@cjhyy/code-shell-server 0.9.49 → 0.9.51

package/dist/index.panels.d.ts

@@ -1,7 +1,7 @@
 export { createPanelHttp } from "./panels/http.js";
 export * from "./panels/automations.js";
 export * from "./panels/hub-automations.js";
-export { createPanelManagement, PanelManagementError } from "./panels/management.js";
+export { createPanelManagement, createPanelSnapshotReads, PanelManagementError, type PanelSnapshotReads, } from "./panels/management.js";
 export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
 export { createHubPanelBinding } from "./panels/hub-binding.js";
 export * from "./panels/project-scope.js";

package/dist/index.panels.js

@@ -1,7 +1,7 @@
 export { createPanelHttp } from "./panels/http.js";
 export * from "./panels/automations.js";
 export * from "./panels/hub-automations.js";
-export { createPanelManagement, PanelManagementError } from "./panels/management.js";
+export { createPanelManagement, createPanelSnapshotReads, PanelManagementError, } from "./panels/management.js";
 export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
 export { createHubPanelBinding } from "./panels/hub-binding.js";
 export * from "./panels/project-scope.js";

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -28,7 +28,8 @@ export function parseMobileClientEvent(value) {
             break;
         case "chat.send":
             valid =
-                boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
+                optionalMember(event.permissionMode, PERMISSION_MODES) &&
+                    boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
                     (event.modelKey === undefined ||
                         (boundedString(event.modelKey, MAX_ID_LENGTH) &&
                             /^(codex|claude-code)\/[^\r\n\0]*$/.test(event.modelKey))) &&
@@ -74,20 +75,37 @@ export function parseMobileClientEvent(value) {
                     ((boundedString(event.throughEventId, 512) && event.cursor === undefined) ||
                         (boundedString(event.cursor, 2048) && event.throughEventId === undefined));
             break;
+        case "session.historyView":
+        case "session.historyDetail":
+            valid =
+                boundedString(event.sessionId, 128) &&
+                    boundedString(event.recoveryId, 128) &&
+                    boundedString(event.requestId, 128) &&
+                    (event.type === "session.historyView"
+                        ? optionalBoundedString(event.before, 2048) &&
+                            Object.keys(event).every((key) => ["type", "sessionId", "recoveryId", "requestId", "before"].includes(key))
+                        : boundedString(event.ref, 2048) &&
+                            optionalBoundedString(event.cursor, 2048) &&
+                            Object.keys(event).every((key) => ["type", "sessionId", "recoveryId", "requestId", "ref", "cursor"].includes(key)));
+            break;
         case "session.outputJournal":
             valid =
                 boundedString(event.sessionId, 128) &&
                     boundedString(event.recoveryId, 128) &&
                     boundedString(event.requestId, 128) &&
                     optionalBoundedString(event.after, 2048) &&
-                    optionalBoundedString(event.through, 2048);
+                    optionalBoundedString(event.through, 2048) &&
+                    (event.frozenSnapshot === undefined || event.frozenSnapshot === true) &&
+                    (event.maxFrames === undefined ||
+                        (isPositiveInteger(event.maxFrames) && event.maxFrames <= 2048));
             break;
         case "session.history":
             valid = boundedString(event.sessionId, MAX_ID_LENGTH);
             break;
         case "session.create":
             valid =
-                optionalBoundedString(event.clientRequestId, MAX_ID_LENGTH) &&
+                optionalMember(event.permissionMode, PERMISSION_MODES) &&
+                    optionalBoundedString(event.clientRequestId, MAX_ID_LENGTH) &&
                     (event.cwd === undefined || event.cwd === null || boundedPath(event.cwd)) &&
                     (event.projectId === undefined ||
                         event.projectId === null ||
@@ -105,6 +123,9 @@ export function parseMobileClientEvent(value) {
                 boundedString(event.approvalId, MAX_ID_LENGTH) &&
                     (event.decision === "approve" || event.decision === "reject") &&
                     optionalBoundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.connectionId, MAX_ID_LENGTH) &&
+                    (event.generation === undefined ||
+                        (Number.isSafeInteger(event.generation) && event.generation >= 0)) &&
                     optionalBoundedString(event.reason, MAX_MESSAGE_LENGTH) &&
                     optionalBoundedString(event.answer, MAX_MESSAGE_LENGTH) &&
                     optionalMember(event.scope, SCOPES) &&

package/dist/mobile-remote/pending-approvals.d.ts

@@ -5,15 +5,27 @@
  * are stateful: keep the latest unresolved raw JSON-RPC request here and replay
  * it to a phone when that phone binds to the matching session.
  */
+export interface PendingMobileApprovalRoute {
+    sessionId: string;
+    requestId: string;
+    connectionId?: string;
+    generation?: number;
+    expiresAt?: number;
+}
 export declare class PendingMobileApprovals {
+    private readonly now;
     private readonly bySession;
     private workerGeneration;
+    constructor(now?: () => number);
     /** Requests belong to the worker that can answer them, never its successor. */
     setWorkerState(generation: number, alive: boolean): void;
     observeOutboundLine(line: string): void;
-    resolve(requestId: string): void;
+    resolve(requestId: string, route?: Partial<PendingMobileApprovalRoute>): void;
     replayLines(sessionId: string): string[];
+    /** The stored worker envelope, rather than a phone's mutable current session, owns routing. */
+    find(sessionId: string, requestId: string): PendingMobileApprovalRoute | undefined;
     /** The desktop has a queue across sessions; return only its current pending requests. */
     replayAllLines(): string[];
     forgetSession(sessionId: string): void;
+    private pruneExpired;
 }

package/dist/mobile-remote/pending-approvals.js

@@ -1,13 +1,10 @@
-/**
- * Tracks currently pending core approval requests for mobile clients.
- *
- * Session snapshots intentionally contain only stream events. Approval requests
- * are stateful: keep the latest unresolved raw JSON-RPC request here and replay
- * it to a phone when that phone binds to the matching session.
- */
 export class PendingMobileApprovals {
+    now;
     bySession = new Map();
     workerGeneration;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
     /** Requests belong to the worker that can answer them, never its successor. */
     setWorkerState(generation, alive) {
         if (!alive || this.workerGeneration !== generation)
@@ -32,6 +29,8 @@ export class PendingMobileApprovals {
                 return;
             if (typeof requestId !== "string" || !requestId)
                 return;
+            if (typeof params?.expiresAt === "number" && params.expiresAt <= this.now())
+                return;
             let pending = this.bySession.get(sessionId);
             if (!pending) {
                 pending = new Map();
@@ -44,24 +43,61 @@ export class PendingMobileApprovals {
             const params = msg.params;
             const requestId = params?.requestId;
             if (typeof requestId === "string" && requestId)
-                this.resolve(requestId);
+                this.resolve(requestId, params ?? {});
         }
     }
-    resolve(requestId) {
+    resolve(requestId, route = {}) {
         for (const [sessionId, pending] of this.bySession) {
+            if (route.sessionId !== undefined && route.sessionId !== sessionId)
+                continue;
+            const line = pending.get(requestId);
+            if (!line)
+                continue;
+            const params = JSON.parse(line).params;
+            if ((params.connectionId !== undefined || params.generation !== undefined) &&
+                (route.sessionId !== sessionId ||
+                    route.connectionId !== params.connectionId ||
+                    route.generation !== params.generation))
+                continue;
+            if ((route.connectionId !== undefined && route.connectionId !== params.connectionId) ||
+                (route.generation !== undefined && route.generation !== params.generation))
+                continue;
             pending.delete(requestId);
             if (pending.size === 0)
                 this.bySession.delete(sessionId);
         }
     }
     replayLines(sessionId) {
+        this.pruneExpired();
         return [...(this.bySession.get(sessionId)?.values() ?? [])];
     }
+    /** The stored worker envelope, rather than a phone's mutable current session, owns routing. */
+    find(sessionId, requestId) {
+        this.pruneExpired();
+        const line = this.bySession.get(sessionId)?.get(requestId);
+        if (!line)
+            return undefined;
+        const { connectionId, generation, expiresAt } = JSON.parse(line).params;
+        return { sessionId, requestId, connectionId, generation, expiresAt };
+    }
     /** The desktop has a queue across sessions; return only its current pending requests. */
     replayAllLines() {
+        this.pruneExpired();
         return [...this.bySession.values()].flatMap((pending) => [...pending.values()]);
     }
     forgetSession(sessionId) {
         this.bySession.delete(sessionId);
     }
+    pruneExpired() {
+        const now = this.now();
+        for (const [sessionId, pending] of this.bySession) {
+            for (const [requestId, line] of pending) {
+                const expiresAt = JSON.parse(line).params.expiresAt;
+                if (typeof expiresAt === "number" && expiresAt <= now)
+                    pending.delete(requestId);
+            }
+            if (!pending.size)
+                this.bySession.delete(sessionId);
+        }
+    }
 }

package/dist/mobile-remote/remote-host-manager.d.ts

@@ -40,6 +40,10 @@ export interface RemoteHostManagerOptions {
     outputJournal?: boolean;
     /** Enable only when the attached selected-session host implements legacy base pages. */
     legacyBasePages?: boolean;
+    /** Enable only when the selected-session reader supports opt-in dense pages. */
+    outputJournalPageFrames?: 2048;
+    /** Selected-session Host implements verified display views and bounded detail parts. */
+    historyView?: boolean;
     onClientEvent: (event: unknown, ws: WebSocket) => void | Promise<void>;
     /**
      * Absolute path to the built mobile app (out/mobile). Defaults to the

package/dist/mobile-remote/remote-host-manager.js

@@ -478,7 +478,11 @@ export class RemoteHostManager extends EventEmitter {
                     ? {
                         capabilities: {
                             outputJournal: 1,
+                            ...(this.opts.historyView ? { historyView: 1 } : {}),
                             ...(this.opts.legacyBasePages ? { legacyBasePages: 1 } : {}),
+                            ...(this.opts.outputJournalPageFrames === 2048
+                                ? { outputJournalPageFrames: 2048 }
+                                : {}),
                         },
                     }
                     : {}),
@@ -501,7 +505,11 @@ export class RemoteHostManager extends EventEmitter {
                     ? {
                         capabilities: {
                             outputJournal: 1,
+                            ...(this.opts.historyView ? { historyView: 1 } : {}),
                             ...(this.opts.legacyBasePages ? { legacyBasePages: 1 } : {}),
+                            ...(this.opts.outputJournalPageFrames === 2048
+                                ? { outputJournalPageFrames: 2048 }
+                                : {}),
                         },
                     }
                     : {}),

package/dist/panels/http.d.ts

@@ -17,7 +17,7 @@ export declare function createPanelHttp(options: PanelManagementHttpOptions & {
     authorizePanelDirectory?: PanelDirectoryAuthorizer;
 }): {
     service: {
-        snapshot: (appId?: string) => Promise<import("./types.js").PanelSnapshot>;
+        snapshot: (appId?: string, reads?: import("./management.js").PanelSnapshotReads) => Promise<import("./types.js").PanelSnapshot>;
         packageHistory(context: import("./types.js").PanelOperationContext, id: unknown, expected: unknown): Promise<import("./types.js").PanelPackageHistory>;
         previewRestore(context: import("./types.js").PanelOperationContext, id: unknown, digest: unknown, expected: unknown): Promise<import("./types.js").PanelPackageRestoreReview>;
         cancelRestore(context: import("./types.js").PanelOperationContext, token: unknown): Promise<{

package/dist/panels/management-http.d.ts

@@ -8,7 +8,7 @@ export interface PanelManagementHttpOptions extends PanelManagementOptions {
 /** Call only after the host's same-origin authentication boundary. */
 export declare function createPanelManagementHttp(options: PanelManagementHttpOptions): {
     service: {
-        snapshot: (appId?: string) => Promise<import("./types.js").PanelSnapshot>;
+        snapshot: (appId?: string, reads?: import("./management.js").PanelSnapshotReads) => Promise<import("./types.js").PanelSnapshot>;
         packageHistory(context: PanelOperationContext, id: unknown, expected: unknown): Promise<import("./types.js").PanelPackageHistory>;
         previewRestore(context: PanelOperationContext, id: unknown, digest: unknown, expected: unknown): Promise<import("./types.js").PanelPackageRestoreReview>;
         cancelRestore(context: PanelOperationContext, token: unknown): Promise<{

package/dist/panels/management.d.ts

@@ -1,5 +1,5 @@
 import { type PanelExecutionScope } from "./execution-gate.js";
-import { type PanelAppPreview, type PanelAppSourceInput } from "@cjhyy/code-shell-core";
+import { type PanelAppInspectionReads, type PanelAppPreview, type PanelAppSourceInput } from "@cjhyy/code-shell-core";
 import type { PanelCompatibility, PanelDiscovery, PanelOperationContext, PanelReview, PanelProjectReview, PanelSnapshot, PanelPackageHistory, PanelPackageRestoreReview } from "./types.js";
 export declare class PanelManagementError extends Error {
     readonly status: number;
@@ -28,8 +28,17 @@ export interface PanelManagementOptions {
         repo: string;
     }, ref: string) => Promise<string>;
 }
+/**
+ * Verified reads shared by the snapshots of one multi-project request, so the
+ * same package is not re-verified once per project. Create one per request.
+ */
+export interface PanelSnapshotReads {
+    inspection: PanelAppInspectionReads;
+    digests: Map<string, Promise<string>>;
+}
+export declare function createPanelSnapshotReads(): PanelSnapshotReads;
 export declare function createPanelManagement(options: PanelManagementOptions): {
-    snapshot: (appId?: string) => Promise<PanelSnapshot>;
+    snapshot: (appId?: string, reads?: PanelSnapshotReads) => Promise<PanelSnapshot>;
     packageHistory(context: PanelOperationContext, id: unknown, expected: unknown): Promise<PanelPackageHistory>;
     previewRestore(context: PanelOperationContext, id: unknown, digest: unknown, expected: unknown): Promise<PanelPackageRestoreReview>;
     cancelRestore(context: PanelOperationContext, token: unknown): Promise<{

package/dist/panels/management.js

@@ -3,7 +3,7 @@ import { panelPackageMutationMatches } from "./package-mutation.js";
 import { createHash, randomBytes } from "node:crypto";
 import { lstatSync, mkdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, join, resolve } from "node:path";
-import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, currentPanelAppPackagePins, installedPanelAppUpdatedAt, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
+import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, currentPanelAppPackagePins, installedPanelAppUpdatedAt, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, inspectInstalledPanelAppDigest, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
 import { mutateJsonFile } from "@cjhyy/code-shell-core/internal";
 import { parseGithubUrl } from "@cjhyy/code-shell-core/internal/skills";
 const REVIEW_TTL = 8 * 60_000;
@@ -151,6 +151,9 @@ function assertRevision(revision) {
     if (typeof revision !== "string" || !/^[a-f0-9]{64}$/.test(revision))
         invalid();
 }
+export function createPanelSnapshotReads() {
+    return { inspection: { packages: new Map() }, digests: new Map() };
+}
 export function createPanelManagement(options) {
     const now = options.now ?? Date.now;
     const workspace = resolve(options.bindingCwd ?? options.cwd);
@@ -206,12 +209,17 @@ export function createPanelManagement(options) {
     const listApps = () => options.projectPackages
         ? inspectProjectPanelApps(workspace).then((result) => result.apps)
         : listInstalledPanelApps();
-    async function inspectApp(app) {
+    async function inspectApp(app, reads) {
         const info = lstatSync(app.installPath);
         if (info.isSymbolicLink() || !info.isDirectory())
             throw new PanelManagementError(403, "unsafe_path", "面板安装目录不支持链接。");
-        const preview = await previewLocalPanelApp({ kind: "dir", path: app.installPath });
-        return { app, digest: preview.reviewToken };
+        // Same digest a dir preview reports, without re-hashing unchanged installed bytes.
+        let digest = reads?.digests.get(app.installPath);
+        if (!digest) {
+            digest = inspectInstalledPanelAppDigest(app.installPath);
+            reads?.digests.set(app.installPath, digest);
+        }
+        return { app, digest: await digest };
     }
     async function selectedApp(id) {
         const app = (await listApps()).find((item) => item.id === id);
@@ -240,12 +248,12 @@ export function createPanelManagement(options) {
             commit: SHA.test(parsed.source.ref ?? "") ? parsed.source.ref : "",
         };
     }
-    async function snapshot(appId) {
+    async function snapshot(appId, reads) {
         if (appId !== undefined)
             assertSafePanelAppId(appId);
         options.assertBinding?.();
         const inspected = options.projectPackages
-            ? await inspectProjectPanelApps(workspace, appId)
+            ? await inspectProjectPanelApps(workspace, appId, reads?.inspection)
             : undefined;
         const apps = inspected?.apps ?? (await listInstalledPanelApps(appId));
         options.assertBinding?.();
@@ -268,7 +276,7 @@ export function createPanelManagement(options) {
                 .digest("hex"),
         }));
         for (const listed of apps) {
-            const { app, digest } = await inspectApp(listed);
+            const { app, digest } = await inspectApp(listed, reads);
             const source = savedSource(app, saved);
             const { installPath: _path, source: _source, installedAt: _installedAt, lastUpdated: _lastUpdated, ...publicApp } = app;
             const support = compatibility(app);

package/dist/panels/resources/library.js

@@ -125,8 +125,15 @@ export class ResourceLibrary {
     async importFile(scope, sourcePath, options = {}) {
         const verify = async () => {
             options.signal?.throwIfAborted();
-            await this.authorize(scope);
-            await options.assertAuthorized?.();
+            // Both checks must complete before any source read or publication. They
+            // are independent; a captured directory may itself recheck the same scope.
+            const checks = await Promise.allSettled([
+                this.authorize(scope),
+                Promise.resolve().then(() => options.assertAuthorized?.()),
+            ]);
+            for (const check of checks)
+                if (check.status === "rejected")
+                    throw check.reason;
             options.signal?.throwIfAborted();
         };
         await verify();
@@ -400,7 +407,14 @@ export class ResourceLibrary {
             if (!info.isFile() || info.size !== asset.bytes)
                 throw new Error("Stored media content changed");
             await this.authorize(scope);
-            return { status, headers, body: handle.createReadStream({ ...bounds, autoClose: true }) };
+            return {
+                status,
+                headers,
+                // Bulk readers authorize every delivered block. Bound read-ahead to
+                // 1 MiB so large downloads and integrity rechecks do not repeat a full
+                // project/package inspection for each default 64 KiB filesystem read.
+                body: handle.createReadStream({ ...bounds, autoClose: true, highWaterMark: 1024 * 1024 }),
+            };
         }
         catch (error) {
             await handle.close();

package/dist/panels/runtime.js

@@ -1606,7 +1606,7 @@ export function createPanelRuntime(options) {
                 error(400, "不支持这个服务端目录。");
             if (method === "filesystem.pickDirectory" &&
                 !(await confirm(grant, "使用服务端下载目录？", directory)))
-                return null;
+                return { cancelled: true };
             await options.authorizePanelDirectory?.(grant.app, options.bindingCwd ?? options.cwd, options.cwd);
             if (name !== "project")
                 await mkdir(directory, { recursive: true, mode: 0o700 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.49",
+  "version": "0.9.51",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,14 +62,14 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.49",
-    "@cjhyy/code-shell-core": "0.9.49",
-    "@cjhyy/code-shell-web": "0.9.49",
+    "@cjhyy/code-shell-capability-coding": "0.9.51",
+    "@cjhyy/code-shell-core": "0.9.51",
+    "@cjhyy/code-shell-web": "0.9.51",
     "@modelcontextprotocol/sdk": "^1.31.0",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0",
-    "@cjhyy/code-shell-link": "0.9.49",
-    "@cjhyy/code-shell-host": "0.9.49"
+    "@cjhyy/code-shell-link": "0.9.51",
+    "@cjhyy/code-shell-host": "0.9.51"
   },
   "engines": {
     "node": ">=20.10"