@ran-sh/dsh-crew 0.5.4 → 0.5.5

package/src/runtime-identity.mjs

@@ -8,7 +8,7 @@
 // Keep this module pure and dependency-free so Hub, MCP and tests all use the
 // exact same compatibility rules.
 
-export const RUNTIME_VERSION = '0.5.4';
+export const RUNTIME_VERSION = '0.5.5';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/server.mjs

@@ -26,9 +26,9 @@ import { buildReviewTask } from './information-flow.mjs';
 import { projectWorkflowView } from './job-contracts.mjs';
 import { loadRoleProfiles, resolveRoleProfile } from './role-profiles.mjs';
 import { loadWorkspaceContexts, resolveWorkspaceContext, buildWorkspaceTask, addContextReferences, isSafeBranchName } from './workspace-context.mjs';
-import { buildExtensionContract } from './extension-contract.mjs';
-import { assessWorkspaceReadiness } from './workspace-readiness.mjs';
-import { detectOrchestrator } from './orchestrator.mjs';
+import { buildExtensionContract } from './extension-contract.mjs';
+import { assessWorkspaceReadiness } from './workspace-readiness.mjs';
+import { detectOrchestrator } from './orchestrator.mjs';
 
 const server = new McpServer({ name: 'dsh-crew', version: RUNTIME_VERSION });
 
@@ -45,11 +45,11 @@ const workspaceSchema = z.object({
   branch: z.string().refine(isSafeBranchName, 'invalid git branch name').optional(),
   worktree: z.enum(['auto', 'existing', 'none']).optional(),
 }).optional().describe('Per-job workspace overrides. auto isolates coding Workers; existing/none use the supplied workspace.');
-const constraintsSchema = z.object({
-  timeout_seconds: z.number().int().positive().max(7200).optional(),
-  allow_fallback: z.boolean().optional(),
-  allow_no_changes: z.boolean().optional().describe('Explicitly allow a verified read-only or analysis job to succeed with zero workspace changes.'),
-}).optional().describe('Per-job constraints override profile and session defaults.');
+const constraintsSchema = z.object({
+  timeout_seconds: z.number().int().positive().max(7200).optional(),
+  allow_fallback: z.boolean().optional(),
+  allow_no_changes: z.boolean().optional().describe('Explicitly allow a verified read-only or analysis job to succeed with zero workspace changes.'),
+}).optional().describe('Per-job constraints override profile and session defaults.');
 
 // Session-level configuration. This MCP server process lives exactly as long
 // as one Claude Code / Codex session, so plain memory IS session scope.
@@ -125,7 +125,7 @@ function text(obj) {
   return { content: [{ type: 'text', text: typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2) }] };
 }
 
-const ORCHESTRATOR = detectOrchestrator();
+const ORCHESTRATOR = detectOrchestrator();
 
 function policyRejection(decision) {
   return text({
@@ -222,10 +222,10 @@ function prepareDispatch({ task, role, tier, legacy_tier, effort, cwd, timeout_s
       profile_id: resolvedProfile.profile_id,
       requested_isolation: requestedIsolation,
       workspace_branch: workspaceOverride?.branch ?? withRefs.context?.default_branch ?? null,
-      timeout_seconds: effectiveTimeout,
-      allow_fallback: constraints?.allow_fallback ?? profileValue.fallback,
-      allow_no_changes: constraints?.allow_no_changes === true,
-      routing: profileValue.routing,
+      timeout_seconds: effectiveTimeout,
+      allow_fallback: constraints?.allow_fallback ?? profileValue.fallback,
+      allow_no_changes: constraints?.allow_no_changes === true,
+      routing: profileValue.routing,
       review_strictness: profileValue.review_strictness,
       workspace_context: withRefs.context,
     },
@@ -324,12 +324,12 @@ async function buildConfigReport() {
   const hubCompatibility = await hubStatus({ force: true });
   let effectiveWorkerProvider = null;
   let effectiveWorkerSelection = { flash: null, pro: null };
-  let providerResolutionError;
-  let providerCatalogChecked = false;
-  let providerCatalogBody = null;
-  let hubJobsChecked = false;
-  let hubJobsBody = null;
-  const workerProviderMode = globalConfig.worker_provider_mode ?? 'deepseek-official';
+  let providerResolutionError;
+  let providerCatalogChecked = false;
+  let providerCatalogBody = null;
+  let hubJobsChecked = false;
+  let hubJobsBody = null;
+  const workerProviderMode = globalConfig.worker_provider_mode ?? 'deepseek-official';
   if (workerProviderMode === 'deepseek-official') {
     effectiveWorkerSelection = {
       flash: { provider: 'deepseek-official', model: 'deepseek-v4-flash', source: 'legacy-strict' },
@@ -338,7 +338,7 @@ async function buildConfigReport() {
   } else if (hubCompatibility.compatible) {
     try {
       providerCatalogChecked = true;
-      const res = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/models`);
+      const res = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/models`, { signal: AbortSignal.timeout(800) });
       const body = await res.json();
       providerCatalogBody = body;
       if (!body?.ok) providerResolutionError = body?.error ?? 'Unable to read Harness model catalog.';
@@ -359,27 +359,27 @@ async function buildConfigReport() {
       providerCatalogChecked = true;
       providerResolutionError = err?.message ?? String(err);
     }
-  } else if (hubCompatibility.reachable) {
-    providerResolutionError = hubCompatibilityMessage(hubCompatibility);
-  }
-  if (hubCompatibility.compatible) {
-    try {
-      hubJobsChecked = true;
-      const jobsRes = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/jobs`, { signal: AbortSignal.timeout(800) });
-      hubJobsBody = await jobsRes.json();
-    } catch {
-      hubJobsChecked = true;
-    }
-  }
-  effectiveWorkerProvider = effectiveWorkerSelection.flash?.provider ?? null;
-  const readinessMatrix = buildConfigReadinessMatrix({
+  } else if (hubCompatibility.reachable) {
+    providerResolutionError = hubCompatibilityMessage(hubCompatibility);
+  }
+  if (hubCompatibility.compatible) {
+    try {
+      hubJobsChecked = true;
+      const jobsRes = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/jobs`, { signal: AbortSignal.timeout(800) });
+      hubJobsBody = await jobsRes.json();
+    } catch {
+      hubJobsChecked = true;
+    }
+  }
+  effectiveWorkerProvider = effectiveWorkerSelection.flash?.provider ?? null;
+  const readinessMatrix = buildConfigReadinessMatrix({
     hubCompatibility,
     workerProviderMode,
-    providerCatalogChecked,
-    providerCatalogBody,
-    hubJobsChecked,
-    hubJobsBody,
-  });
+    providerCatalogChecked,
+    providerCatalogBody,
+    hubJobsChecked,
+    hubJobsBody,
+  });
   const roleProfiles = loadRoleProfiles();
   const workspaceReadiness = await assessWorkspaceReadiness({ cwd: process.cwd() });
   const extensionContract = buildExtensionContract({

package/src/workflow-runtime.mjs

@@ -15,7 +15,7 @@
 // appear here.
 
 import { resolveModelPolicy, shouldAutoReview, getRoleState } from './policy.mjs';
-import { applyWorkspaceEvidence, buildOutcome, decideNextStep, JOB_PHASES, canTransition } from './workflow.mjs';
+import { applyWorkspaceEvidence, buildOutcome, decideNextStep, JOB_PHASES, canTransition } from './workflow.mjs';
 import { parseDeliveryReport } from './delivery.mjs';
 import { classifyFailure } from './failure-classification.mjs';
 import { createCanonicalJobEvent } from './job-contracts.mjs';
@@ -170,10 +170,10 @@ export function createWorkflowRuntime(adapters, {
       requested_isolation: spec.requested_isolation ?? null,
       workspace_branch: spec.workspace_branch ?? null,
       timeout_seconds: spec.timeout_seconds ?? null,
-      profile_id: spec.profile_id ?? null,
-      allow_fallback: spec.allow_fallback !== false,
-      allow_no_changes: spec.allow_no_changes === true,
-      routing: spec.routing ?? 'auto',
+      profile_id: spec.profile_id ?? null,
+      allow_fallback: spec.allow_fallback !== false,
+      allow_no_changes: spec.allow_no_changes === true,
+      routing: spec.routing ?? 'auto',
       review_strictness: spec.review_strictness ?? null,
       workspace_context: spec.workspace_context ? { ...spec.workspace_context } : null,
       effort: spec.effort ?? 'max',
@@ -202,6 +202,8 @@ export function createWorkflowRuntime(adapters, {
       startedAt: now,
       endedAt: null,
       workspaceHandle: null,
+        workspaceReleasePromise: null,
+        cancelPromise: null,
       waiters: [],
     };
     recordCanonical(job, 'job.created', { client_job_id: job.client_job_id }, null, now);
@@ -269,19 +271,26 @@ export function createWorkflowRuntime(adapters, {
       return;
     }
     if (!job.workspaceHandle) return;
-    try {
-      const r = await adapters.releaseWorkspace(job.workspaceHandle);
-      if (!r || r.ok !== true) {
-        // A failed cleanup leaves the isolated workspace in place; say so
-        // truthfully instead of claiming a clean release.
-        job.cleanup_warning = r?.error ?? 'worktree cleanup failed';
+    if (job.workspaceReleasePromise) return job.workspaceReleasePromise;
+    const handle = job.workspaceHandle;
+    job.workspaceReleasePromise = (async () => {
+      try {
+        const r = await adapters.releaseWorkspace(handle);
+        if (!r || r.ok !== true) {
+          // A failed cleanup leaves the isolated workspace in place; say so
+          // truthfully instead of claiming a clean release.
+          job.cleanup_warning = r?.error ?? 'worktree cleanup failed';
+          job.workspace_retained = true;
+        }
+      } catch (err) {
+        job.cleanup_warning = err?.message ?? String(err);
         job.workspace_retained = true;
+      } finally {
+        job.workspaceHandle = null;
+        job.workspaceReleasePromise = null;
       }
-    } catch (err) {
-      job.cleanup_warning = err?.message ?? String(err);
-      job.workspace_retained = true;
-    }
-    job.workspaceHandle = null;
+    })();
+    return job.workspaceReleasePromise;
   }
 
   async function runWorkflow(job) {
@@ -313,6 +322,7 @@ export function createWorkflowRuntime(adapters, {
         const before = alloc?.ok && alloc.isolation === 'worktree' ? await safeCapture(adapters, job.execution_cwd, job.base_revision) : null;
         const reviewTask = adapters.buildReviewTask(job.original_task, null, { strictness: job.review_strictness ?? 'standard' });
         const review = await runReviewerAttempt(job, reviewTask, config, before);
+        if (job.cancelling) { await cancelWorkflow(job); return; }
         job.review = review;
         if (job.review) transition(job, JOB_PHASES.READY, 'review complete');
         finalize(job);
@@ -322,7 +332,7 @@ export function createWorkflowRuntime(adapters, {
       let attempt = 0;
       let escalationReason = null;
       for (;;) {
-        if (job.cancelling) { cancelWorkflow(job); return; }
+        if (job.cancelling) { await cancelWorkflow(job); return; }
         if (attempt > 0) transition(job, JOB_PHASES.RUNNING, `escalated attempt ${attempt}`);
         const resolvedPolicy = resolveModelPolicy(config, 'worker', { attempt });
         const fallbackPolicy = job.allow_fallback === false
@@ -356,7 +366,7 @@ export function createWorkflowRuntime(adapters, {
           },
         });
         job.current_attempt_id = null;
-        if (job.cancelling) { cancelWorkflow(job); return; }
+        if (job.cancelling) { await cancelWorkflow(job); return; }
         const attemptView = attemptRecord(ar, attempt);
         job.attempts.push(attemptView);
         recordCanonical(job, 'model.selected', {
@@ -375,17 +385,17 @@ export function createWorkflowRuntime(adapters, {
           failJob(job, Object.assign(new Error(ar.error ?? 'infrastructure failure'), { code: WORKFLOW_ERROR_CODES.ATTEMPT_INFRA_FAILURE }));
           return;
         }
-        let outcome = ar.outcome ?? buildOutcome({
+        let outcome = ar.outcome ?? buildOutcome({
           result: ar.result ?? '',
           stopReason: ar.stopReason,
           executionStatus: ar.status === 'done' ? 'completed' : 'failed',
         });
         transition(job, JOB_PHASES.VERIFYING, `attempt ${attempt} complete`);
 
-        let workspaceEvidenceAvailable = false;
-        let workspaceHasChanges = false;
-
-        // Capture the latest candidate after every attempt. Capture failure is
+        let workspaceEvidenceAvailable = false;
+        let workspaceHasChanges = false;
+
+        // Capture the latest candidate after every attempt. Capture failure is
         // not allowed to delete the only recoverable state: retain the worktree
         // and preserve the worker business result, while surfacing the warning.
         if (alloc?.ok && alloc.isolation === 'worktree') {
@@ -395,23 +405,23 @@ export function createWorkflowRuntime(adapters, {
             job.retain_workspace = true;
             job.candidate = null;
             job.events.push({ at: clock(), phase: job.phase, type: 'candidate/failed', attempt, message: 'candidate capture failed; worktree retained for recovery' });
-          } else {
-            job.candidate = candidate;
-            attemptView.candidate_fingerprint = candidate.fingerprint ?? null;
-            workspaceEvidenceAvailable = true;
-            workspaceHasChanges = Array.isArray(candidate.changed_files) && candidate.changed_files.length > 0;
-            if (candidate.complete === false || candidate.replayable === false) {
+          } else {
+            job.candidate = candidate;
+            attemptView.candidate_fingerprint = candidate.fingerprint ?? null;
+            workspaceEvidenceAvailable = true;
+            workspaceHasChanges = Array.isArray(candidate.changed_files) && candidate.changed_files.length > 0;
+            if (candidate.complete === false || candidate.replayable === false) {
               job.retain_workspace = true;
               job.events.push({ at: clock(), phase: job.phase, type: 'candidate/incomplete', attempt, message: 'candidate is not fully replayable; worktree retained' });
             }
-          }
-        }
-        outcome = applyWorkspaceEvidence(outcome, {
-          evidenceAvailable: workspaceEvidenceAvailable,
-          hasChanges: workspaceHasChanges,
-          allowNoChanges: job.allow_no_changes,
-        });
-        job.outcome = outcome;
+          }
+        }
+        outcome = applyWorkspaceEvidence(outcome, {
+          evidenceAvailable: workspaceEvidenceAvailable,
+          hasChanges: workspaceHasChanges,
+          allowNoChanges: job.allow_no_changes,
+        });
+        job.outcome = outcome;
 
         const reviewRequested = !isReviewJob && shouldAutoReview(config);
         const reviewerAuto = getRoleState(config, 'reviewer') !== 'disabled';
@@ -419,7 +429,7 @@ export function createWorkflowRuntime(adapters, {
         job.decision = { step: decision.step, phase: decision.phase, reason: decision.reason };
         job.events.push({ at: clock(), phase: job.phase, type: 'attempt/complete', attempt, decision: decision.step });
 
-        if (job.cancelling) { cancelWorkflow(job); return; }
+        if (job.cancelling) { await cancelWorkflow(job); return; }
         if (decision.step === 'fail') {
           const finalAttemptCode = ar.status === 'failed' ? attemptView.error_code : null;
           failJob(job, Object.assign(new Error(`workflow failed: ${decision.reason}`), { code: finalAttemptCode }));
@@ -441,6 +451,7 @@ export function createWorkflowRuntime(adapters, {
           const before = job.candidate;
           const reviewTask = adapters.buildReviewTask(job.original_task, { outcome, candidate: job.candidate ?? null }, { strictness: job.review_strictness ?? 'standard' });
           const review = await runReviewerAttempt(job, reviewTask, config, before, job.execution_cwd, job.base_revision);
+        if (job.cancelling) { await cancelWorkflow(job); return; }
           job.review = review;
           transition(job, JOB_PHASES.READY, decision.reason);
           finalize(job);
@@ -451,7 +462,7 @@ export function createWorkflowRuntime(adapters, {
         return;
       }
     } catch (err) {
-      if (job.cancelling) { cancelWorkflow(job); return; }
+      if (job.cancelling) { await cancelWorkflow(job); return; }
       failJob(job, err);
     } finally {
       await releaseWorkspace(job);
@@ -546,17 +557,24 @@ export function createWorkflowRuntime(adapters, {
   }
 
   function cancelWorkflow(job) {
+    if (job.cancelPromise) return job.cancelPromise;
     if (job.status !== 'running') return;
-    job.cancelling = true;
-    job.events.push({ at: clock(), phase: job.phase, type: 'cancel' });
-    const activeAttempt = job.current_attempt_id;
-    if (activeAttempt) adapters.cancelAttempt?.(activeAttempt).catch(() => {});
-    job.phase = JOB_PHASES.CANCELLED;
-    job.status = 'cancelled';
-    recordCanonical(job, 'job.cancelled', { active_attempt_id: activeAttempt ?? null });
-    job.endedAt = clock();
-    job.current_attempt_id = null;
-    for (const w of job.waiters.splice(0)) w();
+    job.cancelPromise = (async () => {
+      job.cancelling = true;
+      job.events.push({ at: clock(), phase: job.phase, type: 'cancel' });
+      const activeAttempt = job.current_attempt_id;
+      if (activeAttempt) {
+        try { await adapters.cancelAttempt?.(activeAttempt); } catch {}
+      }
+      await releaseWorkspace(job);
+      job.phase = JOB_PHASES.CANCELLED;
+      job.status = 'cancelled';
+      recordCanonical(job, 'job.cancelled', { active_attempt_id: activeAttempt ?? null });
+      job.endedAt = clock();
+      job.current_attempt_id = null;
+      for (const w of job.waiters.splice(0)) w();
+    })();
+    return job.cancelPromise;
   }
 
   function workflowView(job, { withResult = false } = {}) {
@@ -579,9 +597,9 @@ export function createWorkflowRuntime(adapters, {
       current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
       model_class_hint: job.model_class_hint,
       source: job.source,
-      profile_id: job.profile_id,
-      allow_no_changes: job.allow_no_changes,
-      routing: job.routing,
+      profile_id: job.profile_id,
+      allow_no_changes: job.allow_no_changes,
+      routing: job.routing,
       workspace_context: job.workspace_context ? { ...job.workspace_context } : null,
       workspace_branch: job.workspace_branch,
       timeout_seconds: job.timeout_seconds,
@@ -660,9 +678,9 @@ export function createWorkflowRuntime(adapters, {
   async function cancel(id) {
     const job = jobs.get(id);
     if (!job) return undefined;
-    cancelWorkflow(job);
     const qi = queue.indexOf(job);
     if (qi !== -1) queue.splice(qi, 1);
+    await cancelWorkflow(job);
     return workflowView(job);
   }
 

package/src/workspace-isolation.mjs

@@ -12,7 +12,7 @@
 
 import { execFile } from 'node:child_process';
 import { existsSync, rmSync } from 'node:fs';
-import { readFile } from 'node:fs/promises';
+import { readFile, lstat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve, basename } from 'node:path';
 import { randomBytes, createHash } from 'node:crypto';
@@ -106,6 +106,21 @@ function splitFirstTab(line) {
   return i === -1 ? [line, ''] : [line.slice(0, i), line.slice(i + 1)];
 }
 
+async function firstLinkComponent(cwd, relPath) {
+  let current = resolve(cwd);
+  const segments = String(relPath ?? '').replace(/\\/g, '/').split('/').filter(Boolean);
+  for (let i = 0; i < segments.length; i += 1) {
+    current = join(current, segments[i]);
+    try {
+      const st = await lstat(current);
+      if (st.isSymbolicLink()) return segments.slice(0, i + 1).join('/');
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
 async function buildCandidatePatch(run, { cwd, base, nameStatus, untracked, limit }) {
   const tracked = [];
   const sensitive = new Set();
@@ -125,6 +140,8 @@ async function buildCandidatePatch(run, { cwd, base, nameStatus, untracked, limi
   let out = '';
   const redacted = [];
   const incompleteReasons = [];
+  const untrackedFiles = [];
+  const seenLinks = new Set();
   if (tracked.length > 0) {
     const r = await runGit(run, ['diff', '--binary', base, '--', ...tracked], { cwd });
     if (!r.ok) return { failed: true, reason: r.reason, error: r.error };
@@ -137,6 +154,20 @@ async function buildCandidatePatch(run, { cwd, base, nameStatus, untracked, limi
   if (redacted.length > 0) incompleteReasons.push('sensitive_content_redacted');
 
   for (const p of untracked) {
+    // Walk every path component with lstat so a symlink/junction anywhere in
+    // the path is never followed. Out-of-worktree targets are treated as
+    // non-replayable; only the link boundary is exposed.
+    const link = await firstLinkComponent(cwd, p);
+    if (link) {
+      if (!seenLinks.has(link)) {
+        seenLinks.add(link);
+        untrackedFiles.push(link);
+        out += `[UNTRACKED SYMLINK: ${link}]\n`;
+        incompleteReasons.push(`untracked_symlink:${link}`);
+      }
+      continue;
+    }
+    untrackedFiles.push(p);
     if (isSensitivePath(p)) {
       redacted.push(p);
       out += `[REDACTED SENSITIVE FILE: ${p} (untracked)]\n`;
@@ -154,13 +185,16 @@ async function buildCandidatePatch(run, { cwd, base, nameStatus, untracked, limi
     if (!next.complete) incompleteReasons.push(next.reason ?? `untracked_unreplayable:${p}`);
   }
 
+  // Fingerprint identity must represent the complete pre-truncation workspace
+  // diff, not the truncated patch bytes that are actually retained.
+  const workspaceDigest = createHash('sha256').update(out).digest('hex');
   const truncated = Buffer.byteLength(out, 'utf8') > limit;
   if (truncated) {
     out = Buffer.from(out, 'utf8').subarray(0, limit).toString('utf8');
     incompleteReasons.push('patch_truncated');
   }
   const complete = incompleteReasons.length === 0;
-  return { failed: false, patch: out, truncated, redacted, complete, incompleteReasons };
+  return { failed: false, patch: out, truncated, redacted, complete, incompleteReasons, untrackedFiles, workspaceDigest };
 }
 
 async function safeNewFilePatch(relPath, absPath) {
@@ -180,8 +214,8 @@ async function safeNewFilePatch(relPath, absPath) {
   }
 }
 
-function candidateFingerprint({ base, nameStatus, patch }) {
-  return createHash('sha256').update(`${base}\n${nameStatus ?? ''}\n${patch ?? ''}`).digest('hex');
+function candidateFingerprint({ base, nameStatus, workspaceDigest }) {
+  return createHash('sha256').update(`${base}\n${nameStatus ?? ''}\n${workspaceDigest ?? ''}`).digest('hex');
 }
 
 export async function captureCandidate({ worktreePath, baseRevision, git, limit = DIFF_LIMIT } = {}) {
@@ -204,6 +238,8 @@ export async function captureCandidate({ worktreePath, baseRevision, git, limit
   const built = await buildCandidatePatch(run, { cwd: worktreePath, base, nameStatus: nameStatus.stdout, untracked, limit });
   if (built.failed) return { ok: false, reason: built.reason ?? CANDIDATE_CAPTURE_FAILED, error: built.error };
 
+  const untrackedFiles = built.untrackedFiles ?? untracked;
+
   const nameStatusOut = nameStatus.stdout;
   return {
     ok: true,
@@ -211,17 +247,17 @@ export async function captureCandidate({ worktreePath, baseRevision, git, limit
     base_revision: base,
     committed_head: head.ok ? head.stdout.trim() : null,
     worktree_path: worktreePath,
-    changed_files: [...new Set([...trackedIn(nameStatusOut, untracked), ...built.redacted, ...untracked])],
+    changed_files: [...new Set([...trackedIn(nameStatusOut, untrackedFiles), ...built.redacted, ...untrackedFiles])],
     name_status: nameStatusOut,
     diff_stat: statRel.stdout,
     patch: built.patch,
     patch_truncated: built.truncated,
     sensitive_paths_redacted: built.redacted,
-    untracked_files: untracked,
+    untracked_files: untrackedFiles,
     complete: built.complete,
     replayable: built.complete,
     incomplete_reasons: built.incompleteReasons,
-    fingerprint: candidateFingerprint({ base, nameStatus: nameStatusOut, patch: built.patch }),
+    fingerprint: candidateFingerprint({ base, nameStatus: nameStatusOut, workspaceDigest: built.workspaceDigest }),
     candidate_commit: null,
   };
 }