@ddtcorex/dsh-maestro-supervisor 0.6.7 → 0.7.0

package/lib/cli.d.ts

@@ -1 +1,14 @@
+/**
+ * Copy a chosen LKG snapshot back into the DSH home. Recent snapshots are
+ * tried newest-first, skipping any that still carry a failing plugin so a
+ * broken bundle is not restored. `sessions/` is deliberately NOT restored —
+ * session logs are append-only truth and rolling them back to a snapshot
+ * would drop every turn recorded after that snapshot.
+ * @returns the rolled-back snapshot id.
+ */
+export declare function rollbackLKG(opts: {
+    dshHome: string;
+    lkgRoot: string;
+    failingPlugin?: string;
+}): Promise<string>;
 export declare function runCli(args: string[]): Promise<void>;

package/lib/cli.js

@@ -5,7 +5,76 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { resolveHarnessRoot, resolveDeepseekHarnessDir } from './paths.js';
-import { buildKillStalePortsCommand, isSelfCopyError, checkPlannedRestart, writePlannedRestart } from './restart-guards.js';
+import { buildKillStalePortsCommand, isSelfCopyError, checkPlannedRestart, writePlannedRestart, readRestartRequest, clearPlannedRestart } from './restart-guards.js';
+/**
+ * Copy a chosen LKG snapshot back into the DSH home. Recent snapshots are
+ * tried newest-first, skipping any that still carry a failing plugin so a
+ * broken bundle is not restored. `sessions/` is deliberately NOT restored —
+ * session logs are append-only truth and rolling them back to a snapshot
+ * would drop every turn recorded after that snapshot.
+ * @returns the rolled-back snapshot id.
+ */
+export async function rollbackLKG(opts) {
+    const { dshHome, lkgRoot, failingPlugin } = opts;
+    const entries = fs.existsSync(lkgRoot) ? fs.readdirSync(lkgRoot).sort() : [];
+    if (!entries.length)
+        throw new Error('no LKG to rollback to');
+    const candidates = [...entries].reverse().slice(0, 3);
+    let chosen;
+    for (const cand of candidates) {
+        if (!failingPlugin) {
+            chosen = cand;
+            break;
+        }
+        try {
+            const pkgPath = path.join(lkgRoot, cand, 'profiles/web/package.json');
+            if (!fs.existsSync(pkgPath)) {
+                chosen = cand;
+                break;
+            }
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            const bundles = pkg?.dsh?.profile?.bundles ?? [];
+            const deps = pkg?.dependencies ?? {};
+            const hasFailing = bundles.some((b) => b.includes(failingPlugin)) || Object.keys(deps).some(k => k.includes(failingPlugin));
+            if (!hasFailing) {
+                chosen = cand;
+                break;
+            }
+            console.log(`[supervisor] skipping LKG ${cand} still contains failing plugin ${failingPlugin}`);
+        }
+        catch {
+            chosen = cand;
+            break;
+        }
+    }
+    const target = chosen ?? entries[entries.length - 1];
+    const src = path.join(lkgRoot, target);
+    for (const entry of fs.readdirSync(src)) {
+        if (entry === 'manifest.json')
+            continue;
+        if (entry === 'sessions') {
+            console.log('[supervisor] rollback keeps live sessions (append-only truth) — skipping sessions/');
+            continue;
+        }
+        const srcPath = path.join(src, entry);
+        const destPath = path.join(dshHome, entry);
+        try {
+            // Skip if src and dest are the same file (e.g. symlink to same target like ~/.dsh/AGENTS.md)
+            try {
+                if (fs.existsSync(srcPath) && fs.existsSync(destPath) && fs.realpathSync(srcPath) === fs.realpathSync(destPath))
+                    continue;
+            }
+            catch { }
+            fs.cpSync(srcPath, destPath, { recursive: true, force: true });
+        }
+        catch (e) {
+            if (isSelfCopyError(String(e?.message ?? '')))
+                continue;
+            throw e;
+        }
+    }
+    return target;
+}
 export async function runCli(args) {
     const cmd = args[2] ?? '--help';
     if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
@@ -108,10 +177,6 @@ Commands:
             },
             rollback: async () => {
                 const { execSync } = await import('node:child_process');
-                const entries = fs.existsSync(lkgRoot) ? fs.readdirSync(lkgRoot).sort() : [];
-                if (!entries.length)
-                    throw new Error('no LKG to rollback to');
-                // Try newest to oldest (up to 3) to find a clean LKG for plugin failures
                 // Extract failing plugin from current log tail if possible
                 let failingPlugin;
                 try {
@@ -121,56 +186,7 @@ Commands:
                         failingPlugin = m[0].replace(/^@ddtcorex\//, '');
                 }
                 catch { }
-                const candidates = [...entries].reverse().slice(0, 3);
-                let chosen;
-                for (const cand of candidates) {
-                    if (!failingPlugin) {
-                        chosen = cand;
-                        break;
-                    }
-                    try {
-                        const pkgPath = path.join(lkgRoot, cand, 'profiles/web/package.json');
-                        if (!fs.existsSync(pkgPath)) {
-                            chosen = cand;
-                            break;
-                        }
-                        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-                        const bundles = pkg?.dsh?.profile?.bundles ?? [];
-                        const deps = pkg?.dependencies ?? {};
-                        const hasFailing = bundles.some((b) => b.includes(failingPlugin)) || Object.keys(deps).some(k => k.includes(failingPlugin));
-                        if (!hasFailing) {
-                            chosen = cand;
-                            break;
-                        }
-                        console.log(`[supervisor] skipping LKG ${cand} still contains failing plugin ${failingPlugin}`);
-                    }
-                    catch {
-                        chosen = cand;
-                        break;
-                    }
-                }
-                const target = chosen ?? entries[entries.length - 1];
-                const src = path.join(lkgRoot, target);
-                for (const entry of fs.readdirSync(src)) {
-                    if (entry === 'manifest.json')
-                        continue;
-                    const srcPath = path.join(src, entry);
-                    const destPath = path.join(dshHome, entry);
-                    try {
-                        // Skip if src and dest are the same file (e.g. symlink to same target like ~/.dsh/AGENTS.md)
-                        try {
-                            if (fs.existsSync(srcPath) && fs.existsSync(destPath) && fs.realpathSync(srcPath) === fs.realpathSync(destPath))
-                                continue;
-                        }
-                        catch { }
-                        fs.cpSync(srcPath, destPath, { recursive: true, force: true });
-                    }
-                    catch (e) {
-                        if (isSelfCopyError(String(e?.message ?? '')))
-                            continue;
-                        throw e;
-                    }
-                }
+                const target = await rollbackLKG({ dshHome, lkgRoot, failingPlugin });
                 console.log(`[supervisor] rolled back to ${target}${failingPlugin ? ` (avoiding ${failingPlugin})` : ''}`);
                 // Reconcile node_modules from restored package.json (critical for link: deps)
                 try {
@@ -229,6 +245,22 @@ Commands:
             },
             notify: async (msg) => console.log(`[notify] ${msg}`),
             isPlannedRestartActive: () => checkPlannedRestart(),
+            // dsh_web_restart marker ownership: the daemon acts on the marker. After
+            // the restart, scan recent session logs for torn tails (an in-flight
+            // session truncated by the restart) and report; the marker is cleared in
+            // the supervisor's own finally block and again here as a safety net.
+            readRestartRequest: () => readRestartRequest(),
+            onRestartRequestHandled: async () => {
+                const { scanSessions } = await import('./scan.js');
+                const res = await scanSessions(path.join(os.homedir(), '.dsh'), { withinMs: 10 * 60 * 1000 }).catch(() => ({ scanned: 0, torn: [] }));
+                if (res.torn.length) {
+                    console.log(`[supervisor] post-self-restart scan: ${res.torn.length} torn session log(s)`);
+                }
+                else {
+                    console.log('[supervisor] post-self-restart scan: clean');
+                }
+                void clearPlannedRestart();
+            },
         });
         await supervisor.start();
         // keep process alive

package/lib/debug-agent.js

@@ -268,6 +268,7 @@ async function defaultFetchLLM(prompt) {
             body: JSON.stringify({
                 model: cfg.model,
                 temperature: 0.2,
+                ...(cfg.reasoningEffort ? { reasoning_effort: cfg.reasoningEffort, reasoningEffort: cfg.reasoningEffort } : {}),
                 messages: [
                     { role: 'system', content: 'You are a systematic-debugging agent for DSH Web resilience. Follow the 4 phases: root cause, pattern analysis, hypothesis, implementation. Always propose minimal single-file fix.' },
                     { role: 'user', content: prompt },
@@ -312,7 +313,7 @@ async function defaultFetchLLM(prompt) {
                 { role: 'user', content: prompt },
             ],
             max_output_tokens: 4000,
-            reasoning: { effort: 'low' },
+            ...(cfg.reasoningEffort ? { reasoning: { effort: cfg.reasoningEffort } } : { reasoning: { effort: 'low' } }),
         }),
     });
     if (!res2.ok)
@@ -339,7 +340,9 @@ async function resolveLLMConfig() {
     // Model: AI_MODEL / DEEPSEEK_MODEL / settings.json domains.supervisor.model -> domains.review.model / default
     // Supervisor has its own picker; falls back to review model for backward compat, then DSH default.
     let model = process.env.AI_MODEL ?? process.env.DEEPSEEK_MODEL ?? process.env.OPENAI_MODEL ?? null;
-    if (!model) {
+    // reasoningEffort: env first, then supervisor -> review, then settings.yaml fallback
+    let reasoningEffort = (process.env.AI_REASONING_EFFORT ?? process.env.REASONING_EFFORT ?? null) ?? undefined;
+    if (!model || !reasoningEffort) {
         try {
             const { readFileSync } = await import('node:fs');
             const { homedir } = await import('node:os');
@@ -347,24 +350,57 @@ async function resolveLLMConfig() {
             const raw = readFileSync(settingsPath, 'utf-8');
             const j = JSON.parse(raw);
             // Prefer supervisor model, fall back to review model (so old installs keep working)
-            const sup = j?.domains?.supervisor?.model?.model ?? j?.domains?.supervisor?.model;
-            const rev = j?.domains?.review?.model?.model ?? j?.domains?.review?.model;
-            let m = null;
-            if (typeof sup === 'string')
-                m = sup;
-            else if (sup?.model && typeof sup.model === 'string')
-                m = sup.model;
-            else if (typeof rev === 'string')
-                m = rev;
-            else if (rev?.model && typeof rev.model === 'string')
-                m = rev.model;
-            if (typeof m === 'string' && m.trim() !== '')
-                model = m;
+            if (!model) {
+                const sup = j?.domains?.supervisor?.model?.model ?? j?.domains?.supervisor?.model;
+                const rev = j?.domains?.review?.model?.model ?? j?.domains?.review?.model;
+                let m = null;
+                if (typeof sup === 'string')
+                    m = sup;
+                else if (sup?.model && typeof sup.model === 'string')
+                    m = sup.model;
+                else if (typeof rev === 'string')
+                    m = rev;
+                else if (rev?.model && typeof rev.model === 'string')
+                    m = rev.model;
+                if (typeof m === 'string' && m.trim() !== '')
+                    model = m;
+            }
+            if (!reasoningEffort) {
+                // config-lib validator: model is {provider, model, reasoningEffort?} inside domains.supervisor.model / domains.review.model
+                // Support both nested object and flat legacy fallback for future compat
+                const supObj = j?.domains?.supervisor?.model;
+                const revObj = j?.domains?.review?.model;
+                const supEff = typeof supObj === 'object' && supObj !== null ? supObj.reasoningEffort : undefined;
+                const supFlat = j?.domains?.supervisor?.reasoningEffort;
+                const revEff = typeof revObj === 'object' && revObj !== null ? revObj.reasoningEffort : undefined;
+                const revFlat = j?.domains?.review?.reasoningEffort;
+                const candidate = supEff ?? supFlat ?? revEff ?? revFlat;
+                if (typeof candidate === 'string' && candidate.trim() !== '')
+                    reasoningEffort = candidate.trim();
+            }
         }
         catch { }
     }
     if (!model)
         model = 'deepseek-chat';
+    // Also try settings.yaml for reasoningEffort if still missing (e.g., llm-pi-ai default reasoning)
+    if (!reasoningEffort) {
+        try {
+            const { readFileSync } = await import('node:fs');
+            const { homedir } = await import('node:os');
+            const yamlPath = `${homedir()}/.dsh/settings.yaml`;
+            const yaml = readFileSync(yamlPath, 'utf-8');
+            // Look for reasoningEffort near the model id in provider blocks (future-proof; currently not in yaml)
+            const re = new RegExp(`id:\\s*${model}[\\s\\S]{0,200}reasoningEffort:\\s*(\\S+)`, 'm');
+            const m = yaml.match(re);
+            if (m) {
+                const v = m[1].trim().replace(/^["']|["']$/g, '');
+                if (v)
+                    reasoningEffort = v;
+            }
+        }
+        catch { }
+    }
     // If url not set via env, try to resolve from ~/.dsh/settings.yaml llm-pi-ai providers (DeepSeek suggested setup)
     if (!url) {
         try {
@@ -432,7 +468,7 @@ async function resolveLLMConfig() {
     if (!url.includes('/v1/') && !url.includes('/chat/completions')) {
         finalUrl = url.replace(/\/$/, '') + '/v1/chat/completions';
     }
-    return { key, url: finalUrl, model };
+    return { key, url: finalUrl, model, ...(reasoningEffort ? { reasoningEffort } : {}) };
 }
 async function resolveApiKey() {
     const cfg = await resolveLLMConfig();

package/lib/health-poller.js

@@ -50,6 +50,10 @@ function isRecentlyStarted(opts, wallMs) {
         return true;
     return false;
 }
+// Specific parse/boot-failure markers only. Bare 'JSON'/'YAML' were removed
+// (2026-08-31): they matched any line whose payload merely *contained* those
+// substrings — e.g. maestro-sync's status JSON listing session.jsonl.zstd /
+// settings.json paths — turning a healthy 401 into a rollback + restart.
 const ERROR_PATTERNS = [
     'ERR_MODULE_NOT_FOUND',
     'ERR_PNPM',
@@ -58,8 +62,6 @@ const ERROR_PATTERNS = [
     'SyntaxError',
     'YAMLParseError',
     'ParseError',
-    'YAML',
-    'JSON',
     'corrupted',
     'allowBuilds',
     'Cannot find module',

package/lib/plugin.d.ts

@@ -6,7 +6,7 @@
  * and web restart; this plugin handles the in-process resume.
  */
 import { findInterrupted as defaultFindInterrupted, findDanglingOpenTurns as defaultFindDanglingOpenTurns } from './resume.js';
-export declare const inject: readonly ["sessions", "agents", "connection"];
+export declare const inject: readonly ["sessions", "agents", "connection", "skills"];
 export interface SupervisorPluginConfig {
     autoResumeWithin?: number | string;
     autoResumeEnabled?: boolean;

package/lib/plugin.js

@@ -8,8 +8,13 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
+import { fileURLToPath } from 'node:url';
 import { findInterrupted as defaultFindInterrupted, findDanglingOpenTurns as defaultFindDanglingOpenTurns } from './resume.js';
-export const inject = ['sessions', 'agents', 'connection'];
+import { makeSkillProvider } from './skill-provider.js';
+import { registerRestartTool } from './restart-tool.js';
+import { makePreExecuteGuard } from './self-kill-guard.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export const inject = ['sessions', 'agents', 'connection', 'skills'];
 function parseDuration(s) {
     if (!s)
         return undefined;
@@ -280,6 +285,25 @@ export function createResumeRpcHandler(ctx, opts = {}) {
         return { ok: true, value: { resumed: await resume(ctx, ids) } };
     };
 }
+/** Resolve the package-root skills/ dir regardless of module layout. The built
+ * host lib is flat (lib/plugin.js → ../skills), but under vitest the same
+ * module loads from src/host/ (→ ../../skills). Walking to the nearest
+ * package.json yields the same package-root skills/ in both layouts. */
+function resolveSkillsDir(fromDir) {
+    let dir = fromDir;
+    for (let i = 0; i < 6; i++) {
+        try {
+            if (fs.existsSync(path.join(dir, 'package.json')))
+                return path.join(dir, 'skills');
+        }
+        catch { }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return path.join(fromDir, '..', 'skills');
+}
 function ensureSystemdKeepalive(ctx) {
     // Best-effort: ensure dsh-web-keepalive.service exists and is enabled, and linger is on.
     // This is the user-level auto-fix for the 11:42:58 crash where manager session 97
@@ -365,6 +389,36 @@ export function apply(ctx, config = {}) {
             ensureSystemdKeepalive(ctx);
         }
         catch { }
+        try {
+            const skills = ctx.get?.('skills');
+            if (skills?.registerProvider) {
+                ctx.effect(() => {
+                    let unregister;
+                    try {
+                        // Package-root skills/ is resolved at runtime by walking to the
+                        // nearest package.json (robust to lib/ vs src/host/ layouts).
+                        unregister = skills.registerProvider(() => makeSkillProvider(resolveSkillsDir(__dirname)));
+                    }
+                    catch (e) {
+                        ctx.logger?.warn?.(`[supervisor] skill provider failed: ${e?.message ?? String(e)}`);
+                    }
+                    return () => { try {
+                        unregister?.();
+                    }
+                    catch { } };
+                }, 'supervisor:skill');
+            }
+        }
+        catch { }
+        try {
+            ctx.effect(() => registerRestartTool(ctx), 'supervisor:restart-tool');
+        }
+        catch (e) {
+            try {
+                ctx.logger?.warn?.(`[supervisor] restart tool effect failed: ${e?.message ?? String(e)}`);
+            }
+            catch { }
+        }
         ctx.effect(() => {
             let disposed = false;
             let timer = null;
@@ -400,6 +454,24 @@ export function apply(ctx, config = {}) {
                 }
             };
         }, 'supervisor:auto-resume');
+        try {
+            // Deny bash/shell self-kill commands in-tree; the safe restart path is
+            // dsh_web_restart (supervisor daemon owns the actual restart).
+            const guard = makePreExecuteGuard();
+            ctx.effect(() => {
+                const un = ctx.on?.('tools/pre-execute', guard) ?? null;
+                return () => { try {
+                    un?.();
+                }
+                catch { } };
+            }, 'supervisor:self-kill-guard');
+        }
+        catch (e) {
+            try {
+                ctx.logger?.warn?.(`[supervisor] self-kill guard effect failed: ${e?.message ?? String(e)}`);
+            }
+            catch { }
+        }
     }
     catch (e) {
         try {

package/lib/restart-guards.d.ts

@@ -6,3 +6,14 @@ export declare function plannedRestartPath(): string;
 export declare function writePlannedRestart(ttlMs?: number): void;
 export declare function checkPlannedRestart(markerPath?: string): boolean;
 export declare function clearPlannedRestart(): void;
+export interface RestartRequest {
+    ts: number;
+    ttl: number;
+    callerSessionId?: string;
+    reason?: string;
+}
+export declare function writeRestartRequest(caller: {
+    callerSessionId?: string;
+    reason?: string;
+}, ttlMs?: number): void;
+export declare function readRestartRequest(): RestartRequest | undefined;

package/lib/restart-guards.js

@@ -92,3 +92,26 @@ export function clearPlannedRestart() {
     }
     catch { }
 }
+export function writeRestartRequest(caller, ttlMs = 180_000) {
+    const p = plannedRestartPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    const body = { ts: Date.now(), ttl: ttlMs, ...caller };
+    fs.writeFileSync(p, JSON.stringify(body), { mode: 0o600 });
+    try {
+        fs.chmodSync(p, 0o600);
+    }
+    catch { }
+}
+export function readRestartRequest() {
+    try {
+        const raw = fs.readFileSync(plannedRestartPath(), 'utf8');
+        const j = JSON.parse(raw);
+        if (typeof j.ts === 'number' && typeof j.ttl === 'number') {
+            if (Date.now() - j.ts >= j.ttl)
+                return undefined;
+            return { ts: j.ts, ttl: j.ttl, callerSessionId: j.callerSessionId, reason: j.reason };
+        }
+    }
+    catch { }
+    return undefined;
+}

package/lib/restart-tool.d.ts

@@ -0,0 +1,70 @@
+/**
+ * dsh_web_restart tool — the safe restart path for the model running inside
+ * dsh web. Scheduling a restart through this tool instead of a raw kill keeps
+ * the restart inside the supervisor's ownership loop:
+ *
+ *   1. dry-boot gate — if the plugin tree changed since the latest LKG, boot a
+ *      copy of the live profile on an ephemeral DSH_HOME first and only
+ *      schedule when that boot serves HTTP.
+ *   2. intent sidecar — record the caller session + reason under
+ *      ~/.dsh/.supervisor/intents/ for attribution.
+ *   3. hand-off — write the restart-request marker (planned-restart.json with
+ *      callerSessionId) that the supervisor daemon owns and acts on
+ *      (out-of-band). This tool NEVER restarts the host in-tree.
+ */
+import { writeRestartRequest } from './restart-guards.js';
+/**
+ * Boot a copy of the live web profile on an isolated DSH_HOME and verify the
+ * plugin tree loads and serves. Returns ok + a one-line detail for the tool
+ * message. The spawned tree is killed (best-effort) and the temp home removed.
+ * Unit tests mock this (never spawn a real node boot in tests).
+ *
+ * NOTE (bin.ts finding): the `web` alias already implies `--profile web`, and
+ * the web app's own commander program (no allowUnknownOption) rejects a stray
+ * `--profile` in its inner args — so the spawn passes only `web --no-open
+ * --port <port>`.
+ */
+export declare function dryBootVerify(harnessRoot: string, opts?: {
+    timeoutMs?: number;
+}): Promise<{
+    ok: boolean;
+    detail: string;
+}>;
+/** Minimal file metadata the drift check reads; injectable for deterministic tests. */
+export interface FileStat {
+    mtimeMs: number;
+}
+/**
+ * Whether the live plugin tree differs from the latest LKG snapshot. Two
+ * signals are combined:
+ *
+ *   1. manifest drift — the live profile's web `package.json` text vs baseline;
+ *   2. plugin-lib drift — any `@ddtcorex` plugin `lib/` file newer than the
+ *      snapshot moment. Link-installed plugins resolve to the same workspace
+ *      files in both live and LKG, so the stored copies cannot be compared
+ *      byte-wise; the snapshot itself is the meaningful baseline and a rebuilt
+ *      `lib/` bumps a file past it even when the manifest text is unchanged.
+ *      writeLKG writes `manifest.json` LAST, so its FILE mtime is the
+ *      authoritative snapshot moment; the snapshot dir mtime is only a
+ *      fallback for legacy snapshots without a manifest.
+ *
+ * `statFile` (default `statSync`) reads the metadata so tests can inject a
+ * controlled reader instead of relying on filesystem utimes (which CI runners
+ * do not reliably reflect). No LKG baseline, a missing file on either side, or
+ * any stat/read error means "changed" — the caller falls back to the dry-boot
+ * gate.
+ */
+export declare function isPluginTreeChanged(harnessRoot: string, lkgDir?: string, opts?: {
+    statFile?: (p: string) => FileStat;
+}): boolean;
+/**
+ * Register the dsh_web_restart tool. Registration is fail-safe (warns, never
+ * throws) and the returned function disposes the registration. `deps` are
+ * injectable for tests.
+ */
+export declare function registerRestartTool(ctx: any, deps?: {
+    sessionIdOf?: (exec: any) => string | undefined;
+    dryBoot?: typeof dryBootVerify;
+    writeRestartRequest?: typeof writeRestartRequest;
+    harnessRoot?: string;
+}): () => void;