@ran-sh/dsh-crew 2.1.6 → 2.1.8

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.1.6",
+  "version": "2.1.8",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/docs/readiness-matrix.md

@@ -83,3 +83,22 @@ An evidence record may contain:
 ```
 
 The matrix does not fetch or trust arbitrary remote data by itself. Loading and authenticating an evidence source is the responsibility of the higher layer that calls the builder.
+
+`src/ci-evidence.mjs` is that layer for the `ci` rows. It resolves the running
+version's tag to the commit it was cut from, reads that commit's CI run, and
+evidences each platform row from its own job. Three things have to hold before a
+row may go green, because each is a way to look validated without being
+validated: the job's runner labels must name the platform the row claims (a job
+*name* is not a platform), the run must be one this repository pushed (a pull
+request carries its own workflow file, so its runs are not evidence), and the
+job itself must have concluded successfully. The commit is recorded in
+`evidence_ref` so `version → tag → commit` stays auditable. Nothing is read from
+or written to credentials: the public API is used anonymously.
+
+One limit belongs where a reader of a green row will meet it. The mapping starts
+from the version number, so the evidence describes the commit the matching tag
+points at. A payload installed with `update --candidate <dir>` can carry local
+edits that were never tagged while reporting the same version, and the row is
+then green for the tagged commit rather than for the tree that is running.
+`evidence_ref` names that commit, which is as much as this can honestly say
+until the payload records its own revision.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.1.6",
+  "version": "2.1.8",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/ci-evidence.mjs

@@ -8,10 +8,21 @@
 // network.
 //
 // It fails closed in every direction. A version with no tag, a tag whose commit
-// has no run, a run that did not succeed, a missing platform job, a timeout, an
-// HTTP error — all of them return no evidence at all, which leaves the CI rows
-// NOT_RUN. Promoting a row on anything less than a green run at the exact commit
-// being validated is the one failure this module exists to avoid.
+// has no run, a run this repository did not push, a missing platform job, a job
+// that did not pass, a job whose runner is not the platform its row claims, a
+// timeout, an HTTP error — all of them return no evidence at all, which leaves
+// the CI rows NOT_RUN. Promoting a row on anything less than a green run at the
+// exact commit being validated is the one failure this module exists to avoid.
+//
+// The mapping's limit, stated plainly: evidence is resolved *from the version
+// number*, so it describes the commit the matching tag points at. `dsh-crew
+// update --candidate <dir>` can install a tree that was never published while
+// reporting the same version — its local edits are not tagged, so this module
+// would present the tag's commit as the validated one. `evidence_ref` carries
+// that commit so a reader can see which commit the green run covered, but it
+// cannot see the running tree, and nothing here may claim otherwise. Widening
+// this would need the running tree's revision, which the payload does not
+// currently record.
 //
 // Authentication is optional and never required: the repository is public, so
 // the anonymous API answers. A token is used only when the caller already has
@@ -23,6 +34,10 @@ export const CI_EVIDENCE_REPO = 'Ran-sh/dsh-crew';
 // The row each CI job validates. A platform with no job in the workflow cannot
 // be evidenced by any run, so `macos_smoke` is deliberately absent rather than
 // listed and always missing.
+// `runner` is a gate, not a label. Matching on the job name alone would let a
+// job called `deterministic` that ran on a macOS runner evidence the *linux*
+// row, which is exactly the "looks validated, isn't" the matrix exists to
+// refuse; the job's own labels have to name the platform the row claims.
 const PLATFORM_JOBS = [
   { row: 'linux_deterministic', job: 'deterministic', runner: 'ubuntu' },
   { row: 'windows_regressions', job: 'windows-paths', runner: 'windows' },
@@ -30,6 +45,10 @@ const PLATFORM_JOBS = [
 ];
 
 const CACHE_TTL_MS = 10 * 60 * 1000;
+// Negative results expire sooner. Caching "nothing proven" for the full window
+// would let one transient network hiccup freeze a row at NOT_RUN for ten
+// minutes, and the cost of asking again is bounded by the deadline.
+const NEGATIVE_CACHE_TTL_MS = 60 * 1000;
 const cache = new Map();
 
 /** Test seam: drop memoized evidence between cases. */
@@ -55,8 +74,8 @@ function apiHeaders(token) {
 // route must not depend on the transport cooperating, so the request is also
 // raced against the clock. A fetch that ignores its signal then returns nothing
 // at the deadline instead of holding the route open.
-async function getJson(fetchImpl, url, { token, deadline }) {
-  const remaining = deadline - Date.now();
+async function getJson(fetchImpl, url, { token, deadline, now }) {
+  const remaining = deadline - now();
   if (remaining <= 0) return null;
   const controller = new AbortController();
   let timer;
@@ -83,14 +102,14 @@ async function getJson(fetchImpl, url, { token, deadline }) {
  * version with no tag resolves to null and no evidence is produced: the running
  * code is then not the code CI validated, and saying so is the honest answer.
  */
-async function resolveVersionCommit(fetchImpl, { repo, version, token, deadline }) {
+async function resolveVersionCommit(fetchImpl, { repo, version, token, deadline, now }) {
   const tag = `v${version}`;
-  const ref = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`, { token, deadline });
+  const ref = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`, { token, deadline, now });
   const object = ref?.object;
   if (!object) return null;
   if (object.type === 'commit' && typeof object.sha === 'string') return object.sha;
   if (object.type === 'tag' && typeof object.sha === 'string') {
-    const annotated = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/git/tags/${object.sha}`, { token, deadline });
+    const annotated = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/git/tags/${object.sha}`, { token, deadline, now });
     const sha = annotated?.object?.sha;
     return typeof sha === 'string' ? sha : null;
   }
@@ -103,7 +122,11 @@ function evidenceFor(jobs, { runId, sha }) {
     const match = jobs.find((entry) => entry?.name === job);
     if (!match) continue;
     if (String(match.conclusion ?? '').toLowerCase() !== 'success') continue;
-    const labels = Array.isArray(match.labels) ? match.labels.join(',') : '';
+    // The job's labels must name the platform the row claims. A name is not a
+    // platform, and a runner label that does not match is treated as no
+    // evidence at all rather than as evidence for the wrong row.
+    const labels = Array.isArray(match.labels) ? match.labels : [];
+    if (!labels.some((label) => String(label).toLowerCase().includes(runner))) continue;
     evidence[row] = {
       status: 'PASS',
       reason_code: 'CI_GREEN',
@@ -111,7 +134,7 @@ function evidenceFor(jobs, { runId, sha }) {
       // The commit is part of the reference on purpose: version -> tag -> commit
       // is a mapping, and the reader has to be able to audit which commit the
       // green run actually covered.
-      evidence_ref: `run-${runId}/${job}/${runner}@${String(sha).slice(0, 12)}${labels ? ` (${labels})` : ''}`,
+      evidence_ref: `run-${runId}/${job}/${runner}@${String(sha).slice(0, 12)}${labels.length ? ` (${labels.join(',')})` : ''}`,
     };
   }
   return evidence;
@@ -133,30 +156,41 @@ export async function loadCiEvidence({
   if (typeof version !== 'string' || version.trim() === '') return {};
   if (typeof fetchImpl !== 'function') return {};
 
-  const key = `${repo}@${version.trim()}`;
+  // The credential is part of the key: an anonymous result produced under a
+  // rate limit must not be served to a call that offered a token.
+  const key = `${repo}@${version.trim()}@${typeof token === 'string' && token.trim() !== '' ? 'auth' : 'anon'}`;
   const hit = cache.get(key);
-  if (useCache && hit && now() - hit.at < CACHE_TTL_MS) return hit.evidence;
+  if (useCache && hit) {
+    const ttl = Object.keys(hit.evidence).length > 0 ? CACHE_TTL_MS : NEGATIVE_CACHE_TTL_MS;
+    if (now() - hit.at < ttl) return hit.evidence;
+  }
 
   const deadline = now() + timeoutMs;
-  const evidence = await loadUncached({ repo, version: version.trim(), token, fetchImpl, deadline });
+  const evidence = await loadUncached({ repo, version: version.trim(), token, fetchImpl, deadline, now });
   cache.set(key, { at: now(), evidence });
   return evidence;
 }
 
-async function loadUncached({ repo, version, token, fetchImpl, deadline }) {
-  const sha = await resolveVersionCommit(fetchImpl, { repo, version, token, deadline });
+async function loadUncached({ repo, version, token, fetchImpl, deadline, now }) {
+  const sha = await resolveVersionCommit(fetchImpl, { repo, version, token, deadline, now });
   if (!sha) return {};
 
-  const runs = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/actions/runs?head_sha=${sha}&per_page=20`, { token, deadline });
+  const runs = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/actions/runs?head_sha=${sha}&per_page=20`, { token, deadline, now });
   const list = Array.isArray(runs?.workflow_runs) ? runs.workflow_runs : [];
-  // The newest CI run for this commit, and each row judged by its own job. The
-  // run's overall conclusion is deliberately not a gate: one platform's red job
-  // must not withdraw another platform's evidence, and each row asks only
-  // whether *its* validation ran and passed.
-  const ciRun = list.find((run) => run?.name === 'CI');
+  // The newest CI run for this commit, and each row judged by its own job.
+  //
+  // The run's overall conclusion is deliberately not a gate: one platform's red
+  // job must not withdraw another platform's evidence, and each row asks only
+  // whether *its* validation ran and passed. The run's *identity* is a gate
+  // though. A workflow is matched by name, and a name is not an identity — a
+  // pull request can carry a workflow file of its own, so a run this repository
+  // did not push, or one belonging to a fork, is not accepted as evidence.
+  const ciRun = list.find((run) => run?.name === 'CI'
+    && String(run?.event ?? '').toLowerCase() === 'push'
+    && run?.head_repository?.full_name === repo);
   if (!ciRun) return {};
 
-  const jobsBody = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/actions/runs/${ciRun.id}/jobs?per_page=50`, { token, deadline });
+  const jobsBody = await getJson(fetchImpl, `https://api.github.com/repos/${repo}/actions/runs/${ciRun.id}/jobs?per_page=50`, { token, deadline, now });
   const jobs = Array.isArray(jobsBody?.jobs) ? jobsBody.jobs : [];
   return evidenceFor(jobs, { runId: ciRun.id, sha });
 }

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.1.6';
+export const RUNTIME_VERSION = '2.1.8';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/workflow-runtime.mjs

@@ -408,9 +408,7 @@ export function createWorkflowRuntime(adapters, {
           source: job.source,
           model_class_hint: job.model_class_hint,
           escalation_reason: escalationReason,
-          onAttemptStarted: (actualId) => {
-            if (typeof actualId === 'string' && actualId) job.current_attempt_id = actualId;
-          },
+          onAttemptStarted: (actualId) => adoptAttemptId(job, actualId),
         });
         job.current_attempt_id = null;
         if (job.cancelling) { await cancelWorkflow(job); return; }
@@ -602,9 +600,7 @@ export function createWorkflowRuntime(adapters, {
       source: job.source,
       model_class_hint: 'pro',
       escalation_reason: null,
-      onAttemptStarted: (actualId) => {
-        if (typeof actualId === 'string' && actualId) job.current_attempt_id = actualId;
-      },
+      onAttemptStarted: (actualId) => adoptAttemptId(job, actualId),
     });
     job.current_attempt_id = null;
     const attemptView = { ...attemptRecord(ar, 0), phase: 'review' };
@@ -665,6 +661,31 @@ export function createWorkflowRuntime(adapters, {
       : `${workflowId}-a${suffix || '0'}`;
   }
 
+  /**
+   * Record the id the executor actually started, and honour a cancel that
+   * arrived while it was still being dispatched.
+   *
+   * `cancelWorkflow` can only stop what `current_attempt_id` names. During
+   * dispatch that is the workflow-scoped placeholder, which the transport does
+   * not recognise as a runnable attempt, so a cancel landing in that window
+   * stops nothing — and the job the executor starts a moment later runs to
+   * completion while the workflow reports itself cancelled. Re-cancelling after
+   * the attempt returns does not help: `cancelWorkflow` returns the promise it
+   * already made. This is the one moment the real id becomes known, so the
+   * cancel that already happened is applied here.
+   */
+  function adoptAttemptId(job, actualId) {
+    if (typeof actualId !== 'string' || actualId === '') return;
+    job.current_attempt_id = actualId;
+    if (!job.cancelling) return;
+    try {
+      Promise.resolve(adapters.cancelAttempt?.(actualId)).catch(() => {});
+    } catch {
+      // A transport that throws synchronously is still a cancel that did not
+      // land; the workflow's own terminal state is unchanged by it.
+    }
+  }
+
   function cancelWorkflow(job) {
     if (job.cancelPromise) return job.cancelPromise;
     if (job.status !== 'running') return;