@nowcrew/daemon 0.6.76 → 0.6.77-beta.10

package/dist/config.js

@@ -1,6 +1,6 @@
 /** daemon 配置:从 env 读取,解析 crew CLI 路径 (注入给 agent 的 wrapper 用)。 */
 import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { createRequire } from "node:module";
 import { detectDaemonLang, translateDaemon } from "./i18n.js";
@@ -28,6 +28,23 @@ export const MIN_EXECUTION_EVENT_BYTES = 512;
 export const MAX_EXECUTION_TIMEOUT_MS = 2_147_483_647;
 export class ConfigError extends Error {
 }
+/**
+ * Resolve the shared workspace repository root from the daemon's agent root.
+ *
+ * Standard NowWork storage keeps `agent-items`, `daemon`, `repos`, and the QA
+ * report hub as siblings. Legacy/standalone profiles may still point at an
+ * arbitrary agents directory, for which the historical `<agentsRoot>/repos`
+ * layout remains the compatible fallback.
+ */
+export function resolveReposRoot(agentsRoot, configured) {
+    const explicit = configured?.trim();
+    if (explicit)
+        return resolve(explicit);
+    const resolvedAgentsRoot = resolve(agentsRoot);
+    return basename(resolvedAgentsRoot) === "agent-items"
+        ? join(dirname(resolvedAgentsRoot), "repos")
+        : join(resolvedAgentsRoot, "repos");
+}
 function positiveIntegerEnv(env, field, fallback) {
     const raw = env[field];
     const value = raw === undefined ? fallback : Number(raw);
@@ -59,11 +76,11 @@ function defaultCliPath() {
         return resolve(here, "../../cli/dist/main.js");
     }
 }
-// 临时 dev 验收名单。测试完成后删除此常量，恢复未配置时默认关闭的行为。
+// 临时 dev 验收名单。这里必须填写 Server 生成的 Agent handle，而不是显示名称或频道 ID。
+// 测试完成后删除此常量，恢复未配置时默认关闭的行为。
 const TEMP_LOCAL_MEMORY_V2_TEST_HANDLES = [
-    "memory-v2-test-a",
-    "memory-v2-test-b",
-    "memory-v2-test-c",
+    "94533bf3-b5b7-4a1e-9c41-6a1ab0a0e1ea", // memory-v2-test-a
+    "967ab9ce-724c-4f22-a664-2f855cd798af", // memory-v2-test-b
 ];
 function isTemporaryDevServer(serverUrl) {
     try {
@@ -134,10 +151,21 @@ export function loadConfig(env = process.env) {
         maxFirstOutputWaitMs: positiveIntegerEnv(env, "CREW_EXECUTION_MAX_FIRST_OUTPUT_WAIT_MS", DEFAULT_EXECUTION_LIMITS.maxFirstOutputWaitMs),
         firstOutputGraceMs: positiveIntegerEnv(env, "CREW_EXECUTION_FIRST_OUTPUT_GRACE_MS", DEFAULT_EXECUTION_LIMITS.firstOutputGraceMs),
     });
+    const agentsRoot = resolveAgentsRoot(env.CREW_AGENTS_ROOT, homedir());
+    const configuredReposRoot = env.NOWWORK_REPOS_ROOT?.trim();
+    const reposRoot = resolveReposRoot(agentsRoot, configuredReposRoot);
+    const configuredQaReportRoot = env.QA_REPORT_HUB?.trim();
+    const defaultQaReportRoot = configuredReposRoot
+        ? join(dirname(reposRoot), "qa-report-server-v2")
+        : join(dirname(agentsRoot), "qa-report-server-v2");
     return {
         serverUrl,
         machineToken,
-        agentsRoot: resolveAgentsRoot(env.CREW_AGENTS_ROOT, homedir()),
+        agentsRoot,
+        reposRoot,
+        qaReportRoot: configuredQaReportRoot
+            ? resolve(configuredQaReportRoot)
+            : defaultQaReportRoot,
         cliPath: env.CREW_CLI_PATH ?? defaultCliPath(),
         runtimeBin: env.CREW_RUNTIME ?? "claude",
         codexHomeMode: codexHomeModeEnv(env),

package/dist/daemon-installation-lease.js

@@ -3,6 +3,7 @@ import { realpathSync } from "node:fs";
 import { mkdir, open } from "node:fs/promises";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 import { defaultProcessController } from "./execution-journal.js";
 import { createJournalLease, createJournalLeaseRegistry, inspectJournalLock, } from "./execution-journal-lock.js";
 const registry = createJournalLeaseRegistry();
@@ -18,9 +19,10 @@ function canonicalPrefix(npmPrefix) {
         return absolute;
     }
 }
-function leaseDirectory(npmPrefix, userHome) {
+function leaseDirectory(npmPrefix, userHome, localHome) {
     const fingerprint = createHash("sha256").update(resolve(npmPrefix)).digest("hex");
-    return resolve(userHome, ".crew", "daemon", "managed-services", "installation-leases", fingerprint);
+    const root = localHome ?? resolveDaemonLocalStateRoot({ userHome, platform: process.platform });
+    return resolve(root, "daemon", "managed-services", "installation-leases", fingerprint);
 }
 async function syncDirectory(path) {
     if (process.platform === "win32")
@@ -35,7 +37,8 @@ async function syncDirectory(path) {
 }
 export async function acquireDaemonInstallationLease(npmPrefix, options = {}) {
     const normalizedPrefix = canonicalPrefix(npmPrefix);
-    const directory = leaseDirectory(normalizedPrefix, options.userHome ?? homedir());
+    const userHome = options.userHome ?? homedir();
+    const directory = leaseDirectory(normalizedPrefix, userHome, options.localHome);
     await mkdir(directory, { recursive: true, mode: 0o700 });
     const lease = createJournalLease({
         directory,
@@ -75,7 +78,7 @@ export function daemonInstallationLeaseHeld(npmPrefix) {
 export async function inspectDaemonInstallationLease(npmPrefix, options = {}) {
     const normalizedPrefix = canonicalPrefix(npmPrefix);
     return inspectJournalLock({
-        directory: leaseDirectory(normalizedPrefix, options.userHome ?? homedir()),
+        directory: leaseDirectory(normalizedPrefix, options.userHome ?? homedir(), options.localHome),
         inspectIdentity: options.inspectIdentity ?? defaultProcessController.inspectIdentity,
     });
 }

package/dist/daemon-local-home.js

@@ -0,0 +1,108 @@
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
+const CONTROL = /[\0\r\n]/u;
+const pathsFor = (platform) => platform === "win32" ? win32 : posix;
+export function parseDaemonLocalHomeMode(value) {
+    if (value === undefined || value.trim() === "")
+        return "auto";
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "auto" || normalized === "nowwork" || normalized === "legacy")
+        return normalized;
+    throw new Error("NOWWORK_LOCAL_HOME_MODE must be auto, nowwork or legacy");
+}
+function absoluteRoot(value, userHome, platform) {
+    const paths = pathsFor(platform);
+    if (value.length === 0 || CONTROL.test(value))
+        throw new Error("NOWWORK_LOCAL_HOME must be a non-empty single-line path");
+    const expanded = value === "~"
+        ? userHome
+        : value.startsWith("~/") || (platform === "win32" && value.startsWith("~\\"))
+            ? paths.join(userHome, value.slice(2))
+            : value;
+    if (!paths.isAbsolute(expanded))
+        throw new Error("NOWWORK_LOCAL_HOME must be absolute or start with '~/'");
+    return paths.normalize(expanded);
+}
+function legacyDaemonDirectory(profile) {
+    if (profile === "in" || profile === "production")
+        return "daemon";
+    if (profile === "dev")
+        return "daemon-dev";
+    if (profile.startsWith("nw-"))
+        return `daemon-${profile.slice(3)}`;
+    return `daemon-${profile}`;
+}
+function resolution(mode, root, profile, platform, source) {
+    const paths = pathsFor(platform);
+    return Object.freeze({
+        mode,
+        root,
+        daemonHome: mode === "nowwork" ? paths.join(root, "config") : paths.join(root, legacyDaemonDirectory(profile)),
+        runtimePrefix: paths.join(root, "daemon-runtimes", profile),
+        source,
+    });
+}
+export function resolveDaemonLocalHome(input) {
+    if (!PROFILE.test(input.profile))
+        throw new Error("daemon profile is invalid");
+    const mode = parseDaemonLocalHomeMode(input.mode);
+    const paths = pathsFor(input.platform);
+    const nowworkRoot = absoluteRoot(input.explicit ?? paths.join(input.userHome, ".nowwork"), input.userHome, input.platform);
+    const legacyRoot = absoluteRoot(paths.join(input.userHome, ".crew"), input.userHome, input.platform);
+    if (input.explicit !== undefined && mode !== "legacy") {
+        return resolution("nowwork", nowworkRoot, input.profile, input.platform, "explicit");
+    }
+    if (mode === "nowwork")
+        return resolution("nowwork", nowworkRoot, input.profile, input.platform, "nowwork_forced");
+    if (mode === "legacy")
+        return resolution("legacy", legacyRoot, input.profile, input.platform, "legacy_forced");
+    const exists = input.exists ?? existsSync;
+    const nowwork = resolution("nowwork", nowworkRoot, input.profile, input.platform, "auto_nowwork_existing");
+    const legacy = resolution("legacy", legacyRoot, input.profile, input.platform, "auto_legacy_existing");
+    const hasNowwork = exists(nowwork.runtimePrefix) || exists(paths.join(nowwork.daemonHome, "profiles", `${input.profile}.json`));
+    const hasLegacy = exists(legacy.runtimePrefix) || exists(paths.join(legacy.daemonHome, "profiles", `${input.profile}.json`));
+    if (hasNowwork && hasLegacy) {
+        throw new Error(`Daemon local home conflict: profile '${input.profile}' exists under both .crew and .nowwork`);
+    }
+    if (hasNowwork)
+        return nowwork;
+    if (hasLegacy)
+        return legacy;
+    return resolution("nowwork", nowworkRoot, input.profile, input.platform, "auto_new");
+}
+/**
+ * Resolve the local machine state root shared by service metadata, leases,
+ * host coordination and offline logs. It intentionally stays separate from
+ * NOWWORK_HOME, which may point at a NAS persistent data root.
+ */
+export function resolveDaemonLocalStateRoot(input) {
+    const paths = pathsFor(input.platform);
+    const mode = parseDaemonLocalHomeMode(input.mode);
+    const nowworkRoot = absoluteRoot(input.explicit ?? paths.join(input.userHome, ".nowwork"), input.userHome, input.platform);
+    const legacyRoot = absoluteRoot(paths.join(input.userHome, ".crew"), input.userHome, input.platform);
+    if (mode === "legacy")
+        return legacyRoot;
+    if (input.explicit !== undefined || mode === "nowwork")
+        return nowworkRoot;
+    const exists = input.exists ?? existsSync;
+    // Once the new root exists, shared state must follow it even while the
+    // legacy root is retained as a rollback source.
+    if (exists(nowworkRoot))
+        return nowworkRoot;
+    if (exists(legacyRoot))
+        return legacyRoot;
+    return nowworkRoot;
+}
+export function resolveDaemonLocalStateRootFromEnv(input = {}) {
+    const environment = input.environment ?? process.env;
+    return resolveDaemonLocalStateRoot({
+        userHome: input.userHome ?? homedir(),
+        platform: input.platform ?? process.platform,
+        ...(environment.NOWWORK_LOCAL_HOME === undefined ? {} : { explicit: environment.NOWWORK_LOCAL_HOME }),
+        ...(environment.NOWWORK_LOCAL_HOME_MODE === undefined && environment.NOWWORK_STORAGE_MODE === undefined
+            ? {}
+            : { mode: environment.NOWWORK_LOCAL_HOME_MODE ?? environment.NOWWORK_STORAGE_MODE }),
+    });
+}

package/dist/daemon-migration-controller.js

@@ -21,6 +21,9 @@ const MigrationMessageSchema = z.object({
 function migrationBackupRoot(input, id) {
     return resolve(input.backupRoot ?? resolve(input.userHome ?? homedir(), ".crew", "migration-backups"), id);
 }
+function legacyLocalHome(input) {
+    return resolve(input.userHome ?? homedir(), ".crew");
+}
 async function assertEmptyOrMissing(path) {
     try {
         const entries = await readdir(path);
@@ -77,10 +80,10 @@ async function backupAndCopy(input, id, targetHome, targetAgents, service) {
 }
 async function cleanupCurrentServiceDefault(spec, input) {
     const userHome = input.userHome ?? homedir();
-    const records = await readManagedServiceRegistry({ userHome });
+    const records = await readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) });
     const record = records.find((candidate) => candidate.profile === spec.profile && candidate.daemonHome === input.currentDaemonHome);
     if (record !== undefined && (spec.platform === "darwin" || spec.platform === "linux")) {
-        await uninstallManagedService({ spec, record, runner: systemCommandRunner, registry: { userHome } });
+        await uninstallManagedService({ spec, record, runner: systemCommandRunner, registry: { userHome, localHome: legacyLocalHome(input) } });
         return;
     }
     // Windows and legacy descriptors are handled by the normal CLI/service lifecycle.
@@ -125,7 +128,15 @@ export function createDaemonMigrationController(input) {
                 if (currentProfile.machineToken !== input.machineToken)
                     throw new Error("active profile token does not match this daemon");
                 currentRegistryUrl = currentProfile.registryUrl;
-                const target = resolveAutomaticInstallTarget({ serverUrl: input.serverUrl, requestedProfile: message.targetProfile, userHome, platform });
+                const target = resolveAutomaticInstallTarget({
+                    serverUrl: input.serverUrl,
+                    requestedProfile: message.targetProfile,
+                    userHome,
+                    platform,
+                    // This controller migrates the legacy service layout; the new local-home
+                    // standard is handled by the storage migration controller.
+                    requestedLocalHomeMode: "legacy",
+                });
                 if (!isAbsolute(message.targetDaemonHome) || !isAbsolute(message.targetAgentsRoot)
                     || resolve(message.targetDaemonHome) !== resolve(target.daemonHome)
                     || resolve(message.targetAgentsRoot) !== resolve(target.agentsRoot))
@@ -140,7 +151,7 @@ export function createDaemonMigrationController(input) {
                     throw new Error("current managed service identity is not exact and running");
                 currentService = { installed: exact.installed, running: exact.running };
                 if (platform === "darwin" || platform === "linux") {
-                    const records = await (input.readManagedRecords ?? (() => readManagedServiceRegistry({ userHome })))();
+                    const records = await (input.readManagedRecords ?? (() => readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) })))();
                     managedRecord = records.find((record) => record.serviceId === currentSpec.id && record.profile === input.profileName && record.daemonHome === input.currentDaemonHome) ?? null;
                     if (managedRecord === null)
                         throw new Error("current managed service registry record is missing");

package/dist/daemon-registry.js

@@ -0,0 +1,20 @@
+import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
+export const DAEMON_PUBLIC_NPM_REGISTRY = normalizeDaemonNpmRegistry();
+export const DAEMON_PUBLIC_NPM_MIRROR = "https://registry.npmmirror.com";
+/** Keep every daemon package operation on the same ordered, channel-safe sources. */
+export function daemonRegistryCandidates(input) {
+    try {
+        const requested = input.registryUrl ?? input.env?.CREW_NPM_REGISTRY;
+        const configured = requested === undefined
+            ? DAEMON_PUBLIC_NPM_REGISTRY
+            : normalizeDaemonNpmRegistry(requested, { allowLoopbackHttp: input.betaUpdate });
+        return [...new Set([
+                configured,
+                DAEMON_PUBLIC_NPM_REGISTRY,
+                ...(input.betaUpdate ? [DAEMON_PUBLIC_NPM_MIRROR] : []),
+            ])];
+    }
+    catch {
+        return null;
+    }
+}

package/dist/daemon-update-controller.js

@@ -30,6 +30,7 @@ export function createDaemonUpdateController(deps) {
                 targetVersion: message.targetVersion,
                 packageRoot: eligibility.packageRoot,
                 npmPrefix: eligibility.npmPrefix,
+                ...(eligibility.registryUrl === undefined ? {} : { registryUrl: eligibility.registryUrl }),
                 onInstalling: () => {
                     deps.sendStatus({ type: "daemon:update-status", updateId: message.updateId, status: "installing" });
                 },

package/dist/daemon-update-eligibility.js

@@ -9,6 +9,7 @@ import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { daemonInstallationLeaseHeld } from "./daemon-installation-lease.js";
 import { inspectLegacyServiceInstallation } from "./legacy-service-installation.js";
 import { inspectWindowsServiceUpdateScope } from "./windows-scheduled-task.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, serviceDescriptorSha256, } from "./managed-service-registry.js";
 export async function managedDaemonCapabilities(eligibility) {
     try {
@@ -20,24 +21,31 @@ export async function managedDaemonCapabilities(eligibility) {
         return [];
     }
 }
-function defaults() {
+function defaults(profileName) {
+    const userHome = homedir();
+    const localHome = resolveDaemonLocalStateRoot({
+        userHome,
+        platform: process.platform,
+        explicit: process.env.NOWWORK_LOCAL_HOME,
+        mode: process.env.NOWWORK_LOCAL_HOME_MODE ?? process.env.NOWWORK_STORAGE_MODE,
+    });
     return {
         platform: process.platform,
-        profileHome: daemonHome(),
-        userHome: homedir(),
+        profileHome: daemonHome(process.env, profileName),
+        userHome,
         uid: process.getuid?.(),
         nodePath: process.execPath,
         entryPath: builtDaemonEntry(),
         loadProfile,
-        readManagedServices: () => readManagedServiceRegistry(),
-        listManagedDescriptorPaths: () => listManagedServiceDescriptorPaths(process.platform, homedir()),
+        readManagedServices: () => readManagedServiceRegistry({ userHome, localHome }),
+        listManagedDescriptorPaths: () => listManagedServiceDescriptorPaths(process.platform, userHome),
         readServiceDescriptor,
         serviceStatus,
         assertWritable: (path) => access(path, constants.W_OK),
         installationLeaseHeld: daemonInstallationLeaseHeld,
         installationRealpath: realpathSync.native,
         inspectWindowsServiceUpdateScope,
-        inspectLegacyDescriptorInstallation: (descriptorPath) => inspectLegacyServiceInstallation(descriptorPath, process.platform, homedir(), process.getuid?.()),
+        inspectLegacyDescriptorInstallation: (descriptorPath) => inspectLegacyServiceInstallation(descriptorPath, process.platform, userHome, process.getuid?.()),
     };
 }
 async function registryCoversUpdateScope(services, descriptorPaths, targetDescriptorPath, npmPrefix, inspectLegacyDescriptorInstallation) {
@@ -57,7 +65,7 @@ async function registryCoversUpdateScope(services, descriptorPaths, targetDescri
     return true;
 }
 export async function detectDaemonUpdateEligibility(profileName, overrides = {}) {
-    const deps = { ...defaults(), ...overrides };
+    const deps = { ...defaults(profileName), ...overrides };
     if (deps.platform !== "darwin" && deps.platform !== "linux" && deps.platform !== "win32") {
         return { eligible: false, reason: "unsupported_platform" };
     }
@@ -109,6 +117,7 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
             eligible: true,
             profileName,
             ...installation,
+            ...(profile.registryUrl === undefined ? {} : { registryUrl: profile.registryUrl }),
             serviceSpec: { ...spec, runtimeProcessIdentity: scope.processIdentity },
         };
     }
@@ -188,6 +197,7 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
         eligible: true,
         profileName,
         ...installation,
+        ...(profile.registryUrl === undefined ? {} : { registryUrl: profile.registryUrl }),
         serviceSpec: selectedSpec,
     };
 }

package/dist/daemon-updater.js

@@ -3,17 +3,13 @@ import { resolve } from "node:path";
 import { systemCommandRunner } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { daemonReleaseChannel, isDaemonReleaseVersion } from "./daemon-release-version.js";
-import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
-function configuredRegistryArgs(allowLoopbackHttp) {
-    try {
-        return process.env.CREW_NPM_REGISTRY === undefined ? [] : [
-            "--registry",
-            normalizeDaemonNpmRegistry(process.env.CREW_NPM_REGISTRY, { allowLoopbackHttp }),
-        ];
-    }
-    catch {
-        return null;
-    }
+import { daemonRegistryCandidates } from "./daemon-registry.js";
+import { npmInvocation } from "./npm-command.js";
+function registryArgs(registry) {
+    return ["--registry", registry];
+}
+function isRegistryAuthFailure(stderr) {
+    return /(?:\bE401\b|\b401\b.*\bUnauthorized\b)/iu.test(stderr);
 }
 export async function prepareDaemonRestart(input) {
     const local = input.localSlots.tryAcquireExclusive();
@@ -40,10 +36,11 @@ async function readPackageVersion(packageRoot) {
     const body = JSON.parse(await readFile(resolve(packageRoot, "package.json"), "utf8"));
     return typeof body.version === "string" ? body.version : "";
 }
-async function restoreInstalledVersion(input, runner, version, registryArgs) {
+async function restoreInstalledVersion(input, runner, command, commandPrefix, version, registryArgs) {
     if (!isDaemonReleaseVersion(version))
         return false;
-    const result = await runner((input.platform ?? process.platform) === "win32" ? "npm.cmd" : "npm", [
+    const result = await runner(command, [
+        ...commandPrefix,
         "install",
         "--global",
         "--prefix",
@@ -98,6 +95,10 @@ export async function installExactDaemonUpdate(input) {
         return { ok: false, errorCode: "ineligible" };
     }
     const runner = input.runner ?? systemCommandRunner;
+    const platform = input.platform ?? process.platform;
+    const npm = npmInvocation(platform, input.nodePath ?? process.execPath);
+    const command = npm.command;
+    const commandPrefix = npm.argsPrefix;
     let previousVersion = "";
     try {
         previousVersion = await (input.readInstalledVersion ?? readPackageVersion)(input.packageRoot);
@@ -111,9 +112,13 @@ export async function installExactDaemonUpdate(input) {
         await release();
         return { ok: false, errorCode: "install_failed" };
     }
-    const registryArgs = configuredRegistryArgs(daemonReleaseChannel(previousVersion) === "beta"
-        || daemonReleaseChannel(input.targetVersion) === "beta");
-    if (registryArgs === null) {
+    const registries = daemonRegistryCandidates({
+        betaUpdate: daemonReleaseChannel(previousVersion) === "beta"
+            || daemonReleaseChannel(input.targetVersion) === "beta",
+        ...(input.registryUrl === undefined ? {} : { registryUrl: input.registryUrl }),
+        env: process.env,
+    });
+    if (registries === null) {
         await release();
         return { ok: false, errorCode: "install_failed" };
     }
@@ -124,20 +129,41 @@ export async function installExactDaemonUpdate(input) {
         await release();
         return { ok: false, errorCode: "install_failed" };
     }
-    const result = await runner((input.platform ?? process.platform) === "win32" ? "npm.cmd" : "npm", [
-        "install",
-        "--global",
-        "--prefix",
-        input.npmPrefix,
-        "--ignore-scripts",
-        "--no-audit",
-        "--no-fund",
-        ...registryArgs,
-        `@nowcrew/daemon@${input.targetVersion}`,
-    ]).catch(() => null);
-    if (result === null || result.exitCode !== 0) {
+    let selectedRegistryArgs = [];
+    let installed = false;
+    let authFailures = 0;
+    let failedAttempts = 0;
+    for (const registry of registries) {
+        const args = registryArgs(registry);
+        const result = await runner(command, [
+            ...commandPrefix,
+            "install",
+            "--global",
+            "--prefix",
+            input.npmPrefix,
+            "--ignore-scripts",
+            "--no-audit",
+            "--no-fund",
+            ...args,
+            `@nowcrew/daemon@${input.targetVersion}`,
+        ]).catch(() => null);
+        if (result?.exitCode === 0) {
+            selectedRegistryArgs = args;
+            installed = true;
+            break;
+        }
+        failedAttempts += 1;
+        if (result !== null && isRegistryAuthFailure(result.stderr))
+            authFailures += 1;
+    }
+    if (!installed) {
         await release();
-        return { ok: false, errorCode: "install_failed" };
+        return {
+            ok: false,
+            errorCode: failedAttempts > 0 && authFailures === failedAttempts
+                ? "registry_auth_failed"
+                : "install_failed",
+        };
     }
     let installedVersion = "";
     try {
@@ -147,7 +173,7 @@ export async function installExactDaemonUpdate(input) {
         // Version verification is authoritative; unreadable package metadata is a mismatch.
     }
     if (installedVersion !== input.targetVersion) {
-        const restored = await restoreInstalledVersion(input, runner, previousVersion, registryArgs);
+        const restored = await restoreInstalledVersion(input, runner, command, commandPrefix, previousVersion, selectedRegistryArgs);
         if (!restored) {
             console.error(`[daemon-update] version verification failed; restore of ${previousVersion} was unsuccessful`);
         }

package/dist/execution-protocol.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { ATTACHMENT_MAX_FILE_BYTES, ATTACHMENT_MAX_TOTAL_BYTES, } from "./attachment-limits.js";
 import { AbilityRepositoryUrlSchema, SafeAbilityPathSchema, WorkspaceAbilityTargetSchema, } from "./agent-ability/types.js";
 import { compareProjectSkillRefs, MAX_AGENT_PROJECT_SKILL_BINDINGS, MAX_PROJECT_ID_LENGTH, MAX_PROJECT_SKILL_NAME_LENGTH, } from "./project-skills/types.js";
 const ExecutionIdSchema = z.string().uuid();
@@ -160,8 +161,10 @@ export const ExecutionAttachmentSchema = z.object({
     id: z.string().min(1).max(200),
     filename: z.string().min(1).max(255),
     mime: z.string().min(1).max(200),
-    sizeBytes: z.number().int().nonnegative().max(25 * 1024 * 1024),
+    sizeBytes: z.number().int().nonnegative().max(ATTACHMENT_MAX_FILE_BYTES),
 }).strict();
+const ExecutionAttachmentsSchema = z.array(ExecutionAttachmentSchema).max(20).refine((attachments) => attachments.reduce((total, attachment) => total + attachment.sizeBytes, 0)
+    <= ATTACHMENT_MAX_TOTAL_BYTES, "attachment bytes exceed the execution limit");
 const ExecutionAgentSchema = z.object({
     id: z.string().min(1),
     handle: AgentHandleSchema,
@@ -214,7 +217,7 @@ export const ExecutionStartSchema = z.object({
         scheduledRunId: ExecutionIdSchema.optional(),
         externalResponseSessionId: ExecutionIdSchema.optional(),
         answerStream: z.boolean().optional(),
-        attachments: z.array(ExecutionAttachmentSchema).max(20).optional(),
+        attachments: ExecutionAttachmentsSchema.optional(),
     }).strict(),
     reporting: z.object({
         captureFinal: z.boolean(),

package/dist/execution-runner.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { resolveReposRoot } from "./config.js";
 import { DaemonToServerExecutionFrameSchema, ExecutionCompletedSchema, ExecutionRejectedSchema, ExecutionStartSchema, } from "./execution-protocol.js";
 import { JournalConflictError } from "./execution-journal.js";
 import { boundExecutionFrame } from "./execution-event-limit.js";
@@ -524,10 +525,11 @@ export async function runExecution(config, input, dependencies) {
             if (dependencies.abilityRelease !== undefined) {
                 await cancellable(dependencies.abilityRelease.apply(config.agentsRoot, spec.agent.handle, spec.agent.abilityRelease), dependencies.cancellation);
             }
+            const reposRoot = resolveReposRoot(config.agentsRoot, config.reposRoot);
             const preparedProjectDependencies = await cancellable(dependencies.projectDependencies.prepare({
                 trainingRoot: join(config.agentsRoot, spec.agent.handle, "training"),
-                reposRoot: join(config.agentsRoot, "repos"),
-                lockRoot: join(config.agentsRoot, ".crew", "project-dependencies"),
+                reposRoot,
+                lockRoot: join(dirname(resolve(reposRoot)), ".crew", "project-dependencies"),
             }), dependencies.cancellation);
             trainingProjectContext = Object.freeze({
                 projects: Object.freeze(preparedProjectDependencies.map((project) => Object.freeze({
@@ -862,6 +864,8 @@ export async function runExecution(config, input, dependencies) {
                 token: credential.token,
                 agentId: credential.agentId,
                 agentsRoot: config.agentsRoot,
+                reposRoot: resolveReposRoot(config.agentsRoot, config.reposRoot),
+                ...(config.qaReportRoot === undefined ? {} : { qaReportRoot: config.qaReportRoot }),
                 cliPath: config.cliPath,
                 providerConfig,
                 codexHomeMode: config.codexHomeMode,

package/dist/host-execution-coordinator.js

@@ -5,6 +5,7 @@ import { randomUUID } from "node:crypto";
 import { defaultProcessController } from "./execution-journal.js";
 import { createJournalLease, createJournalLeaseRegistry, JournalLockedError, } from "./execution-journal-lock.js";
 import { dslog } from "./slog.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 const HOST_EXECUTION_SLOT_COUNT = 10;
 const HOST_STARTUP_SLOT_COUNT = 10;
 const HOST_STARTUP_GAP_MS = 500;
@@ -16,10 +17,10 @@ export class HostReservationCancelledError extends Error {
         super(message);
     }
 }
-export function defaultHostExecutionCoordinatorRoot(userHome = homedir()) {
+export function defaultHostExecutionCoordinatorRoot(userHome = homedir(), localHome) {
     // Deliberately independent of CREW_DAEMON_HOME and agentsRoot: every profile
     // owned by this OS user must share the same physical-compute safety boundary.
-    return resolve(userHome, ".crew", "daemon", "compute-execution");
+    return resolve(localHome ?? resolveDaemonLocalStateRoot({ userHome, platform: process.platform }), "daemon", "compute-execution");
 }
 async function syncDirectory(path) {
     if (process.platform === "win32")
@@ -132,7 +133,7 @@ async function writeLaunchTimestamp(path, value) {
     }
 }
 export function createHostExecutionCoordinator(options = {}) {
-    const root = resolve(options.root ?? defaultHostExecutionCoordinatorRoot());
+    const root = resolve(options.root ?? defaultHostExecutionCoordinatorRoot(options.userHome, options.localHome));
     const executionSlots = options.executionSlots ?? HOST_EXECUTION_SLOT_COUNT;
     const startupSlots = options.startupSlots ?? HOST_STARTUP_SLOT_COUNT;
     const startupGapMs = options.startupGapMs ?? HOST_STARTUP_GAP_MS;

package/dist/local-executor.js

@@ -466,6 +466,13 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             CREW_TOKEN: input.launch.token,
             CREW_CHANNEL: input.channelId,
             CREW_HOME: workspace.dir,
+            // Keep the daemon-selected storage root authoritative for runtimes.
+            // In profile-backed NowWork sessions the daemon config may differ from
+            // the daemon process environment, so inheriting CREW_AGENTS_ROOT is not
+            // sufficient for QA/project diagnostics.
+            CREW_AGENTS_ROOT: input.launch.agentsRoot,
+            ...(input.launch.reposRoot === undefined ? {} : { NOWWORK_REPOS_ROOT: input.launch.reposRoot }),
+            ...(input.launch.qaReportRoot === undefined ? {} : { QA_REPORT_HUB: input.launch.qaReportRoot }),
             // Expose only the training root; ability-specific workspace layout stays
             // owned by the training package rather than the NowWork daemon.
             QA_RUNTIME_ROOT: join(workspace.dir, "training"),

package/dist/local-memory/runtime.js

@@ -3,9 +3,11 @@ import { lstat, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { applyLocalMemoryResult, parseLocalMemoryResult } from "./write.js";
 export function isLocalMemoryV2Eligible(input) {
-    return input.enabledForHandle
-        && (input.localMemoryV2Initialized || (!input.agentHomePreexisted && input.memorySeedCreated))
-        && input.memoryPrune;
+    // The allowlist is the rollout boundary. The marker and seed/pre-existing
+    // state are retained as diagnostics and for backward-compatible marker
+    // creation, but must not prevent an explicitly allowlisted Agent from using
+    // the structured memory-prune protocol.
+    return input.enabledForHandle && input.memoryPrune;
 }
 const LOCAL_MEMORY_V2_MARKER = "v2-enabled";
 export async function initializeLocalMemoryV2(agentDir) {

package/dist/machine-info.js

@@ -25,6 +25,7 @@ export { executableRuntimes } from "./runtime-capabilities.js";
 const execFileP = promisify(execFile);
 export const PROJECT_WORKSPACES_CAPABILITY = "project_workspaces_v1";
 export const TRAINING_PROJECT_DEPENDENCIES_CAPABILITY = "training_project_dependencies_v1";
+export const EXECUTION_LARGE_ATTACHMENTS_CAPABILITY = "execution_attachments_300m_v1";
 export const NATIVE_PROJECT_WORKSPACE_READINESS = Object.freeze({
     resolverReady: true,
     nativeRuntimeAdaptersReady: true,
@@ -36,6 +37,7 @@ export const DAEMON_CAPABILITIES = Object.freeze([
     "execution_telemetry_ack_v1",
     "execution_external_output_v1",
     "execution_attachments_v1",
+    EXECUTION_LARGE_ATTACHMENTS_CAPABILITY,
     "execution_answer_stream_v1",
     "execution_machine_queue_v1",
     "execution_agent_memory_policy_v1",