@nowcrew/daemon 0.6.88 → 0.6.90

package/dist/supervised-runtime.js

@@ -1,7 +1,7 @@
 import { fileURLToPath } from "node:url";
 import { startDormantSupervisor, } from "./execution-supervisor.js";
 import { buildClaudeLaunch } from "./runtimes/claude.js";
-import { DEEPSEEK_HARNESS_CONFIG_ENV, deepSeekHarnessConfigPath, } from "./runtimes/deepseek-harness.js";
+import { DEEPSEEK_HARNESS_CONFIG_ENV, deepSeekHarnessConfigPath, deepSeekHarnessLauncher, } from "./runtimes/deepseek-harness.js";
 import { RuntimeCancelledError } from "./runtime-cancellation.js";
 export function supervisorLaunch(request) {
     const common = {
@@ -82,7 +82,22 @@ export function supervisorLaunch(request) {
     if (request.runtime === "deepseek-harness") {
         if (request.resume)
             throw new Error("DeepSeek Harness ACP does not support session resume");
-        const configPath = deepSeekHarnessConfigPath();
+        const launcher = deepSeekHarnessLauncher(request.env);
+        if (launcher.kind === "profile") {
+            return {
+                command: process.execPath,
+                args: [fileURLToPath(new URL("./runtimes/deepseek-harness-runner.js", import.meta.url)),
+                    "--bin", request.bin, ...(launcher.patchPath ? ["--patch", launcher.patchPath] : [])],
+                cwd: request.cwd, env: request.env,
+                stdinText: JSON.stringify({ systemPrompt: request.systemPrompt, wakePrompt: request.wakePrompt,
+                    stateRoot: request.harnessStateRoot ?? request.cwd, skillRoots: request.harnessSkillRoots ?? [],
+                    effectivePermission: request.effectivePermission }),
+            };
+        }
+        if ((request.harnessSkillRoots?.length ?? 0) > 0) {
+            throw new Error("DeepSeek Harness bound Skills require the modern dsh ACP profile");
+        }
+        const configPath = deepSeekHarnessConfigPath(request.env);
         if (configPath === null) {
             throw new Error(`${DEEPSEEK_HARNESS_CONFIG_ENV} must be an absolute path`);
         }

package/dist/token.js

@@ -1,4 +1,3 @@
-/** 用机器令牌为某 agent 换取 per-launch 的 sk_agent_*。 */
 export async function mintAgentToken(serverUrl, machineToken, handle, displayName, options = {}, fetchImpl = fetch) {
     const res = await fetchImpl(`${serverUrl}/daemon/agents/token`, {
         method: "POST",

package/dist/workspace-control-handler.js

@@ -0,0 +1,27 @@
+/** 控制面文件/技能查看的按需处理，独立于执行生命周期。 */
+import { join } from "node:path";
+import { readSharedMessageFile } from "./message-file-preview.js";
+import { listWorkspace, readWorkspaceFile } from "./workspace-fs.js";
+import { listSkills } from "./skills.js";
+import { listRuntimeModels } from "./list-models.js";
+export async function handleWorkspaceControlRequest(raw, agentsRoot, registry, models = listRuntimeModels) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const request = raw;
+    if (!["fs:list", "fs:read", "fs:read-shared", "skills:list", "probe-models"].includes(request.type))
+        return null;
+    if (typeof request.reqId !== "string" || request.reqId.length > 128)
+        return null;
+    try {
+        const root = join(agentsRoot, request.handle);
+        const data = request.type === "fs:read-shared" ? await readSharedMessageFile(agentsRoot, raw, registry)
+            : request.type === "fs:list" ? await listWorkspace(root, request.path)
+                : request.type === "fs:read" ? await readWorkspaceFile(root, request.path)
+                    : request.type === "skills:list" ? await listSkills(request.runtime)
+                        : { models: await models(request.runtime ?? "") };
+        return { type: "fs:result", reqId: request.reqId, ok: true, data };
+    }
+    catch (error) {
+        return { type: "fs:result", reqId: request.reqId, ok: false, error: request.type === "probe-models" ? "runtime_model_probe_failed" : error.message };
+    }
+}

package/dist/workspace-fs.js

@@ -3,21 +3,31 @@
  *
  * 安全铁律:
  *  - 所有路径都 resolve 后必须仍落在 agent 根内 (防 `..` / 符号链接逃逸)。
- *  - 隐藏内部目录与点文件 (.crew / .git / 任何 . 开头)。
+ *  - 列表隐藏点文件；内部环境快照始终不可列出或读取，包括链接别名。
  *  - 只回文本文件,二进制拒绝;单文件大小上限,超出截断。
  *  - 仅 list / read,无写删。
  */
-import { realpath, readdir, readFile, stat } from "node:fs/promises";
-import { join, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { realpath, readdir, lstat, open, stat } from "node:fs/promises";
+import { join, relative, resolve, sep } from "node:path";
 export class FsError extends Error {
 }
 const MAX_FILE_BYTES = 256 * 1024; // 单文件查看上限 256KB
 const HIDDEN = new Set([".crew", ".git", ".slock"]);
 const isHidden = (name) => name.startsWith(".") || HIDDEN.has(name);
+/** 该命名空间包含完整机器环境，只允许本地执行 harness 使用。 */
+export const isInternalEnvironmentPath = (path) => path.split(/[\\/]/u)
+    .some((part) => part.toLowerCase().startsWith(".environment-"));
+const assertViewablePath = (path) => {
+    if (isInternalEnvironmentPath(path))
+        throw new FsError("file_not_viewable");
+};
 /** 把相对路径安全解析到 root 内的绝对路径;越界抛错。realpath 兜底符号链接逃逸。 */
 async function safeResolve(root, rel) {
+    assertViewablePath(rel);
     const rootResolved = await realpath(root);
     const target = resolve(rootResolved, rel.replace(/^\/+/, ""));
+    assertViewablePath(target);
     const withSep = rootResolved.endsWith(sep) ? rootResolved : rootResolved + sep;
     if (target !== rootResolved && !target.startsWith(withSep)) {
         throw new FsError("path escapes workspace");
@@ -33,6 +43,7 @@ async function safeResolve(root, rel) {
     if (real !== rootResolved && !real.startsWith(withSep)) {
         throw new FsError("path escapes workspace (symlink)");
     }
+    assertViewablePath(real);
     return real;
 }
 /** 列出某目录 (相对 root)。隐藏点文件/内部目录;目录在前、按名排序。 */
@@ -51,13 +62,15 @@ export async function listWorkspace(root, rel) {
     for (const name of names) {
         if (isHidden(name))
             continue;
-        const full = join(dir, name);
+        const full = await safeResolve(root, relative(rootResolved, join(dir, name))).catch(() => null);
+        if (full === null)
+            continue;
         const s = await stat(full).catch(() => null);
         if (!s)
             continue;
         if (s.isDirectory())
             entries.push({ name, type: "dir" });
-        else if (s.isFile())
+        else if (s.isFile() && s.nlink === 1)
             entries.push({ name, type: "file", size: s.size });
     }
     entries.sort((a, b) => a.type !== b.type ? (a.type === "dir" ? -1 : 1) : a.name.localeCompare(b.name));
@@ -66,15 +79,53 @@ export async function listWorkspace(root, rel) {
 /** 读取某文本文件 (相对 root)。二进制/超大拒绝或截断。 */
 export async function readWorkspaceFile(root, rel) {
     const file = await safeResolve(root, rel);
-    const s = await stat(file).catch(() => null);
-    if (!s || !s.isFile())
+    const before = await lstat(file, { bigint: true }).catch(() => null);
+    if (!before?.isFile())
         throw new FsError("not a file");
-    const buf = await readFile(file);
-    // 二进制探测:含 NUL 即视为二进制
-    const sample = buf.subarray(0, Math.min(buf.length, 8192));
-    if (sample.includes(0))
-        throw new FsError("binary file not viewable");
-    const truncated = buf.length > MAX_FILE_BYTES;
-    const content = buf.subarray(0, MAX_FILE_BYTES).toString("utf8");
-    return { path: rel.replace(/^\/+/, ""), content, truncated, size: buf.length };
+    // 真实路径不能辨认硬链接的私有来源，因此拒绝多链接文件。
+    if (before.nlink !== 1n)
+        throw new FsError("file_not_viewable");
+    // macOS 原子拒绝父目录链接；Linux 在打开后额外核对句柄的真实路径。
+    const noFollow = process.platform === "darwin" ? 0x20000000 : (constants.O_NOFOLLOW ?? 0);
+    const handle = await open(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | noFollow)
+        .catch(() => { throw new FsError("file_not_viewable"); });
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== before.dev || opened.ino !== before.ino)
+            throw new FsError("file_changed");
+        if (process.platform === "linux") {
+            const actual = await realpath(`/proc/self/fd/${handle.fd}`);
+            assertViewablePath(actual);
+            if (actual !== file)
+                throw new FsError("file_changed");
+        }
+        if (await safeResolve(root, rel) !== file)
+            throw new FsError("file_changed");
+        const buffer = Buffer.alloc(MAX_FILE_BYTES);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+            if (bytesRead === 0)
+                break;
+            length += bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        const current = await lstat(file, { bigint: true });
+        if (await safeResolve(root, rel) !== file || !current.isFile() || current.nlink !== 1n
+            || current.dev !== opened.dev || current.ino !== opened.ino || after.nlink !== 1n
+            || after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs)
+            throw new FsError("file_changed");
+        const bytes = buffer.subarray(0, length);
+        if (bytes.subarray(0, Math.min(length, 8192)).includes(0))
+            throw new FsError("binary file not viewable");
+        return { path: rel.replace(/^\/+/, ""), content: bytes.toString("utf8"), truncated: opened.size > BigInt(length), size: Number(opened.size) };
+    }
+    catch (error) {
+        if (error instanceof FsError)
+            throw error;
+        throw new FsError("file_changed");
+    }
+    finally {
+        await handle.close();
+    }
 }

package/dist/workspace.js

@@ -205,7 +205,7 @@ export async function rotateAgentSession(sessionDir) {
  * 第一次准备工作区时写入;之后 agent 自己维护(系统提示词里有协议)。
  * 建 agent 时填了 description,则用它种子化 ## Role(否则留占位符,由 agent 自填)。
  */
-function memorySeed(handle, description) {
+export function memorySeed(handle, description) {
     const role = description?.trim()
         ? description.trim()
         : "（填写你的身份与职责，保持在几行以内。）";

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.88",
+  "version": "0.6.90",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
   "bin": {
-    "crew-daemon": "./dist/main.js"
+    "daemon": "./dist/main.js",
+    "crew-daemon": "./dist/main.js",
+    "nowwork-computer": "./dist/computer-main.js"
   },
   "files": [
     "dist"
@@ -18,9 +20,10 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
-    "@nowcrew/cli": "0.4.16",
+    "@nowcrew/cli": "0.4.17",
     "cross-spawn": "^7.0.6",
     "semver": "7.8.5",
+    "smol-toml": "1.8.0",
     "ws": "^8",
     "yaml": "^2.8.1",
     "zod": "^3.23.0"
@@ -40,7 +43,6 @@
   "scripts": {
     "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
     "build": "tsc -p tsconfig.json",
-    "codex-home:migrate": "tsx src/runtimes/codex-home-migration-cli.ts",
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   }

package/dist/codex-home-launch.js

@@ -1,7 +0,0 @@
-import { awaitWithCancellation } from "./runtime-cancellation.js";
-import { materializeDefaultCodexHome } from "./runtimes/codex-home.js";
-export async function materializePrivateCodexHome(input) {
-    if (input.runtime !== "codex" || input.mode !== "private")
-        return;
-    await awaitWithCancellation((input.materialize ?? materializeDefaultCodexHome)(input.homeDir, input.sourceHome, input.sessionId), input.cancellation);
-}

package/dist/codex-home-mode-controller.js

@@ -1,68 +0,0 @@
-import { z } from "zod";
-import { daemonHome, loadProfile, saveProfile } from "./computer-profile.js";
-const MessageSchema = z.object({
-    type: z.literal("daemon:codex-home-mode"),
-    operationId: z.string().uuid(),
-    mode: z.enum(["shared", "private"]),
-}).strict();
-export function createCodexHomeModeController(input) {
-    let running = null;
-    const handled = new Set();
-    const fail = (operationId, errorCode) => {
-        input.sendStatus({ type: "daemon:codex-home-mode-status", operationId, status: "failed", errorCode });
-    };
-    const execute = async (message) => {
-        if (input.profileName === undefined) {
-            fail(message.operationId, "profile_unavailable");
-            return;
-        }
-        if (input.isBusy()) {
-            fail(message.operationId, "busy");
-            return;
-        }
-        input.sendStatus({ type: "daemon:codex-home-mode-status", operationId: message.operationId, status: "saving" });
-        try {
-            const home = input.profileHome ?? daemonHome();
-            const profile = await loadProfile(input.profileName, home);
-            await saveProfile({ ...profile, codexHomeMode: message.mode }, home);
-        }
-        catch {
-            fail(message.operationId, "save_failed");
-            return;
-        }
-        input.sendStatus({ type: "daemon:codex-home-mode-status", operationId: message.operationId, status: "restarting" });
-        try {
-            const serviceSpec = await input.getServiceSpec();
-            if (serviceSpec === null) {
-                fail(message.operationId, "restart_failed");
-                return;
-            }
-            const handoff = input.scheduleRestart(serviceSpec);
-            void handoff.failed.then(() => fail(message.operationId, "restart_failed"), () => fail(message.operationId, "restart_failed"));
-        }
-        catch {
-            fail(message.operationId, "restart_failed");
-        }
-    };
-    return {
-        handle: async (raw) => {
-            const parsed = MessageSchema.safeParse(raw);
-            if (!parsed.success)
-                return false;
-            if (handled.has(parsed.data.operationId))
-                return true;
-            if (running !== null) {
-                fail(parsed.data.operationId, "busy");
-                handled.add(parsed.data.operationId);
-                return true;
-            }
-            running = execute(parsed.data).finally(() => {
-                handled.add(parsed.data.operationId);
-                running = null;
-            });
-            await running;
-            return true;
-        },
-        drain: async () => { await running; },
-    };
-}

package/dist/daemon-migration-controller.js

@@ -1,211 +0,0 @@
-import { createHash } from "node:crypto";
-import { cp, lstat, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, relative, resolve } from "node:path";
-import { z } from "zod";
-import { loadProfile } from "./computer-profile.js";
-import { builtDaemonEntry } from "./computer-cli.js";
-import { installDaemonAutomatically } from "./automatic-daemon-installer.js";
-import { buildServiceSpec, captureExactService, serviceStatus, systemCommandRunner } from "./computer-service.js";
-import { readManagedServiceRegistry } from "./managed-service-registry.js";
-import { uninstallManagedService } from "./managed-service-lifecycle.js";
-import { resolveAutomaticInstallTarget } from "./automatic-install-target.js";
-import { buildStorageMigrationMappings, createSafeServiceManifest, CredentialMaterialError, } from "./storage-migration-manifest.js";
-const MigrationMessageSchema = z.object({
-    type: z.literal("daemon:migrate"),
-    migrationId: z.string().uuid(),
-    targetProfile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/),
-    targetDaemonHome: z.string().min(1),
-    targetAgentsRoot: z.string().min(1),
-}).strict();
-function migrationBackupRoot(input, id) {
-    return resolve(input.backupRoot ?? resolve(input.userHome ?? homedir(), ".crew", "migration-backups"), id);
-}
-function legacyLocalHome(input) {
-    return resolve(input.userHome ?? homedir(), ".crew");
-}
-async function assertEmptyOrMissing(path) {
-    try {
-        const entries = await readdir(path);
-        if (entries.length > 0)
-            throw new Error(`target path is not empty: ${path}`);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-}
-async function hashedFiles(root, directory = root) {
-    const entries = await readdir(directory, { withFileTypes: true });
-    const files = [];
-    for (const entry of entries) {
-        const path = resolve(directory, entry.name);
-        const stat = await lstat(path);
-        if (stat.isSymbolicLink())
-            throw new Error(`backup source contains a symbolic link: ${relative(root, path)}`);
-        if (stat.isDirectory())
-            files.push(...await hashedFiles(root, path));
-        else if (stat.isFile())
-            files.push({ path: relative(root, path), sha256: createHash("sha256").update(await readFile(path)).digest("hex") });
-    }
-    return files;
-}
-async function backupAndCopy(input, id, targetHome, targetAgents, service) {
-    // Validate and project service identity before creating any backup bytes. A descriptor containing
-    // a token must stop the migration before it can be copied into the local backup root.
-    const safeService = createSafeServiceManifest({
-        spec: service.spec,
-        snapshot: service.snapshot,
-        managedRecord: service.managedRecord,
-    });
-    const backup = migrationBackupRoot(input, id);
-    await mkdir(backup, { recursive: true, mode: 0o700 });
-    await cp(input.currentDaemonHome, resolve(backup, "daemon-home"), { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, resolve(backup, "agents-root"), { recursive: true, force: false });
-    await cp(input.currentDaemonHome, targetHome, { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, targetAgents, { recursive: true, force: false });
-    const daemonFiles = await hashedFiles(resolve(backup, "daemon-home"));
-    const agentFiles = await hashedFiles(resolve(backup, "agents-root"));
-    const mappings = buildStorageMigrationMappings({ daemonFiles, agentFiles });
-    await writeFile(resolve(backup, "manifest.json"), `${JSON.stringify({
-        version: 2,
-        migrationId: id,
-        profile: input.profileName,
-        daemonHome: input.currentDaemonHome,
-        agentsRoot: input.currentAgentsRoot,
-        service: safeService,
-        mappings,
-    }, null, 2)}\n`, { mode: 0o600 });
-    return backup;
-}
-async function cleanupCurrentServiceDefault(spec, input) {
-    const userHome = input.userHome ?? homedir();
-    const records = await readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) });
-    const record = records.find((candidate) => candidate.profile === spec.profile && candidate.daemonHome === input.currentDaemonHome);
-    if (record !== undefined && (spec.platform === "darwin" || spec.platform === "linux")) {
-        await uninstallManagedService({ spec, record, runner: systemCommandRunner, registry: { userHome, localHome: legacyLocalHome(input) } });
-        return;
-    }
-    // Windows and legacy descriptors are handled by the normal CLI/service lifecycle.
-    const { uninstallService } = await import("./computer-service.js");
-    const status = await serviceStatus(spec, systemCommandRunner);
-    if (status.installed)
-        await uninstallService(spec, systemCommandRunner);
-}
-export function createDaemonMigrationController(input) {
-    const handled = new Set();
-    let running = null;
-    const sendFailure = (id, errorCode, error) => {
-        input.sendStatus({ type: "daemon:migration-status", migrationId: id, status: "failed", errorCode, errorMessage: error instanceof Error ? error.message : String(error) });
-    };
-    const execute = async (raw) => {
-        const parsed = MigrationMessageSchema.safeParse(raw);
-        if (!parsed.success)
-            return false;
-        const message = parsed.data;
-        if (handled.has(message.migrationId))
-            return true;
-        if (running !== null) {
-            sendFailure(message.migrationId, "target_conflict", new Error("another migration is already running"));
-            return true;
-        }
-        running = (async () => {
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "preflight" });
-            if (input.isBusy()) {
-                sendFailure(message.migrationId, "runtime_busy", new Error("active executions must finish before migration"));
-                return;
-            }
-            const platform = input.platform ?? process.platform;
-            const userHome = input.userHome ?? homedir();
-            let targetPath;
-            let targetAgents;
-            let currentSpec;
-            let currentService;
-            let managedRecord = null;
-            let currentRegistryUrl;
-            try {
-                const currentProfile = await (input.loadCurrentProfile ?? loadProfile)(input.profileName, input.currentDaemonHome);
-                if (currentProfile.machineToken !== input.machineToken)
-                    throw new Error("active profile token does not match this daemon");
-                currentRegistryUrl = currentProfile.registryUrl;
-                const target = resolveAutomaticInstallTarget({
-                    serverUrl: input.serverUrl,
-                    requestedProfile: message.targetProfile,
-                    userHome,
-                    platform,
-                    // Layout migration creates the canonical service in the new local-home
-                    // root. Source registry and rollback material remain under legacy .crew.
-                    requestedLocalHomeMode: "nowwork",
-                });
-                if (!isAbsolute(message.targetDaemonHome) || !isAbsolute(message.targetAgentsRoot)
-                    || resolve(message.targetDaemonHome) !== resolve(target.daemonHome)
-                    || resolve(message.targetAgentsRoot) !== resolve(target.agentsRoot))
-                    throw new Error("requested target does not match the standard profile layout");
-                targetPath = resolve(target.daemonHome);
-                targetAgents = resolve(target.agentsRoot);
-                await assertEmptyOrMissing(targetPath);
-                await assertEmptyOrMissing(targetAgents);
-                currentSpec = buildServiceSpec({ platform, profile: input.profileName, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: input.currentDaemonHome });
-                const exact = await (input.captureCurrentService ?? ((spec) => captureExactService(spec, systemCommandRunner)))(currentSpec);
-                if (!exact.installed || !exact.running || !exact.exact)
-                    throw new Error("current managed service identity is not exact and running");
-                currentService = { installed: exact.installed, running: exact.running };
-                if (platform === "darwin" || platform === "linux") {
-                    const records = await (input.readManagedRecords ?? (() => readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) })))();
-                    managedRecord = records.find((record) => record.serviceId === currentSpec.id && record.profile === input.profileName && record.daemonHome === input.currentDaemonHome) ?? null;
-                    if (managedRecord === null)
-                        throw new Error("current managed service registry record is missing");
-                }
-            }
-            catch (error) {
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "target_conflict", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "backing_up" });
-            let backupPath;
-            try {
-                backupPath = await backupAndCopy(input, message.migrationId, targetPath, targetAgents, { spec: currentSpec, snapshot: currentService, managedRecord });
-                input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "installing", backupPath });
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "backup_failed", error);
-                return;
-            }
-            const install = input.install ?? installDaemonAutomatically;
-            try {
-                const result = await install({
-                    serverUrl: input.serverUrl,
-                    machineToken: input.machineToken,
-                    requestedProfile: message.targetProfile,
-                    requestedLocalHomeMode: "nowwork",
-                    ...(currentRegistryUrl === undefined ? {} : { requestedRegistryUrl: currentRegistryUrl }),
-                });
-                if (result.profile !== message.targetProfile || result.serviceId.length === 0) {
-                    throw new Error("target service identity did not match the requested profile");
-                }
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, "install_failed", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "restarting" });
-            try {
-                await (input.cleanupCurrentService ?? ((spec) => cleanupCurrentServiceDefault(spec, input)))(currentSpec);
-            }
-            catch (error) {
-                const targetSpec = buildServiceSpec({ platform, profile: message.targetProfile, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: targetPath });
-                await (input.cleanupTargetService ?? ((spec) => cleanupCurrentServiceDefault(spec, { ...input, profileName: message.targetProfile, currentDaemonHome: targetPath })))(targetSpec).catch(() => undefined);
-                sendFailure(message.migrationId, "service_cleanup_failed", error);
-                return;
-            }
-        })().finally(() => {
-            handled.add(message.migrationId);
-            running = null;
-        });
-        await running;
-        return true;
-    };
-    return { handle: execute, drain: async () => { await running; } };
-}

package/dist/daemon-migration-wiring.js

@@ -1,22 +0,0 @@
-import { daemonHome } from "./computer-profile.js";
-import { createDaemonMigrationController } from "./daemon-migration-controller.js";
-export function createServeMigrationController(input) {
-    if (input.profileName === undefined)
-        return null;
-    return createDaemonMigrationController({
-        serverUrl: input.config.serverUrl,
-        machineToken: input.config.machineToken,
-        profileName: input.profileName,
-        currentDaemonHome: daemonHome(),
-        currentAgentsRoot: input.config.agentsRoot,
-        isBusy: input.isBusy,
-        sendStatus: input.sendStatus,
-    });
-}
-export async function handleMigrationControlMessage(controller, decoded) {
-    if (controller === null || typeof decoded !== "object" || decoded === null
-        || !("type" in decoded) || decoded.type !== "daemon:migrate")
-        return false;
-    await controller.handle(decoded);
-    return true;
-}

package/dist/runtimes/codex-home-migration-cli.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-import { parseArgs } from "node:util";
-import { migrateCodexHome } from "./codex-home-migration.js";
-const { values } = parseArgs({
-    args: process.argv.slice(2),
-    strict: true,
-    options: {
-        "agent-home": { type: "string" },
-        "source-home": { type: "string" },
-        "backup-root": { type: "string" },
-        yes: { type: "boolean", default: false },
-    },
-});
-function required(value, name) {
-    if (!value?.trim())
-        throw new Error(`Missing --${name}`);
-    return value;
-}
-if (!values.yes)
-    throw new Error("Refusing Codex home migration without --yes");
-const result = await migrateCodexHome({
-    agentHome: required(values["agent-home"], "agent-home"),
-    sourceHome: required(values["source-home"], "source-home"),
-    backupRoot: required(values["backup-root"], "backup-root"),
-});
-process.stdout.write(`${result.status}${result.backupDir ? ` backup=${result.backupDir}` : ""}\n`);