@chorus-aidlc/chorus 0.16.3 → 0.16.4

package/cli/agent-backend-prompt.mjs

@@ -0,0 +1,93 @@
+// cli/agent-backend-prompt.mjs
+// Single source of truth for the interactive "which agent backend?" menu shared
+// by the daemon credential-capture entry points: `chorus login` (single-agent),
+// `chorus login --add` / `chorus daemon add`, and the `chorus install` "add
+// another agent" loop (see cli/login.mjs, cli/daemon-install-config.mjs).
+//
+// The same AGENT_MENU list also feeds resolveInstallAgent's daemon-level backend
+// prompt in daemon-install-config.mjs, so every surface advertises EXACTLY the
+// same backends and never drifts — re-advertising a backend (e.g. dsh) is a
+// one-line edit here that all prompts pick up.
+//
+// promptAgentBackend deliberately differs from resolveInstallAgent's inline menu
+// in ONE way: an empty / unrecognized answer returns `undefined` ("no explicit
+// choice") rather than DEFAULT_AGENT, so the add/login callers can OMIT the
+// backend field and let resolve-time inheritance apply (the daemon top-level
+// default). resolveInstallAgent must always produce a concrete daemon-level
+// backend, so it keeps its own empty→DEFAULT_AGENT behavior and does NOT use
+// this helper.
+//
+// Lives in its own module to avoid an import cycle: daemon-install-config.mjs
+// already imports appendAgentConfig from login.mjs, so the shared menu cannot
+// live in either of those files.
+
+import { KNOWN_AGENTS } from "./daemon-agent.mjs";
+
+/**
+ * The interactive agent-backend menu. Order mirrors KNOWN_AGENTS with claude-code
+ * first (it is the default). Kept as the single shared list so the numbered
+ * prompt and the accepted values never drift across entry points.
+ *
+ * NOTE: the dsh JSON-RPC daemon backend is temporarily de-advertised (offline).
+ * The code path (probeAgentCli/resolveDshPath, spawner-select, dsh-spawner) is
+ * kept dormant — re-add this menu entry to bring it back online. It remains
+ * reachable by name (e.g. `--agent dsh`, or typing "dsh" at the prompt).
+ */
+export const AGENT_MENU = [
+  { value: "claude-code", label: "Claude Code (default)" },
+  { value: "codex", label: "Codex CLI" },
+  { value: "kiro", label: "Kiro CLI" },
+];
+
+/** A non-empty trimmed string, or undefined. */
+function nonEmpty(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+/**
+ * Prompt the operator to pick an agent backend for the agent being configured,
+ * shared by the add / login / install-add flows.
+ *
+ * Returns the chosen backend value, or `undefined` when the operator makes no
+ * explicit choice — meaning "inherit the daemon default" (the caller then omits
+ * the `agentType` / top-level `agent` field). `undefined` is returned when:
+ *   - `isTTY` is false (non-interactive / piped) — returns immediately, prints
+ *     nothing, never blocks (mirrors resolveInstallAgent / resolveDaemonCwds);
+ *   - the answer is empty (Enter);
+ *   - the answer is an out-of-range number or is otherwise unrecognized.
+ *
+ * Accepts either a menu number (1..AGENT_MENU.length) or a KNOWN_AGENTS value
+ * typed by name (e.g. "codex", or "dsh" even though it is de-advertised).
+ *
+ * @param {{
+ *   ask: (query: string, opts?: object) => Promise<string>,
+ *   log?: (m: string) => void,
+ *   isTTY?: boolean,
+ * }} deps
+ * @returns {Promise<string|undefined>}
+ */
+export async function promptAgentBackend({ ask, log = () => {}, isTTY = false } = {}) {
+  // Non-TTY (piped / scripted) must never block on a menu — return immediately
+  // with no output. The caller falls back to --agent or inherits the default.
+  if (!isTTY || typeof ask !== "function") return undefined;
+
+  log("[Chorus] Which agent backend should this agent use?");
+  for (let i = 0; i < AGENT_MENU.length; i += 1) {
+    log(`[Chorus]   ${i + 1}) ${AGENT_MENU[i].label}`);
+  }
+  const answer = nonEmpty(
+    await ask(`Select [1-${AGENT_MENU.length}] (Enter to inherit the daemon default): `),
+  );
+  if (!answer) return undefined; // Enter → inherit default.
+
+  const n = Number(answer);
+  if (Number.isInteger(n) && n >= 1 && n <= AGENT_MENU.length) {
+    return AGENT_MENU[n - 1].value;
+  }
+  // A backend typed by name (muscle memory). KNOWN_AGENTS includes de-advertised
+  // backends (dsh), so a by-name pick can still reach them.
+  if (KNOWN_AGENTS.includes(answer)) return answer;
+
+  // Out-of-range / garbage → no explicit choice; the caller inherits the default.
+  return undefined;
+}

package/cli/client-args.mjs

@@ -14,10 +14,10 @@
 export const DAEMON_ACTIONS = new Set(["stop", "status", "restart", "logs", "install", "uninstall"]);
 
 /** Known agent backends, kept in sync with the authoritative list in
- * daemon-agent.mjs (`claude-code`, `codex`, `kiro` — all implemented). This copy
+ * daemon-agent.mjs (`claude-code`, `codex`, `kiro`, `dsh` — all implemented). This copy
  * is informational only: parsing here does not validate the value (the resolver
  * in daemon-agent.mjs is the single source of truth for validation). */
-export const KNOWN_AGENTS = new Set(["claude-code", "codex", "kiro"]);
+export const KNOWN_AGENTS = new Set(["claude-code", "codex", "kiro", "dsh"]);
 
 /**
  * Parse the client-subcommand flags out of an arg list. Recognizes the
@@ -126,7 +126,8 @@ OPTIONS
   --agent <type>           Local agent backend to wake         (env: CHORUS_AGENT)
                            (claude-code | codex | kiro; default: claude-code)
                            (Also configurable as "agent":"…" in ~/.chorus/daemon.json;
-                           'chorus daemon install' prompts for it interactively.)
+                           'chorus daemon install' and 'chorus login' (incl. --add)
+                           prompt for it interactively on a TTY.)
   --yolo                   Full autonomy for the woken agent   (env: CHORUS_YOLO=1)
                            (--dangerously-skip-permissions: Bash, file writes, any
                            command). This is the DEFAULT permission mode.
@@ -205,10 +206,15 @@ OPTIONS
   --api-key <cho_...>      Agent API key                       (env: CHORUS_API_KEY)
   --add                    Add this key as an ADDITIONAL agent (multi-agent daemon)
                            instead of overwriting the single credential
+  --agent <type>           Agent backend for THIS agent         (env: CHORUS_AGENT)
+                           (claude-code | codex | kiro). On a TTY, login (and
+                           --add) prompt for it when omitted; Enter inherits the
+                           daemon default (claude-code) and writes no backend.
   -h, --help               Show this help message
 
-  With no flags, login prompts interactively for the URL and a masked API key,
-  validates them against the server, and on success saves the credentials.
+  With no flags, login prompts interactively for the URL, a masked API key, and
+  (on a TTY) the agent backend, validates them against the server, and on success
+  saves the credentials.
 
   With --add, the validated key is appended to the daemon.json 'agents[]' array
   so one daemon can serve several independent agents (see docs/DAEMON.md). The

package/cli/daemon-agent.mjs

@@ -1,6 +1,6 @@
 // cli/daemon-agent.mjs
 // Pure resolution + validation of the daemon's `--agent <type>` selection.
-// `claude-code` (the default), `codex`, and `kiro` are all implemented backends
+// `claude-code` (the default), `codex`, `kiro`, and `dsh` are recognized backends
 // (add-daemon-codex-backend cashed in the reserved `codex` slot;
 // add-daemon-kiro-backend adds `kiro`). Resolving an unknown value is a hard
 // error (no silent fallback).
@@ -16,10 +16,9 @@
 import { readFileSync } from "node:fs";
 import { loginFilePath } from "./credentials.mjs";
 
-/** The agent backends the daemon recognizes. All are implemented (claude-code
- * via ClaudeSpawner, codex via CodexSpawner, kiro via KiroSpawner — see
- * spawner-select.mjs). */
-export const KNOWN_AGENTS = ["claude-code", "codex", "kiro"];
+/** The agent backends the daemon recognizes. Existing spawners cover claude-code,
+ * codex, and kiro; dsh registration is the base contract for its bridge. */
+export const KNOWN_AGENTS = ["claude-code", "codex", "kiro", "dsh"];
 
 /** The default agent backend when neither --agent nor CHORUS_AGENT is set. */
 export const DEFAULT_AGENT = "claude-code";
@@ -35,6 +34,7 @@ export const DEFAULT_AGENT = "claude-code";
 export function backendCli(agentType) {
   if (agentType === "codex") return { name: "codex", envVar: "CHORUS_CODEX_PATH" };
   if (agentType === "kiro") return { name: "kiro-cli", envVar: "CHORUS_KIRO_PATH" };
+  if (agentType === "dsh") return { name: "dsh-jsonrpc-agent", envVar: "CHORUS_DSH_PATH" };
   return { name: "claude", envVar: "CHORUS_CLAUDE_PATH" };
 }
 
@@ -49,6 +49,7 @@ export function backendCli(agentType) {
 export function backendClientType(agentType) {
   if (agentType === "codex") return "codex";
   if (agentType === "kiro") return "kiro";
+  if (agentType === "dsh") return "dsh";
   return "claude_code";
 }
 

package/cli/daemon-banner.mjs

@@ -19,7 +19,7 @@ import { backendCli } from "./daemon-agent.mjs";
  * @property {string} agentUuid        authenticated agent uuid.
  * @property {"yolo"|"chorus"} permissionMode
  * @property {string} credentialSource resolved credential source (flag/env/login-file/…).
- * @property {string} agentType        local agent backend (claude-code | codex) — drives the CLI row label.
+ * @property {string} agentType        local agent backend (claude-code | codex | kiro | dsh) — drives the CLI row label.
  * @property {string|null} cliPath     resolved path of the SELECTED backend's CLI, or null when not found.
  * @property {string} [connection]     connection state line (default "connecting…").
  * @property {string} [configPath]     absolute path to the daemon.json the CLI reads.
@@ -42,8 +42,8 @@ export function bannerRows(info) {
     info.permissionMode === "yolo"
       ? "YOLO ⚠  (full autonomy — Bash/write/any command)"
       : "chorus-only (Chorus MCP tools only)";
-  // The CLI row names the SELECTED backend (claude-code → "claude", codex →
-  // "codex") so a `--agent codex` run never mislabels itself as claude.
+  // The CLI row names the selected backend so non-Claude runs are never
+  // mislabeled and their own executable override is actionable.
   const cli = backendCli(info.agentType);
   const cliValue = info.cliPath
     ? `found: ${info.cliPath}`

package/cli/daemon-config.mjs

@@ -306,7 +306,7 @@ function positiveInt(value) {
  * @typedef {Object} AgentConfig  One fully-resolved agent runtime config.
  * @property {string} url                       Chorus server URL for this agent.
  * @property {string} apiKey                    This agent's `cho_` API key.
- * @property {string} agentType                 Backend: claude-code | codex | kiro.
+ * @property {string} agentType                 Backend: claude-code | codex | kiro | dsh.
  * @property {Array<string|undefined>} cwds     Served paths (`undefined` ⇒ process cwd).
  * @property {"yolo"|"chorus"} permissionMode   Woken-agent permission posture.
  * @property {number} maxConcurrency            This agent's wake-queue cap.

package/cli/daemon-install-config.mjs

@@ -27,9 +27,11 @@ import { updateDaemonConfig, appendAgentConfig, prompt as defaultPrompt } from "
 import { validateAndFetchIdentity } from "./chorus-client.mjs";
 import { normalizeCwd, cleanCwdList } from "./daemon-config.mjs";
 import { KNOWN_AGENTS, DEFAULT_AGENT } from "./daemon-agent.mjs";
+import { AGENT_MENU, promptAgentBackend } from "./agent-backend-prompt.mjs";
 import { agentNotFoundWarningLine } from "./daemon-banner.mjs";
 import { resolveClaudePath } from "./claude-spawner.mjs";
 import { resolveCodexPath } from "./codex-spawner.mjs";
+import { resolveDshPath } from "./dsh-spawner.mjs";
 import { resolveKiroPath } from "./kiro-spawner.mjs";
 import { readFileSync } from "node:fs";
 
@@ -160,12 +162,20 @@ export async function resolveInstallCredentials(flags = {}, env = {}, opts = {})
         );
         continue;
       }
-      const res = appendAgent({ url: u, apiKey: k, agentUuid: id.uuid, agentName: id.name });
+      // Which backend for this agent? Explicit --agent wins; otherwise the menu
+      // (we're already on a TTY here). undefined → omit agentType so the entry
+      // inherits the daemon default at resolve time (never a literal claude-code).
+      let at = nonEmpty(flags.agent);
+      if (!at) at = await promptAgentBackend({ ask, log, isTTY });
+      const agentObj = { url: u, apiKey: k, agentUuid: id.uuid, agentName: id.name };
+      if (at) agentObj.agentType = at;
+      const res = appendAgent(agentObj);
       if (!res.ok) {
         errLog(`[Chorus] agent ${id.name} (${id.uuid}) is already configured — skipping.`);
         continue;
       }
-      log(`[Chorus] added agent ${id.name} (${id.uuid}) — this daemon now serves ${res.agents.length} agents.`);
+      const backendNote = at ? ` (backend: ${at})` : "";
+      log(`[Chorus] added agent ${id.name} (${id.uuid})${backendNote} — this daemon now serves ${res.agents.length} agents.`);
     }
   }
 
@@ -242,7 +252,6 @@ export async function resolveInstallCwds(flags = {}, opts = {}) {
   const first = nonEmpty(await ask(`Working directory [${defaultCwd}] (Enter to accept the default): `));
   collected.push(first ?? defaultCwd);
   // subsequent adds
-  // eslint-disable-next-line no-constant-condition
   while (true) {
     const next = nonEmpty(await ask("Add another working directory (blank to finish): "));
     if (!next) break;
@@ -280,25 +289,23 @@ export async function resolveInstallBrowseRoots(flags = {}, opts = {}) {
   return { browseRoots };
 }
 
-/**
- * The interactive agent-backend menu. Order mirrors KNOWN_AGENTS with claude-code
- * first (it is the default). Kept beside the resolver so the numbered prompt and
- * the accepted values never drift.
- */
-const AGENT_MENU = [
-  { value: "claude-code", label: "Claude Code (default)" },
-  { value: "codex", label: "Codex CLI" },
-  { value: "kiro", label: "Kiro CLI" },
-];
+// The interactive agent-backend menu (`AGENT_MENU`) now lives in
+// ./agent-backend-prompt.mjs as the single source of truth shared with the
+// add/login flows (imported above), so every backend prompt advertises the same
+// list and never drifts. resolveInstallAgent keeps its own inline menu render
+// below (its empty→DEFAULT_AGENT semantics differ from promptAgentBackend's
+// empty→undefined) but reads the same AGENT_MENU rows.
 
 /** Probe the selected backend's CLI on PATH. Returns the resolved path or null.
  * Injectable per backend so the check is testable without a real PATH. */
 function probeAgentCli(agent, probes = {}) {
   const findClaude = probes.resolveClaudePath ?? resolveClaudePath;
   const findCodex = probes.resolveCodexPath ?? resolveCodexPath;
+  const findDsh = probes.resolveDshPath ?? resolveDshPath;
   const findKiro = probes.resolveKiroPath ?? resolveKiroPath;
   if (agent === "codex") return findCodex();
   if (agent === "kiro") return findKiro();
+  if (agent === "dsh") return findDsh();
   return findClaude();
 }
 
@@ -331,7 +338,7 @@ function probeAgentCli(agent, probes = {}) {
  *   loginPath?: string,
  *   writeConfig?: (partial: Record<string, unknown>) => string,
  *   prompt?: typeof defaultPrompt,
- *   probes?: { resolveClaudePath?: Function, resolveCodexPath?: Function, resolveKiroPath?: Function },
+ *   probes?: { resolveClaudePath?: Function, resolveCodexPath?: Function, resolveKiroPath?: Function, resolveDshPath?: Function },
  *   log?: (m: string) => void,
  *   errLog?: (m: string) => void,
  * }} [opts]

package/cli/daemon-rest-client.mjs

@@ -4,10 +4,12 @@
 // the existing server endpoints accept, so the two daemon hosts — the chorus CLI daemon
 // (`cli/daemon.mjs`) and the OpenClaw plugin — cannot drift in the wire contract.
 //
-// The five operations and their EXACT server payload shapes (verified against
-// src/app/api/daemon/*/route.ts — the server is NOT changed by this work):
+// The operations and payload fields this client supports (verified against
+// src/app/api/daemon/*/route.ts):
 //   turnAdvance      → POST /api/daemon/turn-advance
-//                      { connectionUuid, sessionId, status, entityType?, entityUuid?,
+//                      { connectionUuid, sessionId, status, turnUuid?,
+//                        backendSessionId?, entityType?, entityUuid?,
+//                        interruptedReason?, transcriptRelayError?, usage?,
 //                        coalescedCount? }
 //   transcript       → POST /api/daemon/transcript
 //                      { sessionId, messages: [{ role, text }] }
@@ -71,7 +73,7 @@ const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
  *   logger?: { info(m:string):void, warn(m:string):void, error(m:string):void },
  * }} opts
  * @returns {{
- *   turnAdvance: (p: { sessionId: string, backendSessionId?: string|null, status: string, entityType?: string|null, entityUuid?: string|null, coalescedCount?: number }) => Promise<DaemonRestResult>,
+ *   turnAdvance: (p: { sessionId: string, turnUuid?: string|null, backendSessionId?: string|null, status: string, entityType?: string|null, entityUuid?: string|null, coalescedCount?: number }) => Promise<DaemonRestResult>,
  *   transcript: (p: { sessionId: string, messages: Array<{ role: string, text: string }> }) => Promise<DaemonRestResult>,
  *   executionState: (p: { executions: Array<Record<string, unknown>> }) => Promise<DaemonRestResult>,
  *   reportInterrupt: (p: { entityType: string, entityUuid: string, reason: string }) => Promise<DaemonRestResult>,
@@ -111,7 +113,7 @@ export function createDaemonRestClient(opts) {
    *                         established op-prefixed message.
    * @returns {Promise<DaemonRestResult>}
    */
-  async function post(op, path, body, successLog, context = "") {
+  async function post(op, path, body, successLog, context = "", readData = false) {
     let response;
     try {
       response = await fetchImpl(`${url}${path}`, {
@@ -131,8 +133,19 @@ export function createDaemonRestClient(opts) {
       logger.warn(`[Chorus] ${error}`);
       return { ok: false, status: response.status, error };
     }
+    let data;
+    if (readData) {
+      try {
+        const parsed = await response.json();
+        data = parsed && typeof parsed === "object" ? parsed.data : undefined;
+      } catch (err) {
+        // Mixed-version fallback: older servers may return an empty successful body.
+        // Keep the lifecycle report successful, but make the missing correlation visible.
+        logger.warn(`[Chorus] ${op} response correlation unavailable: ${err}`);
+      }
+    }
     if (successLog) logger.info(`[Chorus] ${successLog}`);
-    return { ok: true, status: response.status };
+    return { ok: true, status: response.status, ...(data !== undefined ? { data } : {}) };
   }
 
   return {
@@ -148,7 +161,7 @@ export function createDaemonRestClient(opts) {
      * the turn's usage. Both ride the terminal edge only. Requires the connectionUuid (the
      * server addresses the turn against a connection the agent owns).
      */
-    async turnAdvance({ sessionId, status, entityType, entityUuid, interruptedReason, transcriptRelayError, usage, backendSessionId, coalescedCount }) {
+    async turnAdvance({ sessionId, turnUuid, status, entityType, entityUuid, interruptedReason, transcriptRelayError, usage, backendSessionId, coalescedCount }) {
       const connectionUuid = getConnectionUuid();
       if (!connectionUuid) {
         const error = `cannot advance turn for session ${sessionId} → ${status} — no connection uuid yet`;
@@ -164,6 +177,7 @@ export function createDaemonRestClient(opts) {
         connectionUuid,
         sessionId,
         status,
+        ...(turnUuid ? { turnUuid } : {}),
         // Only sent when BOTH are present, so the server never gets a partial linkage.
         ...(entityType && entityUuid ? { entityType, entityUuid } : {}),
         // Only meaningful alongside status=interrupted; never sent otherwise.
@@ -182,12 +196,21 @@ export function createDaemonRestClient(opts) {
           ? { coalescedCount }
           : {}),
       };
-      return post(
+      const result = await post(
         "turn-advance",
         "/api/daemon/turn-advance",
         body,
         `advanced turn for session ${sessionId} → ${status}`,
+        "",
+        status === "running",
       );
+      const resolvedTurnUuid =
+        typeof result.data?.turn?.uuid === "string" ? result.data.turn.uuid : null;
+      if (status !== "running") return result;
+      const { data: _rawData, ...baseResult } = result;
+      return resolvedTurnUuid
+        ? { ...baseResult, data: { turnUuid: resolvedTurnUuid } }
+        : baseResult;
     },
 
     /**

package/cli/daemon.mjs

@@ -41,6 +41,8 @@ import { Waker } from "./waker.mjs";
 import { LineageResolver } from "./lineage.mjs";
 import { resolveClaudePath } from "./claude-spawner.mjs";
 import { resolveCodexPath } from "./codex-spawner.mjs";
+import { resolveDshPath } from "./dsh-spawner.mjs";
+import { prepareManagedDshConfig } from "./dsh-managed-config.mjs";
 import { resolveKiroPath } from "./kiro-spawner.mjs";
 import { selectSpawner } from "./spawner-select.mjs";
 import {
@@ -152,7 +154,13 @@ export function buildDaemon(creds, deps = {}) {
   // (construction byte-identical to before); codex → CodexSpawner. `creds` are
   // passed through so the Codex backend can export the daemon key into the woken
   // process env (the Claude backend ignores creds — it gets its key via --mcp-config).
-  const spawner = deps.spawner ?? selectSpawner(agentType, { logger, permissionMode, creds });
+  const spawner = deps.spawner ?? selectSpawner(agentType, {
+    logger,
+    permissionMode,
+    creds,
+    bundleVersion: deps.bundleVersion,
+    prepareManagedConfigFn: deps.prepareManagedDshConfig,
+  });
   const maxConcurrency = deps.maxConcurrency ?? 4;
 
   // ===== Multi-path: the SET of cwds this daemon serves (T3 — FR-5) =====
@@ -742,6 +750,7 @@ export async function runDaemon(flags = {}, deps = {}) {
   // banner shows the right binary instead of always probing for `claude`.
   const findClaude = deps.resolveClaudePath ?? resolveClaudePath;
   const findCodex = deps.resolveCodexPath ?? resolveCodexPath;
+  const findDsh = deps.resolveDshPath ?? resolveDshPath;
   const findKiro = deps.resolveKiroPath ?? resolveKiroPath;
   const verbose = flags.verbose === true || env.CHORUS_VERBOSE === "1";
 
@@ -786,6 +795,9 @@ export async function runDaemon(flags = {}, deps = {}) {
     writeConfig: deps.writeConfig,
     readJson: deps.readJson,
     loginPath: deps.loginPath,
+    prepareManagedDshConfig: deps.prepareManagedDshConfig,
+    bundleVersion: version,
+    resolveDshPath: findDsh,
   };
 
   const action = flags.action ?? "run";
@@ -884,6 +896,8 @@ export async function runDaemon(flags = {}, deps = {}) {
       mcpClient: deps.mcpClient,
       lineage: deps.lineage,
       build: deps.build,
+      bundleVersion: version,
+      prepareManagedDshConfig: deps.prepareManagedDshConfig,
     });
 
     const shutdownMulti = () => {
@@ -924,11 +938,16 @@ export async function runDaemon(flags = {}, deps = {}) {
   // Detect the SELECTED backend's executable (non-fatal): the daemon still
   // subscribes when it's missing; a wake surfaces the error visibly when one
   // arrives. The resolved path (or absence) is shown in the banner below. Each
-  // backend probes its own binary — codex → resolveCodexPath, kiro →
-  // resolveKiroPath, otherwise resolveClaudePath — so a `--agent kiro` run probes
-  // (and the banner reports) `kiro-cli`, not `claude`.
+  // backend probes its own binary, including dsh-jsonrpc-agent for dsh, so the
+  // startup banner and warning report the selected runtime rather than Claude.
   const cliPath =
-    agentType === "codex" ? findCodex() : agentType === "kiro" ? findKiro() : findClaude();
+    agentType === "codex"
+      ? findCodex()
+      : agentType === "kiro"
+        ? findKiro()
+        : agentType === "dsh"
+          ? findDsh()
+          : findClaude();
 
   // The daemon.json the layered config readers (credentials, sigint timeout, cwds)
   // consult. Surfacing its absolute path + presence in the banner makes it obvious
@@ -987,6 +1006,8 @@ export async function runDaemon(flags = {}, deps = {}) {
     sigintTimeoutMs,
     cwds,
     browseRoots,
+    bundleVersion: version,
+    prepareManagedDshConfig: deps.prepareManagedDshConfig,
   });
 
   // Graceful shutdown on signals.
@@ -1171,7 +1192,7 @@ export async function handleLifecycleAction(action, { log, errLog, lifecycle, se
     // CHORUS_AGENT env / a prior stored choice; probes the selected CLI and warns
     // (non-fatal) when it is missing. An unknown --agent was already rejected by
     // resolveAgentType above, so this phase never fails.
-    await installCfg.resolveInstallAgent(flags, env, {
+    const installAgent = await installCfg.resolveInstallAgent(flags, env, {
       isTTY,
       skip,
       writeConfig: pfDeps?.writeConfig ?? updateDaemonConfig,
@@ -1181,6 +1202,26 @@ export async function handleLifecycleAction(action, { log, errLog, lifecycle, se
       log,
       errLog,
     });
+    if (
+      installAgent.agent === "dsh" &&
+      !String(env.CHORUS_DSH_CONFIG ?? "").trim() &&
+      !String(env.DSH_CORDIS_CONFIG ?? "").trim()
+    ) {
+      try {
+        await (pfDeps?.prepareManagedDshConfig ?? prepareManagedDshConfig)({
+          env,
+          bundleVersion: pfDeps?.bundleVersion,
+          dshPath: installAgent.cliPath ?? pfDeps?.resolveDshPath?.(),
+          creds: credResult.creds,
+        });
+      } catch (error) {
+        errLog(
+          `[Chorus] install aborted — dsh managed composition preparation failed: ` +
+            `${error instanceof Error ? error.message : String(error)}`,
+        );
+        return 1;
+      }
+    }
 
     const spec = {
       ...svc.resolveServicePaths(),