@nowcrew/daemon 0.6.63 → 0.6.65

package/dist/storage-worker-handoff.js

@@ -0,0 +1,151 @@
+import { execFile } from "node:child_process";
+import { readFile, rm } from "node:fs/promises";
+import { join, posix, resolve, win32 } from "node:path";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+import { readStorageWorkerOperation } from "./storage-worker-operation.js";
+const AbsolutePathSchema = z.string().min(1).max(32768)
+    .refine((value) => !/[\0\r\n]/u.test(value), "path must be a single line")
+    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
+const HandoffSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
+    operationPath: AbsolutePathSchema,
+    operationSha256: z.string().regex(/^[0-9a-f]{64}$/u),
+}).strict();
+export async function writeStorageWorkerHandoff(raw, input) {
+    let handoff;
+    try {
+        handoff = HandoffSchema.parse(raw);
+        AbsolutePathSchema.parse(input.stateRoot);
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker handoff", { cause: error });
+    }
+    const path = join(input.stateRoot, "migrations", handoff.migrationId, "handoff.json");
+    await atomicPrivateWrite(path, `${JSON.stringify(handoff, null, 2)}\n`);
+    return path;
+}
+export async function readStorageWorkerHandoff(path) {
+    try {
+        AbsolutePathSchema.parse(path);
+        return HandoffSchema.parse(JSON.parse(await readFile(path, "utf8")));
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker handoff", { cause: error });
+    }
+}
+const execFileAsync = promisify(execFile);
+const systemSupervisorRun = async (command, args) => {
+    try {
+        const result = await execFileAsync(command, [...args], {
+            encoding: "utf8",
+            timeout: 15_000,
+            maxBuffer: 64 * 1024,
+        });
+        return { exitCode: 0, stdout: result.stdout, stderr: result.stderr };
+    }
+    catch (error) {
+        const failure = error;
+        return {
+            exitCode: typeof failure.code === "number" ? failure.code : 127,
+            stdout: failure.stdout ?? "",
+            stderr: failure.stderr ?? failure.message,
+        };
+    }
+};
+function workerUnitName(migrationId) {
+    return `nowwork-storage-migration-${migrationId}.service`;
+}
+function workerUnitPath(userHome, migrationId) {
+    return resolve(userHome, ".config", "systemd", "user", workerUnitName(migrationId));
+}
+function workerLaunchdLabel(migrationId) {
+    return `com.nowcrew.storage-migration.${migrationId}`;
+}
+function workerLaunchdPath(userHome, migrationId) {
+    return resolve(userHome, "Library", "LaunchAgents", `${workerLaunchdLabel(migrationId)}.plist`);
+}
+function xml(value) {
+    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function systemdArg(value) {
+    if (/[\0\r\n]/u.test(value))
+        throw new Error("storage worker service argument must be a single line");
+    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
+}
+async function checkedSupervisor(run, command, args) {
+    const result = await run(command, args);
+    if (result.exitCode !== 0)
+        throw new Error(result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`);
+}
+export async function launchStorageMigrationWorker(input, runSupervisor = systemSupervisorRun) {
+    AbsolutePathSchema.parse(input.entryPath);
+    AbsolutePathSchema.parse(input.handoffPath);
+    AbsolutePathSchema.parse(input.userHome);
+    const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
+    const worker = [process.execPath, input.entryPath, "storage-migration-worker", "--job", input.handoffPath];
+    if (input.platform === "darwin") {
+        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
+            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
+        }
+        const label = workerLaunchdLabel(migrationId);
+        const path = workerLaunchdPath(input.userHome, migrationId);
+        const args = worker.map((arg) => `      <string>${xml(arg)}</string>`).join("\n");
+        const descriptor = `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key><string>${xml(label)}</string>\n  <key>ProgramArguments</key>\n  <array>\n${args}\n  </array>\n  <key>RunAtLoad</key><true/>\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key><false/>\n  </dict>\n  <key>ProcessType</key><string>Background</string>\n</dict>\n</plist>\n`;
+        await atomicPrivateWrite(path, descriptor);
+        try {
+            await checkedSupervisor(runSupervisor, "launchctl", ["bootstrap", `gui/${input.uid}`, path]);
+        }
+        catch (error) {
+            await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]).catch(() => undefined);
+            await rm(path, { force: true });
+            throw new Error("Storage migration persistent service launch failed", { cause: error });
+        }
+        return;
+    }
+    const unit = workerUnitName(migrationId);
+    const path = workerUnitPath(input.userHome, migrationId);
+    const descriptor = `[Unit]\nDescription=NowWork storage migration ${migrationId}\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=exec\nExecStart=${worker.map(systemdArg).join(" ")}\nRestart=on-abnormal\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
+    await atomicPrivateWrite(path, descriptor);
+    try {
+        await checkedSupervisor(runSupervisor, "systemctl", ["--user", "daemon-reload"]);
+        await checkedSupervisor(runSupervisor, "systemctl", ["--user", "enable", "--now", unit]);
+    }
+    catch (error) {
+        await runSupervisor("systemctl", ["--user", "disable", "--now", unit]).catch(() => undefined);
+        await rm(path, { force: true });
+        await runSupervisor("systemctl", ["--user", "daemon-reload"]).catch(() => undefined);
+        throw new Error("Storage migration persistent service launch failed", { cause: error });
+    }
+}
+export async function completeStorageMigrationWorkerService(input, runSupervisor = systemSupervisorRun) {
+    const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
+    AbsolutePathSchema.parse(input.userHome);
+    if (input.platform === "darwin") {
+        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
+            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
+        }
+        const label = workerLaunchdLabel(migrationId);
+        await rm(workerLaunchdPath(input.userHome, migrationId), { force: true });
+        await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]);
+        return;
+    }
+    const unit = workerUnitName(migrationId);
+    await checkedSupervisor(runSupervisor, "systemctl", ["--user", "disable", unit]);
+    await rm(workerUnitPath(input.userHome, migrationId), { force: true });
+    await checkedSupervisor(runSupervisor, "systemctl", ["--user", "daemon-reload"]);
+}
+export async function completeStorageMigrationWorkerServiceForHandoff(path) {
+    const handoff = await readStorageWorkerHandoff(path);
+    const operation = await readStorageWorkerOperation(handoff.operationPath, handoff.operationSha256);
+    await completeStorageMigrationWorkerService({
+        migrationId: operation.migrationId,
+        platform: operation.service.platform,
+        userHome: operation.service.userHome,
+        ...(operation.service.uid === undefined ? {} : { uid: operation.service.uid }),
+    });
+}

package/dist/storage-worker-operation.js

@@ -0,0 +1,284 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { basename, dirname, join, posix, win32 } from "node:path";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+import { assertStorageControlMaterialTokenFree } from "./storage-credential-guard.js";
+import { storageLayout } from "./storage-layout.js";
+import { StorageMigrationWarningCodeSchema } from "./storage-migration-policy.js";
+const CONTROL = /[\0\r\n]/u;
+const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
+const ENVIRONMENT = /^[a-z0-9][a-z0-9_-]{0,31}$/u;
+const HASH = /^[0-9a-f]{64}$/u;
+const AbsolutePathSchema = z.string().min(1).max(32768)
+    .refine((value) => !CONTROL.test(value), "path must be a single line")
+    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
+const RelativePathSchema = z.string().min(1).max(32768)
+    .refine((value) => !CONTROL.test(value), "path must be a single line")
+    .refine((value) => !posix.isAbsolute(value) && !win32.isAbsolute(value), "path must be relative")
+    .refine((value) => !value.split(/[\\/]/u).some((segment) => segment === "" || segment === "." || segment === ".."), "path must be normalized");
+const SourceKindSchema = z.enum(["daemon-home", "agents-root", "legacy-agents-root"]);
+const PolicySchema = z.object({
+    exclusions: z.array(z.object({
+        sourceKind: SourceKindSchema,
+        sourcePath: RelativePathSchema,
+        reason: z.string().min(1).max(256),
+    }).strict()).max(100_000),
+    transformations: z.array(z.object({
+        sourceKind: SourceKindSchema,
+        sourcePath: RelativePathSchema,
+        logicalDestination: RelativePathSchema,
+        sourceSha256: z.string().regex(HASH),
+        targetSha256: z.string().regex(HASH),
+        targetMode: z.string().regex(/^[0-7]{4}$/u),
+        transform: z.literal("redact_live_like_tokens_v1"),
+    }).strict()).max(100_000),
+}).strict();
+const DoctorInputSchema = z.object({
+    migrationId: z.string().uuid(),
+    generatedAt: z.string().datetime({ offset: true }),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    targetWorkspaceRoot: AbsolutePathSchema,
+    sources: z.array(z.object({
+        kind: SourceKindSchema,
+        root: AbsolutePathSchema,
+        logicalPrefix: RelativePathSchema,
+    }).strict()).min(1).max(3),
+    policy: PolicySchema,
+    manifestStoreRoot: AbsolutePathSchema.optional(),
+    state: z.object({
+        profileIdentityExact: z.boolean(),
+        duplicateWorkspaceMappings: z.number().int().nonnegative(),
+        activeAgentExecutions: z.number().int().nonnegative(),
+        activeScheduledRuns: z.number().int().nonnegative(),
+    }).strict(),
+    freeSpaceMultiplier: z.number().finite().min(1).max(10).optional(),
+}).strict();
+const ManagedServiceRecordSchema = z.object({
+    version: z.literal(1),
+    generation: z.string().uuid(),
+    platform: z.enum(["darwin", "linux"]),
+    serviceId: z.string().min(1).max(256),
+    profile: z.string().regex(PROFILE),
+    daemonHome: AbsolutePathSchema,
+    agentsRoot: AbsolutePathSchema,
+    nodePath: AbsolutePathSchema,
+    entryPath: AbsolutePathSchema,
+    packageRoot: AbsolutePathSchema,
+    npmPrefix: AbsolutePathSchema,
+    descriptorPath: AbsolutePathSchema,
+    descriptorSha256: z.string().regex(HASH),
+    createdAt: z.string().datetime({ offset: true }),
+}).strict();
+const InstallationRecordSchema = z.object({
+    version: z.literal(1),
+    installationId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    serverUrl: z.string().url().max(2048).refine((value) => {
+        const url = new URL(value);
+        return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+    }, "serverUrl must be HTTP(S) without credentials"),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    storageId: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+    nowworkHome: AbsolutePathSchema,
+    runtimeRoot: AbsolutePathSchema,
+    credentialRef: z.string().regex(/^profile:[a-z0-9][a-z0-9_-]{0,47}$/u),
+    storageMigrationId: z.string().uuid(),
+    createdAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true }),
+}).strict();
+const StorageServiceEnvironmentSchema = z.object({
+    NOWWORK_HOME: AbsolutePathSchema.optional(),
+    NOWWORK_ENV_TAG: z.string().regex(ENVIRONMENT).optional(),
+    NOWWORK_STORAGE_POLICY_PATH: AbsolutePathSchema.optional(),
+}).strict();
+const OperationSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    createdAt: z.string().datetime({ offset: true }),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    expectedManifestDigest: z.string().regex(HASH),
+    doctorInput: DoctorInputSchema,
+    migration: z.object({
+        sourceRoots: z.object({
+            "daemon-home": AbsolutePathSchema.optional(),
+            "agents-root": AbsolutePathSchema.optional(),
+            "legacy-agents-root": AbsolutePathSchema.optional(),
+        }).strict(),
+        stagingWorkspaceRoot: AbsolutePathSchema,
+        targetWorkspaceRoot: AbsolutePathSchema,
+        backupsRoot: AbsolutePathSchema,
+        backupArtifacts: z.array(z.object({
+            name: z.string().regex(/^[a-z0-9][a-z0-9_.-]{0,127}$/u),
+            path: AbsolutePathSchema,
+        }).strict()).max(32),
+        acceptedWarnings: z.array(StorageMigrationWarningCodeSchema)
+            .max(StorageMigrationWarningCodeSchema.options.length),
+    }).strict(),
+    service: z.object({
+        platform: z.enum(["darwin", "linux"]),
+        userHome: AbsolutePathSchema,
+        uid: z.number().int().nonnegative().optional(),
+        serviceEnvironment: StorageServiceEnvironmentSchema.optional(),
+        sourceWasRunning: z.boolean(),
+        sourceRecord: ManagedServiceRecordSchema,
+        targetRecord: ManagedServiceRecordSchema,
+    }).strict(),
+    installation: z.object({
+        configRoot: AbsolutePathSchema,
+        target: InstallationRecordSchema,
+    }).strict(),
+}).strict();
+const pathsFor = (_platform) => posix;
+function canonicalPath(value, platform) {
+    const paths = pathsFor(platform);
+    const absolute = paths.resolve(value);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOTDIR")
+            return absolute;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    const missing = [];
+    let ancestor = absolute;
+    for (;;) {
+        const parent = paths.dirname(ancestor);
+        if (parent === ancestor)
+            return absolute;
+        missing.unshift(paths.basename(ancestor));
+        ancestor = parent;
+        try {
+            return paths.resolve(realpathSync.native(ancestor), ...missing);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOTDIR")
+                return absolute;
+            if (code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function samePath(left, right, platform) {
+    return canonicalPath(left, platform) === canonicalPath(right, platform);
+}
+function isInside(root, candidate, platform) {
+    const paths = pathsFor(platform);
+    const child = paths.relative(canonicalPath(root, platform), canonicalPath(candidate, platform));
+    return child === "" || (!child.startsWith("..") && !paths.isAbsolute(child));
+}
+function assertSemanticIdentity(operation) {
+    const identity = [operation.doctorInput, operation.installation.target];
+    if (identity.some((value) => value.workspaceId !== operation.workspaceId
+        || value.environment !== operation.environment || value.profile !== operation.profile)
+        || operation.doctorInput.migrationId !== operation.migrationId
+        || operation.installation.target.storageMigrationId !== operation.migrationId
+        || operation.installation.target.credentialRef !== `profile:${operation.profile}`) {
+        throw new Error("storage worker operation identity does not match");
+    }
+    if (operation.doctorInput.state.profileIdentityExact !== true
+        || operation.doctorInput.state.duplicateWorkspaceMappings !== 0
+        || operation.doctorInput.state.activeAgentExecutions !== 0
+        || operation.doctorInput.state.activeScheduledRuns !== 0) {
+        throw new Error("storage worker operation doctor state is not safe");
+    }
+    const { platform, sourceRecord, targetRecord } = operation.service;
+    if (sourceRecord.platform !== platform || targetRecord.platform !== platform
+        || sourceRecord.profile !== operation.profile || targetRecord.profile !== operation.profile
+        || sourceRecord.serviceId === targetRecord.serviceId
+        || !samePath(sourceRecord.nodePath, targetRecord.nodePath, platform)
+        || !samePath(sourceRecord.entryPath, targetRecord.entryPath, platform)
+        || !samePath(sourceRecord.packageRoot, targetRecord.packageRoot, platform)
+        || !samePath(sourceRecord.npmPrefix, targetRecord.npmPrefix, platform)
+        || !samePath(targetRecord.daemonHome, operation.installation.configRoot, platform)) {
+        throw new Error("storage worker service identity does not match");
+    }
+    const sourceKinds = new Set();
+    for (const source of operation.doctorInput.sources) {
+        if (sourceKinds.has(source.kind) || !samePath(operation.migration.sourceRoots[source.kind] ?? "", source.root, platform)) {
+            throw new Error("storage worker source roots do not match doctor input");
+        }
+        sourceKinds.add(source.kind);
+    }
+    const configuredSourceKinds = Object.entries(operation.migration.sourceRoots)
+        .filter(([, value]) => value !== undefined)
+        .map(([kind]) => kind);
+    if (configuredSourceKinds.length !== sourceKinds.size || configuredSourceKinds.some((kind) => !sourceKinds.has(kind))
+        || !samePath(operation.migration.sourceRoots["daemon-home"] ?? "", sourceRecord.daemonHome, platform)
+        || !samePath(operation.migration.sourceRoots["agents-root"] ?? "", sourceRecord.agentsRoot, platform)) {
+        throw new Error("storage worker source service roots do not match");
+    }
+    const projected = storageLayout({
+        nowworkHome: operation.installation.target.nowworkHome,
+        environment: operation.environment,
+        workspaceId: operation.workspaceId,
+        runtimeBase: join(operation.service.userHome, ".nowwork-worker-runtime-validation"),
+        platform,
+    });
+    if (!samePath(projected.workspaceRoot, operation.migration.targetWorkspaceRoot, platform)
+        || !samePath(projected.workspaceRoot, operation.doctorInput.targetWorkspaceRoot, platform)
+        || !samePath(projected.agentItemsRoot, targetRecord.agentsRoot, platform)) {
+        throw new Error("storage worker target layout does not match installation identity");
+    }
+    if (dirname(operation.migration.stagingWorkspaceRoot) !== dirname(operation.migration.targetWorkspaceRoot)
+        || !basename(operation.migration.stagingWorkspaceRoot).includes(operation.migrationId)) {
+        throw new Error("storage worker staging identity does not match target");
+    }
+    if (isInside(operation.installation.target.nowworkHome, operation.migration.backupsRoot, platform)
+        || isInside(operation.installation.target.nowworkHome, operation.installation.configRoot, platform)) {
+        throw new Error("storage worker local state must remain outside NOWWORK_HOME");
+    }
+}
+function parseOperation(raw) {
+    const operation = OperationSchema.parse(raw);
+    assertSemanticIdentity(operation);
+    return operation;
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export async function writeStorageWorkerOperation(raw, input) {
+    try {
+        const operation = parseOperation(raw);
+        const stateRoot = AbsolutePathSchema.parse(input.stateRoot);
+        const path = join(stateRoot, "migrations", operation.migrationId, "operation.json");
+        const serialized = `${JSON.stringify(operation, null, 2)}\n`;
+        assertStorageControlMaterialTokenFree(serialized, "storage worker operation");
+        await atomicPrivateWrite(path, serialized);
+        return Object.freeze({ path, sha256: sha256(serialized) });
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker operation", { cause: error });
+    }
+}
+export async function readStorageWorkerOperation(path, expectedSha256) {
+    try {
+        AbsolutePathSchema.parse(path);
+        z.string().regex(HASH).parse(expectedSha256);
+        const raw = await readFile(path);
+        assertStorageControlMaterialTokenFree(raw.toString("utf8"), "storage worker operation");
+        const actual = Buffer.from(sha256(raw), "hex");
+        const expected = Buffer.from(expectedSha256, "hex");
+        if (!timingSafeEqual(actual, expected))
+            throw new Error("storage worker operation digest mismatch");
+        const operation = parseOperation(JSON.parse(raw.toString("utf8")));
+        if (basename(path) !== "operation.json" || basename(dirname(path)) !== operation.migrationId
+            || basename(dirname(dirname(path))) !== "migrations") {
+            throw new Error("storage worker operation path does not match migration identity");
+        }
+        return operation;
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker operation", { cause: error });
+    }
+}

package/dist/storage-worker-status.js

@@ -0,0 +1,105 @@
+import { readFile, unlink } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+const WorkerFailureSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    status: z.literal("failed"),
+    errorCode: z.string().regex(/^[a-z0-9._-]{1,128}$/u),
+    errorMessage: z.string().min(1).max(512),
+    at: z.string().datetime({ offset: true }),
+}).strict();
+const WorkerHeartbeatSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    pid: z.number().int().positive(),
+    at: z.string().datetime({ offset: true }),
+}).strict();
+const TOKEN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b|\bbearer\s+[^\s]+|(?:password|secret|token)\s*[:=]\s*[^\s]+)/giu;
+function identityFromHandoffPath(handoffPath) {
+    if (!isAbsolute(handoffPath) || basename(handoffPath) !== "handoff.json") {
+        throw new Error("storage worker handoff path is invalid");
+    }
+    const migrationDirectory = dirname(handoffPath);
+    const migrationsDirectory = dirname(migrationDirectory);
+    if (basename(migrationsDirectory) !== "migrations")
+        throw new Error("storage worker handoff path is invalid");
+    return {
+        stateRoot: dirname(migrationsDirectory),
+        migrationId: z.string().uuid().parse(basename(migrationDirectory)).toLowerCase(),
+    };
+}
+export function storageWorkerFailurePath(stateRoot, migrationId) {
+    if (!isAbsolute(stateRoot))
+        throw new Error("storage worker state root must be absolute");
+    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-status.json");
+}
+export function storageWorkerHeartbeatPath(stateRoot, migrationId) {
+    if (!isAbsolute(stateRoot))
+        throw new Error("storage worker state root must be absolute");
+    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-heartbeat.json");
+}
+export async function startStorageWorkerHeartbeat(handoffPath, input = {}) {
+    const identity = identityFromHandoffPath(handoffPath);
+    const intervalMs = z.number().int().min(100).max(60_000).parse(input.intervalMs ?? 5_000);
+    const now = input.now ?? (() => new Date());
+    const path = storageWorkerHeartbeatPath(identity.stateRoot, identity.migrationId);
+    let pending = Promise.resolve();
+    const write = () => {
+        pending = pending.catch(() => undefined).then(() => atomicPrivateWrite(path, `${JSON.stringify(WorkerHeartbeatSchema.parse({
+            version: 1,
+            migrationId: identity.migrationId,
+            pid: process.pid,
+            at: now().toISOString(),
+        }), null, 2)}\n`));
+        return pending;
+    };
+    await write();
+    const timer = setInterval(() => { void write(); }, intervalMs);
+    timer.unref?.();
+    return async () => {
+        clearInterval(timer);
+        await pending.catch(() => undefined);
+        await unlink(path).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+    };
+}
+export async function writeStorageWorkerFailureStatus(handoffPath, error) {
+    const identity = identityFromHandoffPath(handoffPath);
+    const rawCode = error instanceof Error && "code" in error ? String(error.code) : "worker_failed";
+    const errorCode = /^[a-z0-9._-]{1,128}$/u.test(rawCode) ? rawCode : "worker_failed";
+    const rawMessage = error instanceof Error ? error.message : String(error);
+    const errorMessage = rawMessage.replaceAll(TOKEN, "<redacted>").slice(0, 512) || "storage worker failed";
+    const status = WorkerFailureSchema.parse({
+        version: 1,
+        migrationId: identity.migrationId,
+        status: "failed",
+        errorCode,
+        errorMessage,
+        at: new Date().toISOString(),
+    });
+    await atomicPrivateWrite(storageWorkerFailurePath(identity.stateRoot, identity.migrationId), `${JSON.stringify(status, null, 2)}\n`);
+}
+export async function readStorageWorkerFailureStatus(stateRoot, migrationId) {
+    try {
+        return WorkerFailureSchema.parse(JSON.parse(await readFile(storageWorkerFailurePath(stateRoot, migrationId), "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Invalid storage worker failure status", { cause: error });
+    }
+}
+export async function readStorageWorkerHeartbeat(stateRoot, migrationId) {
+    try {
+        return WorkerHeartbeatSchema.parse(JSON.parse(await readFile(storageWorkerHeartbeatPath(stateRoot, migrationId), "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Invalid storage worker heartbeat", { cause: error });
+    }
+}

package/dist/supervised-runtime.js

@@ -58,6 +58,9 @@ export function supervisorLaunch(request) {
                 ...(request.codexSkillRoots === undefined ? {} : {
                     skillRoots: request.codexSkillRoots,
                 }),
+                ...(request.codexCollaborationTools === undefined ? {} : {
+                    codexCollaborationTools: request.codexCollaborationTools,
+                }),
                 resume: request.resume,
             }),
         };

package/dist/workspace.js

@@ -8,7 +8,7 @@
  *
  * spawn runtime 时把 <ws>/.crew 置于 PATH 最前,于是 agent 的 `crew ...` 命中 wrapper。
  */
-import { mkdir, writeFile, readFile, chmod, access } from "node:fs/promises";
+import { mkdir, writeFile, readFile, chmod, access, lstat } from "node:fs/promises";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { dslog } from "./slog.js";
@@ -34,8 +34,28 @@ async function exists(p) {
         return false;
     }
 }
+async function hasLocalMemoryV2Marker(agentDir) {
+    const crewDir = join(agentDir, ".crew");
+    const memoryDir = join(crewDir, "memory");
+    const markerPath = join(agentDir, ".crew", "memory", "v2-enabled");
+    try {
+        const crewStat = await lstat(crewDir);
+        const memoryStat = await lstat(memoryDir);
+        if (!crewStat.isDirectory() || crewStat.isSymbolicLink()
+            || !memoryStat.isDirectory() || memoryStat.isSymbolicLink())
+            return false;
+        const stat = await lstat(markerPath);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return false;
+        return (await readFile(markerPath, "utf8")) === "1\n";
+    }
+    catch {
+        return false;
+    }
+}
 export async function prepareWorkspace(input) {
     const dir = join(input.agentsRoot, input.handle);
+    const agentHomePreexisted = await exists(dir);
     const crewDir = join(dir, ".crew");
     await mkdir(crewDir, { recursive: true });
     // 预先创建明细目录,让收尾流程可以按功能创建 notes/<topic>.md。
@@ -43,6 +63,7 @@ export async function prepareWorkspace(input) {
     // MEMORY.md:首次创建"持久身份 + 知识索引"骨架,之后由 agent 自己维护
     const memoryPath = join(dir, "MEMORY.md");
     const memorySeedCreated = !(await exists(memoryPath));
+    const localMemoryV2Initialized = await hasLocalMemoryV2Marker(dir);
     if (memorySeedCreated) {
         try {
             await writeFile(memoryPath, memorySeed(input.handle, input.description), "utf8");
@@ -124,7 +145,9 @@ export async function prepareWorkspace(input) {
         crewDir,
         systemPromptPath,
         memory,
+        agentHomePreexisted,
         memorySeedCreated,
+        localMemoryV2Initialized,
         homeDir,
         runDir,
         workLogPath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.63",
+  "version": "0.6.65",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",