@nowcrew/daemon 0.6.64 → 0.6.65

package/dist/main.js

@@ -7,6 +7,7 @@
  */
 import { parseArgs } from "node:util";
 import { homedir } from "node:os";
+import { join } from "node:path";
 import { loadConfig, ConfigError } from "./config.js";
 import { detectDaemonLang, formatDaemonText, translateDaemon } from "./i18n.js";
 import { cliVersion, daemonVersion } from "./machine-info.js";
@@ -21,7 +22,18 @@ import { formatDaemonStartupError } from "./daemon-startup-error.js";
 import { assertManagedServiceStartup } from "./managed-service-startup.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
+import { loadStorageRuntime } from "./storage-runtime.js";
+import { readStorageMigrationReceipt } from "./storage-migration-controller.js";
+import { storageMigrationStatusReplay } from "./storage-status-replay.js";
+import { runStorageWorkerCommand } from "./storage-worker-command.js";
+import { probeStorageMigrationRuntime } from "./storage-runtime-readiness.js";
+import { createStorageTargetConfirmationHandler } from "./storage-target-confirmation.js";
 async function main() {
+    const workerResult = await runStorageWorkerCommand(process.argv.slice(2));
+    if (workerResult !== null) {
+        process.exitCode = workerResult;
+        return;
+    }
     const computerResult = await runComputerCommand(process.argv.slice(2));
     if (computerResult !== null) {
         process.exitCode = computerResult;
@@ -57,8 +69,10 @@ async function main() {
     // 不把 machine token 放进 argv / plist / systemd unit / scheduled task。
     if (values["daemon-home"])
         process.env.CREW_DAEMON_HOME = values["daemon-home"];
+    let activeDaemonHome;
     if (values.profile) {
         const home = daemonHome();
+        activeDaemonHome = home;
         const profile = await loadProfile(values.profile, home);
         if (cmd === "serve") {
             await assertProfileAgentsRootUnique(profile, home, homedir());
@@ -71,6 +85,12 @@ async function main() {
                 agentsRoot: resolveAgentsRoot(profile.agentsRoot, homedir(), process.platform),
                 nodePath: process.execPath,
                 entryPath: builtDaemonEntry(),
+                environment: {
+                    ...(process.env.NOWWORK_HOME === undefined ? {} : { NOWWORK_HOME: process.env.NOWWORK_HOME }),
+                    ...(process.env.NOWWORK_ENV_TAG === undefined ? {} : { NOWWORK_ENV_TAG: process.env.NOWWORK_ENV_TAG }),
+                    ...(process.env.NOWWORK_STORAGE_POLICY_PATH === undefined
+                        ? {} : { NOWWORK_STORAGE_POLICY_PATH: process.env.NOWWORK_STORAGE_POLICY_PATH }),
+                },
             });
         }
         applyProfileToEnv(profile, process.env);
@@ -100,9 +120,72 @@ async function main() {
         const installationLease = installation === null
             ? null
             : await acquireDaemonInstallationLease(installation.npmPrefix);
+        const storageRuntime = values.profile === undefined
+            ? null
+            : await loadStorageRuntime({
+                profile: values.profile,
+                serverUrl: config.serverUrl,
+                userHome: homedir(),
+                platform: process.platform,
+                environment: process.env,
+            });
+        const migrationRuntime = values.profile === undefined || activeDaemonHome === undefined || storageRuntime !== null
+            ? { ready: false, reason: "not_legacy_source" }
+            : await probeStorageMigrationRuntime({
+                profile: values.profile,
+                serverUrl: config.serverUrl,
+                currentDaemonHome: activeDaemonHome,
+                currentAgentsRoot: config.agentsRoot,
+                userHome: homedir(),
+                platform: process.platform,
+                ...(process.getuid === undefined ? {} : { uid: process.getuid() }),
+                environment: process.env,
+            });
+        const targetConfirmation = storageRuntime?.identity.storageMigrationId === undefined
+            ? null
+            : createStorageTargetConfirmationHandler({
+                backupsRoot: storageRuntime.local.backupsRoot,
+                identity: storageRuntime.identity,
+                profile: storageRuntime.installation.profile,
+                completionTimeoutMs: 180_000,
+            });
+        const storageMigration = storageRuntime !== null
+            ? {
+                ready: false,
+                statusOutboxPath: join(storageRuntime.local.stateRoot, "storage-status-outbox.json"),
+                identity: storageRuntime.identity,
+                ...(targetConfirmation === null ? {} : { confirm: targetConfirmation.handle }),
+                ...(storageRuntime.identity.storageMigrationId === undefined ? {} : {
+                    replayStatus: async (send) => {
+                        const migrationId = storageRuntime.identity.storageMigrationId;
+                        const receipt = await readStorageMigrationReceipt(storageRuntime.local.backupsRoot, migrationId);
+                        if (receipt === null)
+                            throw new Error(`storage migration receipt not found: ${migrationId}`);
+                        for (const frame of storageMigrationStatusReplay(receipt, {
+                            migrationId,
+                            environment: storageRuntime.identity.storageEnvironment,
+                            workspaceId: storageRuntime.identity.storageWorkspaceId,
+                            profile: storageRuntime.installation.profile,
+                        }))
+                            send(frame);
+                    },
+                }),
+            }
+            : migrationRuntime.ready
+                ? {
+                    ready: true,
+                    statusOutboxPath: migrationRuntime.runtime.statusOutboxPath,
+                    identity: migrationRuntime.runtime.identity,
+                    controller: migrationRuntime.runtime.controller,
+                    attach: migrationRuntime.runtime.attach,
+                    bindServerIdentity: migrationRuntime.runtime.bindServerIdentity,
+                    replayStatus: migrationRuntime.runtime.replayStatus,
+                }
+                : undefined;
         await runWithDaemonInstallationLease(installationLease, async () => {
             const service = serve(config, {
                 ...(values.profile === undefined ? {} : { profileName: values.profile }),
+                ...(storageMigration === undefined ? {} : { storageMigration }),
             });
             await runServeLifecycle(service);
         });

package/dist/managed-service-lifecycle.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { acquireDaemonInstallationLease } from "./daemon-installation-lease.js";
-import { installService, ensureServiceEnabled, readServiceDescriptor, serviceAction, uninstallService, } from "./computer-service.js";
+import { installService, ensureServiceEnabled, readServiceDescriptor, serviceAction, replaceInstalledServiceDescriptor, uninstallService, } from "./computer-service.js";
 import { ManagedServiceConflictError, ManagedServiceRegistryError, assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, managedServiceConflict, normalizeManagedServiceRecord, serviceDescriptorSha256, withManagedServiceRegistryLock, } from "./managed-service-registry.js";
 function requirePortableManagedSpec(spec) {
     if ((spec.platform !== "darwin" && spec.platform !== "linux")
@@ -35,6 +35,17 @@ function sameManagedIdentity(left, right) {
     const { generation: _generation, createdAt: _createdAt, ...expected } = right;
     return managedServiceIdentityMatches(left, expected);
 }
+function sameManagedResource(left, right) {
+    const { generation: _leftGeneration, createdAt: _leftCreatedAt, descriptorSha256: _leftHash, ...leftResource } = left;
+    const { generation: _rightGeneration, createdAt: _rightCreatedAt, descriptorSha256: _rightHash, ...rightResource } = right;
+    return JSON.stringify(leftResource) === JSON.stringify(rightResource);
+}
+function descriptorDiffIsStorageEnvironmentOnly(previous, next) {
+    if (!next.includes("\n  <key>EnvironmentVariables</key>\n"))
+        return false;
+    const strip = (descriptor) => descriptor.replace(/\n  <key>EnvironmentVariables<\/key>\n  <dict>\n(?:    <key>(?:NOWWORK_HOME|NOWWORK_ENV_TAG|NOWWORK_STORAGE_POLICY_PATH)<\/key><string>[^<]*<\/string>\n)+  <\/dict>\n/u, "\n");
+    return strip(previous) === strip(next);
+}
 function assertRecordDescribesSpec(input) {
     requirePortableManagedSpec(input.spec);
     const { spec, record } = input;
@@ -51,8 +62,20 @@ function assertRecordDescribesSpec(input) {
     }
 }
 export async function installManagedService(input) {
-    assertRecordDescribesSpec(input);
     requirePortableManagedSpec(input.spec);
+    const requestedDescriptor = input.spec.descriptor;
+    const expectedDescriptorHash = serviceDescriptorSha256(input.spec.descriptor);
+    const expectedPath = normalizeManagedServiceRecord({
+        ...input.record,
+        descriptorPath: input.spec.descriptorPath,
+        descriptorSha256: expectedDescriptorHash,
+    }).descriptorPath;
+    if (input.record.platform !== input.spec.platform
+        || input.record.serviceId !== input.spec.id
+        || input.record.profile !== input.spec.profile
+        || input.record.descriptorPath !== expectedPath) {
+        throw new ManagedServiceRegistryError(`Managed service record does not describe '${input.spec.id}'`);
+    }
     const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
     await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services, replace }) => {
         const exact = services.find((record) => sameManagedIdentity(record, input.record));
@@ -76,6 +99,28 @@ export async function installManagedService(input) {
             }
             return;
         }
+        const registered = services.find((record) => record.serviceId === input.record.serviceId
+            && record.profile === input.record.profile
+            && record.daemonHome === input.record.daemonHome);
+        if (registered !== undefined && sameManagedResource(registered, input.record)) {
+            const current = await readServiceDescriptor(input.spec);
+            if (current === null || serviceDescriptorSha256(current) !== registered.descriptorSha256) {
+                throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+            }
+            if (!descriptorDiffIsStorageEnvironmentOnly(current, requestedDescriptor)) {
+                throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' conflicts with the requested identity`);
+            }
+            await replaceInstalledServiceDescriptor(input.spec, current, input.runner);
+            try {
+                await replace(services.map((record) => record === registered ? input.record : record));
+            }
+            catch (error) {
+                const rollbackSpec = { ...input.spec, descriptor: current };
+                await replaceInstalledServiceDescriptor(rollbackSpec, requestedDescriptor, input.runner).catch(() => undefined);
+                throw error;
+            }
+            return;
+        }
         const conflict = managedServiceConflict(services, input.record);
         if (conflict !== null) {
             throw new ManagedServiceConflictError(conflict.resource, input.record, conflict.owner);

package/dist/managed-service-startup.js

@@ -14,6 +14,7 @@ export async function assertManagedServiceStartup(input) {
         nodePath: input.nodePath,
         entryPath: input.entryPath,
         profileHome: input.daemonHome,
+        ...(input.environment === undefined ? {} : { environment: input.environment }),
     });
     const readRegistry = input.readManagedServices
         ?? (() => readManagedServiceRegistry({ userHome: input.userHome }));
@@ -42,6 +43,7 @@ export async function assertManagedServiceStartup(input) {
             nodePath: input.nodePath,
             entryPath: input.entryPath,
             profileHome: input.daemonHome,
+            ...(input.environment === undefined ? {} : { environment: input.environment }),
             legacyServiceId: true,
         });
         const legacyDescriptor = await readDescriptor(legacySpec);

package/dist/profile-layout.js

@@ -2,6 +2,10 @@ import { posix, win32 } from "node:path";
 export const PROFILE_LAYOUT_VERSION = 1;
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
 const LOCAL_INSTANCE_NAME = /^[a-z0-9][a-z0-9_-]{0,39}$/u;
+/** Accept the legacy `in` tag at the boundary, but never persist it in a new layout. */
+export function normalizeProfileEnvironment(value) {
+    return value === "in" ? "production" : value;
+}
 export function validateLocalInstanceName(value) {
     const normalized = value.trim().toLowerCase();
     if (!LOCAL_INSTANCE_NAME.test(normalized) || normalized.includes("..")) {
@@ -10,19 +14,21 @@ export function validateLocalInstanceName(value) {
     return normalized;
 }
 export function profileForLocalInstance(environment, localInstanceName) {
-    const profile = `nw-${environment}-${validateLocalInstanceName(localInstanceName)}`;
+    const canonicalEnvironment = normalizeProfileEnvironment(environment);
+    const profile = `nw-${canonicalEnvironment}-${validateLocalInstanceName(localInstanceName)}`;
     if (!PROFILE_NAME.test(profile))
         throw new Error("derived daemon profile exceeds 48 characters");
     return profile;
 }
 export function profileLayout(input) {
+    const environment = normalizeProfileEnvironment(input.environment);
     const localInstanceName = validateLocalInstanceName(input.localInstanceName);
-    const profile = profileForLocalInstance(input.environment, localInstanceName);
+    const profile = profileForLocalInstance(environment, localInstanceName);
     const paths = input.platform === "win32" ? win32 : posix;
-    const base = `${input.environment}-${localInstanceName}`;
+    const base = `${environment}-${localInstanceName}`;
     return Object.freeze({
         layoutVersion: PROFILE_LAYOUT_VERSION,
-        environment: input.environment,
+        environment,
         localInstanceName,
         profile,
         daemonHome: paths.join(input.userHome, ".crew", `daemon-${base}`),

package/dist/project-skills/controller.js

@@ -183,6 +183,8 @@ export function createProjectSkillsController(deps) {
             const parsed = ProjectCommandSchema.safeParse(input);
             if (!parsed.success)
                 return { ok: false, error: "invalid_project_command" };
+            if (deps.isAdmissionClosed?.() === true)
+                return { ok: false, error: "storage_migration_quiescing" };
             try {
                 assertCurrentEpoch(epochToken);
             }

package/dist/prompt.js

@@ -305,7 +305,7 @@ ${memoryTaskReadRule}
 - **跨任务协调看实时清单**:用 \`crew task list --mine\` 查你当前所有任务及其状态(谁在排队、谁在评审)。例:你一次只能测一个页面时,据此判断"正在测 #1、#2 排队",在 #2 的工作日志里标注"等 #1 完成"。
 - 需要更多背景时再 \`Read $CREW_HOME/notes/<topic>.md\`;不要一次把所有笔记读进上下文。
 
-${communicationSection}
+${communicationSection}${ctx.collaborationToolsEnabled === true ? buildCollaborationToolsPrompt() : ""}
 
 CLI 成功时打印人类可读文本到 stdout;失败时 stderr 给出错误,并用**退出码**告诉你下一步:
 - \`4\` = 任务已被他人认领 / 不可认领 → 停手,别抢,转做别的。
@@ -385,3 +385,21 @@ export function buildOriginDecisionRetryPrompt(channelId, threadId) {
         "普通内部消息不算外部回复决策；--send-draft 也不是外部回复开关。",
     ].join("\n");
 }
+/**
+ * Codex 原生 collaboration.* 工具的用法与边界(spec 2d;2026-08-28 对 Codex 0.149.1/0.150.1 实测)。
+ * 只在 daemon 开关打开且 runtime 为 codex 时注入;是本机 runtime 能力事实,不是产品策略。
+ * 契约来自实测,不编造 Codex 未声明的返回字段。
+ */
+export function buildCollaborationToolsPrompt() {
+    return `
+
+## Codex 原生协作工具
+本机 Codex 已开启 \`collaboration.*\` 子 agent 工具。它们完全在 Codex 进程内运行:子 agent 的工作对 NowWork 的频道、线程、任务、execution 记录和按 agent 的 token 统计**都不可见**,token 并入你本轮的用量。只用于你自己会汇总的内部交叉核对、并行调研;绝不用于人类或其它 NowWork 成员需要观察、审计或接手的事。
+- **\`collaboration.spawn_agent\`** —— 必填 \`task_name\`(仅小写字母/数字/下划线)、\`message\`;可选 \`fork_turns\`(\`"none"\`|\`"all"\`|\`"3"\` 这样的轮数,默认 \`"all"\`)、\`model\`、\`reasoning_effort\`。立即启动独立 turn,你不阻塞;子 agent 跑完后 idle 而非销毁。新 agent 用 **canonical 任务名路径**引用,如 \`/root/api_review\`。含 root 最多 4 个活跃 agent。
+- **\`collaboration.followup_task\`** —— 必填 \`target\`(canonical 路径,不是 UUID)、\`message\`。异步投递并把 idle 的目标唤醒进新 turn,可重复。
+- **\`collaboration.send_message\`** —— 必填 \`target\`、\`message\`。只入队,**不**启动 turn;要触发工作用 followup_task。
+- **\`collaboration.list_agents\`** —— 可选 \`path_prefix\`。只读,列出 live agents。
+- **\`collaboration.wait_agent\`** —— 可选 \`timeout_ms\`(10000–3600000,默认 30000)。阻塞你直到任一子 agent 有更新、有新输入或超时。
+- **没有任何返回值有保证的 schema**:不要去解析返回值里的 \`agent_id\`/\`id\`/\`accepted\` 之类字段;用 \`list_agents\` 和 \`wait_agent\` 获取状态。
+- **不要调用 \`collaboration.interrupt_agent\`**:它会把你自己这轮 turn 一起中断(2026-08-10 线上事故),中断后本轮结果全部丢失且不会重跑。让子 agent 自然跑完或直接忽略其结果。`;
+}

package/dist/runner.js

@@ -58,6 +58,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             ...(input.wakeOrigin ? { wakeOrigin: input.wakeOrigin } : {}),
             memory: capMemoryForInject(workspace.memory),
             ...(resuming ? {} : { workLog: capWorkLogForInject(workspace.workLog) }),
+            collaborationToolsEnabled: config.codexCollaborationTools && runtime === "codex",
         }),
         wakePrompt: ({ resuming, rotatedForBudget, nearBudget }) => {
             const distillHint = nearBudget
@@ -74,6 +75,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             name: runtime,
             ...(providerConfig.model ? { model: providerConfig.model } : {}),
             ...(reasoning.success ? { reasoning: reasoning.data } : {}),
+            codexCollaborationTools: config.codexCollaborationTools,
         },
         effectivePermission: config.dangerous ? "full_access" : "workspace_write",
         captureFinal: true,
@@ -105,6 +107,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             softTokens: config.sessionSoftTokens,
             maxTurns: config.sessionMaxTurns,
         },
+        localMemoryV2Enabled: config.localMemoryV2Handles?.has(input.handle) === true,
     }, {
         onActivity,
         onConsole,

package/dist/runtimes/codex-app-server-runner.js

@@ -6,7 +6,8 @@ import { pathToFileURL } from "node:url";
 import spawn from "cross-spawn";
 import { z } from "zod";
 import { signalSupervisorTree } from "../execution-supervisor.js";
-import { assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
+import { assertCodexCollaborationVersion, assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
+import { decideTurnRetry, itemMakesTurnUnsafe } from "./codex-turn-retry.js";
 import { startFirstProgressWatchdog } from "./progress-watchdog.js";
 const RunnerInputSchema = z.object({
     systemPrompt: z.string().min(1),
@@ -20,6 +21,7 @@ const RunnerInputSchema = z.object({
     cwd: z.string().min(1).optional(),
     workspaceRoots: z.array(z.string().min(1)).optional(),
     skillRoots: z.array(z.string().min(1)).optional(),
+    codexCollaborationTools: z.boolean().optional(),
     resume: z.boolean(),
 }).strict();
 const RPC_TIMEOUT_MS = 30_000;
@@ -37,12 +39,17 @@ const MAX_TRANSIENT_TURN_RETRIES = 2;
 const TRANSIENT_TURN_RETRY_DELAY_MS = 15_000;
 const TRANSIENT_TURN_RETRY_BACKOFF_FACTOR = 3;
 const PROCESS_TREE_STOP_TIMEOUT_MS = 1_000;
+/** 进程级:一旦某个 collabAgentToolCall 的 item/completed 没有对应 item/started,本执行后续永不重试(spec R4-3)。 */
+let collabStartedMissing = false;
 const USER_INPUT_UNAVAILABLE_MESSAGE = "NowWork cannot collect interactive user input in this headless run; ask the user in the final response instead of assuming an answer.";
-export function codexAppServerArgs(projectRootMarkers) {
+export function codexAppServerArgs(input) {
     return [
-        ...(projectRootMarkers === undefined
+        ...(input.projectRootMarkers === undefined
             ? []
-            : ["-c", `project_root_markers=${JSON.stringify(projectRootMarkers)}`]),
+            : ["-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`]),
+        // multi_agent 按开关;multi_agent_v2 无条件关,钉死已验证的 v1 契约(spec 2b)。
+        "-c", `features.multi_agent=${input.collaborationTools === true}`,
+        "-c", "features.multi_agent_v2=false",
         "app-server", "--listen", "stdio://",
     ];
 }
@@ -53,7 +60,8 @@ const TRANSIENT_TURN_ERROR_PATTERNS = [
     /too many requests/i,
 ];
 /** 模型侧瞬态失败(网关过载/限流)→ 换个时间整轮重试大概率成功。
- *  interrupted 不算:那是取消信号或 codex collab 连带中断,重跑语义不明确。 */
+ *  interrupted 单独归为 collab_interrupted:2026-08-10 实锤是模型自己调 collaboration.interrupt_agent
+ *  连带把父 turn 置为 interrupted。两类原因都只在本 turn 无白名单外工具活动时重试(codex-turn-retry.ts)。 */
 export function isTransientTurnFailure(detail) {
     return TRANSIENT_TURN_ERROR_PATTERNS.some((pattern) => pattern.test(detail));
 }
@@ -413,7 +421,10 @@ async function stopChildTree(child) {
 }
 async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs) {
     const attemptStartedAt = Date.now();
-    const child = spawn(bin, codexAppServerArgs(input.projectRootMarkers), {
+    const child = spawn(bin, codexAppServerArgs({
+        ...(input.projectRootMarkers === undefined ? {} : { projectRootMarkers: input.projectRootMarkers }),
+        ...(input.codexCollaborationTools === undefined ? {} : { collaborationTools: input.codexCollaborationTools }),
+    }), {
         cwd: process.cwd(),
         env: process.env,
         stdio: ["pipe", "pipe", "pipe"],
@@ -434,6 +445,8 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
     let threadId = null;
     let announcedThreadId = null;
     let turnId = null;
+    let turnHasUnsafeSideEffect = false;
+    const startedItemIds = new Set();
     let lastUsage;
     let completionResolve;
     let completionReject;
@@ -452,6 +465,20 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             || method === "item/agentMessage/delta" || method === "item/completed") {
             firstProgress.observe();
         }
+        if (method === "item/started" || method === "item/completed") {
+            const item = params !== null && typeof params === "object"
+                ? params.item
+                : undefined;
+            if (method === "item/started" && typeof item?.id === "string")
+                startedItemIds.add(item.id);
+            if (method === "item/completed" && item?.type === "collabAgentToolCall"
+                && (typeof item.id !== "string" || !startedItemIds.has(item.id)) && !collabStartedMissing) {
+                collabStartedMissing = true;
+                process.stderr.write("[codex-app-server] collab_item_started_missing\n");
+            }
+            if (itemMakesTurnUnsafe(item))
+                turnHasUnsafeSideEffect = true;
+        }
         for (const event of mapCodexNotification(method, params)) {
             const eventThreadId = typeof event.thread_id === "string" ? event.thread_id : null;
             if (event.type === "thread.started" && eventThreadId === announcedThreadId)
@@ -496,6 +523,8 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
         if (input.workspaceRoots !== undefined || input.skillRoots !== undefined) {
             assertCodexNativeWorkspaceVersion(initialized);
         }
+        if (input.codexCollaborationTools === true)
+            assertCodexCollaborationVersion(initialized);
         logStage(activeStage, "ok", attempt, stageStartedAt);
         rpc.notify("initialized");
         activeStage = input.resume ? "thread_resume" : "thread_start";
@@ -580,15 +609,19 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             }),
         });
         if (completed.turn?.status === "completed")
-            return { code: 0, initializeTimedOut: false };
+            return { code: 0, initializeTimedOut: false, unsafeToRetry: false };
         const detail = completed.turn?.error?.message ?? `turn status ${completed.turn?.status ?? "unknown"}`;
         process.stderr.write(sanitizeCodexDiagnostic(`Codex turn failed: ${detail.slice(0, ERROR_MESSAGE_CAP)}\n`, secrets));
+        const status = completed.turn?.status;
+        const retryReason = cancelling ? undefined
+            : status === "interrupted" ? "collab_interrupted"
+                : status === "failed" && isTransientTurnFailure(detail) ? "transient_turn_failure"
+                    : undefined;
         return {
-            code: completed.turn?.status === "interrupted" ? 130 : 1,
+            code: status === "interrupted" ? 130 : 1,
             initializeTimedOut: false,
-            transientTurnFailure: !cancelling
-                && completed.turn?.status === "failed"
-                && isTransientTurnFailure(detail),
+            ...(retryReason === undefined ? {} : { retryReason }),
+            unsafeToRetry: turnHasUnsafeSideEffect || collabStartedMissing,
         };
     }
     catch (error) {
@@ -601,7 +634,7 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             logStage(activeStage, "error", attempt, stageStartedAt);
         }
         process.stderr.write(`Codex app-server execution failed: ${safeErrorMessage(error, secrets)}\n`);
-        return { code: 1, initializeTimedOut };
+        return { code: 1, initializeTimedOut, unsafeToRetry: false };
     }
     finally {
         firstProgress.stop();
@@ -633,13 +666,20 @@ export async function runCodexAppServer(bin, options = {}) {
             process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=initialize_timeout\n`);
             continue;
         }
-        if (result.transientTurnFailure && turnRetries < MAX_TRANSIENT_TURN_RETRIES) {
+        const decision = decideTurnRetry(result, turnRetries, MAX_TRANSIENT_TURN_RETRIES);
+        if (decision.kind === "retry") {
             const delayMs = turnRetryDelayMs * TRANSIENT_TURN_RETRY_BACKOFF_FACTOR ** turnRetries;
             turnRetries += 1;
-            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=transient_turn_failure\n`);
+            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=${decision.reason}\n`);
             await new Promise((resolve) => setTimeout(resolve, delayMs));
             continue;
         }
+        if (decision.kind === "skipped") {
+            process.stderr.write(`[codex-app-server] stage=retry status=skipped attempt=${attempt} reason=${decision.reason}_unsafe\n`);
+        }
+        else if (decision.kind === "exhausted") {
+            process.stderr.write(`[codex-app-server] stage=retry status=exhausted attempt=${attempt} reason=${decision.reason}\n`);
+        }
         return result.code;
     }
 }

package/dist/runtimes/codex-command-safety.js

@@ -0,0 +1,75 @@
+/**
+ * Codex app-server 重试门控用的「只读 crew 命令」判定(spec Part 1,R3-1/R4-1)。
+ *
+ * 白名单 + 封闭文法,不是黑名单:任何解析不确定都返回 false。只回答"这是不是白名单里某条
+ * crew 只读命令的一次干净调用",不做"读/写"语义判断。任何非 crew 命令(sed/rg/git/python…)
+ * 一律 false——白名单之外的一切都视为不可安全重试。零 IO,可独立单测。
+ */
+/** 封闭列表,由 cli/src/run.ts 命令面反推;新增 CLI 只读命令时同步维护。漏加只会更保守。 */
+export const READ_ONLY_CREW_COMMANDS = new Set([
+    "whoami",
+    "server info",
+    "message read",
+    "message check",
+    "thread read",
+    "task list",
+    "schedule list",
+    "schedule runs",
+    "reminder list",
+    "reminder log",
+    "resolve",
+    "channel members",
+    "integration env",
+    "integration list",
+]);
+const SINGLE_VERB = new Set(["whoami", "resolve"]);
+// 一层 shell 包装:bash/sh/zsh -c / -lc / -cl,后跟被单引号或双引号整体包裹的正文。
+const WRAPPER = /^(?:\/usr\/bin\/|\/bin\/)?(?:bash|sh|zsh)\s+-(?:l?c|cl)\s+(.+)$/su;
+// 整串禁字符:出现任一即拒绝(含单个 &、引号、$、括号、换行、制表、反斜杠)。
+const FORBIDDEN = /[&;|<>$`(){}\\'"\n\r\t]/u;
+const OPTION_TOKEN = /^--?[A-Za-z][A-Za-z0-9-]*(?:=[A-Za-z0-9._:/@#%+-]+)?$/u;
+const VALUE_TOKEN = /^[A-Za-z0-9._:/@#%+][A-Za-z0-9._:/@#%+-]+$/u;
+function unwrap(command) {
+    const match = WRAPPER.exec(command);
+    if (match === null)
+        return command;
+    const quoted = match[1] ?? "";
+    const quote = quoted[0];
+    if (quote !== "'" && quote !== "\"")
+        return null;
+    if (quoted.length < 2 || quoted[quoted.length - 1] !== quote)
+        return null;
+    const body = quoted.slice(1, -1);
+    if (body.includes(quote))
+        return null;
+    if (quote === "\"" && /[$\\]/u.test(body))
+        return null;
+    return body;
+}
+export function isReadOnlyCrewCommand(command) {
+    const body = unwrap(command);
+    if (body === null)
+        return false;
+    if (FORBIDDEN.test(body))
+        return false;
+    const trimmed = body.trim();
+    if (trimmed === "" || /\s{2,}/u.test(trimmed))
+        return false;
+    const tokens = trimmed.split(" ");
+    if (tokens[0] !== "crew")
+        return false;
+    const verb = tokens[1];
+    if (verb === undefined)
+        return false;
+    let consumed;
+    if (SINGLE_VERB.has(verb)) {
+        consumed = 2;
+    }
+    else {
+        const pair = `${verb} ${tokens[2] ?? ""}`;
+        if (!READ_ONLY_CREW_COMMANDS.has(pair))
+            return false;
+        consumed = 3;
+    }
+    return tokens.slice(consumed).every((token) => OPTION_TOKEN.test(token) || VALUE_TOKEN.test(token));
+}

package/dist/runtimes/codex-contract.js

@@ -1,6 +1,7 @@
-import { CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
+import { CODEX_COLLABORATION_MIN_VERSION, CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
 import { z } from "zod";
 export const CODEX_PROJECT_WORKSPACE_UNSUPPORTED = "codex_project_workspace_unsupported";
+export const CODEX_COLLABORATION_UNSUPPORTED = "codex_collaboration_unsupported";
 export const CODEX_PLAN_ENTRY_LIMIT = 16;
 // 16 steps remain inside the server's 4,000 UTF-16-unit plan payload cap even
 // when every retained code point is a surrogate pair (for example, emoji).
@@ -51,18 +52,32 @@ const versionTuple = (version) => {
 const versionAtLeast = (actual, minimum) => actual[0] > minimum[0]
     || (actual[0] === minimum[0] && (actual[1] > minimum[1]
         || (actual[1] === minimum[1] && actual[2] >= minimum[2])));
-/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
-export function assertCodexNativeWorkspaceVersion(response) {
+function initializeVersion(response) {
     const parsed = NativeInitializeResponseSchema.safeParse(response);
     if (!parsed.success)
-        throw codexProjectWorkspaceUnsupported();
+        return null;
     const match = /(?:^|[/\s])(\d+\.\d+\.\d+)(?=$|[\s(])/u.exec(parsed.data.userAgent);
-    const actual = match === null ? null : versionTuple(match[1] ?? "");
+    return match === null ? null : versionTuple(match[1] ?? "");
+}
+/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
+export function assertCodexNativeWorkspaceVersion(response) {
+    const actual = initializeVersion(response);
     const minimum = versionTuple(CODEX_NATIVE_WORKSPACE_MIN_VERSION);
     if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
         throw codexProjectWorkspaceUnsupported();
     }
 }
+/** Collaboration tools are exposed only on an app-server whose contract was verified (spec 2b). */
+export function assertCodexCollaborationVersion(response) {
+    const actual = initializeVersion(response);
+    const minimum = versionTuple(CODEX_COLLABORATION_MIN_VERSION);
+    if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
+        throw codexCollaborationUnsupported();
+    }
+}
+export function codexCollaborationUnsupported() {
+    return new Error(CODEX_COLLABORATION_UNSUPPORTED);
+}
 const PLAN_STATUSES = new Set(["pending", "inProgress", "completed"]);
 const clipCharacters = (value, limit) => [...value.trim().replace(/\s+/gu, " ")].slice(0, limit).join("");
 /** Treat plan updates as bounded user-visible data; any malformed retained step rejects the event. */