@nowcrew/daemon 0.6.98-beta.6 → 0.6.98-beta.8

package/README.md

@@ -68,10 +68,15 @@ on stderr and the final result on stdout. On Windows shells that block npm.ps1/n
 the package entry; the setup arguments and workflow are unchanged.
 
 Deployment requires `CREW_PUBLIC_URL` (or `CREW_SERVER_URL`) and
-`CREW_COMPUTER_TOKEN_SETUP_VERSION` set to an exact, published version known to support the Token flags.
-The server checks its published release catalog and channel before issuing a Token command. Leave the
-version unset until that installer has been released; it returns `computer_token_setup_unavailable`
-instead of generating a command for an unsupported package. Existing clients retain browser setup.
+a compatible published installer (beta >= 0.6.98-beta.5; stable >= 0.6.99).
+`CREW_COMPUTER_TOKEN_SETUP_VERSION` is an optional exact-version pin, not a feature switch.
+When unset or blank, the server selects the latest beta for dev or stable for production from its refreshed release catalog.
+Both the two-step installation command and the one-step npx command pin that exact version.
+An explicit pin must be published, compatible and in the same channel; invalid pins do not fall back.
+The command keeps `--machine` for target validation and `--setup-token` for the short-lived, one-time preapproval.
+The server checks its published release catalog and channel before issuing a Token command. If no
+compatible published version is available, it returns `computer_token_setup_unavailable` instead of
+generating a command for an unsupported package. Existing clients retain browser setup.
 
 ## Browser-Approved Computer Setup (Compatibility)
 
@@ -429,23 +434,27 @@ path-free inventory and logical `(projectId, skillName)` bindings. The local pat
 while an add command is forwarded to the selected online Computer; it is not written to the workspace
 database, structured logs, inventory frames, or responses. Project Skills are disabled on Windows.
 
-One binding set is projected into both Runtime discovery layouts:
+Skill entries may be real directories or directory symlinks, including relative, absolute, chained,
+and shared directories outside the project. Only direct, non-hidden entries are scanned. Broken,
+cyclic, inaccessible, and non-directory links count as invalid Skills without hiding healthy entries;
+the existing frontmatter, size, name-conflict, and inventory limits apply to linked Skills too.
+
+Each execution projects its binding set into a private Runtime discovery directory:
 
 ```text
-<agentsRoot>/<handle>/.agents/skills/<name>                         # Codex symlink
-<agentsRoot>/<handle>/.crew/claude-skills/.claude/skills/<name>    # Claude symlink
+<agentsRoot>/<handle>/.crew/project-skills/exec-<executionId>/runtime/.claude/skills/<name>
 ```
 
-The two complete directories switch under one per-Agent reconcile/launch lock. A failed switch restores
-the prior complete projection; a missing project or Skill removes only that link and does not block other
-work. These are ordinary writable symlinks, not snapshots or a sandbox: an Agent running as the daemon
-user can modify the source Skill through them. That write-through risk is intentionally accepted.
+The scanner retains the entry path. Binding checks and execution startup resolve its current real
+directory and check for `SKILL.md`; missing sources warn and are omitted without blocking other work.
+Each execution links to that resolved directory, so retargeting an entry affects subsequent executions
+while active executions keep their original target. Source file edits remain live. The projection is
+removed after the runtime process tree stops; source directories and user-created links are preserved.
+These are ordinary writable symlinks, not snapshots or a sandbox: an Agent running as the daemon user
+can modify the source Skill through them. That write-through risk is intentionally accepted.
 
-Codex protocol-v1 task directories are opaque
-`<agentsRoot>/<handle>/tasks/<safe-prefix>-<sha256>` paths. The daemon writes `.nowwork-root` at the Agent
-root and adds it to Codex `project_root_markers`, so upward discovery reaches `.agents/skills` without
-changing the task cwd. Claude receives
-`--add-dir <agentsRoot>/<handle>/.crew/claude-skills`; Claude treats those Skills as `projectSettings`,
+Codex registers the execution's `runtime/.claude/skills` through `skills/extraRoots/set`. Claude receives
+the execution's `runtime` directory through `--add-dir`; Claude treats those Skills as `projectSettings`,
 so a machine policy that disables project settings also disables this source even when the projection is
 healthy.
 
@@ -462,10 +471,10 @@ scope is merged. The policy version in Codex's session fingerprint cold-starts o
 once, then subsequent runs can resume normally. Explicit `shell_environment_policy.set` entries, shell
 startup scripts and Agent notes remain separate configuration; this change does not correct them.
 
-Binding changes reconcile immediately when the Computer is online. On reconnect the server sends the
-complete binding set for every Agent assigned to that Computer, including empty sets that clear stale
-links left by offline unbinds. Every non-empty execution snapshot is also reconciled immediately before
-Runtime launch, which recovers from a missed notification or daemon restart. Skill file content changes
+Binding changes are checked immediately when the Computer is online. On reconnect the server sends the
+complete binding set for every Agent assigned to that Computer, including empty sets. Each execution
+uses its server-snapshotted binding set and revalidates local source paths immediately before Runtime
+launch. Skill file content changes
 are visible through the symlink immediately; adding, deleting, renaming, or changing frontmatter requires
 a rescan. Web descriptions remain at the last inventory value until that rescan.
 

package/dist/automatic-daemon-installer.js

@@ -6,7 +6,8 @@ import { assertProfileAgentsRootUnique, listProfiles, loadProfile, MachineTokenS
 import { buildServiceSpec, captureExactService, hardenWindowsProfile, replaceExactService, restoreExactService, serviceAction, serviceStatus, systemCommandRunner, uninstallService, } from "./computer-service.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { buildManagedServiceRecord, installManagedService, uninstallManagedService, } from "./managed-service-lifecycle.js";
-import { ManagedServiceConflictError, managedServiceConflict, managedServiceIdentityMatches, readManagedServiceRegistry, } from "./managed-service-registry.js";
+import { readManagedServiceRegistry, } from "./managed-service-registry.js";
+import { captureManagedServiceForSetup } from "./automatic-service-capture.js";
 import { resolveAutomaticInstallTarget, } from "./automatic-install-target.js";
 import { acquireDaemonInstallationLease, } from "./daemon-installation-lease.js";
 import { daemonVersion } from "./machine-info.js";
@@ -80,7 +81,6 @@ function defaultDependencies() {
         },
         captureService: async (spec, target) => {
             if (platform !== "win32") {
-                managedRecords = await readManagedServiceRegistry({ userHome, localHome: localHomeForTarget(target, platform) });
                 const entryPath = spec.daemonCommand[1];
                 const installation = daemonGlobalInstallation(entryPath, platform);
                 if (installation === null) {
@@ -94,14 +94,13 @@ function defaultDependencies() {
                     entryPath,
                     ...installation,
                 });
-                const { generation: _generation, createdAt: _createdAt, ...expected } = candidate;
-                previousManagedRecord = managedRecords.find((record) => managedServiceIdentityMatches(record, expected));
-                if (previousManagedRecord === undefined) {
-                    const conflict = managedServiceConflict(managedRecords, candidate);
-                    if (conflict !== null) {
-                        throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
-                    }
-                }
+                const captured = await captureManagedServiceForSetup({
+                    spec, record: candidate, runner,
+                    registry: { userHome, localHome: localHomeForTarget(target, platform) },
+                });
+                managedRecords = captured.managedRecords;
+                previousManagedRecord = captured.previousManagedRecord;
+                return captured.snapshot;
             }
             return captureExactService(spec, runner);
         },
@@ -175,7 +174,12 @@ function defaultDependencies() {
                 ? localHome
                 : localHomeForNpmPrefix(previousManagedRecord.npmPrefix, platform);
             const current = (await readManagedServiceRegistry({ userHome, localHome: restoreLocalHome })).find((record) => record.serviceId === spec.id);
-            if (current !== undefined && JSON.stringify(current) !== JSON.stringify(previousManagedRecord)) {
+            const onlyHashChanged = current !== undefined && previousManagedRecord !== undefined
+                && JSON.stringify({ ...current, descriptorSha256: previousManagedRecord.descriptorSha256 })
+                    === JSON.stringify(previousManagedRecord);
+            // Preflight may have captured the exact descriptor while leaving a stale
+            // registry hash untouched. Let installManagedService reconcile it in place.
+            if (current !== undefined && !onlyHashChanged && JSON.stringify(current) !== JSON.stringify(previousManagedRecord)) {
                 await uninstallManagedService({
                     spec,
                     record: current,

package/dist/automatic-service-capture.js

@@ -0,0 +1,27 @@
+import { captureExactService } from "./computer-service.js";
+import { ManagedServiceConflictError, ManagedServiceRegistryError, managedServiceConflict, managedServiceIdentityMatches, readManagedServiceRegistry, } from "./managed-service-registry.js";
+/** Read-only preflight; keep the record needed to restore the captured service. */
+export async function captureManagedServiceForSetup(input) {
+    const managedRecords = await readManagedServiceRegistry(input.registry);
+    const { generation: _generation, createdAt: _createdAt, ...expected } = input.record;
+    const registered = managedRecords.find((record) => managedServiceIdentityMatches(record, {
+        ...expected, descriptorSha256: record.descriptorSha256,
+    }));
+    if (registered === undefined) {
+        const conflict = managedServiceConflict(managedRecords, input.record);
+        if (conflict !== null) {
+            throw new ManagedServiceConflictError(conflict.resource, input.record, conflict.owner);
+        }
+    }
+    const snapshot = await captureExactService(input.spec, input.runner);
+    if (registered !== undefined && registered.descriptorSha256 !== expected.descriptorSha256
+        && (!snapshot.installed || !snapshot.exact)) {
+        throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match the requested identity`);
+    }
+    // A stale hash may be reconciled later under the registry lock. Rollback must
+    // refer to the descriptor we actually captured, not the stale registry hash.
+    const previousManagedRecord = registered === undefined ? undefined : {
+        ...registered, descriptorSha256: expected.descriptorSha256,
+    };
+    return { managedRecords, previousManagedRecord, snapshot };
+}

package/dist/computer-service.js

@@ -12,6 +12,8 @@ import { powershellCommandArgs } from "./powershell-command.js";
 const execFileAsync = promisify(execFile);
 const WINDOWS_STOP_TIMEOUT_MS = 5_000;
 const WINDOWS_STOP_POLL_MS = 100;
+const DARWIN_STOP_TIMEOUT_MS = 30_000;
+const DARWIN_STOP_POLL_MS = 100;
 /** Windows cannot spawn .cmd/.bat shims directly with shell:false; route them through cmd.exe explicitly. */
 export function systemCommandInvocation(command, args, platform = process.platform, comSpec = process.env.ComSpec ?? process.env.COMSPEC ?? "cmd.exe") {
     if (platform === "win32" && /\.(?:cmd|bat)$/iu.test(command)) {
@@ -186,6 +188,32 @@ async function checked(runner, command, args, action) {
     }
     return result;
 }
+async function stopLaunchdService(spec, initial, runner) {
+    const assertQueryable = (result) => {
+        // launchctl uses 113 for an absent service. Other failures cannot prove it stopped.
+        if (result.exitCode !== 0 && result.exitCode !== 113) {
+            throw new Error(`launchd status failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`}`);
+        }
+    };
+    assertQueryable(initial);
+    if (initial.exitCode === 113)
+        return;
+    const target = `${spec.managerDomain}/${spec.id}`;
+    await checked(runner, "launchctl", ["bootout", target], "launchd stop");
+    const deadline = Date.now() + DARWIN_STOP_TIMEOUT_MS;
+    while (true) {
+        const current = await runner("launchctl", ["print", target]);
+        assertQueryable(current);
+        if (current.exitCode === 113)
+            return;
+        // bootout returns while the job is SIGTERMed and still owns its installation lease.
+        // Wait for removal, not merely a non-running state, before installing or bootstrapping.
+        if (Date.now() >= deadline) {
+            throw new Error(`launchd service '${spec.id}' did not unload within ${DARWIN_STOP_TIMEOUT_MS}ms`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, DARWIN_STOP_POLL_MS));
+    }
+}
 function sameWindowsPath(left, right) {
     return left !== undefined
         && left.replaceAll("/", "\\").toLowerCase() === right.replaceAll("/", "\\").toLowerCase();
@@ -356,9 +384,7 @@ export async function uninstallService(spec, runner = systemCommandRunner) {
     }
     if (spec.platform === "darwin") {
         const status = await serviceStatus(spec, runner);
-        if (status.loaded) {
-            await checked(runner, "launchctl", ["bootout", `${spec.managerDomain}/${spec.id}`], "launchd bootout");
-        }
+        await stopLaunchdService(spec, status, runner);
     }
     else {
         const disable = await runner("systemctl", ["--user", "disable", "--now", spec.id]);
@@ -385,8 +411,7 @@ export async function serviceAction(spec, action, runner = systemCommandRunner)
                 await checked(runner, "launchctl", ["bootstrap", spec.managerDomain, spec.descriptorPath], "launchd start");
         }
         else if (action === "stop") {
-            if (status.loaded)
-                await checked(runner, "launchctl", ["bootout", target], "launchd stop");
+            await stopLaunchdService(spec, status, runner);
         }
         else {
             if (status.loaded)

package/dist/console.js

@@ -9,8 +9,8 @@
  * 会附带结构化 payload(diff/命令/todo 清单/计划…),供前端做富渲染(红绿 diff、清单勾选);
  * 前端不识别 payload.kind 时降级为纯文本行,协议向后兼容。
  *
- * 覆盖三种 runtime 的流:claude(stream-json)、codex(exec --json 的 item.* 事件)、
- * kimi(OpenAI 消息风格行)。
+ * 覆盖 runtime 的流:claude(stream-json)、codex(exec --json 的 item.* 事件)、
+ * kimi(OpenAI 消息风格行)、ACP 适配器与 Pi 适配器(pi.* 块级事件)。
  */
 import { detectDaemonLang, translateDaemon } from "./i18n.js";
 import { buildFilePreview, buildSnippetDiff } from "./console-payload.js";
@@ -280,6 +280,21 @@ export function toConsoleLines(event, runtime) {
         const text = typeof e.content === "string" ? e.content.trim() : "";
         return text ? [{ stream: "tool_result", text: clip(text, TOOL_RESULT_CAP) }] : [];
     }
+    if (e.type === "pi.text" && e.text)
+        return [{ stream: "text", text: e.text }];
+    if (e.type === "pi.thinking" && e.text)
+        return [{ stream: "thinking", text: e.text }];
+    if (e.type === "pi.tool_call") {
+        return [{ stream: "tool", text: e.title ? `⏺ ${clip(e.title, TOOL_INPUT_CAP)}` : "⏺ Pi tool" }];
+    }
+    if (e.type === "pi.tool_result") {
+        const text = typeof e.content === "string" ? e.content.trim() : "";
+        return text ? [{ stream: e.is_error ? "error" : "tool_result", text: clip(text, TOOL_RESULT_CAP) }] : [];
+    }
+    if (e.type === "pi.error") {
+        const message = event.message;
+        return typeof message === "string" && message.trim() ? [{ stream: "error", text: message.trim() }] : [];
+    }
     if (e.type === "system" && e.subtype === "init") {
         return [{ stream: "system", text: `● ${td("Claude Code session started")}` }];
     }

package/dist/execution-journal-lock.js

@@ -3,10 +3,25 @@ import { renameSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { join, resolve } from "node:path";
 import { z } from "zod";
+const ProtectedGroupSchema = z.object({ pid: z.number().int().positive(), processIdentity: z.string().min(1) }).strict();
+export async function inspectProtectedProcessGroup(pid) {
+    try {
+        process.kill(-pid, 0);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return false;
+        if (error.code === "EPERM")
+            return true;
+        throw error;
+    }
+}
 const OwnerSchema = z.object({
     pid: z.number().int().positive(),
     processIdentity: z.string().min(1),
     token: z.string().uuid(),
+    protectedGroup: ProtectedGroupSchema.optional(),
 }).strict();
 export class JournalLockedError extends Error {
     journalPath;
@@ -144,7 +159,8 @@ export async function inspectJournalLock(options) {
         let inspection;
         try {
             const identity = await options.inspectIdentity(owner.pid);
-            inspection = identity === owner.processIdentity
+            const protectedAlive = owner.protectedGroup !== undefined && await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(owner.protectedGroup.pid);
+            inspection = identity === owner.processIdentity || protectedAlive
                 ? {
                     status: "owned",
                     ownerPid: owner.pid,
@@ -333,7 +349,9 @@ export function createJournalLease(options) {
                 if (observed === null)
                     continue;
                 const identity = await options.inspectIdentity(observed.owner.pid);
-                if (identity === observed.owner.processIdentity) {
+                const protectedAlive = observed.owner.protectedGroup !== undefined
+                    && await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(observed.owner.protectedGroup.pid);
+                if (identity === observed.owner.processIdentity || protectedAlive) {
                     throw new JournalLockedError(`Execution journal is locked by process ${observed.owner.pid}`, { journalPath, ownerPid: observed.owner.pid });
                 }
                 await options.hooks?.beforeRemoveObservedOwner?.(observed.owner);
@@ -408,6 +426,9 @@ export function createJournalLease(options) {
             status = "closed";
             return;
         }
+        if (lease.owner.protectedGroup && await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(lease.owner.protectedGroup.pid)) {
+            throw new JournalLockedError("Protected maintenance process group is still alive", { journalPath, ownerPid: lease.owner.protectedGroup.pid });
+        }
         status = "closing";
         lease.releasing = true;
         await awaitAbortable((async () => {
@@ -426,8 +447,36 @@ export function createJournalLease(options) {
         status = "closed";
         void cleanupReleasedDirectory(releasedDirectory);
     };
+    const protectProcessGroup = async (raw) => {
+        const group = ProtectedGroupSchema.parse(raw);
+        const lease = registry.get(options.directory);
+        if (!attached || status !== "open" || !lease || lease.releasing || lease.refs !== 1)
+            throw new JournalLockedError("Lease cannot protect a worker", { journalPath });
+        await validateInstalledOwner(lease);
+        if (await options.inspectIdentity(group.pid) !== group.processIdentity
+            || !await (options.inspectProcessGroup ?? inspectProtectedProcessGroup)(group.pid))
+            throw new JournalLockedError("Worker identity is absent", { journalPath });
+        if (lease.owner.protectedGroup) {
+            if (JSON.stringify(lease.owner.protectedGroup) === JSON.stringify(group))
+                return;
+            throw new JournalLockedError("Lease already protects a worker", { journalPath });
+        }
+        const owner = { ...lease.owner, protectedGroup: group };
+        const temp = join(options.directory, `.journal-owner.${lease.owner.token}.${randomUUID()}.tmp`);
+        try {
+            await fileSystem.writeDurableFile(temp, `${JSON.stringify(owner)}\n`);
+            await fileSystem.rename(temp, join(lockDirectory, lease.ownerFile));
+            lease.owner = owner;
+            await options.syncDirectory(lockDirectory);
+            await options.syncDirectory(options.directory);
+        }
+        finally {
+            await fileSystem.rm(temp, { force: true }).catch(() => undefined);
+        }
+    };
     return {
         acquire,
+        protectProcessGroup,
         assertUsable: () => {
             if (status !== "open") {
                 throw new JournalLockedError(`Execution journal lease is ${status}`, { journalPath });

package/dist/execution-protocol.js

@@ -207,6 +207,8 @@ export const ExecutionStartSchema = z.object({
         model: z.string().optional(),
         reasoning: ReasoningSchema.optional(),
         timeoutMs: z.number().int().positive().optional(),
+        // Server-owned policy; 0 disables the total runtime timer. Capability-gated.
+        taskTimeoutMs: z.number().int().min(0).max(2_145_600_000).optional(),
     }).strict(),
     permissions: z.object({
         requested: PermissionSchema,

package/dist/execution-runner.js

@@ -416,7 +416,7 @@ export async function runExecution(config, input, dependencies) {
         return { kind: "rejected", frame };
     }
     const { permission } = checked;
-    const effectiveTimeoutMs = spec.runtime.timeoutMs ?? config.executionLimits.maxTimeoutMs;
+    const effectiveTimeoutMs = spec.runtime.taskTimeoutMs ?? spec.runtime.timeoutMs ?? config.executionLimits.maxTimeoutMs;
     const accepted = await dependencies.journal.accept(spec.executionId, specHash, {
         runtime: spec.runtime.name,
         ...(spec.runtime.model === undefined ? {} : { model: spec.runtime.model }),
@@ -492,6 +492,7 @@ export async function runExecution(config, input, dependencies) {
     let timeout;
     let timedOut = false;
     let firstOutputTimer;
+    let runtimeTimersStarted = false;
     let firstOutputTimedOut = false;
     let abandonedRuntimeRunningCompletion = null;
     let completion;
@@ -617,7 +618,8 @@ export async function runExecution(config, input, dependencies) {
                 if (dependencies.cancellation?.isRequested())
                     return;
                 const cancel = runtimeCancel;
-                if (cancel !== null && timeout === undefined && !dependencies.cancellation?.isRequested()) {
+                if (cancel !== null && !runtimeTimersStarted && !dependencies.cancellation?.isRequested()) {
+                    runtimeTimersStarted = true;
                     const firstOutputDeadline = config.executionLimits.maxFirstOutputWaitMs
                         + config.executionLimits.firstOutputGraceMs;
                     firstOutputTimer = setTimeout(() => {
@@ -629,15 +631,16 @@ export async function runExecution(config, input, dependencies) {
                             rejectCancellationFailure(error);
                         }
                     }, firstOutputDeadline);
-                    timeout = setTimeout(() => {
-                        timedOut = true;
-                        try {
-                            void cancel().catch(rejectCancellationFailure);
-                        }
-                        catch (error) {
-                            rejectCancellationFailure(error);
-                        }
-                    }, effectiveTimeoutMs);
+                    if (effectiveTimeoutMs > 0)
+                        timeout = setTimeout(() => {
+                            timedOut = true;
+                            try {
+                                void cancel().catch(rejectCancellationFailure);
+                            }
+                            catch (error) {
+                                rejectCancellationFailure(error);
+                            }
+                        }, effectiveTimeoutMs);
                 }
                 dependencies.onRuntimePhase?.("running", spec.runtime.name);
                 const journalStartedAt = Date.now();
@@ -706,9 +709,11 @@ export async function runExecution(config, input, dependencies) {
                     catch { /* best-effort activity omitted when its envelope cannot fit */ }
                 },
             } : {}),
-            ...(spec.reporting.streamConsole ? {
+            ...(spec.reporting.streamConsole || credential.observability ? {
                 onConsole: (chunk) => {
-                    if (firstOutputTimer !== undefined) {
+                    if (!spec.reporting.streamConsole && chunk.payload?.kind !== "agent_observation")
+                        return;
+                    if (chunk.payload?.kind !== "agent_observation" && firstOutputTimer !== undefined) {
                         clearTimeout(firstOutputTimer);
                         firstOutputTimer = undefined;
                     }
@@ -856,6 +861,7 @@ export async function runExecution(config, input, dependencies) {
             return appendAgentMemoryContext(base, recalledMemory, Math.max(Buffer.byteLength(base, "utf8"), baseSystemPromptBudget - (context.reservedPromptBytes ?? 0)));
         };
         const localInput = {
+            ...(credential.observability ? { observability: credential.observability } : {}),
             executionId: spec.executionId,
             handle: spec.agent.handle,
             channelId: spec.context.channelId,

package/dist/host-execution-coordinator.js

@@ -302,6 +302,16 @@ export function createHostExecutionCoordinator(options = {}) {
             }
             let releasePromise = null;
             return {
+                protectProcessGroup: async (pid) => {
+                    const processIdentity = await defaultProcessController.inspectIdentity(pid);
+                    if (processIdentity === null)
+                        throw new Error("maintenance worker identity is absent");
+                    for (const lease of leases) {
+                        if (!lease.protectProcessGroup)
+                            throw new Error("lease process-group protection is unavailable");
+                        await lease.protectProcessGroup({ pid, processIdentity });
+                    }
+                },
                 release: () => {
                     if (releasePromise !== null)
                         return releasePromise;

package/dist/local-executor.js

@@ -46,6 +46,7 @@ import { commitLocalMemoryResultAfterExit, initializeLocalMemoryV2ForWorkspace,
 import { prepareLocalMemoryPrompt } from "./local-memory/prompt.js";
 import { reportLocalMemoryV2Deferred, resolveLocalMemoryV2Rollout } from "./local-memory/rollout.js";
 import { localMemoryV2Environment } from "./config.js";
+import { observationEnvironment, safeRuntimeObservation } from "./runtime-observation.js";
 export class RuntimeRunningCallbackTimeoutError extends Error {
     constructor(runtime, timeoutMs) {
         super(`${runtime} runtime-running callback timed out after ${timeoutMs}ms`);
@@ -592,7 +593,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 systemPromptPath: workspace.systemPromptPath,
                 systemPrompt: effectiveSystemPrompt,
                 wakePrompt,
-                env: runtimeEnv,
+                env: observationEnvironment(runtimeEnv, input.observability),
                 effectivePermission: input.effectivePermission,
                 ...(launchModel === undefined ? {} : { model: launchModel }),
                 ...(launchReasoning === undefined ? {} : { reasoning: launchReasoning }),
@@ -787,6 +788,12 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             const event = parseLine(line);
             if (!event)
                 return;
+            if (typeof event === "object" && "type" in event && event.type === "nowwork.observation") {
+                const payload = safeRuntimeObservation(event.observation, input.observability);
+                if (payload)
+                    callbacks.onConsole?.({ stream: "system", text: "", payload });
+                return;
+            }
             nativeThreadContext?.observe(event);
             localMemoryTelemetry?.observe(event);
             if (isRuntimeReadyEvent(runtime.name, event))

package/dist/machine-info.js

@@ -1,3 +1,5 @@
+import { RUNTIME_TOOL_UPDATES_CAPABILITY } from "./runtime-tool-update-protocol.js";
+import { MAINTENANCE_CAPABILITY } from "./marketplace-maintenance-protocol.js";
 import { retryHarnessProbe } from "./runtimes/harness-probe-retry.js";
 import { MARKETPLACE_CAPABILITY } from "./marketplace-protocol.js";
 /**
@@ -39,7 +41,10 @@ export const NATIVE_PROJECT_WORKSPACE_READINESS = Object.freeze({
     nativeRuntimeAdaptersReady: true,
 });
 export const DAEMON_CAPABILITIES = Object.freeze([
+    RUNTIME_TOOL_UPDATES_CAPABILITY,
+    "execution_task_timeout_v1",
     MARKETPLACE_CAPABILITY,
+    MAINTENANCE_CAPABILITY,
     "scheduled_job_v1",
     "reply_origin_v1",
     "origin_decision_v1",
@@ -72,7 +77,7 @@ export const daemonCapabilities = (runtimePlatform = process.platform, readiness
     const nativeWorkspaceReady = nativeWorkspacePlatform
         && readiness.resolverReady
         && readiness.nativeRuntimeAdaptersReady;
-    return Object.freeze(DAEMON_CAPABILITIES.filter((capability) => ((capability !== MARKETPLACE_CAPABILITY || nativeWorkspacePlatform)
+    return Object.freeze(DAEMON_CAPABILITIES.filter((capability) => (((capability !== MARKETPLACE_CAPABILITY && capability !== MAINTENANCE_CAPABILITY && capability !== RUNTIME_TOOL_UPDATES_CAPABILITY) || nativeWorkspacePlatform)
         && (capability !== PROJECT_WORKSPACES_CAPABILITY || nativeWorkspaceReady)
         && (capability !== "message_file_preview_v1" || nativeWorkspacePlatform)
         && (nativeWorkspacePlatform

package/dist/machine-runtime-environment.js

@@ -138,6 +138,7 @@ export function createMachineRuntimeEnvironment(options) {
     };
     return {
         provider,
+        refresh: refreshRuntimes,
         prewarm: () => {
             if (stopped || warmed)
                 return;

package/dist/managed-service-lifecycle.js

@@ -103,6 +103,16 @@ export async function installManagedService(input) {
             && record.daemonHome === input.record.daemonHome);
         if (registered !== undefined && sameManagedResource(registered, input.record)) {
             const current = await readServiceDescriptor(input.spec);
+            // Descriptor replacement and registry commit can be interrupted separately.
+            // Adopt only the exact requested descriptor with all resource fields intact.
+            if (current === requestedDescriptor) {
+                assertRecordDescribesSpec(input);
+                await ensureServiceEnabled(input.spec, input.runner);
+                await replace(services.map((record) => record === registered
+                    ? { ...record, descriptorSha256: expectedDescriptorHash }
+                    : record));
+                return;
+            }
             if (current === null || serviceDescriptorSha256(current) !== registered.descriptorSha256) {
                 throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
             }

package/dist/marketplace-controller.js

@@ -1,3 +1,4 @@
+import { MaintenanceRequestSchema, MaintenanceReportSchema } from "./marketplace-maintenance-protocol.js";
 import { MarketplaceRequestSchema, marketplaceActive } from "./marketplace-protocol.js";
 import { resolveMarketplaceScopes, runMarketplaceScope } from "./marketplace-runner.js";
 export function createMarketplaceController(deps) {
@@ -11,22 +12,31 @@ export function createMarketplaceController(deps) {
         const deadline = now() + 10 * 60_000;
         let lease = null;
         try {
-            const scopes = await (deps.resolve ?? resolveMarketplaceScopes)(request.targets, deps.agentsRoot);
+            const scopes = request.type === "marketplace:operation" ? await (deps.resolve ?? resolveMarketplaceScopes)(request.targets, deps.agentsRoot) : [];
             // 查询不使用任务执行槽；只有写入运行时共用市场/插件目录时才等待独占保护。
-            if (request.mode === "update") {
+            if (request.type === "marketplace:maintenance" || request.mode === "update") {
                 while (!stopped && now() < deadline && lease === null) {
                     lease = await deps.acquire();
                     if (!lease)
                         await wait();
                 }
                 if (!lease || stopped) {
-                    operations.set(id, { operationId: id, status: "failed", results: [], errorCode: "runtime_busy" });
+                    operations.set(id, { ...operations.get(id), status: "failed", errorCode: "runtime_busy" });
                     return;
                 }
             }
             if (stopped || now() >= deadline)
                 throw new Error("operation_deadline");
-            operations.set(id, { operationId: id, status: "running", results: [], errorCode: null });
+            operations.set(id, { ...operations.get(id), status: "running" });
+            if (request.type === "marketplace:maintenance") {
+                if (!deps.maintain)
+                    throw new Error("maintenance_unavailable");
+                const result = MaintenanceReportSchema.parse(await deps.maintain(request));
+                if (result.operationId !== id)
+                    throw new Error("operation_mismatch");
+                operations.set(id, result);
+                return;
+            }
             const results = [];
             for (const scope of scopes) {
                 if (stopped || now() >= deadline)
@@ -41,7 +51,9 @@ export function createMarketplaceController(deps) {
         }
         catch {
             const previous = operations.get(id);
-            operations.set(id, { ...previous, status: previous.results.some(x => !x.errorCode) ? "partial" : "failed", errorCode: "execution_failed" });
+            operations.set(id, request.type === "marketplace:maintenance"
+                ? { ...previous, status: "unknown", errorCode: "operation_unknown" }
+                : { ...previous, status: previous.results.some(x => !x.errorCode) ? "partial" : "failed", errorCode: "execution_failed" });
         }
         finally {
             try {
@@ -55,22 +67,23 @@ export function createMarketplaceController(deps) {
     };
     return {
         handle(raw) {
-            const parsed = MarketplaceRequestSchema.safeParse(raw);
+            const parsed = MarketplaceRequestSchema.or(MaintenanceRequestSchema).safeParse(raw);
             if (!parsed.success || stopped)
                 return { ok: false, error: "invalid_request" };
             const request = parsed.data;
+            const version = request.type === "marketplace:maintenance" ? { version: 2 } : {};
             const existing = operations.get(request.operationId);
             if (existing)
                 return { ok: true, data: existing };
             if (request.action === "status")
-                return { ok: true, data: { operationId: request.operationId, status: "unknown", results: [], errorCode: "operation_unknown" } };
+                return { ok: true, data: { ...version, operationId: request.operationId, status: "unknown", results: [], errorCode: "operation_unknown" } };
             if (process.platform !== "darwin" && process.platform !== "linux")
                 return { ok: false, error: "unsupported_platform" };
             if (current !== null || [...operations.values()].some(x => marketplaceActive(x.status)))
                 return { ok: false, error: "runtime_busy" };
             if (operations.size >= 100)
                 operations.delete(operations.keys().next().value);
-            const accepted = { operationId: request.operationId, status: "queued", results: [], errorCode: null };
+            const accepted = { ...version, operationId: request.operationId, status: "queued", results: [], errorCode: null };
             operations.set(request.operationId, accepted);
             current = execute(request).finally(() => { current = null; });
             return { ok: true, data: accepted };