@ran-sh/dsh-crew 0.5.5 → 0.5.7

package/src/hub-client.mjs

@@ -113,8 +113,26 @@ export function hubRequestError(body, status) {
   return err;
 }
 
-async function call(path, init) {
-  const res = await fetch(`${API}${path}`, init);
+// Transport deadlines: every Hub call is bounded so a wedged local HTTP
+// exchange can never outlive the workflow timeout contract. Long polls get
+// their requested wait plus grace; spawn gets a wider bound because worktree
+// creation can clone sizeable repositories. The env override exists for
+// deterministic deadline tests; production defaults stay at 10s.
+const ENV_TIMEOUT_MS = Number(process.env.DSH_CREW_HUB_TIMEOUT_MS);
+const DEFAULT_TIMEOUT_MS = Number.isInteger(ENV_TIMEOUT_MS) && ENV_TIMEOUT_MS > 0 ? ENV_TIMEOUT_MS : 10_000;
+const SPAWN_TIMEOUT_MS = Math.max(DEFAULT_TIMEOUT_MS, 60_000);
+const LONG_POLL_GRACE_MS = 5_000;
+
+async function call(path, init, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  let res;
+  try {
+    res = await fetch(`${API}${path}`, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+  } catch (err) {
+    if (err?.name === 'TimeoutError' || err?.name === 'AbortError') {
+      throw hubRequestError({ error: `hub request timed out after ${timeoutMs}ms` }, 0);
+    }
+    throw err;
+  }
   const body = await res.json();
   if (!res.ok || body.ok === false) throw hubRequestError(body, res.status);
   return body;
@@ -125,8 +143,10 @@ export const hub = {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify(spec),
-  }).then((b) => b.job),
+  }, { timeoutMs: SPAWN_TIMEOUT_MS }).then((b) => b.job),
   list: () => call('/jobs').then((b) => b.jobs),
-  get: (id, waitSeconds = 0) => call(`/jobs/${id}?wait=${waitSeconds}`).then((b) => b.job),
+  get: (id, waitSeconds = 0) => call(`/jobs/${id}?wait=${waitSeconds}`, undefined, {
+    timeoutMs: waitSeconds > 0 ? (waitSeconds * 1000) + LONG_POLL_GRACE_MS : DEFAULT_TIMEOUT_MS,
+  }).then((b) => b.job),
   cancel: (id) => call(`/jobs/${id}/cancel`, { method: 'POST' }).then((b) => b.job),
 };

package/src/hub-compatibility.mjs

@@ -13,9 +13,16 @@ export function hubCompatibilityMessage(status = {}) {
   return `DSH workers hub is reachable but incompatible (${code}${detail}). Update/restart the Hub plugin before using Hub execution.`;
 }
 
-export function resolveHubExecutionMode(requestedMode = 'auto', status = {}) {
-  if (requestedMode === 'standalone') {
-    return { ok: true, mode: 'standalone', reason: 'explicit-standalone' };
+export function resolveHubExecutionMode(requestedMode = 'auto', status = {}, { productionOnly = false } = {}) {
+  if (requestedMode === 'standalone') {
+    if (productionOnly) {
+      return {
+        ok: false,
+        code: 'STANDALONE_EXECUTION_DISABLED',
+        error: 'Standalone execution is disabled for the production 3210 Crew transport.',
+      };
+    }
+    return { ok: true, mode: 'standalone', reason: 'explicit-standalone' };
   }
 
   if (status.compatible === true) {
@@ -31,16 +38,25 @@ export function resolveHubExecutionMode(requestedMode = 'auto', status = {}) {
     };
   }
 
-  if (requestedMode === 'hub') {
+  if (requestedMode === 'hub') {
     return {
       ok: false,
       code: status.code ?? HUB_COMPATIBILITY_CODES.UNREACHABLE,
       error: 'Session mode is "hub" but the DSH workers hub is not reachable.',
       hub: status,
     };
-  }
-
-  return {
+  }
+
+  if (productionOnly) {
+    return {
+      ok: false,
+      code: status.code ?? HUB_COMPATIBILITY_CODES.UNREACHABLE,
+      error: `Production 3210 Crew transport is unavailable (${status.code ?? HUB_COMPATIBILITY_CODES.UNREACHABLE}).`,
+      hub: status,
+    };
+  }
+
+  return {
     ok: true,
     mode: 'standalone',
     reason: 'hub-unreachable-fallback',

package/src/install/install.mjs

@@ -93,12 +93,12 @@ function legacySnapshotFrom(config = {}) {
   };
 }
 
-function attachReadMetadata(config, { version, canonical }) {
-  return {
+function attachReadMetadata(config, { version, canonical }) {
+  return {
     ...config,
     config_schema_version: version,
-    config_authority: canonical ? 'canonical' : 'legacy-import',
-    config_migration_required: !canonical,
+    config_authority: canonical ? 'canonical' : 'legacy-import',
+    config_migration_required: !canonical || version < CONFIG_SCHEMA_VERSION,
     config_activation: runtimeActivationMetadata(),
   };
 }

package/src/install/npx-lifecycle.mjs

@@ -31,6 +31,7 @@ import {
   readFileSync,
   realpathSync,
   rmSync,
+  copyFileSync,
   writeFileSync,
 } from 'node:fs';
 import { createRequire } from 'node:module';
@@ -52,6 +53,21 @@ export const CURRENT_POINTER_FILENAME = 'current.json';
 export const KEEP_RELEASES = 2;
 export const INCOMPLETE_MARKER = '.dsh-crew-incomplete';
 
+export function npmCliInvocation(args, {
+  platform = process.platform,
+  environment = process.env,
+} = {}) {
+  if (platform !== 'win32') return { command: 'npm', args: [...args] };
+  const unsafe = args.find((arg) => /[\0\r\n"%!^&|<>]/.test(String(arg)));
+  if (unsafe !== undefined) throw new Error(`unsafe npm argument: ${unsafe}`);
+  const commandLine = ['npm.cmd', ...args.map((arg) => `"${String(arg)}"`)].join(' ');
+  return {
+    command: environment.ComSpec || environment.COMSPEC || 'cmd.exe',
+    args: ['/d', '/s', '/c', commandLine],
+    windowsVerbatimArguments: true,
+  };
+}
+
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
 export function crewAppRoot({ home = homedir() } = {}) {
@@ -218,12 +234,17 @@ export function copyProductionDependencyTree({
 }
 
 function defaultNpmInstaller(stageRoot, log) {
-  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-  const result = spawnSync(npm, [
+  const npmArgs = [
     'install', '--prefix', stageRoot,
     '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund',
     '--no-package-lock', '--loglevel=error',
-  ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], shell: process.platform === 'win32', timeout: 600_000, windowsHide: true, env: sanitizedPackageManagerEnv() });
+  ];
+  const invocation = npmCliInvocation(npmArgs);
+  const result = spawnSync(invocation.command, invocation.args, {
+    encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 600_000,
+    windowsHide: true, windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+    env: sanitizedPackageManagerEnv(),
+  });
   if (result.status !== 0) {
     log(`- npm fallback install failed (${result.status}): ${(result.stderr || result.stdout || '').trim().slice(-300)}`);
     return false;
@@ -549,30 +570,30 @@ async function activateRelease({ home, releaseDir, manifest, log, installer }) {
   }
   log(`✓ Harness plugin registered (dedicated dsh-crew profile → ${releaseDir})`);
 
-  const codex = installer.installCodex({ home, root: releaseDir });
+  const codex = installer.installCodex({ home, root: releaseDir });
   if (codex.ok === false) {
     log(`✗ Codex Desktop integration failed: ${(codex.actions ?? []).join('; ')}`);
     return false;
   }
-  log('✓ Codex Desktop integration');
-
-  if (installer.installZCode) {
-    const zcode = installer.installZCode({ home, root: releaseDir });
-    if (zcode.ok === false) {
-      log(`✗ ZCode integration failed (${zcode.code ?? 'unknown'})`);
-      return false;
-    }
-    log('✓ ZCode integration');
-  }
-
-  const startup = installer.installWindowsStartup?.({ home, root: releaseDir });
-  if (startup?.ok === false) {
-    log(`✗ Windows login startup failed (${startup.code ?? 'unknown'})`);
-    return false;
-  }
-  if (startup?.supported) log('✓ Windows login startup');
-
-  const claude = await installer.installClaudeCode({ home, root: releaseDir });
+  log('✓ Codex Desktop integration');
+
+  if (installer.installZCode) {
+    const zcode = installer.installZCode({ home, root: releaseDir });
+    if (zcode.ok === false) {
+      log(`✗ ZCode integration failed (${zcode.code ?? 'unknown'})`);
+      return false;
+    }
+    log('✓ ZCode integration');
+  }
+
+  const startup = installer.installWindowsStartup?.({ home, root: releaseDir });
+  if (startup?.ok === false) {
+    log(`✗ Windows login startup failed (${startup.code ?? 'unknown'})`);
+    return false;
+  }
+  if (startup?.supported) log('✓ Windows login startup');
+
+  const claude = await installer.installClaudeCode({ home, root: releaseDir });
   if (claude.ok === false) {
     log(`✗ Claude Code integration failed`);
     return false;
@@ -680,8 +701,14 @@ export const UPDATE_DEFAULT_SPEC = `${UPDATE_PACKAGE_NAME}@latest`;
  */
 export function extractPackageTarball(tgzPath, destDir, { runner = spawnSync } = {}) {
   mkdirSync(destDir, { recursive: true });
-  const result = runner('tar', ['-xzf', String(tgzPath), '-C', destDir], {
-    encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true,
+  // GNU tar interprets a `C:\...` argument as a remote rsh host ("Cannot
+  // connect to C:"), so anchor the invocation inside destDir and pass the
+  // archive by basename: every argument stays colon-free for both bsdtar
+  // (Windows 10+) and GNU tar, whatever PATH resolves first.
+  const localArchive = join(destDir, 'candidate.tgz');
+  copyFileSync(tgzPath, localArchive);
+  const result = runner('tar', ['-xzf', 'candidate.tgz'], {
+    encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, cwd: destDir,
   });
   const root = join(destDir, 'package');
   if (result.status !== 0 || !existsSync(join(root, 'package.json'))) {
@@ -759,12 +786,14 @@ export function resolveUpdateCandidate({
   mkdirSync(tmpDir, { recursive: true });
   try {
     const effectiveSpec = process.env.DSH_CREW_UPDATE_SPEC ?? spec;
-    const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
     const packArgs = ['pack', effectiveSpec, '--pack-destination', tmpDir, '--json', '--loglevel=error'];
     log(`- resolving update candidate from the configured npm registry (${effectiveSpec})`);
-    const packed = runner(npm, packArgs, {
-      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], shell: process.platform === 'win32',
-      timeout: 600_000, windowsHide: true, env: sanitizedPackageManagerEnv(),
+    const invocation = npmCliInvocation(packArgs);
+    const packed = runner(invocation.command, invocation.args, {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 600_000, windowsHide: true,
+      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+      env: sanitizedPackageManagerEnv(),
     });
     if (packed.status !== 0) {
       return { ok: false, code: 'REGISTRY_PACK_FAILED', detail: `${effectiveSpec}: ${(packed.stderr || packed.stdout || '').trim().slice(-300)}` };
@@ -960,17 +989,17 @@ export function npxStatus({
     } catch { dshPlugin = 'unknown'; }
   }
 
-  const st = installer.installStatus
-    ? installer.installStatus({ home, root: pointer?.path ?? runningPackageRoot() })
-    : realInstaller.installStatus({ home, root: pointer?.path ?? runningPackageRoot() });
-  const codex = st?.codex?.installed ? 'installed' : 'not installed';
-  const zcode = st?.zcode?.installed ? 'installed' : 'not installed';
-  const claude = st?.claude?.installed ? 'installed' : 'not installed';
+  const st = installer.installStatus
+    ? installer.installStatus({ home, root: pointer?.path ?? runningPackageRoot() })
+    : realInstaller.installStatus({ home, root: pointer?.path ?? runningPackageRoot() });
+  const codex = st?.codex?.installed ? 'installed' : 'not installed';
+  const zcode = st?.zcode?.installed ? 'installed' : 'not installed';
+  const claude = st?.claude?.installed ? 'installed' : 'not installed';
   const official = officialWebIntegrationStatus({ home, releaseDir: pointer?.path });
-  const officialWeb = !official.enabled ? 'disabled' : official.healthy ? 'installed' : 'needs repair';
-  const startupState = installer.windowsStartupStatus?.({ home });
-  const windowsStartup = !startupState?.supported ? 'not supported'
-    : startupState.ready ? 'installed' : startupState.installed ? 'needs repair' : 'not installed';
+  const officialWeb = !official.enabled ? 'disabled' : official.healthy ? 'installed' : 'needs repair';
+  const startupState = installer.windowsStartupStatus?.({ home });
+  const windowsStartup = !startupState?.supported ? 'not supported'
+    : startupState.ready ? 'installed' : startupState.installed ? 'needs repair' : 'not installed';
 
   log(`DSH Crew launcher/candidate: ${candidateVersion ?? 'unknown'}`);
   log(`Installed DSH Crew payload: ${installedLine}`);
@@ -986,10 +1015,10 @@ export function npxStatus({
   }
   log(`DSH plugin: ${dshPlugin} (dedicated dsh-crew profile on 3210)`);
   log(`Official 3080 UI bridge: ${officialWeb}`);
-  log(`Codex Desktop integration: ${codex}`);
-  log(`ZCode integration: ${zcode}`);
-  log(`Claude Code integration: ${claude}`);
-  log(`Windows login startup: ${windowsStartup}`);
+  log(`Codex Desktop integration: ${codex}`);
+  log(`ZCode integration: ${zcode}`);
+  log(`Claude Code integration: ${claude}`);
+  log(`Windows login startup: ${windowsStartup}`);
 
   return {
     ok: true,
@@ -998,11 +1027,11 @@ export function npxStatus({
     installedPath: pointer?.path ?? null,
     dshPlugin,
     officialWeb,
-    codex,
-    zcode,
-    claude,
-    windowsStartup,
-  };
+    codex,
+    zcode,
+    claude,
+    windowsStartup,
+  };
 }
 
 export async function npxUninstall({
@@ -1018,23 +1047,23 @@ export async function npxUninstall({
   const pointer = readCurrentPointer({ home });
   const name = pointer?.name ?? readManifest(runningPackageRoot())?.name;
 
-  const cx = installer.uninstallCodex({ home });
+  const cx = installer.uninstallCodex({ home });
   if (cx.ok !== false) log('✓ Codex Desktop integration removed');
-  else fail('Codex Desktop integration removal failed');
-
-  if (installer.uninstallZCode) {
-    const zc = installer.uninstallZCode({ home });
-    if (zc.ok !== false) log('✓ ZCode integration removed');
-    else fail('ZCode integration removal failed');
-  }
+  else fail('Codex Desktop integration removal failed');
 
-  const cl = installer.uninstallClaudeCode ? await installer.uninstallClaudeCode({ home }) : realInstaller.uninstallClaudeCode({ home });
-  if (cl.ok !== false) log('✓ Claude Code integration removed');
-  else fail('Claude Code integration removal failed');
-
-  const startup = installer.uninstallWindowsStartup?.({ home });
-  if (startup?.ok === false) fail('Windows login startup removal failed');
-  else if (startup?.supported) log('✓ Windows login startup removed');
+  if (installer.uninstallZCode) {
+    const zc = installer.uninstallZCode({ home });
+    if (zc.ok !== false) log('✓ ZCode integration removed');
+    else fail('ZCode integration removal failed');
+  }
+
+  const cl = installer.uninstallClaudeCode ? await installer.uninstallClaudeCode({ home }) : realInstaller.uninstallClaudeCode({ home });
+  if (cl.ok !== false) log('✓ Claude Code integration removed');
+  else fail('Claude Code integration removal failed');
+
+  const startup = installer.uninstallWindowsStartup?.({ home });
+  if (startup?.ok === false) fail('Windows login startup removal failed');
+  else if (startup?.supported) log('✓ Windows login startup removed');
 
   const official = removeOfficialWebIntegration({ home, preserveIntent: !purge, remember: !purge });
   if (!official.ok) fail(`official 3080 bridge removal failed (${official.code ?? 'unknown'})`);
@@ -1081,8 +1110,9 @@ Commands:
   integrate   show Crew inside the official 3080 UI; backend stays isolated on 3210
   detach      remove only the official 3080 bridge; isolated 3210 mode remains available
   status      read-only report of launcher/installed versions and integrations
-  inspect     print the machine-readable extension capability/readiness contract
-  jobs        machine-first job API: list|get|watch|cancel|submit
+  inspect     print the machine-readable extension capability/readiness contract
+  jobs        machine-first job API: list|get|watch|cancel|submit
+  providers   3210 provider lifecycle API: list|delete-plan|delete|rollback|probe
   update      resolve the newest permitted package from the configured npm registry (or
               --candidate), stage and validate it, then activate; idempotent when current
   uninstall   remove the Crew-managed payload, registration, and integrations (config kept)
@@ -1091,7 +1121,11 @@ Options:
   --candidate <path>  update from a local payload directory or packed .tgz instead of the registry
   --after <sequence>  with jobs watch/get: return canonical events after this cursor
   --detail <mode>     with jobs get/watch: compact (default) or full
-  --request <path>    with jobs submit: JSON Job Request document
+  --request <path>    with jobs submit: JSON Job Request document
+  --plan <id>         with providers delete: approved plan id
+  --expected-revision <sha256>  with providers delete: profile revision from delete-plan
+  --replacement-default <id>   with providers delete-plan: replacement Harness Default provider
+  --confirm           with providers delete: confirm the destructive mutation
   --purge             with uninstall: also remove ~/.config/dsh-crew config/backups (destructive)
   --help              show this help
 
@@ -1114,7 +1148,7 @@ export async function npxInspect({
   return { ok: true, extension: body.extension };
 }
 
-export async function npxJobs({
+export async function npxJobs({
   args = [],
   after = 0,
   detail = 'compact',
@@ -1147,15 +1181,129 @@ export async function npxJobs({
   const body = await response.json();
   if (!response.ok || body?.ok === false) throw new Error(body?.error ?? 'Crew jobs API unavailable');
   log(JSON.stringify(body, null, 2));
-  return { ok: true, body };
-}
-
-function normalizeCommand(argv) {
-  const flags = argv.slice(1);
-  let candidate;
-  let after = 0;
-  let detail = 'compact';
-  let request;
+  return { ok: true, body };
+}
+
+/**
+ * Call the isolated 3210 provider lifecycle API. The CLI never parses or
+ * edits Harness YAML itself; the Hub remains the sole mutation authority.
+ */
+export async function npxProviders({
+  args = [],
+  planId,
+  expectedRevision,
+  replacementDefault,
+  confirm = false,
+  purgeOrphanCredentials = false,
+  log = console.log,
+  fetchImpl = globalThis.fetch,
+  readConfig = realInstaller.readGlobalConfig,
+} = {}) {
+  const configuredHubUrl = String(readConfig()?.hub_url ?? 'http://127.0.0.1:3210').replace(/\/$/, '');
+  if (configuredHubUrl !== 'http://127.0.0.1:3210') throw new Error('providers CLI requires the isolated 3210 Crew Hub');
+  const hubUrl = configuredHubUrl;
+  const base = `${hubUrl}/_dsh/dsh-crew/providers`;
+  const action = args[0] ?? 'list';
+  const id = args[1];
+  const options = new Map();
+  for (let index = 2; index < args.length; index += 1) {
+    const value = args[index];
+    if (!value?.startsWith('--')) continue;
+    const [name, inline] = value.split('=', 2);
+    if (name === '--confirm' || name === '--purge-orphan-credentials') options.set(name === '--confirm' ? 'confirm' : name, true);
+    else if (inline !== undefined) options.set(name, inline);
+    else if (args[index + 1] !== undefined) options.set(name, args[++index]);
+  }
+  const resolvedPlan = planId ?? options.get('--plan');
+  const resolvedRevision = expectedRevision ?? options.get('--expected-revision');
+  const resolvedReplacement = replacementDefault ?? options.get('--replacement-default');
+  const resolvedConfirm = confirm === true || options.get('confirm') === true;
+  if (purgeOrphanCredentials === true || options.get('--purge-orphan-credentials') === true) {
+    throw new Error('credential purge requires a separate explicit confirmation flow');
+  }
+  let url = base;
+  let init = { headers: { accept: 'application/json' } };
+  if (action === 'list') {
+    // keep defaults
+  } else if (action === 'delete-plan') {
+    if (!id) throw new Error('providers delete-plan requires a provider id');
+    url = `${base}/${encodeURIComponent(id)}/delete-plan`;
+    init = { method: 'POST', headers: { accept: 'application/json', 'content-type': 'application/json' }, body: JSON.stringify({ ...(resolvedReplacement ? { replacement_default: resolvedReplacement } : {}) }) };
+  } else if (action === 'delete') {
+    if (!id) throw new Error('providers delete requires a provider id');
+    if (!resolvedPlan || !resolvedRevision || !resolvedConfirm) throw new Error('providers delete requires --plan, --expected-revision and --confirm');
+    url = `${base}/${encodeURIComponent(id)}`;
+    init = {
+      method: 'DELETE',
+      headers: { accept: 'application/json', 'content-type': 'application/json' },
+      body: JSON.stringify({ plan_id: resolvedPlan, expected_revision: resolvedRevision, confirm: true }),
+    };
+  } else if (action === 'probe') {
+    if (!id) throw new Error('providers probe requires a provider id');
+    url = `${base}/${encodeURIComponent(id)}/probe`;
+    init = { method: 'POST', headers: { accept: 'application/json', 'content-type': 'application/json' }, body: '{}' };
+  } else if (action === 'rollback') {
+    if (!id) throw new Error('providers rollback requires a provider id');
+    if (!resolvedPlan || !resolvedConfirm) throw new Error('providers rollback requires --plan and --confirm');
+    url = `${base}/${encodeURIComponent(id)}/rollback`;
+    init = { method: 'POST', headers: { accept: 'application/json', 'content-type': 'application/json' }, body: JSON.stringify({ transaction_id: resolvedPlan, confirm: true }) };
+  } else {
+    throw new Error(`unknown providers action: ${action}`);
+  }
+  const response = await fetchImpl(url, init);
+  let body = await response.json();
+  if (!response.ok || body?.ok === false) throw new Error(body?.code ?? body?.error ?? 'Crew provider API unavailable');
+  if (action === 'delete' && body?.restart_required === true && body?.result?.state === 'RESTART_PENDING') {
+    const restartResponse = await fetchImpl('http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart', {
+      method: 'POST',
+      headers: { accept: 'application/json', 'content-type': 'application/json' },
+      body: JSON.stringify({ confirm: true }),
+    });
+    const restartBody = await restartResponse.json();
+    if (!restartResponse.ok || restartBody?.ok !== true) throw new Error(restartBody?.code ?? restartBody?.error ?? 'Crew 3210 restart failed');
+    const verifyUrl = `${base}/${encodeURIComponent(id)}/verify-delete`;
+    const verifyResponse = await fetchImpl(verifyUrl, {
+      method: 'POST',
+      headers: { accept: 'application/json', 'content-type': 'application/json' },
+      body: JSON.stringify({ transaction_id: resolvedPlan, confirm: true }),
+    });
+    const verifyBody = await verifyResponse.json();
+    if (!verifyResponse.ok || verifyBody?.ok !== true) throw new Error(verifyBody?.code ?? verifyBody?.error ?? 'Crew provider deletion verification failed');
+    body = { ...body, restart: restartBody, verification: verifyBody };
+  }
+  if (action === 'rollback' && body?.restart_required === true && body?.state === 'ROLLBACK_PENDING') {
+    const restartResponse = await fetchImpl('http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart', {
+      method: 'POST',
+      headers: { accept: 'application/json', 'content-type': 'application/json' },
+      body: JSON.stringify({ confirm: true }),
+    });
+    const restartBody = await restartResponse.json();
+    if (!restartResponse.ok || restartBody?.ok !== true) throw new Error(restartBody?.code ?? restartBody?.error ?? 'Crew 3210 restart failed');
+    const verifyUrl = `${base}/${encodeURIComponent(id)}/verify-rollback`;
+    const verifyResponse = await fetchImpl(verifyUrl, {
+      method: 'POST',
+      headers: { accept: 'application/json', 'content-type': 'application/json' },
+      body: JSON.stringify({ transaction_id: resolvedPlan, confirm: true }),
+    });
+    const verifyBody = await verifyResponse.json();
+    if (!verifyResponse.ok || verifyBody?.ok !== true) throw new Error(verifyBody?.code ?? verifyBody?.error ?? 'Crew provider rollback verification failed');
+    body = { ...body, restart: restartBody, verification: verifyBody };
+  }
+  log(JSON.stringify(body, null, 2));
+  return { ok: true, body };
+}
+
+function normalizeCommand(argv) {
+  const flags = argv.slice(1);
+  let candidate;
+  let after = 0;
+  let detail = 'compact';
+  let request;
+  let planId;
+  let expectedRevision;
+  let replacementDefault;
+  let confirm = false;
+  let purgeOrphanCredentials = false;
   for (let index = 0; index < flags.length; index += 1) {
     if (flags[index] === '--candidate') {
       candidate = flags[index + 1];
@@ -1177,17 +1325,34 @@ function normalizeCommand(argv) {
       after = Number(flags[index].slice('--after='.length)); flags.splice(index, 1); index -= 1;
     } else if (flags[index]?.startsWith('--detail=')) {
       detail = flags[index].slice('--detail='.length); flags.splice(index, 1); index -= 1;
-    } else if (flags[index]?.startsWith('--request=')) {
-      request = flags[index].slice('--request='.length); flags.splice(index, 1); index -= 1;
-    }
+    } else if (flags[index]?.startsWith('--request=')) {
+      request = flags[index].slice('--request='.length); flags.splice(index, 1); index -= 1;
+    } else if (flags[index] === '--plan' || flags[index] === '--expected-revision' || flags[index] === '--replacement-default') {
+      const name = flags[index];
+      const value = flags[index + 1];
+      if (name === '--plan') planId = value;
+      if (name === '--expected-revision') expectedRevision = value;
+      if (name === '--replacement-default') replacementDefault = value;
+      flags.splice(index, 2); index -= 1;
+    } else if (flags[index]?.startsWith('--plan=')) {
+      planId = flags[index].slice('--plan='.length); flags.splice(index, 1); index -= 1;
+    } else if (flags[index]?.startsWith('--expected-revision=')) {
+      expectedRevision = flags[index].slice('--expected-revision='.length); flags.splice(index, 1); index -= 1;
+    } else if (flags[index]?.startsWith('--replacement-default=')) {
+      replacementDefault = flags[index].slice('--replacement-default='.length); flags.splice(index, 1); index -= 1;
+    } else if (flags[index] === '--confirm') {
+      confirm = true; flags.splice(index, 1); index -= 1;
+    } else if (flags[index] === '--purge-orphan-credentials') {
+      purgeOrphanCredentials = true; flags.splice(index, 1); index -= 1;
+    }
   }
   const knownFlags = new Set(['--purge']);
   const unknown = flags.filter((f) => f.startsWith('--') && !knownFlags.has(f));
   const args = flags.filter((f) => !f.startsWith('--'));
   if (!Number.isInteger(after) || after < 0) unknown.push('--after');
   if (!['compact', 'full'].includes(detail)) unknown.push('--detail');
-  return { command: argv[0], purge: flags.includes('--purge'), candidate, after, detail, request, args, unknown };
-}
+  return { command: argv[0], purge: flags.includes('--purge'), candidate, after, detail, request, planId, expectedRevision, replacementDefault, confirm, purgeOrphanCredentials, args, unknown };
+}
 
 /**
  * CLI dispatcher used by bin/dsh-crew.mjs. Returns a process exit code.
@@ -1198,7 +1363,7 @@ export async function runNpxCli({
   error = console.error,
   commands = {},
 } = {}) {
-  const { command, purge, candidate, after, detail, request, args, unknown } = normalizeCommand(argv);
+  const { command, purge, candidate, after, detail, request, planId, expectedRevision, replacementDefault, confirm, purgeOrphanCredentials, args, unknown } = normalizeCommand(argv);
   if (command === '--help' || command === '-h' || command === 'help') {
     log(USAGE);
     return 0;
@@ -1207,7 +1372,7 @@ export async function runNpxCli({
     error(USAGE);
     return 1;
   }
-  if (unknown.length > 0 || !['install', 'integrate', 'detach', 'status', 'inspect', 'jobs', 'update', 'uninstall'].includes(command)) {
+  if (unknown.length > 0 || !['install', 'integrate', 'detach', 'status', 'inspect', 'jobs', 'providers', 'update', 'uninstall'].includes(command)) {
     error(`unknown command: ${command ?? '<none>'}\n\n${USAGE}`);
     return 1;
   }
@@ -1217,15 +1382,17 @@ export async function runNpxCli({
       integrate: commands.integrate ?? npxIntegrate,
       detach: commands.detach ?? npxDetach,
       status: commands.status ?? npxStatus,
-      inspect: commands.inspect ?? npxInspect,
-      jobs: commands.jobs ?? npxJobs,
+      inspect: commands.inspect ?? npxInspect,
+      jobs: commands.jobs ?? npxJobs,
+      providers: commands.providers ?? npxProviders,
       update: commands.update ?? npxUpdate,
       uninstall: commands.uninstall ?? npxUninstall,
     };
     let result;
     if (command === 'uninstall') result = await actions.uninstall({ purge, log });
-    else if (command === 'update') result = await actions.update({ candidate, log });
-    else if (command === 'jobs') result = await actions.jobs({ args, after, detail, request, log });
+    else if (command === 'update') result = await actions.update({ candidate, log });
+    else if (command === 'jobs') result = await actions.jobs({ args, after, detail, request, log });
+    else if (command === 'providers') result = await actions.providers({ args, planId, expectedRevision, replacementDefault, confirm, purgeOrphanCredentials, log });
     else result = await actions[command]({ log });
     return result?.ok === false ? 1 : 0;
   } catch (err) {

package/src/job-contracts.mjs

@@ -119,7 +119,7 @@ function compactSelectionTrace(attempts) {
   });
 }
 
-function changedFilesFromView(view) {
+function changedFilesFromView(view) {
   if (Array.isArray(view?.candidate?.changed_files)) return view.candidate.changed_files;
   const changes = view?.workspace_diff?.changes;
   if (!changes || typeof changes !== 'object') return [];
@@ -129,7 +129,22 @@ function changedFilesFromView(view) {
     ...(Array.isArray(changes.renamed) ? changes.renamed : []),
     ...(Array.isArray(changes.untracked) ? changes.untracked : []),
   ])];
-}
+}
+
+function boundedExecutionContext(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const executionPlane = boundedText(value.execution_plane, 64);
+  const profile = boundedText(value.profile, 64);
+  const runtimeId = boundedText(value.runtime_id, 128);
+  const port = Number.isInteger(value.listen_port) ? value.listen_port : null;
+  if (!executionPlane && !profile && !runtimeId && port === null) return null;
+  return {
+    execution_plane: executionPlane,
+    profile,
+    listen_port: port,
+    runtime_id: runtimeId,
+  };
+}
 
 /**
  * Build the machine-first Result Contract for a workflow.
@@ -162,7 +177,8 @@ export function buildEvidenceEnvelope(view = {}) {
       delivery_complete: outcome.delivery?.complete === true,
       review_verdict: review?.verdict ?? null,
     },
-    selection_trace: compactSelectionTrace(selectionAttempts),
+    selection_trace: compactSelectionTrace(selectionAttempts),
+    execution_context: boundedExecutionContext(view.execution_context ?? selectionAttempts[0]?.execution_context),
     changed_files: changedFiles,
     changes: boundedStrings(outcome.changes),
     tests: boundedTests(outcome.tests),

package/src/jobs.mjs

@@ -12,6 +12,7 @@ import { createRequire } from 'node:module';
 import { appendDeliveryInstructions, parseDeliveryReport, formatDeliveryMetadata } from './delivery.mjs';
 import { captureWorkspaceBaseline, captureWorkspaceDiff, NOT_A_GIT_REPOSITORY } from './workspace-audit.mjs';
 import { buildOutcome, JOB_PHASES } from './workflow.mjs';
+import { raceWaiters } from './removable-waiter.mjs';
 import { buildDirectSelectionTrace } from './model-routing.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -255,10 +256,7 @@ export async function waitJob(id, timeoutMs) {
   const job = jobs.get(id);
   if (!job) throw new Error(`no such job: ${id}`);
   if (job.status !== 'running') return job;
-  await Promise.race([
-    new Promise((res) => job.waiters.push(res)),
-    timeoutMs ? new Promise((res) => setTimeout(res, timeoutMs)) : new Promise(() => {}),
-  ]);
+  await raceWaiters(job.waiters, { timeoutMs });
   return job;
 }