@ran-sh/dsh-crew 1.1.1 → 1.2.0-rc.5

package/src/install/zcode.mjs

@@ -3,7 +3,7 @@
 // The generated files make ZCode dispatch through the same dsh-crew MCP server
 // used by Codex and Claude while keeping ZCode's native config precedence.
 
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -62,8 +62,10 @@ function normalizePath(value) {
 
 function serverTarget(server) {
   if (!server || typeof server !== 'object') return null;
-  if (server.command !== 'node' || !Array.isArray(server.args) || typeof server.args[0] !== 'string') return null;
-  return normalizePath(server.args[0]);
+  if (server.command !== 'node' || !Array.isArray(server.args) || server.args.length !== 1 || typeof server.args[0] !== 'string') return null;
+  const target = normalizePath(server.args[0]);
+  if (!target) return null;
+  try { return statSync(target).isFile() ? target : null; } catch { return null; }
 }
 
 function nativeServers(config) {
@@ -250,13 +252,19 @@ function installTemplates({ home, root, priorFiles = [] }) {
 function updateMcp({ home, root }) {
   const source = configSource({ home });
   const target = expectedTarget({ root });
+  const normalizedTarget = normalizePath(target);
   const current = source.servers[SERVER];
   const currentTarget = serverTarget(current);
+  const currentDeclaredTarget = Array.isArray(current?.args) && typeof current.args[0] === 'string'
+    ? normalizePath(current.args[0])
+    : null;
   const owned = ownership({ home });
-  if (current && currentTarget !== target) {
+  if (current && currentTarget !== normalizedTarget) {
     // Only an exact previously-owned entry may be repaired. Any foreign
     // command, even if it is also named dsh-crew, is a hard collision.
-    if (!(owned && owned.config_file === source.file && normalizePath(owned.target) === currentTarget)) {
+    if (!(owned
+      && normalizePath(owned.config_file) === normalizePath(source.file)
+      && normalizePath(owned.target) === currentDeclaredTarget)) {
       return { ok: false, code: 'ZCODE_MCP_COLLISION', config_file: source.file };
     }
   }
@@ -303,22 +311,53 @@ function zcodeComponents({ home = homedir(), root = ROOT } = {}) {
   const source = configSource({ home });
   const configured = serverTarget(source.servers[SERVER]);
   const owned = ownership({ home });
+  const expectedPolicy = managedPolicyBlock(root);
+  const installedPolicy = readText(join(home, '.zcode', 'AGENTS.md'));
+  const templates = templateFiles({ home, root });
+  const templateReady = (entry) => {
+    if (!entry) return false;
+    const { source: sourceFile, dest } = entry;
+    const sourceText = readText(sourceFile);
+    const installedText = readText(dest);
+    return sourceText !== null && installedText === sourceText;
+  };
+  const templateBySuffix = (suffix) => templates.find(({ dest }) => dest.endsWith(suffix));
+  const ownershipFilesReady = !!owned && templates.every(({ source: sourceFile, dest }) => {
+    const expectedText = readText(sourceFile);
+    const installedText = readText(dest);
+    const record = Array.isArray(owned.files)
+      ? owned.files.find((entry) => normalizePath(entry?.path) === normalizePath(dest))
+      : null;
+    return expectedText !== null
+      && installedText === expectedText
+      && record?.managed_sha256 === contentHash(expectedText)
+      && contentHash(installedText) === record.managed_sha256;
+  });
   const components = {
     mcp: configured === expected,
-    policy: typeof readText(join(home, '.zcode', 'AGENTS.md')) === 'string' && readText(join(home, '.zcode', 'AGENTS.md')).includes(POLICY_START),
-    worker_agent: existsSync(join(home, '.zcode', 'agents', 'ds-worker.md')),
-    reviewer_agent: existsSync(join(home, '.zcode', 'agents', 'ds-reviewer.md')),
-    config_prompt: existsSync(join(home, '.zcode', 'commands', 'dsh-config.md')),
-    status_prompt: existsSync(join(home, '.zcode', 'commands', 'dsh-status.md')),
-    ownership: !!owned && owned.config_file === source.file && normalizePath(owned.target) === expected,
+    policy: !!expectedPolicy && typeof installedPolicy === 'string' && installedPolicy.includes(expectedPolicy),
+    worker_agent: templateReady(templateBySuffix(join('agents', 'ds-worker.md'))),
+    reviewer_agent: templateReady(templateBySuffix(join('agents', 'ds-reviewer.md'))),
+    config_prompt: templateReady(templateBySuffix(join('commands', 'dsh-config.md'))),
+    status_prompt: templateReady(templateBySuffix(join('commands', 'dsh-status.md'))),
+    ownership: !!owned
+      && normalizePath(owned.config_file) === normalizePath(source.file)
+      && normalizePath(owned.target) === expected
+      && ownershipFilesReady,
   };
-  return { components, source, expected, configured, owned };
+  const policyFootprint = typeof installedPolicy === 'string'
+    && installedPolicy.includes(POLICY_START)
+    && installedPolicy.includes(POLICY_END);
+  const installed = Object.hasOwn(source.servers, SERVER)
+    || !!owned
+    || policyFootprint
+    || templates.some(({ dest }) => existsSync(dest));
+  return { components, source, expected, configured, owned, installed };
 }
 
 export function zcodeStatus({ home = homedir(), root = ROOT } = {}) {
-  const { components, source, expected, configured } = zcodeComponents({ home, root });
+  const { components, source, expected, configured, installed } = zcodeComponents({ home, root });
   const missing = Object.entries(components).filter(([, value]) => !value).map(([key]) => key);
-  const installed = Object.values(components).some(Boolean);
   return {
     installed,
     ready: missing.length === 0,

package/src/job-contracts.mjs

@@ -8,12 +8,12 @@
 export const JOB_CONTRACT_SCHEMA_VERSION = 1;
 
 export const JOB_EVENT_TYPES = Object.freeze([
-  'job.created',
-  'job.started',
-  'runtime.bound',
-  'model.selected',
-  'model.admitted',
-  'agent.created',
+  'job.created',
+  'job.started',
+  'runtime.bound',
+  'model.selected',
+  'model.admitted',
+  'agent.created',
   'model.fallback',
   'worker.started',
   'worker.completed',
@@ -82,6 +82,11 @@ function evidenceStatus(view) {
   if (view?.status === 'failed' || view?.phase === 'failed' || view?.outcome?.execution_status === 'failed') return 'FAIL';
   if (view?.review?.verdict === 'request_changes' || view?.outcome?.task_status === 'partial') return 'PARTIAL';
   if (view?.outcome?.task_status === 'blocked') return 'BLOCKED';
+  if (view?.role === 'reviewer' && view?.outcome == null) {
+    return view.status === 'done' && view.review?.status === 'done'
+      && view.review.verdict === 'approve' && view.review.delivery_complete === true
+      && view.review.mutated_candidate !== true ? 'PASS' : 'PARTIAL';
+  }
   if (view?.status === 'done' && view?.outcome?.task_status === 'success') return 'PASS';
   return 'PARTIAL';
 }
@@ -122,7 +127,7 @@ function compactSelectionTrace(attempts) {
   });
 }
 
-function changedFilesFromView(view) {
+function changedFilesFromView(view) {
   if (Array.isArray(view?.candidate?.changed_files)) return view.candidate.changed_files;
   const changes = view?.workspace_diff?.changes;
   if (!changes || typeof changes !== 'object') return [];
@@ -132,24 +137,24 @@ function changedFilesFromView(view) {
     ...(Array.isArray(changes.renamed) ? changes.renamed : []),
     ...(Array.isArray(changes.untracked) ? changes.untracked : []),
   ])];
-}
-
-function boundedExecutionContext(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-  const executionPlane = boundedText(value.execution_plane, 64);
-  const profile = boundedText(value.profile, 64);
-  const runtimeId = boundedText(value.runtime_id, 128);
-  const port = Number.isInteger(value.listen_port) ? value.listen_port : null;
-  const ingress = value.ingress === 'official-3080' || value.ingress === 'direct-3210' ? value.ingress : null;
-  if (!executionPlane && !profile && !runtimeId && port === null && !ingress) return null;
-  return {
-    execution_plane: executionPlane,
-    profile,
-    listen_port: port,
-    runtime_id: runtimeId,
-    ...(ingress ? { ingress } : {}),
-  };
-}
+}
+
+function boundedExecutionContext(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const executionPlane = boundedText(value.execution_plane, 64);
+  const profile = boundedText(value.profile, 64);
+  const runtimeId = boundedText(value.runtime_id, 128);
+  const port = Number.isInteger(value.listen_port) ? value.listen_port : null;
+  const ingress = value.ingress === 'official-3080' || value.ingress === 'direct-3210' ? value.ingress : null;
+  if (!executionPlane && !profile && !runtimeId && port === null && !ingress) return null;
+  return {
+    execution_plane: executionPlane,
+    profile,
+    listen_port: port,
+    runtime_id: runtimeId,
+    ...(ingress ? { ingress } : {}),
+  };
+}
 
 /**
  * Build the machine-first Result Contract for a workflow.
@@ -165,6 +170,7 @@ export function buildEvidenceEnvelope(view = {}) {
   const errorMessage = boundedText(view.error, 1000);
   const changedFiles = boundedStrings(changedFilesFromView(view), { count: 120, length: 500 });
   const status = evidenceStatus(view);
+  const reviewOnly = view.role === 'reviewer' && view.outcome == null;
   const selectionAttempts = Array.isArray(view.child_attempts) && view.child_attempts.length > 0
     ? view.child_attempts
     : (view.selection_trace || view.provider || view.model ? [view] : []);
@@ -176,18 +182,18 @@ export function buildEvidenceEnvelope(view = {}) {
     status,
     summary: {
       phase: view.phase ?? null,
-      task_status: outcome.task_status ?? null,
-      execution_status: outcome.execution_status ?? null,
+      task_status: outcome.task_status ?? (reviewOnly && status === 'PASS' ? 'success' : null),
+      execution_status: outcome.execution_status ?? (reviewOnly && review?.status === 'done' ? 'completed' : null),
       tests_status: outcome.tests_status ?? null,
-      delivery_complete: outcome.delivery?.complete === true,
+      delivery_complete: reviewOnly ? review?.delivery_complete === true : outcome.delivery?.complete === true,
       review_verdict: review?.verdict ?? null,
     },
-    selection_trace: compactSelectionTrace(selectionAttempts),
-    execution_context: boundedExecutionContext(view.execution_context ?? selectionAttempts[0]?.execution_context),
+    selection_trace: compactSelectionTrace(selectionAttempts),
+    execution_context: boundedExecutionContext(view.execution_context ?? selectionAttempts[0]?.execution_context),
     changed_files: changedFiles,
     changes: boundedStrings(outcome.changes),
     tests: boundedTests(outcome.tests),
-    risks: boundedStrings(outcome.risks),
+    risks: boundedStrings(reviewOnly ? review?.risks : outcome.risks),
     unverified: boundedStrings(outcome.unverified),
     review: review ? {
       verdict: review.verdict ?? null,

package/src/jobs.mjs

@@ -8,7 +8,7 @@
 // never passes an explicit dshBin that would bypass it. The worker rides the
 // `sdk-minimal` profile with the Crew overlay applied as a --patch.
 
-import { DeepSeekHarness } from '@deepseek-ai/dsh-sdk-client';
+import { createStandaloneHarness } from './standalone-sdk.mjs';
 import { readFileSync, mkdirSync, existsSync } from 'node:fs';
 import { createShardWriter } from './status-shard.mjs';
 import { fileURLToPath } from 'node:url';
@@ -123,7 +123,7 @@ export function startJob({
     throw new Error(`DEEPSEEK_API_KEY not found in env or ${join(CONFIG_DIR, '.env')}`);
   }
 
-  const harness = new DeepSeekHarness({
+  const harness = createStandaloneHarness({
     profile: 'sdk-minimal',
     patches: [CORDIS],
     dshHome: CREW_DSH_HOME,

package/src/mcp-runtime.mjs

@@ -8,7 +8,7 @@
 // live entirely in workflow-runtime.mjs; the adapters here just execute.
 
 import { createWorkflowRuntime } from './workflow-runtime.mjs';
-import { normalizeGlobalConfig } from './policy.mjs';
+import { CONFIG_SCHEMA_VERSION, normalizeGlobalConfig } from './policy.mjs';
 import { buildDirectSelectionTrace, enrichSelectionTrace } from './model-routing.mjs';
 import {
   createIsolatedWorkspace,
@@ -43,7 +43,72 @@ export function buildEffectiveRuntimeConfig(globalRaw = {}, session = {}) {
     if (session?.[key] !== undefined) patch[key] = session[key];
   }
   if (session?.enabled === false) patch.subagents_enabled = false;
-  return normalizeGlobalConfig({ ...globalRaw, ...patch });
+  const base = normalizeGlobalConfig(globalRaw);
+  if (Object.keys(patch).length === 0) return base;
+
+  // Session controls are expressed through the compatibility vocabulary,
+  // but a persisted schema-v4 config correctly ignores flat compatibility
+  // mirrors. Project the session once through the legacy normalizer, then
+  // apply only the policy dimensions the session is allowed to own onto the
+  // canonical snapshot. Model priorities, provider routing, fallback,
+  // adaptive ordering, health gates, and review gate remain untouched.
+  const compatibility = { ...base, ...patch, config_schema_version: 2 };
+  delete compatibility.worker;
+  delete compatibility.review;
+  delete compatibility.execution;
+  delete compatibility.legacy;
+  // Canonical flat mirrors describe the persisted base and must not outrank
+  // this session's compatibility command. Remove the derived role/review
+  // mirrors so the legacy projector can recompute them from the requested
+  // session mode and review opt-in.
+  delete compatibility.worker_state;
+  delete compatibility.review_state;
+  delete compatibility.auto_review;
+  if (patch.collaboration_mode !== undefined) {
+    delete compatibility.tier_policy;
+    delete compatibility.flash_state;
+    delete compatibility.pro_state;
+  } else if (patch.tier_policy !== undefined) {
+    delete compatibility.collaboration_mode;
+    delete compatibility.flash_state;
+    delete compatibility.pro_state;
+  } else if (patch.flash_state !== undefined || patch.pro_state !== undefined) {
+    compatibility.collaboration_mode = 'custom';
+    delete compatibility.tier_policy;
+  }
+  Object.assign(compatibility, patch);
+  const projected = normalizeGlobalConfig(compatibility);
+  return normalizeGlobalConfig({
+    ...base,
+    config_schema_version: CONFIG_SCHEMA_VERSION,
+    subagents_enabled: projected.subagents_enabled,
+    main_agent_mode: projected.main_agent_mode,
+    execution: {
+      ...base.execution,
+      enabled: projected.subagents_enabled,
+      default_effort: projected.execution.default_effort,
+      default_timeout_seconds: projected.execution.default_timeout_seconds,
+      mode: projected.execution.mode,
+    },
+    worker: {
+      ...base.worker,
+      state: projected.worker.state,
+      model_policy: {
+        ...base.worker.model_policy,
+        strategy: projected.worker.model_policy.strategy,
+        escalation: {
+          ...base.worker.model_policy.escalation,
+          enabled: projected.worker.model_policy.escalation.enabled,
+        },
+      },
+    },
+    review: {
+      ...base.review,
+      state: projected.review.state,
+      auto_review: projected.review.auto_review,
+    },
+    legacy: projected.legacy,
+  });
 }
 
 /**
@@ -69,9 +134,9 @@ export function attemptFromView(view, spec) {
     modelClassHint: spec.model_class_hint ?? null,
     strategy: source ?? 'transport-selection',
     candidateSet: logicalAttempt > 0 ? 'escalation' : 'primary',
-    provider: view?.provider ?? null,
-    model: view?.model ?? null,
-    execution_context: view?.execution_context ?? null,
+    provider: view?.provider ?? null,
+    model: view?.model ?? null,
+    execution_context: view?.execution_context ?? null,
     source: source ?? 'transport-selection',
     escalationReason: spec.escalation_reason ?? null,
   });
@@ -87,10 +152,10 @@ export function attemptFromView(view, spec) {
     // `view.attempt` may be an adapter routing-attempt (see below); the
     // workflow's logical attempt number is always the spec value.
     attempt: logicalAttempt,
-    provider: view?.provider ?? null,
-    model: view?.model ?? null,
-    execution_context: view?.execution_context ?? null,
-    selection_source: source,
+    provider: view?.provider ?? null,
+    model: view?.model ?? null,
+    execution_context: view?.execution_context ?? null,
+    selection_source: source,
     selection_trace: selectionTrace,
     status: view?.status ?? 'failed',
     result: view?.result ?? null,

package/src/model-callability-contract.mjs

@@ -0,0 +1,79 @@
+import { isExactNativeCrewIdentity, sameCompleteRuntimeIdentity } from './runtime-identity-contract.mjs';
+
+export const MODEL_CALLABILITY_SCHEMA_VERSION = 2;
+const ROLES = ['worker', 'reviewer'];
+const STATES = new Set(['CALLABLE', 'NOT_CALLABLE', 'STALE', 'UNKNOWN', 'NOT_APPLICABLE']);
+const SOURCES = new Set(['provider_health', 'execution']);
+const MAX_EVIDENCE_TTL_MS = 24 * 60 * 60 * 1000;
+
+function exactKeys(value, keys) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+
+function route(value) {
+  return typeof value?.provider === 'string' && value.provider.trim()
+    && typeof value?.model === 'string' && value.model.trim()
+    ? { provider: value.provider.trim(), model: value.model.trim() } : null;
+}
+
+function validEvidence(role, now) {
+  if (!SOURCES.has(role.source) || !Number.isFinite(role.observed_at) || role.observed_at > now
+    || !Number.isFinite(role.expires_at) || role.expires_at <= now
+    || role.expires_at - role.observed_at > MAX_EVIDENCE_TTL_MS) return false;
+  if (role.source === 'execution') {
+    if (!role.last_success || typeof role.last_success !== 'object'
+      || typeof role.last_success.job_id !== 'string' || !role.last_success.job_id.trim()
+      || role.last_success.observed_at !== role.observed_at
+      || role.last_success.expires_at !== role.expires_at) return false;
+  }
+  return true;
+}
+
+export function validateModelCallabilityV2({ projection, runtime, expectedEnabledRoles, expectedSelections, now = Date.now() } = {}) {
+  const fail = (reason_code) => ({ ok: false, reason_code, state: 'UNKNOWN' });
+  if (!projection || typeof projection !== 'object' || projection.schema_version !== MODEL_CALLABILITY_SCHEMA_VERSION) return fail('MODEL_CALLABILITY_SCHEMA_INVALID');
+  if (!isExactNativeCrewIdentity(runtime) || !isExactNativeCrewIdentity(projection.runtime_identity)
+    || !sameCompleteRuntimeIdentity(runtime, projection.runtime_identity)
+    || projection.current_runtime_id !== runtime.runtime_id) return fail('MODEL_CALLABILITY_RUNTIME_MISMATCH');
+  if (!Number.isFinite(projection.captured_at) || projection.captured_at > now) return fail('MODEL_CALLABILITY_CAPTURE_INVALID');
+  if (!exactKeys(projection.enabled_roles, ROLES) || ROLES.some((role) => typeof projection.enabled_roles[role] !== 'boolean')) return fail('MODEL_CALLABILITY_ROLES_INVALID');
+  if (expectedEnabledRoles && (!exactKeys(expectedEnabledRoles, ROLES) || ROLES.some((role) => projection.enabled_roles[role] !== expectedEnabledRoles[role]))) return fail('MODEL_CALLABILITY_ROLE_CONFIG_MISMATCH');
+  if (expectedSelections && !exactKeys(expectedSelections, ROLES)) return fail('MODEL_CALLABILITY_EXPECTED_SELECTIONS_INVALID');
+  if (!exactKeys(projection.roles, ROLES)) return fail('MODEL_CALLABILITY_ROLE_EVIDENCE_MISSING');
+
+  for (const roleName of ROLES) {
+    const role = projection.roles[roleName];
+    if (!role || !STATES.has(role.state)) return fail('MODEL_CALLABILITY_ROLE_STATE_INVALID');
+    const selected = route(role.selected);
+    if (role.selected !== undefined && role.selected !== null && !selected) return fail('MODEL_CALLABILITY_SELECTION_INVALID');
+    if (expectedSelections) {
+      const expectedRaw = expectedSelections[roleName];
+      const expected = expectedRaw === null ? null : route(expectedRaw);
+      if (expectedRaw !== null && !expected) return fail('MODEL_CALLABILITY_EXPECTED_SELECTION_INVALID');
+      if ((expected === null) !== (selected === null)
+        || expected && (expected.provider !== selected.provider || expected.model !== selected.model)) return fail('MODEL_CALLABILITY_SELECTION_MISMATCH');
+    }
+    if (projection.enabled_roles[roleName] === false) {
+      if (role.state !== 'NOT_APPLICABLE' || role.reason_code !== 'ROLE_DISABLED') return fail('MODEL_CALLABILITY_DISABLED_ROLE_INVALID');
+      continue;
+    }
+    if (['CALLABLE', 'NOT_CALLABLE'].includes(role.state) && !selected) return fail('MODEL_CALLABILITY_SELECTION_INVALID');
+    if (projection.enabled_roles[roleName] === true && role.state === 'NOT_APPLICABLE') return fail('MODEL_CALLABILITY_ENABLED_ROLE_NOT_APPLICABLE');
+    if (['CALLABLE', 'NOT_CALLABLE'].includes(role.state)) {
+      if (!validEvidence(role, now)) return fail('MODEL_CALLABILITY_EVIDENCE_INVALID');
+    }
+  }
+
+  const activeRoles = ROLES.map((role) => projection.roles[role]).filter((_, index) => projection.enabled_roles[ROLES[index]] === true);
+  const activeStates = activeRoles.map((role) => role.state);
+  const state = activeStates.includes('NOT_CALLABLE') ? 'NOT_CALLABLE'
+    : activeStates.length > 0 && activeStates.every((value) => value === 'CALLABLE') ? 'CALLABLE'
+      : activeStates.includes('STALE') ? 'STALE' : 'UNKNOWN';
+  if (projection.overall !== state) return fail('MODEL_CALLABILITY_OVERALL_CONTRADICTION');
+  const evidenceExpirations = activeRoles.map((role) => role.expires_at).filter((value) => Number.isFinite(value));
+  const expectedExpires = evidenceExpirations.length ? Math.min(...evidenceExpirations) : null;
+  if (projection.expires_at !== expectedExpires) return fail('MODEL_CALLABILITY_EXPIRY_CONTRADICTION');
+  if (state === 'CALLABLE' && (!Number.isFinite(projection.expires_at) || projection.expires_at <= now)) return fail('MODEL_CALLABILITY_EXPIRED');
+  return { ok: true, state, reason_code: 'MODEL_CALLABILITY_VALID' };
+}

package/src/official-web-bridge.mjs

@@ -429,8 +429,6 @@ export function registerOfficialWebBridge(ctx, options = {}) {
     const QUICK_ALLOWLIST = new Set([
       '/quick-config',
       '/quick-status',
-      '/runtime/restart-request',
-      '/runtime/restart-status',
     ]);
     const disposers = [];
     for (const path of QUICK_ALLOWLIST) {