@ran-sh/dsh-crew 2.2.8 → 2.2.10

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.8",
+  "version": "2.2.10",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.8",
+  "version": "2.2.10",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/install/install-legacy.mjs

@@ -1247,26 +1247,35 @@ export function installHudSegment({ home = homedir() } = {}) {
   return { ok: true, actions: [...(bak ? [`backup: ${bak}`] : []), 'statusLine: claude-hud now runs worker-segment.sh via --extra-cmd'] };
 }
 
-// Crew-owned directories, identified by path SEGMENT rather than by substring: the
-// payload tree lives under `.../dsh-crew/...` and the pre-rename identity used
-// `dsh-workers`. A user path that merely contains those words (`my-dsh-crew-notes`)
-// is not Crew's, and nothing here may treat it as if it were.
-function crewOwnedDirectory(value) {
-  if (typeof value !== 'string' || !value.trim()) return false;
-  return value.split(/[\\/]+/).filter(Boolean).some((segment) => {
-    const lower = segment.toLowerCase();
-    return lower === 'dsh-crew' || lower === 'dsh-workers';
-  });
+// The paths Crew has recorded as its own in this Claude host: the marketplace records
+// it wrote (under the current and pre-rename names, in settings and in the CLI's own
+// cache) and the constant an older installer used. Only these are grounds for removing
+// anything: a directory that merely happens to be named `dsh-crew` belongs to whoever
+// made it, the module's own checkout is not evidence (an uninstall may run from a
+// checkout this host never recorded), and a path that is not recorded here is left
+// alone.
+function crewOwnedRoots({ home, settings, markets, installed }) {
+  const roots = [];
+  const push = (value) => { if (typeof value === 'string' && value.trim() && !roots.includes(value.trim())) roots.push(value.trim()); };
+  for (const name of CREW_CLAUDE_MARKETPLACES) {
+    push(settings?.extraKnownMarketplaces?.[name]?.source?.path);
+    push(markets?.[name]?.source?.path);
+    push(markets?.[name]?.installLocation);
+  }
+  for (const key of CREW_CLAUDE_PLUGIN_KEYS) {
+    const entries = Array.isArray(installed?.plugins?.[key]) ? installed.plugins[key] : [installed?.plugins?.[key]];
+    for (const entry of entries) push(entry?.installPath);
+  }
+  push(join(home, '.config', 'dsh-crew', 'marketplace'));
+  return roots;
 }
 
-// Only the status line `--statusline` installs is Crew's to remove: it points at
-// Crew's own script, in Crew's own directory, in the exact shape the installer
-// writes (`bash <root>/statusline/statusline.sh`). A command that merely mentions
-// these words belongs to whoever wrote it.
-function crewOwnedStatusLine(value) {
+function crewOwnedStatusLine(value, roots) {
   const command = typeof value?.command === 'string' ? value.command.trim() : '';
-  const match = /^bash\s+(.+[\\/])statusline[\\/]statusline\.sh$/i.exec(command);
-  return match ? crewOwnedDirectory(match[1]) : false;
+  const match = /^bash\s+(.+)$/i.exec(command);
+  if (!match) return false;
+  const path = normalizedPath(match[1].trim());
+  return path !== null && roots.some((root) => normalizedPath(join(root, 'statusline', 'statusline.sh')) === path);
 }
 
 // The claude CLI records, per marketplace and plugin, what it materialized, in
@@ -1304,16 +1313,19 @@ function removeCrewClaudeCacheRecords({ home, actions }) {
 export function uninstallClaudeCode({ home = homedir() } = {}) {
   const actions = [];
   const settingsFile = join(home, '.claude', 'settings.json');
+  const cacheDir = join(home, '.claude', 'plugins');
   const settings = readJson(settingsFile, null);
+  const markets = readJson(join(cacheDir, 'known_marketplaces.json'), null);
+  const installed = readJson(join(cacheDir, 'installed_plugins.json'), null);
+  const roots = crewOwnedRoots({ home, settings, markets, installed });
   if (settings) {
     backup(settingsFile);
-    const mpDir = join(home, '.config', 'dsh-crew', 'marketplace');
     if (Array.isArray(settings.extraKnownMarketplaces)) {
-      // Legacy array shape: entries are `{ path }` records this installer wrote under
-      // one of its own names, including the pre-rename one. Anything else in that
-      // array belongs to another plugin and stays.
+      // Legacy array shape: an entry is removed only when it IS one of the paths Crew
+      // recorded as its own. What the path is spelled with is not evidence — a
+      // marketplace under someone else's `dsh-crew` directory stays.
       settings.extraKnownMarketplaces = settings.extraKnownMarketplaces
-        .filter((entry) => !crewOwnedDirectory(entry?.path) && entry?.path !== mpDir);
+        .filter((entry) => !roots.some((root) => normalizedPath(entry?.path) === normalizedPath(root)));
     } else if (settings.extraKnownMarketplaces) {
       for (const name of CREW_CLAUDE_MARKETPLACES) delete settings.extraKnownMarketplaces[name];
     }
@@ -1326,7 +1338,7 @@ export function uninstallClaudeCode({ home = homedir() } = {}) {
       settings.permissions.allow = settings.permissions.allow.filter((rule) => typeof rule !== 'string'
         || !CREW_CLAUDE_PERMISSION_PREFIXES.some((prefix) => rule.startsWith(prefix)));
     }
-    if (crewOwnedStatusLine(settings.statusLine)) {
+    if (crewOwnedStatusLine(settings.statusLine, roots)) {
       delete settings.statusLine;
       actions.push('statusLine: removed (Crew-installed)');
     }

package/src/install/npx-lifecycle.mjs

@@ -2785,6 +2785,9 @@ export async function npxLogs({ args = [], log = console.log } = {}) {
   const keep = Number(args[1]);
   const result = pruneCrewTempLogs(Number.isInteger(keep) && keep > 0 ? { keepRuns: keep } : {});
   log(`✓ Crew diagnostics pruned: removed ${result.removed.length} file(s); kept ${result.kept.length} run(s)`);
+  if (result.failed?.length) {
+    log(`- ${result.failed.length} file(s) could not be deleted (a running process may hold them); they are counted in neither number and the next prune retries`);
+  }
   return { ok: true, ...result };
 }
 

package/src/log-prune.mjs

@@ -2,9 +2,12 @@
 // new dsh-crew-dsh-crew-3210-<stamp>.out/.err.log pair, every desktop launch a
 // dsh-crew-web-*, every official launch a dsh-official-web-*, and the launcher
 // appends to dsh-crew-launcher.log forever. They are the only post-mortem evidence
-// for a crash-before-readiness, so the rule keeps the most recent runs instead of
-// deleting everything: per family, the newest `keep` runs survive, plus anything
-// written within the recency guard (a running process owns its own log files).
+// for a crash-before-readiness, so the rule bounds them instead of deleting them all.
+// A run survives when it is BOTH within its family's newest `keep` AND younger than
+// the age bound; exceeding either one removes it, unless it was written within the
+// recency guard (a running process owns its own log files). The newest `keep` runs
+// therefore do not survive unconditionally — only a run that is also inside the age
+// bound does, which is what keeps a burst of starts from filling the directory.
 
 import { readdirSync, rmSync, statSync } from 'node:fs';
 import { join } from 'node:path';
@@ -23,7 +26,14 @@ const LOG_FAMILIES = [
   { prefix: 'dsh-crew-dsh-crew-3210-', suffix: '.out.log', keep: 10 },
   { prefix: 'dsh-crew-web-', suffix: '.out.log', keep: 20 },
   { prefix: 'dsh-official-web-', suffix: '.out.log', keep: 20 },
-];
+].map((family) => ({
+  ...family,
+  // An `.err.log` whose `.out.log` sibling is gone (or was never written) is still a
+  // Crew diagnostic, so each family recognizes its error files as prunable runs too.
+  errStamp: (name) => name.startsWith(family.prefix) && name.endsWith('.err.log')
+    ? name.slice(family.prefix.length, name.length - '.err.log'.length) || null
+    : null,
+}));
 
 // `dsh-crew-<profile>-<port>-<stamp>.out.log` -> the stamp identifies one run, and
 // its .err.log sibling must live or die with it.
@@ -48,14 +58,28 @@ export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = null, maxAgeD
     const runs = new Map();
     for (const name of names) {
       const stamp = runStamp(name, family);
-      if (!stamp) continue;
+      if (stamp) {
+        const file = join(tempDir, name);
+        let mtimeMs = 0;
+        try { mtimeMs = statSync(file).mtimeMs; } catch { continue; }
+        const run = runs.get(stamp) ?? { stamp, files: [], newest: 0 };
+        run.files.push(name);
+        run.newest = Math.max(run.newest, mtimeMs);
+        runs.set(stamp, run);
+        continue;
+      }
+      // An orphan `.err.log` (its `.out.log` sibling already pruned or never written)
+      // is still a Crew diagnostic: prune it on its own stamp so a half-written run
+      // cannot outlive every bound.
+      const errStamp = family.errStamp(name);
+      if (!errStamp) continue;
       const file = join(tempDir, name);
       let mtimeMs = 0;
       try { mtimeMs = statSync(file).mtimeMs; } catch { continue; }
-      const run = runs.get(stamp) ?? { stamp, files: [], newest: 0 };
+      const run = runs.get(errStamp) ?? { stamp: errStamp, files: [], newest: 0 };
       run.files.push(name);
       run.newest = Math.max(run.newest, mtimeMs);
-      runs.set(stamp, run);
+      runs.set(errStamp, run);
     }
     const ordered = [...runs.values()].sort((left, right) => right.newest - left.newest);
     const keep = keepOverride ?? family.keep;
@@ -70,15 +94,23 @@ export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = null, maxAgeD
       // bound exists to stop. A burst of eleven young runs still keeps ten.
       if ((tooOld || tooMany) && !tooRecentToTouch) {
         for (const name of run.files) removed.push(name);
-        const errName = run.files[0].replace(/\.out\.log$/, '.err.log');
-        if (names.includes(errName)) removed.push(errName);
       } else {
         kept.push(run.stamp);
       }
     });
   }
-  for (const name of removed) {
-    try { rmSync(join(tempDir, name), { force: true }); } catch { /* a locked file stays until the next pass */ }
+  // `removed` lists what is actually gone. A locked file (Windows holds a log open
+  // while its process runs) is reported in `failed` instead of pretending a deletion
+  // happened: the next pass tries again, and the operator is not told a number that
+  // is not true.
+  const failed = [];
+  for (const name of [...new Set(removed)]) {
+    try { rmSync(join(tempDir, name), { force: true }); } catch { failed.push(name); }
   }
-  return { ok: true, removed: [...new Set(removed)].sort(), kept: kept.sort() };
+  return {
+    ok: failed.length === 0 ? true : 'partial',
+    removed: removed.filter((name) => !failed.includes(name)).sort(),
+    kept: kept.sort(),
+    ...(failed.length ? { failed: failed.sort() } : {}),
+  };
 }

package/src/readiness-matrix.mjs

@@ -76,8 +76,17 @@ function normalizeEvidence(row, evidence) {
   // flip the row is how "this route is unused" would turn into "this route passed".
   // What was reported is kept as metadata rather than thrown away.
   if (row.status === 'NOT_APPLICABLE') {
-    if (typeof evidence.status !== 'string') return row;
-    return { ...row, reported_evidence: { status: evidence.status, ...(typeof evidence.reason_code === 'string' && evidence.reason_code.trim() ? { reason_code: evidence.reason_code.trim() } : {}), ...(typeof evidence.evidence_source === 'string' && evidence.evidence_source.trim() ? { evidence_source: evidence.evidence_source.trim() } : {}) } };
+    // The same sanitized fields an applied record keeps, so "the observation is not
+    // lost" is a statement the code supports rather than a claim about three of five.
+    const source = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
+    const reported = {
+      status: evidence.status,
+      ...(source(evidence.reason_code) ? { reason_code: source(evidence.reason_code) } : {}),
+      ...(source(evidence.evidence_source) ? { evidence_source: source(evidence.evidence_source) } : {}),
+      ...(source(evidence.evidence_ref) ? { evidence_ref: source(evidence.evidence_ref) } : {}),
+      ...(source(evidence.detail_code) && /^[A-Z][A-Z0-9_]{0,127}$/u.test(evidence.detail_code) ? { detail_code: evidence.detail_code } : {}),
+    };
+    return { ...row, reported_evidence: reported };
   }
   const reason = typeof evidence.reason_code === 'string' && evidence.reason_code.trim()
     ? evidence.reason_code.trim()
@@ -195,7 +204,7 @@ export function buildReadinessMatrix({
   const selectionKnown = typeof workerSelection?.provider === 'string' && workerSelection.provider.length > 0;
   const deepseekRouteSelected = workerProviderMode === 'deepseek-official'
     || workerSelection?.provider === 'deepseek-official';
-  if (workerProviderMode !== null && selectionKnown && !deepseekRouteSelected) {
+  if (workerProviderMode === 'follow-dsh' && selectionKnown && !deepseekRouteSelected) {
     for (const id of POLICY_NOT_APPLICABLE_ROWS) {
       rows[id] = baseRow(id, 'real-execution', 'NOT_APPLICABLE', READINESS_REASON_CODES.WORKER_PROVIDER_FOLLOWS_DSH, 'runtime-policy');
     }

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.8';
+export const RUNTIME_VERSION = '2.2.10';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/runtime-readiness-snapshot.mjs

@@ -108,12 +108,14 @@ function projectModelRole({ role, selected, health, jobs, runtime, now, executio
   if (healthCurrent && matchingHealth.state === 'callable') {
     return { state: 'CALLABLE', reason_code: matchingHealth.reason_code ?? 'PROVIDER_CALLABLE', selected, observed_at: matchingHealth.observed_at ?? null, expires_at: expiresAt, source: 'provider_health', last_success: null };
   }
-  // What proves the route ran is a provider response, not a passing task contract:
-  // a job that reached `done` with its execution completed has demonstrably called
-  // the selected model even when the task itself came back `partial`. Failed and
-  // cancelled work never reaches this predicate, and neither does a job that errored
-  // before the model answered (its execution_status is `failed`, not `completed`).
-  const responded = (job) => job?.task_status === 'success' || job?.execution_status === 'completed';
+  // Callability asks for positive proof that the provider answered, so the ledger
+  // fact that proves it is the one that says the execution ended normally: a job the
+  // worker recorded as `done` whose `execution_status` is `completed`. The task-level
+  // verdict is deliberately NOT part of this — a `partial` task still had a provider
+  // response — and a job whose execution failed or was never recorded is not evidence
+  // of a response, however its task was later classified. A recovery probe or a real
+  // run is what a route without such a job needs.
+  const responded = (job) => job?.execution_status === 'completed';
   const completed = (Array.isArray(jobs) ? jobs : [])
     .filter((job) => job?.role === role && job?.provider === selected.provider && job?.model === selected.model
       && job?.status === 'done' && responded(job)
@@ -249,7 +251,12 @@ export function reprojectRuntimeModelCallability(snapshot, { enabled_roles = {},
   const roles = {};
   for (const role of ['worker', 'reviewer']) {
     if (enabled_roles?.[role] === false) {
-      roles[role] = { state: 'NOT_APPLICABLE', reason_code: 'ROLE_DISABLED', selected: null, last_success: null };
+      // The hub may still record a selected route for a role this session disables;
+      // keeping that route here (rather than nulling it) is what lets the canonical
+      // validation below accept the reprojection. Nulling it manufactured a
+      // selection mismatch against the unchanged outer snapshot and read the whole
+      // contract as DEGRADED for an intentionally disabled role.
+      roles[role] = { state: 'NOT_APPLICABLE', reason_code: 'ROLE_DISABLED', selected: snapshot[role]?.selected ?? null, last_success: null };
     } else if (sourceProjection.enabled_roles?.[role] === true) {
       roles[role] = structuredClone(sourceProjection.roles[role]);
     } else {
@@ -273,9 +280,14 @@ export function reprojectRuntimeModelCallability(snapshot, { enabled_roles = {},
     projection: projected,
     runtime: snapshot.runtime,
     expectedEnabledRoles: projected.enabled_roles,
+    // Expected selections are the routes the snapshot RECORDED, for disabled roles
+    // too: the canonical rule is "a disabled role keeps its route", and expecting
+    // null here would contradict the very projection this function just built — the
+    // mismatch then discarded a healthy worker's evidence and read the session as
+    // degraded for a role that was intentionally switched off.
     expectedSelections: {
-      worker: enabled_roles.worker === true ? snapshot.worker?.selected ?? null : null,
-      reviewer: enabled_roles.reviewer === true ? snapshot.reviewer?.selected ?? null : null,
+      worker: snapshot.worker?.selected ?? null,
+      reviewer: snapshot.reviewer?.selected ?? null,
     },
     now,
   });