super-dsh 0.1.9 → 0.1.10-e

package/cordis.patch.yml

@@ -71,6 +71,70 @@
       name: 'super-dsh/agents/hermes'
     - id: agent-agy
       name: 'super-dsh/agents/agy'
+    # Opt-IN SDK half of the Antigravity split (2026-10-02 user ruling). The
+    # CLI row above is the PRIMARY path: the user already runs Antigravity, so
+    # the CLI reuses that environment (their ~/.gemini, ADC and keyring) for
+    # free, while this row drives the Python `google-antigravity` SDK instead.
+    #
+    # DISABLED BY DEFAULT — turning the row on IS the switch
+    # (`plugin-presence IS the roster`): no env var, no config key. It runs as
+    # world key `agy-sdk` (roster label "Antigravity (SDK)", world home
+    # `agents/agy-sdk`), deliberately distinct from `agy` because the hub's
+    # registerAgent hard-throws on a duplicate key and this row ships beside
+    # the CLI row — the two can therefore both be enabled harmlessly.
+    #
+    # No Python is installed at `dsh plugin add` time and this package declares
+    # no SDK dependency: the durable venv is fetched into that world home on
+    # first real use (agent-agy-sdk/src/sdk-venv.ts).
+    - id: agent-agy-sdk
+      name: 'super-dsh/agents/agy-sdk'
+      disabled: true
+    # Opt-IN SDK transport for OMP (2026-10-03 user ruling). `agent-omp` is the
+    # PRIMARY path: it drives the operator's own `omp` binary, so the plugin
+    # ships no runtime at all. This row drives the SAME agent through the
+    # package's in-process SDK face instead — one bun sidecar hosting every
+    # session (shared authStorage/modelRegistry), which is the cheaper memory
+    # shape for many concurrent sessions, at the cost of fetching a ~900 MB
+    # runtime tree.
+    #
+    # DISABLED BY DEFAULT — turning the row on IS the switch
+    # (`plugin-presence IS the roster`): no env var, no config key. It runs as
+    # world key `omp-sdk` (roster label "OMP (SDK)", world home
+    # `agents/omp-sdk`), deliberately distinct from `omp` because the hub's
+    # registerAgent hard-throws on a duplicate key and this row ships beside
+    # the RPC row — the two can therefore both be enabled harmlessly.
+    #
+    # Nothing is installed at `dsh plugin add` time and this package declares no
+    # dependency: the durable bun runtime + `@oh-my-pi/pi-coding-agent` tree is
+    # fetched into that world home on first real use
+    # (agent-omp-sdk/src/sdk-runtime.ts).
+    - id: agent-omp-sdk
+      name: 'super-dsh/agents/omp-sdk'
+      disabled: true
+    # PRESERVED SDK line for Codex (2026-10-04 user ruling). `agent-codex` is the
+    # PRIMARY path — it drives a `codex app-server` child process, so the plugin
+    # bundles no SDK: the CLI the operator already has is the runtime. This row
+    # drives the SAME agent through the older in-process `@openai/codex-sdk` face
+    # instead, kept because the code was already written and it is a real option
+    # (no child process per session, and it works with no `codex` binary on PATH
+    # once its runtime is fetched).
+    #
+    # DISABLED BY DEFAULT — turning the row on IS the switch (`plugin-presence IS
+    # the roster`): no env var, no config key. It runs as world key `codex-sdk`
+    # (roster label "Codex (SDK)", world home `agents/codex-sdk`), deliberately
+    # distinct from `codex` because the hub's registerAgent hard-throws on a
+    # duplicate key and this row ships beside the app-server row — the two can
+    # therefore both be enabled harmlessly.
+    #
+    # Nothing is installed at `dsh plugin add` time and this package declares NO
+    # dependency — not a dependency, not an optionalDependency, not a peer: the
+    # SDK tree (`@openai/codex-sdk` + the codex binary package, pinned together)
+    # is fetched into that world home on the first real prompt and is durable
+    # there (agent-codex-sdk/src/sdk-runtime.ts; pre-warm with
+    # `npm run fetch-sdk-runtime`). Zero-spawn, zero-download window before it.
+    - id: agent-codex-sdk
+      name: 'super-dsh/agents/codex-sdk'
+      disabled: true
     # R2 (2026-09-16): the claude adapter ships STANDALONE only — its /world
     # entry is inert. The HUB side joins it: one generic joiner row with the
     # key; spawn/roster/mount wiring lives in super-dsh/join.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "super-dsh",
-  "version": "0.1.9",
-  "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
+  "version": "0.1.10-e",
+  "description": "Super D for the DeepSeek Harness (DSH) \u2014 one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -18,6 +18,9 @@
     "./agents/pi": "./agent-pi/dist/world-plugin.js",
     "./agents/hermes": "./agent-hermes/dist/world-plugin.js",
     "./agents/agy": "./agent-agy/dist/world-plugin.js",
+    "./agents/agy-sdk": "./agent-agy-sdk/dist/world-plugin.js",
+    "./agents/omp-sdk": "./agent-omp-sdk/dist/world-plugin.js",
+    "./agents/codex-sdk": "./agent-codex-sdk/dist/world-plugin.js",
     "./client": "./client/index.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json",
@@ -36,10 +39,17 @@
     "agent-omp/dist",
     "agent-omp/package.json",
     "agent-omp/cordis.patch.yml",
-    "agent-omp/sidecar",
+    "agent-omp-sdk/dist",
+    "agent-omp-sdk/sidecar",
+    "agent-omp-sdk/package.json",
+    "agent-omp-sdk/cordis.patch.yml",
     "agent-codex/dist",
     "agent-codex/package.json",
     "agent-codex/cordis.patch.yml",
+    "agent-codex-sdk/dist",
+    "agent-codex-sdk/scripts",
+    "agent-codex-sdk/package.json",
+    "agent-codex-sdk/cordis.patch.yml",
     "agent-claude/dist",
     "agent-claude/package.json",
     "agent-claude/cordis.patch.yml",
@@ -52,7 +62,10 @@
     "agent-agy/dist",
     "agent-agy/package.json",
     "agent-agy/cordis.patch.yml",
-    "agent-agy/bridge"
+    "agent-agy-sdk/dist",
+    "agent-agy-sdk/package.json",
+    "agent-agy-sdk/cordis.patch.yml",
+    "agent-agy-sdk/bridge"
   ],
   "dsh": {
     "bundle": {
@@ -66,12 +79,8 @@
     }
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.263",
     "@earendil-works/pi-coding-agent": "0.84.2",
-    "@oh-my-pi/pi-coding-agent": "^18.1.14",
     "@openai/codex": "0.154.0",
-    "@openai/codex-sdk": "0.154.0",
-    "bun": "^1.4.2",
     "ws": "^8.21.0",
     "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"

package/superd-hub/dist/client/agent-settings.d.ts

@@ -0,0 +1,210 @@
+/**
+ * Runtime settings panels for the Hub's Agent Runtimes rows (P3, 2026-10-02
+ * user ruling).
+ *
+ * Interaction contract the UI follows (ruling, verbatim intent):
+ *   - clicking the ROW BODY expands that runtime's OWN settings inline
+ *     (accordion: at most one row open at a time);
+ *   - the row's existing right-hand `switch` affordance is the ONLY switch —
+ *     the panel never carries a second one.
+ *
+ * Config belongs to the adapter (agent-adapter-dev-rules §12), so this module
+ * owns only the presentation-side logic: which runtimes have a panel, the
+ * accordion transition, and a defensive parse of whatever the adapter's
+ * `*Auth/get` RPC returns. The adapter decides which auth methods exist, which
+ * are available on this machine, and which one is in force.
+ *
+ * Node-safe by construction (no DOM, no React, no fetch) — the host tsconfig
+ * dual-emits this file to `dist/client/agent-settings.js` so
+ * test/client-agent-settings.test.mjs can pin the parse and accordion rules
+ * under `node --test` (the roster.ts / mesh-api.ts precedent).
+ *
+ * @module superd-hub/client/agent-settings
+ */
+/** One selectable auth method as the adapter describes it. */
+export interface AuthMethodOption {
+    /** Stable id the RPC round-trips (`apiKey` | `oauth` | `adc`). */
+    readonly key: string;
+    /** Human label rendered on the option. */
+    readonly label: string;
+    /** Detected on THIS machine. Drives the availability annotation. */
+    readonly available: boolean;
+    /**
+     * Rendered but not selectable this round (the OAuth placeholder): the UI
+     * shows the shape and says why it is inert, instead of hiding it.
+     */
+    readonly placeholder: boolean;
+    /** One short line explaining the option (or why it is inert). */
+    readonly hint: string;
+}
+/** The adapter's answer to `<runtime>Auth/get`. */
+export interface RuntimeAuthView {
+    readonly methods: readonly AuthMethodOption[];
+    /** The user's explicit persisted choice; `null` when they have not made one. */
+    readonly selected: string | null;
+    /** What a new session would ACTUALLY use right now (ladder fallback applied). */
+    readonly effective: string | null;
+    /** Native file the adapter maintains for this runtime, when it owns one. */
+    readonly settingsPath?: string;
+    /** Free-form note from the adapter (e.g. why a mode is unavailable). */
+    readonly note?: string;
+}
+/**
+ * A runtime's settings panel: which adapter Remote answers for it.
+ *
+ * The namespace is the adapter's own service key — the hub forwards
+ * `envelope.method` verbatim, so the client needs only the name. A runtime absent
+ * from this table has no panel yet: its row still expands, to an explicit empty
+ * state rather than a dead control (the interaction stays uniform, and a runtime
+ * with nothing to configure SAYS so).
+ */
+export interface SettingsPanelSpec {
+    /** The adapter's Remote namespace (`agyAuth`). */
+    readonly namespace: string;
+    /**
+     * Which body the expanded row mounts. A runtime's config is not always a
+     * choice among a fixed set: Antigravity picks one sign-in form from a ladder,
+     * while Codex carries a LIST of providers the user adds, edits and removes
+     * (2026-10-03 ruling; the former active/select toggle is gone — which provider
+     * a Codex session runs on is DSH's own per-session model selection, not a
+     * hub-side switch). One namespace, two shapes — the kind discriminates.
+     */
+    readonly kind: 'auth' | 'providers';
+}
+/** The panel spec for a runtime, or `undefined` when it has none yet. */
+export declare function settingsPanelFor(agentKey: string): SettingsPanelSpec | undefined;
+/** Whether this runtime's row body expands into a real settings panel. */
+export declare function hasSettingsPanel(agentKey: string): boolean;
+/**
+ * Accordion transition: at most one row open. Clicking the open row closes it;
+ * clicking another moves the panel there in one click.
+ */
+export declare function toggleExpanded(current: string | null, key: string): string | null;
+/**
+ * Defensive parse of the RPC answer. Returns `undefined` for anything that is
+ * not a usable view (no methods, wrong shape, adapter absent) so the panel can
+ * render an explicit failure instead of an empty list that looks like success.
+ */
+export declare function parseAuthView(raw: unknown): RuntimeAuthView | undefined;
+/**
+ * The option the panel marks as in force: the effective one when the adapter
+ * named it, else the explicit selection. `undefined` when neither is known —
+ * the panel then marks nothing rather than guessing.
+ */
+export declare function activeMethod(view: RuntimeAuthView): AuthMethodOption | undefined;
+/** Whether an option may be picked (placeholders are rendered, never selected). */
+export declare function selectable(option: AuthMethodOption): boolean;
+/** One model behind a provider, as the panel lists it. */
+export interface ProviderModelOption {
+    readonly id: string;
+    /** Human label; the adapter sends one, else the id stands in. */
+    readonly label: string;
+    readonly contextWindow?: number;
+}
+/**
+ * The auth shapes the provider faces use between them: `apiKey` is shared,
+ * codex adds `env` (the key lives in a named variable), claude adds
+ * `authToken` (a Bearer token). Each face's adapter rejects the other's
+ * addition on save, which is why the form offers kinds per view
+ * (`authKindOptions`) instead of one fixed list.
+ */
+export type ProviderAuthKind = 'apiKey' | 'env' | 'authToken';
+/** One configured provider, listed but never carrying its key. */
+export interface ProviderOption {
+    readonly id: string;
+    readonly label: string;
+    readonly baseUrl: string;
+    readonly protocol: string;
+    readonly models: readonly ProviderModelOption[];
+    /** Which key shape the entry stores — see `ProviderAuthKind`. */
+    readonly authKind: ProviderAuthKind;
+    /** The variable an env-shaped provider expects. */
+    readonly envName?: string;
+    /** Whether a key is available — the ONLY thing the wire says about it. */
+    readonly hasKey: boolean;
+}
+/** One wire protocol the adapter offers, and whether it may be picked. */
+export interface ProviderProtocolOption {
+    readonly value: string;
+    readonly label: string;
+    readonly available: boolean;
+    readonly hint: string;
+}
+/**
+ * The files this surface reads and writes, shown so where an edit lands is
+ * never a surprise. Only `store` is common: each face names its own native
+ * files (codex: config/auth/catalogs; claude: settings), and a face that
+ * lacks a slot simply omits it — the footer renders what is there.
+ */
+export interface ProviderPaths {
+    readonly store: string;
+    readonly config?: string;
+    readonly auth?: string;
+    readonly catalogs?: string;
+    readonly settings?: string;
+}
+/** The adapter's answer to `codexProviders/get` / `claudeProviders/get` (and to every mutation). */
+export interface RuntimeProvidersView {
+    readonly providers: readonly ProviderOption[];
+    /**
+     * What the user's OWN native config currently names (codex: the provider
+     * `~/.codex/config.toml` selects; claude: the endpoint the `settings.json`
+     * env pins). Informational only — there is no action attached to it, and
+     * DSH's per-session model selection (not this list) decides what a session
+     * runs.
+     */
+    readonly native: {
+        readonly providerId?: string;
+        readonly baseUrl?: string;
+        readonly model?: string;
+    } | null;
+    /**
+     * The wire protocols the adapter offers, in the order it offers them. Empty
+     * for a face with no protocol choice (claude) — the panel then omits the
+     * dropdown instead of inventing options the runtime cannot run.
+     */
+    readonly protocols: readonly ProviderProtocolOption[];
+    readonly paths: ProviderPaths;
+    /** Epoch ms of the last reconcile against the native config, when one has happened. */
+    readonly syncedAt?: number;
+    readonly note?: string;
+}
+/**
+ * Defensive parse of the adapter's providers answer.
+ *
+ * `undefined` for anything that is not a usable view — but an empty `providers`
+ * array is valid (a fresh install), and so is a provider whose `models` array
+ * is empty. `protocols` is the codex face's field: an ABSENT field (the claude
+ * face) reads as "no protocol choice" and never fails the parse, while a
+ * present-but-unusable list is a malformed codex answer and rejects as before.
+ */
+export declare function parseProvidersView(raw: unknown): RuntimeProvidersView | undefined;
+/** One selectable auth shape for the add/edit form (`authKindOptions`). */
+export interface ProviderAuthKindOption {
+    readonly value: ProviderAuthKind;
+    readonly label: string;
+    readonly hint: string;
+}
+/**
+ * The auth shapes the add/edit form may pick for a provider, in display order.
+ *
+ * The view carries no explicit vocabulary field, so the panel reads it off the
+ * one field that distinguishes the faces today: `protocols`. The codex face
+ * advertises wire protocols and offers key-or-env-var; the claude face carries
+ * neither and offers its two header shapes instead. The list is per-view,
+ * never a fixed union — each adapter rejects the other's kinds on save, so a
+ * union dropdown would miscode silently. A third face extends the table.
+ */
+export declare function authKindOptions(view: RuntimeProvidersView): readonly ProviderAuthKindOption[];
+/**
+ * `provider / model` (codex) or `endpoint / model` (claude) — whichever halves
+ * the user's own native config names, joined for the one-line fact the panel
+ * states and never acts on.
+ */
+export declare function nativeDescription(native: RuntimeProvidersView['native']): string;
+/**
+ * The non-store paths joined for the panel's second footer line, in a fixed
+ * slot order. `undefined` when the face named none — the line is omitted
+ * entirely rather than rendered with blank slots.
+ */
+export declare function nativePathsLine(paths: ProviderPaths): string | undefined;

package/superd-hub/dist/client/agent-settings.js

@@ -0,0 +1,300 @@
+/**
+ * Runtime settings panels for the Hub's Agent Runtimes rows (P3, 2026-10-02
+ * user ruling).
+ *
+ * Interaction contract the UI follows (ruling, verbatim intent):
+ *   - clicking the ROW BODY expands that runtime's OWN settings inline
+ *     (accordion: at most one row open at a time);
+ *   - the row's existing right-hand `switch` affordance is the ONLY switch —
+ *     the panel never carries a second one.
+ *
+ * Config belongs to the adapter (agent-adapter-dev-rules §12), so this module
+ * owns only the presentation-side logic: which runtimes have a panel, the
+ * accordion transition, and a defensive parse of whatever the adapter's
+ * `*Auth/get` RPC returns. The adapter decides which auth methods exist, which
+ * are available on this machine, and which one is in force.
+ *
+ * Node-safe by construction (no DOM, no React, no fetch) — the host tsconfig
+ * dual-emits this file to `dist/client/agent-settings.js` so
+ * test/client-agent-settings.test.mjs can pin the parse and accordion rules
+ * under `node --test` (the roster.ts / mesh-api.ts precedent).
+ *
+ * @module superd-hub/client/agent-settings
+ */
+const SETTINGS_PANELS = {
+    // The one runtime with a settings surface this round: the CLI adapter owns the
+    // auth ladder and is the configuration surface for the user's local Antigravity.
+    agy: { namespace: 'agyAuth', kind: 'auth' },
+    // Codex's own config.toml names exactly one `model_provider`, but that file
+    // is the USER's and no longer the hub's toggle: Super D hosts the list
+    // cc-switch otherwise holds (add / edit / remove) and the adapter owns both
+    // the list and whatever it does with the native file.
+    codex: { namespace: 'codexProviders', kind: 'providers' },
+    // Both Codex lines host the SAME provider list (2026-10-04): the SDK half is
+    // the same agent through a different transport, so it carries the same panel
+    // and the same Remote namespace. The two worlds keep separate stores under
+    // their own `agents/<key>/`, so neither sees the other's list.
+    'codex-sdk': { namespace: 'codexProviders', kind: 'providers' },
+    // Claude serves the same providers view shape as Codex with no protocol
+    // dropdown: its adapter's view carries no `protocols` field (claude has no
+    // wire-protocol choice to make), so the body degrades to what the view does
+    // carry — two header auth kinds and its own native fact (2026-10-04).
+    claude: { namespace: 'claudeProviders', kind: 'providers' },
+};
+/** The panel spec for a runtime, or `undefined` when it has none yet. */
+export function settingsPanelFor(agentKey) {
+    return SETTINGS_PANELS[agentKey];
+}
+/** Whether this runtime's row body expands into a real settings panel. */
+export function hasSettingsPanel(agentKey) {
+    return settingsPanelFor(agentKey) !== undefined;
+}
+/**
+ * Accordion transition: at most one row open. Clicking the open row closes it;
+ * clicking another moves the panel there in one click.
+ */
+export function toggleExpanded(current, key) {
+    return current === key ? null : key;
+}
+function str(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function methodOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const key = str(record.key);
+    const label = str(record.label);
+    if (key === undefined || label === undefined)
+        return undefined;
+    return {
+        key,
+        label,
+        // Absent flags read as the conservative value: an older adapter that omits
+        // `available` must not render an option as usable when we cannot tell.
+        available: record.available === true,
+        placeholder: record.placeholder === true,
+        hint: str(record.hint) ?? '',
+    };
+}
+/**
+ * Defensive parse of the RPC answer. Returns `undefined` for anything that is
+ * not a usable view (no methods, wrong shape, adapter absent) so the panel can
+ * render an explicit failure instead of an empty list that looks like success.
+ */
+export function parseAuthView(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    if (!Array.isArray(record.methods))
+        return undefined;
+    const methods = record.methods.map(methodOption).filter((m) => m !== undefined);
+    if (methods.length === 0)
+        return undefined;
+    const settingsPath = str(record.settingsPath);
+    const note = str(record.note);
+    return {
+        methods,
+        selected: str(record.selected) ?? null,
+        effective: str(record.effective) ?? null,
+        ...(settingsPath === undefined ? {} : { settingsPath }),
+        ...(note === undefined ? {} : { note }),
+    };
+}
+/**
+ * The option the panel marks as in force: the effective one when the adapter
+ * named it, else the explicit selection. `undefined` when neither is known —
+ * the panel then marks nothing rather than guessing.
+ */
+export function activeMethod(view) {
+    const wanted = view.effective ?? view.selected;
+    if (wanted === null)
+        return undefined;
+    return view.methods.find((method) => method.key === wanted);
+}
+/** Whether an option may be picked (placeholders are rendered, never selected). */
+export function selectable(option) {
+    return !option.placeholder;
+}
+function nonEmpty(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function modelOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const id = nonEmpty(record.id);
+    if (id === undefined)
+        return undefined;
+    const contextWindow = record.contextWindow;
+    return {
+        id,
+        label: nonEmpty(record.displayName) ?? id,
+        ...(typeof contextWindow === 'number' && Number.isSafeInteger(contextWindow) && contextWindow > 0
+            ? { contextWindow }
+            : {}),
+    };
+}
+function providerAuthKind(raw) {
+    // An unstated or unknown kind reads as the shared conservative default,
+    // never as the other face's shape.
+    return raw === 'env' ? 'env' : raw === 'authToken' ? 'authToken' : 'apiKey';
+}
+function providerOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const id = nonEmpty(record.id);
+    const label = nonEmpty(record.label);
+    const baseUrl = nonEmpty(record.baseUrl);
+    if (id === undefined || label === undefined || baseUrl === undefined)
+        return undefined;
+    const models = Array.isArray(record.models)
+        ? record.models.map(modelOption).filter((entry) => entry !== undefined)
+        : [];
+    const envName = nonEmpty(record.envName);
+    return {
+        id,
+        label,
+        baseUrl,
+        // An unknown protocol is never echoed into a control; the only value this
+        // harness can actually run is the safe default.
+        protocol: record.protocol === 'chat' ? 'chat' : 'responses',
+        models,
+        authKind: providerAuthKind(record.authKind),
+        ...(envName === undefined ? {} : { envName }),
+        hasKey: record.hasKey === true,
+    };
+}
+function protocolOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const value = nonEmpty(record.value);
+    const label = nonEmpty(record.label);
+    if (value === undefined || label === undefined)
+        return undefined;
+    return { value, label, available: record.available === true, hint: nonEmpty(record.hint) ?? '' };
+}
+function providerPaths(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const store = nonEmpty(record.store);
+    // The store is the only slot every face promises; the native files are the
+    // face's own, and an absent one stays absent rather than blank.
+    if (store === undefined)
+        return undefined;
+    const config = nonEmpty(record.config);
+    const auth = nonEmpty(record.auth);
+    const catalogs = nonEmpty(record.catalogs);
+    const settings = nonEmpty(record.settings);
+    return {
+        store,
+        ...(config === undefined ? {} : { config }),
+        ...(auth === undefined ? {} : { auth }),
+        ...(catalogs === undefined ? {} : { catalogs }),
+        ...(settings === undefined ? {} : { settings }),
+    };
+}
+/**
+ * Defensive parse of the adapter's providers answer.
+ *
+ * `undefined` for anything that is not a usable view — but an empty `providers`
+ * array is valid (a fresh install), and so is a provider whose `models` array
+ * is empty. `protocols` is the codex face's field: an ABSENT field (the claude
+ * face) reads as "no protocol choice" and never fails the parse, while a
+ * present-but-unusable list is a malformed codex answer and rejects as before.
+ */
+export function parseProvidersView(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    if (!Array.isArray(record.providers))
+        return undefined;
+    // Absent `protocols` (the claude face) → nothing to offer, the panel omits
+    // the dropdown. Present (the codex face) → must parse to at least one
+    // option, exactly as before.
+    let protocols = [];
+    if (record.protocols !== undefined) {
+        if (!Array.isArray(record.protocols))
+            return undefined;
+        protocols = record.protocols.map(protocolOption).filter((entry) => entry !== undefined);
+        if (protocols.length === 0)
+            return undefined;
+    }
+    const paths = providerPaths(record.paths);
+    if (paths === undefined)
+        return undefined;
+    const providers = record.providers.map(providerOption).filter((entry) => entry !== undefined);
+    const syncedAt = record.syncedAt;
+    const note = nonEmpty(record.note);
+    return {
+        providers,
+        native: nativeConfig(record.native),
+        protocols,
+        paths,
+        ...(typeof syncedAt === 'number' && Number.isFinite(syncedAt) ? { syncedAt } : {}),
+        ...(note === undefined ? {} : { note }),
+    };
+}
+/**
+ * The user's own native config as the adapter last read it. `null` when the
+ * adapter said nothing; otherwise an object carrying whichever halves were
+ * named — codex names a provider id, claude an endpoint URL — and an empty
+ * one is still news (the panel says the file names nothing).
+ */
+function nativeConfig(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return null;
+    const record = raw;
+    const providerId = nonEmpty(record.providerId);
+    const baseUrl = nonEmpty(record.baseUrl);
+    const model = nonEmpty(record.model);
+    return {
+        ...(providerId === undefined ? {} : { providerId }),
+        ...(baseUrl === undefined ? {} : { baseUrl }),
+        ...(model === undefined ? {} : { model }),
+    };
+}
+/** The codex face: a stored key, or the name of a variable holding it. */
+const KEY_OR_ENV = [
+    { value: 'apiKey', label: 'API key', hint: 'Stored with the provider; injected at launch.' },
+    { value: 'env', label: 'Environment variable', hint: 'The child reads the key from a named variable.' },
+];
+/** The claude face: both kinds are literal keys, differing only in the header. */
+const TWO_HEADER_SHAPES = [
+    { value: 'apiKey', label: 'API key (x-api-key)', hint: 'Sent as the x-api-key header.' },
+    { value: 'authToken', label: 'Bearer token', hint: 'Sent as the Authorization header.' },
+];
+/**
+ * The auth shapes the add/edit form may pick for a provider, in display order.
+ *
+ * The view carries no explicit vocabulary field, so the panel reads it off the
+ * one field that distinguishes the faces today: `protocols`. The codex face
+ * advertises wire protocols and offers key-or-env-var; the claude face carries
+ * neither and offers its two header shapes instead. The list is per-view,
+ * never a fixed union — each adapter rejects the other's kinds on save, so a
+ * union dropdown would miscode silently. A third face extends the table.
+ */
+export function authKindOptions(view) {
+    return view.protocols.length > 0 ? KEY_OR_ENV : TWO_HEADER_SHAPES;
+}
+/**
+ * `provider / model` (codex) or `endpoint / model` (claude) — whichever halves
+ * the user's own native config names, joined for the one-line fact the panel
+ * states and never acts on.
+ */
+export function nativeDescription(native) {
+    const parts = [native?.providerId ?? native?.baseUrl, native?.model].filter((part) => part !== undefined);
+    return parts.length === 0 ? 'no provider' : parts.join(' / ');
+}
+/**
+ * The non-store paths joined for the panel's second footer line, in a fixed
+ * slot order. `undefined` when the face named none — the line is omitted
+ * entirely rather than rendered with blank slots.
+ */
+export function nativePathsLine(paths) {
+    const parts = [paths.config, paths.auth, paths.catalogs, paths.settings].filter((part) => part !== undefined);
+    return parts.length === 0 ? undefined : parts.join(' · ');
+}

package/superd-hub/dist/client/roster.js

@@ -25,6 +25,12 @@ const FALLBACK_LABELS = {
     pi: 'Pi',
     hermes: 'Hermes',
     agy: 'Antigravity',
+    // The opt-in SDK halves carry their own keys so a host that reports only keys
+    // still renders a distinguishable label (the composite rows are `disabled: true`
+    // by default, so these appear only once an operator turns one on).
+    'omp-sdk': 'OMP (SDK)',
+    'agy-sdk': 'Antigravity (SDK)',
+    'codex-sdk': 'Codex (SDK)',
 };
 /** Coerce a wire `agents` array into links; undefined when unusable/empty. */
 function coerceAgents(raw) {