@ran-sh/dsh-crew 1.9.0 → 1.10.0

package/src/runtime-identity.mjs

@@ -1,235 +1,235 @@
-// Shared runtime identity and Hub compatibility contract.
-//
-// Package/release semver and the wire protocol are intentionally separate:
-// - RUNTIME_VERSION identifies the source/runtime generation for diagnostics.
-// - HUB_PROTOCOL_VERSION changes only when Hub <-> MCP wire semantics become
-//   incompatible.
-//
-// The Harness/DSH cohort version (e.g. 0.1.5-rc.2) is a THIRD, independent
-// domain: it identifies the installed @deepseek-ai/dsh package generation,
-// never the Crew release. Verifiers must compare the cohort against
-// dsh_version, never against runtime_version.
-//
-// Keep this module dependency-light so Hub, MCP and tests all use the exact
-// same compatibility rules.
-
-import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, extname, join, resolve } from 'node:path';
-import {
-  PRODUCTION_EXECUTION_PLANE,
-  PRODUCTION_PROFILE,
-  PRODUCTION_LISTEN_PORT,
-} from './runtime-identity-contract.mjs';
-export {
-  PRODUCTION_EXECUTION_PLANE,
-  PRODUCTION_PROFILE,
-  PRODUCTION_LISTEN_PORT,
-  isCompleteRuntimeIdentity,
-  sameCompleteRuntimeIdentity,
-  isExactNativeCrewIdentity,
-} from './runtime-identity-contract.mjs';
-
-// Production Crew execution is intentionally bound to the isolated 3210 Hub.
-// These fields are public provenance only; no credential or session secret is
-// included in the identity contract.
-const RUNTIME_ID = randomUUID();
-
-export const RUNTIME_VERSION = '1.9.0';
-export const HUB_PROTOCOL_VERSION = 1;
-
-export const HUB_CAPABILITIES = Object.freeze([
-  'jobs',
-  'jobs-wait',
-  'jobs-cancel',
-  'roles',
-  'attempt-index',
-  'model-policy',
-  'model-catalog',
-  'presets',
-  'config',
-  'canonical-events',
-  'evidence',
-  'profiles',
-  'workspace-context',
-  'extension-contract',
-  'provider-inventory',
-  'provider-layer-migration-v1',
-  'provider-lifecycle-v1',
-  'provider-health-v1',
-  'provider-probe-stream-v1',
-  'credential-reference-inventory-v1',
-  'credential-purge-v1',
-  'runtime-provenance-v1',
-]);
-
-// Capabilities the current MCP workflow depends on for full Hub execution.
-// Additional capabilities may be advertised without breaking compatibility.
-export const REQUIRED_HUB_CAPABILITIES = Object.freeze([
-  'jobs',
-  'jobs-wait',
-  'jobs-cancel',
-  'roles',
-  'attempt-index',
-  'model-policy',
-]);
-
-export const HUB_COMPATIBILITY_CODES = Object.freeze({
-  UNREACHABLE: 'HUB_UNREACHABLE',
-  HTTP_ERROR: 'HUB_HTTP_ERROR',
-  SERVICE_MISMATCH: 'HUB_SERVICE_MISMATCH',
-  PROTOCOL_MISSING: 'HUB_PROTOCOL_MISSING',
-  PROTOCOL_MISMATCH: 'HUB_PROTOCOL_MISMATCH',
-  CAPABILITY_MISSING: 'HUB_CAPABILITY_MISSING',
-  PROVENANCE_MISSING: 'HUB_PROVENANCE_MISSING',
-  EXECUTION_PLANE_MISMATCH: 'HUB_EXECUTION_PLANE_MISMATCH',
-  LISTEN_PORT_MISMATCH: 'HUB_LISTEN_PORT_MISMATCH',
-});
-
-function normalizedCapabilities(value) {
-  if (!Array.isArray(value)) return [];
-  return [...new Set(value.filter((item) => typeof item === 'string' && item.trim()).map((item) => item.trim()))];
-}
-
-function readVersionManifest(file) {
-  try {
-    const parsed = JSON.parse(readFileSync(file, 'utf8'));
-    if (parsed?.name !== '@deepseek-ai/dsh') return null;
-    return typeof parsed.version === 'string' && parsed.version.trim() ? parsed.version.trim() : null;
-  } catch { return null; }
-}
-
-/**
- * Resolve the @deepseek-ai/dsh manifest belonging to an explicit CLI entry.
- *
- * This intentionally accepts only a package manifest whose name is the
- * official Harness package. It lets a Crew-owned source checkout (for example
- * the GitHub-only dsh-v0.1.3-alpha.1 tag) report its real cohort without ever
- * reading the official ~/.dsh profile or trusting an arbitrary package.json.
- */
-function readExplicitCliVersion(entry) {
-  if (typeof entry !== 'string' || !entry.trim()) return null;
-  let cursor;
-  try { cursor = resolve(entry); } catch { return null; }
-  if (extname(cursor).toLowerCase() !== '.js') {
-    // A Windows shim normally lives at <root>/node_modules/.bin/dsh.cmd.
-    // Starting at its parent still finds the sibling @deepseek-ai/dsh tree.
-    cursor = dirname(cursor);
-  }
-  for (let depth = 0; depth < 12; depth += 1) {
-    const direct = readVersionManifest(join(cursor, 'package.json'));
-    if (direct) return direct;
-    const nested = readVersionManifest(join(cursor, 'node_modules', '@deepseek-ai', 'dsh', 'package.json'));
-    if (nested) return nested;
-    const parent = dirname(cursor);
-    if (parent === cursor) break;
-    cursor = parent;
-  }
-  return null;
-}
-
-export function getHubRuntimeIdentity() {
-  return {
-    service: 'dsh-crew-hub',
-    surface: 'native-crew-harness',
-    ui_role: 'runtime',
-    runtime_version: RUNTIME_VERSION,
-    dsh_version: readCrewDshVersion(),
-    protocol_version: HUB_PROTOCOL_VERSION,
-    execution_plane: PRODUCTION_EXECUTION_PLANE,
-    profile: PRODUCTION_PROFILE,
-    listen_port: PRODUCTION_LISTEN_PORT,
-    runtime_id: RUNTIME_ID,
-    capabilities: [...HUB_CAPABILITIES],
-  };
-}
-
-// Installed Harness cohort version (the @deepseek-ai/dsh package under the
-// Crew-owned DSH home, or an explicit Crew-owned CLI source checkout). Null
-// when unreadable: callers treat null as "unknown cohort", never as a match.
-// This is the ONLY field cohort verifiers may compare against TARGET_DSH_VERSION.
-export function readCrewDshVersion({ home = homedir(), env = process.env } = {}) {
-  // Only the Crew-scoped override is trusted here. A generic DSH_CLI may
-  // point at the official web profile and must never become Crew provenance.
-  const explicit = env?.DSH_CREW_DSH_CLI;
-  const explicitVersion = readExplicitCliVersion(explicit);
-  if (explicitVersion) return explicitVersion;
-  try {
-    const file = join(home, '.config', 'dsh-crew', 'harness', 'runtime', 'node_modules', '@deepseek-ai', 'dsh', 'package.json');
-    if (!existsSync(file)) return null;
-    const parsed = JSON.parse(readFileSync(file, 'utf8'));
-    return typeof parsed?.version === 'string' && parsed.version.length > 0 ? parsed.version : null;
-  } catch { return null; }
-}
-
-/**
- * Evaluate an already-received Hub ping body.
- *
- * This function does no I/O. `reachable` means an HTTP response was received;
- * `compatible` means the response is from dsh-crew and satisfies the current
- * protocol + required capability contract.
- */
-export function evaluateHubHandshake(body, { requiredCapabilities = REQUIRED_HUB_CAPABILITIES, strictProduction = false } = {}) {
-  const capabilities = normalizedCapabilities(body?.capabilities);
-  const base = {
-    reachable: true,
-    compatible: false,
-    service: typeof body?.service === 'string' ? body.service : null,
-    runtime_version: typeof body?.runtime_version === 'string' ? body.runtime_version : null,
-    protocol_version: Number.isInteger(body?.protocol_version) ? body.protocol_version : null,
-    execution_plane: typeof body?.execution_plane === 'string' ? body.execution_plane : null,
-    profile: typeof body?.profile === 'string' ? body.profile : null,
-    listen_port: Number.isInteger(body?.listen_port) ? body.listen_port : null,
-    runtime_id: typeof body?.runtime_id === 'string' ? body.runtime_id : null,
-    capabilities,
-    missing_capabilities: [],
-    code: null,
-  };
-
-  if (body?.service !== 'dsh-crew-hub') {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.SERVICE_MISMATCH };
-  }
-
-  // An explicit execution identity that is not the isolated 3210 Crew plane
-  // must never be accepted as the production Hub. Missing legacy fields remain
-  // compatible with the older protocol contract and are handled below.
-  if (body?.execution_plane !== undefined && body.execution_plane !== PRODUCTION_EXECUTION_PLANE) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.EXECUTION_PLANE_MISMATCH };
-  }
-  if (body?.listen_port !== undefined && body.listen_port !== PRODUCTION_LISTEN_PORT) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.LISTEN_PORT_MISMATCH };
-  }
-
-  if (!Number.isInteger(body?.protocol_version)) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISSING };
-  }
-
-  if (body.protocol_version !== HUB_PROTOCOL_VERSION) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISMATCH };
-  }
-
-  if (strictProduction && !(body?.execution_plane === PRODUCTION_EXECUTION_PLANE
-    && body?.profile === PRODUCTION_PROFILE
-    && Number.isInteger(body?.listen_port) && body.listen_port === PRODUCTION_LISTEN_PORT
-    && typeof body?.runtime_id === 'string' && body.runtime_id.trim().length > 0)) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.PROVENANCE_MISSING };
-  }
-
-  const required = normalizedCapabilities(requiredCapabilities);
-  const advertised = new Set(capabilities);
-  const missing = required.filter((capability) => !advertised.has(capability));
-  if (missing.length > 0) {
-    return {
-      ...base,
-      missing_capabilities: missing,
-      code: HUB_COMPATIBILITY_CODES.CAPABILITY_MISSING,
-    };
-  }
-
-  return {
-    ...base,
-    compatible: true,
-    code: null,
-  };
-}
+// Shared runtime identity and Hub compatibility contract.
+//
+// Package/release semver and the wire protocol are intentionally separate:
+// - RUNTIME_VERSION identifies the source/runtime generation for diagnostics.
+// - HUB_PROTOCOL_VERSION changes only when Hub <-> MCP wire semantics become
+//   incompatible.
+//
+// The Harness/DSH cohort version (e.g. 0.1.5-rc.2) is a THIRD, independent
+// domain: it identifies the installed @deepseek-ai/dsh package generation,
+// never the Crew release. Verifiers must compare the cohort against
+// dsh_version, never against runtime_version.
+//
+// Keep this module dependency-light so Hub, MCP and tests all use the exact
+// same compatibility rules.
+
+import { randomUUID } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, extname, join, resolve } from 'node:path';
+import {
+  PRODUCTION_EXECUTION_PLANE,
+  PRODUCTION_PROFILE,
+  PRODUCTION_LISTEN_PORT,
+} from './runtime-identity-contract.mjs';
+export {
+  PRODUCTION_EXECUTION_PLANE,
+  PRODUCTION_PROFILE,
+  PRODUCTION_LISTEN_PORT,
+  isCompleteRuntimeIdentity,
+  sameCompleteRuntimeIdentity,
+  isExactNativeCrewIdentity,
+} from './runtime-identity-contract.mjs';
+
+// Production Crew execution is intentionally bound to the isolated 3210 Hub.
+// These fields are public provenance only; no credential or session secret is
+// included in the identity contract.
+const RUNTIME_ID = randomUUID();
+
+export const RUNTIME_VERSION = '1.10.0';
+export const HUB_PROTOCOL_VERSION = 1;
+
+export const HUB_CAPABILITIES = Object.freeze([
+  'jobs',
+  'jobs-wait',
+  'jobs-cancel',
+  'roles',
+  'attempt-index',
+  'model-policy',
+  'model-catalog',
+  'presets',
+  'config',
+  'canonical-events',
+  'evidence',
+  'profiles',
+  'workspace-context',
+  'extension-contract',
+  'provider-inventory',
+  'provider-layer-migration-v1',
+  'provider-lifecycle-v1',
+  'provider-health-v1',
+  'provider-probe-stream-v1',
+  'credential-reference-inventory-v1',
+  'credential-purge-v1',
+  'runtime-provenance-v1',
+]);
+
+// Capabilities the current MCP workflow depends on for full Hub execution.
+// Additional capabilities may be advertised without breaking compatibility.
+export const REQUIRED_HUB_CAPABILITIES = Object.freeze([
+  'jobs',
+  'jobs-wait',
+  'jobs-cancel',
+  'roles',
+  'attempt-index',
+  'model-policy',
+]);
+
+export const HUB_COMPATIBILITY_CODES = Object.freeze({
+  UNREACHABLE: 'HUB_UNREACHABLE',
+  HTTP_ERROR: 'HUB_HTTP_ERROR',
+  SERVICE_MISMATCH: 'HUB_SERVICE_MISMATCH',
+  PROTOCOL_MISSING: 'HUB_PROTOCOL_MISSING',
+  PROTOCOL_MISMATCH: 'HUB_PROTOCOL_MISMATCH',
+  CAPABILITY_MISSING: 'HUB_CAPABILITY_MISSING',
+  PROVENANCE_MISSING: 'HUB_PROVENANCE_MISSING',
+  EXECUTION_PLANE_MISMATCH: 'HUB_EXECUTION_PLANE_MISMATCH',
+  LISTEN_PORT_MISMATCH: 'HUB_LISTEN_PORT_MISMATCH',
+});
+
+function normalizedCapabilities(value) {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.filter((item) => typeof item === 'string' && item.trim()).map((item) => item.trim()))];
+}
+
+function readVersionManifest(file) {
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    if (parsed?.name !== '@deepseek-ai/dsh') return null;
+    return typeof parsed.version === 'string' && parsed.version.trim() ? parsed.version.trim() : null;
+  } catch { return null; }
+}
+
+/**
+ * Resolve the @deepseek-ai/dsh manifest belonging to an explicit CLI entry.
+ *
+ * This intentionally accepts only a package manifest whose name is the
+ * official Harness package. It lets a Crew-owned source checkout (for example
+ * the GitHub-only dsh-v0.1.3-alpha.1 tag) report its real cohort without ever
+ * reading the official ~/.dsh profile or trusting an arbitrary package.json.
+ */
+function readExplicitCliVersion(entry) {
+  if (typeof entry !== 'string' || !entry.trim()) return null;
+  let cursor;
+  try { cursor = resolve(entry); } catch { return null; }
+  if (extname(cursor).toLowerCase() !== '.js') {
+    // A Windows shim normally lives at <root>/node_modules/.bin/dsh.cmd.
+    // Starting at its parent still finds the sibling @deepseek-ai/dsh tree.
+    cursor = dirname(cursor);
+  }
+  for (let depth = 0; depth < 12; depth += 1) {
+    const direct = readVersionManifest(join(cursor, 'package.json'));
+    if (direct) return direct;
+    const nested = readVersionManifest(join(cursor, 'node_modules', '@deepseek-ai', 'dsh', 'package.json'));
+    if (nested) return nested;
+    const parent = dirname(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return null;
+}
+
+export function getHubRuntimeIdentity() {
+  return {
+    service: 'dsh-crew-hub',
+    surface: 'native-crew-harness',
+    ui_role: 'runtime',
+    runtime_version: RUNTIME_VERSION,
+    dsh_version: readCrewDshVersion(),
+    protocol_version: HUB_PROTOCOL_VERSION,
+    execution_plane: PRODUCTION_EXECUTION_PLANE,
+    profile: PRODUCTION_PROFILE,
+    listen_port: PRODUCTION_LISTEN_PORT,
+    runtime_id: RUNTIME_ID,
+    capabilities: [...HUB_CAPABILITIES],
+  };
+}
+
+// Installed Harness cohort version (the @deepseek-ai/dsh package under the
+// Crew-owned DSH home, or an explicit Crew-owned CLI source checkout). Null
+// when unreadable: callers treat null as "unknown cohort", never as a match.
+// This is the ONLY field cohort verifiers may compare against TARGET_DSH_VERSION.
+export function readCrewDshVersion({ home = homedir(), env = process.env } = {}) {
+  // Only the Crew-scoped override is trusted here. A generic DSH_CLI may
+  // point at the official web profile and must never become Crew provenance.
+  const explicit = env?.DSH_CREW_DSH_CLI;
+  const explicitVersion = readExplicitCliVersion(explicit);
+  if (explicitVersion) return explicitVersion;
+  try {
+    const file = join(home, '.config', 'dsh-crew', 'harness', 'runtime', 'node_modules', '@deepseek-ai', 'dsh', 'package.json');
+    if (!existsSync(file)) return null;
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    return typeof parsed?.version === 'string' && parsed.version.length > 0 ? parsed.version : null;
+  } catch { return null; }
+}
+
+/**
+ * Evaluate an already-received Hub ping body.
+ *
+ * This function does no I/O. `reachable` means an HTTP response was received;
+ * `compatible` means the response is from dsh-crew and satisfies the current
+ * protocol + required capability contract.
+ */
+export function evaluateHubHandshake(body, { requiredCapabilities = REQUIRED_HUB_CAPABILITIES, strictProduction = false } = {}) {
+  const capabilities = normalizedCapabilities(body?.capabilities);
+  const base = {
+    reachable: true,
+    compatible: false,
+    service: typeof body?.service === 'string' ? body.service : null,
+    runtime_version: typeof body?.runtime_version === 'string' ? body.runtime_version : null,
+    protocol_version: Number.isInteger(body?.protocol_version) ? body.protocol_version : null,
+    execution_plane: typeof body?.execution_plane === 'string' ? body.execution_plane : null,
+    profile: typeof body?.profile === 'string' ? body.profile : null,
+    listen_port: Number.isInteger(body?.listen_port) ? body.listen_port : null,
+    runtime_id: typeof body?.runtime_id === 'string' ? body.runtime_id : null,
+    capabilities,
+    missing_capabilities: [],
+    code: null,
+  };
+
+  if (body?.service !== 'dsh-crew-hub') {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.SERVICE_MISMATCH };
+  }
+
+  // An explicit execution identity that is not the isolated 3210 Crew plane
+  // must never be accepted as the production Hub. Missing legacy fields remain
+  // compatible with the older protocol contract and are handled below.
+  if (body?.execution_plane !== undefined && body.execution_plane !== PRODUCTION_EXECUTION_PLANE) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.EXECUTION_PLANE_MISMATCH };
+  }
+  if (body?.listen_port !== undefined && body.listen_port !== PRODUCTION_LISTEN_PORT) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.LISTEN_PORT_MISMATCH };
+  }
+
+  if (!Number.isInteger(body?.protocol_version)) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISSING };
+  }
+
+  if (body.protocol_version !== HUB_PROTOCOL_VERSION) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISMATCH };
+  }
+
+  if (strictProduction && !(body?.execution_plane === PRODUCTION_EXECUTION_PLANE
+    && body?.profile === PRODUCTION_PROFILE
+    && Number.isInteger(body?.listen_port) && body.listen_port === PRODUCTION_LISTEN_PORT
+    && typeof body?.runtime_id === 'string' && body.runtime_id.trim().length > 0)) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.PROVENANCE_MISSING };
+  }
+
+  const required = normalizedCapabilities(requiredCapabilities);
+  const advertised = new Set(capabilities);
+  const missing = required.filter((capability) => !advertised.has(capability));
+  if (missing.length > 0) {
+    return {
+      ...base,
+      missing_capabilities: missing,
+      code: HUB_COMPATIBILITY_CODES.CAPABILITY_MISSING,
+    };
+  }
+
+  return {
+    ...base,
+    compatible: true,
+    code: null,
+  };
+}