super-dsh 0.1.9 → 0.1.10-e

package/agent-omp-sdk/README.md

@@ -0,0 +1,103 @@
+# @pgmi-builds/agent-omp-sdk — OMP (SDK) adapter (opt-in)
+
+The **second** OMP adapter package, alongside `@pgmi-builds/agent-omp` (the RPC
+line). It is a complete, standalone copy of the pre-RPC-era OMP bridge — no
+shared code with the RPC package.
+
+- **World key** `omp-sdk`, roster label `OMP (SDK)`, world home
+  `<dshHome>/agents/omp-sdk` (deliberately not `agents/omp`).
+- **Off by default**: the `agent-omp-sdk` row in the super-dsh composite carries
+  `disabled: true`, so while the row is off not one byte of this package is
+  imported and nothing is fetched. Turning the row on (plugin manager
+  `setPluginEnabled` / `dsh plugin`) IS the switch — no env var, no config key.
+- **Why it exists**: the RPC shape is one `omp` child per Dash session
+  (~240 MB private each). This shape hosts **N sessions in one bun sidecar**
+  and shares `authStorage` / `modelRegistry` across them, so the marginal cost
+  per extra session is far lower.
+
+## No dependency is declared, and nothing is fetched at install time
+
+`package.json` declares an **empty `dependencies`** — no coding-agent package,
+no `bun`, no `optionalDependencies`, no `postinstall`. `dsh plugin add` only
+unpacks this package; `npm pack` contains no SDK bytes (only our own
+`sidecar/main.ts` source, which imports the package *inside the fetched
+runtime*).
+
+The durable runtime is fetched **lazily**, on the first real prompt of an
+`omp-sdk` session (draft / browse / passive queries stay at zero action, the
+same zero-spawn window the RPC line holds):
+
+```
+<worldHome>/sdk-runtime/
+  bin/bun                        bun release (linux-x64) unzipped into place
+  package.json / node_modules/   the pinned coding-agent package, installed with that bun
+  sidecar/main.ts                this package's sidecar (bun resolves node_modules from here)
+  dist/protocol.js               the compiled protocol module the sidecar imports
+<worldHome>/sdk-runtime.json     marker: {pluginVersion, packageVersion, bunVersion, bunPath, installedAt}
+<worldHome>/sdk-runtime.lock     atomic (mkdir) bootstrap lock
+<worldHome>/sdk-runtime.error.log  written only by a failed fetch
+```
+
+The marker is written **last**; a marker whose identity (`pluginVersion`,
+`packageVersion`, `bunVersion`) does not match the running adapter is treated as
+absent and refetched. The install is deliberately **slim**: `bun add --exact
+--ignore-scripts --omit=optional @oh-my-pi/pi-coding-agent@<pin>
+@oh-my-pi/pi-natives-<platform>@<pin>` — `--ignore-scripts` blocks package build
+scripts, `--omit=optional` drops the ~234 MB `@huggingface/transformers` +
+`onnxruntime-*` weight whose native postinstall is blocked anyway, and the
+platform binding package is re-added explicitly because `@oh-my-pi/pi-natives`
+needs it to load (`OMP_SDK_KEEP_OPTIONAL=1` reinstates the full tree). After the
+install the fetcher copies the sidecar and the compiled protocol module in, then
+runs a **post-install smoke import** (`<bun> -e 'await import("@oh-my-pi/pi-coding-agent")'`,
+agent dir redirected inside the runtime tree) and only then writes the marker —
+a pin that cannot be imported (18.4.9 is such a pin) fails loud here instead of
+at the first prompt.
+
+A failed fetch writes the error log and throws a single actionable error naming
+`OMP_SDK_PACKAGE_VERSION`; it never degrades silently into a confusing sidecar
+crash, and it never falls back to the RPC line (that is another row the user did
+not enable).
+
+## Wiring (where the fetch is triggered, and where it is not)
+
+- `world-plugin.ts` mounts the world and prints ONE report-only diagnostic when
+  the runtime is not on disk yet. It never fetches, spawns or imports the
+  runtime.
+- `index.ts` (`OmpProvider`) builds its transport in the constructor — that
+  builds a pool object, nothing else.
+- `transport.ts` / `lazy-rpc.ts` (`LazyOmpRpc`) construct per-session wrappers
+  with **zero** side effects; a new-chat draft leaves nothing server-side.
+- `sidecar-client.ts` (`OmpSdkSidecar#start`) is the ONE place `ensureSdkRuntime`
+  is awaited. `start()` is reached only from `LazyOmpRpc#ensure()`, i.e. from the
+  first `prompt` / `followUp` / `steer` / `ensureStarted`.
+- `sdk-client.ts` (`createOmpSdkSidecarPool`) holds the refcounted singleton:
+  two sessions of one dsh process share one bun child, and the pool releases
+  (and stops) it when the last client closes.
+
+## Manual warm-up
+
+```sh
+node scripts/fetch-sdk-runtime.mjs <dsh-home>      # world home = <dsh-home>/agents/omp-sdk
+# or, with the home in the environment:
+DSH_HOME=<dsh-home> npm run fetch-sdk-runtime
+```
+
+The script is a dev/test tool: it refuses any home outside this repository's
+`.tests` tree (the launcher red line) and has no `~/.dsh` default. It shares
+`createSdkRuntimeDeps` with the adapter's first-prompt fetch, so the two paths
+cannot drift.
+
+Pins: `OMP_SDK_PACKAGE_VERSION` (default `18.5.0` — do not use 18.4.9, whose
+source-level import is broken; `18.2.11` is the last known-good fallback) and
+`OMP_SDK_BUN_VERSION` (default `1.4.2`).
+
+## Build & test
+
+```sh
+npm run build     # tsc -p tsconfig.json
+npm test          # node --test test/*.test.mjs  (imports dist/, zero network, zero real bun)
+```
+
+The suite is fakes-only: the runtime bootstrap is driven through its injected
+`SdkRuntimeDeps`, and the sidecar spawn path through an injected `runtimeFetch`.
+No test downloads, spawns bun or touches a real home.

package/agent-omp-sdk/cordis.patch.yml

@@ -0,0 +1,108 @@
+# @pgmi-builds/agent-omp-sdk bundle patch. This file is the `dsh.bundle.patch`
+# layer of the published npm package: when this bundle is composed, the profile
+# boot merges THIS patch — mount the OMP (SDK) provider plus disable the native
+# components OMP replaces — exactly like a manual cordis.patch.yml.
+#
+# OPT-IN row (2026-10-03 user ruling): the super-dsh composite mounts this id
+# with `disabled: true`. The RPC line (@pgmi-builds/agent-omp) is the PRIMARY
+# path — it drives the operator's own `omp` binary over `--mode rpc`, so the
+# plugin bundles no runtime. Turning this row on (plugin manager
+# `setPluginEnabled`, or `dsh plugin`) IS the switch: presence of the row IS
+# roster membership, and there is no env var / config key to keep in sync.
+#
+# Nothing is installed and nothing is fetched while the row is off: this package
+# declares NO coding-agent/bun dependency and ships NO postinstall. The durable
+# runtime (bun + the pinned @oh-my-pi/pi-coding-agent + this package's sidecar)
+# is fetched into `<dshHome>/agents/omp-sdk/sdk-runtime/` on the FIRST real
+# prompt of an `omp-sdk` session (src/sdk-runtime.ts; pre-warm with
+# `npm run fetch-sdk-runtime`). Zero-spawn window before that prompt: no child,
+# no download, no session event.
+#
+# Profile-specific values are deliberately NOT here: `webserver.port` (port
+# choice) and `settings.path` (settings-under-profile) belong to the user's
+# profile patch layer; `agent-default-model` is tracked dynamically from OMP's
+# config.yml (`modelRoles.default`).
+
+# Mount the OMP (SDK) provider: the same Cordis AgentFactory as the RPC line,
+# driven through the SDK transport (one bun sidecar, N sessions, shared
+# authStorage/modelRegistry). The provider instance is this package's own
+# (`@pgmi-builds/agent-omp-sdk`): the two OMP lines are complete standalone
+# copies, each shipping its own provider.
+- insert:
+    - id: omp-sdk-provider
+      name: '@pgmi-builds/agent-omp-sdk'
+
+# OMP owns the live agent transcript; disable the built-in loop so it does not
+# double-run alongside the OMP sidecar.
+- id: agent-loop
+  disabled: true
+
+# The native routes register deepseek-official / pi-ai providers; the OMP
+# provider registers its own adapter (one route per OMP provider) on ctx.llm.
+# Leaving them mounted would advertise native models alongside OMP's.
+- id: llm-deepseek
+  disabled: true
+- id: llm-pi-ai
+  disabled: true
+
+# OMP is single-mode: its own runtime drives tools, so no Dash preset
+# composition is needed. 0.1.7: the host AgentPresetRegistry row (renamed
+# `agent-presets` → `agent-preset-registry`) stays MOUNTED — the bridge
+# registers its one fixed preset into it (src/agent-preset-omp.ts, id `omp`:
+# the capability IS OMP; the WORLD key is what differs) and the registry owns
+# roster/selection/document RPC + the agentPreset projection.
+# Pin only the default; modeSelectionEnabled already defaults to true.
+- id: agent-preset-registry
+  config:
+    default: omp
+
+# Titles come from OMP, not from Dash. The stock `session-title-first-prompt-llm`
+# row would run a Dash-side LLM call (through whatever adapter serves ctx.llm)
+# after the first prompt — that is Dash inventing functionality OMP does not
+# have. OMP's own session file carries a `title` entry exposed through the
+# sidecar; the transport is the only place that may mirror it into a
+# `session/title` event.
+- id: session-title-llm
+  disabled: true
+
+# dsh-shape-session-log: the native jsonl backend is the ONLY sessionPersistence.
+# This adapter feeds it (producer role); native components serve list/page/replay.
+# The plugin provides no persistence of its own — keep the stock row mounted.
+#
+# Directory picker: the stock `directory-picker-auto` is never a simple alias —
+# it RESOLVES the interaction once per boot and mounts BOTH faces through the
+# loader: the host backend package AND the matching CLIENT SURFACE package
+# (`dsh-client-ui-directory-picker-<kind>`). The client surface is what
+# occupies the workspace picker's directory-flow hole; with the hole empty the
+# client hides the "add workspace" entry entirely (WorkspacePicker:
+# `flowAvailable ? [ADD_WORKSPACE] : []`). NEVER just `disabled: true` this
+# row — that removed the button. Pin the in-app browser by mounting both faces
+# of `browse` ourselves (backend first: the surface's browser half drives the
+# capability the backend registers) and unmounting the auto row.
+- insert:
+    - id: directory-picker-browse
+      name: '@deepseek-ai/dsh-host-directory-picker-browse'
+    - id: directory-picker-browse-surface
+      name: '@deepseek-ai/dsh-client-ui-directory-picker-browse'
+- id: directory-picker
+  disabled: true
+
+# OMP has no runtime approval control — the transport maps the preset onto omp's
+# launch-only `--approval-mode` flag, resolved AT SPAWN on both OMP lines from
+# the session's own last `permission/preset`. Default to danger-full-access
+# (OMP's own native yolo default). Restate the full 3-preset table: a patch with
+# only defaultPreset silently drops the bundle's 3-preset table to the plugin's
+# built-in 2, breaking the 3:3 Dash<->OMP pairing.
+- id: permission
+  config:
+    presets:
+      read-only:
+        sandbox: read-only
+        approval: ask
+      workspace-write:
+        sandbox: workspace-write
+        approval: ask
+      danger-full-access:
+        sandbox: danger-full-access
+        approval: never
+    defaultPreset: danger-full-access

package/agent-omp-sdk/dist/adapter.d.ts

@@ -0,0 +1,21 @@
+/**
+ * OMP-backed `LlmAdapter` registered on `ctx.llm` by the OMP provider.
+ *
+ * The browser model selector never touches the OMP agent directly: it is an
+ * RPC round-trip through the apiproxy, which reads `ctx.llm.listProviders /
+ * listModels / resolveModelInfo` to build the catalog. This adapter answers
+ * those queries from OMP's real model registry (`models.ts`) so the selector
+ * shows OMP's providers and models — never the native deepseek-official /
+ * pi-ai routes, which the profile disables.
+ *
+ * `stream` is never dispatched: OMP owns generation inside its SDK sidecar
+ * (`OmpAgent`), so the adapter only serves catalog/metadata queries. It
+ * throws rather than fabricating a wire route the harness would misuse.
+ */
+import { LlmAdapter, type GenerateOptions, type LlmModelInfo, type LlmProviderInfo, type LlmResolvedModelInfo, type StreamChunk } from "@deepseek-ai/dsh-llm";
+export declare class OmpLlmAdapter extends LlmAdapter {
+    providerInfo(provider: string): LlmProviderInfo;
+    listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    stream(_options: GenerateOptions): AsyncIterable<StreamChunk>;
+}

package/agent-omp-sdk/dist/adapter.js

@@ -0,0 +1,36 @@
+/**
+ * OMP-backed `LlmAdapter` registered on `ctx.llm` by the OMP provider.
+ *
+ * The browser model selector never touches the OMP agent directly: it is an
+ * RPC round-trip through the apiproxy, which reads `ctx.llm.listProviders /
+ * listModels / resolveModelInfo` to build the catalog. This adapter answers
+ * those queries from OMP's real model registry (`models.ts`) so the selector
+ * shows OMP's providers and models — never the native deepseek-official /
+ * pi-ai routes, which the profile disables.
+ *
+ * `stream` is never dispatched: OMP owns generation inside its SDK sidecar
+ * (`OmpAgent`), so the adapter only serves catalog/metadata queries. It
+ * throws rather than fabricating a wire route the harness would misuse.
+ */
+import { LlmAdapter, LlmError, } from "@deepseek-ai/dsh-llm";
+import { loadOmpModels, providerDisplayName, toModelInfo, toResolvedModelInfo } from "./models.js";
+export class OmpLlmAdapter extends LlmAdapter {
+    providerInfo(provider) {
+        return { id: provider, name: providerDisplayName(provider) };
+    }
+    async listModels(provider) {
+        return loadOmpModels()
+            .filter((model) => model.provider === provider)
+            .map(toModelInfo);
+    }
+    async resolveModel(provider, model) {
+        const found = loadOmpModels().find((candidate) => candidate.provider === provider && candidate.id === model);
+        if (found === undefined) {
+            throw new LlmError(`OMP provider "${provider}" does not serve model "${model}"`, "MODEL_NOT_FOUND");
+        }
+        return toResolvedModelInfo(found);
+    }
+    stream(_options) {
+        throw new LlmError("the OMP adapter does not stream: OMP owns generation through its rpc agent", "UNSUPPORTED_STREAM");
+    }
+}

package/agent-omp-sdk/dist/agent-preset-omp.d.ts

@@ -0,0 +1,31 @@
+/**
+ * OMP preset registration — the profile's one fixed Agent preset.
+ *
+ * 0.1.7 alignment (upstream split `dsh-agent-presets` into `dsh-agent-preset`
+ * + `dsh-agent-preset-registry` and moved roster, selection, document RPC and
+ * the `agentPreset` session projection into the host `AgentPresetRegistry`,
+ * mounted by the dsh-web-app bundle's `agent-preset-registry` row): the
+ * bridge no longer implements the `agentPresets` service — the 0.1.6
+ * SingleOmpPresetRoster and its own projection fold are retired. It only
+ * REGISTERS the single fixed preset into the host registry.
+ *
+ * OMP is single-mode: the OMP agent drives its own tools through its RPC
+ * process, so no Dash-side preset composition exists to choose from. The
+ * preset's composition deliberately mounts nothing — mounting it composes
+ * nothing, exactly the rosterless behavior the provider runs on. Side benefit
+ * over the 0.1.6 disabled-row posture: `pluginInventory/list` works again
+ * (the registry provides `compositionInventory`, which the stock plugin
+ * inventory page calls unconditionally).
+ */
+import type { Context } from "@deepseek-ai/cordis";
+import type { PresetDefinition } from "@deepseek-ai/dsh-agent-preset-registry";
+export declare const OMP_PRESET_ID = "omp";
+/** The single fixed OMP preset: mounting it composes nothing. */
+export declare const OMP_PRESET: PresetDefinition;
+/**
+ * Register the fixed preset into the host `AgentPresetRegistry` once the
+ * service is up. Registration failure keeps the roster row visible as
+ * `broken` inside the registry (upstream owns that lifecycle) — the bridge
+ * only owns the disposer.
+ */
+export declare function registerOmpPreset(ctx: Context): void;

package/agent-omp-sdk/dist/agent-preset-omp.js

@@ -0,0 +1,32 @@
+export const OMP_PRESET_ID = "omp";
+/** The single fixed OMP preset: mounting it composes nothing. */
+export const OMP_PRESET = Object.freeze({
+    id: OMP_PRESET_ID,
+    name: "OMP",
+    description: "OMP agent via the agent-omp bridge",
+    plugins: Object.freeze([]),
+});
+/**
+ * Register the fixed preset into the host `AgentPresetRegistry` once the
+ * service is up. Registration failure keeps the roster row visible as
+ * `broken` inside the registry (upstream owns that lifecycle) — the bridge
+ * only owns the disposer.
+ */
+export function registerOmpPreset(ctx) {
+    ctx.inject(["agentPresets"], (scoped) => {
+        let dispose;
+        let settled = false;
+        void scoped.agentPresets.register(OMP_PRESET).then((unregister) => {
+            if (settled) {
+                void unregister();
+            }
+            else {
+                dispose = unregister;
+            }
+        });
+        ctx.effect(() => async () => {
+            settled = true;
+            await dispose?.();
+        }, "ompProvider.preset");
+    });
+}

package/agent-omp-sdk/dist/agent.d.ts

@@ -0,0 +1,64 @@
+/**
+ * OmpAgent — the Dash `Agent` shim over one live OMP SDK sidecar session.
+ *
+ * Bridges OMP's RPC event stream into the Dash `SessionEventMap`:
+ *
+ *   OMP RPC                         →  Dash session event
+ *   ─────────────────────────────────────────────────────────────
+ *   (send/followup delivers)        →  turn/start + user/message
+ *   turn_start                      →  step/start
+ *   message_update(text_delta)      →  assistant/chunk
+ *   message_end(assistant)          →  assistant/message (+ usage, reasoning)
+ *   message_end(toolResult)         →  tool/result (deduped vs tool_execution_end)
+ *   tool_execution_start            →  tool/call
+ *   tool_execution_end              →  tool/result
+ *   turn_end                        →  step/end
+ *   agent_end                       →  turn/end + status idle
+ *
+ * One Dash turn (user prompt → final answer) spans multiple OMP turns (one
+ * assistant response + its tool executions each), so Dash turn/step boundaries
+ * are synthesized around the OMP stream.
+ */
+import type { Context } from "@deepseek-ai/cordis";
+import type { Agent, AgentOptions, AgentStatus, CancelOptions, InboxTarget } from "@deepseek-ai/dsh-agent";
+import { Inbox } from "./inbox.js";
+import type { AgentCancelCause, Session, SessionId, UserMessage } from "@deepseek-ai/dsh-session";
+import type { ContentBlock, TokenUsage } from "@deepseek-ai/dsh-llm";
+import type { OmpContentBlock, OmpMessage } from "./rpc-types.js";
+import type { OmpAgentRpc } from "./lazy-rpc.js";
+import { type WithSystemHead } from "../../superd-hub/dist/index.js";
+export declare function convertContent(blocks: OmpContentBlock[] | undefined): ContentBlock[];
+/**
+ * Classify OMP's `stopReason: "error"` assistant message into a Dash `failure`
+ * (`{ message, code }`). This is the same taxonomy the harness adapters use for
+ * `turn/end` reasons — `AUTH`, `RATE_LIMIT`, `QUOTA`, `SERVER` — so the Web UI
+ * renders it through its own error path (the red "API key is invalid" alert,
+ * turn-positioned failure feedback) instead of an empty assistant bubble.
+ * Quota/usage wording is checked before the generic 403→AUTH because OMP's
+ * providers (e.g. kimi) report an exhausted billing quota as HTTP 403.
+ */
+export declare function ompFailure(message: OmpMessage): {
+    message: string;
+    code: string;
+} | undefined;
+/** Map OMP's usage accounting into Dash `TokenUsage` (disjoint field names). */
+export declare function convertUsage(usage: unknown): TokenUsage | undefined;
+export declare class OmpAgent implements Agent {
+    #private;
+    readonly id: SessionId;
+    readonly options: AgentOptions;
+    readonly session: WithSystemHead<Session>;
+    readonly inbox: Inbox;
+    readonly ctx: Context;
+    constructor(loopCtx: Context, id: SessionId, options: AgentOptions, session: Session, rpc: OmpAgentRpc, onIdleExit?: () => void);
+    get status(): AgentStatus;
+    send(message: UserMessage, target: InboxTarget, wakeup: boolean): void;
+    followup(message: UserMessage): void;
+    steer(message: UserMessage): void;
+    inject(message: UserMessage): void;
+    cancel(cause: AgentCancelCause, _options?: CancelOptions): void;
+    whenIdle(): Promise<void>;
+    runMaintenance<T>(task: (signal: AbortSignal) => Promise<T>): Promise<T>;
+    /** Stop OMP and unwind the scoped world. Idempotent. */
+    dispose(): Promise<void>;
+}