@nowcrew/daemon 0.6.87-beta.3 → 0.6.87-beta.4

package/dist/cloud-report-uploader.js

@@ -13,22 +13,17 @@ const fileFingerprint = async (path) => {
     const stat = await lstat(path);
     return `${stat.size}:${stat.mtimeMs}`;
 };
-function isReportFile(root, path) {
+function isReportFile(root, path, kind) {
     const parts = relative(root, path).split(sep).filter(Boolean);
     const filename = parts.at(-1) ?? "";
-    if (parts[0] === "tasks" && parts.length >= 3) {
-        return REPORT_FILENAMES.has(filename) || extname(filename).toLowerCase() === ".html";
-    }
-    if (parts[0] !== "qa-report-server-v2")
-        return false;
-    if (parts[1] === "static" && parts.length === 3)
-        return extname(filename).toLowerCase() === ".html";
-    if (parts[1] === "qa-results" && parts.length >= 4) {
+    if (kind === "static")
+        return parts.length === 1 && extname(filename).toLowerCase() === ".html";
+    if (parts.length >= 2) {
         return REPORT_FILENAMES.has(filename) || extname(filename).toLowerCase() === ".html";
     }
     return false;
 }
-async function walkReports(root, directory, depth, output) {
+async function walkReports(root, directory, depth, output, kind) {
     if (depth > MAX_DEPTH || output.length >= MAX_FILES)
         return;
     const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
@@ -39,28 +34,26 @@ async function walkReports(root, directory, depth, output) {
             continue;
         const path = join(directory, entry.name);
         if (entry.isDirectory()) {
-            await walkReports(root, path, depth + 1, output);
+            await walkReports(root, path, depth + 1, output, kind);
         }
-        else if (entry.isFile() && isReportFile(root, path)) {
+        else if (entry.isFile() && isReportFile(root, path, kind)) {
             output.push(resolve(path));
         }
     }
 }
-export async function snapshotReportFiles(root) {
+export async function snapshotReportFiles(root, qaReportRoot) {
     const files = [];
     const workspaceRoot = resolve(root);
-    for (const directory of [
-        join(workspaceRoot, "tasks"),
-        join(workspaceRoot, "qa-report-server-v2", "qa-results"),
-        join(workspaceRoot, "qa-report-server-v2", "static"),
-    ]) {
-        await walkReports(workspaceRoot, directory, 0, files);
+    const hub = resolve(qaReportRoot ?? join(workspaceRoot, "qa-report-server-v2"));
+    for (const kind of ["tasks", "qa-results", "static"]) {
+        const directory = join(kind === "tasks" ? workspaceRoot : hub, kind);
+        await walkReports(directory, directory, 0, files, kind);
     }
     const entries = await Promise.all(files.map(async (path) => [path, await fileFingerprint(path)]));
     return new Map(entries);
 }
-export async function discoverReportFiles(root, before) {
-    const after = await snapshotReportFiles(root);
+export async function discoverReportFiles(root, before, qaReportRoot) {
+    const after = await snapshotReportFiles(root, qaReportRoot);
     return [...after.entries()]
         .filter(([path, fingerprint]) => before.get(path) !== fingerprint)
         .map(([path]) => path)
@@ -97,7 +90,7 @@ async function verifyOssUrl(url) {
     }
 }
 export async function uploadCloudReports(input) {
-    const files = await discoverReportFiles(input.root, input.before);
+    const files = await discoverReportFiles(input.root, input.before, input.qaReportRoot);
     if (files.length === 0)
         return { urls: [], failures: [] };
     const run = input.execFile ?? (async (file, args) => {
@@ -131,10 +124,10 @@ export async function uploadCloudReports(input) {
     }
     return { urls, failures };
 }
-export async function prepareCloudReportSnapshot(facts, root) {
+export async function prepareCloudReportSnapshot(facts, root, qaReportRoot) {
     if (!facts.enabled)
         return null;
-    return snapshotReportFiles(root);
+    return snapshotReportFiles(root, qaReportRoot);
 }
 export async function prepareCloudReportExecution(input) {
     const facts = cloudReportUploadFacts(input.env);
@@ -147,7 +140,7 @@ export async function prepareCloudReportExecution(input) {
         return { facts, snapshot: null };
     }
     try {
-        return { facts, snapshot: await prepareCloudReportSnapshot(facts, input.root) };
+        return { facts, snapshot: await prepareCloudReportSnapshot(facts, input.root, input.qaReportRoot) };
     }
     catch (error) {
         dslog("cloud_report_upload.snapshot_failed", "报告文件快照失败", {
@@ -177,6 +170,7 @@ export async function deliverCloudReports(input) {
         const result = await (input.upload ?? uploadCloudReports)({
             script: input.facts.ossUploadScript,
             root: input.root,
+            ...(input.qaReportRoot === undefined ? {} : { qaReportRoot: input.qaReportRoot }),
             before: input.before,
         });
         if (result.failures.length > 0) {
@@ -185,6 +179,14 @@ export async function deliverCloudReports(input) {
                 uploaded_count: result.urls.length, failed_count: result.failures.length,
             });
         }
+        else {
+            dslog(result.urls.length === 0 ? "cloud_report_upload.no_files" : "cloud_report_upload.completed", result.urls.length === 0 ? "未发现新增或变化的报告文件" : "报告上传完成", {
+                execution_id: input.executionId, agent_handle: input.agentHandle,
+                uploaded_count: result.urls.length,
+                report_root: input.root,
+                qa_report_root: input.qaReportRoot ?? join(input.root, "qa-report-server-v2"),
+            });
+        }
         return {
             finalText: input.captureFinal && result.urls.length > 0
                 ? appendReportLinks(input.finalText ?? "", result.urls)

package/dist/external-output.js

@@ -1,15 +1,104 @@
 export const EXTERNAL_ANSWER_OPEN = "<nowwork_external_answer>";
 export const EXTERNAL_ANSWER_CLOSE = "</nowwork_external_answer>";
-function retainedMarkerPrefix(value, marker) {
-    const maximum = Math.min(value.length, marker.length - 1);
-    for (let length = maximum; length > 0; length -= 1) {
-        if (marker.startsWith(value.slice(-length)))
-            return length;
+const MAX_MARKER_TAG_LENGTH = 96;
+const KNOWN_EXTERNAL_ANSWER_TAG = /^now+orkexternalanswer$/u;
+const CANONICAL_EXTERNAL_ANSWER_TAG = "noworkexternalanswer";
+function editDistanceWithin(value, target, maximum) {
+    if (Math.abs(value.length - target.length) > maximum)
+        return false;
+    let previous = Array.from({ length: target.length + 1 }, (_, index) => index);
+    for (let row = 1; row <= value.length; row += 1) {
+        const current = [row];
+        let rowMinimum = row;
+        for (let column = 1; column <= target.length; column += 1) {
+            const cost = value[row - 1] === target[column - 1] ? 0 : 1;
+            const distance = Math.min(previous[column] + 1, current[column - 1] + 1, previous[column - 1] + cost);
+            current.push(distance);
+            rowMinimum = Math.min(rowMinimum, distance);
+        }
+        if (rowMinimum > maximum)
+            return false;
+        previous = current;
+    }
+    return previous[target.length] <= maximum;
+}
+function resemblesExternalAnswerTag(name) {
+    if (name.includes("externalanswer"))
+        return true;
+    const canonicalized = name.replace(/^now+ork/u, "nowork");
+    return editDistanceWithin(canonicalized, CANONICAL_EXTERNAL_ANSWER_TAG, 2);
+}
+function classifyMarkerTag(body) {
+    const trimmed = body.trim();
+    const closing = trimmed.startsWith("/");
+    const name = (closing ? trimmed.slice(1) : trimmed)
+        .trim()
+        .toLowerCase()
+        .replace(/[_\-\s]/gu, "");
+    if (KNOWN_EXTERNAL_ANSWER_TAG.test(name))
+        return { closing, kind: "known" };
+    return {
+        closing,
+        kind: resemblesExternalAnswerTag(name) ? "suspicious" : "other",
+    };
+}
+function nextMarkerTag(value, from) {
+    let cursor = from;
+    while (cursor < value.length) {
+        const start = value.indexOf("<", cursor);
+        if (start < 0)
+            return null;
+        const end = value.indexOf(">", start + 1);
+        if (end < 0)
+            return null;
+        const body = value.slice(start + 1, end);
+        const classified = classifyMarkerTag(body);
+        if (classified.kind === "suspicious"
+            || (classified.kind === "known" && body.length > MAX_MARKER_TAG_LENGTH)) {
+            return { start, end: end + 1, closing: classified.closing, kind: "suspicious" };
+        }
+        if (classified.kind === "known") {
+            return { start, end: end + 1, closing: classified.closing, kind: "known" };
+        }
+        cursor = end + 1;
+    }
+    return null;
+}
+function parseExternalAnswerText(value) {
+    const sections = [];
+    let cursor = 0;
+    let contentStart = 0;
+    let inside = false;
+    let found = false;
+    for (;;) {
+        const tag = nextMarkerTag(value, cursor);
+        if (!tag)
+            break;
+        if (tag.kind === "suspicious")
+            return { kind: "rejected", text: "" };
+        if (tag.closing) {
+            if (!inside)
+                return { kind: "rejected", text: "" };
+            sections.push(value.slice(contentStart, tag.start));
+            inside = false;
+        }
+        else {
+            if (inside)
+                return { kind: "rejected", text: "" };
+            found = true;
+            inside = true;
+            contentStart = tag.end;
+        }
+        cursor = tag.end;
     }
-    return 0;
+    if (inside)
+        sections.push(value.slice(contentStart));
+    if (!found)
+        return { kind: "plain", text: value.trim() };
+    return { kind: "marked", text: sections.join("").trim() };
 }
 /**
- * 跨 chunk 的契约标签流式解码器:push() 逐段返回标签内文本(供 answerStream 实时转发);
+ * 跨 chunk 的契约标签解码器:push() 在合法闭合后返回完整标签块(供 answerStream 转发);
  * 同时记住整轮里**最后一个完整闭合**的标签块(`lastClosedBlock`),供完结时作为契约答案——
  * 只有闭合了的块才算数:半截块(被工具调用拆开的前半段)与叙述里提到的开标签
  * ("我会把结论包在 <marker> 里,先去跑测试")都不会被当成答案(review of a027bf15, C1)。
@@ -40,34 +129,63 @@ export class ExternalAnswerDecoder {
     }
     consume(value, output) {
         this.pending = "";
-        const marker = this.state === "outside" ? EXTERNAL_ANSWER_OPEN : EXTERNAL_ANSWER_CLOSE;
-        const markerAt = value.indexOf(marker);
-        if (markerAt >= 0) {
-            if (this.state === "inside") {
-                const head = value.slice(0, markerAt);
-                if (head)
-                    output.push(head);
-                const completed = `${this.block}${head}`.trim();
-                if (completed)
-                    this.closed = completed;
-                this.block = "";
-                this.state = "outside";
+        const appendInside = (text) => {
+            if (!text)
+                return;
+            this.block += text;
+        };
+        for (const character of value) {
+            if (this.pending) {
+                this.pending += character;
+                if (character === ">") {
+                    const body = this.pending.slice(1, -1);
+                    const tag = classifyMarkerTag(body);
+                    if (tag.kind === "known" && body.length <= MAX_MARKER_TAG_LENGTH) {
+                        if (tag.closing && this.state === "inside") {
+                            const completed = this.block.trim();
+                            if (completed) {
+                                this.closed = completed;
+                                output.push(completed);
+                            }
+                            this.block = "";
+                            this.state = "outside";
+                        }
+                        else if (!tag.closing && this.state === "outside") {
+                            this.block = "";
+                            this.state = "inside";
+                        }
+                        else {
+                            this.block = "";
+                            this.state = tag.closing ? "outside" : "inside";
+                        }
+                    }
+                    else if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.block = "";
+                        this.state = "outside";
+                    }
+                    else if (this.state === "inside") {
+                        appendInside(this.pending);
+                    }
+                    this.pending = "";
+                }
+                else if (this.pending.length > MAX_MARKER_TAG_LENGTH + 2) {
+                    const tag = classifyMarkerTag(this.pending.slice(1));
+                    if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.block = "";
+                        this.state = "outside";
+                    }
+                    else if (this.state === "inside") {
+                        appendInside(this.pending);
+                    }
+                    this.pending = "";
+                }
             }
-            else {
-                this.block = "";
-                this.state = "inside";
+            else if (character === "<") {
+                this.pending = character;
+            }
+            else if (this.state === "inside") {
+                appendInside(character);
             }
-            const remaining = value.slice(markerAt + marker.length);
-            if (remaining)
-                this.consume(remaining, output);
-            return;
-        }
-        const retained = retainedMarkerPrefix(value, marker);
-        const safe = retained > 0 ? value.slice(0, -retained) : value;
-        this.pending = retained > 0 ? value.slice(-retained) : "";
-        if (this.state === "inside" && safe) {
-            output.push(safe);
-            this.block += safe;
         }
     }
 }
@@ -104,20 +222,7 @@ export function decodeExternalOutputEvent(runtime, event, decoder) {
         : [];
 }
 export function stripExternalAnswerMarkers(value) {
-    const sections = [];
-    let cursor = 0;
-    while (cursor < value.length) {
-        const openAt = value.indexOf(EXTERNAL_ANSWER_OPEN, cursor);
-        if (openAt < 0)
-            break;
-        const contentAt = openAt + EXTERNAL_ANSWER_OPEN.length;
-        const closeAt = value.indexOf(EXTERNAL_ANSWER_CLOSE, contentAt);
-        if (closeAt < 0)
-            return value.slice(contentAt).trim();
-        sections.push(value.slice(contentAt, closeAt));
-        cursor = closeAt + EXTERNAL_ANSWER_CLOSE.length;
-    }
-    return (sections.length > 0 ? sections.join("") : value).trim();
+    return parseExternalAnswerText(value).text;
 }
 /**
  * 提取 marker 内容:有 marker 返回拼接内容(trim,空→null),无 marker 返回 null。
@@ -125,25 +230,6 @@ export function stripExternalAnswerMarkers(value) {
  * 本函数用于判定"agent 是否给出了频道直接回复"——必须能区分有无 marker。
  */
 export function extractExternalAnswer(value) {
-    const parts = [];
-    let found = false;
-    let rest = value;
-    for (;;) {
-        const open = rest.indexOf(EXTERNAL_ANSWER_OPEN);
-        if (open < 0)
-            break;
-        found = true;
-        const afterOpen = rest.slice(open + EXTERNAL_ANSWER_OPEN.length);
-        const close = afterOpen.indexOf(EXTERNAL_ANSWER_CLOSE);
-        if (close < 0) {
-            parts.push(afterOpen);
-            break;
-        }
-        parts.push(afterOpen.slice(0, close));
-        rest = afterOpen.slice(close + EXTERNAL_ANSWER_CLOSE.length);
-    }
-    if (!found)
-        return null;
-    const answer = parts.join("").trim();
-    return answer.length > 0 ? answer : null;
+    const parsed = parseExternalAnswerText(value);
+    return parsed.kind === "marked" && parsed.text ? parsed.text : null;
 }

package/dist/local-executor.js

@@ -254,7 +254,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     let executionWorkspace = workspace;
     let localMemoryTelemetry = null;
     const inheritedEnv = { ...process.env };
-    const cloudReportPreparation = await prepareCloudReportExecution({ env: inheritedEnv, root: workspace.dir, executionId: input.executionId, agentHandle: input.handle });
+    const reportRoots = {
+        root: workspace.dir,
+        ...(input.launch.qaReportRoot === undefined ? {} : { qaReportRoot: input.launch.qaReportRoot }),
+    };
+    const cloudReportPreparation = await prepareCloudReportExecution({ env: inheritedEnv, ...reportRoots, executionId: input.executionId, agentHandle: input.handle });
     const { facts: cloudReportUpload, snapshot: reportSnapshot } = cloudReportPreparation;
     for (const key of Object.keys(inheritedEnv)) {
         if (key.startsWith("CREW_AGENT_MEMORY_") || ["CREW_CLOUD_PROVIDER", "CREW_OSS_UPLOAD_SCRIPT", "CREW_OSS_REPORT_UPLOAD"].includes(key))
@@ -1018,7 +1022,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         const cloudReportResult = exitCode === 0
             ? await deliverCloudReports({
-                facts: cloudReportUpload, root: workspace.dir, before: reportSnapshot, finalText,
+                facts: cloudReportUpload, ...reportRoots, before: reportSnapshot, finalText,
                 externalAnswer: externalOutput.lastClosedBlock
                     ?? (finalText === null ? null : extractExternalAnswer(finalText)),
                 captureFinal: input.captureFinal, executionId: input.executionId, agentHandle: input.handle,

package/dist/main.js

@@ -24,7 +24,7 @@ import { formatDaemonStartupError } from "./daemon-startup-error.js";
 import { assertManagedServiceStartup } from "./managed-service-startup.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
-import { loadStorageRuntime } from "./storage-runtime.js";
+import { createStorageRuntimeOwnershipBinding, loadStorageRuntime } from "./storage-runtime.js";
 import { readStorageMigrationReceipt } from "./storage-migration-controller.js";
 import { storageMigrationStatusReplay } from "./storage-status-replay.js";
 import { runStorageWorkerCommand } from "./storage-worker-command.js";
@@ -160,6 +160,9 @@ async function main() {
                 ...(process.getuid === undefined ? {} : { uid: process.getuid() }),
                 environment: process.env,
             });
+        const targetStorageBinding = storageRuntime === null
+            ? null
+            : createStorageRuntimeOwnershipBinding(storageRuntime);
         const targetConfirmation = storageRuntime?.identity.storageMigrationId === undefined
             ? null
             : createStorageTargetConfirmationHandler({
@@ -172,7 +175,8 @@ async function main() {
             ? {
                 ready: false,
                 statusOutboxPath: join(storageRuntime.local.stateRoot, "storage-status-outbox.json"),
-                identity: storageRuntime.identity,
+                identity: targetStorageBinding.identity,
+                bindServerIdentity: targetStorageBinding.bind,
                 ...(targetConfirmation === null ? {} : { confirm: targetConfirmation.handle }),
                 ...(storageRuntime.identity.storageMigrationId === undefined ? {} : {
                     replayStatus: async (send) => {

package/dist/serve.js

@@ -54,7 +54,7 @@ import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
-import { attachStorageMigrationRuntime, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
+import { attachStorageMigrationRuntime, bindStorageMigrationServerIdentity, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
 const ACTIVITY_MAP = {
@@ -316,6 +316,7 @@ export function serve(config, opts = {}) {
         let connectionEpochToken;
         ws.on("open", () => {
             connectionEpochToken = projectSkillsController.beginConnectionEpoch();
+            storageMigrationRuntime.beginIdentityBinding();
             const openedSocket = ws;
             backoff = 1000;
             connectedAt = Date.now();
@@ -811,16 +812,21 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
-                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
-                    try {
-                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId, machineId: r.machineId });
-                        machineHelloPublisher.republish();
-                    }
-                    catch (error) {
-                        dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", {
-                            level: "ERROR", error_message: error.message,
-                        });
-                    }
+                if (opts.storageMigration !== undefined && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
+                    const bindingSocket = ws;
+                    bindStorageMigrationServerIdentity(opts.storageMigration, { workspaceId: r.workspaceId, machineId: r.machineId }, {
+                        onBound: () => {
+                            if (bindingSocket !== ws || bindingSocket?.readyState !== WebSocket.OPEN)
+                                return;
+                            storageMigrationRuntime.completeIdentityBinding();
+                            machineHelloPublisher.republish();
+                        },
+                        onError: (error) => {
+                            dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", { level: "ERROR", error_message: error.message });
+                            if (bindingSocket === ws && bindingSocket?.readyState === WebSocket.OPEN)
+                                bindingSocket.close(1011, "storage identity binding failed");
+                        },
+                    });
                 }
                 // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。
                 serverCapabilities = new Set(Array.isArray(r.serverCapabilities)

package/dist/storage-identity.js

@@ -4,6 +4,9 @@ import { createStorageOwnershipClaim } from "./storage-ownership.js";
 function fingerprint(namespace, value) {
     return `sha256:${createHash("sha256").update(`${namespace}\0${value}`).digest("hex")}`;
 }
+export function storageWorkspaceRootFingerprint(workspaceRoot) {
+    return fingerprint("workspace-root", workspaceRoot);
+}
 export function storageIdFingerprint(storageId) {
     return fingerprint("storage", storageId);
 }
@@ -15,7 +18,7 @@ export function storageHelloIdentity(input) {
         || installation.runtimeRoot !== layout.runtimeRoot) {
         throw new Error("installation storage identity does not match resolved layout");
     }
-    const workspaceRootFingerprint = fingerprint("workspace-root", layout.workspaceRoot);
+    const workspaceRootFingerprint = storageWorkspaceRootFingerprint(layout.workspaceRoot);
     let ownership;
     if (input.ownership !== undefined) {
         const { claimFingerprint: reportedFingerprint, ...claimIdentity } = input.ownership;

package/dist/storage-ownership.js

@@ -1,8 +1,11 @@
-import { createHash } from "node:crypto";
-import { lstat, readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, open, readFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { z } from "zod";
+import { atomicRenameNoReplace } from "./atomic-no-replace-rename.js";
+import { durableDirectorySync } from "./atomic-private-write.js";
 const FingerprintSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u);
+const UuidSchema = z.string().uuid();
 const StorageOwnershipClaimSchema = z.object({
     version: z.literal(1),
     machineId: z.string().uuid(),
@@ -38,8 +41,10 @@ export function createStorageOwnershipClaim(input) {
 export function storageOwnershipClaimPath(nowworkHome) {
     return join(nowworkHome, "storage-layout.json");
 }
-export async function readStorageOwnershipClaim(nowworkHome) {
-    const path = storageOwnershipClaimPath(nowworkHome);
+export function workspaceStorageOwnershipClaimPath(nowworkHome, workspaceId) {
+    return join(nowworkHome, ".storage-ownership", `${UuidSchema.parse(workspaceId).toLowerCase()}.json`);
+}
+async function readClaim(path) {
     const metadata = await lstat(path);
     if (!metadata.isFile())
         throw new Error("storage ownership claim must be a file");
@@ -53,3 +58,86 @@ export async function readStorageOwnershipClaim(nowworkHome) {
     }
     return expected;
 }
+function missingClaim(message) {
+    return Object.assign(new Error(message), { code: "ENOENT" });
+}
+export async function readStorageOwnershipClaim(nowworkHome, workspaceId) {
+    if (workspaceId !== undefined) {
+        const normalizedWorkspaceId = UuidSchema.parse(workspaceId).toLowerCase();
+        try {
+            return await readClaim(workspaceStorageOwnershipClaimPath(nowworkHome, normalizedWorkspaceId));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const legacy = await readClaim(storageOwnershipClaimPath(nowworkHome));
+        if (legacy.workspaceId !== normalizedWorkspaceId) {
+            throw missingClaim(`storage ownership claim is not provisioned for workspace '${normalizedWorkspaceId}'`);
+        }
+        return legacy;
+    }
+    return readClaim(storageOwnershipClaimPath(nowworkHome));
+}
+export async function resolveWorkspaceStorageOwnershipClaim(input) {
+    const machineId = UuidSchema.parse(input.machineId).toLowerCase();
+    const workspaceId = UuidSchema.parse(input.workspaceId).toLowerCase();
+    try {
+        const existing = await readStorageOwnershipClaim(input.nowworkHome, workspaceId);
+        const expected = createStorageOwnershipClaim({
+            machineId,
+            workspaceId,
+            environment: input.environment,
+            volumeFingerprint: existing.volumeFingerprint,
+            workspaceRootFingerprint: input.workspaceRootFingerprint,
+            ownerEpoch: existing.ownerEpoch,
+        });
+        if (existing.claimFingerprint !== expected.claimFingerprint) {
+            throw new Error("storage ownership claim conflicts with the authenticated workspace identity");
+        }
+        return existing;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const anchor = await readClaim(storageOwnershipClaimPath(input.nowworkHome));
+    if (anchor.environment !== input.environment.toLowerCase()) {
+        throw new Error("storage ownership volume anchor environment does not match");
+    }
+    const claim = createStorageOwnershipClaim({
+        machineId,
+        workspaceId,
+        environment: input.environment,
+        volumeFingerprint: anchor.volumeFingerprint,
+        workspaceRootFingerprint: input.workspaceRootFingerprint,
+        ownerEpoch: 1,
+    });
+    const path = workspaceStorageOwnershipClaimPath(input.nowworkHome, workspaceId);
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    let handle = null;
+    try {
+        handle = await open(temporary, "wx", 0o600);
+        await handle.writeFile(`${JSON.stringify({ version: 1, ...claim })}\n`, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        const published = await atomicRenameNoReplace(temporary, path);
+        if (published === "published") {
+            await durableDirectorySync(directory);
+            return claim;
+        }
+        const raced = await readClaim(path);
+        if (raced.claimFingerprint !== claim.claimFingerprint) {
+            throw new Error("storage ownership claim was concurrently provisioned for another identity");
+        }
+        return raced;
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+}

package/dist/storage-runtime-controller.js

@@ -5,12 +5,13 @@ import { buildServiceSpec } from "./computer-service.js";
 import { buildManagedServiceRecord } from "./managed-service-lifecycle.js";
 import { createStorageControlController } from "./storage-control.js";
 import { runStorageDoctor } from "./storage-doctor.js";
-import { storageHelloIdentity } from "./storage-identity.js";
+import { storageHelloIdentity, storageWorkspaceRootFingerprint, } from "./storage-identity.js";
 import { storageLayout, validateStorageEnvironment } from "./storage-layout.js";
 import { StorageMigrationFailure } from "./storage-migration-controller.js";
 import { launchStorageMigrationWorker, writeStorageWorkerHandoff } from "./storage-worker-handoff.js";
 import { writeStorageWorkerOperation } from "./storage-worker-operation.js";
 import { latestSourceStorageMigrationReceipt, monitorStorageMigrationStatus, storageMigrationStatusReplay, } from "./storage-status-replay.js";
+import { resolveWorkspaceStorageOwnershipClaim, } from "./storage-ownership.js";
 const UUID = z.string().uuid();
 function fingerprint(value) {
     return `sha256:${createHash("sha256").update(value).digest("hex")}`;
@@ -22,13 +23,13 @@ function deterministicUuid(value) {
     const hex = chars.join("");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
-function storageId(input, workspaceId) {
-    if (input.ownership.workspaceId !== workspaceId || input.ownership.environment !== input.environment) {
+function storageId(input, workspaceId, ownership) {
+    if (ownership.workspaceId !== workspaceId || ownership.environment !== input.environment) {
         throw new Error("Storage ownership claim does not match the migration identity");
     }
-    return `storage_${input.ownership.claimFingerprint.slice("sha256:".length)}`;
+    return `storage_${ownership.claimFingerprint.slice("sha256:".length)}`;
 }
-function installationBase(input, workspaceId, migrationId, createdAt) {
+function installationBase(input, workspaceId, migrationId, createdAt, ownership) {
     const layout = storageLayout({
         nowworkHome: input.nowworkHome,
         environment: input.environment,
@@ -43,7 +44,7 @@ function installationBase(input, workspaceId, migrationId, createdAt) {
         serverUrl: input.serverUrl,
         environment: input.environment,
         workspaceId,
-        storageId: storageId(input, workspaceId),
+        storageId: storageId(input, workspaceId, ownership),
         nowworkHome: input.nowworkHome,
         runtimeRoot: layout.runtimeRoot,
         credentialRef: `profile:${input.profile}`,
@@ -99,6 +100,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
         writeHandoff: writeStorageWorkerHandoff,
         launchWorker: launchStorageMigrationWorker,
         monitorWorker: monitorStorageMigrationStatus,
+        resolveOwnership: resolveWorkspaceStorageOwnershipClaim,
         now: () => new Date(),
         ...injected,
     };
@@ -108,6 +110,8 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
     let gate = null;
     let sendStatus = null;
     let control = null;
+    let ownership = input.ownership;
+    let identityBindTail = Promise.resolve();
     const pendingControlMessages = [];
     let drainingPendingControlMessages = false;
     const drainPendingControlMessages = () => {
@@ -197,8 +201,8 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                 backupsRoot: input.local.backupsRoot,
                 backupArtifacts: input.backupArtifacts.map((artifact) => ({ ...artifact })),
                 ownership: {
-                    ownerEpoch: input.ownership.ownerEpoch,
-                    ownershipClaimFingerprint: input.ownership.claimFingerprint,
+                    ownerEpoch: ownership.ownerEpoch,
+                    ownershipClaimFingerprint: ownership.claimFingerprint,
                 },
                 acceptedWarnings: [...input.policy.acceptedWarnings],
             },
@@ -214,7 +218,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             installation: {
                 configRoot: input.local.configRoot,
                 target: {
-                    ...installationBase(input, workspaceId, doctor.manifest.migrationId, createdAt),
+                    ...installationBase(input, workspaceId, doctor.manifest.migrationId, createdAt, ownership),
                     storageMigrationId: doctor.manifest.migrationId,
                 },
             },
@@ -236,8 +240,8 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             sourceStorageFingerprint,
             targetStorageFingerprint: identity.storageIdFingerprint,
             ownership: {
-                ownerEpoch: input.ownership.ownerEpoch,
-                ownershipClaimFingerprint: input.ownership.claimFingerprint,
+                ownerEpoch: ownership.ownerEpoch,
+                ownershipClaimFingerprint: ownership.claimFingerprint,
             },
             runDoctor: async (migrationId) => dependencies.runDoctor(await doctorInput(migrationId)),
             runMigration: async (doctor) => {
@@ -294,7 +298,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             sendStatus,
         });
     };
-    const bindServerIdentity = (server) => {
+    const bindServerIdentityOnce = async (server) => {
         const nextWorkspaceId = UUID.parse(server.workspaceId).toLowerCase();
         const nextMachineId = UUID.parse(server.machineId).toLowerCase();
         if (workspaceId !== null && workspaceId !== nextWorkspaceId) {
@@ -303,13 +307,6 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
         if (machineId !== null && machineId !== nextMachineId) {
             throw new Error("Storage migration server machine identity changed");
         }
-        if (input.ownership.workspaceId !== nextWorkspaceId
-            || input.ownership.machineId !== nextMachineId
-            || input.ownership.environment !== input.environment) {
-            throw new Error("Storage ownership claim does not match authenticated server identity");
-        }
-        const createdAt = dependencies.now().toISOString();
-        const installation = installationBase(input, nextWorkspaceId, undefined, createdAt);
         const layout = storageLayout({
             nowworkHome: input.nowworkHome,
             environment: input.environment,
@@ -317,13 +314,36 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             runtimeBase: input.local.runtimeBase,
             platform: input.platform,
         });
-        const nextIdentity = storageHelloIdentity({ installation, layout, ownership: input.ownership });
+        if (ownership.workspaceId !== nextWorkspaceId
+            || ownership.machineId !== nextMachineId
+            || ownership.environment !== input.environment) {
+            ownership = await dependencies.resolveOwnership({
+                nowworkHome: input.nowworkHome,
+                machineId: nextMachineId,
+                workspaceId: nextWorkspaceId,
+                environment: input.environment,
+                workspaceRootFingerprint: storageWorkspaceRootFingerprint(layout.workspaceRoot),
+            });
+        }
+        if (ownership.workspaceId !== nextWorkspaceId
+            || ownership.machineId !== nextMachineId
+            || ownership.environment !== input.environment) {
+            throw new Error("Storage ownership claim does not match authenticated server identity");
+        }
+        const createdAt = dependencies.now().toISOString();
+        const installation = installationBase(input, nextWorkspaceId, undefined, createdAt, ownership);
+        const nextIdentity = storageHelloIdentity({ installation, layout, ownership });
         workspaceId = nextWorkspaceId;
         machineId = nextMachineId;
         identity = nextIdentity;
         ensureControl();
         drainPendingControlMessages();
     };
+    const bindServerIdentity = (server) => {
+        const current = identityBindTail.then(() => bindServerIdentityOnce(server));
+        identityBindTail = current.catch(() => undefined);
+        return current;
+    };
     const attach = (runtime) => {
         gate = runtime.gate;
         sendStatus = runtime.sendStatus;

package/dist/storage-runtime.js

@@ -1,7 +1,7 @@
 import { findInstallationForProfile, readInstallations, resolveLocalStorageRoots, } from "./storage-config.js";
 import { storageHelloIdentity } from "./storage-identity.js";
 import { storageLayout } from "./storage-layout.js";
-import { readStorageOwnershipClaim } from "./storage-ownership.js";
+import { readStorageOwnershipClaim, resolveWorkspaceStorageOwnershipClaim, } from "./storage-ownership.js";
 const canonicalServerUrl = (value) => value.replace(/\/+$/u, "");
 export function resolveStorageRuntime(input) {
     const installation = findInstallationForProfile(input.records, input.profile);
@@ -45,7 +45,7 @@ export async function loadStorageRuntime(input) {
         return null;
     let ownership;
     try {
-        ownership = await readStorageOwnershipClaim(baseline.layout.persistentRoot);
+        ownership = await readStorageOwnershipClaim(baseline.layout.persistentRoot, baseline.layout.workspaceId);
     }
     catch (error) {
         if (error.code !== "ENOENT")
@@ -53,3 +53,39 @@ export async function loadStorageRuntime(input) {
     }
     return ownership === undefined ? baseline : resolveStorageRuntime({ ...input, records, ownership });
 }
+export async function bindStorageRuntimeOwnership(runtime, server) {
+    const workspaceId = server.workspaceId.toLowerCase();
+    const machineId = server.machineId.toLowerCase();
+    if (runtime.installation.workspaceId !== workspaceId) {
+        throw new Error("Storage runtime server workspace identity changed");
+    }
+    const existing = runtime.identity.storageOwnership;
+    if (existing !== undefined) {
+        if (existing.machineId !== machineId)
+            throw new Error("Storage runtime server machine identity changed");
+        return runtime;
+    }
+    const ownership = await resolveWorkspaceStorageOwnershipClaim({
+        nowworkHome: runtime.layout.persistentRoot,
+        machineId,
+        workspaceId,
+        environment: runtime.installation.environment,
+        workspaceRootFingerprint: runtime.identity.workspaceRootFingerprint,
+    });
+    return Object.freeze({
+        ...runtime,
+        identity: storageHelloIdentity({ installation: runtime.installation, layout: runtime.layout, ownership }),
+    });
+}
+export function createStorageRuntimeOwnershipBinding(initial) {
+    let runtime = initial;
+    let bindTail = Promise.resolve();
+    const bind = (server) => {
+        const current = bindTail.then(async () => {
+            runtime = await bindStorageRuntimeOwnership(runtime, server);
+        });
+        bindTail = current.catch(() => undefined);
+        return current;
+    };
+    return Object.freeze({ identity: () => runtime.identity, bind });
+}

package/dist/storage-serve-adapter.js

@@ -9,6 +9,15 @@ export function storageMigrationCapabilities(configured, options) {
             ...(options.ready ? [STORAGE_MIGRATION_CAPABILITY] : []),
         ])]);
 }
+export function bindStorageMigrationServerIdentity(options, identity, callbacks) {
+    const bind = options?.bindServerIdentity;
+    if (bind === undefined) {
+        if (options?.ready === true)
+            callbacks.onBound();
+        return;
+    }
+    void Promise.resolve().then(() => bind(identity)).then(callbacks.onBound).catch(callbacks.onError);
+}
 export function createServeStorageStatusDelivery(options, dependencies) {
     return createStorageStatusDelivery({
         ...(options?.statusOutboxPath === undefined ? {} : { outboxPath: options.statusOutboxPath }),
@@ -17,28 +26,36 @@ export function createServeStorageStatusDelivery(options, dependencies) {
     });
 }
 export function attachStorageMigrationRuntime(options, dependencies) {
-    let admissionClosed = false;
+    let migrationAdmissionClosed = false;
+    let identityAdmissionClosed = options?.bindServerIdentity !== undefined;
     if (options?.ready === true) {
         options.attach?.({
             gate: {
                 isBusy: dependencies.isBusy,
                 closeAndFlush: async () => {
-                    admissionClosed = true;
+                    migrationAdmissionClosed = true;
                     await dependencies.waitForExecutionFrames();
                     if (dependencies.isBusy()) {
-                        admissionClosed = false;
+                        migrationAdmissionClosed = false;
                         throw Object.assign(new Error("active execution entered before storage migration quiesce"), {
                             code: "runtime_busy",
                         });
                     }
                     await dependencies.flushLocalState();
                 },
-                reopen: () => { admissionClosed = false; },
+                reopen: () => { migrationAdmissionClosed = false; },
             },
             sendStatus: dependencies.sendStatus,
         });
     }
-    return Object.freeze({ isAdmissionClosed: () => admissionClosed });
+    return Object.freeze({
+        isAdmissionClosed: () => migrationAdmissionClosed || identityAdmissionClosed,
+        beginIdentityBinding: () => {
+            if (options?.bindServerIdentity !== undefined)
+                identityAdmissionClosed = true;
+        },
+        completeIdentityBinding: () => { identityAdmissionClosed = false; },
+    });
 }
 export function replayStorageMigrationStatus(options, socket, isCurrent, onError, deliver) {
     return options?.replayStatus?.((frame) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.87-beta.3",
+  "version": "0.6.87-beta.4",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -16,14 +16,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "codex-home:migrate": "tsx src/runtimes/codex-home-migration-cli.ts",
-    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@nowcrew/cli": "0.4.13",
@@ -44,5 +36,12 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "codex-home:migrate": "tsx src/runtimes/codex-home-migration-cli.ts",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
-}
+}