@ran-sh/dsh-crew 2.2.13 → 2.2.15

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.13",
+  "version": "2.2.15",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.13",
+  "version": "2.2.15",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {
@@ -42,30 +42,29 @@
     "./package.json": "./package.json"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-agent-loop": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-agent-presets": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-bash-local": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-compaction-basic": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-fs-local": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-fs-observation-policy": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-llm-deepseek": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-sdk-client": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-sdk-jsonrpc-server": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-sdk-minimal": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-session": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-token-meter": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-tool-fs": "0.1.6-alpha.1",
-    "@deepseek-ai/dsh-tool-todo": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent-loop": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-bash-local": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-compaction-basic": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-fs-local": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-fs-observation-policy": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm-deepseek": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-sandbox-local": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-sdk-client": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-sdk-jsonrpc-server": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-sdk-minimal": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-subprocess-local": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-token-meter": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-tool-fs": "^0.1.0 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-tool-todo": "^0.1.0 || ^0.2.0-rc.1",
     "react": "^18.0.0",
     "react-dom": "^18.0.0"
   },
@@ -79,9 +78,6 @@
     "@deepseek-ai/dsh-agent-loop": {
       "optional": true
     },
-    "@deepseek-ai/dsh-agent-presets": {
-      "optional": true
-    },
     "@deepseek-ai/dsh-bash-local": {
       "optional": true
     },

package/src/dsh-cohort.mjs

@@ -7,6 +7,62 @@ export const DSH_CLI_PACKAGE = '@deepseek-ai/dsh';
 export const TARGET_DSH_VERSION = '0.1.6-alpha.1';
 export const TARGET_DSH_SPEC = `${DSH_CLI_PACKAGE}@${TARGET_DSH_VERSION}`;
 
+export const DSH_SCOPE = '@deepseek-ai/';
+
+/** Cohort namespace: the CLI plus every `@deepseek-ai/dsh-*` package. */
+export function isDshCohortPackage(name) {
+  return name === DSH_CLI_PACKAGE || name.startsWith(`${DSH_CLI_PACKAGE}-`);
+}
+
+// The packages a persisted Crew payload vendors, at TARGET_DSH_VERSION.
+//
+// This list — not `package.json`'s DSH peer keys — decides what the standalone
+// payload installs. The two answer different questions: a peer key declares
+// which hosts will load the plugin, so it carries a RANGE that a host gate
+// compares against the running version, while a released payload must resolve
+// ONE exact cohort, because a half-upgraded tree is the failure it exists to
+// prevent. Reading the payload cohort out of the peer block conflated them, so
+// widening a peer range silently unlocked the cohort: nothing stayed pinned,
+// `exactSpecOverrides` produced no overrides, and npm materialized the newest
+// matching release instead of the one the embedded runtime runs.
+//
+// Names here are the cohort of TARGET_DSH_VERSION. A package that exists only
+// in a later cohort (a rename, for example) belongs in the peer block for that
+// host and must NOT be added here until TARGET_DSH_VERSION moves with it.
+export const DSH_COHORT_PACKAGES = Object.freeze([
+  DSH_CLI_PACKAGE,
+  '@deepseek-ai/dsh-agent',
+  '@deepseek-ai/dsh-agent-loop',
+  '@deepseek-ai/dsh-agent-presets',
+  '@deepseek-ai/dsh-bash-local',
+  '@deepseek-ai/dsh-client-locale',
+  '@deepseek-ai/dsh-client-ui-renderer',
+  '@deepseek-ai/dsh-client-ui-settings',
+  '@deepseek-ai/dsh-compaction-basic',
+  '@deepseek-ai/dsh-fs-local',
+  '@deepseek-ai/dsh-fs-observation-policy',
+  '@deepseek-ai/dsh-llm',
+  '@deepseek-ai/dsh-llm-deepseek',
+  '@deepseek-ai/dsh-sandbox-local',
+  '@deepseek-ai/dsh-sandbox-policy',
+  '@deepseek-ai/dsh-sdk-client',
+  '@deepseek-ai/dsh-sdk-jsonrpc-server',
+  '@deepseek-ai/dsh-sdk-minimal',
+  '@deepseek-ai/dsh-session',
+  '@deepseek-ai/dsh-session-persistence-jsonl',
+  '@deepseek-ai/dsh-subprocess-local',
+  '@deepseek-ai/dsh-token-meter',
+  '@deepseek-ai/dsh-tool-fs',
+  '@deepseek-ai/dsh-tool-todo',
+]);
+
+/** Exact `name -> TARGET_DSH_VERSION` specs for the vendored payload cohort. */
+export function dshCohortPins(version = TARGET_DSH_VERSION) {
+  const pins = {};
+  for (const name of DSH_COHORT_PACKAGES) pins[name] = version;
+  return pins;
+}
+
 // Retained-cohort support: when a release's manifest pins an older DSH
 // cohort than the current TARGET, the old runtime is retained on disk so a
 // rollback can restore it offline (no registry round-trip).

package/src/install/npx-lifecycle.mjs

@@ -45,7 +45,7 @@ import { crewDshHome, crewProfileDir, claudeIntegrationLine } from './install.mj
 import { integrationRoot } from './crew-paths.mjs';
 import { releaseClaimsState } from '../release-in-use.mjs';
 import { compareProcessToken, processStartToken } from '../process-identity.mjs';
-import { RELEASE_COHORT_FILENAME } from '../dsh-cohort.mjs';
+import { DSH_SCOPE, RELEASE_COHORT_FILENAME, dshCohortPins } from '../dsh-cohort.mjs';
 import { renameTree } from './tree-move.mjs';
 import { checkRuntimeAdvance, normalizeRuntimeState, runtimeStateMayHaveStarted } from './runtime-lifecycle.mjs';
 import { ensureCrewDshRuntime, ensureCrewPluginRegistration, ensureCrewWebProfile, removeCrewPluginRegistration, migrateCrewDshRuntime, installDshInto, restoreRetainedRuntime, crewDshRuntimeRoot, payloadDshVersion, gcRetainedRuntimes, TARGET_DSH_VERSION } from '../dsh-cli-runtime.mjs';
@@ -1042,19 +1042,38 @@ export function stageCandidatePayload({
     writeFileSync(destination, bytes, { mode: content.modes.get(entry) });
   }
 
-  // Persist an adjusted manifest: identity/runtime fields stay; production
-  // dependencies gain the exact-pinned peer cohort so the payload runs
-  // standalone (src/server.mjs statically imports DSH peers). Optional
-  // dependencies keep their own section so npm reconciles them per-platform.
+  // Persist an adjusted manifest: identity/runtime fields stay; declared DSH
+  // peers are re-pinned to the cohort in src/dsh-cohort.mjs so the standalone
+  // payload resolves exactly one cohort; optional dependencies keep their own
+  // section so npm reconciles them per-platform.
+  //
+  // The peer VALUES are deliberately not the payload's cohort. A peer key declares
+  // which hosts will load the plugin, so it carries a range; a released payload
+  // has to resolve one exact cohort, and exact specs are the only ones
+  // `exactSpecOverrides` can pin. A scoped peer outside TARGET_DSH_VERSION — a
+  // later-cohort rename, or the Cordis framework — is therefore a host-gate
+  // declaration only: the running host supplies it, as it supplies every other
+  // shared module. Without this pin the payload stops carrying a resolvable
+  // cohort at all, and `payloadDshVersion` fails closed on the range.
   const stagedManifest = { ...manifest };
   delete stagedManifest.devDependencies;
   delete stagedManifest.peerDependencies;
   delete stagedManifest.peerDependenciesMeta;
   const optionalNames = new Set(Object.keys(manifest.optionalDependencies ?? {}));
-  stagedManifest.dependencies = {
-    ...(manifest.peerDependencies ?? {}),
-    ...(manifest.dependencies ?? {}),
-  };
+  const cohortPins = dshCohortPins();
+  const explicitDependencies = new Set(Object.keys(manifest.dependencies ?? {}));
+  const stagedDependencies = { ...(manifest.dependencies ?? {}) };
+  for (const [name, spec] of Object.entries(manifest.peerDependencies ?? {})) {
+    if (!name.startsWith(DSH_SCOPE)) {
+      if (!(name in stagedDependencies)) stagedDependencies[name] = spec;
+      continue;
+    }
+    // An explicit runtime dependency wins over the peer shorthand.
+    if (explicitDependencies.has(name)) continue;
+    if (!Object.hasOwn(cohortPins, name)) continue;
+    stagedDependencies[name] = cohortPins[name];
+  }
+  stagedManifest.dependencies = stagedDependencies;
   const overrides = exactSpecOverrides(stagedManifest.dependencies);
   if (overrides) stagedManifest.overrides = overrides;
   writeFileSync(join(stageDir, 'package.json'), JSON.stringify(stagedManifest, null, 2) + '\n');

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.13';
+export const RUNTIME_VERSION = '2.2.15';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([