@cjhyy/code-shell-server 0.9.47 → 0.9.49

package/README.md

@@ -83,6 +83,10 @@ Desktop Web 和 Hub 在注销或显式撤销会话时，会关闭该会话尚未
 响应，包括正在下载的文件，并停止源文件读取、释放句柄。其他会话的下载不受影响；
 已经返回接受结果的后台任务仍由原来的任务生命周期管理。注销请求本身仍返回成功。
 
+Hub 认证每次读取磁盘上的当前会话；只有需要更新活动时间时才获取写锁，并在锁内
+重新验证撤销与过期状态。Hub 与 Mobile 静态文件按打开时的大小流式发送，`HEAD`
+只返回元数据；客户端断开会停止读取。首页和 SPA 回退也遵守静态目录边界。
+
 ## code-shell-serve — 个人 Hub Web host
 
 在任意机器上把一个 workspace 变成浏览器可访问的 CodeShell：

package/dist/desktop-web/http-api.d.ts

@@ -34,8 +34,17 @@ export interface DesktopWebApiOptions {
     sessionTtlMs?: number;
 }
 export interface DesktopWebHttpApi {
+    /**
+     * Optional independent authorization for GET/HEAD Panel assets. A handler may
+     * serve only an existing short-lived capability after revalidating its owner
+     * and project grant. Return false without writing when no capability matches;
+     * the caller must then apply its ordinary access gate. Never accepts API calls.
+     */
+    handleCapabilityAsset?: (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
     handle: (request: IncomingMessage, response: ServerResponse, context: {
         baseUrl: string;
+        /** Recheck the entrance authorization captured after its access gate succeeded. */
+        isAccessAuthorized?: () => boolean;
     }) => Promise<boolean>;
     /** Reopen after RemoteHostManager.stop(), without reviving previous cookies. */
     start: () => void;

package/dist/desktop-web/http-api.js

@@ -163,6 +163,8 @@ export function createDesktopWebApi(options) {
         if (!identity || closed || identity.generation !== generation)
             return false;
         try {
+            if (identity.isAccessAuthorized?.() === false)
+                return false;
             if (principal(identity.token)?.session !== identity.session)
                 return false;
             const resolved = await options.resolveWorkspace(identity.input, identity.session.deviceId);
@@ -170,6 +172,7 @@ export function createDesktopWebApi(options) {
             return (resolved === identity.cwd &&
                 !closed &&
                 identity.generation === generation &&
+                identity.isAccessAuthorized?.() !== false &&
                 principal(identity.token)?.session === identity.session);
         }
         catch {
@@ -302,6 +305,8 @@ export function createDesktopWebApi(options) {
             try {
                 if (closed)
                     throw new HubConfigurationError(503, "桌面远程服务已停止。");
+                if (context.isAccessAuthorized?.() === false)
+                    throw new HubConfigurationError(401, "访问口令已更新，请重新连接桌面。");
                 const requestGeneration = generation;
                 const origin = sameOrigin(request, context.baseUrl);
                 const secure = origin.protocol === "https:";
@@ -310,6 +315,8 @@ export function createDesktopWebApi(options) {
                     const input = await credentials(request);
                     if (closed || requestGeneration !== generation)
                         throw new HubConfigurationError(503, "桌面远程服务已停止。");
+                    if (context.isAccessAuthorized?.() === false)
+                        throw new HubConfigurationError(401, "访问口令已更新，请重新连接桌面。");
                     const device = options.devices.authenticate(input.deviceId, input.secretHash);
                     if (!device)
                         throw new HubConfigurationError(401, "设备未配对或已被撤销，请在桌面重新配对。");
@@ -360,6 +367,7 @@ export function createDesktopWebApi(options) {
                     const id = await environmentIdentity(options.dataDir);
                     if (closed ||
                         generation !== requestGeneration ||
+                        context.isAccessAuthorized?.() === false ||
                         principal(token)?.session !== current.session)
                         throw new HubConfigurationError(401, "设备连接已失效，请重新连接桌面。");
                     json(response, 200, describeEnvironment(id, "desktop"));
@@ -369,11 +377,19 @@ export function createDesktopWebApi(options) {
                 const cwd = await options.resolveWorkspace(input, current.device.id);
                 if (closed ||
                     generation !== requestGeneration ||
+                    context.isAccessAuthorized?.() === false ||
                     principal(token)?.session !== current.session)
                     throw new HubConfigurationError(401, "设备连接已失效，请重新连接桌面。");
                 if (!cwd || !isAbsolute(cwd))
                     throw new HubConfigurationError(403, "只能访问桌面已知的项目或会话工作区。");
-                identities.set(request, { token, session: current.session, input, cwd, generation });
+                identities.set(request, {
+                    token,
+                    session: current.session,
+                    input,
+                    cwd,
+                    generation,
+                    isAccessAuthorized: context.isAccessAuthorized,
+                });
                 const services = servicesFor(cwd);
                 services.active++;
                 try {

package/dist/http-byte-range.d.ts

@@ -0,0 +1,5 @@
+/** A bounded single HTTP byte range. Multipart ranges are deliberately unsupported. */
+export declare function rangeBounds(range: string, size: number): {
+    start: number;
+    end: number;
+} | null;

package/dist/http-byte-range.js

@@ -0,0 +1,19 @@
+/** A bounded single HTTP byte range. Multipart ranges are deliberately unsupported. */
+export function rangeBounds(range, size) {
+    const match = /^bytes=(\d*)-(\d*)$/.exec(range);
+    if (!match || (!match[1] && !match[2]) || !Number.isSafeInteger(size) || size <= 0)
+        return null;
+    const first = match[1] ? Number(match[1]) : undefined;
+    const last = match[2] ? Number(match[2]) : undefined;
+    if ((first !== undefined && !Number.isSafeInteger(first)) ||
+        (last !== undefined && !Number.isSafeInteger(last)))
+        return null;
+    if (first === undefined) {
+        if (!last || last <= 0)
+            return null;
+        return { start: Math.max(0, size - last), end: size - 1 };
+    }
+    if (first >= size || (last !== undefined && last < first))
+        return null;
+    return { start: first, end: Math.min(last ?? size - 1, size - 1) };
+}

package/dist/hub/auth-store.d.ts

@@ -40,6 +40,7 @@ export declare class HubAuthStore {
     }): Promise<HubSessionGrant>;
     login(input: HubLoginInput, replaceToken?: string): Promise<HubSessionGrant>;
     authenticate(token: string | undefined): HubSession | null;
+    private findSession;
     listSessions(): HubSession[];
     /** Offline restore must not resurrect sessions revoked after the snapshot. */
     revokeAllSessions(): void;
@@ -49,6 +50,7 @@ export declare class HubAuthStore {
     private toPublic;
     private mutate;
     private ensureDirectory;
+    private assertDirectory;
     private read;
     private write;
 }

package/dist/hub/auth-store.js

@@ -93,20 +93,36 @@ export class HubAuthStore {
     authenticate(token) {
         if (!token || !TOKEN_PATTERN.test(token))
             return null;
+        // Writers publish by atomic rename. Read the committed record on every
+        // request, but only contend for the writer lock when activity needs saving.
+        this.assertDirectory();
+        const tokenHash = hashToken(token);
+        const record = this.read();
+        const now = this.now();
+        const session = this.findSession(record, tokenHash, now);
+        if (!session)
+            return null;
+        if (now - session.lastSeenAt < 60_000)
+            return this.toPublic(record, session);
         return this.mutate((record) => {
             const now = this.now();
-            const tokenHash = hashToken(token);
-            const session = record.sessions.find((row) => safeHashEqual(row.tokenHash, tokenHash));
-            if (!record.account || !session || session.expiresAt <= now || session.createdAt > now) {
+            // Recheck after taking the lock: a peer may have revoked, replaced or
+            // refreshed the session since the unlocked read. Never write that snapshot.
+            const session = this.findSession(record, tokenHash, now);
+            if (!session)
                 return { result: null, changed: false };
-            }
-            // Persist activity at most once per minute; validation always reads disk.
             const changed = now - session.lastSeenAt >= 60_000;
             if (changed)
                 session.lastSeenAt = now;
             return { result: this.toPublic(record, session), changed };
         });
     }
+    findSession(record, tokenHash, now) {
+        if (!record.account)
+            return null;
+        const session = record.sessions.find((row) => safeHashEqual(row.tokenHash, tokenHash));
+        return session && session.expiresAt > now && session.createdAt <= now ? session : null;
+    }
     listSessions() {
         const record = this.read();
         const now = this.now();
@@ -194,10 +210,13 @@ export class HubAuthStore {
     ensureDirectory() {
         const parent = dirname(this.filePath);
         mkdirSync(parent, { recursive: true, mode: 0o700 });
-        const metadata = lstatSync(parent);
+        this.assertDirectory();
+        chmodSync(parent, 0o700);
+    }
+    assertDirectory() {
+        const metadata = lstatSync(dirname(this.filePath));
         if (!metadata.isDirectory() || metadata.isSymbolicLink())
             throw new Error("Invalid Hub auth directory");
-        chmodSync(parent, 0o700);
     }
     read(allowMissing = false) {
         let descriptor;

package/dist/hub/files.js

@@ -2,8 +2,10 @@ import { constants } from "node:fs";
 import { lstat, open, opendir, realpath } from "node:fs/promises";
 import { basename, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
+import { Readable } from "node:stream";
+import { rangeBounds } from "../http-byte-range.js";
 import { hubJson } from "./uploads.js";
-const MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024;
+const MAX_DOWNLOAD_BYTES = 2 * 1024 * 1024 * 1024;
 const MAX_PREVIEW_BYTES = 512 * 1024;
 const IMAGE_TYPES = {
     ".png": "image/png",
@@ -121,7 +123,7 @@ export function createHubFiles(options) {
         try {
             if (closed)
                 throw new FileRequestError(503, "服务正在关闭。");
-            if (req.method !== "GET")
+            if (req.method !== "GET" && !(req.method === "HEAD" && url.pathname.endsWith("/content")))
                 throw new FileRequestError(405, "文件页面只支持读取。");
             if (!(await options.isAuthorized(req)))
                 throw new FileRequestError(401, "请重新登录。");
@@ -184,14 +186,16 @@ export function createHubFiles(options) {
                 if (!(await options.isAuthorized(req)))
                     throw new FileRequestError(401, "请重新登录。");
                 await opened.verify();
+                if (!(await options.isAuthorized(req)))
+                    throw new FileRequestError(401, "请重新登录。");
                 hubJson(res, 200, { path: location.relativePath, files, truncated });
             }
             else {
-                if (info.size > MAX_DOWNLOAD_BYTES)
-                    throw new FileRequestError(413, "文件超过 100 MB，请从服务器工作目录获取。");
                 if (!(await options.isAuthorized(req)))
                     throw new FileRequestError(401, "请重新登录。");
                 await opened.verify();
+                if (!(await options.isAuthorized(req)))
+                    throw new FileRequestError(401, "请重新登录。");
                 const imageType = IMAGE_TYPES[extname(location.path).toLowerCase()];
                 const preview = url.searchParams.get("preview") === "true";
                 if (preview) {
@@ -199,6 +203,9 @@ export function createHubFiles(options) {
                     const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
                     const bytes = buffer.subarray(0, bytesRead);
                     const binary = bytes.includes(0) || !!imageType;
+                    await opened.verify();
+                    if (!(await options.isAuthorized(req)))
+                        throw new FileRequestError(401, "请重新登录。");
                     hubJson(res, 200, {
                         path: location.relativePath,
                         name: basename(location.path),
@@ -211,21 +218,76 @@ export function createHubFiles(options) {
                     });
                 }
                 else {
+                    if (info.size > MAX_DOWNLOAD_BYTES)
+                        throw new FileRequestError(413, "文件超过 2 GiB 下载上限。");
                     const inline = url.searchParams.get("inline") === "true" && !!imageType;
                     const filename = basename(location.path);
                     const encoded = encodeURIComponent(filename).replace(/[!'()*]/g, (value) => `%${value.charCodeAt(0).toString(16).toUpperCase()}`);
-                    res.writeHead(200, {
+                    // Workspace outputs are mutable; without a matching validator an
+                    // If-Range request must receive the complete current representation.
+                    const range = req.headers["if-range"] === undefined ? req.headers.range : undefined;
+                    const bounds = range === undefined ? { start: 0, end: info.size - 1 } : rangeBounds(range, info.size);
+                    const headers = {
                         "content-type": inline ? imageType : "application/octet-stream",
-                        "content-length": info.size,
                         "content-disposition": `${inline ? "inline" : "attachment"}; filename="download${extname(filename).replace(/[^.A-Za-z0-9]/g, "")}"; filename*=UTF-8''${encoded}`,
+                        "accept-ranges": "bytes",
                         "cache-control": "no-store",
                         "x-content-type-options": "nosniff",
                         "content-security-policy": "default-src 'none'; sandbox",
+                        "referrer-policy": "no-referrer",
+                    };
+                    if (!bounds) {
+                        res.writeHead(416, {
+                            ...headers,
+                            "content-range": `bytes */${info.size}`,
+                            "content-length": 0,
+                        });
+                        res.end();
+                        return true;
+                    }
+                    res.writeHead(range === undefined ? 200 : 206, {
+                        ...headers,
+                        "content-length": bounds.end - bounds.start + 1,
+                        ...(range === undefined
+                            ? {}
+                            : { "content-range": `bytes ${bounds.start}-${bounds.end}/${info.size}` }),
                     });
-                    if (info.size === 0)
+                    if (req.method === "HEAD" || info.size === 0)
                         res.end();
-                    else
-                        await pipeline(handle.createReadStream({ autoClose: false, end: Math.max(0, info.size - 1) }), res);
+                    else {
+                        const input = handle.createReadStream({ autoClose: false, ...bounds });
+                        const authorize = async () => {
+                            if (closed || res.destroyed || !(await options.isAuthorized(req)))
+                                throw new FileRequestError(401, "下载授权已失效。");
+                        };
+                        let checking = false;
+                        const timer = setInterval(() => {
+                            if (checking)
+                                return;
+                            checking = true;
+                            void authorize()
+                                .catch(() => {
+                                input.destroy();
+                                res.destroy();
+                            })
+                                .finally(() => {
+                                checking = false;
+                            });
+                        }, 250);
+                        timer.unref();
+                        try {
+                            await pipeline(Readable.from((async function* () {
+                                for await (const chunk of input) {
+                                    await authorize();
+                                    yield chunk;
+                                }
+                            })(), { objectMode: false }), res);
+                        }
+                        finally {
+                            clearInterval(timer);
+                            input.destroy();
+                        }
+                    }
                 }
             }
         }

package/dist/index.panels.d.ts

@@ -26,3 +26,4 @@ export * from "./panels/task-cookie-host.js";
 export * from "./panels/execution-gate.js";
 export * from "./panels/package-mutation.js";
 export * from "./panels/model-traces.js";
+export * from "./panels/background-services.js";

package/dist/index.panels.js

@@ -25,3 +25,4 @@ export * from "./panels/task-cookie-host.js";
 export * from "./panels/execution-gate.js";
 export * from "./panels/package-mutation.js";
 export * from "./panels/model-traces.js";
+export * from "./panels/background-services.js";

package/dist/mobile-remote/access-passcode.d.ts

@@ -49,6 +49,11 @@ export declare class AccessPasscode {
     private lockedUntil;
     constructor(opts: AccessPasscodeOptions);
     isSet(): boolean;
+    /**
+     * After a successful gate, retain its passcode generation for derived grants.
+     * Rechecks never retain/retry the plaintext or spend the verification budget.
+     */
+    captureValidity(): () => boolean;
     /** Set (or rotate) the passcode. Rotating `secret` invalidates old tokens. */
     set(passcode: string): void;
     /**

package/dist/mobile-remote/access-passcode.js

@@ -11,6 +11,10 @@ const SCRYPT_KEYLEN = 32;
 export const MIN_ACCESS_PASSCODE_LENGTH = 4;
 export const MAX_ACCESS_PASSCODE_LENGTH = 256;
 const MAX_REMEMBER_TOKEN_LENGTH = 128;
+/** Marks which gate decision produced a response: "granted", "denied" or
+ *  "unconfigured". The challenge page reports a passcode outcome only from this
+ *  marker, never from a status a tunnel edge or proxy could also produce. */
+const ACCESS_OUTCOME_HEADER = "X-CodeShell-Access";
 const MAX_ACCESS_RECORD_BYTES = 4 * 1024;
 /**
  * The public-tunnel access gate. A single shared passcode (set by the desktop
@@ -49,6 +53,14 @@ export class AccessPasscode {
     isSet() {
         return this.read() !== undefined;
     }
+    /**
+     * After a successful gate, retain its passcode generation for derived grants.
+     * Rechecks never retain/retry the plaintext or spend the verification budget.
+     */
+    captureValidity() {
+        const secret = this.read()?.secret;
+        return () => secret !== undefined && this.read()?.secret === secret;
+    }
     /** Set (or rotate) the passcode. Rotating `secret` invalidates old tokens. */
     set(passcode) {
         if (!isValidPasscode(passcode)) {
@@ -132,13 +144,18 @@ export class AccessPasscode {
     gate(req, res) {
         if (!this.isSet()) {
             // No passcode configured → tunnel must not be reachable. Refuse.
-            res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+            res.writeHead(403, {
+                "content-type": "text/plain; charset=utf-8",
+                [ACCESS_OUTCOME_HEADER]: "unconfigured",
+            });
             res.end("access passcode not configured");
             return false;
         }
         const cookieToken = readCookie(req.headers.cookie, COOKIE_NAME);
-        if (cookieToken && this.verifyToken(cookieToken))
+        if (cookieToken && this.verifyToken(cookieToken)) {
+            res.setHeader(ACCESS_OUTCOME_HEADER, "granted");
             return true;
+        }
         const supplied = readPasscodeParam(req);
         let wrongAttempt = false;
         if (supplied) {
@@ -151,6 +168,7 @@ export class AccessPasscode {
                 // user every visit. Lax sends it on top-level navigations. Secure
                 // because the tunnel terminates TLS (always https).
                 `${COOKIE_NAME}=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${Math.floor(this.tokenMaxAgeMs / 1000)}`);
+                res.setHeader(ACCESS_OUTCOME_HEADER, "granted");
                 const cleanLocation = acceptsHtml(req) ? locationWithoutPasscode(req.url) : undefined;
                 if (cleanLocation) {
                     // The HTML challenge has a no-query JavaScript path below, but keep a
@@ -176,11 +194,17 @@ export class AccessPasscode {
         // to enter the passcode). Non-navigation requests (WS upgrade, fetch) keep
         // the lightweight text 401.
         if (acceptsHtml(req)) {
-            res.writeHead(401, { "content-type": "text/html; charset=utf-8" });
+            res.writeHead(401, {
+                "content-type": "text/html; charset=utf-8",
+                [ACCESS_OUTCOME_HEADER]: "denied",
+            });
             res.end(challengePage(req.url, wrongAttempt, this.isLocked()));
             return false;
         }
-        res.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+        res.writeHead(401, {
+            "content-type": "text/plain; charset=utf-8",
+            [ACCESS_OUTCOME_HEADER]: "denied",
+        });
         res.end("访问口令无效或缺失");
         return false;
     }
@@ -457,17 +481,32 @@ function challengePage(url, wrong, locked) {
     const value = input?.value ?? "";
     if (!value) return;
     try {
+      // Request the page as the following navigation will (HTML), so SPA
+      // routes resolve the same way. A passcode outcome is reported only from
+      // the gate's own marker: a tunnel edge or proxy can answer 4xx/5xx
+      // without the request ever reaching the gate.
       const response = await fetch(window.location.href, {
-        headers: { "X-Access-Passcode": value, Accept: "application/json" },
+        headers: { "X-Access-Passcode": value, Accept: "text/html" },
         credentials: "same-origin",
       });
-      if (!response.ok) {
+      if (response.ok) {
+        window.location.replace(${cleanLocation});
+        return;
+      }
+      const access = response.headers.get("${ACCESS_OUTCOME_HEADER}");
+      const status = "（HTTP " + response.status + "）";
+      if (access === "denied") {
         if (note) note.textContent = "口令不正确或尝试过多，请稍后重试。";
-        if (note) note.className = "err";
         if (input) input.value = "";
-        return;
+      } else if (note) {
+        note.textContent =
+          access === "granted"
+            ? "访问验证已通过，但页面加载失败" + status + "，请稍后重试或检查桌面端。"
+            : access === "unconfigured"
+              ? "远程访问未就绪" + status + "，请在桌面端检查手机遥控设置。"
+              : "请求未完成" + status + "，口令尚未得到验证，请稍后重试。";
       }
-      window.location.replace(${cleanLocation});
+      if (note) note.className = "err";
     } catch {
       if (note) note.textContent = "连接失败，请重试。";
       if (note) note.className = "err";

package/dist/mobile-remote/codex-room-agent.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { stopRoomProcess } from "./room-process-stop.js";
+import { releaseStdioAfterExit, stopRoomProcess } from "./room-process-stop.js";
 import { createInterface } from "node:readline";
 import { pathWithCommonBins } from "./path-bins.js";
 import { parseCodexJsonLine, extractThreadId } from "./codex-parse.js";
@@ -109,6 +109,8 @@ export class CodexRoomAgent {
             stdio: ["pipe", "pipe", "pipe"],
         });
         this.child = child;
+        // Settle on `close` so trailing output is read, without waiting on grandchildren.
+        releaseStdioAfterExit(child);
         if (child.stdout) {
             const rl = createInterface({ input: child.stdout });
             rl.on("line", (line) => {

package/dist/mobile-remote/mobile-chat-turn.d.ts

@@ -33,6 +33,12 @@ export type DispatchMobileChatTurnResult = {
 } | {
     ok: false;
     message: string;
+    uncertain?: false;
+} | {
+    ok: false;
+    message: string;
+    uncertain: true;
+    clientMessageId: string;
 };
 /** Transaction boundary for mobile chat: workspace → canonical stage → worker ack → finalize. */
 export declare function dispatchMobileChatTurn(input: DispatchMobileChatTurnInput): Promise<DispatchMobileChatTurnResult>;

package/dist/mobile-remote/mobile-chat-turn.js

@@ -63,11 +63,24 @@ export async function dispatchMobileChatTurn(input) {
             : await injectMobileRunAndAwaitAcceptance(input.bridge, request, input.meta);
     }
     catch {
-        acceptance = { ok: false, message: "The selected runtime rejected the submission" };
+        acceptance = {
+            ok: false,
+            uncertain: true,
+            message: "The selected runtime did not confirm the submission",
+        };
     }
     if (!acceptance.ok) {
+        // Worker input refers to the canonical staged files, not these temporary
+        // upload spools. Keep the staged files for a possibly accepted run and
+        // release only the claims so the same intent can retry its attachments.
+        // A late acceptance may never be observed, so uncertain files also need
+        // sent retention rather than expiring as abandoned drafts after one day.
+        if (acceptance.uncertain)
+            await (input.markSent ?? markAttachmentsSent)(cwd, input.sessionId, materialized.metas).catch(() => undefined);
         await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
-        return { ok: false, message: acceptance.message };
+        return acceptance.uncertain
+            ? { ok: false, message: acceptance.message, uncertain: true, clientMessageId }
+            : { ok: false, message: acceptance.message };
     }
     await (input.markSent ?? markAttachmentsSent)(cwd, input.sessionId, materialized.metas).catch(() => undefined);
     await settleClaims(input.uploads, input.deviceId, materialized.claims, "finalize");

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -29,6 +29,9 @@ export function parseMobileClientEvent(value) {
         case "chat.send":
             valid =
                 boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
+                    (event.modelKey === undefined ||
+                        (boundedString(event.modelKey, MAX_ID_LENGTH) &&
+                            /^(codex|claude-code)\/[^\r\n\0]*$/.test(event.modelKey))) &&
                     optionalBoundedString(event.sessionId, MAX_ID_LENGTH) &&
                     (event.modelTraceSource === undefined ||
                         (typeof event.modelTraceSource === "string" &&
@@ -52,6 +55,17 @@ export function parseMobileClientEvent(value) {
         case "session.recovery.cancel":
             valid = true;
             break;
+        case "session.outputRecovery.plan":
+        case "session.outputRecovery.apply":
+            valid =
+                boundedString(event.sessionId, 128) &&
+                    boundedString(event.requestId, 128) &&
+                    (event.type === "session.outputRecovery.plan" ||
+                        (boundedString(event.planId, 128) && event.acceptHistoricalGap === true)) &&
+                    Object.keys(event).every((key) => (event.type === "session.outputRecovery.plan"
+                        ? ["type", "sessionId", "requestId"]
+                        : ["type", "sessionId", "requestId", "planId", "acceptHistoricalGap"]).includes(key));
+            break;
         case "session.legacyBase":
             valid =
                 boundedString(event.sessionId, 128) &&
@@ -97,6 +111,15 @@ export function parseMobileClientEvent(value) {
                     optionalMember(event.pathScope, PATH_SCOPES);
             break;
         case "session.list":
+            valid =
+                optionalBoundedString(event.requestId, 128) &&
+                    optionalBoundedString(event.cursor, 2048) &&
+                    (event.cwds === undefined ||
+                        (Array.isArray(event.cwds) &&
+                            event.cwds.length > 0 &&
+                            event.cwds.length <= 256 &&
+                            event.cwds.every(boundedPath)));
+            break;
         case "room.list":
         case "room.projects":
             valid = true;
@@ -115,6 +138,9 @@ export function parseMobileClientEvent(value) {
         case "model.set":
             valid = boundedString(event.model, MAX_ID_LENGTH);
             break;
+        case "runtime.models":
+            valid = true;
+            break;
         case "goal.extend":
             valid =
                 boundedString(event.sessionId, MAX_ID_LENGTH) &&
@@ -164,7 +190,10 @@ export function parseMobileClientEvent(value) {
                     optionalMember(event.kind, KINDS);
             break;
         case "ccRoom.listSessions":
-            valid = boundedPath(event.cwd) && optionalMember(event.kind, KINDS);
+            valid =
+                boundedPath(event.cwd) &&
+                    optionalMember(event.kind, KINDS) &&
+                    (event.all === undefined || typeof event.all === "boolean");
             break;
         case "ccRoom.openSession":
             valid =

package/dist/mobile-remote/mobile-run-dispatch.d.ts

@@ -13,6 +13,7 @@ export type MobileRunAcceptance = {
     ok: false;
     message: string;
     code?: number;
+    uncertain?: true;
 };
 /** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
 export declare function injectMobileRunAndAwaitAcceptance(bridge: MobileRunBridge, request: MobileRunRequest, meta: WorkerFrameMeta, timeoutMs?: number): Promise<MobileRunAcceptance>;

package/dist/mobile-remote/mobile-run-dispatch.js

@@ -2,7 +2,6 @@
 export function injectMobileRunAndAwaitAcceptance(bridge, request, meta, timeoutMs = 5_000) {
     return new Promise((resolve) => {
         let settled = false;
-        let timer;
         const finish = (result) => {
             if (settled)
                 return;
@@ -40,17 +39,26 @@ export function injectMobileRunAndAwaitAcceptance(bridge, request, meta, timeout
                 // Not JSON or not part of this request.
             }
         });
-        timer = setTimeout(() => finish({ ok: false, message: "worker did not acknowledge the run" }), timeoutMs);
+        const timer = setTimeout(() => finish({ ok: false, uncertain: true, message: "worker did not acknowledge the run" }), timeoutMs);
+        let injecting = false;
         try {
-            bridge.injectWorkerMessage(JSON.stringify({
+            const line = JSON.stringify({
                 jsonrpc: "2.0",
                 id: request.id,
                 method: "agent/run",
                 params: request.params,
-            }), meta);
+            });
+            injecting = true;
+            bridge.injectWorkerMessage(line, meta);
         }
         catch (error) {
-            finish({ ok: false, message: error instanceof Error ? error.message : String(error) });
+            // An injection can fail after queuing bytes. Only serialization failure
+            // proves that this request never reached the transport.
+            finish({
+                ok: false,
+                message: error instanceof Error ? error.message : String(error),
+                ...(injecting ? { uncertain: true } : {}),
+            });
         }
     });
 }