@nowcrew/daemon 0.6.68 → 0.6.69

package/dist/prompt.js

@@ -305,7 +305,7 @@ ${memoryTaskReadRule}
 - **跨任务协调看实时清单**:用 \`crew task list --mine\` 查你当前所有任务及其状态(谁在排队、谁在评审)。例:你一次只能测一个页面时,据此判断"正在测 #1、#2 排队",在 #2 的工作日志里标注"等 #1 完成"。
 - 需要更多背景时再 \`Read $CREW_HOME/notes/<topic>.md\`;不要一次把所有笔记读进上下文。
 
-${communicationSection}
+${communicationSection}${ctx.collaborationToolsEnabled === true ? buildCollaborationToolsPrompt() : ""}
 
 CLI 成功时打印人类可读文本到 stdout;失败时 stderr 给出错误,并用**退出码**告诉你下一步:
 - \`4\` = 任务已被他人认领 / 不可认领 → 停手,别抢,转做别的。
@@ -385,3 +385,21 @@ export function buildOriginDecisionRetryPrompt(channelId, threadId) {
         "普通内部消息不算外部回复决策；--send-draft 也不是外部回复开关。",
     ].join("\n");
 }
+/**
+ * Codex 原生 collaboration.* 工具的用法与边界(spec 2d;2026-08-28 对 Codex 0.149.1/0.150.1 实测)。
+ * 只在 daemon 开关打开且 runtime 为 codex 时注入;是本机 runtime 能力事实,不是产品策略。
+ * 契约来自实测,不编造 Codex 未声明的返回字段。
+ */
+export function buildCollaborationToolsPrompt() {
+    return `
+
+## Codex 原生协作工具
+本机 Codex 已开启 \`collaboration.*\` 子 agent 工具。它们完全在 Codex 进程内运行:子 agent 的工作对 NowWork 的频道、线程、任务、execution 记录和按 agent 的 token 统计**都不可见**,token 并入你本轮的用量。只用于你自己会汇总的内部交叉核对、并行调研;绝不用于人类或其它 NowWork 成员需要观察、审计或接手的事。
+- **\`collaboration.spawn_agent\`** —— 必填 \`task_name\`(仅小写字母/数字/下划线)、\`message\`;可选 \`fork_turns\`(\`"none"\`|\`"all"\`|\`"3"\` 这样的轮数,默认 \`"all"\`)、\`model\`、\`reasoning_effort\`。立即启动独立 turn,你不阻塞;子 agent 跑完后 idle 而非销毁。新 agent 用 **canonical 任务名路径**引用,如 \`/root/api_review\`。含 root 最多 4 个活跃 agent。
+- **\`collaboration.followup_task\`** —— 必填 \`target\`(canonical 路径,不是 UUID)、\`message\`。异步投递并把 idle 的目标唤醒进新 turn,可重复。
+- **\`collaboration.send_message\`** —— 必填 \`target\`、\`message\`。只入队,**不**启动 turn;要触发工作用 followup_task。
+- **\`collaboration.list_agents\`** —— 可选 \`path_prefix\`。只读,列出 live agents。
+- **\`collaboration.wait_agent\`** —— 可选 \`timeout_ms\`(10000–3600000,默认 30000)。阻塞你直到任一子 agent 有更新、有新输入或超时。
+- **没有任何返回值有保证的 schema**:不要去解析返回值里的 \`agent_id\`/\`id\`/\`accepted\` 之类字段;用 \`list_agents\` 和 \`wait_agent\` 获取状态。
+- **不要调用 \`collaboration.interrupt_agent\`**:它会把你自己这轮 turn 一起中断(2026-08-10 线上事故),中断后本轮结果全部丢失且不会重跑。让子 agent 自然跑完或直接忽略其结果。`;
+}

package/dist/provider-env.js

@@ -11,24 +11,6 @@
 import { join } from "node:path";
 import { DEEPSEEK_CODEX_KEY_ENV, deepSeekCodexHome, } from "./runtimes/codex-deepseek-config.js";
 import { DEEPSEEK_HARNESS_CONFIG_ENV } from "./runtimes/deepseek-harness.js";
-const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const RESERVED_ENV = new Set([
-    "PATH",
-    "XDG_CONFIG_HOME",
-    "XDG_DATA_HOME",
-    "XDG_CACHE_HOME",
-    "GH_CONFIG_DIR",
-    "CLOUDSDK_CONFIG",
-]);
-/** Keep user-provided variables away from daemon-owned runtime and credential fields. */
-export function sanitizeEnvVars(raw) {
-    if (!raw)
-        return {};
-    return Object.fromEntries(Object.entries(raw).filter(([key, value]) => typeof value === "string"
-        && ENV_KEY_RE.test(key)
-        && !key.toUpperCase().startsWith("CREW_")
-        && !RESERVED_ENV.has(key.toUpperCase())));
-}
 /** custom 模式下必须从继承 env 中剔除的全局路由/凭证变量(避免与注入值叠加或抢优先级)。 */
 const CONFLICTING_ENV = [
     "ANTHROPIC_BASE_URL",
@@ -57,12 +39,12 @@ const CONFLICTING_CODEX_ENV = [
     DEEPSEEK_CODEX_KEY_ENV,
 ];
 /** 返回叠加了 provider 隔离的新 env(不改入参);不支持的 runtime/provider 组合原样返回。 */
-export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverride) {
+export function applyProviderEnv(base, runtime, cfg, homeDir) {
     if (runtime === "codex" && cfg.provider === "deepseek") {
         const env = { ...base };
         for (const key of CONFLICTING_CODEX_ENV)
             delete env[key];
-        env.CODEX_HOME = deepSeekHomeOverride ?? deepSeekCodexHome(homeDir);
+        env.CODEX_HOME = deepSeekCodexHome(homeDir);
         if (cfg.providerApiKey)
             env[DEEPSEEK_CODEX_KEY_ENV] = cfg.providerApiKey;
         return env;
@@ -118,7 +100,7 @@ export function applyDeepSeekHarnessMachineEnv(base, machineEnv) {
  */
 export function providerFingerprint(runtime, cfg) {
     if (runtime === "codex" && cfg.provider === "deepseek") {
-        return `deepseek|${cfg.providerBaseUrl ?? "default"}|${cfg.providerApiKey ? "key" : "nokey"}`;
+        return `deepseek|${cfg.providerApiKey ? "key" : "nokey"}`;
     }
     if (runtime !== "claude" || cfg.provider !== "custom")
         return null;

package/dist/repository-identity.js

@@ -0,0 +1,45 @@
+import { createHash } from "node:crypto";
+import { AbilityRepositoryUrlSchema } from "./agent-ability/types.js";
+const SCP_REPOSITORY = /^git@([^:]+):(.+)$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+function normalizePath(value) {
+    const path = value.replace(/^\/+|\/+$/gu, "").replace(/\.git$/iu, "");
+    if (!path || path.split("/").some((part) => part.length === 0 || part === "." || part === ".." || part.includes("\\"))) {
+        throw new Error("project_dependency_repository_path_invalid");
+    }
+    return path;
+}
+function repositoryParts(repository) {
+    const value = repository.trim();
+    AbilityRepositoryUrlSchema.parse(value);
+    const scp = value.match(SCP_REPOSITORY);
+    if (scp !== null)
+        return { host: scp[1].toLowerCase(), path: normalizePath(scp[2]) };
+    const url = new URL(value);
+    if (url.search || url.hash || url.username || url.password) {
+        throw new Error("project_dependency_repository_url_invalid");
+    }
+    return { host: url.hostname.toLowerCase(), path: normalizePath(url.pathname) };
+}
+export function normalizeRepositoryIdentity(repository) {
+    const parts = repositoryParts(repository);
+    const canonical = `${parts.host}/${parts.path}`;
+    const hash = createHash("sha256").update(canonical, "utf8").digest("hex");
+    const basename = parts.path.split("/").at(-1) ?? "repo";
+    const displayName = basename.replace(/[^A-Za-z0-9._-]/gu, "_") || "repo";
+    return Object.freeze({
+        canonical,
+        repositoryKey: `repo-${hash}`,
+        displayName,
+    });
+}
+export function worktreeDirectoryName(branch, resolvedCommit) {
+    if (!COMMIT.test(resolvedCommit))
+        throw new Error("project_dependency_commit_invalid");
+    const safeBranch = branch
+        .replaceAll("/", "__")
+        .replace(/[^A-Za-z0-9._-]/gu, "_")
+        .replace(/^[-.]+/u, "_")
+        .slice(0, 128) || "default";
+    return `${safeBranch}--${resolvedCommit}`;
+}

package/dist/runner.js

@@ -10,8 +10,7 @@ import { readOriginDecisionFile, resetOriginDecisionFile } from "./origin-decisi
 import { readBoundImDecisionFile, resetBoundImDecisionFile } from "./bound-im-decision.js";
 import { launchSupervisedRuntime } from "./supervised-runtime.js";
 import { awaitWithCancellation, } from "./runtime-cancellation.js";
-export { awaitExit, exitActivity } from "./local-executor.js";
-export { sanitizeEnvVars } from "./provider-env.js";
+export { awaitExit, exitActivity, sanitizeEnvVars } from "./local-executor.js";
 const ICON = {
     init: "🟢", text: "💬", reading: "📖", sending: "📨", checking: "🔎",
     claiming: "📌", crew: "⚙️", tool: "🛠️", tool_result: "↩️", done: "✅", error: "❌",
@@ -59,6 +58,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             ...(input.wakeOrigin ? { wakeOrigin: input.wakeOrigin } : {}),
             memory: capMemoryForInject(workspace.memory),
             ...(resuming ? {} : { workLog: capWorkLogForInject(workspace.workLog) }),
+            collaborationToolsEnabled: config.codexCollaborationTools && runtime === "codex",
         }),
         wakePrompt: ({ resuming, rotatedForBudget, nearBudget }) => {
             const distillHint = nearBudget
@@ -75,6 +75,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             name: runtime,
             ...(providerConfig.model ? { model: providerConfig.model } : {}),
             ...(reasoning.success ? { reasoning: reasoning.data } : {}),
+            codexCollaborationTools: config.codexCollaborationTools,
         },
         effectivePermission: config.dangerous ? "full_access" : "workspace_write",
         captureFinal: true,
@@ -106,6 +107,7 @@ export async function runAgent(config, input, onActivity = defaultPrint, onConso
             softTokens: config.sessionSoftTokens,
             maxTurns: config.sessionMaxTurns,
         },
+        localMemoryV2Enabled: config.localMemoryV2Handles?.has(input.handle) === true,
     }, {
         onActivity,
         onConsole,

package/dist/runtimes/codex-app-server-runner.js

@@ -6,7 +6,8 @@ import { pathToFileURL } from "node:url";
 import spawn from "cross-spawn";
 import { z } from "zod";
 import { signalSupervisorTree } from "../execution-supervisor.js";
-import { assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
+import { assertCodexCollaborationVersion, assertCodexNativeWorkspaceVersion, assertCodexProjectWorkspaceResponse, assertCodexSkillsListResponse, boundedCodexPlan, codexProjectWorkspaceUnsupported, } from "./codex-contract.js";
+import { decideTurnRetry, itemMakesTurnUnsafe } from "./codex-turn-retry.js";
 import { startFirstProgressWatchdog } from "./progress-watchdog.js";
 const RunnerInputSchema = z.object({
     systemPrompt: z.string().min(1),
@@ -20,13 +21,9 @@ const RunnerInputSchema = z.object({
     cwd: z.string().min(1).optional(),
     workspaceRoots: z.array(z.string().min(1)).optional(),
     skillRoots: z.array(z.string().min(1)).optional(),
-    networkAccess: z.boolean().optional(),
+    codexCollaborationTools: z.boolean().optional(),
     resume: z.boolean(),
-}).strict().superRefine((input, ctx) => {
-    if (input.networkAccess === true && input.effectivePermission !== "workspace_write") {
-        ctx.addIssue({ code: "custom", message: "network_access_requires_workspace_write" });
-    }
-});
+}).strict();
 const RPC_TIMEOUT_MS = 30_000;
 const INITIALIZE_RPC_TIMEOUT_MS = 60_000;
 const ERROR_MESSAGE_CAP = 2_000;
@@ -42,12 +39,17 @@ const MAX_TRANSIENT_TURN_RETRIES = 2;
 const TRANSIENT_TURN_RETRY_DELAY_MS = 15_000;
 const TRANSIENT_TURN_RETRY_BACKOFF_FACTOR = 3;
 const PROCESS_TREE_STOP_TIMEOUT_MS = 1_000;
+/** 进程级:一旦某个 collabAgentToolCall 的 item/completed 没有对应 item/started,本执行后续永不重试(spec R4-3)。 */
+let collabStartedMissing = false;
 const USER_INPUT_UNAVAILABLE_MESSAGE = "NowWork cannot collect interactive user input in this headless run; ask the user in the final response instead of assuming an answer.";
-export function codexAppServerArgs(projectRootMarkers) {
+export function codexAppServerArgs(input) {
     return [
-        ...(projectRootMarkers === undefined
+        ...(input.projectRootMarkers === undefined
             ? []
-            : ["-c", `project_root_markers=${JSON.stringify(projectRootMarkers)}`]),
+            : ["-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`]),
+        // multi_agent 按开关;multi_agent_v2 无条件关,钉死已验证的 v1 契约(spec 2b)。
+        "-c", `features.multi_agent=${input.collaborationTools === true}`,
+        "-c", "features.multi_agent_v2=false",
         "app-server", "--listen", "stdio://",
     ];
 }
@@ -58,7 +60,8 @@ const TRANSIENT_TURN_ERROR_PATTERNS = [
     /too many requests/i,
 ];
 /** 模型侧瞬态失败(网关过载/限流)→ 换个时间整轮重试大概率成功。
- *  interrupted 不算:那是取消信号或 codex collab 连带中断,重跑语义不明确。 */
+ *  interrupted 单独归为 collab_interrupted:2026-08-10 实锤是模型自己调 collaboration.interrupt_agent
+ *  连带把父 turn 置为 interrupted。两类原因都只在本 turn 无白名单外工具活动时重试(codex-turn-retry.ts)。 */
 export function isTransientTurnFailure(detail) {
     return TRANSIENT_TURN_ERROR_PATTERNS.some((pattern) => pattern.test(detail));
 }
@@ -418,7 +421,10 @@ async function stopChildTree(child) {
 }
 async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs) {
     const attemptStartedAt = Date.now();
-    const child = spawn(bin, codexAppServerArgs(input.projectRootMarkers), {
+    const child = spawn(bin, codexAppServerArgs({
+        ...(input.projectRootMarkers === undefined ? {} : { projectRootMarkers: input.projectRootMarkers }),
+        ...(input.codexCollaborationTools === undefined ? {} : { collaborationTools: input.codexCollaborationTools }),
+    }), {
         cwd: process.cwd(),
         env: process.env,
         stdio: ["pipe", "pipe", "pipe"],
@@ -439,6 +445,8 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
     let threadId = null;
     let announcedThreadId = null;
     let turnId = null;
+    let turnHasUnsafeSideEffect = false;
+    const startedItemIds = new Set();
     let lastUsage;
     let completionResolve;
     let completionReject;
@@ -457,6 +465,20 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             || method === "item/agentMessage/delta" || method === "item/completed") {
             firstProgress.observe();
         }
+        if (method === "item/started" || method === "item/completed") {
+            const item = params !== null && typeof params === "object"
+                ? params.item
+                : undefined;
+            if (method === "item/started" && typeof item?.id === "string")
+                startedItemIds.add(item.id);
+            if (method === "item/completed" && item?.type === "collabAgentToolCall"
+                && (typeof item.id !== "string" || !startedItemIds.has(item.id)) && !collabStartedMissing) {
+                collabStartedMissing = true;
+                process.stderr.write("[codex-app-server] collab_item_started_missing\n");
+            }
+            if (itemMakesTurnUnsafe(item))
+                turnHasUnsafeSideEffect = true;
+        }
         for (const event of mapCodexNotification(method, params)) {
             const eventThreadId = typeof event.thread_id === "string" ? event.thread_id : null;
             if (event.type === "thread.started" && eventThreadId === announcedThreadId)
@@ -501,6 +523,8 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
         if (input.workspaceRoots !== undefined || input.skillRoots !== undefined) {
             assertCodexNativeWorkspaceVersion(initialized);
         }
+        if (input.codexCollaborationTools === true)
+            assertCodexCollaborationVersion(initialized);
         logStage(activeStage, "ok", attempt, stageStartedAt);
         rpc.notify("initialized");
         activeStage = input.resume ? "thread_resume" : "thread_start";
@@ -565,9 +589,6 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             ...(input.reasoning === undefined || input.reasoning === "default"
                 ? {}
                 : { effort: input.reasoning }),
-            ...(input.networkAccess === true ? {
-                sandboxPolicy: { type: "workspaceWrite", networkAccess: true },
-            } : {}),
         });
         logStage(activeStage, "ok", attempt, stageStartedAt);
         turnId = started.turn.id;
@@ -588,15 +609,19 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             }),
         });
         if (completed.turn?.status === "completed")
-            return { code: 0, initializeTimedOut: false };
+            return { code: 0, initializeTimedOut: false, unsafeToRetry: false };
         const detail = completed.turn?.error?.message ?? `turn status ${completed.turn?.status ?? "unknown"}`;
         process.stderr.write(sanitizeCodexDiagnostic(`Codex turn failed: ${detail.slice(0, ERROR_MESSAGE_CAP)}\n`, secrets));
+        const status = completed.turn?.status;
+        const retryReason = cancelling ? undefined
+            : status === "interrupted" ? "collab_interrupted"
+                : status === "failed" && isTransientTurnFailure(detail) ? "transient_turn_failure"
+                    : undefined;
         return {
-            code: completed.turn?.status === "interrupted" ? 130 : 1,
+            code: status === "interrupted" ? 130 : 1,
             initializeTimedOut: false,
-            transientTurnFailure: !cancelling
-                && completed.turn?.status === "failed"
-                && isTransientTurnFailure(detail),
+            ...(retryReason === undefined ? {} : { retryReason }),
+            unsafeToRetry: turnHasUnsafeSideEffect || collabStartedMissing,
         };
     }
     catch (error) {
@@ -609,7 +634,7 @@ async function runCodexAppServerAttempt(bin, input, attempt, initializeTimeoutMs
             logStage(activeStage, "error", attempt, stageStartedAt);
         }
         process.stderr.write(`Codex app-server execution failed: ${safeErrorMessage(error, secrets)}\n`);
-        return { code: 1, initializeTimedOut };
+        return { code: 1, initializeTimedOut, unsafeToRetry: false };
     }
     finally {
         firstProgress.stop();
@@ -641,13 +666,20 @@ export async function runCodexAppServer(bin, options = {}) {
             process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=initialize_timeout\n`);
             continue;
         }
-        if (result.transientTurnFailure && turnRetries < MAX_TRANSIENT_TURN_RETRIES) {
+        const decision = decideTurnRetry(result, turnRetries, MAX_TRANSIENT_TURN_RETRIES);
+        if (decision.kind === "retry") {
             const delayMs = turnRetryDelayMs * TRANSIENT_TURN_RETRY_BACKOFF_FACTOR ** turnRetries;
             turnRetries += 1;
-            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=transient_turn_failure\n`);
+            process.stderr.write(`[codex-app-server] stage=retry status=start attempt=${attempt + 1} elapsed_ms=0 reason=${decision.reason}\n`);
             await new Promise((resolve) => setTimeout(resolve, delayMs));
             continue;
         }
+        if (decision.kind === "skipped") {
+            process.stderr.write(`[codex-app-server] stage=retry status=skipped attempt=${attempt} reason=${decision.reason}_unsafe\n`);
+        }
+        else if (decision.kind === "exhausted") {
+            process.stderr.write(`[codex-app-server] stage=retry status=exhausted attempt=${attempt} reason=${decision.reason}\n`);
+        }
         return result.code;
     }
 }

package/dist/runtimes/codex-command-safety.js

@@ -0,0 +1,75 @@
+/**
+ * Codex app-server 重试门控用的「只读 crew 命令」判定(spec Part 1,R3-1/R4-1)。
+ *
+ * 白名单 + 封闭文法,不是黑名单:任何解析不确定都返回 false。只回答"这是不是白名单里某条
+ * crew 只读命令的一次干净调用",不做"读/写"语义判断。任何非 crew 命令(sed/rg/git/python…)
+ * 一律 false——白名单之外的一切都视为不可安全重试。零 IO,可独立单测。
+ */
+/** 封闭列表,由 cli/src/run.ts 命令面反推;新增 CLI 只读命令时同步维护。漏加只会更保守。 */
+export const READ_ONLY_CREW_COMMANDS = new Set([
+    "whoami",
+    "server info",
+    "message read",
+    "message check",
+    "thread read",
+    "task list",
+    "schedule list",
+    "schedule runs",
+    "reminder list",
+    "reminder log",
+    "resolve",
+    "channel members",
+    "integration env",
+    "integration list",
+]);
+const SINGLE_VERB = new Set(["whoami", "resolve"]);
+// 一层 shell 包装:bash/sh/zsh -c / -lc / -cl,后跟被单引号或双引号整体包裹的正文。
+const WRAPPER = /^(?:\/usr\/bin\/|\/bin\/)?(?:bash|sh|zsh)\s+-(?:l?c|cl)\s+(.+)$/su;
+// 整串禁字符:出现任一即拒绝(含单个 &、引号、$、括号、换行、制表、反斜杠)。
+const FORBIDDEN = /[&;|<>$`(){}\\'"\n\r\t]/u;
+const OPTION_TOKEN = /^--?[A-Za-z][A-Za-z0-9-]*(?:=[A-Za-z0-9._:/@#%+-]+)?$/u;
+const VALUE_TOKEN = /^[A-Za-z0-9._:/@#%+][A-Za-z0-9._:/@#%+-]+$/u;
+function unwrap(command) {
+    const match = WRAPPER.exec(command);
+    if (match === null)
+        return command;
+    const quoted = match[1] ?? "";
+    const quote = quoted[0];
+    if (quote !== "'" && quote !== "\"")
+        return null;
+    if (quoted.length < 2 || quoted[quoted.length - 1] !== quote)
+        return null;
+    const body = quoted.slice(1, -1);
+    if (body.includes(quote))
+        return null;
+    if (quote === "\"" && /[$\\]/u.test(body))
+        return null;
+    return body;
+}
+export function isReadOnlyCrewCommand(command) {
+    const body = unwrap(command);
+    if (body === null)
+        return false;
+    if (FORBIDDEN.test(body))
+        return false;
+    const trimmed = body.trim();
+    if (trimmed === "" || /\s{2,}/u.test(trimmed))
+        return false;
+    const tokens = trimmed.split(" ");
+    if (tokens[0] !== "crew")
+        return false;
+    const verb = tokens[1];
+    if (verb === undefined)
+        return false;
+    let consumed;
+    if (SINGLE_VERB.has(verb)) {
+        consumed = 2;
+    }
+    else {
+        const pair = `${verb} ${tokens[2] ?? ""}`;
+        if (!READ_ONLY_CREW_COMMANDS.has(pair))
+            return false;
+        consumed = 3;
+    }
+    return tokens.slice(consumed).every((token) => OPTION_TOKEN.test(token) || VALUE_TOKEN.test(token));
+}

package/dist/runtimes/codex-contract.js

@@ -1,6 +1,7 @@
-import { CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
+import { CODEX_COLLABORATION_MIN_VERSION, CODEX_NATIVE_WORKSPACE_MIN_VERSION } from "./codex.js";
 import { z } from "zod";
 export const CODEX_PROJECT_WORKSPACE_UNSUPPORTED = "codex_project_workspace_unsupported";
+export const CODEX_COLLABORATION_UNSUPPORTED = "codex_collaboration_unsupported";
 export const CODEX_PLAN_ENTRY_LIMIT = 16;
 // 16 steps remain inside the server's 4,000 UTF-16-unit plan payload cap even
 // when every retained code point is a surrogate pair (for example, emoji).
@@ -51,18 +52,32 @@ const versionTuple = (version) => {
 const versionAtLeast = (actual, minimum) => actual[0] > minimum[0]
     || (actual[0] === minimum[0] && (actual[1] > minimum[1]
         || (actual[1] === minimum[1] && actual[2] >= minimum[2])));
-/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
-export function assertCodexNativeWorkspaceVersion(response) {
+function initializeVersion(response) {
     const parsed = NativeInitializeResponseSchema.safeParse(response);
     if (!parsed.success)
-        throw codexProjectWorkspaceUnsupported();
+        return null;
     const match = /(?:^|[/\s])(\d+\.\d+\.\d+)(?=$|[\s(])/u.exec(parsed.data.userAgent);
-    const actual = match === null ? null : versionTuple(match[1] ?? "");
+    return match === null ? null : versionTuple(match[1] ?? "");
+}
+/** Native roots require the app-server version returned by initialize, not a separate shell probe. */
+export function assertCodexNativeWorkspaceVersion(response) {
+    const actual = initializeVersion(response);
     const minimum = versionTuple(CODEX_NATIVE_WORKSPACE_MIN_VERSION);
     if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
         throw codexProjectWorkspaceUnsupported();
     }
 }
+/** Collaboration tools are exposed only on an app-server whose contract was verified (spec 2b). */
+export function assertCodexCollaborationVersion(response) {
+    const actual = initializeVersion(response);
+    const minimum = versionTuple(CODEX_COLLABORATION_MIN_VERSION);
+    if (actual === null || minimum === null || !versionAtLeast(actual, minimum)) {
+        throw codexCollaborationUnsupported();
+    }
+}
+export function codexCollaborationUnsupported() {
+    return new Error(CODEX_COLLABORATION_UNSUPPORTED);
+}
 const PLAN_STATUSES = new Set(["pending", "inProgress", "completed"]);
 const clipCharacters = (value, limit) => [...value.trim().replace(/\s+/gu, " ")].slice(0, limit).join("");
 /** Treat plan updates as bounded user-visible data; any malformed retained step rejects the event. */

package/dist/runtimes/codex-deepseek-config.js

@@ -7,20 +7,10 @@ export const DEEPSEEK_CODEX_BASE_URL = "https://api.deepseek.com/";
 export const DEEPSEEK_CODEX_KEY_ENV = "NOWCREW_DEEPSEEK_API_KEY";
 export const DEEPSEEK_CODEX_REASONING_LEVELS = ["low", "high", "max"];
 const PRIVATE_CODEX_HOME = ".codex-deepseek";
-const SELF_TRAINING_PRIVATE_CODEX_HOME = ".codex-deepseek-self-training";
-export function deepSeekCodexHome(homeDir, selfTraining = false) {
-    return resolve(homeDir, selfTraining ? SELF_TRAINING_PRIVATE_CODEX_HOME : PRIVATE_CODEX_HOME);
+export function deepSeekCodexHome(homeDir) {
+    return resolve(homeDir, PRIVATE_CODEX_HOME);
 }
-function normalizedBaseUrl(value) {
-    const url = new URL(value);
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new Error("DeepSeek provider base URL must use HTTP(S)");
-    }
-    if (!url.pathname.endsWith("/"))
-        url.pathname = `${url.pathname}/`;
-    return url.toString();
-}
-export function renderDeepSeekConfig(codexHome, baseUrl = DEEPSEEK_CODEX_BASE_URL) {
+export function renderDeepSeekConfig(codexHome) {
     const catalogPath = join(codexHome, "models.json");
     return [
         `model = ${JSON.stringify(DEEPSEEK_CODEX_MODEL)}`,
@@ -30,7 +20,7 @@ export function renderDeepSeekConfig(codexHome, baseUrl = DEEPSEEK_CODEX_BASE_UR
         "",
         "[model_providers.deepseek]",
         'name = "deepseek"',
-        `base_url = ${JSON.stringify(normalizedBaseUrl(baseUrl))}`,
+        `base_url = ${JSON.stringify(DEEPSEEK_CODEX_BASE_URL)}`,
         'wire_api = "responses"',
         `env_key = ${JSON.stringify(DEEPSEEK_CODEX_KEY_ENV)}`,
         "",
@@ -50,11 +40,11 @@ async function writePrivateAtomic(path, content) {
         await rm(temporary, { force: true });
     }
 }
-export async function materializeDeepSeekCodexHome(homeDir, options = {}) {
-    const codexHome = deepSeekCodexHome(homeDir, options.selfTraining === true);
+export async function materializeDeepSeekCodexHome(homeDir) {
+    const codexHome = deepSeekCodexHome(homeDir);
     await mkdir(codexHome, { recursive: true, mode: 0o700 });
     await chmod(codexHome, 0o700);
     await writePrivateAtomic(join(codexHome, "models.json"), DEEPSEEK_CODEX_CATALOG);
-    await writePrivateAtomic(join(codexHome, "config.toml"), renderDeepSeekConfig(codexHome, options.baseUrl));
+    await writePrivateAtomic(join(codexHome, "config.toml"), renderDeepSeekConfig(codexHome));
     return codexHome;
 }

package/dist/runtimes/codex-turn-retry.js

@@ -0,0 +1,69 @@
+/**
+ * Codex app-server turn 级重试决策(spec Part 1)。
+ *
+ * attempt 只上报两个正交事实:retryReason(为什么值得重试)与 unsafeToRetry(本 turn 是否已有
+ * 白名单之外的工具活动)。外层循环通过 decideTurnRetry 单一出口判断,所有原因共用一个预算。
+ * 2026-08-10 事故根因:模型自己调 collaboration.interrupt_agent,Codex 把父 turn 也置为
+ * interrupted;旧代码直接 exit 130。同时旧的网关过载重试是无条件的,会重放 crew message send。
+ */
+import { isReadOnlyCrewCommand } from "./codex-command-safety.js";
+/**
+ * Codex app-server v2 `codex app-server generate-json-schema` ThreadItem 枚举的全部 18 种类型,
+ * 逐一裁定安全性(2026-08-28 最终评审 F1:实测真实 app-server 0.150.1 发现 userMessage 缺失导致
+ * 所有 turn 被判不安全,回归影响过载重试与 interrupted 重试两条路径)。新增协议类型时,必须在此
+ * 表格里显式落座,不允许静默归类。
+ *
+ * safe(协议/叙述类,无副作用,共 9 种):
+ *   - userMessage        Codex 对我们自己发送的 prompt 的回显,每个 turn 必有
+ *   - hookPrompt          hook 触发的系统提示回显
+ *   - agentMessage        模型最终回复文本
+ *   - reasoning           模型推理过程(不透出给下游)
+ *   - plan                模型计划更新
+ *   - contextCompaction   上下文压缩通知
+ *   - sleep               模型主动等待
+ *   - enteredReviewMode   进入 review 模式通知
+ *   - exitedReviewMode    退出 review 模式通知
+ * conditional(1 种,视具体内容而定):
+ *   - commandExecution    仅当 isReadOnlyCrewCommand(command) 为 true 时安全
+ * unsafe(有副作用或无法判断,共 8 种 + 未知类型):
+ *   - fileChange          写文件
+ *   - mcpToolCall          调用外部 MCP 工具
+ *   - dynamicToolCall      调用动态工具
+ *   - collabAgentToolCall  协作工具(spawnAgent/interrupt_agent 等)
+ *   - subAgentActivity     子 agent 活动
+ *   - webSearch            联网搜索
+ *   - imageView            查看图片
+ *   - imageGeneration      生成图片
+ *   - (任何未知/缺失 type)  一律视为不安全
+ */
+const NARRATIVE_ITEM_TYPES = new Set([
+    "userMessage",
+    "hookPrompt",
+    "agentMessage",
+    "reasoning",
+    "plan",
+    "contextCompaction",
+    "sleep",
+    "enteredReviewMode",
+    "exitedReviewMode",
+]);
+/** 白名单判定:只有叙述类 item 和白名单内的 crew 只读命令是安全的;其它一切(含未知类型)不安全。 */
+export function itemMakesTurnUnsafe(item) {
+    if (item?.type === undefined)
+        return true;
+    if (NARRATIVE_ITEM_TYPES.has(item.type))
+        return false;
+    if (item.type === "commandExecution") {
+        return typeof item.command !== "string" || !isReadOnlyCrewCommand(item.command);
+    }
+    return true;
+}
+export function decideTurnRetry(result, turnRetries, maxRetries) {
+    if (result.retryReason === undefined)
+        return { kind: "return" };
+    if (result.unsafeToRetry)
+        return { kind: "skipped", reason: result.retryReason };
+    if (turnRetries < maxRetries)
+        return { kind: "retry", reason: result.retryReason };
+    return { kind: "exhausted", reason: result.retryReason };
+}

package/dist/runtimes/codex.js

@@ -5,6 +5,8 @@
 import spawn from "cross-spawn";
 /** Minimum CLI whose real app-server contract supports NowCrew native project workspaces. */
 export const CODEX_NATIVE_WORKSPACE_MIN_VERSION = "0.148.0";
+/** Minimum CLI whose `multi_agent` collaboration tool contract was empirically verified (2026-08-28). */
+export const CODEX_COLLABORATION_MIN_VERSION = "0.149.1";
 // Codex CLI 原生 model_reasoning_effort 档位(codex 0.135.0 实测:非法值时 config 解析报错枚举这六档)。
 // 注意:codex 对非法值是硬失败(进程直接退出),所以必须白名单过滤;白名单外(含 "default"、
 // claude 专属的 "max")回落 CODEX_DEFAULT_EFFORT。
@@ -22,6 +24,8 @@ export function buildCodexArgs(input) {
         ? input.reasoning
         : CODEX_DEFAULT_EFFORT;
     args.push("-c", `model_reasoning_effort=${effort}`);
+    // 纵深防御:exec 启动器没有 initialize 握手、无法断言版本,协作工具恒关(spec 2b)。
+    args.push("-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false");
     if (input.projectRootMarkers) {
         args.push("-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`);
     }
@@ -32,9 +36,6 @@ export function buildCodexArgs(input) {
     else if (input.effectivePermission === "full_access" || (input.effectivePermission === undefined && input.dangerous)) {
         args.push("--dangerously-bypass-approvals-and-sandbox");
     }
-    if (input.effectivePermission === "workspace_write" && input.networkAccess === true) {
-        args.push("-c", "sandbox_workspace_write.network_access=true");
-    }
     for (const imagePath of input.imagePaths ?? [])
         args.push("--image", imagePath);
     // `-` instructs codex exec to read the prompt from stdin. Keeping the complete prompt out of argv