@nowcrew/daemon 0.6.73 → 0.6.75

package/dist/daemon-updater.js

@@ -2,7 +2,19 @@ import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { systemCommandRunner } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
-const RELEASED_VERSION_RE = /^\d+\.\d+\.\d+$/;
+import { daemonReleaseChannel, isDaemonReleaseVersion } from "./daemon-release-version.js";
+import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
+function configuredRegistryArgs(allowLoopbackHttp) {
+    try {
+        return process.env.CREW_NPM_REGISTRY === undefined ? [] : [
+            "--registry",
+            normalizeDaemonNpmRegistry(process.env.CREW_NPM_REGISTRY, { allowLoopbackHttp }),
+        ];
+    }
+    catch {
+        return null;
+    }
+}
 export async function prepareDaemonRestart(input) {
     const local = input.localSlots.tryAcquireExclusive();
     if (local === null)
@@ -28,8 +40,32 @@ async function readPackageVersion(packageRoot) {
     const body = JSON.parse(await readFile(resolve(packageRoot, "package.json"), "utf8"));
     return typeof body.version === "string" ? body.version : "";
 }
+async function restoreInstalledVersion(input, runner, version, registryArgs) {
+    if (!isDaemonReleaseVersion(version))
+        return false;
+    const result = await runner((input.platform ?? process.platform) === "win32" ? "npm.cmd" : "npm", [
+        "install",
+        "--global",
+        "--prefix",
+        input.npmPrefix,
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        ...registryArgs,
+        `@nowcrew/daemon@${version}`,
+    ]).catch(() => null);
+    if (result?.exitCode !== 0)
+        return false;
+    try {
+        const installedVersion = await (input.readInstalledVersion ?? readPackageVersion)(input.packageRoot);
+        return installedVersion === version;
+    }
+    catch {
+        return false;
+    }
+}
 export async function installExactDaemonUpdate(input) {
-    if (!RELEASED_VERSION_RE.test(input.targetVersion)) {
+    if (!isDaemonReleaseVersion(input.targetVersion)) {
         return { ok: false, errorCode: "ineligible" };
     }
     const installation = daemonGlobalInstallation(input.currentEntryPath ?? process.argv[1] ?? "", input.platform ?? process.platform);
@@ -62,6 +98,25 @@ export async function installExactDaemonUpdate(input) {
         return { ok: false, errorCode: "ineligible" };
     }
     const runner = input.runner ?? systemCommandRunner;
+    let previousVersion = "";
+    try {
+        previousVersion = await (input.readInstalledVersion ?? readPackageVersion)(input.packageRoot);
+    }
+    catch {
+        // Do not replace a package when there is no verified version to restore.
+        await release();
+        return { ok: false, errorCode: "install_failed" };
+    }
+    if (!isDaemonReleaseVersion(previousVersion)) {
+        await release();
+        return { ok: false, errorCode: "install_failed" };
+    }
+    const registryArgs = configuredRegistryArgs(daemonReleaseChannel(previousVersion) === "beta"
+        || daemonReleaseChannel(input.targetVersion) === "beta");
+    if (registryArgs === null) {
+        await release();
+        return { ok: false, errorCode: "install_failed" };
+    }
     try {
         await input.onInstalling?.();
     }
@@ -77,6 +132,7 @@ export async function installExactDaemonUpdate(input) {
         "--ignore-scripts",
         "--no-audit",
         "--no-fund",
+        ...registryArgs,
         `@nowcrew/daemon@${input.targetVersion}`,
     ]).catch(() => null);
     if (result === null || result.exitCode !== 0) {
@@ -91,6 +147,10 @@ export async function installExactDaemonUpdate(input) {
         // Version verification is authoritative; unreadable package metadata is a mismatch.
     }
     if (installedVersion !== input.targetVersion) {
+        const restored = await restoreInstalledVersion(input, runner, previousVersion, registryArgs);
+        if (!restored) {
+            console.error(`[daemon-update] version verification failed; restore of ${previousVersion} was unsuccessful`);
+        }
         await release();
         return { ok: false, errorCode: "version_mismatch" };
     }

package/dist/external-output.js

@@ -8,9 +8,19 @@ function retainedMarkerPrefix(value, marker) {
     }
     return 0;
 }
+/**
+ * 跨 chunk 的契约标签流式解码器:push() 逐段返回标签内文本(供 answerStream 实时转发);
+ * 同时记住整轮里**最后一个完整闭合**的标签块(`lastClosedBlock`),供完结时作为契约答案——
+ * 只有闭合了的块才算数:半截块(被工具调用拆开的前半段)与叙述里提到的开标签
+ * ("我会把结论包在 <marker> 里,先去跑测试")都不会被当成答案(review of a027bf15, C1)。
+ * 所有 runtime 的文本都经此解码器(local-executor 事件循环),因此"后到者胜"在
+ * 覆盖式与增量式 runtime 上语义一致。
+ */
 export class ExternalAnswerDecoder {
     state = "outside";
     pending = "";
+    block = "";
+    closed = null;
     push(text) {
         if (!text)
             return [];
@@ -21,16 +31,32 @@ export class ExternalAnswerDecoder {
     finish() {
         this.pending = "";
         this.state = "outside";
+        this.block = "";
         return [];
     }
+    /** 整轮里最后一个完整闭合的标签块(已 trim);没有闭合过任何块则为 null。 */
+    get lastClosedBlock() {
+        return this.closed;
+    }
     consume(value, output) {
         this.pending = "";
         const marker = this.state === "outside" ? EXTERNAL_ANSWER_OPEN : EXTERNAL_ANSWER_CLOSE;
         const markerAt = value.indexOf(marker);
         if (markerAt >= 0) {
-            if (this.state === "inside" && markerAt > 0)
-                output.push(value.slice(0, markerAt));
-            this.state = this.state === "outside" ? "inside" : "outside";
+            if (this.state === "inside") {
+                const head = value.slice(0, markerAt);
+                if (head)
+                    output.push(head);
+                const completed = `${this.block}${head}`.trim();
+                if (completed)
+                    this.closed = completed;
+                this.block = "";
+                this.state = "outside";
+            }
+            else {
+                this.block = "";
+                this.state = "inside";
+            }
             const remaining = value.slice(markerAt + marker.length);
             if (remaining)
                 this.consume(remaining, output);
@@ -39,14 +65,18 @@ export class ExternalAnswerDecoder {
         const retained = retainedMarkerPrefix(value, marker);
         const safe = retained > 0 ? value.slice(0, -retained) : value;
         this.pending = retained > 0 ? value.slice(-retained) : "";
-        if (this.state === "inside" && safe)
+        if (this.state === "inside" && safe) {
             output.push(safe);
+            this.block += safe;
+        }
     }
 }
 export function decodeExternalOutputEvent(runtime, event, decoder) {
     if (runtime === "claude") {
         const candidate = (event ?? {});
         const delta = candidate.event?.delta;
+        if (candidate.parent_tool_use_id != null)
+            return [];
         if (candidate.type !== "stream_event"
             || candidate.event?.type !== "content_block_delta"
             || delta?.type !== "text_delta"

package/dist/i18n.js

@@ -51,12 +51,14 @@ const zh = {
     "Upgraded daemon and restart request accepted for '{{name}}'. Verify with status.": "daemon 已升级，并已请求重启 '{{name}}'；请用 status 确认。",
     "Refused daemon upgrade for '{{name}}': {{reason}}": "已拒绝升级 daemon '{{name}}'：{{reason}}",
     "Upgraded daemon. Installed services were not restarted; pass --profile to restart one.": "daemon 已升级；已安装服务尚未重启，可传入 --profile 重启指定服务。",
+    "Cross-channel daemon upgrade requires --profile so the server environment can be verified": "跨发布渠道升级 daemon 需要传入 --profile，以便校验服务端环境。",
     "Service lifecycle requires the built daemon entry (.js), not a TypeScript development entry": "服务生命周期必须使用已构建的 daemon 入口（.js），不能使用 TypeScript 开发入口",
+    "Installed daemon release tag '{{installed}}' does not match profile '{{profile}}' release tag '{{target}}'": "已安装 daemon 的发布标签 '{{installed}}' 与配置 '{{profile}}' 要求的发布标签 '{{target}}' 不一致",
     "Installed '{{id}}'. Use status to confirm runtime state.": "已安装 '{{id}}'；请用 status 确认运行状态。",
     "Uninstalled '{{id}}'.": "已卸载 '{{id}}'。",
     "{{action}} request accepted for '{{id}}'. Verify with status.": "已接受对 '{{id}}' 的 {{action}} 请求；请用 status 确认。",
     "--token-stdin requires a token on standard input": "--token-stdin 需要从标准输入读取令牌",
-    "Service lifecycle requires a global @nowcrew/daemon install; run npm install --global @nowcrew/daemon@latest": "服务生命周期需要全局安装 @nowcrew/daemon；请运行 npm install --global @nowcrew/daemon@latest",
+    "Service lifecycle requires a global @nowcrew/daemon install; run npm install --global @nowcrew/daemon@{{tag}}": "服务生命周期需要全局安装 @nowcrew/daemon；请运行 npm install --global @nowcrew/daemon@{{tag}}",
     "Profile '{{profile}}' conflicts with profile '{{conflict}}': both resolve to agents root '{{agentsRoot}}'. Save it with a unique root, for example: {{command}}": "配置 '{{profile}}' 与配置 '{{conflict}}' 解析到了同一个 agents root '{{agentsRoot}}'。请保存为唯一目录，例如：{{command}}",
     "Daemon is already running (PID={{ownerPid}}) for agents root '{{agentsRoot}}'. Journal: '{{journalPath}}'. Do not delete the active journal lock. Stop the existing daemon before retrying. If this profile is managed as a service, use 'crew-daemon stop --profile {{profileName}}' or 'crew-daemon restart --profile {{profileName}}'.": "daemon 已在运行（PID={{ownerPid}}），agents root 为 '{{agentsRoot}}'。日志目录：'{{journalPath}}'。不要删除活跃进程持有的 journal 锁。请先停止现有 daemon 再重试；如果此 profile 由系统服务管理，请使用 'crew-daemon stop --profile {{profileName}}' 或 'crew-daemon restart --profile {{profileName}}'。",
     "Daemon is already running (PID={{ownerPid}}) for agents root '{{agentsRoot}}'. Journal: '{{journalPath}}'. Do not delete the active journal lock. Stop the existing daemon before retrying. If it is managed as a service, use 'crew-daemon stop --profile <name>' or 'crew-daemon restart --profile <name>'.": "daemon 已在运行（PID={{ownerPid}}），agents root 为 '{{agentsRoot}}'。日志目录：'{{journalPath}}'。不要删除活跃进程持有的 journal 锁。请先停止现有 daemon 再重试；如果它由系统服务管理，请使用 'crew-daemon stop --profile <name>' 或 'crew-daemon restart --profile <name>'。",

package/dist/list-models.js

@@ -1,6 +1,7 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { isWin } from "./platform.js";
+import { listClaudeModels } from "./runtimes/claude-models.js";
 import { listHermesModels } from "./runtimes/hermes-models.js";
 const execFileRaw = promisify(execFile);
 const MODEL_PROBE_TIMEOUT_MS = 8_000;
@@ -30,23 +31,6 @@ export async function listRuntimeModels(runtime, options = {}) {
             return null;
     }
 }
-/** claude CLI 没有模型枚举命令,但 `--model` 的族别名(fable/opus/sonnet/haiku)恒指
- *  本机已装 CLI 版本的最新对应模型(2.1.252 帮助与二进制文案实证)——上报别名即
- *  「上报本机 claude 实际可用的模型」,CLI 升级零维护、永不过期。
- *  `--version` 只作安装探测(未安装/不可执行时抛错,由上层回落到 server 静态兜底),
- *  版本号拼进展示名让用户看得到清单来自哪台机器的哪个 CLI。
- *  思考强度不在此上报:claude 的 --effort 档位由 web 端 REASONING_CATALOG 静态维护。 */
-async function listClaudeModels() {
-    const rawVersion = (await execFileP("claude", ["--version"])).stdout.trim();
-    const version = rawVersion.replace(/\s*\(Claude Code\)\s*$/, "").trim();
-    const suffix = version ? ` · Claude Code ${version}` : "";
-    return [
-        { id: "fable", label: `Fable (latest)${suffix}` },
-        { id: "sonnet", label: `Sonnet (latest)${suffix}`, default: true },
-        { id: "opus", label: `Opus (latest)${suffix}` },
-        { id: "haiku", label: `Haiku (latest)${suffix}` },
-    ];
-}
 function parseCodexModels(stdout) {
     try {
         const parsed = JSON.parse(stdout);

package/dist/local-executor.js

@@ -27,42 +27,11 @@ import { ProjectProjectionError, } from "./project-skills/reconciler.js";
 import { formatProjectSkillRuntimeWarning } from "./project-skills/runtime-warning.js";
 import { projectSkillRuntimeDirectories, redactProjectSkillRuntimeRootText, redactProjectSkillRuntimeRootValue, } from "./project-skills/runtime-launch.js";
 import { logIdentityRosterRuntimePrepared } from "./identity-roster-telemetry.js";
-import { diffMemoryPruneNotes, evaluateMemoryPrunePostcondition, inspectMemoryPruneFilesWithinDeadline, parseMemoryPruneTraceId, } from "./memory-prune-diagnostics.js";
+import { diffMemoryPruneNotes, evaluateMemoryPrunePostcondition, inspectMemoryPruneFilesWithinDeadline, logMemoryPruneDiagnosticsFailure, memoryPruneSnapshotFields, parseMemoryPruneTraceId, } from "./memory-prune-diagnostics.js";
 import { createLocalMemoryTelemetry, logLocalMemoryContextPrepareFailure, logLocalMemoryDiagnosticsFailure, } from "./local-memory-telemetry.js";
 import { CodexStartupStageParser } from "./codex-startup-stage.js";
 import { formatRuntimeStartupError } from "./runtime-startup-error.js";
 import { commitLocalMemoryResultAfterExit, initializeLocalMemoryV2ForWorkspace, isLocalMemoryV2Eligible, localMemoryResultPath as makeLocalMemoryResultPath, renderLocalMemoryResultInstructions, } from "./local-memory/runtime.js";
-function memoryPruneFileFactFields(fileFacts) {
-    const fields = {};
-    for (const [label, fact] of Object.entries(fileFacts)) {
-        fields[`${label}_exists`] = fact.exists;
-        fields[`${label}_size`] = fact.size;
-        fields[`${label}_mtime_ms`] = fact.mtime_ms;
-        fields[`${label}_sha256`] = fact.sha256;
-        fields[`${label}_hash_skipped_reason`] = fact.hash_skipped_reason;
-        fields[`${label}_error`] = fact.error;
-        fields[`${label}_markdown_heading_count`] = fact.markdown_heading_count;
-        fields[`${label}_lessons_reference_count`] = fact.lessons_reference_count;
-        fields[`${label}_same_as_shared_path`] = fact.same_as_shared_path;
-    }
-    return fields;
-}
-function memoryPruneSnapshotFields({ notes_manifest: _notesManifest, ...fileFacts }) {
-    return memoryPruneFileFactFields(fileFacts);
-}
-function logMemoryPruneDiagnosticsFailure(input, traceId, phase, error) {
-    const errorCode = error?.code;
-    dslog("memory_prune.diagnostics_failed", "长期记忆收尾诊断失败", {
-        level: "WARN",
-        execution_id: input.executionId,
-        agent_handle: input.handle,
-        task_key: input.taskKey,
-        prune_trace_id: traceId,
-        diagnostics_phase: phase,
-        error_name: error instanceof Error ? error.name : "unknown",
-        error_code: errorCode,
-    });
-}
 export class RuntimeRunningCallbackTimeoutError extends Error {
     constructor(runtime, timeoutMs) {
         super(`${runtime} runtime-running callback timed out after ${timeoutMs}ms`);
@@ -732,6 +701,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         let observedModel = currentModel;
         let finalText = null;
         let sentViaCrew = false;
+        // 契约答案解码器:除了给 answerStream 实时转发,还记住整轮最后一个**闭合**的标签块。
+        // finalText 只保留"最后一条"助手消息,模型打完 <nowwork_external_answer> 标签后若又干了
+        // 别的(如顺手 git commit),收尾消息会覆盖 finalText,只从 finalText 提取就把已履约的
+        // 结论整段丢掉——server 回落 finalText 后频道里只剩无标签的尾声
+        // (incident: 2026-09-02, boss-alarm 排查结论未投递)。所有 runtime 的文本都喂给它。
         const externalOutput = new ExternalAnswerDecoder();
         // 每轮独立:tool_use/result 关联状态不能跨 execution 泄漏。
         const consoleFormatter = createConsoleFormatter();
@@ -1011,8 +985,14 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             finalText: input.captureFinal && finalText !== null
                 ? stripExternalAnswerMarkers(finalText)
                 : null,
-            externalAnswer: input.captureFinal && finalText !== null
-                ? extractExternalAnswer(finalText)
+            // 契约答案 = 整轮最后一个闭合的标签块(六个 runtime 语义一致的"后到者胜",半截块与
+            // 叙述里的开标签不算数);从未闭合过时才回落到对 finalText 的宽容提取,保住"收尾被
+            // 截断"这一老兜底。解码器存的是原文,这里补脱敏。注意这放宽了"externalAnswer 非空
+            // ⇒ finalText 非空"的旧不变式;是否上报仍由 execution-runner 按 exitCode===0 把关。
+            externalAnswer: input.captureFinal
+                ? (externalOutput.lastClosedBlock !== null
+                    ? redactProjectSkillRuntimeRootText(externalOutput.lastClosedBlock, activeProjectSkillRuntimeRoot)
+                    : finalText !== null ? extractExternalAnswer(finalText) : null)
                 : null,
             sentViaCrew,
         };

package/dist/machine-info.js

@@ -20,6 +20,7 @@ import { probeOpenCodeRun } from "./runtimes/opencode.js";
 import { RUNTIME_HEALTH_PROBE_CAPABILITY } from "./runtime-health.js";
 import { probeDeepSeekHarnessAcp } from "./runtimes/deepseek-harness.js";
 import { daemonHome } from "./computer-profile.js";
+import { daemonReleaseProvenance } from "./release-provenance.js";
 export { executableRuntimes } from "./runtime-capabilities.js";
 const execFileP = promisify(execFile);
 export const PROJECT_WORKSPACES_CAPABILITY = "project_workspaces_v1";
@@ -182,6 +183,15 @@ export async function collectMachineHello(agentsRoot, executionLimits, runtimePl
         hostname: hostname(),
         os: `${osPlatform()} ${arch()}`,
         daemonVersion: daemonVersion(),
+        ...(() => {
+            const provenance = daemonReleaseProvenance(daemonVersion());
+            return {
+                releaseChannel: provenance.releaseChannel,
+                releaseTag: provenance.releaseTag,
+                ...(provenance.gitSha === null ? {} : { gitSha: provenance.gitSha }),
+                ...(provenance.artifactDigest === null ? {} : { artifactDigest: provenance.artifactDigest }),
+            };
+        })(),
         runtimes,
         executionRuntimes,
         capabilities,

package/dist/main.js

@@ -11,6 +11,8 @@ import { join } from "node:path";
 import { loadConfig, ConfigError } from "./config.js";
 import { detectDaemonLang, formatDaemonText, translateDaemon } from "./i18n.js";
 import { cliVersion, daemonVersion } from "./machine-info.js";
+import { daemonReleaseProvenance } from "./release-provenance.js";
+import { assertReleaseTagForServerUrl } from "./automatic-install-target.js";
 import { runAgent } from "./runner.js";
 import { serve } from "./serve.js";
 import { initSlog, flushSlog } from "./slog.js";
@@ -57,11 +59,12 @@ async function main() {
             "daemon-home": { type: "string" },
         },
     });
-    // 无子命令时默认 serve(对齐 `npx @nowcrew/daemon@latest --server-url ... --api-key ...`)
+    // 无子命令时默认 serve(对齐当前发布 channel 的 npx 入口)
     const cmd = positionals[0] ?? "serve";
     if (cmd !== "run" && cmd !== "serve") {
+        const releaseTag = daemonReleaseProvenance(daemonVersion()).releaseTag;
         process.stderr.write(td("Usage:") + "\n" +
-            "  npx @nowcrew/daemon@latest --server-url <url> --api-key <sk_machine_*>   # " + td("connect and stay resident") + "\n" +
+            `  npx @nowcrew/daemon@${releaseTag} --server-url <url> --api-key <sk_machine_*>   # ` + td("connect and stay resident") + "\n" +
             "  crew-daemon run --agent <h> --channel <id> [--wake ...]                  # " + td("run once manually") + "\n");
         process.exit(2);
     }
@@ -112,8 +115,10 @@ async function main() {
         }
         throw e;
     }
+    const provenance = daemonReleaseProvenance(daemonVersion());
+    assertReleaseTagForServerUrl(config.serverUrl, provenance.releaseTag);
     if (cmd === "serve") {
-        process.stdout.write(formatDaemonLogLine(`🛰️  crew-daemon v${daemonVersion()} (cli v${cliVersion()}) ${td("resident, connecting to")} ${config.serverUrl} ${td("control plane")}...`) + "\n");
+        process.stdout.write(formatDaemonLogLine(`🛰️  crew-daemon v${daemonVersion()} (cli v${cliVersion()}, ${provenance.releaseChannel}/${provenance.releaseTag}) ${td("resident, connecting to")} ${config.serverUrl} ${td("control plane")}...`) + "\n");
         const installation = values.profile === undefined
             ? null
             : daemonGlobalInstallation(builtDaemonEntry(), process.platform);
@@ -199,6 +204,10 @@ async function main() {
     initSlog(config.serverUrl, config.machineToken, {
         daemonVersion: daemonVersion(),
         cliVersion: cliVersion(),
+        releaseChannel: provenance.releaseChannel,
+        releaseTag: provenance.releaseTag,
+        gitSha: provenance.gitSha,
+        artifactDigest: provenance.artifactDigest,
         ...(values.profile === undefined ? {} : { profileName: values.profile }),
         agentsRoot: config.agentsRoot,
     }); // 一次性 run 模式也上报 SLS(runner 里的埋点生效)

package/dist/memory-prune-diagnostics.js

@@ -3,6 +3,7 @@ import { createReadStream } from "node:fs";
 import { lstat, readdir } from "node:fs/promises";
 import { join } from "node:path";
 import { StringDecoder } from "node:string_decoder";
+import { dslog } from "./slog.js";
 const TRACE_PATTERN = /\[memory-prune trace_id=([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\]/i;
 export const MEMORY_PRUNE_HASH_LIMIT_BYTES = 10 * 1024 * 1024;
 export const MEMORY_PRUNE_NOTES_MANIFEST_LIMIT = 128;
@@ -391,3 +392,35 @@ export function evaluateMemoryPrunePostcondition(before, after, execution) {
         outcome = "no_files_changed";
     return { outcome, ...facts };
 }
+// —— 收尾诊断的 SLS 字段拍平与失败日志(自 local-executor 迁入,签名用结构子集避免类型回环) ——
+function memoryPruneFileFactFields(fileFacts) {
+    const fields = {};
+    for (const [label, fact] of Object.entries(fileFacts)) {
+        fields[`${label}_exists`] = fact.exists;
+        fields[`${label}_size`] = fact.size;
+        fields[`${label}_mtime_ms`] = fact.mtime_ms;
+        fields[`${label}_sha256`] = fact.sha256;
+        fields[`${label}_hash_skipped_reason`] = fact.hash_skipped_reason;
+        fields[`${label}_error`] = fact.error;
+        fields[`${label}_markdown_heading_count`] = fact.markdown_heading_count;
+        fields[`${label}_lessons_reference_count`] = fact.lessons_reference_count;
+        fields[`${label}_same_as_shared_path`] = fact.same_as_shared_path;
+    }
+    return fields;
+}
+export function memoryPruneSnapshotFields({ notes_manifest: _notesManifest, ...fileFacts }) {
+    return memoryPruneFileFactFields(fileFacts);
+}
+export function logMemoryPruneDiagnosticsFailure(input, traceId, phase, error) {
+    const errorCode = error?.code;
+    dslog("memory_prune.diagnostics_failed", "长期记忆收尾诊断失败", {
+        level: "WARN",
+        execution_id: input.executionId,
+        agent_handle: input.handle,
+        task_key: input.taskKey,
+        prune_trace_id: traceId,
+        diagnostics_phase: phase,
+        error_name: error instanceof Error ? error.name : "unknown",
+        error_code: errorCode,
+    });
+}

package/dist/npm-registry.js

@@ -0,0 +1,32 @@
+const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+function isLoopbackHostname(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+export function normalizeDaemonNpmRegistry(value, options = {}) {
+    const raw = value?.trim();
+    if (!raw)
+        return DEFAULT_NPM_REGISTRY;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error("npm registry must be an HTTPS URL without credentials");
+    }
+    if (!/^[A-Za-z0-9._~/%-]*$/u.test(parsed.pathname)) {
+        throw new Error("npm registry must be an HTTPS URL without credentials or unsafe path characters");
+    }
+    if ((parsed.protocol !== "https:" && !(parsed.protocol === "http:"
+        && isLoopbackHostname(parsed.hostname)
+        && options.allowLoopbackHttp === true))
+        || parsed.username !== ""
+        || parsed.password !== ""
+        || parsed.search !== ""
+        || parsed.hash !== "") {
+        throw new Error("npm registry must be an HTTPS URL without credentials");
+    }
+    return parsed.toString().replace(/\/+$/u, "");
+}
+export function npmRegistryArgs(value) {
+    return ["--registry", normalizeDaemonNpmRegistry(value)];
+}

package/dist/release-channel-guard.js

@@ -0,0 +1,60 @@
+import { cliVersion, daemonVersion } from "./machine-info.js";
+import { daemonReleaseProvenance } from "./release-provenance.js";
+import { dslog, initSlog } from "./slog.js";
+export function initReleaseSlog(input) {
+    const provenance = daemonReleaseProvenance(daemonVersion());
+    initSlog(input.serverUrl, input.machineToken, {
+        daemonVersion: daemonVersion(),
+        cliVersion: cliVersion(),
+        releaseChannel: provenance.releaseChannel,
+        releaseTag: provenance.releaseTag,
+        gitSha: provenance.gitSha,
+        artifactDigest: provenance.artifactDigest,
+        ...(input.profileName === undefined ? {} : { profileName: input.profileName }),
+        agentsRoot: input.agentsRoot,
+    });
+}
+export function reportReleaseChannelError(log) {
+    const provenance = daemonReleaseProvenance(daemonVersion());
+    log(`🛑 线上环境只允许正式版 daemon，当前 ${provenance.releaseTag} 包不可连接。`);
+    dslog("daemon.ws_release_rejected", "线上控制面拒绝非正式 daemon 包", {
+        level: "ERROR",
+        release_channel: provenance.releaseChannel,
+        release_tag: provenance.releaseTag,
+    });
+}
+export function reportReleaseArtifactError(log) {
+    log("🛑 daemon artifact digest 未通过 server allowlist，当前安装包不能连接控制面。");
+    dslog("daemon.ws_artifact_rejected", "控制面拒绝未获批准的 daemon artifact", {
+        level: "ERROR",
+    });
+}
+export function reportReleaseChannelClose(code, log) {
+    if (code !== 4002)
+        return false;
+    log("🛑 线上环境只允许正式版 daemon，beta 包不能连接控制面 (code 4002)。");
+    return true;
+}
+export function reportReleaseError(code, log) {
+    if (code === "DAEMON_RELEASE_CHANNEL_MISMATCH") {
+        reportReleaseChannelError(log);
+        return true;
+    }
+    if (code === "DAEMON_RELEASE_ARTIFACT_MISMATCH") {
+        reportReleaseArtifactError(log);
+        return true;
+    }
+    return false;
+}
+export function reportDaemonConnectionClose(code, log) {
+    if (code === 4001) {
+        log("🛑 控制面以鉴权失败关闭连接 (code 4001):机器凭证无效或已吊销。");
+        log("   请在 NowWork 重新 \"Add Computer\" 获取新连接命令再重跑(当前 --api-key 已失效)。");
+        return true;
+    }
+    if (code === 4003) {
+        reportReleaseArtifactError(log);
+        return true;
+    }
+    return reportReleaseChannelClose(code, log);
+}

package/dist/release-provenance.js

@@ -0,0 +1,87 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readdirSync, readFileSync } from "node:fs";
+import { basename, dirname, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { daemonReleaseChannel } from "./daemon-release-version.js";
+function validSha(value) {
+    return value !== undefined && /^[a-f0-9]{40}$/u.test(value) ? value : null;
+}
+function validDigest(value) {
+    return value !== undefined && /^[a-f0-9]{64}$/u.test(value) ? value : null;
+}
+function collectArtifactFiles(root, directory, files) {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        const absolutePath = resolve(directory, entry.name);
+        if (entry.isDirectory()) {
+            if (!collectArtifactFiles(root, absolutePath, files))
+                return false;
+            continue;
+        }
+        // Reject links and special files so local and packed artifacts share one
+        // regular-file-only digest contract.
+        if (!entry.isFile())
+            return false;
+        files.push({
+            relativePath: relative(root, absolutePath).split(sep).join("/"),
+            bytes: readFileSync(absolutePath),
+        });
+    }
+    return true;
+}
+function artifactDigestState(distDirectory) {
+    let distStat;
+    try {
+        distStat = lstatSync(distDirectory);
+    }
+    catch (error) {
+        return error.code === "ENOENT"
+            ? { exists: false, digest: null }
+            : { exists: true, digest: null };
+    }
+    if (!distStat.isDirectory())
+        return { exists: true, digest: null };
+    try {
+        const files = [];
+        if (!collectArtifactFiles(distDirectory, distDirectory, files))
+            return { exists: true, digest: null };
+        files.sort((a, b) => a.relativePath < b.relativePath ? -1 : a.relativePath > b.relativePath ? 1 : 0);
+        const hash = createHash("sha256");
+        for (const file of files) {
+            hash.update(file.relativePath, "utf8");
+            hash.update(Buffer.from([0]));
+            hash.update(file.bytes);
+            hash.update(Buffer.from([0]));
+        }
+        return { exists: true, digest: hash.digest("hex") };
+    }
+    catch {
+        return { exists: true, digest: null };
+    }
+}
+/** Compute the canonical content digest for a daemon dist directory. */
+export function computeArtifactContentSha256(distDirectory) {
+    return artifactDigestState(distDirectory).digest;
+}
+function defaultDistDirectory() {
+    const moduleDirectory = dirname(fileURLToPath(import.meta.url));
+    return basename(moduleDirectory) === "dist" ? moduleDirectory : resolve(moduleDirectory, "../dist");
+}
+export function daemonReleaseProvenance(version, env = process.env, options = {}) {
+    const channel = daemonReleaseChannel(version) ?? "stable";
+    const canonicalTag = channel === "beta" ? "beta" : "latest";
+    // The package version is the artifact identity. An inherited environment tag
+    // is advisory and must not create a stable/beta mismatch in hello logs.
+    const configuredTag = env.CREW_DAEMON_RELEASE_TAG;
+    const releaseTag = configuredTag === canonicalTag ? configuredTag : canonicalTag;
+    const localArtifact = artifactDigestState(options.distDirectory ?? defaultDistDirectory());
+    return Object.freeze({
+        packageName: "@nowcrew/daemon",
+        packageVersion: version,
+        releaseChannel: channel,
+        releaseTag,
+        gitSha: validSha(env.CREW_DAEMON_GIT_SHA),
+        artifactDigest: localArtifact.exists
+            ? localArtifact.digest
+            : validDigest(env.CREW_DAEMON_ARTIFACT_DIGEST),
+    });
+}