@cjhyy/code-shell-server 0.8.8 → 0.8.10

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -0,0 +1,230 @@
+import { MAX_MOBILE_ATTACHMENTS, MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
+const PERMISSION_MODES = new Set(["default", "acceptEdits", "bypassPermissions"]);
+const KINDS = new Set(["claude-code", "codex"]);
+const SCOPES = new Set(["once", "session", "project"]);
+const PATH_SCOPES = new Set(["file", "dir", "tool"]);
+const IMAGE_MIMES = new Set(["image/png", "image/jpeg", "image/webp", "image/gif"]);
+const MAX_ID_LENGTH = 512;
+const MAX_NAME_LENGTH = 512;
+const MAX_PATH_LENGTH = 32_768;
+const MAX_MESSAGE_LENGTH = 512 * 1024;
+const MAX_HISTORY_LIMIT = 500;
+/** Runtime validation at the WebSocket boundary; TypeScript types do not validate JSON. */
+export function parseMobileClientEvent(value) {
+    if (!isRecord(value) || typeof value.type !== "string")
+        return undefined;
+    const event = value;
+    let valid;
+    switch (event.type) {
+        case "auth.device":
+            valid = boundedString(event.deviceId, MAX_ID_LENGTH) && boundedString(event.secretHash, 4096);
+            break;
+        case "pair.complete":
+            valid =
+                boundedString(event.token, MAX_ID_LENGTH) &&
+                    boundedTrimmedString(event.name, MAX_NAME_LENGTH) &&
+                    boundedString(event.secretHash, 4096);
+            break;
+        case "chat.send":
+            valid =
+                boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
+                    optionalBoundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.clientMessageId, MAX_ID_LENGTH) &&
+                    optionalAttachments(event.attachments);
+            break;
+        case "attachment.upload.begin":
+            valid =
+                boundedString(event.clientId, MAX_ID_LENGTH) &&
+                    boundedString(event.name, MAX_NAME_LENGTH) &&
+                    member(event.mime, IMAGE_MIMES) &&
+                    isPositiveInteger(event.size) &&
+                    event.size <= MAX_MOBILE_IMAGE_BYTES;
+            break;
+        case "session.select":
+        case "session.history":
+            valid = boundedString(event.sessionId, MAX_ID_LENGTH);
+            break;
+        case "session.create":
+            valid =
+                (event.cwd === undefined ||
+                    event.cwd === null ||
+                    boundedPath(event.cwd)) &&
+                    optionalBoundedString(event.name, MAX_NAME_LENGTH);
+            break;
+        case "run.stop":
+            valid = optionalBoundedString(event.sessionId, MAX_ID_LENGTH);
+            break;
+        case "approval.respond":
+            valid =
+                boundedString(event.approvalId, MAX_ID_LENGTH) &&
+                    (event.decision === "approve" || event.decision === "reject") &&
+                    optionalBoundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.reason, MAX_MESSAGE_LENGTH) &&
+                    optionalBoundedString(event.answer, MAX_MESSAGE_LENGTH) &&
+                    optionalMember(event.scope, SCOPES) &&
+                    optionalMember(event.pathScope, PATH_SCOPES);
+            break;
+        case "session.list":
+        case "room.list":
+        case "room.projects":
+            valid = true;
+            break;
+        case "session.sync":
+            valid =
+                boundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalNonNegativeInteger(event.sinceSeq);
+            break;
+        case "permission.setMode":
+            valid =
+                optionalBoundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    member(event.mode, PERMISSION_MODES);
+            break;
+        case "model.set":
+            valid = boundedString(event.model, MAX_ID_LENGTH);
+            break;
+        case "goal.extend":
+            valid =
+                boundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalPositiveInteger(event.addTurns) &&
+                    optionalPositiveInteger(event.addTokenBudget) &&
+                    optionalPositiveInteger(event.addTimeBudgetMs) &&
+                    optionalPositiveInteger(event.addStopBlocks) &&
+                    [event.addTurns, event.addTokenBudget, event.addTimeBudgetMs, event.addStopBlocks].some((amount) => amount !== undefined);
+            break;
+        case "goal.clear":
+            valid = boundedString(event.sessionId, MAX_ID_LENGTH);
+            break;
+        case "room.create":
+            valid =
+                boundedPath(event.cwd) &&
+                    optionalBoundedString(event.name, MAX_NAME_LENGTH) &&
+                    optionalMember(event.kind, KINDS) &&
+                    optionalMember(event.permissionMode, PERMISSION_MODES);
+            break;
+        case "room.open":
+        case "room.close":
+            valid = boundedString(event.roomId, MAX_ID_LENGTH);
+            break;
+        case "room.send":
+            valid =
+                boundedString(event.roomId, MAX_ID_LENGTH) &&
+                    boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
+                    optionalBoundedString(event.clientMessageId, MAX_ID_LENGTH) &&
+                    optionalAttachments(event.attachments);
+            break;
+        case "room.history":
+            valid =
+                boundedString(event.roomId, MAX_ID_LENGTH) &&
+                    optionalNonNegativeInteger(event.sinceSeq);
+            break;
+        case "ccRoom.probe":
+            valid =
+                (event.force === undefined || typeof event.force === "boolean") &&
+                    optionalMember(event.kind, KINDS);
+            break;
+        case "ccRoom.listSessions":
+            valid = boundedPath(event.cwd) && optionalMember(event.kind, KINDS);
+            break;
+        case "ccRoom.openSession":
+            valid =
+                boundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    boundedPath(event.cwd) &&
+                    member(event.mode, PERMISSION_MODES) &&
+                    optionalMember(event.kind, KINDS);
+            break;
+        case "ccRoom.subscribeTranscript":
+            valid =
+                boundedString(event.roomId, MAX_ID_LENGTH) &&
+                    boundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    boundedPath(event.cwd) &&
+                    isBoundedHistoryLimit(event.limit) &&
+                    optionalMember(event.kind, KINDS);
+            break;
+        case "ccRoom.unsubscribeTranscript":
+            valid = boundedString(event.roomId, MAX_ID_LENGTH);
+            break;
+        case "ccRoom.readHistory":
+            valid =
+                boundedPath(event.cwd) &&
+                    boundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    isBoundedHistoryLimit(event.limit) &&
+                    optionalMember(event.kind, KINDS);
+            break;
+        case "ccRoom.respondApproval":
+            valid =
+                boundedString(event.roomId, MAX_ID_LENGTH) &&
+                    boundedString(event.requestId, MAX_ID_LENGTH) &&
+                    isApprovalDecision(event.decision);
+            break;
+        default:
+            valid = false;
+    }
+    return valid ? event : undefined;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function boundedString(value, maxLength) {
+    return typeof value === "string" && value.length > 0 && value.length <= maxLength;
+}
+function boundedOptionalEmptyString(value, maxLength) {
+    return typeof value === "string" && value.length <= maxLength;
+}
+function boundedTrimmedString(value, maxLength) {
+    return boundedString(value, maxLength) && value.trim().length > 0 && !value.includes("\0");
+}
+function boundedPath(value) {
+    return boundedString(value, MAX_PATH_LENGTH) && !value.includes("\0");
+}
+function optionalBoundedString(value, maxLength) {
+    return value === undefined || boundedString(value, maxLength);
+}
+function member(value, values) {
+    return typeof value === "string" && values.has(value);
+}
+function optionalMember(value, values) {
+    return value === undefined || member(value, values);
+}
+function isNonNegativeInteger(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isPositiveInteger(value) {
+    return isNonNegativeInteger(value) && value > 0;
+}
+function optionalNonNegativeInteger(value) {
+    return value === undefined || isNonNegativeInteger(value);
+}
+function optionalPositiveInteger(value) {
+    return value === undefined || isPositiveInteger(value);
+}
+function isBoundedHistoryLimit(value) {
+    return isPositiveInteger(value) && value <= MAX_HISTORY_LIMIT;
+}
+function optionalAttachments(value) {
+    return (value === undefined ||
+        (Array.isArray(value) &&
+            value.length <= MAX_MOBILE_ATTACHMENTS &&
+            value.every(isAttachment)));
+}
+function isAttachment(value) {
+    if (!isRecord(value) ||
+        !boundedString(value.clientId, MAX_ID_LENGTH) ||
+        !boundedString(value.name, MAX_NAME_LENGTH) ||
+        !member(value.mime, IMAGE_MIMES) ||
+        !isPositiveInteger(value.size) ||
+        value.size > MAX_MOBILE_IMAGE_BYTES) {
+        return false;
+    }
+    return value.transport === "inline"
+        ? boundedString(value.dataUrl, MAX_MESSAGE_LENGTH)
+        : value.transport === "upload" && boundedString(value.uploadId, MAX_ID_LENGTH);
+}
+function isApprovalDecision(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.behavior === "allow") {
+        return ((value.answer === undefined || boundedOptionalEmptyString(value.answer, MAX_MESSAGE_LENGTH)) &&
+            (value.updatedInput === undefined || isRecord(value.updatedInput)));
+    }
+    return (value.behavior === "deny" && boundedOptionalEmptyString(value.message, MAX_MESSAGE_LENGTH));
+}

package/dist/mobile-remote/mobile-limits.d.ts

@@ -0,0 +1,6 @@
+/** Pure transport limits shared by validation, upload ticketing, and materialization. */
+export declare const MAX_MOBILE_ATTACHMENTS = 4;
+export declare const MAX_MOBILE_IMAGE_BYTES: number;
+export declare const MAX_MOBILE_INLINE_IMAGE_BYTES: number;
+export declare const MAX_MOBILE_INLINE_TOTAL_BYTES: number;
+export declare const MAX_MOBILE_ATTACHMENT_TOTAL_BYTES: number;

package/dist/mobile-remote/mobile-limits.js

@@ -0,0 +1,6 @@
+/** Pure transport limits shared by validation, upload ticketing, and materialization. */
+export const MAX_MOBILE_ATTACHMENTS = 4;
+export const MAX_MOBILE_IMAGE_BYTES = 10 * 1024 * 1024;
+export const MAX_MOBILE_INLINE_IMAGE_BYTES = 256 * 1024;
+export const MAX_MOBILE_INLINE_TOTAL_BYTES = 512 * 1024;
+export const MAX_MOBILE_ATTACHMENT_TOTAL_BYTES = 20 * 1024 * 1024;

package/dist/mobile-remote/mobile-upload-service.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { MobileImageBase } from "./types.js";
-export declare const MAX_MOBILE_IMAGE_BYTES: number;
+export { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export declare const MOBILE_UPLOAD_TTL_MS: number;
 export declare const MAX_MOBILE_UPLOAD_TICKETS_PER_DEVICE = 16;
 export declare const MAX_MOBILE_UPLOAD_CLAIM_ATTEMPTS = 3;
@@ -53,5 +53,6 @@ export declare class MobileUploadService {
     private expire;
     private cleanupRecordFiles;
     private cleanupOrphanSpools;
+    private ensurePrivateRoot;
     private assertClaimOwner;
 }

package/dist/mobile-remote/mobile-upload-service.js

@@ -1,10 +1,11 @@
 import { createHash, randomBytes } from "node:crypto";
 import { createWriteStream } from "node:fs";
-import { mkdir, readdir, rename, rm, stat } from "node:fs/promises";
+import { chmod, mkdir, readdir, rename, rm, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Transform } from "node:stream";
-export const MAX_MOBILE_IMAGE_BYTES = 10 * 1024 * 1024;
+import { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
+export { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export const MOBILE_UPLOAD_TTL_MS = 5 * 60 * 1000;
 export const MAX_MOBILE_UPLOAD_TICKETS_PER_DEVICE = 16;
 export const MAX_MOBILE_UPLOAD_CLAIM_ATTEMPTS = 3;
@@ -142,7 +143,7 @@ export class MobileUploadService {
         // receives the existing 409 above while this first request runs normally.
         record.status = "uploading";
         try {
-            await mkdir(this.opts.rootDir, { recursive: true });
+            await this.ensurePrivateRoot();
         }
         catch {
             if (this.uploads.get(uploadId) === record && record.status === "uploading") {
@@ -173,7 +174,7 @@ export class MobileUploadService {
             controller.abort(new Error("upload ticket expired during transfer"));
         }, Math.max(0, record.expiresAt - this.now()));
         deadline.unref?.();
-        const transfer = pipeline(req, counter, createWriteStream(partPath, { flags: "wx" }), {
+        const transfer = pipeline(req, counter, createWriteStream(partPath, { flags: "wx", mode: 0o600 }), {
             signal: controller.signal,
         });
         this.activeTransfers.set(uploadId, { controller, done: transfer });
@@ -332,7 +333,7 @@ export class MobileUploadService {
     }
     async cleanupOrphanSpools(now, removeAll) {
         try {
-            await mkdir(this.opts.rootDir, { recursive: true });
+            await this.ensurePrivateRoot();
         }
         catch {
             return;
@@ -356,6 +357,11 @@ export class MobileUploadService {
             await rm(path, { force: true });
         }));
     }
+    async ensurePrivateRoot() {
+        await mkdir(this.opts.rootDir, { recursive: true, mode: 0o700 });
+        if (process.platform !== "win32")
+            await chmod(this.opts.rootDir, 0o700);
+    }
     assertClaimOwner(deviceId, uploadId, claimId) {
         const record = this.uploads.get(uploadId);
         if (!record)

package/dist/mobile-remote/pairing.d.ts

@@ -1,8 +1,19 @@
 import type { PairingToken } from "./types.js";
+export declare const MAX_PENDING_PAIRING_TOKENS = 256;
 export declare class PairingTokenManager {
     private readonly now;
     private tokens;
     constructor(now?: () => number);
     createToken(ttlMs?: number): PairingToken;
     consume(value: string): boolean;
+    /**
+     * Run a synchronous commit while the token is valid, consuming it only when
+     * that commit succeeds. The validity timestamp is sampled once, so a commit
+     * that crosses the expiry millisecond cannot create a device yet report a
+     * false pairing failure.
+     */
+    commit<T>(value: string, action: () => T): T | undefined;
+    /** Live token count for diagnostics/tests; expired entries are pruned on mint. */
+    get pendingCount(): number;
+    private prune;
 }

package/dist/mobile-remote/pairing.js

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+export const MAX_PENDING_PAIRING_TOKENS = 256;
 export class PairingTokenManager {
     now;
     tokens = new Map();
@@ -6,9 +7,23 @@ export class PairingTokenManager {
         this.now = now;
     }
     createToken(ttlMs = 10 * 60 * 1000) {
+        if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0) {
+            throw new Error("Pairing token TTL must be a positive safe integer");
+        }
+        const now = this.now();
+        if (!Number.isSafeInteger(now) || now < 0 || now > Number.MAX_SAFE_INTEGER - ttlMs) {
+            throw new Error("Pairing token clock is invalid");
+        }
+        this.prune(now);
+        while (this.tokens.size >= MAX_PENDING_PAIRING_TOKENS) {
+            const oldest = this.tokens.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.tokens.delete(oldest);
+        }
         const token = {
             value: randomBytes(32).toString("base64url"),
-            expiresAt: this.now() + ttlMs,
+            expiresAt: now + ttlMs,
         };
         this.tokens.set(token.value, token);
         return token;
@@ -18,6 +33,36 @@ export class PairingTokenManager {
         if (!token)
             return false;
         this.tokens.delete(value);
-        return token.expiresAt >= this.now();
+        const now = this.now();
+        return Number.isSafeInteger(now) && now >= 0 && token.expiresAt >= now;
+    }
+    /**
+     * Run a synchronous commit while the token is valid, consuming it only when
+     * that commit succeeds. The validity timestamp is sampled once, so a commit
+     * that crosses the expiry millisecond cannot create a device yet report a
+     * false pairing failure.
+     */
+    commit(value, action) {
+        const token = this.tokens.get(value);
+        if (!token)
+            return undefined;
+        const now = this.now();
+        if (!Number.isSafeInteger(now) || now < 0 || token.expiresAt < now) {
+            this.tokens.delete(value);
+            return undefined;
+        }
+        const result = action();
+        this.tokens.delete(value);
+        return result;
+    }
+    /** Live token count for diagnostics/tests; expired entries are pruned on mint. */
+    get pendingCount() {
+        return this.tokens.size;
+    }
+    prune(now) {
+        for (const [value, token] of this.tokens) {
+            if (token.expiresAt < now)
+                this.tokens.delete(value);
+        }
     }
 }

package/dist/mobile-remote/remote-host-manager.d.ts

@@ -2,7 +2,7 @@ import { EventEmitter } from "node:events";
 import { type WebSocket } from "ws";
 import type { AccessPasscode } from "./access-passcode.js";
 import type { TrustedDeviceStore } from "./trusted-device-store.js";
-import type { MobileClientEvent, MobileServerEvent } from "./types.js";
+import type { MobileServerEvent } from "./types.js";
 import type { MobileUploadService } from "./mobile-upload-service.js";
 /**
  * Pick the Mac's real LAN IPv4 so a phone on the same Wi-Fi can reach the
@@ -33,7 +33,7 @@ export interface RemoteHostStarted {
 }
 export interface RemoteHostManagerOptions {
     devices: TrustedDeviceStore;
-    onClientEvent: (event: unknown, ws: WebSocket) => void;
+    onClientEvent: (event: unknown, ws: WebSocket) => void | Promise<void>;
     /**
      * Absolute path to the built mobile app (out/mobile). Defaults to the
      * sibling of the bundled main (out/main → ../mobile). Overridable for tests.
@@ -52,6 +52,7 @@ export declare class RemoteHostManager extends EventEmitter {
     private server?;
     private wss?;
     private started?;
+    private starting?;
     private pairing;
     /** ws → authenticated device id. A socket absent here is unauthenticated. */
     private authed;
@@ -79,6 +80,7 @@ export declare class RemoteHostManager extends EventEmitter {
      *  socket goes away (online→offline). */
     markOffline(deviceId: string): void;
     start(options: RemoteHostStartOptions): Promise<RemoteHostStarted>;
+    private startOnce;
     /**
      * Override the base URL used to build pairing URLs (tunnel mode points this
      * at the `https://*.trycloudflare.com` domain so the QR encodes the public
@@ -97,7 +99,7 @@ export declare class RemoteHostManager extends EventEmitter {
      * trusted-device store (which rejects revoked devices), so the remote host
      * never executes tools itself — it only gates transport.
      */
-    handleClientEvent(event: MobileClientEvent): MobileServerEvent | undefined;
+    handleClientEvent(input: unknown): MobileServerEvent | undefined;
     /** Broadcast a server event to every connected, authenticated mobile socket. */
     broadcast(event: MobileServerEvent): void;
     /** Send a server event to ONLY the sockets belonging to one device. Used for

package/dist/mobile-remote/remote-host-manager.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";
 import { serveMobile } from "./mobile-static.js";
 import { PairingTokenManager } from "./pairing.js";
+import { parseMobileClientEvent } from "./mobile-client-event-validator.js";
 /**
  * Pick the Mac's real LAN IPv4 so a phone on the same Wi-Fi can reach the
  * remote host. We bind to a concrete LAN address (NOT 0.0.0.0) per the design's
@@ -37,6 +38,7 @@ export class RemoteHostManager extends EventEmitter {
     server;
     wss;
     started;
+    starting;
     pairing = new PairingTokenManager();
     /** ws → authenticated device id. A socket absent here is unauthenticated. */
     authed = new WeakMap();
@@ -91,6 +93,19 @@ export class RemoteHostManager extends EventEmitter {
     async start(options) {
         if (this.started)
             return this.started;
+        if (this.starting)
+            return this.starting;
+        const attempt = this.startOnce(options);
+        this.starting = attempt;
+        try {
+            return await attempt;
+        }
+        finally {
+            if (this.starting === attempt)
+                this.starting = undefined;
+        }
+    }
+    async startOnce(options) {
         const tunnel = options.mode === "tunnel";
         this.passcode = tunnel ? options.passcode : undefined;
         const gate = this.passcode;
@@ -135,9 +150,19 @@ export class RemoteHostManager extends EventEmitter {
         this.wss = gate
             ? new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 })
             : new WebSocketServer({ server, path: "/ws", maxPayload: 1024 * 1024 });
+        // ws re-emits its HTTP server's bind errors. Without an error listener a
+        // handled EADDRINUSE rejection still becomes an uncaught EventEmitter error.
+        this.wss.on("error", (error) => this.emit("host-error", error));
         if (gate) {
             server.on("upgrade", (req, socket, head) => {
-                if (!req.url?.startsWith("/ws")) {
+                let isWebSocketPath = false;
+                try {
+                    isWebSocketPath = new URL(req.url ?? "", "http://localhost").pathname === "/ws";
+                }
+                catch {
+                    // Invalid request targets are not valid WebSocket endpoints.
+                }
+                if (!isWebSocketPath) {
                     socket.destroy();
                     return;
                 }
@@ -155,18 +180,30 @@ export class RemoteHostManager extends EventEmitter {
             const viewerId = `viewer-${this.nextViewerId++}`;
             this.viewers.set(ws, viewerId);
             ws.on("message", (raw) => {
-                let event;
+                let parsed;
                 try {
-                    event = JSON.parse(String(raw));
+                    parsed = JSON.parse(String(raw));
                 }
                 catch {
                     ws.send(JSON.stringify({ type: "error", message: "Invalid JSON" }));
                     return;
                 }
+                const event = parseMobileClientEvent(parsed);
+                if (!event) {
+                    ws.send(JSON.stringify({ type: "error", message: "Invalid client event" }));
+                    return;
+                }
                 // Pairing/auth are handled inline and bind device identity to this
                 // socket. Everything else is gated: an unauthenticated socket cannot
                 // send chat/approval/run/job events (design §6.1).
-                const reply = this.handleClientEvent(event);
+                let reply;
+                try {
+                    reply = this.handleClientEvent(event);
+                }
+                catch {
+                    ws.send(JSON.stringify({ type: "error", message: "Client event failed" }));
+                    return;
+                }
                 if (event.type === "auth.device" && reply?.type === "auth.ok") {
                     if (!this.authed.has(ws))
                         this.markOnline(reply.device.id);
@@ -188,7 +225,17 @@ export class RemoteHostManager extends EventEmitter {
                 }
                 // Authenticated, non-auth event → hand to the main dispatcher, which
                 // routes chat/approval into the existing run/permission path.
-                this.opts.onClientEvent({ ...event, deviceId: this.authed.get(ws), viewerId: this.viewers.get(ws) }, ws);
+                try {
+                    const dispatched = this.opts.onClientEvent({ ...event, deviceId: this.authed.get(ws), viewerId: this.viewers.get(ws) }, ws);
+                    void Promise.resolve(dispatched).catch(() => {
+                        if (ws.readyState === ws.OPEN) {
+                            ws.send(JSON.stringify({ type: "error", message: "Client event failed" }));
+                        }
+                    });
+                }
+                catch {
+                    ws.send(JSON.stringify({ type: "error", message: "Client event failed" }));
+                }
             });
             ws.on("close", () => {
                 this.releaseSocket(ws);
@@ -203,10 +250,35 @@ export class RemoteHostManager extends EventEmitter {
             : options.host === "lan"
                 ? (resolveLanHost() ?? "127.0.0.1")
                 : options.host;
-        await new Promise((resolve, reject) => {
-            server.once("error", reject);
-            server.listen(options.port, bindHost, () => resolve());
-        });
+        try {
+            await new Promise((resolve, reject) => {
+                const onError = (error) => reject(error);
+                server.once("error", onError);
+                server.listen(options.port, bindHost, () => {
+                    server.off("error", onError);
+                    resolve();
+                });
+            });
+        }
+        catch (error) {
+            for (const client of this.wss?.clients ?? [])
+                client.terminate();
+            try {
+                this.wss?.close();
+            }
+            catch {
+                // A noServer WebSocketServer may not have entered a running state yet.
+            }
+            server.closeAllConnections?.();
+            if (server.listening) {
+                await new Promise((resolveClose) => server.close(() => resolveClose()));
+            }
+            if (this.server === server)
+                this.server = undefined;
+            this.wss = undefined;
+            this.passcode = undefined;
+            throw error;
+        }
         const addr = server.address();
         const port = typeof addr === "object" && addr ? addr.port : options.port;
         this.started = {
@@ -243,19 +315,34 @@ export class RemoteHostManager extends EventEmitter {
      * trusted-device store (which rejects revoked devices), so the remote host
      * never executes tools itself — it only gates transport.
      */
-    handleClientEvent(event) {
+    handleClientEvent(input) {
+        const event = parseMobileClientEvent(input);
+        if (!event)
+            return { type: "error", message: "Invalid client event" };
         if (event.type === "pair.complete") {
-            if (!this.pairing.consume(event.token)) {
+            let device;
+            try {
+                device = this.pairing.commit(event.token, () => this.opts.devices.addDevice({
+                    name: event.name,
+                    secretHash: event.secretHash,
+                }));
+            }
+            catch {
+                return { type: "pair.failed", message: "Trusted device store is unavailable" };
+            }
+            if (!device) {
                 return { type: "pair.failed", message: "Pairing token expired or invalid" };
             }
-            const device = this.opts.devices.addDevice({
-                name: event.name,
-                secretHash: event.secretHash,
-            });
             return { type: "pair.ok", device };
         }
         if (event.type === "auth.device") {
-            const device = this.opts.devices.authenticate(event.deviceId, event.secretHash);
+            let device;
+            try {
+                device = this.opts.devices.authenticate(event.deviceId, event.secretHash);
+            }
+            catch {
+                return { type: "auth.failed", message: "Trusted device store is unavailable" };
+            }
             if (!device)
                 return { type: "auth.failed", message: "Device is not trusted" };
             return { type: "auth.ok", device };
@@ -309,6 +396,8 @@ export class RemoteHostManager extends EventEmitter {
         this.markOffline(deviceId);
     }
     async stop() {
+        if (this.starting)
+            await this.starting.catch(() => undefined);
         const server = this.server;
         // Forcibly drop live WS sockets first. wss.close() alone waits for clients
         // to disconnect, so a phone left connected would hang stop() indefinitely.

package/dist/mobile-remote/room-manager.d.ts

@@ -150,6 +150,9 @@ export declare class RoomManager {
      *  Holds the raw tool input so respondApproval can bake the user's answer into
      *  the `answers` record the CLI expects. Cleared on response. */
     private pendingAskUser;
+    /** Original server-observed tool inputs for ordinary approvals. The response
+     * client may approve or deny, but must not replace the command/path it saw. */
+    private pendingApprovalInputs;
     /** User turns are echoed immediately for responsive room UX. When a
      * transcript follower later sees the same CLI-written user line, this queue
      * suppresses that duplicate. */
@@ -174,15 +177,20 @@ export declare class RoomManager {
     private pendingLastActive;
     private lastActiveWrittenAt;
     private now;
+    private readonly rootRealPath;
     /** Drop all pending AskUser entries for a room. Called when its agent goes
      *  away (exit/close) so a request that can no longer be answered doesn't leak
      *  in the map (small memory leak) and its approval card doesn't hang until the
      *  5-min timeout. Keys are `${roomId}:${requestId}`. */
-    private clearPendingAskUser;
+    private clearPendingApprovals;
     constructor(opts: RoomManagerOptions);
+    private assertRootUnchanged;
     private roomDir;
+    private checkedRoomFile;
     private metaPath;
     private msgPath;
+    private writeRoomMeta;
+    private appendRoomMessage;
     createRoom(input: {
         name?: string;
         cwd: string;