@nowcrew/daemon 0.6.97 → 0.6.98-beta.1

package/dist/automatic-service-migration.js

@@ -3,6 +3,8 @@ import { posix, win32 } from "node:path";
 import { buildServiceSpec, serviceStatus, windowsCommandArg, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { inspectLegacyServiceInstallationDetails } from "./legacy-service-installation.js";
+import { powershellCommandArgs } from "./powershell-command.js";
+import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -142,12 +144,11 @@ async function discoverWindows(input, identity) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
-        "[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+        "$task=$tasks[0];$actions=@($task.Actions);",
+        windowsTaskPrincipalScript,
+        `[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
     ].join("");
-    const result = await input.runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encoded(identity.id),
-    ]);
+    const result = await input.runner("powershell.exe", powershellCommandArgs(script, [encoded(identity.id)]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect legacy scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -165,7 +166,7 @@ async function discoverWindows(input, identity) {
         : null;
     if (definition.count !== 1
         || definition.actionCount !== 1
-        || definition.principalMatches !== true
+        || !windowsTaskPrincipalMatches(definition)
         || !win32.isAbsolute(definition.execute ?? "")
         || match === null
         || match[2] !== input.desired.profile

package/dist/computer-service.js

@@ -6,7 +6,9 @@ import { promisify } from "node:util";
 import { dirname, resolve } from "node:path";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
 import { daemonRegistryCandidates } from "./daemon-registry.js";
+import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 import { npmInvocation } from "./npm-command.js";
+import { powershellCommandArgs } from "./powershell-command.js";
 const execFileAsync = promisify(execFile);
 const WINDOWS_STOP_TIMEOUT_MS = 5_000;
 const WINDOWS_STOP_POLL_MS = 100;
@@ -195,12 +197,11 @@ async function windowsTaskDefinitionMatches(spec, runner) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
-        "[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
+        "$task=$tasks[0];$actions=@($task.Actions);",
+        windowsTaskPrincipalScript,
+        `[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
-    ]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect scheduled task definition: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -214,7 +215,7 @@ async function windowsTaskDefinitionMatches(spec, runner) {
     const expectedArguments = spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ");
     return definition.count === 1
         && definition.actionCount === 1
-        && definition.principalMatches === true
+        && windowsTaskPrincipalMatches(definition)
         && sameWindowsPath(definition.execute, spec.daemonCommand[0])
         && definition.arguments === expectedArguments;
 }
@@ -226,9 +227,7 @@ async function windowsTaskState(spec, runner) {
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -eq 0){'missing'}elseif($tasks.Count -eq 1){'state:'+([int]$tasks[0].State)}else{throw 'duplicate scheduled tasks'}",
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
-    ]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
     if (result.exitCode !== 0) {
         throw new Error(`Unable to query scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -279,10 +278,9 @@ export async function installService(spec, runner = systemCommandRunner) {
             "$principal=New-ScheduledTaskPrincipal -UserId $identity -LogonType Interactive -RunLevel Limited;",
             "Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -ErrorAction Stop|Out-Null;",
         ].join("");
-        await checked(runner, "powershell.exe", [
-            "-NoProfile", "-NonInteractive", "-Command", script,
+        await checked(runner, "powershell.exe", powershellCommandArgs(script, [
             encodedName, encodedExecutable, encodedArguments,
-        ], "Scheduled task installation");
+        ]), "Scheduled task installation");
         return;
     }
     if (spec.descriptorPath === null || spec.descriptor === null)
@@ -418,6 +416,33 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
     }
 }
 const systemDetachedSpawn = (command, args, options) => spawn(command, [...args], options);
+function windowsRestartCommandArgs(spec) {
+    if (!spec.runtimeProcessIdentity)
+        throw new Error("Windows daemon process identity is required for restart");
+    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
+    const encodedExecutable = Buffer.from(spec.daemonCommand[0], "utf16le").toString("base64");
+    const encodedArguments = Buffer.from(spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "), "utf16le").toString("base64");
+    const script = [
+        "$ErrorActionPreference='Stop';",
+        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
+        "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
+        "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
+        "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
+        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+        "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
+        "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
+        "$p.Kill();",
+        "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
+        "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
+        "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
+        "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
+        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+        "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
+    ].join("");
+    return powershellCommandArgs(script, [
+        String(process.pid), encodedName, encodedExecutable, encodedArguments, spec.runtimeProcessIdentity,
+    ]);
+}
 const RESTART_HELPER_SOURCE = String.raw `
 const { spawnSync } = require("node:child_process");
 const spec = JSON.parse(process.argv[1]);
@@ -428,27 +453,7 @@ setTimeout(() => {
   } else if (spec.platform === "linux") {
     restarted = spawnSync("systemctl", ["--user", "--no-block", "restart", spec.id], { stdio: "ignore", shell: false });
   } else {
-    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
-    const encodedExecutable = Buffer.from(spec.executable, "utf16le").toString("base64");
-    const encodedArguments = Buffer.from(spec.arguments, "utf16le").toString("base64");
-    const script = [
-      "$ErrorActionPreference='Stop';",
-      "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
-      "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
-      "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
-      "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
-      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-      "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
-      "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
-      "$p.Kill();",
-      "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
-      "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
-      "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
-      "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
-      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-      "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
-    ].join("");
-    restarted = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, String(spec.daemonPid), encodedName, encodedExecutable, encodedArguments, spec.processIdentity], { stdio: "ignore", shell: false });
+    restarted = spawnSync("powershell.exe", spec.powershellArgs, { stdio: "ignore", shell: false });
   }
   if (restarted.status !== 0) process.send?.({ type: "restart-failed", status: restarted.status });
   setTimeout(() => {
@@ -470,15 +475,8 @@ export function scheduleServiceRestart(spec, spawnDetached = systemDetachedSpawn
             ? { platform: spec.platform, id: spec.id }
             : {
                 platform: spec.platform,
-                id: spec.id,
-                daemonPid: process.pid,
-                executable: spec.daemonCommand[0],
-                arguments: spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "),
-                processIdentity: spec.runtimeProcessIdentity,
+                powershellArgs: windowsRestartCommandArgs(spec),
             };
-    if (spec.platform === "win32" && !payload.processIdentity) {
-        throw new Error("Windows daemon process identity is required for restart");
-    }
     const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"], shell: false });
     child.unref();
     let settleFailure;
@@ -627,7 +625,7 @@ export async function windowsProfileIsPrivate(path, runner = systemCommandRunner
         "$unsafe=$rules|Where-Object { $_.AccessControlType -eq 'Allow' -and $safe -notcontains $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value };",
         "if($unsafe){'false'}else{'true'}",
     ].join("");
-    const result = await runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, encodedPath]);
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedPath]));
     if (result.exitCode !== 0)
         throw new Error(`Profile ACL inspection failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     if (result.stdout.trim() === "true")

package/dist/computer-setup-client.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { hostname } from "node:os";
 import { MachineTokenSchema } from "./computer-profile.js";
+import { powershellCommandArgs } from "./powershell-command.js";
 import { systemCommandRunner, } from "./computer-service.js";
 const HttpUrlSchema = z.string().url().refine((value) => {
     const url = new URL(value);
@@ -309,8 +310,10 @@ export function createComputerSetupClient(options) {
     };
 }
 export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
-    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
-    const args = [url];
+    const command = platform === "win32" ? "powershell.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = platform === "win32"
+        ? powershellCommandArgs("Start-Process -FilePath $args[0] -ErrorAction Stop | Out-Null", [url])
+        : [url];
     const result = await runner(command, args);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);

package/dist/machine-info.js

@@ -33,6 +33,7 @@ export const SELF_TRAINING_EXECUTION_CAPABILITY = "self_training_execution_v1";
 export const EXECUTION_LARGE_ATTACHMENTS_CAPABILITY = "execution_attachments_300m_v1";
 export const PROJECT_SKILL_PROJECTION_CAPABILITY = "project_skill_projection_v2";
 export const MACHINE_ENVIRONMENT_CAPABILITY = "machine_environment_v1";
+export const MACHINE_HELLO_ACK_CAPABILITY = "machine_hello_ack_v1";
 export const NATIVE_PROJECT_WORKSPACE_READINESS = Object.freeze({
     resolverReady: true,
     nativeRuntimeAdaptersReady: true,
@@ -62,6 +63,7 @@ export const DAEMON_CAPABILITIES = Object.freeze([
     "agent_ability_runtime_assets_v1",
     "agent_environments_v1",
     MACHINE_ENVIRONMENT_CAPABILITY,
+    MACHINE_HELLO_ACK_CAPABILITY,
 ]);
 /** 能力只按平台过滤,进程存活期间静态(CLAUDE.md 红线)。Windows 在 junction/copy 真机 smoke 通过前不宣告 Project Skills。 */
 export const daemonCapabilities = (runtimePlatform = process.platform, readiness = NATIVE_PROJECT_WORKSPACE_READINESS) => {

package/dist/npm-command.js

@@ -1,9 +1,9 @@
 import { posix, win32 } from "node:path";
-/** Execute POSIX npm through its owning Node binary so service PATH is irrelevant. */
+/** Execute npm through its owning Node binary so PATH and cmd.exe quoting are irrelevant. */
 export function npmInvocation(platform, nodePath = process.execPath) {
     const paths = platform === "win32" ? win32 : posix;
-    const npmPath = paths.join(paths.dirname(nodePath), platform === "win32" ? "npm.cmd" : "npm");
-    return platform === "win32"
-        ? { command: npmPath, argsPrefix: [] }
-        : { command: nodePath, argsPrefix: [npmPath] };
+    const npmPath = platform === "win32"
+        ? paths.join(paths.dirname(nodePath), "node_modules", "npm", "bin", "npm-cli.js")
+        : paths.join(paths.dirname(nodePath), "npm");
+    return { command: nodePath, argsPrefix: [npmPath] };
 }

package/dist/powershell-command.js

@@ -0,0 +1,12 @@
+/**
+ * powershell.exe -Command joins trailing argv into command text, rather than
+ * binding it to $args. Invoke a scriptblock with literal arguments inside one
+ * UTF-16LE encoded command. Encoding is transport, not encryption.
+ */
+export function powershellCommandArgs(script, args = []) {
+    // PowerShell also treats typographic single quotes as string delimiters.
+    const literals = args.map((arg) => `'${arg.replace(/['\u2018-\u201b]/gu, (quote) => quote + quote)}'`).join(" ");
+    const command = "[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false);\n"
+        + `& {\n${script}\n} ${literals}`;
+    return ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(command, "utf16le").toString("base64")];
+}

package/dist/project-skills/machine-hello-publisher.js

@@ -1,20 +1,109 @@
 import { WebSocket } from "ws";
+const HELLO_RETRY_DELAYS_MS = [1_000, 2_000, 4_000];
 /** 记住最近一次 hello 与 socket,便于存储身份变化后重发;Project Skills 状态恒为 ready。 */
 export function createMachineHelloPublisher(input) {
     let latest = null;
     let latestSocket = null;
-    const republish = () => {
-        if (latest === null || latestSocket?.readyState !== WebSocket.OPEN)
+    let acknowledged = false;
+    let attempts = 0;
+    // 发送代次:每开一轮新发送(attach/publish/republish)自增,随帧发出并要求 ack 回显。
+    let generation = 0;
+    let retryTimer;
+    const clearRetry = () => {
+        if (retryTimer !== undefined) {
+            clearTimeout(retryTimer);
+            retryTimer = undefined;
+        }
+    };
+    const scheduleRetry = () => {
+        clearRetry();
+        if (acknowledged || latest === null || latestSocket?.readyState !== WebSocket.OPEN)
+            return;
+        // 当前 server 不支持 ack → 不排重试(否则永远等不到确认,白跑满退避)。
+        if (input.ackSupported && !input.ackSupported())
+            return;
+        const delay = HELLO_RETRY_DELAYS_MS[attempts - 1];
+        if (delay === undefined) {
+            // 退避跑满仍未 ack:期待 ack(ackSupported 已声明支持)才升级为断连重连,避免旧行为下反复重连。
+            if (input.ackSupported !== undefined && latestSocket !== null)
+                input.onExhausted?.(latestSocket);
             return;
-        const hello = input.effective({ ...latest, projectSkillsStatus: "ready" });
+        }
+        retryTimer = setTimeout(() => {
+            retryTimer = undefined;
+            sendCurrent();
+        }, delay);
+    };
+    function sendCurrent() {
+        if (latest === null || latestSocket?.readyState !== WebSocket.OPEN || acknowledged)
+            return;
+        // helloSeq 随帧发出;同一代次的多次重试复用同一 seq,ack 回显该 seq 即视为确认。
+        const hello = input.effective({ ...latest, projectSkillsStatus: "ready", helloSeq: generation });
+        const attempt = attempts + 1;
+        attempts = attempt;
         try {
             latestSocket.send(JSON.stringify(hello));
-            input.onSent(hello);
+            input.onSent(hello, attempt);
+        }
+        catch (error) {
+            input.onSendFailed?.(hello, attempt, error);
         }
-        catch { /* 非 OPEN,忽略 */ }
+        scheduleRetry();
+    }
+    const attach = (socket) => {
+        clearRetry();
+        latestSocket = socket;
+        acknowledged = false;
+        attempts = 0;
+        generation += 1;
+        sendCurrent();
+    };
+    const detach = (socket) => {
+        if (latestSocket !== socket)
+            return;
+        clearRetry();
+        latestSocket = null;
+        acknowledged = false;
+        attempts = 0;
+    };
+    const republish = () => {
+        if (latest === null || latestSocket === null)
+            return;
+        clearRetry();
+        acknowledged = false;
+        attempts = 0;
+        generation += 1;
+        sendCurrent();
+    };
+    const acknowledge = (socket, seq) => {
+        // 非当前 socket / 已确认 / 该 socket 已在关闭(close 后迟到的 ack)一律忽略:
+        // 后者会错误触发 onAck→清零强制重连计数,削弱重连上限。
+        if (latestSocket !== socket || latest === null || acknowledged || socket.readyState !== WebSocket.OPEN)
+            return;
+        // 代次校验:只接受回显当前代次的 ack,忽略上一代次迟到的 ack(否则会误停新代次的重试)。
+        // seq 缺省(老 server 不回显)时退回仅按 socket 匹配,保持兼容。
+        if (seq !== undefined && seq !== generation)
+            return;
+        acknowledged = true;
+        clearRetry();
+        input.onAck?.(input.effective({ ...latest, projectSkillsStatus: "ready" }));
     };
     return Object.freeze({
-        publish: (hello, socket) => { latest = hello; latestSocket = socket; republish(); },
+        publish: (hello, socket) => {
+            latest = hello;
+            if (latestSocket !== socket) {
+                attach(socket);
+                return;
+            }
+            acknowledged = false;
+            attempts = 0;
+            generation += 1;
+            clearRetry();
+            sendCurrent();
+        },
+        attach,
+        detach,
         republish,
+        acknowledge,
     });
 }

package/dist/serve.js

@@ -9,7 +9,7 @@ import { randomUUID } from "node:crypto";
 import { dslog, setSlogDefaults, drainSpool, flushSlog } from "./slog.js";
 import { mergeRunAgentResults, reportScheduledStartFailure, runAgent } from "./runner.js";
 import { buildOriginDecisionRetryPrompt, buildScheduledPrompt } from "./prompt.js";
-import { daemonCapabilities, daemonCapabilityBindings, } from "./machine-info.js";
+import { daemonCapabilities, daemonCapabilityBindings, MACHINE_HELLO_ACK_CAPABILITY, } from "./machine-info.js";
 import { reconcileExecutionJournal } from "./execution-recovery.js";
 import { initReleaseSlog, reportDaemonConnectionClose, reportReleaseError } from "./release-channel-guard.js";
 import { handleWorkspaceControlRequest } from "./workspace-control-handler.js";
@@ -65,6 +65,10 @@ export function serve(config, opts = {}) {
     let serverCapabilities = new Set();
     let backoff = 1000;
     const maxBackoff = opts.maxBackoffMs ?? 30_000;
+    // hello 重试跑满仍未 ack 时主动断连重连(破 server 侧连接归属/fence 死锁)。收到 ack 清零;
+    // 连续多次仍拿不到 ack 则停手,退回 connected-offline,避免事故期把控制面打成重连风暴。
+    const maxUnackedHelloReconnects = 3;
+    let unackedHelloReconnects = 0;
     const testShutdown = readTestShutdownConfiguration(process.env);
     const shutdownTimeoutMs = opts.shutdownTimeoutMs ?? testShutdown.timeoutMs ?? 30_000;
     const createWebSocket = opts.createWebSocket ?? ((url) => new WebSocket(url));
@@ -160,7 +164,41 @@ export function serve(config, opts = {}) {
                 : configuredIdentity;
             return currentIdentity === undefined ? hello : { ...hello, ...currentIdentity };
         },
-        onSent: (hello) => log(`📤 已上报机器信息: ${hello.hostname} · ${hello.os} · installed=[${hello.runtimes.join(",")}] · executable=[${hello.executionRuntimes.join(",")}] · agents=[${hello.agentHandles.join(",")}]`),
+        onSent: (hello, attempt) => dslog("daemon.machine_hello_send_queued", "机器 hello 已进入发送队列", {
+            attempt, hostname: hello.hostname, daemon_version: hello.daemonVersion,
+        }),
+        onSendFailed: (hello, attempt, error) => dslog("daemon.machine_hello_send_failed", "机器 hello 发送失败", {
+            level: "WARN", attempt, hostname: hello.hostname, daemon_version: hello.daemonVersion,
+            error_message: error instanceof Error ? error.message : String(error),
+        }),
+        onAck: (hello) => {
+            unackedHelloReconnects = 0; // 拿到确认 = 本连接登记成功,清零强制重连计数。
+            dslog("daemon.machine_hello_ack_received", "机器 hello 已收到控制面确认", {
+                hostname: hello.hostname, daemon_version: hello.daemonVersion,
+            });
+        },
+        // 仅当当前 server 声明支持 ack 才重试;老 server 收不到 ack,重试无意义(退回单次上报)。
+        ackSupported: () => serverCapabilities.has(MACHINE_HELLO_ACK_CAPABILITY),
+        // 重试跑满仍未 ack → 断开当前连接,靠重连换新连接(新 epoch/token)破 server 侧 fence 死锁。
+        onExhausted: (socket) => {
+            if (stopped || ws !== socket || socket.readyState !== WebSocket.OPEN)
+                return;
+            if (unackedHelloReconnects >= maxUnackedHelloReconnects) {
+                dslog("daemon.machine_hello_unacked_giveup", "机器 hello 连续多次重连仍未确认,停止强制重连(保持连接,等待下次事件或人工介入)", {
+                    level: "ERROR", reconnects: unackedHelloReconnects,
+                });
+                return;
+            }
+            unackedHelloReconnects += 1;
+            // 抖动重连间隔:控制面回滚时多台 daemon 会同时耗尽重试,固定间隔会同步重连造成羊群。
+            // close handler 用当前 backoff 排重连,这里注入 1~4s 随机值把各机错峰(open 会再把它复位)。
+            const jitteredBackoff = 1_000 + Math.floor(Math.random() * 3_000);
+            backoff = Math.min(jitteredBackoff, maxBackoff);
+            dslog("daemon.machine_hello_unacked_reconnect", "机器 hello 重试跑满仍未确认,断开重连换新连接", {
+                level: "WARN", reconnects: unackedHelloReconnects, backoff_ms: backoff,
+            });
+            socket.close(1011, "machine hello unacknowledged");
+        },
     });
     const machineRuntime = createMachineRuntimeEnvironment({
         config,
@@ -310,6 +348,7 @@ export function serve(config, opts = {}) {
             // 连上了才有机会把离线期间(断连原因/退出前)落盘的日志补传上去
             void drainSpool();
             // 上报本机信息 (hostname/os/daemon 版本/已装 runtimes)
+            machineHelloPublisher.attach(openedSocket);
             machineRuntime.open(openedSocket, { capabilities: capabilities.machineHello, beforePublish: Promise.resolve(), connectionId });
             opts.onOpen?.(ws);
             void sendSnapshot(`reconnect-${randomUUID()}`);
@@ -352,6 +391,11 @@ export function serve(config, opts = {}) {
             if (typeof decoded !== "object" || decoded === null)
                 return;
             const rawType = "type" in decoded && typeof decoded.type === "string" ? decoded.type : "";
+            if (rawType === "machine:hello_ack") {
+                const ackSeq = "helloSeq" in decoded && typeof decoded.helloSeq === "number" ? decoded.helloSeq : undefined;
+                machineHelloPublisher.acknowledge(connectionSocket, ackSeq);
+                return;
+            }
             if (rawType === "machine:environment:get" || rawType === "machine:environment:refresh") {
                 await handleMachineEnvironmentFrame(decoded, machineRuntime.provider, sendToConnection);
                 return;
@@ -735,6 +779,11 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
+                // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。ackSupported() 依赖它判断是否重试,
+                // 必须在任何 republish() 之前就位;否则本轮 republish 看到空集合→不排重试→整套 ack/重连机制哑火。
+                serverCapabilities = new Set(Array.isArray(r.serverCapabilities)
+                    ? r.serverCapabilities.filter((c) => typeof c === "string")
+                    : []);
                 if (opts.storageRuntime !== undefined && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
                     const bindingSocket = ws;
                     bindStorageServerIdentity(opts.storageRuntime, { workspaceId: r.workspaceId, machineId: r.machineId }, {
@@ -751,10 +800,7 @@ export function serve(config, opts = {}) {
                         },
                     });
                 }
-                // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。
-                serverCapabilities = new Set(Array.isArray(r.serverCapabilities)
-                    ? r.serverCapabilities.filter((c) => typeof c === "string")
-                    : []);
+                machineHelloPublisher.republish();
                 if (serverCapabilities.has(PROJECT_SKILLS_CAPABILITY)) {
                     void projectSkillsController.initialize()
                         .then(() => projectSkillsController.publishCurrent())
@@ -1203,6 +1249,7 @@ export function serve(config, opts = {}) {
         });
         connectionSocket.on("close", (code) => {
             machineRuntime.close(connectionSocket);
+            machineHelloPublisher.detach(connectionSocket);
             if (stopped || ws !== connectionSocket)
                 return;
             // server 能力随连接失效;下个连接的 ready 帧重新声明(防降级重连后沿用过期能力)。

package/dist/windows-scheduled-task.js

@@ -1,5 +1,6 @@
 import { systemCommandRunner, windowsCommandArg, } from "./computer-service.js";
 import { win32 } from "node:path";
+import { powershellCommandArgs } from "./powershell-command.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -33,10 +34,9 @@ export async function inspectWindowsServiceUpdateScope(spec, npmPrefix, daemonPi
         "$enginePid=if($instances.Count -eq 1){[int64]$instances[0].EnginePID}else{0};",
         "[pscustomobject]@{count=1;state=[int]$task.State;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};instanceCount=$instances.Count;enginePid=$enginePid;engineOwned=($enginePid -eq $pidValue -or $ancestors -contains $enginePid);processIdentity=$processIdentity;conflictingPrefixes=$conflicts.Count}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script,
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [
         encoded(spec.id), encoded(entryMarker), String(daemonPid),
-    ]);
+    ]));
     if (result.exitCode !== 0)
         return { valid: false };
     let inspection;

package/dist/windows-task-principal.js

@@ -0,0 +1,26 @@
+/** Read only: resolve the task's account with Windows, without guessing or stripping its domain. */
+export const windowsTaskPrincipalScript = [
+    "$currentUserSid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value;",
+    "$principalSid=$null;",
+    "try{",
+    "$account=[string]$task.Principal.UserId;",
+    "if($account -match '^S-\\d-'){",
+    "$principalSid=([Security.Principal.SecurityIdentifier]::new($account)).Value;",
+    "}else{",
+    "$principalSid=([Security.Principal.NTAccount]::new($account)).Translate([Security.Principal.SecurityIdentifier]).Value;",
+    "}",
+    "}catch{$principalSid=$null};",
+].join("");
+export const windowsTaskPrincipalFields = [
+    "currentUserSid=$currentUserSid;",
+    "principalSid=$principalSid;",
+    "logonType=[int]$task.Principal.LogonType;",
+    "runLevel=[int]$task.Principal.RunLevel;",
+].join("");
+export function windowsTaskPrincipalMatches(principal) {
+    return typeof principal.currentUserSid === "string"
+        && /^S-1-(?:\d+-)*\d+$/.test(principal.currentUserSid)
+        && principal.principalSid === principal.currentUserSid
+        && principal.logonType === 3 // Interactive
+        && principal.runLevel === 0; // Limited
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.97",
+  "version": "0.6.98-beta.1",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",