@nowcrew/daemon 0.6.88-beta.29 → 0.6.88-beta.30

package/README.md

@@ -40,6 +40,43 @@ This compatibility form stays resident in the current terminal and reconnects wi
 `pnpm --filter @nowcrew/daemon daemon`. `crew-daemon run --agent <handle> --channel <id>` is the legacy
 manual one-shot entry.
 
+## Browser-Approved Computer Setup
+
+The Web UI generates a token-free command for a specific Workspace and Machine:
+
+```bash
+npx -y --registry https://registry.npmjs.org --package @nowcrew/daemon@latest nowwork-computer setup /nowcoder-app --machine <machine-uuid> --server-url https://nowwork.nowcoder.com
+```
+
+`nowwork-computer setup` opens a one-time authorization page, prints the user code, polls until an owner or
+admin approves it, then installs the selected daemon through the existing isolated profile and native service
+installer. The command contains no long-lived `sk_machine_*` credential. The issued credential is held
+only in memory until the private profile is written, and becomes permanent after successful finalization.
+Each command run needs a new approval. Browser approval expires after ten minutes; credential exchange starts
+a separate thirty-minute installation window. Failed installations restore the prior credential when still owned
+by that setup. Interrupted setups are reconciled at server startup and every minute.
+Only one unfinished credential exchange can own a Machine at a time; a concurrent setup receives a conflict.
+Use `--no-browser` on hosts without a desktop browser and
+`--json` for machine-readable status output. `--server-url` must be explicit for remote servers; it may also
+come from `CREW_SERVER_URL`.
+
+Alternatively, install both command entries first, then run setup:
+
+```bash
+npm install --global --registry https://registry.npmjs.org @nowcrew/daemon@latest
+nowwork-computer setup --server-url https://nowwork.nowcoder.com /nowcoder-app --machine <machine-uuid>
+```
+
+With `CREW_SERVER_URL=https://nowwork.nowcoder.com` already set, the second command can be shortened to
+`nowwork-computer setup /nowcoder-app --machine <machine-uuid>`. Replace the placeholder with the
+Machine UUID from the Web command. New production setup links use `nowwork.nowcoder.com`;
+the old `nowwork-in.nowcoder.com` hostname remains a production alias for existing profiles and pairing.
+
+The setup flow validates the exact Workspace and Machine UUID and waits for the machine control-plane hello
+to confirm Workspace, Machine, environment, profile, and storage identity. It does not migrate NAS or copy
+existing `.crew` data. Existing `crew-daemon install --server-url ... --api-key ...` and profile lifecycle
+commands remain available as compatibility and recovery entry points.
+
 ## Machine Environment
 
 The daemon loads exported variables from its OS account’s bash/zsh configuration on macOS/Linux,
@@ -72,7 +109,8 @@ npx -y --registry https://registry.npmjs.org @nowcrew/daemon@beta install \
   --release-tag beta --registry https://registry.npmjs.org
 ```
 
-The installer selects the fixed `in` layout for `nowwork-in.nowcoder.com` and the fixed `dev` layout for
+The installer selects the fixed production layout for both `nowwork.nowcoder.com` (canonical) and
+`nowwork-in.nowcoder.com` (legacy compatibility), and the fixed `dev` layout for
 `nowwork-dev.nowcoder.com`. It compares the parsed hostname exactly; lookalike suffixes are not accepted.
 An unknown hostname is rejected before any write and reports how to retry with an explicit custom profile:
 

package/dist/automatic-daemon-installer.js

@@ -1,5 +1,6 @@
 import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
+import { z } from "zod";
 import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
 import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
@@ -14,6 +15,8 @@ import { daemonRegistryCandidates } from "./daemon-registry.js";
 import { npmInvocation } from "./npm-command.js";
 import { discoverExactLegacyService, } from "./automatic-service-migration.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
+import { serverHostIdentity } from "./server-url.js";
+import { computerSetupRecoveryGuidance } from "./computer-setup-client.js";
 function profileStorage(platform, userHome, runner) {
     return {
         platform,
@@ -27,7 +30,7 @@ function profileStorage(platform, userHome, runner) {
     };
 }
 function sameHostname(left, right) {
-    return new URL(left).hostname.toLowerCase() === new URL(right).hostname.toLowerCase();
+    return serverHostIdentity(left) === serverHostIdentity(right);
 }
 function localHomeForTarget(target, platform) {
     const paths = platform === "win32" ? win32 : posix;
@@ -246,8 +249,33 @@ function recoveryError(primary, failures) {
         return original;
     return new Error(`${original.message}; recovery failed: ${failures.map((error) => error.message).join("; ")}`, { cause: original });
 }
+function setupIdentity(input) {
+    if (input.workspaceId === undefined && input.machineId === undefined)
+        return null;
+    if (input.workspaceId === undefined || input.machineId === undefined) {
+        throw new Error("Computer setup requires both Workspace and Machine identity");
+    }
+    return {
+        workspaceId: z.string().uuid().parse(input.workspaceId),
+        machineId: z.string().uuid().parse(input.machineId),
+    };
+}
+function assertExistingProfileIdentity(previous, identity) {
+    if (previous === null || identity === null)
+        return;
+    if (previous.workspaceId === undefined || previous.machineId === undefined) {
+        throw new Error(`Profile '${previous.name}' does not record its Workspace and Machine identity`);
+    }
+    if (previous.workspaceId !== identity.workspaceId) {
+        throw new Error(`Profile '${previous.name}' belongs to a different Workspace identity`);
+    }
+    if (previous.machineId !== identity.machineId) {
+        throw new Error(`Profile '${previous.name}' belongs to a different Machine identity`);
+    }
+}
 export async function installDaemonAutomatically(input, dependencies = defaultDependencies()) {
     const machineToken = MachineTokenSchema.parse(input.machineToken);
+    const identity = setupIdentity(input);
     const requestedLocalHome = input.requestedLocalHome ?? dependencies.environment.NOWWORK_LOCAL_HOME;
     const requestedLocalHomeMode = input.requestedLocalHomeMode
         ?? dependencies.environment.NOWWORK_LOCAL_HOME_MODE
@@ -280,6 +308,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
     });
     const previousProfile = await dependencies.captureProfile(target);
     await dependencies.assertProfileTarget(target, previousProfile);
+    assertExistingProfileIdentity(previousProfile, identity);
     const previousService = await dependencies.captureService(spec, target);
     if (previousService.installed && !previousService.exact) {
         throw new Error(`Installed service '${spec.id}' does not match the requested identity`);
@@ -330,6 +359,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
             name: target.profile,
             serverUrl: target.serverUrl,
             machineToken,
+            ...(identity === null ? {} : identity),
             agentsRoot: target.agentsRoot,
             releaseTag: target.releaseTag,
             ...(target.registryUrl === undefined ? {} : { registryUrl: target.registryUrl }),
@@ -341,14 +371,33 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
         const status = await dependencies.verifyService(spec);
         if (!status.running)
             throw new Error(`Service '${spec.id}' did not reach running state`);
-        return {
+        const result = {
             profile: target.profile,
             version: dependencies.version,
             serviceId: spec.id,
             running: true,
+            localHome: localHomeForTarget(target, dependencies.platform),
+            daemonHome: target.daemonHome,
+            agentsRoot: target.agentsRoot,
         };
+        await input.verifyAfterStart?.(result);
+        return result;
     }
     catch (error) {
+        try {
+            await input.beforeRollback?.();
+        }
+        catch (rollbackError) {
+            throw new Error(`${error.message}; local recovery blocked: ${rollbackError.message}. `
+                + computerSetupRecoveryGuidance({
+                    serverUrl: target.serverUrl,
+                    workspaceId: input.workspaceId ?? "unknown",
+                    machineId: input.machineId ?? "unknown",
+                    profile: target.profile,
+                    serviceId: spec.id,
+                    daemonHome: target.daemonHome,
+                }), { cause: error });
+        }
         const failures = [];
         if (profileSaved) {
             try {

package/dist/automatic-install-target.js

@@ -4,6 +4,14 @@ import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
 import { resolveDaemonLocalHome } from "./daemon-local-home.js";
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
 const KNOWN_TARGETS = {
+    // Canonical production hostname. Keep the internal hostname below as a
+    // compatibility alias so existing profiles and service identities continue
+    // to work when users move between the two URLs.
+    "nowwork.nowcoder.com": {
+        environment: "production",
+        daemonDirectory: "daemon",
+        agentsDirectory: "agents",
+    },
     "nowwork-in.nowcoder.com": {
         environment: "production",
         daemonDirectory: "daemon",

package/dist/computer-main.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { detectDaemonLang, formatDaemonText } from "./i18n.js";
+import { runComputerSetupCommand, setupUsage } from "./computer-setup.js";
+import { redactSetupSecrets } from "./computer-setup-client.js";
+async function main() {
+    const result = await runComputerSetupCommand(process.argv.slice(2));
+    if (result !== null) {
+        process.exitCode = result;
+        return;
+    }
+    const lang = detectDaemonLang();
+    process.stderr.write(`${formatDaemonText(lang, "Usage:")}\n${setupUsage((message, values) => formatDaemonText(lang, message, values))}`);
+    process.exitCode = 2;
+}
+main().catch((error) => {
+    process.stderr.write(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+    process.exitCode = 1;
+});

package/dist/computer-profile.js

@@ -21,6 +21,8 @@ const ProfileFields = z.object({
     name: z.string().regex(PROFILE_NAME),
     serverUrl: ServerUrlSchema,
     machineToken: MachineTokenSchema,
+    workspaceId: z.string().uuid().optional(),
+    machineId: z.string().uuid().optional(),
     agentsRoot: z.string().min(1).optional(),
     runtimePath: z.string().min(1).max(32768).refine((value) => !value.includes("\0") && !value.includes("\n") && !value.includes("\r"), "runtimePath must be a single line").optional(),
     releaseTag: z.enum(["latest", "beta"]).optional(),
@@ -258,6 +260,8 @@ export async function saveProfile(input, home = daemonHome(), options = {}) {
                 version: 1,
                 name: profile.name,
                 serverUrl: profile.serverUrl,
+                ...(profile.workspaceId === undefined ? {} : { workspaceId: profile.workspaceId }),
+                ...(profile.machineId === undefined ? {} : { machineId: profile.machineId }),
                 ...(profile.agentsRoot ? { agentsRoot: profile.agentsRoot } : {}),
                 ...(profile.runtimePath ? { runtimePath: profile.runtimePath } : {}),
                 ...(profile.releaseTag === undefined ? {} : { releaseTag: profile.releaseTag }),
@@ -302,6 +306,8 @@ export async function loadProfile(name, home = daemonHome(), options = {}) {
                 version: stored.version,
                 name: stored.name,
                 serverUrl: stored.serverUrl,
+                ...(stored.workspaceId === undefined ? {} : { workspaceId: stored.workspaceId }),
+                ...(stored.machineId === undefined ? {} : { machineId: stored.machineId }),
                 ...(stored.agentsRoot ? { agentsRoot: stored.agentsRoot } : {}),
                 ...(stored.runtimePath ? { runtimePath: stored.runtimePath } : {}),
                 ...(stored.releaseTag === undefined ? {} : { releaseTag: stored.releaseTag }),
@@ -388,6 +394,8 @@ export function publicProfile(profile) {
         name: profile.name,
         serverUrl: profile.serverUrl,
         machineTokenConfigured: true,
+        ...(profile.workspaceId === undefined ? {} : { workspaceId: profile.workspaceId }),
+        ...(profile.machineId === undefined ? {} : { machineId: profile.machineId }),
         ...(profile.agentsRoot ? { agentsRoot: profile.agentsRoot } : {}),
     };
 }

package/dist/computer-setup-client.js

@@ -0,0 +1,318 @@
+import { z } from "zod";
+import { hostname } from "node:os";
+import { MachineTokenSchema } from "./computer-profile.js";
+import { systemCommandRunner, } from "./computer-service.js";
+const HttpUrlSchema = z.string().url().refine((value) => {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:")
+        && url.username.length === 0
+        && url.password.length === 0;
+}, "expected an HTTP(S) URL without embedded credentials");
+const ServerOriginSchema = HttpUrlSchema.refine((value) => {
+    const url = new URL(value);
+    return (url.pathname === "" || url.pathname === "/")
+        && url.search.length === 0
+        && url.hash.length === 0;
+}, "expected a server origin without a path, query, or hash");
+const SetupStartSchema = z.object({
+    deviceCode: z.string().min(16).max(512),
+    userCode: z.string().min(4).max(128),
+    verificationUri: HttpUrlSchema,
+    expiresAt: z.string().datetime({ offset: true }),
+    intervalSeconds: z.number().int().positive().max(300),
+}).strict();
+const SetupBootstrapSchema = z.object({
+    setupId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    workspaceSlug: z.string().min(1).max(80).optional(),
+    machineId: z.string().uuid(),
+    serverUrl: ServerOriginSchema,
+    environment: z.string().min(1).max(64),
+    environmentId: z.string().min(1).max(128).optional(),
+    profile: z.string().min(1).max(128),
+    minimumConnectionEpoch: z.number().int().nonnegative(),
+    daemonVersion: z.string().min(1).max(128).optional(),
+    releaseTag: z.enum(["latest", "beta"]).optional(),
+    registryUrl: HttpUrlSchema.optional(),
+    storageId: z.string().min(1).max(256).optional(),
+    expiresAt: z.string().datetime({ offset: true }).optional(),
+    machineToken: MachineTokenSchema,
+}).strict();
+const SetupPendingSchema = z.object({
+    status: z.enum(["authorization_pending", "pending"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupSlowDownSchema = z.object({
+    status: z.literal("slow_down"),
+    intervalSeconds: z.number().int().positive().max(300),
+}).strict();
+const SetupDeniedSchema = z.object({
+    status: z.enum(["access_denied", "denied"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupExpiredSchema = z.object({
+    status: z.enum(["expired_token", "expired"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupReadySchema = z.object({
+    status: z.literal("ready"),
+    machineId: z.string().uuid(),
+    workspaceId: z.string().min(1).max(256),
+    environment: z.string().min(1).max(64),
+    profile: z.string().min(1).max(128),
+    storageId: z.string().min(1).max(256).optional(),
+    daemonHome: z.string().min(1).max(32768),
+    agentsRoot: z.string().min(1).max(32768),
+}).strict();
+export class ComputerSetupHttpError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.name = "ComputerSetupHttpError";
+        this.status = status;
+        this.code = code;
+    }
+}
+export function redactSetupSecrets(value, secrets = []) {
+    let redacted = value.replace(/\bsk_machine_[A-Za-z0-9_-]+\b/gu, "<redacted>");
+    for (const secret of secrets) {
+        if (secret.length > 0)
+            redacted = redacted.replaceAll(secret, "<redacted>");
+    }
+    return redacted;
+}
+export function computerSetupRecoveryGuidance(target) {
+    const localTarget = [
+        ...(target.profile === undefined ? [] : [`profile '${target.profile}'`]),
+        ...(target.serviceId === undefined ? [] : [`service '${target.serviceId}'`]),
+        ...(target.daemonHome === undefined ? [] : [`daemon home '${target.daemonHome}'`]),
+    ];
+    return `Local profile/service state was preserved${localTarget.length === 0 ? "" : ` for ${localTarget.join(", ")}`}. `
+        + `Do not restore old credentials. Check Computer '${target.machineId}' in Workspace '${target.workspaceId}' `
+        + `on ${target.serverUrl}. Resolve the reported error and check connectivity, then rerun nowwork-computer setup to reconcile the installation.`;
+}
+function normalizeServerUrl(value) {
+    const parsed = new URL(ServerOriginSchema.parse(value));
+    return `${parsed.protocol}//${parsed.host}`;
+}
+function pathForMachine(machineId, suffix) {
+    return `/api/machines/${encodeURIComponent(machineId)}/setup/${suffix}`;
+}
+function parseBootstrap(raw) {
+    const value = (raw !== null && typeof raw === "object" && "bootstrap" in raw)
+        ? raw.bootstrap
+        : raw;
+    const candidate = value !== null && typeof value === "object"
+        ? (() => {
+            const record = value;
+            const { token: legacyToken, ...rest } = record;
+            return {
+                ...rest,
+                ...(rest.machineToken === undefined && typeof legacyToken === "string"
+                    ? { machineToken: legacyToken }
+                    : {}),
+            };
+        })()
+        : value;
+    const parsed = SetupBootstrapSchema.parse(candidate);
+    return {
+        setupId: parsed.setupId,
+        workspaceId: parsed.workspaceId,
+        ...(parsed.workspaceSlug === undefined ? {} : { workspaceSlug: parsed.workspaceSlug }),
+        machineId: parsed.machineId,
+        serverUrl: parsed.serverUrl,
+        environment: parsed.environment,
+        profile: parsed.profile,
+        minimumConnectionEpoch: parsed.minimumConnectionEpoch,
+        machineToken: parsed.machineToken,
+        ...(parsed.environmentId === undefined ? {} : { environmentId: parsed.environmentId }),
+        ...(parsed.daemonVersion === undefined ? {} : { daemonVersion: parsed.daemonVersion }),
+        ...(parsed.releaseTag === undefined ? {} : { releaseTag: parsed.releaseTag }),
+        ...(parsed.registryUrl === undefined ? {} : { registryUrl: parsed.registryUrl }),
+        ...(parsed.storageId === undefined ? {} : { storageId: parsed.storageId }),
+        ...(parsed.expiresAt === undefined ? {} : { expiresAt: parsed.expiresAt }),
+    };
+}
+function parseStart(raw) {
+    return SetupStartSchema.parse(raw);
+}
+function parsePoll(raw) {
+    if (raw !== null && typeof raw === "object" && "status" in raw
+        && raw.status === "authorized") {
+        const record = raw;
+        if ("bootstrap" in raw) {
+            return { status: "authorized", bootstrap: parseBootstrap(raw) };
+        }
+        if (record.target === undefined || typeof record.token !== "string") {
+            throw new Error("Invalid authorized computer setup response");
+        }
+        return {
+            status: "authorized",
+            bootstrap: parseBootstrap({
+                ...record.target,
+                setupId: record.setupId,
+                machineToken: record.token,
+            }),
+        };
+    }
+    const pending = SetupPendingSchema.safeParse(raw);
+    if (pending.success) {
+        return {
+            status: "authorization_pending",
+            intervalSeconds: pending.data.intervalSeconds ?? 5,
+        };
+    }
+    const slowDown = SetupSlowDownSchema.safeParse(raw);
+    if (slowDown.success)
+        return slowDown.data;
+    const denied = SetupDeniedSchema.safeParse(raw);
+    if (denied.success) {
+        return {
+            status: "access_denied",
+            intervalSeconds: denied.data.intervalSeconds ?? 5,
+        };
+    }
+    const expired = SetupExpiredSchema.safeParse(raw);
+    if (expired.success) {
+        return {
+            status: "expired_token",
+            intervalSeconds: expired.data.intervalSeconds ?? 5,
+        };
+    }
+    throw new Error("Invalid computer setup polling response");
+}
+function parseHello(raw) {
+    if (raw !== null && typeof raw === "object" && "helloConfirmed" in raw
+        && raw.helloConfirmed === true) {
+        const value = raw;
+        const parsed = SetupReadySchema.parse({
+            status: "ready",
+            machineId: value.machineId,
+            workspaceId: value.workspaceId,
+            environment: value.environment,
+            profile: value.profile,
+            ...(value.storageId === undefined ? {} : { storageId: value.storageId }),
+            ...(value.daemonHome === undefined ? {} : { daemonHome: value.daemonHome }),
+            ...(value.agentsRoot === undefined ? {} : { agentsRoot: value.agentsRoot }),
+        });
+        return {
+            status: "ready",
+            machineId: parsed.machineId,
+            workspaceId: parsed.workspaceId,
+            environment: parsed.environment,
+            profile: parsed.profile,
+            ...(parsed.storageId === undefined ? {} : { storageId: parsed.storageId }),
+            daemonHome: parsed.daemonHome,
+            agentsRoot: parsed.agentsRoot,
+        };
+    }
+    const ready = SetupReadySchema.safeParse(raw);
+    if (ready.success) {
+        return {
+            status: "ready",
+            machineId: ready.data.machineId,
+            workspaceId: ready.data.workspaceId,
+            environment: ready.data.environment,
+            profile: ready.data.profile,
+            ...(ready.data.storageId === undefined ? {} : { storageId: ready.data.storageId }),
+            daemonHome: ready.data.daemonHome,
+            agentsRoot: ready.data.agentsRoot,
+        };
+    }
+    const pending = z.object({
+        status: z.literal("pending"),
+        intervalSeconds: z.number().int().positive().max(300).optional(),
+    }).safeParse(raw);
+    if (pending.success)
+        return { status: "pending", intervalSeconds: pending.data.intervalSeconds ?? 2 };
+    throw new Error("Invalid computer setup hello response");
+}
+export function createComputerSetupClient(options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const serverUrl = normalizeServerUrl(options.serverUrl);
+    const requestTimeoutMs = options.requestTimeoutMs ?? 15_000;
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => {
+        setTimeout(resolve, milliseconds);
+    }));
+    const now = options.now ?? Date.now;
+    let activeMachineId;
+    const request = async (method, path, body, bearer) => {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
+        try {
+            const response = await fetchImpl(`${serverUrl}${path}`, {
+                method,
+                headers: {
+                    ...(body === undefined ? {} : { "content-type": "application/json" }),
+                    ...(bearer === undefined ? {} : { authorization: `Bearer ${bearer}` }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: controller.signal,
+            });
+            const payload = await response.json();
+            if (!response.ok || payload?.success === false) {
+                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`);
+                throw new ComputerSetupHttpError(message, response.status, payload?.error?.code ?? `HTTP_${response.status}`);
+            }
+            return (payload?.success === true ? payload.data : payload);
+        }
+        catch (error) {
+            if (controller.signal.aborted)
+                throw new Error("computer setup request timed out");
+            if (error instanceof ComputerSetupHttpError)
+                throw error;
+            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error)));
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    };
+    return {
+        start: async (input) => {
+            activeMachineId = input.machineId;
+            return parseStart(await request("POST", "/api/auth/computer-setup/start", {
+                ...(input.workspace.kind === "id"
+                    ? { workspaceId: input.workspace.value }
+                    : { workspaceSlug: input.workspace.value }),
+                machineId: input.machineId,
+                deviceName: (input.deviceName ?? hostname()).trim().slice(0, 120) || "computer",
+                serverUrl,
+            }));
+        },
+        poll: async (deviceCode) => {
+            if (activeMachineId === undefined)
+                throw new Error("computer setup polling has no active machine");
+            return parsePoll(await request("POST", "/api/auth/computer-setup/poll", { deviceCode }));
+        },
+        waitForHello: async (input) => {
+            const timeoutMs = input.timeoutMs ?? 120_000;
+            const deadline = now() + timeoutMs;
+            for (;;) {
+                const status = parseHello(await request("GET", `/daemon/computer-setup/status?machine_id=${encodeURIComponent(input.machineId)}&workspace_id=${encodeURIComponent(input.workspaceId)}&profile=${encodeURIComponent(input.profile)}&setup_id=${encodeURIComponent(input.setupId)}&minimum_connection_epoch=${encodeURIComponent(String(input.minimumConnectionEpoch))}`, undefined, input.machineToken));
+                if (status.status === "ready")
+                    return status;
+                if (now() >= deadline)
+                    throw new Error("Timed out waiting for machine hello");
+                await sleep(Math.min(status.intervalSeconds * 1_000, Math.max(0, deadline - now())));
+            }
+        },
+        finalize: async (input) => {
+            const result = await request("POST", "/daemon/computer-setup/finalize", { setupId: input.setupId }, input.machineToken);
+            if (result?.finalized !== true)
+                throw new Error("computer setup credential finalization not confirmed");
+        },
+        rollback: async (input) => {
+            const result = await request("POST", "/daemon/computer-setup/rollback", { setupId: input.setupId }, input.machineToken);
+            return result.rolledBack === true;
+        },
+    };
+}
+export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
+    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = [url];
+    const result = await runner(command, args);
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);
+    }
+}

package/dist/computer-setup-orchestration.js

@@ -0,0 +1,203 @@
+import { computerSetupRecoveryGuidance, redactSetupSecrets, } from "./computer-setup-client.js";
+import { isProductionServerHostname, serverUrlsMatch } from "./server-url.js";
+import { posix, win32 } from "node:path";
+import { resolveAgentsRoot } from "./computer-profile.js";
+function safeError(error, machineToken) {
+    const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), machineToken === undefined ? [] : [machineToken]);
+    return new Error(message, error instanceof Error ? { cause: error } : undefined);
+}
+function assertBootstrapMatches(bootstrap, input) {
+    if (bootstrap.machineId !== input.args.machineId) {
+        throw new Error("setup bootstrap machine does not match --machine");
+    }
+    const workspaceMatches = input.args.workspace.kind === "id"
+        ? input.args.workspace.value === bootstrap.workspaceId
+        : bootstrap.workspaceSlug !== undefined && input.args.workspace.value === bootstrap.workspaceSlug;
+    if (!workspaceMatches)
+        throw new Error("setup bootstrap Workspace does not match the requested Workspace");
+    const bootstrapUrl = new URL(bootstrap.serverUrl);
+    const requestedUrl = new URL(input.serverUrl);
+    if (!serverUrlsMatch(bootstrapUrl.origin, requestedUrl.origin)) {
+        throw new Error("setup bootstrap server does not match the requested server context");
+    }
+    const hostname = bootstrapUrl.hostname.toLowerCase();
+    const knownEnvironment = hostname === "nowwork-dev.nowcoder.com"
+        ? "dev"
+        : isProductionServerHostname(hostname)
+            ? "production"
+            : null;
+    if (knownEnvironment !== null) {
+        const expectedReleaseTag = knownEnvironment === "dev" ? "beta" : "latest";
+        if (bootstrap.environment !== knownEnvironment) {
+            throw new Error("setup bootstrap environment does not match the server hostname");
+        }
+        if (bootstrap.releaseTag !== undefined && bootstrap.releaseTag !== expectedReleaseTag) {
+            throw new Error("setup bootstrap release tag does not match the server hostname");
+        }
+    }
+}
+function secondsUntil(expiresAt, now) {
+    const remaining = Date.parse(expiresAt) - now();
+    return Math.max(0, Math.ceil(remaining / 1_000));
+}
+function localPathsMatch(left, right, platform) {
+    const paths = platform === "win32" ? win32 : posix;
+    if (!paths.isAbsolute(left) || !paths.isAbsolute(right))
+        return false;
+    const normalize = (value) => {
+        const resolved = resolveAgentsRoot(value, undefined, platform);
+        return platform === "win32" ? win32.normalize(resolved).toLocaleLowerCase("en-US") : resolved;
+    };
+    return normalize(left) === normalize(right);
+}
+async function obtainBootstrap(input, deps) {
+    const pairing = await deps.client.start({
+        workspace: input.args.workspace,
+        machineId: input.args.machineId,
+    });
+    deps.reportPairing(`Open ${pairing.verificationUri}`);
+    deps.reportPairing(`Code ${pairing.userCode}`);
+    try {
+        await deps.openBrowser(pairing.verificationUri);
+    }
+    catch (error) {
+        deps.reportPairing(`Browser open skipped: ${redactSetupSecrets(error.message)}`);
+    }
+    let intervalSeconds = pairing.intervalSeconds;
+    for (;;) {
+        const remainingSeconds = secondsUntil(pairing.expiresAt, deps.now);
+        if (remainingSeconds <= 0)
+            throw new Error("computer setup pairing expired");
+        await deps.sleep(Math.min(intervalSeconds * 1_000, remainingSeconds * 1_000));
+        const result = await deps.client.poll(pairing.deviceCode);
+        if (result.status === "authorization_pending" || result.status === "slow_down") {
+            intervalSeconds = result.intervalSeconds;
+            continue;
+        }
+        if (result.status === "access_denied")
+            throw new Error("computer setup pairing was denied");
+        if (result.status === "expired_token")
+            throw new Error("computer setup pairing expired");
+        return result.bootstrap;
+    }
+}
+export async function runComputerSetupOrchestration(input, deps) {
+    let machineToken;
+    let bootstrap;
+    let credentialFinalized = false;
+    let verifiedStorageId;
+    let rollbackAttempt;
+    const confirmRollback = () => {
+        // Reuse both success and failure so an outer catch cannot change the recovery decision.
+        rollbackAttempt ??= (async () => {
+            if (credentialFinalized)
+                throw new Error("computer setup credentials already finalized");
+            if (bootstrap === undefined || machineToken === undefined)
+                throw new Error("computer setup credentials unavailable");
+            for (let attempt = 0;; attempt += 1) {
+                try {
+                    const confirmed = await deps.client.rollback({ setupId: bootstrap.setupId, machineToken });
+                    if (confirmed !== true)
+                        throw new Error("computer setup rollback not confirmed");
+                    return;
+                }
+                catch (error) {
+                    if (attempt >= 2)
+                        throw error;
+                    await deps.sleep(1_000);
+                }
+            }
+        })();
+        return rollbackAttempt;
+    };
+    try {
+        const authorized = await obtainBootstrap(input, deps);
+        const token = authorized.machineToken;
+        bootstrap = authorized;
+        machineToken = token;
+        assertBootstrapMatches(authorized, input);
+        const installation = await deps.installAutomatically({
+            serverUrl: authorized.serverUrl,
+            machineToken: token,
+            workspaceId: authorized.workspaceId,
+            machineId: authorized.machineId,
+            ...(authorized.profile === undefined ? {} : { requestedProfile: authorized.profile }),
+            ...(authorized.releaseTag === "latest" || authorized.releaseTag === "beta"
+                ? { requestedReleaseTag: authorized.releaseTag }
+                : {}),
+            ...(authorized.registryUrl === undefined ? {} : { requestedRegistryUrl: authorized.registryUrl }),
+            beforeRollback: confirmRollback,
+            verifyAfterStart: async (candidate) => {
+                const hello = await deps.client.waitForHello({
+                    machineToken: token,
+                    machineId: authorized.machineId,
+                    workspaceId: authorized.workspaceId,
+                    profile: candidate.profile,
+                    setupId: authorized.setupId,
+                    minimumConnectionEpoch: authorized.minimumConnectionEpoch,
+                });
+                if (hello.machineId !== authorized.machineId)
+                    throw new Error("machine hello identity mismatch");
+                if (hello.workspaceId !== authorized.workspaceId)
+                    throw new Error("machine hello workspace identity mismatch");
+                if (hello.environment !== authorized.environment)
+                    throw new Error("machine hello environment identity mismatch");
+                if (hello.profile !== candidate.profile)
+                    throw new Error("machine hello profile identity mismatch");
+                const platform = deps.platform ?? process.platform;
+                if (!localPathsMatch(hello.daemonHome, candidate.daemonHome, platform))
+                    throw new Error("machine hello daemon home mismatch");
+                if (!localPathsMatch(hello.agentsRoot, candidate.agentsRoot, platform))
+                    throw new Error("machine hello agents root mismatch");
+                if (authorized.storageId !== undefined && hello.storageId !== authorized.storageId) {
+                    throw new Error("machine hello storage identity mismatch");
+                }
+                verifiedStorageId = hello.storageId;
+                let finalizeError;
+                for (let attempt = 0; attempt < 3; attempt += 1) {
+                    try {
+                        await deps.client.finalize({ setupId: authorized.setupId, machineToken: token });
+                        credentialFinalized = true;
+                        finalizeError = undefined;
+                        break;
+                    }
+                    catch (error) {
+                        finalizeError = error;
+                        if (attempt < 2)
+                            await deps.sleep(1_000);
+                    }
+                }
+                if (!credentialFinalized) {
+                    throw finalizeError ?? new Error("computer setup credential finalization failed");
+                }
+            },
+        });
+        return {
+            workspaceId: authorized.workspaceId,
+            machineId: authorized.machineId,
+            environment: authorized.environment,
+            profile: installation.profile,
+            daemonVersion: installation.version,
+            serviceId: installation.serviceId,
+            serviceStatus: "running",
+            helloConfirmed: true,
+            ...(authorized.environmentId === undefined ? {} : { environmentId: authorized.environmentId }),
+            ...(verifiedStorageId === undefined ? {} : { storageId: verifiedStorageId }),
+            localNowworkHome: installation.localHome,
+            daemonHome: installation.daemonHome,
+            agentsRoot: installation.agentsRoot,
+        };
+    }
+    catch (error) {
+        if (bootstrap !== undefined && machineToken !== undefined && !credentialFinalized && rollbackAttempt === undefined) {
+            try {
+                await confirmRollback();
+            }
+            catch (rollbackError) {
+                error = new Error(`${error.message}; computer setup rollback failed: ${rollbackError.message}; `
+                    + `local recovery blocked. ${computerSetupRecoveryGuidance(bootstrap)}`, { cause: error });
+            }
+        }
+        throw safeError(error, machineToken);
+    }
+}

package/dist/computer-setup.js

@@ -0,0 +1,244 @@
+import { parseArgs } from "node:util";
+import { z } from "zod";
+import { DEFAULT_SERVER_URL } from "./config.js";
+import { installDaemonAutomatically, } from "./automatic-daemon-installer.js";
+import { createComputerSetupClient, openSetupBrowser, redactSetupSecrets, } from "./computer-setup-client.js";
+import { runComputerSetupOrchestration, } from "./computer-setup-orchestration.js";
+import { detectDaemonLang, formatDaemonText } from "./i18n.js";
+import { systemCommandRunner } from "./computer-service.js";
+const WorkspaceSlugSchema = z.string()
+    .min(2)
+    .max(40)
+    .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u);
+const WorkspaceIdSchema = z.string().uuid();
+const MachineIdSchema = z.string().uuid();
+const ServerUrlSchema = z.string().url().refine((value) => {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:")
+        && url.username.length === 0
+        && url.password.length === 0
+        && (url.pathname === "" || url.pathname === "/")
+        && url.search.length === 0
+        && url.hash.length === 0;
+}, "server URL must be an HTTP(S) origin without embedded credentials");
+function stringValue(values, key) {
+    const value = values[key];
+    return typeof value === "string" ? value : undefined;
+}
+function booleanValue(values, key) {
+    return values[key] === true;
+}
+function optionOccurrences(argv, name) {
+    const prefix = `--${name}`;
+    const values = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const value = argv[index];
+        if (value === prefix) {
+            const next = argv[index + 1];
+            if (next !== undefined && !next.startsWith("--"))
+                values.push(next);
+            index += 1;
+            continue;
+        }
+        if (value?.startsWith(`${prefix}=`))
+            values.push(value.slice(prefix.length + 1));
+    }
+    return values;
+}
+function assertRepeatedOptionValuesAgree(argv, name, normalize) {
+    const normalized = optionOccurrences(argv, name).map(normalize);
+    if (new Set(normalized).size > 1) {
+        throw new Error(`Repeated --${name} values conflict`);
+    }
+}
+function normalizedServerOrigin(value) {
+    const parsed = new URL(ServerUrlSchema.parse(value));
+    return `${parsed.protocol}//${parsed.host}`;
+}
+function workspaceFromSlug(value) {
+    if (!value.startsWith("/") || value.startsWith("//")) {
+        throw new Error("Workspace slug must use exactly one leading slash, for example /nowcoder-app");
+    }
+    return WorkspaceSlugSchema.parse(value.slice(1));
+}
+function workspaceFromAlias(value) {
+    return value.startsWith("/") ? workspaceFromSlug(value) : WorkspaceSlugSchema.parse(value);
+}
+export function parseSetupArgs(argv) {
+    assertRepeatedOptionValuesAgree(argv, "workspace", (value) => workspaceFromAlias(value));
+    assertRepeatedOptionValuesAgree(argv, "workspace-id", (value) => WorkspaceIdSchema.parse(value).toLowerCase());
+    assertRepeatedOptionValuesAgree(argv, "machine", (value) => MachineIdSchema.parse(value).toLowerCase());
+    assertRepeatedOptionValuesAgree(argv, "machine-id", (value) => MachineIdSchema.parse(value).toLowerCase());
+    assertRepeatedOptionValuesAgree(argv, "server-url", normalizedServerOrigin);
+    const parsed = parseArgs({
+        args: [...argv],
+        allowPositionals: true,
+        strict: true,
+        options: {
+            workspace: { type: "string" },
+            "workspace-id": { type: "string" },
+            machine: { type: "string" },
+            "machine-id": { type: "string" },
+            "server-url": { type: "string" },
+            json: { type: "boolean", default: false },
+            "no-browser": { type: "boolean", default: false },
+            help: { type: "boolean", short: "h", default: false },
+        },
+    });
+    const values = parsed.values;
+    const [command, ...positionals] = parsed.positionals;
+    if (command !== "setup")
+        throw new Error("Expected 'setup'");
+    if (booleanValue(values, "help"))
+        throw new Error(setupUsage());
+    if (positionals.length > 1)
+        throw new Error("Setup accepts one Workspace argument");
+    const workspaceAlias = stringValue(values, "workspace");
+    const workspaceIdAlias = stringValue(values, "workspace-id");
+    if (workspaceAlias !== undefined && workspaceIdAlias !== undefined) {
+        throw new Error("Choose one Workspace source: positional, --workspace, or --workspace-id");
+    }
+    const positionalWorkspace = positionals[0] === undefined ? undefined : workspaceFromSlug(positionals[0]);
+    const aliasWorkspace = workspaceAlias === undefined ? undefined : workspaceFromAlias(workspaceAlias);
+    if (positionalWorkspace !== undefined && workspaceIdAlias !== undefined) {
+        throw new Error("A positional Workspace slug cannot be combined with --workspace-id");
+    }
+    if (positionalWorkspace !== undefined && aliasWorkspace !== undefined && positionalWorkspace !== aliasWorkspace) {
+        throw new Error("Positional Workspace conflicts with --workspace");
+    }
+    const workspace = positionalWorkspace !== undefined
+        ? Object.freeze({ kind: "slug", value: positionalWorkspace })
+        : aliasWorkspace !== undefined
+            ? Object.freeze({ kind: "slug", value: aliasWorkspace })
+            : workspaceIdAlias === undefined
+                ? (() => { throw new Error("Missing Workspace; use /<slug> or --workspace-id <uuid>"); })()
+                : Object.freeze({ kind: "id", value: WorkspaceIdSchema.parse(workspaceIdAlias).toLowerCase() });
+    const machineAlias = stringValue(values, "machine");
+    const machineIdAlias = stringValue(values, "machine-id");
+    const parsedMachine = MachineIdSchema.parse(machineAlias ?? machineIdAlias ?? (() => {
+        throw new Error("Missing --machine <uuid>");
+    })()).toLowerCase();
+    if (machineAlias !== undefined && machineIdAlias !== undefined
+        && parsedMachine !== MachineIdSchema.parse(machineIdAlias).toLowerCase()) {
+        throw new Error("--machine conflicts with --machine-id");
+    }
+    const machineId = parsedMachine;
+    const serverUrl = stringValue(values, "server-url");
+    return Object.freeze({
+        command: "setup",
+        workspace,
+        machineId,
+        ...(serverUrl === undefined ? {} : { serverUrl: ServerUrlSchema.parse(serverUrl) }),
+        ...(booleanValue(values, "json") ? { json: true } : {}),
+        ...(booleanValue(values, "no-browser") ? { noBrowser: true } : {}),
+    });
+}
+function resolveSetupServerUrl(args, env) {
+    const configured = args.serverUrl ?? env.CREW_SERVER_URL?.trim();
+    if (configured !== undefined && configured.length > 0)
+        return normalizedServerOrigin(configured);
+    if (env.NODE_ENV === "development" || env.NODE_ENV === "test")
+        return DEFAULT_SERVER_URL;
+    throw new Error("server URL is required; pass --server-url or set CREW_SERVER_URL");
+}
+export function setupUsage(td = (message) => message) {
+    return [
+        td("Usage:"),
+        "  nowwork-computer setup /workspace --machine <uuid>",
+        "  nowwork-computer setup --workspace /workspace --machine <uuid>",
+        "  nowwork-computer setup --workspace-id <uuid> --machine-id <uuid>",
+        "",
+        "Options: --server-url <url> --json --no-browser",
+    ].join("\n") + "\n";
+}
+function defaults() {
+    return {
+        env: process.env,
+        platform: process.platform,
+        fetch: globalThis.fetch,
+        stdout: (text) => process.stdout.write(text),
+        stderr: (text) => process.stderr.write(text),
+        createClient: (serverUrl) => createComputerSetupClient({ serverUrl }),
+        installAutomatically: installDaemonAutomatically,
+        openBrowser: (url) => openSetupBrowser(url, process.platform, systemCommandRunner),
+        sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+        now: Date.now,
+    };
+}
+function humanSummary(result, td) {
+    return [
+        td("Workspace: {{value}}", { value: result.workspaceId }),
+        td("Machine:   {{value}}", { value: result.machineId }),
+        td("Environment: {{value}}", { value: result.environment }),
+        td("Daemon:    profile {{profile}} / v{{version}} / {{status}}", {
+            profile: result.profile, version: result.daemonVersion, status: result.serviceStatus,
+        }),
+        td("Local:     {{value}}", { value: result.localNowworkHome }),
+        td("Config:    {{value}}", { value: result.daemonHome }),
+        td("Agents:    {{value}}", { value: result.agentsRoot }),
+        ...(result.storageId === undefined ? [] : [td("Storage ID: {{value}}", { value: result.storageId })]),
+        td(result.helloConfirmed ? "Status:    connected and ready" : "Status:    not ready"),
+    ].join("\n") + "\n";
+}
+function localizedPairingMessage(lang, message) {
+    if (message.startsWith("Open ")) {
+        return formatDaemonText(lang, "Open {{url}}", { url: message.slice("Open ".length) });
+    }
+    if (message.startsWith("Code ")) {
+        return formatDaemonText(lang, "Code {{code}}", { code: message.slice("Code ".length) });
+    }
+    if (message.startsWith("Browser open skipped: ")) {
+        return formatDaemonText(lang, "Browser open skipped: {{reason}}", {
+            reason: message.slice("Browser open skipped: ".length),
+        });
+    }
+    return formatDaemonText(lang, message);
+}
+export async function runComputerSetupCommand(argv, overrides = {}) {
+    if (argv.length === 1 && (argv[0] === "--help" || argv[0] === "-h")) {
+        const deps = { ...defaults(), ...overrides };
+        const lang = detectDaemonLang(deps.env);
+        deps.stdout(setupUsage((message, values) => formatDaemonText(lang, message, values)));
+        return 0;
+    }
+    if (argv[0] !== "setup")
+        return null;
+    const deps = { ...defaults(), ...overrides };
+    const lang = detectDaemonLang(deps.env);
+    try {
+        if (argv.includes("--help") || argv.includes("-h")) {
+            deps.stdout(setupUsage((message, values) => formatDaemonText(lang, message, values)));
+            return 0;
+        }
+        let args;
+        try {
+            args = parseSetupArgs(argv);
+        }
+        catch (error) {
+            deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+            return 2;
+        }
+        if (args.json === true) {
+            deps.stderr(`${formatDaemonText(lang, "Starting computer setup pairing...")}\n`);
+        }
+        const serverUrl = resolveSetupServerUrl(args, deps.env);
+        const createClient = overrides.createClient
+            ?? ((value) => createComputerSetupClient({ serverUrl: value, fetch: deps.fetch }));
+        const result = await runComputerSetupOrchestration({ args, serverUrl }, {
+            client: createClient(serverUrl),
+            installAutomatically: deps.installAutomatically,
+            openBrowser: args.noBrowser === true ? async () => { } : deps.openBrowser,
+            sleep: deps.sleep,
+            reportPairing: (message) => deps[args.json === true ? "stderr" : "stdout"](`${localizedPairingMessage(lang, message)}\n`),
+            now: deps.now,
+        });
+        deps.stdout(args.json === true
+            ? `${JSON.stringify(result)}\n`
+            : humanSummary(result, (message, values) => formatDaemonText(lang, message, values)));
+        return 0;
+    }
+    catch (error) {
+        deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+        return 1;
+    }
+}

package/dist/i18n.js

@@ -31,6 +31,20 @@ const zh = {
     "Run finished": "本轮结束",
     "Missing CREW_MACHINE_TOKEN (sk_machine_*, printed by seed)": "缺少 CREW_MACHINE_TOKEN（sk_machine_*，由 seed 打印）",
     "Usage:": "用法：",
+    "Open {{url}}": "打开 {{url}}",
+    "Code {{code}}": "验证码 {{code}}",
+    "Browser open skipped: {{reason}}": "未能自动打开浏览器：{{reason}}",
+    "Starting computer setup pairing...": "正在发起电脑接入授权…",
+    "Workspace: {{value}}": "工作区：{{value}}",
+    "Machine:   {{value}}": "机器：   {{value}}",
+    "Environment: {{value}}": "环境：{{value}}",
+    "Daemon:    profile {{profile}} / v{{version}} / {{status}}": "Daemon：配置 {{profile}} / v{{version}} / {{status}}",
+    "Local:     {{value}}": "本地目录：{{value}}",
+    "Config:    {{value}}": "配置目录：{{value}}",
+    "Agents:    {{value}}": "Agent 目录：{{value}}",
+    "Storage ID: {{value}}": "存储标识：{{value}}",
+    "Status:    connected and ready": "状态：已连接并就绪",
+    "Status:    not ready": "状态：尚未就绪",
     "connect and stay resident": "连接并常驻",
     "run once manually": "手动运行一次",
     "resident, connecting to": "常驻，连接到",

package/dist/message-file-preview.js

@@ -10,6 +10,7 @@ import { isInternalEnvironmentPath } from "./workspace-fs.js";
 import { opaqueKey, safeKey } from "./workspace.js";
 import { AgentHandleSchema } from "./execution-protocol.js";
 const MAX_BYTES = 256 * 1024;
+const MAX_BINARY_BYTES = 8 * 1024 * 1024;
 const MAX_CONCURRENT_READS = 4;
 let activeReads = 0;
 export const SharedFileRequestSchema = z.object({
@@ -182,7 +183,10 @@ async function readCandidate(candidate) {
         if (current.dev !== opened.dev || current.ino !== opened.ino || !current.isFile() || current.nlink !== 1n) {
             throw new SharedFileError("file_changed");
         }
-        const buffer = Buffer.alloc(MAX_BYTES);
+        const knownBinary = /\.(?:xlsx|xls|pdf|png|jpe?g|gif|webp|zip|docx|pptx)$/iu.test(candidate.path);
+        if (knownBinary && opened.size > BigInt(MAX_BINARY_BYTES))
+            throw new SharedFileError("file_too_large");
+        const buffer = Buffer.alloc(knownBinary ? Number(opened.size) : MAX_BYTES);
         let length = 0;
         while (length < buffer.length) {
             const read = await handle.read(buffer, length, buffer.length - length, length);
@@ -197,9 +201,12 @@ async function readCandidate(candidate) {
             throw new SharedFileError("file_changed");
         }
         const bytes = buffer.subarray(0, length);
-        if (bytes.includes(0))
-            throw new SharedFileError("file_binary");
         const truncated = opened.size > BigInt(length);
+        if (bytes.includes(0) || knownBinary) {
+            if (truncated)
+                throw new SharedFileError("file_too_large");
+            return { path: relative(candidate.root, candidate.path).split(sep).join("/"), content: bytes.toString("base64"), encoding: "base64", size: Number(opened.size), truncated };
+        }
         let content;
         try {
             content = new TextDecoder("utf-8", { fatal: true }).decode(bytes, { stream: truncated });

package/dist/server-url.js

@@ -0,0 +1,25 @@
+const CANONICAL_PRODUCTION_HOST = "nowwork.nowcoder.com";
+const PRODUCTION_HOST_ALIASES = new Set([
+    CANONICAL_PRODUCTION_HOST,
+    "nowwork-in.nowcoder.com",
+]);
+function canonicalHostname(hostname) {
+    const normalized = hostname.toLowerCase();
+    return isProductionServerHostname(normalized) ? CANONICAL_PRODUCTION_HOST : normalized;
+}
+export function isProductionServerHostname(hostname) {
+    return PRODUCTION_HOST_ALIASES.has(hostname.toLowerCase());
+}
+/** Host identity used by profile/service guards; the public and internal production names are aliases. */
+export function serverHostIdentity(serverUrl) {
+    return canonicalHostname(new URL(serverUrl).hostname);
+}
+/** URL identity used by storage records; preserve path/port/query while collapsing production host aliases. */
+export function serverUrlIdentity(serverUrl) {
+    const parsed = new URL(serverUrl);
+    parsed.hostname = canonicalHostname(parsed.hostname);
+    return parsed.toString().replace(/\/+$/u, "");
+}
+export function serverUrlsMatch(left, right) {
+    return serverUrlIdentity(left) === serverUrlIdentity(right);
+}

package/dist/slog.js

@@ -16,6 +16,7 @@ import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
 import { resolveDaemonLocalStateRoot } from "./daemon-local-home.js";
+import { isProductionServerHostname } from "./server-url.js";
 const FLUSH_INTERVAL_MS = 1500;
 const BATCH_SIZE = 50;
 const SPOOL_MAX_FILES = 50; // spool 目录文件数上限,超出丢最旧(日志非关键数据,防无限膨胀)
@@ -30,7 +31,7 @@ let lastErrorAt = 0;
 let exitHookInstalled = false;
 let localStateRoot;
 function deploymentEnvironment(serverHost) {
-    if (serverHost === "nowwork-in.nowcoder.com")
+    if (serverHost !== undefined && isProductionServerHostname(serverHost))
         return "prod";
     if (serverHost === "nowwork-dev.nowcoder.com")
         return "dev";

package/dist/storage-runtime.js

@@ -2,12 +2,12 @@ import { findInstallationForProfile, readInstallations, resolveLocalStorageRoots
 import { storageHelloIdentity } from "./storage-identity.js";
 import { storageLayout } from "./storage-layout.js";
 import { readStorageOwnershipClaim, resolveWorkspaceStorageOwnershipClaim, } from "./storage-ownership.js";
-const canonicalServerUrl = (value) => value.replace(/\/+$/u, "");
+import { serverUrlsMatch } from "./server-url.js";
 export function resolveStorageRuntime(input) {
     const installation = findInstallationForProfile(input.records, input.profile);
     if (installation === null)
         return null;
-    if (canonicalServerUrl(installation.serverUrl) !== canonicalServerUrl(input.serverUrl)) {
+    if (!serverUrlsMatch(installation.serverUrl, input.serverUrl)) {
         throw new Error("installation server identity does not match the active profile");
     }
     const local = resolveLocalStorageRoots({

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.88-beta.29",
+  "version": "0.6.88-beta.30",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
   "bin": {
-    "crew-daemon": "./dist/main.js"
+    "daemon": "./dist/main.js",
+    "crew-daemon": "./dist/main.js",
+    "nowwork-computer": "./dist/computer-main.js"
   },
   "files": [
     "dist"