@ran-sh/dsh-crew 0.5.7 → 1.0.0

package/src/hub/index.mjs

@@ -4,7 +4,7 @@
 // and serves the one-click installer endpoints for the settings page.
 
 import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, isAbsolute } from 'node:path';
 import { homedir } from 'node:os';
 import { createShardWriter, readMergedStatus } from '../status-shard.mjs';
@@ -39,6 +39,11 @@ import { normalizeProviderLifecycleState } from '../provider-lifecycle-state.mjs
 import { createProviderHealthStore } from '../provider-health.mjs';
 import { planProviderDelete } from '../provider-lifecycle.mjs';
 import { createProviderDeleteFileHooks } from '../provider-delete-adapters.mjs';
+import { buildCredentialReferenceInventory } from '../credential-reference-inventory.mjs';
+import { executeCredentialPurge, planCredentialPurge } from '../credential-lifecycle.mjs';
+import { createCredentialPurgeFileHooks } from '../credential-purge-adapters.mjs';
+import { normalizeCredentialPurgeState, recordCredentialPurgeOutcome } from '../credential-purge-state.mjs';
+import { buildRuntimeReadinessSnapshot } from '../runtime-readiness-snapshot.mjs';
 
 // policy.mjs is pure (no @deepseek-ai imports, no ctx access), so importing it
 // here is safe for the profile-realm discipline: it never pulls in package
@@ -100,6 +105,7 @@ const LEGACY_TIER_MODELS = { flash: 'deepseek-v4-flash', pro: 'deepseek-v4-pro'
 // the profile realm): a valid dispatch role set.
 const ROLES = { worker: true, reviewer: true };
 const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
+const CREDENTIAL_PURGE_STATE_FILE = join(CONFIG_DIR, 'credential-purge-lifecycle.json');
 
 function readProviderLifecycleState() {
   try {
@@ -109,6 +115,22 @@ function readProviderLifecycleState() {
   }
 }
 
+function readCredentialPurgeState() {
+  try { return normalizeCredentialPurgeState(JSON.parse(readFileSync(CREDENTIAL_PURGE_STATE_FILE, 'utf8'))); } catch { return normalizeCredentialPurgeState(); }
+}
+
+function writeCredentialPurgeState(state) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  const temp = `${CREDENTIAL_PURGE_STATE_FILE}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify(normalizeCredentialPurgeState(state), null, 2) + '\n', 'utf8');
+    renameSync(temp, CREDENTIAL_PURGE_STATE_FILE);
+  } catch (error) {
+    try { rmSync(temp, { force: true }); } catch {}
+    throw error;
+  }
+}
+
 function providerInventoryPolicy(config) {
   return {
     worker: config?.worker?.model_policy ?? {
@@ -140,13 +162,31 @@ async function readProviderInventorySnapshot(hub, ctx, config) {
     }
   } catch {}
   const lifecycle = readProviderLifecycleState();
-  return buildProviderInventory({
+  const credentialPurge = readCredentialPurgeState();
+  const inventory = buildProviderInventory({
     catalog,
     declarations,
     policy: providerInventoryPolicy(config),
     tombstones: lifecycle.tombstones,
     activeJobs: hub.list(),
   });
+  return {
+    ...inventory,
+    credential_history_refs: Object.values(lifecycle.transactions ?? {})
+      .flatMap((transaction) => Array.isArray(transaction?.credential_refs) ? transaction.credential_refs : []),
+    credential_purged_refs: Object.keys(credentialPurge.purged),
+    credential_purge_unverified: Object.entries(credentialPurge.unverified).map(([referenceId, record]) => ({
+      reference_id: referenceId,
+      transaction_id: record.transaction_id,
+      state: record.state,
+    })),
+    lifecycle_transactions: Object.entries(lifecycle.transactions ?? {}).slice(-64).map(([transactionId, transaction]) => ({
+      transaction_id: transactionId,
+      provider_id: transaction.provider_id,
+      state: transaction.state,
+      ...(transaction.expected_revision ? { expected_revision: transaction.expected_revision } : {}),
+    })),
+  };
 }
 
 function readProviderProfileRevision() {
@@ -165,12 +205,26 @@ export function hubCanonicalEvents(job = {}) {
   const role = job.role === 'reviewer' ? 'reviewer' : 'worker';
   const atStart = job.startedAt ?? null;
   const atEnd = job.endedAt ?? atStart;
-  const definitions = [
-    ['job.created', atStart, { client_job_id: job.client_job_id ?? null }],
-    ['job.started', atStart, {}],
-    ['model.selected', atStart, { provider: job.provider ?? null, model: job.model ?? null, source: job.selection_source ?? null }],
-    [role === 'reviewer' ? 'review.started' : 'worker.started', atStart, { run_id: job.id }],
-  ];
+  const definitions = [
+    ['job.created', atStart, { client_job_id: job.client_job_id ?? null }],
+    ['job.started', atStart, {}],
+    ['runtime.bound', atStart, {
+      execution_plane: job.execution_context?.execution_plane ?? null,
+      profile: job.execution_context?.profile ?? null,
+      listen_port: Number.isInteger(job.execution_context?.listen_port) ? job.execution_context.listen_port : null,
+      runtime_id: job.execution_context?.runtime_id ?? null,
+    }],
+    ['model.selected', atStart, { provider: job.provider ?? null, model: job.model ?? null, source: job.selection_source ?? null }],
+    ['model.admitted', atStart, {
+      provider: job.provider ?? null,
+      model: job.model ?? null,
+      health_state: job.health_state ?? 'unprobed',
+      reason_code: job.health_reason_code ?? null,
+      observed_at: Number.isFinite(job.health_observed_at) ? job.health_observed_at : null,
+    }],
+    [role === 'reviewer' ? 'review.started' : 'worker.started', atStart, { run_id: job.id }],
+    ['agent.created', atStart, { run_id: job.id }],
+  ];
   if (job.status !== 'running') {
     definitions.push([
       role === 'reviewer' ? 'review.completed' : 'worker.completed',
@@ -319,7 +373,7 @@ export class WorkerRegistry {  constructor(ctx) {
    * `role` (worker | reviewer) records who does the work; `tier` remains the
    * legacy model-class slot. Reviewer-role jobs always use the pro slot.
    */
-  async spawn({ task, tier = 'flash', role, attempt = 0, effort = 'max', cwd, source = 'api', preset, delivery = 'coding', client_job_id, requested_isolation, workspace_branch, timeout_seconds, profile_id, workspace_context, allow_no_changes }) {
+  async spawn({ task, tier = 'flash', role, attempt = 0, effort = 'max', cwd, source = 'api', preset, delivery = 'coding', client_job_id, requested_isolation, workspace_branch, timeout_seconds, profile_id, workspace_context, allow_no_changes, ingress = 'direct-3210' }) {
     // role is only honored when the caller explicitly names it; a legacy
     // tier-only spawn (role === undefined) keeps the exact v0.1 resolution.
     const hasRole = role === 'worker' || role === 'reviewer';
@@ -455,6 +509,7 @@ export class WorkerRegistry {  constructor(ctx) {
           profile: runtime.profile,
           listen_port: runtime.listen_port,
           runtime_id: runtime.runtime_id,
+          ingress: ingress === 'official-3080' ? 'official-3080' : 'direct-3210',
         };
       })(),
       allow_no_changes: allow_no_changes === true,
@@ -895,10 +950,15 @@ export async function apply(ctx) {
   const disposers = [];
   const PROVIDER_DELETE_PLAN_TTL_MS = 10 * 60 * 1000;
   const providerDeletePlans = new Map();
+  const credentialPurgePlans = new Map();
   const rememberProviderDeletePlan = (plan) => {
     providerDeletePlans.set(plan.plan_id, { plan, created_at: Date.now() });
     while (providerDeletePlans.size > 32) providerDeletePlans.delete(providerDeletePlans.keys().next().value);
   };
+  const rememberCredentialPurgePlan = (plan) => {
+    credentialPurgePlans.set(plan.plan_id, { plan, created_at: Date.now() });
+    while (credentialPurgePlans.size > 32) credentialPurgePlans.delete(credentialPurgePlans.keys().next().value);
+  };
 
   // Multimodal bridge: register describe_image / generate_image for the DS
   // model. Config is read per call so settings-page edits apply live; the
@@ -987,7 +1047,8 @@ export async function apply(ctx) {
             // as its raw default (pro-only + no tier used to spawn flash).
             const resolved = resolveHubSpawnPayload(payload, () => hub.getConfig?.() ?? {});
             if (!resolved.ok) return sendJson(res, 400, { ok: false, error: resolved.error, code: resolved.code });
-            const job = await hub.spawn(resolved.payload);
+            const ingress = req.headers?.['x-dsh-crew-ingress'] === 'official-3080' ? 'official-3080' : 'direct-3210';
+            const job = await hub.spawn({ ...resolved.payload, ingress });
             return sendJson(res, 200, { ok: true, job: hub.view(job) });
           }
           if (req.method === 'POST' && parts.length === 2 && parts[1] === 'cancel') {
@@ -1067,16 +1128,27 @@ export async function apply(ctx) {
         const workspaceReadiness = requestedWorkspaceId && !requestedContext
           ? { status: 'UNAVAILABLE', reason_code: 'WORKSPACE_CONTEXT_NOT_FOUND' }
           : await assessWorkspaceReadiness({ cwd: requestedContext?.repo_root ?? null });
-        const liveJobs = typeof hub.list === 'function' ? hub.list() : [];
-        const [modelExecution, reviewerExecution] = buildHubExecutionRows(liveJobs);
-        const contract = buildExtensionContract({
-          config,
-          readinessMatrix: { rows: [
-            { id: 'hub_compatibility', status: 'PASS', reason_code: 'LIVE_CHECK_PASSED' },
-            catalogStatus,
-            modelExecution,
-            reviewerExecution,
-          ] },
+        const liveJobs = typeof hub.list === 'function' ? hub.list() : [];
+        const [modelExecution, reviewerExecution] = buildHubExecutionRows(liveJobs);
+        const readinessMatrix = { rows: [
+          { id: 'hub_compatibility', status: 'PASS', reason_code: 'LIVE_CHECK_PASSED' },
+          catalogStatus,
+          modelExecution,
+          reviewerExecution,
+          { id: 'provider_lifecycle_consistent', status: 'NOT_RUN', reason_code: 'NO_EXECUTION_EVIDENCE' },
+        ] };
+        const readinessSnapshot = buildRuntimeReadinessSnapshot({
+          runtime: getHubRuntimeIdentity(),
+          readinessMatrix,
+          selections: { worker: liveJobs.find((job) => job?.role === 'worker') ?? null, reviewer: liveJobs.find((job) => job?.role === 'reviewer') ?? null },
+          health: hub.healthStore.list(),
+          jobs: liveJobs,
+          workspace: workspaceReadiness,
+        });
+        const contract = buildExtensionContract({
+          config,
+          readinessMatrix,
+          readinessSnapshot,
           workspace: workspaceReadiness,
           profiles,
           runtime: getHubRuntimeIdentity(),
@@ -1195,6 +1267,91 @@ export async function apply(ctx) {
       },
     }));
 
+    // Credential references are a separate, secret-free inventory. Provider
+    // deletion can report these references, but never implies their purge.
+    disposers.push(webServer.register({
+      kind: 'exact', path: `${ROUTE_BASE}/credential-references`,
+      handler: async (req, res) => {
+        if (!isLoopbackRequest(req)) return sendJson(res, 403, { ok: false, error: 'loopback only' });
+        if (req.method !== 'GET') return sendJson(res, 405, { ok: false, error: 'GET only' }, { allow: 'GET' });
+        try {
+          const config = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+          const snapshot = await readProviderInventorySnapshot(hub, ctx, config);
+          const credentials = buildCredentialReferenceInventory({ providers: snapshot.records, additional_refs: snapshot.credential_history_refs, purged_refs: snapshot.credential_purged_refs });
+          return sendJson(res, 200, { ok: true, ...credentials, unverified_purges: snapshot.credential_purge_unverified, runtime: getHubRuntimeIdentity() });
+        } catch {
+          return sendJson(res, 503, { ok: false, code: 'CREDENTIAL_REFERENCE_INVENTORY_UNAVAILABLE' });
+        }
+      },
+    }));
+
+    disposers.push(webServer.register({
+      kind: 'prefix', path: `${ROUTE_BASE}/credential-references`,
+      handler: async (req, res) => {
+        if (!isLoopbackRequest(req)) return sendJson(res, 403, { ok: false, error: 'loopback only' });
+        let url;
+        try { url = new URL(req.url, 'http://localhost'); } catch { return sendJson(res, 400, { ok: false, code: 'CREDENTIAL_PURGE_PLAN_INVALID' }); }
+        const parts = url.pathname.slice(`${ROUTE_BASE}/credential-references`.length).split('/').filter(Boolean);
+        try {
+          const referenceId = decodeURIComponent(parts[0] ?? '');
+          const body = await readBody(req);
+          const config = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+          const snapshot = await readProviderInventorySnapshot(hub, ctx, config);
+          const credentials = buildCredentialReferenceInventory({ providers: snapshot.records, additional_refs: snapshot.credential_history_refs, purged_refs: snapshot.credential_purged_refs });
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'purge-plan') {
+            const planned = planCredentialPurge({ inventory: credentials, referenceId, expectedRevision: body?.expected_revision });
+            if (!planned.ok) return sendJson(res, 409, { ok: false, code: planned.code });
+            rememberCredentialPurgePlan(planned.plan);
+            return sendJson(res, 200, { ok: true, plan: planned.plan });
+          }
+          if (req.method === 'DELETE' && parts.length === 1) {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'CREDENTIAL_PURGE_CONFIRM_REQUIRED' });
+            const stored = credentialPurgePlans.get(body?.plan_id);
+            if (!stored || Date.now() - stored.created_at > PROVIDER_DELETE_PLAN_TTL_MS || stored.plan.reference_id !== referenceId) {
+              credentialPurgePlans.delete(body?.plan_id);
+              return sendJson(res, 409, { ok: false, code: 'CREDENTIAL_PURGE_PLAN_EXPIRED' });
+            }
+            const current = planCredentialPurge({ inventory: credentials, referenceId, expectedRevision: stored.plan.expected_revision });
+            if (!current.ok) return sendJson(res, 409, { ok: false, code: current.code });
+            if (current.plan.expected_revision !== stored.plan.expected_revision) return sendJson(res, 409, { ok: false, code: 'CREDENTIAL_REFERENCE_CHANGED' });
+            credentialPurgePlans.delete(body.plan_id);
+            const adapter = createCredentialPurgeFileHooks({
+              credentialsFile: join(CONFIG_DIR, 'harness', '.credentials.yaml'),
+              crewHome: join(CONFIG_DIR, 'harness'),
+            });
+            const result = await executeCredentialPurge(current.plan, {
+              recheck: async (id) => {
+                const freshSnapshot = await readProviderInventorySnapshot(hub, ctx, config);
+                const freshCredentials = buildCredentialReferenceInventory({ providers: freshSnapshot.records, additional_refs: freshSnapshot.credential_history_refs, purged_refs: freshSnapshot.credential_purged_refs });
+                const freshPlan = planCredentialPurge({ inventory: freshCredentials, referenceId: id });
+                if (!freshPlan.ok) return { ok: false };
+                const freshRecord = freshCredentials.records.find((entry) => entry.reference_id === id);
+                return {
+                  ok: true,
+                  revision: freshPlan.plan.expected_revision,
+                  orphan: freshRecord?.orphan === true,
+                  ownership: freshRecord?.ownership,
+                  purge_capability: freshRecord?.purge_capability,
+                };
+              },
+              ...(adapter.ok ? { purge: adapter.purge, verify: adapter.verify } : {}),
+            });
+            if (result.state === 'PURGED' || result.state === 'VERIFIED') {
+              try {
+                writeCredentialPurgeState(recordCredentialPurgeOutcome(readCredentialPurgeState(), current.plan, result));
+              } catch {
+                return sendJson(res, 503, { ok: false, code: 'CREDENTIAL_PURGE_AUDIT_FAILED', state: result.state, reference_id: referenceId });
+              }
+            }
+            return sendJson(res, result.ok ? 200 : 503, result);
+          }
+          return sendJson(res, 404, { ok: false, code: 'CREDENTIAL_REFERENCE_ENDPOINT_NOT_FOUND' });
+        } catch (error) {
+          return sendJson(res, 400, { ok: false, code: boundedMachineCodeFromError(error) ?? 'CREDENTIAL_PURGE_PLAN_INVALID' });
+        }
+      },
+    }));
+
     // Deletion is two-phase: this endpoint only computes a revision-bound,
     // secret-free impact plan. A later mutation endpoint must present that
     // plan and perform restart/verification through an owned supervisor.

package/src/hub-client.mjs

@@ -90,7 +90,7 @@ export async function hubStatus({ force = false } = {}) {
         endpoint: 'runtime',
       });
     }
-    return cacheStatus(evaluateHubHandshake(runtime.body));
+    return cacheStatus(evaluateHubHandshake(runtime.body, { strictProduction: true }));
   } catch {
     return cacheStatus(EMPTY_STATUS);
   }