@ran-sh/dsh-crew 2.0.2 → 2.0.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/docs/job-contracts.md

@@ -85,13 +85,18 @@ Per-job precedence is request `constraints` > Profile > session defaults.
 `auto`, `existing`, or `none`. Workspace preflight reports `READY`, `CONFLICT`,
 `READ_ONLY`, or `UNAVAILABLE` before dispatch.
 
-`constraints.allow_no_changes: true` is reserved for explicitly read-only
-search, inspection, or analysis work. It does not blindly convert a partial
-Delivery Report into success: Crew requires an isolated candidate with zero
-changed files, a complete Delivery Report, at least one passing evidence check,
-and no failed check. If the Worker reports no changes but the workspace contains
-edits—or reports changes while the workspace is empty—the workflow fails closed
-with workspace-evidence mismatch.
+`constraints.allow_no_changes: true` is for tasks explicitly expected to leave
+no net workspace changes, including read-only search/inspection and bounded
+temporary smoke work. It does not blindly convert a partial Delivery Report
+into success: Crew requires a complete Delivery Report, at least one passing
+evidence check, no failed check, and machine-verifiable zero net workspace
+changes. For Hub jobs, that evidence comes from a clean Git baseline, or from a
+non-Git workspace whose initial tree contains only directories; the latter audit
+compares paths and entry types without opening file contents. Non-Git trees that
+already contain files, links, or special entries remain unverifiable and fail
+closed. If the Worker reports no changes but the workspace contains edits—or
+reports changes while the workspace is empty—the workflow fails closed with
+workspace-evidence mismatch.
 
 The CLI is a JSON projection of the same local HTTP surface:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/hub/index.mjs

@@ -502,10 +502,9 @@ export function hubCanonicalEvents(job = {}) {
 
 export function applyHubWorkspaceEvidence({ outcome, workspaceDiff, allowNoChanges = false, isolation = 'shared', role = 'worker' } = {}) {
   void isolation;
-  const changes = workspaceDiff?.changes ?? {};
-  const hasChanges = ['modified', 'deleted', 'renamed', 'untracked']
-    .some((key) => Array.isArray(changes[key]) && changes[key].length > 0);
-  const evidenceAvailable = workspaceDiff?.kind === 'git' && workspaceDiff.dirtyBaseline !== true;
+  const hasChanges = workspaceHasChanges(workspaceDiff);
+  const evidenceAvailable = (workspaceDiff?.kind === 'git' && workspaceDiff.dirtyBaseline !== true)
+    || (workspaceDiff?.kind === 'filesystem-empty' && typeof workspaceDiff.unchanged === 'boolean');
   return applyWorkspaceEvidence(outcome, {
     evidenceAvailable,
     hasChanges,
@@ -521,6 +520,19 @@ export function applyHubWorkspaceEvidence({ outcome, workspaceDiff, allowNoChang
   });
 }
 
+function workspaceHasChanges(workspaceDiff) {
+  if (workspaceDiff?.kind === 'filesystem-empty') return workspaceDiff.unchanged !== true;
+  const changes = workspaceDiff?.changes ?? {};
+  return ['modified', 'deleted', 'renamed', 'untracked']
+    .some((key) => Array.isArray(changes[key]) && changes[key].length > 0);
+}
+
+export function invalidateReviewForWorkspaceMutation({ role, review, workspaceDiff } = {}) {
+  if (role !== 'reviewer' || !review || !['git', 'filesystem-empty'].includes(workspaceDiff?.kind)) return review;
+  if (!workspaceHasChanges(workspaceDiff)) return review;
+  return { ...review, mutated_candidate: true, invalidated: true, verdict: 'request_changes' };
+}
+
 /**
  * Build the explicit provider callability probe used by the 3210 lifecycle
  * route. It performs one token-bounded Harness stream through the same llm
@@ -602,7 +614,7 @@ export class WorkerRegistry {  constructor(ctx) {
       task_status: job.outcome?.task_status ?? null,
       workspace_evidence_ok: job.outcome?.workspace_evidence_ok ?? null,
       review_verdict: job.review?.verdict ?? null,
-      workspace_diff_available: !!job.workspaceDiff && job.workspaceDiff.kind === 'git',
+      workspace_diff_available: !!job.workspaceDiff && ['git', 'filesystem-empty'].includes(job.workspaceDiff.kind),
       workspace_retained: job.workspace_retained === true,
       cleanup_warning: job.cleanup_warning ?? null,
       profile_id: job.profile_id ?? null,
@@ -935,7 +947,8 @@ export class WorkerRegistry {  constructor(ctx) {
     // Read-only pre-run snapshot (async, never blocks dispatch): the audit
     // only needs the before-state by the time the worker finishes. Non-repos
     // degrade to { kind:'no-git' } instead of failing the job.
-    job.baseline = await captureWorkspaceBaseline({ cwd: executionCwd }).catch(() => ({ kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace audit failed' }));
+    job.baseline = await captureWorkspaceBaseline({ cwd: executionCwd, allowEmptyNonGitDirectory: true })
+      .catch(() => ({ kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace audit failed' }));
     try {
       this.assertProviderNotMutating(selection.provider, providerMutationEpoch);
       this.acquireProviderLease(selection.provider);
@@ -1120,7 +1133,7 @@ export class WorkerRegistry {  constructor(ctx) {
         });
         job.phase = job.status === 'done' ? JOB_PHASES.COMPLETED : job.status === 'cancelled' ? JOB_PHASES.CANCELLED : JOB_PHASES.FAILED;
         // Read-only after-snapshot of the workspace: bounded, redacted patch.
-        job.workspaceDiff = job.baseline.kind === 'git'
+        job.workspaceDiff = ['git', 'filesystem-empty'].includes(job.baseline.kind)
           ? await captureWorkspaceDiff({ cwd: executionCwd, baseline: job.baseline }).catch(() => ({ kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace diff failed' }))
           : job.baseline;
         job.outcome = applyHubWorkspaceEvidence({
@@ -1139,15 +1152,11 @@ export class WorkerRegistry {  constructor(ctx) {
             error: { code: job.error_code, message: job.error },
           });
         }
-        if (job.role === 'reviewer' && job.review && job.workspaceDiff?.kind === 'git') {
-          const changes = job.workspaceDiff.changes ?? {};
-          const mutated = ['modified', 'deleted', 'renamed', 'untracked'].some((key) => Array.isArray(changes[key]) && changes[key].length > 0);
-          if (mutated) {
-            job.review.mutated_candidate = true;
-            job.review.invalidated = true;
-            job.review.verdict = 'request_changes';
-          }
-        }
+        job.review = invalidateReviewForWorkspaceMutation({
+          role: job.role,
+          review: job.review,
+          workspaceDiff: job.workspaceDiff,
+        });
         if (job.isolatedWorkspace) {
           const cleanup = await cleanupIsolatedWorkspace(job.isolatedWorkspace).catch((error) => ({ ok: false, error: error?.message ?? String(error) }));
           job.workspace_retained = cleanup.ok !== true;

package/src/mcp-runtime.mjs

@@ -283,8 +283,10 @@ export function buildMcpWorkflowRuntime(deps) {
     const config = getConfig();
     const isolation = config.execution?.isolation ?? 'worktree';
     // Explicit shared mode uses the requested workspace. Readonly profiles,
-    // including the default Reviewer, use a disposable worktree below so an
-    // accidental edit can be detected and never pollutes the primary tree.
+    // including the default Reviewer, take the disposable worktree below, so an
+    // accidental edit cannot reach the primary tree at all. A reviewer that was
+    // explicitly given a shared workspace still gets fingerprinted around its
+    // attempt, so an edit there is detected even though it is not prevented.
     if (job.requested_isolation === 'shared' || isolation === 'shared') {
       return { ok: true, execution_cwd: job.requested_cwd, isolation: 'shared', base_revision: null, primary_workspace_dirty: false, handle: null };
     }

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.0.2';
+export const RUNTIME_VERSION = '2.0.4';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/workflow-runtime.mjs

@@ -289,7 +289,10 @@ export function createWorkflowRuntime(adapters, {
 
   async function releaseWorkspace(job) {
     if (job.retain_workspace) {
-      job.workspace_retained = true;
+      // Retention means an isolated workspace was deliberately kept for
+      // recovery. A shared workspace is the caller's own and was never ours to
+      // keep, so an evidence failure there retains nothing.
+      if (job.workspaceHandle) job.workspace_retained = true;
       return;
     }
     if (!job.workspaceHandle) return;
@@ -342,7 +345,7 @@ export function createWorkflowRuntime(adapters, {
 
       if (isReviewJob) {
         transition(job, JOB_PHASES.REVIEWING, 'explicit reviewer');
-        const before = alloc?.ok && alloc.isolation === 'worktree' ? await safeCapture(adapters, job.execution_cwd, job.base_revision) : null;
+        const before = alloc?.ok ? await safeCapture(adapters, job.execution_cwd, job.base_revision) : null;
         // Explicit reviewers inspect the caller's stated task/workspace
         // directly. The bounded worker-candidate capsule belongs only to the
         // automatic post-worker review path; constructing it with no worker
@@ -553,8 +556,13 @@ export function createWorkflowRuntime(adapters, {
   }
 
   async function runReviewerAttempt(job, task, config, beforeCandidate, cwd = job.execution_cwd, baseRevision = job.base_revision) {
+    // Reviewing is the one role whose entire contract is "changed nothing", so
+    // its evidence is not exempted by isolation. In a worktree the pre-review
+    // candidate comes from the allocator or the worker and its absence is a real
+    // failure; a shared workspace has no such candidate, so fingerprint the tree
+    // the reviewer is about to touch — otherwise the reviewer is the one actor
+    // whose edits nothing observes.
     const requireFingerprint = (candidate) => {
-      if (job.isolation !== 'worktree') return;
       if (candidate?.ok === true && typeof candidate.fingerprint === 'string' && candidate.fingerprint.trim()) return;
       job.candidate_capture_failed = true;
       job.retain_workspace = true;
@@ -562,7 +570,9 @@ export function createWorkflowRuntime(adapters, {
         code: 'REVIEW_EVIDENCE_UNAVAILABLE',
       });
     };
-    requireFingerprint(beforeCandidate);
+    const before = beforeCandidate
+      ?? (job.isolation === 'worktree' ? null : await safeCapture(adapters, cwd, baseRevision));
+    requireFingerprint(before);
     const policy = resolveModelPolicy(config, 'reviewer', { attempt: 0 });
     const attemptId = attemptIdFor(adapters, job.id, 'review');
     job.current_attempt_id = attemptId;
@@ -594,9 +604,9 @@ export function createWorkflowRuntime(adapters, {
       fallback_reason: attemptView.selection_trace?.fallback_reason ?? null,
     }, 0);
     if (ar.status === 'failed' && attemptView.error_code) job.error_code = attemptView.error_code;
-    const afterCandidate = job.isolation === 'worktree' ? await safeCapture(adapters, cwd, baseRevision) : null;
+    const afterCandidate = await safeCapture(adapters, cwd, baseRevision);
     requireFingerprint(afterCandidate);
-    const review = normalizeReview({ attemptResult: ar, beforeCandidate, afterCandidate });
+    const review = normalizeReview({ attemptResult: ar, beforeCandidate: before, afterCandidate });
     recordCanonical(job, 'review.completed', {
       attempt_id: attemptView.id,
       status: review.status,

package/src/workspace-audit.mjs

@@ -5,15 +5,17 @@
 //
 // Discipline: strictly read-only. Only git porcelain reads are issued — never
 // reset / stash / clean / checkout, and nothing here writes to disk. A
-// non-git directory degrades to { kind: 'no-git' } instead of failing, and a
-// pre-dirty workspace is flagged (dirtyBaseline) rather than hidden.
+// non-git directory degrades to { kind: 'no-git' } by default, and a pre-dirty
+// workspace is flagged (dirtyBaseline) rather than hidden. Hub callers may
+// opt into a bounded directory-only snapshot for initially empty non-Git trees.
 //
 // The default `git` runner is replaceable with an injected runner in tests:
 // it receives (argsArray, { cwd }) and resolves { code, stdout, stderr }.
 
 import { execFile } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { win32 } from 'node:path';
+import { lstat, opendir, realpath } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep, win32 } from 'node:path';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
@@ -22,7 +24,10 @@ export const DIFF_LIMIT = 64 * 1024;
 export const NOT_A_GIT_REPOSITORY = 'NOT_A_GIT_REPOSITORY';
 export const GIT_NOT_FOUND = 'GIT_NOT_FOUND';
 export const GIT_TIMEOUT = 'GIT_TIMEOUT';
+export const GIT_ERROR = 'GIT_ERROR';
 export const GIT_TIMEOUT_MS = 8000;
+const EMPTY_TREE_ENTRY_LIMIT = 20_000;
+const EMPTY_TREE_DEPTH_LIMIT = 64;
 
 const SENSITIVE_SUFFIXES = ['.pem', '.key'];
 const SENSITIVE_PREFIXES = ['credentials', 'secret'];
@@ -85,15 +90,103 @@ async function runGit(runner, args, opts) {
     if (/not a git repository/i.test(stderr)) {
       return { ok: false, reason: NOT_A_GIT_REPOSITORY, error: stderr.trim() };
     }
+    if (Number.isInteger(r.code) && r.code !== 0) {
+      return { ok: false, reason: GIT_ERROR, error: 'git audit failed' };
+    }
     return { ok: true, code: r.code ?? 0, stdout: r.stdout ?? '', stderr };
   } catch (err) {
     const msg = err?.message ?? String(err);
+    const diagnostic = `${err?.stderr ?? ''}\n${msg}`;
+    if (/not a git repository/i.test(diagnostic)) return { ok: false, reason: NOT_A_GIT_REPOSITORY, error: 'not a git repository' };
     if (err?.code === 'ETIMEDOUT' || err?.killed === true || /timed out|timeout/i.test(msg)) return { ok: false, reason: GIT_TIMEOUT, error: 'git audit timed out' };
     if (/ENOENT|spawn git/i.test(msg)) return { ok: false, reason: GIT_NOT_FOUND, error: msg };
-    return { ok: false, reason: NOT_A_GIT_REPOSITORY, error: msg };
+    return { ok: false, reason: GIT_ERROR, error: 'git audit failed' };
   }
 }
 
+function samePath(left, right) {
+  const normalizedLeft = resolve(left).replace(/[\\/]+$/, '');
+  const normalizedRight = resolve(right).replace(/[\\/]+$/, '');
+  return process.platform === 'win32'
+    ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase()
+    : normalizedLeft === normalizedRight;
+}
+
+function pathIsWithin(root, candidate) {
+  const rel = relative(root, candidate);
+  const comparable = process.platform === 'win32' ? rel.toLowerCase() : rel;
+  return comparable === '' || (comparable !== '..' && !comparable.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+
+/**
+ * Capture names and entry kinds only; never open file contents. This fallback
+ * is eligible only when the pre-run tree has no files or links, so it can prove
+ * that a temporary file/directory was removed without reading existing data.
+ */
+async function captureDirectoryEntries(cwd) {
+  let root;
+  try {
+    const requested = resolve(cwd);
+    const requestedStat = await lstat(requested);
+    if (!requestedStat.isDirectory() || requestedStat.isSymbolicLink()) {
+      return { ok: false, reason: 'WORKSPACE_ROOT_UNSAFE' };
+    }
+    root = await realpath(requested);
+  } catch {
+    return { ok: false, reason: 'WORKSPACE_SCAN_UNAVAILABLE' };
+  }
+
+  const pending = [{ absolute: root, depth: 0 }];
+  const entries = [];
+  let regularFileCount = 0;
+  let linkOrSpecialCount = 0;
+  try {
+    while (pending.length > 0) {
+      const current = pending.pop();
+      if (current.depth > EMPTY_TREE_DEPTH_LIMIT) return { ok: false, reason: 'WORKSPACE_SCAN_LIMIT' };
+      const beforeStat = await lstat(current.absolute);
+      if (!beforeStat.isDirectory() || beforeStat.isSymbolicLink()) return { ok: false, reason: 'WORKSPACE_SCAN_UNAVAILABLE' };
+      const canonical = await realpath(current.absolute);
+      if (!pathIsWithin(root, canonical)) return { ok: false, reason: 'WORKSPACE_SCAN_UNAVAILABLE' };
+      const children = await opendir(canonical);
+      for await (const child of children) {
+        if (entries.length >= EMPTY_TREE_ENTRY_LIMIT) return { ok: false, reason: 'WORKSPACE_SCAN_LIMIT' };
+        const absolute = resolve(canonical, child.name);
+        const entryPath = relative(root, absolute).split(sep).join('/');
+        const stat = await lstat(absolute);
+        let type;
+        if (stat.isSymbolicLink()) {
+          type = 'link';
+          linkOrSpecialCount += 1;
+        } else if (stat.isDirectory()) {
+          type = 'directory';
+          pending.push({ absolute, depth: current.depth + 1 });
+        } else if (stat.isFile()) {
+          type = 'file';
+          regularFileCount += 1;
+        } else {
+          type = 'special';
+          linkOrSpecialCount += 1;
+        }
+        entries.push({ path: entryPath, type });
+      }
+      const afterStat = await lstat(current.absolute);
+      const afterCanonical = await realpath(current.absolute);
+      if (!afterStat.isDirectory() || afterStat.isSymbolicLink()
+        || !samePath(canonical, afterCanonical)
+        || beforeStat.mtimeMs !== afterStat.mtimeMs
+        || beforeStat.ctimeMs !== afterStat.ctimeMs) {
+        return { ok: false, reason: 'WORKSPACE_SCAN_UNAVAILABLE' };
+      }
+    }
+  } catch {
+    return { ok: false, reason: 'WORKSPACE_SCAN_UNAVAILABLE' };
+  }
+
+  entries.sort((left, right) => left.path.localeCompare(right.path));
+  return { ok: true, entries, regularFileCount, linkOrSpecialCount };
+}
+
 function splitFirstTab(line) {
   const i = line.indexOf('\t');
   return i === -1 ? [line, ''] : [line.slice(0, i), line.slice(i + 1)];
@@ -136,10 +229,11 @@ export function parseChanges(nameStatus, statusPorcelain) {
 
 /**
  * Read-only pre-run snapshot of a workspace. Returns a git snapshot
- * { kind:'git', status, nameStatus, stat, dirty, changes } or a degraded
- * { kind:'no-git', reason, error } for non-repos / missing git. Never throws.
+ * { kind:'git', status, nameStatus, stat, dirty, changes }, an opted-in
+ * { kind:'filesystem-empty', entries } for an empty non-Git tree, or a degraded
+ * { kind:'no-git', reason, error } for other non-repos / missing Git. Never throws.
  */
-export async function captureWorkspaceBaseline({ cwd, git } = {}) {
+export async function captureWorkspaceBaseline({ cwd, git, allowEmptyNonGitDirectory = false } = {}) {
   const runner = git ?? defaultRunner;
   if (!cwd) return { kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace cwd is required' };
   const [status, nameStatus, stat] = await Promise.all([
@@ -147,8 +241,19 @@ export async function captureWorkspaceBaseline({ cwd, git } = {}) {
     runGit(runner, ['diff', '--name-status'], { cwd }),
     runGit(runner, ['diff', '--stat'], { cwd }),
   ]);
-  for (const r of [status, nameStatus, stat]) {
-    if (!r.ok) return { kind: 'no-git', reason: r.reason, error: r.error };
+  const results = [status, nameStatus, stat];
+  const failures = results.filter((result) => !result.ok);
+  if (failures.length > 0) {
+    const allExplicitlyNonGit = failures.length === results.length
+      && failures.every((result) => result.reason === NOT_A_GIT_REPOSITORY);
+    if (allExplicitlyNonGit && allowEmptyNonGitDirectory === true) {
+      const tree = await captureDirectoryEntries(cwd);
+      if (tree.ok && tree.regularFileCount === 0 && tree.linkOrSpecialCount === 0) {
+        return { kind: 'filesystem-empty', entries: tree.entries };
+      }
+    }
+    const failed = failures.find((result) => result.reason !== NOT_A_GIT_REPOSITORY) ?? failures[0];
+    return { kind: 'no-git', reason: failed.reason, error: failed.error };
   }
   const changes = parseChanges(nameStatus.stdout, status.stdout);
   return {
@@ -203,6 +308,15 @@ async function buildPatch(runner, { cwd, changes, limit }) {
 export async function captureWorkspaceDiff({ cwd, baseline, git, limit = DIFF_LIMIT } = {}) {
   const runner = git ?? defaultRunner;
   if (!cwd) return { kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace cwd is required' };
+  if (baseline?.kind === 'filesystem-empty') {
+    const tree = await captureDirectoryEntries(cwd);
+    if (!tree.ok) return { kind: 'no-git', reason: tree.reason, error: 'filesystem audit unavailable' };
+    return {
+      kind: 'filesystem-empty',
+      dirtyBaseline: false,
+      unchanged: JSON.stringify(tree.entries) === JSON.stringify(baseline.entries),
+    };
+  }
   if (!baseline || baseline.kind !== 'git') {
     return { kind: 'no-git', reason: baseline?.reason ?? NOT_A_GIT_REPOSITORY, error: baseline?.error };
   }