dsh-tower 2.0.4 → 2.1.0

package/lib/legacy.js

@@ -9,7 +9,7 @@
 //
 // `validateLegacyMap` is the audit-only mapping check: a map is a record that
 // legacy id X corresponds to DSH mission Y. It never adopts or restores work.
-import fsp from 'node:fs/promises'
+import { fsp } from '../adapters/store-fs.js'
 import path from 'node:path'
 import crypto from 'node:crypto'
 
@@ -23,6 +23,7 @@ const CODEX_ID_RE = /^T\d{4,}$/
 const SHA256_RE = /^[a-f0-9]{64}$/
 
 function fail(code, message) {
+  /** @type {Error & {code?: string}} */
   const error = new Error(message)
   error.code = code
   throw error
@@ -40,13 +41,27 @@ function sha256(buffer) {
   return crypto.createHash('sha256').update(buffer).digest('hex')
 }
 
-function win32Lower(value) {
-  return process.platform === 'win32' ? value.toLowerCase() : value
+// Path semantics are selected from an injected platform so both branches are
+// testable on any OS (#86). On the real platform this is exactly `path`.
+function pathFor(platform) {
+  return platform === 'win32' ? path.win32 : path.posix
 }
 
-function isInside(parent, child) {
-  const relative = path.relative(win32Lower(path.resolve(parent)), win32Lower(path.resolve(child)))
-  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))
+export function win32Lower(value, platform = process.platform) {
+  return platform === 'win32' ? value.toLowerCase() : value
+}
+
+/**
+ * Is `child` inside `parent` (or the same path)? Windows reconciles case
+ * because NTFS is case-insensitive; the POSIX branch stays case-sensitive.
+ */
+export function isInside(parent, child, platform = process.platform) {
+  const pathImpl = pathFor(platform)
+  const relative = pathImpl.relative(
+    win32Lower(pathImpl.resolve(parent), platform),
+    win32Lower(pathImpl.resolve(child), platform),
+  )
+  return relative === '' || (!relative.startsWith('..') && !pathImpl.isAbsolute(relative))
 }
 
 async function realpathOrResolve(target) {
@@ -58,6 +73,10 @@ async function realpathOrResolve(target) {
   }
 }
 
+/**
+ * @param {string} error
+ * @param {'tower-codex'|'dsh'|null} [format]
+ */
 function invalidResult(error, format = null) {
   return {
     ok: false,
@@ -121,6 +140,11 @@ function validateReviews(reviews, id) {
   return null
 }
 
+/**
+ * @param {any} payload
+ * @param {'tower-codex'|'dsh'} format
+ * @returns {{error:string|null, missions:Array<{id:string,status:string,kind:string}>, missionIds:string[], paused:string[]}}
+ */
 function validateMissions(payload, format) {
   const statuses = format === 'tower-codex' ? CODEX_STATUSES : DSH_STATUSES
   const idRe = format === 'tower-codex' ? CODEX_ID_RE : DSH_ID_RE
@@ -130,17 +154,17 @@ function validateMissions(payload, format) {
   const seen = new Set()
   for (let index = 0; index < payload.missions.length; index += 1) {
     const mission = payload.missions[index]
-    if (!isPlainObject(mission)) return { error: `missions[${index}] must be an object` }
+    if (!isPlainObject(mission)) return { error: `missions[${index}] must be an object`, missions: [], missionIds: [], paused: [] }
     if (typeof mission.id !== 'string' || !idRe.test(mission.id)) {
-      return { error: `missions[${index}] has unsupported id ${JSON.stringify(mission.id)} (expected ${format === 'tower-codex' ? 'T####' : 'M#'})` }
+      return { error: `missions[${index}] has unsupported id ${JSON.stringify(mission.id)} (expected ${format === 'tower-codex' ? 'T####' : 'M#'})`, missions: [], missionIds: [], paused: [] }
     }
-    if (seen.has(mission.id)) return { error: `duplicate legacy mission id ${mission.id}` }
+    if (seen.has(mission.id)) return { error: `duplicate legacy mission id ${mission.id}`, missions: [], missionIds: [], paused: [] }
     seen.add(mission.id)
     if (typeof mission.status !== 'string' || !statuses.includes(mission.status)) {
-      return { error: `mission ${mission.id} has unknown status ${JSON.stringify(mission.status)}` }
+      return { error: `mission ${mission.id} has unknown status ${JSON.stringify(mission.status)}`, missions: [], missionIds: [], paused: [] }
     }
     if (mission.kind !== undefined && mission.kind !== 'build' && mission.kind !== 'survey') {
-      return { error: `mission ${mission.id} has unknown kind ${JSON.stringify(mission.kind)}` }
+      return { error: `mission ${mission.id} has unknown kind ${JSON.stringify(mission.kind)}`, missions: [], missionIds: [], paused: [] }
     }
     for (const problem of [
       validateScope(mission.scope, mission.id),
@@ -148,7 +172,7 @@ function validateMissions(payload, format) {
       validateDeps(mission.deps, mission.id),
       validateReviews(mission.reviews, mission.id),
     ]) {
-      if (problem) return { error: problem }
+      if (problem) return { error: problem, missions: [], missionIds: [], paused: [] }
     }
     missions.push({ id: mission.id, status: mission.status, kind: mission.kind ?? 'build' })
     missionIds.push(mission.id)
@@ -180,7 +204,8 @@ export function validateLegacySnapshot(payload) {
   }
   if (!Array.isArray(payload.missions)) return invalidResult('legacy snapshot has no missions array')
 
-  let format
+  /** @type {'tower-codex'|'dsh'} */
+  let format = 'dsh'
   if (payload.missions.length === 0) {
     format = isNonEmptyString(payload.baseBranch) ? 'tower-codex' : 'dsh'
   } else {
@@ -236,7 +261,7 @@ export function validateLegacySnapshot(payload) {
  * same bytes; it never writes state.json, never activates/adopts a mission, and
  * `paused` stays paused in the returned summary.
  *
- * @returns {{summary:object, snapshot:object}} where `snapshot` is the record
+ * @returns {Promise<{summary:object, snapshot:object}>} where `snapshot` is the record
  *   the caller may append to `state.legacySnapshots`.
  */
 export async function importLegacySnapshot(input = {}) {

package/lib/modeState.js

@@ -0,0 +1,39 @@
+// Owned mode state instead of a bare module-level Map.
+export class ModeState {
+  constructor(entries) {
+    this.map = new Map(entries ?? [])
+  }
+
+  has(key) {
+    return this.map.has(key)
+  }
+
+  get(key) {
+    return this.map.get(key)
+  }
+
+  set(key, value) {
+    this.map.set(key, value)
+    return this
+  }
+
+  delete(key) {
+    return this.map.delete(key)
+  }
+
+  values() {
+    return this.map.values()
+  }
+
+  entries() {
+    return this.map.entries()
+  }
+
+  replace(entries) {
+    this.map = new Map(entries ?? [])
+  }
+
+  clear() {
+    this.map.clear()
+  }
+}

package/lib/modeStore.js

@@ -3,20 +3,13 @@
 // The session-projection route needs zod schemas, which this bundle cannot
 // resolve from the DSH installation on every deployment; a small atomic JSON
 // store under DSH_HOME/tower-mode keeps the mode across restarts.
-import fs from 'node:fs'
+import { fs } from '../adapters/store-fs.js'
 import os from 'node:os'
 import path from 'node:path'
+import { acquireLockSync, readJsonSync, writeJsonAtomicSync } from './persistence.js'
 
 const DEFAULT_MAX_ENTRIES = 200
 
-function sleepSync(ms) {
-  try {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
-  } catch {
-    // best effort; a busy loop would be worse
-  }
-}
-
 function defaultStoreDir() {
   const home = process.env.DSH_HOME || path.join(os.homedir(), '.dsh')
   return path.join(home, 'tower-mode')
@@ -34,8 +27,7 @@ function storeFile(baseDir) {
 export function loadModes(baseDir) {
   const modes = new Map()
   try {
-    const raw = fs.readFileSync(storeFile(baseDir), 'utf8')
-    const parsed = JSON.parse(raw)
+    const parsed = readJsonSync(storeFile(baseDir))
     const entries = parsed && typeof parsed === 'object' && parsed.modes && typeof parsed.modes === 'object'
       ? parsed.modes
       : {}
@@ -52,6 +44,7 @@ export function loadModes(baseDir) {
           lastChange: value.lastChange && typeof value.lastChange === 'object' ? value.lastChange : null,
           lock,
           baseBranch: typeof value.baseBranch === 'string' && value.baseBranch.trim() ? value.baseBranch.trim() : null,
+          lastDisclosure: typeof value.lastDisclosure === 'string' ? value.lastDisclosure : null,
           at: Number(value.at) || 0,
         })
       }
@@ -63,31 +56,20 @@ export function loadModes(baseDir) {
 }
 
 /** Persist the current modes atomically with a short cross-process lock. */
-export function saveModes(modes, baseDir, maxEntries = DEFAULT_MAX_ENTRIES) {
+export function saveModes(modes, baseDir, maxEntries = DEFAULT_MAX_ENTRIES, options = {}) {
   const dir = storeDir(baseDir)
   const file = storeFile(baseDir)
   const lock = path.join(dir, 'modes.lock')
+  const timeoutMs = Number(options.timeoutMs) > 0 ? Number(options.timeoutMs) : 5000
   try {
     fs.mkdirSync(dir, { recursive: true })
-    let acquired = false
-    for (let attempt = 0; attempt < 40; attempt += 1) {
-      try {
-        const fd = fs.openSync(lock, 'wx')
-        fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }))
-        fs.closeSync(fd)
-        acquired = true
-        break
-      } catch (error) {
-        if (error?.code !== 'EEXIST') throw error
-        sleepSync(5)
-      }
-    }
-    if (!acquired) return false
+    const held = acquireLockSync(lock, { timeoutMs, invalidPidIsDead: true })
+    if (!held) return false
     try {
       const limit = Number.isInteger(maxEntries) && maxEntries > 0 ? maxEntries : DEFAULT_MAX_ENTRIES
       let disk = {}
       try {
-        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'))
+        const parsed = readJsonSync(file)
         if (parsed && typeof parsed === 'object' && parsed.modes && typeof parsed.modes === 'object') disk = parsed.modes
       } catch {
         disk = {}
@@ -104,24 +86,10 @@ export function saveModes(modes, baseDir, maxEntries = DEFAULT_MAX_ENTRIES) {
         .sort((a, b) => (Number(b[1]?.at) || 0) - (Number(a[1]?.at) || 0))
         .slice(0, limit)
       const payload = { version: 1, modes: Object.fromEntries(entries) }
-      const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
-      fs.writeFileSync(tmp, JSON.stringify(payload, null, 2), 'utf8')
-      let lastError = null
-      for (let attempt = 0; attempt < 5; attempt += 1) {
-        try {
-          fs.renameSync(tmp, file)
-          return true
-        } catch (error) {
-          lastError = error
-          if (!['EPERM', 'EBUSY', 'EACCES'].includes(error?.code)) break
-          sleepSync(10 * (attempt + 1))
-        }
-      }
-      try { fs.unlinkSync(tmp) } catch {}
-      if (lastError) return false
+      writeJsonAtomicSync(file, payload)
       return true
     } finally {
-      try { fs.unlinkSync(lock) } catch {}
+      held.release()
     }
   } catch {
     return false

package/lib/persistence.js

@@ -0,0 +1,356 @@
+// Shared durable-persistence contract (#56 P2b).
+//
+// state.json (lib/store.js) and modes.json (lib/modeStore.js) both persist a
+// whole JSON document behind a token-owned writer lock. They must agree on:
+//
+//   - atomic replacement: serialise completely, write a temp file, rename;
+//   - dead-PID reclamation: a provably dead owner is moved to a quarantine
+//     name, verified, and only then removed; a live/foreign lock is never
+//     stolen or deleted;
+//   - bounded waiting: a held lock is reported after a timeout, not stolen.
+//
+// Keeping the primitives here means a protocol fix applies to both contracts
+// at once. This module is the only lib/ file besides store.js that talks to
+// the fs adapter; it never imports node:fs directly (#50).
+import { fs, fsp } from '../adapters/store-fs.js'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { TowerToolError } from '../domain/errors.js'
+
+export const DEFAULT_LOCK_TIMEOUT_MS = 5000
+export const DEFAULT_LOCK_POLL_MS = 25
+
+// Exported with the retry loop so a test can assert the budget and the exact
+// transient set instead of copying them (#86).
+export const RENAME_ATTEMPTS = 12
+export const TRANSIENT_RENAME_ERRORS = new Set(['EPERM', 'EBUSY', 'EACCES'])
+const PROCESS_STARTED_AT = Date.now() - Math.round(process.uptime() * 1000)
+
+export function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+function sleepSync(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+  } catch {
+    // best effort; a busy loop would be worse
+  }
+}
+
+// ---------------------------------------------------------------------------
+// JSON document I/O
+// ---------------------------------------------------------------------------
+
+function parseJson(file, text) {
+  try {
+    return JSON.parse(text)
+  } catch (error) {
+    throw new TowerToolError('state-corrupt', `corrupt tower state at ${file}: ${error.message}`)
+  }
+}
+
+export async function readJson(file) {
+  return parseJson(file, await fsp.readFile(file, 'utf8'))
+}
+
+/** Synchronous counterpart for the mode store's short critical section. */
+export function readJsonSync(file) {
+  return parseJson(file, fs.readFileSync(file, 'utf8'))
+}
+
+export async function writeJsonAtomic(file, value) {
+  const dir = path.dirname(file)
+  const tmp = path.join(dir, `.${path.basename(file)}.tmp-${process.pid}-${crypto.randomUUID()}`)
+  const handle = await fsp.open(tmp, 'w')
+  try {
+    await handle.writeFile(JSON.stringify(value, null, 2), 'utf8')
+    await handle.sync()
+  } finally {
+    await handle.close()
+  }
+  await renameWithRetry(tmp, file)
+}
+
+/**
+ * Windows can reject a rename while an indexer, antivirus, or a concurrent
+ * reader still holds the destination; retry briefly instead of failing a
+ * successful mutation. The temp file is removed when the rename never lands.
+ *
+ * `options.rename` and `options.sleep` inject the syscall and the backoff so
+ * both outcomes are testable on any OS (#86); production callers omit them.
+ */
+export async function renameWithRetry(tmp, file, options = {}) {
+  const rename = options.rename ?? fsp.rename
+  const wait = options.sleep ?? sleep
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      await rename(tmp, file)
+      return
+    } catch (error) {
+      if (!TRANSIENT_RENAME_ERRORS.has(error?.code) || attempt >= RENAME_ATTEMPTS) {
+        await fsp.unlink(tmp).catch(() => {})
+        throw error
+      }
+      await wait(10 + attempt * 15)
+    }
+  }
+}
+
+/** Synchronous counterpart used by the mode store's short critical section. */
+export function writeJsonAtomicSync(file, value) {
+  const dir = path.dirname(file)
+  const tmp = path.join(dir, `.${path.basename(file)}.tmp-${process.pid}-${crypto.randomUUID()}`)
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2), 'utf8')
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      fs.renameSync(tmp, file)
+      return
+    } catch (error) {
+      if (!TRANSIENT_RENAME_ERRORS.has(error?.code) || attempt >= RENAME_ATTEMPTS) {
+        try {
+          fs.unlinkSync(tmp)
+        } catch {
+          // best effort
+        }
+        throw error
+      }
+      sleepSync(10 + attempt * 15)
+    }
+  }
+}
+
+export async function appendJsonl(file, value) {
+  await fsp.appendFile(file, `${JSON.stringify(value)}\n`, 'utf8')
+}
+
+// ---------------------------------------------------------------------------
+// Lock records
+// ---------------------------------------------------------------------------
+
+/**
+ * true = process exists, false = provably gone, null = the record carries no
+ * usable PID. The tri-state matters: a malformed state lock must be reported,
+ * not silently reclaimed as if its owner were dead.
+ */
+export function processAlive(pid) {
+  const value = Number(pid)
+  if (!Number.isInteger(value) || value <= 0) return null
+  try {
+    process.kill(value, 0)
+    return true
+  } catch (error) {
+    if (error?.code === 'ESRCH') return false
+    // EPERM means the process exists but belongs to another user.
+    return true
+  }
+}
+
+export function lockRecord(token, extra = {}) {
+  return { token, pid: process.pid, ...extra, at: Date.now() }
+}
+
+function isDeadLock(record, options) {
+  const alive = processAlive(record?.pid)
+  if (alive === false) return true
+  // The mode store historically treated a lock without a usable PID as dead;
+  // preserve that where callers opt in, while the state lock stays defensive.
+  return alive === null && options.invalidPidIsDead === true
+}
+
+// ---------------------------------------------------------------------------
+// Lock inspection / reclamation
+// ---------------------------------------------------------------------------
+
+export async function readLock(lockPath) {
+  try {
+    const raw = await fsp.readFile(lockPath, 'utf8')
+    const record = JSON.parse(raw)
+    return { path: lockPath, record, alive: processAlive(record?.pid), raw }
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { path: lockPath, record: null, alive: null, raw: null }
+    return { path: lockPath, record: null, alive: null, raw: null, error: String(error?.message ?? error) }
+  }
+}
+
+export function readLockSync(lockPath) {
+  try {
+    const raw = fs.readFileSync(lockPath, 'utf8')
+    const record = JSON.parse(raw)
+    return { path: lockPath, record, alive: processAlive(record?.pid), raw }
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { path: lockPath, record: null, alive: null, raw: null }
+    return { path: lockPath, record: null, alive: null, raw: null, error: String(error?.message ?? error) }
+  }
+}
+
+export async function reclaimDeadLock(lockPath, options = {}) {
+  let original
+  try {
+    original = await fsp.readFile(lockPath, 'utf8')
+  } catch {
+    return false
+  }
+  let parsed
+  try {
+    parsed = JSON.parse(original)
+  } catch {
+    return false
+  }
+  if (!isDeadLock(parsed, options)) return false
+  // Move, never delete: a concurrent writer may have replaced the record
+  // between the read and the rename, so verify the quarantined bytes first.
+  const quarantine = `${lockPath}.stale-${process.pid}-${crypto.randomUUID()}`
+  try {
+    await fsp.rename(lockPath, quarantine)
+  } catch {
+    return false
+  }
+  const moved = await fsp.readFile(quarantine, 'utf8').catch(() => null)
+  if (moved === null || moved !== original) {
+    if (moved !== null) await fsp.rename(quarantine, lockPath).catch(() => {})
+    return false
+  }
+  await fsp.unlink(quarantine).catch(() => {})
+  return true
+}
+
+export function reclaimDeadLockSync(lockPath, options = {}) {
+  let original
+  try {
+    original = fs.readFileSync(lockPath, 'utf8')
+  } catch {
+    return false
+  }
+  let parsed
+  try {
+    parsed = JSON.parse(original)
+  } catch {
+    return false
+  }
+  if (!isDeadLock(parsed, options)) return false
+  const quarantine = `${lockPath}.stale-${process.pid}-${crypto.randomUUID()}`
+  try {
+    fs.renameSync(lockPath, quarantine)
+  } catch {
+    return false
+  }
+  let moved = null
+  try {
+    moved = fs.readFileSync(quarantine, 'utf8')
+  } catch {
+    moved = null
+  }
+  if (moved === null || moved !== original) {
+    if (moved !== null) {
+      try {
+        fs.renameSync(quarantine, lockPath)
+      } catch {
+        // the newer record could not be restored; never delete it silently
+      }
+    }
+    return false
+  }
+  try {
+    fs.unlinkSync(quarantine)
+  } catch {
+    // the lock is already reclaimed; a leftover quarantine is inert
+  }
+  return true
+}
+
+// ---------------------------------------------------------------------------
+// Lock acquire / token-checked release
+// ---------------------------------------------------------------------------
+
+function handleFor(lockPath, token, record) {
+  return {
+    path: lockPath,
+    token,
+    record,
+    async release() {
+      return releaseLock(lockPath, token)
+    },
+  }
+}
+
+function syncHandleFor(lockPath, token, record) {
+  return {
+    path: lockPath,
+    token,
+    record,
+    release() {
+      return releaseLockSync(lockPath, token)
+    },
+  }
+}
+
+/**
+ * Acquire a token-owned lock with a bounded wait. Returns null when another
+ * writer still holds a live lock at the deadline; callers translate that into
+ * their own [tower:state-locked] message (or a false return for modes).
+ */
+export async function acquireLock(lockPath, options = {}) {
+  const token = options.token ?? crypto.randomUUID()
+  const record = options.record ?? lockRecord(token)
+  const timeoutMs = Number(options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS)
+  const pollMs = Number(options.pollMs ?? DEFAULT_LOCK_POLL_MS)
+  const deadline = Date.now() + Math.max(0, timeoutMs)
+  for (;;) {
+    try {
+      await fsp.writeFile(lockPath, JSON.stringify(record), { flag: 'wx' })
+      return handleFor(lockPath, token, record)
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error
+      if (await reclaimDeadLock(lockPath, options)) continue
+      if (Date.now() > deadline) return null
+      await sleep(pollMs)
+    }
+  }
+}
+
+export function acquireLockSync(lockPath, options = {}) {
+  const token = options.token ?? crypto.randomUUID()
+  const record = options.record ?? lockRecord(token)
+  const timeoutMs = Number(options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS)
+  const pollMs = Number(options.pollMs ?? DEFAULT_LOCK_POLL_MS)
+  const deadline = Date.now() + Math.max(0, timeoutMs)
+  for (;;) {
+    try {
+      fs.writeFileSync(lockPath, JSON.stringify(record), { flag: 'wx' })
+      return syncHandleFor(lockPath, token, record)
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error
+      if (reclaimDeadLockSync(lockPath, options)) continue
+      if (Date.now() > deadline) return null
+      sleepSync(pollMs)
+    }
+  }
+}
+
+export async function releaseLock(lockPath, token) {
+  try {
+    const current = await fsp.readFile(lockPath, 'utf8').catch(() => null)
+    if (current === null) return false
+    const parsed = JSON.parse(current)
+    if (!parsed || parsed.token !== token) return false
+    await fsp.unlink(lockPath)
+    return true
+  } catch {
+    // a foreign or unreadable lock is not ours to remove
+    return false
+  }
+}
+
+export function releaseLockSync(lockPath, token) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(lockPath, 'utf8'))
+    if (!parsed || parsed.token !== token) return false
+    fs.unlinkSync(lockPath)
+    return true
+  } catch {
+    return false
+  }
+}
+
+export { PROCESS_STARTED_AT }

package/lib/presets.js

@@ -0,0 +1,35 @@
+// Cross-field preset validation (#64): fail before work starts, not at spawn.
+import { TowerToolError } from '../domain/errors.js'
+
+export function presetIds(config = {}) {
+  return {
+    worker: String(config.spawn?.workerPreset ?? 'tower-worker'),
+    reviewer: String(config.spawn?.reviewerPreset ?? 'tower-reviewer'),
+  }
+}
+
+function rowId(preset) {
+  return preset === 'tower-worker' ? 'preset-tower-worker' : preset === 'tower-reviewer' ? 'preset-tower-reviewer' : preset
+}
+
+/**
+ * Resolve both presets against the profile's agentPresets service. Fail closed
+ * with preset-missing before mode entry/planning when a required preset is not
+ * registered. If the service is unavailable, doctor reports that separately and
+ * this check cannot make a claim either way.
+ */
+export async function assertPresetsAvailable(ctx, config = {}) {
+  const service = ctx?.get?.('agentPresets')
+  if (!service || typeof service.list !== 'function') return { checked: false, missing: [] }
+  const presets = presetIds(config)
+  const available = new Set((await service.list()).map((entry) => String(entry.id)))
+  const missing = [presets.worker, presets.reviewer].filter((id) => !available.has(id))
+  if (missing.length > 0) {
+    const rows = [...new Set(missing.map(rowId))]
+    throw new TowerToolError(
+      'preset-missing',
+      `required Tower agent preset(s) missing: ${missing.join(', ')}; re-enable ${rows.join(', ')} in the plugin page, then restart DSH`,
+    )
+  }
+  return { checked: true, missing: [] }
+}