super-dsh 0.3.1-d → 0.3.1-e

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.1-d",
+  "version": "0.3.1-e",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",

package/superd-hub/dist/a2a-host.d.ts

@@ -10,6 +10,14 @@ export interface A2aHostOptions {
      * ({@link bridgeTypertGateway}).
      */
     nativeGateway?: RawTypertGatewayFace;
+    /**
+     * LAZY provider of ctx0's owner browser Peer (connection.browserPeer) —
+     * 0.2.1 gateways read peer.signal/principal on every invocation. A
+     * provider, not a value: typertGateway mounts before connection, so a
+     * wiring-time read would capture undefined forever; resolution happens
+     * per call, when connection is long live.
+     */
+    nativePeer?: () => unknown;
 }
 /**
  * The RAW typertGateway service face — upstream canonical stream order
@@ -20,8 +28,8 @@ export interface A2aHostOptions {
  * mesh-gateway wire adapters (dual-face, 3rd-argument dispatch).
  */
 export interface RawTypertGatewayFace {
-    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal): Promise<unknown>;
-    openWireStream(endpoint: string, payload: unknown, uplink: undefined, peer: undefined, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
+    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal, peer: unknown): Promise<unknown>;
+    openWireStream(endpoint: string, payload: unknown, uplink: undefined, peer: unknown, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 }
 /**
  * Bridge one RAW typertGateway instance to Task 2's 3-arg `A2aGateway` face
@@ -38,7 +46,7 @@ export interface RawTypertGatewayFace {
  * @param real - a raw in-process typertGateway instance (ctx0's own or a local world's).
  * @returns the gateway Task 2's service consumes.
  */
-export declare function bridgeTypertGateway(real: RawTypertGatewayFace): A2aGateway;
+export declare function bridgeTypertGateway(real: RawTypertGatewayFace, peer?: unknown): A2aGateway;
 /**
  * Build the gatewayFor resolver Task 2's service consumes: federated table
  * first, shared target registry second, local id-map inversion third,

package/superd-hub/dist/a2a-host.js

@@ -59,10 +59,10 @@ function localKeyOfA6(home, a6) {
  * @param real - a raw in-process typertGateway instance (ctx0's own or a local world's).
  * @returns the gateway Task 2's service consumes.
  */
-export function bridgeTypertGateway(real) {
+export function bridgeTypertGateway(real, peer) {
     return {
-        dispatchRpc: (endpoint, payload, signal) => real.dispatchRpc(endpoint, payload, signal),
-        openWireStream: (endpoint, payload, signal) => real.openWireStream(endpoint, payload, undefined, undefined, signal, new AbortController()),
+        dispatchRpc: (endpoint, payload, signal) => real.dispatchRpc(endpoint, payload, signal, peer),
+        openWireStream: (endpoint, payload, signal) => real.openWireStream(endpoint, payload, undefined, peer, signal, new AbortController()),
     };
 }
 /**
@@ -95,17 +95,17 @@ export function resolveA2aGatewayFor(options) {
             if (key === 'native') {
                 if (options.nativeGateway === undefined)
                     throw new A2aAddressError('unreachable', addr);
-                return bridgeTypertGateway(options.nativeGateway);
+                return bridgeTypertGateway(options.nativeGateway, options.nativePeer?.());
             }
             // The registry's declared GatewayFace (targets.ts) types the stream
             // face as the 3-arg subset, but a LOCAL row's runtime object is the RAW
             // typertGateway instance (world-join.ts registers it verbatim) — re-cast
             // to RawTypertGatewayFace so the bridge above binds the canonical 6-arg
             // positional order instead of the declared subset.
-            const local = getTarget(key)?.gateway;
-            if (local === undefined)
+            const target = getTarget(key);
+            if (target?.gateway === undefined)
                 throw new A2aAddressError('unreachable', addr);
-            return bridgeTypertGateway(local);
+            return bridgeTypertGateway(target.gateway, target.peer);
         }
         // The a6 resolves nowhere — classify the miss (D7): a roster row exists →
         // its plane is down; else the machine decides agent-vs-machine blame.

package/superd-hub/dist/a2a-row.js

@@ -56,12 +56,18 @@ export function wireHubToolRow(ctx, opts = {}) {
         // RAW instance in, bridged at the resolver (fix round 1: one shared
         // bridge in a2a-host.ts covers the native seam AND all local world rows).
         const raw = t.get('typertGateway');
+        // 0.2.1: every invocation reads the caller Peer — ctx0's owner browser
+        // Peer rides the native seam as a LAZY provider: typertGateway mounts
+        // BEFORE connection (the service registers in its constructor), so a
+        // wiring-time value would capture undefined forever; resolution happens
+        // per call, when connection is long live.
+        const nativePeer = () => ctx.get('connection')?.browserPeer;
         // postoffice R4: ONE resolver, ONE ingest, TWO consumers — the initiator
         // service's self-routing leg calls the very same ingest handler the HTTP
         // endpoint calls (protocol-identical by construction). The service takes
         // a LAZY provider: the ingest's delivery face buffers through the
         // service's own buffer leg, so it can only be built after the service.
-        const gatewayFor = resolveA2aGatewayFor({ home, nativeGateway: raw });
+        const gatewayFor = resolveA2aGatewayFor({ home, nativeGateway: raw, nativePeer });
         // Operational journal: the pure modules only format lines; this is
         // where they meet the process console and land in the unit log (4999 rig
         // / dev3 dsh.service journal). NOT ctx.logger: the pack composes no

package/superd-hub/dist/carrier.d.ts

@@ -1,22 +1,24 @@
 import { type WorldRequest, type WorldResponse } from './world-web-server.js';
 import { WorldMuxServer, type MuxFailure } from './world-mux.js';
-/** The three-method face of a world's typertGateway service instance. */
+/** The face of a world's typertGateway service instance the hub forwards through. */
 export interface CarrierGatewayFace {
-    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal): Promise<unknown>;
+    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal, peer: unknown): Promise<unknown>;
     /**
      * Streams return an async iterable (upstream face is synchronous-returning).
      * Canonical order: (endpoint, payload, uplink, peer, signal, control) — the
-     * carrier passes no peer (ctx0's fence already authenticated the client),
-     * the mux controller's signal, and the controller itself, exactly as the
-     * native gateway's mux wires its own streams.
+     * carrier passes the world's owner browser Peer (0.2.1 gateways read it on
+     * every invocation), the mux controller's signal, and the controller
+     * itself, exactly as the native gateway's mux wires its own streams.
      */
-    openWireStream(endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, peer: undefined, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
+    openWireStream(endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, peer: unknown, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 }
 export declare function writeJson(res: WorldResponse, status: number, body: string): void;
 /** Deps the forwarding kernel needs to answer for one world's traffic. */
 export interface ForwardOptions {
     /** The addressed world's gateway instance. */
     gateway: CarrierGatewayFace;
+    /** The addressed world's owner browser Peer (0.2.1 invocation identity). */
+    peer?: unknown;
     /** World key addressing the world's published `/api` fetch handler. */
     label: string;
     /** URL prefix this carrier strips before the world sees the request (`/omp`, `/hub`). */
@@ -47,7 +49,7 @@ export declare function forwardWorldFetch(options: {
  */
 export declare function forwardApiCall(options: ForwardOptions, req: WorldRequest, res: WorldResponse): Promise<void>;
 /** One WorldMuxServer bound to `gateway` — the canonical openWireStream wiring in one place. */
-export declare function worldMuxOf(gateway: CarrierGatewayFace, options?: {
+export declare function worldMuxOf(gateway: CarrierGatewayFace, peer?: unknown, options?: {
     heartbeatIntervalMs?: number;
     failure?: (error: unknown) => MuxFailure;
 }): WorldMuxServer;

package/superd-hub/dist/carrier.js

@@ -177,7 +177,7 @@ export async function forwardApiCall(options, req, res) {
         }
         rpcId = envelope.rpcId;
         const controller = new AbortController();
-        const result = await options.gateway.dispatchRpc(envelope.method, envelope.payload, controller.signal);
+        const result = await options.gateway.dispatchRpc(envelope.method, envelope.payload, controller.signal, options.peer);
         // The gateway already returns a Result (`{ok:true,value}` | `{ok:false,error}`),
         // which is exactly the server-response's `result` field.
         writeJson(res, 200, serverResult(rpcId, result));
@@ -194,8 +194,8 @@ export async function forwardApiCall(options, req, res) {
     }
 }
 /** One WorldMuxServer bound to `gateway` — the canonical openWireStream wiring in one place. */
-export function worldMuxOf(gateway, options) {
-    return new WorldMuxServer((endpoint, payload, uplink, control) => Promise.resolve(gateway.openWireStream(endpoint, payload, uplink, undefined, control.signal, control)), {
+export function worldMuxOf(gateway, peer, options) {
+    return new WorldMuxServer((endpoint, payload, uplink, control) => Promise.resolve(gateway.openWireStream(endpoint, payload, uplink, peer, control.signal, control)), {
         ...(options?.heartbeatIntervalMs === undefined ? {} : { heartbeatIntervalMs: options.heartbeatIntervalMs }),
         ...(options?.failure === undefined ? {} : { failure: options.failure }),
     });

package/superd-hub/dist/companions.js

@@ -3,8 +3,9 @@ import { createHash } from 'node:crypto';
 import { readFile, mkdir, unlink, rmdir } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
-// done marks a CONFIRMED first use (Better observed installed). A receipt with attempted
-// but neither done nor error is an interrupted first use — e.g. killed by the restart
+// done marks a CONFIRMED first use (Better observed installed); removed marks a
+// migrated legacy removal record. A receipt with attempted but neither done,
+// error, nor removed is an interrupted first use — e.g. killed by the restart
 // that installing Super itself triggers — and must re-arm, not suppress, the retry.
 const message = (error) => error instanceof Error ? error.message : String(error);
 async function optionalJson(path) {
@@ -48,9 +49,10 @@ export class BetterDashCompanion {
         return this.initialized ??= (async () => {
             const saved = await optionalJson(this.receipt);
             if (saved !== undefined) {
-                // Never-resurrect applies only to a CONFIRMED first use or a recorded
-                // failure; an interrupted first use (no done, no error) re-arms.
-                this.intent = saved.attempted && saved.done !== true && saved.error === undefined
+                // Never-resurrect applies to a CONFIRMED first use, a recorded failure,
+                // or a migrated removal record; an interrupted first use (no done, no
+                // error, no removal marker) re-arms.
+                this.intent = saved.attempted && saved.done !== true && saved.error === undefined && saved.removed !== true
                     ? { attempted: false } : saved;
                 await this.cleanLegacy();
                 return;
@@ -59,7 +61,7 @@ export class BetterDashCompanion {
             // Any old registration was first use. An absent Better now means removal,
             // including when Super has since changed version; never resurrect it.
             if (old?.['super-dsh:better-dsh'] !== undefined) {
-                this.intent = { attempted: true };
+                this.intent = { attempted: true, removed: true };
                 await this.save();
                 await this.cleanLegacy();
             }

package/superd-hub/dist/gateway.js

@@ -90,7 +90,14 @@ export function apply(ctx, config) {
             real: real,
             authorize: (req, res) => connection.authorizeIndex(req, res),
             requestRejection: (req) => connection.requestRejection(req),
-            gatewayOf: (label) => (federatedGatewayOf(label) ?? getTarget(label)?.gateway),
+            gatewayOf: (label) => {
+                const federated = federatedGatewayOf(label);
+                if (federated !== undefined)
+                    return { key: label, gateway: federated };
+                // The stored face IS the service instance (canonical methods); targets.ts
+                // keeps a looser structural view for the mesh wire adapters.
+                return getTarget(label);
+            },
         }), 'superd-hub: /hub route family');
         // P4 §8.2: the PTY executor's upgrade route — same gate as the /hub family
         // (authorizeIndex cookie auth first, then the browser-trust fence). The

package/superd-hub/dist/hub-route.d.ts

@@ -63,8 +63,11 @@ export interface HubRouteOptions {
      * answer, so even the demux 404s never speak to untrusted traffic.
      */
     requestRejection?(req: unknown): number | undefined;
-    /** The live gateway of a registered label, or undefined (unknown / not yet spawned). */
-    gatewayOf(label: string): CarrierGatewayFace | undefined;
+    /** The live target (gateway + owner peer) of a registered label, or undefined (unknown / not yet spawned). */
+    gatewayOf(label: string): {
+        gateway: CarrierGatewayFace;
+        peer?: unknown;
+    } | undefined;
 }
 /**
  * Register the family on ctx0's webServer.

package/superd-hub/dist/hub-route.js

@@ -130,15 +130,15 @@ export function registerHubRoute(options) {
             });
             return;
         }
-        const gateway = options.gatewayOf(agent);
-        if (gateway === undefined) {
+        const target = options.gatewayOf(agent);
+        if (target === undefined) {
             answer404(res, { error: 'unknown-agent', label: agent });
             return;
         }
         // Consume the family plumbing: the kernel forwards a native-shaped URL
         // (the kernel carries the same fence face as the carrier's own kernel).
         req.url = worldUrlOf(req.url);
-        await forwardApiCall({ gateway, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
+        await forwardApiCall({ gateway: target.gateway, peer: target.peer, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
     };
     const handleUpgrade = (req, socket, head) => {
         if (!gateUpgrade(options, req, socket))
@@ -155,8 +155,8 @@ export function registerHubRoute(options) {
             rejectUpgrade(socket, 404, JSON.stringify({ error: 'foreign-only' }), 'application/json');
             return;
         }
-        const gateway = options.gatewayOf(agent);
-        if (gateway === undefined) {
+        const target = options.gatewayOf(agent);
+        if (target === undefined) {
             rejectUpgrade(socket, 404, JSON.stringify({ error: 'unknown-agent', label: agent }), 'application/json');
             return;
         }
@@ -165,7 +165,7 @@ export function registerHubRoute(options) {
         // a heartbeat interval and a per-connection WebSocketServer; on socket
         // close it must be CLOSED (world-mux clears the heartbeat only in close),
         // or every reconnect leaks the timer plus the mux graph forever.
-        const mux = worldMuxOf(gateway);
+        const mux = worldMuxOf(target.gateway, target.peer);
         socket.once?.('close', () => {
             void mux.close().catch(() => undefined);
         });

package/superd-hub/dist/targets.d.ts

@@ -22,6 +22,13 @@ export interface ForeignTarget {
     key: string;
     /** The context's typertGateway service instance (or a wire adapter with the same face). */
     gateway: GatewayFace;
+    /**
+     * The world's owner browser Peer (connection.browserPeer) for in-process
+     * faces — DSH 0.2.1 gateways read peer.signal/principal on every forwarded
+     * invocation, so the hub must present the world's shared owner identity.
+     * Wire adapters (mesh federation) omit it: the far end supplies its own.
+     */
+    peer?: unknown;
 }
 /** Register (or replace) the target for a runtime key. */
 export declare function registerForeignTarget(target: ForeignTarget): void;

package/superd-hub/dist/world-lifecycle.js

@@ -48,7 +48,7 @@ export function ownWorld(ctx, entry, spawn, onFailure) {
                     unregisterForeignTarget(key);
                 setReady(key, false);
             }, `superd.world.${key}: availability`);
-            target = { key, gateway: world.get('typertGateway') };
+            target = { key, gateway: world.get('typertGateway'), peer: world.get('connection')?.browserPeer };
             registerForeignTarget(target);
             setReady(key, true);
             return world;