super-dsh 0.3.1 → 0.3.2-d

package/client/index.js

@@ -898,6 +898,16 @@ function machineLabelsFrom(list) {
 * roster-probe failure → revert to native + a visible toast, never a page
 * lock).
 *
+* Live-install staleness (2026-10-18): the fusion flag global and the
+* transport script are baked into the SERVED index, so a page that booted
+* before super-dsh was installed runs the freshly hot-loaded client half
+* against a stale page — `fusionPage()` reads false and every switch
+* affordance stays hidden until a manual restart. {@link fusionReloadDecision}
+* is the pure decision behind the client half's heal: one roster answer later,
+* reload the page once. The transport must precede app boot (its upload hook
+* `__DSH_FILE_UPLOAD__` is read at construction), so a client-side flag flip
+* can never arm a stale page honestly — the page must be re-served.
+*
 * Host-half on purpose: plain TS with every effect injected through
 * {@link SwitchHost} — no DOM, no client imports — so `test/client-switch.test.mjs`
 * imports it from `dist/` like every other host module. The client half
@@ -1343,6 +1353,22 @@ function switchAffordance(fusion) {
 		hint: FUSION_OFF_HINT
 	};
 }
+/** The sessionStorage marker guarding the stale-page reload: one per tab session. */
+const FUSION_RELOAD_MARKER = "superd.fusion-armed.reload";
+/**
+* The live-install staleness decision (host-half pure so the node tests pin
+* the table from `dist/`). The host's `hub.fusion` field is the ONLY thing
+* that distinguishes a page-booted-before-install from a deliberately
+* flag-off deployment — without it the reload would loop forever on every
+* `enabled: false` composition (the client half loads there too).
+*/
+function fusionReloadDecision(input) {
+	if (input.flagPresent) return "armed";
+	if (input.markerPresent) return "already-reloaded";
+	if (input.hubFusion === true) return "reload";
+	if (input.hubFusion === false) return "row-off";
+	return "host-silent";
+}
 /**
 * The active agent's display name for the Hub row's right-edge selector: the
 * roster label of the atom's `activeAgent` key — the name the selector's
@@ -1621,6 +1647,53 @@ function createReadinessWaiter(faces, options = {}) {
 function fusionPage() {
 	return globalThis.__SUPERD_UI_FUSION__ === true;
 }
+/**
+* The sessionStorage marker read (undefined-safe: a storage failure is
+* `false` — the probe then reloads without the loop guard, which only
+* matters for a host that reports fusion but never bakes the flag).
+*/
+function staleReloadMarker() {
+	try {
+		return globalThis.sessionStorage?.getItem(FUSION_RELOAD_MARKER) !== null;
+	} catch {
+		return false;
+	}
+}
+/**
+* Live-install staleness probe (2026-10-18): the ONE call the client entry
+* makes when the page does not carry the fusion flag. A flag-absent page is
+* either a pre-install page (the client half hot-loaded into HTML served
+* before the row mounted — the fresh-install case where the Hub row renders
+* but every switch affordance stays hidden until a manual restart) or a
+* deliberate flag-off deployment (T-E). The roster's additive `hub.fusion`
+* answers which; on an armed host the page re-boots ONCE — the marker keeps
+* a misbehaving host from ever looping the tab. Every failure mode (fetch
+* error, non-OK, old host without the field) degrades to no action: the
+* flag-off shapes below are the honest rendering of an unanswered probe.
+*
+* Fire-and-forget by contract — never throws, never blocks the apply.
+*/
+function probeStaleFusionPage() {
+	(async () => {
+		let hubFusion;
+		try {
+			const response = await fetch("/api/agent-runtime", { credentials: "same-origin" });
+			if (!response.ok) return;
+			hubFusion = (await response.json()).hub?.fusion;
+		} catch {
+			return;
+		}
+		if (fusionReloadDecision({
+			flagPresent: fusionPage(),
+			markerPresent: staleReloadMarker(),
+			hubFusion
+		}) !== "reload") return;
+		try {
+			globalThis.sessionStorage?.setItem(FUSION_RELOAD_MARKER, "1");
+		} catch {}
+		globalThis.location?.reload();
+	})();
+}
 /** The page atom, when the page carries one (it always does on a fusion page). */
 function uiState() {
 	const state = globalThis.__SUPERD_UI_STATE__;
@@ -3880,6 +3953,38 @@ function HubPage() {
 	});
 }
 
+//#endregion
+//#region src/client/pill-geometry.ts
+/**
+* Derive the scroll-invariant offsets from one same-frame measurement.
+* Measuring the DELTAS (not absolute coordinates) is the whole point: they
+* survive any scroll of any ancestor, so nothing needs to re-run while the
+* sidebar scrolls.
+*/
+function measurePillBox(input) {
+	return {
+		dx: input.row.right - input.wrap.left,
+		cy: (input.row.top + input.row.bottom) / 2 - input.wrap.top
+	};
+}
+/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
+const PILL_ROW_INSET = 8;
+/**
+* The pill's placement, wrapper-relative: its right edge sits `inset` px
+* inside the row's right edge, vertically centered on the row
+* (`translateY(-50%)`). `selectorWidth` is the render-time pill width (the
+* mark is present only while an agent is active), so it stays a render
+* concern; the measured box is not.
+*/
+function pillStyle(box, selectorWidth, inset = PILL_ROW_INSET) {
+	return {
+		position: "absolute",
+		left: box.dx - inset - selectorWidth,
+		top: box.cy,
+		transform: "translateY(-50%)"
+	};
+}
+
 //#endregion
 //#region src/client/HubPanelIcon.tsx
 /** Runtime-mark edge inside the selector, and the chevron's own default edge. */
@@ -3893,8 +3998,6 @@ const CHEVRON_SIZE = 14;
 const SELECTOR_HEIGHT = 28;
 const SELECTOR_PAD = 8;
 const SELECTOR_GAP = 4;
-/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
-const ROW_INSET = 8;
 function HubPanelIcon({ size }) {
 	const wide = size <= 16;
 	const rootRef = react.useRef(null);
@@ -3917,16 +4020,25 @@ function HubPanelIcon({ size }) {
 	}, [fusion]);
 	const measure = react.useCallback(() => {
 		const row = rootRef.current?.closest("button") ?? null;
-		if (row === null) {
+		const wrap = selectorRef.current?.parentElement ?? null;
+		if (row === null || wrap === null) {
 			setBox(null);
 			return;
 		}
-		const rect = row.getBoundingClientRect();
-		setBox((prev) => prev !== null && prev.top === rect.top && prev.bottom === rect.bottom && prev.right === rect.right ? prev : {
-			top: rect.top,
-			bottom: rect.bottom,
-			right: rect.right
+		const rowRect = row.getBoundingClientRect();
+		const wrapRect = wrap.getBoundingClientRect();
+		const next = measurePillBox({
+			row: {
+				top: rowRect.top,
+				bottom: rowRect.bottom,
+				right: rowRect.right
+			},
+			wrap: {
+				left: wrapRect.left,
+				top: wrapRect.top
+			}
 		});
+		setBox((prev) => prev !== null && prev.dx === next.dx && prev.cy === next.cy ? prev : next);
 	}, []);
 	react.useLayoutEffect(() => {
 		if (!wide || !switchUi.available) return;
@@ -4036,7 +4148,7 @@ function HubPanelIcon({ size }) {
 		children: [
 			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(HubGlyph, { size }),
 			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SuperdToastHost, {}),
-			wide && box !== null && switchUi.available && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__deepseek_ai_dsh_client_ui_primitives.Menu, {
+			wide && switchUi.available && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__deepseek_ai_dsh_client_ui_primitives.Menu, {
 				open,
 				onClose: () => {
 					setOpen(false);
@@ -4057,10 +4169,11 @@ function HubPanelIcon({ size }) {
 					"aria-expanded": open,
 					title: activeLabel === void 0 ? "Agent selector" : `Agent selector: ${activeLabel}`,
 					style: {
-						position: "fixed",
-						left: box.right - ROW_INSET - selectorWidth,
-						top: box.top + (box.bottom - box.top) / 2,
-						transform: "translateY(-50%)",
+						...pillStyle(box ?? {
+							dx: 0,
+							cy: 0
+						}, selectorWidth),
+						visibility: box === null ? "hidden" : "visible",
 						display: "inline-flex",
 						alignItems: "center",
 						justifyContent: "center",
@@ -4105,9 +4218,17 @@ const inject = ["slots"];
 * absent (a composition without the sidebar renders nothing — every seat
 * here is an optional occupant by contract).
 *
-* @param ctx - client root context.
+* Live-install staleness: the fusion flag is baked into the SERVED index, so
+* a page that booted before super-dsh was installed carries no flag even
+* though this very apply is the hot-loaded client half — the Hub row would
+* render with every switch affordance hidden until a manual restart. When
+* the flag is absent the entry probes the roster's `hub.fusion` once and
+* re-boots the page on an armed host (switch.ts `probeStaleFusionPage`; the
+* sessionStorage marker bounds it to one reload per tab session). A flag-off
+* deployment answers `false` and keeps the T-E inert shape with no reload.
 */
 function apply(ctx) {
+	if (!fusionPage()) probeStaleFusionPage();
 	ctx.inject(["slots"], (raw) => {
 		const scope = raw;
 		scope.effect(() => scope.slots.inject("main", () => scope.slots.register({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.1",
+  "version": "0.3.2-d",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",

package/remote/helper-bin/MANIFEST.json

@@ -0,0 +1,35 @@
+{
+  "format": 1,
+  "name": "superd-run",
+  "ver": "0.3.1-d.b596",
+  "protocol": 1,
+  "targets": {
+    "aarch64-apple-darwin": {
+      "file": "superd-run",
+      "bytes": 337808,
+      "sha256": "a8fd11a5e6a2cb146deb599414434a299ebf78c53cfc1d3e5f42617ee11c1706"
+    },
+    "aarch64-unknown-linux-musl": {
+      "file": "superd-run",
+      "bytes": 397592,
+      "sha256": "3a8660fa099f1e71de6e08313ee2aaace00503f74365475ee46e2d2a89228397"
+    },
+    "x86_64-pc-windows-gnu": {
+      "file": "superd-run.exe",
+      "bytes": 337408,
+      "sha256": "1372450238c5bda702b4529f4148aa79e80a255c3c125d1a6229afd4693e9d90"
+    },
+    "x86_64-unknown-linux-musl": {
+      "file": "superd-run",
+      "bytes": 447152,
+      "sha256": "05b428657942abf22a0ad609433d5cab6b6182fe389851345459a0274b5a6533"
+    }
+  },
+  "sources": {
+    "Cargo.toml": "129ab8360e9da872f9dfd6e713d81fe1389735a74d781f3d9c15e110f92d2757",
+    "build.rs": "c4fb356956b1ec700e99bdeca07d657a7d3b2a4026582db136411676da3d125e",
+    "src/main.rs": "47f1648ea1abc30583839edab219a9062c83d57be981c0505ab6bf79c6fbff54",
+    "src/unix.rs": "56c5f523b7b1a9efd50ef24ccdabc024bc065dd2f904fdbecdf0ca49fe7f3393",
+    "src/windows.rs": "6c1537424b1adc05ed17c7cf8bf376fb5711602b9da1697d596155bf21d541da"
+  }
+}

package/remote/helper-bin/aarch64-apple-darwin/BUILT-VER

@@ -0,0 +1 @@
+0.3.1-d.b596

package/remote/helper-bin/aarch64-unknown-linux-musl/BUILT-VER

@@ -0,0 +1 @@
+0.3.1-d.b596

package/remote/helper-bin/x86_64-pc-windows-gnu/BUILT-VER

@@ -0,0 +1 @@
+0.3.1-d.b596

package/remote/helper-bin/x86_64-unknown-linux-musl/BUILT-VER

@@ -0,0 +1 @@
+0.3.1-d.b596

package/remote/hub-pty-pump.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+// Hub PTY pump — the DUMB child of the canonical PTY session over a Hub
+// machine (0.3.2-c). The session (better-dsh/src/remote/pty-session.ts)
+// spawns `script -qfec 'stty -echo; … exec node <this file>' /dev/null`, so
+// this process's stdin/stdout ride a host-side PTY; we forward those bytes
+// over one WebSocket to the peer hub's dumb PTY executor
+// (/api/superd/exec/pty: one WS = one `script -qfec bash /dev/null`, text
+// frames = stream bytes, {"op":…} JSON frames = transport control, WS close
+// = peer group-kill). All session intelligence (nonce framing, init
+// handshake, env E-frames, two-stage interrupt, idle TTL) is in-band bytes
+// produced by the SESSION — this pump never parses the stream, only the
+// peer's control frames.
+//
+// Connection facts arrive via environment (never argv — credentials must not
+// show up in `ps`):
+//   SUPERD_HUB_PTY_URL     wss://…/api/superd/exec/pty (peer executor)
+//   SUPERD_HUB_PTY_COOKIE  pairing cookie for the upgrade request
+//   SUPERD_HUB_PTY_WS      ABSOLUTE path to a usable `ws` module (resolved by
+//                          the caller before spawning; no resolution gamble
+//                          here — a missing module is a creation-time error)
+//
+// Verbatim-asset discipline (helper-bin precedent): this file is copied
+// byte-for-byte into lib/remote/ and the Super closure; no build step
+// transforms it. Crash-proof by construction (mesh-gateway lesson): the
+// 'error' listener is registered before anything can reject, and post-close
+// sends are swallowed — the session's death path owns the teardown.
+const PUMP_ENV_PREFIX = 'SUPERD_HUB_PTY_'
+const [url, cookie, wsPath] = ['URL', 'COOKIE', 'WS'].map((k) => process.env[`SUPERD_HUB_PTY_${k}`])
+
+// cookie may be legitimately empty (an unauthenticated test lane sends no header);
+// the endpoint URL and the ws module path are the hard requirements.
+if (url === undefined || url === '' || wsPath === undefined || wsPath === '') {
+  process.stderr.write(`hub-pty-pump: missing environment (${PUMP_ENV_PREFIX}URL/WS)\n`)
+  process.exit(1)
+}
+
+let WebSocket
+try {
+  const require = (await import('node:module')).createRequire(import.meta.url)
+  const mod = require(wsPath)
+  WebSocket = typeof mod === 'function' ? mod : mod.default
+} catch (err) {
+  process.stderr.write(`hub-pty-pump: cannot load ws module at ${wsPath} — ${err instanceof Error ? err.message : String(err)}\n`)
+  process.exit(1)
+}
+if (typeof WebSocket !== 'function') {
+  process.stderr.write('hub-pty-pump: the ws module did not yield a WebSocket constructor\n')
+  process.exit(1)
+}
+
+const socket = new WebSocket(url, { headers: cookie ? { cookie } : {} })
+let opened = false
+let forward = true
+
+socket.on('error', (err) => {
+  // Always-on listener: an ECONNREFUSED or a rejected 401 upgrade must be a
+  // reported death, never an uncaught exception.
+  process.stderr.write(`hub-pty-pump: ${opened ? 'socket error' : 'connect failed'} — ${err instanceof Error ? err.message : String(err)}\n`)
+})
+socket.on('open', () => { opened = true; pumpStdin() })
+socket.on('message', (data) => {
+  if (!forward) return
+  const text = typeof data === 'string' ? data : Array.isArray(data) ? Buffer.concat(data).toString('utf8') : Buffer.from(data).toString('utf8')
+  // Transport control frames (peer: {"op":"exit"} / {"op":"spawn-error"}) are
+  // addressed to THIS pump, not to the shell stream — the exit frame is
+  // followed by a socket close, which settles us below.
+  if (text.startsWith('{"op":')) {
+    try {
+      const parsed = JSON.parse(text)
+      if (typeof parsed.op === 'string') {
+        if (parsed.op === 'spawn-error' && typeof parsed.error === 'string') process.stderr.write(`hub-pty-pump: peer could not spawn the terminal — ${parsed.error}\n`)
+        return
+      }
+    } catch { /* not JSON after all: fall through and forward */ }
+  }
+  process.stdout.write(text)
+})
+socket.on('close', () => {
+  forward = false
+  // Before open this is a failed connection (diag already on stderr); after
+  // open it is the peer session ending — either way the child exiting is the
+  // session's dead signal.
+  process.exit(opened ? 0 : 1)
+})
+
+function pumpStdin() {
+  process.stdin.setEncoding('utf8')
+  process.stdin.on('data', (chunk) => {
+    if (!opened) return
+    try { socket.send(chunk) } catch { /* closing: the close handler exits us */ }
+  })
+  // The session's kill path tears down the process group; a plain stdin end
+  // (no kill) still means nobody will type more — close politely so the peer
+  // reaps its side.
+  process.stdin.on('end', () => { try { socket.close() } catch { /* already closing */ } })
+  process.stdin.on('error', () => { /* EPIPE on teardown: the close path owns the exit */ })
+}