@nowcrew/daemon 0.6.89 → 0.6.90

package/dist/workspace-fs.js

@@ -3,21 +3,31 @@
  *
  * 安全铁律:
  *  - 所有路径都 resolve 后必须仍落在 agent 根内 (防 `..` / 符号链接逃逸)。
- *  - 隐藏内部目录与点文件 (.crew / .git / 任何 . 开头)。
+ *  - 列表隐藏点文件；内部环境快照始终不可列出或读取，包括链接别名。
  *  - 只回文本文件,二进制拒绝;单文件大小上限,超出截断。
  *  - 仅 list / read,无写删。
  */
-import { realpath, readdir, readFile, stat } from "node:fs/promises";
-import { join, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { realpath, readdir, lstat, open, stat } from "node:fs/promises";
+import { join, relative, resolve, sep } from "node:path";
 export class FsError extends Error {
 }
 const MAX_FILE_BYTES = 256 * 1024; // 单文件查看上限 256KB
 const HIDDEN = new Set([".crew", ".git", ".slock"]);
 const isHidden = (name) => name.startsWith(".") || HIDDEN.has(name);
+/** 该命名空间包含完整机器环境，只允许本地执行 harness 使用。 */
+export const isInternalEnvironmentPath = (path) => path.split(/[\\/]/u)
+    .some((part) => part.toLowerCase().startsWith(".environment-"));
+const assertViewablePath = (path) => {
+    if (isInternalEnvironmentPath(path))
+        throw new FsError("file_not_viewable");
+};
 /** 把相对路径安全解析到 root 内的绝对路径;越界抛错。realpath 兜底符号链接逃逸。 */
 async function safeResolve(root, rel) {
+    assertViewablePath(rel);
     const rootResolved = await realpath(root);
     const target = resolve(rootResolved, rel.replace(/^\/+/, ""));
+    assertViewablePath(target);
     const withSep = rootResolved.endsWith(sep) ? rootResolved : rootResolved + sep;
     if (target !== rootResolved && !target.startsWith(withSep)) {
         throw new FsError("path escapes workspace");
@@ -33,6 +43,7 @@ async function safeResolve(root, rel) {
     if (real !== rootResolved && !real.startsWith(withSep)) {
         throw new FsError("path escapes workspace (symlink)");
     }
+    assertViewablePath(real);
     return real;
 }
 /** 列出某目录 (相对 root)。隐藏点文件/内部目录;目录在前、按名排序。 */
@@ -51,13 +62,15 @@ export async function listWorkspace(root, rel) {
     for (const name of names) {
         if (isHidden(name))
             continue;
-        const full = join(dir, name);
+        const full = await safeResolve(root, relative(rootResolved, join(dir, name))).catch(() => null);
+        if (full === null)
+            continue;
         const s = await stat(full).catch(() => null);
         if (!s)
             continue;
         if (s.isDirectory())
             entries.push({ name, type: "dir" });
-        else if (s.isFile())
+        else if (s.isFile() && s.nlink === 1)
             entries.push({ name, type: "file", size: s.size });
     }
     entries.sort((a, b) => a.type !== b.type ? (a.type === "dir" ? -1 : 1) : a.name.localeCompare(b.name));
@@ -66,15 +79,53 @@ export async function listWorkspace(root, rel) {
 /** 读取某文本文件 (相对 root)。二进制/超大拒绝或截断。 */
 export async function readWorkspaceFile(root, rel) {
     const file = await safeResolve(root, rel);
-    const s = await stat(file).catch(() => null);
-    if (!s || !s.isFile())
+    const before = await lstat(file, { bigint: true }).catch(() => null);
+    if (!before?.isFile())
         throw new FsError("not a file");
-    const buf = await readFile(file);
-    // 二进制探测:含 NUL 即视为二进制
-    const sample = buf.subarray(0, Math.min(buf.length, 8192));
-    if (sample.includes(0))
-        throw new FsError("binary file not viewable");
-    const truncated = buf.length > MAX_FILE_BYTES;
-    const content = buf.subarray(0, MAX_FILE_BYTES).toString("utf8");
-    return { path: rel.replace(/^\/+/, ""), content, truncated, size: buf.length };
+    // 真实路径不能辨认硬链接的私有来源，因此拒绝多链接文件。
+    if (before.nlink !== 1n)
+        throw new FsError("file_not_viewable");
+    // macOS 原子拒绝父目录链接；Linux 在打开后额外核对句柄的真实路径。
+    const noFollow = process.platform === "darwin" ? 0x20000000 : (constants.O_NOFOLLOW ?? 0);
+    const handle = await open(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | noFollow)
+        .catch(() => { throw new FsError("file_not_viewable"); });
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== before.dev || opened.ino !== before.ino)
+            throw new FsError("file_changed");
+        if (process.platform === "linux") {
+            const actual = await realpath(`/proc/self/fd/${handle.fd}`);
+            assertViewablePath(actual);
+            if (actual !== file)
+                throw new FsError("file_changed");
+        }
+        if (await safeResolve(root, rel) !== file)
+            throw new FsError("file_changed");
+        const buffer = Buffer.alloc(MAX_FILE_BYTES);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+            if (bytesRead === 0)
+                break;
+            length += bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        const current = await lstat(file, { bigint: true });
+        if (await safeResolve(root, rel) !== file || !current.isFile() || current.nlink !== 1n
+            || current.dev !== opened.dev || current.ino !== opened.ino || after.nlink !== 1n
+            || after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs)
+            throw new FsError("file_changed");
+        const bytes = buffer.subarray(0, length);
+        if (bytes.subarray(0, Math.min(length, 8192)).includes(0))
+            throw new FsError("binary file not viewable");
+        return { path: rel.replace(/^\/+/, ""), content: bytes.toString("utf8"), truncated: opened.size > BigInt(length), size: Number(opened.size) };
+    }
+    catch (error) {
+        if (error instanceof FsError)
+            throw error;
+        throw new FsError("file_changed");
+    }
+    finally {
+        await handle.close();
+    }
 }

package/dist/workspace.js

@@ -205,7 +205,7 @@ export async function rotateAgentSession(sessionDir) {
  * 第一次准备工作区时写入;之后 agent 自己维护(系统提示词里有协议)。
  * 建 agent 时填了 description,则用它种子化 ## Role(否则留占位符,由 agent 自填)。
  */
-function memorySeed(handle, description) {
+export function memorySeed(handle, description) {
     const role = description?.trim()
         ? description.trim()
         : "（填写你的身份与职责，保持在几行以内。）";

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.89",
+  "version": "0.6.90",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
   "bin": {
-    "crew-daemon": "./dist/main.js"
+    "daemon": "./dist/main.js",
+    "crew-daemon": "./dist/main.js",
+    "nowwork-computer": "./dist/computer-main.js"
   },
   "files": [
     "dist"
@@ -16,19 +18,12 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "codex-home:migrate": "tsx src/runtimes/codex-home-migration-cli.ts",
-    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
-    "@nowcrew/cli": "0.4.16",
+    "@nowcrew/cli": "0.4.17",
     "cross-spawn": "^7.0.6",
     "semver": "7.8.5",
+    "smol-toml": "1.8.0",
     "ws": "^8",
     "yaml": "^2.8.1",
     "zod": "^3.23.0"
@@ -44,5 +39,11 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
-}
+}

package/dist/codex-home-launch.js

@@ -1,7 +0,0 @@
-import { awaitWithCancellation } from "./runtime-cancellation.js";
-import { materializeDefaultCodexHome } from "./runtimes/codex-home.js";
-export async function materializePrivateCodexHome(input) {
-    if (input.runtime !== "codex" || input.mode !== "private")
-        return;
-    await awaitWithCancellation((input.materialize ?? materializeDefaultCodexHome)(input.homeDir, input.sourceHome, input.sessionId), input.cancellation);
-}

package/dist/codex-home-mode-controller.js

@@ -1,68 +0,0 @@
-import { z } from "zod";
-import { daemonHome, loadProfile, saveProfile } from "./computer-profile.js";
-const MessageSchema = z.object({
-    type: z.literal("daemon:codex-home-mode"),
-    operationId: z.string().uuid(),
-    mode: z.enum(["shared", "private"]),
-}).strict();
-export function createCodexHomeModeController(input) {
-    let running = null;
-    const handled = new Set();
-    const fail = (operationId, errorCode) => {
-        input.sendStatus({ type: "daemon:codex-home-mode-status", operationId, status: "failed", errorCode });
-    };
-    const execute = async (message) => {
-        if (input.profileName === undefined) {
-            fail(message.operationId, "profile_unavailable");
-            return;
-        }
-        if (input.isBusy()) {
-            fail(message.operationId, "busy");
-            return;
-        }
-        input.sendStatus({ type: "daemon:codex-home-mode-status", operationId: message.operationId, status: "saving" });
-        try {
-            const home = input.profileHome ?? daemonHome();
-            const profile = await loadProfile(input.profileName, home);
-            await saveProfile({ ...profile, codexHomeMode: message.mode }, home);
-        }
-        catch {
-            fail(message.operationId, "save_failed");
-            return;
-        }
-        input.sendStatus({ type: "daemon:codex-home-mode-status", operationId: message.operationId, status: "restarting" });
-        try {
-            const serviceSpec = await input.getServiceSpec();
-            if (serviceSpec === null) {
-                fail(message.operationId, "restart_failed");
-                return;
-            }
-            const handoff = input.scheduleRestart(serviceSpec);
-            void handoff.failed.then(() => fail(message.operationId, "restart_failed"), () => fail(message.operationId, "restart_failed"));
-        }
-        catch {
-            fail(message.operationId, "restart_failed");
-        }
-    };
-    return {
-        handle: async (raw) => {
-            const parsed = MessageSchema.safeParse(raw);
-            if (!parsed.success)
-                return false;
-            if (handled.has(parsed.data.operationId))
-                return true;
-            if (running !== null) {
-                fail(parsed.data.operationId, "busy");
-                handled.add(parsed.data.operationId);
-                return true;
-            }
-            running = execute(parsed.data).finally(() => {
-                handled.add(parsed.data.operationId);
-                running = null;
-            });
-            await running;
-            return true;
-        },
-        drain: async () => { await running; },
-    };
-}

package/dist/daemon-migration-controller.js

@@ -1,211 +0,0 @@
-import { createHash } from "node:crypto";
-import { cp, lstat, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, relative, resolve } from "node:path";
-import { z } from "zod";
-import { loadProfile } from "./computer-profile.js";
-import { builtDaemonEntry } from "./computer-cli.js";
-import { installDaemonAutomatically } from "./automatic-daemon-installer.js";
-import { buildServiceSpec, captureExactService, serviceStatus, systemCommandRunner } from "./computer-service.js";
-import { readManagedServiceRegistry } from "./managed-service-registry.js";
-import { uninstallManagedService } from "./managed-service-lifecycle.js";
-import { resolveAutomaticInstallTarget } from "./automatic-install-target.js";
-import { buildStorageMigrationMappings, createSafeServiceManifest, CredentialMaterialError, } from "./storage-migration-manifest.js";
-const MigrationMessageSchema = z.object({
-    type: z.literal("daemon:migrate"),
-    migrationId: z.string().uuid(),
-    targetProfile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/),
-    targetDaemonHome: z.string().min(1),
-    targetAgentsRoot: z.string().min(1),
-}).strict();
-function migrationBackupRoot(input, id) {
-    return resolve(input.backupRoot ?? resolve(input.userHome ?? homedir(), ".crew", "migration-backups"), id);
-}
-function legacyLocalHome(input) {
-    return resolve(input.userHome ?? homedir(), ".crew");
-}
-async function assertEmptyOrMissing(path) {
-    try {
-        const entries = await readdir(path);
-        if (entries.length > 0)
-            throw new Error(`target path is not empty: ${path}`);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-}
-async function hashedFiles(root, directory = root) {
-    const entries = await readdir(directory, { withFileTypes: true });
-    const files = [];
-    for (const entry of entries) {
-        const path = resolve(directory, entry.name);
-        const stat = await lstat(path);
-        if (stat.isSymbolicLink())
-            throw new Error(`backup source contains a symbolic link: ${relative(root, path)}`);
-        if (stat.isDirectory())
-            files.push(...await hashedFiles(root, path));
-        else if (stat.isFile())
-            files.push({ path: relative(root, path), sha256: createHash("sha256").update(await readFile(path)).digest("hex") });
-    }
-    return files;
-}
-async function backupAndCopy(input, id, targetHome, targetAgents, service) {
-    // Validate and project service identity before creating any backup bytes. A descriptor containing
-    // a token must stop the migration before it can be copied into the local backup root.
-    const safeService = createSafeServiceManifest({
-        spec: service.spec,
-        snapshot: service.snapshot,
-        managedRecord: service.managedRecord,
-    });
-    const backup = migrationBackupRoot(input, id);
-    await mkdir(backup, { recursive: true, mode: 0o700 });
-    await cp(input.currentDaemonHome, resolve(backup, "daemon-home"), { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, resolve(backup, "agents-root"), { recursive: true, force: false });
-    await cp(input.currentDaemonHome, targetHome, { recursive: true, force: false });
-    await cp(input.currentAgentsRoot, targetAgents, { recursive: true, force: false });
-    const daemonFiles = await hashedFiles(resolve(backup, "daemon-home"));
-    const agentFiles = await hashedFiles(resolve(backup, "agents-root"));
-    const mappings = buildStorageMigrationMappings({ daemonFiles, agentFiles });
-    await writeFile(resolve(backup, "manifest.json"), `${JSON.stringify({
-        version: 2,
-        migrationId: id,
-        profile: input.profileName,
-        daemonHome: input.currentDaemonHome,
-        agentsRoot: input.currentAgentsRoot,
-        service: safeService,
-        mappings,
-    }, null, 2)}\n`, { mode: 0o600 });
-    return backup;
-}
-async function cleanupCurrentServiceDefault(spec, input) {
-    const userHome = input.userHome ?? homedir();
-    const records = await readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) });
-    const record = records.find((candidate) => candidate.profile === spec.profile && candidate.daemonHome === input.currentDaemonHome);
-    if (record !== undefined && (spec.platform === "darwin" || spec.platform === "linux")) {
-        await uninstallManagedService({ spec, record, runner: systemCommandRunner, registry: { userHome, localHome: legacyLocalHome(input) } });
-        return;
-    }
-    // Windows and legacy descriptors are handled by the normal CLI/service lifecycle.
-    const { uninstallService } = await import("./computer-service.js");
-    const status = await serviceStatus(spec, systemCommandRunner);
-    if (status.installed)
-        await uninstallService(spec, systemCommandRunner);
-}
-export function createDaemonMigrationController(input) {
-    const handled = new Set();
-    let running = null;
-    const sendFailure = (id, errorCode, error) => {
-        input.sendStatus({ type: "daemon:migration-status", migrationId: id, status: "failed", errorCode, errorMessage: error instanceof Error ? error.message : String(error) });
-    };
-    const execute = async (raw) => {
-        const parsed = MigrationMessageSchema.safeParse(raw);
-        if (!parsed.success)
-            return false;
-        const message = parsed.data;
-        if (handled.has(message.migrationId))
-            return true;
-        if (running !== null) {
-            sendFailure(message.migrationId, "target_conflict", new Error("another migration is already running"));
-            return true;
-        }
-        running = (async () => {
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "preflight" });
-            if (input.isBusy()) {
-                sendFailure(message.migrationId, "runtime_busy", new Error("active executions must finish before migration"));
-                return;
-            }
-            const platform = input.platform ?? process.platform;
-            const userHome = input.userHome ?? homedir();
-            let targetPath;
-            let targetAgents;
-            let currentSpec;
-            let currentService;
-            let managedRecord = null;
-            let currentRegistryUrl;
-            try {
-                const currentProfile = await (input.loadCurrentProfile ?? loadProfile)(input.profileName, input.currentDaemonHome);
-                if (currentProfile.machineToken !== input.machineToken)
-                    throw new Error("active profile token does not match this daemon");
-                currentRegistryUrl = currentProfile.registryUrl;
-                const target = resolveAutomaticInstallTarget({
-                    serverUrl: input.serverUrl,
-                    requestedProfile: message.targetProfile,
-                    userHome,
-                    platform,
-                    // Layout migration creates the canonical service in the new local-home
-                    // root. Source registry and rollback material remain under legacy .crew.
-                    requestedLocalHomeMode: "nowwork",
-                });
-                if (!isAbsolute(message.targetDaemonHome) || !isAbsolute(message.targetAgentsRoot)
-                    || resolve(message.targetDaemonHome) !== resolve(target.daemonHome)
-                    || resolve(message.targetAgentsRoot) !== resolve(target.agentsRoot))
-                    throw new Error("requested target does not match the standard profile layout");
-                targetPath = resolve(target.daemonHome);
-                targetAgents = resolve(target.agentsRoot);
-                await assertEmptyOrMissing(targetPath);
-                await assertEmptyOrMissing(targetAgents);
-                currentSpec = buildServiceSpec({ platform, profile: input.profileName, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: input.currentDaemonHome });
-                const exact = await (input.captureCurrentService ?? ((spec) => captureExactService(spec, systemCommandRunner)))(currentSpec);
-                if (!exact.installed || !exact.running || !exact.exact)
-                    throw new Error("current managed service identity is not exact and running");
-                currentService = { installed: exact.installed, running: exact.running };
-                if (platform === "darwin" || platform === "linux") {
-                    const records = await (input.readManagedRecords ?? (() => readManagedServiceRegistry({ userHome, localHome: legacyLocalHome(input) })))();
-                    managedRecord = records.find((record) => record.serviceId === currentSpec.id && record.profile === input.profileName && record.daemonHome === input.currentDaemonHome) ?? null;
-                    if (managedRecord === null)
-                        throw new Error("current managed service registry record is missing");
-                }
-            }
-            catch (error) {
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "target_conflict", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "backing_up" });
-            let backupPath;
-            try {
-                backupPath = await backupAndCopy(input, message.migrationId, targetPath, targetAgents, { spec: currentSpec, snapshot: currentService, managedRecord });
-                input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "installing", backupPath });
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, error instanceof CredentialMaterialError ? "credential_material" : "backup_failed", error);
-                return;
-            }
-            const install = input.install ?? installDaemonAutomatically;
-            try {
-                const result = await install({
-                    serverUrl: input.serverUrl,
-                    machineToken: input.machineToken,
-                    requestedProfile: message.targetProfile,
-                    requestedLocalHomeMode: "nowwork",
-                    ...(currentRegistryUrl === undefined ? {} : { requestedRegistryUrl: currentRegistryUrl }),
-                });
-                if (result.profile !== message.targetProfile || result.serviceId.length === 0) {
-                    throw new Error("target service identity did not match the requested profile");
-                }
-            }
-            catch (error) {
-                await Promise.allSettled([rm(targetPath, { recursive: true, force: true }), rm(targetAgents, { recursive: true, force: true })]);
-                sendFailure(message.migrationId, "install_failed", error);
-                return;
-            }
-            input.sendStatus({ type: "daemon:migration-status", migrationId: message.migrationId, status: "restarting" });
-            try {
-                await (input.cleanupCurrentService ?? ((spec) => cleanupCurrentServiceDefault(spec, input)))(currentSpec);
-            }
-            catch (error) {
-                const targetSpec = buildServiceSpec({ platform, profile: message.targetProfile, userHome, uid: process.getuid?.(), nodePath: process.execPath, entryPath: builtDaemonEntry(), profileHome: targetPath });
-                await (input.cleanupTargetService ?? ((spec) => cleanupCurrentServiceDefault(spec, { ...input, profileName: message.targetProfile, currentDaemonHome: targetPath })))(targetSpec).catch(() => undefined);
-                sendFailure(message.migrationId, "service_cleanup_failed", error);
-                return;
-            }
-        })().finally(() => {
-            handled.add(message.migrationId);
-            running = null;
-        });
-        await running;
-        return true;
-    };
-    return { handle: execute, drain: async () => { await running; } };
-}

package/dist/daemon-migration-wiring.js

@@ -1,22 +0,0 @@
-import { daemonHome } from "./computer-profile.js";
-import { createDaemonMigrationController } from "./daemon-migration-controller.js";
-export function createServeMigrationController(input) {
-    if (input.profileName === undefined)
-        return null;
-    return createDaemonMigrationController({
-        serverUrl: input.config.serverUrl,
-        machineToken: input.config.machineToken,
-        profileName: input.profileName,
-        currentDaemonHome: daemonHome(),
-        currentAgentsRoot: input.config.agentsRoot,
-        isBusy: input.isBusy,
-        sendStatus: input.sendStatus,
-    });
-}
-export async function handleMigrationControlMessage(controller, decoded) {
-    if (controller === null || typeof decoded !== "object" || decoded === null
-        || !("type" in decoded) || decoded.type !== "daemon:migrate")
-        return false;
-    await controller.handle(decoded);
-    return true;
-}

package/dist/runtimes/codex-home-migration-cli.js

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-import { parseArgs } from "node:util";
-import { migrateCodexHome } from "./codex-home-migration.js";
-const { values } = parseArgs({
-    args: process.argv.slice(2),
-    strict: true,
-    options: {
-        "agent-home": { type: "string" },
-        "source-home": { type: "string" },
-        "backup-root": { type: "string" },
-        yes: { type: "boolean", default: false },
-    },
-});
-function required(value, name) {
-    if (!value?.trim())
-        throw new Error(`Missing --${name}`);
-    return value;
-}
-if (!values.yes)
-    throw new Error("Refusing Codex home migration without --yes");
-const result = await migrateCodexHome({
-    agentHome: required(values["agent-home"], "agent-home"),
-    sourceHome: required(values["source-home"], "source-home"),
-    backupRoot: required(values["backup-root"], "backup-root"),
-});
-process.stdout.write(`${result.status}${result.backupDir ? ` backup=${result.backupDir}` : ""}\n`);

package/dist/runtimes/codex-home-migration.js

@@ -1,112 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { lstat, mkdir, readlink, rename, rm, symlink, unlink, } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { randomUUID } from "node:crypto";
-import { atomicPrivateWrite } from "../atomic-private-write.js";
-import { defaultCodexHome, materializeDefaultCodexHome } from "./codex-home.js";
-const execFileAsync = promisify(execFile);
-const SQLITE_FILES = ["state_5.sqlite", "state_5.sqlite-wal", "state_5.sqlite-shm"];
-const MARKER_NAME = ".codex-home-migration.json";
-async function exists(path) {
-    try {
-        await lstat(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return false;
-        throw error;
-    }
-}
-async function assertNoOpenSqliteFiles(codexHome) {
-    for (const name of SQLITE_FILES) {
-        const path = join(codexHome, name);
-        if (!(await exists(path)))
-            continue;
-        try {
-            const result = await execFileAsync("lsof", ["-t", "--", path], { encoding: "utf8" });
-            if (result.stdout.trim()) {
-                throw new Error(`Codex SQLite file is still open: ${path}`);
-            }
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === 1)
-                continue;
-            if (code === "ENOENT")
-                throw new Error("lsof is required to verify Codex home quiescence");
-            throw error;
-        }
-    }
-}
-async function symlinkTarget(path) {
-    try {
-        const info = await lstat(path);
-        if (!info.isSymbolicLink())
-            return null;
-        return await readlink(path);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-export async function migrateCodexHome(input, dependencies = {}) {
-    const agentHome = resolve(input.agentHome);
-    const sourceHome = resolve(input.sourceHome);
-    const backupRoot = resolve(input.backupRoot);
-    const codexHome = defaultCodexHome(agentHome);
-    const sessions = join(codexHome, "sessions");
-    const index = join(codexHome, "session_index.jsonl");
-    const expectedSessions = resolve(sourceHome, "sessions");
-    const expectedIndex = resolve(sourceHome, "session_index.jsonl");
-    const marker = join(codexHome, MARKER_NAME);
-    const sessionLink = await symlinkTarget(sessions);
-    const indexLink = await symlinkTarget(index);
-    if (sessionLink === null && indexLink === null && await exists(marker)) {
-        return { status: "already-migrated" };
-    }
-    if (sessionLink === null || indexLink === null) {
-        throw new Error("Refusing migration: Codex home is not in the complete legacy symlink layout");
-    }
-    if (resolve(codexHome, sessionLink) !== expectedSessions || resolve(codexHome, indexLink) !== expectedIndex) {
-        throw new Error("Refusing migration: legacy symlinks do not point to the configured source home");
-    }
-    await (dependencies.ensureQuiesced ?? assertNoOpenSqliteFiles)(codexHome);
-    const stamp = (dependencies.now ?? (() => new Date()))().toISOString().replaceAll(/[^0-9]/g, "").slice(0, 14);
-    const backupDir = join(backupRoot, `${stamp}-${dependencies.id?.() ?? randomUUID()}`);
-    await mkdir(backupDir, { recursive: true, mode: 0o700 });
-    await symlink(sessionLink, join(backupDir, "sessions"), "dir");
-    await symlink(indexLink, join(backupDir, "session_index.jsonl"), "file");
-    const moved = [];
-    try {
-        for (const name of SQLITE_FILES) {
-            const current = join(codexHome, name);
-            if (await exists(current)) {
-                await rename(current, join(backupDir, name));
-                moved.push(name);
-            }
-        }
-        await materializeDefaultCodexHome(agentHome, sourceHome);
-        await atomicPrivateWrite(marker, JSON.stringify({
-            version: 1,
-            migrated_at: new Date().toISOString(),
-            source_home: sourceHome,
-            backup_dir: backupDir,
-        }) + "\n");
-        return { status: "migrated", backupDir };
-    }
-    catch (error) {
-        for (const name of moved.reverse()) {
-            await rename(join(backupDir, name), join(codexHome, name)).catch(() => undefined);
-        }
-        await rm(sessions, { recursive: true, force: true });
-        await unlink(index).catch(() => undefined);
-        await symlink(sessionLink, sessions, "dir").catch(() => undefined);
-        await symlink(indexLink, index, "file").catch(() => undefined);
-        throw error;
-    }
-}
-export const codexHomeMigrationMarkerName = MARKER_NAME;