super-dsh 0.1.9 → 0.1.10

package/cordis.patch.yml

@@ -71,6 +71,70 @@
       name: 'super-dsh/agents/hermes'
     - id: agent-agy
       name: 'super-dsh/agents/agy'
+    # Opt-IN SDK half of the Antigravity split (2026-10-02 user ruling). The
+    # CLI row above is the PRIMARY path: the user already runs Antigravity, so
+    # the CLI reuses that environment (their ~/.gemini, ADC and keyring) for
+    # free, while this row drives the Python `google-antigravity` SDK instead.
+    #
+    # DISABLED BY DEFAULT — turning the row on IS the switch
+    # (`plugin-presence IS the roster`): no env var, no config key. It runs as
+    # world key `agy-sdk` (roster label "Antigravity (SDK)", world home
+    # `agents/agy-sdk`), deliberately distinct from `agy` because the hub's
+    # registerAgent hard-throws on a duplicate key and this row ships beside
+    # the CLI row — the two can therefore both be enabled harmlessly.
+    #
+    # No Python is installed at `dsh plugin add` time and this package declares
+    # no SDK dependency: the durable venv is fetched into that world home on
+    # first real use (agent-agy-sdk/src/sdk-venv.ts).
+    - id: agent-agy-sdk
+      name: 'super-dsh/agents/agy-sdk'
+      disabled: true
+    # Opt-IN SDK transport for OMP (2026-10-03 user ruling). `agent-omp` is the
+    # PRIMARY path: it drives the operator's own `omp` binary, so the plugin
+    # ships no runtime at all. This row drives the SAME agent through the
+    # package's in-process SDK face instead — one bun sidecar hosting every
+    # session (shared authStorage/modelRegistry), which is the cheaper memory
+    # shape for many concurrent sessions, at the cost of fetching a ~900 MB
+    # runtime tree.
+    #
+    # DISABLED BY DEFAULT — turning the row on IS the switch
+    # (`plugin-presence IS the roster`): no env var, no config key. It runs as
+    # world key `omp-sdk` (roster label "OMP (SDK)", world home
+    # `agents/omp-sdk`), deliberately distinct from `omp` because the hub's
+    # registerAgent hard-throws on a duplicate key and this row ships beside
+    # the RPC row — the two can therefore both be enabled harmlessly.
+    #
+    # Nothing is installed at `dsh plugin add` time and this package declares no
+    # dependency: the durable bun runtime + `@oh-my-pi/pi-coding-agent` tree is
+    # fetched into that world home on first real use
+    # (agent-omp-sdk/src/sdk-runtime.ts).
+    - id: agent-omp-sdk
+      name: 'super-dsh/agents/omp-sdk'
+      disabled: true
+    # PRESERVED SDK line for Codex (2026-10-04 user ruling). `agent-codex` is the
+    # PRIMARY path — it drives a `codex app-server` child process, so the plugin
+    # bundles no SDK: the CLI the operator already has is the runtime. This row
+    # drives the SAME agent through the older in-process `@openai/codex-sdk` face
+    # instead, kept because the code was already written and it is a real option
+    # (no child process per session, and it works with no `codex` binary on PATH
+    # once its runtime is fetched).
+    #
+    # DISABLED BY DEFAULT — turning the row on IS the switch (`plugin-presence IS
+    # the roster`): no env var, no config key. It runs as world key `codex-sdk`
+    # (roster label "Codex (SDK)", world home `agents/codex-sdk`), deliberately
+    # distinct from `codex` because the hub's registerAgent hard-throws on a
+    # duplicate key and this row ships beside the app-server row — the two can
+    # therefore both be enabled harmlessly.
+    #
+    # Nothing is installed at `dsh plugin add` time and this package declares NO
+    # dependency — not a dependency, not an optionalDependency, not a peer: the
+    # SDK tree (`@openai/codex-sdk` + the codex binary package, pinned together)
+    # is fetched into that world home on the first real prompt and is durable
+    # there (agent-codex-sdk/src/sdk-runtime.ts; pre-warm with
+    # `npm run fetch-sdk-runtime`). Zero-spawn, zero-download window before it.
+    - id: agent-codex-sdk
+      name: 'super-dsh/agents/codex-sdk'
+      disabled: true
     # R2 (2026-09-16): the claude adapter ships STANDALONE only — its /world
     # entry is inert. The HUB side joins it: one generic joiner row with the
     # key; spawn/roster/mount wiring lives in super-dsh/join.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "super-dsh",
-  "version": "0.1.9",
-  "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
+  "version": "0.1.10",
+  "description": "Super D for the DeepSeek Harness (DSH) \u2014 one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -18,6 +18,9 @@
     "./agents/pi": "./agent-pi/dist/world-plugin.js",
     "./agents/hermes": "./agent-hermes/dist/world-plugin.js",
     "./agents/agy": "./agent-agy/dist/world-plugin.js",
+    "./agents/agy-sdk": "./agent-agy-sdk/dist/world-plugin.js",
+    "./agents/omp-sdk": "./agent-omp-sdk/dist/world-plugin.js",
+    "./agents/codex-sdk": "./agent-codex-sdk/dist/world-plugin.js",
     "./client": "./client/index.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json",
@@ -36,10 +39,17 @@
     "agent-omp/dist",
     "agent-omp/package.json",
     "agent-omp/cordis.patch.yml",
-    "agent-omp/sidecar",
+    "agent-omp-sdk/dist",
+    "agent-omp-sdk/sidecar",
+    "agent-omp-sdk/package.json",
+    "agent-omp-sdk/cordis.patch.yml",
     "agent-codex/dist",
     "agent-codex/package.json",
     "agent-codex/cordis.patch.yml",
+    "agent-codex-sdk/dist",
+    "agent-codex-sdk/scripts",
+    "agent-codex-sdk/package.json",
+    "agent-codex-sdk/cordis.patch.yml",
     "agent-claude/dist",
     "agent-claude/package.json",
     "agent-claude/cordis.patch.yml",
@@ -52,7 +62,10 @@
     "agent-agy/dist",
     "agent-agy/package.json",
     "agent-agy/cordis.patch.yml",
-    "agent-agy/bridge"
+    "agent-agy-sdk/dist",
+    "agent-agy-sdk/package.json",
+    "agent-agy-sdk/cordis.patch.yml",
+    "agent-agy-sdk/bridge"
   ],
   "dsh": {
     "bundle": {
@@ -68,10 +81,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.263",
     "@earendil-works/pi-coding-agent": "0.84.2",
-    "@oh-my-pi/pi-coding-agent": "^18.1.14",
     "@openai/codex": "0.154.0",
-    "@openai/codex-sdk": "0.154.0",
-    "bun": "^1.4.2",
     "ws": "^8.21.0",
     "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"

package/superd-hub/dist/client/agent-settings.d.ts

@@ -0,0 +1,156 @@
+/**
+ * Runtime settings panels for the Hub's Agent Runtimes rows (P3, 2026-10-02
+ * user ruling).
+ *
+ * Interaction contract the UI follows (ruling, verbatim intent):
+ *   - clicking the ROW BODY expands that runtime's OWN settings inline
+ *     (accordion: at most one row open at a time);
+ *   - the row's existing right-hand `switch` affordance is the ONLY switch —
+ *     the panel never carries a second one.
+ *
+ * Config belongs to the adapter (agent-adapter-dev-rules §12), so this module
+ * owns only the presentation-side logic: which runtimes have a panel, the
+ * accordion transition, and a defensive parse of whatever the adapter's
+ * `*Auth/get` RPC returns. The adapter decides which auth methods exist, which
+ * are available on this machine, and which one is in force.
+ *
+ * Node-safe by construction (no DOM, no React, no fetch) — the host tsconfig
+ * dual-emits this file to `dist/client/agent-settings.js` so
+ * test/client-agent-settings.test.mjs can pin the parse and accordion rules
+ * under `node --test` (the roster.ts / mesh-api.ts precedent).
+ *
+ * @module superd-hub/client/agent-settings
+ */
+/** One selectable auth method as the adapter describes it. */
+export interface AuthMethodOption {
+    /** Stable id the RPC round-trips (`apiKey` | `oauth` | `adc`). */
+    readonly key: string;
+    /** Human label rendered on the option. */
+    readonly label: string;
+    /** Detected on THIS machine. Drives the availability annotation. */
+    readonly available: boolean;
+    /**
+     * Rendered but not selectable this round (the OAuth placeholder): the UI
+     * shows the shape and says why it is inert, instead of hiding it.
+     */
+    readonly placeholder: boolean;
+    /** One short line explaining the option (or why it is inert). */
+    readonly hint: string;
+}
+/** The adapter's answer to `<runtime>Auth/get`. */
+export interface RuntimeAuthView {
+    readonly methods: readonly AuthMethodOption[];
+    /** The user's explicit persisted choice; `null` when they have not made one. */
+    readonly selected: string | null;
+    /** What a new session would ACTUALLY use right now (ladder fallback applied). */
+    readonly effective: string | null;
+    /** Native file the adapter maintains for this runtime, when it owns one. */
+    readonly settingsPath?: string;
+    /** Free-form note from the adapter (e.g. why a mode is unavailable). */
+    readonly note?: string;
+}
+/**
+ * A runtime's settings panel: which adapter Remote answers for it.
+ *
+ * The namespace is the adapter's own service key — the hub forwards
+ * `envelope.method` verbatim, so the client needs only the name. A runtime absent
+ * from this table has no panel yet: its row still expands, to an explicit empty
+ * state rather than a dead control (the interaction stays uniform, and a runtime
+ * with nothing to configure SAYS so).
+ */
+export interface SettingsPanelSpec {
+    /** The adapter's Remote namespace (`agyAuth`). */
+    readonly namespace: string;
+    /**
+     * Which body the expanded row mounts. A runtime's config is not always a
+     * choice among a fixed set: Antigravity picks one sign-in form from a ladder,
+     * while Codex carries a LIST of providers the user adds, edits and removes
+     * (2026-10-03 ruling; the former active/select toggle is gone — which provider
+     * a Codex session runs on is DSH's own per-session model selection, not a
+     * hub-side switch). One namespace, two shapes — the kind discriminates.
+     */
+    readonly kind: 'auth' | 'providers';
+}
+/** The panel spec for a runtime, or `undefined` when it has none yet. */
+export declare function settingsPanelFor(agentKey: string): SettingsPanelSpec | undefined;
+/** Whether this runtime's row body expands into a real settings panel. */
+export declare function hasSettingsPanel(agentKey: string): boolean;
+/**
+ * Accordion transition: at most one row open. Clicking the open row closes it;
+ * clicking another moves the panel there in one click.
+ */
+export declare function toggleExpanded(current: string | null, key: string): string | null;
+/**
+ * Defensive parse of the RPC answer. Returns `undefined` for anything that is
+ * not a usable view (no methods, wrong shape, adapter absent) so the panel can
+ * render an explicit failure instead of an empty list that looks like success.
+ */
+export declare function parseAuthView(raw: unknown): RuntimeAuthView | undefined;
+/**
+ * The option the panel marks as in force: the effective one when the adapter
+ * named it, else the explicit selection. `undefined` when neither is known —
+ * the panel then marks nothing rather than guessing.
+ */
+export declare function activeMethod(view: RuntimeAuthView): AuthMethodOption | undefined;
+/** Whether an option may be picked (placeholders are rendered, never selected). */
+export declare function selectable(option: AuthMethodOption): boolean;
+/** One model behind a provider, as the panel lists it. */
+export interface ProviderModelOption {
+    readonly id: string;
+    /** Human label; the adapter sends one, else the id stands in. */
+    readonly label: string;
+    readonly contextWindow?: number;
+}
+/** One configured provider, listed but never carrying its key. */
+export interface ProviderOption {
+    readonly id: string;
+    readonly label: string;
+    readonly baseUrl: string;
+    readonly protocol: string;
+    readonly models: readonly ProviderModelOption[];
+    readonly authKind: 'apiKey' | 'env';
+    /** The variable an env-shaped provider expects. */
+    readonly envName?: string;
+    /** Whether a key is available — the ONLY thing the wire says about it. */
+    readonly hasKey: boolean;
+}
+/** One wire protocol the adapter offers, and whether it may be picked. */
+export interface ProviderProtocolOption {
+    readonly value: string;
+    readonly label: string;
+    readonly available: boolean;
+    readonly hint: string;
+}
+/** The files this surface reads and writes, shown so where an edit lands is never a surprise. */
+export interface ProviderPaths {
+    readonly store: string;
+    readonly config: string;
+    readonly auth: string;
+    readonly catalogs: string;
+}
+/** The adapter's answer to `codexProviders/get` (and to every mutation). */
+export interface RuntimeProvidersView {
+    readonly providers: readonly ProviderOption[];
+    /**
+     * What the user's OWN ~/.codex/config.toml currently names. Informational
+     * only — there is no action attached to it, and DSH's per-session model
+     * selection (not this list) decides what a session runs.
+     */
+    readonly native: {
+        readonly providerId?: string;
+        readonly model?: string;
+    } | null;
+    readonly protocols: readonly ProviderProtocolOption[];
+    readonly paths: ProviderPaths;
+    /** Epoch ms of the last reconcile against config.toml, when one has happened. */
+    readonly syncedAt?: number;
+    readonly note?: string;
+}
+/**
+ * Defensive parse of the adapter's providers answer.
+ *
+ * `undefined` for anything that is not a usable view — but an empty `providers`
+ * array WITH a usable protocol list is valid (a fresh install), and so is a
+ * provider whose `models` array is empty.
+ */
+export declare function parseProvidersView(raw: unknown): RuntimeProvidersView | undefined;

package/superd-hub/dist/client/agent-settings.js

@@ -0,0 +1,229 @@
+/**
+ * Runtime settings panels for the Hub's Agent Runtimes rows (P3, 2026-10-02
+ * user ruling).
+ *
+ * Interaction contract the UI follows (ruling, verbatim intent):
+ *   - clicking the ROW BODY expands that runtime's OWN settings inline
+ *     (accordion: at most one row open at a time);
+ *   - the row's existing right-hand `switch` affordance is the ONLY switch —
+ *     the panel never carries a second one.
+ *
+ * Config belongs to the adapter (agent-adapter-dev-rules §12), so this module
+ * owns only the presentation-side logic: which runtimes have a panel, the
+ * accordion transition, and a defensive parse of whatever the adapter's
+ * `*Auth/get` RPC returns. The adapter decides which auth methods exist, which
+ * are available on this machine, and which one is in force.
+ *
+ * Node-safe by construction (no DOM, no React, no fetch) — the host tsconfig
+ * dual-emits this file to `dist/client/agent-settings.js` so
+ * test/client-agent-settings.test.mjs can pin the parse and accordion rules
+ * under `node --test` (the roster.ts / mesh-api.ts precedent).
+ *
+ * @module superd-hub/client/agent-settings
+ */
+const SETTINGS_PANELS = {
+    // The one runtime with a settings surface this round: the CLI adapter owns the
+    // auth ladder and is the configuration surface for the user's local Antigravity.
+    agy: { namespace: 'agyAuth', kind: 'auth' },
+    // Codex's own config.toml names exactly one `model_provider`, but that file
+    // is the USER's and no longer the hub's toggle: Super D hosts the list
+    // cc-switch otherwise holds (add / edit / remove) and the adapter owns both
+    // the list and whatever it does with the native file.
+    codex: { namespace: 'codexProviders', kind: 'providers' },
+    // Both Codex lines host the SAME provider list (2026-10-04): the SDK half is
+    // the same agent through a different transport, so it carries the same panel
+    // and the same Remote namespace. The two worlds keep separate stores under
+    // their own `agents/<key>/`, so neither sees the other's list.
+    'codex-sdk': { namespace: 'codexProviders', kind: 'providers' },
+};
+/** The panel spec for a runtime, or `undefined` when it has none yet. */
+export function settingsPanelFor(agentKey) {
+    return SETTINGS_PANELS[agentKey];
+}
+/** Whether this runtime's row body expands into a real settings panel. */
+export function hasSettingsPanel(agentKey) {
+    return settingsPanelFor(agentKey) !== undefined;
+}
+/**
+ * Accordion transition: at most one row open. Clicking the open row closes it;
+ * clicking another moves the panel there in one click.
+ */
+export function toggleExpanded(current, key) {
+    return current === key ? null : key;
+}
+function str(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function methodOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const key = str(record.key);
+    const label = str(record.label);
+    if (key === undefined || label === undefined)
+        return undefined;
+    return {
+        key,
+        label,
+        // Absent flags read as the conservative value: an older adapter that omits
+        // `available` must not render an option as usable when we cannot tell.
+        available: record.available === true,
+        placeholder: record.placeholder === true,
+        hint: str(record.hint) ?? '',
+    };
+}
+/**
+ * Defensive parse of the RPC answer. Returns `undefined` for anything that is
+ * not a usable view (no methods, wrong shape, adapter absent) so the panel can
+ * render an explicit failure instead of an empty list that looks like success.
+ */
+export function parseAuthView(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    if (!Array.isArray(record.methods))
+        return undefined;
+    const methods = record.methods.map(methodOption).filter((m) => m !== undefined);
+    if (methods.length === 0)
+        return undefined;
+    const settingsPath = str(record.settingsPath);
+    const note = str(record.note);
+    return {
+        methods,
+        selected: str(record.selected) ?? null,
+        effective: str(record.effective) ?? null,
+        ...(settingsPath === undefined ? {} : { settingsPath }),
+        ...(note === undefined ? {} : { note }),
+    };
+}
+/**
+ * The option the panel marks as in force: the effective one when the adapter
+ * named it, else the explicit selection. `undefined` when neither is known —
+ * the panel then marks nothing rather than guessing.
+ */
+export function activeMethod(view) {
+    const wanted = view.effective ?? view.selected;
+    if (wanted === null)
+        return undefined;
+    return view.methods.find((method) => method.key === wanted);
+}
+/** Whether an option may be picked (placeholders are rendered, never selected). */
+export function selectable(option) {
+    return !option.placeholder;
+}
+function nonEmpty(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function modelOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const id = nonEmpty(record.id);
+    if (id === undefined)
+        return undefined;
+    const contextWindow = record.contextWindow;
+    return {
+        id,
+        label: nonEmpty(record.displayName) ?? id,
+        ...(typeof contextWindow === 'number' && Number.isSafeInteger(contextWindow) && contextWindow > 0
+            ? { contextWindow }
+            : {}),
+    };
+}
+function providerOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const id = nonEmpty(record.id);
+    const label = nonEmpty(record.label);
+    const baseUrl = nonEmpty(record.baseUrl);
+    if (id === undefined || label === undefined || baseUrl === undefined)
+        return undefined;
+    const models = Array.isArray(record.models)
+        ? record.models.map(modelOption).filter((entry) => entry !== undefined)
+        : [];
+    const envName = nonEmpty(record.envName);
+    return {
+        id,
+        label,
+        baseUrl,
+        // An unknown protocol is never echoed into a control; the only value this
+        // harness can actually run is the safe default.
+        protocol: record.protocol === 'chat' ? 'chat' : 'responses',
+        models,
+        authKind: record.authKind === 'env' ? 'env' : 'apiKey',
+        ...(envName === undefined ? {} : { envName }),
+        hasKey: record.hasKey === true,
+    };
+}
+function protocolOption(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const value = nonEmpty(record.value);
+    const label = nonEmpty(record.label);
+    if (value === undefined || label === undefined)
+        return undefined;
+    return { value, label, available: record.available === true, hint: nonEmpty(record.hint) ?? '' };
+}
+function providerPaths(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const store = nonEmpty(record.store);
+    const config = nonEmpty(record.config);
+    const auth = nonEmpty(record.auth);
+    const catalogs = nonEmpty(record.catalogs);
+    if (store === undefined || config === undefined || auth === undefined || catalogs === undefined)
+        return undefined;
+    return { store, config, auth, catalogs };
+}
+/**
+ * Defensive parse of the adapter's providers answer.
+ *
+ * `undefined` for anything that is not a usable view — but an empty `providers`
+ * array WITH a usable protocol list is valid (a fresh install), and so is a
+ * provider whose `models` array is empty.
+ */
+export function parseProvidersView(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    if (!Array.isArray(record.providers))
+        return undefined;
+    if (!Array.isArray(record.protocols))
+        return undefined;
+    const protocols = record.protocols.map(protocolOption).filter((entry) => entry !== undefined);
+    if (protocols.length === 0)
+        return undefined;
+    const paths = providerPaths(record.paths);
+    if (paths === undefined)
+        return undefined;
+    const providers = record.providers.map(providerOption).filter((entry) => entry !== undefined);
+    const syncedAt = record.syncedAt;
+    const note = nonEmpty(record.note);
+    return {
+        providers,
+        native: nativeConfig(record.native),
+        protocols,
+        paths,
+        ...(typeof syncedAt === 'number' && Number.isFinite(syncedAt) ? { syncedAt } : {}),
+        ...(note === undefined ? {} : { note }),
+    };
+}
+/**
+ * The user's own config.toml as the adapter last read it. `null` when the
+ * adapter said nothing; otherwise an object carrying whichever halves were
+ * named (an empty one is still news — the panel says the file names nothing).
+ */
+function nativeConfig(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return null;
+    const record = raw;
+    const providerId = nonEmpty(record.providerId);
+    const model = nonEmpty(record.model);
+    return {
+        ...(providerId === undefined ? {} : { providerId }),
+        ...(model === undefined ? {} : { model }),
+    };
+}

package/superd-hub/dist/client/roster.js

@@ -25,6 +25,12 @@ const FALLBACK_LABELS = {
     pi: 'Pi',
     hermes: 'Hermes',
     agy: 'Antigravity',
+    // The opt-in SDK halves carry their own keys so a host that reports only keys
+    // still renders a distinguishable label (the composite rows are `disabled: true`
+    // by default, so these appear only once an operator turns one on).
+    'omp-sdk': 'OMP (SDK)',
+    'agy-sdk': 'Antigravity (SDK)',
+    'codex-sdk': 'Codex (SDK)',
 };
 /** Coerce a wire `agents` array into links; undefined when unusable/empty. */
 function coerceAgents(raw) {

package/superd-hub/dist/client/runtime-settings-api.d.ts

@@ -0,0 +1,76 @@
+/**
+ * runtime-settings-api.ts — the browser half of a runtime's settings panel.
+ *
+ * The panel's config belongs to the ADAPTER, so nothing here knows what an auth
+ * method is: it posts a `client-request` envelope at the runtime's own world and
+ * hands the adapter's answer to `parseAuthView` (agent-settings.ts).
+ *
+ *    POST /hub/api?agent=agy
+ *    { type:'client-request', rpcId, method:'agyAuth/get'|'agyAuth/set',
+ *      payload:{ args: {} | { request: { mode } } } }
+ *
+ * `/hub/api` is the hub family's prefix mount (`hub-route.ts`), which forwards
+ * `method` verbatim to the addressed world's `typertGateway`. The path needs no
+ * `CONTROL` exemption in fusion-transport.ts: the rewrite only touches same-origin
+ * `/api/...` paths, and `/hub/...` is never one of them.
+ *
+ * Node-safe: no DOM reach at module scope and `fetch` is injectable, so
+ * test/client-runtime-settings.test.mjs pins the envelope and every failure
+ * branch under `node --test` (the mesh-api.ts precedent).
+ *
+ * @module superd-hub/client/runtime-settings-api
+ */
+import { type RuntimeAuthView, type RuntimeProvidersView } from './agent-settings.js';
+/** Structural slice of `fetch` — the bundle uses the global, tests inject a stub. */
+export type FetchLike = (input: string, init: RequestInit) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+}>;
+/** One rpcId for request/response correlation. `randomUUID` needs a secure context. */
+export declare function mintRpcId(): string;
+/** The wire body of one unary call. */
+export interface ClientRequestEnvelope {
+    type: 'client-request';
+    rpcId: string;
+    method: string;
+    payload: {
+        args: Record<string, unknown>;
+    };
+}
+/** Build the envelope for one panel call (exported so tests pin the exact wire shape). */
+/** The operation names the adapter Remotes accept (auth ladder + providers). */
+export type RuntimeSettingsOp = 'get' | 'set' | 'save' | 'remove';
+export declare function settingsEnvelope(namespace: string, op: RuntimeSettingsOp, args: Record<string, unknown>): ClientRequestEnvelope;
+/** What a caller can do with a failed panel call — kept structural for the tests. */
+declare function messageOf(error: unknown): string;
+/**
+ * One unary call at a runtime's world, unwrapped to the RPC's value.
+ *
+ * Every failure mode is reported as a thrown `Error` carrying the adapter's own
+ * message where one exists: a transport failure, a malformed answer, and the
+ * gateway's business error (`{ok:false,error}`) must not look alike to the panel.
+ *
+ * @param agentKey - roster key addressing the world (`?agent=`).
+ * @param namespace - the adapter's Remote namespace (`agyAuth`).
+ * @param op - the Remote method.
+ * @param args - exact named wire arguments.
+ * @param doFetch - fetch implementation (tests inject).
+ * @returns the raw RPC value.
+ * @throws {Error} on transport, framing, or gateway failure.
+ */
+export declare function callRuntimeSettings(agentKey: string, namespace: string, op: RuntimeSettingsOp, args: Record<string, unknown>, doFetch?: FetchLike): Promise<unknown>;
+/** Read one runtime's panel state, parsed. */
+export declare function fetchAuthView(agentKey: string, namespace: string, doFetch?: FetchLike): Promise<RuntimeAuthView>;
+/** Adopt one auth form (`null` clears the explicit choice). */
+export declare function setAuthMode(agentKey: string, namespace: string, mode: string | null, doFetch?: FetchLike): Promise<RuntimeAuthView>;
+/** Read the multi-provider state of one runtime. */
+export declare function fetchProvidersView(agentKey: string, namespace: string, doFetch?: FetchLike): Promise<RuntimeProvidersView>;
+/**
+ * Add or edit one provider in the adapter's list. Which provider a session runs
+ * on is DSH's own per-session model selection, so this touches no active half.
+ */
+export declare function saveProvider(agentKey: string, namespace: string, provider: unknown, doFetch?: FetchLike): Promise<RuntimeProvidersView>;
+/** Drop one provider from the list. Does not rewrite the runtime's own config. */
+export declare function removeProvider(agentKey: string, namespace: string, id: string, doFetch?: FetchLike): Promise<RuntimeProvidersView>;
+export { messageOf as settingsErrorText };