super-dsh 0.3.0-d → 0.3.0-e

package/client/index.js

@@ -331,7 +331,7 @@ function RuntimeMark({ runtimeId, agentKey, size }) {
 function statusColor(status) {
 	if (status === "reachable") return "var(--dsw-alias-state-success-primary)";
 	if (status === "auth-expired") return "var(--dsw-alias-state-error-primary)";
-	if (status === "unreachable") return "var(--dsw-alias-state-warn-primary)";
+	if (status === "unreachable") return "var(--dsw-alias-label-caption)";
 	return "var(--dsw-alias-label-caption)";
 }
 /** The word the icon replaces — tooltip and accessibility text. */
@@ -614,7 +614,8 @@ async function addMachine(input) {
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
 			name: input.name,
-			tokenUrl: input.tokenUrl
+			tokenUrl: input.tokenUrl,
+			...pageOrigin() === "" ? {} : { origin: pageOrigin() }
 		})
 	});
 	if (!response.ok) throw new Error(await errorText(response));
@@ -623,9 +624,21 @@ async function addMachine(input) {
 	const raw = body.mutual;
 	return { mutual: {
 		ok: raw.ok === true,
+		...raw.skipped === "self" || raw.skipped === "already-paired" ? { skipped: raw.skipped } : {},
 		...typeof raw.error === "string" && raw.error !== "" ? { error: raw.error } : {}
 	} };
 }
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+function pageOrigin() {
+	if (typeof location === "undefined") return "";
+	if (location.origin !== "null" && location.origin !== "") return location.origin;
+	try {
+		const url = new URL(location.href);
+		return url.protocol + "//" + url.host;
+	} catch {
+		return "";
+	}
+}
 /**
 * DELETE one remote row by id (`{removed: boolean}` answers even for
 * unknown ids — a false removal is a reload, not an error).
@@ -671,7 +684,7 @@ const AUTO_REFRESH_NOTE = "auto-refreshes every 5 min";
 * face's public `authenticatedUrl` — this client never sees the raw token
 * anywhere else.
 *
-* @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+* @param origin - the page's own host address, including a desktop scheme.
 * @returns the tokenized pairing URL.
 * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
 */
@@ -692,9 +705,9 @@ async function fetchPairingUrl(origin) {
 }
 /**
 * Client-side pre-check before a pairing submit: a parseable absolute
-* http(s) URL carrying a non-empty `token` query param. The server re-parses
+* host-bearing URL carrying a non-empty `token` query param. The server re-parses
 * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
-* dead drafts off the wire.
+* malformed drafts off the wire.
 *
 * @param input - the raw token-URL draft (trim before calling).
 * @returns whether the draft is submit-shaped.
@@ -707,7 +720,7 @@ function validTokenUrl(input) {
 	} catch {
 		return false;
 	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.host === "") return false;
 	const token = url.searchParams.get("token");
 	return token !== null && token !== "";
 }
@@ -3143,7 +3156,7 @@ function HubPage() {
 		});
 	}, [fusion]);
 	const here = currentMountPath();
-	const hereOrigin = typeof location === "undefined" ? "" : location.origin;
+	const hereOrigin = pageOrigin();
 	const isActive = (agent) => hubRowActive({
 		fusion,
 		agentKey: agent.key,
@@ -3254,8 +3267,9 @@ function HubPage() {
 			setShowAdd(false);
 			setMeshError(null);
 			reloadMachines();
-			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}, but the mutual half failed (${out.mutual.error}) — add this machine from the peer manually.`);
-			else showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}; reverse connection unavailable.`);
+			else if (out.mutual?.ok && out.mutual.skipped !== "self") showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			else showSuperdToast(`Super D: paired with ${name}.`, { tone: "success" });
 		}).catch((err) => {
 			setMeshError(errText(err));
 		}).finally(() => {
@@ -3282,7 +3296,7 @@ function HubPage() {
 	*  GET), one clipboard write, the outcome on the shared toast. */
 	const copyPairingUrl = () => {
 		if (pairingBusy) return;
-		const origin = typeof location === "undefined" ? "" : location.origin;
+		const origin = pageOrigin();
 		if (origin === "") return;
 		setPairingBusy(true);
 		fetchPairingUrl(origin).then((url) => (0, __deepseek_ai_dsh_client_ui_primitives.writeClipboard)(url)).then((copied) => {
@@ -3463,7 +3477,7 @@ function HubPage() {
 								color: "var(--dsw-alias-label-tertiary)"
 							},
 							children: [
-								"Add another DSH from remote machines, provide the token URL. Pairing is mutual — the peer adds this machine back automatically. Status ",
+								"Add another DSH with its token URL. The peer attempts to connect back. Status ",
 								AUTO_REFRESH_NOTE,
 								"."
 							]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.0-d",
+  "version": "0.3.0-e",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
@@ -83,7 +83,7 @@
     }
   },
   "dependencies": {
-    "better-dsh": "0.3.0-d",
+    "better-dsh": "0.3.0-e",
     "@earendil-works/pi-coding-agent": "0.84.2",
     "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"

package/superd-hub/dist/client/mesh-api.d.ts

@@ -87,6 +87,7 @@ export declare function fetchMachines(): Promise<MeshList>;
  *  pairing itself succeeded either way and the row is in). */
 export interface MutualPairingOutcome {
     readonly ok: boolean;
+    readonly skipped?: 'self' | 'already-paired';
     readonly error?: string;
 }
 /**
@@ -100,6 +101,8 @@ export interface MutualPairingOutcome {
 export declare function addMachine(input: AddMachineInput): Promise<{
     mutual?: MutualPairingOutcome;
 }>;
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+export declare function pageOrigin(): string;
 /**
  * DELETE one remote row by id (`{removed: boolean}` answers even for
  * unknown ids — a false removal is a reload, not an error).
@@ -128,16 +131,16 @@ export declare const AUTO_REFRESH_NOTE = "auto-refreshes every 5 min";
  * face's public `authenticatedUrl` — this client never sees the raw token
  * anywhere else.
  *
- * @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+ * @param origin - the page's own host address, including a desktop scheme.
  * @returns the tokenized pairing URL.
  * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
  */
 export declare function fetchPairingUrl(origin: string): Promise<string>;
 /**
  * Client-side pre-check before a pairing submit: a parseable absolute
- * http(s) URL carrying a non-empty `token` query param. The server re-parses
+ * host-bearing URL carrying a non-empty `token` query param. The server re-parses
  * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
- * dead drafts off the wire.
+ * malformed drafts off the wire.
  *
  * @param input - the raw token-URL draft (trim before calling).
  * @returns whether the draft is submit-shaped.

package/superd-hub/dist/client/mesh-api.js

@@ -128,7 +128,7 @@ export async function addMachine(input) {
         credentials: 'same-origin',
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ name: input.name, tokenUrl: input.tokenUrl }),
+        body: JSON.stringify({ name: input.name, tokenUrl: input.tokenUrl, ...(pageOrigin() === '' ? {} : { origin: pageOrigin() }) }),
     });
     if (!response.ok)
         throw new Error(await errorText(response));
@@ -139,10 +139,25 @@ export async function addMachine(input) {
     return {
         mutual: {
             ok: raw.ok === true,
+            ...(raw.skipped === 'self' || raw.skipped === 'already-paired' ? { skipped: raw.skipped } : {}),
             ...(typeof raw.error === 'string' && raw.error !== '' ? { error: raw.error } : {}),
         },
     };
 }
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+export function pageOrigin() {
+    if (typeof location === 'undefined')
+        return '';
+    if (location.origin !== 'null' && location.origin !== '')
+        return location.origin;
+    try {
+        const url = new URL(location.href);
+        return url.protocol + '//' + url.host;
+    }
+    catch {
+        return '';
+    }
+}
 /**
  * DELETE one remote row by id (`{removed: boolean}` answers even for
  * unknown ids — a false removal is a reload, not an error).
@@ -187,7 +202,7 @@ export const AUTO_REFRESH_NOTE = 'auto-refreshes every 5 min';
  * face's public `authenticatedUrl` — this client never sees the raw token
  * anywhere else.
  *
- * @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+ * @param origin - the page's own host address, including a desktop scheme.
  * @returns the tokenized pairing URL.
  * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
  */
@@ -208,9 +223,9 @@ export async function fetchPairingUrl(origin) {
 }
 /**
  * Client-side pre-check before a pairing submit: a parseable absolute
- * http(s) URL carrying a non-empty `token` query param. The server re-parses
+ * host-bearing URL carrying a non-empty `token` query param. The server re-parses
  * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
- * dead drafts off the wire.
+ * malformed drafts off the wire.
  *
  * @param input - the raw token-URL draft (trim before calling).
  * @returns whether the draft is submit-shaped.
@@ -225,7 +240,7 @@ export function validTokenUrl(input) {
     catch {
         return false;
     }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+    if (url.host === '')
         return false;
     const token = url.searchParams.get('token');
     return token !== null && token !== '';

package/superd-hub/dist/fusion-transport.js

@@ -106,13 +106,22 @@ try {
   const CONTROL_PREFIX = '/api/superd'
   const origin = () => {
     const loc = g.location
+    if (g.document !== undefined && typeof g.document.baseURI === 'string') return g.document.baseURI
+    if (loc !== undefined && typeof loc.href === 'string') return loc.href
     if (loc !== undefined && typeof loc.origin === 'string' && loc.origin !== 'null') return loc.origin
     return 'http://dsh.internal'
   }
-  // Same authority as the page (scheme-agnostic: ws/wss/http/https share host).
+  // The document and the shell-declared stream carrier can name different
+  // authorities. Read both at call time; never infer a carrier from localhost.
   const sameAuthority = (url) => {
     try {
-      return url.host === new URL(origin()).host
+      if (url.host === new URL(origin()).host) return true
+      const base = g.__DSH_TRANSPORT__ && g.__DSH_TRANSPORT__.streamBaseUrl
+      if (typeof base !== 'string') return false
+      const carrier = new URL(base)
+      return (carrier.protocol === 'http:' || carrier.protocol === 'https:')
+        && (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'ws:' || url.protocol === 'wss:')
+        && url.host === carrier.host
     } catch {
       return false
     }
@@ -169,7 +178,9 @@ try {
       const url = new URL(s, origin())
       if (!sameAuthority(url)) return s
       const next = retarget(url.pathname, url.search, url.hash)
-      return next === null ? s : url.origin + next
+      // WHATWG URL.origin is 'null' for custom schemes such as dsh-app.
+      // Preserve that scheme/authority instead of manufacturing an HTTP URL.
+      return next === null ? s : url.protocol + '//' + url.host + next
     } catch {
       return s
     }

package/superd-hub/dist/gateway.js

@@ -1,6 +1,7 @@
 import z from '@deepseek-ai/schemastery';
 import { registerSelectorRpc, registryTargets } from './rpc.js';
 import { registerMeshRpc } from './mesh-rpc.js';
+import { registerPairingAuth } from './pairing-auth.js';
 import { startReprobeSweep } from './mesh-link.js';
 import { federatedGatewayOf, startMeshFederation } from './mesh-federate.js';
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
@@ -59,6 +60,7 @@ export function apply(ctx, config) {
         const real = host.get('webServer');
         if (real instanceof WorldWebServer)
             return;
+        registerPairingAuth(host);
         const connection = host.get('connection');
         // The gate is ctx0's authorize source (connection.authorizeIndex); the
         // addressed world resolves per request through the live foreign-target

package/superd-hub/dist/machines.d.ts

@@ -15,6 +15,8 @@ export interface MachineRow {
     token?: string;
     /** Last minted request cookie (spec §4): persisted so hub restarts keep the remote's 30-day session instead of forcing a re-mint on every boot. */
     cookie?: string;
+    /** Received a reciprocal offer; without a verified cookie this is an incoming-only row. */
+    incoming?: boolean;
     enabled: boolean;
     /** P4 exec knob on the INITIATOR side (spec §5): undefined/true = this machine's agents may exec there; false = the tool leg refuses. */
     execEnabled?: boolean;

package/superd-hub/dist/machines.js

@@ -29,6 +29,7 @@ function isMachineRow(v) {
         typeof r.origin === 'string' && r.origin !== '' && typeof r.enabled === 'boolean' && typeof r.addedAt === 'number' &&
         (r.token === undefined || typeof r.token === 'string') &&
         (r.cookie === undefined || typeof r.cookie === 'string') &&
+        (r.incoming === undefined || typeof r.incoming === 'boolean') &&
         (r.execEnabled === undefined || r.execEnabled === true || r.execEnabled === false));
 }
 /** Mint a random short id over [a-z0-9], re-minting on collision with `taken`; loud after 32 attempts. */
@@ -80,6 +81,7 @@ export function loadMachines(home) {
             addedAt: r.addedAt,
             ...(r.token === undefined ? {} : { token: r.token }),
             ...(r.cookie === undefined ? {} : { cookie: r.cookie }),
+            ...(r.incoming === undefined ? {} : { incoming: r.incoming }),
             ...(r.execEnabled === undefined ? {} : { execEnabled: r.execEnabled }),
         })) };
 }

package/superd-hub/dist/mesh-link.d.ts

@@ -72,10 +72,10 @@ export interface MutualPairing {
     /** This machine's operator-facing name (hostname, port-qualified per instance). */
     selfName: string;
 }
-/** The reverse leg's outcome. `ok` is also true when the peer answered
- *  duplicate-machine-id — it already holds us, so mutual already holds. */
+/** The peer's explicitly confirmed reverse-leg outcome. */
 export interface MutualOutcome {
     ok: boolean;
+    skipped?: 'self' | 'already-paired';
     /** Why the offer failed; absent on success. The pairing itself never fails with it. */
     error?: string;
 }
@@ -204,6 +204,14 @@ export declare function pairMachine(home: string, input: {
     tokenUrl: string;
     mutual?: MutualPairing;
 }, deps?: LinkDeps): Promise<PairOutcome>;
+/** Incoming offers name identity before dialing; address format is not reachability evidence. */
+export declare function receivePairing(home: string, input: {
+    machineId: string;
+    name: string;
+    tokenUrl: string;
+}, deps?: LinkDeps): Promise<MutualOutcome & {
+    row?: MachineRow;
+}>;
 /**
  * Re-probe a paired machine: the jar's cookie, falling back to the cookie
  * persisted on the row (cold jar after a hub restart), rides the probe. On

package/superd-hub/dist/mesh-link.js

@@ -20,8 +20,9 @@
  * records a `versionWarning` on the status entry (diff major/minor or
  * unparsable → warn; patch-only drift → clean).
  */
-import { loadMachines, saveMachines, upsertRemote, listRemotes } from './machines.js';
+import { ensureSelf, loadMachines, saveMachines, upsertRemote, listRemotes } from './machines.js';
 import { PACK_VERSION } from './pack-version.js';
+import { PAIRING_AUTH_PATH } from './pairing-auth.js';
 /**
  * The `ours` side of the I2 comparison — the super-dsh PACK version (D6: the
  * hub subpackage's constant 0.1.0 made the comparator dead; the pack number
@@ -68,6 +69,9 @@ export function versionWarningFor(peer, ours) {
 const FETCH_TIMEOUT_MS = 10_000;
 /** <machineId, cookie> — in-process jar, a front for the persisted `MachineRow.cookie` (same value; write-through on every mint). */
 const cookieJar = new Map();
+/** Latest pairing/probe attempt owns status and federation updates. */
+const probeAttempts = new Map();
+const removalGenerations = new Map();
 const machineStatusTable = new Map();
 function errMsg(err) {
     return err instanceof Error ? err.message : String(err);
@@ -110,9 +114,20 @@ function firstCookiePair(raw) {
  * with the status/cause attached.
  */
 export async function mintCookie(origin, token, fetchImpl = globalThis.fetch) {
+    // Native peers exchange at /. Super peers also expose a dedicated route
+    // because Better Dash owns / for password login. Both use native auth.
+    const root = await exchangeCookie(origin, '/', token, fetchImpl);
+    if (root !== undefined)
+        return root;
+    const dedicated = await exchangeCookie(origin, PAIRING_AUTH_PATH, token, fetchImpl);
+    if (dedicated !== undefined)
+        return dedicated;
+    throw new Error(`mesh-link: token mint failed — no dsh-auth-* Set-Cookie in response from ${origin}`);
+}
+async function exchangeCookie(origin, path, token, fetchImpl) {
     let res;
     try {
-        res = await fetchImpl(`${origin}/?token=${encodeURIComponent(token)}`, {
+        res = await fetchImpl(`${origin}${path}?token=${encodeURIComponent(token)}`, {
             redirect: 'manual',
             signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
         });
@@ -120,6 +135,8 @@ export async function mintCookie(origin, token, fetchImpl = globalThis.fetch) {
     catch (err) {
         throw new Error(`mesh-link: token mint to ${origin} failed — ${errMsg(err)}`);
     }
+    if (path === PAIRING_AUTH_PATH && res.status === 404)
+        return undefined;
     if (res.status !== 303 && !(res.status >= 200 && res.status < 300)) {
         throw new Error(`mesh-link: token mint failed — unexpected status ${res.status} from ${origin}`);
     }
@@ -131,7 +148,7 @@ export async function mintCookie(origin, token, fetchImpl = globalThis.fetch) {
         if (pair !== null && pair.startsWith('dsh-auth-'))
             return pair;
     }
-    throw new Error(`mesh-link: token mint failed — no dsh-auth-* Set-Cookie in response (status ${res.status}) from ${origin}`);
+    return undefined;
 }
 function coerceAgent(v) {
     const a = (typeof v === 'object' && v !== null ? v : {});
@@ -203,6 +220,9 @@ export function machineStatus() {
 /** Test hook: drop all status entries. */
 export function resetMachineStatus() {
     machineStatusTable.clear();
+    cookieJar.clear();
+    probeAttempts.clear();
+    removalGenerations.clear();
 }
 const federationListeners = new Set();
 /** Subscribe to federation lifecycle events; returns an unsubscribe function. */
@@ -223,6 +243,10 @@ function emitFederation(event) {
  * mesh-link, the registrar subscribes at wiring time).
  */
 export function emitMachineRemoved(machineId) {
+    removalGenerations.set(machineId, (removalGenerations.get(machineId) ?? 0) + 1);
+    cookieJar.delete(machineId);
+    machineStatusTable.delete(machineId);
+    probeAttempts.set(machineId, Symbol());
     emitFederation({ type: 'defederated', machineId });
 }
 /**
@@ -233,12 +257,9 @@ export function emitMachineRemoved(machineId) {
  * in this process), else `''` (wire calls then simply omit the Cookie header).
  */
 export function cookieOf(machineId, home) {
-    const jarred = cookieJar.get(machineId);
-    if (jarred !== undefined)
-        return jarred;
-    if (home === undefined)
-        return '';
-    return listRemotes(home).find((r) => r.id === machineId)?.cookie ?? '';
+    if (home !== undefined)
+        return listRemotes(home).find((r) => r.id === machineId)?.cookie ?? '';
+    return cookieJar.get(machineId) ?? '';
 }
 /** Record one probe outcome; the I2 versionWarning (4th arg) lands only on
  *  reachable probes — every entry is written FRESH, so a re-probe against a
@@ -278,14 +299,19 @@ function persistRow(home, row, deps) {
 export async function pairMachine(home, input, deps) {
     const fetchImpl = deps?.fetchImpl ?? globalThis.fetch;
     const load = deps?.load ?? loadMachines;
+    const removalsAtStart = new Map(removalGenerations);
     const { origin, token } = parseTokenUrl(input.tokenUrl);
     const cookie = await mintCookie(origin, token, fetchImpl);
     const probe = await probeMachine(origin, cookie, fetchImpl);
     if (!probe.ok) {
         throw new Error(`mesh-link: pairing ${origin} failed — ${probe.status}: ${probe.error}`);
     }
+    if ((removalGenerations.get(probe.machineId) ?? 0) !== (removalsAtStart.get(probe.machineId) ?? 0)) {
+        throw new Error('mesh-link: machine removed during pairing');
+    }
     const file = load(home);
-    if (probe.machineId === file.self.id || file.remotes.some((r) => r.id === probe.machineId)) {
+    const prior = file.remotes.find((r) => r.id === probe.machineId);
+    if (probe.machineId === file.self.id || (prior !== undefined && !(prior.incoming && !prior.cookie))) {
         throw new Error(`mesh-link: duplicate-machine-id ${probe.machineId} — collides with self or an existing remote row; remove the stale row before re-pairing`);
     }
     const row = {
@@ -294,16 +320,19 @@ export async function pairMachine(home, input, deps) {
         origin,
         token,
         cookie,
-        enabled: true,
-        addedAt: Date.now(),
+        enabled: prior?.enabled ?? true,
+        addedAt: prior?.addedAt ?? Date.now(),
+        ...(prior?.incoming === undefined ? {} : { incoming: prior.incoming }),
+        ...(prior?.execEnabled === undefined ? {} : { execEnabled: prior.execEnabled }),
     };
     persistRow(home, row, deps);
+    probeAttempts.set(row.id, Symbol());
     cookieJar.set(row.id, cookie);
     recordStatus(row.id, 'reachable', undefined, versionWarningFor(probe.version, OWN_VERSION));
     emitFederation({ type: 'federated', machineId: row.id, machineName: row.name, origin, agents: probe.agents });
     const outcome = { machineId: row.id, row, probe };
     if (input.mutual !== undefined)
-        outcome.mutual = await reversePair(row, input.mutual, fetchImpl);
+        outcome.mutual = await reversePair(row, input.mutual, ensureSelf(home, 'local').id, fetchImpl);
     return outcome;
 }
 const REVERSE_TIMEOUT_MS = 10_000;
@@ -311,18 +340,18 @@ const REVERSE_TIMEOUT_MS = 10_000;
  * The mutual-pairing reverse leg: offer THIS machine's pairing input to the
  * just-paired peer over the cookie minted seconds ago (the peer then pairs
  * back without its own reverse leg — the offer carries `mutual: true`). A
- * duplicate-machine-id answer means the peer already holds us: mutual is
- * already satisfied, reported as ok. EVERY failure lands on the outcome and
+ * peer must explicitly confirm the reverse outcome or a reachable row with
+ * our UID. EVERY failure lands on the outcome and
  * never fails the pairing itself — the user sees it and can still add
  * manually from the peer.
  */
-async function reversePair(row, mutual, fetchImpl) {
+async function reversePair(row, mutual, machineId, fetchImpl) {
     let res;
     try {
         res = await fetchImpl(`${row.origin}/api/superd/machines`, {
             method: 'POST',
             headers: { cookie: row.cookie ?? '', 'content-type': 'application/json' },
-            body: JSON.stringify({ name: mutual.selfName, tokenUrl: mutual.selfTokenUrl, mutual: true }),
+            body: JSON.stringify({ name: mutual.selfName, tokenUrl: mutual.selfTokenUrl, machineId, mutual: true }),
             signal: AbortSignal.timeout(REVERSE_TIMEOUT_MS),
         });
     }
@@ -337,14 +366,64 @@ async function reversePair(row, mutual, fetchImpl) {
                 error = body.error;
         }
         catch { /* unreadable body */ }
-        if (error.includes('duplicate-machine-id'))
-            return { ok: true };
         return { ok: false, error: error === '' ? `the peer answered ${res.status}` : error };
     }
-    if (res.status >= 200 && res.status < 300)
-        return { ok: true };
+    if (res.status >= 200 && res.status < 300) {
+        const body = await res.json().catch(() => undefined);
+        const reciprocal = body?.reciprocal;
+        if (typeof reciprocal?.ok === 'boolean') {
+            return {
+                ok: reciprocal.ok,
+                ...(reciprocal.skipped === 'self' || reciprocal.skipped === 'already-paired' ? { skipped: reciprocal.skipped } : {}),
+                ...(typeof reciprocal.error === 'string' ? { error: reciprocal.error } : {}),
+            };
+        }
+        // Older peers confirm the paired identity through their public machine row.
+        if (body?.machine?.id === machineId && body.machine.status === 'reachable')
+            return { ok: true };
+        return { ok: false, error: 'the peer did not confirm a reverse connection' };
+    }
     return { ok: false, error: `the peer answered ${res.status}` };
 }
+/** Incoming offers name identity before dialing; address format is not reachability evidence. */
+export async function receivePairing(home, input, deps) {
+    const self = ensureSelf(home, 'local');
+    if (input.machineId === self.id)
+        return { ok: true, skipped: 'self' };
+    const load = deps?.load ?? loadMachines;
+    const existing = load(home).remotes.find((row) => row.id === input.machineId);
+    if (existing?.cookie) {
+        persistRow(home, { ...existing, incoming: true }, deps);
+        const probe = await reprobeMachine(home, existing.id, deps);
+        return {
+            ok: probe.ok, ...(probe.ok ? { skipped: 'already-paired' } : { error: probe.error }),
+            row: load(home).remotes.find((row) => row.id === existing.id),
+        };
+    }
+    let url;
+    try {
+        url = new URL(input.tokenUrl);
+    }
+    catch {
+        return { ok: false, error: 'mesh-link: invalid reciprocal URL' };
+    }
+    const origin = url.protocol + '//' + url.host;
+    const token = url.searchParams.get('token') ?? '';
+    const row = {
+        id: input.machineId, name: existing?.name ?? input.name, origin, token,
+        incoming: true, enabled: existing?.enabled ?? true, addedAt: existing?.addedAt ?? Date.now(),
+        ...(existing?.execEnabled === undefined ? {} : { execEnabled: existing.execEnabled }),
+    };
+    // Retain the identity even if the address cannot be dialed from this Host.
+    persistRow(home, row, deps);
+    recordStatus(row.id, 'unreachable', 'reciprocal connection has not been established');
+    const probe = await reprobeMachine(home, row.id, deps);
+    return {
+        ok: probe.ok,
+        row: load(home).remotes.find((current) => current.id === row.id),
+        ...(probe.ok ? {} : { error: probe.error }),
+    };
+}
 /**
  * Re-probe a paired machine: the jar's cookie, falling back to the cookie
  * persisted on the row (cold jar after a hub restart), rides the probe. On
@@ -361,23 +440,48 @@ export async function reprobeMachine(home, id, deps) {
         throw new Error(`mesh-link: unknown machine id "${id}" — no remote row in the registry`);
     }
     const origin = row.origin;
-    let cookie = cookieJar.get(id) ?? row.cookie ?? '';
-    let probe = await probeMachine(origin, cookie, fetchImpl);
-    if (!probe.ok && probe.status === 'auth-expired' && row.token) {
+    const attempt = Symbol();
+    probeAttempts.set(id, attempt);
+    let cookie = row.cookie ?? '';
+    let probe;
+    if (cookie === '' && row.token) {
+        try {
+            cookie = await mintCookie(origin, row.token, fetchImpl);
+            probe = await probeMachine(origin, cookie, fetchImpl);
+        }
+        catch (err) {
+            probe = { ok: false, status: 'unreachable', error: `connection failed — ${errMsg(err)}` };
+        }
+    }
+    else
+        probe = await probeMachine(origin, cookie, fetchImpl);
+    if (!probe.ok && probe.status === 'auth-expired' && row.token && cookie !== '') {
         try {
             cookie = await mintCookie(origin, row.token, fetchImpl);
-            cookieJar.set(id, cookie);
-            persistRow(home, { ...row, cookie }, deps);
             probe = await probeMachine(origin, cookie, fetchImpl);
         }
         catch (err) {
             probe = { ok: false, status: 'auth-expired', error: `re-mint failed — ${errMsg(err)}` };
         }
     }
+    if (probe.ok && probe.machineId !== id) {
+        probe = { ok: false, status: 'unreachable', error: 'peer Hub UID does not match the paired machine' };
+    }
+    if (probe.ok && row.incoming && cookie === '') {
+        probe = { ok: false, status: 'unreachable', error: 'reciprocal connection has no authenticated credentials' };
+    }
+    if (!probe.ok && row.incoming && !row.cookie) {
+        probe = { ...probe, status: 'unreachable' };
+    }
+    const current = (deps?.load ? deps.load(home).remotes : listRemotes(home)).find((r) => r.id === id);
+    if (probeAttempts.get(id) !== attempt || current === undefined || current.origin !== row.origin || current.token !== row.token || current.cookie !== row.cookie || current.addedAt !== row.addedAt) {
+        return { ok: false, status: 'unreachable', error: 'pairing changed during probe' };
+    }
     if (probe.ok) {
+        persistRow(home, { ...current, cookie }, deps);
         cookieJar.set(id, cookie);
         recordStatus(id, 'reachable', undefined, versionWarningFor(probe.version, OWN_VERSION));
-        emitFederation({ type: 'federated', machineId: id, machineName: row.name, origin, agents: probe.agents });
+        emitFederation({ type: 'federated', machineId: id, machineName: current.name, origin, agents: probe.agents });
     }
     else if (probe.status === 'auth-expired') {
         recordStatus(id, 'auth-expired', probe.error);

package/superd-hub/dist/mesh-rpc.d.ts

@@ -98,7 +98,7 @@ export declare function tokenPreviewOf(tokenUrl: string): string | undefined;
  */
 export declare function handleMeshMachines(request: Request, deps: MeshDeps): Promise<Response>;
 /**
- * Validate a token-url request origin: an absolute http(s) URL that is ONLY
+ * Validate a token-url request origin: an absolute host-bearing URL that is ONLY
  * an origin — no path, query, hash, or credentials. The pairing URL a user
  * copies must address the server root (`authorizeIndex` answers `/` only),
  * and anything beyond the origin would smuggle parts the mint would overwrite

package/superd-hub/dist/mesh-rpc.js

@@ -1,6 +1,6 @@
 import { hostname } from 'node:os';
 import { ensureSelf, listRemotes, removeRemote } from './machines.js';
-import { machineStatus, pairMachine, reprobeMachine, emitMachineRemoved } from './mesh-link.js';
+import { machineStatus, pairMachine, receivePairing, reprobeMachine, emitMachineRemoved } from './mesh-link.js';
 import { A2A_ENDPOINT_PATH, A2A_OUTBOX_PATH, A2A_WIRE_VERSION, decodeA2aWireFrame } from './a2a-wire.js';
 import { EXEC_API_BASE, parseOneShotExecBody, runOneShotExec } from './exec.js';
 /** The shared-channel Fetch route path this API owns. */
@@ -37,7 +37,7 @@ function publicRow(row) {
 function projectRow(row, status) {
     const entry = status.get(row.id);
     if (entry === undefined)
-        return { id: row.id, name: row.name, origin: row.origin, enabled: row.enabled, addedAt: row.addedAt, status: 'pending' };
+        return { id: row.id, name: row.name, origin: row.origin, enabled: row.enabled, addedAt: row.addedAt, status: row.incoming && !row.cookie ? 'unreachable' : 'pending' };
     const out = { id: row.id, name: row.name, origin: row.origin, enabled: row.enabled, addedAt: row.addedAt, status: entry.status, lastProbeAt: entry.lastProbeAt };
     if (entry.error !== undefined)
         out.error = entry.error;
@@ -101,7 +101,7 @@ function handleList(deps) {
     });
 }
 /**
- * Validate a token-url request origin: an absolute http(s) URL that is ONLY
+ * Validate a token-url request origin: an absolute host-bearing URL that is ONLY
  * an origin — no path, query, hash, or credentials. The pairing URL a user
  * copies must address the server root (`authorizeIndex` answers `/` only),
  * and anything beyond the origin would smuggle parts the mint would overwrite
@@ -119,15 +119,14 @@ export function parsePairingOrigin(origin) {
     catch {
         return { ok: false, error: 'mesh-api: tokenUrl origin is not a parseable absolute URL' };
     }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        return { ok: false, error: `mesh-api: tokenUrl origin must be http(s), got "${url.protocol}"` };
-    }
+    if (url.host === '')
+        return { ok: false, error: 'mesh-api: tokenUrl origin must name a host' };
     if (url.username !== '' || url.password !== '')
         return { ok: false, error: 'mesh-api: tokenUrl origin must not carry credentials' };
-    if (url.pathname !== '/' || url.search !== '' || url.hash !== '') {
+    if ((url.pathname !== '/' && url.pathname !== '') || url.search !== '' || url.hash !== '') {
         return { ok: false, error: 'mesh-api: tokenUrl origin must be a bare origin (no path, query or hash)' };
     }
-    return { ok: true, origin: url.origin };
+    return { ok: true, origin: url.protocol + '//' + url.host };
 }
 /** POST op `tokenUrl`: tokenize the caller's origin with the live launch
  *  token (spec hub-roster-identity §3). The answer rides a POST the user
@@ -153,14 +152,18 @@ function handleTokenUrl(body, deps) {
  * (no mint face, no Host header) — the peer can then only be paired
  * manually from its own UI.
  */
-function buildMutual(request, deps) {
+function buildMutual(request, deps, pageOrigin) {
     if (deps.tokenUrlOf === undefined)
         return undefined;
     const host = request.headers.get('host');
-    if (host === null || host === '')
+    if ((host === null || host === '') && typeof pageOrigin !== 'string')
         return undefined;
     const proto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim() ?? 'http';
-    const origin = `${proto}://${host}`;
+    const raw = typeof pageOrigin === 'string' ? pageOrigin : `${proto}://${host}`;
+    const parsed = parsePairingOrigin(raw);
+    if (!parsed.ok)
+        return undefined;
+    const origin = parsed.origin;
     const port = new URL(origin).port;
     const name = hostname();
     return {
@@ -207,9 +210,14 @@ async function handlePost(request, deps) {
     if (name === '' || tokenUrl === '') {
         return json(400, { error: 'mesh-api: pair body must be {name, tokenUrl} with non-empty name and tokenUrl' });
     }
+    if (body.mutual === true && typeof body.machineId === 'string' && body.machineId !== '') {
+        const received = await receivePairing(deps.home, { machineId: body.machineId, name, tokenUrl }, { fetchImpl: deps.fetchImpl });
+        const { row, ...reciprocal } = received;
+        return json(201, { ...(row === undefined ? {} : { machine: publicRow(row) }), reciprocal });
+    }
     // The reverse leg rides USER-initiated pairs only: an offer that arrived
     // with `mutual: true` (the peer's own reverse leg) pairs without one.
-    const mutual = body.mutual === true ? undefined : buildMutual(request, deps);
+    const mutual = body.mutual === true ? undefined : buildMutual(request, deps, body.origin);
     let outcome;
     try {
         outcome = await pairMachine(deps.home, { name, tokenUrl, ...(mutual === undefined ? {} : { mutual }) }, { fetchImpl: deps.fetchImpl });

package/superd-hub/dist/pairing-auth.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { HostConnectionHandle, ConnectionIndexRequest, ConnectionIndexResponse } from '@deepseek-ai/dsh-client-connection';
+export declare const PAIRING_AUTH_PATH = "/superd/pair-auth";
+/** Exchange the native launch token without taking ownership of the password page. */
+export declare function handlePairingAuth(request: ConnectionIndexRequest, response: ConnectionIndexResponse, connection: Pick<HostConnectionHandle, 'authorizeIndex'>): void;
+/** Called only in ctx0's real WebServer/Connection injection scope. */
+export declare function registerPairingAuth(ctx: Context): void;

package/superd-hub/dist/pairing-auth.js

@@ -0,0 +1,29 @@
+export const PAIRING_AUTH_PATH = '/superd/pair-auth';
+/** Exchange the native launch token without taking ownership of the password page. */
+export function handlePairingAuth(request, response, connection) {
+    if (request.method !== 'GET') {
+        response.writeHead(405, { allow: 'GET', 'cache-control': 'no-store' });
+        response.end();
+        return;
+    }
+    const url = new URL(request.url ?? PAIRING_AUTH_PATH, 'http://dsh.invalid');
+    const tokens = url.searchParams.getAll('token');
+    if (tokens.length !== 1 || tokens[0] === '') {
+        response.writeHead(401, { 'cache-control': 'no-store' });
+        response.end();
+        return;
+    }
+    // Host headers keep native authority binding. Connection alone checks the
+    // process token and signs the cookie; no credential or verifier is copied.
+    if (connection.authorizeIndex({ method: 'GET', url: '/' + url.search, headers: request.headers }, response)) {
+        response.writeHead(401, { 'cache-control': 'no-store' });
+        response.end();
+    }
+}
+/** Called only in ctx0's real WebServer/Connection injection scope. */
+export function registerPairingAuth(ctx) {
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact', path: PAIRING_AUTH_PATH,
+        handler: (request, response) => handlePairingAuth(request, response, ctx.connection),
+    }), 'superd-hub: native pairing authentication');
+}

package/superd-hub/lib/client/index.js

@@ -331,7 +331,7 @@ function RuntimeMark({ runtimeId, agentKey, size }) {
 function statusColor(status) {
 	if (status === "reachable") return "var(--dsw-alias-state-success-primary)";
 	if (status === "auth-expired") return "var(--dsw-alias-state-error-primary)";
-	if (status === "unreachable") return "var(--dsw-alias-state-warn-primary)";
+	if (status === "unreachable") return "var(--dsw-alias-label-caption)";
 	return "var(--dsw-alias-label-caption)";
 }
 /** The word the icon replaces — tooltip and accessibility text. */
@@ -614,7 +614,8 @@ async function addMachine(input) {
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
 			name: input.name,
-			tokenUrl: input.tokenUrl
+			tokenUrl: input.tokenUrl,
+			...pageOrigin() === "" ? {} : { origin: pageOrigin() }
 		})
 	});
 	if (!response.ok) throw new Error(await errorText(response));
@@ -623,9 +624,21 @@ async function addMachine(input) {
 	const raw = body.mutual;
 	return { mutual: {
 		ok: raw.ok === true,
+		...raw.skipped === "self" || raw.skipped === "already-paired" ? { skipped: raw.skipped } : {},
 		...typeof raw.error === "string" && raw.error !== "" ? { error: raw.error } : {}
 	} };
 }
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+function pageOrigin() {
+	if (typeof location === "undefined") return "";
+	if (location.origin !== "null" && location.origin !== "") return location.origin;
+	try {
+		const url = new URL(location.href);
+		return url.protocol + "//" + url.host;
+	} catch {
+		return "";
+	}
+}
 /**
 * DELETE one remote row by id (`{removed: boolean}` answers even for
 * unknown ids — a false removal is a reload, not an error).
@@ -671,7 +684,7 @@ const AUTO_REFRESH_NOTE = "auto-refreshes every 5 min";
 * face's public `authenticatedUrl` — this client never sees the raw token
 * anywhere else.
 *
-* @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+* @param origin - the page's own host address, including a desktop scheme.
 * @returns the tokenized pairing URL.
 * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
 */
@@ -692,9 +705,9 @@ async function fetchPairingUrl(origin) {
 }
 /**
 * Client-side pre-check before a pairing submit: a parseable absolute
-* http(s) URL carrying a non-empty `token` query param. The server re-parses
+* host-bearing URL carrying a non-empty `token` query param. The server re-parses
 * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
-* dead drafts off the wire.
+* malformed drafts off the wire.
 *
 * @param input - the raw token-URL draft (trim before calling).
 * @returns whether the draft is submit-shaped.
@@ -707,7 +720,7 @@ function validTokenUrl(input) {
 	} catch {
 		return false;
 	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.host === "") return false;
 	const token = url.searchParams.get("token");
 	return token !== null && token !== "";
 }
@@ -3143,7 +3156,7 @@ function HubPage() {
 		});
 	}, [fusion]);
 	const here = currentMountPath();
-	const hereOrigin = typeof location === "undefined" ? "" : location.origin;
+	const hereOrigin = pageOrigin();
 	const isActive = (agent) => hubRowActive({
 		fusion,
 		agentKey: agent.key,
@@ -3254,8 +3267,9 @@ function HubPage() {
 			setShowAdd(false);
 			setMeshError(null);
 			reloadMachines();
-			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}, but the mutual half failed (${out.mutual.error}) — add this machine from the peer manually.`);
-			else showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}; reverse connection unavailable.`);
+			else if (out.mutual?.ok && out.mutual.skipped !== "self") showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			else showSuperdToast(`Super D: paired with ${name}.`, { tone: "success" });
 		}).catch((err) => {
 			setMeshError(errText(err));
 		}).finally(() => {
@@ -3282,7 +3296,7 @@ function HubPage() {
 	*  GET), one clipboard write, the outcome on the shared toast. */
 	const copyPairingUrl = () => {
 		if (pairingBusy) return;
-		const origin = typeof location === "undefined" ? "" : location.origin;
+		const origin = pageOrigin();
 		if (origin === "") return;
 		setPairingBusy(true);
 		fetchPairingUrl(origin).then((url) => (0, __deepseek_ai_dsh_client_ui_primitives.writeClipboard)(url)).then((copied) => {
@@ -3463,7 +3477,7 @@ function HubPage() {
 								color: "var(--dsw-alias-label-tertiary)"
 							},
 							children: [
-								"Add another DSH from remote machines, provide the token URL. Pairing is mutual — the peer adds this machine back automatically. Status ",
+								"Add another DSH with its token URL. The peer attempts to connect back. Status ",
 								AUTO_REFRESH_NOTE,
 								"."
 							]