@ran-sh/dsh-crew 2.2.0 → 2.2.1

package/src/install/npx-lifecycle.mjs

@@ -44,9 +44,10 @@ import { samePayloadContent, capturePayloadContent } from './payload-content.mjs
 import { crewDshHome, crewProfileDir, claudeIntegrationLine } from './install.mjs';
 import { releaseClaimsState } from '../release-in-use.mjs';
 import { compareProcessToken, processStartToken } from '../process-identity.mjs';
+import { RELEASE_COHORT_FILENAME } from '../dsh-cohort.mjs';
 import { renameTree } from './tree-move.mjs';
 import { checkRuntimeAdvance, normalizeRuntimeState, runtimeStateMayHaveStarted } from './runtime-lifecycle.mjs';
-import { ensureCrewDshRuntime, ensureCrewPluginRegistration, removeCrewPluginRegistration, migrateCrewDshRuntime, installDshInto, restoreRetainedRuntime, crewDshRuntimeRoot, payloadDshVersion, TARGET_DSH_VERSION } from '../dsh-cli-runtime.mjs';
+import { ensureCrewDshRuntime, ensureCrewPluginRegistration, removeCrewPluginRegistration, migrateCrewDshRuntime, installDshInto, restoreRetainedRuntime, crewDshRuntimeRoot, payloadDshVersion, gcRetainedRuntimes, TARGET_DSH_VERSION } from '../dsh-cli-runtime.mjs';
 import {
   ensureOfficialWebIntegration,
   officialWebIntegrationStatus,
@@ -61,15 +62,15 @@ import {
 } from './windows-supervisor-adapter.mjs';
 
 export const CREW_APP_DIRNAME = 'app';
-export const RELEASES_DIRNAME = 'releases';
-export const CURRENT_POINTER_FILENAME = 'current.json';
-export const KEEP_RELEASES = 2;
+const RELEASES_DIRNAME = 'releases';
+const CURRENT_POINTER_FILENAME = 'current.json';
+const KEEP_RELEASES = 2;
 export const INCOMPLETE_MARKER = '.dsh-crew-incomplete';
 const CREW_ROUTE_BASE = '/_dsh/dsh-crew';
 // Exact DSH cohort version: dotted numeric with optional -prerelease suffix.
 // Anything else (ranges, "../..", paths) is NOT an authorized cohort value
 // and must never reach rename/rmSync authority via retained-runtimes keys.
-export const EXACT_DSH_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const EXACT_DSH_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 
 export function npmCliInvocation(args, {
   platform = process.platform,
@@ -242,8 +243,8 @@ function writeCurrentPointer({ home, name, version, path }) {
   return pointer;
 }
 
-export const UPDATE_JOURNAL_FILENAME = 'update-journal.json';
-export const UPDATE_LOCK_FILENAME = 'update-in-progress.lock';
+const UPDATE_JOURNAL_FILENAME = 'update-journal.json';
+const UPDATE_LOCK_FILENAME = 'update-in-progress.lock';
 
 export function updateJournalFile({ home = homedir() } = {}) {
   return join(crewAppRoot({ home }), UPDATE_JOURNAL_FILENAME);
@@ -453,7 +454,7 @@ function writeUpdateJournal({ home, stage, prior = null, candidate = null, verif
 // identity matches the expected stage/prior/candidate. A crash between
 // verification success and this write leaves the journal unverified, so
 // reconcile refuses to finalize it.
-export function markJournalVerified({ home = homedir(), stage, prior = null, candidate = null, runtime = null } = {}) {
+function markJournalVerified({ home = homedir(), stage, prior = null, candidate = null, runtime = null } = {}) {
   const current = readUpdateJournal({ home });
   if (!current || current.malformed) return { ok: false, code: 'JOURNAL_NOT_FOUND' };
   const same = (a, b) => JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
@@ -481,82 +482,6 @@ function compensateActivationSync({ home, prior, manifest, log, installer }) {
   return { ok: true, version: manifest.version, path: prior.path };
 }
 
-// Undo a first-install candidate's activation surfaces: remove its profile
-// registration (dependency + bundle + junction) ONLY when each surface
-// still references THIS journal's candidate. The dependency must resolve
-// to exactly link:<candidateRealPath> (normalized slashes); a later
-// legitimate registration pointing elsewhere is never removed. Mixed or
-// unjudgeable state fails closed with the journal retained. When the
-// profile manifest is missing/unreadable the junction is still handled
-// independently so a "junction created, manifest never written" crash
-// cannot leave a dangling junction.
-function undoCandidateActivationSync({ home, candidateDir, candidateName }) {
-  if (!candidateDir || !candidateName) return { ok: true, undone: false };
-  const profileRoot = crewProfileDir({ home });
-  const profileFile = join(profileRoot, 'package.json');
-  let manifest = null;
-  let manifestReadable = true;
-  try { manifest = JSON.parse(readFileSync(profileFile, 'utf8')); } catch { manifest = null; manifestReadable = false; }
-  const linkPath = join(profileRoot, 'node_modules', ...candidateName.split('/'));
-  let linked = null;
-  try {
-    if (lstatSync(linkPath).isSymbolicLink()) linked = realpathSync(linkPath);
-  } catch { linked = null; }
-  let candidateReal = null;
-  try { candidateReal = realpathSync(candidateDir); } catch { candidateReal = candidateDir; }
-  const expectedDep = `link:${String(candidateReal).replace(/\\/g, '/')}`;
-  const rawDep = manifest?.dependencies?.[candidateName];
-  const depPointsAtCandidate = typeof rawDep === 'string'
-    && rawDep.replace(/\\/g, '/') === expectedDep;
-  const bundleNamesCandidate = Array.isArray(manifest?.dsh?.profile?.bundles) && manifest.dsh.profile.bundles.includes(candidateName);
-  const linkPointsAtCandidate = linked !== null && linked === candidateReal;
-  // Bundle carries no path: it NEVER grants deletion authority by itself.
-  // It is removed only when dependency or junction proves THIS journal's
-  // candidate still owns the registration. A re-pointed dep/junction with
-  // a leftover same-name bundle fails closed (journal retained).
-  const identityEvidence = depPointsAtCandidate || linkPointsAtCandidate;
-  const bundlePointsAtCandidate = bundleNamesCandidate && identityEvidence;
-  // Manifest unreadable but junction dangles at candidate: remove junction.
-  if (!manifestReadable) {
-    if (!linkPointsAtCandidate) return { ok: true, undone: false };
-    try { rmSync(linkPath, { force: true }); } catch (error) {
-      return { ok: false, code: 'CANDIDATE_UNDO_FAILED', error: String(error?.message ?? error) };
-    }
-    return { ok: true, undone: true };
-  }
-  if (!manifest) return { ok: true, undone: false };
-  // Same-name package re-pointed elsewhere (dep or junction references a
-  // different target) while the bundle still names it: mixed state that
-  // cannot prove THIS candidate owns the registration. Fail closed,
-  // retain the journal for operator inspection.
-  const depPointsElsewhere = typeof rawDep === 'string' && !depPointsAtCandidate;
-  const linkPointsElsewhere = linked !== null && !linkPointsAtCandidate;
-  if ((depPointsElsewhere || linkPointsElsewhere) && bundleNamesCandidate) {
-    return { ok: false, code: 'CANDIDATE_UNDO_AMBIGUOUS', error: 'same-name package re-pointed elsewhere; refusing bundle removal' };
-  }
-  if (!depPointsAtCandidate && !bundlePointsAtCandidate && !linkPointsAtCandidate) {
-    return { ok: true, undone: false };
-  }
-  // Partial registration: only undo the surfaces that reference THIS
-  // candidate; leave anything already re-pointed elsewhere untouched.
-  try {
-    const next = { ...manifest };
-    if (depPointsAtCandidate) {
-      next.dependencies = { ...manifest.dependencies };
-      delete next.dependencies[candidateName];
-      if (Object.keys(next.dependencies).length === 0) delete next.dependencies;
-    }
-    if (bundlePointsAtCandidate) {
-      next.dsh = { ...manifest.dsh, profile: { ...manifest.dsh.profile, bundles: manifest.dsh.profile.bundles.filter((b) => b !== candidateName) } };
-    }
-    writeFileAtomic(profileFile, JSON.stringify(next, null, 2) + '\n');
-    if (linkPointsAtCandidate) rmSync(linkPath, { force: true });
-  } catch (error) {
-    return { ok: false, code: 'CANDIDATE_UNDO_FAILED', error: String(error?.message ?? error) };
-  }
-  return { ok: true, undone: true };
-}
-
 // Canonical containment validation for a journal's runtime segment. Recovery
 // may rename/recursively-delete these roots, so liveRoot and retainedRoot
 // must be EXACTLY the canonical Crew-owned paths (resolved, never a suffix
@@ -760,6 +685,7 @@ export async function reconcileUpdateJournal({ home = homedir(), log = () => {},
     }
     clearUpdateJournal({ home });
     gcOldReleases({ home, protect: journal.prior?.path ?? null });
+    gcRetainedCohorts({ home });
     log(`- recovered update journal at stage ${journal.stage}: candidate ${candidateIdent.version} already committed, finalized`);
     return { ok: true, reconciled: true, stage: journal.stage, committed: true };
   }
@@ -803,6 +729,7 @@ export async function reconcileUpdateJournal({ home = homedir(), log = () => {},
     writeCurrentPointer({ home, name: candidateIdent.name, version: candidateIdent.version, path: candidateDir });
     clearUpdateJournal({ home });
     gcOldReleases({ home, protect: journal.prior?.path ?? null });
+    gcRetainedCohorts({ home });
     log(`- recovered update journal at stage ${journal.stage}: candidate ${candidateIdent.version} was verified and started, so the commit was completed`);
     return { ok: true, reconciled: true, stage: journal.stage, committed: true };
   }
@@ -1304,15 +1231,48 @@ export function commitActivatedRelease({ stageDir, manifest, home, prior = null
   writeCurrentPointer({ home, name: manifest.name, version: manifest.version, path: stageDir });
   clearUpdateJournal({ home });
   gcOldReleases({ home, protect: prior?.path ?? null });
+  gcRetainedCohorts({ home });
   return stageDir;
 }
 
-function commitStagedRelease({ stageDir, manifest, home, prior = null }) {
-  return commitActivatedRelease({ stageDir, manifest, home, prior });
-}
-
 const STALE_INCOMPLETE_MS = 24 * 60 * 60 * 1000;
 
+// A retained runtime cohort is needed only while some surviving release
+// resolves to it, so this runs next to release pruning at the commit points
+// that call gcOldReleases: dropping a release is what stops its cohort being
+// pinned. Resolution goes through resolveReleaseCohort, the same chain every
+// other caller uses (manifest pin, then the release-cohort.json sidecar), so a
+// release that names its cohort only in the sidecar keeps its runtime.
+//
+// Fail closed: the cohort set is trusted only when EVERY directory under
+// releases/ resolved, because "nothing pins it" and "could not tell" must not
+// prune the same way. Pruning is best-effort on top of that — it must never
+// turn an update that already committed its pointer into a failed one.
+//
+// performCoordinatedCohortUpdate commits without gcOldReleases and is
+// deliberately not covered here either; its prior tree is still the rollback
+// target at that point.
+function gcRetainedCohorts({ home }) {
+  try {
+    const releasesDir = crewReleasesDir({ home });
+    if (!existsSync(releasesDir)) return [];
+    const entries = readdirSync(releasesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory());
+    const cohorts = [];
+    for (const entry of entries) {
+      const resolved = resolveReleaseCohort({ releaseDir: join(releasesDir, entry.name) });
+      if (!resolved.ok) {
+        process.emitWarning(`dsh-crew: release "${entry.name}" does not resolve to an exact cohort (${resolved.code ?? 'unknown'}); skipping retained-runtime pruning this pass`);
+        return [];
+      }
+      cohorts.push(resolved.dshVersion);
+    }
+    return gcRetainedRuntimes({ home, cohorts });
+  } catch (error) {
+    process.emitWarning(`dsh-crew: retained-runtime pruning skipped: ${error?.message ?? error}`);
+    return [];
+  }
+}
+
 function gcOldReleases({ home, keep = KEEP_RELEASES, protect = null }) {
   const pointer = readCurrentPointer({ home });
   const releasesDir = crewReleasesDir({ home });
@@ -1362,7 +1322,7 @@ function gcOldReleases({ home, keep = KEEP_RELEASES, protect = null }) {
   return removed;
 }
 
-export function listManagedReleases({ home = homedir() } = {}) {
+function listManagedReleases({ home = homedir() } = {}) {
   const pointer = readCurrentPointer({ home });
   const root = crewReleasesDir({ home });
   if (!existsSync(root)) return [];
@@ -1390,7 +1350,7 @@ export function listManagedReleases({ home = homedir() } = {}) {
 // Windows supervisor executes it and writes a VERIFIED result. This polls
 // until the result arrives (or the timeout elapses). NEVER talks to the
 // legacy 3080 supervisor endpoint.
-export async function requestCrewRuntimeRestart({
+async function requestCrewRuntimeRestart({
   reason = null,
   fetchImpl = globalThis.fetch,
   pollIntervalMs = 1_000,
@@ -1442,18 +1402,6 @@ export async function requestCrewRuntimeRestart({
   }
 }
 
-async function restartOwnedRuntime(fetchImpl = globalThis.fetch) {
-  return requestCrewRuntimeRestart({ fetchImpl, reason: 'lifecycle restart' });
-}
-
-async function verifyRuntimeVersion(version, fetchImpl = globalThis.fetch) {
-  const response = await fetchImpl('http://127.0.0.1:3210/_dsh/dsh-crew/runtime', { headers: { accept: 'application/json' } });
-  const body = await response.json();
-  return response.ok && body?.ok === true && body.runtime_version === version
-    ? { ok: true, runtime_version: body.runtime_version }
-    : { ok: false, code: 'RUNTIME_VERSION_MISMATCH' };
-}
-
 // Cohort verifier: compares the TARGET DSH cohort against the Hub's
 // dsh_version domain (the installed @deepseek-ai/dsh package), NEVER
 // against Crew's own runtime_version (the dsh-crew release). A null
@@ -1509,7 +1457,7 @@ export async function verifyCrewRuntimeIdentity(version, fetchImpl = globalThis.
 // AND the expected DSH cohort (dsh_version domain), alongside full 3210
 // identity. A stale old-Crew process on the right cohort (or vice versa)
 // fails closed instead of reporting rollback success.
-export async function verifyRollbackTarget({ crewVersion, dshVersion, fetchImpl = globalThis.fetch } = {}) {
+async function verifyRollbackTarget({ crewVersion, dshVersion, fetchImpl = globalThis.fetch } = {}) {
   let body = null;
   try {
     const response = await fetchImpl('http://127.0.0.1:3210/_dsh/dsh-crew/extension', { headers: { accept: 'application/json' } });
@@ -1910,10 +1858,10 @@ async function finishLifecycleAfterUpdateLock({
 // Lifecycle-owned cohort sidecar for a managed release directory. Historical
 // releases (pre-1.0.4) do not pin @deepseek-ai/dsh in their immutable
 // manifest; this records the cohort fact the lifecycle observed for them.
-const cohortFile = (releaseDir) => join(releaseDir, 'release-cohort.json');
+const cohortFile = (releaseDir) => join(releaseDir, RELEASE_COHORT_FILENAME);
 
 // Exact DSH cohort version helper: delegates to the module-level regex.
-export function isExactDshVersion(value) {
+function isExactDshVersion(value) {
   return typeof value === 'string' && EXACT_DSH_VERSION_RE.test(value);
 }
 
@@ -2242,7 +2190,7 @@ function registrationHealthy({ home, name, releaseDir }) {
  * config resolution. Package-manager children must see the user's real
  * environment, not our execution context.
  */
-export function sanitizedPackageManagerEnv(baseEnv = process.env) {
+function sanitizedPackageManagerEnv(baseEnv = process.env) {
   const env = {};
   for (const [key, value] of Object.entries(baseEnv)) {
     if (/^npm_(config_|lifecycle|package_|execpath$|node_execpath$)/i.test(key)) continue;
@@ -2818,15 +2766,15 @@ async function npxInstallInner({ home, log, sourceRoot, installer, ensureRuntime
   return { ok: true, version: manifest.version, path: releaseDir };
 }
 
-export const UPDATE_PACKAGE_NAME = '@ran-sh/dsh-crew';
-export const UPDATE_DEFAULT_SPEC = `${UPDATE_PACKAGE_NAME}@latest`;
+const UPDATE_PACKAGE_NAME = '@ran-sh/dsh-crew';
+const UPDATE_DEFAULT_SPEC = `${UPDATE_PACKAGE_NAME}@latest`;
 
 /**
  * Extract a packed npm tarball with the platform `tar` binary (bsdtar ships
  * with Windows 10+, macOS, and Linux) into destDir; npm tarballs always root
  * at `package/`.
  */
-export function extractPackageTarball(tgzPath, destDir, { runner = spawnSync } = {}) {
+function extractPackageTarball(tgzPath, destDir, { runner = spawnSync } = {}) {
   mkdirSync(destDir, { recursive: true });
   // GNU tar interprets a `C:\...` argument as a remote rsh host ("Cannot
   // connect to C:"), so anchor the invocation inside destDir and pass the
@@ -3449,9 +3397,9 @@ const CREDENTIAL_CAPABILITY_REQUIREMENTS = Object.freeze({
   'purge-plan': Object.freeze(['credential-reference-inventory-v1', 'credential-purge-v1']),
   purge: Object.freeze(['credential-reference-inventory-v1', 'credential-purge-v1']),
 });
-export const PRODUCTION_HUB_URL = 'http://127.0.0.1:3210';
+const PRODUCTION_HUB_URL = 'http://127.0.0.1:3210';
 
-export async function assertProductionHub({ hubUrl, requiredCapabilities = [], purpose = 'command', fetchImpl = globalThis.fetch } = {}) {
+async function assertProductionHub({ hubUrl, requiredCapabilities = [], purpose = 'command', fetchImpl = globalThis.fetch } = {}) {
   if (hubUrl !== PRODUCTION_HUB_URL) throw new Error(`${purpose} requires the isolated 3210 Crew Hub`);
   const response = await fetchImpl(`${hubUrl}${CREW_ROUTE_BASE}/runtime`, { headers: { accept: 'application/json' } });
   let body;
@@ -3474,7 +3422,7 @@ export async function assertProductionHub({ hubUrl, requiredCapabilities = [], p
  * surface before sending a provider request. This prevents a same-port stale
  * Hub from turning a later 404 into an ambiguous destructive failure.
  */
-export async function assertProviderHubCapabilities({ hubUrl, action, fetchImpl = globalThis.fetch } = {}) {
+async function assertProviderHubCapabilities({ hubUrl, action, fetchImpl = globalThis.fetch } = {}) {
   return assertProductionHub({
     hubUrl,
     requiredCapabilities: PROVIDER_CAPABILITY_REQUIREMENTS[action] ?? PROVIDER_CAPABILITY_REQUIREMENTS.list,

package/src/install/official-web.mjs

@@ -10,7 +10,7 @@ import { join } from 'node:path';
 export const OFFICIAL_BRIDGE_PACKAGE = '@ran-sh/dsh-crew-web-bridge';
 const STATE_FILENAME = 'official-web.json';
 
-export function officialWebProfileDir({ home = homedir() } = {}) {
+function officialWebProfileDir({ home = homedir() } = {}) {
   return join(home, '.dsh', 'profiles', 'web');
 }
 

package/src/install/windows-startup.mjs

@@ -12,11 +12,11 @@ import { dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { installOfficialFrontendAssets, officialFrontendAssetsReady } from './official-frontend-assets.mjs';
 
-export const WINDOWS_STARTUP_FILENAME = 'DSH Crew.vbs';
-export const WINDOWS_LAUNCHER_FILENAME = 'start-dsh-crew.cmd';
-export const WINDOWS_HELPER_FILENAME = 'start-dsh-crew.ps1';
-export const WINDOWS_CONTROL_FILENAME = 'supervisor-control.ps1';
-export const WINDOWS_SUPERVISOR_ASSET_MANIFEST = 'supervisor-assets.json';
+const WINDOWS_STARTUP_FILENAME = 'DSH Crew.vbs';
+const WINDOWS_LAUNCHER_FILENAME = 'start-dsh-crew.cmd';
+const WINDOWS_HELPER_FILENAME = 'start-dsh-crew.ps1';
+const WINDOWS_CONTROL_FILENAME = 'supervisor-control.ps1';
+const WINDOWS_SUPERVISOR_ASSET_MANIFEST = 'supervisor-assets.json';
 
 function defaultStartupDir({ home, env }) {
   if (home === homedir() && env.APPDATA) {

package/src/install/windows-supervisor-adapter.mjs

@@ -5,6 +5,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join, win32 } from 'node:path';
 import { homedir } from 'node:os';
 
+import { RELEASE_COHORT_FILENAME } from '../dsh-cohort.mjs';
 import {
   readMaintenanceSession,
   readSupervisorHeartbeat,
@@ -47,7 +48,7 @@ export function hashSupervisorHelper(file) {
   try { return createHash('sha256').update(readFileSync(file)).digest('hex'); } catch { return null; }
 }
 
-export function canonicalWindowsPowerShellPath({
+function canonicalWindowsPowerShellPath({
   environment = process.env,
   exists = existsSync,
 } = {}) {
@@ -344,7 +345,7 @@ function prepareWindowsSupervisorConvergence({ home, root, platform }) {
   let expectedDshVersion = text(manifest?.dependencies?.['@deepseek-ai/dsh'] ?? manifest?.peerDependencies?.['@deepseek-ai/dsh']);
   if (!EXACT_VERSION_RE.test(expectedDshVersion ?? '')) {
     try {
-      const cohort = JSON.parse(readFileSync(join(root, 'release-cohort.json'), 'utf8'));
+      const cohort = JSON.parse(readFileSync(join(root, RELEASE_COHORT_FILENAME), 'utf8'));
       expectedDshVersion = text(cohort?.dsh_version);
     } catch { expectedDshVersion = null; }
   }

package/src/install/windows-supervisor-lifecycle.mjs

@@ -10,8 +10,8 @@ import {
 import { dirname, join } from 'node:path';
 import { compareProcessToken, processStartToken } from '../process-identity.mjs';
 
-export const WINDOWS_SUPERVISOR_HANDOFF_SCHEMA = 1;
-export const WINDOWS_SUPERVISOR_HANDOFF_PHASES = Object.freeze([
+const WINDOWS_SUPERVISOR_HANDOFF_SCHEMA = 1;
+const WINDOWS_SUPERVISOR_HANDOFF_PHASES = Object.freeze([
   'planned',
   'backend-stopped',
   'old-watcher-stopped',

package/src/install/zcode.mjs

@@ -395,5 +395,3 @@ export function uninstallZCode({ home = homedir(), env = process.env } = {}) {
   }
   return { ok: true, actions };
 }
-
-export function zcodeOwnershipFile({ home = homedir() } = {}) { return OWNERSHIP_FILE({ home }); }

package/src/job-contracts.mjs

@@ -5,7 +5,7 @@
 // internal details remain available only through an explicit detail=full
 // request at the MCP boundary.
 
-export const JOB_CONTRACT_SCHEMA_VERSION = 1;
+const JOB_CONTRACT_SCHEMA_VERSION = 1;
 
 export const JOB_EVENT_TYPES = Object.freeze([
   'job.created',

package/src/job-identity.mjs

@@ -19,8 +19,8 @@
 // give them all one title. There the workspace groups the sessions and this name
 // tells them apart.
 
-export const JOB_NAME_PREFIX = 'Crew_';
-export const JOB_PURPOSE_MAX = 32;
+const JOB_NAME_PREFIX = 'Crew_';
+const JOB_PURPOSE_MAX = 32;
 
 export const JOB_NAME_RE = /^Crew_\d{8}_\d{6}_[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*(?:-\d+)?$/;
 

package/src/jobs.mjs

@@ -14,8 +14,8 @@ import { createShardWriter } from './status-shard.mjs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve, basename } from 'node:path';
 import { homedir } from 'node:os';
-import { appendDeliveryInstructions, prependJobIdentity, parseDeliveryReport, formatDeliveryMetadata } from './delivery.mjs';
-import { jobDisplayName } from './job-identity.mjs';
+import { appendDeliveryInstructions, prependJobIdentity, parseDeliveryReport, formatDeliveryMetadata } from './delivery.mjs';
+import { jobDisplayName } from './job-identity.mjs';
 import { isCrewWorktreeName } from './workspace-isolation.mjs';
 import { captureWorkspaceBaseline, captureWorkspaceDiff, NOT_A_GIT_REPOSITORY } from './workspace-audit.mjs';
 import { buildOutcome, JOB_PHASES } from './workflow.mjs';
@@ -28,7 +28,6 @@ import { readGlobalConfig } from './install/install.mjs';
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
 const CREW_DSH_HOME = join(homedir(), '.config', 'dsh-crew', 'harness');
-const STATUS_FILE = join(CONFIG_DIR, 'status.json');
 const CORDIS = join(ROOT, 'worker.cordis.yml');
 
 // Read the operator's schedule once per dispatch. An unreadable config must not
@@ -38,7 +37,7 @@ function readModelSchedule() {
   try { return normalizeModelSchedule(readGlobalConfig().model_schedule); } catch { return normalizeModelSchedule(undefined); }
 }
 
-export const TIERS = {
+const TIERS = {
   flash: { model: 'deepseek-v4-flash', label: 'V4 Flash' },
   pro: { model: 'deepseek-v4-pro', label: 'V4 Pro' },
 };

package/src/model-routing.mjs

@@ -7,7 +7,7 @@
 import { rankAdaptiveCandidates } from './adaptive-routing.mjs';
 import { scheduleAdmission } from './model-schedule.mjs';
 
-export const DEFAULT_TIER_MODEL_PREFERENCES = Object.freeze({
+const DEFAULT_TIER_MODEL_PREFERENCES = Object.freeze({
   flash: 'deepseek-v4-flash',
   pro: 'deepseek-v4-pro',
 });
@@ -20,9 +20,8 @@ export const DEFAULT_ROLE_MODEL_PREFERENCES = Object.freeze({
   reviewer: 'deepseek-v4-pro',
 });
 
-export const MODEL_FALLBACKS = ['harness-default'];
 export const NO_WORKER_MODEL_AVAILABLE = 'NO_WORKER_MODEL_AVAILABLE';
-export const MODEL_SELECTION_TRACE_VERSION = 1;
+const MODEL_SELECTION_TRACE_VERSION = 1;
 export const MODEL_SELECTION_REASON_CODES = Object.freeze({
   PROVIDER_UNAVAILABLE: 'PROVIDER_UNAVAILABLE',
   PREFERRED_MODEL_UNAVAILABLE: 'PREFERRED_MODEL_UNAVAILABLE',
@@ -61,7 +60,7 @@ const BLOCKED_MODEL_CODES = Object.freeze({
   [MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED]: 'MODEL_BLOCKED_PEAK',
 });
 
-export function normalizeModelRef(raw) {
+function normalizeModelRef(raw) {
   if (!raw || typeof raw !== 'object') return null;
   const provider = typeof raw.provider === 'string' ? raw.provider.trim() : '';
   const model = typeof raw.model === 'string' ? raw.model.trim() : '';

package/src/model-schedule.mjs

@@ -27,7 +27,6 @@ export const DEFAULT_PEAK_WINDOWS = Object.freeze([
 
 export const DEFAULT_TIMEZONE_OFFSET_MINUTES = 8 * 60;
 export const DEFAULT_PEAK_WEEKDAYS = Object.freeze([1, 2, 3, 4, 5]);
-export const MINUTES_PER_DAY = 24 * 60;
 // A fixed offset is bounded by the real-world range of UTC offsets; anything
 // wider is a typo, not a timezone.
 const MAX_OFFSET_MINUTES = 14 * 60;

package/src/policy-legacy.mjs

@@ -21,8 +21,8 @@ import { normalizeModelPriority } from './model-routing.mjs';
 
 export const TIER_STATES = ['disabled', 'manual', 'auto'];
 export const COLLABORATION_MODES = ['flash-only', 'pro-only', 'balanced', 'review-pipeline', 'custom'];
-export const MAIN_AGENT_MODES = ['direct-allowed', 'coordinator-first', 'dispatcher-only'];
-export const ROLE_IDS = [
+const MAIN_AGENT_MODES = ['direct-allowed', 'coordinator-first', 'dispatcher-only'];
+const ROLE_IDS = [
   'implementation',
   'simple_fix',
   'tests',
@@ -52,7 +52,7 @@ export const POLICY_ERROR_CODES = {
   ROLE_TIER_CONFLICT: 'ROLE_TIER_CONFLICT',
 };
 
-export const POLICY_ERROR_MESSAGES = {
+const POLICY_ERROR_MESSAGES = {
   [POLICY_ERROR_CODES.SUBAGENTS_DISABLED]:
     'DSH Crew worker dispatch is disabled.',
   [POLICY_ERROR_CODES.TIER_DISABLED]:
@@ -89,18 +89,16 @@ export const POLICY_ERROR_MESSAGES = {
 // Everything new here reads a canonical config shape produced by
 // migrateLegacyConfig; the legacy collab/tier functions stay for compatibility.
 
-export const DISPATCH_ROLES = ['worker', 'reviewer'];
-export const ROLE_STATES = TIER_STATES; // disabled | manual | auto
 export const ROLE_MODEL_STRATEGIES = ['economy', 'balanced', 'quality', 'strong'];
-export const DEFAULT_WORKER_STRATEGY = 'balanced';
-export const DEFAULT_REVIEWER_STRATEGY = 'strong';
+const DEFAULT_WORKER_STRATEGY = 'balanced';
+const DEFAULT_REVIEWER_STRATEGY = 'strong';
 export const DEFAULT_MAX_PARALLEL = 3;
 
-export function normalizeRoleState(raw) {
+function normalizeRoleState(raw) {
   return normalizeState(raw);
 }
 
-export function normalizeIsolation(raw) {
+function normalizeIsolation(raw) {
   return raw === 'worktree' || raw === 'shared' ? raw : 'worktree';
 }
 
@@ -117,7 +115,7 @@ function normalizeMaxParallel(raw) {
  *   escalation_priority_configured, fallback, escalation: { enabled, max_attempts } }.
  * Pure; unknown fields drop, empty priority falls back to the role default.
  */
-export function normalizeModelPolicy(raw = {}) {
+function normalizeModelPolicy(raw = {}) {
   return {
     role: raw.role === 'reviewer' ? 'reviewer' : 'worker',
     strategy: ROLE_MODEL_STRATEGIES.includes(raw.strategy)
@@ -444,7 +442,7 @@ export function resolveHubWorkerProvider({ worker_provider_mode, getCurrentSelec
 }
 
 /** Structured policy error; `code` is machine-readable, `message` user-facing. */
-export function policyError(code, extra = {}) {
+function policyError(code, extra = {}) {
   const base = POLICY_ERROR_MESSAGES[code] ?? code;
   return Object.assign(new Error(base.replace('{tier}', extra.tier ?? 'pro')), { policyCode: code });
 }
@@ -677,7 +675,7 @@ export function shouldRunProReview(config, session = {}) {
 }
 
 /** Roles for a tier (host guidance for who does what, not a hard classifier). */
-export function getTierRoles(config, tier) {
+function getTierRoles(config, tier) {
   const roles = tier === 'flash' ? config.flash_roles : config.pro_roles;
   return normalizeRoles(roles, tier === 'flash' ? DEFAULT_FLASH_ROLES : DEFAULT_PRO_ROLES);
 }

package/src/provider-inventory.mjs

@@ -9,7 +9,7 @@ import { classifyCredentialReference } from './credential-reference.mjs';
 const LIFECYCLE_ORIGINS = new Set(['builtin', 'profile-managed', 'dynamic', 'unknown']);
 const OWNERSHIPS = new Set(['harness', 'crew-managed-profile', 'user-managed-profile', 'dynamic-user', 'unknown']);
 const MUTABLE_AUTHORITY_KINDS = new Set(['crew-profile', 'harness-settings']);
-export const IMMUTABLE_HARNESS_PROVIDER_IDS = Object.freeze(['deepseek-official']);
+const IMMUTABLE_HARNESS_PROVIDER_IDS = Object.freeze(['deepseek-official']);
 
 function text(value) {
   return typeof value === 'string' && value.trim() ? value.trim() : null;

package/src/provider-layer-migration.mjs

@@ -120,8 +120,6 @@ export function hasProviderLayerMigration(plan) {
   return Array.isArray(plan?.providers) && plan.providers.length > 0;
 }
 
-const MIGRATION_STATES = Object.freeze(['PLANNED', 'APPLIED', 'RESTART_PENDING', 'VERIFYING', 'VERIFIED', 'FAILED']);
-
 function migrationCode(error, fallback = 'PROVIDER_MIGRATION_FAILED') {
   const code = text(error?.code);
   return code && /^[A-Z][A-Z0-9_]{1,63}$/u.test(code) ? code : fallback;

package/src/readiness-matrix.mjs

@@ -5,7 +5,7 @@
 // (Hub handshake / catalog read) are intentionally separate from execution
 // verification (real worker, reviewer, cancellation, timeout, etc.).
 
-export const READINESS_STATUSES = Object.freeze(['PASS', 'FAIL', 'BLOCKED', 'SKIP', 'NOT_RUN']);
+const READINESS_STATUSES = Object.freeze(['PASS', 'FAIL', 'BLOCKED', 'SKIP', 'NOT_RUN']);
 
 export const READINESS_REASON_CODES = Object.freeze({
   LIVE_CHECK_PASSED: 'LIVE_CHECK_PASSED',

package/src/release-in-use.mjs

@@ -22,7 +22,7 @@ import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-export const IN_USE_DIRNAME = 'in-use';
+const IN_USE_DIRNAME = 'in-use';
 
 // A claim file is `<pid>.json` or `<pid>-<nonce>.json`. The PID alone is not
 // enough to identify a claim: two mounts inside one process would publish to the

package/src/role-profiles.mjs

@@ -6,7 +6,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 
-export const ROLE_PROFILE_SCHEMA_VERSION = 1;
+const ROLE_PROFILE_SCHEMA_VERSION = 1;
 export const DEFAULT_ROLE_PROFILES = Object.freeze({
   'worker-default': Object.freeze({
     role: 'worker', routing: 'auto', isolation: 'worktree', fallback: true,
@@ -45,7 +45,7 @@ function normalizeProfile(id, raw) {
   };
 }
 
-export function roleProfilesFile({ home = homedir() } = {}) {
+function roleProfilesFile({ home = homedir() } = {}) {
   return join(home, '.config', 'dsh-crew', 'profiles.json');
 }
 

package/src/runtime-controls.mjs

@@ -22,7 +22,7 @@ const R = ACTIVATION_BOUNDARY.RESTART_REQUIRED;
  * running MCP process. `session: null` means the setting is not a session
  * override surface.
  */
-export const RUNTIME_SETTING_ACTIVATION = Object.freeze({
+const RUNTIME_SETTING_ACTIVATION = Object.freeze({
   max_parallel: Object.freeze({ global: L, session: null, note: 'Admission limit refreshes before new workflow starts and when slots release; lowering never cancels active work.' }),
 
   subagents_enabled: Object.freeze({ global: N, session: N }),

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.0';
+export const RUNTIME_VERSION = '2.2.1';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/status-shard.mjs

@@ -9,7 +9,7 @@ import { homedir } from 'node:os';
 
 const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
 const SHARD_DIR = join(CONFIG_DIR, 'status.d');
-export const SHARD_FRESH_MS = 30 * 60 * 1000;
+const SHARD_FRESH_MS = 30 * 60 * 1000;
 
 export function createShardWriter(kind) {
   const writer = `${kind}-${process.pid}`;