@nowcrew/daemon 0.6.68 → 0.6.70

package/dist/storage-worker-operation.js

@@ -0,0 +1,284 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { basename, dirname, join, posix, win32 } from "node:path";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+import { assertStorageControlMaterialTokenFree } from "./storage-credential-guard.js";
+import { storageLayout } from "./storage-layout.js";
+import { StorageMigrationWarningCodeSchema } from "./storage-migration-policy.js";
+const CONTROL = /[\0\r\n]/u;
+const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
+const ENVIRONMENT = /^[a-z0-9][a-z0-9_-]{0,31}$/u;
+const HASH = /^[0-9a-f]{64}$/u;
+const AbsolutePathSchema = z.string().min(1).max(32768)
+    .refine((value) => !CONTROL.test(value), "path must be a single line")
+    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
+const RelativePathSchema = z.string().min(1).max(32768)
+    .refine((value) => !CONTROL.test(value), "path must be a single line")
+    .refine((value) => !posix.isAbsolute(value) && !win32.isAbsolute(value), "path must be relative")
+    .refine((value) => !value.split(/[\\/]/u).some((segment) => segment === "" || segment === "." || segment === ".."), "path must be normalized");
+const SourceKindSchema = z.enum(["daemon-home", "agents-root", "legacy-agents-root"]);
+const PolicySchema = z.object({
+    exclusions: z.array(z.object({
+        sourceKind: SourceKindSchema,
+        sourcePath: RelativePathSchema,
+        reason: z.string().min(1).max(256),
+    }).strict()).max(100_000),
+    transformations: z.array(z.object({
+        sourceKind: SourceKindSchema,
+        sourcePath: RelativePathSchema,
+        logicalDestination: RelativePathSchema,
+        sourceSha256: z.string().regex(HASH),
+        targetSha256: z.string().regex(HASH),
+        targetMode: z.string().regex(/^[0-7]{4}$/u),
+        transform: z.literal("redact_live_like_tokens_v1"),
+    }).strict()).max(100_000),
+}).strict();
+const DoctorInputSchema = z.object({
+    migrationId: z.string().uuid(),
+    generatedAt: z.string().datetime({ offset: true }),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    targetWorkspaceRoot: AbsolutePathSchema,
+    sources: z.array(z.object({
+        kind: SourceKindSchema,
+        root: AbsolutePathSchema,
+        logicalPrefix: RelativePathSchema,
+    }).strict()).min(1).max(3),
+    policy: PolicySchema,
+    manifestStoreRoot: AbsolutePathSchema.optional(),
+    state: z.object({
+        profileIdentityExact: z.boolean(),
+        duplicateWorkspaceMappings: z.number().int().nonnegative(),
+        activeAgentExecutions: z.number().int().nonnegative(),
+        activeScheduledRuns: z.number().int().nonnegative(),
+    }).strict(),
+    freeSpaceMultiplier: z.number().finite().min(1).max(10).optional(),
+}).strict();
+const ManagedServiceRecordSchema = z.object({
+    version: z.literal(1),
+    generation: z.string().uuid(),
+    platform: z.enum(["darwin", "linux"]),
+    serviceId: z.string().min(1).max(256),
+    profile: z.string().regex(PROFILE),
+    daemonHome: AbsolutePathSchema,
+    agentsRoot: AbsolutePathSchema,
+    nodePath: AbsolutePathSchema,
+    entryPath: AbsolutePathSchema,
+    packageRoot: AbsolutePathSchema,
+    npmPrefix: AbsolutePathSchema,
+    descriptorPath: AbsolutePathSchema,
+    descriptorSha256: z.string().regex(HASH),
+    createdAt: z.string().datetime({ offset: true }),
+}).strict();
+const InstallationRecordSchema = z.object({
+    version: z.literal(1),
+    installationId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    serverUrl: z.string().url().max(2048).refine((value) => {
+        const url = new URL(value);
+        return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+    }, "serverUrl must be HTTP(S) without credentials"),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    storageId: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+    nowworkHome: AbsolutePathSchema,
+    runtimeRoot: AbsolutePathSchema,
+    credentialRef: z.string().regex(/^profile:[a-z0-9][a-z0-9_-]{0,47}$/u),
+    storageMigrationId: z.string().uuid(),
+    createdAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true }),
+}).strict();
+const StorageServiceEnvironmentSchema = z.object({
+    NOWWORK_HOME: AbsolutePathSchema.optional(),
+    NOWWORK_ENV_TAG: z.string().regex(ENVIRONMENT).optional(),
+    NOWWORK_STORAGE_POLICY_PATH: AbsolutePathSchema.optional(),
+}).strict();
+const OperationSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    createdAt: z.string().datetime({ offset: true }),
+    environment: z.string().regex(ENVIRONMENT),
+    workspaceId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    expectedManifestDigest: z.string().regex(HASH),
+    doctorInput: DoctorInputSchema,
+    migration: z.object({
+        sourceRoots: z.object({
+            "daemon-home": AbsolutePathSchema.optional(),
+            "agents-root": AbsolutePathSchema.optional(),
+            "legacy-agents-root": AbsolutePathSchema.optional(),
+        }).strict(),
+        stagingWorkspaceRoot: AbsolutePathSchema,
+        targetWorkspaceRoot: AbsolutePathSchema,
+        backupsRoot: AbsolutePathSchema,
+        backupArtifacts: z.array(z.object({
+            name: z.string().regex(/^[a-z0-9][a-z0-9_.-]{0,127}$/u),
+            path: AbsolutePathSchema,
+        }).strict()).max(32),
+        acceptedWarnings: z.array(StorageMigrationWarningCodeSchema)
+            .max(StorageMigrationWarningCodeSchema.options.length),
+    }).strict(),
+    service: z.object({
+        platform: z.enum(["darwin", "linux"]),
+        userHome: AbsolutePathSchema,
+        uid: z.number().int().nonnegative().optional(),
+        serviceEnvironment: StorageServiceEnvironmentSchema.optional(),
+        sourceWasRunning: z.boolean(),
+        sourceRecord: ManagedServiceRecordSchema,
+        targetRecord: ManagedServiceRecordSchema,
+    }).strict(),
+    installation: z.object({
+        configRoot: AbsolutePathSchema,
+        target: InstallationRecordSchema,
+    }).strict(),
+}).strict();
+const pathsFor = (_platform) => posix;
+function canonicalPath(value, platform) {
+    const paths = pathsFor(platform);
+    const absolute = paths.resolve(value);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOTDIR")
+            return absolute;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    const missing = [];
+    let ancestor = absolute;
+    for (;;) {
+        const parent = paths.dirname(ancestor);
+        if (parent === ancestor)
+            return absolute;
+        missing.unshift(paths.basename(ancestor));
+        ancestor = parent;
+        try {
+            return paths.resolve(realpathSync.native(ancestor), ...missing);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOTDIR")
+                return absolute;
+            if (code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function samePath(left, right, platform) {
+    return canonicalPath(left, platform) === canonicalPath(right, platform);
+}
+function isInside(root, candidate, platform) {
+    const paths = pathsFor(platform);
+    const child = paths.relative(canonicalPath(root, platform), canonicalPath(candidate, platform));
+    return child === "" || (!child.startsWith("..") && !paths.isAbsolute(child));
+}
+function assertSemanticIdentity(operation) {
+    const identity = [operation.doctorInput, operation.installation.target];
+    if (identity.some((value) => value.workspaceId !== operation.workspaceId
+        || value.environment !== operation.environment || value.profile !== operation.profile)
+        || operation.doctorInput.migrationId !== operation.migrationId
+        || operation.installation.target.storageMigrationId !== operation.migrationId
+        || operation.installation.target.credentialRef !== `profile:${operation.profile}`) {
+        throw new Error("storage worker operation identity does not match");
+    }
+    if (operation.doctorInput.state.profileIdentityExact !== true
+        || operation.doctorInput.state.duplicateWorkspaceMappings !== 0
+        || operation.doctorInput.state.activeAgentExecutions !== 0
+        || operation.doctorInput.state.activeScheduledRuns !== 0) {
+        throw new Error("storage worker operation doctor state is not safe");
+    }
+    const { platform, sourceRecord, targetRecord } = operation.service;
+    if (sourceRecord.platform !== platform || targetRecord.platform !== platform
+        || sourceRecord.profile !== operation.profile || targetRecord.profile !== operation.profile
+        || sourceRecord.serviceId === targetRecord.serviceId
+        || !samePath(sourceRecord.nodePath, targetRecord.nodePath, platform)
+        || !samePath(sourceRecord.entryPath, targetRecord.entryPath, platform)
+        || !samePath(sourceRecord.packageRoot, targetRecord.packageRoot, platform)
+        || !samePath(sourceRecord.npmPrefix, targetRecord.npmPrefix, platform)
+        || !samePath(targetRecord.daemonHome, operation.installation.configRoot, platform)) {
+        throw new Error("storage worker service identity does not match");
+    }
+    const sourceKinds = new Set();
+    for (const source of operation.doctorInput.sources) {
+        if (sourceKinds.has(source.kind) || !samePath(operation.migration.sourceRoots[source.kind] ?? "", source.root, platform)) {
+            throw new Error("storage worker source roots do not match doctor input");
+        }
+        sourceKinds.add(source.kind);
+    }
+    const configuredSourceKinds = Object.entries(operation.migration.sourceRoots)
+        .filter(([, value]) => value !== undefined)
+        .map(([kind]) => kind);
+    if (configuredSourceKinds.length !== sourceKinds.size || configuredSourceKinds.some((kind) => !sourceKinds.has(kind))
+        || !samePath(operation.migration.sourceRoots["daemon-home"] ?? "", sourceRecord.daemonHome, platform)
+        || !samePath(operation.migration.sourceRoots["agents-root"] ?? "", sourceRecord.agentsRoot, platform)) {
+        throw new Error("storage worker source service roots do not match");
+    }
+    const projected = storageLayout({
+        nowworkHome: operation.installation.target.nowworkHome,
+        environment: operation.environment,
+        workspaceId: operation.workspaceId,
+        runtimeBase: join(operation.service.userHome, ".nowwork-worker-runtime-validation"),
+        platform,
+    });
+    if (!samePath(projected.workspaceRoot, operation.migration.targetWorkspaceRoot, platform)
+        || !samePath(projected.workspaceRoot, operation.doctorInput.targetWorkspaceRoot, platform)
+        || !samePath(projected.agentItemsRoot, targetRecord.agentsRoot, platform)) {
+        throw new Error("storage worker target layout does not match installation identity");
+    }
+    if (dirname(operation.migration.stagingWorkspaceRoot) !== dirname(operation.migration.targetWorkspaceRoot)
+        || !basename(operation.migration.stagingWorkspaceRoot).includes(operation.migrationId)) {
+        throw new Error("storage worker staging identity does not match target");
+    }
+    if (isInside(operation.installation.target.nowworkHome, operation.migration.backupsRoot, platform)
+        || isInside(operation.installation.target.nowworkHome, operation.installation.configRoot, platform)) {
+        throw new Error("storage worker local state must remain outside NOWWORK_HOME");
+    }
+}
+function parseOperation(raw) {
+    const operation = OperationSchema.parse(raw);
+    assertSemanticIdentity(operation);
+    return operation;
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export async function writeStorageWorkerOperation(raw, input) {
+    try {
+        const operation = parseOperation(raw);
+        const stateRoot = AbsolutePathSchema.parse(input.stateRoot);
+        const path = join(stateRoot, "migrations", operation.migrationId, "operation.json");
+        const serialized = `${JSON.stringify(operation, null, 2)}\n`;
+        assertStorageControlMaterialTokenFree(serialized, "storage worker operation");
+        await atomicPrivateWrite(path, serialized);
+        return Object.freeze({ path, sha256: sha256(serialized) });
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker operation", { cause: error });
+    }
+}
+export async function readStorageWorkerOperation(path, expectedSha256) {
+    try {
+        AbsolutePathSchema.parse(path);
+        z.string().regex(HASH).parse(expectedSha256);
+        const raw = await readFile(path);
+        assertStorageControlMaterialTokenFree(raw.toString("utf8"), "storage worker operation");
+        const actual = Buffer.from(sha256(raw), "hex");
+        const expected = Buffer.from(expectedSha256, "hex");
+        if (!timingSafeEqual(actual, expected))
+            throw new Error("storage worker operation digest mismatch");
+        const operation = parseOperation(JSON.parse(raw.toString("utf8")));
+        if (basename(path) !== "operation.json" || basename(dirname(path)) !== operation.migrationId
+            || basename(dirname(dirname(path))) !== "migrations") {
+            throw new Error("storage worker operation path does not match migration identity");
+        }
+        return operation;
+    }
+    catch (error) {
+        throw new Error("Invalid storage worker operation", { cause: error });
+    }
+}

package/dist/storage-worker-status.js

@@ -0,0 +1,259 @@
+import { readFile, unlink } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { Worker } from "node:worker_threads";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+const WorkerFailureSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    status: z.literal("failed"),
+    errorCode: z.string().regex(/^[a-z0-9._-]{1,128}$/u),
+    errorMessage: z.string().min(1).max(512),
+    at: z.string().datetime({ offset: true }),
+}).strict();
+const WorkerHeartbeatSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    pid: z.number().int().positive(),
+    at: z.string().datetime({ offset: true }),
+}).strict();
+const TOKEN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b|\bbearer\s+[^\s]+|(?:password|secret|token)\s*[:=]\s*[^\s]+)/giu;
+const HEARTBEAT_WORKER_KIND = "nowwork-storage-worker-heartbeat-v1";
+async function unlinkHeartbeat(path) {
+    await unlink(path).catch((error) => {
+        if (error.code !== "ENOENT")
+            throw error;
+    });
+}
+/**
+ * Keep the liveness writer in a worker with its own event loop. The source is
+ * intentionally plain JavaScript because a worker module cannot resolve the
+ * source tree's `.js` specifiers under tsx/Vitest; production builds and tests
+ * therefore exercise the same isolated execution boundary.
+ */
+const HEARTBEAT_WORKER_SOURCE = String.raw `
+const { parentPort, workerData } = require("node:worker_threads");
+const { mkdir, chmod, rename, rm, unlink, writeFile } = require("node:fs/promises");
+const { dirname } = require("node:path");
+const { randomUUID } = require("node:crypto");
+
+const atomicPrivateWrite = async (path, content) => {
+  const directory = dirname(path);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await chmod(directory, 0o700);
+  const temporary = path + "." + randomUUID() + ".tmp";
+  try {
+    await writeFile(temporary, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await rename(temporary, path);
+    await chmod(path, 0o600);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+};
+const removeHeartbeat = async () => {
+  try { await unlink(workerData.path); } catch (error) {
+    if (error && error.code !== "ENOENT") throw error;
+  }
+};
+let pending = Promise.resolve();
+let stopping = false;
+let firstWrite = true;
+const write = (requestedAt) => {
+  const initial = firstWrite;
+  firstWrite = false;
+  pending = pending.catch(() => undefined).then(() => atomicPrivateWrite(workerData.path, JSON.stringify({
+    version: 1,
+    migrationId: workerData.migrationId,
+    pid: process.pid,
+    at: initial && workerData.initialAt ? workerData.initialAt : requestedAt || new Date().toISOString(),
+  }, null, 2) + "\n"));
+  return pending;
+};
+const report = (message) => { try { parentPort.postMessage(message); } catch {} };
+(async () => {
+  try { await write(); report({ type: "ready" }); }
+  catch (error) { report({ type: "error", message: error instanceof Error ? error.message : String(error) }); return; }
+  const timer = workerData.useParentClock ? null : setInterval(() => {
+    if (!stopping) void write().catch((error) => report({ type: "error", message: error instanceof Error ? error.message : String(error) }));
+  }, workerData.intervalMs);
+  timer?.unref?.();
+  parentPort.on("message", (message) => {
+    if (stopping || !message) return;
+    if (message.type === "tick") {
+      if (!workerData.useParentClock) return;
+      void write(message.at).catch((error) => report({ type: "error", message: error instanceof Error ? error.message : String(error) }));
+      return;
+    }
+    if (message.type !== "stop") return;
+    stopping = true;
+    if (timer !== null) clearInterval(timer);
+    void pending.then(async () => { await removeHeartbeat(); report({ type: "stopped" }); }, async () => {
+      await removeHeartbeat().catch(() => undefined); report({ type: "stopped" });
+    });
+  });
+})();
+`;
+function identityFromHandoffPath(handoffPath) {
+    if (!isAbsolute(handoffPath) || basename(handoffPath) !== "handoff.json") {
+        throw new Error("storage worker handoff path is invalid");
+    }
+    const migrationDirectory = dirname(handoffPath);
+    const migrationsDirectory = dirname(migrationDirectory);
+    if (basename(migrationsDirectory) !== "migrations")
+        throw new Error("storage worker handoff path is invalid");
+    return {
+        stateRoot: dirname(migrationsDirectory),
+        migrationId: z.string().uuid().parse(basename(migrationDirectory)).toLowerCase(),
+    };
+}
+export function storageWorkerFailurePath(stateRoot, migrationId) {
+    if (!isAbsolute(stateRoot))
+        throw new Error("storage worker state root must be absolute");
+    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-status.json");
+}
+export function storageWorkerHeartbeatPath(stateRoot, migrationId) {
+    if (!isAbsolute(stateRoot))
+        throw new Error("storage worker state root must be absolute");
+    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-heartbeat.json");
+}
+export async function startStorageWorkerHeartbeat(handoffPath, input = {}) {
+    const identity = identityFromHandoffPath(handoffPath);
+    const intervalMs = z.number().int().min(100).max(15_000).parse(input.intervalMs ?? 5_000);
+    const path = storageWorkerHeartbeatPath(identity.stateRoot, identity.migrationId);
+    const initialAt = input.now?.().toISOString();
+    // The worker owns heartbeat I/O so a synchronous CPU-heavy scan in the
+    // migration process cannot delay the monitor's 30-second freshness window.
+    const worker = new Worker(HEARTBEAT_WORKER_SOURCE, {
+        eval: true,
+        // `--input-type=module` is inherited by workers launched from an eval
+        // smoke test; strip it so the plain CommonJS worker source can use require.
+        execArgv: process.execArgv.filter((arg) => !arg.startsWith("--input-type=")),
+        workerData: {
+            kind: HEARTBEAT_WORKER_KIND,
+            path,
+            migrationId: identity.migrationId,
+            intervalMs,
+            useParentClock: input.now !== undefined,
+            ...(initialAt === undefined ? {} : { initialAt }),
+        },
+    });
+    worker.unref();
+    let startupSettled = false;
+    let heartbeatError = null;
+    let stopResolve = null;
+    const onWorkerMessage = (message) => {
+        if (message.type === "error") {
+            heartbeatError = new Error(`storage worker heartbeat failed: ${message.message}`);
+            if (!startupSettled)
+                startupReject?.(heartbeatError);
+        }
+        else if (message.type === "stopped") {
+            stopResolve?.();
+            stopResolve = null;
+        }
+    };
+    let startupReject = null;
+    worker.on("message", onWorkerMessage);
+    // Keep this listener for the entire worker lifetime. A heartbeat write may
+    // fail after startup; dropping the listener would turn that operational
+    // error into an unhandled Worker 'error' event and crash the parent.
+    const onWorkerError = (error) => {
+        heartbeatError = error;
+        if (!startupSettled)
+            startupReject?.(error);
+    };
+    worker.on("error", onWorkerError);
+    await new Promise((resolvePromise, reject) => {
+        startupReject = reject;
+        const onReady = (message) => {
+            if (message.type !== "ready")
+                return;
+            startupSettled = true;
+            worker.off("message", onReady);
+            resolvePromise();
+        };
+        worker.on("message", onReady);
+    }).catch(async (error) => {
+        startupSettled = true;
+        await worker.terminate().catch(() => undefined);
+        worker.off("message", onWorkerMessage);
+        worker.off("error", onWorkerError);
+        await unlinkHeartbeat(path).catch(() => undefined);
+        throw error;
+    });
+    const parentTimer = input.now === undefined ? null : setInterval(() => {
+        try {
+            worker.postMessage({ type: "tick", at: input.now().toISOString() });
+        }
+        catch (error) {
+            heartbeatError = error instanceof Error ? error : new Error(String(error));
+        }
+    }, intervalMs);
+    parentTimer?.unref?.();
+    let stopped = false;
+    const stop = async () => {
+        if (stopped)
+            return;
+        stopped = true;
+        if (parentTimer !== null)
+            clearInterval(parentTimer);
+        await new Promise((resolvePromise) => {
+            const onExit = () => {
+                worker.off("exit", onExit);
+                stopResolve = null;
+                resolvePromise();
+            };
+            stopResolve = resolvePromise;
+            worker.once("exit", onExit);
+            worker.postMessage({ type: "stop" });
+        });
+        await worker.terminate().catch(() => undefined);
+        worker.off("message", onWorkerMessage);
+        worker.off("error", onWorkerError);
+        await unlinkHeartbeat(path);
+    };
+    Object.defineProperty(stop, "assertHealthy", {
+        enumerable: false,
+        value: () => {
+            if (heartbeatError !== null)
+                throw heartbeatError;
+        },
+    });
+    return stop;
+}
+export async function writeStorageWorkerFailureStatus(handoffPath, error) {
+    const identity = identityFromHandoffPath(handoffPath);
+    const rawCode = error instanceof Error && "code" in error ? String(error.code) : "worker_failed";
+    const errorCode = /^[a-z0-9._-]{1,128}$/u.test(rawCode) ? rawCode : "worker_failed";
+    const rawMessage = error instanceof Error ? error.message : String(error);
+    const errorMessage = rawMessage.replaceAll(TOKEN, "<redacted>").slice(0, 512) || "storage worker failed";
+    const status = WorkerFailureSchema.parse({
+        version: 1,
+        migrationId: identity.migrationId,
+        status: "failed",
+        errorCode,
+        errorMessage,
+        at: new Date().toISOString(),
+    });
+    await atomicPrivateWrite(storageWorkerFailurePath(identity.stateRoot, identity.migrationId), `${JSON.stringify(status, null, 2)}\n`);
+}
+export async function readStorageWorkerFailureStatus(stateRoot, migrationId) {
+    try {
+        return WorkerFailureSchema.parse(JSON.parse(await readFile(storageWorkerFailurePath(stateRoot, migrationId), "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Invalid storage worker failure status", { cause: error });
+    }
+}
+export async function readStorageWorkerHeartbeat(stateRoot, migrationId) {
+    try {
+        return WorkerHeartbeatSchema.parse(JSON.parse(await readFile(storageWorkerHeartbeatPath(stateRoot, migrationId), "utf8")));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Invalid storage worker heartbeat", { cause: error });
+    }
+}

package/dist/supervised-runtime.js

@@ -46,7 +46,6 @@ export function supervisorLaunch(request) {
                 effectivePermission: request.effectivePermission,
                 ...(request.model === undefined ? {} : { model: request.model }),
                 ...(request.reasoning === undefined ? {} : { reasoning: request.reasoning }),
-                ...(request.networkAccess === undefined ? {} : { networkAccess: request.networkAccess }),
                 ...(request.sessionId === undefined ? {} : { sessionId: request.sessionId }),
                 ...(request.imagePaths === undefined ? {} : { imagePaths: request.imagePaths }),
                 ...(request.agentRoot === undefined ? {} : {
@@ -59,6 +58,9 @@ export function supervisorLaunch(request) {
                 ...(request.codexSkillRoots === undefined ? {} : {
                     skillRoots: request.codexSkillRoots,
                 }),
+                ...(request.codexCollaborationTools === undefined ? {} : {
+                    codexCollaborationTools: request.codexCollaborationTools,
+                }),
                 resume: request.resume,
             }),
         };

package/dist/workspace.js

@@ -8,7 +8,7 @@
  *
  * spawn runtime 时把 <ws>/.crew 置于 PATH 最前,于是 agent 的 `crew ...` 命中 wrapper。
  */
-import { mkdir, writeFile, readFile, chmod, access } from "node:fs/promises";
+import { mkdir, writeFile, readFile, chmod, access, lstat } from "node:fs/promises";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { dslog } from "./slog.js";
@@ -34,17 +34,37 @@ async function exists(p) {
         return false;
     }
 }
+async function hasLocalMemoryV2Marker(agentDir) {
+    const crewDir = join(agentDir, ".crew");
+    const memoryDir = join(crewDir, "memory");
+    const markerPath = join(agentDir, ".crew", "memory", "v2-enabled");
+    try {
+        const crewStat = await lstat(crewDir);
+        const memoryStat = await lstat(memoryDir);
+        if (!crewStat.isDirectory() || crewStat.isSymbolicLink()
+            || !memoryStat.isDirectory() || memoryStat.isSymbolicLink())
+            return false;
+        const stat = await lstat(markerPath);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return false;
+        return (await readFile(markerPath, "utf8")) === "1\n";
+    }
+    catch {
+        return false;
+    }
+}
 export async function prepareWorkspace(input) {
     const dir = join(input.agentsRoot, input.handle);
+    const agentHomePreexisted = await exists(dir);
     const crewDir = join(dir, ".crew");
     await mkdir(crewDir, { recursive: true });
     // 预先创建明细目录,让收尾流程可以按功能创建 notes/<topic>.md。
-    if (!input.skipLocalMemory)
-        await mkdir(join(dir, "notes"), { recursive: true });
+    await mkdir(join(dir, "notes"), { recursive: true });
     // MEMORY.md:首次创建"持久身份 + 知识索引"骨架,之后由 agent 自己维护
     const memoryPath = join(dir, "MEMORY.md");
-    const memorySeedCreated = !input.skipLocalMemory && !(await exists(memoryPath));
-    if (!input.skipLocalMemory && memorySeedCreated) {
+    const memorySeedCreated = !(await exists(memoryPath));
+    const localMemoryV2Initialized = await hasLocalMemoryV2Marker(dir);
+    if (memorySeedCreated) {
         try {
             await writeFile(memoryPath, memorySeed(input.handle, input.description), "utf8");
         }
@@ -53,15 +73,13 @@ export async function prepareWorkspace(input) {
             throw error;
         }
     }
-    let memory = "";
-    if (!input.skipLocalMemory) {
-        try {
-            memory = await readFile(memoryPath, "utf8");
-        }
-        catch (error) {
-            logMemoryPrepareFailure(input, "memory_read", error);
-            throw error;
-        }
+    let memory;
+    try {
+        memory = await readFile(memoryPath, "utf8");
+    }
+    catch (error) {
+        logMemoryPrepareFailure(input, "memory_read", error);
+        throw error;
     }
     // 系统提示词按 execution 隔离;省略 identity 的兼容调用每次使用随机路径。
     const promptDir = join(crewDir, "prompts");
@@ -127,7 +145,9 @@ export async function prepareWorkspace(input) {
         crewDir,
         systemPromptPath,
         memory,
+        agentHomePreexisted,
         memorySeedCreated,
+        localMemoryV2Initialized,
         homeDir,
         runDir,
         workLogPath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.68",
+  "version": "0.6.70",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",

package/dist/self-training-workspace.js

@@ -1,15 +0,0 @@
-import { rm } from "node:fs/promises";
-import { isAbsolute, relative, sep } from "node:path";
-/** Delete only a concrete child of this Agent's tasks root; never follow an ambiguous target. */
-export async function cleanupSelfTrainingRunDir(tasksRoot, runDir) {
-    const child = relative(tasksRoot, runDir);
-    if (child === "" || isAbsolute(child) || child === ".." || child.startsWith(`..${sep}`))
-        return;
-    try {
-        await rm(runDir, { recursive: true, force: true });
-    }
-    catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[execution] failed to remove self-training run dir ${runDir}: ${detail}\n`);
-    }
-}