@nowcrew/daemon 0.6.67 → 0.6.68

package/dist/provider-env.js

@@ -11,6 +11,24 @@
 import { join } from "node:path";
 import { DEEPSEEK_CODEX_KEY_ENV, deepSeekCodexHome, } from "./runtimes/codex-deepseek-config.js";
 import { DEEPSEEK_HARNESS_CONFIG_ENV } from "./runtimes/deepseek-harness.js";
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const RESERVED_ENV = new Set([
+    "PATH",
+    "XDG_CONFIG_HOME",
+    "XDG_DATA_HOME",
+    "XDG_CACHE_HOME",
+    "GH_CONFIG_DIR",
+    "CLOUDSDK_CONFIG",
+]);
+/** Keep user-provided variables away from daemon-owned runtime and credential fields. */
+export function sanitizeEnvVars(raw) {
+    if (!raw)
+        return {};
+    return Object.fromEntries(Object.entries(raw).filter(([key, value]) => typeof value === "string"
+        && ENV_KEY_RE.test(key)
+        && !key.toUpperCase().startsWith("CREW_")
+        && !RESERVED_ENV.has(key.toUpperCase())));
+}
 /** custom 模式下必须从继承 env 中剔除的全局路由/凭证变量(避免与注入值叠加或抢优先级)。 */
 const CONFLICTING_ENV = [
     "ANTHROPIC_BASE_URL",
@@ -39,12 +57,12 @@ const CONFLICTING_CODEX_ENV = [
     DEEPSEEK_CODEX_KEY_ENV,
 ];
 /** 返回叠加了 provider 隔离的新 env(不改入参);不支持的 runtime/provider 组合原样返回。 */
-export function applyProviderEnv(base, runtime, cfg, homeDir) {
+export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverride) {
     if (runtime === "codex" && cfg.provider === "deepseek") {
         const env = { ...base };
         for (const key of CONFLICTING_CODEX_ENV)
             delete env[key];
-        env.CODEX_HOME = deepSeekCodexHome(homeDir);
+        env.CODEX_HOME = deepSeekHomeOverride ?? deepSeekCodexHome(homeDir);
         if (cfg.providerApiKey)
             env[DEEPSEEK_CODEX_KEY_ENV] = cfg.providerApiKey;
         return env;
@@ -100,7 +118,7 @@ export function applyDeepSeekHarnessMachineEnv(base, machineEnv) {
  */
 export function providerFingerprint(runtime, cfg) {
     if (runtime === "codex" && cfg.provider === "deepseek") {
-        return `deepseek|${cfg.providerApiKey ? "key" : "nokey"}`;
+        return `deepseek|${cfg.providerBaseUrl ?? "default"}|${cfg.providerApiKey ? "key" : "nokey"}`;
     }
     if (runtime !== "claude" || cfg.provider !== "custom")
         return null;

package/dist/runner.js

@@ -10,7 +10,8 @@ import { readOriginDecisionFile, resetOriginDecisionFile } from "./origin-decisi
 import { readBoundImDecisionFile, resetBoundImDecisionFile } from "./bound-im-decision.js";
 import { launchSupervisedRuntime } from "./supervised-runtime.js";
 import { awaitWithCancellation, } from "./runtime-cancellation.js";
-export { awaitExit, exitActivity, sanitizeEnvVars } from "./local-executor.js";
+export { awaitExit, exitActivity } from "./local-executor.js";
+export { sanitizeEnvVars } from "./provider-env.js";
 const ICON = {
     init: "🟢", text: "💬", reading: "📖", sending: "📨", checking: "🔎",
     claiming: "📌", crew: "⚙️", tool: "🛠️", tool_result: "↩️", done: "✅", error: "❌",
@@ -58,7 +59,6 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             ...(input.wakeOrigin ? { wakeOrigin: input.wakeOrigin } : {}),
             memory: capMemoryForInject(workspace.memory),
             ...(resuming ? {} : { workLog: capWorkLogForInject(workspace.workLog) }),
-            collaborationToolsEnabled: config.codexCollaborationTools && runtime === "codex",
         }),
         wakePrompt: ({ resuming, rotatedForBudget, nearBudget }) => {
             const distillHint = nearBudget
@@ -75,7 +75,6 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             name: runtime,
             ...(providerConfig.model ? { model: providerConfig.model } : {}),
             ...(reasoning.success ? { reasoning: reasoning.data } : {}),
-            codexCollaborationTools: config.codexCollaborationTools,
         },
         effectivePermission: config.dangerous ? "full_access" : "workspace_write",
         captureFinal: true,
@@ -107,7 +106,6 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             softTokens: config.sessionSoftTokens,
             maxTurns: config.sessionMaxTurns,
         },
-        localMemoryV2Enabled: config.localMemoryV2Handles?.has(input.handle) === true,
     }, {
         onActivity,
         onConsole,

package/dist/runtimes/codex-app-server-runner.js

@@ -6,8 +6,7 @@ import { pathToFileURL } from "node:url";
 import spawn from "cross-spawn";
 import { z } from "zod";
 import { signalSupervisorTree } from "../execution-supervisor.js";
-import { assertCodexCollaborationVersion, assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
-import { decideTurnRetry, itemMakesTurnUnsafe } from "./codex-turn-retry.js";
+import { assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
 import { startFirstProgressWatchdog } from "./progress-watchdog.js";
 const RunnerInputSchema = z.object({
     systemPrompt: z.string().min(1),
@@ -21,9 +20,13 @@ const RunnerInputSchema = z.object({
     cwd: z.string().min(1).optional(),
     workspaceRoots: z.array(z.string().min(1)).optional(),
     skillRoots: z.array(z.string().min(1)).optional(),
-    codexCollaborationTools: z.boolean().optional(),
+    networkAccess: z.boolean().optional(),
     resume: z.boolean(),
-}).strict();
+}).strict().superRefine((input, ctx) => {
+    if (input.networkAccess === true && input.effectivePermission !== "workspace_write") {
+        ctx.addIssue({ code: "custom", message: "network_access_requires_workspace_write" });
+    }
+});
 const RPC_TIMEOUT_MS = 30_000;
 const INITIALIZE_RPC_TIMEOUT_MS = 60_000;
 const ERROR_MESSAGE_CAP = 2_000;
@@ -39,17 +42,12 @@ const MAX_TRANSIENT_TURN_RETRIES = 2;
 const TRANSIENT_TURN_RETRY_DELAY_MS = 15_000;
 const TRANSIENT_TURN_RETRY_BACKOFF_FACTOR = 3;
 const PROCESS_TREE_STOP_TIMEOUT_MS = 1_000;
-/** 进程级:一旦某个 collabAgentToolCall 的 item/completed 没有对应 item/started,本执行后续永不重试(spec R4-3)。 */
-let collabStartedMissing = false;
 const USER_INPUT_UNAVAILABLE_MESSAGE = "NowWork cannot collect interactive user input in this headless run; ask the user in the final response instead of assuming an answer.";
-export function codexAppServerArgs(input) {
+export function codexAppServerArgs(projectRootMarkers) {
     return [
-        ...(input.projectRootMarkers === undefined
+        ...(projectRootMarkers === undefined
             ? []
-            : ["-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`]),
-        // multi_agent 按开关;multi_agent_v2 无条件关,钉死已验证的 v1 契约(spec 2b)。
-        "-c", `features.multi_agent=${input.collaborationTools === true}`,
-        "-c", "features.multi_agent_v2=false",
+            : ["-c", `project_root_markers=${JSON.stringify(projectRootMarkers)}`]),
         "app-server", "--listen", "stdio://",
     ];
 }
@@ -60,8 +58,7 @@ const TRANSIENT_TURN_ERROR_PATTERNS = [
     /too many requests/i,
 ];
 /** 模型侧瞬态失败(网关过载/限流)→ 换个时间整轮重试大概率成功。
- *  interrupted 单独归为 collab_interrupted:2026-08-10 实锤是模型自己调 collaboration.interrupt_agent
- *  连带把父 turn 置为 interrupted。两类原因都只在本 turn 无白名单外工具活动时重试(codex-turn-retry.ts)。 */
+ *  interrupted 不算:那是取消信号或 codex collab 连带中断,重跑语义不明确。 */
 export function isTransientTurnFailure(detail) {
     return TRANSIENT_TURN_ERROR_PATTERNS.some((pattern) => pattern.test(detail));
 }
@@ -421,10 +418,7 @@ async function stopChildTree(child) {
 }
 async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs) {
     const attemptStartedAt = Date.now();
-    const child = spawn(bin, codexAppServerArgs({
-        ...(input.projectRootMarkers === undefined ? {} : { projectRootMarkers: input.projectRootMarkers }),
-        ...(input.codexCollaborationTools === undefined ? {} : { collaborationTools: input.codexCollaborationTools }),
-    }), {
+    const child = spawn(bin, codexAppServerArgs(input.projectRootMarkers), {
         cwd: process.cwd(),
         env: process.env,
         stdio: ["pipe", "pipe", "pipe"],
@@ -445,8 +439,6 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
     let threadId = null;
     let announcedThreadId = null;
     let turnId = null;
-    let turnHasUnsafeSideEffect = false;
-    const startedItemIds = new Set();
     let lastUsage;
     let completionResolve;
     let completionReject;
@@ -465,20 +457,6 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             || method === "item/agentMessage/delta" || method === "item/completed") {
             firstProgress.observe();
         }
-        if (method === "item/started" || method === "item/completed") {
-            const item = params !== null && typeof params === "object"
-                ? params.item
-                : undefined;
-            if (method === "item/started" && typeof item?.id === "string")
-                startedItemIds.add(item.id);
-            if (method === "item/completed" && item?.type === "collabAgentToolCall"
-                && (typeof item.id !== "string" || !startedItemIds.has(item.id)) && !collabStartedMissing) {
-                collabStartedMissing = true;
-                process.stderr.write("[codex-app-server] collab_item_started_missing\n");
-            }
-            if (itemMakesTurnUnsafe(item))
-                turnHasUnsafeSideEffect = true;
-        }
         for (const event of mapCodexNotification(method, params)) {
             const eventThreadId = typeof event.thread_id === "string" ? event.thread_id : null;
             if (event.type === "thread.started" && eventThreadId === announcedThreadId)
@@ -523,8 +501,6 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
         if (input.workspaceRoots !== undefined || input.skillRoots !== undefined) {
             assertCodexNativeWorkspaceVersion(initialized);
         }
-        if (input.codexCollaborationTools === true)
-            assertCodexCollaborationVersion(initialized);
         logStage(activeStage, "ok", attempt, stageStartedAt);
         rpc.notify("initialized");
         activeStage = input.resume ? "thread_resume" : "thread_start";
@@ -589,6 +565,9 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             ...(input.reasoning === undefined || input.reasoning === "default"
                 ? {}
                 : { effort: input.reasoning }),
+            ...(input.networkAccess === true ? {
+                sandboxPolicy: { type: "workspaceWrite", networkAccess: true },
+            } : {}),
         });
         logStage(activeStage, "ok", attempt, stageStartedAt);
         turnId = started.turn.id;
@@ -609,19 +588,15 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             }),
         });
         if (completed.turn?.status === "completed")
-            return { code: 0, initializeTimedOut: false, unsafeToRetry: false };
+            return { code: 0, initializeTimedOut: false };
         const detail = completed.turn?.error?.message ?? `turn status ${completed.turn?.status ?? "unknown"}`;
         process.stderr.write(sanitizeCodexDiagnostic(`Codex turn failed: ${detail.slice(0, ERROR_MESSAGE_CAP)}\n`, secrets));
-        const status = completed.turn?.status;
-        const retryReason = cancelling ? undefined
-            : status === "interrupted" ? "collab_interrupted"
-                : status === "failed" && isTransientTurnFailure(detail) ? "transient_turn_failure"
-                    : undefined;
         return {
-            code: status === "interrupted" ? 130 : 1,
+            code: completed.turn?.status === "interrupted" ? 130 : 1,
             initializeTimedOut: false,
-            ...(retryReason === undefined ? {} : { retryReason }),
-            unsafeToRetry: turnHasUnsafeSideEffect || collabStartedMissing,
+            transientTurnFailure: !cancelling
+                && completed.turn?.status === "failed"
+                && isTransientTurnFailure(detail),
         };
     }
     catch (error) {
@@ -634,7 +609,7 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             logStage(activeStage, "error", attempt, stageStartedAt);
         }
         process.stderr.write(`Codex app-server execution failed: ${safeErrorMessage(error, secrets)}\n`);
-        return { code: 1, initializeTimedOut, unsafeToRetry: false };
+        return { code: 1, initializeTimedOut };
     }
     finally {
         firstProgress.stop();
@@ -666,20 +641,13 @@ export async function runCodexAppServer(bin, options = {}) {
             process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=initialize_timeout\n`);
             continue;
         }
-        const decision = decideTurnRetry(result, turnRetries, MAX_TRANSIENT_TURN_RETRIES);
-        if (decision.kind === "retry") {
+        if (result.transientTurnFailure && turnRetries < MAX_TRANSIENT_TURN_RETRIES) {
             const delayMs = turnRetryDelayMs * TRANSIENT_TURN_RETRY_BACKOFF_FACTOR ** turnRetries;
             turnRetries += 1;
-            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=${decision.reason}\n`);
+            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=transient_turn_failure\n`);
             await new Promise((resolve) => setTimeout(resolve, delayMs));
             continue;
         }
-        if (decision.kind === "skipped") {
-            process.stderr.write(`[codex-app-server] stage=retry status=skipped attempt=${attempt} reason=${decision.reason}_unsafe\n`);
-        }
-        else if (decision.kind === "exhausted") {
-            process.stderr.write(`[codex-app-server] stage=retry status=exhausted attempt=${attempt} reason=${decision.reason}\n`);
-        }
         return result.code;
     }
 }

package/dist/runtimes/codex-contract.js

@@ -1,7 +1,6 @@
-import { CODEX_COLLABORATION_MIN_VERSION, CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
+import { CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
 import { z } from "zod";
 export const CODEX_PROJECT_WORKSPACE_UNSUPPORTED = "codex_project_workspace_unsupported";
-export const CODEX_COLLABORATION_UNSUPPORTED = "codex_collaboration_unsupported";
 export const CODEX_PLAN_ENTRY_LIMIT = 16;
 // 16 steps remain inside the server's 4,000 UTF-16-unit plan payload cap even
 // when every retained code point is a surrogate pair (for example, emoji).
@@ -52,32 +51,18 @@ const versionTuple = (version) => {
 const versionAtLeast = (actual, minimum) => actual[0] > minimum[0]
     || (actual[0] === minimum[0] && (actual[1] > minimum[1]
         || (actual[1] === minimum[1] && actual[2] >= minimum[2])));
-function initializeVersion(response) {
+/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
+export function assertCodexNativeWorkspaceVersion(response) {
     const parsed = NativeInitializeResponseSchema.safeParse(response);
     if (!parsed.success)
-        return null;
+        throw codexProjectWorkspaceUnsupported();
     const match = /(?:^|[/\s])(\d+\.\d+\.\d+)(?=$|[\s(])/u.exec(parsed.data.userAgent);
-    return match === null ? null : versionTuple(match[1] ?? "");
-}
-/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
-export function assertCodexNativeWorkspaceVersion(response) {
-    const actual = initializeVersion(response);
+    const actual = match === null ? null : versionTuple(match[1] ?? "");
     const minimum = versionTuple(CODEX_NATIVE_WORKSPACE_MIN_VERSION);
     if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
         throw codexProjectWorkspaceUnsupported();
     }
 }
-/** Collaboration tools are exposed only on an app-server whose contract was verified (spec 2b). */
-export function assertCodexCollaborationVersion(response) {
-    const actual = initializeVersion(response);
-    const minimum = versionTuple(CODEX_COLLABORATION_MIN_VERSION);
-    if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
-        throw codexCollaborationUnsupported();
-    }
-}
-export function codexCollaborationUnsupported() {
-    return new Error(CODEX_COLLABORATION_UNSUPPORTED);
-}
 const PLAN_STATUSES = new Set(["pending", "inProgress", "completed"]);
 const clipCharacters = (value, limit) => [...value.trim().replace(/\s+/gu, " ")].slice(0, limit).join("");
 /** Treat plan updates as bounded user-visible data; any malformed retained step rejects the event. */

package/dist/runtimes/codex-deepseek-config.js

@@ -7,10 +7,20 @@ export const DEEPSEEK_CODEX_BASE_URL = "https://api.deepseek.com/";
 export const DEEPSEEK_CODEX_KEY_ENV = "NOWCREW_DEEPSEEK_API_KEY";
 export const DEEPSEEK_CODEX_REASONING_LEVELS = ["low", "high", "max"];
 const PRIVATE_CODEX_HOME = ".codex-deepseek";
-export function deepSeekCodexHome(homeDir) {
-    return resolve(homeDir, PRIVATE_CODEX_HOME);
+const SELF_TRAINING_PRIVATE_CODEX_HOME = ".codex-deepseek-self-training";
+export function deepSeekCodexHome(homeDir, selfTraining = false) {
+    return resolve(homeDir, selfTraining ? SELF_TRAINING_PRIVATE_CODEX_HOME : PRIVATE_CODEX_HOME);
 }
-export function renderDeepSeekConfig(codexHome) {
+function normalizedBaseUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error("DeepSeek provider base URL must use HTTP(S)");
+    }
+    if (!url.pathname.endsWith("/"))
+        url.pathname = `${url.pathname}/`;
+    return url.toString();
+}
+export function renderDeepSeekConfig(codexHome, baseUrl = DEEPSEEK_CODEX_BASE_URL) {
     const catalogPath = join(codexHome, "models.json");
     return [
         `model = ${JSON.stringify(DEEPSEEK_CODEX_MODEL)}`,
@@ -20,7 +30,7 @@ export function renderDeepSeekConfig(codexHome) {
         "",
         "[model_providers.deepseek]",
         'name = "deepseek"',
-        `base_url = ${JSON.stringify(DEEPSEEK_CODEX_BASE_URL)}`,
+        `base_url = ${JSON.stringify(normalizedBaseUrl(baseUrl))}`,
         'wire_api = "responses"',
         `env_key = ${JSON.stringify(DEEPSEEK_CODEX_KEY_ENV)}`,
         "",
@@ -40,11 +50,11 @@ async function writePrivateAtomic(path, content) {
         await rm(temporary, { force: true });
     }
 }
-export async function materializeDeepSeekCodexHome(homeDir) {
-    const codexHome = deepSeekCodexHome(homeDir);
+export async function materializeDeepSeekCodexHome(homeDir, options = {}) {
+    const codexHome = deepSeekCodexHome(homeDir, options.selfTraining === true);
     await mkdir(codexHome, { recursive: true, mode: 0o700 });
     await chmod(codexHome, 0o700);
     await writePrivateAtomic(join(codexHome, "models.json"), DEEPSEEK_CODEX_CATALOG);
-    await writePrivateAtomic(join(codexHome, "config.toml"), renderDeepSeekConfig(codexHome));
+    await writePrivateAtomic(join(codexHome, "config.toml"), renderDeepSeekConfig(codexHome, options.baseUrl));
     return codexHome;
 }

package/dist/runtimes/codex.js

@@ -5,8 +5,6 @@
 import spawn from "cross-spawn";
 /** Minimum CLI whose real app-server contract supports NowCrew native project workspaces. */
 export const CODEX_NATIVE_WORKSPACE_MIN_VERSION = "0.148.0";
-/** Minimum CLI whose `multi_agent` collaboration tool contract was empirically verified (2026-08-28). */
-export const CODEX_COLLABORATION_MIN_VERSION = "0.149.1";
 // Codex CLI 原生 model_reasoning_effort 档位(codex 0.135.0 实测:非法值时 config 解析报错枚举这六档)。
 // 注意:codex 对非法值是硬失败(进程直接退出),所以必须白名单过滤;白名单外(含 "default"、
 // claude 专属的 "max")回落 CODEX_DEFAULT_EFFORT。
@@ -24,8 +22,6 @@ export function buildCodexArgs(input) {
         ? input.reasoning
         : CODEX_DEFAULT_EFFORT;
     args.push("-c", `model_reasoning_effort=${effort}`);
-    // 纵深防御:exec 启动器没有 initialize 握手、无法断言版本,协作工具恒关(spec 2b)。
-    args.push("-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false");
     if (input.projectRootMarkers) {
         args.push("-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`);
     }
@@ -36,6 +32,9 @@ export function buildCodexArgs(input) {
     else if (input.effectivePermission === "full_access" || (input.effectivePermission === undefined && input.dangerous)) {
         args.push("--dangerously-bypass-approvals-and-sandbox");
     }
+    if (input.effectivePermission === "workspace_write" && input.networkAccess === true) {
+        args.push("-c", "sandbox_workspace_write.network_access=true");
+    }
     for (const imagePath of input.imagePaths ?? [])
         args.push("--image", imagePath);
     // `-` instructs codex exec to read the prompt from stdin. Keeping the complete prompt out of argv

package/dist/self-training-workspace.js

@@ -0,0 +1,15 @@
+import { rm } from "node:fs/promises";
+import { isAbsolute, relative, sep } from "node:path";
+/** Delete only a concrete child of this Agent's tasks root; never follow an ambiguous target. */
+export async function cleanupSelfTrainingRunDir(tasksRoot, runDir) {
+    const child = relative(tasksRoot, runDir);
+    if (child === "" || isAbsolute(child) || child === ".." || child.startsWith(`..${sep}`))
+        return;
+    try {
+        await rm(runDir, { recursive: true, force: true });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`[execution] failed to remove self-training run dir ${runDir}: ${detail}\n`);
+    }
+}

package/dist/serve.js

@@ -51,7 +51,6 @@ import { handleRuntimeProbeFrame, probeRuntimeHealth } from "./runtime-health.js
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
-import { attachStorageMigrationRuntime, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
 const ACTIVITY_MAP = {
@@ -123,7 +122,6 @@ export function serve(config, opts = {}) {
             catch { /* reconnect/timeout reconciliation handles a lost status frame */ }
         },
     });
-    let storageMigrationAdmissionClosed = () => false;
     const migrationController = createServeMigrationController({
         config,
         ...(opts.profileName === undefined ? {} : { profileName: opts.profileName }),
@@ -144,7 +142,6 @@ export function serve(config, opts = {}) {
     const agentAbilityRuntime = createAgentAbilityRuntime(config.agentsRoot, {
         ...opts.agentAbility,
         coordinator: projectionCoordinator,
-        isAdmissionClosed: () => storageMigrationAdmissionClosed(),
     });
     let projectSkillsController;
     const projectSkillsReconciler = opts.projectSkills?.reconciler ?? createProjectSkillsReconciler({
@@ -164,7 +161,6 @@ export function serve(config, opts = {}) {
             }
             catch { /* 下一次 ready 或项目操作会重新发送完整快照 */ }
         },
-        isAdmissionClosed: () => storageMigrationAdmissionClosed(),
         reconcile: (handle, bindings) => projectSkillsReconciler.reconcile(handle, bindings),
         ensureSnapshot: (handle, snapshot, options) => projectSkillsReconciler.ensureSnapshot(handle, snapshot, options),
     });
@@ -179,37 +175,13 @@ export function serve(config, opts = {}) {
     });
     const machineHelloPublisher = createProjectSkillMachineHelloPublisher({
         status: projectSkillControllerReadiness.status,
-        effective: (hello, status) => {
-            const effective = withProjectSkillCapabilityStatus(hello, status);
-            const configuredIdentity = opts.storageMigration?.identity;
-            const currentIdentity = typeof configuredIdentity === "function"
-                ? configuredIdentity()
-                : configuredIdentity;
-            return currentIdentity === undefined ? effective : { ...effective, ...currentIdentity };
-        },
+        effective: withProjectSkillCapabilityStatus,
         onSent: (hello) => log(`📤 已上报机器信息: ${hello.hostname} · ${hello.os} · installed=[${hello.runtimes.join(",")}] · executable=[${hello.executionRuntimes.join(",")}] · agents=[${hello.agentHandles.join(",")}]`),
     });
     const initializedProjectSkills = initializedProjectSkillsReconciler(projectSkillControllerReadiness.ensure, projectSkillsReconciler);
-    const configuredCapabilities = opts.machineInfo?.capabilities ?? daemonCapabilities(process.platform);
-    const storageCapabilities = storageMigrationCapabilities(configuredCapabilities, opts.storageMigration);
-    const storageStatusDelivery = createServeStorageStatusDelivery(opts.storageMigration, {
-        onPersistenceError: (error) => dslog("daemon.storage_status_outbox_failed", "存储迁移状态 outbox 持久化失败", { level: "ERROR", error_message: error.message }),
-        transmit: (frame) => { try {
-            if (ws?.readyState === WebSocket.OPEN)
-                ws.send(JSON.stringify(frame));
-        }
-        catch { /* retry */ } },
-    });
-    const storageMigrationRuntime = attachStorageMigrationRuntime(opts.storageMigration, {
-        isBusy: () => executionRuns.size > 0 || legacyRuns.size > 0,
-        waitForExecutionFrames: () => executionFrameQueue,
-        flushLocalState: flushSlog,
-        sendStatus: storageStatusDelivery.send,
-    });
-    storageMigrationAdmissionClosed = storageMigrationRuntime.isAdmissionClosed;
     const prepareProjectSkillCapabilities = createProjectSkillConnectionCapabilityProvider({
         platform: process.platform,
-        baseCapabilities: storageCapabilities,
+        baseCapabilities: opts.machineInfo?.capabilities ?? daemonCapabilities(process.platform),
         additionalCapabilities: () => managedDaemonCapabilities(updateEligibility),
         probeRuntimeRootStorePrimitive: projectSkillRuntimeRootStartup.probeNativePublicationPrimitiveReadiness,
         initializeController: projectSkillControllerReadiness.ensure,
@@ -338,12 +310,6 @@ export function serve(config, opts = {}) {
             // 连上了才有机会把离线期间(断连原因/退出前)落盘的日志补传上去
             void drainSpool();
             // 上报本机信息 (hostname/os/daemon 版本/已装 runtimes)
-            storageStatusDelivery.replayPending();
-            const storageReplay = replayStorageMigrationStatus(opts.storageMigration, openedSocket, () => ws === openedSocket, (error) => {
-                dslog("daemon.storage_status_replay_failed", "存储迁移状态重放失败", {
-                    level: "ERROR", error_message: error.message,
-                });
-            }, storageStatusDelivery.send);
             const { detectInstalled, detectExecutable = detectExecutionRuntimesWithSignal } = opts.machineInfo ?? {};
             const helloPromise = (opts.machineInfo?.collect ?? collectMachineHello)(config.agentsRoot, config.executionLimits, process.platform, {
                 ...(detectInstalled ? { detectInstalled } : {}),
@@ -359,7 +325,6 @@ export function serve(config, opts = {}) {
                 if (hello.executionProtocol === undefined)
                     return [];
                 const detected = await runtimeProbe.detect(hello.runtimes, detectExecutable);
-                await storageReplay;
                 if (ws === openedSocket && openedSocket.readyState === WebSocket.OPEN
                     && detected.some((runtime) => !hello.executionRuntimes.includes(runtime))) {
                     detectedExecutionRuntimes = detected;
@@ -374,8 +339,7 @@ export function serve(config, opts = {}) {
                 return [];
             });
             void helloPromise
-                .then(async (hello) => {
-                await storageReplay;
+                .then((hello) => {
                 if (ws !== openedSocket || openedSocket.readyState !== WebSocket.OPEN)
                     return;
                 detectedExecutionRuntimes = hello.executionRuntimes;
@@ -423,8 +387,6 @@ export function serve(config, opts = {}) {
             if (typeof decoded !== "object" || decoded === null)
                 return;
             const rawType = "type" in decoded && typeof decoded.type === "string" ? decoded.type : "";
-            if (storageStatusDelivery.acknowledge(decoded))
-                return;
             if (rawType === "daemon:update" || rawType === "daemon:restart") {
                 void updateController.handle(decoded).catch((error) => {
                     dslog("daemon.control_failed", "daemon 控制操作处理失败", {
@@ -441,11 +403,6 @@ export function serve(config, opts = {}) {
                 void codexHomeModeController.handle(decoded).catch((error) => dslog("daemon.codex_home_mode_failed", "Codex Home 模式切换失败", { level: "ERROR", error_message: error.message }));
                 return;
             }
-            if (handleStorageMigrationControl(opts.storageMigration, rawType, decoded, storageStatusDelivery.send, (kind, error) => {
-                dslog(kind === "migration" ? "daemon.storage_migration_failed" : "daemon.storage_migration_confirmation_failed", kind === "migration" ? "存储迁移控制操作失败" : "存储迁移 hello 确认处理失败", { level: "ERROR", error_message: error.message });
-            })) {
-                return;
-            }
             if (rawType.startsWith("execution:")) {
                 const parsedExecution = ServerToDaemonExecutionFrameSchema.safeParse(decoded);
                 if (!parsedExecution.success) {
@@ -507,14 +464,6 @@ export function serve(config, opts = {}) {
                         return;
                     }
                     const spec = frame;
-                    if (storageMigrationRuntime.isAdmissionClosed()) {
-                        safeExecutionSend(ExecutionRejectedSchema.parse({
-                            type: "execution:rejected", protocolVersion: 1, executionId: spec.executionId,
-                            reason: "resource_limit", message: "Storage migration is quiescing this machine",
-                            at: new Date().toISOString(),
-                        }));
-                        return;
-                    }
                     const workspaceRejection = projectWorkspaceCapabilityRejection(spec, capabilities.executionRunner, new Date().toISOString());
                     if (workspaceRejection !== null)
                         return void safeExecutionSend(workspaceRejection);
@@ -821,17 +770,6 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
-                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string") {
-                    try {
-                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId });
-                        machineHelloPublisher.republish();
-                    }
-                    catch (error) {
-                        dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", {
-                            level: "ERROR", error_message: error.message,
-                        });
-                    }
-                }
                 // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。
                 serverCapabilities = new Set(Array.isArray(r.serverCapabilities)
                     ? r.serverCapabilities.filter((c) => typeof c === "string")
@@ -930,8 +868,6 @@ export function serve(config, opts = {}) {
             }
             if (msg.type !== "agent:start")
                 return; // ready/error 等忽略
-            if (storageMigrationRuntime.isAdmissionClosed())
-                return;
             // 任务键:scheduled run 用 runId(每次运行独立 cwd/work-log;overlap 由 server 端 skip_if_running 管,
             // daemon 的 running 去重只兜底"同一 run 重复投递");普通唤醒仍是 线程锚点 ?? 频道。
             const scheduled = msg.reason === "scheduled_job" && msg.scheduledRun
@@ -1347,7 +1283,6 @@ export function serve(config, opts = {}) {
             concurrencyTelemetry.stop();
             runtimeProbe.stop();
             completionRetransmitter.stop();
-            storageStatusDelivery.stop();
             const deadline = createShutdownDeadline(shutdownTimeoutMs);
             if (reconnectTimer !== null) {
                 clearTimeout(reconnectTimer);

package/dist/supervised-runtime.js

@@ -46,6 +46,7 @@ export function supervisorLaunch(request) {
                 effectivePermission: request.effectivePermission,
                 ...(request.model === undefined ? {} : { model: request.model }),
                 ...(request.reasoning === undefined ? {} : { reasoning: request.reasoning }),
+                ...(request.networkAccess === undefined ? {} : { networkAccess: request.networkAccess }),
                 ...(request.sessionId === undefined ? {} : { sessionId: request.sessionId }),
                 ...(request.imagePaths === undefined ? {} : { imagePaths: request.imagePaths }),
                 ...(request.agentRoot === undefined ? {} : {
@@ -58,9 +59,6 @@ export function supervisorLaunch(request) {
                 ...(request.codexSkillRoots === undefined ? {} : {
                     skillRoots: request.codexSkillRoots,
                 }),
-                ...(request.codexCollaborationTools === undefined ? {} : {
-                    codexCollaborationTools: request.codexCollaborationTools,
-                }),
                 resume: request.resume,
             }),
         };