@ran-sh/dsh-crew 1.5.0 → 1.6.0

package/src/release-in-use.mjs

@@ -0,0 +1,110 @@
+// Release liveness claims.
+//
+// A running Hub keeps executing the release it was started from, but it loads
+// several modules lazily with a cache-busting query (`import('...?t=' + Date.now())`)
+// so that a config edit is visible without a restart. Those lazy reads go to
+// disk every time, which means deleting the release under a live process breaks
+// it permanently: the routes that were already loaded keep working while
+// everything behind a lazy import answers 500.
+//
+// Release retention keeps only the newest few, and it protected the *current*
+// pointer — not the one a running process is actually executing. So a machine
+// could be left with a Hub whose config routes were dead, and an update would
+// not repair it because the damage is to the process, not the files.
+//
+// A process therefore records that it is using a release. Retention skips any
+// release with a live claim. Liveness is decided by the pid, not by the file, so
+// a process that dies without cleaning up cannot pin a release forever.
+
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const IN_USE_DIRNAME = 'in-use';
+
+export function releaseInUseDir({ home = homedir() } = {}) {
+  return join(home, '.config', 'dsh-crew', 'app', IN_USE_DIRNAME);
+}
+
+/** The release root that owns `moduleUrl`, or null when it is outside one. */
+export function releaseRootFor(moduleUrl) {
+  let path;
+  try { path = fileURLToPath(moduleUrl); } catch { return null; }
+  // <release>/src/<...> or <release>/src/hub/entry.mjs → walk up to the release root.
+  let dir = dirname(path);
+  for (let depth = 0; depth < 6; depth++) {
+    if (existsSync(join(dir, 'package.json'))) {
+      try {
+        const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+        if (pkg?.name === '@ran-sh/dsh-crew') return resolve(dir);
+      } catch { /* not the payload manifest; keep walking */ }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+function isAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error?.code === 'EPERM'; }
+}
+
+/**
+ * Record that this process is running `releasePath`. Best effort: failing to
+ * claim must never stop the Hub from starting, because the cost of a missed
+ * claim is a possible retention of one extra release.
+ */
+export function claimReleaseInUse({ moduleUrl = import.meta.url, releasePath, home = homedir(), pid = process.pid, now = Date.now() } = {}) {
+  try {
+    const target = releasePath ?? releaseRootFor(moduleUrl);
+    if (!target) return null;
+    const dir = releaseInUseDir({ home });
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, `${pid}.json`);
+    writeFileSync(file, JSON.stringify({ pid, release: resolve(target), claimed_at: now }) + '\n');
+    return file;
+  } catch { return null; }
+}
+
+export function releaseClaimFile({ home = homedir(), pid = process.pid } = {}) {
+  return join(releaseInUseDir({ home }), `${pid}.json`);
+}
+
+export function releaseClaimInUse({ home = homedir(), pid = process.pid } = {}) {
+  const file = releaseClaimFile({ home, pid });
+  return existsSync(file) || false;
+}
+
+export function clearReleaseClaim({ home = homedir(), pid = process.pid } = {}) {
+  try { rmSync(releaseClaimFile({ home, pid }), { force: true }); return true; } catch { return false; }
+}
+
+/**
+ * Releases currently held by a live process. Dead claims are removed as they are
+ * encountered, so the directory cannot accumulate stale files.
+ */
+export function liveReleaseClaims({ home = homedir(), alive = isAlive } = {}) {
+  const dir = releaseInUseDir({ home });
+  let names;
+  // A state directory that is unreadable — or replaced by a file — must read as
+  // "no claims" rather than throwing: this runs inside install, and failing it
+  // would block an update over a problem that only affects pruning.
+  try { names = readdirSync(dir); } catch { return []; }
+  const live = [];
+  for (const name of names) {
+    if (!name.endsWith('.json')) continue;
+    const file = join(dir, name);
+    let record;
+    try { record = JSON.parse(readFileSync(file, 'utf8')); } catch { record = null; }
+    if (record && Number.isInteger(record.pid) && typeof record.release === 'string' && alive(record.pid)) {
+      live.push(resolve(record.release));
+      continue;
+    }
+    try { rmSync(file, { force: true }); } catch { /* best effort */ }
+  }
+  return [...new Set(live)];
+}

package/src/runtime-controls.mjs

@@ -41,9 +41,6 @@ export const RUNTIME_SETTING_ACTIVATION = Object.freeze({
   pro_model_fallback: Object.freeze({ global: N, session: null }),
   adaptive_routing: Object.freeze({ global: N, session: null, note: 'Opt-in provider health ordering is read for the next Hub model selection; existing explicit priorities remain authoritative.' }),
   isolation: Object.freeze({ global: N, session: null }),
-  vision_provider: Object.freeze({ global: N, session: null }),
-  vision_model: Object.freeze({ global: N, session: null }),
-  imagegen_provider: Object.freeze({ global: N, session: null }),
 
   // These values are copied into the MCP session defaults at process startup.
   // dsh_worker_config can override them for subsequent workflows in that same
@@ -56,11 +53,8 @@ export const RUNTIME_SETTING_ACTIVATION = Object.freeze({
   preset_flash: Object.freeze({ global: S, session: N }),
   preset_pro: Object.freeze({ global: S, session: N }),
 
-  // hub-client freezes its base URL at module initialization. Crew Vision and
-  // Image Generation tool registration is also decided at Hub plugin boot.
+  // hub-client freezes its base URL at module initialization.
   hub_url: Object.freeze({ global: R, session: null }),
-  vision_enabled: Object.freeze({ global: R, session: null }),
-  imagegen_enabled: Object.freeze({ global: R, session: null }),
 });
 
 export function activationForSetting(key) {

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.5.0';
+export const RUNTIME_VERSION = '1.6.0';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/server.mjs

@@ -305,10 +305,9 @@ const SAFE_GLOBAL_KEYS = [
   'default_tier', 'default_effort', 'mode', 'default_timeout_seconds', 'hub_url',
   'tier_policy', 'escalate_on_failure', 'subagents_enabled', 'collaboration_mode',
   'main_agent_mode', 'flash_state', 'pro_state', 'flash_roles', 'pro_roles',
-  'pro_reviews_flash', 'worker_provider_mode', 'vision_enabled', 'imagegen_enabled',
+  'pro_reviews_flash', 'worker_provider_mode',
   'flash_model_priority', 'flash_model_priority_configured', 'flash_model_fallback',
   'pro_model_priority', 'pro_model_priority_configured', 'pro_model_fallback',
-  'vision_provider', 'vision_model', 'imagegen_provider',
   'preset_flash', 'preset_pro',
 ];
 

package/src/image-output.mjs

@@ -1,71 +0,0 @@
-import { mkdtempSync, mkdirSync, lstatSync, openSync, readSync, closeSync, renameSync, rmSync } from 'node:fs';
-import { basename, dirname, isAbsolute, join } from 'node:path';
-
-export async function downloadImageBytes(url, { fetchImpl = globalThis.fetch, timeoutMs = 60_000, maxBytes = 64 * 1024 * 1024 } = {}) {
-  if (!['http:', 'https:'].includes(new URL(url).protocol)) throw new Error('unsupported image URL protocol');
-  const controller = new AbortController();
-  let reader;
-  let timer;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(() => {
-      controller.abort();
-      reject(new Error('image download timed out'));
-    }, timeoutMs);
-  });
-  const download = async () => {
-    const response = await fetchImpl(url, { signal: controller.signal });
-    controller.signal.throwIfAborted();
-    if (!response.ok) throw new Error(`image download failed: HTTP ${response.status}`);
-    if (Number(response.headers.get('content-length')) > maxBytes) throw new Error('image download exceeds size limit');
-    if (!response.body) throw new Error('image download has no body');
-    reader = response.body.getReader();
-    const chunks = [];
-    let bytes = 0;
-    while (true) {
-      const { done, value } = await reader.read();
-      controller.signal.throwIfAborted();
-      if (done) break;
-      bytes += value.byteLength;
-      if (bytes > maxBytes) throw new Error('image download exceeds size limit');
-      chunks.push(Buffer.from(value));
-    }
-    return Buffer.concat(chunks, bytes);
-  };
-  try { return await Promise.race([download(), timeout]); }
-  finally {
-    clearTimeout(timer);
-    controller.abort();
-    if (reader) void reader.cancel().catch(() => {});
-  }
-}
-
-function validateImage(file) {
-  const info = lstatSync(file);
-  if (!info.isFile() || info.size === 0 || info.size > 64 * 1024 * 1024) throw new Error('generated image has invalid type or size');
-  const head = Buffer.alloc(32);
-  const fd = openSync(file, 'r');
-  let length;
-  try { length = readSync(fd, head, 0, head.length, 0); } finally { closeSync(fd); }
-  const bytes = head.subarray(0, length);
-  const png = bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
-  const jpeg = bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
-  const gif = ['GIF87a', 'GIF89a'].includes(bytes.subarray(0, 6).toString('ascii'));
-  const webp = bytes.subarray(0, 4).toString('ascii') === 'RIFF' && bytes.subarray(8, 12).toString('ascii') === 'WEBP';
-  if (!png && !jpeg && !gif && !webp) throw new Error('generated output does not have a supported image signature');
-}
-
-/** Stage each request separately; an existing destination never proves success. */
-export async function withGeneratedImageOutput(outputPath, generate) {
-  if (!isAbsolute(outputPath)) throw new Error('output_path must be absolute');
-  mkdirSync(dirname(outputPath), { recursive: true });
-  const stage = mkdtempSync(join(dirname(outputPath), '.dsh-image-'));
-  const stagedFile = join(stage, basename(outputPath));
-  try {
-    await generate(stagedFile);
-    validateImage(stagedFile);
-    renameSync(stagedFile, outputPath);
-    return outputPath;
-  } finally {
-    rmSync(stage, { recursive: true, force: true });
-  }
-}

package/src/vision-route.mjs

@@ -1,138 +0,0 @@
-// Vision route: lets users paste images into DSH conversations on the
-// text-only DeepSeek models.
-//
-// Two cooperating pieces:
-// 1. A duck-typed LLM adapter registered as provider "deepseek-vision" that
-//    advertises image input modality (passing the api-proxy admission gate)
-//    and delegates every stream straight back to "deepseek-official".
-//    registerAdapter does no instanceof check, so a plain object keeps the
-//    zero-@deepseek-imports realm discipline.
-// 2. A global agent/pre-step waterfall that appends a text transcription (via
-//    the multimodal describeFile pipeline) after each ImageBlock. The image
-//    block itself stays in history so the conversation still shows the picture;
-//    the adapter above drops image blocks on the way to the model, which is
-//    what keeps the DeepSeek serializer (it throws on any image block) happy.
-
-import { writeFileSync, mkdirSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-import { createHash } from 'node:crypto';
-import { describeFile } from './multimodal.mjs';
-import { tr } from './i18n.mjs';
-
-const VISION_PROVIDER = 'deepseek-vision';
-const DELEGATE = 'deepseek-official';
-const ATTACH_DIR = join(homedir(), '.config', 'dsh-crew', 'attachments');
-
-const EXT = { 'image/png': 'png', 'image/jpeg': 'jpg', 'image/webp': 'webp', 'image/gif': 'gif' };
-
-const TRANSCRIPT_PREFIX = (name) => tr(`[图片「${name}」已由视觉桥转写]`, `[Image "${name}" transcribed by the vision bridge]`);
-// Both locales' prefixes must be recognised: the user may switch language after
-// a transcription was written, and re-transcribing would duplicate it.
-const TRANSCRIPT_MARKERS = ['[图片「', '[Image "'];
-
-/** True when `block` is a transcription this route wrote for `imageBlock`. */
-function isTranscriptFor(block, imageBlock) {
-  if (block?.type !== 'text' || typeof block.text !== 'string') return false;
-  const name = imageBlock?.attachment?.name;
-  if (name && (block.text.startsWith(`[图片「${name}」`) || block.text.startsWith(`[Image "${name}"`))) return true;
-  return TRANSCRIPT_MARKERS.some((m) => block.text.startsWith(m));
-}
-
-/**
- * Images live on in history for the UI, but never reach the model: the
- * transcription that follows each one already carries the content, so the image
- * block is dropped rather than replaced with a placeholder.
- */
-function stripImages(content) {
-  if (!Array.isArray(content)) return content;
-  if (!content.some((b) => b?.type === 'image')) return content;
-  const out = content.filter((b) => b?.type !== 'image');
-  return out.length > 0 ? out : [{ type: 'text', text: tr('[图片已由视觉桥转写，详见随后的描述]', '[image transcribed by the vision bridge — see the description that follows]') }];
-}
-
-export function installVisionRoute(ctx, getConfig) {
-  const llm = ctx.llm;
-  const disposers = [];
-
-  const adapter = {
-    providerInfo: (p) => ({ id: p, name: tr('DeepSeek (视觉)', 'DeepSeek (Vision)') }),
-    providerRetryPolicy: () => undefined,
-    async listModels(p) {
-      const models = await llm.listModels(DELEGATE);
-      return models.map((m) => ({ ...m, provider: p, name: `${m.name} ◉`, inputModalities: ['text', 'image'] }));
-    },
-    async resolveModel(p, model, signal) {
-      const base = await llm.resolveModelInfo(DELEGATE, model, signal);
-      return { ...base, provider: p, name: `${base.name} ◉`, inputModalities: ['text', 'image'] };
-    },
-    async *stream(options) {
-      // Safety net: any image block that survived pre-step would make the
-      // DeepSeek serializer throw — strip defensively.
-      // NOTE: routing reads top-level options.provider (adapterStream uses
-      // this.registration(options.provider)); rewriting anything else
-      // self-recurses into this adapter.
-      const messages = options.messages?.map((m) => ({ ...m, content: stripImages(m.content) })) ?? options.messages;
-      yield* llm.stream({ ...options, provider: DELEGATE, ...(messages === undefined ? {} : { messages }) });
-    },
-  };
-  const handle = llm.registerAdapter([VISION_PROVIDER], adapter);
-  disposers.push(() => handle());
-
-  // Transcribe pending images before the step enters history. Applies to every
-  // agent in this host: on a DS-only deployment any surviving image block is a
-  // hard error downstream, so rewriting is strictly better than crashing.
-  disposers.push(ctx.on('agent/pre-step', async (payload, next) => {
-    const decision = await next();
-    if (decision.kind !== 'enter') return decision;
-    if (getConfig().vision_provider === 'off') return decision;
-    let changed = false;
-    const rewritten = [];
-    for (const message of decision.messages) {
-      if (!Array.isArray(message.content) || !message.content.some((b) => b?.type === 'image')) {
-        rewritten.push(message);
-        continue;
-      }
-      const content = [];
-      for (const [i, block] of message.content.entries()) {
-        if (block?.type !== 'image') { content.push(block); continue; }
-        content.push(block); // keep the image so the conversation still shows it
-        // Steps replay the whole history: skip anything already transcribed,
-        // otherwise every step would append another copy.
-        if (isTranscriptFor(message.content[i + 1], block)) continue;
-        changed = true;
-        try {
-          const stored = await ctx.attachments.readImage(block.attachment, payload.signal);
-          const sha = createHash('sha256').update(stored.data).digest('hex').slice(0, 12);
-          const ext = EXT[block.attachment?.mediaType] ?? 'png';
-          mkdirSync(ATTACH_DIR, { recursive: true });
-          const path = join(ATTACH_DIR, `${sha}.${ext}`);
-          if (!existsSync(path)) writeFileSync(path, stored.data);
-          const name = block.attachment?.name ?? `${sha}.${ext}`;
-          const desc = await describeFile(getConfig, path, tr(
-            '详细描述这张图片：整体内容、布局结构、可见文字（逐字）、颜色与显著元素。',
-            'Describe this image in detail: overall content, layout, any visible text (verbatim), colours and notable elements.'));
-          content.push({
-            type: 'text',
-            text: `${TRANSCRIPT_PREFIX(name)}\n${desc}\n${tr(
-              `[原图: ${path} — 需要更多细节可用 describe_image 工具带具体问题查看]`,
-              `[Original: ${path} — for more detail, ask the describe_image tool a specific question]`)}`,
-          });
-        } catch (err) {
-          // Same prefix as a successful transcription so the dedup check above
-          // treats it as handled — otherwise a broken provider would append a
-          // fresh failure notice on every step.
-          content.push({
-            type: 'text',
-            text: `${TRANSCRIPT_PREFIX(block.attachment?.name ?? tr('图片', 'image'))}\n${tr(`[转写失败: ${err?.message ?? err}]`, `[transcription failed: ${err?.message ?? err}]`)}`,
-          });
-        }
-      }
-      rewritten.push({ ...message, content });
-    }
-    return changed ? { kind: 'enter', messages: rewritten } : decision;
-  }));
-
-  ctx.logger?.info?.('dsh-crew: vision route registered (provider "deepseek-vision" + pre-step transcription)');
-  return () => { for (const d of disposers.reverse()) { try { d(); } catch {} } };
-}