@nowcrew/daemon 0.6.98-beta.6 → 0.6.98-beta.8

package/dist/marketplace-maintenance-bridge.js

@@ -0,0 +1,79 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { augmentedPath } from "./runtime-path.js";
+import { MaintenanceReportSchema } from "./marketplace-maintenance-protocol.js";
+export function maintenanceEnvironment(env) {
+    // Keep the machine user's login/config, never forward control-plane credentials.
+    return Object.fromEntries(Object.entries(env).filter(([key]) => !/^(CREW_|NOWCREW_|NOWWORK_)/i.test(key)));
+}
+async function supervise(file, id, cwd, env) {
+    await new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [file, "--run", id], { cwd, env, detached: true, stdio: "ignore" });
+        let expired = false;
+        const kill = () => { if (child.pid) {
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch { /* already gone */ }
+        } };
+        const timer = setTimeout(() => { expired = true; kill(); }, 18 * 60_000);
+        child.once("error", () => { clearTimeout(timer); kill(); reject(new Error("worker_failed")); });
+        child.once("close", code => {
+            clearTimeout(timer);
+            // Never release the machine lock while descendants can still write shared configuration.
+            kill();
+            if (expired || code !== 0)
+                reject(new Error("worker_failed"));
+            else
+                resolve();
+        });
+    });
+}
+export async function runMaintenanceBridge(config, request, acquireEnv) {
+    const fail = (errorCode) => ({ version: 2, operationId: request.operationId, status: "failed", results: [], errorCode });
+    let dir;
+    let started = false;
+    try {
+        const response = await fetch(`${config.serverUrl.replace(/\/+$/, "")}/machine/marketplace-maintenance/${request.operationId}/runner/${request.plan.runner.releaseId}`, {
+            headers: { authorization: `Bearer ${config.machineToken}` }, redirect: "error", signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            return fail("runner_unavailable");
+        // Bound even a malformed server response before buffering or executing it.
+        if (!response.body)
+            return fail("runner_unavailable");
+        const chunks = [];
+        let bytes = 0;
+        for await (const chunk of response.body) {
+            bytes += chunk.length;
+            if (bytes > 256_000)
+                return fail("runner_unavailable");
+            chunks.push(chunk);
+        }
+        const content = Buffer.concat(chunks);
+        if (createHash("sha256").update(content).digest("hex") !== request.plan.runner.sha256)
+            return fail("runner_unavailable");
+        const env = maintenanceEnvironment(await acquireEnv());
+        env.PATH = augmentedPath(env, {}, process.platform, "append");
+        dir = await mkdtemp(join(tmpdir(), "nowwork-maintenance-"));
+        const file = join(dir, "runner.mjs");
+        await writeFile(file, content, { mode: 0o600 });
+        started = true;
+        await supervise(file, request.operationId, dir, env);
+        const report = MaintenanceReportSchema.parse(JSON.parse(await readFile(join(dir, "report.json"), "utf8")));
+        if (report.operationId !== request.operationId)
+            throw new Error("operation_mismatch");
+        return report;
+    }
+    catch {
+        // A killed worker may have changed files: require readback/manual confirmation before another write.
+        return started ? { ...fail("operation_unknown"), status: "unknown" } : fail("runner_unavailable");
+    }
+    finally {
+        if (dir)
+            await rm(dir, { recursive: true, force: true });
+    }
+}

package/dist/marketplace-maintenance-protocol.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+// 与 daemon 同名文件逐字一致；这是独立于旧单插件协议的版本化契约。
+export const MAINTENANCE_CAPABILITY = "marketplace_codex_maintenance_v1";
+export const MaintenancePlanSchema = z.object({
+    marketplace: z.literal("nowwork-pm"),
+    actions: z.tuple([z.literal("install-missing"), z.literal("update-installed")]),
+    hosts: z.tuple([z.literal("claude"), z.literal("codex"), z.literal("pi")]),
+    runner: z.object({ releaseId: z.string().regex(/^[a-f0-9]{64}$/), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict(),
+}).strict();
+export const MaintenanceRequestSchema = z.discriminatedUnion("action", [
+    z.object({ type: z.literal("marketplace:maintenance"), action: z.literal("start"), operationId: z.string().uuid(), plan: MaintenancePlanSchema }).strict(),
+    z.object({ type: z.literal("marketplace:maintenance"), action: z.literal("status"), operationId: z.string().uuid() }).strict(),
+]);
+export const MaintenanceErrorSchema = z.enum(["runtime_busy", "execution_failed", "operation_unknown", "runner_unavailable",
+    "manager_missing", "cli_missing", "command_failed", "verification_failed", "source_conflict", "unsupported_platform"]);
+const Version = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._+-]{0,79}$/).nullable();
+export const MaintenanceResultSchema = z.object({
+    runtime: z.enum(["claude", "codex", "pi"]), plugin: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,127}$/).nullable(),
+    status: z.enum(["installed", "updated", "unchanged", "empty", "missing_cli", "failed"]),
+    beforeVersion: Version, afterVersion: Version, targetVersion: Version,
+    activation: z.enum(["reload_required", "not_changed", "unverified"]), errorCode: MaintenanceErrorSchema.nullable(),
+}).strict();
+export const MaintenanceReportSchema = z.object({
+    version: z.literal(2), operationId: z.string().uuid(),
+    status: z.enum(["queued", "running", "completed", "partial", "failed", "unknown"]),
+    results: z.array(MaintenanceResultSchema).max(1500), errorCode: MaintenanceErrorSchema.nullable(),
+}).strict().superRefine((r, ctx) => {
+    const keys = r.results.map(x => `${x.runtime}:${x.plugin}`);
+    if (new Set(keys).size !== keys.length)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "Duplicate plugin result" });
+    for (const x of r.results) {
+        if (["installed", "updated", "unchanged"].includes(x.status) && (!x.plugin || !x.targetVersion || x.targetVersion !== x.afterVersion || x.errorCode)) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: "Successful plugin result requires a verified target version" });
+        }
+    }
+    if (r.status === "completed" && (r.errorCode || ["claude", "codex", "pi"].some(host => !r.results.some(x => x.runtime === host))
+        || r.results.some(x => x.errorCode || x.status === "failed" || x.status === "missing_cli"))) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "Completion requires verified coverage of every host" });
+    }
+});

package/dist/marketplace-serve.js

@@ -1,7 +1,9 @@
+import { runMaintenanceBridge } from "./marketplace-maintenance-bridge.js";
 import { createMarketplaceController } from "./marketplace-controller.js";
 import { prepareDaemonRestart } from "./daemon-updater.js";
-export function createServeMarketplace(config, localSlots, hostCoordinator) {
+export function createServeMarketplace(config, localSlots, hostCoordinator, acquireEnv = async () => ({ ...process.env })) {
     const controller = createMarketplaceController({ agentsRoot: config.agentsRoot,
+        maintain: request => runMaintenanceBridge(config, request, acquireEnv),
         acquire: async () => {
             // Marketplace updates can mutate shared Codex/Claude homes across profiles.
             const local = await prepareDaemonRestart({ localSlots });
@@ -29,7 +31,7 @@ export function createServeMarketplace(config, localSlots, hostCoordinator) {
         } });
     return {
         handle(raw, send) {
-            if (!raw || typeof raw !== "object" || !("type" in raw) || raw.type !== "marketplace:operation")
+            if (!raw || typeof raw !== "object" || !("type" in raw) || (raw.type !== "marketplace:operation" && raw.type !== "marketplace:maintenance"))
                 return false;
             const { reqId, ...request } = raw;
             if (typeof reqId === "string")

package/dist/project-skills/execution-projection.js

@@ -85,11 +85,10 @@ export async function materializeExecutionProjection(input) {
                 continue;
             let projected;
             try {
-                // `projectDirectory`'s symlink path never lstats the source (POSIX symlink() happily
-                // creates a dangling link), so a source that vanished between scan and materialize would
-                // otherwise be silently projected as a broken link instead of failing loudly.
-                const sourceExists = await lstat(record.sourcePath).then(() => true, () => false);
-                if (!sourceExists)
+                // 源路径已由 reconciler 解析;拒绝解析后消失、变成文件或被替换为链接的目录。
+                // POSIX symlink() 本身允许断链,不能用“创建链接成功”代替源目录检查。
+                const source = await lstat(record.sourcePath).catch(() => null);
+                if (!source?.isDirectory() || source.isSymbolicLink())
                     throw new ExecutionProjectionError("link_failed");
                 projected = await project(record.sourcePath, join(root.codexSkillRoot, record.skillName), platform);
             }

package/dist/project-skills/reconciler.js

@@ -1,13 +1,14 @@
 /**
  * Project Skill 解析 + 执行编排。
- * reconcile: server 同步绑定时只解析"哪些 skill 在本机可用",不碰磁盘。
+ * reconcile: server 同步绑定时只读取"哪些 skill 在本机可用",不写入投影。
  * prepareAndLaunch: 为这一次 execution 建独占投影目录 → 启动 runtime → 进程树确认退出后删除。
  * 没有共享目录,所以没有锁、租约、manifest、GC。ownership 未确认时目录保留,交给启动 sweep。
  */
-import { lstat, stat } from "node:fs/promises";
+import { stat } from "node:fs/promises";
 import { join, resolve, sep } from "node:path";
 import { ExecutionProjectionError, materializeExecutionProjection, removeExecutionProjection, } from "./execution-projection.js";
 import { projectSkillResolutionRecords } from "./scanner.js";
+import { resolveProjectSkillDirectory } from "./source-directory.js";
 import { compareProjectSkillRefs, } from "./types.js";
 export class ProjectProjectionError extends Error {
     code;
@@ -46,16 +47,14 @@ const canonicalConflictFreeBindings = (bindings) => {
     }
     return Object.freeze(unique);
 };
-/** 源目录必须是真实目录且有 SKILL.md,否则按 missing 处理(warning,不阻断)。 */
+/** 每次从扫描入口解析真实目录,固定本次执行的链接目标;不可用则 warning,不阻断。 */
 const actualResolutionRecords = async (bindings, projects, platform) => Object.freeze(await Promise.all(projectSkillResolutionRecords(bindings, projects, platform).map(async (record) => {
     if (record.mode === "missing" || record.sourcePath === null)
         return record;
-    const [source, skillFile] = await Promise.all([
-        lstat(record.sourcePath).catch(() => null),
-        stat(join(record.sourcePath, "SKILL.md")).catch(() => null),
-    ]);
-    if (source?.isDirectory() === true && !source.isSymbolicLink() && skillFile?.isFile() === true) {
-        return record;
+    const directory = await resolveProjectSkillDirectory(record.sourcePath);
+    const skillFile = directory === null ? null : await stat(join(directory, "SKILL.md")).catch(() => null);
+    if (directory !== null && skillFile?.isFile() === true) {
+        return Object.freeze({ ...record, sourcePath: directory });
     }
     return Object.freeze({
         projectId: record.projectId,

package/dist/project-skills/scanner.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { compareProjectSkillRefs, isProjectSkillName, MAX_MACHINE_PROJECT_SKILLS, MAX_PROJECT_SKILL_DESCRIPTION_LENGTH, MAX_PROJECT_SKILL_FILE_BYTES, MAX_PROJECT_SKILLS_PER_PROJECT, } from "./types.js";
 import { parseSkillFrontmatter } from "../skill-frontmatter.js";
 import { normalizeProjectSkillResolutionRecords } from "./resolution-records.js";
+import { resolveProjectSkillDirectory } from "./source-directory.js";
 const unavailable = (projectId, scannedAt, errorCode) => Object.freeze({
     inventory: Object.freeze({
         projectId,
@@ -45,10 +46,15 @@ export async function scanProject(project, now = () => new Date()) {
     let invalidSkillCount = 0;
     const candidates = [];
     for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-        if (entry.name.startsWith(".") || !entry.isDirectory())
+        if (entry.name.startsWith(".") || (!entry.isDirectory() && !entry.isSymbolicLink()))
             continue;
         const sourcePath = join(skillsRoot, entry.name);
-        const skillPath = join(sourcePath, "SKILL.md");
+        const directory = await resolveProjectSkillDirectory(sourcePath);
+        if (directory === null) {
+            invalidSkillCount += 1;
+            continue;
+        }
+        const skillPath = join(directory, "SKILL.md");
         const skillStat = await stat(skillPath).catch(() => null);
         if (!skillStat?.isFile() || skillStat.size > MAX_PROJECT_SKILL_FILE_BYTES) {
             invalidSkillCount += 1;
@@ -70,6 +76,7 @@ export async function scanProject(project, now = () => new Date()) {
             invalidSkillCount += 1;
             continue;
         }
+        // 保留入口:执行前重新解析,才能识别链接删除或改指。
         candidates.push(Object.freeze({ name, description, sourcePath }));
     }
     const counts = new Map();

package/dist/project-skills/source-directory.js

@@ -0,0 +1,13 @@
+import { lstat, realpath } from "node:fs/promises";
+/** 跟随用户放置的源链接;只在本次操作中使用真实目录,不把它缓存为扫描入口。 */
+export async function resolveProjectSkillDirectory(sourcePath) {
+    try {
+        const directory = await realpath(sourcePath);
+        const info = await lstat(directory);
+        return info.isDirectory() && !info.isSymbolicLink() ? directory : null;
+    }
+    catch {
+        // 断链、循环或权限不足只使这个 Skill 不可用,不影响其它 Skill。
+        return null;
+    }
+}

package/dist/runtime-observation.js

@@ -0,0 +1,219 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+export const OBSERVABILITY_ENV = "NOWWORK_OBSERVABILITY_POLICY";
+export const ObservabilityPolicySchema = z.object({
+    version: z.literal(1), captureId: z.string().min(1).max(128),
+    contentMode: z.enum(["metadata", "redacted"]),
+}).strict();
+const Id = z.string().min(1).max(200);
+const Count = z.number().int().nonnegative().safe();
+export const RuntimeObservationSchema = z.object({
+    kind: z.literal("agent_observation"), version: z.literal(1), captureId: z.string().min(1).max(128),
+    sourceEventIndex: z.number().int().positive().safe(),
+    runtime: z.enum(["codex", "claude", "kimi", "hermes", "deepseek-harness", "opencode", "pi"]),
+    observationId: Id, parentObservationId: Id.optional(), nativeSessionId: Id.optional(),
+    nativeTurnId: Id.optional(), nativeCallId: Id.optional(),
+    type: z.enum(["agent", "tool", "generation", "event", "span", "retriever"]),
+    phase: z.enum(["start", "end", "event"]), name: z.string().min(1).max(200),
+    observedAt: z.string().datetime({ offset: true }), status: z.enum(["ok", "error"]).optional(),
+    input: z.string().max(8192).optional(), output: z.string().max(8192).optional(), inputBytes: Count.optional(), outputBytes: Count.optional(), model: z.string().min(1).max(200).optional(),
+    usage: z.object({ inputTokens: Count.optional(), outputTokens: Count.optional(), cacheReadTokens: Count.optional(),
+        cacheCreationTokens: Count.optional(), reasoningTokens: Count.optional(), costUsd: z.number().finite().nonnegative().optional() }).strict().optional(),
+    usageScope: z.enum(["generation", "turn", "execution"]).optional(),
+    unavailable: z.array(z.string().min(1).max(120)).max(30).optional(), truncated: z.boolean().optional(),
+    expectedCount: z.number().int().nonnegative().safe().optional(), dropped: z.number().int().nonnegative().safe().optional(),
+}).strict().superRefine((event, ctx) => {
+    if (event.name === "capture.summary") {
+        if (event.phase !== "event" || event.type !== "event" || event.expectedCount === undefined
+            || event.sourceEventIndex !== event.expectedCount + 1)
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: "Invalid capture summary" });
+    }
+    else if (event.expectedCount !== undefined || event.dropped !== undefined) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "Only capture summary carries counts" });
+    }
+});
+export function parseObservabilityPolicy(raw) {
+    const parsed = ObservabilityPolicySchema.safeParse(raw);
+    return parsed.success ? parsed.data : undefined;
+}
+export function observationPolicyFromEnvironment(env) {
+    try {
+        return parseObservabilityPolicy(JSON.parse(env[OBSERVABILITY_ENV] ?? "null"));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** 最后应用，清掉继承/用户配置中的同名变量，旧执行默认关闭。 */
+export function observationEnvironment(env, policy) {
+    const clean = Object.fromEntries(Object.entries(env).filter(([key]) => key.toUpperCase() !== OBSERVABILITY_ENV));
+    const parsed = parseObservabilityPolicy(policy);
+    return parsed ? { ...clean, [OBSERVABILITY_ENV]: JSON.stringify(parsed) } : clean;
+}
+const REDACTED = "[REDACTED]";
+// 与 Server 保持相同的边界规则；原 env/spec 不能先进入本地 journal 再由 Server 清洗。
+const normalizeKey = (key) => key.toLowerCase().replace(/[^a-z0-9]/gu, "");
+const forbiddenContainer = (key) => /^(?:env|envvars|runtimeenv|childenv|inheritedenv|environmentvariables|processenv|environmentplan|spec|executionspec|runtimeconfig|providerconfig)$/u.test(normalizeKey(key));
+const sensitiveKey = (key) => /(?:apikey|accesskey(?:id)?|secretkey|secret|password|passwd|token|authorization|cookie|credential|privatekey|signature)$/u.test(normalizeKey(key))
+    || /^(?:key|sig|session|auth|authkey|authstring)$/u.test(normalizeKey(key));
+function clip(value, limit) {
+    const end = value.charCodeAt(limit - 1);
+    return value.slice(0, end >= 0xd800 && end <= 0xdbff ? limit - 1 : limit);
+}
+function cleanUrl(raw) {
+    try {
+        const url = new URL(raw);
+        if (url.username || url.password) {
+            url.username = REDACTED;
+            url.password = "";
+        }
+        for (const name of [...url.searchParams.keys()]) {
+            if (sensitiveKey(name) || /^(?:code|ticket|sessionid|sas)$/iu.test(name) || /^(?:x-amz-|x-oss-|x-goog-)/iu.test(name))
+                url.searchParams.set(name, REDACTED);
+        }
+        if (url.hash && /(?:token|secret|password|credential|key|signature)/iu.test(url.hash))
+            url.hash = REDACTED;
+        return url.toString();
+    }
+    catch {
+        return REDACTED;
+    }
+}
+export function redactObservationText(value) {
+    const urls = [];
+    const text = value.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"'`]+/giu, raw => {
+        const index = urls.push(cleanUrl(raw)) - 1;
+        return `__NOWWORK_TRACE_URL_${index}__`;
+    });
+    return text
+        .replace(/-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/gu, REDACTED)
+        .replace(/\b(?:sk|pk)[-_]lf[-_][A-Za-z0-9_-]+\b/gu, REDACTED)
+        .replace(/\b(?:sk[-_][A-Za-z0-9_-]{6,}|gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,}|npm_[A-Za-z0-9]{12,})\b/gu, REDACTED)
+        .replace(/\b(authorization\s*[:=]\s*)(?:(?:bearer|basic)\s+)?[^\r\n,;]+/giu, `$1${REDACTED}`)
+        .replace(/((?:[A-Za-z0-9_]*(?:api[_-]?key|access[_-]?key|secret|password|passwd|token|cookie|credential|signature)|\b(?:key|session))\s*["']?\s*[:=]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;}]+)/giu, `$1${REDACTED}`)
+        .replace(/(\/\/[^\s"'`]+\/:_auth(?:token)?\s*=)\s*[^\s"'`]+/giu, `$1${REDACTED}`)
+        .replace(/__NOWWORK_TRACE_URL_(\d+)__/gu, (_match, index) => urls[Number(index)] ?? REDACTED);
+}
+function safeIdentity(value) {
+    // 含敏感值的 ID 用稳定别名，不能把不同调用都改成同一个 [REDACTED]。
+    return redactObservationText(value) === value ? value : `redacted-id:${createHash("sha256").update(value).digest("hex")}`;
+}
+function content(value) {
+    let truncated = false;
+    let remaining = 2000;
+    const visit = (item, depth) => {
+        if (--remaining < 0 || depth > 12) {
+            truncated = true;
+            return "[TRUNCATED]";
+        }
+        if (typeof item === "string") {
+            const text = redactObservationText(item);
+            if (text.length > 8192)
+                truncated = true;
+            return clip(text, 8192);
+        }
+        if (item === null || typeof item === "number" || typeof item === "boolean")
+            return item;
+        if (Array.isArray(item)) {
+            if (item.length > 100)
+                truncated = true;
+            return item.slice(0, 100).map(child => visit(child, depth + 1));
+        }
+        if (typeof item === "object") {
+            const entries = Object.entries(item);
+            if (entries.length > 100)
+                truncated = true;
+            return Object.fromEntries(entries.slice(0, 100).map(([key, child]) => [redactObservationText(key), forbiddenContainer(key) || sensitiveKey(key)
+                    || (normalizeKey(key) === "environment" && typeof child === "object") ? REDACTED : visit(child, depth + 1)]));
+        }
+        return String(item);
+    };
+    let structured = value;
+    if (typeof value === "string" && /^[\s]*[\[{]/u.test(value)) {
+        try {
+            structured = JSON.parse(value);
+        }
+        catch { /* 不是完整JSON则走文本清洗 */ }
+    }
+    const safe = visit(structured, 0);
+    const text = typeof safe === "string" ? safe : JSON.stringify(safe);
+    return { text: clip(text, 8192), truncated: truncated || text.length > 8192 };
+}
+/** 校验与本地内容策略在进入现有 telemetry journal 前再执行一次。 */
+export function safeRuntimeObservation(raw, policy) {
+    if (!policy)
+        return undefined;
+    const result = RuntimeObservationSchema.safeParse(raw);
+    if (!result.success || result.data.captureId !== policy.captureId)
+        return undefined;
+    const { input, output, ...metadata } = result.data;
+    const cleanMetadata = { ...metadata, name: redactObservationText(metadata.name),
+        ...(metadata.model ? { model: redactObservationText(metadata.model) } : {}),
+        ...(metadata.unavailable ? { unavailable: metadata.unavailable.map(value => clip(redactObservationText(value), 120)) } : {}),
+        ...Object.fromEntries(["observationId", "parentObservationId", "nativeSessionId", "nativeTurnId", "nativeCallId"]
+            .flatMap(key => metadata[key] === undefined ? [] : [[key, safeIdentity(metadata[key])]])),
+    };
+    const inputContent = policy.contentMode === "redacted" && input !== undefined ? content(input) : undefined;
+    const outputContent = policy.contentMode === "redacted" && output !== undefined ? content(output) : undefined;
+    const safe = policy.contentMode === "metadata" ? cleanMetadata : {
+        ...cleanMetadata,
+        ...(inputContent ? { input: inputContent.text } : {}),
+        ...(outputContent ? { output: outputContent.text } : {}),
+        ...(inputContent?.truncated || outputContent?.truncated ? { truncated: true } : {}),
+    };
+    const checked = RuntimeObservationSchema.safeParse(safe);
+    return checked.success && Buffer.byteLength(JSON.stringify(checked.data)) <= 24 * 1024 ? checked.data : undefined;
+}
+/** 仅短命 runner 使用；不持久化、不联网、不影响业务事件流。 */
+export function createRuntimeObservationCapture(runtime, env = process.env, emit = event => { process.stdout.write(`${JSON.stringify(event)}\n`); }) {
+    const policy = observationPolicyFromEnvironment(env);
+    let index = 0;
+    let dropped = 0;
+    let finished = false;
+    const send = (fields, summary = false) => {
+        if (!policy || finished)
+            return;
+        if (!summary && index >= 20_000) {
+            dropped += 1;
+            return;
+        }
+        try {
+            const { input, output, ...metadata } = fields;
+            const bytes = (value) => Buffer.byteLength(typeof value === "string" ? value : JSON.stringify(value));
+            const inputText = policy.contentMode === "redacted" && input !== undefined ? content(input) : undefined;
+            const outputText = policy.contentMode === "redacted" && output !== undefined ? content(output) : undefined;
+            let candidate = {
+                ...metadata, kind: "agent_observation", version: 1, captureId: policy.captureId,
+                runtime, sourceEventIndex: index + 1, observedAt: fields.observedAt ?? new Date().toISOString(),
+                ...(input === undefined ? {} : { inputBytes: bytes(input) }), ...(output === undefined ? {} : { outputBytes: bytes(output) }),
+                ...(inputText ? { input: inputText.text } : {}), ...(outputText ? { output: outputText.text } : {}),
+                ...(inputText?.truncated || outputText?.truncated ? { truncated: true } : {}),
+            };
+            if (Buffer.byteLength(JSON.stringify(candidate)) > 24 * 1024) {
+                candidate = { ...candidate, ...(inputText ? { input: clip(inputText.text, 1500) } : {}),
+                    ...(outputText ? { output: clip(outputText.text, 1500) } : {}), truncated: true };
+            }
+            const safe = safeRuntimeObservation(candidate, policy);
+            if (!safe) {
+                dropped += 1;
+                return;
+            }
+            index += 1;
+            emit({ type: "nowwork.observation", observation: safe });
+        }
+        catch {
+            dropped += 1; /* 诊断永远不改变 runtime 结果 */
+        }
+    };
+    return {
+        enabled: policy !== undefined,
+        observe: fields => send(fields),
+        finish() {
+            if (finished)
+                return;
+            send({ observationId: "capture.summary", type: "event", phase: "event", name: "capture.summary",
+                expectedCount: index, dropped, ...(index === 0 ? { unavailable: ["runtime_events"] } : {}) }, true);
+            finished = true;
+        },
+    };
+}

package/dist/runtime-tool-update-bridge.js

@@ -0,0 +1,126 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { RuntimeToolResponseSchema } from "./runtime-tool-update-protocol.js";
+export function runtimeToolEnvironment(env) {
+    // Keep only machine identity and lookup settings. Never pass runtime/control-plane credentials or Node injection flags.
+    return Object.fromEntries(Object.entries(env).filter(([key]) => /^(PATH|HOME|USER|LOGNAME|SHELL|TMPDIR|TMP|TEMP|LANG|LC_[A-Z_]+|XDG_CONFIG_HOME|XDG_CACHE_HOME)$/u.test(key)));
+}
+async function readReport(dir) {
+    const file = join(dir, "report.json");
+    if ((await stat(file)).size > 256_000)
+        throw new Error("invalid_report");
+    return RuntimeToolResponseSchema.parse(JSON.parse(await readFile(file, "utf8")));
+}
+async function stopGroup(pid) {
+    if (!pid)
+        return true;
+    try {
+        process.kill(-pid, "SIGKILL");
+    }
+    catch (error) {
+        return error.code === "ESRCH";
+    }
+    const deadline = Date.now() + 3000;
+    while (Date.now() < deadline) {
+        try {
+            process.kill(-pid, 0);
+        }
+        catch (error) {
+            return error.code === "ESRCH";
+        }
+        await new Promise(resolve => setTimeout(resolve, 50));
+    }
+    return false;
+}
+export function createRuntimeToolProgressPoller(read, progress, intervalMs = 250) {
+    let active = true;
+    let pending = null;
+    const interval = setInterval(() => {
+        if (!active || pending || !progress)
+            return;
+        pending = read().then(async (data) => { if (active)
+            await progress(data); })
+            .catch(() => { }).finally(() => { pending = null; });
+    }, intervalMs);
+    return { async stop() { active = false; clearInterval(interval); await pending; } };
+}
+async function supervise(dir, env, start, progress, protectProcessGroup) {
+    const child = spawn(process.execPath, [join(dir, "runner.mjs"), "--managed-worker"], { cwd: dir, env, detached: true, stdio: ["ignore", "ignore", "ignore", "ipc"] });
+    const closed = new Promise(resolve => { child.once("error", () => resolve(null)); child.once("close", resolve); });
+    const polling = createRuntimeToolProgressPoller(() => readReport(dir), progress);
+    let expired = false;
+    const timer = setTimeout(() => { expired = true; void stopGroup(child.pid); }, start ? 12 * 60_000 : 120_000);
+    let launchFailed = false;
+    try {
+        if (start) {
+            if (!protectProcessGroup || !child.pid)
+                throw new Error("lease_protection_unavailable");
+            await protectProcessGroup(child.pid);
+        }
+        await new Promise((resolve, reject) => child.send({ type: "runtime-tools:go" }, error => error ? reject(error) : resolve()));
+    }
+    catch {
+        launchFailed = true;
+        await stopGroup(child.pid);
+    }
+    const code = await closed;
+    clearTimeout(timer);
+    await polling.stop();
+    // A successful parent exit does not prove its package-manager descendants stopped.
+    const stopped = await stopGroup(child.pid);
+    return { stopped, success: stopped && !expired && !launchFailed && code === 0 };
+}
+export async function runRuntimeToolBridge(config, request, acquireEnv, progress, deps = {}) {
+    let dir;
+    let started = false;
+    let processStopped = true;
+    const failure = (errorCode) => ({ processStopped, data: request.action === "start" ? { operation: {
+                operationId: request.operationId, state: started ? "unknown" : "failed", currentIndex: 0, targets: request.targets,
+                items: request.targets.map(t => ({ runtime: t.installation.runtime, state: started ? "unknown" : "failed", errorCode })),
+                updatedAt: new Date().toISOString(), errorCode,
+            } } : {} });
+    try {
+        const response = await (deps.fetch ?? fetch)(`${config.serverUrl.replace(/\/+$/, "")}/machine/runtime-tool-updates/runner/${request.runner.releaseId}`, {
+            headers: { authorization: `Bearer ${config.machineToken}` }, redirect: "error", signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok || !response.body)
+            return failure("runner_unavailable");
+        const chunks = [];
+        let bytes = 0;
+        for await (const chunk of response.body) {
+            bytes += chunk.length;
+            if (bytes > 512_000)
+                return failure("runner_unavailable");
+            chunks.push(chunk);
+        }
+        const content = Buffer.concat(chunks);
+        if (createHash("sha256").update(content).digest("hex") !== request.runner.sha256)
+            return failure("runner_unavailable");
+        const env = runtimeToolEnvironment(await acquireEnv());
+        dir = await mkdtemp(join(tmpdir(), "nowwork-runtime-update-"));
+        await writeFile(join(dir, "runner.mjs"), content, { mode: 0o600 });
+        await writeFile(join(dir, "request.json"), JSON.stringify(request), { mode: 0o600 });
+        started = true;
+        processStopped = false;
+        const outcome = await supervise(dir, env, request.action === "start", progress, deps.protectProcessGroup);
+        processStopped = outcome.stopped;
+        if (!outcome.success)
+            return failure("operation_unknown");
+        const data = await readReport(dir);
+        if (request.action === "start" && data.operation?.operationId !== request.operationId)
+            return failure("operation_unknown");
+        if (request.action === "inspect" && !data.snapshot)
+            return failure("inspection_failed");
+        return { data, processStopped };
+    }
+    catch {
+        return failure(started ? "operation_unknown" : "runner_unavailable");
+    }
+    finally {
+        if (dir && processStopped)
+            await rm(dir, { recursive: true, force: true });
+    }
+}