super-dsh 0.3.0-c → 0.3.0-e

package/README.md

@@ -24,28 +24,31 @@ DSH home is created under `<DSH_HOME>/agents/<label>/` on first boot.
 
 ## Better Dash delivery and native Web defaults
 
-The release embeds [Better Dash](../better-dsh/) and Pi's prebuilt SDK dependency tree.
-Every `scripts/pack.mjs` invocation first builds the current same-repository
-`../better-dsh` and packs it with the same npm approach, then embeds that
-artifact using `bundledDependencies`. Missing source or an exact version mismatch
-fails the build; Better Dash is never fetched from a registry during this step.
-The pack verifies every embedded file against the independent Better Dash tarball.
-
-Install Super Dash alone: on first startup its delivery component registers the
-exact enclosed Better Dash tarball through the installed harness's native package
-operation. The native Plugin Manager then shows **Super Dash** and **Better Dash**
-as parallel installed bundles. Their switches are independent: Better alone keeps
-native tools; Super alone keeps Hub/A2A and foreign agents. dev WebMCP stays separate.
-Super never includes Better's YAML in its own bundle patch.
-
-The archive is cached in the current DSH home's `bundle-artifacts/` directory, so
-Better remains reinstallable after Super is removed. An update preserves a retained
-Better disablement; replacing an already installed package requires a DSH restart.
-When both bundles are disabled, companion updates wait until either is enabled.
-Explicitly uninstalling Better is respected for the same Super artifact.
-Both source directories share one repository, and Better Dash remains separately
-installable with the same version, currently **0.3.0-a**. Pi's bundled dependencies
-require no installation-script approval from the consumer.
+Super Dash declares [Better Dash](../better-dsh/) at the synchronized exact
+version in ordinary npm `dependencies`; it contains no Better files or archive.
+One `npm install super-dsh@<version>` or native Plugin Manager installation
+resolves both packages from the configured registry. Publish Better first, then
+Super. Pi's prebuilt SDK dependency tree retains its separate bundled delivery.
+
+DSH does not recursively expose transitive bundles. On startup the coordinator
+registers the already downloaded exact Better version using native profile
+package operations **offline**, without installation hooks or another registry
+fetch. This automatic local registration is separate from the user's single
+installation command. Missing cached data reports a failure instead of falling
+back to online fetching. Replacing loaded code or promoting loaded provenance
+requires the documented cold restart.
+
+The Plugin Manager shows both packages as parallel installed bundles with their
+own YAML and independent switches. Better's Code source is `better-dsh@<version>`.
+Updates retain disablement and same-version explicit uninstall; removing Super
+retains the directly registered Better. Old `bundle-artifacts/` caches are left
+intact for previous installations, but new releases do not write them. With Super
+disabled, registration waits until Super is enabled. dev WebMCP is
+separate and test-only.
+
+Both packages use the same local dual-build pipeline. Tests serve the exact
+unpublished artifact pair through a read-only local registry, without modifying
+the release manifest or preinstalling Better. Current iteration: **0.3.0-f**.
 
 For a tarball URL installation in the native Web UI, put the `.tgz` URL in the
 main Add plugin input and keep the separate Registry selection on the official

package/client/index.js

@@ -331,7 +331,7 @@ function RuntimeMark({ runtimeId, agentKey, size }) {
 function statusColor(status) {
 	if (status === "reachable") return "var(--dsw-alias-state-success-primary)";
 	if (status === "auth-expired") return "var(--dsw-alias-state-error-primary)";
-	if (status === "unreachable") return "var(--dsw-alias-state-warn-primary)";
+	if (status === "unreachable") return "var(--dsw-alias-label-caption)";
 	return "var(--dsw-alias-label-caption)";
 }
 /** The word the icon replaces — tooltip and accessibility text. */
@@ -614,7 +614,8 @@ async function addMachine(input) {
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
 			name: input.name,
-			tokenUrl: input.tokenUrl
+			tokenUrl: input.tokenUrl,
+			...pageOrigin() === "" ? {} : { origin: pageOrigin() }
 		})
 	});
 	if (!response.ok) throw new Error(await errorText(response));
@@ -623,9 +624,21 @@ async function addMachine(input) {
 	const raw = body.mutual;
 	return { mutual: {
 		ok: raw.ok === true,
+		...raw.skipped === "self" || raw.skipped === "already-paired" ? { skipped: raw.skipped } : {},
 		...typeof raw.error === "string" && raw.error !== "" ? { error: raw.error } : {}
 	} };
 }
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+function pageOrigin() {
+	if (typeof location === "undefined") return "";
+	if (location.origin !== "null" && location.origin !== "") return location.origin;
+	try {
+		const url = new URL(location.href);
+		return url.protocol + "//" + url.host;
+	} catch {
+		return "";
+	}
+}
 /**
 * DELETE one remote row by id (`{removed: boolean}` answers even for
 * unknown ids — a false removal is a reload, not an error).
@@ -671,7 +684,7 @@ const AUTO_REFRESH_NOTE = "auto-refreshes every 5 min";
 * face's public `authenticatedUrl` — this client never sees the raw token
 * anywhere else.
 *
-* @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+* @param origin - the page's own host address, including a desktop scheme.
 * @returns the tokenized pairing URL.
 * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
 */
@@ -692,9 +705,9 @@ async function fetchPairingUrl(origin) {
 }
 /**
 * Client-side pre-check before a pairing submit: a parseable absolute
-* http(s) URL carrying a non-empty `token` query param. The server re-parses
+* host-bearing URL carrying a non-empty `token` query param. The server re-parses
 * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
-* dead drafts off the wire.
+* malformed drafts off the wire.
 *
 * @param input - the raw token-URL draft (trim before calling).
 * @returns whether the draft is submit-shaped.
@@ -707,7 +720,7 @@ function validTokenUrl(input) {
 	} catch {
 		return false;
 	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.host === "") return false;
 	const token = url.searchParams.get("token");
 	return token !== null && token !== "";
 }
@@ -3143,7 +3156,7 @@ function HubPage() {
 		});
 	}, [fusion]);
 	const here = currentMountPath();
-	const hereOrigin = typeof location === "undefined" ? "" : location.origin;
+	const hereOrigin = pageOrigin();
 	const isActive = (agent) => hubRowActive({
 		fusion,
 		agentKey: agent.key,
@@ -3254,8 +3267,9 @@ function HubPage() {
 			setShowAdd(false);
 			setMeshError(null);
 			reloadMachines();
-			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}, but the mutual half failed (${out.mutual.error}) — add this machine from the peer manually.`);
-			else showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}; reverse connection unavailable.`);
+			else if (out.mutual?.ok && out.mutual.skipped !== "self") showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			else showSuperdToast(`Super D: paired with ${name}.`, { tone: "success" });
 		}).catch((err) => {
 			setMeshError(errText(err));
 		}).finally(() => {
@@ -3282,7 +3296,7 @@ function HubPage() {
 	*  GET), one clipboard write, the outcome on the shared toast. */
 	const copyPairingUrl = () => {
 		if (pairingBusy) return;
-		const origin = typeof location === "undefined" ? "" : location.origin;
+		const origin = pageOrigin();
 		if (origin === "") return;
 		setPairingBusy(true);
 		fetchPairingUrl(origin).then((url) => (0, __deepseek_ai_dsh_client_ui_primitives.writeClipboard)(url)).then((copied) => {
@@ -3463,7 +3477,7 @@ function HubPage() {
 								color: "var(--dsw-alias-label-tertiary)"
 							},
 							children: [
-								"Add another DSH from remote machines, provide the token URL. Pairing is mutual — the peer adds this machine back automatically. Status ",
+								"Add another DSH with its token URL. The peer attempts to connect back. Status ",
 								AUTO_REFRESH_NOTE,
 								"."
 							]

package/cordis.patch.yml

@@ -12,8 +12,8 @@
 #                              zero-port sibling root, mounted under /<label>
 #   - super-dsh/join           the generic hub joiner for the standalone
 #                              claude adapter (R2)
-# DSH-only WebTrust, WebServer and onboarding policies belong to the bundled
-# Better Dash package, registered as an independent profile bundle.
+# DSH-only WebTrust, WebServer and onboarding policies belong to the exact registry
+# Better Dash dependency, registered as an independent profile bundle.
 #   - super-dsh/a2a            the agent-facing A2A tool face (mesh P3): the
 #                              single `superd-hub` model tool on ctx0's tools
 #                              service (dormant without tools; world trees
@@ -22,7 +22,7 @@
 # Profile-layer values (webserver port/host, settings path) stay in the USER's
 # profile patch layer, never here.
 - insert:
-    # Register the bundled local companion as an independent native bundle.
+    # Register the already installed exact registry companion as an independent native bundle.
     - id: superd-bundle-setup
       name: 'super-dsh/setup'
     # BARE package row: subpath rows (…/agents/omp) are permanently not client

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.0-c",
+  "version": "0.3.0-e",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
@@ -69,7 +69,7 @@
     "agent-agy-sdk/package.json",
     "agent-agy-sdk/cordis.patch.yml",
     "agent-agy-sdk/bridge",
-    "bundles"
+    "superd-hub/scripts/register-companion.mjs"
   ],
   "dsh": {
     "bundle": {
@@ -83,7 +83,7 @@
     }
   },
   "dependencies": {
-    "better-dsh": "0.3.0-c",
+    "better-dsh": "0.3.0-e",
     "@earendil-works/pi-coding-agent": "0.84.2",
     "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"
@@ -104,7 +104,11 @@
     "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-user-approval": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-user-questions": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0"
+    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-app-boot": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-cmdline": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-plugin-manager": ">=0.1.5-0 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -154,20 +158,28 @@
     },
     "@deepseek-ai/dsh-client-connection": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-app-boot": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-atomic-write": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-cmdline": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-plugin-manager": {
+      "optional": true
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "bundledDependencies": [
-    "better-dsh",
     "@earendil-works/pi-coding-agent"
   ],
   "homepage": "https://github.com/pgmi-builds/super-dsh",
   "bugs": {
     "url": "https://github.com/pgmi-builds/super-dsh/issues"
-  },
-  "superd": {
-    "delivery": "./bundles/manifest.json"
   }
 }

package/superd-hub/dist/bundle-setup.d.ts

@@ -1,2 +1,17 @@
-/** Delivery only: reuse the exact locally bundled Better implementation. */
-export { default } from '../../node_modules/better-dsh/lib/bundle-delivery.js';
+import type { Context } from '@deepseek-ai/cordis';
+import type { ProfileContext } from '@deepseek-ai/dsh-app-boot';
+export declare const name = "superd-bundle-setup";
+export declare const inject: string[];
+interface DeliveryResult {
+    installed: string[];
+    restartRequired: boolean;
+}
+/** First registration enables a companion; native reconciliation preserves retained disablement. */
+export declare function reconcileRegistryCompanions(profile: ProfileContext, signal?: AbortSignal): Promise<DeliveryResult>;
+export declare function apply(ctx: Context): void;
+declare const _default: {
+    name: string;
+    inject: string[];
+    apply: typeof apply;
+};
+export default _default;

package/superd-hub/dist/bundle-setup.js

@@ -1,2 +1,158 @@
-/** Delivery only: reuse the exact locally bundled Better implementation. */
-export { default } from '../../node_modules/better-dsh/lib/bundle-delivery.js';
+/** Register pack companions through the installed harness's native package operations. */
+import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { readFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+import * as AppBoot from '@deepseek-ai/dsh-app-boot';
+export const name = 'superd-bundle-setup';
+export const inject = ['profileContext', 'appReady'];
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+// Refresh-capable hosts retain loaded package provenance: promoting the
+// companion from its containing pack to a direct dependency needs a restart.
+// Older hosts without this API keep their first-registration behavior.
+const nativePackages = AppBoot.PluginPackages?.prototype;
+const restartForPromotion = nativePackages !== undefined && typeof Reflect.get(nativePackages, 'refresh') === 'function';
+const json = async (path) => JSON.parse(await readFile(path, 'utf8'));
+async function optionalJson(path) {
+    try {
+        return await json(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+/** A child process avoids inheriting a running HMR transaction's AsyncLocalStorage. */
+async function installNative(profile, expected, signal) {
+    signal?.throwIfAborted();
+    const childScript = fileURLToPath(new URL('../scripts/register-companion.mjs', import.meta.url));
+    return new Promise((done, fail) => {
+        const child = spawn(process.execPath, [childScript], { stdio: ['pipe', 'pipe', 'pipe'], cwd: profile.dir });
+        let output = '', diagnostic = '';
+        const abort = () => { child.kill('SIGTERM'); };
+        const timeout = setTimeout(abort, 360_000);
+        signal?.addEventListener('abort', abort, { once: true });
+        child.stdout.setEncoding('utf8').on('data', chunk => { output = (output + chunk).slice(-32768); });
+        child.stderr.setEncoding('utf8').on('data', chunk => { diagnostic = (diagnostic + chunk).slice(-4096); });
+        child.on('error', fail);
+        child.on('close', code => {
+            clearTimeout(timeout);
+            signal?.removeEventListener('abort', abort);
+            if (signal?.aborted) {
+                fail(signal.reason);
+                return;
+            }
+            if (code !== 0) {
+                fail(new Error(`Native companion registration failed (${code}): ${diagnostic.trim() || output.trim()}`));
+                return;
+            }
+            try {
+                const result = JSON.parse(output);
+                if (result.exitCode !== 0)
+                    fail(new Error(`Native companion registration failed (${result.exitCode}); diagnostics: ${result.logPath ?? 'unavailable'}`));
+                else if (!['installed', 'owner-changed', 'companion-changed', 'companion-removed'].includes(result.disposition))
+                    fail(new Error('Native companion registration returned an invalid disposition'));
+                else
+                    done(result.disposition);
+            }
+            catch (error) {
+                fail(error);
+            }
+        });
+        child.stdin.on('error', () => { });
+        child.stdin.end(JSON.stringify({ profile, expected }));
+    });
+}
+/** First registration enables a companion; native reconciliation preserves retained disablement. */
+export async function reconcileRegistryCompanions(profile, signal) {
+    const directory = join(profile.home, 'companion-registration');
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const key = hash(profile.dir);
+    return withFileLock(join(directory, key + '.delivery'), async () => {
+        signal?.throwIfAborted();
+        const receiptPath = join(directory, key + '.json');
+        const receipts = await optionalJson(receiptPath) ?? {};
+        const manifest = await json(join(profile.dir, 'package.json'));
+        const result = { installed: [], restartRequired: false };
+        for (const owner of Object.keys(manifest.dependencies ?? {})) {
+            const ownerDir = join(profile.dir, 'node_modules', owner);
+            const ownerManifest = await optionalJson(join(ownerDir, 'package.json'));
+            if (owner !== 'super-dsh' || ownerManifest?.name !== owner)
+                continue;
+            const version = ownerManifest.dependencies?.['better-dsh'];
+            if (version === undefined || version !== ownerManifest.version)
+                throw new Error('Super Dash requires its synchronized exact Better registry dependency');
+            const item = { name: 'better-dsh', version };
+            const current = await json(join(profile.dir, 'package.json'));
+            const ownerSpec = current.dependencies?.[owner];
+            if (ownerSpec === undefined)
+                continue;
+            const priorSpec = current.dependencies?.[item.name];
+            const receiptKey = `${owner}:${item.name}`;
+            if (priorSpec === undefined && receipts[receiptKey] === version)
+                continue; // same-version explicit removal
+            const installed = await optionalJson(join(profile.dir, 'node_modules', item.name, 'package.json'));
+            if (priorSpec === version && installed?.name === item.name && installed.version === version) {
+                receipts[receiptKey] = version;
+                await writeFileAtomic(receiptPath, JSON.stringify(receipts) + '\n', { mode: 0o600 });
+                continue;
+            }
+            signal?.throwIfAborted();
+            const disposition = await installNative(profile, { owner, ownerSpec, companion: item, ...priorSpec === undefined ? {} : { priorSpec } }, signal);
+            if (disposition === 'owner-changed' || disposition === 'companion-changed')
+                continue;
+            receipts[receiptKey] = version;
+            await writeFileAtomic(receiptPath, JSON.stringify(receipts) + '\n', { mode: 0o600 });
+            if (disposition === 'companion-removed')
+                continue;
+            result.installed.push(`${item.name}@${item.version}`);
+            result.restartRequired ||= priorSpec !== undefined || restartForPromotion;
+        }
+        return result;
+    }, { waitMs: 120000 });
+}
+export function apply(ctx) {
+    const signal = new AbortController();
+    let started = false, running = false, again = false;
+    const reconcile = async () => {
+        if (!started || signal.signal.aborted)
+            return;
+        if (running) {
+            again = true;
+            return;
+        }
+        running = true;
+        try {
+            const result = await reconcileRegistryCompanions(ctx.profileContext, signal.signal);
+            if (result.installed.length) {
+                ctx.logger.info(`Registered ${result.installed.join(', ')} from its installed exact registry dependency${result.restartRequired ? '; restart DSH to use the updated code' : ''}`);
+                ctx.emit('plugin-manager/changed', { reason: 'install' });
+            }
+        }
+        catch (error) {
+            if (!signal.signal.aborted)
+                ctx.logger.error('Offline registry companion registration failed; retry the Super installation before re-enabling the bundle', error);
+        }
+        finally {
+            running = false;
+            if (again && !signal.signal.aborted) {
+                again = false;
+                void reconcile();
+            }
+        }
+    };
+    ctx.effect(() => {
+        const offReady = ctx.appReady.onReady(() => { started = true; void reconcile(); });
+        const offChange = ctx.on('plugin-manager/changed', () => { void reconcile(); });
+        return () => {
+            offReady();
+            offChange();
+            signal.abort();
+            // Never await a child here: manager HMR may be holding the profile lock it needs.
+        };
+    }, 'bundle-delivery: native registration');
+}
+export default { name, inject, apply };

package/superd-hub/dist/client/mesh-api.d.ts

@@ -87,6 +87,7 @@ export declare function fetchMachines(): Promise<MeshList>;
  *  pairing itself succeeded either way and the row is in). */
 export interface MutualPairingOutcome {
     readonly ok: boolean;
+    readonly skipped?: 'self' | 'already-paired';
     readonly error?: string;
 }
 /**
@@ -100,6 +101,8 @@ export interface MutualPairingOutcome {
 export declare function addMachine(input: AddMachineInput): Promise<{
     mutual?: MutualPairingOutcome;
 }>;
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+export declare function pageOrigin(): string;
 /**
  * DELETE one remote row by id (`{removed: boolean}` answers even for
  * unknown ids — a false removal is a reload, not an error).
@@ -128,16 +131,16 @@ export declare const AUTO_REFRESH_NOTE = "auto-refreshes every 5 min";
  * face's public `authenticatedUrl` — this client never sees the raw token
  * anywhere else.
  *
- * @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+ * @param origin - the page's own host address, including a desktop scheme.
  * @returns the tokenized pairing URL.
  * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
  */
 export declare function fetchPairingUrl(origin: string): Promise<string>;
 /**
  * Client-side pre-check before a pairing submit: a parseable absolute
- * http(s) URL carrying a non-empty `token` query param. The server re-parses
+ * host-bearing URL carrying a non-empty `token` query param. The server re-parses
  * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
- * dead drafts off the wire.
+ * malformed drafts off the wire.
  *
  * @param input - the raw token-URL draft (trim before calling).
  * @returns whether the draft is submit-shaped.

package/superd-hub/dist/client/mesh-api.js

@@ -128,7 +128,7 @@ export async function addMachine(input) {
         credentials: 'same-origin',
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ name: input.name, tokenUrl: input.tokenUrl }),
+        body: JSON.stringify({ name: input.name, tokenUrl: input.tokenUrl, ...(pageOrigin() === '' ? {} : { origin: pageOrigin() }) }),
     });
     if (!response.ok)
         throw new Error(await errorText(response));
@@ -139,10 +139,25 @@ export async function addMachine(input) {
     return {
         mutual: {
             ok: raw.ok === true,
+            ...(raw.skipped === 'self' || raw.skipped === 'already-paired' ? { skipped: raw.skipped } : {}),
             ...(typeof raw.error === 'string' && raw.error !== '' ? { error: raw.error } : {}),
         },
     };
 }
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+export function pageOrigin() {
+    if (typeof location === 'undefined')
+        return '';
+    if (location.origin !== 'null' && location.origin !== '')
+        return location.origin;
+    try {
+        const url = new URL(location.href);
+        return url.protocol + '//' + url.host;
+    }
+    catch {
+        return '';
+    }
+}
 /**
  * DELETE one remote row by id (`{removed: boolean}` answers even for
  * unknown ids — a false removal is a reload, not an error).
@@ -187,7 +202,7 @@ export const AUTO_REFRESH_NOTE = 'auto-refreshes every 5 min';
  * face's public `authenticatedUrl` — this client never sees the raw token
  * anywhere else.
  *
- * @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+ * @param origin - the page's own host address, including a desktop scheme.
  * @returns the tokenized pairing URL.
  * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
  */
@@ -208,9 +223,9 @@ export async function fetchPairingUrl(origin) {
 }
 /**
  * Client-side pre-check before a pairing submit: a parseable absolute
- * http(s) URL carrying a non-empty `token` query param. The server re-parses
+ * host-bearing URL carrying a non-empty `token` query param. The server re-parses
  * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
- * dead drafts off the wire.
+ * malformed drafts off the wire.
  *
  * @param input - the raw token-URL draft (trim before calling).
  * @returns whether the draft is submit-shaped.
@@ -225,7 +240,7 @@ export function validTokenUrl(input) {
     catch {
         return false;
     }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+    if (url.host === '')
         return false;
     const token = url.searchParams.get('token');
     return token !== null && token !== '';

package/superd-hub/dist/fusion-transport.js

@@ -106,13 +106,22 @@ try {
   const CONTROL_PREFIX = '/api/superd'
   const origin = () => {
     const loc = g.location
+    if (g.document !== undefined && typeof g.document.baseURI === 'string') return g.document.baseURI
+    if (loc !== undefined && typeof loc.href === 'string') return loc.href
     if (loc !== undefined && typeof loc.origin === 'string' && loc.origin !== 'null') return loc.origin
     return 'http://dsh.internal'
   }
-  // Same authority as the page (scheme-agnostic: ws/wss/http/https share host).
+  // The document and the shell-declared stream carrier can name different
+  // authorities. Read both at call time; never infer a carrier from localhost.
   const sameAuthority = (url) => {
     try {
-      return url.host === new URL(origin()).host
+      if (url.host === new URL(origin()).host) return true
+      const base = g.__DSH_TRANSPORT__ && g.__DSH_TRANSPORT__.streamBaseUrl
+      if (typeof base !== 'string') return false
+      const carrier = new URL(base)
+      return (carrier.protocol === 'http:' || carrier.protocol === 'https:')
+        && (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'ws:' || url.protocol === 'wss:')
+        && url.host === carrier.host
     } catch {
       return false
     }
@@ -169,7 +178,9 @@ try {
       const url = new URL(s, origin())
       if (!sameAuthority(url)) return s
       const next = retarget(url.pathname, url.search, url.hash)
-      return next === null ? s : url.origin + next
+      // WHATWG URL.origin is 'null' for custom schemes such as dsh-app.
+      // Preserve that scheme/authority instead of manufacturing an HTTP URL.
+      return next === null ? s : url.protocol + '//' + url.host + next
     } catch {
       return s
     }

package/superd-hub/dist/gateway.js

@@ -1,6 +1,7 @@
 import z from '@deepseek-ai/schemastery';
 import { registerSelectorRpc, registryTargets } from './rpc.js';
 import { registerMeshRpc } from './mesh-rpc.js';
+import { registerPairingAuth } from './pairing-auth.js';
 import { startReprobeSweep } from './mesh-link.js';
 import { federatedGatewayOf, startMeshFederation } from './mesh-federate.js';
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
@@ -59,6 +60,7 @@ export function apply(ctx, config) {
         const real = host.get('webServer');
         if (real instanceof WorldWebServer)
             return;
+        registerPairingAuth(host);
         const connection = host.get('connection');
         // The gate is ctx0's authorize source (connection.authorizeIndex); the
         // addressed world resolves per request through the live foreign-target

package/superd-hub/dist/machines.d.ts

@@ -15,6 +15,8 @@ export interface MachineRow {
     token?: string;
     /** Last minted request cookie (spec §4): persisted so hub restarts keep the remote's 30-day session instead of forcing a re-mint on every boot. */
     cookie?: string;
+    /** Received a reciprocal offer; without a verified cookie this is an incoming-only row. */
+    incoming?: boolean;
     enabled: boolean;
     /** P4 exec knob on the INITIATOR side (spec §5): undefined/true = this machine's agents may exec there; false = the tool leg refuses. */
     execEnabled?: boolean;

package/superd-hub/dist/machines.js

@@ -29,6 +29,7 @@ function isMachineRow(v) {
         typeof r.origin === 'string' && r.origin !== '' && typeof r.enabled === 'boolean' && typeof r.addedAt === 'number' &&
         (r.token === undefined || typeof r.token === 'string') &&
         (r.cookie === undefined || typeof r.cookie === 'string') &&
+        (r.incoming === undefined || typeof r.incoming === 'boolean') &&
         (r.execEnabled === undefined || r.execEnabled === true || r.execEnabled === false));
 }
 /** Mint a random short id over [a-z0-9], re-minting on collision with `taken`; loud after 32 attempts. */
@@ -80,6 +81,7 @@ export function loadMachines(home) {
             addedAt: r.addedAt,
             ...(r.token === undefined ? {} : { token: r.token }),
             ...(r.cookie === undefined ? {} : { cookie: r.cookie }),
+            ...(r.incoming === undefined ? {} : { incoming: r.incoming }),
             ...(r.execEnabled === undefined ? {} : { execEnabled: r.execEnabled }),
         })) };
 }

package/superd-hub/dist/mesh-link.d.ts

@@ -72,10 +72,10 @@ export interface MutualPairing {
     /** This machine's operator-facing name (hostname, port-qualified per instance). */
     selfName: string;
 }
-/** The reverse leg's outcome. `ok` is also true when the peer answered
- *  duplicate-machine-id — it already holds us, so mutual already holds. */
+/** The peer's explicitly confirmed reverse-leg outcome. */
 export interface MutualOutcome {
     ok: boolean;
+    skipped?: 'self' | 'already-paired';
     /** Why the offer failed; absent on success. The pairing itself never fails with it. */
     error?: string;
 }
@@ -204,6 +204,14 @@ export declare function pairMachine(home: string, input: {
     tokenUrl: string;
     mutual?: MutualPairing;
 }, deps?: LinkDeps): Promise<PairOutcome>;
+/** Incoming offers name identity before dialing; address format is not reachability evidence. */
+export declare function receivePairing(home: string, input: {
+    machineId: string;
+    name: string;
+    tokenUrl: string;
+}, deps?: LinkDeps): Promise<MutualOutcome & {
+    row?: MachineRow;
+}>;
 /**
  * Re-probe a paired machine: the jar's cookie, falling back to the cookie
  * persisted on the row (cold jar after a hub restart), rides the probe. On