@ran-sh/dsh-crew 0.3.6 → 0.3.8

package/src/official-web-bridge.mjs

@@ -0,0 +1,196 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { crewDshHome } from './install/install.mjs';
+import { crewDshRuntimeModule } from './dsh-cli-runtime.mjs';
+
+export const CREW_BRIDGE_PREFIX = '/_dsh/dsh-crew';
+export const CREW_BRIDGE_TARGET = 'http://127.0.0.1:3210';
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+const HOP_BY_HOP = new Set([
+  'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+  'te', 'trailer', 'transfer-encoding', 'upgrade', 'host', 'content-length',
+]);
+
+export function isLoopbackAddress(address) {
+  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
+}
+
+function isLocalHostname(hostname) {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1';
+}
+
+export function isTrustedLocalRequest(req) {
+  if (!isLoopbackAddress(req?.socket?.remoteAddress)) return false;
+  const host = typeof req?.headers?.host === 'string' ? req.headers.host.trim().toLowerCase() : '';
+  if (!host) return false;
+  let authority;
+  try { authority = new URL(`http://${host}`); } catch { return false; }
+  if (!isLocalHostname(authority.hostname.toLowerCase())) return false;
+  const fetchSite = String(req?.headers?.['sec-fetch-site'] ?? '').toLowerCase();
+  if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'none') return false;
+  const origin = req?.headers?.origin;
+  if (origin !== undefined) {
+    if (typeof origin !== 'string') return false;
+    let parsedOrigin;
+    try { parsedOrigin = new URL(origin); } catch { return false; }
+    if (!isLocalHostname(parsedOrigin.hostname.toLowerCase()) || parsedOrigin.host.toLowerCase() !== host) return false;
+  }
+  return true;
+}
+
+function safeHeaders(source) {
+  const result = {};
+  for (const [rawName, rawValue] of Object.entries(source ?? {})) {
+    const name = rawName.toLowerCase();
+    if (HOP_BY_HOP.has(name) || rawValue === undefined) continue;
+    result[name] = Array.isArray(rawValue) ? rawValue.join(', ') : String(rawValue);
+  }
+  return result;
+}
+
+function sendJson(res, status, value) {
+  const body = Buffer.from(JSON.stringify(value));
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'content-length': String(body.length),
+    'cache-control': 'no-store',
+    'x-content-type-options': 'nosniff',
+    'x-dsh-crew-bridge': '3080-to-3210',
+  });
+  res.end(body);
+}
+
+async function readBoundedBody(req, limit = MAX_BODY_BYTES) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += value.length;
+    if (size > limit) throw Object.assign(new Error('request too large'), { code: 'BODY_TOO_LARGE' });
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks);
+}
+
+async function defaultHealthCheck(fetchImpl = globalThis.fetch) {
+  try {
+    const response = await fetchImpl(`${CREW_BRIDGE_TARGET}${CREW_BRIDGE_PREFIX}/ping`, {
+      signal: AbortSignal.timeout(1_500),
+      headers: { accept: 'application/json' },
+    });
+    return response.ok;
+  } catch { return false; }
+}
+
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export function createCrewSidecarSupervisor({
+  home = homedir(),
+  exists = existsSync,
+  healthCheck = () => defaultHealthCheck(),
+  spawnImpl = spawn,
+  wait = delay,
+  maxAttempts = 120,
+  pollInterval = 250,
+} = {}) {
+  let starting = null;
+  let runningChild = null;
+  const runtime = crewDshRuntimeModule({ home });
+  const dshHome = crewDshHome({ home });
+
+  async function start() {
+    if (await healthCheck()) return { ok: true, started: false };
+    if (!exists(runtime)) return { ok: false, code: 'CREW_RUNTIME_NOT_INSTALLED' };
+    const childAlive = runningChild && runningChild.killed !== true && runningChild.exitCode == null;
+    if (!childAlive) {
+      runningChild = spawnImpl(process.execPath, [
+        runtime, '--profile', 'dsh-crew', '--host', '127.0.0.1', '--port', '3210',
+      ], {
+        cwd: dshHome,
+        env: { ...process.env, DSH_HOME: dshHome },
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: true,
+      });
+      const ownedChild = runningChild;
+      ownedChild.once?.('exit', () => { if (runningChild === ownedChild) runningChild = null; });
+      ownedChild.unref?.();
+    }
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+      if (await healthCheck()) return { ok: true, started: true };
+      await wait(pollInterval);
+    }
+    return { ok: false, code: 'CREW_BACKEND_START_TIMEOUT' };
+  }
+
+  return {
+    ensure() {
+      if (!starting) starting = start().finally(() => { starting = null; });
+      return starting;
+    },
+  };
+}
+
+const processSupervisor = createCrewSidecarSupervisor();
+
+export async function proxyCrewRequest(req, res, {
+  fetchImpl = globalThis.fetch,
+  ensureBackend = () => processSupervisor.ensure(),
+} = {}) {
+  if (!isTrustedLocalRequest(req)) {
+    sendJson(res, 403, { ok: false, code: 'LOCAL_SAME_ORIGIN_ONLY' });
+    return;
+  }
+  let pathname;
+  try { pathname = new URL(req.url, 'http://127.0.0.1:3080').pathname; } catch { pathname = ''; }
+  if (pathname !== CREW_BRIDGE_PREFIX && !pathname.startsWith(`${CREW_BRIDGE_PREFIX}/`)) {
+    sendJson(res, 404, { ok: false, code: 'NOT_FOUND' });
+    return;
+  }
+  try {
+    const backend = await ensureBackend();
+    if (backend?.ok === false) throw new Error('backend unavailable');
+    const method = String(req.method ?? 'GET').toUpperCase();
+    const bodyBuffer = method === 'GET' || method === 'HEAD' ? null : await readBoundedBody(req);
+    const response = await fetchImpl(`${CREW_BRIDGE_TARGET}${req.url}`, {
+      method,
+      headers: safeHeaders(req.headers),
+      body: bodyBuffer === null ? undefined : new Blob([bodyBuffer]),
+      signal: AbortSignal.timeout(120_000),
+    });
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    const headers = safeHeaders(Object.fromEntries(response.headers.entries()));
+    headers['content-length'] = String(responseBody.length);
+    headers['x-dsh-crew-bridge'] = '3080-to-3210';
+    res.writeHead(response.status, headers);
+    res.end(responseBody);
+  } catch (error) {
+    if (error?.code === 'BODY_TOO_LARGE') sendJson(res, 413, { ok: false, code: 'REQUEST_TOO_LARGE' });
+    else sendJson(res, 503, { ok: false, code: 'CREW_BACKEND_UNAVAILABLE' });
+  }
+}
+
+export function registerOfficialWebBridge(ctx, options = {}) {
+  return ctx.inject(['webServer'], (webCtx) => {
+    const disposeStatus = webCtx.webServer.register({
+      kind: 'exact',
+      path: `${CREW_BRIDGE_PREFIX}/bridge-status`,
+      handler: (req, res) => {
+        if (!isTrustedLocalRequest(req)) return sendJson(res, 403, { ok: false, code: 'LOCAL_SAME_ORIGIN_ONLY' });
+        return sendJson(res, 200, { ok: true, mode: 'official-3080-isolated-3210' });
+      },
+    });
+    const disposeProxy = webCtx.webServer.register({
+      kind: 'prefix',
+      path: CREW_BRIDGE_PREFIX,
+      handler: (req, res) => proxyCrewRequest(req, res, options),
+    });
+    return () => { disposeProxy?.(); disposeStatus?.(); };
+  });
+}
+
+export async function apply(ctx) {
+  registerOfficialWebBridge(ctx);
+}

package/src/policy.mjs

@@ -1,197 +1,197 @@
-// v0.3 config-authority facade over the frozen v0.2 policy implementation.
-//
-// The v0.2 module remains byte-for-byte available as policy-legacy.mjs. New
-// callers import this facade. For schema-v3 persisted configs, the nested
-// worker/review/execution/legacy snapshot is authoritative; flat Flash/Pro
-// fields are compatibility mirrors only. Legacy files still flow through the
-// old migration exactly as before.
-
-export * from './policy-legacy.mjs';
-import * as legacy from './policy-legacy.mjs';
-import { normalizeAdaptiveRouting } from './adaptive-routing.mjs';
-
-export { normalizeAdaptiveRouting };
-export const CONFIG_SCHEMA_VERSION = 3;
-
-function validObject(value) {
-  return !!value && typeof value === 'object' && !Array.isArray(value);
-}
-
-function hasCanonicalAuthority(raw) {
-  return Number(raw?.config_schema_version) >= CONFIG_SCHEMA_VERSION
-    && validObject(raw?.worker)
-    && validObject(raw?.review)
-    && validObject(raw?.execution);
-}
-
-function semanticLegacyMode(canonical) {
-  if (canonical.review.auto_review === true && canonical.review.state === 'auto') return 'review-pipeline';
-  if (canonical.worker.state === 'auto' && canonical.review.state === 'disabled'
-      && canonical.worker.model_policy.strategy === 'economy') return 'flash-only';
-  if (canonical.worker.state === 'auto' && canonical.review.state === 'disabled'
-      && canonical.worker.model_policy.strategy === 'quality') return 'pro-only';
-  if (canonical.worker.state === 'auto' && canonical.review.state === 'manual') return 'balanced';
-  return 'custom';
-}
-
-function normalizeLegacySnapshot(raw, canonical) {
-  // A nested v3 legacy snapshot is canonical compatibility metadata. Flat
-  // fields are only a fallback for transitional/pre-v3 inputs.
-  const nested = validObject(raw?.legacy) ? raw.legacy : {};
-  const source = { ...raw, ...nested };
-  const mode = legacy.COLLABORATION_MODES.includes(source.collaboration_mode)
-    ? source.collaboration_mode
-    : semanticLegacyMode(canonical);
-
-  let flash = legacy.TIER_STATES.includes(source.flash_state) ? source.flash_state : undefined;
-  let pro = legacy.TIER_STATES.includes(source.pro_state) ? source.pro_state : undefined;
-  if (mode === 'flash-only') { flash = 'auto'; pro = 'disabled'; }
-  else if (mode === 'pro-only') { flash = 'disabled'; pro = 'auto'; }
-  else if (mode === 'balanced' || mode === 'review-pipeline') { flash = 'auto'; pro = 'auto'; }
-  else {
-    flash ??= canonical.worker.state;
-    // reviewer=manual historically means the Pro tier is available/Auto but
-    // review itself is on-demand. Preserve an explicit nested pro state when
-    // present; otherwise use a conservative compatibility reconstruction.
-    pro ??= canonical.review.state === 'disabled' ? 'disabled' : 'auto';
-  }
-
-  return {
-    collaboration_mode: mode,
-    tier_policy: mode === 'flash-only' ? 'flash-only' : mode === 'pro-only' ? 'pro-only' : 'auto',
-    flash_state: flash,
-    pro_state: pro,
-  };
-}
-
-function modelPolicyWithAdaptive(basePolicy, rawPolicy) {
-  return {
-    ...basePolicy,
-    adaptive: normalizeAdaptiveRouting(rawPolicy?.adaptive),
-  };
-}
-
-function normalizeCanonical(raw) {
-  const base = legacy.getCanonical(raw);
-  const providerMode = legacy.normalizeWorkerProviderMode(base.worker?.provider_mode);
-  const canonical = {
-    ...base,
-    execution: {
-      ...base.execution,
-      // There is one global dispatch permission. `execution.enabled` is a
-      // canonical mirror of the top-level switch, never a second authority.
-      enabled: base.subagents_enabled,
-    },
-    worker: {
-      ...base.worker,
-      provider_mode: providerMode,
-      model_policy: modelPolicyWithAdaptive(base.worker.model_policy, raw?.worker?.model_policy),
-    },
-    review: {
-      ...base.review,
-      // v0.3 still exposes one Worker Provider selector. Until per-role
-      // provider modes become first-class, keep both roles aligned.
-      provider_mode: providerMode,
-      model_policy: modelPolicyWithAdaptive(base.review.model_policy, raw?.review?.model_policy),
-    },
-  };
-  canonical.legacy = normalizeLegacySnapshot(raw, canonical);
-  return canonical;
-}
-
-function proMirror(canonical) {
-  const escalation = canonical.worker.model_policy;
-  const reviewer = canonical.review.model_policy;
-  if (escalation.escalation_priority_configured || escalation.escalation_priority.length > 0) {
-    return {
-      priority: escalation.escalation_priority,
-      configured: escalation.escalation_priority_configured,
-      fallback: escalation.fallback,
-    };
-  }
-  return {
-    priority: reviewer.priority,
-    configured: reviewer.priorityConfigured,
-    fallback: reviewer.fallback,
-  };
-}
-
-function legacyRoutingMirror(canonical) {
-  // Legacy tier/UI behavior has its own canonical compatibility sub-domain.
-  // Never infer this back from flat mirrors: schema-v3 `legacy` owns it.
-  return normalizeLegacySnapshot({ legacy: canonical.legacy }, canonical);
-}
-
-/**
- * Re-exported normalizer with schema-v3 precedence.
- *
- * `legacy.normalizeGlobalConfig` remains the import path for legacy-file
- * migration. Once schema v3 is present, flat compatibility fields are rebuilt
- * from the canonical snapshot so a stale/manual mirror cannot override runtime
- * behavior.
- */
-export function normalizeGlobalConfig(raw = {}) {
-  const normalized = legacy.normalizeGlobalConfig(raw);
-  if (!hasCanonicalAuthority(raw)) return normalized;
-
-  const canonical = normalizeCanonical(raw);
-  const pro = proMirror(canonical);
-  const routing = legacyRoutingMirror(canonical);
-  return {
-    ...normalized,
-    config_schema_version: CONFIG_SCHEMA_VERSION,
-    subagents_enabled: canonical.subagents_enabled,
-    main_agent_mode: canonical.main_agent_mode,
-    default_effort: canonical.execution.default_effort,
-    default_timeout_seconds: canonical.execution.default_timeout_seconds,
-    mode: canonical.execution.mode,
-    max_parallel: canonical.execution.max_parallel,
-    isolation: canonical.execution.isolation,
-    collaboration_mode: routing.collaboration_mode,
-    tier_policy: routing.tier_policy,
-    flash_state: routing.flash_state,
-    pro_state: routing.pro_state,
-    worker_state: canonical.worker.state,
-    review_state: canonical.review.state,
-    auto_review: canonical.review.auto_review === true,
-    worker_provider_mode: canonical.worker.provider_mode,
-    flash_model_priority: [...canonical.worker.model_policy.priority],
-    flash_model_priority_configured: canonical.worker.model_policy.priorityConfigured,
-    flash_model_fallback: canonical.worker.model_policy.fallback,
-    pro_model_priority: [...pro.priority],
-    pro_model_priority_configured: pro.configured,
-    pro_model_fallback: pro.fallback,
-    escalate_on_failure: canonical.worker.model_policy.escalation.enabled,
-    pro_reviews_flash: canonical.review.auto_review === true,
-    execution: canonical.execution,
-    worker: canonical.worker,
-    review: canonical.review,
-    legacy: canonical.legacy,
-  };
-}
-
-/**
- * v0.3 model-policy view. The frozen v0.2 resolver remains authoritative for
- * every existing dimension. This facade only adds the normalized opt-in
- * adaptive sub-domain, so direct canonical-ish v0.2 callers retain the exact
- * priority/escalation semantics they had before schema-v3 existed.
- */
-export function resolveModelPolicy(config = {}, role = 'worker', context = {}) {
-  const base = legacy.resolveModelPolicy(config, role, context);
-  const rawPolicy = role === 'reviewer'
-    ? config?.review?.model_policy
-    : config?.worker?.model_policy;
-  return {
-    ...base,
-    adaptive: normalizeAdaptiveRouting(rawPolicy?.adaptive ?? base.adaptive),
-  };
-}
-
-/** Explicit legacy-import normalizer for the persistence layer. */
-export function normalizeLegacyGlobalConfig(raw = {}) {
-  return legacy.normalizeGlobalConfig(raw);
-}
-
-export function configHasCanonicalAuthority(raw = {}) {
-  return hasCanonicalAuthority(raw);
-}
+// v0.3 config-authority facade over the frozen v0.2 policy implementation.
+//
+// The v0.2 module remains byte-for-byte available as policy-legacy.mjs. New
+// callers import this facade. For schema-v3 persisted configs, the nested
+// worker/review/execution/legacy snapshot is authoritative; flat Flash/Pro
+// fields are compatibility mirrors only. Legacy files still flow through the
+// old migration exactly as before.
+
+export * from './policy-legacy.mjs';
+import * as legacy from './policy-legacy.mjs';
+import { normalizeAdaptiveRouting } from './adaptive-routing.mjs';
+
+export { normalizeAdaptiveRouting };
+export const CONFIG_SCHEMA_VERSION = 3;
+
+function validObject(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+function hasCanonicalAuthority(raw) {
+  return Number(raw?.config_schema_version) >= CONFIG_SCHEMA_VERSION
+    && validObject(raw?.worker)
+    && validObject(raw?.review)
+    && validObject(raw?.execution);
+}
+
+function semanticLegacyMode(canonical) {
+  if (canonical.review.auto_review === true && canonical.review.state === 'auto') return 'review-pipeline';
+  if (canonical.worker.state === 'auto' && canonical.review.state === 'disabled'
+      && canonical.worker.model_policy.strategy === 'economy') return 'flash-only';
+  if (canonical.worker.state === 'auto' && canonical.review.state === 'disabled'
+      && canonical.worker.model_policy.strategy === 'quality') return 'pro-only';
+  if (canonical.worker.state === 'auto' && canonical.review.state === 'manual') return 'balanced';
+  return 'custom';
+}
+
+function normalizeLegacySnapshot(raw, canonical) {
+  // A nested v3 legacy snapshot is canonical compatibility metadata. Flat
+  // fields are only a fallback for transitional/pre-v3 inputs.
+  const nested = validObject(raw?.legacy) ? raw.legacy : {};
+  const source = { ...raw, ...nested };
+  const mode = legacy.COLLABORATION_MODES.includes(source.collaboration_mode)
+    ? source.collaboration_mode
+    : semanticLegacyMode(canonical);
+
+  let flash = legacy.TIER_STATES.includes(source.flash_state) ? source.flash_state : undefined;
+  let pro = legacy.TIER_STATES.includes(source.pro_state) ? source.pro_state : undefined;
+  if (mode === 'flash-only') { flash = 'auto'; pro = 'disabled'; }
+  else if (mode === 'pro-only') { flash = 'disabled'; pro = 'auto'; }
+  else if (mode === 'balanced' || mode === 'review-pipeline') { flash = 'auto'; pro = 'auto'; }
+  else {
+    flash ??= canonical.worker.state;
+    // reviewer=manual historically means the Pro tier is available/Auto but
+    // review itself is on-demand. Preserve an explicit nested pro state when
+    // present; otherwise use a conservative compatibility reconstruction.
+    pro ??= canonical.review.state === 'disabled' ? 'disabled' : 'auto';
+  }
+
+  return {
+    collaboration_mode: mode,
+    tier_policy: mode === 'flash-only' ? 'flash-only' : mode === 'pro-only' ? 'pro-only' : 'auto',
+    flash_state: flash,
+    pro_state: pro,
+  };
+}
+
+function modelPolicyWithAdaptive(basePolicy, rawPolicy) {
+  return {
+    ...basePolicy,
+    adaptive: normalizeAdaptiveRouting(rawPolicy?.adaptive),
+  };
+}
+
+function normalizeCanonical(raw) {
+  const base = legacy.getCanonical(raw);
+  const providerMode = legacy.normalizeWorkerProviderMode(base.worker?.provider_mode);
+  const canonical = {
+    ...base,
+    execution: {
+      ...base.execution,
+      // There is one global dispatch permission. `execution.enabled` is a
+      // canonical mirror of the top-level switch, never a second authority.
+      enabled: base.subagents_enabled,
+    },
+    worker: {
+      ...base.worker,
+      provider_mode: providerMode,
+      model_policy: modelPolicyWithAdaptive(base.worker.model_policy, raw?.worker?.model_policy),
+    },
+    review: {
+      ...base.review,
+      // v0.3 still exposes one Worker Provider selector. Until per-role
+      // provider modes become first-class, keep both roles aligned.
+      provider_mode: providerMode,
+      model_policy: modelPolicyWithAdaptive(base.review.model_policy, raw?.review?.model_policy),
+    },
+  };
+  canonical.legacy = normalizeLegacySnapshot(raw, canonical);
+  return canonical;
+}
+
+function proMirror(canonical) {
+  const escalation = canonical.worker.model_policy;
+  const reviewer = canonical.review.model_policy;
+  if (escalation.escalation_priority_configured || escalation.escalation_priority.length > 0) {
+    return {
+      priority: escalation.escalation_priority,
+      configured: escalation.escalation_priority_configured,
+      fallback: escalation.fallback,
+    };
+  }
+  return {
+    priority: reviewer.priority,
+    configured: reviewer.priorityConfigured,
+    fallback: reviewer.fallback,
+  };
+}
+
+function legacyRoutingMirror(canonical) {
+  // Legacy tier/UI behavior has its own canonical compatibility sub-domain.
+  // Never infer this back from flat mirrors: schema-v3 `legacy` owns it.
+  return normalizeLegacySnapshot({ legacy: canonical.legacy }, canonical);
+}
+
+/**
+ * Re-exported normalizer with schema-v3 precedence.
+ *
+ * `legacy.normalizeGlobalConfig` remains the import path for legacy-file
+ * migration. Once schema v3 is present, flat compatibility fields are rebuilt
+ * from the canonical snapshot so a stale/manual mirror cannot override runtime
+ * behavior.
+ */
+export function normalizeGlobalConfig(raw = {}) {
+  const normalized = legacy.normalizeGlobalConfig(raw);
+  if (!hasCanonicalAuthority(raw)) return normalized;
+
+  const canonical = normalizeCanonical(raw);
+  const pro = proMirror(canonical);
+  const routing = legacyRoutingMirror(canonical);
+  return {
+    ...normalized,
+    config_schema_version: CONFIG_SCHEMA_VERSION,
+    subagents_enabled: canonical.subagents_enabled,
+    main_agent_mode: canonical.main_agent_mode,
+    default_effort: canonical.execution.default_effort,
+    default_timeout_seconds: canonical.execution.default_timeout_seconds,
+    mode: canonical.execution.mode,
+    max_parallel: canonical.execution.max_parallel,
+    isolation: canonical.execution.isolation,
+    collaboration_mode: routing.collaboration_mode,
+    tier_policy: routing.tier_policy,
+    flash_state: routing.flash_state,
+    pro_state: routing.pro_state,
+    worker_state: canonical.worker.state,
+    review_state: canonical.review.state,
+    auto_review: canonical.review.auto_review === true,
+    worker_provider_mode: canonical.worker.provider_mode,
+    flash_model_priority: [...canonical.worker.model_policy.priority],
+    flash_model_priority_configured: canonical.worker.model_policy.priorityConfigured,
+    flash_model_fallback: canonical.worker.model_policy.fallback,
+    pro_model_priority: [...pro.priority],
+    pro_model_priority_configured: pro.configured,
+    pro_model_fallback: pro.fallback,
+    escalate_on_failure: canonical.worker.model_policy.escalation.enabled,
+    pro_reviews_flash: canonical.review.auto_review === true,
+    execution: canonical.execution,
+    worker: canonical.worker,
+    review: canonical.review,
+    legacy: canonical.legacy,
+  };
+}
+
+/**
+ * v0.3 model-policy view. The frozen v0.2 resolver remains authoritative for
+ * every existing dimension. This facade only adds the normalized opt-in
+ * adaptive sub-domain, so direct canonical-ish v0.2 callers retain the exact
+ * priority/escalation semantics they had before schema-v3 existed.
+ */
+export function resolveModelPolicy(config = {}, role = 'worker', context = {}) {
+  const base = legacy.resolveModelPolicy(config, role, context);
+  const rawPolicy = role === 'reviewer'
+    ? config?.review?.model_policy
+    : config?.worker?.model_policy;
+  return {
+    ...base,
+    adaptive: normalizeAdaptiveRouting(rawPolicy?.adaptive ?? base.adaptive),
+  };
+}
+
+/** Explicit legacy-import normalizer for the persistence layer. */
+export function normalizeLegacyGlobalConfig(raw = {}) {
+  return legacy.normalizeGlobalConfig(raw);
+}
+
+export function configHasCanonicalAuthority(raw = {}) {
+  return hasCanonicalAuthority(raw);
+}