@nowcrew/daemon 0.6.77-beta.7 → 0.6.77-beta.8

package/README.md

@@ -479,6 +479,26 @@ failure matrix, rollout limits, and the server-native follow-up design.
 
 ## Code Map
 
+## Local daemon installation root (experimental)
+
+New installations use `~/.nowwork` for machine-local daemon configuration and npm runtimes. The
+Workspace persistence root is still selected independently by `NOWWORK_HOME`; it may be a local
+directory or an ECS-specific NAS directory. Runtime packages, locks, sockets, PIDs and temporary
+files must remain on the machine running the daemon.
+
+The selector is controlled by `NOWWORK_LOCAL_HOME_MODE`:
+
+- `auto` (default): use an existing `.nowwork` installation, otherwise preserve an existing `.crew`
+  installation; a brand-new profile is created under `.nowwork`.
+- `nowwork`: require the `.nowwork` installation root.
+- `legacy`: force the old `.crew` root for rollback.
+
+`NOWWORK_STORAGE_MODE` is accepted as a compatibility alias. `NOWWORK_LOCAL_HOME` can override the
+local root and should point to a local filesystem, never to the NAS Workspace root; the mount/device
+check remains a doctor/migration gate. If the same profile
+is found in both roots, startup/install is refused until the duplicate is resolved explicitly. The
+old `.crew` tree is not deleted by this compatibility layer.
+
 - `src/serve.ts`: connection, negotiation, routing, sync, and legacy boundary.
 - `src/daemon-update-eligibility.ts`, `src/daemon-updater.ts`, and `src/daemon-update-controller.ts`:
   managed-update eligibility, exact npm replacement, host-wide admission barrier, and restart handoff.

package/dist/automatic-daemon-installer.js

@@ -39,6 +39,7 @@ function defaultDependencies() {
         platform,
         userHome,
         uid: process.getuid?.(),
+        environment: process.env,
         nodePath: process.execPath,
         version: daemonVersion(),
         ...(process.env.PATH ? { runtimePath: process.env.PATH } : {}),
@@ -231,6 +232,10 @@ function recoveryError(primary, failures) {
 }
 export async function installDaemonAutomatically(input, dependencies = defaultDependencies()) {
     const machineToken = MachineTokenSchema.parse(input.machineToken);
+    const requestedLocalHome = input.requestedLocalHome ?? dependencies.environment.NOWWORK_LOCAL_HOME;
+    const requestedLocalHomeMode = input.requestedLocalHomeMode
+        ?? dependencies.environment.NOWWORK_LOCAL_HOME_MODE
+        ?? dependencies.environment.NOWWORK_STORAGE_MODE;
     const target = resolveAutomaticInstallTarget({
         serverUrl: input.serverUrl,
         ...(input.requestedProfile === undefined ? {} : { requestedProfile: input.requestedProfile }),
@@ -238,6 +243,8 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
         ...(input.requestedRegistryUrl === undefined ? {} : { requestedRegistryUrl: input.requestedRegistryUrl }),
         userHome: dependencies.userHome,
         platform: dependencies.platform,
+        ...(requestedLocalHome === undefined ? {} : { requestedLocalHome }),
+        ...(requestedLocalHomeMode === undefined ? {} : { requestedLocalHomeMode }),
     });
     if (!isDaemonReleaseVersion(dependencies.version)) {
         throw new Error(`Invoking daemon package has an invalid release version '${dependencies.version}'`);

package/dist/automatic-install-target.js

@@ -1,6 +1,7 @@
 import { posix, win32 } from "node:path";
 import { profileLayout, validateLocalInstanceName } from "./profile-layout.js";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
+import { resolveDaemonLocalHome } from "./daemon-local-home.js";
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
 const KNOWN_TARGETS = {
     "nowwork-in.nowcoder.com": {
@@ -72,13 +73,21 @@ function knownTargetForProfile(environment, requestedProfile, input, parsed) {
     const legacyProfile = environment === "production" ? "in" : environment;
     assertReleaseTagForServerUrl(input.serverUrl, input.requestedReleaseTag);
     if (requestedProfile === undefined || requestedProfile === legacyProfile) {
+        const local = resolveDaemonLocalHome({
+            userHome: input.userHome,
+            platform: input.platform,
+            profile: legacyProfile,
+            ...(input.requestedLocalHome === undefined ? {} : { explicit: input.requestedLocalHome }),
+            ...(input.requestedLocalHomeMode === undefined ? {} : { mode: input.requestedLocalHomeMode }),
+            ...(input.pathExists === undefined ? {} : { exists: input.pathExists }),
+        });
         return Object.freeze({
             kind: "known",
             profile: legacyProfile,
             serverUrl: normalizedServerUrl(parsed),
-            daemonHome: paths.join(input.userHome, ".crew", environment === "production" ? "daemon" : "daemon-dev"),
-            agentsRoot: paths.join(input.userHome, ".crew", environment === "production" ? "agents" : "agents-dev"),
-            npmPrefix: paths.join(input.userHome, ".crew", "daemon-runtimes", legacyProfile),
+            daemonHome: local.daemonHome,
+            agentsRoot: paths.join(local.root, environment === "production" ? "agents" : "agents-dev"),
+            npmPrefix: local.runtimePrefix,
             releaseTag: environment === "dev" ? "beta" : "latest",
         });
     }
@@ -99,15 +108,23 @@ function knownTargetForProfile(environment, requestedProfile, input, parsed) {
         userHome: input.userHome,
         platform: input.platform,
     });
+    const local = resolveDaemonLocalHome({
+        userHome: input.userHome,
+        platform: input.platform,
+        profile: layout.profile,
+        ...(input.requestedLocalHome === undefined ? {} : { explicit: input.requestedLocalHome }),
+        ...(input.requestedLocalHomeMode === undefined ? {} : { mode: input.requestedLocalHomeMode }),
+        ...(input.pathExists === undefined ? {} : { exists: input.pathExists }),
+    });
     return Object.freeze({
         kind: "known",
         environment,
         localInstanceName,
         profile: layout.profile,
         serverUrl: normalizedServerUrl(parsed),
-        daemonHome: layout.daemonHome,
-        agentsRoot: layout.agentsRoot,
-        npmPrefix: layout.npmPrefix,
+        daemonHome: local.daemonHome,
+        agentsRoot: paths.join(local.root, "agents-" + layout.environment + "-" + layout.localInstanceName),
+        npmPrefix: local.runtimePrefix,
         releaseTag: environment === "dev" ? "beta" : "latest",
     });
 }
@@ -127,13 +144,21 @@ export function resolveAutomaticInstallTarget(input) {
         return registryUrl === undefined ? target : Object.freeze({ ...target, registryUrl });
     }
     const profile = requireCustomProfile(hostname, input.requestedProfile);
+    const local = resolveDaemonLocalHome({
+        userHome: input.userHome,
+        platform: input.platform,
+        profile,
+        ...(input.requestedLocalHome === undefined ? {} : { explicit: input.requestedLocalHome }),
+        ...(input.requestedLocalHomeMode === undefined ? {} : { mode: input.requestedLocalHomeMode }),
+        ...(input.pathExists === undefined ? {} : { exists: input.pathExists }),
+    });
     return Object.freeze({
         kind: "custom",
         profile,
         serverUrl: normalizedServerUrl(parsed),
-        daemonHome: paths.join(input.userHome, ".crew", `daemon-${profile}`),
-        agentsRoot: paths.join(input.userHome, ".crew", `agents-${profile}`),
-        npmPrefix: paths.join(input.userHome, ".crew", "daemon-runtimes", profile),
+        daemonHome: local.daemonHome,
+        agentsRoot: paths.join(local.root, `agents-${profile}`),
+        npmPrefix: local.runtimePrefix,
         releaseTag: input.requestedReleaseTag ?? "latest",
         ...(registryUrl === undefined ? {} : { registryUrl }),
     });

package/dist/computer-cli.js

@@ -1,6 +1,6 @@
 import { parseArgs } from "node:util";
 import { homedir } from "node:os";
-import { resolve } from "node:path";
+import { posix, resolve, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertProfileAgentsRootUnique, daemonHome, inspectProfileAgentsRoot, listProfiles, loadProfile, PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, ProfileAgentsRootConflictError, profileIsPrivate, profilePath, publicProfile, removeProfile, resolveAgentsRoot, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
 import { buildServiceSpec, doctorService, hardenWindowsProfile, installService, readServiceDescriptor, serviceAction, serviceStatus, systemCommandRunner, uninstallService, upgradeDaemon, windowsProfileIsPrivate, } from "./computer-service.js";
@@ -18,6 +18,7 @@ import { assertManagedServiceIdentity, buildManagedServiceRecord, installManaged
 import { inspectManagedServiceDiagnostics } from "./managed-service-diagnostics.js";
 import { readManagedServiceRegistry } from "./managed-service-registry.js";
 import { installDaemonAutomatically, } from "./automatic-daemon-installer.js";
+import { resolveDaemonLocalHome } from "./daemon-local-home.js";
 const COMPUTER_COMMANDS = new Set(["profile", "doctor", "install", "uninstall", "start", "stop", "restart", "status", "upgrade"]);
 export function builtDaemonEntry(moduleUrl = import.meta.url) {
     return moduleUrl.endsWith(".js")
@@ -67,6 +68,7 @@ function usage(td) {
         "  crew-daemon install --server-url <url> --api-key <sk_machine_*> [--profile <custom-name>] [--release-tag <latest|beta>] [--registry <https-url>]",
         "  crew-daemon doctor|install|uninstall|start|stop|restart|status --profile <name>",
         "  crew-daemon upgrade [--profile <name>] [--release-tag <latest|beta>] [--registry <https-url>]",
+        "  NOWWORK_LOCAL_HOME_MODE=auto|nowwork|legacy NOWWORK_LOCAL_HOME=~/.nowwork",
         "",
         td("profile save reads the machine token from CREW_MACHINE_TOKEN, or stdin with --token-stdin."),
     ].join("\n") + "\n";
@@ -154,6 +156,7 @@ export async function runComputerCommand(argv, overrides = {}) {
                 ?? deps.env.CREW_MACHINE_TOKEN)?.trim();
             if (!machineToken)
                 throw new Error(td("Missing machine token for automatic installation"));
+            const requestedLocalHomeMode = deps.env.NOWWORK_LOCAL_HOME_MODE ?? deps.env.NOWWORK_STORAGE_MODE;
             const result = await deps.installAutomatically({
                 serverUrl: parsed.values["server-url"],
                 machineToken,
@@ -162,11 +165,28 @@ export async function runComputerCommand(argv, overrides = {}) {
                 ...(configuredRegistryUrl === undefined
                     ? {}
                     : { requestedRegistryUrl: configuredRegistryUrl }),
+                ...(deps.env.NOWWORK_LOCAL_HOME === undefined
+                    ? {}
+                    : { requestedLocalHome: deps.env.NOWWORK_LOCAL_HOME }),
+                ...(requestedLocalHomeMode === undefined ? {} : { requestedLocalHomeMode }),
             });
             deps.stdout(`${td("Installed daemon {{version}} for profile '{{profile}}'; service '{{service}}' is running.", { version: result.version, profile: result.profile, service: result.serviceId })}\n`);
             return 0;
         }
-        const home = daemonHome(deps.env);
+        const resolvedProfile = profileName ?? positionalName;
+        const configuredLocalHomeMode = deps.env.NOWWORK_LOCAL_HOME_MODE ?? deps.env.NOWWORK_STORAGE_MODE;
+        const home = resolvedProfile !== undefined
+            && (deps.env.NOWWORK_LOCAL_HOME !== undefined
+                || deps.env.NOWWORK_LOCAL_HOME_MODE !== undefined
+                || deps.env.NOWWORK_STORAGE_MODE !== undefined)
+            ? resolveDaemonLocalHome({
+                userHome: deps.userHome,
+                platform: deps.platform,
+                profile: resolvedProfile,
+                ...(deps.env.NOWWORK_LOCAL_HOME === undefined ? {} : { explicit: deps.env.NOWWORK_LOCAL_HOME }),
+                ...(configuredLocalHomeMode === undefined ? {} : { mode: configuredLocalHomeMode }),
+            }).daemonHome
+            : daemonHome(deps.env);
         const profileStorage = {
             platform: deps.platform,
             userHome: deps.userHome,
@@ -221,7 +241,9 @@ export async function runComputerCommand(argv, overrides = {}) {
                 }),
                 ...(parsed.values["agents-root"]
                     ? { agentsRoot: resolveAgentsRoot(parsed.values["agents-root"], deps.userHome, deps.platform) }
-                    : {}),
+                    : (deps.env.NOWWORK_LOCAL_HOME !== undefined || configuredLocalHomeMode !== undefined)
+                        ? { agentsRoot: resolveAgentsRoot((deps.platform === "win32" ? win32 : posix).join((deps.platform === "win32" ? win32 : posix).dirname(home), `agents-${name}`), deps.userHome, deps.platform) }
+                        : {}),
                 ...(deps.env.PATH ? { runtimePath: deps.env.PATH } : {}),
             };
             await saveProfile(profile, home, profileStorage);

package/dist/computer-profile.js

@@ -9,6 +9,7 @@ import { acquireProfileSaveLock, } from "./computer-profile-lock.js";
 import { formatDaemonText } from "./i18n.js";
 import { atomicPrivateWrite } from "./atomic-private-write.js";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
+import { resolveDaemonLocalHome } from "./daemon-local-home.js";
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
 export const MachineTokenSchema = z.string().startsWith("sk_machine_").max(4096);
 const ServerUrlSchema = z.string().url().max(2048).refine((value) => {
@@ -94,8 +95,20 @@ export class ProfileAgentsRootConflictError extends Error {
 }
 const quotePosixArgument = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
 const quotePowerShellArgument = (value) => `'${value.replaceAll("'", "''")}'`;
-export function daemonHome(env = process.env) {
-    return resolve(env.CREW_DAEMON_HOME ?? resolve(homedir(), ".crew/daemon"));
+export function daemonHome(env = process.env, profile) {
+    if (env.CREW_DAEMON_HOME !== undefined)
+        return resolve(env.CREW_DAEMON_HOME);
+    const mode = env.NOWWORK_LOCAL_HOME_MODE ?? env.NOWWORK_STORAGE_MODE;
+    if (profile !== undefined && (env.NOWWORK_LOCAL_HOME !== undefined || mode !== undefined)) {
+        return resolveDaemonLocalHome({
+            userHome: homedir(),
+            platform: process.platform,
+            profile,
+            ...(env.NOWWORK_LOCAL_HOME === undefined ? {} : { explicit: env.NOWWORK_LOCAL_HOME }),
+            ...(mode === undefined ? {} : { mode }),
+        }).daemonHome;
+    }
+    return resolve(homedir(), ".crew/daemon");
 }
 export function resolveAgentsRoot(configured, userHome = homedir(), platform = process.platform) {
     const pathApi = platform === "win32" ? win32 : posix;

package/dist/daemon-local-home.js

@@ -0,0 +1,73 @@
+import { existsSync } from "node:fs";
+import { posix, win32 } from "node:path";
+const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
+const CONTROL = /[\0\r\n]/u;
+const pathsFor = (platform) => platform === "win32" ? win32 : posix;
+export function parseDaemonLocalHomeMode(value) {
+    if (value === undefined || value.trim() === "")
+        return "auto";
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "auto" || normalized === "nowwork" || normalized === "legacy")
+        return normalized;
+    throw new Error("NOWWORK_LOCAL_HOME_MODE must be auto, nowwork or legacy");
+}
+function absoluteRoot(value, userHome, platform) {
+    const paths = pathsFor(platform);
+    if (value.length === 0 || CONTROL.test(value))
+        throw new Error("NOWWORK_LOCAL_HOME must be a non-empty single-line path");
+    const expanded = value === "~"
+        ? userHome
+        : value.startsWith("~/") || (platform === "win32" && value.startsWith("~\\"))
+            ? paths.join(userHome, value.slice(2))
+            : value;
+    if (!paths.isAbsolute(expanded))
+        throw new Error("NOWWORK_LOCAL_HOME must be absolute or start with '~/'");
+    return paths.normalize(expanded);
+}
+function legacyDaemonDirectory(profile) {
+    if (profile === "in" || profile === "production")
+        return "daemon";
+    if (profile === "dev")
+        return "daemon-dev";
+    if (profile.startsWith("nw-"))
+        return `daemon-${profile.slice(3)}`;
+    return `daemon-${profile}`;
+}
+function resolution(mode, root, profile, platform, source) {
+    const paths = pathsFor(platform);
+    return Object.freeze({
+        mode,
+        root,
+        daemonHome: mode === "nowwork" ? paths.join(root, "config") : paths.join(root, legacyDaemonDirectory(profile)),
+        runtimePrefix: paths.join(root, "daemon-runtimes", profile),
+        source,
+    });
+}
+export function resolveDaemonLocalHome(input) {
+    if (!PROFILE.test(input.profile))
+        throw new Error("daemon profile is invalid");
+    const mode = parseDaemonLocalHomeMode(input.mode);
+    const paths = pathsFor(input.platform);
+    const nowworkRoot = absoluteRoot(input.explicit ?? paths.join(input.userHome, ".nowwork"), input.userHome, input.platform);
+    const legacyRoot = absoluteRoot(paths.join(input.userHome, ".crew"), input.userHome, input.platform);
+    if (input.explicit !== undefined && mode !== "legacy") {
+        return resolution("nowwork", nowworkRoot, input.profile, input.platform, "explicit");
+    }
+    if (mode === "nowwork")
+        return resolution("nowwork", nowworkRoot, input.profile, input.platform, "nowwork_forced");
+    if (mode === "legacy")
+        return resolution("legacy", legacyRoot, input.profile, input.platform, "legacy_forced");
+    const exists = input.exists ?? existsSync;
+    const nowwork = resolution("nowwork", nowworkRoot, input.profile, input.platform, "auto_nowwork_existing");
+    const legacy = resolution("legacy", legacyRoot, input.profile, input.platform, "auto_legacy_existing");
+    const hasNowwork = exists(nowwork.runtimePrefix) || exists(paths.join(nowwork.daemonHome, "profiles", `${input.profile}.json`));
+    const hasLegacy = exists(legacy.runtimePrefix) || exists(paths.join(legacy.daemonHome, "profiles", `${input.profile}.json`));
+    if (hasNowwork && hasLegacy) {
+        throw new Error(`Daemon local home conflict: profile '${input.profile}' exists under both .crew and .nowwork`);
+    }
+    if (hasNowwork)
+        return nowwork;
+    if (hasLegacy)
+        return legacy;
+    return resolution("nowwork", nowworkRoot, input.profile, input.platform, "auto_new");
+}

package/dist/daemon-migration-controller.js

@@ -125,7 +125,15 @@ export function createDaemonMigrationController(input) {
                 if (currentProfile.machineToken !== input.machineToken)
                     throw new Error("active profile token does not match this daemon");
                 currentRegistryUrl = currentProfile.registryUrl;
-                const target = resolveAutomaticInstallTarget({ serverUrl: input.serverUrl, requestedProfile: message.targetProfile, userHome, platform });
+                const target = resolveAutomaticInstallTarget({
+                    serverUrl: input.serverUrl,
+                    requestedProfile: message.targetProfile,
+                    userHome,
+                    platform,
+                    // This controller migrates the legacy service layout; the new local-home
+                    // standard is handled by the storage migration controller.
+                    requestedLocalHomeMode: "legacy",
+                });
                 if (!isAbsolute(message.targetDaemonHome) || !isAbsolute(message.targetAgentsRoot)
                     || resolve(message.targetDaemonHome) !== resolve(target.daemonHome)
                     || resolve(message.targetAgentsRoot) !== resolve(target.agentsRoot))

package/dist/main.js

@@ -74,7 +74,7 @@ async function main() {
         process.env.CREW_DAEMON_HOME = values["daemon-home"];
     let activeDaemonHome;
     if (values.profile) {
-        const home = daemonHome();
+        const home = daemonHome(process.env, values.profile);
         activeDaemonHome = home;
         const profile = await loadProfile(values.profile, home);
         if (cmd === "serve") {

package/dist/serve.js

@@ -825,9 +825,9 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
-                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string") {
+                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
                     try {
-                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId });
+                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId, machineId: r.machineId });
                         machineHelloPublisher.republish();
                     }
                     catch (error) {

package/dist/storage-control.js

@@ -5,6 +5,8 @@ const IdentitySchema = z.object({
     migrationId: z.string().uuid(),
     environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
     workspaceId: z.string().uuid(),
+    ownerEpoch: z.number().int().positive().safe().optional(),
+    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
 });
 const DoctorRequestSchema = IdentitySchema.extend({ type: z.literal("daemon:storage-doctor") }).strict();
 const MigrateRequestSchema = IdentitySchema.extend({
@@ -26,6 +28,11 @@ export function createStorageControlController(input) {
     const profile = z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u).parse(input.profile);
     const sourceStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.sourceStorageFingerprint);
     const targetStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.targetStorageFingerprint);
+    const ownership = input.ownership === undefined ? undefined : Object.freeze({
+        ownerEpoch: z.number().int().positive().safe().parse(input.ownership.ownerEpoch),
+        ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u)
+            .parse(input.ownership.ownershipClaimFingerprint),
+    });
     const preflights = new Map();
     const preflightRuns = new Map();
     const appliedMigrationIds = new Set();
@@ -39,6 +46,7 @@ export function createStorageControlController(input) {
         environment,
         workspaceId,
         profile,
+        ...(ownership === undefined ? {} : ownership),
         ...extra,
     });
     const failure = (identity, errorCode, error, reopenAdmission = false, extra = {}) => {
@@ -59,7 +67,10 @@ export function createStorageControlController(input) {
             input.onStatusError?.(error, statusFrame);
         }
     };
-    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId;
+    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId
+        && (ownership === undefined
+            || (identity.ownerEpoch === ownership.ownerEpoch
+                && identity.ownershipClaimFingerprint === ownership.ownershipClaimFingerprint));
     const preflightKey = (identity) => `${identity.migrationId}\0${identity.environment}\0${identity.workspaceId}`;
     const runPreflight = (identity, failureFallback = "doctor_failed") => {
         const key = preflightKey(identity);

package/dist/storage-identity.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { STORAGE_LAYOUT_VERSION } from "./storage-layout.js";
+import { createStorageOwnershipClaim } from "./storage-ownership.js";
 function fingerprint(namespace, value) {
     return `sha256:${createHash("sha256").update(`${namespace}\0${value}`).digest("hex")}`;
 }
@@ -14,14 +15,27 @@ export function storageHelloIdentity(input) {
         || installation.runtimeRoot !== layout.runtimeRoot) {
         throw new Error("installation storage identity does not match resolved layout");
     }
+    const workspaceRootFingerprint = fingerprint("workspace-root", layout.workspaceRoot);
+    let ownership;
+    if (input.ownership !== undefined) {
+        const { claimFingerprint: reportedFingerprint, ...claimIdentity } = input.ownership;
+        ownership = createStorageOwnershipClaim(claimIdentity);
+        if (ownership.claimFingerprint !== reportedFingerprint
+            || ownership.workspaceId !== layout.workspaceId
+            || ownership.environment !== layout.environment
+            || ownership.workspaceRootFingerprint !== workspaceRootFingerprint) {
+            throw new Error("storage ownership identity does not match resolved layout");
+        }
+    }
     return Object.freeze({
         storageLayoutVersion: STORAGE_LAYOUT_VERSION,
         storageEnvironment: layout.environment,
         storageWorkspaceId: layout.workspaceId,
         storageIdFingerprint: storageIdFingerprint(installation.storageId),
-        workspaceRootFingerprint: fingerprint("workspace-root", layout.workspaceRoot),
+        workspaceRootFingerprint,
         daemonRootFingerprint: fingerprint("daemon-root", layout.daemonRoot),
         agentRootFingerprint: fingerprint("agent-root", layout.agentItemsRoot),
+        ...(ownership === undefined ? {} : { storageOwnership: ownership }),
         ...(installation.storageMigrationId === undefined
             ? {}
             : { storageMigrationId: installation.storageMigrationId }),

package/dist/storage-migration-controller.js

@@ -27,6 +27,8 @@ const ReceiptSchema = z.object({
     environment: z.string().min(1),
     workspaceId: z.string().uuid(),
     profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
+    ownerEpoch: z.number().int().positive().safe().optional(),
+    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
     manifestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
     targetFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
     status: ReceiptStatusSchema,
@@ -37,13 +39,23 @@ const ReceiptSchema = z.object({
     sourceStopAttempted: z.boolean().optional(),
     sourceStopped: z.boolean().optional(),
     targetTouched: z.boolean().optional(),
-}).strict();
+}).strict().superRefine((receipt, context) => {
+    if ((receipt.ownerEpoch === undefined) !== (receipt.ownershipClaimFingerprint === undefined)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "storage receipt ownership identity must be complete" });
+    }
+});
 const MigrationLockSchema = z.object({
     version: z.literal(1),
     migrationId: z.string().uuid(),
     pid: z.number().int().positive(),
     createdAt: z.string().datetime({ offset: true }),
 }).strict();
+const REQUIRED_BACKUP_ARTIFACTS = Object.freeze([
+    "profile.json",
+    "service-descriptor",
+    "managed-service-registry.json",
+    "installations.json",
+]);
 export class StorageMigrationFailure extends Error {
     code;
     receipt;
@@ -204,6 +216,16 @@ function assertOwnedStaging(input) {
     }
 }
 async function backupArtifacts(input, receipt) {
+    const providedNames = new Set(input.backupArtifacts.map((artifact) => artifact.name));
+    const missing = REQUIRED_BACKUP_ARTIFACTS.filter((name) => !providedNames.has(name));
+    if (missing.length > 0) {
+        throw new StorageMigrationFailure("backup_artifact_missing", `required rollback artifacts are missing: ${missing.join(", ")}`);
+    }
+    for (const artifact of input.backupArtifacts) {
+        if (!(await lstat(artifact.path)).isFile()) {
+            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact must be a file");
+        }
+    }
     const directory = join(input.backupsRoot, receipt.migrationId);
     const artifactsDirectory = join(directory, "artifacts");
     await mkdir(artifactsDirectory, { recursive: true, mode: 0o700 });
@@ -217,8 +239,6 @@ async function backupArtifacts(input, receipt) {
             throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact names must be unique safe file names");
         }
         names.add(artifact.name);
-        if (!(await lstat(artifact.path)).isFile())
-            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact must be a file");
         const destination = join(artifactsDirectory, artifact.name);
         await copyFile(artifact.path, destination);
         await chmod(destination, 0o600);
@@ -271,6 +291,7 @@ export async function runStorageMigration(input, dependencies) {
         environment: input.doctor.environment,
         workspaceId: input.doctor.workspaceId,
         profile: input.doctor.profile,
+        ...(input.ownership === undefined ? {} : input.ownership),
         manifestDigest: input.doctor.manifestDigest,
         targetFingerprint: targetFingerprint(input.targetWorkspaceRoot),
         status: "preflight_passed",
@@ -301,7 +322,7 @@ export async function runStorageMigration(input, dependencies) {
         input.assertHealthy?.();
         await transition("backing_up");
         receipt = await backupArtifacts(input, receipt).catch((error) => {
-            failureCode = "backup_failed";
+            failureCode = error instanceof StorageMigrationFailure ? error.code : "backup_failed";
             throw error;
         });
         await writeReceipt(path, receipt);

package/dist/storage-ownership.js

@@ -0,0 +1,55 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+const FingerprintSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u);
+const StorageOwnershipClaimSchema = z.object({
+    version: z.literal(1),
+    machineId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
+    volumeFingerprint: FingerprintSchema,
+    workspaceRootFingerprint: FingerprintSchema,
+    ownerEpoch: z.number().int().positive().safe(),
+    claimFingerprint: FingerprintSchema,
+}).strict();
+function claimFingerprint(identity) {
+    const digest = createHash("sha256").update([
+        "nowwork-storage-ownership-v1",
+        identity.machineId,
+        identity.workspaceId,
+        identity.environment,
+        identity.volumeFingerprint,
+        identity.workspaceRootFingerprint,
+        String(identity.ownerEpoch),
+    ].join("\0")).digest("hex");
+    return `sha256:${digest}`;
+}
+export function createStorageOwnershipClaim(input) {
+    const parsed = StorageOwnershipClaimSchema.omit({ version: true, claimFingerprint: true }).parse(input);
+    const identity = Object.freeze({
+        ...parsed,
+        machineId: parsed.machineId.toLowerCase(),
+        workspaceId: parsed.workspaceId.toLowerCase(),
+        environment: parsed.environment.toLowerCase(),
+    });
+    return Object.freeze({ ...identity, claimFingerprint: claimFingerprint(identity) });
+}
+export function storageOwnershipClaimPath(nowworkHome) {
+    return join(nowworkHome, "storage-layout.json");
+}
+export async function readStorageOwnershipClaim(nowworkHome) {
+    const path = storageOwnershipClaimPath(nowworkHome);
+    const metadata = await lstat(path);
+    if (!metadata.isFile())
+        throw new Error("storage ownership claim must be a file");
+    if (metadata.size > 16 * 1024)
+        throw new Error("storage ownership claim file is too large");
+    const parsed = StorageOwnershipClaimSchema.parse(JSON.parse(await readFile(path, "utf8")));
+    const { version: _version, claimFingerprint: reportedFingerprint, ...identity } = parsed;
+    const expected = createStorageOwnershipClaim(identity);
+    if (reportedFingerprint !== expected.claimFingerprint) {
+        throw new Error("storage ownership claim fingerprint is invalid");
+    }
+    return expected;
+}

package/dist/storage-runtime-controller.js

@@ -23,9 +23,10 @@ function deterministicUuid(value) {
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 function storageId(input, workspaceId) {
-    return `storage_${createHash("sha256").update([
-        input.serverUrl.replace(/\/+$/u, ""), input.profile, workspaceId, input.nowworkHome,
-    ].join("\0")).digest("hex").slice(0, 32)}`;
+    if (input.ownership.workspaceId !== workspaceId || input.ownership.environment !== input.environment) {
+        throw new Error("Storage ownership claim does not match the migration identity");
+    }
+    return `storage_${input.ownership.claimFingerprint.slice("sha256:".length)}`;
 }
 function installationBase(input, workspaceId, migrationId, createdAt) {
     const layout = storageLayout({
@@ -102,6 +103,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
         ...injected,
     };
     let workspaceId = null;
+    let machineId = null;
     let identity;
     let gate = null;
     let sendStatus = null;
@@ -194,6 +196,10 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                 targetWorkspaceRoot: target.workspaceRoot,
                 backupsRoot: input.local.backupsRoot,
                 backupArtifacts: input.backupArtifacts.map((artifact) => ({ ...artifact })),
+                ownership: {
+                    ownerEpoch: input.ownership.ownerEpoch,
+                    ownershipClaimFingerprint: input.ownership.claimFingerprint,
+                },
                 acceptedWarnings: [...input.policy.acceptedWarnings],
             },
             service: {
@@ -229,6 +235,10 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             profile: input.profile,
             sourceStorageFingerprint,
             targetStorageFingerprint: identity.storageIdFingerprint,
+            ownership: {
+                ownerEpoch: input.ownership.ownerEpoch,
+                ownershipClaimFingerprint: input.ownership.claimFingerprint,
+            },
             runDoctor: async (migrationId) => dependencies.runDoctor(await doctorInput(migrationId)),
             runMigration: async (doctor) => {
                 await gate.closeAndFlush();
@@ -264,6 +274,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                         environment: operation.environment,
                         workspaceId: operation.workspaceId,
                         profile: operation.profile,
+                        ...(operation.migration.ownership === undefined ? {} : operation.migration.ownership),
                     }, sendStatus);
                     if (outcome.reopenAdmission)
                         gate.reopen();
@@ -285,20 +296,31 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
     };
     const bindServerIdentity = (server) => {
         const nextWorkspaceId = UUID.parse(server.workspaceId).toLowerCase();
+        const nextMachineId = UUID.parse(server.machineId).toLowerCase();
         if (workspaceId !== null && workspaceId !== nextWorkspaceId) {
             throw new Error("Storage migration server workspace identity changed");
         }
-        workspaceId = nextWorkspaceId;
+        if (machineId !== null && machineId !== nextMachineId) {
+            throw new Error("Storage migration server machine identity changed");
+        }
+        if (input.ownership.workspaceId !== nextWorkspaceId
+            || input.ownership.machineId !== nextMachineId
+            || input.ownership.environment !== input.environment) {
+            throw new Error("Storage ownership claim does not match authenticated server identity");
+        }
         const createdAt = dependencies.now().toISOString();
-        const installation = installationBase(input, workspaceId, undefined, createdAt);
+        const installation = installationBase(input, nextWorkspaceId, undefined, createdAt);
         const layout = storageLayout({
             nowworkHome: input.nowworkHome,
             environment: input.environment,
-            workspaceId,
+            workspaceId: nextWorkspaceId,
             runtimeBase: input.local.runtimeBase,
             platform: input.platform,
         });
-        identity = storageHelloIdentity({ installation, layout });
+        const nextIdentity = storageHelloIdentity({ installation, layout, ownership: input.ownership });
+        workspaceId = nextWorkspaceId;
+        machineId = nextMachineId;
+        identity = nextIdentity;
         ensureControl();
         drainPendingControlMessages();
     };

package/dist/storage-runtime-readiness.js

@@ -5,10 +5,11 @@ import { buildServiceSpec } from "./computer-service.js";
 import { profilePath } from "./computer-profile.js";
 import { assertManagedServiceIdentity } from "./managed-service-lifecycle.js";
 import { managedServiceRegistryPath, readManagedServiceRegistry, } from "./managed-service-registry.js";
-import { resolveLocalStorageRoots } from "./storage-config.js";
+import { installationsPath, resolveLocalStorageRoots } from "./storage-config.js";
 import { readStorageMigrationPolicy } from "./storage-migration-policy.js";
 import { createStorageMigrationRuntimeController, } from "./storage-runtime-controller.js";
 import { resolveEnvTag, resolveNowworkHome } from "./storage-layout.js";
+import { readStorageOwnershipClaim } from "./storage-ownership.js";
 const notReady = (reason) => Object.freeze({ ready: false, reason });
 function canonicalPath(value) {
     const absolute = resolve(value);
@@ -106,6 +107,7 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         assertManagedServiceIdentity,
         readPolicy: readStorageMigrationPolicy,
         createController: createStorageMigrationRuntimeController,
+        readOwnership: readStorageOwnershipClaim,
         ...injected,
     };
     let sourceRecord;
@@ -153,6 +155,17 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
     catch {
         return notReady("migration_policy_invalid");
     }
+    let ownership;
+    try {
+        ownership = await dependencies.readOwnership(nowworkHome);
+    }
+    catch (error) {
+        return notReady(error.code === "ENOENT"
+            ? "storage_ownership_claim_missing"
+            : "storage_ownership_claim_invalid");
+    }
+    if (ownership.environment !== environment)
+        return notReady("storage_ownership_claim_invalid");
     const local = resolveLocalStorageRoots({
         platform: input.platform,
         userHome: input.userHome,
@@ -169,6 +182,7 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         sourceRecord,
         local,
         policy,
+        ownership,
         serviceEnvironment: {
             NOWWORK_HOME: nowworkHome,
             NOWWORK_ENV_TAG: environment,
@@ -178,6 +192,7 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
             { name: "profile.json", path: profilePath(input.profile, input.currentDaemonHome) },
             { name: "service-descriptor", path: sourceRecord.descriptorPath },
             { name: "managed-service-registry.json", path: managedServiceRegistryPath(input.userHome) },
+            { name: "installations.json", path: installationsPath(local.configRoot) },
         ],
     }, { assertSourceIdentity });
     return Object.freeze({ ready: true, runtime });

package/dist/storage-runtime.js

@@ -1,6 +1,7 @@
 import { findInstallationForProfile, readInstallations, resolveLocalStorageRoots, } from "./storage-config.js";
 import { storageHelloIdentity } from "./storage-identity.js";
 import { storageLayout } from "./storage-layout.js";
+import { readStorageOwnershipClaim } from "./storage-ownership.js";
 const canonicalServerUrl = (value) => value.replace(/\/+$/u, "");
 export function resolveStorageRuntime(input) {
     const installation = findInstallationForProfile(input.records, input.profile);
@@ -24,7 +25,11 @@ export function resolveStorageRuntime(input) {
     return Object.freeze({
         installation,
         layout,
-        identity: storageHelloIdentity({ installation, layout }),
+        identity: storageHelloIdentity({
+            installation,
+            layout,
+            ...(input.ownership === undefined ? {} : { ownership: input.ownership }),
+        }),
         local,
     });
 }
@@ -35,5 +40,16 @@ export async function loadStorageRuntime(input) {
         environment: input.environment,
     });
     const records = await readInstallations({ configRoot: local.configRoot });
-    return resolveStorageRuntime({ ...input, records });
+    const baseline = resolveStorageRuntime({ ...input, records });
+    if (baseline === null)
+        return null;
+    let ownership;
+    try {
+        ownership = await readStorageOwnershipClaim(baseline.layout.persistentRoot);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return ownership === undefined ? baseline : resolveStorageRuntime({ ...input, records, ownership });
 }

package/dist/storage-status-delivery.js

@@ -18,6 +18,8 @@ const DeliveredFrameSchema = z.object({
     environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
     workspaceId: z.string().uuid(),
     profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
+    ownerEpoch: z.number().int().positive().safe().optional(),
+    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
     sourceStorageFingerprint: z.string().optional(),
     targetStorageFingerprint: z.string().optional(),
     manifestDigest: z.string().optional(),
@@ -45,6 +47,8 @@ export function storageStatusEventId(frame) {
         frame.environment,
         frame.workspaceId,
         frame.profile,
+        frame.ownerEpoch ?? null,
+        frame.ownershipClaimFingerprint ?? null,
         frame.sourceStorageFingerprint ?? null,
         frame.targetStorageFingerprint ?? null,
         frame.manifestDigest ?? null,

package/dist/storage-status-replay.js

@@ -35,7 +35,10 @@ export function storageMigrationStatusReplay(receipt, expected) {
     if (expected !== undefined && (receipt.migrationId !== expected.migrationId
         || receipt.environment !== expected.environment
         || receipt.workspaceId !== expected.workspaceId
-        || receipt.profile !== expected.profile)) {
+        || receipt.profile !== expected.profile
+        || (expected.ownerEpoch !== undefined && receipt.ownerEpoch !== expected.ownerEpoch)
+        || (expected.ownershipClaimFingerprint !== undefined
+            && receipt.ownershipClaimFingerprint !== expected.ownershipClaimFingerprint))) {
         throw new Error("storage migration receipt identity mismatch");
     }
     return Object.freeze(storageMigrationReplayStatuses(receipt).map((status) => Object.freeze({
@@ -45,6 +48,10 @@ export function storageMigrationStatusReplay(receipt, expected) {
         environment: receipt.environment,
         workspaceId: receipt.workspaceId,
         profile: receipt.profile,
+        ...(receipt.ownerEpoch === undefined ? {} : { ownerEpoch: receipt.ownerEpoch }),
+        ...(receipt.ownershipClaimFingerprint === undefined ? {} : {
+            ownershipClaimFingerprint: receipt.ownershipClaimFingerprint,
+        }),
         ...(status === "verified" ? { finalManifestDigest: receipt.manifestDigest } : {}),
         ...(status === "failed"
             ? {
@@ -98,6 +105,10 @@ export async function monitorStorageMigrationStatus(input, send, injected = {})
                 environment: input.environment,
                 workspaceId: input.workspaceId,
                 profile: input.profile,
+                ...(input.ownerEpoch === undefined ? {} : { ownerEpoch: input.ownerEpoch }),
+                ...(input.ownershipClaimFingerprint === undefined ? {} : {
+                    ownershipClaimFingerprint: input.ownershipClaimFingerprint,
+                }),
                 errorCode: workerFailure.errorCode,
                 errorMessage: workerFailure.errorMessage,
                 ...(receipt?.sourceStopAttempted === false || receipt === null ? { reopenAdmission: true } : {}),
@@ -114,6 +125,10 @@ export async function monitorStorageMigrationStatus(input, send, injected = {})
                 environment: input.environment,
                 workspaceId: input.workspaceId,
                 profile: input.profile,
+                ...(input.ownerEpoch === undefined ? {} : { ownerEpoch: input.ownerEpoch }),
+                ...(input.ownershipClaimFingerprint === undefined ? {} : {
+                    ownershipClaimFingerprint: input.ownershipClaimFingerprint,
+                }),
                 errorCode: "worker_heartbeat_stale_recovery_required",
                 errorMessage: "storage migration worker heartbeat expired; explicit recovery is required",
                 ...(receipt?.sourceStopAttempted === false || receipt === null ? { reopenAdmission: true } : {}),

package/dist/storage-worker-executor.js

@@ -367,6 +367,7 @@ export async function executeStorageMigrationWorker(handoffPath, injected = {})
         targetWorkspaceRoot: operation.migration.targetWorkspaceRoot,
         backupsRoot: operation.migration.backupsRoot,
         backupArtifacts: operation.migration.backupArtifacts,
+        ...(operation.migration.ownership === undefined ? {} : { ownership: operation.migration.ownership }),
         acceptedWarnings: operation.migration.acceptedWarnings,
         onStatus: () => assertHeartbeatHealthy(),
         assertHealthy: assertHeartbeatHealthy,

package/dist/storage-worker-operation.js

@@ -118,6 +118,10 @@ const OperationSchema = z.object({
             name: z.string().regex(/^[a-z0-9][a-z0-9_.-]{0,127}$/u),
             path: AbsolutePathSchema,
         }).strict()).max(32),
+        ownership: z.object({
+            ownerEpoch: z.number().int().positive().safe(),
+            ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
+        }).strict().optional(),
         acceptedWarnings: z.array(StorageMigrationWarningCodeSchema)
             .max(StorageMigrationWarningCodeSchema.options.length),
     }).strict(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.77-beta.7",
+  "version": "0.6.77-beta.8",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",