@patwoodman/dsh-sdlc-flow 0.4.0-beta.19 → 0.4.0-beta.21

package/cordis.patch.yml

@@ -22,10 +22,11 @@
 #
 # Order matters only where a row waits on a service: services first, then the
 # tools and preset rows that use them, then the UI. The
-# `agent-preset-registry` row stays FIRST inside the presets block (the dialect
-# has no insert-if-missing), so on the web template the composed lead holds two
-# same-id registry rows at one service — the loader accepts both and every
-# preset activates (verified live); M0-02 pins those counts.
+# `agent-preset-registry` row stays FIRST inside the presets member block
+# (headless/sdk, the dialect has no insert-if-missing). This generated lead
+# patch replaces that insert with an id-targeted override of the web template's
+# shipped row: a duplicate id+name is loader-accepted but blocks plugin-manager
+# uninstall. M0-02 pins one registry row whose default is sdlc-lead.
 
 # ── the meta-bundle's own row ────────────────────────────────────────────────
 # A row that executes this package's apply() at boot, so the meta-bundle is a
@@ -82,11 +83,16 @@
         worktreePath: !!js process.cwd()
 
 # ── from @patwoodman/dsh-sdlc-flow-presets — the 26 role presets (C.3)
+# The web template ships agent-preset-registry. Override its default instead
+# of inserting a duplicate row: a duplicate id+name is loader-accepted but
+# blocks plugin-manager uninstall as "bundle-in-use". The presets member keeps
+# the insert for headless/sdk templates, which have no registry row.
+- id: agent-preset-registry
+  name: '@deepseek-ai/dsh-agent-preset-registry'
+  config:
+    default: sdlc-lead
+
 - insert:
-    - id: agent-preset-registry
-      name: "@deepseek-ai/dsh-agent-preset-registry"
-      config:
-        default: sdlc-lead
     - id: preset-sdlc-lead
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -106,14 +112,20 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: true
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
           - id: tool-subagent
             name: "@deepseek-ai/dsh-tool-subagent"
+            config:
+              provider: spawn
+              toolName: subagent
+              backgroundMode: continuable
           - id: sdlc-dispatch
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-dispatch"
           - id: sdlc-plan
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-plan"
     - id: preset-sdlc-business-analyst
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -133,8 +145,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-requirements-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -154,8 +168,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-product-owner
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -175,8 +191,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-solution-architect
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -196,8 +214,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-security-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -217,8 +237,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-data-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -238,8 +260,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-database-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -259,8 +283,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-ux-designer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -280,8 +306,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-ui-designer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -301,8 +329,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-accessibility-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -322,8 +352,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-frontend-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -343,8 +375,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-backend-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -364,8 +398,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-api-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -385,8 +421,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-integration-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -406,8 +444,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-devops-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -427,8 +467,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-platform-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -448,8 +490,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-qa-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -469,8 +513,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-test-automation-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -490,8 +536,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-e2e-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -511,8 +559,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-visual-qa-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -532,8 +582,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-performance-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -553,8 +605,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-technical-writer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -574,8 +628,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-release-manager
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -595,8 +651,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-code-reviewer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -616,8 +674,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-sre-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -637,8 +697,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: sdlc-presets
       name: "@patwoodman/dsh-sdlc-flow/presets-plugin"
       config: {}

package/lib/install-lib.mjs

@@ -0,0 +1,56 @@
+/**
+ * packages/sdlc-orchestrator/src/install-lib.mjs — pure text helpers for the
+ * registry installer. Kept separate from `install.mjs` so tests can import it
+ * without running the CLI.
+ */
+
+/**
+ * Normalize `minimumReleaseAgeExclude` in a pnpm-workspace.yaml body and add
+ * exact-version entries for the suite.
+ *
+ * pnpm accepts ONE `name@version` pattern per list item. A value such as
+ * `@patwoodman/dsh-sdlc-flow@0.4.0-beta.19 || 0.4.0-beta.20` (written by an
+ * earlier install path) is not a valid pattern, so pnpm ignores the exemption
+ * and a fresh beta silently resolves to the previous one. This splits such
+ * entries into valid items, carries the package name onto a bare version, adds
+ * the requested specs, deduplicates, sorts, and leaves every other setting in
+ * the file untouched.
+ *
+ * @param {string} text - existing pnpm-workspace.yaml (may be empty).
+ * @param {string[]} specs - exact `name@version` patterns to add.
+ * @returns {string} the rewritten YAML body with a trailing newline.
+ */
+export function normalizeReleaseAgeExcludes(text, specs) {
+  const lines = String(text ?? '').split('\n');
+  const start = lines.findIndex((line) => /^minimumReleaseAgeExclude:\s*$/.test(line));
+  const wanted = [];
+  if (start >= 0) {
+    let end = start + 1;
+    while (end < lines.length && (/^\s*-\s+/.test(lines[end]) || lines[end].trim() === '')) end += 1;
+    for (const line of lines.slice(start + 1, end)) {
+      const raw = line.replace(/^\s*-\s+/, '').trim();
+      if (!raw) continue;
+      const value = raw.replace(/^['"]|['"]$/g, '');
+      let packageName = null;
+      for (const part of value.split(/\s*\|\|\s*/)) {
+        const trimmed = part.trim();
+        if (!trimmed) continue;
+        const named = /^((?:@[^/]+\/)?[^@]+)@(.+)$/.exec(trimmed);
+        if (named) {
+          packageName = named[1];
+          wanted.push(trimmed);
+        } else if (packageName && /^[0-9]/.test(trimmed)) {
+          wanted.push(`${packageName}@${trimmed}`);
+        } else {
+          wanted.push(trimmed);
+        }
+      }
+    }
+    lines.splice(start, end - start);
+  }
+  wanted.push(...specs);
+  const unique = [...new Set(wanted.filter(Boolean))].sort();
+  lines.push('minimumReleaseAgeExclude:');
+  for (const spec of unique) lines.push(`  - '${spec}'`);
+  return `${lines.join('\n').replace(/\n+$/, '')}\n`;
+}

package/lib/install.mjs

@@ -0,0 +1,274 @@
+#!/usr/bin/env node
+/**
+ * packages/sdlc-orchestrator/src/install.mjs — registry installer/updater.
+ *
+ * The Desktop Add-plugin field and `dsh plugin add` both go through pnpm, and
+ * pnpm 11 applies a 24-hour `minimumReleaseAge` to `latest`/range requests. A
+ * beta published minutes ago therefore resolves to the PREVIOUS beta — exactly
+ * how beta.19 (broken presets) kept installing while beta.20 was already
+ * `latest`. This command is the reliable path:
+ *
+ *   1. resolve `latest` (or `beta`) from the npm registry itself;
+ *   2. pin the EXACT version in the profile and add the matching
+ *      `minimumReleaseAgeExclude` entry (pnpm's documented escape hatch);
+ *   3. create the profile from its shipped template when it is missing;
+ *   4. install with `dsh plugin add <name>@<exact>`;
+ *   5. re-add the bundle to `dsh.profile.bundles` (a failed uninstall can
+ *      leave a package installed but disabled) and verify the installed
+ *      package.json version.
+ *
+ * Run it without cloning:
+ *
+ *   npx -y @patwoodman/dsh-sdlc-flow@latest dsh-sdlc-install
+ *   npx -y @patwoodman/dsh-sdlc-flow@latest dsh-sdlc-install --only all
+ *
+ * Flags: --only lead|worker|probe|all (default lead), --tag latest|beta,
+ *        --version <exact>, --dsh-home <dir>, --dry-run, --json, --help.
+ *
+ * Node built-ins only: this file is shipped in the published package and must
+ * run before any dependency is installed.
+ */
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import { PACKAGE, BUNDLES } from './index.js';
+import { normalizeReleaseAgeExcludes } from './install-lib.mjs';
+
+const REGISTRY = process.env.npm_config_registry || 'https://registry.npmjs.org';
+const META = PACKAGE;
+const CORE = BUNDLES.find((name) => name.endsWith('-core'));
+const TOOLS = BUNDLES.find((name) => name.endsWith('-tools'));
+const PRESETS = BUNDLES.find((name) => name.endsWith('-presets'));
+const UI = BUNDLES.find((name) => name.endsWith('-ui'));
+const GUARD = BUNDLES.find((name) => name.endsWith('-guard')) ?? `${META}-guard`;
+
+const argv = process.argv.slice(2);
+const has = (name) => argv.includes(name);
+const flag = (name, fallback) => (has(name) ? argv[argv.indexOf(name) + 1] : fallback);
+
+const ONLY = flag('--only', 'lead');
+const TAG = flag('--tag', 'latest');
+const EXACT = flag('--version', null);
+const DSH_HOME = flag('--dsh-home', process.env.DSH_HOME || join(homedir(), '.dsh'));
+const DRY_RUN = has('--dry-run');
+const JSON_OUT = has('--json');
+
+if (has('--help') || has('-h')) {
+  process.stdout.write(`Usage: dsh-sdlc-install [options]
+
+Install the latest published DSH SDLC Flow bundle into a DSH profile.
+
+  --only lead|worker|probe|all  which profile(s) to install (default: lead)
+  --tag latest|beta             registry dist-tag to resolve (default: latest)
+  --version <exact>             pin an exact version instead of a tag
+  --dsh-home <dir>              DSH home (default: $DSH_HOME or ~/.dsh)
+  --dry-run                     print the commands without changing anything
+  --json                        machine-readable result
+  -h, --help                    this help
+
+Examples:
+  npx -y @patwoodman/dsh-sdlc-flow@latest dsh-sdlc-install
+  npx -y @patwoodman/dsh-sdlc-flow@latest dsh-sdlc-install --only all
+  npx -y @patwoodman/dsh-sdlc-flow@latest dsh-sdlc-install --version 0.4.0-beta.21
+`);
+  process.exit(0);
+}
+
+const VALID_ONLY = new Set(['lead', 'worker', 'probe', 'all']);
+if (!VALID_ONLY.has(ONLY)) {
+  process.stderr.write(`dsh-sdlc-install: --only must be one of ${[...VALID_ONLY].join(', ')}\n`);
+  process.exit(2);
+}
+if (!['latest', 'beta'].includes(TAG) && EXACT === null) {
+  process.stderr.write('dsh-sdlc-install: --tag must be latest or beta\n');
+  process.exit(2);
+}
+
+const steps = [];
+function record(step, detail = '') {
+  steps.push({ step, detail });
+  if (!JSON_OUT) process.stdout.write(`  [ok]      ${step}${detail ? ` — ${detail}` : ''}\n`);
+}
+function warn(message) {
+  steps.push({ step: message, warning: true });
+  if (!JSON_OUT) process.stdout.write(`  [warn]    ${message}\n`);
+}
+
+function run(command, args, { cwd, timeoutMs = 900_000 } = {}) {
+  if (DRY_RUN) {
+    record(`exec ${command} ${args.join(' ')}`);
+    return { status: 0, stdout: '', stderr: '' };
+  }
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    timeout: timeoutMs,
+    env: { ...process.env, DSH_HOME },
+  });
+  return {
+    status: result.status ?? 1,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+  };
+}
+
+function mustRun(command, args, context) {
+  const result = run(command, args);
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || '').trim().slice(-1_500);
+    throw new Error(`${context}: \`${command} ${args.join(' ')}\` exited ${result.status}${detail ? `\n${detail}` : ''}`);
+  }
+  return result;
+}
+
+async function resolveVersion() {
+  if (EXACT !== null) return { version: EXACT, source: '--version' };
+  const url = `${REGISTRY.replace(/\/+$/, '')}/${META.replace('/', '%2F')}`;
+  let response;
+  try {
+    response = await fetch(url, { signal: AbortSignal.timeout(20_000) });
+  } catch (error) {
+    throw new Error(`cannot reach the npm registry at ${REGISTRY}: ${error.message}\nPin a version with --version <exact> or check your network.`);
+  }
+  if (!response.ok) throw new Error(`registry returned HTTP ${response.status} for ${META}`);
+  const packument = await response.json();
+  const version = packument?.['dist-tags']?.[TAG];
+  if (typeof version !== 'string') {
+    throw new Error(`registry has no ${TAG} dist-tag for ${META} (tags: ${Object.keys(packument?.['dist-tags'] ?? {}).join(', ')})`);
+  }
+  return { version, source: TAG };
+}
+
+const profileDir = (name) => join(DSH_HOME, 'profiles', name);
+
+/** Create a profile from its shipped template when absent. */
+function ensureProfile(name, template) {
+  const dir = profileDir(name);
+  if (existsSync(join(dir, 'package.json'))) {
+    record(`profile ${name} already exists`);
+    return;
+  }
+  mustRun('dsh', ['--profile', name, '--from-default-profile', template, '--dump-config'], `create profile ${name}`);
+  record(`created profile ${name} from the ${template} template`);
+}
+
+/**
+ * Add exact-version `minimumReleaseAgeExclude` entries, normalizing the
+ * malformed `pkg@a || pkg@b` form (pnpm does not understand it) into separate
+ * list items. This is the difference between installing the fresh beta and
+ * silently resolving the previous one.
+ */
+function ensureReleaseAgeExcludes(name, specs) {
+  const file = join(profileDir(name), 'pnpm-workspace.yaml');
+  const text = existsSync(file) ? readFileSync(file, 'utf8') : 'packages:\n  - .\n';
+  const next = normalizeReleaseAgeExcludes(text, specs);
+  if (DRY_RUN) {
+    record(`would set minimumReleaseAgeExclude (${specs.join(', ')})`);
+    return;
+  }
+  writeFileSync(file, next);
+  record('pinned pnpm release-age exemptions', specs.join(', '));
+}
+
+/** Ensure the bundle is selected even if an earlier failed uninstall removed it. */
+function ensureBundles(name, bundles) {
+  const file = join(profileDir(name), 'package.json');
+  if (DRY_RUN) {
+    record(`would select bundles ${bundles.join(', ')}`);
+    return;
+  }
+  const manifest = JSON.parse(readFileSync(file, 'utf8'));
+  manifest.dsh ??= {};
+  manifest.dsh.profile ??= {};
+  const current = Array.isArray(manifest.dsh.profile.bundles) ? manifest.dsh.profile.bundles : [];
+  const missing = bundles.filter((bundle) => !current.includes(bundle));
+  if (missing.length === 0) {
+    record(`profile ${name} already selects ${bundles.length} bundle(s)`);
+    return;
+  }
+  manifest.dsh.profile.bundles = [...current, ...missing];
+  writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`);
+  record(`selected bundle(s) in ${name}`, missing.join(', '));
+}
+
+function installedVersion(name, pkgName) {
+  const manifest = join(profileDir(name), 'node_modules', ...pkgName.split('/'), 'package.json');
+  if (!existsSync(manifest)) return null;
+  try {
+    return JSON.parse(readFileSync(manifest, 'utf8')).version;
+  } catch {
+    return null;
+  }
+}
+
+const PLANS = {
+  lead: { profile: 'sdlc-web', template: 'web', packages: [META], bundles: [META] },
+  worker: { profile: 'sdlc-worker', template: 'headless', packages: [GUARD, TOOLS], bundles: [GUARD, TOOLS] },
+  probe: { profile: 'sdlc-probe', template: 'sdk', packages: [CORE, TOOLS, PRESETS, GUARD], bundles: [CORE, TOOLS, PRESETS, GUARD] },
+};
+
+function planFor(only) {
+  return only === 'all' ? ['lead', 'worker', 'probe'] : [only];
+}
+
+async function main() {
+  if (!JSON_OUT) {
+    process.stdout.write(`\nDSH SDLC Flow — registry install${DRY_RUN ? ' (dry run)' : ''}\n`);
+    process.stdout.write('================================================\n\n');
+    process.stdout.write(`  DSH_HOME : ${DSH_HOME}\n`);
+  }
+
+  const { version, source } = await resolveVersion();
+  record(`resolved ${META}@${version}`, `from ${source}`);
+
+  const dsh = DRY_RUN ? { status: 0, stdout: '' } : run('dsh', ['--version']);
+  if (!DRY_RUN && dsh.status !== 0) {
+    throw new Error('dsh is not on PATH. Install it first: npm install -g @deepseek-ai/dsh@0.2.1-alpha.2 (or any 0.2.x).');
+  }
+  record('dsh CLI available', DRY_RUN ? '(dry run)' : dsh.stdout.trim());
+
+  for (const only of planFor(ONLY)) {
+    const plan = PLANS[only];
+    if (!plan || plan.packages.some((pkg) => pkg === undefined)) {
+      throw new Error(`cannot derive the ${only} package list from ${META}'s BUNDLES export`);
+    }
+    ensureProfile(plan.profile, plan.template);
+    ensureReleaseAgeExcludes(plan.profile, plan.packages.map((pkg) => `${pkg}@${version}`));
+    mustRun(
+      'dsh',
+      ['plugin', '--profile', plan.profile, 'add', '--ignore-workspace-root-check', ...plan.packages.map((pkg) => `${pkg}@${version}`)],
+      `install into ${plan.profile}`,
+    );
+    record(`installed ${plan.packages.map((pkg) => `${pkg}@${version}`).join(', ')}`, plan.profile);
+    ensureBundles(plan.profile, plan.bundles);
+    if (!DRY_RUN) {
+      for (const pkg of plan.packages) {
+        const actual = installedVersion(plan.profile, pkg);
+        if (actual !== version) {
+          throw new Error(`${plan.profile}: expected ${pkg}@${version}, found ${pkg}@${actual ?? '<missing>'}`);
+        }
+      }
+      record(`verified ${plan.profile}`, plan.packages.map((pkg) => `${pkg}@${version}`).join(', '));
+    }
+  }
+
+  if (JSON_OUT) {
+    process.stdout.write(`${JSON.stringify({ version, tag: EXACT === null ? TAG : null, only: ONLY, dshHome: DSH_HOME, steps }, null, 2)}\n`);
+  } else {
+    process.stdout.write('\nDone. Restart DeepSeek Harness (or any running lead) so the new bundle is loaded:\n');
+    process.stdout.write('  dsh --profile sdlc-web\n\n');
+    if (ONLY === 'lead' || ONLY === 'all') {
+      process.stdout.write('A new session will use the sdlc-lead preset. If you still see an "agent-preset/invalid"\n');
+      process.stdout.write('error, the app is still running the old bundle — quit it completely and reopen.\n');
+    }
+  }
+}
+
+main().catch((error) => {
+  if (JSON_OUT) process.stdout.write(`${JSON.stringify({ ok: false, error: error.message }, null, 2)}\n`);
+  else process.stderr.write(`\ndsh-sdlc-install: ${error.message}\n`);
+  process.exit(1);
+});

package/lib/rows/cli/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-cli",
-  "version": "0.4.0-beta.19",
+  "version": "0.4.0-beta.21",
   "type": "module"
 }

package/lib/rows/core/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-core",
-  "version": "0.4.0-beta.19",
+  "version": "0.4.0-beta.21",
   "type": "module"
 }

package/lib/rows/guard/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-guard",
-  "version": "0.4.0-beta.19",
+  "version": "0.4.0-beta.21",
   "type": "module"
 }

package/lib/rows/presets/cordis.patch.yml

@@ -12,10 +12,10 @@
 #
 # The agent-preset-registry row is FIRST inside insert: so the registry exists
 # before the presets register against it on templates that lack one
-# (headless). On the web template the shipped row already exists, so the lead
-# profile composes two same-id rows pointing at the same service — the loader
-# accepts both and the presets activate (verified live). The M0 static check
-# pins the patch shape; the M0-02 live check pins the composed profile.
+# (headless/sdk). The web template already ships the row; the generated lead
+# meta-bundle replaces this insert with an id-targeted override — a duplicate
+# id+name is loader-accepted but blocks plugin-manager uninstall. The M0-02
+# live check pins one registry row with default sdlc-lead.
 - insert:
     - id: agent-preset-registry
       name: "@deepseek-ai/dsh-agent-preset-registry"
@@ -40,14 +40,20 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: true
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
           - id: tool-subagent
             name: "@deepseek-ai/dsh-tool-subagent"
+            config:
+              provider: spawn
+              toolName: subagent
+              backgroundMode: continuable
           - id: sdlc-dispatch
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/dispatch"
           - id: sdlc-plan
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/plan"
     - id: preset-sdlc-business-analyst
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -67,8 +73,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-requirements-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -88,8 +96,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-product-owner
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -109,8 +119,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-solution-architect
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -130,8 +142,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-security-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -151,8 +165,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-data-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -172,8 +188,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-database-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -193,8 +211,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-ux-designer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -214,8 +234,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-ui-designer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -235,8 +257,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-accessibility-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -256,8 +280,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-frontend-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -277,8 +303,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-backend-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -298,8 +326,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-api-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -319,8 +349,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-integration-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -340,8 +372,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-devops-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -361,8 +395,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-platform-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -382,8 +418,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-qa-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -403,8 +441,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-test-automation-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -424,8 +464,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-e2e-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -445,8 +487,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-visual-qa-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -466,8 +510,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-performance-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -487,8 +533,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-technical-writer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -508,8 +556,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-release-manager
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -529,8 +579,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-code-reviewer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -550,8 +602,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: preset-sdlc-sre-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -571,8 +625,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow-tools"
+            name: "@patwoodman/dsh-sdlc-flow-tools/report"
     - id: sdlc-presets
       name: "@patwoodman/dsh-sdlc-flow-presets/plugin"
       config: {}

package/lib/rows/presets/lib/roles.js

@@ -15,19 +15,37 @@
  * "no unnecessary agents" is structural, not heuristic.
  */
 
-/** Tools every worker preset composes. Worker presets get NO delegation tools. */
+/**
+ * Tools every worker preset composes. Worker presets get NO delegation tools.
+ *
+ * DSH requires the tool configs in these rows explicitly — neither plugin has
+ * a default — and an omitted value fails the WHOLE preset at mount:
+ *   - `tool-todo`: `allowParallelInProgress` is a required deployment policy.
+ *     A worker owns exactly one task contract at a time, so it keeps the
+ *     single-active discipline.
+ *   - `tool-subagent` (Lead only, below): `provider` is required.
+ */
 export const WORKER_TOOL_ROWS = [
   { id: 'tool-bash', name: '@deepseek-ai/dsh-tool-bash' },
   { id: 'tool-fs', name: '@deepseek-ai/dsh-tool-fs' },
-  { id: 'tool-todo', name: '@deepseek-ai/dsh-tool-todo' },
-  { id: 'sdlc-report', name: '@patwoodman/dsh-sdlc-flow-tools' },
+  { id: 'tool-todo', name: '@deepseek-ai/dsh-tool-todo', config: { allowParallelInProgress: false } },
+  { id: 'sdlc-report', name: '@patwoodman/dsh-sdlc-flow-tools/report' },
 ];
 
-/** Tools only the Lead composes: delegation, plan deltas, decision ledger. */
+/** Tools only the Lead composes: delegation, plan deltas, decision ledger.
+ *
+ * `provider: 'spawn'` is the in-process backend the web template registers;
+ * `backgroundMode: 'continuable'` keeps delegated child conversations available
+ * for follow-up turns. Both match DSH's own `standard`/web preset.
+ */
 export const LEAD_TOOL_ROWS = [
-  { id: 'tool-subagent', name: '@deepseek-ai/dsh-tool-subagent' },
-  { id: 'sdlc-dispatch', name: '@patwoodman/dsh-sdlc-flow-tools' },
-  { id: 'sdlc-plan', name: '@patwoodman/dsh-sdlc-flow-tools' },
+  {
+    id: 'tool-subagent',
+    name: '@deepseek-ai/dsh-tool-subagent',
+    config: { provider: 'spawn', toolName: 'subagent', backgroundMode: 'continuable' },
+  },
+  { id: 'sdlc-dispatch', name: '@patwoodman/dsh-sdlc-flow-tools/dispatch' },
+  { id: 'sdlc-plan', name: '@patwoodman/dsh-sdlc-flow-tools/plan' },
 ];
 
 export const POLICY_SUFFIX = [
@@ -140,13 +158,12 @@ export function presetConfigIdFor(roleId) {
  * waiting for service: agentPresets` while the presets silently never
  * mounted.
  *
- * The row is FIRST inside the presets patch's insert: list so it exists
- * before the presets register against it. Two constraints on its config:
- * (1) `default` must name a preset that EXISTS in the composed profile —
- * `standard` exists on web (shipped row) but on sdk/headless nothing ships
- * presets, so the default is our own `sdlc-lead`; (2) on `web` the composed
- * profile then holds two same-id rows pointing at the same service — the
- * loader accepts both and every preset activates (verified live).
+ * The row is FIRST inside the member patch's insert: list so it exists before
+ * the presets register against it on headless/sdk profiles, which ship no
+ * registry row. On web the shipped row exists, so the generated lead
+ * meta-bundle replaces this insert with an id-targeted override of the
+ * shipped row's `default` — a duplicate id+name is loader-accepted but blocks
+ * the plugin manager's uninstall audit.
  */
 export function presetRegistryRow() {
   return {
@@ -169,6 +186,19 @@ export function personaPrefix(role) {
   ].join('\n');
 }
 
+/**
+ * The Lead fans work out to workers/subagents, so its own todo list may legitimately
+ * track several active items at once. Workers stay single-active.
+ */
+function leadToolRows() {
+  const rows = WORKER_TOOL_ROWS.map((row) =>
+    row.id === 'tool-todo'
+      ? { ...row, config: { ...row.config, allowParallelInProgress: true } }
+      : row,
+  );
+  return [...rows, ...LEAD_TOOL_ROWS];
+}
+
 /** Build the `- insert:` row for one role preset. */
 export function presetRow(role) {
   const plugins = [
@@ -180,7 +210,7 @@ export function presetRow(role) {
         suffix: 'Your working directory is {{cwd}}. Model: {{model}}.',
       },
     },
-    ...(role.lead ? [...WORKER_TOOL_ROWS, ...LEAD_TOOL_ROWS] : WORKER_TOOL_ROWS),
+    ...(role.lead ? leadToolRows() : WORKER_TOOL_ROWS),
   ];
   return {
     id: presetIdFor(role.id),

package/lib/rows/presets/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-presets",
-  "version": "0.4.0-beta.19",
+  "version": "0.4.0-beta.21",
   "type": "module"
 }

package/lib/rows/tools/lib/dispatch.js

@@ -0,0 +1,11 @@
+/**
+ * packages/sdlc-tools/src/dispatch.js — the Lead's dispatch/approval slice
+ * (spec v3 C.3/C.4): propose a dispatch, approve a transition, record a
+ * decision. `sdlc_plan_delta` has its own `./plan` entry.
+ */
+
+import { DISPATCH_TOOLS } from './index.js';
+import { toolSubsetPlugin } from './plugin.js';
+
+export const name = 'sdlc-tools/dispatch';
+export const apply = toolSubsetPlugin(DISPATCH_TOOLS);

package/lib/rows/tools/lib/index.js

@@ -16,6 +16,17 @@ export const WORKER_TOOLS = ['sdlc_report_result', 'sdlc_claim_check', 'sdlc_req
 export const LEAD_TOOLS = ['sdlc_dispatch_task', 'sdlc_approve_transition', 'sdlc_record_decision', 'sdlc_plan_delta'];
 export const ALL_TOOLS = [...WORKER_TOOLS, ...LEAD_TOOLS];
 
+/**
+ * The three preset-plane slices (spec C.3). Each is a real loader entry with
+ * its own subpath export — the preset rows name them directly, so a worker's
+ * catalog is the report slice and the Lead's is report + dispatch + plan.
+ * They register TOOLS ONLY: the /sdlc command surface belongs to the host
+ * `sdlc-tools` row, not to every mounted preset.
+ */
+export const REPORT_TOOLS = [...WORKER_TOOLS];
+export const DISPATCH_TOOLS = LEAD_TOOLS.filter((name) => name !== 'sdlc_plan_delta');
+export const PLAN_TOOLS = ['sdlc_plan_delta'];
+
 export const COMMANDS = [
   'run', 'status', 'tasks', 'workers', 'models', 'logs', 'verify', 'resume', 'stop',
   'explain', 'retry', 'elevate', 'approve', 'reject', 'doctor', 'config', 'init', 'lock', 'selftest',
@@ -227,4 +238,4 @@ export function validateToolArgs(name, args = {}) {
   return errors.length ? { ok: false, error: errors.join('; ') } : { ok: true };
 }
 
-export default { TOOL_DEFS, WORKER_TOOLS, LEAD_TOOLS, COMMANDS, createHandlers, writeOutbox };
+export default { TOOL_DEFS, WORKER_TOOLS, LEAD_TOOLS, REPORT_TOOLS, DISPATCH_TOOLS, PLAN_TOOLS, COMMANDS, createHandlers, writeOutbox };

package/lib/rows/tools/lib/plan.js

@@ -0,0 +1,11 @@
+/**
+ * packages/sdlc-tools/src/plan.js — the Lead's plan-delta slice (spec v3
+ * C.3/C.4). Kept separate so the preset row can name exactly the tool it
+ * grants instead of re-mounting the whole tools plugin.
+ */
+
+import { PLAN_TOOLS } from './index.js';
+import { toolSubsetPlugin } from './plugin.js';
+
+export const name = 'sdlc-tools/plan';
+export const apply = toolSubsetPlugin(PLAN_TOOLS);

package/lib/rows/tools/lib/plugin.js

@@ -18,13 +18,20 @@ function pkgVersion() {
   }
 }
 
-/** Register every tool definition on a DSH context. */
+/**
+ * Register tool definitions on a DSH context.
+ *
+ * `config.tools` narrows the set to those names (the preset slices); omitting
+ * it registers the complete surface (the host `sdlc-tools` row).
+ */
 export function registerTools(ctx, config = {}) {
   const registered = [];
+  const selected = Array.isArray(config.tools) ? new Set(config.tools) : null;
   const worktreePath = config.worktreePath ?? process.cwd();
   const handlers = createHandlers({ worktreePath, runMeta: config.runMeta ?? {} });
 
   for (const [name, def] of Object.entries(TOOL_DEFS)) {
+    if (selected !== null && !selected.has(name)) continue;
     const handler = handlers[name];
     if (!handler) continue;
     registered.push(name);
@@ -67,6 +74,24 @@ export function registerCommands(ctx, config = {}) {
   return registered;
 }
 
+/**
+ * Build a loader entry for one preset-plane tool slice.
+ *
+ * The preset rows use the package's `./report`, `./dispatch` and `./plan`
+ * exports, each of which is one of these. A slice registers only its tools
+ * and NEVER the command surface: the host `sdlc-tools` row owns commands, and
+ * mounting them once per preset would collide on the second mount.
+ * @param {string[]} toolNames - the exact tool names this entry registers.
+ * @returns {(ctx: object, config?: object) => undefined}
+ */
+export function toolSubsetPlugin(toolNames) {
+  const tools = [...toolNames];
+  return function applyToolSubset(ctx, config = {}) {
+    setSelftestMeta({ version: pkgVersion() });
+    contributeSelftest({ tools: registerTools(ctx, { ...config, tools }) });
+  };
+}
+
 /**
  * Loader entry. MUST return nothing: the Cordis runner interprets a plugin's
  * return value as an effect (`TypeError: Invalid effect` for a

package/lib/rows/tools/lib/report.js

@@ -0,0 +1,15 @@
+/**
+ * packages/sdlc-tools/src/report.js — the worker preset's propose-only result
+ * slice (spec v3 C.3/C.4).
+ *
+ * The preset rows name this subpath, not the package root: `lib/index.js` is
+ * data only, so the loader would reject it with "never started". Each slice is
+ * a real loader entry and registers tools only — commands stay with the host
+ * `sdlc-tools` row.
+ */
+
+import { REPORT_TOOLS } from './index.js';
+import { toolSubsetPlugin } from './plugin.js';
+
+export const name = 'sdlc-tools/report';
+export const apply = toolSubsetPlugin(REPORT_TOOLS);

package/lib/rows/tools/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-tools",
-  "version": "0.4.0-beta.19",
+  "version": "0.4.0-beta.21",
   "type": "module"
 }

package/lib/rows/ui/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-ui",
-  "version": "0.4.0-beta.19",
+  "version": "0.4.0-beta.21",
   "type": "module"
 }

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow",
-  "version": "0.4.0-beta.19",
+  "version": "0.4.0-beta.21",
   "type": "module",
   "description": "DSH SDLC Flow lead-profile bundle: task engine, tools, role presets, and web UI in one install.",
   "main": "lib/index.js",
+  "bin": {
+    "dsh-sdlc-install": "lib/install.mjs"
+  },
   "exports": {
     ".": "./lib/index.js",
+    "./install": "./lib/install.mjs",
     "./package.json": "./package.json",
     "./locale/*.json": "./locale/*.json",
     "./icon": "./icon.svg",
@@ -16,6 +20,9 @@
     "./selftest": "./lib/rows/core/lib/selftest.js",
     "./tools": "./lib/rows/tools/lib/index.js",
     "./tools-plugin": "./lib/rows/tools/lib/plugin.js",
+    "./tools-report": "./lib/rows/tools/lib/report.js",
+    "./tools-dispatch": "./lib/rows/tools/lib/dispatch.js",
+    "./tools-plan": "./lib/rows/tools/lib/plan.js",
     "./presets": "./lib/rows/presets/lib/index.js",
     "./presets-plugin": "./lib/rows/presets/lib/plugin.js",
     "./ui": "./lib/rows/ui/lib/index.js",