@nowcrew/daemon 0.6.101-beta.3 → 0.6.101-beta.5

package/dist/runtime-tool-update-bridge.js

@@ -0,0 +1,126 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { RuntimeToolResponseSchema } from "./runtime-tool-update-protocol.js";
+export function runtimeToolEnvironment(env) {
+    // Keep only machine identity and lookup settings. Never pass runtime/control-plane credentials or Node injection flags.
+    return Object.fromEntries(Object.entries(env).filter(([key]) => /^(PATH|HOME|USER|LOGNAME|SHELL|TMPDIR|TMP|TEMP|LANG|LC_[A-Z_]+|XDG_CONFIG_HOME|XDG_CACHE_HOME)$/u.test(key)));
+}
+async function readReport(dir) {
+    const file = join(dir, "report.json");
+    if ((await stat(file)).size > 256_000)
+        throw new Error("invalid_report");
+    return RuntimeToolResponseSchema.parse(JSON.parse(await readFile(file, "utf8")));
+}
+async function stopGroup(pid) {
+    if (!pid)
+        return true;
+    try {
+        process.kill(-pid, "SIGKILL");
+    }
+    catch (error) {
+        return error.code === "ESRCH";
+    }
+    const deadline = Date.now() + 3000;
+    while (Date.now() < deadline) {
+        try {
+            process.kill(-pid, 0);
+        }
+        catch (error) {
+            return error.code === "ESRCH";
+        }
+        await new Promise(resolve => setTimeout(resolve, 50));
+    }
+    return false;
+}
+export function createRuntimeToolProgressPoller(read, progress, intervalMs = 250) {
+    let active = true;
+    let pending = null;
+    const interval = setInterval(() => {
+        if (!active || pending || !progress)
+            return;
+        pending = read().then(async (data) => { if (active)
+            await progress(data); })
+            .catch(() => { }).finally(() => { pending = null; });
+    }, intervalMs);
+    return { async stop() { active = false; clearInterval(interval); await pending; } };
+}
+async function supervise(dir, env, start, progress, protectProcessGroup) {
+    const child = spawn(process.execPath, [join(dir, "runner.mjs"), "--managed-worker"], { cwd: dir, env, detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"] });
+    const closed = new Promise(resolve => { child.once("error", () => resolve(null)); child.once("close", resolve); });
+    const polling = createRuntimeToolProgressPoller(() => readReport(dir), progress);
+    let expired = false;
+    const timer = setTimeout(() => { expired = true; void stopGroup(child.pid); }, start ? 12 * 60_000 : 120_000);
+    let launchFailed = false;
+    try {
+        if (start) {
+            if (!protectProcessGroup || !child.pid)
+                throw new Error("lease_protection_unavailable");
+            await protectProcessGroup(child.pid);
+        }
+        await new Promise((resolve, reject) => child.send({ type: "runtime-tools:go" }, error => error ? reject(error) : resolve()));
+    }
+    catch {
+        launchFailed = true;
+        await stopGroup(child.pid);
+    }
+    const code = await closed;
+    clearTimeout(timer);
+    await polling.stop();
+    // A successful parent exit does not prove its package-manager descendants stopped.
+    const stopped = await stopGroup(child.pid);
+    return { stopped, success: stopped && !expired && !launchFailed && code === 0 };
+}
+export async function runRuntimeToolBridge(config, request, acquireEnv, progress, deps = {}) {
+    let dir;
+    let started = false;
+    let processStopped = true;
+    const failure = (errorCode) => ({ processStopped, data: request.action === "start" ? { operation: {
+                operationId: request.operationId, state: started ? "unknown" : "failed", currentIndex: 0, targets: request.targets,
+                items: request.targets.map(t => ({ runtime: t.installation.runtime, state: started ? "unknown" : "failed", errorCode })),
+                updatedAt: new Date().toISOString(), errorCode,
+            } } : {} });
+    try {
+        const response = await (deps.fetch ?? fetch)(`${config.serverUrl.replace(/\/+$/, "")}/machine/runtime-tool-updates/runner/${request.runner.releaseId}`, {
+            headers: { authorization: `Bearer ${config.machineToken}` }, redirect: "error", signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok || !response.body)
+            return failure("runner_unavailable");
+        const chunks = [];
+        let bytes = 0;
+        for await (const chunk of response.body) {
+            bytes += chunk.length;
+            if (bytes > 512_000)
+                return failure("runner_unavailable");
+            chunks.push(chunk);
+        }
+        const content = Buffer.concat(chunks);
+        if (createHash("sha256").update(content).digest("hex") !== request.runner.sha256)
+            return failure("runner_unavailable");
+        const env = runtimeToolEnvironment(await acquireEnv());
+        dir = await mkdtemp(join(tmpdir(), "nowwork-runtime-update-"));
+        await writeFile(join(dir, "runner.mjs"), content, { mode: 0o600 });
+        await writeFile(join(dir, "request.json"), JSON.stringify(request), { mode: 0o600 });
+        started = true;
+        processStopped = false;
+        const outcome = await supervise(dir, env, request.action === "start", progress, deps.protectProcessGroup);
+        processStopped = outcome.stopped;
+        if (!outcome.success)
+            return failure("operation_unknown");
+        const data = await readReport(dir);
+        if (request.action === "start" && data.operation?.operationId !== request.operationId)
+            return failure("operation_unknown");
+        if (request.action === "inspect" && !data.snapshot)
+            return failure("inspection_failed");
+        return { data, processStopped };
+    }
+    catch {
+        return failure(started ? "operation_unknown" : "runner_unavailable");
+    }
+    finally {
+        if (dir && processStopped)
+            await rm(dir, { recursive: true, force: true });
+    }
+}

package/dist/runtime-tool-update-controller.js

@@ -0,0 +1,151 @@
+import { RuntimeToolRequestSchema, RuntimeToolResponseSchema } from "./runtime-tool-update-protocol.js";
+const finalStates = new Set(["completed", "failed", "unknown", "cancelled"]);
+const phaseRank = (state) => ({ queued: 0, preflight: 1, installing: 2, verifying: 3, completed: 4, failed: 4, unknown: 4, cancelled: 4 })[state];
+function advancesProgress(previous, next) {
+    if (finalStates.has(previous.state) || finalStates.has(next.state)
+        || next.operationId !== previous.operationId || JSON.stringify(next.targets) !== JSON.stringify(previous.targets)
+        || next.currentIndex < previous.currentIndex || next.currentIndex >= previous.targets.length
+        || (next.currentIndex === previous.currentIndex && phaseRank(next.state) < phaseRank(previous.state)))
+        return false;
+    return previous.items.every((item, index) => {
+        const candidate = next.items[index];
+        if (!candidate || candidate.runtime !== item.runtime)
+            return false;
+        return finalStates.has(item.state) ? candidate.state === item.state && candidate.errorCode === item.errorCode
+            : phaseRank(candidate.state) >= phaseRank(item.state);
+    });
+}
+export function createRuntimeToolUpdateController(deps) {
+    const entries = new Map();
+    let current = null;
+    let stopped = false;
+    let orphaned = false;
+    const now = deps.now ?? Date.now;
+    const date = () => new Date(now()).toISOString();
+    const wait = deps.wait ?? (() => new Promise(resolve => setTimeout(resolve, 500)));
+    const fail = (error) => ({ ok: false, error });
+    const result = (data) => ({ ok: true, data });
+    const set = (entry, patch) => { entry.operation = { ...entry.operation, ...patch, updatedAt: date() }; };
+    async function execute(entry) {
+        const deadline = now() + 10 * 60_000;
+        let acceptingProgress = false;
+        let lease = null;
+        try {
+            while (!stopped && entry.operation.state === "queued" && now() < deadline && !lease) {
+                lease = await deps.acquire();
+                if (!lease)
+                    await wait();
+            }
+            if (entry.operation.state === "cancelled")
+                return;
+            if (!lease || stopped || now() >= deadline) {
+                set(entry, { state: "failed", errorCode: "runtime_busy" });
+                return;
+            }
+            set(entry, { state: "preflight" });
+            // Mark unsafe before spawning: an exception or lost response cannot authorize another writer.
+            entry.processStopped = false;
+            acceptingProgress = true;
+            const output = await deps.run(entry.request, raw => {
+                if (!acceptingProgress)
+                    return;
+                const parsed = RuntimeToolResponseSchema.safeParse(raw);
+                if (parsed.success && parsed.data.operation && advancesProgress(entry.operation, parsed.data.operation))
+                    entry.operation = parsed.data.operation;
+            }, lease.protectProcessGroup);
+            acceptingProgress = false;
+            const data = RuntimeToolResponseSchema.parse(output.data);
+            entry.processStopped = output.processStopped;
+            if (!data.operation || data.operation.operationId !== entry.operation.operationId
+                || JSON.stringify(data.operation.targets) !== JSON.stringify(entry.request.targets)
+                || data.operation.currentIndex < entry.operation.currentIndex || !finalStates.has(data.operation.state))
+                throw new Error("operation_mismatch");
+            entry.operation = data.operation;
+            if (!entry.processStopped)
+                set(entry, { state: "unknown", errorCode: "operation_unknown" });
+        }
+        catch {
+            acceptingProgress = false;
+            set(entry, { state: "unknown", errorCode: "operation_unknown" });
+        }
+        finally {
+            acceptingProgress = false;
+            // Retain the barrier if process-group termination could not be proved.
+            if (entry.processStopped) {
+                try {
+                    await lease?.release();
+                }
+                catch {
+                    entry.processStopped = false;
+                    set(entry, { state: "unknown", errorCode: "operation_unknown" });
+                }
+            }
+        }
+    }
+    return {
+        async handle(raw) {
+            const parsed = RuntimeToolRequestSchema.safeParse(raw);
+            if (!parsed.success || stopped)
+                return fail("invalid_request");
+            const request = parsed.data;
+            if (request.action === "inspect") {
+                try {
+                    const data = RuntimeToolResponseSchema.parse((await deps.run(request)).data);
+                    return data.snapshot ? result(data) : fail("inspection_failed");
+                }
+                catch {
+                    return fail("inspection_failed");
+                }
+            }
+            const entry = entries.get(request.operationId);
+            if (request.action === "start") {
+                if (entry)
+                    return result({ operation: entry.operation });
+                if (orphaned || [...entries.values()].some(x => x.operation.state === "unknown"))
+                    return fail("operation_unknown");
+                if (current)
+                    return fail("runtime_busy");
+                if (entries.size >= 100)
+                    return fail("operation_limit");
+                if (new Set(request.targets.map(t => t.installation.runtime)).size !== request.targets.length)
+                    return fail("invalid_request");
+                const operation = { operationId: request.operationId, state: "queued", currentIndex: 0, targets: request.targets,
+                    items: request.targets.map(t => ({ runtime: t.installation.runtime, state: "queued", errorCode: null })), updatedAt: date(), errorCode: null };
+                const next = { operation, request, processStopped: true };
+                entries.set(request.operationId, next);
+                current = execute(next).finally(() => { current = null; });
+                return result({ operation });
+            }
+            if (!entry) {
+                orphaned = true;
+                return fail("operation_unknown");
+            }
+            if (request.action === "status")
+                return result({ operation: entry.operation });
+            if (request.action === "cancel") {
+                if (entry.operation.state !== "queued")
+                    return fail("already_started");
+                set(entry, { state: "cancelled", items: entry.operation.items.map(x => ({ ...x, state: "cancelled" })) });
+                return result({ operation: entry.operation });
+            }
+            if (!entry.processStopped || current)
+                return fail("operation_unknown");
+            try {
+                const output = await deps.run({ action: "inspect", runner: entry.request.runner });
+                const snapshot = RuntimeToolResponseSchema.parse(output.data).snapshot;
+                if (!snapshot || !output.processStopped)
+                    return fail("operation_unknown");
+                const matches = entry.operation.targets.every(target => snapshot.tools.some(tool => tool.runtime === target.installation.runtime
+                    && tool.version === target.targetVersion && tool.path === target.installation.path && tool.source === target.installation.source
+                    && tool.prefix === target.installation.prefix && tool.brewPath === target.installation.brewPath && tool.automatic));
+                set(entry, { state: matches ? "completed" : "failed", errorCode: matches ? null : "verification_failed", snapshot,
+                    items: entry.operation.items.map(x => ({ ...x, state: matches ? "completed" : "failed", errorCode: matches ? null : "verification_failed" })) });
+                return result({ operation: entry.operation, snapshot });
+            }
+            catch {
+                return fail("inspection_failed");
+            }
+        },
+        async stop() { stopped = true; await current; },
+    };
+}

package/dist/runtime-tool-update-protocol.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+export const RUNTIME_TOOL_UPDATES_CAPABILITY = "runtime_tool_updates_v1";
+const boundedPath = z.string().min(1).max(4096);
+export const RuntimeToolRunnerSchema = z.object({ releaseId: z.string().regex(/^[a-f0-9]{64}$/), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
+export const RuntimeToolInstallationSchema = z.object({
+    runtime: z.enum(["codex", "claude"]), path: boundedPath, realPath: boundedPath,
+    version: z.string().max(100).nullable(), source: z.enum(["npm", "homebrew", "native", "unknown"]),
+    nodeVersion: z.string().max(100).nullable(), nodePath: boundedPath.nullable(), npmPath: boundedPath.nullable(), prefix: boundedPath.nullable(),
+    brewPath: boundedPath.nullable(), brewKind: z.enum(["formula", "cask"]).nullable(), brewName: z.enum(["codex", "claude-code"]).nullable(),
+    fingerprint: z.string().regex(/^[a-f0-9]{64}$/), alternatives: z.array(boundedPath).max(32), automatic: z.boolean(), reason: z.string().max(100).nullable(),
+}).strict();
+export const RuntimeToolSnapshotSchema = z.object({ checkedAt: z.string().datetime(), tools: z.array(RuntimeToolInstallationSchema).max(2) }).strict();
+export const RuntimeToolTargetSchema = z.object({ installation: RuntimeToolInstallationSchema, targetVersion: z.string().regex(/^\d+\.\d+\.\d+$/).max(100) }).strict();
+export const RuntimeToolStateSchema = z.enum(["queued", "preflight", "installing", "verifying", "completed", "failed", "unknown", "cancelled"]);
+export const RuntimeToolOperationSchema = z.object({ operationId: z.string().uuid(), state: RuntimeToolStateSchema, currentIndex: z.number().int().min(0).max(2),
+    targets: z.array(RuntimeToolTargetSchema).min(1).max(2), items: z.array(z.object({ runtime: z.enum(["codex", "claude"]), state: RuntimeToolStateSchema, errorCode: z.string().max(100).nullable() }).strict()).max(2),
+    updatedAt: z.string().datetime(), errorCode: z.string().max(100).nullable(), snapshot: RuntimeToolSnapshotSchema.optional(),
+}).strict();
+export const RuntimeToolRequestSchema = z.discriminatedUnion("action", [
+    z.object({ action: z.literal("inspect"), runner: RuntimeToolRunnerSchema }).strict(),
+    z.object({ action: z.literal("start"), operationId: z.string().uuid(), targets: z.array(RuntimeToolTargetSchema).min(1).max(2), runner: RuntimeToolRunnerSchema }).strict(),
+    ...["status", "cancel", "verify"].map(action => z.object({ action: z.literal(action), operationId: z.string().uuid() }).strict()),
+]);
+export const RuntimeToolResponseSchema = z.object({ snapshot: RuntimeToolSnapshotSchema.optional(), operation: RuntimeToolOperationSchema.optional() }).strict();

package/dist/runtime-tool-update-serve.js

@@ -0,0 +1,54 @@
+import { prepareDaemonRestart } from "./daemon-updater.js";
+import { createRuntimeToolUpdateController } from "./runtime-tool-update-controller.js";
+import { augmentedPath } from "./runtime-path.js";
+import { runRuntimeToolBridge } from "./runtime-tool-update-bridge.js";
+export async function acquireRuntimeToolLease(localSlots, host) {
+    const local = await prepareDaemonRestart({ localSlots });
+    if (!local.ok)
+        return null;
+    try {
+        const shared = await host.tryAcquireExclusiveExecution();
+        if (!shared) {
+            await local.release();
+            return null;
+        }
+        let released = false;
+        return { protectProcessGroup: async (pid) => {
+                if (!shared.protectProcessGroup)
+                    throw new Error("lease protection unavailable");
+                await shared.protectProcessGroup(pid);
+            }, async release() { if (released)
+                return; await shared.release(); await local.release(); released = true; } };
+    }
+    catch (error) {
+        await local.release();
+        throw error;
+    }
+}
+export function createServeRuntimeToolUpdates(config, localSlots, host, acquireEnv, refresh) {
+    const controller = createRuntimeToolUpdateController({ acquire: () => acquireRuntimeToolLease(localSlots, host),
+        run: async (request, progress, protectProcessGroup) => {
+            const result = await runRuntimeToolBridge(config, request, async () => {
+                const env = await acquireEnv();
+                return { ...env, PATH: augmentedPath(env, {}, process.platform, "append") };
+            }, progress, { ...(protectProcessGroup ? { protectProcessGroup } : {}) });
+            if (request.action === "start" && result.processStopped)
+                refresh();
+            return result;
+        } });
+    return {
+        handle(raw, send) {
+            if (!raw || typeof raw !== "object" || !("type" in raw) || raw.type !== "runtime-tools:operation")
+                return false;
+            const { reqId, type: _type, ...request } = raw;
+            if (typeof reqId === "string") {
+                if (process.platform !== "linux" && process.platform !== "darwin")
+                    send({ type: "fs:result", reqId, ok: false, error: "unsupported_platform" });
+                else
+                    void controller.handle(request).then(result => send({ type: "fs:result", reqId, ...result })).catch(() => send({ type: "fs:result", reqId, ok: false, error: "operation_unknown" }));
+            }
+            return true;
+        },
+        stop: controller.stop,
+    };
+}

package/dist/runtimes/claude-thread-runner.js

@@ -12,6 +12,14 @@ const InputSchema = z.object({ bin: z.string().min(1), args: z.array(z.string())
     wakePrompt: z.string().min(1), sessionId: z.string().min(1).optional(), resume: z.boolean() }).strict();
 class PreflightError extends Error {
 }
+// Claude waits for every merged SessionStart hook before acknowledging SDK
+// initialization. Those hooks may legitimately outlive the old 30s adapter
+// deadline. Cap this phase below the daemon's default 120s fail-closed startup
+// window so wrapper failure propagation and supervisor-owned tree cleanup retain
+// margin. The 100s cap leaves a nominal 20s outside this phase; this runner's
+// local TERM/KILL cleanup is itself bounded to 2s.
+// Resume and cold recovery share this one budget; hook activity never extends it.
+export const CLAUDE_INITIALIZE_TIMEOUT_MS = 100_000;
 function hookCommand(path, nonce) {
     const source = import.meta.url.endsWith(".ts");
     const hook = fileURLToPath(new URL(`./claude-session-start-hook.${source ? "ts" : "js"}`, import.meta.url));
@@ -52,6 +60,9 @@ async function bounded(promise, milliseconds, label) {
         clearTimeout(timer);
     }
 }
+export function waitForClaudeInitialize(initialized, timeoutMs = CLAUDE_INITIALIZE_TIMEOUT_MS) {
+    return bounded(initialized, timeoutMs, "claude_initialize_timeout");
+}
 async function attempt(input, sessionId, resume, options) {
     const proofDir = await mkdtemp(join(tmpdir(), "nowwork-claude-session-"));
     const proofPath = join(proofDir, "proof.json");
@@ -188,7 +199,7 @@ async function attempt(input, sessionId, resume, options) {
     try {
         try {
             await send({ type: "control_request", request_id: initId, request: { subtype: "initialize" } });
-            await bounded(initialized.promise, options.initializeTimeoutMs ?? 30_000, "claude_initialize_timeout");
+            await waitForClaudeInitialize(initialized.promise, options.initializeTimeoutMs);
             const proof = JSON.parse(await readFile(proofPath, "utf8"));
             if (proof.nonce !== nonce || proof.sessionId !== sessionId || proof.source !== (resume ? "resume" : "startup")) {
                 throw new Error("claude_session_proof_mismatch");
@@ -238,15 +249,25 @@ async function attempt(input, sessionId, resume, options) {
 }
 export async function runClaudeThread(input, options = {}) {
     const sessionId = input.sessionId ?? randomUUID();
+    const initializeBudgetMs = options.initializeTimeoutMs ?? CLAUDE_INITIALIZE_TIMEOUT_MS;
+    const now = options.now ?? (() => performance.now());
+    const initializeDeadline = now() + Math.max(0, initializeBudgetMs);
+    const runAttempt = (attemptSessionId, resume) => {
+        const remainingMs = Math.max(0, Math.ceil(initializeDeadline - now()));
+        if (remainingMs === 0)
+            return Promise.reject(new PreflightError("claude_native_session_unconfirmed"));
+        return attempt(input, attemptSessionId, resume, { ...options, initializeTimeoutMs: remainingMs });
+    };
     try {
-        return await attempt(input, sessionId, input.resume, options);
+        return await runAttempt(sessionId, input.resume);
     }
     catch (error) {
         // The failed attempt never received a business user turn or entered its
-        // model/tool loop. Native startup hooks may run again on cold recovery.
+        // model/tool loop. Native startup hooks may run again on cold recovery,
+        // within the original aggregate initialize deadline.
         if (!input.resume || !(error instanceof PreflightError || error instanceof ThreadDeliveryColdStartRequired))
             throw error;
-        return attempt(input, randomUUID(), false, options);
+        return runAttempt(randomUUID(), false);
     }
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/dist/serve.js

@@ -14,6 +14,7 @@ import { reconcileExecutionJournal } from "./execution-recovery.js";
 import { initReleaseSlog, reportDaemonConnectionClose, reportReleaseError } from "./release-channel-guard.js";
 import { handleWorkspaceControlRequest } from "./workspace-control-handler.js";
 import { inspectRaftWorkspace, importRaftWorkspace } from "./workspace-import.js";
+import { withMemoryAccess } from "./local-memory/migration-access.js";
 import { normalizeScheduledContext } from "./scheduled-report.js";
 import { formatDaemonLogLine } from "./log-format.js";
 import { reportAgentRunComplete } from "./scheduled-run-report.js";
@@ -48,8 +49,11 @@ import { initializedProjectSkillsReconciler } from "./project-skills/initialized
 import { parseMemoryPruneTraceId } from "./memory-prune-diagnostics.js";
 import { probeRuntimeHealth } from "./runtime-health.js";
 import { createServeMarketplace } from "./marketplace-serve.js";
+import { createServeRuntimeToolUpdates } from "./runtime-tool-update-serve.js";
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
+import { createMemoryMigrationController } from "./memory-migration-controller.js";
+import { createMemoryMigrationJournal, replayExecutionJournals } from "./memory-migration-journal.js";
 import { bindStorageServerIdentity, createStorageIdentityAdmission, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
@@ -75,6 +79,8 @@ export function serve(config, opts = {}) {
     let reconnectTimer = null;
     let stopPromise = null;
     let executionJournal;
+    let migrationExecutionJournal;
+    let migrationJournalReady = false;
     const injectedExecutionJournal = opts.execution?.journal;
     const agentMemory = opts.execution?.dependencies?.agentMemory
         ?? (config.agentMemory === null ? undefined : createAgentMemoryBridge(config.agentMemory));
@@ -89,6 +95,15 @@ export function serve(config, opts = {}) {
             startupGapMs: config.executionLimits.startupGapMs,
         });
     const localSlots = createSharedSlotManager(config.executionLimits);
+    const memoryMigrations = createMemoryMigrationController({ config, coordinator: hostCoordinator,
+        isAdmissionClosed: () => stopped || storageIdentityAdmission.isAdmissionClosed(),
+        journal: () => { if (!migrationJournalReady)
+            throw new Error("memory_migration_journal_unavailable"); return migrationExecutionJournal; }, send: frame => {
+            if (frame.type === "execution:completed")
+                completionRetransmitter.track(frame);
+            else if (ws?.readyState === WebSocket.OPEN)
+                ws.send(JSON.stringify(frame));
+        } });
     const sharedSlots = hostCoordinatedSlotManager(localSlots, hostCoordinator);
     const concurrencyTelemetry = createExecutionConcurrencyTelemetry(sharedSlots, {
         ...(opts.execution?.concurrencySnapshotIntervalMs === undefined
@@ -210,6 +225,7 @@ export function serve(config, opts = {}) {
         onError: (code, context) => dslog("execution.runtime_detection_failed", "机器环境或 runtime 探测失败", { level: "ERROR", error_code: code, ...context }),
     });
     machineRuntime.prewarm();
+    const runtimeToolUpdates = createServeRuntimeToolUpdates(config, localSlots, hostCoordinator, async () => ({ ...(await machineRuntime.provider.acquire()).env }), () => machineRuntime.refresh());
     const initializedProjectSkills = initializedProjectSkillsReconciler(() => projectSkillsController.ensureScanned(), projectSkillsReconciler);
     const configuredCapabilities = opts.machineInfo?.capabilities ?? daemonCapabilities(process.platform);
     const prepareCapabilities = async () => daemonCapabilityBindings(process.platform, [...configuredCapabilities, ...await managedDaemonCapabilities(updateEligibility)]);
@@ -270,7 +286,7 @@ export function serve(config, opts = {}) {
         return null;
     };
     const sendSnapshot = async (reqId) => {
-        const entries = (await executionJournal.replay()).map(snapshotEntry).filter((entry) => entry !== null);
+        const entries = (await replayExecutionJournals(executionJournal, migrationExecutionJournal)).map(snapshotEntry).filter((entry) => entry !== null);
         safeExecutionSend(ExecutionSnapshotSchema.parse({
             type: "execution:snapshot", protocolVersion: 1, reqId, entries,
         }));
@@ -352,6 +368,12 @@ export function serve(config, opts = {}) {
             machineRuntime.open(openedSocket, { capabilities: capabilities.machineHello, beforePublish: Promise.resolve(), connectionId });
             opts.onOpen?.(ws);
             void sendSnapshot(`reconnect-${randomUUID()}`);
+            // 普通回执不等待维护日志IO；两类记录分别重放到同一发送器。
+            void migrationExecutionJournal.replay().then(entries => {
+                for (const entry of entries)
+                    if (entry.completion && !entry.completionAcknowledged)
+                        completionRetransmitter.track(entry.completion);
+            }).catch(() => dslog("memory_migration.journal_unavailable", "维护回执重放失败，普通回执继续", { level: "ERROR" }));
             void executionJournal.replay()
                 .then((entries) => {
                 for (const entry of entries) {
@@ -431,7 +453,8 @@ export function serve(config, opts = {}) {
                         return;
                     if (frame.type === "execution:completion-ack") {
                         try {
-                            await executionJournal.acknowledgeCompletion(frame.executionId);
+                            const journal = await executionJournal.get(frame.executionId) ? executionJournal : migrationExecutionJournal;
+                            await journal.acknowledgeCompletion(frame.executionId);
                             const attempts = completionRetransmitter.acknowledge(frame.executionId);
                             dslog("execution.completion_acknowledged", "execution completion ACK 已持久化", {
                                 execution_id: frame.executionId,
@@ -457,6 +480,8 @@ export function serve(config, opts = {}) {
                         return;
                     }
                     if (frame.type === "execution:cancel") {
+                        if (memoryMigrations.cancel(frame.executionId))
+                            return;
                         if (!knownExecutionHashes.has(frame.executionId)
                             && !executionRuns.has(frame.executionId)
                             && await executionJournal.get(frame.executionId) === null)
@@ -689,6 +714,7 @@ export function serve(config, opts = {}) {
                     const execution = executeProtocol(config, spec, {
                         ...opts.execution?.dependencies,
                         machineEnvironment: machineRuntime.provider,
+                        ...(memoryMigrations.getIdentity() === null ? {} : { controlIdentity: memoryMigrations.getIdentity() }),
                         capabilities: capabilities.executionRunner,
                         projectSkills: opts.execution?.dependencies?.projectSkills ?? initializedProjectSkills,
                         abilityRelease: opts.execution?.dependencies?.abilityRelease ?? agentAbilityRuntime.materializer,
@@ -779,6 +805,8 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
+                if (r.workspaceId && r.machineId)
+                    memoryMigrations.setIdentity({ workspaceId: r.workspaceId, machineId: r.machineId });
                 // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。ackSupported() 依赖它判断是否重试,
                 // 必须在任何 republish() 之前就位;否则本轮 republish 看到空集合→不排重试→整套 ack/重连机制哑火。
                 serverCapabilities = new Set(Array.isArray(r.serverCapabilities)
@@ -842,11 +870,19 @@ export function serve(config, opts = {}) {
                 }
                 return;
             }
+            const runtimeUpdateSocket = ws;
+            if (runtimeToolUpdates.handle(msg, frame => { try {
+                runtimeUpdateSocket?.send(JSON.stringify(frame));
+            }
+            catch { /* Server reconciles via status. */ } }))
+                return;
             if (marketplace.handle(msg, frame => { try {
                 ws?.send(JSON.stringify(frame));
             }
             catch { /* server 会按请求超时处理 */ } }))
                 return;
+            if (await memoryMigrations.handle(msg))
+                return;
             if (await agentAbilityRuntime.tryHandleControlMessage(msg, serverCapabilities, (frame) => ws?.send(JSON.stringify(frame))))
                 return;
             // 导入 raft agent 工作区:inspect 反填 name/description;import 复制用户内容
@@ -861,7 +897,7 @@ export function serve(config, opts = {}) {
                 try {
                     const data2 = req.type === "raft:inspect"
                         ? await inspectRaftWorkspace(req.path)
-                        : await importRaftWorkspace(req.path, join(config.agentsRoot, req.handle));
+                        : await withMemoryAccess(join(config.agentsRoot, req.handle), () => importRaftWorkspace(req.path, join(config.agentsRoot, req.handle)), { create: true });
                     if (req.type === "raft:import") {
                         log(`📦 已导入 raft 工作区 → ${req.handle}: 复制 ${data2.copied.length} 项`);
                     }
@@ -1254,6 +1290,7 @@ export function serve(config, opts = {}) {
                 return;
             // server 能力随连接失效;下个连接的 ready 帧重新声明(防降级重连后沿用过期能力)。
             serverCapabilities = new Set();
+            memoryMigrations.clearIdentity();
             completionRetransmitter.pause();
             // 4001 = 控制面应用级「鉴权失败」关闭码(见 server control-plane.ts)。即使上面的
             // error 帧因 close 抢先而丢失,也能据关闭码识别这是凭证失效——退避拉满,不再每秒热循环。
@@ -1306,6 +1343,9 @@ export function serve(config, opts = {}) {
             writeStderr: (line) => process.stderr.write(line),
         });
         await runProjectSkillStartupCleanup(config.agentsRoot, executionJournal, dslog);
+        migrationExecutionJournal = createMemoryMigrationJournal(config.agentsRoot);
+        await migrationExecutionJournal.reconcileAfterRestart().then(() => { migrationJournalReady = true; })
+            .catch(() => dslog("memory_migration.journal_unavailable", "迁移日志恢复失败，普通执行继续，迁移请求单独报错", { level: "ERROR" }));
         await connect();
     })();
     const stop = () => {
@@ -1323,9 +1363,11 @@ export function serve(config, opts = {}) {
             const webSocketClosed = closeWebSocketWithinDeadline(ws, deadline.signal);
             const pending = [
                 machineRuntime.stop(),
+                memoryMigrations.stop(),
                 webSocketClosed,
                 updateController.drain(),
                 marketplace.stop(),
+                runtimeToolUpdates.stop(),
                 executionFrameQueue,
                 ...executionRuns.values(),
                 ...[...legacyRuns.values()].map((run) => run.done),
@@ -1341,6 +1383,8 @@ export function serve(config, opts = {}) {
                 if (executionJournal !== undefined) {
                     await executionJournal.close({ signal: deadline.signal });
                 }
+                if (migrationExecutionJournal !== undefined)
+                    await migrationExecutionJournal.close({ signal: deadline.signal });
             }
             finally {
                 deadline.dispose();

package/dist/token.js

@@ -7,6 +7,7 @@ export async function mintAgentToken(serverUrl, machineToken, handle, displayNam
         },
         // 把本轮唤醒的线程根钉到 per-launch 令牌:服务端据此让 task/消息默认绑/回当前线程。
         body: JSON.stringify({
+            memoryStateGuardVersion: 1,
             handle,
             ...(displayName ? { displayName } : {}),
             ...(options.wakeThreadRoot ? { wakeThreadRoot: options.wakeThreadRoot } : {}),

package/dist/workspace-control-handler.js

@@ -1,9 +1,22 @@
 /** 控制面文件/技能查看的按需处理，独立于执行生命周期。 */
-import { join } from "node:path";
+import { lstat } from "node:fs/promises";
+import { join, resolve } from "node:path";
 import { readSharedMessageFile } from "./message-file-preview.js";
 import { listWorkspace, readWorkspaceFile } from "./workspace-fs.js";
 import { listSkills } from "./skills.js";
 import { listRuntimeModels } from "./list-models.js";
+import { withMemoryAccess } from "./local-memory/migration-access.js";
+async function listProtectedWorkspace(root, path) {
+    try {
+        await lstat(root);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        return { root: resolve(root), path: path.replace(/^\/+/, ""), entries: [] };
+    }
+    return withMemoryAccess(root, () => listWorkspace(root, path));
+}
 export async function handleWorkspaceControlRequest(raw, agentsRoot, registry, models = listRuntimeModels) {
     if (!raw || typeof raw !== "object")
         return null;
@@ -15,8 +28,8 @@ export async function handleWorkspaceControlRequest(raw, agentsRoot, registry, m
     try {
         const root = join(agentsRoot, request.handle);
         const data = request.type === "fs:read-shared" ? await readSharedMessageFile(agentsRoot, raw, registry)
-            : request.type === "fs:list" ? await listWorkspace(root, request.path)
-                : request.type === "fs:read" ? await readWorkspaceFile(root, request.path)
+            : request.type === "fs:list" ? await listProtectedWorkspace(root, request.path)
+                : request.type === "fs:read" ? await withMemoryAccess(root, () => readWorkspaceFile(root, request.path))
                     : request.type === "skills:list" ? await listSkills(request.runtime)
                         : { models: await models(request.runtime ?? "") };
         return { type: "fs:result", reqId: request.reqId, ok: true, data };