@nowcrew/daemon 0.6.89 → 0.6.91-beta.1

package/dist/automatic-daemon-installer.js

@@ -1,5 +1,6 @@
 import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
+import { z } from "zod";
 import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
 import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
@@ -15,6 +16,7 @@ import { npmInvocation } from "./npm-command.js";
 import { discoverExactLegacyService, } from "./automatic-service-migration.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
 import { serverHostIdentity } from "./server-url.js";
+import { computerSetupRecoveryGuidance } from "./computer-setup-client.js";
 function profileStorage(platform, userHome, runner) {
     return {
         platform,
@@ -247,8 +249,33 @@ function recoveryError(primary, failures) {
         return original;
     return new Error(`${original.message}; recovery failed: ${failures.map((error) => error.message).join("; ")}`, { cause: original });
 }
+function setupIdentity(input) {
+    if (input.workspaceId === undefined && input.machineId === undefined)
+        return null;
+    if (input.workspaceId === undefined || input.machineId === undefined) {
+        throw new Error("Computer setup requires both Workspace and Machine identity");
+    }
+    return {
+        workspaceId: z.string().uuid().parse(input.workspaceId),
+        machineId: z.string().uuid().parse(input.machineId),
+    };
+}
+function assertExistingProfileIdentity(previous, identity) {
+    if (previous === null || identity === null)
+        return;
+    if (previous.workspaceId === undefined || previous.machineId === undefined) {
+        throw new Error(`Profile '${previous.name}' does not record its Workspace and Machine identity`);
+    }
+    if (previous.workspaceId !== identity.workspaceId) {
+        throw new Error(`Profile '${previous.name}' belongs to a different Workspace identity`);
+    }
+    if (previous.machineId !== identity.machineId) {
+        throw new Error(`Profile '${previous.name}' belongs to a different Machine identity`);
+    }
+}
 export async function installDaemonAutomatically(input, dependencies = defaultDependencies()) {
     const machineToken = MachineTokenSchema.parse(input.machineToken);
+    const identity = setupIdentity(input);
     const requestedLocalHome = input.requestedLocalHome ?? dependencies.environment.NOWWORK_LOCAL_HOME;
     const requestedLocalHomeMode = input.requestedLocalHomeMode
         ?? dependencies.environment.NOWWORK_LOCAL_HOME_MODE
@@ -281,6 +308,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
     });
     const previousProfile = await dependencies.captureProfile(target);
     await dependencies.assertProfileTarget(target, previousProfile);
+    assertExistingProfileIdentity(previousProfile, identity);
     const previousService = await dependencies.captureService(spec, target);
     if (previousService.installed && !previousService.exact) {
         throw new Error(`Installed service '${spec.id}' does not match the requested identity`);
@@ -331,6 +359,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
             name: target.profile,
             serverUrl: target.serverUrl,
             machineToken,
+            ...(identity === null ? {} : identity),
             agentsRoot: target.agentsRoot,
             releaseTag: target.releaseTag,
             ...(target.registryUrl === undefined ? {} : { registryUrl: target.registryUrl }),
@@ -342,14 +371,33 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
         const status = await dependencies.verifyService(spec);
         if (!status.running)
             throw new Error(`Service '${spec.id}' did not reach running state`);
-        return {
+        const result = {
             profile: target.profile,
             version: dependencies.version,
             serviceId: spec.id,
             running: true,
+            localHome: localHomeForTarget(target, dependencies.platform),
+            daemonHome: target.daemonHome,
+            agentsRoot: target.agentsRoot,
         };
+        await input.verifyAfterStart?.(result);
+        return result;
     }
     catch (error) {
+        try {
+            await input.beforeRollback?.();
+        }
+        catch (rollbackError) {
+            throw new Error(`${error.message}; local recovery blocked: ${rollbackError.message}. `
+                + computerSetupRecoveryGuidance({
+                    serverUrl: target.serverUrl,
+                    workspaceId: input.workspaceId ?? "unknown",
+                    machineId: input.machineId ?? "unknown",
+                    profile: target.profile,
+                    serviceId: spec.id,
+                    daemonHome: target.daemonHome,
+                }), { cause: error });
+        }
         const failures = [];
         if (profileSaved) {
             try {

package/dist/computer-main.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { detectDaemonLang, formatDaemonText } from "./i18n.js";
+import { runComputerSetupCommand, setupUsage } from "./computer-setup.js";
+import { redactSetupSecrets } from "./computer-setup-client.js";
+async function main() {
+    const result = await runComputerSetupCommand(process.argv.slice(2));
+    if (result !== null) {
+        process.exitCode = result;
+        return;
+    }
+    const lang = detectDaemonLang();
+    process.stderr.write(`${formatDaemonText(lang, "Usage:")}\n${setupUsage((message, values) => formatDaemonText(lang, message, values))}`);
+    process.exitCode = 2;
+}
+main().catch((error) => {
+    process.stderr.write(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+    process.exitCode = 1;
+});

package/dist/computer-profile.js

@@ -21,11 +21,12 @@ const ProfileFields = z.object({
     name: z.string().regex(PROFILE_NAME),
     serverUrl: ServerUrlSchema,
     machineToken: MachineTokenSchema,
+    workspaceId: z.string().uuid().optional(),
+    machineId: z.string().uuid().optional(),
     agentsRoot: z.string().min(1).optional(),
     runtimePath: z.string().min(1).max(32768).refine((value) => !value.includes("\0") && !value.includes("\n") && !value.includes("\r"), "runtimePath must be a single line").optional(),
     releaseTag: z.enum(["latest", "beta"]).optional(),
     registryUrl: z.string().url().optional(),
-    codexHomeMode: z.enum(["shared", "private"]).optional(),
 }).strict();
 function validateProfileRegistry(value, context) {
     const fields = value;
@@ -60,7 +61,13 @@ const StoredProtectedProfileSchema = ProfileFields.omit({ machineToken: true }).
         ciphertext: z.string().min(1).max(16384),
     }).strict(),
 }).strict().superRefine(validateProfileRegistry);
-const StoredProfileSchema = z.union([StoredPlainProfileSchema, StoredProtectedProfileSchema]);
+// 旧版本可能已保存 shared 字段；读取时丢弃退休设置，其余字段仍严格校验。
+const StoredProfileSchema = z.preprocess((raw) => {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return raw;
+    const { codexHomeMode: _retiredMode, ...fields } = raw;
+    return fields;
+}, z.union([StoredPlainProfileSchema, StoredProtectedProfileSchema]));
 export const PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE = "Profile '{{profile}}' conflicts with profile '{{conflict}}': both resolve to agents root '{{agentsRoot}}'. Save it with a unique root, for example: {{command}}";
 export class ProfileAgentsRootConflictError extends Error {
     profile;
@@ -253,11 +260,12 @@ export async function saveProfile(input, home = daemonHome(), options = {}) {
                 version: 1,
                 name: profile.name,
                 serverUrl: profile.serverUrl,
+                ...(profile.workspaceId === undefined ? {} : { workspaceId: profile.workspaceId }),
+                ...(profile.machineId === undefined ? {} : { machineId: profile.machineId }),
                 ...(profile.agentsRoot ? { agentsRoot: profile.agentsRoot } : {}),
                 ...(profile.runtimePath ? { runtimePath: profile.runtimePath } : {}),
                 ...(profile.releaseTag === undefined ? {} : { releaseTag: profile.releaseTag }),
                 ...(profile.registryUrl === undefined ? {} : { registryUrl: profile.registryUrl }),
-                ...(profile.codexHomeMode === undefined ? {} : { codexHomeMode: profile.codexHomeMode }),
                 machineTokenProtected: { scheme: "dpapi-current-user", ciphertext },
             });
             await atomicPrivateWrite(profilePath(profile.name, home), `${JSON.stringify(stored, null, 2)}\n`, configured.harden);
@@ -298,6 +306,8 @@ export async function loadProfile(name, home = daemonHome(), options = {}) {
                 version: stored.version,
                 name: stored.name,
                 serverUrl: stored.serverUrl,
+                ...(stored.workspaceId === undefined ? {} : { workspaceId: stored.workspaceId }),
+                ...(stored.machineId === undefined ? {} : { machineId: stored.machineId }),
                 ...(stored.agentsRoot ? { agentsRoot: stored.agentsRoot } : {}),
                 ...(stored.runtimePath ? { runtimePath: stored.runtimePath } : {}),
                 ...(stored.releaseTag === undefined ? {} : { releaseTag: stored.releaseTag }),
@@ -384,6 +394,8 @@ export function publicProfile(profile) {
         name: profile.name,
         serverUrl: profile.serverUrl,
         machineTokenConfigured: true,
+        ...(profile.workspaceId === undefined ? {} : { workspaceId: profile.workspaceId }),
+        ...(profile.machineId === undefined ? {} : { machineId: profile.machineId }),
         ...(profile.agentsRoot ? { agentsRoot: profile.agentsRoot } : {}),
     };
 }
@@ -404,5 +416,6 @@ export function applyProfileToEnv(profile, env) {
         env.CREW_NPM_REGISTRY = profile.registryUrl;
     else
         delete env.CREW_NPM_REGISTRY;
-    env.CREW_CODEX_HOME_MODE = profile.codexHomeMode ?? "shared";
+    // 不再向运行时传播退休的模式开关；CODEX_HOME 沿用用户环境。
+    delete env.CREW_CODEX_HOME_MODE;
 }

package/dist/computer-setup-client.js

@@ -0,0 +1,318 @@
+import { z } from "zod";
+import { hostname } from "node:os";
+import { MachineTokenSchema } from "./computer-profile.js";
+import { systemCommandRunner, } from "./computer-service.js";
+const HttpUrlSchema = z.string().url().refine((value) => {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:")
+        && url.username.length === 0
+        && url.password.length === 0;
+}, "expected an HTTP(S) URL without embedded credentials");
+const ServerOriginSchema = HttpUrlSchema.refine((value) => {
+    const url = new URL(value);
+    return (url.pathname === "" || url.pathname === "/")
+        && url.search.length === 0
+        && url.hash.length === 0;
+}, "expected a server origin without a path, query, or hash");
+const SetupStartSchema = z.object({
+    deviceCode: z.string().min(16).max(512),
+    userCode: z.string().min(4).max(128),
+    verificationUri: HttpUrlSchema,
+    expiresAt: z.string().datetime({ offset: true }),
+    intervalSeconds: z.number().int().positive().max(300),
+}).strict();
+const SetupBootstrapSchema = z.object({
+    setupId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    workspaceSlug: z.string().min(1).max(80).optional(),
+    machineId: z.string().uuid(),
+    serverUrl: ServerOriginSchema,
+    environment: z.string().min(1).max(64),
+    environmentId: z.string().min(1).max(128).optional(),
+    profile: z.string().min(1).max(128),
+    minimumConnectionEpoch: z.number().int().nonnegative(),
+    daemonVersion: z.string().min(1).max(128).optional(),
+    releaseTag: z.enum(["latest", "beta"]).optional(),
+    registryUrl: HttpUrlSchema.optional(),
+    storageId: z.string().min(1).max(256).optional(),
+    expiresAt: z.string().datetime({ offset: true }).optional(),
+    machineToken: MachineTokenSchema,
+}).strict();
+const SetupPendingSchema = z.object({
+    status: z.enum(["authorization_pending", "pending"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupSlowDownSchema = z.object({
+    status: z.literal("slow_down"),
+    intervalSeconds: z.number().int().positive().max(300),
+}).strict();
+const SetupDeniedSchema = z.object({
+    status: z.enum(["access_denied", "denied"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupExpiredSchema = z.object({
+    status: z.enum(["expired_token", "expired"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupReadySchema = z.object({
+    status: z.literal("ready"),
+    machineId: z.string().uuid(),
+    workspaceId: z.string().min(1).max(256),
+    environment: z.string().min(1).max(64),
+    profile: z.string().min(1).max(128),
+    storageId: z.string().min(1).max(256).optional(),
+    daemonHome: z.string().min(1).max(32768),
+    agentsRoot: z.string().min(1).max(32768),
+}).strict();
+export class ComputerSetupHttpError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.name = "ComputerSetupHttpError";
+        this.status = status;
+        this.code = code;
+    }
+}
+export function redactSetupSecrets(value, secrets = []) {
+    let redacted = value.replace(/\bsk_machine_[A-Za-z0-9_-]+\b/gu, "<redacted>");
+    for (const secret of secrets) {
+        if (secret.length > 0)
+            redacted = redacted.replaceAll(secret, "<redacted>");
+    }
+    return redacted;
+}
+export function computerSetupRecoveryGuidance(target) {
+    const localTarget = [
+        ...(target.profile === undefined ? [] : [`profile '${target.profile}'`]),
+        ...(target.serviceId === undefined ? [] : [`service '${target.serviceId}'`]),
+        ...(target.daemonHome === undefined ? [] : [`daemon home '${target.daemonHome}'`]),
+    ];
+    return `Local profile/service state was preserved${localTarget.length === 0 ? "" : ` for ${localTarget.join(", ")}`}. `
+        + `Do not restore old credentials. Check Computer '${target.machineId}' in Workspace '${target.workspaceId}' `
+        + `on ${target.serverUrl}. Resolve the reported error and check connectivity, then rerun nowwork-computer setup to reconcile the installation.`;
+}
+function normalizeServerUrl(value) {
+    const parsed = new URL(ServerOriginSchema.parse(value));
+    return `${parsed.protocol}//${parsed.host}`;
+}
+function pathForMachine(machineId, suffix) {
+    return `/api/machines/${encodeURIComponent(machineId)}/setup/${suffix}`;
+}
+function parseBootstrap(raw) {
+    const value = (raw !== null && typeof raw === "object" && "bootstrap" in raw)
+        ? raw.bootstrap
+        : raw;
+    const candidate = value !== null && typeof value === "object"
+        ? (() => {
+            const record = value;
+            const { token: legacyToken, ...rest } = record;
+            return {
+                ...rest,
+                ...(rest.machineToken === undefined && typeof legacyToken === "string"
+                    ? { machineToken: legacyToken }
+                    : {}),
+            };
+        })()
+        : value;
+    const parsed = SetupBootstrapSchema.parse(candidate);
+    return {
+        setupId: parsed.setupId,
+        workspaceId: parsed.workspaceId,
+        ...(parsed.workspaceSlug === undefined ? {} : { workspaceSlug: parsed.workspaceSlug }),
+        machineId: parsed.machineId,
+        serverUrl: parsed.serverUrl,
+        environment: parsed.environment,
+        profile: parsed.profile,
+        minimumConnectionEpoch: parsed.minimumConnectionEpoch,
+        machineToken: parsed.machineToken,
+        ...(parsed.environmentId === undefined ? {} : { environmentId: parsed.environmentId }),
+        ...(parsed.daemonVersion === undefined ? {} : { daemonVersion: parsed.daemonVersion }),
+        ...(parsed.releaseTag === undefined ? {} : { releaseTag: parsed.releaseTag }),
+        ...(parsed.registryUrl === undefined ? {} : { registryUrl: parsed.registryUrl }),
+        ...(parsed.storageId === undefined ? {} : { storageId: parsed.storageId }),
+        ...(parsed.expiresAt === undefined ? {} : { expiresAt: parsed.expiresAt }),
+    };
+}
+function parseStart(raw) {
+    return SetupStartSchema.parse(raw);
+}
+function parsePoll(raw) {
+    if (raw !== null && typeof raw === "object" && "status" in raw
+        && raw.status === "authorized") {
+        const record = raw;
+        if ("bootstrap" in raw) {
+            return { status: "authorized", bootstrap: parseBootstrap(raw) };
+        }
+        if (record.target === undefined || typeof record.token !== "string") {
+            throw new Error("Invalid authorized computer setup response");
+        }
+        return {
+            status: "authorized",
+            bootstrap: parseBootstrap({
+                ...record.target,
+                setupId: record.setupId,
+                machineToken: record.token,
+            }),
+        };
+    }
+    const pending = SetupPendingSchema.safeParse(raw);
+    if (pending.success) {
+        return {
+            status: "authorization_pending",
+            intervalSeconds: pending.data.intervalSeconds ?? 5,
+        };
+    }
+    const slowDown = SetupSlowDownSchema.safeParse(raw);
+    if (slowDown.success)
+        return slowDown.data;
+    const denied = SetupDeniedSchema.safeParse(raw);
+    if (denied.success) {
+        return {
+            status: "access_denied",
+            intervalSeconds: denied.data.intervalSeconds ?? 5,
+        };
+    }
+    const expired = SetupExpiredSchema.safeParse(raw);
+    if (expired.success) {
+        return {
+            status: "expired_token",
+            intervalSeconds: expired.data.intervalSeconds ?? 5,
+        };
+    }
+    throw new Error("Invalid computer setup polling response");
+}
+function parseHello(raw) {
+    if (raw !== null && typeof raw === "object" && "helloConfirmed" in raw
+        && raw.helloConfirmed === true) {
+        const value = raw;
+        const parsed = SetupReadySchema.parse({
+            status: "ready",
+            machineId: value.machineId,
+            workspaceId: value.workspaceId,
+            environment: value.environment,
+            profile: value.profile,
+            ...(value.storageId === undefined ? {} : { storageId: value.storageId }),
+            ...(value.daemonHome === undefined ? {} : { daemonHome: value.daemonHome }),
+            ...(value.agentsRoot === undefined ? {} : { agentsRoot: value.agentsRoot }),
+        });
+        return {
+            status: "ready",
+            machineId: parsed.machineId,
+            workspaceId: parsed.workspaceId,
+            environment: parsed.environment,
+            profile: parsed.profile,
+            ...(parsed.storageId === undefined ? {} : { storageId: parsed.storageId }),
+            daemonHome: parsed.daemonHome,
+            agentsRoot: parsed.agentsRoot,
+        };
+    }
+    const ready = SetupReadySchema.safeParse(raw);
+    if (ready.success) {
+        return {
+            status: "ready",
+            machineId: ready.data.machineId,
+            workspaceId: ready.data.workspaceId,
+            environment: ready.data.environment,
+            profile: ready.data.profile,
+            ...(ready.data.storageId === undefined ? {} : { storageId: ready.data.storageId }),
+            daemonHome: ready.data.daemonHome,
+            agentsRoot: ready.data.agentsRoot,
+        };
+    }
+    const pending = z.object({
+        status: z.literal("pending"),
+        intervalSeconds: z.number().int().positive().max(300).optional(),
+    }).safeParse(raw);
+    if (pending.success)
+        return { status: "pending", intervalSeconds: pending.data.intervalSeconds ?? 2 };
+    throw new Error("Invalid computer setup hello response");
+}
+export function createComputerSetupClient(options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const serverUrl = normalizeServerUrl(options.serverUrl);
+    const requestTimeoutMs = options.requestTimeoutMs ?? 15_000;
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => {
+        setTimeout(resolve, milliseconds);
+    }));
+    const now = options.now ?? Date.now;
+    let activeMachineId;
+    const request = async (method, path, body, bearer) => {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
+        try {
+            const response = await fetchImpl(`${serverUrl}${path}`, {
+                method,
+                headers: {
+                    ...(body === undefined ? {} : { "content-type": "application/json" }),
+                    ...(bearer === undefined ? {} : { authorization: `Bearer ${bearer}` }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: controller.signal,
+            });
+            const payload = await response.json();
+            if (!response.ok || payload?.success === false) {
+                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`);
+                throw new ComputerSetupHttpError(message, response.status, payload?.error?.code ?? `HTTP_${response.status}`);
+            }
+            return (payload?.success === true ? payload.data : payload);
+        }
+        catch (error) {
+            if (controller.signal.aborted)
+                throw new Error("computer setup request timed out");
+            if (error instanceof ComputerSetupHttpError)
+                throw error;
+            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error)));
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    };
+    return {
+        start: async (input) => {
+            activeMachineId = input.machineId;
+            return parseStart(await request("POST", "/api/auth/computer-setup/start", {
+                ...(input.workspace.kind === "id"
+                    ? { workspaceId: input.workspace.value }
+                    : { workspaceSlug: input.workspace.value }),
+                machineId: input.machineId,
+                deviceName: (input.deviceName ?? hostname()).trim().slice(0, 120) || "computer",
+                serverUrl,
+            }));
+        },
+        poll: async (deviceCode) => {
+            if (activeMachineId === undefined)
+                throw new Error("computer setup polling has no active machine");
+            return parsePoll(await request("POST", "/api/auth/computer-setup/poll", { deviceCode }));
+        },
+        waitForHello: async (input) => {
+            const timeoutMs = input.timeoutMs ?? 120_000;
+            const deadline = now() + timeoutMs;
+            for (;;) {
+                const status = parseHello(await request("GET", `/daemon/computer-setup/status?machine_id=${encodeURIComponent(input.machineId)}&workspace_id=${encodeURIComponent(input.workspaceId)}&profile=${encodeURIComponent(input.profile)}&setup_id=${encodeURIComponent(input.setupId)}&minimum_connection_epoch=${encodeURIComponent(String(input.minimumConnectionEpoch))}`, undefined, input.machineToken));
+                if (status.status === "ready")
+                    return status;
+                if (now() >= deadline)
+                    throw new Error("Timed out waiting for machine hello");
+                await sleep(Math.min(status.intervalSeconds * 1_000, Math.max(0, deadline - now())));
+            }
+        },
+        finalize: async (input) => {
+            const result = await request("POST", "/daemon/computer-setup/finalize", { setupId: input.setupId }, input.machineToken);
+            if (result?.finalized !== true)
+                throw new Error("computer setup credential finalization not confirmed");
+        },
+        rollback: async (input) => {
+            const result = await request("POST", "/daemon/computer-setup/rollback", { setupId: input.setupId }, input.machineToken);
+            return result.rolledBack === true;
+        },
+    };
+}
+export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
+    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = [url];
+    const result = await runner(command, args);
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);
+    }
+}