@nowcrew/daemon 0.6.88-beta.2 → 0.6.88-beta.21

package/README.md

@@ -3,6 +3,21 @@
 The daemon is NowWork's local execution adapter. It holds a machine credential, keeps one control-plane
 WebSocket open, and launches coding runtimes on that machine. Product policy remains on the server.
 
+## 已完成搬迁后的存储运行
+
+NAS / `NOWWORK_HOME` 搬迁和旧 daemon 布局标准化入口已退役。daemon 不再提供内部
+`storage-migration-worker` / `storage-migration-recover` 命令，不处理 `daemon:migrate`、
+`daemon:storage-doctor`、`daemon:storage-migrate` 或迁移确认消息，也不再声明
+`storage_migration_v1` / `storage_migration_status_v1` / `daemon_layout_migration_v1` 能力。
+
+现有 `installations.json` 即使仍有历史 `storageMigrationId`，也按当前 installation 解析
+Agent、仓库和报告目录；启动、hello 和身份绑定不再读取迁移 receipt、outbox 或备份。
+hello 继续报告布局、环境、Workspace、路径指纹与 ownership，但不再发送迁移 ID。
+每次连接仍须完成 Server 身份绑定后才能执行任务；Workspace 或 Machine 身份不匹配时拒绝执行。
+
+旧布局读取兼容、日常安装/升级、NAS 所有权校验、执行 journal 与 ACK/replay 继续保留。
+退役代码不会删除历史安装字段、迁移记录、receipt、备份或旧数据目录；这些数据的保留与清理另行处理。
+
 ## Run
 
 For a temporary foreground connection, run:
@@ -242,26 +257,26 @@ The stable adapters keep prompts out of provider argv wherever the provider prot
 
 | Runtime | Transport | System/wake input | Native resume |
 | --- | --- | --- | --- |
-| Claude | stream-json CLI | daemon-owned system prompt file | CLI session id |
-| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume` |
-| Kimi | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| Hermes | ACP over stdio | `session/prompt` | `session/resume` (`session/load` compatibility fallback) |
-| OpenCode | `run --format json` | stdin | `--session` |
+| Claude | stream-json CLI | daemon-owned system prompt file + user input | CLI session id; thread-bound: matching native SessionStart proof + SDK initialization |
+| Codex | app-server JSON-RPC over stdio | `developerInstructions` + turn input | `thread/resume`; thread-bound: returned id must match |
+| Kimi | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| Hermes | ACP over stdio | `session/prompt` | unbound: `session/resume` (`session/load` fallback); thread-bound: cold |
+| OpenCode | `run --format json` | stdin | unbound: `--session`; thread-bound: cold |
 | DeepSeek Harness | ACP over stdio | `session/prompt` | none (fresh session per execution) |
 
 Kimi ACP currently requires a Kimi account even when the CLI has a working custom provider. Only for
 the explicit `Authentication required` response, the adapter retries once through Kimi's stream-json
-CLI and carries the same native session id; unrelated ACP failures stay failures. The CLI fallback is
+CLI; only unbound executions can carry a saved native session id. Unrelated ACP failures stay failures. The CLI fallback is
 subject to the Windows UTF-16 argv guard, while protocol-v1 itself remains disabled on Windows until
 durable Job Object ownership is available.
 
 Hermes uses only ACP capabilities advertised by the installed CLI. Model and effort choices come from
 a short-lived discovery session; credentials, provider profiles, plugins, and `HERMES_HOME` remain
-machine-local. A missing resumed ACP session is retried once as a fresh session.
+machine-local. For unbound executions, a missing resumed ACP session is retried once as a fresh session.
 
 OpenCode receives the prompt through stdin and runs with both cwd and `PWD` anchored to the Agent
 workspace. Models and variants come from `opencode models --verbose` (with the plain catalog as a
-compatibility fallback). A missing resumed session is retried once without `--session`; malformed,
+compatibility fallback). For unbound executions, a missing resumed session is retried once without `--session`; malformed,
 empty, incomplete, or explicitly failed JSON streams remain failures. NowWork never writes
 `opencode.json` or replaces `OPENCODE_CONFIG_CONTENT`. The daemon advertises OpenCode as executable
 only when `opencode run --help` exposes `--format`, `--dangerously-skip-permissions`, `--dir`,
@@ -291,8 +306,12 @@ uses fresh sessions and committed text; it does not claim resume, images, MCP, r
 or transcript support. Agent environment variables cannot override `DEEPSEEK_*`, `DSH_*`, or
 `NOWCREW_DEEPSEEK_HARNESS_CONFIG`; those values always come from the daemon service environment.
 
-Codex, Kimi, Hermes, and OpenCode sessions use the same bounded per-task persistence and keyed lease as Claude when they
-run through protocol v1. A first-progress watchdog covers a provider that accepts a turn but remains
+Unbound Codex, Kimi, Hermes, and OpenCode sessions retain the same configured warm/budget policy and keyed
+lease as Claude through protocol v1. Thread-bound Claude/Codex sessions keep their native session across
+warm-cache expiry, token estimates, and turn counts; verified restoration receives only accepted-cursor
+deltas. New sessions and runtimes without verified restoration receive complete current-thread history
+before the business turn. See the [thread context contract](../docs/thread-scoped-native-context.md).
+A first-progress watchdog covers a provider that accepts a turn but remains
 semantically silent; after the first semantic event, the execution's configured total timeout remains
 authoritative so a legitimate long-running tool is not killed for quiet output.
 DeepSeek Harness is execution-v1-only and intentionally skips native session persistence.
@@ -343,9 +362,11 @@ changing the task cwd. Claude receives
 so a machine policy that disables project settings also disables this source even when the projection is
 healthy.
 
-Existing user-level discovery is unchanged. Claude may still load `~/.claude/skills`; Codex may still
-load `$CODEX_HOME/skills`. The DeepSeek Codex variant uses its Agent-private `.codex-deepseek` home.
-Project bindings do not hide or rewrite any of those sources.
+Ordinary Codex always uses the shared user Home: the inherited `CODEX_HOME`, or `~/.codex` when
+unset. There is no Computer-level Home mode or private-Home migration command. Existing user-level
+discovery is unchanged: Claude may still load `~/.claude/skills`, and Codex may load `$CODEX_HOME/skills`
+and `~/.agents/skills`. The DeepSeek Codex variant keeps its Agent-private `.codex-deepseek` Home for
+provider credentials. Project bindings do not hide or rewrite any of those sources.
 
 Binding changes reconcile immediately when the Computer is online. On reconnect the server sends the
 complete binding set for every Agent assigned to that Computer, including empty sets that clear stale
@@ -354,6 +375,15 @@ Runtime launch, which recovers from a missed notification or daemon restart. Ski
 are visible through the symlink immediately; adding, deleting, renaming, or changing frontmatter requires
 a rescan. Web descriptions remain at the last inventory value until that rescan.
 
+## 目录投影测试的平台范围
+
+`test/directory-projection.test.ts` 在所有平台运行，覆盖路径检查、复制发布、只读权限请求及失败恢复。
+其受控文件系统夹具记录目录 `chmod` 请求，但保留宿主目录的写权限，避免把 macOS 的目录重命名规则当作 Windows 行为。
+生产代码的只读保护不受此夹具影响。
+
+`test/directory-projection.windows.test.ts` 仅在 Windows 上运行，使用真实文件系统验证只读目录发布与文件保护。
+非 Windows 的全量测试会明确跳过该文件，不能据此宣称 Windows 原生行为已验证。
+
 ## Reliability
 
 Protocol-v1 lifecycle is `accepted → started → completed`, followed by a server

package/dist/agent-memory/policy.js

@@ -17,7 +17,9 @@ function truncateUtf8(value, maxBytes) {
     return output;
 }
 export function extractIncomingMessage(wakePrompt) {
-    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew)|$)/su);
+    // Keep legacy wake delimiters while accepting program-delivered-context prompts.
+    // Stop before policy/history blocks; neither is the current user's message.
+    const match = wakePrompt.match(/(?:^|\n)(?:Incoming message|来信):[ \t]*(.*?)(?=\n(?:Start with crew|先用 crew|Work directly from this thread's context|直接依据程序交付的本线程上下文|No thread anchor:|没有线程锚点[，,])|$)/su);
     const content = match?.[1]?.trim();
     return content ? content : null;
 }

package/dist/computer-profile.js

@@ -25,7 +25,6 @@ const ProfileFields = z.object({
     runtimePath: z.string().min(1).max(32768).refine((value) => !value.includes("\0") && !value.includes("\n") && !value.includes("\r"), "runtimePath must be a single line").optional(),
     releaseTag: z.enum(["latest", "beta"]).optional(),
     registryUrl: z.string().url().optional(),
-    codexHomeMode: z.enum(["shared", "private"]).optional(),
 }).strict();
 function validateProfileRegistry(value, context) {
     const fields = value;
@@ -60,7 +59,13 @@ const StoredProtectedProfileSchema = ProfileFields.omit({ machineToken: true }).
         ciphertext: z.string().min(1).max(16384),
     }).strict(),
 }).strict().superRefine(validateProfileRegistry);
-const StoredProfileSchema = z.union([StoredPlainProfileSchema, StoredProtectedProfileSchema]);
+// 旧版本可能已保存 shared 字段；读取时丢弃退休设置，其余字段仍严格校验。
+const StoredProfileSchema = z.preprocess((raw) => {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return raw;
+    const { codexHomeMode: _retiredMode, ...fields } = raw;
+    return fields;
+}, z.union([StoredPlainProfileSchema, StoredProtectedProfileSchema]));
 export const PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE = "Profile '{{profile}}' conflicts with profile '{{conflict}}': both resolve to agents root '{{agentsRoot}}'. Save it with a unique root, for example: {{command}}";
 export class ProfileAgentsRootConflictError extends Error {
     profile;
@@ -257,7 +262,6 @@ export async function saveProfile(input, home = daemonHome(), options = {}) {
                 ...(profile.runtimePath ? { runtimePath: profile.runtimePath } : {}),
                 ...(profile.releaseTag === undefined ? {} : { releaseTag: profile.releaseTag }),
                 ...(profile.registryUrl === undefined ? {} : { registryUrl: profile.registryUrl }),
-                ...(profile.codexHomeMode === undefined ? {} : { codexHomeMode: profile.codexHomeMode }),
                 machineTokenProtected: { scheme: "dpapi-current-user", ciphertext },
             });
             await atomicPrivateWrite(profilePath(profile.name, home), `${JSON.stringify(stored, null, 2)}\n`, configured.harden);
@@ -404,5 +408,6 @@ export function applyProfileToEnv(profile, env) {
         env.CREW_NPM_REGISTRY = profile.registryUrl;
     else
         delete env.CREW_NPM_REGISTRY;
-    env.CREW_CODEX_HOME_MODE = profile.codexHomeMode ?? "shared";
+    // 不再向运行时传播退休的模式开关；CODEX_HOME 沿用用户环境。
+    delete env.CREW_CODEX_HOME_MODE;
 }

package/dist/config.js

@@ -111,14 +111,6 @@ function localMemoryV2Handles(env, serverUrl) {
     return new Set(handles);
 }
 export const DEFAULT_SERVER_URL = "http://127.0.0.1:3001";
-function codexHomeModeEnv(env) {
-    const value = env.CREW_CODEX_HOME_MODE;
-    if (value === undefined || value === "shared")
-        return "shared";
-    if (value === "private")
-        return "private";
-    throw new ConfigError("CREW_CODEX_HOME_MODE must be shared or private");
-}
 function codexCollaborationToolsEnv(env) {
     const value = (env.CREW_CODEX_COLLABORATION_TOOLS ?? "").trim().toLowerCase();
     if (value === "" || value === "0" || value === "false" || value === "off")
@@ -168,7 +160,6 @@ export function loadConfig(env = process.env) {
             : defaultQaReportRoot,
         cliPath: env.CREW_CLI_PATH ?? defaultCliPath(),
         runtimeBin: env.CREW_RUNTIME ?? "claude",
-        codexHomeMode: codexHomeModeEnv(env),
         codexCollaborationTools: codexCollaborationToolsEnv(env),
         dangerous: env.CREW_RUNTIME_SAFE !== "1", // 默认开启 (headless agent 在自有 workspace 内运行)
         resume: env.CREW_RESUME !== "off" && env.CREW_RESUME !== "0", // 默认开启;一键回退现状用 CREW_RESUME=off

package/dist/daemon-update-eligibility.js

@@ -14,7 +14,7 @@ import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, man
 export async function managedDaemonCapabilities(eligibility) {
     try {
         return (await eligibility()).eligible
-            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1", "daemon_layout_migration_v1"]
+            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1"]
             : [];
     }
     catch {

package/dist/execution-journal.js

@@ -878,23 +878,26 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         },
         acknowledgeCompletion: async (executionId) => {
             validateExecutionId(executionId);
-            const updated = await serializedExecution(executionId, "acknowledge_completion", async () => {
+            const result = await serializedExecution(executionId, "acknowledge_completion", async () => {
                 const entry = await requireRecord(executionId);
                 if (entry.state !== "completed" && entry.state !== "interrupted") {
                     throw new JournalTransitionError(`Cannot acknowledge ${entry.state} execution`);
                 }
-                if (entry.completionAcknowledged)
-                    return confirmDurable(entry);
+                if (entry.completionAcknowledged) {
+                    return { entry: await confirmDurable(entry), newlyAcknowledged: false };
+                }
                 const updated = JournalEntrySchema.parse({
                     ...entry,
                     completionAcknowledged: true,
                     updatedAt: now().toISOString(),
                 });
                 await writeRecord(updated);
-                return updated;
+                return { entry: updated, newlyAcknowledged: true };
             });
-            await serializedDirectory(pruneInternal);
-            return updated;
+            // 重复 ACK 仍确认持久化，但不能反复全目录清理并阻塞后续控制帧。
+            if (result.newlyAcknowledged)
+                await serializedDirectory(pruneInternal);
+            return result.entry;
         },
         get: async (executionId) => {
             validateExecutionId(executionId);

package/dist/execution-protocol.js

@@ -200,7 +200,7 @@ export const ExecutionStartSchema = z.object({
         language: z.enum(["zh", "en"]),
         systemPrompt: z.string(),
         wakePrompt: z.string(),
-        maintenancePurpose: z.literal("self_training").optional(),
+        maintenancePurpose: z.enum(["self_training", "memory_prune"]).optional(),
     }).strict(),
     runtime: z.object({
         name: RuntimeSchema,
@@ -264,6 +264,7 @@ export const ExecutionRejectedSchema = z.object({
     reason: RejectionReasonSchema,
     message: z.string().optional(),
     at: TimestampSchema,
+    preAdmissionProof: z.object({ specHash: z.string().regex(/^[a-f0-9]{64}$/u) }).strict().optional(),
 }).strict();
 export const ExecutionStartedSchema = z.object({
     type: z.literal("execution:started"),

package/dist/execution-runner.js

@@ -408,7 +408,8 @@ export async function runExecution(config, input, dependencies) {
         ? { permission: effectivePermission(spec, config) }
         : admission(spec, config, dependencies, initialAt);
     if ("rejected" in checked) {
-        const frame = ExecutionRejectedSchema.parse(boundExecutionFrame(checked.rejected, config.executionLimits.maxEventBytes));
+        const proof = await dependencies.confirmPreAdmission?.(checked.rejected).catch(() => false);
+        const frame = ExecutionRejectedSchema.parse(boundExecutionFrame({ ...checked.rejected, ...(proof ? { preAdmissionProof: { specHash } } : {}) }, config.executionLimits.maxEventBytes));
         await dependencies.report(frame);
         return { kind: "rejected", frame };
     }
@@ -844,6 +845,7 @@ export async function runExecution(config, input, dependencies) {
             executionId: spec.executionId,
             handle: spec.agent.handle,
             channelId: spec.context.channelId,
+            ...(spec.context.threadId === undefined ? {} : { threadId: spec.context.threadId }),
             keyMode: "opaque",
             taskKey: spec.workspace.taskKey,
             ...(spec.workspace.resumeKey === undefined ? {} : { resumeKey: spec.workspace.resumeKey }),
@@ -876,7 +878,6 @@ export async function runExecution(config, input, dependencies) {
                 ...(config.qaReportRoot === undefined ? {} : { qaReportRoot: config.qaReportRoot }),
                 cliPath: config.cliPath,
                 providerConfig,
-                codexHomeMode: config.codexHomeMode,
                 ...(providerConfig.description ? { description: providerConfig.description } : {}),
                 ...(spec.reporting.allowBoundImDecision ? {
                     systemEnv: {
@@ -885,13 +886,13 @@ export async function runExecution(config, input, dependencies) {
                 } : {}),
             },
             session: {
-                enabled: selfTraining ? false : config.resume,
+                enabled: spec.instructions.maintenancePurpose !== undefined ? false : config.resume,
                 warmMs: config.resumeWarmMs,
                 budgetTokens: config.sessionBudgetTokens,
                 softTokens: config.sessionSoftTokens,
                 maxTurns: config.sessionMaxTurns,
             },
-            ...(selfTraining ? { maintenancePurpose: "self_training" } : {}),
+            ...(spec.instructions.maintenancePurpose === undefined ? {} : { maintenancePurpose: spec.instructions.maintenancePurpose }),
             localMemoryV2Enabled,
         };
         const result = await Promise.race([

package/dist/list-models.js

@@ -1,6 +1,7 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { isWin } from "./platform.js";
+import { augmentedPath } from "./runtime-path.js";
 import { listClaudeModels } from "./runtimes/claude-models.js";
 import { listHermesModels } from "./runtimes/hermes-models.js";
 const execFileRaw = promisify(execFile);
@@ -8,6 +9,7 @@ const MODEL_PROBE_TIMEOUT_MS = 8_000;
 const MODEL_PROBE_MAX_BUFFER_BYTES = 1024 * 1024;
 // win32 上 npm CLI 是 .cmd shim,execFile 需 shell 才能执行;参数全是固定字面量,无注入面。
 const execFileP = (bin, args) => execFileRaw(bin, args, {
+    env: { ...process.env, PATH: augmentedPath() },
     shell: isWin(),
     timeout: MODEL_PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL",

package/dist/local-execution-lease.js

@@ -0,0 +1,22 @@
+import { awaitWithCancellation } from "./runtime-cancellation.js";
+const leaseTails = new Map();
+/** 同一进程内的短操作或原生会话排队；等待取消也不会越过前一位持有者。 */
+export async function withKeyedLease(key, operation, cancellation) {
+    const predecessor = leaseTails.get(key) ?? Promise.resolve();
+    // 解锁函数在等待 predecessor 前可用，保留取消等待时的队列顺序。
+    let unlock;
+    const current = new Promise(resolve => { unlock = resolve; });
+    const queued = predecessor.then(() => current);
+    leaseTails.set(key, queued);
+    try {
+        await awaitWithCancellation(predecessor, cancellation);
+        return await operation();
+    }
+    finally {
+        unlock();
+        void queued.then(() => {
+            if (leaseTails.get(key) === queued)
+                leaseTails.delete(key);
+        });
+    }
+}

package/dist/local-executor.js

@@ -1,3 +1,4 @@
+import { deepSeekHarnessLauncher } from "./runtimes/deepseek-harness.js";
 import { createInterface } from "node:readline";
 import { readFile, rm, writeFile } from "node:fs/promises";
 import { delimiter, join } from "node:path";
@@ -6,8 +7,6 @@ import { prepareWorkspace, rotateAgentSession, safeKey, } from "./workspace.js";
 import { CLAUDE_ADDITIONAL_DIRECTORY_INSTRUCTIONS_ENV, isClaudeAdditionalDirectoryInstructionsSupported, probeClaudeVersion, spawnClaude, } from "./runtimes/claude.js";
 import { spawnCodex } from "./runtimes/codex.js";
 import { DEEPSEEK_CODEX_MODEL, DEEPSEEK_CODEX_REASONING_LEVELS, materializeDeepSeekCodexHome, } from "./runtimes/codex-deepseek-config.js";
-import { materializeDefaultCodexHome } from "./runtimes/codex-home.js";
-import { materializePrivateCodexHome } from "./codex-home-launch.js";
 import { spawnKimi, KIMI_EFFORT_LEVELS } from "./runtimes/kimi.js";
 import { applyDeepSeekHarnessMachineEnv, applyProviderEnv, providerFingerprint, } from "./provider-env.js";
 import { augmentedPath } from "./runtime-path.js";
@@ -15,6 +14,11 @@ import { deliverCloudReports, prepareCloudReportExecution } from "./cloud-report
 import { reportDeliveryContext } from "./cloud-report-receipt.js";
 import { extractFinalText, extractRunMeta, normalizeEvent, parseLine, } from "./normalize.js";
 import { readSession, writeSession, pickResumeId, isNearBudget } from "./session.js";
+import { NativeThreadContext, isolateMaintenanceSession } from "./native-thread-context.js";
+import { prepareThreadDelivery } from "./thread-input-delivery.js";
+import { resolveMemoryPruneWorkLog, workLogSha256 } from "./local-memory/work-log.js";
+import { withKeyedLease } from "./local-execution-lease.js";
+import { withWorkLogExecution, withWorkLogCommit, workLogExecutionKey } from "./local-memory/work-log-execution.js";
 import { providerErrorFromExit } from "./provider-error.js";
 import { createConsoleFormatter } from "./console-formatter.js";
 import { withLocalExecutionFacts, } from "./local-execution-prompt.js";
@@ -108,6 +112,9 @@ async function launchLegacyRuntime(request) {
     if (request.runtime === "deepseek-harness") {
         throw new Error("DeepSeek Harness requires execution protocol v1");
     }
+    if (request.runtime !== "claude")
+        request = { ...request, wakePrompt: (await prepareThreadDelivery({ env: request.env,
+                resumed: false, sessionId: "unverified-cold-legacy", wakePrompt: request.wakePrompt })).prompt };
     const common = {
         bin: request.bin,
         cwd: request.cwd,
@@ -154,27 +161,12 @@ async function launchLegacyRuntime(request) {
 function resolvePrompt(prompt, context) {
     return typeof prompt === "string" ? prompt : prompt(context);
 }
-const nativeSessionLeaseTails = new Map();
 const activeMemoryPrunes = new Map();
-async function withKeyedLease(key, operation, cancellation) {
-    const predecessor = nativeSessionLeaseTails.get(key) ?? Promise.resolve();
-    let release;
-    const current = new Promise((resolve) => { release = resolve; });
-    const tail = predecessor.then(() => current);
-    nativeSessionLeaseTails.set(key, tail);
-    try {
-        await awaitWithCancellation(predecessor, cancellation);
-        return await operation();
-    }
-    finally {
-        release();
-        void tail.then(() => {
-            if (nativeSessionLeaseTails.get(key) === tail)
-                nativeSessionLeaseTails.delete(key);
-        });
-    }
-}
 export async function executeLocal(input, callbacks = {}, dependencies = {}) {
+    input = isolateMaintenanceSession(input);
+    return withWorkLogExecution(workLogExecutionKey(input.launch.agentsRoot, input.handle, input.taskKey), () => executeLocalWithSession(input, callbacks, dependencies), dependencies.cancellation);
+}
+async function executeLocalWithSession(input, callbacks, dependencies) {
     const versionedProjectSkills = input.projectSkills !== undefined
         && !Array.isArray(input.projectSkills);
     if (versionedProjectSkills && (input.runtime.name !== "codex" && input.runtime.name !== "claude")) {
@@ -255,6 +247,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     let localMemoryResultPath = null;
     let executionWorkspace = workspace;
     let localMemoryTelemetry = null;
+    let nativeThreadContext = null;
     const inheritedEnv = { ...process.env };
     const reportRoots = {
         root: workspace.dir,
@@ -267,8 +260,6 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         if (key.startsWith("CREW_AGENT_MEMORY_") || ["CREW_CLOUD_PROVIDER", "CREW_OSS_UPLOAD_SCRIPT", "CREW_OSS_REPORT_UPLOAD"].includes(key))
             delete inheritedEnv[key];
     }
-    const sourceCodexHome = inheritedEnv.CODEX_HOME
-        ?? (inheritedEnv.HOME === undefined ? undefined : join(inheritedEnv.HOME, ".codex"));
     let materializedDeepSeekHome;
     try {
         if (isDeepSeekCodex && !providerConfig.providerApiKey) {
@@ -294,12 +285,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             : null;
         const currentPrior = storedCurrentPrior !== null
             && storedCurrentPrior.sessionContextFingerprint === input.sessionContextFingerprint
+            && storedCurrentPrior.runtime === runtime.name
+            && storedCurrentPrior.threadRoot === input.resumeKey
             ? storedCurrentPrior
             : null;
-        // Interactive V1 uses collision-resistant session directories, while the
-        // older legacy path stored metadata under tasks/<safe thread key>. Import
-        // that metadata once so an existing thread can cross the protocol boundary
-        // without losing its native runtime conversation.
+        // Import compatible legacy metadata across the protocol boundary.
         const legacyRunDir = input.session.enabled
             && supportsNativeResume
             && input.keyMode === "opaque"
@@ -315,7 +305,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const legacyPrior = legacyRunDir === null || (currentPrior !== null && !legacyCwdPinned)
             ? null
             : await readSession(legacyRunDir);
-        const prior = currentPrior ?? legacyPrior;
+        const compatibleLegacyPrior = legacyPrior?.runtime === runtime.name && legacyPrior?.threadRoot === input.resumeKey
+            ? legacyPrior : null;
+        const prior = currentPrior ?? compatibleLegacyPrior;
         const sessionExists = workspace.sessionResume || legacyPrior !== null;
         const usesLegacyCwd = legacyRunDir !== null
             && (legacyCwdPinned || (currentPrior === null && legacyPrior !== null));
@@ -336,11 +328,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ? prior?.model ?? currentModel
             : currentModel;
         const resumeSessionId = supportsNativeResume && sessionExists
-            ? pickResumeId(prior, Date.now(), input.session.warmMs, resumeComparisonModel, input.session.budgetTokens, input.session.maxTurns, providerFp)
+            ? pickResumeId(input.resumeKey && (!Number.isSafeInteger(prior?.threadContextSeq) || prior?.threadHistoryComplete !== true) ? null : prior, Date.now(), input.resumeKey ? 0 : input.session.warmMs, resumeComparisonModel, input.resumeKey ? 0 : input.session.budgetTokens, input.resumeKey ? 0 : input.session.maxTurns, providerFp)
             : null;
         const resuming = resumeSessionId !== null;
         const rotatedForBudget = !resuming && supportsNativeResume && sessionExists
-            && pickResumeId(prior, Date.now(), input.session.warmMs, resumeComparisonModel, 0, 0, providerFp) !== null;
+            && pickResumeId(prior, Date.now(), input.resumeKey ? 0 : input.session.warmMs, resumeComparisonModel, 0, 0, providerFp) !== null;
         const nearBudget = resuming && isNearBudget(prior, input.session.softTokens);
         const rotated = Boolean(workspace.agentSessionId && sessionExists && !resuming);
         // Codex and Kimi choose their own id on a fresh start, so the native id persisted in
@@ -348,8 +340,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         const launchSessionId = resumeSessionId ?? (rotated
             ? await rotateAgentSession(workspace.sessionDir)
             : workspace.agentSessionId);
-        await materializePrivateCodexHome({ runtime: runtime.name, homeDir: workspace.homeDir, ...(input.launch.codexHomeMode === undefined ? {} : { mode: input.launch.codexHomeMode }), ...(sourceCodexHome === undefined ? {} : { sourceHome: sourceCodexHome }), ...(launchSessionId === undefined ? {} : { sessionId: launchSessionId }), ...(dependencies.cancellation === undefined ? {} : { cancellation: dependencies.cancellation }), ...(dependencies.materializeDefaultCodexHome === undefined ? {} : { materialize: dependencies.materializeDefaultCodexHome }) });
-        const promptContext = {
+        let promptContext = {
             workspace: executionWorkspace,
             resuming,
             rotatedForBudget,
@@ -388,8 +379,13 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             }
         }
         const attachmentPlan = routeRuntimeAttachments(runtime.name, materialized?.attachments ?? []);
-        const wakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
-        memoryPruneTraceId = parseMemoryPruneTraceId(wakePrompt);
+        let baseWakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
+        memoryPruneTraceId = parseMemoryPruneTraceId(baseWakePrompt);
+        if (memoryPruneTraceId !== null) {
+            executionWorkspace = await resolveMemoryPruneWorkLog(executionWorkspace, input);
+            promptContext = { ...promptContext, workspace: executionWorkspace };
+            baseWakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
+        }
         if (input.localMemoryV2Enabled === true && memoryPruneTraceId !== null
             && isLocalMemoryV2Eligible({
                 enabledForHandle: true,
@@ -402,12 +398,13 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         const memoryPrompt = await prepareLocalMemoryPrompt({
             agentDir: executionWorkspace.dir, executionId: input.executionId, agentHandle: input.handle,
-            enabled: input.localMemoryV2Enabled === true, query: wakePrompt,
+            enabled: input.localMemoryV2Enabled === true, query: baseWakePrompt,
             resultPath: localMemoryResultPath, maxBytes: input.maxSystemPromptBytes,
             renderBase: (reservedPromptBytes) => resolvePrompt(input.systemPrompt, { ...promptContext, reservedPromptBytes }),
         });
         localMemoryResultPath = memoryPrompt.resultPath;
         const systemPrompt = memoryPrompt.systemPrompt;
+        const wakePrompt = baseWakePrompt + memoryPrompt.wakePromptSuffix;
         if (!isolatedMaintenance)
             try {
                 localMemoryTelemetry = createLocalMemoryTelemetry({
@@ -466,6 +463,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         memoryPruneFailurePhase = "runtime_prepare";
         const crewHome = isolatedMaintenance ? executionWorkspace.runDir : workspace.dir;
+        const contextThreadId = input.threadId ?? input.resumeKey;
+        if (contextThreadId && input.maintenancePurpose === undefined) {
+            nativeThreadContext = new NativeThreadContext(join(executionWorkspace.runDir, `.crew-context-${input.executionId}.json`), contextThreadId, runtime.name, resumeSessionId, prior);
+            await nativeThreadContext.initialize();
+        }
         const baseEnv = {
             ...inheritedEnv,
             ...sanitizeEnvVars(providerConfig.envVars),
@@ -478,6 +480,9 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             CREW_TOKEN: input.launch.token,
             CREW_CHANNEL: input.channelId,
             CREW_HOME: crewHome,
+            // Empty values override any stale inherited hints from an enclosing runtime.
+            CREW_THREAD_ROOT: contextThreadId ?? "",
+            CREW_THREAD_CONTEXT_FILE: nativeThreadContext?.path ?? "",
             // Keep the daemon-selected storage root authoritative for runtimes.
             // In profile-backed NowWork sessions the daemon config may differ from
             // the daemon process environment, so inheriting CREW_AGENTS_ROOT is not
@@ -502,9 +507,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 ? { KIMI_MODEL_THINKING_EFFORT: runtime.reasoning }
                 : {}),
         };
-        const providerEnv = applyProviderEnv(baseEnv, runtime.name, input.launch.codexHomeMode === undefined
-            ? providerConfig
-            : { ...providerConfig, codexHomeMode: input.launch.codexHomeMode }, workspace.homeDir, materializedDeepSeekHome);
+        const providerEnv = applyProviderEnv(baseEnv, runtime.name, providerConfig, workspace.homeDir, materializedDeepSeekHome);
         const childEnv = runtime.name === "deepseek-harness"
             ? applyDeepSeekHarnessMachineEnv(providerEnv, inheritedEnv)
             : providerEnv;
@@ -525,7 +528,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const effectiveSystemPrompt = abilityContext === undefined
                 ? systemPrompt
                 : `${systemPrompt}\n\n${abilityContext.prompt}`;
-            if (Buffer.byteLength(effectiveSystemPrompt, "utf8") > (input.maxSystemPromptBytes ?? Number.MAX_SAFE_INTEGER)) {
+            if (Buffer.byteLength(effectiveSystemPrompt, "utf8") + Buffer.byteLength(memoryPrompt.wakePromptSuffix, "utf8")
+                > (input.maxSystemPromptBytes ?? Number.MAX_SAFE_INTEGER)) {
                 throw new Error("ability_runtime_context_size_exceeded");
             }
             memoryPruneFailurePhase = "prompt_write";
@@ -559,7 +563,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 });
             }
             const trainingRoots = input.trainingProjectContext?.projects.map((project) => project.root) ?? [];
-            const { codexSkillRoots, claudeAdditionalDirectories } = await projectSkillRuntimeDirectories({
+            const { codexSkillRoots, claudeAdditionalDirectories, harnessSkillRoots } = await projectSkillRuntimeDirectories({
                 runtime: runtime.name,
                 ...(runtimeRoot === undefined ? {} : { runtimeRoot }),
                 agentRoot: workspace.dir,
@@ -597,7 +601,8 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const workspaceRoots = [...legacyRoots, ...trainingRoots];
             const launchRequest = {
                 runtime: runtime.name,
-                bin: runtime.name === "deepseek-harness" ? "dsh-acp-demo" : runtime.name,
+                bin: runtime.name === "deepseek-harness" ? deepSeekHarnessLauncher(runtimeEnv).bin : runtime.name,
+                ...(runtime.name === "deepseek-harness" ? { harnessStateRoot: executionWorkspace.runDir, harnessSkillRoots: harnessSkillRoots ?? [] } : {}),
                 cwd: input.projectContext?.primary?.root ?? executionWorkspace.runDir,
                 ...(runtimeRoot !== undefined
                     || (input.projectSkills === undefined && input.abilityRelease === undefined)
@@ -801,6 +806,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const event = parseLine(line);
             if (!event)
                 return;
+            nativeThreadContext?.observe(event);
             localMemoryTelemetry?.observe(event);
             if (isRuntimeReadyEvent(runtime.name, event))
                 markRuntimeReady();
@@ -918,14 +924,17 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         memoryPruneRuntimeExitCode = exitCode;
         if (localMemoryResultPath !== null) {
             memoryPruneFailurePhase = "memory_commit";
-            const committed = await commitLocalMemoryResultAfterExit({
-                resultPath: localMemoryResultPath,
+            const resultPath = localMemoryResultPath;
+            const commit = () => commitLocalMemoryResultAfterExit({
+                resultPath,
                 agentDir: executionWorkspace.dir,
                 executionId: input.executionId,
                 pruneTraceId: memoryPruneTraceId,
                 exitCode,
                 workLogPath: executionWorkspace.workLogPath,
+                expectedWorkLogSha256: workLogSha256(executionWorkspace.workLog),
             });
+            const committed = exitCode !== 0 ? await commit() : await withWorkLogCommit(workLogExecutionKey(input.launch.agentsRoot, input.handle, input.taskKey), commit, dependencies.cancellation);
             if (committed.status === "failed" || committed.status === "missing") {
                 const reason = committed.error ?? "local_memory_result_missing";
                 dslog("local_memory.commit_failed", "结构化本地记忆提交或清理未完成，保留可用恢复材料", {
@@ -959,9 +968,12 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 ? usage.inputTokens + usage.cacheReadTokens + usage.cacheCreationTokens
                 : (resuming ? prior?.contextTokens : undefined);
             await writeSession(workspace.sessionDir, {
+                runtime: runtime.name,
+                ...(input.resumeKey === undefined ? {} : { threadRoot: input.resumeKey }),
+                ...(exitCode === 0 ? await nativeThreadContext?.checkpoint() ?? {} : {}),
                 sessionId,
                 lastRunAt: Date.now(),
-                turns: resuming ? (prior?.turns ?? 0) + 1 : 1,
+                turns: nativeThreadContext?.confirmed ? (prior?.turns ?? 0) + 1 : 1,
                 model: currentModel,
                 providerFingerprint: providerFp,
                 ...(input.sessionContextFingerprint === undefined
@@ -995,7 +1007,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ...(usage === undefined ? {} : { usage }),
             model: observedModel,
             runtime: runtime.name,
-            resumed: resuming,
+            resumed: nativeThreadContext?.confirmed ?? false,
             sessionId,
             errorMessage: errorTail || null,
             ...(providerError === undefined ? {} : { providerError }),
@@ -1007,6 +1019,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         };
     }
     finally {
+        await nativeThreadContext?.cleanup().catch(() => undefined);
         startupReservationState.current?.release();
         try {
             await localMemoryTelemetry?.finish();