@ran-sh/dsh-crew 0.3.0

package/package.json

@@ -0,0 +1,125 @@
+{
+  "name": "@ran-sh/dsh-crew",
+  "version": "0.3.0",
+  "type": "module",
+  "main": "./src/hub/entry.mjs",
+  "description": "DeepSeek Harness plugin: dispatch work to DSH agents from Claude Code / Codex, as native subagents with live progress",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "mcp": "node src/server.mjs",
+    "build:client": "tsdown src/client/entry.tsx --format cjs --platform browser --target es2022 --tsconfig tsconfig.client.json --deps.never-bundle react --deps.never-bundle react/jsx-runtime --deps.never-bundle react-dom --deps.never-bundle react-dom/client --out-dir .client-build --clean --logLevel warn && node scripts/build-client.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.17.5",
+    "zod": "^3.24.0"
+  },
+  "exports": {
+    ".": "./src/hub/entry.mjs",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "peerDependencies": {
+    "react": "^18.0.0",
+    "react-dom": "^18.0.0",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-presets": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-spine-demo": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-bash-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-compaction-basic": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-fs-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-sdk-client": "^0.1.0-rc.5",
+    "@deepseek-ai/dsh-sdk-jsonrpc-demo": "^0.1.0-rc.5",
+    "@deepseek-ai/dsh-sdk-jsonrpc-server": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-token-meter": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tool-fs": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tool-todo": "0.1.0-rc.6"
+  },
+  "devDependencies": {
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "tsdown": "^0.12.0",
+    "typescript": "^5.6.0",
+    "@types/react": "^18.3.0",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-presets": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-spine-demo": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-bash-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-compaction-basic": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-fs-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-sdk-client": "^0.1.0-rc.5",
+    "@deepseek-ai/dsh-sdk-jsonrpc-demo": "^0.1.0-rc.5",
+    "@deepseek-ai/dsh-sdk-jsonrpc-server": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-token-meter": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tool-fs": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tool-todo": "0.1.0-rc.6"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ran-sh/dsh-crew.git"
+  },
+  "homepage": "https://github.com/Ran-sh/dsh-crew",
+  "bugs": {
+    "url": "https://github.com/Ran-sh/dsh-crew/issues"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek",
+    "claude-code",
+    "codex",
+    "subagent",
+    "worker",
+    "multimodal",
+    "plugin",
+    "agent"
+  ],
+  "files": [
+    "lib",
+    "src",
+    "scripts",
+    "agents",
+    "commands",
+    "codex",
+    "statusline",
+    "cordis.patch.yml",
+    "worker.cordis.yml",
+    ".claude-plugin",
+    ".mcp.json",
+    "README.md",
+    "README.*.md",
+    "docs/images/dsh-crew-logo.png",
+    "docs/images/dsh-crew-overview.png",
+    "docs/images/dsh-crew-host.png",
+    "docs/images/dsh-crew-jobs.png",
+    "LICENSE"
+  ]
+}

package/scripts/build-client.mjs

@@ -0,0 +1,28 @@
+// Wrap the compiled client bundle into the dsh-web module-loader artifact:
+// `window.__ModuleLoader__.load({ id, factory })`. The id must equal the
+// package name (= the cordis entry name). Pattern from dsh-noema.
+
+import { readFile, writeFile, rm, mkdir, readdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const manifest = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+const pluginId = manifest.name;
+const buildDir = join(root, '.client-build');
+const compiledEntries = (await readdir(buildDir)).filter((name) => name.endsWith('.cjs'));
+if (compiledEntries.length !== 1) {
+  throw new Error(`expected exactly one compiled client entry in .client-build, found ${compiledEntries.length}: ${compiledEntries.join(', ')}`);
+}
+const source = await readFile(join(buildDir, compiledEntries[0]), 'utf8');
+const wrapped = [
+  `window.__ModuleLoader__.load({ id: ${JSON.stringify(pluginId)}, factory: (require) => {`,
+  'var module = { exports: {} }; var exports = module.exports;',
+  source.replace(/\n?\/\/# sourceMappingURL=.*$/u, ''),
+  'return module.exports; } });',
+  '',
+].join('\n');
+await mkdir(join(root, 'lib'), { recursive: true });
+await writeFile(join(root, 'lib', 'client.js'), wrapped);
+await rm(buildDir, { recursive: true, force: true });
+console.log(`built lib/client.js (${wrapped.length} bytes) as module "${pluginId}" from ${compiledEntries[0]}`);

package/scripts/live-crew-smoke.mjs

@@ -0,0 +1,39 @@
+// Live Crew worker smoke against a Crew-owned dsh-crew Hub (Stage 4 provider
+// routing). Targets the dedicated Crew Hub (DSH_CREW_HUB env or default
+// http://127.0.0.1:3210); it never targets or mutates the official web profile.
+// Creates a temp fixture as cwd, spawns flash, polls, prints job metadata.
+import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
+const BASE = (process.env.DSH_CREW_HUB ?? 'http://127.0.0.1:3210').replace(/\/$/, '') + '/_dsh/dsh-crew';
+
+(async () => {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh4-fixture-'));
+  fs.writeFileSync(path.join(fixture, 'note.txt'), 'hello');
+  const cwd = fixture.replace(/\\/g, '/');
+  console.log('fixture:', cwd);
+  console.log('provider route:', JSON.stringify(await (await fetch(`${BASE}/provider`)).json()));
+
+  const tier = process.argv[2] ?? 'flash';
+  const res = await fetch(`${BASE}/jobs`, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ task: 'Reply with exactly: CREW_OPENCODE_GO_OK', tier, effort: 'off', cwd }),
+  });
+  const spawned = await res.json();
+  console.log('spawn:', JSON.stringify(spawned).slice(0, 260));
+  if (!spawned.ok && !spawned.job) { process.exit(1); }
+  const id = (spawned.job ?? spawned).id;
+
+  // Poll for up to 120s.
+  for (let i = 0; i < 40; i++) {
+    await new Promise((r) => setTimeout(r, 3000));
+    const r = await (await fetch(`${BASE}/jobs/${id}?wait=0`)).json();
+    const j = r.job ?? r;
+    if (!['running', 'pending'].includes(j.status)) {
+      console.log('final:', JSON.stringify({ id: j.id, tier: j.tier, model: j.model, status: j.status, result: (j.result || '').slice(0, 120), error: (j.error || '').slice(0, 200), tokens: j.tokens }, null, 2));
+      process.exit(j.status === 'done' ? 0 : 2);
+    }
+  }
+  console.log('TIMEOUT waiting for job', id);
+  process.exit(3);
+})();

package/scripts/live-policy-matrix.mjs

@@ -0,0 +1,177 @@
+// Live policy acceptance matrix against a Crew-owned dsh-crew Hub (loopback
+// API). Targets the dedicated Crew Hub (DSH_CREW_HUB env or default
+// http://127.0.0.1:3210); it never targets or mutates the official web profile.
+//
+// Safety guarantees:
+//  - the worker cwd is always an auto-created temp fixture under os.tmpdir()
+//    (never a real user path — no hardcoded Desktop/Users paths);
+//  - the pre-test Crew config is snapshotted and restored in a try/finally, so
+//    the matrix can never leave the DSH policy in a test state, even on error;
+//  - if there was no ~/.config/dsh-crew/config.json before the run, that
+//    absence cannot be recreated through the public API (the config route only
+//    merges), so the script reports it instead of pretending.
+//
+// The helpers (createLiveFixture / withBaselineRestore / configFileExists) are
+// exported and unit-tested in test/live-policy-matrix.test.mjs.
+//
+// Usage: node scripts/live-policy-matrix.mjs
+
+import os from 'node:os';
+import path from 'node:path';
+import fs, { mkdtempSync, writeFileSync, rmSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { homedir } from 'node:os';
+
+const BASE = (process.env.DSH_CREW_HUB ?? 'http://127.0.0.1:3210').replace(/\/$/, '') + '/_dsh/dsh-crew';
+const CREW_CONFIG = () => path.join(homedir(), '.config', 'dsh-crew', 'config.json');
+
+/** True when the global config file exists on disk before the run. */
+export function configFileExists(configPath = CREW_CONFIG()) {
+  return existsSync(configPath);
+}
+
+/** Create a throwaway fixture dir under os.tmpdir() with minimal safe files. */
+export async function createLiveFixture(opts = {}) {
+  const prefix = opts.prefix ?? 'dsh-crew-live-acceptance-';
+  const dir = mkdtempSync(path.join(os.tmpdir(), prefix));
+  const src = path.join(dir, 'src');
+  fs.mkdirSync(src, { recursive: true });
+  writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'dsh-crew-live-fixture', private: true, type: 'module' }, null, 2) + '\n');
+  writeFileSync(path.join(src, 'math.js'), 'export function add(a, b) { return a + b; }\n');
+  writeFileSync(path.join(dir, 'README.md'), '# dsh-crew live acceptance fixture\n');
+  return dir;
+}
+
+/** Remove a fixture dir created by createLiveFixture. */
+export function removeLiveFixture(dir) {
+  if (dir && dir.startsWith(os.tmpdir())) rmSync(dir, { recursive: true, force: true });
+}
+
+/**
+ * Snapshot the current config, run fn(), then restore the snapshot —
+ * always, even when fn() throws. Returns fn()'s value or rethrows.
+ */
+export async function withBaselineRestore(getConfig, setConfig, fn) {
+  const baseline = await getConfig();
+  try {
+    return await fn();
+  } finally {
+    try { await setConfig(baseline); } catch (err) { console.error('LIVE MATRIX: baseline restore failed —', err?.message ?? err); }
+  }
+}
+
+async function getConfig() {
+  const res = await fetch(`${BASE}/config`);
+  const body = await res.json();
+  if (!body.ok) throw new Error(`config GET failed: ${JSON.stringify(body)}`);
+  return body.config;
+}
+
+async function setConfig(patch) {
+  const res = await fetch(`${BASE}/config`, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(patch),
+  });
+  const body = await res.json();
+  if (!body.ok) throw new Error(`config write failed: ${JSON.stringify(body)}`);
+  return body.config;
+}
+
+async function spawn(body) {
+  const res = await fetch(`${BASE}/jobs`, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return res.json();
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
+if (isMain) {
+  let passed = 0, failed = 0;
+  const check = (name, ok, detail = '') => {
+    console.log(`${ok ? 'PASS' : 'FAIL'} ${name}${detail ? ` — ${detail}` : ''}`);
+    ok ? passed++ : failed++;
+  };
+
+  const fixture = await createLiveFixture();
+  const CWD = fixture;
+  const hadConfig = configFileExists();
+  console.log(`fixture: ${CWD} (exists=${existsSync(CWD)})`);
+  console.log(`config file existed before run: ${hadConfig}`);
+
+  await withBaselineRestore(getConfig, setConfig, async () => {
+    // ---------- Test A: Subagents OFF ----------
+    await setConfig({ subagents_enabled: false, collaboration_mode: 'balanced' });
+    {
+      const r = await spawn({ task: 't', tier: 'flash', cwd: CWD });
+      check('A1: Subagents OFF blocks flash dispatch', r.ok === false && r.code === 'SUBAGENTS_DISABLED', r.error ?? '');
+      const r2 = await spawn({ task: 't', cwd: CWD });
+      check('A2: Subagents OFF blocks default dispatch too', r2.ok === false && r2.code === 'SUBAGENTS_DISABLED', r2.error ?? '');
+    }
+
+    // ---------- Test B/C: Flash Only ----------
+    await setConfig({ subagents_enabled: true, collaboration_mode: 'flash-only' });
+    {
+      const r = await spawn({ task: 't', cwd: CWD });
+      check('B1: Flash Only + missing tier spawns flash', r.ok === true && r.job.tier === 'flash', r.ok ? `tier=${r.job.tier}` : r.error);
+      const r2 = await spawn({ task: 't', tier: 'pro', cwd: CWD });
+      check('C1: Flash Only + explicit pro rejected TIER_DISABLED', r2.ok === false && r2.code === 'TIER_DISABLED', r2.error ?? '');
+    }
+
+    // ---------- Test D/E: Pro Only ----------
+    await setConfig({ collaboration_mode: 'pro-only' });
+    {
+      const r = await spawn({ task: 't', cwd: CWD });
+      check('D1: Pro Only + missing tier spawns pro (resolved-tier regression)', r.ok === true && r.job.tier === 'pro', r.ok ? `tier=${r.job.tier}` : r.error);
+      const r2 = await spawn({ task: 't', tier: 'flash', cwd: CWD });
+      check('E1: Pro Only + explicit flash rejected TIER_DISABLED', r2.ok === false && r2.code === 'TIER_DISABLED', r2.error ?? '');
+    }
+
+    // ---------- Test F: Balanced ----------
+    await setConfig({ collaboration_mode: 'balanced', flash_state: 'auto', pro_state: 'auto' });
+    {
+      const r = await spawn({ task: 't', cwd: CWD });
+      check('F1: Balanced + missing tier uses default (flash)', r.ok === true && r.job.tier === 'flash', r.ok ? `tier=${r.job.tier}` : r.error);
+      const r2 = await spawn({ task: 't', tier: 'pro', cwd: CWD });
+      check('F2: Balanced + explicit pro allowed', r2.ok === true && r2.job.tier === 'pro', r2.ok ? `tier=${r2.job.tier}` : r2.error);
+    }
+
+    // ---------- Test G: Manual semantics ----------
+    await setConfig({ collaboration_mode: 'custom', flash_state: 'auto', pro_state: 'manual' });
+    {
+      const r = await spawn({ task: 't', cwd: CWD });
+      check('G1: Custom flash=auto/pro=manual + no tier → flash (manual not auto-default)', r.ok === true && r.job.tier === 'flash', r.ok ? `tier=${r.job.tier}` : r.error);
+      const r2 = await spawn({ task: 't', tier: 'pro', cwd: CWD });
+      check('G2: Custom + explicit pro allowed (manual is callable when named)', r2.ok === true && r2.job.tier === 'pro', r2.ok ? `tier=${r2.job.tier}` : r2.error);
+    }
+
+    // ---------- Test H: both disabled ----------
+    await setConfig({ collaboration_mode: 'custom', flash_state: 'disabled', pro_state: 'disabled' });
+    {
+      const r = await spawn({ task: 't', cwd: CWD });
+      check('H1: both disabled → NO_WORKER_TIER (no fallback)', r.ok === false && r.code === 'NO_WORKER_TIER', r.error ?? '');
+      const r2 = await spawn({ task: 't', tier: 'flash', cwd: CWD });
+      check('H2: both disabled + explicit flash still rejected', r2.ok === false && r2.code === 'TIER_DISABLED', r2.error ?? '');
+    }
+
+    // ---------- Test I: Review Pipeline config semantics ----------
+    await setConfig({ collaboration_mode: 'review-pipeline' });
+    {
+      const c = await getConfig();
+      check('I1: review-pipeline GET exposes normalized pro_reviews_flash=true', c.pro_reviews_flash === true, `normalized=${c.pro_reviews_flash}`);
+      const { normalizeGlobalConfig, shouldRunProReview } = await import('../src/policy.mjs');
+      check('I1b: review-pipeline effective pro_reviews_flash=true (policy layer)', shouldRunProReview(normalizeGlobalConfig(c)) === true);
+      const r = await spawn({ task: 't', cwd: CWD });
+      check('I2: review-pipeline default tier flash', r.ok === true && r.job.tier === 'flash', r.ok ? `tier=${r.job.tier}` : r.error);
+    }
+  });
+
+  removeLiveFixture(fixture);
+  const restored = await getConfig();
+  console.log(`\nrestore check: mode=${restored.collaboration_mode} flash=${restored.flash_state} pro=${restored.pro_state} subagents=${restored.subagents_enabled}`);
+  if (!hadConfig && configFileExists()) {
+    console.log('NOTE: ~/.config/dsh-crew/config.json was absent before this run; the public API cannot delete it, so the file remains (values were reset to the pre-test snapshot).');
+  }
+  console.log(`\n${passed} passed, ${failed} failed`);
+  process.exit(failed > 0 ? 1 : 0);
+}

package/scripts/policy-probe.mjs

@@ -0,0 +1,101 @@
+// Functional probe of the real MCP stdio server (src/server.mjs), no DSH
+// instance and no DeepSeek credentials needed: policy rejections must happen
+// before any worker runtime is touched.
+// Run: node scripts/policy-probe.mjs
+
+import { spawn } from 'node:child_process';
+
+const child = spawn(process.execPath, ['src/server.mjs'], { stdio: ['pipe', 'pipe', 'pipe'] });
+let buffer = '';
+const pending = new Map();
+let nextId = 1;
+
+child.stdout.on('data', (d) => {
+  buffer += d.toString();
+  let idx;
+  while ((idx = buffer.indexOf('\n')) >= 0) {
+    const line = buffer.slice(0, idx);
+    buffer = buffer.slice(idx + 1);
+    if (!line.trim()) continue;
+    let msg;
+    try { msg = JSON.parse(line); } catch { continue; }
+    if (msg.id !== undefined && pending.has(msg.id)) {
+      pending.get(msg.id)(msg);
+      pending.delete(msg.id);
+    }
+  }
+});
+
+function call(method, params) {
+  return new Promise((resolve) => {
+    const id = nextId++;
+    pending.set(id, resolve);
+    child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n');
+  });
+}
+
+const results = [];
+function check(name, cond, detail) {
+  results.push({ name, ok: !!cond, detail });
+  console.log(`${cond ? 'PASS' : 'FAIL'} ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+await call('initialize', { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'probe', version: '1' } });
+await new Promise((r) => setTimeout(r, 200));
+
+// 1. Read config: must expose the new effective policy fields.
+const cfg = await call('tools/call', { name: 'dsh_worker_config', arguments: {} });
+const cfgText = cfg.result?.content?.[0]?.text;
+let cfgJson = null;
+try { cfgJson = JSON.parse(cfgText); } catch {}
+check('config returns effective policy', !!cfgJson && typeof cfgJson.flash_state === 'string' && typeof cfgJson.pro_state === 'string' && typeof cfgJson.routing_guidance === 'string',
+  cfgJson ? `flash=${cfgJson.flash_state} pro=${cfgJson.pro_state} mode=${cfgJson.collaboration_mode}` : cfgText?.slice(0, 120));
+check('config hides API keys', cfgText !== undefined && !/api_key|sk-/.test(cfgText));
+check('config reports effective_policy + roles + legacy_source', !!cfgJson
+  && typeof cfgJson.effective_policy === 'string' && cfgJson.effective_policy.includes('mode=')
+  && Array.isArray(cfgJson.flash_roles) && cfgJson.flash_roles.length > 0
+  && Array.isArray(cfgJson.pro_roles) && cfgJson.pro_roles.length > 0
+  && typeof cfgJson.legacy_source === 'string',
+  cfgJson ? cfgJson.effective_policy : undefined);
+check('config reflects main_agent_mode', !!cfgJson && ['direct-allowed', 'coordinator-first', 'dispatcher-only'].includes(cfgJson.main_agent_mode), cfgJson?.main_agent_mode);
+
+// 2. Session clamp: flash-only + explicit pro must be refused with TIER_DISABLED.
+const clamp = await call('tools/call', { name: 'dsh_worker_config', arguments: { tier_policy: 'flash-only' } });
+check('session tier_policy clamp set', clamp.result !== undefined && !clamp.result.isError);
+
+const refusePro = await call('tools/call', { name: 'dsh_run_worker', arguments: { task: 'probe', tier: 'pro' } });
+const refuseText = refusePro.result?.content?.[0]?.text ?? '';
+check('pro refused under flash-only', /TIER_DISABLED/.test(refuseText), refuseText.slice(0, 120));
+
+// 3. subagents master switch via session enabled=false.
+const off = await call('tools/call', { name: 'dsh_worker_config', arguments: { reset: true, enabled: false } });
+check('session enabled=false set', off.result !== undefined && !off.result.isError);
+const refuseAll = await call('tools/call', { name: 'dsh_run_worker', arguments: { task: 'probe' } });
+const refuseAllText = refuseAll.result?.content?.[0]?.text ?? '';
+check('dispatch refused when disabled', /SUBAGENTS_DISABLED/.test(refuseAllText), refuseAllText.slice(0, 120));
+
+// 4. dsh_spawn_worker shares the same policy.
+const refuseSpawn = await call('tools/call', { name: 'dsh_spawn_worker', arguments: { task: 'probe' } });
+const refuseSpawnText = refuseSpawn.result?.content?.[0]?.text ?? '';
+check('spawn refused when disabled', /SUBAGENTS_DISABLED/.test(refuseSpawnText));
+
+// 5. Manual semantics: flash manual + pro auto, no explicit tier → pro is chosen, never flash.
+const manual = await call('tools/call', { name: 'dsh_worker_config', arguments: { reset: true, tier_policy: 'auto' } });
+// global config is balanced here; exercise manual via session state override:
+const manualSet = await call('tools/call', { name: 'dsh_worker_config', arguments: { collaboration_mode: 'custom', flash_state: 'manual', pro_state: 'auto', default_tier: 'flash' } });
+check('manual/custom session set', manualSet.result !== undefined && !manualSet.result.isError);
+const manualCfg = await call('tools/call', { name: 'dsh_worker_config', arguments: {} });
+const manualCfgJson = JSON.parse(manualCfg.result.content[0].text);
+check('manual tier never auto-default (effective_default_tier=pro)',
+  manualCfgJson.effective_default_tier === 'pro', `got ${manualCfgJson.effective_default_tier}`);
+check('effective states reported', manualCfgJson.flash_state === 'manual' && manualCfgJson.pro_state === 'auto');
+
+// 6. Reset back to global defaults.
+const reset = await call('tools/call', { name: 'dsh_worker_config', arguments: { reset: true } });
+check('reset restores defaults', reset.result !== undefined && !reset.result.isError);
+
+child.kill();
+await new Promise((r) => setTimeout(r, 100));
+const failed = results.filter((r) => !r.ok);
+console.log(`\n${results.length - failed.length}/${results.length} checks passed`);
+process.exit(failed.length > 0 ? 1 : 0);