@ran-sh/dsh-crew 1.9.0 → 1.10.0

package/src/session-origins.mjs

@@ -1,60 +1,60 @@
-// Durable provenance for sessions the Crew hub created.
-//
-// Cleanup needs to tell a session Crew dispatched apart from one the operator
-// opened in the same UI, because they are otherwise identical: both are ordinary
-// Harness sessions in one shared store, with the same header shape (no field
-// records who asked for them). Provenance has to be recorded at the moment of
-// creation, which only the hub knows.
-//
-// This is deliberately an append-only JSONL file rather than a rewrite of the
-// status shards: a shard removes itself on clean process exit, so it is a
-// best-effort view of live writers, not a record of what was ever created.
-//
-// Absence is not proof of user authorship — a session predating this ledger, or
-// one whose line was lost, simply stays unclaimed. Unclaimed sessions are treated
-// as the operator's and are never removed by a Crew-scoped cleanup.
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-
-export function sessionOriginsFile({ home = homedir() } = {}) {
-  return join(home, '.config', 'dsh-crew', 'session-origins.jsonl');
-}
-
-/**
- * Record that Crew created one session. Best effort: losing a line weakens a
- * later cleanup's scope, so it must never fail a dispatch that already started.
- */
-export function appendSessionOrigin({ home = homedir(), sessionId, role = null, jobId = null, now = Date.now } = {}) {
-  if (typeof sessionId !== 'string' || !sessionId) return false;
-  try {
-    const file = sessionOriginsFile({ home });
-    mkdirSync(dirname(file), { recursive: true });
-    appendFileSync(file, `${JSON.stringify({ sessionId, role, jobId, createdAt: now() })}\n`);
-    return true;
-  } catch { return false; }
-}
-
-/**
- * Session ids Crew is known to have created.
- *
- * A malformed or truncated line is skipped rather than thrown: the ledger is an
- * optimization for scope, and a damaged tail must not make cleanup unusable. The
- * failure direction is safe — an unread session is treated as the operator's.
- */
-export function readSessionOrigins({ home = homedir() } = {}) {
-  const file = sessionOriginsFile({ home });
-  if (!existsSync(file)) return new Set();
-  try {
-    const ids = new Set();
-    for (const line of readFileSync(file, 'utf8').split('\n')) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      try {
-        const row = JSON.parse(trimmed);
-        if (typeof row?.sessionId === 'string' && row.sessionId) ids.add(row.sessionId);
-      } catch { /* skip a torn line */ }
-    }
-    return ids;
-  } catch { return new Set(); }
-}
+// Durable provenance for sessions the Crew hub created.
+//
+// Cleanup needs to tell a session Crew dispatched apart from one the operator
+// opened in the same UI, because they are otherwise identical: both are ordinary
+// Harness sessions in one shared store, with the same header shape (no field
+// records who asked for them). Provenance has to be recorded at the moment of
+// creation, which only the hub knows.
+//
+// This is deliberately an append-only JSONL file rather than a rewrite of the
+// status shards: a shard removes itself on clean process exit, so it is a
+// best-effort view of live writers, not a record of what was ever created.
+//
+// Absence is not proof of user authorship — a session predating this ledger, or
+// one whose line was lost, simply stays unclaimed. Unclaimed sessions are treated
+// as the operator's and are never removed by a Crew-scoped cleanup.
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+export function sessionOriginsFile({ home = homedir() } = {}) {
+  return join(home, '.config', 'dsh-crew', 'session-origins.jsonl');
+}
+
+/**
+ * Record that Crew created one session. Best effort: losing a line weakens a
+ * later cleanup's scope, so it must never fail a dispatch that already started.
+ */
+export function appendSessionOrigin({ home = homedir(), sessionId, role = null, jobId = null, now = Date.now } = {}) {
+  if (typeof sessionId !== 'string' || !sessionId) return false;
+  try {
+    const file = sessionOriginsFile({ home });
+    mkdirSync(dirname(file), { recursive: true });
+    appendFileSync(file, `${JSON.stringify({ sessionId, role, jobId, createdAt: now() })}\n`);
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Session ids Crew is known to have created.
+ *
+ * A malformed or truncated line is skipped rather than thrown: the ledger is an
+ * optimization for scope, and a damaged tail must not make cleanup unusable. The
+ * failure direction is safe — an unread session is treated as the operator's.
+ */
+export function readSessionOrigins({ home = homedir() } = {}) {
+  const file = sessionOriginsFile({ home });
+  if (!existsSync(file)) return new Set();
+  try {
+    const ids = new Set();
+    for (const line of readFileSync(file, 'utf8').split('\n')) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const row = JSON.parse(trimmed);
+        if (typeof row?.sessionId === 'string' && row.sessionId) ids.add(row.sessionId);
+      } catch { /* skip a torn line */ }
+    }
+    return ids;
+  } catch { return new Set(); }
+}

package/src/standalone-sdk.mjs

@@ -1,23 +1,23 @@
-/** Keep Hub-only MCP clients independent of optional standalone host peers. */
-export function createStandaloneHarness(options, { load = () => import('@deepseek-ai/dsh-sdk-client') } = {}) {
-  let loading;
-  let harness;
-  let closed = false;
-  return {
-    async run(...args) {
-      if (closed) throw Error('standalone job cancelled before startup');
-      loading ??= load().catch(error => {
-        if (error?.code !== 'ERR_MODULE_NOT_FOUND' && error?.code !== 'MODULE_NOT_FOUND') throw error;
-        throw Object.assign(new Error('Standalone DSH SDK is unavailable. Repair the Crew-owned installation before using standalone mode; Hub mode does not require this SDK.'), { code: 'STANDALONE_SDK_UNAVAILABLE' });
-      });
-      const { DeepSeekHarness } = await loading;
-      if (closed) throw Error('standalone job cancelled before startup');
-      harness ??= new DeepSeekHarness(options);
-      return harness.run(...args);
-    },
-    async close() {
-      closed = true;
-      if (harness) await harness.close();
-    },
-  };
-}
+/** Keep Hub-only MCP clients independent of optional standalone host peers. */
+export function createStandaloneHarness(options, { load = () => import('@deepseek-ai/dsh-sdk-client') } = {}) {
+  let loading;
+  let harness;
+  let closed = false;
+  return {
+    async run(...args) {
+      if (closed) throw Error('standalone job cancelled before startup');
+      loading ??= load().catch(error => {
+        if (error?.code !== 'ERR_MODULE_NOT_FOUND' && error?.code !== 'MODULE_NOT_FOUND') throw error;
+        throw Object.assign(new Error('Standalone DSH SDK is unavailable. Repair the Crew-owned installation before using standalone mode; Hub mode does not require this SDK.'), { code: 'STANDALONE_SDK_UNAVAILABLE' });
+      });
+      const { DeepSeekHarness } = await loading;
+      if (closed) throw Error('standalone job cancelled before startup');
+      harness ??= new DeepSeekHarness(options);
+      return harness.run(...args);
+    },
+    async close() {
+      closed = true;
+      if (harness) await harness.close();
+    },
+  };
+}

package/src/status-shard.mjs

@@ -1,63 +1,63 @@
-// Sharded worker-status publishing: every writer (hub process, per-session
-// standalone MCP server) owns one file under ~/.config/dsh-crew/status.d/
-// and readers merge all fresh shards. Kills the last-writer-wins race that a
-// single shared status.json had with multiple concurrent writers.
-
-import { writeFileSync, mkdirSync, rmSync, readdirSync, readFileSync, renameSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-
-const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
-const SHARD_DIR = join(CONFIG_DIR, 'status.d');
-export const SHARD_FRESH_MS = 30 * 60 * 1000;
-
-export function createShardWriter(kind) {
-  const writer = `${kind}-${process.pid}`;
-  const file = join(SHARD_DIR, `${writer}.json`);
-  const cleanup = () => { try { rmSync(file, { force: true }); } catch {} };
-  process.once('exit', cleanup);
-  process.once('SIGINT', () => { cleanup(); process.exit(130); });
-  process.once('SIGTERM', () => { cleanup(); process.exit(143); });
-  return {
-    writer,
-    publish(jobs) {
-      // Same durability pattern as the profile/workspace registries: write a
-      // same-directory temp file as 0600 and rename it over the shard, so a
-      // reader never observes a partially written shard (parse failures are
-      // silently ignored, which would make the writer look vanished).
-      try {
-        mkdirSync(SHARD_DIR, { recursive: true });
-        const temp = `${file}.tmp-${Date.now()}`;
-        try {
-          writeFileSync(temp, JSON.stringify({ updatedAt: new Date().toISOString(), writer, jobs }, null, 2), { encoding: 'utf8', mode: 0o600 });
-          renameSync(temp, file);
-        } catch (error) {
-          try { rmSync(temp, { force: true }); } catch {}
-          throw error;
-        }
-      } catch {}
-    },
-    dispose: cleanup,
-  };
-}
-
-/** Merge fresh shards (plus the legacy status.json during transition). */
-export function readMergedStatus({ excludeWriter } = {}) {
-  const jobs = [];
-  const now = Date.now();
-  const consume = (raw) => {
-    try {
-      const shard = JSON.parse(raw);
-      if (shard.writer === excludeWriter) return;
-      if (now - +new Date(shard.updatedAt) > SHARD_FRESH_MS) return;
-      for (const job of shard.jobs ?? []) jobs.push({ ...job, origin: shard.writer ?? 'legacy' });
-    } catch {}
-  };
-  try {
-    for (const f of readdirSync(SHARD_DIR)) {
-      if (f.endsWith('.json')) { try { consume(readFileSync(join(SHARD_DIR, f), 'utf8')); } catch {} }
-    }
-  } catch {}
-  try { consume(readFileSync(join(CONFIG_DIR, 'status.json'), 'utf8')); } catch {}
-  return jobs;
-}
+// Sharded worker-status publishing: every writer (hub process, per-session
+// standalone MCP server) owns one file under ~/.config/dsh-crew/status.d/
+// and readers merge all fresh shards. Kills the last-writer-wins race that a
+// single shared status.json had with multiple concurrent writers.
+
+import { writeFileSync, mkdirSync, rmSync, readdirSync, readFileSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
+const SHARD_DIR = join(CONFIG_DIR, 'status.d');
+export const SHARD_FRESH_MS = 30 * 60 * 1000;
+
+export function createShardWriter(kind) {
+  const writer = `${kind}-${process.pid}`;
+  const file = join(SHARD_DIR, `${writer}.json`);
+  const cleanup = () => { try { rmSync(file, { force: true }); } catch {} };
+  process.once('exit', cleanup);
+  process.once('SIGINT', () => { cleanup(); process.exit(130); });
+  process.once('SIGTERM', () => { cleanup(); process.exit(143); });
+  return {
+    writer,
+    publish(jobs) {
+      // Same durability pattern as the profile/workspace registries: write a
+      // same-directory temp file as 0600 and rename it over the shard, so a
+      // reader never observes a partially written shard (parse failures are
+      // silently ignored, which would make the writer look vanished).
+      try {
+        mkdirSync(SHARD_DIR, { recursive: true });
+        const temp = `${file}.tmp-${Date.now()}`;
+        try {
+          writeFileSync(temp, JSON.stringify({ updatedAt: new Date().toISOString(), writer, jobs }, null, 2), { encoding: 'utf8', mode: 0o600 });
+          renameSync(temp, file);
+        } catch (error) {
+          try { rmSync(temp, { force: true }); } catch {}
+          throw error;
+        }
+      } catch {}
+    },
+    dispose: cleanup,
+  };
+}
+
+/** Merge fresh shards (plus the legacy status.json during transition). */
+export function readMergedStatus({ excludeWriter } = {}) {
+  const jobs = [];
+  const now = Date.now();
+  const consume = (raw) => {
+    try {
+      const shard = JSON.parse(raw);
+      if (shard.writer === excludeWriter) return;
+      if (now - +new Date(shard.updatedAt) > SHARD_FRESH_MS) return;
+      for (const job of shard.jobs ?? []) jobs.push({ ...job, origin: shard.writer ?? 'legacy' });
+    } catch {}
+  };
+  try {
+    for (const f of readdirSync(SHARD_DIR)) {
+      if (f.endsWith('.json')) { try { consume(readFileSync(join(SHARD_DIR, f), 'utf8')); } catch {} }
+    }
+  } catch {}
+  try { consume(readFileSync(join(CONFIG_DIR, 'status.json'), 'utf8')); } catch {}
+  return jobs;
+}

package/src/structured-error-code.mjs

@@ -1,39 +1,39 @@
-// Shared bounded machine error-code contract for the Hub service boundary.
-//
-// A machine code is an uppercase snake-style identifier (A-Z, 0-9, single
-// underscores) of at most 64 characters. Only such values may cross the Hub
-// service/client boundary as a top-level `code`: values are taken from
-// err.code / err.policyCode only and are never derived from error text or from
-// arbitrary response payload fields. Invalid values are treated as absent and
-// callers fall back to their own constant (e.g. HUB_REQUEST_FAILED).
-
-export const MACHINE_CODE_MAX_LENGTH = 64;
-const MACHINE_CODE_RE = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$/;
-
-/**
- * True when `value` is a string that satisfies the bounded machine-code
- * contract (uppercase snake-style identifier, length 1..64). Null, non-strings,
- * lowercase/mixed-case, blank, leading/trailing/double-underscore, and
- * over-length values are rejected.
- */
-export function isBoundedMachineCode(value) {
-  return typeof value === 'string'
-    && value.length > 0
-    && value.length <= MACHINE_CODE_MAX_LENGTH
-    && MACHINE_CODE_RE.test(value);
-}
-
-/**
- * First valid bounded machine code found on an error object: `code` wins over
- * `policyCode`. Returns null when neither field is a valid bounded machine
- * code, so callers can keep the raw error text unchanged and only add the
- * optional top-level `code` when one genuinely exists.
- */
-export function boundedMachineCodeFromError(err) {
-  if (!err || typeof err !== 'object') return null;
-  for (const key of ['code', 'policyCode']) {
-    const value = err[key];
-    if (isBoundedMachineCode(value)) return value;
-  }
-  return null;
+// Shared bounded machine error-code contract for the Hub service boundary.
+//
+// A machine code is an uppercase snake-style identifier (A-Z, 0-9, single
+// underscores) of at most 64 characters. Only such values may cross the Hub
+// service/client boundary as a top-level `code`: values are taken from
+// err.code / err.policyCode only and are never derived from error text or from
+// arbitrary response payload fields. Invalid values are treated as absent and
+// callers fall back to their own constant (e.g. HUB_REQUEST_FAILED).
+
+export const MACHINE_CODE_MAX_LENGTH = 64;
+const MACHINE_CODE_RE = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$/;
+
+/**
+ * True when `value` is a string that satisfies the bounded machine-code
+ * contract (uppercase snake-style identifier, length 1..64). Null, non-strings,
+ * lowercase/mixed-case, blank, leading/trailing/double-underscore, and
+ * over-length values are rejected.
+ */
+export function isBoundedMachineCode(value) {
+  return typeof value === 'string'
+    && value.length > 0
+    && value.length <= MACHINE_CODE_MAX_LENGTH
+    && MACHINE_CODE_RE.test(value);
+}
+
+/**
+ * First valid bounded machine code found on an error object: `code` wins over
+ * `policyCode`. Returns null when neither field is a valid bounded machine
+ * code, so callers can keep the raw error text unchanged and only add the
+ * optional top-level `code` when one genuinely exists.
+ */
+export function boundedMachineCodeFromError(err) {
+  if (!err || typeof err !== 'object') return null;
+  for (const key of ['code', 'policyCode']) {
+    const value = err[key];
+    if (isBoundedMachineCode(value)) return value;
+  }
+  return null;
 }