@ran-sh/dsh-crew 0.5.7 → 1.0.1

package/README.md

@@ -46,8 +46,14 @@ dsh-crew inspect          # live capabilities and readiness
 dsh-crew jobs list        # jobs and Result Contracts
 dsh-crew providers list   # 3210 Harness provider inventory (secret-free)
 dsh-crew providers probe <provider-id>
+curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # references/orphans only
+dsh-crew credentials list  # secret-free reference inventory
+dsh-crew credentials purge-plan env:NAME
+dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
 dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
 dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew releases list     # retained validated payloads
+dsh-crew rollback <version> # switch payload and verify the 3210 runtime
 dsh-crew update           # update and repair enabled integrations
 dsh-crew uninstall        # remove managed files, keep backups/config
 ```

package/README.zh.md

@@ -42,8 +42,14 @@ dsh-crew inspect          # 实时能力与就绪度
 dsh-crew jobs list        # 任务与 Result Contract
 dsh-crew providers list   # 3210 Harness Provider 清单（不含密钥）
 dsh-crew providers probe <provider-id>
+curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # 仅查看引用/孤儿报告
+dsh-crew credentials list  # 不含密钥值的引用清单
+dsh-crew credentials purge-plan env:NAME
+dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
 dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
 dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew releases list     # 查看保留且已验证的版本
+dsh-crew rollback <version> # 切换版本并验证 3210 runtime
 dsh-crew update           # 更新并修复已启用集成
 dsh-crew uninstall        # 移除受管文件，保留配置/备份
 ```

package/lib/client.js

@@ -179,7 +179,16 @@ function componentState(status, keys, { aligned = false } = {}) {
 	if (evidence.some((value) => typeof value !== "boolean")) return READINESS_STATES.UNKNOWN;
 	return evidence.every(Boolean) && (!aligned || status.components.target_alignment === true) ? READINESS_STATES.READY : READINESS_STATES.DEGRADED;
 }
-function runtimeState(runtime) {
+function runtimeState(runtime, readinessSnapshot) {
+	if (readinessSnapshot && typeof readinessSnapshot === "object") {
+		const identity = readinessSnapshot.runtime;
+		if (!(identity?.execution_plane === "hub-3210" && identity.profile === "dsh-crew" && Number(identity.listen_port) === 3210 && typeof identity.runtime_id === "string" && identity.runtime_id.trim())) return READINESS_STATES.UNAVAILABLE;
+		const row = Array.isArray(readinessSnapshot.readiness_matrix?.rows) ? readinessSnapshot.readiness_matrix.rows.find((entry) => entry?.id === "hub_compatibility") : void 0;
+		if (row?.status === "PASS") return READINESS_STATES.READY;
+		if (row?.status === "FAIL") return READINESS_STATES.UNAVAILABLE;
+		if (row?.status === "NOT_RUN" || row?.status === "SKIP") return READINESS_STATES.DEGRADED;
+		return READINESS_STATES.UNKNOWN;
+	}
 	if (runtime === void 0) return READINESS_STATES.UNKNOWN;
 	if (runtime === null) return READINESS_STATES.UNAVAILABLE;
 	return runtime?.ok === true && runtime.service === "dsh-crew-hub" ? READINESS_STATES.READY : READINESS_STATES.DEGRADED;
@@ -190,7 +199,7 @@ function bridgeState(surface) {
 	return READINESS_STATES.UNKNOWN;
 }
 /** Project only structured, non-secret installer/runtime evidence. */
-function projectHostReadiness({ installStatus, runtime, surface } = {}) {
+function projectHostReadiness({ installStatus, runtime, surface, readinessSnapshot } = {}) {
 	const codex = installStatus?.codex;
 	const claude = installStatus?.claude;
 	const zcode = installStatus?.zcode;
@@ -230,7 +239,7 @@ function projectHostReadiness({ installStatus, runtime, surface } = {}) {
 		},
 		{
 			id: "crew_harness",
-			state: runtimeState(runtime),
+			state: runtimeState(runtime, readinessSnapshot),
 			detail: runtime?.runtime_version ?? null
 		},
 		{
@@ -434,7 +443,7 @@ const COPY = {
 			"follow-dsh": "跟随 Harness · 使用各档独立的模型优先级",
 			"deepseek-official": "DeepSeek Official · 使用旧版固定模型路由"
 		},
-		workerProviderHint: "仅作用于 Hub 模式；Standalone 始终用 deepseek-official + DEEPSEEK_API_KEY。",
+		workerProviderHint: "仅作用于 Hub 模式；Standalone 仅保留为旧版迁移元数据，不是生产执行路径。",
 		workerModels: "Worker 模型",
 		refreshHarnessModels: "刷新 Harness 模型",
 		refreshingModels: "刷新中…",
@@ -503,11 +512,23 @@ const COPY = {
 		providerDeletePlan: "生成删除计划",
 		providerDelete: "确认删除",
 		providerPlanReady: "计划已生成；再次确认后才会修改 3210 配置。",
+		providerRollback: "回滚",
+		providerRollbackConfirm: "按已保存事务恢复这个 Harness Provider 及原有路由？",
+		providerRollbackUnavailable: "没有可验证的回滚事务",
 		providerReplacement: "替换 Harness 默认 Provider（输入 Provider id）",
 		providerDeleteConfirm: "确认按计划删除这个 Harness Provider？会清理路由引用并重启 3210。",
 		providerDeleteBlocked: "当前 Provider 不能删除（内置、在用、已删除或缺少可用替换）。",
 		providerLifecycleError: "Provider 生命周期操作失败",
 		providerNoInventory: "暂时无法读取 3210 Provider inventory。",
+		credentialReferences: "Credential 引用",
+		credentialReferenceHint: "仅显示引用名、归属和孤儿状态；不会读取或删除密钥。",
+		credentialOrphan: "孤儿 · 可单独申请清理",
+		credentialInUse: (count) => `使用中 · ${count} 个 Provider`,
+		credentialPurgePlan: "申请清理",
+		credentialPurgeConfirm: "这是不可恢复的 Crew-owned 凭据清理，确认继续？",
+		credentialPurging: "清理中…",
+		credentialPurgeUnavailable: "凭据清理不可用",
+		credentialPurgeUnverified: "已执行清理，但验证失败；引用仍保留用于恢复检查",
 		customProviders: "自定义 Provider",
 		addProvider: "＋ 添加 Provider",
 		noCustomProviders: "暂无。添加后会出现在上方的视觉 / 生图 provider 选择里。",
@@ -745,7 +766,7 @@ const COPY = {
 			"follow-dsh": "Follow Harness · use each tier's ordered model priority",
 			"deepseek-official": "DeepSeek Official · use legacy fixed model routing"
 		},
-		workerProviderHint: "Applies to Hub workers only; Standalone always uses deepseek-official + DEEPSEEK_API_KEY.",
+		workerProviderHint: "Applies to Hub workers only; Standalone is legacy migration metadata only and is not a production execution path.",
 		workerModels: "Worker Models",
 		refreshHarnessModels: "Refresh Harness Models",
 		refreshingModels: "Refreshing…",
@@ -814,11 +835,23 @@ const COPY = {
 		providerDeletePlan: "Plan deletion",
 		providerDelete: "Confirm delete",
 		providerPlanReady: "Plan ready; a second confirmation is required before changing 3210 config.",
+		providerRollback: "Rollback",
+		providerRollbackConfirm: "Restore this Harness Provider and its previous routing from the saved transaction?",
+		providerRollbackUnavailable: "No verified rollback transaction is available",
 		providerReplacement: "Replacement Harness Default provider id",
 		providerDeleteConfirm: "Delete this Harness Provider per the plan? Routing refs will be scrubbed and 3210 restarted.",
 		providerDeleteBlocked: "This Provider cannot be deleted (built-in, in use, already absent, or missing a valid replacement).",
 		providerLifecycleError: "Provider lifecycle operation failed",
 		providerNoInventory: "3210 Provider inventory is temporarily unavailable.",
+		credentialReferences: "Credential references",
+		credentialReferenceHint: "Names, ownership, and orphan status only; values are never read or deleted.",
+		credentialOrphan: "orphan · separate purge approval required",
+		credentialInUse: (count) => `in use · ${count} provider(s)`,
+		credentialPurgePlan: "Purge…",
+		credentialPurgeConfirm: "This irreversibly removes a Crew-owned credential. Continue?",
+		credentialPurging: "Purging…",
+		credentialPurgeUnavailable: "Credential purge unavailable",
+		credentialPurgeUnverified: "Purge ran but verification failed; the reference remains visible for recovery",
 		customProviders: "Custom providers",
 		addProvider: "＋ Add provider",
 		noCustomProviders: "None yet. Added providers appear in the vision / image-gen selects above.",
@@ -1406,6 +1439,9 @@ function WorkersPanel({ ctx }) {
 	const [modelCatalogBusy, setModelCatalogBusy] = (0, react.useState)(false);
 	const [providerInventory, setProviderInventory] = (0, react.useState)(null);
 	const [providerHealth, setProviderHealth] = (0, react.useState)([]);
+	const [credentialRefs, setCredentialRefs] = (0, react.useState)([]);
+	const [credentialUnverified, setCredentialUnverified] = (0, react.useState)([]);
+	const [credentialLifecycleBusy, setCredentialLifecycleBusy] = (0, react.useState)(null);
 	const [providerInventoryError, setProviderInventoryError] = (0, react.useState)("");
 	const [providerLifecycleBusy, setProviderLifecycleBusy] = (0, react.useState)(null);
 	const [modelPickerTier, setModelPickerTier] = (0, react.useState)(null);
@@ -1414,6 +1450,7 @@ function WorkersPanel({ ctx }) {
 	const [expandedSections, setExpandedSections] = (0, react.useState)(() => readSectionState(sectionStorage()));
 	const [surface, setSurface] = (0, react.useState)("detecting");
 	const [runtimeInfo, setRuntimeInfo] = (0, react.useState)(void 0);
+	const [readinessSnapshot, setReadinessSnapshot] = (0, react.useState)(void 0);
 	const toggleSection = (sectionId) => {
 		setExpandedSections((current) => ({
 			...current,
@@ -1494,13 +1531,15 @@ function WorkersPanel({ ctx }) {
 	}, [detectSurface]);
 	const refreshAll = (0, react.useCallback)(async () => {
 		try {
-			const [j, s, c, pr, pi, ph] = await Promise.all([
+			const [j, s, c, pr, pi, ph, cr, ext] = await Promise.all([
 				get("/jobs"),
 				get("/install/status"),
 				get("/config"),
 				get("/presets"),
 				get("/providers").catch(() => null),
-				get("/provider-health").catch(() => null)
+				get("/provider-health").catch(() => null),
+				get("/credential-references").catch(() => null),
+				get("/extension").catch(() => null)
 			]);
 			if (j.ok) setJobs(j.jobs ?? []);
 			if (s.ok) setStatus(s.status);
@@ -1514,6 +1553,11 @@ function WorkersPanel({ ctx }) {
 			}))]);
 			if (pi?.ok) setProviderInventory(pi);
 			if (ph?.ok) setProviderHealth(ph.health ?? []);
+			if (cr?.ok) {
+				setCredentialRefs(cr.records ?? []);
+				setCredentialUnverified(cr.unverified_purges ?? []);
+			}
+			if (ext?.ok) setReadinessSnapshot(ext.extension?.readiness_snapshot ?? void 0);
 		} catch {}
 	}, [get]);
 	(0, react.useEffect)(() => {
@@ -1547,14 +1591,59 @@ function WorkersPanel({ ctx }) {
 	const refreshProviderInventory = (0, react.useCallback)(async () => {
 		setProviderInventoryError("");
 		try {
-			const [result, health] = await Promise.all([get("/providers"), get("/provider-health").catch(() => null)]);
+			const [result, health, refs] = await Promise.all([
+				get("/providers"),
+				get("/provider-health").catch(() => null),
+				get("/credential-references").catch(() => null)
+			]);
 			if (!result.ok) throw new Error(result.error ?? copy.providerNoInventory);
 			setProviderInventory(result);
 			if (health?.ok) setProviderHealth(health.health ?? []);
+			if (refs?.ok) {
+				setCredentialRefs(refs.records ?? []);
+				setCredentialUnverified(refs.unverified_purges ?? []);
+			}
 		} catch (error) {
 			setProviderInventoryError(error?.message ?? copy.providerNoInventory);
 		}
 	}, [get, copy]);
+	const purgeCredentialRef = (0, react.useCallback)(async (ref) => {
+		if (ref?.ownership !== "crew-owned" || ref?.orphan !== true || ref?.purge_capability !== "eligible") return;
+		const referenceId = String(ref.reference_id ?? "");
+		if (!referenceId || !window.confirm(copy.credentialPurgeConfirm)) return;
+		setCredentialLifecycleBusy(referenceId);
+		setNotice(copy.working);
+		try {
+			const encoded = encodeURIComponent(referenceId);
+			const planned = await post(`/credential-references/${encoded}/purge-plan`, {});
+			if (!planned.ok || !planned.plan) throw new Error(planned.code ?? copy.credentialPurgeUnavailable);
+			if (!window.confirm(`${copy.credentialPurgeConfirm}\n\n${referenceId}`)) return;
+			const result = await readJson(await fetch(withLang(`/credential-references/${encoded}`), {
+				method: "DELETE",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					plan_id: planned.plan.plan_id,
+					expected_revision: planned.plan.expected_revision,
+					confirm: true,
+					lang: locale === "zh" ? "zh" : "en"
+				})
+			}), `/credential-references/${encoded}`);
+			if (!result.ok || result.state !== "VERIFIED") throw new Error(result.code ?? copy.credentialPurgeUnavailable);
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			setNotice(String(error?.message ?? error));
+		} finally {
+			setCredentialLifecycleBusy(null);
+		}
+	}, [
+		copy,
+		locale,
+		post,
+		readJson,
+		refreshProviderInventory,
+		withLang
+	]);
 	(0, react.useEffect)(() => {
 		if (surface === CREW_UI_SURFACES.OFFICIAL) refreshHarnessModels();
 	}, [surface, refreshHarnessModels]);
@@ -1922,6 +2011,43 @@ function WorkersPanel({ ctx }) {
 			setProviderLifecycleBusy(null);
 		}
 	};
+	const rollbackHarnessProvider = async (record, transactionId) => {
+		if (!record || !transactionId || record.desired_state !== "absent") {
+			setNotice(copy.providerRollbackUnavailable);
+			return;
+		}
+		if (!window.confirm(copy.providerRollbackConfirm)) return;
+		setProviderLifecycleBusy(`rollback:${record.id}`);
+		setNotice(copy.working);
+		try {
+			const encoded = encodeURIComponent(record.id);
+			const result = await post(`/providers/${encoded}/rollback`, {
+				transaction_id: transactionId,
+				confirm: true
+			});
+			if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+			if (result.restart_required === true && result.state === "ROLLBACK_PENDING") {
+				const restartPath = "http://127.0.0.1:3080/_dsh/dsh-crew/supervisor/restart";
+				const restarted = await readJson(await fetch(restartPath, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ confirm: true })
+				}), restartPath);
+				if (!restarted.ok) throw new Error(restarted.code ?? restarted.error ?? copy.providerLifecycleError);
+				const verified = await post(`/providers/${encoded}/verify-rollback`, {
+					transaction_id: transactionId,
+					confirm: true
+				});
+				if (!verified.ok || verified.state !== "ROLLED_BACK") throw new Error(verified.code ?? verified.error ?? copy.providerLifecycleError);
+			} else if (result.state !== "ROLLED_BACK") throw new Error(result.code ?? copy.providerLifecycleError);
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			setNotice(String(error?.message ?? error));
+		} finally {
+			setProviderLifecycleBusy(null);
+		}
+	};
 	/** Card: title + one-line description header, then its fields. */
 	const block = (text, fields, gridded = true) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 		style: S.block,
@@ -2021,7 +2147,8 @@ function WorkersPanel({ ctx }) {
 	const hostReadiness = projectHostReadiness({
 		installStatus: status,
 		runtime: runtimeInfo,
-		surface
+		surface,
+		readinessSnapshot
 	});
 	if (!currentSurfaceResponsibilities.fullControlPlane) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(MinimalCrewPanel, {
 		locale,
@@ -3463,6 +3590,7 @@ function WorkersPanel({ ctx }) {
 						(providerInventory?.records ?? []).map((record) => {
 							const blocked = record.ownership === "harness" || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0;
 							const lifecycle = record.desired_state === "absent" ? "absent" : record.lifecycle?.enabled === false ? "disabled" : record.lifecycle?.catalogued ? "catalogued" : "configured";
+							const rollbackTransaction = (providerInventory?.lifecycle_transactions ?? []).find((entry) => entry.provider_id === record.id && ["VERIFIED", "RESTART_PENDING"].includes(entry.state));
 							return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: {
 									display: "flex",
@@ -3507,9 +3635,95 @@ function WorkersPanel({ ctx }) {
 											deleteHarnessProvider(record);
 										},
 										children: providerLifecycleBusy === record.id ? copy.working : copy.providerDeletePlan
+									}),
+									record.desired_state === "absent" && rollbackTransaction && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: {
+											...S.btn,
+											padding: "2px 8px"
+										},
+										disabled: providerLifecycleBusy !== null,
+										onClick: () => {
+											rollbackHarnessProvider(record, rollbackTransaction.transaction_id);
+										},
+										children: providerLifecycleBusy === `rollback:${record.id}` ? copy.working : copy.providerRollback
 									})
 								]
 							}, record.id);
+						}),
+						(credentialRefs.length > 0 || credentialUnverified.length > 0) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							style: {
+								marginTop: 10,
+								borderTop: "1px solid rgba(128,128,128,0.16)",
+								paddingTop: 8
+							},
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									style: {
+										fontWeight: 600,
+										fontSize: 12.5
+									},
+									children: copy.credentialReferences
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									style: {
+										fontSize: 11,
+										opacity: .6,
+										margin: "3px 0 7px"
+									},
+									children: copy.credentialReferenceHint
+								}),
+								credentialUnverified.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: {
+										color: "#c55",
+										fontSize: 11.5
+									},
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: S.mono,
+											children: entry.reference_id
+										}),
+										" · ",
+										copy.credentialPurgeUnverified
+									]
+								}, `unverified:${entry.reference_id}`)),
+								credentialRefs.map((ref) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: {
+										display: "flex",
+										alignItems: "center",
+										gap: 8,
+										fontSize: 11.5,
+										flexWrap: "wrap"
+									},
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: S.mono,
+											children: ref.reference_id
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: { opacity: .65 },
+											children: ref.ownership
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											style: { color: ref.orphan ? "#c98735" : void 0 },
+											children: ref.orphan ? copy.credentialOrphan : copy.credentialInUse(ref.consumer_count ?? 0)
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { flex: 1 } }),
+										ref.ownership === "crew-owned" && ref.orphan === true && ref.purge_capability === "eligible" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											style: {
+												...S.btn,
+												padding: "2px 8px"
+											},
+											disabled: credentialLifecycleBusy !== null,
+											onClick: () => {
+												purgeCredentialRef(ref);
+											},
+											children: credentialLifecycleBusy === ref.reference_id ? copy.credentialPurging : copy.credentialPurgePlan
+										})
+									]
+								}, ref.reference_id))
+							]
 						})
 					]
 				}),