@ran-sh/dsh-crew 2.2.11 → 2.2.13

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.11",
+  "version": "2.2.13",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.11",
+  "version": "2.2.13",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/hub/index.mjs

@@ -28,6 +28,7 @@ import { createCanonicalJobEvent, projectWorkflowView } from '../job-contracts.m
 import { getHubRuntimeIdentity } from '../runtime-identity.mjs';
 import { loadCiEvidence } from '../ci-evidence.mjs';
 import { ensureCrewWorkspace, releaseCrewWorkspace } from '../crew-workspaces.mjs';
+import { sameRepoPath } from '../workspace-isolation.mjs';
 import { loadRoleProfiles, resolveRoleProfile, saveRoleProfiles } from '../role-profiles.mjs';
 import { addContextReferences, buildWorkspaceTask, isSafeBranchName, loadWorkspaceContexts, resolveWorkspaceContext, saveWorkspaceContexts } from '../workspace-context.mjs';
 import { buildExtensionContract } from '../extension-contract.mjs';
@@ -897,7 +898,12 @@ export class WorkerRegistry {  constructor(ctx) {
       // This project's stable worker/reviewer workspace, reset to the job's base
       // revision and held for the job's duration, so the Harness groups these
       // sessions into two entries instead of one per job.
-      const created = await ensureCrewWorkspace({ cwd, role: jobRole, baseRevision: workspace_branch });
+      // The cross-SID git exception is granted only for a root the OPERATOR listed
+      // in `trusted_workspace_roots`: this API authenticates a loopback socket, not
+      // a Windows account, so an API caller's path can never grant itself the trust.
+      const approvedRoots = Array.isArray(cfg.trusted_workspace_roots) ? cfg.trusted_workspace_roots : [];
+      const trustedRepoRoot = approvedRoots.find((root) => typeof root === 'string' && sameRepoPath(root, cwd)) ?? null;
+      const created = await ensureCrewWorkspace({ cwd, trustedRepoRoot, role: jobRole, baseRevision: workspace_branch });
       if (!created.ok) throw Object.assign(new Error(created.error ?? created.reason), { code: created.reason });
       executionCwd = created.worktreePath;
       isolatedWorkspace = { worktreePath: created.worktreePath, repoRoot: created.repoRoot, stable: true, release: created.release };

package/src/install/install-legacy.mjs

@@ -396,6 +396,13 @@ export const GLOBAL_CONFIG_DEFAULTS = {
   // default: the interactive desktop entry is what opens a session, and an extra
   // always-on harness process is the operator's choice to make.
   frontend_autostart: false,
+  // Opt-in trust: repository roots whose ownership differs from this account's, for
+  // which the hub's worktree dispatch may carry a request-scoped git
+  // `safe.directory` exception. The hub API authenticates a loopback socket, not a
+  // Windows account, so this file — edited by the operator, not by an API caller —
+  // is what turns a foreign-owned checkout into a legal dispatch target. Exact
+  // roots only; wildcards are refused.
+  trusted_workspace_roots: [],
   // Worker provider routing for HUB workers: which DSH provider backs each
   // worker session. Fresh installs stay on the built-in DeepSeek provider;
   // follow-dsh is an explicit opt-in that uses the provider selected in DSH

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.11';
+export const RUNTIME_VERSION = '2.2.13';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/workspace-isolation.mjs

@@ -25,6 +25,8 @@ export const NOT_GIT_REPOSITORY = 'NOT_GIT_REPOSITORY';
 export const GIT_NOT_FOUND = 'GIT_NOT_FOUND';
 export const GIT_TIMEOUT = 'GIT_TIMEOUT';
 export const GIT_ERROR = 'GIT_ERROR';
+/** Git refused to read a repository owned by another account; the trust decision is the operator's. */
+export const WORKTREE_GIT_OWNERSHIP_UNSAFE = 'WORKTREE_GIT_OWNERSHIP_UNSAFE';
 /** A valid repository whose HEAD does not resolve because nothing is committed. */
 export const REPOSITORY_HAS_NO_COMMITS = 'REPOSITORY_HAS_NO_COMMITS';
 export const WORKTREE_LOCKED = 'WORKTREE_LOCKED';
@@ -67,6 +69,12 @@ async function runGit(runner, args, opts) {
     const r = await runner(args, opts);
     const stderr = r.stderr ?? '';
     if (/not a git repository/i.test(stderr)) return { ok: false, reason: NOT_GIT_REPOSITORY, error: stderr.trim() };
+    // Git's ownership refusal is its own condition, distinct from a broken
+    // repository: the tree exists, Crew can see it, and the remedy is a trust
+    // decision that belongs to the operator, not a repair step. Naming it keeps
+    // "the worktree looks unowned" (WORKSPACE_CONFLICT) and generic GIT_ERROR
+    // from misdescribing a shared checkout.
+    if (/dubious ownership/i.test(stderr)) return { ok: false, reason: WORKTREE_GIT_OWNERSHIP_UNSAFE, code: r.code, error: stderr.trim() };
     if (r.code != null && r.code !== 0) return { ok: false, reason: r.code === -1 ? GIT_NOT_FOUND : GIT_ERROR, code: r.code, error: stderr.trim() || 'git exited non-zero' };
     return { ok: true, code: r.code, stdout: r.stdout ?? '', stderr };
   } catch (err) {
@@ -101,6 +109,13 @@ export function sameRepoPath(left, right) {
 export function withSafeDirectory(git, trustedRepoRoot) {
   const run = git ?? defaultRunner;
   const safe = resolve(String(trustedRepoRoot ?? ''));
+  // Git reads a trailing `/*` as a prefix wildcard, and on POSIX `*` is a legal
+  // filename, so a value that could outlive "exactly one repository" is refused
+  // here rather than handed to Git and discovered later.
+  if (safe.includes('*')) {
+    const error = `Crew trust refusal: the safe.directory anchor must be one exact path without wildcards, got ${safe}`;
+    return async () => ({ code: 1, stdout: '', stderr: error });
+  }
   return (args, opts) => run(['-c', `safe.directory=${safe}`, ...args], opts);
 }