@cjhyy/code-shell-server 0.8.9 → 0.8.10

package/README.md

@@ -54,21 +54,22 @@ headless serve（本包 serve/）
 agent-server-stdio worker（@cjhyy/code-shell-capability-coding）
 ```
 
-- 浏览器是 core 协议的一等前端（`agent/run` / `agent/streamEvent` / `agent/approvalRequest` / `agent/approve` / `agent/cancel`），serve 只是一根经过认证的薄管道；所有已认证 tab 看到同一条事件流。
+- 浏览器使用受限的 core 协议投影：serve 自己处理会话列表/详情，只允许向 worker 转发 `agent/run`、`agent/approve`、`agent/cancel`，并在转发前校验 workspace 与 session 归属。配置修改、任意 workspace 切换等原始 RPC 不对 Web 开放。
+- 每个 tab 的请求 ID 会在 host 内重写，响应只回到发起 tab；`agent/streamEvent` 等通知才广播给所有已认证 tab，避免多 tab 使用相同本地 ID 时串包。
 - **访问控制只有 passcode + remember-cookie**（决策见 TODO 约束边界「服务端部署不做账号体系」）：scrypt 哈希存储、防爆破锁定、轮换口令使所有旧 cookie 失效。无注册登录、无多用户。
 - 默认只绑 `127.0.0.1`；`--host 0.0.0.0` 暴露到局域网是运维者的显式选择。公网建议走反向代理/tunnel 终结 TLS。
-- 会话持久在磁盘（worker 的数据目录）；serve 或 worker 重启后浏览器重连即恢复列表，worker 在下一条消息时按需重启。
+- 会话、设置与凭据持久在 serve 独占的 worker data root（默认 `<data-dir>/worker`），不再读取宿主机默认 `~/.code-shell`；serve 或 worker 重启后浏览器重连即可恢复列表。
 
 ### CLI 参数
 
-| 参数            | 默认                  | 说明                   |
-| --------------- | --------------------- | ---------------------- |
-| `--cwd`         | 当前目录              | worker 的 workspace 根 |
-| `--port`        | 8790                  | 监听端口               |
-| `--host`        | 127.0.0.1             | 监听地址               |
-| `--passcode`    | （生成）              | 设置/轮换访问口令      |
-| `--data-dir`    | `~/.code-shell/serve` | access.json 位置       |
-| `--static-root` | 自动解析 web dist-app | 覆盖静态资源目录       |
+| 参数            | 默认                  | 说明                                         |
+| --------------- | --------------------- | -------------------------------------------- |
+| `--cwd`         | 当前目录              | worker 的 workspace 根                       |
+| `--port`        | 8790                  | 监听端口                                     |
+| `--host`        | 127.0.0.1             | 监听地址                                     |
+| `--passcode`    | （生成）              | 设置/轮换访问口令                            |
+| `--data-dir`    | `~/.code-shell/serve` | access.json 与隔离 worker data root 的父目录 |
+| `--static-root` | 自动解析 web dist-app | 覆盖静态资源目录                             |
 
 ### Web 客户端开发
 

package/dist/attachment-service.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
-import { appendFile, lstat, mkdir, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { appendFile, lstat, mkdir, open, readdir, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { basename, extname, join, relative, resolve, sep } from "node:path";
 import { sanitizeImageBytes } from "./image-byte-probe.js";
 const CODE_SHELL_DIR = ".code-shell";
@@ -10,6 +11,36 @@ export const DRAFT_ATTACHMENT_TTL_MS = 24 * 60 * 60 * 1000;
 export const SENT_ATTACHMENT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const MAX_STAGED_IMAGE_BYTES = 10 * 1024 * 1024;
 export const MAX_STAGED_FILE_BYTES = 20 * 1024 * 1024;
+const MAX_ATTACHMENT_NAME_CHARS = 1_024;
+const MAX_ATTACHMENT_MIME_CHARS = 256;
+const MAX_MANIFEST_LINE_BYTES = 128 * 1024;
+const MAX_MANIFEST_SCAN_BYTES = 32 * 1024 * 1024;
+const MAX_MANIFEST_RECORDS = 50_000;
+const MAX_ATTACHMENT_SESSION_DIRS = 10_000;
+const ATTACHMENT_ORIGINS = new Set([
+    "paste",
+    "os-drop",
+    "file-panel",
+    "picker",
+    "mention",
+    "generated",
+    "mobile",
+    "im-gateway",
+    "tool",
+]);
+function assertAttachmentLabels(input) {
+    if ((input.name !== undefined &&
+        (typeof input.name !== "string" ||
+            input.name.length > MAX_ATTACHMENT_NAME_CHARS ||
+            input.name.includes("\0"))) ||
+        (input.mime !== undefined &&
+            (typeof input.mime !== "string" ||
+                input.mime.length > MAX_ATTACHMENT_MIME_CHARS ||
+                input.mime.includes("\0"))) ||
+        !ATTACHMENT_ORIGINS.has(input.origin)) {
+        throw new Error("invalid attachment metadata");
+    }
+}
 const IMAGE_MIME_EXT = {
     "image/png": ".png",
     "image/jpeg": ".jpg",
@@ -31,6 +62,7 @@ export async function stageImageDataUrl(input) {
 }
 /** Stage already-transferred bytes without expanding them back through base64. */
 export async function stageImageBytes(input) {
+    assertAttachmentLabels(input);
     const mime = normalizeMime(input.mime);
     if (!ALLOWED_IMAGE_MIMES.has(mime))
         throw new Error(`unsupported image MIME ${input.mime}`);
@@ -39,14 +71,25 @@ export async function stageImageBytes(input) {
     }
     let buffer;
     if (input.sourceFile !== undefined) {
-        const source = await lstat(input.sourceFile);
-        if (!source.isFile() || source.isSymbolicLink()) {
-            throw new Error("image source must be a regular file");
+        if (typeof input.sourceFile !== "string" ||
+            !input.sourceFile ||
+            input.sourceFile.length > 32_768 ||
+            input.sourceFile.includes("\0")) {
+            throw new Error("image source path is invalid");
+        }
+        const handle = await open(input.sourceFile, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+        try {
+            const source = await handle.stat();
+            if (!source.isFile())
+                throw new Error("image source must be a regular file");
+            if (source.size > MAX_STAGED_IMAGE_BYTES) {
+                throw new Error(`image attachment exceeds size limit (${formatBytes(MAX_STAGED_IMAGE_BYTES)})`);
+            }
+            buffer = await handle.readFile();
         }
-        if (source.size > MAX_STAGED_IMAGE_BYTES) {
-            throw new Error(`image attachment exceeds size limit (${formatBytes(MAX_STAGED_IMAGE_BYTES)})`);
+        finally {
+            await handle.close();
         }
-        buffer = await readFile(input.sourceFile);
     }
     else {
         buffer = Buffer.from(input.bytes);
@@ -54,6 +97,7 @@ export async function stageImageBytes(input) {
     return stageImageBuffer(input, mime, buffer);
 }
 async function stageImageBuffer(input, mime, buffer) {
+    assertAttachmentLabels(input);
     const cwd = await resolveExistingDirectory(input.cwd, "cwd");
     assertSafeSessionId(input.sessionId);
     if (buffer.byteLength > MAX_STAGED_IMAGE_BYTES) {
@@ -107,6 +151,7 @@ async function stageImageBuffer(input, mime, buffer) {
 }
 /** Stage an untrusted non-image file inside the canonical attachment root. */
 export async function stageFileBytes(input) {
+    assertAttachmentLabels(input);
     const cwd = await resolveExistingDirectory(input.cwd, "cwd");
     assertSafeSessionId(input.sessionId);
     const buffer = Buffer.from(input.bytes);
@@ -480,33 +525,121 @@ async function findExistingSessionFile(sessionDir, sha16) {
     catch {
         return null;
     }
-    return entries.find((entry) => entry.startsWith(`${sha16}-`) && entry !== MANIFEST_FILE) ?? null;
+    for (const entry of entries) {
+        if (!entry.startsWith(`${sha16}-`) || entry === MANIFEST_FILE)
+            continue;
+        const info = await lstat(join(sessionDir, entry));
+        if (info.isSymbolicLink() || !info.isFile()) {
+            throw new Error("existing attachment hash entry must be a regular file, not a symlink");
+        }
+        return entry;
+    }
+    return null;
 }
 async function appendManifest(sessionDir, record) {
     const manifest = await safeJoin(sessionDir, MANIFEST_FILE, sessionDir);
-    await appendFile(manifest, `${JSON.stringify(record)}\n`, "utf-8");
+    const serialized = JSON.stringify(record);
+    if (Buffer.byteLength(serialized, "utf8") > MAX_MANIFEST_LINE_BYTES) {
+        throw new Error("attachment manifest record exceeds the size limit");
+    }
+    await appendFile(manifest, `${serialized}\n`, { encoding: "utf-8", mode: 0o600 });
 }
 async function readManifest(sessionDir) {
     try {
         const manifest = await safeJoin(sessionDir, MANIFEST_FILE, sessionDir);
-        const raw = await readFile(manifest, "utf-8");
+        const handle = await open(manifest, "r");
+        let raw;
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile())
+                return [];
+            const length = Math.min(stat.size, MAX_MANIFEST_SCAN_BYTES);
+            const start = stat.size - length;
+            const buffer = Buffer.allocUnsafe(length);
+            let total = 0;
+            while (total < length) {
+                const { bytesRead } = await handle.read(buffer, total, length - total, start + total);
+                if (bytesRead === 0)
+                    break;
+                total += bytesRead;
+            }
+            let window = buffer.subarray(0, total);
+            if (start > 0) {
+                const newline = window.indexOf(0x0a);
+                if (newline < 0)
+                    return [];
+                window = window.subarray(newline + 1);
+            }
+            raw = window.toString("utf8");
+        }
+        finally {
+            await handle.close();
+        }
         return raw
             .split("\n")
-            .filter(Boolean)
+            .filter((line) => line.length > 0 && Buffer.byteLength(line, "utf8") <= MAX_MANIFEST_LINE_BYTES)
             .map((line) => {
             try {
-                return JSON.parse(line);
+                return parseManifestRecord(JSON.parse(line));
             }
             catch {
                 return null;
             }
         })
-            .filter((record) => !!record);
+            .filter((record) => !!record)
+            .slice(-MAX_MANIFEST_RECORDS);
     }
     catch {
         return [];
     }
 }
+function parseManifestRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const raw = value;
+    if ((raw.event !== "staged" &&
+        raw.event !== "sent" &&
+        raw.event !== "removedFromDraft" &&
+        raw.event !== "cleanup") ||
+        typeof raw.sessionId !== "string") {
+        return null;
+    }
+    try {
+        assertSafeSessionId(raw.sessionId);
+    }
+    catch {
+        return null;
+    }
+    for (const field of [
+        "id",
+        "path",
+        "absPath",
+        "relPath",
+        "mime",
+        "sha256",
+        "originalName",
+    ]) {
+        const item = raw[field];
+        if (item !== undefined && (typeof item !== "string" || item.length > 32_768 || item.includes("\0"))) {
+            return null;
+        }
+    }
+    if (raw.kind !== undefined &&
+        raw.kind !== "image" &&
+        raw.kind !== "file" &&
+        raw.kind !== "directory") {
+        return null;
+    }
+    if (raw.origin !== undefined && !ATTACHMENT_ORIGINS.has(raw.origin)) {
+        return null;
+    }
+    for (const field of ["size", "createdAt", "sentAt", "removedAt", "cleanedAt"]) {
+        const item = raw[field];
+        if (item !== undefined && (typeof item !== "number" || !Number.isFinite(item)))
+            return null;
+    }
+    return raw;
+}
 async function listSafeSessionDirs(root) {
     let entries;
     try {
@@ -517,6 +650,7 @@ async function listSafeSessionDirs(root) {
     }
     return entries
         .filter((entry) => entry.isDirectory())
+        .slice(0, MAX_ATTACHMENT_SESSION_DIRS)
         .map((entry) => entry.name)
         .filter((name) => {
         try {

package/dist/mobile-remote/access-passcode.d.ts

@@ -1,3 +1,5 @@
+export declare const MIN_ACCESS_PASSCODE_LENGTH = 4;
+export declare const MAX_ACCESS_PASSCODE_LENGTH = 256;
 /** Minimal structural views of node:http req/res so `gate` is unit-testable
  *  without a real server. */
 interface GateRequest {
@@ -43,6 +45,7 @@ export declare class AccessPasscode {
     private readonly lockoutMs;
     private readonly tokenMaxAgeMs;
     private failures;
+    private malformed;
     private lockedUntil;
     constructor(opts: AccessPasscodeOptions);
     isSet(): boolean;
@@ -71,6 +74,16 @@ export declare class AccessPasscode {
      *  write). Used by the WS gate which cannot send a challenge page. */
     allows(req: GateRequest): boolean;
     private isLocked;
+    private recordFailure;
+    /**
+     * Count a request whose passcode could not even be a passcode.
+     *
+     * Kept separate from `recordFailure` so junk traffic cannot spend the
+     * credential-guessing budget and lock out the owner. The budget is a large
+     * multiple of `maxAttempts`: a determined flood is still throttled, but the
+     * handful of malformed submissions a real client produces never is.
+     */
+    private recordMalformed;
     private issueToken;
     private sign;
     private hashPasscode;

package/dist/mobile-remote/access-passcode.js

@@ -1,11 +1,17 @@
 import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 const DEFAULT_MAX_ATTEMPTS = 5;
+/** Malformed submissions allowed per `maxAttempts` before throttling kicks in. */
+const MALFORMED_ATTEMPT_MULTIPLIER = 20;
 const DEFAULT_LOCKOUT_MS = 60_000;
 const DEFAULT_TOKEN_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 const COOKIE_NAME = "cs_access";
 const SCRYPT_KEYLEN = 32;
+export const MIN_ACCESS_PASSCODE_LENGTH = 4;
+export const MAX_ACCESS_PASSCODE_LENGTH = 256;
+const MAX_REMEMBER_TOKEN_LENGTH = 128;
+const MAX_ACCESS_RECORD_BYTES = 4 * 1024;
 /**
  * The public-tunnel access gate. A single shared passcode (set by the desktop
  * user) guards the tunnel; a phone that enters it correctly receives a signed
@@ -25,8 +31,15 @@ export class AccessPasscode {
     lockoutMs;
     tokenMaxAgeMs;
     failures = 0;
+    malformed = 0;
     lockedUntil = 0;
     constructor(opts) {
+        if (!opts || typeof opts.filePath !== "string" || !opts.filePath) {
+            throw new Error("Access passcode filePath is required");
+        }
+        assertPositiveSafeInteger("maxAttempts", opts.maxAttempts);
+        assertPositiveSafeInteger("lockoutMs", opts.lockoutMs);
+        assertPositiveSafeInteger("tokenMaxAgeMs", opts.tokenMaxAgeMs);
         this.filePath = opts.filePath;
         this.now = opts.now ?? Date.now;
         this.maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
@@ -38,6 +51,9 @@ export class AccessPasscode {
     }
     /** Set (or rotate) the passcode. Rotating `secret` invalidates old tokens. */
     set(passcode) {
+        if (!isValidPasscode(passcode)) {
+            throw new Error(`Access passcode must be ${MIN_ACCESS_PASSCODE_LENGTH}-${MAX_ACCESS_PASSCODE_LENGTH} characters`);
+        }
         const salt = randomBytes(16).toString("hex");
         const hash = this.hashPasscode(passcode, salt);
         const secret = randomBytes(32).toString("hex");
@@ -56,12 +72,21 @@ export class AccessPasscode {
             return null;
         if (this.isLocked())
             return null;
+        // Malformed input is rejected before the expensive hash, but it must NOT
+        // spend the credential-guessing budget. A value outside the length bounds
+        // is not a candidate passcode — no 4..256 check can be "guessed" by a
+        // 1-character string — so counting it deterred no attack while handing an
+        // unauthenticated caller a free lockout: five `?passcode=1` requests locked
+        // the legitimate owner out for the whole window, repeatable indefinitely.
+        // It still costs an attempt against a much larger malformed-input budget,
+        // so a script hammering junk is not free either.
+        if (!isValidPasscode(passcode)) {
+            this.recordMalformed();
+            return null;
+        }
         const candidate = this.hashPasscode(passcode, record.salt);
         if (!safeEqualHex(candidate, record.hash)) {
-            this.failures++;
-            if (this.failures >= this.maxAttempts) {
-                this.lockedUntil = this.now() + this.lockoutMs;
-            }
+            this.recordFailure();
             return null;
         }
         this.failures = 0;
@@ -73,6 +98,11 @@ export class AccessPasscode {
      *  issue timestamp must be within the validity window (so a stolen/synced
      *  cookie cannot grant access indefinitely). */
     verifyToken(token) {
+        if (typeof token !== "string" ||
+            token.length === 0 ||
+            token.length > MAX_REMEMBER_TOKEN_LENGTH) {
+            return false;
+        }
         const record = this.read();
         if (!record)
             return false;
@@ -89,7 +119,8 @@ export class AccessPasscode {
         const issuedAt = Number(payload.slice(payload.indexOf(".") + 1));
         if (!Number.isFinite(issuedAt))
             return false;
-        return this.now() - issuedAt <= this.tokenMaxAgeMs;
+        const age = this.now() - issuedAt;
+        return age >= 0 && age <= this.tokenMaxAgeMs;
     }
     /**
      * HTTP gate. Returns true (allow) when the request carries a valid remember
@@ -132,6 +163,10 @@ export class AccessPasscode {
                     res.end();
                     return false;
                 }
+                // Non-HTML/no-JS callers still use the historical GET fallback, so the
+                // passcode may appear in reverse-proxy access logs. Browser clients use
+                // the header-based fetch in challengePage and are redirected to a clean
+                // URL; deployments should redact the `passcode` query parameter in logs.
                 return true;
             }
             wrongAttempt = true;
@@ -172,6 +207,27 @@ export class AccessPasscode {
         }
         return true;
     }
+    recordFailure() {
+        this.failures++;
+        if (this.failures >= this.maxAttempts) {
+            this.lockedUntil = this.now() + this.lockoutMs;
+        }
+    }
+    /**
+     * Count a request whose passcode could not even be a passcode.
+     *
+     * Kept separate from `recordFailure` so junk traffic cannot spend the
+     * credential-guessing budget and lock out the owner. The budget is a large
+     * multiple of `maxAttempts`: a determined flood is still throttled, but the
+     * handful of malformed submissions a real client produces never is.
+     */
+    recordMalformed() {
+        this.malformed++;
+        if (this.malformed >= this.maxAttempts * MALFORMED_ATTEMPT_MULTIPLIER) {
+            this.malformed = 0;
+            this.lockedUntil = this.now() + this.lockoutMs;
+        }
+    }
     issueToken(record) {
         const payload = `${randomBytes(12).toString("hex")}.${this.now()}`;
         const sig = this.sign(payload, record.secret);
@@ -186,20 +242,94 @@ export class AccessPasscode {
     read() {
         if (!existsSync(this.filePath))
             return undefined;
+        let fd;
         try {
-            const parsed = JSON.parse(readFileSync(this.filePath, "utf-8"));
-            if (parsed.hash && parsed.salt && parsed.secret) {
-                return { hash: parsed.hash, salt: parsed.salt, secret: parsed.secret };
+            fd = openSync(this.filePath, "r");
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.size > MAX_ACCESS_RECORD_BYTES)
+                return undefined;
+            const buffer = Buffer.allocUnsafe(MAX_ACCESS_RECORD_BYTES + 1);
+            let total = 0;
+            while (total < buffer.byteLength) {
+                const count = readSync(fd, buffer, total, buffer.byteLength - total, total);
+                if (count === 0)
+                    break;
+                total += count;
+            }
+            if (total > MAX_ACCESS_RECORD_BYTES)
+                return undefined;
+            const parsed = JSON.parse(buffer.subarray(0, total).toString("utf8"));
+            if (isAccessRecord(parsed)) {
+                return parsed;
             }
             return undefined;
         }
         catch {
             return undefined;
         }
+        finally {
+            if (fd !== undefined)
+                closeSync(fd);
+        }
     }
     write(record) {
-        mkdirSync(dirname(this.filePath), { recursive: true });
-        writeFileSync(this.filePath, JSON.stringify(record, null, 2), "utf-8");
+        const parent = dirname(this.filePath);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        try {
+            chmodSync(parent, 0o700);
+        }
+        catch {
+            // Best effort on platforms/filesystems without POSIX permissions.
+        }
+        // access.json contains the HMAC signing secret. A direct overwrite can
+        // truncate the only valid record if the process crashes mid-write, and the
+        // default umask can make a newly-created file group/world-readable.
+        const tempPath = `${this.filePath}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+        try {
+            writeFileSync(tempPath, JSON.stringify(record, null, 2), {
+                encoding: "utf-8",
+                flag: "wx",
+                mode: 0o600,
+            });
+            renameSync(tempPath, this.filePath);
+            try {
+                chmodSync(this.filePath, 0o600);
+            }
+            catch {
+                // Best effort on platforms/filesystems without POSIX permissions.
+            }
+        }
+        finally {
+            try {
+                rmSync(tempPath, { force: true });
+            }
+            catch {
+                // Never hide the original write/rename error with cleanup failure.
+            }
+        }
+    }
+}
+function isAccessRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return (typeof record.hash === "string" &&
+        /^[0-9a-f]{64}$/i.test(record.hash) &&
+        typeof record.salt === "string" &&
+        /^[0-9a-f]{32}$/i.test(record.salt) &&
+        typeof record.secret === "string" &&
+        /^[0-9a-f]{64}$/i.test(record.secret));
+}
+function isValidPasscode(value) {
+    return (typeof value === "string" &&
+        value.length >= MIN_ACCESS_PASSCODE_LENGTH &&
+        value.length <= MAX_ACCESS_PASSCODE_LENGTH);
+}
+function assertPositiveSafeInteger(name, value) {
+    if (value === undefined)
+        return;
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${name} must be a positive safe integer`);
     }
 }
 function readCookie(cookieHeader, name) {
@@ -288,6 +418,10 @@ function challengePage(url, wrong, locked) {
         : wrong
             ? "口令不正确,请重试。"
             : "请输入访问口令以继续。";
+    const cleanLocation = JSON.stringify(path + (params.size ? `?${params.toString()}` : ""))
+        .replace(/</g, "\\u003c")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
     return `<!doctype html>
 <html lang="zh"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -311,7 +445,7 @@ function challengePage(url, wrong, locked) {
   <h1>手机遥控</h1>
   <p class="${wrong || locked ? "err" : ""}">${note}</p>
   ${hidden}
-  <input id="passcode" type="password" name="passcode" placeholder="访问口令" autofocus required ${locked ? "disabled" : ""}>
+  <input id="passcode" type="password" name="passcode" placeholder="访问口令" minlength="${MIN_ACCESS_PASSCODE_LENGTH}" maxlength="${MAX_ACCESS_PASSCODE_LENGTH}" autofocus required ${locked ? "disabled" : ""}>
   <button type="submit" ${locked ? "disabled" : ""}>进入</button>
 </form>
 <script>
@@ -333,7 +467,7 @@ function challengePage(url, wrong, locked) {
         if (input) input.value = "";
         return;
       }
-      window.location.replace(${JSON.stringify(path + (params.size ? `?${params.toString()}` : ""))});
+      window.location.replace(${cleanLocation});
     } catch {
       if (note) note.textContent = "连接失败，请重试。";
       if (note) note.className = "err";

package/dist/mobile-remote/mobile-attachments.d.ts

@@ -1,10 +1,7 @@
 import { type InputAttachmentMeta } from "../attachment-service.js";
 import type { MobileAttachmentSummary, MobileImageAttachment } from "./types.js";
 import type { ClaimedMobileUpload, MobileUploadService } from "./mobile-upload-service.js";
-export declare const MAX_MOBILE_ATTACHMENTS = 4;
-export declare const MAX_MOBILE_INLINE_IMAGE_BYTES: number;
-export declare const MAX_MOBILE_INLINE_TOTAL_BYTES: number;
-export declare const MAX_MOBILE_ATTACHMENT_TOTAL_BYTES: number;
+export { MAX_MOBILE_ATTACHMENTS, MAX_MOBILE_ATTACHMENT_TOTAL_BYTES, MAX_MOBILE_INLINE_IMAGE_BYTES, MAX_MOBILE_INLINE_TOTAL_BYTES, } from "./mobile-limits.js";
 interface MaterializeInput {
     deviceId: string;
     cwd: string;
@@ -18,4 +15,3 @@ export declare function materializeMobileAttachments(input: MaterializeInput): P
     claims: ClaimedMobileUpload[];
     summaries: MobileAttachmentSummary[];
 }>;
-export {};

package/dist/mobile-remote/mobile-attachments.js

@@ -1,8 +1,6 @@
 import { stageImageBytes } from "../attachment-service.js";
-export const MAX_MOBILE_ATTACHMENTS = 4;
-export const MAX_MOBILE_INLINE_IMAGE_BYTES = 256 * 1024;
-export const MAX_MOBILE_INLINE_TOTAL_BYTES = 512 * 1024;
-export const MAX_MOBILE_ATTACHMENT_TOTAL_BYTES = 20 * 1024 * 1024;
+import { MAX_MOBILE_ATTACHMENTS, MAX_MOBILE_ATTACHMENT_TOTAL_BYTES, MAX_MOBILE_INLINE_IMAGE_BYTES, MAX_MOBILE_INLINE_TOTAL_BYTES, } from "./mobile-limits.js";
+export { MAX_MOBILE_ATTACHMENTS, MAX_MOBILE_ATTACHMENT_TOTAL_BYTES, MAX_MOBILE_INLINE_IMAGE_BYTES, MAX_MOBILE_INLINE_TOTAL_BYTES, } from "./mobile-limits.js";
 const ALLOWED_MIMES = new Set([
     "image/png",
     "image/jpeg",

package/dist/mobile-remote/mobile-client-event-validator.d.ts

@@ -0,0 +1,3 @@
+import type { MobileClientEvent } from "./types.js";
+/** Runtime validation at the WebSocket boundary; TypeScript types do not validate JSON. */
+export declare function parseMobileClientEvent(value: unknown): MobileClientEvent | undefined;