@ran-sh/dsh-crew 2.2.9 → 2.2.11

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.2.9",
+  "version": "2.2.11",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.2.9",
+  "version": "2.2.11",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/crew-workspaces.mjs

@@ -27,6 +27,8 @@ import {
   defaultWorktreeRoot,
   inspectRepository,
   resetWorktreeTo,
+  sameRepoPath,
+  withSafeDirectory,
 } from './workspace-isolation.mjs';
 import { acquireWorkspaceLock, DEFAULT_LOCK_WAIT_MS } from './workspace-lock.mjs';
 
@@ -81,6 +83,14 @@ export function crewWorkspaceLockPath({ repoRoot, role, root = defaultWorktreeRo
  */
 export async function ensureCrewWorkspace({
   cwd,
+  // The repository root the REQUEST named, when Crew may trust it for this job's git
+  // subprocesses. A shared checkout can be owned by another account, and Git refuses
+  // to read it without a `safe.directory` exception; the exception is scoped to this
+  // one root, and the repository Git resolves must be exactly that root — anything
+  // else (a subdirectory cwd, a different repo) fails closed rather than widening the
+  // trust. Worktree-local operations do not get the exception: the worktree Crew
+  // creates is owned by the account Crew runs as.
+  trustedRepoRoot = null,
   role,
   baseRevision,
   at,
@@ -92,8 +102,16 @@ export async function ensureCrewWorkspace({
   isAlive,
   pid,
 } = {}) {
-  const repo = await inspectRepository({ cwd, git });
+  const run = trustedRepoRoot ? withSafeDirectory(git, trustedRepoRoot) : git;
+  const repo = await inspectRepository({ cwd, git: run });
   if (!repo.ok) return { ok: false, reason: repo.reason, error: repo.error };
+  if (trustedRepoRoot && !sameRepoPath(repo.repoRoot, trustedRepoRoot)) {
+    return {
+      ok: false,
+      reason: 'WORKSPACE_TRUST_ANCHOR_MISMATCH',
+      error: `git resolved ${repo.repoRoot}, not the trusted root ${trustedRepoRoot}; run the job at the repository root or register a workspace context`,
+    };
+  }
   const repoRoot = repo.repoRoot;
   const revision = baseRevision ?? repo.baseRevision;
   const name = crewWorkspaceName(role);
@@ -109,7 +127,7 @@ export async function ensureCrewWorkspace({
     return { ok: false, reason, error };
   };
 
-  const reused = await crewOwnsWorktree({ worktreePath, repoRoot, git });
+  const reused = await crewOwnsWorktree({ worktreePath, repoRoot, git: run });
   if (!reused) {
     if (existsSync(worktreePath)) {
       // Something is there that Crew did not create. Deleting it would be a
@@ -117,7 +135,7 @@ export async function ensureCrewWorkspace({
       // say which path is in the way.
       return fail(WORKSPACE_CONFLICT, `workspace path exists but is not a Crew worktree of this repository: ${worktreePath}`);
     }
-    const created = await createWorktreeAt({ dir: worktreePath, repoRoot, revision, purpose: name, at, git });
+    const created = await createWorktreeAt({ dir: worktreePath, repoRoot, revision, purpose: name, at, git: run });
     if (!created.ok) return fail(created.reason, created.error);
   }
 

package/src/install/install-legacy.mjs

@@ -1249,10 +1249,11 @@ export function installHudSegment({ home = homedir() } = {}) {
 
 // The paths Crew has recorded as its own in this Claude host: the marketplace records
 // it wrote (under the current and pre-rename names, in settings and in the CLI's own
-// cache), the constant an older installer used, and the checkout this module runs
-// from. Only these are grounds for removing anything: a directory that merely happens
-// to be named `dsh-crew` belongs to whoever made it, and a path that is not recorded
-// here cannot be identified as Crew's, so it is left alone.
+// cache) and the constant an older installer used. Only these are grounds for removing
+// anything: a directory that merely happens to be named `dsh-crew` belongs to whoever
+// made it, the module's own checkout is not evidence (an uninstall may run from a
+// checkout this host never recorded), and a path that is not recorded here is left
+// alone.
 function crewOwnedRoots({ home, settings, markets, installed }) {
   const roots = [];
   const push = (value) => { if (typeof value === 'string' && value.trim() && !roots.includes(value.trim())) roots.push(value.trim()); };
@@ -1266,7 +1267,6 @@ function crewOwnedRoots({ home, settings, markets, installed }) {
     for (const entry of entries) push(entry?.installPath);
   }
   push(join(home, '.config', 'dsh-crew', 'marketplace'));
-  push(ROOT);
   return roots;
 }
 

package/src/install/npx-lifecycle.mjs

@@ -2785,6 +2785,9 @@ export async function npxLogs({ args = [], log = console.log } = {}) {
   const keep = Number(args[1]);
   const result = pruneCrewTempLogs(Number.isInteger(keep) && keep > 0 ? { keepRuns: keep } : {});
   log(`✓ Crew diagnostics pruned: removed ${result.removed.length} file(s); kept ${result.kept.length} run(s)`);
+  if (result.failed?.length) {
+    log(`- ${result.failed.length} file(s) could not be deleted (a running process may hold them); they are counted in neither number and the next prune retries`);
+  }
   return { ok: true, ...result };
 }
 

package/src/log-prune.mjs

@@ -26,7 +26,14 @@ const LOG_FAMILIES = [
   { prefix: 'dsh-crew-dsh-crew-3210-', suffix: '.out.log', keep: 10 },
   { prefix: 'dsh-crew-web-', suffix: '.out.log', keep: 20 },
   { prefix: 'dsh-official-web-', suffix: '.out.log', keep: 20 },
-];
+].map((family) => ({
+  ...family,
+  // An `.err.log` whose `.out.log` sibling is gone (or was never written) is still a
+  // Crew diagnostic, so each family recognizes its error files as prunable runs too.
+  errStamp: (name) => name.startsWith(family.prefix) && name.endsWith('.err.log')
+    ? name.slice(family.prefix.length, name.length - '.err.log'.length) || null
+    : null,
+}));
 
 // `dsh-crew-<profile>-<port>-<stamp>.out.log` -> the stamp identifies one run, and
 // its .err.log sibling must live or die with it.
@@ -51,14 +58,28 @@ export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = null, maxAgeD
     const runs = new Map();
     for (const name of names) {
       const stamp = runStamp(name, family);
-      if (!stamp) continue;
+      if (stamp) {
+        const file = join(tempDir, name);
+        let mtimeMs = 0;
+        try { mtimeMs = statSync(file).mtimeMs; } catch { continue; }
+        const run = runs.get(stamp) ?? { stamp, files: [], newest: 0 };
+        run.files.push(name);
+        run.newest = Math.max(run.newest, mtimeMs);
+        runs.set(stamp, run);
+        continue;
+      }
+      // An orphan `.err.log` (its `.out.log` sibling already pruned or never written)
+      // is still a Crew diagnostic: prune it on its own stamp so a half-written run
+      // cannot outlive every bound.
+      const errStamp = family.errStamp(name);
+      if (!errStamp) continue;
       const file = join(tempDir, name);
       let mtimeMs = 0;
       try { mtimeMs = statSync(file).mtimeMs; } catch { continue; }
-      const run = runs.get(stamp) ?? { stamp, files: [], newest: 0 };
+      const run = runs.get(errStamp) ?? { stamp: errStamp, files: [], newest: 0 };
       run.files.push(name);
       run.newest = Math.max(run.newest, mtimeMs);
-      runs.set(stamp, run);
+      runs.set(errStamp, run);
     }
     const ordered = [...runs.values()].sort((left, right) => right.newest - left.newest);
     const keep = keepOverride ?? family.keep;
@@ -73,15 +94,23 @@ export function pruneCrewTempLogs({ tempDir = tmpdir(), keepRuns = null, maxAgeD
       // bound exists to stop. A burst of eleven young runs still keeps ten.
       if ((tooOld || tooMany) && !tooRecentToTouch) {
         for (const name of run.files) removed.push(name);
-        const errName = run.files[0].replace(/\.out\.log$/, '.err.log');
-        if (names.includes(errName)) removed.push(errName);
       } else {
         kept.push(run.stamp);
       }
     });
   }
-  for (const name of removed) {
-    try { rmSync(join(tempDir, name), { force: true }); } catch { /* a locked file stays until the next pass */ }
+  // `removed` lists what is actually gone. A locked file (Windows holds a log open
+  // while its process runs) is reported in `failed` instead of pretending a deletion
+  // happened: the next pass tries again, and the operator is not told a number that
+  // is not true.
+  const failed = [];
+  for (const name of [...new Set(removed)]) {
+    try { rmSync(join(tempDir, name), { force: true }); } catch { failed.push(name); }
   }
-  return { ok: true, removed: [...new Set(removed)].sort(), kept: kept.sort() };
+  return {
+    ok: failed.length === 0 ? true : 'partial',
+    removed: removed.filter((name) => !failed.includes(name)).sort(),
+    kept: kept.sort(),
+    ...(failed.length ? { failed: failed.sort() } : {}),
+  };
 }

package/src/mcp-runtime.mjs

@@ -14,6 +14,7 @@ import {
   cleanupIsolatedWorkspace,
   inspectRepository,
   captureCandidate as captureIsolationCandidate,
+  withSafeDirectory,
 } from './workspace-isolation.mjs';
 import { startJob, waitJob, jobView, cancelJob } from './jobs.mjs';
 import { hub } from './hub-client.mjs';
@@ -297,7 +298,13 @@ export function buildMcpWorkflowRuntime(deps) {
     }
     // Isolated roles fail closed when the workspace
     // is not a git repo — never silently fall back to sharing the working tree.
-    const repo = await inspectRepository({ cwd: job.requested_cwd });
+    // The pre-check and the workspace entry share one scoped exception: the
+    // requested cwd is the only root this dispatch may trust, and only when Git
+    // resolves it as the repository root (a shared checkout owned by another
+    // account is the case this exists for).
+    const trustedRoot = job.requested_cwd;
+    const scopedGit = withSafeDirectory(null, trustedRoot);
+    const repo = await inspectRepository({ cwd: job.requested_cwd, git: scopedGit });
     if (!repo.ok) {
       return { ok: false, reason: repo.reason ?? 'ISOLATION_UNAVAILABLE', error: `${job.role ?? 'worker'} needs an isolated git worktree: ${repo.error ?? repo.reason}` };
     }
@@ -309,6 +316,7 @@ export function buildMcpWorkflowRuntime(deps) {
     // cannot share it.
     const workspace = await ensureCrewWorkspace({
       cwd: job.requested_cwd,
+      trustedRepoRoot: trustedRoot,
       role: job.role ?? 'worker',
       baseRevision: job.workspace_branch ?? repo.baseRevision,
     });

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.2.9';
+export const RUNTIME_VERSION = '2.2.11';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([

package/src/runtime-readiness-snapshot.mjs

@@ -251,7 +251,12 @@ export function reprojectRuntimeModelCallability(snapshot, { enabled_roles = {},
   const roles = {};
   for (const role of ['worker', 'reviewer']) {
     if (enabled_roles?.[role] === false) {
-      roles[role] = { state: 'NOT_APPLICABLE', reason_code: 'ROLE_DISABLED', selected: null, last_success: null };
+      // The hub may still record a selected route for a role this session disables;
+      // keeping that route here (rather than nulling it) is what lets the canonical
+      // validation below accept the reprojection. Nulling it manufactured a
+      // selection mismatch against the unchanged outer snapshot and read the whole
+      // contract as DEGRADED for an intentionally disabled role.
+      roles[role] = { state: 'NOT_APPLICABLE', reason_code: 'ROLE_DISABLED', selected: snapshot[role]?.selected ?? null, last_success: null };
     } else if (sourceProjection.enabled_roles?.[role] === true) {
       roles[role] = structuredClone(sourceProjection.roles[role]);
     } else {
@@ -275,9 +280,14 @@ export function reprojectRuntimeModelCallability(snapshot, { enabled_roles = {},
     projection: projected,
     runtime: snapshot.runtime,
     expectedEnabledRoles: projected.enabled_roles,
+    // Expected selections are the routes the snapshot RECORDED, for disabled roles
+    // too: the canonical rule is "a disabled role keeps its route", and expecting
+    // null here would contradict the very projection this function just built — the
+    // mismatch then discarded a healthy worker's evidence and read the session as
+    // degraded for a role that was intentionally switched off.
     expectedSelections: {
-      worker: enabled_roles.worker === true ? snapshot.worker?.selected ?? null : null,
-      reviewer: enabled_roles.reviewer === true ? snapshot.reviewer?.selected ?? null : null,
+      worker: snapshot.worker?.selected ?? null,
+      reviewer: snapshot.reviewer?.selected ?? null,
     },
     now,
   });

package/src/workspace-isolation.mjs

@@ -77,6 +77,33 @@ async function runGit(runner, args, opts) {
   }
 }
 
+function repoPathKey(value) {
+  try {
+    const p = resolve(String(value ?? ''));
+    return process.platform === 'win32' ? p.toLowerCase() : p;
+  } catch { return String(value ?? ''); }
+}
+
+/** Whether two paths name the same repository root on this platform. */
+export function sameRepoPath(left, right) {
+  const a = repoPathKey(left);
+  const b = repoPathKey(right);
+  return a.length > 0 && a === b;
+}
+
+// A shared checkout can be owned by another Windows account, and Git refuses even to
+// read it ("dubious ownership"); the operator's usual remedy, a global
+// `safe.directory` entry, is one Crew must never write. `-c safe.directory=<root>` is
+// the scoped form: it lives and dies with the subprocess, persists nothing, and names
+// exactly one repository rather than a wildcard. Callers pass the root the request
+// itself named, and the workspace entry fails closed when Git resolves any other
+// repository.
+export function withSafeDirectory(git, trustedRepoRoot) {
+  const run = git ?? defaultRunner;
+  const safe = resolve(String(trustedRepoRoot ?? ''));
+  return (args, opts) => run(['-c', `safe.directory=${safe}`, ...args], opts);
+}
+
 const PURPOSE_MAX = 32;
 
 /** Local wall-clock stamp: readable, and what an operator expects to see. */