@cjhyy/code-shell-server 0.9.29 → 0.9.31

package/dist/links/http.js

@@ -113,6 +113,7 @@ export function createLinkHttp(options) {
                             "connectionId",
                             "expectedRevision",
                             "authModeId",
+                            "resourceUrl",
                         ]);
                         result = await service.startAuthorization(owner, input, input.authModeId);
                     }
@@ -170,6 +171,7 @@ export function createLinkHttp(options) {
                             "connectionId",
                             "expectedRevision",
                             ...(token ? ["token"] : []),
+                            ...(url.pathname.endsWith("/remote") ? ["resourceUrl"] : []),
                         ]);
                         result = token
                             ? await service.connectToken(owner, input)

package/dist/links/remote-catalog.d.ts

@@ -8,7 +8,7 @@ export declare const REMOTE_LINK_ADAPTERS: ({
     id: "github";
     name: "GitHub";
     group: "repositories";
-    actions: readonly ["list_repositories", "get_readme", "get_file", "list_issues", "get_issue", "list_pull_requests", "get_pull_request", "create_issue", "get_repository", "get_starred", "set_starred"];
+    actions: readonly ["list_repositories", "get_readme", "get_file", "list_issues", "get_issue", "list_pull_requests", "get_pull_request", "create_issue", "update_issue", "get_repository", "get_starred", "set_starred"];
 } | {
     methodId: string;
     authModeId: string;

package/dist/links/remote-catalog.js

@@ -20,10 +20,14 @@ export async function readRemoteProviderCatalog(configuration) {
 /** A legacy v1 service has no catalog. Its one already-reviewed adapter remains compatible. */
 export async function readRemoteProviderCapabilities(configuration) {
     const issuer = beginRemoteLinkAuthorization(configuration).configuration.issuer;
+    const scopes = REMOTE_LINK_ADAPTERS.flatMap((adapter) => adapter.scopes);
+    const capabilities = JSON.stringify({ version: 1, scopes });
+    if (scopes.length > 128 || Buffer.byteLength(capabilities) > 4_096)
+        throw new Error("Host Link capabilities exceed catalog negotiation limits");
     const response = await fetch(new URL("/api/v1/links/providers", issuer), {
         redirect: "error",
         signal: AbortSignal.timeout(5_000),
-        headers: { Accept: "application/json" },
+        headers: { Accept: "application/json", "X-CodeShell-Link-Capabilities": capabilities },
     });
     if ([404, 501].includes(response.status)) {
         await response.body?.cancel();

package/dist/links/service.js

@@ -186,6 +186,14 @@ export function createLinkService(options = {}) {
                 id: meta.linkAccountId,
                 label: meta.linkAccountLabel,
                 resources: meta.linkResourceLabels?.slice(0, 100) ?? [],
+                ...(remote && meta.linkResourceGroups
+                    ? {
+                        resourceGroups: meta.linkResourceGroups.map((group) => ({
+                            id: group.id,
+                            items: group.items.map((item) => ({ id: item.id, label: item.label })),
+                        })),
+                    }
+                    : {}),
             },
             capabilityIds: meta.linkCapabilityIds ?? [],
             verifiedAt: meta.linkLastVerifiedAt,
@@ -664,6 +672,8 @@ export function createLinkService(options = {}) {
     async function startAuthorization(context, input, rawAuthModeId) {
         await authorize(context);
         const authModeId = string(rawAuthModeId, 80);
+        if (input?.resourceUrl !== undefined && authModeId !== "remote-link")
+            throw new LinkServiceError(400, "invalid_request");
         if (authModeId === "remote-link")
             await refreshRemoteCatalog(context);
         const provider = snapshot().providers.find((candidate) => candidate.id === input?.providerId);
@@ -1029,7 +1039,12 @@ export function createLinkService(options = {}) {
         checkCapacity();
         if (!input ||
             input.methodId !== "remote-link" ||
-            !REMOTE_LINK_ADAPTERS.some((adapter) => adapter.id === input.providerId))
+            !REMOTE_LINK_ADAPTERS.some((adapter) => adapter.id === input.providerId) ||
+            (input.resourceUrl !== undefined &&
+                (input.providerId !== "figma" ||
+                    !input.connectionId ||
+                    typeof input.resourceUrl !== "string" ||
+                    !input.resourceUrl)))
             throw new LinkServiceError(400, "invalid_request");
         const config = options.remoteLink?.();
         if (!config)
@@ -1055,11 +1070,24 @@ export function createLinkService(options = {}) {
                 throw new LinkServiceError(409, "conflict");
         }
         const prepared = { id, expected, input: { ...input, label: string(input.label) } };
+        if (input.resourceUrl !== undefined && !expected)
+            throw new LinkServiceError(400, "invalid_request");
         let attempt;
         try {
+            let resourceFiles;
+            if (input.providerId === "figma") {
+                // Recover the old whitelist from Host custody. Browser input can only suggest one new file.
+                const groups = expected?.meta?.linkResourceGroups;
+                if (expected && (!groups || groups.length !== 1 || groups[0]?.id !== "files"))
+                    throw new Error("Invalid saved Figma resources");
+                resourceFiles = groups?.[0]?.items.map((item) => item.id) ?? [];
+                if (input.resourceUrl !== undefined)
+                    resourceFiles.push(input.resourceUrl);
+            }
             attempt = beginRemoteLinkAuthorization(config, now(), {
                 providerId: input.providerId,
                 actions: capabilities.actions,
+                ...(resourceFiles !== undefined ? { resourceFiles } : {}),
             });
         }
         catch {
@@ -1123,6 +1151,10 @@ export function createLinkService(options = {}) {
                 },
             });
             await check();
+            if (job.attempt.providerId === "figma" &&
+                job.prepared.expected &&
+                credential.meta?.linkAccountId !== job.prepared.expected.meta?.linkAccountId)
+                throw new LinkServiceError(409, "conflict");
             const guarded = {
                 ownerId: context.ownerId,
                 authorize: async () => {

package/dist/mobile-remote/mobile-chat-turn.d.ts

@@ -1,5 +1,5 @@
 import { markAttachmentsSent, type InputAttachmentMeta } from "../attachment-service.js";
-import { type MobileRunBridge } from "./mobile-run-dispatch.js";
+import { type MobileRunBridge, type MobileRunAcceptance, type MobileRunRequest } from "./mobile-run-dispatch.js";
 import type { MobileUploadService } from "./mobile-upload-service.js";
 import type { MobileAttachmentSummary, MobileImageAttachment, PermissionMode } from "./types.js";
 import type { WorkerFrameMeta } from "../worker-bridge-core.js";
@@ -20,6 +20,8 @@ export interface DispatchMobileChatTurnInput {
     uploads: ChatTurnUploads;
     resolveWorkspace: (sessionId: string, fallbackCwd: string) => Promise<string>;
     markSent?: typeof markAttachmentsSent;
+    /** Host-owned alternative producer; receives the same materialized input and ack boundary. */
+    submit?: (request: MobileRunRequest) => Promise<MobileRunAcceptance>;
 }
 export type DispatchMobileChatTurnResult = {
     ok: true;

package/dist/mobile-remote/mobile-chat-turn.js

@@ -1,7 +1,7 @@
 import { markAttachmentsSent } from "../attachment-service.js";
 import { stablePromptHash } from "../client-message-id.js";
 import { materializeMobileAttachments } from "./mobile-attachments.js";
-import { injectMobileRunAndAwaitAcceptance } from "./mobile-run-dispatch.js";
+import { injectMobileRunAndAwaitAcceptance, } from "./mobile-run-dispatch.js";
 async function settleClaims(uploads, deviceId, claims, action) {
     await Promise.allSettled(claims.map((claim) => uploads[action](deviceId, claim.uploadId, claim.claimId)));
 }
@@ -40,7 +40,7 @@ export async function dispatchMobileChatTurn(input) {
     }
     const clientMessageId = suppliedClientMessageId ||
         `mobile:${input.sessionId}:${input.runId}:${stablePromptHash(`${text}\0${attachmentHash}`)}`;
-    const acceptance = await injectMobileRunAndAwaitAcceptance(input.bridge, {
+    const request = {
         id: input.runId,
         params: {
             task: text,
@@ -52,7 +52,16 @@ export async function dispatchMobileChatTurn(input) {
             attachments: materialized.metas,
             ...(input.permissionMode ? { permissionMode: input.permissionMode } : {}),
         },
-    }, input.meta);
+    };
+    let acceptance;
+    try {
+        acceptance = input.submit
+            ? await input.submit(request)
+            : await injectMobileRunAndAwaitAcceptance(input.bridge, request, input.meta);
+    }
+    catch {
+        acceptance = { ok: false, message: "The selected runtime rejected the submission" };
+    }
     if (!acceptance.ok) {
         await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
         return { ok: false, message: acceptance.message };

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -41,6 +41,21 @@ export function parseMobileClientEvent(value) {
                     event.size <= MAX_MOBILE_IMAGE_BYTES;
             break;
         case "session.select":
+            valid =
+                boundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.recoveryId, 128);
+            break;
+        case "session.recovery.cancel":
+            valid = true;
+            break;
+        case "session.outputJournal":
+            valid =
+                boundedString(event.sessionId, 128) &&
+                    boundedString(event.recoveryId, 128) &&
+                    boundedString(event.requestId, 128) &&
+                    optionalBoundedString(event.after, 2048) &&
+                    optionalBoundedString(event.through, 2048);
+            break;
         case "session.history":
             valid = boundedString(event.sessionId, MAX_ID_LENGTH);
             break;

package/dist/mobile-remote/remote-host-manager.d.ts

@@ -36,6 +36,7 @@ export interface RemoteHostStarted {
 }
 export interface RemoteHostManagerOptions {
     devices: TrustedDeviceStore;
+    outputJournal?: boolean;
     onClientEvent: (event: unknown, ws: WebSocket) => void | Promise<void>;
     /**
      * Absolute path to the built mobile app (out/mobile). Defaults to the
@@ -116,6 +117,9 @@ export declare class RemoteHostManager extends EventEmitter {
      *  one phone's session/permission state never leaks onto another's screen.
      *  A device with no live socket (raced a disconnect) is a silent no-op. */
     sendToDevice(deviceId: string, event: MobileServerEvent): void;
+    /** Reply only to the currently authenticated tab; retired/revoked viewers receive nothing. */
+    hasAuthenticatedViewer(viewerId: string, deviceId: string): boolean;
+    sendToViewer(viewerId: string, event: MobileServerEvent): void;
     /** Send a raw JSON-RPC worker line to ONLY one authenticated device. */
     sendRawToDevice(deviceId: string, payload: string): void;
     /** Broadcast a raw line (e.g. a mirrored worker→renderer JSON-RPC line) to

package/dist/mobile-remote/remote-host-manager.js

@@ -406,7 +406,11 @@ export class RemoteHostManager extends EventEmitter {
             if (!device) {
                 return { type: "pair.failed", message: "Pairing token expired or invalid" };
             }
-            return { type: "pair.ok", device };
+            return {
+                type: "pair.ok",
+                device,
+                ...(this.opts.outputJournal ? { capabilities: { outputJournal: 1 } } : {}),
+            };
         }
         if (event.type === "auth.device") {
             let device;
@@ -418,7 +422,11 @@ export class RemoteHostManager extends EventEmitter {
             }
             if (!device)
                 return { type: "auth.failed", message: "Device is not trusted" };
-            return { type: "auth.ok", device };
+            return {
+                type: "auth.ok",
+                device,
+                ...(this.opts.outputJournal ? { capabilities: { outputJournal: 1 } } : {}),
+            };
         }
         return undefined;
     }
@@ -438,6 +446,33 @@ export class RemoteHostManager extends EventEmitter {
             }
         }
     }
+    /** Reply only to the currently authenticated tab; retired/revoked viewers receive nothing. */
+    hasAuthenticatedViewer(viewerId, deviceId) {
+        for (const client of this.wss?.clients ?? []) {
+            if (client.readyState === client.OPEN &&
+                this.authed.get(client) === deviceId &&
+                this.viewers.get(client) === viewerId)
+                return true;
+        }
+        return false;
+    }
+    sendToViewer(viewerId, event) {
+        const payload = JSON.stringify(event);
+        for (const client of this.wss?.clients ?? []) {
+            if (client.readyState === client.OPEN &&
+                this.authed.has(client) &&
+                this.viewers.get(client) === viewerId) {
+                // A selected viewer cannot accumulate an unbounded outbound page queue
+                // by issuing new reads while refusing to consume prior replies.
+                if (client.bufferedAmount + Buffer.byteLength(payload) > 4 * 1024 * 1024) {
+                    this.releaseSocket(client);
+                    client.terminate();
+                    return;
+                }
+                client.send(payload);
+            }
+        }
+    }
     /** Send a raw JSON-RPC worker line to ONLY one authenticated device. */
     sendRawToDevice(deviceId, payload) {
         for (const client of this.wss?.clients ?? []) {

package/dist/panels/browser-capture.d.ts

@@ -0,0 +1,15 @@
+/** Bounded, domain-neutral requests for the trusted browser's recording chooser. */
+export declare const panelVideoLimits: Readonly<{
+    maxDurationSeconds: 1200;
+    maxBytes: number;
+    defaultDurationSeconds: 300;
+    defaultBytes: number;
+}>;
+export interface PanelVideoOptions {
+    source: "camera" | "screen";
+    microphone: boolean;
+    systemAudio: boolean;
+    maxDurationSeconds: number;
+    maxBytes: number;
+}
+export declare function panelVideoOptions(raw: unknown): PanelVideoOptions;

package/dist/panels/browser-capture.js

@@ -0,0 +1,35 @@
+/** Bounded, domain-neutral requests for the trusted browser's recording chooser. */
+export const panelVideoLimits = Object.freeze({
+    maxDurationSeconds: 1200,
+    maxBytes: 200 * 1024 * 1024,
+    defaultDurationSeconds: 300,
+    defaultBytes: 64 * 1024 * 1024,
+});
+export function panelVideoOptions(raw) {
+    const value = raw;
+    if (!value ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        Object.keys(value).some((key) => !["source", "microphone", "systemAudio", "maxDurationSeconds", "maxBytes"].includes(key)) ||
+        (value.source !== "camera" && value.source !== "screen") ||
+        (value.microphone !== undefined && typeof value.microphone !== "boolean") ||
+        (value.systemAudio !== undefined && typeof value.systemAudio !== "boolean") ||
+        (value.source !== "screen" && value.systemAudio === true))
+        throw new Error("视频录制请求无效。");
+    const maxDurationSeconds = value.maxDurationSeconds ?? panelVideoLimits.defaultDurationSeconds;
+    const maxBytes = value.maxBytes ?? panelVideoLimits.defaultBytes;
+    if (!Number.isSafeInteger(maxDurationSeconds) ||
+        Number(maxDurationSeconds) < 1 ||
+        Number(maxDurationSeconds) > panelVideoLimits.maxDurationSeconds ||
+        !Number.isSafeInteger(maxBytes) ||
+        Number(maxBytes) < 1 ||
+        Number(maxBytes) > panelVideoLimits.maxBytes)
+        throw new Error("视频录制限制无效。");
+    return {
+        source: value.source,
+        microphone: value.microphone !== false,
+        systemAudio: value.systemAudio === true,
+        maxDurationSeconds: Number(maxDurationSeconds),
+        maxBytes: Number(maxBytes),
+    };
+}

package/dist/panels/management.d.ts

@@ -1,5 +1,4 @@
 import { type PanelAppPreview, type PanelAppSourceInput } from "@cjhyy/code-shell-core";
-import { getRefCommit } from "@cjhyy/code-shell-core/internal/skills";
 import type { PanelCompatibility, PanelDiscovery, PanelOperationContext, PanelReview, PanelProjectReview, PanelSnapshot, PanelPackageHistory, PanelPackageRestoreReview } from "./types.js";
 export declare class PanelManagementError extends Error {
     readonly status: number;
@@ -23,7 +22,10 @@ export interface PanelManagementOptions {
     compatibility?: (app: Pick<PanelAppPreview, "permissions" | "agent">) => PanelCompatibility;
     now?: () => number;
     /** Network seam only; production still uses the reviewed Core installer. */
-    resolveCommit?: typeof getRefCommit;
+    resolveCommit?: (info: {
+        owner: string;
+        repo: string;
+    }, ref: string) => Promise<string>;
 }
 export declare function createPanelManagement(options: PanelManagementOptions): {
     snapshot: (appId?: string) => Promise<PanelSnapshot>;

package/dist/panels/management.js

@@ -3,9 +3,9 @@ import { panelPackageMutationMatches } from "./package-mutation.js";
 import { createHash, randomBytes } from "node:crypto";
 import { lstatSync, mkdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, join, resolve } from "node:path";
-import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
+import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
 import { mutateJsonFile } from "@cjhyy/code-shell-core/internal";
-import { getRefCommit, parseGithubUrl } from "@cjhyy/code-shell-core/internal/skills";
+import { parseGithubUrl } from "@cjhyy/code-shell-core/internal/skills";
 const REVIEW_TTL = 8 * 60_000;
 const MAX_REVIEWS = 8;
 const MAX_NETWORK = 2;
@@ -47,7 +47,7 @@ export function publicPanelError(error) {
         return new PanelManagementError(503, "github_unavailable", "GitHub 暂时不可用，请稍后重试。");
     if (/(?:ENOTFOUND|EAI_AGAIN|ECONNRESET|ECONNREFUSED|UND_ERR_SOCKET)/.test(code) ||
         /^(?:fetch failed|Failed to fetch)$/i.test(message) ||
-        /GitHub source download failed/i.test(message))
+        /GitHub source (?:download|ref lookup) failed/i.test(message))
         return new PanelManagementError(502, "github_network", "服务端无法连接 GitHub，请检查网络、DNS 或代理设置后重试。");
     if (error instanceof PanelAppInstallError)
         return new PanelManagementError(400, "invalid_source", error.message);
@@ -352,7 +352,9 @@ export function createPanelManagement(options) {
         const ref = parsed.source.ref ?? "HEAD";
         const commit = SHA.test(ref)
             ? ref.toLowerCase()
-            : await (options.resolveCommit ?? getRefCommit)({ owner: parsed.owner, repo: parsed.repo }, ref);
+            : options.resolveCommit
+                ? await options.resolveCommit({ owner: parsed.owner, repo: parsed.repo }, ref)
+                : await resolveGitHubPanelAppCommit(parsed.source);
         await guard();
         if (!SHA.test(commit))
             throw new PanelManagementError(502, "invalid_source", "GitHub 没有返回有效的提交版本。");

package/dist/panels/runtime.js

@@ -1,3 +1,4 @@
+import { panelVideoLimits, panelVideoOptions } from "./browser-capture.js";
 import { panelExecutionGate, PanelExecutionBusyError } from "./execution-gate.js";
 import { randomBytes, createHash } from "node:crypto";
 import { constants } from "node:fs";
@@ -43,6 +44,8 @@ const METHODS = [
     "resources.open",
     "resources.preview",
     "resources.recordAudio",
+    "resources.recordVideo",
+    "resources.recordVideo.capabilities",
     ...panelToolJobMethods,
     "credentials.connections.list",
     "credentials.cookies.listForTask",
@@ -299,7 +302,7 @@ function bridgeScript(id, origin) {
       const requestId = String(++next);
       const timer = setTimeout(() => {
         pending.delete(requestId); reject(new Error("Panel request timed out"));
-      }, ["tasks.start", "tasks.retry", "tasks.queue.set", "resources.recordAudio"].includes(method) ? 30 * 60 * 1000 : 60000);
+      }, ["tasks.start", "tasks.retry", "tasks.queue.set", "resources.recordAudio", "resources.recordVideo"].includes(method) ? 30 * 60 * 1000 : 60000);
       pending.set(requestId, { resolve, reject, timer });
       try {
         parent.postMessage({ type: "codeshell-panel:call", instanceId: id, requestId, method, params }, origin);
@@ -1128,6 +1131,7 @@ export function createPanelRuntime(options) {
                         ? {
                             methodLimits: {
                                 "resources.recordAudio": { timeoutMs: 30 * 60 * 1000 },
+                                "resources.recordVideo": { timeoutMs: 30 * 60 * 1000 },
                                 ...(app.permissions.includes("process")
                                     ? {
                                         "tasks.start": {
@@ -1326,6 +1330,28 @@ export function createPanelRuntime(options) {
             send: (event, payload) => emit(grant, event, payload),
         };
         if (method.startsWith("resources.")) {
+            if (method === "resources.recordVideo.capabilities") {
+                if (params !== undefined &&
+                    (!params ||
+                        typeof params !== "object" ||
+                        Array.isArray(params) ||
+                        Object.keys(params).length))
+                    error(400, "视频录制能力请求无效。");
+                // Device/encoder support belongs to the trusted browser, not this server.
+                return {
+                    effect: method,
+                    maxDurationSeconds: panelVideoLimits.maxDurationSeconds,
+                    maxBytes: panelVideoLimits.maxBytes,
+                };
+            }
+            if (method === "resources.recordVideo") {
+                try {
+                    return { effect: method, ...panelVideoOptions(params) };
+                }
+                catch {
+                    error(400, "视频录制请求或限制无效。");
+                }
+            }
             if (method === "resources.recordAudio") {
                 const value = (params ?? {});
                 const maxDurationSeconds = value.maxDurationSeconds ?? 300;

package/dist/remote-relay/connector.d.ts

@@ -11,7 +11,9 @@ export interface DeviceRelayConnectorOptions {
     relayOrigin: string;
     hostId: string;
     publicOrigin: string;
-    credential: string;
+    credential?: string;
+    /** Main-owned rotating credentials, resolved before each control connection. */
+    getCredential?: (signal: AbortSignal) => Promise<string>;
     /** Target is always 127.0.0.1; stopping its Host revokes this capability. */
     localHost: RelayLocalTarget;
     /** Additional trusted CA for private installations; TLS verification stays enabled. */

package/dist/remote-relay/connector.js

@@ -5,7 +5,8 @@ export function createDeviceRelayConnector(options) {
     if (!isRelayOrigin(options.relayOrigin) ||
         !isRelayOrigin(options.publicOrigin) ||
         !isRelayHostId(options.hostId) ||
-        !isRelayToken(options.credential) ||
+        (!options.getCredential && !isRelayToken(options.credential)) ||
+        (options.getCredential !== undefined && typeof options.getCredential !== "function") ||
         !options.localHost ||
         !Number.isInteger(options.localHost.port) ||
         options.localHost.port < 1 ||
@@ -27,6 +28,7 @@ export function createDeviceRelayConnector(options) {
     let control;
     let reconnect;
     let failures = 0;
+    let credentialAttempt;
     const pending = new Set();
     const streams = new Set();
     const state = (value) => {
@@ -39,18 +41,62 @@ export function createDeviceRelayConnector(options) {
     };
     const track = (done) => {
         pending.add(done);
-        void done.finally(() => pending.delete(done));
+        void done.finally(() => pending.delete(done)).catch(() => { });
     };
-    const connect = (attempt) => {
+    const retry = (attempt) => {
+        if (!running || generation !== attempt || config.localHost.signal.aborted)
+            return;
+        const delay = Math.min(30_000, 500 * 2 ** Math.min(failures++, 6));
+        reconnect = setTimeout(() => track(connect(attempt)), delay * (0.75 + Math.random() * 0.5));
+    };
+    const connect = async (attempt) => {
         if (!running || generation !== attempt || config.localHost.signal.aborted)
             return;
         state("connecting");
         if (!running || generation !== attempt || config.localHost.signal.aborted)
             return;
+        const acquisition = new AbortController();
+        credentialAttempt?.abort();
+        credentialAttempt = acquisition;
+        let credential;
+        try {
+            credential = config.getCredential
+                ? await new Promise((resolve, reject) => {
+                    const abort = () => reject(new Error("Relay credential acquisition cancelled"));
+                    acquisition.signal.addEventListener("abort", abort, { once: true });
+                    Promise.resolve()
+                        .then(() => config.getCredential(acquisition.signal))
+                        .then(resolve, reject)
+                        .finally(() => acquisition.signal.removeEventListener("abort", abort))
+                        .catch(() => { });
+                })
+                : config.credential;
+            if (!isRelayToken(credential))
+                throw new Error("Invalid relay credential");
+        }
+        catch (error) {
+            if (!running || generation !== attempt || acquisition.signal.aborted)
+                return;
+            if (error?.status === 401 ||
+                error?.status === 403) {
+                running = false;
+                state("unauthorized");
+            }
+            else {
+                state("disconnected");
+                retry(attempt);
+            }
+            return;
+        }
+        if (!running ||
+            generation !== attempt ||
+            acquisition.signal.aborted ||
+            config.localHost.signal.aborted)
+            return;
         const url = new URL(RELAY_CONNECT_PATH, config.relayOrigin);
         url.protocol = "wss:";
         const ws = new WebSocket(url, {
-            headers: { Authorization: `Bearer ${config.credential}` },
+            headers: { Authorization: `Bearer ${credential}` },
             ca: config.ca,
             followRedirects: false,
             perMessageDeflate: false,
@@ -79,8 +125,7 @@ export function createDeviceRelayConnector(options) {
                 state("disconnected");
                 if (!running || generation !== attempt || control || config.localHost.signal.aborted)
                     return resolve();
-                const delay = Math.min(30_000, 500 * 2 ** Math.min(failures++, 6));
-                reconnect = setTimeout(() => connect(attempt), delay * (0.75 + Math.random() * 0.5));
+                retry(attempt);
             }
             resolve();
         })));
@@ -146,7 +191,7 @@ export function createDeviceRelayConnector(options) {
             };
             if (streams.size >= RELAY_MAX_STREAMS)
                 return failed();
-            const stream = openRelayStream(config, message, failed);
+            const stream = openRelayStream({ ...config, credential }, message, failed);
             owned.set(message.streamId, stream);
             streams.add(stream);
             const done = stream.done.then(() => {
@@ -166,7 +211,8 @@ export function createDeviceRelayConnector(options) {
             config.localHost.signal.addEventListener("abort", revoke, { once: true });
             running = true;
             failures = 0;
-            connect(++generation);
+            const acquisition = connect(++generation);
+            track(acquisition);
         },
         close() {
             if (closing)
@@ -174,6 +220,8 @@ export function createDeviceRelayConnector(options) {
             running = false;
             config.localHost.signal.removeEventListener("abort", revoke);
             generation++;
+            credentialAttempt?.abort();
+            credentialAttempt = undefined;
             clearTimeout(reconnect);
             reconnect = undefined;
             control?.terminate();

package/dist/remote-relay/local-stream.d.ts

@@ -5,6 +5,8 @@ export interface RelayLocalStream {
     done: Promise<void>;
 }
 /** One fixed loopback connection. Never accept a target, URL, or port from control messages. */
-export declare function openRelayStream(config: DeviceRelayConnectorOptions, message: Extract<RelayControlMessage, {
+export declare function openRelayStream(config: DeviceRelayConnectorOptions & {
+    credential: string;
+}, message: Extract<RelayControlMessage, {
     type: "open";
 }>, failed: () => void): RelayLocalStream;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.29",
+  "version": "0.9.31",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,13 +60,13 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.29",
-    "@cjhyy/code-shell-core": "0.9.29",
-    "@cjhyy/code-shell-web": "0.9.29",
+    "@cjhyy/code-shell-capability-coding": "0.9.31",
+    "@cjhyy/code-shell-core": "0.9.31",
+    "@cjhyy/code-shell-web": "0.9.31",
     "@modelcontextprotocol/sdk": "^1.31.0",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0",
-    "@cjhyy/code-shell-link": "0.9.29"
+    "@cjhyy/code-shell-link": "0.9.31"
   },
   "engines": {
     "node": ">=20.10"