@ran-sh/dsh-crew 1.10.5 → 1.10.6

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "1.10.5",
+  "version": "1.10.6",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "1.10.5",
+  "version": "1.10.6",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/dsh-cli-runtime.mjs

@@ -7,6 +7,7 @@
 
 import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
+import { renameTree } from './install/tree-move.mjs';
 import {
   existsSync,
   lstatSync,
@@ -460,7 +461,7 @@ export async function migrateCrewDshRuntime({
   let liveMoved = false;
   try {
     if (existsSync(liveRoot)) {
-      rename(liveRoot, prevRoot);
+      renameTree(liveRoot, prevRoot, { rename });
       liveMoved = true;
     }
     mkdirSync(liveRoot, { recursive: true });

package/src/hub/index.mjs

@@ -1330,6 +1330,19 @@ export function resolveHubSpawnPayload(payload, getConfig = () => ({}), dependen
   }
   // v0.2 role-based dispatch: reviewer / worker are gated by their role state,
   // and the tier slot is derived from the role (reviewer always → pro).
+  // A plain payload names no workspace or constraints, but it does name a role,
+  // and the role's profile states how that role runs. Only the advanced shape
+  // resolved it, so the same task submitted through the simple shape ran shared
+  // while the profile said worktree: the profile was silently ignored for the
+  // caller who wrote the least. A payload that names no role keeps its
+  // pass-through shape.
+  if (normalized.requested_isolation === undefined && (normalized.role === 'worker' || normalized.role === 'reviewer')) {
+    const registry = dependencies.profileRegistry ?? loadRoleProfiles();
+    const roleProfile = registry.ok ? resolveRoleProfile(registry, normalized.profile, normalized.role) : { ok: false };
+    if (roleProfile.ok && typeof roleProfile.profile?.isolation === 'string') {
+      normalized = { ...normalized, requested_isolation: roleProfile.profile.isolation };
+    }
+  }
   if (normalized.role === 'worker' || normalized.role === 'reviewer') {
     const hint = resolveRoleTierHint(normalized.role, normalized.tier);
     if (!hint.ok) return { ok: false, code: hint.code, error: hint.error };

package/src/install/crew-paths.mjs

@@ -0,0 +1,52 @@
+// Where the Crew-owned Harness profile lives, and where the registration link
+// that the host integrations point at is rooted.
+//
+// This is its own module because two layers must agree about it and neither may
+// import the other: the installers write host integrations against the loader
+// link, and the readiness checks decide whether those integrations are correct.
+// When readiness derived its expected paths from the release directory instead,
+// every correctly installed machine read as needing repair — the installer and
+// the check disagreed about what "the installed server" is, and only the
+// installer was right.
+
+import { existsSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+export const CREW_PROFILE_NAME = 'dsh-crew';
+export const CREW_HOME_REL = join('.config', 'dsh-crew', 'harness');
+
+export function crewDshHome({ home = homedir() } = {}) {
+  return join(home, CREW_HOME_REL);
+}
+
+export function crewProfileDir({ home = homedir() } = {}) {
+  return join(crewDshHome({ home }), 'profiles', CREW_PROFILE_NAME);
+}
+
+// The profile's `node_modules/<name>` entry for the installed package. The
+// registration points this at the live release, so it is stable across
+// upgrades while the release path underneath it is not.
+export function loaderLinkPath({ home = homedir(), name } = {}) {
+  if (typeof name !== 'string' || name.trim() === '') return null;
+  return join(crewProfileDir({ home }), 'node_modules', ...name.split('/'));
+}
+
+function sameDirectory(left, right) {
+  try { return realpathSync(left) === realpathSync(right); } catch { return false; }
+}
+
+/**
+ * The root the host integrations were installed from.
+ *
+ * Readiness must judge the integrations against the path they were actually
+ * written with. That path is the loader link when it resolves to this release,
+ * and the release directory itself otherwise — a machine whose link is missing
+ * or points somewhere else is reported against the release, which is exactly
+ * the mismatch the operator needs to see.
+ */
+export function integrationRoot({ home = homedir(), root, name } = {}) {
+  const link = loaderLinkPath({ home, name });
+  if (!link || !root || !existsSync(link)) return root;
+  return sameDirectory(link, root) ? link : root;
+}

package/src/install/install-legacy.mjs

@@ -10,6 +10,7 @@ import { homedir } from 'node:os';
 import { normalizeModelPriority } from '../model-routing.mjs';
 import { crewSkillFiles, installCrewSkill, readCrewSkill, removeCrewSkill } from './crew-skill.mjs';
 import { zcodeStatus } from './zcode.mjs';
+import { integrationRoot } from './crew-paths.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 const MARKETPLACE_NAME = 'dsh-crew';
@@ -372,6 +373,13 @@ export function writeGlobalConfig(patch) {
 
 /** What is currently installed where — drives the settings-page buttons. */
 export function installStatus({ home = homedir(), root = ROOT, env = process.env } = {}) {
+  // Host integrations are installed from the profile's loader link, not from the
+  // release directory, so an upgrade re-points one link instead of rewriting four
+  // host configurations. Readiness has to judge them against the path they were
+  // actually written with: deriving it from the release directory made every
+  // correctly installed machine read as needing repair.
+  const manifestName = readJson(join(root, 'package.json'), {})?.name ?? null;
+  const effectiveRoot = integrationRoot({ home, root, name: manifestName });
   const settings = readJson(join(home, '.claude', 'settings.json'), {});
   const enabled = settings.enabledPlugins;
   const claudeInstalled = !!(enabled && !Array.isArray(enabled) && enabled[PLUGIN_KEY]);
@@ -382,8 +390,8 @@ export function installStatus({ home = homedir(), root = ROOT, env = process.env
   const claudeFootprint = claudeInstalled || typeof marketplaceRoot === 'string' || installedPluginRecord !== undefined;
   const claudeComponents = {
     enabled: claudeInstalled,
-    marketplace: normalizedPath(marketplaceRoot) === normalizedPath(root) && claudePluginRootReady(root),
-    snapshot: claudeSnapshotReady(home, root),
+    marketplace: normalizedPath(marketplaceRoot) === normalizedPath(effectiveRoot) && claudePluginRootReady(effectiveRoot),
+    snapshot: claudeSnapshotReady(home, effectiveRoot),
     permissions: claudePermissionsReady(settings),
   };
   const claudeMissing = Object.entries(claudeComponents).filter(([, present]) => !present).map(([key]) => key);
@@ -395,11 +403,11 @@ export function installStatus({ home = homedir(), root = ROOT, env = process.env
   const workerTarget = codexRoleTarget(workerFile, 'ds-worker');
   const reviewerTarget = codexRoleTarget(reviewerFile, 'ds-reviewer');
   const mcpTarget = codexMcpTarget(configText);
-  const expectedTarget = normalizedPath(join(root, 'src', 'server.mjs'));
-  const expectedWorkerRole = renderedCodexRole(root, 'ds-worker.toml');
-  const expectedReviewerRole = renderedCodexRole(root, 'ds-reviewer.toml');
-  const expectedConfigPrompt = readText(join(root, 'codex', 'prompts', 'dsh-config.md'));
-  const expectedStatusPrompt = readText(join(root, 'codex', 'prompts', 'dsh-status.md'));
+  const expectedTarget = normalizedPath(join(effectiveRoot, 'src', 'server.mjs'));
+  const expectedWorkerRole = renderedCodexRole(effectiveRoot, 'ds-worker.toml');
+  const expectedReviewerRole = renderedCodexRole(effectiveRoot, 'ds-reviewer.toml');
+  const expectedConfigPrompt = readText(join(effectiveRoot, 'codex', 'prompts', 'dsh-config.md'));
+  const expectedStatusPrompt = readText(join(effectiveRoot, 'codex', 'prompts', 'dsh-status.md'));
   const components = {
     worker_role: expectedWorkerRole !== null && readText(workerFile) === expectedWorkerRole,
     reviewer_role: expectedReviewerRole !== null && readText(reviewerFile) === expectedReviewerRole,
@@ -422,10 +430,34 @@ export function installStatus({ home = homedir(), root = ROOT, env = process.env
       missing: claudeMissing,
     },
     codex: { installed: codexInstalled, ready: missing.length === 0, components, missing },
-    zcode: zcodeStatus({ home, root }),
+    zcode: zcodeStatus({ home, root: effectiveRoot }),
   };
 }
 
+function removeLegacyCodexRoles({ agentsDir }) {
+  const actions = [];
+  for (const f of ['worker.toml', 'reviewer.toml']) {
+    const p = join(agentsDir, f);
+    if (!existsSync(p)) continue;
+    // Only Crew's own abandoned stub is removed. An earlier release wrote these
+    // before the roles were renamed to ds-worker/ds-reviewer, and every Codex
+    // start since has logged "Ignoring malformed agent role definition" about a
+    // file of ours that Codex cannot use: a role without `developer_instructions`
+    // is not a role, so anything that *is* a real user role cannot match here.
+    const text = readText(p);
+    if (typeof text !== 'string') continue;
+    const name = f.replace(/\.toml$/, '');
+    const stripped = text.replace(/#[^\n]*/g, '').trim();
+    if (/developer_instructions/.test(stripped)) continue;
+    if (!new RegExp(`^name\\s*=\\s*["']${name}["']$`).test(stripped)) continue;
+    const bak = backup(p);
+    if (bak) actions.push(`backup: ${bak}`);
+    rmSync(p);
+    actions.push(`removed obsolete role: ${p}`);
+  }
+  return actions;
+}
+
 export function uninstallCodex({ home = homedir(), env = process.env } = {}) {
   const actions = [];
   // Both the v0.2 roles (ds-worker / ds-reviewer) and the deprecated v0.1
@@ -435,6 +467,7 @@ export function uninstallCodex({ home = homedir(), env = process.env } = {}) {
     const p = join(codexHomeDir(home, env), 'agents', f);
     if (existsSync(p)) { backup(p); rmSync(p); actions.push(`removed: ${p} (backup kept)`); }
   }
+  actions.push(...removeLegacyCodexRoles({ agentsDir: join(codexHomeDir(home, env), 'agents') }));
   for (const f of ['dsh-config.md', 'dsh-status.md']) {
     const p = join(codexHomeDir(home, env), 'prompts', f);
     if (existsSync(p)) { rmSync(p); actions.push(`removed: ${p}`); }
@@ -596,6 +629,7 @@ export function installCodex({ home = homedir(), scope, root = ROOT, env = proce
     writeFileSync(join(promptsDir, f), readFileSync(join(promptsSrc, f), 'utf8'));
     actions.push(`prompt: ${join(promptsDir, f)}`);
   }
+  actions.push(...removeLegacyCodexRoles({ agentsDir }));
   if (scope !== 'project') {
     const act = writeGlobalCodexMcpServer(home, renderedPath, env);
     actions.push(...act);

package/src/install/install.mjs

@@ -32,16 +32,9 @@ const TIER_STATES = ['disabled', 'manual', 'auto'];
 // paths must never default to the user's official ~/.dsh or its ``web`` profile.
 // A fresh Crew Hub config points at the Crew-owned port only; the former
 // shared-profile default 3080 is treated as a legacy value to migrate away from.
-export const CREW_PROFILE_NAME = 'dsh-crew';
-export const CREW_HOME_REL = join('.config', 'dsh-crew', 'harness');
 export const CREW_DEFAULT_HUB_URL = 'http://127.0.0.1:3210';
 export const CREW_LEGACY_HUB_URL = 'http://127.0.0.1:3080';
-export function crewDshHome({ home = homedir() } = {}) {
-  return join(home, CREW_HOME_REL);
-}
-export function crewProfileDir({ home = homedir() } = {}) {
-  return join(crewDshHome({ home }), 'profiles', CREW_PROFILE_NAME);
-}
+export { CREW_HOME_REL, CREW_PROFILE_NAME, crewDshHome, crewProfileDir } from './crew-paths.mjs';
 
 // The isolated default set: identical to the legacy defaults except the Hub URL,
 // so fresh Crew installs never point at the official web profile.

package/src/install/npx-lifecycle.mjs

@@ -44,6 +44,7 @@ import { samePayloadContent, capturePayloadContent } from './payload-content.mjs
 import { crewDshHome, crewProfileDir } from './install.mjs';
 import { releaseClaimsState } from '../release-in-use.mjs';
 import { compareProcessToken, processStartToken } from '../process-identity.mjs';
+import { renameTree } from './tree-move.mjs';
 import { checkRuntimeAdvance, normalizeRuntimeState, runtimeStateMayHaveStarted } from './runtime-lifecycle.mjs';
 import { ensureCrewDshRuntime, ensureCrewPluginRegistration, removeCrewPluginRegistration, migrateCrewDshRuntime, installDshInto, restoreRetainedRuntime, crewDshRuntimeRoot, payloadDshVersion, TARGET_DSH_VERSION } from '../dsh-cli-runtime.mjs';
 import {
@@ -857,7 +858,7 @@ export async function reconcileUpdateJournal({ home = homedir(), log = () => {},
         if (parked) {
           try {
             rmSync(rt.liveRoot, { recursive: true, force: true });
-            renameSync(parked, rt.liveRoot);
+            renameTree(parked, rt.liveRoot);
           } catch (error) {
             return { ok: false, code: 'JOURNAL_COORDINATED_RUNTIME_RESTORE_FAILED', stage: journal.stage, error: `prior runtime restore failed: ${error?.message ?? error}` };
           }
@@ -868,7 +869,7 @@ export async function reconcileUpdateJournal({ home = homedir(), log = () => {},
           if (retainedDir && existsSync(retainedDir)) {
             try {
               rmSync(rt.liveRoot, { recursive: true, force: true });
-              renameSync(retainedDir, rt.liveRoot);
+              renameTree(retainedDir, rt.liveRoot);
               restored = true;
             } catch { /* fall through to fail closed */ }
           }
@@ -2434,14 +2435,14 @@ export async function performCoordinatedCohortUpdate({
       if (existsSync(liveRoot)) {
         // prevPath is unique per attempt and already recorded in the journal.
         try { rmSync(prevPath, { recursive: true, force: true }); } catch {}
-        renameSync(liveRoot, prevPath);
+        renameTree(liveRoot, prevPath);
         liveMoved = true;
       }
       mkdirSync(liveRoot, { recursive: true });
     } catch (error) {
       // Park failed: restore live tree before anything else.
       try {
-        if (liveMoved && !existsSync(liveRoot) && prevPath && existsSync(prevPath)) renameSync(prevPath, liveRoot);
+        if (liveMoved && !existsSync(liveRoot) && prevPath && existsSync(prevPath)) renameTree(prevPath, liveRoot);
       } catch { /* best effort */ }
       const comp = await compensate();
       return finalizeCompensationFailure({ home, code: 'COORDINATED_RUNTIME_PARK_FAILED', error: String(error?.message ?? error), comp });
@@ -2453,7 +2454,7 @@ export async function performCoordinatedCohortUpdate({
       let comp = { ok: false };
       try {
         rmSync(liveRoot, { recursive: true, force: true });
-        if (liveMoved && existsSync(prevPath)) renameSync(prevPath, liveRoot);
+        if (liveMoved && existsSync(prevPath)) renameTree(prevPath, liveRoot);
         comp = await compensate();
       } catch { /* compensate below already reports */ }
       return finalizeCompensationFailure({ home, code: installed.code ?? 'COORDINATED_RUNTIME_INSTALL_FAILED', error: installed.error ?? 'runtime install at live root failed', comp });

package/src/install/tree-move.mjs

@@ -0,0 +1,37 @@
+import { renameSync } from 'node:fs';
+
+/**
+ * Rename a directory, absorbing the transient refusal Windows gives for a tree
+ * that was just in use.
+ *
+ * Every runtime-tree move in this codebase happens immediately after the process
+ * using that tree was stopped: parking the live cohort, restoring a parked one
+ * during recovery, rotating a displaced cohort. On Windows the rename can be
+ * refused with EPERM/EACCES for a moment afterwards — a handle another process
+ * still holds, an indexer, or the previous child's own teardown — and the same
+ * call succeeds a few milliseconds later. Treating the first refusal as fatal
+ * turns that timing artifact into a failed upgrade, a failed rollback, or worst
+ * of all a recovery that cannot finish.
+ *
+ * Only the transient codes are retried. A missing source or a cross-device move
+ * is not going to become possible on the next attempt, so it is raised at once.
+ */
+export const TRANSIENT_RENAME_CODES = Object.freeze(['EPERM', 'EACCES', 'EBUSY', 'ENOTEMPTY']);
+
+export function renameTree(from, to, { rename = renameSync, delays = [0, 40, 120, 300, 700] } = {}) {
+  let lastError = null;
+  for (const delay of delays) {
+    if (delay > 0) {
+      const until = Date.now() + delay;
+      while (Date.now() < until) { /* bounded wait: this path is not hot */ }
+    }
+    try {
+      rename(from, to);
+      return { ok: true };
+    } catch (error) {
+      lastError = error;
+      if (!TRANSIENT_RENAME_CODES.includes(error?.code)) throw error;
+    }
+  }
+  throw lastError;
+}

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.10.5';
+export const RUNTIME_VERSION = '1.10.6';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/workflow-runtime.mjs

@@ -181,8 +181,14 @@ export function createWorkflowRuntime(adapters, {
       phase: JOB_PHASES.CREATED,
       status: 'running',
       cancelling: false,
+      // Where it will run is not known until the workspace is allocated, and the
+      // first snapshot a caller sees is taken before that happens. Claiming
+      // `shared` there was a wrong answer for every job that ends up isolated:
+      // the caller was told the work happens in their own tree while it was
+      // about to happen in a worktree. `null` means not allocated yet;
+      // `requested_isolation` carries what was asked for.
       execution_cwd: spec.cwd,
-      isolation: 'shared',
+      isolation: null,
       base_revision: null,
       primary_workspace_dirty: false,
       attempts: [],

package/src/workflow.mjs

@@ -63,17 +63,41 @@ function splitSection(value) {
   return value.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
 }
 
-const NO_CHANGE_SENTINELS = new Set([
-  'no files changed',
-  'no file changed',
-  'no changes',
-  '无文件变更',
-  '没有文件变更',
-  '未更改任何文件',
-  '无变更',
-]);
+// A line that asserts the workspace ends unchanged. The report sections are
+// prose, so this has to recognize the assertion inside a sentence rather than
+// only as a whole line: "No net file changes — git status is empty" is the same
+// claim as "no changes", and it is the *better* report.
+const NO_CHANGE_ASSERTION_RE = new RegExp(
+  '^(?:'
+  + 'no\\s+(?:net\\s+)?(?:files?|changes?)\\b'
+  + '|nothing\\s+(?:was\\s+)?(?:changed|modified|added|removed|deleted)\\b'
+  + '|none\\s+(?:of\\s+the\\s+)?(?:files?|changes?)\\b'
+  + '|workspace\\s+(?:is\\s+|remains\\s+)?(?:unchanged|clean)\\b'
+  + '|(?:the\\s+)?(?:final\\s+|net\\s+)?(?:file\\s+)?changes?\\s*[:—-]\\s*(?:none|no\\b|empty)'
+  + '|无(?:文件)?变更|没有(?:文件)?变更|未(?:更改|修改)任何文件|工作区(?:保持)?不变'
+  + ')',
+);
+
+function isNoChangeAssertion(line) {
+  const normalized = line
+    .replace(/^(?:[-*+]\s+)+/, '')
+    .replace(/[`"'“”‘’]/g, '')
+    .replace(/[.!。！]+$/, '')
+    .trim()
+    .toLowerCase();
+  if (normalized === '') return false;
+  return NO_CHANGE_ASSERTION_RE.test(normalized);
+}
 
+// Whether the report claims the workspace holds changes. A report that asserts
+// the workspace ends unchanged is not claiming any, whatever else it describes:
+// an authorized task that creates something, verifies it and removes it must
+// describe that transient work, and describing it is not a claim that it is
+// still there. This can only ever turn a mismatch into a match when the
+// workspace really is unchanged — if it did change, `claimsChanges === false`
+// against real changes is still a mismatch, so no actual change is hidden.
 function deliveryClaimsChanges(outcome) {
+  if (outcome?.no_change_declared === true) return false;
   return Array.isArray(outcome?.changes) && outcome.changes.length > 0;
 }
 
@@ -110,15 +134,9 @@ export function applyWorkspaceEvidence(outcome, {
 }
 
 function parseChanges(section) {
-  return splitSection(section).filter((line) => {
-    const normalized = line
-      .replace(/^(?:[-*+]\s+)+/, '')
-      .replace(/[`"'“”‘’]/g, '')
-      .replace(/[.!。！]+$/g, '')
-      .trim()
-      .toLowerCase();
-    return !NO_CHANGE_SENTINELS.has(normalized);
-  });
+  // The declaration lines are dropped so the remaining list is what the report
+  // says about files; the no-change assertion itself is kept out of it.
+  return splitSection(section).filter((line) => !isNoChangeAssertion(line));
 }
 
 // The Tests section is parsed by the delivery contract's own parser. This module
@@ -163,6 +181,11 @@ export function buildOutcome({ result = '', deliveryMeta, executionStatus, stopR
     confidence: null,
     needs_escalation: false,
     changes: parseChanges(parsed.sections.Diff),
+    // The report's net claim about the workspace, read from the section as
+    // written. It cannot be inferred from `changes`: that list is filtered, so
+    // the declaration line is gone from it by the time anyone looks, and the
+    // lines that remain describe work the report already said it undid.
+    no_change_declared: splitSection(parsed.sections.Diff).some(isNoChangeAssertion),
     tests,
     tests_status: testsStatus ?? null,
     risks: splitSection(parsed.sections.Risks),