@nowcrew/daemon 0.6.88-beta.1 → 0.6.88-beta.10

package/README.md

@@ -242,26 +242,26 @@ The stable adapters keep prompts out of provider argv wherever the provider prot
 
 | Runtime | Transport | System/wake input | Native resume |
 | --- | --- | --- | --- |
-| Claude | stream-json CLI | daemon-owned system prompt file | CLI session id |
-| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume` |
-| Kimi | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| Hermes | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| OpenCode | `run --format json` | stdin | `--session` |
+| Claude | stream-json CLI | daemon-owned system prompt file + user input | CLI session id; thread-bound: matching native SessionStart proof + SDK initialization |
+| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume`; thread-bound: returned id must match |
+| Kimi | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| Hermes | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| OpenCode | `run --format json` | stdin | unbound: `--session`; thread-bound: cold |
 | DeepSeek Harness | ACP over stdio | `session/prompt` | none (fresh session per execution) |
 
 Kimi ACP currently requires a Kimi account even when the CLI has a working custom provider. Only for
 the explicit `Authentication required` response, the adapter retries once through Kimi's stream-json
-CLI and carries the same native session id; unrelated ACP failures stay failures. The CLI fallback is
+CLI; only unbound executions can carry a saved native session id. Unrelated ACP failures stay failures. The CLI fallback is
 subject to the Windows UTF-16 argv guard, while protocol-v1 itself remains disabled on Windows until
 durable Job Object ownership is available.
 
 Hermes uses only ACP capabilities advertised by the installed CLI. Model and effort choices come from
 a short-lived discovery session; credentials, provider profiles, plugins, and `HERMES_HOME` remain
-machine-local. A missing resumed ACP session is retried once as a fresh session.
+machine-local. For unbound executions, a missing resumed ACP session is retried once as a fresh session.
 
 OpenCode receives the prompt through stdin and runs with both cwd and `PWD` anchored to the Agent
 workspace. Models and variants come from `opencode models --verbose` (with the plain catalog as a
-compatibility fallback). A missing resumed session is retried once without `--session`; malformed,
+compatibility fallback). For unbound executions, a missing resumed session is retried once without `--session`; malformed,
 empty, incomplete, or explicitly failed JSON streams remain failures. NowWork never writes
 `opencode.json` or replaces `OPENCODE_CONFIG_CONTENT`. The daemon advertises OpenCode as executable
 only when `opencode run --help` exposes `--format`, `--dangerously-skip-permissions`, `--dir`,
@@ -291,8 +291,12 @@ uses fresh sessions and committed text; it does not claim resume, images, MCP, r
 or transcript support. Agent environment variables cannot override `DEEPSEEK_*`, `DSH_*`, or
 `NOWCREW_DEEPSEEK_HARNESS_CONFIG`; those values always come from the daemon service environment.
 
-Codex, Kimi, Hermes, and OpenCode sessions use the same bounded per-task persistence and keyed lease as Claude when they
-run through protocol v1. A first-progress watchdog covers a provider that accepts a turn but remains
+Unbound Codex, Kimi, Hermes, and OpenCode sessions retain the same configured warm/budget policy and keyed
+lease as Claude through protocol v1. Thread-bound Claude/Codex sessions keep their native session across
+warm-cache expiry, token estimates, and turn counts; verified restoration receives only accepted-cursor
+deltas. New sessions and runtimes without verified restoration receive complete current-thread history
+before the business turn. See the [thread context contract](../docs/thread-scoped-native-context.md).
+A first-progress watchdog covers a provider that accepts a turn but remains
 semantically silent; after the first semantic event, the execution's configured total timeout remains
 authoritative so a legitimate long-running tool is not killed for quiet output.
 DeepSeek Harness is execution-v1-only and intentionally skips native session persistence.
@@ -354,6 +358,15 @@ Runtime launch, which recovers from a missed notification or daemon restart. Ski
 are visible through the symlink immediately; adding, deleting, renaming, or changing frontmatter requires
 a rescan. Web descriptions remain at the last inventory value until that rescan.
 
+## 目录投影测试的平台范围
+
+`test/directory-projection.test.ts` 在所有平台运行，覆盖路径检查、复制发布、只读权限请求及失败恢复。
+其受控文件系统夹具记录目录 `chmod` 请求，但保留宿主目录的写权限，避免把 macOS 的目录重命名规则当作 Windows 行为。
+生产代码的只读保护不受此夹具影响。
+
+`test/directory-projection.windows.test.ts` 仅在 Windows 上运行，使用真实文件系统验证只读目录发布与文件保护。
+非 Windows 的全量测试会明确跳过该文件，不能据此宣称 Windows 原生行为已验证。
+
 ## Reliability
 
 Protocol-v1 lifecycle is `accepted → started → completed`, followed by a server

package/dist/agent-memory/policy.js

@@ -17,7 +17,9 @@ function truncateUtf8(value, maxBytes) {
     return output;
 }
 export function extractIncomingMessage(wakePrompt) {
-    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew)|$)/su);
+    // Keep legacy wake delimiters while accepting program-delivered-context prompts.
+    // Stop before policy/history blocks; neither is the current user's message.
+    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew|Work directly from this thread's context|直接依据程序交付的本线程上下文|No thread anchor:|没有线程锚点[，,])|$)/su);
     const content = match?.[1]?.trim();
     return content ? content : null;
 }

package/dist/cloud-report-receipt.js

@@ -0,0 +1,83 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+const MAX_REPORT_BYTES = 32 * 1024 * 1024;
+export function reportDeliveryContext(executionId, runDir, facts) {
+    return {
+        version: 1,
+        provider: facts.provider,
+        executionId,
+        receiptFile: join(runDir, `.qa-report-delivery-${createHash("sha256").update(executionId).digest("hex")}.json`),
+        ...(facts.ossUploadScript === undefined ? {} : { script: facts.ossUploadScript }),
+    };
+}
+function inside(root, file) {
+    const part = relative(root, file);
+    return part !== ".." && !part.startsWith("../") && !part.startsWith("..\\") && !isAbsolute(part);
+}
+export async function verifiedReportReceipt(input) {
+    if (!input.receiptFile || !input.answer)
+        return false;
+    try {
+        const stat = await lstat(input.receiptFile);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 64 * 1024)
+            return false;
+        const receipt = JSON.parse(await readFile(input.receiptFile, "utf8"));
+        if (!receipt || typeof receipt !== "object")
+            return false;
+        const r = receipt;
+        if (r.version !== 1 || r.executionId !== input.executionId || r.evidenceComplete !== true
+            || !Array.isArray(r.runIds) || r.runIds.length === 0 || r.runIds.length > 100
+            || r.runIds.some(id => typeof id !== "string" || !id || id.length > 256)
+            || typeof r.file !== "string" || !isAbsolute(r.file) || !r.file.endsWith(".html")
+            || typeof r.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.sha256)
+            || typeof r.url !== "string")
+            return false;
+        const url = new URL(r.url);
+        if (url.protocol !== "https:" || url.hostname !== "ai-claw-in.nowcoder.com"
+            || !url.pathname.endsWith(".html") || url.username || url.password || url.search || url.hash)
+            return false;
+        const answerUrls = input.answer.match(/https:\/\/ai-claw-in\.nowcoder\.com\/[^\s<>"')\]]+/g) ?? [];
+        if (!answerUrls.includes(url.href))
+            return false;
+        const file = await realpath(r.file);
+        const roots = await Promise.all([input.root, input.qaReportRoot ?? join(input.root, "qa-report-server-v2")]
+            .map(root => realpath(resolve(root)).catch(() => null)));
+        if (!roots.some(root => root !== null && inside(root, file)))
+            return false;
+        const fileStat = await lstat(file);
+        if (!fileStat.isFile() || fileStat.size > MAX_REPORT_BYTES)
+            return false;
+        const expectedHash = createHash("sha256").update(await readFile(file)).digest("hex");
+        if (expectedHash !== r.sha256)
+            return false;
+        const response = await fetch(url.href, { redirect: "error", signal: AbortSignal.timeout(15_000) });
+        if (!response.ok || !/^text\/html(?:;|$)/i.test(response.headers.get("content-type") ?? "")
+            || /attachment/i.test(response.headers.get("content-disposition") ?? "") || !response.body) {
+            await response.body?.cancel();
+            return false;
+        }
+        const reader = response.body.getReader();
+        const hash = createHash("sha256");
+        let bytes = 0;
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                bytes += chunk.value.byteLength;
+                if (bytes > MAX_REPORT_BYTES)
+                    return false;
+                hash.update(chunk.value);
+            }
+            return bytes === fileStat.size && hash.digest("hex") === expectedHash;
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+            reader.releaseLock();
+        }
+    }
+    catch {
+        return false;
+    }
+}

package/dist/cloud-report-uploader.js

@@ -4,6 +4,7 @@ import { extname, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { cloudReportUploadFacts } from "./cloud-report-upload.js";
 import { dslog } from "./slog.js";
+import { verifiedReportReceipt } from "./cloud-report-receipt.js";
 const execFileP = promisify(execFile);
 const REPORT_FILENAMES = new Set(["report.md", "result.json"]);
 const MAX_DEPTH = 8;
@@ -166,6 +167,14 @@ export async function deliverCloudReports(input) {
     if (!input.facts.enabled || input.facts.ossUploadScript === undefined || input.before === null) {
         return { finalText: input.finalText, externalAnswer: input.externalAnswer };
     }
+    if (input.captureFinal && await verifiedReportReceipt({
+        ...input, answer: input.externalAnswer ?? input.finalText,
+    })) {
+        dslog("cloud_report_upload.already_delivered", "本次执行的 HTML 交付收据及内容已验证，跳过重复上传", {
+            execution_id: input.executionId, agent_handle: input.agentHandle,
+        });
+        return { finalText: input.finalText, externalAnswer: input.externalAnswer };
+    }
     try {
         const result = await (input.upload ?? uploadCloudReports)({
             script: input.facts.ossUploadScript,

package/dist/execution-protocol.js

@@ -200,7 +200,7 @@ export const ExecutionStartSchema = z.object({
         language: z.enum(["zh", "en"]),
         systemPrompt: z.string(),
         wakePrompt: z.string(),
-        maintenancePurpose: z.literal("self_training").optional(),
+        maintenancePurpose: z.enum(["self_training", "memory_prune"]).optional(),
     }).strict(),
     runtime: z.object({
         name: RuntimeSchema,

package/dist/execution-runner.js

@@ -844,6 +844,7 @@ export async function runExecution(config, input, dependencies) {
             executionId: spec.executionId,
             handle: spec.agent.handle,
             channelId: spec.context.channelId,
+            ...(spec.context.threadId === undefined ? {} : { threadId: spec.context.threadId }),
             keyMode: "opaque",
             taskKey: spec.workspace.taskKey,
             ...(spec.workspace.resumeKey === undefined ? {} : { resumeKey: spec.workspace.resumeKey }),
@@ -885,13 +886,13 @@ export async function runExecution(config, input, dependencies) {
                 } : {}),
             },
             session: {
-                enabled: selfTraining ? false : config.resume,
+                enabled: spec.instructions.maintenancePurpose !== undefined ? false : config.resume,
                 warmMs: config.resumeWarmMs,
                 budgetTokens: config.sessionBudgetTokens,
                 softTokens: config.sessionSoftTokens,
                 maxTurns: config.sessionMaxTurns,
             },
-            ...(selfTraining ? { maintenancePurpose: "self_training" } : {}),
+            ...(spec.instructions.maintenancePurpose === undefined ? {} : { maintenancePurpose: spec.instructions.maintenancePurpose }),
             localMemoryV2Enabled,
         };
         const result = await Promise.race([

package/dist/list-models.js

@@ -1,6 +1,7 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { isWin } from "./platform.js";
+import { augmentedPath } from "./runtime-path.js";
 import { listClaudeModels } from "./runtimes/claude-models.js";
 import { listHermesModels } from "./runtimes/hermes-models.js";
 const execFileRaw = promisify(execFile);
@@ -8,6 +9,7 @@ const MODEL_PROBE_TIMEOUT_MS = 8_000;
 const MODEL_PROBE_MAX_BUFFER_BYTES = 1024 * 1024;
 // win32 上 npm CLI 是 .cmd shim,execFile 需 shell 才能执行;参数全是固定字面量,无注入面。
 const execFileP = (bin, args) => execFileRaw(bin, args, {
+    env: { ...process.env, PATH: augmentedPath() },
     shell: isWin(),
     timeout: MODEL_PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL",

package/dist/local-executor.js

@@ -12,8 +12,11 @@ import { spawnKimi, KIMI_EFFORT_LEVELS } from "./runtimes/kimi.js";
 import { applyDeepSeekHarnessMachineEnv, applyProviderEnv, providerFingerprint, } from "./provider-env.js";
 import { augmentedPath } from "./runtime-path.js";
 import { deliverCloudReports, prepareCloudReportExecution } from "./cloud-report-uploader.js";
+import { reportDeliveryContext } from "./cloud-report-receipt.js";
 import { extractFinalText, extractRunMeta, normalizeEvent, parseLine, } from "./normalize.js";
 import { readSession, writeSession, pickResumeId, isNearBudget } from "./session.js";
+import { NativeThreadContext, isolateMaintenanceSession } from "./native-thread-context.js";
+import { prepareThreadDelivery } from "./thread-input-delivery.js";
 import { providerErrorFromExit } from "./provider-error.js";
 import { createConsoleFormatter } from "./console-formatter.js";
 import { withLocalExecutionFacts, } from "./local-execution-prompt.js";
@@ -34,7 +37,8 @@ import { diffMemoryPruneNotes, evaluateMemoryPrunePostcondition, inspectMemoryPr
 import { createLocalMemoryTelemetry, logLocalMemoryContextPrepareFailure, logLocalMemoryDiagnosticsFailure, } from "./local-memory-telemetry.js";
 import { CodexStartupStageParser } from "./codex-startup-stage.js";
 import { formatRuntimeStartupError } from "./runtime-startup-error.js";
-import { machinePackageManagerEnv, packageManagerEnvFacts } from "./package-manager-env.js";
+import { machinePackageManagerEnv } from "./package-manager-env.js";
+import { logRuntimeEnvironmentContract } from "./runtime-environment-telemetry.js";
 import { sanitizeEnvVars } from "./runtime-env.js";
 import { commitLocalMemoryResultAfterExit, initializeLocalMemoryV2ForWorkspace, isLocalMemoryV2Eligible, localMemoryResultPath as makeLocalMemoryResultPath, } from "./local-memory/runtime.js";
 import { prepareLocalMemoryPrompt } from "./local-memory/prompt.js";
@@ -106,6 +110,9 @@ async function launchLegacyRuntime(request) {
     if (request.runtime === "deepseek-harness") {
         throw new Error("DeepSeek Harness requires execution protocol v1");
     }
+    if (request.runtime !== "claude")
+        request = { ...request, wakePrompt: (await prepareThreadDelivery({ env: request.env,
+                resumed: false, sessionId: "unverified-cold-legacy", wakePrompt: request.wakePrompt })).prompt };
     const common = {
         bin: request.bin,
         cwd: request.cwd,
@@ -173,6 +180,7 @@ async function withKeyedLease(key, operation, cancellation) {
     }
 }
 export async function executeLocal(input, callbacks = {}, dependencies = {}) {
+    input = isolateMaintenanceSession(input);
     const versionedProjectSkills = input.projectSkills !== undefined
         && !Array.isArray(input.projectSkills);
     if (versionedProjectSkills && (input.runtime.name !== "codex" && input.runtime.name !== "claude")) {
@@ -253,6 +261,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     let localMemoryResultPath = null;
     let executionWorkspace = workspace;
     let localMemoryTelemetry = null;
+    let nativeThreadContext = null;
     const inheritedEnv = { ...process.env };
     const reportRoots = {
         root: workspace.dir,
@@ -260,6 +269,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     };
     const cloudReportPreparation = await prepareCloudReportExecution({ env: inheritedEnv, ...reportRoots, executionId: input.executionId, agentHandle: input.handle });
     const { facts: cloudReportUpload, snapshot: reportSnapshot } = cloudReportPreparation;
+    const reportContext = reportDeliveryContext(input.executionId, workspace.runDir, cloudReportUpload);
     for (const key of Object.keys(inheritedEnv)) {
         if (key.startsWith("CREW_AGENT_MEMORY_") || ["CREW_CLOUD_PROVIDER", "CREW_OSS_UPLOAD_SCRIPT", "CREW_OSS_REPORT_UPLOAD"].includes(key))
             delete inheritedEnv[key];
@@ -291,12 +301,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             : null;
         const currentPrior = storedCurrentPrior !== null
             && storedCurrentPrior.sessionContextFingerprint === input.sessionContextFingerprint
+            && storedCurrentPrior.runtime === runtime.name
+            && storedCurrentPrior.threadRoot === input.resumeKey
             ? storedCurrentPrior
             : null;
-        // Interactive V1 uses collision-resistant session directories, while the
-        // older legacy path stored metadata under tasks/<safe thread key>. Import
-        // that metadata once so an existing thread can cross the protocol boundary
-        // without losing its native runtime conversation.
+        // Import compatible legacy metadata across the protocol boundary.
         const legacyRunDir = input.session.enabled
             && supportsNativeResume
             && input.keyMode === "opaque"
@@ -312,7 +321,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const legacyPrior = legacyRunDir === null || (currentPrior !== null && !legacyCwdPinned)
             ? null
             : await readSession(legacyRunDir);
-        const prior = currentPrior ?? legacyPrior;
+        const compatibleLegacyPrior = legacyPrior?.runtime === runtime.name && legacyPrior?.threadRoot === input.resumeKey
+            ? legacyPrior : null;
+        const prior = currentPrior ?? compatibleLegacyPrior;
         const sessionExists = workspace.sessionResume || legacyPrior !== null;
         const usesLegacyCwd = legacyRunDir !== null
             && (legacyCwdPinned || (currentPrior === null && legacyPrior !== null));
@@ -333,11 +344,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ? prior?.model ?? currentModel
             : currentModel;
         const resumeSessionId = supportsNativeResume && sessionExists
-            ? pickResumeId(prior, Date.now(), input.session.warmMs, resumeComparisonModel, input.session.budgetTokens, input.session.maxTurns, providerFp)
+            ? pickResumeId(input.resumeKey && (!Number.isSafeInteger(prior?.threadContextSeq) || prior?.threadHistoryComplete !== true) ? null : prior, Date.now(), input.resumeKey ? 0 : input.session.warmMs, resumeComparisonModel, input.resumeKey ? 0 : input.session.budgetTokens, input.resumeKey ? 0 : input.session.maxTurns, providerFp)
             : null;
         const resuming = resumeSessionId !== null;
         const rotatedForBudget = !resuming && supportsNativeResume && sessionExists
-            && pickResumeId(prior, Date.now(), input.session.warmMs, resumeComparisonModel, 0, 0, providerFp) !== null;
+            && pickResumeId(prior, Date.now(), input.resumeKey ? 0 : input.session.warmMs, resumeComparisonModel, 0, 0, providerFp) !== null;
         const nearBudget = resuming && isNearBudget(prior, input.session.softTokens);
         const rotated = Boolean(workspace.agentSessionId && sessionExists && !resuming);
         // Codex and Kimi choose their own id on a fresh start, so the native id persisted in
@@ -385,8 +396,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             }
         }
         const attachmentPlan = routeRuntimeAttachments(runtime.name, materialized?.attachments ?? []);
-        const wakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
-        memoryPruneTraceId = parseMemoryPruneTraceId(wakePrompt);
+        const baseWakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
+        memoryPruneTraceId = parseMemoryPruneTraceId(baseWakePrompt);
         if (input.localMemoryV2Enabled === true && memoryPruneTraceId !== null
             && isLocalMemoryV2Eligible({
                 enabledForHandle: true,
@@ -399,12 +410,13 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         const memoryPrompt = await prepareLocalMemoryPrompt({
             agentDir: executionWorkspace.dir, executionId: input.executionId, agentHandle: input.handle,
-            enabled: input.localMemoryV2Enabled === true, query: wakePrompt,
+            enabled: input.localMemoryV2Enabled === true, query: baseWakePrompt,
             resultPath: localMemoryResultPath, maxBytes: input.maxSystemPromptBytes,
             renderBase: (reservedPromptBytes) => resolvePrompt(input.systemPrompt, { ...promptContext, reservedPromptBytes }),
         });
         localMemoryResultPath = memoryPrompt.resultPath;
         const systemPrompt = memoryPrompt.systemPrompt;
+        const wakePrompt = baseWakePrompt + memoryPrompt.wakePromptSuffix;
         if (!isolatedMaintenance)
             try {
                 localMemoryTelemetry = createLocalMemoryTelemetry({
@@ -463,6 +475,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         memoryPruneFailurePhase = "runtime_prepare";
         const crewHome = isolatedMaintenance ? executionWorkspace.runDir : workspace.dir;
+        const contextThreadId = input.threadId ?? input.resumeKey;
+        if (contextThreadId && input.maintenancePurpose === undefined) {
+            nativeThreadContext = new NativeThreadContext(join(executionWorkspace.runDir, `.crew-context-${input.executionId}.json`), contextThreadId, runtime.name, resumeSessionId, prior);
+            await nativeThreadContext.initialize();
+        }
         const baseEnv = {
             ...inheritedEnv,
             ...sanitizeEnvVars(providerConfig.envVars),
@@ -475,6 +492,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             CREW_TOKEN: input.launch.token,
             CREW_CHANNEL: input.channelId,
             CREW_HOME: crewHome,
+            // Empty values override any stale inherited hints from an enclosing runtime.
+            CREW_THREAD_ROOT: contextThreadId ?? "",
+            CREW_THREAD_CONTEXT_FILE: nativeThreadContext?.path ?? "",
             // Keep the daemon-selected storage root authoritative for runtimes.
             // In profile-backed NowWork sessions the daemon config may differ from
             // the daemon process environment, so inheriting CREW_AGENTS_ROOT is not
@@ -485,6 +505,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             // Expose only the training root; ability-specific workspace layout stays
             // owned by the training package rather than the NowWork daemon.
             QA_RUNTIME_ROOT: join(crewHome, "training"),
+            QA_REPORT_DELIVERY_CONTEXT: JSON.stringify(reportContext),
             CREW_TASK_DIR: executionWorkspace.runDir,
             CREW_TASK_LOG: executionWorkspace.workLogPath,
             ...(input.wakeMessageId ? { CREW_WAKE_MESSAGE_ID: input.wakeMessageId } : {}),
@@ -504,30 +525,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const childEnv = runtime.name === "deepseek-harness"
             ? applyDeepSeekHarnessMachineEnv(providerEnv, inheritedEnv)
             : providerEnv;
-        dslog("runtime.environment_contract", "Runtime 子进程环境契约", {
-            execution_id: input.executionId,
-            agent_handle: input.handle,
-            runtime: runtime.name,
-            qa_runtime_root: childEnv.QA_RUNTIME_ROOT ?? null,
-            qa_runtime_root_present: childEnv.QA_RUNTIME_ROOT !== undefined,
-            inherited_qa_runtime_root_present: inheritedEnv.QA_RUNTIME_ROOT !== undefined,
-            ...packageManagerEnvFacts(childEnv),
-            training_root: join(crewHome, "training"),
-            cloud_provider: cloudReportUpload.provider,
-            oss_report_upload_enabled: cloudReportUpload.enabled,
-            project_context_present: input.projectContext !== undefined,
-            project_ids: JSON.stringify(input.projectContext === undefined
-                ? []
-                : [
-                    ...(input.projectContext.primary === undefined
-                        ? []
-                        : [input.projectContext.primary.projectId]),
-                    ...input.projectContext.secondary.map((project) => project.projectId),
-                ]),
-            ability_release_present: input.abilityRelease !== undefined,
-            ability_release_id: input.abilityRelease?.releaseId,
-            ability_root_commit: input.abilityRelease?.rootCommit,
-        });
+        logRuntimeEnvironmentContract(input, childEnv, inheritedEnv, crewHome, cloudReportUpload);
         const warn = dependencies.warnRuntime ?? warnRuntimeLocally;
         const launchRuntime = dependencies.launchRuntime ?? (async (launchReq) => {
             if (launchReq.runtime === "codex" && launchReq.codexCollaborationTools === true) {
@@ -544,7 +542,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const effectiveSystemPrompt = abilityContext === undefined
                 ? systemPrompt
                 : `${systemPrompt}\n\n${abilityContext.prompt}`;
-            if (Buffer.byteLength(effectiveSystemPrompt, "utf8") > (input.maxSystemPromptBytes ?? Number.MAX_SAFE_INTEGER)) {
+            if (Buffer.byteLength(effectiveSystemPrompt, "utf8") + Buffer.byteLength(memoryPrompt.wakePromptSuffix, "utf8")
+                > (input.maxSystemPromptBytes ?? Number.MAX_SAFE_INTEGER)) {
                 throw new Error("ability_runtime_context_size_exceeded");
             }
             memoryPruneFailurePhase = "prompt_write";
@@ -820,6 +819,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const event = parseLine(line);
             if (!event)
                 return;
+            nativeThreadContext?.observe(event);
             localMemoryTelemetry?.observe(event);
             if (isRuntimeReadyEvent(runtime.name, event))
                 markRuntimeReady();
@@ -936,22 +936,27 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         localMemoryTelemetry?.markRuntimeExited(exitCode);
         memoryPruneRuntimeExitCode = exitCode;
         if (localMemoryResultPath !== null) {
+            memoryPruneFailurePhase = "memory_commit";
             const committed = await commitLocalMemoryResultAfterExit({
                 resultPath: localMemoryResultPath,
                 agentDir: executionWorkspace.dir,
                 executionId: input.executionId,
                 pruneTraceId: memoryPruneTraceId,
                 exitCode,
+                workLogPath: executionWorkspace.workLogPath,
             });
-            if (committed.status === "failed") {
-                dslog("local_memory.commit_failed", "结构化本地记忆候选未落地，保留结果文件", {
-                    level: "WARN",
+            if (committed.status === "failed" || committed.status === "missing") {
+                const reason = committed.error ?? "local_memory_result_missing";
+                dslog("local_memory.commit_failed", "结构化本地记忆提交或清理未完成，保留可用恢复材料", {
+                    level: "ERROR",
                     execution_id: input.executionId,
                     agent_handle: input.handle,
-                    error_code: committed.error,
+                    error_code: reason,
                     result_path: localMemoryResultPath,
                 });
+                throw new Error(`local_memory_commit_failed: ${reason}`);
             }
+            memoryPruneFailurePhase = "runtime_finalize";
         }
         const errorTail = [
             stderrTail.trim(),
@@ -973,9 +978,12 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 ? usage.inputTokens + usage.cacheReadTokens + usage.cacheCreationTokens
                 : (resuming ? prior?.contextTokens : undefined);
             await writeSession(workspace.sessionDir, {
+                runtime: runtime.name,
+                ...(input.resumeKey === undefined ? {} : { threadRoot: input.resumeKey }),
+                ...(exitCode === 0 ? await nativeThreadContext?.checkpoint() ?? {} : {}),
                 sessionId,
                 lastRunAt: Date.now(),
-                turns: resuming ? (prior?.turns ?? 0) + 1 : 1,
+                turns: nativeThreadContext?.confirmed ? (prior?.turns ?? 0) + 1 : 1,
                 model: currentModel,
                 providerFingerprint: providerFp,
                 ...(input.sessionContextFingerprint === undefined
@@ -991,6 +999,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const cloudReportResult = exitCode === 0
             ? await deliverCloudReports({
                 facts: cloudReportUpload, ...reportRoots, before: reportSnapshot, finalText,
+                receiptFile: reportContext.receiptFile,
                 externalAnswer: externalOutput.lastClosedBlock
                     ?? (finalText === null ? null : extractExternalAnswer(finalText)),
                 captureFinal: input.captureFinal, executionId: input.executionId, agentHandle: input.handle,
@@ -1008,7 +1017,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ...(usage === undefined ? {} : { usage }),
             model: observedModel,
             runtime: runtime.name,
-            resumed: resuming,
+            resumed: nativeThreadContext?.confirmed ?? false,
             sessionId,
             errorMessage: errorTail || null,
             ...(providerError === undefined ? {} : { providerError }),
@@ -1020,6 +1029,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         };
     }
     finally {
+        await nativeThreadContext?.cleanup().catch(() => undefined);
         startupReservationState.current?.release();
         try {
             await localMemoryTelemetry?.finish();

package/dist/local-memory/candidate.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+import { containsLikelySecret } from "../agent-memory/policy.js";
+const CategorySchema = z.enum([
+    "preferences", "project-rules", "testing", "debugging", "git", "incidents", "lessons",
+]);
+export const LocalMemorySingleLineText = z.string().trim().min(1).max(500).regex(/^[^\r\n]+$/u);
+export const LocalMemoryChangeSchema = z.object({
+    operation: z.enum(["create", "update", "supersede"]),
+    memoryId: LocalMemorySingleLineText.regex(/^[^<>]+$/u).nullable(),
+    baseRevision: z.number().int().nonnegative().nullable(),
+    supersedesMemoryId: LocalMemorySingleLineText.regex(/^[^<>]+$/u).nullable(),
+    title: LocalMemorySingleLineText.max(120),
+    kind: z.enum(["procedural", "semantic", "episodic", "preference"]),
+    summary: LocalMemorySingleLineText,
+    triggers: z.array(LocalMemorySingleLineText.max(80)).min(1).max(16),
+    priority: z.enum(["high", "medium", "low"]),
+    detailCategory: CategorySchema,
+    detailBody: z.string().trim().min(1).max(12_000),
+    reviewAfter: LocalMemorySingleLineText.nullable(),
+}).strict();
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u;
+const RESERVED_MEMORY_MARKER = /NOWWORK:(?:MEMORY_ENTRY|MEMORY_INDEX):/iu;
+export function validateLocalMemoryChange(change) {
+    const text = [change.title, change.summary, ...change.triggers, change.detailBody].join("\n");
+    if (containsLikelySecret(text))
+        throw new Error("local_memory_secret_candidate");
+    if (CONTROL_CHARACTER_PATTERN.test(text))
+        throw new Error("local_memory_control_character");
+    if (RESERVED_MEMORY_MARKER.test(text))
+        throw new Error("local_memory_reserved_marker");
+    if (change.operation === "create"
+        && (change.memoryId !== null || change.baseRevision !== null || change.supersedesMemoryId !== null)) {
+        throw new Error("local_memory_create_revision_invalid");
+    }
+    if (change.operation === "update"
+        && (change.memoryId === null || change.baseRevision === null || change.supersedesMemoryId !== null)) {
+        throw new Error("local_memory_update_revision_missing");
+    }
+    if (change.operation === "supersede"
+        && (change.memoryId !== null || change.baseRevision === null || change.supersedesMemoryId === null)) {
+        throw new Error("local_memory_supersede_revision_missing");
+    }
+}

package/dist/local-memory/pending-match.js

@@ -0,0 +1,29 @@
+export function normalizePendingQuery(value) {
+    return value.normalize("NFKC").toLocaleLowerCase().replace(/\s+/gu, " ").trim();
+}
+function containsTerm(text, term) {
+    if (!term)
+        return false;
+    const startBoundary = /^[a-z0-9]/u.test(term);
+    const endBoundary = /[a-z0-9]$/u.test(term);
+    let position = text.indexOf(term);
+    while (position >= 0) {
+        const before = text[position - 1] ?? "";
+        const after = text[position + term.length] ?? "";
+        if ((!startBoundary || !/[a-z0-9_-]/u.test(before)) && (!endBoundary || !/[a-z0-9_-]/u.test(after)))
+            return true;
+        position = text.indexOf(term, position + 1);
+    }
+    return false;
+}
+export function pendingRecallScore(item, query) {
+    const normalized = normalizePendingQuery(query);
+    if (!normalized)
+        return 0;
+    const candidate = item.candidate;
+    const terms = normalized.split(/[\s,，、。！？；：:()[\]{}"'`]+/u).filter(Boolean);
+    const text = normalizePendingQuery([candidate.title, candidate.summary, ...candidate.triggers, candidate.detailCategory, candidate.detailBody].join("\n"));
+    const explicit = [candidate.title, ...candidate.triggers].map(normalizePendingQuery);
+    const explicitScore = explicit.reduce((score, term) => score + (containsTerm(normalized, term) ? 10 : 0), 0);
+    return explicitScore + terms.reduce((score, term) => score + (containsTerm(text, term) ? 1 : 0), 0);
+}