muse-crew 0.7.7 → 0.7.8

package/docs/guide.md

@@ -99,6 +99,30 @@ After init completes, it returns a summary:
 
 Re-running init against an existing setup returns `"unchanged"` (or `"updated"` with the converged field names) for each cron, with no other mutations.
 
+### Uninstall
+
+Uninstalling a crew removes its scheduler crons and deletes the crew home — one flow, never a manual two-step. Launch it as a workflow through the agent's workflow tools:
+
+```
+workflow_launch with:
+  scriptPath: "<install-path>/workflows/crew-uninstall.js"
+  args: {
+    crewHome: "~/workspace/.my-crew",
+    confirm: true
+  }
+```
+
+`crewHome` is required; `confirm` must be exactly `true` or the run blocks. `force` (default `false`) overrides the live-work check described below.
+
+The run has four phases:
+
+1. **Gates** — the crew home must be inside the workspace (uninstall refuses to delete anything outside it), and `confirm: true` must be present. Either missing blocks the run before anything is touched.
+2. **Safety** — if any task is `in_progress`, the run blocks unless `force: true`. Uninstalling under live workflows would strand them.
+3. **Crons** — removes the crew's scheduler jobs, and only those: the exact ids from `$CREW_HOME/.cron-registry.json` (written by init; covers id overrides), plus discovery of `crew-poll-*` jobs whose body contains the crew home path (covers installs from before the registry existed). Anything not on that union is never touched — shared crons are safe by construction, and a missing home still gets its orphaned crons removed.
+4. **Home** — best-effort `git worktree prune` on the crew's project repos, then deletes the crew home directory and verifies it is gone.
+
+Dashboard artifacts are left untouched — uninstall removes the crew instance (its crons and its home), never the user's artifacts.
+
 ## Connecting an existing project
 
 Projects are registered through the API, not through init. Init sets up the infrastructure and registers the task service as the first project; you register additional projects separately.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/crew-init.js

@@ -363,9 +363,18 @@ try {
     "      Call cron_update with only the fields that differ. If nothing differs,\n" +
     "      do not call cron_update. Record action 'updated' with the updated field\n" +
     "      names, or 'unchanged' with no updated fields.\n" +
-    "3. Return { passed: true, summary: { crons: [...] } } with one entry per\n" +
-    "   manifest entry, in manifest order: { id, action: 'created' | 'updated' |\n" +
-    "   'unchanged', updated_fields: [...] }.",
+    "3. Write the cron registry at " + crewHome + "/.cron-registry.json — the exact\n" +
+    "   record a later uninstall uses to find these jobs. Build this JSON (one entry\n" +
+    "   per manifest entry, in manifest order, using the live ids from step 2):\n" +
+    "   {\"version\":1,\"instanceId\":\"" + instanceId + "\",\"owner\":\"" + cronOwner + "\",\n" +
+    "    \"crons\":[{\"id\":<live id>,\"manifestId\":<entry.id>}, ...]}\n" +
+    "   Write it with printf '%s' and a single-quoted heredoc so the shell\n" +
+    "   interpolates nothing, then read it back to confirm it parses.\n" +
+    "4. Return { passed: true, summary: { crons: [...], registry: {...} } } with one\n" +
+    "   crons entry per manifest entry, in manifest order:\n" +
+    "   { id, action: 'created' | 'updated' | 'unchanged', updated_fields: [...] },\n" +
+    "   and registry: { path: \"" + crewHome + "/.cron-registry.json\",\n" +
+    "   ids: [<live id>, ...] } echoing the ids written to disk.",
     {
       key: "crons-1",
       label: "Create and converge cron jobs",
@@ -387,9 +396,17 @@ try {
                   },
                   required: ["id", "action", "updated_fields"]
                 }
+              },
+              registry: {
+                type: "object",
+                properties: {
+                  path: { type: "string" },
+                  ids: { type: "array", items: { type: "string" } }
+                },
+                required: ["path", "ids"]
               }
             },
-            required: ["crons"]
+            required: ["crons", "registry"]
           }
         },
         required: ["passed", "summary"]
@@ -399,10 +416,12 @@ try {
 } catch (e) {
   return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron setup failed", message: String(e.message || e) } };
 }
-if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.crons)) {
-  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron manifest invalid", message: "seed/crons.json failed validation or produced no crons list" } };
+if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.crons) ||
+    !cronsResult.summary.registry || !Array.isArray(cronsResult.summary.registry.ids)) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron manifest invalid", message: "seed/crons.json failed validation, produced no crons list, or wrote no cron registry" } };
 }
-log("Crons: " + cronsResult.summary.crons.map(function (c) { return c.id + "=" + c.action; }).join(", "));
+log("Crons: " + cronsResult.summary.crons.map(function (c) { return c.id + "=" + c.action; }).join(", ") +
+    "; registry: " + cronsResult.summary.registry.path + " (" + cronsResult.summary.registry.ids.join(", ") + ")");
 
 
 // ── Summary ───────────────────────────────────────────────────────────
@@ -416,5 +435,6 @@ return {
   releaseHash: releaseResult.hash,
   scaffold: { created: scaffoldCreated, skipped: scaffoldSkipped },
   project: projectResult.action,
-  crons: cronsResult.summary.crons
+  crons: cronsResult.summary.crons,
+  registry: cronsResult.summary.registry
 };

package/workflows/crew-uninstall.js

@@ -0,0 +1,264 @@
+export const meta = {
+  name: "crew-uninstall",
+  description: "Uninstall a Muse Crew instance: remove its scheduler cron jobs, then delete the crew home directory. Destructive and irreversible — requires confirm: true, and refuses to run while any task is in_progress unless force: true. Only the crew's own crons are removed (exact registry plus body-match discovery); shared crons are never touched. Dashboard artifacts are left alone.",
+  phases: [
+    { name: "gates", title: "Containment gate and explicit confirmation" },
+    { name: "safety", title: "Refuse while work is live (unless forced)" },
+    { name: "crons", title: "Remove the crew's scheduler crons" },
+    { name: "home", title: "Delete the crew home directory" }
+  ]
+};
+
+// ── Arguments ──────────────────────────────────────────────────────────
+const inputs = args ?? {};
+const crewHome = inputs.crewHome;
+const confirm = inputs.confirm;
+const force = inputs.force;
+
+if (!crewHome) throw new Error("crewHome is required — e.g. ~/workspace/.crew");
+
+// ── Pure decision helpers ──────────────────────────────────────────────
+// The agent is a sensor, not a judge: it reports raw facts (HOME, expanded
+// paths, existence, in-progress counts) and the verdicts below are computed
+// here, deterministically. (Prompt hardening is a smell — this is the
+// mechanical version.)
+function expandTilde(p, home) {
+  if (p === "~") return home;
+  if (p.indexOf("~/") === 0) return home + p.slice(1);
+  return p;
+}
+function uninstallGateDecide(facts) {
+  // facts: { home, crewHomeExpanded }
+  // Uninstall deletes a directory tree — it must never run against a home
+  // outside the workspace. Same prefix rule as crew-init's Gate 0.
+  var workspace = facts.home + "/workspace";
+  var launchable = facts.crewHomeExpanded.indexOf(workspace + "/") === 0;
+  return { workspace: workspace, launchable: launchable };
+}
+function confirmDecide(c) {
+  // Strict: only the boolean true counts. "true", 1, and undefined do not.
+  if (c === true) return { ok: true, message: "" };
+  return {
+    ok: false,
+    message: "crew-uninstall is destructive and irreversible: it removes the crew's scheduler cron jobs and deletes the crew home directory. Re-run with confirm: true to proceed."
+  };
+}
+function safetyDecide(inProgressCount, f) {
+  // Live work strands if its home disappears mid-run. Refuse unless forced.
+  if (inProgressCount > 0 && f !== true) {
+    return {
+      ok: false,
+      message: inProgressCount + " task(s) are in_progress. Uninstalling now would strand their workflows. Re-run with force: true to uninstall anyway, or finish/park the work first."
+    };
+  }
+  return { ok: true, message: "" };
+}
+
+// ── Gates: containment + confirmation ──────────────────────────────────
+phase("gates");
+var gateFacts;
+try {
+  gateFacts = await agent(
+    "Report filesystem facts for a crew uninstall. Do not judge — just report.\n\n" +
+    "Requested crewHome: " + crewHome + "\n\n" +
+    "Steps (run in shell):\n" +
+    "1. home=$(echo $HOME)\n" +
+    "2. Expand a leading ~/ in the requested crewHome against $HOME (leave other paths untouched).\n" +
+    "3. Report whether the expanded path exists: test -e \"<expanded>\"; echo EXISTS:$?\n" +
+    "4. Return JSON { home, crewHomeExpanded, homeExists } where homeExists is true\n" +
+    "   when the path exists.",
+    {
+      key: "uninstall-gates",
+      label: "Validate uninstall target",
+      schema: {
+        type: "object",
+        properties: {
+          home: { type: "string" },
+          crewHomeExpanded: { type: "string" },
+          homeExists: { type: "boolean" }
+        },
+        required: ["home", "crewHomeExpanded", "homeExists"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Uninstall validation failed", message: String(e.message || e) } };
+}
+var gateResult = uninstallGateDecide(gateFacts);
+if (!gateResult.launchable) {
+  return {
+    __hatchWorkflowControl: "blocked",
+    result: {
+      blocked_reason: "crewHome is not workspace-contained",
+      message: "crewHome must be inside the workspace (" + gateResult.workspace + "). Requested: " + gateFacts.crewHomeExpanded + ". Uninstall refuses to delete anything outside the workspace."
+    }
+  };
+}
+var crewHomeExpanded = gateFacts.crewHomeExpanded;
+var confirmation = confirmDecide(confirm);
+if (!confirmation.ok) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Uninstall not confirmed", message: confirmation.message } };
+}
+log("Uninstall confirmed for " + crewHomeExpanded + (gateFacts.homeExists ? "" : " (crew home already gone — removing orphaned crons only)"));
+
+// ── Safety: refuse while work is live (unless forced) ───────────────────
+phase("safety");
+var safetyFacts = { homeExists: gateFacts.homeExists, inProgress: 0 };
+if (gateFacts.homeExists) {
+  try {
+    safetyFacts = await agent(
+      "Report whether this crew has live work. Do not judge — just report.\n\n" +
+      "crewHome: " + crewHomeExpanded + "\n\n" +
+      "Steps (run in shell):\n" +
+      "1. If \"" + crewHomeExpanded + "/crew-state.db\" exists, run:\n" +
+      "   sqlite3 \"" + crewHomeExpanded + "/crew-state.db\" \"SELECT COUNT(*) FROM tasks WHERE state='in_progress';\"\n" +
+      "   Report the number. When the database is missing, the count is 0.\n" +
+      "2. Return JSON { homeExists: true, inProgress: <number> }.",
+      {
+        key: "uninstall-safety",
+        label: "Check for live work",
+        schema: {
+          type: "object",
+          properties: {
+            homeExists: { type: "boolean" },
+            inProgress: { type: "number" }
+          },
+          required: ["homeExists", "inProgress"]
+        }
+      }
+    );
+  } catch (e) {
+    return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Safety check failed", message: String(e.message || e) } };
+  }
+}
+var safety = safetyDecide(safetyFacts.inProgress, force);
+if (!safety.ok) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Live work in progress", message: safety.message } };
+}
+log("Safety: " + safetyFacts.inProgress + " in_progress task(s)" + (force === true ? " (forced)" : ""));
+
+// ── Remove the crew's scheduler crons ──────────────────────────────────
+// Two sources, unioned: the exact registry written by crew-init (covers id
+// overrides), and discovery (covers installs from before the registry
+// existed, and a registry that was never written). A job is only removed
+// when it is on that union — never by guesswork.
+phase("crons");
+var cronsResult;
+try {
+  cronsResult = await agent(
+    "Remove this crew instance's scheduler cron jobs — and nothing else.\n\n" +
+    "crewHome: " + crewHomeExpanded + "\n\n" +
+    "Steps:\n" +
+    "1. Registry: if \"" + crewHomeExpanded + "/.cron-registry.json\" exists, read it\n" +
+    "   and take its crons[].id list as registry candidates.\n" +
+    "2. Discovery: call cron_list. For every job whose id starts with 'crew-poll-',\n" +
+    "   call cron_view and keep it as a discovery candidate when the job body\n" +
+    "   contains the crewHome string '" + crewHomeExpanded + "' (the poll body template\n" +
+    "   embeds the crew home path). The bare id 'crew-poll' with no instance suffix\n" +
+    "   is never a live crew job — never remove it.\n" +
+    "3. Removal list = registry candidates ∪ discovery candidates, deduped.\n" +
+    "   SAFETY: remove only jobs on this list. When in doubt about any job, fail\n" +
+    "   closed (passed: false) instead of guessing.\n" +
+    "4. For each id on the removal list: call cron_remove. A job that is already\n" +
+    "   gone records action 'already_gone'.\n" +
+    "5. Call cron_list again and confirm none of the removed ids remain. If any\n" +
+    "   remain, return passed: false.\n" +
+    "6. Return { passed: true, summary: { removed: [...] } } with one entry per\n" +
+    "   removal-list id: { id, source: 'registry' | 'discovery',\n" +
+    "   action: 'removed' | 'already_gone' }. An empty removal list is a pass\n" +
+    "   with removed: [].",
+    {
+      key: "uninstall-crons",
+      label: "Remove the crew's crons",
+      schema: {
+        type: "object",
+        properties: {
+          passed: { type: "boolean" },
+          summary: {
+            type: "object",
+            properties: {
+              removed: {
+                type: "array",
+                items: {
+                  type: "object",
+                  properties: {
+                    id: { type: "string" },
+                    source: { type: "string", enum: ["registry", "discovery"] },
+                    action: { type: "string", enum: ["removed", "already_gone"] }
+                  },
+                  required: ["id", "source", "action"]
+                }
+              }
+            },
+            required: ["removed"]
+          }
+        },
+        required: ["passed", "summary"]
+      }
+    }
+  );
+} catch (e) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron removal failed", message: String(e.message || e) } };
+}
+if (!cronsResult.passed || !cronsResult.summary || !Array.isArray(cronsResult.summary.removed)) {
+  return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Cron removal failed", message: "The cron-removal agent did not pass. No further teardown was attempted; the crew home is untouched." } };
+}
+var removedDesc = cronsResult.summary.removed.map(function (r) { return r.id + "=" + r.action; }).join(", ");
+log("Crons: " + (removedDesc || "(none belonged to this crew)"));
+
+// ── Delete the crew home directory ─────────────────────────────────────
+phase("home");
+var homeRemoved = false;
+if (gateFacts.homeExists) {
+  var homeResult;
+  try {
+    homeResult = await agent(
+      "Delete the crew home directory.\n\n" +
+      "crewHome: " + crewHomeExpanded + "\n\n" +
+      "Steps:\n" +
+      "1. Best-effort worktree hygiene (failures do not block): if\n" +
+      "   \"" + crewHomeExpanded + "/crew-state.db\" exists, list the repo_path values\n" +
+      "   from its projects table and run 'git worktree prune' in each. Ignore errors.\n" +
+      "2. Run: rm -rf \"" + crewHomeExpanded + "\"\n" +
+      "3. Verify: test ! -e \"" + crewHomeExpanded + "\" — fail closed (passed: false)\n" +
+      "   if the path still exists.\n" +
+      "4. Return { passed: true, summary: { removed: true } }.",
+      {
+        key: "uninstall-home",
+        label: "Delete the crew home",
+        schema: {
+          type: "object",
+          properties: {
+            passed: { type: "boolean" },
+            summary: {
+              type: "object",
+              properties: {
+                removed: { type: "boolean" }
+              },
+              required: ["removed"]
+            }
+          },
+          required: ["passed", "summary"]
+        }
+      }
+    );
+  } catch (e) {
+    return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Crew home removal failed", message: String(e.message || e) } };
+  }
+  if (!homeResult.passed || !homeResult.summary || homeResult.summary.removed !== true) {
+    return { __hatchWorkflowControl: "blocked", result: { blocked_reason: "Crew home removal failed", message: "The crew home could not be deleted. Its crons were already removed; delete " + crewHomeExpanded + " manually." } };
+  }
+  homeRemoved = true;
+  log("Crew home deleted: " + crewHomeExpanded);
+} else {
+  log("Crew home already gone — nothing to delete.");
+}
+
+// ── Summary ────────────────────────────────────────────────────────────
+return {
+  message: "Muse Crew uninstalled.",
+  crewHome: crewHomeExpanded,
+  removed_crons: cronsResult.summary.removed,
+  crew_home_removed: homeRemoved,
+  note: "Dashboard artifacts were left untouched — uninstall removes the crew instance (its crons and its home), never the user's artifacts."
+};