__"
+                || entry.name.endsWith(".pyc") || entry.name.endsWith(".pyo"))
+                continue;
+            const absolute = join(directory, entry.name);
+            const info = await lstat(absolute);
+            if (info.isSymbolicLink())
+                throw new Error(`ability_symlink_forbidden:${relative(root, absolute)}`);
+            if (info.isDirectory())
+                await visit(absolute);
+            else if (info.isFile()) {
+                if (info.size > MAX_FILE_BYTES)
+                    throw new Error(`ability_file_size_exceeded:${relative(root, absolute)}`);
+                totalBytes += info.size;
+                if (totalBytes > MAX_TOTAL_BYTES)
+                    throw new Error("ability_total_size_exceeded");
+                if (files.length >= MAX_FILES)
+                    throw new Error("ability_file_count_exceeded");
+                files.push({ path: relative(root, absolute).split(sep).join("/"), content: await readFile(absolute) });
+            }
+        }
+    };
+    await visit(root);
+    return files.sort((left, right) => comparePosixPaths(left.path, right.path));
+};
+export const abilityTreeDigest = (rootPath, files) => {
+    const exact = files.find((file) => file.path === rootPath);
+    const nested = exact ? [exact] : files.filter((file) => file.path.startsWith(`${rootPath}/`));
+    if (nested.length === 0)
+        throw new Error(`ability_locked_asset_missing:${rootPath}`);
+    const digest = createHash("sha256");
+    for (const file of nested) {
+        digest.update(file.path);
+        digest.update("\0");
+        digest.update(file.content);
+        digest.update("\0");
+    }
+    return `sha256:${digest.digest("hex")}`;
+};
+const frontmatter = (content) => {
+    const lines = content.split(/\r?\n/u);
+    if (lines[0] !== "---")
+        throw new Error("ability_memory_frontmatter_missing");
+    const result = {};
+    for (const line of lines.slice(1)) {
+        if (line === "---")
+            break;
+        const separator = line.indexOf(":");
+        if (separator > 0 && !line.startsWith(" "))
+            result[line.slice(0, separator).trim()] = line.slice(separator + 1).trim();
+    }
+    return result;
+};
+const materializeGit = async (cacheRoot, repositoryUrl, commit, target) => {
+    const repositoryKey = createHash("sha256").update(repositoryUrl).digest("hex");
+    const bare = join(cacheRoot, "git", `${repositoryKey}.git`);
+    await mkdir(dirname(bare), { recursive: true });
+    try {
+        await lstat(bare);
+    }
+    catch {
+        await git(["init", "--bare", bare]);
+    }
+    const remotes = await git(["--git-dir", bare, "remote"]);
+    if (!remotes.split("\n").includes("origin"))
+        await git(["--git-dir", bare, "remote", "add", "origin", repositoryUrl]);
+    else
+        await git(["--git-dir", bare, "remote", "set-url", "origin", repositoryUrl]);
+    await git(["--git-dir", bare, "fetch", "--no-tags", "--prune", "origin", commit]);
+    const temp = `${target}.tmp-${randomUUID()}`;
+    await rm(temp, { recursive: true, force: true });
+    await git(["clone", "--no-checkout", "--shared", bare, temp]);
+    await git(["checkout", "--detach", commit], temp);
+    await rm(join(temp, ".git"), { recursive: true, force: true });
+    await mkdir(dirname(target), { recursive: true });
+    await rm(target, { recursive: true, force: true });
+    await rename(temp, target);
+};
+const resolveRoot = async (cacheRoot, repositoryUrl, branchGlob, desiredCommit) => {
+    const repositoryKey = createHash("sha256").update(repositoryUrl).digest("hex");
+    const bare = join(cacheRoot, "git", `${repositoryKey}.git`);
+    await mkdir(dirname(bare), { recursive: true });
+    try {
+        await lstat(bare);
+    }
+    catch {
+        await git(["init", "--bare", bare]);
+    }
+    const remotes = await git(["--git-dir", bare, "remote"]);
+    if (!remotes.split("\n").includes("origin"))
+        await git(["--git-dir", bare, "remote", "add", "origin", repositoryUrl]);
+    else
+        await git(["--git-dir", bare, "remote", "set-url", "origin", repositoryUrl]);
+    await git(["--git-dir", bare, "fetch", "--no-tags", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"]);
+    const refs = (await git(["--git-dir", bare, "for-each-ref", "--format=%(refname:strip=3)\t%(objectname)\t%(committerdate:unix)", "refs/remotes/origin"])).split("\n")
+        .filter(Boolean).map((line) => {
+        const [branch, commit, time] = line.split("\t");
+        return { branch: branch, commit: commit, time: Number(time) };
+    }).filter((candidate) => matchesAbilityBranch(branchGlob, candidate.branch));
+    if (refs.length === 0)
+        throw new Error("ability_release_branch_not_found");
+    const selected = refs.filter((candidate) => desiredCommit === undefined || candidate.commit === desiredCommit)
+        .sort((left, right) => right.time - left.time || right.branch.localeCompare(left.branch))[0];
+    if (!selected)
+        throw new Error("ability_desired_commit_not_found");
+    const root = join(cacheRoot, "artifacts", repositoryKey, selected.commit);
+    try {
+        await lstat(root);
+    }
+    catch {
+        await materializeGit(cacheRoot, repositoryUrl, selected.commit, root);
+    }
+    const tree = await git(["--git-dir", bare, "rev-parse", `${selected.commit}^{tree}`]);
+    return { ...selected, root, repositoryKey, treeDigest: `git:${tree}` };
+};
+const verifyExternalDependencies = async (cacheRoot, root, lock) => {
+    const paths = new Map();
+    for (const dependency of lock.dependencies) {
+        const target = join(root, ".nowcrew-external", safeAbilityName(dependency.name));
+        await materializeGit(cacheRoot, dependency.url, dependency.commit, target);
+        const files = await collectAbilityFiles(target);
+        const actual = abilityTreeDigest(dependency.path, files);
+        if (actual !== dependency.contentDigest)
+            throw new Error(`ability_dependency_lock_drift:${dependency.name}`);
+        paths.set(dependency.name, join(".nowcrew-external", safeAbilityName(dependency.name), dependency.path).split(sep).join("/"));
+    }
+    return paths;
+};
+export const validateAbilityDependencyDeclarations = (manifest, lock) => {
+    const dependencies = new Map(lock.dependencies.map((dependency) => [dependency.name, dependency]));
+    const declared = new Set();
+    for (const skill of manifest.spec.skills) {
+        if (skill.source.type !== "git")
+            continue;
+        declared.add(skill.name);
+        const dependency = dependencies.get(skill.name);
+        if (!dependency
+            || dependency.url !== skill.source.url
+            || dependency.requestedRef !== skill.source.ref
+            || dependency.path !== skill.source.path
+            || (skill.trust !== undefined && dependency.trust !== skill.trust)) {
+            throw new Error(`ability_dependency_manifest_mismatch:${skill.name}`);
+        }
+    }
+    if (lock.dependencies.some((dependency) => !declared.has(dependency.name))) {
+        throw new Error("ability_lock_has_undeclared_dependency");
+    }
+};
+const scan = (files, manifest) => {
+    const findings = [];
+    const secrets = [
+        /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/u,
+        /\b(?:sk|sk-ant|ghp|glpat|xox[baprs])[-_][-A-Za-z0-9_]{16,}\b/u,
+        /\bAK(?:ID|IA)[A-Z0-9]{12,}\b/u,
+    ];
+    const executable = new Set([".exe", ".dll", ".dylib", ".so", ".bin", ".class", ".jar"]);
+    const allowedBinaryDocuments = new Set([".pdf", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".xlsx", ".xls", ".docx", ".pptx"]);
+    for (const file of files) {
+        let text;
+        try {
+            text = new TextDecoder("utf-8", { fatal: true }).decode(file.content);
+        }
+        catch {
+            if (!allowedBinaryDocuments.has(extname(file.path).toLowerCase())) {
+                findings.push({ code: "binary_asset", path: file.path });
+            }
+            continue;
+        }
+        if (secrets.some((pattern) => pattern.test(text)))
+            findings.push({ code: "secret_detected", path: file.path });
+        if (executable.has(extname(file.path).toLowerCase()))
+            findings.push({ code: "executable_asset", path: file.path });
+    }
+    const required = new Set(["instructions", "memory-policy", "memory-seed", "workspace", "eval-policy", "eval-cases"]);
+    if (manifest.spec.skills.length > 0)
+        required.add("skills");
+    return { findings, required };
+};
+const lockedManifestPaths = (manifest) => [
+    manifest.spec.instructions.path,
+    ...manifest.spec.skills.flatMap((skill) => skill.source.type === "local" ? [skill.source.path] : []),
+    ...manifest.spec.memory.policy.map((entry) => entry.path),
+    ...manifest.spec.memory.seeds.map((entry) => entry.path),
+    ...manifest.spec.workspace.assets.map((entry) => entry.source),
+    manifest.spec.evals.policy,
+    ...manifest.spec.evals.cases,
+];
+export const evaluateAbilityCases = (files, manifest, lock, memory) => {
+    const skillNames = new Set(manifest.spec.skills.map((skill) => skill.name));
+    for (const file of files) {
+        if (!file.path.endsWith("/SKILL.md"))
+            continue;
+        const parts = file.path.split("/");
+        if (parts.length > 1)
+            skillNames.add(parts.at(-2));
+    }
+    const memoryIds = new Set(memory.map((entry) => entry.id));
+    const filePaths = new Set(files.map((file) => file.path));
+    const workspaceReferenceResolves = (reference) => {
+        if (!reference.startsWith("workspace://"))
+            return false;
+        const target = reference.slice("workspace://".length);
+        return manifest.spec.workspace.assets.some((asset) => {
+            const projection = abilityWorkspaceProjectionPath(asset.target);
+            if (target === projection)
+                return filePaths.has(asset.source);
+            if (!target.startsWith(`${projection}/`))
+                return false;
+            return filePaths.has(`${asset.source}/${target.slice(projection.length + 1)}`);
+        });
+    };
+    const assertions = [];
+    for (const path of manifest.spec.evals.cases) {
+        const source = files.find((file) => file.path === path);
+        const parsed = source
+            ? EvalSuiteSchema.safeParse((() => {
+                try {
+                    return JSON.parse(source.content.toString("utf8"));
+                }
+                catch {
+                    return null;
+                }
+            })())
+            : null;
+        if (!parsed?.success) {
+            assertions.push({ name: `eval_suite_schema:${path}`.slice(0, 128), passed: false });
+            continue;
+        }
+        for (const testCase of parsed.data.cases) {
+            const expected = testCase.expected;
+            const dependency = expected.dependency
+                ? lock.dependencies.find((entry) => entry.name === expected.dependency)
+                : undefined;
+            const expectedSkills = [...(expected.skillNames ?? []), ...(expected.forbiddenSkillNames ?? [])];
+            const passed = (expected.instructionPath === undefined
+                || expected.instructionPath === manifest.spec.instructions.path)
+                && expectedSkills.every((name) => skillNames.has(name))
+                && (expected.memoryIds ?? []).every((id) => memoryIds.has(id))
+                && (expected.workspaceRefs ?? []).every(workspaceReferenceResolves)
+                && (expected.evalSuite === undefined || expected.evalSuite === parsed.data.name)
+                && (expected.dependency === undefined || dependency !== undefined)
+                && (expected.commit === undefined || dependency?.commit === expected.commit);
+            assertions.push({
+                name: `eval_case:${parsed.data.name}:${testCase.id}`.slice(0, 128),
+                passed,
+            });
+        }
+    }
+    return assertions;
+};
+export async function resolveAbilityRelease(agentsRoot, command) {
+    validateAbilityGitHost(command.repositoryUrl);
+    const cacheRoot = join(agentsRoot, ".crew", "ability-cache");
+    const resolved = await resolveRoot(cacheRoot, command.repositoryUrl, command.branchGlob, command.desiredCommit);
+    const rawManifest = await readFile(join(resolved.root, "agent.yaml"));
+    const manifest = DaemonAbilityManifestSchema.parse(parse(rawManifest.toString("utf8")));
+    const lock = DaemonAbilityLockSchema.parse(JSON.parse(await readFile(join(resolved.root, "agent.lock.json"), "utf8")));
+    for (const dependency of lock.dependencies)
+        validateAbilityGitHost(dependency.url);
+    if (lock.manifestDigest !== abilitySha256(rawManifest))
+        throw new Error("ability_manifest_lock_drift");
+    validateAbilityDependencyDeclarations(manifest, lock);
+    let files = await collectAbilityFiles(resolved.root);
+    for (const asset of lock.assets) {
+        if (abilityTreeDigest(asset.path, files) !== asset.contentDigest)
+            throw new Error(`ability_asset_lock_drift:${asset.path}`);
+    }
+    const externalPaths = await verifyExternalDependencies(cacheRoot, resolved.root, lock);
+    files = await collectAbilityFiles(resolved.root);
+    const security = scan(files, manifest);
+    const kinds = new Set(lock.assets.map((asset) => asset.kind));
+    const memory = [];
+    for (const [layer, mounts] of [["release-policy", manifest.spec.memory.policy], ["release-seed", manifest.spec.memory.seeds]]) {
+        for (const mount of mounts) {
+            for (const file of files.filter((candidate) => candidate.path.startsWith(`${mount.path}/`) && candidate.path.endsWith(".md"))) {
+                const content = file.content.toString("utf8");
+                const metadata = frontmatter(content);
+                if (!metadata.id || !metadata.authority)
+                    throw new Error(`ability_memory_frontmatter_invalid:${file.path}`);
+                memory.push({ id: metadata.id, layer, authority: metadata.authority, path: file.path, content });
+            }
+        }
+    }
+    const lockedPaths = new Set(lock.assets.map((asset) => asset.path));
+    const assertions = [
+        { name: "manifest_lock_verified", passed: true },
+        { name: "manifest_asset_paths_locked", passed: lockedManifestPaths(manifest).every((path) => lockedPaths.has(path)) },
+        { name: "all_five_layers_resolvable", passed: [...security.required].every((kind) => kind === "skills" ? kinds.has(kind) || (manifest.spec.skills.length > 0 && lock.dependencies.length > 0) : kinds.has(kind)) },
+        { name: "dependencies_pinned", passed: lock.dependencies.every((dependency) => /^[a-f0-9]{40}$/u.test(dependency.commit)) },
+        { name: "security_scan_clear", passed: security.findings.length === 0 },
+        ...evaluateAbilityCases(files, manifest, lock, memory),
+    ];
+    const artifactDigest = abilitySha256(JSON.stringify({
+        repositoryUrl: command.repositoryUrl, rootCommit: resolved.commit, treeDigest: resolved.treeDigest,
+        lock, external: [...externalPaths.entries()].sort(([left], [right]) => left.localeCompare(right)),
+    }));
+    const assetSummary = Object.freeze(Object.fromEntries(lock.assets.reduce((counts, asset) => {
+        counts.set(asset.kind, (counts.get(asset.kind) ?? 0) + 1);
+        return counts;
+    }, new Map())));
+    const instructionsContent = (files.find((file) => file.path === manifest.spec.instructions.path)?.content
+        ?? (() => { throw new Error("ability_instructions_missing"); })()).toString("utf8");
+    if (Buffer.byteLength(instructionsContent, "utf8") > MAX_INSTRUCTIONS_BYTES) {
+        throw new Error("ability_instructions_size_exceeded");
+    }
+    if (memory.reduce((bytes, entry) => bytes + Buffer.byteLength(entry.content, "utf8"), 0) > MAX_MEMORY_BYTES) {
+        throw new Error("ability_memory_size_exceeded");
+    }
+    return {
+        branch: resolved.branch, rootCommit: resolved.commit, treeDigest: resolved.treeDigest,
+        artifactDigest, schemaVersion: manifest.apiVersion, manifest, lock, assetSummary,
+        scanSummary: { passed: security.findings.length === 0, blockingFindings: security.findings.length, findings: security.findings.slice(0, 100) },
+        evalSummary: { passed: assertions.every((assertion) => assertion.passed), assertions },
+        materialization: {
+            cacheKey: `${resolved.repositoryKey}/${resolved.commit}`, repositoryUrl: command.repositoryUrl,
+            branch: resolved.branch, rootCommit: resolved.commit, artifactDigest,
+            instructionsPath: manifest.spec.instructions.path,
+            instructionsContent,
+            skills: manifest.spec.skills.map((skill) => ({
+                name: skill.name,
+                path: skill.source.type === "local" ? skill.source.path : externalPaths.get(skill.name),
+                mode: skill.mode,
+            })),
+            memory, workspace: manifest.spec.workspace.assets, evals: manifest.spec.evals.cases,
+        },
+    };
+}

package/dist/agent-ability/runtime.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { AbilityReleaseSnapshotSchema, AgentHandleSchema } from "../execution-protocol.js";
+import { createAgentAbilityController } from "./controller.js";
+import { createAgentAbilityMaterializer } from "./materializer.js";
+import { AGENT_ABILITY_CAPABILITY, AGENT_ABILITY_WORKSPACE_CAPABILITY } from "./types.js";
+const AbilityApplyCommandSchema = z.object({
+    type: z.literal("agent:ability:apply"),
+    reqId: z.string().min(1).max(128),
+    handle: AgentHandleSchema,
+    ability: AbilityReleaseSnapshotSchema,
+}).strict();
+export function createAgentAbilityRuntime(agentsRoot, options = {}) {
+    const controller = options.controller ?? createAgentAbilityController({ agentsRoot });
+    const materializer = options.materializer ?? createAgentAbilityMaterializer(agentsRoot);
+    return {
+        materializer,
+        async tryHandleControlMessage(input, serverCapabilities, send) {
+            const type = input?.type;
+            if (type !== "agent:ability:resolve" && type !== "agent:ability:apply")
+                return false;
+            const reqId = input.reqId;
+            if (typeof reqId !== "string")
+                return true;
+            let result;
+            const requiredCapability = type === "agent:ability:apply"
+                ? AGENT_ABILITY_WORKSPACE_CAPABILITY
+                : AGENT_ABILITY_CAPABILITY;
+            if (!serverCapabilities.has(requiredCapability)) {
+                result = { ok: false, error: "capability_unavailable" };
+            }
+            else if (type === "agent:ability:resolve") {
+                result = await controller.handle(input);
+            }
+            else {
+                const parsed = AbilityApplyCommandSchema.safeParse(input);
+                if (!parsed.success)
+                    result = { ok: false, error: "invalid_ability_apply_command" };
+                else {
+                    try {
+                        result = { ok: true, data: await materializer.apply(agentsRoot, parsed.data.handle, parsed.data.ability) };
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : "ability_workspace_projection_failed";
+                        result = {
+                            ok: false,
+                            error: /^[a-z0-9_:-]+$/u.test(message) ? message.slice(0, 200) : "ability_workspace_projection_failed",
+                        };
+                    }
+                }
+            }
+            try {
+                send({ type: "fs:result", reqId, ...result });
+            }
+            catch {
+                // The control plane request timeout handles a lost response.
+            }
+            return true;
+        },
+    };
+}

package/dist/agent-ability/types.js

@@ -0,0 +1,117 @@
+import { z } from "zod";
+export const AGENT_ABILITY_CAPABILITY = "agent_ability_release_v1";
+export const AGENT_ABILITY_WORKSPACE_CAPABILITY = "agent_ability_workspace_v1";
+const DigestSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const CommitSchema = z.string().regex(/^[a-f0-9]{40}$/u);
+export const SafeAbilityPathSchema = z.string().min(1).max(512).refine((value) => !value.startsWith("/") && !value.includes("\\") && !value.includes("\0")
+    && value.split("/").every((part) => part.length > 0 && part !== "." && part !== ".."), "unsafe ability path");
+export const WorkspaceAbilityTargetSchema = SafeAbilityPathSchema.refine((value) => value.startsWith("training/workspace/") || value.startsWith(".nowcrew/ability/"), "training workspace targets must stay under training/workspace/");
+export function abilityWorkspaceProjectionPath(target) {
+    WorkspaceAbilityTargetSchema.parse(target);
+    return target.startsWith("training/workspace/")
+        ? target.slice("training/workspace/".length)
+        : target.slice(".nowcrew/ability/".length);
+}
+export const AbilityRepositoryUrlSchema = z.string().trim().min(1).max(2_048).superRefine((value, ctx) => {
+    const scpLike = /^git@[a-z0-9.-]+:[A-Za-z0-9._~/-]+(?:\.git)?$/iu.test(value);
+    let allowedUrl = false;
+    try {
+        const url = new URL(value);
+        allowedUrl = (url.protocol === "https:" || url.protocol === "ssh:")
+            && !url.username && !url.password && Boolean(url.hostname);
+    }
+    catch { /* handled below */ }
+    if (!scpLike && !allowedUrl)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "unsupported repository URL" });
+});
+export const AbilityBranchGlobSchema = z.string().min(1).max(128).superRefine((value, ctx) => {
+    if (/\s|[\p{Cc}\\]/u.test(value) || value.includes("..") || value.includes("@{")
+        || value.startsWith("-") || !/[A-Za-z0-9._/-]/u.test(value) || /[^A-Za-z0-9._/*-]/u.test(value)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "invalid branch glob" });
+    }
+});
+export function matchesAbilityBranch(glob, branch) {
+    AbilityBranchGlobSchema.parse(glob);
+    if (!branch || branch.startsWith("refs/") || branch.includes("..") || /\s|[\p{Cc}\\]/u.test(branch))
+        return false;
+    let pattern = "^";
+    for (let index = 0; index < glob.length; index += 1) {
+        const character = glob[index];
+        if (character === "*") {
+            pattern += ".*";
+            if (glob[index + 1] === "*")
+                index += 1;
+        }
+        else
+            pattern += character.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    }
+    return new RegExp(`${pattern}$`, "u").test(branch);
+}
+const ModeSchema = z.enum(["managed-readonly", "managed-copy", "overlay", "generated"]);
+const LocalSkillSchema = z.object({ type: z.literal("local"), path: SafeAbilityPathSchema, catalog: SafeAbilityPathSchema.optional() }).strict();
+const GitSkillSchema = z.object({
+    type: z.literal("git"), url: AbilityRepositoryUrlSchema, ref: z.string().min(1).max(256), path: SafeAbilityPathSchema,
+}).strict();
+export const DaemonAbilityManifestSchema = z.object({
+    apiVersion: z.literal("nowcrew.ai/v1alpha1"), kind: z.literal("AgentTraining"),
+    metadata: z.object({ name: z.string().min(1).max(128), version: z.string().min(1).max(64), description: z.string().max(1_000).optional() }).strict(),
+    spec: z.object({
+        instructions: z.object({ path: SafeAbilityPathSchema }).strict(),
+        skills: z.array(z.object({
+            name: z.string().min(1).max(128), source: z.union([LocalSkillSchema, GitSkillSchema]),
+            mount: SafeAbilityPathSchema, mode: ModeSchema, trust: z.string().max(128).optional(),
+        }).strict()).max(500),
+        memory: z.object({
+            policy: z.array(z.object({ path: SafeAbilityPathSchema, mode: ModeSchema, mergeKey: z.string().optional() }).strict()).max(100),
+            seeds: z.array(z.object({ path: SafeAbilityPathSchema, mode: ModeSchema, mergeKey: z.string().optional() }).strict()).max(1_000),
+            runtime: z.object({ store: z.literal("nowcrew-managed"), promotion: z.literal("pull-request"), retentionDays: z.number().int().positive().optional() }).strict(),
+        }).strict(),
+        workspace: z.object({ assets: z.array(z.object({
+                source: SafeAbilityPathSchema, target: WorkspaceAbilityTargetSchema, mode: ModeSchema,
+            }).strict()).max(1_000) }).strict(),
+        evals: z.object({ policy: SafeAbilityPathSchema, cases: z.array(SafeAbilityPathSchema).min(1).max(1_000) }).strict(),
+        compatibility: z.object({
+            providers: z.array(z.enum(["claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness"])).min(1),
+            minNowCrewVersion: z.string().regex(/^\d+\.\d+\.\d+$/u),
+        }).strict().optional(),
+        permissions: z.object({
+            network: z.literal("declared-only"), executableAssets: z.literal("skill-declared-only"),
+            secrets: z.literal("runtime-only"), productionWrites: z.literal("human-confirmed").optional(),
+        }).strict(),
+        rollout: z.object({ mode: z.enum(["manual", "auto_after_gates", "scheduled", "pinned"]), canaryExecutions: z.number().int().min(0).max(100), rollbackOnGateFailure: z.boolean().optional() }).strict(),
+    }).strict(),
+}).strict().superRefine((manifest, ctx) => {
+    const unique = (values, path, label) => {
+        if (new Set(values).size !== values.length) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: [...path], message: `duplicate ${label}` });
+        }
+    };
+    unique(manifest.spec.skills.map((skill) => skill.name), ["spec", "skills"], "Skill name");
+    unique(manifest.spec.skills.map((skill) => skill.name.replace(/[^A-Za-z0-9._-]/gu, "_")), ["spec", "skills"], "Skill projection");
+    unique(manifest.spec.skills.map((skill) => skill.mount), ["spec", "skills"], "Skill mount");
+    unique(manifest.spec.workspace.assets.map((asset) => asset.target), ["spec", "workspace", "assets"], "Workspace target");
+    unique(manifest.spec.evals.cases, ["spec", "evals", "cases"], "Eval case");
+});
+export const DaemonAbilityLockSchema = z.object({
+    lockVersion: z.literal(1), manifestDigest: DigestSchema,
+    assets: z.array(z.object({ kind: z.string().min(1).max(64), path: SafeAbilityPathSchema, contentDigest: DigestSchema }).strict()).max(5_000),
+    dependencies: z.array(z.object({
+        name: z.string().min(1).max(128), url: AbilityRepositoryUrlSchema, requestedRef: z.string().min(1).max(256),
+        commit: CommitSchema, path: SafeAbilityPathSchema, contentDigest: DigestSchema, trust: z.string().min(1).max(128),
+    }).strict()).max(500),
+    generatedBy: z.string().min(1).max(256),
+}).strict().superRefine((lock, ctx) => {
+    const assetKeys = lock.assets.map((asset) => `${asset.kind}\0${asset.path}`);
+    if (new Set(assetKeys).size !== assetKeys.length) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["assets"], message: "duplicate locked asset" });
+    }
+    const dependencyNames = lock.dependencies.map((dependency) => dependency.name);
+    if (new Set(dependencyNames).size !== dependencyNames.length) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["dependencies"], message: "duplicate dependency name" });
+    }
+});
+export const AbilityResolveCommandSchema = z.object({
+    type: z.literal("agent:ability:resolve"), reqId: z.string().min(1).max(128),
+    handle: z.string().min(1).max(64), repositoryUrl: AbilityRepositoryUrlSchema,
+    branchGlob: AbilityBranchGlobSchema, desiredCommit: CommitSchema.optional(),
+}).strict();

package/dist/control-plane-url.js

@@ -0,0 +1,16 @@
+import { executionBackendCapability } from "./execution-backend.js";
+import { daemonCapabilities, EXECUTION_PROTOCOL } from "./machine-info.js";
+import { PROJECT_SKILLS_CAPABILITY } from "./project-skills/types.js";
+export function buildControlPlaneUrl(serverUrl, machineToken, runtimePlatform = process.platform, jobObjectProbe, projectSkillsAvailable = true) {
+    const query = new URLSearchParams({ key: machineToken });
+    if (executionBackendCapability(runtimePlatform, jobObjectProbe).supported) {
+        query.set("execution_min", String(EXECUTION_PROTOCOL.min));
+        query.set("execution_max", String(EXECUTION_PROTOCOL.max));
+    }
+    for (const capability of daemonCapabilities(runtimePlatform)) {
+        if (capability !== PROJECT_SKILLS_CAPABILITY || projectSkillsAvailable) {
+            query.append("capability", capability);
+        }
+    }
+    return `${serverUrl.replace(/^http/, "ws").replace(/\/+$/, "")}/daemon/connect?${query.toString()}`;
+}

package/dist/execution-protocol.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { AbilityRepositoryUrlSchema, SafeAbilityPathSchema, WorkspaceAbilityTargetSchema, } from "./agent-ability/types.js";
 import { MAX_AGENT_PROJECT_SKILL_BINDINGS } from "./project-skills/types.js";
 const ExecutionIdSchema = z.string().uuid();
 const ProtocolVersionSchema = z.literal(1);
@@ -22,6 +23,24 @@ const ProjectSkillRefSchema = z.object({
     projectId: z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/u),
     skillName: z.string().min(1).max(128).regex(/^[a-z0-9][a-z0-9._:-]*$/u),
 }).strict();
+export const AbilityReleaseSnapshotSchema = z.object({
+    bindingId: z.string().uuid(),
+    releaseId: z.string().uuid(),
+    repositoryUrl: AbilityRepositoryUrlSchema,
+    branch: z.string().min(1).max(256),
+    rootCommit: z.string().regex(/^[a-f0-9]{40}$/u),
+    treeDigest: z.string().regex(/^git:[a-f0-9]{40,64}$/u),
+    artifactDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
+    instructions: z.object({ path: SafeAbilityPathSchema, content: z.string().max(96 * 1024) }).strict(),
+    skills: z.array(z.object({ name: z.string().min(1).max(128), path: SafeAbilityPathSchema, mode: z.string().max(64) }).strict()).max(500),
+    memory: z.array(z.object({
+        id: z.string().min(1).max(256),
+        layer: z.enum(["release-policy", "release-seed", "runtime-semantic", "runtime-episodic", "user"]),
+        authority: z.string().min(1).max(128), path: SafeAbilityPathSchema, content: z.string().max(64 * 1024),
+    }).strict()).max(100),
+    workspace: z.array(z.object({ source: SafeAbilityPathSchema, target: WorkspaceAbilityTargetSchema, mode: z.string().max(64) }).strict()).max(1_000),
+    evalProvenance: z.object({ cases: z.array(SafeAbilityPathSchema).max(1_000) }).strict(),
+}).strict();
 export const ReasoningSchema = z.string().min(1).max(64)
     .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u, "invalid runtime reasoning token");
 export const PermissionSchema = z.enum([
@@ -97,6 +116,7 @@ export const ExecutionStartSchema = z.object({
         handle: AgentHandleSchema,
         memoryEnabled: z.boolean().optional(),
         projectSkills: z.array(ProjectSkillRefSchema).max(MAX_AGENT_PROJECT_SKILL_BINDINGS).optional(),
+        abilityRelease: AbilityReleaseSnapshotSchema.optional(),
     }).strict(),
     workspace: z.object({
         taskKey: z.string().min(1).max(200),

package/dist/execution-runner.js

@@ -517,6 +517,7 @@ export async function runExecution(config, input, dependencies) {
                 ? {}
                 : { startupTimeoutMs: dependencies.startupTimeoutMs }),
             ...(dependencies.projectSkills === undefined ? {} : { projectSkills: dependencies.projectSkills }),
+            ...(dependencies.abilityRelease === undefined ? {} : { abilityRelease: dependencies.abilityRelease }),
             launchRuntime: async (request) => {
                 if (launchClosed || dependencies.cancellation?.isRequested())
                     throw new ExecutionCancelledError();
@@ -585,6 +586,7 @@ export async function runExecution(config, input, dependencies) {
             ...(spec.context.wakeMessageId === undefined ? {} : { wakeMessageId: spec.context.wakeMessageId }),
             ...(spec.context.attachments === undefined ? {} : { attachments: spec.context.attachments }),
             ...(spec.agent.projectSkills === undefined ? {} : { projectSkills: spec.agent.projectSkills }),
+            ...(spec.agent.abilityRelease === undefined ? {} : { abilityRelease: spec.agent.abilityRelease }),
             systemPrompt: boundedSystemPrompt,
             wakePrompt: spec.instructions.wakePrompt,
             runtime: {