@nowcrew/daemon 0.6.19 → 0.6.21

package/dist/project-skills/serve-capability.js

@@ -0,0 +1,28 @@
+import { WebSocket } from "ws";
+import { daemonCapabilityBindings, } from "../machine-info.js";
+import { prepareProjectSkillConnectionCapabilities, } from "./capability.js";
+export function createProjectSkillConnectionCapabilityProvider(input) {
+    return async () => daemonCapabilityBindings(input.platform, await prepareProjectSkillConnectionCapabilities(input));
+}
+export function createProjectSkillMachineHelloPublisher(input) {
+    let latest = null;
+    let latestSocket = null;
+    const republish = () => {
+        if (latest === null || latestSocket?.readyState !== WebSocket.OPEN)
+            return;
+        const hello = input.effective(latest, input.status());
+        try {
+            latestSocket.send(JSON.stringify(hello));
+            input.onSent(hello);
+        }
+        catch { /* 非 OPEN,忽略 */ }
+    };
+    return Object.freeze({
+        publish: (hello, socket) => {
+            latest = hello;
+            latestSocket = socket;
+            republish();
+        },
+        republish,
+    });
+}

package/dist/project-skills/serve-startup.js

@@ -0,0 +1,22 @@
+import { createExecutionJournal } from "../execution-journal.js";
+import { reconcileExecutionJournal } from "../execution-recovery.js";
+import { dslog, flushSlog } from "../slog.js";
+export async function initializeProjectSkillProtectedExecutionJournal(input) {
+    return input.startup.initializeAfterLeaseProtection(input.config.agentsRoot, async (snapshot) => {
+        input.protectedExecutionIds.clear();
+        for (const executionId of snapshot)
+            input.protectedExecutionIds.add(executionId);
+        const journal = input.injectedJournal ?? createExecutionJournal(input.config.agentsRoot, {
+            protectedExecutionIds: () => input.protectedExecutionIds,
+        });
+        await reconcileExecutionJournal(journal, {
+            agentsRoot: input.config.agentsRoot,
+            serverUrl: input.config.serverUrl,
+            ...(input.profileName === undefined ? {} : { profileName: input.profileName }),
+            log: dslog,
+            flush: flushSlog,
+            writeStderr: (line) => process.stderr.write(line),
+        });
+        return journal;
+    });
+}

package/dist/project-skills/types.js

@@ -1,4 +1,5 @@
 export const PROJECT_SKILLS_CAPABILITY = "project_skills_v1";
+export const PROJECT_SKILL_PROJECTION_V2_CAPABILITY = "project_skill_projection_v2";
 export const MAX_PROJECT_ID_LENGTH = 64;
 export const MAX_PROJECT_SKILL_NAME_LENGTH = 128;
 export const MAX_PROJECT_SKILL_DESCRIPTION_LENGTH = 1_000;

package/dist/runtimes/codex-home-migration-cli.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import { migrateCodexHome } from "./codex-home-migration.js";
+const { values } = parseArgs({
+    args: process.argv.slice(2),
+    strict: true,
+    options: {
+        "agent-home": { type: "string" },
+        "source-home": { type: "string" },
+        "backup-root": { type: "string" },
+        yes: { type: "boolean", default: false },
+    },
+});
+function required(value, name) {
+    if (!value?.trim())
+        throw new Error(`Missing --${name}`);
+    return value;
+}
+if (!values.yes)
+    throw new Error("Refusing Codex home migration without --yes");
+const result = await migrateCodexHome({
+    agentHome: required(values["agent-home"], "agent-home"),
+    sourceHome: required(values["source-home"], "source-home"),
+    backupRoot: required(values["backup-root"], "backup-root"),
+});
+process.stdout.write(`${result.status}${result.backupDir ? ` backup=${result.backupDir}` : ""}\n`);

package/dist/runtimes/codex-home-migration.js

@@ -0,0 +1,112 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { lstat, mkdir, readlink, rename, rm, symlink, unlink, } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { atomicPrivateWrite } from "../atomic-private-write.js";
+import { defaultCodexHome, materializeDefaultCodexHome } from "./codex-home.js";
+const execFileAsync = promisify(execFile);
+const SQLITE_FILES = ["state_5.sqlite", "state_5.sqlite-wal", "state_5.sqlite-shm"];
+const MARKER_NAME = ".codex-home-migration.json";
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+async function assertNoOpenSqliteFiles(codexHome) {
+    for (const name of SQLITE_FILES) {
+        const path = join(codexHome, name);
+        if (!(await exists(path)))
+            continue;
+        try {
+            const result = await execFileAsync("lsof", ["-t", "--", path], { encoding: "utf8" });
+            if (result.stdout.trim()) {
+                throw new Error(`Codex SQLite file is still open: ${path}`);
+            }
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 1)
+                continue;
+            if (code === "ENOENT")
+                throw new Error("lsof is required to verify Codex home quiescence");
+            throw error;
+        }
+    }
+}
+async function symlinkTarget(path) {
+    try {
+        const info = await lstat(path);
+        if (!info.isSymbolicLink())
+            return null;
+        return await readlink(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+export async function migrateCodexHome(input, dependencies = {}) {
+    const agentHome = resolve(input.agentHome);
+    const sourceHome = resolve(input.sourceHome);
+    const backupRoot = resolve(input.backupRoot);
+    const codexHome = defaultCodexHome(agentHome);
+    const sessions = join(codexHome, "sessions");
+    const index = join(codexHome, "session_index.jsonl");
+    const expectedSessions = resolve(sourceHome, "sessions");
+    const expectedIndex = resolve(sourceHome, "session_index.jsonl");
+    const marker = join(codexHome, MARKER_NAME);
+    const sessionLink = await symlinkTarget(sessions);
+    const indexLink = await symlinkTarget(index);
+    if (sessionLink === null && indexLink === null && await exists(marker)) {
+        return { status: "already-migrated" };
+    }
+    if (sessionLink === null || indexLink === null) {
+        throw new Error("Refusing migration: Codex home is not in the complete legacy symlink layout");
+    }
+    if (resolve(codexHome, sessionLink) !== expectedSessions || resolve(codexHome, indexLink) !== expectedIndex) {
+        throw new Error("Refusing migration: legacy symlinks do not point to the configured source home");
+    }
+    await (dependencies.ensureQuiesced ?? assertNoOpenSqliteFiles)(codexHome);
+    const stamp = (dependencies.now ?? (() => new Date()))().toISOString().replaceAll(/[^0-9]/g, "").slice(0, 14);
+    const backupDir = join(backupRoot, `${stamp}-${dependencies.id?.() ?? randomUUID()}`);
+    await mkdir(backupDir, { recursive: true, mode: 0o700 });
+    await symlink(sessionLink, join(backupDir, "sessions"), "dir");
+    await symlink(indexLink, join(backupDir, "session_index.jsonl"), "file");
+    const moved = [];
+    try {
+        for (const name of SQLITE_FILES) {
+            const current = join(codexHome, name);
+            if (await exists(current)) {
+                await rename(current, join(backupDir, name));
+                moved.push(name);
+            }
+        }
+        await materializeDefaultCodexHome(agentHome, sourceHome);
+        await atomicPrivateWrite(marker, JSON.stringify({
+            version: 1,
+            migrated_at: new Date().toISOString(),
+            source_home: sourceHome,
+            backup_dir: backupDir,
+        }) + "\n");
+        return { status: "migrated", backupDir };
+    }
+    catch (error) {
+        for (const name of moved.reverse()) {
+            await rename(join(backupDir, name), join(codexHome, name)).catch(() => undefined);
+        }
+        await rm(sessions, { recursive: true, force: true });
+        await unlink(index).catch(() => undefined);
+        await symlink(sessionLink, sessions, "dir").catch(() => undefined);
+        await symlink(indexLink, index, "file").catch(() => undefined);
+        throw error;
+    }
+}
+export const codexHomeMigrationMarkerName = MARKER_NAME;

package/dist/runtimes/codex-home.js

@@ -1,15 +1,11 @@
-import { chmod, lstat, mkdir, symlink } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { chmod, copyFile, lstat, mkdir, open, readdir, readlink, rename, rm, symlink, unlink, link, writeFile, } from "node:fs/promises";
+import { constants } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
 const PRIVATE_CODEX_HOME = ".codex";
-const SHARED_CODEX_ENTRIES = [
-    { name: "auth.json", type: "file" },
-    { name: "sessions", type: "dir" },
-    { name: "session_index.jsonl", type: "file" },
-];
 export function defaultCodexHome(homeDir) {
     return resolve(homeDir, PRIVATE_CODEX_HOME);
 }
-async function linkIfMissing(source, target, type) {
+async function linkIfMissing(source, target) {
     try {
         await lstat(target);
         return;
@@ -27,24 +23,211 @@ async function linkIfMissing(source, target, type) {
         throw error;
     }
     try {
-        await symlink(source, target, type);
+        await symlink(source, target, "file");
     }
     catch (error) {
         if (error.code !== "EEXIST")
             throw error;
     }
 }
-/**
- * Isolate Codex's high-volume runtime state per Agent while preserving the
- * machine login and native resume files used by existing sessions.
- */
-export async function materializeDefaultCodexHome(agentHome, sourceHome) {
+function isBelow(root, candidate) {
+    const child = relative(root, candidate);
+    return child !== "" && child !== ".." && !child.startsWith(`..${sep}`) && !child.startsWith(sep);
+}
+async function isExactSymlink(target, expectedSource) {
+    const linkTarget = await readlink(target);
+    return resolve(dirname(target), linkTarget) === resolve(expectedSource);
+}
+async function ensurePrivateSessions(target, legacySource) {
+    try {
+        const current = await lstat(target);
+        if (current.isSymbolicLink()) {
+            if (legacySource === undefined || !(await isExactSymlink(target, legacySource))) {
+                throw new Error(`Refusing to replace unexpected Codex sessions symlink: ${target}`);
+            }
+            const replacement = `${target}.private-${process.pid}-${Math.random().toString(36).slice(2)}`;
+            const legacyBackup = `${target}.legacy-${process.pid}-${Math.random().toString(36).slice(2)}`;
+            try {
+                await mkdir(replacement, { mode: 0o700 });
+                await rename(target, legacyBackup);
+                try {
+                    await rename(replacement, target);
+                }
+                catch (error) {
+                    await rename(legacyBackup, target).catch(() => undefined);
+                    throw error;
+                }
+            }
+            finally {
+                await rm(replacement, { recursive: true, force: true }).catch(() => undefined);
+                await rm(legacyBackup, { recursive: true, force: true }).catch(() => undefined);
+            }
+        }
+        else if (!current.isDirectory()) {
+            throw new Error(`Codex sessions target is not a directory: ${target}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        await mkdir(target, { mode: 0o700 });
+    }
+    await chmod(target, 0o700);
+}
+async function atomicCopyFile(source, target, mode) {
+    const parent = dirname(target);
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    const temporary = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+    try {
+        await copyFile(source, temporary, constants.COPYFILE_EXCL);
+        await chmod(temporary, mode);
+        try {
+            await link(temporary, target);
+            return true;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            return false;
+        }
+    }
+    finally {
+        await unlink(temporary).catch(() => undefined);
+    }
+}
+async function ensurePrivateIndex(target, source) {
+    let current;
+    try {
+        current = await lstat(target);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (current?.isSymbolicLink()) {
+        if (source === undefined || !(await isExactSymlink(target, source))) {
+            throw new Error(`Refusing to replace unexpected Codex session index symlink: ${target}`);
+        }
+        const replacement = `${target}.private-${process.pid}-${Math.random().toString(36).slice(2)}`;
+        const legacyBackup = `${target}.legacy-${process.pid}-${Math.random().toString(36).slice(2)}`;
+        try {
+            try {
+                await lstat(source);
+                await copyFile(source, replacement, constants.COPYFILE_EXCL);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                await writeFile(replacement, "", { encoding: "utf8", flag: "wx" });
+            }
+            await chmod(replacement, 0o600);
+            await rename(target, legacyBackup);
+            try {
+                await rename(replacement, target);
+            }
+            catch (error) {
+                await rename(legacyBackup, target).catch(() => undefined);
+                throw error;
+            }
+        }
+        finally {
+            await rm(replacement, { force: true }).catch(() => undefined);
+            await rm(legacyBackup, { force: true }).catch(() => undefined);
+        }
+        current = undefined;
+    }
+    if (current !== undefined && !current.isFile()) {
+        throw new Error(`Codex session index target is not a regular file: ${target}`);
+    }
+    if (current !== undefined) {
+        await chmod(target, 0o600);
+        return;
+    }
+    if (source !== undefined) {
+        try {
+            await lstat(source);
+            if (await atomicCopyFile(source, target, 0o600))
+                return;
+            return;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    const handle = await open(target, "wx", 0o600).catch((error) => {
+        if (error.code === "EEXIST")
+            return null;
+        throw error;
+    });
+    await handle?.close();
+}
+async function findRollout(root, sessionId) {
+    const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    const matches = [];
+    for (const entry of entries) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory()) {
+            const nested = await findRollout(path, sessionId);
+            if (nested !== null)
+                matches.push(nested);
+        }
+        else if (entry.isFile() && entry.name.includes(sessionId)) {
+            matches.push(path);
+        }
+    }
+    if (matches.length > 1)
+        throw new Error(`Multiple Codex rollout files match session ${sessionId}`);
+    return matches[0] ?? null;
+}
+async function hydrateResumeRollout(sourceSessions, privateSessions, sessionId) {
+    if (sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
+        throw new Error("Invalid Codex resume session id");
+    }
+    const sourcePath = await findRollout(sourceSessions, sessionId);
+    if (sourcePath === null)
+        return;
+    const relativePath = relative(sourceSessions, sourcePath);
+    const destination = resolve(privateSessions, relativePath);
+    if (!isBelow(resolve(privateSessions), destination)) {
+        throw new Error("Codex resume rollout escaped the private sessions directory");
+    }
+    let existing;
+    try {
+        existing = await lstat(destination);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (existing !== undefined) {
+        if (!existing.isFile() || existing.isSymbolicLink()) {
+            throw new Error(`Refusing to replace existing Codex rollout: ${destination}`);
+        }
+        return;
+    }
+    const mode = (await lstat(sourcePath)).mode & 0o777;
+    await atomicCopyFile(sourcePath, destination, mode);
+}
+/** Isolate Codex high-volume state per Agent while preserving auth and exact resume. */
+export async function materializeDefaultCodexHome(agentHome, sourceHome, resumeSessionId) {
     const codexHome = defaultCodexHome(agentHome);
     await mkdir(codexHome, { recursive: true, mode: 0o700 });
     await chmod(codexHome, 0o700);
     const source = sourceHome === undefined ? null : resolve(sourceHome);
-    if (source === null || source === codexHome)
-        return codexHome;
-    await Promise.all(SHARED_CODEX_ENTRIES.map(({ name, type }) => linkIfMissing(join(source, name), join(codexHome, name), type)));
+    if (source !== null && source !== codexHome) {
+        await linkIfMissing(join(source, "auth.json"), join(codexHome, "auth.json"));
+    }
+    const sourceSessions = source === null || source === codexHome ? undefined : join(source, "sessions");
+    await ensurePrivateSessions(join(codexHome, "sessions"), sourceSessions);
+    const sourceIndex = source === null || source === codexHome ? undefined : join(source, "session_index.jsonl");
+    await ensurePrivateIndex(join(codexHome, "session_index.jsonl"), sourceIndex);
+    if (sourceSessions !== undefined && resumeSessionId) {
+        await hydrateResumeRollout(sourceSessions, join(codexHome, "sessions"), resumeSessionId);
+    }
     return codexHome;
 }