@ran-sh/dsh-crew 1.0.0 → 1.0.2

package/README.md

@@ -17,9 +17,13 @@ dsh-crew integrate
 dsh-crew status
 ```
 
-Open <http://127.0.0.1:3080> for the daily console. On Windows, installation
-also registers login startup for the 3080 console; its official bridge starts
-and owns the isolated 3210 Harness backend.
+Open <http://127.0.0.1:3080> for the daily console. On Windows, installation
+also registers login startup for the 3080 console; its official bridge starts
+and owns the isolated 3210 Harness backend.
+
+Fresh installs contain only the built-in DeepSeek route. Add your own provider
+credentials, model priorities, and optional integrations in the local Settings;
+they are never bundled into this package.
 
 | Surface | Purpose |
 | --- | --- |
@@ -42,26 +46,26 @@ silently falling back.
 ## Useful commands
 
 ```bash
-dsh-crew inspect          # live capabilities and readiness
-dsh-crew jobs list        # jobs and Result Contracts
-dsh-crew providers list   # 3210 Harness provider inventory (secret-free)
-dsh-crew providers probe <provider-id>
-curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # references/orphans only
-dsh-crew credentials list  # secret-free reference inventory
-dsh-crew credentials purge-plan env:NAME
-dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
-dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
-dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
-dsh-crew releases list     # retained validated payloads
-dsh-crew rollback <version> # switch payload and verify the 3210 runtime
-dsh-crew update           # update and repair enabled integrations
+dsh-crew inspect          # live capabilities and readiness
+dsh-crew jobs list        # jobs and Result Contracts
+dsh-crew providers list   # 3210 Harness provider inventory (secret-free)
+dsh-crew providers probe <provider-id>
+curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # references/orphans only
+dsh-crew credentials list  # secret-free reference inventory
+dsh-crew credentials purge-plan env:NAME
+dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
+dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew releases list     # retained validated payloads
+dsh-crew rollback <version> # switch payload and verify the 3210 runtime
+dsh-crew update           # update and repair enabled integrations
 dsh-crew uninstall        # remove managed files, keep backups/config
 ```
 
-The runtime is isolated under `~/.config/dsh-crew/harness` with `profile: dsh-crew`;
-the official `web` profile receives only the 3080 bridge.
-All production Worker/Reviewer model calls are executed by the isolated 3210
-Crew Harness; 3080 is a control-plane bridge only.
+The runtime is isolated under `~/.config/dsh-crew/harness` with `profile: dsh-crew`;
+the official `web` profile receives only the 3080 bridge.
+All production Worker/Reviewer model calls are executed by the isolated 3210
+Crew Harness; 3080 is a control-plane bridge only.
 
 ## Legacy launcher migration
 

package/README.zh.md

@@ -16,8 +16,11 @@ dsh-crew integrate
 dsh-crew status
 ```
 
-打开 <http://127.0.0.1:3080> 进入日常控制台。Windows 安装会注册当前用户的
-登录启动项，先启动 3080 控制台，再由官方桥接启动并监管隔离的 3210 Harness。
+打开 <http://127.0.0.1:3080> 进入日常控制台。Windows 安装会注册当前用户的
+登录启动项，先启动 3080 控制台，再由官方桥接启动并监管隔离的 3210 Harness。
+
+全新安装只包含内置 DeepSeek 路由。其他 Provider 凭据、模型优先级和可选集成需要
+在本机设置中自行配置，绝不会打包进发布版本。
 
 | 界面 | 用途 |
 | --- | --- |
@@ -38,25 +41,25 @@ dsh-crew status
 ## 常用命令
 
 ```bash
-dsh-crew inspect          # 实时能力与就绪度
-dsh-crew jobs list        # 任务与 Result Contract
-dsh-crew providers list   # 3210 Harness Provider 清单（不含密钥）
-dsh-crew providers probe <provider-id>
-curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # 仅查看引用/孤儿报告
-dsh-crew credentials list  # 不含密钥值的引用清单
-dsh-crew credentials purge-plan env:NAME
-dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
-dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
-dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
-dsh-crew releases list     # 查看保留且已验证的版本
-dsh-crew rollback <version> # 切换版本并验证 3210 runtime
-dsh-crew update           # 更新并修复已启用集成
+dsh-crew inspect          # 实时能力与就绪度
+dsh-crew jobs list        # 任务与 Result Contract
+dsh-crew providers list   # 3210 Harness Provider 清单（不含密钥）
+dsh-crew providers probe <provider-id>
+curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # 仅查看引用/孤儿报告
+dsh-crew credentials list  # 不含密钥值的引用清单
+dsh-crew credentials purge-plan env:NAME
+dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
+dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew releases list     # 查看保留且已验证的版本
+dsh-crew rollback <version> # 切换版本并验证 3210 runtime
+dsh-crew update           # 更新并修复已启用集成
 dsh-crew uninstall        # 移除受管文件，保留配置/备份
 ```
 
-运行时隔离在 `~/.config/dsh-crew/harness`，使用 `profile: dsh-crew`；官方 `web` profile
-只接收 3080 轻量桥接。
-生产 Worker/Reviewer 的模型调用全部由隔离的 3210 Crew Harness 执行，3080 仅作为控制面桥接。
+运行时隔离在 `~/.config/dsh-crew/harness`，使用 `profile: dsh-crew`；官方 `web` profile
+只接收 3080 轻量桥接。
+生产 Worker/Reviewer 的模型调用全部由隔离的 3210 Crew Harness 执行，3080 仅作为控制面桥接。
 
 ## 旧启动器迁移
 

package/lib/client.js

@@ -509,6 +509,8 @@ const COPY = {
 		providerState: (state) => `状态：${state}`,
 		providerModels: (count) => `${count} 个模型`,
 		providerJobs: (count) => `${count} 个运行任务`,
+		providerOfficialBuiltin: "· 官方内置（不可删除）",
+		providerSourceUnresolved: "· 来源未解析（安全锁定）",
 		providerDeletePlan: "生成删除计划",
 		providerDelete: "确认删除",
 		providerPlanReady: "计划已生成；再次确认后才会修改 3210 配置。",
@@ -519,6 +521,12 @@ const COPY = {
 		providerDeleteConfirm: "确认按计划删除这个 Harness Provider？会清理路由引用并重启 3210。",
 		providerDeleteBlocked: "当前 Provider 不能删除（内置、在用、已删除或缺少可用替换）。",
 		providerLifecycleError: "Provider 生命周期操作失败",
+		providerDeletePending: "配置可能已变更，事务仍待重启/验证；请刷新状态后选择回滚。",
+		providerRollbackContinue: "继续回滚验证",
+		recoveryUnresolved: "发现不可自动恢复的事务",
+		recoveryStorage: "存储项",
+		recoveryQuarantine: "隔离",
+		recoveryQuarantineConfirm: "该事务清单无法安全恢复。将其移入隔离区并阻止自动使用，继续？",
 		providerNoInventory: "暂时无法读取 3210 Provider inventory。",
 		credentialReferences: "Credential 引用",
 		credentialReferenceHint: "仅显示引用名、归属和孤儿状态；不会读取或删除密钥。",
@@ -832,6 +840,8 @@ const COPY = {
 		providerState: (state) => `State: ${state}`,
 		providerModels: (count) => `${count} models`,
 		providerJobs: (count) => `${count} running jobs`,
+		providerOfficialBuiltin: "· official built-in (immutable)",
+		providerSourceUnresolved: "· source unresolved (locked)",
 		providerDeletePlan: "Plan deletion",
 		providerDelete: "Confirm delete",
 		providerPlanReady: "Plan ready; a second confirmation is required before changing 3210 config.",
@@ -842,6 +852,12 @@ const COPY = {
 		providerDeleteConfirm: "Delete this Harness Provider per the plan? Routing refs will be scrubbed and 3210 restarted.",
 		providerDeleteBlocked: "This Provider cannot be deleted (built-in, in use, already absent, or missing a valid replacement).",
 		providerLifecycleError: "Provider lifecycle operation failed",
+		providerDeletePending: "Configuration may already be changed; the transaction still needs restart/verification. Refresh status and use rollback if needed.",
+		providerRollbackContinue: "Continue rollback verification",
+		recoveryUnresolved: "An unrecoverable recovery transaction is blocking deletion",
+		recoveryStorage: "storage entry",
+		recoveryQuarantine: "Quarantine",
+		recoveryQuarantineConfirm: "This recovery manifest cannot be safely reopened. Move it into the quarantine area and keep it out of automatic recovery?",
 		providerNoInventory: "3210 Provider inventory is temporarily unavailable.",
 		credentialReferences: "Credential references",
 		credentialReferenceHint: "Names, ownership, and orphan status only; values are never read or deleted.",
@@ -1959,13 +1975,13 @@ function WorkersPanel({ ctx }) {
 		applyPatch(patch);
 	};
 	const deleteHarnessProvider = async (record) => {
-		if (!record || record.ownership === "harness" || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0) {
+		if (!record || record.delete_capability !== "supported" || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0) {
 			setNotice(copy.providerDeleteBlocked);
 			return;
 		}
 		let replacementDefault;
 		if (record.references?.harness_default === true) {
-			const candidate = (providerInventory?.records ?? []).find((item) => item.id !== record.id && item.desired_state !== "absent" && item.ownership !== "harness" && (item.models?.length ?? 0) > 0)?.id ?? "";
+			const candidate = (providerInventory?.records ?? []).find((item) => item.id === "deepseek-official" && item.id !== record.id && item.desired_state !== "absent" && (item.models?.length ?? 0) > 0)?.id ?? (providerInventory?.records ?? []).find((item) => item.id !== record.id && item.desired_state !== "absent" && item.delete_capability !== "source-unresolved" && (item.models?.length ?? 0) > 0)?.id ?? "";
 			const entered = window.prompt(copy.providerReplacement, candidate);
 			if (!entered?.trim()) return;
 			replacementDefault = entered.trim();
@@ -2006,13 +2022,29 @@ function WorkersPanel({ ctx }) {
 			setNotice(copy.saved);
 			await refreshProviderInventory();
 		} catch (error) {
-			setNotice(String(error?.message ?? error));
+			try {
+				await refreshProviderInventory();
+			} catch {}
+			setNotice(`${String(error?.message ?? error)} · ${copy.providerDeletePending}`);
 		} finally {
 			setProviderLifecycleBusy(null);
 		}
 	};
-	const rollbackHarnessProvider = async (record, transactionId) => {
-		if (!record || !transactionId || record.desired_state !== "absent") {
+	const rollbackHarnessProvider = async (record, transactionId, transactionState = "VERIFIED") => {
+		const continuing = ["ROLLBACK_PENDING", "ROLLBACK_RESTART_PENDING"].includes(transactionState);
+		const recoverable = [
+			"PLANNED",
+			"TOMBSTONE_APPLYING",
+			"TOMBSTONE_APPLIED",
+			"REFERENCES_APPLYING",
+			"REFERENCES_APPLIED",
+			"DECLARATIONS_APPLYING",
+			"DECLARATIONS_APPLIED",
+			"DELETE_RESTART_PENDING",
+			"ROLLBACK_APPLYING",
+			"ROLLBACK_RESTORED"
+		].includes(transactionState);
+		if (!record || !transactionId || !continuing && !recoverable && record.desired_state !== "absent") {
 			setNotice(copy.providerRollbackUnavailable);
 			return;
 		}
@@ -2021,7 +2053,11 @@ function WorkersPanel({ ctx }) {
 		setNotice(copy.working);
 		try {
 			const encoded = encodeURIComponent(record.id);
-			const result = await post(`/providers/${encoded}/rollback`, {
+			const result = continuing ? {
+				ok: true,
+				restart_required: true,
+				state: "ROLLBACK_PENDING"
+			} : await post(`/providers/${encoded}/rollback`, {
 				transaction_id: transactionId,
 				confirm: true
 			});
@@ -2043,6 +2079,32 @@ function WorkersPanel({ ctx }) {
 			setNotice(copy.saved);
 			await refreshProviderInventory();
 		} catch (error) {
+			try {
+				await refreshProviderInventory();
+			} catch {}
+			setNotice(`${String(error?.message ?? error)} · ${copy.providerDeletePending}`);
+		} finally {
+			setProviderLifecycleBusy(null);
+		}
+	};
+	const quarantineRecoveryTransaction = async (entry) => {
+		const actionId = typeof entry?.action_id === "string" ? entry.action_id : "";
+		if (!actionId || entry?.recoverable === true) return;
+		if (!window.confirm(copy.recoveryQuarantineConfirm)) return;
+		setProviderLifecycleBusy(`quarantine:${actionId}`);
+		setNotice(copy.working);
+		try {
+			const result = await post("/providers/_recovery/quarantine", {
+				action_id: actionId,
+				confirm: true
+			});
+			if (!result.ok) throw new Error(result.code ?? result.error ?? copy.providerLifecycleError);
+			setNotice(copy.saved);
+			await refreshProviderInventory();
+		} catch (error) {
+			try {
+				await refreshProviderInventory();
+			} catch {}
 			setNotice(String(error?.message ?? error));
 		} finally {
 			setProviderLifecycleBusy(null);
@@ -3040,7 +3102,7 @@ function WorkersPanel({ ctx }) {
 											style: S.fieldLabel,
 											children: copy.workerProvider
 										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CustomSelect, {
-											value: config.worker_provider_mode ?? "follow-dsh",
+											value: config.worker_provider_mode ?? "deepseek-official",
 											onChange: (v) => field("worker_provider_mode", v),
 											options: ["follow-dsh", "deepseek-official"].map((m) => ({
 												value: m,
@@ -3588,9 +3650,31 @@ function WorkersPanel({ ctx }) {
 							children: copy.providerNoInventory
 						}),
 						(providerInventory?.records ?? []).map((record) => {
-							const blocked = record.ownership === "harness" || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0;
+							const immutable = record.delete_capability === "immutable-builtin";
+							const unresolved = record.delete_capability === "source-unresolved";
+							const blocked = immutable || unresolved || record.desired_state === "absent" || Number(record.references?.active_jobs ?? 0) > 0;
 							const lifecycle = record.desired_state === "absent" ? "absent" : record.lifecycle?.enabled === false ? "disabled" : record.lifecycle?.catalogued ? "catalogued" : "configured";
-							const rollbackTransaction = (providerInventory?.lifecycle_transactions ?? []).find((entry) => entry.provider_id === record.id && ["VERIFIED", "RESTART_PENDING"].includes(entry.state));
+							const lifecycleTransactions = providerInventory?.lifecycle_transactions ?? [];
+							const recoveryTransactions = (providerInventory?.recovery_transactions ?? []).map((entry) => ({
+								...entry,
+								state: entry.phase
+							}));
+							const rollbackTransaction = [...lifecycleTransactions, ...recoveryTransactions].filter((entry) => entry.provider_id === record.id && [
+								"VERIFIED",
+								"RESTART_PENDING",
+								"ROLLBACK_PENDING",
+								"PLANNED",
+								"TOMBSTONE_APPLYING",
+								"TOMBSTONE_APPLIED",
+								"REFERENCES_APPLYING",
+								"REFERENCES_APPLIED",
+								"DECLARATIONS_APPLYING",
+								"DECLARATIONS_APPLIED",
+								"DELETE_RESTART_PENDING",
+								"ROLLBACK_RESTART_PENDING",
+								"ROLLBACK_RESTORED",
+								"ROLLBACK_APPLYING"
+							].includes(entry.state)).sort((a, b) => String(a.updated_at ?? "").localeCompare(String(b.updated_at ?? ""))).at(-1);
 							return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: {
 									display: "flex",
@@ -3619,12 +3703,20 @@ function WorkersPanel({ ctx }) {
 										style: { opacity: .65 },
 										children: copy.providerModels(record.models?.length ?? 0)
 									}),
+									immutable && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: { opacity: .65 },
+										children: copy.providerOfficialBuiltin
+									}),
+									unresolved && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: { color: "#c98735" },
+										children: copy.providerSourceUnresolved
+									}),
 									Number(record.references?.active_jobs ?? 0) > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 										style: { color: "#c98735" },
 										children: copy.providerJobs(record.references.active_jobs)
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { flex: 1 } }),
-									record.ownership !== "harness" && record.desired_state !== "absent" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									record.delete_capability === "supported" && record.desired_state !== "absent" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 										type: "button",
 										style: {
 											...S.btn,
@@ -3636,7 +3728,20 @@ function WorkersPanel({ ctx }) {
 										},
 										children: providerLifecycleBusy === record.id ? copy.working : copy.providerDeletePlan
 									}),
-									record.desired_state === "absent" && rollbackTransaction && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									(record.desired_state === "absent" || [
+										"PLANNED",
+										"TOMBSTONE_APPLYING",
+										"TOMBSTONE_APPLIED",
+										"REFERENCES_APPLYING",
+										"REFERENCES_APPLIED",
+										"DECLARATIONS_APPLYING",
+										"DECLARATIONS_APPLIED",
+										"DELETE_RESTART_PENDING",
+										"ROLLBACK_PENDING",
+										"ROLLBACK_RESTART_PENDING",
+										"ROLLBACK_RESTORED",
+										"ROLLBACK_APPLYING"
+									].includes(rollbackTransaction?.state)) && rollbackTransaction && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 										type: "button",
 										style: {
 											...S.btn,
@@ -3644,13 +3749,51 @@ function WorkersPanel({ ctx }) {
 										},
 										disabled: providerLifecycleBusy !== null,
 										onClick: () => {
-											rollbackHarnessProvider(record, rollbackTransaction.transaction_id);
+											rollbackHarnessProvider(record, rollbackTransaction.transaction_id, rollbackTransaction.state);
 										},
-										children: providerLifecycleBusy === `rollback:${record.id}` ? copy.working : copy.providerRollback
+										children: providerLifecycleBusy === `rollback:${record.id}` ? copy.working : rollbackTransaction.state === "ROLLBACK_PENDING" ? copy.providerRollbackContinue : copy.providerRollback
 									})
 								]
 							}, record.id);
 						}),
+						(providerInventory?.recovery_transactions ?? []).filter((entry) => entry?.unresolved === true || !entry?.provider_id).map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							style: {
+								display: "flex",
+								alignItems: "center",
+								gap: 8,
+								fontSize: 12,
+								flexWrap: "wrap",
+								color: "#c98735",
+								marginTop: 6
+							},
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									style: { fontWeight: 600 },
+									children: copy.recoveryUnresolved
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									style: S.mono,
+									children: entry.storage_id ?? entry.transaction_id ?? "unknown"
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									style: { opacity: .7 },
+									children: entry.phase
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { flex: 1 } }),
+								entry.action_id && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									style: {
+										...S.btn,
+										padding: "2px 8px"
+									},
+									disabled: providerLifecycleBusy !== null,
+									onClick: () => {
+										quarantineRecoveryTransaction(entry);
+									},
+									children: providerLifecycleBusy === `quarantine:${entry.action_id}` ? copy.working : copy.recoveryQuarantine
+								})
+							]
+						}, `recovery:${entry.storage_id ?? entry.transaction_id ?? "unknown"}`)),
 						(credentialRefs.length > 0 || credentialUnverified.length > 0) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							style: {
 								marginTop: 10,