@nowcrew/daemon 0.6.50 → 0.6.52

package/dist/storage-worker-operation.js

@@ -0,0 +1,277 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { basename, dirname, join, posix, win32 } from "node:path";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+import { assertStorageControlMaterialTokenFree } from "./storage-credential-guard.js";
+import { storageLayout } from "./storage-layout.js";
+import { StorageMigrationWarningCodeSchema } from "./storage-migration-policy.js";
+const CONTROL = /[\0\r\n]/u;
+const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
+const ENVIRONMENT = /^[a-z0-9][a-z0-9_-]{0,31}$/u;
+const HASH = /^[0-9a-f]{64}$/u;
+const AbsolutePathSchema = z.string().min(1).max(32768)
+    .refine((value) => !CONTROL.test(value), "path must be a single line")
+    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
+const RelativePathSchema = z.string().min(1).max(32768)
+    .refine((value) => !CONTROL.test(value), "path must be a single line")
+    .refine((value) => !posix.isAbsolute(value) && !win32.isAbsolute(value), "path must be relative")
+    .refine((value) => !value.split(/[\\/]/u).some((segment) => segment === "" || segment === "." || segment === ".."), "path must be normalized");
+const SourceKindSchema = z.enum(["daemon-home", "agents-root", "legacy-agents-root"]);
+const PolicySchema = z.object({
+    exclusions: z.array(z.object({
+        sourceKind: SourceKindSchema,
+        sourcePath: RelativePathSchema,
+        reason: z.string().min(1).max(256),
+    }).strict()).max(100_000),
+    transformations: z.array(z.object({
+        sourceKind: SourceKindSchema,
+        sourcePath: RelativePathSchema,
+        logicalDestination: RelativePathSchema,
+        sourceSha256: z.string().regex(HASH),
+        targetSha256: z.string().regex(HASH),
+        targetMode: z.string().regex(/^[0-7]{4}$/u),
+        transform: z.literal("redact_live_like_tokens_v1"),
+    }).strict()).max(100_000),
+}).strict();
+const DoctorInputSchema = z.object({
+    migrationId: z.string().uuid(),
+    generatedAt: z.string().datetime({ offset: true }),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    targetWorkspaceRoot: AbsolutePathSchema,
+    sources: z.array(z.object({
+        kind: SourceKindSchema,
+        root: AbsolutePathSchema,
+        logicalPrefix: RelativePathSchema,
+    }).strict()).min(1).max(3),
+    policy: PolicySchema,
+    state: z.object({
+        profileIdentityExact: z.boolean(),
+        duplicateWorkspaceMappings: z.number().int().nonnegative(),
+        activeAgentExecutions: z.number().int().nonnegative(),
+        activeScheduledRuns: z.number().int().nonnegative(),
+    }).strict(),
+    freeSpaceMultiplier: z.number().finite().min(1).max(10).optional(),
+}).strict();
+const ManagedServiceRecordSchema = z.object({
+    version: z.literal(1),
+    generation: z.string().uuid(),
+    platform: z.enum(["darwin", "linux"]),
+    serviceId: z.string().min(1).max(256),
+    profile: z.string().regex(PROFILE),
+    daemonHome: AbsolutePathSchema,
+    agentsRoot: AbsolutePathSchema,
+    nodePath: AbsolutePathSchema,
+    entryPath: AbsolutePathSchema,
+    packageRoot: AbsolutePathSchema,
+    npmPrefix: AbsolutePathSchema,
+    descriptorPath: AbsolutePathSchema,
+    descriptorSha256: z.string().regex(HASH),
+    createdAt: z.string().datetime({ offset: true }),
+}).strict();
+const InstallationRecordSchema = z.object({
+    version: z.literal(1),
+    installationId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    serverUrl: z.string().url().max(2048).refine((value) => {
+        const url = new URL(value);
+        return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+    }, "serverUrl must be HTTP(S) without credentials"),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    storageId: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+    nowworkHome: AbsolutePathSchema,
+    runtimeRoot: AbsolutePathSchema,
+    credentialRef: z.string().regex(/^profile:[a-z0-9][a-z0-9_-]{0,47}$/u),
+    storageMigrationId: z.string().uuid(),
+    createdAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true }),
+}).strict();
+const OperationSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    createdAt: z.string().datetime({ offset: true }),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    expectedManifestDigest: z.string().regex(HASH),
+    doctorInput: DoctorInputSchema,
+    migration: z.object({
+        sourceRoots: z.object({
+            "daemon-home": AbsolutePathSchema.optional(),
+            "agents-root": AbsolutePathSchema.optional(),
+            "legacy-agents-root": AbsolutePathSchema.optional(),
+        }).strict(),
+        stagingWorkspaceRoot: AbsolutePathSchema,
+        targetWorkspaceRoot: AbsolutePathSchema,
+        backupsRoot: AbsolutePathSchema,
+        backupArtifacts: z.array(z.object({
+            name: z.string().regex(/^[a-z0-9][a-z0-9_.-]{0,127}$/u),
+            path: AbsolutePathSchema,
+        }).strict()).max(32),
+        acceptedWarnings: z.array(StorageMigrationWarningCodeSchema)
+            .max(StorageMigrationWarningCodeSchema.options.length),
+    }).strict(),
+    service: z.object({
+        platform: z.enum(["darwin", "linux"]),
+        userHome: AbsolutePathSchema,
+        uid: z.number().int().nonnegative().optional(),
+        sourceWasRunning: z.boolean(),
+        sourceRecord: ManagedServiceRecordSchema,
+        targetRecord: ManagedServiceRecordSchema,
+    }).strict(),
+    installation: z.object({
+        configRoot: AbsolutePathSchema,
+        target: InstallationRecordSchema,
+    }).strict(),
+}).strict();
+const pathsFor = (_platform) => posix;
+function canonicalPath(value, platform) {
+    const paths = pathsFor(platform);
+    const absolute = paths.resolve(value);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOTDIR")
+            return absolute;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    const missing = [];
+    let ancestor = absolute;
+    for (;;) {
+        const parent = paths.dirname(ancestor);
+        if (parent === ancestor)
+            return absolute;
+        missing.unshift(paths.basename(ancestor));
+        ancestor = parent;
+        try {
+            return paths.resolve(realpathSync.native(ancestor), ...missing);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOTDIR")
+                return absolute;
+            if (code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function samePath(left, right, platform) {
+    return canonicalPath(left, platform) === canonicalPath(right, platform);
+}
+function isInside(root, candidate, platform) {
+    const paths = pathsFor(platform);
+    const child = paths.relative(canonicalPath(root, platform), canonicalPath(candidate, platform));
+    return child === "" || (!child.startsWith("..") && !paths.isAbsolute(child));
+}
+function assertSemanticIdentity(operation) {
+    const identity = [operation.doctorInput, operation.installation.target];
+    if (identity.some((value) => value.workspaceId !== operation.workspaceId
+        || value.environment !== operation.environment || value.profile !== operation.profile)
+        || operation.doctorInput.migrationId !== operation.migrationId
+        || operation.installation.target.storageMigrationId !== operation.migrationId
+        || operation.installation.target.credentialRef !== `profile:${operation.profile}`) {
+        throw new Error("storage worker operation identity does not match");
+    }
+    if (operation.doctorInput.state.profileIdentityExact !== true
+        || operation.doctorInput.state.duplicateWorkspaceMappings !== 0
+        || operation.doctorInput.state.activeAgentExecutions !== 0
+        || operation.doctorInput.state.activeScheduledRuns !== 0) {
+        throw new Error("storage worker operation doctor state is not safe");
+    }
+    const { platform, sourceRecord, targetRecord } = operation.service;
+    if (sourceRecord.platform !== platform || targetRecord.platform !== platform
+        || sourceRecord.profile !== operation.profile || targetRecord.profile !== operation.profile
+        || sourceRecord.serviceId === targetRecord.serviceId
+        || !samePath(sourceRecord.nodePath, targetRecord.nodePath, platform)
+        || !samePath(sourceRecord.entryPath, targetRecord.entryPath, platform)
+        || !samePath(sourceRecord.packageRoot, targetRecord.packageRoot, platform)
+        || !samePath(sourceRecord.npmPrefix, targetRecord.npmPrefix, platform)
+        || !samePath(targetRecord.daemonHome, operation.installation.configRoot, platform)) {
+        throw new Error("storage worker service identity does not match");
+    }
+    const sourceKinds = new Set();
+    for (const source of operation.doctorInput.sources) {
+        if (sourceKinds.has(source.kind) || !samePath(operation.migration.sourceRoots[source.kind] ?? "", source.root, platform)) {
+            throw new Error("storage worker source roots do not match doctor input");
+        }
+        sourceKinds.add(source.kind);
+    }
+    const configuredSourceKinds = Object.entries(operation.migration.sourceRoots)
+        .filter(([, value]) => value !== undefined)
+        .map(([kind]) => kind);
+    if (configuredSourceKinds.length !== sourceKinds.size || configuredSourceKinds.some((kind) => !sourceKinds.has(kind))
+        || !samePath(operation.migration.sourceRoots["daemon-home"] ?? "", sourceRecord.daemonHome, platform)
+        || !samePath(operation.migration.sourceRoots["agents-root"] ?? "", sourceRecord.agentsRoot, platform)) {
+        throw new Error("storage worker source service roots do not match");
+    }
+    const projected = storageLayout({
+        nowworkHome: operation.installation.target.nowworkHome,
+        environment: operation.environment,
+        workspaceId: operation.workspaceId,
+        runtimeBase: join(operation.service.userHome, ".nowwork-worker-runtime-validation"),
+        platform,
+    });
+    if (!samePath(projected.workspaceRoot, operation.migration.targetWorkspaceRoot, platform)
+        || !samePath(projected.workspaceRoot, operation.doctorInput.targetWorkspaceRoot, platform)
+        || !samePath(projected.agentItemsRoot, targetRecord.agentsRoot, platform)) {
+        throw new Error("storage worker target layout does not match installation identity");
+    }
+    if (dirname(operation.migration.stagingWorkspaceRoot) !== dirname(operation.migration.targetWorkspaceRoot)
+        || !basename(operation.migration.stagingWorkspaceRoot).includes(operation.migrationId)) {
+        throw new Error("storage worker staging identity does not match target");
+    }
+    if (isInside(operation.installation.target.nowworkHome, operation.migration.backupsRoot, platform)
+        || isInside(operation.installation.target.nowworkHome, operation.installation.configRoot, platform)) {
+        throw new Error("storage worker local state must remain outside NOWWORK_HOME");
+    }
+}
+function parseOperation(raw) {
+    const operation = OperationSchema.parse(raw);
+    assertSemanticIdentity(operation);
+    return operation;
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export async function writeStorageWorkerOperation(raw, input) {
+    try {
+        const operation = parseOperation(raw);
+        const stateRoot = AbsolutePathSchema.parse(input.stateRoot);
+        const path = join(stateRoot, "migrations", operation.migrationId, "operation.json");
+        const serialized = `${JSON.stringify(operation, null, 2)}\n`;
+        assertStorageControlMaterialTokenFree(serialized, "storage worker operation");
+        await atomicPrivateWrite(path, serialized);
+        return Object.freeze({ path, sha256: sha256(serialized) });
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker operation", { cause: error });
+    }
+}
+export async function readStorageWorkerOperation(path, expectedSha256) {
+    try {
+        AbsolutePathSchema.parse(path);
+        z.string().regex(HASH).parse(expectedSha256);
+        const raw = await readFile(path);
+        assertStorageControlMaterialTokenFree(raw.toString("utf8"), "storage worker operation");
+        const actual = Buffer.from(sha256(raw), "hex");
+        const expected = Buffer.from(expectedSha256, "hex");
+        if (!timingSafeEqual(actual, expected))
+            throw new Error("storage worker operation digest mismatch");
+        const operation = parseOperation(JSON.parse(raw.toString("utf8")));
+        if (basename(path) !== "operation.json" || basename(dirname(path)) !== operation.migrationId
+            || basename(dirname(dirname(path))) !== "migrations") {
+            throw new Error("storage worker operation path does not match migration identity");
+        }
+        return operation;
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker operation", { cause: error });
+    }
+}

package/dist/storage-worker-status.js

@@ -0,0 +1,105 @@
+import { readFile, unlink } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+const WorkerFailureSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    status: z.literal("failed"),
+    errorCode: z.string().regex(/^[a-z0-9._-]{1,128}$/u),
+    errorMessage: z.string().min(1).max(512),
+    at: z.string().datetime({ offset: true }),
+}).strict();
+const WorkerHeartbeatSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    pid: z.number().int().positive(),
+    at: z.string().datetime({ offset: true }),
+}).strict();
+const TOKEN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b|\bbearer\s+[^\s]+|(?:password|secret|token)\s*[:=]\s*[^\s]+)/giu;
+function identityFromHandoffPath(handoffPath) {
+    if (!isAbsolute(handoffPath) || basename(handoffPath) !== "handoff.json") {
+        throw new Error("storage worker handoff path is invalid");
+    }
+    const migrationDirectory = dirname(handoffPath);
+    const migrationsDirectory = dirname(migrationDirectory);
+    if (basename(migrationsDirectory) !== "migrations")
+        throw new Error("storage worker handoff path is invalid");
+    return {
+        stateRoot: dirname(migrationsDirectory),
+        migrationId: z.string().uuid().parse(basename(migrationDirectory)).toLowerCase(),
+    };
+}
+export function storageWorkerFailurePath(stateRoot, migrationId) {
+    if (!isAbsolute(stateRoot))
+        throw new Error("storage worker state root must be absolute");
+    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-status.json");
+}
+export function storageWorkerHeartbeatPath(stateRoot, migrationId) {
+    if (!isAbsolute(stateRoot))
+        throw new Error("storage worker state root must be absolute");
+    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-heartbeat.json");
+}
+export async function startStorageWorkerHeartbeat(handoffPath, input = {}) {
+    const identity = identityFromHandoffPath(handoffPath);
+    const intervalMs = z.number().int().min(100).max(60_000).parse(input.intervalMs ?? 5_000);
+    const now = input.now ?? (() => new Date());
+    const path = storageWorkerHeartbeatPath(identity.stateRoot, identity.migrationId);
+    let pending = Promise.resolve();
+    const write = () => {
+        pending = pending.catch(() => undefined).then(() => atomicPrivateWrite(path, `${JSON.stringify(WorkerHeartbeatSchema.parse({
+            version: 1,
+            migrationId: identity.migrationId,
+            pid: process.pid,
+            at: now().toISOString(),
+        }), null, 2)}\n`));
+        return pending;
+    };
+    await write();
+    const timer = setInterval(() => { void write(); }, intervalMs);
+    timer.unref?.();
+    return async () => {
+        clearInterval(timer);
+        await pending.catch(() => undefined);
+        await unlink(path).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+    };
+}
+export async function writeStorageWorkerFailureStatus(handoffPath, error) {
+    const identity = identityFromHandoffPath(handoffPath);
+    const rawCode = error instanceof Error && "code" in error ? String(error.code) : "worker_failed";
+    const errorCode = /^[a-z0-9._-]{1,128}$/u.test(rawCode) ? rawCode : "worker_failed";
+    const rawMessage = error instanceof Error ? error.message : String(error);
+    const errorMessage = rawMessage.replaceAll(TOKEN, "<redacted>").slice(0, 512) || "storage worker failed";
+    const status = WorkerFailureSchema.parse({
+        version: 1,
+        migrationId: identity.migrationId,
+        status: "failed",
+        errorCode,
+        errorMessage,
+        at: new Date().toISOString(),
+    });
+    await atomicPrivateWrite(storageWorkerFailurePath(identity.stateRoot, identity.migrationId), `${JSON.stringify(status, null, 2)}\n`);
+}
+export async function readStorageWorkerFailureStatus(stateRoot, migrationId) {
+    try {
+        return WorkerFailureSchema.parse(JSON.parse(await readFile(storageWorkerFailurePath(stateRoot, migrationId), "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Invalid storage worker failure status", { cause: error });
+    }
+}
+export async function readStorageWorkerHeartbeat(stateRoot, migrationId) {
+    try {
+        return WorkerHeartbeatSchema.parse(JSON.parse(await readFile(storageWorkerHeartbeatPath(stateRoot, migrationId), "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Invalid storage worker heartbeat", { cause: error });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.50",
+  "version": "0.6.52",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",