@runweave/server-linux-x64 0.1.7 → 0.1.9

package/payload/plugins/toolkit/skills/daily-record/scripts/job_isolation.py

@@ -0,0 +1,69 @@
+"""Retire legacy browsing inputs without replaying unknown work writes."""
+import copy
+from pathlib import Path
+from job_state import require, read, write, binding, process_identity, digest
+
+
+def blocked_scope(value):
+    return any(value.startswith(p) for p in ("browser:", "materials:", "browse:"))
+
+
+def assert_payload(payload):
+    require(not payload.get("materialResults") and not any(
+        any(blocked_scope(s) for s in day.get("requestedScopes", [])) or
+        any(ref.get("channel") in ("browser-visit", "suiji-material") or blocked_scope(ref.get("sourceScope", ""))
+            for fact in day.get("facts", []) for ref in fact.get("sourceRefs", []))
+        for day in payload.get("days", [])), "BROWSING_IS_NOT_WORK: retire the old batch with isolate-work")
+
+
+def migrate(state, config_path, dry_run, suiji):
+    require(not (state.root / "source-migration.json").exists(), "FINISH_SOURCE_MIGRATION_FIRST")
+    journal = state.root / "work-isolation.json"
+    if journal.exists():
+        saved = read(journal)
+        require(saved["configPath"] == str(Path(config_path).resolve()), "ISOLATION_TARGET_CHANGED")
+        original_state = read(state.root / "before-work-isolation-state.json")
+        original_config = read(state.root / "before-work-isolation-config.json")
+        require(state.data.get("binding") in (saved["state"]["binding"], original_state["binding"]) and state.c in (saved["config"], original_config), "ISOLATION_IDENTITY_CHANGED")
+        if not dry_run:
+            write(state.file, saved["state"])
+            write(config_path, saved["config"])
+            state.data = saved["state"]
+        return {"dryRun": dry_run, "isolated": not dry_run, "newContextRequired": True}
+    updated = copy.deepcopy(state.data)
+    config = copy.deepcopy(state.c)
+    for key in ("browser", "materials"):
+        config["sources"].pop(key, None)
+    active = updated.get("active")
+    receipt = None
+    if active:
+        path = Path(updated["batches"][active]["path"])
+        meta = read(path / "batch.json")
+        require(process_identity(meta["ownerPid"]) != meta["ownerProcess"], "BUSY: original Agent is still active")
+        pending = meta.get("pending")
+        if pending:
+            original = read(pending["request"])
+            require(digest(original) == pending["hash"], "FROZEN_REQUEST_CHANGED")
+            connection = read(config["suiji"]["configPath"])
+            client, _ = suiji.connect(connection, config["suiji"]["tokenFile"])
+            # This endpoint compares the original immutable operation hash and returns no fact bodies.
+            receipt = client.call("get_work_import_receipt", {"idempotencyKey": original["arguments"]["idempotencyKey"], "input": original["arguments"]["input"]})
+        updated["batches"][active] = {**updated["batches"][active], "phase": "retired-browsing", "receipt": receipt}
+        updated["active"] = None
+    updated["identities"] = {key: value for key, value in updated["identities"].items()
+                             if not any(blocked_scope(a) for a in value.get("anchors", []))}
+    updated["forbiddenWorkThreads"] = updated.get("excludedThreads", [])
+    updated["workIsolationVersion"] = 1
+    updated["binding"] = binding(config)
+    for day in updated["days"].values():
+        day["receipts"] = [r for r in day.get("receipts", []) if not blocked_scope(r["sourceScope"])]
+        day["complete"] = bool(day["receipts"]) and all(r["status"] == "complete" for r in day["receipts"])
+    result = {"dryRun": dry_run, "retiredBatch": active, "retainedIdentities": len(updated["identities"]), "receipt": receipt, "newContextRequired": True}
+    if not dry_run:
+        write(state.root / "before-work-isolation-state.json", state.data)
+        write(state.root / "before-work-isolation-config.json", state.c)
+        write(journal, {"configPath": str(Path(config_path).resolve()), "state": updated, "config": config})
+        write(state.file, updated)
+        write(config_path, config)
+        state.data = updated
+    return result

package/payload/plugins/toolkit/skills/daily-record/scripts/job_materials.py

@@ -0,0 +1,154 @@
+"""Opt-in user supplied materials, with separate scan and consumption checkpoints."""
+import base64
+import copy
+import hashlib
+from pathlib import Path
+from job_state import directory, read, require, stamp, window, write, materials_enabled
+
+
+def client_for(c, suiji):
+    connection = read(c["suiji"]["configPath"])
+    client, info = suiji.connect(connection, c["suiji"]["tokenFile"])
+    require(info.get("features", {}).get("materials") and info.get("features", {}).get("workMaterials"), "MATERIALS_UNAVAILABLE")
+    require(c["sources"]["materials"]["accountScope"] == info["serverId"] + ":" + info["ownerId"], "MATERIAL_ACCOUNT_MISMATCH")
+    return client
+
+
+def scope(c):
+    return "materials:" + c["sources"]["materials"]["accountScope"]
+
+
+def reconcile(state, suiji):
+    if not materials_enabled(state.c):
+        return
+    client = client_for(state.c, suiji)
+    snapshot = copy.deepcopy(state.data.get("materials", {"cursor": None, "records": {}}))
+    cursor, changed = snapshot["cursor"], set()
+    while True:
+        page = client.call("list_changes", {"limit": 50, **({"cursor": cursor} if cursor else {})})
+        for item in page["items"]:
+            if item["kind"] == "followup_added":
+                continue
+            changed.add(item["recordId"])
+        require(page["nextCursor"] != cursor or not page["hasMore"], "MATERIAL_CHANGE_CURSOR_STUCK")
+        cursor = page["nextCursor"]
+        if not page["hasMore"]:
+            break
+    affected = set()
+    for record_id in sorted(changed):
+        old = snapshot["records"].get(record_id)
+        if old:
+            affected.add(old["material"]["materialDate"])
+        try:
+            record = client.call("get_record", {"recordId": record_id})["record"]
+        except suiji.Failure as error:
+            if str(error) != "NOT_FOUND":
+                raise
+            record = None
+        if record and record.get("material") and not record.get("deletedAt"):
+            snapshot["records"][record_id] = record
+            affected.add(record["material"]["materialDate"])
+        else:
+            snapshot["records"].pop(record_id, None)
+    snapshot["cursor"] = cursor
+    state.data["materials"] = snapshot
+    for day in affected:
+        if materials_enabled(state.c, day):
+            state.data["days"].setdefault(day, {})["complete"] = False
+    # Index and cursor commit atomically. Consumption is only confirmed after publish readback.
+    write(state.file, state.data)
+
+
+def rows(state, day, bundle, suiji):
+    client = client_for(state.c, suiji)
+    directory(bundle)
+    result, complete = [], True
+    for expected in state.data.get("materials", {}).get("records", {}).values():
+        if expected["material"]["materialDate"] != day:
+            continue
+        record = client.call("get_record", {"recordId": expected["id"]})["record"]
+        material = record.get("material")
+        require(material and not record.get("deletedAt") and material["sourceHash"] == expected["material"]["sourceHash"], "MATERIAL_VERSION_CHANGED: recollect")
+        images, image_error = [], False
+        for attachment in record["attachments"]:
+            if attachment["kind"] != "image":
+                # First release consumes image/text/link only. Do not claim an unread attachment.
+                image_error = True
+                continue
+            try:
+                value = client.call("read_attachment", {"attachmentId": attachment["id"]})
+                blocks = [b for b in value.get("content", []) if b.get("type") == "image"]
+                metadata = value.get("structuredContent", {})
+                require(len(blocks) == 1 and metadata.get("attachmentId") == attachment["id"], "MATERIAL_IMAGE_IDENTITY_MISMATCH")
+                data = base64.b64decode(blocks[0]["data"], validate=True)
+                sha = hashlib.sha256(data).hexdigest()
+                require(len(data) == attachment["byteSize"] and blocks[0]["mimeType"] == attachment["mimeType"] and metadata.get("sha256") == sha, "MATERIAL_IMAGE_CONTENT_MISMATCH")
+                path = bundle / (attachment["id"] + (".png" if attachment["mimeType"] == "image/png" else ".jpg"))
+                with path.open("wb") as stream:
+                    stream.write(data)
+                path.chmod(0o600)
+                images.append({"attachmentId": attachment["id"], "path": str(path), "sha256": sha})
+            except Exception:
+                image_error = True
+        current = client.call("get_record", {"recordId": record["id"]})["record"]
+        require(current.get("material", {}).get("sourceHash") == material["sourceHash"], "MATERIAL_VERSION_CHANGED: recollect")
+        complete = complete and not image_error
+        result.append({"id": "material:" + record["id"], "day": day, "role": "user", "text": record["body"],
+                       "anchor": scope(state.c) + ":" + record["id"], "project": None, "images": images, "imageError": image_error,
+                       "material": material, "ref": {"channel": "suiji-material", "sourceScope": scope(state.c),
+                       "nativeId": record["id"], "revision": str(record["version"]), "hash": material["sourceHash"]}})
+    return result, {"sourceScope": scope(state.c), "status": "complete" if complete else "partial", "collectedAt": stamp(), **window(day)}
+
+
+def acknowledge_image(path, meta, material, receipt_path):
+    """Executor calls only AFTER passing the actual image to its vision-capable model."""
+    require(material["ref"]["channel"] == "suiji-material" and material["images"], "IMAGE_MATERIAL_REQUIRED")
+    receipt = read(receipt_path)
+    require(set(receipt) == {"materialId", "sourceHash", "reader", "toolCallId", "images", "observation"}, "INVALID_IMAGE_READ_RECEIPT")
+    require(receipt["materialId"] == material["id"] and receipt["sourceHash"] == material["ref"]["hash"], "IMAGE_READ_VERSION_MISMATCH")
+    require(all(isinstance(receipt[k], str) and receipt[k].strip() for k in ("reader", "toolCallId", "observation")), "ACTUAL_VISION_READ_REQUIRED")
+    expected = [{"attachmentId": i["attachmentId"], "sha256": i["sha256"]} for i in material["images"]]
+    require(receipt["images"] == expected, "IMAGE_READ_IDENTITY_MISMATCH")
+    for item in material["images"]:
+        require(hashlib.sha256(Path(item["path"]).read_bytes()).hexdigest() == item["sha256"], "IMAGE_FILE_CHANGED")
+    meta.setdefault("imageReads", {})[material["id"]] = receipt
+    write(path / (material["ref"]["nativeId"] + "-image-read.json"), receipt)
+    return {"acknowledged": material["id"], "sourceHash": material["ref"]["hash"]}
+
+
+def results(materials, candidates, meta, exported):
+    source = {m["id"]: m for m in materials if m["ref"]["channel"] == "suiji-material"}
+    reviews = candidates.get("materialReviews", [])
+    require(isinstance(reviews, list) and len(reviews) == len(source) and {r.get("id") for r in reviews} == set(source), "REVIEW_EVERY_MATERIAL: include deferred when vision is unavailable")
+    output = []
+    for review in reviews:
+        require(set(review) == {"id", "outcome", "reason"} and review["outcome"] in ("included", "merged", "no-new-fact", "deferred") and isinstance(review["reason"], str) and review["reason"].strip(), "INVALID_MATERIAL_REVIEW")
+        m = source[review["id"]]
+        facts = [f for day in exported for f in day["facts"] if any(r["channel"] == "suiji-material" and r["nativeId"] == m["ref"]["nativeId"] for r in f["sourceRefs"])]
+        if review["outcome"] == "deferred":
+            require(not facts, "DEFERRED_MATERIAL_CANNOT_PROVE_FACT")
+            for day in exported:
+                if day["date"] == m["day"]:
+                    for r in day["receipts"]:
+                        if r["sourceScope"] == m["ref"]["sourceScope"]:
+                            r["status"] = "partial"
+            continue
+        require(not m["imageError"], "MATERIAL_ATTACHMENT_UNREAD")
+        if m["images"]:
+            receipt = meta.get("imageReads", {}).get(m["id"], {})
+            require(receipt.get("sourceHash") == m["ref"]["hash"], "ACTUAL_VISION_READ_REQUIRED: text read does not read images")
+            for image in m["images"]:
+                require(hashlib.sha256(Path(image["path"]).read_bytes()).hexdigest() == image["sha256"], "IMAGE_FILE_CHANGED")
+        require(bool(facts) == (review["outcome"] != "no-new-fact"), "MATERIAL_OUTCOME_FACT_MISMATCH")
+        output.append({"recordId": m["ref"]["nativeId"], "recordVersion": int(m["ref"]["revision"]), "sourceHash": m["ref"]["hash"],
+                       "outcome": review["outcome"], "eventKeys": sorted({f["eventKey"] for f in facts})})
+    return output
+
+
+def verify_versions(c, payload, suiji):
+    if not payload.get("materialResults"):
+        return
+    client = client_for(c, suiji)
+    for item in payload["materialResults"]:
+        record = client.call("get_record", {"recordId": item["recordId"]})["record"]
+        require(record.get("material", {}).get("sourceHash") == item["sourceHash"] and record["version"] == item["recordVersion"], "MATERIAL_VERSION_CHANGED: recollect before publishing")

package/payload/plugins/toolkit/skills/daily-record/scripts/job_screen.py

@@ -0,0 +1,77 @@
+"""Read a frozen, authenticated ScreenJournal export; never open the media store."""
+import datetime as dt
+import hashlib
+import json
+import subprocess
+from zoneinfo import ZoneInfo
+from job_state import Failure, digest, read, require, stamp, window
+
+
+def source_scope(c):
+    return "screen:" + c["producerId"] + ":" + c["sources"]["screen"]["expectedDeviceID"] + ":observed"
+
+
+def rows(bundle, day, c):
+    manifest = read(bundle / "manifest.json")
+    raw = (bundle / "export.json").read_bytes()
+    require(len(raw) <= 8 * 1024 * 1024 and hashlib.sha256(raw).hexdigest() == manifest["sha256"], "SCREEN_EXPORT_CHANGED")
+    value = json.loads(raw)
+    require(value["schemaVersion"] == 1 and value["deviceID"] == c["sources"]["screen"]["expectedDeviceID"] and value["day"] == day and value["timeZone"] == "Asia/Shanghai", "SCREEN_IDENTITY_MISMATCH")
+    require(value["revision"] == manifest["revision"] and value["snapshotID"] == manifest["snapshotID"] and not value.get("nextCursor"), "SCREEN_SNAPSHOT_INCOMPLETE")
+    canonical = dict(value, contentHash="")
+    expected_hash = hashlib.sha256(json.dumps(canonical, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    require(value.get("contentHash") == expected_hash, "SCREEN_CONTENT_HASH_MISMATCH")
+    require(value["coverage"] in ("complete", "partial", "unavailable"), "SCREEN_COVERAGE_INVALID")
+    result, seen = [], set()
+    for card in value["cards"]:
+        require(card["cardID"] not in seen and isinstance(card["revision"], int) and card["revision"] > 0, "SCREEN_CARD_IDENTITY_INVALID")
+        seen.add(card["cardID"])
+        require(card["evidenceIDs"] and card["spans"], "SCREEN_EVIDENCE_REQUIRED")
+        for span in card["spans"]:
+            for ms in (span["startMs"], span["endMs"]):
+                require(dt.datetime.fromtimestamp(ms / 1000, ZoneInfo("Asia/Shanghai")).date().isoformat() == day, "SCREEN_DAY_MISMATCH")
+        # Only facts and stable IDs cross the publish boundary. No JPEG, path,
+        # transient view ID or raw thread transcript is a source reference.
+        ref = {"channel": "screen-timeline", "sourceScope": source_scope(c), "nativeId": card["cardID"], "revision": str(card["revision"]), "hash": digest(card)}
+        result.append({"id": "screen:" + value["deviceID"] + ":" + card["cardID"], "day": day, "role": "observation", "text": json.dumps(card, ensure_ascii=False),
+                       "occurredAt": dt.datetime.fromtimestamp(min(span["startMs"] for span in card["spans"]) / 1000, dt.timezone.utc).isoformat(),
+                       "sourceVersion": str(card["revision"]) + ":" + ref["hash"],
+                       "anchor": source_scope(c) + ":" + card["matterID"], "project": None, "ref": ref})
+    receipt = {"sourceScope": source_scope(c), "status": value["coverage"], "collectedAt": stamp(), **window(day)}
+    return result, receipt, value["revision"]
+
+
+def unavailable(day, c):
+    return {"sourceScope": source_scope(c), "status": "unavailable", "collectedAt": stamp(), **window(day)}
+
+
+def export(c, day, bundle=None):
+    argv = c["sources"]["screen"]["exporterArgv"] + ["--day", day, "--json"]
+    if bundle is not None:
+        argv += ["--out", str(bundle)]
+    try:
+        result = subprocess.run(argv, capture_output=True, text=True, timeout=120 if bundle is not None else 10, check=False)
+    except (OSError, subprocess.TimeoutExpired):
+        require(False, "SCREEN_EXPORT_UNAVAILABLE")
+    require(result.returncode == 0 and len(result.stdout.encode()) <= 8 * 1024 * 1024, "SCREEN_EXPORT_UNAVAILABLE")
+    return json.loads(result.stdout)
+
+
+def reconcile_revisions(state):
+    # Called only after the original active/pending package is resolved.
+    today = dt.datetime.now(ZoneInfo("Asia/Shanghai")).date()
+    screen = state.c["sources"].get("screen", {})
+    if not screen.get("enabled"):
+        return
+    for offset in range(1, 8):
+        day = (today - dt.timedelta(days=offset)).isoformat()
+        old = state.data["days"].get(day)
+        if old is None or day < screen["effectiveFrom"]:
+            continue
+        try:
+            value = export(state.c, day)
+            require(value["deviceID"] == screen["expectedDeviceID"] and value["day"] == day and value["schemaVersion"] == 1, "SCREEN_IDENTITY_MISMATCH")
+            if old.get("screenRevision") != value["revision"]:
+                old["complete"] = False
+        except (OSError, ValueError, KeyError, subprocess.SubprocessError, Failure):
+            old["complete"] = False

package/payload/plugins/toolkit/skills/daily-record/scripts/job_state.py

@@ -0,0 +1,309 @@
+"""Private local state for the shared scheduled Daily Record workflow."""
+import datetime as dt
+import fcntl
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import tempfile
+import sys
+import copy
+import uuid
+from zoneinfo import ZoneInfo
+
+
+class Failure(Exception):
+    pass
+
+
+def require(ok, message):
+    if not ok:
+        raise Failure(message)
+
+
+def digest(value):
+    return hashlib.sha256(json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+
+
+def read(path):
+    path = Path(path)
+    require(not path.is_symlink() and path.is_file() and not path.stat().st_mode & 0o077, "PRIVATE_FILE_REQUIRED")
+    return json.loads(path.read_bytes())
+
+
+def write(path, value):
+    path = Path(path)
+    fd, name = tempfile.mkstemp(prefix=".daily-", dir=path.parent)
+    try:
+        with os.fdopen(fd, "wb") as stream:
+            stream.write((json.dumps(value, ensure_ascii=False, indent=2) + "\n").encode())
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(name, path)
+        descriptor = os.open(path.parent, os.O_RDONLY)
+        try:
+            os.fsync(descriptor)
+        finally:
+            os.close(descriptor)
+    finally:
+        if os.path.exists(name):
+            os.unlink(name)
+
+
+def directory(path):
+    path = Path(path)
+    require(not path.is_symlink(), "DIRECTORY_SYMLINK_REJECTED")
+    path.mkdir(mode=0o700, parents=True, exist_ok=True)
+    require(path.is_dir() and not path.stat().st_mode & 0o077, "PRIVATE_DIRECTORY_REQUIRED")
+    return path
+
+
+def date(value):
+    parsed = dt.date.fromisoformat(value)
+    require(parsed.isoformat() == value, "INVALID_DATE")
+    return parsed
+
+
+def today():
+    return dt.datetime.now(ZoneInfo("Asia/Shanghai")).date()
+
+
+def stamp():
+    return dt.datetime.now(dt.timezone.utc).isoformat()
+
+
+def window(day):
+    start = dt.datetime.combine(date(day), dt.time(), ZoneInfo("Asia/Shanghai"))
+    return {"from": start.isoformat(), "to": (start + dt.timedelta(days=1)).isoformat()}
+
+
+def exact(value, required, optional=()):
+    require(isinstance(value, dict) and set(required) <= set(value) and not set(value) - set(required) - set(optional), "INVALID_CONFIG_FIELDS")
+
+
+def scope(value):
+    require(isinstance(value, str) and re.fullmatch(r"[A-Za-z0-9_.:-]{1,120}", value), "INVALID_SCOPE")
+
+
+def config(path):
+    c = read(path)
+    exact(c, {"schemaVersion", "producerId", "sourceNamespace", "startDate", "timeZone", "stateDir", "collectorArgv", "sources", "projectAliases", "suiji"}, {"maxDaysPerRun"})
+    require(c["schemaVersion"] == 1 and c["timeZone"] == "Asia/Shanghai", "INVALID_JOB_VERSION_OR_TIMEZONE")
+    scope(c["producerId"])
+    scope(c["sourceNamespace"])
+    date(c["startDate"])
+    exact(c["sources"], {"localAgent", "feishu"}, {"browser", "screen", "materials"})
+    local, feishu = c["sources"]["localAgent"], c["sources"]["feishu"]
+    exact(local, {"providers"}, {"home"})
+    require(isinstance(local["providers"], list) and all(p in ("codex", "pi", "claude", "trae") for p in local["providers"]) and len(set(local["providers"])) == len(local["providers"]), "INVALID_PROVIDERS")
+    exact(feishu, {"enabled", "channels"}, {"accountScope"})
+    require(type(feishu["enabled"]) is bool and feishu["channels"] == "messages", "MESSAGES_ONLY")
+    if feishu["enabled"]:
+        scope(feishu.get("accountScope"))
+    browser = c["sources"].get("browser", {"enabled": False})
+    require(type(browser.get("enabled")) is bool, "INVALID_BROWSER_ENABLED")
+    if browser["enabled"]:
+        exact(browser, {"enabled", "effectiveFrom", "root", "collectorArgv", "expectedSourceIds"})
+        require(sys.platform == "darwin", "BROWSER_REQUIRES_MACOS")
+        date(browser["effectiveFrom"])
+        require(browser["effectiveFrom"] >= c["startDate"], "BROWSER_BEFORE_JOB_START")
+        require(isinstance(browser["root"], str) and Path(browser["root"]).is_absolute(), "ABSOLUTE_PATH_REQUIRED")
+        require(isinstance(browser["collectorArgv"], list) and browser["collectorArgv"] and all(isinstance(v, str) and v and "\0" not in v for v in browser["collectorArgv"]), "INVALID_BROWSER_ARGV")
+        ids = browser["expectedSourceIds"]
+        require(isinstance(ids, list) and ids and len(ids) == len(set(ids)) and all(isinstance(v, str) and str(uuid.UUID(v)) == v for v in ids), "INVALID_BROWSER_SOURCE_IDS")
+    else:
+        exact(browser, {"enabled"})
+        # Keep the original binding byte-for-byte for old/disabled configurations.
+        c["sources"].pop("browser", None)
+    screen = c["sources"].get("screen", {"enabled": False})
+    require(type(screen.get("enabled")) is bool, "INVALID_SCREEN_ENABLED")
+    if screen["enabled"]:
+        exact(screen, {"enabled", "effectiveFrom", "expectedDeviceID", "exporterArgv"})
+        require(sys.platform == "darwin", "SCREEN_REQUIRES_MACOS")
+        date(screen["effectiveFrom"])
+        require(screen["effectiveFrom"] >= c["startDate"], "SCREEN_BEFORE_JOB_START")
+        require(isinstance(screen["expectedDeviceID"], str) and str(uuid.UUID(screen["expectedDeviceID"])).lower() == screen["expectedDeviceID"].lower(), "INVALID_SCREEN_DEVICE")
+        argv = screen["exporterArgv"]
+        require(isinstance(argv, list) and argv and all(isinstance(v, str) and v and "\0" not in v for v in argv), "INVALID_SCREEN_ARGV")
+        require(argv[1:] == ["screen-recording", "analysis", "export", "--instance", "stable"], "SCREEN_EXPORTER_MUST_USE_STABLE")
+        require(Path(argv[0]).is_absolute(), "ABSOLUTE_PATH_REQUIRED")
+    else:
+        exact(screen, {"enabled"})
+        c["sources"].pop("screen", None)
+    materials = c["sources"].get("materials", {"enabled": False})
+    require(type(materials.get("enabled")) is bool, "INVALID_MATERIALS_ENABLED")
+    if materials["enabled"]:
+        exact(materials, {"enabled", "effectiveFrom", "accountScope"})
+        date(materials["effectiveFrom"])
+        require(materials["effectiveFrom"] >= c["startDate"], "MATERIALS_BEFORE_JOB_START")
+        connection = read(c["suiji"]["configPath"])
+        require(materials["accountScope"] == connection["serverId"] + ":" + connection["ownerId"], "MATERIAL_ACCOUNT_MISMATCH")
+    else:
+        exact(materials, {"enabled"})
+        c["sources"].pop("materials", None)
+    require(local["providers"] or feishu["enabled"] or (browser["enabled"] and browser["effectiveFrom"] == c["startDate"]) or (materials["enabled"] and materials["effectiveFrom"] == c["startDate"]), "NO_ENABLED_SOURCE_FOR_START_DATE")
+    require(isinstance(c["collectorArgv"], list) and c["collectorArgv"] and all(isinstance(v, str) and v and "\0" not in v for v in c["collectorArgv"]), "INVALID_COLLECTOR_ARGV")
+    exact(c["suiji"], {"configPath", "tokenFile", "autoPublish"})
+    require(type(c["suiji"]["autoPublish"]) is bool, "INVALID_AUTO_PUBLISH")
+    for value in [c["stateDir"], c["suiji"]["configPath"], c["suiji"]["tokenFile"]] + ([local["home"]] if "home" in local else []):
+        require(isinstance(value, str) and Path(value).is_absolute(), "ABSOLUTE_PATH_REQUIRED")
+    require(isinstance(c["projectAliases"], dict) and all(isinstance(k, str) and isinstance(v, str) and 0 < len(v.strip()) <= 80 and not any(ch in v for ch in "\r\n\t") for k, v in c["projectAliases"].items()), "INVALID_PROJECT_ALIASES")
+    c.setdefault("maxDaysPerRun", 7)
+    require(type(c["maxDaysPerRun"]) is int and 1 <= c["maxDaysPerRun"] <= 366, "INVALID_DAY_BUDGET")
+    scopes(c)
+    return c
+
+
+def browser_enabled(c, day=None):
+    browser = c["sources"].get("browser", {})
+    return bool(browser.get("enabled") and (day is None or day >= browser["effectiveFrom"]))
+
+
+def screen_enabled(c, day=None):
+    screen = c["sources"].get("screen", {})
+    return bool(screen.get("enabled") and (day is None or day >= screen["effectiveFrom"]))
+
+
+def materials_enabled(c, day=None):
+    value = c["sources"].get("materials", {})
+    return bool(value.get("enabled") and (day is None or day >= value["effectiveFrom"]))
+
+
+def binding(c):
+    connection = read(c["suiji"]["configPath"])
+    value = {k: c[k] for k in ("producerId", "sourceNamespace", "startDate", "sources")}
+    value["target"] = {k: connection[k] for k in ("endpoint", "serverId", "ownerId")}
+    return digest(value)
+
+
+def scopes(c, day=None):
+    values = ["agent:" + c["producerId"] + ":" + p for p in c["sources"]["localAgent"]["providers"]]
+    if c["sources"]["feishu"]["enabled"]:
+        values.append("feishu:" + c["sources"]["feishu"]["accountScope"] + ":messages")
+    if browser_enabled(c, day):
+        values.append("browser:" + c["producerId"] + ":observed")
+    if screen_enabled(c, day):
+        values.append("screen:" + c["producerId"] + ":" + c["sources"]["screen"]["expectedDeviceID"] + ":observed")
+    if materials_enabled(c, day):
+        values.append("materials:" + c["sources"]["materials"]["accountScope"])
+    for value in values:
+        scope(value)
+    return values
+
+
+def process_identity(pid):
+    try:
+        result = subprocess.run(["ps", "-p", str(pid), "-o", "lstart="], capture_output=True, text=True, timeout=5, check=False)
+        return result.stdout.strip() if result.returncode == 0 else None
+    except (OSError, subprocess.TimeoutExpired):
+        raise Failure("OWNER_CHECK_UNAVAILABLE") from None
+
+
+class State:
+    def __init__(self, c, migrating=False):
+        self.c = c
+        self.migrating = migrating
+        self.root = directory(Path(c["stateDir"]).resolve())
+        self.file = self.root / "state.json"
+        self.lock = None
+
+    def __enter__(self):
+        lock_path = self.root / "lock"
+        require(not lock_path.is_symlink(), "LOCK_SYMLINK_REJECTED")
+        self.lock = os.fdopen(os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600), "r+")
+        try:
+            fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            self.lock.close()
+            raise Failure("BUSY") from None
+        try:
+            expected = binding(self.c)
+            journal = self.root / "source-migration.json"
+            require(self.migrating or not journal.exists(), "SOURCE_MIGRATION_IN_PROGRESS: resume migrate-sources")
+            self.data = read(self.file) if self.file.exists() else {"schemaVersion": 1, "binding": expected, "days": {}, "identities": {}, "batches": {}, "excludedThreads": []}
+            self.original_digest = digest(self.data)
+            if not (self.migrating and (journal.exists() or (self.root / "work-isolation.json").exists())):
+                require(self.data.get("binding") == expected, "JOB_IDENTITY_OR_SOURCES_CHANGED")
+        except Exception:
+            self.lock.close()
+            raise
+        return self
+
+    def __exit__(self, kind, error, traceback):
+        try:
+            if hasattr(self, "data") and digest(self.data) != self.original_digest:
+                write(self.file, self.data)
+        finally:
+            self.lock.close()
+
+    def batch(self, args):
+        path = Path(args.batch).absolute()
+        require(not path.is_symlink() and path.resolve().parent == (self.root / "batches").resolve(), "INVALID_BATCH_PATH")
+        meta = read(path / "batch.json")
+        require(meta["id"] in self.data["batches"] and self.data["active"] == meta["id"], "BATCH_NOT_ACTIVE")
+        require(meta["runId"] == args.run_id and meta["generation"] == args.generation, "BATCH_OWNER_CHANGED")
+        if meta.get("identitySnapshot") is not None:
+            self.data["identities"] = meta["identitySnapshot"]
+        self.data["days"].update(meta.get("confirmations", {}))
+        return path, meta
+
+    def save_batch(self, path, meta):
+        write(path / "batch.json", meta)
+        self.data["batches"][meta["id"]] = {"phase": meta["phase"], "path": str(path), "days": meta["days"]}
+
+    def missing(self):
+        result = []
+        day = date(self.c["startDate"])
+        while day < today():
+            if not self.data["days"].get(day.isoformat(), {}).get("complete", False):
+                result.append(day.isoformat())
+            day += dt.timedelta(days=1)
+        return result
+
+
+def migrate_sources(state, current_path, next_path, dry_run):
+    """Journal one additive browser or screen source under the existing lock."""
+    target = str(Path(current_path).resolve())
+    next_c = config(next_path)
+    journal_path = state.root / "source-migration.json"
+    completed_path = state.root / "source-migration-completed.json"
+    if not journal_path.exists() and state.c == next_c and completed_path.exists():
+        completed = read(completed_path)
+        require(completed["configPath"] == target and completed["newConfig"] == next_c and state.data["binding"] == completed["newState"]["binding"], "MIGRATION_TARGET_CHANGED")
+        return {"dryRun": dry_run, "migrated": True, "alreadyApplied": True, "affectedDays": completed["affectedDays"]}
+
+    if journal_path.exists():
+        journal = read(journal_path)
+        require(journal["configPath"] == target and journal["newConfig"] == next_c, "MIGRATION_TARGET_CHANGED")
+        require(state.data["binding"] in (journal["oldBinding"], journal["newState"]["binding"]) and state.c in (journal["oldConfig"], journal["newConfig"]), "MIGRATION_IDENTITY_CHANGED")
+    else:
+        added = [name for name, enabled in (("browser", browser_enabled), ("screen", screen_enabled), ("materials", materials_enabled)) if enabled(next_c) and not enabled(state.c)]
+        require(len(added) == 1, "ADDITIVE_SOURCE_MIGRATION_ONLY")
+        source = added[0]
+        old_base, new_base = copy.deepcopy(state.c), copy.deepcopy(next_c)
+        new_base["sources"].pop(source)
+        require(old_base == new_base, "MIGRATION_MAY_ONLY_ADD_ONE_SOURCE")
+        require(not state.data.get("active") and all(b["phase"] == "confirmed" for b in state.data["batches"].values()), "ACTIVE_OR_PENDING_BATCH: recover it before migration")
+        updated = copy.deepcopy(state.data)
+        updated["binding"] = binding(next_c)
+        effective = next_c["sources"][source]["effectiveFrom"]
+        affected = [d for d in updated["days"] if d >= effective]
+        for day in affected:
+            updated["days"][day]["complete"] = False
+        journal = {"source": source, "configPath": target, "oldConfig": state.c, "newConfig": next_c, "oldBinding": state.data["binding"], "newState": updated, "affectedDays": affected}
+    source = journal.get("source", "browser")
+    result = {"dryRun": dry_run, "effectiveFrom": next_c["sources"][source]["effectiveFrom"], "affectedDays": journal["affectedDays"], "oldBinding": journal["oldBinding"], "newBinding": journal["newState"]["binding"]}
+    if dry_run:
+        return result
+    if not journal_path.exists():
+        write(state.root / ("before-" + source + "-config.json"), journal["oldConfig"])
+        write(state.root / ("before-" + source + "-state.json"), state.data)
+        write(journal_path, journal)
+    write(state.file, journal["newState"])
+    write(target, next_c)
+    state.data = journal["newState"]
+    state.original_digest = digest(state.data)
+    journal_path.rename(state.root / "source-migration-completed.json")
+    return {**result, "migrated": True}