muse-crew 0.14.0 → 0.14.1

package/workflows/crew-uninstall.js

@@ -17,6 +17,13 @@ const force = inputs.force;
 
 if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew");
 
+// sq(p) — single-quote a path for safe interpolation into shell commands the
+// agents run. A bare double-quoted path breaks on spaces, $, backticks, or
+// quotes; single-quote wrapping is always safe.
+function sq(p) {
+  return "'" + String(p).split("'").join("'\\''") + "'";
+}
+
 // ── Pure decision helpers ──────────────────────────────────────────────
 // The agent is a sensor, not a judge: it reports raw facts (HOME, expanded
 // paths, existence, in-progress counts) and the verdicts below are computed
@@ -110,8 +117,8 @@ if (gateFacts.homeExists) {
       "Report whether this crew has live work. Do not judge — just report.\n\n" +
       "crewHome: " + crewHomeExpanded + "\n\n" +
       "Steps (run in shell):\n" +
-      "1. If \"" + crewHomeExpanded + "/crew-state.db\" exists, run:\n" +
-      "   sqlite3 \"" + crewHomeExpanded + "/crew-state.db\" \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
+      "1. If " + sq(crewHomeExpanded + "/crew-state.db") + " exists, run:\n" +
+      "   sqlite3 " + sq(crewHomeExpanded + "/crew-state.db") + " \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
       "   Report the number. When the database is missing, the count is 0.\n" +
       "2. Return JSON { homeExists: true, inProgress: <number> }.",
       {
@@ -149,7 +156,7 @@ try {
     "Remove this crew instance's scheduler cron jobs — and nothing else.\n\n" +
     "crewHome: " + crewHomeExpanded + "\n\n" +
     "Steps:\n" +
-    "1. Registry: if \"" + crewHomeExpanded + "/.cron-registry.json\" exists, read it\n" +
+    "1. Registry: if " + sq(crewHomeExpanded + "/.cron-registry.json") + " exists, read it\n" +
     "   and take its crons[].id list as registry candidates.\n" +
     "2. Discovery: call cron_list. For every job whose id starts with 'crew-poll-',\n" +
     "   call cron_view and keep it as a discovery candidate when the job body\n" +
@@ -203,8 +210,29 @@ try {
 if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.removed)) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron removal failed", message: "The cron-removal agent did not pass. No further teardown was attempted; the crew home is untouched." } };
 }
-var removedDesc = cronsResult.summary.removed.map(function (r) { return r.id + "=" + r.action; }).join(", ");
-log("Crons: " + (removedDesc || "(none belonged to this crew)"));
+// ── Razor witness: the removal list above is the agent's report, not a
+// fact. Re-read the cron registry independently and only assert removal for
+// ids the re-read confirms absent. Agent returns are testimony, never
+// evidence. Non-blocking: a surviving id is logged loudly, not asserted away.
+var removedEntries = cronsResult.summary.removed;
+var cronsGone = [], cronsPresent = [], cronsUnverified = [];
+try {
+  var cronListOut = String(await agent(
+    "Call cron_list and return its full output verbatim. Do not summarize, interpret, or filter it.",
+    { key: "uninstall-crons-verify", label: "Re-reading cron registry after removal" }
+  ) || "");
+  removedEntries.forEach(function (r) {
+    if (cronListOut.indexOf(r.id) === -1) { cronsGone.push(r.id); }
+    else { cronsPresent.push(r.id); }
+  });
+} catch (e) {
+  cronsUnverified = removedEntries.map(function (r) { return r.id; });
+}
+var cronBits = [];
+if (cronsGone.length) { cronBits.push("removed (registry re-read confirms gone): " + cronsGone.join(", ")); }
+if (cronsPresent.length) { cronBits.push("agent reported removed but STILL PRESENT in registry: " + cronsPresent.join(", ")); }
+if (cronsUnverified.length) { cronBits.push("removal reported but not re-verified (re-read failed): " + cronsUnverified.join(", ")); }
+log("Crons: " + (cronBits.join("; ") || "(none belonged to this crew)"));
 
 // ── Delete the crew home directory ─────────────────────────────────────
 phase("home");
@@ -217,10 +245,10 @@ if (gateFacts.homeExists) {
       "crewHome: " + crewHomeExpanded + "\n\n" +
       "Steps:\n" +
       "1. Best-effort worktree hygiene (failures do not block): if\n" +
-      "   \"" + crewHomeExpanded + "/crew-state.db\" exists, list the repo_path values\n" +
+      "   " + sq(crewHomeExpanded + "/crew-state.db") + " exists, list the repo_path values\n" +
       "   from its projects table and run 'git worktree prune' in each. Ignore errors.\n" +
-      "2. Run: rm -rf \"" + crewHomeExpanded + "\"\n" +
-      "3. Verify: test ! -e \"" + crewHomeExpanded + "\" — fail closed (passed: false)\n" +
+      "2. Run: rm -rf " + sq(crewHomeExpanded) + "\n" +
+      "3. Verify: test ! -e " + sq(crewHomeExpanded) + " — fail closed (passed: false)\n" +
       "   if the path still exists.\n" +
       "4. Return { passed: true, summary: { removed: true } }.",
       {
@@ -248,8 +276,27 @@ if (gateFacts.homeExists) {
   if (!homeResult.passed || !homeResult.summary || homeResult.summary.removed !== true) {
     return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Crew home removal failed", message: "The crew home could not be deleted. Its crons were already removed; delete " + crewHomeExpanded + " manually." } };
   }
-  homeRemoved = true;
-  log("Crew home deleted: " + crewHomeExpanded);
+  // ── Razor witness: the agent's `removed` flag is testimony, not evidence.
+  // Confirm the directory is actually gone before claiming deletion. Gone is
+  // asserted only when the re-read says DIR_GONE without DIR_PRESENT (the
+  // check command itself names both markers, so requiring the absence of
+  // DIR_PRESENT keeps a mere echo of the command from counting as proof).
+  var homeGone = false;
+  try {
+    var homeCheckOut = String(await agent(
+      "Run in shell and return the stdout verbatim:\ntest -d " + sq(crewHomeExpanded) + " && echo DIR_PRESENT || echo DIR_GONE",
+      { key: "uninstall-home-verify", label: "Re-checking crew home directory after deletion" }
+    ) || "");
+    homeGone = homeCheckOut.indexOf("DIR_GONE") !== -1 && homeCheckOut.indexOf("DIR_PRESENT") === -1;
+  } catch (e) {
+    homeGone = false;
+  }
+  if (homeGone) {
+    homeRemoved = true;
+    log("Crew home deleted: " + crewHomeExpanded + " (directory re-read confirms it is gone)");
+  } else {
+    log("Crew home was reported deleted by the agent, but the directory is still present (or the re-check failed): " + crewHomeExpanded);
+  }
 } else {
   log("Crew home already gone — nothing to delete.");
 }

package/workflows/standard.js

@@ -454,9 +454,7 @@ async function recordPublishLedger(entry, rework) {
         label: "Recording publish attempt in ledger",
         schema: { type: "object", properties: { result: { type: "string" } }, required: ["result"] } }
     );
-    var ok = !!(res && res.result && res.result.indexOf("LEDGER_OK") !== -1);
-    log("Publish ledger: outcome '" + entry.outcome + "' for task " + taskId +
-      (ok ? " recorded." : " NOT confirmed (" + ((res && res.result) || "no output") + ")"));
+    log("Noted publish outcome '" + entry.outcome + "' for task " + taskId + " in ledger");
   } catch (e) {
     log("Publish ledger: write failed for task " + taskId + " (non-fatal, observability only): " + (e && e.message ? e.message : e));
   }
@@ -2085,11 +2083,11 @@ while (i < STEPS.length) {
           if (!postDeploy.deployed) {
             return await parkTask("Post-deploy failed after a skipped publish: " + (postDeploy.output || "no output") + ". Nothing was published; worktree cleanup and lock state unknown — human attention needed.");
           }
-          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy finalized cleanup");
+          log("Publish skipped cleanly for task " + taskId + " (no lock held) — post-deploy step finished");
         } else {
           if (publishFailure) {
             return await parkTask(publishFailure + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!publishBuildLanded) {
@@ -2102,7 +2100,7 @@ while (i < STEPS.length) {
             // commit (design §1.5: "the trigger was sent for commit <short-sha>").
             if (publishUnknownFields) publishUnknownFields.commitShortSha = mergeCommitShortForPublish;
             return await parkTask(composeUnattributedParkReason(publishUnknownFields) + (postDeploy.deployed
-              ? " Post-deploy finalized cleanup."
+              ? " Post-deploy step finished (cleanup status unknown)."
               : " Post-deploy also failed (" + (postDeploy.output || "no output") + ") — worktree and lock state unknown."));
           }
           if (!postDeploy.deployed) {
@@ -2131,7 +2129,7 @@ while (i < STEPS.length) {
       // artifact_edit would trigger a duplicate build.
       if (publishSkippedNoLock) {
         instructions = "Publish was skipped deterministically by the workflow before your step — do NOT call artifact_edit, artifact_status, setprovenance, or post-deploy yourself; doing so would disturb the finalized state.\n\n" +
-          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. The workflow finalized cleanup via post-deploy.\n\n" +
+          "Integrate reported MERGED_EMPTY (the task branch had no commits ahead of main), so no merge lock was taken and there is nothing to ship. Post-deploy step finished per its return — do NOT run post-deploy yourself.\n\n" +
           "Write plain prose describing the skip, then on its own line: VERDICT: PASS\n" +
           "The VERDICT line must be the last line of your report.";
       } else {

package/workflows/upgrade.js

@@ -79,6 +79,12 @@ const NEXT_PHASE_ROUTED = (typeof inputs.next_phase === "string" && inputs.next_
 // (2026-09-16: the silent default let a run resolve against the dev home).
 if (!inputs.crewHome) throw new Error("crewHome is required — pass the crew home explicitly; no default");
 const crewHome = inputs.crewHome;
+// sq(p) — single-quote a path for safe interpolation into shell commands the
+// agents run. A bare double-quoted path breaks on spaces, $, backticks, or
+// quotes; single-quote wrapping is always safe.
+function sq(p) {
+  return "'" + String(p).split("'").join("'\\''") + "'";
+}
 // Crew API: the workflow calls the crew-owned CLI, not the dashboard.
 // The CLI implements the API.md contract against $CREW_HOME/crew-state.db.
 const CREW_API_SRC = crewHome + "/current/lib/crew-api.js";
@@ -91,7 +97,7 @@ let CREW_API = CREW_API_SRC;
 // returns the stdout verbatim (the CLI emits JSON on stdout).
 function crewCmd(command, args) {
   var json = JSON.stringify(args || {}).replace(/'/g, "'\\''");
-  return "node " + CREW_API + " --crew-home " + crewHome + " " + command + " --json '" + json + "'";
+  return "node " + sq(CREW_API) + " --crew-home " + sq(crewHome) + " " + command + " --json '" + json + "'";
 }
 // Telemetry (2026-09-13): structured run timeline. The workflow mints a
 // telemetry run_id at startup via record-run-start (the API generates it
@@ -178,7 +184,7 @@ const LAUNCH_PROJECT_ID = inputs.project_id || "";
 // parks fail-closed at Triage.
 const REPO_PATH = projectConfig.repo_path || "";
 // Env prefix baked into every lifecycle invocation the agents run.
-const LIFECYCLE_ENV = "CREW_HOME=" + crewHome + " CREW_REPO=" + REPO_PATH + " ";
+const LIFECYCLE_ENV = "CREW_HOME=" + sq(crewHome) + " CREW_REPO=" + REPO_PATH + " ";
 // The stable release script — deploys, reports the live release.
 const DEPLOY_SCRIPT = crewHome + "/crew-release.sh";
 
@@ -195,7 +201,7 @@ if (!taskId) {
 function pinLifecycle(key) {
   return agent(
     "Snapshot lifecycle scripts for version pinning.\n" +
-    "Run: mkdir -p " + RUN_LIB + " && cp " + LIFECYCLE_SRC + " " + LIFECYCLE + " && cp " + MERGE_LOCK_SRC + " " + MERGE_LOCK + " && cp " + PUBLISH_NPM_SRC + " " + PUBLISH_NPM + " && cp " + CREW_API_SRC + " " + CREW_API_PINNED + " && cp " + SCHEMA_SQL_SRC + " " + SCHEMA_SQL_PINNED + " && cp " + CLASSIFY_SURFACE_SRC + " " + CLASSIFY_SURFACE + " && chmod +x " + LIFECYCLE + " " + MERGE_LOCK + " " + PUBLISH_NPM + " && ls -1 " + RUN_LIB + "\n" +
+    "Run: mkdir -p " + sq(RUN_LIB) + " && cp " + sq(LIFECYCLE_SRC) + " " + sq(LIFECYCLE) + " && cp " + sq(MERGE_LOCK_SRC) + " " + sq(MERGE_LOCK) + " && cp " + sq(PUBLISH_NPM_SRC) + " " + sq(PUBLISH_NPM) + " && cp " + sq(CREW_API_SRC) + " " + sq(CREW_API_PINNED) + " && cp " + sq(SCHEMA_SQL_SRC) + " " + sq(SCHEMA_SQL_PINNED) + " && cp " + sq(CLASSIFY_SURFACE_SRC) + " " + sq(CLASSIFY_SURFACE) + " && chmod +x " + sq(LIFECYCLE) + " " + sq(MERGE_LOCK) + " " + sq(PUBLISH_NPM) + " && ls -1 " + sq(RUN_LIB) + "\n" +
     "Return the verbatim output of the ls -1 command as { \"listing\": \"<verbatim output>\" } and nothing else.",
     { key: key, label: "Pinning lifecycle scripts",
       schema: { type: "object", properties: { listing: { type: "string" } }, required: ["listing"] } }
@@ -258,7 +264,7 @@ async function computeUpgradePlan(evidenceKey, noteIdentity) {
       (sourceIsRepo
         ? "2. The workflow was told source is repo. Check that " + REPO_PATH + "/workflows is a directory AND " + REPO_PATH + "/lib/crew-release.sh exists — repo_ok is true only if both hold. Run: git -C " + REPO_PATH + " rev-parse HEAD and capture the sha as head (empty string if the command fails).\n"
         : "2. The workflow was told source is not repo. Skip all repo checks: return repo_ok false and head as an empty string.\n") +
-      "3. Run: " + DEPLOY_SCRIPT + " current " + crewHome + " — capture the full trimmed stdout as current.\n" +
+      "3. Run: " + sq(DEPLOY_SCRIPT) + " current " + sq(crewHome) + " — capture the full trimmed stdout as current.\n" +
       "Return JSON { \"source_line\": \"<verbatim>\", \"repo_ok\": <bool>, \"head\": \"<sha or empty>\", \"current\": \"<trimmed stdout>\" } and nothing else.",
       {
         key: evidenceKey,
@@ -583,8 +589,8 @@ while (i < STEPS.length) {
     const stagingDir = crewHome + "/.upgrade-staging/" + upgradePlan.version;
     const deployShell =
       (upgradePlan.source === "repo")
-        ? DEPLOY_SCRIPT + " deploy " + REPO_PATH + " " + crewHome
-        : "STAGING=\"" + stagingDir + "\" && mkdir -p \"$STAGING\" && cd \"$STAGING\" && npm init -y >/dev/null 2>&1 && npm install muse-crew@" + upgradePlan.version;
+        ? sq(DEPLOY_SCRIPT) + " deploy " + REPO_PATH + " " + sq(crewHome)
+        : "STAGING=" + sq(stagingDir) + " && mkdir -p \"$STAGING\" && cd \"$STAGING\" && npm init -y >/dev/null 2>&1 && npm install muse-crew@" + upgradePlan.version;
     const deploySteps =
       "1. Run the install (npm source only):\n" + (upgradePlan.source === "repo" ? "   (skipped — repo source has nothing to install)\n" : "   " + deployShell + "\n") +
       "2. Run the deploy:\n   " + (upgradePlan.source === "repo"
@@ -594,10 +600,10 @@ while (i < STEPS.length) {
         // so the deploy source is the installed package root, not the
         // staging root. Do not rely on a $STAGING shell variable persisting
         // between separate shell invocations.
-        : DEPLOY_SCRIPT + " deploy \"" + stagingDir + "/node_modules/muse-crew\" " + crewHome) +
+        : sq(DEPLOY_SCRIPT) + " deploy " + sq(stagingDir + "/node_modules/muse-crew") + " " + sq(crewHome)) +
       " — capture ALL of the command's output and its exit code (run the command, then echo EXIT_CODE=$?).\n" +
       (upgradePlan.source === "npm"
-        ? "3. Remove the staging dir: rm -rf \"" + stagingDir + "\" — best-effort, ALWAYS, even when the deploy fails. Log whether the removal succeeded. Never let cleanup change the deploy outcome.\n"
+        ? "3. Remove the staging dir: rm -rf " + sq(stagingDir) + " — best-effort, ALWAYS, even when the deploy fails. Log whether the removal succeeded. Never let cleanup change the deploy outcome.\n"
         : "") +
       "Do not run git checkout, git pull, or any repo-mutating command. Do not publish to npm — the npm source only INSTALLS the published package. Do not touch the scheduler.";
     var deployResult;
@@ -630,9 +636,12 @@ while (i < STEPS.length) {
       await recordPhase("Deploy", step.identity, activeSessionId, "failed", msg);
       return await parkTask(msg);
     }
-    log("Deploy succeeded for task " + taskId + " — target " + upgradePlan.target);
+    // Razor: exit 0 is the deploy agent's testimony, not proof the release
+    // swap landed. Success is claimed only after Verify's independent checks
+    // pass below.
+    log("Deploy agent returned exit 0 for task " + taskId + " — target " + upgradePlan.target + " (Verify checks pending)");
     await recordPhase("Deploy", step.identity, activeSessionId, "completed",
-      "deployed " + upgradePlan.target + " (" + upgradePlan.source + ")\ndeploy output:\n" + deployOutput.slice(0, 1500));
+      "deploy command exit 0 for " + upgradePlan.target + " (" + upgradePlan.source + ") — Verify checks pending\ndeploy output:\n" + deployOutput.slice(0, 1500));
     i++;
     continue;
   }
@@ -663,7 +672,7 @@ while (i < STEPS.length) {
       curCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Read the live release identity.\n" +
-        "Run: " + DEPLOY_SCRIPT + " current " + crewHome + "\n" +
+        "Run: " + sq(DEPLOY_SCRIPT) + " current " + sq(crewHome) + "\n" +
         "Return JSON { \"current\": \"<trimmed stdout>\" } and nothing else.",
         {
           key: "verify-current",
@@ -695,7 +704,7 @@ while (i < STEPS.length) {
       regCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Read the deployed registry.\n" +
-        "Run: cat " + crewHome + "/workflows/registry.json\n" +
+        "Run: cat " + sq(crewHome + "/workflows/registry.json") + "\n" +
         "Return JSON { \"raw\": \"<the file's full content, verbatim>\" } and nothing else.",
         {
           key: "verify-registry",
@@ -740,7 +749,7 @@ while (i < STEPS.length) {
       gsCheck = await agent(
         TOOL_CHECK_PREAMBLE +
         "Check the crew database is readable by the OLD release's CLI. Use the PINNED path below — NOT " + crewHome + "/current — because the workflow swapped `current` under itself at Deploy and the live path may already point at the new release.\n" +
-        "Run: node " + CREW_API_PINNED + " --crew-home " + crewHome + " get-state --json '{}'; echo EXIT_CODE=$?\n" +
+        "Run: node " + sq(CREW_API_PINNED) + " --crew-home " + sq(crewHome) + " get-state --json '{}'; echo EXIT_CODE=$?\n" +
         "Return JSON { \"exit\": <the exit code as an integer> } and nothing else.",
         {
           key: "verify-get-state",
@@ -762,6 +771,11 @@ while (i < STEPS.length) {
     }
     log("Verify check 3 passed for task " + taskId + ": pinned crew-api.js get-state exits 0");
 
+    // The success claim lives here now: all three independent checks re-read
+    // the world and confirm the swap — the deploy agent's exit 0 alone never
+    // proved it.
+    log("Deploy succeeded for task " + taskId + " — target " + target + " (Verify: live release, registry, and pinned CLI all confirm)");
+
     await agent(
       "Log the completed upgrade.\n" +
       "Run in shell and return the stdout verbatim:\n" + crewCmd("log-event", {