super-dsh 0.1.3 → 0.1.5

package/superd-hub/dist/world-host.js

@@ -0,0 +1,65 @@
+/**
+ * Cross-root mount registry (AW-B DL1/DL3).
+ *
+ * A world runs as its OWN cordis ROOT (events are root-scoped — probe
+ * 2026-09-16), so ctx0 and the world cannot share service instances through
+ * the context tree. They DO share this module (the profile links
+ * `@pgmi-builds/superd-hub` at the same path), which is where the host hands
+ * the world what it needs to mount itself:
+ *
+ *   ctx0 hub  → registerHostMount({ key, labelPath })         (before spawn)
+ *   world     → takeHostMount(key) → provides the virtual `webServer`
+ *
+ * T-C (2026-09-26): the `real`/`authorize` legs were RETIRED with the
+ * per-label URL family. T-D (2026-09-26) swept the vestiges: the mount record
+ * is the world's ADDRESSABILITY entry only (`{ key, labelPath }`) — no ctx0
+ * webServer instance, no index gate; the adapter world-plugins' call sites
+ * were updated in the same round.
+ *
+ * No selection state: the key is the world's own identity, fixed at spawn.
+ */
+const mounts = new Map();
+/** Publish the host side of one world mount (idempotent replace). */
+export function registerHostMount(mount) {
+    mounts.set(mount.key, mount);
+    return () => {
+        if (mounts.get(mount.key) === mount)
+            mounts.delete(mount.key);
+    };
+}
+const servers = new Map();
+/** Record the virtual webServer a world root provided (diagnostics/tests). */
+export function noteWorldServer(key, server) {
+    servers.set(key, server);
+}
+/** The virtual webServer a world root provided, if it mounted yet. */
+export function worldServerOf(key) {
+    return servers.get(key);
+}
+/** Read one host mount (called from inside the world root). */
+export function takeHostMount(key) {
+    return mounts.get(key);
+}
+/** Keys with a published host mount. */
+export function listHostMounts() {
+    return [...mounts.keys()];
+}
+const worldFetchHandlers = new Map();
+/**
+ * Publish one world's shared `/api` fetch handler so the hub's `/hub` family
+ * can forward non-envelope traffic (`?agent=<label>` GET/HEAD) into the
+ * world's registered routes (session-log export and friends). Called from
+ * inside the world root (`world-entry`); read from the host root
+ * (`carrier`). Idempotent replace.
+ */
+export function publishWorldFetch(key, handler) {
+    worldFetchHandlers.set(key, handler);
+    return () => {
+        if (worldFetchHandlers.get(key) === handler)
+            worldFetchHandlers.delete(key);
+    };
+}
+/** The world's published shared `/api` fetch handler, if its root published one yet. */
+export function worldFetchHandlerOf(key) {
+    return worldFetchHandlers.get(key);
+}

package/{agent-hub → superd-hub}/dist/world-join.d.ts

@@ -1,5 +1,5 @@
 /** Stable Cordis plugin name. */
-export declare const name = "aw.world.join";
+export declare const name = "superd-join";
 /** Row config: which world to join, under which roster label. */
 export interface Config {
     key: string;
@@ -10,6 +10,7 @@ interface HostContext {
     provide(name: string, value: unknown): void;
     inject(deps: string[], callback: (ctx: unknown) => void): unknown;
     effect?(callback: () => () => void, label?: string): unknown;
+    get(name: string): unknown;
 }
 /** Apply the join. @param ctx - the CTX0 root context. @param config - `{ key, label? }`. */
 export declare function apply(ctx: HostContext, config?: Partial<Config>): void;

package/{agent-hub → superd-hub}/dist/world-join.js

@@ -1,22 +1,26 @@
 /**
- * Hub-side world joiner (AW-B DL1–DL5) — `@pgmi-builds/agent-hub/join`.
+ * Hub-side world joiner (AW-B DL1–DL5) — `@pgmi-builds/superd-hub/join`.
  *
  * Ruling R2 (2026-09-16): an adapter may ship STANDALONE only — joining the
- * agent-worlds hub is the HUB side's job. This plugin is that job, generic:
+ * super-dsh hub is the HUB side's job. This plugin is that job, generic:
  * the ctx0 composition inserts one row with `{ key }` and the hub does the
  * spawn/roster/mount wiring the adapter's own world plugin would otherwise
  * carry (the omp/codex adapters ship active per-adapter plugins; the claude
  * adapter's `/world` entry is deliberately inert and is joined HERE).
  *
  *   1. roster membership (activation IS membership, spec S2);
- *   2. ctx0 publishes the host mount (real webServer instance) before spawn;
+ *   2. ctx0 publishes the host mount record — the world's addressability
+ *      entry only since T-D (no webServer instance, no fence: those legs
+ *      retired with the world pages);
  *   3. `spawnWorld` boots the sibling ROOT from the world's own nested home
  *      (`<home>/agents/<key>/profiles/web` — provisioned here via
  *      `provisionWorldProfile`, or by the line bootstrap when the adapter
  *      package is not resolvable from this module), with the world mount
- *      patches (no listener, virtual webServer);
- *   4. the world's gateway becomes a foreign target; the carrier answers
- *      `/<key>/api` + `/<key>/api/remote.mux` in ctx0's auth domain.
+ *      patches (no listener, no webui rows — T-D);
+ *   4. the world's gateway becomes a foreign target; the hub's `/hub` family
+ *      answers `?agent=<key>` traffic in ctx0's auth domain (T-C: the
+ *      per-label `/<key>/api` + `/<key>/api/remote.mux` mounts are retired —
+ *      `/hub` is the sole entry).
  *
  * Cordis identifies a plugin by its module, so ONE joiner row per tree — a
  * second joined world needs either its own adapter-side plugin (omp/codex
@@ -31,19 +35,16 @@ import { join } from 'node:path';
 import { registerAgent, setReady } from './roster.js';
 import { registerForeignTarget } from './targets.js';
 import { spawnWorld } from './spawn-world.js';
-import { provisionWorldProfile } from './world-provision.js';
+import { provisionWorldProfile, resolveInstallAnchor } from './world-provision.js';
 import { registerHostMount } from './world-host.js';
-import { mountWorld } from './carrier.js';
 import { worldMountPatches } from './world-mount.js';
 /** Stable Cordis plugin name. */
-export const name = 'aw.world.join';
-const ANCHOR = process.env.SUPERD_DSH_ANCHOR
-    ?? '/home/u1/.local/lib/node_modules/@deepseek-ai/dsh/package.json';
+export const name = 'superd-join';
 /** Apply the join. @param ctx - the CTX0 root context. @param config - `{ key, label? }`. */
 export function apply(ctx, config) {
     const key = typeof config?.key === 'string' ? config.key : undefined;
     if (key === undefined || key === '' || key.includes('/')) {
-        ctx.provide('aw.world.join.error', `invalid config.key ${JSON.stringify(config?.key)}`);
+        ctx.provide('superd.world.join.error', `invalid config.key ${JSON.stringify(config?.key)}`);
         return;
     }
     const label = typeof config?.label === 'string' && config.label !== '' ? config.label : key;
@@ -58,58 +59,37 @@ export function apply(ctx, config) {
     const worldHome = join(root, 'agents', key);
     mkdirSync(join(worldHome, 'profiles'), { recursive: true });
     // Publish story: a foreign install has no line bootstrap, so the nested
-    // profile + @pgmi-builds links are provisioned HERE (idempotent; dev lines
-    // keep parity — smoke.mjs wrote the same layout, and AW_BARE_BASE still
-    // overrides the resolved base).
-    const bareBase = provisionWorldProfile({
+    // profile + @pgmi-builds links are provisioned HERE (idempotent).
+    provisionWorldProfile({
         key,
-        adapterPkg: '@pgmi-builds/agent-adapter-claude',
+        adapterPkg: '@pgmi-builds/agent-claude',
         worldHome,
     });
     const world = (async () => {
-        // Wait for ctx0's listening stack: the mount needs the real webServer and
-        // the browser-trust fence from the live connection service.
-        const host = await new Promise((resolve) => {
-            ctx.inject(['webServer', 'connection'], (hostCtx) => { resolve(hostCtx); });
-        });
-        const real = host['webServer'];
-        const connection = host['connection'];
-        const dropHostMount = registerHostMount({
-            key,
-            labelPath: `/${key}`,
-            real,
-            // ctx0's index gate, applied by the mount to this world's pages and
-            // assets: the world is reached in-ctx and owns no listener, so ctx0
-            // decides auth (one auth domain).
-            authorize: (req, res) => connection.authorizeIndex(req, res),
-        });
+        // T-D: the mount record is addressability only — no ctx0 listening-stack
+        // wait, no webServer instance, no authorize leg (the /hub family wires
+        // its own gate in ctx0, see gateway.ts).
+        const dropHostMount = registerHostMount({ key, labelPath: `/${key}` });
         const ctxW = await spawnWorld({
-            appName: `aw-${key}`,
+            appName: `superd-${key}`,
             profileName: 'web',
-            installAnchor: ANCHOR,
+            installAnchor: resolveInstallAnchor(ctx), // lazy: never at module scope — import must stay side-effect-free
             home: worldHome,
             dataHome: worldHome,
-            // Adapter-local bundle names resolve from the profile's own
-            // node_modules (heal owns @deepseek-ai there; @pgmi-builds links are
-            // provisioned by provisionWorldProfile above, or by the line bootstrap
-            // when the adapter package was not resolvable — env wins over both).
-            bareModuleBaseUrl: process.env.AW_BARE_BASE ?? bareBase ?? undefined,
+            // The host's live table carries this world: spawnWorld republishes a
+            // widened successor before boot imports anything (spec §2.1), and
+            // @pgmi-builds rows resolve from the profile-local links written above.
+            host: ctx,
             extraPatches: worldMountPatches(key),
         });
         const gateway = ctxW.get('typertGateway');
         registerForeignTarget({ key, gateway });
-        const mounted = mountWorld({
-            real,
-            label: key,
-            gateway,
-            requestRejection: (request) => connection
-                .requestRejection(request),
-        });
+        // T-C: no per-label mount anymore — the gateway above is the world's
+        // whole ingress, reached through the /hub family's `?agent=<key>` demux.
         setReady(key, true);
         ctx.effect?.(() => () => {
-            mounted.dispose();
             dropHostMount();
-        }, `aw.world.join: ${key} mount`);
+        }, `superd-join: ${key} mount`);
         return ctxW;
     })().catch((cause) => {
         // A failed world degrades to a not-ready roster row; a rejected provided
@@ -117,6 +97,6 @@ export function apply(ctx, config) {
         console.error(`[super-dsh] ${key} world failed:`, cause);
         return null;
     });
-    ctx.provide(`aw.world.${key}`, world);
+    ctx.provide(`superd.world.${key}`, world);
 }
 export default apply;

package/superd-hub/dist/world-mount.d.ts

@@ -0,0 +1,82 @@
+/**
+ * World composition patches for the mount (AW-B DL1/DL3 → path-separation T-D).
+ *
+ * A mounted world is a PURE DATA PLANE: no listener (it never had a socket)
+ * and since T-D no webui composition either ("disable their webui build, just
+ * like disable their webserver" — 2026-09-26 user ruling). The rows that gave
+ * the world tree its own web surface are DISABLED here:
+ *
+ *   1. `webserver` disabled    — the world owns no socket; ctx0's listener is
+ *                                the only ingress (pre-T-D posture, kept).
+ *   2. `hmr` disabled          — a world's composition is a spawn-time fact;
+ *                                the profile-hmr reload chain must never arm.
+ *   3. `web-runtime` disabled  — the web-app glue row: it mounted the
+ *                                frontend-static fallback owner over the
+ *                                virtual server, printed the URL line, opened
+ *                                the browser, and registered the web-surface
+ *                                prompt section. Its ONE data-plane leg — the
+ *                                `webRuntime` values the `connection` row
+ *                                injects — moved into the world mount row
+ *                                (neutral facts, see `world-entry.ts`).
+ *   4. `client-hmr` disabled   — the client-plugin reload chain; nothing ever
+ *                                loads a world page to reload.
+ *   5. `modules` still waits   — the client-modules row (and any other row
+ *                                that injects `webServer`) binds against the
+ *                                VIRTUAL per-world server the mount row
+ *                                provides; the virtual server swallows every
+ *                                registration (T-C), so the tree boots
+ *                                unchanged while nothing is ever served.
+ *   6. insert the world rows   — the mount row (virtual `webServer` + neutral
+ *                                `webRuntime` provider) and the HUB row (the
+ *                                `/api/agent-runtime` face /hub can reach
+ *                                through the world's own data plane). The
+ *                                world page-trust row is GONE (T-D): its only
+ *                                consumer was the world page.
+ * Patch layers are plain data: the patch engine applies arbitrary entry
+ * overrides (`vendor/include/src/index.ts:77-121`).
+ */
+/** Id of the inserted world-mount row. */
+export declare const WORLD_MOUNT_ROW_ID = "superd-world-mount";
+/** Plugin name providing the world's virtual webServer. */
+export declare const WORLD_MOUNT_PLUGIN = "@pgmi-builds/superd-hub/world";
+/** Id of the inserted hub row (the same plugin ctx0 itself composes). */
+export declare const WORLD_HUB_ROW_ID = "superd-hub";
+/** Plugin name of the hub itself — one UI, one roster, every runtime. */
+export declare const WORLD_HUB_PLUGIN = "@pgmi-builds/superd-hub";
+/**
+ * Parse the deploy-level trusted-authority list the world's connection fence
+ * was seeded with (`SUPERD_TRUSTED_HOSTS`, whitespace/comma separated) — the
+ * same values `spawnWorld` feeds the world tree as `--trusted-host` extras.
+ * Shared so the fence facts keep a single derivation.
+ */
+export declare function superdTrustedHosts(value: string | undefined): string[];
+/** One patch layer understood by the loader (structural; no app-boot import). */
+export type WorldPatchLayer = {
+    id: string;
+    disabled?: boolean;
+    inject?: readonly string[];
+    config?: Record<string, unknown>;
+} | {
+    insert: ReadonlyArray<{
+        id: string;
+        name: string;
+        config?: Record<string, unknown>;
+    }>;
+};
+/**
+ * The layers that turn a listener-owning world into a mounted, webui-less
+ * data plane:
+ *
+ *   1. `webserver` off — the world owns no socket (the hub serves its face);
+ *   2. `hmr` off — the composition is a spawn-time fact;
+ *   3. `web-runtime` off — no frontend-static mount, no URL line, no browser
+ *      handoff, no web-surface prompt (T-D; its `webRuntime` provider moved
+ *      into the mount row);
+ *   4. `client-hmr` off — no client reload chain (T-D);
+ *   5. `modules` waits for the virtual `webServer` the mount row provides;
+ *   6. the world rows: the mount (virtual `webServer` + neutral `webRuntime`)
+ *      and the hub (`/api/agent-runtime` face on the world's data plane).
+ * @param key - runtime key (`omp`, `codex`, …) — the mount label.
+ * @returns patch layers to append to the world's composition.
+ */
+export declare function worldMountPatches(key: string): readonly WorldPatchLayer[];

package/superd-hub/dist/world-mount.js

@@ -0,0 +1,105 @@
+/**
+ * World composition patches for the mount (AW-B DL1/DL3 → path-separation T-D).
+ *
+ * A mounted world is a PURE DATA PLANE: no listener (it never had a socket)
+ * and since T-D no webui composition either ("disable their webui build, just
+ * like disable their webserver" — 2026-09-26 user ruling). The rows that gave
+ * the world tree its own web surface are DISABLED here:
+ *
+ *   1. `webserver` disabled    — the world owns no socket; ctx0's listener is
+ *                                the only ingress (pre-T-D posture, kept).
+ *   2. `hmr` disabled          — a world's composition is a spawn-time fact;
+ *                                the profile-hmr reload chain must never arm.
+ *   3. `web-runtime` disabled  — the web-app glue row: it mounted the
+ *                                frontend-static fallback owner over the
+ *                                virtual server, printed the URL line, opened
+ *                                the browser, and registered the web-surface
+ *                                prompt section. Its ONE data-plane leg — the
+ *                                `webRuntime` values the `connection` row
+ *                                injects — moved into the world mount row
+ *                                (neutral facts, see `world-entry.ts`).
+ *   4. `client-hmr` disabled   — the client-plugin reload chain; nothing ever
+ *                                loads a world page to reload.
+ *   5. `modules` still waits   — the client-modules row (and any other row
+ *                                that injects `webServer`) binds against the
+ *                                VIRTUAL per-world server the mount row
+ *                                provides; the virtual server swallows every
+ *                                registration (T-C), so the tree boots
+ *                                unchanged while nothing is ever served.
+ *   6. insert the world rows   — the mount row (virtual `webServer` + neutral
+ *                                `webRuntime` provider) and the HUB row (the
+ *                                `/api/agent-runtime` face /hub can reach
+ *                                through the world's own data plane). The
+ *                                world page-trust row is GONE (T-D): its only
+ *                                consumer was the world page.
+ * Patch layers are plain data: the patch engine applies arbitrary entry
+ * overrides (`vendor/include/src/index.ts:77-121`).
+ */
+/** Id of the inserted world-mount row. */
+export const WORLD_MOUNT_ROW_ID = 'superd-world-mount';
+/** Plugin name providing the world's virtual webServer. */
+export const WORLD_MOUNT_PLUGIN = '@pgmi-builds/superd-hub/world';
+/** Id of the inserted hub row (the same plugin ctx0 itself composes). */
+export const WORLD_HUB_ROW_ID = 'superd-hub';
+/** Plugin name of the hub itself — one UI, one roster, every runtime. */
+export const WORLD_HUB_PLUGIN = '@pgmi-builds/superd-hub';
+/**
+ * Parse the deploy-level trusted-authority list the world's connection fence
+ * was seeded with (`SUPERD_TRUSTED_HOSTS`, whitespace/comma separated) — the
+ * same values `spawnWorld` feeds the world tree as `--trusted-host` extras.
+ * Shared so the fence facts keep a single derivation.
+ */
+export function superdTrustedHosts(value) {
+    return (value ?? '').split(/[\s,]+/).filter(Boolean);
+}
+/**
+ * The layers that turn a listener-owning world into a mounted, webui-less
+ * data plane:
+ *
+ *   1. `webserver` off — the world owns no socket (the hub serves its face);
+ *   2. `hmr` off — the composition is a spawn-time fact;
+ *   3. `web-runtime` off — no frontend-static mount, no URL line, no browser
+ *      handoff, no web-surface prompt (T-D; its `webRuntime` provider moved
+ *      into the mount row);
+ *   4. `client-hmr` off — no client reload chain (T-D);
+ *   5. `modules` waits for the virtual `webServer` the mount row provides;
+ *   6. the world rows: the mount (virtual `webServer` + neutral `webRuntime`)
+ *      and the hub (`/api/agent-runtime` face on the world's data plane).
+ * @param key - runtime key (`omp`, `codex`, …) — the mount label.
+ * @returns patch layers to append to the world's composition.
+ */
+export function worldMountPatches(key) {
+    if (typeof key !== 'string' || key === '' || key.includes('/')) {
+        throw new Error(`world-mount: invalid key ${JSON.stringify(key)}`);
+    }
+    return [
+        // 0.1.7 belt-and-braces: the composition provably carries `disabled: true`
+        // (SUPERD_TRACE dump), yet the live world audit still saw the row activate
+        // and bind the default 3080 — so pin the config to an EPHEMERAL loopback
+        // port too (the audited AW fixture shape: loopback-only, never
+        // user-facing). Honored disables bind nothing; ignored disables bind a
+        // throwaway socket instead of colliding with a real deployment port.
+        { id: 'webserver', disabled: true, config: { host: '127.0.0.1', port: 0 } },
+        // 0.1.7: with a profileContext provided (settings requires it), the base
+        // hmr row ENABLES itself in world trees (`disabled: !!js
+        // !ctx.get('profileContext')`) and its config reload then recomposes the
+        // tree from the profile layers alone — DROPPING the spawn-time
+        // worldMountPatches (webserver re-enabled on 3080, world rows gone).
+        // Worlds must stay hmr-less: their composition is a spawn-time fact.
+        { id: 'hmr', disabled: true },
+        // T-D (2026-09-26): the world webui rows off. The `web-runtime` row is the
+        // web-app glue that mounted frontend-static over the virtual server and
+        // announced a URL nobody can reach (`/hub` is the sole entry); the world
+        // keeps only its data plane. Its `webRuntime` provider — the ONE
+        // data-plane leg (the `connection` row injects it) — is re-provided by the
+        // mount row with the same neutral facts (loopback bind ⇒ no LAN
+        // literals; the deploy-level trusted-host extras ride along).
+        { id: 'web-runtime', disabled: true },
+        { id: 'client-hmr', disabled: true },
+        { id: 'modules', inject: ['webServer'] },
+        { insert: [
+                { id: WORLD_MOUNT_ROW_ID, name: WORLD_MOUNT_PLUGIN, config: { key } },
+                { id: WORLD_HUB_ROW_ID, name: WORLD_HUB_PLUGIN },
+            ] },
+    ];
+}

package/{agent-hub → superd-hub}/dist/world-mux.d.ts

@@ -4,20 +4,26 @@
  * Upstream's `RemoteStreamMuxServer` owns `/api/remote.mux` for the native
  * gateway and is NOT reachable from outside its package (root exports omit it;
  * `./src/*` cannot be imported at runtime). So this is our own wire-compatible
- * implementation of the same protocol, bound to the ADDRESSED world's
- * `openWireStream`:
+ * implementation of the same protocol (dsh 0.1.7 `stream-protocol.ts`), bound
+ * to the ADDRESSED world's `openWireStream`:
  *
  *   browser → server   { type:'open', streamId, endpoint, payload }
+ *                      { type:'item', streamId, value? }   (uplink)
+ *                      { type:'end', streamId }            (uplink half-close)
  *                      { type:'cancel', streamId }
  *   server → browser   { type:'item', streamId, value }
  *                      { type:'end', streamId }
  *                      { type:'error', streamId, error:{code,message,details} }
  *
- * Heartbeat: ping every interval, terminate after two missed pongs (same
- * policy as upstream).
+ * Dispatch semantics mirror upstream `RemoteStreamMuxConnection`: `item`,
+ * `end`, and `cancel` for a stream this connection no longer owns are dropped;
+ * a duplicate `open` is the one violation that closes the socket. Uplink items
+ * wait in a bounded inbox created before the opener resolves, so items sent
+ * right after `open` are never lost. Heartbeat: ping every interval, terminate
+ * after two missed pongs.
  */
 /** Open one world stream (the world gateway's `openWireStream`). */
-export type MuxOpen = (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<AsyncIterable<unknown>>;
+export type MuxOpen = (endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, control: AbortController) => Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 /** Wire failure body (upstream `RemoteStreamFailure`). */
 export interface MuxFailure {
     code: string;
@@ -26,8 +32,10 @@ export interface MuxFailure {
 }
 /** Options. */
 export interface WorldMuxOptions {
-    /** Ping interval; upstream default is 30s. */
+    /** Ping interval; upstream default is 2s. */
     heartbeatIntervalMs?: number;
+    /** Buffered uplink frame bytes one logical stream may hold before it fails; upstream default 256KiB. */
+    streamInboxBytes?: number;
     /** Error → wire failure mapper. */
     failure?: (error: unknown) => MuxFailure;
 }
@@ -37,6 +45,13 @@ type ClientMessage = {
     streamId: string;
     endpoint: string;
     payload: unknown;
+} | {
+    type: 'item';
+    streamId: string;
+    value?: unknown;
+} | {
+    type: 'end';
+    streamId: string;
 } | {
     type: 'cancel';
     streamId: string;