@ran-sh/dsh-crew 0.5.6 → 0.5.7

package/src/server.mjs

@@ -56,7 +56,9 @@ const constraintsSchema = z.object({
 // Initial values come from the global config (~/.config/dsh-crew/config.json,
 // edited on the DSH settings page); dsh_worker_config overrides per session.
 // All dispatch decisions (dsh_run_worker AND dsh_spawn_worker, hub AND
-// standalone) go through the same policy resolver in src/policy.mjs.
+// production dispatches go through the 3210-only policy resolver in
+// src/policy.mjs; the historical standalone path is retained only for
+// read/migration compatibility and is never selected for execution.
 import { readGlobalConfig } from './install/install.mjs';
 const initialGlobalConfig = normalizeGlobalConfig(readGlobalConfig());
 const legacyDefaults = deriveLegacyConfig(initialGlobalConfig);
@@ -65,7 +67,7 @@ const sessionConfig = {
   enabled: true,
   default_tier: legacyDefaults.default_tier,
   default_effort: legacyDefaults.default_effort,
-  mode: legacyDefaults.mode, // auto | hub | standalone
+  mode: legacyDefaults.mode === 'standalone' ? 'hub' : legacyDefaults.mode, // auto | hub; legacy standalone is migrated to hub
   default_timeout_seconds: legacyDefaults.default_timeout_seconds,
   tier_policy: undefined,
   escalate_on_failure: legacyDefaults.escalate_on_failure,
@@ -83,7 +85,7 @@ function resetSessionConfig() {
     enabled: true,
     default_tier: legacyDefaults.default_tier,
     default_effort: legacyDefaults.default_effort,
-    mode: legacyDefaults.mode,
+    mode: legacyDefaults.mode === 'standalone' ? 'hub' : legacyDefaults.mode,
     default_timeout_seconds: legacyDefaults.default_timeout_seconds,
     tier_policy: undefined,
     escalate_on_failure: legacyDefaults.escalate_on_failure,
@@ -142,9 +144,9 @@ function dispatchDisabled() {
   });
 }
 
-async function resolveMode() {
-  const status = await hubStatus();
-  const decision = resolveHubExecutionMode(sessionConfig.mode, status);
+async function resolveMode() {
+  const status = await hubStatus();
+  const decision = resolveHubExecutionMode(sessionConfig.mode, status, { productionOnly: true });
   if (!decision.ok) {
     throw Object.assign(new Error(decision.error), {
       code: decision.code,
@@ -274,7 +276,7 @@ server.registerTool('dsh_worker_config', {
     enabled: z.boolean().optional().describe('false = refuse all worker dispatch this session'),
     default_tier: z.enum(['flash', 'pro']).optional(),
     default_effort: z.enum(['off', 'high', 'max']).optional(),
-    mode: z.enum(['auto', 'hub', 'standalone']).optional(),
+    mode: z.enum(['auto', 'hub']).optional().describe('Execution mode. Production dispatch always uses the isolated 3210 Crew Harness; standalone is retained only as a legacy read/migration value.'),
     default_timeout_seconds: z.number().int().positive().max(7200).optional(),
     tier_policy: z.enum(['auto', 'flash-only', 'pro-only']).optional().describe('session hard clamp: flash-only / pro-only pin every dispatch to one tier'),
     escalate_on_failure: z.boolean().optional().describe('allow an unverified worker attempt to retry through the stronger model policy (applies to run and spawn)'),
@@ -325,9 +327,11 @@ async function buildConfigReport() {
   let effectiveWorkerProvider = null;
   let effectiveWorkerSelection = { flash: null, pro: null };
   let providerResolutionError;
-  let providerCatalogChecked = false;
-  let providerCatalogBody = null;
-  let hubJobsChecked = false;
+  let providerCatalogChecked = false;
+  let providerCatalogBody = null;
+  let providerInventoryChecked = false;
+  let providerInventoryBody = null;
+  let hubJobsChecked = false;
   let hubJobsBody = null;
   const workerProviderMode = globalConfig.worker_provider_mode ?? 'deepseek-official';
   if (workerProviderMode === 'deepseek-official') {
@@ -362,9 +366,21 @@ async function buildConfigReport() {
   } else if (hubCompatibility.reachable) {
     providerResolutionError = hubCompatibilityMessage(hubCompatibility);
   }
-  if (hubCompatibility.compatible) {
-    try {
-      hubJobsChecked = true;
+  if (hubCompatibility.compatible) {
+    try {
+      providerInventoryChecked = true;
+      const inventoryRes = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/providers`, { signal: AbortSignal.timeout(800) });
+      providerInventoryBody = inventoryRes.ok
+        ? await inventoryRes.json()
+        : { ok: false, code: 'PROVIDER_INVENTORY_UNAVAILABLE' };
+    } catch {
+      providerInventoryChecked = true;
+      providerInventoryBody = { ok: false, code: 'PROVIDER_INVENTORY_UNAVAILABLE' };
+    }
+  }
+  if (hubCompatibility.compatible) {
+    try {
+      hubJobsChecked = true;
       const jobsRes = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/jobs`, { signal: AbortSignal.timeout(800) });
       hubJobsBody = await jobsRes.json();
     } catch {
@@ -375,9 +391,11 @@ async function buildConfigReport() {
   const readinessMatrix = buildConfigReadinessMatrix({
     hubCompatibility,
     workerProviderMode,
-    providerCatalogChecked,
-    providerCatalogBody,
-    hubJobsChecked,
+    providerCatalogChecked,
+    providerCatalogBody,
+    providerInventoryChecked,
+    providerInventoryBody,
+    hubJobsChecked,
     hubJobsBody,
   });
   const roleProfiles = loadRoleProfiles();

package/src/status-shard.mjs

@@ -3,7 +3,7 @@
 // and readers merge all fresh shards. Kills the last-writer-wins race that a
 // single shared status.json had with multiple concurrent writers.
 
-import { writeFileSync, mkdirSync, rmSync, readdirSync, readFileSync } from 'node:fs';
+import { writeFileSync, mkdirSync, rmSync, readdirSync, readFileSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
@@ -21,9 +21,20 @@ export function createShardWriter(kind) {
   return {
     writer,
     publish(jobs) {
+      // Same durability pattern as the profile/workspace registries: write a
+      // same-directory temp file as 0600 and rename it over the shard, so a
+      // reader never observes a partially written shard (parse failures are
+      // silently ignored, which would make the writer look vanished).
       try {
         mkdirSync(SHARD_DIR, { recursive: true });
-        writeFileSync(file, JSON.stringify({ updatedAt: new Date().toISOString(), writer, jobs }, null, 2));
+        const temp = `${file}.tmp-${Date.now()}`;
+        try {
+          writeFileSync(temp, JSON.stringify({ updatedAt: new Date().toISOString(), writer, jobs }, null, 2), { encoding: 'utf8', mode: 0o600 });
+          renameSync(temp, file);
+        } catch (error) {
+          try { rmSync(temp, { force: true }); } catch {}
+          throw error;
+        }
       } catch {}
     },
     dispose: cleanup,

package/src/workflow-runtime.mjs

@@ -15,6 +15,7 @@
 // appear here.
 
 import { resolveModelPolicy, shouldAutoReview, getRoleState } from './policy.mjs';
+import { raceWaiters } from './removable-waiter.mjs';
 import { applyWorkspaceEvidence, buildOutcome, decideNextStep, JOB_PHASES, canTransition } from './workflow.mjs';
 import { parseDeliveryReport } from './delivery.mjs';
 import { classifyFailure } from './failure-classification.mjs';
@@ -298,7 +299,8 @@ export function createWorkflowRuntime(adapters, {
     let config = {};
 
     try {
-      config = adapters.getConfig?.() ?? {};
+      config = adapters.getConfig?.() ?? {};
+      job.review_gate = ['required', 'optional', 'off'].includes(config?.review?.gate) ? config.review.gate : 'required';
       const alloc = await adapters.allocateWorkspace?.(job);
       if (alloc && alloc.ok === false) {
         failJob(job, Object.assign(new Error(alloc.error ?? alloc.reason), { code: alloc.reason }));
@@ -324,6 +326,19 @@ export function createWorkflowRuntime(adapters, {
         const review = await runReviewerAttempt(job, reviewTask, config, before);
         if (job.cancelling) { await cancelWorkflow(job); return; }
         job.review = review;
+        const reviewApproved = review.status === 'done'
+          && review.delivery_complete === true
+          && review.verdict === 'approve';
+        if (!reviewApproved) {
+          const code = review.verdict === 'request_changes'
+            ? 'REVIEW_CHANGES_REQUESTED'
+            : 'REVIEW_INCONCLUSIVE';
+          failJob(job, Object.assign(
+            new Error(`explicit review blocked acceptance: verdict=${review.verdict}, reviewer status=${review.status}, review delivery_complete=${review.delivery_complete === true}`),
+            { code },
+          ));
+          return;
+        }
         if (job.review) transition(job, JOB_PHASES.READY, 'review complete');
         finalize(job);
         return;
@@ -453,6 +468,24 @@ export function createWorkflowRuntime(adapters, {
           const review = await runReviewerAttempt(job, reviewTask, config, before, job.execution_cwd, job.base_revision);
         if (job.cancelling) { await cancelWorkflow(job); return; }
           job.review = review;
+          // The review verdict is an acceptance gate, not a footnote: only a
+          // reviewer that ran to completion, delivered its own auditable
+          // contract, and approved may finalize as COMPLETED. Anything else
+          // fails closed through the existing FAILED machinery so the MCP
+          // surface reports a failed workflow instead of a false "done".
+          const reviewApproved = review.status === 'done'
+            && review.delivery_complete === true
+            && review.verdict === 'approve';
+          if (!reviewApproved && job.review_gate === 'required') {
+            const code = review.verdict === 'request_changes'
+              ? 'REVIEW_CHANGES_REQUESTED'
+              : 'REVIEW_INCONCLUSIVE';
+            failJob(job, Object.assign(
+              new Error(`automatic review blocked acceptance: verdict=${review.verdict}, reviewer status=${review.status}, review delivery_complete=${review.delivery_complete === true}`),
+              { code },
+            ));
+            return;
+          }
           transition(job, JOB_PHASES.READY, decision.reason);
           finalize(job);
           return;
@@ -535,8 +568,9 @@ export function createWorkflowRuntime(adapters, {
       id: ar.id,
       role: ar.role ?? 'worker',
       attempt,
-      provider: ar.provider ?? null,
-      model: ar.model ?? null,
+      provider: ar.provider ?? null,
+      model: ar.model ?? null,
+      execution_context: ar.execution_context ?? null,
       selection_source: ar.selection_source ?? null,
       selection_trace: ar.selection_trace ?? null,
       status: ar.status ?? 'failed',
@@ -594,7 +628,8 @@ export function createWorkflowRuntime(adapters, {
       phase: job.phase,
       status: job.status,
       attempt: job.attempts.length,
-      current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
+      current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
+      execution_context: job.attempts[job.attempts.length - 1]?.execution_context ?? null,
       model_class_hint: job.model_class_hint,
       source: job.source,
       profile_id: job.profile_id,
@@ -619,12 +654,14 @@ export function createWorkflowRuntime(adapters, {
       workspace_retained: job.workspace_retained === true,
       decision: job.decision,
       candidate_available: !!job.candidate,
-      review_status: job.review ? job.review.status ?? null : null,
+      review_status: job.review ? job.review.status ?? null : null,
+      review_gate: job.review_gate ?? 'required',
       event_cursor: job.canonical_events.at(-1)?.sequence ?? 0,
     };
     if (withResult) {
       v.child_attempts = job.attempts.map((a) => ({
-        id: a.id, role: a.role, attempt: a.attempt, provider: a.provider, model: a.model,
+        id: a.id, role: a.role, attempt: a.attempt, provider: a.provider, model: a.model,
+        execution_context: a.execution_context ?? null,
         selection_source: a.selection_source, selection_trace: a.selection_trace ?? null,
         status: a.status, stopReason: a.stopReason,
         outcome_task: a.outcome?.task_status ?? null,
@@ -661,10 +698,7 @@ export function createWorkflowRuntime(adapters, {
     const job = jobs.get(id);
     if (!job) return undefined;
     if (job.status !== 'running') return job;
-    await Promise.race([
-      new Promise((res) => job.waiters.push(res)),
-      timeoutMs > 0 ? new Promise((res) => setTimeout(res, timeoutMs)) : new Promise(() => {}),
-    ]);
+    await raceWaiters(job.waiters, { timeoutMs });
     return job;
   }
 

package/windows/start-dsh-crew.cmd

@@ -51,7 +51,7 @@ exit /b 64
 
 :help
 echo Usage: %~nx0 [--open ^| --background ^| --watch]
-echo   --open        Start both services and open http://127.0.0.1:3080/.
-echo   --background  Start both services silently without opening a browser.
-echo   --watch       Keep both services healthy and restart them after an exit.
+echo   --open        Start the 3080 console and its supervised 3210 backend, then open the console.
+echo   --background  Start the 3080 console and its supervised 3210 backend silently.
+echo   --watch       Keep the 3080 console and supervised 3210 backend healthy.
 exit /b 0

package/windows/start-dsh-crew.ps1

@@ -15,8 +15,8 @@ $logRoot = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
 $launcherLog = Join-Path $logRoot 'dsh-crew-launcher.log'
 $startedAt = Get-Date
 $services = @(
-  [pscustomobject]@{ Name = 'Crew backend'; Profile = 'dsh-crew'; Home = $crewHome; Port = 3210; Url = 'http://127.0.0.1:3210'; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null },
-  [pscustomobject]@{ Name = 'Official UI'; Profile = 'web'; Home = $officialHome; Port = 3080; Url = 'http://127.0.0.1:3080'; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null }
+  [pscustomobject]@{ Name = 'Official UI'; Profile = 'web'; Home = $officialHome; Port = 3080; Url = 'http://127.0.0.1:3080'; ManagedByBridge = $false; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null },
+  [pscustomobject]@{ Name = 'Crew backend'; Profile = 'dsh-crew'; Home = $crewHome; Port = 3210; Url = 'http://127.0.0.1:3210'; ManagedByBridge = $true; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null }
 )
 
 function Write-LaunchLog {
@@ -44,6 +44,18 @@ function Get-HealthState {
   }
 }
 
+function Start-BridgedCrewService {
+  try {
+    $response = Invoke-WebRequest -UseBasicParsing -Uri 'http://127.0.0.1:3080/_dsh/dsh-crew/ping' -TimeoutSec 5
+    if ($response.StatusCode -ge 200 -and $response.StatusCode -lt 300) {
+      return [pscustomobject]@{ Ready = $true; Error = $null }
+    }
+    return [pscustomobject]@{ Ready = $false; Error = ('3080 bridge returned HTTP {0}.' -f $response.StatusCode) }
+  } catch {
+    return [pscustomobject]@{ Ready = $false; Error = ('3080 bridge could not start the supervised 3210 backend: {0}' -f $_.Exception.Message) }
+  }
+}
+
 function Get-PortState {
   param([int] $Port)
   try {
@@ -175,7 +187,7 @@ function Wait-CrewServices {
       if ($health.Ready) {
         $service.State = 'ready'
         $service.ConsecutiveFailures = 0
-        [void] (Set-TrackedListenerIdentity -Service $service)
+        if (-not $service.ManagedByBridge) { [void] (Set-TrackedListenerIdentity -Service $service) }
         Write-LaunchLog ('{0} ready on {1}; runtime={2}' -f $service.Name, $service.Port, $health.Version)
       } elseif ($service.Process -and $service.Process.HasExited) {
         throw ('{0} exited before becoming ready; PID={1}; exit={2}; last health error: {3}' -f $service.Name, $service.Process.Id, $service.Process.ExitCode, $health.Error)
@@ -184,7 +196,9 @@ function Wait-CrewServices {
     if (@($services | Where-Object State -eq 'starting').Count -gt 0) { Start-Sleep -Milliseconds 500 }
   }
 
-  $notReady = @($services | Where-Object State -ne 'ready')
+  $notReady = @($services | Where-Object {
+    $_.State -ne 'ready' -and -not ($_.ManagedByBridge -and $_.State -eq 'pending')
+  })
   if ($notReady.Count -gt 0) {
     $details = ($notReady | ForEach-Object { '{0}:{1} ({2})' -f $_.Profile, $_.Port, $_.LastError }) -join '; '
     throw "Startup health deadline exceeded: $details"
@@ -193,21 +207,36 @@ function Wait-CrewServices {
 
 function Ensure-CrewServices {
   param([switch] $QuietHealthy)
+  $officialRestarted = $false
 
   foreach ($service in $services) {
     $health = Get-HealthState $service
+    if ($service.ManagedByBridge -and $officialRestarted) {
+      # A restarted 3080 process must re-establish ownership of 3210 through
+      # its own sidecar, even if an old detached listener still answers.
+      $service.State = 'pending'
+      $service.LastError = 'Waiting for the restarted 3080 bridge to claim 3210.'
+      continue
+    }
     if ($health.Ready) {
       $wasReady = $service.State -eq 'ready'
       $service.State = 'ready'
       $service.ConsecutiveFailures = 0
       $service.LastError = $null
-      if (-not $service.ListenerPid) { [void] (Set-TrackedListenerIdentity -Service $service) }
+      if (-not $service.ManagedByBridge -and -not $service.ListenerPid) { [void] (Set-TrackedListenerIdentity -Service $service) }
       if (-not $QuietHealthy -or -not $wasReady) {
         Write-LaunchLog ('{0} already ready on {1}; runtime={2}' -f $service.Name, $service.Port, $health.Version)
       }
       continue
     }
 
+    if ($service.ManagedByBridge) {
+      $service.LastError = $health.Error
+      $service.ConsecutiveFailures += 1
+      $service.State = 'pending'
+      continue
+    }
+
     $service.LastError = $health.Error
     $service.ConsecutiveFailures += 1
     if ($service.Process -and $service.Process.HasExited) {
@@ -242,9 +271,24 @@ function Ensure-CrewServices {
       Write-LaunchLog ('Supervisor detected {0} unavailable on {1}; restarting it.' -f $service.Name, $service.Port) 'WARN'
     }
     Start-CrewService $service
+    if (-not $service.ManagedByBridge) { $officialRestarted = $true }
   }
 
   Wait-CrewServices
+
+  # The 3080 official bridge is the sole owner of the 3210 child. Trigger it
+  # only after 3080 is healthy, then wait on the direct 3210 runtime contract.
+  foreach ($service in ($services | Where-Object ManagedByBridge -eq $true | Where-Object State -ne 'ready')) {
+    $bridge = Start-BridgedCrewService
+    if (-not $bridge.Ready) {
+      $service.LastError = $bridge.Error
+      throw $bridge.Error
+    }
+    $service.State = 'starting'
+    $service.ConsecutiveFailures = 0
+    $service.LastError = $null
+  }
+  if (@($services | Where-Object State -eq 'starting').Count -gt 0) { Wait-CrewServices }
 }
 
 function Start-ServiceSupervisor {