@ran-sh/dsh-crew 1.3.2 → 1.5.0

package/src/client/index.tsx

@@ -18,6 +18,11 @@ import { CREW_UI_SURFACES, classifyCrewSurface, surfaceResponsibilities } from '
 import { aggregateModelInvocations } from './task-telemetry.mjs';
 import { PanelHeader, PanelStyles } from './panel-chrome';
 import { HistoryPanel } from './history-panel';
+// The schedule contract is shared, not mirrored: model-schedule.mjs imports
+// nothing, so the panel can use the same normalization and peak test the router
+// does. A hand-maintained copy could accept less than the server and then write
+// the difference back on save.
+import { normalizeModelSchedule, isPeakAt } from '../model-schedule.mjs';
 
 export const inject = ['slots', 'locale'];
 
@@ -42,6 +47,7 @@ function normalizeAdaptive(value: any): AdaptiveConfig {
   };
 }
 
+
 const COPY = {
   zh: {
     label: 'DSH Crew',
@@ -57,7 +63,7 @@ const COPY = {
     expandAll: '全部展开', collapseAll: '全部折叠',
     modelCount: (count: number) => `${count} 个模型`, providerCount: (count: number) => `${count} 个 Provider`,
     jobCount: (count: number) => `${count} 个任务`, runningCount: (count: number) => `${count} 个运行中`,
-    sectionNames: { integrations: 'Codex / Claude / ZCode 集成状态', workflow: 'Crew 工作流设置', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: '模型优先级与派发', adaptive: '自适应路由', runtime: '运行 / 生效边界', multimodal: '视觉与生图', harnessProviders: 'Harness Providers', providers: '多模态适配器', jobs: '任务状态' },
+    sectionNames: { integrations: 'Codex / Claude / ZCode 集成状态', workflow: 'Crew 工作流设置', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: '模型优先级与派发', schedule: '波峰波谷调度', adaptive: '自适应路由', runtime: '运行 / 生效边界', multimodal: '视觉与生图', harnessProviders: 'Harness Providers', providers: '多模态适配器', jobs: '任务状态' },
     harnessHint: 'DeepSeek 官方 Harness 的 dsh-crew profile：Provider、Harness Models 与运行时配置',
     hostReadiness: '宿主集成就绪度', hostReadinessHint: '只使用结构化安装与运行时证据；缺少证据不会显示 READY。',
     readinessLabels: { codex_mcp: 'Codex MCP', ds_worker: 'ds-worker', ds_reviewer: 'ds-reviewer', claude_plugin: 'Claude plugin', zcode_mcp: 'ZCode MCP', crew_harness: 'Crew plugin profile', official_bridge: 'Official bridge' },
@@ -163,8 +169,14 @@ const COPY = {
     save: '保存', saved: '已保存', jobs: 'Worker 任务', empty: '当前没有 Worker / Reviewer 任务。',
     adaptiveTitle: '自适应模型路由（实验）', adaptiveHint: '默认关闭；只重排系统自动候选，手动模型优先级始终保持原序。健康信号仅来自本进程已观察到的成功、失败、超时与粗粒度延迟，重启后清空。',
     adaptiveEnabled: '启用自适应路由', adaptiveWindow: '健康窗口', adaptiveSamples: '最少样本', adaptiveBoundary: '下一个工作流生效',
-    modelActivity: '模型活动概览', modelActivityHint: '聚合本 Hub 内存中最近 500 个含真实调用证据的任务；每个模型按任务计数（不是推测底层轮次），最多显示 50 个模型。不保存提示词、结果或凭据。', noModelActivity: '还没有真实模型活动。',
-    calls: '任务数', invocationSource: '任务来源', routingSource: '路由来源', lastCalled: '最近调用', role: '角色', model: '模型', never: '—',
+    scheduleTitle: '波峰波谷调度', scheduleHint: '按本地时间限制指定模型：波峰时被“阻止”的模型会被跳过，由下一个候选接替任务；“提醒”的仍会使用并在选择轨迹中标记。未列出的模型不受限制。默认时段为 DeepSeek 公布的波峰时间（工作日 09:00-12:00、14:00-18:00）。',
+    scheduleTimezone: '时区（相对 UTC）', scheduleWindows: '波峰时段', schedulePeak: '现在处于波峰', scheduleOffPeak: '现在处于波谷',
+    scheduleAddWindow: '添加时段', scheduleStart: '开始', scheduleEnd: '结束',
+    scheduleBlock: '阻止', scheduleWarn: '提醒', scheduleOff: '关闭',
+    scheduleRestricted: '受限模型', scheduleNoRestricted: '还没有受限模型；未列出的模型不受时间限制。',
+    scheduleWeekdays: '生效工作日', scheduleBoundary: '下次派发生效',
+    modelActivity: '模型活动概览', modelActivityHint: '聚合本 Hub 内存中最近 500 个含真实调用证据的任务；每个模型按任务计数（不是推测底层轮次），最多显示 50 个模型。不保存提示词、结果或凭据。', noModelActivity: '还没有真实模型活动。',
+    calls: '任务数', invocationSource: '任务来源', routingSource: '路由来源', lastCalled: '最近调用', role: '角色', model: '模型', never: '—',
     col: { id: '任务', role: '角色', source: '来源', model: '模型', tier: '档位', status: '状态', progress: '进度', tokens: 'tokens ⇅', task: '内容' },
     working: '处理中…',
     tips: {
@@ -199,7 +211,7 @@ const COPY = {
     expandAll: 'Expand all', collapseAll: 'Collapse all',
     modelCount: (count: number) => `${count} models`, providerCount: (count: number) => `${count} providers`,
     jobCount: (count: number) => `${count} jobs`, runningCount: (count: number) => `${count} running`,
-    sectionNames: { integrations: 'Codex / Claude / ZCode integration status', workflow: 'Crew workflow settings', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: 'Model priority & dispatch', adaptive: 'Adaptive routing', runtime: 'Runtime / activation boundaries', multimodal: 'Vision & image generation', harnessProviders: 'Harness Providers', providers: 'Multimodal adapters', jobs: 'Task status' },
+    sectionNames: { integrations: 'Codex / Claude / ZCode integration status', workflow: 'Crew workflow settings', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: 'Model priority & dispatch', schedule: 'Peak / off-peak scheduling', adaptive: 'Adaptive routing', runtime: 'Runtime / activation boundaries', multimodal: 'Vision & image generation', harnessProviders: 'Harness Providers', providers: 'Multimodal adapters', jobs: 'Task status' },
     harnessHint: 'The official DeepSeek Harness dsh-crew profile: providers, Harness Models, and runtime configuration',
     hostReadiness: 'Host integration readiness', hostReadinessHint: 'Uses structured installer and runtime evidence only; missing evidence is never READY.',
     readinessLabels: { codex_mcp: 'Codex MCP', ds_worker: 'ds-worker', ds_reviewer: 'ds-reviewer', claude_plugin: 'Claude plugin', zcode_mcp: 'ZCode MCP', crew_harness: 'Crew plugin profile', official_bridge: 'Official bridge' },
@@ -305,8 +317,14 @@ const COPY = {
     save: 'Save', saved: 'Saved', jobs: 'Worker jobs', empty: 'No Worker / Reviewer jobs yet.',
     adaptiveTitle: 'Adaptive model routing (experimental)', adaptiveHint: 'Off by default. Only system-derived candidates may be reordered; explicit model priorities always keep their order. Health uses only process-local success, failure, timeout, and coarse latency observations and resets on restart.',
     adaptiveEnabled: 'Enable adaptive routing', adaptiveWindow: 'Health window', adaptiveSamples: 'Minimum samples', adaptiveBoundary: 'Effective for the next workflow',
-    modelActivity: 'Model activity overview', modelActivityHint: 'Aggregates the latest 500 in-memory Hub jobs with real model-activity evidence; each model is counted once per qualifying job (not an inferred turn count). Shows at most 50 models; prompts, results, and credentials are never stored here.', noModelActivity: 'No real model activity yet.',
-    calls: 'Jobs', invocationSource: 'Task source', routingSource: 'Routing source', lastCalled: 'Last called', role: 'Role', model: 'Model', never: '—',
+    scheduleTitle: 'Peak / off-peak scheduling', scheduleHint: 'Restricts chosen models by local wall clock. During peak, a "block" model is skipped and the next candidate serves the job; a "warn" model is still used and flagged in the selection trace. Models not listed are unrestricted. Defaults are DeepSeek\'s published peak hours (weekdays 09:00-12:00 and 14:00-18:00).',
+    scheduleTimezone: 'Timezone (relative to UTC)', scheduleWindows: 'Peak windows', schedulePeak: 'Peak hours now', scheduleOffPeak: 'Off-peak now',
+    scheduleAddWindow: 'Add window', scheduleStart: 'Start', scheduleEnd: 'End',
+    scheduleBlock: 'Block', scheduleWarn: 'Warn', scheduleOff: 'Off',
+    scheduleRestricted: 'Restricted models', scheduleNoRestricted: 'No restricted models yet; unlisted models have no time limit.',
+    scheduleWeekdays: 'Days the windows apply', scheduleBoundary: 'Effective for the next dispatch',
+    modelActivity: 'Model activity overview', modelActivityHint: 'Aggregates the latest 500 in-memory Hub jobs with real model-activity evidence; each model is counted once per qualifying job (not an inferred turn count). Shows at most 50 models; prompts, results, and credentials are never stored here.', noModelActivity: 'No real model activity yet.',
+    calls: 'Jobs', invocationSource: 'Task source', routingSource: 'Routing source', lastCalled: 'Last called', role: 'Role', model: 'Model', never: '—',
     col: { id: 'job', role: 'role', source: 'source', model: 'model', tier: 'tier', status: 'status', progress: 'progress', tokens: 'tokens ⇅', task: 'task' },
     working: 'Working…',
     tips: {
@@ -1121,6 +1139,59 @@ function WorkersPanel({ ctx }: { ctx: any }) {
     const { next, ordering } = setAdaptiveLocal(candidate);
     void applyPatch({ worker: { model_policy: { adaptive: next, ordering } } });
   };
+  // ---- per-model peak/off-peak scheduling ----
+  // The schedule replaces as a whole (windows and model modes only mean anything
+  // together), so every edit saves the complete object.
+  const schedule = normalizeModelSchedule(config?.model_schedule);
+  const saveSchedule = (candidate: any) => {
+    const next = normalizeModelSchedule(candidate);
+    setConfig((current: any) => ({ ...current, model_schedule: next }));
+    void applyPatch({ model_schedule: next });
+  };
+  const schedulePeakNow = isPeakAt(schedule);
+  const scheduleModeOf = (ref: any) => schedule.models.find(
+    (entry: any) => entry.provider === ref.provider && entry.model === ref.model,
+  )?.mode ?? 'off';
+  const setScheduleMode = (ref: any, mode: string) => {
+    const others = schedule.models.filter(
+      (entry: any) => !(entry.provider === ref.provider && entry.model === ref.model),
+    );
+    saveSchedule({ ...schedule, models: mode === 'off' ? others : [...others, { ...ref, mode }] });
+  };
+  // Every model the router can actually select, not just what the flat tier
+  // mirrors happen to expose. The Pro mirror collapses worker-escalation and
+  // reviewer priority into one list — it shows whichever is set and hides the
+  // other — so a reviewer-only model would be routable yet impossible to
+  // restrict. Harness Default and the catalog are included for the same reason:
+  // routing can land on a model that is in no priority list at all.
+  const scheduleModelRefs = (() => {
+    const seen = new Map<string, any>();
+    const add = (ref: any) => {
+      if (ref?.provider && ref?.model) seen.set(`${ref.provider}\0${ref.model}`, { provider: ref.provider, model: ref.model });
+    };
+    for (const ref of config?.flash_model_priority ?? []) add(ref);
+    for (const ref of config?.pro_model_priority ?? []) add(ref);
+    for (const role of ['worker', 'review'] as const) {
+      const policy = config?.[role]?.model_policy;
+      for (const ref of policy?.priority ?? []) add(ref);
+      for (const ref of policy?.escalation_priority ?? []) add(ref);
+    }
+    add(modelCatalog?.harness_default);
+    for (const provider of modelCatalog?.providers ?? []) {
+      for (const model of provider?.models ?? []) add({ provider: provider.id, model: model?.id });
+    }
+    for (const entry of schedule.models) add(entry);
+    return [...seen.values()];
+  })();
+  const scheduleWeekdayNames = locale === 'zh'
+    ? ['日', '一', '二', '三', '四', '五', '六']
+    : ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+  const toggleScheduleWeekday = (day: number) => {
+    const days = schedule.weekdays.includes(day)
+      ? schedule.weekdays.filter((value: number) => value !== day)
+      : [...schedule.weekdays, day].sort((a: number, b: number) => a - b);
+    saveSchedule({ ...schedule, weekdays: days });
+  };
   const modelActivity = aggregateModelInvocations(jobs);
   const modelState = modelCallabilityState(readinessSnapshot?.model_callability, runtimeInfo);
   const currentSurfaceResponsibilities = surfaceResponsibilities(surface);
@@ -1466,6 +1537,87 @@ function WorkersPanel({ ctx }: { ctx: any }) {
           </>))}
         </CollapsibleSection>
 
+        <CollapsibleSection sectionId="schedule" title={copy.sectionNames.schedule}
+          summary={sectionSummary(schedulePeakNow ? copy.schedulePeak : copy.scheduleOffPeak,
+            `UTC${schedule.timezone_offset_minutes >= 0 ? '+' : '-'}${Math.abs(schedule.timezone_offset_minutes) / 60}`,
+            config?.model_schedule === undefined ? copy.scheduleOff : `${schedule.models.length} · ${copy.scheduleRestricted}`)}
+          expanded={!!expandedSections.schedule} onToggle={() => toggleSection('schedule')}>
+          {block({ t: copy.scheduleTitle, d: copy.scheduleHint }, (<>
+            <label style={S.field}><span style={S.fieldLabel}>{copy.scheduleTimezone}</span>
+              <CustomSelect value={String(schedule.timezone_offset_minutes)}
+                onChange={(v) => saveSchedule({ ...schedule, timezone_offset_minutes: Number(v) })}
+                options={(() => {
+                  // Real-world fixed offsets, not just whole hours: a stored
+                  // minute-level offset with no matching option would render as
+                  // a different value than it holds.
+                  const offsets = new Set<number>();
+                  for (let h = -14; h <= 14; h++) offsets.add(h * 60);
+                  for (const minutes of [330, 345, 570, -210, -570]) offsets.add(minutes);
+                  offsets.add(schedule.timezone_offset_minutes);
+                  return [...offsets].sort((a, b) => a - b).map((minutes) => ({
+                    value: String(minutes),
+                    label: `UTC${minutes >= 0 ? '+' : '-'}${Math.floor(Math.abs(minutes) / 60)}`
+                      + (Math.abs(minutes) % 60 ? `:${String(Math.abs(minutes) % 60).padStart(2, '0')}` : ''),
+                  }));
+                })()} /></label>
+            <div style={{ gridColumn: '1 / -1' }}>
+              <span style={{ ...S.fieldLabel, display: 'block', marginBottom: 5 }}>{copy.scheduleWeekdays}</span>
+              <div style={{ display: 'flex', gap: 5, flexWrap: 'wrap' }}>
+                {scheduleWeekdayNames.map((name: string, day: number) => (
+                  <button key={day} type="button"
+                    style={{ ...S.btn, padding: '3px 9px', opacity: schedule.weekdays.includes(day) ? 1 : 0.45 }}
+                    onClick={() => toggleScheduleWeekday(day)}>{name}</button>
+                ))}
+              </div>
+            </div>
+            <div style={{ gridColumn: '1 / -1' }}>
+              <span style={{ ...S.fieldLabel, display: 'block', marginBottom: 5 }}>{copy.scheduleWindows}</span>
+              <div style={{ display: 'flex', flexDirection: 'column' as const, gap: 6 }}>
+                {schedule.peak_windows.map((window: any, index: number) => (
+                  <div key={`${window.start}-${window.end}-${index}`} style={{ display: 'flex', gap: 6, alignItems: 'center' }}>
+                    <input type="time" value={window.start} style={S.input}
+                      onChange={(event) => {
+                        const next = schedule.peak_windows.map((row: any, i: number) => i === index ? { ...row, start: event.target.value } : row);
+                        saveSchedule({ ...schedule, peak_windows: next });
+                      }} />
+                    <span style={{ opacity: 0.6 }}>–</span>
+                    <input type="time" value={window.end} style={S.input}
+                      onChange={(event) => {
+                        const next = schedule.peak_windows.map((row: any, i: number) => i === index ? { ...row, end: event.target.value } : row);
+                        saveSchedule({ ...schedule, peak_windows: next });
+                      }} />
+                    <button type="button" style={{ ...S.btn, padding: '2px 8px' }}
+                      onClick={() => saveSchedule({ ...schedule, peak_windows: schedule.peak_windows.filter((_: any, i: number) => i !== index) })}>×</button>
+                  </div>
+                ))}
+                <button type="button" style={{ ...S.btn, alignSelf: 'flex-start' }}
+                  onClick={() => saveSchedule({ ...schedule, peak_windows: [...schedule.peak_windows, { start: '09:00', end: '12:00' }] })}>
+                  {copy.scheduleAddWindow}</button>
+              </div>
+            </div>
+            <div style={{ gridColumn: '1 / -1' }}>
+              <span style={{ ...S.fieldLabel, display: 'block', marginBottom: 5 }}>{copy.scheduleRestricted}</span>
+              {scheduleModelRefs.length === 0
+                ? <span style={{ fontSize: 11.5, opacity: 0.6 }}>{copy.scheduleNoRestricted}</span>
+                : <div style={{ display: 'flex', flexDirection: 'column' as const, gap: 5 }}>
+                    {scheduleModelRefs.map((ref: any) => (
+                      <div key={`${ref.provider}\0${ref.model}`} style={{ display: 'flex', gap: 8, alignItems: 'center', padding: '5px 8px', border: '1px solid rgba(128,128,128,0.2)', borderRadius: 6 }}>
+                        <span style={{ flex: 1, minWidth: 0, fontSize: 11, fontFamily: 'monospace', overflow: 'hidden', textOverflow: 'ellipsis' }}>{ref.provider} / {ref.model}</span>
+                        <CustomSelect value={scheduleModeOf(ref)}
+                          onChange={(v) => setScheduleMode(ref, v)}
+                          options={[
+                            { value: 'off', label: copy.scheduleOff },
+                            { value: 'warn', label: copy.scheduleWarn },
+                            { value: 'block', label: copy.scheduleBlock },
+                          ]} />
+                      </div>
+                    ))}
+                  </div>}
+              <span style={{ display: 'block', fontSize: 11, opacity: 0.55, marginTop: 5 }}>{copy.scheduleBoundary}</span>
+            </div>
+          </>))}
+        </CollapsibleSection>
+
         <CollapsibleSection sectionId="runtime" title={copy.sectionNames.runtime}
           summary={sectionSummary(config.mode, `${config.default_timeout_seconds}s`, config.hub_url)}
           expanded={!!expandedSections.runtime} onToggle={() => toggleSection('runtime')}>
@@ -1838,7 +1990,7 @@ function WorkersPanel({ ctx }: { ctx: any }) {
                   <div role="row" key={`${entry.provider}/${entry.model}`} style={{ display: 'grid', gridTemplateColumns: 'minmax(190px, 1.35fr) 72px minmax(170px, 1fr) 125px', gap: 10, alignItems: 'center', padding: '7px 6px', borderTop: '1px solid rgba(128,128,128,0.16)' }}>
                     <span role="cell" style={{ minWidth: 0 }}><strong style={{ display: 'block', fontSize: 12 }}>{entry.model}</strong><span style={{ ...S.mono, opacity: 0.55 }}>{entry.provider}</span></span>
                     <span role="cell" style={{ ...S.mono, fontSize: 15, fontWeight: 650 }}>{entry.count}</span>
-                    <span role="cell" style={{ minWidth: 0, fontSize: 11.5 }}><span style={{ display: 'block' }}>{entry.task_sources.map(sourceLabel).join(' · ')}</span><span style={{ display: 'block', opacity: 0.55 }}>{entry.selection_sources.join(' · ')} · {entry.roles.length > 0 ? entry.roles.join(' / ') : copy.never}</span></span>
+                    <span role="cell" style={{ minWidth: 0, fontSize: 11.5 }}><span style={{ display: 'block' }}>{entry.task_sources.map(sourceLabel).join(' · ')}</span><span style={{ display: 'block', opacity: 0.55 }}>{entry.selection_sources.join(' · ')} · {entry.roles.length > 0 ? entry.roles.join(' / ') : copy.never}</span></span>
                     <span role="cell" style={{ ...S.mono, fontSize: 10.5 }}>{formatTimestamp(entry.last_called_at, locale)}</span>
                   </div>
                 ))}

package/src/history/cleanup-plan.mjs

@@ -28,18 +28,42 @@ function records(values) {
   return [...values].sort((a, b) => a.id.localeCompare(b.id, 'en'));
 }
 
-/** Pure preview only. No filesystem or project-path operations are performed. */
-export function planHistoryCleanup(snapshot, { operation = 'archive', scope = 'all', before } = {}) {
-  if (!['archive', 'delete'].includes(operation) || !['all', 'before'].includes(scope)) throw new Error('HISTORY_INVALID_OPTIONS');
+/**
+ * Pure preview only. No filesystem or project-path operations are performed.
+ *
+ * `scope` defaults to `crew`: a caller that forgets to narrow the range gets the
+ * one range that cannot remove sessions the operator opened themselves. Widening
+ * to `all` is always an explicit choice.
+ */
+export function planHistoryCleanup(snapshot, { operation = 'archive', scope = 'crew', before } = {}) {
+  if (!['archive', 'delete'].includes(operation) || !['all', 'crew', 'worktree', 'before'].includes(scope)) throw new Error('HISTORY_INVALID_OPTIONS');
   const cutoff = scope === 'before' ? instant(before) : null;
   if (scope === 'before' && (typeof before !== 'string' || cutoff === null)) throw new Error('HISTORY_INVALID_CUTOFF');
   const workspaces = records(snapshot.workspaces);
   const sessions = records(snapshot.sessions);
   const active = ids(snapshot.activeSessionIds);
-  const selected = new Set(sessions.filter(row => scope === 'all' || (instant(row.createdAt) !== null && instant(row.createdAt) < cutoff)).map(row => row.id));
+  // `crew` and `worktree` narrow by provenance, never by project path: a session
+  // is Crew's own only when Crew recorded creating it, and worktree scope adds
+  // the isolated-workspace marker the hub stamps at dispatch.
+  const origin = new Set(Array.isArray(snapshot.crewSessionIds) ? snapshot.crewSessionIds : []);
+  const admitted = (row) => {
+    if (scope === 'crew') return origin.has(row.id);
+    if (scope === 'worktree') return origin.has(row.id) && row.worktree === true;
+    return true;
+  };
+  const withinTime = (row) => cutoff === null
+    || (instant(row.createdAt) !== null && instant(row.createdAt) < cutoff);
+  const selected = new Set(sessions.filter(row => admitted(row) && withinTime(row)).map(row => row.id));
+  // A workspace carries no provenance of its own: it follows its sessions, and
+  // only when every one of them is selected. Checking `admitted(row)` here would
+  // test a workspace id against a session ledger and always fail. A provenance
+  // scope additionally requires at least one selected child — an empty workspace
+  // holds no Crew work, so it is not Crew's to remove; `all` keeps its historical
+  // behaviour of following an empty workspace.
+  const requiresOwnedChild = scope === 'crew' || scope === 'worktree';
   const workspaceIds = workspaces.filter(row => {
     const children = ids(row.sessionIds);
-    return (scope === 'all' || (instant(row.createdAt) !== null && instant(row.createdAt) < cutoff))
+    return withinTime(row) && (!requiresOwnedChild || children.length > 0)
       && children.every(id => selected.has(id));
   }).map(row => row.id).sort();
   const sessionIds = [...selected].sort();
@@ -48,6 +72,7 @@ export function planHistoryCleanup(snapshot, { operation = 'archive', scope = 'a
     workspaces: workspaces.map(row => ({ id: row.id, createdAt: row.createdAt, updatedAt: row.updatedAt, sessionIds: ids(row.sessionIds) })),
     sessions: sessions.map(row => ({ id: row.id, createdAt: row.createdAt, revision: row.revision })),
     active,
+    crewSessionIds: [...origin].sort(),
   };
   return {
     schemaVersion: 1, operation, scope,

package/src/history/runner-detach.mjs

@@ -0,0 +1,34 @@
+// Detach the history maintenance runner from the hub's process tree.
+//
+// The runner must outlive the hub it is maintaining: its transaction stops 3210,
+// rewrites the session store while nothing holds it, then starts 3210 again. The
+// supervisor stops a service by killing that service's whole tracked process
+// tree, and the tree is walked through `ParentProcessId`. A runner spawned
+// directly by the hub is therefore inside the tree and is killed by the very stop
+// it requested, leaving the transaction stranded in STOPPING with a stale update
+// lock and no operator-side way to finish it.
+//
+// This launcher is the intermediate: it starts the runner, confirms the process
+// exists, and exits immediately. The runner's parent is then a process that no
+// longer exists, so the supervisor's tree walk cannot reach it and it survives.
+//
+// Usage: node runner-detach.mjs <runnerPath> [...runnerArgs]
+import { spawn } from 'node:child_process';
+
+const [runnerPath, ...runnerArgs] = process.argv.slice(2);
+if (!runnerPath) {
+  process.stderr.write('runner-detach: missing runner path\n');
+  process.exit(2);
+}
+
+const child = spawn(process.execPath, [runnerPath, ...runnerArgs], {
+  detached: true,
+  windowsHide: true,
+  stdio: 'ignore',
+  env: { ...process.env },
+});
+child.once('error', () => process.exit(1));
+child.once('spawn', () => {
+  child.unref();
+  process.exit(0);
+});

package/src/history/runtime.mjs

@@ -17,8 +17,15 @@ export function registerRuntimeHistory(ctx) {
     const service = createHistoryService({ crewRoot, agents: host.agents, persistence: host.sessionPersistence,
       runtimeId: runtime.runtime_id, launch(id, recover = false) {
         return new Promise((accept, reject) => {
-          const child = spawn(process.execPath, [fileURLToPath(new URL('./runner.mjs', import.meta.url)), id, ...(recover ? ['--recover'] : [])], {
-            detached: true, windowsHide: true, stdio: 'ignore', env: { ...process.env },
+          // Spawn through a launcher that exits immediately: a runner parented by
+          // this hub would sit inside the hub's tracked process tree and be killed
+          // by the stop it requested. See runner-detach.mjs.
+          const child = spawn(process.execPath, [
+            fileURLToPath(new URL('./runner-detach.mjs', import.meta.url)),
+            fileURLToPath(new URL('./runner.mjs', import.meta.url)),
+            id, ...(recover ? ['--recover'] : []),
+          ], {
+            windowsHide: true, stdio: 'ignore', env: { ...process.env },
           });
           child.once('error', reject); child.once('spawn', () => { child.unref(); accept(); });
         });

package/src/history/service.mjs

@@ -5,6 +5,8 @@ import { planHistoryCleanup } from './cleanup-plan.mjs';
 import { installHistoryAdmissionGate } from './admission-gate.mjs';
 import { historyHash, historyPath, readHistoryBytes, decodeWorkspaceStore, readHistoryManifest, isSessionArtifactPath } from './archive-store.mjs';
 import { readHistoryState, writeHistoryState, historyPending, publicHistoryState } from './state.mjs';
+import { readSessionOrigins } from '../session-origins.mjs';
+import { defaultWorktreeRoot } from '../workspace-isolation.mjs';
 
 export function createHistoryService({ crewRoot, agents, persistence, runtimeId, launch, now = Date.now }) {
   const gate = installHistoryAdmissionGate(agents, () => historyPending(crewRoot));
@@ -60,12 +62,21 @@ export function createHistoryService({ crewRoot, agents, persistence, runtimeId,
       }
       const raw = readHistoryBytes(historyPath(crewRoot, path)); total += raw.length;
       if (total > 512 * 1024 * 1024) throw Error('HISTORY_INVENTORY_TOO_LARGE');
-      return { id: header.id, createdAt: header.createdAt, parentSession: header.parentSession,
+      return { id: header.id, createdAt: header.createdAt, parentSession: header.parentSession, cwd: header.cwd,
         revision: JSON.stringify([header.revision, historyHash(raw)]), artifact: { sessionId: header.id, relativePath: path, sha256: historyHash(raw) } };
     });
     // A retained child keeps its ancestor chain; do not leave a newer fork orphaned.
     const workspaces = Object.entries(store.tables.workspaces).map(([id, row]) => ({ id, ...row }));
-    const plan = planHistoryCleanup({ workspaces, sessions, activeSessionIds: gate.idle() ? [] : ['active-agent'] }, options);
+    const crewSessionIds = [...readSessionOrigins()];
+    const crewSet = new Set(crewSessionIds);
+    for (const row of sessions) if (crewSet.has(row.id)) row.crew = true;
+    // The isolated-workspace marker: the hub stamps every worktree session with a
+    // cwd under the Crew worktree root, so that subset is scopeable on its own.
+    const worktreeRoot = defaultWorktreeRoot().replaceAll('\\', '/').toLowerCase();
+    for (const row of sessions) {
+      if (row.crew === true && typeof row.cwd === 'string' && row.cwd.replaceAll('\\', '/').toLowerCase().startsWith(worktreeRoot)) row.worktree = true;
+    }
+    const plan = planHistoryCleanup({ workspaces, sessions, crewSessionIds, activeSessionIds: gate.idle() ? [] : ['active-agent'] }, options);
     const selected = new Set(plan.sessionIds);
     const byId = new Map(sessions.map(row => [row.id, row]));
     const queue = sessions.filter(row => !selected.has(row.id));

package/src/hub/index.mjs

@@ -18,6 +18,7 @@ import {
   resolveRoleTierHint,
 } from '../policy.mjs';
 import { buildDirectSelectionTrace, resolveWorkerModel, resolveModel } from '../model-routing.mjs';
+import { scheduleAdmission } from '../model-schedule.mjs';
 import { readHarnessModelCatalog } from '../model-catalog.mjs';
 import { appendDeliveryInstructions, parseDeliveryReport, formatDeliveryMetadata } from '../delivery.mjs';
 import { captureWorkspaceBaseline, captureWorkspaceDiff, NOT_A_GIT_REPOSITORY } from '../workspace-audit.mjs';
@@ -101,6 +102,7 @@ function seedLangFromHost(ctx) {
 }
 
 import { setLang } from '../i18n.mjs';
+import { appendSessionOrigin } from '../session-origins.mjs';
 
 const ROUTE_BASE = '/_dsh/dsh-crew';
 // Quick-config allowlist: the ONLY config keys writable from the official
@@ -701,12 +703,48 @@ export class WorkerRegistry {  constructor(ctx) {
     const getCurrentSelection = () => this.ctx.get('agentDefaultModel')?.currentSelection?.();
     let selection;
     if (workerProviderMode === 'deepseek-official') {
+      // Strict mode names its model directly instead of walking a catalog, but a
+      // peak `block` must still apply: otherwise enabling the schedule would be
+      // silently ignored on every dispatch that uses this provider mode.
+      const strictRef = { provider: 'deepseek-official', model: legacyModel };
+      const strictAt = new Date();
+      const strictPeak = scheduleAdmission(cfg.model_schedule, strictRef, strictAt);
+      if (strictPeak?.mode === 'block') {
+        // Carry the same structured evidence the catalog path produces. The
+        // strict branch has no candidate list to fall through, so the trace is
+        // the operator's only record of why the dispatch died.
+        const blockedTrace = buildDirectSelectionTrace({
+          role: effRole,
+          logicalAttempt: attempt,
+          modelClassHint: effTier,
+          strategy: 'legacy-strict',
+          candidateSet: attempt > 0 ? 'escalation' : 'primary',
+          provider: strictRef.provider,
+          model: strictRef.model,
+          source: 'legacy-strict',
+        });
+        blockedTrace.ordered_candidates = [{
+          provider: strictRef.provider,
+          model: strictRef.model,
+          source: 'legacy-strict',
+          status: 'skipped',
+          reason_code: 'PEAK_RESTRICTED',
+        }];
+        blockedTrace.fallback_reason = 'PEAK_RESTRICTED';
+        throw Object.assign(new Error('MODEL_BLOCKED_PEAK'), {
+          policyCode: 'MODEL_BLOCKED_PEAK',
+          provider: strictRef.provider,
+          model: strictRef.model,
+          selection_trace: blockedTrace,
+        });
+      }
       selection = {
         ok: true,
         provider: 'deepseek-official',
         model: legacyModel,
         source: 'legacy-strict',
         reasoningEffort: effort,
+        ...(strictPeak?.mode === 'warn' ? { peak_advisory: true } : {}),
         selection_trace: buildDirectSelectionTrace({
           role: effRole,
           logicalAttempt: attempt,
@@ -716,6 +754,7 @@ export class WorkerRegistry {  constructor(ctx) {
           provider: 'deepseek-official',
           model: legacyModel,
           source: 'legacy-strict',
+          ...(strictPeak?.mode === 'warn' ? { peakAdvisory: true } : {}),
         }),
       };
     } else {
@@ -747,6 +786,7 @@ export class WorkerRegistry {  constructor(ctx) {
           healthGate: policy.health_gate ?? healthGate,
           allowFallback: cfg.allow_fallback !== false,
           tombstones: lifecycleState.tombstones,
+          schedule: cfg.model_schedule,
         });
       } else {
         selection = resolveWorkerModel({
@@ -760,6 +800,7 @@ export class WorkerRegistry {  constructor(ctx) {
           healthGate,
           allowFallback: cfg.allow_fallback !== false,
           tombstones: lifecycleState.tombstones,
+          schedule: cfg.model_schedule,
           traceContext: {
             role: effRole,
             logicalAttempt: attempt,
@@ -809,9 +850,17 @@ export class WorkerRegistry {  constructor(ctx) {
       isolatedWorkspace = { worktreePath: created.worktreePath, repoRoot: created.repoRoot };
     }
     const sessionId = `session-${randomUUID()}`;
+    // Record provenance while it is still knowable: a session header carries no
+    // field naming who asked for the session, so a later Crew-scoped cleanup can
+    // only tell Crew's own work apart from the operator's by this ledger.
+    appendSessionOrigin({ sessionId, role: jobRole, jobId: id });
     const job = {
       id, client_job_id: client_job_id ?? null, sessionId, role: jobRole, attempt, tier: effTier, provider: selection.provider, model: selection.model,
       selection_source: selection.source, selection_trace: selection.selection_trace ?? null,
+      // Routing already reports a peak `warn` as a top-level flag; carry it onto
+      // the job so a job consumer sees the same signal the router produced
+      // without having to re-derive it from the trace.
+      peak_advisory: selection.peak_advisory === true,
       effort, reasoning_effort: selection.reasoningEffort,
       task, source, cwd: executionCwd, requested_cwd: cwd,
       isolation: isolatedWorkspace ? 'worktree' : 'shared',
@@ -1530,6 +1579,9 @@ export async function apply(ctx) {
               healthGate: policy.health_gate ?? config.health_gate ?? config.worker?.model_policy?.health_gate,
               allowFallback: config.allow_fallback !== false,
               tombstones: lifecycleState.tombstones,
+              // A projection must reflect the decision dispatch would make, or
+              // the panel reports a model that routing would skip at peak.
+              schedule: config.model_schedule,
             });
           }
         }
@@ -1768,6 +1820,9 @@ export async function apply(ctx) {
                 healthGate,
                 allowFallback: config.allow_fallback !== false,
                 tombstones: lifecycleState.tombstones,
+                // Same reason as the extension projection: report what dispatch
+                // would actually pick.
+                schedule: config.model_schedule,
               });
               selections[tier] = selected.ok
                 ? { provider: selected.provider, model: selected.model, source: selected.source }

package/src/install/install-legacy.mjs

@@ -323,6 +323,14 @@ export const GLOBAL_CONFIG_DEFAULTS = {
   worker_state: undefined,
   review_state: undefined,
   auto_review: undefined,
+  // ---- per-model peak/off-peak scheduling ----
+  // Some providers price by wall clock (DeepSeek doubles its rate during peak
+  // hours). `models` lists only the restricted models — one absent from it is
+  // unrestricted — each at `warn` (selectable, flagged) or `block` (skipped, so
+  // the next candidate serves the job). Times are the operator's local wall
+  // clock at `timezone_offset_minutes`, defaulting to UTC+8 with DeepSeek's
+  // published peak hours expressed in it.
+  model_schedule: undefined,
 };
 
 export function mergeStoredGlobalConfig(stored) {

package/src/install/install.mjs

@@ -13,6 +13,7 @@ import { basename, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import * as legacy from './install-legacy.mjs';
 import { normalizeModelPriority } from '../model-routing.mjs';
+import { normalizeModelSchedule } from '../model-schedule.mjs';
 import { runtimeActivationMetadata } from '../runtime-controls.mjs';
 import {
   CONFIG_SCHEMA_VERSION,
@@ -93,12 +94,12 @@ function legacySnapshotFrom(config = {}) {
   };
 }
 
-function attachReadMetadata(config, { version, canonical }) {
-  return {
+function attachReadMetadata(config, { version, canonical }) {
+  return {
     ...config,
     config_schema_version: version,
-    config_authority: canonical ? 'canonical' : 'legacy-import',
-    config_migration_required: !canonical || version < CONFIG_SCHEMA_VERSION,
+    config_authority: canonical ? 'canonical' : 'legacy-import',
+    config_migration_required: !canonical || version < CONFIG_SCHEMA_VERSION,
     config_activation: runtimeActivationMetadata(),
   };
 }
@@ -210,6 +211,10 @@ function mergeCanonicalPatch(current, patch) {
     };
   }
   if (validObject(patch.legacy)) next.legacy = { ...next.legacy, ...patch.legacy };
+  // The peak/off-peak schedule replaces as a whole: its parts (windows, weekdays,
+  // offset, per-model modes) only make sense together, so a partial merge could
+  // pair one operator's windows with another's model list.
+  if (validObject(patch.model_schedule)) next.model_schedule = normalizeModelSchedule(patch.model_schedule);
 
   // v0.3 still has one provider-mode control. A direct canonical patch is
   // allowed, but it cannot manufacture separate worker/reviewer authorities.
@@ -397,10 +402,13 @@ export function writeGlobalConfig(patch, { configFile = GLOBAL_CONFIG_FILE } = {
     ? mergeLegacyPatchIntoCanonical(current, compatibilityView, candidate, patch)
     : { ...candidate, legacy: legacySnapshotFrom(candidate) };
 
+  // `model_schedule` is canonical-only (it has no flat mirror), so it must open
+  // the canonical merge path on its own rather than ride along with worker/review.
   const hasCanonicalPatch = validObject(patch?.worker)
     || validObject(patch?.review)
     || validObject(patch?.execution)
-    || validObject(patch?.legacy);
+    || validObject(patch?.legacy)
+    || validObject(patch?.model_schedule);
   if (hasCanonicalPatch) normalized = mergeCanonicalPatch(normalized, patch);
 
   if (!validObject(normalized.legacy)) normalized.legacy = legacySnapshotFrom(candidate);