@ran-sh/dsh-crew 2.2.3 → 2.2.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/config-readiness.mjs

@@ -256,6 +256,7 @@ export function buildConfigReadinessMatrix({
     platform,
     hubCompatibility,
     workerProviderMode,
+    workerSelection: currentSelections?.worker ?? null,
     providerCatalogChecked,
     providerCatalogOk: catalogOk,
     evidence,

package/src/hub/index.mjs

@@ -43,6 +43,7 @@ import { inspectProviderProfile, readProviderDeclarations, readProviderMateriali
 import { hasHarnessDefaultBlock, inspectProviderSettings, readHarnessDefault, readProviderSettingsDeclarations, readProviderSettingsMaterialization } from '../provider-settings-store.mjs';
 import { normalizeProviderLifecycleState } from '../provider-lifecycle-state.mjs';
 import { createProviderHealthStore } from '../provider-health.mjs';
+import { pruneCrewTempLogs } from '../log-prune.mjs';
 import { planProviderDelete } from '../provider-lifecycle.mjs';
 import { createProviderDeleteFileHooks, isRecoverableProviderDeleteBackup, readProviderDeleteManifestFile } from '../provider-delete-adapters.mjs';
 import { buildCredentialReferenceInventory } from '../credential-reference-inventory.mjs';
@@ -2809,6 +2810,13 @@ export async function apply(ctx) {
     return () => { for (const d of disposers.reverse()) d(); };
   });
 
+  // Each hub start writes another diagnostics pair into %TEMP%; bound them here,
+  // on the machine that owns them, keeping the newest runs (see log-prune.mjs).
+  try {
+    const pruned = pruneCrewTempLogs();
+    if (pruned.removed.length > 0) ctx.logger?.info?.(`dsh-crew diagnostics pruned: ${pruned.removed.length} file(s)`);
+  } catch { /* pruning is best-effort and must never block a boot */ }
+
   ctx.logger?.info?.('dsh-crew hub mounted (jobs API + installer endpoints)');
   return async () => {
     for (const d of disposers.reverse()) { try { d(); } catch {} }

package/src/install/install-legacy.mjs

@@ -383,6 +383,11 @@ export const GLOBAL_CONFIG_DEFAULTS = {
   // Automatic Pro review after a successful Flash run (review-pipeline forces
   // this on; balanced/custom only when this flag is set).
   pro_reviews_flash: false,
+  // Opt-in: the login/background launcher also starts the Crew-managed 3080
+  // frontend — without opening a browser, logging the session URL instead. Off by
+  // default: the interactive desktop entry is what opens a session, and an extra
+  // always-on harness process is the operator's choice to make.
+  frontend_autostart: false,
   // Worker provider routing for HUB workers: which DSH provider backs each
   // worker session. Fresh installs stay on the built-in DeepSeek provider;
   // follow-dsh is an explicit opt-in that uses the provider selected in DSH

package/src/install/npx-lifecycle.mjs

@@ -51,6 +51,7 @@ import { checkRuntimeAdvance, normalizeRuntimeState, runtimeStateMayHaveStarted
 import { ensureCrewDshRuntime, ensureCrewPluginRegistration, ensureCrewWebProfile, removeCrewPluginRegistration, migrateCrewDshRuntime, installDshInto, restoreRetainedRuntime, crewDshRuntimeRoot, payloadDshVersion, gcRetainedRuntimes, TARGET_DSH_VERSION } from '../dsh-cli-runtime.mjs';
 import { desktopAttach, desktopDetach, desktopStatus } from './desktop-profile.mjs';
 import { mirrorOfficialHarnessConfig, officialConfigMirrorStatus } from './harness-config-import.mjs';
+import { pruneCrewTempLogs } from '../log-prune.mjs';
 import {
   ensureOfficialWebIntegration,
   officialWebIntegrationStatus,
@@ -2772,6 +2773,21 @@ export async function npxDesktop({ home = homedir(), args = [], dryRun = false,
   return result;
 }
 
+// Bound the diagnostics that accumulate in the temp directory. The hub does this
+// on every boot too; the command exists so an operator can reclaim space without
+// waiting for a restart or guessing which files are safe to delete.
+export async function npxLogs({ args = [], log = console.log } = {}) {
+  const action = args[0] ?? 'prune';
+  if (action !== 'prune') {
+    log(`✗ unknown logs action: ${action}`);
+    return { ok: false, error: 'usage: dsh-crew logs prune [keep]' };
+  }
+  const keep = Number(args[1]);
+  const result = pruneCrewTempLogs(Number.isInteger(keep) && keep > 0 ? { keepRuns: keep } : {});
+  log(`✓ Crew diagnostics pruned: removed ${result.removed.length} file(s); kept ${result.kept.length} run(s)`);
+  return { ok: true, ...result };
+}
+
 // Bring the operator's user-level DSH configuration across from the official home
 // into Crew's home: the Crew hub then runs the same models, providers, policy and
 // MCP servers as the desktop app. Read-only on ~/.dsh, no secrets copied (provider
@@ -3426,6 +3442,7 @@ Commands:
               home, so the Crew hub matches the desktop app. Read-only on ~/.dsh; no
               secrets are copied (provider entries keep their apiKeyEnv references);
               entries naming packages absent from Crew's runtime cohort are skipped
+  logs        prune the Crew diagnostics in the temp directory: prune [keep]
   status      read-only report of launcher/installed versions and integrations
   inspect     print the machine-readable extension capability/readiness contract
   jobs        machine-first job API: list|get|watch|cancel|submit
@@ -3830,7 +3847,7 @@ export async function runNpxCli({
     error(USAGE);
     return 1;
   }
-  if (unknown.length > 0 || !['install', 'integrate', 'detach', 'desktop', 'config', 'status', 'inspect', 'jobs', 'providers', 'credentials', 'releases', 'rollback', 'update', 'uninstall'].includes(command)) {
+  if (unknown.length > 0 || !['install', 'integrate', 'detach', 'desktop', 'config', 'logs', 'status', 'inspect', 'jobs', 'providers', 'credentials', 'releases', 'rollback', 'update', 'uninstall'].includes(command)) {
     error(`unknown command: ${command ?? '<none>'}\n\n${USAGE}`);
     return 1;
   }
@@ -3841,6 +3858,7 @@ export async function runNpxCli({
       detach: commands.detach ?? npxDetach,
       desktop: commands.desktop ?? npxDesktop,
       config: commands.config ?? npxConfig,
+      logs: commands.logs ?? npxLogs,
       status: commands.status ?? npxStatus,
       inspect: commands.inspect ?? npxInspect,
       jobs: commands.jobs ?? npxJobs,
@@ -3856,6 +3874,7 @@ export async function runNpxCli({
     else if (command === 'update') result = await actions.update({ candidate, log });
     else if (command === 'desktop') result = await actions.desktop({ args, dryRun, log });
     else if (command === 'config') result = await actions.config({ args, dryRun, log });
+    else if (command === 'logs') result = await actions.logs({ args, log });
     else if (command === 'jobs') result = await actions.jobs({ args, after, detail, request, log });
     else if (command === 'providers') result = await actions.providers({ args, planId, expectedRevision, replacementDefault, confirm, purgeOrphanCredentials, log });
     else if (command === 'credentials') result = await actions.credentials({ args, planId, expectedRevision, confirm, log });

package/src/install/windows-startup.mjs

@@ -107,14 +107,15 @@ export function windowsStartupStatus({
       const sourceControl = readFileSync(join(root, 'windows', WINDOWS_CONTROL_FILENAME), 'utf8');
       const sourceVbs = readFileSync(join(root, 'windows', 'start-dsh-crew.vbs'), 'utf8');
       const startup = readFileSync(resolved.startupFile, 'utf16le').replace(/^\uFEFF/, '');
-      components.startup_entry_content = startup === renderVbs(sourceVbs, resolved.launcherFile);
-      components.launcher_content = readFileSync(resolved.launcherFile, 'utf8') === sourceLauncher;
-      components.helper_content = readFileSync(resolved.helperFile, 'utf8') === sourceHelper;
-      components.control_content = readFileSync(resolved.controlFile, 'utf8') === sourceControl;
+      components.startup_entry_content = normalizeEol(startup) === normalizeEol(renderVbs(sourceVbs, resolved.launcherFile));
+      components.launcher_content = normalizeEol(readFileSync(resolved.launcherFile, 'utf8')) === normalizeEol(sourceLauncher);
+      components.helper_content = normalizeEol(readFileSync(resolved.helperFile, 'utf8')) === normalizeEol(sourceHelper);
+      components.control_content = normalizeEol(readFileSync(resolved.controlFile, 'utf8')) === normalizeEol(sourceControl);
+      // The manifest is written from the INSTALLED bytes, so it is checked against
+      // them (inside readWindowsSupervisorAssets); what ties the installation to the
+      // shipped payload is the *_content* comparison above, which is EOL-tolerant.
       const assets = readWindowsSupervisorAssets({ home });
-      components.supervisor_manifest = assets.ok
-        && assets.helper_hash === sha256File(join(root, 'windows', WINDOWS_HELPER_FILENAME))
-        && assets.control_hash === sha256File(join(root, 'windows', WINDOWS_CONTROL_FILENAME));
+      components.supervisor_manifest = assets.ok;
     } catch { /* missing or unreadable content remains false */ }
   }
   const missing = Object.entries(components).filter(([, ready]) => !ready).map(([key]) => key);
@@ -125,6 +126,14 @@ function sha256File(file) {
   try { return createHash('sha256').update(readFileSync(file)).digest('hex'); } catch { return null; }
 }
 
+// Git checks these scripts out as CRLF on a `core.autocrlf=true` machine and
+// PowerShell accepts either, so a line-ending difference is not a difference this
+// check may report: comparing raw bytes made every Windows dev checkout read as
+// "needs repair" while the npm payload (LF) was installed correctly.
+function normalizeEol(text) {
+  return String(text).replace(/\r\n/g, '\n');
+}
+
 function samePath(left, right) {
   try { return resolve(left).toLowerCase() === resolve(right).toLowerCase(); } catch { return false; }
 }

package/src/log-prune.mjs

@@ -0,0 +1,70 @@
+// Bound the Crew diagnostics that accumulate in %TEMP%: every hub start writes a
+// new dsh-crew-dsh-crew-3210-<stamp>.out/.err.log pair, every desktop launch a
+// dsh-crew-web-*, every official launch a dsh-official-web-*, and the launcher
+// appends to dsh-crew-launcher.log forever. They are the only post-mortem evidence
+// for a crash-before-readiness, so the rule keeps the most recent runs instead of
+// deleting everything: per family, the newest `keep` runs survive, plus anything
+// written within the recency guard (a running process owns its own log files).
+
+import { readdirSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+export const DEFAULT_KEEP_RUNS = 20;
+export const DEFAULT_MAX_AGE_DAYS = 14;
+const RECENT_GUARD_MS = 5 * 60 * 1000;
+
+const LOG_FAMILIES = [
+  { prefix: 'dsh-crew-dsh-crew-3210-', suffix: '.out.log' },
+  { prefix: 'dsh-crew-web-', suffix: '.out.log' },
+  { prefix: 'dsh-official-web-', suffix: '.out.log' },
+];
+
+// `dsh-crew-<profile>-<port>-<stamp>.out.log` -> the stamp identifies one run, and
+// its .err.log sibling must live or die with it.
+function runStamp(fileName, family) {
+  if (!fileName.startsWith(family.prefix) || !fileName.endsWith(family.suffix)) return null;
+  const stamp = fileName.slice(family.prefix.length, fileName.length - family.suffix.length);
+  return stamp || null;
+}
+
+export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = DEFAULT_KEEP_RUNS, maxAgeDays = DEFAULT_MAX_AGE_DAYS, now = Date.now() } = {}) {
+  const keep = Number.isInteger(keepRuns) && keepRuns > 0 ? keepRuns : DEFAULT_KEEP_RUNS;
+  const maxAgeMs = Number.isFinite(maxAgeDays) && maxAgeDays > 0 ? maxAgeDays * 24 * 60 * 60 * 1000 : DEFAULT_MAX_AGE_DAYS * 24 * 60 * 60 * 1000;
+  let names;
+  try { names = readdirSync(tempDir); } catch { return { ok: true, removed: [], kept: [], skipped: 'unreadable' }; }
+
+  const removed = [];
+  const kept = [];
+  for (const family of LOG_FAMILIES) {
+    const runs = new Map();
+    for (const name of names) {
+      const stamp = runStamp(name, family);
+      if (!stamp) continue;
+      const file = join(tempDir, name);
+      let mtimeMs = 0;
+      try { mtimeMs = statSync(file).mtimeMs; } catch { continue; }
+      const run = runs.get(stamp) ?? { stamp, files: [], newest: 0 };
+      run.files.push(name);
+      run.newest = Math.max(run.newest, mtimeMs);
+      runs.set(stamp, run);
+    }
+    const ordered = [...runs.values()].sort((left, right) => right.newest - left.newest);
+    ordered.forEach((run, index) => {
+      const tooOld = now - run.newest > maxAgeMs;
+      const tooMany = index >= keep;
+      const tooRecentToTouch = now - run.newest < RECENT_GUARD_MS;
+      if ((tooOld || tooMany) && !tooRecentToTouch) {
+        for (const name of run.files) removed.push(name);
+        const errName = run.files[0].replace(/\.out\.log$/, '.err.log');
+        if (names.includes(errName)) removed.push(errName);
+      } else {
+        kept.push(run.stamp);
+      }
+    });
+  }
+  for (const name of removed) {
+    try { rmSync(join(tempDir, name), { force: true }); } catch { /* a locked file stays until the next pass */ }
+  }
+  return { ok: true, removed: [...new Set(removed)].sort(), kept: kept.sort() };
+}

package/src/provider-health.mjs

@@ -73,7 +73,10 @@ function boundedTimestamp(value, fallback) {
 function view(entry, now) {
   if (!entry) return { state: 'unprobed', reason_code: null, observed_at: null, expires_at: null, fresh: false };
   const fresh = now < entry.expires_at;
-  if (!fresh) return { state: 'unprobed', reason_code: null, observed_at: entry.observed_at, expires_at: entry.expires_at, fresh: false };
+  // An aged-out record keeps its identity (provider/model) and timestamps: the
+  // readiness projection matches it against the selected route to report STALE
+  // instead of "never probed". Only the verdict is reset to `unprobed`.
+  if (!fresh) return { ...entry, state: 'unprobed', reason_code: null, fresh: false };
   return { ...entry, fresh: true };
 }
 
@@ -124,7 +127,12 @@ export function createProviderHealthStore({ clock = () => Date.now(), ttls = {},
     return get(provider, model);
   };
 
-  const list = () => [...records.values()].map((entry) => view(entry, clock())).filter((entry) => entry.fresh).slice(0, boundedMax);
+  // Expired records are included, as `fresh: false` with their timestamps: "this
+  // route was probed and the evidence has aged out" is knowledge the readiness
+  // projection needs (it renders STALE), and dropping it made an aged-out probe
+  // read as never-probed. Consumers that need live evidence filter on `fresh`
+  // themselves (currentRouteHealthEvidence does exactly that).
+  const list = () => [...records.values()].map((entry) => view(entry, clock())).slice(0, boundedMax);
 
   return { get, record, list, ttls: { ...limits }, maxEntries: boundedMax };
 }

package/src/readiness-matrix.mjs

@@ -22,6 +22,7 @@ export const READINESS_REASON_CODES = Object.freeze({
   NO_CI_EVIDENCE: 'NO_CI_EVIDENCE',
   NO_EXECUTION_EVIDENCE: 'NO_EXECUTION_EVIDENCE',
   CREDENTIAL_STATUS_NOT_PROBED: 'CREDENTIAL_STATUS_NOT_PROBED',
+  ROUTE_NOT_SELECTED: 'ROUTE_NOT_SELECTED',
   EVIDENCE_REPORTED: 'EVIDENCE_REPORTED',
 });
 
@@ -101,6 +102,7 @@ export function buildReadinessMatrix({
   platform = process.platform,
   hubCompatibility = null,
   workerProviderMode = null,
+  workerSelection = null,
   providerCatalogChecked = false,
   providerCatalogOk = false,
   evidence = {},
@@ -161,6 +163,21 @@ export function buildReadinessMatrix({
     );
   }
 
+  // The two built-in DeepSeek rows describe a route only when the operator runs
+  // it. Under follow-dsh with a KNOWN, other selected provider they can never
+  // gather evidence, and NOT_RUN reads like a check that should have run rather
+  // than a route that was never chosen. An unknown selection stays NOT_RUN: this
+  // matrix is conservative, and "we could not tell" must not read as "not
+  // applicable". Reported evidence still wins, because it is applied below.
+  const selectionKnown = typeof workerSelection?.provider === 'string' && workerSelection.provider.length > 0;
+  const deepseekRouteSelected = workerProviderMode === 'deepseek-official'
+    || workerSelection?.provider === 'deepseek-official';
+  if (workerProviderMode !== null && selectionKnown && !deepseekRouteSelected) {
+    for (const id of ['deepseek_flash', 'deepseek_pro']) {
+      rows[id] = baseRow(id, 'real-execution', 'SKIP', READINESS_REASON_CODES.ROUTE_NOT_SELECTED, 'runtime-policy');
+    }
+  }
+
   for (const [id] of TARGET_ROWS) {
     rows[id] = normalizeEvidence(rows[id], evidence?.[id]);
   }

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.3';
+export const RUNTIME_VERSION = '2.2.4';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/runtime-readiness-snapshot.mjs

@@ -95,13 +95,13 @@ function projectModelRole({ role, selected, health, jobs, runtime, now, executio
     })[0];
   const expiresAt = Number.isFinite(matchingHealth?.expires_at) ? matchingHealth.expires_at : null;
   const observedAt = Number.isFinite(matchingHealth?.observed_at) ? matchingHealth.observed_at : null;
-  if (matchingHealth) {
-    if (observedAt === null || observedAt > now || expiresAt === null || expiresAt <= now
-      || expiresAt - observedAt > MAX_EXECUTION_EVIDENCE_TTL_MS) {
-      return { state: 'STALE', reason_code: 'PROVIDER_HEALTH_STALE_OR_INVALID', selected, observed_at: observedAt, expires_at: expiresAt, source: 'provider_health', last_success: null };
-    }
-  }
-  const healthCurrent = matchingHealth && matchingHealth.fresh === true;
+  // An aged-out probe is remembered, not forgotten: it is reported as STALE below,
+  // but only after the job evidence is consulted — a real successful execution is
+  // stronger than "a probe aged out", and letting the stale record decide first
+  // would downgrade a route that just ran.
+  const healthExpired = Boolean(matchingHealth) && (observedAt === null || observedAt > now || expiresAt === null
+    || expiresAt <= now || expiresAt - observedAt > MAX_EXECUTION_EVIDENCE_TTL_MS);
+  const healthCurrent = matchingHealth && matchingHealth.fresh === true && !healthExpired;
   if (healthCurrent && matchingHealth.state !== 'callable') {
     return { state: 'NOT_CALLABLE', reason_code: matchingHealth.reason_code ?? 'PROVIDER_ROUTE_UNCALLABLE', selected, observed_at: matchingHealth.observed_at ?? null, expires_at: expiresAt, source: 'provider_health', last_success: null };
   }
@@ -122,6 +122,9 @@ function projectModelRole({ role, selected, health, jobs, runtime, now, executio
     if (expires > now) return { state: 'CALLABLE', reason_code: 'RECENT_EXECUTION_PASSED', selected, observed_at: completed.endedAt, expires_at: expires, source: 'execution', last_success: lastSuccess };
     return { state: 'STALE', reason_code: 'EXECUTION_EVIDENCE_EXPIRED', selected, observed_at: completed.endedAt, expires_at: expires, source: 'execution', last_success: lastSuccess };
   }
+  if (healthExpired) {
+    return { state: 'STALE', reason_code: 'PROVIDER_HEALTH_STALE_OR_INVALID', selected, observed_at: observedAt, expires_at: expiresAt, source: 'provider_health', last_success: null };
+  }
   return { state: 'UNKNOWN', reason_code: 'NO_CURRENT_MODEL_EVIDENCE', selected, last_success: null };
 }
 

package/windows/start-dsh-crew.ps1

@@ -372,6 +372,33 @@ function Start-CrewManagedFrontendQuietly {
   }
 }
 
+function Test-CrewFrontendAutostart {
+  # Opt-in only. The login/background launch has never started 3080 — the desktop
+  # entry does that, with a browser — which left operators who expect the browser
+  # surface after a reboot with nothing on 3080. Any unreadable config reads as off.
+  try {
+    $configFile = Join-Path $env:USERPROFILE '.config\dsh-crew\config.json'
+    if (-not (Test-Path -LiteralPath $configFile -PathType Leaf)) { return $false }
+    $config = Get-Content -LiteralPath $configFile -Raw | ConvertFrom-Json
+    return $config.frontend_autostart -eq $true
+  } catch { return $false }
+}
+
+function Start-CrewFrontendFromLogin {
+  # Never fatal: this runs before the supervisor starts, so a failure must not stop
+  # the backend. The session URL goes to the log instead of a browser window.
+  try {
+    if (Open-CrewManagedFrontend -Quiet) {
+      $url = Get-CrewWebSessionUrl
+      Write-LaunchLog ('Crew-managed frontend on 3080 is serving{0}' -f $(if ($url) { '; session: ' + $url } else { '' }))
+    } else {
+      Write-LaunchLog 'Crew-managed frontend on 3080 was not started (no Crew-managed CLI entry).' 'WARN'
+    }
+  } catch {
+    Write-LaunchLog ('Crew-managed frontend on 3080 could not be started: {0}' -f $_.Exception.Message) 'WARN'
+  }
+}
+
 function Get-OfficialFrontendOverlay {
   $frontendRoot = Join-Path $env:USERPROFILE '.config\dsh-crew\frontend'
   $path = Join-Path $frontendRoot 'official-web.patch.json'
@@ -1510,7 +1537,9 @@ try {
     throw "The isolated dsh-crew profile is missing under $crewHome. Run: dsh-crew update"
   }
   if ($Mode -eq 'open') { Open-OfficialFrontend }
-  # Background/watch modes remain independent of the official frontend.
+  # Background/watch modes remain independent of the official frontend, unless the
+  # operator opted in: then the login launch also serves 3080, without a browser.
+  if ($Mode -ne 'open' -and (Test-CrewFrontendAutostart)) { Start-CrewFrontendFromLogin }
 
   if ($Mode -eq 'watch') {
     Start-ServiceSupervisor