@ran-sh/dsh-crew 1.9.0 → 1.10.0

package/src/hub-client.mjs

@@ -1,154 +1,154 @@
-// Client for the in-host workers-hub jobs API. When a DSH web instance with the
-// dsh-crew bundle is running, jobs run inside it (sessions visible in the
-// Web UI); otherwise the MCP server falls back to standalone runtimes.
-
-import { readGlobalConfig } from './install/install.mjs';
-import { evaluateHubHandshake, HUB_COMPATIBILITY_CODES } from './runtime-identity.mjs';
-import { buildReadinessMatrix } from './readiness-matrix.mjs';
-import { isBoundedMachineCode } from './structured-error-code.mjs';
-
-const BASE = (process.env.DSH_CREW_HUB ?? readGlobalConfig().hub_url).replace(/\/$/, '');
-const API = `${BASE}/_dsh/dsh-crew`;
-
-export const HUB_REQUEST_FAILED = 'HUB_REQUEST_FAILED';
-
-const EMPTY_STATUS = Object.freeze({
-  reachable: false,
-  compatible: false,
-  service: null,
-  runtime_version: null,
-  protocol_version: null,
-  capabilities: [],
-  missing_capabilities: [],
-  code: HUB_COMPATIBILITY_CODES.UNREACHABLE,
-});
-
-let lastProbe = { at: 0, base: null, status: EMPTY_STATUS };
-
-function withReadiness(status) {
-  return {
-    ...status,
-    readiness_matrix: buildReadinessMatrix({ hubCompatibility: status }),
-  };
-}
-
-function cacheStatus(status, base) {
-  const observed = withReadiness(status);
-  lastProbe = { at: Date.now(), base, status: observed };
-  return observed;
-}
-
-async function fetchJson(path, base = BASE) {
-  const api = `${String(base).replace(/\/$/, '')}/_dsh/dsh-crew`;
-  const res = await fetch(`${api}${path}`, { signal: AbortSignal.timeout(800) });
-  let body;
-  try { body = await res.json(); } catch { body = null; }
-  return { res, body };
-}
-
-/**
- * Probe reachability and compatibility as separate contracts.
- *
- * /ping is intentionally legacy-compatible and proves only that a dsh-crew Hub
- * is alive. /runtime is the v0.3 compatibility handshake. A legacy Hub that
- * lacks /runtime is therefore reachable-but-incompatible instead of looking
- * offline or being silently treated as current.
- */
-export async function hubStatus({ force = false, base = BASE } = {}) {
-  const normalizedBase = String(base).replace(/\/$/, '');
-  if (!force && lastProbe.base === normalizedBase && Date.now() - lastProbe.at < 10_000) return lastProbe.status;
-  try {
-    const ping = await fetchJson('/ping', normalizedBase);
-    if (!ping.res.ok) {
-      return cacheStatus({
-        ...EMPTY_STATUS,
-        reachable: true,
-        code: HUB_COMPATIBILITY_CODES.HTTP_ERROR,
-        http_status: ping.res.status,
-        endpoint: 'ping',
-      }, normalizedBase);
-    }
-    if (ping.body?.service !== 'dsh-crew-hub') {
-      return cacheStatus(evaluateHubHandshake(ping.body), normalizedBase);
-    }
-
-    const runtime = await fetchJson('/runtime', normalizedBase);
-    if (runtime.res.status === 404) {
-      return cacheStatus({
-        ...EMPTY_STATUS,
-        reachable: true,
-        service: 'dsh-crew-hub',
-        code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISSING,
-        endpoint: 'runtime',
-      }, normalizedBase);
-    }
-    if (!runtime.res.ok) {
-      return cacheStatus({
-        ...EMPTY_STATUS,
-        reachable: true,
-        service: 'dsh-crew-hub',
-        code: HUB_COMPATIBILITY_CODES.HTTP_ERROR,
-        http_status: runtime.res.status,
-        endpoint: 'runtime',
-      }, normalizedBase);
-    }
-    return cacheStatus(evaluateHubHandshake(runtime.body, { strictProduction: true }), normalizedBase);
-  } catch {
-    return cacheStatus(EMPTY_STATUS, normalizedBase);
-  }
-}
-
-export async function hubAvailable() {
-  return (await hubStatus()).compatible;
-}
-
-function structuredCode(body) {
-  if (isBoundedMachineCode(body?.code)) return body.code;
-  if (isBoundedMachineCode(body?.policyCode)) return body.policyCode;
-  return null;
-}
-
-/** Build a bounded Hub request error without copying arbitrary response fields. */
-export function hubRequestError(body, status) {
-  const err = new Error(body?.error ?? `hub request failed (${status})`);
-  err.code = structuredCode(body) ?? HUB_REQUEST_FAILED;
-  return err;
-}
-
-// Transport deadlines: every Hub call is bounded so a wedged local HTTP
-// exchange can never outlive the workflow timeout contract. Long polls get
-// their requested wait plus grace; spawn gets a wider bound because worktree
-// creation can clone sizeable repositories. The env override exists for
-// deterministic deadline tests; production defaults stay at 10s.
-const ENV_TIMEOUT_MS = Number(process.env.DSH_CREW_HUB_TIMEOUT_MS);
-const DEFAULT_TIMEOUT_MS = Number.isInteger(ENV_TIMEOUT_MS) && ENV_TIMEOUT_MS > 0 ? ENV_TIMEOUT_MS : 10_000;
-const SPAWN_TIMEOUT_MS = Math.max(DEFAULT_TIMEOUT_MS, 60_000);
-const LONG_POLL_GRACE_MS = 5_000;
-
-async function call(path, init, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
-  let res;
-  try {
-    res = await fetch(`${API}${path}`, { ...init, signal: AbortSignal.timeout(timeoutMs) });
-  } catch (err) {
-    if (err?.name === 'TimeoutError' || err?.name === 'AbortError') {
-      throw hubRequestError({ error: `hub request timed out after ${timeoutMs}ms` }, 0);
-    }
-    throw err;
-  }
-  const body = await res.json();
-  if (!res.ok || body.ok === false) throw hubRequestError(body, res.status);
-  return body;
-}
-
-export const hub = {
-  spawn: (spec) => call('/jobs', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(spec),
-  }, { timeoutMs: SPAWN_TIMEOUT_MS }).then((b) => b.job),
-  list: () => call('/jobs').then((b) => b.jobs),
-  get: (id, waitSeconds = 0) => call(`/jobs/${id}?wait=${waitSeconds}`, undefined, {
-    timeoutMs: waitSeconds > 0 ? (waitSeconds * 1000) + LONG_POLL_GRACE_MS : DEFAULT_TIMEOUT_MS,
-  }).then((b) => b.job),
-  cancel: (id) => call(`/jobs/${id}/cancel`, { method: 'POST' }).then((b) => b.job),
-};
+// Client for the in-host workers-hub jobs API. When a DSH web instance with the
+// dsh-crew bundle is running, jobs run inside it (sessions visible in the
+// Web UI); otherwise the MCP server falls back to standalone runtimes.
+
+import { readGlobalConfig } from './install/install.mjs';
+import { evaluateHubHandshake, HUB_COMPATIBILITY_CODES } from './runtime-identity.mjs';
+import { buildReadinessMatrix } from './readiness-matrix.mjs';
+import { isBoundedMachineCode } from './structured-error-code.mjs';
+
+const BASE = (process.env.DSH_CREW_HUB ?? readGlobalConfig().hub_url).replace(/\/$/, '');
+const API = `${BASE}/_dsh/dsh-crew`;
+
+export const HUB_REQUEST_FAILED = 'HUB_REQUEST_FAILED';
+
+const EMPTY_STATUS = Object.freeze({
+  reachable: false,
+  compatible: false,
+  service: null,
+  runtime_version: null,
+  protocol_version: null,
+  capabilities: [],
+  missing_capabilities: [],
+  code: HUB_COMPATIBILITY_CODES.UNREACHABLE,
+});
+
+let lastProbe = { at: 0, base: null, status: EMPTY_STATUS };
+
+function withReadiness(status) {
+  return {
+    ...status,
+    readiness_matrix: buildReadinessMatrix({ hubCompatibility: status }),
+  };
+}
+
+function cacheStatus(status, base) {
+  const observed = withReadiness(status);
+  lastProbe = { at: Date.now(), base, status: observed };
+  return observed;
+}
+
+async function fetchJson(path, base = BASE) {
+  const api = `${String(base).replace(/\/$/, '')}/_dsh/dsh-crew`;
+  const res = await fetch(`${api}${path}`, { signal: AbortSignal.timeout(800) });
+  let body;
+  try { body = await res.json(); } catch { body = null; }
+  return { res, body };
+}
+
+/**
+ * Probe reachability and compatibility as separate contracts.
+ *
+ * /ping is intentionally legacy-compatible and proves only that a dsh-crew Hub
+ * is alive. /runtime is the v0.3 compatibility handshake. A legacy Hub that
+ * lacks /runtime is therefore reachable-but-incompatible instead of looking
+ * offline or being silently treated as current.
+ */
+export async function hubStatus({ force = false, base = BASE } = {}) {
+  const normalizedBase = String(base).replace(/\/$/, '');
+  if (!force && lastProbe.base === normalizedBase && Date.now() - lastProbe.at < 10_000) return lastProbe.status;
+  try {
+    const ping = await fetchJson('/ping', normalizedBase);
+    if (!ping.res.ok) {
+      return cacheStatus({
+        ...EMPTY_STATUS,
+        reachable: true,
+        code: HUB_COMPATIBILITY_CODES.HTTP_ERROR,
+        http_status: ping.res.status,
+        endpoint: 'ping',
+      }, normalizedBase);
+    }
+    if (ping.body?.service !== 'dsh-crew-hub') {
+      return cacheStatus(evaluateHubHandshake(ping.body), normalizedBase);
+    }
+
+    const runtime = await fetchJson('/runtime', normalizedBase);
+    if (runtime.res.status === 404) {
+      return cacheStatus({
+        ...EMPTY_STATUS,
+        reachable: true,
+        service: 'dsh-crew-hub',
+        code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISSING,
+        endpoint: 'runtime',
+      }, normalizedBase);
+    }
+    if (!runtime.res.ok) {
+      return cacheStatus({
+        ...EMPTY_STATUS,
+        reachable: true,
+        service: 'dsh-crew-hub',
+        code: HUB_COMPATIBILITY_CODES.HTTP_ERROR,
+        http_status: runtime.res.status,
+        endpoint: 'runtime',
+      }, normalizedBase);
+    }
+    return cacheStatus(evaluateHubHandshake(runtime.body, { strictProduction: true }), normalizedBase);
+  } catch {
+    return cacheStatus(EMPTY_STATUS, normalizedBase);
+  }
+}
+
+export async function hubAvailable() {
+  return (await hubStatus()).compatible;
+}
+
+function structuredCode(body) {
+  if (isBoundedMachineCode(body?.code)) return body.code;
+  if (isBoundedMachineCode(body?.policyCode)) return body.policyCode;
+  return null;
+}
+
+/** Build a bounded Hub request error without copying arbitrary response fields. */
+export function hubRequestError(body, status) {
+  const err = new Error(body?.error ?? `hub request failed (${status})`);
+  err.code = structuredCode(body) ?? HUB_REQUEST_FAILED;
+  return err;
+}
+
+// Transport deadlines: every Hub call is bounded so a wedged local HTTP
+// exchange can never outlive the workflow timeout contract. Long polls get
+// their requested wait plus grace; spawn gets a wider bound because worktree
+// creation can clone sizeable repositories. The env override exists for
+// deterministic deadline tests; production defaults stay at 10s.
+const ENV_TIMEOUT_MS = Number(process.env.DSH_CREW_HUB_TIMEOUT_MS);
+const DEFAULT_TIMEOUT_MS = Number.isInteger(ENV_TIMEOUT_MS) && ENV_TIMEOUT_MS > 0 ? ENV_TIMEOUT_MS : 10_000;
+const SPAWN_TIMEOUT_MS = Math.max(DEFAULT_TIMEOUT_MS, 60_000);
+const LONG_POLL_GRACE_MS = 5_000;
+
+async function call(path, init, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  let res;
+  try {
+    res = await fetch(`${API}${path}`, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+  } catch (err) {
+    if (err?.name === 'TimeoutError' || err?.name === 'AbortError') {
+      throw hubRequestError({ error: `hub request timed out after ${timeoutMs}ms` }, 0);
+    }
+    throw err;
+  }
+  const body = await res.json();
+  if (!res.ok || body.ok === false) throw hubRequestError(body, res.status);
+  return body;
+}
+
+export const hub = {
+  spawn: (spec) => call('/jobs', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(spec),
+  }, { timeoutMs: SPAWN_TIMEOUT_MS }).then((b) => b.job),
+  list: () => call('/jobs').then((b) => b.jobs),
+  get: (id, waitSeconds = 0) => call(`/jobs/${id}?wait=${waitSeconds}`, undefined, {
+    timeoutMs: waitSeconds > 0 ? (waitSeconds * 1000) + LONG_POLL_GRACE_MS : DEFAULT_TIMEOUT_MS,
+  }).then((b) => b.job),
+  cancel: (id) => call(`/jobs/${id}/cancel`, { method: 'POST' }).then((b) => b.job),
+};

package/src/hub-compatibility.mjs

@@ -1,18 +1,18 @@
-// Pure execution-mode decision for the Hub compatibility contract.
-// Transport probing lives in hub-client.mjs; this module only decides whether
-// a session may use Hub, intentionally fall back, or must fail closed.
-
-import { HUB_COMPATIBILITY_CODES } from './runtime-identity.mjs';
-
-export function hubCompatibilityMessage(status = {}) {
-  const code = status.code ?? 'HUB_INCOMPATIBLE';
-  if (!status.reachable) return `DSH workers hub is not reachable (${code}).`;
-  const detail = status.missing_capabilities?.length
-    ? `; missing capabilities: ${status.missing_capabilities.join(', ')}`
-    : '';
-  return `DSH workers hub is reachable but incompatible (${code}${detail}). Update/restart the Hub plugin before using Hub execution.`;
-}
-
+// Pure execution-mode decision for the Hub compatibility contract.
+// Transport probing lives in hub-client.mjs; this module only decides whether
+// a session may use Hub, intentionally fall back, or must fail closed.
+
+import { HUB_COMPATIBILITY_CODES } from './runtime-identity.mjs';
+
+export function hubCompatibilityMessage(status = {}) {
+  const code = status.code ?? 'HUB_INCOMPATIBLE';
+  if (!status.reachable) return `DSH workers hub is not reachable (${code}).`;
+  const detail = status.missing_capabilities?.length
+    ? `; missing capabilities: ${status.missing_capabilities.join(', ')}`
+    : '';
+  return `DSH workers hub is reachable but incompatible (${code}${detail}). Update/restart the Hub plugin before using Hub execution.`;
+}
+
 export function resolveHubExecutionMode(requestedMode = 'auto', status = {}, { productionOnly = false } = {}) {
   if (requestedMode === 'standalone') {
     if (productionOnly) {
@@ -23,28 +23,28 @@ export function resolveHubExecutionMode(requestedMode = 'auto', status = {}, { p
       };
     }
     return { ok: true, mode: 'standalone', reason: 'explicit-standalone' };
-  }
-
-  if (status.compatible === true) {
-    return { ok: true, mode: 'hub', reason: 'compatible-hub' };
-  }
-
-  if (status.reachable === true) {
-    return {
-      ok: false,
-      code: status.code ?? 'HUB_INCOMPATIBLE',
-      error: hubCompatibilityMessage(status),
-      hub: status,
-    };
-  }
-
+  }
+
+  if (status.compatible === true) {
+    return { ok: true, mode: 'hub', reason: 'compatible-hub' };
+  }
+
+  if (status.reachable === true) {
+    return {
+      ok: false,
+      code: status.code ?? 'HUB_INCOMPATIBLE',
+      error: hubCompatibilityMessage(status),
+      hub: status,
+    };
+  }
+
   if (requestedMode === 'hub') {
-    return {
-      ok: false,
-      code: status.code ?? HUB_COMPATIBILITY_CODES.UNREACHABLE,
-      error: 'Session mode is "hub" but the DSH workers hub is not reachable.',
-      hub: status,
-    };
+    return {
+      ok: false,
+      code: status.code ?? HUB_COMPATIBILITY_CODES.UNREACHABLE,
+      error: 'Session mode is "hub" but the DSH workers hub is not reachable.',
+      hub: status,
+    };
   }
 
   if (productionOnly) {
@@ -57,9 +57,9 @@ export function resolveHubExecutionMode(requestedMode = 'auto', status = {}, { p
   }
 
   return {
-    ok: true,
-    mode: 'standalone',
-    reason: 'hub-unreachable-fallback',
-    hub: status,
-  };
-}
+    ok: true,
+    mode: 'standalone',
+    reason: 'hub-unreachable-fallback',
+    hub: status,
+  };
+}

package/src/i18n.mjs

@@ -1,19 +1,19 @@
-// Server-side locale for strings that reach the user: connectivity-test
-// reports, model-list labels and error messages.
-//
-// The panel owns the authoritative locale (DSH's setting may be absent, in
-// which case the browser decides), so it passes `lang` with every request and
-// the hub calls setLang(). The host's durable setting seeds the initial value
-// for paths with no request behind them, such as the pasted-image pre-step.
-
-let LANG = 'en';
-
-export function setLang(lang) {
-  if (lang === 'zh' || lang === 'en') LANG = lang;
-  return LANG;
-}
-
-export function getLang() { return LANG; }
-
-/** Pick the string for the active locale. Both branches are cheap literals. */
-export function tr(zh, en) { return LANG === 'zh' ? zh : en; }
+// Server-side locale for strings that reach the user: connectivity-test
+// reports, model-list labels and error messages.
+//
+// The panel owns the authoritative locale (DSH's setting may be absent, in
+// which case the browser decides), so it passes `lang` with every request and
+// the hub calls setLang(). The host's durable setting seeds the initial value
+// for paths with no request behind them, such as the pasted-image pre-step.
+
+let LANG = 'en';
+
+export function setLang(lang) {
+  if (lang === 'zh' || lang === 'en') LANG = lang;
+  return LANG;
+}
+
+export function getLang() { return LANG; }
+
+/** Pick the string for the active locale. Both branches are cheap literals. */
+export function tr(zh, en) { return LANG === 'zh' ? zh : en; }

package/src/information-flow.mjs

@@ -1,67 +1,67 @@
-// Bounded context builders for agent-to-agent hand-offs.
-//
-// Workers still receive the user's complete delegated task. Once a worker has
-// run, downstream agents receive only an objective plus structured evidence
-// and artifact references. They inspect the isolated workspace directly when
-// more detail is required; raw prose and whole patches are never re-embedded.
-
-function clip(value, limit) {
-  const text = String(value ?? '').trim();
-  if (text.length <= limit) return text;
-  return `${text.slice(0, limit)}\n[truncated: ${text.length - limit} characters omitted]`;
-}
-
-function list(values, { count = 40, itemLimit = 300 } = {}) {
-  if (!Array.isArray(values) || values.length === 0) return ['(none)'];
-  const selected = values.slice(0, count).map((value) => `- ${clip(value, itemLimit)}`);
-  if (values.length > count) selected.push(`- [truncated: ${values.length - count} additional items omitted]`);
-  return selected;
-}
-
-function tests(values) {
-  if (!Array.isArray(values) || values.length === 0) return ['(none reported)'];
-  return list(values.map((entry) => [entry?.status, entry?.command, entry?.summary].filter(Boolean).join(' — ')), {
-    count: 30,
-    itemLimit: 500,
-  });
-}
-
-/** Build the automatic-review context capsule. */
-export function buildReviewTask(task, view = {}, { strictness = 'standard' } = {}) {
-  const outcome = view?.outcome ?? {};
-  const candidate = view?.candidate ?? {};
-  const changedFiles = Array.isArray(candidate.changed_files) ? candidate.changed_files : [];
-  const parts = [
-    'You are the automatic reviewer of a completed worker implementation.',
-    'REVIEW ONLY: inspect the candidate and report findings. Do not modify files.',
-    ...(strictness === 'strict' ? [
-      'STRICT REVIEW: fail closed. Approve only when direct code and test evidence supports every material claim; treat missing evidence as needs changes.',
-    ] : []),
-    '',
-    'Objective:',
-    clip(task, 4000),
-    '',
-    'Worker outcome:',
-    `task_status=${outcome.task_status ?? 'unknown'} tests_status=${outcome.tests_status ?? 'unknown'} delivery=${outcome.delivery?.complete ? 'complete' : 'incomplete'}`,
-    '',
-    'Reported changes:',
-    ...list(outcome.changes),
-    '',
-    'Reported tests:',
-    ...tests(outcome.tests),
-    '',
-    'Reported risks:',
-    ...list(outcome.risks),
-    '',
-    'Candidate artifact:',
-    `base_revision=${candidate.base_revision ?? 'unknown'}`,
-    `fingerprint=${candidate.fingerprint ?? 'unknown'}`,
-    'changed_files:',
-    ...list(changedFiles, { count: 80, itemLimit: 500 }),
-    '',
-    'Inspect the candidate directly in the current isolated workspace. Use git diff against the base revision and open only the files needed for review. The worker\'s raw prose and full patch are intentionally not embedded in this hand-off.',
-    '',
-    'Report: 1) whether the implementation satisfies the objective, 2) concrete bugs/style/security risks, 3) suggested fixes. End with ## Review Findings / ## Evidence / ## Risks / ## Verdict (approved | needs changes | rejected).',
-  ];
-  return parts.join('\n');
-}
+// Bounded context builders for agent-to-agent hand-offs.
+//
+// Workers still receive the user's complete delegated task. Once a worker has
+// run, downstream agents receive only an objective plus structured evidence
+// and artifact references. They inspect the isolated workspace directly when
+// more detail is required; raw prose and whole patches are never re-embedded.
+
+function clip(value, limit) {
+  const text = String(value ?? '').trim();
+  if (text.length <= limit) return text;
+  return `${text.slice(0, limit)}\n[truncated: ${text.length - limit} characters omitted]`;
+}
+
+function list(values, { count = 40, itemLimit = 300 } = {}) {
+  if (!Array.isArray(values) || values.length === 0) return ['(none)'];
+  const selected = values.slice(0, count).map((value) => `- ${clip(value, itemLimit)}`);
+  if (values.length > count) selected.push(`- [truncated: ${values.length - count} additional items omitted]`);
+  return selected;
+}
+
+function tests(values) {
+  if (!Array.isArray(values) || values.length === 0) return ['(none reported)'];
+  return list(values.map((entry) => [entry?.status, entry?.command, entry?.summary].filter(Boolean).join(' — ')), {
+    count: 30,
+    itemLimit: 500,
+  });
+}
+
+/** Build the automatic-review context capsule. */
+export function buildReviewTask(task, view = {}, { strictness = 'standard' } = {}) {
+  const outcome = view?.outcome ?? {};
+  const candidate = view?.candidate ?? {};
+  const changedFiles = Array.isArray(candidate.changed_files) ? candidate.changed_files : [];
+  const parts = [
+    'You are the automatic reviewer of a completed worker implementation.',
+    'REVIEW ONLY: inspect the candidate and report findings. Do not modify files.',
+    ...(strictness === 'strict' ? [
+      'STRICT REVIEW: fail closed. Approve only when direct code and test evidence supports every material claim; treat missing evidence as needs changes.',
+    ] : []),
+    '',
+    'Objective:',
+    clip(task, 4000),
+    '',
+    'Worker outcome:',
+    `task_status=${outcome.task_status ?? 'unknown'} tests_status=${outcome.tests_status ?? 'unknown'} delivery=${outcome.delivery?.complete ? 'complete' : 'incomplete'}`,
+    '',
+    'Reported changes:',
+    ...list(outcome.changes),
+    '',
+    'Reported tests:',
+    ...tests(outcome.tests),
+    '',
+    'Reported risks:',
+    ...list(outcome.risks),
+    '',
+    'Candidate artifact:',
+    `base_revision=${candidate.base_revision ?? 'unknown'}`,
+    `fingerprint=${candidate.fingerprint ?? 'unknown'}`,
+    'changed_files:',
+    ...list(changedFiles, { count: 80, itemLimit: 500 }),
+    '',
+    'Inspect the candidate directly in the current isolated workspace. Use git diff against the base revision and open only the files needed for review. The worker\'s raw prose and full patch are intentionally not embedded in this hand-off.',
+    '',
+    'Report: 1) whether the implementation satisfies the objective, 2) concrete bugs/style/security risks, 3) suggested fixes. End with ## Review Findings / ## Evidence / ## Risks / ## Verdict (approved | needs changes | rejected).',
+  ];
+  return parts.join('\n');
+}

package/src/install/cli.mjs

@@ -1,28 +1,28 @@
-#!/usr/bin/env node
-// Usage: node src/install/cli.mjs <claude|codex|all|hud|uninstall-claude|uninstall-codex|uninstall-all> [--statusline] [--project]
-
-import { installClaudeCode, installCodex, uninstallClaudeCode, uninstallCodex, installHudSegment } from './install.mjs';
-
-const cmd = process.argv[2];
-const flags = new Set(process.argv.slice(3));
-const opts = { statusline: flags.has('--statusline'), scope: flags.has('--project') ? 'project' : 'user' };
-
-const run = {
-  claude: () => [installClaudeCode(opts)],
-  codex: () => [installCodex(opts)],
-  all: () => [installClaudeCode(opts), installHudSegment(opts), installCodex(opts)],
-  'uninstall-claude': () => [uninstallClaudeCode(opts)],
-  'uninstall-codex': () => [uninstallCodex(opts)],
-  'uninstall-all': () => [uninstallClaudeCode(opts), uninstallCodex(opts)],
-  hud: () => [installHudSegment(opts)],
-}[cmd];
-
-if (!run) {
-  console.error('usage: cli.mjs <claude|codex|all|hud|uninstall-claude|uninstall-codex|uninstall-all> [--statusline] [--project]');
-  process.exit(1);
-}
-for (const p of run()) {
-  const r = await p;
-  for (const a of r.actions) console.log('•', a);
-}
-console.log('done.');
+#!/usr/bin/env node
+// Usage: node src/install/cli.mjs <claude|codex|all|hud|uninstall-claude|uninstall-codex|uninstall-all> [--statusline] [--project]
+
+import { installClaudeCode, installCodex, uninstallClaudeCode, uninstallCodex, installHudSegment } from './install.mjs';
+
+const cmd = process.argv[2];
+const flags = new Set(process.argv.slice(3));
+const opts = { statusline: flags.has('--statusline'), scope: flags.has('--project') ? 'project' : 'user' };
+
+const run = {
+  claude: () => [installClaudeCode(opts)],
+  codex: () => [installCodex(opts)],
+  all: () => [installClaudeCode(opts), installHudSegment(opts), installCodex(opts)],
+  'uninstall-claude': () => [uninstallClaudeCode(opts)],
+  'uninstall-codex': () => [uninstallCodex(opts)],
+  'uninstall-all': () => [uninstallClaudeCode(opts), uninstallCodex(opts)],
+  hud: () => [installHudSegment(opts)],
+}[cmd];
+
+if (!run) {
+  console.error('usage: cli.mjs <claude|codex|all|hud|uninstall-claude|uninstall-codex|uninstall-all> [--statusline] [--project]');
+  process.exit(1);
+}
+for (const p of run()) {
+  const r = await p;
+  for (const a of r.actions) console.log('•', a);
+}
+console.log('done.');