@chenacc/agentbridge 0.2.2 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chenacc/agentbridge",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Control local coding agents from a phone through a secure WeChat QR web console.",
   "license": "MIT",
   "type": "module",
@@ -65,7 +65,7 @@
     "verify:responsive": "node scripts/verify-responsive.mjs",
     "verify:guide": "node scripts/verify-product-guide.mjs",
     "verify:release": "node scripts/verify-plugin-release.mjs",
-    "check": "node --check src/server.js && node --check src/cli.js && node --check src/config.js && node --check src/cc-switch-models.js && node --check src/workspaces/workspace-catalog.js && node --check src/conversations/conversation-catalog.js && node --check src/adapters/capabilities.js && node --check src/adapters/claude.js && node --check src/adapters/codex.js && node --check src/adapters/deepseek-harness.js && node --check src/adapters/dsh-desktop.js && node --check src/dsh-desktop-channels.js && node --check src/event-store.js && node --check src/notifier.js && node --check src/attachments.js && node --check src/session-manager.js && node --check integrations/dsh-phone/lib/index.js && node --check src/tunnel.js && node --check src/remote.js && node --check src/adapters/zcode-native.js && node --check public/adapter-capabilities.js && node --check public/workspace-navigation.js && node --check public/markdown.js && node --check public/highlight.js && node --check public/transcript.js && node --check public/app.js && node --check scripts/verify-workspace-ui.mjs && node --check scripts/verify-message-blocks.mjs && node --check scripts/verify-background-scrim.mjs && node --check scripts/verify-model-control.mjs && node --check scripts/verify-notifications.mjs && node --check scripts/verify-attachments.mjs && node --check scripts/verify-features.mjs && node --check scripts/verify-quick-nav.mjs && node --check scripts/verify-questions.mjs && node --check scripts/verify-responsive.mjs && node --check scripts/verify-product-guide.mjs && node --check scripts/verify-plugin-release.mjs && node --check scripts/capture-screenshots.mjs",
+    "check": "node --check src/server.js && node --check src/cli.js && node --check src/config.js && node --check src/cc-switch-models.js && node --check src/workspaces/workspace-catalog.js && node --check src/conversations/conversation-catalog.js && node --check src/adapters/capabilities.js && node --check src/adapters/claude.js && node --check src/adapters/codex.js && node --check src/adapters/deepseek-harness.js && node --check src/adapters/dsh-desktop.js && node --check src/dsh-desktop-channels.js && node --check src/event-store.js && node --check src/notifier.js && node --check src/attachments.js && node --check src/session-manager.js && node --check integrations/dsh-phone/lib/index.js && node --check src/tunnel.js && node --check src/remote.js && node --check src/origin-announcer.js && node --check src/adapters/zcode-native.js && node --check public/adapter-capabilities.js && node --check public/workspace-navigation.js && node --check public/markdown.js && node --check public/highlight.js && node --check public/transcript.js && node --check public/app.js && node --check scripts/verify-workspace-ui.mjs && node --check scripts/verify-message-blocks.mjs && node --check scripts/verify-background-scrim.mjs && node --check scripts/verify-model-control.mjs && node --check scripts/verify-notifications.mjs && node --check scripts/verify-attachments.mjs && node --check scripts/verify-features.mjs && node --check scripts/verify-quick-nav.mjs && node --check scripts/verify-questions.mjs && node --check scripts/verify-responsive.mjs && node --check scripts/verify-product-guide.mjs && node --check scripts/verify-plugin-release.mjs && node --check scripts/capture-screenshots.mjs",
     "verify:remote": "node scripts/verify-remote-tunnel.mjs",
     "capture:shots": "node scripts/capture-screenshots.mjs"
   },

package/public/app.js

@@ -310,22 +310,84 @@ async function resolveRequest(requestId, body) {
 }
 
 async function api(path, options = {}) {
-  const response = await fetch(path, {
-    credentials: "same-origin",
-    ...options,
-    headers: options.body ? { "content-type": "application/json", ...(options.headers ?? {}) } : options.headers,
-  });
+  let response;
+  try {
+    response = await fetch(path, {
+      credentials: "same-origin",
+      ...options,
+      headers: options.body ? { "content-type": "application/json", ...(options.headers ?? {}) } : options.headers,
+    });
+  } catch (error) {
+    // No HTTP status at all: the origin itself is unreachable — almost always
+    // because the tunnel hostname changed and this page is still on the old one.
+    noteConnectionFailure("offline");
+    throw error;
+  }
   const body = response.headers.get("content-type")?.includes("application/json") ? await response.json() : null;
   if (!response.ok) {
+    if (response.status === 401) noteConnectionFailure("unauthorized");
     const error = new Error(body?.error ?? `请求失败 (${response.status})`);
     error.status = response.status;
     error.code = body?.code;
     error.diagnostics = body?.diagnostics;
     throw error;
   }
+  noteConnectionSuccess();
   return body;
 }
 
+/**
+ * A page that cannot reach its bridge must say so.
+ *
+ * After a tunnel rebuild the phone keeps rendering the last transcript and the
+ * connection chip just says 正在重连 — which reads as "still working" while every
+ * request is already failing. Two failures in a row is enough evidence to show a
+ * banner that explains what to do, because there is nothing else the page can do:
+ * the address it was loaded from no longer exists.
+ */
+const connectionWatch = { failures: 0, banner: null };
+
+function noteConnectionFailure(kind) {
+  connectionWatch.failures += 1;
+  if (connectionWatch.failures < 2) return;
+  showStaleBanner(kind);
+}
+
+function noteConnectionSuccess() {
+  connectionWatch.failures = 0;
+  if (connectionWatch.banner) {
+    connectionWatch.banner.remove();
+    connectionWatch.banner = null;
+  }
+}
+
+function showStaleBanner(kind) {
+  if (connectionWatch.banner) return;
+  const banner = document.createElement("div");
+  banner.id = "stale-banner";
+  banner.setAttribute("role", "alert");
+  banner.style.cssText = [
+    "position:fixed", "inset:0 0 auto 0", "z-index:9999",
+    "padding:12px 16px", "font:14px/1.5 system-ui,-apple-system,sans-serif",
+    "background:#b3261e", "color:#fff", "box-shadow:0 2px 8px rgba(0,0,0,.4)",
+  ].join(";");
+  banner.textContent = kind === "unauthorized"
+    ? "登录状态已失效：这台手机的配对属于旧地址。请在电脑上重新执行 /phone，扫描新的二维码。"
+    : "连不上电脑：二维码地址可能已经更换（隧道重建会换域名）。请在电脑上重新执行 /phone 并扫描新二维码。";
+  const dismiss = document.createElement("button");
+  dismiss.textContent = "知道了";
+  dismiss.style.cssText = "margin-left:12px;padding:4px 10px;border:0;border-radius:6px;background:rgba(255,255,255,.2);color:#fff;font:inherit";
+  dismiss.addEventListener("click", () => {
+    banner.remove();
+    connectionWatch.banner = null;
+    // Keep counting: a still-broken page will show it again on the next failure.
+    connectionWatch.failures = 0;
+  });
+  banner.appendChild(dismiss);
+  document.body.appendChild(banner);
+  connectionWatch.banner = banner;
+}
+
 function toast(message) {
   const element = $("#toast");
   element.textContent = message;

package/src/cli.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -52,23 +52,37 @@ Tell the user to scan the QR with WeChat. While the phone controls this session,
 `;
 }
 
+/**
+ * The Codex skill is named `phone-codex`, not `phone`.
+ *
+ * `~/.agents/skills` is shared: Codex reads it, and so does DSH Desktop. A skill
+ * called `phone` therefore shadows the DSH plugin's `/phone` command, and typing
+ * `/phone` in DSH Desktop runs `phone --agent codex` — pairing a Codex
+ * conversation instead of the one on screen. One name per client: the plugin owns
+ * `/phone`, this skill answers `/phone-codex`.
+ */
+export const CODEX_SKILL_NAME = "phone-codex";
+const CODEX_SKILL_MARKER = "# Send a Codex project to AgentBridge";
+
 export function renderCodexPhoneSkill(entryPath = cliEntry) {
   const portableEntry = entryPath.replaceAll("\\", "/").replaceAll('"', '\\"');
   return `---
-name: phone
-description: Generate a one-time WeChat QR code for a Codex project conversation. Use only when the user explicitly invokes /phone.
+name: ${CODEX_SKILL_NAME}
+description: Generate a one-time WeChat QR code for a Codex project conversation. Use only when the user explicitly invokes /${CODEX_SKILL_NAME}.
 disable-model-invocation: true
 ---
 
-# Send a Codex project to AgentBridge
+${CODEX_SKILL_MARKER}
 
-When the user invokes \`/phone\`, you must immediately execute the following command in the terminal from the current project directory. Do not merely describe the command or ask the user to run it:
+When the user invokes \`/${CODEX_SKILL_NAME}\`, you must immediately execute the following command in the terminal from the current project directory. Do not merely describe the command or ask the user to run it:
 
 \`node "${portableEntry}" phone --agent codex --cwd .\`
 
 After a successful command, reply with the exact QR image Markdown emitted by the command (for example, \`![微信扫码二维码](<temporary QR image URL>)\`) so Codex Desktop renders a scannable image. The temporary QR image URL and pairing URL must be shown as clickable links; then tell the user to scan the 微信扫码二维码 with WeChat. Do not invent or alter either URL. If the command fails, show its exact safe error and do not claim that a QR code was generated.
 
 If the user supplies a known persisted Codex thread ID, append \`--session <thread-id>\` to resume that exact thread. Do not claim that the command attached the current desktop conversation when no thread ID was supplied: Codex does not expose a documented current-thread substitution to this local skill.
+
+> Named \`${CODEX_SKILL_NAME}\` on purpose: DSH Desktop reads the same skills folder and owns \`/phone\` for the conversation on screen. Running \`/phone\` here would pair the wrong Agent.
 `;
 }
 
@@ -271,17 +285,51 @@ async function installClaudeSkill(options) {
   return target;
 }
 
+/**
+ * Remove a `phone` skill this installer used to create.
+ *
+ * Earlier releases wrote the Codex skill as `phone`, which shadowed the DSH
+ * plugin's `/phone` in DSH Desktop because both clients read `~/.agents/skills`.
+ * Re-running the installer has to clean that up, or the wrong pairing keeps
+ * happening after an upgrade. Only a file carrying our own marker is touched —
+ * a hand-written `phone` skill belongs to whoever wrote it.
+ */
+async function removeLegacyCodexSkill(root) {
+  const legacy = path.join(root, "phone", "SKILL.md");
+  let content;
+  try {
+    content = await readFile(legacy, "utf8");
+  } catch {
+    return null;
+  }
+  if (!content.includes(CODEX_SKILL_MARKER)) return null;
+  try {
+    await rm(path.join(root, "phone"), { recursive: true, force: true });
+    return legacy;
+  } catch {
+    return null;
+  }
+}
+
 async function installCodexSkill(options) {
   if (options.user && options.project) throw new Error("Choose only one of --user or --project");
   const projectCwd = path.resolve(options.cwd ?? process.cwd());
   const root = options.project
     ? path.join(projectCwd, ".agents", "skills")
     : path.join(os.homedir(), ".agents", "skills");
-  const target = path.join(root, "phone", "SKILL.md");
+
+  const removed = await removeLegacyCodexSkill(root);
+  if (removed) {
+    console.log(`已移除会抢占 /phone 的旧技能: ${removed}`);
+    console.log("（DSH Desktop 也读这个目录，旧的 phone 技能会让 /phone 绑到 Codex 会话。）");
+  }
+
+  const target = path.join(root, CODEX_SKILL_NAME, "SKILL.md");
   await mkdir(path.dirname(target), { recursive: true });
   await writeFile(target, renderCodexPhoneSkill(), { encoding: "utf8", flag: "w" });
-  console.log(`Codex /phone 已安装到: ${target}`);
-  console.log("重新打开 Codex 桌面项目后，在斜杠命令列表选择 /phone。未提供 thread ID 时，它会创建新的项目会话并清楚标注。");
+  console.log(`Codex /${CODEX_SKILL_NAME} 已安装到: ${target}`);
+  console.log(`重新打开 Codex 桌面项目后，在斜杠命令列表选择 /${CODEX_SKILL_NAME}。未提供 thread ID 时，它会创建新的项目会话并清楚标注。`);
+  console.log("DSH Desktop 里的 /phone 保持归插件所有，绑定的就是屏幕上那条会话。");
   return target;
 }
 

package/src/notifier.js

@@ -63,6 +63,19 @@ export function describeNotification(kind, payload = {}, context = {}) {
     case "notify.test": {
       return { title: "🔔 AgentBridge 通知测试", text: [`${where}`, "如果你看到这条消息，通知链路是通的。"].filter(Boolean).join("\n") };
     }
+    case "bridge.moved": {
+      // The one message a phone cannot get any other way: it is still sitting on
+      // the old address, so its own page can no longer be told anything.
+      return {
+        title: "🔄 AgentBridge 地址已更换",
+        text: [
+          `${where}`,
+          "隧道重建后二维码地址变了，手机上的旧链接已经打不开。",
+          `新地址：${clip(payload.origin ?? "", 200)}`,
+          "在电脑上重新执行 /phone 并扫描新二维码，或直接打开上面的新地址。",
+        ].filter(Boolean).join("\n"),
+      };
+    }
     default:
       return { title: DEFAULT_TITLES[kind] ?? "AgentBridge", text: where };
   }

package/src/origin-announcer.js

@@ -0,0 +1,92 @@
+/**
+ * Tell an already-paired phone that the bridge moved.
+ *
+ * A Cloudflare quick tunnel hands out a new hostname every time the tunnel is
+ * rebuilt, and the bridge is rebuilt often (desktop restart, tunnel restart). The
+ * phone is sitting on the old origin: its page still renders, every request from
+ * it fails, and nothing on the desktop says so. The QR code is not much help
+ * either — the person is not looking at the desktop any more.
+ *
+ * So the address change is announced over the channel that still works when the
+ * web page cannot: the push notification the user configured. One message per
+ * change, only when a device actually exists to tell, and never on the first run
+ * (nothing has "moved" yet).
+ *
+ * Everything that touches the machine is injectable because this decides whether a
+ * third party gets a message, which is worth testing without a network.
+ */
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+export function announcedOriginPath(dataDir) {
+  return path.join(dataDir, "advertised-origin.json");
+}
+
+export function readAnnouncedOrigin(dataDir, { readFile = readFileSync } = {}) {
+  try {
+    const parsed = JSON.parse(String(readFile(announcedOriginPath(dataDir), "utf8")));
+    return typeof parsed?.origin === "string" ? parsed.origin : null;
+  } catch {
+    return null;
+  }
+}
+
+export function writeAnnouncedOrigin(dataDir, origin, { writeFile = writeFileSync, rename = renameSync, now = () => new Date().toISOString() } = {}) {
+  const target = announcedOriginPath(dataDir);
+  const temporary = `${target}.tmp`;
+  writeFile(temporary, JSON.stringify({ origin, recordedAt: now() }, null, 2), "utf8");
+  rename(temporary, target);
+  return origin;
+}
+
+/** Whether this machine has ever recorded an address (i.e. it is not the first run). */
+export function hasAnnouncedBefore(dataDir, options = {}) {
+  return readAnnouncedOrigin(dataDir, options) !== null;
+}
+
+/**
+ * Compare the address with the last one this bridge announced.
+ *
+ * Returns `{ announced, reason }`. A failure to notify is not thrown: the bridge is
+ * already serving, and a dead webhook must not be able to stop that.
+ */
+export async function announceOriginChange({
+  dataDir,
+  origin,
+  notifier = null,
+  deviceCount = 0,
+  machineName = "",
+  log = () => {},
+  read = readAnnouncedOrigin,
+  write = writeAnnouncedOrigin,
+} = {}) {
+  if (!dataDir || !origin) return { announced: false, reason: "missing-argument" };
+
+  const previous = read(dataDir);
+  if (previous === origin) return { announced: false, reason: "unchanged" };
+
+  // Record first: a crash mid-announcement must not turn one tunnel restart into a
+  // notification loop on every subsequent launch.
+  write(dataDir, origin);
+
+  if (!previous) {
+    log(`Recorded the first advertised address: ${origin}`);
+    return { announced: false, reason: "first-run" };
+  }
+  if (deviceCount <= 0) return { announced: false, reason: "no-devices" };
+  if (!notifier?.enabled) return { announced: false, reason: "notifications-disabled" };
+
+  try {
+    const result = await notifier.send(
+      "bridge.moved",
+      { previous, origin },
+      { sessionTitle: machineName || "AgentBridge", adapterId: "agentbridge" },
+    );
+    if (result?.sent) log(`Announced the new address to ${deviceCount} paired device(s): ${origin}`);
+    else log(`Address change not announced: ${result?.reason ?? "unknown"}`);
+    return { announced: result?.sent === true, reason: result?.reason ?? null, previous };
+  } catch (error) {
+    log(`Address change announcement failed: ${error instanceof Error ? error.message : String(error)}`);
+    return { announced: false, reason: "send-failed", previous };
+  }
+}

package/src/server.js

@@ -5,6 +5,7 @@ import { readFile, stat } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import QRCode from "qrcode";
 import { loadConfig, isLoopback } from "./config.js";
+import { announceOriginChange } from "./origin-announcer.js";
 import { EventStore } from "./event-store.js";
 import { PairingManager } from "./pairing.js";
 import { AdapterRegistry } from "./adapter-registry.js";
@@ -33,6 +34,9 @@ function json(res, statusCode, value, headers = {}) {
   res.writeHead(statusCode, {
     "content-type": "application/json; charset=utf-8",
     "cache-control": "no-store",
+    // A renewal cookie rides every authenticated JSON response when the session
+    // was just extended; explicit per-handler cookies (logout, revoke) still win.
+    ...(res.renewCookie ? { "set-cookie": res.renewCookie } : {}),
     ...headers,
   });
   res.end(JSON.stringify(value));
@@ -601,6 +605,16 @@ export async function createBridge(options = {}) {
         // must not consume a pairing code, mint a device, or take the lease away
         // from the phone that is already driving this conversation.
         const reconnecting = body.reconnect === true;
+        // An automatic restore (the desktop app just restarted and is opening a
+        // conversation the phone already owns) passes `existingOnly`: it must bind
+        // the bridge session that already exists and never create a new one, or
+        // simply opening a never-paired conversation would fill the phone's
+        // workspace drawer with sessions nobody asked for.
+        if (reconnecting && body.existingOnly === true
+          && !sessions.findByProvider("deepseek-harness-desktop", providerSessionId)) {
+          dshDesktopChannels.revoke(registration.id);
+          throw Object.assign(new Error("No AgentBridge session is bound to this conversation"), { statusCode: 404 });
+        }
         const device = reconnecting ? null : pairing.createSession("DSH Desktop /phone");
         let session;
         try {
@@ -638,6 +652,27 @@ export async function createBridge(options = {}) {
         });
       }
 
+      // Which conversations should a freshly started desktop companion re-attach?
+      //
+      // After DSH Desktop updates or restarts, the bridge still has the sessions
+      // and history the phone was using, but the desktop-side channel is gone and
+      // nothing re-registers it: the phone reads "桌面端未连接" until someone runs
+      // /phone again. The companion asks this endpoint on startup and whenever a
+      // conversation is opened, and re-registers only these — a never-paired
+      // conversation stays silent instead of appearing as a new session.
+      if (req.method === "GET" && url.pathname === "/api/local/dsh-desktop/expected") {
+        if (!isLoopback(req.socket.remoteAddress)) throw Object.assign(new Error("Local access only"), { statusCode: 403 });
+        const providerSessionIds = [];
+        for (const session of sessions.list()) {
+          if (session.adapterId !== "deepseek-harness-desktop") continue;
+          const providerSessionId = session.providerSessionId;
+          if (!providerSessionId) continue;
+          if (dshDesktopChannels.isOnline(providerSessionId)) continue;
+          providerSessionIds.push(providerSessionId);
+        }
+        return json(res, 200, { providerSessionIds: [...new Set(providerSessionIds)] });
+      }
+
       if (req.method === "POST" && url.pathname === "/api/pairings/exchange") {
         requireAccessKey(req, url, config);
         requireSameOrigin(req);
@@ -703,6 +738,19 @@ export async function createBridge(options = {}) {
       const device = pairing.authenticate(requestToken(req));
       if (!device) throw Object.assign(new Error("Authentication required"), { statusCode: 401 });
 
+      // Sliding renewal: a phone that keeps using the console is never asked to
+      // scan a QR again merely because its original window ran out. The refreshed
+      // cookie rides whichever response this request produces (JSON or SSE), so
+      // opening the app once is enough for the device to stay paired. Idle
+      // sessions still expire on the normal TTL.
+      if (pairing.renewIfNeeded(device.id)) {
+        res.renewCookie = sessionCookie(
+          requestToken(req),
+          config.secureCookies && !isLoopback(req.socket.remoteAddress),
+          config.sessionTtlMs,
+        );
+      }
+
       if (req.method === "GET" && url.pathname === "/api/devices") {
         return json(res, 200, { devices: pairing.listDevices(), currentDeviceId: device.id });
       }
@@ -820,6 +868,7 @@ export async function createBridge(options = {}) {
           "cache-control": "no-cache, no-transform",
           connection: "keep-alive",
           "x-accel-buffering": "no",
+          ...(res.renewCookie ? { "set-cookie": res.renewCookie } : {}),
         });
         res.write(": connected\n\n");
         const writeEvent = (event) => {
@@ -1005,6 +1054,17 @@ export async function startBridge() {
       + "(set it in the desktop console, or point AGENTBRIDGE_NOTIFY_IMPORT at an older .agentbridge folder)",
     );
   }
+  // A quick tunnel gets a new hostname every time it is rebuilt, and the phone that
+  // is already paired is sitting on the old one: its own page can no longer be told
+  // anything, so the change goes out over the push channel instead.
+  void announceOriginChange({
+    dataDir: bridge.config.dataDir,
+    origin: bridge.config.advertisedOrigin,
+    notifier: bridge.notifier,
+    deviceCount: bridge.pairing.listDevices().length,
+    machineName: bridge.config.machineName,
+    log: (message) => console.log(message),
+  }).catch((error) => console.warn(`Address announcement skipped: ${error.message}`));
   // Silence here used to mean a QR encoding an address the phone could never reach.
   if (new URL(bridge.config.advertisedOrigin).hostname === "127.0.0.1") {
     console.warn(