@nowcrew/daemon 0.6.97 → 0.6.98-beta.2

package/dist/serve.js

@@ -9,11 +9,12 @@ import { randomUUID } from "node:crypto";
 import { dslog, setSlogDefaults, drainSpool, flushSlog } from "./slog.js";
 import { mergeRunAgentResults, reportScheduledStartFailure, runAgent } from "./runner.js";
 import { buildOriginDecisionRetryPrompt, buildScheduledPrompt } from "./prompt.js";
-import { daemonCapabilities, daemonCapabilityBindings, } from "./machine-info.js";
+import { daemonCapabilities, daemonCapabilityBindings, MACHINE_HELLO_ACK_CAPABILITY, } from "./machine-info.js";
 import { reconcileExecutionJournal } from "./execution-recovery.js";
 import { initReleaseSlog, reportDaemonConnectionClose, reportReleaseError } from "./release-channel-guard.js";
 import { handleWorkspaceControlRequest } from "./workspace-control-handler.js";
 import { inspectRaftWorkspace, importRaftWorkspace } from "./workspace-import.js";
+import { withMemoryAccess } from "./local-memory/migration-access.js";
 import { normalizeScheduledContext } from "./scheduled-report.js";
 import { formatDaemonLogLine } from "./log-format.js";
 import { reportAgentRunComplete } from "./scheduled-run-report.js";
@@ -50,6 +51,8 @@ import { probeRuntimeHealth } from "./runtime-health.js";
 import { createServeMarketplace } from "./marketplace-serve.js";
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
+import { createMemoryMigrationController } from "./memory-migration-controller.js";
+import { createMemoryMigrationJournal, replayExecutionJournals } from "./memory-migration-journal.js";
 import { bindStorageServerIdentity, createStorageIdentityAdmission, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
@@ -65,12 +68,18 @@ export function serve(config, opts = {}) {
     let serverCapabilities = new Set();
     let backoff = 1000;
     const maxBackoff = opts.maxBackoffMs ?? 30_000;
+    // hello 重试跑满仍未 ack 时主动断连重连(破 server 侧连接归属/fence 死锁)。收到 ack 清零;
+    // 连续多次仍拿不到 ack 则停手,退回 connected-offline,避免事故期把控制面打成重连风暴。
+    const maxUnackedHelloReconnects = 3;
+    let unackedHelloReconnects = 0;
     const testShutdown = readTestShutdownConfiguration(process.env);
     const shutdownTimeoutMs = opts.shutdownTimeoutMs ?? testShutdown.timeoutMs ?? 30_000;
     const createWebSocket = opts.createWebSocket ?? ((url) => new WebSocket(url));
     let reconnectTimer = null;
     let stopPromise = null;
     let executionJournal;
+    let migrationExecutionJournal;
+    let migrationJournalReady = false;
     const injectedExecutionJournal = opts.execution?.journal;
     const agentMemory = opts.execution?.dependencies?.agentMemory
         ?? (config.agentMemory === null ? undefined : createAgentMemoryBridge(config.agentMemory));
@@ -85,6 +94,15 @@ export function serve(config, opts = {}) {
             startupGapMs: config.executionLimits.startupGapMs,
         });
     const localSlots = createSharedSlotManager(config.executionLimits);
+    const memoryMigrations = createMemoryMigrationController({ config, coordinator: hostCoordinator,
+        isAdmissionClosed: () => stopped || storageIdentityAdmission.isAdmissionClosed(),
+        journal: () => { if (!migrationJournalReady)
+            throw new Error("memory_migration_journal_unavailable"); return migrationExecutionJournal; }, send: frame => {
+            if (frame.type === "execution:completed")
+                completionRetransmitter.track(frame);
+            else if (ws?.readyState === WebSocket.OPEN)
+                ws.send(JSON.stringify(frame));
+        } });
     const sharedSlots = hostCoordinatedSlotManager(localSlots, hostCoordinator);
     const concurrencyTelemetry = createExecutionConcurrencyTelemetry(sharedSlots, {
         ...(opts.execution?.concurrencySnapshotIntervalMs === undefined
@@ -160,7 +178,41 @@ export function serve(config, opts = {}) {
                 : configuredIdentity;
             return currentIdentity === undefined ? hello : { ...hello, ...currentIdentity };
         },
-        onSent: (hello) => log(`📤 已上报机器信息: ${hello.hostname} · ${hello.os} · installed=[${hello.runtimes.join(",")}] · executable=[${hello.executionRuntimes.join(",")}] · agents=[${hello.agentHandles.join(",")}]`),
+        onSent: (hello, attempt) => dslog("daemon.machine_hello_send_queued", "机器 hello 已进入发送队列", {
+            attempt, hostname: hello.hostname, daemon_version: hello.daemonVersion,
+        }),
+        onSendFailed: (hello, attempt, error) => dslog("daemon.machine_hello_send_failed", "机器 hello 发送失败", {
+            level: "WARN", attempt, hostname: hello.hostname, daemon_version: hello.daemonVersion,
+            error_message: error instanceof Error ? error.message : String(error),
+        }),
+        onAck: (hello) => {
+            unackedHelloReconnects = 0; // 拿到确认 = 本连接登记成功,清零强制重连计数。
+            dslog("daemon.machine_hello_ack_received", "机器 hello 已收到控制面确认", {
+                hostname: hello.hostname, daemon_version: hello.daemonVersion,
+            });
+        },
+        // 仅当当前 server 声明支持 ack 才重试;老 server 收不到 ack,重试无意义(退回单次上报)。
+        ackSupported: () => serverCapabilities.has(MACHINE_HELLO_ACK_CAPABILITY),
+        // 重试跑满仍未 ack → 断开当前连接,靠重连换新连接(新 epoch/token)破 server 侧 fence 死锁。
+        onExhausted: (socket) => {
+            if (stopped || ws !== socket || socket.readyState !== WebSocket.OPEN)
+                return;
+            if (unackedHelloReconnects >= maxUnackedHelloReconnects) {
+                dslog("daemon.machine_hello_unacked_giveup", "机器 hello 连续多次重连仍未确认,停止强制重连(保持连接,等待下次事件或人工介入)", {
+                    level: "ERROR", reconnects: unackedHelloReconnects,
+                });
+                return;
+            }
+            unackedHelloReconnects += 1;
+            // 抖动重连间隔:控制面回滚时多台 daemon 会同时耗尽重试,固定间隔会同步重连造成羊群。
+            // close handler 用当前 backoff 排重连,这里注入 1~4s 随机值把各机错峰(open 会再把它复位)。
+            const jitteredBackoff = 1_000 + Math.floor(Math.random() * 3_000);
+            backoff = Math.min(jitteredBackoff, maxBackoff);
+            dslog("daemon.machine_hello_unacked_reconnect", "机器 hello 重试跑满仍未确认,断开重连换新连接", {
+                level: "WARN", reconnects: unackedHelloReconnects, backoff_ms: backoff,
+            });
+            socket.close(1011, "machine hello unacknowledged");
+        },
     });
     const machineRuntime = createMachineRuntimeEnvironment({
         config,
@@ -232,7 +284,7 @@ export function serve(config, opts = {}) {
         return null;
     };
     const sendSnapshot = async (reqId) => {
-        const entries = (await executionJournal.replay()).map(snapshotEntry).filter((entry) => entry !== null);
+        const entries = (await replayExecutionJournals(executionJournal, migrationExecutionJournal)).map(snapshotEntry).filter((entry) => entry !== null);
         safeExecutionSend(ExecutionSnapshotSchema.parse({
             type: "execution:snapshot", protocolVersion: 1, reqId, entries,
         }));
@@ -310,9 +362,16 @@ export function serve(config, opts = {}) {
             // 连上了才有机会把离线期间(断连原因/退出前)落盘的日志补传上去
             void drainSpool();
             // 上报本机信息 (hostname/os/daemon 版本/已装 runtimes)
+            machineHelloPublisher.attach(openedSocket);
             machineRuntime.open(openedSocket, { capabilities: capabilities.machineHello, beforePublish: Promise.resolve(), connectionId });
             opts.onOpen?.(ws);
             void sendSnapshot(`reconnect-${randomUUID()}`);
+            // 普通回执不等待维护日志IO；两类记录分别重放到同一发送器。
+            void migrationExecutionJournal.replay().then(entries => {
+                for (const entry of entries)
+                    if (entry.completion && !entry.completionAcknowledged)
+                        completionRetransmitter.track(entry.completion);
+            }).catch(() => dslog("memory_migration.journal_unavailable", "维护回执重放失败，普通回执继续", { level: "ERROR" }));
             void executionJournal.replay()
                 .then((entries) => {
                 for (const entry of entries) {
@@ -352,6 +411,11 @@ export function serve(config, opts = {}) {
             if (typeof decoded !== "object" || decoded === null)
                 return;
             const rawType = "type" in decoded && typeof decoded.type === "string" ? decoded.type : "";
+            if (rawType === "machine:hello_ack") {
+                const ackSeq = "helloSeq" in decoded && typeof decoded.helloSeq === "number" ? decoded.helloSeq : undefined;
+                machineHelloPublisher.acknowledge(connectionSocket, ackSeq);
+                return;
+            }
             if (rawType === "machine:environment:get" || rawType === "machine:environment:refresh") {
                 await handleMachineEnvironmentFrame(decoded, machineRuntime.provider, sendToConnection);
                 return;
@@ -387,7 +451,8 @@ export function serve(config, opts = {}) {
                         return;
                     if (frame.type === "execution:completion-ack") {
                         try {
-                            await executionJournal.acknowledgeCompletion(frame.executionId);
+                            const journal = await executionJournal.get(frame.executionId) ? executionJournal : migrationExecutionJournal;
+                            await journal.acknowledgeCompletion(frame.executionId);
                             const attempts = completionRetransmitter.acknowledge(frame.executionId);
                             dslog("execution.completion_acknowledged", "execution completion ACK 已持久化", {
                                 execution_id: frame.executionId,
@@ -413,6 +478,8 @@ export function serve(config, opts = {}) {
                         return;
                     }
                     if (frame.type === "execution:cancel") {
+                        if (memoryMigrations.cancel(frame.executionId))
+                            return;
                         if (!knownExecutionHashes.has(frame.executionId)
                             && !executionRuns.has(frame.executionId)
                             && await executionJournal.get(frame.executionId) === null)
@@ -645,6 +712,7 @@ export function serve(config, opts = {}) {
                     const execution = executeProtocol(config, spec, {
                         ...opts.execution?.dependencies,
                         machineEnvironment: machineRuntime.provider,
+                        ...(memoryMigrations.getIdentity() === null ? {} : { controlIdentity: memoryMigrations.getIdentity() }),
                         capabilities: capabilities.executionRunner,
                         projectSkills: opts.execution?.dependencies?.projectSkills ?? initializedProjectSkills,
                         abilityRelease: opts.execution?.dependencies?.abilityRelease ?? agentAbilityRuntime.materializer,
@@ -735,6 +803,13 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
+                if (r.workspaceId && r.machineId)
+                    memoryMigrations.setIdentity({ workspaceId: r.workspaceId, machineId: r.machineId });
+                // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。ackSupported() 依赖它判断是否重试,
+                // 必须在任何 republish() 之前就位;否则本轮 republish 看到空集合→不排重试→整套 ack/重连机制哑火。
+                serverCapabilities = new Set(Array.isArray(r.serverCapabilities)
+                    ? r.serverCapabilities.filter((c) => typeof c === "string")
+                    : []);
                 if (opts.storageRuntime !== undefined && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
                     const bindingSocket = ws;
                     bindStorageServerIdentity(opts.storageRuntime, { workspaceId: r.workspaceId, machineId: r.machineId }, {
@@ -751,10 +826,7 @@ export function serve(config, opts = {}) {
                         },
                     });
                 }
-                // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。
-                serverCapabilities = new Set(Array.isArray(r.serverCapabilities)
-                    ? r.serverCapabilities.filter((c) => typeof c === "string")
-                    : []);
+                machineHelloPublisher.republish();
                 if (serverCapabilities.has(PROJECT_SKILLS_CAPABILITY)) {
                     void projectSkillsController.initialize()
                         .then(() => projectSkillsController.publishCurrent())
@@ -801,6 +873,8 @@ export function serve(config, opts = {}) {
             }
             catch { /* server 会按请求超时处理 */ } }))
                 return;
+            if (await memoryMigrations.handle(msg))
+                return;
             if (await agentAbilityRuntime.tryHandleControlMessage(msg, serverCapabilities, (frame) => ws?.send(JSON.stringify(frame))))
                 return;
             // 导入 raft agent 工作区:inspect 反填 name/description;import 复制用户内容
@@ -815,7 +889,7 @@ export function serve(config, opts = {}) {
                 try {
                     const data2 = req.type === "raft:inspect"
                         ? await inspectRaftWorkspace(req.path)
-                        : await importRaftWorkspace(req.path, join(config.agentsRoot, req.handle));
+                        : await withMemoryAccess(join(config.agentsRoot, req.handle), () => importRaftWorkspace(req.path, join(config.agentsRoot, req.handle)), { create: true });
                     if (req.type === "raft:import") {
                         log(`📦 已导入 raft 工作区 → ${req.handle}: 复制 ${data2.copied.length} 项`);
                     }
@@ -1203,10 +1277,12 @@ export function serve(config, opts = {}) {
         });
         connectionSocket.on("close", (code) => {
             machineRuntime.close(connectionSocket);
+            machineHelloPublisher.detach(connectionSocket);
             if (stopped || ws !== connectionSocket)
                 return;
             // server 能力随连接失效;下个连接的 ready 帧重新声明(防降级重连后沿用过期能力)。
             serverCapabilities = new Set();
+            memoryMigrations.clearIdentity();
             completionRetransmitter.pause();
             // 4001 = 控制面应用级「鉴权失败」关闭码(见 server control-plane.ts)。即使上面的
             // error 帧因 close 抢先而丢失,也能据关闭码识别这是凭证失效——退避拉满,不再每秒热循环。
@@ -1259,6 +1335,9 @@ export function serve(config, opts = {}) {
             writeStderr: (line) => process.stderr.write(line),
         });
         await runProjectSkillStartupCleanup(config.agentsRoot, executionJournal, dslog);
+        migrationExecutionJournal = createMemoryMigrationJournal(config.agentsRoot);
+        await migrationExecutionJournal.reconcileAfterRestart().then(() => { migrationJournalReady = true; })
+            .catch(() => dslog("memory_migration.journal_unavailable", "迁移日志恢复失败，普通执行继续，迁移请求单独报错", { level: "ERROR" }));
         await connect();
     })();
     const stop = () => {
@@ -1276,6 +1355,7 @@ export function serve(config, opts = {}) {
             const webSocketClosed = closeWebSocketWithinDeadline(ws, deadline.signal);
             const pending = [
                 machineRuntime.stop(),
+                memoryMigrations.stop(),
                 webSocketClosed,
                 updateController.drain(),
                 marketplace.stop(),
@@ -1294,6 +1374,8 @@ export function serve(config, opts = {}) {
                 if (executionJournal !== undefined) {
                     await executionJournal.close({ signal: deadline.signal });
                 }
+                if (migrationExecutionJournal !== undefined)
+                    await migrationExecutionJournal.close({ signal: deadline.signal });
             }
             finally {
                 deadline.dispose();

package/dist/token.js

@@ -7,6 +7,7 @@ export async function mintAgentToken(serverUrl, machineToken, handle, displayNam
         },
         // 把本轮唤醒的线程根钉到 per-launch 令牌:服务端据此让 task/消息默认绑/回当前线程。
         body: JSON.stringify({
+            memoryStateGuardVersion: 1,
             handle,
             ...(displayName ? { displayName } : {}),
             ...(options.wakeThreadRoot ? { wakeThreadRoot: options.wakeThreadRoot } : {}),

package/dist/windows-scheduled-task.js

@@ -1,5 +1,6 @@
 import { systemCommandRunner, windowsCommandArg, } from "./computer-service.js";
 import { win32 } from "node:path";
+import { powershellCommandArgs } from "./powershell-command.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -33,10 +34,9 @@ export async function inspectWindowsServiceUpdateScope(spec, npmPrefix, daemonPi
         "$enginePid=if($instances.Count -eq 1){[int64]$instances[0].EnginePID}else{0};",
         "[pscustomobject]@{count=1;state=[int]$task.State;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};instanceCount=$instances.Count;enginePid=$enginePid;engineOwned=($enginePid -eq $pidValue -or $ancestors -contains $enginePid);processIdentity=$processIdentity;conflictingPrefixes=$conflicts.Count}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await runner("powershell.exe", [
-        "-NoProfile", "-NonInteractive", "-Command", script,
+    const result = await runner("powershell.exe", powershellCommandArgs(script, [
         encoded(spec.id), encoded(entryMarker), String(daemonPid),
-    ]);
+    ]));
     if (result.exitCode !== 0)
         return { valid: false };
     let inspection;

package/dist/windows-task-principal.js

@@ -0,0 +1,26 @@
+/** Read only: resolve the task's account with Windows, without guessing or stripping its domain. */
+export const windowsTaskPrincipalScript = [
+    "$currentUserSid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value;",
+    "$principalSid=$null;",
+    "try{",
+    "$account=[string]$task.Principal.UserId;",
+    "if($account -match '^S-\\d-'){",
+    "$principalSid=([Security.Principal.SecurityIdentifier]::new($account)).Value;",
+    "}else{",
+    "$principalSid=([Security.Principal.NTAccount]::new($account)).Translate([Security.Principal.SecurityIdentifier]).Value;",
+    "}",
+    "}catch{$principalSid=$null};",
+].join("");
+export const windowsTaskPrincipalFields = [
+    "currentUserSid=$currentUserSid;",
+    "principalSid=$principalSid;",
+    "logonType=[int]$task.Principal.LogonType;",
+    "runLevel=[int]$task.Principal.RunLevel;",
+].join("");
+export function windowsTaskPrincipalMatches(principal) {
+    return typeof principal.currentUserSid === "string"
+        && /^S-1-(?:\d+-)*\d+$/.test(principal.currentUserSid)
+        && principal.principalSid === principal.currentUserSid
+        && principal.logonType === 3 // Interactive
+        && principal.runLevel === 0; // Limited
+}

package/dist/workspace-control-handler.js

@@ -1,9 +1,22 @@
 /** 控制面文件/技能查看的按需处理，独立于执行生命周期。 */
-import { join } from "node:path";
+import { lstat } from "node:fs/promises";
+import { join, resolve } from "node:path";
 import { readSharedMessageFile } from "./message-file-preview.js";
 import { listWorkspace, readWorkspaceFile } from "./workspace-fs.js";
 import { listSkills } from "./skills.js";
 import { listRuntimeModels } from "./list-models.js";
+import { withMemoryAccess } from "./local-memory/migration-access.js";
+async function listProtectedWorkspace(root, path) {
+    try {
+        await lstat(root);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        return { root: resolve(root), path: path.replace(/^\/+/, ""), entries: [] };
+    }
+    return withMemoryAccess(root, () => listWorkspace(root, path));
+}
 export async function handleWorkspaceControlRequest(raw, agentsRoot, registry, models = listRuntimeModels) {
     if (!raw || typeof raw !== "object")
         return null;
@@ -15,8 +28,8 @@ export async function handleWorkspaceControlRequest(raw, agentsRoot, registry, m
     try {
         const root = join(agentsRoot, request.handle);
         const data = request.type === "fs:read-shared" ? await readSharedMessageFile(agentsRoot, raw, registry)
-            : request.type === "fs:list" ? await listWorkspace(root, request.path)
-                : request.type === "fs:read" ? await readWorkspaceFile(root, request.path)
+            : request.type === "fs:list" ? await listProtectedWorkspace(root, request.path)
+                : request.type === "fs:read" ? await withMemoryAccess(root, () => readWorkspaceFile(root, request.path))
                     : request.type === "skills:list" ? await listSkills(request.runtime)
                         : { models: await models(request.runtime ?? "") };
         return { type: "fs:result", reqId: request.reqId, ok: true, data };

package/dist/workspace.js

@@ -8,12 +8,15 @@
  *
  * spawn runtime 时把 <ws>/.crew 置于 PATH 最前,于是 agent 的 `crew ...` 命中 wrapper。
  */
-import { mkdir, writeFile, readFile, chmod, access, lstat } from "node:fs/promises";
+import { mkdir, writeFile, readFile, chmod, access, lstat, realpath } from "node:fs/promises";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 import { dslog } from "./slog.js";
+import { MigrationStateSchema } from "./local-memory/migration-schema.js";
+import { assertMigrationStateIntegrity } from "./local-memory/migration-state-invariants.js";
+import { detectLocalMemoryStorageVersion } from "./local-memory/storage-format.js";
 /** 文件系统安全的 taskKey:仅留 [\w.-],其余转 _,截断,避免路径穿越/超长。 */
 export function safeKey(key) {
     return key.replace(/[^\w.-]+/g, "_").replace(/^[-.]+/, "").slice(0, 80) || "default";
@@ -49,7 +52,15 @@ async function hasLocalMemoryV2Marker(agentDir) {
         const stat = await lstat(markerPath);
         if (!stat.isFile() || stat.isSymbolicLink())
             return false;
-        return (await readFile(markerPath, "utf8")) === "1\n";
+        if ((await readFile(markerPath, "utf8")) !== "1\n")
+            return false;
+        const root = await realpath(agentDir);
+        const state = MigrationStateSchema.parse(JSON.parse(await readFile(join(memoryDir, "migration.v1.json"), "utf8")));
+        assertMigrationStateIntegrity(state, state.identity);
+        return state.phase === "committed" && state.storageVersion === 2
+            && state.identity.rootFingerprint === createHash("sha256").update(root).digest("hex")
+            && state.identity.ownerIdentity === String((await lstat(root)).uid)
+            && detectLocalMemoryStorageVersion(await readFile(join(root, "MEMORY.md"), "utf8")) === 2;
     }
     catch {
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.97",
+  "version": "0.6.98-beta.2",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -18,13 +18,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@nowcrew/cli": "0.4.17",
@@ -46,5 +39,11 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
-}
+}

package/dist/runtimes/codex-execution-policy.js

@@ -1,12 +0,0 @@
-/** Bump when old native transcripts must not cross a changed execution boundary. */
-export const CODEX_EXECUTION_POLICY_VERSION = "nowwork-codex-context-v1";
-/** Process-local overrides: keep host auth/Skills without importing host automatic memory. */
-export function codexExecutionPolicyArgs() {
-    return [
-        "features.memories=false",
-        'shell_environment_policy.inherit="all"',
-        "shell_environment_policy.ignore_default_excludes=true",
-        "shell_environment_policy.exclude=[]",
-        "shell_environment_policy.include_only=[]",
-    ].flatMap(value => ["-c", value]);
-}