super-dsh 0.1.10 → 0.1.11

package/agent-claude/dist/index.js

@@ -25,15 +25,21 @@ import { Service } from "@deepseek-ai/cordis";
 import { SessionLogOffset, SessionPreparation, interruptedTurnClosers, } from "@deepseek-ai/dsh-session";
 import { ClaudeSdkClient, probeClaudeModels } from "./claude-client.js";
 import { ClaudeAgent } from "./agent.js";
-import { ClaudeLlmAdapter, CLAUDE_PROVIDER_ID } from "./adapter.js";
+import { ClaudeLlmAdapter, CLAUDE_PROVIDER_ID, routeIds } from "./adapter.js";
 import { resolveClaudeHome } from "./claude-home.js";
 import { resetProjectionState } from "./claude-events.js";
 import { claudeSessionIdFromDsh } from "./session-id.js";
 import { claudePermissionMode, defaultPermissionPreset, modeChangePatch, presetFromEvents, } from "./permission.js";
 import { sessionRecord, upsertSession } from "./session-map.js";
 import { makeCanUseTool, answerAskUserQuestion, askPlanReview, } from "./interaction.js";
-import { modelEntryFromSdk, readModelCatalog, setModelCatalog, CLAUDE_DEFAULT_MODEL } from "./models.js";
+import { modelEntryFromSdk, setModelCatalog, CLAUDE_DEFAULT_MODEL } from "./models.js";
 import { registerClaudePreset } from "./agent-preset-claude.js";
+import { claudeLaunchFor } from "./claude-launch.js";
+import { routeSeed } from "./claude-route.js";
+import { endpointKey, readProviderStore } from "./claude-providers.js";
+import { ClaudeProvidersGateway, syncFromNative } from "./claude-provider-gateway.js";
+import { readNativeModel, readNativeProviders } from "./claude-native-config.js";
+import { resolveClaudeBinary } from "./sdk-runtime.js";
 const CLAUDE_MODES = ["default", "acceptEdits", "bypassPermissions", "plan", "auto", "dontAsk"];
 /** Narrow an untrusted value to a persisted Claude permission mode. */
 function isClaudeMode(raw) {
@@ -56,6 +62,14 @@ const trace = (...parts) => {
     if (process.env.CLAUDE_TRACE === "1")
         process.stderr.write(`[claude-provider ${Date.now() % 1_000_000}] ${parts.join(" ")}\n`);
 };
+/**
+ * How often the canonical store is reconciled with the user's `settings.json`
+ * env (2026-10-04 user ruling: startup + every ten minutes). The file is the
+ * user's own and edited with their own tools, so the sync is a poll rather
+ * than an event subscription — ten minutes is the granularity the ruling
+ * asked for.
+ */
+const SYNC_INTERVAL_MS = 600_000;
 /**
  * Resume identity guard (exported for unit testing): fail closed when no Claude
  * session is recorded for the DSH session id. Route B (a mapping file) is V1+
@@ -118,6 +132,11 @@ export class ClaudeProvider extends Service {
     home;
     /** Echo/staleness guard for the app-wide default-model push. */
     defaultModelKey = "";
+    /** Epoch ms of the last reconcile with the user's `settings.json` env. */
+    syncedAt;
+    /** The live `ctx.llm` registration for the claude routes, when one exists.
+     *  Its `replace()` is how the route SET follows the store (codex twin). */
+    routes;
     constructor(ctx) {
         super(ctx, "claudeProvider");
         this.runtime = { ctx };
@@ -127,6 +146,17 @@ export class ClaudeProvider extends Service {
         trace(`home: worldHome=${this.home} claudeHome=${resolveClaudeHome()}`);
         ctx.effect(() => ctx.agents.setFactory(this), "claudeProvider.setFactory()");
         this.#registerModelCatalog();
+        // The store is canonical and the native settings.json env is a source
+        // (2026-10-04). Reconcile once at startup, then keep reconciling on a
+        // timer; the sync is idempotent and write-only-when-moved, so a world
+        // with no providers configured pays nothing but a no-op read.
+        this.syncNow();
+        const timer = setInterval(() => this.syncNow(), SYNC_INTERVAL_MS);
+        timer.unref?.();
+        // Fiber-scoped cleanup (super-dsh/AGENTS unload contract): the timer must
+        // never outlive this row — HMR row unload disposes the fiber, which runs
+        // this effect's disposer.
+        ctx.effect(() => () => clearInterval(timer), "claudeProvider.syncTimer()");
         // The roster must be visible to the API gateway's root-level remote
         // enumeration; nesting it under a child fiber via ctx.plugin hides its
         // @Remote routes from the gateway and every agentPresets/* call 404s (the
@@ -140,6 +170,50 @@ export class ClaudeProvider extends Service {
         registerClaudePreset(ctx);
         this.#registerDefaultModel();
         this.#probeBootModels();
+        // The Hub settings panel's data plane (2026-10-04 multi-provider ruling):
+        // an adapter-owned Typert Remote (`claudeProviders/get|save|remove`) on
+        // this world's context. The hub's carrier forwards `envelope.method`
+        // verbatim, so the panel reaches it through the existing
+        // `/hub/api?agent=claude` family — no new hub route, and no provider
+        // knowledge leaks out of the adapter (dev-rules §12). Cordis keeps the
+        // instance alive as this context's `claudeProviders` service. There is no
+        // `select`: which provider a session runs on is DSH's per-session
+        // `model/selection`.
+        //
+        // `resolveClaudeHome` is passed as a THUNK on purpose (the codex twin's
+        // rule): the native home is re-resolved per call, so a test's
+        // `CLAUDE_CONFIG_DIR` and an operator's override are both honored.
+        //
+        // A panel save/remove re-points the route SET (one route per provider, plus
+        // the fixed `claude` route) through routes.replace — the codex twin's
+        // mechanism, wired exactly.
+        new ClaudeProvidersGateway(ctx, this.home, () => resolveClaudeHome(), () => this.refreshRoutes());
+    }
+    /**
+     * Reconcile the canonical provider store with the user's `settings.json`
+     * env (2026-10-04 user ruling) and stamp the last-reconcile epoch.
+     *
+     * Called once at startup and every {@link SYNC_INTERVAL_MS}. Mirrors the
+     * codex twin's semantics exactly — idempotent, silent, and
+     * write-only-when-moved (claude-providers.ts guarantees the store rewrite
+     * happens only when something actually changed) — minus codex's
+     * `#applyRoutes` step: claude serves every provider under the ONE fixed
+     * `claude` route registered at boot, so there is no route set to re-point.
+     * Never throws: a provider list is not worth a boot.
+     */
+    syncNow() {
+        try {
+            const { store, added, updated } = syncFromNative(this.home, resolveClaudeHome());
+            trace(`provider sync: added=${added.join(",") || "none"} updated=${updated.join(",") || "none"}`);
+            if (added.length > 0 || updated.length > 0) {
+                this.runtime.ctx.logger.info(`claude-provider: settings.json sync — added ${added.join(", ") || "none"}, refreshed ${updated.join(", ") || "none"}`);
+            }
+            this.syncedAt = Date.now();
+            this.#applyRoutes(store);
+        }
+        catch (error) {
+            this.runtime.ctx.logger.warn(`claude-provider: provider sync failed: ${String(error)}`);
+        }
     }
     /**
      * RC-3 boot model probe: ONE ephemeral SDK query asks the CLI's
@@ -150,7 +224,7 @@ export class ClaudeProvider extends Service {
      * probe-failure fallback, and a live session re-observes anyway.
      */
     #probeBootModels() {
-        void probeClaudeModels()
+        void probeClaudeModels({ worldHome: this.home })
             .then((models) => {
             const entries = models.flatMap((model) => modelEntryFromSdk(model));
             if (entries.length === 0) {
@@ -222,21 +296,22 @@ export class ClaudeProvider extends Service {
         // The host-side permission gate is injected now, closing over the injected
         // approval/questions seams plus a lazy agent holder (set in setupAndPublish).
         const agentRef = { current: undefined };
-        const client = new ClaudeSdkClient({
+        const canUseTool = makeClaudeCanUseTool({
+            approval: loopCtx.get("approval"),
+            questions: loopCtx.get("userQuestions"),
+            getAgent: () => agentRef.current,
+        });
+        // One factory per session: the shared wiring (canUseTool, worldHome, cwd,
+        // permission posture) plus per-instance overrides. The agent swaps the whole
+        // client through it when a provider move needs a different child.
+        const clientFactory = (overrides = {}) => new ClaudeSdkClient({
             cwd: spawnCwd,
-            claudeSessionId,
-            canUseTool: makeClaudeCanUseTool({
-                approval: loopCtx.get("approval"),
-                questions: loopCtx.get("userQuestions"),
-                getAgent: () => agentRef.current,
-            }),
+            worldHome: this.home,
+            canUseTool,
             allowDangerouslySkipPermissions: claudeMode === "bypassPermissions",
+            ...overrides,
         });
-        // Apply the resolved boot/observed default to the CLI (mirrors codex's
-        // create-time `setModel`); an explicit caller selection is honored by
-        // `sessionAgentOptions` at publication.
-        const createCatalog = readModelCatalog();
-        void client.setModel(createCatalog.defaultModel ?? CLAUDE_DEFAULT_MODEL).catch(() => { });
+        const client = clientFactory({ claudeSessionId });
         const preparation = SessionPreparation.create(loopCtx.sessions.prepare(id, {
             ...(options.seed === undefined ? {} : { seed: options.seed }),
             ...(meta === undefined ? {} : { meta }),
@@ -271,7 +346,9 @@ export class ClaudeProvider extends Service {
                     upsertSession(this.home, String(id), { resumable: false });
                     trace(`marked ${id} not resumable (conversation never materialized)`);
                 },
-            }, agentRef);
+                launchFor: (providerId, model) => this.agentLaunchFor(providerId, model),
+                contextWindowFor: (providerId, model) => this.agentContextWindowFor(providerId, model),
+            }, agentRef, clientFactory);
         }
         catch (error) {
             trace(`create ${id} THREW: ${String(error)}`);
@@ -333,16 +410,19 @@ export class ClaudeProvider extends Service {
         // first prompt). Re-apply the persisted permission mode up front (buffered
         // until the query exists), and re-inject the host-side permission gate.
         const agentRef = { current: undefined };
-        const client = new ClaudeSdkClient({
+        const canUseTool = makeClaudeCanUseTool({
+            approval: loopCtx.get("approval"),
+            questions: loopCtx.get("userQuestions"),
+            getAgent: () => agentRef.current,
+        });
+        const clientFactory = (overrides = {}) => new ClaudeSdkClient({
             cwd: spawnCwd,
-            resumeSessionId: claudeSessionId,
-            canUseTool: makeClaudeCanUseTool({
-                approval: loopCtx.get("approval"),
-                questions: loopCtx.get("userQuestions"),
-                getAgent: () => agentRef.current,
-            }),
+            worldHome: this.home,
+            canUseTool,
             allowDangerouslySkipPermissions: claudeMode === "bypassPermissions",
+            ...overrides,
         });
+        const client = clientFactory({ resumeSessionId: claudeSessionId });
         void client.setPermissionMode(claudeMode).catch(() => { });
         let handle;
         let stored;
@@ -397,7 +477,9 @@ export class ClaudeProvider extends Service {
                     upsertSession(this.home, String(id), { resumable: false });
                     trace(`marked ${id} not resumable (conversation never materialized)`);
                 },
-            }, agentRef);
+                launchFor: (providerId, model) => this.agentLaunchFor(providerId, model),
+                contextWindowFor: (providerId, model) => this.agentContextWindowFor(providerId, model),
+            }, agentRef, clientFactory);
         }
         catch (error) {
             trace(`resume ${id} THREW: ${String(error)} | stack=${error instanceof Error ? error.stack?.slice(0, 400) : "n/a"}`);
@@ -412,25 +494,104 @@ export class ClaudeProvider extends Service {
         }
     }
     #registerModelCatalog() {
+        this.#applyRoutes(readProviderStore(this.home));
+    }
+    /** Re-register the `ctx.llm` routes from the current store (panel mutation path). */
+    refreshRoutes() {
+        try {
+            this.#applyRoutes(readProviderStore(this.home));
+        }
+        catch (error) {
+            this.runtime.ctx.logger.warn(`claude-provider: route refresh failed: ${String(error)}`);
+        }
+    }
+    /** Register or atomically re-point the claude routes at the given store
+     *  (the fixed `claude` route + one route per provider with models). */
+    #applyRoutes(store) {
         const llm = this.runtime.ctx.get("llm");
         if (llm === undefined)
             return;
-        llm.registerAdapter([CLAUDE_PROVIDER_ID], new ClaudeLlmAdapter());
+        const ids = routeIds(store);
+        if (this.routes === undefined) {
+            this.routes = llm.registerAdapter([...ids], new ClaudeLlmAdapter(this.home));
+            trace(`routes registered: ${ids.join(", ")}`);
+            return;
+        }
+        // `replace` validates the whole candidate set before swapping; a throw here
+        // must not take the caller (a timer, or a panel save) down with it.
+        this.routes.replace([...ids]);
+        trace(`routes replaced: ${ids.join(", ") || "none"}`);
     }
     /**
      * The factory owns its sessions' route (user directive 2026-09-15): the
      * ambient `agentDefaultModel` selection is NOT authoritative here — a session
-     * created by this factory always runs on the `claude` route, with the boot
-     * default (or an observed default) unless the caller asked for a served
-     * claude model.
+     * created by this factory starts from the reconciled pair below unless the
+     * caller asked for a route this world serves (the native `claude` route or a
+     * curated provider route).
      */
     sessionAgentOptions(requested) {
-        const catalog = readModelCatalog();
-        const explicit = requested?.provider === CLAUDE_PROVIDER_ID && typeof requested.model === "string" && requested.model !== ""
-            ? requested.model
+        // 1. A caller-requested route wins when it names a pair this world serves:
+        //    the fixed native `claude` route (any raw id — launch native, inject
+        //    nothing) or a curated provider route whose models include the id.
+        const wanted = requested?.provider !== undefined && typeof requested.model === "string" && requested.model !== ""
+            ? requested
             : undefined;
-        const model = explicit ?? catalog.defaultModel ?? CLAUDE_DEFAULT_MODEL;
-        return { ...(requested ?? {}), provider: CLAUDE_PROVIDER_ID, ...(model === undefined ? {} : { model }) };
+        const served = wanted !== undefined && (wanted.provider === CLAUDE_PROVIDER_ID
+            || this.providerEntry(wanted.provider)?.models.some((model) => model.id === wanted.model) === true);
+        if (wanted !== undefined && served)
+            return { ...wanted, provider: wanted.provider, model: wanted.model };
+        // 2. Native fold model (the user's own settings.json env).
+        const nativeProvider = this.nativeProviderId();
+        const nativeModel = readNativeModel(resolveClaudeHome());
+        if (nativeProvider !== undefined && nativeModel !== undefined && nativeModel !== "") {
+            return { ...(requested ?? {}), provider: nativeProvider, model: nativeModel };
+        }
+        // 3. First provider's first model.
+        for (const entry of readProviderStore(this.home).providers) {
+            const model = entry.models[0]?.id;
+            if (model !== undefined)
+                return { ...(requested ?? {}), provider: entry.id, model };
+        }
+        // 4. Legacy boot default (claude/sonnet → NATIVE_LAUNCH).
+        return { ...(requested ?? {}), provider: CLAUDE_PROVIDER_ID, model: CLAUDE_DEFAULT_MODEL };
+    }
+    /** The store entry a provider id names, or `undefined`. */
+    providerEntry(providerId) {
+        return readProviderStore(this.home).providers.find((entry) => entry.id === providerId);
+    }
+    /** The provider id the user's own settings.json env folds to, or `undefined`. */
+    nativeProviderId() {
+        const table = readNativeProviders(resolveClaudeHome())[0];
+        if (table?.baseUrl === undefined)
+            return undefined;
+        const key = endpointKey(table.baseUrl);
+        return readProviderStore(this.home).providers.find((entry) => endpointKey(entry.baseUrl) === key)?.id;
+    }
+    /** The launch that pins one provider for a freshly spawned client. */
+    agentLaunchFor(providerId, model) {
+        const entry = this.providerEntry(providerId);
+        if (entry === undefined)
+            return undefined;
+        return claudeLaunchFor({ provider: providerId, model }, entry, resolveClaudeBinary());
+    }
+    /** The provider's own context window for one of its models, when known. */
+    agentContextWindowFor(providerId, model) {
+        const entry = this.providerEntry(providerId);
+        return entry?.models.find((candidate) => candidate.id === model)?.contextWindow;
+    }
+    /** The app-wide default selection (DSH-side `claude/<composite-or-boot>`). */
+    defaultModelSelection() {
+        const nativeProvider = this.nativeProviderId();
+        const nativeModel = readNativeModel(resolveClaudeHome());
+        if (nativeProvider !== undefined && nativeModel !== undefined && nativeModel !== "") {
+            return { provider: nativeProvider, model: nativeModel };
+        }
+        for (const entry of readProviderStore(this.home).providers) {
+            const model = entry.models[0]?.id;
+            if (model !== undefined)
+                return { provider: entry.id, model };
+        }
+        return { provider: CLAUDE_PROVIDER_ID, model: CLAUDE_DEFAULT_MODEL };
     }
     /**
      * App-wide default-model push (mirrors `agent-codex` `#registerDefaultModel`
@@ -447,8 +608,7 @@ export class ClaudeProvider extends Service {
             const service = mCtx.get("agentDefaultModel");
             if (service === undefined)
                 return;
-            const catalog = readModelCatalog();
-            const target = { provider: CLAUDE_PROVIDER_ID, model: catalog.defaultModel ?? CLAUDE_DEFAULT_MODEL };
+            const target = this.defaultModelSelection();
             const targetKey = `${target.provider}/${target.model}`;
             const current = service.currentSelection?.();
             const currentKey = current === undefined ? undefined : `${current.provider}/${current.model}`;
@@ -487,7 +647,7 @@ async function appendUnstoredSuffix(stored, session) {
  * a module-level function (not a private method) because Cordis exposes the
  * provider through a tracing proxy, which breaks hard-private receivers.
  */
-async function setupAndPublish(loopCtx, ownerCtx, id, agentOptions, setup, session, client, parentAgent, source, opts, stored, runtimeInfo, agentRef) {
+async function setupAndPublish(loopCtx, ownerCtx, id, agentOptions, setup, session, client, parentAgent, source, opts, stored, runtimeInfo, agentRef, clientFactory) {
     let detachSession;
     let detachAgent;
     let agent;
@@ -497,8 +657,25 @@ async function setupAndPublish(loopCtx, ownerCtx, id, agentOptions, setup, sessi
         // module-level reset is belt-and-suspenders for a re-entry before the
         // agent exists (e.g. a throwing setup that re-publishes).
         resetProjectionState();
-        agent = new ClaudeAgent(loopCtx, id, agentOptions, session, client, () => idleExit?.(), runtimeInfo);
+        agent = new ClaudeAgent(loopCtx, id, agentOptions, session, client, () => idleExit?.(), runtimeInfo, clientFactory);
         agentRef.current = agent;
+        // Seed THIS session's route only when its log has none (mirrors codex): the
+        // harness's `model/selection` is the durable per-session route, so an
+        // existing one is the authority and only a session that never named a route
+        // gets the boot default. Log-only — the agent resolves it each turn.
+        try {
+            const events = session.snapshotEvents();
+            const alreadyRouted = events.some((event) => event.type === "model/selection");
+            const seed = routeSeed(agentOptions);
+            if (!alreadyRouted && seed !== undefined) {
+                const selection = { provider: seed.provider, model: seed.model };
+                session.append("model/selection", selection);
+                trace(`session route seeded: ${selection.provider}/${selection.model}`);
+            }
+        }
+        catch (error) {
+            trace(`session route seeding failed: ${String(error)}`);
+        }
         // Composition-only setup on the unpublished agent scope.
         const commit = await setup?.(agent.ctx, agent);
         // Publish: flush the unstored suffix, enter + announce in order.

package/agent-claude/dist/models.js

@@ -30,6 +30,7 @@
  * field: exactly one Claude app per world observes it, and the settings-UI
  * round trip constructs its own adapter instance.
  */
+import { compositeModelId } from "./claude-route.js";
 /** The empty catalog after a legitimate empty observation (`setModelCatalog([])`). */
 const EMPTY_CATALOG = Object.freeze({ models: Object.freeze([]) });
 /**
@@ -97,6 +98,19 @@ export function readModelCatalog() {
         ...(catalog.defaultModel === undefined ? {} : { defaultModel: catalog.defaultModel }),
     });
 }
+/**
+ * Mint one observed entry's catalog id as `${provider}/${id}` (the composite id
+ * the selector picks). Only the LIVE session's authoritative `supportedModels()`
+ * roster goes through this — the degraded single-entry catalog and the boot
+ * probe stay raw (observed-default stays raw-only-in-memory).
+ *
+ * @param provider - the CURRENT turn's provider (`#turnRoute?.provider ?? "native"`).
+ * @param entries - observed entries whose ids are RAW wire ids.
+ * @returns the entries with composite ids.
+ */
+export function mintCatalogEntries(provider, entries) {
+    return entries.map((entry) => ({ ...entry, id: compositeModelId(provider, entry.id) }));
+}
 /**
  * Derive the **degraded** single-entry catalog from a projected `session_init`
  * (Task 4) while `supportedModels()` has not answered yet.