super-dsh 0.1.4 → 0.1.5-a

package/superd-hub/dist/hub-route.js

@@ -0,0 +1,188 @@
+/**
+ * The hub-owned `/hub` route family (native UI fusion, plan Task 2).
+ *
+ * ONE prefix route + ONE upgrade route on ctx0's webServer (design ratified
+ * 2026-09-26): every FOREIGN-agent request funnels into this family and the
+ * demux key rides the query (`?agent=<label>`) instead of the path. The
+ * native `/api` surface is never touched — this family is the only seam. It
+ * registers unconditionally (authorize-gated, inert until a request carries a
+ * registered foreign label); the fusion feature flag never gates server route
+ * registration.
+ *
+ * Semantics per request:
+ *  - `?agent=<label>` with a registered gateway → the request is consumed and
+ *    forwarded to that world: envelope POST → `dispatchRpc`, non-envelope
+ *    GET/HEAD → the world's published `/api` fetch handler, WS upgrade → a
+ *    `WorldMuxServer` bound to that gateway. The demux key is CONSUMED, so
+ *    the world sees exactly the URL its native page would have sent
+ *    (`/hub/api/x?agent=o&p=1` → world `/api/x?p=1`).
+ *  - no `agent` param or `agent=native` → 404 JSON: the family serves foreign
+ *    traffic only; native belongs to `/api`.
+ *  - unknown / not-yet-spawned label → 404 JSON `{error:'unknown-agent',
+ *    label}` — silent degradation, never a locked page.
+ *
+ * The ctx0 gate is the SAME authorize source the world mounts use
+ * (`connection.authorizeIndex`, the boolean face whose false path already
+ * wrote the answer — 401 or the token→cookie 303); the family then runs the
+ * SAME browser-trust fence the sibling `/<label>/api` mounts run
+ * (`requestRejection`, the connection's `isTrustedApiRequest` face) before it
+ * answers anything — the family is never weaker than the neighbors carrying
+ * identical traffic. Forwarding reuses the carrier kernel
+ * ({@link forwardApiCall} / {@link worldMuxOf}) unchanged: this module only
+ * gates, fences and demuxes.
+ *
+ * Mux lifecycle (review round 1): each accepted upgrade constructs ONE
+ * `WorldMuxServer`, which roots a heartbeat interval and a per-connection
+ * WebSocketServer — resources that would otherwise outlive the client forever
+ * (one 2s no-op timer per reconnect). The mux is therefore CLOSED the moment
+ * its socket dies: close-on-disconnect. The carrier's shared-mux-per-mount
+ * shape does not transfer (the hub rebinds per respawn); close-on-disconnect
+ * does.
+ */
+import { forwardApiCall, worldMuxOf, writeJson } from './carrier.js';
+import { stripLabelFromUrl } from './world-web-server.js';
+/** The mount prefix the family owns. */
+export const HUB_MOUNT_PATH = '/hub';
+/** The WebSocket upgrade path (upstream matches upgrades by pathname, so `?agent=` rides along). */
+export const HUB_MUX_PATH = '/hub/api/remote.mux';
+/** The demux key of one family request; absent or empty means "not foreign-addressed". */
+function agentOf(req) {
+    const url = new URL(req.url ?? '/', 'http://dsh.internal');
+    const value = url.searchParams.get('agent');
+    return value === null || value === '' ? undefined : value;
+}
+/**
+ * The world-relative URL for one family request: the `/hub` mount prefix
+ * stripped (same translation the `/<label>` mounts apply) and the demux key
+ * removed with byte-preserving query surgery — every other parameter keeps
+ * its original order and encoding.
+ */
+function worldUrlOf(url) {
+    const raw = stripLabelFromUrl(url, HUB_MOUNT_PATH);
+    const queryAt = raw.indexOf('?');
+    if (queryAt === -1)
+        return raw;
+    const kept = raw.slice(queryAt + 1).split('&').filter((pair) => {
+        if (pair === '')
+            return false;
+        const eq = pair.indexOf('=');
+        return (eq === -1 ? pair : pair.slice(0, eq)) !== 'agent';
+    });
+    return kept.length === 0 ? raw.slice(0, queryAt) : `${raw.slice(0, queryAt)}?${kept.join('&')}`;
+}
+/** Reason phrases for the raw-socket upgrade rejections this family writes. */
+const REASON_PHRASE = { 401: 'Unauthorized', 403: 'Forbidden', 404: 'Not Found' };
+/** Reject an upgrade on the raw socket (no ws ownership transfer). */
+function rejectUpgrade(socket, status, body, contentType) {
+    const writable = socket;
+    writable.write?.(`HTTP/1.1 ${status} ${REASON_PHRASE[status] ?? 'Rejected'}\r\n`
+        + 'Connection: close\r\n'
+        + `Content-Type: ${contentType}\r\n`
+        + `Content-Length: ${String(Buffer.byteLength(body, 'utf8'))}\r\n\r\n`
+        + body);
+    writable.destroy?.();
+}
+/**
+ * Run the boolean gate against an upgrade: the authorizer's false path writes
+ * to a `res` that does not exist on an upgrade, so the answer is captured and
+ * replayed on the raw socket verbatim. False means the upgrade was answered.
+ */
+function gateUpgrade(options, req, socket) {
+    let status = 401;
+    let body;
+    const admitted = options.authorize(req, {
+        writeHead: (answered) => { status = answered; },
+        end: (chunk) => { if (chunk !== undefined && chunk !== null)
+            body = String(chunk); },
+    });
+    if (admitted)
+        return true;
+    rejectUpgrade(socket, status, body ?? '', 'text/plain; charset=utf-8');
+    return false;
+}
+/** One shared 404 answer shape for family-level demux misses. */
+function answer404(res, body) {
+    writeJson(res, 404, JSON.stringify(body));
+}
+/**
+ * Register the family on ctx0's webServer.
+ * @param options - see {@link HubRouteOptions}.
+ * @returns the disposer unregistering both routes.
+ */
+export function registerHubRoute(options) {
+    const handleRequest = async (req, res) => {
+        // ctx0's gate first (world-mount order): false ⇒ already answered.
+        if (!options.authorize(req, res))
+            return;
+        // Then the SAME browser-trust fence the sibling carrier family runs
+        // (the kernel's first statement there): before ANY family answer — the
+        // demux 404s below are for trusted traffic only.
+        const rejection = options.requestRejection?.(req);
+        if (rejection !== undefined) {
+            writeJson(res, rejection, JSON.stringify({ error: rejection === 401 ? 'unauthorized' : 'forbidden' }));
+            return;
+        }
+        const agent = agentOf(req);
+        if (agent === undefined || agent === 'native') {
+            answer404(res, {
+                error: 'foreign-only',
+                message: 'the /hub family serves ?agent=<label> foreign traffic only; native belongs to /api',
+            });
+            return;
+        }
+        const gateway = options.gatewayOf(agent);
+        if (gateway === undefined) {
+            answer404(res, { error: 'unknown-agent', label: agent });
+            return;
+        }
+        // Consume the family plumbing: the kernel forwards a native-shaped URL
+        // (the kernel carries the same fence face as the carrier's own kernel).
+        req.url = worldUrlOf(req.url);
+        await forwardApiCall({ gateway, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
+    };
+    const handleUpgrade = (req, socket, head) => {
+        if (!gateUpgrade(options, req, socket))
+            return;
+        // Same fence as the sibling carrier's mux: raw 401/403, no ws handover
+        // for untrusted Host/Origin.
+        const rejection = options.requestRejection?.(req);
+        if (rejection !== undefined) {
+            rejectUpgrade(socket, rejection, JSON.stringify({ error: rejection === 401 ? 'unauthorized' : 'forbidden' }), 'application/json');
+            return;
+        }
+        const agent = agentOf(req);
+        if (agent === undefined || agent === 'native') {
+            rejectUpgrade(socket, 404, JSON.stringify({ error: 'foreign-only' }), 'application/json');
+            return;
+        }
+        const gateway = options.gatewayOf(agent);
+        if (gateway === undefined) {
+            rejectUpgrade(socket, 404, JSON.stringify({ error: 'unknown-agent', label: agent }), 'application/json');
+            return;
+        }
+        // One mux per accepted connection: the binding resolves at upgrade time,
+        // so a respawned world is addressed by its CURRENT gateway. The mux roots
+        // a heartbeat interval and a per-connection WebSocketServer; on socket
+        // close it must be CLOSED (world-mux clears the heartbeat only in close),
+        // or every reconnect leaks the timer plus the mux graph forever.
+        const mux = worldMuxOf(gateway);
+        socket.once?.('close', () => {
+            void mux.close().catch(() => undefined);
+        });
+        void mux.handleUpgrade(req, socket, head);
+    };
+    const disposers = [
+        options.real.register({ kind: 'prefix', path: HUB_MOUNT_PATH, handler: handleRequest }),
+        options.real.registerUpgrade({ path: HUB_MUX_PATH, handler: handleUpgrade }),
+    ];
+    return () => {
+        for (const dispose of disposers.splice(0).reverse()) {
+            try {
+                dispose();
+            }
+            catch {
+                // teardown must not throw
+            }
+        }
+    };
+}

package/superd-hub/dist/index.d.ts

@@ -8,22 +8,28 @@
  * DL7 (2026-09-16): the app-level selector value is GONE. World ownership is
  * per-request: the addressed world is the mount path of the request
  * (`/<label>/...`). `/api/*` stays ctx0/native and untouched.
+ *
+ * Path separation T-D (2026-09-26): the world-page faces left the surface —
+ * the client mount shim, the mount HTML pass (`rewriteIndexHtml`) and the
+ * retired `mountWorld` no-op are gone (git history keeps them), and worlds
+ * compose as pure data planes (no webui rows).
  */
 export { handleAgentRuntime, registerSelectorRpc, AGENT_RUNTIME_RPC_PATH, registryTargets, type RuntimeTargetSource } from './rpc.js';
 export { registerForeignTarget, unregisterForeignTarget, getTarget, listRuntimeKeys, type ForeignTarget, type GatewayFace } from './targets.js';
 export { registerAgent, unregisterAgent, setReady, listAgents, onRosterChanged, type RosterEntry } from './roster.js';
 export { spawnWorld, type SpawnWorldOptions } from './spawn-world.js';
 export { provisionWorldProfile, resolveInstallAnchor, type ProvisionWorldOptions } from './world-provision.js';
-export { claimLabel, labelOf, releaseLabel, listLabels, type LabelClaim, type ClaimOptions } from './labels.js';
 export { WorldWebServer, stripLabelFromUrl, type WorldWebRoute, type WorldWebUpgradeRoute, type RealWebServerFace } from './world-web-server.js';
 export { parseClientRequest, serverResponse, serverError, serverResult, wireErrorOf, EnvelopeError, type ClientRequestEnvelope, type WireError } from './envelope.js';
 export { WorldMuxServer, parseClientMessage, defaultFailure, type MuxOpen, type MuxFailure, type WorldMuxOptions } from './world-mux.js';
-export { mountWorld, rewriteIndexHtml, type CarrierGatewayFace, type MountWorldOptions, type MountedWorld } from './carrier.js';
-export { renderClientShim } from './client-shim.js';
+export { forwardApiCall, forwardWorldFetch, worldMuxOf, writeJson, type CarrierGatewayFace, type ForwardOptions } from './carrier.js';
+export { registerHubRoute, HUB_MOUNT_PATH, HUB_MUX_PATH, type HubRouteOptions } from './hub-route.js';
+export { renderFusionTransport, FUSION_FLAG_GLOBAL, type FusionConfig } from './fusion-transport.js';
+export { createSwitchController, parseLandingTarget, namespacedKey, storageNamespace, seatClickDecision, NATIVE_AGENT, SESSIONS_CURRENT_KEY, SWITCH_FALLBACK_MS, type SwitchHost, type SwitchController, type SwitchOptions, type SeatClickInput, type SeatClickDecision } from './switch-core.js';
 export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL, type AgentLink } from './agent-roster.js';
 export { createOwnershipIndex, type OwnershipIndex, type OwnershipRow } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf, type HostMount } from './world-host.js';
-export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_WEB_TRUST_PLUGIN, WORLD_WEB_TRUST_ROW_ID, type WorldPatchLayer, } from './world-mount.js';
+export { worldMountPatches, superdTrustedHosts, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_HUB_PLUGIN, WORLD_HUB_ROW_ID, type WorldPatchLayer, } from './world-mount.js';
 export { buildTrustScript, deriveDefaultPageAuthorities, type BootScriptRow, type TrustConfig, } from './web-trust.js';
 export { withSystemHead, type HeadAwareSessionFace, type HeadPlaceholder, type WithSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName, type Config as WorldEntryConfig } from './world-entry.js';

package/superd-hub/dist/index.js

@@ -8,22 +8,28 @@
  * DL7 (2026-09-16): the app-level selector value is GONE. World ownership is
  * per-request: the addressed world is the mount path of the request
  * (`/<label>/...`). `/api/*` stays ctx0/native and untouched.
+ *
+ * Path separation T-D (2026-09-26): the world-page faces left the surface —
+ * the client mount shim, the mount HTML pass (`rewriteIndexHtml`) and the
+ * retired `mountWorld` no-op are gone (git history keeps them), and worlds
+ * compose as pure data planes (no webui rows).
  */
 export { handleAgentRuntime, registerSelectorRpc, AGENT_RUNTIME_RPC_PATH, registryTargets } from './rpc.js';
 export { registerForeignTarget, unregisterForeignTarget, getTarget, listRuntimeKeys } from './targets.js';
 export { registerAgent, unregisterAgent, setReady, listAgents, onRosterChanged } from './roster.js';
 export { spawnWorld } from './spawn-world.js';
 export { provisionWorldProfile, resolveInstallAnchor } from './world-provision.js';
-export { claimLabel, labelOf, releaseLabel, listLabels } from './labels.js';
 export { WorldWebServer, stripLabelFromUrl } from './world-web-server.js';
 export { parseClientRequest, serverResponse, serverError, serverResult, wireErrorOf, EnvelopeError } from './envelope.js';
 export { WorldMuxServer, parseClientMessage, defaultFailure } from './world-mux.js';
-export { mountWorld, rewriteIndexHtml } from './carrier.js';
-export { renderClientShim } from './client-shim.js';
+export { forwardApiCall, forwardWorldFetch, worldMuxOf, writeJson } from './carrier.js';
+export { registerHubRoute, HUB_MOUNT_PATH, HUB_MUX_PATH } from './hub-route.js';
+export { renderFusionTransport, FUSION_FLAG_GLOBAL } from './fusion-transport.js';
+export { createSwitchController, parseLandingTarget, namespacedKey, storageNamespace, seatClickDecision, NATIVE_AGENT, SESSIONS_CURRENT_KEY, SWITCH_FALLBACK_MS } from './switch-core.js';
 export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL } from './agent-roster.js';
 export { createOwnershipIndex } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf } from './world-host.js';
-export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_WEB_TRUST_PLUGIN, WORLD_WEB_TRUST_ROW_ID, } from './world-mount.js';
+export { worldMountPatches, superdTrustedHosts, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_HUB_PLUGIN, WORLD_HUB_ROW_ID, } from './world-mount.js';
 export { buildTrustScript, deriveDefaultPageAuthorities, } from './web-trust.js';
 export { withSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName } from './world-entry.js';

package/superd-hub/dist/roster.d.ts

@@ -3,8 +3,8 @@
  *
  * No config file: an agent is in the roster exactly while its adapter
  * plugin is loaded and registered. Adapter plugins self-register on
- * activation (key/label/ready). Roster entries are inventory only: they
- * carry NO selection —
+ * activation (key/label/ready) and the Hub UI consumes the snapshot.
+ * Roster entries are inventory only: they carry NO selection —
  * the addressed world is the request's mount path (`DL7`, 2026-09-16).
  * one authority.
  */

package/superd-hub/dist/spawn-world.js

@@ -27,6 +27,7 @@ import { dump } from 'js-yaml';
 import { entryListSchema } from '@deepseek-ai/cordis-plugin-include';
 import { existsSync, writeFileSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
+import { superdTrustedHosts } from './world-mount.js';
 /**
  * Republish the host's live resolution with THIS world added as a linked
  * root (spec §2.1, contract-legal form): `profilesDir`/`profileDir` are
@@ -159,7 +160,7 @@ export async function spawnWorld(opts) {
         try {
             const rows = composed;
             const pick = (id) => rows.find((r) => r.id === id);
-            for (const id of ['webserver', 'hmr', 'modules', 'superd-world-mount', 'superd-hub', 'agent-preset-registry']) {
+            for (const id of ['webserver', 'hmr', 'web-runtime', 'client-hmr', 'modules', 'superd-world-mount', 'superd-hub', 'agent-preset-registry']) {
                 const row = pick(id);
                 process.stderr.write(`[spawn-world:${opts.appName}] ${id}: ${row === undefined ? 'ABSENT' : JSON.stringify({ disabled: row.disabled, inject: 'inject' in row ? row.inject : undefined, name: row.name })}\n`);
             }
@@ -201,8 +202,9 @@ export async function spawnWorld(opts) {
     // Worlds take no flags and never open a browser; exit = dispose own fiber.
     // LAN authorities for the world's trust fence (deploy-level, env-driven):
     // the world webserver must accept the Host the browser actually sends.
-    const trusted = (process.env.SUPERD_TRUSTED_HOSTS ?? '')
-        .split(/[\s,]+/).filter(Boolean)
+    // (Same derivation worldMountPatches carries into the mount row's neutral
+    // webRuntime facts — one source, `superdTrustedHosts`.)
+    const trusted = superdTrustedHosts(process.env.SUPERD_TRUSTED_HOSTS)
         .flatMap((h) => ['--trusted-host', h]);
     let fiber;
     // Launcher parity (0.1.7): a profileContext-carrying tree runs the profile