@ran-sh/dsh-crew 0.3.6 → 0.3.8

package/src/install/official-web.mjs

@@ -0,0 +1,132 @@
+import {
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { ensurePluginRegistration, removeCrewPluginRegistration } from '../dsh-cli-runtime.mjs';
+
+export const OFFICIAL_BRIDGE_PACKAGE = '@ran-sh/dsh-crew-web-bridge';
+const STATE_FILENAME = 'official-web.json';
+
+export function officialWebProfileDir({ home = homedir() } = {}) {
+  return join(home, '.dsh', 'profiles', 'web');
+}
+
+export function officialWebIntegrationStateFile({ home = homedir() } = {}) {
+  return join(home, '.config', 'dsh-crew', STATE_FILENAME);
+}
+
+function readState(home) {
+  try {
+    const value = JSON.parse(readFileSync(officialWebIntegrationStateFile({ home }), 'utf8'));
+    return value && typeof value === 'object' ? value : null;
+  } catch { return null; }
+}
+
+function writeState(home, value) {
+  const file = officialWebIntegrationStateFile({ home });
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(value, null, 2) + '\n');
+}
+
+function validOfficialManifest(file) {
+  if (!existsSync(file)) return { ok: false, code: 'OFFICIAL_WEB_PROFILE_NOT_FOUND' };
+  try {
+    const raw = readFileSync(file, 'utf8');
+    const manifest = JSON.parse(raw);
+    if (!manifest || typeof manifest !== 'object'
+      || (manifest.dependencies !== undefined && (!manifest.dependencies || typeof manifest.dependencies !== 'object' || Array.isArray(manifest.dependencies)))
+      || !Array.isArray(manifest.dsh?.profile?.bundles)) {
+      return { ok: false, code: 'OFFICIAL_WEB_PROFILE_INVALID' };
+    }
+    return { ok: true, raw, manifest };
+  } catch { return { ok: false, code: 'OFFICIAL_WEB_PROFILE_INVALID' }; }
+}
+
+function makeBackup({ home, profileManifest, previous }) {
+  if (previous?.backup_file && existsSync(previous.backup_file)) return previous.backup_file;
+  const backupDir = join(home, '.config', 'dsh-crew', 'backups');
+  mkdirSync(backupDir, { recursive: true });
+  const backupFile = join(backupDir, `official-web-package-${Date.now()}.json`);
+  copyFileSync(profileManifest, backupFile);
+  return backupFile;
+}
+
+export function ensureOfficialWebIntegration({ home = homedir(), releaseDir } = {}) {
+  let resolvedRelease;
+  try { resolvedRelease = realpathSync(releaseDir); } catch { return { ok: false, code: 'RELEASE_NOT_FOUND' }; }
+  const bridgeRoot = join(resolvedRelease, 'official-web-bridge');
+  const profileRoot = officialWebProfileDir({ home });
+  const profileManifest = join(profileRoot, 'package.json');
+  const profile = validOfficialManifest(profileManifest);
+  if (!profile.ok) return profile;
+  const previous = readState(home);
+  const backupFile = makeBackup({ home, profileManifest, previous });
+  const registration = ensurePluginRegistration({
+    profileRoot,
+    root: bridgeRoot,
+    name: OFFICIAL_BRIDGE_PACKAGE,
+    createProfile: false,
+  });
+  if (!registration.ok) {
+    return { ok: false, code: registration.code === 'CREW_PROFILE_METADATA_INVALID' ? 'OFFICIAL_WEB_PROFILE_INVALID' : registration.code };
+  }
+  const stateChanged = previous?.enabled !== true || previous?.release_dir !== resolvedRelease || previous?.backup_file !== backupFile;
+  writeState(home, {
+    enabled: true,
+    release_dir: resolvedRelease,
+    backup_file: backupFile,
+    package: OFFICIAL_BRIDGE_PACKAGE,
+  });
+  return { ...registration, changed: registration.changed || stateChanged, backupFile };
+}
+
+export function officialWebIntegrationStatus({ home = homedir(), releaseDir } = {}) {
+  const state = readState(home);
+  if (state?.enabled !== true) return { enabled: false, healthy: false, state };
+  const expectedRelease = releaseDir ?? state.release_dir;
+  let expectedBridge;
+  try { expectedBridge = realpathSync(join(expectedRelease, 'official-web-bridge')); } catch {
+    return { enabled: true, healthy: false, code: 'BRIDGE_RELEASE_MISSING', state };
+  }
+  const profileRoot = officialWebProfileDir({ home });
+  const profile = validOfficialManifest(join(profileRoot, 'package.json'));
+  if (!profile.ok) return { enabled: true, healthy: false, code: profile.code, state };
+  const dependency = profile.manifest.dependencies?.[OFFICIAL_BRIDGE_PACKAGE];
+  const bundled = profile.manifest.dsh.profile.bundles.includes(OFFICIAL_BRIDGE_PACKAGE);
+  const linkPath = join(profileRoot, 'node_modules', ...OFFICIAL_BRIDGE_PACKAGE.split('/'));
+  let linked = false;
+  try { linked = lstatSync(linkPath).isSymbolicLink() && realpathSync(linkPath) === expectedBridge; } catch {}
+  return { enabled: true, healthy: Boolean(dependency && bundled && linked), state, linkPath, expectedBridge };
+}
+
+export function removeOfficialWebIntegration({ home = homedir(), remember = true, preserveIntent = false } = {}) {
+  const profileRoot = officialWebProfileDir({ home });
+  const profileManifest = join(profileRoot, 'package.json');
+  const profile = validOfficialManifest(profileManifest);
+  if (!profile.ok && profile.code !== 'OFFICIAL_WEB_PROFILE_NOT_FOUND') return profile;
+  let removed = false;
+  if (profile.ok) {
+    const result = removeCrewPluginRegistration({ home, name: OFFICIAL_BRIDGE_PACKAGE, profileRoot });
+    if (!result.ok) return { ok: false, code: result.code === 'CREW_PROFILE_METADATA_INVALID' ? 'OFFICIAL_WEB_PROFILE_INVALID' : result.code };
+    removed = result.removed;
+  }
+  const previous = readState(home);
+  if (remember) writeState(home, {
+    ...(previous ?? {}),
+    enabled: preserveIntent ? previous?.enabled === true : false,
+    package: OFFICIAL_BRIDGE_PACKAGE,
+  });
+  else {
+    const stateFile = officialWebIntegrationStateFile({ home });
+    if (existsSync(stateFile)) unlinkSync(stateFile);
+  }
+  return { ok: true, removed };
+}

package/src/mcp-runtime.mjs

@@ -1,257 +1,257 @@
-// MCP-side workflow runtime wiring: builds the shared workflow runtime with
-// the real Hub / Standalone attempt adapters and the git-worktree workspace
-// adapter. This is the only place that knows which transport executes an
-// attempt; the MCP server (src/server.mjs) only does schema, validation,
-// policy gating and formatting.
-//
-// Behaviour decisions (escalation, review, candidate, queue, cancellation)
-// live entirely in workflow-runtime.mjs; the adapters here just execute.
-
-import { createWorkflowRuntime } from './workflow-runtime.mjs';
-import { normalizeGlobalConfig } from './policy.mjs';
-import { buildDirectSelectionTrace, enrichSelectionTrace } from './model-routing.mjs';
-import {
-  createIsolatedWorkspace,
-  cleanupIsolatedWorkspace,
-  inspectRepository,
-  captureCandidate as captureIsolationCandidate,
-} from './workspace-isolation.mjs';
-import { startJob, waitJob, jobView, cancelJob } from './jobs.mjs';
-import { hub } from './hub-client.mjs';
-
-const SESSION_CONFIG_KEYS = [
-  'default_tier', 'default_effort', 'mode', 'default_timeout_seconds',
-  'tier_policy', 'escalate_on_failure', 'collaboration_mode', 'main_agent_mode',
-  'flash_state', 'pro_state', 'pro_reviews_flash',
-];
-
-/**
- * Merge only defined session overrides onto the live global config before the
- * workflow snapshots its policy. This keeps dsh_worker_config authoritative
- * for escalation/review decisions instead of applying it only to the MCP gate.
- */
-export function buildEffectiveRuntimeConfig(globalRaw = {}, session = {}) {
-  const patch = {};
-  for (const key of SESSION_CONFIG_KEYS) {
-    if (session?.[key] !== undefined) patch[key] = session[key];
-  }
-  if (session?.enabled === false) patch.subagents_enabled = false;
-  return normalizeGlobalConfig({ ...globalRaw, ...patch });
-}
-
-/**
- * Translate a role/workflow attempt into the legacy model-class slot needed by
- * Standalone and DeepSeek Official Hub routing. A user-requested strong worker
- * starts on Pro; every escalated worker attempt also uses the strong slot.
- */
-export function resolveAttemptTier({ role = 'worker', attempt = 0, modelClassHint } = {}) {
-  if (role === 'reviewer') return 'pro';
-  if (Number.isInteger(attempt) && attempt > 0) return 'pro';
-  if (modelClassHint === 'pro') return 'pro';
-  return 'flash';
-}
-
-/** Map a Hub/Standalone job view into the AttemptResult the runtime expects. */
-export function attemptFromView(view, spec) {
-  const role = view?.role ?? spec.role ?? 'worker';
-  const logicalAttempt = spec.attempt ?? 0;
-  const source = view?.selection_source ?? null;
-  const transportTrace = view?.selection_trace ?? buildDirectSelectionTrace({
-    role,
-    logicalAttempt,
-    modelClassHint: spec.model_class_hint ?? null,
-    strategy: source ?? 'transport-selection',
-    candidateSet: logicalAttempt > 0 ? 'escalation' : 'primary',
-    provider: view?.provider ?? null,
-    model: view?.model ?? null,
-    source: source ?? 'transport-selection',
-    escalationReason: spec.escalation_reason ?? null,
-  });
-  const selectionTrace = enrichSelectionTrace(transportTrace, {
-    role,
-    logicalAttempt,
-    modelClassHint: spec.model_class_hint ?? null,
-    escalationReason: spec.escalation_reason ?? null,
-  });
-  return {
-    id: view?.id ?? spec.id,
-    role,
-    // `view.attempt` may be an adapter routing-attempt (see below); the
-    // workflow's logical attempt number is always the spec value.
-    attempt: logicalAttempt,
-    provider: view?.provider ?? null,
-    model: view?.model ?? null,
-    selection_source: source,
-    selection_trace: selectionTrace,
-    status: view?.status ?? 'failed',
-    result: view?.result ?? null,
-    stopReason: view?.stopReason ?? null,
-    outcome: view?.outcome ?? null,
-    usage: view?.tokens ?? null,
-    error: view?.error ?? null,
-    error_code: view?.error_code ?? view?.code ?? null,
-  };
-}
-
-function timedOutAttempt(view, spec, timeoutMs) {
-  return {
-    ...attemptFromView(view, spec),
-    status: 'failed',
-    stopReason: 'timeout',
-    error: `attempt timed out after ${Math.ceil(timeoutMs / 1000)}s and was cancelled before any retry`,
-    timed_out: true,
-  };
-}
-
-/**
- * Build the workflow runtime used by the MCP server.
- *
- * deps:
- *   getSessionConfig()     -> session-level config (effort, timeout, mode...)
- *   resolveMode()          -> 'hub' | 'standalone'
- *   presetForTier(tier)    -> hub agent preset id for a tier slot (optional)
- *   readGlobalConfig()     -> raw global config reader
- *   buildReviewTask(task, view) -> reviewer prompt builder
- *   attemptTimeoutMs()     -> default attempt execution timeout (optional)
- */
-export function buildMcpWorkflowRuntime(deps) {
-  const { getSessionConfig, resolveMode, presetForTier, readGlobalConfig, buildReviewTask } = deps;
-  const getConfig = () => buildEffectiveRuntimeConfig(readGlobalConfig(), getSessionConfig?.() ?? {});
-  const getRuntimeControls = () => ({
-    max_parallel: getConfig().execution?.max_parallel ?? 3,
-  });
-
-  const executeAttempt = async (spec) => {
-    const session = getSessionConfig?.() ?? {};
-    const effort = spec.effort ?? session.default_effort ?? 'max';
-    const timeoutMs = (deps.attemptTimeoutMs?.() ?? (session.default_timeout_seconds ?? 1800) * 1000);
-    const tier = resolveAttemptTier({ role: spec.role, attempt: spec.attempt, modelClassHint: spec.model_class_hint });
-    const delivery = spec.role === 'reviewer' || spec.delivery === 'review' ? 'review' : 'coding';
-    const source = spec.source ?? 'api';
-    const preset = presetForTier?.(tier);
-
-    if ((await resolveMode()) === 'hub') {
-      // Hub follow-dsh currently uses `attempt` to choose primary vs escalation
-      // model policy. For an explicit worker+pro hint, route selection through
-      // the strong pool while preserving the workflow's logical attempt number
-      // in the normalized AttemptResult.
-      const routingAttempt = spec.role === 'worker' && spec.attempt === 0 && spec.model_class_hint === 'pro'
-        ? 1
-        : spec.attempt;
-      const spawned = await hub.spawn({
-        task: spec.task,
-        tier,
-        role: spec.role,
-        attempt: routingAttempt,
-        effort,
-        cwd: spec.cwd,
-        source,
-        preset,
-        delivery,
-      });
-      spec.onAttemptStarted?.(spawned.id);
-
-      const deadline = Date.now() + timeoutMs;
-      let resolved = spawned;
-      while (resolved?.status === 'running') {
-        const remainingMs = deadline - Date.now();
-        if (remainingMs <= 0) {
-          let cancelled = resolved;
-          try { cancelled = await hub.cancel(spawned.id); } catch {}
-          return timedOutAttempt(cancelled, spec, timeoutMs);
-        }
-        const waitSeconds = Math.max(1, Math.min(600, Math.ceil(remainingMs / 1000)));
-        resolved = await hub.get(spawned.id, waitSeconds);
-      }
-      return attemptFromView(resolved, spec);
-    }
-
-    const job = startJob({
-      task: spec.task,
-      tier,
-      role: spec.role,
-      attempt: spec.attempt,
-      effort,
-      cwd: spec.cwd,
-      timeoutMs,
-      source,
-      delivery,
-      modelClassHint: spec.model_class_hint ?? null,
-      escalationReason: spec.escalation_reason ?? null,
-    });
-    spec.onAttemptStarted?.(job.id);
-    await waitJob(job.id, timeoutMs);
-    if (job.status === 'running') {
-      await cancelJob(job.id).catch(() => {});
-      return timedOutAttempt(jobView(job, { withResult: true }), spec, timeoutMs);
-    }
-    return attemptFromView(jobView(job, { withResult: true }), spec);
-  };
-
-  const cancelAttempt = async (id) => {
-    if (String(id ?? '').startsWith('hub-')) {
-      try { await hub.cancel(id); } catch {}
-      return;
-    }
-    try { await cancelJob(id); } catch {}
-  };
-
-  const allocateWorkspace = async (job) => {
-    const config = getConfig();
-    const isolation = config.execution?.isolation ?? 'worktree';
-    // Reviewer role / explicit review and shared mode never draft a candidate;
-    // they run in the requested workspace.
-    if (job.role === 'reviewer' || job.delivery === 'review' || isolation === 'shared') {
-      return { ok: true, execution_cwd: job.requested_cwd, isolation: 'shared', base_revision: null, primary_workspace_dirty: false, handle: null };
-    }
-    // Coding worker under worktree isolation: fail closed when the workspace
-    // is not a git repo — never silently fall back to sharing the working tree.
-    const repo = await inspectRepository({ cwd: job.requested_cwd });
-    if (!repo.ok) {
-      return { ok: false, reason: repo.reason ?? 'ISOLATION_UNAVAILABLE', error: `coding worker needs an isolated git worktree: ${repo.error ?? repo.reason}` };
-    }
-    const created = await createIsolatedWorkspace({ cwd: job.requested_cwd, jobId: job.id, baseRevision: repo.baseRevision });
-    if (!created.ok) {
-      return { ok: false, reason: created.reason ?? 'WORKTREE_CREATE_FAILED', error: `worktree create failed: ${created.error ?? ''}` };
-    }
-    return {
-      ok: true,
-      execution_cwd: created.worktreePath,
-      base_revision: created.baseRevision,
-      isolation: 'worktree',
-      primary_workspace_dirty: repo.dirty === true,
-      handle: { worktreePath: created.worktreePath, repoRoot: created.repoRoot },
-    };
-  };
-
-  const captureCandidate = async ({ cwd, baseRevision }) => captureIsolationCandidate({ worktreePath: cwd, baseRevision });
-
-  const releaseWorkspace = async (handle) => {
-    if (!handle) return { ok: true };
-    try {
-      const r = await cleanupIsolatedWorkspace({ worktreePath: handle.worktreePath, repoRoot: handle.repoRoot });
-      return { ok: r.ok, error: r.ok ? undefined : r.error };
-    } catch (err) {
-      return { ok: false, error: err?.message ?? String(err) };
-    }
-  };
-
-  const initialConfig = getConfig();
-  const runtime = createWorkflowRuntime(
-    {
-      executeAttempt,
-      cancelAttempt,
-      allocateWorkspace,
-      captureCandidate,
-      releaseWorkspace,
-      buildReviewTask,
-      getConfig,
-      getRuntimeControls,
-    },
-    {
-      maxParallel: initialConfig.execution?.max_parallel ?? 3,
-    },
-  );
-
-  return runtime;
-}
+// MCP-side workflow runtime wiring: builds the shared workflow runtime with
+// the real Hub / Standalone attempt adapters and the git-worktree workspace
+// adapter. This is the only place that knows which transport executes an
+// attempt; the MCP server (src/server.mjs) only does schema, validation,
+// policy gating and formatting.
+//
+// Behaviour decisions (escalation, review, candidate, queue, cancellation)
+// live entirely in workflow-runtime.mjs; the adapters here just execute.
+
+import { createWorkflowRuntime } from './workflow-runtime.mjs';
+import { normalizeGlobalConfig } from './policy.mjs';
+import { buildDirectSelectionTrace, enrichSelectionTrace } from './model-routing.mjs';
+import {
+  createIsolatedWorkspace,
+  cleanupIsolatedWorkspace,
+  inspectRepository,
+  captureCandidate as captureIsolationCandidate,
+} from './workspace-isolation.mjs';
+import { startJob, waitJob, jobView, cancelJob } from './jobs.mjs';
+import { hub } from './hub-client.mjs';
+
+const SESSION_CONFIG_KEYS = [
+  'default_tier', 'default_effort', 'mode', 'default_timeout_seconds',
+  'tier_policy', 'escalate_on_failure', 'collaboration_mode', 'main_agent_mode',
+  'flash_state', 'pro_state', 'pro_reviews_flash',
+];
+
+/**
+ * Merge only defined session overrides onto the live global config before the
+ * workflow snapshots its policy. This keeps dsh_worker_config authoritative
+ * for escalation/review decisions instead of applying it only to the MCP gate.
+ */
+export function buildEffectiveRuntimeConfig(globalRaw = {}, session = {}) {
+  const patch = {};
+  for (const key of SESSION_CONFIG_KEYS) {
+    if (session?.[key] !== undefined) patch[key] = session[key];
+  }
+  if (session?.enabled === false) patch.subagents_enabled = false;
+  return normalizeGlobalConfig({ ...globalRaw, ...patch });
+}
+
+/**
+ * Translate a role/workflow attempt into the legacy model-class slot needed by
+ * Standalone and DeepSeek Official Hub routing. A user-requested strong worker
+ * starts on Pro; every escalated worker attempt also uses the strong slot.
+ */
+export function resolveAttemptTier({ role = 'worker', attempt = 0, modelClassHint } = {}) {
+  if (role === 'reviewer') return 'pro';
+  if (Number.isInteger(attempt) && attempt > 0) return 'pro';
+  if (modelClassHint === 'pro') return 'pro';
+  return 'flash';
+}
+
+/** Map a Hub/Standalone job view into the AttemptResult the runtime expects. */
+export function attemptFromView(view, spec) {
+  const role = view?.role ?? spec.role ?? 'worker';
+  const logicalAttempt = spec.attempt ?? 0;
+  const source = view?.selection_source ?? null;
+  const transportTrace = view?.selection_trace ?? buildDirectSelectionTrace({
+    role,
+    logicalAttempt,
+    modelClassHint: spec.model_class_hint ?? null,
+    strategy: source ?? 'transport-selection',
+    candidateSet: logicalAttempt > 0 ? 'escalation' : 'primary',
+    provider: view?.provider ?? null,
+    model: view?.model ?? null,
+    source: source ?? 'transport-selection',
+    escalationReason: spec.escalation_reason ?? null,
+  });
+  const selectionTrace = enrichSelectionTrace(transportTrace, {
+    role,
+    logicalAttempt,
+    modelClassHint: spec.model_class_hint ?? null,
+    escalationReason: spec.escalation_reason ?? null,
+  });
+  return {
+    id: view?.id ?? spec.id,
+    role,
+    // `view.attempt` may be an adapter routing-attempt (see below); the
+    // workflow's logical attempt number is always the spec value.
+    attempt: logicalAttempt,
+    provider: view?.provider ?? null,
+    model: view?.model ?? null,
+    selection_source: source,
+    selection_trace: selectionTrace,
+    status: view?.status ?? 'failed',
+    result: view?.result ?? null,
+    stopReason: view?.stopReason ?? null,
+    outcome: view?.outcome ?? null,
+    usage: view?.tokens ?? null,
+    error: view?.error ?? null,
+    error_code: view?.error_code ?? view?.code ?? null,
+  };
+}
+
+function timedOutAttempt(view, spec, timeoutMs) {
+  return {
+    ...attemptFromView(view, spec),
+    status: 'failed',
+    stopReason: 'timeout',
+    error: `attempt timed out after ${Math.ceil(timeoutMs / 1000)}s and was cancelled before any retry`,
+    timed_out: true,
+  };
+}
+
+/**
+ * Build the workflow runtime used by the MCP server.
+ *
+ * deps:
+ *   getSessionConfig()     -> session-level config (effort, timeout, mode...)
+ *   resolveMode()          -> 'hub' | 'standalone'
+ *   presetForTier(tier)    -> hub agent preset id for a tier slot (optional)
+ *   readGlobalConfig()     -> raw global config reader
+ *   buildReviewTask(task, view) -> reviewer prompt builder
+ *   attemptTimeoutMs()     -> default attempt execution timeout (optional)
+ */
+export function buildMcpWorkflowRuntime(deps) {
+  const { getSessionConfig, resolveMode, presetForTier, readGlobalConfig, buildReviewTask } = deps;
+  const getConfig = () => buildEffectiveRuntimeConfig(readGlobalConfig(), getSessionConfig?.() ?? {});
+  const getRuntimeControls = () => ({
+    max_parallel: getConfig().execution?.max_parallel ?? 3,
+  });
+
+  const executeAttempt = async (spec) => {
+    const session = getSessionConfig?.() ?? {};
+    const effort = spec.effort ?? session.default_effort ?? 'max';
+    const timeoutMs = (deps.attemptTimeoutMs?.() ?? (session.default_timeout_seconds ?? 1800) * 1000);
+    const tier = resolveAttemptTier({ role: spec.role, attempt: spec.attempt, modelClassHint: spec.model_class_hint });
+    const delivery = spec.role === 'reviewer' || spec.delivery === 'review' ? 'review' : 'coding';
+    const source = spec.source ?? 'api';
+    const preset = presetForTier?.(tier);
+
+    if ((await resolveMode()) === 'hub') {
+      // Hub follow-dsh currently uses `attempt` to choose primary vs escalation
+      // model policy. For an explicit worker+pro hint, route selection through
+      // the strong pool while preserving the workflow's logical attempt number
+      // in the normalized AttemptResult.
+      const routingAttempt = spec.role === 'worker' && spec.attempt === 0 && spec.model_class_hint === 'pro'
+        ? 1
+        : spec.attempt;
+      const spawned = await hub.spawn({
+        task: spec.task,
+        tier,
+        role: spec.role,
+        attempt: routingAttempt,
+        effort,
+        cwd: spec.cwd,
+        source,
+        preset,
+        delivery,
+      });
+      spec.onAttemptStarted?.(spawned.id);
+
+      const deadline = Date.now() + timeoutMs;
+      let resolved = spawned;
+      while (resolved?.status === 'running') {
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+          let cancelled = resolved;
+          try { cancelled = await hub.cancel(spawned.id); } catch {}
+          return timedOutAttempt(cancelled, spec, timeoutMs);
+        }
+        const waitSeconds = Math.max(1, Math.min(600, Math.ceil(remainingMs / 1000)));
+        resolved = await hub.get(spawned.id, waitSeconds);
+      }
+      return attemptFromView(resolved, spec);
+    }
+
+    const job = startJob({
+      task: spec.task,
+      tier,
+      role: spec.role,
+      attempt: spec.attempt,
+      effort,
+      cwd: spec.cwd,
+      timeoutMs,
+      source,
+      delivery,
+      modelClassHint: spec.model_class_hint ?? null,
+      escalationReason: spec.escalation_reason ?? null,
+    });
+    spec.onAttemptStarted?.(job.id);
+    await waitJob(job.id, timeoutMs);
+    if (job.status === 'running') {
+      await cancelJob(job.id).catch(() => {});
+      return timedOutAttempt(jobView(job, { withResult: true }), spec, timeoutMs);
+    }
+    return attemptFromView(jobView(job, { withResult: true }), spec);
+  };
+
+  const cancelAttempt = async (id) => {
+    if (String(id ?? '').startsWith('hub-')) {
+      try { await hub.cancel(id); } catch {}
+      return;
+    }
+    try { await cancelJob(id); } catch {}
+  };
+
+  const allocateWorkspace = async (job) => {
+    const config = getConfig();
+    const isolation = config.execution?.isolation ?? 'worktree';
+    // Reviewer role / explicit review and shared mode never draft a candidate;
+    // they run in the requested workspace.
+    if (job.role === 'reviewer' || job.delivery === 'review' || isolation === 'shared') {
+      return { ok: true, execution_cwd: job.requested_cwd, isolation: 'shared', base_revision: null, primary_workspace_dirty: false, handle: null };
+    }
+    // Coding worker under worktree isolation: fail closed when the workspace
+    // is not a git repo — never silently fall back to sharing the working tree.
+    const repo = await inspectRepository({ cwd: job.requested_cwd });
+    if (!repo.ok) {
+      return { ok: false, reason: repo.reason ?? 'ISOLATION_UNAVAILABLE', error: `coding worker needs an isolated git worktree: ${repo.error ?? repo.reason}` };
+    }
+    const created = await createIsolatedWorkspace({ cwd: job.requested_cwd, jobId: job.id, baseRevision: repo.baseRevision });
+    if (!created.ok) {
+      return { ok: false, reason: created.reason ?? 'WORKTREE_CREATE_FAILED', error: `worktree create failed: ${created.error ?? ''}` };
+    }
+    return {
+      ok: true,
+      execution_cwd: created.worktreePath,
+      base_revision: created.baseRevision,
+      isolation: 'worktree',
+      primary_workspace_dirty: repo.dirty === true,
+      handle: { worktreePath: created.worktreePath, repoRoot: created.repoRoot },
+    };
+  };
+
+  const captureCandidate = async ({ cwd, baseRevision }) => captureIsolationCandidate({ worktreePath: cwd, baseRevision });
+
+  const releaseWorkspace = async (handle) => {
+    if (!handle) return { ok: true };
+    try {
+      const r = await cleanupIsolatedWorkspace({ worktreePath: handle.worktreePath, repoRoot: handle.repoRoot });
+      return { ok: r.ok, error: r.ok ? undefined : r.error };
+    } catch (err) {
+      return { ok: false, error: err?.message ?? String(err) };
+    }
+  };
+
+  const initialConfig = getConfig();
+  const runtime = createWorkflowRuntime(
+    {
+      executeAttempt,
+      cancelAttempt,
+      allocateWorkspace,
+      captureCandidate,
+      releaseWorkspace,
+      buildReviewTask,
+      getConfig,
+      getRuntimeControls,
+    },
+    {
+      maxParallel: initialConfig.execution?.max_parallel ?? 3,
+    },
+  );
+
+  return runtime;
+}