@nowcrew/daemon 0.6.93-beta.1 → 0.6.93-beta.10

package/dist/local-memory/migration-access.js

@@ -9,6 +9,7 @@ import { detectLocalMemoryStorageVersion, parseFullMemoryIndex } from "./storage
 import { readMemoryInventorySource, inventoryLimits } from "./inventory-source.js";
 import { MEMORY_STATE_GUARD_CAPABILITY, MEMORY_STORAGE_V2_CAPABILITY } from "../memory-migration-protocol.js";
 import { isLocalMemoryInitializationIdentity, localMemoryInitializationIdentity } from "./initialization-identity.js";
+import { assertMigrationStateIntegrity } from "./migration-state-invariants.js";
 export const LOCAL_MEMORY_V2_WRITER_CAPABILITIES = [MEMORY_STORAGE_V2_CAPABILITY, MEMORY_STATE_GUARD_CAPABILITY];
 /**
  * Keep an execution that started before migration from writing a committed V2
@@ -77,14 +78,33 @@ export async function assertMemoryAccessAllowed(agentDir, options = {}) {
     try {
         const source = await readMemoryInventorySource(agentDir, ".crew/memory/migration.v1.json", inventoryLimits.fileBytes);
         state = StateGate.parse(JSON.parse(source.content));
-        if (state.phase === "applying" || state.phase === "repair_required") {
-            const agentId = options.initializedRecoveryAgentId;
-            if (agentId === undefined)
+        if (state.phase === "prepared" || state.phase === "applying" || state.phase === "repair_required") {
+            if (options.pendingOnly && (state.phase === "prepared" || state.phase === "applying")) {
+                const fullState = MigrationStateSchema.parse(state);
+                assertMigrationStateIntegrity(fullState, fullState.identity);
+                // The migration inventory owns the pending directory while its journal
+                // is active.  Allowing an execution to append a candidate here would
+                // make the next classify() see an unplanned file and force
+                // repair_required.  Keep the journal fail-closed and let pending-only
+                // apply only to the marker-only legacy state (no active journal).
+                throw new Error("memory_migration_in_progress");
+            }
+            const recovery = options.initializedRecoveryIdentity;
+            if (recovery === undefined)
                 throw new Error("memory_migration_in_progress");
             const fullState = MigrationStateSchema.parse(state);
-            const identity = await localMemoryInitializationIdentity(agentDir, agentId);
+            assertMigrationStateIntegrity(fullState, fullState.identity);
+            const binding = recovery.workspaceId !== undefined && recovery.machineId !== undefined
+                ? { workspaceId: recovery.workspaceId, machineId: recovery.machineId }
+                : undefined;
+            const identity = await localMemoryInitializationIdentity(agentDir, recovery.agentId, binding);
+            const legacyIdentity = binding === undefined
+                ? identity
+                : await localMemoryInitializationIdentity(agentDir, recovery.agentId);
             if (fullState.origin !== "initialized"
-                || !isLocalMemoryInitializationIdentity(fullState.identity, identity)) {
+                || (fullState.phase === "prepared" && fullState.intentReceipt !== undefined)
+                || (!isLocalMemoryInitializationIdentity(fullState.identity, identity)
+                    && !isLocalMemoryInitializationIdentity(fullState.identity, legacyIdentity))) {
                 throw new Error("memory_migration_in_progress");
             }
             return;
@@ -112,8 +132,10 @@ export async function assertMemoryAccessAllowed(agentDir, options = {}) {
         if (!state)
             throw new Error("memory_migration_state_missing");
         const verified = MigrationStateSchema.parse(state);
+        assertMigrationStateIntegrity(verified, verified.identity);
         if (verified.phase !== "committed" || verified.storageVersion !== 2 || version !== 2
-            || verified.identity.rootFingerprint !== createHash("sha256").update(await realpath(agentDir)).digest("hex")) {
+            || verified.identity.rootFingerprint !== createHash("sha256").update(await realpath(agentDir)).digest("hex")
+            || verified.identity.ownerIdentity !== String((await lstat(agentDir)).uid)) {
             throw new Error("memory_migration_state_invalid");
         }
         parseFullMemoryIndex(source.content);
@@ -171,9 +193,10 @@ export async function withMemoryAccess(agentDir, operation, options = {}) {
     try {
         if (!options.maintenance)
             await assertMemoryAccessAllowed(root, {
-                ...(options.initializedRecoveryAgentId === undefined ? {} : {
-                    initializedRecoveryAgentId: options.initializedRecoveryAgentId,
+                ...(options.initializedRecoveryIdentity === undefined ? {} : {
+                    initializedRecoveryIdentity: options.initializedRecoveryIdentity,
                 }),
+                ...(options.pendingOnly ? { pendingOnly: true } : {}),
             });
         lease.assertUsable();
         return await operation({ created });

package/dist/local-memory/migration-pending.js

@@ -0,0 +1,9 @@
+import { detectLocalMemoryStorageVersion } from "./storage-format.js";
+export function shouldUseMigrationDeferredPending(input) {
+    return input.pruneTraceId !== null
+        && input.writerMode === "blocked"
+        && input.rolloutEnabled
+        && input.legacyFallback !== true
+        && input.failure !== "inspection_failed"
+        && detectLocalMemoryStorageVersion(input.memory) === 1;
+}

package/dist/local-memory/migration-plan.js

@@ -17,7 +17,10 @@ export function initializeExactWorkspaceSeed(bytes) {
         return null;
     const heading = '\n## Knowledge Index\n';
     const insertion = memory.length - tail.length + tail.indexOf(heading) + heading.length;
-    return Buffer.from(`${memory.slice(0, insertion)}${renderFullMemoryIndex([])}\n${memory.slice(insertion)}`);
+    const initialized = `${memory.slice(0, insertion)}${renderFullMemoryIndex([])}\n${memory.slice(insertion)}`;
+    return Buffer.from(initialized
+        .replace(/<!-- 使用以下格式：[\s\S]*?-->\n<!-- 示例：[\s\S]*?-->\n/u, "<!-- V2 结构化索引由 daemon 管理。规范字段为 id、file、type、status、summary、triggers、priority、revision、anchor、updated，可选 review_after；不包含 scope。 -->\n")
+        .replace("- 每条索引必须保留 file、type、scope、summary、triggers、priority、updated 这些英文协议字段名。", "- V2 结构化索引由 daemon 管理；不要直接编辑索引字段或正文锚点。"));
 }
 const categories = /^(?:preferences|project-rules|testing|debugging|git|incidents|lessons)$/u;
 const blockPattern = /<!--\s*NOWWORK:MEMORY_ENTRY:BEGIN\s+id=([A-Za-z0-9_-]+)\s+revision=([1-9][0-9]*)\s*-->([\s\S]*?)<!--\s*NOWWORK:MEMORY_ENTRY:END\s+id=\1\s*-->/gu;
@@ -28,6 +31,29 @@ function migrationSummary(body, title) {
         .replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, 180);
     return clean(body) || clean(title) || 'Migrated memory';
 }
+const MIGRATION_EPOCH_DATE = '1970-01-01';
+function parseLegacyCardMetadata(card) {
+    const fieldMatches = [...card.matchAll(/^- ([a-z_]+):[^\S\r\n]*(.*)$/gmu)];
+    const fields = Object.fromEntries(fieldMatches.map(match => [match[1], match[2].trim()]));
+    const allowedFields = new Set(['file', 'scope', 'type', 'status', 'summary', 'priority', 'updated', 'triggers', 'review_after', 'id', 'anchor', 'revision']);
+    const category = /^notes\/(.+)\.md$/u.exec(fields.file ?? '')?.[1] ?? '';
+    const valid = !card.replace(/^- ([a-z_]+):[^\S\r\n]*(.*)$/gmu, '').replace(/^### .+\r?\n/u, '').trim()
+        && fieldMatches.length === Object.keys(fields).length
+        && Object.keys(fields).every(key => allowedFields.has(key))
+        && Boolean(categories.test(category) && fields.summary
+            && ['procedural', 'semantic', 'episodic', 'preference'].includes(fields.type ?? '')
+            && ['candidate', 'active', 'pinned', 'stale', 'superseded', 'archived'].includes(fields.status ?? '')
+            && ['high', 'medium', 'low'].includes(fields.priority ?? '') && fields.updated);
+    if (!valid)
+        return null;
+    return {
+        type: fields.type, summary: fields.summary,
+        priority: fields.priority, updated: fields.updated,
+        triggers: (fields.triggers ?? '').split(/[,，、]/u).map(item => item.trim()).filter(Boolean),
+        reviewAfter: fields.review_after ?? null,
+    };
+}
+const migrationDate = () => new Date().toISOString().slice(0, 10);
 export function validateMigrationTarget(files) {
     let totalBytes = 0;
     for (const [path, bytes] of files) {
@@ -61,6 +87,7 @@ export function planMemoryMigration(identity, files, supplied = []) {
     if (detectLocalMemoryStorageVersion(memory) !== identity.sourceStorageVersion)
         throw new MigrationError('migration_source_version_mismatch');
     const confirmedMappings = supplied.map(value => MigrationRecordMappingSchema.parse(value));
+    const fallbackUpdated = migrationDate();
     const mappingSourceDigests = new Map();
     for (const mapping of confirmedMappings) {
         if (mapping.sourceSha256 === undefined)
@@ -136,7 +163,7 @@ export function planMemoryMigration(identity, files, supplied = []) {
         const newEntries = additions.map(mapping => ({ id: mapping.targetId, title: mapping.title,
             file: `notes/${mapping.category}.md`, type: 'semantic', status: mapping.status,
             summary: migrationSummary(retainedHistory.get(mapping.targetId)?.body ?? files.get(mapping.sourceFile).toString('utf8').slice(mapping.start, mapping.end), mapping.title),
-            triggers: [], priority: 'medium', updated: '1970-01-01', anchor: mapping.targetId, revision: retainedHistory.get(mapping.targetId)?.revision ?? 1, reviewAfter: null }));
+            triggers: [], priority: 'medium', updated: fallbackUpdated, anchor: mapping.targetId, revision: retainedHistory.get(mapping.targetId)?.revision ?? 1, reviewAfter: null }));
         for (const mapping of additions) {
             if (retainedHistory.has(mapping.targetId))
                 continue;
@@ -229,8 +256,15 @@ export function planMemoryMigration(identity, files, supplied = []) {
                 continue;
             }
             const id = mapping.targetId ?? `mem_${digest(`${identity.migrationId}:${mapping.sourceFile}:${mapping.start}:${mapping.end}`).slice(0, 24)}`;
+            const confirmedMetadata = mapping.sourceFile === 'MEMORY.md' ? parseLegacyCardMetadata(body.slice(mapping.start, mapping.end)) : null;
             entries.push({ id, title: mapping.title, file: `notes/${mapping.category}.md`, type: 'semantic', status: mapping.status, summary: migrationSummary(body.slice(mapping.start, mapping.end), mapping.title),
-                triggers: [], priority: 'medium', updated: '1970-01-01', anchor: id, revision: 1, reviewAfter: null, ...knownMetadata.get(mapping.sourceFile) });
+                triggers: [], priority: 'medium', updated: fallbackUpdated, anchor: id, revision: 1, reviewAfter: null,
+                ...knownMetadata.get(mapping.sourceFile),
+                ...(confirmedMetadata ? (() => {
+                    const source = confirmedMetadata;
+                    return { type: source.type, summary: source.summary, triggers: source.triggers, priority: source.priority,
+                        updated: source.updated === MIGRATION_EPOCH_DATE ? fallbackUpdated : source.updated, reviewAfter: source.reviewAfter };
+                })() : {}) });
         }
         for (const [path, bytes] of files) {
             if (!path.startsWith('notes/') && path !== 'MEMORY.md')

package/dist/local-memory/migration-state-invariants.js

@@ -0,0 +1,65 @@
+import { createHash } from 'node:crypto';
+import { MigrationError, MigrationIntentReceiptSchema, } from './migration-schema.js';
+export const migrationOperationRoot = (identity) => `.crew/memory/migrations/${identity.migrationId}`;
+function canonical(data) {
+    if (Array.isArray(data))
+        return data.map(canonical);
+    if (data !== null && typeof data === 'object') {
+        return Object.fromEntries(Object.entries(data)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, value]) => [key, canonical(value)]));
+    }
+    return data;
+}
+export const encodeMigrationData = (data) => Buffer.from(JSON.stringify(canonical(data)));
+export const sameMigrationData = (left, right) => encodeMigrationData(left).equals(encodeMigrationData(right));
+export function migrationPlanDigest(identity, sourceDigest, manifest) {
+    return createHash('sha256')
+        .update(encodeMigrationData({ identity, sourceDigest, manifest }))
+        .digest('hex');
+}
+export function verifyMigrationIntent(receipt, state) {
+    const parsed = MigrationIntentReceiptSchema.parse(receipt);
+    for (const key of Object.keys(state.identity)) {
+        if (parsed[key] !== state.identity[key])
+            throw new MigrationError('migration_intent_identity_mismatch');
+    }
+    if (parsed.sourceDigest !== state.sourceDigest || parsed.planDigest !== state.planDigest) {
+        throw new MigrationError('migration_intent_digest_mismatch');
+    }
+    return parsed;
+}
+/** Pure validation shared by migration recovery and read-only inventory. */
+export function assertMigrationStateIntegrity(state, identity) {
+    if (!sameMigrationData(state.identity, identity) || state.migrationId !== identity.migrationId
+        || state.planDigest !== migrationPlanDigest(identity, state.sourceDigest, state.manifest)) {
+        throw new MigrationError('migration_identity_or_manifest_invalid');
+    }
+    // A prepared/applying/rolled-back journal still describes the source store;
+    // only a committed journal describes the V2 target.  repair_required may
+    // represent either side because it can be recorded after a committed target
+    // is found damaged.  Reject contradictory states before any recovery or
+    // pending-only escape hatch can use them.
+    const sourceVersion = state.identity.sourceStorageVersion;
+    const sourcePhase = state.phase === 'prepared' || state.phase === 'applying' || state.phase === 'rolled_back';
+    if (state.origin === 'initialized' && sourceVersion !== 0
+        || sourcePhase && state.storageVersion !== sourceVersion
+        || state.phase === 'committed' && state.storageVersion !== state.targetStorageVersion
+        || state.targetStorageVersion !== identity.targetStorageVersion) {
+        throw new MigrationError('migration_identity_or_manifest_invalid');
+    }
+    const paths = state.manifest.files.map(file => file.path);
+    if (new Set(paths).size !== paths.length || !paths.includes('MEMORY.md')) {
+        throw new MigrationError('migration_manifest_invalid');
+    }
+    const operationRoot = `${migrationOperationRoot(identity)}/`;
+    for (const file of state.manifest.files) {
+        for (const image of [file.before, file.after]) {
+            if (image.exists && !image.ref.startsWith(operationRoot)) {
+                throw new MigrationError('migration_manifest_invalid');
+            }
+        }
+    }
+    if (state.intentReceipt !== undefined)
+        verifyMigrationIntent(state.intentReceipt, state);
+}

package/dist/local-memory/migration-store.js

@@ -3,33 +3,10 @@ import { dirname } from 'node:path';
 import { z } from 'zod';
 import { atomicBytes, digest, inventory, readBytes, safePath, STATE_PATH, syncDirectory, validateMigrationRoot } from './migration-io.js';
 import { initializeExactWorkspaceSeed, planMemoryMigration, validateMigrationTarget } from './migration-plan.js';
-import { MigrationError, MigrationHistorySchema, MigrationIntentReceiptSchema, MigrationProcessStoppedReceiptSchema, MigrationStateSchema } from './migration-schema.js';
+import { MigrationError, MigrationHistorySchema, MigrationProcessStoppedReceiptSchema, MigrationStateSchema } from './migration-schema.js';
+import { assertMigrationStateIntegrity as assertIdentity, encodeMigrationData as encode, migrationOperationRoot as opRoot, migrationPlanDigest as planDigest, sameMigrationData as same, verifyMigrationIntent as verifyIntent, } from './migration-state-invariants.js';
 import { detectLocalMemoryStorageVersion } from './storage-format.js';
 import { isLocalMemoryInitializationIdentity, localMemoryInitializationIdentity } from './initialization-identity.js';
-const opRoot = (identity) => `.crew/memory/migrations/${identity.migrationId}`;
-function canonical(data) {
-    if (Array.isArray(data))
-        return data.map(canonical);
-    if (data !== null && typeof data === 'object')
-        return Object.fromEntries(Object.entries(data).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => [key, canonical(value)]));
-    return data;
-}
-const encode = (data) => Buffer.from(JSON.stringify(canonical(data)));
-const same = (a, b) => encode(a).equals(encode(b));
-const planDigest = (identity, sourceDigest, manifest) => digest(encode({ identity, sourceDigest, manifest }));
-function assertIdentity(state, identity) {
-    if (!same(state.identity, identity) || state.migrationId !== identity.migrationId
-        || state.planDigest !== planDigest(identity, state.sourceDigest, state.manifest))
-        throw new MigrationError('migration_identity_or_manifest_invalid');
-    const paths = state.manifest.files.map(file => file.path);
-    if (new Set(paths).size !== paths.length || !paths.includes('MEMORY.md'))
-        throw new MigrationError('migration_manifest_invalid');
-    for (const file of state.manifest.files)
-        for (const image of [file.before, file.after]) {
-            if (image.exists && !image.ref.startsWith(`${opRoot(identity)}/`))
-                throw new MigrationError('migration_manifest_invalid');
-        }
-}
 async function immutable(root, path, data) {
     const previous = await readBytes(root, path, 64 * 1024 * 1024);
     if (previous) {
@@ -41,6 +18,7 @@ async function immutable(root, path, data) {
 }
 async function save(root, state) {
     const parsed = MigrationStateSchema.parse(state);
+    assertIdentity(parsed, parsed.identity);
     if (parsed.phase === 'committed' || parsed.phase === 'rolled_back') {
         const previous = await readBytes(root, `${opRoot(parsed.identity)}/terminal.json`, 32 * 1024 * 1024);
         if (previous && !same(JSON.parse(previous.toString('utf8')), parsed)) {
@@ -76,15 +54,6 @@ export async function statusMemoryMigration(input) {
     const identity = await validateMigrationRoot(input.agentDir, input.identity);
     return load({ ...input, identity });
 }
-function verifyIntent(receipt, state) {
-    const parsed = MigrationIntentReceiptSchema.parse(receipt);
-    for (const key of Object.keys(state.identity))
-        if (parsed[key] !== state.identity[key])
-            throw new MigrationError('migration_intent_identity_mismatch');
-    if (parsed.sourceDigest !== state.sourceDigest || parsed.planDigest !== state.planDigest)
-        throw new MigrationError('migration_intent_digest_mismatch');
-    return parsed;
-}
 export async function prepareMemoryMigration(input, hooks = {}) {
     const identity = await validateMigrationRoot(input.agentDir, input.identity);
     const history = MigrationHistorySchema.parse(input.serverHistory);
@@ -120,7 +89,10 @@ export async function prepareMemoryMigration(input, hooks = {}) {
     const previousSeed = existing?.origin === 'initialized' && existing.phase === 'rolled_back'
         ? existing.manifest.files.find(file => file.path === 'MEMORY.md')?.before : undefined;
     const retryingOriginalSeed = previousSeed?.exists === true && sourceMemory !== undefined && digest(sourceMemory) === previousSeed.sha256;
-    const expectedInitializationIdentity = await localMemoryInitializationIdentity(input.agentDir, identity.agentId);
+    const expectedInitializationIdentity = await localMemoryInitializationIdentity(input.agentDir, identity.agentId, {
+        workspaceId: identity.workspaceId,
+        machineId: identity.machineId,
+    });
     const onlyCurrentOperationResidue = isLocalMemoryInitializationIdentity(identity, expectedInitializationIdentity)
         && existing === null && operations.length === 1
         && operations[0] === identity.migrationId;

package/dist/local-memory/pending-query.js

@@ -15,6 +15,7 @@ const SearchSchema = z.object({
     cursor: z.string().max(2048).optional(), limit: z.number().int().min(1).max(40).default(10),
 }).strict();
 const excerpt = (text, cap) => Array.from(text).slice(0, cap).join("");
+const pendingState = (reason) => reason === "legacy_requires_migration" ? "migration_deferred" : "capacity_deferred";
 export async function searchPendingMemoryPage(input) {
     const parsed = SearchSchema.safeParse(input);
     if (!parsed.success)
@@ -61,7 +62,8 @@ export async function searchPendingMemoryPage(input) {
         const match = source && isRecallablePending(source.candidate) && pendingRecallScore(source.candidate, args.query) > 0
             ? { pendingId: source.candidate.pendingId, sha256: source.sha256, title: source.candidate.candidate.title,
                 summary: excerpt(source.candidate.candidate.summary, 180), triggers: source.candidate.candidate.triggers.slice(0, 4),
-                operation: "create", state: "capacity_deferred" }
+                operation: "create", reason: source.candidate.reason,
+                state: pendingState(source.candidate.reason) }
             : null;
         const addition = match ?? warning;
         const size = addition ? Buffer.byteLength(JSON.stringify(addition), "utf8") + 2 : 0;
@@ -96,5 +98,6 @@ export async function readPendingMemoryBody(input) {
         throw new Error("memory_pending_not_recallable");
     const candidate = source.candidate.candidate;
     return { pendingId: source.candidate.pendingId, sha256: source.sha256, title: candidate.title,
-        operation: "create", state: "capacity_deferred", content: candidate.detailBody };
+        operation: "create", reason: source.candidate.reason,
+        state: pendingState(source.candidate.reason), content: candidate.detailBody };
 }

package/dist/local-memory/pending-schema.js

@@ -8,7 +8,7 @@ const ArchivedMemoryChangeSchema = LocalMemoryChangeSchema.extend({
 export const PendingIdSchema = z.string().max(200).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u);
 export const PendingMemorySchema = z.object({
     schemaVersion: z.literal(1), pendingId: PendingIdSchema,
-    createdAt: z.string().min(1).max(100), reason: z.literal("index_over_budget"),
+    createdAt: z.string().min(1).max(100), reason: z.enum(["index_over_budget", "legacy_requires_migration"]),
     source: z.object({ executionId: z.string().min(1).max(500), pruneTraceId: z.string().min(1).max(500).nullable() }).strict(),
     candidate: ArchivedMemoryChangeSchema,
 }).strict();

package/dist/local-memory/pending.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { lstat, mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, realpath, rename, rm, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { isRecallablePending, parsePendingMemoryCandidate } from "./pending-schema.js";
 import { pendingFileNames, pendingReadDirectory, PENDING_FILE_BYTES, readPendingSource } from "./pending-source.js";
@@ -103,6 +103,17 @@ export async function persistPendingMemoryCandidate(input) {
     const directory = await pendingDirectory(input.agentDir);
     const target = join(directory, `${parsed.pendingId}.json`);
     await assertRegularFile(target);
+    try {
+        const existing = parsePendingMemoryCandidate(JSON.parse(await readFile(target, "utf8")));
+        const dedupKey = (value) => value.reason === "legacy_requires_migration"
+            ? JSON.stringify({ schemaVersion: value.schemaVersion, reason: value.reason, candidate: value.candidate })
+            : JSON.stringify({ ...value, createdAt: "" });
+        if (dedupKey(existing) === dedupKey(parsed))
+            return target;
+    }
+    catch {
+        // A malformed existing candidate is replaced by the validated input below.
+    }
     await atomicWrite(target, `${JSON.stringify(parsed, null, 2)}\n`);
     return target;
 }
@@ -164,7 +175,10 @@ function truncateCodePoints(value, maxCodePoints) {
     return Array.from(value).slice(0, Math.max(0, maxCodePoints)).join("");
 }
 export function renderPendingMemoryContext(candidates, maxCodePoints = 2_000) {
-    const recallable = candidates.filter(isRecallablePending);
+    // Migration-deferred candidates remain explicitly searchable, but must not
+    // be injected into the ordinary prompt before a reviewed migration promotes
+    // them to the active catalog.
+    const recallable = candidates.filter((candidate) => isRecallablePending(candidate) && candidate.reason === "index_over_budget");
     if (recallable.length === 0 || maxCodePoints <= 0)
         return "";
     const header = `\n\n## Archived memory candidates (daemon-managed)\n容量暂存的新增资料，仅为部分预览，不代表完整检索；可参考但不能覆盖现行规则，未包含内容请按需查询。\n`;

package/dist/local-memory/prompt.js

@@ -2,7 +2,7 @@ import { dslog } from "../slog.js";
 import { renderPendingMemoryContext, searchPendingMemoryCandidates } from "./pending.js";
 import { renderLocalMemoryResultInstructions, renderLocalMemoryV2WriteGuard } from "./runtime.js";
 import { LOCAL_MEMORY_V2_DEFERRED_GUIDANCE, LOCAL_MEMORY_LEGACY_GUIDANCE } from "./rollout.js";
-const PENDING_READ_GUIDANCE = "\n\nV2新增资料预览未命中不代表没有资料；先查有效索引，必要时用 crew-memory search-pending --query '关键词'，按 nextCursor 续查；用 read-pending --id ID 分页读正文。容量暂存资料不能覆盖现行规则，未应用修改不作为记忆。用 crew-memory --help 查看参数。\n";
+const PENDING_READ_GUIDANCE = "\n\nV2新增资料预览未命中不代表没有资料；先查有效索引，必要时用 crew-memory search-pending --query '关键词'，按 nextCursor 续查；用 read-pending --id ID 分页读正文。容量暂存或迁移延期资料不能覆盖现行规则，未应用修改不作为记忆；迁移延期候选必须等 reviewed migration 后再按当前 ID/revision/hash 处理。用 crew-memory --help 查看参数。\n";
 export async function prepareLocalMemoryPrompt(input) {
     let pending = "";
     if (input.enabled) {
@@ -24,7 +24,7 @@ export async function prepareLocalMemoryPrompt(input) {
     const original = input.renderBase(0);
     const guard = input.legacyFallback ? LOCAL_MEMORY_LEGACY_GUIDANCE : input.deferred ? LOCAL_MEMORY_V2_DEFERRED_GUIDANCE
         : input.strictRollout && input.enabled && input.resultPath === null ? renderLocalMemoryV2WriteGuard() : "";
-    const structured = input.resultPath === null ? "" : renderLocalMemoryResultInstructions(input.resultPath, input.storageVersion);
+    const structured = input.resultPath === null ? "" : renderLocalMemoryResultInstructions(input.resultPath, input.storageVersion, input.migrationDeferred === true);
     const guidance = input.enabled ? PENDING_READ_GUIDANCE : "";
     let requiredMemoryBudgetError;
     // 短命令指引放在当前轮，独立于可舍弃预览；收尾契约仍保持系统与当前轮两份。

package/dist/local-memory/read-cli.js

@@ -81,10 +81,10 @@ search 关键词按空白分隔，同一行须全部命中；返回完整文件
 后续页可传 --if-hash <前一页的 sha256>，文件变化时停止，避免混读不同版本。
 schema=2 的 search 查询完整有效目录（active/pinned），按标题、摘要、触发词联合匹配并返回 ID、revision 和正文引用；search-history 显式查询历史/失效记录。预览未展示不代表记录不存在。
 旧格式 search/search-history 及 read 读取原文；search-history 是显式 legacy fallback，不把旧内容当作已结构化 V2 记录；read 按指定文件和哈希分页，不扫描 pending。
-search-pending 只查因容量延期的 create 候选；有 nextCursor 就继续，即使本页 matches 为空。
+search-pending 只查容量延期或迁移延期的 create 候选；有 nextCursor 就继续，即使本页 matches 为空。
 complete=true 才表示全部候选已检索完成且无遗漏；warnings 或非零退出码表示读取未完成，不能当作零命中。
 read-pending 只返回候选正文；offset 非零时必须传 --if-hash，update/supersede 候选不可读取。
-候选只供相关问题参考，未生效，不能覆盖有效规则；先读取当前有效索引与明细。`;
+候选只供相关问题参考，未生效，不能覆盖有效规则；先读取当前有效索引与明细。迁移延期候选会标记为 migration_deferred，必须等 reviewed migration 后再按当前 ID/revision/hash 处理。`;
 function inside(root, path) {
     const value = relative(root, path);
     return value !== ".." && !value.startsWith(`..${sep}`) && !isAbsolute(value);
@@ -180,8 +180,9 @@ function writeResult(result, io) {
 export async function runMemoryReadCommand(argv, io) {
     if (!io.env.CREW_HOME || argv.includes("--help") || argv.includes("-h"))
         return runMemoryReadUnlocked(argv, io);
+    const pendingOnly = argv[0] === "search-pending" || argv[0] === "read-pending";
     try {
-        return await withMemoryAccess(io.env.CREW_HOME, () => runMemoryReadUnlocked(argv, io));
+        return await withMemoryAccess(io.env.CREW_HOME, () => runMemoryReadUnlocked(argv, io), pendingOnly ? { pendingOnly: true } : {});
     }
     catch (error) {
         const reason = error instanceof Error && /^(?:local_)?memory_[a-z_]+$/u.test(error.message) ? error.message : "memory_migration_access_failed";

package/dist/local-memory/rollout.js

@@ -10,6 +10,19 @@ import { dslog } from "../slog.js";
 import { createHash } from "node:crypto";
 import { detectLocalMemoryStorageVersion, parseFullMemoryIndex } from "./storage-format.js";
 import { MigrationStateSchema } from "./migration-schema.js";
+import { assertMigrationStateIntegrity } from "./migration-state-invariants.js";
+const TRANSIENT_INSPECTION_ERRORS = new Set([
+    "EACCES", "EPERM", "EIO", "EBUSY", "EAGAIN", "EINTR", "ESTALE", "EMFILE", "ENFILE", "ENOMEM", "ETIMEDOUT",
+    "source_changed", "memory_migration_access_busy",
+]);
+export function localMemoryRolloutFailure(error) {
+    const code = error?.code;
+    const reason = error instanceof Error ? error.message : "";
+    return (typeof code === "string" && TRANSIENT_INSPECTION_ERRORS.has(code))
+        || TRANSIENT_INSPECTION_ERRORS.has(reason)
+        ? "inspection_failed"
+        : "requires_migration";
+}
 export const LOCAL_MEMORY_V2_DEFERRED_GUIDANCE = `
 
 ## 本轮本地记忆兼容状态
@@ -22,12 +35,19 @@ export const LOCAL_MEMORY_LEGACY_GUIDANCE = `
 本 Agent 尚未完成 V2 格式转换，本轮继续原记忆流程。用户明确要求新增或修改长期规则时，可按原规则最小范围更新共享记忆；记忆收尾继续依据任务日志更新原 MEMORY.md 和 notes，确认成功后再清理日志。
 本节覆盖旧会话中因等待 V2 转换而冻结共享记忆写入的要求，但不是新的用户写入授权；本任务如明确要求不更新记忆，继续遵守。
 保留原身份、目标及无关资料，不自行迁移或重置文件，不宣称已启用 V2。`;
-export function reportLocalMemoryV2Deferred(executionId, handle, memoryPrune, legacyFallback = false) {
-    dslog("local_memory.v2_deferred", legacyFallback ? "旧格式继续原记忆流程，转换成功后再启用V2" : "记忆格式异常，保留原资料和待处理日志", {
-        execution_id: executionId, agent_handle: handle, reason: legacyFallback ? "legacy_compatible" : "requires_migration"
+export function reportLocalMemoryV2Deferred(executionId, handle, memoryPrune, legacyFallback = false, failure = "requires_migration", allowPendingOnly = false) {
+    dslog("local_memory.v2_deferred", allowPendingOnly
+        ? "迁移尚未完成，新增候选隔离保存到 pending"
+        : legacyFallback ? "旧格式继续原记忆流程，转换成功后再启用V2" : "记忆格式异常，保留原资料和待处理日志", {
+        execution_id: executionId,
+        agent_handle: handle,
+        reason: legacyFallback ? "legacy_compatible" : failure,
+        writer_mode: allowPendingOnly ? "pending_only" : legacyFallback ? "legacy" : "blocked",
+        ...(allowPendingOnly ? { pending_reason: "legacy_requires_migration" } : {}),
     });
-    if (memoryPrune && !legacyFallback)
-        throw new Error("local_memory_v2_requires_migration");
+    if (memoryPrune && !legacyFallback && !allowPendingOnly) {
+        throw new Error(failure === "inspection_failed" ? "local_memory_inspection_failed" : "local_memory_v2_requires_migration");
+    }
 }
 /** 只核对小型索引和其引用；不扫描全部历史任务、不迁移或生成新存储。 */
 export async function resolveLocalMemoryV2Rollout(input) {
@@ -43,14 +63,16 @@ export async function resolveLocalMemoryV2Rollout(input) {
             const root = await realpath(input.workspace.dir);
             const record = await readMemoryInventorySource(root, ".crew/memory/migration.v1.json", inventoryLimits.fileBytes);
             const state = MigrationStateSchema.parse(JSON.parse(record.content));
+            assertMigrationStateIntegrity(state, state.identity);
             if (state.phase !== "committed" || state.storageVersion !== 2
                 || state.identity.agentId !== (input.agentId ?? input.handle)
-                || state.identity.rootFingerprint !== createHash("sha256").update(root).digest("hex"))
+                || state.identity.rootFingerprint !== createHash("sha256").update(root).digest("hex")
+                || state.identity.ownerIdentity !== String((await lstat(root)).uid))
                 throw new Error("invalid_state");
             return { enabled: true, deferred: false };
         }
-        catch {
-            return { enabled: false, deferred: true };
+        catch (error) {
+            return { enabled: false, deferred: true, failure: localMemoryRolloutFailure(error) };
         }
     }
     if (environment === "production")
@@ -122,7 +144,7 @@ export async function resolveLocalMemoryV2Rollout(input) {
         }
         return { enabled: true, deferred: false };
     }
-    catch {
-        return deferred;
+    catch (error) {
+        return { ...deferred, failure: localMemoryRolloutFailure(error) };
     }
 }

package/dist/local-memory/runtime.js

@@ -55,8 +55,8 @@ function initializedIntent(identity, state) {
  * publication path used by migration.  The marker is written only after the
  * committed catalog and state have both been verified.
  */
-export async function initializeLocalMemoryV2(agentDir, agentId) {
-    const identity = await localMemoryInitializationIdentity(agentDir, agentId);
+async function initializeLocalMemoryV2WithBinding(agentDir, agentId, binding) {
+    const identity = await localMemoryInitializationIdentity(agentDir, agentId, binding);
     let state = await prepareMemoryMigration({
         agentDir,
         identity,
@@ -96,7 +96,11 @@ export async function initializeLocalMemoryV2(agentDir, agentId) {
     }
     await writeLocalMemoryV2Marker(agentDir);
 }
-export async function initializeLocalMemoryV2ForWorkspace(workspace, enabledForHandle, agentId) {
+/** Fresh initialization requires the identity from the authenticated ready frame. */
+export function initializeLocalMemoryV2(agentDir, agentId, binding) {
+    return initializeLocalMemoryV2WithBinding(agentDir, agentId, binding);
+}
+export async function initializeLocalMemoryV2ForWorkspace(workspace, enabledForHandle, agentId, binding) {
     const initialized = workspace.localMemoryV2Initialized === true;
     if (initialized)
         return true;
@@ -105,12 +109,19 @@ export async function initializeLocalMemoryV2ForWorkspace(workspace, enabledForH
     if (workspace.localMemoryV2Initialized !== false)
         return false;
     let resumable = false;
+    let effectiveBinding = binding;
     try {
         const state = MigrationStateSchema.parse(JSON.parse(await readFile(join(workspace.dir, ".crew", "memory", "migration.v1.json"), "utf8")));
-        const identity = await localMemoryInitializationIdentity(workspace.dir, agentId);
+        const identity = await localMemoryInitializationIdentity(workspace.dir, agentId, binding);
+        const legacyIdentity = binding === undefined
+            ? identity
+            : await localMemoryInitializationIdentity(workspace.dir, agentId);
         resumable = state.origin === "initialized"
             && state.phase !== "rolled_back"
-            && isLocalMemoryInitializationIdentity(state.identity, identity);
+            && (isLocalMemoryInitializationIdentity(state.identity, identity)
+                || isLocalMemoryInitializationIdentity(state.identity, legacyIdentity));
+        if (resumable && isLocalMemoryInitializationIdentity(state.identity, legacyIdentity))
+            effectiveBinding = undefined;
     }
     catch (error) {
         if (error.code !== "ENOENT")
@@ -120,8 +131,18 @@ export async function initializeLocalMemoryV2ForWorkspace(workspace, enabledForH
             if (!migrations.isDirectory() || migrations.isSymbolicLink()) {
                 throw new Error("local_memory_v2_initialization_residue_invalid");
             }
-            const identity = await localMemoryInitializationIdentity(workspace.dir, agentId);
-            const operation = await lstat(join(workspace.dir, ".crew", "memory", "migrations", identity.migrationId));
+            const identity = await localMemoryInitializationIdentity(workspace.dir, agentId, binding);
+            const legacyIdentity = binding === undefined
+                ? identity
+                : await localMemoryInitializationIdentity(workspace.dir, agentId);
+            let operationIdentity = identity;
+            const operation = await lstat(join(workspace.dir, ".crew", "memory", "migrations", identity.migrationId))
+                .catch(async (error) => {
+                if (error.code !== "ENOENT" || identity.migrationId === legacyIdentity.migrationId)
+                    throw error;
+                operationIdentity = legacyIdentity;
+                return lstat(join(workspace.dir, ".crew", "memory", "migrations", legacyIdentity.migrationId));
+            });
             if (!operation.isDirectory() || operation.isSymbolicLink()) {
                 throw new Error("local_memory_v2_initialization_residue_invalid");
             }
@@ -130,6 +151,8 @@ export async function initializeLocalMemoryV2ForWorkspace(workspace, enabledForH
             resumable = current.files.size === 1 && memory !== undefined
                 && current.directories.every(path => path === "notes" || path === ".crew/memory/pending")
                 && initializeExactWorkspaceSeed(memory) !== null;
+            if (resumable && operationIdentity.migrationId === legacyIdentity.migrationId)
+                effectiveBinding = undefined;
         }
         catch (residueError) {
             if (residueError.code !== "ENOENT")
@@ -142,17 +165,23 @@ export async function initializeLocalMemoryV2ForWorkspace(workspace, enabledForH
         && workspace.memorySeedCreated === true;
     if (!resumable && !pristineFirstInitialization)
         return false;
-    await initializeLocalMemoryV2(workspace.dir, agentId);
+    // Never create another unbound sentinel. Undefined is retained solely to
+    // finish a pre-upgrade journal already proven above.
+    if (!resumable && effectiveBinding === undefined)
+        return false;
+    await initializeLocalMemoryV2WithBinding(workspace.dir, agentId, effectiveBinding);
     return true;
 }
 export function localMemoryResultPath(runDir, executionId) {
     const suffix = createHash("sha256").update(executionId, "utf8").digest("hex").slice(0, 32);
     return join(runDir, `.memory-result.v1-${suffix}.json`);
 }
-export function renderLocalMemoryResultInstructions(resultPath, storageVersion = 1) {
-    const storagePolicy = storageVersion === 2
-        ? "完整目录保存在 MEMORY.md，模型只看到有界预览；未展示记录仍然有效。涉及旧规则时先用 crew-memory search 查询完整目录，按当前 ID/revision 更新，不因预览未命中就重复新建。20条预览不是有效记录上限；完整存储超出资源上限会拒绝提交，不得自行删除或降级旧记录。已有 pending 仍是未应用候选，须重新核对授权、重复与版本后通过 changes 申请保存，不因迁移自动生效。"
-        : "daemon 会校验、去重、限制 MEMORY.md 大小，超出索引容量的候选会保存在 pending 归档中。容量暂存的 create 可按需检索参考但不能覆盖现行规则；有空间的后续 proposed 提交可提升。未应用的 update/supersede 不进入普通召回，必须重新核对目标版本后处理。";
+export function renderLocalMemoryResultInstructions(resultPath, storageVersion = 1, migrationDeferred = false) {
+    const storagePolicy = migrationDeferred
+        ? "该 Agent 的旧记忆仍在迁移审阅中。本轮只允许提交新的 create 候选；daemon 会把候选原子保存到 .crew/memory/pending/，reason=legacy_requires_migration，并提供 search-pending/read-pending 查询。候选不会进入 active，也不会自动注入普通上下文；更新、替代和 statusChanges 必须留待迁移完成后按当前 V2 ID/revision/hash 重新核对。旧 MEMORY.md、notes 和已有 active/pending 保持不变。"
+        : storageVersion === 2
+            ? "完整目录保存在 MEMORY.md，模型只看到有界预览；未展示记录仍然有效。涉及旧规则时先用 crew-memory search 查询完整目录，按当前 ID/revision 更新，不因预览未命中就重复新建。20条预览不是有效记录上限；完整存储超出资源上限会拒绝提交，不得自行删除或降级旧记录。已有 pending 仍是未应用候选，须重新核对授权、重复与版本后通过 changes 申请保存，不因迁移自动生效。"
+            : "daemon 会校验、去重、限制 MEMORY.md 大小，超出索引容量的候选会保存在 pending 归档中。容量暂存的 create 可按需检索参考但不能覆盖现行规则；有空间的后续 proposed 提交可提升。未应用的 update/supersede 不进入普通召回，必须重新核对目标版本后处理。";
     return `
 
 ## Structured memory prune (daemon-managed)
@@ -243,6 +272,8 @@ export async function commitLocalMemoryResultAfterExit(input) {
             executionId: input.executionId,
             pruneTraceId: input.pruneTraceId,
             ...(input.writerCapabilities === undefined ? {} : { writerCapabilities: input.writerCapabilities }),
+            ...(input.requiredStorageVersion === undefined ? {} : { requiredStorageVersion: input.requiredStorageVersion }),
+            ...(input.migrationDeferredPending ? { migrationDeferredPending: true } : {}),
         });
         storageAfter = await localMemoryStorageFacts(input.agentDir);
         if (input.requiredStorageVersion === 2
@@ -282,5 +313,7 @@ export async function commitLocalMemoryResultAfterExit(input) {
     return { status: "applied", storageVersionBefore: storageBefore.storageVersion,
         storageVersionAfter: storageAfter.storageVersion, committedState: storageAfter.committedState,
         createdIds: applied.createdIds, updatedIds: applied.updatedIds,
-        statusChangedIds: applied.statusChangedIds, pendingIds: applied.pendingIds };
+        statusChangedIds: applied.statusChangedIds, pendingIds: applied.pendingIds,
+        ...(input.migrationDeferredPending
+            ? { pendingReason: "legacy_requires_migration" } : {}) };
 }