@nowcrew/daemon 0.6.57 → 0.6.60

package/dist/computer-cli.js

@@ -82,6 +82,14 @@ function translatedError(error, td) {
     }
     return td(error.message);
 }
+function storageServiceEnvironment(env) {
+    return {
+        ...(env.NOWWORK_HOME === undefined ? {} : { NOWWORK_HOME: env.NOWWORK_HOME }),
+        ...(env.NOWWORK_ENV_TAG === undefined ? {} : { NOWWORK_ENV_TAG: env.NOWWORK_ENV_TAG }),
+        ...(env.NOWWORK_STORAGE_POLICY_PATH === undefined
+            ? {} : { NOWWORK_STORAGE_POLICY_PATH: env.NOWWORK_STORAGE_POLICY_PATH }),
+    };
+}
 export async function runComputerCommand(argv, overrides = {}) {
     const command = argv[0];
     if (!command || !COMPUTER_COMMANDS.has(command))
@@ -202,6 +210,7 @@ export async function runComputerCommand(argv, overrides = {}) {
                     ...deps,
                     profile: restartProfile.name,
                     profileHome: home,
+                    environment: storageServiceEnvironment(deps.env),
                 })
                 : null;
             if (spec && restartProfile) {
@@ -272,7 +281,7 @@ export async function runComputerCommand(argv, overrides = {}) {
             throw new Error(td("Service lifecycle requires the built daemon entry (.js), not a TypeScript development entry"));
         }
         const spec = buildServiceSpec({
-            ...deps, profile: name, profileHome: home,
+            ...deps, profile: name, profileHome: home, environment: storageServiceEnvironment(deps.env),
         });
         const installation = daemonGlobalInstallation(deps.entryPath, deps.platform);
         const managedRecord = installation !== null && spec.platform !== "win32"

package/dist/computer-service.js

@@ -53,6 +53,7 @@ export function windowsCommandArg(value) {
 }
 export function buildServiceSpec(input) {
     const { platform, profile, userHome } = input;
+    const environment = input.environment ?? process.env;
     if (platform !== "darwin" && platform !== "linux" && platform !== "win32") {
         throw new Error(`Computer services are not supported on platform '${platform}'`);
     }
@@ -72,6 +73,16 @@ export function buildServiceSpec(input) {
             throw new Error("Cannot install launchd service without a numeric uid");
         const id = `com.nowcrew.daemon.${profile}${identitySuffix}`;
         const args = daemonCommand.map((arg) => `      <string>${xml(arg)}</string>`).join("\n");
+        const environmentEntries = [
+            ["NOWWORK_HOME", environment.NOWWORK_HOME],
+            ["NOWWORK_ENV_TAG", environment.NOWWORK_ENV_TAG],
+            ["NOWWORK_STORAGE_POLICY_PATH", environment.NOWWORK_STORAGE_POLICY_PATH],
+        ].flatMap(([key, value]) => value === undefined
+            ? []
+            : [`    <key>${key}</key><string>${xml(assertSingleLine(value, key))}</string>`]);
+        const environmentBlock = environmentEntries.length === 0
+            ? ""
+            : `  <key>EnvironmentVariables</key>\n  <dict>\n${environmentEntries.join("\n")}\n  </dict>\n`;
         return {
             platform,
             profile,
@@ -79,7 +90,7 @@ export function buildServiceSpec(input) {
             descriptorPath: resolve(userHome, "Library", "LaunchAgents", `${id}.plist`),
             daemonCommand,
             managerDomain: `gui/${input.uid}`,
-            descriptor: `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key><string>${xml(id)}</string>\n  <key>ProgramArguments</key>\n  <array>\n${args}\n  </array>\n  <key>KeepAlive</key><true/>\n  <key>ProcessType</key><string>Background</string>\n</dict>\n</plist>\n`,
+            descriptor: `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key><string>${xml(id)}</string>\n  <key>ProgramArguments</key>\n  <array>\n${args}\n  </array>\n${environmentBlock}  <key>KeepAlive</key><true/>\n  <key>ProcessType</key><string>Background</string>\n</dict>\n</plist>\n`,
         };
     }
     if (platform === "linux") {
@@ -266,6 +277,35 @@ export async function installService(spec, runner = systemCommandRunner) {
         throw error;
     }
 }
+export async function replaceInstalledServiceDescriptor(spec, previousDescriptor, runner = systemCommandRunner) {
+    if (spec.platform === "win32" || spec.descriptorPath === null || spec.descriptor === null) {
+        throw new Error("Installed service descriptor replacement requires launchd or systemd");
+    }
+    const current = await readServiceDescriptor(spec);
+    if (current !== previousDescriptor) {
+        throw new Error(`Installed descriptor for '${spec.id}' changed before replacement`);
+    }
+    const status = await serviceStatus(spec, runner);
+    if (!status.installed)
+        throw new Error(`Service '${spec.id}' is not installed`);
+    if (status.running || status.loaded)
+        await serviceAction(spec, "stop", runner);
+    try {
+        await writePrivateAtomic(spec.descriptorPath, spec.descriptor);
+        if (spec.platform === "linux") {
+            await checked(runner, "systemctl", ["--user", "daemon-reload"], "systemd reload");
+            await checked(runner, "systemctl", ["--user", "enable", spec.id], "systemd enable");
+        }
+        if (status.running)
+            await serviceAction(spec, "start", runner);
+    }
+    catch (error) {
+        await writePrivateAtomic(spec.descriptorPath, previousDescriptor).catch(() => undefined);
+        if (status.running)
+            await serviceAction(spec, "start", runner).catch(() => undefined);
+        throw error;
+    }
+}
 export async function ensureServiceEnabled(spec, runner = systemCommandRunner) {
     if (spec.platform === "linux") {
         if (spec.descriptorPath === null || !await pathExists(spec.descriptorPath)) {

package/dist/main.js

@@ -85,6 +85,12 @@ async function main() {
                 agentsRoot: resolveAgentsRoot(profile.agentsRoot, homedir(), process.platform),
                 nodePath: process.execPath,
                 entryPath: builtDaemonEntry(),
+                environment: {
+                    ...(process.env.NOWWORK_HOME === undefined ? {} : { NOWWORK_HOME: process.env.NOWWORK_HOME }),
+                    ...(process.env.NOWWORK_ENV_TAG === undefined ? {} : { NOWWORK_ENV_TAG: process.env.NOWWORK_ENV_TAG }),
+                    ...(process.env.NOWWORK_STORAGE_POLICY_PATH === undefined
+                        ? {} : { NOWWORK_STORAGE_POLICY_PATH: process.env.NOWWORK_STORAGE_POLICY_PATH }),
+                },
             });
         }
         applyProfileToEnv(profile, process.env);

package/dist/managed-service-lifecycle.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { acquireDaemonInstallationLease } from "./daemon-installation-lease.js";
-import { installService, ensureServiceEnabled, readServiceDescriptor, serviceAction, uninstallService, } from "./computer-service.js";
+import { installService, ensureServiceEnabled, readServiceDescriptor, serviceAction, replaceInstalledServiceDescriptor, uninstallService, } from "./computer-service.js";
 import { ManagedServiceConflictError, ManagedServiceRegistryError, assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, managedServiceConflict, normalizeManagedServiceRecord, serviceDescriptorSha256, withManagedServiceRegistryLock, } from "./managed-service-registry.js";
 function requirePortableManagedSpec(spec) {
     if ((spec.platform !== "darwin" && spec.platform !== "linux")
@@ -35,6 +35,17 @@ function sameManagedIdentity(left, right) {
     const { generation: _generation, createdAt: _createdAt, ...expected } = right;
     return managedServiceIdentityMatches(left, expected);
 }
+function sameManagedResource(left, right) {
+    const { generation: _leftGeneration, createdAt: _leftCreatedAt, descriptorSha256: _leftHash, ...leftResource } = left;
+    const { generation: _rightGeneration, createdAt: _rightCreatedAt, descriptorSha256: _rightHash, ...rightResource } = right;
+    return JSON.stringify(leftResource) === JSON.stringify(rightResource);
+}
+function descriptorDiffIsStorageEnvironmentOnly(previous, next) {
+    if (!next.includes("\n  <key>EnvironmentVariables</key>\n"))
+        return false;
+    const strip = (descriptor) => descriptor.replace(/\n  <key>EnvironmentVariables<\/key>\n  <dict>\n(?:    <key>(?:NOWWORK_HOME|NOWWORK_ENV_TAG|NOWWORK_STORAGE_POLICY_PATH)<\/key><string>[^<]*<\/string>\n)+  <\/dict>\n/u, "\n");
+    return strip(previous) === strip(next);
+}
 function assertRecordDescribesSpec(input) {
     requirePortableManagedSpec(input.spec);
     const { spec, record } = input;
@@ -51,8 +62,20 @@ function assertRecordDescribesSpec(input) {
     }
 }
 export async function installManagedService(input) {
-    assertRecordDescribesSpec(input);
     requirePortableManagedSpec(input.spec);
+    const requestedDescriptor = input.spec.descriptor;
+    const expectedDescriptorHash = serviceDescriptorSha256(input.spec.descriptor);
+    const expectedPath = normalizeManagedServiceRecord({
+        ...input.record,
+        descriptorPath: input.spec.descriptorPath,
+        descriptorSha256: expectedDescriptorHash,
+    }).descriptorPath;
+    if (input.record.platform !== input.spec.platform
+        || input.record.serviceId !== input.spec.id
+        || input.record.profile !== input.spec.profile
+        || input.record.descriptorPath !== expectedPath) {
+        throw new ManagedServiceRegistryError(`Managed service record does not describe '${input.spec.id}'`);
+    }
     const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
     await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services, replace }) => {
         const exact = services.find((record) => sameManagedIdentity(record, input.record));
@@ -76,6 +99,28 @@ export async function installManagedService(input) {
             }
             return;
         }
+        const registered = services.find((record) => record.serviceId === input.record.serviceId
+            && record.profile === input.record.profile
+            && record.daemonHome === input.record.daemonHome);
+        if (registered !== undefined && sameManagedResource(registered, input.record)) {
+            const current = await readServiceDescriptor(input.spec);
+            if (current === null || serviceDescriptorSha256(current) !== registered.descriptorSha256) {
+                throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+            }
+            if (!descriptorDiffIsStorageEnvironmentOnly(current, requestedDescriptor)) {
+                throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' conflicts with the requested identity`);
+            }
+            await replaceInstalledServiceDescriptor(input.spec, current, input.runner);
+            try {
+                await replace(services.map((record) => record === registered ? input.record : record));
+            }
+            catch (error) {
+                const rollbackSpec = { ...input.spec, descriptor: current };
+                await replaceInstalledServiceDescriptor(rollbackSpec, requestedDescriptor, input.runner).catch(() => undefined);
+                throw error;
+            }
+            return;
+        }
         const conflict = managedServiceConflict(services, input.record);
         if (conflict !== null) {
             throw new ManagedServiceConflictError(conflict.resource, input.record, conflict.owner);

package/dist/managed-service-startup.js

@@ -14,6 +14,7 @@ export async function assertManagedServiceStartup(input) {
         nodePath: input.nodePath,
         entryPath: input.entryPath,
         profileHome: input.daemonHome,
+        ...(input.environment === undefined ? {} : { environment: input.environment }),
     });
     const readRegistry = input.readManagedServices
         ?? (() => readManagedServiceRegistry({ userHome: input.userHome }));
@@ -42,6 +43,7 @@ export async function assertManagedServiceStartup(input) {
             nodePath: input.nodePath,
             entryPath: input.entryPath,
             profileHome: input.daemonHome,
+            ...(input.environment === undefined ? {} : { environment: input.environment }),
             legacyServiceId: true,
         });
         const legacyDescriptor = await readDescriptor(legacySpec);

package/dist/storage-runtime-controller.js

@@ -67,6 +67,7 @@ function targetRecord(input, workspaceId, createdAt) {
         nodePath: input.sourceRecord.nodePath,
         entryPath: input.sourceRecord.entryPath,
         profileHome: input.local.configRoot,
+        ...(input.serviceEnvironment === undefined ? {} : { environment: input.serviceEnvironment }),
     });
     return buildManagedServiceRecord({
         spec,
@@ -183,6 +184,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                 platform: input.platform,
                 userHome: input.userHome,
                 ...(input.uid === undefined ? {} : { uid: input.uid }),
+                ...(input.serviceEnvironment === undefined ? {} : { serviceEnvironment: input.serviceEnvironment }),
                 sourceWasRunning: true,
                 sourceRecord: input.sourceRecord,
                 targetRecord: targetRecord(input, workspaceId, createdAt),
@@ -236,6 +238,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                         migrationId: operation.migrationId,
                         platform: input.platform,
                         userHome: input.userHome,
+                        ...(input.uid === undefined ? {} : { uid: input.uid }),
                     });
                     workerLaunched = true;
                     const outcome = await dependencies.monitorWorker({

package/dist/storage-runtime-readiness.js

@@ -58,9 +58,12 @@ function findSourceRecord(records, input) {
     return matches.length === 1 ? matches[0] : null;
 }
 export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
-    if (rawInput.platform !== "linux") {
+    if (rawInput.platform !== "darwin" && rawInput.platform !== "linux") {
         return notReady("platform_not_supported");
     }
+    if (rawInput.platform === "darwin" && rawInput.uid === undefined) {
+        return notReady("platform_identity_missing");
+    }
     const configuredNowworkHome = rawInput.environment.NOWWORK_HOME;
     if (configuredNowworkHome === undefined)
         return notReady("nowwork_home_missing");
@@ -124,6 +127,7 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         nodePath: sourceRecord.nodePath,
         entryPath: sourceRecord.entryPath,
         profileHome: input.currentDaemonHome,
+        environment: input.environment,
     });
     const assertSourceIdentity = () => dependencies.assertManagedServiceIdentity({
         spec: sourceSpec,
@@ -165,6 +169,11 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         sourceRecord,
         local,
         policy,
+        serviceEnvironment: {
+            NOWWORK_HOME: nowworkHome,
+            NOWWORK_ENV_TAG: environment,
+            NOWWORK_STORAGE_POLICY_PATH: policyPath,
+        },
         backupArtifacts: [
             { name: "profile.json", path: profilePath(input.profile, input.currentDaemonHome) },
             { name: "service-descriptor", path: sourceRecord.descriptorPath },

package/dist/storage-worker-executor.js

@@ -35,6 +35,9 @@ function serviceSpec(operation, record, profileHome) {
         nodePath: record.nodePath,
         entryPath: record.entryPath,
         profileHome,
+        ...(operation.service.serviceEnvironment === undefined
+            ? {}
+            : { environment: operation.service.serviceEnvironment }),
     });
 }
 function assertRecordMatchesSpec(record, spec) {

package/dist/storage-worker-handoff.js

@@ -62,6 +62,16 @@ function workerUnitName(migrationId) {
 function workerUnitPath(userHome, migrationId) {
     return resolve(userHome, ".config", "systemd", "user", workerUnitName(migrationId));
 }
+function workerLaunchdLabel(migrationId) {
+    return `com.nowcrew.storage-migration.${migrationId}`;
+}
+function workerLaunchdPath(userHome, migrationId) {
+    return resolve(userHome, "Library", "LaunchAgents", `${workerLaunchdLabel(migrationId)}.plist`);
+}
+function xml(value) {
+    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
 function systemdArg(value) {
     if (/[\0\r\n]/u.test(value))
         throw new Error("storage worker service argument must be a single line");
@@ -77,9 +87,26 @@ export async function launchStorageMigrationWorker(input, runSupervisor = system
     AbsolutePathSchema.parse(input.handoffPath);
     AbsolutePathSchema.parse(input.userHome);
     const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
-    if (input.platform !== "linux")
-        throw new Error("Persistent storage migration workers require Linux systemd");
     const worker = [process.execPath, input.entryPath, "storage-migration-worker", "--job", input.handoffPath];
+    if (input.platform === "darwin") {
+        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
+            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
+        }
+        const label = workerLaunchdLabel(migrationId);
+        const path = workerLaunchdPath(input.userHome, migrationId);
+        const args = worker.map((arg) => `      <string>${xml(arg)}</string>`).join("\n");
+        const descriptor = `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key><string>${xml(label)}</string>\n  <key>ProgramArguments</key>\n  <array>\n${args}\n  </array>\n  <key>RunAtLoad</key><true/>\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key><false/>\n  </dict>\n  <key>ProcessType</key><string>Background</string>\n</dict>\n</plist>\n`;
+        await atomicPrivateWrite(path, descriptor);
+        try {
+            await checkedSupervisor(runSupervisor, "launchctl", ["bootstrap", `gui/${input.uid}`, path]);
+        }
+        catch (error) {
+            await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]).catch(() => undefined);
+            await rm(path, { force: true });
+            throw new Error("Storage migration persistent service launch failed", { cause: error });
+        }
+        return;
+    }
     const unit = workerUnitName(migrationId);
     const path = workerUnitPath(input.userHome, migrationId);
     const descriptor = `[Unit]\nDescription=NowWork storage migration ${migrationId}\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=exec\nExecStart=${worker.map(systemdArg).join(" ")}\nRestart=on-abnormal\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
@@ -97,9 +124,16 @@ export async function launchStorageMigrationWorker(input, runSupervisor = system
 }
 export async function completeStorageMigrationWorkerService(input, runSupervisor = systemSupervisorRun) {
     const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
-    if (input.platform !== "linux")
-        return;
     AbsolutePathSchema.parse(input.userHome);
+    if (input.platform === "darwin") {
+        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
+            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
+        }
+        const label = workerLaunchdLabel(migrationId);
+        await rm(workerLaunchdPath(input.userHome, migrationId), { force: true });
+        await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]);
+        return;
+    }
     const unit = workerUnitName(migrationId);
     await checkedSupervisor(runSupervisor, "systemctl", ["--user", "disable", unit]);
     await rm(workerUnitPath(input.userHome, migrationId), { force: true });
@@ -112,5 +146,6 @@ export async function completeStorageMigrationWorkerServiceForHandoff(path) {
         migrationId: operation.migrationId,
         platform: operation.service.platform,
         userHome: operation.service.userHome,
+        ...(operation.service.uid === undefined ? {} : { uid: operation.service.uid }),
     });
 }

package/dist/storage-worker-operation.js

@@ -90,6 +90,11 @@ const InstallationRecordSchema = z.object({
     createdAt: z.string().datetime({ offset: true }),
     updatedAt: z.string().datetime({ offset: true }),
 }).strict();
+const StorageServiceEnvironmentSchema = z.object({
+    NOWWORK_HOME: AbsolutePathSchema.optional(),
+    NOWWORK_ENV_TAG: z.string().regex(ENVIRONMENT).optional(),
+    NOWWORK_STORAGE_POLICY_PATH: AbsolutePathSchema.optional(),
+}).strict();
 const OperationSchema = z.object({
     version: z.literal(1),
     migrationId: z.string().uuid(),
@@ -119,6 +124,7 @@ const OperationSchema = z.object({
         platform: z.enum(["darwin", "linux"]),
         userHome: AbsolutePathSchema,
         uid: z.number().int().nonnegative().optional(),
+        serviceEnvironment: StorageServiceEnvironmentSchema.optional(),
         sourceWasRunning: z.boolean(),
         sourceRecord: ManagedServiceRecordSchema,
         targetRecord: ManagedServiceRecordSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.57",
+  "version": "0.6.60",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",