@nowcrew/daemon 0.6.88-beta.2 → 0.6.88-beta.20

package/README.md

@@ -3,6 +3,21 @@
 The daemon is NowWork's local execution adapter. It holds a machine credential, keeps one control-plane
 WebSocket open, and launches coding runtimes on that machine. Product policy remains on the server.
 
+## 已完成搬迁后的存储运行
+
+NAS / `NOWWORK_HOME` 搬迁和旧 daemon 布局标准化入口已退役。daemon 不再提供内部
+`storage-migration-worker` / `storage-migration-recover` 命令，不处理 `daemon:migrate`、
+`daemon:storage-doctor`、`daemon:storage-migrate` 或迁移确认消息，也不再声明
+`storage_migration_v1` / `storage_migration_status_v1` / `daemon_layout_migration_v1` 能力。
+
+现有 `installations.json` 即使仍有历史 `storageMigrationId`，也按当前 installation 解析
+Agent、仓库和报告目录；启动、hello 和身份绑定不再读取迁移 receipt、outbox 或备份。
+hello 继续报告布局、环境、Workspace、路径指纹与 ownership，但不再发送迁移 ID。
+每次连接仍须完成 Server 身份绑定后才能执行任务；Workspace 或 Machine 身份不匹配时拒绝执行。
+
+旧布局读取兼容、日常安装/升级、NAS 所有权校验、执行 journal 与 ACK/replay 继续保留。
+退役代码不会删除历史安装字段、迁移记录、receipt、备份或旧数据目录；这些数据的保留与清理另行处理。
+
 ## Run
 
 For a temporary foreground connection, run:
@@ -242,26 +257,26 @@ The stable adapters keep prompts out of provider argv wherever the provider prot
 
 | Runtime | Transport | System/wake input | Native resume |
 | --- | --- | --- | --- |
-| Claude | stream-json CLI | daemon-owned system prompt file | CLI session id |
-| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume` |
-| Kimi | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| Hermes | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| OpenCode | `run --format json` | stdin | `--session` |
+| Claude | stream-json CLI | daemon-owned system prompt file + user input | CLI session id; thread-bound: matching native SessionStart proof + SDK initialization |
+| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume`; thread-bound: returned id must match |
+| Kimi | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| Hermes | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| OpenCode | `run --format json` | stdin | unbound: `--session`; thread-bound: cold |
 | DeepSeek Harness | ACP over stdio | `session/prompt` | none (fresh session per execution) |
 
 Kimi ACP currently requires a Kimi account even when the CLI has a working custom provider. Only for
 the explicit `Authentication required` response, the adapter retries once through Kimi's stream-json
-CLI and carries the same native session id; unrelated ACP failures stay failures. The CLI fallback is
+CLI; only unbound executions can carry a saved native session id. Unrelated ACP failures stay failures. The CLI fallback is
 subject to the Windows UTF-16 argv guard, while protocol-v1 itself remains disabled on Windows until
 durable Job Object ownership is available.
 
 Hermes uses only ACP capabilities advertised by the installed CLI. Model and effort choices come from
 a short-lived discovery session; credentials, provider profiles, plugins, and `HERMES_HOME` remain
-machine-local. A missing resumed ACP session is retried once as a fresh session.
+machine-local. For unbound executions, a missing resumed ACP session is retried once as a fresh session.
 
 OpenCode receives the prompt through stdin and runs with both cwd and `PWD` anchored to the Agent
 workspace. Models and variants come from `opencode models --verbose` (with the plain catalog as a
-compatibility fallback). A missing resumed session is retried once without `--session`; malformed,
+compatibility fallback). For unbound executions, a missing resumed session is retried once without `--session`; malformed,
 empty, incomplete, or explicitly failed JSON streams remain failures. NowWork never writes
 `opencode.json` or replaces `OPENCODE_CONFIG_CONTENT`. The daemon advertises OpenCode as executable
 only when `opencode run --help` exposes `--format`, `--dangerously-skip-permissions`, `--dir`,
@@ -291,8 +306,12 @@ uses fresh sessions and committed text; it does not claim resume, images, MCP, r
 or transcript support. Agent environment variables cannot override `DEEPSEEK_*`, `DSH_*`, or
 `NOWCREW_DEEPSEEK_HARNESS_CONFIG`; those values always come from the daemon service environment.
 
-Codex, Kimi, Hermes, and OpenCode sessions use the same bounded per-task persistence and keyed lease as Claude when they
-run through protocol v1. A first-progress watchdog covers a provider that accepts a turn but remains
+Unbound Codex, Kimi, Hermes, and OpenCode sessions retain the same configured warm/budget policy and keyed
+lease as Claude through protocol v1. Thread-bound Claude/Codex sessions keep their native session across
+warm-cache expiry, token estimates, and turn counts; verified restoration receives only accepted-cursor
+deltas. New sessions and runtimes without verified restoration receive complete current-thread history
+before the business turn. See the [thread context contract](../docs/thread-scoped-native-context.md).
+A first-progress watchdog covers a provider that accepts a turn but remains
 semantically silent; after the first semantic event, the execution's configured total timeout remains
 authoritative so a legitimate long-running tool is not killed for quiet output.
 DeepSeek Harness is execution-v1-only and intentionally skips native session persistence.
@@ -354,6 +373,15 @@ Runtime launch, which recovers from a missed notification or daemon restart. Ski
 are visible through the symlink immediately; adding, deleting, renaming, or changing frontmatter requires
 a rescan. Web descriptions remain at the last inventory value until that rescan.
 
+## 目录投影测试的平台范围
+
+`test/directory-projection.test.ts` 在所有平台运行，覆盖路径检查、复制发布、只读权限请求及失败恢复。
+其受控文件系统夹具记录目录 `chmod` 请求，但保留宿主目录的写权限，避免把 macOS 的目录重命名规则当作 Windows 行为。
+生产代码的只读保护不受此夹具影响。
+
+`test/directory-projection.windows.test.ts` 仅在 Windows 上运行，使用真实文件系统验证只读目录发布与文件保护。
+非 Windows 的全量测试会明确跳过该文件，不能据此宣称 Windows 原生行为已验证。
+
 ## Reliability
 
 Protocol-v1 lifecycle is `accepted → started → completed`, followed by a server

package/dist/agent-memory/policy.js

@@ -17,7 +17,9 @@ function truncateUtf8(value, maxBytes) {
     return output;
 }
 export function extractIncomingMessage(wakePrompt) {
-    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew)|$)/su);
+    // Keep legacy wake delimiters while accepting program-delivered-context prompts.
+    // Stop before policy/history blocks; neither is the current user's message.
+    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew|Work directly from this thread's context|直接依据程序交付的本线程上下文|No thread anchor:|没有线程锚点[，,])|$)/su);
     const content = match?.[1]?.trim();
     return content ? content : null;
 }

package/dist/daemon-update-eligibility.js

@@ -14,7 +14,7 @@ import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, man
 export async function managedDaemonCapabilities(eligibility) {
     try {
         return (await eligibility()).eligible
-            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1", "daemon_layout_migration_v1"]
+            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1"]
             : [];
     }
     catch {

package/dist/execution-journal.js

@@ -878,23 +878,26 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         },
         acknowledgeCompletion: async (executionId) => {
             validateExecutionId(executionId);
-            const updated = await serializedExecution(executionId, "acknowledge_completion", async () => {
+            const result = await serializedExecution(executionId, "acknowledge_completion", async () => {
                 const entry = await requireRecord(executionId);
                 if (entry.state !== "completed" && entry.state !== "interrupted") {
                     throw new JournalTransitionError(`Cannot acknowledge ${entry.state} execution`);
                 }
-                if (entry.completionAcknowledged)
-                    return confirmDurable(entry);
+                if (entry.completionAcknowledged) {
+                    return { entry: await confirmDurable(entry), newlyAcknowledged: false };
+                }
                 const updated = JournalEntrySchema.parse({
                     ...entry,
                     completionAcknowledged: true,
                     updatedAt: now().toISOString(),
                 });
                 await writeRecord(updated);
-                return updated;
+                return { entry: updated, newlyAcknowledged: true };
             });
-            await serializedDirectory(pruneInternal);
-            return updated;
+            // 重复 ACK 仍确认持久化，但不能反复全目录清理并阻塞后续控制帧。
+            if (result.newlyAcknowledged)
+                await serializedDirectory(pruneInternal);
+            return result.entry;
         },
         get: async (executionId) => {
             validateExecutionId(executionId);

package/dist/execution-protocol.js

@@ -200,7 +200,7 @@ export const ExecutionStartSchema = z.object({
         language: z.enum(["zh", "en"]),
         systemPrompt: z.string(),
         wakePrompt: z.string(),
-        maintenancePurpose: z.literal("self_training").optional(),
+        maintenancePurpose: z.enum(["self_training", "memory_prune"]).optional(),
     }).strict(),
     runtime: z.object({
         name: RuntimeSchema,
@@ -264,6 +264,7 @@ export const ExecutionRejectedSchema = z.object({
     reason: RejectionReasonSchema,
     message: z.string().optional(),
     at: TimestampSchema,
+    preAdmissionProof: z.object({ specHash: z.string().regex(/^[a-f0-9]{64}$/u) }).strict().optional(),
 }).strict();
 export const ExecutionStartedSchema = z.object({
     type: z.literal("execution:started"),

package/dist/execution-runner.js

@@ -408,7 +408,8 @@ export async function runExecution(config, input, dependencies) {
         ? { permission: effectivePermission(spec, config) }
         : admission(spec, config, dependencies, initialAt);
     if ("rejected" in checked) {
-        const frame = ExecutionRejectedSchema.parse(boundExecutionFrame(checked.rejected, config.executionLimits.maxEventBytes));
+        const proof = await dependencies.confirmPreAdmission?.(checked.rejected).catch(() => false);
+        const frame = ExecutionRejectedSchema.parse(boundExecutionFrame({ ...checked.rejected, ...(proof ? { preAdmissionProof: { specHash } } : {}) }, config.executionLimits.maxEventBytes));
         await dependencies.report(frame);
         return { kind: "rejected", frame };
     }
@@ -844,6 +845,7 @@ export async function runExecution(config, input, dependencies) {
             executionId: spec.executionId,
             handle: spec.agent.handle,
             channelId: spec.context.channelId,
+            ...(spec.context.threadId === undefined ? {} : { threadId: spec.context.threadId }),
             keyMode: "opaque",
             taskKey: spec.workspace.taskKey,
             ...(spec.workspace.resumeKey === undefined ? {} : { resumeKey: spec.workspace.resumeKey }),
@@ -885,13 +887,13 @@ export async function runExecution(config, input, dependencies) {
                 } : {}),
             },
             session: {
-                enabled: selfTraining ? false : config.resume,
+                enabled: spec.instructions.maintenancePurpose !== undefined ? false : config.resume,
                 warmMs: config.resumeWarmMs,
                 budgetTokens: config.sessionBudgetTokens,
                 softTokens: config.sessionSoftTokens,
                 maxTurns: config.sessionMaxTurns,
             },
-            ...(selfTraining ? { maintenancePurpose: "self_training" } : {}),
+            ...(spec.instructions.maintenancePurpose === undefined ? {} : { maintenancePurpose: spec.instructions.maintenancePurpose }),
             localMemoryV2Enabled,
         };
         const result = await Promise.race([

package/dist/list-models.js

@@ -1,6 +1,7 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { isWin } from "./platform.js";
+import { augmentedPath } from "./runtime-path.js";
 import { listClaudeModels } from "./runtimes/claude-models.js";
 import { listHermesModels } from "./runtimes/hermes-models.js";
 const execFileRaw = promisify(execFile);
@@ -8,6 +9,7 @@ const MODEL_PROBE_TIMEOUT_MS = 8_000;
 const MODEL_PROBE_MAX_BUFFER_BYTES = 1024 * 1024;
 // win32 上 npm CLI 是 .cmd shim,execFile 需 shell 才能执行;参数全是固定字面量,无注入面。
 const execFileP = (bin, args) => execFileRaw(bin, args, {
+    env: { ...process.env, PATH: augmentedPath() },
     shell: isWin(),
     timeout: MODEL_PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL",

package/dist/local-execution-lease.js

@@ -0,0 +1,22 @@
+import { awaitWithCancellation } from "./runtime-cancellation.js";
+const leaseTails = new Map();
+/** 同一进程内的短操作或原生会话排队；等待取消也不会越过前一位持有者。 */
+export async function withKeyedLease(key, operation, cancellation) {
+    const predecessor = leaseTails.get(key) ?? Promise.resolve();
+    // 解锁函数在等待 predecessor 前可用，保留取消等待时的队列顺序。
+    let unlock;
+    const current = new Promise(resolve => { unlock = resolve; });
+    const queued = predecessor.then(() => current);
+    leaseTails.set(key, queued);
+    try {
+        await awaitWithCancellation(predecessor, cancellation);
+        return await operation();
+    }
+    finally {
+        unlock();
+        void queued.then(() => {
+            if (leaseTails.get(key) === queued)
+                leaseTails.delete(key);
+        });
+    }
+}

package/dist/local-executor.js

@@ -1,3 +1,4 @@
+import { deepSeekHarnessLauncher } from "./runtimes/deepseek-harness.js";
 import { createInterface } from "node:readline";
 import { readFile, rm, writeFile } from "node:fs/promises";
 import { delimiter, join } from "node:path";
@@ -15,6 +16,11 @@ import { deliverCloudReports, prepareCloudReportExecution } from "./cloud-report
 import { reportDeliveryContext } from "./cloud-report-receipt.js";
 import { extractFinalText, extractRunMeta, normalizeEvent, parseLine, } from "./normalize.js";
 import { readSession, writeSession, pickResumeId, isNearBudget } from "./session.js";
+import { NativeThreadContext, isolateMaintenanceSession } from "./native-thread-context.js";
+import { prepareThreadDelivery } from "./thread-input-delivery.js";
+import { resolveMemoryPruneWorkLog, workLogSha256 } from "./local-memory/work-log.js";
+import { withKeyedLease } from "./local-execution-lease.js";
+import { withWorkLogExecution, withWorkLogCommit, workLogExecutionKey } from "./local-memory/work-log-execution.js";
 import { providerErrorFromExit } from "./provider-error.js";
 import { createConsoleFormatter } from "./console-formatter.js";
 import { withLocalExecutionFacts, } from "./local-execution-prompt.js";
@@ -108,6 +114,9 @@ async function launchLegacyRuntime(request) {
     if (request.runtime === "deepseek-harness") {
         throw new Error("DeepSeek Harness requires execution protocol v1");
     }
+    if (request.runtime !== "claude")
+        request = { ...request, wakePrompt: (await prepareThreadDelivery({ env: request.env,
+                resumed: false, sessionId: "unverified-cold-legacy", wakePrompt: request.wakePrompt })).prompt };
     const common = {
         bin: request.bin,
         cwd: request.cwd,
@@ -154,27 +163,12 @@ async function launchLegacyRuntime(request) {
 function resolvePrompt(prompt, context) {
     return typeof prompt === "string" ? prompt : prompt(context);
 }
-const nativeSessionLeaseTails = new Map();
 const activeMemoryPrunes = new Map();
-async function withKeyedLease(key, operation, cancellation) {
-    const predecessor = nativeSessionLeaseTails.get(key) ?? Promise.resolve();
-    let release;
-    const current = new Promise((resolve) => { release = resolve; });
-    const tail = predecessor.then(() => current);
-    nativeSessionLeaseTails.set(key, tail);
-    try {
-        await awaitWithCancellation(predecessor, cancellation);
-        return await operation();
-    }
-    finally {
-        release();
-        void tail.then(() => {
-            if (nativeSessionLeaseTails.get(key) === tail)
-                nativeSessionLeaseTails.delete(key);
-        });
-    }
-}
 export async function executeLocal(input, callbacks = {}, dependencies = {}) {
+    input = isolateMaintenanceSession(input);
+    return withWorkLogExecution(workLogExecutionKey(input.launch.agentsRoot, input.handle, input.taskKey), () => executeLocalWithSession(input, callbacks, dependencies), dependencies.cancellation);
+}
+async function executeLocalWithSession(input, callbacks, dependencies) {
     const versionedProjectSkills = input.projectSkills !== undefined
         && !Array.isArray(input.projectSkills);
     if (versionedProjectSkills && (input.runtime.name !== "codex" && input.runtime.name !== "claude")) {
@@ -255,6 +249,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     let localMemoryResultPath = null;
     let executionWorkspace = workspace;
     let localMemoryTelemetry = null;
+    let nativeThreadContext = null;
     const inheritedEnv = { ...process.env };
     const reportRoots = {
         root: workspace.dir,
@@ -294,12 +289,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             : null;
         const currentPrior = storedCurrentPrior !== null
             && storedCurrentPrior.sessionContextFingerprint === input.sessionContextFingerprint
+            && storedCurrentPrior.runtime === runtime.name
+            && storedCurrentPrior.threadRoot === input.resumeKey
             ? storedCurrentPrior
             : null;
-        // Interactive V1 uses collision-resistant session directories, while the
-        // older legacy path stored metadata under tasks/<safe thread key>. Import
-        // that metadata once so an existing thread can cross the protocol boundary
-        // without losing its native runtime conversation.
+        // Import compatible legacy metadata across the protocol boundary.
         const legacyRunDir = input.session.enabled
             && supportsNativeResume
             && input.keyMode === "opaque"
@@ -315,7 +309,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const legacyPrior = legacyRunDir === null || (currentPrior !== null && !legacyCwdPinned)
             ? null
             : await readSession(legacyRunDir);
-        const prior = currentPrior ?? legacyPrior;
+        const compatibleLegacyPrior = legacyPrior?.runtime === runtime.name && legacyPrior?.threadRoot === input.resumeKey
+            ? legacyPrior : null;
+        const prior = currentPrior ?? compatibleLegacyPrior;
         const sessionExists = workspace.sessionResume || legacyPrior !== null;
         const usesLegacyCwd = legacyRunDir !== null
             && (legacyCwdPinned || (currentPrior === null && legacyPrior !== null));
@@ -336,11 +332,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ? prior?.model ?? currentModel
             : currentModel;
         const resumeSessionId = supportsNativeResume && sessionExists
-            ? pickResumeId(prior, Date.now(), input.session.warmMs, resumeComparisonModel, input.session.budgetTokens, input.session.maxTurns, providerFp)
+            ? pickResumeId(input.resumeKey && (!Number.isSafeInteger(prior?.threadContextSeq) || prior?.threadHistoryComplete !== true) ? null : prior, Date.now(), input.resumeKey ? 0 : input.session.warmMs, resumeComparisonModel, input.resumeKey ? 0 : input.session.budgetTokens, input.resumeKey ? 0 : input.session.maxTurns, providerFp)
             : null;
         const resuming = resumeSessionId !== null;
         const rotatedForBudget = !resuming && supportsNativeResume && sessionExists
-            && pickResumeId(prior, Date.now(), input.session.warmMs, resumeComparisonModel, 0, 0, providerFp) !== null;
+            && pickResumeId(prior, Date.now(), input.resumeKey ? 0 : input.session.warmMs, resumeComparisonModel, 0, 0, providerFp) !== null;
         const nearBudget = resuming && isNearBudget(prior, input.session.softTokens);
         const rotated = Boolean(workspace.agentSessionId && sessionExists && !resuming);
         // Codex and Kimi choose their own id on a fresh start, so the native id persisted in
@@ -349,7 +345,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ? await rotateAgentSession(workspace.sessionDir)
             : workspace.agentSessionId);
         await materializePrivateCodexHome({ runtime: runtime.name, homeDir: workspace.homeDir, ...(input.launch.codexHomeMode === undefined ? {} : { mode: input.launch.codexHomeMode }), ...(sourceCodexHome === undefined ? {} : { sourceHome: sourceCodexHome }), ...(launchSessionId === undefined ? {} : { sessionId: launchSessionId }), ...(dependencies.cancellation === undefined ? {} : { cancellation: dependencies.cancellation }), ...(dependencies.materializeDefaultCodexHome === undefined ? {} : { materialize: dependencies.materializeDefaultCodexHome }) });
-        const promptContext = {
+        let promptContext = {
             workspace: executionWorkspace,
             resuming,
             rotatedForBudget,
@@ -388,8 +384,13 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             }
         }
         const attachmentPlan = routeRuntimeAttachments(runtime.name, materialized?.attachments ?? []);
-        const wakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
-        memoryPruneTraceId = parseMemoryPruneTraceId(wakePrompt);
+        let baseWakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
+        memoryPruneTraceId = parseMemoryPruneTraceId(baseWakePrompt);
+        if (memoryPruneTraceId !== null) {
+            executionWorkspace = await resolveMemoryPruneWorkLog(executionWorkspace, input);
+            promptContext = { ...promptContext, workspace: executionWorkspace };
+            baseWakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
+        }
         if (input.localMemoryV2Enabled === true && memoryPruneTraceId !== null
             && isLocalMemoryV2Eligible({
                 enabledForHandle: true,
@@ -402,12 +403,13 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         const memoryPrompt = await prepareLocalMemoryPrompt({
             agentDir: executionWorkspace.dir, executionId: input.executionId, agentHandle: input.handle,
-            enabled: input.localMemoryV2Enabled === true, query: wakePrompt,
+            enabled: input.localMemoryV2Enabled === true, query: baseWakePrompt,
             resultPath: localMemoryResultPath, maxBytes: input.maxSystemPromptBytes,
             renderBase: (reservedPromptBytes) => resolvePrompt(input.systemPrompt, { ...promptContext, reservedPromptBytes }),
         });
         localMemoryResultPath = memoryPrompt.resultPath;
         const systemPrompt = memoryPrompt.systemPrompt;
+        const wakePrompt = baseWakePrompt + memoryPrompt.wakePromptSuffix;
         if (!isolatedMaintenance)
             try {
                 localMemoryTelemetry = createLocalMemoryTelemetry({
@@ -466,6 +468,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         memoryPruneFailurePhase = "runtime_prepare";
         const crewHome = isolatedMaintenance ? executionWorkspace.runDir : workspace.dir;
+        const contextThreadId = input.threadId ?? input.resumeKey;
+        if (contextThreadId && input.maintenancePurpose === undefined) {
+            nativeThreadContext = new NativeThreadContext(join(executionWorkspace.runDir, `.crew-context-${input.executionId}.json`), contextThreadId, runtime.name, resumeSessionId, prior);
+            await nativeThreadContext.initialize();
+        }
         const baseEnv = {
             ...inheritedEnv,
             ...sanitizeEnvVars(providerConfig.envVars),
@@ -478,6 +485,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             CREW_TOKEN: input.launch.token,
             CREW_CHANNEL: input.channelId,
             CREW_HOME: crewHome,
+            // Empty values override any stale inherited hints from an enclosing runtime.
+            CREW_THREAD_ROOT: contextThreadId ?? "",
+            CREW_THREAD_CONTEXT_FILE: nativeThreadContext?.path ?? "",
             // Keep the daemon-selected storage root authoritative for runtimes.
             // In profile-backed NowWork sessions the daemon config may differ from
             // the daemon process environment, so inheriting CREW_AGENTS_ROOT is not
@@ -525,7 +535,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const effectiveSystemPrompt = abilityContext === undefined
                 ? systemPrompt
                 : `${systemPrompt}\n\n${abilityContext.prompt}`;
-            if (Buffer.byteLength(effectiveSystemPrompt, "utf8") > (input.maxSystemPromptBytes ?? Number.MAX_SAFE_INTEGER)) {
+            if (Buffer.byteLength(effectiveSystemPrompt, "utf8") + Buffer.byteLength(memoryPrompt.wakePromptSuffix, "utf8")
+                > (input.maxSystemPromptBytes ?? Number.MAX_SAFE_INTEGER)) {
                 throw new Error("ability_runtime_context_size_exceeded");
             }
             memoryPruneFailurePhase = "prompt_write";
@@ -559,7 +570,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 });
             }
             const trainingRoots = input.trainingProjectContext?.projects.map((project) => project.root) ?? [];
-            const { codexSkillRoots, claudeAdditionalDirectories } = await projectSkillRuntimeDirectories({
+            const { codexSkillRoots, claudeAdditionalDirectories, harnessSkillRoots } = await projectSkillRuntimeDirectories({
                 runtime: runtime.name,
                 ...(runtimeRoot === undefined ? {} : { runtimeRoot }),
                 agentRoot: workspace.dir,
@@ -597,7 +608,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const workspaceRoots = [...legacyRoots, ...trainingRoots];
             const launchRequest = {
                 runtime: runtime.name,
-                bin: runtime.name === "deepseek-harness" ? "dsh-acp-demo" : runtime.name,
+                bin: runtime.name === "deepseek-harness" ? deepSeekHarnessLauncher(runtimeEnv).bin : runtime.name,
+                ...(runtime.name === "deepseek-harness" ? { harnessStateRoot: executionWorkspace.runDir, harnessSkillRoots: harnessSkillRoots ?? [] } : {}),
                 cwd: input.projectContext?.primary?.root ?? executionWorkspace.runDir,
                 ...(runtimeRoot !== undefined
                     || (input.projectSkills === undefined && input.abilityRelease === undefined)
@@ -801,6 +813,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const event = parseLine(line);
             if (!event)
                 return;
+            nativeThreadContext?.observe(event);
             localMemoryTelemetry?.observe(event);
             if (isRuntimeReadyEvent(runtime.name, event))
                 markRuntimeReady();
@@ -918,14 +931,17 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         memoryPruneRuntimeExitCode = exitCode;
         if (localMemoryResultPath !== null) {
             memoryPruneFailurePhase = "memory_commit";
-            const committed = await commitLocalMemoryResultAfterExit({
-                resultPath: localMemoryResultPath,
+            const resultPath = localMemoryResultPath;
+            const commit = () => commitLocalMemoryResultAfterExit({
+                resultPath,
                 agentDir: executionWorkspace.dir,
                 executionId: input.executionId,
                 pruneTraceId: memoryPruneTraceId,
                 exitCode,
                 workLogPath: executionWorkspace.workLogPath,
+                expectedWorkLogSha256: workLogSha256(executionWorkspace.workLog),
             });
+            const committed = exitCode !== 0 ? await commit() : await withWorkLogCommit(workLogExecutionKey(input.launch.agentsRoot, input.handle, input.taskKey), commit, dependencies.cancellation);
             if (committed.status === "failed" || committed.status === "missing") {
                 const reason = committed.error ?? "local_memory_result_missing";
                 dslog("local_memory.commit_failed", "结构化本地记忆提交或清理未完成，保留可用恢复材料", {
@@ -959,9 +975,12 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 ? usage.inputTokens + usage.cacheReadTokens + usage.cacheCreationTokens
                 : (resuming ? prior?.contextTokens : undefined);
             await writeSession(workspace.sessionDir, {
+                runtime: runtime.name,
+                ...(input.resumeKey === undefined ? {} : { threadRoot: input.resumeKey }),
+                ...(exitCode === 0 ? await nativeThreadContext?.checkpoint() ?? {} : {}),
                 sessionId,
                 lastRunAt: Date.now(),
-                turns: resuming ? (prior?.turns ?? 0) + 1 : 1,
+                turns: nativeThreadContext?.confirmed ? (prior?.turns ?? 0) + 1 : 1,
                 model: currentModel,
                 providerFingerprint: providerFp,
                 ...(input.sessionContextFingerprint === undefined
@@ -995,7 +1014,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ...(usage === undefined ? {} : { usage }),
             model: observedModel,
             runtime: runtime.name,
-            resumed: resuming,
+            resumed: nativeThreadContext?.confirmed ?? false,
             sessionId,
             errorMessage: errorTail || null,
             ...(providerError === undefined ? {} : { providerError }),
@@ -1007,6 +1026,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         };
     }
     finally {
+        await nativeThreadContext?.cleanup().catch(() => undefined);
         startupReservationState.current?.release();
         try {
             await localMemoryTelemetry?.finish();

package/dist/local-memory/candidate.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+import { containsLikelySecret } from "../agent-memory/policy.js";
+const CategorySchema = z.enum([
+    "preferences", "project-rules", "testing", "debugging", "git", "incidents", "lessons",
+]);
+export const LocalMemorySingleLineText = z.string().trim().min(1).max(500).regex(/^[^\r\n]+$/u);
+export const LocalMemoryChangeSchema = z.object({
+    operation: z.enum(["create", "update", "supersede"]),
+    memoryId: LocalMemorySingleLineText.regex(/^[^<>]+$/u).nullable(),
+    baseRevision: z.number().int().nonnegative().nullable(),
+    supersedesMemoryId: LocalMemorySingleLineText.regex(/^[^<>]+$/u).nullable(),
+    title: LocalMemorySingleLineText.max(120),
+    kind: z.enum(["procedural", "semantic", "episodic", "preference"]),
+    summary: LocalMemorySingleLineText,
+    triggers: z.array(LocalMemorySingleLineText.max(80)).min(1).max(16),
+    priority: z.enum(["high", "medium", "low"]),
+    detailCategory: CategorySchema,
+    detailBody: z.string().trim().min(1).max(12_000),
+    reviewAfter: LocalMemorySingleLineText.nullable(),
+}).strict();
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u;
+const RESERVED_MEMORY_MARKER = /NOWWORK:(?:MEMORY_ENTRY|MEMORY_INDEX):/iu;
+export function validateLocalMemoryChange(change) {
+    const text = [change.title, change.summary, ...change.triggers, change.detailBody].join("\n");
+    if (containsLikelySecret(text))
+        throw new Error("local_memory_secret_candidate");
+    if (CONTROL_CHARACTER_PATTERN.test(text))
+        throw new Error("local_memory_control_character");
+    if (RESERVED_MEMORY_MARKER.test(text))
+        throw new Error("local_memory_reserved_marker");
+    if (change.operation === "create"
+        && (change.memoryId !== null || change.baseRevision !== null || change.supersedesMemoryId !== null)) {
+        throw new Error("local_memory_create_revision_invalid");
+    }
+    if (change.operation === "update"
+        && (change.memoryId === null || change.baseRevision === null || change.supersedesMemoryId !== null)) {
+        throw new Error("local_memory_update_revision_missing");
+    }
+    if (change.operation === "supersede"
+        && (change.memoryId !== null || change.baseRevision === null || change.supersedesMemoryId === null)) {
+        throw new Error("local_memory_supersede_revision_missing");
+    }
+}

package/dist/local-memory/index-budget.js

@@ -19,6 +19,14 @@ export function renderLocalMemoryIndexCard(entry) {
         + `- updated: ${entry.updated}\n`
         + (entry.reviewAfter === null ? "" : `- review_after: ${entry.reviewAfter}\n`);
 }
+/** 写入和预演共用完整索引，预算包含起止标记与分隔换行。 */
+export function renderGeneratedIndex(entries) {
+    const cards = entries
+        .filter(entry => PROJECTABLE_STATUSES.has(entry.status))
+        .map(renderLocalMemoryIndexCard)
+        .join("\n");
+    return `<!-- NOWWORK:MEMORY_INDEX:BEGIN schema=1 -->\n${cards}<!-- NOWWORK:MEMORY_INDEX:END -->`;
+}
 function compareEntries(left, right) {
     const statusRank = (status) => status === "pinned" ? 0 : 1;
     const priorityRank = (priority) => (priority === "high" ? 0 : priority === "medium" ? 1 : 2);

package/dist/local-memory/inventory-cli.js

@@ -0,0 +1,61 @@
+const CommandSchema = z.object({
+    "agent-dir": z.string().min(1).refine(isAbsolute),
+    "dry-run": z.literal(true),
+}).strict();
+const USAGE = "只读记忆盘点与转换预演，不写文件，不支持 --apply。\n"
+    + "pnpm --filter @nowcrew/daemon exec tsx src/local-memory/inventory-cli.ts --agent-dir <单个Agent绝对路径> --dry-run\n"
+    + "报告包含原始记忆，需作为敏感本地资料保存；退出码0仅代表盘点及格式预演无阻塞，不代表批准迁移。\n";
+export async function runMemoryInventoryCommand(args, io) {
+    if (args.length === 1 && args[0] === "--help") {
+        io.out(USAGE);
+        return 0;
+    }
+    let command;
+    try {
+        const parsed = parseArgs({ args, allowPositionals: false, options: {
+                "agent-dir": { type: "string" }, "dry-run": { type: "boolean" },
+            } });
+        command = CommandSchema.parse(parsed.values);
+    }
+    catch {
+        io.err(USAGE);
+        return 2;
+    }
+    try {
+        const scan = await scanMemorySources(command["agent-dir"]);
+        const scanComplete = scan.issues.length === 0;
+        const analysis = previewMemoryInventory(scan.sources, scanComplete);
+        const complete = scanComplete && !analysis.issues.some((issue) => issue.code === "missing_detail");
+        const issues = [...scan.issues, ...analysis.issues];
+        const referenced = new Set(analysis.entries.map((entry) => entry.sourceFields.file));
+        const files = scan.sources.map(({ path, bytes, sha256 }) => ({ path, bytes, sha256 }));
+        const report = {
+            schemaVersion: 1, mode: "dry-run", agentDir: scan.root, applySupported: false,
+            complete, scanComplete, requiresHumanReview: true,
+            coverage: ["MEMORY.md", "notes/**", ".crew/memory/pending/**", "根目录的 .memory-result.v1-*.json"],
+            limitations: ["不扫描历史执行目录；result清单仅覆盖Agent根目录。", "两遍摘要比对不等同跨文件原子快照，正式迁移仍需停止写入并重新核对。"],
+            limits: inventoryLimits, totalBytes: scan.totalBytes, files, ...analysis, issues,
+            pending: files.filter((file) => file.path.startsWith(".crew/memory/pending/")).map((file) => file.path),
+            orphanNotes: files.filter((file) => file.path.startsWith("notes/") && !referenced.has(file.path)).map((file) => file.path),
+            resultFiles: files.filter((file) => file.path.startsWith(".memory-result.v1-")).map((file) => file.path),
+        };
+        io.out(JSON.stringify(report, null, 2) + "\n");
+        return issues.length ? 1 : 0;
+    }
+    catch (error) {
+        const code = error instanceof Error ? error.code ?? error.message : "inventory_failed";
+        io.err(`记忆盘点失败：${code}\n`);
+        return 1;
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+    process.exitCode = await runMemoryInventoryCommand(process.argv.slice(2), {
+        out: (text) => process.stdout.write(text), err: (text) => process.stderr.write(text),
+    });
+}
+import { isAbsolute, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { z } from "zod";
+import { inventoryLimits, scanMemorySources } from "./inventory-source.js";
+import { previewMemoryInventory } from "./inventory-preview.js";