muse-crew 0.7.19 → 0.8.0

package/workflows/crew-init.js

@@ -1,11 +1,12 @@
 export const meta = {
   name: "crew-init",
-  description: "Initialize Muse Crew: bootstrap release, scaffold orchestration, register the first project, set up cron jobs. Idempotent — safe to re-run. The dashboard is optional: omit dashboardSlug/dashboardRepoPath for a CLI-only install. Takes an optional crewName (the human's chosen name for the crew), stored at $CREW_HOME/crew-name.",
+  description: "Initialize Muse Crew: bootstrap release, scaffold orchestration, register the first project, set up cron jobs, and persist the automatic-update policy. Idempotent — safe to re-run. The dashboard is optional: omit dashboardSlug/dashboardRepoPath for a CLI-only install. Takes an optional crewName (the human's chosen name for the crew), stored at $CREW_HOME/crew-name. Takes optional autoUpdateCrew/autoUpdateDashboard/updateChannel (defaults true/true/latest) for the automatic update watcher policy.",
   phases: [
     { name: "release", title: "Bootstrap release system" },
     { name: "scaffold", title: "Scaffold orchestration directory" },
     { name: "project", title: "Register first project" },
-    { name: "crons", title: "Create and converge cron jobs" }
+    { name: "crons", title: "Create and converge cron jobs" },
+    { name: "policy", title: "Persist update policy" }
   ]
 };
 
@@ -19,6 +20,28 @@ const dashboardName = inputs.dashboardName || "Muse Crew";
 const crewName = inputs.crewName || null;
 const cronIds = inputs.cronIds || {};
 
+// ── Automatic-update policy inputs ──────────────────────────────────
+// All optional. autoUpdateCrew/autoUpdateDashboard default to true (the
+// update watcher files upgrade tasks through the loop); updateChannel
+// defaults to "latest" ("patch" narrows crew upgrades to patch releases).
+// Explicit inputs win on every run; existing config values survive a
+// re-init that passes no inputs; defaults apply only on first init —
+// never silently resurrect a human's deliberate opt-out.
+const autoUpdateCrew = inputs.autoUpdateCrew !== undefined ? !!inputs.autoUpdateCrew : true;
+const autoUpdateDashboard = inputs.autoUpdateDashboard !== undefined ? !!inputs.autoUpdateDashboard : true;
+const updateChannel = inputs.updateChannel || "latest";
+
+// Validation in workflow code, before any agent call — fail closed.
+if (updateChannel !== "latest" && updateChannel !== "patch") {
+  return {
+    __hatchWorkflowControl: "blocked",
+    result: {
+      blocked_reason: "Invalid updateChannel",
+      message: "updateChannel must be \"latest\" or \"patch\" — got " + JSON.stringify(updateChannel) + ". Re-run init with a valid channel."
+    }
+  };
+}
+
 if (!crewRepoPath) throw new Error("crewRepoPath is required — path to muse-crew (git checkout or npm install)");
 if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew (must be inside the workspace)");
 // The dashboard is optional. Provide both dashboardSlug and dashboardRepoPath
@@ -367,19 +390,76 @@ try {
 log("Project: " + dashboardSlug + " " + projectResult.action + " (repo_path=" + gateFacts.dashboardRepoExpanded + ")");
 } // end dashboard-mode project registration
 
+// ── Scheduler identity (2026-09-16) ──────────────────────────────────
+// The crew's scheduler identity is dashboard-independent and chosen once.
+// First init uses the crew-home basename; a re-run keeps the instanceId
+// recorded in .cron-registry.json. A registry that exists but is corrupt,
+// or parses but carries no usable instanceId, fails closed — init will not
+// guess the previous identity, because a wrong guess would orphan the old
+// cron jobs and create duplicates. Attaching or removing a dashboard
+// is a project registration, never an identity change, so it can neither
+// orphan nor duplicate the polling loop. The loop is cli-owned: deleting a
+// dashboard artifact must not stop the crew (the crew never requires a
+// dashboard); crew removal is crew-uninstall's job (registry + discovery).
+// The sensor reports raw; the decision below is pure JS.
+function priorInstanceId(cronRegistryJson, registryPath) {
+  if (cronRegistryJson == null) return null;
+  var reg;
+  try {
+    reg = JSON.parse(cronRegistryJson);
+  } catch (e) {
+    throw new Error("existing " + registryPath + " is not valid JSON (" + String(e.message || e) + "). Inspect or remove it, then re-run init — init will not guess the previous scheduler identity.");
+  }
+  var id = reg && reg.instanceId;
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error("existing " + registryPath + " has no usable instanceId. Repair the registry or remove it, then re-run init — init will not guess the previous scheduler identity.");
+  }
+  return id;
+}
+
 // ── Phase 4: Cron jobs (declarative manifest) ──────────────────────────
 // The manifest lives in the repo at seed/crons.json. Body templates live
 // in seed/ with {crewHome} placeholders. Missing jobs are
 // created from the manifest; existing jobs converge to it — except `enabled`,
 // which is a creation-time default only and is never touched on update.
-// Instance identity: in dashboard mode the dashboard slug scopes cron ids
-// and ownership (space:<slug>); in CLI-only mode the crew-home basename
-// scopes them instead, so two crew instances never share a cron id and no
-// dashboard is required.
+// Live ids are entry.id + '-' + instanceId (instance-safe by construction —
+// two crew instances never share a cron id) unless overridden via cronIds.
 phase("crons");
-var crewHomeBase = gateFacts.crewHomeExpanded.split("/").pop().replace(/^\./, "") || "crew";
-var instanceId = dashboardSlug || crewHomeBase;
-var cronOwner = inputs.cronOwner || (dashboardSlug ? "space:" + dashboardSlug : "cli:" + instanceId);
+var registryPath = gateFacts.crewHomeExpanded + "/.cron-registry.json";
+var identityFacts;
+try {
+  identityFacts = await agent(
+    "Read this crew's existing scheduler identity, if any. Report raw facts.\\n\\n" +
+    "Crew home: " + gateFacts.crewHomeExpanded + "\\n\\n" +
+    "Steps (run in shell):\\n" +
+    "1. If " + registryPath + " exists, print its exact bytes with cat.\\n" +
+    "2. If it does not exist, print nothing.\\n" +
+    "3. Return JSON { registryJson }: registryJson is the file's exact text, or null when the file does not exist. Do not judge, summarize, or repair — report raw.",
+    {
+      key: "crons-identity-1",
+      label: "Read existing scheduler identity",
+      schema: {
+        type: "object",
+        properties: {
+          registryJson: { type: ["string", "null"] }
+        },
+        required: ["registryJson"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Scheduler identity read failed", message: String(e.message || e) } };
+}
+var instanceId;
+try {
+  instanceId = priorInstanceId(identityFacts.registryJson, registryPath) ||
+    gateFacts.crewHomeExpanded.split("/").pop().replace(/^\./, "") || "crew";
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Scheduler identity unreadable", message: String(e.message || e) } };
+}
+var cronOwner = inputs.cronOwner || ("cli:" + instanceId);
+log("Scheduler identity: instanceId=" + instanceId + " owner=" + cronOwner +
+  (identityFacts.registryJson ? " (kept from existing registry)" : " (first init; crew-home basename)"));
 var cronsResult;
 try {
   cronsResult = await agent(
@@ -480,6 +560,83 @@ log("Crons: " + cronsResult.summary.crons.map(function (c) { return c.id + "=" +
     "; registry: " + cronsResult.summary.registry.path + " (" + cronsResult.summary.registry.ids.join(", ") + ")");
 
 
+// ── Phase 5: Update policy ────────────────────────────────────────────
+// Persists the automatic-update policy (auto_update_crew,
+// auto_update_dashboard, update_channel) via the Crew API's update-config,
+// and seeds $CREW_HOME/.update-watch.json as {} only when it does not
+// exist. Re-init semantics mirror the crons manifest rule: explicit inputs
+// win; existing config values are kept; defaults apply only on first init —
+// a re-init with no inputs never silently resurrects a human's opt-out.
+// No wall-clock reads anywhere in this phase or its prompt.
+phase("policy");
+var policyInputCrew = inputs.autoUpdateCrew !== undefined ? (!!inputs.autoUpdateCrew ? "true" : "false") : null;
+var policyInputDashboard = inputs.autoUpdateDashboard !== undefined ? (!!inputs.autoUpdateDashboard ? "true" : "false") : null;
+var policyInputChannel = inputs.updateChannel !== undefined ? updateChannel : null;
+var safeExpandedHome = gateFacts.crewHomeExpanded.split('"').join('\\"');
+var policyResult;
+try {
+  policyResult = await agent(
+    "Persist the automatic-update policy for the crew's update watcher.\n\n" +
+    "Crew home (expanded): " + gateFacts.crewHomeExpanded + "\n" +
+    "Crew API: " + gateFacts.crewHomeExpanded + "/current/lib/crew-api.js\n\n" +
+    "Explicit inputs for this run (null means the human gave no input):\n" +
+    "- auto_update_crew: " + policyInputCrew + " (default true)\n" +
+    "- auto_update_dashboard: " + policyInputDashboard + " (default true)\n" +
+    "- update_channel: " + policyInputChannel + " (default latest)\n\n" +
+    "Steps:\n" +
+    "1. Read the current config:\n" +
+    "   node " + gateFacts.crewHomeExpanded + "/current/lib/crew-api.js --crew-home " + gateFacts.crewHomeExpanded + " get-config\n" +
+    "   The response carries { config: { key: value, ... } }.\n" +
+    "2. For each key in (auto_update_crew, auto_update_dashboard, update_channel):\n" +
+    "   - When an explicit input is present for the key, write the input value.\n" +
+    "   - Otherwise, when the config already holds a value for the key, keep it —\n" +
+    "     do NOT overwrite it with the default. A human's deliberate opt-out\n" +
+    "     (e.g. auto_update_crew=false) must survive a re-init that passes no inputs.\n" +
+    "   - Otherwise write the default (true / true / latest).\n" +
+    "   Write via:\n" +
+    "   node " + gateFacts.crewHomeExpanded + "/current/lib/crew-api.js --crew-home " + gateFacts.crewHomeExpanded + " update-config --json '{\"key\": \"<key>\", \"value\": \"<value>\"}'\n" +
+    "   Values are the strings \"true\"/\"false\" for the booleans and \"latest\"/\"patch\"\n" +
+    "   for the channel. Only issue update-config for a key whose final value\n" +
+    "   differs from the current config value.\n" +
+    "3. Seed the watcher state file only when absent — never overwrite it,\n" +
+    "   it is the idempotency record for filed upgrade tasks:\n" +
+    "   test -f \"" + safeExpandedHome + "/.update-watch.json\" && echo STATE_EXISTS || (printf '%s' '{}' > \"" + safeExpandedHome + "/.update-watch.json\" && echo STATE_SEEDED)\n" +
+    "4. Return JSON { persisted: { auto_update_crew: \"<value>\", auto_update_dashboard: \"<value>\", update_channel: \"<value>\" }, state_file: \"seeded\" | \"exists\" }\n" +
+    "   with the values that are in effect after this run (explicit input,\n" +
+    "   kept config value, or default — whichever applied).",
+    {
+      key: "policy-1",
+      label: "Persist update policy",
+      schema: {
+        type: "object",
+        properties: {
+          persisted: {
+            type: "object",
+            properties: {
+              auto_update_crew: { type: "string" },
+              auto_update_dashboard: { type: "string" },
+              update_channel: { type: "string" }
+            },
+            required: ["auto_update_crew", "auto_update_dashboard", "update_channel"]
+          },
+          state_file: { type: "string", enum: ["seeded", "exists"] }
+        },
+        required: ["persisted", "state_file"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Update policy persist failed", message: String(e.message || e) } };
+}
+var persistedPolicy = policyResult.persisted || {};
+if (!persistedPolicy.auto_update_crew || !persistedPolicy.auto_update_dashboard || !persistedPolicy.update_channel) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Update policy incomplete", message: "policy phase returned no persisted policy values" } };
+}
+log("Update policy: auto_update_crew=" + persistedPolicy.auto_update_crew +
+  " auto_update_dashboard=" + persistedPolicy.auto_update_dashboard +
+  " update_channel=" + persistedPolicy.update_channel +
+  " state_file=" + policyResult.state_file);
+
 // ── Summary ───────────────────────────────────────────────────────────
 return {
   message: "Muse Crew initialized.",
@@ -492,5 +649,11 @@ return {
   scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
   project: projectResult.action,
   crons: cronsResult.summary.crons,
-  registry: cronsResult.summary.registry
+  registry: cronsResult.summary.registry,
+  autoUpdate: {
+    crew: persistedPolicy.auto_update_crew === "true",
+    dashboard: persistedPolicy.auto_update_dashboard === "true",
+    channel: persistedPolicy.update_channel
+  },
+  announcement: "Your crew and dashboard will update themselves automatically; say the word if you'd rather approve each one."
 };