@ran-sh/dsh-crew 1.4.0 → 1.5.1

package/src/install/install.mjs

@@ -13,6 +13,7 @@ import { basename, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import * as legacy from './install-legacy.mjs';
 import { normalizeModelPriority } from '../model-routing.mjs';
+import { normalizeModelSchedule } from '../model-schedule.mjs';
 import { runtimeActivationMetadata } from '../runtime-controls.mjs';
 import {
   CONFIG_SCHEMA_VERSION,
@@ -93,12 +94,12 @@ function legacySnapshotFrom(config = {}) {
   };
 }
 
-function attachReadMetadata(config, { version, canonical }) {
-  return {
+function attachReadMetadata(config, { version, canonical }) {
+  return {
     ...config,
     config_schema_version: version,
-    config_authority: canonical ? 'canonical' : 'legacy-import',
-    config_migration_required: !canonical || version < CONFIG_SCHEMA_VERSION,
+    config_authority: canonical ? 'canonical' : 'legacy-import',
+    config_migration_required: !canonical || version < CONFIG_SCHEMA_VERSION,
     config_activation: runtimeActivationMetadata(),
   };
 }
@@ -210,6 +211,10 @@ function mergeCanonicalPatch(current, patch) {
     };
   }
   if (validObject(patch.legacy)) next.legacy = { ...next.legacy, ...patch.legacy };
+  // The peak/off-peak schedule replaces as a whole: its parts (windows, weekdays,
+  // offset, per-model modes) only make sense together, so a partial merge could
+  // pair one operator's windows with another's model list.
+  if (validObject(patch.model_schedule)) next.model_schedule = normalizeModelSchedule(patch.model_schedule);
 
   // v0.3 still has one provider-mode control. A direct canonical patch is
   // allowed, but it cannot manufacture separate worker/reviewer authorities.
@@ -397,10 +402,13 @@ export function writeGlobalConfig(patch, { configFile = GLOBAL_CONFIG_FILE } = {
     ? mergeLegacyPatchIntoCanonical(current, compatibilityView, candidate, patch)
     : { ...candidate, legacy: legacySnapshotFrom(candidate) };
 
+  // `model_schedule` is canonical-only (it has no flat mirror), so it must open
+  // the canonical merge path on its own rather than ride along with worker/review.
   const hasCanonicalPatch = validObject(patch?.worker)
     || validObject(patch?.review)
     || validObject(patch?.execution)
-    || validObject(patch?.legacy);
+    || validObject(patch?.legacy)
+    || validObject(patch?.model_schedule);
   if (hasCanonicalPatch) normalized = mergeCanonicalPatch(normalized, patch);
 
   if (!validObject(normalized.legacy)) normalized.legacy = legacySnapshotFrom(candidate);

package/src/install/npx-lifecycle.mjs

@@ -42,6 +42,7 @@ import { homedir } from 'node:os';
 import * as realInstaller from './install.mjs';
 import { samePayloadContent, capturePayloadContent } from './payload-content.mjs';
 import { crewDshHome, crewProfileDir } from './install.mjs';
+import { liveReleaseClaims } from '../release-in-use.mjs';
 import { ensureCrewDshRuntime, ensureCrewPluginRegistration, removeCrewPluginRegistration, migrateCrewDshRuntime, installDshInto, restoreRetainedRuntime, crewDshRuntimeRoot, payloadDshVersion, TARGET_DSH_VERSION } from '../dsh-cli-runtime.mjs';
 import {
   ensureOfficialWebIntegration,
@@ -1085,9 +1086,15 @@ function gcOldReleases({ home, keep = KEEP_RELEASES, protect = null }) {
   const releasesDir = crewReleasesDir({ home });
   if (!existsSync(releasesDir)) return;
   const removed = [];
+  // A running Hub keeps executing the release it started from and re-reads
+  // several modules from disk on every request, so removing that release breaks
+  // those routes with no recovery but a restart. Protect what live processes
+  // claim, not just what the pointer names.
+  const claimed = liveReleaseClaims({ home }).map((dir) => resolve(dir));
+  const live = new Set([...(protect ? [resolve(protect)] : []), ...claimed]);
   const dirs = readdirSync(releasesDir)
     .map((name) => join(releasesDir, name))
-    .filter((dir) => (!pointer || dir !== pointer.path) && (!protect || dir !== protect));
+    .filter((dir) => (!pointer || dir !== pointer.path) && !live.has(resolve(dir)));
   const incomplete = [];
   const complete = [];
   for (const dir of dirs) {
@@ -3434,7 +3441,14 @@ export async function runNpxCli({
     else if (command === 'releases') result = await actions.releases({ args, log });
     else if (command === 'rollback') result = await actions.rollback({ version: args?.[0], args, log });
     else result = await actions[command]({ log });
-    return result?.ok === false ? 1 : 0;
+    // Surface why the command failed. Actions return a structured failure rather
+    // than throwing, so without this the CLI exits 1 having printed nothing —
+    // `dsh-crew rollback` with no version was a silent failure.
+    if (result?.ok === false) {
+      error(`dsh-crew ${command} failed: ${result.error ?? result.code ?? 'unknown error'}`);
+      return 1;
+    }
+    return 0;
   } catch (err) {
     error(`dsh-crew ${command} failed: ${err?.message ?? err}`);
     return 1;

package/src/jobs.mjs

@@ -19,7 +19,9 @@ import { captureWorkspaceBaseline, captureWorkspaceDiff, NOT_A_GIT_REPOSITORY }
 import { buildOutcome, JOB_PHASES } from './workflow.mjs';
 import { raceWaiters } from './removable-waiter.mjs';
 import { buildDirectSelectionTrace } from './model-routing.mjs';
+import { normalizeModelSchedule, scheduleAdmission } from './model-schedule.mjs';
 import { appendSessionOrigin } from './session-origins.mjs';
+import { readGlobalConfig } from './install/install.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
@@ -27,6 +29,13 @@ const CREW_DSH_HOME = join(homedir(), '.config', 'dsh-crew', 'harness');
 const STATUS_FILE = join(CONFIG_DIR, 'status.json');
 const CORDIS = join(ROOT, 'worker.cordis.yml');
 
+// Read the operator's schedule once per dispatch. An unreadable config must not
+// block a job: a missing or damaged file means no restriction, matching how the
+// router treats an absent schedule.
+function readModelSchedule() {
+  try { return normalizeModelSchedule(readGlobalConfig().model_schedule); } catch { return normalizeModelSchedule(undefined); }
+}
+
 export const TIERS = {
   flash: { model: 'deepseek-v4-flash', label: 'V4 Flash' },
   pro: { model: 'deepseek-v4-pro', label: 'V4 Pro' },
@@ -110,6 +119,14 @@ export function startJob({
 }) {
   const tierInfo = TIERS[tier];
   if (!tierInfo) throw new Error(`unknown tier "${tier}" (expected: ${Object.keys(TIERS).join(', ')})`);
+  // Standalone dispatch names its provider/model directly rather than walking a
+  // catalog, but a peak `block` still applies: without this the schedule would be
+  // silently ignored on every standalone job.
+  const standaloneRef = { provider: 'deepseek-official', model: tierInfo.model };
+  const standaloneAt = new Date();
+  if (scheduleAdmission(readModelSchedule(), standaloneRef, standaloneAt)?.mode === 'block') {
+    throw Object.assign(new Error('MODEL_BLOCKED_PEAK'), { policyCode: 'MODEL_BLOCKED_PEAK' });
+  }
   if (!ROLES[role]) throw new Error(`unknown role "${role}" (expected: ${Object.keys(ROLES).join(', ')})`);
   if (!['off', 'high', 'max'].includes(effort)) throw new Error(`unknown effort "${effort}" (expected: off, high, max)`);
   if (!existsSync(CORDIS)) throw new Error(`worker overlay not found at ${CORDIS}`);