@ran-sh/dsh-crew 1.9.0 → 1.10.0

package/README.zh.md

@@ -1,116 +1,116 @@
-# DSH Crew
-
-DSH Crew 是附着在 DeepSeek 官方 Harness 上的 Crew 编排插件，为 Codex Desktop、
-ZCode 和 Claude Code 增加 Worker/Reviewer 调度、模型优先级、任务跟踪和能力感知安全门。
-
-[English](./README.md)
-
-## 快速开始
-
-需要 Windows、Node.js 和 Git。目前受管 3210 监督仅支持 Windows；Linux 和 macOS
-暂不属于生产运行平台。
-桌面前台还需要单独安装官方 CLI：`npm install -g @deepseek-ai/dsh@latest`，
-并确保 PATH 中能找到 `dsh.cmd`。
-
-```bash
-npm install -g @ran-sh/dsh-crew@latest
-dsh-crew install
-```
-
-DSH Crew 安装在 DeepSeek 官方 Harness 的专用 `dsh-crew` profile 中，并由 3210
-提供服务。这个 profile 是 Crew 的 canonical control and execution surface。
-
-桌面启动器打开官方 3080，并在后台隐藏启动 Crew 3210，不自动打开后台网页。
-后台模式和登录启动项只启动 Crew。Crew 安装器不修改官方 profile；官方程序
-正常启动时自行管理它的运行状态。
-
-Windows 安装会注册登录启动项。如需立即启动并打开 Crew 控制台：
-
-```powershell
-& "$env:USERPROFILE\.config\dsh-crew\launchers\start-dsh-crew.cmd" --open
-```
-
-日常使用 <http://127.0.0.1:3080/>；需要后台高级配置时再访问
-<http://127.0.0.1:3210/>。桌面启动通过 Crew 自有目录中的 `--patch` 叠加配置
-挂载简易面板，不写入官方 profile。3080 的按钮打开 3210，3210 的按钮打开 3080。
-
-安装、更新和回滚也会自动收敛 Windows watcher：系统会精确交接旧 watcher，
-并且只有在新的 3210 Crew 与 DSH 版本验证通过后才报告完成；整个过程不涉及
-重启 3080。
-
-```bash
-dsh-crew status
-dsh-crew inspect
-```
-
-全新安装只包含内置 DeepSeek 路由。其他 Provider 凭据、模型优先级和可选集成需要
-在本机设置中自行配置，绝不会打包进发布版本。
-
-| 界面 | 用途 |
-| --- | --- |
-| `3080` | 日常官方 Harness 前台，桌面启动时打开 |
-| `3210` | Crew 后台执行实例，默认隐藏，需要时进入高级配置 |
-
-进入 **设置 → DSH Crew**，刷新 Harness Models，并分别排列 Worker 与 Reviewer
-的模型顺序。然后直接告诉 Codex、ZCode 或 Claude：
-
-```text
-使用 ds-worker 实现这个改动并运行测试。
-使用 ds-reviewer 审查结果。
-```
-
-集成会先检查 Crew 的实时能力；已选择 Crew 后若能力不可用，会暂停等待操作者
-决定修复 Crew 还是由主代理本地完成，不会静默降级。
-
-## 常用命令
-
-```bash
-dsh-crew inspect          # 实时能力与就绪度
-dsh-crew jobs list        # 任务与 Result Contract
-dsh-crew providers list   # 3210 Harness Provider 清单（不含密钥）
-dsh-crew providers migration-status # 检查旧 profile Provider，不会自动迁移
-dsh-crew providers migrate-plan <provider>
-dsh-crew providers migrate <provider> --plan <id> --confirm # 写入用户层，重启 3210 并验证
-dsh-crew providers rollback-migration <provider> --plan <id> --confirm
-dsh-crew providers probe <provider-id>
-curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # 仅查看引用/孤儿报告
-dsh-crew credentials list  # 不含密钥值的引用清单
-dsh-crew credentials purge-plan env:NAME
-dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
-dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
-dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
-dsh-crew releases list     # 查看保留且已验证的版本
-dsh-crew rollback <version> # 切换版本并验证 3210 runtime
-dsh-crew update           # 更新并修复已启用集成
-dsh-crew uninstall        # 移除受管文件，保留配置/备份
-```
-
-专用的官方 Harness 运行时状态隔离在 `~/.config/dsh-crew/harness`，使用
-`profile: dsh-crew`；DSH Crew 本身仍然是插件，并非 DeepSeek Harness 的分支或替代品。
-官方 `web` profile 不属于 Crew 且对 Crew 始终只读；旧版 3080 bridge 若仍存在，
-只会作为已弃用诊断项显示。
-
-## 旧启动器迁移
-
-对于 `<= 0.3.3` 的旧启动器，请先刷新启动器。旧 updater 无法发现更新，也无法被追溯修复：
-
-```bash
-npm install -g @ran-sh/dsh-crew@latest
-dsh-crew update
-```
-
-## 从源码安装
-
-```bash
-git clone https://github.com/Ran-sh/dsh-crew.git
-cd dsh-crew
-node scripts/setup.mjs install
-node scripts/setup.mjs status
-node scripts/setup.mjs uninstall
-```
-
-测试：`node --test test/*.test.mjs`。更多信息见[安装方案](./docs/installation.md)、
-[界面分工](./docs/ui-surfaces.md)、[就绪矩阵](./docs/readiness-matrix.md)和
-[任务合同](./docs/job-contracts.md)。
-
-MIT
+# DSH Crew
+
+DSH Crew 是附着在 DeepSeek 官方 Harness 上的 Crew 编排插件，为 Codex Desktop、
+ZCode 和 Claude Code 增加 Worker/Reviewer 调度、模型优先级、任务跟踪和能力感知安全门。
+
+[English](./README.md)
+
+## 快速开始
+
+需要 Windows、Node.js 和 Git。目前受管 3210 监督仅支持 Windows；Linux 和 macOS
+暂不属于生产运行平台。
+桌面前台还需要单独安装官方 CLI：`npm install -g @deepseek-ai/dsh@latest`，
+并确保 PATH 中能找到 `dsh.cmd`。
+
+```bash
+npm install -g @ran-sh/dsh-crew@latest
+dsh-crew install
+```
+
+DSH Crew 安装在 DeepSeek 官方 Harness 的专用 `dsh-crew` profile 中，并由 3210
+提供服务。这个 profile 是 Crew 的 canonical control and execution surface。
+
+桌面启动器打开官方 3080，并在后台隐藏启动 Crew 3210，不自动打开后台网页。
+后台模式和登录启动项只启动 Crew。Crew 安装器不修改官方 profile；官方程序
+正常启动时自行管理它的运行状态。
+
+Windows 安装会注册登录启动项。如需立即启动并打开 Crew 控制台：
+
+```powershell
+& "$env:USERPROFILE\.config\dsh-crew\launchers\start-dsh-crew.cmd" --open
+```
+
+日常使用 <http://127.0.0.1:3080/>；需要后台高级配置时再访问
+<http://127.0.0.1:3210/>。桌面启动通过 Crew 自有目录中的 `--patch` 叠加配置
+挂载简易面板，不写入官方 profile。3080 的按钮打开 3210，3210 的按钮打开 3080。
+
+安装、更新和回滚也会自动收敛 Windows watcher：系统会精确交接旧 watcher，
+并且只有在新的 3210 Crew 与 DSH 版本验证通过后才报告完成；整个过程不涉及
+重启 3080。
+
+```bash
+dsh-crew status
+dsh-crew inspect
+```
+
+全新安装只包含内置 DeepSeek 路由。其他 Provider 凭据、模型优先级和可选集成需要
+在本机设置中自行配置，绝不会打包进发布版本。
+
+| 界面 | 用途 |
+| --- | --- |
+| `3080` | 日常官方 Harness 前台，桌面启动时打开 |
+| `3210` | Crew 后台执行实例，默认隐藏，需要时进入高级配置 |
+
+进入 **设置 → DSH Crew**，刷新 Harness Models，并分别排列 Worker 与 Reviewer
+的模型顺序。然后直接告诉 Codex、ZCode 或 Claude：
+
+```text
+使用 ds-worker 实现这个改动并运行测试。
+使用 ds-reviewer 审查结果。
+```
+
+集成会先检查 Crew 的实时能力；已选择 Crew 后若能力不可用，会暂停等待操作者
+决定修复 Crew 还是由主代理本地完成，不会静默降级。
+
+## 常用命令
+
+```bash
+dsh-crew inspect          # 实时能力与就绪度
+dsh-crew jobs list        # 任务与 Result Contract
+dsh-crew providers list   # 3210 Harness Provider 清单（不含密钥）
+dsh-crew providers migration-status # 检查旧 profile Provider，不会自动迁移
+dsh-crew providers migrate-plan <provider>
+dsh-crew providers migrate <provider> --plan <id> --confirm # 写入用户层，重启 3210 并验证
+dsh-crew providers rollback-migration <provider> --plan <id> --confirm
+dsh-crew providers probe <provider-id>
+curl http://127.0.0.1:3210/_dsh/dsh-crew/credential-references  # 仅查看引用/孤儿报告
+dsh-crew credentials list  # 不含密钥值的引用清单
+dsh-crew credentials purge-plan env:NAME
+dsh-crew credentials purge env:NAME --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew providers delete-plan <provider-id> --replacement-default <provider-id>
+dsh-crew providers delete <provider-id> --plan <plan-id> --expected-revision <sha256> --confirm
+dsh-crew releases list     # 查看保留且已验证的版本
+dsh-crew rollback <version> # 切换版本并验证 3210 runtime
+dsh-crew update           # 更新并修复已启用集成
+dsh-crew uninstall        # 移除受管文件，保留配置/备份
+```
+
+专用的官方 Harness 运行时状态隔离在 `~/.config/dsh-crew/harness`，使用
+`profile: dsh-crew`；DSH Crew 本身仍然是插件，并非 DeepSeek Harness 的分支或替代品。
+官方 `web` profile 不属于 Crew 且对 Crew 始终只读；旧版 3080 bridge 若仍存在，
+只会作为已弃用诊断项显示。
+
+## 旧启动器迁移
+
+对于 `<= 0.3.3` 的旧启动器，请先刷新启动器。旧 updater 无法发现更新，也无法被追溯修复：
+
+```bash
+npm install -g @ran-sh/dsh-crew@latest
+dsh-crew update
+```
+
+## 从源码安装
+
+```bash
+git clone https://github.com/Ran-sh/dsh-crew.git
+cd dsh-crew
+node scripts/setup.mjs install
+node scripts/setup.mjs status
+node scripts/setup.mjs uninstall
+```
+
+测试：`node --test test/*.test.mjs`。更多信息见[安装方案](./docs/installation.md)、
+[界面分工](./docs/ui-surfaces.md)、[就绪矩阵](./docs/readiness-matrix.md)和
+[任务合同](./docs/job-contracts.md)。
+
+MIT

package/agents/ds-flash.md

@@ -1,24 +1,24 @@
----
-name: ds-flash
-description: DEPRECATED alias for ds-worker with a Flash model-class hint. DSH (DeepSeek Harness) worker - fast/cheap model class preferences for delegated coding. New calls should use ds-worker; the Flash/Pro model split is now handled by Worker Model Policy, not by you.
-model: haiku
----
-
-Deprecated ds-flash alias; prefer ds-worker/ds-reviewer for new work.
-Thin dispatcher only: do not edit files or perform the delegated task locally.
-
-1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
-   disabled capabilities. Use role "worker", legacy_tier "flash".
-2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
-   constraints and acceptance evidence; exclude unrelated chat history.
-   Backend policy selects models. Omit effort unless explicitly requested.
-   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
-3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
-   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
-4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
-   Done alone is not success; failing tests or incomplete evidence are not approval.
-   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
-   provider or model metadata as task requirements. Never invent missing counters.
-
-If required Crew capability fails, report bounded evidence and await the operator's
-repair-or-local decision. Do not repair, fall back or switch tiers yourself.
+---
+name: ds-flash
+description: DEPRECATED alias for ds-worker with a Flash model-class hint. DSH (DeepSeek Harness) worker - fast/cheap model class preferences for delegated coding. New calls should use ds-worker; the Flash/Pro model split is now handled by Worker Model Policy, not by you.
+model: haiku
+---
+
+Deprecated ds-flash alias; prefer ds-worker/ds-reviewer for new work.
+Thin dispatcher only: do not edit files or perform the delegated task locally.
+
+1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
+   disabled capabilities. Use role "worker", legacy_tier "flash".
+2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
+   constraints and acceptance evidence; exclude unrelated chat history.
+   Backend policy selects models. Omit effort unless explicitly requested.
+   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
+3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
+   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
+4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
+   Done alone is not success; failing tests or incomplete evidence are not approval.
+   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
+   provider or model metadata as task requirements. Never invent missing counters.
+
+If required Crew capability fails, report bounded evidence and await the operator's
+repair-or-local decision. Do not repair, fall back or switch tiers yourself.

package/agents/ds-pro.md

@@ -1,24 +1,24 @@
----
-name: ds-pro
-description: DEPRECATED alias for ds-worker with a Pro (strong) model-class hint, or ds-reviewer when the request is explicitly a review. DSH (DeepSeek Harness) worker. New calls should use ds-worker or ds-reviewer.
-model: haiku
----
-
-Deprecated ds-pro alias; prefer ds-worker/ds-reviewer for new work.
-Thin dispatcher only: do not edit files or perform the delegated task locally.
-
-1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
-   disabled capabilities. Explicit review → role "reviewer"; otherwise role "worker". Preserve legacy_tier "pro".
-2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
-   constraints and acceptance evidence; exclude unrelated chat history.
-   Backend policy selects models. Omit effort unless explicitly requested.
-   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
-3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
-   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
-4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
-   Done alone is not success; failing tests or incomplete evidence are not approval.
-   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
-   provider or model metadata as task requirements. Never invent missing counters.
-
-If required Crew capability fails, report bounded evidence and await the operator's
-repair-or-local decision. Do not repair, fall back or switch tiers yourself.
+---
+name: ds-pro
+description: DEPRECATED alias for ds-worker with a Pro (strong) model-class hint, or ds-reviewer when the request is explicitly a review. DSH (DeepSeek Harness) worker. New calls should use ds-worker or ds-reviewer.
+model: haiku
+---
+
+Deprecated ds-pro alias; prefer ds-worker/ds-reviewer for new work.
+Thin dispatcher only: do not edit files or perform the delegated task locally.
+
+1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
+   disabled capabilities. Explicit review → role "reviewer"; otherwise role "worker". Preserve legacy_tier "pro".
+2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
+   constraints and acceptance evidence; exclude unrelated chat history.
+   Backend policy selects models. Omit effort unless explicitly requested.
+   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
+3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
+   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
+4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
+   Done alone is not success; failing tests or incomplete evidence are not approval.
+   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
+   provider or model metadata as task requirements. Never invent missing counters.
+
+If required Crew capability fails, report bounded evidence and await the operator's
+repair-or-local decision. Do not repair, fall back or switch tiers yourself.

package/agents/ds-reviewer.md

@@ -1,23 +1,23 @@
----
-name: ds-reviewer
-description: DSH (DeepSeek Harness) reviewer role - independent review of a completed implementation. Inspects the workspace diff, tests and risks and returns a verdict. Review-only by default; does NOT implement.
-model: haiku
----
-
-Thin dispatcher only: do not edit files or perform the delegated task locally.
-
-1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
-   disabled capabilities. Use role "reviewer".
-2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
-   constraints and acceptance evidence; exclude unrelated chat history.
-   Backend policy selects models. Omit effort unless explicitly requested.
-3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
-   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
-4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
-   Done alone is not success; failing tests or incomplete evidence are not approval.
-   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
-   provider or model metadata as task requirements. Never invent missing counters.
-
-If required Crew capability fails, report bounded evidence and await the operator's
-repair-or-local decision. Do not repair, fall back or switch tiers yourself.
-Review is read-only; report requested fixes, do not implement them.
+---
+name: ds-reviewer
+description: DSH (DeepSeek Harness) reviewer role - independent review of a completed implementation. Inspects the workspace diff, tests and risks and returns a verdict. Review-only by default; does NOT implement.
+model: haiku
+---
+
+Thin dispatcher only: do not edit files or perform the delegated task locally.
+
+1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
+   disabled capabilities. Use role "reviewer".
+2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
+   constraints and acceptance evidence; exclude unrelated chat history.
+   Backend policy selects models. Omit effort unless explicitly requested.
+3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
+   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
+4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
+   Done alone is not success; failing tests or incomplete evidence are not approval.
+   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
+   provider or model metadata as task requirements. Never invent missing counters.
+
+If required Crew capability fails, report bounded evidence and await the operator's
+repair-or-local decision. Do not repair, fall back or switch tiers yourself.
+Review is read-only; report requested fixes, do not implement them.

package/agents/ds-worker.md

@@ -1,23 +1,23 @@
----
-name: ds-worker
-description: DSH Worker dispatcher for bounded implementation, fixes, tests and inspection; backend policy selects the model. Return compact evidence, never implement locally.
-model: haiku
----
-
-Thin dispatcher only: do not edit files or perform the delegated task locally.
-
-1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
-   disabled capabilities. Use role "worker".
-2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
-   constraints and acceptance evidence; exclude unrelated chat history.
-   Backend policy selects models. Omit effort unless explicitly requested.
-   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
-3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
-   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
-4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
-   Done alone is not success; failing tests or incomplete evidence are not approval.
-   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
-   provider or model metadata as task requirements. Never invent missing counters.
-
-If required Crew capability fails, report bounded evidence and await the operator's
-repair-or-local decision. Do not repair, fall back or switch tiers yourself.
+---
+name: ds-worker
+description: DSH Worker dispatcher for bounded implementation, fixes, tests and inspection; backend policy selects the model. Return compact evidence, never implement locally.
+model: haiku
+---
+
+Thin dispatcher only: do not edit files or perform the delegated task locally.
+
+1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
+   disabled capabilities. Use role "worker".
+2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
+   constraints and acceptance evidence; exclude unrelated chat history.
+   Backend policy selects models. Omit effort unless explicitly requested.
+   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
+3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
+   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
+4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
+   Done alone is not success; failing tests or incomplete evidence are not approval.
+   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
+   provider or model metadata as task requirements. Never invent missing counters.
+
+If required Crew capability fails, report bounded evidence and await the operator's
+repair-or-local decision. Do not repair, fall back or switch tiers yourself.

package/bin/dsh-crew.mjs

@@ -1,16 +1,16 @@
-#!/usr/bin/env node
-// dsh-crew CLI entry for the packaged npm payload.
-//
-//   npx @ran-sh/dsh-crew@latest install|status|update|uninstall
-//   npm exec --package=@ran-sh/dsh-crew@latest -- dsh-crew status
-//
-// The lifecycle implementation lives in src/install/npx-lifecycle.mjs so the
-// commands are testable in-process; this wrapper only dispatches.
-
-import { runNpxCli } from '../src/install/npx-lifecycle.mjs';
-
-if (process.argv[2] === 'history' && process.argv[3] === 'recover') {
-  const { runProductionHistory } = await import('../src/history/runner.mjs');
-  try { await runProductionHistory({ recover: true }); console.log('History maintenance recovered.'); }
-  catch { console.error('HISTORY_RECOVERY_REQUIRED: recovery did not complete; data and maintenance evidence were retained.'); process.exitCode = 1; }
-} else process.exitCode = await runNpxCli();
+#!/usr/bin/env node
+// dsh-crew CLI entry for the packaged npm payload.
+//
+//   npx @ran-sh/dsh-crew@latest install|status|update|uninstall
+//   npm exec --package=@ran-sh/dsh-crew@latest -- dsh-crew status
+//
+// The lifecycle implementation lives in src/install/npx-lifecycle.mjs so the
+// commands are testable in-process; this wrapper only dispatches.
+
+import { runNpxCli } from '../src/install/npx-lifecycle.mjs';
+
+if (process.argv[2] === 'history' && process.argv[3] === 'recover') {
+  const { runProductionHistory } = await import('../src/history/runner.mjs');
+  try { await runProductionHistory({ recover: true }); console.log('History maintenance recovered.'); }
+  catch { console.error('HISTORY_RECOVERY_REQUIRED: recovery did not complete; data and maintenance evidence were retained.'); process.exitCode = 1; }
+} else process.exitCode = await runNpxCli();

package/codex/agents/ds-flash.toml

@@ -1,34 +1,34 @@
-# Codex agent role: DEPRECATED alias for ds-worker (Flash model-class hint).
-# Install through dsh-crew; the installer resolves __DSH_CREW_ROOT__.
-# Prefer ds-worker; model selection is now handled by the Worker Model Policy.
-
-name = "ds-flash"
-description = "DEPRECATED alias for ds-worker (DSH worker, Flash model-class hint). Spawn for simple, well-scoped subtasks. New calls should use ds-worker."
-model = "gpt-5.4-mini"
-
-developer_instructions = """
-Deprecated ds-flash alias; prefer ds-worker/ds-reviewer for new work.
-Thin dispatcher only: do not edit files or perform the delegated task locally.
-
-1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
-   disabled capabilities. Use role "worker", legacy_tier "flash".
-2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
-   constraints and acceptance evidence; exclude unrelated chat history.
-   Backend policy selects models. Omit effort unless explicitly requested.
-   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
-3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
-   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
-4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
-   Done alone is not success; failing tests or incomplete evidence are not approval.
-   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
-   provider or model metadata as task requirements. Never invent missing counters.
-
-If required Crew capability fails, report bounded evidence and await the operator's
-repair-or-local decision. Do not repair, fall back or switch tiers yourself.
-"""
-
-[mcp_servers.dsh-crew]
-command = "node"
-args = ["__DSH_CREW_ROOT__/src/server.mjs"]
-default_tools_approval_mode = "approve"
-tool_timeout_sec = 3600
+# Codex agent role: DEPRECATED alias for ds-worker (Flash model-class hint).
+# Install through dsh-crew; the installer resolves __DSH_CREW_ROOT__.
+# Prefer ds-worker; model selection is now handled by the Worker Model Policy.
+
+name = "ds-flash"
+description = "DEPRECATED alias for ds-worker (DSH worker, Flash model-class hint). Spawn for simple, well-scoped subtasks. New calls should use ds-worker."
+model = "gpt-5.4-mini"
+
+developer_instructions = """
+Deprecated ds-flash alias; prefer ds-worker/ds-reviewer for new work.
+Thin dispatcher only: do not edit files or perform the delegated task locally.
+
+1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
+   disabled capabilities. Use role "worker", legacy_tier "flash".
+2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
+   constraints and acceptance evidence; exclude unrelated chat history.
+   Backend policy selects models. Omit effort unless explicitly requested.
+   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
+3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
+   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
+4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
+   Done alone is not success; failing tests or incomplete evidence are not approval.
+   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
+   provider or model metadata as task requirements. Never invent missing counters.
+
+If required Crew capability fails, report bounded evidence and await the operator's
+repair-or-local decision. Do not repair, fall back or switch tiers yourself.
+"""
+
+[mcp_servers.dsh-crew]
+command = "node"
+args = ["__DSH_CREW_ROOT__/src/server.mjs"]
+default_tools_approval_mode = "approve"
+tool_timeout_sec = 3600

package/codex/agents/ds-pro.toml

@@ -1,34 +1,34 @@
-# Codex agent role: DEPRECATED alias for ds-worker (strong hint) / ds-reviewer.
-# Install through dsh-crew; the installer resolves __DSH_CREW_ROOT__.
-# Prefer ds-worker or ds-reviewer; model selection is now handled by Model Policy.
-
-name = "ds-pro"
-description = "DEPRECATED alias for ds-worker with a Pro (strong) model-class hint, or ds-reviewer when the request is explicitly a review. New calls should use ds-worker or ds-reviewer."
-model = "gpt-5.4-mini"
-
-developer_instructions = """
-Deprecated ds-pro alias; prefer ds-worker/ds-reviewer for new work.
-Thin dispatcher only: do not edit files or perform the delegated task locally.
-
-1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
-   disabled capabilities. Explicit review → role "reviewer"; otherwise role "worker". Preserve legacy_tier "pro".
-2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
-   constraints and acceptance evidence; exclude unrelated chat history.
-   Backend policy selects models. Omit effort unless explicitly requested.
-   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
-3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
-   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
-4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
-   Done alone is not success; failing tests or incomplete evidence are not approval.
-   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
-   provider or model metadata as task requirements. Never invent missing counters.
-
-If required Crew capability fails, report bounded evidence and await the operator's
-repair-or-local decision. Do not repair, fall back or switch tiers yourself.
-"""
-
-[mcp_servers.dsh-crew]
-command = "node"
-args = ["__DSH_CREW_ROOT__/src/server.mjs"]
-default_tools_approval_mode = "approve"
-tool_timeout_sec = 3600
+# Codex agent role: DEPRECATED alias for ds-worker (strong hint) / ds-reviewer.
+# Install through dsh-crew; the installer resolves __DSH_CREW_ROOT__.
+# Prefer ds-worker or ds-reviewer; model selection is now handled by Model Policy.
+
+name = "ds-pro"
+description = "DEPRECATED alias for ds-worker with a Pro (strong) model-class hint, or ds-reviewer when the request is explicitly a review. New calls should use ds-worker or ds-reviewer."
+model = "gpt-5.4-mini"
+
+developer_instructions = """
+Deprecated ds-pro alias; prefer ds-worker/ds-reviewer for new work.
+Thin dispatcher only: do not edit files or perform the delegated task locally.
+
+1. Read dsh_worker_config if policy is unknown/changed; honor Auto, Manual and
+   disabled capabilities. Explicit review → role "reviewer"; otherwise role "worker". Preserve legacy_tier "pro".
+2. Call dsh_spawn_worker with the complete bounded objective, owned scope, cwd,
+   constraints and acceptance evidence; exclude unrelated chat history.
+   Backend policy selects models. Omit effort unless explicitly requested.
+   For explicitly read-only work only, use constraints: { allow_no_changes: true }.
+3. Save the workflow ID. Follow the same job_id via dsh_worker_result with
+   compact detail and a bounded wait within the host timeout. Running is not failure; never redispatch a duplicate.
+4. Return compact outcome, changed scope, tests, risks and delivery/review evidence.
+   Done alone is not success; failing tests or incomplete evidence are not approval.
+   Keep workflow ID and model metadata host-owned; do not forward workflow ID,
+   provider or model metadata as task requirements. Never invent missing counters.
+
+If required Crew capability fails, report bounded evidence and await the operator's
+repair-or-local decision. Do not repair, fall back or switch tiers yourself.
+"""
+
+[mcp_servers.dsh-crew]
+command = "node"
+args = ["__DSH_CREW_ROOT__/src/server.mjs"]
+default_tools_approval_mode = "approve"
+tool_timeout_sec = 3600