@nowcrew/daemon 0.6.69 → 0.6.71

package/dist/provider-error.js

@@ -3,14 +3,13 @@ export function providerErrorFromExit(exitCode, errorText) {
         return undefined;
     return errorText ? classifyProviderError(errorText) : { category: "cli", code: "process_exit" };
 }
-const STATUS_PATTERN = /\b(?:http(?:\/\d(?:\.\d)?)?\s*)?(?:status(?:_code)?\s*[:=]?\s*|response\s+status\s+|error\s+)([1-5]\d{2})\b/iu;
-const KNOWN_STATUS_PATTERN = /\b(401|403|408|429|500|502|503|504)\b/u;
+const STATUS_PATTERN = /\b(?:http(?:\/\d(?:\.\d)?)?\s+|status(?:_code)?\s*[:=]?\s*|response\s+status\s+|error\s+|failed\s*[:=]?\s*|returned\s+|responded\s+)([1-5]\d{2})\b/iu;
 const CODE_BY_STATUS = Object.freeze({
     401: "unauthorized", 403: "forbidden", 408: "request_timeout", 429: "rate_limited",
     500: "internal_server_error", 502: "bad_gateway", 503: "service_unavailable", 504: "gateway_timeout",
 });
 function statusFromText(text) {
-    const explicit = STATUS_PATTERN.exec(text)?.[1] ?? KNOWN_STATUS_PATTERN.exec(text)?.[1];
+    const explicit = STATUS_PATTERN.exec(text)?.[1];
     if (explicit === undefined)
         return undefined;
     const value = Number(explicit);

package/dist/runtime-health-handler.js

@@ -0,0 +1,5 @@
+import { handleRuntimeProbeFrame, probeRuntimeHealth, } from "./runtime-health.js";
+export const runtimeHealthProbeHandler = (configuredProbe, executionRuntimesKnown, detectedExecutionRuntimes) => configuredProbe ?? ((request) => probeRuntimeHealth(request, {
+    ...(executionRuntimesKnown ? { availableRuntimes: detectedExecutionRuntimes } : {}),
+}));
+export const handleRuntimeHealthProbeFrame = (decoded, configuredProbe, executionRuntimesKnown, detectedExecutionRuntimes) => handleRuntimeProbeFrame(decoded, runtimeHealthProbeHandler(configuredProbe, executionRuntimesKnown, detectedExecutionRuntimes));

package/dist/runtime-health.js

@@ -13,6 +13,12 @@ const RuntimeProbeTargetSchema = z.object({
 export const RuntimeProbeRequestSchema = z.object({
     runtimes: z.array(RuntimeProbeTargetSchema).min(1).max(RUNTIME_HEALTH_NAMES.length),
     timeoutMs: z.number().int().min(10).max(60_000),
+    probeMode: z.enum(["inventory", "active"]).optional(),
+    /**
+     * Optional daemon-side execution adapter inventory. Older callers omit this
+     * field and retain the historical executable probing behavior.
+     */
+    availableRuntimes: z.array(z.enum(RUNTIME_HEALTH_NAMES)).max(RUNTIME_HEALTH_NAMES.length).optional(),
 }).strict().superRefine((value, context) => {
     const seen = new Set();
     for (let index = 0; index < value.runtimes.length; index += 1) {
@@ -34,13 +40,15 @@ export const RuntimeProbeFrameSchema = z.object({
     reqId: z.string().min(1).max(128),
     runtimes: z.array(RuntimeProbeTargetSchema).min(1).max(RUNTIME_HEALTH_NAMES.length),
     timeoutMs: z.number().int().min(10).max(60_000),
+    probeMode: z.enum(["inventory", "active"]).optional(),
+    availableRuntimes: z.array(z.enum(RUNTIME_HEALTH_NAMES)).max(RUNTIME_HEALTH_NAMES.length).optional(),
 }).strict();
 const execFileAsync = promisify(execFile);
 const defaultExecutor = async (file, args, options) => {
     const result = await execFileAsync(file, [...args], options);
     return { stdout: String(result.stdout), stderr: String(result.stderr) };
 };
-const adapterOf = (_runtime) => "executable";
+const adapterOf = (runtime, availableRuntimes) => (availableRuntimes === undefined || availableRuntimes.includes(runtime) ? "executable" : "unsupported");
 function modelArgs(runtime, modelId) {
     const model = modelId === null ? [] : ["--model", modelId];
     if (runtime === "claude")
@@ -72,9 +80,16 @@ function failureCode(error) {
         return "mapping_invalid";
     if (/\b429\b|rate.?limit|too many requests/.test(text))
         return "rate_limited";
-    if (/\b5\d\d\b|upstream|bad gateway|service unavailable/.test(text))
+    const providerError = classifyProviderError(text);
+    // A local diagnostic may contain the word "upstream" or an exit code without
+    // proving a Provider 5xx. Only explicit HTTP context or well-known gateway
+    // messages are strong enough here.
+    if (providerError.category === "upstream" || /bad gateway|service unavailable|gateway timeout/.test(text)) {
         return "upstream_error";
-    return "upstream_error";
+    }
+    if (providerError.category === "timeout")
+        return "timeout";
+    return "unknown_failure";
 }
 const isMissing = (error) => typeof error === "object" && error !== null && error.code === "ENOENT";
 const isAbort = (error) => typeof error === "object" && error !== null && error.name === "AbortError";
@@ -109,60 +124,88 @@ export async function probeRuntimeHealth(request, dependencies = {}) {
     const monotonicNow = dependencies.monotonicNow ?? (() => performance.now());
     const sourceEnv = dependencies.env ?? process.env;
     const env = { ...sourceEnv, PATH: augmentedPath(sourceEnv) };
-    return Promise.all(parsed.runtimes.map(async (target) => {
-        const started = monotonicNow();
-        const checkedAt = now().toISOString();
-        const base = {
-            runtime: target.runtime,
-            adapter: adapterOf(target.runtime),
-            modelId: target.modelId,
-            configFingerprint: target.configFingerprint,
-            checkedAt,
-        };
-        const latencyMs = () => Math.max(0, Math.round(monotonicNow() - started));
-        try {
-            await runBounded(execute, target.runtime, ["--version"], parsed.timeoutMs, env);
-        }
-        catch (error) {
-            return {
-                ...base,
-                installation: isMissing(error) ? "missing" : "timeout",
-                model: "not_checked",
-                latencyMs: latencyMs(),
-                detailCode: isMissing(error) ? "executable_missing" : "version_timeout",
+    const availableRuntimes = dependencies.availableRuntimes ?? parsed.availableRuntimes;
+    const results = [];
+    for (const target of parsed.runtimes) {
+        results.push(await (async () => {
+            const started = monotonicNow();
+            const checkedAt = now().toISOString();
+            const base = {
+                runtime: target.runtime,
+                adapter: adapterOf(target.runtime, availableRuntimes),
+                modelId: target.modelId,
+                configFingerprint: target.configFingerprint,
+                checkedAt,
             };
-        }
-        if (base.adapter !== "executable") {
-            return { ...base, installation: "available", model: "not_checked", latencyMs: latencyMs(), detailCode: null };
-        }
-        try {
-            await runBounded(execute, target.runtime, modelArgs(target.runtime, target.modelId), parsed.timeoutMs, env);
-            return { ...base, installation: "available", model: "ok", latencyMs: latencyMs(), detailCode: null };
-        }
-        catch (error) {
-            const code = isAbort(error) ? "timeout" : failureCode(error);
-            const providerError = isAbort(error)
-                ? { category: "timeout", code: "timeout" }
-                : classifyProviderError(failureText(error));
-            return {
-                ...base,
-                installation: "available",
-                model: code,
-                latencyMs: latencyMs(),
-                detailCode: code,
-                providerErrorCategory: providerError.category,
-                ...(providerError.httpStatus === undefined ? {} : { providerHttpStatus: providerError.httpStatus }),
-                ...(providerError.code === undefined ? {} : { providerErrorCode: providerError.code }),
-            };
-        }
-    }));
+            const latencyMs = () => Math.max(0, Math.round(monotonicNow() - started));
+            if (availableRuntimes !== undefined && !availableRuntimes.includes(target.runtime)) {
+                return {
+                    ...base,
+                    installation: "available",
+                    adapter: "unsupported",
+                    model: "not_checked",
+                    latencyMs: latencyMs(),
+                    detailCode: "health_adapter_unavailable",
+                    startupStage: "unknown",
+                };
+            }
+            try {
+                await runBounded(execute, target.runtime, ["--version"], parsed.timeoutMs, env);
+            }
+            catch (error) {
+                const missing = isMissing(error);
+                const timedOut = isAbort(error);
+                return {
+                    ...base,
+                    installation: missing || timedOut ? (missing ? "missing" : "timeout") : "available",
+                    model: "not_checked",
+                    latencyMs: latencyMs(),
+                    detailCode: missing ? "executable_missing" : timedOut ? "version_timeout" : "version_check_failed",
+                    startupStage: missing ? "spawn" : "version",
+                };
+            }
+            if (base.adapter !== "executable") {
+                return { ...base, installation: "available", model: "not_checked", latencyMs: latencyMs(), detailCode: null, startupStage: "version" };
+            }
+            if ((parsed.probeMode ?? "active") === "inventory") {
+                return { ...base, installation: "available", model: "not_checked", latencyMs: latencyMs(), detailCode: "inventory_only", startupStage: "version" };
+            }
+            try {
+                await runBounded(execute, target.runtime, modelArgs(target.runtime, target.modelId), parsed.timeoutMs, env);
+                return { ...base, installation: "available", model: "ok", latencyMs: latencyMs(), detailCode: null, startupStage: "ready" };
+            }
+            catch (error) {
+                const code = isAbort(error) ? "timeout" : failureCode(error);
+                const providerError = isAbort(error)
+                    ? { category: "timeout", code: "timeout" }
+                    : classifyProviderError(failureText(error));
+                return {
+                    ...base,
+                    installation: "available",
+                    model: code,
+                    latencyMs: latencyMs(),
+                    detailCode: code,
+                    startupStage: "model_probe",
+                    providerErrorCategory: providerError.category,
+                    ...(providerError.httpStatus === undefined ? {} : { providerHttpStatus: providerError.httpStatus }),
+                    ...(providerError.code === undefined ? {} : { providerErrorCode: providerError.code }),
+                };
+            }
+        })());
+    }
+    return results;
 }
 export async function handleRuntimeProbeFrame(decoded, probe = probeRuntimeHealth) {
     const frame = RuntimeProbeFrameSchema.safeParse(decoded);
     if (!frame.success)
         return null;
     try {
-        const data = await probe({ runtimes: frame.data.runtimes, timeoutMs: frame.data.timeoutMs });
+        const data = await probe({
+            runtimes: frame.data.runtimes,
+            timeoutMs: frame.data.timeoutMs,
+            ...(frame.data.probeMode === undefined ? {} : { probeMode: frame.data.probeMode }),
+            ...(frame.data.availableRuntimes === undefined ? {} : { availableRuntimes: frame.data.availableRuntimes }),
+        });
         return { reqId: frame.data.reqId, ok: true, data };
     }
     catch {

package/dist/serve.js

@@ -47,7 +47,8 @@ import { createAgentAbilityRuntime } from "./agent-ability/runtime.js";
 import { createProjectSkillsReconciler, } from "./project-skills/reconciler.js";
 import { initializedProjectSkillsReconciler } from "./project-skills/initialized-reconciler.js";
 import { parseMemoryPruneTraceId } from "./memory-prune-diagnostics.js";
-import { handleRuntimeProbeFrame, probeRuntimeHealth } from "./runtime-health.js";
+import { probeRuntimeHealth } from "./runtime-health.js";
+import { handleRuntimeHealthProbeFrame } from "./runtime-health-handler.js";
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
@@ -78,7 +79,7 @@ export function serve(config, opts = {}) {
         ?? (config.agentMemory === null ? undefined : createAgentMemoryBridge(config.agentMemory));
     const executionTelemetry = createExecutionTelemetryJournal(config.agentsRoot);
     const executeProtocol = opts.execution?.runExecution ?? runExecution;
-    let detectedExecutionRuntimes = [];
+    let detectedExecutionRuntimes = [], executionRuntimesKnown = false;
     let runtimeFacts = null;
     const runtimeProbe = createRuntimeProbeCoordinator();
     const hostCoordinator = opts.execution?.hostCoordinator
@@ -356,9 +357,12 @@ export function serve(config, opts = {}) {
             });
             runtimeFacts = helloPromise
                 .then(async (hello) => {
-                if (hello.executionProtocol === undefined)
+                if (hello.executionProtocol === undefined) {
+                    executionRuntimesKnown = true;
                     return [];
+                }
                 const detected = await runtimeProbe.detect(hello.runtimes, detectExecutable);
+                executionRuntimesKnown = true;
                 await storageReplay;
                 if (ws === openedSocket && openedSocket.readyState === WebSocket.OPEN
                     && detected.some((runtime) => !hello.executionRuntimes.includes(runtime))) {
@@ -368,6 +372,7 @@ export function serve(config, opts = {}) {
                 return detected;
             })
                 .catch((error) => {
+                executionRuntimesKnown = true;
                 dslog("execution.runtime_detection_failed", "runtime 探测失败", {
                     level: "ERROR", error_message: error.message,
                 });
@@ -872,7 +877,7 @@ export function serve(config, opts = {}) {
                 return;
             }
             if (msg.type === "runtime-health:probe") {
-                const result = await handleRuntimeProbeFrame(msg, opts.runtimeHealth?.probe ?? probeRuntimeHealth);
+                const result = await handleRuntimeHealthProbeFrame(msg, opts.runtimeHealth?.probe, executionRuntimesKnown, detectedExecutionRuntimes);
                 if (result !== null) {
                     try {
                         ws?.send(JSON.stringify({ type: "fs:result", ...result }));

package/dist/slog.js

@@ -32,10 +32,12 @@ function deploymentEnvironment(serverHost) {
         return "prod";
     if (serverHost === "nowwork-dev.nowcoder.com")
         return "dev";
+    if (serverHost === "nowwork-pre.nowcoder.com")
+        return "pre";
     if (serverHost === "localhost" || serverHost === "127.0.0.1"
         || serverHost === "::1" || serverHost === "[::1]")
         return "local";
-    return undefined;
+    return "unknown";
 }
 function spoolDir() {
     return process.env.CREW_SLS_SPOOL_DIR ?? join(homedir(), ".crew", "logs", "sls-spool");

package/dist/storage-manifest.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { chmod, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm } from "node:fs/promises";
+import { chmod, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename } from "node:fs/promises";
 import { createInterface } from "node:readline";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
 import { z } from "zod";
@@ -111,15 +111,30 @@ function pathReason(sourceKind, sourcePath) {
         return "local_runtime";
     return null;
 }
-async function fileDigest(path) {
+function abortedManifestScanError() {
+    return Object.assign(new Error("storage manifest scan aborted"), { code: "preflight_aborted" });
+}
+async function fileDigest(path, signal) {
+    if (signal?.aborted)
+        throw abortedManifestScanError();
     const before = await lstat(path);
     const digest = createHash("sha256");
-    await new Promise((resolvePromise, reject) => {
-        const stream = createReadStream(path);
-        stream.on("data", (chunk) => digest.update(chunk));
-        stream.once("end", resolvePromise);
-        stream.once("error", reject);
-    });
+    try {
+        await new Promise((resolvePromise, reject) => {
+            const stream = createReadStream(path, signal === undefined ? {} : { signal });
+            stream.on("data", (chunk) => digest.update(chunk));
+            stream.once("end", resolvePromise);
+            stream.once("error", reject);
+        });
+    }
+    catch (error) {
+        if (signal?.aborted || (error instanceof Error && error.name === "AbortError")) {
+            throw abortedManifestScanError();
+        }
+        throw error;
+    }
+    if (signal?.aborted)
+        throw abortedManifestScanError();
     const after = await lstat(path);
     if (before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
         throw new Error(`source changed while hashing: ${path}`);
@@ -329,7 +344,7 @@ async function* scanSourceEntries(input) {
             if (transformation !== undefined) {
                 if (type !== "file")
                     throw new Error(`transformation source is not a file: ${sourcePath}`);
-                const digest = await fileDigest(path);
+                const digest = await fileDigest(path, input.signal);
                 if (digest !== transformation.sourceSha256)
                     throw new Error(`transformation source drift: ${sourcePath}`);
                 const entry = emit(ManifestEntrySchema.parse({
@@ -394,7 +409,7 @@ async function* scanSourceEntries(input) {
                 reason: "durable_workspace_data",
                 mode: modeString(stat.mode),
                 sizeBytes: stat.size,
-                ...(type === "file" ? { sha256: await fileDigest(path) } : {}),
+                ...(type === "file" ? { sha256: await fileDigest(path, input.signal) } : {}),
             }));
             input.onEntry?.(entry.sourceKind, entry.sourcePath);
             yield entry;
@@ -663,6 +678,55 @@ const StoredChunkSchema = z.object({
     digest: z.string().regex(CHUNK_DIGEST),
     entries: z.array(ManifestEntrySchema).max(50_000),
 }).strict();
+// A timeout aborts the scan asynchronously. Keep a process-local single-flight
+// guard so a retry cannot append to the same partial JSONL while the timed-out
+// invocation is still unwinding. A daemon restart clears this guard; the
+// persisted checkpoint and chunk digests remain the cross-process authority.
+const activeManifestPersists = new Set();
+const StorageManifestChunkCheckpointSchema = z.object({
+    version: z.literal(1),
+    migrationId: z.string().uuid(),
+    nextChunkIndex: z.number().int().nonnegative(),
+    emittedEntries: z.number().int().nonnegative(),
+    sourceIndex: z.number().int().nonnegative(),
+    sourcePath: z.string().min(1).nullable(),
+    identityDigest: z.string().regex(CHUNK_DIGEST),
+    sequenceDigest: z.string().regex(CHUNK_DIGEST),
+}).strict();
+function emptyManifestSummary() {
+    return { records: 0, files: 0, directories: 0, symlinks: 0, copied: 0, skipped: 0, transformations: 0, externalSymlinks: 0, bytesToCopy: 0, errors: 0 };
+}
+function emptyManifestWarnings() {
+    return { credentialLinks: 0, unapprovedLinks: 0, brokenLinks: 0, unsupportedItems: 0 };
+}
+function addManifestEntryToSummary(summary, warnings, entry) {
+    summary.records += 1;
+    if (entry.type === "file")
+        summary.files += 1;
+    if (entry.type === "directory")
+        summary.directories += 1;
+    if (entry.type === "symlink")
+        summary.symlinks += 1;
+    if (entry.disposition === "copy")
+        summary.copied += 1;
+    if (entry.disposition === "skip")
+        summary.skipped += 1;
+    if (entry.disposition === "transform")
+        summary.transformations += 1;
+    if (entry.type === "file" && entry.disposition !== "skip")
+        summary.bytesToCopy += entry.sizeBytes;
+    if (entry.link?.classification === "external") {
+        summary.externalSymlinks += 1;
+        if (entry.reason === "credential_material")
+            warnings.credentialLinks += 1;
+        else if (entry.reason !== "local_runtime")
+            warnings.unapprovedLinks += 1;
+    }
+    if (entry.link?.classification === "broken")
+        warnings.brokenLinks += 1;
+    if (entry.type === "unsupported")
+        warnings.unsupportedItems += 1;
+}
 function chunkStorePaths(root, migrationId) {
     if (!isAbsolute(root) || CONTROL.test(root))
         throw new Error("manifest chunk store root must be an absolute single-line path");
@@ -670,6 +734,82 @@ function chunkStorePaths(root, migrationId) {
     const directory = resolve(root, "migrations", migrationId);
     return Object.freeze({ directory, path: join(directory, "manifest.jsonl"), checkpointPath: join(directory, "checkpoint.json") });
 }
+async function pathExists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+async function readManifestCheckpoint(path) {
+    try {
+        return StorageManifestChunkCheckpointSchema.parse(JSON.parse(await readFile(path, "utf8")));
+    }
+    catch (error) {
+        throw new Error("Invalid storage manifest checkpoint", { cause: error });
+    }
+}
+async function readPartialManifestChunkState(path, input, prepared) {
+    if (input.signal?.aborted)
+        throw abortedManifestScanError();
+    const stream = createReadStream(path, {
+        encoding: "utf8",
+        ...(input.signal === undefined ? {} : { signal: input.signal }),
+    });
+    const lines = createInterface({ input: stream, crlfDelay: Infinity });
+    let expected = 0;
+    let entryCount = 0;
+    let sequenceDigest = storageManifestChunkSequenceSeed({
+        migrationId: input.migrationId,
+        environment: prepared.environment,
+        workspaceId: input.workspaceId,
+        targetWorkspaceRoot: input.targetWorkspaceRoot,
+        sourceKinds: prepared.sourceKinds,
+    });
+    const summary = emptyManifestSummary();
+    const warnings = emptyManifestWarnings();
+    try {
+        for await (const line of lines) {
+            if (input.signal?.aborted)
+                throw abortedManifestScanError();
+            if (line.trim().length === 0)
+                continue;
+            let parsed;
+            try {
+                parsed = StoredChunkSchema.parse(JSON.parse(line));
+            }
+            catch (error) {
+                throw new Error("Invalid partial storage manifest chunk", { cause: error });
+            }
+            if (parsed.index !== expected)
+                throw new Error("storage manifest partial chunk sequence is not contiguous");
+            if (storageManifestChunkDigest(parsed.entries) !== parsed.digest) {
+                throw new Error("storage manifest partial chunk digest mismatch");
+            }
+            for (const entry of parsed.entries)
+                addManifestEntryToSummary(summary, warnings, entry);
+            expected += 1;
+            entryCount += parsed.entries.length;
+            sequenceDigest = storageManifestChunkSequenceStep(sequenceDigest, parsed.digest);
+        }
+    }
+    catch (error) {
+        if (input.signal?.aborted || (error instanceof Error && error.name === "AbortError")) {
+            throw abortedManifestScanError();
+        }
+        throw error;
+    }
+    finally {
+        lines.close();
+        stream.destroy();
+    }
+    assertStorageManifestEntryLimit(entryCount);
+    return { chunkCount: expected, entryCount, sequenceDigest, summary, warnings };
+}
 /** Iterate a persisted manifest without materializing its entries array. */
 export async function* readStorageManifestChunks(store) {
     const record = z.object({
@@ -760,29 +900,63 @@ function manifestMigrationIdFromStorePath(path) {
     return z.string().uuid().parse(id);
 }
 /** Persist a chunk stream and return a compact manifest reference. */
-export async function persistStorageManifestChunks(input, options) {
-    if (options.resumeFrom !== undefined) {
-        throw new Error("persisting a resumed manifest requires the original chunk store; resume the stream before persistence");
-    }
+async function persistStorageManifestChunksLocked(input, options) {
     const prepared = prepareManifestScan(input);
     const chunkSize = z.number().int().positive().max(50_000).parse(options.chunkSize ?? 10_000);
     const paths = chunkStorePaths(options.root, input.migrationId);
     await mkdir(paths.directory, { recursive: true, mode: 0o700 });
     await chmod(paths.directory, 0o700);
     const temporary = `${paths.path}.tmp`;
-    await rm(temporary, { force: true });
+    const temporaryExists = await pathExists(temporary);
+    const checkpointExists = await pathExists(paths.checkpointPath);
+    if (temporaryExists && !checkpointExists) {
+        throw new Error("storage manifest partial state is incomplete");
+    }
+    const resumeFrom = temporaryExists
+        ? await readManifestCheckpoint(paths.checkpointPath)
+        : options.resumeFrom;
+    if (options.resumeFrom !== undefined && resumeFrom !== undefined
+        && JSON.stringify(options.resumeFrom) !== JSON.stringify(resumeFrom)) {
+        throw new Error("storage manifest checkpoint does not match persisted state");
+    }
+    if (resumeFrom !== undefined && !temporaryExists) {
+        throw new Error("storage manifest checkpoint has no partial chunk store");
+    }
+    const partial = temporaryExists
+        ? await readPartialManifestChunkState(temporary, input, prepared)
+        : null;
+    if (resumeFrom !== undefined && partial !== null) {
+        const expectedIdentityDigest = storageManifestChunkSequenceSeed({
+            migrationId: input.migrationId,
+            environment: prepared.environment,
+            workspaceId: input.workspaceId,
+            targetWorkspaceRoot: input.targetWorkspaceRoot,
+            sourceKinds: prepared.sourceKinds,
+        });
+        if (resumeFrom.migrationId !== input.migrationId
+            || resumeFrom.identityDigest !== expectedIdentityDigest
+            || resumeFrom.nextChunkIndex !== partial.chunkCount
+            || resumeFrom.emittedEntries !== partial.entryCount
+            || resumeFrom.sequenceDigest !== partial.sequenceDigest
+            || resumeFrom.sourceIndex > input.sources.length) {
+            throw new Error("storage manifest checkpoint identity or digest mismatch");
+        }
+    }
     let handle = null;
-    let chunkCount = 0;
-    let entryCount = 0;
-    let sequenceDigest = storageManifestChunkSequenceDigest({
+    let chunkCount = partial?.chunkCount ?? 0;
+    let entryCount = partial?.entryCount ?? 0;
+    let sequenceDigest = partial?.sequenceDigest ?? storageManifestChunkSequenceDigest({
         migrationId: input.migrationId, environment: prepared.environment, workspaceId: input.workspaceId,
         targetWorkspaceRoot: input.targetWorkspaceRoot, sourceKinds: prepared.sourceKinds, chunkDigests: [],
     });
-    const summary = { records: 0, files: 0, directories: 0, symlinks: 0, copied: 0, skipped: 0, transformations: 0, externalSymlinks: 0, bytesToCopy: 0, errors: 0 };
-    const warnings = { credentialLinks: 0, unapprovedLinks: 0, brokenLinks: 0, unsupportedItems: 0 };
+    const summary = partial?.summary ?? emptyManifestSummary();
+    const warnings = partial?.warnings ?? emptyManifestWarnings();
     try {
-        handle = await open(temporary, "wx", 0o600);
-        for await (const chunk of streamStorageManifestChunks(input, { chunkSize })) {
+        handle = await open(temporary, temporaryExists ? "a" : "wx", 0o600);
+        for await (const chunk of streamStorageManifestChunks(input, {
+            chunkSize,
+            ...(resumeFrom === undefined ? {} : { resumeFrom }),
+        })) {
             const line = `${JSON.stringify({ version: 1, index: chunk.index, digest: chunk.digest, entries: chunk.entries })}\n`;
             await handle.writeFile(line, "utf8");
             await handle.sync();
@@ -790,34 +964,8 @@ export async function persistStorageManifestChunks(input, options) {
             chunkCount += 1;
             entryCount += chunk.entries.length;
             sequenceDigest = chunk.checkpoint.sequenceDigest;
-            for (const entry of chunk.entries) {
-                summary.records += 1;
-                if (entry.type === "file")
-                    summary.files += 1;
-                if (entry.type === "directory")
-                    summary.directories += 1;
-                if (entry.type === "symlink")
-                    summary.symlinks += 1;
-                if (entry.disposition === "copy")
-                    summary.copied += 1;
-                if (entry.disposition === "skip")
-                    summary.skipped += 1;
-                if (entry.disposition === "transform")
-                    summary.transformations += 1;
-                if (entry.type === "file" && entry.disposition !== "skip")
-                    summary.bytesToCopy += entry.sizeBytes;
-                if (entry.link?.classification === "external") {
-                    summary.externalSymlinks += 1;
-                    if (entry.reason === "credential_material")
-                        warnings.credentialLinks += 1;
-                    else if (entry.reason !== "local_runtime")
-                        warnings.unapprovedLinks += 1;
-                }
-                if (entry.link?.classification === "broken")
-                    warnings.brokenLinks += 1;
-                if (entry.type === "unsupported")
-                    warnings.unsupportedItems += 1;
-            }
+            for (const entry of chunk.entries)
+                addManifestEntryToSummary(summary, warnings, entry);
             input.onProgress?.({ scannedEntries: entryCount, sourceKind: chunk.sourceKind === "mixed" ? prepared.sourceKinds[0] : chunk.sourceKind, sourcePath: chunk.entries.at(-1)?.sourcePath ?? "" });
         }
         await handle.close();
@@ -833,10 +981,25 @@ export async function persistStorageManifestChunks(input, options) {
     }
     catch (error) {
         await handle?.close().catch(() => undefined);
-        await rm(temporary, { force: true });
+        // Keep both the partial JSONL and its last authenticated checkpoint. A
+        // subsequent preflight can resume this exact migration, while a mismatched
+        // or incomplete pair fails closed instead of being silently overwritten.
         throw error;
     }
 }
+export async function persistStorageManifestChunks(input, options) {
+    const paths = chunkStorePaths(options.root, input.migrationId);
+    if (activeManifestPersists.has(paths.path)) {
+        throw new Error("storage manifest persistence is already running for this migration");
+    }
+    activeManifestPersists.add(paths.path);
+    try {
+        return await persistStorageManifestChunksLocked(input, options);
+    }
+    finally {
+        activeManifestPersists.delete(paths.path);
+    }
+}
 export function parseStorageManifest(raw) {
     try {
         return StorageManifestSchema.parse(JSON.parse(raw));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.69",
+  "version": "0.6.71",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -16,6 +16,14 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "codex-home:migrate": "tsx src/runtimes/codex-home-migration-cli.ts",
+    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@nowcrew/cli": "^0.4.13",
@@ -34,12 +42,5 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
-  },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "codex-home:migrate": "tsx src/runtimes/codex-home-migration-cli.ts",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
   }
-}
+}