@cjhyy/code-shell-server 0.9.47 → 0.9.48

package/README.md

@@ -83,6 +83,10 @@ Desktop Web 和 Hub 在注销或显式撤销会话时，会关闭该会话尚未
 响应，包括正在下载的文件，并停止源文件读取、释放句柄。其他会话的下载不受影响；
 已经返回接受结果的后台任务仍由原来的任务生命周期管理。注销请求本身仍返回成功。
 
+Hub 认证每次读取磁盘上的当前会话；只有需要更新活动时间时才获取写锁，并在锁内
+重新验证撤销与过期状态。Hub 与 Mobile 静态文件按打开时的大小流式发送，`HEAD`
+只返回元数据；客户端断开会停止读取。首页和 SPA 回退也遵守静态目录边界。
+
 ## code-shell-serve — 个人 Hub Web host
 
 在任意机器上把一个 workspace 变成浏览器可访问的 CodeShell：

package/dist/hub/auth-store.d.ts

@@ -40,6 +40,7 @@ export declare class HubAuthStore {
     }): Promise<HubSessionGrant>;
     login(input: HubLoginInput, replaceToken?: string): Promise<HubSessionGrant>;
     authenticate(token: string | undefined): HubSession | null;
+    private findSession;
     listSessions(): HubSession[];
     /** Offline restore must not resurrect sessions revoked after the snapshot. */
     revokeAllSessions(): void;
@@ -49,6 +50,7 @@ export declare class HubAuthStore {
     private toPublic;
     private mutate;
     private ensureDirectory;
+    private assertDirectory;
     private read;
     private write;
 }

package/dist/hub/auth-store.js

@@ -93,20 +93,36 @@ export class HubAuthStore {
     authenticate(token) {
         if (!token || !TOKEN_PATTERN.test(token))
             return null;
+        // Writers publish by atomic rename. Read the committed record on every
+        // request, but only contend for the writer lock when activity needs saving.
+        this.assertDirectory();
+        const tokenHash = hashToken(token);
+        const record = this.read();
+        const now = this.now();
+        const session = this.findSession(record, tokenHash, now);
+        if (!session)
+            return null;
+        if (now - session.lastSeenAt < 60_000)
+            return this.toPublic(record, session);
         return this.mutate((record) => {
             const now = this.now();
-            const tokenHash = hashToken(token);
-            const session = record.sessions.find((row) => safeHashEqual(row.tokenHash, tokenHash));
-            if (!record.account || !session || session.expiresAt <= now || session.createdAt > now) {
+            // Recheck after taking the lock: a peer may have revoked, replaced or
+            // refreshed the session since the unlocked read. Never write that snapshot.
+            const session = this.findSession(record, tokenHash, now);
+            if (!session)
                 return { result: null, changed: false };
-            }
-            // Persist activity at most once per minute; validation always reads disk.
             const changed = now - session.lastSeenAt >= 60_000;
             if (changed)
                 session.lastSeenAt = now;
             return { result: this.toPublic(record, session), changed };
         });
     }
+    findSession(record, tokenHash, now) {
+        if (!record.account)
+            return null;
+        const session = record.sessions.find((row) => safeHashEqual(row.tokenHash, tokenHash));
+        return session && session.expiresAt > now && session.createdAt <= now ? session : null;
+    }
     listSessions() {
         const record = this.read();
         const now = this.now();
@@ -194,10 +210,13 @@ export class HubAuthStore {
     ensureDirectory() {
         const parent = dirname(this.filePath);
         mkdirSync(parent, { recursive: true, mode: 0o700 });
-        const metadata = lstatSync(parent);
+        this.assertDirectory();
+        chmodSync(parent, 0o700);
+    }
+    assertDirectory() {
+        const metadata = lstatSync(dirname(this.filePath));
         if (!metadata.isDirectory() || metadata.isSymbolicLink())
             throw new Error("Invalid Hub auth directory");
-        chmodSync(parent, 0o700);
     }
     read(allowMissing = false) {
         let descriptor;

package/dist/mobile-remote/codex-room-agent.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { stopRoomProcess } from "./room-process-stop.js";
+import { releaseStdioAfterExit, stopRoomProcess } from "./room-process-stop.js";
 import { createInterface } from "node:readline";
 import { pathWithCommonBins } from "./path-bins.js";
 import { parseCodexJsonLine, extractThreadId } from "./codex-parse.js";
@@ -109,6 +109,8 @@ export class CodexRoomAgent {
             stdio: ["pipe", "pipe", "pipe"],
         });
         this.child = child;
+        // Settle on `close` so trailing output is read, without waiting on grandchildren.
+        releaseStdioAfterExit(child);
         if (child.stdout) {
             const rl = createInterface({ input: child.stdout });
             rl.on("line", (line) => {

package/dist/mobile-remote/mobile-chat-turn.d.ts

@@ -33,6 +33,12 @@ export type DispatchMobileChatTurnResult = {
 } | {
     ok: false;
     message: string;
+    uncertain?: false;
+} | {
+    ok: false;
+    message: string;
+    uncertain: true;
+    clientMessageId: string;
 };
 /** Transaction boundary for mobile chat: workspace → canonical stage → worker ack → finalize. */
 export declare function dispatchMobileChatTurn(input: DispatchMobileChatTurnInput): Promise<DispatchMobileChatTurnResult>;

package/dist/mobile-remote/mobile-chat-turn.js

@@ -63,11 +63,24 @@ export async function dispatchMobileChatTurn(input) {
             : await injectMobileRunAndAwaitAcceptance(input.bridge, request, input.meta);
     }
     catch {
-        acceptance = { ok: false, message: "The selected runtime rejected the submission" };
+        acceptance = {
+            ok: false,
+            uncertain: true,
+            message: "The selected runtime did not confirm the submission",
+        };
     }
     if (!acceptance.ok) {
+        // Worker input refers to the canonical staged files, not these temporary
+        // upload spools. Keep the staged files for a possibly accepted run and
+        // release only the claims so the same intent can retry its attachments.
+        // A late acceptance may never be observed, so uncertain files also need
+        // sent retention rather than expiring as abandoned drafts after one day.
+        if (acceptance.uncertain)
+            await (input.markSent ?? markAttachmentsSent)(cwd, input.sessionId, materialized.metas).catch(() => undefined);
         await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
-        return { ok: false, message: acceptance.message };
+        return acceptance.uncertain
+            ? { ok: false, message: acceptance.message, uncertain: true, clientMessageId }
+            : { ok: false, message: acceptance.message };
     }
     await (input.markSent ?? markAttachmentsSent)(cwd, input.sessionId, materialized.metas).catch(() => undefined);
     await settleClaims(input.uploads, input.deviceId, materialized.claims, "finalize");

package/dist/mobile-remote/mobile-run-dispatch.d.ts

@@ -13,6 +13,7 @@ export type MobileRunAcceptance = {
     ok: false;
     message: string;
     code?: number;
+    uncertain?: true;
 };
 /** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
 export declare function injectMobileRunAndAwaitAcceptance(bridge: MobileRunBridge, request: MobileRunRequest, meta: WorkerFrameMeta, timeoutMs?: number): Promise<MobileRunAcceptance>;

package/dist/mobile-remote/mobile-run-dispatch.js

@@ -2,7 +2,6 @@
 export function injectMobileRunAndAwaitAcceptance(bridge, request, meta, timeoutMs = 5_000) {
     return new Promise((resolve) => {
         let settled = false;
-        let timer;
         const finish = (result) => {
             if (settled)
                 return;
@@ -40,17 +39,26 @@ export function injectMobileRunAndAwaitAcceptance(bridge, request, meta, timeout
                 // Not JSON or not part of this request.
             }
         });
-        timer = setTimeout(() => finish({ ok: false, message: "worker did not acknowledge the run" }), timeoutMs);
+        const timer = setTimeout(() => finish({ ok: false, uncertain: true, message: "worker did not acknowledge the run" }), timeoutMs);
+        let injecting = false;
         try {
-            bridge.injectWorkerMessage(JSON.stringify({
+            const line = JSON.stringify({
                 jsonrpc: "2.0",
                 id: request.id,
                 method: "agent/run",
                 params: request.params,
-            }), meta);
+            });
+            injecting = true;
+            bridge.injectWorkerMessage(line, meta);
         }
         catch (error) {
-            finish({ ok: false, message: error instanceof Error ? error.message : String(error) });
+            // An injection can fail after queuing bytes. Only serialization failure
+            // proves that this request never reached the transport.
+            finish({
+                ok: false,
+                message: error instanceof Error ? error.message : String(error),
+                ...(injecting ? { uncertain: true } : {}),
+            });
         }
     });
 }

package/dist/mobile-remote/mobile-static.d.ts

@@ -38,12 +38,11 @@ export declare function mobileEntryRedirect(reqUrl: string): string | null;
  *  can see through it. Guarding that would need inode/device policy, and anyone
  *  able to hardlink into the served root can already write files there.
  *
- *  The returned path is the REQUESTED one, not the realpath: callers stream it
- *  directly and the resolved-name contract is relied on elsewhere (on macOS the
- *  realpath of a /var root is /private/var, which would change every result).
- *  That leaves the same synchronous stat-then-read window this module always
- *  had; closing it properly needs an open-then-fstat rework of both callers,
- *  which is out of scope for this fix. */
+ *  The returned path is the REQUESTED one, not the realpath: the resolved-name
+ *  contract is relied on elsewhere (on macOS the realpath of a /var root is
+ *  /private/var, which would change every result). This is only a routing check;
+ *  both HTTP callers open and revalidate the selected file through
+ *  streamStaticFile before returning bytes. */
 export declare function resolveSafe(root: string, subPath: string): string | null;
 export interface MobileStaticOptions {
     /** Absolute path to the built mobile app (out/mobile). */

package/dist/mobile-remote/mobile-static.js

@@ -1,7 +1,7 @@
-import { createReadStream, existsSync, realpathSync, statSync } from "node:fs";
+import { existsSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, normalize, relative, resolve, sep, extname } from "node:path";
 import { request as httpRequest } from "node:http";
-import { contentTypeFor } from "../static-files.js";
+import { contentTypeFor, streamStaticFile } from "../static-files.js";
 /**
  * Serves the built mobile web app (out/mobile) as static assets for the
  * `/mobile` route family, replacing the old inline `mobileRemoteHtml()` string.
@@ -61,12 +61,11 @@ function isContained(root, target) {
  *  can see through it. Guarding that would need inode/device policy, and anyone
  *  able to hardlink into the served root can already write files there.
  *
- *  The returned path is the REQUESTED one, not the realpath: callers stream it
- *  directly and the resolved-name contract is relied on elsewhere (on macOS the
- *  realpath of a /var root is /private/var, which would change every result).
- *  That leaves the same synchronous stat-then-read window this module always
- *  had; closing it properly needs an open-then-fstat rework of both callers,
- *  which is out of scope for this fix. */
+ *  The returned path is the REQUESTED one, not the realpath: the resolved-name
+ *  contract is relied on elsewhere (on macOS the realpath of a /var root is
+ *  /private/var, which would change every result). This is only a routing check;
+ *  both HTTP callers open and revalidate the selected file through
+ *  streamStaticFile before returning bytes. */
 export function resolveSafe(root, subPath) {
     const rootResolved = resolve(root);
     const rel = normalize(subPath || "index.html");
@@ -77,11 +76,11 @@ export function resolveSafe(root, subPath) {
     const full = resolve(join(rootResolved, rel));
     if (!isContained(rootResolved, full))
         return null;
-    if (!existsSync(full) || !statSync(full).isFile())
-        return null;
     // realpathSync throws on a dangling link or a race-deleted file; a missing
     // target is a 404 through the normal contract, never a 500.
     try {
+        if (!existsSync(full) || !statSync(full).isFile())
+            return null;
         if (!isContained(realpathSync(rootResolved), realpathSync(full)))
             return null;
     }
@@ -143,15 +142,15 @@ export function serveMobile(req, res, opts) {
     // stale index.html would reference deleted assets → 404 → blank page until a
     // hard refresh.
     const isHtml = type.startsWith("text/html");
-    res.writeHead(200, {
-        "content-type": type,
-        "cache-control": isHtml
+    void streamStaticFile(req, res, {
+        rootDir: opts.rootDir,
+        filePath: file,
+        cacheControl: isHtml
             ? "no-store"
             : sub.startsWith("assets/")
                 ? "public, max-age=31536000, immutable"
                 : "no-cache",
     });
-    createReadStream(file).pipe(res);
 }
 /** Dev-only: forward the request to the mobile vite dev server. The mobile vite
  *  config sets base "/mobile/", so vite serves its HMR client, module graph, and

package/dist/mobile-remote/resident-agent.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { stopRoomProcess } from "./room-process-stop.js";
+import { releaseStdioAfterExit, stopRoomProcess } from "./room-process-stop.js";
 import { createInterface } from "node:readline";
 import { pathWithCommonBins } from "./path-bins.js";
 /**
@@ -149,6 +149,8 @@ export class ResidentAgentProcess {
             stdio: ["pipe", "pipe", "pipe"],
         });
         this.child = child;
+        // Settle on `close` so trailing output is read, without waiting on grandchildren.
+        releaseStdioAfterExit(child);
         if (child.stdout) {
             const rl = createInterface({ input: child.stdout });
             rl.on("line", (line) => {

package/dist/mobile-remote/room-manager.d.ts

@@ -119,6 +119,10 @@ export interface RoomManagerOptions {
      * Returning null means the transcript is absent. The returned identity is
      * checked again here so a stale or mismatched locator fails closed. */
     resolveLinkedSession?: (target: Readonly<LinkedSessionTarget>) => LinkedSessionTarget | null | undefined;
+    /** Throws while a background task (DriveAgent) may still be writing this
+     * external session. Checked before any resident agent can start on it, so
+     * desktop and phone entry points share one ownership gate. */
+    assertExternalSessionAvailable?: (externalSessionId: string, kind: RoomKind) => void;
     /** Called whenever a room gains a new persisted message (push to phone). */
     onMessage: (roomId: string, msg: RoomMessage) => void;
     /** Called when a room's resident agent requests tool-use approval. For

package/dist/mobile-remote/room-manager.js

@@ -777,6 +777,8 @@ export class RoomManager {
      * so a given claude session maps to exactly one room. Returns the room id.
      */
     openForSession(claudeSessionId, cwd, mode, kind = "claude-code") {
+        if (claudeSessionId)
+            this.opts.assertExternalSessionAvailable?.(claudeSessionId, kind);
         // Reuse must match BOTH id and kind: a codex thread id and a claude session
         // id live in the same `claudeSessionId` field, so a bare id match could
         // otherwise hand back a claude room when a codex room was asked for.
@@ -851,6 +853,7 @@ export class RoomManager {
      * silently start a different session. */
     takeOverLinkedSession(roomId, externalSessionId, cwd, kind) {
         const target = this.requireLinkedSessionTarget({ externalSessionId, cwd, kind });
+        this.opts.assertExternalSessionAvailable?.(target.externalSessionId, target.kind);
         const meta = this.getRoom(roomId);
         if (!meta ||
             meta.claudeSessionId !== target.externalSessionId ||
@@ -969,6 +972,8 @@ export class RoomManager {
         if (meta.linkedSessionMode === "observe-only")
             return { status: "observing" };
         if (!this.agents.has(id)) {
+            if (meta.claudeSessionId)
+                this.opts.assertExternalSessionAvailable?.(meta.claudeSessionId, meta.kind);
             let agent = undefined;
             agent = this.opts.createAgent(meta, (event) => {
                 // stop() sends a signal; an old process can still drain output or emit

package/dist/mobile-remote/room-process-stop.d.ts

@@ -1,3 +1,11 @@
 import type { ChildProcess } from "node:child_process";
 /** Retire an unusable room transport without leaving an unresponsive CLI alive. */
 export declare function stopRoomProcess(child: ChildProcess): void;
+/**
+ * `close` waits for every holder of the child's stdout/stderr. A grandchild the
+ * CLI backgrounded with inherited stdio (a dev server, say) keeps them open
+ * after the CLI exits, so the room would never settle. Once the CLI has exited
+ * and its buffered output had a grace period to drain, release the pipes;
+ * the grandchild itself is left running.
+ */
+export declare function releaseStdioAfterExit(child: ChildProcess, graceMs?: number): void;

package/dist/mobile-remote/room-process-stop.js

@@ -26,3 +26,21 @@ export function stopRoomProcess(child) {
     timer.unref();
     child.once("exit", () => clearTimeout(timer));
 }
+/**
+ * `close` waits for every holder of the child's stdout/stderr. A grandchild the
+ * CLI backgrounded with inherited stdio (a dev server, say) keeps them open
+ * after the CLI exits, so the room would never settle. Once the CLI has exited
+ * and its buffered output had a grace period to drain, release the pipes;
+ * the grandchild itself is left running.
+ */
+export function releaseStdioAfterExit(child, graceMs = 1_000) {
+    child.once("exit", () => {
+        const timer = setTimeout(() => {
+            child.stdout?.destroy();
+            child.stderr?.destroy();
+            child.stdin?.destroy();
+        }, graceMs);
+        timer.unref();
+        child.once("close", () => clearTimeout(timer));
+    });
+}

package/dist/panels/execution-gate.d.ts

@@ -39,6 +39,8 @@ export declare class PanelExecutionGate {
     register(source: () => Iterable<PanelExecutionScope>): () => void;
     /** Executions that a change matching `matches` would wait for, grouped by holder. */
     blockers(matches: (scope: PanelExecutionScope) => boolean): PanelExecutionBlocker[];
-    mutate<T>(matches: (scope: PanelExecutionScope) => boolean, work: () => Promise<T>): Promise<T>;
+    mutate<T>(matches: (scope: PanelExecutionScope) => boolean, work: () => Promise<T>, 
+    /** Trusted Host preparation that validates a review before draining existing work. */
+    drain?: () => Promise<void>): Promise<T>;
 }
 export declare const panelExecutionGate: PanelExecutionGate;

package/dist/panels/execution-gate.js

@@ -77,15 +77,23 @@ export class PanelExecutionGate {
         }
         return [...grouped.values()];
     }
-    async mutate(matches, work) {
+    async mutate(matches, work, 
+    /** Trusted Host preparation that validates a review before draining existing work. */
+    drain) {
         if (this.mutations.size)
             throw new PanelExecutionBusyError("另一个面板修改正在进行，请稍后重试。");
         // No await between the snapshot and installing the admission barrier.
         const blockers = this.blockers(matches);
-        if (blockers.length)
+        if (blockers.length && !drain)
             throw new PanelExecutionBusyError("面板还有正在提交、排队或运行的任务，请结束后再修改。", blockers);
         this.mutations.add(matches);
         try {
+            if (drain) {
+                await drain();
+                const remaining = this.blockers(matches);
+                if (remaining.length)
+                    throw new PanelExecutionBusyError("面板还有正在提交、排队或运行的任务，请结束后再修改。", remaining);
+            }
             return await work();
         }
         finally {

package/dist/panels/http.d.ts

@@ -39,6 +39,7 @@ export declare function createPanelHttp(options: PanelManagementHttpOptions & {
         install(context: import("./types.js").PanelOperationContext, token: unknown, bind?: boolean, approval?: {
             overwrite?: boolean;
             expectedId?: string;
+            releaseExecutions?: (appId: string, matches: (scope: import("./execution-gate.js").PanelExecutionScope) => boolean) => Promise<void>;
         }): Promise<{
             id: string;
             packageDigest: string | undefined;

package/dist/panels/management-http.d.ts

@@ -30,6 +30,7 @@ export declare function createPanelManagementHttp(options: PanelManagementHttpOp
         install(context: PanelOperationContext, token: unknown, bind?: boolean, approval?: {
             overwrite?: boolean;
             expectedId?: string;
+            releaseExecutions?: (appId: string, matches: (scope: import("./execution-gate.js").PanelExecutionScope) => boolean) => Promise<void>;
         }): Promise<{
             id: string;
             packageDigest: string | undefined;

package/dist/panels/management.d.ts

@@ -1,3 +1,4 @@
+import { type PanelExecutionScope } from "./execution-gate.js";
 import { type PanelAppPreview, type PanelAppSourceInput } from "@cjhyy/code-shell-core";
 import type { PanelCompatibility, PanelDiscovery, PanelOperationContext, PanelReview, PanelProjectReview, PanelSnapshot, PanelPackageHistory, PanelPackageRestoreReview } from "./types.js";
 export declare class PanelManagementError extends Error {
@@ -50,6 +51,8 @@ export declare function createPanelManagement(options: PanelManagementOptions):
     install(context: PanelOperationContext, token: unknown, bind?: boolean, approval?: {
         overwrite?: boolean;
         expectedId?: string;
+        /** Trusted Host callback, never supplied by an HTTP request body. */
+        releaseExecutions?: (appId: string, matches: (scope: PanelExecutionScope) => boolean) => Promise<void>;
     }): Promise<{
         id: string;
         packageDigest: string | undefined;

package/dist/panels/management.js

@@ -3,7 +3,7 @@ import { panelPackageMutationMatches } from "./package-mutation.js";
 import { createHash, randomBytes } from "node:crypto";
 import { lstatSync, mkdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, join, resolve } from "node:path";
-import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
+import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, currentPanelAppPackagePins, installedPanelAppUpdatedAt, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
 import { mutateJsonFile } from "@cjhyy/code-shell-core/internal";
 import { parseGithubUrl } from "@cjhyy/code-shell-core/internal/skills";
 const REVIEW_TTL = 8 * 60_000;
@@ -177,14 +177,17 @@ export function createPanelManagement(options) {
             .update(JSON.stringify({
             app,
             digest,
-            ...(options.projectPackages
-                ? { pin: parsePanelAppPackagePins(project ?? projectSettings())[app.id] ?? null }
-                : {}),
+            ...(options.projectPackages ? { pin: selectedPin(app.id, project) } : {}),
             bound: current.boundApps.has(app.id),
             disabled: current.globalDisabledApps.has(app.id),
         }))
             .digest("hex");
     }
+    /** The pinned package identity; when it was pinned does not change the selection. */
+    function selectedPin(id, project) {
+        const pin = parsePanelAppPackagePins(project ?? projectSettings())[id];
+        return pin ? { version: pin.version, packageDigest: pin.packageDigest } : null;
+    }
     function projectSettings() {
         return new SettingsManager(workspace, "full").getRawForScope("project", workspace, {
             strict: true,
@@ -291,7 +294,7 @@ export function createPanelManagement(options) {
         // Never attach a new revision to stale displayed binding state. File and
         // package inspection above can yield to another device's mutation.
         for (const app of [...panels, ...issues]) {
-            const pin = options.projectPackages ? parsePanelAppPackagePins(project)[app.id] : undefined;
+            const pin = options.projectPackages ? currentPanelAppPackagePins(project)[app.id] : undefined;
             if (projectState(app.id, project) !== projectState(app.id) ||
                 current.globalDisabledApps.has(app.id) !== policy().globalDisabledApps.has(app.id) ||
                 (pin && (pin.packageDigest !== app.packageDigest || pin.version !== app.version)))
@@ -484,7 +487,7 @@ export function createPanelManagement(options) {
             return value;
         });
     }
-    async function mutate(context, change, work) {
+    async function mutate(context, change, work, prepare) {
         const expected = generation(context.ownerId);
         const guard = () => assertAuthorized(context, expected);
         const run = async () => {
@@ -493,7 +496,11 @@ export function createPanelManagement(options) {
                 await guard();
                 return work(guard);
             };
-            return panelExecutionGate.mutate(panelPackageMutationMatches({ ...change, projectPath: options.bindingCwd ?? options.cwd }), () => (options.withMutation ? options.withMutation(write) : write()));
+            const matches = panelPackageMutationMatches({
+                ...change,
+                projectPath: options.bindingCwd ?? options.cwd,
+            });
+            return panelExecutionGate.mutate(matches, () => (options.withMutation ? options.withMutation(write) : write()), prepare ? () => prepare(guard, matches) : undefined);
         };
         const next = catalogMutation.then(run, run);
         catalogMutation = next.catch(() => undefined);
@@ -524,7 +531,20 @@ export function createPanelManagement(options) {
                 if (bound) {
                     if (!app.packageDigest)
                         throw new Error("Cannot bind an unverified Panel package");
-                    pins[app.id] = { version: app.version, packageDigest: app.packageDigest };
+                    const existing = pins[app.id];
+                    // Rebinding the package a current pin already selects changes nothing, so
+                    // it must not invalidate other devices' revisions or pending reviews.
+                    const unchanged = existing?.version === app.version &&
+                        existing.packageDigest === app.packageDigest &&
+                        !!currentPanelAppPackagePins({ panelAppPins: { [app.id]: existing } })[app.id];
+                    if (!unchanged)
+                        pins[app.id] = {
+                            version: app.version,
+                            packageDigest: app.packageDigest,
+                            // Holds this project only until the next global install or update, so it
+                            // must be strictly later than the install it was chosen after.
+                            pinnedAt: new Date(Math.max(now(), (installedPanelAppUpdatedAt(app.id) ?? 0) + 1)).toISOString(),
+                        };
                 }
                 else
                     delete pins[app.id];
@@ -735,12 +755,18 @@ export function createPanelManagement(options) {
             await assertAuthorized(context, held.generation);
             if (approval?.expectedId && approval.expectedId !== held.public.preview.id)
                 invalid();
+            if (approval?.releaseExecutions && held.public.kind !== "update")
+                invalid();
             if (approval && held.public.kind === "update" && !approval.overwrite)
                 throw new PanelManagementError(409, "already_installed", "这个面板已经安装，请确认项目更新。");
-            return mutate(context, { appId: held.public.preview.id, kind: held.public.kind }, async (guard) => {
-                await assertAuthorized(context, held.generation);
-                if (reviews.get(token) !== held || held.public.expiresAt <= now())
+            let admitted = false;
+            const assertReviewLease = () => {
+                if (!admitted && (reviews.get(token) !== held || held.public.expiresAt <= now()))
                     throw new PanelManagementError(409, "review_expired", "预览已失效，请重新检查来源。");
+            };
+            const validateReview = async (guard) => {
+                await assertAuthorized(context, held.generation);
+                assertReviewLease();
                 const id = held.public.preview.id;
                 if (held.public.kind === "update") {
                     const current = await selectedApp(id);
@@ -753,6 +779,11 @@ export function createPanelManagement(options) {
                 if (projectState(id) !== held.projectState)
                     throw new PanelManagementError(409, "conflict", "项目面板配置已改变，请重新预览。");
                 await guard();
+                assertReviewLease();
+            };
+            return mutate(context, { appId: held.public.preview.id, kind: held.public.kind }, async (guard) => {
+                await validateReview(guard);
+                const id = held.public.preview.id;
                 const installed = await installReviewedLocalPanelApp(held.source, held.digest, new Date(now()).toISOString(), {
                     overwrite: held.public.kind === "update",
                     expectedId: id,
@@ -782,7 +813,24 @@ export function createPanelManagement(options) {
                 invalidateSkillCache();
                 await options.onChanged?.(id, held.public.kind);
                 return { id, packageDigest: installed.packageDigest };
-            });
+            }, approval?.releaseExecutions
+                ? async (guard, matches) => {
+                    await validateReview(guard);
+                    // A local directory/ZIP may have changed since preview. Check its
+                    // reviewed bytes before cancelling work, then recheck mutable
+                    // project/catalog authority after the source read.
+                    const preview = await previewLocalPanelApp(held.source);
+                    if (preview.id !== held.public.preview.id || preview.reviewToken !== held.digest)
+                        throw new PanelManagementError(409, "conflict", "来源已改变，请重新检查更新。");
+                    await validateReview(guard);
+                    // This admitted operation owns the review while its holders exit.
+                    // TTL expiry during cancellation must not invalidate that consent;
+                    // owner revocation and package/project changes are still checked.
+                    admitted = true;
+                    reviews.delete(token);
+                    await approval.releaseExecutions(held.public.preview.id, matches);
+                }
+                : undefined);
         },
         async binding(context, id, bound, expected) {
             assertId(id);
@@ -793,11 +841,11 @@ export function createPanelManagement(options) {
                 const current = await selectedApp(id);
                 if (bound && !compatibility(current.app).supported)
                     throw new PanelManagementError(400, "unsupported", "这个面板需要当前 Web 环境未提供的能力。");
-                // Legacy installs need a retained copy before the project can pin them.
-                // An already pinned project must keep its selected version, not the catalog's.
+                // An unpinned (or superseded) selection needs a retained copy before the
+                // project can pin it. A current pin must keep its selected version.
                 const app = bound &&
                     options.projectPackages &&
-                    !parsePanelAppPackagePins(projectSettings())[current.app.id]
+                    !currentPanelAppPackagePins(projectSettings())[current.app.id]
                     ? await retainInstalledPanelApp(current.app.id, current.app.packageDigest)
                     : current.app;
                 await guard();

package/dist/panels/package-mutation.d.ts

@@ -4,5 +4,5 @@ export interface PanelPackageMutation {
     projectPath: string;
     kind: "install" | "update" | "binding" | "remove";
 }
-/** Pinned projects retain their bytes when a different project updates the catalog. */
+/** A catalog install or update supersedes every project's pin, so it reaches every project. */
 export declare function panelPackageMutationMatches(change: PanelPackageMutation): (scope: PanelExecutionScope) => boolean;

package/dist/panels/package-mutation.js

@@ -1,6 +1,6 @@
-import { projectPanelAppPackagePins, resolvePanelAppBindingProjectPath, } from "@cjhyy/code-shell-core";
+import { resolvePanelAppBindingProjectPath } from "@cjhyy/code-shell-core";
 import { panelExecutionProject } from "./execution-gate.js";
-/** Pinned projects retain their bytes when a different project updates the catalog. */
+/** A catalog install or update supersedes every project's pin, so it reaches every project. */
 export function panelPackageMutationMatches(change) {
     const project = panelExecutionProject(resolvePanelAppBindingProjectPath(change.projectPath));
     return (scope) => {
@@ -11,13 +11,6 @@ export function panelPackageMutationMatches(change) {
         const bindingProject = resolvePanelAppBindingProjectPath(scope.projectPath);
         if (panelExecutionProject(bindingProject) === project)
             return true;
-        if (change.kind === "binding")
-            return false;
-        try {
-            return !projectPanelAppPackagePins(bindingProject, change.appId)[change.appId];
-        }
-        catch {
-            return true;
-        } // An unreadable project cannot prove that it is insulated.
+        return change.kind !== "binding";
     };
 }

package/dist/serve/headless-server.js

@@ -17,15 +17,15 @@ import { describeEnvironment, environmentIdentity } from "../environment-identit
 // server restart spawns a fresh worker on the first inbound frame and the
 // browser re-lists sessions over the same protocol.
 import { createServer } from "node:http";
-import { readFileSync, existsSync } from "node:fs";
-import { basename, dirname, extname, join, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { WebSocketServer } from "ws";
 import { CONTRACTS, SessionManager, SettingsManager } from "@cjhyy/code-shell-core";
 import { SessionOutputCoverageStore, readOutputJournal, readOutputJournalLegacyBase, } from "@cjhyy/code-shell-core/internal";
 import { AccessPasscode } from "../mobile-remote/access-passcode.js";
 import { resolveSafe } from "../mobile-remote/mobile-static.js";
-import { contentTypeFor } from "../static-files.js";
+import { streamStaticFile } from "../static-files.js";
 import { createHubAuth } from "../hub/auth-http.js";
 import { ApprovalLeases } from "../hub/approval-lease.js";
 import { HubUploads, hubJson } from "../hub/uploads.js";
@@ -611,7 +611,7 @@ export async function startHeadlessServer(opts) {
             isAuthorized: configurationOptions.isAuthorized,
         })
         : undefined;
-    const serveStatic = (req, res) => {
+    const serveStatic = async (req, res) => {
         const root = opts.staticRootDir;
         if (!root) {
             res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
@@ -635,27 +635,24 @@ export async function startHeadlessServer(opts) {
                 res.end("not found");
                 return;
             }
-            filePath = join(root, "index.html");
-            if (!existsSync(filePath)) {
+            filePath = resolveSafe(root, "index.html");
+            if (!filePath) {
                 res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
                 res.end("web app not built");
                 return;
             }
         }
-        try {
-            const body = readFileSync(filePath);
-            res.writeHead(200, {
-                "content-type": contentTypeFor(extname(filePath)),
-                "cache-control": "no-cache",
-            });
-            res.end(body);
-        }
-        catch {
-            res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-            res.end("not found");
-        }
+        await streamStaticFile(req, res, {
+            rootDir: root,
+            filePath,
+            cacheControl: "no-cache",
+        });
     };
     const handleHttp = async (req, res) => {
+        if (closing) {
+            hubJson(res, 503, { error: "server is closing" });
+            return;
+        }
         const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
         res.setHeader("x-content-type-options", "nosniff");
         res.setHeader("referrer-policy", "no-referrer");
@@ -678,14 +675,16 @@ export async function startHeadlessServer(opts) {
             return;
         }
         if (hubAuth) {
-            if (await links?.handlePublic(req, res))
+            if ((await links?.handlePublic(req, res)) || closing || res.destroyed)
                 return;
-            if (await panels?.handleAssets(req, res))
+            if ((await panels?.handleAssets(req, res)) || closing || res.destroyed)
                 return;
-            if (await hubAuth.handle(req, res))
+            if ((await hubAuth.handle(req, res)) || closing || res.destroyed)
                 return;
             if (pathname.startsWith("/api/")) {
                 const session = await hubAuth.authenticate(req);
+                if (closing || res.destroyed)
+                    return;
                 if (!session) {
                     hubJson(res, 401, { error: "login required" });
                     return;
@@ -694,10 +693,6 @@ export async function startHeadlessServer(opts) {
                     hubJson(res, 403, { error: "origin rejected" });
                     return;
                 }
-                if (closing) {
-                    hubJson(res, 503, { error: "server is closing" });
-                    return;
-                }
                 responses.track(session.id, res);
                 if (pathname === "/api/v1/environment" && req.method === "GET") {
                     hubJson(res, 200, environment);
@@ -738,20 +733,37 @@ export async function startHeadlessServer(opts) {
                 return;
             }
             // Public static shell contains no user data and supplies the setup/login page.
-            serveStatic(req, res);
+            await serveStatic(req, res);
             return;
         }
         if (!passcode.gate(req, res))
             return;
-        serveStatic(req, res);
+        await serveStatic(req, res);
     };
     const server = createServer((req, res) => {
         void handleHttp(req, res).catch(() => hubJson(res, 500, { error: "server request failed" }));
     });
+    // HTTP closeAllConnections excludes an upgrade awaiting authentication.
+    // Own accepted sockets until close or a completed transfer to WebSocket.
+    const connections = new Set();
+    server.on("connection", (socket) => {
+        connections.add(socket);
+        socket.once("close", () => connections.delete(socket));
+        if (closing)
+            socket.destroy();
+    });
     const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 });
     const upgrade = async (req, socket, head) => {
+        if (closing || socket.destroyed) {
+            socket.destroy();
+            return;
+        }
         const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
         const session = hubAuth ? await hubAuth.authenticate(req) : undefined;
+        if (closing || socket.destroyed) {
+            socket.destroy();
+            return;
+        }
         const allowed = hubAuth
             ? !!session && hubAuth.isOriginAllowed(req)
             : passcode.allows(req);
@@ -767,6 +779,7 @@ export async function startHeadlessServer(opts) {
         }
         const tabId = nextTabId++;
         wss.handleUpgrade(req, socket, head, (ws) => {
+            connections.delete(socket);
             tabs.add(ws);
             if (session)
                 tabAuth.set(ws, { sessionId: session.id, request: req });
@@ -792,7 +805,7 @@ export async function startHeadlessServer(opts) {
                     ws.close(1009, "payload too large");
                     return;
                 }
-                if (closing) {
+                if (closing || ws.readyState !== ws.OPEN) {
                     ws.close(1012, "server stopping");
                     return;
                 }
@@ -943,9 +956,13 @@ export async function startHeadlessServer(opts) {
                             sendToTab(ws, hostQueryError(parsed.id ?? null, -32602, error.message), "attachments");
                             return;
                         }
-                        if (ws.readyState !== ws.OPEN || !(await hubAuth.authenticate(req)))
+                        if (closing || ws.readyState !== ws.OPEN)
+                            return;
+                        if (!(await hubAuth.authenticate(req)))
                             return;
                     }
+                    if (closing || ws.readyState !== ws.OPEN)
+                        return;
                     // Recheck after asynchronous staging/authentication; other tabs may
                     // have filled the runtime's capacity while this request was suspended.
                     if (hubAuth && parsed.method === "agent/run" && runningSessions.size >= 64) {
@@ -1060,6 +1077,8 @@ export async function startHeadlessServer(opts) {
                     const workerLine = JSON.stringify(workerMessage);
                     // Spawn-on-first-frame (idempotent): the browser's first request wakes
                     // the worker, mirroring the renderer's spawn-on-agent/run semantics.
+                    if (closing || ws.readyState !== ws.OPEN)
+                        return;
                     bridge.ensureWorker(opts.cwd);
                     if (!bridge.canSend()) {
                         workerUnavailable("agent worker is unavailable");
@@ -1114,6 +1133,58 @@ export async function startHeadlessServer(opts) {
     server.on("upgrade", (req, socket, head) => {
         void upgrade(req, socket, head).catch(() => socket.destroy());
     });
+    let closePromise;
+    const close = () => {
+        if (closePromise)
+            return closePromise;
+        closing = true;
+        closePromise = Promise.resolve().then(async () => {
+            // Stop admission before any asynchronous resource/worker cleanup. A
+            // reconnect during a slow worker exit must not prolong server shutdown.
+            const webSocketsClosed = new Promise((resolve) => wss.close(() => resolve()));
+            // Finish WebSocket teardown before the HTTP close callback, including on
+            // Bun where closing HTTP before its upgraded sockets can strand it.
+            const httpClosed = webSocketsClosed.then(() => new Promise((resolve) => {
+                server.closeAllConnections?.();
+                server.close(() => resolve());
+            }));
+            for (const tab of tabs)
+                tab.terminate();
+            for (const socket of connections)
+                socket.destroy();
+            tabs.clear();
+            responses.clear();
+            clearInterval(pendingResponseReaper);
+            if (authReaper)
+                clearInterval(authReaper);
+            // A failed cleanup must not leave the remaining services or worker alive.
+            const errors = [];
+            const clean = async (action) => {
+                try {
+                    await action();
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+            };
+            await clean(() => panelAutomations?.close());
+            await clean(() => {
+                hostRuntime.stop();
+            });
+            await clean(() => uploads?.close());
+            await clean(() => skills?.close());
+            await clean(() => mcp?.close());
+            await clean(() => configuration?.close());
+            await clean(() => links?.close());
+            await clean(() => panels?.close());
+            await clean(() => files?.close());
+            await clean(() => bridge.stopAndWait());
+            await Promise.all([httpClosed, webSocketsClosed]);
+            if (errors.length)
+                throw new AggregateError(errors, "Headless server shutdown failed");
+        });
+        return closePromise;
+    };
     try {
         if (hubAuth) {
             automationWorker = createHubAutomationWorker({
@@ -1187,23 +1258,18 @@ export async function startHeadlessServer(opts) {
         });
     }
     catch (error) {
-        closing = true;
-        responses.clear();
-        await panelAutomations?.close();
-        clearInterval(pendingResponseReaper);
-        hostRuntime.stop();
-        if (authReaper)
-            clearInterval(authReaper);
-        await uploads?.close();
-        await skills?.close();
-        await mcp?.close();
-        configuration?.close();
-        links?.close();
-        await panels?.close();
-        files?.close();
-        await bridge.stopAndWait();
-        wss.close();
-        server.close();
+        const failures = [error];
+        try {
+            await close();
+        }
+        catch (cleanupError) {
+            failures.push(cleanupError);
+        }
+        if (failures.length > 1) {
+            throw new AggregateError(failures, "Headless server startup and shutdown failed", {
+                cause: error,
+            });
+        }
         throw error;
     }
     const address = server.address();
@@ -1220,39 +1286,7 @@ export async function startHeadlessServer(opts) {
         bridge,
         tabCount: () => tabs.size,
         pendingResponseCount: () => pendingWorkerResponses.size,
-        close: async () => {
-            closing = true;
-            responses.clear();
-            await panelAutomations?.close();
-            clearInterval(pendingResponseReaper);
-            if (authReaper)
-                clearInterval(authReaper);
-            await uploads?.close();
-            await skills?.close();
-            await mcp?.close();
-            configuration?.close();
-            links?.close();
-            await panels?.close();
-            files?.close();
-            for (const tab of tabs) {
-                try {
-                    tab.terminate();
-                }
-                catch {
-                    /* ignore */
-                }
-            }
-            tabs.clear();
-            await bridge.stopAndWait();
-            await new Promise((resolve) => {
-                wss.close(() => {
-                    server.close(() => resolve());
-                });
-                // server.close() alone waits out keep-alive HTTP sockets forever;
-                // drop them so shutdown is prompt.
-                server.closeAllConnections?.();
-            });
-        },
+        close,
     };
 }
 function webSocketPayloadBytes(data) {

package/dist/static-files.d.ts

@@ -1 +1,8 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
 export declare function contentTypeFor(extname: string): string;
+/** Stream a pinned regular file, bounded by its opened size and the response lifetime. */
+export declare function streamStaticFile(req: IncomingMessage, res: ServerResponse, options: {
+    rootDir: string;
+    filePath: string;
+    cacheControl: string;
+}): Promise<void>;

package/dist/static-files.js

@@ -3,6 +3,11 @@
 // Shared static-file primitives for the two HTTP hosts (pairing host's
 // /mobile static root and the headless serve SPA root). Keep this file free
 // of host wiring — MIME map + helpers only.
+import { constants } from "node:fs";
+import { createHash } from "node:crypto";
+import { open, realpath, stat } from "node:fs/promises";
+import { extname, isAbsolute, relative, sep } from "node:path";
+import { pipeline } from "node:stream/promises";
 const CONTENT_TYPES = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
@@ -24,3 +29,112 @@ const CONTENT_TYPES = {
 export function contentTypeFor(extname) {
     return CONTENT_TYPES[extname.toLowerCase()] ?? "application/octet-stream";
 }
+/** RFC 9110 entity-tag lists allow commas inside opaque tags and empty list items. */
+function matchesIfNoneMatch(value, etag) {
+    if (typeof value !== "string")
+        return false;
+    const header = value.replace(/^[ \t]+|[ \t]+$/g, "");
+    if (header === "*")
+        return true;
+    const tag = /(?:W\/)?("[\x21\x23-\x7e\x80-\xff]*")/y;
+    const opaque = etag.slice(2);
+    let position = 0;
+    let matches = false;
+    while (position < header.length) {
+        while (/[ \t,]/.test(header[position] ?? "") && position < header.length)
+            position++;
+        if (position === header.length)
+            break;
+        tag.lastIndex = position;
+        const item = tag.exec(header);
+        if (!item)
+            return false;
+        matches ||= item[1] === opaque;
+        position = tag.lastIndex;
+        while (/[ \t]/.test(header[position] ?? "") && position < header.length)
+            position++;
+        if (position < header.length && header[position++] !== ",")
+            return false;
+    }
+    // Validate the entire field before accepting a match, including later items.
+    return matches;
+}
+/** Stream a pinned regular file, bounded by its opened size and the response lifetime. */
+export async function streamStaticFile(req, res, options) {
+    let handle;
+    try {
+        if (res.destroyed || res.writableEnded)
+            return;
+        const root = await realpath(options.rootDir);
+        const path = await realpath(options.filePath);
+        const contained = (target) => {
+            const rel = relative(root, target);
+            return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+        };
+        if (!contained(path))
+            throw new Error("Static asset is outside its root");
+        // Resolve aliases before opening so valid in-root symlinks remain supported.
+        // O_NONBLOCK avoids hanging on a regular file replaced by a FIFO.
+        handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+        const info = await handle.stat({ bigint: true });
+        if (!info.isFile())
+            throw new Error("Static asset is not a regular file");
+        if (info.size > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new Error("Static asset is too large");
+        const currentPath = await realpath(options.filePath);
+        const current = await stat(currentPath, { bigint: true });
+        if (!contained(currentPath) ||
+            (await realpath(options.rootDir)) !== root ||
+            current.dev !== info.dev ||
+            current.ino !== info.ino ||
+            current.size !== info.size ||
+            current.mtimeNs !== info.mtimeNs ||
+            current.ctimeNs !== info.ctimeNs)
+            throw new Error("Static asset changed while opening");
+        if (res.destroyed || res.writableEnded)
+            return;
+        // A weak validator describes the opened file's metadata, not a byte hash.
+        // Include identity and change time so replacement or an equal-size rewrite
+        // with a restored mtime does not reuse the previous representation's tag.
+        const fingerprint = createHash("sha256")
+            .update(`${info.dev}:${info.ino}:${info.size}:${info.mtimeNs}:${info.ctimeNs}`)
+            .digest("base64url");
+        const etag = `W/"${fingerprint}"`;
+        const headers = {
+            "content-type": contentTypeFor(extname(options.filePath)),
+            "cache-control": options.cacheControl,
+            "x-content-type-options": "nosniff",
+            etag,
+        };
+        if ((req.method === "GET" || req.method === "HEAD") &&
+            matchesIfNoneMatch(req.headers["if-none-match"], etag)) {
+            res.writeHead(304, headers);
+            res.end();
+            return;
+        }
+        res.writeHead(200, { ...headers, "content-length": info.size.toString() });
+        if (req.method === "HEAD" || info.size === 0n) {
+            res.end();
+            return;
+        }
+        // pipeline propagates backpressure and destroys the source on disconnect.
+        // The explicit end prevents a growing file from extending this response.
+        await pipeline(handle.createReadStream({ autoClose: false, start: 0, end: Number(info.size - 1n) }), res);
+    }
+    catch {
+        if (res.destroyed || res.writableEnded)
+            return;
+        if (res.headersSent)
+            res.destroy();
+        else {
+            res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+            res.end("not found");
+        }
+    }
+    finally {
+        await handle?.close().catch(() => {
+            if (!res.destroyed)
+                res.destroy();
+        });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.47",
+  "version": "0.9.48",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,14 +62,14 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.47",
-    "@cjhyy/code-shell-core": "0.9.47",
-    "@cjhyy/code-shell-web": "0.9.47",
+    "@cjhyy/code-shell-capability-coding": "0.9.48",
+    "@cjhyy/code-shell-core": "0.9.48",
+    "@cjhyy/code-shell-web": "0.9.48",
     "@modelcontextprotocol/sdk": "^1.31.0",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0",
-    "@cjhyy/code-shell-link": "0.9.47",
-    "@cjhyy/code-shell-host": "0.9.47"
+    "@cjhyy/code-shell-link": "0.9.48",
+    "@cjhyy/code-shell-host": "0.9.48"
   },
   "engines": {
     "node": ">=20.10"