@ran-sh/dsh-crew 2.1.3 → 2.1.5

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/scripts/verify-history-ui.mjs

@@ -10,6 +10,7 @@ import { Readable } from 'node:stream';
 import { createHistoryService } from '../src/history/service.mjs';
 import { registerHistoryHttp } from '../src/history/http.mjs';
 import { runHistoryOperation } from '../src/history/operation.mjs';
+import { CREW_SESSIONS_REL } from '../src/install/crew-paths.mjs';
 
 const require = createRequire(import.meta.url);
 const { chromium } = require(process.env.CREW_PLAYWRIGHT_MODULE || 'playwright');
@@ -17,8 +18,8 @@ const repo = dirname(dirname(fileURLToPath(import.meta.url)));
 const root = mkdtempSync(join(tmpdir(), 'crew-history-e2e-'));
 const output = mkdtempSync(join(tmpdir(), 'crew-history-ui-shots-'));
 mkdirSync(join(root, 'harness/storages'), { recursive: true });
-mkdirSync(join(root, 'harness/sessions/example/session-test'), { recursive: true });
-const file = join(root, 'harness/sessions/example/session-test/session.jsonl');
+mkdirSync(join(root, CREW_SESSIONS_REL, 'example/session-test'), { recursive: true });
+const file = join(root, CREW_SESSIONS_REL, 'example/session-test/session.jsonl');
 writeFileSync(file, 'DISPOSABLE TEST CONVERSATION');
 writeFileSync(join(root, 'harness/storages/workspace.json'), JSON.stringify({ unit: { name: 'workspace', version: 2 }, global: { initialized: true, workspaceIds: ['test-workspace'], archivedSessionIds: [] }, tables: { workspaces: { 'test-workspace': { path: '/example/project', title: 'Disposable workspace', createdAt: '2026-01-01T00:00:00Z', updatedAt: '2026-01-01T00:00:00Z', sessionIds: ['session-test'] } } } }));
 const errors = []; let stopped = false; let operationPromise;

package/src/history/archive-store.mjs

@@ -2,6 +2,8 @@ import { createHash, randomUUID } from 'node:crypto';
 import { closeSync, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 
+import { CREW_SESSIONS_REL } from '../install/crew-paths.mjs';
+
 const WORKSPACE = 'harness/storages/workspace.json';
 const LIMIT = 512 * 1024 * 1024;
 const hash = bytes => createHash('sha256').update(bytes).digest('hex');
@@ -31,7 +33,8 @@ function pathInside(root, relativePath) {
 // `session.vN.jsonl` (N >= 1) after that, each optionally zstd-compressed.
 // Sharing the shape between the inventory and the archive guard keeps both in
 // step when the backend's naming changes.
-export const SESSION_ARTIFACT_PATTERN = /^harness\/sessions\/[^/]+\/[^/]+\/session(?:\.v[1-9][0-9]*)?\.jsonl(?:\.zstd)?$/;
+const SESSION_ARTIFACT_DIR = CREW_SESSIONS_REL.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+export const SESSION_ARTIFACT_PATTERN = new RegExp(`^${SESSION_ARTIFACT_DIR}/[^/]+/[^/]+/session(?:\\.v[1-9][0-9]*)?\\.jsonl(?:\\.zstd)?$`);
 
 export function isSessionArtifactPath(relativePath, sessionId) {
   return typeof relativePath === 'string'
@@ -130,7 +133,7 @@ async function requireStopped(assertStopped) {
  * drop its workspace while leaving the artifact behind.
  */
 function presentSessionIds(root) {
-  const sessionsRoot = pathInside(root, 'harness/sessions');
+  const sessionsRoot = pathInside(root, CREW_SESSIONS_REL);
   let projects;
   try { projects = readdirSync(sessionsRoot, { withFileTypes: true }); } catch { return new Set(); }
   if (projects.length > 20000) fail('INVALID_FILE');

package/src/history/operation.mjs

@@ -57,11 +57,11 @@ export async function runHistoryOperation({ crewRoot, id, acquire, release, supe
     if (!alreadyStarted) {
       if (!recover || await assertStopped(state) !== true) await checkFence(state);
       save('STOPPING');
-      // `refresh_frontend`: this operation rewrites `storages/workspace.json`,
+      // `refreshFrontend`: this operation rewrites `storages/workspace.json`,
       // which the Crew-managed frontend on 3080 shares, so the launcher stops
       // that server for the same window and starts it again afterwards. The npx
       // lifecycle stops only 3210, because a tree swap leaves that file alone.
-      const stopped = await supervisor.stopOwnedBackend({ lease: state.lease, runtimeId: state.runtimeId, refresh_frontend: true });
+      const stopped = await supervisor.stopOwnedBackend({ lease: state.lease, runtimeId: state.runtimeId, refreshFrontend: true });
       if (!stopped?.ok || await assertStopped(state) !== true) throw Error('HISTORY_STOP_NOT_VERIFIED');
       const archiveId = state.operation === 'restore' ? state.archiveId : state.id;
       const manifestFile = historyPath(crewRoot, `history/transactions/${archiveId}/manifest.json`);

package/src/information-flow.mjs

@@ -26,6 +26,30 @@ function tests(values) {
   });
 }
 
+/**
+ * The pointer to the reviewed attempt's persisted execution record.
+ *
+ * Only a pointer: the record itself is far too large to embed, and the reviewer
+ * is expected to open it in the workspace it already has. It is emitted only
+ * when the runtime could resolve both halves, so a transport that cannot name
+ * the store degrades to the previous capsule instead of printing a dead path.
+ */
+function executionRecordLines(evidence) {
+  const sessionId = evidence?.sessionId;
+  const root = evidence?.root;
+  if (typeof sessionId !== 'string' || sessionId.trim() === '') return [];
+  if (typeof root !== 'string' || root.trim() === '') return [];
+  return [
+    '',
+    'Persisted execution record:',
+    `session: ${sessionId}`,
+    `store: ${root}`,
+    `The record is the directory named "${sessionId}", one workspace level below that store. Read the session journal inside it — \`session.jsonl\` or a versioned \`session.v*.jsonl\`, possibly \`.zstd\`-compressed — and take your evidence from its \`tool/result\` entries: those hold the exact bytes a \`write\` produced (including a file that was later deleted) and the recorded output and exit code of every command that ran.`,
+    'The journal is written as concatenated zstd frames, so a single-frame decompressor returns only the header; split it on the zstd magic 28 B5 2F FD and decompress each slice.',
+    'This is the original execution, not a re-enactment. When the work was transient — created, run and removed before this review — this record is the only account of it, and a reproduction you run yourself cannot stand in for it: say so plainly and mark anything the record does not settle as NOT RUN rather than substituting an equivalent check.',
+  ];
+}
+
 /** Build the automatic-review context capsule. */
 export function buildReviewTask(task, view = {}, { strictness = 'standard' } = {}) {
   const outcome = view?.outcome ?? {};
@@ -60,6 +84,7 @@ export function buildReviewTask(task, view = {}, { strictness = 'standard' } = {
     ...list(changedFiles, { count: 80, itemLimit: 500 }),
     '',
     'Inspect the candidate directly in the current isolated workspace. Use git diff against the base revision and open only the files needed for review. The worker\'s raw prose and full patch are intentionally not embedded in this hand-off.',
+    ...executionRecordLines(view?.evidence),
     '',
     'Report: 1) whether the implementation satisfies the objective, 2) concrete bugs/style/security risks, 3) suggested fixes. End with ## Review Findings / ## Evidence / ## Risks / ## Verdict (approved | needs changes | rejected).',
   ];

package/src/install/crew-paths.mjs

@@ -10,12 +10,26 @@
 // installer was right.
 
 import { existsSync, realpathSync } from 'node:fs';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 
 export const CREW_PROFILE_NAME = 'dsh-crew';
 export const CREW_HOME_REL = join('.config', 'dsh-crew', 'harness');
 
+/**
+ * The Harness session store, as a POSIX path relative to the Crew root (the
+ * parent of the Harness home).
+ *
+ * Two very different readers need this fact in different shapes: `archive-store`
+ * walks it relative to the Crew root to prove a session artifact is really gone
+ * before history is deleted, and it also compiles the artifact path into a
+ * regular expression, while `crewHarnessSessionsDir` resolves it to an absolute
+ * path for the reviewer's evidence pointer. It is one literal here so those can
+ * not drift apart — a divergence would either mis-target a deletion or hand a
+ * reviewer a path that does not exist.
+ */
+export const CREW_SESSIONS_REL = 'harness/sessions';
+
 export function crewDshHome({ home = homedir() } = {}) {
   return join(home, CREW_HOME_REL);
 }
@@ -24,6 +38,20 @@ export function crewProfileDir({ home = homedir() } = {}) {
   return join(crewDshHome({ home }), 'profiles', CREW_PROFILE_NAME);
 }
 
+/**
+ * Where the Harness persists its session records (`harness/sessions`).
+ *
+ * This is the only durable record of what an attempt actually executed: the
+ * `tool/result` entries carry the exact file contents a `write` produced and the
+ * captured stdout, stderr and exit code of every command. A reviewer that has to
+ * judge a transient change — work that was created, run and then removed before
+ * the review started — has nothing left in the workspace to inspect, so this is
+ * the evidence it must read instead of trusting the worker's summary of it.
+ */
+export function crewHarnessSessionsDir({ home = homedir() } = {}) {
+  return join(dirname(crewDshHome({ home })), CREW_SESSIONS_REL);
+}
+
 // The profile's `node_modules/<name>` entry for the installed package. The
 // registration points this at the live release, so it is stable across
 // upgrades while the release path underneath it is not.

package/src/job-contracts.mjs

@@ -82,8 +82,13 @@ function evidenceStatus(view) {
   if (view?.status === 'failed' || view?.phase === 'failed' || view?.outcome?.execution_status === 'failed') return 'FAIL';
   if (view?.review?.verdict === 'request_changes' || view?.outcome?.task_status === 'partial') return 'PARTIAL';
   if (view?.outcome?.task_status === 'blocked') return 'BLOCKED';
-  if (view?.role === 'reviewer' && view?.outcome == null) {
-    return view.status === 'done' && view.review?.status === 'done'
+  // A reviewer is judged by its verdict, whether or not an outcome was built for
+  // it. Keying this branch on `outcome == null` meant the hub — which always
+  // builds one — took the generic path below, where a complete review contract
+  // was enough for PASS even when the verdict was `inconclusive`. The review
+  // verdict is the reviewer's whole product, so it is what has to be approving.
+  if (view?.role === 'reviewer' && view.review) {
+    return view.status === 'done' && view.review.status === 'done'
       && view.review.verdict === 'approve' && view.review.delivery_complete === true
       && view.review.mutated_candidate !== true ? 'PASS' : 'PARTIAL';
   }

package/src/mcp-runtime.mjs

@@ -18,6 +18,7 @@ import {
 } from './workspace-isolation.mjs';
 import { startJob, waitJob, jobView, cancelJob } from './jobs.mjs';
 import { hub } from './hub-client.mjs';
+import { crewHarnessSessionsDir } from './install/crew-paths.mjs';
 
 const SESSION_CONFIG_KEYS = [
   'default_tier', 'default_effort', 'mode', 'default_timeout_seconds',
@@ -155,6 +156,10 @@ export function attemptFromView(view, spec) {
     provider: view?.provider ?? null,
     model: view?.model ?? null,
     execution_context: view?.execution_context ?? null,
+    // The Hub's own session id for this attempt. It is the key to the attempt's
+    // persisted execution record, which is what lets a later reviewer read the
+    // raw tool results instead of trusting the worker's summary of them.
+    session_id: view?.sessionId ?? null,
     selection_source: source,
     selection_trace: selectionTrace,
     status: view?.status ?? 'failed',
@@ -339,6 +344,10 @@ export function buildMcpWorkflowRuntime(deps) {
       captureCandidate,
       releaseWorkspace,
       buildReviewTask,
+      // Where the Harness writes session records. The automatic review needs it
+      // to point the reviewer at the worker's raw execution evidence; without it
+      // the reviewer can only re-read the worker's own summary of what ran.
+      evidenceRoot: () => crewHarnessSessionsDir(),
       getConfig,
       getRuntimeControls,
     },

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.1.3';
+export const RUNTIME_VERSION = '2.1.5';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/workflow-runtime.mjs

@@ -508,7 +508,19 @@ export function createWorkflowRuntime(adapters, {
         if (decision.step === 'review') {
           transition(job, JOB_PHASES.REVIEWING, 'automatic review');
           const before = job.candidate;
-          const reviewTask = adapters.buildReviewTask(job.original_task, { outcome, candidate: job.candidate ?? null }, { strictness: job.review_strictness ?? 'standard' });
+          // The reviewed attempt's own persisted execution record. The capsule
+          // already carries the worker's *summary* of what it ran; this is the
+          // handle to what it actually ran, which is the only thing that lets the
+          // reviewer check a transient workspace that no longer holds the work.
+          const reviewed = [...job.attempts].reverse().find((a) => a.role !== 'reviewer');
+          const reviewTask = adapters.buildReviewTask(job.original_task, {
+            outcome,
+            candidate: job.candidate ?? null,
+            evidence: {
+              sessionId: reviewed?.session_id ?? null,
+              root: adapters.evidenceRoot?.() ?? null,
+            },
+          }, { strictness: job.review_strictness ?? 'standard' });
           const review = await runReviewerAttempt(job, reviewTask, config, before, job.execution_cwd, job.base_revision);
         if (job.cancelling) { await cancelWorkflow(job); return; }
           job.review = review;
@@ -633,6 +645,7 @@ export function createWorkflowRuntime(adapters, {
       provider: ar.provider ?? null,
       model: ar.model ?? null,
       execution_context: ar.execution_context ?? null,
+      session_id: ar.session_id ?? null,
       selection_source: ar.selection_source ?? null,
       selection_trace: ar.selection_trace ?? null,
       status: ar.status ?? 'failed',

package/src/workflow.mjs

@@ -172,8 +172,27 @@ export function buildOutcome({ result = '', deliveryMeta, executionStatus, stopR
   const parsed = parseDeliveryReport(result);
   // The aggregate status and the visible entries come from one parse, so they can
   // no longer disagree about whether the Tests section is evidence.
-  const parsedTests = parseTestsSection(parsed.sections.Tests);
-  const testsStatus = parsedTests.status ?? parsed.tests_status ?? deliveryMeta?.tests_status;
+  //
+  // `parseDeliveryReport` already decided which contract this message answered —
+  // it reads the format off the headings that are present, and only a coding
+  // report has a Tests obligation. A review report has no Tests rule, so a
+  // reviewer that also lists what it checked under `## Tests` is describing its
+  // own coverage; reading those rows with the worker's rule made an honest
+  // `NOT RUN — <check> — <reason>`, which is exactly the answer the contract asks
+  // for when something cannot be verified, downgrade the reviewer to `partial`
+  // and surface `TESTS_NOT_RUN`. The role was penalised for the disclosure the
+  // contract requires, so the coding Tests rule now applies only to coding
+  // reports. The format decision stays in one place: this consumes it.
+  const reviewReport = parsed.format === 'review';
+  const parsedTests = reviewReport
+    ? { valid: false, status: undefined, tests: [] }
+    : parseTestsSection(parsed.sections.Tests);
+  // `deliveryMeta` is the same report read a second way, so for a review it can
+  // only reintroduce the verdict the gate above just dropped. It is a fallback
+  // for coding reports, not a way around the format gate.
+  const testsStatus = reviewReport
+    ? undefined
+    : (parsedTests.status ?? parsed.tests_status ?? deliveryMeta?.tests_status);
   const tests = parsedTests.tests;
   const execStatus = executionStatus ?? (stopReason === 'completed' ? 'completed' : 'failed');
   return {