@ran-sh/dsh-crew 1.2.0-rc.6 → 1.3.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "1.2.0-rc.6",
+  "version": "1.3.1",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/docs/installation.md

@@ -90,6 +90,36 @@ pnpm run build:client
 npm pack --dry-run
 ```
 
+## Harness CLI selection
+
+The Crew launcher and the 3210 Hub boot from one Crew-managed Harness entry,
+chosen in this order:
+
+1. `DSH_CREW_DSH_CLI`, when set to an explicit `@deepseek-ai/dsh` entry.
+2. The Crew-managed npm runtime at `<crew home>/runtime` (the normal install
+   path, written by `dsh-crew update`). It carries whatever cohort the installed
+   Crew release pinned; the launcher never substitutes a different version.
+3. A Crew-managed source cohort, discovered through a
+   `<crew home>/runtime-source-<label>.json` sidecar. The sidecar's recorded
+   `version` must equal the checkout's own `apps/cli/package.json`, so a stale
+   sidecar can never pin a half-updated tree.
+
+For the npm runtime the launcher uses the Crew home as `DSH_HOME`; a source
+cohort is its own home, because its profiles, sessions and settings live inside
+that tree. The launcher then derives `dsh_version` from the verified
+`@deepseek-ai/dsh` manifest and requires the Hub to report that same version, so
+a process left over from a previous cohort is never treated as healthy.
+
+Only override `DSH_CREW_DSH_CLI` deliberately — it wins over the managed runtime.
+Never point it at the official `~/.dsh` tree, which the Crew launcher treats as a
+read-only boundary.
+
+To build a source cohort instead of the npm runtime (for example to test an
+unpublished tag), clone the tag into `<crew home>/runtime-source-<label>`, build
+its CLI, and write the matching sidecar. On Windows a source install needs the
+native toolchain for its `fs-ext` dependency; a failed native build is reported
+as a runtime failure rather than silently falling back to another cohort.
+
 ## Rollback vs uninstall
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "1.2.0-rc.6",
+  "version": "1.3.1",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {
@@ -41,30 +41,30 @@
     "./package.json": "./package.json"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-agent-loop": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-agent-presets": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-bash-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-compaction-basic": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-fs-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-fs-observation-policy": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm-deepseek": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sdk-client": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sdk-jsonrpc-server": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sdk-minimal": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-token-meter": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-tool-fs": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-tool-todo": "0.1.2-rc.1",
+    "@deepseek-ai/dsh": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-agent-loop": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-agent-presets": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-compaction-basic": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sdk-client": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sdk-jsonrpc-server": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sdk-minimal": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-token-meter": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-tool-fs": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-tool-todo": "0.1.5-rc.2",
     "react": "^18.0.0",
     "react-dom": "^18.0.0"
   },
@@ -149,30 +149,30 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/dsh": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-agent-loop": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-agent-presets": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-bash-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-compaction-basic": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-fs-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-fs-observation-policy": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm-deepseek": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sdk-client": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sdk-jsonrpc-server": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-sdk-minimal": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-token-meter": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-tool-fs": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-tool-todo": "0.1.2-rc.1",
+    "@deepseek-ai/dsh": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-agent-loop": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-agent-presets": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-compaction-basic": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sdk-client": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sdk-jsonrpc-server": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-sdk-minimal": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-token-meter": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-tool-fs": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-tool-todo": "0.1.5-rc.2",
     "@types/react": "^18.3.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",

package/scripts/verify-official-bridge-e2e.mjs

@@ -17,6 +17,7 @@ import { createServer } from 'node:net';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { npxInstall, npxIntegrate } from '../src/install/npx-lifecycle.mjs';
+import { TARGET_DSH_VERSION } from '../src/dsh-cohort.mjs';
 
 // RETIRED as a release gate: the legacy 3080 -> 3210 bridge is retired and
 // npxIntegrate()/npxDetach() always return OFFICIAL_WEB_PROFILE_READ_ONLY, so
@@ -139,7 +140,7 @@ try {
       const target = join(harnessHome, 'runtime');
       mkdirSync(dirname(target), { recursive: true });
       symlinkSync(realpathSync(runtimeRoot), target, process.platform === 'win32' ? 'junction' : 'dir');
-      return { ok: true, version: '0.1.2-rc.1' };
+      return { ok: true, version: TARGET_DSH_VERSION };
     },
   });
   assert(installed.ok, `disposable install failed: ${logs.join(' | ')}`);

package/src/dsh-cli-runtime.mjs

@@ -784,6 +784,75 @@ function ensureProfileScaffold(profileRoot) {
   return changed;
 }
 
+function readPackageVersionAt(dir, read = readFileSync) {
+  try {
+    const parsed = JSON.parse(read(join(dir, 'package.json'), 'utf8'));
+    return typeof parsed.version === 'string' && parsed.version ? parsed.version : null;
+  } catch { return null; }
+}
+
+// Nearest `<dir>/node_modules/<name>` walking up from `dir`, mirroring the
+// resolution a require() from that directory would take.
+export function resolveNearestBundleVersion(dir, name, { exists = defaultExists, read = readFileSync } = {}) {
+  let cursor = dir;
+  for (let depth = 0; depth < 12; depth += 1) {
+    const candidate = join(cursor, 'node_modules', ...name.split('/'));
+    if (exists(candidate)) return readPackageVersionAt(candidate, read);
+    const parent = dirname(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return null;
+}
+
+/**
+ * Stop a profile from resolving its bundle packages out of a foreign cohort.
+ *
+ * A profile first installed against a source checkout records `dsh-base` and
+ * `dsh-web-app` as links into that checkout. Switching the CLI to another
+ * cohort leaves those links behind, and because they sit in the profile's own
+ * node_modules they shadow the matching packages installed beside the profile.
+ * The host then composes the web app of one cohort while the plugin table comes
+ * from another; the client module table is built per cohort, so the mismatched
+ * plugin dies at require time with "missed the module table".
+ *
+ * Only an entry whose fallthrough provably resolves the target cohort is
+ * removed. A profile that deliberately tracks a different cohort keeps its
+ * links and is reported as skipped, never as an error.
+ */
+export function reconcileProfileBundleCohort({
+  home = homedir(),
+  profileRoot,
+  version = TARGET_DSH_VERSION,
+  bundles = CREW_PROFILE_DEFAULT_BUNDLES,
+  exists = defaultExists,
+  read = readFileSync,
+  remove = (path) => rmSync(path, { recursive: true, force: true }),
+} = {}) {
+  const root = profileRoot ?? crewProfileDir({ home });
+  if (typeof root !== 'string' || !isAbsolute(root)) return { ok: false, code: 'INVALID_PROFILE_ROOT' };
+  const modulesDir = join(root, 'node_modules');
+  const parentDir = dirname(root);
+  const unshadowed = [];
+  const skipped = [];
+  const removeBundle = (path) => remove(path);
+  for (const name of bundles) {
+    const shadowPath = join(modulesDir, ...name.split('/'));
+    if (!exists(shadowPath)) continue;
+    const shadowed = readPackageVersionAt(shadowPath, read);
+    if (shadowed === version) continue;
+    const fallthrough = resolveNearestBundleVersion(parentDir, name, { exists, read });
+    if (fallthrough !== version) {
+      skipped.push({ bundle: name, shadowed: shadowed ?? null, fallthrough: fallthrough ?? null });
+      continue;
+    }
+    try { removeBundle(shadowPath); } catch { return { ok: false, code: 'PROFILE_BUNDLE_UNSHADOW_FAILED', profileRoot: root, bundle: name }; }
+    if (exists(shadowPath)) return { ok: false, code: 'PROFILE_BUNDLE_UNSHADOW_FAILED', profileRoot: root, bundle: name };
+    unshadowed.push({ bundle: name, shadowed: shadowed ?? null });
+  }
+  return { ok: true, changed: unshadowed.length > 0, profileRoot: root, unshadowed, skipped };
+}
+
 function readCrewTombstones(home) {
   const lifecycleFile = join(dirname(crewDshHome({ home })), 'provider-lifecycle.json');
   if (!existsSync(lifecycleFile)) return { ok: true, tombstones: {} };
@@ -894,9 +963,16 @@ export function ensurePluginRegistration({
 export function ensureCrewPluginRegistration({ home = homedir(), root, name } = {}) {
   const result = ensurePluginRegistration({ profileRoot: crewProfileDir({ home }), root, name });
   if (!result.ok) return result;
+  const reconciliation = reconcileProfileBundleCohort({ home, profileRoot: result.profileRoot });
+  if (!reconciliation.ok) return reconciliation;
   const reconciled = reconcileCrewProfileProviders({ home, profileRoot: result.profileRoot });
   if (!reconciled.ok) return reconciled;
-  return { ...result, changed: result.changed || reconciled.changed, provider_reconciliation: reconciled.removed ?? [] };
+  return {
+    ...result,
+    changed: result.changed || reconciled.changed || reconciliation.changed,
+    provider_reconciliation: reconciled.removed ?? [],
+    bundle_reconciliation: reconciliation.unshadowed ?? [],
+  };
 }
 
 /**

package/src/dsh-cohort.mjs

@@ -4,7 +4,7 @@
 // resolve to this exact version. All other modules re-export from here so a
 // cohort bump touches exactly one file (plus package.json's 48 DSH pins).
 export const DSH_CLI_PACKAGE = '@deepseek-ai/dsh';
-export const TARGET_DSH_VERSION = '0.1.2-rc.1';
+export const TARGET_DSH_VERSION = '0.1.5-rc.2';
 export const TARGET_DSH_SPEC = `${DSH_CLI_PACKAGE}@${TARGET_DSH_VERSION}`;
 
 // Retained-cohort support: when a release's manifest pins an older DSH

package/src/history/archive-store.mjs

@@ -26,10 +26,21 @@ function pathInside(root, relativePath) {
   return current;
 }
 
+// One canonical session artifact path. The jsonl backend keeps one immutable
+// file per Session format generation: `session.jsonl` for version 0 and
+// `session.vN.jsonl` (N >= 1) after that, each optionally zstd-compressed.
+// Sharing the shape between the inventory and the archive guard keeps both in
+// step when the backend's naming changes.
+export const SESSION_ARTIFACT_PATTERN = /^harness\/sessions\/[^/]+\/[^/]+\/session(?:\.v[1-9][0-9]*)?\.jsonl(?:\.zstd)?$/;
+
+export function isSessionArtifactPath(relativePath, sessionId) {
+  return typeof relativePath === 'string'
+    && SESSION_ARTIFACT_PATTERN.test(relativePath)
+    && relativePath.split('/')[3] === sessionId;
+}
+
 function artifactPath(root, file) {
-  if (!validId(file?.sessionId) || typeof file.relativePath !== 'string'
-    || !/^harness\/sessions\/[^/]+\/[^/]+\/session\.jsonl(?:\.zstd)?$/.test(file.relativePath)
-    || file.relativePath.split('/')[3] !== file.sessionId) fail('INVALID_ARTIFACT');
+  if (!validId(file?.sessionId) || !isSessionArtifactPath(file.relativePath, file.sessionId)) fail('INVALID_ARTIFACT');
   return pathInside(root, file.relativePath);
 }
 

package/src/history/runner.mjs

@@ -6,6 +6,7 @@ import { acquireUpdateLock, releaseUpdateLock, createCrewSupervisor } from '../i
 import { readMaintenanceSession } from '../supervisor/restart-request.mjs';
 import { runHistoryOperation } from './operation.mjs';
 import { readHistoryState } from './state.mjs';
+import { TARGET_DSH_VERSION } from '../dsh-cohort.mjs';
 
 async function portFree() {
   return new Promise(resolve => {
@@ -40,7 +41,7 @@ export async function runProductionHistory({ id, recover = false } = {}) {
         const runtime = await response.json();
         return response.ok && runtime.ok === true && runtime.service === 'dsh-crew-hub' && runtime.profile === 'dsh-crew'
           && runtime.execution_plane === 'hub-3210' && runtime.listen_port === 3210 && runtime.protocol_version === 1
-          && runtime.dsh_version === '0.1.2-rc.1' && typeof runtime.runtime_id === 'string' && runtime.runtime_id !== s.runtimeId;
+          && runtime.dsh_version === TARGET_DSH_VERSION && typeof runtime.runtime_id === 'string' && runtime.runtime_id !== s.runtimeId;
       } catch { return false; }
     },
   });

package/src/history/runtime.mjs

@@ -3,13 +3,14 @@ import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import { getHubRuntimeIdentity } from '../runtime-identity.mjs';
+import { TARGET_DSH_VERSION } from '../dsh-cohort.mjs';
 import { createHistoryService } from './service.mjs';
 import { registerHistoryHttp } from './http.mjs';
 
 export function registerRuntimeHistory(ctx) {
   const crewRoot = join(homedir(), '.config', 'dsh-crew');
   const runtime = getHubRuntimeIdentity();
-  const owned = process.platform === 'win32' && runtime.dsh_version === '0.1.2-rc.1'
+  const owned = process.platform === 'win32' && runtime.dsh_version === TARGET_DSH_VERSION
     && resolve(process.env.DSH_HOME ?? '').toLowerCase() === resolve(join(crewRoot, 'harness')).toLowerCase();
   if (!owned) return () => {};
   return ctx.inject(['webServer', 'sessionPersistence', 'agents'], host => {

package/src/history/service.mjs

@@ -3,36 +3,65 @@ import { existsSync, readdirSync } from 'node:fs';
 import { relative } from 'node:path';
 import { planHistoryCleanup } from './cleanup-plan.mjs';
 import { installHistoryAdmissionGate } from './admission-gate.mjs';
-import { historyHash, historyPath, readHistoryBytes, decodeWorkspaceStore, readHistoryManifest } from './archive-store.mjs';
+import { historyHash, historyPath, readHistoryBytes, decodeWorkspaceStore, readHistoryManifest, isSessionArtifactPath } from './archive-store.mjs';
 import { readHistoryState, writeHistoryState, historyPending, publicHistoryState } from './state.mjs';
 
 export function createHistoryService({ crewRoot, agents, persistence, runtimeId, launch, now = Date.now }) {
   const gate = installHistoryAdmissionGate(agents, () => historyPending(crewRoot));
   const plans = new Map();
   let entering = false;
+  // One row per materialized session: the header to archive and the artifact
+  // location the backend reported. The 0.1.5 jsonl backend resolves each
+  // session's current immutable generation itself and hands back a concrete
+  // path through `listArtifacts()`. The earlier backend listed snapshots and
+  // only hinted at a location, leaving the encoding to be probed below.
+  async function readInventory() {
+    if (typeof persistence?.listArtifacts === 'function') {
+      const artifacts = await persistence.listArtifacts();
+      if (!Array.isArray(artifacts)) throw Error('HISTORY_INVENTORY_INVALID');
+      return artifacts.map(({ header, path }) => {
+        if (typeof path !== 'string') throw Error('HISTORY_STORAGE_UNSUPPORTED');
+        return { header, located: path, resolved: true };
+      });
+    }
+    if (typeof persistence?.listSnapshots === 'function') {
+      const rows = await persistence.listSnapshots();
+      if (!Array.isArray(rows)) throw Error('HISTORY_INVENTORY_INVALID');
+      return rows.map(({ header }) => {
+        const location = persistence.locate(header);
+        if (location?.kind !== 'jsonl') throw Error('HISTORY_STORAGE_UNSUPPORTED');
+        return { header, located: location.path, resolved: false };
+      });
+    }
+    throw Error('HISTORY_STORAGE_UNSUPPORTED');
+  }
   async function snapshot(options) {
-    if (typeof persistence?.listSnapshots !== 'function' || typeof persistence?.locate !== 'function'
-      || persistence.supportsRawArtifacts !== true) throw Error('HISTORY_STORAGE_UNSUPPORTED');
+    if (typeof persistence?.locate !== 'function') throw Error('HISTORY_STORAGE_UNSUPPORTED');
+    // Refuse only a backend that explicitly declares it exposes no per-session
+    // raw artifact. The 0.1.5 backend dropped the flag rather than setting it
+    // false, and the artifact path itself is validated below either way.
+    if (persistence.supportsRawArtifacts === false) throw Error('HISTORY_STORAGE_UNSUPPORTED');
     const bytes = readHistoryBytes(historyPath(crewRoot, 'harness/storages/workspace.json'));
     const store = decodeWorkspaceStore(bytes);
-    const listed = await persistence.listSnapshots();
-    if (!Array.isArray(listed) || listed.length > 10000) throw Error('HISTORY_INVENTORY_TOO_LARGE');
+    const listed = await readInventory();
+    if (listed.length > 10000) throw Error('HISTORY_INVENTORY_TOO_LARGE');
     let total = 0;
-    const sessions = listed.map(({ header, revision }) => {
+    const sessions = listed.map(({ header, located, resolved }) => {
       if (!header || typeof header.id !== 'string') throw Error('HISTORY_INVENTORY_INVALID');
-      const location = persistence.locate(header);
-      if (location?.kind !== 'jsonl') throw Error('HISTORY_STORAGE_UNSUPPORTED');
-      let path = relative(crewRoot, location.path).replaceAll('\\', '/');
-      if (!/^harness\/sessions\/[^/]+\/[^/]+\/session\.jsonl(?:\.zstd)?$/.test(path)
-        || path.split('/')[3] !== header.id) throw Error('HISTORY_STORAGE_UNSUPPORTED');
-      const plain = path.replace(/\.zstd$/, '');
-      const existing = [plain, `${plain}.zstd`].filter(candidate => existsSync(historyPath(crewRoot, candidate)));
-      if (existing.length !== 1) throw Error('HISTORY_ARTIFACT_AMBIGUOUS');
-      path = existing[0];
+      let path = relative(crewRoot, located).replaceAll('\\', '/');
+      if (!isSessionArtifactPath(path, header.id)) throw Error('HISTORY_STORAGE_UNSUPPORTED');
+      if (!resolved) {
+        // An unresolved location is a hint that may not name the encoding that
+        // actually exists, so exactly one candidate must be present on disk.
+        const plain = path.replace(/\.zstd$/, '');
+        const existing = [plain, `${plain}.zstd`].filter(candidate => existsSync(historyPath(crewRoot, candidate)));
+        if (existing.length !== 1) throw Error('HISTORY_ARTIFACT_AMBIGUOUS');
+        path = existing[0];
+      }
       const raw = readHistoryBytes(historyPath(crewRoot, path)); total += raw.length;
       if (total > 512 * 1024 * 1024) throw Error('HISTORY_INVENTORY_TOO_LARGE');
       return { id: header.id, createdAt: header.createdAt, parentSession: header.parentSession,
-        revision: JSON.stringify([revision, historyHash(raw)]), artifact: { sessionId: header.id, relativePath: path, sha256: historyHash(raw) } };
+        revision: JSON.stringify([header.revision, historyHash(raw)]), artifact: { sessionId: header.id, relativePath: path, sha256: historyHash(raw) } };
     });
     // A retained child keeps its ancestor chain; do not leave a newer fork orphaned.
     const workspaces = Object.entries(store.tables.workspaces).map(([id, row]) => ({ id, ...row }));

package/src/runtime-identity.mjs

@@ -5,7 +5,7 @@
 // - HUB_PROTOCOL_VERSION changes only when Hub <-> MCP wire semantics become
 //   incompatible.
 //
-// The Harness/DSH cohort version (e.g. 0.1.2-rc.1) is a THIRD, independent
+// The Harness/DSH cohort version (e.g. 0.1.5-rc.2) is a THIRD, independent
 // domain: it identifies the installed @deepseek-ai/dsh package generation,
 // never the Crew release. Verifiers must compare the cohort against
 // dsh_version, never against runtime_version.
@@ -16,7 +16,7 @@
 import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, extname, join, resolve } from 'node:path';
 import {
   PRODUCTION_EXECUTION_PLANE,
   PRODUCTION_PROFILE,
@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.2.0-rc.6';
+export const RUNTIME_VERSION = '1.3.1';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([
@@ -92,6 +92,43 @@ function normalizedCapabilities(value) {
   return [...new Set(value.filter((item) => typeof item === 'string' && item.trim()).map((item) => item.trim()))];
 }
 
+function readVersionManifest(file) {
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    if (parsed?.name !== '@deepseek-ai/dsh') return null;
+    return typeof parsed.version === 'string' && parsed.version.trim() ? parsed.version.trim() : null;
+  } catch { return null; }
+}
+
+/**
+ * Resolve the @deepseek-ai/dsh manifest belonging to an explicit CLI entry.
+ *
+ * This intentionally accepts only a package manifest whose name is the
+ * official Harness package. It lets a Crew-owned source checkout (for example
+ * the GitHub-only dsh-v0.1.3-alpha.1 tag) report its real cohort without ever
+ * reading the official ~/.dsh profile or trusting an arbitrary package.json.
+ */
+function readExplicitCliVersion(entry) {
+  if (typeof entry !== 'string' || !entry.trim()) return null;
+  let cursor;
+  try { cursor = resolve(entry); } catch { return null; }
+  if (extname(cursor).toLowerCase() !== '.js') {
+    // A Windows shim normally lives at <root>/node_modules/.bin/dsh.cmd.
+    // Starting at its parent still finds the sibling @deepseek-ai/dsh tree.
+    cursor = dirname(cursor);
+  }
+  for (let depth = 0; depth < 12; depth += 1) {
+    const direct = readVersionManifest(join(cursor, 'package.json'));
+    if (direct) return direct;
+    const nested = readVersionManifest(join(cursor, 'node_modules', '@deepseek-ai', 'dsh', 'package.json'));
+    if (nested) return nested;
+    const parent = dirname(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return null;
+}
+
 export function getHubRuntimeIdentity() {
   return {
     service: 'dsh-crew-hub',
@@ -109,10 +146,15 @@ export function getHubRuntimeIdentity() {
 }
 
 // Installed Harness cohort version (the @deepseek-ai/dsh package under the
-// Crew-owned DSH home). Null when unreadable: callers treat null as
-// "unknown cohort", never as a match. This is the ONLY field cohort
-// verifiers may compare against TARGET_DSH_VERSION.
-export function readCrewDshVersion({ home = homedir() } = {}) {
+// Crew-owned DSH home, or an explicit Crew-owned CLI source checkout). Null
+// when unreadable: callers treat null as "unknown cohort", never as a match.
+// This is the ONLY field cohort verifiers may compare against TARGET_DSH_VERSION.
+export function readCrewDshVersion({ home = homedir(), env = process.env } = {}) {
+  // Only the Crew-scoped override is trusted here. A generic DSH_CLI may
+  // point at the official web profile and must never become Crew provenance.
+  const explicit = env?.DSH_CREW_DSH_CLI;
+  const explicitVersion = readExplicitCliVersion(explicit);
+  if (explicitVersion) return explicitVersion;
   try {
     const file = join(home, '.config', 'dsh-crew', 'harness', 'runtime', 'node_modules', '@deepseek-ai', 'dsh', 'package.json');
     if (!existsSync(file)) return null;

package/windows/start-dsh-crew.ps1

@@ -9,7 +9,95 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
 $crewHome = Join-Path $env:USERPROFILE '.config\dsh-crew\harness'
-$dshCli = Join-Path $crewHome 'runtime\node_modules\.bin\dsh.cmd'
+$configuredDshCli = [string] $env:DSH_CREW_DSH_CLI
+if ($env:DSH_CREW_LAUNCHER_TEST_IMPORT -eq '1') { $configuredDshCli = '' }
+if (-not $configuredDshCli.Trim() -and $env:DSH_CREW_LAUNCHER_TEST_IMPORT -ne '1') {
+  # Crew-managed npm runtime: the normal install path, written by dsh-crew
+  # update and carrying whatever cohort that release pinned. An explicit
+  # DSH_CREW_DSH_CLI always wins so an operator can still pin another entry.
+  $runtimeEntry = Join-Path $crewHome 'runtime\node_modules\@deepseek-ai\dsh\lib\bin.js'
+  if (Test-Path -LiteralPath $runtimeEntry -PathType Leaf) {
+    $configuredDshCli = $runtimeEntry
+  }
+}
+if (-not $configuredDshCli.Trim() -and $env:DSH_CREW_LAUNCHER_TEST_IMPORT -ne '1') {
+  # Crew-managed source cohort: a runtime-source-<label>.json sidecar names the
+  # CLI entry. The sidecar's recorded version must equal the checkout's own
+  # manifest, so a stale sidecar can never pin a half-updated tree.
+  foreach ($sidecar in @(Get-ChildItem -LiteralPath $crewHome -Filter 'runtime-source-*.json' -File -ErrorAction SilentlyContinue | Sort-Object Name)) {
+    try {
+      $metadata = Get-Content -LiteralPath $sidecar.FullName -Raw | ConvertFrom-Json
+      if ($metadata.managed_by -ne 'dsh-crew') { continue }
+      $candidate = [string] $metadata.cli_entry
+      if ([string]::IsNullOrWhiteSpace($candidate)) { continue }
+      $sourceRoot = [IO.Path]::GetFullPath((Join-Path $crewHome ([IO.Path]::GetFileNameWithoutExtension($sidecar.Name))))
+      $candidateFull = [IO.Path]::GetFullPath($candidate)
+      $sourcePrefix = $sourceRoot.TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar
+      $sourceManifest = Join-Path $sourceRoot 'apps\cli\package.json'
+      $sourceVersion = if (Test-Path -LiteralPath $sourceManifest -PathType Leaf) {
+        [string] (Get-Content -LiteralPath $sourceManifest -Raw | ConvertFrom-Json).version
+      } else { $null }
+      $candidateValid = $sourceVersion -and $sourceVersion -eq [string] $metadata.version `
+        -and $candidateFull.StartsWith($sourcePrefix, [StringComparison]::OrdinalIgnoreCase) `
+        -and (Test-Path -LiteralPath $candidateFull -PathType Leaf)
+      if ($candidateValid) {
+        $configuredDshCli = $candidateFull
+        break
+      }
+    } catch { }
+  }
+}
+$dshCli = if ($configuredDshCli.Trim()) {
+  try { [IO.Path]::GetFullPath($configuredDshCli) } catch { $configuredDshCli }
+} else {
+  Join-Path $crewHome 'runtime\node_modules\.bin\dsh.cmd'
+}
+if ($configuredDshCli.Trim()) { $env:DSH_CREW_DSH_CLI = $dshCli }
+# DSH_HOME that owns the selected CLI. The managed npm runtime shares the Crew
+# home; a Crew-managed source cohort is its own home (its profiles, sessions and
+# settings live inside that tree). Derived from the selected entry so an explicit
+# DSH_CREW_DSH_CLI override resolves correctly too.
+$dshHome = $crewHome
+$sourceRootMatch = [regex]::Match($dshCli, '^(?<root>.+?[\\/]runtime-source-[^\\/]+)[\\/]')
+if ($sourceRootMatch.Success) {
+  $candidateRoot = $sourceRootMatch.Groups['root'].Value
+  if (Test-Path -LiteralPath (Join-Path $candidateRoot 'profiles') -PathType Container) { $dshHome = $candidateRoot }
+}
+$dshCliIsNodeEntry = [IO.Path]::GetExtension($dshCli).ToLowerInvariant() -eq '.js'
+$dshCommand = if ($dshCliIsNodeEntry) {
+  (Get-Command node.exe -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source
+} else { $dshCli }
+
+function Get-CrewDshManifest {
+  param([string] $Entry)
+  if (-not $Entry) { return $null }
+  try { $cursor = [IO.Path]::GetFullPath($Entry) } catch { return $null }
+  if ([IO.Path]::GetExtension($cursor).ToLowerInvariant() -eq '.js') {
+    $cursor = Split-Path -Parent $cursor
+  } else {
+    $cursor = Split-Path -Parent $cursor
+  }
+  for ($depth = 0; $depth -lt 12 -and $cursor; $depth += 1) {
+    $candidates = @(
+      (Join-Path $cursor 'package.json'),
+      (Join-Path $cursor 'node_modules\@deepseek-ai\dsh\package.json')
+    )
+    foreach ($candidate in $candidates) {
+      if (-not (Test-Path -LiteralPath $candidate -PathType Leaf)) { continue }
+      try {
+        $manifest = Get-Content -LiteralPath $candidate -Raw | ConvertFrom-Json
+        $knownOfficial = -not $configuredDshCli.Trim() -or $manifest.name -eq '@deepseek-ai/dsh'
+        if ($knownOfficial -and [string] $manifest.version) { return $manifest }
+      } catch { }
+    }
+    $parent = Split-Path -Parent $cursor
+    if ($parent -eq $cursor) { break }
+    $cursor = $parent
+  }
+  return $null
+}
+
+$dshManifest = Get-CrewDshManifest -Entry $dshCli
 $logRoot = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
 $launcherLog = Join-Path $logRoot 'dsh-crew-launcher.log'
 $startedAt = Get-Date
@@ -25,7 +113,7 @@ try {
   } finally { $hashStream.Dispose() }
 } catch { $launcherHelperHash = $null }
 $services = @(
-  [pscustomobject]@{ Name = 'Crew backend'; Profile = 'dsh-crew'; Home = $crewHome; Port = 3210; Url = 'http://127.0.0.1:3210'; CrewOwned = $true; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null }
+  [pscustomobject]@{ Name = 'Crew backend'; Profile = 'dsh-crew'; Home = $dshHome; Port = 3210; Url = 'http://127.0.0.1:3210'; CrewOwned = $true; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null }
 )
 
 function Write-LaunchLog {
@@ -58,7 +146,7 @@ function Resolve-OfficialHarnessCommand {
 }
 
 function Test-OfficialHarnessListener {
-  param([int] $OwnerPid, [pscustomobject] $Official)
+  param([int] $OwnerPid, [pscustomobject] $Official, [string] $Profile = 'web')
   if ($OwnerPid -le 0) { return $false }
   try {
     $owner = Get-CimInstance Win32_Process -Filter ('ProcessId={0}' -f $OwnerPid) -ErrorAction Stop
@@ -66,11 +154,154 @@ function Test-OfficialHarnessListener {
     $line = ([string] $owner.CommandLine).Replace('/', '\')
     $entry = [regex]::Escape($Official.Entry.Replace('/', '\'))
     $node = [regex]::Escape($Official.NodePath.Replace('/', '\'))
-    $pattern = '^\s*(?:"?' + $node + '"?|"?node(?:\.exe)?"?)\s+"?' + $entry + '"?\s+(?:"?web"?|--profile\s+"?web"?)(?:\s|$)'
+    $profileToken = [regex]::Escape($Profile)
+    $pattern = '^\s*(?:"?' + $node + '"?|"?node(?:\.exe)?"?)\s+"?' + $entry + '"?\s+(?:"?' + $profileToken + '"?|--profile\s+"?' + $profileToken + '"?)(?:\s|$)'
     return $line -match $pattern
   } catch { return $false }
 }
 
+function Test-CrewDshCliPreflight {
+  if ($null -eq $dshManifest -or [string]::IsNullOrWhiteSpace([string] $dshManifest.version)) {
+    throw "The DSH CLI at $dshCli is not a verified @deepseek-ai/dsh package entry."
+  }
+  if ($dshCliIsNodeEntry -and -not (Test-Path -LiteralPath (Join-Path (Join-Path $dshHome 'profiles') 'web\package.json') -PathType Leaf)) {
+    throw ('The Harness web profile is missing under {0}. Run: dsh-crew update' -f $dshHome)
+  }
+  $versionArgs = if ($dshCliIsNodeEntry) { @($dshCli, '--version') } else { @('--version') }
+  $reported = try { (& $dshCommand @versionArgs 2>&1 | Out-String).Trim() } catch { '' }
+  if ($LASTEXITCODE -ne 0 -or $reported -ne [string] $dshManifest.version) {
+    throw ('DSH CLI preflight failed: manifest={0}, reported={1}' -f $dshManifest.version, ($reported -replace '\s+', ' '))
+  }
+}
+
+function Get-CrewWebSessionUrl {
+  param([string] $OutputLog = $null)
+  $logs = if ($OutputLog) {
+    @(Get-Item -LiteralPath $OutputLog -ErrorAction SilentlyContinue)
+  } else {
+    @(Get-ChildItem -LiteralPath $logRoot -Filter 'dsh-crew-web-*.out.log' -File -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending)
+  }
+  foreach ($log in $logs) {
+    try {
+      $text = Get-Content -LiteralPath $log.FullName -Raw -ErrorAction Stop
+      $match = [regex]::Match($text, 'https?://127\.0\.0\.1:3080/\?token=[^\s\r\n]+')
+      if ($match.Success) { return $match.Value }
+    } catch { }
+  }
+  return $null
+}
+
+function Open-CrewBrowserUrl {
+  param([Parameter(Mandatory = $true)] [string] $Url)
+  $edge = Get-Command msedge.exe -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
+  if (-not $edge) {
+    $edgeCandidates = @(
+      @(
+        (Join-Path ${env:ProgramFiles(x86)} 'Microsoft\Edge\Application\msedge.exe'),
+        (Join-Path $env:ProgramFiles 'Microsoft\Edge\Application\msedge.exe'),
+        (Join-Path $env:LOCALAPPDATA 'Microsoft\Edge\Application\msedge.exe')
+      ) | Where-Object { $_ -and (Test-Path -LiteralPath $_ -PathType Leaf) }
+    )
+    if ($edgeCandidates.Count -gt 0) { $edge = [pscustomobject]@{ Source = $edgeCandidates[0] } }
+  }
+  if ($edge) {
+    Start-Process -FilePath $edge.Source -ArgumentList @('--new-window', $Url) | Out-Null
+    return
+  }
+  Start-Process $Url | Out-Null
+}
+
+function Test-CrewWebSessionUrl {
+  param([string] $Url)
+  if (-not $Url) { return $false }
+  try {
+    # The token endpoint intentionally answers with a 303 + Set-Cookie and
+    # redirects to `/`; do not follow it here or PowerShell loses the cookie
+    # and falsely reports the authenticated page as 404.
+    $response = Invoke-WebRequest -UseBasicParsing -MaximumRedirection 0 -Uri $Url -TimeoutSec 3
+    return [int] $response.StatusCode -ge 200 -and [int] $response.StatusCode -lt 400
+  } catch {
+    $status = if ($_.Exception.Response) { [int] $_.Exception.Response.StatusCode } else { 0 }
+    return $status -in @(301, 302, 303, 307, 308)
+  }
+}
+
+function Open-CrewManagedFrontend {
+  param([int] $TimeoutSeconds = 90)
+  # The 3080 frontend boots from the same Crew-managed Harness entry as 3210,
+  # against that entry's own DSH_HOME (npm runtime -> Crew home, source cohort
+  # -> its own tree). No official ~/.dsh state is read or written here.
+  $managedHome = $dshHome
+  $managedProfile = 'web'
+  $profileManifest = Join-Path (Join-Path $managedHome 'profiles') ('{0}\package.json' -f $managedProfile)
+  if (-not $dshCliIsNodeEntry -or -not (Test-Path -LiteralPath $profileManifest -PathType Leaf)) {
+    return $false
+  }
+  $official = [pscustomobject]@{ NodePath = $dshCommand; Entry = $dshCli; Profile = $managedProfile }
+  $frontend = Get-OfficialFrontendOverlay
+  $mutex = New-Object System.Threading.Mutex($false, 'Local\DSHCrewOfficialFrontendLauncher')
+  $locked = $false
+  try {
+    try { $locked = $mutex.WaitOne(30000) } catch [System.Threading.AbandonedMutexException] { $locked = $true }
+    if (-not $locked) { throw 'Another desktop launch is still starting the Crew-managed Harness frontend.' }
+    $port = Get-PortState -Port 3080
+    if ($port.State -eq 'unknown') { throw $port.Error }
+    if ($port.State -eq 'occupied') {
+      if (-not (Test-OfficialHarnessListener -OwnerPid $port.Pid -Official $official -Profile $managedProfile)) {
+        throw 'Port 3080 is occupied by a non-Crew-managed process; it was left untouched.'
+      }
+      if (-not (Test-OfficialWebReady)) { throw 'The Crew-managed 3080 frontend is not ready; its process was left running.' }
+      $existingUrl = Get-CrewWebSessionUrl
+      if ($existingUrl -and (Test-CrewWebSessionUrl -Url $existingUrl)) {
+        Open-CrewBrowserUrl -Url $existingUrl
+        Write-LaunchLog 'Opened the existing Crew-managed Harness frontend on 3080 with its session URL.'
+        return $true
+      }
+      Write-LaunchLog 'The existing Crew-managed 3080 session URL is stale; restarting the verified listener.' 'WARN'
+      Stop-Process -Id $port.Pid -Force -ErrorAction Stop
+      $freeDeadline = (Get-Date).AddSeconds(5)
+      do { Start-Sleep -Milliseconds 250; $port = Get-PortState -Port 3080 } while ($port.State -ne 'free' -and (Get-Date) -lt $freeDeadline)
+      if ($port.State -ne 'free') { throw 'The stale Crew-managed 3080 listener did not release the port.' }
+    }
+
+    $stamp = '{0}-{1}' -f (Get-Date -Format 'yyyyMMdd-HHmmssfff'), $PID
+    $stdout = Join-Path $logRoot ('dsh-crew-web-{0}.out.log' -f $stamp)
+    $stderr = Join-Path $logRoot ('dsh-crew-web-{0}.err.log' -f $stamp)
+    $previousHome = $env:DSH_HOME
+    $previousCli = $env:DSH_CREW_DSH_CLI
+    try {
+      $env:DSH_HOME = $managedHome
+      $env:DSH_CREW_DSH_CLI = $dshCli
+      $arguments = @($dshCli, '--profile', $managedProfile, '--patch', ('"{0}"' -f $frontend.Path), '--host', '127.0.0.1', '--port', '3080')
+      $process = Start-Process -FilePath $dshCommand -ArgumentList $arguments -WindowStyle Hidden -PassThru `
+        -RedirectStandardOutput $stdout -RedirectStandardError $stderr
+    } finally {
+      $env:DSH_HOME = $previousHome
+      $env:DSH_CREW_DSH_CLI = $previousCli
+    }
+    Write-LaunchLog ('Started Crew-managed Harness on 3080; PID={0}. Logs: {1}, {2}' -f $process.Id, $stdout, $stderr)
+    $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
+    do {
+      $port = Get-PortState -Port 3080
+      if ($port.State -eq 'occupied') {
+        if (-not (Test-OfficialHarnessListener -OwnerPid $port.Pid -Official $official -Profile $managedProfile)) {
+          throw 'Port 3080 became occupied by an unverified process; it was left untouched.'
+        }
+        if (Test-OfficialWebReady) {
+          $startedUrl = Get-CrewWebSessionUrl -OutputLog $stdout
+          if ($startedUrl) { Open-CrewBrowserUrl -Url $startedUrl; return $true }
+        }
+      }
+      if ($process.HasExited) { throw ('Crew-managed Harness exited before readiness. Diagnostic log: {0}' -f $stderr) }
+      Start-Sleep -Milliseconds 500
+    } while ((Get-Date) -lt $deadline)
+    throw ('The Crew-managed Harness did not become ready within {0}s; inspect {1}.' -f $TimeoutSeconds, $stderr)
+  } finally {
+    if ($locked) { $mutex.ReleaseMutex() }
+    $mutex.Dispose()
+  }
+}
+
 function Test-OfficialWebReady {
   try {
     $response = Invoke-WebRequest -UseBasicParsing -Uri 'http://127.0.0.1:3080/' -TimeoutSec 2
@@ -82,28 +313,28 @@ function Test-OfficialWebReady {
   }
 }
 
-function Get-OfficialFrontendOverlay {
-  $frontendRoot = Join-Path $env:USERPROFILE '.config\dsh-crew\frontend'
-  $path = Join-Path $frontendRoot 'official-web.patch.json'
-  if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { throw 'Crew frontend overlay is missing. Run dsh-crew update with the current GitHub candidate.' }
-  # Windows PowerShell 5.1 keeps a JSON root array as one pipeline object;
-  # direct `$patch[0].insert[0]` therefore resolves `insert` as IList.Insert
-  # instead of indexing the JSON property. Flatten both PowerShell generations
-  # explicitly and read properties through PSObject so StrictMode reports a
-  # useful validation error instead of "property id cannot be found".
-  $parsed = Get-Content -LiteralPath $path -Raw | ConvertFrom-Json
-  $patch = @($parsed | ForEach-Object { $_ })
-  $root = if ($patch.Count -eq 1) { $patch[0] } else { $null }
-  $insertProperty = if ($null -ne $root) { $root.PSObject.Properties['insert'] } else { $null }
-  $insertValue = if ($null -ne $insertProperty) { $insertProperty.Value } else { $null }
-  $inserts = @($insertValue | ForEach-Object { $_ })
-  $bridge = if ($inserts.Count -eq 1) { $inserts[0] } else { $null }
-  $idProperty = if ($null -ne $bridge) { $bridge.PSObject.Properties['id'] } else { $null }
-  $nameProperty = if ($null -ne $bridge) { $bridge.PSObject.Properties['name'] } else { $null }
-  if ($patch.Count -ne 1 -or $inserts.Count -ne 1 -or $null -eq $idProperty -or [string] $idProperty.Value -ne 'dsh-crew-official-web-bridge' -or $null -eq $nameProperty) {
-    throw 'Crew frontend overlay has an unexpected structure.'
-  }
-  $uri = [Uri] ([string] $nameProperty.Value)
+function Get-OfficialFrontendOverlay {
+  $frontendRoot = Join-Path $env:USERPROFILE '.config\dsh-crew\frontend'
+  $path = Join-Path $frontendRoot 'official-web.patch.json'
+  if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { throw 'Crew frontend overlay is missing. Run dsh-crew update with the current GitHub candidate.' }
+  # Windows PowerShell 5.1 keeps a JSON root array as one pipeline object;
+  # direct `$patch[0].insert[0]` therefore resolves `insert` as IList.Insert
+  # instead of indexing the JSON property. Flatten both PowerShell generations
+  # explicitly and read properties through PSObject so StrictMode reports a
+  # useful validation error instead of "property id cannot be found".
+  $parsed = Get-Content -LiteralPath $path -Raw | ConvertFrom-Json
+  $patch = @($parsed | ForEach-Object { $_ })
+  $root = if ($patch.Count -eq 1) { $patch[0] } else { $null }
+  $insertProperty = if ($null -ne $root) { $root.PSObject.Properties['insert'] } else { $null }
+  $insertValue = if ($null -ne $insertProperty) { $insertProperty.Value } else { $null }
+  $inserts = @($insertValue | ForEach-Object { $_ })
+  $bridge = if ($inserts.Count -eq 1) { $inserts[0] } else { $null }
+  $idProperty = if ($null -ne $bridge) { $bridge.PSObject.Properties['id'] } else { $null }
+  $nameProperty = if ($null -ne $bridge) { $bridge.PSObject.Properties['name'] } else { $null }
+  if ($patch.Count -ne 1 -or $inserts.Count -ne 1 -or $null -eq $idProperty -or [string] $idProperty.Value -ne 'dsh-crew-official-web-bridge' -or $null -eq $nameProperty) {
+    throw 'Crew frontend overlay has an unexpected structure.'
+  }
+  $uri = [Uri] ([string] $nameProperty.Value)
   if (-not $uri.IsFile) { throw 'Crew frontend must load from its local snapshot.' }
   $entry = [IO.Path]::GetFullPath($uri.LocalPath)
   $prefix = [IO.Path]::GetFullPath((Join-Path $frontendRoot 'revisions')) + [IO.Path]::DirectorySeparatorChar
@@ -126,6 +357,10 @@ function Test-OfficialFrontendAttached {
 
 function Open-OfficialFrontend {
   param([int] $TimeoutSeconds = 90)
+  # Preferred path: the Crew-managed Harness serves 3080 with the Crew panel
+  # already loaded. The legacy fallback below (separate official install in
+  # ~/.dsh) is only reached when no Crew-managed frontend is available.
+  if (Open-CrewManagedFrontend -TimeoutSeconds $TimeoutSeconds) { return }
   $official = Resolve-OfficialHarnessCommand
   $frontend = Get-OfficialFrontendOverlay
   $mutex = New-Object System.Threading.Mutex($false, 'Local\DSHCrewOfficialFrontendLauncher')
@@ -196,12 +431,10 @@ function Get-HealthState {
       # the process cannot be proven to match the tree it will next boot.
       $expectedDshVersion = $null
       $diskReadable = $false
-      $runtimeManifest = Join-Path $crewHome 'runtime\node_modules\@deepseek-ai\dsh\package.json'
-      if (Test-Path -LiteralPath $runtimeManifest -PathType Leaf) {
-        try {
-          $expectedDshVersion = (Get-Content -LiteralPath $runtimeManifest -Raw | ConvertFrom-Json).version
-          if ($expectedDshVersion) { $diskReadable = $true }
-        } catch { $expectedDshVersion = $null }
+      $activeDshManifest = Get-CrewDshManifest -Entry $dshCli
+      if ($null -ne $activeDshManifest -and [string] $activeDshManifest.version) {
+        $expectedDshVersion = [string] $activeDshManifest.version
+        $diskReadable = $true
       }
       $cohortMatches = $diskReadable -and $runtime.dsh_version -eq $expectedDshVersion
       if ($response.ok -eq $true -and $version -and $cohortMatches) {
@@ -814,7 +1047,8 @@ function Start-CrewService {
   try {
     $env:DSH_HOME = $Service.Home
     $arguments = @('--profile', $Service.Profile, '--host', '127.0.0.1', '--port', [string] $Service.Port, '--no-open')
-    $process = Start-Process -FilePath $dshCli -ArgumentList $arguments -WindowStyle Hidden -PassThru `
+    $launchArguments = if ($dshCliIsNodeEntry) { @($dshCli) + $arguments } else { $arguments }
+    $process = Start-Process -FilePath $dshCommand -ArgumentList $launchArguments -WindowStyle Hidden -PassThru `
       -RedirectStandardOutput $stdout -RedirectStandardError $stderr
     $Service.Process = $process
     $Service.RootPid = $process.Id
@@ -1034,14 +1268,14 @@ if ($env:DSH_CREW_LAUNCHER_TEST_IMPORT -eq '1') { return }
 try {
   New-Item -ItemType Directory -Path $logRoot -Force | Out-Null
   Write-LaunchLog ('Launcher started; mode={0}; user={1}' -f $Mode, $env:USERNAME)
-  if ($Mode -eq 'open') { Open-OfficialFrontend }
-
   if (-not (Test-Path -LiteralPath $dshCli -PathType Leaf)) {
-    throw "DSH CLI was not found at $dshCli. Run: npm install -g @ran-sh/dsh-crew@latest; dsh-crew update"
+    throw "DSH CLI was not found at $dshCli. Configure DSH_CREW_DSH_CLI to a Crew-owned official CLI entry, or run: npm install -g @ran-sh/dsh-crew@latest; dsh-crew update"
   }
+  Test-CrewDshCliPreflight
   if (-not (Test-Path -LiteralPath (Join-Path $crewHome 'profiles\dsh-crew\package.json') -PathType Leaf)) {
     throw "The isolated dsh-crew profile is missing under $crewHome. Run: dsh-crew update"
   }
+  if ($Mode -eq 'open') { Open-OfficialFrontend }
   # Background/watch modes remain independent of the official frontend.
 
   if ($Mode -eq 'watch') {

package/worker.cordis.yml

@@ -20,15 +20,11 @@
     mode: !!js process.env.DSH_SANDBOX_MODE ?? 'workspace-write'
     workspaceRoot: !!js process.env.DSH_CWD ?? process.cwd()
 
-- id: fs-local
-  config:
-    cwd: !!js process.env.DSH_CWD ?? process.cwd()
-
 - id: system-prompt
   config:
     includeHarnessIdentity: false
     includeRuntimeContext: false
-    persona: !!js process.env.DSH_SYSTEM_PROMPT ?? 'You are a focused coding worker. Complete the assigned task, then summarize what you did in your final message.'
+    personaPrefix: !!js process.env.DSH_SYSTEM_PROMPT ?? 'You are a focused coding worker. Complete the assigned task, then summarize what you did in your final message.'
 
 - id: agent-loop
   config:
@@ -40,6 +36,14 @@
     compression: zstd
 
 - insert:
+    # sdk-minimal dropped its own fs-local row in the 0.1.5 cohort, but the
+    # Crew tool suite still injects the `fs` service, so Crew owns the row and
+    # keeps the worker's editor rooted at the task workspace.
+    - id: fs-local
+      name: '@deepseek-ai/dsh-fs-local'
+      config:
+        cwd: !!js process.env.DSH_CWD ?? process.cwd()
+
     - id: fs-observation-policy
       name: '@deepseek-ai/dsh-fs-observation-policy'