@nowcrew/daemon 0.6.98-beta.5 → 0.6.98-beta.6

package/README.md

@@ -110,6 +110,15 @@ to confirm Workspace, Machine, environment, profile, and storage identity. It do
 existing `.crew` data. Existing `crew-daemon install --server-url ... --api-key ...` and profile lifecycle
 commands remain available as compatibility and recovery entry points.
 
+Profiles created by older installers may omit `workspaceId` and `machineId`. During setup, the installer
+uses the newly authorized machine credential to call `POST /daemon/computer-setup/legacy-profile` with
+the SHA-256 of the previous profile token. The server checks historical ownership within that exact
+Workspace and Machine, including revoked credentials, without reactivating them. After the server,
+profile name, Agent root and any existing identity fields match, normal installation persists both UUIDs.
+A mismatch or failed verification stops before changing the local profile or service; do not delete a
+profile or fill in UUIDs by guessing. Deploy the server endpoint before publishing the compatible daemon;
+an older server cannot verify legacy profiles, and already published daemon packages remain unchanged.
+
 ## Machine Environment
 
 The daemon loads exported variables from its OS account’s bash/zsh configuration on macOS/Linux,

package/dist/automatic-daemon-installer.js

@@ -1,7 +1,8 @@
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import { posix, win32 } from "node:path";
 import { z } from "zod";
-import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
+import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenSchema, removeProfile, resolveAgentsRoot, saveProfile, windowsDpapiProtector, } from "./computer-profile.js";
 import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { buildManagedServiceRecord, installManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
@@ -15,8 +16,8 @@ import { daemonRegistryCandidates } from "./daemon-registry.js";
 import { npmInvocation } from "./npm-command.js";
 import { discoverExactLegacyService, } from "./automatic-service-migration.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
-import { serverHostIdentity } from "./server-url.js";
-import { computerSetupRecoveryGuidance } from "./computer-setup-client.js";
+import { serverHostIdentity, serverUrlsMatch } from "./server-url.js";
+import { computerSetupRecoveryGuidance, createComputerSetupClient, } from "./computer-setup-client.js";
 export const automaticDaemonInstallStageMessage = {
     downloading: "Downloading the Daemon package...",
     configuring: "Configuring the Daemon service...",
@@ -63,6 +64,7 @@ function defaultDependencies() {
         version: daemonVersion(),
         ...(process.env.PATH ? { runtimePath: process.env.PATH } : {}),
         runner,
+        verifyLegacyProfileIdentity: (serverUrl, input) => createComputerSetupClient({ serverUrl }).verifyLegacyProfileIdentity(input),
         captureProfile: async (target) => (await listProfiles(target.daemonHome)).includes(target.profile)
             ? loadProfile(target.profile, target.daemonHome, storage)
             : null,
@@ -266,18 +268,37 @@ function setupIdentity(input) {
         machineId: z.string().uuid().parse(input.machineId),
     };
 }
-function assertExistingProfileIdentity(previous, identity) {
+async function assertExistingProfileIdentity(previous, identity, target, machineToken, dependencies) {
     if (previous === null || identity === null)
         return;
-    if (previous.workspaceId === undefined || previous.machineId === undefined) {
-        throw new Error(`Profile '${previous.name}' does not record its Workspace and Machine identity`);
-    }
-    if (previous.workspaceId !== identity.workspaceId) {
+    if (previous.workspaceId !== undefined && previous.workspaceId !== identity.workspaceId) {
         throw new Error(`Profile '${previous.name}' belongs to a different Workspace identity`);
     }
-    if (previous.machineId !== identity.machineId) {
+    if (previous.machineId !== undefined && previous.machineId !== identity.machineId) {
         throw new Error(`Profile '${previous.name}' belongs to a different Machine identity`);
     }
+    if (previous.workspaceId !== undefined && previous.machineId !== undefined)
+        return;
+    const rootIdentity = (root) => {
+        const resolved = resolveAgentsRoot(root, dependencies.userHome, dependencies.platform);
+        return dependencies.platform === "win32" ? resolved.toLowerCase() : resolved;
+    };
+    if (previous.name !== target.profile || !serverUrlsMatch(previous.serverUrl, target.serverUrl)
+        || rootIdentity(previous.agentsRoot) !== rootIdentity(target.agentsRoot)) {
+        throw new Error(`Legacy profile '${previous.name}' does not match the requested server, profile, or Agent root`);
+    }
+    if (dependencies.verifyLegacyProfileIdentity === undefined) {
+        throw new Error(`Cannot verify legacy profile '${previous.name}' Workspace and Machine identity`);
+    }
+    // The old credential may already have been revoked by setup. Only the current credential
+    // authenticates this read-only request; the old hash proves historical ownership.
+    const verified = await dependencies.verifyLegacyProfileIdentity(target.serverUrl, {
+        machineToken,
+        previousTokenHash: createHash("sha256").update(previous.machineToken).digest("hex"),
+    });
+    if (verified.workspaceId !== identity.workspaceId || verified.machineId !== identity.machineId) {
+        throw new Error(`Legacy profile '${previous.name}' belongs to a different Workspace or Machine identity`);
+    }
 }
 export async function installDaemonAutomatically(input, dependencies = defaultDependencies()) {
     const machineToken = MachineTokenSchema.parse(input.machineToken);
@@ -314,7 +335,7 @@ export async function installDaemonAutomatically(input, dependencies = defaultDe
     });
     const previousProfile = await dependencies.captureProfile(target);
     await dependencies.assertProfileTarget(target, previousProfile);
-    assertExistingProfileIdentity(previousProfile, identity);
+    await assertExistingProfileIdentity(previousProfile, identity, target, machineToken, dependencies);
     const previousService = await dependencies.captureService(spec, target);
     if (previousService.installed && !previousService.exact) {
         throw new Error(`Installed service '${spec.id}' does not match the requested identity`);

package/dist/computer-setup-client.js

@@ -299,6 +299,11 @@ export function createComputerSetupClient(options) {
             return receipt.data;
         },
         tokenTarget: async (machineToken) => SetupTokenTargetSchema.parse(await request("GET", "/daemon/computer-setup/target", undefined, machineToken)),
+        verifyLegacyProfileIdentity: async (input) => z.object({
+            workspaceId: z.string().uuid(), machineId: z.string().uuid(),
+        }).strict().parse(await request("POST", "/daemon/computer-setup/legacy-profile", {
+            previousTokenHash: input.previousTokenHash,
+        }, input.machineToken)),
         start: async (input) => {
             return parseStart(await request("POST", "/api/auth/computer-setup/start", {
                 ...(input.workspace.kind === "id"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.98-beta.5",
+  "version": "0.6.98-beta.6",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -18,6 +18,13 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
     "@nowcrew/cli": "0.4.17",
@@ -39,11 +46,5 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
-  },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
   }
-}
+}