@nowcrew/daemon 0.6.98-beta.3 → 0.6.98

package/README.md

@@ -40,40 +40,7 @@ This compatibility form stays resident in the current terminal and reconnects wi
 `pnpm --filter @nowcrew/daemon daemon`. `crew-daemon run --agent <handle> --channel <id>` is the legacy
 manual one-shot entry.
 
-## Single-Command Computer Setup
-
-After the deployment enables Token setup, an owner/admin opens **Add Computer**, copies the complete
-command, and pastes it into the target computer's terminal. The same steps apply on macOS, Linux/SSH,
-and Windows. Node.js 22+ and npm must already be installed. The command launches the installer with npx;
-no separate global installation, browser confirmation, or verification code is needed during execution.
-
-The generated command pins an exact published installer version and includes a `--setup-token`.
-This is an already-approved one-time connection request, valid for ten minutes. The program exchanges
-it for the machine credential only when executed, then reuses native service installation, new-hello
-verification, credential finalization and rollback. Merely generating or copying a command does not
-rotate the existing credential. An expired or consumed command must be regenerated in the Web UI.
-
-For a machine credential you already hold, the same setup entry accepts `--api-key` or
-`CREW_MACHINE_TOKEN` without browser pairing:
-
-```bash
-nowwork-computer setup --server-url https://nowwork.nowcoder.com /nowcoder-app \
-  --machine <machine-uuid> --api-key <existing-machine-token>
-```
-
-The machine Token must match the specified Workspace and Computer. This path never rotates the
-credential or creates an approval request; it confirms a new control-plane connection with the expected
-profile and paths before reporting success. Token sources cannot be combined. JSON output puts progress
-on stderr and the final result on stdout. On Windows shells that block npm.ps1/npx.ps1, use npx.cmd as
-the package entry; the setup arguments and workflow are unchanged.
-
-Deployment requires `CREW_PUBLIC_URL` (or `CREW_SERVER_URL`) and
-`CREW_COMPUTER_TOKEN_SETUP_VERSION` set to an exact, published version known to support the Token flags.
-The server checks its published release catalog and channel before issuing a Token command. Leave the
-version unset until that installer has been released; it returns `computer_token_setup_unavailable`
-instead of generating a command for an unsupported package. Existing clients retain browser setup.
-
-## Browser-Approved Computer Setup (Compatibility)
+## Browser-Approved Computer Setup
 
 The Web UI generates a token-free command for a specific Workspace and Machine:
 

package/dist/automatic-service-migration.js

@@ -3,8 +3,6 @@ import { posix, win32 } from "node:path";
 import { buildServiceSpec, serviceStatus, windowsCommandArg, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { inspectLegacyServiceInstallationDetails } from "./legacy-service-installation.js";
-import { powershellCommandArgs } from "./powershell-command.js";
-import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -144,11 +142,12 @@ async function discoverWindows(input, identity) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);",
-        windowsTaskPrincipalScript,
-        `[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
+        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
+        "[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await input.runner("powershell.exe", powershellCommandArgs(script, [encoded(identity.id)]));
+    const result = await input.runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encoded(identity.id),
+    ]);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect legacy scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -166,7 +165,7 @@ async function discoverWindows(input, identity) {
         : null;
     if (definition.count !== 1
         || definition.actionCount !== 1
-        || !windowsTaskPrincipalMatches(definition)
+        || definition.principalMatches !== true
         || !win32.isAbsolute(definition.execute ?? "")
         || match === null
         || match[2] !== input.desired.profile

package/dist/computer-service.js

@@ -6,9 +6,7 @@ import { promisify } from "node:util";
 import { dirname, resolve } from "node:path";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
 import { daemonRegistryCandidates } from "./daemon-registry.js";
-import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 import { npmInvocation } from "./npm-command.js";
-import { powershellCommandArgs } from "./powershell-command.js";
 const execFileAsync = promisify(execFile);
 const WINDOWS_STOP_TIMEOUT_MS = 5_000;
 const WINDOWS_STOP_POLL_MS = 100;
@@ -197,11 +195,12 @@ async function windowsTaskDefinitionMatches(spec, runner) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);",
-        windowsTaskPrincipalScript,
-        `[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
+        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
+        "[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
+    const result = await runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
+    ]);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect scheduled task definition: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -215,7 +214,7 @@ async function windowsTaskDefinitionMatches(spec, runner) {
     const expectedArguments = spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ");
     return definition.count === 1
         && definition.actionCount === 1
-        && windowsTaskPrincipalMatches(definition)
+        && definition.principalMatches === true
         && sameWindowsPath(definition.execute, spec.daemonCommand[0])
         && definition.arguments === expectedArguments;
 }
@@ -227,7 +226,9 @@ async function windowsTaskState(spec, runner) {
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -eq 0){'missing'}elseif($tasks.Count -eq 1){'state:'+([int]$tasks[0].State)}else{throw 'duplicate scheduled tasks'}",
     ].join("");
-    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
+    const result = await runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
+    ]);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to query scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -278,9 +279,10 @@ export async function installService(spec, runner = systemCommandRunner) {
             "$principal=New-ScheduledTaskPrincipal -UserId $identity -LogonType Interactive -RunLevel Limited;",
             "Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -ErrorAction Stop|Out-Null;",
         ].join("");
-        await checked(runner, "powershell.exe", powershellCommandArgs(script, [
+        await checked(runner, "powershell.exe", [
+            "-NoProfile", "-NonInteractive", "-Command", script,
             encodedName, encodedExecutable, encodedArguments,
-        ]), "Scheduled task installation");
+        ], "Scheduled task installation");
         return;
     }
     if (spec.descriptorPath === null || spec.descriptor === null)
@@ -416,33 +418,6 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
     }
 }
 const systemDetachedSpawn = (command, args, options) => spawn(command, [...args], options);
-function windowsRestartCommandArgs(spec) {
-    if (!spec.runtimeProcessIdentity)
-        throw new Error("Windows daemon process identity is required for restart");
-    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
-    const encodedExecutable = Buffer.from(spec.daemonCommand[0], "utf16le").toString("base64");
-    const encodedArguments = Buffer.from(spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "), "utf16le").toString("base64");
-    const script = [
-        "$ErrorActionPreference='Stop';",
-        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
-        "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
-        "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
-        "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
-        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-        "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
-        "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
-        "$p.Kill();",
-        "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
-        "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
-        "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
-        "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
-        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-        "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
-    ].join("");
-    return powershellCommandArgs(script, [
-        String(process.pid), encodedName, encodedExecutable, encodedArguments, spec.runtimeProcessIdentity,
-    ]);
-}
 const RESTART_HELPER_SOURCE = String.raw `
 const { spawnSync } = require("node:child_process");
 const spec = JSON.parse(process.argv[1]);
@@ -453,7 +428,27 @@ setTimeout(() => {
   } else if (spec.platform === "linux") {
     restarted = spawnSync("systemctl", ["--user", "--no-block", "restart", spec.id], { stdio: "ignore", shell: false });
   } else {
-    restarted = spawnSync("powershell.exe", spec.powershellArgs, { stdio: "ignore", shell: false });
+    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
+    const encodedExecutable = Buffer.from(spec.executable, "utf16le").toString("base64");
+    const encodedArguments = Buffer.from(spec.arguments, "utf16le").toString("base64");
+    const script = [
+      "$ErrorActionPreference='Stop';",
+      "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
+      "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
+      "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
+      "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
+      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+      "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
+      "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
+      "$p.Kill();",
+      "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
+      "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
+      "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
+      "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
+      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+      "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
+    ].join("");
+    restarted = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, String(spec.daemonPid), encodedName, encodedExecutable, encodedArguments, spec.processIdentity], { stdio: "ignore", shell: false });
   }
   if (restarted.status !== 0) process.send?.({ type: "restart-failed", status: restarted.status });
   setTimeout(() => {
@@ -475,8 +470,15 @@ export function scheduleServiceRestart(spec, spawnDetached = systemDetachedSpawn
             ? { platform: spec.platform, id: spec.id }
             : {
                 platform: spec.platform,
-                powershellArgs: windowsRestartCommandArgs(spec),
+                id: spec.id,
+                daemonPid: process.pid,
+                executable: spec.daemonCommand[0],
+                arguments: spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "),
+                processIdentity: spec.runtimeProcessIdentity,
             };
+    if (spec.platform === "win32" && !payload.processIdentity) {
+        throw new Error("Windows daemon process identity is required for restart");
+    }
     const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"], shell: false });
     child.unref();
     let settleFailure;
@@ -625,7 +627,7 @@ export async function windowsProfileIsPrivate(path, runner = systemCommandRunner
         "$unsafe=$rules|Where-Object { $_.AccessControlType -eq 'Allow' -and $safe -notcontains $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value };",
         "if($unsafe){'false'}else{'true'}",
     ].join("");
-    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedPath]));
+    const result = await runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, encodedPath]);
     if (result.exitCode !== 0)
         throw new Error(`Profile ACL inspection failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     if (result.stdout.trim() === "true")

package/dist/computer-setup-client.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { hostname } from "node:os";
 import { MachineTokenSchema } from "./computer-profile.js";
-import { powershellCommandArgs } from "./powershell-command.js";
 import { systemCommandRunner, } from "./computer-service.js";
 const HttpUrlSchema = z.string().url().refine((value) => {
     const url = new URL(value);
@@ -39,19 +38,6 @@ const SetupBootstrapSchema = z.object({
     expiresAt: z.string().datetime({ offset: true }).optional(),
     machineToken: MachineTokenSchema,
 }).strict();
-const SetupTokenTargetSchema = SetupBootstrapSchema.omit({ setupId: true, machineToken: true }).extend({
-    workspaceSlug: z.string().min(1).max(80),
-    releaseTag: z.enum(["latest", "beta"]),
-    connection: z.object({
-        status: z.enum(["online", "offline"]),
-        epoch: z.number().int().nonnegative(),
-        profile: z.string().nullable(),
-        daemonHome: z.string().nullable(),
-        agentsRoot: z.string().nullable(),
-        storageId: z.string().optional(),
-        credentialMatchesConnection: z.boolean(),
-    }).strict(),
-}).strict();
 const SetupPendingSchema = z.object({
     status: z.enum(["authorization_pending", "pending"]),
     intervalSeconds: z.number().int().positive().max(300).optional(),
@@ -250,8 +236,8 @@ export function createComputerSetupClient(options) {
         setTimeout(resolve, milliseconds);
     }));
     const now = options.now ?? Date.now;
+    let activeMachineId;
     const request = async (method, path, body, bearer) => {
-        const secretInputs = [bearer ?? "", body?.deviceCode ?? ""];
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
         try {
@@ -266,7 +252,7 @@ export function createComputerSetupClient(options) {
             });
             const payload = await response.json();
             if (!response.ok || payload?.success === false) {
-                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`, secretInputs);
+                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`);
                 throw new ComputerSetupHttpError(message, response.status, payload?.error?.code ?? `HTTP_${response.status}`);
             }
             return (payload?.success === true ? payload.data : payload);
@@ -276,15 +262,15 @@ export function createComputerSetupClient(options) {
                 throw new Error("computer setup request timed out");
             if (error instanceof ComputerSetupHttpError)
                 throw error;
-            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error), secretInputs));
+            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error)));
         }
         finally {
             clearTimeout(timeoutId);
         }
     };
     return {
-        tokenTarget: async (machineToken) => SetupTokenTargetSchema.parse(await request("GET", "/daemon/computer-setup/target", undefined, machineToken)),
         start: async (input) => {
+            activeMachineId = input.machineId;
             return parseStart(await request("POST", "/api/auth/computer-setup/start", {
                 ...(input.workspace.kind === "id"
                     ? { workspaceId: input.workspace.value }
@@ -295,6 +281,8 @@ export function createComputerSetupClient(options) {
             }));
         },
         poll: async (deviceCode) => {
+            if (activeMachineId === undefined)
+                throw new Error("computer setup polling has no active machine");
             return parsePoll(await request("POST", "/api/auth/computer-setup/poll", { deviceCode }));
         },
         waitForHello: async (input) => {
@@ -321,10 +309,8 @@ export function createComputerSetupClient(options) {
     };
 }
 export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
-    const command = platform === "win32" ? "powershell.exe" : platform === "darwin" ? "open" : "xdg-open";
-    const args = platform === "win32"
-        ? powershellCommandArgs("Start-Process -FilePath $args[0] -ErrorAction Stop | Out-Null", [url])
-        : [url];
+    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = [url];
     const result = await runner(command, args);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);

package/dist/computer-setup-orchestration.js

@@ -6,7 +6,7 @@ function safeError(error, machineToken) {
     const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), machineToken === undefined ? [] : [machineToken]);
     return new Error(message, error instanceof Error ? { cause: error } : undefined);
 }
-export function assertBootstrapMatches(bootstrap, input) {
+function assertBootstrapMatches(bootstrap, input) {
     if (bootstrap.machineId !== input.args.machineId) {
         throw new Error("setup bootstrap machine does not match --machine");
     }
@@ -40,7 +40,7 @@ function secondsUntil(expiresAt, now) {
     const remaining = Date.parse(expiresAt) - now();
     return Math.max(0, Math.ceil(remaining / 1_000));
 }
-export function localPathsMatch(left, right, platform) {
+function localPathsMatch(left, right, platform) {
     const paths = platform === "win32" ? win32 : posix;
     if (!paths.isAbsolute(left) || !paths.isAbsolute(right))
         return false;
@@ -51,14 +51,6 @@ export function localPathsMatch(left, right, platform) {
     return normalize(left) === normalize(right);
 }
 async function obtainBootstrap(input, deps) {
-    if (input.args.setupToken !== undefined) {
-        deps.reportPairing("Checking computer connection information...");
-        const result = await deps.client.poll(input.args.setupToken);
-        if (result.status !== "authorized") {
-            throw new Error("Setup command expired or unavailable; regenerate it in NowWork and run the new command");
-        }
-        return result.bootstrap;
-    }
     const pairing = await deps.client.start({
         workspace: input.args.workspace,
         machineId: input.args.machineId,
@@ -124,7 +116,6 @@ export async function runComputerSetupOrchestration(input, deps) {
         bootstrap = authorized;
         machineToken = token;
         assertBootstrapMatches(authorized, input);
-        deps.reportPairing("Downloading, installing, and starting the Daemon service...");
         const installation = await deps.installAutomatically({
             serverUrl: authorized.serverUrl,
             machineToken: token,
@@ -137,7 +128,6 @@ export async function runComputerSetupOrchestration(input, deps) {
             ...(authorized.registryUrl === undefined ? {} : { requestedRegistryUrl: authorized.registryUrl }),
             beforeRollback: confirmRollback,
             verifyAfterStart: async (candidate) => {
-                deps.reportPairing("Confirming the computer connection...");
                 const hello = await deps.client.waitForHello({
                     machineToken: token,
                     machineId: authorized.machineId,
@@ -184,7 +174,6 @@ export async function runComputerSetupOrchestration(input, deps) {
         });
         return {
             workspaceId: authorized.workspaceId,
-            ...(authorized.workspaceSlug === undefined ? {} : { workspaceSlug: authorized.workspaceSlug }),
             machineId: authorized.machineId,
             environment: authorized.environment,
             profile: installation.profile,

package/dist/computer-setup.js

@@ -1,13 +1,11 @@
 import { parseArgs } from "node:util";
 import { z } from "zod";
 import { DEFAULT_SERVER_URL } from "./config.js";
-import { MachineTokenSchema } from "./computer-profile.js";
 import { installDaemonAutomatically, } from "./automatic-daemon-installer.js";
 import { createComputerSetupClient, openSetupBrowser, redactSetupSecrets, } from "./computer-setup-client.js";
 import { runComputerSetupOrchestration, } from "./computer-setup-orchestration.js";
 import { detectDaemonLang, formatDaemonText } from "./i18n.js";
 import { systemCommandRunner } from "./computer-service.js";
-import { runMachineTokenSetup } from "./computer-token-setup.js";
 const WorkspaceSlugSchema = z.string()
     .min(2)
     .max(40)
@@ -72,8 +70,6 @@ export function parseSetupArgs(argv) {
     assertRepeatedOptionValuesAgree(argv, "machine", (value) => MachineIdSchema.parse(value).toLowerCase());
     assertRepeatedOptionValuesAgree(argv, "machine-id", (value) => MachineIdSchema.parse(value).toLowerCase());
     assertRepeatedOptionValuesAgree(argv, "server-url", normalizedServerOrigin);
-    assertRepeatedOptionValuesAgree(argv, "setup-token", (value) => value);
-    assertRepeatedOptionValuesAgree(argv, "api-key", (value) => value);
     const parsed = parseArgs({
         args: [...argv],
         allowPositionals: true,
@@ -86,8 +82,6 @@ export function parseSetupArgs(argv) {
             "server-url": { type: "string" },
             json: { type: "boolean", default: false },
             "no-browser": { type: "boolean", default: false },
-            "setup-token": { type: "string" },
-            "api-key": { type: "string" },
             help: { type: "boolean", short: "h", default: false },
         },
     });
@@ -130,14 +124,6 @@ export function parseSetupArgs(argv) {
     }
     const machineId = parsedMachine;
     const serverUrl = stringValue(values, "server-url");
-    const setupToken = stringValue(values, "setup-token");
-    const machineToken = stringValue(values, "api-key");
-    if (setupToken !== undefined && machineToken !== undefined)
-        throw new Error("Choose one setup credential source");
-    if (setupToken !== undefined && !/^[A-Za-z0-9_-]{32,512}$/u.test(setupToken))
-        throw new Error("Invalid setup Token");
-    if (machineToken !== undefined)
-        MachineTokenSchema.parse(machineToken);
     return Object.freeze({
         command: "setup",
         workspace,
@@ -145,8 +131,6 @@ export function parseSetupArgs(argv) {
         ...(serverUrl === undefined ? {} : { serverUrl: ServerUrlSchema.parse(serverUrl) }),
         ...(booleanValue(values, "json") ? { json: true } : {}),
         ...(booleanValue(values, "no-browser") ? { noBrowser: true } : {}),
-        ...(setupToken === undefined ? {} : { setupToken }),
-        ...(machineToken === undefined ? {} : { machineToken }),
     });
 }
 function resolveSetupServerUrl(args, env) {
@@ -164,8 +148,7 @@ export function setupUsage(td = (message) => message) {
         "  nowwork-computer setup --workspace /workspace --machine <uuid>",
         "  nowwork-computer setup --workspace-id <uuid> --machine-id <uuid>",
         "",
-        "Options: --server-url <url> --setup-token <token> --api-key <sk_machine_*> --json --no-browser",
-        td("Token setup does not require browser authorization. CREW_MACHINE_TOKEN is also supported."),
+        "Options: --server-url <url> --json --no-browser",
     ].join("\n") + "\n";
 }
 function defaults() {
@@ -184,7 +167,6 @@ function defaults() {
 }
 function humanSummary(result, td) {
     return [
-        td("Connected to {{workspace}}.", { workspace: result.workspaceSlug ?? result.workspaceId }),
         td("Workspace: {{value}}", { value: result.workspaceId }),
         td("Machine:   {{value}}", { value: result.machineId }),
         td("Environment: {{value}}", { value: result.environment }),
@@ -223,7 +205,6 @@ export async function runComputerSetupCommand(argv, overrides = {}) {
         return null;
     const deps = { ...defaults(), ...overrides };
     const lang = detectDaemonLang(deps.env);
-    const secrets = [...optionOccurrences(argv, "setup-token"), ...optionOccurrences(argv, "api-key"), deps.env.CREW_MACHINE_TOKEN ?? ""];
     try {
         if (argv.includes("--help") || argv.includes("-h")) {
             deps.stdout(setupUsage((message, values) => formatDaemonText(lang, message, values)));
@@ -232,43 +213,32 @@ export async function runComputerSetupCommand(argv, overrides = {}) {
         let args;
         try {
             args = parseSetupArgs(argv);
-            const envToken = deps.env.CREW_MACHINE_TOKEN?.trim();
-            if (envToken) {
-                if (args.setupToken !== undefined || (args.machineToken !== undefined && args.machineToken !== envToken)) {
-                    throw new Error("Choose one setup credential source; clear CREW_MACHINE_TOKEN when using another Token");
-                }
-                args = Object.freeze({ ...args, machineToken: MachineTokenSchema.parse(envToken) });
-            }
         }
         catch (error) {
-            deps.stderr(`nowwork-computer: ${formatDaemonText(lang, redactSetupSecrets(error.message, secrets))}\n`);
+            deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
             return 2;
         }
-        if (args.json === true && args.setupToken === undefined && args.machineToken === undefined) {
+        if (args.json === true) {
             deps.stderr(`${formatDaemonText(lang, "Starting computer setup pairing...")}\n`);
         }
         const serverUrl = resolveSetupServerUrl(args, deps.env);
         const createClient = overrides.createClient
             ?? ((value) => createComputerSetupClient({ serverUrl: value, fetch: deps.fetch }));
-        const orchestrationDeps = {
+        const result = await runComputerSetupOrchestration({ args, serverUrl }, {
             client: createClient(serverUrl),
             installAutomatically: deps.installAutomatically,
             openBrowser: args.noBrowser === true ? async () => { } : deps.openBrowser,
             sleep: deps.sleep,
             reportPairing: (message) => deps[args.json === true ? "stderr" : "stdout"](`${localizedPairingMessage(lang, message)}\n`),
             now: deps.now,
-            platform: deps.platform,
-        };
-        const result = args.machineToken === undefined
-            ? await runComputerSetupOrchestration({ args, serverUrl }, orchestrationDeps)
-            : await runMachineTokenSetup({ args, serverUrl }, orchestrationDeps, args.machineToken);
+        });
         deps.stdout(args.json === true
             ? `${JSON.stringify(result)}\n`
             : humanSummary(result, (message, values) => formatDaemonText(lang, message, values)));
         return 0;
     }
     catch (error) {
-        deps.stderr(`nowwork-computer: ${formatDaemonText(lang, redactSetupSecrets(error.message, secrets))}\n`);
+        deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
         return 1;
     }
 }

package/dist/execution-runner.js

@@ -587,6 +587,26 @@ export async function runExecution(config, input, dependencies) {
         let activitySequence = 0;
         let consoleSequence = 0;
         let externalOutputSequence = 0;
+        const bufferedPiExternalOutput = [];
+        const reportExternalOutput = (text) => {
+            if (firstOutputTimer !== undefined) {
+                clearTimeout(firstOutputTimer);
+                firstOutputTimer = undefined;
+            }
+            const frame = DaemonToServerExecutionFrameSchema.parse({
+                type: "execution:output",
+                protocolVersion: 1,
+                executionId: spec.executionId,
+                channel: "external_answer",
+                text,
+                seq: externalOutputSequence++,
+                at: now().toISOString(),
+            });
+            try {
+                telemetry.enqueue(boundExecutionFrame(frame, config.executionLimits.maxEventBytes));
+            }
+            catch { /* final completion remains the authoritative repair */ }
+        };
         const callbacks = {
             onRuntimeStarting: () => {
                 dependencies.onRuntimePhase?.("starting", spec.runtime.name);
@@ -711,23 +731,11 @@ export async function runExecution(config, input, dependencies) {
             } : {}),
             ...(spec.context.externalResponseSessionId || spec.context.answerStream ? {
                 onExternalOutput: (text) => {
-                    if (firstOutputTimer !== undefined) {
-                        clearTimeout(firstOutputTimer);
-                        firstOutputTimer = undefined;
-                    }
-                    const frame = DaemonToServerExecutionFrameSchema.parse({
-                        type: "execution:output",
-                        protocolVersion: 1,
-                        executionId: spec.executionId,
-                        channel: "external_answer",
-                        text,
-                        seq: externalOutputSequence++,
-                        at: now().toISOString(),
-                    });
-                    try {
-                        telemetry.enqueue(boundExecutionFrame(frame, config.executionLimits.maxEventBytes));
+                    if (spec.runtime.name === "pi") {
+                        bufferedPiExternalOutput.push(text);
+                        return;
                     }
-                    catch { /* final completion remains the authoritative repair */ }
+                    reportExternalOutput(text);
                 },
             } : {}),
         };
@@ -909,6 +917,10 @@ export async function runExecution(config, input, dependencies) {
             clearTimeout(timeout);
         if (firstOutputTimer !== undefined)
             clearTimeout(firstOutputTimer);
+        if (spec.runtime.name === "pi" && result.exitCode === 0 && result.externalAnswer !== null) {
+            for (const text of bufferedPiExternalOutput)
+                reportExternalOutput(text);
+        }
         const finishedAt = now().toISOString();
         if (result.exitCode === 0 && result.finalText?.trim())
             memoryCaptureFinalText = result.finalText;

package/dist/external-output.js

@@ -110,6 +110,7 @@ export class ExternalAnswerDecoder {
     pending = "";
     block = "";
     closed = null;
+    rejected = false;
     push(text) {
         if (!text)
             return [];
@@ -125,7 +126,7 @@ export class ExternalAnswerDecoder {
     }
     /** 整轮里最后一个完整闭合的标签块(已 trim);没有闭合过任何块则为 null。 */
     get lastClosedBlock() {
-        return this.closed;
+        return this.rejected ? null : this.closed;
     }
     consume(value, output) {
         this.pending = "";
@@ -154,12 +155,21 @@ export class ExternalAnswerDecoder {
                             this.block = "";
                             this.state = "inside";
                         }
+                        else if (!tag.closing && this.state === "inside") {
+                            // 嵌套答案标记说明模型正在讨论协议或混入了思考文本;
+                            // 不要把内层短片段误当成最终答案。
+                            this.rejected = true;
+                            this.block = "";
+                            this.state = "outside";
+                        }
                         else {
+                            this.rejected = true;
                             this.block = "";
                             this.state = tag.closing ? "outside" : "inside";
                         }
                     }
                     else if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.rejected = true;
                         this.block = "";
                         this.state = "outside";
                     }
@@ -171,6 +181,7 @@ export class ExternalAnswerDecoder {
                 else if (this.pending.length > MAX_MARKER_TAG_LENGTH + 2) {
                     const tag = classifyMarkerTag(this.pending.slice(1));
                     if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.rejected = true;
                         this.block = "";
                         this.state = "outside";
                     }

package/dist/i18n.js

@@ -36,16 +36,6 @@ const zh = {
     "Code {{code}}": "验证码 {{code}}",
     "Browser open skipped: {{reason}}": "未能自动打开浏览器：{{reason}}",
     "Starting computer setup pairing...": "正在发起电脑接入授权…",
-    "Token setup does not require browser authorization. CREW_MACHINE_TOKEN is also supported.": "Token 接入无需浏览器授权，也支持 CREW_MACHINE_TOKEN。",
-    "Checking computer connection information...": "正在检查接入信息…",
-    "Downloading, installing, and starting the Daemon service...": "正在下载、安装并启动 Daemon 服务…",
-    "Confirming the computer connection...": "正在确认电脑连接…",
-    "Connected to {{workspace}}.": "已接入 {{workspace}}。",
-    "Setup command expired or unavailable; regenerate it in NowWork and run the new command": "接入命令已过期或不可用，请在 NowWork 重新生成并执行新命令。",
-    "Timed out confirming the new computer connection": "确认新连接超时，请检查网络和服务状态。",
-    "Invalid setup Token": "接入 Token 无效。",
-    "Choose one setup credential source": "请只使用一种接入凭据。",
-    "Choose one setup credential source; clear CREW_MACHINE_TOKEN when using another Token": "请只使用一种接入凭据；使用其他 Token 时请清除 CREW_MACHINE_TOKEN。",
     "Workspace: {{value}}": "工作区：{{value}}",
     "Machine:   {{value}}": "机器：   {{value}}",
     "Environment: {{value}}": "环境：{{value}}",