@ran-sh/dsh-crew 2.2.10 → 2.2.12

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.10",
+  "version": "2.2.12",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.10",
+  "version": "2.2.12",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/crew-workspaces.mjs

@@ -27,6 +27,8 @@ import {
   defaultWorktreeRoot,
   inspectRepository,
   resetWorktreeTo,
+  sameRepoPath,
+  withSafeDirectory,
 } from './workspace-isolation.mjs';
 import { acquireWorkspaceLock, DEFAULT_LOCK_WAIT_MS } from './workspace-lock.mjs';
 
@@ -81,6 +83,14 @@ export function crewWorkspaceLockPath({ repoRoot, role, root = defaultWorktreeRo
  */
 export async function ensureCrewWorkspace({
   cwd,
+  // The repository root the REQUEST named, when Crew may trust it for this job's git
+  // subprocesses. A shared checkout can be owned by another account, and Git refuses
+  // to read it without a `safe.directory` exception; the exception is scoped to this
+  // one root, and the repository Git resolves must be exactly that root — anything
+  // else (a subdirectory cwd, a different repo) fails closed rather than widening the
+  // trust. Worktree-local operations do not get the exception: the worktree Crew
+  // creates is owned by the account Crew runs as.
+  trustedRepoRoot = null,
   role,
   baseRevision,
   at,
@@ -92,8 +102,16 @@ export async function ensureCrewWorkspace({
   isAlive,
   pid,
 } = {}) {
-  const repo = await inspectRepository({ cwd, git });
+  const run = trustedRepoRoot ? withSafeDirectory(git, trustedRepoRoot) : git;
+  const repo = await inspectRepository({ cwd, git: run });
   if (!repo.ok) return { ok: false, reason: repo.reason, error: repo.error };
+  if (trustedRepoRoot && !sameRepoPath(repo.repoRoot, trustedRepoRoot)) {
+    return {
+      ok: false,
+      reason: 'WORKSPACE_TRUST_ANCHOR_MISMATCH',
+      error: `git resolved ${repo.repoRoot}, not the trusted root ${trustedRepoRoot}; run the job at the repository root or register a workspace context`,
+    };
+  }
   const repoRoot = repo.repoRoot;
   const revision = baseRevision ?? repo.baseRevision;
   const name = crewWorkspaceName(role);
@@ -109,7 +127,7 @@ export async function ensureCrewWorkspace({
     return { ok: false, reason, error };
   };
 
-  const reused = await crewOwnsWorktree({ worktreePath, repoRoot, git });
+  const reused = await crewOwnsWorktree({ worktreePath, repoRoot, git: run });
   if (!reused) {
     if (existsSync(worktreePath)) {
       // Something is there that Crew did not create. Deleting it would be a
@@ -117,7 +135,7 @@ export async function ensureCrewWorkspace({
       // say which path is in the way.
       return fail(WORKSPACE_CONFLICT, `workspace path exists but is not a Crew worktree of this repository: ${worktreePath}`);
     }
-    const created = await createWorktreeAt({ dir: worktreePath, repoRoot, revision, purpose: name, at, git });
+    const created = await createWorktreeAt({ dir: worktreePath, repoRoot, revision, purpose: name, at, git: run });
     if (!created.ok) return fail(created.reason, created.error);
   }
 

package/src/mcp-runtime.mjs

@@ -14,6 +14,7 @@ import {
   cleanupIsolatedWorkspace,
   inspectRepository,
   captureCandidate as captureIsolationCandidate,
+  withSafeDirectory,
 } from './workspace-isolation.mjs';
 import { startJob, waitJob, jobView, cancelJob } from './jobs.mjs';
 import { hub } from './hub-client.mjs';
@@ -297,7 +298,13 @@ export function buildMcpWorkflowRuntime(deps) {
     }
     // Isolated roles fail closed when the workspace
     // is not a git repo — never silently fall back to sharing the working tree.
-    const repo = await inspectRepository({ cwd: job.requested_cwd });
+    // The pre-check and the workspace entry share one scoped exception: the
+    // requested cwd is the only root this dispatch may trust, and only when Git
+    // resolves it as the repository root (a shared checkout owned by another
+    // account is the case this exists for).
+    const trustedRoot = job.requested_cwd;
+    const scopedGit = withSafeDirectory(null, trustedRoot);
+    const repo = await inspectRepository({ cwd: job.requested_cwd, git: scopedGit });
     if (!repo.ok) {
       return { ok: false, reason: repo.reason ?? 'ISOLATION_UNAVAILABLE', error: `${job.role ?? 'worker'} needs an isolated git worktree: ${repo.error ?? repo.reason}` };
     }
@@ -309,6 +316,7 @@ export function buildMcpWorkflowRuntime(deps) {
     // cannot share it.
     const workspace = await ensureCrewWorkspace({
       cwd: job.requested_cwd,
+      trustedRepoRoot: trustedRoot,
       role: job.role ?? 'worker',
       baseRevision: job.workspace_branch ?? repo.baseRevision,
     });

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.10';
+export const RUNTIME_VERSION = '2.2.12';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/workspace-isolation.mjs

@@ -25,6 +25,8 @@ export const NOT_GIT_REPOSITORY = 'NOT_GIT_REPOSITORY';
 export const GIT_NOT_FOUND = 'GIT_NOT_FOUND';
 export const GIT_TIMEOUT = 'GIT_TIMEOUT';
 export const GIT_ERROR = 'GIT_ERROR';
+/** Git refused to read a repository owned by another account; the trust decision is the operator's. */
+export const WORKTREE_GIT_OWNERSHIP_UNSAFE = 'WORKTREE_GIT_OWNERSHIP_UNSAFE';
 /** A valid repository whose HEAD does not resolve because nothing is committed. */
 export const REPOSITORY_HAS_NO_COMMITS = 'REPOSITORY_HAS_NO_COMMITS';
 export const WORKTREE_LOCKED = 'WORKTREE_LOCKED';
@@ -67,6 +69,12 @@ async function runGit(runner, args, opts) {
     const r = await runner(args, opts);
     const stderr = r.stderr ?? '';
     if (/not a git repository/i.test(stderr)) return { ok: false, reason: NOT_GIT_REPOSITORY, error: stderr.trim() };
+    // Git's ownership refusal is its own condition, distinct from a broken
+    // repository: the tree exists, Crew can see it, and the remedy is a trust
+    // decision that belongs to the operator, not a repair step. Naming it keeps
+    // "the worktree looks unowned" (WORKSPACE_CONFLICT) and generic GIT_ERROR
+    // from misdescribing a shared checkout.
+    if (/dubious ownership/i.test(stderr)) return { ok: false, reason: WORKTREE_GIT_OWNERSHIP_UNSAFE, code: r.code, error: stderr.trim() };
     if (r.code != null && r.code !== 0) return { ok: false, reason: r.code === -1 ? GIT_NOT_FOUND : GIT_ERROR, code: r.code, error: stderr.trim() || 'git exited non-zero' };
     return { ok: true, code: r.code, stdout: r.stdout ?? '', stderr };
   } catch (err) {
@@ -77,6 +85,40 @@ async function runGit(runner, args, opts) {
   }
 }
 
+function repoPathKey(value) {
+  try {
+    const p = resolve(String(value ?? ''));
+    return process.platform === 'win32' ? p.toLowerCase() : p;
+  } catch { return String(value ?? ''); }
+}
+
+/** Whether two paths name the same repository root on this platform. */
+export function sameRepoPath(left, right) {
+  const a = repoPathKey(left);
+  const b = repoPathKey(right);
+  return a.length > 0 && a === b;
+}
+
+// A shared checkout can be owned by another Windows account, and Git refuses even to
+// read it ("dubious ownership"); the operator's usual remedy, a global
+// `safe.directory` entry, is one Crew must never write. `-c safe.directory=<root>` is
+// the scoped form: it lives and dies with the subprocess, persists nothing, and names
+// exactly one repository rather than a wildcard. Callers pass the root the request
+// itself named, and the workspace entry fails closed when Git resolves any other
+// repository.
+export function withSafeDirectory(git, trustedRepoRoot) {
+  const run = git ?? defaultRunner;
+  const safe = resolve(String(trustedRepoRoot ?? ''));
+  // Git reads a trailing `/*` as a prefix wildcard, and on POSIX `*` is a legal
+  // filename, so a value that could outlive "exactly one repository" is refused
+  // here rather than handed to Git and discovered later.
+  if (safe.includes('*')) {
+    const error = `Crew trust refusal: the safe.directory anchor must be one exact path without wildcards, got ${safe}`;
+    return async () => ({ code: 1, stdout: '', stderr: error });
+  }
+  return (args, opts) => run(['-c', `safe.directory=${safe}`, ...args], opts);
+}
+
 const PURPOSE_MAX = 32;
 
 /** Local wall-clock stamp: readable, and what an operator expects to see. */