super-dsh 0.3.0-d → 0.3.0-f

package/README.md

@@ -22,62 +22,20 @@ six primary `@pgmi-builds/agent-*` packages and three OPTIONAL SDK halves).
 Restart the profile after replacing a loaded package. Each foreign world's
 DSH home is created under `<DSH_HOME>/agents/<label>/` on first boot.
 
-## Better Dash delivery and native Web defaults
-
-Super Dash declares [Better Dash](../better-dsh/) at the synchronized exact
-version in ordinary npm `dependencies`; it contains no Better files or archive.
-One `npm install super-dsh@<version>` or native Plugin Manager installation
-resolves both packages from the configured registry. Publish Better first, then
-Super. Pi's prebuilt SDK dependency tree retains its separate bundled delivery.
-
-DSH does not recursively expose transitive bundles. On startup the coordinator
-registers the already downloaded exact Better version using native profile
-package operations **offline**, without installation hooks or another registry
-fetch. This automatic local registration is separate from the user's single
-installation command. Missing cached data reports a failure instead of falling
-back to online fetching. Replacing loaded code or promoting loaded provenance
-requires the documented cold restart.
-
-The Plugin Manager shows both packages as parallel installed bundles with their
-own YAML and independent switches. Better's Code source is `better-dsh@<version>`.
-Updates retain disablement and same-version explicit uninstall; removing Super
-retains the directly registered Better. Old `bundle-artifacts/` caches are left
-intact for previous installations, but new releases do not write them. With Super
-disabled, registration waits until Super is enabled. dev WebMCP is
-separate and test-only.
-
-Both packages use the same local dual-build pipeline. Tests serve the exact
-unpublished artifact pair through a read-only local registry, without modifying
-the release manifest or preinstalling Better. Current iteration: **0.3.0-f**.
-
-For a tarball URL installation in the native Web UI, put the `.tgz` URL in the
-main Add plugin input and keep the separate Registry selection on the official
-npm registry. A tarball file server is not an npm registry.
-
-Disabling Better restores native Web binding, trusted-host, login and onboarding
-policies. Remote deployments must supply native DSH trusted-host configuration;
-Super does not take ownership of those Better policies.
-
-Better Dash owns the native DSH policies: `dashr-web-trust` retains cookie
-authentication while accepting authenticated serving Host/Origin values; its
-password page provides new-client login. Cookie expiry and authority binding remain.
-`dashr-webserver` defaults to `0.0.0.0`; native `--port` and explicit loopback
-`--host` overrides are preserved. Super Dash carries no duplicate WebTrust.
-To restore the native address fence, set `dashr-web-trust`'s `trustAllHosts: false`.
-
-Better Dash also disables automatic credential onboarding and acknowledges the
-installed Models client's current welcome version before the listener opens.
-Manual model configuration remains available. To restore native welcome behavior:
-
-```yaml
-- id: dashr-welcome-notice
-  disabled: true
-```
+## Better Dash delivery
+
+Super installs [Better Dash](../better-dsh/) at runtime through the native DSH
+Plugin Manager, requesting its installed Super version first, then `better-dsh@latest`, then bare
+`better-dsh` after each preceding failure. The packages have no dependency edge or shared physical payload;
+both retain independent native Plugin Manager rows and component switches.
+
+First-use intent lives under `$DSH_HOME/superd/companions/`, so manual removal
+remains removed across restarts and upgrades. Hub Settings offers explicit
+reinstallation. Both packages ship at synchronized versions; publish Better
+before Super. Pi's prebuilt SDK retains its separate bundled delivery.
 
-Version-only upstream bumps adapt at the next startup. A renamed private constant
-or changed bundle layout fails explicitly and requires adaptation or disabling the
-entry. Dev WebMCP lives in the root `dev-webmcp/` directory and is included
-only as an extra development profile bundle, never in either release tarball.
+Better's welcome policy uses the official client onboarding slot. Native
+WebServer and HMR stay in place; listener configuration belongs to deployment.
 
 ## Runtimes
 

package/client/index.js

@@ -331,7 +331,7 @@ function RuntimeMark({ runtimeId, agentKey, size }) {
 function statusColor(status) {
 	if (status === "reachable") return "var(--dsw-alias-state-success-primary)";
 	if (status === "auth-expired") return "var(--dsw-alias-state-error-primary)";
-	if (status === "unreachable") return "var(--dsw-alias-state-warn-primary)";
+	if (status === "unreachable") return "var(--dsw-alias-label-caption)";
 	return "var(--dsw-alias-label-caption)";
 }
 /** The word the icon replaces — tooltip and accessibility text. */
@@ -614,7 +614,8 @@ async function addMachine(input) {
 		headers: { "content-type": "application/json" },
 		body: JSON.stringify({
 			name: input.name,
-			tokenUrl: input.tokenUrl
+			tokenUrl: input.tokenUrl,
+			...pageOrigin() === "" ? {} : { origin: pageOrigin() }
 		})
 	});
 	if (!response.ok) throw new Error(await errorText(response));
@@ -623,9 +624,21 @@ async function addMachine(input) {
 	const raw = body.mutual;
 	return { mutual: {
 		ok: raw.ok === true,
+		...raw.skipped === "self" || raw.skipped === "already-paired" ? { skipped: raw.skipped } : {},
 		...typeof raw.error === "string" && raw.error !== "" ? { error: raw.error } : {}
 	} };
 }
+/** Preserve shell schemes whose WHATWG origin is opaque; this is an address, not a reachability verdict. */
+function pageOrigin() {
+	if (typeof location === "undefined") return "";
+	if (location.origin !== "null" && location.origin !== "") return location.origin;
+	try {
+		const url = new URL(location.href);
+		return url.protocol + "//" + url.host;
+	} catch {
+		return "";
+	}
+}
 /**
 * DELETE one remote row by id (`{removed: boolean}` answers even for
 * unknown ids — a false removal is a reload, not an error).
@@ -671,7 +684,7 @@ const AUTO_REFRESH_NOTE = "auto-refreshes every 5 min";
 * face's public `authenticatedUrl` — this client never sees the raw token
 * anywhere else.
 *
-* @param origin - the page's own origin (`location.origin`), a bare http(s) origin.
+* @param origin - the page's own host address, including a desktop scheme.
 * @returns the tokenized pairing URL.
 * @throws Error(body.error) on a non-2xx answer (validation or missing host face).
 */
@@ -692,9 +705,9 @@ async function fetchPairingUrl(origin) {
 }
 /**
 * Client-side pre-check before a pairing submit: a parseable absolute
-* http(s) URL carrying a non-empty `token` query param. The server re-parses
+* host-bearing URL carrying a non-empty `token` query param. The server re-parses
 * authoritatively (mesh-link's parseTokenUrl); this only keeps obviously
-* dead drafts off the wire.
+* malformed drafts off the wire.
 *
 * @param input - the raw token-URL draft (trim before calling).
 * @returns whether the draft is submit-shaped.
@@ -707,7 +720,7 @@ function validTokenUrl(input) {
 	} catch {
 		return false;
 	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.host === "") return false;
 	const token = url.searchParams.get("token");
 	return token !== null && token !== "";
 }
@@ -2185,6 +2198,145 @@ async function removeProvider(agentKey, namespace, id, doFetch) {
 	return requireProvidersView(await callRuntimeSettings(agentKey, namespace, "remove", { request: { id } }, doFetch));
 }
 
+//#endregion
+//#region src/client/companion-api.ts
+async function callCompanion(operation, doFetch) {
+	const method = `superdCompanions/${operation}`;
+	const response = await (doFetch ?? ((path, init) => fetch(path, init)))(`/api/${method}`, {
+		method: "POST",
+		credentials: "same-origin",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			type: "client-request",
+			rpcId: mintRpcId(),
+			method,
+			payload: { args: {} }
+		})
+	});
+	if (!response.ok) throw new Error(`Better Dash: HTTP ${response.status}`);
+	let body;
+	try {
+		body = JSON.parse(await response.text());
+	} catch {
+		throw new Error("Better Dash: unreadable response");
+	}
+	const result = body?.result;
+	if (result?.ok !== true) throw new Error(result?.error?.message ?? "Better Dash: request failed");
+	const value = result.value;
+	if (value === null || typeof value !== "object" || typeof value.installed !== "boolean" || typeof value.installing !== "boolean" || typeof value.requestedVersion !== "string" || value.version !== void 0 && typeof value.version !== "string" || value.enabled !== void 0 && typeof value.enabled !== "boolean" || value.error !== void 0 && typeof value.error !== "string") throw new Error("Better Dash: invalid status");
+	return value;
+}
+
+//#endregion
+//#region src/client/CompanionSettings.tsx
+/** Native plugin switches remain in Plugin Manager; this row provides explicit recovery. */
+function CompanionSettings() {
+	const [status, setStatus] = react.default.useState();
+	const [error, setError] = react.default.useState();
+	const [busy, setBusy] = react.default.useState(false);
+	const live = react.default.useRef(false);
+	const operation = react.default.useRef(false);
+	react.default.useEffect(() => {
+		live.current = true;
+		let reading = false;
+		const refresh = async () => {
+			if (reading || operation.current) return;
+			reading = true;
+			try {
+				const next = await callCompanion("getBetterDash");
+				if (live.current) {
+					setStatus(next);
+					setError(next.error);
+				}
+			} catch (cause) {
+				if (live.current) setError(cause instanceof Error ? cause.message : String(cause));
+			} finally {
+				reading = false;
+			}
+		};
+		refresh();
+		const timer = window.setInterval(() => {
+			refresh();
+		}, 5e3);
+		return () => {
+			live.current = false;
+			window.clearInterval(timer);
+		};
+	}, []);
+	const install = async () => {
+		if (operation.current) return;
+		operation.current = true;
+		setBusy(true);
+		setError(void 0);
+		try {
+			const next = await callCompanion("installBetterDash");
+			if (live.current) {
+				setStatus(next);
+				setError(next.error);
+			}
+		} catch (cause) {
+			if (live.current) setError(cause instanceof Error ? cause.message : String(cause));
+		} finally {
+			operation.current = false;
+			if (live.current) setBusy(false);
+		}
+	};
+	const installing = busy || status?.installing === true;
+	const label = status === void 0 ? "Loading…" : status.installed ? `Installed${status.version ? " · " + status.version : ""}${status.enabled === false ? " · Disabled" : ""}` : "Not installed";
+	return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+		style: {
+			borderRadius: 12,
+			padding: "12px 14px",
+			background: "var(--dsw-alias-interactive-bg-hover)"
+		},
+		children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+			style: {
+				display: "flex",
+				alignItems: "center",
+				gap: 16
+			},
+			children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: { flex: 1 },
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					style: {
+						fontSize: 14,
+						fontWeight: 600
+					},
+					children: "Better Dash"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					role: "status",
+					style: {
+						fontSize: 12,
+						color: "var(--dsw-alias-label-secondary)",
+						marginTop: 4
+					},
+					children: installing ? "Installing…" : label
+				})]
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				type: "button",
+				disabled: installing || status?.installed === true,
+				onClick: () => {
+					install();
+				},
+				style: {
+					padding: "6px 12px",
+					borderRadius: 8,
+					cursor: installing || status?.installed ? "default" : "pointer"
+				},
+				children: installing ? "Installing…" : status?.installed ? "Installed" : "Install"
+			})]
+		}), error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+			role: "alert",
+			style: {
+				fontSize: 12,
+				margin: "8px 0 0",
+				color: "var(--dsw-alias-state-error-primary)"
+			},
+			children: error
+		})]
+	});
+}
+
 //#endregion
 //#region src/client/HubPage.tsx
 const EMPTY_DRAFT = {
@@ -3143,7 +3295,7 @@ function HubPage() {
 		});
 	}, [fusion]);
 	const here = currentMountPath();
-	const hereOrigin = typeof location === "undefined" ? "" : location.origin;
+	const hereOrigin = pageOrigin();
 	const isActive = (agent) => hubRowActive({
 		fusion,
 		agentKey: agent.key,
@@ -3254,8 +3406,9 @@ function HubPage() {
 			setShowAdd(false);
 			setMeshError(null);
 			reloadMachines();
-			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}, but the mutual half failed (${out.mutual.error}) — add this machine from the peer manually.`);
-			else showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			if (out.mutual !== void 0 && !out.mutual.ok) showSuperdToast(`Super D: paired with ${name}; reverse connection unavailable.`);
+			else if (out.mutual?.ok && out.mutual.skipped !== "self") showSuperdToast(`Super D: paired with ${name} — the peer also added this machine (mutual).`, { tone: "success" });
+			else showSuperdToast(`Super D: paired with ${name}.`, { tone: "success" });
 		}).catch((err) => {
 			setMeshError(errText(err));
 		}).finally(() => {
@@ -3282,7 +3435,7 @@ function HubPage() {
 	*  GET), one clipboard write, the outcome on the shared toast. */
 	const copyPairingUrl = () => {
 		if (pairingBusy) return;
-		const origin = typeof location === "undefined" ? "" : location.origin;
+		const origin = pageOrigin();
 		if (origin === "") return;
 		setPairingBusy(true);
 		fetchPairingUrl(origin).then((url) => (0, __deepseek_ai_dsh_client_ui_primitives.writeClipboard)(url)).then((copied) => {
@@ -3401,16 +3554,8 @@ function HubPage() {
 					},
 					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(GroupHead, {
 						title: "Settings",
-						count: 0
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						style: {
-							margin: 0,
-							fontSize: 13,
-							lineHeight: "20px",
-							color: "var(--dsw-alias-label-tertiary)"
-						},
-						children: "Hub preferences — pairing, runtime visibility, and orchestration defaults land with the hub service."
-					})]
+						count: 1
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CompanionSettings, {})]
 				}),
 				tab === "home" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 					style: {
@@ -3463,7 +3608,7 @@ function HubPage() {
 								color: "var(--dsw-alias-label-tertiary)"
 							},
 							children: [
-								"Add another DSH from remote machines, provide the token URL. Pairing is mutual — the peer adds this machine back automatically. Status ",
+								"Add another DSH with its token URL. The peer attempts to connect back. Status ",
 								AUTO_REFRESH_NOTE,
 								"."
 							]

package/cordis.patch.yml

@@ -12,8 +12,8 @@
 #                              zero-port sibling root, mounted under /<label>
 #   - super-dsh/join           the generic hub joiner for the standalone
 #                              claude adapter (R2)
-# DSH-only WebTrust, WebServer and onboarding policies belong to the exact registry
-# Better Dash dependency, registered as an independent profile bundle.
+# DSH-only WebTrust and onboarding policies belong to independently installed
+# Better Dash; the native Plugin Manager owns its package and enablement.
 #   - super-dsh/a2a            the agent-facing A2A tool face (mesh P3): the
 #                              single `superd-hub` model tool on ctx0's tools
 #                              service (dormant without tools; world trees
@@ -22,7 +22,7 @@
 # Profile-layer values (webserver port/host, settings path) stay in the USER's
 # profile patch layer, never here.
 - insert:
-    # Register the already installed exact registry companion as an independent native bundle.
+    # Expose native companion management and perform first-use installation.
     - id: superd-bundle-setup
       name: 'super-dsh/setup'
     # BARE package row: subpath rows (…/agents/omp) are permanently not client

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.0-d",
+  "version": "0.3.0-f",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
@@ -68,8 +68,7 @@
     "agent-agy-sdk/dist",
     "agent-agy-sdk/package.json",
     "agent-agy-sdk/cordis.patch.yml",
-    "agent-agy-sdk/bridge",
-    "superd-hub/scripts/register-companion.mjs"
+    "agent-agy-sdk/bridge"
   ],
   "dsh": {
     "bundle": {
@@ -83,7 +82,6 @@
     }
   },
   "dependencies": {
-    "better-dsh": "0.3.0-d",
     "@earendil-works/pi-coding-agent": "0.84.2",
     "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"

package/superd-hub/dist/bundle-setup.d.ts

@@ -1,13 +1,23 @@
+/** Better Dash is installed by the current profile's native Plugin Manager. */
 import type { Context } from '@deepseek-ai/cordis';
-import type { ProfileContext } from '@deepseek-ai/dsh-app-boot';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import { BetterDashCompanion } from './companions.js';
+import type { BetterDashStatus } from './companion-contract.js';
+export { BetterDashCompanion } from './companions.js';
+export type { BetterDashStatus } from './companion-contract.js';
 export declare const name = "superd-bundle-setup";
 export declare const inject: string[];
-interface DeliveryResult {
-    installed: string[];
-    restartRequired: boolean;
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        superdCompanions: SuperdCompanions;
+    }
+}
+export declare class SuperdCompanions extends TypertRemoteService {
+    private readonly companion;
+    constructor(ctx: Context, companion: BetterDashCompanion);
+    getBetterDash(): Promise<BetterDashStatus>;
+    installBetterDash(): Promise<BetterDashStatus>;
 }
-/** First registration enables a companion; native reconciliation preserves retained disablement. */
-export declare function reconcileRegistryCompanions(profile: ProfileContext, signal?: AbortSignal): Promise<DeliveryResult>;
 export declare function apply(ctx: Context): void;
 declare const _default: {
     name: string;