@nowcrew/daemon 0.6.87-beta.3 → 0.6.87-beta.5

package/dist/local-memory/read-cli.js

@@ -0,0 +1,232 @@
+import { constants } from "node:fs";
+import { open, realpath } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs, TextDecoder } from "node:util";
+import { z } from "zod";
+const OUTPUT_BYTES = 12 * 1024;
+const FILE_BYTES = 32 * 1024 * 1024;
+const FileSchema = z.string().min(1).refine((file) => {
+    if (isAbsolute(file) || /[\\\u0000-\u001f\u007f]/u.test(file))
+        return false;
+    if (Buffer.byteLength(file, "utf8") > 1024)
+        return false;
+    const parts = file.split("/");
+    if (parts.some((part) => part === "" || part === "." || part === ".."))
+        return false;
+    return file === "MEMORY.md" || (parts[0] === "notes" && parts.length > 1 && file.endsWith(".md"));
+}, "memory_path_invalid");
+const Common = {
+    file: FileSchema.default("MEMORY.md"),
+    ifHash: z.string().regex(/^[a-f0-9]{64}$/u).optional(),
+};
+const CommandSchema = z.discriminatedUnion("command", [
+    z.object({
+        command: z.literal("search"), ...Common,
+        query: z.string().trim().min(1).max(256),
+        limit: z.coerce.number().int().min(1).max(40).default(10),
+        afterLine: z.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).default(0),
+    }).strict(),
+    z.object({
+        command: z.literal("read"), ...Common,
+        offset: z.coerce.number().int().min(0).max(Number.MAX_SAFE_INTEGER).default(0),
+        limit: z.coerce.number().int().min(1).max(4000).default(2000),
+    }).strict(),
+]);
+const USAGE = `只读记忆工具，默认输出 JSON，不修改任何记忆文件。
+crew-memory search --query <关键词> [--file MEMORY.md|notes/文件.md] [--limit 10] [--after-line 0]
+crew-memory read [--file MEMORY.md|notes/文件.md] [--offset 0] [--limit 2000]
+搜索关键词按空白分隔，同一行须全部命中；返回完整文件中的行号和字符偏移。
+读取的 offset/limit 按 Unicode 字符计数；用 nextOffset 继续，eof=true 表示结束。
+后续页可传 --if-hash <前一页的 sha256>，文件变化时停止，避免混读不同版本。
+搜索结果是原始资料定位，不代表候选已生效；按当前有效索引读取明细，不扫描 pending。`;
+function inside(root, path) {
+    const value = relative(root, path);
+    return value !== ".." && !value.startsWith(`..${sep}`) && !isAbsolute(value);
+}
+async function readSource(home, file) {
+    if (!home)
+        throw new Error("memory_home_missing");
+    const root = await realpath(home);
+    const path = await realpath(resolve(root, file));
+    if (!inside(root, path) || !FileSchema.safeParse(relative(root, path).split(sep).join("/")).success) {
+        throw new Error("memory_path_invalid");
+    }
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile())
+            throw new Error("memory_file_not_regular");
+        if (stat.size > FILE_BYTES)
+            throw new Error("memory_file_too_large");
+        // 允许读完整来源，但绝不能在文件并发增长时无界分配内存。
+        const chunks = [];
+        const chunk = Buffer.allocUnsafe(64 * 1024);
+        let bytes = 0;
+        for (;;) {
+            const { bytesRead } = await handle.read(chunk, 0, Math.min(chunk.length, FILE_BYTES + 1 - bytes), null);
+            if (bytesRead === 0)
+                break;
+            bytes += bytesRead;
+            if (bytes > FILE_BYTES)
+                throw new Error("memory_file_too_large");
+            chunks.push(Buffer.from(chunk.subarray(0, bytesRead)));
+        }
+        const buffer = Buffer.concat(chunks);
+        const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(buffer);
+        return { text, sha256: createHash("sha256").update(buffer).digest("hex") };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function characterCount(text) {
+    let count = 0;
+    for (const _character of text)
+        count += 1;
+    return count;
+}
+function excerpt(text, limit) {
+    let value = "";
+    let count = 0;
+    for (const character of text) {
+        if (count++ >= limit)
+            return `${value}...`;
+        value += character;
+    }
+    return value;
+}
+function originalLowercaseIndex(text, index) {
+    let originalIndex = 0;
+    let lowerIndex = 0;
+    for (const character of text) {
+        // 逐字符只累计小写长度；匹配仍用整行小写，保留长度不变的词尾 sigma 上下文规则。
+        lowerIndex += character.toLowerCase().length;
+        if (index < lowerIndex)
+            return originalIndex;
+        originalIndex += character.length;
+    }
+    return text.length;
+}
+function searchSource(text, sha256, command) {
+    const terms = command.query.toLowerCase().split(/\s+/u);
+    const matches = [];
+    let line = 0;
+    let offset = 0;
+    let heading = "";
+    let matchCount = 0;
+    let hasMore = false;
+    let remaining = OUTPUT_BYTES - Buffer.byteLength(JSON.stringify({ file: command.file, sha256 })) - 512;
+    for (const match of text.matchAll(/[^\n]*(?:\n|$)/gu)) {
+        if (match[0] === "")
+            break;
+        line += 1;
+        const raw = match[0];
+        const content = raw.replace(/\r?\n$/u, "");
+        const title = /^#{1,6}\s+(.+?)\s*$/u.exec(content)?.[1];
+        if (title !== undefined)
+            heading = excerpt(title, 96);
+        const lower = content.toLowerCase();
+        if (terms.every((term) => lower.includes(term))) {
+            matchCount += 1;
+            if (line > command.afterLine) {
+                let start = Math.max(0, originalLowercaseIndex(content, lower.indexOf(terms[0])) - 60);
+                if (start > 0 && /[\uDC00-\uDFFF]/u.test(content[start]))
+                    start -= 1;
+                const item = { line, offset, heading, text: `${start > 0 ? "..." : ""}${excerpt(content.slice(start), 240)}` };
+                const bytes = Buffer.byteLength(JSON.stringify(item), "utf8") + 1;
+                if (hasMore || matches.length >= command.limit || bytes > remaining) {
+                    hasMore = true;
+                }
+                else {
+                    matches.push(item);
+                    remaining -= bytes;
+                }
+            }
+        }
+        offset += characterCount(raw);
+    }
+    return {
+        file: command.file, sha256, matches, matchCount, hasMore,
+        nextAfterLine: hasMore ? matches.at(-1)?.line ?? null : null,
+    };
+}
+function readPage(text, sha256, command) {
+    const metadata = { file: command.file, sha256, offset: command.offset, nextOffset: Number.MAX_SAFE_INTEGER, eof: false, content: "" };
+    let remaining = OUTPUT_BYTES - Buffer.byteLength(JSON.stringify(metadata), "utf8");
+    let position = 0;
+    let offset = 0;
+    while (position < text.length && offset < command.offset) {
+        position += text.codePointAt(position) > 0xffff ? 2 : 1;
+        offset += 1;
+    }
+    let content = "";
+    let count = 0;
+    while (position < text.length && count < command.limit) {
+        const character = String.fromCodePoint(text.codePointAt(position));
+        const bytes = Buffer.byteLength(JSON.stringify(character), "utf8") - 2;
+        if (bytes > remaining)
+            break;
+        remaining -= bytes;
+        content += character;
+        position += character.length;
+        offset += 1;
+        count += 1;
+    }
+    const eof = position === text.length;
+    return { ...metadata, content, eof, nextOffset: eof ? null : offset };
+}
+export async function runMemoryReadCommand(argv, io) {
+    let command;
+    try {
+        const { values, positionals } = parseArgs({
+            args: [...argv], allowPositionals: true,
+            options: {
+                query: { type: "string", short: "q" }, file: { type: "string" },
+                limit: { type: "string" }, offset: { type: "string" },
+                "after-line": { type: "string" }, "if-hash": { type: "string" },
+                json: { type: "boolean" }, help: { type: "boolean", short: "h" },
+            },
+        });
+        if (values.help) {
+            io.out(USAGE);
+            return 0;
+        }
+        if (positionals.length !== 1)
+            throw new Error("memory_command_invalid");
+        const { help: _help, json: _json, "after-line": afterLine, "if-hash": ifHash, ...options } = values;
+        command = CommandSchema.parse({
+            command: positionals[0], ...options,
+            ...(afterLine === undefined ? {} : { afterLine }),
+            ...(ifHash === undefined ? {} : { ifHash }),
+        });
+    }
+    catch {
+        io.err(`memory_arguments_invalid: 参数不合法。\n${USAGE}`);
+        return 2;
+    }
+    try {
+        const source = await readSource(io.env.CREW_HOME, command.file);
+        if (command.ifHash !== undefined && command.ifHash !== source.sha256)
+            throw new Error("memory_file_changed");
+        const result = command.command === "search"
+            ? searchSource(source.text, source.sha256, command)
+            : readPage(source.text, source.sha256, command);
+        io.out(JSON.stringify(result));
+        return 0;
+    }
+    catch (error) {
+        const code = error.code;
+        const known = error instanceof Error && /^memory_[a-z_]+$/u.test(error.message) ? error.message : code ?? "memory_read_failed";
+        io.err(JSON.stringify({ error: known, message: "记忆读取未完成；检查路径、文件版本或大小，不要将此错误当作没有记忆。" }));
+        return 1;
+    }
+}
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+    void runMemoryReadCommand(process.argv.slice(2), {
+        env: process.env,
+        out: (text) => process.stdout.write(`${text}\n`),
+        err: (text) => process.stderr.write(`${text}\n`),
+    }).then((code) => { process.exitCode = code; });
+}

package/dist/local-memory-diagnostics.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
 import { isAbsolute, join, normalize, relative, resolve } from "node:path";
+import { parseArgs } from "node:util";
 import { capMemoryForInject, MEMORY_INJECT_CAP } from "./prompt.js";
 const INJECTION_MARKERS = [
     "## Injected MEMORY.md (bounded local context)\n",
@@ -172,10 +173,58 @@ function commandOperation(command) {
         ? "read"
         : null;
 }
+function crewMemoryReadAccess(command, paths) {
+    if (!/^\s*crew-memory(?:\s|$)/u.test(command))
+        return null;
+    const args = [];
+    let remaining = command.trim();
+    // Only complete literal arguments are supported; shell expansion and concatenated quoting are not inferred.
+    while (remaining !== "") {
+        const match = /^(?:"([^"\\$`]*)"|'([^']*)'|([^\s"'\\$`<>;|&()\[\]{}*?!#]+))(?=\s|$)\s*/u.exec(remaining);
+        if (match === null)
+            return null;
+        args.push(match[1] ?? match[2] ?? match[3]);
+        remaining = remaining.slice(match[0].length);
+    }
+    try {
+        const { values, positionals } = parseArgs({
+            args: args.slice(1),
+            allowPositionals: true,
+            options: {
+                file: { type: "string" }, query: { type: "string", short: "q" },
+                limit: { type: "string" }, offset: { type: "string" },
+                "after-line": { type: "string" }, "if-hash": { type: "string" },
+                json: { type: "boolean" }, help: { type: "boolean", short: "h" },
+            },
+        });
+        if (values.help || positionals.length !== 1)
+            return null;
+        const operation = positionals[0];
+        if (operation === "search") {
+            if (!values.query?.trim() || values.offset !== undefined)
+                return null;
+        }
+        else if (operation !== "read" || values.query !== undefined || values["after-line"] !== undefined) {
+            return null;
+        }
+        const file = values.file ?? "MEMORY.md";
+        if (file !== "MEMORY.md" && !/^notes\/[^/\\\u0000-\u001f\u007f]+\.md$/u.test(file))
+            return null;
+        const classified = classifyExplicitPath(resolve(paths.homeDir, file), paths);
+        return classified === null ? null : { ...classified, operation: "read" };
+    }
+    catch {
+        return null;
+    }
+}
 function commandAccesses(command, paths) {
     if (/[;|&\n]/.test(command))
         return [];
     const accesses = new Map();
+    const memoryRead = crewMemoryReadAccess(command, paths);
+    if (memoryRead !== null) {
+        accesses.set(`${memoryRead.target}:${memoryRead.relative_path ?? ""}:read`, memoryRead);
+    }
     const expanded = command
         .replaceAll("${CREW_HOME}", paths.homeDir)
         .replaceAll("$CREW_HOME", paths.homeDir)
@@ -243,26 +292,41 @@ export function createLocalMemoryAccessObserver(options) {
                 for (const block of blocks) {
                     if (block.type !== "tool_use" || typeof block.id !== "string" || typeof block.name !== "string")
                         continue;
+                    if (block.name === "Bash") {
+                        const input = block.input && typeof block.input === "object" && !Array.isArray(block.input)
+                            ? block.input
+                            : null;
+                        const accesses = typeof input?.command === "string" ? commandAccesses(input.command, paths) : [];
+                        if (accesses.length > 0)
+                            pending.set(block.id, { accesses, evidence: "shell_command" });
+                        continue;
+                    }
                     const operation = toolOperation(block.name);
                     const path = toolPath(block.input);
                     const classified = operation === null || path === null ? null : classifyExplicitPath(path, paths);
-                    if (operation !== null && classified !== null)
-                        pending.set(block.id, { operation, ...classified });
+                    if (operation !== null && classified !== null) {
+                        pending.set(block.id, {
+                            accesses: [{ operation, ...classified }],
+                            evidence: "structured_tool",
+                        });
+                    }
                 }
             }
             if (record.type === "user") {
                 for (const block of blocks) {
                     if (block.type !== "tool_result" || typeof block.tool_use_id !== "string")
                         continue;
-                    const access = pending.get(block.tool_use_id);
+                    const toolAccess = pending.get(block.tool_use_id);
                     pending.delete(block.tool_use_id);
-                    if (access === undefined)
+                    if (toolAccess === undefined)
                         continue;
-                    recordObservation(observations, counts, {
-                        ...access,
-                        outcome: block.is_error === true ? "failed" : "succeeded",
-                        evidence: "structured_tool",
-                    });
+                    for (const access of toolAccess.accesses) {
+                        recordObservation(observations, counts, {
+                            ...access,
+                            outcome: block.is_error === true ? "failed" : "succeeded",
+                            evidence: toolAccess.evidence,
+                        });
+                    }
                 }
             }
             if (record.type === "kimi.acp.tool_call" && typeof record.id === "string") {
@@ -277,15 +341,18 @@ export function createLocalMemoryAccessObserver(options) {
                     ? null
                     : classifyExplicitPath(path, paths);
                 if (fallbackOperation !== null && classified !== null) {
-                    pending.set(record.id, { operation: fallbackOperation, ...classified });
+                    pending.set(record.id, {
+                        accesses: [{ operation: fallbackOperation, ...classified }],
+                        evidence: "structured_tool",
+                    });
                 }
             }
             if (record.type === "kimi.acp.tool_result" && typeof record.id === "string") {
                 if (record.status !== "completed" && record.status !== "failed")
                     return observations;
-                const access = pending.get(record.id);
+                const toolAccess = pending.get(record.id);
                 pending.delete(record.id);
-                if (access !== undefined) {
+                for (const access of toolAccess?.accesses ?? []) {
                     recordObservation(observations, counts, {
                         ...access,
                         outcome: record.status === "failed" ? "failed" : "succeeded",

package/dist/main.js

@@ -24,7 +24,7 @@ import { formatDaemonStartupError } from "./daemon-startup-error.js";
 import { assertManagedServiceStartup } from "./managed-service-startup.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
-import { loadStorageRuntime } from "./storage-runtime.js";
+import { createStorageRuntimeOwnershipBinding, loadStorageRuntime } from "./storage-runtime.js";
 import { readStorageMigrationReceipt } from "./storage-migration-controller.js";
 import { storageMigrationStatusReplay } from "./storage-status-replay.js";
 import { runStorageWorkerCommand } from "./storage-worker-command.js";
@@ -160,6 +160,9 @@ async function main() {
                 ...(process.getuid === undefined ? {} : { uid: process.getuid() }),
                 environment: process.env,
             });
+        const targetStorageBinding = storageRuntime === null
+            ? null
+            : createStorageRuntimeOwnershipBinding(storageRuntime);
         const targetConfirmation = storageRuntime?.identity.storageMigrationId === undefined
             ? null
             : createStorageTargetConfirmationHandler({
@@ -172,7 +175,8 @@ async function main() {
             ? {
                 ready: false,
                 statusOutboxPath: join(storageRuntime.local.stateRoot, "storage-status-outbox.json"),
-                identity: storageRuntime.identity,
+                identity: targetStorageBinding.identity,
+                bindServerIdentity: targetStorageBinding.bind,
                 ...(targetConfirmation === null ? {} : { confirm: targetConfirmation.handle }),
                 ...(storageRuntime.identity.storageMigrationId === undefined ? {} : {
                     replayStatus: async (send) => {

package/dist/prompt.js

@@ -67,10 +67,23 @@ export function capWorkLogForInject(workLog, cap = WORKLOG_INJECT_CAP) {
     const tail = workLog.slice(-WORKLOG_TAIL);
     return `${head}\n…(work-log 过长已截去中段,全文用 Read 读 $CREW_TASK_LOG)\n${tail}`;
 }
-export function capMemoryForInject(memory, cap = MEMORY_INJECT_CAP) {
-    return memory.length > cap
-        ? `${memory.slice(0, cap)}\n…(MEMORY.md 过长已截断,详情用 Read 读 $CREW_HOME/MEMORY.md;功能明细仅按索引中的 file 读取)`
-        : memory;
+export function capMemoryForInject(memory, cap = MEMORY_INJECT_CAP, maxBytes = Number.POSITIVE_INFINITY) {
+    if (memory.length <= cap && Buffer.byteLength(memory, "utf8") <= maxBytes)
+        return memory;
+    const notice = "[MEMORY.md preview truncated; use crew-memory search/read for more.]\n";
+    const noticeBytes = Buffer.byteLength(notice, "utf8");
+    if (notice.length > cap || noticeBytes > maxBytes)
+        return "";
+    let end = 0;
+    let bytes = noticeBytes;
+    for (const character of memory) {
+        const size = Buffer.byteLength(character, "utf8");
+        if (notice.length + end + character.length > cap || bytes + size > maxBytes)
+            break;
+        end += character.length;
+        bytes += size;
+    }
+    return notice + memory.slice(0, end);
 }
 export function buildSystemPrompt(ctx) {
     const product = ctx.productName ?? "nowwork";
@@ -99,7 +112,7 @@ export function buildSystemPrompt(ctx) {
     // scheduled 换成静默版,不出现任何"先确认/先回复"的措辞。
     const startupSequence = alwaysReport
         ? `## 启动序列(每轮汇报定时任务)
-1. 使用本提示词末尾已注入的 MEMORY.md 索引;命中相关条目时,再按索引中的 file 从 $CREW_HOME 读取明细。
+1. 参考本提示词中的 MEMORY.md 预览;需要历史约束或经验时检索完整索引,再按索引中的 file 从 $CREW_HOME 读取明细。
 2. 执行唤醒提示词里给出的定时指令。
 3. Return exactly one self-contained final report as your runtime final response.
 4. Do not call crew message send; the daemon delivers the final response.
@@ -107,14 +120,14 @@ export function buildSystemPrompt(ctx) {
 6. 只有存在需要后续跟进的具体事项时,才用 \`crew task create\` 创建任务。`
         : scheduled
             ? `## 启动序列(静默定时任务)
-1. 使用本提示词末尾已注入的 MEMORY.md 索引;命中相关条目时,再按索引中的 file 从 $CREW_HOME 读取明细。
+1. 参考本提示词中的 MEMORY.md 预览;需要历史约束或经验时检索完整索引,再按索引中的 file 从 $CREW_HOME 读取明细。
 2. 执行唤醒提示词里给出的定时指令。**默认零输出**:不判断"是否需要先确认/声明接手",本轮没有人在等你回复。
 3. 只有发现异常、需要人处理、或指令明确要求汇报时,才用 \`crew message send --send-draft\` 输出到频道(用法见上面"通信"一节)。
 4. 只有存在需要后续跟进的具体事项时,才用 \`crew task create\` 创建任务。
 5. 无异常时直接结束,不需要任何输出,不必读频道历史(除非指令要求)。`
             : `## 启动序列
 1. 若本轮来信可以直接回答,不要先发确认消息;处理完后只发一条完整回复。只有需要澄清、调用工具、协调他人或较长时间处理时,才先发有信息量的确认/进度消息。
-2. 使用本提示词末尾已注入的 MEMORY.md 索引;命中相关条目时,再按索引中的 file 从 $CREW_HOME 读取明细。
+2. 参考本提示词中的 MEMORY.md 预览;需要历史约束或经验时检索完整索引,再按索引中的 file 从 $CREW_HOME 读取明细。
 3. 若本轮只有"有未读"的 inbox notice、没有正文:notice 表示存在你尚未看到的消息(正文被暂时省略以免刷屏,不是没有内容)。是否读、何时读由你判断,可用 \`crew message check\` / \`crew message read\` 拉取。**绝不能仅凭一条 content-free notice 就断定"没有工作"**;若选择暂不读,要诚实当作 defer。
 4. 收到消息就处理,并用 \`crew message send\` 回复。
 5. **做完你负责的所有事再停。** 多步任务(调研/改码/测试)要全部完成、汇报结果后再停。新消息会在你存活期间自动送达,无需轮询等待。`;
@@ -329,13 +342,15 @@ ${interactiveTaskRules}${freshnessRule}${externalReplyRule}${collaborationEtique
 
 ## Workspace 与分层记忆(CRITICAL — 索引+按需,配合上面的并行规则)
 你的持久记忆在 \`$CREW_HOME\`(跨你所有任务共享),按“常驻索引 + 功能明细 + 当前工作”分层:
-1. **MEMORY.md = 常驻索引 + 角色**:系统每次已把它(截断索引版)注入本提示词末尾。索引条目包含 \`file/type/scope/summary/triggers/priority/updated\`,其中 file 是相对于 \`$CREW_HOME\` 的路径(例如 \`notes/testing.md\`),先用这些字段判断当前问题是否相关;通常不必再读整份 MEMORY.md。
+1. **MEMORY.md = 常驻索引 + 角色**:提示词末尾可能只有它的有界预览,预算不足时也可能省略。预览未命中不等于没有记忆。索引条目包含 \`file/type/scope/summary/triggers/priority/updated\`,其中 file 是相对于 \`$CREW_HOME\` 的路径(例如 \`notes/testing.md\`);需要历史约束、经验或偏好时先检索完整索引,再按需分段读取。
 2. **notes/<topic>.md = 功能明细**:按用户偏好、项目规则、测试、调试、Git、事故复盘等主题拆分。优先读取与当前任务匹配的文件;\`notes/lessons.md\` 只保留未分类经验和历史兼容内容,不是所有新经验的默认目的地。普通任务默认只读不写,但当前用户明确要求时可以按最小范围更新;任务结束后的专门收尾执行仍按收尾指令复核。
    - 对旧版 MEMORY.md,如果条目没有完整结构化字段但明确指向 \`notes/<file>.md\`,把它视为 legacy 索引;仍需结合条目标题/链接和当前请求判断相关性,不要因为缺少 summary/triggers 就假定正文已注入。
 3. **本任务 work-log = \`$CREW_TASK_LOG\`**:每任务一份(别的运行不会碰),记当前阶段/下一步/卡点/关键结论。系统已把它的当前内容注入末尾让你续上;有进展就更新它——这是你**唯一**该在任务中持续写的记忆文件。**work-log 是现状快照,不是流水账**:保持 ≤100 行,更新时重写全文替换过时内容,不要无限追加(过长会被注入截断)。
 
 **按需读取规则(提示词引导,不是 Daemon 自动召回保证)**:
-- 当前请求命中 MEMORY.md 某条目的 \`summary\` 或 \`triggers\`,或用户明确询问历史经验/偏好时,在最终回答或执行动作前用 \`Read $CREW_HOME/<file>\` 读取对应明细;不要再次拼接 \`notes/\`。
+- 需要历史约束、经验或偏好时,在最终回答或执行动作前先用只读命令 \`crew-memory search --query '关键词' [--after-line N]\` 搜索完整 \`$CREW_HOME/MEMORY.md\`;默认返回 JSON,有后续结果时按返回游标继续,不要把预览中未命中当成全文无结果。
+- 用 \`crew-memory read [--file MEMORY.md|notes/xxx.md] [--offset N] [--limit N]\` 读取命中范围,再按索引中的 file 从 $CREW_HOME 读取明细;默认返回 JSON。以当前有效索引及其指向的正文为依据,不自动读取 pending,也不把未决或已替代片段当成有效记忆。
+- 旧 daemon 没有 \`crew-memory\` 时,回退到 runtime 原生文件搜索和分段 Read:先搜索完整 \`$CREW_HOME/MEMORY.md\`,再用 \`Read $CREW_HOME/<file>\` 读取命中范围;不要再次拼接 \`notes/\`。工具提示截断或返回下一页时继续分页,不要一次读取整份大文件。
 - 未命中时不要为了“保险”读取全部 notes;只读取能直接影响当前任务的文件。MEMORY.md 注入的是索引,不会自动让 note 正文可用。
 
 **沉淀与瘦身由系统触发,不要平时自行扩展范围**:任务被改为 done/closed 时,系统会单独唤醒你收尾——那时按功能分类把可复用经验提炼进合适的 \`notes/<topic>.md\`,更新 MEMORY.md 索引。普通执行已经按用户明确要求写入时,收尾先检查、后修改,只在明确缺漏时做最小必要修正,不得重复追加或只为优化措辞而改写。最终结论必须且只能归类为:无变化、已修正、冲突、失败;无变化或已修正时必须满足对应后置条件并清空 work-log,冲突或失败时保留 work-log,任一记忆写入失败则保留 work-log。不要默认全部写入 \`notes/lessons.md\`。默认不要改 MEMORY.md/notes,但不能覆盖当前用户明确授权的最小范围更新。

package/dist/serve.js

@@ -54,7 +54,7 @@ import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
-import { attachStorageMigrationRuntime, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
+import { attachStorageMigrationRuntime, bindStorageMigrationServerIdentity, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
 const ACTIVITY_MAP = {
@@ -316,6 +316,7 @@ export function serve(config, opts = {}) {
         let connectionEpochToken;
         ws.on("open", () => {
             connectionEpochToken = projectSkillsController.beginConnectionEpoch();
+            storageMigrationRuntime.beginIdentityBinding();
             const openedSocket = ws;
             backoff = 1000;
             connectedAt = Date.now();
@@ -811,16 +812,21 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
-                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
-                    try {
-                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId, machineId: r.machineId });
-                        machineHelloPublisher.republish();
-                    }
-                    catch (error) {
-                        dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", {
-                            level: "ERROR", error_message: error.message,
-                        });
-                    }
+                if (opts.storageMigration !== undefined && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
+                    const bindingSocket = ws;
+                    bindStorageMigrationServerIdentity(opts.storageMigration, { workspaceId: r.workspaceId, machineId: r.machineId }, {
+                        onBound: () => {
+                            if (bindingSocket !== ws || bindingSocket?.readyState !== WebSocket.OPEN)
+                                return;
+                            storageMigrationRuntime.completeIdentityBinding();
+                            machineHelloPublisher.republish();
+                        },
+                        onError: (error) => {
+                            dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", { level: "ERROR", error_message: error.message });
+                            if (bindingSocket === ws && bindingSocket?.readyState === WebSocket.OPEN)
+                                bindingSocket.close(1011, "storage identity binding failed");
+                        },
+                    });
                 }
                 // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。
                 serverCapabilities = new Set(Array.isArray(r.serverCapabilities)

package/dist/storage-identity.js

@@ -4,6 +4,9 @@ import { createStorageOwnershipClaim } from "./storage-ownership.js";
 function fingerprint(namespace, value) {
     return `sha256:${createHash("sha256").update(`${namespace}\0${value}`).digest("hex")}`;
 }
+export function storageWorkspaceRootFingerprint(workspaceRoot) {
+    return fingerprint("workspace-root", workspaceRoot);
+}
 export function storageIdFingerprint(storageId) {
     return fingerprint("storage", storageId);
 }
@@ -15,7 +18,7 @@ export function storageHelloIdentity(input) {
         || installation.runtimeRoot !== layout.runtimeRoot) {
         throw new Error("installation storage identity does not match resolved layout");
     }
-    const workspaceRootFingerprint = fingerprint("workspace-root", layout.workspaceRoot);
+    const workspaceRootFingerprint = storageWorkspaceRootFingerprint(layout.workspaceRoot);
     let ownership;
     if (input.ownership !== undefined) {
         const { claimFingerprint: reportedFingerprint, ...claimIdentity } = input.ownership;