@nowcrew/daemon 0.6.92 → 0.6.93-beta.1

package/dist/memory-migration-controller.js

@@ -0,0 +1,84 @@
+import { z } from "zod";
+import { createRuntimeCancellation } from "./runtime-cancellation.js";
+import { MemoryMigrationStartSchema } from "./memory-migration-protocol.js";
+import { runMemoryMigration } from "./memory-migration-runtime.js";
+import { inspectMemoryForMigration } from "./memory-migration-inspect.js";
+const Inspect = MemoryMigrationStartSchema.pick({ reqId: true, protocolVersion: true, workspaceId: true,
+    agentId: true, handle: true, machineId: true }).extend({ type: z.literal("memory:migration:inspect"), executionId: z.string().uuid().optional() }).strict();
+export function createMemoryMigrationController(input) {
+    let identity = null;
+    const runs = new Map();
+    return {
+        setIdentity(value) { identity = value; },
+        cancel(executionId) { const run = runs.get(executionId); if (!run)
+            return false; run.cancel(); return true; },
+        async handle(raw) {
+            const type = raw?.type;
+            if (type !== "memory:migration:start" && type !== "memory:migration:inspect")
+                return false;
+            const parsed = type === "memory:migration:start" ? MemoryMigrationStartSchema.safeParse(raw) : Inspect.safeParse(raw);
+            if (!parsed.success) {
+                const reqId = raw.reqId;
+                if (typeof reqId === "string" && reqId.length <= 200)
+                    input.send({ type: "fs:result", reqId, ok: false, error: "memory_migration_invalid_request" });
+                return true;
+            }
+            const request = parsed.data;
+            if (!identity || request.workspaceId !== identity.workspaceId || request.machineId !== identity.machineId) {
+                input.send({ type: "fs:result", reqId: request.reqId, ok: false, error: "memory_migration_identity_mismatch" });
+                return true;
+            }
+            let journal;
+            try {
+                journal = input.journal();
+            }
+            catch {
+                input.send({ type: "fs:result", reqId: request.reqId, ok: false, error: "memory_migration_journal_unavailable" });
+                return true;
+            }
+            if (request.type === "memory:migration:inspect") {
+                try {
+                    const data = await inspectMemoryForMigration(input.config.agentsRoot, request, journal);
+                    input.send({ type: "fs:result", reqId: request.reqId, ok: true, data });
+                }
+                catch {
+                    input.send({ type: "fs:result", reqId: request.reqId, ok: false, error: "memory_migration_inspection_failed" });
+                }
+                return true;
+            }
+            const existing = runs.get(request.executionId);
+            if (existing) {
+                input.send({ type: "fs:result", reqId: request.reqId, ok: true, data: { kind: "running" } });
+                return true;
+            }
+            if (input.isAdmissionClosed?.()) {
+                input.send({ type: "fs:result", reqId: request.reqId, ok: false, error: "memory_migration_storage_busy" });
+                return true;
+            }
+            const cancellation = createRuntimeCancellation();
+            const promise = runMemoryMigration(request, {
+                agentsRoot: input.config.agentsRoot, coordinator: input.coordinator, journal,
+                cancellation: cancellation.cancellation, send: input.send,
+                control: async (step, body) => {
+                    const base = `/daemon/memory-migrations/${encodeURIComponent(request.agentId)}`;
+                    const path = step === "history" ? `${base}/history` : `${base}/${request.migrationId}/${step === "needs-review" ? "review" : step}`;
+                    const response = await fetch(new URL(path, input.config.serverUrl), {
+                        method: step === "history" ? "GET" : "POST", signal: AbortSignal.timeout(10_000),
+                        headers: { authorization: `Bearer ${input.config.machineToken}`, "content-type": "application/json" },
+                        ...(step === "history" ? {} : { body: JSON.stringify(body) }),
+                    });
+                    const result = await response.json();
+                    if (!response.ok || result.success !== true)
+                        throw new Error("migration_control_unconfirmed");
+                    return result.data;
+                },
+            }).then(data => input.send({ type: "fs:result", reqId: request.reqId, ok: true, data }))
+                .catch(() => input.send({ type: "fs:result", reqId: request.reqId, ok: false, error: "memory_migration_failed" }))
+                .finally(() => runs.delete(request.executionId));
+            runs.set(request.executionId, { promise, cancel: cancellation.request });
+            return true;
+        },
+        async stop() { for (const run of runs.values())
+            run.cancel(); await Promise.allSettled([...runs.values()].map(run => run.promise)); },
+    };
+}

package/dist/memory-migration-inspect.js

@@ -0,0 +1,75 @@
+import { lstat, readFile, realpath, readdir } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { withMemoryAccess } from "./local-memory/migration-access.js";
+import { MigrationStateSchema } from "./local-memory/migration-schema.js";
+import { detectLocalMemoryStorageVersion, parseFullMemoryIndex } from "./local-memory/storage-format.js";
+import { resolveLocalMemoryV2Rollout } from "./local-memory/rollout.js";
+import { readMemoryInventorySource, inventoryLimits } from "./local-memory/inventory-source.js";
+export async function inspectMemoryForMigration(agentsRoot, input, journal) {
+    const parent = await realpath(agentsRoot);
+    const path = join(parent, input.handle);
+    const base = { workspaceId: input.workspaceId, agentId: input.agentId, machineId: input.machineId,
+        storageRootFingerprint: createHash("sha256").update(resolve(path)).digest("hex"),
+        ownerIdentity: String((await lstat(parent)).uid) };
+    const prior = input.executionId ? await journal?.get(input.executionId) : null;
+    const stoppedExecutionId = prior?.requestedRuntime === "memory_migration" && (prior.state === "completed" || prior.state === "interrupted") ? prior.executionId : null;
+    const empty = { ...base, storageVersion: null, classification: "empty", emptyWithoutResidue: true, localState: null, issueCodes: [], stoppedExecutionId };
+    try {
+        await lstat(path);
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return empty;
+        throw e;
+    }
+    try {
+        return await withMemoryAccess(path, async () => {
+            let localState = null;
+            try {
+                const record = await readMemoryInventorySource(path, ".crew/memory/migration.v1.json", inventoryLimits.fileBytes);
+                const state = MigrationStateSchema.parse(JSON.parse(record.content));
+                if (state.identity.rootFingerprint !== base.storageRootFingerprint || state.identity.agentId !== input.agentId
+                    || state.origin !== "initialized" && (state.identity.workspaceId !== input.workspaceId
+                        || state.identity.machineId !== input.machineId))
+                    throw new Error("migration_identity_mismatch");
+                localState = { migrationId: state.migrationId, phase: state.phase, storageVersion: state.storageVersion,
+                    sourceDigest: state.sourceDigest, planDigest: state.planDigest };
+                if (state.phase === "applying" || state.phase === "repair_required")
+                    return {
+                        ...empty, localState, classification: "repair_required", emptyWithoutResidue: false, issueCodes: ["migration_recovery_required"],
+                    };
+            }
+            catch (e) {
+                if (e.code !== "ENOENT")
+                    throw e;
+            }
+            let source;
+            try {
+                source = await readMemoryInventorySource(path, "MEMORY.md", inventoryLimits.fileBytes);
+            }
+            catch (e) {
+                if (e.code !== "ENOENT")
+                    throw e;
+                const names = await readdir(path);
+                const nonMetadata = names.filter(name => name !== ".crew");
+                return { ...empty, localState, emptyWithoutResidue: nonMetadata.length === 0 && localState === null,
+                    classification: nonMetadata.length === 0 && localState === null ? "empty" : "repair_required", issueCodes: ["memory_source_missing"] };
+            }
+            const storageVersion = detectLocalMemoryStorageVersion(source.content);
+            if (storageVersion === 2) {
+                parseFullMemoryIndex(source.content);
+                return { ...base, storageVersion, classification: "valid_v2", emptyWithoutResidue: false, localState, issueCodes: [], stoppedExecutionId };
+            }
+            const eligibility = await resolveLocalMemoryV2Rollout({ workspace: { dir: path, memory: source.content },
+                serverUrl: "https://nowwork-dev.nowcoder.com", handle: input.handle, requested: true });
+            return { ...base, storageVersion, classification: storageVersion === 1 && eligibility.enabled ? "valid_v1"
+                    : eligibility.legacyFallback || eligibility.enabled ? "legacy" : "repair_required",
+                emptyWithoutResidue: false, localState, stoppedExecutionId, issueCodes: eligibility.enabled || eligibility.legacyFallback ? [] : ["memory_source_incompatible"] };
+        }, { maintenance: true, waitMs: 0 });
+    }
+    catch (error) {
+        const code = error instanceof Error && /^[a-z_]+$/u.test(error.message) ? error.message : "memory_inspection_failed";
+        return { ...empty, emptyWithoutResidue: false, classification: code === "memory_migration_access_busy" ? "busy" : "repair_required", issueCodes: [code] };
+    }
+}

package/dist/memory-migration-journal.js

@@ -0,0 +1,14 @@
+import { join } from "node:path";
+import { createExecutionJournal } from "./execution-journal.js";
+import { dslog } from "./slog.js";
+/** 复用journal的监管/恢复实现；旧daemon只读普通目录，不会解析维护类型。 */
+export function createMemoryMigrationJournal(agentsRoot) {
+    return createExecutionJournal(join(agentsRoot, ".crew", "memory-migration-runtime"), { retainCompleted: true });
+}
+export async function replayExecutionJournals(normal, maintenance) {
+    const [ordinary, migration] = await Promise.all([normal.replay(), maintenance.replay().catch(() => {
+            dslog("memory_migration.journal_unavailable", "迁移日志暂不可读，保留普通执行能力", { level: "ERROR" });
+            return [];
+        })]);
+    return [...ordinary, ...migration];
+}

package/dist/memory-migration-protocol.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+import { MigrationRecordMappingSchema } from "./local-memory/migration-schema.js";
+export const MEMORY_MIGRATION_CAPABILITY = "memory_migration_v1";
+export const MEMORY_STORAGE_V2_CAPABILITY = "memory_storage_v2";
+export const MEMORY_STATE_GUARD_CAPABILITY = "memory_state_guard_v1";
+export const MemoryMigrationStartSchema = z.object({
+    type: z.literal("memory:migration:start"), reqId: z.string().min(1).max(200), protocolVersion: z.literal(1),
+    workspaceId: z.string().uuid(), agentId: z.string().uuid(), handle: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+    machineId: z.string().uuid(), executionId: z.string().uuid(), migrationId: z.string().uuid(),
+    expectedRevision: z.number().int().nonnegative(), attemptKey: z.string().min(1).max(200),
+    sourceStorageVersion: z.union([z.literal(0), z.literal(1)]), targetStorageVersion: z.literal(2),
+    action: z.enum(["migrate", "recover"]),
+    recordMappings: z.array(MigrationRecordMappingSchema).max(10_000).optional(),
+}).strict();

package/dist/memory-migration-runtime.js

@@ -0,0 +1,305 @@
+import { createHash } from "node:crypto";
+import { mkdir, lstat, realpath, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createRequire } from "node:module";
+import { z } from "zod";
+import { ExecutionCompletedSchema } from "./execution-protocol.js";
+import { startDormantSupervisor } from "./execution-supervisor.js";
+import { MemoryMigrationStartSchema } from "./memory-migration-protocol.js";
+import { MigrationHistorySchema, MigrationIdentitySchema, MigrationStateSchema } from "./local-memory/migration-schema.js";
+import { readMemoryInventorySource, inventoryLimits } from "./local-memory/inventory-source.js";
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const protectedWindows = new Map();
+const Operation = z.object({ id: z.string(), revision: z.number().int(), executionId: z.string().nullable(),
+    status: z.string(), sourceDigest: z.string().nullable(), planDigest: z.string().nullable(),
+    writeIntentConfirmedAt: z.string().nullable(), newAgentConfirmed: z.boolean().optional(),
+    cancelRequestedAt: z.string().nullable(),
+}).passthrough();
+const Summary = z.object({ result: z.enum(["success", "failed", "needs_review", "repair_required", "missing"]),
+    phase: z.string().nullable().optional(), issues: z.array(z.object({ path: z.string(), reason: z.string() }).passthrough()) }).passthrough();
+/** 系统维护在普通执行槽之前分流；只有 server 持久确认意图后才运行活动替换。 */
+export async function runMemoryMigration(raw, deps) {
+    const frame = MemoryMigrationStartSchema.parse(raw);
+    const common = { agentId: frame.agentId, migrationId: frame.migrationId, machineId: frame.machineId,
+        executionId: frame.executionId, attemptKey: frame.attemptKey };
+    const protectionKey = `${deps.agentsRoot}:${frame.migrationId}`;
+    const exclusive = protectedWindows.get(protectionKey) ?? await deps.coordinator.tryAcquireExclusiveExecution();
+    if (!exclusive) {
+        await deps.control("busy", { ...common, expectedRevision: frame.expectedRevision });
+        return { kind: "busy" };
+    }
+    let revision = frame.expectedRevision, intentConfirmed = false, acquired = false, acquisitionRequested = false, keepProtection = false;
+    let bound;
+    let identity, state;
+    let serverHistory;
+    let intentReceipt;
+    let lastPid = null, stopped = true, phaseCount = 0;
+    const startedAt = new Date().toISOString();
+    const dir = join(deps.agentsRoot, frame.handle);
+    const timeoutMs = deps.timeoutMs ?? 60_000;
+    const guard = () => ({ ...common, expectedRevision: revision, ...bound });
+    const control = async (step, extra = {}) => {
+        const response = await deps.control(step, { ...guard(), ...extra });
+        const parsed = z.object({ operation: Operation }).parse(response);
+        revision = parsed.operation.revision;
+        return parsed.operation;
+    };
+    const readKnownState = async (path) => {
+        const source = await readMemoryInventorySource(await realpath(dir), path, inventoryLimits.fileBytes);
+        return MigrationStateSchema.parse(JSON.parse(source.content));
+    };
+    const readState = () => readKnownState(".crew/memory/migration.v1.json");
+    const runTool = async (command, extra = {}) => {
+        if (!identity)
+            throw new Error("migration_identity_missing");
+        if (command === "recover" && deps.cancellation?.isRequested())
+            extra = { ...extra, cancelled: true };
+        const rollback = command === "recover" && extra.cancelled === true;
+        if (!rollback && deps.cancellation?.isRequested())
+            throw new Error("migration_cancelled");
+        if (phaseCount++ > 0) {
+            if (!stopped || !deps.journal.retry)
+                throw new Error("migration_stop_unproven");
+            await deps.journal.retry(frame.executionId);
+        }
+        const sourceMode = import.meta.url.endsWith(".ts");
+        const entry = fileURLToPath(new URL(`./local-memory/migration-tool-entry.${sourceMode ? "ts" : "js"}`, import.meta.url));
+        const args = sourceMode ? ["--import", pathToFileURL(createRequire(import.meta.url).resolve("tsx/esm")).href, entry] : [entry];
+        let stdout = "";
+        const launched = await deps.journal.startGuarded(frame.executionId, new Date().toISOString(), () => (deps.startSupervisor ?? startDormantSupervisor)({ command: process.execPath, args, cwd: dir,
+            env: { PATH: process.env.PATH ?? "", CREW_SLS_LOG: "off" },
+            stdinText: JSON.stringify({ command, agentDir: dir, identity, ...extra }),
+        }, sourceMode ? {
+            childEntry: fileURLToPath(new URL("./execution-supervisor-child.ts", import.meta.url)),
+            execArgv: ["--import", pathToFileURL(createRequire(import.meta.url).resolve("tsx/esm")).href],
+        } : {}), { beforeRelease: async ({ handle }) => {
+                lastPid = handle.pid;
+                stopped = false;
+                handle.stdout.on("data", chunk => { stdout += String(chunk); if (stdout.length > 2 * 1024 * 1024)
+                    void handle.cancel(); });
+                handle.stderr.resume();
+            } });
+        if (launched.kind !== "started")
+            throw new Error("migration_execution_already_running");
+        const processHandle = launched.handle;
+        deps.send({ type: "execution:started", protocolVersion: 1, executionId: frame.executionId, at: new Date().toISOString() });
+        let timedOut = false;
+        const timer = setTimeout(() => { timedOut = true; void processHandle.cancel(); }, timeoutMs);
+        if (!rollback)
+            deps.cancellation?.register(async () => { if (!stopped)
+                await processHandle.cancel(); });
+        try {
+            await processHandle.exit;
+            await processHandle.cancel();
+            stopped = true;
+            if (timedOut)
+                throw new Error("migration_window_timeout");
+            return Summary.parse(JSON.parse(stdout.trim()));
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    const finish = async (outcome, reason) => {
+        const completion = ExecutionCompletedSchema.parse({ type: "execution:completed", protocolVersion: 1,
+            executionId: frame.executionId, runtime: "memory_migration", resumed: false, outcome,
+            exitCode: outcome === "succeeded" ? 0 : 1, ...(reason ? { errorCode: reason, errorMessage: reason } : {}),
+            startedAt, finishedAt: new Date().toISOString() });
+        await deps.journal.complete(frame.executionId, completion);
+        deps.send(completion);
+    };
+    try {
+        const history = z.object({ operations: z.array(Operation), serverHistory: MigrationHistorySchema }).passthrough().parse(await deps.control("history", {}));
+        serverHistory = history.serverHistory;
+        const operation = history.operations.find(op => op.id === frame.migrationId);
+        if (!operation || operation.revision !== revision || operation.executionId !== frame.executionId)
+            throw new Error("migration_server_identity_mismatch");
+        intentConfirmed = operation.writeIntentConfirmedAt !== null;
+        await mkdir(dir, { recursive: true });
+        const root = await realpath(dir);
+        if ((await lstat(dir)).isSymbolicLink())
+            throw new Error("migration_root_invalid");
+        bound = { storageRootFingerprint: digest(root), ownerIdentity: String((await lstat(root)).uid) };
+        identity = MigrationIdentitySchema.parse({ agentId: frame.agentId, migrationId: frame.migrationId,
+            machineId: frame.machineId, executionId: frame.executionId, workspaceId: frame.workspaceId,
+            rootFingerprint: bound.storageRootFingerprint, ownerIdentity: bound.ownerIdentity,
+            sourceStorageVersion: frame.sourceStorageVersion, targetStorageVersion: 2 });
+        const { reqId: _transportRequest, ...stableFrame } = frame;
+        const accepted = await deps.journal.accept(frame.executionId, digest(JSON.stringify(stableFrame)), { runtime: "memory_migration" });
+        if (accepted.kind === "existing" && accepted.completion) {
+            deps.send(accepted.completion);
+            return { kind: "completed" };
+        }
+        deps.send({ type: "execution:accepted", protocolVersion: 1, executionId: frame.executionId,
+            state: "ready", effectivePermission: "workspace_write", at: new Date().toISOString() });
+        acquisitionRequested = true;
+        await control("acquired");
+        acquired = true;
+        if (frame.action === "recover") {
+            state = await readState().catch(() => undefined);
+            if (state && state.migrationId !== frame.migrationId && state.phase === "rolled_back"
+                && history.serverHistory.rolledBackOperations?.some(previous => previous.migrationId === state.migrationId
+                    && previous.sourceDigest === state.sourceDigest && previous.planDigest === state.planDigest))
+                state = undefined;
+            if (state) {
+                if (state.migrationId !== frame.migrationId || state.identity.rootFingerprint !== bound.storageRootFingerprint
+                    || state.identity.machineId !== frame.machineId || state.identity.agentId !== frame.agentId)
+                    throw new Error("migration_state_identity_mismatch");
+                identity = state.identity;
+            }
+            if (!state) {
+                state = await readKnownState(`.crew/memory/migrations/${frame.migrationId}/terminal.json`).catch((e) => {
+                    if (e.code !== "ENOENT")
+                        throw e;
+                    return readKnownState(`.crew/memory/migrations/${frame.migrationId}/manifest.json`);
+                });
+                identity = state.identity;
+            }
+            if (state.planDigest !== operation.planDigest || state.sourceDigest !== operation.sourceDigest)
+                throw new Error("migration_server_plan_mismatch");
+            const prior = await deps.journal.get(identity.executionId);
+            if (state.phase !== "committed" && (!prior || (prior.state !== "completed" && prior.state !== "interrupted"))) {
+                throw new Error("migration_stop_unproven");
+            }
+            const result = await runTool("recover", { serverHistory: history.serverHistory, cancelled: !intentConfirmed || operation.cancelRequestedAt !== null,
+                stoppedReceipt: { kind: "migration_process_stopped", migrationId: frame.migrationId, machineId: frame.machineId,
+                    executionId: identity.executionId, ownerIdentity: identity.ownerIdentity, pid: null,
+                    stoppedAt: new Date().toISOString(), proof: "journal_reconciled" } });
+            if (result.result !== "success")
+                throw new Error("migration_recovery_failed");
+        }
+        else {
+            const prepared = await runTool("prepare", { serverHistory: history.serverHistory,
+                ...(frame.recordMappings ? { recordMappings: frame.recordMappings } : {}) });
+            if (prepared.result === "needs_review") {
+                await control("needs-review", { issues: prepared.issues });
+                await finish("failed", "migration_needs_review");
+                return { kind: "needs_review" };
+            }
+            if (prepared.result !== "success")
+                throw new Error("migration_prepare_failed");
+            state = await readState();
+            const confirmed = await control("intent", { sourceDigest: state.sourceDigest, planDigest: state.planDigest,
+                minReaderCapabilities: ["memory_storage_v2", "memory_state_guard_v1"], minWriterCapabilities: ["memory_storage_v2", "memory_state_guard_v1"] });
+            intentConfirmed = true;
+            intentReceipt = { ...identity, kind: "server_write_intent", sourceDigest: state.sourceDigest,
+                planDigest: state.planDigest, intentVersion: confirmed.revision, confirmedAt: confirmed.writeIntentConfirmedAt };
+            const result = await runTool("apply", { intentReceipt });
+            if (result.result !== "success")
+                throw new Error("migration_apply_failed");
+        }
+        state = await readState();
+        if (state.phase !== "committed" && state.phase !== "rolled_back")
+            throw new Error("migration_terminal_unverified");
+        if (!intentConfirmed) {
+            if (state.phase !== "rolled_back")
+                throw new Error("migration_commit_without_intent");
+            await control("no-write", { sourceDigest: state.sourceDigest, planDigest: state.planDigest, verified: true });
+        }
+        else
+            await control("result", { outcome: state.phase, storageVersion: state.storageVersion,
+                sourceDigest: state.sourceDigest, planDigest: state.planDigest, origin: state.origin, verified: true });
+        await finish("succeeded");
+        return { kind: "completed", phase: state.phase };
+    }
+    catch (error) {
+        const reason = error instanceof Error && /^[a-z_]+$/u.test(error.message) ? error.message : "migration_execution_failed";
+        if (acquisitionRequested) {
+            try {
+                const latest = z.object({ operations: z.array(Operation) }).passthrough().parse(await deps.control("history", {}))
+                    .operations.find(op => op.id === frame.migrationId);
+                if (!latest || latest.executionId !== frame.executionId)
+                    throw new Error("migration_control_owner_changed");
+                revision = latest.revision;
+                intentConfirmed = latest.writeIntentConfirmedAt !== null;
+                acquired = !["needs_review", "rolled_back"].includes(latest.status);
+                if (intentConfirmed && identity && state && latest.sourceDigest === state.sourceDigest && latest.planDigest === state.planDigest) {
+                    intentReceipt = { ...identity, kind: "server_write_intent", sourceDigest: state.sourceDigest, planDigest: state.planDigest,
+                        intentVersion: latest.revision, confirmedAt: latest.writeIntentConfirmedAt };
+                }
+            }
+            catch {
+                keepProtection = true;
+            }
+        }
+        if (acquired) {
+            if (intentConfirmed) {
+                keepProtection = true;
+                if (stopped && identity && lastPid !== null) {
+                    try {
+                        const recovered = await runTool("recover", { cancelled: true, ...(intentReceipt ? { intentReceipt } : {}),
+                            stoppedReceipt: { kind: "migration_process_stopped", migrationId: frame.migrationId, machineId: frame.machineId,
+                                executionId: identity.executionId, ownerIdentity: identity.ownerIdentity, pid: lastPid,
+                                stoppedAt: new Date().toISOString(), proof: "supervisor_exit" } });
+                        state = await readState();
+                        if (recovered.result === "success" && (state.phase === "committed" || state.phase === "rolled_back")) {
+                            await control("result", { outcome: state.phase, storageVersion: state.storageVersion,
+                                sourceDigest: state.sourceDigest, planDigest: state.planDigest, origin: state.origin, verified: true });
+                            keepProtection = false;
+                        }
+                    }
+                    catch { /* 未证明提交或完整回退时保留保护。 */ }
+                }
+                if (keepProtection)
+                    await control("repair", { reason }).catch(() => undefined);
+            }
+            else if (stopped) {
+                let digests;
+                try {
+                    let local = await readState().catch((error) => { if (error.code === "ENOENT")
+                        return undefined; throw error; });
+                    if (local?.migrationId !== frame.migrationId) {
+                        local = await readKnownState(`.crew/memory/migrations/${frame.migrationId}/manifest.json`).catch(async (error) => {
+                            if (error.code !== "ENOENT")
+                                throw error;
+                            const residue = await lstat(join(dir, ".crew/memory/migrations", frame.migrationId)).catch((statError) => {
+                                if (statError.code === "ENOENT")
+                                    return undefined;
+                                throw statError;
+                            });
+                            if (residue)
+                                throw new Error("migration_prepare_residue_unverified");
+                            return undefined;
+                        });
+                    }
+                    if (local?.migrationId === frame.migrationId) {
+                        if (!identity || lastPid === null || Object.keys(local.identity).some(key => local.identity[key] !== identity[key])
+                            || local.intentReceipt || !["prepared", "rolled_back"].includes(local.phase))
+                            throw new Error("migration_no_write_state_unverified");
+                        digests = { sourceDigest: local.sourceDigest, planDigest: local.planDigest };
+                        const recovered = await runTool("recover", { cancelled: true,
+                            serverHistory: { kind: "existing", migrationId: frame.migrationId, writeIntentConfirmed: false,
+                                ...(serverHistory?.rolledBackOperations ? { rolledBackOperations: serverHistory.rolledBackOperations } : {}) },
+                            stoppedReceipt: { kind: "migration_process_stopped", migrationId: frame.migrationId, machineId: frame.machineId,
+                                executionId: identity.executionId, ownerIdentity: identity.ownerIdentity, pid: lastPid,
+                                stoppedAt: new Date().toISOString(), proof: "supervisor_exit" } });
+                        state = await readState();
+                        if (recovered.result !== "success" || state.phase !== "rolled_back")
+                            throw new Error("migration_no_write_rollback_unverified");
+                        digests = { sourceDigest: state.sourceDigest, planDigest: state.planDigest };
+                    }
+                    await control("no-write", { verified: true, ...digests });
+                    keepProtection = false;
+                }
+                catch {
+                    keepProtection = true;
+                    await control("repair", { reason: "migration_no_write_rollback_unverified", ...digests }).catch(() => undefined);
+                }
+            }
+            else
+                keepProtection = true;
+        }
+        if (stopped)
+            await finish("failed", reason).catch(() => undefined);
+        return { kind: "failed", reason, processStopped: stopped, lastPid };
+    }
+    finally {
+        if (!keepProtection && stopped) {
+            protectedWindows.delete(protectionKey);
+            await exclusive.release();
+        }
+        else
+            protectedWindows.set(protectionKey, exclusive);
+    }
+}

package/dist/memory-prune-diagnostics.js

@@ -7,6 +7,7 @@ import { dslog } from "./slog.js";
 const TRACE_PATTERN = /\[memory-prune trace_id=([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\]/i;
 export const MEMORY_PRUNE_HASH_LIMIT_BYTES = 10 * 1024 * 1024;
 export const MEMORY_PRUNE_NOTES_MANIFEST_LIMIT = 128;
+export const MEMORY_PRUNE_PENDING_MANIFEST_LIMIT = 128;
 export const MEMORY_PRUNE_NOTE_CHANGE_LIMIT = 128;
 function compareCodeUnits(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
@@ -192,6 +193,50 @@ export async function inspectMemoryPruneNotes(homeDir, signal) {
         ...(signal?.aborted ? { error: "ABORT_ERR" } : {}),
     };
 }
+export async function inspectMemoryPrunePending(homeDir, signal) {
+    const pendingDir = join(homeDir, ".crew", "memory", "pending");
+    try {
+        const metadata = await lstat(pendingDir);
+        if (metadata.isSymbolicLink())
+            return { files: [], total_count: 0, omitted_count: 0, truncated: false, error: "symbolic_link" };
+        if (!metadata.isDirectory())
+            return { files: [], total_count: 0, omitted_count: 0, truncated: false, error: "ENOTDIR" };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { files: [], total_count: 0, omitted_count: 0, truncated: false };
+        return { files: [], total_count: 0, omitted_count: 0, truncated: false, error: diagnosticError(error) };
+    }
+    let names;
+    try {
+        names = (await readdir(pendingDir, { withFileTypes: true }))
+            .filter(entry => (entry.isFile() || entry.isSymbolicLink()) && entry.name.endsWith(".json"))
+            .map(entry => entry.name).sort(compareCodeUnits);
+    }
+    catch (error) {
+        return { files: [], total_count: 0, omitted_count: 0, truncated: false, error: diagnosticError(error) };
+    }
+    const selected = names.slice(0, MEMORY_PRUNE_PENDING_MANIFEST_LIMIT);
+    const files = [];
+    for (const name of selected) {
+        if (signal?.aborted)
+            break;
+        const path = join(pendingDir, name);
+        try {
+            if ((await lstat(path)).isSymbolicLink()) {
+                files.push({ relative_path: `.crew/memory/pending/${name}`, exists: false, error: "symbolic_link" });
+                continue;
+            }
+        }
+        catch (error) {
+            files.push({ relative_path: `.crew/memory/pending/${name}`, exists: false, error: diagnosticError(error) });
+            continue;
+        }
+        files.push({ relative_path: `.crew/memory/pending/${name}`, ...await inspectFile(path, false, undefined, signal) });
+    }
+    return { files, total_count: names.length, omitted_count: Math.max(0, names.length - selected.length),
+        truncated: names.length > selected.length, ...(signal?.aborted ? { error: "ABORT_ERR" } : {}) };
+}
 async function inspectMemoryPruneFixedFiles(homeDir, runDir, workLogPath, signal) {
     const cwdIsHome = runDir === homeDir;
     const [memory, lessons, cwdMemory, cwdLessons, workLog] = await Promise.all([
@@ -210,15 +255,17 @@ async function inspectMemoryPruneFixedFiles(homeDir, runDir, workLogPath, signal
     };
 }
 export async function inspectMemoryPruneFiles(homeDir, runDir, workLogPath, signal) {
-    const [fixedFiles, notesManifest] = await Promise.all([
+    const [fixedFiles, notesManifest, pendingManifest] = await Promise.all([
         inspectMemoryPruneFixedFiles(homeDir, runDir, workLogPath, signal),
         inspectMemoryPruneNotes(homeDir, signal),
+        inspectMemoryPrunePending(homeDir, signal),
     ]);
-    return { ...fixedFiles, notes_manifest: notesManifest };
+    return { ...fixedFiles, notes_manifest: notesManifest, pending_manifest: pendingManifest };
 }
 export async function inspectMemoryPruneFilesWithinDeadline(homeDir, runDir, workLogPath, timeoutMs) {
     const fixedFiles = await withinMemoryPruneDiagnosticsDeadline((signal) => inspectMemoryPruneFixedFiles(homeDir, runDir, workLogPath, signal), timeoutMs);
     let notesManifest;
+    let pendingManifest;
     try {
         notesManifest = await withinMemoryPruneDiagnosticsDeadline((signal) => inspectMemoryPruneNotes(homeDir, signal), timeoutMs);
     }
@@ -231,7 +278,13 @@ export async function inspectMemoryPruneFilesWithinDeadline(homeDir, runDir, wor
             error: diagnosticError(error),
         };
     }
-    return { ...fixedFiles, notes_manifest: notesManifest };
+    try {
+        pendingManifest = await withinMemoryPruneDiagnosticsDeadline(signal => inspectMemoryPrunePending(homeDir, signal), timeoutMs);
+    }
+    catch (error) {
+        pendingManifest = { files: [], total_count: 0, omitted_count: 0, truncated: false, error: diagnosticError(error) };
+    }
+    return { ...fixedFiles, notes_manifest: notesManifest, pending_manifest: pendingManifest };
 }
 export async function withinMemoryPruneDiagnosticsDeadline(operation, timeoutMs) {
     const controller = new AbortController();
@@ -361,6 +414,7 @@ export function evaluateMemoryPrunePostcondition(before, after, execution) {
             && (after.cwd_memory.lessons_reference_count ?? 0) > 0,
         cwd_lessons_changed: !after.cwd_lessons.same_as_shared_path
             && fileChanged(before.cwd_lessons, after.cwd_lessons),
+        pending_changed: diffMemoryPruneNotes(before.pending_manifest ?? { files: [], total_count: 0, omitted_count: 0, truncated: false }, after.pending_manifest ?? { files: [], total_count: 0, omitted_count: 0, truncated: false }).change_count > 0,
     };
     let outcome;
     if (!execution.executorCompleted)
@@ -388,6 +442,8 @@ export function evaluateMemoryPrunePostcondition(before, after, execution) {
         outcome = "promoted_without_index_change";
     else if (facts.shared_memory_changed)
         outcome = "shared_memory_updated";
+    else if (facts.pending_changed)
+        outcome = "pending_updated";
     else
         outcome = "no_files_changed";
     return { outcome, ...facts };
@@ -408,7 +464,7 @@ function memoryPruneFileFactFields(fileFacts) {
     }
     return fields;
 }
-export function memoryPruneSnapshotFields({ notes_manifest: _notesManifest, ...fileFacts }) {
+export function memoryPruneSnapshotFields({ notes_manifest: _notesManifest, pending_manifest: _pendingManifest, ...fileFacts }) {
     return memoryPruneFileFactFields(fileFacts);
 }
 export function logMemoryPruneDiagnosticsFailure(input, traceId, phase, error) {

package/dist/message-file-preview.js

@@ -9,6 +9,7 @@ import { z } from "zod";
 import { isInternalEnvironmentPath } from "./workspace-fs.js";
 import { opaqueKey, safeKey } from "./workspace.js";
 import { AgentHandleSchema } from "./execution-protocol.js";
+import { withMemoryAccess } from "./local-memory/migration-access.js";
 const MAX_BYTES = 256 * 1024;
 const MAX_BINARY_BYTES = 8 * 1024 * 1024;
 const MAX_CONCURRENT_READS = 4;
@@ -231,7 +232,16 @@ export async function readSharedMessageFile(agentsRoot, rawRequest, registry) {
         throw new SharedFileError("file_preview_busy");
     activeReads++;
     try {
-        return await readCandidate(await resolveCandidate(agentsRoot, parsed.data, registry));
+        const candidate = await resolveCandidate(agentsRoot, parsed.data, registry);
+        const agentRoot = await realpath(resolve(agentsRoot, parsed.data.handle)).catch((error) => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        // 记忆保护只用于该Agent根内资料，独立项目文件仍按原执行授权读取。
+        return await (agentRoot && inside(agentRoot, candidate.path)
+            ? withMemoryAccess(agentRoot, () => readCandidate(candidate))
+            : readCandidate(candidate));
     }
     catch (error) {
         if (error instanceof SharedFileError)