dsh-zen-remote 2.2.2 → 2.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-zen-remote",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "一个插件、两种角色：主服务端把 DeepSeek Harness 变成手机能安全访问的 PWA（移动端界面、配对码网关、Web Push），并把选定会话共享给已配对的桌面端；子客户端在另一台 DSH 桌面端的侧边栏里远程使用这些会话。One DSH plugin, two roles: the host turns DeepSeek Harness into a phone-reachable PWA (mobile UI, pairing-code gateway behind your own reverse proxy, Web Push) and shares chosen sessions to paired desktops; the client uses those sessions remotely from another DSH desktop app's sidebar.",
   "license": "MIT",
   "type": "module",
@@ -115,42 +115,42 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5-alpha.1",
+    "@deepseek-ai/cordis": "4.0.5-alpha.2",
     "@deepseek-ai/cosmokit": "1.8.5",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-remotes": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-workspace-controller": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-scope": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-log-export": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-query": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-stats": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-token-meter": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-util-crypto": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-workspace": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-api-remotes": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-api-session-controller": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-api-workspace-controller": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-log-export": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-query": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-stats": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-token-meter": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-util-crypto": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-workspace": "0.2.1-alpha.3",
     "@deepseek-ai/schemastery": "3.18.4",
     "@types/node": "^26.2.0",
     "@types/react": "~18.3.1",

package/src/admin-routes.ts

@@ -37,6 +37,7 @@
  * drive it over a real socket with a mock gateway and a mock admit.
  */
 
+import { withPeer } from './owner-peer.js'
 import { request as httpRequest } from 'node:http'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { ConfigSource, ZenRemoteConfig } from './config.js'
@@ -150,6 +151,8 @@ export interface AdminHandlerOptions {
    * share trusts the table alone. The lookup itself must never be allowed to
    * throw into the route, so callers wrap it. */
   typert?: () => RelayGateway | undefined
+  /** The owner Peer gateway calls are made as (DSH 0.2.1-alpha.3+); see owner-peer.ts. */
+  getPeer?: () => unknown
   /** Live agent roster for the busy restore a successful `share` performs.
    * Absent or throwing means "no information": nothing is marked busy. */
   listAgents?: () => readonly AgentStatusLike[]
@@ -358,12 +361,12 @@ async function projectionOf(options: AdminHandlerOptions, sessionId: string): Pr
     return { kind: 'no-gateway' }
   }
   if (gateway === undefined) return { kind: 'no-gateway' }
-  const value = await gateway.invoke({
+  const value = await gateway.invoke(withPeer({
     namespace: 'session',
     method: 'projections',
     args: { request: { sessionId } },
     signal: AbortSignal.timeout(options.projectionTimeoutMs ?? PROJECTION_TIMEOUT_MS),
-  })
+  }, options.getPeer))
   if (value === null || value === undefined) return { kind: 'no-session' }
   const values = (value as { values?: unknown }).values
   return {

package/src/index.ts

@@ -15,6 +15,7 @@
  * the package.json dsh.client declaration.
  */
 
+import { createOwnerPeerSource } from './owner-peer.js'
 import { lstat, mkdir, open, realpath, rm } from 'node:fs/promises'
 import type { FileHandle } from 'node:fs/promises'
 import type { IncomingMessage, ServerResponse } from 'node:http'
@@ -715,6 +716,7 @@ export function apply(ctx: Context, config: MobileNavConfig = {}): void {
           // which would turn every shares request into a 500.
           store,
           typert: () => webCtx.reflect.get('typertGateway') as RelayGateway | undefined,
+          getPeer: createOwnerPeerSource(() => webCtx.connection),
           listAgents: () => (webCtx.reflect.get('agents') as { list(): readonly AgentStatusLike[] } | undefined)?.list() ?? [],
           // The "who is looking" badge (T33a2): read through whichever relay
           // handler is live right now. sessionQuery likewise — the share
@@ -780,6 +782,7 @@ export function apply(ctx: Context, config: MobileNavConfig = {}): void {
       // registry and pin those throwaway values for the row's lifetime.
       // ~7 ms per computation against a full registry; a failed compute
       // lands as the empty map inside the relay handler's own guard.
+      const relayPeer = createOwnerPeerSource(() => relayCtx.reflect.get('connection'))
       relayCtx.effect(() => {
         // The plugin bridge's loopback facts (PB-3), both read PER REQUEST
         // through the reflection layer: the web server may have restarted on
@@ -812,6 +815,10 @@ export function apply(ctx: Context, config: MobileNavConfig = {}): void {
           store,
           gateway: gatewayService,
           getApiFetch,
+          // DSH 0.2.1-alpha.3: one cached owner/answer Peer for every relay
+          // gateway call — `$events/result` must come from the Peer that
+          // opened `$events`.
+          getPeer: relayPeer,
           // Subagent reachability (T22c-fix): isAccessible walks the same
           // child→parent chain the activity tracker keeps fresh.
           parentOf: parentIndex.parentOf,
@@ -1068,7 +1075,15 @@ export function apply(ctx: Context, config: MobileNavConfig = {}): void {
       // second failure uninstalls (a half-trusted interception is worse than
       // none). Failure handling lives in runSelfCheck, which records the
       // verdict via noteSelfCheck.
-      void runSelfCheck(raw, { handle, log: logWarn })
+      // DSH 0.2.1-alpha.3: the probe needs an owner Peer of its own (the
+      // gateway's operatorPeer fallback is gone) — read `connection` through
+      // the reflection layer so a composition without it still installs.
+      void runSelfCheck(raw, {
+        handle,
+        log: logWarn,
+        info: (format, ...args) => { ctx.logger?.info(`dsh-zen-remote ${format}`, ...args) },
+        getPeer: createOwnerPeerSource(() => gatewayCtx.reflect.get('connection')),
+      })
     })
     // The exact-fetch-route interception (T51): the local backend's
     // `/api/session/uploadFileBinary` entry forwards REMOTE sessions'

package/src/intercept-shape.ts

@@ -23,6 +23,11 @@ export type GatewayShapeCheck = { ok: true; notes: string[] } | { ok: false; rea
  * §2.2/§4.1). If these strings vanish from the constructor source, own
  * properties would silently stop intercepting. */
 const DYNAMIC_OPEN_CALL = 'this.openWireStream(endpoint, payload, uplink, peer, control.signal, control)'
+/** DSH 0.2.1-alpha.3 threads the mux's per-stream uplink window through as a
+ * seventh argument (`uplinkWindow`); the call site is otherwise unchanged. */
+const DYNAMIC_OPEN_CALL_WINDOW = 'this.openWireStream(endpoint, payload, uplink, peer, control.signal, control, window)'
+/** Accepted `openWireStream` arities: 6 through 0.2.1-alpha.2, 7 from alpha.3. */
+const OPEN_ARITIES = [6, 7]
 const DYNAMIC_RPC_CALL = 'this.dispatchRpc(endpoint, payload, signal, peer)'
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -48,7 +53,9 @@ export function checkGatewayShape(raw: unknown): GatewayShapeCheck {
   // already installed.
   const open = proto === null ? undefined : proto.openWireStream
   if (typeof open !== 'function') reasons.push('prototype: openWireStream is not a function')
-  else if (open.length !== 6) reasons.push(`prototype: openWireStream has ${open.length} parameters, expected 6`)
+  else if (!OPEN_ARITIES.includes(open.length)) {
+    reasons.push(`prototype: openWireStream has ${open.length} parameters, expected ${OPEN_ARITIES.join(' or ')}`)
+  }
   const dispatch = proto === null ? undefined : proto.dispatchRpc
   if (typeof dispatch !== 'function') reasons.push('prototype: dispatchRpc is not a function')
   else if (dispatch.length !== 4) reasons.push(`prototype: dispatchRpc has ${dispatch.length} parameters, expected 4`)
@@ -65,8 +72,8 @@ export function checkGatewayShape(raw: unknown): GatewayShapeCheck {
   if (constructorSource === '') {
     reasons.push('constructor: the prototype has no constructor to inspect')
   } else {
-    if (!constructorSource.includes(DYNAMIC_OPEN_CALL)) {
-      reasons.push(`constructor: source does not contain "${DYNAMIC_OPEN_CALL}"`)
+    if (!constructorSource.includes(DYNAMIC_OPEN_CALL) && !constructorSource.includes(DYNAMIC_OPEN_CALL_WINDOW)) {
+      reasons.push(`constructor: source does not contain "${DYNAMIC_OPEN_CALL}" or "${DYNAMIC_OPEN_CALL_WINDOW}"`)
     }
     if (!constructorSource.includes(DYNAMIC_RPC_CALL)) {
       reasons.push(`constructor: source does not contain "${DYNAMIC_RPC_CALL}"`)

package/src/intercept.ts

@@ -3212,6 +3212,9 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
     peer: unknown,
     signal: AbortSignal | undefined,
     control: unknown,
+    // DSH 0.2.1-alpha.3: the mux's uplink window, passed through verbatim
+    // (undefined on older hosts and on the 5-argument wireStream.open path).
+    uplinkWindow?: unknown,
   ): unknown {
     if (!installed) {
       return (chainTarget.openWireStream as (...callArgs: unknown[]) => unknown).call(
@@ -3222,6 +3225,7 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
         peer,
         signal,
         control,
+        uplinkWindow,
       )
     }
     counters.openWireStream += 1
@@ -3235,7 +3239,7 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
     if (endpoint === '$events') {
       const open = chainTarget.openWireStream as (this: unknown, ...callArgs: unknown[]) => unknown
       return (async (): Promise<unknown> => {
-        const local = await open.call(raw, endpoint, payload, uplink, peer, signal, control)
+        const local = await open.call(raw, endpoint, payload, uplink, peer, signal, control, uplinkWindow)
         if (!isAsyncIterable(local)) return local
         return mergedEventsStream({ local, relay, signal, recordFailure, log, clock, summarySync })
       })()
@@ -3256,6 +3260,7 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
             peer,
             signal,
             control,
+            uplinkWindow,
           )
         }
         // The T23b-2 global merge. The 0.2.0 openWireStream is an ASYNC
@@ -3269,7 +3274,7 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
         return (async (): Promise<unknown> => {
           // The uplink rides to the LOCAL method verbatim (it may consume
           // it); the remote leg carries no uplink.
-          const local = await open.call(raw, endpoint, payload, uplink, peer, signal, control)
+          const local = await open.call(raw, endpoint, payload, uplink, peer, signal, control, uplinkWindow)
           if (!isAsyncIterable(local)) return local
           return mergedGlobalStream({
             endpoint,
@@ -3295,6 +3300,7 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
         peer,
         signal,
         control,
+        uplinkWindow,
       )
     }
     const verdict = validate(endpoint, virtuals)
@@ -3399,6 +3405,11 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
 export interface SelfCheckOptions {
   /** How long the probe may wait for its first frame; default 5000 ms. */
   timeoutMs?: number
+  /** The owner Peer the probe opens as. DSH 0.2.1-alpha.3 removed
+   * `gateway.operatorPeer()` and requires a live Peer on every stream; see
+   * owner-peer.ts. Undefined falls back to `operatorPeer()` where it still
+   * exists (≤ alpha.2), else to no Peer. */
+  getPeer?: () => unknown
 }
 
 /**
@@ -3430,7 +3441,15 @@ export async function behaviorSelfCheck(raw: object, options?: SelfCheckOptions)
   const wireStream = gateway.wireStream
   const open = isPlainObject(wireStream) ? wireStream.open : undefined
   if (typeof open !== 'function') return { ok: false, reason: 'wireStream.open disappeared before the self-check' }
-  const operatorPeer = typeof gateway.operatorPeer === 'function' ? gateway.operatorPeer : undefined
+  // ≤ 0.2.1-alpha.2 only: alpha.3 deleted operatorPeer (and connection.operator).
+  const legacyOperatorPeer = typeof gateway.operatorPeer === 'function' ? gateway.operatorPeer : undefined
+  let peer: unknown
+  try {
+    peer = options?.getPeer?.()
+  } catch (error) {
+    return { ok: false, reason: `the self-check could not obtain an owner Peer: ${messageOf(error)}` }
+  }
+  if (peer === undefined && legacyOperatorPeer !== undefined) peer = legacyOperatorPeer.call(raw)
   const controller = new AbortController()
   // NOT unref'd: an unref'd timer lets the process exit (or a test runner
   // judge the loop empty) before the timeout ever fires when this probe is
@@ -3458,7 +3477,7 @@ export async function behaviorSelfCheck(raw: object, options?: SelfCheckOptions)
           'workspace/follow',
           payload,
           undefined,
-          typeof operatorPeer === 'function' ? operatorPeer.call(raw) : undefined,
+          peer,
           controller.signal,
         ),
       ),
@@ -3502,6 +3521,10 @@ export interface RunSelfCheckOptions {
   retryDelayMs?: number
   /** Failure logging, wired to the context logger by index.ts. */
   log?: (format: string, ...args: unknown[]) => void
+  /** Success logging (one line once the probe passes). */
+  info?: (format: string, ...args: unknown[]) => void
+  /** Forwarded to {@link behaviorSelfCheck}. */
+  getPeer?: () => unknown
 }
 
 /**
@@ -3521,7 +3544,7 @@ export async function runSelfCheck(raw: object, options: RunSelfCheckOptions): P
   const { handle, log } = options
   const retryDelayMs = options.retryDelayMs ?? 3_000
   const stillInstalled = (): boolean => handle.diagnostics().installed
-  let result = await behaviorSelfCheck(raw)
+  let result = await behaviorSelfCheck(raw, { getPeer: options.getPeer })
   if (!result.ok && stillInstalled()) {
     await new Promise<void>((resolve) => {
       const timer = setTimeout(resolve, retryDelayMs)
@@ -3529,11 +3552,14 @@ export async function runSelfCheck(raw: object, options: RunSelfCheckOptions): P
       // loop-empty judgement) open for the retry delay.
       if (typeof timer.unref === 'function') timer.unref()
     })
-    if (stillInstalled()) result = await behaviorSelfCheck(raw)
+    if (stillInstalled()) result = await behaviorSelfCheck(raw, { getPeer: options.getPeer })
   }
   if (!stillInstalled()) return result
   handle.noteSelfCheck(result)
-  if (result.ok) return result
+  if (result.ok) {
+    options.info?.('client intercept self-check passed; interception active')
+    return result
+  }
   handle.uninstall()
   log?.('client intercept self-check failed (%s), interception removed', result.reason)
   return result

package/src/owner-peer.ts

@@ -0,0 +1,81 @@
+/**
+ * The owner Peer this plugin speaks as when it calls the typert gateway on
+ * its own behalf (relay routes, admin projections, the intercept
+ * self-check, the `$events` relay subscription).
+ *
+ * DSH 0.2.1-alpha.3 removed the gateway's implicit operator fallback
+ * (`gateway.operatorPeer()`, `connection.operator` and the `OperatorPeer`
+ * export are gone): every gateway call — `invoke`, `stream`,
+ * `openWireStream`, `dispatchRpc` — now asserts a live Peer, and `$events` /
+ * `$events/result` additionally demand `principal.kind === 'owner'` and
+ * `interactions === 'answer'`, with the result answered by the SAME Peer that
+ * opened the stream. The sanctioned in-process door is
+ * `connection.createPeer({ principal: { kind: 'owner' }, interactions:
+ * 'answer' })` (docs/upgrade-guide/v0.2.1-alpha.2/operator-connect), whose
+ * Peer is disposed with the Context that read `connection`.
+ *
+ * Resolution order: a cached `createPeer` Peer (recreated once its scope is
+ * disposed), else `connection.browserPeer` (also an owner/answer Peer),
+ * else `undefined` — the pre-alpha.3 behavior, where the gateway itself
+ * defaulted a missing Peer to its operator.
+ */
+
+/** Minimal structural view of a typert `PeerScope`. */
+export interface PeerLike {
+  readonly signal?: AbortSignal
+}
+
+/** The connection-service members this module reads. */
+export interface PeerConnectionLike {
+  createPeer?: (options: { principal: { kind: 'owner' }; interactions?: 'answer' | 'none' }) => unknown
+  browserPeer?: unknown
+}
+
+function isLive(peer: unknown): boolean {
+  if (peer === null || typeof peer !== 'object') return false
+  const signal = (peer as PeerLike).signal
+  return !(signal instanceof AbortSignal) || !signal.aborted
+}
+
+/**
+ * Build a lazy, caching owner-Peer source over a connection-service reader.
+ * The reader runs per call (the service may be absent or restarted). The
+ * cache is keyed on the Peer's LIVENESS, not on the connection object's
+ * identity: `ctx.reflect.get('connection')` hands out a fresh proxy per read,
+ * so an identity key would mint a new Peer per call — and the gateway
+ * refuses a `$events/result` from any Peer but the one that opened
+ * `$events` (found by the alpha.3 live smoke). A restarted connection
+ * service disposes its Peers, which is exactly when a new one is minted.
+ * @param getConnection - live reader of `ctx.connection` (may return undefined).
+ * @returns a function answering the Peer to pass, or undefined to let the
+ *   host default it (pre-alpha.3 hosts).
+ */
+export function createOwnerPeerSource(getConnection: () => unknown): () => unknown {
+  let cached: unknown
+  return () => {
+    let connection: PeerConnectionLike | undefined
+    try {
+      const value = getConnection()
+      connection = value !== null && typeof value === 'object' ? (value as PeerConnectionLike) : undefined
+    } catch {
+      connection = undefined
+    }
+    if (connection === undefined) return undefined
+    if (typeof connection.createPeer === 'function') {
+      if (isLive(cached)) return cached
+      cached = connection.createPeer({ principal: { kind: 'owner' }, interactions: 'answer' })
+      return cached
+    }
+    const browser = connection.browserPeer
+    return browser !== null && typeof browser === 'object' ? browser : undefined
+  }
+}
+
+/**
+ * Attach `peer` to one gateway request object when a Peer is available;
+ * otherwise return the request unchanged (pre-alpha.3 shape).
+ */
+export function withPeer<T extends object>(request: T, getPeer: (() => unknown) | undefined): T & { peer?: unknown } {
+  const peer = getPeer?.()
+  return peer === undefined ? request : { ...request, peer }
+}

package/src/relay-server.ts

@@ -26,6 +26,7 @@
  * a 404.
  */
 
+import { withPeer } from './owner-peer.js'
 import { randomBytes, timingSafeEqual } from 'node:crypto'
 import { Readable, Transform } from 'node:stream'
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
@@ -208,12 +209,13 @@ const JOB_CACHE_LIMIT = 1024
  *   before its typert dispatch — and returns the `{ok,…}` envelope itself.
  */
 export interface RelayGateway {
-  invoke(call: { namespace: string; method: string; args: unknown; signal?: AbortSignal }): Promise<unknown>
+  invoke(call: { namespace: string; method: string; args: unknown; signal?: AbortSignal; peer?: unknown }): Promise<unknown>
   stream(call: {
     namespace: string
     method: string
     args: unknown
     signal?: AbortSignal
+    peer?: unknown
   }): Promise<AsyncIterable<unknown>>
   /** The host's wire adapter, shared by the WebSocket mux and the local
    * transports. `open` is the async 0.2.0 method. */
@@ -268,6 +270,12 @@ export interface RelayHandlerOptions {
    * synthetic Request to the same exact-fetch route table the browser's
    * `/api` transport uses — no loopback HTTP, no login state. */
   getApiFetch?: () => ((request: Request) => Promise<Response>) | undefined
+  /** The owner Peer every gateway call is made as (DSH 0.2.1-alpha.3+
+   * requires one; `$events` and `$events/result` need an owner Peer with
+   * `interactions: 'answer'`, the SAME one for both). Built by
+   * {@link createOwnerPeerSource}; absent or answering undefined keeps the
+   * pre-alpha.3 behavior (the host defaults the Peer). */
+  getPeer?: () => unknown
   /** Stream heartbeat interval in ms (a `{"type":"ping"}` line that keeps
    * reverse proxies from timing the idle stream away); defaults to 15000.
    * Tests inject a small value. */
@@ -875,12 +883,12 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
     const cached = recentJobs.get(sessionId)
     if (cached !== undefined && cached.has(jobId)) return cached.get(jobId) === sessionId
     try {
-      const iterable = await gateway.stream({
+      const iterable = await gateway.stream(withPeer({
         namespace: 'job',
         method: 'list',
         args: { request: { sessionId } },
         signal,
-      })
+      }, options.getPeer))
       for await (const frame of iterable) {
         rememberJobs(sessionId, frame)
         const jobs = recentJobs.get(sessionId)
@@ -906,7 +914,7 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
    */
   const workspaceExists = async (workspaceId: string, signal: AbortSignal): Promise<boolean> => {
     try {
-      const iterable = await gateway.stream({ namespace: 'workspace', method: 'follow', args: {}, signal })
+      const iterable = await gateway.stream(withPeer({ namespace: 'workspace', method: 'follow', args: {}, signal }, options.getPeer))
       for await (const frame of iterable) {
         if (!isPlainObject(frame) || frame.type !== 'baseline') return false
         const value = isPlainObject(frame.value) ? frame.value : undefined
@@ -939,7 +947,7 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
       '$events',
       { args: {} },
       undefined,
-      undefined,
+      options.getPeer?.(),
       signal,
     )) as unknown
     if (
@@ -1217,7 +1225,7 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
           '$events/result',
           { args: { clientId: owner.clientId, eventId: originalEventId, outcome: parsed.result } },
           hangUp.signal,
-          undefined,
+          options.getPeer?.(),
         )) as unknown
         responseJson(res, 200, isPlainObject(envelope) ? envelope : { ok: false, error: { code: 'internal' } })
       } catch (error) {
@@ -1341,7 +1349,7 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
           responseJson(res, 403, { ok: false, error: { code: 'not-shared' } })
           return
         }
-        const value = await gateway.invoke({ namespace, method, args, signal: hangUp.signal })
+        const value = await gateway.invoke(withPeer({ namespace, method, args, signal: hangUp.signal }, options.getPeer))
         // T31: a session created or forked THROUGH the relay is shared
         // automatically — the client only ever sees shared sessions, so an
         // unshared result would be born unreachable. Re-sharing (a fork the
@@ -2471,12 +2479,12 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
           const syncProjections = async (sessionId: string): Promise<void> => {
             let result: unknown
             try {
-              result = await gateway.invoke({
+              result = await gateway.invoke(withPeer({
                 namespace: 'session',
                 method: 'projections',
                 args: { request: { sessionId } },
                 signal: hangUp.signal,
-              })
+              }, options.getPeer))
             } catch {
               return // projections unavailable — the next live projection frame will flow anyway
             }
@@ -2596,7 +2604,7 @@ export function createRelayHandler(options: RelayHandlerOptions): RelayHandler {
             const iterable =
               eventsSub !== undefined
                 ? await openEventsStream(hangUp.signal)
-                : await gateway.stream({ namespace, method, args, signal: hangUp.signal })
+                : await gateway.stream(withPeer({ namespace, method, args, signal: hangUp.signal }, options.getPeer))
             for await (const frame of iterable) {
               if (finished || clientGone) break
               if (namespace === 'job' && method === 'list') rememberJobs(ownerSessionIdOf(args), frame)