@ran-sh/dsh-crew 2.2.6 → 2.2.7

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.6",
+  "version": "2.2.7",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/docs/readiness-matrix.md

@@ -12,9 +12,16 @@ The matrix is emitted by `hubStatus()` and is therefore visible inside the exist
 - `FAIL` — a check actually ran and produced an incompatible or failed result.
 - `BLOCKED` — the check could not run because required infrastructure or authorization was unavailable.
 - `SKIP` — the row is intentionally not applicable for the active policy/path.
+- `NOT_APPLICABLE` — the row asks about a route this machine does not use, and the
+  matrix says so instead of omitting it. The two built-in DeepSeek rows are the live
+  case: they read `NOT_APPLICABLE` / `WORKER_PROVIDER_FOLLOWS_DSH` whenever a known,
+  other provider is selected, and keep `NOT_RUN` when the selection is unknown.
 - `NOT_RUN` — no trusted evidence has been supplied for the row.
 
-`BLOCKED` and `SKIP` are not failures. `NOT_RUN` is not success.
+`BLOCKED` and `SKIP` are not failures. `NOT_RUN` is not success, and `NOT_APPLICABLE`
+is an answer: it is reported as itself on any component that consumes the row, and it
+cannot lower the readiness aggregate — only a `FAIL`, an unproven row or an
+`UNAVAILABLE` component does.
 
 ## Evidence classes
 
@@ -61,7 +68,7 @@ actually run" — `provider_health`, `reviewer_health`, `model_execution`,
 `worker_primary_callable`, `reviewer_primary_callable`, `reviewer_pipeline` — is
 filtered to whatever route is currently selected, so an operator on other
 providers is covered by those and loses nothing by the two DeepSeek rows
-reading `NOT_RUN`. A static row per provider was tried and replaced by these
+reading `NOT_APPLICABLE` under `follow-dsh`. A static row per provider was tried and replaced by these
 dynamic signals; `opencode_go_mimo_qwen` was that attempt's last trace in this
 document.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.6",
+  "version": "2.2.7",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/scripts/setup.mjs

@@ -384,11 +384,19 @@ export async function setupStatus({ log = console.log, root = ROOT, home = homed
     } catch { dshPlugin = 'unknown'; }
   }
   log(`DSH plugin: ${dshPlugin} (dedicated dsh-crew profile; official web profile ignored)`);
+  // The frontend is on-demand by design: 3210 is the service, and 3080 is started
+  // for a browser session. Rendering it as anything else reads as a missing piece
+  // of the installation, which it is not.
+  const frontendConfig = (installer.readGlobalConfig ?? realInstaller.readGlobalConfig)({ configFile: join(home, '.config', 'dsh-crew', 'config.json') });
+  const frontend = frontendConfig?.frontend_autostart === true
+    ? 'auto-started at login (dsh-crew open for a session URL)'
+    : 'available on demand (dsh-crew open)';
+  log(`Frontend (3080): ${frontend}`);
   log(`Codex Desktop integration: ${codex}`);
   log(`ZCode integration: ${zcode}`);
   log(`Claude Code integration: ${claude}`);
   log(`Windows login startup: ${windowsStartup}`);
-  return { ok: true, dshPlugin, codex, zcode, claude, windowsStartup };
+  return { ok: true, dshPlugin, frontend, codex, zcode, claude, windowsStartup };
 }
 
 export async function runSetupCli({ argv = process.argv.slice(2), run: actions = {}, log = console.log } = {}) {

package/src/extension-contract.mjs

@@ -32,6 +32,10 @@ function workspaceComponent(workspace) {
 function readinessFromRow(entry, { pass = 'READY', notRun = 'DEGRADED' } = {}) {
   if (!entry) return component('UNAVAILABLE', 'NO_EVIDENCE');
   if (entry.status === 'PASS') return component(pass, entry.reason_code ?? 'CHECK_PASSED');
+  // A row that does not apply to this machine is reported as such, not as a check
+  // that has not run: NOT_APPLICABLE says the question was answered, and it cannot
+  // pull the aggregate down (see the readiness roll-up below).
+  if (entry.status === 'NOT_APPLICABLE') return component('NOT_APPLICABLE', entry.reason_code ?? 'CHECK_NOT_APPLICABLE');
   if (entry.status === 'NOT_RUN' || entry.status === 'SKIP') return component(notRun, entry.reason_code ?? 'CHECK_NOT_RUN');
   return component('UNAVAILABLE', entry.reason_code ?? 'CHECK_FAILED');
 }
@@ -50,7 +54,12 @@ function modelReadinessFromSnapshot(readinessSnapshot, matrix, runtime, expected
     });
     if (validation.ok && validation.state === 'CALLABLE') return component('READY', 'CURRENT_MODEL_CALLABLE', { captured_at: callability.captured_at, expires_at: callability.expires_at, runtime_id: callability.current_runtime_id });
     if (validation.ok && validation.state === 'NOT_CALLABLE') return component('UNAVAILABLE', callability.roles.worker?.state === 'NOT_CALLABLE' ? callability.roles.worker.reason_code : callability.roles.reviewer.reason_code ?? 'CURRENT_MODEL_NOT_CALLABLE');
+    // Aging evidence is reported as aging, not as a fault, and "nothing has proven
+    // this route yet" is reported as unknown. The validator's own success code is
+    // `MODEL_CALLABILITY_VALID`, and rendering that next to DEGRADED read as a
+    // contradiction: the projection was valid, the evidence was simply not current.
     if (validation.ok && validation.state === 'STALE') return component('DEGRADED', 'MODEL_EVIDENCE_STALE');
+    if (validation.ok) return component('DEGRADED', 'MODEL_CALLABILITY_UNKNOWN');
     return component('DEGRADED', validation.reason_code ?? 'MODEL_CALLABILITY_UNKNOWN');
   }
   if (providerHealthEvidence?.status === 'FAIL') return readinessFromRow(providerHealthEvidence);

package/src/install/install-legacy.mjs

@@ -17,6 +17,14 @@ import { integrationRoot } from './crew-paths.mjs';
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 const MARKETPLACE_NAME = 'dsh-crew';
 const PLUGIN_KEY = `dsh-crew@${MARKETPLACE_NAME}`;
+// Every name this installer has ever registered Crew under in a Claude host, and
+// the only names its uninstall may remove. `dsh-workers` is the pre-rename
+// identity: an operator who upgraded keeps that marketplace, plugin entry and its
+// permission rules until the same uninstall cleans them, and nothing else in the
+// file is Crew's to touch.
+const CREW_CLAUDE_MARKETPLACES = [MARKETPLACE_NAME, 'dsh-workers'];
+const CREW_CLAUDE_PLUGIN_KEYS = [PLUGIN_KEY, 'dsh-workers@dsh-workers'];
+const CREW_CLAUDE_PERMISSION_PREFIXES = ['mcp__plugin_dsh-crew_', 'mcp__plugin_dsh-workers_'];
 // A Claude Code plugin refresh is a real copy of the plugin tree, and its cost
 // tracks machine load: 163s measured idle, ~6 minutes measured during an
 // activation. The install is the step that copies, so it gets the ceiling that
@@ -645,7 +653,7 @@ export function uninstallCodex({ home = homedir(), env = process.env } = {}) {
 export function claudeIntegrationLine(result) {
   if (result?.ok === false) return '✗ Claude Code integration failed';
   if (result?.detected === false) {
-    return '- Claude Code not detected; settings registered, CLI step skipped';
+    return '- Claude Code not installed (claude CLI not found); nothing written';
   }
   if (result?.degraded === true) {
     return `- Claude Code integration registered, but not loaded: ${result.reason ?? 'plugin snapshot not refreshed'}`;
@@ -906,9 +914,22 @@ export async function runClaudeStep(args, { timeoutMs = CLAUDE_STEP_TIMEOUT_MS,
   };
 }
 
-export async function installClaudeCode({ home = homedir(), statusline = false, root = ROOT } = {}) {
+export async function installClaudeCode({ home = homedir(), statusline = false, root = ROOT, resolveClaude = resolveClaudeCommand } = {}) {
   const actions = [];
 
+  // This registration exists only to make Crew callable FROM Claude Code, so a
+  // host without the `claude` CLI has nothing for it to serve. Writing it anyway
+  // left Crew's marketplace, plugin entry and permission rules in a file Crew
+  // could never exercise, next to a footprint that read back as an integration
+  // wanting a CLI the machine does not have. Detect once, up front, and write
+  // nothing when the host cannot use it: `host_detected` then reports the truth
+  // with no stale registration to explain away.
+  const claudeCommand = resolveClaude();
+  if (!claudeCommand) {
+    actions.push('claude CLI not found; no Claude configuration written');
+    return { ok: true, detected: false, actions };
+  }
+
   // The repository carries its own marketplace manifest (.claude-plugin/
   // marketplace.json with source "."), so the marketplace root IS the plugin
   // checkout itself — no parent-directory layout assumption. This keeps the
@@ -999,7 +1020,8 @@ export async function installClaudeCode({ home = homedir(), statusline = false,
   // Materialize the install through the claude CLI: registers the marketplace
   // in the plugin cache (settings alone leave a stale/absent cache entry) and
   // pulls the plugin so the next session loads it. Best-effort: settings are
-  // already correct, so a missing CLI just means one manual `plugin install`.
+  // already correct, so a CLI that fails on its own terms leaves the operator one
+  // manual `plugin install` short rather than an unregistered host.
   const registered = readJson(join(home, '.claude', 'plugins', 'known_marketplaces.json'), {})?.[MARKETPLACE_NAME];
   const installedRecord = readJson(join(home, '.claude', 'plugins', 'installed_plugins.json'), {})?.plugins?.[PLUGIN_KEY];
   const installedEntries = Array.isArray(installedRecord) ? installedRecord : [installedRecord];
@@ -1019,14 +1041,9 @@ export async function installClaudeCode({ home = homedir(), statusline = false,
     actions.push('cli: skipped (non-default home; test mode)');
     return { ok: true, actions };
   }
-  // The CLI is best-effort, but a host that does not have it must not be told to
-  // run it. The checkout entry already gates on this; doing it here too keeps the
-  // two entries describing the same machine the same way.
-  const claudeCommand = resolveClaudeCommand();
-  if (!claudeCommand) {
-    actions.push('cli: skipped (claude not found)');
-    return { ok: true, detected: false, actions };
-  }
+  // `claudeCommand` was resolved before anything was written: reaching this line
+  // already proves the CLI is there, so the step is best-effort rather than
+  // possibly-pointless.
   return refreshClaudePlugin({ home, root, actions, claudeCommand });
 }
 
@@ -1230,25 +1247,76 @@ export function installHudSegment({ home = homedir() } = {}) {
   return { ok: true, actions: [...(bak ? [`backup: ${bak}`] : []), 'statusLine: claude-hud now runs worker-segment.sh via --extra-cmd'] };
 }
 
+// Only the status line `--statusline` installs is Crew's to remove: it points at
+// Crew's own script. Any other status line in the file belongs to whoever
+// configured it, even when it happens to name this checkout.
+function crewOwnedStatusLine(value) {
+  const command = typeof value?.command === 'string' ? value.command : '';
+  return command.includes('statusline.sh') && command.includes('dsh-crew');
+}
+
+// The claude CLI records, per marketplace and plugin, what it materialized, in
+// files of its own. Unregistering the settings and leaving those records behind
+// hands the next install a snapshot with no owner, so an explicit uninstall
+// clears them too. Crew-scoped and best-effort: a file that is absent, unreadable
+// or shaped differently than expected is left exactly as it is found.
+function removeCrewClaudeCacheRecords({ home, actions }) {
+  const dir = join(home, '.claude', 'plugins');
+  const marketsFile = join(dir, 'known_marketplaces.json');
+  const markets = readJson(marketsFile, null);
+  if (markets && typeof markets === 'object' && !Array.isArray(markets)) {
+    const owned = CREW_CLAUDE_MARKETPLACES.filter((name) => Object.hasOwn(markets, name));
+    if (owned.length) {
+      backup(marketsFile);
+      for (const name of owned) delete markets[name];
+      writeFileSync(marketsFile, JSON.stringify(markets, null, 2) + '\n');
+      actions.push(`marketplace cache: removed ${owned.join(', ')}`);
+    }
+  }
+  const pluginsFile = join(dir, 'installed_plugins.json');
+  const installed = readJson(pluginsFile, null);
+  if (installed && typeof installed === 'object' && !Array.isArray(installed)
+    && installed.plugins && typeof installed.plugins === 'object' && !Array.isArray(installed.plugins)) {
+    const owned = CREW_CLAUDE_PLUGIN_KEYS.filter((key) => Object.hasOwn(installed.plugins, key));
+    if (owned.length) {
+      backup(pluginsFile);
+      for (const key of owned) delete installed.plugins[key];
+      writeFileSync(pluginsFile, JSON.stringify(installed, null, 2) + '\n');
+      actions.push(`plugin cache: removed ${owned.join(', ')}`);
+    }
+  }
+}
+
 export function uninstallClaudeCode({ home = homedir() } = {}) {
+  const actions = [];
   const settingsFile = join(home, '.claude', 'settings.json');
   const settings = readJson(settingsFile, null);
-  if (!settings) return { ok: true, actions: ['settings.json not found'] };
-  backup(settingsFile);
-  const mpDir = join(home, '.config', 'dsh-crew', 'marketplace');
-  if (Array.isArray(settings.extraKnownMarketplaces)) {
-    settings.extraKnownMarketplaces = settings.extraKnownMarketplaces.filter((m) => m?.path !== mpDir);
-  } else if (settings.extraKnownMarketplaces) {
-    delete settings.extraKnownMarketplaces[MARKETPLACE_NAME];
-  }
-  if (Array.isArray(settings.enabledPlugins)) {
-    settings.enabledPlugins = settings.enabledPlugins.filter((p) => p !== PLUGIN_KEY);
-  } else if (settings.enabledPlugins) {
-    delete settings.enabledPlugins[PLUGIN_KEY];
-  }
-  if (settings.permissions?.allow) {
-    settings.permissions.allow = settings.permissions.allow.filter((r) => !r.startsWith('mcp__plugin_dsh-crew_'));
+  if (settings) {
+    backup(settingsFile);
+    const mpDir = join(home, '.config', 'dsh-crew', 'marketplace');
+    if (Array.isArray(settings.extraKnownMarketplaces)) {
+      settings.extraKnownMarketplaces = settings.extraKnownMarketplaces.filter((m) => m?.path !== mpDir);
+    } else if (settings.extraKnownMarketplaces) {
+      for (const name of CREW_CLAUDE_MARKETPLACES) delete settings.extraKnownMarketplaces[name];
+    }
+    if (Array.isArray(settings.enabledPlugins)) {
+      settings.enabledPlugins = settings.enabledPlugins.filter((p) => !CREW_CLAUDE_PLUGIN_KEYS.includes(p));
+    } else if (settings.enabledPlugins) {
+      for (const key of CREW_CLAUDE_PLUGIN_KEYS) delete settings.enabledPlugins[key];
+    }
+    if (settings.permissions?.allow) {
+      settings.permissions.allow = settings.permissions.allow.filter((rule) => typeof rule !== 'string'
+        || !CREW_CLAUDE_PERMISSION_PREFIXES.some((prefix) => rule.startsWith(prefix)));
+    }
+    if (crewOwnedStatusLine(settings.statusLine)) {
+      delete settings.statusLine;
+      actions.push('statusLine: removed (Crew-installed)');
+    }
+    writeFileSync(settingsFile, JSON.stringify(settings, null, 2) + '\n');
+    actions.push('unregistered from settings.json (backup kept)');
+  } else {
+    actions.push('settings.json not found');
   }
-  writeFileSync(settingsFile, JSON.stringify(settings, null, 2) + '\n');
-  return { ok: true, actions: ['unregistered from settings.json (backup kept)'] };
+  removeCrewClaudeCacheRecords({ home, actions });
+  return { ok: true, actions };
 }

package/src/install/npx-lifecycle.mjs

@@ -3327,6 +3327,15 @@ export function npxStatus({
   }
   log(`DSH plugin: ${dshPlugin} (dedicated dsh-crew profile on 3210)`);
   log(`Official 3080 UI bridge: ${officialWeb}`);
+  // The frontend is not an install that can be missing: 3210 is the service, and
+  // 3080 is started on demand. Saying so is the difference between "this machine is
+  // incomplete" and "run `dsh-crew open` when you want the browser surface" — and
+  // whether 3080 happens to be up right now does not change either answer.
+  const frontendConfig = (installer.readGlobalConfig ?? realInstaller.readGlobalConfig)({ configFile: join(home, '.config', 'dsh-crew', 'config.json') });
+  const frontend = frontendConfig?.frontend_autostart === true
+    ? 'auto-started at login (dsh-crew open for a session URL)'
+    : 'available on demand (dsh-crew open)';
+  log(`Frontend (3080): ${frontend}`);
   // The desktop app carries its own bridge entry, which pins a revision: after a
   // payload update that entry is stale until it is re-pointed, so say which of the
   // three states the machine is in instead of leaving the panel silently old.
@@ -3349,6 +3358,7 @@ export function npxStatus({
     installedPath: pointer?.path ?? null,
     dshPlugin,
     officialWeb,
+    frontend,
     codex,
     zcode,
     claude,

package/src/install/official-frontend-assets.mjs

@@ -19,9 +19,10 @@ function plan(home, root) {
   // `core.autocrlf=true` checkout hashes to a different revision than the npm
   // payload it installs, which made readiness look for a snapshot that does not
   // exist and reported "needs repair" on a correct install (and made every payload
-  // update look like a stale desktop revision).
+  // update look like a stale desktop revision). Lone CR collapses too: one line
+  // break is one line break in these sources.
   const canonicalBytes = (bytes) => (bytes.includes(0) ? bytes
-    : Buffer.from(bytes.toString('utf8').replace(/\r\n/g, '\n'), 'utf8'));
+    : Buffer.from(bytes.toString('utf8').replace(/\r\n?/g, '\n'), 'utf8'));
   for (const [name, bytes] of files) files.set(name, canonicalBytes(bytes));
   const hash = createHash('sha256').update(JSON.stringify(metadata));
   for (const [name, bytes] of files) hash.update(name).update(bytes);
@@ -43,10 +44,12 @@ function plan(home, root) {
 // snapshot was written from the npm payload (LF). The bridge sources are text that
 // either line ending serves, so a CRLF checkout must not read as a drifted snapshot;
 // bytes are still compared first, and the tolerant path only applies to text.
+// Lone CR is normalized as well, so a file saved with classic-Mac endings reads as
+// the same source rather than as content drift.
 function sameTextContent(installed, expected) {
   if (installed.equals(expected)) return true;
   if (installed.includes(0) || expected.includes(0)) return false;
-  const normalize = (buffer) => buffer.toString('utf8').replace(/\r\n/g, '\n');
+  const normalize = (buffer) => buffer.toString('utf8').replace(/\r\n?/g, '\n');
   return normalize(installed) === normalize(expected);
 }
 
@@ -61,7 +64,7 @@ export function officialFrontendAssetsReady({ home = homedir(), root } = {}) {
   try {
     const p = plan(home, root);
     const overlay = readFileSync(p.overlayFile, 'utf8');
-    return matches(p) && (overlay === p.overlay || overlay.replace(/\r\n/g, '\n') === p.overlay.replace(/\r\n/g, '\n'));
+    return matches(p) && (overlay === p.overlay || overlay.replace(/\r\n?/g, '\n') === p.overlay.replace(/\r\n?/g, '\n'));
   } catch { return false; }
 }
 

package/src/install/windows-startup.mjs

@@ -129,9 +129,12 @@ function sha256File(file) {
 // Git checks these scripts out as CRLF on a `core.autocrlf=true` machine and
 // PowerShell accepts either, so a line-ending difference is not a difference this
 // check may report: comparing raw bytes made every Windows dev checkout read as
-// "needs repair" while the npm payload (LF) was installed correctly.
+// "needs repair" while the npm payload (LF) was installed correctly. Lone CR is
+// collapsed too — an editor that saved one of these files with classic-Mac
+// endings is still the same script, and only a real character difference should
+// send the operator to a repair step.
 function normalizeEol(text) {
-  return String(text).replace(/\r\n/g, '\n');
+  return String(text).replace(/\r\n?/g, '\n');
 }
 
 function samePath(left, right) {

package/src/log-prune.mjs

@@ -10,7 +10,7 @@ import { readdirSync, rmSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 
-export const DEFAULT_KEEP_RUNS = 20;
+export const DEFAULT_KEEP_RUNS = 10;
 export const DEFAULT_MAX_AGE_DAYS = 14;
 const RECENT_GUARD_MS = 5 * 60 * 1000;
 

package/src/readiness-matrix.mjs

@@ -5,7 +5,7 @@
 // (Hub handshake / catalog read) are intentionally separate from execution
 // verification (real worker, reviewer, cancellation, timeout, etc.).
 
-const READINESS_STATUSES = Object.freeze(['PASS', 'FAIL', 'BLOCKED', 'SKIP', 'NOT_RUN']);
+const READINESS_STATUSES = Object.freeze(['PASS', 'FAIL', 'BLOCKED', 'SKIP', 'NOT_APPLICABLE', 'NOT_RUN']);
 
 export const READINESS_REASON_CODES = Object.freeze({
   LIVE_CHECK_PASSED: 'LIVE_CHECK_PASSED',
@@ -22,7 +22,7 @@ export const READINESS_REASON_CODES = Object.freeze({
   NO_CI_EVIDENCE: 'NO_CI_EVIDENCE',
   NO_EXECUTION_EVIDENCE: 'NO_EXECUTION_EVIDENCE',
   CREDENTIAL_STATUS_NOT_PROBED: 'CREDENTIAL_STATUS_NOT_PROBED',
-  ROUTE_NOT_SELECTED: 'ROUTE_NOT_SELECTED',
+  WORKER_PROVIDER_FOLLOWS_DSH: 'WORKER_PROVIDER_FOLLOWS_DSH',
   EVIDENCE_REPORTED: 'EVIDENCE_REPORTED',
 });
 
@@ -166,15 +166,18 @@ export function buildReadinessMatrix({
   // The two built-in DeepSeek rows describe a route only when the operator runs
   // it. Under follow-dsh with a KNOWN, other selected provider they can never
   // gather evidence, and NOT_RUN reads like a check that should have run rather
-  // than a route that was never chosen. An unknown selection stays NOT_RUN: this
-  // matrix is conservative, and "we could not tell" must not read as "not
-  // applicable". Reported evidence still wins, because it is applied below.
+  // than a route that was never chosen. They are reported NOT_APPLICABLE: the rows
+  // stay in the matrix (dropping them would hide that the question was asked and
+  // answered), and neither status can move the aggregate — only a FAIL, an
+  // UNPROVEN row or an UNAVAILABLE component does. An unknown selection stays
+  // NOT_RUN: this matrix is conservative, and "we could not tell" must not read as
+  // "not applicable". Reported evidence still wins, because it is applied below.
   const selectionKnown = typeof workerSelection?.provider === 'string' && workerSelection.provider.length > 0;
   const deepseekRouteSelected = workerProviderMode === 'deepseek-official'
     || workerSelection?.provider === 'deepseek-official';
   if (workerProviderMode !== null && selectionKnown && !deepseekRouteSelected) {
     for (const id of ['deepseek_flash', 'deepseek_pro']) {
-      rows[id] = baseRow(id, 'real-execution', 'SKIP', READINESS_REASON_CODES.ROUTE_NOT_SELECTED, 'runtime-policy');
+      rows[id] = baseRow(id, 'real-execution', 'NOT_APPLICABLE', READINESS_REASON_CODES.WORKER_PROVIDER_FOLLOWS_DSH, 'runtime-policy');
     }
   }
 

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.6';
+export const RUNTIME_VERSION = '2.2.7';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/windows/start-dsh-crew.ps1

@@ -127,6 +127,24 @@ function Write-LaunchLog {
   }
 }
 
+# Every launch appends to one file for the life of the machine, so it grows without
+# bound while only its tail is ever read. Rotation runs once per launch before the
+# first line is written and keeps two generations: a post-mortem needs the current
+# run and the one before it. Deliberately best-effort — a locked, unreadable or
+# huge log is a reason to leave it alone, never a reason to fail the launch.
+$launcherLogMaxBytes = 5MB
+function Rotate-LaunchLog {
+  try {
+    if (-not (Test-Path -LiteralPath $launcherLog -PathType Leaf)) { return }
+    if ((Get-Item -LiteralPath $launcherLog -ErrorAction Stop).Length -lt $launcherLogMaxBytes) { return }
+    $oldest = "$launcherLog.2"
+    $previous = "$launcherLog.1"
+    if (Test-Path -LiteralPath $oldest) { Remove-Item -LiteralPath $oldest -Force -ErrorAction Stop }
+    if (Test-Path -LiteralPath $previous) { Move-Item -LiteralPath $previous -Destination $oldest -Force -ErrorAction Stop }
+    Move-Item -LiteralPath $launcherLog -Destination $previous -Force -ErrorAction Stop
+  } catch { }
+}
+
 function Resolve-OfficialHarnessCommand {
   $shim = Get-Command dsh.cmd -CommandType Application -ErrorAction Stop | Select-Object -First 1
   $root = Join-Path (Split-Path -Parent $shim.Source) 'node_modules\@deepseek-ai\dsh'
@@ -1528,6 +1546,7 @@ if ($env:DSH_CREW_LAUNCHER_TEST_IMPORT -eq '1') { return }
 
 try {
   New-Item -ItemType Directory -Path $logRoot -Force | Out-Null
+  Rotate-LaunchLog
   Write-LaunchLog ('Launcher started; mode={0}; user={1}' -f $Mode, $env:USERNAME)
   if (-not (Test-Path -LiteralPath $dshCli -PathType Leaf)) {
     throw "DSH CLI was not found at $dshCli. Configure DSH_CREW_DSH_CLI to a Crew-owned official CLI entry, or run: npm install -g @ran-sh/dsh-crew@latest; dsh-crew update"