@cjhyy/code-shell-server 0.8.13 → 0.9.0

package/dist/mobile-remote/mobile-chat-turn.d.ts

@@ -2,17 +2,21 @@ import { markAttachmentsSent, type InputAttachmentMeta } from "../attachment-ser
 import { type MobileRunBridge } from "./mobile-run-dispatch.js";
 import type { MobileUploadService } from "./mobile-upload-service.js";
 import type { MobileAttachmentSummary, MobileImageAttachment, PermissionMode } from "./types.js";
+import type { WorkerFrameMeta } from "../worker-bridge-core.js";
 type ChatTurnUploads = Pick<MobileUploadService, "claim" | "release" | "finalize">;
 export interface DispatchMobileChatTurnInput {
     deviceId: string;
     sessionId: string;
     fallbackCwd: string;
+    projectId?: string;
+    rootId?: string;
     text: string;
     attachments?: MobileImageAttachment[];
     clientMessageId?: string;
     permissionMode?: PermissionMode;
     runId: string;
     bridge: MobileRunBridge;
+    meta: WorkerFrameMeta;
     uploads: ChatTurnUploads;
     resolveWorkspace: (sessionId: string, fallbackCwd: string) => Promise<string>;
     markSent?: typeof markAttachmentsSent;

package/dist/mobile-remote/mobile-chat-turn.js

@@ -46,11 +46,13 @@ export async function dispatchMobileChatTurn(input) {
             task: text,
             cwd,
             sessionId: input.sessionId,
+            ...(input.projectId ? { projectId: input.projectId } : {}),
+            ...(input.rootId ? { rootId: input.rootId } : {}),
             clientMessageId,
             attachments: materialized.metas,
             ...(input.permissionMode ? { permissionMode: input.permissionMode } : {}),
         },
-    });
+    }, input.meta);
     if (!acceptance.ok) {
         await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
         return { ok: false, message: acceptance.message };

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -46,9 +46,13 @@ export function parseMobileClientEvent(value) {
             break;
         case "session.create":
             valid =
-                (event.cwd === undefined ||
-                    event.cwd === null ||
-                    boundedPath(event.cwd)) &&
+                (event.cwd === undefined || event.cwd === null || boundedPath(event.cwd)) &&
+                    (event.projectId === undefined ||
+                        event.projectId === null ||
+                        boundedString(event.projectId, MAX_ID_LENGTH)) &&
+                    optionalBoundedString(event.rootId, MAX_ID_LENGTH) &&
+                    (event.rootId === undefined || typeof event.projectId === "string") &&
+                    !(event.projectId === null && event.rootId !== undefined) &&
                     optionalBoundedString(event.name, MAX_NAME_LENGTH);
             break;
         case "run.stop":
@@ -71,8 +75,7 @@ export function parseMobileClientEvent(value) {
             break;
         case "session.sync":
             valid =
-                boundedString(event.sessionId, MAX_ID_LENGTH) &&
-                    optionalNonNegativeInteger(event.sinceSeq);
+                boundedString(event.sessionId, MAX_ID_LENGTH) && optionalNonNegativeInteger(event.sinceSeq);
             break;
         case "permission.setMode":
             valid =
@@ -114,8 +117,7 @@ export function parseMobileClientEvent(value) {
             break;
         case "room.history":
             valid =
-                boundedString(event.roomId, MAX_ID_LENGTH) &&
-                    optionalNonNegativeInteger(event.sinceSeq);
+                boundedString(event.roomId, MAX_ID_LENGTH) && optionalNonNegativeInteger(event.sinceSeq);
             break;
         case "ccRoom.probe":
             valid =
@@ -202,9 +204,7 @@ function isBoundedHistoryLimit(value) {
 }
 function optionalAttachments(value) {
     return (value === undefined ||
-        (Array.isArray(value) &&
-            value.length <= MAX_MOBILE_ATTACHMENTS &&
-            value.every(isAttachment)));
+        (Array.isArray(value) && value.length <= MAX_MOBILE_ATTACHMENTS && value.every(isAttachment)));
 }
 function isAttachment(value) {
     if (!isRecord(value) ||
@@ -223,8 +223,9 @@ function isApprovalDecision(value) {
     if (!isRecord(value))
         return false;
     if (value.behavior === "allow") {
-        return ((value.answer === undefined || boundedOptionalEmptyString(value.answer, MAX_MESSAGE_LENGTH)) &&
+        return ((value.answer === undefined ||
+            boundedOptionalEmptyString(value.answer, MAX_MESSAGE_LENGTH)) &&
             (value.updatedInput === undefined || isRecord(value.updatedInput)));
     }
-    return (value.behavior === "deny" && boundedOptionalEmptyString(value.message, MAX_MESSAGE_LENGTH));
+    return value.behavior === "deny" && boundedOptionalEmptyString(value.message, MAX_MESSAGE_LENGTH);
 }

package/dist/mobile-remote/mobile-run-dispatch.d.ts

@@ -1,6 +1,7 @@
+import type { WorkerFrameMeta } from "../worker-bridge-core.js";
 export interface MobileRunBridge {
     subscribeOutbound(listener: (line: string) => void): () => void;
-    injectWorkerMessage(line: string): void;
+    injectWorkerMessage(line: string, meta: WorkerFrameMeta): void;
 }
 export interface MobileRunRequest {
     id: string;
@@ -14,4 +15,4 @@ export type MobileRunAcceptance = {
     code?: number;
 };
 /** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
-export declare function injectMobileRunAndAwaitAcceptance(bridge: MobileRunBridge, request: MobileRunRequest, timeoutMs?: number): Promise<MobileRunAcceptance>;
+export declare function injectMobileRunAndAwaitAcceptance(bridge: MobileRunBridge, request: MobileRunRequest, meta: WorkerFrameMeta, timeoutMs?: number): Promise<MobileRunAcceptance>;

package/dist/mobile-remote/mobile-run-dispatch.js

@@ -1,5 +1,5 @@
 /** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
-export function injectMobileRunAndAwaitAcceptance(bridge, request, timeoutMs = 5_000) {
+export function injectMobileRunAndAwaitAcceptance(bridge, request, meta, timeoutMs = 5_000) {
     return new Promise((resolve) => {
         let settled = false;
         let timer;
@@ -47,7 +47,7 @@ export function injectMobileRunAndAwaitAcceptance(bridge, request, timeoutMs = 5
                 id: request.id,
                 method: "agent/run",
                 params: request.params,
-            }));
+            }), meta);
         }
         catch (error) {
             finish({ ok: false, message: error instanceof Error ? error.message : String(error) });

package/dist/mobile-remote/trusted-device-store.js

@@ -38,8 +38,11 @@ export class TrustedDeviceStore {
             // Get-or-create by secretHash. A phone's secret is stable per browser
             // (persisted in localStorage as cs.deviceSecret), so re-scanning the QR
             // code must reuse its live row rather than accumulating duplicates.
-            const existing = devices.find((d) => d.secretHash === input.secretHash && !d.revokedAt);
+            const existing = devices.find((d) => secretHashEquals(d.secretHash, input.secretHash));
             if (existing) {
+                if (existing.revokedAt) {
+                    throw new Error("Trusted device was revoked; remove it before pairing again");
+                }
                 existing.name = name;
                 existing.lastSeenAt = Date.now();
                 return { result: this.toPublic(existing), changed: true };

package/dist/serve/headless-server.js

@@ -232,7 +232,7 @@ export async function startHeadlessServer(opts) {
                 // Spawn-on-first-frame (idempotent): the browser's first request wakes
                 // the worker, mirroring the renderer's spawn-on-agent/run semantics.
                 bridge.ensureWorker(opts.cwd);
-                bridge.injectWorkerMessage(workerLine);
+                bridge.injectWorkerMessage(workerLine, { origin: "serve", producer: "serve-ws" });
             });
             ws.on("close", () => {
                 tabs.delete(ws);

package/dist/worker-bridge-core.d.ts

@@ -1,6 +1,11 @@
 /** Truncate a wire line for logs. */
 export declare function previewLine(s: string, max?: number): string;
 export type WorkerBridgeLog = (event: string, data?: Record<string, unknown>) => void;
+export interface WorkerFrameMeta {
+    origin: "renderer" | "mobile" | "host" | "serve";
+    /** Producer label for logs and audits. It is never an authorization input. */
+    producer: string;
+}
 export interface WorkerExitInfo {
     code: number | null;
     signal: NodeJS.Signals | null;
@@ -55,6 +60,8 @@ export interface WorkerRequestOptions {
     ensureWorker?: boolean;
     /** cwd handed to ensureWorker() when it spawns. Ignored unless ensureWorker. */
     ensureWorkerCwd?: string;
+    /** Main-owned provenance for this frame. */
+    meta: WorkerFrameMeta;
 }
 export interface WorkerBridgeCoreOptions {
     /** Absolute path of the worker entry script (agent-server-stdio). */
@@ -71,7 +78,7 @@ export interface WorkerBridgeCoreOptions {
      * injected or correlated (e.g. agent/run trust metadata + on-demand spawn).
      * Returns the line to write; `method` is only used for log context.
      */
-    prepareInbound?: (line: string) => {
+    prepareInbound?: (line: string, meta: WorkerFrameMeta) => {
         line: string;
         method?: string;
     };
@@ -141,7 +148,7 @@ export declare class WorkerBridgeCore {
      * written, or dropped with a log when no worker is alive — identical
      * semantics for every front end (renderer, mobile remote, orchestrators).
      */
-    injectWorkerMessage(rawLine: string): void;
+    injectWorkerMessage(rawLine: string, meta: WorkerFrameMeta): void;
     /**
      * Send a correlated JSON-RPC request and await its response by id.
      * `params` is omitted from the frame when undefined. Never rejects — the

package/dist/worker-bridge-core.js

@@ -200,9 +200,7 @@ export class WorkerBridgeCore {
         const pending = this.pendingRequests.get(msg.id);
         if (!pending)
             return false;
-        pending.settle(msg.error
-            ? { status: "error", error: msg.error }
-            : { status: "result", result: msg.result });
+        pending.settle(msg.error ? { status: "error", error: msg.error } : { status: "result", result: msg.result });
         return pending.consume;
     }
     settlePendingOnExit() {
@@ -239,18 +237,25 @@ export class WorkerBridgeCore {
      * written, or dropped with a log when no worker is alive — identical
      * semantics for every front end (renderer, mobile remote, orchestrators).
      */
-    injectWorkerMessage(rawLine) {
+    injectWorkerMessage(rawLine, meta) {
         const prep = this.opts.prepareInbound
-            ? this.opts.prepareInbound(rawLine)
+            ? this.opts.prepareInbound(rawLine, meta)
             : { line: rawLine, method: undefined };
         if (!this.canSend()) {
             this.log("inject.dropped", {
                 reason: this.child ? "stdin destroyed" : "no child",
                 method: prep.method,
+                origin: meta.origin,
+                producer: meta.producer,
             });
             return;
         }
-        this.log("inject→worker", { method: prep.method, raw: previewLine(prep.line) });
+        this.log("inject→worker", {
+            method: prep.method,
+            origin: meta.origin,
+            producer: meta.producer,
+            raw: previewLine(prep.line),
+        });
         this.sendLine(prep.line);
     }
     /**
@@ -298,7 +303,7 @@ export class WorkerBridgeCore {
                 // bypassing this hook left the main process unable to route the first
                 // Panel tool call for a restored session.
                 const prepared = this.opts.prepareInbound
-                    ? this.opts.prepareInbound(rawFrame)
+                    ? this.opts.prepareInbound(rawFrame, options.meta)
                     : { line: rawFrame, method: undefined };
                 // Wake a lazily-unspawned worker before writing, so a spawn-triggering
                 // request (pet/IM-gateway agent/run) isn't dropped by sendLine and left
@@ -311,6 +316,17 @@ export class WorkerBridgeCore {
             catch (e) {
                 sendError = e;
             }
+            const rejected = sendError;
+            if (typeof rejected?.code === "number") {
+                settle({
+                    status: "error",
+                    error: {
+                        code: rejected.code,
+                        message: typeof rejected.message === "string" ? rejected.message : "worker frame rejected",
+                    },
+                });
+                return;
+            }
             if (options.failFast && (!sent || sendError !== undefined)) {
                 settle({ status: "sendFailed", error: sendError });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.8.13",
+  "version": "0.9.0",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -39,9 +39,9 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.8.13",
-    "@cjhyy/code-shell-core": "0.8.13",
-    "@cjhyy/code-shell-web": "0.8.13",
+    "@cjhyy/code-shell-capability-coding": "0.9.0",
+    "@cjhyy/code-shell-core": "0.9.0",
+    "@cjhyy/code-shell-web": "0.9.0",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0"
   },