@nowcrew/daemon 0.6.89 → 0.6.91-beta.1

package/dist/computer-setup-orchestration.js

@@ -0,0 +1,203 @@
+import { computerSetupRecoveryGuidance, redactSetupSecrets, } from "./computer-setup-client.js";
+import { isProductionServerHostname, serverUrlsMatch } from "./server-url.js";
+import { posix, win32 } from "node:path";
+import { resolveAgentsRoot } from "./computer-profile.js";
+function safeError(error, machineToken) {
+    const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), machineToken === undefined ? [] : [machineToken]);
+    return new Error(message, error instanceof Error ? { cause: error } : undefined);
+}
+function assertBootstrapMatches(bootstrap, input) {
+    if (bootstrap.machineId !== input.args.machineId) {
+        throw new Error("setup bootstrap machine does not match --machine");
+    }
+    const workspaceMatches = input.args.workspace.kind === "id"
+        ? input.args.workspace.value === bootstrap.workspaceId
+        : bootstrap.workspaceSlug !== undefined && input.args.workspace.value === bootstrap.workspaceSlug;
+    if (!workspaceMatches)
+        throw new Error("setup bootstrap Workspace does not match the requested Workspace");
+    const bootstrapUrl = new URL(bootstrap.serverUrl);
+    const requestedUrl = new URL(input.serverUrl);
+    if (!serverUrlsMatch(bootstrapUrl.origin, requestedUrl.origin)) {
+        throw new Error("setup bootstrap server does not match the requested server context");
+    }
+    const hostname = bootstrapUrl.hostname.toLowerCase();
+    const knownEnvironment = hostname === "nowwork-dev.nowcoder.com"
+        ? "dev"
+        : isProductionServerHostname(hostname)
+            ? "production"
+            : null;
+    if (knownEnvironment !== null) {
+        const expectedReleaseTag = knownEnvironment === "dev" ? "beta" : "latest";
+        if (bootstrap.environment !== knownEnvironment) {
+            throw new Error("setup bootstrap environment does not match the server hostname");
+        }
+        if (bootstrap.releaseTag !== undefined && bootstrap.releaseTag !== expectedReleaseTag) {
+            throw new Error("setup bootstrap release tag does not match the server hostname");
+        }
+    }
+}
+function secondsUntil(expiresAt, now) {
+    const remaining = Date.parse(expiresAt) - now();
+    return Math.max(0, Math.ceil(remaining / 1_000));
+}
+function localPathsMatch(left, right, platform) {
+    const paths = platform === "win32" ? win32 : posix;
+    if (!paths.isAbsolute(left) || !paths.isAbsolute(right))
+        return false;
+    const normalize = (value) => {
+        const resolved = resolveAgentsRoot(value, undefined, platform);
+        return platform === "win32" ? win32.normalize(resolved).toLocaleLowerCase("en-US") : resolved;
+    };
+    return normalize(left) === normalize(right);
+}
+async function obtainBootstrap(input, deps) {
+    const pairing = await deps.client.start({
+        workspace: input.args.workspace,
+        machineId: input.args.machineId,
+    });
+    deps.reportPairing(`Open ${pairing.verificationUri}`);
+    deps.reportPairing(`Code ${pairing.userCode}`);
+    try {
+        await deps.openBrowser(pairing.verificationUri);
+    }
+    catch (error) {
+        deps.reportPairing(`Browser open skipped: ${redactSetupSecrets(error.message)}`);
+    }
+    let intervalSeconds = pairing.intervalSeconds;
+    for (;;) {
+        const remainingSeconds = secondsUntil(pairing.expiresAt, deps.now);
+        if (remainingSeconds <= 0)
+            throw new Error("computer setup pairing expired");
+        await deps.sleep(Math.min(intervalSeconds * 1_000, remainingSeconds * 1_000));
+        const result = await deps.client.poll(pairing.deviceCode);
+        if (result.status === "authorization_pending" || result.status === "slow_down") {
+            intervalSeconds = result.intervalSeconds;
+            continue;
+        }
+        if (result.status === "access_denied")
+            throw new Error("computer setup pairing was denied");
+        if (result.status === "expired_token")
+            throw new Error("computer setup pairing expired");
+        return result.bootstrap;
+    }
+}
+export async function runComputerSetupOrchestration(input, deps) {
+    let machineToken;
+    let bootstrap;
+    let credentialFinalized = false;
+    let verifiedStorageId;
+    let rollbackAttempt;
+    const confirmRollback = () => {
+        // Reuse both success and failure so an outer catch cannot change the recovery decision.
+        rollbackAttempt ??= (async () => {
+            if (credentialFinalized)
+                throw new Error("computer setup credentials already finalized");
+            if (bootstrap === undefined || machineToken === undefined)
+                throw new Error("computer setup credentials unavailable");
+            for (let attempt = 0;; attempt += 1) {
+                try {
+                    const confirmed = await deps.client.rollback({ setupId: bootstrap.setupId, machineToken });
+                    if (confirmed !== true)
+                        throw new Error("computer setup rollback not confirmed");
+                    return;
+                }
+                catch (error) {
+                    if (attempt >= 2)
+                        throw error;
+                    await deps.sleep(1_000);
+                }
+            }
+        })();
+        return rollbackAttempt;
+    };
+    try {
+        const authorized = await obtainBootstrap(input, deps);
+        const token = authorized.machineToken;
+        bootstrap = authorized;
+        machineToken = token;
+        assertBootstrapMatches(authorized, input);
+        const installation = await deps.installAutomatically({
+            serverUrl: authorized.serverUrl,
+            machineToken: token,
+            workspaceId: authorized.workspaceId,
+            machineId: authorized.machineId,
+            ...(authorized.profile === undefined ? {} : { requestedProfile: authorized.profile }),
+            ...(authorized.releaseTag === "latest" || authorized.releaseTag === "beta"
+                ? { requestedReleaseTag: authorized.releaseTag }
+                : {}),
+            ...(authorized.registryUrl === undefined ? {} : { requestedRegistryUrl: authorized.registryUrl }),
+            beforeRollback: confirmRollback,
+            verifyAfterStart: async (candidate) => {
+                const hello = await deps.client.waitForHello({
+                    machineToken: token,
+                    machineId: authorized.machineId,
+                    workspaceId: authorized.workspaceId,
+                    profile: candidate.profile,
+                    setupId: authorized.setupId,
+                    minimumConnectionEpoch: authorized.minimumConnectionEpoch,
+                });
+                if (hello.machineId !== authorized.machineId)
+                    throw new Error("machine hello identity mismatch");
+                if (hello.workspaceId !== authorized.workspaceId)
+                    throw new Error("machine hello workspace identity mismatch");
+                if (hello.environment !== authorized.environment)
+                    throw new Error("machine hello environment identity mismatch");
+                if (hello.profile !== candidate.profile)
+                    throw new Error("machine hello profile identity mismatch");
+                const platform = deps.platform ?? process.platform;
+                if (!localPathsMatch(hello.daemonHome, candidate.daemonHome, platform))
+                    throw new Error("machine hello daemon home mismatch");
+                if (!localPathsMatch(hello.agentsRoot, candidate.agentsRoot, platform))
+                    throw new Error("machine hello agents root mismatch");
+                if (authorized.storageId !== undefined && hello.storageId !== authorized.storageId) {
+                    throw new Error("machine hello storage identity mismatch");
+                }
+                verifiedStorageId = hello.storageId;
+                let finalizeError;
+                for (let attempt = 0; attempt < 3; attempt += 1) {
+                    try {
+                        await deps.client.finalize({ setupId: authorized.setupId, machineToken: token });
+                        credentialFinalized = true;
+                        finalizeError = undefined;
+                        break;
+                    }
+                    catch (error) {
+                        finalizeError = error;
+                        if (attempt < 2)
+                            await deps.sleep(1_000);
+                    }
+                }
+                if (!credentialFinalized) {
+                    throw finalizeError ?? new Error("computer setup credential finalization failed");
+                }
+            },
+        });
+        return {
+            workspaceId: authorized.workspaceId,
+            machineId: authorized.machineId,
+            environment: authorized.environment,
+            profile: installation.profile,
+            daemonVersion: installation.version,
+            serviceId: installation.serviceId,
+            serviceStatus: "running",
+            helloConfirmed: true,
+            ...(authorized.environmentId === undefined ? {} : { environmentId: authorized.environmentId }),
+            ...(verifiedStorageId === undefined ? {} : { storageId: verifiedStorageId }),
+            localNowworkHome: installation.localHome,
+            daemonHome: installation.daemonHome,
+            agentsRoot: installation.agentsRoot,
+        };
+    }
+    catch (error) {
+        if (bootstrap !== undefined && machineToken !== undefined && !credentialFinalized && rollbackAttempt === undefined) {
+            try {
+                await confirmRollback();
+            }
+            catch (rollbackError) {
+                error = new Error(`${error.message}; computer setup rollback failed: ${rollbackError.message}; `
+                    + `local recovery blocked. ${computerSetupRecoveryGuidance(bootstrap)}`, { cause: error });
+            }
+        }
+        throw safeError(error, machineToken);
+    }
+}

package/dist/computer-setup.js

@@ -0,0 +1,244 @@
+import { parseArgs } from "node:util";
+import { z } from "zod";
+import { DEFAULT_SERVER_URL } from "./config.js";
+import { installDaemonAutomatically, } from "./automatic-daemon-installer.js";
+import { createComputerSetupClient, openSetupBrowser, redactSetupSecrets, } from "./computer-setup-client.js";
+import { runComputerSetupOrchestration, } from "./computer-setup-orchestration.js";
+import { detectDaemonLang, formatDaemonText } from "./i18n.js";
+import { systemCommandRunner } from "./computer-service.js";
+const WorkspaceSlugSchema = z.string()
+    .min(2)
+    .max(40)
+    .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u);
+const WorkspaceIdSchema = z.string().uuid();
+const MachineIdSchema = z.string().uuid();
+const ServerUrlSchema = z.string().url().refine((value) => {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:")
+        && url.username.length === 0
+        && url.password.length === 0
+        && (url.pathname === "" || url.pathname === "/")
+        && url.search.length === 0
+        && url.hash.length === 0;
+}, "server URL must be an HTTP(S) origin without embedded credentials");
+function stringValue(values, key) {
+    const value = values[key];
+    return typeof value === "string" ? value : undefined;
+}
+function booleanValue(values, key) {
+    return values[key] === true;
+}
+function optionOccurrences(argv, name) {
+    const prefix = `--${name}`;
+    const values = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const value = argv[index];
+        if (value === prefix) {
+            const next = argv[index + 1];
+            if (next !== undefined && !next.startsWith("--"))
+                values.push(next);
+            index += 1;
+            continue;
+        }
+        if (value?.startsWith(`${prefix}=`))
+            values.push(value.slice(prefix.length + 1));
+    }
+    return values;
+}
+function assertRepeatedOptionValuesAgree(argv, name, normalize) {
+    const normalized = optionOccurrences(argv, name).map(normalize);
+    if (new Set(normalized).size > 1) {
+        throw new Error(`Repeated --${name} values conflict`);
+    }
+}
+function normalizedServerOrigin(value) {
+    const parsed = new URL(ServerUrlSchema.parse(value));
+    return `${parsed.protocol}//${parsed.host}`;
+}
+function workspaceFromSlug(value) {
+    if (!value.startsWith("/") || value.startsWith("//")) {
+        throw new Error("Workspace slug must use exactly one leading slash, for example /nowcoder-app");
+    }
+    return WorkspaceSlugSchema.parse(value.slice(1));
+}
+function workspaceFromAlias(value) {
+    return value.startsWith("/") ? workspaceFromSlug(value) : WorkspaceSlugSchema.parse(value);
+}
+export function parseSetupArgs(argv) {
+    assertRepeatedOptionValuesAgree(argv, "workspace", (value) => workspaceFromAlias(value));
+    assertRepeatedOptionValuesAgree(argv, "workspace-id", (value) => WorkspaceIdSchema.parse(value).toLowerCase());
+    assertRepeatedOptionValuesAgree(argv, "machine", (value) => MachineIdSchema.parse(value).toLowerCase());
+    assertRepeatedOptionValuesAgree(argv, "machine-id", (value) => MachineIdSchema.parse(value).toLowerCase());
+    assertRepeatedOptionValuesAgree(argv, "server-url", normalizedServerOrigin);
+    const parsed = parseArgs({
+        args: [...argv],
+        allowPositionals: true,
+        strict: true,
+        options: {
+            workspace: { type: "string" },
+            "workspace-id": { type: "string" },
+            machine: { type: "string" },
+            "machine-id": { type: "string" },
+            "server-url": { type: "string" },
+            json: { type: "boolean", default: false },
+            "no-browser": { type: "boolean", default: false },
+            help: { type: "boolean", short: "h", default: false },
+        },
+    });
+    const values = parsed.values;
+    const [command, ...positionals] = parsed.positionals;
+    if (command !== "setup")
+        throw new Error("Expected 'setup'");
+    if (booleanValue(values, "help"))
+        throw new Error(setupUsage());
+    if (positionals.length > 1)
+        throw new Error("Setup accepts one Workspace argument");
+    const workspaceAlias = stringValue(values, "workspace");
+    const workspaceIdAlias = stringValue(values, "workspace-id");
+    if (workspaceAlias !== undefined && workspaceIdAlias !== undefined) {
+        throw new Error("Choose one Workspace source: positional, --workspace, or --workspace-id");
+    }
+    const positionalWorkspace = positionals[0] === undefined ? undefined : workspaceFromSlug(positionals[0]);
+    const aliasWorkspace = workspaceAlias === undefined ? undefined : workspaceFromAlias(workspaceAlias);
+    if (positionalWorkspace !== undefined && workspaceIdAlias !== undefined) {
+        throw new Error("A positional Workspace slug cannot be combined with --workspace-id");
+    }
+    if (positionalWorkspace !== undefined && aliasWorkspace !== undefined && positionalWorkspace !== aliasWorkspace) {
+        throw new Error("Positional Workspace conflicts with --workspace");
+    }
+    const workspace = positionalWorkspace !== undefined
+        ? Object.freeze({ kind: "slug", value: positionalWorkspace })
+        : aliasWorkspace !== undefined
+            ? Object.freeze({ kind: "slug", value: aliasWorkspace })
+            : workspaceIdAlias === undefined
+                ? (() => { throw new Error("Missing Workspace; use /<slug> or --workspace-id <uuid>"); })()
+                : Object.freeze({ kind: "id", value: WorkspaceIdSchema.parse(workspaceIdAlias).toLowerCase() });
+    const machineAlias = stringValue(values, "machine");
+    const machineIdAlias = stringValue(values, "machine-id");
+    const parsedMachine = MachineIdSchema.parse(machineAlias ?? machineIdAlias ?? (() => {
+        throw new Error("Missing --machine <uuid>");
+    })()).toLowerCase();
+    if (machineAlias !== undefined && machineIdAlias !== undefined
+        && parsedMachine !== MachineIdSchema.parse(machineIdAlias).toLowerCase()) {
+        throw new Error("--machine conflicts with --machine-id");
+    }
+    const machineId = parsedMachine;
+    const serverUrl = stringValue(values, "server-url");
+    return Object.freeze({
+        command: "setup",
+        workspace,
+        machineId,
+        ...(serverUrl === undefined ? {} : { serverUrl: ServerUrlSchema.parse(serverUrl) }),
+        ...(booleanValue(values, "json") ? { json: true } : {}),
+        ...(booleanValue(values, "no-browser") ? { noBrowser: true } : {}),
+    });
+}
+function resolveSetupServerUrl(args, env) {
+    const configured = args.serverUrl ?? env.CREW_SERVER_URL?.trim();
+    if (configured !== undefined && configured.length > 0)
+        return normalizedServerOrigin(configured);
+    if (env.NODE_ENV === "development" || env.NODE_ENV === "test")
+        return DEFAULT_SERVER_URL;
+    throw new Error("server URL is required; pass --server-url or set CREW_SERVER_URL");
+}
+export function setupUsage(td = (message) => message) {
+    return [
+        td("Usage:"),
+        "  nowwork-computer setup /workspace --machine <uuid>",
+        "  nowwork-computer setup --workspace /workspace --machine <uuid>",
+        "  nowwork-computer setup --workspace-id <uuid> --machine-id <uuid>",
+        "",
+        "Options: --server-url <url> --json --no-browser",
+    ].join("\n") + "\n";
+}
+function defaults() {
+    return {
+        env: process.env,
+        platform: process.platform,
+        fetch: globalThis.fetch,
+        stdout: (text) => process.stdout.write(text),
+        stderr: (text) => process.stderr.write(text),
+        createClient: (serverUrl) => createComputerSetupClient({ serverUrl }),
+        installAutomatically: installDaemonAutomatically,
+        openBrowser: (url) => openSetupBrowser(url, process.platform, systemCommandRunner),
+        sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+        now: Date.now,
+    };
+}
+function humanSummary(result, td) {
+    return [
+        td("Workspace: {{value}}", { value: result.workspaceId }),
+        td("Machine:   {{value}}", { value: result.machineId }),
+        td("Environment: {{value}}", { value: result.environment }),
+        td("Daemon:    profile {{profile}} / v{{version}} / {{status}}", {
+            profile: result.profile, version: result.daemonVersion, status: result.serviceStatus,
+        }),
+        td("Local:     {{value}}", { value: result.localNowworkHome }),
+        td("Config:    {{value}}", { value: result.daemonHome }),
+        td("Agents:    {{value}}", { value: result.agentsRoot }),
+        ...(result.storageId === undefined ? [] : [td("Storage ID: {{value}}", { value: result.storageId })]),
+        td(result.helloConfirmed ? "Status:    connected and ready" : "Status:    not ready"),
+    ].join("\n") + "\n";
+}
+function localizedPairingMessage(lang, message) {
+    if (message.startsWith("Open ")) {
+        return formatDaemonText(lang, "Open {{url}}", { url: message.slice("Open ".length) });
+    }
+    if (message.startsWith("Code ")) {
+        return formatDaemonText(lang, "Code {{code}}", { code: message.slice("Code ".length) });
+    }
+    if (message.startsWith("Browser open skipped: ")) {
+        return formatDaemonText(lang, "Browser open skipped: {{reason}}", {
+            reason: message.slice("Browser open skipped: ".length),
+        });
+    }
+    return formatDaemonText(lang, message);
+}
+export async function runComputerSetupCommand(argv, overrides = {}) {
+    if (argv.length === 1 && (argv[0] === "--help" || argv[0] === "-h")) {
+        const deps = { ...defaults(), ...overrides };
+        const lang = detectDaemonLang(deps.env);
+        deps.stdout(setupUsage((message, values) => formatDaemonText(lang, message, values)));
+        return 0;
+    }
+    if (argv[0] !== "setup")
+        return null;
+    const deps = { ...defaults(), ...overrides };
+    const lang = detectDaemonLang(deps.env);
+    try {
+        if (argv.includes("--help") || argv.includes("-h")) {
+            deps.stdout(setupUsage((message, values) => formatDaemonText(lang, message, values)));
+            return 0;
+        }
+        let args;
+        try {
+            args = parseSetupArgs(argv);
+        }
+        catch (error) {
+            deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+            return 2;
+        }
+        if (args.json === true) {
+            deps.stderr(`${formatDaemonText(lang, "Starting computer setup pairing...")}\n`);
+        }
+        const serverUrl = resolveSetupServerUrl(args, deps.env);
+        const createClient = overrides.createClient
+            ?? ((value) => createComputerSetupClient({ serverUrl: value, fetch: deps.fetch }));
+        const result = await runComputerSetupOrchestration({ args, serverUrl }, {
+            client: createClient(serverUrl),
+            installAutomatically: deps.installAutomatically,
+            openBrowser: args.noBrowser === true ? async () => { } : deps.openBrowser,
+            sleep: deps.sleep,
+            reportPairing: (message) => deps[args.json === true ? "stderr" : "stdout"](`${localizedPairingMessage(lang, message)}\n`),
+            now: deps.now,
+        });
+        deps.stdout(args.json === true
+            ? `${JSON.stringify(result)}\n`
+            : humanSummary(result, (message, values) => formatDaemonText(lang, message, values)));
+        return 0;
+    }
+    catch (error) {
+        deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+        return 1;
+    }
+}

package/dist/config.js

@@ -76,12 +76,32 @@ function defaultCliPath() {
         return resolve(here, "../../cli/dist/main.js");
     }
 }
-// 临时 dev 验收名单。这里必须填写 Server 生成的 Agent handle，而不是显示名称或频道 ID。
-// 测试完成后删除此常量，恢复未配置时默认关闭的行为。
+// 保留本地开发的原默认名单；远端 dev 全量不再依赖该集合。
 const TEMP_LOCAL_MEMORY_V2_TEST_HANDLES = [
-    "94533bf3-b5b7-4a1e-9c41-6a1ab0a0e1ea", // memory-v2-test-a
-    "967ab9ce-724c-4f22-a664-2f855cd798af", // memory-v2-test-b
+    "94533bf3-b5b7-4a1e-9c41-6a1ab0a0e1ea", // memory-v2-test-b
+    "967ab9ce-724c-4f22-a664-2f855cd798af", // memory-v2-test-a
 ];
+export function localMemoryV2Environment(serverUrl) {
+    try {
+        const url = new URL(serverUrl);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return "custom";
+        const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
+        if (hostname === "nowwork-dev.nowcoder.com")
+            return "dev";
+        if (hostname === "nowwork-in.nowcoder.com" || hostname === "nowwork.nowcoder.com")
+            return "production";
+    }
+    catch { /* 其它地址保留原配置行为。 */ }
+    return "custom";
+}
+/** 环境资格不代表旧格式已兼容；实际格式由本轮工作区准备阶段核对。 */
+export function isLocalMemoryV2Enabled(config, handle) {
+    const environment = localMemoryV2Environment(config.serverUrl);
+    if (environment !== "custom")
+        return environment === "dev";
+    return config.localMemoryV2Handles?.has(handle) === true;
+}
 function isTemporaryDevServer(serverUrl) {
     try {
         const hostname = new URL(serverUrl).hostname.toLowerCase();
@@ -111,13 +131,11 @@ function localMemoryV2Handles(env, serverUrl) {
     return new Set(handles);
 }
 export const DEFAULT_SERVER_URL = "http://127.0.0.1:3001";
-function codexHomeModeEnv(env) {
-    const value = env.CREW_CODEX_HOME_MODE;
-    if (value === undefined || value === "shared")
-        return "shared";
-    if (value === "private")
-        return "private";
-    throw new ConfigError("CREW_CODEX_HOME_MODE must be shared or private");
+function machineEnvironmentModeEnv(env) {
+    const value = env.NOWWORK_MACHINE_ENV_MODE ?? "auto";
+    if (value === "auto" || value === "zsh" || value === "bash" || value === "windows" || value === "off")
+        return value;
+    throw new ConfigError("NOWWORK_MACHINE_ENV_MODE must be auto, zsh, bash, windows, or off");
 }
 function codexCollaborationToolsEnv(env) {
     const value = (env.CREW_CODEX_COLLABORATION_TOOLS ?? "").trim().toLowerCase();
@@ -168,7 +186,7 @@ export function loadConfig(env = process.env) {
             : defaultQaReportRoot,
         cliPath: env.CREW_CLI_PATH ?? defaultCliPath(),
         runtimeBin: env.CREW_RUNTIME ?? "claude",
-        codexHomeMode: codexHomeModeEnv(env),
+        machineEnvironmentMode: machineEnvironmentModeEnv(env),
         codexCollaborationTools: codexCollaborationToolsEnv(env),
         dangerous: env.CREW_RUNTIME_SAFE !== "1", // 默认开启 (headless agent 在自有 workspace 内运行)
         resume: env.CREW_RESUME !== "off" && env.CREW_RESUME !== "0", // 默认开启;一键回退现状用 CREW_RESUME=off

package/dist/console-formatter.js

@@ -22,7 +22,7 @@ const clip = (text) => text.length > TOOL_RESULT_CAP
     ? `${text.slice(0, TOOL_RESULT_CAP)}… (+${text.length - TOOL_RESULT_CAP})`
     : text;
 const SCRIPT_TOOLS = new Set(["Bash", "PowerShell", "Shell"]);
-export function createConsoleFormatter() {
+export function createConsoleFormatter(runtime) {
     const pending = new Map();
     // listId → 上一条 todos 快照的指纹;仅用于丢弃「连续两次完全相同」的重复事件(无损去重)。
     // 只比对相邻快照,不做跨快照合并——进度推进的中间态必须逐条下发,否则前端进度条会停在旧值。
@@ -86,7 +86,7 @@ export function createConsoleFormatter() {
                     const filler = consumePendingThinking();
                     if (filler) {
                         const content = message.content.map((block) => block.type === "thinking" && !block.thinking?.trim() ? { ...block, thinking: filler } : block);
-                        return dedupeTodos(toConsoleLines({ ...rec, message: { ...message, content } }));
+                        return dedupeTodos(toConsoleLines({ ...rec, message: { ...message, content } }, runtime));
                     }
                 }
             }
@@ -146,7 +146,7 @@ export function createConsoleFormatter() {
                 }
                 return out;
             }
-            return dedupeTodos(toConsoleLines(event));
+            return dedupeTodos(toConsoleLines(event, runtime));
         },
     };
 }

package/dist/console.js

@@ -263,7 +263,7 @@ function codexItemChunks(item, td) {
     return [];
 }
 /** 把一个 stream-json 事件转成 0..N 条 console 行(完全透传)。 */
-export function toConsoleLines(event) {
+export function toConsoleLines(event, runtime) {
     const e = (event ?? {});
     const lang = detectDaemonLang();
     const td = (message) => translateDaemon(lang, message);
@@ -284,7 +284,20 @@ export function toConsoleLines(event) {
         return [{ stream: "system", text: `● ${td("Claude session started")}` }];
     }
     if (e.type === "thread.started") {
-        return [{ stream: "system", text: `● ${td("Codex session started")}` }];
+        // thread.started is shared by Codex and ACP adapters; its shape does not
+        // identify the runtime. Use the executor-owned selection, not event fields.
+        const messages = {
+            claude: "Claude session started",
+            codex: "Codex session started",
+            kimi: "Kimi session started",
+            hermes: "Hermes session started",
+            opencode: "OpenCode session started",
+            "deepseek-harness": "DeepSeek Harness session started",
+        };
+        const message = runtime && Object.hasOwn(messages, runtime)
+            ? messages[runtime]
+            : "Session started";
+        return [{ stream: "system", text: `● ${td(message)}` }];
     }
     if (e.type === "turn.plan.updated") {
         const plan = boundedCodexPlan(e.plan);

package/dist/daemon-update-eligibility.js

@@ -14,7 +14,7 @@ import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, man
 export async function managedDaemonCapabilities(eligibility) {
     try {
         return (await eligibility()).eligible
-            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1", "daemon_layout_migration_v1"]
+            ? ["daemon_update_v1", "daemon_restart_v1", "daemon_update_registry_v1"]
             : [];
     }
     catch {

package/dist/daemon-updater.js

@@ -11,15 +11,12 @@ function registryArgs(registry) {
 function isRegistryAuthFailure(stderr) {
     return /(?:\bE401\b|\b401\b.*\bUnauthorized\b)/iu.test(stderr);
 }
+// Managed eligibility guarantees an exclusive installation and native service per profile.
+// Other profiles share compute capacity, but do not share the package being replaced.
 export async function prepareDaemonRestart(input) {
     const local = input.localSlots.tryAcquireExclusive();
     if (local === null)
         return { ok: false, errorCode: "runtime_busy" };
-    const host = await input.hostCoordinator.tryAcquireExclusiveExecution();
-    if (host === null) {
-        local.release();
-        return { ok: false, errorCode: "runtime_busy" };
-    }
     let released = false;
     return {
         ok: true,
@@ -27,7 +24,6 @@ export async function prepareDaemonRestart(input) {
             if (released)
                 return;
             released = true;
-            await host.release();
             local.release();
         },
     };
@@ -74,17 +70,11 @@ export async function installExactDaemonUpdate(input) {
     const local = input.localSlots.tryAcquireExclusive();
     if (local === null)
         return { ok: false, errorCode: "runtime_busy" };
-    const host = await input.hostCoordinator.tryAcquireExclusiveExecution();
-    if (host === null) {
-        local.release();
-        return { ok: false, errorCode: "runtime_busy" };
-    }
     let released = false;
     const release = async () => {
         if (released)
             return;
         released = true;
-        await host.release();
         local.release();
     };
     const lockedInstallation = daemonGlobalInstallation(input.currentEntryPath ?? process.argv[1] ?? "", input.platform ?? process.platform);

package/dist/execution-journal.js

@@ -878,23 +878,26 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         },
         acknowledgeCompletion: async (executionId) => {
             validateExecutionId(executionId);
-            const updated = await serializedExecution(executionId, "acknowledge_completion", async () => {
+            const result = await serializedExecution(executionId, "acknowledge_completion", async () => {
                 const entry = await requireRecord(executionId);
                 if (entry.state !== "completed" && entry.state !== "interrupted") {
                     throw new JournalTransitionError(`Cannot acknowledge ${entry.state} execution`);
                 }
-                if (entry.completionAcknowledged)
-                    return confirmDurable(entry);
+                if (entry.completionAcknowledged) {
+                    return { entry: await confirmDurable(entry), newlyAcknowledged: false };
+                }
                 const updated = JournalEntrySchema.parse({
                     ...entry,
                     completionAcknowledged: true,
                     updatedAt: now().toISOString(),
                 });
                 await writeRecord(updated);
-                return updated;
+                return { entry: updated, newlyAcknowledged: true };
             });
-            await serializedDirectory(pruneInternal);
-            return updated;
+            // 重复 ACK 仍确认持久化，但不能反复全目录清理并阻塞后续控制帧。
+            if (result.newlyAcknowledged)
+                await serializedDirectory(pruneInternal);
+            return result.entry;
         },
         get: async (executionId) => {
             validateExecutionId(executionId);

package/dist/execution-protocol.js

@@ -264,6 +264,7 @@ export const ExecutionRejectedSchema = z.object({
     reason: RejectionReasonSchema,
     message: z.string().optional(),
     at: TimestampSchema,
+    preAdmissionProof: z.object({ specHash: z.string().regex(/^[a-f0-9]{64}$/u) }).strict().optional(),
 }).strict();
 export const ExecutionStartedSchema = z.object({
     type: z.literal("execution:started"),