@ran-sh/dsh-crew 2.2.7 → 2.2.9

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.7",
+  "version": "2.2.9",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/docs/readiness-matrix.md

@@ -13,15 +13,27 @@ The matrix is emitted by `hubStatus()` and is therefore visible inside the exist
 - `BLOCKED` — the check could not run because required infrastructure or authorization was unavailable.
 - `SKIP` — the row is intentionally not applicable for the active policy/path.
 - `NOT_APPLICABLE` — the row asks about a route this machine does not use, and the
-  matrix says so instead of omitting it. The two built-in DeepSeek rows are the live
-  case: they read `NOT_APPLICABLE` / `WORKER_PROVIDER_FOLLOWS_DSH` whenever a known,
-  other provider is selected, and keep `NOT_RUN` when the selection is unknown.
+  matrix says so instead of omitting it. The two built-in DeepSeek rows are the only
+  rows a policy may mark this way: they read `NOT_APPLICABLE` /
+  `WORKER_PROVIDER_FOLLOWS_DSH` whenever a known, other provider is selected, and keep
+  `NOT_RUN` when the selection is unknown.
 - `NOT_RUN` — no trusted evidence has been supplied for the row.
 
-`BLOCKED` and `SKIP` are not failures. `NOT_RUN` is not success, and `NOT_APPLICABLE`
-is an answer: it is reported as itself on any component that consumes the row, and it
-cannot lower the readiness aggregate — only a `FAIL`, an unproven row or an
-`UNAVAILABLE` component does.
+`BLOCKED` and `SKIP` are not failures. `NOT_RUN` is not success.
+
+Applicability is decided when the row is built and it is final for that row:
+
+- Supplied evidence can neither create nor clear it. `NOT_APPLICABLE` is not part of
+  the evidence vocabulary (`PASS`, `FAIL`, `BLOCKED`, `SKIP`, `NOT_RUN`), so no
+  evidence source can make a required row disappear from readiness, and evidence
+  reported against a not-applicable row is kept as `reported_evidence` metadata
+  instead of flipping the status back.
+- A required row that arrives as `NOT_APPLICABLE` anyway is a contradiction, not a
+  pass: consumers that project such a row into readiness report
+  `UNAVAILABLE` / `CHECK_NOT_APPLICABLE_ON_REQUIRED_ROW`, which cannot leave the
+  aggregate READY.
+- The matrix declares `schema_version: 2`: a row may legally be `NOT_APPLICABLE` and
+  the summary carries a matching key, which is what a strict consumer needs to know.
 
 ## Evidence classes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.7",
+  "version": "2.2.9",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/scripts/setup.mjs

@@ -389,7 +389,7 @@ export async function setupStatus({ log = console.log, root = ROOT, home = homed
   // of the installation, which it is not.
   const frontendConfig = (installer.readGlobalConfig ?? realInstaller.readGlobalConfig)({ configFile: join(home, '.config', 'dsh-crew', 'config.json') });
   const frontend = frontendConfig?.frontend_autostart === true
-    ? 'auto-started at login (dsh-crew open for a session URL)'
+    ? 'configured to auto-start at login (dsh-crew open for a session URL)'
     : 'available on demand (dsh-crew open)';
   log(`Frontend (3080): ${frontend}`);
   log(`Codex Desktop integration: ${codex}`);

package/src/extension-contract.mjs

@@ -29,13 +29,19 @@ function workspaceComponent(workspace) {
     : { ...component('UNAVAILABLE', workspace?.code ?? 'WORKSPACE_NOT_CHECKED'), state: 'UNAVAILABLE' };
 }
 
-function readinessFromRow(entry, { pass = 'READY', notRun = 'DEGRADED' } = {}) {
+function readinessFromRow(entry, { pass = 'READY', notRun = 'DEGRADED', allowNotApplicable = false } = {}) {
   if (!entry) return component('UNAVAILABLE', 'NO_EVIDENCE');
   if (entry.status === 'PASS') return component(pass, entry.reason_code ?? 'CHECK_PASSED');
-  // A row that does not apply to this machine is reported as such, not as a check
-  // that has not run: NOT_APPLICABLE says the question was answered, and it cannot
-  // pull the aggregate down (see the readiness roll-up below).
-  if (entry.status === 'NOT_APPLICABLE') return component('NOT_APPLICABLE', entry.reason_code ?? 'CHECK_NOT_APPLICABLE');
+  // Every row this function is called with asks a question that applies to any Crew
+  // machine (a reachable hub, a consistent provider lifecycle, a runnable route), so
+  // "not applicable" is a contradiction here, not a pass: it is reported as missing
+  // evidence and it cannot leave the aggregate READY. Only a caller that names a row
+  // which may legitimately not apply opts in.
+  if (entry.status === 'NOT_APPLICABLE') {
+    return allowNotApplicable
+      ? component('NOT_APPLICABLE', entry.reason_code ?? 'CHECK_NOT_APPLICABLE')
+      : component('UNAVAILABLE', 'CHECK_NOT_APPLICABLE_ON_REQUIRED_ROW');
+  }
   if (entry.status === 'NOT_RUN' || entry.status === 'SKIP') return component(notRun, entry.reason_code ?? 'CHECK_NOT_RUN');
   return component('UNAVAILABLE', entry.reason_code ?? 'CHECK_FAILED');
 }

package/src/hub/index.mjs

@@ -642,6 +642,10 @@ export class WorkerRegistry {  constructor(ctx) {
       delivery_complete: !!job.delivery_complete,
       allow_no_changes: job.allow_no_changes === true,
       task_status: job.outcome?.task_status ?? null,
+      // Whether the worker's execution itself completed, kept beside the task-level
+      // verdict: a `partial` task still had a provider response, and that is what
+      // model callability asks about.
+      execution_status: job.outcome?.execution_status ?? null,
       workspace_evidence_ok: job.outcome?.workspace_evidence_ok ?? null,
       review_verdict: job.review?.verdict ?? null,
       workspace_diff_available: !!job.workspaceDiff && ['git', 'filesystem-empty'].includes(job.workspaceDiff.kind),

package/src/install/install-legacy.mjs

@@ -1247,12 +1247,35 @@ export function installHudSegment({ home = homedir() } = {}) {
   return { ok: true, actions: [...(bak ? [`backup: ${bak}`] : []), 'statusLine: claude-hud now runs worker-segment.sh via --extra-cmd'] };
 }
 
-// Only the status line `--statusline` installs is Crew's to remove: it points at
-// Crew's own script. Any other status line in the file belongs to whoever
-// configured it, even when it happens to name this checkout.
-function crewOwnedStatusLine(value) {
-  const command = typeof value?.command === 'string' ? value.command : '';
-  return command.includes('statusline.sh') && command.includes('dsh-crew');
+// The paths Crew has recorded as its own in this Claude host: the marketplace records
+// it wrote (under the current and pre-rename names, in settings and in the CLI's own
+// cache), the constant an older installer used, and the checkout this module runs
+// from. Only these are grounds for removing anything: a directory that merely happens
+// to be named `dsh-crew` belongs to whoever made it, and a path that is not recorded
+// here cannot be identified as Crew's, so it is left alone.
+function crewOwnedRoots({ home, settings, markets, installed }) {
+  const roots = [];
+  const push = (value) => { if (typeof value === 'string' && value.trim() && !roots.includes(value.trim())) roots.push(value.trim()); };
+  for (const name of CREW_CLAUDE_MARKETPLACES) {
+    push(settings?.extraKnownMarketplaces?.[name]?.source?.path);
+    push(markets?.[name]?.source?.path);
+    push(markets?.[name]?.installLocation);
+  }
+  for (const key of CREW_CLAUDE_PLUGIN_KEYS) {
+    const entries = Array.isArray(installed?.plugins?.[key]) ? installed.plugins[key] : [installed?.plugins?.[key]];
+    for (const entry of entries) push(entry?.installPath);
+  }
+  push(join(home, '.config', 'dsh-crew', 'marketplace'));
+  push(ROOT);
+  return roots;
+}
+
+function crewOwnedStatusLine(value, roots) {
+  const command = typeof value?.command === 'string' ? value.command.trim() : '';
+  const match = /^bash\s+(.+)$/i.exec(command);
+  if (!match) return false;
+  const path = normalizedPath(match[1].trim());
+  return path !== null && roots.some((root) => normalizedPath(join(root, 'statusline', 'statusline.sh')) === path);
 }
 
 // The claude CLI records, per marketplace and plugin, what it materialized, in
@@ -1290,12 +1313,19 @@ function removeCrewClaudeCacheRecords({ home, actions }) {
 export function uninstallClaudeCode({ home = homedir() } = {}) {
   const actions = [];
   const settingsFile = join(home, '.claude', 'settings.json');
+  const cacheDir = join(home, '.claude', 'plugins');
   const settings = readJson(settingsFile, null);
+  const markets = readJson(join(cacheDir, 'known_marketplaces.json'), null);
+  const installed = readJson(join(cacheDir, 'installed_plugins.json'), null);
+  const roots = crewOwnedRoots({ home, settings, markets, installed });
   if (settings) {
     backup(settingsFile);
-    const mpDir = join(home, '.config', 'dsh-crew', 'marketplace');
     if (Array.isArray(settings.extraKnownMarketplaces)) {
-      settings.extraKnownMarketplaces = settings.extraKnownMarketplaces.filter((m) => m?.path !== mpDir);
+      // Legacy array shape: an entry is removed only when it IS one of the paths Crew
+      // recorded as its own. What the path is spelled with is not evidence — a
+      // marketplace under someone else's `dsh-crew` directory stays.
+      settings.extraKnownMarketplaces = settings.extraKnownMarketplaces
+        .filter((entry) => !roots.some((root) => normalizedPath(entry?.path) === normalizedPath(root)));
     } else if (settings.extraKnownMarketplaces) {
       for (const name of CREW_CLAUDE_MARKETPLACES) delete settings.extraKnownMarketplaces[name];
     }
@@ -1308,7 +1338,7 @@ export function uninstallClaudeCode({ home = homedir() } = {}) {
       settings.permissions.allow = settings.permissions.allow.filter((rule) => typeof rule !== 'string'
         || !CREW_CLAUDE_PERMISSION_PREFIXES.some((prefix) => rule.startsWith(prefix)));
     }
-    if (crewOwnedStatusLine(settings.statusLine)) {
+    if (crewOwnedStatusLine(settings.statusLine, roots)) {
       delete settings.statusLine;
       actions.push('statusLine: removed (Crew-installed)');
     }

package/src/install/npx-lifecycle.mjs

@@ -3333,7 +3333,7 @@ export function npxStatus({
   // whether 3080 happens to be up right now does not change either answer.
   const frontendConfig = (installer.readGlobalConfig ?? realInstaller.readGlobalConfig)({ configFile: join(home, '.config', 'dsh-crew', 'config.json') });
   const frontend = frontendConfig?.frontend_autostart === true
-    ? 'auto-started at login (dsh-crew open for a session URL)'
+    ? 'configured to auto-start at login (dsh-crew open for a session URL)'
     : 'available on demand (dsh-crew open)';
   log(`Frontend (3080): ${frontend}`);
   // The desktop app carries its own bridge entry, which pins a revision: after a

package/src/log-prune.mjs

@@ -2,9 +2,12 @@
 // new dsh-crew-dsh-crew-3210-<stamp>.out/.err.log pair, every desktop launch a
 // dsh-crew-web-*, every official launch a dsh-official-web-*, and the launcher
 // appends to dsh-crew-launcher.log forever. They are the only post-mortem evidence
-// for a crash-before-readiness, so the rule keeps the most recent runs instead of
-// deleting everything: per family, the newest `keep` runs survive, plus anything
-// written within the recency guard (a running process owns its own log files).
+// for a crash-before-readiness, so the rule bounds them instead of deleting them all.
+// A run survives when it is BOTH within its family's newest `keep` AND younger than
+// the age bound; exceeding either one removes it, unless it was written within the
+// recency guard (a running process owns its own log files). The newest `keep` runs
+// therefore do not survive unconditionally — only a run that is also inside the age
+// bound does, which is what keeps a burst of starts from filling the directory.
 
 import { readdirSync, rmSync, statSync } from 'node:fs';
 import { join } from 'node:path';
@@ -14,10 +17,15 @@ export const DEFAULT_KEEP_RUNS = 10;
 export const DEFAULT_MAX_AGE_DAYS = 14;
 const RECENT_GUARD_MS = 5 * 60 * 1000;
 
+// Per family. The hub-start pairs are what a crash-before-readiness leaves behind,
+// and ten of them are the post-mortem window the policy names; the frontend families
+// are launched far less often and keep the retention they already had, so one
+// family's bound is not silently imposed on the others. An explicit `keepRuns`
+// still applies to every family: that is an operator stating how many runs to keep.
 const LOG_FAMILIES = [
-  { prefix: 'dsh-crew-dsh-crew-3210-', suffix: '.out.log' },
-  { prefix: 'dsh-crew-web-', suffix: '.out.log' },
-  { prefix: 'dsh-official-web-', suffix: '.out.log' },
+  { prefix: 'dsh-crew-dsh-crew-3210-', suffix: '.out.log', keep: 10 },
+  { prefix: 'dsh-crew-web-', suffix: '.out.log', keep: 20 },
+  { prefix: 'dsh-official-web-', suffix: '.out.log', keep: 20 },
 ];
 
 // `dsh-crew-<profile>-<port>-<stamp>.out.log` -> the stamp identifies one run, and
@@ -28,8 +36,11 @@ function runStamp(fileName, family) {
   return stamp || null;
 }
 
-export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = DEFAULT_KEEP_RUNS, maxAgeDays = DEFAULT_MAX_AGE_DAYS, now = Date.now() } = {}) {
-  const keep = Number.isInteger(keepRuns) && keepRuns > 0 ? keepRuns : DEFAULT_KEEP_RUNS;
+export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = null, maxAgeDays = DEFAULT_MAX_AGE_DAYS, now = Date.now() } = {}) {
+  // `keepRuns` is an explicit operator override for every family; without one each
+  // family uses its own bound, so the default is "nothing was asked for" rather than
+  // a number that would flatten them all to the hub's ten.
+  const keepOverride = Number.isInteger(keepRuns) && keepRuns > 0 ? keepRuns : null;
   const maxAgeMs = Number.isFinite(maxAgeDays) && maxAgeDays > 0 ? maxAgeDays * 24 * 60 * 60 * 1000 : DEFAULT_MAX_AGE_DAYS * 24 * 60 * 60 * 1000;
   let names;
   try { names = readdirSync(tempDir); } catch { return { ok: true, removed: [], kept: [], skipped: 'unreadable' }; }
@@ -50,10 +61,16 @@ export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = DEFAULT_KEEP_
       runs.set(stamp, run);
     }
     const ordered = [...runs.values()].sort((left, right) => right.newest - left.newest);
+    const keep = keepOverride ?? family.keep;
     ordered.forEach((run, index) => {
       const tooOld = now - run.newest > maxAgeMs;
       const tooMany = index >= keep;
       const tooRecentToTouch = now - run.newest < RECENT_GUARD_MS;
+      // Delete when EITHER bound is exceeded. The newest `keep` runs are what an
+      // operator reads, and past that a run beyond the age bound is gone regardless
+      // of its rank: keeping an eleventh run merely because it is only hours old
+      // would let a burst of starts grow without bound, which is the growth this
+      // bound exists to stop. A burst of eleven young runs still keeps ten.
       if ((tooOld || tooMany) && !tooRecentToTouch) {
         for (const name of run.files) removed.push(name);
         const errName = run.files[0].replace(/\.out\.log$/, '.err.log');

package/src/readiness-matrix.mjs

@@ -6,6 +6,17 @@
 // verification (real worker, reviewer, cancellation, timeout, etc.).
 
 const READINESS_STATUSES = Object.freeze(['PASS', 'FAIL', 'BLOCKED', 'SKIP', 'NOT_APPLICABLE', 'NOT_RUN']);
+// Statuses a trusted evidence source may report. `NOT_APPLICABLE` is deliberately
+// absent: applicability is a fact about this machine's policy, decided when the row
+// is built, and letting evidence declare a required row "not applicable" would be a
+// way to make a check disappear while the matrix still reads healthy. Evidence can
+// neither create nor clear it.
+const EVIDENCE_STATUSES = Object.freeze(['PASS', 'FAIL', 'BLOCKED', 'SKIP', 'NOT_RUN']);
+// The rows this release may decide are not applicable, and only when the reason is
+// policy rather than observation: the two built-in DeepSeek routes exist to name a
+// provider the operator may not be using. Every other row asks a question that is
+// always applicable to a Crew machine.
+const POLICY_NOT_APPLICABLE_ROWS = Object.freeze(['deepseek_flash', 'deepseek_pro']);
 
 export const READINESS_REASON_CODES = Object.freeze({
   LIVE_CHECK_PASSED: 'LIVE_CHECK_PASSED',
@@ -59,7 +70,24 @@ function baseRow(id, category, status, reasonCode, evidenceSource = 'none', extr
 
 function normalizeEvidence(row, evidence) {
   if (!evidence || typeof evidence !== 'object') return row;
-  if (!READINESS_STATUSES.includes(evidence.status)) return row;
+  if (!EVIDENCE_STATUSES.includes(evidence.status)) return row;
+  // A row the policy marked not applicable keeps that status: reported evidence says
+  // something happened, not that the current worker route changed, and letting it
+  // flip the row is how "this route is unused" would turn into "this route passed".
+  // What was reported is kept as metadata rather than thrown away.
+  if (row.status === 'NOT_APPLICABLE') {
+    // The same sanitized fields an applied record keeps, so "the observation is not
+    // lost" is a statement the code supports rather than a claim about three of five.
+    const source = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
+    const reported = {
+      status: evidence.status,
+      ...(source(evidence.reason_code) ? { reason_code: source(evidence.reason_code) } : {}),
+      ...(source(evidence.evidence_source) ? { evidence_source: source(evidence.evidence_source) } : {}),
+      ...(source(evidence.evidence_ref) ? { evidence_ref: source(evidence.evidence_ref) } : {}),
+      ...(source(evidence.detail_code) && /^[A-Z][A-Z0-9_]{0,127}$/u.test(evidence.detail_code) ? { detail_code: evidence.detail_code } : {}),
+    };
+    return { ...row, reported_evidence: reported };
+  }
   const reason = typeof evidence.reason_code === 'string' && evidence.reason_code.trim()
     ? evidence.reason_code.trim()
     : READINESS_REASON_CODES.EVIDENCE_REPORTED;
@@ -171,12 +199,13 @@ export function buildReadinessMatrix({
   // answered), and neither status can move the aggregate — only a FAIL, an
   // UNPROVEN row or an UNAVAILABLE component does. An unknown selection stays
   // NOT_RUN: this matrix is conservative, and "we could not tell" must not read as
-  // "not applicable". Reported evidence still wins, because it is applied below.
+  // "not applicable". This policy decision is also final for the row: evidence
+  // applied below records what it saw without changing the status back.
   const selectionKnown = typeof workerSelection?.provider === 'string' && workerSelection.provider.length > 0;
   const deepseekRouteSelected = workerProviderMode === 'deepseek-official'
     || workerSelection?.provider === 'deepseek-official';
-  if (workerProviderMode !== null && selectionKnown && !deepseekRouteSelected) {
-    for (const id of ['deepseek_flash', 'deepseek_pro']) {
+  if (workerProviderMode === 'follow-dsh' && selectionKnown && !deepseekRouteSelected) {
+    for (const id of POLICY_NOT_APPLICABLE_ROWS) {
       rows[id] = baseRow(id, 'real-execution', 'NOT_APPLICABLE', READINESS_REASON_CODES.WORKER_PROVIDER_FOLLOWS_DSH, 'runtime-policy');
     }
   }
@@ -192,7 +221,10 @@ export function buildReadinessMatrix({
   ]));
 
   return {
-    schema_version: 1,
+    // A row can now legally be NOT_APPLICABLE and the summary carries a matching key,
+    // so the vocabulary a strict consumer must accept changed: that is what the
+    // version means here, not a change in the rules that produce PASS.
+    schema_version: 2,
     platform,
     conservative: true,
     summary: counts,

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.7';
+export const RUNTIME_VERSION = '2.2.9';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/runtime-readiness-snapshot.mjs

@@ -108,9 +108,17 @@ function projectModelRole({ role, selected, health, jobs, runtime, now, executio
   if (healthCurrent && matchingHealth.state === 'callable') {
     return { state: 'CALLABLE', reason_code: matchingHealth.reason_code ?? 'PROVIDER_CALLABLE', selected, observed_at: matchingHealth.observed_at ?? null, expires_at: expiresAt, source: 'provider_health', last_success: null };
   }
+  // Callability asks for positive proof that the provider answered, so the ledger
+  // fact that proves it is the one that says the execution ended normally: a job the
+  // worker recorded as `done` whose `execution_status` is `completed`. The task-level
+  // verdict is deliberately NOT part of this — a `partial` task still had a provider
+  // response — and a job whose execution failed or was never recorded is not evidence
+  // of a response, however its task was later classified. A recovery probe or a real
+  // run is what a route without such a job needs.
+  const responded = (job) => job?.execution_status === 'completed';
   const completed = (Array.isArray(jobs) ? jobs : [])
     .filter((job) => job?.role === role && job?.provider === selected.provider && job?.model === selected.model
-      && job?.status === 'done' && job?.task_status === 'success'
+      && job?.status === 'done' && responded(job)
       && sameCompleteRuntimeIdentity(job.execution_context, runtime))
     .map((job) => ({ job, endedAt: Date.parse(job.endedAt ?? '') }))
     .filter(({ endedAt }) => Number.isFinite(endedAt))

package/windows/start-dsh-crew.cmd

@@ -32,6 +32,7 @@ if not "%~1"=="" goto :invalid_argument
 set "LAUNCH_HELPER=%LAUNCH_DIR%start-dsh-crew.ps1"
 set "LAUNCH_LOG=%TEMP%\dsh-crew-launcher.log"
 if not exist "%LAUNCH_HELPER%" (
+  call :rotate_launcher_log
   >>"%LAUNCH_LOG%" echo [%date% %time%] ERROR Managed launcher helper is missing: %LAUNCH_HELPER%
   echo ERROR: DSH Crew launcher helper is missing.
   echo Repair it with: dsh-crew update
@@ -51,6 +52,21 @@ echo ERROR: Unsupported launcher arguments: %LAUNCH_REQUEST%
 echo Use --open, --background, or --watch.
 exit /b 64
 
+:rotate_launcher_log
+rem The PowerShell launcher bounds this log at 5 MiB before its first line, but the
+rem emergency path that calls this is what runs when that helper is MISSING — so a
+rem bounded log cannot depend on the helper whose absence is one of the failures the
+rem log exists to diagnose. Same cap, same two generations, best-effort: a locked or
+rem unreadable log is left alone rather than failing the launch.
+set "LAUNCH_LOG_SIZE="
+for %%A in ("%LAUNCH_LOG%") do set "LAUNCH_LOG_SIZE=%%~zA"
+if not defined LAUNCH_LOG_SIZE goto :eof
+if %LAUNCH_LOG_SIZE% LSS 5242880 goto :eof
+if exist "%LAUNCH_LOG%.2" del /f /q "%LAUNCH_LOG%.2" >nul 2>&1
+if exist "%LAUNCH_LOG%.1" move /y "%LAUNCH_LOG%.1" "%LAUNCH_LOG%.2" >nul 2>&1
+move /y "%LAUNCH_LOG%" "%LAUNCH_LOG%.1" >nul 2>&1
+goto :eof
+
 :help
 echo Usage: %~nx0 [--open ^| --background ^| --watch]
 echo   --open        Open official Harness on 3080 and return once Crew is supervised;