@nowcrew/daemon 0.6.98-beta.4 → 0.6.98

package/README.md

@@ -40,40 +40,7 @@ This compatibility form stays resident in the current terminal and reconnects wi
 `pnpm --filter @nowcrew/daemon daemon`. `crew-daemon run --agent <handle> --channel <id>` is the legacy
 manual one-shot entry.
 
-## Single-Command Computer Setup
-
-After the deployment enables Token setup, an owner/admin opens **Add Computer**, copies the complete
-command, and pastes it into the target computer's terminal. The same steps apply on macOS, Linux/SSH,
-and Windows. Node.js 22+ and npm must already be installed. The command launches the installer with npx;
-no separate global installation, browser confirmation, or verification code is needed during execution.
-
-The generated command pins an exact published installer version and includes a `--setup-token`.
-This is an already-approved one-time connection request, valid for ten minutes. The program exchanges
-it for the machine credential only when executed, then reuses native service installation, new-hello
-verification, credential finalization and rollback. Merely generating or copying a command does not
-rotate the existing credential. An expired or consumed command must be regenerated in the Web UI.
-
-For a machine credential you already hold, the same setup entry accepts `--api-key` or
-`CREW_MACHINE_TOKEN` without browser pairing:
-
-```bash
-nowwork-computer setup --server-url https://nowwork.nowcoder.com /nowcoder-app \
-  --machine <machine-uuid> --api-key <existing-machine-token>
-```
-
-The machine Token must match the specified Workspace and Computer. This path never rotates the
-credential or creates an approval request; it confirms a new control-plane connection with the expected
-profile and paths before reporting success. Token sources cannot be combined. JSON output puts progress
-on stderr and the final result on stdout. On Windows shells that block npm.ps1/npx.ps1, use npx.cmd as
-the package entry; the setup arguments and workflow are unchanged.
-
-Deployment requires `CREW_PUBLIC_URL` (or `CREW_SERVER_URL`) and
-`CREW_COMPUTER_TOKEN_SETUP_VERSION` set to an exact, published version known to support the Token flags.
-The server checks its published release catalog and channel before issuing a Token command. Leave the
-version unset until that installer has been released; it returns `computer_token_setup_unavailable`
-instead of generating a command for an unsupported package. Existing clients retain browser setup.
-
-## Browser-Approved Computer Setup (Compatibility)
+## Browser-Approved Computer Setup
 
 The Web UI generates a token-free command for a specific Workspace and Machine:
 

package/dist/automatic-service-migration.js

@@ -3,8 +3,6 @@ import { posix, win32 } from "node:path";
 import { buildServiceSpec, serviceStatus, windowsCommandArg, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { inspectLegacyServiceInstallationDetails } from "./legacy-service-installation.js";
-import { powershellCommandArgs } from "./powershell-command.js";
-import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 function encoded(value) {
     return Buffer.from(value, "utf16le").toString("base64");
 }
@@ -144,11 +142,12 @@ async function discoverWindows(input, identity) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);",
-        windowsTaskPrincipalScript,
-        `[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
+        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
+        "[pscustomobject]@{count=1;state=[int]$task.State;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await input.runner("powershell.exe", powershellCommandArgs(script, [encoded(identity.id)]));
+    const result = await input.runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encoded(identity.id),
+    ]);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect legacy scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -166,7 +165,7 @@ async function discoverWindows(input, identity) {
         : null;
     if (definition.count !== 1
         || definition.actionCount !== 1
-        || !windowsTaskPrincipalMatches(definition)
+        || definition.principalMatches !== true
         || !win32.isAbsolute(definition.execute ?? "")
         || match === null
         || match[2] !== input.desired.profile

package/dist/cloud-report-upload.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir, hostname, platform } from "node:os";
+import { join } from "node:path";
 const ALIYUN_MARKER = /alibaba|aliyun|alicloud/iu;
 function readMarker(path) {
     try {
@@ -28,7 +29,15 @@ export function detectCloudProvider(env = process.env, platformName = platform()
 }
 export function findOssUploadScript(env = process.env, exists = existsSync) {
     const explicit = env.CREW_OSS_UPLOAD_SCRIPT?.trim();
-    return explicit && exists(explicit) ? explicit : undefined;
+    if (explicit)
+        return exists(explicit) ? explicit : undefined;
+    const home = env.HOME?.trim() || homedir();
+    const candidates = [
+        join(home, ".claude", "skills", "oss-upload", "scripts", "oss_upload.py"),
+        join(home, ".codex", "skills", "oss-upload", "scripts", "oss_upload.py"),
+        join(home, ".agents", "skills", "oss-upload", "scripts", "oss_upload.py"),
+    ];
+    return candidates.find(exists);
 }
 export function cloudReportUploadFacts(env = process.env, platformName = platform(), hostName = hostname(), readMarkerValue, exists) {
     const provider = detectCloudProvider(env, platformName, hostName, readMarkerValue);

package/dist/computer-service.js

@@ -6,9 +6,7 @@ import { promisify } from "node:util";
 import { dirname, resolve } from "node:path";
 import { normalizeDaemonNpmRegistry } from "./npm-registry.js";
 import { daemonRegistryCandidates } from "./daemon-registry.js";
-import { windowsTaskPrincipalFields, windowsTaskPrincipalMatches, windowsTaskPrincipalScript, } from "./windows-task-principal.js";
 import { npmInvocation } from "./npm-command.js";
-import { powershellCommandArgs } from "./powershell-command.js";
 const execFileAsync = promisify(execFile);
 const WINDOWS_STOP_TIMEOUT_MS = 5_000;
 const WINDOWS_STOP_POLL_MS = 100;
@@ -197,11 +195,12 @@ async function windowsTaskDefinitionMatches(spec, runner) {
         "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));",
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -ne 1){[pscustomobject]@{count=$tasks.Count}|ConvertTo-Json -Compress;exit 0};",
-        "$task=$tasks[0];$actions=@($task.Actions);",
-        windowsTaskPrincipalScript,
-        `[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};${windowsTaskPrincipalFields}}|ConvertTo-Json -Compress;`,
+        "$task=$tasks[0];$actions=@($task.Actions);$me=[Security.Principal.WindowsIdentity]::GetCurrent().Name;",
+        "[pscustomobject]@{count=1;actionCount=$actions.Count;execute=if($actions.Count -eq 1){$actions[0].Execute}else{$null};arguments=if($actions.Count -eq 1){$actions[0].Arguments}else{$null};principalMatches=([String]::Equals($task.Principal.UserId,$me,[StringComparison]::OrdinalIgnoreCase)-and [int]$task.Principal.LogonType -eq 3 -and [int]$task.Principal.RunLevel -eq 0)}|ConvertTo-Json -Compress;",
     ].join("");
-    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
+    const result = await runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
+    ]);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to inspect scheduled task definition: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -215,7 +214,7 @@ async function windowsTaskDefinitionMatches(spec, runner) {
     const expectedArguments = spec.daemonCommand.slice(1).map(windowsCommandArg).join(" ");
     return definition.count === 1
         && definition.actionCount === 1
-        && windowsTaskPrincipalMatches(definition)
+        && definition.principalMatches === true
         && sameWindowsPath(definition.execute, spec.daemonCommand[0])
         && definition.arguments === expectedArguments;
 }
@@ -227,7 +226,9 @@ async function windowsTaskState(spec, runner) {
         "$tasks=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});",
         "if($tasks.Count -eq 0){'missing'}elseif($tasks.Count -eq 1){'state:'+([int]$tasks[0].State)}else{throw 'duplicate scheduled tasks'}",
     ].join("");
-    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedName]));
+    const result = await runner("powershell.exe", [
+        "-NoProfile", "-NonInteractive", "-Command", script, encodedName,
+    ]);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to query scheduled task: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     }
@@ -278,9 +279,10 @@ export async function installService(spec, runner = systemCommandRunner) {
             "$principal=New-ScheduledTaskPrincipal -UserId $identity -LogonType Interactive -RunLevel Limited;",
             "Register-ScheduledTask -TaskName $name -TaskPath '\\' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -ErrorAction Stop|Out-Null;",
         ].join("");
-        await checked(runner, "powershell.exe", powershellCommandArgs(script, [
+        await checked(runner, "powershell.exe", [
+            "-NoProfile", "-NonInteractive", "-Command", script,
             encodedName, encodedExecutable, encodedArguments,
-        ]), "Scheduled task installation");
+        ], "Scheduled task installation");
         return;
     }
     if (spec.descriptorPath === null || spec.descriptor === null)
@@ -416,33 +418,6 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
     }
 }
 const systemDetachedSpawn = (command, args, options) => spawn(command, [...args], options);
-function windowsRestartCommandArgs(spec) {
-    if (!spec.runtimeProcessIdentity)
-        throw new Error("Windows daemon process identity is required for restart");
-    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
-    const encodedExecutable = Buffer.from(spec.daemonCommand[0], "utf16le").toString("base64");
-    const encodedArguments = Buffer.from(spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "), "utf16le").toString("base64");
-    const script = [
-        "$ErrorActionPreference='Stop';",
-        "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
-        "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
-        "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
-        "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
-        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-        "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
-        "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
-        "$p.Kill();",
-        "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
-        "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
-        "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
-        "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
-        "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
-        "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
-    ].join("");
-    return powershellCommandArgs(script, [
-        String(process.pid), encodedName, encodedExecutable, encodedArguments, spec.runtimeProcessIdentity,
-    ]);
-}
 const RESTART_HELPER_SOURCE = String.raw `
 const { spawnSync } = require("node:child_process");
 const spec = JSON.parse(process.argv[1]);
@@ -453,7 +428,27 @@ setTimeout(() => {
   } else if (spec.platform === "linux") {
     restarted = spawnSync("systemctl", ["--user", "--no-block", "restart", spec.id], { stdio: "ignore", shell: false });
   } else {
-    restarted = spawnSync("powershell.exe", spec.powershellArgs, { stdio: "ignore", shell: false });
+    const encodedName = Buffer.from(spec.id, "utf16le").toString("base64");
+    const encodedExecutable = Buffer.from(spec.executable, "utf16le").toString("base64");
+    const encodedArguments = Buffer.from(spec.arguments, "utf16le").toString("base64");
+    const script = [
+      "$ErrorActionPreference='Stop';",
+      "$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[1]));",
+      "$exe=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[2]));",
+      "$argv=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[3]));",
+      "$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};",
+      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+      "$p=Get-Process -Id ([int]$args[0]) -ErrorAction Stop;",
+      "if($p.StartTime.ToUniversalTime().ToFileTimeUtc().ToString() -cne $args[4]){throw 'daemon process identity changed'};",
+      "$p.Kill();",
+      "if(-not $p.WaitForExit(10000)){throw 'daemon exit timeout'};",
+      "$deadline=[DateTime]::UtcNow.AddSeconds(10);",
+      "do{$task=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});if($task.Count -ne 1){throw 'scheduled task identity changed'};if([int]$task[0].State -ne 4){break};Start-Sleep -Milliseconds 100}while([DateTime]::UtcNow -lt $deadline);",
+      "if([int]$task[0].State -eq 4){throw 'scheduled task stop timeout'};",
+      "$actions=@($task[0].Actions);if($actions.Count -ne 1 -or -not [String]::Equals($actions[0].Execute,$exe,[StringComparison]::OrdinalIgnoreCase) -or $actions[0].Arguments -cne $argv){throw 'scheduled task action changed'};",
+      "& schtasks.exe /Run /TN $n | Out-Null;if($LASTEXITCODE -ne 0){throw 'scheduled task start failed'};",
+    ].join("");
+    restarted = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, String(spec.daemonPid), encodedName, encodedExecutable, encodedArguments, spec.processIdentity], { stdio: "ignore", shell: false });
   }
   if (restarted.status !== 0) process.send?.({ type: "restart-failed", status: restarted.status });
   setTimeout(() => {
@@ -475,8 +470,15 @@ export function scheduleServiceRestart(spec, spawnDetached = systemDetachedSpawn
             ? { platform: spec.platform, id: spec.id }
             : {
                 platform: spec.platform,
-                powershellArgs: windowsRestartCommandArgs(spec),
+                id: spec.id,
+                daemonPid: process.pid,
+                executable: spec.daemonCommand[0],
+                arguments: spec.daemonCommand.slice(1).map(windowsCommandArg).join(" "),
+                processIdentity: spec.runtimeProcessIdentity,
             };
+    if (spec.platform === "win32" && !payload.processIdentity) {
+        throw new Error("Windows daemon process identity is required for restart");
+    }
     const child = spawnDetached(process.execPath, ["-e", RESTART_HELPER_SOURCE, JSON.stringify(payload)], { detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"], shell: false });
     child.unref();
     let settleFailure;
@@ -625,7 +627,7 @@ export async function windowsProfileIsPrivate(path, runner = systemCommandRunner
         "$unsafe=$rules|Where-Object { $_.AccessControlType -eq 'Allow' -and $safe -notcontains $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value };",
         "if($unsafe){'false'}else{'true'}",
     ].join("");
-    const result = await runner("powershell.exe", powershellCommandArgs(script, [encodedPath]));
+    const result = await runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script, encodedPath]);
     if (result.exitCode !== 0)
         throw new Error(`Profile ACL inspection failed: ${result.stderr.trim() || `exit ${result.exitCode}`}`);
     if (result.stdout.trim() === "true")

package/dist/computer-setup-client.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { hostname } from "node:os";
 import { MachineTokenSchema } from "./computer-profile.js";
-import { powershellCommandArgs } from "./powershell-command.js";
 import { systemCommandRunner, } from "./computer-service.js";
 const HttpUrlSchema = z.string().url().refine((value) => {
     const url = new URL(value);
@@ -39,19 +38,6 @@ const SetupBootstrapSchema = z.object({
     expiresAt: z.string().datetime({ offset: true }).optional(),
     machineToken: MachineTokenSchema,
 }).strict();
-const SetupTokenTargetSchema = SetupBootstrapSchema.omit({ setupId: true, machineToken: true }).extend({
-    workspaceSlug: z.string().min(1).max(80),
-    releaseTag: z.enum(["latest", "beta"]),
-    connection: z.object({
-        status: z.enum(["online", "offline"]),
-        epoch: z.number().int().nonnegative(),
-        profile: z.string().nullable(),
-        daemonHome: z.string().nullable(),
-        agentsRoot: z.string().nullable(),
-        storageId: z.string().optional(),
-        credentialMatchesConnection: z.boolean(),
-    }).strict(),
-}).strict();
 const SetupPendingSchema = z.object({
     status: z.enum(["authorization_pending", "pending"]),
     intervalSeconds: z.number().int().positive().max(300).optional(),
@@ -250,8 +236,8 @@ export function createComputerSetupClient(options) {
         setTimeout(resolve, milliseconds);
     }));
     const now = options.now ?? Date.now;
+    let activeMachineId;
     const request = async (method, path, body, bearer) => {
-        const secretInputs = [bearer ?? "", body?.deviceCode ?? ""];
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
         try {
@@ -266,7 +252,7 @@ export function createComputerSetupClient(options) {
             });
             const payload = await response.json();
             if (!response.ok || payload?.success === false) {
-                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`, secretInputs);
+                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`);
                 throw new ComputerSetupHttpError(message, response.status, payload?.error?.code ?? `HTTP_${response.status}`);
             }
             return (payload?.success === true ? payload.data : payload);
@@ -276,15 +262,15 @@ export function createComputerSetupClient(options) {
                 throw new Error("computer setup request timed out");
             if (error instanceof ComputerSetupHttpError)
                 throw error;
-            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error), secretInputs));
+            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error)));
         }
         finally {
             clearTimeout(timeoutId);
         }
     };
     return {
-        tokenTarget: async (machineToken) => SetupTokenTargetSchema.parse(await request("GET", "/daemon/computer-setup/target", undefined, machineToken)),
         start: async (input) => {
+            activeMachineId = input.machineId;
             return parseStart(await request("POST", "/api/auth/computer-setup/start", {
                 ...(input.workspace.kind === "id"
                     ? { workspaceId: input.workspace.value }
@@ -295,6 +281,8 @@ export function createComputerSetupClient(options) {
             }));
         },
         poll: async (deviceCode) => {
+            if (activeMachineId === undefined)
+                throw new Error("computer setup polling has no active machine");
             return parsePoll(await request("POST", "/api/auth/computer-setup/poll", { deviceCode }));
         },
         waitForHello: async (input) => {
@@ -321,10 +309,8 @@ export function createComputerSetupClient(options) {
     };
 }
 export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
-    const command = platform === "win32" ? "powershell.exe" : platform === "darwin" ? "open" : "xdg-open";
-    const args = platform === "win32"
-        ? powershellCommandArgs("Start-Process -FilePath $args[0] -ErrorAction Stop | Out-Null", [url])
-        : [url];
+    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = [url];
     const result = await runner(command, args);
     if (result.exitCode !== 0) {
         throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);

package/dist/computer-setup-orchestration.js

@@ -6,7 +6,7 @@ function safeError(error, machineToken) {
     const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), machineToken === undefined ? [] : [machineToken]);
     return new Error(message, error instanceof Error ? { cause: error } : undefined);
 }
-export function assertBootstrapMatches(bootstrap, input) {
+function assertBootstrapMatches(bootstrap, input) {
     if (bootstrap.machineId !== input.args.machineId) {
         throw new Error("setup bootstrap machine does not match --machine");
     }
@@ -40,7 +40,7 @@ function secondsUntil(expiresAt, now) {
     const remaining = Date.parse(expiresAt) - now();
     return Math.max(0, Math.ceil(remaining / 1_000));
 }
-export function localPathsMatch(left, right, platform) {
+function localPathsMatch(left, right, platform) {
     const paths = platform === "win32" ? win32 : posix;
     if (!paths.isAbsolute(left) || !paths.isAbsolute(right))
         return false;
@@ -51,14 +51,6 @@ export function localPathsMatch(left, right, platform) {
     return normalize(left) === normalize(right);
 }
 async function obtainBootstrap(input, deps) {
-    if (input.args.setupToken !== undefined) {
-        deps.reportPairing("Checking computer connection information...");
-        const result = await deps.client.poll(input.args.setupToken);
-        if (result.status !== "authorized") {
-            throw new Error("Setup command expired or unavailable; regenerate it in NowWork and run the new command");
-        }
-        return result.bootstrap;
-    }
     const pairing = await deps.client.start({
         workspace: input.args.workspace,
         machineId: input.args.machineId,
@@ -124,7 +116,6 @@ export async function runComputerSetupOrchestration(input, deps) {
         bootstrap = authorized;
         machineToken = token;
         assertBootstrapMatches(authorized, input);
-        deps.reportPairing("Downloading, installing, and starting the Daemon service...");
         const installation = await deps.installAutomatically({
             serverUrl: authorized.serverUrl,
             machineToken: token,
@@ -137,7 +128,6 @@ export async function runComputerSetupOrchestration(input, deps) {
             ...(authorized.registryUrl === undefined ? {} : { requestedRegistryUrl: authorized.registryUrl }),
             beforeRollback: confirmRollback,
             verifyAfterStart: async (candidate) => {
-                deps.reportPairing("Confirming the computer connection...");
                 const hello = await deps.client.waitForHello({
                     machineToken: token,
                     machineId: authorized.machineId,
@@ -184,7 +174,6 @@ export async function runComputerSetupOrchestration(input, deps) {
         });
         return {
             workspaceId: authorized.workspaceId,
-            ...(authorized.workspaceSlug === undefined ? {} : { workspaceSlug: authorized.workspaceSlug }),
             machineId: authorized.machineId,
             environment: authorized.environment,
             profile: installation.profile,

package/dist/computer-setup.js

@@ -1,13 +1,11 @@
 import { parseArgs } from "node:util";
 import { z } from "zod";
 import { DEFAULT_SERVER_URL } from "./config.js";
-import { MachineTokenSchema } from "./computer-profile.js";
 import { installDaemonAutomatically, } from "./automatic-daemon-installer.js";
 import { createComputerSetupClient, openSetupBrowser, redactSetupSecrets, } from "./computer-setup-client.js";
 import { runComputerSetupOrchestration, } from "./computer-setup-orchestration.js";
 import { detectDaemonLang, formatDaemonText } from "./i18n.js";
 import { systemCommandRunner } from "./computer-service.js";
-import { runMachineTokenSetup } from "./computer-token-setup.js";
 const WorkspaceSlugSchema = z.string()
     .min(2)
     .max(40)
@@ -72,8 +70,6 @@ export function parseSetupArgs(argv) {
     assertRepeatedOptionValuesAgree(argv, "machine", (value) => MachineIdSchema.parse(value).toLowerCase());
     assertRepeatedOptionValuesAgree(argv, "machine-id", (value) => MachineIdSchema.parse(value).toLowerCase());
     assertRepeatedOptionValuesAgree(argv, "server-url", normalizedServerOrigin);
-    assertRepeatedOptionValuesAgree(argv, "setup-token", (value) => value);
-    assertRepeatedOptionValuesAgree(argv, "api-key", (value) => value);
     const parsed = parseArgs({
         args: [...argv],
         allowPositionals: true,
@@ -86,8 +82,6 @@ export function parseSetupArgs(argv) {
             "server-url": { type: "string" },
             json: { type: "boolean", default: false },
             "no-browser": { type: "boolean", default: false },
-            "setup-token": { type: "string" },
-            "api-key": { type: "string" },
             help: { type: "boolean", short: "h", default: false },
         },
     });
@@ -130,14 +124,6 @@ export function parseSetupArgs(argv) {
     }
     const machineId = parsedMachine;
     const serverUrl = stringValue(values, "server-url");
-    const setupToken = stringValue(values, "setup-token");
-    const machineToken = stringValue(values, "api-key");
-    if (setupToken !== undefined && machineToken !== undefined)
-        throw new Error("Choose one setup credential source");
-    if (setupToken !== undefined && !/^[A-Za-z0-9_-]{32,512}$/u.test(setupToken))
-        throw new Error("Invalid setup Token");
-    if (machineToken !== undefined)
-        MachineTokenSchema.parse(machineToken);
     return Object.freeze({
         command: "setup",
         workspace,
@@ -145,8 +131,6 @@ export function parseSetupArgs(argv) {
         ...(serverUrl === undefined ? {} : { serverUrl: ServerUrlSchema.parse(serverUrl) }),
         ...(booleanValue(values, "json") ? { json: true } : {}),
         ...(booleanValue(values, "no-browser") ? { noBrowser: true } : {}),
-        ...(setupToken === undefined ? {} : { setupToken }),
-        ...(machineToken === undefined ? {} : { machineToken }),
     });
 }
 function resolveSetupServerUrl(args, env) {
@@ -164,8 +148,7 @@ export function setupUsage(td = (message) => message) {
         "  nowwork-computer setup --workspace /workspace --machine <uuid>",
         "  nowwork-computer setup --workspace-id <uuid> --machine-id <uuid>",
         "",
-        "Options: --server-url <url> --setup-token <token> --api-key <sk_machine_*> --json --no-browser",
-        td("Token setup does not require browser authorization. CREW_MACHINE_TOKEN is also supported."),
+        "Options: --server-url <url> --json --no-browser",
     ].join("\n") + "\n";
 }
 function defaults() {
@@ -184,7 +167,6 @@ function defaults() {
 }
 function humanSummary(result, td) {
     return [
-        td("Connected to {{workspace}}.", { workspace: result.workspaceSlug ?? result.workspaceId }),
         td("Workspace: {{value}}", { value: result.workspaceId }),
         td("Machine:   {{value}}", { value: result.machineId }),
         td("Environment: {{value}}", { value: result.environment }),
@@ -223,7 +205,6 @@ export async function runComputerSetupCommand(argv, overrides = {}) {
         return null;
     const deps = { ...defaults(), ...overrides };
     const lang = detectDaemonLang(deps.env);
-    const secrets = [...optionOccurrences(argv, "setup-token"), ...optionOccurrences(argv, "api-key"), deps.env.CREW_MACHINE_TOKEN ?? ""];
     try {
         if (argv.includes("--help") || argv.includes("-h")) {
             deps.stdout(setupUsage((message, values) => formatDaemonText(lang, message, values)));
@@ -232,43 +213,32 @@ export async function runComputerSetupCommand(argv, overrides = {}) {
         let args;
         try {
             args = parseSetupArgs(argv);
-            const envToken = deps.env.CREW_MACHINE_TOKEN?.trim();
-            if (envToken) {
-                if (args.setupToken !== undefined || (args.machineToken !== undefined && args.machineToken !== envToken)) {
-                    throw new Error("Choose one setup credential source; clear CREW_MACHINE_TOKEN when using another Token");
-                }
-                args = Object.freeze({ ...args, machineToken: MachineTokenSchema.parse(envToken) });
-            }
         }
         catch (error) {
-            deps.stderr(`nowwork-computer: ${formatDaemonText(lang, redactSetupSecrets(error.message, secrets))}\n`);
+            deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
             return 2;
         }
-        if (args.json === true && args.setupToken === undefined && args.machineToken === undefined) {
+        if (args.json === true) {
             deps.stderr(`${formatDaemonText(lang, "Starting computer setup pairing...")}\n`);
         }
         const serverUrl = resolveSetupServerUrl(args, deps.env);
         const createClient = overrides.createClient
             ?? ((value) => createComputerSetupClient({ serverUrl: value, fetch: deps.fetch }));
-        const orchestrationDeps = {
+        const result = await runComputerSetupOrchestration({ args, serverUrl }, {
             client: createClient(serverUrl),
             installAutomatically: deps.installAutomatically,
             openBrowser: args.noBrowser === true ? async () => { } : deps.openBrowser,
             sleep: deps.sleep,
             reportPairing: (message) => deps[args.json === true ? "stderr" : "stdout"](`${localizedPairingMessage(lang, message)}\n`),
             now: deps.now,
-            platform: deps.platform,
-        };
-        const result = args.machineToken === undefined
-            ? await runComputerSetupOrchestration({ args, serverUrl }, orchestrationDeps)
-            : await runMachineTokenSetup({ args, serverUrl }, orchestrationDeps, args.machineToken);
+        });
         deps.stdout(args.json === true
             ? `${JSON.stringify(result)}\n`
             : humanSummary(result, (message, values) => formatDaemonText(lang, message, values)));
         return 0;
     }
     catch (error) {
-        deps.stderr(`nowwork-computer: ${formatDaemonText(lang, redactSetupSecrets(error.message, secrets))}\n`);
+        deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
         return 1;
     }
 }

package/dist/execution-journal.js

@@ -8,7 +8,7 @@ import { provePosixProcessGroupStopped } from "./execution-posix-stop-proof.js";
 export { JournalLockedError, JournalLockCorruptionError } from "./execution-journal-lock.js";
 const ExecutionIdSchema = z.string().uuid();
 const TimestampSchema = z.string().datetime({ offset: true });
-const RuntimeSchema = z.enum(["claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness", "memory_migration", "pi"]);
+const RuntimeSchema = z.enum(["claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness", "pi"]);
 const RUNTIME_READY_SUFFIX = ".runtime-ready";
 const RawJournalEntrySchema = z.object({
     executionId: ExecutionIdSchema,
@@ -523,8 +523,6 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         }
     };
     const pruneInternal = async () => {
-        if (options.retainCompleted)
-            return;
         const protectedExecutionIds = new Set(options.protectedExecutionIds?.() ?? []);
         const entries = await readAll();
         const acknowledged = entries

package/dist/execution-protocol.js

@@ -319,7 +319,7 @@ const RawExecutionCompletedSchema = z.object({
     providerErrorCategory: ProviderErrorCategorySchema.optional(),
     providerHttpStatus: ProviderHttpStatusSchema.optional(),
     providerErrorCode: ProviderErrorCodeSchema.optional(),
-    runtime: z.union([RuntimeSchema, z.literal("memory_migration")]),
+    runtime: RuntimeSchema,
     model: z.string().optional(),
     resumed: z.boolean(),
     finalText: z.string().optional(),

package/dist/execution-runner.js

@@ -1,7 +1,6 @@
 import { createHash } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { isLocalMemoryV2Enabled, localMemoryV2Environment, resolveReposRoot } from "./config.js";
-import { detectLocalMemoryStorageVersion } from "./local-memory/storage-format.js";
 import { DaemonToServerExecutionFrameSchema, ExecutionCompletedSchema, ExecutionRejectedSchema, ExecutionStartSchema, } from "./execution-protocol.js";
 import { JournalConflictError } from "./execution-journal.js";
 import { boundExecutionFrame } from "./execution-event-limit.js";
@@ -588,6 +587,26 @@ export async function runExecution(config, input, dependencies) {
         let activitySequence = 0;
         let consoleSequence = 0;
         let externalOutputSequence = 0;
+        const bufferedPiExternalOutput = [];
+        const reportExternalOutput = (text) => {
+            if (firstOutputTimer !== undefined) {
+                clearTimeout(firstOutputTimer);
+                firstOutputTimer = undefined;
+            }
+            const frame = DaemonToServerExecutionFrameSchema.parse({
+                type: "execution:output",
+                protocolVersion: 1,
+                executionId: spec.executionId,
+                channel: "external_answer",
+                text,
+                seq: externalOutputSequence++,
+                at: now().toISOString(),
+            });
+            try {
+                telemetry.enqueue(boundExecutionFrame(frame, config.executionLimits.maxEventBytes));
+            }
+            catch { /* final completion remains the authoritative repair */ }
+        };
         const callbacks = {
             onRuntimeStarting: () => {
                 dependencies.onRuntimePhase?.("starting", spec.runtime.name);
@@ -712,23 +731,11 @@ export async function runExecution(config, input, dependencies) {
             } : {}),
             ...(spec.context.externalResponseSessionId || spec.context.answerStream ? {
                 onExternalOutput: (text) => {
-                    if (firstOutputTimer !== undefined) {
-                        clearTimeout(firstOutputTimer);
-                        firstOutputTimer = undefined;
-                    }
-                    const frame = DaemonToServerExecutionFrameSchema.parse({
-                        type: "execution:output",
-                        protocolVersion: 1,
-                        executionId: spec.executionId,
-                        channel: "external_answer",
-                        text,
-                        seq: externalOutputSequence++,
-                        at: now().toISOString(),
-                    });
-                    try {
-                        telemetry.enqueue(boundExecutionFrame(frame, config.executionLimits.maxEventBytes));
+                    if (spec.runtime.name === "pi") {
+                        bufferedPiExternalOutput.push(text);
+                        return;
                     }
-                    catch { /* final completion remains the authoritative repair */ }
+                    reportExternalOutput(text);
                 },
             } : {}),
         };
@@ -839,9 +846,8 @@ export async function runExecution(config, input, dependencies) {
         const localMemoryGuardInBase = localMemoryV2Environment(config.serverUrl) === "custom";
         const boundedSystemPrompt = (context) => {
             const enabled = context.workspace.localMemoryV2Enabled ?? localMemoryV2Enabled;
-            const systemPromptWithLocalFacts = withLocalExecutionFacts(`${spec.instructions.systemPrompt}${enabled && localMemoryGuardInBase && detectLocalMemoryStorageVersion(context.workspace.memory) !== 2 ? renderLocalMemoryV2WriteGuard() : ""}`, baseSystemPromptBudget, {
+            const systemPromptWithLocalFacts = withLocalExecutionFacts(`${spec.instructions.systemPrompt}${enabled && localMemoryGuardInBase ? renderLocalMemoryV2WriteGuard() : ""}`, baseSystemPromptBudget, {
                 ...(selfTraining ? { isolateLocalMemory: true } : {}),
-                memoryQuery: spec.instructions.wakePrompt,
                 collaborationTools: config.codexCollaborationTools && spec.runtime.name === "codex",
             });
             const base = typeof systemPromptWithLocalFacts === "string"
@@ -881,7 +887,6 @@ export async function runExecution(config, input, dependencies) {
                 serverUrl: config.serverUrl,
                 token: credential.token,
                 agentId: credential.agentId,
-                ...(dependencies.controlIdentity === undefined ? {} : dependencies.controlIdentity),
                 agentsRoot: config.agentsRoot,
                 reposRoot: resolveReposRoot(config.agentsRoot, config.reposRoot),
                 ...(config.qaReportRoot === undefined ? {} : { qaReportRoot: config.qaReportRoot }),
@@ -912,6 +917,10 @@ export async function runExecution(config, input, dependencies) {
             clearTimeout(timeout);
         if (firstOutputTimer !== undefined)
             clearTimeout(firstOutputTimer);
+        if (spec.runtime.name === "pi" && result.exitCode === 0 && result.externalAnswer !== null) {
+            for (const text of bufferedPiExternalOutput)
+                reportExternalOutput(text);
+        }
         const finishedAt = now().toISOString();
         if (result.exitCode === 0 && result.finalText?.trim())
             memoryCaptureFinalText = result.finalText;