@nowcrew/daemon 0.6.98 → 0.6.99-beta.1

package/dist/computer-setup-existing.js

@@ -0,0 +1,154 @@
+import { access, readFile, readdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+import { resolveAutomaticInstallTarget } from "./automatic-install-target.js";
+import { stableDaemonEntry } from "./automatic-daemon-installer.js";
+import { resolveDaemonLocalHome } from "./daemon-local-home.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { isDaemonReleaseVersion } from "./daemon-release-version.js";
+import { listProfiles, loadProfile, profileIsPrivate, profilePath } from "./computer-profile.js";
+import { buildServiceSpec, captureExactService, systemCommandRunner, windowsProfileIsPrivate } from "./computer-service.js";
+import { buildManagedServiceRecord } from "./managed-service-lifecycle.js";
+import { managedServiceIdentityMatches, readManagedServiceRegistry } from "./managed-service-registry.js";
+import { serverUrlsMatch } from "./server-url.js";
+import { assertBootstrapMatches, localPathsMatch } from "./computer-setup-orchestration.js";
+const storageKeys = ["NOWWORK_HOME", "NOWWORK_ENV_TAG", "NOWWORK_STORAGE_POLICY_PATH", "NOWWORK_LOCAL_HOME", "NOWWORK_LOCAL_HOME_MODE"];
+const decodeXml = (value) => value.replaceAll(""", '"').replaceAll("'", "'")
+    .replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+// Only recover the generated environment fields; the rebuilt descriptor must still match byte-for-byte.
+function descriptorEnvironment(descriptor, platform) {
+    return Object.fromEntries(storageKeys.flatMap((key) => {
+        const value = platform === "darwin"
+            ? new RegExp(`<key>${key}</key><string>([^<]*)</string>`, "u").exec(descriptor)?.[1]
+            : new RegExp(`^Environment="${key}=((?:[^"\\\\]|\\\\.)*)"$`, "mu").exec(descriptor)?.[1];
+        return value === undefined ? [] : [[key, platform === "darwin" ? decodeXml(value) : value.replace(/\\(.)/gu, "$1").replaceAll("%%", "%")]];
+    }));
+}
+async function windowsNodePath(serviceId, runner) {
+    const script = "$ErrorActionPreference='Stop';$n=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]));"
+        + "$t=@(Get-ScheduledTask -ErrorAction Stop|Where-Object{$_.TaskPath -eq '\\' -and $_.TaskName -ceq $n});"
+        + "if($t.Count -ne 1){throw 'scheduled task identity unknown'};$a=@($t[0].Actions);"
+        + "if($a.Count -ne 1){throw 'scheduled task action unknown'};$a[0].Execute|ConvertTo-Json -Compress;";
+    const result = await runner("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script,
+        Buffer.from(serviceId, "utf16le").toString("base64")]);
+    const path = result.exitCode === 0 ? JSON.parse(result.stdout) : null;
+    if (typeof path !== "string" || !win32.isAbsolute(path))
+        throw new Error("Scheduled task executable unavailable");
+    return path;
+}
+/** One-shot inspection only. Never consumes credentials or changes local/service state. */
+export async function inspectExistingComputerSetup(input, client, options = {}) {
+    if (input.args.setupToken === undefined)
+        return { status: "unavailable" };
+    const platform = options.platform ?? process.platform;
+    const userHome = options.userHome ?? homedir();
+    const environment = options.environment ?? process.env;
+    const runner = options.runner ?? systemCommandRunner;
+    const paths = platform === "win32" ? win32 : posix;
+    try {
+        const requestedLocalHome = environment.NOWWORK_LOCAL_HOME;
+        const requestedLocalHomeMode = environment.NOWWORK_LOCAL_HOME_MODE ?? environment.NOWWORK_STORAGE_MODE;
+        const localOptions = {
+            ...(requestedLocalHome === undefined ? {} : { requestedLocalHome }),
+            ...(requestedLocalHomeMode === undefined ? {} : { requestedLocalHomeMode }),
+        };
+        const configuredHome = resolveDaemonLocalHome({ userHome, platform, profile: "in", mode: "nowwork",
+            ...(requestedLocalHome === undefined ? {} : { explicit: requestedLocalHome }) }).daemonHome;
+        const legacyRoot = paths.join(userHome, ".crew");
+        const legacyEntries = await readdir(legacyRoot, { withFileTypes: true }).catch((error) => {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        });
+        const homes = [...new Set([configuredHome, paths.join(userHome, ".nowwork", "config"),
+                ...legacyEntries.filter((entry) => entry.isDirectory() && /^daemon(?:-[a-z0-9_-]+)?$/u.test(entry.name))
+                    .map((entry) => paths.join(legacyRoot, entry.name))])];
+        const candidates = [];
+        for (const home of homes) {
+            for (const name of await listProfiles(home)) {
+                const privateProfile = platform === "win32"
+                    ? await windowsProfileIsPrivate(profilePath(name, home), runner)
+                    : await profileIsPrivate(name, home, platform);
+                if (!privateProfile)
+                    continue;
+                const profile = await loadProfile(name, home, { platform });
+                if (profile.name !== name || profile.machineId !== input.args.machineId || profile.workspaceId === undefined
+                    || !serverUrlsMatch(profile.serverUrl, input.serverUrl)
+                    || (input.args.workspace.kind === "id" && profile.workspaceId !== input.args.workspace.value))
+                    continue;
+                const target = resolveAutomaticInstallTarget({ serverUrl: input.serverUrl, requestedProfile: name,
+                    userHome, platform, ...localOptions });
+                if (!localPathsMatch(target.daemonHome, home, platform))
+                    continue;
+                if (profile.agentsRoot === undefined || !localPathsMatch(profile.agentsRoot, target.agentsRoot, platform))
+                    continue;
+                candidates.push({ profile, target });
+            }
+        }
+        if (candidates.length !== 1)
+            return { status: "unavailable" };
+        const { profile, target } = candidates[0];
+        const receipt = await client.receipt({ setupToken: input.args.setupToken, machineToken: profile.machineToken });
+        assertBootstrapMatches(receipt.target, input);
+        if (receipt.target.workspaceId !== profile.workspaceId || receipt.target.profile !== profile.name)
+            return { status: "unavailable" };
+        if (receipt.credentialState === "pending")
+            return { status: "pending" };
+        const connection = receipt.connection;
+        if (receipt.credentialState !== "finalized" || !receipt.connectionConfirmed || connection.status !== "online"
+            || !connection.credentialMatchesConnection || connection.epoch <= receipt.target.minimumConnectionEpoch
+            || connection.profile !== profile.name || connection.daemonHome === null || connection.agentsRoot === null
+            || !localPathsMatch(connection.daemonHome, target.daemonHome, platform)
+            || !localPathsMatch(connection.agentsRoot, target.agentsRoot, platform)
+            || (receipt.target.storageId !== undefined && receipt.target.storageId !== connection.storageId))
+            return { status: "unavailable" };
+        const localHome = paths.resolve(target.npmPrefix, "..", "..");
+        const entryPath = stableDaemonEntry(target, platform);
+        const installation = daemonGlobalInstallation(entryPath, platform);
+        if (installation === null)
+            return { status: "unavailable" };
+        await access(entryPath);
+        const packageJson = JSON.parse(await readFile(paths.join(installation.packageRoot, "package.json"), "utf8"));
+        if (!packageJson || typeof packageJson !== "object" || !("name" in packageJson) || packageJson.name !== "@nowcrew/daemon"
+            || !("version" in packageJson) || typeof packageJson.version !== "string" || !isDaemonReleaseVersion(packageJson.version))
+            return { status: "unavailable" };
+        const base = { platform, profile: profile.name, profileHome: target.daemonHome, userHome,
+            uid: options.uid ?? process.getuid?.(), entryPath };
+        let spec;
+        if (platform === "win32") {
+            const identity = buildServiceSpec({ ...base, nodePath: process.execPath, environment: {} });
+            const nodePath = await windowsNodePath(identity.id, runner);
+            await access(nodePath);
+            spec = buildServiceSpec({ ...base, nodePath, environment: {} });
+        }
+        else {
+            const records = (await readManagedServiceRegistry({ userHome, localHome })).filter((record) => record.profile === profile.name
+                && localPathsMatch(record.daemonHome, target.daemonHome, platform));
+            if (records.length !== 1)
+                return { status: "unavailable" };
+            const record = records[0];
+            await access(record.nodePath);
+            const descriptor = await readFile(record.descriptorPath, "utf8");
+            spec = buildServiceSpec({ ...base, nodePath: record.nodePath, entryPath: record.entryPath,
+                environment: descriptorEnvironment(descriptor, platform) });
+            const expected = buildManagedServiceRecord({ spec, daemonHome: target.daemonHome, agentsRoot: target.agentsRoot,
+                nodePath: record.nodePath, entryPath, ...installation });
+            if (!managedServiceIdentityMatches(record, expected))
+                return { status: "unavailable" };
+        }
+        const service = await captureExactService(spec, runner);
+        if (!service.installed || !service.exact || !service.running)
+            return { status: "unavailable" };
+        return { status: "connected", result: {
+                workspaceId: receipt.target.workspaceId, workspaceSlug: receipt.target.workspaceSlug, machineId: receipt.target.machineId,
+                environment: receipt.target.environment, profile: profile.name, daemonVersion: packageJson.version,
+                serviceId: spec.id, serviceStatus: "running", helloConfirmed: true, localNowworkHome: localHome,
+                daemonHome: target.daemonHome, agentsRoot: target.agentsRoot,
+                ...(connection.storageId === undefined ? {} : { storageId: connection.storageId }),
+            } };
+    }
+    catch {
+        // Failed inspection is not proof of installation, connection, or credential ownership.
+        return { status: "unavailable" };
+    }
+}

package/dist/computer-setup-orchestration.js

@@ -1,12 +1,14 @@
 import { computerSetupRecoveryGuidance, redactSetupSecrets, } from "./computer-setup-client.js";
+import { automaticDaemonInstallStageMessage } from "./automatic-daemon-installer.js";
+import { inspectExistingComputerSetup } from "./computer-setup-existing.js";
 import { isProductionServerHostname, serverUrlsMatch } from "./server-url.js";
 import { posix, win32 } from "node:path";
 import { resolveAgentsRoot } from "./computer-profile.js";
-function safeError(error, machineToken) {
-    const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), machineToken === undefined ? [] : [machineToken]);
-    return new Error(message, error instanceof Error ? { cause: error } : undefined);
+function safeError(error, machineToken, setupToken) {
+    const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), [machineToken ?? "", setupToken ?? ""]);
+    return new Error(message);
 }
-function assertBootstrapMatches(bootstrap, input) {
+export function assertBootstrapMatches(bootstrap, input) {
     if (bootstrap.machineId !== input.args.machineId) {
         throw new Error("setup bootstrap machine does not match --machine");
     }
@@ -40,7 +42,7 @@ function secondsUntil(expiresAt, now) {
     const remaining = Date.parse(expiresAt) - now();
     return Math.max(0, Math.ceil(remaining / 1_000));
 }
-function localPathsMatch(left, right, platform) {
+export function localPathsMatch(left, right, platform) {
     const paths = platform === "win32" ? win32 : posix;
     if (!paths.isAbsolute(left) || !paths.isAbsolute(right))
         return false;
@@ -51,6 +53,26 @@ function localPathsMatch(left, right, platform) {
     return normalize(left) === normalize(right);
 }
 async function obtainBootstrap(input, deps) {
+    if (input.args.setupToken !== undefined) {
+        deps.reportPairing("Checking computer connection information...");
+        const result = await deps.client.poll(input.args.setupToken);
+        if (result.status !== "authorized") {
+            deps.reportPairing("Checking the existing computer connection...");
+            const inspection = await (deps.inspectExistingSetup ?? ((candidate, client) => inspectExistingComputerSetup(candidate, client, {
+                ...(deps.platform === undefined ? {} : { platform: deps.platform }),
+                ...(deps.environment === undefined ? {} : { environment: deps.environment }),
+            })))(input, deps.client);
+            if (inspection.status === "connected") {
+                deps.reportPairing("This computer is already connected. No installation changes are needed.");
+                return inspection.result;
+            }
+            if (inspection.status === "pending") {
+                throw new Error("Setup is still in progress; check the original terminal and wait for it to finish");
+            }
+            throw new Error("Setup command expired or unavailable; regenerate it in NowWork and run the new command");
+        }
+        return result.bootstrap;
+    }
     const pairing = await deps.client.start({
         workspace: input.args.workspace,
         machineId: input.args.machineId,
@@ -112,11 +134,14 @@ export async function runComputerSetupOrchestration(input, deps) {
     };
     try {
         const authorized = await obtainBootstrap(input, deps);
+        if ("helloConfirmed" in authorized)
+            return authorized;
         const token = authorized.machineToken;
         bootstrap = authorized;
         machineToken = token;
         assertBootstrapMatches(authorized, input);
         const installation = await deps.installAutomatically({
+            onProgress: (stage) => deps.reportPairing(automaticDaemonInstallStageMessage[stage]),
             serverUrl: authorized.serverUrl,
             machineToken: token,
             workspaceId: authorized.workspaceId,
@@ -174,6 +199,7 @@ export async function runComputerSetupOrchestration(input, deps) {
         });
         return {
             workspaceId: authorized.workspaceId,
+            ...(authorized.workspaceSlug === undefined ? {} : { workspaceSlug: authorized.workspaceSlug }),
             machineId: authorized.machineId,
             environment: authorized.environment,
             profile: installation.profile,
@@ -198,6 +224,6 @@ export async function runComputerSetupOrchestration(input, deps) {
                     + `local recovery blocked. ${computerSetupRecoveryGuidance(bootstrap)}`, { cause: error });
             }
         }
-        throw safeError(error, machineToken);
+        throw safeError(error, machineToken, input.args.setupToken);
     }
 }

package/dist/computer-setup.js

@@ -1,11 +1,13 @@
 import { parseArgs } from "node:util";
 import { z } from "zod";
 import { DEFAULT_SERVER_URL } from "./config.js";
+import { MachineTokenSchema } from "./computer-profile.js";
 import { installDaemonAutomatically, } from "./automatic-daemon-installer.js";
 import { createComputerSetupClient, openSetupBrowser, redactSetupSecrets, } from "./computer-setup-client.js";
 import { runComputerSetupOrchestration, } from "./computer-setup-orchestration.js";
 import { detectDaemonLang, formatDaemonText } from "./i18n.js";
 import { systemCommandRunner } from "./computer-service.js";
+import { runMachineTokenSetup } from "./computer-token-setup.js";
 const WorkspaceSlugSchema = z.string()
     .min(2)
     .max(40)
@@ -70,6 +72,8 @@ export function parseSetupArgs(argv) {
     assertRepeatedOptionValuesAgree(argv, "machine", (value) => MachineIdSchema.parse(value).toLowerCase());
     assertRepeatedOptionValuesAgree(argv, "machine-id", (value) => MachineIdSchema.parse(value).toLowerCase());
     assertRepeatedOptionValuesAgree(argv, "server-url", normalizedServerOrigin);
+    assertRepeatedOptionValuesAgree(argv, "setup-token", (value) => value);
+    assertRepeatedOptionValuesAgree(argv, "api-key", (value) => value);
     const parsed = parseArgs({
         args: [...argv],
         allowPositionals: true,
@@ -82,6 +86,8 @@ export function parseSetupArgs(argv) {
             "server-url": { type: "string" },
             json: { type: "boolean", default: false },
             "no-browser": { type: "boolean", default: false },
+            "setup-token": { type: "string" },
+            "api-key": { type: "string" },
             help: { type: "boolean", short: "h", default: false },
         },
     });
@@ -124,6 +130,14 @@ export function parseSetupArgs(argv) {
     }
     const machineId = parsedMachine;
     const serverUrl = stringValue(values, "server-url");
+    const setupToken = stringValue(values, "setup-token");
+    const machineToken = stringValue(values, "api-key");
+    if (setupToken !== undefined && machineToken !== undefined)
+        throw new Error("Choose one setup credential source");
+    if (setupToken !== undefined && !/^[A-Za-z0-9_-]{32,512}$/u.test(setupToken))
+        throw new Error("Invalid setup Token");
+    if (machineToken !== undefined)
+        MachineTokenSchema.parse(machineToken);
     return Object.freeze({
         command: "setup",
         workspace,
@@ -131,6 +145,8 @@ export function parseSetupArgs(argv) {
         ...(serverUrl === undefined ? {} : { serverUrl: ServerUrlSchema.parse(serverUrl) }),
         ...(booleanValue(values, "json") ? { json: true } : {}),
         ...(booleanValue(values, "no-browser") ? { noBrowser: true } : {}),
+        ...(setupToken === undefined ? {} : { setupToken }),
+        ...(machineToken === undefined ? {} : { machineToken }),
     });
 }
 function resolveSetupServerUrl(args, env) {
@@ -148,7 +164,8 @@ export function setupUsage(td = (message) => message) {
         "  nowwork-computer setup --workspace /workspace --machine <uuid>",
         "  nowwork-computer setup --workspace-id <uuid> --machine-id <uuid>",
         "",
-        "Options: --server-url <url> --json --no-browser",
+        "Options: --server-url <url> --setup-token <token> --api-key <sk_machine_*> --json --no-browser",
+        td("Token setup does not require browser authorization. CREW_MACHINE_TOKEN is also supported."),
     ].join("\n") + "\n";
 }
 function defaults() {
@@ -167,6 +184,7 @@ function defaults() {
 }
 function humanSummary(result, td) {
     return [
+        td("Connected to {{workspace}}.", { workspace: result.workspaceSlug ?? result.workspaceId }),
         td("Workspace: {{value}}", { value: result.workspaceId }),
         td("Machine:   {{value}}", { value: result.machineId }),
         td("Environment: {{value}}", { value: result.environment }),
@@ -205,6 +223,7 @@ export async function runComputerSetupCommand(argv, overrides = {}) {
         return null;
     const deps = { ...defaults(), ...overrides };
     const lang = detectDaemonLang(deps.env);
+    const secrets = [...optionOccurrences(argv, "setup-token"), ...optionOccurrences(argv, "api-key"), deps.env.CREW_MACHINE_TOKEN ?? ""];
     try {
         if (argv.includes("--help") || argv.includes("-h")) {
             deps.stdout(setupUsage((message, values) => formatDaemonText(lang, message, values)));
@@ -213,32 +232,44 @@ export async function runComputerSetupCommand(argv, overrides = {}) {
         let args;
         try {
             args = parseSetupArgs(argv);
+            const envToken = deps.env.CREW_MACHINE_TOKEN?.trim();
+            if (envToken) {
+                if (args.setupToken !== undefined || (args.machineToken !== undefined && args.machineToken !== envToken)) {
+                    throw new Error("Choose one setup credential source; clear CREW_MACHINE_TOKEN when using another Token");
+                }
+                args = Object.freeze({ ...args, machineToken: MachineTokenSchema.parse(envToken) });
+            }
         }
         catch (error) {
-            deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+            deps.stderr(`nowwork-computer: ${formatDaemonText(lang, redactSetupSecrets(error.message, secrets))}\n`);
             return 2;
         }
-        if (args.json === true) {
+        if (args.json === true && args.setupToken === undefined && args.machineToken === undefined) {
             deps.stderr(`${formatDaemonText(lang, "Starting computer setup pairing...")}\n`);
         }
         const serverUrl = resolveSetupServerUrl(args, deps.env);
         const createClient = overrides.createClient
             ?? ((value) => createComputerSetupClient({ serverUrl: value, fetch: deps.fetch }));
-        const result = await runComputerSetupOrchestration({ args, serverUrl }, {
+        const orchestrationDeps = {
             client: createClient(serverUrl),
             installAutomatically: deps.installAutomatically,
             openBrowser: args.noBrowser === true ? async () => { } : deps.openBrowser,
             sleep: deps.sleep,
             reportPairing: (message) => deps[args.json === true ? "stderr" : "stdout"](`${localizedPairingMessage(lang, message)}\n`),
             now: deps.now,
-        });
+            platform: deps.platform,
+            environment: deps.env,
+        };
+        const result = args.machineToken === undefined
+            ? await runComputerSetupOrchestration({ args, serverUrl }, orchestrationDeps)
+            : await runMachineTokenSetup({ args, serverUrl }, orchestrationDeps, args.machineToken);
         deps.stdout(args.json === true
             ? `${JSON.stringify(result)}\n`
             : humanSummary(result, (message, values) => formatDaemonText(lang, message, values)));
         return 0;
     }
     catch (error) {
-        deps.stderr(`nowwork-computer: ${redactSetupSecrets(error.message)}\n`);
+        deps.stderr(`nowwork-computer: ${formatDaemonText(lang, redactSetupSecrets(error.message, secrets))}\n`);
         return 1;
     }
 }

package/dist/computer-token-setup.js

@@ -0,0 +1,46 @@
+import { automaticDaemonInstallStageMessage } from "./automatic-daemon-installer.js";
+import { assertBootstrapMatches, localPathsMatch } from "./computer-setup-orchestration.js";
+import { redactSetupSecrets } from "./computer-setup-client.js";
+export async function runMachineTokenSetup(input, deps, machineToken) {
+    try {
+        deps.reportPairing("Checking computer connection information...");
+        const target = await deps.client.tokenTarget(machineToken);
+        assertBootstrapMatches(target, input);
+        const installation = await deps.installAutomatically({
+            onProgress: (stage) => deps.reportPairing(automaticDaemonInstallStageMessage[stage]),
+            serverUrl: target.serverUrl, machineToken, workspaceId: target.workspaceId, machineId: target.machineId,
+            requestedProfile: target.profile,
+            ...(target.releaseTag === undefined ? {} : { requestedReleaseTag: target.releaseTag }),
+            ...(target.registryUrl === undefined ? {} : { requestedRegistryUrl: target.registryUrl }),
+            verifyAfterStart: async (candidate) => {
+                const deadline = deps.now() + 120_000;
+                for (;;) {
+                    const current = await deps.client.tokenTarget(machineToken);
+                    assertBootstrapMatches(current, input);
+                    const connection = current.connection;
+                    const platform = deps.platform ?? process.platform;
+                    if (connection.status === "online" && connection.epoch > target.minimumConnectionEpoch
+                        && connection.credentialMatchesConnection && current.environment === target.environment
+                        && connection.profile === candidate.profile
+                        && connection.daemonHome !== null && localPathsMatch(connection.daemonHome, candidate.daemonHome, platform)
+                        && connection.agentsRoot !== null && localPathsMatch(connection.agentsRoot, candidate.agentsRoot, platform)
+                        && (target.storageId === undefined || connection.storageId === target.storageId))
+                        return;
+                    if (deps.now() >= deadline)
+                        throw new Error("Timed out confirming the new computer connection");
+                    await deps.sleep(Math.min(2_000, Math.max(0, deadline - deps.now())));
+                }
+            },
+        });
+        return {
+            workspaceId: target.workspaceId, workspaceSlug: target.workspaceSlug, machineId: target.machineId,
+            environment: target.environment, profile: installation.profile, daemonVersion: installation.version,
+            serviceId: installation.serviceId, serviceStatus: "running", helloConfirmed: true,
+            localNowworkHome: installation.localHome, daemonHome: installation.daemonHome, agentsRoot: installation.agentsRoot,
+            ...(target.storageId === undefined ? {} : { storageId: target.storageId }),
+        };
+    }
+    catch (error) {
+        throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error), [machineToken]));
+    }
+}

package/dist/execution-journal.js

@@ -8,7 +8,7 @@ import { provePosixProcessGroupStopped } from "./execution-posix-stop-proof.js";
 export { JournalLockedError, JournalLockCorruptionError } from "./execution-journal-lock.js";
 const ExecutionIdSchema = z.string().uuid();
 const TimestampSchema = z.string().datetime({ offset: true });
-const RuntimeSchema = z.enum(["claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness", "pi"]);
+const RuntimeSchema = z.enum(["claude", "codex", "kimi", "hermes", "opencode", "deepseek-harness", "memory_migration", "pi"]);
 const RUNTIME_READY_SUFFIX = ".runtime-ready";
 const RawJournalEntrySchema = z.object({
     executionId: ExecutionIdSchema,
@@ -523,6 +523,8 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         }
     };
     const pruneInternal = async () => {
+        if (options.retainCompleted)
+            return;
         const protectedExecutionIds = new Set(options.protectedExecutionIds?.() ?? []);
         const entries = await readAll();
         const acknowledged = entries

package/dist/execution-protocol.js

@@ -319,7 +319,7 @@ const RawExecutionCompletedSchema = z.object({
     providerErrorCategory: ProviderErrorCategorySchema.optional(),
     providerHttpStatus: ProviderHttpStatusSchema.optional(),
     providerErrorCode: ProviderErrorCodeSchema.optional(),
-    runtime: RuntimeSchema,
+    runtime: z.union([RuntimeSchema, z.literal("memory_migration")]),
     model: z.string().optional(),
     resumed: z.boolean(),
     finalText: z.string().optional(),

package/dist/execution-runner.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { isLocalMemoryV2Enabled, localMemoryV2Environment, resolveReposRoot } from "./config.js";
+import { detectLocalMemoryStorageVersion } from "./local-memory/storage-format.js";
 import { DaemonToServerExecutionFrameSchema, ExecutionCompletedSchema, ExecutionRejectedSchema, ExecutionStartSchema, } from "./execution-protocol.js";
 import { JournalConflictError } from "./execution-journal.js";
 import { boundExecutionFrame } from "./execution-event-limit.js";
@@ -846,8 +847,9 @@ export async function runExecution(config, input, dependencies) {
         const localMemoryGuardInBase = localMemoryV2Environment(config.serverUrl) === "custom";
         const boundedSystemPrompt = (context) => {
             const enabled = context.workspace.localMemoryV2Enabled ?? localMemoryV2Enabled;
-            const systemPromptWithLocalFacts = withLocalExecutionFacts(`${spec.instructions.systemPrompt}${enabled && localMemoryGuardInBase ? renderLocalMemoryV2WriteGuard() : ""}`, baseSystemPromptBudget, {
+            const systemPromptWithLocalFacts = withLocalExecutionFacts(`${spec.instructions.systemPrompt}${enabled && localMemoryGuardInBase && detectLocalMemoryStorageVersion(context.workspace.memory) !== 2 ? renderLocalMemoryV2WriteGuard() : ""}`, baseSystemPromptBudget, {
                 ...(selfTraining ? { isolateLocalMemory: true } : {}),
+                memoryQuery: spec.instructions.wakePrompt,
                 collaborationTools: config.codexCollaborationTools && spec.runtime.name === "codex",
             });
             const base = typeof systemPromptWithLocalFacts === "string"
@@ -887,6 +889,7 @@ export async function runExecution(config, input, dependencies) {
                 serverUrl: config.serverUrl,
                 token: credential.token,
                 agentId: credential.agentId,
+                ...(dependencies.controlIdentity === undefined ? {} : dependencies.controlIdentity),
                 agentsRoot: config.agentsRoot,
                 reposRoot: resolveReposRoot(config.agentsRoot, config.reposRoot),
                 ...(config.qaReportRoot === undefined ? {} : { qaReportRoot: config.qaReportRoot }),

package/dist/i18n.js

@@ -36,6 +36,22 @@ const zh = {
     "Code {{code}}": "验证码 {{code}}",
     "Browser open skipped: {{reason}}": "未能自动打开浏览器：{{reason}}",
     "Starting computer setup pairing...": "正在发起电脑接入授权…",
+    "Token setup does not require browser authorization. CREW_MACHINE_TOKEN is also supported.": "Token 接入无需浏览器授权，也支持 CREW_MACHINE_TOKEN。",
+    "Checking computer connection information...": "正在检查接入信息…",
+    "Checking the existing computer connection...": "正在检查已有电脑连接…",
+    "Downloading the Daemon package...": "正在下载 Daemon 安装包…",
+    "Configuring the Daemon service...": "正在配置 Daemon 服务…",
+    "Starting the Daemon service...": "正在启动 Daemon 服务…",
+    "This computer is already connected. No installation changes are needed.": "此电脑已经连接，无需修改安装。",
+    "Setup is still in progress; check the original terminal and wait for it to finish": "接入仍在进行中，请查看原来的终端并等待接入完成。",
+    "Downloading, installing, and starting the Daemon service...": "正在下载、安装并启动 Daemon 服务…",
+    "Confirming the computer connection...": "正在确认电脑连接…",
+    "Connected to {{workspace}}.": "已接入 {{workspace}}。",
+    "Setup command expired or unavailable; regenerate it in NowWork and run the new command": "接入命令已过期或不可用，请在 NowWork 重新生成并执行新命令。",
+    "Timed out confirming the new computer connection": "确认新连接超时，请检查网络和服务状态。",
+    "Invalid setup Token": "接入 Token 无效。",
+    "Choose one setup credential source": "请只使用一种接入凭据。",
+    "Choose one setup credential source; clear CREW_MACHINE_TOKEN when using another Token": "请只使用一种接入凭据；使用其他 Token 时请清除 CREW_MACHINE_TOKEN。",
     "Workspace: {{value}}": "工作区：{{value}}",
     "Machine:   {{value}}": "机器：   {{value}}",
     "Environment: {{value}}": "环境：{{value}}",

package/dist/local-execution-prompt.js

@@ -2,8 +2,9 @@
  * 本机执行提示词的合成与预算裁剪。
  *
  * server 提示词是权威部分,绝不裁剪;项目工作区提示词是绑定执行的强制部分,放不下就直接失败;
- * 只有本机事实(CREW_HOME / work-log / MEMORY 注入)是可选增强,按整段丢弃或按字节截断。
+ * 本机事实与旧格式预览可按预算省略；schema2身份和置顶规则必须保留，放不下则拒绝执行。
  */
+import { detectLocalMemoryStorageVersion } from "./local-memory/storage-format.js";
 import { buildCollaborationToolsPrompt, buildRuntimeWorkspacePrompt, capMemoryForInject, capWorkLogForInject, } from "./prompt.js";
 const trainingProjectJson = (project) => JSON.stringify({
     repositoryKey: project.repositoryKey,
@@ -57,10 +58,14 @@ export function withLocalExecutionFacts(serverPrompt, maxBytes, options = {}) {
         }
         const remaining = maxBytes - requiredBytes - Math.max(0, reservedPromptBytes);
         const factsBytes = Buffer.byteLength(localFacts, "utf8");
-        if (factsBytes > remaining)
+        if (factsBytes > remaining) {
+            if (!options.isolateLocalMemory && detectLocalMemoryStorageVersion(workspace.memory) === 2) {
+                throw new Error("local_memory_identity_budget_exceeded");
+            }
             return `${serverPrompt}${collaborationPrompt}${mandatoryWorkspacePrompt}`;
+        }
         const memoryHeading = "\n\n## Injected MEMORY.md (bounded local context)\n";
-        const memory = options.isolateLocalMemory ? "" : capMemoryForInject(workspace.memory, undefined, remaining - factsBytes - Buffer.byteLength(memoryHeading, "utf8"));
+        const memory = options.isolateLocalMemory ? "" : capMemoryForInject(workspace.memory, undefined, remaining - factsBytes - Buffer.byteLength(memoryHeading, "utf8"), options.memoryQuery);
         const memorySection = memory === "" ? "" : memoryHeading + memory;
         const workLogSection = workLog === "" ? "" : `\n\n## Injected work-log (bounded local context)\n${workLog}`;
         const workLogBudget = remaining - factsBytes - Buffer.byteLength(memorySection, "utf8");