@nowcrew/daemon 0.6.66 → 0.6.67

package/dist/managed-service-startup.js

@@ -14,6 +14,7 @@ export async function assertManagedServiceStartup(input) {
         nodePath: input.nodePath,
         entryPath: input.entryPath,
         profileHome: input.daemonHome,
+        ...(input.environment === undefined ? {} : { environment: input.environment }),
     });
     const readRegistry = input.readManagedServices
         ?? (() => readManagedServiceRegistry({ userHome: input.userHome }));
@@ -42,6 +43,7 @@ export async function assertManagedServiceStartup(input) {
             nodePath: input.nodePath,
             entryPath: input.entryPath,
             profileHome: input.daemonHome,
+            ...(input.environment === undefined ? {} : { environment: input.environment }),
             legacyServiceId: true,
         });
         const legacyDescriptor = await readDescriptor(legacySpec);

package/dist/profile-layout.js

@@ -2,6 +2,10 @@ import { posix, win32 } from "node:path";
 export const PROFILE_LAYOUT_VERSION = 1;
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
 const LOCAL_INSTANCE_NAME = /^[a-z0-9][a-z0-9_-]{0,39}$/u;
+/** Accept the legacy `in` tag at the boundary, but never persist it in a new layout. */
+export function normalizeProfileEnvironment(value) {
+    return value === "in" ? "production" : value;
+}
 export function validateLocalInstanceName(value) {
     const normalized = value.trim().toLowerCase();
     if (!LOCAL_INSTANCE_NAME.test(normalized) || normalized.includes("..")) {
@@ -10,19 +14,21 @@ export function validateLocalInstanceName(value) {
     return normalized;
 }
 export function profileForLocalInstance(environment, localInstanceName) {
-    const profile = `nw-${environment}-${validateLocalInstanceName(localInstanceName)}`;
+    const canonicalEnvironment = normalizeProfileEnvironment(environment);
+    const profile = `nw-${canonicalEnvironment}-${validateLocalInstanceName(localInstanceName)}`;
     if (!PROFILE_NAME.test(profile))
         throw new Error("derived daemon profile exceeds 48 characters");
     return profile;
 }
 export function profileLayout(input) {
+    const environment = normalizeProfileEnvironment(input.environment);
     const localInstanceName = validateLocalInstanceName(input.localInstanceName);
-    const profile = profileForLocalInstance(input.environment, localInstanceName);
+    const profile = profileForLocalInstance(environment, localInstanceName);
     const paths = input.platform === "win32" ? win32 : posix;
-    const base = `${input.environment}-${localInstanceName}`;
+    const base = `${environment}-${localInstanceName}`;
     return Object.freeze({
         layoutVersion: PROFILE_LAYOUT_VERSION,
-        environment: input.environment,
+        environment,
         localInstanceName,
         profile,
         daemonHome: paths.join(input.userHome, ".crew", `daemon-${base}`),

package/dist/project-skills/controller.js

@@ -183,6 +183,8 @@ export function createProjectSkillsController(deps) {
             const parsed = ProjectCommandSchema.safeParse(input);
             if (!parsed.success)
                 return { ok: false, error: "invalid_project_command" };
+            if (deps.isAdmissionClosed?.() === true)
+                return { ok: false, error: "storage_migration_quiescing" };
             try {
                 assertCurrentEpoch(epochToken);
             }

package/dist/prompt.js

@@ -305,7 +305,7 @@ ${memoryTaskReadRule}
 - **跨任务协调看实时清单**:用 \`crew task list --mine\` 查你当前所有任务及其状态(谁在排队、谁在评审)。例:你一次只能测一个页面时,据此判断"正在测 #1、#2 排队",在 #2 的工作日志里标注"等 #1 完成"。
 - 需要更多背景时再 \`Read $CREW_HOME/notes/<topic>.md\`;不要一次把所有笔记读进上下文。
 
-${communicationSection}
+${communicationSection}${ctx.collaborationToolsEnabled === true ? buildCollaborationToolsPrompt() : ""}
 
 CLI 成功时打印人类可读文本到 stdout;失败时 stderr 给出错误,并用**退出码**告诉你下一步:
 - \`4\` = 任务已被他人认领 / 不可认领 → 停手,别抢,转做别的。
@@ -385,3 +385,21 @@ export function buildOriginDecisionRetryPrompt(channelId, threadId) {
         "普通内部消息不算外部回复决策；--send-draft 也不是外部回复开关。",
     ].join("\n");
 }
+/**
+ * Codex 原生 collaboration.* 工具的用法与边界(spec 2d;2026-08-28 对 Codex 0.149.1/0.150.1 实测)。
+ * 只在 daemon 开关打开且 runtime 为 codex 时注入;是本机 runtime 能力事实,不是产品策略。
+ * 契约来自实测,不编造 Codex 未声明的返回字段。
+ */
+export function buildCollaborationToolsPrompt() {
+    return `
+
+## Codex 原生协作工具
+本机 Codex 已开启 \`collaboration.*\` 子 agent 工具。它们完全在 Codex 进程内运行:子 agent 的工作对 NowWork 的频道、线程、任务、execution 记录和按 agent 的 token 统计**都不可见**,token 并入你本轮的用量。只用于你自己会汇总的内部交叉核对、并行调研;绝不用于人类或其它 NowWork 成员需要观察、审计或接手的事。
+- **\`collaboration.spawn_agent\`** —— 必填 \`task_name\`(仅小写字母/数字/下划线)、\`message\`;可选 \`fork_turns\`(\`"none"\`|\`"all"\`|\`"3"\` 这样的轮数,默认 \`"all"\`)、\`model\`、\`reasoning_effort\`。立即启动独立 turn,你不阻塞;子 agent 跑完后 idle 而非销毁。新 agent 用 **canonical 任务名路径**引用,如 \`/root/api_review\`。含 root 最多 4 个活跃 agent。
+- **\`collaboration.followup_task\`** —— 必填 \`target\`(canonical 路径,不是 UUID)、\`message\`。异步投递并把 idle 的目标唤醒进新 turn,可重复。
+- **\`collaboration.send_message\`** —— 必填 \`target\`、\`message\`。只入队,**不**启动 turn;要触发工作用 followup_task。
+- **\`collaboration.list_agents\`** —— 可选 \`path_prefix\`。只读,列出 live agents。
+- **\`collaboration.wait_agent\`** —— 可选 \`timeout_ms\`(10000–3600000,默认 30000)。阻塞你直到任一子 agent 有更新、有新输入或超时。
+- **没有任何返回值有保证的 schema**:不要去解析返回值里的 \`agent_id\`/\`id\`/\`accepted\` 之类字段;用 \`list_agents\` 和 \`wait_agent\` 获取状态。
+- **不要调用 \`collaboration.interrupt_agent\`**:它会把你自己这轮 turn 一起中断(2026-08-10 线上事故),中断后本轮结果全部丢失且不会重跑。让子 agent 自然跑完或直接忽略其结果。`;
+}

package/dist/runner.js

@@ -58,6 +58,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             ...(input.wakeOrigin ? { wakeOrigin: input.wakeOrigin } : {}),
             memory: capMemoryForInject(workspace.memory),
             ...(resuming ? {} : { workLog: capWorkLogForInject(workspace.workLog) }),
+            collaborationToolsEnabled: config.codexCollaborationTools && runtime === "codex",
         }),
         wakePrompt: ({ resuming, rotatedForBudget, nearBudget }) => {
             const distillHint = nearBudget
@@ -74,6 +75,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             name: runtime,
             ...(providerConfig.model ? { model: providerConfig.model } : {}),
             ...(reasoning.success ? { reasoning: reasoning.data } : {}),
+            codexCollaborationTools: config.codexCollaborationTools,
         },
         effectivePermission: config.dangerous ? "full_access" : "workspace_write",
         captureFinal: true,
@@ -105,6 +107,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             softTokens: config.sessionSoftTokens,
             maxTurns: config.sessionMaxTurns,
         },
+        localMemoryV2Enabled: config.localMemoryV2Handles?.has(input.handle) === true,
     }, {
         onActivity,
         onConsole,

package/dist/runtimes/codex-app-server-runner.js

@@ -6,7 +6,8 @@ import { pathToFileURL } from "node:url";
 import spawn from "cross-spawn";
 import { z } from "zod";
 import { signalSupervisorTree } from "../execution-supervisor.js";
-import { assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
+import { assertCodexCollaborationVersion, assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
+import { decideTurnRetry, itemMakesTurnUnsafe } from "./codex-turn-retry.js";
 import { startFirstProgressWatchdog } from "./progress-watchdog.js";
 const RunnerInputSchema = z.object({
     systemPrompt: z.string().min(1),
@@ -20,6 +21,7 @@ const RunnerInputSchema = z.object({
     cwd: z.string().min(1).optional(),
     workspaceRoots: z.array(z.string().min(1)).optional(),
     skillRoots: z.array(z.string().min(1)).optional(),
+    codexCollaborationTools: z.boolean().optional(),
     resume: z.boolean(),
 }).strict();
 const RPC_TIMEOUT_MS = 30_000;
@@ -37,12 +39,17 @@ const MAX_TRANSIENT_TURN_RETRIES = 2;
 const TRANSIENT_TURN_RETRY_DELAY_MS = 15_000;
 const TRANSIENT_TURN_RETRY_BACKOFF_FACTOR = 3;
 const PROCESS_TREE_STOP_TIMEOUT_MS = 1_000;
+/** 进程级:一旦某个 collabAgentToolCall 的 item/completed 没有对应 item/started,本执行后续永不重试(spec R4-3)。 */
+let collabStartedMissing = false;
 const USER_INPUT_UNAVAILABLE_MESSAGE = "NowWork cannot collect interactive user input in this headless run; ask the user in the final response instead of assuming an answer.";
-export function codexAppServerArgs(projectRootMarkers) {
+export function codexAppServerArgs(input) {
     return [
-        ...(projectRootMarkers === undefined
+        ...(input.projectRootMarkers === undefined
             ? []
-            : ["-c", `project_root_markers=${JSON.stringify(projectRootMarkers)}`]),
+            : ["-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`]),
+        // multi_agent 按开关;multi_agent_v2 无条件关,钉死已验证的 v1 契约(spec 2b)。
+        "-c", `features.multi_agent=${input.collaborationTools === true}`,
+        "-c", "features.multi_agent_v2=false",
         "app-server", "--listen", "stdio://",
     ];
 }
@@ -53,7 +60,8 @@ const TRANSIENT_TURN_ERROR_PATTERNS = [
     /too many requests/i,
 ];
 /** 模型侧瞬态失败(网关过载/限流)→ 换个时间整轮重试大概率成功。
- *  interrupted 不算:那是取消信号或 codex collab 连带中断,重跑语义不明确。 */
+ *  interrupted 单独归为 collab_interrupted:2026-08-10 实锤是模型自己调 collaboration.interrupt_agent
+ *  连带把父 turn 置为 interrupted。两类原因都只在本 turn 无白名单外工具活动时重试(codex-turn-retry.ts)。 */
 export function isTransientTurnFailure(detail) {
     return TRANSIENT_TURN_ERROR_PATTERNS.some((pattern) => pattern.test(detail));
 }
@@ -413,7 +421,10 @@ async function stopChildTree(child) {
 }
 async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs) {
     const attemptStartedAt = Date.now();
-    const child = spawn(bin, codexAppServerArgs(input.projectRootMarkers), {
+    const child = spawn(bin, codexAppServerArgs({
+        ...(input.projectRootMarkers === undefined ? {} : { projectRootMarkers: input.projectRootMarkers }),
+        ...(input.codexCollaborationTools === undefined ? {} : { collaborationTools: input.codexCollaborationTools }),
+    }), {
         cwd: process.cwd(),
         env: process.env,
         stdio: ["pipe", "pipe", "pipe"],
@@ -434,6 +445,8 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
     let threadId = null;
     let announcedThreadId = null;
     let turnId = null;
+    let turnHasUnsafeSideEffect = false;
+    const startedItemIds = new Set();
     let lastUsage;
     let completionResolve;
     let completionReject;
@@ -452,6 +465,20 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             || method === "item/agentMessage/delta" || method === "item/completed") {
             firstProgress.observe();
         }
+        if (method === "item/started" || method === "item/completed") {
+            const item = params !== null && typeof params === "object"
+                ? params.item
+                : undefined;
+            if (method === "item/started" && typeof item?.id === "string")
+                startedItemIds.add(item.id);
+            if (method === "item/completed" && item?.type === "collabAgentToolCall"
+                && (typeof item.id !== "string" || !startedItemIds.has(item.id)) && !collabStartedMissing) {
+                collabStartedMissing = true;
+                process.stderr.write("[codex-app-server] collab_item_started_missing\n");
+            }
+            if (itemMakesTurnUnsafe(item))
+                turnHasUnsafeSideEffect = true;
+        }
         for (const event of mapCodexNotification(method, params)) {
             const eventThreadId = typeof event.thread_id === "string" ? event.thread_id : null;
             if (event.type === "thread.started" && eventThreadId === announcedThreadId)
@@ -496,6 +523,8 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
         if (input.workspaceRoots !== undefined || input.skillRoots !== undefined) {
             assertCodexNativeWorkspaceVersion(initialized);
         }
+        if (input.codexCollaborationTools === true)
+            assertCodexCollaborationVersion(initialized);
         logStage(activeStage, "ok", attempt, stageStartedAt);
         rpc.notify("initialized");
         activeStage = input.resume ? "thread_resume" : "thread_start";
@@ -580,15 +609,19 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             }),
         });
         if (completed.turn?.status === "completed")
-            return { code: 0, initializeTimedOut: false };
+            return { code: 0, initializeTimedOut: false, unsafeToRetry: false };
         const detail = completed.turn?.error?.message ?? `turn status ${completed.turn?.status ?? "unknown"}`;
         process.stderr.write(sanitizeCodexDiagnostic(`Codex turn failed: ${detail.slice(0, ERROR_MESSAGE_CAP)}\n`, secrets));
+        const status = completed.turn?.status;
+        const retryReason = cancelling ? undefined
+            : status === "interrupted" ? "collab_interrupted"
+                : status === "failed" && isTransientTurnFailure(detail) ? "transient_turn_failure"
+                    : undefined;
         return {
-            code: completed.turn?.status === "interrupted" ? 130 : 1,
+            code: status === "interrupted" ? 130 : 1,
             initializeTimedOut: false,
-            transientTurnFailure: !cancelling
-                && completed.turn?.status === "failed"
-                && isTransientTurnFailure(detail),
+            ...(retryReason === undefined ? {} : { retryReason }),
+            unsafeToRetry: turnHasUnsafeSideEffect || collabStartedMissing,
         };
     }
     catch (error) {
@@ -601,7 +634,7 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             logStage(activeStage, "error", attempt, stageStartedAt);
         }
         process.stderr.write(`Codex app-server execution failed: ${safeErrorMessage(error, secrets)}\n`);
-        return { code: 1, initializeTimedOut };
+        return { code: 1, initializeTimedOut, unsafeToRetry: false };
     }
     finally {
         firstProgress.stop();
@@ -633,13 +666,20 @@ export async function runCodexAppServer(bin, options = {}) {
             process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=initialize_timeout\n`);
             continue;
         }
-        if (result.transientTurnFailure && turnRetries < MAX_TRANSIENT_TURN_RETRIES) {
+        const decision = decideTurnRetry(result, turnRetries, MAX_TRANSIENT_TURN_RETRIES);
+        if (decision.kind === "retry") {
             const delayMs = turnRetryDelayMs * TRANSIENT_TURN_RETRY_BACKOFF_FACTOR ** turnRetries;
             turnRetries += 1;
-            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=transient_turn_failure\n`);
+            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=${decision.reason}\n`);
             await new Promise((resolve) => setTimeout(resolve, delayMs));
             continue;
         }
+        if (decision.kind === "skipped") {
+            process.stderr.write(`[codex-app-server] stage=retry status=skipped attempt=${attempt} reason=${decision.reason}_unsafe\n`);
+        }
+        else if (decision.kind === "exhausted") {
+            process.stderr.write(`[codex-app-server] stage=retry status=exhausted attempt=${attempt} reason=${decision.reason}\n`);
+        }
         return result.code;
     }
 }

package/dist/runtimes/codex-command-safety.js

@@ -0,0 +1,75 @@
+/**
+ * Codex app-server 重试门控用的「只读 crew 命令」判定(spec Part 1,R3-1/R4-1)。
+ *
+ * 白名单 + 封闭文法,不是黑名单:任何解析不确定都返回 false。只回答"这是不是白名单里某条
+ * crew 只读命令的一次干净调用",不做"读/写"语义判断。任何非 crew 命令(sed/rg/git/python…)
+ * 一律 false——白名单之外的一切都视为不可安全重试。零 IO,可独立单测。
+ */
+/** 封闭列表,由 cli/src/run.ts 命令面反推;新增 CLI 只读命令时同步维护。漏加只会更保守。 */
+export const READ_ONLY_CREW_COMMANDS = new Set([
+    "whoami",
+    "server info",
+    "message read",
+    "message check",
+    "thread read",
+    "task list",
+    "schedule list",
+    "schedule runs",
+    "reminder list",
+    "reminder log",
+    "resolve",
+    "channel members",
+    "integration env",
+    "integration list",
+]);
+const SINGLE_VERB = new Set(["whoami", "resolve"]);
+// 一层 shell 包装:bash/sh/zsh -c / -lc / -cl,后跟被单引号或双引号整体包裹的正文。
+const WRAPPER = /^(?:\/usr\/bin\/|\/bin\/)?(?:bash|sh|zsh)\s+-(?:l?c|cl)\s+(.+)$/su;
+// 整串禁字符:出现任一即拒绝(含单个 &、引号、$、括号、换行、制表、反斜杠)。
+const FORBIDDEN = /[&;|<>$`(){}\\'"\n\r\t]/u;
+const OPTION_TOKEN = /^--?[A-Za-z][A-Za-z0-9-]*(?:=[A-Za-z0-9._:/@#%+-]+)?$/u;
+const VALUE_TOKEN = /^[A-Za-z0-9._:/@#%+][A-Za-z0-9._:/@#%+-]+$/u;
+function unwrap(command) {
+    const match = WRAPPER.exec(command);
+    if (match === null)
+        return command;
+    const quoted = match[1] ?? "";
+    const quote = quoted[0];
+    if (quote !== "'" && quote !== "\"")
+        return null;
+    if (quoted.length < 2 || quoted[quoted.length - 1] !== quote)
+        return null;
+    const body = quoted.slice(1, -1);
+    if (body.includes(quote))
+        return null;
+    if (quote === "\"" && /[$\\]/u.test(body))
+        return null;
+    return body;
+}
+export function isReadOnlyCrewCommand(command) {
+    const body = unwrap(command);
+    if (body === null)
+        return false;
+    if (FORBIDDEN.test(body))
+        return false;
+    const trimmed = body.trim();
+    if (trimmed === "" || /\s{2,}/u.test(trimmed))
+        return false;
+    const tokens = trimmed.split(" ");
+    if (tokens[0] !== "crew")
+        return false;
+    const verb = tokens[1];
+    if (verb === undefined)
+        return false;
+    let consumed;
+    if (SINGLE_VERB.has(verb)) {
+        consumed = 2;
+    }
+    else {
+        const pair = `${verb} ${tokens[2] ?? ""}`;
+        if (!READ_ONLY_CREW_COMMANDS.has(pair))
+            return false;
+        consumed = 3;
+    }
+    return tokens.slice(consumed).every((token) => OPTION_TOKEN.test(token) || VALUE_TOKEN.test(token));
+}

package/dist/runtimes/codex-contract.js

@@ -1,6 +1,7 @@
-import { CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
+import { CODEX_COLLABORATION_MIN_VERSION, CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
 import { z } from "zod";
 export const CODEX_PROJECT_WORKSPACE_UNSUPPORTED = "codex_project_workspace_unsupported";
+export const CODEX_COLLABORATION_UNSUPPORTED = "codex_collaboration_unsupported";
 export const CODEX_PLAN_ENTRY_LIMIT = 16;
 // 16 steps remain inside the server's 4,000 UTF-16-unit plan payload cap even
 // when every retained code point is a surrogate pair (for example, emoji).
@@ -51,18 +52,32 @@ const versionTuple = (version) => {
 const versionAtLeast = (actual, minimum) => actual[0] > minimum[0]
     || (actual[0] === minimum[0] && (actual[1] > minimum[1]
         || (actual[1] === minimum[1] && actual[2] >= minimum[2])));
-/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
-export function assertCodexNativeWorkspaceVersion(response) {
+function initializeVersion(response) {
     const parsed = NativeInitializeResponseSchema.safeParse(response);
     if (!parsed.success)
-        throw codexProjectWorkspaceUnsupported();
+        return null;
     const match = /(?:^|[/\s])(\d+\.\d+\.\d+)(?=$|[\s(])/u.exec(parsed.data.userAgent);
-    const actual = match === null ? null : versionTuple(match[1] ?? "");
+    return match === null ? null : versionTuple(match[1] ?? "");
+}
+/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
+export function assertCodexNativeWorkspaceVersion(response) {
+    const actual = initializeVersion(response);
     const minimum = versionTuple(CODEX_NATIVE_WORKSPACE_MIN_VERSION);
     if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
         throw codexProjectWorkspaceUnsupported();
     }
 }
+/** Collaboration tools are exposed only on an app-server whose contract was verified (spec 2b). */
+export function assertCodexCollaborationVersion(response) {
+    const actual = initializeVersion(response);
+    const minimum = versionTuple(CODEX_COLLABORATION_MIN_VERSION);
+    if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
+        throw codexCollaborationUnsupported();
+    }
+}
+export function codexCollaborationUnsupported() {
+    return new Error(CODEX_COLLABORATION_UNSUPPORTED);
+}
 const PLAN_STATUSES = new Set(["pending", "inProgress", "completed"]);
 const clipCharacters = (value, limit) => [...value.trim().replace(/\s+/gu, " ")].slice(0, limit).join("");
 /** Treat plan updates as bounded user-visible data; any malformed retained step rejects the event. */

package/dist/runtimes/codex-turn-retry.js

@@ -0,0 +1,69 @@
+/**
+ * Codex app-server turn 级重试决策(spec Part 1)。
+ *
+ * attempt 只上报两个正交事实:retryReason(为什么值得重试)与 unsafeToRetry(本 turn 是否已有
+ * 白名单之外的工具活动)。外层循环通过 decideTurnRetry 单一出口判断,所有原因共用一个预算。
+ * 2026-08-10 事故根因:模型自己调 collaboration.interrupt_agent,Codex 把父 turn 也置为
+ * interrupted;旧代码直接 exit 130。同时旧的网关过载重试是无条件的,会重放 crew message send。
+ */
+import { isReadOnlyCrewCommand } from "./codex-command-safety.js";
+/**
+ * Codex app-server v2 `codex app-server generate-json-schema` ThreadItem 枚举的全部 18 种类型,
+ * 逐一裁定安全性(2026-08-28 最终评审 F1:实测真实 app-server 0.150.1 发现 userMessage 缺失导致
+ * 所有 turn 被判不安全,回归影响过载重试与 interrupted 重试两条路径)。新增协议类型时,必须在此
+ * 表格里显式落座,不允许静默归类。
+ *
+ * safe(协议/叙述类,无副作用,共 9 种):
+ *   - userMessage        Codex 对我们自己发送的 prompt 的回显,每个 turn 必有
+ *   - hookPrompt          hook 触发的系统提示回显
+ *   - agentMessage        模型最终回复文本
+ *   - reasoning           模型推理过程(不透出给下游)
+ *   - plan                模型计划更新
+ *   - contextCompaction   上下文压缩通知
+ *   - sleep               模型主动等待
+ *   - enteredReviewMode   进入 review 模式通知
+ *   - exitedReviewMode    退出 review 模式通知
+ * conditional(1 种,视具体内容而定):
+ *   - commandExecution    仅当 isReadOnlyCrewCommand(command) 为 true 时安全
+ * unsafe(有副作用或无法判断,共 8 种 + 未知类型):
+ *   - fileChange          写文件
+ *   - mcpToolCall          调用外部 MCP 工具
+ *   - dynamicToolCall      调用动态工具
+ *   - collabAgentToolCall  协作工具(spawnAgent/interrupt_agent 等)
+ *   - subAgentActivity     子 agent 活动
+ *   - webSearch            联网搜索
+ *   - imageView            查看图片
+ *   - imageGeneration      生成图片
+ *   - (任何未知/缺失 type)  一律视为不安全
+ */
+const NARRATIVE_ITEM_TYPES = new Set([
+    "userMessage",
+    "hookPrompt",
+    "agentMessage",
+    "reasoning",
+    "plan",
+    "contextCompaction",
+    "sleep",
+    "enteredReviewMode",
+    "exitedReviewMode",
+]);
+/** 白名单判定:只有叙述类 item 和白名单内的 crew 只读命令是安全的;其它一切(含未知类型)不安全。 */
+export function itemMakesTurnUnsafe(item) {
+    if (item?.type === undefined)
+        return true;
+    if (NARRATIVE_ITEM_TYPES.has(item.type))
+        return false;
+    if (item.type === "commandExecution") {
+        return typeof item.command !== "string" || !isReadOnlyCrewCommand(item.command);
+    }
+    return true;
+}
+export function decideTurnRetry(result, turnRetries, maxRetries) {
+    if (result.retryReason === undefined)
+        return { kind: "return" };
+    if (result.unsafeToRetry)
+        return { kind: "skipped", reason: result.retryReason };
+    if (turnRetries < maxRetries)
+        return { kind: "retry", reason: result.retryReason };
+    return { kind: "exhausted", reason: result.retryReason };
+}

package/dist/runtimes/codex.js

@@ -5,6 +5,8 @@
 import spawn from "cross-spawn";
 /** Minimum CLI whose real app-server contract supports NowCrew native project workspaces. */
 export const CODEX_NATIVE_WORKSPACE_MIN_VERSION = "0.148.0";
+/** Minimum CLI whose `multi_agent` collaboration tool contract was empirically verified (2026-08-28). */
+export const CODEX_COLLABORATION_MIN_VERSION = "0.149.1";
 // Codex CLI 原生 model_reasoning_effort 档位(codex 0.135.0 实测:非法值时 config 解析报错枚举这六档)。
 // 注意:codex 对非法值是硬失败(进程直接退出),所以必须白名单过滤;白名单外(含 "default"、
 // claude 专属的 "max")回落 CODEX_DEFAULT_EFFORT。
@@ -22,6 +24,8 @@ export function buildCodexArgs(input) {
         ? input.reasoning
         : CODEX_DEFAULT_EFFORT;
     args.push("-c", `model_reasoning_effort=${effort}`);
+    // 纵深防御:exec 启动器没有 initialize 握手、无法断言版本,协作工具恒关(spec 2b)。
+    args.push("-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false");
     if (input.projectRootMarkers) {
         args.push("-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`);
     }