@nowcrew/daemon 0.6.98-beta.4 → 0.6.98-beta.6

package/README.md

@@ -110,6 +110,15 @@ to confirm Workspace, Machine, environment, profile, and storage identity. It do
 existing `.crew` data. Existing `crew-daemon install --server-url ... --api-key ...` and profile lifecycle
 commands remain available as compatibility and recovery entry points.
 
+Profiles created by older installers may omit `workspaceId` and `machineId`. During setup, the installer
+uses the newly authorized machine credential to call `POST /daemon/computer-setup/legacy-profile` with
+the SHA-256 of the previous profile token. The server checks historical ownership within that exact
+Workspace and Machine, including revoked credentials, without reactivating them. After the server,
+profile name, Agent root and any existing identity fields match, normal installation persists both UUIDs.
+A mismatch or failed verification stops before changing the local profile or service; do not delete a
+profile or fill in UUIDs by guessing. Deploy the server endpoint before publishing the compatible daemon;
+an older server cannot verify legacy profiles, and already published daemon packages remain unchanged.
+
 ## Machine Environment
 
 The daemon loads exported variables from its OS account’s bash/zsh configuration on macOS/Linux,

package/dist/automatic-daemon-installer.js

@@ -1,7 +1,8 @@
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import { posix, win32 } from "node:path";
 import { z } from "zod";
-import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
+import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, resolveAgentsRoot, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
 import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { buildManagedServiceRecord, installManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
@@ -15,8 +16,14 @@ import { daemonRegistryCandidates } from "./daemon-registry.js";
 import { npmInvocation } from "./npm-command.js";
 import { discoverExactLegacyService, } from "./automatic-service-migration.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
-import { serverHostIdentity } from "./server-url.js";
-import { computerSetupRecoveryGuidance } from "./computer-setup-client.js";
+import { serverHostIdentity, serverUrlsMatch } from "./server-url.js";
+import { computerSetupRecoveryGuidance, createComputerSetupClient, } from "./computer-setup-client.js";
+export const automaticDaemonInstallStageMessage = {
+    downloading: "Downloading the Daemon package...",
+    configuring: "Configuring the Daemon service...",
+    starting: "Starting the Daemon service...",
+    confirming: "Confirming the computer connection...",
+};
 function profileStorage(platform, userHome, runner) {
     return {
         platform,
@@ -57,6 +64,7 @@ function defaultDependencies() {
         version: daemonVersion(),
         ...(process.env.PATH ? { runtimePath: process.env.PATH } : {}),
         runner,
+        verifyLegacyProfileIdentity: (serverUrl, input) => createComputerSetupClient({ serverUrl }).verifyLegacyProfileIdentity(input),
         captureProfile: async (target) => (await listProfiles(target.daemonHome)).includes(target.profile)
             ? loadProfile(target.profile, target.daemonHome, storage)
             : null,
@@ -260,18 +268,37 @@ function setupIdentity(input) {
         machineId: z.string().uuid().parse(input.machineId),
     };
 }
-function assertExistingProfileIdentity(previous, identity) {
+async function assertExistingProfileIdentity(previous, identity, target, machineToken, dependencies) {
     if (previous === null || identity === null)
         return;
-    if (previous.workspaceId === undefined || previous.machineId === undefined) {
-        throw new Error(`Profile '${previous.name}' does not record its Workspace and Machine identity`);
-    }
-    if (previous.workspaceId !== identity.workspaceId) {
+    if (previous.workspaceId !== undefined && previous.workspaceId !== identity.workspaceId) {
         throw new Error(`Profile '${previous.name}' belongs to a different Workspace identity`);
     }
-    if (previous.machineId !== identity.machineId) {
+    if (previous.machineId !== undefined && previous.machineId !== identity.machineId) {
         throw new Error(`Profile '${previous.name}' belongs to a different Machine identity`);
     }
+    if (previous.workspaceId !== undefined && previous.machineId !== undefined)
+        return;
+    const rootIdentity = (root) => {
+        const resolved = resolveAgentsRoot(root, dependencies.userHome, dependencies.platform);
+        return dependencies.platform === "win32" ? resolved.toLowerCase() : resolved;
+    };
+    if (previous.name !== target.profile || !serverUrlsMatch(previous.serverUrl, target.serverUrl)
+        || rootIdentity(previous.agentsRoot) !== rootIdentity(target.agentsRoot)) {
+        throw new Error(`Legacy profile '${previous.name}' does not match the requested server, profile, or Agent root`);
+    }
+    if (dependencies.verifyLegacyProfileIdentity === undefined) {
+        throw new Error(`Cannot verify legacy profile '${previous.name}' Workspace and Machine identity`);
+    }
+    // The old credential may already have been revoked by setup. Only the current credential
+    // authenticates this read-only request; the old hash proves historical ownership.
+    const verified = await dependencies.verifyLegacyProfileIdentity(target.serverUrl, {
+        machineToken,
+        previousTokenHash: createHash("sha256").update(previous.machineToken).digest("hex"),
+    });
+    if (verified.workspaceId !== identity.workspaceId || verified.machineId !== identity.machineId) {
+        throw new Error(`Legacy profile '${previous.name}' belongs to a different Workspace or Machine identity`);
+    }
 }
 export async function installDaemonAutomatically(input, dependencies = defaultDependencies()) {
     const machineToken = MachineTokenSchema.parse(input.machineToken);
@@ -308,7 +335,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
     });
     const previousProfile = await dependencies.captureProfile(target);
     await dependencies.assertProfileTarget(target, previousProfile);
-    assertExistingProfileIdentity(previousProfile, identity);
+    await assertExistingProfileIdentity(previousProfile, identity, target, machineToken, dependencies);
     const previousService = await dependencies.captureService(spec, target);
     if (previousService.installed && !previousService.exact) {
         throw new Error(`Installed service '${spec.id}' does not match the requested identity`);
@@ -331,6 +358,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
         });
         let installFailure;
         try {
+            input.onProgress?.("downloading");
             await dependencies.installPackage(target.npmPrefix, dependencies.version, dependencies.platform, dependencies.runner, target.registryUrl);
         }
         catch (error) {
@@ -353,6 +381,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
             legacyRemovalStarted = true;
             await dependencies.removeLegacyService(legacyService);
         }
+        input.onProgress?.("configuring");
         profileSaved = true;
         await dependencies.saveTargetProfile({
             version: 1,
@@ -367,6 +396,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
         }, target.daemonHome);
         serviceReplacementStarted = true;
         await dependencies.replaceService(spec, target);
+        input.onProgress?.("starting");
         await dependencies.startService(spec);
         const status = await dependencies.verifyService(spec);
         if (!status.running)
@@ -380,6 +410,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
             daemonHome: target.daemonHome,
             agentsRoot: target.agentsRoot,
         };
+        input.onProgress?.("confirming");
         await input.verifyAfterStart?.(result);
         return result;
     }

package/dist/cloud-report-upload.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir, hostname, platform } from "node:os";
+import { join } from "node:path";
 const ALIYUN_MARKER = /alibaba|aliyun|alicloud/iu;
 function readMarker(path) {
     try {
@@ -28,7 +29,15 @@ export function detectCloudProvider(env = process.env, platformName = platform()
 }
 export function findOssUploadScript(env = process.env, exists = existsSync) {
     const explicit = env.CREW_OSS_UPLOAD_SCRIPT?.trim();
-    return explicit && exists(explicit) ? explicit : undefined;
+    if (explicit)
+        return exists(explicit) ? explicit : undefined;
+    const home = env.HOME?.trim() || homedir();
+    const candidates = [
+        join(home, ".claude", "skills", "oss-upload", "scripts", "oss_upload.py"),
+        join(home, ".codex", "skills", "oss-upload", "scripts", "oss_upload.py"),
+        join(home, ".agents", "skills", "oss-upload", "scripts", "oss_upload.py"),
+    ];
+    return candidates.find(exists);
 }
 export function cloudReportUploadFacts(env = process.env, platformName = platform(), hostName = hostname(), readMarkerValue, exists) {
     const provider = detectCloudProvider(env, platformName, hostName, readMarkerValue);

package/dist/computer-setup-client.js

@@ -52,6 +52,13 @@ const SetupTokenTargetSchema = SetupBootstrapSchema.omit({ setupId: true, machin
         credentialMatchesConnection: z.boolean(),
     }).strict(),
 }).strict();
+const SetupReceiptSchema = z.object({
+    setupId: z.string().uuid(),
+    credentialState: z.enum(["pending", "finalized"]),
+    target: SetupTokenTargetSchema.omit({ connection: true }),
+    connection: SetupTokenTargetSchema.shape.connection,
+    connectionConfirmed: z.boolean(),
+}).strict();
 const SetupPendingSchema = z.object({
     status: z.enum(["authorization_pending", "pending"]),
     intervalSeconds: z.number().int().positive().max(300).optional(),
@@ -89,7 +96,8 @@ export class ComputerSetupHttpError extends Error {
     }
 }
 export function redactSetupSecrets(value, secrets = []) {
-    let redacted = value.replace(/\bsk_machine_[A-Za-z0-9_-]+\b/gu, "<redacted>");
+    let redacted = value.replace(/\bsk_machine_[A-Za-z0-9_-]+\b/gu, "<redacted>")
+        .replace(/(--setup-token(?:=|\s+))[A-Za-z0-9_-]+/gu, "$1<redacted>");
     for (const secret of secrets) {
         if (secret.length > 0)
             redacted = redacted.replaceAll(secret, "<redacted>");
@@ -251,7 +259,8 @@ export function createComputerSetupClient(options) {
     }));
     const now = options.now ?? Date.now;
     const request = async (method, path, body, bearer) => {
-        const secretInputs = [bearer ?? "", body?.deviceCode ?? ""];
+        const secretInputs = [bearer ?? "", body?.deviceCode ?? "",
+            body?.setupToken ?? ""];
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
         try {
@@ -283,7 +292,18 @@ export function createComputerSetupClient(options) {
         }
     };
     return {
+        receipt: async ({ setupToken, machineToken }) => {
+            const receipt = SetupReceiptSchema.safeParse(await request("POST", "/daemon/computer-setup/receipt", { setupToken }, machineToken));
+            if (!receipt.success)
+                throw new Error("Invalid computer setup receipt response");
+            return receipt.data;
+        },
         tokenTarget: async (machineToken) => SetupTokenTargetSchema.parse(await request("GET", "/daemon/computer-setup/target", undefined, machineToken)),
+        verifyLegacyProfileIdentity: async (input) => z.object({
+            workspaceId: z.string().uuid(), machineId: z.string().uuid(),
+        }).strict().parse(await request("POST", "/daemon/computer-setup/legacy-profile", {
+            previousTokenHash: input.previousTokenHash,
+        }, input.machineToken)),
         start: async (input) => {
             return parseStart(await request("POST", "/api/auth/computer-setup/start", {
                 ...(input.workspace.kind === "id"

package/dist/computer-setup-existing.js

@@ -0,0 +1,154 @@
+import { access, readFile, readdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+import { resolveAutomaticInstallTarget } from "./automatic-install-target.js";
+import { stableDaemonEntry } from "./automatic-daemon-installer.js";
+import { resolveDaemonLocalHome } from "./daemon-local-home.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { isDaemonReleaseVersion } from "./daemon-release-version.js";
+import { listProfiles, loadProfile, profileIsPrivate, profilePath } from "./computer-profile.js";
+import { buildServiceSpec, captureExactService, systemCommandRunner, windowsProfileIsPrivate } from "./computer-service.js";
+import { buildManagedServiceRecord } from "./managed-service-lifecycle.js";
+import { managedServiceIdentityMatches, readManagedServiceRegistry } from "./managed-service-registry.js";
+import { serverUrlsMatch } from "./server-url.js";
+import { assertBootstrapMatches, localPathsMatch } from "./computer-setup-orchestration.js";
+const storageKeys = ["NOWWORK_HOME", "NOWWORK_ENV_TAG", "NOWWORK_STORAGE_POLICY_PATH", "NOWWORK_LOCAL_HOME", "NOWWORK_LOCAL_HOME_MODE"];
+const decodeXml = (value) => value.replaceAll(""", '"').replaceAll("'", "'")
+    .replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+// Only recover the generated environment fields; the rebuilt descriptor must still match byte-for-byte.
+function descriptorEnvironment(descriptor, platform) {
+    return Object.fromEntries(storageKeys.flatMap((key) => {
+        const value = platform === "darwin"
+            ? new RegExp(`<key>${key}</key><string>([^<]*)</string>`, "u").exec(descriptor)?.[1]
+            : new RegExp(`^Environment="${key}=((?:[^"\\\\]|\\\\.)*)"$`, "mu").exec(descriptor)?.[1];
+        return value === undefined ? [] : [[key, platform === "darwin" ? decodeXml(value) : value.replace(/\\(.)/gu, "$1").replaceAll("%%", "%")]];
+    }));
+}
+async function windowsNodePath(serviceId, runner) {
+    const script = "$ErrorActionPreference='Stop';$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));"
+        + "$t=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});"
+        + "if($t.Count -ne 1){throw 'scheduled task identity unknown'};$a=@($t[0].Actions);"
+        + "if($a.Count -ne 1){throw 'scheduled task action unknown'};$a[0].Execute|ConvertTo-Json -Compress;";
+    const result = await runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script,
+        Buffer.from(serviceId, "utf16le").toString("base64")]);
+    const path = result.exitCode === 0 ? JSON.parse(result.stdout) : null;
+    if (typeof path !== "string" || !win32.isAbsolute(path))
+        throw new Error("Scheduled task executable unavailable");
+    return path;
+}
+/** One-shot inspection only. Never consumes credentials or changes local/service state. */
+export async function inspectExistingComputerSetup(input, client, options = {}) {
+    if (input.args.setupToken === undefined)
+        return { status: "unavailable" };
+    const platform = options.platform ?? process.platform;
+    const userHome = options.userHome ?? homedir();
+    const environment = options.environment ?? process.env;
+    const runner = options.runner ?? systemCommandRunner;
+    const paths = platform === "win32" ? win32 : posix;
+    try {
+        const requestedLocalHome = environment.NOWWORK_LOCAL_HOME;
+        const requestedLocalHomeMode = environment.NOWWORK_LOCAL_HOME_MODE ?? environment.NOWWORK_STORAGE_MODE;
+        const localOptions = {
+            ...(requestedLocalHome === undefined ? {} : { requestedLocalHome }),
+            ...(requestedLocalHomeMode === undefined ? {} : { requestedLocalHomeMode }),
+        };
+        const configuredHome = resolveDaemonLocalHome({ userHome, platform, profile: "in", mode: "nowwork",
+            ...(requestedLocalHome === undefined ? {} : { explicit: requestedLocalHome }) }).daemonHome;
+        const legacyRoot = paths.join(userHome, ".crew");
+        const legacyEntries = await readdir(legacyRoot, { withFileTypes: true }).catch((error) => {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        });
+        const homes = [...new Set([configuredHome, paths.join(userHome, ".nowwork", "config"),
+                ...legacyEntries.filter((entry) => entry.isDirectory() && /^daemon(?:-[a-z0-9_-]+)?$/u.test(entry.name))
+                    .map((entry) => paths.join(legacyRoot, entry.name))])];
+        const candidates = [];
+        for (const home of homes) {
+            for (const name of await listProfiles(home)) {
+                const privateProfile = platform === "win32"
+                    ? await windowsProfileIsPrivate(profilePath(name, home), runner)
+                    : await profileIsPrivate(name, home, platform);
+                if (!privateProfile)
+                    continue;
+                const profile = await loadProfile(name, home, { platform });
+                if (profile.name !== name || profile.machineId !== input.args.machineId || profile.workspaceId === undefined
+                    || !serverUrlsMatch(profile.serverUrl, input.serverUrl)
+                    || (input.args.workspace.kind === "id" && profile.workspaceId !== input.args.workspace.value))
+                    continue;
+                const target = resolveAutomaticInstallTarget({ serverUrl: input.serverUrl, requestedProfile: name,
+                    userHome, platform, ...localOptions });
+                if (!localPathsMatch(target.daemonHome, home, platform))
+                    continue;
+                if (profile.agentsRoot === undefined || !localPathsMatch(profile.agentsRoot, target.agentsRoot, platform))
+                    continue;
+                candidates.push({ profile, target });
+            }
+        }
+        if (candidates.length !== 1)
+            return { status: "unavailable" };
+        const { profile, target } = candidates[0];
+        const receipt = await client.receipt({ setupToken: input.args.setupToken, machineToken: profile.machineToken });
+        assertBootstrapMatches(receipt.target, input);
+        if (receipt.target.workspaceId !== profile.workspaceId || receipt.target.profile !== profile.name)
+            return { status: "unavailable" };
+        if (receipt.credentialState === "pending")
+            return { status: "pending" };
+        const connection = receipt.connection;
+        if (receipt.credentialState !== "finalized" || !receipt.connectionConfirmed || connection.status !== "online"
+            || !connection.credentialMatchesConnection || connection.epoch <= receipt.target.minimumConnectionEpoch
+            || connection.profile !== profile.name || connection.daemonHome === null || connection.agentsRoot === null
+            || !localPathsMatch(connection.daemonHome, target.daemonHome, platform)
+            || !localPathsMatch(connection.agentsRoot, target.agentsRoot, platform)
+            || (receipt.target.storageId !== undefined && receipt.target.storageId !== connection.storageId))
+            return { status: "unavailable" };
+        const localHome = paths.resolve(target.npmPrefix, "..", "..");
+        const entryPath = stableDaemonEntry(target, platform);
+        const installation = daemonGlobalInstallation(entryPath, platform);
+        if (installation === null)
+            return { status: "unavailable" };
+        await access(entryPath);
+        const packageJson = JSON.parse(await readFile(paths.join(installation.packageRoot, "package.json"), "utf8"));
+        if (!packageJson || typeof packageJson !== "object" || !("name" in packageJson) || packageJson.name !== "@nowcrew/daemon"
+            || !("version" in packageJson) || typeof packageJson.version !== "string" || !isDaemonReleaseVersion(packageJson.version))
+            return { status: "unavailable" };
+        const base = { platform, profile: profile.name, profileHome: target.daemonHome, userHome,
+            uid: options.uid ?? process.getuid?.(), entryPath };
+        let spec;
+        if (platform === "win32") {
+            const identity = buildServiceSpec({ ...base, nodePath: process.execPath, environment: {} });
+            const nodePath = await windowsNodePath(identity.id, runner);
+            await access(nodePath);
+            spec = buildServiceSpec({ ...base, nodePath, environment: {} });
+        }
+        else {
+            const records = (await readManagedServiceRegistry({ userHome, localHome })).filter((record) => record.profile === profile.name
+                && localPathsMatch(record.daemonHome, target.daemonHome, platform));
+            if (records.length !== 1)
+                return { status: "unavailable" };
+            const record = records[0];
+            await access(record.nodePath);
+            const descriptor = await readFile(record.descriptorPath, "utf8");
+            spec = buildServiceSpec({ ...base, nodePath: record.nodePath, entryPath: record.entryPath,
+                environment: descriptorEnvironment(descriptor, platform) });
+            const expected = buildManagedServiceRecord({ spec, daemonHome: target.daemonHome, agentsRoot: target.agentsRoot,
+                nodePath: record.nodePath, entryPath, ...installation });
+            if (!managedServiceIdentityMatches(record, expected))
+                return { status: "unavailable" };
+        }
+        const service = await captureExactService(spec, runner);
+        if (!service.installed || !service.exact || !service.running)
+            return { status: "unavailable" };
+        return { status: "connected", result: {
+                workspaceId: receipt.target.workspaceId, workspaceSlug: receipt.target.workspaceSlug, machineId: receipt.target.machineId,
+                environment: receipt.target.environment, profile: profile.name, daemonVersion: packageJson.version,
+                serviceId: spec.id, serviceStatus: "running", helloConfirmed: true, localNowworkHome: localHome,
+                daemonHome: target.daemonHome, agentsRoot: target.agentsRoot,
+                ...(connection.storageId === undefined ? {} : { storageId: connection.storageId }),
+            } };
+    }
+    catch {
+        // Failed inspection is not proof of installation, connection, or credential ownership.
+        return { status: "unavailable" };
+    }
+}

package/dist/computer-setup-orchestration.js

@@ -1,10 +1,12 @@
 import { computerSetupRecoveryGuidance, redactSetupSecrets, } from "./computer-setup-client.js";
+import { automaticDaemonInstallStageMessage } from "./automatic-daemon-installer.js";
+import { inspectExistingComputerSetup } from "./computer-setup-existing.js";
 import { isProductionServerHostname, serverUrlsMatch } from "./server-url.js";
 import { posix, win32 } from "node:path";
 import { resolveAgentsRoot } from "./computer-profile.js";
-function safeError(error, machineToken) {
-    const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), machineToken === undefined ? [] : [machineToken]);
-    return new Error(message, error instanceof Error ? { cause: error } : undefined);
+function safeError(error, machineToken, setupToken) {
+    const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), [machineToken ?? "", setupToken ?? ""]);
+    return new Error(message);
 }
 export function assertBootstrapMatches(bootstrap, input) {
     if (bootstrap.machineId !== input.args.machineId) {
@@ -55,6 +57,18 @@ async function obtainBootstrap(input, deps) {
         deps.reportPairing("Checking computer connection information...");
         const result = await deps.client.poll(input.args.setupToken);
         if (result.status !== "authorized") {
+            deps.reportPairing("Checking the existing computer connection...");
+            const inspection = await (deps.inspectExistingSetup ?? ((candidate, client) => inspectExistingComputerSetup(candidate, client, {
+                ...(deps.platform === undefined ? {} : { platform: deps.platform }),
+                ...(deps.environment === undefined ? {} : { environment: deps.environment }),
+            })))(input, deps.client);
+            if (inspection.status === "connected") {
+                deps.reportPairing("This computer is already connected. No installation changes are needed.");
+                return inspection.result;
+            }
+            if (inspection.status === "pending") {
+                throw new Error("Setup is still in progress; check the original terminal and wait for it to finish");
+            }
             throw new Error("Setup command expired or unavailable; regenerate it in NowWork and run the new command");
         }
         return result.bootstrap;
@@ -120,12 +134,14 @@ export async function runComputerSetupOrchestration(input, deps) {
     };
     try {
         const authorized = await obtainBootstrap(input, deps);
+        if ("helloConfirmed" in authorized)
+            return authorized;
         const token = authorized.machineToken;
         bootstrap = authorized;
         machineToken = token;
         assertBootstrapMatches(authorized, input);
-        deps.reportPairing("Downloading, installing, and starting the Daemon service...");
         const installation = await deps.installAutomatically({
+            onProgress: (stage) => deps.reportPairing(automaticDaemonInstallStageMessage[stage]),
             serverUrl: authorized.serverUrl,
             machineToken: token,
             workspaceId: authorized.workspaceId,
@@ -137,7 +153,6 @@ export async function runComputerSetupOrchestration(input, deps) {
             ...(authorized.registryUrl === undefined ? {} : { requestedRegistryUrl: authorized.registryUrl }),
             beforeRollback: confirmRollback,
             verifyAfterStart: async (candidate) => {
-                deps.reportPairing("Confirming the computer connection...");
                 const hello = await deps.client.waitForHello({
                     machineToken: token,
                     machineId: authorized.machineId,
@@ -209,6 +224,6 @@ export async function runComputerSetupOrchestration(input, deps) {
                     + `local recovery blocked. ${computerSetupRecoveryGuidance(bootstrap)}`, { cause: error });
             }
         }
-        throw safeError(error, machineToken);
+        throw safeError(error, machineToken, input.args.setupToken);
     }
 }

package/dist/computer-setup.js

@@ -258,6 +258,7 @@ export async function runComputerSetupCommand(argv, overrides = {}) {
             reportPairing: (message) => deps[args.json === true ? "stderr" : "stdout"](`${localizedPairingMessage(lang, message)}\n`),
             now: deps.now,
             platform: deps.platform,
+            environment: deps.env,
         };
         const result = args.machineToken === undefined
             ? await runComputerSetupOrchestration({ args, serverUrl }, orchestrationDeps)

package/dist/computer-token-setup.js

@@ -1,3 +1,4 @@
+import { automaticDaemonInstallStageMessage } from "./automatic-daemon-installer.js";
 import { assertBootstrapMatches, localPathsMatch } from "./computer-setup-orchestration.js";
 import { redactSetupSecrets } from "./computer-setup-client.js";
 export async function runMachineTokenSetup(input, deps, machineToken) {
@@ -5,14 +6,13 @@ export async function runMachineTokenSetup(input, deps, machineToken) {
         deps.reportPairing("Checking computer connection information...");
         const target = await deps.client.tokenTarget(machineToken);
         assertBootstrapMatches(target, input);
-        deps.reportPairing("Downloading, installing, and starting the Daemon service...");
         const installation = await deps.installAutomatically({
+            onProgress: (stage) => deps.reportPairing(automaticDaemonInstallStageMessage[stage]),
             serverUrl: target.serverUrl, machineToken, workspaceId: target.workspaceId, machineId: target.machineId,
             requestedProfile: target.profile,
             ...(target.releaseTag === undefined ? {} : { requestedReleaseTag: target.releaseTag }),
             ...(target.registryUrl === undefined ? {} : { requestedRegistryUrl: target.registryUrl }),
             verifyAfterStart: async (candidate) => {
-                deps.reportPairing("Confirming the computer connection...");
                 const deadline = deps.now() + 120_000;
                 for (;;) {
                     const current = await deps.client.tokenTarget(machineToken);

package/dist/execution-journal.js

@@ -8,7 +8,7 @@ import { provePosixProcessGroupStopped } from "./execution-posix-stop-proof.js";
 export { JournalLockedError, JournalLockCorruptionError } from "./execution-journal-lock.js";
 const ExecutionIdSchema = z.string().uuid();
 const TimestampSchema = z.string().datetime({ offset: true });
-const RuntimeSchema = z.enum(["claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness", "memory_migration", "pi"]);
+const RuntimeSchema = z.enum(["claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness", "pi"]);
 const RUNTIME_READY_SUFFIX = ".runtime-ready";
 const RawJournalEntrySchema = z.object({
     executionId: ExecutionIdSchema,
@@ -523,8 +523,6 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         }
     };
     const pruneInternal = async () => {
-        if (options.retainCompleted)
-            return;
         const protectedExecutionIds = new Set(options.protectedExecutionIds?.() ?? []);
         const entries = await readAll();
         const acknowledged = entries

package/dist/execution-protocol.js

@@ -319,7 +319,7 @@ const RawExecutionCompletedSchema = z.object({
     providerErrorCategory: ProviderErrorCategorySchema.optional(),
     providerHttpStatus: ProviderHttpStatusSchema.optional(),
     providerErrorCode: ProviderErrorCodeSchema.optional(),
-    runtime: z.union([RuntimeSchema, z.literal("memory_migration")]),
+    runtime: RuntimeSchema,
     model: z.string().optional(),
     resumed: z.boolean(),
     finalText: z.string().optional(),

package/dist/execution-runner.js

@@ -1,7 +1,6 @@
 import { createHash } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { isLocalMemoryV2Enabled, localMemoryV2Environment, resolveReposRoot } from "./config.js";
-import { detectLocalMemoryStorageVersion } from "./local-memory/storage-format.js";
 import { DaemonToServerExecutionFrameSchema, ExecutionCompletedSchema, ExecutionRejectedSchema, ExecutionStartSchema, } from "./execution-protocol.js";
 import { JournalConflictError } from "./execution-journal.js";
 import { boundExecutionFrame } from "./execution-event-limit.js";
@@ -588,6 +587,26 @@ export async function runExecution(config, input, dependencies) {
         let activitySequence = 0;
         let consoleSequence = 0;
         let externalOutputSequence = 0;
+        const bufferedPiExternalOutput = [];
+        const reportExternalOutput = (text) => {
+            if (firstOutputTimer !== undefined) {
+                clearTimeout(firstOutputTimer);
+                firstOutputTimer = undefined;
+            }
+            const frame = DaemonToServerExecutionFrameSchema.parse({
+                type: "execution:output",
+                protocolVersion: 1,
+                executionId: spec.executionId,
+                channel: "external_answer",
+                text,
+                seq: externalOutputSequence++,
+                at: now().toISOString(),
+            });
+            try {
+                telemetry.enqueue(boundExecutionFrame(frame, config.executionLimits.maxEventBytes));
+            }
+            catch { /* final completion remains the authoritative repair */ }
+        };
         const callbacks = {
             onRuntimeStarting: () => {
                 dependencies.onRuntimePhase?.("starting", spec.runtime.name);
@@ -712,23 +731,11 @@ export async function runExecution(config, input, dependencies) {
             } : {}),
             ...(spec.context.externalResponseSessionId || spec.context.answerStream ? {
                 onExternalOutput: (text) => {
-                    if (firstOutputTimer !== undefined) {
-                        clearTimeout(firstOutputTimer);
-                        firstOutputTimer = undefined;
-                    }
-                    const frame = DaemonToServerExecutionFrameSchema.parse({
-                        type: "execution:output",
-                        protocolVersion: 1,
-                        executionId: spec.executionId,
-                        channel: "external_answer",
-                        text,
-                        seq: externalOutputSequence++,
-                        at: now().toISOString(),
-                    });
-                    try {
-                        telemetry.enqueue(boundExecutionFrame(frame, config.executionLimits.maxEventBytes));
+                    if (spec.runtime.name === "pi") {
+                        bufferedPiExternalOutput.push(text);
+                        return;
                     }
-                    catch { /* final completion remains the authoritative repair */ }
+                    reportExternalOutput(text);
                 },
             } : {}),
         };
@@ -839,9 +846,8 @@ export async function runExecution(config, input, dependencies) {
         const localMemoryGuardInBase = localMemoryV2Environment(config.serverUrl) === "custom";
         const boundedSystemPrompt = (context) => {
             const enabled = context.workspace.localMemoryV2Enabled ?? localMemoryV2Enabled;
-            const systemPromptWithLocalFacts = withLocalExecutionFacts(`${spec.instructions.systemPrompt}${enabled && localMemoryGuardInBase && detectLocalMemoryStorageVersion(context.workspace.memory) !== 2 ? renderLocalMemoryV2WriteGuard() : ""}`, baseSystemPromptBudget, {
+            const systemPromptWithLocalFacts = withLocalExecutionFacts(`${spec.instructions.systemPrompt}${enabled && localMemoryGuardInBase ? renderLocalMemoryV2WriteGuard() : ""}`, baseSystemPromptBudget, {
                 ...(selfTraining ? { isolateLocalMemory: true } : {}),
-                memoryQuery: spec.instructions.wakePrompt,
                 collaborationTools: config.codexCollaborationTools && spec.runtime.name === "codex",
             });
             const base = typeof systemPromptWithLocalFacts === "string"
@@ -881,7 +887,6 @@ export async function runExecution(config, input, dependencies) {
                 serverUrl: config.serverUrl,
                 token: credential.token,
                 agentId: credential.agentId,
-                ...(dependencies.controlIdentity === undefined ? {} : dependencies.controlIdentity),
                 agentsRoot: config.agentsRoot,
                 reposRoot: resolveReposRoot(config.agentsRoot, config.reposRoot),
                 ...(config.qaReportRoot === undefined ? {} : { qaReportRoot: config.qaReportRoot }),
@@ -912,6 +917,10 @@ export async function runExecution(config, input, dependencies) {
             clearTimeout(timeout);
         if (firstOutputTimer !== undefined)
             clearTimeout(firstOutputTimer);
+        if (spec.runtime.name === "pi" && result.exitCode === 0 && result.externalAnswer !== null) {
+            for (const text of bufferedPiExternalOutput)
+                reportExternalOutput(text);
+        }
         const finishedAt = now().toISOString();
         if (result.exitCode === 0 && result.finalText?.trim())
             memoryCaptureFinalText = result.finalText;

package/dist/external-output.js

@@ -110,6 +110,7 @@ export class ExternalAnswerDecoder {
     pending = "";
     block = "";
     closed = null;
+    rejected = false;
     push(text) {
         if (!text)
             return [];
@@ -125,7 +126,7 @@ export class ExternalAnswerDecoder {
     }
     /** 整轮里最后一个完整闭合的标签块(已 trim);没有闭合过任何块则为 null。 */
     get lastClosedBlock() {
-        return this.closed;
+        return this.rejected ? null : this.closed;
     }
     consume(value, output) {
         this.pending = "";
@@ -154,12 +155,21 @@ export class ExternalAnswerDecoder {
                             this.block = "";
                             this.state = "inside";
                         }
+                        else if (!tag.closing && this.state === "inside") {
+                            // 嵌套答案标记说明模型正在讨论协议或混入了思考文本;
+                            // 不要把内层短片段误当成最终答案。
+                            this.rejected = true;
+                            this.block = "";
+                            this.state = "outside";
+                        }
                         else {
+                            this.rejected = true;
                             this.block = "";
                             this.state = tag.closing ? "outside" : "inside";
                         }
                     }
                     else if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.rejected = true;
                         this.block = "";
                         this.state = "outside";
                     }
@@ -171,6 +181,7 @@ export class ExternalAnswerDecoder {
                 else if (this.pending.length > MAX_MARKER_TAG_LENGTH + 2) {
                     const tag = classifyMarkerTag(this.pending.slice(1));
                     if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.rejected = true;
                         this.block = "";
                         this.state = "outside";
                     }