@ran-sh/dsh-crew 1.0.3 → 1.1.0

package/src/runtime-identity.mjs

@@ -5,10 +5,18 @@
 // - HUB_PROTOCOL_VERSION changes only when Hub <-> MCP wire semantics become
 //   incompatible.
 //
+// The Harness/DSH cohort version (e.g. 0.1.2-rc.1) is a THIRD, independent
+// domain: it identifies the installed @deepseek-ai/dsh package generation,
+// never the Crew release. Verifiers must compare the cohort against
+// dsh_version, never against runtime_version.
+//
 // Keep this module dependency-light so Hub, MCP and tests all use the exact
 // same compatibility rules.
 
 import { randomUUID } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 
 // Production Crew execution is intentionally bound to the isolated 3210 Hub.
 // These fields are public provenance only; no credential or session secret is
@@ -18,7 +26,7 @@ export const PRODUCTION_PROFILE = 'dsh-crew';
 export const PRODUCTION_LISTEN_PORT = 3210;
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.0.3';
+export const RUNTIME_VERSION = '1.1.0';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([
@@ -80,6 +88,7 @@ export function getHubRuntimeIdentity() {
     surface: 'native-crew-harness',
     ui_role: 'runtime',
     runtime_version: RUNTIME_VERSION,
+    dsh_version: readCrewDshVersion(),
     protocol_version: HUB_PROTOCOL_VERSION,
     execution_plane: PRODUCTION_EXECUTION_PLANE,
     profile: PRODUCTION_PROFILE,
@@ -89,6 +98,19 @@ export function getHubRuntimeIdentity() {
   };
 }
 
+// Installed Harness cohort version (the @deepseek-ai/dsh package under the
+// Crew-owned DSH home). Null when unreadable: callers treat null as
+// "unknown cohort", never as a match. This is the ONLY field cohort
+// verifiers may compare against TARGET_DSH_VERSION.
+export function readCrewDshVersion({ home = homedir() } = {}) {
+  try {
+    const file = join(home, '.config', 'dsh-crew', 'harness', 'runtime', 'node_modules', '@deepseek-ai', 'dsh', 'package.json');
+    if (!existsSync(file)) return null;
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    return typeof parsed?.version === 'string' && parsed.version.length > 0 ? parsed.version : null;
+  } catch { return null; }
+}
+
 /**
  * Evaluate an already-received Hub ping body.
  *

package/src/supervisor/restart-request.mjs

@@ -0,0 +1,202 @@
+// Durable restart-request protocol between the Crew hub (3210) and the
+// Windows Crew supervisor (launcher).
+//
+// The hub must NEVER spawn itself: self-spawn creates an ownership handoff
+// window (port still held, PID reuse, no authority to judge the new
+// process). Instead the hub writes a durable, self-describing restart
+// request; the supervisor (the only process authority) polls, validates the
+// request against its persisted ownership (PID + start time + live
+// runtime_id), executes the restart, and writes a verified result.
+//
+// Directory layout (all under the Crew app root):
+//   supervisor/restart-requests/<request-id>.json
+//   supervisor/restart-results/<request-id>.json
+//   supervisor/heartbeat.json
+//   supervisor/ownership.json
+
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const RESTART_REQUEST_SCHEMA = 1;
+export const RESTART_REQUEST_TTL_MS = 60_000;
+
+export function supervisorStateRoot(appRoot) {
+  return join(appRoot, 'supervisor');
+}
+
+export function restartRequestsDir(appRoot) {
+  return join(supervisorStateRoot(appRoot), 'restart-requests');
+}
+
+export function restartResultsDir(appRoot) {
+  return join(supervisorStateRoot(appRoot), 'restart-results');
+}
+
+export function heartbeatFile(appRoot) {
+  return join(supervisorStateRoot(appRoot), 'heartbeat.json');
+}
+
+export function ownershipFile(appRoot) {
+  return join(supervisorStateRoot(appRoot), 'ownership.json');
+}
+
+function writeFileAtomic(file, content) {
+  mkdirSync(dirname(file), { recursive: true });
+  const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temp, content);
+  try {
+    renameSync(temp, file);
+  } catch (error) {
+    try { rmSync(temp, { force: true }); } catch {}
+    throw error;
+  }
+}
+
+/**
+ * Create a durable restart request. The runtime identity is taken from the
+ * CALLER's own live identity contract — never accepted from the HTTP caller —
+ * so a stale or forged request cannot claim a runtime_id it does not hold.
+ */
+export function createRestartRequest({
+  appRoot,
+  runtimeIdentity,
+  reason = null,
+  now = Date.now(),
+  ttlMs = RESTART_REQUEST_TTL_MS,
+}) {
+  return createSupervisorRequest({
+    appRoot,
+    operation: 'restart',
+    runtimeIdentity,
+    reason,
+    now,
+    ttlMs,
+  });
+}
+
+/**
+ * Create a durable supervisor request for maintenance transactions
+ * (stop/start around a runtime-tree swap). The launcher-mediated npx flow
+ * uses these instead of spawning/killing the 3210 itself: the launcher is
+ * the only process authority. `lease` binds the stop and start phases of
+ * one transaction; `extra` carries the expected versions for verification.
+ */
+export function createSupervisorRequest({
+  appRoot,
+  operation,
+  runtimeIdentity,
+  reason = null,
+  lease = randomUUID(),
+  extra = null,
+  now = Date.now(),
+  ttlMs = RESTART_REQUEST_TTL_MS,
+}) {
+  const request = {
+    schema_version: RESTART_REQUEST_SCHEMA,
+    request_id: randomUUID(),
+    operation,
+    execution_plane: runtimeIdentity?.execution_plane ?? 'hub-3210',
+    profile: runtimeIdentity?.profile ?? 'dsh-crew',
+    port: runtimeIdentity?.listen_port ?? 3210,
+    runtime_id: runtimeIdentity?.runtime_id ?? null,
+    lease,
+    requested_at: now,
+    expires_at: now + ttlMs,
+    reason: reason ?? null,
+    extra,
+  };
+  if (typeof request.runtime_id !== 'string' || request.runtime_id.length === 0) {
+    return { ok: false, code: 'RUNTIME_IDENTITY_INCOMPLETE', error: 'cannot request supervisor action without a live runtime_id' };
+  }
+  const dir = operation.startsWith('maintenance-') ? maintenanceRequestsDir(appRoot) : restartRequestsDir(appRoot);
+  mkdirSync(dir, { recursive: true });
+  const file = join(dir, `${request.request_id}.json`);
+  writeFileAtomic(file, JSON.stringify(request, null, 2) + '\n');
+  return { ok: true, request, file };
+}
+
+export function maintenanceRequestsDir(appRoot) {
+  return join(supervisorStateRoot(appRoot), 'maintenance-requests');
+}
+
+export function maintenanceResultsDir(appRoot) {
+  return join(supervisorStateRoot(appRoot), 'maintenance-results');
+}
+
+export function readRestartRequest(appRoot, requestId) {
+  try {
+    const parsed = JSON.parse(readFileSync(join(restartRequestsDir(appRoot), `${requestId}.json`), 'utf8'));
+    if (parsed?.schema_version === RESTART_REQUEST_SCHEMA && parsed.request_id === requestId) return parsed;
+  } catch { /* absent or malformed */ }
+  return null;
+}
+
+export function listRestartRequests(appRoot) {
+  const dir = restartRequestsDir(appRoot);
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((name) => name.endsWith('.json'))
+    .map((name) => {
+      try { return JSON.parse(readFileSync(join(dir, name), 'utf8')); } catch { return null; }
+    })
+    .filter(Boolean);
+}
+
+export function removeRestartRequest(appRoot, requestId) {
+  try { rmSync(join(restartRequestsDir(appRoot), `${requestId}.json`), { force: true }); } catch {}
+}
+
+export function writeRestartResult({ appRoot, request, state, detail = null, now = Date.now() }) {
+  const result = {
+    schema_version: RESTART_REQUEST_SCHEMA,
+    request_id: request.request_id,
+    operation: request.operation,
+    state,
+    runtime_id: request.runtime_id,
+    written_at: now,
+    detail,
+  };
+  const file = join(restartResultsDir(appRoot), `${request.request_id}.json`);
+  writeFileAtomic(file, JSON.stringify(result, null, 2) + '\n');
+  return result;
+}
+
+export function readRestartResult(appRoot, requestId) {
+  try {
+    const parsed = JSON.parse(readFileSync(join(restartResultsDir(appRoot), `${requestId}.json`), 'utf8'));
+    if (parsed?.schema_version === RESTART_REQUEST_SCHEMA && parsed.request_id === requestId) return parsed;
+  } catch { /* absent */ }
+  return null;
+}
+
+/**
+ * Read the supervisor heartbeat. Returns null when the supervisor is not
+ * actively heartbeating (absent, stale beyond tolerance, or malformed).
+ */
+export function readSupervisorHeartbeat(appRoot, { now = Date.now(), staleAfterMs = 15_000 } = {}) {
+  try {
+    const parsed = JSON.parse(readFileSync(heartbeatFile(appRoot), 'utf8'));
+    if (parsed?.schema_version !== 1 || !Number.isInteger(parsed.pid) || parsed.pid < 1) return null;
+    if (typeof parsed.last_seen !== 'number' || now - parsed.last_seen > staleAfterMs) return null;
+    return parsed;
+  } catch { return null; }
+}
+
+export function writeSupervisorHeartbeat({ appRoot, pid, now = Date.now() }) {
+  const record = {
+    schema_version: 1,
+    supervisor_instance_id: randomUUID(),
+    pid,
+    last_seen: now,
+    protocol_version: 1,
+  };
+  // Merge onto the previous record so the instance id is stable per watcher
+  // run (the watcher rewrites this file every few seconds).
+  try {
+    const prev = JSON.parse(readFileSync(heartbeatFile(appRoot), 'utf8'));
+    if (prev?.schema_version === 1) record.supervisor_instance_id = prev.supervisor_instance_id;
+  } catch { /* first beat */ }
+  writeFileAtomic(heartbeatFile(appRoot), JSON.stringify(record, null, 2) + '\n');
+  return record;
+}