@ran-sh/dsh-crew 0.5.0 → 0.5.2

package/scripts/setup.mjs

@@ -167,12 +167,36 @@ export async function setupInstall({
     mark(log, true, `DSH crew profile linked offline (dedicated Crew DSH_HOME, profile dsh-crew; ${registration.changed ? 'updated' : 'already current'})`);
   }
 
-  if (dryRun) mark(log, true, 'Codex Desktop integration (dry-run)');
-  else {
+  if (dryRun) mark(log, true, 'Codex Desktop integration (dry-run)');
+  else {
     const r = installer.installCodex ? installer.installCodex({ home }) : realInstaller.installCodex({ home });
     mark(log, r.ok !== false, r.ok === false ? `Codex Desktop integration failed: ${(r.actions ?? []).join('; ')}` : 'Codex Desktop integration');
-    if (r.ok === false) return { ok: false, error: 'Codex integration failed' };
-  }
+    if (r.ok === false) return { ok: false, error: 'Codex integration failed' };
+  }
+
+  if (dryRun) mark(log, true, 'ZCode integration (dry-run)');
+  else {
+    const r = installer.installZCode
+      ? installer.installZCode({ home, root })
+      : realInstaller.installZCode({ home, root });
+    if (r.ok === false) {
+      mark(log, false, `ZCode integration failed (${r.code ?? 'unknown'})`);
+      return { ok: false, error: 'ZCode integration failed' };
+    }
+    mark(log, true, 'ZCode integration');
+  }
+
+  if (dryRun) mark(log, true, 'Windows login startup (dry-run)');
+  else {
+    const r = installer.installWindowsStartup
+      ? installer.installWindowsStartup({ home, root })
+      : realInstaller.installWindowsStartup({ home, root });
+    if (r.ok === false) {
+      mark(log, false, `Windows login startup failed (${r.code ?? 'unknown'})`);
+      return { ok: false, error: 'Windows login startup failed' };
+    }
+    if (r.supported) mark(log, true, 'Windows login startup');
+  }
 
   if (commandExists('claude')) {
     if (dryRun) mark(log, true, 'Claude Code integration (dry-run)');
@@ -203,17 +227,31 @@ export async function setupUninstall({
   const fail = (name, text) => { mark(log, false, text || `${name} failed`); failures.push(name); };
 
   if (dryRun) {
-    mark(log, true, 'Codex Desktop integration would be removed');
-    mark(log, true, 'Claude Code integration would be removed');
-    mark(log, true, 'DSH crew profile would be removed');
+    mark(log, true, 'Codex Desktop integration would be removed');
+    mark(log, true, 'ZCode integration would be removed');
+    mark(log, true, 'Claude Code integration would be removed');
+    mark(log, true, 'Windows login startup would be removed');
+    mark(log, true, 'DSH crew profile would be removed');
   } else {
     const cx = installer.uninstallCodex ? installer.uninstallCodex({ home }) : realInstaller.uninstallCodex({ home });
-    if (cx.ok !== false) mark(log, true, 'Codex Desktop integration removed');
-    else fail('codex', 'Codex Desktop integration removal failed');
+    if (cx.ok !== false) mark(log, true, 'Codex Desktop integration removed');
+    else fail('codex', 'Codex Desktop integration removal failed');
+
+    const zc = installer.uninstallZCode
+      ? installer.uninstallZCode({ home, root })
+      : realInstaller.uninstallZCode({ home, root });
+    if (zc.ok !== false) mark(log, true, 'ZCode integration removed');
+    else fail('zcode', 'ZCode integration removal failed');
 
-    const cl = installer.uninstallClaudeCode ? installer.uninstallClaudeCode({ home }) : realInstaller.uninstallClaudeCode({ home });
-    if (cl.ok !== false) mark(log, true, 'Claude Code integration removed');
-    else fail('claude', 'Claude Code integration removal failed');
+    const cl = installer.uninstallClaudeCode ? installer.uninstallClaudeCode({ home }) : realInstaller.uninstallClaudeCode({ home });
+    if (cl.ok !== false) mark(log, true, 'Claude Code integration removed');
+    else fail('claude', 'Claude Code integration removal failed');
+
+    const startup = installer.uninstallWindowsStartup
+      ? installer.uninstallWindowsStartup({ home })
+      : realInstaller.uninstallWindowsStartup({ home });
+    if (startup.ok === false) fail('startup', 'Windows login startup removal failed');
+    else if (startup.supported) mark(log, true, 'Windows login startup removed');
 
     const name = readPackageName(root);
     if (!name) fail('dsh', 'DSH plugin removal failed: package name missing');
@@ -243,9 +281,15 @@ export async function setupUninstall({
 }
 
 export async function setupStatus({ log = console.log, root = ROOT, home = homedir(), installer = realInstaller } = {}) {
-  const st = installer.installStatus ? installer.installStatus({ home }) : realInstaller.installStatus({ home });
-  const claude = st?.claude?.installed ? 'installed' : 'not installed';
-  const codex = st?.codex?.installed ? 'installed' : 'not installed';
+  const st = installer.installStatus ? installer.installStatus({ home, root }) : realInstaller.installStatus({ home, root });
+  const claude = st?.claude?.installed ? 'installed' : 'not installed';
+  const codex = st?.codex?.installed ? 'installed' : 'not installed';
+  const zcode = st?.zcode?.installed ? 'installed' : 'not installed';
+  const startupState = installer.windowsStartupStatus
+    ? installer.windowsStartupStatus({ home })
+    : realInstaller.windowsStartupStatus({ home });
+  const windowsStartup = !startupState.supported ? 'not supported'
+    : startupState.ready ? 'installed' : startupState.installed ? 'needs repair' : 'not installed';
   // Crew status reads ONLY the dedicated Crew profile under the Crew DSH_HOME;
   // the official web profile layout under the default DSH home is intentionally
   // never inspected.
@@ -260,10 +304,12 @@ export async function setupStatus({ log = console.log, root = ROOT, home = homed
     } catch { dshPlugin = 'unknown'; }
   }
   log(`DSH plugin: ${dshPlugin} (dedicated dsh-crew profile; official web profile ignored)`);
-  log(`Codex Desktop integration: ${codex}`);
-  log(`Claude Code integration: ${claude}`);
-  return { ok: true, dshPlugin, codex, claude };
-}
+  log(`Codex Desktop integration: ${codex}`);
+  log(`ZCode integration: ${zcode}`);
+  log(`Claude Code integration: ${claude}`);
+  log(`Windows login startup: ${windowsStartup}`);
+  return { ok: true, dshPlugin, codex, zcode, claude, windowsStartup };
+}
 
 export async function runSetupCli({ argv = process.argv.slice(2), run: actions = {}, log = console.log } = {}) {
   const action = argv[0];

package/scripts/verify-npm-install.mjs

@@ -9,13 +9,13 @@
 // or fully resolving the very large official DSH dependency graph.
 
 import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const registry = process.env.NPM_REGISTRY ?? 'https://registry.npmjs.org/';
 export const supportedDshVersion = '0.1.1-rc.2';
 const verifyOfficialDsh = process.argv.includes('--with-official-dsh');
@@ -23,6 +23,19 @@ const DSH_PACKAGE = '@deepseek-ai/dsh';
 const DSH_PREFIX = '@deepseek-ai/dsh-';
 const MAX_DIRECT_PEERS = 64;
 
+export function resolveNpmInvocation({
+  platform = process.platform,
+  nodePath = process.execPath,
+  fileExists = existsSync,
+} = {}) {
+  if (platform !== 'win32') return { command: 'npm', argsPrefix: [] };
+  const npmCli = path.join(path.dirname(nodePath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+  if (!fileExists(npmCli)) throw new Error(`npm CLI was not found beside Node.js: ${npmCli}`);
+  return { command: nodePath, argsPrefix: [npmCli] };
+}
+
+const npmInvocation = resolveNpmInvocation();
+
 /**
  * The candidate version is derived from the candidate package manifest at the
  * checkout root instead of a hard-coded release literal, so the verifier never
@@ -217,10 +230,10 @@ export async function auditOfficialDshCohort({
 }
 
 function run(args, cwd = root) {
-  const result = spawnSync(npmCommand, args, {
+  const result = spawnSync(npmInvocation.command, [...npmInvocation.argsPrefix, ...args], {
     cwd,
     encoding: 'utf8',
-    shell: process.platform === 'win32',
+    shell: false,
     windowsHide: true,
   });
   if (result.error) throw result.error;

package/src/client/host-readiness.mjs

@@ -33,13 +33,14 @@ function bridgeState(surface) {
 export function projectHostReadiness({ installStatus, runtime, surface } = {}) {
   const codex = installStatus?.codex;
   const claude = installStatus?.claude;
+  const zcode = installStatus?.zcode;
   return [
     { id: 'codex_mcp', state: componentState(codex, ['mcp'], { aligned: true }) },
     { id: 'ds_worker', state: componentState(codex, ['worker_role'], { aligned: true }) },
     { id: 'ds_reviewer', state: componentState(codex, ['reviewer_role'], { aligned: true }) },
     { id: 'claude_plugin', state: componentState(claude, ['enabled', 'marketplace', 'snapshot', 'permissions']) },
+    { id: 'zcode_mcp', state: componentState(zcode, ['mcp', 'policy', 'worker_agent', 'reviewer_agent', 'config_prompt', 'status_prompt', 'ownership']) },
     { id: 'crew_harness', state: runtimeState(runtime), detail: runtime?.runtime_version ?? null },
     { id: 'official_bridge', state: bridgeState(surface) },
   ];
 }
-

package/src/client/index.tsx

@@ -52,11 +52,11 @@ const COPY = {
     expandAll: '全部展开', collapseAll: '全部折叠',
     modelCount: (count: number) => `${count} 个模型`, providerCount: (count: number) => `${count} 个 Provider`,
     jobCount: (count: number) => `${count} 个任务`, runningCount: (count: number) => `${count} 个运行中`,
-    sectionNames: { integrations: 'Codex / Claude 集成状态', workflow: 'Crew 工作流设置', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: '模型优先级与派发', adaptive: '自适应路由', runtime: '运行 / 生效边界', multimodal: '视觉与生图', providers: '自定义 Provider', jobs: '任务状态' },
+    sectionNames: { integrations: 'Codex / Claude / ZCode 集成状态', workflow: 'Crew 工作流设置', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: '模型优先级与派发', adaptive: '自适应路由', runtime: '运行 / 生效边界', multimodal: '视觉与生图', providers: '自定义 Provider', jobs: '任务状态' },
     openHarness: '打开 3210 Crew Harness →',
     harnessHint: '底层 Provider、Harness Models 与运行时配置',
     hostReadiness: '宿主集成就绪度', hostReadinessHint: '只使用结构化安装与运行时证据；缺少证据不会显示 READY。',
-    readinessLabels: { codex_mcp: 'Codex MCP', ds_worker: 'ds-worker', ds_reviewer: 'ds-reviewer', claude_plugin: 'Claude plugin', crew_harness: 'Crew Harness', official_bridge: 'Official bridge' },
+    readinessLabels: { codex_mcp: 'Codex MCP', ds_worker: 'ds-worker', ds_reviewer: 'ds-reviewer', claude_plugin: 'Claude plugin', zcode_mcp: 'ZCode MCP', crew_harness: 'Crew Harness', official_bridge: 'Official bridge' },
     readinessStates: { READY: 'READY', DEGRADED: 'DEGRADED', UNAVAILABLE: 'UNAVAILABLE', UNKNOWN: 'UNKNOWN' },
     globalHint: '修改即时保存到 ~/.config/dsh-crew/config.json；CC / Codex 的新会话自动读取为默认值（会话内可用 /dsh-crew:config 临时覆盖）。',
     orchestration: 'Agent 编排',
@@ -154,11 +154,16 @@ const COPY = {
         update: '重跑安装流程：刷新注册与权限、迁移旧格式配置、更新 HUD 接线；幂等，可放心点',
         restore: '从 Claude Code 移除集成：清除 marketplace 注册、插件启用项与权限规则（settings 先备份）；不删除插件源码与已跑任务',
       },
-      codex: {
-        install: '把 ds-flash / ds-pro 角色和 /dsh-config、/dsh-status 命令复制到 ~/.codex/（MCP 路径按本机自动渲染，含 approve 审批与超时配置）',
-        update: '重新渲染并覆盖角色文件与命令（插件路径或配置变更后用）；原文件先备份',
-        restore: '删除 ~/.codex/ 下的 ds-flash / ds-pro 角色与 dsh 命令文件（角色文件先备份）',
-      },
+      codex: {
+        install: '把 ds-flash / ds-pro 角色和 /dsh-config、/dsh-status 命令复制到 ~/.codex/（MCP 路径按本机自动渲染，含 approve 审批与超时配置）',
+        update: '重新渲染并覆盖角色文件与命令（插件路径或配置变更后用）；原文件先备份',
+        restore: '删除 ~/.codex/ 下的 ds-flash / ds-pro 角色与 dsh 命令文件（角色文件先备份）',
+      },
+      zcode: {
+        install: '安装 ZCode 全局规则、ds-worker / ds-reviewer 角色、命令和按来源选择的 MCP 配置到 ~/.zcode/',
+        update: '重新渲染 ZCode 角色、命令和 MCP 条目；保留个人文件与其他 MCP 服务',
+        restore: '仅移除 dsh-crew 管理的 ZCode 文件和 MCP 条目（保留备份）',
+      },
     },
   },
   en: {
@@ -173,11 +178,11 @@ const COPY = {
     expandAll: 'Expand all', collapseAll: 'Collapse all',
     modelCount: (count: number) => `${count} models`, providerCount: (count: number) => `${count} providers`,
     jobCount: (count: number) => `${count} jobs`, runningCount: (count: number) => `${count} running`,
-    sectionNames: { integrations: 'Codex / Claude integration status', workflow: 'Crew workflow settings', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: 'Model priority & dispatch', adaptive: 'Adaptive routing', runtime: 'Runtime / activation boundaries', multimodal: 'Vision & image generation', providers: 'Custom providers', jobs: 'Task status' },
+    sectionNames: { integrations: 'Codex / Claude / ZCode integration status', workflow: 'Crew workflow settings', flash: 'Worker / Flash', pro: 'Reviewer / Pro', dispatch: 'Model priority & dispatch', adaptive: 'Adaptive routing', runtime: 'Runtime / activation boundaries', multimodal: 'Vision & image generation', providers: 'Custom providers', jobs: 'Task status' },
     openHarness: 'Open 3210 Crew Harness →',
     harnessHint: 'Low-level providers, Harness Models, and runtime configuration',
     hostReadiness: 'Host integration readiness', hostReadinessHint: 'Uses structured installer and runtime evidence only; missing evidence is never READY.',
-    readinessLabels: { codex_mcp: 'Codex MCP', ds_worker: 'ds-worker', ds_reviewer: 'ds-reviewer', claude_plugin: 'Claude plugin', crew_harness: 'Crew Harness', official_bridge: 'Official bridge' },
+    readinessLabels: { codex_mcp: 'Codex MCP', ds_worker: 'ds-worker', ds_reviewer: 'ds-reviewer', claude_plugin: 'Claude plugin', zcode_mcp: 'ZCode MCP', crew_harness: 'Crew Harness', official_bridge: 'Official bridge' },
     readinessStates: { READY: 'READY', DEGRADED: 'DEGRADED', UNAVAILABLE: 'UNAVAILABLE', UNKNOWN: 'UNKNOWN' },
     globalHint: 'Changes save instantly to ~/.config/dsh-crew/config.json; new CC / Codex sessions pick them up as defaults (override per session with /dsh-crew:config).',
     orchestration: 'Agent orchestration',
@@ -275,11 +280,16 @@ const COPY = {
         update: 'Re-run the installer: refresh registration & permissions, migrate legacy config, update HUD wiring; idempotent',
         restore: 'Remove the integration from Claude Code: marketplace registration, plugin enablement and permission rules (settings backed up); plugin source and past jobs untouched',
       },
-      codex: {
-        install: 'Copy ds-flash / ds-pro roles and /dsh-config, /dsh-status prompts into ~/.codex/ (MCP paths rendered for this machine, approve mode + timeout included)',
-        update: 'Re-render and overwrite role files and prompts (after path/config changes); originals backed up',
-        restore: 'Delete ds-flash / ds-pro roles and dsh prompts from ~/.codex/ (roles backed up first)',
-      },
+      codex: {
+        install: 'Copy ds-flash / ds-pro roles and /dsh-config, /dsh-status prompts into ~/.codex/ (MCP paths rendered for this machine, approve mode + timeout included)',
+        update: 'Re-render and overwrite role files and prompts (after path/config changes); originals backed up',
+        restore: 'Delete ds-flash / ds-pro roles and dsh prompts from ~/.codex/ (roles backed up first)',
+      },
+      zcode: {
+        install: 'Install the ZCode global policy, ds-worker / ds-reviewer agents, commands and source-aware MCP config under ~/.zcode/',
+        update: 'Re-render ZCode agents, commands and MCP entry; user files and unrelated MCP servers are preserved',
+        restore: 'Remove only dsh-crew-owned ZCode files and MCP entry (backups kept)',
+      },
     },
   },
 };
@@ -817,6 +827,7 @@ function WorkersPanel({ ctx }: { ctx: any }) {
           <div style={{ display: 'flex', gap: 6, marginTop: 8, flexWrap: 'wrap' }}>
             <span style={S.chip(!!status?.codex?.ready)}>Codex {status?.codex?.ready ? 'READY' : 'CHECK'}</span>
             <span style={S.chip(!!status?.claude?.ready)}>Claude {status?.claude?.ready ? 'READY' : 'CHECK'}</span>
+            <span style={S.chip(!!status?.zcode?.ready)}>ZCode {status?.zcode?.ready ? 'READY' : 'CHECK'}</span>
             <span style={S.chip(jobs.some((job) => job.status === 'running'))}>{jobs.filter((job) => job.status === 'running').length} running</span>
           </div>
         </div>
@@ -836,7 +847,7 @@ function WorkersPanel({ ctx }: { ctx: any }) {
       </div>
 
       <CollapsibleSection sectionId="integrations" title={copy.sectionNames.integrations}
-        summary={sectionSummary(status?.claude?.ready ? 'Claude READY' : 'Claude CHECK', status?.codex?.ready ? 'Codex READY' : 'Codex CHECK')}
+        summary={sectionSummary(status?.claude?.ready ? 'Claude READY' : 'Claude CHECK', `${status?.codex?.ready ? 'Codex READY' : 'Codex CHECK'} · ${status?.zcode?.ready ? 'ZCode READY' : 'ZCode CHECK'}`)}
         expanded={!!expandedSections.integrations} onToggle={() => toggleSection('integrations')}>
         <div style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
           <div style={S.block}>
@@ -860,6 +871,9 @@ function WorkersPanel({ ctx }: { ctx: any }) {
           {integrationRow('Codex', !!status?.codex?.installed, !!status?.codex?.ready,
             status?.codex?.ready ? null : <span title={(status?.codex?.missing ?? []).join(', ')} style={{ fontSize: 11, opacity: 0.6 }}>{(status?.codex?.missing ?? []).join(' · ')}</span>,
             'codex', 'codex-uninstall', (copy as any).tips.codex)}
+          {integrationRow('ZCode', !!status?.zcode?.installed, !!status?.zcode?.ready,
+            status?.zcode?.ready ? null : <span title={(status?.zcode?.missing ?? []).join(', ')} style={{ fontSize: 11, opacity: 0.6 }}>{(status?.zcode?.missing ?? []).join(' · ')}</span>,
+            'zcode', 'zcode-uninstall', (copy as any).tips.zcode)}
         </div>
       </CollapsibleSection>
 

package/src/hub/index.mjs

@@ -1033,8 +1033,8 @@ export async function apply(ctx) {
           // Cache-busted import: the installer must always run the code
           // currently on disk, not whatever this process first loaded —
           // a stale cached copy once re-broke user settings after a fix.
-          const { installClaudeCode, installCodex, installHudSegment, uninstallClaudeCode, uninstallCodex } =
-            await import(`../install/install.mjs?t=${Date.now()}`);
+          const { installClaudeCode, installCodex, installHudSegment, uninstallClaudeCode, uninstallCodex, installZCode, uninstallZCode } =
+            await import(`../install/install.mjs?t=${Date.now()}`);
           if (target === 'claude') {
             const base = await installClaudeCode({ statusline: !!statusline });
             const hud = installHudSegment({});
@@ -1043,10 +1043,12 @@ export async function apply(ctx) {
               actions: [...base.actions, ...hud.actions.map((a) => `hud: ${a}`)],
             });
           }
-          if (target === 'codex') return sendJson(res, 200, installCodex({}));
-          if (target === 'claude-uninstall') return sendJson(res, 200, uninstallClaudeCode({}));
-          if (target === 'codex-uninstall') return sendJson(res, 200, uninstallCodex({}));
-          return sendJson(res, 400, { ok: false, error: 'target must be claude | codex | claude-uninstall | codex-uninstall' });
+          if (target === 'codex') return sendJson(res, 200, installCodex({}));
+          if (target === 'zcode') return sendJson(res, 200, installZCode({}));
+          if (target === 'claude-uninstall') return sendJson(res, 200, uninstallClaudeCode({}));
+          if (target === 'codex-uninstall') return sendJson(res, 200, uninstallCodex({}));
+          if (target === 'zcode-uninstall') return sendJson(res, 200, uninstallZCode({}));
+          return sendJson(res, 400, { ok: false, error: 'target must be claude | codex | zcode | claude-uninstall | codex-uninstall | zcode-uninstall' });
         } catch (err) {
           return sendJson(res, 500, { ok: false, error: err?.message ?? String(err) });
         }

package/src/install/install-legacy.mjs

@@ -6,11 +6,14 @@ import { readFileSync, writeFileSync, mkdirSync, copyFileSync, existsSync, readd
 import { dirname, join, resolve, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
-import { normalizeModelPriority } from '../model-routing.mjs';
+import { normalizeModelPriority } from '../model-routing.mjs';
+import { zcodeStatus } from './zcode.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 const MARKETPLACE_NAME = 'dsh-crew';
-const PLUGIN_KEY = `dsh-crew@${MARKETPLACE_NAME}`;
+const PLUGIN_KEY = `dsh-crew@${MARKETPLACE_NAME}`;
+const POLICY_START = '<!-- DSH CREW MANAGED POLICY:START -->';
+const POLICY_END = '<!-- DSH CREW MANAGED POLICY:END -->';
 // dsh_worker_config is included so the session commands (/dsh-crew:config,
 // /dsh-config) and any orchestrator policy lookup run without an extra
 // authorization prompt.
@@ -33,6 +36,50 @@ function readText(file) {
   try { return readFileSync(file, 'utf8'); } catch { return null; }
 }
 
+function managedPolicyBlock(root) {
+  const policy = readText(join(root, 'codex', 'AGENTS.md'))?.trim();
+  if (!policy) return null;
+  return `${POLICY_START}\n${policy}\n${POLICY_END}`;
+}
+
+function installGlobalCodexPolicy({ home, root }) {
+  const file = join(home, '.codex', 'AGENTS.md');
+  const block = managedPolicyBlock(root);
+  if (!block) return { ok: false, action: 'global policy template missing' };
+  mkdirSync(dirname(file), { recursive: true });
+  const current = readText(file) ?? '';
+  const managed = new RegExp(`${POLICY_START.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}[\\s\\S]*?${POLICY_END.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`, 'm');
+  const template = readText(join(root, 'codex', 'AGENTS.md'))?.trim() ?? '';
+  let next;
+  if (managed.test(current)) next = current.replace(managed, block);
+  else if (current.trim() === template) next = `${block}\n`;
+  else next = `${current.trimEnd()}${current.trim() ? '\n\n' : ''}${block}\n`;
+  if (next !== current) {
+    backup(file);
+    writeFileSync(file, next);
+  }
+  return { ok: true, action: `global policy: ${file}` };
+}
+
+function globalCodexPolicyReady({ home, root = ROOT }) {
+  const block = managedPolicyBlock(root);
+  const text = readText(join(home, '.codex', 'AGENTS.md'));
+  return !!block && typeof text === 'string' && text.includes(block);
+}
+
+function uninstallGlobalCodexPolicy({ home }) {
+  const file = join(home, '.codex', 'AGENTS.md');
+  const current = readText(file);
+  if (typeof current !== 'string') return null;
+  const managed = new RegExp(`(?:\\r?\\n){0,2}${POLICY_START.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}[\\s\\S]*?${POLICY_END.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\r?\\n)?`, 'm');
+  if (!managed.test(current)) return null;
+  const next = current.replace(managed, '').trimEnd();
+  backup(file);
+  if (next.trim()) writeFileSync(file, `${next}\n`);
+  else rmSync(file);
+  return `codex global policy: removed managed block`;
+}
+
 function tomlSection(text, name) {
   if (typeof text !== 'string') return null;
   const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -256,7 +303,7 @@ export function writeGlobalConfig(patch) {
 }
 
 /** What is currently installed where — drives the settings-page buttons. */
-export function installStatus({ home = homedir() } = {}) {
+export function installStatus({ home = homedir(), root } = {}) {
   const settings = readJson(join(home, '.claude', 'settings.json'), {});
   const enabled = settings.enabledPlugins;
   const claudeInstalled = !!(enabled && !Array.isArray(enabled) && enabled[PLUGIN_KEY]);
@@ -282,6 +329,7 @@ export function installStatus({ home = homedir() } = {}) {
     status_prompt: !!readText(join(codexRoot, 'prompts', 'dsh-status.md'))?.trim(),
     mcp: !!mcpTarget,
     target_alignment: !!workerTarget && workerTarget === reviewerTarget && workerTarget === mcpTarget,
+    global_policy: globalCodexPolicyReady({ home }),
   };
   const codexInstalled = Object.values(components).some(Boolean)
     || existsSync(join(codexRoot, 'agents', 'ds-flash.toml'))
@@ -296,10 +344,11 @@ export function installStatus({ home = homedir() } = {}) {
       missing: claudeMissing,
     },
     codex: { installed: codexInstalled, ready: missing.length === 0, components, missing },
+    zcode: zcodeStatus({ home, ...(root ? { root } : {}) }),
   };
 }
 
-export function uninstallCodex({ home = homedir() } = {}) {
+export function uninstallCodex({ home = homedir() } = {}) {
   const actions = [];
   // Both the v0.2 roles (ds-worker / ds-reviewer) and the deprecated v0.1
   // aliases (ds-flash / ds-pro) are dsh-crew managed; uninstall removes only
@@ -308,10 +357,12 @@ export function uninstallCodex({ home = homedir() } = {}) {
     const p = join(home, '.codex', 'agents', f);
     if (existsSync(p)) { backup(p); rmSync(p); actions.push(`removed: ${p} (backup kept)`); }
   }
-  for (const f of ['dsh-config.md', 'dsh-status.md']) {
+  for (const f of ['dsh-config.md', 'dsh-status.md']) {
     const p = join(home, '.codex', 'prompts', f);
     if (existsSync(p)) { rmSync(p); actions.push(`removed: ${p}`); }
-  }
+  }
+  const policyAction = uninstallGlobalCodexPolicy({ home });
+  if (policyAction) actions.push(policyAction);
   // Remove only the dsh-crew entry from [mcp_servers], keeping any other
   // MCP servers the user configured.
   const configFile = join(home, '.codex', 'config.toml');
@@ -428,7 +479,7 @@ export async function installClaudeCode({ home = homedir(), statusline = false,
   return { ok: true, actions };
 }
 
-export function installCodex({ home = homedir(), scope, root = ROOT } = {}) {
+export function installCodex({ home = homedir(), scope, root = ROOT } = {}) {
   const actions = [];
   const agentsDir = scope === 'project' ? join(process.cwd(), '.codex', 'agents') : join(home, '.codex', 'agents');
   mkdirSync(agentsDir, { recursive: true });
@@ -455,10 +506,13 @@ export function installCodex({ home = homedir(), scope, root = ROOT } = {}) {
     writeFileSync(join(promptsDir, f), readFileSync(join(promptsSrc, f), 'utf8'));
     actions.push(`prompt: ${join(promptsDir, f)}`);
   }
-  if (scope !== 'project') {
-    const act = writeGlobalCodexMcpServer(home, renderedPath);
-    actions.push(...act);
-  }
+  if (scope !== 'project') {
+    const act = writeGlobalCodexMcpServer(home, renderedPath);
+    actions.push(...act);
+    const policy = installGlobalCodexPolicy({ home, root });
+    if (!policy.ok) return { ok: false, actions: [...actions, policy.action] };
+    actions.push(policy.action);
+  }
   return { ok: true, actions };
 }
 

package/src/install/install.mjs

@@ -4,7 +4,9 @@
 // This module keeps all installer exports while replacing only global config
 // read/write semantics with schema-v3 canonical authority.
 
-export * from './install-legacy.mjs';
+export * from './install-legacy.mjs';
+export * from './windows-startup.mjs';
+export * from './zcode.mjs';
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';

package/src/install/npx-lifecycle.mjs

@@ -549,14 +549,30 @@ async function activateRelease({ home, releaseDir, manifest, log, installer }) {
   }
   log(`✓ Harness plugin registered (dedicated dsh-crew profile → ${releaseDir})`);
 
-  const codex = installer.installCodex({ home, root: releaseDir });
+  const codex = installer.installCodex({ home, root: releaseDir });
   if (codex.ok === false) {
     log(`✗ Codex Desktop integration failed: ${(codex.actions ?? []).join('; ')}`);
     return false;
   }
-  log('✓ Codex Desktop integration');
-
-  const claude = await installer.installClaudeCode({ home, root: releaseDir });
+  log('✓ Codex Desktop integration');
+
+  if (installer.installZCode) {
+    const zcode = installer.installZCode({ home, root: releaseDir });
+    if (zcode.ok === false) {
+      log(`✗ ZCode integration failed (${zcode.code ?? 'unknown'})`);
+      return false;
+    }
+    log('✓ ZCode integration');
+  }
+
+  const startup = installer.installWindowsStartup?.({ home, root: releaseDir });
+  if (startup?.ok === false) {
+    log(`✗ Windows login startup failed (${startup.code ?? 'unknown'})`);
+    return false;
+  }
+  if (startup?.supported) log('✓ Windows login startup');
+
+  const claude = await installer.installClaudeCode({ home, root: releaseDir });
   if (claude.ok === false) {
     log(`✗ Claude Code integration failed`);
     return false;
@@ -944,11 +960,17 @@ export function npxStatus({
     } catch { dshPlugin = 'unknown'; }
   }
 
-  const st = installer.installStatus ? installer.installStatus({ home }) : realInstaller.installStatus({ home });
-  const codex = st?.codex?.installed ? 'installed' : 'not installed';
-  const claude = st?.claude?.installed ? 'installed' : 'not installed';
+  const st = installer.installStatus
+    ? installer.installStatus({ home, root: pointer?.path ?? runningPackageRoot() })
+    : realInstaller.installStatus({ home, root: pointer?.path ?? runningPackageRoot() });
+  const codex = st?.codex?.installed ? 'installed' : 'not installed';
+  const zcode = st?.zcode?.installed ? 'installed' : 'not installed';
+  const claude = st?.claude?.installed ? 'installed' : 'not installed';
   const official = officialWebIntegrationStatus({ home, releaseDir: pointer?.path });
-  const officialWeb = !official.enabled ? 'disabled' : official.healthy ? 'installed' : 'needs repair';
+  const officialWeb = !official.enabled ? 'disabled' : official.healthy ? 'installed' : 'needs repair';
+  const startupState = installer.windowsStartupStatus?.({ home });
+  const windowsStartup = !startupState?.supported ? 'not supported'
+    : startupState.ready ? 'installed' : startupState.installed ? 'needs repair' : 'not installed';
 
   log(`DSH Crew launcher/candidate: ${candidateVersion ?? 'unknown'}`);
   log(`Installed DSH Crew payload: ${installedLine}`);
@@ -964,8 +986,10 @@ export function npxStatus({
   }
   log(`DSH plugin: ${dshPlugin} (dedicated dsh-crew profile on 3210)`);
   log(`Official 3080 UI bridge: ${officialWeb}`);
-  log(`Codex Desktop integration: ${codex}`);
-  log(`Claude Code integration: ${claude}`);
+  log(`Codex Desktop integration: ${codex}`);
+  log(`ZCode integration: ${zcode}`);
+  log(`Claude Code integration: ${claude}`);
+  log(`Windows login startup: ${windowsStartup}`);
 
   return {
     ok: true,
@@ -974,9 +998,11 @@ export function npxStatus({
     installedPath: pointer?.path ?? null,
     dshPlugin,
     officialWeb,
-    codex,
-    claude,
-  };
+    codex,
+    zcode,
+    claude,
+    windowsStartup,
+  };
 }
 
 export async function npxUninstall({
@@ -992,13 +1018,23 @@ export async function npxUninstall({
   const pointer = readCurrentPointer({ home });
   const name = pointer?.name ?? readManifest(runningPackageRoot())?.name;
 
-  const cx = installer.uninstallCodex({ home });
+  const cx = installer.uninstallCodex({ home });
   if (cx.ok !== false) log('✓ Codex Desktop integration removed');
-  else fail('Codex Desktop integration removal failed');
-
-  const cl = installer.uninstallClaudeCode ? await installer.uninstallClaudeCode({ home }) : realInstaller.uninstallClaudeCode({ home });
-  if (cl.ok !== false) log('✓ Claude Code integration removed');
-  else fail('Claude Code integration removal failed');
+  else fail('Codex Desktop integration removal failed');
+
+  if (installer.uninstallZCode) {
+    const zc = installer.uninstallZCode({ home });
+    if (zc.ok !== false) log('✓ ZCode integration removed');
+    else fail('ZCode integration removal failed');
+  }
+
+  const cl = installer.uninstallClaudeCode ? await installer.uninstallClaudeCode({ home }) : realInstaller.uninstallClaudeCode({ home });
+  if (cl.ok !== false) log('✓ Claude Code integration removed');
+  else fail('Claude Code integration removal failed');
+
+  const startup = installer.uninstallWindowsStartup?.({ home });
+  if (startup?.ok === false) fail('Windows login startup removal failed');
+  else if (startup?.supported) log('✓ Windows login startup removed');
 
   const official = removeOfficialWebIntegration({ home, preserveIntent: !purge, remember: !purge });
   if (!official.ok) fail(`official 3080 bridge removal failed (${official.code ?? 'unknown'})`);