@ran-sh/dsh-crew 1.10.1 → 1.10.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "1.10.1",
+  "version": "1.10.2",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "1.10.1",
+  "version": "1.10.2",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/dsh-cli-runtime.mjs

@@ -11,6 +11,7 @@ import {
   existsSync,
   lstatSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   realpathSync,
   renameSync,
@@ -528,9 +529,21 @@ async function rollbackRuntimeSwap({ liveRoot, prevRoot, stopOwned, startOwned,
       return recovery;
     }
   }
-  try { rmSync(liveRoot, { recursive: true, force: true }); } catch {}
   try {
-    if (existsSync(prevRoot)) { rename(prevRoot, liveRoot); recovery.restore = true; }
+    rmSync(liveRoot, { recursive: true, force: true });
+  } catch (error) {
+    // A failed removal must stop the recovery. Swallowing it left the window
+    // open: the restore was attempted over whatever remained, and
+    // `startOwned()` ran regardless — so a tree that could not be removed was
+    // then asked to start again, which on Windows is exactly the case where
+    // live handles blocked the removal.
+    recovery.removeError = String(error?.message ?? error);
+    recovery.ok = false;
+    return recovery;
+  }
+  try {
+    if (!existsSync(prevRoot)) recovery.restoreError = `previous runtime is missing at ${prevRoot}`;
+    else { rename(prevRoot, liveRoot); recovery.restore = true; }
   } catch (error) {
     recovery.restoreError = String(error?.message ?? error);
   }
@@ -538,6 +551,14 @@ async function rollbackRuntimeSwap({ liveRoot, prevRoot, stopOwned, startOwned,
     recovery.ok = recovery.restore === true;
     return recovery;
   }
+  // Restart only on positive proof that the prior runtime is the tree now at the
+  // live root. Starting without it would run the failed candidate again, or
+  // nothing at all, and report it as a recovery.
+  if (recovery.restore !== true || !existsSync(liveRoot)) {
+    recovery.restartSkipped = 'the previous runtime was not restored';
+    recovery.ok = false;
+    return recovery;
+  }
   try {
     const restarted = await startOwned();
     recovery.restart = restarted?.ok === true;
@@ -551,6 +572,8 @@ async function rollbackRuntimeSwap({ liveRoot, prevRoot, stopOwned, startOwned,
 
 // ---- retained runtime cohorts -------------------------------------------------
 
+const DISPLACED_RUNTIME_PREFIX = 'runtime-displaced-';
+
 function retainedRuntimesRoot({ home }) {
   return join(crewDshHome({ home }), RETAINED_RUNTIMES_DIRNAME);
 }
@@ -572,12 +595,22 @@ function runtimeTreeVersion(root, read = readFileSync) {
 // Best-effort retention of the swapped-out prior runtime tree. Never throws
 // and never fails the caller: retention is an optimization for offline
 // rollback, not a correctness requirement of the migration itself.
-function retainPriorRuntime({ home, prevRoot, rename = renameSync }) {
+/**
+ * Retain a parked runtime tree under the version it ships.
+ *
+ * `removeUnreadable` exists for one caller: the rollback rotation, where the
+ * parked tree is the ONLY copy of the cohort just displaced. There, failing to
+ * read its version is not a reason to delete it — that would destroy the very
+ * copy the rotation exists to keep — so it stays parked and is found later by
+ * `findRetainedRuntime`. The forward migration path keeps the default, where an
+ * unreadable tree really is junk.
+ */
+function retainPriorRuntime({ home, prevRoot, rename = renameSync, removeUnreadable = true }) {
   try {
     if (!existsSync(prevRoot)) return { ok: true, retained: false };
     const version = runtimeTreeVersion(prevRoot);
     if (!version) {
-      // No version to key retention on; the tree is unreadable junk.
+      if (!removeUnreadable) return { ok: false, retained: false, prevRoot, error: 'parked cohort version unreadable; left in place' };
       try { rmSync(prevRoot, { recursive: true, force: true }); } catch {}
       return { ok: true, retained: false, reason: 'prior tree version unreadable; removed' };
     }
@@ -601,9 +634,24 @@ function retainPriorRuntime({ home, prevRoot, rename = renameSync }) {
 export function findRetainedRuntime({ home = homedir(), version, exists = existsSync, read = readFileSync } = {}) {
   if (typeof version !== 'string' || version.length === 0) return null;
   const dir = retainedRuntimeDir({ home, version });
-  if (!exists(dir)) return null;
-  if (runtimeTreeVersion(dir, read) !== version) return null;
-  return dir;
+  if (exists(dir) && runtimeTreeVersion(dir, read) === version) return dir;
+  // A rotation whose retain step failed leaves the displaced cohort parked in the
+  // harness home. It is a complete, valid copy of that cohort, so it is found
+  // here rather than being written off: otherwise a later offline rollback to
+  // that version reports RETAINED_MISSING while the tree sits on disk.
+  return findDisplacedRuntime({ home, version, exists, read });
+}
+
+function findDisplacedRuntime({ home, version, exists = existsSync, read = readFileSync }) {
+  let names;
+  try { names = readdirSync(crewDshHome({ home })); } catch { return null; }
+  for (const name of names) {
+    if (!name.startsWith(DISPLACED_RUNTIME_PREFIX)) continue;
+    const dir = join(crewDshHome({ home }), name);
+    if (!exists(dir)) continue;
+    if (runtimeTreeVersion(dir, read) === version) return dir;
+  }
+  return null;
 }
 
 // Offline cohort restore for cross-cohort rollback: move the retained tree
@@ -642,14 +690,34 @@ export async function restoreRetainedRuntime({
   if (!stop.ok) {
     return { ok: false, code: stop.code ?? 'DSH_RUNTIME_STOP_FAILED', error: stop.error ?? 'could not stop owned 3210' };
   }
+  // Park the displaced cohort instead of deleting it. Deleting it was what made a
+  // second rollback impossible: after B→A the B tree was gone, so a later A→B
+  // found no retained B. Retention has to rotate, like the forward path does.
+  const parked = join(crewDshHome({ home }), `${DISPLACED_RUNTIME_PREFIX}${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`);
+  let parkedLive = false;
+  try {
+    if (existsSync(liveRoot)) { rename(liveRoot, parked); parkedLive = true; }
+  } catch (error) {
+    return { ok: false, code: 'DSH_RUNTIME_PARK_FAILED', error: String(error?.message ?? error) };
+  }
   try {
-    if (existsSync(liveRoot)) rmSync(liveRoot, { recursive: true, force: true });
     rename(retained, liveRoot);
   } catch (error) {
-    // Restore the pre-existing live tree is impossible (it was replaced only
-    // on success above); report and let the caller reconcile.
+    // Put the displaced tree back: leaving the live root empty because a rename
+    // failed would take a working runtime down for nothing.
+    try { if (parkedLive && !existsSync(liveRoot)) rename(parked, liveRoot); } catch { /* reported below */ }
     return { ok: false, code: 'DSH_RUNTIME_RESTORE_SWAP_FAILED', error: String(error?.message ?? error) };
   }
+  // The cohort just displaced becomes the retained one, so the version this
+  // restore moved away from can still be rolled back to. This parked tree is the
+  // only copy of that cohort, so an unreadable version keeps it rather than
+  // deleting it, and a failure is surfaced instead of passing as a clean restore.
+  const rotated = parkedLive
+    ? retainPriorRuntime({ home, prevRoot: parked, rename, removeUnreadable: false })
+    : { ok: true, retained: false };
+  if (parkedLive && rotated.ok === false) {
+    log(`! could not retain the displaced runtime cohort; it remains at ${parked}: ${rotated.error ?? ''}`);
+  }
   if (prepareOnly) {
     log(`- runtime tree prepared offline from retained tree (@${version}); process not started`);
     return { ok: true, version, liveRoot, prepared: true };

package/src/install/npx-lifecycle.mjs

@@ -161,21 +161,62 @@ export function readCurrentPointerState({ home = homedir() } = {}) {
     return { status: 'malformed', file, code: 'POINTER_FIELDS_INVALID' };
   }
   if (!isAbsolute(raw.path)) return { status: 'malformed', file, code: 'POINTER_PATH_NOT_ABSOLUTE' };
-  return { status: 'valid', file, pointer: raw };
+  // The pointer names the release that is live, and recovery acts on it. A path
+  // outside the managed releases directory is a corrupt or tampered pointer, not
+  // a release, so it fails closed exactly like the other malformed cases — and
+  // the canonical value is what the caller gets, so every later use acts on the
+  // path that was checked.
+  const canonical = managedReleasePath({ home, value: raw.path });
+  if (canonical === null) {
+    return { status: 'malformed', file, code: 'POINTER_PATH_OUTSIDE_RELEASES' };
+  }
+  return { status: 'valid', file, pointer: { ...raw, path: canonical } };
+}
+
+/**
+ * Resolve a path that a journal, the pointer, or recovery is about to act on, and
+ * refuse it unless it is inside the Crew-owned releases directory.
+ *
+ * An absolute path is not enough. Recovery recursively deletes the journal's
+ * candidate stage directory and moves the pointer's release, so a syntactically
+ * valid but corrupt or tampered journal naming any absolute path would grant
+ * delete authority over it — including the official `~/.dsh` tree this plugin is
+ * required never to touch. Containment is therefore checked before any read,
+ * write, delete or activation, and a path that fails it is treated exactly like
+ * a malformed journal: nothing is touched and the state is retained.
+ */
+export function managedReleasePath({ home = homedir(), value } = {}) {
+  if (typeof value !== 'string' || value.length === 0 || !isAbsolute(value)) return null;
+  const releases = realpathOr(resolve(crewReleasesDir({ home })));
+  const candidate = realpathOr(resolve(value));
+  // Resolve both sides before comparing: `..` segments and symlinks must not be
+  // able to leave the managed directory after the check.
+  const relative = relativeTo(releases, candidate);
+  if (relative === null || relative === '' || relative.startsWith('..') || isAbsolute(relative)) return null;
+  return candidate;
 }
 
-function validJournalRelease(value) {
+function realpathOr(path) {
+  try { return realpathSync(path); } catch { return path; }
+}
+
+/** `path` expressed relative to `from`, or null when they are on different roots. */
+function relativeTo(from, path) {
+  return relative(from, path);
+}
+
+function validJournalRelease({ home, value }) {
   return !!value && typeof value === 'object'
     && typeof value.name === 'string' && value.name.length > 0
     && typeof value.version === 'string' && value.version.length > 0
-    && typeof value.path === 'string' && isAbsolute(value.path);
+    && managedReleasePath({ home, value: value.path }) !== null;
 }
 
-function validJournalCandidate(value) {
+function validJournalCandidate({ home, value }) {
   return !!value && typeof value === 'object'
     && typeof value.name === 'string' && value.name.length > 0
     && typeof value.version === 'string' && value.version.length > 0
-    && typeof value.stageDir === 'string' && isAbsolute(value.stageDir);
+    && managedReleasePath({ home, value: value.stageDir }) !== null;
 }
 
 function writeFileAtomic(file, content) {
@@ -359,13 +400,23 @@ function readUpdateJournal({ home = homedir() } = {}) {
     return { malformed: true, file };
   }
   // Full schema check: a semantically broken journal (null candidate,
-  // incomplete prior) must fail closed, never enter recovery.
-  if (!validJournalCandidate(raw.candidate)) {
+  // incomplete prior) must fail closed, never enter recovery. The paths are
+  // checked for containment too, because recovery deletes and moves them, and
+  // they are replaced with the canonical value that was checked so that every
+  // later use acts on the path that was validated rather than the string that
+  // happened to be written.
+  const canonicalCandidate = managedReleasePath({ home, value: raw.candidate?.stageDir });
+  if (!validJournalCandidate({ home, value: raw.candidate }) || canonicalCandidate === null) {
     return { malformed: true, file, code: 'JOURNAL_CANDIDATE_SCHEMA_INVALID' };
   }
-  if (raw.prior !== null && raw.prior !== undefined && !validJournalRelease(raw.prior)) {
-    return { malformed: true, file, code: 'JOURNAL_PRIOR_SCHEMA_INVALID' };
+  if (raw.prior !== null && raw.prior !== undefined) {
+    const canonicalPrior = managedReleasePath({ home, value: raw.prior?.path });
+    if (!validJournalRelease({ home, value: raw.prior }) || canonicalPrior === null) {
+      return { malformed: true, file, code: 'JOURNAL_PRIOR_SCHEMA_INVALID' };
+    }
+    raw = { ...raw, prior: { ...raw.prior, path: canonicalPrior } };
   }
+  raw = { ...raw, candidate: { ...raw.candidate, stageDir: canonicalCandidate } };
   return raw;
 }
 
@@ -554,7 +605,9 @@ export function reconcileUpdateJournal({ home = homedir(), log = () => {}, insta
     return { ok: false, code: 'POINTER_MALFORMED', file: pointerState.file, error: pointerState.code ?? 'pointer unreadable; refusing recovery' };
   }
   const pointer = pointerState.status === 'valid' ? pointerState.pointer : null;
-  const candidateDir = journal.candidate?.stageDir ?? null;
+  // Act on the canonical path that was validated, not the raw string that was
+  // written: the delete below is only as safe as the path it is handed.
+  const candidateDir = managedReleasePath({ home, value: journal.candidate?.stageDir ?? null });
   const candidateManifest = candidateDir && existsSync(candidateDir) ? readManifest(candidateDir) : null;
 
   // A coordinated-update journal MUST carry a runtime segment; recovery may

package/src/install/payload-content.mjs

@@ -74,12 +74,23 @@ export function capturePayloadContent(root, suppliedManifest) {
   } catch { return null; }
 }
 
-/** This digest covers first-party shipped files, not dependency tamper attestation. */
+/**
+ * This digest covers first-party shipped files, not dependency tamper attestation.
+ *
+ * The permission bits are part of it: the copy below writes each file with the
+ * mode captured from the source, so a payload whose `0644` became `0755` with
+ * identical bytes is not the same payload — it is the case where an intended
+ * permission repair would otherwise be skipped as already done.
+ */
 export function payloadContentDigest(root) {
   const snapshot = capturePayloadContent(root);
   if (!snapshot) return null;
-  const hashes = [...snapshot.files].map(([name, bytes]) => [name, createHash('sha256').update(bytes).digest('hex')]);
-  return createHash('sha256').update(JSON.stringify(hashes.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))).digest('hex');
+  const entries = [...snapshot.files].map(([name, bytes]) => [
+    name,
+    snapshot.modes.get(name) ?? null,
+    createHash('sha256').update(bytes).digest('hex'),
+  ]);
+  return createHash('sha256').update(JSON.stringify(entries.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))).digest('hex');
 }
 
 export function samePayloadContent(sourceRoot, installedRoot) {

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.10.1';
+export const RUNTIME_VERSION = '1.10.2';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([