@nowcrew/daemon 0.6.88-beta.1 → 0.6.88-beta.3

package/dist/cloud-report-receipt.js

@@ -0,0 +1,83 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+const MAX_REPORT_BYTES = 32 * 1024 * 1024;
+export function reportDeliveryContext(executionId, runDir, facts) {
+    return {
+        version: 1,
+        provider: facts.provider,
+        executionId,
+        receiptFile: join(runDir, `.qa-report-delivery-${createHash("sha256").update(executionId).digest("hex")}.json`),
+        ...(facts.ossUploadScript === undefined ? {} : { script: facts.ossUploadScript }),
+    };
+}
+function inside(root, file) {
+    const part = relative(root, file);
+    return part !== ".." && !part.startsWith("../") && !part.startsWith("..\\") && !isAbsolute(part);
+}
+export async function verifiedReportReceipt(input) {
+    if (!input.receiptFile || !input.answer)
+        return false;
+    try {
+        const stat = await lstat(input.receiptFile);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 64 * 1024)
+            return false;
+        const receipt = JSON.parse(await readFile(input.receiptFile, "utf8"));
+        if (!receipt || typeof receipt !== "object")
+            return false;
+        const r = receipt;
+        if (r.version !== 1 || r.executionId !== input.executionId || r.evidenceComplete !== true
+            || !Array.isArray(r.runIds) || r.runIds.length === 0 || r.runIds.length > 100
+            || r.runIds.some(id => typeof id !== "string" || !id || id.length > 256)
+            || typeof r.file !== "string" || !isAbsolute(r.file) || !r.file.endsWith(".html")
+            || typeof r.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.sha256)
+            || typeof r.url !== "string")
+            return false;
+        const url = new URL(r.url);
+        if (url.protocol !== "https:" || url.hostname !== "ai-claw-in.nowcoder.com"
+            || !url.pathname.endsWith(".html") || url.username || url.password || url.search || url.hash)
+            return false;
+        const answerUrls = input.answer.match(/https:\/\/ai-claw-in\.nowcoder\.com\/[^\s<>"')\]]+/g) ?? [];
+        if (!answerUrls.includes(url.href))
+            return false;
+        const file = await realpath(r.file);
+        const roots = await Promise.all([input.root, input.qaReportRoot ?? join(input.root, "qa-report-server-v2")]
+            .map(root => realpath(resolve(root)).catch(() => null)));
+        if (!roots.some(root => root !== null && inside(root, file)))
+            return false;
+        const fileStat = await lstat(file);
+        if (!fileStat.isFile() || fileStat.size > MAX_REPORT_BYTES)
+            return false;
+        const expectedHash = createHash("sha256").update(await readFile(file)).digest("hex");
+        if (expectedHash !== r.sha256)
+            return false;
+        const response = await fetch(url.href, { redirect: "error", signal: AbortSignal.timeout(15_000) });
+        if (!response.ok || !/^text\/html(?:;|$)/i.test(response.headers.get("content-type") ?? "")
+            || /attachment/i.test(response.headers.get("content-disposition") ?? "") || !response.body) {
+            await response.body?.cancel();
+            return false;
+        }
+        const reader = response.body.getReader();
+        const hash = createHash("sha256");
+        let bytes = 0;
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                bytes += chunk.value.byteLength;
+                if (bytes > MAX_REPORT_BYTES)
+                    return false;
+                hash.update(chunk.value);
+            }
+            return bytes === fileStat.size && hash.digest("hex") === expectedHash;
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+            reader.releaseLock();
+        }
+    }
+    catch {
+        return false;
+    }
+}

package/dist/cloud-report-uploader.js

@@ -4,6 +4,7 @@ import { extname, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { cloudReportUploadFacts } from "./cloud-report-upload.js";
 import { dslog } from "./slog.js";
+import { verifiedReportReceipt } from "./cloud-report-receipt.js";
 const execFileP = promisify(execFile);
 const REPORT_FILENAMES = new Set(["report.md", "result.json"]);
 const MAX_DEPTH = 8;
@@ -166,6 +167,14 @@ export async function deliverCloudReports(input) {
     if (!input.facts.enabled || input.facts.ossUploadScript === undefined || input.before === null) {
         return { finalText: input.finalText, externalAnswer: input.externalAnswer };
     }
+    if (input.captureFinal && await verifiedReportReceipt({
+        ...input, answer: input.externalAnswer ?? input.finalText,
+    })) {
+        dslog("cloud_report_upload.already_delivered", "本次执行的 HTML 交付收据及内容已验证，跳过重复上传", {
+            execution_id: input.executionId, agent_handle: input.agentHandle,
+        });
+        return { finalText: input.finalText, externalAnswer: input.externalAnswer };
+    }
     try {
         const result = await (input.upload ?? uploadCloudReports)({
             script: input.facts.ossUploadScript,

package/dist/local-executor.js

@@ -12,6 +12,7 @@ import { spawnKimi, KIMI_EFFORT_LEVELS } from "./runtimes/kimi.js";
 import { applyDeepSeekHarnessMachineEnv, applyProviderEnv, providerFingerprint, } from "./provider-env.js";
 import { augmentedPath } from "./runtime-path.js";
 import { deliverCloudReports, prepareCloudReportExecution } from "./cloud-report-uploader.js";
+import { reportDeliveryContext } from "./cloud-report-receipt.js";
 import { extractFinalText, extractRunMeta, normalizeEvent, parseLine, } from "./normalize.js";
 import { readSession, writeSession, pickResumeId, isNearBudget } from "./session.js";
 import { providerErrorFromExit } from "./provider-error.js";
@@ -34,7 +35,8 @@ import { diffMemoryPruneNotes, evaluateMemoryPrunePostcondition, inspectMemoryPr
 import { createLocalMemoryTelemetry, logLocalMemoryContextPrepareFailure, logLocalMemoryDiagnosticsFailure, } from "./local-memory-telemetry.js";
 import { CodexStartupStageParser } from "./codex-startup-stage.js";
 import { formatRuntimeStartupError } from "./runtime-startup-error.js";
-import { machinePackageManagerEnv, packageManagerEnvFacts } from "./package-manager-env.js";
+import { machinePackageManagerEnv } from "./package-manager-env.js";
+import { logRuntimeEnvironmentContract } from "./runtime-environment-telemetry.js";
 import { sanitizeEnvVars } from "./runtime-env.js";
 import { commitLocalMemoryResultAfterExit, initializeLocalMemoryV2ForWorkspace, isLocalMemoryV2Eligible, localMemoryResultPath as makeLocalMemoryResultPath, } from "./local-memory/runtime.js";
 import { prepareLocalMemoryPrompt } from "./local-memory/prompt.js";
@@ -260,6 +262,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     };
     const cloudReportPreparation = await prepareCloudReportExecution({ env: inheritedEnv, ...reportRoots, executionId: input.executionId, agentHandle: input.handle });
     const { facts: cloudReportUpload, snapshot: reportSnapshot } = cloudReportPreparation;
+    const reportContext = reportDeliveryContext(input.executionId, workspace.runDir, cloudReportUpload);
     for (const key of Object.keys(inheritedEnv)) {
         if (key.startsWith("CREW_AGENT_MEMORY_") || ["CREW_CLOUD_PROVIDER", "CREW_OSS_UPLOAD_SCRIPT", "CREW_OSS_REPORT_UPLOAD"].includes(key))
             delete inheritedEnv[key];
@@ -485,6 +488,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             // Expose only the training root; ability-specific workspace layout stays
             // owned by the training package rather than the NowWork daemon.
             QA_RUNTIME_ROOT: join(crewHome, "training"),
+            QA_REPORT_DELIVERY_CONTEXT: JSON.stringify(reportContext),
             CREW_TASK_DIR: executionWorkspace.runDir,
             CREW_TASK_LOG: executionWorkspace.workLogPath,
             ...(input.wakeMessageId ? { CREW_WAKE_MESSAGE_ID: input.wakeMessageId } : {}),
@@ -504,30 +508,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const childEnv = runtime.name === "deepseek-harness"
             ? applyDeepSeekHarnessMachineEnv(providerEnv, inheritedEnv)
             : providerEnv;
-        dslog("runtime.environment_contract", "Runtime 子进程环境契约", {
-            execution_id: input.executionId,
-            agent_handle: input.handle,
-            runtime: runtime.name,
-            qa_runtime_root: childEnv.QA_RUNTIME_ROOT ?? null,
-            qa_runtime_root_present: childEnv.QA_RUNTIME_ROOT !== undefined,
-            inherited_qa_runtime_root_present: inheritedEnv.QA_RUNTIME_ROOT !== undefined,
-            ...packageManagerEnvFacts(childEnv),
-            training_root: join(crewHome, "training"),
-            cloud_provider: cloudReportUpload.provider,
-            oss_report_upload_enabled: cloudReportUpload.enabled,
-            project_context_present: input.projectContext !== undefined,
-            project_ids: JSON.stringify(input.projectContext === undefined
-                ? []
-                : [
-                    ...(input.projectContext.primary === undefined
-                        ? []
-                        : [input.projectContext.primary.projectId]),
-                    ...input.projectContext.secondary.map((project) => project.projectId),
-                ]),
-            ability_release_present: input.abilityRelease !== undefined,
-            ability_release_id: input.abilityRelease?.releaseId,
-            ability_root_commit: input.abilityRelease?.rootCommit,
-        });
+        logRuntimeEnvironmentContract(input, childEnv, inheritedEnv, crewHome, cloudReportUpload);
         const warn = dependencies.warnRuntime ?? warnRuntimeLocally;
         const launchRuntime = dependencies.launchRuntime ?? (async (launchReq) => {
             if (launchReq.runtime === "codex" && launchReq.codexCollaborationTools === true) {
@@ -936,22 +917,27 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         localMemoryTelemetry?.markRuntimeExited(exitCode);
         memoryPruneRuntimeExitCode = exitCode;
         if (localMemoryResultPath !== null) {
+            memoryPruneFailurePhase = "memory_commit";
             const committed = await commitLocalMemoryResultAfterExit({
                 resultPath: localMemoryResultPath,
                 agentDir: executionWorkspace.dir,
                 executionId: input.executionId,
                 pruneTraceId: memoryPruneTraceId,
                 exitCode,
+                workLogPath: executionWorkspace.workLogPath,
             });
-            if (committed.status === "failed") {
-                dslog("local_memory.commit_failed", "结构化本地记忆候选未落地，保留结果文件", {
-                    level: "WARN",
+            if (committed.status === "failed" || committed.status === "missing") {
+                const reason = committed.error ?? "local_memory_result_missing";
+                dslog("local_memory.commit_failed", "结构化本地记忆提交或清理未完成，保留可用恢复材料", {
+                    level: "ERROR",
                     execution_id: input.executionId,
                     agent_handle: input.handle,
-                    error_code: committed.error,
+                    error_code: reason,
                     result_path: localMemoryResultPath,
                 });
+                throw new Error(`local_memory_commit_failed: ${reason}`);
             }
+            memoryPruneFailurePhase = "runtime_finalize";
         }
         const errorTail = [
             stderrTail.trim(),
@@ -991,6 +977,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const cloudReportResult = exitCode === 0
             ? await deliverCloudReports({
                 facts: cloudReportUpload, ...reportRoots, before: reportSnapshot, finalText,
+                receiptFile: reportContext.receiptFile,
                 externalAnswer: externalOutput.lastClosedBlock
                     ?? (finalText === null ? null : extractExternalAnswer(finalText)),
                 captureFinal: input.captureFinal, executionId: input.executionId, agentHandle: input.handle,

package/dist/local-memory/runtime.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
-import { lstat, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { applyLocalMemoryResult, parseLocalMemoryResult } from "./write.js";
 export function isLocalMemoryV2Eligible(input) {
     // The allowlist is the rollout boundary. The marker and seed/pre-existing
@@ -54,10 +55,21 @@ export function renderLocalMemoryResultInstructions(resultPath) {
 将一个合法 JSON 对象写入以下 daemon 提供的文件，写入完成后再结束本轮：
 ${resultPath}
 
-JSON 顶层必须包含：
+outcome 只允许 no_change、proposed、conflict、failed。新增、更新、替代记忆或任何 statusChanges 都必须使用 proposed；no_change 的 changes/statusChanges 必须都为空。conflict/failed 表示未完成，不能当作提交成功。自然语言“已修正”不是 JSON 枚举值，不能写成 corrected。
+
+新增记忆的完整合法示例（内容须替换为本任务实际候选）：
+\`\`\`json
+{"schemaVersion":1,"purpose":"memory_prune","baseCatalogRevision":0,"outcome":"proposed","changes":[{"operation":"create","memoryId":null,"baseRevision":null,"supersedesMemoryId":null,"title":"发布验收约定","kind":"procedural","summary":"发布前必须验证回滚步骤。","triggers":["发布","回滚"],"priority":"medium","detailCategory":"project-rules","detailBody":"发布前必须验证回滚步骤，并将验证结果写入发布报告。","reviewAfter":null}],"statusChanges":[]}
+\`\`\`
+
+没有需要变更的记忆时：
+\`\`\`json
 {"schemaVersion":1,"purpose":"memory_prune","baseCatalogRevision":0,"outcome":"no_change","changes":[],"statusChanges":[]}
-每个 changes 项使用 operation=create|update|supersede、title、kind、summary、triggers、priority、detailCategory、detailBody、reviewAfter；create 的 memoryId/baseRevision/supersedesMemoryId 必须为 null，update/supersede 按现有索引填写版本和 id。
+\`\`\`
+
+每个 changes 项须保留示例中的全部字段。operation=create|update|supersede；kind=procedural|semantic|episodic|preference；priority=high|medium|low；detailCategory=preferences|project-rules|testing|debugging|git|incidents|lessons。create 的 memoryId/baseRevision/supersedesMemoryId 必须为 null；update 按现有索引填写 memoryId/baseRevision，supersedesMemoryId 为 null；supersede 填 supersedesMemoryId/baseRevision，memoryId 为 null。
 只提交可复用、与本次任务明确相关的少量候选；不要写入凭证、token、隐私或内部控制标记。daemon 会校验、去重、限制 MEMORY.md 大小，超出索引容量的候选会保存在 pending 归档中；后续相关任务会按需召回，索引腾出空间后可自动提升。
+写入候选文件不等于已经记住，只有 daemon 校验并提交成功后记忆才生效。本结构化轮次覆盖前文提前清理工作日志的要求：保留 $CREW_TASK_LOG，不要清空或删除；daemon 将在提交成功后清理，失败时保留日志和候选用于排查或重试。
 `;
 }
 /** Prevent ordinary V2 turns from racing the daemon-managed memory writer. */
@@ -81,16 +93,52 @@ export async function commitLocalMemoryResultAfterExit(input) {
     }
     try {
         const result = parseLocalMemoryResult(raw);
+        if (result.outcome === "conflict" || result.outcome === "failed") {
+            return { status: "failed", error: `local_memory_result_${result.outcome}` };
+        }
         await applyLocalMemoryResult({
             agentDir: input.agentDir,
             result,
             executionId: input.executionId,
             pruneTraceId: input.pruneTraceId,
         });
-        await rm(input.resultPath, { force: true });
-        return { status: "applied" };
     }
     catch (error) {
         return { status: "failed", error: error instanceof Error ? error.message : "apply_failed" };
     }
+    if (input.workLogPath !== undefined) {
+        try {
+            const relativeLogPath = relative(resolve(input.agentDir), resolve(input.workLogPath));
+            if (relativeLogPath === "" || relativeLogPath === ".." || relativeLogPath.startsWith(`..${sep}`)
+                || isAbsolute(relativeLogPath))
+                throw new Error("local_memory_work_log_path_invalid");
+            const expectedLogPath = join(await realpath(input.agentDir), relativeLogPath);
+            const before = await lstat(input.workLogPath);
+            if (!before.isFile() || before.isSymbolicLink())
+                throw new Error("local_memory_work_log_path_invalid");
+            if (await realpath(input.workLogPath) !== expectedLogPath)
+                throw new Error("local_memory_work_log_path_invalid");
+            const handle = await open(input.workLogPath, constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+            try {
+                const opened = await handle.stat();
+                if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) {
+                    throw new Error("local_memory_work_log_path_changed");
+                }
+                await handle.truncate(0);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch {
+            return { status: "failed", error: "local_memory_work_log_cleanup_failed" };
+        }
+    }
+    try {
+        await rm(input.resultPath, { force: true });
+    }
+    catch {
+        return { status: "failed", error: "local_memory_result_cleanup_failed" };
+    }
+    return { status: "applied" };
 }

package/dist/runtime-environment-telemetry.js

@@ -0,0 +1,27 @@
+import { join } from "node:path";
+import { packageManagerEnvFacts } from "./package-manager-env.js";
+import { dslog } from "./slog.js";
+export function logRuntimeEnvironmentContract(input, childEnv, inheritedEnv, crewHome, cloudReportUpload) {
+    dslog("runtime.environment_contract", "Runtime 子进程环境契约", {
+        execution_id: input.executionId,
+        agent_handle: input.handle,
+        runtime: input.runtime.name,
+        qa_runtime_root: childEnv.QA_RUNTIME_ROOT ?? null,
+        qa_runtime_root_present: childEnv.QA_RUNTIME_ROOT !== undefined,
+        inherited_qa_runtime_root_present: inheritedEnv.QA_RUNTIME_ROOT !== undefined,
+        ...packageManagerEnvFacts(childEnv),
+        training_root: join(crewHome, "training"),
+        cloud_provider: cloudReportUpload.provider,
+        oss_report_upload_enabled: cloudReportUpload.enabled,
+        project_context_present: input.projectContext !== undefined,
+        project_ids: JSON.stringify(input.projectContext === undefined
+            ? []
+            : [
+                ...(input.projectContext.primary === undefined ? [] : [input.projectContext.primary.projectId]),
+                ...input.projectContext.secondary.map((project) => project.projectId),
+            ]),
+        ability_release_present: input.abilityRelease !== undefined,
+        ability_release_id: input.abilityRelease?.releaseId,
+        ability_root_commit: input.abilityRelease?.rootCommit,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.88-beta.1",
+  "version": "0.6.88-beta.3",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",