super-dsh 0.1.3 → 0.1.5

package/superd-hub/dist/system-head.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Protected system-surface head co-writer for bridge sessions (2026-09-24).
+ *
+ * dsh session format v4 (0.1.7 reader) constrains every `system/message`
+ * twice: it must sit INSIDE an open, matching turn+step (`requireStep`), and
+ * it must either BE the surface's first node (the protected head) or replace
+ * one ("system/message requires a protected first surface head"). Bridge
+ * adapters learn the runtime's real prompt only after the first user message
+ * is already on the surface, and most write the user message at turn level
+ * (before any step) — so every bridge-written log violated one rule or the
+ * other and became unresumable across restarts.
+ *
+ * The native loop never hits this because it opens the step before writing
+ * anything: `turn/start → step/start → system/message → user/message …`,
+ * and later prompt changes REPLACE the protected head (the operation
+ * compaction also uses). This module gives bridge adapters that posture with
+ * a one-line wrap:
+ *
+ *   this.session = withSystemHead(session, () => createSystemMessage(""))
+ *
+ * The wrap is a transparent Proxy that tracks the open turn/step (exactly as
+ * the v4 reader does) and intervenes minimally:
+ *
+ *   - the FIRST `user/message` append on a still-headless, still-empty
+ *     surface first opens the turn's next step (when a turn is open but no
+ *     step is) and appends a placeholder head; the adapters' real prompt
+ *     later REPLACES it (replaced heads are shadowed out of derived model
+ *     history, so the empty placeholder never reaches the model or the UI);
+ *   - the adapter's own `step/start` for a step THIS wrap opened is dropped
+ *     (the log already carries it — appending again would duplicate), and a
+ *     wrap-opened step still open at `turn/end` is closed just before it;
+ *   - `stampSystemPrompt(turn, step, message)` appends-or-replaces the
+ *     protected head with the runtime's real prompt. A stamp arriving with
+ *     no open step (an adapter bootstrapping before the first turn) is
+ *     queued and flushed inside the next step the adapter opens;
+ *   - everything else delegates unchanged.
+ *
+ * A surface that already starts with a user message and has no head (legacy
+ * logs) stays headless — valid — and is never stamped: appending a head
+ * there is exactly the corruption this module exists to prevent.
+ */
+/**
+ * The session slice the co-writer reads. Deliberately loose so the real
+ * (generic-typed) `Session.append` satisfies it; the system-head calls go
+ * through {@link SystemHeadAppend}, the shape this module itself issues.
+ */
+export interface HeadAwareSessionFace {
+    append(...args: never[]): unknown;
+    snapshotEvents(): ReadonlyArray<{
+        type: string;
+        seq: number;
+        surfaceOp?: unknown;
+    }>;
+}
+/** Builds the placeholder head message (adapters pass their createSystemMessage). */
+export type HeadPlaceholder = () => unknown;
+/** One co-written session: transparent delegation + head bookkeeping. */
+export type WithSystemHead<S> = S & {
+    /** Append-or-replace the protected head with the runtime's system prompt. */
+    stampSystemPrompt(turn: number, step: number, message: unknown): void;
+};
+/**
+ * Wrap one bridge session with protected-head co-writing.
+ * @param session - the adapter's real Session.
+ * @param placeholder - builds the placeholder head message when the first
+ *   user message arrives on an empty surface.
+ * @returns the session (transparently delegated) with `stampSystemPrompt`.
+ */
+export declare function withSystemHead<S extends HeadAwareSessionFace>(session: S, placeholder: HeadPlaceholder): WithSystemHead<S>;

package/superd-hub/dist/system-head.js

@@ -0,0 +1,194 @@
+/**
+ * Protected system-surface head co-writer for bridge sessions (2026-09-24).
+ *
+ * dsh session format v4 (0.1.7 reader) constrains every `system/message`
+ * twice: it must sit INSIDE an open, matching turn+step (`requireStep`), and
+ * it must either BE the surface's first node (the protected head) or replace
+ * one ("system/message requires a protected first surface head"). Bridge
+ * adapters learn the runtime's real prompt only after the first user message
+ * is already on the surface, and most write the user message at turn level
+ * (before any step) — so every bridge-written log violated one rule or the
+ * other and became unresumable across restarts.
+ *
+ * The native loop never hits this because it opens the step before writing
+ * anything: `turn/start → step/start → system/message → user/message …`,
+ * and later prompt changes REPLACE the protected head (the operation
+ * compaction also uses). This module gives bridge adapters that posture with
+ * a one-line wrap:
+ *
+ *   this.session = withSystemHead(session, () => createSystemMessage(""))
+ *
+ * The wrap is a transparent Proxy that tracks the open turn/step (exactly as
+ * the v4 reader does) and intervenes minimally:
+ *
+ *   - the FIRST `user/message` append on a still-headless, still-empty
+ *     surface first opens the turn's next step (when a turn is open but no
+ *     step is) and appends a placeholder head; the adapters' real prompt
+ *     later REPLACES it (replaced heads are shadowed out of derived model
+ *     history, so the empty placeholder never reaches the model or the UI);
+ *   - the adapter's own `step/start` for a step THIS wrap opened is dropped
+ *     (the log already carries it — appending again would duplicate), and a
+ *     wrap-opened step still open at `turn/end` is closed just before it;
+ *   - `stampSystemPrompt(turn, step, message)` appends-or-replaces the
+ *     protected head with the runtime's real prompt. A stamp arriving with
+ *     no open step (an adapter bootstrapping before the first turn) is
+ *     queued and flushed inside the next step the adapter opens;
+ *   - everything else delegates unchanged.
+ *
+ * A surface that already starts with a user message and has no head (legacy
+ * logs) stays headless — valid — and is never stamped: appending a head
+ * there is exactly the corruption this module exists to prevent.
+ */
+/** Events that occupy a slot on the ordered message surface. */
+const SURFACE_TYPES = new Set(['system/message', 'user/message', 'developer/message', 'assistant/message', 'tool/result']);
+/** Seq of the live protected head: the LAST `system/message` on the surface (replacements shadow their source). */
+function liveHeadSeq(events) {
+    let head;
+    for (const event of events) {
+        if (event.type === 'system/message' && event.surfaceOp !== undefined)
+            head = event.seq;
+    }
+    return head;
+}
+/** Whether any surface node exists yet. */
+function surfaceIsEmpty(events) {
+    return !events.some(event => SURFACE_TYPES.has(event.type) && event.surfaceOp !== undefined);
+}
+/**
+ * Wrap one bridge session with protected-head co-writing.
+ * @param session - the adapter's real Session.
+ * @param placeholder - builds the placeholder head message when the first
+ *   user message arrives on an empty surface.
+ * @returns the session (transparently delegated) with `stampSystemPrompt`.
+ */
+export function withSystemHead(session, placeholder) {
+    // The one narrow this module performs: the loose face above is what makes
+    // the generic real Session assignable; every call below issues exactly the
+    // SystemHeadAppend shape.
+    const appendHead = session.append.bind(session);
+    const rawAppend = session.append.bind(session);
+    // Reader-mirrored turn/step state.
+    let turn = null;
+    let step = null;
+    let nextStep = 1;
+    let wrapOpenedStep = false;
+    let wrapClosedStep;
+    let headSeq;
+    let queuedStamp;
+    const openWrapStep = () => {
+        if (turn === null || step !== null)
+            return step !== null;
+        rawAppend('step/start', { turn, step: nextStep });
+        step = nextStep;
+        wrapOpenedStep = true;
+        return true;
+    };
+    const ensureHead = () => {
+        if (headSeq !== undefined)
+            return;
+        headSeq = liveHeadSeq(session.snapshotEvents());
+        if (headSeq !== undefined)
+            return;
+        if (!surfaceIsEmpty(session.snapshotEvents()))
+            return; // headless-but-valid legacy surface: never append here
+        if (!openWrapStep())
+            return; // no open turn: a head is impossible; stay headless
+        headSeq = appendHead('system/message', { turn: turn, step: step, message: placeholder() }, { surfaceOp: 'append' }).seq;
+    };
+    const stamp = (turnArg, stepArg, message) => {
+        if (step === null) {
+            // No open step (adapter bootstrapping before the first turn): queue and
+            // flush inside the step the adapter opens next.
+            queuedStamp = { turn: turnArg, step: stepArg, message };
+            return;
+        }
+        if (headSeq === undefined) {
+            headSeq = liveHeadSeq(session.snapshotEvents());
+            if (headSeq === undefined && surfaceIsEmpty(session.snapshotEvents())) {
+                headSeq = appendHead('system/message', { turn: turnArg, step: stepArg, message }, { surfaceOp: 'append' }).seq;
+                return;
+            }
+        }
+        if (headSeq === undefined) {
+            queuedStamp = { turn: turnArg, step: stepArg, message };
+            return; // headless legacy surface: stamping would corrupt it
+        }
+        headSeq = appendHead('system/message', { turn: turn ?? turnArg, step: step ?? stepArg, message }, { surfaceOp: { op: 'replace', startSeq: headSeq, endSeq: headSeq }, sourceEventSeqs: [headSeq] }).seq;
+    };
+    return new Proxy(session, {
+        get(target, property) {
+            if (property === 'stampSystemPrompt') {
+                return (turnArg, stepArg, message) => { stamp(turnArg, stepArg, message); };
+            }
+            if (property === 'append') {
+                return (type, data, opts) => {
+                    if (type === 'turn/start') {
+                        turn = data.turn;
+                        nextStep = 1;
+                        wrapOpenedStep = false;
+                        wrapClosedStep = undefined;
+                    }
+                    else if (type === 'turn/end') {
+                        // A step THIS wrap opened must not survive the turn boundary.
+                        if (step !== null && wrapOpenedStep) {
+                            rawAppend('step/end', { turn, step });
+                            wrapClosedStep = step;
+                            step = null;
+                            nextStep += 1;
+                        }
+                        turn = null;
+                    }
+                    else if (type === 'step/start') {
+                        const dataStep = data;
+                        if (step !== null && wrapOpenedStep && dataStep.turn === turn && dataStep.step === step) {
+                            // The adapter opened the step the wrap already wrote: drop the
+                            // duplicate (the adapter's own counters stay consistent).
+                            return { type, seq: session.snapshotEvents().length, time: Date.now(), data };
+                        }
+                        if (step === null && dataStep.step !== undefined)
+                            step = dataStep.step;
+                        wrapOpenedStep = false;
+                        const applied = rawAppend(type, data);
+                        if (queuedStamp !== undefined && step !== null) {
+                            const pending = queuedStamp;
+                            queuedStamp = undefined;
+                            stamp(pending.turn, pending.step, pending.message);
+                        }
+                        return applied;
+                    }
+                    else if (type === 'step/end') {
+                        const dataStep = data;
+                        if (step === null && wrapClosedStep !== undefined && dataStep.step === wrapClosedStep) {
+                            wrapClosedStep = undefined;
+                            return { type, seq: session.snapshotEvents().length, time: Date.now(), data }; // the wrap already closed it
+                        }
+                        step = null;
+                        if (dataStep.step !== undefined)
+                            nextStep = dataStep.step + 1;
+                    }
+                    else if (type === 'user/message') {
+                        ensureHead();
+                    }
+                    else if (type === 'system/message') {
+                        // A direct adapter append (notices, bootstraps): give it the step
+                        // context the reader demands — open the turn's next step when
+                        // none is open and NORMALIZE the coordinates to that context
+                        // (requireStep compares them for equality; a mismatched append
+                        // is doomed otherwise). Surface ordering beyond the head rules
+                        // stays the adapter's own responsibility.
+                        if (step === null && turn !== null)
+                            openWrapStep();
+                        if (step !== null && turn !== null) {
+                            const direct = data;
+                            if (direct.turn !== turn || direct.step !== step)
+                                data = { ...data, turn, step };
+                        }
+                    }
+                    return Reflect.apply(target.append, target, [type, data, opts]);
+                };
+            }
+            const value = Reflect.get(target, property, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}

package/superd-hub/dist/web-trust.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Web page trust component — the browser-side twin of the connection row's
+ * server-side `trustedHosts` fence (ported from better-dsh `web-trust.ts`,
+ * authorities leg only).
+ *
+ * Why: when the Web UI is served on an operator-declared non-loopback
+ * authority (Caddy domain, LAN IP), the server side accepts the Host through
+ * `trustedHosts`, but the BROWSER-side connection client computes
+ * `ctx.connection.isLoopback` from `location.hostname` — non-loopback → the
+ * page degrades into the describe-mirror shape (Host settings persistence
+ * reports terminal `memory` unavailability). This component injects one
+ * inline `<head>` script through the webserver's public
+ * `webserver/index-inject` event (every index render re-emits; row data is
+ * read fresh at emit time, so a config reload needs no listener re-wiring):
+ * when the page's hostname is one the operator declared their own, it sets
+ * `window.__DSH_TRANSPORT__ = { ownsHost: true }` BEFORE any application
+ * bundle materializes — the connection client's only whole-repo consumer —
+ * restoring the upstream-documented shape for trusted authorities.
+ *
+ * The object deliberately carries NO fetch/openStream: the connection
+ * client's optional chaining then builds the default HTTP/WS transport, so
+ * the flag's only effect is the loopback verdict. An existing
+ * `__DSH_TRANSPORT__` (a worker shell that owns a real transport) is never
+ * overwritten.
+ *
+ * On/off (two independent levels, both standard):
+ *   - row level: a profile layer with `- id: superd-web-trust / disabled: true`
+ *     removes the component entirely;
+ *   - config level: `trustedPageAuthorities: []` keeps the row mounted but
+ *     injects nothing (fully inert).
+ *
+ * Composed on ctx0 only (since path-separation T-D): the `super-dsh/web-trust`
+ * row in the composite bundle's insert list. The per-world row retired with
+ * the world pages themselves (T-D disabled the world webui rows — no world
+ * page renders, so no world-local injection exists); `/hub` is the sole
+ * foreign entry and it serves ctx0's index, which this ctx0 row covers.
+ *
+ * @module @pgmi-builds/superd-hub/web-trust
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+/**
+ * The schema-level default for `trustedPageAuthorities` (better-dsh v0.2.2a
+ * shape): derive from the trusted-hosts environment — the SAME single source
+ * the server-side fence legs read (`SUPERD_TRUSTED_HOSTS` on this line, upstream
+ * spelling `DSH_TRUSTED_HOSTS` honored first) — so ONE declaration (e.g. one
+ * `Environment=` line in the service unit) drives the server fence and the
+ * page leg with zero per-instance plugin config. Bare hostnames only:
+ * `location.hostname` carries no port, and {@link assertBareHostname} would
+ * reject a portful entry at boot, so portful/schematic entries are dropped
+ * here instead of thrown. Declared in the Config SCHEMA rather than the
+ * bundle patch row because a profile/home layer row with the same id
+ * whole-row-overrides the row's config object, while schema defaults fill
+ * per-key at plugin load and survive every overlay layer. An explicit
+ * configured value always wins.
+ *
+ * @param env - the raw trusted-hosts value (whitespace/comma separated).
+ * @returns the bare-hostname authorities to trust by default.
+ */
+export declare function deriveDefaultPageAuthorities(env: string | undefined): string[];
+/** The `webserver/index-inject` row shape this component pushes. */
+export interface BootScriptRow {
+    kind: 'script';
+    placement: 'head';
+    text: string;
+}
+/**
+ * Build the authorities-leg script. Pure: same config in, same script out —
+ * the unit tests pin the shape (authority match, no-overwrite guard,
+ * inert-when-empty, hostile-string escaping).
+ *
+ * @param trustedPageAuthorities - the operator-declared hostnames.
+ * @returns the script text, or `undefined` when the list is empty (inject
+ *   nothing — the component is fully inert).
+ */
+export declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined): string | undefined;
+/** Row config schema. */
+export interface TrustConfig {
+    /** Hostnames this operator declares their own devices' pages run on. */
+    trustedPageAuthorities?: readonly string[];
+}
+/** Row config schema (schema-level default derives from the trusted-hosts env). */
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    trustedPageAuthorities: z<string[], string[], "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    trustedPageAuthorities: z<string[], string[], "defined">;
+}>>, "plain">;
+/** Cordis plugin name. */
+export declare const name = "superd-web-trust";
+/**
+ * No static injects: `webServer` is composed conditionally inside
+ * {@link apply}, so the row loads (dormant) in compositions without one.
+ */
+export declare const inject: string[];
+/**
+ * Mount the authorities-leg injection: one `webserver/index-inject` listener
+ * pushing the rendered row.
+ * @param ctx - host plugin context.
+ * @param config - the row config.
+ */
+export declare function apply(ctx: Context, config: TrustConfig | undefined): void;
+declare const _default: {
+    name: string;
+    inject: string[];
+    Config: z<Schemastery.ObjectS<NoInfer<{
+        trustedPageAuthorities: z<string[], string[], "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        trustedPageAuthorities: z<string[], string[], "defined">;
+    }>>, "plain">;
+    apply: typeof apply;
+};
+export default _default;

package/superd-hub/dist/web-trust.js

@@ -0,0 +1,126 @@
+/**
+ * Web page trust component — the browser-side twin of the connection row's
+ * server-side `trustedHosts` fence (ported from better-dsh `web-trust.ts`,
+ * authorities leg only).
+ *
+ * Why: when the Web UI is served on an operator-declared non-loopback
+ * authority (Caddy domain, LAN IP), the server side accepts the Host through
+ * `trustedHosts`, but the BROWSER-side connection client computes
+ * `ctx.connection.isLoopback` from `location.hostname` — non-loopback → the
+ * page degrades into the describe-mirror shape (Host settings persistence
+ * reports terminal `memory` unavailability). This component injects one
+ * inline `<head>` script through the webserver's public
+ * `webserver/index-inject` event (every index render re-emits; row data is
+ * read fresh at emit time, so a config reload needs no listener re-wiring):
+ * when the page's hostname is one the operator declared their own, it sets
+ * `window.__DSH_TRANSPORT__ = { ownsHost: true }` BEFORE any application
+ * bundle materializes — the connection client's only whole-repo consumer —
+ * restoring the upstream-documented shape for trusted authorities.
+ *
+ * The object deliberately carries NO fetch/openStream: the connection
+ * client's optional chaining then builds the default HTTP/WS transport, so
+ * the flag's only effect is the loopback verdict. An existing
+ * `__DSH_TRANSPORT__` (a worker shell that owns a real transport) is never
+ * overwritten.
+ *
+ * On/off (two independent levels, both standard):
+ *   - row level: a profile layer with `- id: superd-web-trust / disabled: true`
+ *     removes the component entirely;
+ *   - config level: `trustedPageAuthorities: []` keeps the row mounted but
+ *     injects nothing (fully inert).
+ *
+ * Composed on ctx0 only (since path-separation T-D): the `super-dsh/web-trust`
+ * row in the composite bundle's insert list. The per-world row retired with
+ * the world pages themselves (T-D disabled the world webui rows — no world
+ * page renders, so no world-local injection exists); `/hub` is the sole
+ * foreign entry and it serves ctx0's index, which this ctx0 row covers.
+ *
+ * @module @pgmi-builds/superd-hub/web-trust
+ */
+import z from '@deepseek-ai/schemastery';
+/**
+ * The schema-level default for `trustedPageAuthorities` (better-dsh v0.2.2a
+ * shape): derive from the trusted-hosts environment — the SAME single source
+ * the server-side fence legs read (`SUPERD_TRUSTED_HOSTS` on this line, upstream
+ * spelling `DSH_TRUSTED_HOSTS` honored first) — so ONE declaration (e.g. one
+ * `Environment=` line in the service unit) drives the server fence and the
+ * page leg with zero per-instance plugin config. Bare hostnames only:
+ * `location.hostname` carries no port, and {@link assertBareHostname} would
+ * reject a portful entry at boot, so portful/schematic entries are dropped
+ * here instead of thrown. Declared in the Config SCHEMA rather than the
+ * bundle patch row because a profile/home layer row with the same id
+ * whole-row-overrides the row's config object, while schema defaults fill
+ * per-key at plugin load and survive every overlay layer. An explicit
+ * configured value always wins.
+ *
+ * @param env - the raw trusted-hosts value (whitespace/comma separated).
+ * @returns the bare-hostname authorities to trust by default.
+ */
+export function deriveDefaultPageAuthorities(env) {
+    return (env ?? '').split(/[\s,]+/).filter(h => h.length > 0 && !/[:/@?#]/.test(h));
+}
+/** Assert one configured authority is a bare hostname (no port/path/scheme). */
+function assertBareHostname(entry) {
+    if (entry.length === 0 || /[:/@?#]/.test(entry)) {
+        throw new Error(`superd-web-trust: trustedPageAuthorities entry ${JSON.stringify(entry)} is not a bare hostname `
+            + '(location.hostname carries no port; an entry with port/path would never match)');
+    }
+}
+/** The IIFE framing (a throwing leg stays invisible on the page). */
+function frame(body) {
+    return ['(function(){try{', ...body, '}catch(e){}})();'].join('');
+}
+/**
+ * Build the authorities-leg script. Pure: same config in, same script out —
+ * the unit tests pin the shape (authority match, no-overwrite guard,
+ * inert-when-empty, hostile-string escaping).
+ *
+ * @param trustedPageAuthorities - the operator-declared hostnames.
+ * @returns the script text, or `undefined` when the list is empty (inject
+ *   nothing — the component is fully inert).
+ */
+export function buildTrustScript(trustedPageAuthorities) {
+    const authorities = [...(trustedPageAuthorities ?? [])];
+    if (authorities.length === 0)
+        return undefined;
+    for (const entry of authorities)
+        assertBareHostname(entry);
+    return frame([
+        'if(!window.__DSH_TRANSPORT__){',
+        `var h=location.hostname,a=${JSON.stringify(authorities)};`,
+        'for(var i=0;i<a.length;i++)if(a[i]===h){window.__DSH_TRANSPORT__={ownsHost:true};break}',
+        '}',
+    ]);
+}
+/** The trusted-hosts single source: upstream spelling first, this line's second. */
+function trustedHostsEnv() {
+    return process.env.DSH_TRUSTED_HOSTS ?? process.env.SUPERD_TRUSTED_HOSTS;
+}
+/** Row config schema (schema-level default derives from the trusted-hosts env). */
+export const Config = z.object({
+    trustedPageAuthorities: z.array(String).default(deriveDefaultPageAuthorities(trustedHostsEnv())),
+});
+/** Cordis plugin name. */
+export const name = 'superd-web-trust';
+/**
+ * No static injects: `webServer` is composed conditionally inside
+ * {@link apply}, so the row loads (dormant) in compositions without one.
+ */
+export const inject = [];
+/**
+ * Mount the authorities-leg injection: one `webserver/index-inject` listener
+ * pushing the rendered row.
+ * @param ctx - host plugin context.
+ * @param config - the row config.
+ */
+export function apply(ctx, config) {
+    const authorities = config?.trustedPageAuthorities;
+    ctx.inject(['webServer'], () => {
+        ctx.on('webserver/index-inject', (table) => {
+            const text = buildTrustScript(authorities);
+            if (text !== undefined)
+                table.push({ kind: 'script', placement: 'head', text });
+        });
+    });
+}
+export default { name, inject, Config, apply };

package/superd-hub/dist/world-entry.d.ts

@@ -0,0 +1,38 @@
+/**
+ * World-side mount plugin (AW-B DL1/DL3) — `@pgmi-builds/superd-hub/world`.
+ *
+ * Inserted into the WORLD root's composition (its own process-side root, no
+ * listener). Since path-separation T-D (2026-09-26, "disable their webui
+ * build, just like disable their webserver") it provides the world's whole
+ * remaining web-adjacent surface, shrunk to data-plane facts:
+ *
+ *   - the VIRTUAL `webServer` — a silent, registration-only shell
+ *     (`world-web-server.ts`): every route a world plugin declares is
+ *     accepted and swallowed, so the tree boots exactly as before while
+ *     nothing is ever served (`/hub` is the sole entry, T-C);
+ *   - the neutral `webRuntime` values — the ONE leg the disabled `web-runtime`
+ *     row used to provide that the DATA plane still reads (the `connection`
+ *     row injects it): loopback bind ⇒ no LAN literals, plus the deploy-level
+ *     `--trusted-host` extras spawnWorld seeds the tree with (carried here by
+ *     `worldMountPatches` in the row config).
+ *
+ * The RPC channel is NOT the world's: the hub's `/hub` family
+ * (`hub-route.ts`) answers `?agent=<key>` traffic in ctx0's auth domain,
+ * dispatching to this world's gateway instance. Non-envelope GET/HEAD traffic
+ * is forwarded into the world's registered exact Fetch routes (session-log
+ * export and friends) through the shared `/api` fetch handler this plugin
+ * publishes into the cross-root registry (`world-host.ts`) — still behind
+ * ctx0's fence, never the world's own.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Stable Cordis plugin name. */
+export declare const name = "superd-world-mount";
+/** Row config: which world this root is. */
+export interface Config {
+    key: string;
+}
+/** Apply the world mount. @param ctx - the WORLD root context. @param config - `{ key }`. */
+export declare function apply(ctx: Context, config?: {
+    key?: unknown;
+}): void;
+export default apply;

package/superd-hub/dist/world-entry.js

@@ -0,0 +1,47 @@
+import { noteWorldServer, publishWorldFetch, takeHostMount } from './world-host.js';
+import { WorldWebServer } from './world-web-server.js';
+import { superdTrustedHosts } from './world-mount.js';
+/** Stable Cordis plugin name. */
+export const name = 'superd-world-mount';
+/** Apply the world mount. @param ctx - the WORLD root context. @param config - `{ key }`. */
+export function apply(ctx, config) {
+    const key = typeof config?.key === 'string' ? config.key : undefined;
+    if (key === undefined) {
+        ctx.logger?.warn?.('superd-world-mount: missing config.key — world not mounted');
+        return;
+    }
+    const mount = takeHostMount(key);
+    if (mount === undefined) {
+        ctx.logger?.warn?.(`superd-world-mount: no host mount registered for key ${JSON.stringify(key)}`);
+        return;
+    }
+    const worldWebServer = new WorldWebServer(mount.labelPath);
+    noteWorldServer(key, worldWebServer);
+    ctx.reflect.provide('webServer', worldWebServer);
+    // The data-plane leg of the disabled `web-runtime` row: the `connection`
+    // row injects `webRuntime` (and reads `ctx.webRuntime.trustedHosts` in its
+    // config). Same neutral shape as before T-D: a loopback-only bind resolves
+    // no LAN literals; the trusted-host extras are the same deploy-level env
+    // list `spawnWorld` feeds this tree as `--trusted-host` arguments (one
+    // derivation: `superdTrustedHosts`).
+    ctx.reflect.provide('webRuntime', { lanAddresses: [], trustedHosts: superdTrustedHosts(process.env.SUPERD_TRUSTED_HOSTS) });
+    // The world's `/api` fetch handler (exact Fetch routes + the gateway's RPC
+    // interceptor) is published here so the hub's `/hub` family can forward
+    // non-envelope GET/HEAD traffic into the world's registered routes; auth
+    // stays in ctx0's domain because the family fences the request BEFORE this
+    // handler runs. (The world's own index-authorization neutralization is
+    // gone with T-D: no world page exists to authorize.)
+    let dropWorldFetch;
+    ctx.inject(['connection'], (webCtx) => {
+        const connection = webCtx.get('connection');
+        if (connection === undefined)
+            return;
+        if (typeof connection.createSharedFetchHandler === 'function') {
+            dropWorldFetch = publishWorldFetch(key, connection.createSharedFetchHandler('/api'));
+        }
+    });
+    ctx.effect(() => () => {
+        dropWorldFetch?.();
+    }, 'superd-world-mount: virtual webServer');
+}
+export default apply;

package/{agent-hub → superd-hub}/dist/world-host.d.ts

@@ -4,32 +4,26 @@
  * A world runs as its OWN cordis ROOT (events are root-scoped — probe
  * 2026-09-16), so ctx0 and the world cannot share service instances through
  * the context tree. They DO share this module (the profile links
- * `@pgmi-builds/agent-hub` at the same path), which is where the host hands the
- * world everything it needs to mount itself:
+ * `@pgmi-builds/superd-hub` at the same path), which is where the host hands
+ * the world what it needs to mount itself:
  *
- *   ctx0 hub  → registerHostMount({ key, labelPath, real })   (before spawn)
+ *   ctx0 hub  → registerHostMount({ key, labelPath })         (before spawn)
  *   world     → takeHostMount(key) → provides the virtual `webServer`
  *
+ * T-C (2026-09-26): the `real`/`authorize` legs were RETIRED with the
+ * per-label URL family. T-D (2026-09-26) swept the vestiges: the mount record
+ * is the world's ADDRESSABILITY entry only (`{ key, labelPath }`) — no ctx0
+ * webServer instance, no index gate; the adapter world-plugins' call sites
+ * were updated in the same round.
+ *
  * No selection state: the key is the world's own identity, fixed at spawn.
  */
-import type { RealWebServerFace } from './world-web-server.js';
-/** What a world needs to mount its surface onto ctx0's real webServer. */
+/** What the host publishes for one world mount (the world's identity record). */
 export interface HostMount {
     /** Runtime key (`omp`, `codex`, …) — equals the mount label. */
     key: string;
     /** Mount root (`/omp`). */
     labelPath: string;
-    /** ctx0's webServer instance (live object, passed across roots). */
-    real: RealWebServerFace;
-    /**
-     * ctx0's index authorization (the SAME gate the native index goes through).
-     * The mount is the only ingress and answers the world's pages/assets itself,
-     * so auth is decided in ctx0's domain — by the cookie that authenticated
-     * `<label>` — and never by the world's own browser-auth gate (a different
-     * tree, a different secret). Returning false means the authorizer already
-     * answered (401, or the token→cookie 303).
-     */
-    authorize?(req: unknown, res: unknown): boolean;
 }
 /** Publish the host side of one world mount (idempotent replace). */
 export declare function registerHostMount(mount: HostMount): () => void;
@@ -59,10 +53,11 @@ export interface WorldFetchHandler {
     fetch(request: Request): Promise<Response>;
 }
 /**
- * Publish one world's shared `/api` fetch handler so the carrier can forward
- * non-envelope traffic on `/<label>/api` into the world's registered routes
- * (session-log export and friends). Called from inside the world root
- * (`world-entry`); read from the host root (`carrier`). Idempotent replace.
+ * Publish one world's shared `/api` fetch handler so the hub's `/hub` family
+ * can forward non-envelope traffic (`?agent=<label>` GET/HEAD) into the
+ * world's registered routes (session-log export and friends). Called from
+ * inside the world root (`world-entry`); read from the host root
+ * (`carrier`). Idempotent replace.
  */
 export declare function publishWorldFetch(key: string, handler: WorldFetchHandler): () => void;
 /** The world's published shared `/api` fetch handler, if its root published one yet. */