super-dsh 0.1.10-e → 0.1.11-a

package/superd-hub/dist/connection-trust.js

@@ -0,0 +1,16 @@
+/**
+ * Use the native index authenticator as a cookie-only admission delegate.
+ * A fixed, query-free index path prevents token exchange or redirects here;
+ * original Host and Cookie headers preserve the native authority binding and
+ * lifetime. No upstream private fields or cookie-format copies are needed.
+ */
+export function installAuthenticationOnlyAdmission(connection) {
+    const original = connection.requestRejection;
+    const response = { writeHead() { }, end() { } };
+    connection.requestRejection = (request) => connection.authorizeIndex({
+        headers: request.headers,
+        method: 'GET',
+        url: '/index.html',
+    }, response) ? undefined : 401;
+    return () => { connection.requestRejection = original; };
+}

package/superd-hub/dist/web-trust.d.ts

@@ -1,41 +1,8 @@
 /**
- * Web page trust component — the browser-side twin of the connection row's
- * server-side `trustedHosts` fence (ported from better-dsh `web-trust.ts`,
- * authorities leg only).
- *
- * Why: when the Web UI is served on an operator-declared non-loopback
- * authority (Caddy domain, LAN IP), the server side accepts the Host through
- * `trustedHosts`, but the BROWSER-side connection client computes
- * `ctx.connection.isLoopback` from `location.hostname` — non-loopback → the
- * page degrades into the describe-mirror shape (Host settings persistence
- * reports terminal `memory` unavailability). This component injects one
- * inline `<head>` script through the webserver's public
- * `webserver/index-inject` event (every index render re-emits; row data is
- * read fresh at emit time, so a config reload needs no listener re-wiring):
- * when the page's hostname is one the operator declared their own, it sets
- * `window.__DSH_TRANSPORT__ = { ownsHost: true }` BEFORE any application
- * bundle materializes — the connection client's only whole-repo consumer —
- * restoring the upstream-documented shape for trusted authorities.
- *
- * The object deliberately carries NO fetch/openStream: the connection
- * client's optional chaining then builds the default HTTP/WS transport, so
- * the flag's only effect is the loopback verdict. An existing
- * `__DSH_TRANSPORT__` (a worker shell that owns a real transport) is never
- * overwritten.
- *
- * On/off (two independent levels, both standard):
- *   - row level: a profile layer with `- id: superd-web-trust / disabled: true`
- *     removes the component entirely;
- *   - config level: `trustedPageAuthorities: []` keeps the row mounted but
- *     injects nothing (fully inert).
- *
- * Composed on ctx0 only (since path-separation T-D): the `super-dsh/web-trust`
- * row in the composite bundle's insert list. The per-world row retired with
- * the world pages themselves (T-D disabled the world webui rows — no world
- * page renders, so no world-local injection exists); `/hub` is the sole
- * foreign entry and it serves ctx0's index, which this ctx0 row covers.
- *
- * @module @pgmi-builds/superd-hub/web-trust
+ * Browser ownership and opt-in authentication-only server admission.
+ * trustAllHosts skips Host/Origin restrictions while retaining native cookie
+ * authentication. Existing transports and declared-authority mode are preserved.
+ * Mounted on ctx0, whose connection also gates the /hub routes.
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
@@ -70,19 +37,23 @@ export interface BootScriptRow {
  * inert-when-empty, hostile-string escaping).
  *
  * @param trustedPageAuthorities - the operator-declared hostnames.
- * @returns the script text, or `undefined` when the list is empty (inject
- *   nothing — the component is fully inert).
+ * @param trustAllHosts - enable browser ownership for every hostname.
+ * @returns script text, or undefined for an empty declared-authority list.
  */
-export declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined): string | undefined;
+export declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined, trustAllHosts?: boolean): string | undefined;
 /** Row config schema. */
 export interface TrustConfig {
+    /** Skip address fences on server and browser; native authentication remains. */
+    trustAllHosts?: boolean;
     /** Hostnames this operator declares their own devices' pages run on. */
     trustedPageAuthorities?: readonly string[];
 }
 /** Row config schema (schema-level default derives from the trusted-hosts env). */
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    trustAllHosts: z<boolean, boolean, "defined">;
     trustedPageAuthorities: z<string[], string[], "defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
+    trustAllHosts: z<boolean, boolean, "defined">;
     trustedPageAuthorities: z<string[], string[], "defined">;
 }>>, "plain">;
 /** Cordis plugin name. */
@@ -93,8 +64,7 @@ export declare const name = "superd-web-trust";
  */
 export declare const inject: string[];
 /**
- * Mount the authorities-leg injection: one `webserver/index-inject` listener
- * pushing the rendered row.
+ * Mount browser ownership and, when opted in, native authentication-only admission.
  * @param ctx - host plugin context.
  * @param config - the row config.
  */
@@ -103,8 +73,10 @@ declare const _default: {
     name: string;
     inject: string[];
     Config: z<Schemastery.ObjectS<NoInfer<{
+        trustAllHosts: z<boolean, boolean, "defined">;
         trustedPageAuthorities: z<string[], string[], "defined">;
     }>>, Schemastery.ObjectT<NoInfer<{
+        trustAllHosts: z<boolean, boolean, "defined">;
         trustedPageAuthorities: z<string[], string[], "defined">;
     }>>, "plain">;
     apply: typeof apply;

package/superd-hub/dist/web-trust.js

@@ -1,43 +1,11 @@
 /**
- * Web page trust component — the browser-side twin of the connection row's
- * server-side `trustedHosts` fence (ported from better-dsh `web-trust.ts`,
- * authorities leg only).
- *
- * Why: when the Web UI is served on an operator-declared non-loopback
- * authority (Caddy domain, LAN IP), the server side accepts the Host through
- * `trustedHosts`, but the BROWSER-side connection client computes
- * `ctx.connection.isLoopback` from `location.hostname` — non-loopback → the
- * page degrades into the describe-mirror shape (Host settings persistence
- * reports terminal `memory` unavailability). This component injects one
- * inline `<head>` script through the webserver's public
- * `webserver/index-inject` event (every index render re-emits; row data is
- * read fresh at emit time, so a config reload needs no listener re-wiring):
- * when the page's hostname is one the operator declared their own, it sets
- * `window.__DSH_TRANSPORT__ = { ownsHost: true }` BEFORE any application
- * bundle materializes — the connection client's only whole-repo consumer —
- * restoring the upstream-documented shape for trusted authorities.
- *
- * The object deliberately carries NO fetch/openStream: the connection
- * client's optional chaining then builds the default HTTP/WS transport, so
- * the flag's only effect is the loopback verdict. An existing
- * `__DSH_TRANSPORT__` (a worker shell that owns a real transport) is never
- * overwritten.
- *
- * On/off (two independent levels, both standard):
- *   - row level: a profile layer with `- id: superd-web-trust / disabled: true`
- *     removes the component entirely;
- *   - config level: `trustedPageAuthorities: []` keeps the row mounted but
- *     injects nothing (fully inert).
- *
- * Composed on ctx0 only (since path-separation T-D): the `super-dsh/web-trust`
- * row in the composite bundle's insert list. The per-world row retired with
- * the world pages themselves (T-D disabled the world webui rows — no world
- * page renders, so no world-local injection exists); `/hub` is the sole
- * foreign entry and it serves ctx0's index, which this ctx0 row covers.
- *
- * @module @pgmi-builds/superd-hub/web-trust
+ * Browser ownership and opt-in authentication-only server admission.
+ * trustAllHosts skips Host/Origin restrictions while retaining native cookie
+ * authentication. Existing transports and declared-authority mode are preserved.
+ * Mounted on ctx0, whose connection also gates the /hub routes.
  */
 import z from '@deepseek-ai/schemastery';
+import { installAuthenticationOnlyAdmission } from './connection-trust.js';
 /**
  * The schema-level default for `trustedPageAuthorities` (better-dsh v0.2.2a
  * shape): derive from the trusted-hosts environment — the SAME single source
@@ -76,10 +44,12 @@ function frame(body) {
  * inert-when-empty, hostile-string escaping).
  *
  * @param trustedPageAuthorities - the operator-declared hostnames.
- * @returns the script text, or `undefined` when the list is empty (inject
- *   nothing — the component is fully inert).
+ * @param trustAllHosts - enable browser ownership for every hostname.
+ * @returns script text, or undefined for an empty declared-authority list.
  */
-export function buildTrustScript(trustedPageAuthorities) {
+export function buildTrustScript(trustedPageAuthorities, trustAllHosts = false) {
+    if (trustAllHosts)
+        return frame(['if(!window.__DSH_TRANSPORT__)window.__DSH_TRANSPORT__={ownsHost:true};']);
     const authorities = [...(trustedPageAuthorities ?? [])];
     if (authorities.length === 0)
         return undefined;
@@ -98,6 +68,7 @@ function trustedHostsEnv() {
 }
 /** Row config schema (schema-level default derives from the trusted-hosts env). */
 export const Config = z.object({
+    trustAllHosts: z.boolean().default(false),
     trustedPageAuthorities: z.array(String).default(deriveDefaultPageAuthorities(trustedHostsEnv())),
 });
 /** Cordis plugin name. */
@@ -108,16 +79,20 @@ export const name = 'superd-web-trust';
  */
 export const inject = [];
 /**
- * Mount the authorities-leg injection: one `webserver/index-inject` listener
- * pushing the rendered row.
+ * Mount browser ownership and, when opted in, native authentication-only admission.
  * @param ctx - host plugin context.
  * @param config - the row config.
  */
 export function apply(ctx, config) {
+    if (config?.trustAllHosts) {
+        ctx.inject(['connection'], owner => {
+            owner.effect(() => installAuthenticationOnlyAdmission(owner.connection), 'superd-web-trust: authentication-only admission');
+        });
+    }
     const authorities = config?.trustedPageAuthorities;
     ctx.inject(['webServer'], () => {
         ctx.on('webserver/index-inject', (table) => {
-            const text = buildTrustScript(authorities);
+            const text = buildTrustScript(authorities, config?.trustAllHosts);
             if (text !== undefined)
                 table.push({ kind: 'script', placement: 'head', text });
         });

package/superd-hub/dist/world-mount.d.ts

@@ -93,13 +93,14 @@ export declare const WORLD_WAVE1_DISABLED_ROWS: readonly string[];
  * Wave-2 of world composition minimization: the CLIENT lane. The
  * multi-ctx-multi-ui → native-ui-only transition (0.1.5 / T-D) retired the
  * world's own web UI (webserver/hmr/web-runtime/client-hmr above); wave-2
- * completes it by stripping the browser-half rows of the web-app bundle —
- * every dsh-client-* row plus the cordis client runner. In a world these
- * only registered modules into a table no browser ever reads.
+ * completes it by stripping the browser-only rows of the web-app bundle
+ * plus the cordis client runner. A dsh-client-* package can also provide
+ * host services, so its name alone does not make it safe to disable.
  *
  * Dependency-cleared 2026-09-27: the KEEP side (api controllers, gateway,
- * session core, adapters) injects none of their services with ONE
- * exceptions — `connection` (dsh-client-connection: the world's typert
+ * session core, adapters) keeps the required host services:
+ * `file-upload` (dsh-client-file-upload: sessionController injects its
+ * fileUploads service), `connection` (dsh-client-connection: the world's typert
  * gateway injects it) and `modules` (dsh-client-modules: its activation
  * work fails in world trees ("client bundles not found") and at least one
  * fiber treats it as required — the load-bearing parking restatement

package/superd-hub/dist/world-mount.js

@@ -95,13 +95,14 @@ export const WORLD_WAVE1_DISABLED_ROWS = [
  * Wave-2 of world composition minimization: the CLIENT lane. The
  * multi-ctx-multi-ui → native-ui-only transition (0.1.5 / T-D) retired the
  * world's own web UI (webserver/hmr/web-runtime/client-hmr above); wave-2
- * completes it by stripping the browser-half rows of the web-app bundle —
- * every dsh-client-* row plus the cordis client runner. In a world these
- * only registered modules into a table no browser ever reads.
+ * completes it by stripping the browser-only rows of the web-app bundle
+ * plus the cordis client runner. A dsh-client-* package can also provide
+ * host services, so its name alone does not make it safe to disable.
  *
  * Dependency-cleared 2026-09-27: the KEEP side (api controllers, gateway,
- * session core, adapters) injects none of their services with ONE
- * exceptions — `connection` (dsh-client-connection: the world's typert
+ * session core, adapters) keeps the required host services:
+ * `file-upload` (dsh-client-file-upload: sessionController injects its
+ * fileUploads service), `connection` (dsh-client-connection: the world's typert
  * gateway injects it) and `modules` (dsh-client-modules: its activation
  * work fails in world trees ("client bundles not found") and at least one
  * fiber treats it as required — the load-bearing parking restatement
@@ -110,7 +111,6 @@ export const WORLD_WAVE1_DISABLED_ROWS = [
 export const WORLD_WAVE2_DISABLED_ROWS = [
     'cordis-client-runner',
     'directory-picker-browse-surface',
-    'file-upload',
     'locale',
     'resources',
     'ui-agent-preset', 'ui-approval', 'ui-attachment', 'ui-brand-official',

package/superd-hub/lib/client/index.js

@@ -1738,14 +1738,14 @@ function modelOption(raw) {
 	};
 }
 function providerAuthKind(raw) {
-	return raw === "env" ? "env" : raw === "authToken" ? "authToken" : "apiKey";
+	return raw === "oauth" ? "oauth" : raw === "env" ? "env" : raw === "authToken" ? "authToken" : "apiKey";
 }
 function providerOption(raw) {
 	if (typeof raw !== "object" || raw === null) return void 0;
 	const record = raw;
 	const id = nonEmpty(record.id);
 	const label = nonEmpty(record.label);
-	const baseUrl = nonEmpty(record.baseUrl);
+	const baseUrl = nonEmpty(record.baseUrl) ?? (record.authKind === "oauth" ? "" : void 0);
 	if (id === void 0 || label === void 0 || baseUrl === void 0) return void 0;
 	const models = Array.isArray(record.models) ? record.models.map(modelOption).filter((entry) => entry !== void 0) : [];
 	const envName = nonEmpty(record.envName);
@@ -2650,6 +2650,10 @@ function ProvidersPanel({ agent, namespace }) {
 						style: chip,
 						children: "token"
 					}),
+					provider.authKind === "oauth" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: chip,
+						children: "native OAuth"
+					}),
 					!provider.hasKey && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 						style: chip,
 						children: "no key"
@@ -2668,13 +2672,13 @@ function ProvidersPanel({ agent, namespace }) {
 					}),
 					provider.models.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 						style: chipWarn,
-						children: "no models yet — add one"
+						children: provider.authKind === "oauth" ? "model cache unavailable — open Codex to refresh" : "no models yet — add one"
 					}),
 					busy === `remove:${provider.id}` && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 						style: chip,
 						children: "removing…"
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+					provider.authKind !== "oauth" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 						type: "button",
 						style: buttonStyle,
 						disabled: busy !== null,
@@ -2682,8 +2686,7 @@ function ProvidersPanel({ agent, namespace }) {
 							openEdit(provider);
 						},
 						children: "Edit"
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 						type: "button",
 						style: {
 							...buttonStyle,
@@ -2695,7 +2698,7 @@ function ProvidersPanel({ agent, namespace }) {
 							run(`remove:${provider.id}`, () => removeProvider(agent.key, namespace, provider.id));
 						},
 						children: "Delete"
-					})
+					})] })
 				]
 			}, provider.id)),
 			editing === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {

package/superd-hub/package.json

@@ -43,7 +43,8 @@
     "@deepseek-ai/dsh-home-paths": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-host-webserver": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-tools": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0"
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -63,6 +64,9 @@
     },
     "@deepseek-ai/dsh-typert-protocol": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
     }
   },
   "devDependencies": {

package/agent-codex/README.md

@@ -1,179 +0,0 @@
-# @pgmi-builds/agent-codex
-
-superd 外壳下的 **Codex adapter**（super-dsh 线）：把 Codex CLI 经由 **`codex app-server`**
-接进 DSH —— 会话、事件、模型目录、审批、持久化全部按 DSH 语义呈现，WebUI 消费的是 DSH
-服务提供的数据面。
-
-> 通用规则（定位 / 两形态 / 测试准则 / 接线域 / per-agent 定制权 / home 与 profile 布局）
-> 见上级目录的 `agent-adapter-dev-rules.md` —— 改本包前先读它。
-> 迁移计划与实证：`docs/superpowers/plans/2026-10-03-agent-codex-app-server-migration.md`。
-
-## 它是什么
-
-- 一个**普通 dsh plugin bundle**：`package.json` 的 `dsh.bundle.patch` 指向本目录的
-  `cordis.patch.yml`（挂 codex provider、关掉它替代的原生行、重写权限三档表、pin 应用内目录选择器）。
-- 一个 **AgentFactory**：`src/index.ts` 里的 `CodexProvider` 在 `ctx.agents` 注册工厂，
-  **每个会话一个 `codex app-server` 子进程**（`src/app-server-client.ts`）；
-  `src/agent.ts` 把 app-server 通知流投影成 DSH 会话事件。
-- **不包含** 任何 hub 耦合：世界挂载由 hub 侧驱动。本包自己就足以点亮一个完整的 web app。
-
-## 线别（2026-10-03 迁移）
-
-**app-server 线**取代了原 `@openai/codex-sdk` 线（SDK 依赖已从本包与主 pack 移除）。
-SDK 线在 adapter 里登记的一整排降级被 app-server 协议面直接消掉：
-
-| 能力 | SDK 线（已退役） | app-server 线（现役） |
-|---|---|---|
-| 打断 | 只有 AbortSignal（掐断本轮 stream） | **`turn/interrupt`** |
-| steer | 无 → 排队 followUp 近似 | **`turn/steer`**（注入进行中的 turn） |
-| 运行时换模型 | 无 → 下一轮 `resumeThread` | **`turn/start.model`**（下一轮起生效，线程不重建） |
-| 运行时审批档 | 无 → launch-only 预设 | **`turn/start.approvalPolicy`**（折叠 `approval/policy`，`/permission` 可用） |
-| 运行时沙箱档 | 无 → launch-only | **`turn/start.sandboxPolicy`**（折叠 `sandbox/mode`） |
-| 审批人机回路 | 无（`sendRaw` 是 no-op） | **`*/requestApproval` → DSH `ctx.approval`**（Web UI ApprovalPanel） |
-| 用户消息回显 | 无（SDK item 无 `user_message`） | `item/started userMessage` |
-| token usage | 只在本轮 `turn/completed`，滞后 | `thread/tokenUsage/updated`（本轮 `turn_end` 附着） |
-
-**未接（登记 backlog）**：`thread/compact/start`（`/compact` 仍显式拒绝）、
-`thread/list` 会话清单（DSH 日志仍是权威）、`skills/list` / `mcpServerStatus/list` 面板、
-`thread/fork`、`requestUserInput` / `mcpServer/elicitation`（fail-closed 应答）、
-collab/subagent 项。
-
-## 单独跑起来（首选开发/验收形态）
-
-场景级验证唯一入口 = **整包 pack 线**（`super-dsh/test/start-4999.sh`）+ dev3 目标机实装
-（2026-09-24「场景退役」裁决）；本包不再有 standalone 启动脚本。
-
-## Home 与 profile 布局（user 裁定）
-
-| 位置 | 内容 |
-|---|---|
-| `$DSH_HOME`（测试 = `<repo>/.tests`） | 测试 DSH home |
-| 原生 `~/.codex`（`CODEX_HOME` 才重定向） | **Codex 原生 app home**：`config.toml` / `auth.json` / 模型 catalog / rollout / state。adapter **绝不重定向**（红线 §5），**从不写入**（单向阀） |
-| `$DSH_HOME/agents/codex` | 该 world 的 **DSH home**：DSH 会话日志副本、storages、`dsh-sessions.json` 映射 |
-| `$DSH_HOME/profiles/superd-pub` | 整包线的 dsh profile（tarball 物理安装） |
-
-## 关键实现点
-
-- **lazy spawn（硬门）**：`CodexAppServerClient.create()` 零 IO、零子进程；`ensureStarted()`
-  在**首个真实 prompt** 才 spawn + `initialize` + `thread/start|resume`。查看/创建/resume
-  一个会话不产生任何 native 进程。单测直接钉住这条不变量（transport factory 调用计数 = 0）。
-- **进程回收**：子进程 `detached: true`（自有进程组），close 时先 `SIGTERM` 进程组、
-  宽限后 `SIGKILL`，再 `child.kill()` 兜底——stdio MCP 后代 `setsid` 逃离时仍能被扫到。
-- **session 身份 = 一对一映射**：DSH session id 是权威；Codex thread id 在**线程 attach**
-  时经 `onThreadAttached` 写入 `<dshHome>/dsh-sessions.json`（`src/session-map.ts`）。
-  resume 只经该映射重挂线程，查不到即 fail-closed。
-- **DSH-native 持久化**：工厂按上游 agent-loop 的方式持有写通道（create `persistence.create` /
-  resume `persistence.open(id,'write')` → `read` → `interruptedTurnClosers` → `prepare`），
-  发布点刷未存后缀，dispose 时 `handle.close()` 排空。
-- **每会话路由钉住**：create/resume 时同步钉住本会话路由（追加 `model/selection` +
-  `installModelSelection`），**不依赖全局默认模型的落盘时序**。
-- **每轮权限折叠**：`agent.ts` 在每次 `turn/start` 前把会话日志的
-  `approval/policy` / `sandbox/mode`（无则由 preset 表兜底）折成 codex 覆盖
-  （`permission.ts` 的 `turnPolicyFromEvents`）；`CODEX_APPROVAL_MODE` 只覆盖审批半边。
-- **审批桥 fail-closed**：`app-server-approvals.ts` 把 server-request 映射到
-  `ctx.approval.request()`；无 answerer / 抛错 / 超时（`CODEX_APPROVAL_TIMEOUT_MS`，默认 5 分钟）
-  一律 **decline**，绝不让 codex 挂死。
-- **事件映射**：`system/message`（rollout HEAD `base_instructions`）、`request/context`、
-  `assistant/message`（reasoning 用 `{type:'reasoning',text}`）、
-  `tool/call`（原始 JSON 串）/`tool/result`、`step/start|end`、`turn/start|end`、`todo/write`。
-
-## 环境变量
-
-| 变量 | 作用 |
-|---|---|
-| `CODEX_TRACE=1` | provider/agent/app-server 追踪（stderr） |
-| `CODEX_BIN` | 覆盖 codex 入口脚本（测试）；默认 = 本包 pin 的 `@openai/codex/bin/codex.js` |
-| `CODEX_HOME` | Codex 原生 home 重定向（**测试专用**；生产路径零重定向） |
-| `CODEX_APPROVAL_MODE` | 覆盖审批档（`never`/`on-request`/`on-failure`/`untrusted`；非法值忽略） |
-| `CODEX_APPROVAL_TIMEOUT_MS` | 审批应答超时；`0` 关闭；默认 300000 |
-| `CODEX_IDLE_EXIT_MS` | 会话空闲后拆客户端；`0` 关闭；默认 600000 |
-
-## 测试
-
-```bash
-npm run build                                   # tsc strict
-DSH_HOME=<repo>/.tests \
-SUPERD_DSH_ANCHOR=<repo>/upstream/deepseek-harness/package.json \
-node --test test/*.test.mjs
-```
-
-单测全部是 fake：`test/fixtures/fake-app-server.mjs` 是一个**可编程的 app-server 替身**
-（真 JSONL JSON-RPC 分帧、真子进程），wire / client 测试用真管道驱动它；投影器与审批桥是纯函数。
-**不 spawn 真 codex、不打模型。**
-
-## 已知边界（app-server 线 v1）
-
-- `thread/compact/start` 未接 → `/compact` 仍以显式错误拒绝；
-- 会话清单仍由 DSH 日志提供（不接 `thread/list`，遵守 mapping-only）；
-- `requestUserInput` / `mcpServer/elicitation` / `permissions/requestApproval` 一律 fail-closed；
-- collab / subagent / `thread/fork` / skills / MCP 面板未接；
-- 内存镜像 `getMessages()` 仅供诊断，权威转录是 DSH 会话日志。
-
-## 多 provider 面（Hub + DSH，2026-10-04 重做）
-
-Codex 是**单 provider** harness：它自己的 `config.toml` 只能写一个 `model_provider`。provider 的**清单**
-在 Codex 家里无处安放——那正是 cc-switch 存在的理由；而「这个会话现在跑在哪个 provider 上」在 DSH
-里已有公认答案（`session/selectModel` + 持久的 `model/selection`）。所以本线**只做清单**，选择交给 DSH：
-
-- adapter 的 store 是**正本**（canonical），原生 `config.toml` 是**来源**（source），单向读入；
-- UI 不再有「active provider」概念——界面里切换 provider/model 就是 DSH 自带模型选择器，与本仓其它
-  harness 完全一致；
-- provider 由**进程参数**注入子进程（`-c model_providers.<id>.*`），**不写任何原生文件**。
-
-### 分账
-
-| 位置 | 内容 |
-|---|---|
-| `$DSH_HOME/agents/codex/codex-providers.json`（0600） | **正本**：provider 清单 + 被显式删除的 endpoint 墓碑（含 API key） |
-| `$DSH_HOME/agents/codex/codex-catalogs/<id>.json` | 本 adapter 自有的 per-provider 模型目录；经 `-c model_catalog_json=<绝对路径>` 注入 |
-| `~/.codex/config.toml` | 用户原生：**只读**。启动时 + 每 10 分钟读一次，按 endpoint URL 去重折进正本 |
-| `~/.codex/auth.json` | 用户原生：**只读**。`apiKey` 形态的 key 走子进程环境，不走这里 |
-
-### 同步（2026-10-04 user 裁决）
-
-`syncFromNative()`：启动时 + 每 10 分钟（`SYNC_INTERVAL_MS = 600_000`）读 `config.toml` 的**全部**
-`[model_providers.<id>]` 表，按 endpoint URL 去重折进正本。新 endpoint 在库里没有名字，**就用 URL 端点
-当名字**（`label = baseUrl`）——Codex 的 catalog 是「当前在役 provider」专用的，所以非在役 provider 的
-模型清单**确实无从得知**，此时存 `models: []`（面板显示「no models yet」，该 provider 不注册路由），
-而不是编一个。同步只**增/刷**、永不删；唯一的例外是用户显式删除留下的**墓碑**（endpoint key），
-否则「删除」会在十分钟后自己撤销。
-
-### 选择与切换
-
-- **路由 = DSH 的**：每个有模型的 provider 注册一条 `ctx.llm` 路由，于是 `session/modelCatalog` 天然
-  按 provider 分组，`session/selectModel` 天然持久（`model/selection` + `modelSelection` 投影）；
-- **turn 边界判定 = DSH 的**：agent 每轮按 `pending ?? request/header ?? agentDefaultModel ?? options`
-  解析路由（`codex-route.ts`），并回写 `request/header`——于是投影的 `lastUsed`/`next`、
-  `consumeSelection`、以及「会话上次跑在哪个 provider」全部由上游自洽，UI 重放自然准确；
-- **中途切换不用打断**：`turn/start` 的 `model` 覆盖「本轮及后续轮」，所以换**模型**是原生的；换
-  **provider** 必须换子进程——`turn/start` 没有 provider 字段，而打给**已加载**线程的 `thread/resume`
-  是「接受但忽略」（2026-10-03 实测：要 `zhipu-cn` 回 `deepseek`）。故 agent 在**下一轮冷启动**时
-  kill 掉旧 child、用新 `-c` 起新 child、`thread/resume` **同一个 thread id**，历史与上下文完整保留。
-  turn 中发起的切换落在下一轮（DSH 的 pending 语义），**不打断在跑的 turn**。
-
-### 启动注入（零原生写入）
-
-`codex-launch.ts` 生成 argv/env；三条实测约束写死在注释里：
-
-1. hyphenated id 在 `-c` 点路径里合法（`model_providers.zhipu-cn.…`）⇒ 原生表名可原样作 provider id；
-2. `model_catalog_json` 作为 override 时按**进程 cwd** 解析 ⇒ 路径必须绝对（相对路径实测 `ENOENT`）；
-3. `env_key` 是唯一不经过 auth manager 的形态 ⇒ 库里的 key 以合成变量名（`SUPERD_CODEX_KEY_<ID>`）
-   经**子进程环境**交给 codex，`auth.json` 完全不碰。**这也顺带解决了 ChatGPT 登录遮蔽 keyed provider
-   的老问题**（`requires_openai_auth` 才会被 `auth_mode=chatgpt` 遮蔽）；只有「seeded」形态
-   （`apiKey` 且 value 为空 = key 在 auth.json 里）才回落到 `requires_openai_auth`，面板仍会告警。
-
-### RPC
-
-`TypertRemoteService`，namespace `codexProviders`（hub 经 `/hub/api?agent=codex` 原样转发）：
-`get` / `save` / `remove`。**API key 只写不读**——wire 上只有 `hasKey`，绝不回传值。
-没有 `select`：选择是 DSH 的 per-session 状态。
-
-### 模型目录必须克隆模板
-
-codex 0.154 对 catalog 条目要求 `slug`/`display_name`/`supported_reasoning_levels`/`shell_type`/
-`visibility`/`supported_in_api`/`priority`/`support_verbosity` 以及**嵌套 struct** `truncation_policy`…
-字段链未终止，故只从既有条目克隆并覆盖身份字段。目录是**替换式**：一份目录只写它那个 provider 的模型
-（2026-10-03 修正：早期「吸收且永不丢弃」让 Chat 模型清单只增不减）。
-
-记录：`docs/superpowers/plans/2026-10-03-codex-multi-provider-hub.md` +
-`docs/test-reports/2026-10-04-codex-multi-provider-onthefly.md`。

package/agent-codex-sdk/README.md

@@ -1,79 +0,0 @@
-# @pgmi-builds/agent-codex-sdk
-
-superd 外壳下的 **Codex adapter**（super-dsh 线，AW-E）：把 Codex CLI 经由
-`@openai/codex-sdk` 接进 DSH —— 会话、事件、模型目录、持久化全部按 DSH 语义呈现，
-WebUI 消费的是 DSH 服务提供的数据面。
-
-> 通用规则（定位 / 两形态 / 测试准则 / 接线域 / per-agent 定制权 / home 与 profile 布局）
-> 见上级目录的 `agent-adapter-dev-rules.md` —— 改本包前先读它。
-
-## 它是什么
-
-- 一个**普通 dsh plugin bundle**：`package.json` 的 `dsh.bundle.patch` 指向本目录的
-  `cordis.patch.yml`（挂 codex provider、关掉它替代的原生行、重写权限三档表、pin 应用内目录选择器）。
-- 一个 **AgentFactory**：`src/index.ts` 里的 `CodexProvider` 在 `ctx.agents` 注册工厂，
-  每个会话一个 `CodexSdkClient`（真 `@openai/codex-sdk` 线程）；`src/agent.ts` 把 Codex 线程事件
-  投影成 DSH 会话事件。
-- **带自己的 world 入口**：`src/world-plugin.ts`（`./world`，world key `codex-sdk`）把它作为
-  superd 世界挂载（`spawnWorld` + `worldMountPatches`），需要 hub 的 `@pgmi-builds/superd-hub`；
-  同一份 adapter 代码也可作为普通 bundle 点亮一个完整 web app（两形态一条代码路径）。
-
-## 零声明依赖与运行时自取（2026-10-04 user 裁决）
-
-本包 **不声明任何运行时依赖** —— `@openai/codex-sdk` / `@openai/codex` / `zod` 既不在
-`dependencies`、也不在 `optionalDependencies`、也不在 `peerDependencies`（`dependencies` 恒为
-`{}`），安装期零下载、零 postinstall。SDK 树在**首个真 prompt** 时才被 fetch 进
-`<worldHome>/sdk-runtime/`（`src/sdk-runtime.ts`）：
-
-- marker `<worldHome>/sdk-runtime.json`（**最后写**：写不到就不算成功）、锁 `.lock`（mkdir 原子，
-  30 min 判陈旧可夺）、失败留 `.error.log`；
-- marker 身份 = 本包版本 + 两个 pin，任一变化即重取；命中且 entry 存在则零网络短路；
-- 装完立刻 smoke `import()` entry 并要求 `Codex` 构造器存在 —— 坏树在 fetch 时报错，不留到首 prompt；
-- 预热（dev/运维）：`npm run fetch-sdk-runtime [<home>]`（只接受仓内 `.tests` 下的 home）。
-
-## 跑起来
-
-本包默认 **disabled**（composite 行 `agent-codex-sdk`，打开该行即启用）：行为级验证只走整包
-pack 线（`super-dsh/test/start-4999.sh` + dev3 实装），不另起 per-agent 场景 rig（2026-09-24
-场景退役，见 `agent-adapter-dev-rules.md` §2）。`CODEX_TRACE=1` 开 provider/agent 追踪。
-## Home 与 profile 布局（user 裁定）
-
-| 位置 | 内容 |
-|---|---|
-| `$DSH_HOME`（测试 = `<repo>/.tests`） | 测试 DSH home |
-| `<DSH_HOME>/agents/codex-sdk` | 该世界的 **world DSH home**（`dsh-sessions.json` 映射等 adapter 态）+ **自取 SDK 运行时** `<worldHome>/sdk-runtime/`；codex app home 仍是原生 `~/.codex`（绝不重定向） |
-| `$DSH_HOME/profiles/codex-sdk` | 该世界的 dsh profile（bundles + `cordis.patch.yml`） |
-| `$DSH_HOME/sessions/...` | **DSH 会话日志**（上游 `session-persistence-jsonl`，zstd）——list/replay 都由此提供 |
-
-**禁止**自造 per-app home（如 `.tests/codex-app`）。
-
-## 关键实现点
-
-- **session 身份 = 一对一映射**：DSH session id 是权威；Codex thread id 在其物化后写入
-  `<worldHome>/dsh-sessions.json`（`src/session-map.ts`）。resume 只经该映射重挂线程，查不到即
-  fail-closed。**不自建 rollout 扫描做 list，也不自解析 JSONL 做 replay。**
-- **DSH-native 持久化**：工厂按上游 agent-loop 的方式持有写通道（create `persistence.create` /
-  resume `persistence.open(id,'write')` → `read` → `interruptedTurnClosers` → `prepare`），
-  发布点刷未存后缀，dispose 时 `handle.close()` 排空。
-- **每会话路由钉住**：工厂在 create/resume 时同步钉住本会话路由（追加 `model/selection` +
-  `installModelSelection`），**不依赖全局默认模型的落盘时序**（共享 test home 里 settings 默认可能属别线）。
-- **事件映射**：`system/message`（Codex 系统提示，rollout HEAD `base_instructions`）、
-  `request/context`（provider/model/contextWindow）、`assistant/message`（reasoning 用
-  `{type:'reasoning',text}`）、`tool/call`（原始 JSON 串）/`tool/result`、`step/start|end`、`turn/start|end`。
-
-## 测试
-
-```bash
-npm run build                                   # tsc strict
-DSH_HOME=<repo>/.tests \
-SUPERD_DSH_ANCHOR=<repo>/upstream/deepseek-harness/package.json \
-node --test test/*.test.mjs
-```
-
-## 已知边界（V1）
-
-- 审批仅 launch-only 预设（SDK 无运行时审批；app-server 线才有 `*/requestApproval`）；
-- 无 steer / 无运行时换模型（下一轮生效）/ usage 滞后一轮 / 无 fork；
-- `compaction/*`、`todo/write`、`subagent/*` 未接（见规则文档 §9.4 backlog）；
-- **world 入口**：`src/world-plugin.ts`（world key `codex-sdk`）已接线 `spawnWorld`；roster 条目
-  fiber-scoped、行关闭时 dispose 世界（2026-10-03 omp-sdk 验收踩到的两条卸载契约）。