@ran-sh/dsh-crew 1.3.1 → 1.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/client/history-panel.tsx

@@ -5,7 +5,7 @@ const pending = (phase?: string) => !!phase && !['IDLE', 'DONE', 'FAILED', 'ROLL
 const copy = {
   zh: {
     title: '工作区与会话清理', intro: '仅影响 3210 的工作区记录与会话日志；不删除项目文件、附件或 3080 数据。',
-    operation: '操作', archive: '归档（可恢复）', delete: '删除（不可恢复）', scope: '时间范围', all: '全部', before: '指定时间之前',
+    operation: '操作', archive: '归档（可恢复）', delete: '删除（不可恢复）', scope: '范围', all: '全部（含你自己的会话）', crew: '仅 Crew 创建（推荐）', worktree: '仅 Crew 工作树', before: '指定时间之前',
     time: '创建时间早于', timeHint: '按本机时区选择，严格按创建时间筛选；包含新会话的工作区会保留。',
     preview: '预览清理范围', confirm: '确认执行', acknowledgement: '删除确认：请输入 DELETE', idle: '会短暂停止并重启 3210；请先结束或关闭所有正在使用的 3210 会话。',
     consent: '我已确认范围，并同意短暂重启 3210', restore: '恢复', archives: '已归档批次', empty: '暂无可恢复的归档',
@@ -17,7 +17,7 @@ const copy = {
   },
   en: {
     title: 'Workspace & session cleanup', intro: 'Only 3210 workspace records and session logs. Project files, attachments and 3080 data are untouched.',
-    operation: 'Action', archive: 'Archive (restorable)', delete: 'Delete (permanent)', scope: 'Time range', all: 'All', before: 'Before a date',
+    operation: 'Action', archive: 'Archive (restorable)', delete: 'Delete (permanent)', scope: 'Scope', all: 'Everything (includes your own sessions)', crew: 'Crew-created only (recommended)', worktree: 'Crew worktrees only', before: 'Before a date',
     time: 'Created before', timeHint: 'Local timezone; strict creation-time cutoff. Workspaces with newer sessions are kept.',
     preview: 'Preview cleanup', confirm: 'Confirm operation', acknowledgement: 'Type DELETE to confirm deletion', idle: '3210 will briefly stop and restart. End or close all active 3210 conversations first.',
     consent: 'I reviewed the scope and agree to restart 3210', restore: 'Restore', archives: 'Archived batches', empty: 'No restorable archives',
@@ -33,7 +33,7 @@ export function HistoryPanel({ locale }: { locale: string }) {
   const t = copy[locale === 'zh' ? 'zh' : 'en'];
   const [open, setOpen] = useState(false);
   const [operation, setOperation] = useState('archive');
-  const [scope, setScope] = useState('all');
+  const [scope, setScope] = useState('crew');
   const [before, setBefore] = useState('');
   const [preview, setPreview] = useState<any>(null);
   const [status, setStatus] = useState<any>({ phase: 'IDLE' });
@@ -81,7 +81,7 @@ export function HistoryPanel({ locale }: { locale: string }) {
       <p style={{ margin: 0, opacity: .75 }}>{t.intro}</p>
       <div style={{ display: 'flex', gap: 12, flexWrap: 'wrap' }}>
         <label>{t.operation} <select style={style} value={operation} disabled={locked} onChange={e => { setOperation(e.target.value); invalidate(); }}><option value="archive">{t.archive}</option><option value="delete">{t.delete}</option></select></label>
-        <label>{t.scope} <select style={style} value={scope} disabled={locked} onChange={e => { setScope(e.target.value); invalidate(); }}><option value="all">{t.all}</option><option value="before">{t.before}</option></select></label>
+        <label>{t.scope} <select style={style} value={scope} disabled={locked} onChange={e => { setScope(e.target.value); invalidate(); }}><option value="crew">{t.crew}</option><option value="worktree">{t.worktree}</option><option value="all">{t.all}</option><option value="before">{t.before}</option></select></label>
       </div>
       {scope === 'before' && <label>{t.time} <input type="datetime-local" style={style} value={before} disabled={locked} onChange={e => { setBefore(e.target.value); invalidate(); }} /></label>}
       <div style={{ fontSize: 11.5, opacity: .7 }}>{t.timeHint}</div>

package/src/history/admission-gate.mjs

@@ -13,6 +13,22 @@ function method(object, name) {
   }
 }
 
+/**
+ * Whether one registered agent currently owns a running turn.
+ *
+ * Registration is not activity: the session controller resumes a session into
+ * the registry as soon as it opens it, and leaves it there after the turn ends
+ * with `status: 'idle'`. Treating a non-empty registry as "in use" therefore
+ * wedged cleanup permanently behind ACTIVE_SESSIONS on a machine whose web UI had
+ * ever opened a session. Only a `running` status means work is actually in
+ * flight; anything else (idle, or a status an older agent does not expose) is
+ * treated as not running, and `creating > 0` remains the independent guard for a
+ * creation that has not published yet.
+ */
+function isRunning(agent) {
+  try { return agent?.status === 'running'; } catch { return false; }
+}
+
 export function installHistoryAdmissionGate(agents, isMaintenancePending) {
   if (typeof agents?.create !== 'function' || typeof agents?.list !== 'function'
     || typeof isMaintenancePending !== 'function') throw new Error('HISTORY_ADMISSION_UNAVAILABLE');
@@ -40,7 +56,7 @@ export function installHistoryAdmissionGate(agents, isMaintenancePending) {
       if (entries.some(entry => method(agents, entry.name) !== entry.wrapper)) return false;
       try {
         const live = agents.list();
-        return Array.isArray(live) && creating === 0 && live.length === 0;
+        return Array.isArray(live) && creating === 0 && !live.some(isRunning);
       } catch { return false; }
     },
     dispose() {

package/src/history/cleanup-plan.mjs

@@ -28,18 +28,42 @@ function records(values) {
   return [...values].sort((a, b) => a.id.localeCompare(b.id, 'en'));
 }
 
-/** Pure preview only. No filesystem or project-path operations are performed. */
-export function planHistoryCleanup(snapshot, { operation = 'archive', scope = 'all', before } = {}) {
-  if (!['archive', 'delete'].includes(operation) || !['all', 'before'].includes(scope)) throw new Error('HISTORY_INVALID_OPTIONS');
+/**
+ * Pure preview only. No filesystem or project-path operations are performed.
+ *
+ * `scope` defaults to `crew`: a caller that forgets to narrow the range gets the
+ * one range that cannot remove sessions the operator opened themselves. Widening
+ * to `all` is always an explicit choice.
+ */
+export function planHistoryCleanup(snapshot, { operation = 'archive', scope = 'crew', before } = {}) {
+  if (!['archive', 'delete'].includes(operation) || !['all', 'crew', 'worktree', 'before'].includes(scope)) throw new Error('HISTORY_INVALID_OPTIONS');
   const cutoff = scope === 'before' ? instant(before) : null;
   if (scope === 'before' && (typeof before !== 'string' || cutoff === null)) throw new Error('HISTORY_INVALID_CUTOFF');
   const workspaces = records(snapshot.workspaces);
   const sessions = records(snapshot.sessions);
   const active = ids(snapshot.activeSessionIds);
-  const selected = new Set(sessions.filter(row => scope === 'all' || (instant(row.createdAt) !== null && instant(row.createdAt) < cutoff)).map(row => row.id));
+  // `crew` and `worktree` narrow by provenance, never by project path: a session
+  // is Crew's own only when Crew recorded creating it, and worktree scope adds
+  // the isolated-workspace marker the hub stamps at dispatch.
+  const origin = new Set(Array.isArray(snapshot.crewSessionIds) ? snapshot.crewSessionIds : []);
+  const admitted = (row) => {
+    if (scope === 'crew') return origin.has(row.id);
+    if (scope === 'worktree') return origin.has(row.id) && row.worktree === true;
+    return true;
+  };
+  const withinTime = (row) => cutoff === null
+    || (instant(row.createdAt) !== null && instant(row.createdAt) < cutoff);
+  const selected = new Set(sessions.filter(row => admitted(row) && withinTime(row)).map(row => row.id));
+  // A workspace carries no provenance of its own: it follows its sessions, and
+  // only when every one of them is selected. Checking `admitted(row)` here would
+  // test a workspace id against a session ledger and always fail. A provenance
+  // scope additionally requires at least one selected child — an empty workspace
+  // holds no Crew work, so it is not Crew's to remove; `all` keeps its historical
+  // behaviour of following an empty workspace.
+  const requiresOwnedChild = scope === 'crew' || scope === 'worktree';
   const workspaceIds = workspaces.filter(row => {
     const children = ids(row.sessionIds);
-    return (scope === 'all' || (instant(row.createdAt) !== null && instant(row.createdAt) < cutoff))
+    return withinTime(row) && (!requiresOwnedChild || children.length > 0)
       && children.every(id => selected.has(id));
   }).map(row => row.id).sort();
   const sessionIds = [...selected].sort();
@@ -48,6 +72,7 @@ export function planHistoryCleanup(snapshot, { operation = 'archive', scope = 'a
     workspaces: workspaces.map(row => ({ id: row.id, createdAt: row.createdAt, updatedAt: row.updatedAt, sessionIds: ids(row.sessionIds) })),
     sessions: sessions.map(row => ({ id: row.id, createdAt: row.createdAt, revision: row.revision })),
     active,
+    crewSessionIds: [...origin].sort(),
   };
   return {
     schemaVersion: 1, operation, scope,

package/src/history/runner-detach.mjs

@@ -0,0 +1,34 @@
+// Detach the history maintenance runner from the hub's process tree.
+//
+// The runner must outlive the hub it is maintaining: its transaction stops 3210,
+// rewrites the session store while nothing holds it, then starts 3210 again. The
+// supervisor stops a service by killing that service's whole tracked process
+// tree, and the tree is walked through `ParentProcessId`. A runner spawned
+// directly by the hub is therefore inside the tree and is killed by the very stop
+// it requested, leaving the transaction stranded in STOPPING with a stale update
+// lock and no operator-side way to finish it.
+//
+// This launcher is the intermediate: it starts the runner, confirms the process
+// exists, and exits immediately. The runner's parent is then a process that no
+// longer exists, so the supervisor's tree walk cannot reach it and it survives.
+//
+// Usage: node runner-detach.mjs <runnerPath> [...runnerArgs]
+import { spawn } from 'node:child_process';
+
+const [runnerPath, ...runnerArgs] = process.argv.slice(2);
+if (!runnerPath) {
+  process.stderr.write('runner-detach: missing runner path\n');
+  process.exit(2);
+}
+
+const child = spawn(process.execPath, [runnerPath, ...runnerArgs], {
+  detached: true,
+  windowsHide: true,
+  stdio: 'ignore',
+  env: { ...process.env },
+});
+child.once('error', () => process.exit(1));
+child.once('spawn', () => {
+  child.unref();
+  process.exit(0);
+});

package/src/history/runtime.mjs

@@ -17,8 +17,15 @@ export function registerRuntimeHistory(ctx) {
     const service = createHistoryService({ crewRoot, agents: host.agents, persistence: host.sessionPersistence,
       runtimeId: runtime.runtime_id, launch(id, recover = false) {
         return new Promise((accept, reject) => {
-          const child = spawn(process.execPath, [fileURLToPath(new URL('./runner.mjs', import.meta.url)), id, ...(recover ? ['--recover'] : [])], {
-            detached: true, windowsHide: true, stdio: 'ignore', env: { ...process.env },
+          // Spawn through a launcher that exits immediately: a runner parented by
+          // this hub would sit inside the hub's tracked process tree and be killed
+          // by the stop it requested. See runner-detach.mjs.
+          const child = spawn(process.execPath, [
+            fileURLToPath(new URL('./runner-detach.mjs', import.meta.url)),
+            fileURLToPath(new URL('./runner.mjs', import.meta.url)),
+            id, ...(recover ? ['--recover'] : []),
+          ], {
+            windowsHide: true, stdio: 'ignore', env: { ...process.env },
           });
           child.once('error', reject); child.once('spawn', () => { child.unref(); accept(); });
         });

package/src/history/service.mjs

@@ -5,6 +5,8 @@ import { planHistoryCleanup } from './cleanup-plan.mjs';
 import { installHistoryAdmissionGate } from './admission-gate.mjs';
 import { historyHash, historyPath, readHistoryBytes, decodeWorkspaceStore, readHistoryManifest, isSessionArtifactPath } from './archive-store.mjs';
 import { readHistoryState, writeHistoryState, historyPending, publicHistoryState } from './state.mjs';
+import { readSessionOrigins } from '../session-origins.mjs';
+import { defaultWorktreeRoot } from '../workspace-isolation.mjs';
 
 export function createHistoryService({ crewRoot, agents, persistence, runtimeId, launch, now = Date.now }) {
   const gate = installHistoryAdmissionGate(agents, () => historyPending(crewRoot));
@@ -60,12 +62,21 @@ export function createHistoryService({ crewRoot, agents, persistence, runtimeId,
       }
       const raw = readHistoryBytes(historyPath(crewRoot, path)); total += raw.length;
       if (total > 512 * 1024 * 1024) throw Error('HISTORY_INVENTORY_TOO_LARGE');
-      return { id: header.id, createdAt: header.createdAt, parentSession: header.parentSession,
+      return { id: header.id, createdAt: header.createdAt, parentSession: header.parentSession, cwd: header.cwd,
         revision: JSON.stringify([header.revision, historyHash(raw)]), artifact: { sessionId: header.id, relativePath: path, sha256: historyHash(raw) } };
     });
     // A retained child keeps its ancestor chain; do not leave a newer fork orphaned.
     const workspaces = Object.entries(store.tables.workspaces).map(([id, row]) => ({ id, ...row }));
-    const plan = planHistoryCleanup({ workspaces, sessions, activeSessionIds: gate.idle() ? [] : ['active-agent'] }, options);
+    const crewSessionIds = [...readSessionOrigins()];
+    const crewSet = new Set(crewSessionIds);
+    for (const row of sessions) if (crewSet.has(row.id)) row.crew = true;
+    // The isolated-workspace marker: the hub stamps every worktree session with a
+    // cwd under the Crew worktree root, so that subset is scopeable on its own.
+    const worktreeRoot = defaultWorktreeRoot().replaceAll('\\', '/').toLowerCase();
+    for (const row of sessions) {
+      if (row.crew === true && typeof row.cwd === 'string' && row.cwd.replaceAll('\\', '/').toLowerCase().startsWith(worktreeRoot)) row.worktree = true;
+    }
+    const plan = planHistoryCleanup({ workspaces, sessions, crewSessionIds, activeSessionIds: gate.idle() ? [] : ['active-agent'] }, options);
     const selected = new Set(plan.sessionIds);
     const byId = new Map(sessions.map(row => [row.id, row]));
     const queue = sessions.filter(row => !selected.has(row.id));

package/src/hub/index.mjs

@@ -101,6 +101,7 @@ function seedLangFromHost(ctx) {
 }
 
 import { setLang } from '../i18n.mjs';
+import { appendSessionOrigin } from '../session-origins.mjs';
 
 const ROUTE_BASE = '/_dsh/dsh-crew';
 // Quick-config allowlist: the ONLY config keys writable from the official
@@ -809,6 +810,10 @@ export class WorkerRegistry {  constructor(ctx) {
       isolatedWorkspace = { worktreePath: created.worktreePath, repoRoot: created.repoRoot };
     }
     const sessionId = `session-${randomUUID()}`;
+    // Record provenance while it is still knowable: a session header carries no
+    // field naming who asked for the session, so a later Crew-scoped cleanup can
+    // only tell Crew's own work apart from the operator's by this ledger.
+    appendSessionOrigin({ sessionId, role: jobRole, jobId: id });
     const job = {
       id, client_job_id: client_job_id ?? null, sessionId, role: jobRole, attempt, tier: effTier, provider: selection.provider, model: selection.model,
       selection_source: selection.source, selection_trace: selection.selection_trace ?? null,

package/src/jobs.mjs

@@ -8,7 +8,7 @@
 // never passes an explicit dshBin that would bypass it. The worker rides the
 // `sdk-minimal` profile with the Crew overlay applied as a --patch.
 
-import { createStandaloneHarness } from './standalone-sdk.mjs';
+import { createStandaloneHarness } from './standalone-sdk.mjs';
 import { readFileSync, mkdirSync, existsSync } from 'node:fs';
 import { createShardWriter } from './status-shard.mjs';
 import { fileURLToPath } from 'node:url';
@@ -19,6 +19,7 @@ import { captureWorkspaceBaseline, captureWorkspaceDiff, NOT_A_GIT_REPOSITORY }
 import { buildOutcome, JOB_PHASES } from './workflow.mjs';
 import { raceWaiters } from './removable-waiter.mjs';
 import { buildDirectSelectionTrace } from './model-routing.mjs';
+import { appendSessionOrigin } from './session-origins.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
@@ -123,7 +124,7 @@ export function startJob({
     throw new Error(`DEEPSEEK_API_KEY not found in env or ${join(CONFIG_DIR, '.env')}`);
   }
 
-  const harness = createStandaloneHarness({
+  const harness = createStandaloneHarness({
     profile: 'sdk-minimal',
     patches: [CORDIS],
     dshHome: CREW_DSH_HOME,
@@ -178,6 +179,10 @@ export function startJob({
     .catch(() => ({ kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace audit failed' }));
 
   const sessionId = id;
+  // Standalone dispatches write into the same shared session store as the hub,
+  // so they need the same provenance record or a Crew-scoped cleanup would leave
+  // them behind.
+  appendSessionOrigin({ sessionId, role, jobId: id });
   const onNotification = (n) => {
     if (n.method === 'session.status') return;
     if (n.method !== 'session.event') return;

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.3.1';
+export const RUNTIME_VERSION = '1.4.0';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/session-origins.mjs

@@ -0,0 +1,60 @@
+// Durable provenance for sessions the Crew hub created.
+//
+// Cleanup needs to tell a session Crew dispatched apart from one the operator
+// opened in the same UI, because they are otherwise identical: both are ordinary
+// Harness sessions in one shared store, with the same header shape (no field
+// records who asked for them). Provenance has to be recorded at the moment of
+// creation, which only the hub knows.
+//
+// This is deliberately an append-only JSONL file rather than a rewrite of the
+// status shards: a shard removes itself on clean process exit, so it is a
+// best-effort view of live writers, not a record of what was ever created.
+//
+// Absence is not proof of user authorship — a session predating this ledger, or
+// one whose line was lost, simply stays unclaimed. Unclaimed sessions are treated
+// as the operator's and are never removed by a Crew-scoped cleanup.
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+export function sessionOriginsFile({ home = homedir() } = {}) {
+  return join(home, '.config', 'dsh-crew', 'session-origins.jsonl');
+}
+
+/**
+ * Record that Crew created one session. Best effort: losing a line weakens a
+ * later cleanup's scope, so it must never fail a dispatch that already started.
+ */
+export function appendSessionOrigin({ home = homedir(), sessionId, role = null, jobId = null, now = Date.now } = {}) {
+  if (typeof sessionId !== 'string' || !sessionId) return false;
+  try {
+    const file = sessionOriginsFile({ home });
+    mkdirSync(dirname(file), { recursive: true });
+    appendFileSync(file, `${JSON.stringify({ sessionId, role, jobId, createdAt: now() })}\n`);
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Session ids Crew is known to have created.
+ *
+ * A malformed or truncated line is skipped rather than thrown: the ledger is an
+ * optimization for scope, and a damaged tail must not make cleanup unusable. The
+ * failure direction is safe — an unread session is treated as the operator's.
+ */
+export function readSessionOrigins({ home = homedir() } = {}) {
+  const file = sessionOriginsFile({ home });
+  if (!existsSync(file)) return new Set();
+  try {
+    const ids = new Set();
+    for (const line of readFileSync(file, 'utf8').split('\n')) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const row = JSON.parse(trimmed);
+        if (typeof row?.sessionId === 'string' && row.sessionId) ids.add(row.sessionId);
+      } catch { /* skip a torn line */ }
+    }
+    return ids;
+  } catch { return new Set(); }
+}