muse-crew 0.14.4 → 0.14.6

package/workflows/crew-dispatch.js

@@ -50,6 +50,42 @@ const MAX_TASKS_PER_POLL = inputs.maxTasksPerPoll || 6;
 // inputs.registry. Fall back to the agent() load only when the caller
 // predates the registry — slow, but never broken.
 var registryResult = inputs.registry;
+// Nested-registry seam (2026-09-20): a malformed nested registry object
+// (e.g. a workflow key mapping to null/undefined, or a steps entry without
+// a name) used to die deep in the lookup tables with a cryptic TypeError
+// ("cannot convert 'null' or 'undefined' to object"). Validate the shape
+// deterministically first; a malformed registry falls back to the slow
+// agent load with a loud log, exactly like a missing one — the defect is
+// named, never a crash.
+function validateRegistry(reg) {
+  var wfNames = ["standard", "bugfix", "chore", "docs", "upgrade"];
+  if (!reg || typeof reg !== "object" || Array.isArray(reg)) {
+    return { ok: false, reason: "registry is missing or not an object" };
+  }
+  for (var i = 0; i < wfNames.length; i++) {
+    var wf = reg[wfNames[i]];
+    if (!wf || typeof wf !== "object") {
+      return { ok: false, reason: "workflow '" + wfNames[i] + "' is missing or not an object" };
+    }
+    if (!Array.isArray(wf.steps)) {
+      return { ok: false, reason: "workflow '" + wfNames[i] + "' has no steps array" };
+    }
+    for (var j = 0; j < wf.steps.length; j++) {
+      if (!wf.steps[j] || typeof wf.steps[j].name !== "string") {
+        return { ok: false, reason: "workflow '" + wfNames[i] + "' step " + j + " has no name" };
+      }
+    }
+    if (typeof wf.reworkTarget !== "string") {
+      return { ok: false, reason: "workflow '" + wfNames[i] + "' has no reworkTarget string" };
+    }
+  }
+  return { ok: true };
+}
+var registryCheck = validateRegistry(registryResult);
+if (!registryCheck.ok) {
+  log("WARNING: registry failed shape validation (" + registryCheck.reason + ") — falling back to slow registry load");
+  registryResult = null;
+}
 if (!registryResult) {
   log("WARNING: no registry in args — falling back to slow registry load");
   registryResult = await agent(

package/workflows/crew-init.js

@@ -58,6 +58,29 @@ if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew
 // create projects later via crew-api.js). One without the other is an error.
 if (!!dashboardSlug !== !!dashboardRepoPath) throw new Error("dashboardSlug and dashboardRepoPath must be provided together, or neither (omit both for a CLI-only install without a dashboard)");
 
+// ── Cron id override validation (2026-09-20, 0.14.6 REVIEW) ──
+// Uninstall's discovery fallback only recognizes live ids that start with
+// a manifest entry id + "-" (crew-poll-, crew-ack-scan-,
+// crew-update-watch-). An override that breaks that convention would
+// survive uninstall if .cron-registry.json were ever lost — so overrides
+// must keep the manifest-id prefix. Fail closed at init, before any cron
+// is created.
+for (const manifestId of Object.keys(cronIds)) {
+  const liveId = cronIds[manifestId];
+  if (typeof liveId !== "string" || !liveId.startsWith(manifestId + "-")) {
+    return {
+      __hatchWorkflowControl: "blocked",
+      result: {
+        blocked_reason: "Invalid cronIds override",
+        message: "cronIds[\"" + manifestId + "\"] must start with \"" + manifestId + "-\" — got " +
+          JSON.stringify(liveId) + ". Uninstall's discovery fallback only recognizes live ids under " +
+          "the manifest-id prefix; an arbitrary id could survive uninstall if the cron registry " +
+          "were lost. Re-run init with a prefixed id."
+      }
+    };
+  }
+}
+
 const orchDir = crewHome + "/.orchestration";
 
 // ── Dependency node_modules resolution (clean-room defect 2026-09-16) ──

package/workflows/crew-uninstall.js

@@ -158,11 +158,14 @@ try {
     "Steps:\n" +
     "1. Registry: if " + sq(crewHomeExpanded + "/.cron-registry.json") + " exists, read it\n" +
     "   and take its crons[].id list as registry candidates.\n" +
-    "2. Discovery: call cron_list. For every job whose id starts with 'crew-poll-',\n" +
+    "2. Discovery: call cron_list. For every job whose id starts with one of\n" +
+    "   'crew-poll-', 'crew-ack-scan-', or 'crew-update-watch-' (the three\n" +
+    "   seed/crons.json manifest entry ids, each suffixed with the instance id),\n" +
     "   call cron_view and keep it as a discovery candidate when the job body\n" +
-    "   contains the crewHome string '" + crewHomeExpanded + "' (the poll body template\n" +
-    "   embeds the crew home path). The bare id 'crew-poll' with no instance suffix\n" +
-    "   is never a live crew job — never remove it.\n" +
+    "   contains the crewHome string '" + crewHomeExpanded + "' (the cron body templates\n" +
+    "   embed the crew home path). A bare manifest id ('crew-poll', 'crew-ack-scan',\n" +
+    "   'crew-update-watch') with no instance suffix is never a live crew job —\n" +
+    "   never remove it.\n" +
     "3. Removal list = registry candidates ∪ discovery candidates, deduped.\n" +
     "   SAFETY: remove only jobs on this list. When in doubt about any job, fail\n" +
     "   closed (passed: false) instead of guessing.\n" +