@ran-sh/dsh-crew 1.1.0 → 1.2.0-rc.4

package/src/supervisor/restart-request.mjs

@@ -124,6 +124,31 @@ export function maintenanceResultsDir(appRoot) {
   return join(supervisorStateRoot(appRoot), 'maintenance-results');
 }
 
+export function maintenanceSessionFile(appRoot) {
+  return join(supervisorStateRoot(appRoot), 'maintenance-session.json');
+}
+
+export function readMaintenanceSession(appRoot) {
+  const file = maintenanceSessionFile(appRoot);
+  if (!existsSync(file)) return { ok: true, state: 'absent', session: null };
+  try {
+    const session = JSON.parse(readFileSync(file, 'utf8'));
+    const valid = session?.schema_version === 1
+      && session.state === 'STOPPED'
+      && typeof session.lease === 'string'
+      && session.lease.length > 0
+      && typeof session.runtime_id === 'string'
+      && session.runtime_id.length > 0
+      && typeof session.request_id === 'string'
+      && session.request_id.length > 0;
+    return valid
+      ? { ok: true, state: 'present', session }
+      : { ok: false, state: 'malformed', code: 'MAINTENANCE_SESSION_MALFORMED', session: null };
+  } catch (error) {
+    return { ok: false, state: 'malformed', code: 'MAINTENANCE_SESSION_MALFORMED', error: error?.message, session: null };
+  }
+}
+
 export function readRestartRequest(appRoot, requestId) {
   try {
     const parsed = JSON.parse(readFileSync(join(restartRequestsDir(appRoot), `${requestId}.json`), 'utf8'));
@@ -170,24 +195,47 @@ export function readRestartResult(appRoot, requestId) {
   return null;
 }
 
-/**
- * Read the supervisor heartbeat. Returns null when the supervisor is not
- * actively heartbeating (absent, stale beyond tolerance, or malformed).
- */
-export function readSupervisorHeartbeat(appRoot, { now = Date.now(), staleAfterMs = 15_000 } = {}) {
+/** Observe a fresh heartbeat without granting it restart authority. */
+export function readSupervisorHeartbeatRecord(appRoot, { now = Date.now(), staleAfterMs = 15_000 } = {}) {
   try {
     const parsed = JSON.parse(readFileSync(heartbeatFile(appRoot), 'utf8'));
     if (parsed?.schema_version !== 1 || !Number.isInteger(parsed.pid) || parsed.pid < 1) return null;
-    if (typeof parsed.last_seen !== 'number' || now - parsed.last_seen > staleAfterMs) return null;
-    return parsed;
+    if (typeof parsed.last_seen !== 'number' || now - parsed.last_seen > staleAfterMs || parsed.last_seen - now > 5_000) return null;
+    const hasOwnershipField = Object.hasOwn(parsed, 'ownership_ready');
+    const identityReady = typeof parsed.process_started_at_utc_ticks === 'string'
+      && /^\d+$/u.test(parsed.process_started_at_utc_ticks)
+      && parsed.process_started_at_utc_ticks !== '0'
+      && typeof parsed.helper_hash === 'string'
+      && /^[a-f0-9]{64}$/u.test(parsed.helper_hash)
+      && typeof parsed.supervisor_instance_id === 'string'
+      && parsed.supervisor_instance_id.trim().length > 0;
+    const state = !hasOwnershipField ? 'legacy-v1' : parsed.ownership_ready === true && identityReady ? 'ready' : 'starting';
+    return { state, record: { ...parsed, ownership_source: state } };
   } catch { return null; }
 }
 
-export function writeSupervisorHeartbeat({ appRoot, pid, now = Date.now() }) {
+/** Return only an ownership-proven supervisor heartbeat. */
+export function readSupervisorHeartbeat(appRoot, options = {}) {
+  const observed = readSupervisorHeartbeatRecord(appRoot, options);
+  return observed?.state === 'ready' ? observed.record : null;
+}
+
+export function writeSupervisorHeartbeat({
+  appRoot,
+  pid,
+  now = Date.now(),
+  ownershipReady = true,
+  processStartedAtUtcTicks = null,
+  helperHash = null,
+  supervisorInstanceId = randomUUID(),
+}) {
   const record = {
     schema_version: 1,
-    supervisor_instance_id: randomUUID(),
+    supervisor_instance_id: supervisorInstanceId,
     pid,
+    process_started_at_utc_ticks: typeof processStartedAtUtcTicks === 'string' ? processStartedAtUtcTicks : null,
+    helper_hash: helperHash,
+    ownership_ready: ownershipReady === true,
     last_seen: now,
     protocol_version: 1,
   };
@@ -195,7 +243,13 @@ export function writeSupervisorHeartbeat({ appRoot, pid, now = Date.now() }) {
   // run (the watcher rewrites this file every few seconds).
   try {
     const prev = JSON.parse(readFileSync(heartbeatFile(appRoot), 'utf8'));
-    if (prev?.schema_version === 1) record.supervisor_instance_id = prev.supervisor_instance_id;
+    const sameWatcher = prev?.schema_version === 1
+      && prev.pid === record.pid
+      && prev.process_started_at_utc_ticks === record.process_started_at_utc_ticks
+      && prev.helper_hash === record.helper_hash
+      && typeof prev.supervisor_instance_id === 'string'
+      && prev.supervisor_instance_id.length > 0;
+    if (sameWatcher) record.supervisor_instance_id = prev.supervisor_instance_id;
   } catch { /* first beat */ }
   writeFileAtomic(heartbeatFile(appRoot), JSON.stringify(record, null, 2) + '\n');
   return record;

package/src/workflow-runtime.mjs

@@ -299,8 +299,8 @@ export function createWorkflowRuntime(adapters, {
     let config = {};
 
     try {
-      config = adapters.getConfig?.() ?? {};
-      job.review_gate = ['required', 'optional', 'off'].includes(config?.review?.gate) ? config.review.gate : 'required';
+      config = adapters.getConfig?.() ?? {};
+      job.review_gate = ['required', 'optional', 'off'].includes(config?.review?.gate) ? config.review.gate : 'required';
       const alloc = await adapters.allocateWorkspace?.(job);
       if (alloc && alloc.ok === false) {
         failJob(job, Object.assign(new Error(alloc.error ?? alloc.reason), { code: alloc.reason }));
@@ -322,7 +322,11 @@ export function createWorkflowRuntime(adapters, {
       if (isReviewJob) {
         transition(job, JOB_PHASES.REVIEWING, 'explicit reviewer');
         const before = alloc?.ok && alloc.isolation === 'worktree' ? await safeCapture(adapters, job.execution_cwd, job.base_revision) : null;
-        const reviewTask = adapters.buildReviewTask(job.original_task, null, { strictness: job.review_strictness ?? 'standard' });
+        // Explicit reviewers inspect the caller's stated task/workspace
+        // directly. The bounded worker-candidate capsule belongs only to the
+        // automatic post-worker review path; constructing it with no worker
+        // view falsely tells an explicit reviewer that nothing was delivered.
+        const reviewTask = job.original_task;
         const review = await runReviewerAttempt(job, reviewTask, config, before);
         if (job.cancelling) { await cancelWorkflow(job); return; }
         job.review = review;
@@ -476,7 +480,7 @@ export function createWorkflowRuntime(adapters, {
           const reviewApproved = review.status === 'done'
             && review.delivery_complete === true
             && review.verdict === 'approve';
-          if (!reviewApproved && job.review_gate === 'required') {
+          if (!reviewApproved && job.review_gate === 'required') {
             const code = review.verdict === 'request_changes'
               ? 'REVIEW_CHANGES_REQUESTED'
               : 'REVIEW_INCONCLUSIVE';
@@ -512,6 +516,16 @@ export function createWorkflowRuntime(adapters, {
   }
 
   async function runReviewerAttempt(job, task, config, beforeCandidate, cwd = job.execution_cwd, baseRevision = job.base_revision) {
+    const requireFingerprint = (candidate) => {
+      if (job.isolation !== 'worktree') return;
+      if (candidate?.ok === true && typeof candidate.fingerprint === 'string' && candidate.fingerprint.trim()) return;
+      job.candidate_capture_failed = true;
+      job.retain_workspace = true;
+      throw Object.assign(new Error('review workspace evidence unavailable; worktree retained'), {
+        code: 'REVIEW_EVIDENCE_UNAVAILABLE',
+      });
+    };
+    requireFingerprint(beforeCandidate);
     const policy = resolveModelPolicy(config, 'reviewer', { attempt: 0 });
     const attemptId = attemptIdFor(adapters, job.id, 'review');
     job.current_attempt_id = attemptId;
@@ -544,6 +558,7 @@ export function createWorkflowRuntime(adapters, {
     }, 0);
     if (ar.status === 'failed' && attemptView.error_code) job.error_code = attemptView.error_code;
     const afterCandidate = job.isolation === 'worktree' ? await safeCapture(adapters, cwd, baseRevision) : null;
+    requireFingerprint(afterCandidate);
     const review = normalizeReview({ attemptResult: ar, beforeCandidate, afterCandidate });
     recordCanonical(job, 'review.completed', {
       attempt_id: attemptView.id,
@@ -568,9 +583,9 @@ export function createWorkflowRuntime(adapters, {
       id: ar.id,
       role: ar.role ?? 'worker',
       attempt,
-      provider: ar.provider ?? null,
-      model: ar.model ?? null,
-      execution_context: ar.execution_context ?? null,
+      provider: ar.provider ?? null,
+      model: ar.model ?? null,
+      execution_context: ar.execution_context ?? null,
       selection_source: ar.selection_source ?? null,
       selection_trace: ar.selection_trace ?? null,
       status: ar.status ?? 'failed',
@@ -628,8 +643,8 @@ export function createWorkflowRuntime(adapters, {
       phase: job.phase,
       status: job.status,
       attempt: job.attempts.length,
-      current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
-      execution_context: job.attempts[job.attempts.length - 1]?.execution_context ?? null,
+      current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
+      execution_context: job.attempts[job.attempts.length - 1]?.execution_context ?? null,
       model_class_hint: job.model_class_hint,
       source: job.source,
       profile_id: job.profile_id,
@@ -654,14 +669,14 @@ export function createWorkflowRuntime(adapters, {
       workspace_retained: job.workspace_retained === true,
       decision: job.decision,
       candidate_available: !!job.candidate,
-      review_status: job.review ? job.review.status ?? null : null,
-      review_gate: job.review_gate ?? 'required',
+      review_status: job.review ? job.review.status ?? null : null,
+      review_gate: job.review_gate ?? 'required',
       event_cursor: job.canonical_events.at(-1)?.sequence ?? 0,
     };
     if (withResult) {
       v.child_attempts = job.attempts.map((a) => ({
-        id: a.id, role: a.role, attempt: a.attempt, provider: a.provider, model: a.model,
-        execution_context: a.execution_context ?? null,
+        id: a.id, role: a.role, attempt: a.attempt, provider: a.provider, model: a.model,
+        execution_context: a.execution_context ?? null,
         selection_source: a.selection_source, selection_trace: a.selection_trace ?? null,
         status: a.status, stopReason: a.stopReason,
         outcome_task: a.outcome?.task_status ?? null,

package/windows/start-dsh-crew.cmd

@@ -1,57 +1,57 @@
-@echo off
-setlocal EnableExtensions
-title DSH Crew Launcher
-
-set "LAUNCH_REQUEST=%*"
-set "LAUNCH_MODE=open"
-set "LAUNCH_DIR=%~dp0"
-
-if "%~1"=="" goto :run
-if /i "%~1"=="--background" (
-  set "LAUNCH_MODE=background"
-  shift
-  goto :validate
-)
-if /i "%~1"=="--open" (
-  set "LAUNCH_MODE=open"
-  shift
-  goto :validate
-)
-if /i "%~1"=="--watch" (
-  set "LAUNCH_MODE=watch"
-  shift
-  goto :validate
-)
-if /i "%~1"=="--help" goto :help
-goto :invalid_argument
-
-:validate
-if not "%~1"=="" goto :invalid_argument
-
-:run
-set "LAUNCH_HELPER=%LAUNCH_DIR%start-dsh-crew.ps1"
-set "LAUNCH_LOG=%TEMP%\dsh-crew-launcher.log"
-if not exist "%LAUNCH_HELPER%" (
-  >>"%LAUNCH_LOG%" echo [%date% %time%] ERROR Managed launcher helper is missing: %LAUNCH_HELPER%
-  echo ERROR: DSH Crew launcher helper is missing.
-  echo Repair it with: dsh-crew update
-  if /i "%LAUNCH_MODE%"=="open" pause
-  exit /b 1
-)
-
-powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%LAUNCH_HELPER%" -Mode "%LAUNCH_MODE%"
-set "LAUNCH_EXIT=%ERRORLEVEL%"
-if not "%LAUNCH_EXIT%"=="0" if /i "%LAUNCH_MODE%"=="open" pause
-exit /b %LAUNCH_EXIT%
-
-:invalid_argument
-echo ERROR: Unsupported launcher arguments: %LAUNCH_REQUEST%
-echo Use --open, --background, or --watch.
-exit /b 64
-
-:help
-echo Usage: %~nx0 [--open ^| --background ^| --watch]
-echo   --open        Start the 3080 console and its supervised 3210 backend, then open the console.
-echo   --background  Start the 3080 console and its supervised 3210 backend silently.
-echo   --watch       Keep the 3080 console and supervised 3210 backend healthy.
-exit /b 0
+@echo off
+setlocal EnableExtensions
+title DSH Crew Launcher
+
+set "LAUNCH_REQUEST=%*"
+set "LAUNCH_MODE=open"
+set "LAUNCH_DIR=%~dp0"
+
+if "%~1"=="" goto :run
+if /i "%~1"=="--background" (
+  set "LAUNCH_MODE=background"
+  shift
+  goto :validate
+)
+if /i "%~1"=="--open" (
+  set "LAUNCH_MODE=open"
+  shift
+  goto :validate
+)
+if /i "%~1"=="--watch" (
+  set "LAUNCH_MODE=watch"
+  shift
+  goto :validate
+)
+if /i "%~1"=="--help" goto :help
+goto :invalid_argument
+
+:validate
+if not "%~1"=="" goto :invalid_argument
+
+:run
+set "LAUNCH_HELPER=%LAUNCH_DIR%start-dsh-crew.ps1"
+set "LAUNCH_LOG=%TEMP%\dsh-crew-launcher.log"
+if not exist "%LAUNCH_HELPER%" (
+  >>"%LAUNCH_LOG%" echo [%date% %time%] ERROR Managed launcher helper is missing: %LAUNCH_HELPER%
+  echo ERROR: DSH Crew launcher helper is missing.
+  echo Repair it with: dsh-crew update
+  if /i "%LAUNCH_MODE%"=="open" pause
+  exit /b 1
+)
+
+powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%LAUNCH_HELPER%" -Mode "%LAUNCH_MODE%"
+set "LAUNCH_EXIT=%ERRORLEVEL%"
+if not "%LAUNCH_EXIT%"=="0" if /i "%LAUNCH_MODE%"=="open" pause
+exit /b %LAUNCH_EXIT%
+
+:invalid_argument
+echo ERROR: Unsupported launcher arguments: %LAUNCH_REQUEST%
+echo Use --open, --background, or --watch.
+exit /b 64
+
+:help
+echo Usage: %~nx0 [--open ^| --background ^| --watch]
+echo   --open        Open official Harness on 3080, then start Crew silently on 3210.
+echo   --background  Start the Crew-owned 3210 service silently.
+echo   --watch       Keep the Crew-owned 3210 service healthy.
+exit /b 0