super-dsh 0.1.4 → 0.1.5

package/superd-hub/dist/world-web-server.d.ts

@@ -1,25 +1,35 @@
 /**
- * Per-world virtual webServer (AW-B DL3).
+ * Per-world virtual webServer (AW-B DL3; path-separation T-C silent sink →
+ * T-D registration-only shell).
  *
- * A world's plugins must be able to declare ANY path they like (`/api`,
- * `/plugins`, `/whatever-name-i-like`). Enumerating those namespaces in the
- * carrier is wrong by construction — a third-party plugin may declare a new
- * one at any time. So this class translates at REGISTRATION time:
+ * A world's plugins still declare ANY path they like (`/api`, `/plugins`,
+ * `/whatever-name-i-like`), and the world root still needs a `webServer`
+ * provider for them to bind (the `modules` row injects it; `worldMountPatches`
+ * pins that inject). It used to translate every registration onto ctx0's real
+ * webServer as `/<label>+path` — the per-label page family. T-C (2026-09-26,
+ * user ruling "strip off the per agent url path … no need the url path
+ * fallback (we have git history)") severed that: every route a world plugin
+ * declares is accepted and SWALLOWED — no `/<label>/…` route ever lands on
+ * ctx0's real webServer. T-D (2026-09-26, "disable their webui build, just
+ * like disable their webserver") then disabled the world webui rows
+ * (`web-runtime`/`client-hmr`, see `worldMountPatches`) and retired the whole
+ * index face with them: no `renderIndex`, no taps, no index injections, no
+ * client mount shim — nothing renders a world page anywhere, and the mount
+ * HTML pass (`index-pass.ts`) plus the shim retired with the last consumer.
  *
- *   world registers  { kind, path }        →  real registers { kind, `${labelPath}${path}` }
- *   real receives    /<label>/<path>/...   →  plugin handler sees /<path>/...
+ * What REMAINS and why (the data-plane coupling the guardrail protects):
+ *   - the `webServer` provider itself: world-tree rows (`modules`, adapter
+ *     rows) inject/bind it; removing the provider would pend them and fail
+ *     the world boot;
+ *   - `stripLabelFromUrl`/`RealWebServerFace`: the `/hub` family
+ *     (`hub-route.ts`) types ctx0's real server and strips the `/hub` prefix
+ *     with the same URL rule;
+ *   - the neutral `port`/`host` getters: the shape every remaining reader
+ *     sees (a world owns no socket).
  *
- * Consequences:
- *  - any declared prefix lands under the label automatically; no list;
- *  - two worlds may both own `/api` (they become `/omp/api`, `/codex/api`);
- *  - ctx0 only ever sees the label namespaces, so a world cannot collide with
- *    ctx0's own routes.
- *
- * Index rows stay world-local: this instance owns its taps and emits nothing
- * on the shared tree (worlds run as their own cordis ROOTS, whose event buses
- * are isolated — probe 2026-09-16: emit on root B never reaches root A).
+ * The RPC channel is hub-owned: the `/hub` family (`hub-route.ts`) is the
+ * sole foreign entry.
  */
-import { type IndexInjection } from '@deepseek-ai/dsh-host-webserver';
 /** Route match kind (mirrors the upstream contract). */
 export type WebRouteKind = 'exact' | 'prefix';
 /** The slice of node:http we touch (kept structural for testability). */
@@ -43,7 +53,11 @@ export interface WorldWebUpgradeRoute {
     path: string;
     handler: (req: WorldRequest, socket: unknown, head: Buffer) => void | Promise<void>;
 }
-/** The real (ctx0) webServer surface this world forwards into. */
+/**
+ * The real (ctx0) webServer surface — since T-C no longer reachable from a
+ * world mount. The type stays for the `/hub` family (`hub-route.ts`), which
+ * registers on ctx0's real webServer directly.
+ */
 export interface RealWebServerFace {
     register(route: {
         kind: WebRouteKind;
@@ -59,104 +73,41 @@ export interface RealWebServerFace {
     readonly port?: number;
     readonly host?: string;
 }
-/** Options: how this world collects its own index rows. */
-export interface WorldWebServerOptions {
-    /**
-     * Push the world's index injection rows. The world plugin supplies a
-     * function that emits on the WORLD root (never on ctx0's tree).
-     */
-    onIndexInject?(table: IndexInjection[]): void;
-    /**
-     * ctx0's index authorization, applied to every route this mount forwards
-     * (pages, assets, fallback): the SAME gate native uses, so one cookie opens
-     * everything under the origin. The world owns no listener and the browser
-     * reaches it only through this mount, so authentication is decided HERE, in
-     * ctx0's auth domain — never by the world's own browser-auth gate. A false
-     * return means the authorizer already wrote the response (401 / 303).
-     */
-    authorize?(req: WorldRequest, res: WorldResponse): boolean;
-}
 /** Remove the mount label from `req.url`, preserving the trailing query. */
 export declare function stripLabelFromUrl(url: string | undefined, labelPath: string): string;
-/** One world's web surface, mounted under `<labelPath>`. */
+/**
+ * One world's web surface — a registration-only shell: it accepts every
+ * registration a world plugin makes (so the tree boots and composes exactly
+ * as before) and forwards none of them anywhere; nothing is stored, nothing
+ * is served (T-C), and nothing renders (T-D).
+ */
 export declare class WorldWebServer {
     readonly labelPath: string;
-    private readonly real;
-    private readonly options;
-    private readonly disposers;
-    private readonly taps;
-    /**
-     * @param labelPath - mount root, e.g. `/omp` (no trailing slash).
-     * @param real - the ctx0 webServer this world's routes forward into.
-     * @param options - world-local index row source.
-     */
-    constructor(labelPath: string, real: RealWebServerFace, options?: WorldWebServerOptions);
-    /** The ctx0 listener port (read-through; the world owns no socket). */
-    get port(): number;
-    /** The ctx0 bind host (read-through). */
-    get host(): string;
     /**
-     * The RPC channel belongs to the HUB, not to the world: the hub's carrier
-     * answers `/<label>/api/*` and `/<label>/api/remote.mux` with ctx0's auth
-     * domain, so the world's own connection/gateway registrations are swallowed
-     * here (returning a no-op disposer) instead of colliding on the real table.
-     * Non-envelope GET/HEAD traffic on `/<label>/api` still reaches the world's
-     * exact Fetch routes: `world-entry` publishes the world connection's shared
-     * `/api` fetch handler through `world-host`, and the carrier forwards into
-     * it AFTER ctx0's fence — the world's own browser-auth gate is never in the
-     * path (a different tree, a different secret).
+     * @param labelPath - mount root, e.g. `/omp` (no trailing slash) — the
+     *   world's identity record; no page is ever served under it.
      */
-    private static hubOwned;
+    constructor(labelPath: string);
     /**
-     * Mount-side authentication for one forwarded world route.
-     *
-     * The world's own browser-auth gate never sees a browser: it is reached
-     * in-ctx through this mount, and its cookie secret belongs to a different
-     * tree (every runtime is nested with its own home). So the decision is made
-     * here, with ctx0's connection: the same cookie that authenticated `<label>`
-     * in ctx0 authorizes its pages and assets.
+     * The ctx0 listener facts (read-through retired with the mount): worlds
+     * keep the same neutral defaults the disconnected read-through always
+     * fell back to — a world owns no socket and no page anyone can hit.
      */
-    private gate;
-    /** Register a world route; the real table stores its translated path. */
-    register(route: WorldWebRoute): () => void;
-    /** Register a world upgrade route (verbatim exact path; hub-owned RPC paths are swallowed). */
-    registerUpgrade(route: WorldWebUpgradeRoute): () => void;
-    /**
-     * Claim the world's SPA fallback: the ctx0 fallback seat is already owned by
-     * native frontend-static, so the world's fallback lives as a PREFIX route on
-     * the mount path (`/<label>`), which also keeps it inside the label namespace.
-     */
-    registerFallback(handler: (req: WorldRequest, res: WorldResponse) => void | Promise<void>): () => void;
+    get port(): number;
+    /** The neutral bind host (see {@link WorldWebServer.port}). */
+    get host(): string;
     /**
-     * Fix up HTML on its way out. Two passes belong here, in this order:
-     *
-     *   1. the world's own frontend-static injects `<base href="/">` AFTER
-     *      `renderIndex`, and the FIRST `<base>` wins in a document, so the mount
-     *      base is re-pinned on the bytes actually sent;
-     *   2. the agent roster is injected LAST — its values are the mount paths of
-     *      OTHER worlds (`/`, `/omp/`, `/codex/`), which the mount pass above
-     *      would otherwise re-root under this world's label.
+     * Accept one world route — and swallow it (T-C): pages have no road to
+     * ctx0. The disposer is a no-op, matching the swallowed-registration
+     * contract the `/api` family always had.
      */
-    private htmlRewrite;
-    /** World-local raw index transform (never forwarded to ctx0's taps). */
-    tapIndex(transform: (html: string) => string): () => void;
-    /** Apply this world's taps in registration order. */
-    applyIndexTaps(html: string): string;
-    /** Collect this world's structured rows (supplied by the world root). */
-    collectIndexInjections(): IndexInjection[];
+    register(_route: WorldWebRoute): () => void;
+    /** Accept one world upgrade route — and swallow it (see {@link register}). */
+    registerUpgrade(_route: WorldWebUpgradeRoute): () => void;
     /**
-     * Render the world's index: the client mount shim first (it must run before
-     * the app entry module), then the world's rows, then its taps, then the mount
-     * pass (base pinned at `/<label>/`, root-absolute strings re-rooted).
-     *
-     * The agent roster is injected LAST, after the mount pass: its values are
-     * mount paths of OTHER worlds (`/`, `/omp/`, `/codex/`), and the pass would
-     * happily re-root them under this world's label.
+     * Accept the world's SPA fallback claim — and swallow it (see
+     * {@link register}): the ctx0 fallback seat was always native
+     * frontend-static's alone.
      */
-    renderIndex(html: string): string;
-    /** Unregister every translated route (world unloaded). */
-    dispose(): void;
-    /** Wrap a plugin handler so it sees the world-relative URL. */
-    private strip;
-    private track;
+    registerFallback(_handler: (req: WorldRequest, res: WorldResponse) => void | Promise<void>): () => void;
 }

package/superd-hub/dist/world-web-server.js

@@ -1,34 +1,35 @@
 /**
- * Per-world virtual webServer (AW-B DL3).
+ * Per-world virtual webServer (AW-B DL3; path-separation T-C silent sink →
+ * T-D registration-only shell).
  *
- * A world's plugins must be able to declare ANY path they like (`/api`,
- * `/plugins`, `/whatever-name-i-like`). Enumerating those namespaces in the
- * carrier is wrong by construction — a third-party plugin may declare a new
- * one at any time. So this class translates at REGISTRATION time:
+ * A world's plugins still declare ANY path they like (`/api`, `/plugins`,
+ * `/whatever-name-i-like`), and the world root still needs a `webServer`
+ * provider for them to bind (the `modules` row injects it; `worldMountPatches`
+ * pins that inject). It used to translate every registration onto ctx0's real
+ * webServer as `/<label>+path` — the per-label page family. T-C (2026-09-26,
+ * user ruling "strip off the per agent url path … no need the url path
+ * fallback (we have git history)") severed that: every route a world plugin
+ * declares is accepted and SWALLOWED — no `/<label>/…` route ever lands on
+ * ctx0's real webServer. T-D (2026-09-26, "disable their webui build, just
+ * like disable their webserver") then disabled the world webui rows
+ * (`web-runtime`/`client-hmr`, see `worldMountPatches`) and retired the whole
+ * index face with them: no `renderIndex`, no taps, no index injections, no
+ * client mount shim — nothing renders a world page anywhere, and the mount
+ * HTML pass (`index-pass.ts`) plus the shim retired with the last consumer.
  *
- *   world registers  { kind, path }        →  real registers { kind, `${labelPath}${path}` }
- *   real receives    /<label>/<path>/...   →  plugin handler sees /<path>/...
+ * What REMAINS and why (the data-plane coupling the guardrail protects):
+ *   - the `webServer` provider itself: world-tree rows (`modules`, adapter
+ *     rows) inject/bind it; removing the provider would pend them and fail
+ *     the world boot;
+ *   - `stripLabelFromUrl`/`RealWebServerFace`: the `/hub` family
+ *     (`hub-route.ts`) types ctx0's real server and strips the `/hub` prefix
+ *     with the same URL rule;
+ *   - the neutral `port`/`host` getters: the shape every remaining reader
+ *     sees (a world owns no socket).
  *
- * Consequences:
- *  - any declared prefix lands under the label automatically; no list;
- *  - two worlds may both own `/api` (they become `/omp/api`, `/codex/api`);
- *  - ctx0 only ever sees the label namespaces, so a world cannot collide with
- *    ctx0's own routes.
- *
- * Index rows stay world-local: this instance owns its taps and emits nothing
- * on the shared tree (worlds run as their own cordis ROOTS, whose event buses
- * are isolated — probe 2026-09-16: emit on root B never reaches root A).
+ * The RPC channel is hub-owned: the `/hub` family (`hub-route.ts`) is the
+ * sole foreign entry.
  */
-import { renderIndexInjections } from '@deepseek-ai/dsh-host-webserver';
-import { rewriteIndexHtml } from './index-pass.js';
-import { renderClientShim } from './client-shim.js';
-import { agentRosterRow } from './agent-roster.js';
-function translatePath(labelPath, path) {
-    if (typeof path !== 'string' || !path.startsWith('/')) {
-        throw new Error(`world-web-server: route path must start with "/", got ${JSON.stringify(path)}`);
-    }
-    return path === '/' ? labelPath : `${labelPath}${path}`;
-}
 /** Remove the mount label from `req.url`, preserving the trailing query. */
 export function stripLabelFromUrl(url, labelPath) {
     const raw = typeof url === 'string' && url !== '' ? url : '/';
@@ -41,214 +42,58 @@ export function stripLabelFromUrl(url, labelPath) {
         return `${path.slice(labelPath.length)}${rest}`;
     return raw;
 }
-/** One world's web surface, mounted under `<labelPath>`. */
+/** No-op registration disposer (the swallowed-route shape). */
+function swallowed() {
+    return () => { };
+}
+/**
+ * One world's web surface — a registration-only shell: it accepts every
+ * registration a world plugin makes (so the tree boots and composes exactly
+ * as before) and forwards none of them anywhere; nothing is stored, nothing
+ * is served (T-C), and nothing renders (T-D).
+ */
 export class WorldWebServer {
     labelPath;
-    real;
-    options;
-    disposers = [];
-    taps = [];
     /**
-     * @param labelPath - mount root, e.g. `/omp` (no trailing slash).
-     * @param real - the ctx0 webServer this world's routes forward into.
-     * @param options - world-local index row source.
+     * @param labelPath - mount root, e.g. `/omp` (no trailing slash) — the
+     *   world's identity record; no page is ever served under it.
      */
-    constructor(labelPath, real, options = {}) {
+    constructor(labelPath) {
         this.labelPath = labelPath;
-        this.real = real;
-        this.options = options;
         if (typeof labelPath !== 'string' || !labelPath.startsWith('/') || labelPath === '/' || labelPath.endsWith('/')) {
             throw new Error(`world-web-server: labelPath must start with "/" and carry no trailing slash, got ${JSON.stringify(labelPath)}`);
         }
     }
-    /** The ctx0 listener port (read-through; the world owns no socket). */
-    get port() {
-        return this.real.port ?? 0;
-    }
-    /** The ctx0 bind host (read-through). */
-    get host() {
-        return this.real.host ?? '127.0.0.1';
-    }
-    /**
-     * The RPC channel belongs to the HUB, not to the world: the hub's carrier
-     * answers `/<label>/api/*` and `/<label>/api/remote.mux` with ctx0's auth
-     * domain, so the world's own connection/gateway registrations are swallowed
-     * here (returning a no-op disposer) instead of colliding on the real table.
-     * Non-envelope GET/HEAD traffic on `/<label>/api` still reaches the world's
-     * exact Fetch routes: `world-entry` publishes the world connection's shared
-     * `/api` fetch handler through `world-host`, and the carrier forwards into
-     * it AFTER ctx0's fence — the world's own browser-auth gate is never in the
-     * path (a different tree, a different secret).
-     */
-    static hubOwned(path) {
-        return path === '/api' || path.startsWith('/api/');
-    }
     /**
-     * Mount-side authentication for one forwarded world route.
-     *
-     * The world's own browser-auth gate never sees a browser: it is reached
-     * in-ctx through this mount, and its cookie secret belongs to a different
-     * tree (every runtime is nested with its own home). So the decision is made
-     * here, with ctx0's connection: the same cookie that authenticated `<label>`
-     * in ctx0 authorizes its pages and assets.
+     * The ctx0 listener facts (read-through retired with the mount): worlds
+     * keep the same neutral defaults the disconnected read-through always
+     * fell back to — a world owns no socket and no page anyone can hit.
      */
-    gate(handler) {
-        return (req, ...rest) => {
-            const res = rest[0];
-            // false => the authorizer already answered (401, or token→cookie 303).
-            if (res !== undefined && this.options.authorize !== undefined
-                && !this.options.authorize(req, res))
-                return;
-            return handler(req, ...rest);
-        };
-    }
-    /** Register a world route; the real table stores its translated path. */
-    register(route) {
-        if (WorldWebServer.hubOwned(route.path))
-            return () => { };
-        return this.track(this.real.register({
-            kind: route.kind,
-            path: translatePath(this.labelPath, route.path),
-            handler: this.strip(this.gate(route.handler)),
-        }));
-    }
-    /** Register a world upgrade route (verbatim exact path; hub-owned RPC paths are swallowed). */
-    registerUpgrade(route) {
-        if (WorldWebServer.hubOwned(route.path))
-            return () => { };
-        return this.track(this.real.registerUpgrade({
-            path: translatePath(this.labelPath, route.path),
-            handler: this.strip(route.handler),
-        }));
+    get port() {
+        return 0;
     }
-    /**
-     * Claim the world's SPA fallback: the ctx0 fallback seat is already owned by
-     * native frontend-static, so the world's fallback lives as a PREFIX route on
-     * the mount path (`/<label>`), which also keeps it inside the label namespace.
-     */
-    registerFallback(handler) {
-        // The world's index arrives HERE (its own frontend-static claims the
-        // fallback seat), so this is the route the mount must authenticate.
-        const gated = this.gate((req, ...rest) => handler(req, rest[0]));
-        return this.track(this.real.register({
-            kind: 'prefix',
-            path: this.labelPath,
-            handler: this.htmlRewrite(this.strip(gated)),
-        }));
+    /** The neutral bind host (see {@link WorldWebServer.port}). */
+    get host() {
+        return '127.0.0.1';
     }
     /**
-     * Fix up HTML on its way out. Two passes belong here, in this order:
-     *
-     *   1. the world's own frontend-static injects `<base href="/">` AFTER
-     *      `renderIndex`, and the FIRST `<base>` wins in a document, so the mount
-     *      base is re-pinned on the bytes actually sent;
-     *   2. the agent roster is injected LAST — its values are the mount paths of
-     *      OTHER worlds (`/`, `/omp/`, `/codex/`), which the mount pass above
-     *      would otherwise re-root under this world's label.
+     * Accept one world route — and swallow it (T-C): pages have no road to
+     * ctx0. The disposer is a no-op, matching the swallowed-registration
+     * contract the `/api` family always had.
      */
-    htmlRewrite(handler) {
-        const labelPath = this.labelPath;
-        return (req, ...rest) => {
-            const res = rest[0];
-            const originalEnd = res?.end?.bind(res);
-            if (res !== undefined && originalEnd !== undefined) {
-                res.end = ((chunk, ...tail) => {
-                    if (typeof chunk === 'string' || Buffer.isBuffer(chunk)) {
-                        const text = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
-                        if (/<head[\s>]/i.test(text) && /<base\b/i.test(text)) {
-                            const mounted = rewriteIndexHtml(text, labelPath);
-                            // A world that composes the hub row emits its own roster row during
-                            // renderIndex — i.e. BEFORE this mount pass, so its paths were
-                            // already re-rooted. Drop every earlier copy and inject the one
-                            // this pass has just built from unrewritten values.
-                            const stale = /<script>globalThis\["__DSH_AGENT_ROSTER__"\][^<]*<\/script>/g;
-                            const cleaned = mounted.replace(stale, '');
-                            return originalEnd(renderIndexInjections(cleaned, [agentRosterRow()]), ...tail);
-                        }
-                    }
-                    return originalEnd(chunk, ...tail);
-                });
-            }
-            return handler(req, ...rest);
-        };
+    register(_route) {
+        return swallowed();
     }
-    /** World-local raw index transform (never forwarded to ctx0's taps). */
-    tapIndex(transform) {
-        this.taps.push(transform);
-        return () => {
-            const at = this.taps.indexOf(transform);
-            if (at !== -1)
-                this.taps.splice(at, 1);
-        };
-    }
-    /** Apply this world's taps in registration order. */
-    applyIndexTaps(html) {
-        let out = html;
-        for (const transform of this.taps)
-            out = transform(out);
-        return out;
-    }
-    /** Collect this world's structured rows (supplied by the world root). */
-    collectIndexInjections() {
-        const table = [];
-        this.options.onIndexInject?.(table);
-        return table;
+    /** Accept one world upgrade route — and swallow it (see {@link register}). */
+    registerUpgrade(_route) {
+        return swallowed();
     }
     /**
-     * Render the world's index: the client mount shim first (it must run before
-     * the app entry module), then the world's rows, then its taps, then the mount
-     * pass (base pinned at `/<label>/`, root-absolute strings re-rooted).
-     *
-     * The agent roster is injected LAST, after the mount pass: its values are
-     * mount paths of OTHER worlds (`/`, `/omp/`, `/codex/`), and the pass would
-     * happily re-root them under this world's label.
+     * Accept the world's SPA fallback claim — and swallow it (see
+     * {@link register}): the ctx0 fallback seat was always native
+     * frontend-static's alone.
      */
-    renderIndex(html) {
-        // Injection rows FIRST, the client shim LAST: index-inject rows may need
-        // to own the transport global before anything else materializes — the
-        // page-trust component's `window.__DSH_TRANSPORT__ = { ownsHost: true }`
-        // guards on absence, while the shim MERGES into an existing object
-        // (`globalThis.__DSH_TRANSPORT__ = globalThis.__DSH_TRANSPORT__ || {}`).
-        // Shim-first would create the object and silently eat the verdict.
-        const rows = [
-            // No hub-invented widget here: the world composes the hub's own client
-            // plugin (see worldMountPatches), so its selector IS the native one.
-            ...this.collectIndexInjections(),
-            { kind: 'script', placement: 'head', text: renderClientShim(this.labelPath) },
-        ];
-        const rendered = this.applyIndexTaps(renderIndexInjections(html, rows));
-        // The roster rides the outbound pass (htmlRewrite), not this one: the mount
-        // rewrite above would re-root other worlds' paths under this label.
-        return rewriteIndexHtml(rendered, this.labelPath);
-    }
-    /** Unregister every translated route (world unloaded). */
-    dispose() {
-        for (const dispose of this.disposers.splice(0).reverse()) {
-            try {
-                dispose();
-            }
-            catch {
-                // release must never throw during teardown
-            }
-        }
-        this.taps.length = 0;
-    }
-    /** Wrap a plugin handler so it sees the world-relative URL. */
-    strip(handler) {
-        const labelPath = this.labelPath;
-        return (req, ...rest) => {
-            req.url = stripLabelFromUrl(req.url, labelPath);
-            return handler(req, ...rest);
-        };
-    }
-    track(dispose) {
-        const wrapped = () => {
-            const at = this.disposers.indexOf(wrapped);
-            if (at !== -1)
-                this.disposers.splice(at, 1);
-            dispose();
-        };
-        this.disposers.push(wrapped);
-        return wrapped;
+    registerFallback(_handler) {
+        return swallowed();
     }
 }