@ran-sh/dsh-crew 1.1.1 → 1.2.0-rc.4

package/src/history/runtime.mjs

@@ -0,0 +1,28 @@
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn } from 'node:child_process';
+import { getHubRuntimeIdentity } from '../runtime-identity.mjs';
+import { createHistoryService } from './service.mjs';
+import { registerHistoryHttp } from './http.mjs';
+
+export function registerRuntimeHistory(ctx) {
+  const crewRoot = join(homedir(), '.config', 'dsh-crew');
+  const runtime = getHubRuntimeIdentity();
+  const owned = process.platform === 'win32' && runtime.dsh_version === '0.1.2-rc.1'
+    && resolve(process.env.DSH_HOME ?? '').toLowerCase() === resolve(join(crewRoot, 'harness')).toLowerCase();
+  if (!owned) return () => {};
+  return ctx.inject(['webServer', 'sessionPersistence', 'agents'], host => {
+    const service = createHistoryService({ crewRoot, agents: host.agents, persistence: host.sessionPersistence,
+      runtimeId: runtime.runtime_id, launch(id, recover = false) {
+        return new Promise((accept, reject) => {
+          const child = spawn(process.execPath, [fileURLToPath(new URL('./runner.mjs', import.meta.url)), id, ...(recover ? ['--recover'] : [])], {
+            detached: true, windowsHide: true, stdio: 'ignore', env: { ...process.env },
+          });
+          child.once('error', reject); child.once('spawn', () => { child.unref(); accept(); });
+        });
+      } });
+    const disposeHttp = registerHistoryHttp(host.webServer, service);
+    return () => { disposeHttp?.(); service.dispose(); };
+  });
+}

package/src/history/service.mjs

@@ -0,0 +1,137 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, readdirSync } from 'node:fs';
+import { relative } from 'node:path';
+import { planHistoryCleanup } from './cleanup-plan.mjs';
+import { installHistoryAdmissionGate } from './admission-gate.mjs';
+import { historyHash, historyPath, readHistoryBytes, decodeWorkspaceStore, readHistoryManifest } from './archive-store.mjs';
+import { readHistoryState, writeHistoryState, historyPending, publicHistoryState } from './state.mjs';
+
+export function createHistoryService({ crewRoot, agents, persistence, runtimeId, launch, now = Date.now }) {
+  const gate = installHistoryAdmissionGate(agents, () => historyPending(crewRoot));
+  const plans = new Map();
+  let entering = false;
+  async function snapshot(options) {
+    if (typeof persistence?.listSnapshots !== 'function' || typeof persistence?.locate !== 'function'
+      || persistence.supportsRawArtifacts !== true) throw Error('HISTORY_STORAGE_UNSUPPORTED');
+    const bytes = readHistoryBytes(historyPath(crewRoot, 'harness/storages/workspace.json'));
+    const store = decodeWorkspaceStore(bytes);
+    const listed = await persistence.listSnapshots();
+    if (!Array.isArray(listed) || listed.length > 10000) throw Error('HISTORY_INVENTORY_TOO_LARGE');
+    let total = 0;
+    const sessions = listed.map(({ header, revision }) => {
+      if (!header || typeof header.id !== 'string') throw Error('HISTORY_INVENTORY_INVALID');
+      const location = persistence.locate(header);
+      if (location?.kind !== 'jsonl') throw Error('HISTORY_STORAGE_UNSUPPORTED');
+      let path = relative(crewRoot, location.path).replaceAll('\\', '/');
+      if (!/^harness\/sessions\/[^/]+\/[^/]+\/session\.jsonl(?:\.zstd)?$/.test(path)
+        || path.split('/')[3] !== header.id) throw Error('HISTORY_STORAGE_UNSUPPORTED');
+      const plain = path.replace(/\.zstd$/, '');
+      const existing = [plain, `${plain}.zstd`].filter(candidate => existsSync(historyPath(crewRoot, candidate)));
+      if (existing.length !== 1) throw Error('HISTORY_ARTIFACT_AMBIGUOUS');
+      path = existing[0];
+      const raw = readHistoryBytes(historyPath(crewRoot, path)); total += raw.length;
+      if (total > 512 * 1024 * 1024) throw Error('HISTORY_INVENTORY_TOO_LARGE');
+      return { id: header.id, createdAt: header.createdAt, parentSession: header.parentSession,
+        revision: JSON.stringify([revision, historyHash(raw)]), artifact: { sessionId: header.id, relativePath: path, sha256: historyHash(raw) } };
+    });
+    // A retained child keeps its ancestor chain; do not leave a newer fork orphaned.
+    const workspaces = Object.entries(store.tables.workspaces).map(([id, row]) => ({ id, ...row }));
+    const plan = planHistoryCleanup({ workspaces, sessions, activeSessionIds: gate.idle() ? [] : ['active-agent'] }, options);
+    const selected = new Set(plan.sessionIds);
+    const byId = new Map(sessions.map(row => [row.id, row]));
+    const queue = sessions.filter(row => !selected.has(row.id));
+    for (let i = 0; i < queue.length; i++) {
+      const parent = byId.get(queue[i].parentSession);
+      if (parent && selected.delete(parent.id)) queue.push(parent);
+    }
+    plan.sessionIds = plan.sessionIds.filter(id => selected.has(id));
+    plan.workspaceIds = plan.workspaceIds.filter(id => store.tables.workspaces[id].sessionIds.every(sid => selected.has(sid)));
+    plan.counts = { workspaces: plan.workspaceIds.length, sessions: plan.sessionIds.length };
+    plan.executable = gate.idle() && plan.counts.workspaces + plan.counts.sessions > 0;
+    if (!plan.executable && !plan.blockedReason) plan.blockedReason = 'EMPTY_SELECTION';
+    const request = { operation: plan.operation, workspaceHash: historyHash(bytes), workspaceIds: plan.workspaceIds,
+      sessionIds: plan.sessionIds, artifacts: sessions.filter(row => selected.has(row.id)).map(row => row.artifact) };
+    const revision = historyHash(JSON.stringify([runtimeId, plan.revision, request]));
+    return { plan: { ...plan, revision, items: workspaces.filter(row => plan.workspaceIds.includes(row.id)).slice(0, 100).map(row => ({ id: row.id, title: row.title })) }, request };
+  }
+  async function preview(options = {}) {
+    if (historyPending(crewRoot)) throw Error('HISTORY_MAINTENANCE_PENDING');
+    const result = await snapshot(options); const planId = randomUUID();
+    const expiresAt = now() + 600000;
+    plans.set(planId, { ...result, options, expiresAt });
+    while (plans.size > 16) plans.delete(plans.keys().next().value);
+    return { ...result.plan, planId, expiresAt };
+  }
+  async function submit(operation, build) {
+    if (entering || historyPending(crewRoot)) throw Error('HISTORY_MAINTENANCE_PENDING');
+    entering = true;
+    let state;
+    try {
+      state = { schemaVersion: 1, id: randomUUID(), operation, phase: 'QUEUED', lease: randomUUID(), runtimeId };
+      writeHistoryState(crewRoot, state); // Fence BEFORE the last idle/snapshot check.
+      if (!gate.idle()) throw Error('HISTORY_ACTIVE_SESSIONS');
+      Object.assign(state, await build(), { phase: 'QUEUED' });
+      writeHistoryState(crewRoot, state);
+      await launch(state.id);
+      return publicHistoryState(state);
+    } catch (error) {
+      if (state) writeHistoryState(crewRoot, { ...state, phase: 'FAILED', code: safeHistoryError(error) });
+      throw error;
+    } finally { entering = false; }
+  }
+  async function execute({ planId, confirm, acknowledgement } = {}) {
+    const saved = plans.get(planId);
+    if (!saved || saved.expiresAt < now()) throw Error('HISTORY_PLAN_EXPIRED');
+    if (confirm !== true || (saved.plan.operation === 'delete' && acknowledgement !== 'DELETE')) throw Error('HISTORY_CONFIRMATION_REQUIRED');
+    return submit(saved.plan.operation, async () => {
+      const fresh = await snapshot(saved.options);
+      if (fresh.plan.revision !== saved.plan.revision) throw Error('HISTORY_PREVIEW_CHANGED');
+      if (!fresh.plan.executable) throw Error('HISTORY_EMPTY_SELECTION');
+      plans.delete(planId);
+      return { request: fresh.request, options: saved.options, revision: fresh.plan.revision, counts: fresh.plan.counts };
+    });
+  }
+  function archives() {
+    const directory = historyPath(crewRoot, 'history/transactions');
+    if (!existsSync(directory)) return [];
+    const ids = readdirSync(directory).filter(id => /^[a-f0-9-]{36}$/.test(id));
+    if (ids.length > 10000) throw Error('HISTORY_ARCHIVE_LIMIT');
+    return ids.flatMap(id => {
+      try {
+        const m = readHistoryManifest(crewRoot, id);
+        return m.operation === 'archive' && m.state === 'APPLIED' ? [{ id: m.id, createdAt: m.createdAt, sessions: m.files.length,
+          workspaces: m.before.global.workspaceIds.filter(id => !m.after.global.workspaceIds.includes(id)).length }] : [];
+      } catch {
+        return [{ id, invalid: true, code: 'HISTORY_INVALID_MANIFEST', sessions: 0, workspaces: 0, createdAt: null }];
+      }
+    }).reverse();
+  }
+  async function restore({ archiveId, confirm } = {}) {
+    if (confirm !== true) throw Error('HISTORY_CONFIRMATION_REQUIRED');
+    return submit('restore', async () => {
+      const archive = archives().find(a => a.id === archiveId && !a.invalid);
+      if (!archive) throw Error('HISTORY_ARCHIVE_NOT_RESTORABLE');
+      return { archiveId, counts: { sessions: archive.sessions, workspaces: archive.workspaces } };
+    });
+  }
+  async function fencedCheck() {
+    const state = readHistoryState(crewRoot);
+    if (!state || !historyPending(crewRoot) || state.runtimeId !== runtimeId || !gate.idle()) throw Error('HISTORY_FENCE_NOT_IDLE');
+    if (state.operation !== 'restore') {
+      const fresh = await snapshot(state.options);
+      if (fresh.plan.revision !== state.revision) throw Error('HISTORY_PREVIEW_CHANGED');
+    }
+    return true;
+  }
+  async function recover({ confirm } = {}) {
+    const state = readHistoryState(crewRoot);
+    if (confirm !== true) throw Error('HISTORY_CONFIRMATION_REQUIRED');
+    if (!state || !historyPending(crewRoot)) throw Error('HISTORY_RECOVERY_UNAVAILABLE');
+    await launch(state.id, true);
+    return publicHistoryState(state);
+  }
+  return { preview, execute, restore, recover, archives, fencedCheck, status: () => publicHistoryState(readHistoryState(crewRoot)), dispose: () => gate.dispose() };
+}
+export function safeHistoryError(error) {
+  return /^HISTORY_[A-Z_]+$/.test(error?.message ?? '') ? error.message : 'HISTORY_OPERATION_FAILED';
+}

package/src/history/state.mjs

@@ -0,0 +1,27 @@
+import { existsSync } from 'node:fs';
+import { historyPath, readHistoryBytes, writeHistoryBytes } from './archive-store.mjs';
+
+export const TERMINAL_HISTORY_PHASES = ['DONE', 'FAILED', 'ROLLED_BACK'];
+const phases = ['QUEUED', 'STOPPING', 'APPLYING', 'STARTING', 'VERIFYING', 'RECOVERY_REQUIRED', ...TERMINAL_HISTORY_PHASES];
+export function readHistoryState(root) {
+  const file = historyPath(root, 'history/active.json');
+  if (!existsSync(file)) return null;
+  let value;
+  try { value = JSON.parse(readHistoryBytes(file)); } catch { throw Error('HISTORY_STATE_INVALID'); }
+  if (value?.schemaVersion !== 1 || !/^[a-f0-9-]{36}$/.test(value.id) || !phases.includes(value.phase)
+    || !['archive', 'delete', 'restore'].includes(value.operation) || typeof value.runtimeId !== 'string'
+    || !/^[a-f0-9-]{36}$/.test(value.lease)) throw Error('HISTORY_STATE_INVALID');
+  return value;
+}
+export function writeHistoryState(root, value) {
+  writeHistoryBytes(root, 'history/active.json', JSON.stringify({ ...value, updatedAt: Date.now() }));
+}
+export function historyPending(root) {
+  const state = readHistoryState(root);
+  return state !== null && !TERMINAL_HISTORY_PHASES.includes(state.phase);
+}
+export function publicHistoryState(state) {
+  if (!state) return { phase: 'IDLE' };
+  return { id: state.id, phase: state.phase, operation: state.operation, counts: state.counts,
+    archiveId: state.archiveId, code: state.code, updatedAt: state.updatedAt };
+}

package/src/hub/index.mjs

@@ -30,7 +30,7 @@ import { addContextReferences, buildWorkspaceTask, isSafeBranchName, loadWorkspa
 import { buildExtensionContract } from '../extension-contract.mjs';
 import { cleanupIsolatedWorkspace, createIsolatedWorkspace } from '../workspace-isolation.mjs';
 import { assessWorkspaceReadiness } from '../workspace-readiness.mjs';
-import { buildHubExecutionRows } from '../config-readiness.mjs';
+import { buildConfigReadinessMatrix } from '../config-readiness.mjs';
 import { localRequestCore, originLoopback } from '../local-request-guard.mjs';
 import { raceWaiters } from '../removable-waiter.mjs';
 import { buildProviderInventory } from '../provider-inventory.mjs';
@@ -273,6 +273,38 @@ export function buildProviderMigrationDeclarations(profileDeclarations = [], set
   ];
 }
 
+export function projectCatalogHealth(health, { limit = 32 } = {}) {
+  const boundedLimit = Number.isSafeInteger(limit) && limit > 0 ? Math.min(limit, 128) : 32;
+  const hints = (Array.isArray(health?.hints) ? health.hints : []).map((hint) => ({
+    code: typeof hint?.code === 'string' && hint.code.trim() ? hint.code.slice(0, 128) : 'UNKNOWN',
+    level: hint?.level === 'warning' ? 'warning' : 'info',
+  }));
+  const warnings = hints.filter((hint) => hint.level === 'warning');
+  const informational = hints.filter((hint) => hint.level !== 'warning');
+  return { hints: [...warnings, ...informational].slice(0, boundedLimit) };
+}
+
+export function projectCurrentProviderHealth(healthStore, currentSelections = {}, { limit = 128 } = {}) {
+  const boundedLimit = Number.isSafeInteger(limit) && limit > 0 ? Math.min(limit, 256) : 128;
+  const selected = [];
+  const selectedKeys = new Set();
+  for (const route of Object.values(currentSelections ?? {})) {
+    if (route?.ok !== true || typeof route.provider !== 'string' || typeof route.model !== 'string') continue;
+    const key = `${route.provider}\u0000${route.model}`;
+    if (selectedKeys.has(key)) continue;
+    const observation = healthStore?.get?.(route.provider, route.model);
+    if (observation?.fresh !== true) continue;
+    selectedKeys.add(key);
+    selected.push(observation);
+  }
+  const listed = healthStore?.list?.();
+  const remaining = (Array.isArray(listed) ? listed : []).filter((entry) => {
+    const key = `${entry?.provider ?? ''}\u0000${entry?.model ?? ''}`;
+    return !selectedKeys.has(key);
+  });
+  return [...selected, ...remaining].slice(0, boundedLimit);
+}
+
 async function readProviderInventorySnapshot(hub, ctx, config) {
   let catalog = { providers: [], harness_default: null };
   let catalogEvidence = { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' };
@@ -384,10 +416,12 @@ async function readProviderInventorySnapshot(hub, ctx, config) {
     lifecycleEvidence,
     defaultEvidence,
   });
+  const catalogHealth = projectCatalogHealth(catalog?.health);
   return {
     ...inventory,
     migration,
     catalog_evidence: catalogEvidence,
+    catalog_health: catalogHealth,
     declaration_evidence: declarationEvidence,
     default_evidence: defaultEvidence,
     lifecycle_evidence: lifecycleEvidence.ok ? { ok: true } : { ok: false, code: lifecycleEvidence.code },
@@ -1262,6 +1296,8 @@ export async function apply(ctx) {
   // calls resolveHubSpawnPayload (above) to stamp the effective tier onto
   // the spawn payload.
   const disposers = [];
+  const { registerRuntimeHistory } = await import('../history/runtime.mjs');
+  disposers.push(registerRuntimeHistory(ctx));
   const PROVIDER_DELETE_PLAN_TTL_MS = 10 * 60 * 1000;
   const providerDeletePlans = new Map();
   const providerMigrationPlans = new Map();
@@ -1427,20 +1463,82 @@ export async function apply(ctx) {
         if (!isLoopbackRequest(req)) return sendJson(res, 403, { ok: false, error: 'loopback only' });
         if (req.method !== 'GET') return sendJson(res, 405, { ok: false, error: 'GET only' }, { allow: 'GET' });
         const config = normalizeGlobalConfig(hub.getConfig?.() ?? {});
-        let catalogStatus = { id: 'provider_catalog', status: 'NOT_RUN', reason_code: 'PROVIDER_MODE_UNKNOWN' };
-        if (normalizeWorkerProviderMode(config.worker_provider_mode) === 'deepseek-official') {
-          catalogStatus = { id: 'provider_catalog', status: 'SKIP', reason_code: 'PROVIDER_CATALOG_NOT_REQUIRED' };
-        } else {
-          try {
-            await readHarnessModelCatalog({
-              llm: ctx.llm ?? ctx.get('llm'),
-              getCurrentSelection: () => ctx.get('agentDefaultModel')?.currentSelection?.(),
+        const workerProviderMode = normalizeWorkerProviderMode(config.worker_provider_mode);
+        const runtime = getHubRuntimeIdentity();
+        // One authoritative snapshot drives both catalog and provider-lifecycle
+        // readiness. Keep only bounded, secret-free projections in the matrix.
+        let providerInventoryBody = { ok: false, code: 'PROVIDER_INVENTORY_UNAVAILABLE' };
+        let providerCatalogBody = { ok: false, code: 'PROVIDER_CATALOG_UNAVAILABLE' };
+        let providerInventorySnapshot = null;
+        try {
+          providerInventorySnapshot = await readProviderInventorySnapshot(hub, ctx, config);
+          const records = Array.isArray(providerInventorySnapshot?.records) ? providerInventorySnapshot.records : [];
+          const recoveryTransactions = Array.isArray(providerInventorySnapshot?.recovery_transactions)
+            ? providerInventorySnapshot.recovery_transactions
+            : [];
+          providerInventoryBody = records.length <= 256 && recoveryTransactions.length <= 256
+            ? {
+                ok: true,
+                records,
+                lifecycle_evidence: providerInventorySnapshot.lifecycle_evidence ?? null,
+                declaration_evidence: providerInventorySnapshot.declaration_evidence ?? null,
+                default_evidence: providerInventorySnapshot.default_evidence ?? null,
+                recovery_transactions: recoveryTransactions.map((transaction) => ({
+                  provider_id: transaction?.provider_id ?? null,
+                  unresolved: transaction?.unresolved === true,
+                })),
+              }
+            : { ok: false, code: 'PROVIDER_INVENTORY_INCOMPLETE' };
+          providerCatalogBody = providerInventorySnapshot.catalog_evidence?.ok === true
+            ? { ok: true, health: providerInventorySnapshot.catalog_health ?? { hints: [] } }
+            : { ok: false, code: providerInventorySnapshot.catalog_evidence?.code ?? 'PROVIDER_CATALOG_UNAVAILABLE' };
+        } catch {
+          providerInventoryBody = { ok: false, code: 'PROVIDER_INVENTORY_UNAVAILABLE' };
+        }
+        const liveJobs = typeof hub.list === 'function' ? hub.list() : [];
+        const boundedJobs = Array.isArray(liveJobs) ? liveJobs.slice(-128) : [];
+        const currentSelections = {};
+        if (workerProviderMode === 'deepseek-official') {
+          currentSelections.worker = { ok: true, provider: 'deepseek-official', model: 'deepseek-v4-flash', source: 'legacy-strict' };
+          currentSelections.worker_escalation = { ok: true, provider: 'deepseek-official', model: 'deepseek-v4-pro', source: 'legacy-strict' };
+          currentSelections.reviewer = { ok: true, provider: 'deepseek-official', model: 'deepseek-v4-pro', source: 'legacy-strict' };
+        } else if (providerInventorySnapshot) {
+          const routingCatalog = {
+            providers: providerInventorySnapshot.records
+              .filter((record) => record?.lifecycle?.catalogued === true)
+              .map((record) => ({
+                id: record.id,
+                name: record.display_name ?? record.id,
+                models: (Array.isArray(record.models) ? record.models : []).map((id) => ({ id })),
+              })),
+            harness_default: providerInventorySnapshot.harness_default ?? null,
+          };
+          const lifecycleState = readProviderLifecycleState();
+          for (const route of [
+            { key: 'worker', role: 'worker', attempt: 0 },
+            { key: 'worker_escalation', role: 'worker', attempt: 1 },
+            { key: 'reviewer', role: 'reviewer', attempt: 0 },
+          ]) {
+            const policy = resolveModelPolicy(config, route.role, { attempt: route.attempt });
+            currentSelections[route.key] = resolveModel({
+              role: route.role,
+              attempt: route.attempt,
+              policy,
+              catalog: routingCatalog,
+              harnessDefault: routingCatalog.harness_default,
+              healthStore: hub.healthStore,
+              healthGate: policy.health_gate ?? config.health_gate ?? config.worker?.model_policy?.health_gate,
+              allowFallback: config.allow_fallback !== false,
+              tombstones: lifecycleState.tombstones,
             });
-            catalogStatus = { id: 'provider_catalog', status: 'PASS', reason_code: 'PROVIDER_CATALOG_RESOLVED' };
-          } catch {
-            catalogStatus = { id: 'provider_catalog', status: 'FAIL', reason_code: 'PROVIDER_CATALOG_UNAVAILABLE' };
           }
         }
+        let providerHealthBody = { ok: false, code: 'PROVIDER_HEALTH_UNAVAILABLE' };
+        try {
+          providerHealthBody = { ok: true, health: projectCurrentProviderHealth(hub.healthStore, currentSelections) };
+        } catch {
+          providerHealthBody = { ok: false, code: 'PROVIDER_HEALTH_UNAVAILABLE' };
+        }
         const profiles = loadRoleProfiles();
         const requestUrl = new URL(req.url, 'http://localhost');
         const requestedWorkspaceId = requestUrl.searchParams.get('workspace_id');
@@ -1449,20 +1547,39 @@ export async function apply(ctx) {
         const workspaceReadiness = requestedWorkspaceId && !requestedContext
           ? { status: 'UNAVAILABLE', reason_code: 'WORKSPACE_CONTEXT_NOT_FOUND' }
           : await assessWorkspaceReadiness({ cwd: requestedContext?.repo_root ?? null });
-        const liveJobs = typeof hub.list === 'function' ? hub.list() : [];
-        const executionRows = buildHubExecutionRows(liveJobs);
-        const readinessMatrix = { rows: [
-          { id: 'hub_compatibility', status: 'PASS', reason_code: 'LIVE_CHECK_PASSED' },
-          catalogStatus,
-          ...executionRows,
-        ] };
+        const readinessMatrix = buildConfigReadinessMatrix({
+          hubCompatibility: {
+            reachable: true,
+            compatible: true,
+            runtime_version: runtime.runtime_version ?? null,
+            protocol_version: runtime.protocol_version ?? null,
+          },
+          workerProviderMode,
+          providerCatalogChecked: true,
+          providerCatalogBody,
+          providerInventoryChecked: true,
+          providerInventoryBody,
+          providerHealthChecked: true,
+          providerHealthBody,
+          currentSelections,
+          hubJobsChecked: true,
+          hubJobsBody: { ok: true, jobs: boundedJobs },
+        });
         const readinessSnapshot = buildRuntimeReadinessSnapshot({
-          runtime: getHubRuntimeIdentity(),
+          runtime,
           readinessMatrix,
-          selections: { worker: liveJobs.find((job) => job?.role === 'worker') ?? null, reviewer: liveJobs.find((job) => job?.role === 'reviewer') ?? null },
-          health: hub.healthStore.list(),
-          jobs: liveJobs,
+          selections: {
+            worker: currentSelections.worker ?? null,
+            reviewer: currentSelections.reviewer ?? null,
+          },
+          health: Array.isArray(providerHealthBody?.health) ? providerHealthBody.health.slice(0, 128) : [],
+          health_status: providerHealthBody.ok === true ? 'AVAILABLE' : 'UNAVAILABLE',
+          jobs: boundedJobs,
           workspace: workspaceReadiness,
+          enabled_roles: {
+            worker: config.subagents_enabled !== false && config.worker_state !== 'disabled',
+            reviewer: config.subagents_enabled !== false && config.review_state !== 'disabled',
+          },
         });
         const contract = buildExtensionContract({
           config,
@@ -1470,7 +1587,7 @@ export async function apply(ctx) {
           readinessSnapshot,
           workspace: workspaceReadiness,
           profiles,
-          runtime: getHubRuntimeIdentity(),
+          runtime,
         });
         return sendJson(res, 200, { ok: true, extension: contract });
       },

package/src/hub-client.mjs

@@ -23,7 +23,7 @@ const EMPTY_STATUS = Object.freeze({
   code: HUB_COMPATIBILITY_CODES.UNREACHABLE,
 });
 
-let lastProbe = { at: 0, status: EMPTY_STATUS };
+let lastProbe = { at: 0, base: null, status: EMPTY_STATUS };
 
 function withReadiness(status) {
   return {
@@ -32,14 +32,15 @@ function withReadiness(status) {
   };
 }
 
-function cacheStatus(status) {
+function cacheStatus(status, base) {
   const observed = withReadiness(status);
-  lastProbe = { at: Date.now(), status: observed };
+  lastProbe = { at: Date.now(), base, status: observed };
   return observed;
 }
 
-async function fetchJson(path) {
-  const res = await fetch(`${API}${path}`, { signal: AbortSignal.timeout(800) });
+async function fetchJson(path, base = BASE) {
+  const api = `${String(base).replace(/\/$/, '')}/_dsh/dsh-crew`;
+  const res = await fetch(`${api}${path}`, { signal: AbortSignal.timeout(800) });
   let body;
   try { body = await res.json(); } catch { body = null; }
   return { res, body };
@@ -53,10 +54,11 @@ async function fetchJson(path) {
  * lacks /runtime is therefore reachable-but-incompatible instead of looking
  * offline or being silently treated as current.
  */
-export async function hubStatus({ force = false } = {}) {
-  if (!force && Date.now() - lastProbe.at < 10_000) return lastProbe.status;
+export async function hubStatus({ force = false, base = BASE } = {}) {
+  const normalizedBase = String(base).replace(/\/$/, '');
+  if (!force && lastProbe.base === normalizedBase && Date.now() - lastProbe.at < 10_000) return lastProbe.status;
   try {
-    const ping = await fetchJson('/ping');
+    const ping = await fetchJson('/ping', normalizedBase);
     if (!ping.res.ok) {
       return cacheStatus({
         ...EMPTY_STATUS,
@@ -64,13 +66,13 @@ export async function hubStatus({ force = false } = {}) {
         code: HUB_COMPATIBILITY_CODES.HTTP_ERROR,
         http_status: ping.res.status,
         endpoint: 'ping',
-      });
+      }, normalizedBase);
     }
     if (ping.body?.service !== 'dsh-crew-hub') {
-      return cacheStatus(evaluateHubHandshake(ping.body));
+      return cacheStatus(evaluateHubHandshake(ping.body), normalizedBase);
     }
 
-    const runtime = await fetchJson('/runtime');
+    const runtime = await fetchJson('/runtime', normalizedBase);
     if (runtime.res.status === 404) {
       return cacheStatus({
         ...EMPTY_STATUS,
@@ -78,7 +80,7 @@ export async function hubStatus({ force = false } = {}) {
         service: 'dsh-crew-hub',
         code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISSING,
         endpoint: 'runtime',
-      });
+      }, normalizedBase);
     }
     if (!runtime.res.ok) {
       return cacheStatus({
@@ -88,11 +90,11 @@ export async function hubStatus({ force = false } = {}) {
         code: HUB_COMPATIBILITY_CODES.HTTP_ERROR,
         http_status: runtime.res.status,
         endpoint: 'runtime',
-      });
+      }, normalizedBase);
     }
-    return cacheStatus(evaluateHubHandshake(runtime.body, { strictProduction: true }));
+    return cacheStatus(evaluateHubHandshake(runtime.body, { strictProduction: true }), normalizedBase);
   } catch {
-    return cacheStatus(EMPTY_STATUS);
+    return cacheStatus(EMPTY_STATUS, normalizedBase);
   }
 }
 

package/src/image-output.mjs

@@ -0,0 +1,71 @@
+import { mkdtempSync, mkdirSync, lstatSync, openSync, readSync, closeSync, renameSync, rmSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join } from 'node:path';
+
+export async function downloadImageBytes(url, { fetchImpl = globalThis.fetch, timeoutMs = 60_000, maxBytes = 64 * 1024 * 1024 } = {}) {
+  if (!['http:', 'https:'].includes(new URL(url).protocol)) throw new Error('unsupported image URL protocol');
+  const controller = new AbortController();
+  let reader;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new Error('image download timed out'));
+    }, timeoutMs);
+  });
+  const download = async () => {
+    const response = await fetchImpl(url, { signal: controller.signal });
+    controller.signal.throwIfAborted();
+    if (!response.ok) throw new Error(`image download failed: HTTP ${response.status}`);
+    if (Number(response.headers.get('content-length')) > maxBytes) throw new Error('image download exceeds size limit');
+    if (!response.body) throw new Error('image download has no body');
+    reader = response.body.getReader();
+    const chunks = [];
+    let bytes = 0;
+    while (true) {
+      const { done, value } = await reader.read();
+      controller.signal.throwIfAborted();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > maxBytes) throw new Error('image download exceeds size limit');
+      chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks, bytes);
+  };
+  try { return await Promise.race([download(), timeout]); }
+  finally {
+    clearTimeout(timer);
+    controller.abort();
+    if (reader) void reader.cancel().catch(() => {});
+  }
+}
+
+function validateImage(file) {
+  const info = lstatSync(file);
+  if (!info.isFile() || info.size === 0 || info.size > 64 * 1024 * 1024) throw new Error('generated image has invalid type or size');
+  const head = Buffer.alloc(32);
+  const fd = openSync(file, 'r');
+  let length;
+  try { length = readSync(fd, head, 0, head.length, 0); } finally { closeSync(fd); }
+  const bytes = head.subarray(0, length);
+  const png = bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+  const jpeg = bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
+  const gif = ['GIF87a', 'GIF89a'].includes(bytes.subarray(0, 6).toString('ascii'));
+  const webp = bytes.subarray(0, 4).toString('ascii') === 'RIFF' && bytes.subarray(8, 12).toString('ascii') === 'WEBP';
+  if (!png && !jpeg && !gif && !webp) throw new Error('generated output does not have a supported image signature');
+}
+
+/** Stage each request separately; an existing destination never proves success. */
+export async function withGeneratedImageOutput(outputPath, generate) {
+  if (!isAbsolute(outputPath)) throw new Error('output_path must be absolute');
+  mkdirSync(dirname(outputPath), { recursive: true });
+  const stage = mkdtempSync(join(dirname(outputPath), '.dsh-image-'));
+  const stagedFile = join(stage, basename(outputPath));
+  try {
+    await generate(stagedFile);
+    validateImage(stagedFile);
+    renameSync(stagedFile, outputPath);
+    return outputPath;
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}