@nowcrew/daemon 0.6.77-beta.7 → 0.6.77-beta.9

package/dist/host-execution-coordinator.js

@@ -5,6 +5,7 @@ import { randomUUID } from "node:crypto";
 import { defaultProcessController } from "./execution-journal.js";
 import { createJournalLease, createJournalLeaseRegistry, JournalLockedError, } from "./execution-journal-lock.js";
 import { dslog } from "./slog.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 const HOST_EXECUTION_SLOT_COUNT = 10;
 const HOST_STARTUP_SLOT_COUNT = 10;
 const HOST_STARTUP_GAP_MS = 500;
@@ -16,10 +17,10 @@ export class HostReservationCancelledError extends Error {
         super(message);
     }
 }
-export function defaultHostExecutionCoordinatorRoot(userHome = homedir()) {
+export function defaultHostExecutionCoordinatorRoot(userHome = homedir(), localHome) {
     // Deliberately independent of CREW_DAEMON_HOME and agentsRoot: every profile
     // owned by this OS user must share the same physical-compute safety boundary.
-    return resolve(userHome, ".crew", "daemon", "compute-execution");
+    return resolve(localHome ?? resolveDaemonLocalStateRoot({ userHome, platform: process.platform }), "daemon", "compute-execution");
 }
 async function syncDirectory(path) {
     if (process.platform === "win32")
@@ -132,7 +133,7 @@ async function writeLaunchTimestamp(path, value) {
     }
 }
 export function createHostExecutionCoordinator(options = {}) {
-    const root = resolve(options.root ?? defaultHostExecutionCoordinatorRoot());
+    const root = resolve(options.root ?? defaultHostExecutionCoordinatorRoot(options.userHome, options.localHome));
     const executionSlots = options.executionSlots ?? HOST_EXECUTION_SLOT_COUNT;
     const startupSlots = options.startupSlots ?? HOST_STARTUP_SLOT_COUNT;
     const startupGapMs = options.startupGapMs ?? HOST_STARTUP_GAP_MS;

package/dist/main.js

@@ -30,6 +30,7 @@ import { storageMigrationStatusReplay } from "./storage-status-replay.js";
 import { runStorageWorkerCommand } from "./storage-worker-command.js";
 import { probeStorageMigrationRuntime } from "./storage-runtime-readiness.js";
 import { createStorageTargetConfirmationHandler } from "./storage-target-confirmation.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 async function main() {
     const workerResult = await runStorageWorkerCommand(process.argv.slice(2));
     if (workerResult !== null) {
@@ -73,8 +74,16 @@ async function main() {
     if (values["daemon-home"])
         process.env.CREW_DAEMON_HOME = values["daemon-home"];
     let activeDaemonHome;
+    const localHome = resolveDaemonLocalStateRoot({
+        userHome: homedir(),
+        platform: process.platform,
+        explicit: process.env.NOWWORK_LOCAL_HOME,
+        mode: process.env.NOWWORK_LOCAL_HOME_MODE
+            ?? process.env.NOWWORK_STORAGE_MODE
+            ?? (values["daemon-home"] === undefined ? undefined : "legacy"),
+    });
     if (values.profile) {
-        const home = daemonHome();
+        const home = daemonHome(process.env, values.profile);
         activeDaemonHome = home;
         const profile = await loadProfile(values.profile, home);
         if (cmd === "serve") {
@@ -83,6 +92,7 @@ async function main() {
                 platform: process.platform,
                 profile: profile.name,
                 userHome: homedir(),
+                localHome,
                 uid: process.getuid?.(),
                 daemonHome: home,
                 agentsRoot: resolveAgentsRoot(profile.agentsRoot, homedir(), process.platform),
@@ -141,7 +151,7 @@ async function main() {
             : daemonGlobalInstallation(builtDaemonEntry(), process.platform);
         const installationLease = installation === null
             ? null
-            : await acquireDaemonInstallationLease(installation.npmPrefix);
+            : await acquireDaemonInstallationLease(installation.npmPrefix, { localHome });
         const migrationRuntime = values.profile === undefined || activeDaemonHome === undefined || storageRuntime !== null
             ? { ready: false, reason: "not_legacy_source" }
             : await probeStorageMigrationRuntime({
@@ -198,6 +208,7 @@ async function main() {
         await runWithDaemonInstallationLease(installationLease, async () => {
             const service = serve(runtimeConfig, {
                 ...(values.profile === undefined ? {} : { profileName: values.profile }),
+                localHome,
                 ...(storageMigration === undefined ? {} : { storageMigration }),
             });
             await runServeLifecycle(service);

package/dist/managed-service-diagnostics.js

@@ -16,6 +16,7 @@ export async function inspectManagedServiceDiagnostics(input) {
     const inspectLease = input.inspectInstallationLease
         ?? (() => inspectDaemonInstallationLease(input.expectedRecord.npmPrefix, {
             ...(userHome === undefined ? {} : { userHome }),
+            ...(registry.localHome === undefined ? {} : { localHome: registry.localHome }),
         }));
     let services = null;
     let registryCheck;

package/dist/managed-service-registry.js

@@ -5,6 +5,7 @@ import { homedir } from "node:os";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { z } from "zod";
 import { acquireProfileSaveLock } from "./computer-profile-lock.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 const AbsolutePathSchema = z.string().min(1).refine(isAbsolute, "must be an absolute path");
 const ManagedServiceRecordSchema = z.object({
     version: z.literal(1),
@@ -42,11 +43,15 @@ export class ManagedServiceConflictError extends ManagedServiceRegistryError {
         this.owner = owner;
     }
 }
-function registryDirectory(userHome) {
-    return resolve(userHome, ".crew", "daemon", "managed-services");
+function registryDirectory(userHome, localHome) {
+    const root = localHome ?? resolveDaemonLocalStateRoot({
+        userHome,
+        platform: process.platform,
+    });
+    return resolve(root, "daemon", "managed-services");
 }
-export function managedServiceRegistryPath(userHome = homedir()) {
-    return resolve(registryDirectory(userHome), "registry.json");
+export function managedServiceRegistryPath(userHome = homedir(), localHome) {
+    return resolve(registryDirectory(userHome, localHome), "registry.json");
 }
 export async function listManagedServiceDescriptorPaths(platform, userHome = homedir()) {
     const directory = platform === "darwin"
@@ -219,14 +224,14 @@ export function managedServiceConflict(services, candidate) {
 }
 export async function withManagedServiceRegistryLock(options, operation) {
     const userHome = options.userHome ?? homedir();
-    const directory = registryDirectory(userHome);
+    const directory = registryDirectory(userHome, options.localHome);
     const release = await acquireProfileSaveLock(directory, {
         ...(options.lockTimeoutMs === undefined ? {} : { timeoutMs: options.lockTimeoutMs }),
         ...(options.lockRetryMs === undefined ? {} : { retryMs: options.lockRetryMs }),
     });
     let operationError;
     try {
-        const path = managedServiceRegistryPath(userHome);
+        const path = managedServiceRegistryPath(userHome, options.localHome);
         const services = await readRegistryFile(path);
         return await operation({
             services,
@@ -258,7 +263,7 @@ export async function withManagedServiceRegistryLock(options, operation) {
     }
 }
 export async function readManagedServiceRegistry(options = {}) {
-    return readRegistryFile(managedServiceRegistryPath(options.userHome ?? homedir()));
+    return readRegistryFile(managedServiceRegistryPath(options.userHome ?? homedir(), options.localHome));
 }
 export async function registerManagedService(input, options = {}) {
     const candidate = normalizeManagedServiceRecord(input);

package/dist/managed-service-startup.js

@@ -17,7 +17,10 @@ export async function assertManagedServiceStartup(input) {
         ...(input.environment === undefined ? {} : { environment: input.environment }),
     });
     const readRegistry = input.readManagedServices
-        ?? (() => readManagedServiceRegistry({ userHome: input.userHome }));
+        ?? (() => readManagedServiceRegistry({
+            userHome: input.userHome,
+            ...(input.localHome === undefined ? {} : { localHome: input.localHome }),
+        }));
     const listDescriptors = input.listManagedDescriptorPaths
         ?? (() => listManagedServiceDescriptorPaths(input.platform, input.userHome));
     const readDescriptor = input.readServiceDescriptor ?? readServiceDescriptor;

package/dist/serve.js

@@ -53,6 +53,7 @@ import { handleRuntimeHealthProbeFrame } from "./runtime-health-handler.js";
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
+import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
 import { attachStorageMigrationRuntime, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
@@ -83,8 +84,10 @@ export function serve(config, opts = {}) {
     let detectedExecutionRuntimes = [], executionRuntimesKnown = false;
     let runtimeFacts = null;
     const runtimeProbe = createRuntimeProbeCoordinator();
+    const localHome = opts.localHome ?? resolveDaemonLocalStateRootFromEnv();
     const hostCoordinator = opts.execution?.hostCoordinator
         ?? createHostExecutionCoordinator({
+            localHome,
             executionSlots: config.executionLimits.maxParallelTotal,
             startupSlots: config.executionLimits.maxStartingTotal,
             startupGapMs: config.executionLimits.startupGapMs,
@@ -825,9 +828,9 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
-                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string") {
+                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
                     try {
-                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId });
+                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId, machineId: r.machineId });
                         machineHelloPublisher.republish();
                     }
                     catch (error) {

package/dist/slog.js

@@ -15,6 +15,7 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 const FLUSH_INTERVAL_MS = 1500;
 const BATCH_SIZE = 50;
 const SPOOL_MAX_FILES = 50; // spool 目录文件数上限,超出丢最旧(日志非关键数据,防无限膨胀)
@@ -27,6 +28,7 @@ let flushPromise = null;
 let inFlightBatch = [];
 let lastErrorAt = 0;
 let exitHookInstalled = false;
+let localStateRoot;
 function deploymentEnvironment(serverHost) {
     if (serverHost === "nowwork-in.nowcoder.com")
         return "prod";
@@ -40,12 +42,23 @@ function deploymentEnvironment(serverHost) {
     return "unknown";
 }
 function spoolDir() {
-    return process.env.CREW_SLS_SPOOL_DIR ?? join(homedir(), ".crew", "logs", "sls-spool");
+    return process.env.CREW_SLS_SPOOL_DIR ?? join(localStateRoot ?? resolveDaemonLocalStateRoot({
+        userHome: homedir(),
+        platform: process.platform,
+        explicit: process.env.NOWWORK_LOCAL_HOME,
+        mode: process.env.NOWWORK_LOCAL_HOME_MODE ?? process.env.NOWWORK_STORAGE_MODE,
+    }), "logs", "sls-spool");
 }
 /** serve/run 启动时调用一次;disabled(CREW_SLS_LOG=off)则保持 no-op。 */
 export function initSlog(serverUrl, machineToken, identity = {}) {
     if (process.env.CREW_SLS_LOG === "off" || process.env.CREW_SLS_LOG === "0")
         return;
+    localStateRoot = resolveDaemonLocalStateRoot({
+        userHome: homedir(),
+        platform: process.platform,
+        explicit: process.env.NOWWORK_LOCAL_HOME,
+        mode: process.env.NOWWORK_LOCAL_HOME_MODE ?? process.env.NOWWORK_STORAGE_MODE,
+    });
     cfg = { serverUrl: serverUrl.replace(/\/+$/, ""), token: machineToken };
     let serverHost;
     try {

package/dist/storage-control.js

@@ -5,6 +5,8 @@ const IdentitySchema = z.object({
     migrationId: z.string().uuid(),
     environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
     workspaceId: z.string().uuid(),
+    ownerEpoch: z.number().int().positive().safe().optional(),
+    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
 });
 const DoctorRequestSchema = IdentitySchema.extend({ type: z.literal("daemon:storage-doctor") }).strict();
 const MigrateRequestSchema = IdentitySchema.extend({
@@ -26,6 +28,11 @@ export function createStorageControlController(input) {
     const profile = z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u).parse(input.profile);
     const sourceStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.sourceStorageFingerprint);
     const targetStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.targetStorageFingerprint);
+    const ownership = input.ownership === undefined ? undefined : Object.freeze({
+        ownerEpoch: z.number().int().positive().safe().parse(input.ownership.ownerEpoch),
+        ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u)
+            .parse(input.ownership.ownershipClaimFingerprint),
+    });
     const preflights = new Map();
     const preflightRuns = new Map();
     const appliedMigrationIds = new Set();
@@ -39,6 +46,7 @@ export function createStorageControlController(input) {
         environment,
         workspaceId,
         profile,
+        ...(ownership === undefined ? {} : ownership),
         ...extra,
     });
     const failure = (identity, errorCode, error, reopenAdmission = false, extra = {}) => {
@@ -59,7 +67,10 @@ export function createStorageControlController(input) {
             input.onStatusError?.(error, statusFrame);
         }
     };
-    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId;
+    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId
+        && (ownership === undefined
+            || (identity.ownerEpoch === ownership.ownerEpoch
+                && identity.ownershipClaimFingerprint === ownership.ownershipClaimFingerprint));
     const preflightKey = (identity) => `${identity.migrationId}\0${identity.environment}\0${identity.workspaceId}`;
     const runPreflight = (identity, failureFallback = "doctor_failed") => {
         const key = preflightKey(identity);

package/dist/storage-identity.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { STORAGE_LAYOUT_VERSION } from "./storage-layout.js";
+import { createStorageOwnershipClaim } from "./storage-ownership.js";
 function fingerprint(namespace, value) {
     return `sha256:${createHash("sha256").update(`${namespace}\0${value}`).digest("hex")}`;
 }
@@ -14,14 +15,27 @@ export function storageHelloIdentity(input) {
         || installation.runtimeRoot !== layout.runtimeRoot) {
         throw new Error("installation storage identity does not match resolved layout");
     }
+    const workspaceRootFingerprint = fingerprint("workspace-root", layout.workspaceRoot);
+    let ownership;
+    if (input.ownership !== undefined) {
+        const { claimFingerprint: reportedFingerprint, ...claimIdentity } = input.ownership;
+        ownership = createStorageOwnershipClaim(claimIdentity);
+        if (ownership.claimFingerprint !== reportedFingerprint
+            || ownership.workspaceId !== layout.workspaceId
+            || ownership.environment !== layout.environment
+            || ownership.workspaceRootFingerprint !== workspaceRootFingerprint) {
+            throw new Error("storage ownership identity does not match resolved layout");
+        }
+    }
     return Object.freeze({
         storageLayoutVersion: STORAGE_LAYOUT_VERSION,
         storageEnvironment: layout.environment,
         storageWorkspaceId: layout.workspaceId,
         storageIdFingerprint: storageIdFingerprint(installation.storageId),
-        workspaceRootFingerprint: fingerprint("workspace-root", layout.workspaceRoot),
+        workspaceRootFingerprint,
         daemonRootFingerprint: fingerprint("daemon-root", layout.daemonRoot),
         agentRootFingerprint: fingerprint("agent-root", layout.agentItemsRoot),
+        ...(ownership === undefined ? {} : { storageOwnership: ownership }),
         ...(installation.storageMigrationId === undefined
             ? {}
             : { storageMigrationId: installation.storageMigrationId }),

package/dist/storage-migration-controller.js

@@ -27,6 +27,8 @@ const ReceiptSchema = z.object({
     environment: z.string().min(1),
     workspaceId: z.string().uuid(),
     profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
+    ownerEpoch: z.number().int().positive().safe().optional(),
+    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
     manifestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
     targetFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
     status: ReceiptStatusSchema,
@@ -37,13 +39,23 @@ const ReceiptSchema = z.object({
     sourceStopAttempted: z.boolean().optional(),
     sourceStopped: z.boolean().optional(),
     targetTouched: z.boolean().optional(),
-}).strict();
+}).strict().superRefine((receipt, context) => {
+    if ((receipt.ownerEpoch === undefined) !== (receipt.ownershipClaimFingerprint === undefined)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "storage receipt ownership identity must be complete" });
+    }
+});
 const MigrationLockSchema = z.object({
     version: z.literal(1),
     migrationId: z.string().uuid(),
     pid: z.number().int().positive(),
     createdAt: z.string().datetime({ offset: true }),
 }).strict();
+const REQUIRED_BACKUP_ARTIFACTS = Object.freeze([
+    "profile.json",
+    "service-descriptor",
+    "managed-service-registry.json",
+    "installations.json",
+]);
 export class StorageMigrationFailure extends Error {
     code;
     receipt;
@@ -204,6 +216,16 @@ function assertOwnedStaging(input) {
     }
 }
 async function backupArtifacts(input, receipt) {
+    const providedNames = new Set(input.backupArtifacts.map((artifact) => artifact.name));
+    const missing = REQUIRED_BACKUP_ARTIFACTS.filter((name) => !providedNames.has(name));
+    if (missing.length > 0) {
+        throw new StorageMigrationFailure("backup_artifact_missing", `required rollback artifacts are missing: ${missing.join(", ")}`);
+    }
+    for (const artifact of input.backupArtifacts) {
+        if (!(await lstat(artifact.path)).isFile()) {
+            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact must be a file");
+        }
+    }
     const directory = join(input.backupsRoot, receipt.migrationId);
     const artifactsDirectory = join(directory, "artifacts");
     await mkdir(artifactsDirectory, { recursive: true, mode: 0o700 });
@@ -217,8 +239,6 @@ async function backupArtifacts(input, receipt) {
             throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact names must be unique safe file names");
         }
         names.add(artifact.name);
-        if (!(await lstat(artifact.path)).isFile())
-            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact must be a file");
         const destination = join(artifactsDirectory, artifact.name);
         await copyFile(artifact.path, destination);
         await chmod(destination, 0o600);
@@ -271,6 +291,7 @@ export async function runStorageMigration(input, dependencies) {
         environment: input.doctor.environment,
         workspaceId: input.doctor.workspaceId,
         profile: input.doctor.profile,
+        ...(input.ownership === undefined ? {} : input.ownership),
         manifestDigest: input.doctor.manifestDigest,
         targetFingerprint: targetFingerprint(input.targetWorkspaceRoot),
         status: "preflight_passed",
@@ -301,7 +322,7 @@ export async function runStorageMigration(input, dependencies) {
         input.assertHealthy?.();
         await transition("backing_up");
         receipt = await backupArtifacts(input, receipt).catch((error) => {
-            failureCode = "backup_failed";
+            failureCode = error instanceof StorageMigrationFailure ? error.code : "backup_failed";
             throw error;
         });
         await writeReceipt(path, receipt);

package/dist/storage-ownership.js

@@ -0,0 +1,55 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+const FingerprintSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u);
+const StorageOwnershipClaimSchema = z.object({
+    version: z.literal(1),
+    machineId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
+    volumeFingerprint: FingerprintSchema,
+    workspaceRootFingerprint: FingerprintSchema,
+    ownerEpoch: z.number().int().positive().safe(),
+    claimFingerprint: FingerprintSchema,
+}).strict();
+function claimFingerprint(identity) {
+    const digest = createHash("sha256").update([
+        "nowwork-storage-ownership-v1",
+        identity.machineId,
+        identity.workspaceId,
+        identity.environment,
+        identity.volumeFingerprint,
+        identity.workspaceRootFingerprint,
+        String(identity.ownerEpoch),
+    ].join("\0")).digest("hex");
+    return `sha256:${digest}`;
+}
+export function createStorageOwnershipClaim(input) {
+    const parsed = StorageOwnershipClaimSchema.omit({ version: true, claimFingerprint: true }).parse(input);
+    const identity = Object.freeze({
+        ...parsed,
+        machineId: parsed.machineId.toLowerCase(),
+        workspaceId: parsed.workspaceId.toLowerCase(),
+        environment: parsed.environment.toLowerCase(),
+    });
+    return Object.freeze({ ...identity, claimFingerprint: claimFingerprint(identity) });
+}
+export function storageOwnershipClaimPath(nowworkHome) {
+    return join(nowworkHome, "storage-layout.json");
+}
+export async function readStorageOwnershipClaim(nowworkHome) {
+    const path = storageOwnershipClaimPath(nowworkHome);
+    const metadata = await lstat(path);
+    if (!metadata.isFile())
+        throw new Error("storage ownership claim must be a file");
+    if (metadata.size > 16 * 1024)
+        throw new Error("storage ownership claim file is too large");
+    const parsed = StorageOwnershipClaimSchema.parse(JSON.parse(await readFile(path, "utf8")));
+    const { version: _version, claimFingerprint: reportedFingerprint, ...identity } = parsed;
+    const expected = createStorageOwnershipClaim(identity);
+    if (reportedFingerprint !== expected.claimFingerprint) {
+        throw new Error("storage ownership claim fingerprint is invalid");
+    }
+    return expected;
+}

package/dist/storage-runtime-controller.js

@@ -23,9 +23,10 @@ function deterministicUuid(value) {
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 function storageId(input, workspaceId) {
-    return `storage_${createHash("sha256").update([
-        input.serverUrl.replace(/\/+$/u, ""), input.profile, workspaceId, input.nowworkHome,
-    ].join("\0")).digest("hex").slice(0, 32)}`;
+    if (input.ownership.workspaceId !== workspaceId || input.ownership.environment !== input.environment) {
+        throw new Error("Storage ownership claim does not match the migration identity");
+    }
+    return `storage_${input.ownership.claimFingerprint.slice("sha256:".length)}`;
 }
 function installationBase(input, workspaceId, migrationId, createdAt) {
     const layout = storageLayout({
@@ -102,6 +103,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
         ...injected,
     };
     let workspaceId = null;
+    let machineId = null;
     let identity;
     let gate = null;
     let sendStatus = null;
@@ -194,6 +196,10 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                 targetWorkspaceRoot: target.workspaceRoot,
                 backupsRoot: input.local.backupsRoot,
                 backupArtifacts: input.backupArtifacts.map((artifact) => ({ ...artifact })),
+                ownership: {
+                    ownerEpoch: input.ownership.ownerEpoch,
+                    ownershipClaimFingerprint: input.ownership.claimFingerprint,
+                },
                 acceptedWarnings: [...input.policy.acceptedWarnings],
             },
             service: {
@@ -229,6 +235,10 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             profile: input.profile,
             sourceStorageFingerprint,
             targetStorageFingerprint: identity.storageIdFingerprint,
+            ownership: {
+                ownerEpoch: input.ownership.ownerEpoch,
+                ownershipClaimFingerprint: input.ownership.claimFingerprint,
+            },
             runDoctor: async (migrationId) => dependencies.runDoctor(await doctorInput(migrationId)),
             runMigration: async (doctor) => {
                 await gate.closeAndFlush();
@@ -264,6 +274,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                         environment: operation.environment,
                         workspaceId: operation.workspaceId,
                         profile: operation.profile,
+                        ...(operation.migration.ownership === undefined ? {} : operation.migration.ownership),
                     }, sendStatus);
                     if (outcome.reopenAdmission)
                         gate.reopen();
@@ -285,20 +296,31 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
     };
     const bindServerIdentity = (server) => {
         const nextWorkspaceId = UUID.parse(server.workspaceId).toLowerCase();
+        const nextMachineId = UUID.parse(server.machineId).toLowerCase();
         if (workspaceId !== null && workspaceId !== nextWorkspaceId) {
             throw new Error("Storage migration server workspace identity changed");
         }
-        workspaceId = nextWorkspaceId;
+        if (machineId !== null && machineId !== nextMachineId) {
+            throw new Error("Storage migration server machine identity changed");
+        }
+        if (input.ownership.workspaceId !== nextWorkspaceId
+            || input.ownership.machineId !== nextMachineId
+            || input.ownership.environment !== input.environment) {
+            throw new Error("Storage ownership claim does not match authenticated server identity");
+        }
         const createdAt = dependencies.now().toISOString();
-        const installation = installationBase(input, workspaceId, undefined, createdAt);
+        const installation = installationBase(input, nextWorkspaceId, undefined, createdAt);
         const layout = storageLayout({
             nowworkHome: input.nowworkHome,
             environment: input.environment,
-            workspaceId,
+            workspaceId: nextWorkspaceId,
             runtimeBase: input.local.runtimeBase,
             platform: input.platform,
         });
-        identity = storageHelloIdentity({ installation, layout });
+        const nextIdentity = storageHelloIdentity({ installation, layout, ownership: input.ownership });
+        workspaceId = nextWorkspaceId;
+        machineId = nextMachineId;
+        identity = nextIdentity;
         ensureControl();
         drainPendingControlMessages();
     };

package/dist/storage-runtime-readiness.js

@@ -5,10 +5,12 @@ import { buildServiceSpec } from "./computer-service.js";
 import { profilePath } from "./computer-profile.js";
 import { assertManagedServiceIdentity } from "./managed-service-lifecycle.js";
 import { managedServiceRegistryPath, readManagedServiceRegistry, } from "./managed-service-registry.js";
-import { resolveLocalStorageRoots } from "./storage-config.js";
+import { installationsPath, resolveLocalStorageRoots } from "./storage-config.js";
 import { readStorageMigrationPolicy } from "./storage-migration-policy.js";
 import { createStorageMigrationRuntimeController, } from "./storage-runtime-controller.js";
 import { resolveEnvTag, resolveNowworkHome } from "./storage-layout.js";
+import { readStorageOwnershipClaim } from "./storage-ownership.js";
+import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 const notReady = (reason) => Object.freeze({ ready: false, reason });
 function canonicalPath(value) {
     const absolute = resolve(value);
@@ -73,6 +75,12 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         serverUrl: z.string().url().parse(rawInput.serverUrl),
         platform: rawInput.platform,
     };
+    const localHome = resolveDaemonLocalStateRoot({
+        userHome: rawInput.userHome,
+        platform: rawInput.platform,
+        explicit: rawInput.environment.NOWWORK_LOCAL_HOME,
+        mode: rawInput.environment.NOWWORK_LOCAL_HOME_MODE ?? rawInput.environment.NOWWORK_STORAGE_MODE,
+    });
     let nowworkHome;
     let environment;
     try {
@@ -106,11 +114,12 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         assertManagedServiceIdentity,
         readPolicy: readStorageMigrationPolicy,
         createController: createStorageMigrationRuntimeController,
+        readOwnership: readStorageOwnershipClaim,
         ...injected,
     };
     let sourceRecord;
     try {
-        const records = await dependencies.readManagedServices({ userHome: input.userHome });
+        const records = await dependencies.readManagedServices({ userHome: input.userHome, localHome });
         const found = findSourceRecord(records, input);
         if (found === null)
             return notReady("source_service_record_missing");
@@ -132,7 +141,7 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
     const assertSourceIdentity = () => dependencies.assertManagedServiceIdentity({
         spec: sourceSpec,
         record: sourceRecord,
-        registry: { userHome: input.userHome },
+        registry: { userHome: input.userHome, localHome },
     });
     try {
         await assertSourceIdentity();
@@ -153,6 +162,17 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
     catch {
         return notReady("migration_policy_invalid");
     }
+    let ownership;
+    try {
+        ownership = await dependencies.readOwnership(nowworkHome);
+    }
+    catch (error) {
+        return notReady(error.code === "ENOENT"
+            ? "storage_ownership_claim_missing"
+            : "storage_ownership_claim_invalid");
+    }
+    if (ownership.environment !== environment)
+        return notReady("storage_ownership_claim_invalid");
     const local = resolveLocalStorageRoots({
         platform: input.platform,
         userHome: input.userHome,
@@ -169,6 +189,7 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         sourceRecord,
         local,
         policy,
+        ownership,
         serviceEnvironment: {
             NOWWORK_HOME: nowworkHome,
             NOWWORK_ENV_TAG: environment,
@@ -177,7 +198,8 @@ export async function probeStorageMigrationRuntime(rawInput, injected = {}) {
         backupArtifacts: [
             { name: "profile.json", path: profilePath(input.profile, input.currentDaemonHome) },
             { name: "service-descriptor", path: sourceRecord.descriptorPath },
-            { name: "managed-service-registry.json", path: managedServiceRegistryPath(input.userHome) },
+            { name: "managed-service-registry.json", path: managedServiceRegistryPath(input.userHome, localHome) },
+            { name: "installations.json", path: installationsPath(local.configRoot) },
         ],
     }, { assertSourceIdentity });
     return Object.freeze({ ready: true, runtime });

package/dist/storage-runtime.js

@@ -1,6 +1,7 @@
 import { findInstallationForProfile, readInstallations, resolveLocalStorageRoots, } from "./storage-config.js";
 import { storageHelloIdentity } from "./storage-identity.js";
 import { storageLayout } from "./storage-layout.js";
+import { readStorageOwnershipClaim } from "./storage-ownership.js";
 const canonicalServerUrl = (value) => value.replace(/\/+$/u, "");
 export function resolveStorageRuntime(input) {
     const installation = findInstallationForProfile(input.records, input.profile);
@@ -24,7 +25,11 @@ export function resolveStorageRuntime(input) {
     return Object.freeze({
         installation,
         layout,
-        identity: storageHelloIdentity({ installation, layout }),
+        identity: storageHelloIdentity({
+            installation,
+            layout,
+            ...(input.ownership === undefined ? {} : { ownership: input.ownership }),
+        }),
         local,
     });
 }
@@ -35,5 +40,16 @@ export async function loadStorageRuntime(input) {
         environment: input.environment,
     });
     const records = await readInstallations({ configRoot: local.configRoot });
-    return resolveStorageRuntime({ ...input, records });
+    const baseline = resolveStorageRuntime({ ...input, records });
+    if (baseline === null)
+        return null;
+    let ownership;
+    try {
+        ownership = await readStorageOwnershipClaim(baseline.layout.persistentRoot);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return ownership === undefined ? baseline : resolveStorageRuntime({ ...input, records, ownership });
 }