@nowcrew/daemon 0.6.88-beta.15 → 0.6.88-beta.17

package/README.md

@@ -3,6 +3,21 @@
 The daemon is NowWork's local execution adapter. It holds a machine credential, keeps one control-plane
 WebSocket open, and launches coding runtimes on that machine. Product policy remains on the server.
 
+## 已完成搬迁后的存储运行
+
+NAS / `NOWWORK_HOME` 搬迁和旧 daemon 布局标准化入口已退役。daemon 不再提供内部
+`storage-migration-worker` / `storage-migration-recover` 命令，不处理 `daemon:migrate`、
+`daemon:storage-doctor`、`daemon:storage-migrate` 或迁移确认消息，也不再声明
+`storage_migration_v1` / `storage_migration_status_v1` / `daemon_layout_migration_v1` 能力。
+
+现有 `installations.json` 即使仍有历史 `storageMigrationId`，也按当前 installation 解析
+Agent、仓库和报告目录；启动、hello 和身份绑定不再读取迁移 receipt、outbox 或备份。
+hello 继续报告布局、环境、Workspace、路径指纹与 ownership，但不再发送迁移 ID。
+每次连接仍须完成 Server 身份绑定后才能执行任务；Workspace 或 Machine 身份不匹配时拒绝执行。
+
+旧布局读取兼容、日常安装/升级、NAS 所有权校验、执行 journal 与 ACK/replay 继续保留。
+退役代码不会删除历史安装字段、迁移记录、receipt、备份或旧数据目录；这些数据的保留与清理另行处理。
+
 ## Run
 
 For a temporary foreground connection, run:

package/dist/daemon-update-eligibility.js

@@ -14,7 +14,7 @@ import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, man
 export async function managedDaemonCapabilities(eligibility) {
     try {
         return (await eligibility()).eligible
-            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1", "daemon_layout_migration_v1"]
+            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1"]
             : [];
     }
     catch {

package/dist/local-executor.js

@@ -1,3 +1,4 @@
+import { deepSeekHarnessLauncher } from "./runtimes/deepseek-harness.js";
 import { createInterface } from "node:readline";
 import { readFile, rm, writeFile } from "node:fs/promises";
 import { delimiter, join } from "node:path";
@@ -569,7 +570,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 });
             }
             const trainingRoots = input.trainingProjectContext?.projects.map((project) => project.root) ?? [];
-            const { codexSkillRoots, claudeAdditionalDirectories } = await projectSkillRuntimeDirectories({
+            const { codexSkillRoots, claudeAdditionalDirectories, harnessSkillRoots } = await projectSkillRuntimeDirectories({
                 runtime: runtime.name,
                 ...(runtimeRoot === undefined ? {} : { runtimeRoot }),
                 agentRoot: workspace.dir,
@@ -607,7 +608,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const workspaceRoots = [...legacyRoots, ...trainingRoots];
             const launchRequest = {
                 runtime: runtime.name,
-                bin: runtime.name === "deepseek-harness" ? "dsh-acp-demo" : runtime.name,
+                bin: runtime.name === "deepseek-harness" ? deepSeekHarnessLauncher(runtimeEnv).bin : runtime.name,
+                ...(runtime.name === "deepseek-harness" ? { harnessStateRoot: executionWorkspace.runDir, harnessSkillRoots: harnessSkillRoots ?? [] } : {}),
                 cwd: input.projectContext?.primary?.root ?? executionWorkspace.runDir,
                 ...(runtimeRoot !== undefined
                     || (input.projectSkills === undefined && input.abilityRelease === undefined)

package/dist/machine-info.js

@@ -2,6 +2,8 @@
  * 采集本机信息上报给控制面 (machine:hello):hostname / os / daemon 版本 / 已装 runtimes。
  * runtimes 探测靠 `which <bin>`(win32 用 `where`),只报真实可执行的 CLI(用于展示 Detected Runtimes)。
  */
+import { randomUUID } from "node:crypto";
+import { dslog } from "./slog.js";
 import { hostname, arch, platform as osPlatform } from "node:os";
 import { lookupCmd } from "./platform.js";
 import { augmentedPath } from "./runtime-path.js";
@@ -18,7 +20,7 @@ import { probeKimiAcp } from "./runtimes/kimi-acp-runner.js";
 import { probeHermesAcp } from "./runtimes/hermes.js";
 import { probeOpenCodeRun } from "./runtimes/opencode.js";
 import { RUNTIME_HEALTH_PROBE_CAPABILITY } from "./runtime-health.js";
-import { probeDeepSeekHarnessAcp } from "./runtimes/deepseek-harness.js";
+import { probeDeepSeekHarnessAcp, deepSeekHarnessLauncher } from "./runtimes/deepseek-harness.js";
 import { daemonHome } from "./computer-profile.js";
 import { daemonReleaseProvenance } from "./release-provenance.js";
 export { executableRuntimes } from "./runtime-capabilities.js";
@@ -90,7 +92,7 @@ const RUNTIME_BINS = [
     ["gemini", "gemini"],
     ["hermes", "hermes"],
     ["opencode", "opencode"],
-    ["deepseek-harness", "dsh-acp-demo"],
+    ["deepseek-harness", "dsh"],
     ["copilot", "copilot"],
     ["kimi", "kimi"],
     ["pi", "pi"],
@@ -107,29 +109,60 @@ async function isInstalled(bin) {
 }
 /** 并发探测所有候选 runtime,返回已安装的展示名列表。 */
 export async function detectRuntimes() {
-    const checks = await Promise.all(RUNTIME_BINS.map(async ([name, bin]) => ((await isInstalled(bin)) ? name : null)));
+    const checks = await Promise.all(RUNTIME_BINS.map(async ([name, bin]) => {
+        try {
+            return await isInstalled(name === "deepseek-harness" ? deepSeekHarnessLauncher().bin : bin) ? name : null;
+        }
+        catch {
+            return null;
+        }
+    }));
     return checks.filter((x) => x !== null);
 }
-async function supportsKimiAcp(signal) {
-    return probeKimiAcp({ bin: "kimi", ...(signal ? { signal } : {}) });
+async function supportsKimiAcp(signal, probeId) {
+    return probeKimiAcp({ bin: "kimi", ...(probeId ? { probeId } : {}), ...(signal ? { signal } : {}) });
 }
-async function supportsHermesAcp(signal) {
-    return probeHermesAcp({ bin: "hermes", ...(signal ? { signal } : {}) });
+async function supportsHermesAcp(signal, probeId) {
+    return probeHermesAcp({ bin: "hermes", ...(probeId ? { probeId } : {}), ...(signal ? { signal } : {}) });
 }
 async function supportsOpenCodeRun(signal) {
     return probeOpenCodeRun(signal);
 }
-async function supportsDeepSeekHarnessAcp(signal) {
-    return probeDeepSeekHarnessAcp({ bin: "dsh-acp-demo", ...(signal ? { signal } : {}) });
+async function supportsDeepSeekHarnessAcp(signal, probeId) {
+    try {
+        return await probeDeepSeekHarnessAcp({ bin: deepSeekHarnessLauncher().bin, ...(probeId ? { probeId } : {}), ...(signal ? { signal } : {}) });
+    }
+    catch {
+        return false;
+    }
 }
 /** Runtime adapters that can satisfy the durable protocol-v1 process contract. */
-export async function detectExecutionRuntimes(installed = detectRuntimes(), kimiAcpProbe = supportsKimiAcp, hermesAcpProbe = supportsHermesAcp, openCodeProbe = supportsOpenCodeRun, deepSeekHarnessProbe = supportsDeepSeekHarnessAcp, signal) {
+export async function detectExecutionRuntimes(installed = detectRuntimes(), kimiAcpProbe = supportsKimiAcp, hermesAcpProbe = supportsHermesAcp, openCodeProbe = supportsOpenCodeRun, deepSeekHarnessProbe = supportsDeepSeekHarnessAcp, signal, probeId = randomUUID()) {
     const present = await installed;
+    const probe = (runtime, detect) => {
+        const startedAt = Date.now();
+        dslog("runtime_probe.optional_start", "开始可选 runtime 探测", { probe_id: probeId, runtime, aborted: signal?.aborted ?? false });
+        const complete = (outcome, ready) => {
+            dslog("runtime_probe.optional_complete", "可选 runtime 探测结束", {
+                probe_id: probeId, runtime, outcome, duration_ms: Date.now() - startedAt,
+                aborted: signal?.aborted ?? false, ...(ready === undefined ? {} : { ready }),
+            });
+        };
+        let pending;
+        try {
+            pending = detect(signal, probeId);
+        }
+        catch (error) {
+            complete("threw");
+            throw error;
+        }
+        return pending.then((ready) => { complete("resolved", ready); return ready; }, (error) => { complete("threw"); throw error; });
+    };
     const [kimiReady, hermesReady, openCodeReady, deepSeekHarnessReady] = await Promise.all([
-        present.includes("kimi") ? kimiAcpProbe(signal) : false,
-        present.includes("hermes") ? hermesAcpProbe(signal) : false,
-        present.includes("opencode") ? openCodeProbe(signal) : false,
-        present.includes("deepseek-harness") ? deepSeekHarnessProbe(signal) : false,
+        present.includes("kimi") ? probe("kimi", kimiAcpProbe) : false,
+        present.includes("hermes") ? probe("hermes", hermesAcpProbe) : false,
+        present.includes("opencode") ? probe("opencode", openCodeProbe) : false,
+        present.includes("deepseek-harness") ? probe("deepseek-harness", deepSeekHarnessProbe) : false,
     ]);
     return executableRuntimes(present).filter((runtime) => (runtime === "kimi" ? kimiReady
         : runtime === "hermes" ? hermesReady
@@ -137,7 +170,7 @@ export async function detectExecutionRuntimes(installed = detectRuntimes(), kimi
                 : runtime === "deepseek-harness" ? deepSeekHarnessReady
                     : true));
 }
-export const detectExecutionRuntimesWithSignal = (installed, signal) => detectExecutionRuntimes(installed, supportsKimiAcp, supportsHermesAcp, supportsOpenCodeRun, supportsDeepSeekHarnessAcp, signal);
+export const detectExecutionRuntimesWithSignal = (installed, signal, probeId) => detectExecutionRuntimes(installed, supportsKimiAcp, supportsHermesAcp, supportsOpenCodeRun, supportsDeepSeekHarnessAcp, signal, probeId);
 export function daemonVersion() {
     try {
         const here = dirname(fileURLToPath(import.meta.url));

package/dist/main.js

@@ -7,7 +7,6 @@
  */
 import { parseArgs } from "node:util";
 import { homedir } from "node:os";
-import { join } from "node:path";
 import { loadConfig, ConfigError } from "./config.js";
 import { detectDaemonLang, formatDaemonText, translateDaemon } from "./i18n.js";
 import { cliVersion, daemonVersion } from "./machine-info.js";
@@ -25,19 +24,9 @@ import { assertManagedServiceStartup } from "./managed-service-startup.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
 import { createStorageRuntimeOwnershipBinding, loadStorageRuntime } from "./storage-runtime.js";
-import { readStorageMigrationReceipt } from "./storage-migration-controller.js";
-import { storageMigrationStatusReplay } from "./storage-status-replay.js";
-import { runStorageWorkerCommand } from "./storage-worker-command.js";
-import { probeStorageMigrationRuntime } from "./storage-runtime-readiness.js";
-import { createStorageTargetConfirmationHandler } from "./storage-target-confirmation.js";
 import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
 import { storageServiceEnvironment } from "./computer-service.js";
 async function main() {
-    const workerResult = await runStorageWorkerCommand(process.argv.slice(2));
-    if (workerResult !== null) {
-        process.exitCode = workerResult;
-        return;
-    }
     const computerResult = await runComputerCommand(process.argv.slice(2));
     if (computerResult !== null) {
         process.exitCode = computerResult;
@@ -74,7 +63,6 @@ async function main() {
     // 不把 machine token 放进 argv / plist / systemd unit / scheduled task。
     if (values["daemon-home"])
         process.env.CREW_DAEMON_HOME = values["daemon-home"];
-    let activeDaemonHome;
     const localHome = resolveDaemonLocalStateRoot({
         userHome: homedir(),
         platform: process.platform,
@@ -85,7 +73,6 @@ async function main() {
     });
     if (values.profile) {
         const home = daemonHome(process.env, values.profile);
-        activeDaemonHome = home;
         const profile = await loadProfile(values.profile, home);
         if (cmd === "serve") {
             await assertProfileAgentsRootUnique(profile, home, homedir());
@@ -148,68 +135,16 @@ async function main() {
         const installationLease = installation === null
             ? null
             : await acquireDaemonInstallationLease(installation.npmPrefix, { localHome });
-        const migrationRuntime = values.profile === undefined || activeDaemonHome === undefined || storageRuntime !== null
-            ? { ready: false, reason: "not_legacy_source" }
-            : await probeStorageMigrationRuntime({
-                profile: values.profile,
-                serverUrl: config.serverUrl,
-                currentDaemonHome: activeDaemonHome,
-                currentAgentsRoot: config.agentsRoot,
-                userHome: homedir(),
-                platform: process.platform,
-                ...(process.getuid === undefined ? {} : { uid: process.getuid() }),
-                environment: process.env,
-            });
-        const targetStorageBinding = storageRuntime === null
+        const storageBinding = storageRuntime === null
             ? null
             : createStorageRuntimeOwnershipBinding(storageRuntime);
-        const targetConfirmation = storageRuntime?.identity.storageMigrationId === undefined
-            ? null
-            : createStorageTargetConfirmationHandler({
-                backupsRoot: storageRuntime.local.backupsRoot,
-                identity: storageRuntime.identity,
-                profile: storageRuntime.installation.profile,
-                completionTimeoutMs: 180_000,
-            });
-        const storageMigration = storageRuntime !== null
-            ? {
-                ready: false,
-                statusOutboxPath: join(storageRuntime.local.stateRoot, "storage-status-outbox.json"),
-                identity: targetStorageBinding.identity,
-                bindServerIdentity: targetStorageBinding.bind,
-                ...(targetConfirmation === null ? {} : { confirm: targetConfirmation.handle }),
-                ...(storageRuntime.identity.storageMigrationId === undefined ? {} : {
-                    replayStatus: async (send) => {
-                        const migrationId = storageRuntime.identity.storageMigrationId;
-                        const receipt = await readStorageMigrationReceipt(storageRuntime.local.backupsRoot, migrationId);
-                        if (receipt === null)
-                            throw new Error(`storage migration receipt not found: ${migrationId}`);
-                        for (const frame of storageMigrationStatusReplay(receipt, {
-                            migrationId,
-                            environment: storageRuntime.identity.storageEnvironment,
-                            workspaceId: storageRuntime.identity.storageWorkspaceId,
-                            profile: storageRuntime.installation.profile,
-                        }))
-                            send(frame);
-                    },
-                }),
-            }
-            : migrationRuntime.ready
-                ? {
-                    ready: true,
-                    statusOutboxPath: migrationRuntime.runtime.statusOutboxPath,
-                    identity: migrationRuntime.runtime.identity,
-                    controller: migrationRuntime.runtime.controller,
-                    attach: migrationRuntime.runtime.attach,
-                    bindServerIdentity: migrationRuntime.runtime.bindServerIdentity,
-                    replayStatus: migrationRuntime.runtime.replayStatus,
-                }
-                : undefined;
         await runWithDaemonInstallationLease(installationLease, async () => {
             const service = serve(runtimeConfig, {
                 ...(values.profile === undefined ? {} : { profileName: values.profile }),
                 localHome,
-                ...(storageMigration === undefined ? {} : { storageMigration }),
+                ...(storageBinding === null ? {} : {
+                    storageRuntime: { identity: storageBinding.identity, bindServerIdentity: storageBinding.bind },
+                }),
             });
             await runServeLifecycle(service);
         });

package/dist/project-skills/execution-adapter.js

@@ -9,10 +9,11 @@ export function projectSkillExecutionProjection(bindings, generation) {
         });
 }
 /**
- * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时是 codex/claude 的执行
+ * 投影门控与 ownership 判定的唯一谓词:只有绑定了 Project Skills 且运行时支持受控目录的执行
  * 才会有投影目录,也才需要在停止无法证明时保留它。两处判定分开写过一次,结果 kimi + projectSkills
  * 会在取消路径上错抛 ownership 未确认。
  */
 export const projectSkillProjectionApplies = (spec) => spec.agent.projectSkills !== undefined
-    && (spec.runtime.name === "codex" || spec.runtime.name === "claude");
+    && (spec.runtime.name === "codex" || spec.runtime.name === "claude"
+        || spec.runtime.name === "deepseek-harness");
 export const projectSkillProjectionErrorCode = (error) => error instanceof ProjectProjectionError ? error.code : null;

package/dist/project-skills/runtime-launch.js

@@ -11,12 +11,26 @@ export function projectSkillRuntimeLaunchFacts(runtime, root) {
     if (runtime === "claude") {
         return Object.freeze({ claudeAdditionalDirectory: root.claudeAdditionalDirectory });
     }
+    if (runtime === "deepseek-harness") {
+        return Object.freeze({ harnessSkillRoot: root.codexSkillRoot });
+    }
     throw new ProjectProjectionError("skill_projection_failed");
 }
 /** Builds Runtime-native arrays while keeping v1 shared roots separate from v2 exact roots. */
 export async function projectSkillRuntimeDirectories(input) {
     const trainingProjectRoots = input.trainingProjectRoots ?? [];
     const facts = projectSkillRuntimeLaunchFacts(input.runtime, input.runtimeRoot);
+    if (input.runtime === "deepseek-harness") {
+        // Harness 的 local provider 接受直接包含 Skill 子目录的受控 root,不扫描项目/用户目录。
+        return Object.freeze({
+            codexSkillRoots: Object.freeze([]),
+            claudeAdditionalDirectories: Object.freeze([]),
+            harnessSkillRoots: Object.freeze([
+                ...(facts.harnessSkillRoot === undefined ? [] : [facts.harnessSkillRoot]),
+                ...(input.abilitySkillRoot === undefined ? [] : [input.abilitySkillRoot]),
+            ]),
+        });
+    }
     const codexSkillRoots = input.runtime === "codex"
         && (input.runtimeRoot !== undefined || input.projectContext !== undefined)
         ? Object.freeze([

package/dist/provider-env.js

@@ -10,7 +10,6 @@
  */
 import { join } from "node:path";
 import { DEEPSEEK_CODEX_KEY_ENV, deepSeekCodexHome, } from "./runtimes/codex-deepseek-config.js";
-import { DEEPSEEK_HARNESS_CONFIG_ENV } from "./runtimes/deepseek-harness.js";
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const RESERVED_ENV = new Set([
     "PATH",
@@ -96,9 +95,9 @@ export function applyProviderEnv(base, runtime, cfg, homeDir, deepSeekHomeOverri
     }
     return env;
 }
-const deepSeekHarnessMachineOwnedKey = (key) => (key.startsWith("DEEPSEEK_")
-    || key === DEEPSEEK_HARNESS_CONFIG_ENV
-    || key.startsWith("DSH_"));
+const deepSeekHarnessMachineOwnedKey = (key) => (key.toUpperCase().startsWith("DEEPSEEK_")
+    || key.toUpperCase().startsWith("NOWCREW_DEEPSEEK_HARNESS_")
+    || key.toUpperCase().startsWith("DSH_"));
 /** Agent env remains available to tools, but cannot replace Harness process policy or credentials. */
 export function applyDeepSeekHarnessMachineEnv(base, machineEnv) {
     const env = { ...base };

package/dist/runtime-probe.js

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+import { dslog } from "./slog.js";
 import { executableRuntimes } from "./runtime-capabilities.js";
 export function conservativeExecutionRuntimes(installed) {
     return executableRuntimes(installed)
@@ -7,16 +9,43 @@ export function createRuntimeProbeCoordinator() {
     const abort = new AbortController();
     const flights = new Map();
     return {
-        detect(installed, detector) {
+        detect(installed, detector, connectionId) {
             const key = [...installed].sort().join("\0");
             const existing = flights.get(key);
-            if (existing)
-                return existing;
-            const pending = detector(installed, abort.signal).catch((error) => {
+            const probeId = existing?.probeId ?? randomUUID();
+            const fields = { probe_id: probeId, connection_id: connectionId, installed_runtimes: JSON.stringify(installed) };
+            dslog("runtime_probe.request", "请求 runtime 执行能力探测", fields);
+            if (existing) {
+                dslog("runtime_probe.cache_hit", "复用 runtime 探测结果", { ...fields, cache_state: existing.state });
+                return existing.promise;
+            }
+            const startedAt = Date.now();
+            const complete = (outcome, executionRuntimes) => {
+                dslog("runtime_probe.complete", "runtime 探测聚合结束", {
+                    ...fields, outcome, duration_ms: Date.now() - startedAt, aborted: abort.signal.aborted,
+                    ...(executionRuntimes === undefined ? {} : { execution_runtimes: JSON.stringify(executionRuntimes) }),
+                });
+            };
+            let detection;
+            try {
+                detection = detector(installed, abort.signal, probeId);
+            }
+            catch (error) {
+                complete("threw");
+                throw error;
+            }
+            const pending = detection.then((result) => {
+                const flight = flights.get(key);
+                if (flight)
+                    flights.set(key, { ...flight, state: "resolved" });
+                complete("resolved", result);
+                return result;
+            }, (error) => {
                 flights.delete(key);
+                complete("threw");
                 throw error;
             });
-            flights.set(key, pending);
+            flights.set(key, { promise: pending, probeId, state: "pending" });
             return pending;
         },
         stop() {

package/dist/runtimes/deepseek-harness-profile.js

@@ -0,0 +1,92 @@
+/** 短命执行配置:不读取全局 Harness home,不新增 daemon 状态。 */
+import { mkdtemp, mkdir, writeFile, access } from "node:fs/promises";
+import { join, isAbsolute } from "node:path";
+import { stringify } from "yaml";
+export const harnessPermissionMode = (permission) => permission === "sandboxed"
+    ? "read-only"
+    : permission === "workspace_write"
+        ? "workspace-write"
+        : "danger-full-access";
+// A variable's returned value is interpolated once: literal {{...}} in NowWork
+// instructions must not become unknown Harness template variables.
+const instructionsPlugin = `export const name = 'nowwork-instructions';
+export const inject = ['systemPrompt'];
+export function apply(ctx, config) {
+  ctx.systemPrompt.variable('nowwork_instructions', () => config.text);
+  ctx.systemPrompt.section({name: 'nowwork-instructions', order: 100000, text: '{{nowwork_instructions}}'});
+}
+`;
+export async function prepareHarnessProfile(input) {
+    if (![input.stateRoot, input.cwd, ...input.skillRoots].every(isAbsolute)) {
+        throw new Error("DeepSeek Harness execution paths must be absolute");
+    }
+    if (input.patchPath !== undefined) {
+        if (!isAbsolute(input.patchPath))
+            throw new Error("DeepSeek Harness patch must be absolute");
+        await access(input.patchPath);
+    }
+    await mkdir(input.stateRoot, { recursive: true, mode: 0o700 });
+    const home = await mkdtemp(join(input.stateRoot, ".deepseek-harness-"));
+    const pluginPath = join(home, "nowwork-instructions.mjs");
+    const policyPath = join(home, "nowwork-policy.yml");
+    const mode = harnessPermissionMode(input.effectivePermission);
+    await writeFile(pluginPath, instructionsPlugin, { mode: 0o600 });
+    await writeFile(policyPath, stringify([
+        {
+            id: "sandbox-policy",
+            disabled: false,
+            config: { mode, workspaceRoot: input.cwd },
+        },
+        { id: "approval", disabled: false, config: { policy: "never" } },
+        {
+            id: "permission",
+            disabled: false,
+            config: {
+                defaultPreset: "nowwork",
+                presets: { nowwork: { sandbox: mode, approval: "never" } },
+            },
+        },
+        {
+            id: "skill-filesystem",
+            disabled: false,
+            config: {
+                includeDefaultRoots: false,
+                customSkillDirs: [...input.skillRoots],
+                watch: false,
+            },
+        },
+        {
+            id: "session-persistence-jsonl",
+            disabled: false,
+            config: { root: join(home, "sessions") },
+        },
+        {
+            insert: [
+                {
+                    id: "nowwork-instructions",
+                    name: pluginPath,
+                    config: { text: input.systemPrompt },
+                },
+            ],
+        },
+    ]), { mode: 0o600 });
+    const env = Object.fromEntries(Object.entries(input.env).filter(([key]) => !key.toUpperCase().startsWith("DSH_")));
+    return {
+        home,
+        policyPath,
+        args: [
+            "--profile",
+            "acp",
+            ...(input.patchPath ? ["--patch", input.patchPath] : []),
+            "--patch",
+            policyPath,
+        ],
+        env: {
+            ...env,
+            DSH_HOME: home,
+            DSH_AGENTS_HOME: join(home, "agents-home"),
+            DSH_PERMISSION_MODE: mode,
+            DSH_TELEMETRY_DISABLED: "1",
+        },
+    };
+}