@chorus-aidlc/chorus 0.16.2 → 0.16.4

package/cli/daemon-rest-client.mjs

@@ -4,10 +4,12 @@
 // the existing server endpoints accept, so the two daemon hosts — the chorus CLI daemon
 // (`cli/daemon.mjs`) and the OpenClaw plugin — cannot drift in the wire contract.
 //
-// The five operations and their EXACT server payload shapes (verified against
-// src/app/api/daemon/*/route.ts — the server is NOT changed by this work):
+// The operations and payload fields this client supports (verified against
+// src/app/api/daemon/*/route.ts):
 //   turnAdvance      → POST /api/daemon/turn-advance
-//                      { connectionUuid, sessionId, status, entityType?, entityUuid?,
+//                      { connectionUuid, sessionId, status, turnUuid?,
+//                        backendSessionId?, entityType?, entityUuid?,
+//                        interruptedReason?, transcriptRelayError?, usage?,
 //                        coalescedCount? }
 //   transcript       → POST /api/daemon/transcript
 //                      { sessionId, messages: [{ role, text }] }
@@ -71,7 +73,7 @@ const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
  *   logger?: { info(m:string):void, warn(m:string):void, error(m:string):void },
  * }} opts
  * @returns {{
- *   turnAdvance: (p: { sessionId: string, backendSessionId?: string|null, status: string, entityType?: string|null, entityUuid?: string|null, coalescedCount?: number }) => Promise<DaemonRestResult>,
+ *   turnAdvance: (p: { sessionId: string, turnUuid?: string|null, backendSessionId?: string|null, status: string, entityType?: string|null, entityUuid?: string|null, coalescedCount?: number }) => Promise<DaemonRestResult>,
  *   transcript: (p: { sessionId: string, messages: Array<{ role: string, text: string }> }) => Promise<DaemonRestResult>,
  *   executionState: (p: { executions: Array<Record<string, unknown>> }) => Promise<DaemonRestResult>,
  *   reportInterrupt: (p: { entityType: string, entityUuid: string, reason: string }) => Promise<DaemonRestResult>,
@@ -111,7 +113,7 @@ export function createDaemonRestClient(opts) {
    *                         established op-prefixed message.
    * @returns {Promise<DaemonRestResult>}
    */
-  async function post(op, path, body, successLog, context = "") {
+  async function post(op, path, body, successLog, context = "", readData = false) {
     let response;
     try {
       response = await fetchImpl(`${url}${path}`, {
@@ -131,8 +133,19 @@ export function createDaemonRestClient(opts) {
       logger.warn(`[Chorus] ${error}`);
       return { ok: false, status: response.status, error };
     }
+    let data;
+    if (readData) {
+      try {
+        const parsed = await response.json();
+        data = parsed && typeof parsed === "object" ? parsed.data : undefined;
+      } catch (err) {
+        // Mixed-version fallback: older servers may return an empty successful body.
+        // Keep the lifecycle report successful, but make the missing correlation visible.
+        logger.warn(`[Chorus] ${op} response correlation unavailable: ${err}`);
+      }
+    }
     if (successLog) logger.info(`[Chorus] ${successLog}`);
-    return { ok: true, status: response.status };
+    return { ok: true, status: response.status, ...(data !== undefined ? { data } : {}) };
   }
 
   return {
@@ -148,7 +161,7 @@ export function createDaemonRestClient(opts) {
      * the turn's usage. Both ride the terminal edge only. Requires the connectionUuid (the
      * server addresses the turn against a connection the agent owns).
      */
-    async turnAdvance({ sessionId, status, entityType, entityUuid, interruptedReason, transcriptRelayError, usage, backendSessionId, coalescedCount }) {
+    async turnAdvance({ sessionId, turnUuid, status, entityType, entityUuid, interruptedReason, transcriptRelayError, usage, backendSessionId, coalescedCount }) {
       const connectionUuid = getConnectionUuid();
       if (!connectionUuid) {
         const error = `cannot advance turn for session ${sessionId} → ${status} — no connection uuid yet`;
@@ -164,6 +177,7 @@ export function createDaemonRestClient(opts) {
         connectionUuid,
         sessionId,
         status,
+        ...(turnUuid ? { turnUuid } : {}),
         // Only sent when BOTH are present, so the server never gets a partial linkage.
         ...(entityType && entityUuid ? { entityType, entityUuid } : {}),
         // Only meaningful alongside status=interrupted; never sent otherwise.
@@ -182,12 +196,21 @@ export function createDaemonRestClient(opts) {
           ? { coalescedCount }
           : {}),
       };
-      return post(
+      const result = await post(
         "turn-advance",
         "/api/daemon/turn-advance",
         body,
         `advanced turn for session ${sessionId} → ${status}`,
+        "",
+        status === "running",
       );
+      const resolvedTurnUuid =
+        typeof result.data?.turn?.uuid === "string" ? result.data.turn.uuid : null;
+      if (status !== "running") return result;
+      const { data: _rawData, ...baseResult } = result;
+      return resolvedTurnUuid
+        ? { ...baseResult, data: { turnUuid: resolvedTurnUuid } }
+        : baseResult;
     },
 
     /**

package/cli/daemon.mjs

@@ -41,6 +41,8 @@ import { Waker } from "./waker.mjs";
 import { LineageResolver } from "./lineage.mjs";
 import { resolveClaudePath } from "./claude-spawner.mjs";
 import { resolveCodexPath } from "./codex-spawner.mjs";
+import { resolveDshPath } from "./dsh-spawner.mjs";
+import { prepareManagedDshConfig } from "./dsh-managed-config.mjs";
 import { resolveKiroPath } from "./kiro-spawner.mjs";
 import { selectSpawner } from "./spawner-select.mjs";
 import {
@@ -152,7 +154,13 @@ export function buildDaemon(creds, deps = {}) {
   // (construction byte-identical to before); codex → CodexSpawner. `creds` are
   // passed through so the Codex backend can export the daemon key into the woken
   // process env (the Claude backend ignores creds — it gets its key via --mcp-config).
-  const spawner = deps.spawner ?? selectSpawner(agentType, { logger, permissionMode, creds });
+  const spawner = deps.spawner ?? selectSpawner(agentType, {
+    logger,
+    permissionMode,
+    creds,
+    bundleVersion: deps.bundleVersion,
+    prepareManagedConfigFn: deps.prepareManagedDshConfig,
+  });
   const maxConcurrency = deps.maxConcurrency ?? 4;
 
   // ===== Multi-path: the SET of cwds this daemon serves (T3 — FR-5) =====
@@ -742,6 +750,7 @@ export async function runDaemon(flags = {}, deps = {}) {
   // banner shows the right binary instead of always probing for `claude`.
   const findClaude = deps.resolveClaudePath ?? resolveClaudePath;
   const findCodex = deps.resolveCodexPath ?? resolveCodexPath;
+  const findDsh = deps.resolveDshPath ?? resolveDshPath;
   const findKiro = deps.resolveKiroPath ?? resolveKiroPath;
   const verbose = flags.verbose === true || env.CHORUS_VERBOSE === "1";
 
@@ -786,6 +795,9 @@ export async function runDaemon(flags = {}, deps = {}) {
     writeConfig: deps.writeConfig,
     readJson: deps.readJson,
     loginPath: deps.loginPath,
+    prepareManagedDshConfig: deps.prepareManagedDshConfig,
+    bundleVersion: version,
+    resolveDshPath: findDsh,
   };
 
   const action = flags.action ?? "run";
@@ -884,6 +896,8 @@ export async function runDaemon(flags = {}, deps = {}) {
       mcpClient: deps.mcpClient,
       lineage: deps.lineage,
       build: deps.build,
+      bundleVersion: version,
+      prepareManagedDshConfig: deps.prepareManagedDshConfig,
     });
 
     const shutdownMulti = () => {
@@ -924,11 +938,16 @@ export async function runDaemon(flags = {}, deps = {}) {
   // Detect the SELECTED backend's executable (non-fatal): the daemon still
   // subscribes when it's missing; a wake surfaces the error visibly when one
   // arrives. The resolved path (or absence) is shown in the banner below. Each
-  // backend probes its own binary — codex → resolveCodexPath, kiro →
-  // resolveKiroPath, otherwise resolveClaudePath — so a `--agent kiro` run probes
-  // (and the banner reports) `kiro-cli`, not `claude`.
+  // backend probes its own binary, including dsh-jsonrpc-agent for dsh, so the
+  // startup banner and warning report the selected runtime rather than Claude.
   const cliPath =
-    agentType === "codex" ? findCodex() : agentType === "kiro" ? findKiro() : findClaude();
+    agentType === "codex"
+      ? findCodex()
+      : agentType === "kiro"
+        ? findKiro()
+        : agentType === "dsh"
+          ? findDsh()
+          : findClaude();
 
   // The daemon.json the layered config readers (credentials, sigint timeout, cwds)
   // consult. Surfacing its absolute path + presence in the banner makes it obvious
@@ -987,6 +1006,8 @@ export async function runDaemon(flags = {}, deps = {}) {
     sigintTimeoutMs,
     cwds,
     browseRoots,
+    bundleVersion: version,
+    prepareManagedDshConfig: deps.prepareManagedDshConfig,
   });
 
   // Graceful shutdown on signals.
@@ -1171,7 +1192,7 @@ export async function handleLifecycleAction(action, { log, errLog, lifecycle, se
     // CHORUS_AGENT env / a prior stored choice; probes the selected CLI and warns
     // (non-fatal) when it is missing. An unknown --agent was already rejected by
     // resolveAgentType above, so this phase never fails.
-    await installCfg.resolveInstallAgent(flags, env, {
+    const installAgent = await installCfg.resolveInstallAgent(flags, env, {
       isTTY,
       skip,
       writeConfig: pfDeps?.writeConfig ?? updateDaemonConfig,
@@ -1181,6 +1202,26 @@ export async function handleLifecycleAction(action, { log, errLog, lifecycle, se
       log,
       errLog,
     });
+    if (
+      installAgent.agent === "dsh" &&
+      !String(env.CHORUS_DSH_CONFIG ?? "").trim() &&
+      !String(env.DSH_CORDIS_CONFIG ?? "").trim()
+    ) {
+      try {
+        await (pfDeps?.prepareManagedDshConfig ?? prepareManagedDshConfig)({
+          env,
+          bundleVersion: pfDeps?.bundleVersion,
+          dshPath: installAgent.cliPath ?? pfDeps?.resolveDshPath?.(),
+          creds: credResult.creds,
+        });
+      } catch (error) {
+        errLog(
+          `[Chorus] install aborted — dsh managed composition preparation failed: ` +
+            `${error instanceof Error ? error.message : String(error)}`,
+        );
+        return 1;
+      }
+    }
 
     const spec = {
       ...svc.resolveServicePaths(),

package/cli/dsh-managed-config.mjs

@@ -0,0 +1,407 @@
+import { spawnSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+
+export const DSH_BUNDLE = "@chorus-aidlc/chorus-dsh";
+export const DSH_PEERS = Object.freeze([
+  "@deepseek-ai/dsh-mcp-client",
+  "@deepseek-ai/dsh-skill-filesystem",
+  "@deepseek-ai/dsh-tool-skill",
+  "@deepseek-ai/dsh-persona",
+]);
+export const DSH_RC_VERSION = "0.1.0-rc.7";
+export const MANAGED_CONFIG_FILE = "cordis.yml";
+
+// dsh-base supplies the core plugins used by the external JSON-RPC composition.
+// Hoisted linking makes those transitive plugins visible from the config anchor.
+const RUNTIME_PACKAGES = Object.freeze({
+  "@deepseek-ai/dsh-base": DSH_RC_VERSION,
+  "@deepseek-ai/dsh-agent-spine-demo": DSH_RC_VERSION,
+  "@deepseek-ai/dsh-sdk-jsonrpc-server": DSH_RC_VERSION,
+  "@deepseek-ai/dsh-sdk-jsonrpc-demo": DSH_RC_VERSION,
+  "@deepseek-ai/dsh-invariants": DSH_RC_VERSION,
+  "@deepseek-ai/cordis": "4.0.1",
+});
+const REQUIRED_IMPORTS = Object.freeze([DSH_BUNDLE, ...DSH_PEERS]);
+const STATE_VERSION = 1;
+
+const CONFIG_HEAD = `# Generated by Chorus. Secrets are read from the child environment.
+# This file is managed; use CHORUS_DSH_CONFIG or DSH_CORDIS_CONFIG to override it.
+
+- id: sdk-jsonrpc-server
+  name: '@deepseek-ai/dsh-sdk-jsonrpc-server'
+  config:
+    maxTokensAsSuccess: true
+
+- id: llm-deepseek
+  name: '@deepseek-ai/dsh-llm-deepseek'
+  config:
+    thinking: enabled
+    reasoningEffort: max
+
+- id: subprocess
+  name: '@deepseek-ai/dsh-subprocess-local'
+
+- id: bash
+  name: '@deepseek-ai/dsh-bash-local'
+  config:
+    cwd: !!js process.env.DSH_CWD ?? process.cwd()
+    timeoutMs: 60000
+
+- id: agent-spine
+  name: '@deepseek-ai/dsh-agent-spine-demo'
+  config:
+    persona: !!js process.env.DSH_SYSTEM_PROMPT ?? 'You are a coding agent.'
+    workspaceContext: false
+    skills:
+      enabled: false
+    toolBash:
+      enableRunInBackground: false
+    toolJobs: false
+
+- id: sessions
+  name: '@deepseek-ai/dsh-session-persistence-jsonl'
+  config:
+    root: !!js process.env.DSH_SESSION_ROOT ?? './.sessions'
+    compression: zstd
+
+- id: session-checkpoints
+  name: '@deepseek-ai/dsh-session-checkpoint-policy'
+
+- id: subagent
+  name: '@deepseek-ai/dsh-subagent'
+
+- id: subagent-spawn-in-process
+  name: '@deepseek-ai/dsh-subagent-spawn-in-process'
+  config:
+    providerName: spawn
+
+- id: tool-subagent
+  name: '@deepseek-ai/dsh-tool-subagent'
+  config:
+    provider: spawn
+    toolName: subagent
+    enableRunInBackground: false
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+- id: fs-local
+  name: '@deepseek-ai/dsh-fs-local'
+  config:
+    cwd: !!js process.env.DSH_CWD ?? process.cwd()
+
+- id: fs-observation-policy
+  name: '@deepseek-ai/dsh-fs-observation-policy'
+
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: token-meter
+  name: '@deepseek-ai/dsh-token-meter'
+
+- id: compaction-basic
+  name: '@deepseek-ai/dsh-compaction-basic'
+  config:
+    thresholdRatio: 0.8
+    retainRatio: 0.16
+    maxTokens: 8192
+    compactionRetries: 1
+
+- id: chorus-dsh-lifecycle
+  name: __CHORUS_BUNDLE__
+
+- id: chorus-mcp
+  name: '@deepseek-ai/dsh-mcp-client'
+  inject: [chorusDshConfig]
+  config:
+    serverName: chorus
+    transport: streamable-http
+    url: !!js '\`\${chorusDshConfig.url}/api/mcp\`'
+    headers:
+      Authorization: !!js '\`Bearer \${chorusDshConfig.apiKey}\`'
+    failOnStartupError: false
+    reconnect:
+      enabled: true
+
+- id: skill
+  name: '@deepseek-ai/dsh-skill'
+
+- id: chorus-skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+  config:
+    providerName: chorus
+    includeDefaultRoots: false
+    customSkillDirs:
+      - !!js "process.getBuiltinModule('node:path').join(process.getBuiltinModule('node:path').dirname(process.getBuiltinModule('node:module').createRequire(baseUrl).resolve('@chorus-aidlc/chorus-dsh/package.json')), 'skills')"
+
+- id: chorus-persona
+  name: __CHORUS_PERSONA__
+  config:
+    plugin: '@deepseek-ai/dsh-persona'
+    text: |-
+      You are a Chorus PM and developer agent powered by {{model}}. Work from {{cwd}}.
+      Use the Chorus AI-DLC lifecycle and load the relevant Chorus skill before operating
+      a Chorus resource. Keep decisions, progress, acceptance evidence, and review verdicts
+      on the assigned resource. In a headless daemon turn, never wait for terminal input:
+      persist human decisions through Chorus, mention the requester, and end the turn.
+      Do not push, merge, publish, approve, verify, or cross a human-owned gate unless the
+      wake explicitly grants that authority.
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+`;
+
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function redactedErrorText(error, values = []) {
+  let text = errorText(error);
+  for (const value of values) {
+    if (typeof value === "string" && value) text = text.replaceAll(value, "[REDACTED]");
+  }
+  return text;
+}
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function packageSpecs({ bundleVersion, bundleSpec }) {
+  return {
+    [DSH_BUNDLE]: bundleSpec ?? bundleVersion,
+    ...Object.fromEntries(DSH_PEERS.map((name) => [name, DSH_RC_VERSION])),
+    ...RUNTIME_PACKAGES,
+  };
+}
+
+export function managedDshRoot(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir();
+  return join(home, ".chorus", "dsh");
+}
+
+export function renderManagedDshConfig(bundleEntry = DSH_BUNDLE) {
+  const quote = (value) => `'${String(value).replaceAll("'", "''")}'`;
+  const personaEntry =
+    bundleEntry === DSH_BUNDLE ? `${DSH_BUNDLE}/persona` : join(dirname(bundleEntry), "persona.mjs");
+  const skillDir =
+    bundleEntry === DSH_BUNDLE
+      ? `"process.getBuiltinModule('node:path').join(process.getBuiltinModule('node:path').dirname(process.getBuiltinModule('node:module').createRequire(baseUrl).resolve('@chorus-aidlc/chorus-dsh/package.json')), 'skills')"`
+      : quote(resolve(dirname(bundleEntry), "..", "skills"));
+  return CONFIG_HEAD
+    .replace("__CHORUS_BUNDLE__", quote(bundleEntry))
+    .replace("__CHORUS_PERSONA__", quote(personaEntry))
+    .replace(
+      `"process.getBuiltinModule('node:path').join(process.getBuiltinModule('node:path').dirname(process.getBuiltinModule('node:module').createRequire(baseUrl).resolve('@chorus-aidlc/chorus-dsh/package.json')), 'skills')"`,
+      skillDir,
+    );
+}
+
+function resolveInstalledBundleEntry(projectDir) {
+  const pkgPath = join(projectDir, "node_modules", "@chorus-aidlc", "chorus-dsh", "package.json");
+  const pkg = readJson(pkgPath);
+  if (!pkg) return null;
+  const exported = pkg.exports?.["."]?.default ?? pkg.main;
+  return typeof exported === "string" ? resolve(dirname(pkgPath), exported) : null;
+}
+
+export async function validateManagedDshImports(projectDir, opts = {}) {
+  const requireFromConfig = createRequire(join(projectDir, MANAGED_CONFIG_FILE));
+  const resolveImport = opts.resolveImport ?? ((name) => requireFromConfig.resolve(name));
+  const importModule = opts.importModule ?? ((entry) => import(pathToFileURL(entry).href));
+  const resolved = {};
+  let usedBundleFallback = false;
+
+  for (const name of REQUIRED_IMPORTS) {
+    try {
+      resolved[name] = resolveImport(name);
+    } catch (error) {
+      if (name !== DSH_BUNDLE) {
+        throw new Error(`dsh managed import resolution failed for ${name}: ${errorText(error)}`);
+      }
+      const fallback =
+        opts.resolveBundleEntry?.(projectDir) ?? resolveInstalledBundleEntry(projectDir);
+      if (!fallback || !existsSync(fallback)) {
+        throw new Error(`dsh managed bundle resolution failed: ${errorText(error)}`);
+      }
+      resolved[name] = fallback;
+      usedBundleFallback = true;
+    }
+  }
+
+  for (const [name, entry] of Object.entries(resolved)) {
+    try {
+      await importModule(entry);
+    } catch (error) {
+      throw new Error(`dsh managed import load failed for ${name}: ${errorText(error)}`);
+    }
+  }
+  return {
+    resolved,
+    bundleEntry: resolved[DSH_BUNDLE],
+    usedBundleFallback,
+  };
+}
+
+function runCommand(command, argv, opts) {
+  const platform = opts.platform ?? process.platform;
+  const isCmd = platform === "win32" && /\.(cmd|bat)$/i.test(command);
+  const executable = isCmd ? opts.env?.ComSpec || opts.env?.COMSPEC || "cmd.exe" : command;
+  const commandArgs = isCmd ? ["/d", "/s", "/c", command, ...argv] : argv;
+  const result = spawnSync(executable, commandArgs, {
+    cwd: opts.cwd,
+    env: opts.env,
+    encoding: "utf8",
+    shell: false,
+    timeout: opts.timeout,
+    input: opts.input,
+    windowsHide: true,
+  });
+  if (result.error || result.status !== 0) {
+    const detail = result.error?.message || result.stderr?.trim() || `exit ${result.status}`;
+    throw new Error(detail);
+  }
+  return result;
+}
+
+export function validateManagedDshComposition(configPath, opts = {}) {
+  const dshPath = opts.dshPath;
+  if (!dshPath) throw new Error("cannot validate dsh composition: dsh-jsonrpc-agent was not found");
+  const env = {
+    ...(opts.env ?? process.env),
+    CHORUS_DAEMON_HEADLESS: "1",
+    CHORUS_URL: opts.creds?.url ?? "http://127.0.0.1",
+    CHORUS_API_KEY: opts.creds?.apiKey ?? "cho_validation",
+    DSH_CORDIS_CONFIG: configPath,
+    DSH_CWD: dirname(configPath),
+  };
+  const request =
+    `${JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: { cwd: dirname(configPath), provider: "deepseek-official", model: "deepseek-v4-flash" } })}\n`;
+  const runner = opts.runCommand ?? runCommand;
+  const result = runner(dshPath, [], {
+    cwd: dirname(configPath),
+    env,
+    input: request,
+    timeout: opts.timeoutMs ?? 20_000,
+    platform: opts.platform,
+  });
+  if (!String(result.stdout ?? "").includes('"id":1')) {
+    throw new Error("dsh composition validation did not complete JSON-RPC initialization");
+  }
+}
+
+function activeState(root, pathExists = existsSync) {
+  const state = readJson(join(root, "active.json"));
+  if (
+    !state ||
+    state.version !== STATE_VERSION ||
+    typeof state.configPath !== "string" ||
+    typeof state.runtimePath !== "string"
+  ) return null;
+  return pathExists(state.configPath) && pathExists(state.runtimePath) ? state : null;
+}
+
+export async function prepareManagedDshConfig(opts = {}) {
+  const env = opts.env ?? process.env;
+  const root = opts.root ?? managedDshRoot(env);
+  const bundleVersion = opts.bundleVersion;
+  if (!bundleVersion) throw new Error("dsh managed preparation requires a Chorus bundle version");
+  const specs = packageSpecs({ bundleVersion, bundleSpec: opts.bundleSpec });
+  const fingerprint = createHash("sha256")
+    .update(JSON.stringify({ version: STATE_VERSION, specs }))
+    .digest("hex")
+    .slice(0, 16);
+  const current = activeState(root, opts.statePathExists ?? existsSync);
+
+  if (current?.fingerprint === fingerprint) {
+    await (opts.validateImports ?? validateManagedDshImports)(dirname(current.configPath), opts);
+    return { ...current, reused: true };
+  }
+
+  const releaseDir = join(root, "releases", `${fingerprint}-${randomUUID()}`);
+  const markerTmp = join(root, `.active-${randomUUID()}.json`);
+  mkdirSync(releaseDir, { recursive: true });
+  try {
+    writeFileSync(
+      join(releaseDir, "package.json"),
+      `${JSON.stringify({ private: true, type: "module", dependencies: specs }, null, 2)}\n`,
+      { mode: 0o600 },
+    );
+    writeFileSync(join(releaseDir, ".npmrc"), "node-linker=hoisted\n", { mode: 0o600 });
+
+    const install = opts.install ?? ((cwd) => runCommand(
+      opts.packageManager ?? (opts.platform === "win32" ? "pnpm.cmd" : "pnpm"),
+      ["install", "--prod", "--ignore-scripts", "--frozen-lockfile=false"],
+      { cwd, env, timeout: opts.installTimeoutMs ?? 120_000, platform: opts.platform },
+    ));
+    try {
+      install(releaseDir);
+    } catch (error) {
+      throw new Error(
+        `dsh managed package installation failed: ` +
+          redactedErrorText(error, [env.CHORUS_API_KEY, opts.creds?.apiKey]),
+      );
+    }
+
+    const importResult = await (opts.validateImports ?? validateManagedDshImports)(releaseDir, opts);
+    const bundleEntry = importResult.usedBundleFallback ? importResult.bundleEntry : DSH_BUNDLE;
+    const configPath = join(releaseDir, MANAGED_CONFIG_FILE);
+    const runtimePath = join(
+      releaseDir,
+      "node_modules",
+      ".bin",
+      opts.platform === "win32" ? "dsh-jsonrpc-agent.cmd" : "dsh-jsonrpc-agent",
+    );
+    if (!(opts.runtimeExists ?? existsSync)(runtimePath)) {
+      throw new Error(`dsh managed runtime was not installed at ${runtimePath}`);
+    }
+    writeFileSync(configPath, renderManagedDshConfig(bundleEntry), { mode: 0o600 });
+
+    try {
+      (opts.validateComposition ?? validateManagedDshComposition)(configPath, {
+        ...opts,
+        dshPath: runtimePath,
+      });
+    } catch (error) {
+      throw new Error(
+        `dsh managed composition validation failed: ` +
+          redactedErrorText(error, [env.CHORUS_API_KEY, opts.creds?.apiKey]),
+      );
+    }
+
+    const state = {
+      version: STATE_VERSION,
+      fingerprint,
+      configPath,
+      bundleEntry,
+      runtimePath,
+      validatedAt: new Date().toISOString(),
+    };
+    mkdirSync(root, { recursive: true });
+    writeFileSync(markerTmp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    renameSync(markerTmp, join(root, "active.json"));
+    return { ...state, reused: false };
+  } catch (error) {
+    rmSync(markerTmp, { force: true });
+    rmSync(releaseDir, { recursive: true, force: true });
+    throw error;
+  }
+}