@nowcrew/daemon 0.6.88-beta.14 → 0.6.88-beta.16

package/dist/daemon-migration-controller.js

@@ -1,211 +0,0 @@
-import { createHash } from "node:crypto";
-import { cp, lstat, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, relative, resolve } from "node:path";
-import { z } from "zod";
-import { loadProfile } from "./computer-profile.js";
-import { builtDaemonEntry } from "./computer-cli.js";
-import { installDaemonAutomatically } from "./automatic-daemon-installer.js";
-import { buildServiceSpec, captureExactService, serviceStatus, systemCommandRunner } from "./computer-service.js";
-import { readManagedServiceRegistry } from "./managed-service-registry.js";
-import { uninstallManagedService } from "./managed-service-lifecycle.js";
-import { resolveAutomaticInstallTarget } from "./automatic-install-target.js";
-import { buildStorageMigrationMappings, createSafeServiceManifest, CredentialMaterialError, } from "./storage-migration-manifest.js";
-const MigrationMessageSchema = z.object({
-    type: z.literal("daemon:migrate"),
-    migrationId: z.string().uuid(),
-    targetProfile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/),
-    targetDaemonHome: z.string().min(1),
-    targetAgentsRoot: z.string().min(1),
-}).strict();
-function migrationBackupRoot(input, id) {
-    return resolve(input.backupRoot ?? resolve(input.userHome ?? homedir(), ".crew", "migration-backups"), id);
-}
-function legacyLocalHome(input) {
-    return resolve(input.userHome ?? homedir(), ".crew");
-}
-async function assertEmptyOrMissing(path) {
-    try {
-        const entries = await readdir(path);
-        if (entries.length > 0)
-            throw new Error(`target path is not empty: ${path}`);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-}
-async function hashedFiles(root, directory = root) {
-    const entries = await readdir(directory, { withFileTypes: true });
-    const files = [];
-    for (const entry of entries) {
-        const path = resolve(directory, entry.name);
-        const stat = await lstat(path);
-        if (stat.isSymbolicLink())
-            throw new Error(`backup source contains a symbolic link: ${relative(root, path)}`);
-        if (stat.isDirectory())
-            files.push(...await hashedFiles(root, path));
-        else if (stat.isFile())
-            files.push({ path: relative(root, path), sha256: createHash("sha256").update(await readFile(path)).digest("hex") });
-    }
-    return files;
-}
-async function backupAndCopy(input, id, targetHome, targetAgents, service) {
-    // Validate and project service identity before creating any backup bytes. A descriptor containing
-    // a token must stop the migration before it can be copied into the local backup root.
-    const safeService = createSafeServiceManifest({
-        spec: service.spec,
-        snapshot: service.snapshot,
-        managedRecord: service.managedRecord,
-    });
-    const backup = migrationBackupRoot(input, id);
-    await mkdir(backup, { recursive: true, mode: 0o700 });
-    await cp(input.currentDaemonHome, resolve(backup, "daemon-home"), { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, resolve(backup, "agents-root"), { recursive: true, force: false });
-    await cp(input.currentDaemonHome, targetHome, { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, targetAgents, { recursive: true, force: false });
-    const daemonFiles = await hashedFiles(resolve(backup, "daemon-home"));
-    const agentFiles = await hashedFiles(resolve(backup, "agents-root"));
-    const mappings = buildStorageMigrationMappings({ daemonFiles, agentFiles });
-    await writeFile(resolve(backup, "manifest.json"), `${JSON.stringify({
-        version: 2,
-        migrationId: id,
-        profile: input.profileName,
-        daemonHome: input.currentDaemonHome,
-        agentsRoot: input.currentAgentsRoot,
-        service: safeService,
-        mappings,
-    }, null, 2)}\n`, { mode: 0o600 });
-    return backup;
-}
-async function cleanupCurrentServiceDefault(spec, input) {
-    const userHome = input.userHome ?? homedir();
-    const records = await readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) });
-    const record = records.find((candidate) => candidate.profile === spec.profile && candidate.daemonHome === input.currentDaemonHome);
-    if (record !== undefined && (spec.platform === "darwin" || spec.platform === "linux")) {
-        await uninstallManagedService({ spec, record, runner: systemCommandRunner, registry: { userHome, localHome: legacyLocalHome(input) } });
-        return;
-    }
-    // Windows and legacy descriptors are handled by the normal CLI/service lifecycle.
-    const { uninstallService } = await import("./computer-service.js");
-    const status = await serviceStatus(spec, systemCommandRunner);
-    if (status.installed)
-        await uninstallService(spec, systemCommandRunner);
-}
-export function createDaemonMigrationController(input) {
-    const handled = new Set();
-    let running = null;
-    const sendFailure = (id, errorCode, error) => {
-        input.sendStatus({ type: "daemon:migration-status", migrationId: id, status: "failed", errorCode, errorMessage: error instanceof Error ? error.message : String(error) });
-    };
-    const execute = async (raw) => {
-        const parsed = MigrationMessageSchema.safeParse(raw);
-        if (!parsed.success)
-            return false;
-        const message = parsed.data;
-        if (handled.has(message.migrationId))
-            return true;
-        if (running !== null) {
-            sendFailure(message.migrationId, "target_conflict", new Error("another migration is already running"));
-            return true;
-        }
-        running = (async () => {
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "preflight" });
-            if (input.isBusy()) {
-                sendFailure(message.migrationId, "runtime_busy", new Error("active executions must finish before migration"));
-                return;
-            }
-            const platform = input.platform ?? process.platform;
-            const userHome = input.userHome ?? homedir();
-            let targetPath;
-            let targetAgents;
-            let currentSpec;
-            let currentService;
-            let managedRecord = null;
-            let currentRegistryUrl;
-            try {
-                const currentProfile = await (input.loadCurrentProfile ?? loadProfile)(input.profileName, input.currentDaemonHome);
-                if (currentProfile.machineToken !== input.machineToken)
-                    throw new Error("active profile token does not match this daemon");
-                currentRegistryUrl = currentProfile.registryUrl;
-                const target = resolveAutomaticInstallTarget({
-                    serverUrl: input.serverUrl,
-                    requestedProfile: message.targetProfile,
-                    userHome,
-                    platform,
-                    // Layout migration creates the canonical service in the new local-home
-                    // root. Source registry and rollback material remain under legacy .crew.
-                    requestedLocalHomeMode: "nowwork",
-                });
-                if (!isAbsolute(message.targetDaemonHome) || !isAbsolute(message.targetAgentsRoot)
-                    || resolve(message.targetDaemonHome) !== resolve(target.daemonHome)
-                    || resolve(message.targetAgentsRoot) !== resolve(target.agentsRoot))
-                    throw new Error("requested target does not match the standard profile layout");
-                targetPath = resolve(target.daemonHome);
-                targetAgents = resolve(target.agentsRoot);
-                await assertEmptyOrMissing(targetPath);
-                await assertEmptyOrMissing(targetAgents);
-                currentSpec = buildServiceSpec({ platform, profile: input.profileName, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: input.currentDaemonHome });
-                const exact = await (input.captureCurrentService ?? ((spec) => captureExactService(spec, systemCommandRunner)))(currentSpec);
-                if (!exact.installed || !exact.running || !exact.exact)
-                    throw new Error("current managed service identity is not exact and running");
-                currentService = { installed: exact.installed, running: exact.running };
-                if (platform === "darwin" || platform === "linux") {
-                    const records = await (input.readManagedRecords ?? (() => readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) })))();
-                    managedRecord = records.find((record) => record.serviceId === currentSpec.id && record.profile === input.profileName && record.daemonHome === input.currentDaemonHome) ?? null;
-                    if (managedRecord === null)
-                        throw new Error("current managed service registry record is missing");
-                }
-            }
-            catch (error) {
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "target_conflict", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "backing_up" });
-            let backupPath;
-            try {
-                backupPath = await backupAndCopy(input, message.migrationId, targetPath, targetAgents, { spec: currentSpec, snapshot: currentService, managedRecord });
-                input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "installing", backupPath });
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "backup_failed", error);
-                return;
-            }
-            const install = input.install ?? installDaemonAutomatically;
-            try {
-                const result = await install({
-                    serverUrl: input.serverUrl,
-                    machineToken: input.machineToken,
-                    requestedProfile: message.targetProfile,
-                    requestedLocalHomeMode: "nowwork",
-                    ...(currentRegistryUrl === undefined ? {} : { requestedRegistryUrl: currentRegistryUrl }),
-                });
-                if (result.profile !== message.targetProfile || result.serviceId.length === 0) {
-                    throw new Error("target service identity did not match the requested profile");
-                }
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, "install_failed", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "restarting" });
-            try {
-                await (input.cleanupCurrentService ?? ((spec) => cleanupCurrentServiceDefault(spec, input)))(currentSpec);
-            }
-            catch (error) {
-                const targetSpec = buildServiceSpec({ platform, profile: message.targetProfile, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: targetPath });
-                await (input.cleanupTargetService ?? ((spec) => cleanupCurrentServiceDefault(spec, { ...input, profileName: message.targetProfile, currentDaemonHome: targetPath })))(targetSpec).catch(() => undefined);
-                sendFailure(message.migrationId, "service_cleanup_failed", error);
-                return;
-            }
-        })().finally(() => {
-            handled.add(message.migrationId);
-            running = null;
-        });
-        await running;
-        return true;
-    };
-    return { handle: execute, drain: async () => { await running; } };
-}

package/dist/daemon-migration-wiring.js

@@ -1,22 +0,0 @@
-import { daemonHome } from "./computer-profile.js";
-import { createDaemonMigrationController } from "./daemon-migration-controller.js";
-export function createServeMigrationController(input) {
-    if (input.profileName === undefined)
-        return null;
-    return createDaemonMigrationController({
-        serverUrl: input.config.serverUrl,
-        machineToken: input.config.machineToken,
-        profileName: input.profileName,
-        currentDaemonHome: daemonHome(),
-        currentAgentsRoot: input.config.agentsRoot,
-        isBusy: input.isBusy,
-        sendStatus: input.sendStatus,
-    });
-}
-export async function handleMigrationControlMessage(controller, decoded) {
-    if (controller === null || typeof decoded !== "object" || decoded === null
-        || !("type" in decoded) || decoded.type !== "daemon:migrate")
-        return false;
-    await controller.handle(decoded);
-    return true;
-}

package/dist/storage-control.js

@@ -1,212 +0,0 @@
-import { z } from "zod";
-export const STORAGE_MIGRATION_CAPABILITY = "storage_migration_v1";
-export const STORAGE_MIGRATION_STATUS_CAPABILITY = "storage_migration_status_v1";
-const IdentitySchema = z.object({
-    migrationId: z.string().uuid(),
-    environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
-    workspaceId: z.string().uuid(),
-    ownerEpoch: z.number().int().positive().safe().optional(),
-    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-});
-const DoctorRequestSchema = IdentitySchema.extend({ type: z.literal("daemon:storage-doctor") }).strict();
-const MigrateRequestSchema = IdentitySchema.extend({
-    type: z.literal("daemon:storage-migrate"),
-    manifestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
-}).strict();
-const StatusSchema = z.enum([
-    "preflight_running", "preflight_passed", "backing_up", "initial_sync", "quiescing", "final_sync", "verified",
-    "service_switched", "hello_confirmed", "completed", "failed", "rollback_pending", "rolled_back",
-    "rollback_failed",
-]);
-const TOKEN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b|\bbearer\s+[^\s]+|(?:password|secret|token)\s*[:=]\s*[^\s]+)/giu;
-const safeError = (error) => (error instanceof Error ? error.message : String(error))
-    .replaceAll(TOKEN, "<redacted>").slice(0, 500) || "storage migration failed";
-const stableErrorCode = (candidate, fallback) => typeof candidate === "string" && /^[a-z0-9._-]{1,128}$/u.test(candidate) ? candidate : fallback;
-export function createStorageControlController(input) {
-    const environment = z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u).parse(input.environment);
-    const workspaceId = z.string().uuid().parse(input.workspaceId);
-    const profile = z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u).parse(input.profile);
-    const sourceStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.sourceStorageFingerprint);
-    const targetStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.targetStorageFingerprint);
-    const ownership = input.ownership === undefined ? undefined : Object.freeze({
-        ownerEpoch: z.number().int().positive().safe().parse(input.ownership.ownerEpoch),
-        ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u)
-            .parse(input.ownership.ownershipClaimFingerprint),
-    });
-    const preflights = new Map();
-    const preflightRuns = new Map();
-    const appliedMigrationIds = new Set();
-    let runningMigrationId = null;
-    const preflightTimeoutMs = z.number().int().positive().max(24 * 60 * 60 * 1000)
-        .parse(input.preflightTimeoutMs ?? 30 * 60 * 1000);
-    const frame = (identity, status, extra = {}) => ({
-        type: "daemon:storage-migration-status",
-        migrationId: identity.migrationId,
-        status,
-        environment,
-        workspaceId,
-        profile,
-        ...(ownership === undefined ? {} : ownership),
-        ...extra,
-    });
-    const failure = (identity, errorCode, error, reopenAdmission = false, extra = {}) => {
-        reportStatus(frame(identity, "failed", {
-            errorCode,
-            ...extra,
-            ...(error === undefined ? {} : { errorMessage: safeError(error) }),
-            ...(reopenAdmission || error?.reopenAdmission === true
-                ? { reopenAdmission: true }
-                : {}),
-        }));
-    };
-    const reportStatus = (statusFrame) => {
-        try {
-            input.sendStatus(statusFrame);
-        }
-        catch (error) {
-            input.onStatusError?.(error, statusFrame);
-        }
-    };
-    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId
-        && (ownership === undefined
-            || (identity.ownerEpoch === ownership.ownerEpoch
-                && identity.ownershipClaimFingerprint === ownership.ownershipClaimFingerprint));
-    const preflightKey = (identity) => `${identity.migrationId}\0${identity.environment}\0${identity.workspaceId}`;
-    const runPreflight = (identity, failureFallback = "doctor_failed") => {
-        const key = preflightKey(identity);
-        const existing = preflightRuns.get(key);
-        if (existing !== undefined)
-            return existing;
-        const controller = new AbortController();
-        let scannedEntries = 0;
-        let timedOut = false;
-        reportStatus(frame(identity, "preflight_running", {
-            progress: { state: "running", scannedEntries: 0 },
-        }));
-        const doctorPromise = Promise.resolve().then(() => input.runDoctor(identity.migrationId, {
-            signal: controller.signal,
-            onProgress: (progress) => {
-                if (timedOut)
-                    return;
-                scannedEntries = progress.scannedEntries;
-                reportStatus(frame(identity, "preflight_running", {
-                    progress: { state: "running", scannedEntries },
-                }));
-            },
-        }));
-        let timeoutHandle;
-        const timeout = new Promise((_, reject) => {
-            timeoutHandle = setTimeout(() => {
-                timedOut = true;
-                controller.abort();
-                reject(Object.assign(new Error("storage doctor preflight timed out"), {
-                    code: "preflight_stale",
-                    scannedEntries,
-                }));
-            }, preflightTimeoutMs);
-            timeoutHandle.unref?.();
-        });
-        void doctorPromise.catch(() => undefined);
-        let outcome;
-        outcome = Promise.race([doctorPromise, timeout]).then((doctor) => {
-            if (doctor.manifest.migrationId !== identity.migrationId
-                || doctor.environment !== environment || doctor.workspaceId !== workspaceId
-                || doctor.profile !== profile) {
-                failure(identity, "storage_identity_mismatch", undefined, true);
-                return null;
-            }
-            if (!doctor.applyAllowed) {
-                failure(identity, doctor.blockers[0]?.code ?? "doctor_blocked", undefined, true);
-                return null;
-            }
-            preflights.set(identity.migrationId, doctor);
-            reportStatus(frame(identity, "preflight_passed", {
-                sourceStorageFingerprint,
-                targetStorageFingerprint,
-                manifestDigest: doctor.manifestDigest,
-            }));
-            return doctor;
-        }).catch((error) => {
-            const code = error.code;
-            if (code === "preflight_stale") {
-                failure(identity, "preflight_stale", undefined, true, {
-                    retryable: true,
-                    progress: { state: "stale", scannedEntries: Number(error.scannedEntries) || scannedEntries },
-                });
-            }
-            else if (code === "preflight_aborted") {
-                failure(identity, "preflight_aborted", error, true, {
-                    retryable: true,
-                    progress: { state: "stale", scannedEntries },
-                });
-            }
-            else {
-                failure(identity, stableErrorCode(code, failureFallback), error, true);
-            }
-            return null;
-        }).finally(() => {
-            if (timeoutHandle !== undefined)
-                clearTimeout(timeoutHandle);
-            if (preflightRuns.get(key) === outcome)
-                preflightRuns.delete(key);
-        });
-        preflightRuns.set(key, outcome);
-        return outcome;
-    };
-    const handle = async (raw) => {
-        const type = typeof raw === "object" && raw !== null && "type" in raw ? raw.type : null;
-        if (type !== "daemon:storage-doctor" && type !== "daemon:storage-migrate")
-            return false;
-        const schema = type === "daemon:storage-doctor" ? DoctorRequestSchema : MigrateRequestSchema;
-        const parsed = schema.safeParse(raw);
-        if (!parsed.success)
-            return true;
-        const identity = parsed.data;
-        if (!matchesIdentity(identity)) {
-            failure(identity, "storage_identity_mismatch", undefined, true);
-            return true;
-        }
-        if (type === "daemon:storage-doctor") {
-            await runPreflight(identity);
-            return true;
-        }
-        if (runningMigrationId !== null) {
-            if (runningMigrationId !== identity.migrationId)
-                failure(identity, "migration_active");
-            return true;
-        }
-        const migrate = MigrateRequestSchema.parse(identity);
-        if (appliedMigrationIds.has(identity.migrationId))
-            return true;
-        let doctor = preflights.get(identity.migrationId);
-        if (doctor === undefined) {
-            const rebuilt = await runPreflight(identity, "preflight_rebuild_failed");
-            if (rebuilt === null)
-                return true;
-            doctor = rebuilt;
-        }
-        if (!doctor.applyAllowed || doctor.manifestDigest !== migrate.manifestDigest
-            || doctor.manifest.migrationId !== identity.migrationId
-            || doctor.environment !== environment || doctor.workspaceId !== workspaceId || doctor.profile !== profile) {
-            failure(identity, "preflight_digest_mismatch", undefined, true);
-            return true;
-        }
-        preflights.delete(identity.migrationId);
-        runningMigrationId = identity.migrationId;
-        try {
-            await input.runMigration(doctor, (status) => {
-                if (StatusSchema.safeParse(status).success)
-                    reportStatus(frame(identity, status));
-            });
-            appliedMigrationIds.add(identity.migrationId);
-        }
-        catch (error) {
-            failure(identity, stableErrorCode(error.code, "storage_migration_failed"), error);
-        }
-        finally {
-            runningMigrationId = null;
-        }
-        return true;
-    };
-    return Object.freeze({ handle });
-}