@blue-soda/dsh-remote 0.5.5 → 0.5.7

package/dist/index.js

@@ -13521,7 +13521,7 @@ function normalizeServerUrl(value) {
 }
 
 // src/version.ts
-var PLUGIN_VERSION = "0.5.5";
+var PLUGIN_VERSION = "0.5.7";
 
 // src/server-api.ts
 var ENABLED_QR_PROVIDERS = ["github"];
@@ -13998,6 +13998,7 @@ function requireRecord(value, name2) {
 
 // src/server-connection.ts
 var DEFAULT_WEBRTC_NEGOTIATE_TIMEOUT_MS = 12e3;
+var CLOSE_DRAIN_TIMEOUT_MS = 5e3;
 var HostServerConnection = class {
   constructor(config, identity, identities, api, connections, logger, createWebSocket = (url) => new WebSocket(url), rtcFactoryProvider, hostCapabilities = () => ["harness.api.v1"], harnessVersion) {
     this.config = config;
@@ -14041,7 +14042,7 @@ var HostServerConnection = class {
     }
     if (this.resumeQueued) return;
     this.resumeQueued = true;
-    void this.running.finally(() => {
+    void this.running.catch(() => void 0).finally(() => {
       this.resumeQueued = false;
       if (!this.stopped) this.start();
     });
@@ -14077,7 +14078,7 @@ var HostServerConnection = class {
     this.reconnectRequested = true;
     this.retryWake?.();
     this.socket?.close(4e3, "manual reconnect");
-    void this.running.finally(() => {
+    void this.running.catch(() => void 0).finally(() => {
       if (!this.reconnectRequested || this.stopped) return;
       this.reconnectRequested = false;
       this.start();
@@ -14107,7 +14108,7 @@ var HostServerConnection = class {
           ...connectionFailureDetail(error)
         });
         if (TERMINAL_AUTH_ERRORS.has(code)) {
-          this.logger.warn(code === "CONNECTION_REPLACED" ? "Another instance is using this Host identity. Standing by: retrying in five minutes, and taking over as soon as it leaves." : code === "SERVER_CREDENTIALS_BUSY" ? "Credential refresh is locked. Stop other instances; after a crash, stop all instances before removing server-credentials.json.refresh-lock and authorizing again." : "Host authorization failed. Run /remote login or authorize this Host again in Remote settings.");
+          this.logger.warn(code === "CONNECTION_REPLACED" ? "Another instance is using this Host identity. Standing by: retrying in five minutes, and taking over as soon as it leaves." : code === "SERVER_CREDENTIALS_BUSY" ? "Credential refresh is locked. Stop other instances; after a crash, stop all instances before removing server-credentials.json.refresh-lock and authorizing again." : code === "CONTROL_DISABLED" ? 'This device is not accepting control. Turn on "Allow control of this device" to reconnect.' : "Host authorization failed. Run /remote login or authorize this Host again in Remote settings.");
         }
         if (code === "DEVICE_REVOKED" || code === "AUTH_INVALID") {
           try {
@@ -14166,9 +14167,25 @@ var HostServerConnection = class {
         });
       };
       socket.onmessage = (event) => {
+        let frame;
+        try {
+          frame = decodeControl(event.data, this.controlFrameLimits);
+        } catch (error) {
+          this.controlFrameFailed(socket, error);
+          return;
+        }
+        this.lastActiveAt = Date.now();
+        if (acknowledged && (frame.type === "ping" || frame.type === "pong")) {
+          if (frame.type === "pong") return;
+          const nonce = objectValue(frame.payload, "nonce");
+          if (typeof nonce !== "string") {
+            this.controlFrameFailed(socket, new ControlConnectionError("INVALID_MESSAGE", "Control ping has no nonce."));
+            return;
+          }
+          this.sendControl("pong", { nonce });
+          return;
+        }
         messageQueue = messageQueue.then(async () => {
-          const frame = decodeControl(event.data, this.controlFrameLimits);
-          this.lastActiveAt = Date.now();
           if (frame.type === "hello.ack") {
             const payload = requireHelloAck(frame.payload);
             this.authRecoveryAttempted = false;
@@ -14193,13 +14210,7 @@ var HostServerConnection = class {
           if (!acknowledged) throw new ControlConnectionError("INVALID_MESSAGE", "Server sent a frame before hello.ack.");
           await this.handleFrame(frame);
         }).catch((error) => {
-          const code = errorCode2(error);
-          this.terminalError = code;
-          this.logger.error("server control frame failed", {
-            code,
-            reason: diagnosticReason(error)
-          });
-          socket.close(4008, "invalid control frame");
+          this.controlFrameFailed(socket, error);
         });
       };
       socket.onerror = (event) => {
@@ -14209,7 +14220,7 @@ var HostServerConnection = class {
       };
       socket.onclose = (event) => {
         const close = async () => {
-          await messageQueue.catch(() => void 0);
+          await drainWithin(messageQueue, CLOSE_DRAIN_TIMEOUT_MS);
           if (this.stopped) {
             finish();
             return;
@@ -14237,13 +14248,23 @@ var HostServerConnection = class {
             finish(new ControlConnectionError("DEVICE_REVOKED", "The Server revoked this Host device."));
             return;
           }
-          if (acknowledged) this.terminalError = closeCode(event.code);
-          finish(acknowledged ? void 0 : new ControlConnectionError(closeCode(event.code), event.reason || "Server control connection closed."));
+          if (acknowledged) this.terminalError = closeCode(event.code, event.reason);
+          finish(acknowledged ? void 0 : new ControlConnectionError(closeCode(event.code, event.reason), event.reason || "Server control connection closed."));
         };
         void close();
       };
     });
   }
+  /** Record a frame failure and close the socket, so the run retries from a clean state. */
+  controlFrameFailed(socket, error) {
+    const code = errorCode2(error);
+    this.terminalError = code;
+    this.logger.error("server control frame failed", {
+      code,
+      reason: diagnosticReason(error)
+    });
+    socket.close(4008, "invalid control frame");
+  }
   async handleFrame(frame) {
     if (frame.type === "ping") {
       const nonce = objectValue(frame.payload, "nonce");
@@ -14705,10 +14726,25 @@ var HostServerConnection = class {
   }
 };
 var REPLACED_FIRST_RETRY_MS = 65e3;
+async function drainWithin(promise, ms) {
+  let timer;
+  try {
+    await Promise.race([
+      promise.catch(() => void 0),
+      new Promise((resolve4) => {
+        timer = setTimeout(resolve4, ms);
+        timer.unref?.();
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
 var TERMINAL_AUTH_ERRORS = /* @__PURE__ */ new Set([
   "SERVER_CREDENTIALS_BUSY",
   "ACCOUNT_AUTH_REQUIRED",
   "AUTH_INVALID",
+  "CONTROL_DISABLED",
   "DEVICE_OWNERSHIP_REQUIRED",
   "DEVICE_REVOKED",
   "TOKEN_EXPIRED"
@@ -14926,14 +14962,25 @@ function errorCode2(error) {
 function isRetryable(error) {
   return !TERMINAL_AUTH_ERRORS.has(errorCode2(error)) && (!(error instanceof ServerApiError) || error.retryable);
 }
-function closeCode(code) {
+function closeCode(code, reason) {
   if (code === 4002) return "AUTH_INVALID";
   if (code === 4003) return "CONNECTION_REPLACED";
   if (code === 4004) return "DEVICE_REVOKED";
   if (code === 4007) return "RATE_LIMITED";
   if (code === 4011) return "UNSUPPORTED_VERSION";
+  if (code === 4001 && reason !== void 0 && REJECTED_HELLO_CODES.has(reason)) return reason;
   return "CONNECTION_FAILED";
 }
+var REJECTED_HELLO_CODES = /* @__PURE__ */ new Set([
+  "AUTH_REQUIRED",
+  "AUTH_INVALID",
+  "TOKEN_EXPIRED",
+  "DEVICE_REVOKED",
+  "CONTROL_DISABLED",
+  "MEMBERSHIP_REQUIRED",
+  "UNSUPPORTED_VERSION",
+  "RATE_LIMITED"
+]);
 
 // src/loopback-preview.ts
 import { randomBytes as randomBytes7, randomUUID } from "node:crypto";
@@ -15512,7 +15559,7 @@ var CodexRemoteClient = class {
     if (!isRecord(result) || !Array.isArray(result.data))
       throw invalidResponse("thread list");
     return {
-      sessions: result.data.map(projectCodexThread).filter((value) => value !== void 0),
+      sessions: uniqueCodexThreadRows(result.data).map(projectCodexThread).filter((value) => value !== void 0),
       ...typeof result.nextCursor === "string" ? { nextCursor: result.nextCursor } : {}
     };
   }
@@ -15666,6 +15713,33 @@ function projectCodexThread(value) {
     ...typeof value.isPinned === "boolean" ? { pinned: value.isPinned } : {}
   };
 }
+var THREAD_ID_KEY = /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/u;
+var LEGACY_ROW_KEY = /^([A-Za-z0-9][A-Za-z0-9._-]{0,255})~[^~]{0,64}~[0-9]{1,9}$/u;
+function codexThreadIdFromKey(key) {
+  if (THREAD_ID_KEY.test(key))
+    return key;
+  return LEGACY_ROW_KEY.exec(key)?.[1];
+}
+function rowFreshness(row) {
+  for (const field of ["updatedAt", "createdAt"]) {
+    const value = row[field];
+    if (typeof value === "number" && Number.isFinite(value))
+      return value;
+  }
+  return 0;
+}
+function uniqueCodexThreadRows(values) {
+  const byThread = /* @__PURE__ */ new Map();
+  for (const value of values) {
+    if (!isRecord(value) || typeof value.id !== "string" || value.id.length === 0)
+      continue;
+    const threadId = codexThreadIdFromKey(value.id) ?? value.id;
+    const current = byThread.get(threadId);
+    if (current === void 0 || rowFreshness(value) > rowFreshness(current))
+      byThread.set(threadId, value);
+  }
+  return [...byThread.values()];
+}
 function deriveCodexCwdWorkspaces(values) {
   const byPath = /* @__PURE__ */ new Map();
   const usedIds = /* @__PURE__ */ new Set();
@@ -16866,7 +16940,7 @@ var RemoteHarnessApiProxy = class {
       if (committed.transferId !== transferId || committed.totalBytes <= 0 || committed.totalBytes > MAX_HARNESS_API_TRANSFER_BYTES || committed.totalChunks !== Math.ceil(committed.totalBytes / HARNESS_API_TRANSFER_CHUNK_BYTES)) {
         throw new Error("The remote Host returned an invalid Harness API transfer descriptor.");
       }
-      const responseBytes = new Uint8Array(committed.totalBytes);
+      const responseBytes2 = new Uint8Array(committed.totalBytes);
       let offset = 0;
       for (let index = 0; index < committed.totalChunks; index += 1) {
         const result = await this.client.rpc(
@@ -16882,10 +16956,10 @@ var RemoteHarnessApiProxy = class {
         if (chunk.byteLength !== expectedBytes) {
           throw new Error("The remote Host returned an invalid Harness API transfer chunk.");
         }
-        responseBytes.set(chunk, offset);
+        responseBytes2.set(chunk, offset);
         offset += chunk.byteLength;
       }
-      return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(responseBytes));
+      return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(responseBytes2));
     } finally {
       if (opened) {
         await this.client.rpc("harness.api.transfer.close", { transferId }).catch(() => void 0);
@@ -17360,7 +17434,7 @@ var RemoteTypertGateway2 = class {
       if (committed.transferId !== transferId || committed.totalBytes <= 0 || committed.totalBytes > MAX_HARNESS_API_TRANSFER_BYTES || committed.totalChunks !== Math.ceil(committed.totalBytes / HARNESS_API_TRANSFER_CHUNK_BYTES)) {
         throw new Error("The remote Host returned an invalid Harness Remote transfer descriptor.");
       }
-      const responseBytes = new Uint8Array(committed.totalBytes);
+      const responseBytes2 = new Uint8Array(committed.totalBytes);
       let offset = 0;
       for (let index = 0; index < committed.totalChunks; index += 1) {
         const result = await this.client.rpc(
@@ -17376,10 +17450,10 @@ var RemoteTypertGateway2 = class {
         if (chunk.byteLength !== expectedBytes) {
           throw new Error("The remote Host returned an invalid Harness Remote transfer chunk.");
         }
-        responseBytes.set(chunk, offset);
+        responseBytes2.set(chunk, offset);
         offset += chunk.byteLength;
       }
-      return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(responseBytes));
+      return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(responseBytes2));
     } finally {
       if (opened) await this.client.rpc("harness.remote.transfer.close", { transferId }).catch(() => void 0);
     }
@@ -17540,6 +17614,17 @@ function record(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 
+// src/codex/session-id.ts
+var SESSION_PREFIX = "codex:";
+function parseCodexSessionId(value) {
+  if (typeof value !== "string" || !value.startsWith(SESSION_PREFIX)) return void 0;
+  const threadId = codexThreadIdFromKey(value.slice(SESSION_PREFIX.length));
+  return threadId === void 0 ? void 0 : { sessionId: value, threadId };
+}
+function resolveCodexThreadKey(key) {
+  return codexThreadIdFromKey(key) ?? key;
+}
+
 // src/codex/method-policy.ts
 var id2 = external_exports.string().min(1).max(256);
 var cursor = external_exports.string().min(1).max(4096).nullable().optional();
@@ -19411,7 +19496,7 @@ async function loadCatalog(client, signal, pendingThreads) {
       updatedAt: workspace.updatedAt
     }));
   }
-  const projected = threads.map((thread) => {
+  const projected = uniqueCodexThreadRows(threads).map((thread) => {
     const session = projectCodexThread(thread);
     return session === void 0 ? void 0 : { thread, session };
   }).filter((value) => value !== void 0);
@@ -20121,10 +20206,9 @@ function sessionIdFromAddress(address) {
   return requiredString(address.childSessionId, "childSessionId");
 }
 function nativeThreadId(sessionId) {
-  if (!sessionId.startsWith(CODEX_SESSION_PREFIX) || sessionId.length === CODEX_SESSION_PREFIX.length) {
-    throw new Error("The selected Session does not belong to CodeX.");
-  }
-  return sessionId.slice(CODEX_SESSION_PREFIX.length);
+  const parsed = parseCodexSessionId(sessionId);
+  if (parsed === void 0) throw new Error("The selected Session does not belong to CodeX.");
+  return parsed.threadId;
 }
 function activeTurnId(value) {
   if (!Array.isArray(value)) return void 0;
@@ -24679,8 +24763,9 @@ var CodexPeerBridge = class {
       method: "thread/read",
       params: { threadId: params.threadId, includeTurns: false }
     });
-    this.streams.set(params.streamId, params.threadId);
-    return { opened: true, streamId: params.streamId, threadId: params.threadId };
+    const threadId = resolveCodexThreadKey(params.threadId);
+    this.streams.set(params.streamId, threadId);
+    return { opened: true, streamId: params.streamId, threadId };
   }
   closeStream(input2) {
     const params = streamCloseSchema.parse(input2);
@@ -24759,22 +24844,22 @@ var CodexPeerBridge = class {
       });
       throw error;
     }
-    const responseBytes = new TextEncoder().encode(JSON.stringify(response));
-    if (responseBytes.byteLength <= INLINE_TRANSFER_RESPONSE_BYTES) return { kind: "inline", response };
-    if (responseBytes.byteLength > MAX_CODEX_APP_TRANSFER_BYTES) {
+    const responseBytes2 = new TextEncoder().encode(JSON.stringify(response));
+    if (responseBytes2.byteLength <= INLINE_TRANSFER_RESPONSE_BYTES) return { kind: "inline", response };
+    if (responseBytes2.byteLength > MAX_CODEX_APP_TRANSFER_BYTES) {
       throw new RpcError("RESPONSE_TOO_LARGE", "The Codex response exceeds the bounded transfer limit.");
     }
     if (this.outgoingTransfers.size >= MAX_ACTIVE_TRANSFERS) {
       throw new RpcError("RATE_LIMITED", "Too many Codex response transfers are active.", void 0, true);
     }
-    const totalChunks = Math.ceil(responseBytes.byteLength / CODEX_APP_TRANSFER_CHUNK_BYTES);
+    const totalChunks = Math.ceil(responseBytes2.byteLength / CODEX_APP_TRANSFER_CHUNK_BYTES);
     this.outgoingTransfers.set(params.transferId, {
-      bytes: responseBytes,
+      bytes: responseBytes2,
       totalChunks,
       nextIndex: 0,
       touchedAt: Date.now()
     });
-    return { kind: "chunked", transferId: params.transferId, totalBytes: responseBytes.byteLength, totalChunks };
+    return { kind: "chunked", transferId: params.transferId, totalBytes: responseBytes2.byteLength, totalChunks };
   }
   readTransfer(input2) {
     this.requireOpen();
@@ -25026,9 +25111,7 @@ var CodexRemoteDomain = class {
       }));
     }
     if (isRecord12(call.params) && typeof call.params.threadId === "string") {
-      const rowKey = call.params.threadId;
-      const separator = rowKey.indexOf("~");
-      if (separator > 0) call.params.threadId = rowKey.slice(0, separator);
+      call.params.threadId = resolveCodexThreadKey(call.params.threadId);
     }
     if (call.method === "thread/list") {
       const result = sanitizeThreadList(await this.callUpstream(call.method, call.params));
@@ -25038,10 +25121,7 @@ var CodexRemoteDomain = class {
       );
       return {
         ...authorized,
-        data: authorized.data.map((row, index) => ({
-          ...row,
-          id: `${String(row.id)}~${String(row.createdAt ?? "")}~${index}`
-        }))
+        data: uniqueCodexThreadRows(authorized.data)
       };
     }
     if (call.method === "thread/start") {
@@ -26546,12 +26626,14 @@ var PluginControlRuntime = class {
   /** Consecutive reconciliations without a DSH session: DSH refreshes its grant, so one empty read is not a sign-out. */
   /** Guards against re-entry through configure(), which reads the settings view back. */
   reconcilingWithDeepSeek = false;
+  /** The authorization exchange in flight; a settings poll must not start a second one. */
+  deepseekAuthorization;
   /**
    * Keep this device's Server credentials in step with DSH's DeepSeek session - that session is the credential, and
    * the Server verifies it before issuing this device its own tokens.
    *
    * Three cases: DSH signed in and this device not authorized -> authorize; DSH signed out and this device authorized
-   * -> sign out; otherwise nothing. At most once per ten seconds, from the settings poll the panel already makes.
+   * -> sign out; otherwise nothing. At most one exchange at a time, from the settings poll the panel already makes.
    */
   async reconcileWithDeepSeek() {
     if (this.deepseekSession === void 0 || this.reconcilingWithDeepSeek) return;
@@ -26560,19 +26642,20 @@ var PluginControlRuntime = class {
       const session = await this.deepseekSession.read();
       if (this.client !== void 0) this.client.hasDeepSeekSession = session !== void 0;
       const authorized = this.client === void 0 ? false : await this.client.hasServerAuthorization();
-      console.error(`[dsh-remote] reconcile ${JSON.stringify({ hasSession: session !== void 0, authorized })}`);
       if (session === void 0 && authorized) {
         await this.logout({ releaseDeepSeek: false });
         return;
       }
       if (session === void 0 || authorized) return;
+      if (this.deepseekAuthorization !== void 0) return;
       if (this.client !== void 0) this.client.authorizingWithDeepSeek = true;
-      void (async () => {
+      this.deepseekAuthorization = (async () => {
         try {
           await this.configure({ provider: "deepseek", serverUrl: this.config.serverUrl });
         } catch (error) {
           console.error(`[dsh-remote] reconcile failed ${JSON.stringify({ code: String(error?.code ?? "") })}`);
         } finally {
+          this.deepseekAuthorization = void 0;
           if (this.client !== void 0) this.client.authorizingWithDeepSeek = false;
         }
       })();
@@ -26724,13 +26807,6 @@ function redact(value, key = "") {
   return Object.fromEntries(Object.entries(value).map(([childKey, child]) => [childKey, redact(child, childKey)]));
 }
 
-// src/codex/session-id.ts
-function parseCodexSessionId(value) {
-  if (typeof value !== "string") return void 0;
-  const match = /^codex:([A-Za-z0-9][A-Za-z0-9._-]{0,255})$/.exec(value);
-  return match === null ? void 0 : { sessionId: value, threadId: match[1] };
-}
-
 // src/terminal-policy.ts
 var TERMINAL_CALLS = /* @__PURE__ */ new Set([
   "terminal/environment",
@@ -26744,6 +26820,7 @@ var TERMINAL_CALLS = /* @__PURE__ */ new Set([
 ]);
 var TERMINAL_STREAMS = /* @__PURE__ */ new Set(["terminal/follow", "terminal/retain"]);
 var id3 = external_exports.string().regex(/^[A-Za-z0-9_:-]{1,256}$/);
+var sessionKey = external_exports.string().regex(/^[A-Za-z0-9_:~-]{1,512}$/);
 var TerminalPolicy = class {
   constructor(enabled, deviceId, owners) {
     this.enabled = enabled;
@@ -26758,7 +26835,7 @@ var TerminalPolicy = class {
     );
     const args = external_exports.object({ args: external_exports.record(external_exports.unknown()) }).strict().parse(payload).args;
     const rawSessionId = args.agentId ?? args.sessionId;
-    const sessionId = id3.parse(rawSessionId);
+    const sessionId = sessionKey.parse(rawSessionId);
     const codexSession = parseCodexSessionId(sessionId);
     void codexSession;
     if (endpoint === "terminal/environment" || endpoint === "terminal/shells" || endpoint === "terminal/list") return {};
@@ -27391,8 +27468,8 @@ async function callHistoryWithRetry(callWithTimeout, payload, rpcId2, pageSizes)
   }
   throw new RpcError("INTERNAL_ERROR", "Failed to load session history with a fallback page size.");
 }
-function sessionHistoryFallbackPageSizes(requestedMaxMessages) {
-  const requested = normalizeSessionHistoryPageSize(requestedMaxMessages);
+function sessionHistoryFallbackPageSizes(requestedMaxMessages2) {
+  const requested = normalizeSessionHistoryPageSize(requestedMaxMessages2);
   const sizes = [];
   if (requested === void 0) {
     sizes.push(...SESSION_HISTORY_PAGE_SIZES);
@@ -27755,25 +27832,25 @@ var HarnessApiBridge = class {
     }
     const nativeRequest = callSchema2.parse(request);
     const response = await this.call(nativeRequest);
-    const responseBytes = new TextEncoder().encode(JSON.stringify(response));
-    if (responseBytes.byteLength <= INLINE_TRANSFER_RESPONSE_BYTES2) {
+    const responseBytes2 = new TextEncoder().encode(JSON.stringify(response));
+    if (responseBytes2.byteLength <= INLINE_TRANSFER_RESPONSE_BYTES2) {
       return { kind: "inline", response };
     }
-    if (responseBytes.byteLength > MAX_HARNESS_API_TRANSFER_BYTES) {
+    if (responseBytes2.byteLength > MAX_HARNESS_API_TRANSFER_BYTES) {
       throw new RpcError("RESPONSE_TOO_LARGE", "The Harness API response exceeds the bounded transfer limit.");
     }
     this.pruneTransfers();
     if (this.outgoingTransfers.size >= MAX_ACTIVE_API_TRANSFERS) {
       throw new RpcError("RATE_LIMITED", "Too many Harness API response transfers are active.", void 0, true);
     }
-    const totalChunks = Math.ceil(responseBytes.byteLength / HARNESS_API_TRANSFER_CHUNK_BYTES);
+    const totalChunks = Math.ceil(responseBytes2.byteLength / HARNESS_API_TRANSFER_CHUNK_BYTES);
     this.outgoingTransfers.set(params.transferId, {
-      bytes: responseBytes,
+      bytes: responseBytes2,
       totalChunks,
       nextIndex: 0,
       touchedAt: Date.now()
     });
-    return { kind: "chunked", transferId: params.transferId, totalBytes: responseBytes.byteLength, totalChunks };
+    return { kind: "chunked", transferId: params.transferId, totalBytes: responseBytes2.byteLength, totalChunks };
   }
   readTransfer(input2) {
     this.pruneTransfers();
@@ -28194,6 +28271,7 @@ function concatChunks2(chunks, totalBytes) {
 }
 
 // src/harness-remote-bridge.ts
+import { Buffer as Buffer4 } from "node:buffer";
 var endpointSchema = external_exports.string().min(1).max(128).regex(/^(?:\$events(?:\/result)?|[A-Za-z0-9_$.-]+\/[A-Za-z0-9_$.-]+)$/);
 var callSchema3 = external_exports.object({ endpoint: endpointSchema, payload: external_exports.unknown() }).strict();
 var streamOpenSchema3 = external_exports.object({
@@ -28241,6 +28319,13 @@ var directoryListSchema2 = external_exports.object({
 var MAX_ACTIVE_STREAMS2 = MAX_ALPHA_STREAMS_PER_CONNECTION;
 var MAX_ACTIVE_TRANSFERS2 = MAX_ACTIVE_TRANSFERS_PER_DIRECTION;
 var INLINE_TRANSFER_RESPONSE_BYTES3 = 2 * 1024 * 1024;
+var STREAM_FRAME_ENVELOPE_BYTES = 4 * 1024;
+var RESPONSE_ENVELOPE_BYTES = 8 * 1024;
+var HISTORY_PAGE_SIZES = [120, 80, 50, 30, 20, 12, 6, 3, 1];
+var MAX_HISTORY_PAGE_MESSAGES = 500;
+var REMOTE_HISTORY_CALL_ENDPOINTS = /* @__PURE__ */ new Set(["session/page", "session/history"]);
+var REMOTE_HISTORY_STREAM_ENDPOINTS = /* @__PURE__ */ new Set(["session/follow"]);
+var MAX_CACHED_HISTORY_PAGES = 64;
 var HARNESS_REMOTE_ALLOWLIST = [
   "$events",
   "$events/result",
@@ -28329,6 +28414,8 @@ var HarnessRemoteBridge = class {
   streams = /* @__PURE__ */ new Map();
   incomingTransfers = /* @__PURE__ */ new Map();
   outgoingTransfers = /* @__PURE__ */ new Map();
+  /** Last page size that fit one secure message, per session, so probing is paid once. */
+  historyPageSizes = /* @__PURE__ */ new Map();
   /**
    * Answer one remote Gateway call.
    *
@@ -28369,7 +28456,7 @@ var HarnessRemoteBridge = class {
     const signal = AbortSignal.timeout(6e4);
     try {
       const nativePayload = normalizeWorkspaceRequestPayload(params.endpoint, params.payload, this.harnessVersion);
-      const nativeResult = params.endpoint === "commands/execute" ? await dispatchCommandForHost(this.gateway, params.payload, signal, this.harnessVersion) : await this.gateway.dispatch(params.endpoint, nativePayload, signal);
+      const nativeResult = REMOTE_HISTORY_CALL_ENDPOINTS.has(params.endpoint) ? await this.dispatchHistoryPage(params.endpoint, nativePayload, signal) : params.endpoint === "commands/execute" ? await dispatchCommandForHost(this.gateway, params.payload, signal, this.harnessVersion) : await this.gateway.dispatch(params.endpoint, nativePayload, signal);
       const result = params.endpoint === "directoryPicker/list" && needsDirectoryFallback(nativeResult) ? await this.directoryList(params.payload, signal) : nativeResult;
       this.logger?.debug("harness remote call ok", {
         endpoint: params.endpoint,
@@ -28390,7 +28477,10 @@ var HarnessRemoteBridge = class {
       this.logger?.warn("harness remote call failed", {
         endpoint: params.endpoint,
         durationMs: Math.round(performance.now() - startedAt),
-        code: this.gateway.failure(error).code
+        code: this.gateway.failure(error).code,
+        // The code alone is what the client sees; the message is the only thing that says WHY the
+        // Host threw (a strict-schema rejection, an oversized page, a session the gateway lost).
+        message: error instanceof Error ? error.message : String(error)
       });
       throw error;
     }
@@ -28460,22 +28550,22 @@ var HarnessRemoteBridge = class {
       throw new RpcError("INVALID_MESSAGE", "The Harness Remote transfer does not contain a valid request.");
     }
     const response = await this.call(callSchema3.parse(request));
-    const responseBytes = new TextEncoder().encode(JSON.stringify(response));
-    if (responseBytes.byteLength <= INLINE_TRANSFER_RESPONSE_BYTES3) return { kind: "inline", response };
-    if (responseBytes.byteLength > MAX_HARNESS_API_TRANSFER_BYTES) {
+    const responseBytes2 = new TextEncoder().encode(JSON.stringify(response));
+    if (responseBytes2.byteLength <= INLINE_TRANSFER_RESPONSE_BYTES3) return { kind: "inline", response };
+    if (responseBytes2.byteLength > MAX_HARNESS_API_TRANSFER_BYTES) {
       throw new RpcError("RESPONSE_TOO_LARGE", "The Harness Remote response exceeds the bounded transfer limit.");
     }
     if (this.outgoingTransfers.size >= MAX_ACTIVE_TRANSFERS2) {
       throw new RpcError("RATE_LIMITED", "Too many Harness Remote response transfers are active.", void 0, true);
     }
-    const totalChunks = Math.ceil(responseBytes.byteLength / HARNESS_API_TRANSFER_CHUNK_BYTES);
+    const totalChunks = Math.ceil(responseBytes2.byteLength / HARNESS_API_TRANSFER_CHUNK_BYTES);
     this.outgoingTransfers.set(params.transferId, {
-      bytes: responseBytes,
+      bytes: responseBytes2,
       totalChunks,
       nextIndex: 0,
       touchedAt: Date.now()
     });
-    return { kind: "chunked", transferId: params.transferId, totalBytes: responseBytes.byteLength, totalChunks };
+    return { kind: "chunked", transferId: params.transferId, totalBytes: responseBytes2.byteLength, totalChunks };
   }
   readTransfer(input2) {
     this.pruneTransfers();
@@ -28493,7 +28583,7 @@ var HarnessRemoteBridge = class {
     return {
       transferId: params.transferId,
       index: params.index,
-      data: Buffer.from(transfer.bytes.subarray(start, end)).toString("base64")
+      data: Buffer4.from(transfer.bytes.subarray(start, end)).toString("base64")
     };
   }
   closeTransfer(input2) {
@@ -28513,17 +28603,135 @@ var HarnessRemoteBridge = class {
     }
     const controller = new AbortController();
     this.streams.set(params.streamId, { controller });
-    let source;
     try {
-      source = (this.codexWorkspace === void 0 ? void 0 : await this.codexWorkspace.open(params.endpoint, params.payload, controller.signal)) ?? await this.gateway.open(params.endpoint, normalizeWorkspaceChangesPayload(params.endpoint, params.payload, this.harnessVersion), controller.signal);
+      const nativePayload = normalizeWorkspaceChangesPayload(params.endpoint, params.payload, this.harnessVersion);
+      if (REMOTE_HISTORY_STREAM_ENDPOINTS.has(params.endpoint)) {
+        const opened = await this.openHistoryStream(params, nativePayload, controller.signal);
+        void this.pump(params.streamId, opened.source, controller.signal, opened.frame);
+        return { opened: true, streamId: params.streamId };
+      }
+      const source = (this.codexWorkspace === void 0 ? void 0 : await this.codexWorkspace.open(params.endpoint, params.payload, controller.signal)) ?? await this.gateway.open(params.endpoint, nativePayload, controller.signal);
       controller.signal.throwIfAborted();
+      void this.pump(params.streamId, source, controller.signal);
+      return { opened: true, streamId: params.streamId };
     } catch (error) {
       this.streams.delete(params.streamId);
       controller.abort();
+      this.logger?.warn("harness remote stream open failed", {
+        endpoint: params.endpoint,
+        message: error instanceof Error ? error.message : String(error)
+      });
       throw error;
     }
-    void this.pump(params.streamId, source, controller.signal);
-    return { opened: true, streamId: params.streamId };
+  }
+  /**
+   * Open a history stream with its opening page chosen by byte budget.
+   *
+   * `session/follow` yields one snapshot page and then live events. The snapshot cannot be
+   * retried after the stream is handed to the client, so each attempt is pulled here, measured,
+   * and closed again when it would not fit one secure message. The accepted iterator continues
+   * after that first frame, which the pump publishes before the live tail.
+   * @param params - the validated stream-open request.
+   * @param payload - the request payload after endpoint normalization.
+   * @param signal - the stream's cancellation signal.
+   * @returns the remaining source and the measured first frame.
+   */
+  async openHistoryStream(params, payload, signal) {
+    const { key, sizes } = this.historyPageSizesFor(payload);
+    for (const size of sizes) {
+      const source = await this.gateway.open(params.endpoint, withHistoryWindow(payload, size), signal);
+      const iterator = source[Symbol.asyncIterator]();
+      let first;
+      try {
+        first = await iterator.next();
+      } catch (error) {
+        await iterator.return?.();
+        throw error;
+      }
+      if (first.done === true) {
+        await iterator.return?.();
+        return { source: EMPTY_ASYNC_ITERABLE };
+      }
+      const frame = {
+        streamId: params.streamId,
+        hasValue: true,
+        ...first.value === void 0 ? {} : { value: collectRpcAttachments(first.value) }
+      };
+      const bytes = streamFrameBytes(frame);
+      this.logger?.debug("history stream attempt", { endpoint: params.endpoint, size, bytes });
+      if (bytes <= MAX_SECURE_MESSAGE_BYTES - STREAM_FRAME_ENVELOPE_BYTES) {
+        this.rememberHistoryPageSize(key, size);
+        return { source: remainingIterable(iterator), frame };
+      }
+      await iterator.return?.();
+    }
+    throw new RpcError(
+      "RESPONSE_TOO_LARGE",
+      "The Harness history page is too large for the secure Remote channel. Request a smaller page.",
+      { maxBytes: MAX_SECURE_MESSAGE_BYTES },
+      true
+    );
+  }
+  /**
+   * Answer one unary history page with the largest window that still fits.
+   *
+   * DSH's client asks for 500 messages; a session whose only Turn is long answers that with
+   * its whole log, which the 4 MiB secure-message limit cannot carry. Each page is measured
+   * after attachment tagging (the form the wire carries) and the request steps down through
+   * {@link HISTORY_PAGE_SIZES} until it fits. Only a size overflow retries: a business failure
+   * is returned immediately.
+   * @param endpoint - the history endpoint being called.
+   * @param payload - the request payload after endpoint normalization.
+   * @param signal - the call's timeout signal.
+   * @returns the page, or `RESPONSE_TOO_LARGE` when even one message cannot cross.
+   */
+  async dispatchHistoryPage(endpoint, payload, signal) {
+    const { key, sizes } = this.historyPageSizesFor(payload);
+    for (const size of sizes) {
+      const startedAt = performance.now();
+      const result = await this.gateway.dispatch(endpoint, withHistoryWindow(payload, size), signal);
+      if (!result.ok) return result;
+      const value = result.value;
+      const wire = collectRpcAttachments(result);
+      const bytes = responseBytes(wire);
+      this.logger?.debug("history page attempt", {
+        endpoint,
+        size,
+        durationMs: Math.round(performance.now() - startedAt),
+        ok: result.ok,
+        records: Array.isArray(value?.records) ? value.records.length : void 0,
+        hasMore: value?.hasMore,
+        bytes
+      });
+      if (bytes <= MAX_SECURE_MESSAGE_BYTES - RESPONSE_ENVELOPE_BYTES) {
+        this.rememberHistoryPageSize(key, size);
+        return wire;
+      }
+    }
+    return {
+      ok: false,
+      error: {
+        code: "RESPONSE_TOO_LARGE",
+        message: "The Harness history page is too large for the secure Remote channel. Request a smaller page.",
+        details: { maxBytes: MAX_SECURE_MESSAGE_BYTES }
+      }
+    };
+  }
+  /** The ladder for one history request, starting from what last fit for this session. */
+  historyPageSizesFor(payload) {
+    const key = historyPageKey(payload);
+    const requested = requestedMaxMessages(payload) ?? HISTORY_PAGE_SIZES[0];
+    const remembered = this.historyPageSizes.get(key);
+    const start = Math.max(1, Math.min(requested, MAX_HISTORY_PAGE_MESSAGES, remembered ?? requested));
+    this.logger?.debug("history window", { key: key.slice(0, 120), requested, remembered, start });
+    return { key, sizes: historyPageSizes(start) };
+  }
+  rememberHistoryPageSize(key, size) {
+    if (this.historyPageSizes.size >= MAX_CACHED_HISTORY_PAGES && !this.historyPageSizes.has(key)) {
+      const oldest = this.historyPageSizes.keys().next().value;
+      if (oldest !== void 0) this.historyPageSizes.delete(oldest);
+    }
+    this.historyPageSizes.set(key, size);
   }
   closeStream(input2) {
     const params = streamCloseSchema3.parse(input2);
@@ -28539,6 +28747,7 @@ var HarnessRemoteBridge = class {
     this.streams.clear();
     this.incomingTransfers.clear();
     this.outgoingTransfers.clear();
+    this.historyPageSizes.clear();
     for (const [, stream] of streams) stream.controller.abort(reason);
     await this.codexWorkspace?.closeAll();
   }
@@ -28550,17 +28759,28 @@ var HarnessRemoteBridge = class {
       throw new RpcError("FEATURE_NOT_SUPPORTED", "This Harness version does not support Remote event transport.");
     }
   }
-  async pump(streamId, source, signal) {
+  async pump(streamId, source, signal, initialFrame) {
     let reason = "completed";
     let failure2;
     try {
+      if (initialFrame !== void 0 && !signal.aborted) await this.publish("harness.remote.frame", initialFrame);
       for await (const value of source) {
         if (signal.aborted) break;
-        await this.publish("harness.remote.frame", {
+        const frame = {
           streamId,
           hasValue: true,
           ...value === void 0 ? {} : { value: collectRpcAttachments(value) }
-        });
+        };
+        if (streamFrameBytes(frame) > MAX_SECURE_MESSAGE_BYTES - STREAM_FRAME_ENVELOPE_BYTES) {
+          failure2 = {
+            code: "RESPONSE_TOO_LARGE",
+            message: "The Harness stream frame is too large for the secure Remote channel.",
+            details: { maxBytes: MAX_SECURE_MESSAGE_BYTES }
+          };
+          reason = "failed";
+          break;
+        }
+        await this.publish("harness.remote.frame", frame);
       }
       if (signal.aborted) reason = "cancelled";
     } catch (error) {
@@ -28581,6 +28801,77 @@ var HarnessRemoteBridge = class {
     for (const [id4, transfer] of this.outgoingTransfers) if (transfer.touchedAt < cutoff) this.outgoingTransfers.delete(id4);
   }
 };
+function withHistoryWindow(payload, maxMessages) {
+  if (!isRecord14(payload)) return payload;
+  if (Array.isArray(payload.args)) {
+    const [first, ...rest] = payload.args;
+    return isRecord14(first) ? { ...payload, args: [windowedParams(first, maxMessages), ...rest] } : payload;
+  }
+  if (isRecord14(payload.args)) return { ...payload, args: windowedParams(payload.args, maxMessages) };
+  return windowedParams(payload, maxMessages);
+}
+function windowedParams(params, maxMessages) {
+  return isRecord14(params.request) ? { ...params, request: windowedRequest(params.request, maxMessages) } : windowedRequest(params, maxMessages);
+}
+function windowedRequest(request, maxMessages) {
+  const turnWindow = isRecord14(request.turnWindow) ? request.turnWindow : void 0;
+  const next = { ...request, maxMessages };
+  if (turnWindow !== void 0) {
+    next.turnWindow = typeof turnWindow.minMessages === "number" && Number.isFinite(turnWindow.minMessages) ? { ...turnWindow, minMessages: Math.min(turnWindow.minMessages, maxMessages) } : turnWindow;
+  }
+  return next;
+}
+function historyPageSizes(start) {
+  const sizes = [start];
+  for (const size of HISTORY_PAGE_SIZES) if (size < start) sizes.push(size);
+  return sizes;
+}
+function historyRequestOf(payload) {
+  let node = payload;
+  for (let depth = 0; depth < 4; depth += 1) {
+    if (!isRecord14(node)) return void 0;
+    if (Array.isArray(node.args)) {
+      node = node.args[0];
+      continue;
+    }
+    if (isRecord14(node.args)) {
+      node = node.args;
+      continue;
+    }
+    if (isRecord14(node.request)) {
+      node = node.request;
+      continue;
+    }
+    return node;
+  }
+  return void 0;
+}
+function requestedMaxMessages(payload) {
+  const value = historyRequestOf(payload)?.maxMessages;
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+}
+function historyPageKey(payload) {
+  const request = historyRequestOf(payload);
+  if (request === void 0) return "default";
+  const address = request.address ?? request.request ?? request.threadId ?? request.sessionId;
+  if (address === void 0) return "default";
+  try {
+    return JSON.stringify(address);
+  } catch {
+    return "default";
+  }
+}
+function responseBytes(result) {
+  return Buffer4.byteLength(JSON.stringify(result), "utf8");
+}
+function streamFrameBytes(frame) {
+  return Buffer4.byteLength(JSON.stringify(frame), "utf8");
+}
+function remainingIterable(iterator) {
+  return { [Symbol.asyncIterator]: () => iterator };
+}
+var EMPTY_ASYNC_ITERABLE = { async *[Symbol.asyncIterator]() {
+} };
 function normalizeWorkspaceChangesPayload(endpoint, payload, harnessVersion) {
   if (endpoint !== "workspaceFiles/changes" || !requiresWorkspaceChangePath(harnessVersion)) return payload;
   if (!isRecord14(payload) || !isRecord14(payload.args) || Object.hasOwn(payload.args, "path")) return payload;
@@ -28634,7 +28925,7 @@ async function dispatchCommandForHost(gateway, payload, signal, harnessVersion)
   );
 }
 function decodeCanonicalBase643(value) {
-  const bytes = Buffer.from(value, "base64");
+  const bytes = Buffer4.from(value, "base64");
   if (bytes.toString("base64") !== value) throw new RpcError("INVALID_MESSAGE", "The Harness Remote transfer chunk is invalid.");
   return bytes;
 }