@cjhyy/code-shell-server 0.9.51 → 0.10.1

package/dist/mobile-remote/mobile-chat-turn.js

@@ -44,6 +44,9 @@ export async function dispatchMobileChatTurn(input) {
         id: input.runId,
         params: {
             task: text,
+            ...(input.model ? { model: input.model } : {}),
+            ...(input.configuredModel ? { configuredModel: { ...input.configuredModel } } : {}),
+            ...(input.workspaceProfile ? { workspaceProfile: input.workspaceProfile } : {}),
             ...(input.modelTraceSource && /^panel:[a-z][a-z0-9-]{0,63}$/.test(input.modelTraceSource)
                 ? { modelTraceSource: input.modelTraceSource }
                 : {}),

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -28,8 +28,14 @@ export function parseMobileClientEvent(value) {
             break;
         case "chat.send":
             valid =
-                optionalMember(event.permissionMode, PERMISSION_MODES) &&
+                event.configuredModel === undefined &&
+                    event.model === undefined &&
+                    optionalMember(event.permissionMode, PERMISSION_MODES) &&
                     boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
+                    (event.nativeConnectionId === undefined ||
+                        (boundedTrimmedString(event.nativeConnectionId, MAX_ID_LENGTH) &&
+                            !/[\r\n\0]/.test(event.nativeConnectionId))) &&
+                    !(event.modelKey !== undefined && event.nativeConnectionId !== undefined) &&
                     (event.modelKey === undefined ||
                         (boundedString(event.modelKey, MAX_ID_LENGTH) &&
                             /^(codex|claude-code)\/[^\r\n\0]*$/.test(event.modelKey))) &&
@@ -38,6 +44,7 @@ export function parseMobileClientEvent(value) {
                         (typeof event.modelTraceSource === "string" &&
                             /^panel:[a-z][a-z0-9-]{0,63}$/.test(event.modelTraceSource))) &&
                     optionalBoundedString(event.clientMessageId, MAX_ID_LENGTH) &&
+                    optionalQueueFlag(event.queue) &&
                     optionalAttachments(event.attachments);
             break;
         case "attachment.upload.begin":
@@ -131,6 +138,14 @@ export function parseMobileClientEvent(value) {
                     optionalMember(event.scope, SCOPES) &&
                     optionalMember(event.pathScope, PATH_SCOPES);
             break;
+        case "approval.keepWaiting":
+            valid =
+                boundedString(event.approvalId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.connectionId, MAX_ID_LENGTH) &&
+                    (event.generation === undefined ||
+                        (Number.isSafeInteger(event.generation) && event.generation >= 0));
+            break;
         case "session.list":
             valid =
                 optionalBoundedString(event.requestId, 128) &&
@@ -190,8 +205,23 @@ export function parseMobileClientEvent(value) {
                 boundedString(event.roomId, MAX_ID_LENGTH) &&
                     boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
                     optionalBoundedString(event.clientMessageId, MAX_ID_LENGTH) &&
+                    optionalQueueFlag(event.queue) &&
                     optionalAttachments(event.attachments);
             break;
+        case "queue.sync":
+        case "queue.clear":
+        case "queue.resume":
+            valid =
+                queueTarget(event.target) &&
+                    Object.keys(event).every((key) => key === "type" || key === "target");
+            break;
+        case "queue.cancel":
+        case "queue.retry":
+            valid =
+                queueTarget(event.target) &&
+                    boundedString(event.entryId, MAX_ID_LENGTH) &&
+                    Object.keys(event).every((key) => ["type", "target", "entryId"].includes(key));
+            break;
         case "room.history":
             valid =
                 boundedString(event.roomId, MAX_ID_LENGTH) &&
@@ -221,7 +251,8 @@ export function parseMobileClientEvent(value) {
                 boundedString(event.sessionId, MAX_ID_LENGTH) &&
                     boundedPath(event.cwd) &&
                     member(event.mode, PERMISSION_MODES) &&
-                    optionalMember(event.kind, KINDS);
+                    optionalMember(event.kind, KINDS) &&
+                    optionalBoundedString(event.requestId, MAX_ID_LENGTH);
             break;
         case "ccRoom.subscribeTranscript":
             valid =
@@ -291,6 +322,20 @@ function optionalPositiveInteger(value) {
 function isBoundedHistoryLimit(value) {
     return isPositiveInteger(value) && value <= MAX_HISTORY_LIMIT;
 }
+function optionalQueueFlag(value) {
+    return value === undefined || value === true;
+}
+function queueTarget(value) {
+    if (!isRecord(value))
+        return false;
+    const keys = Object.keys(value);
+    if (value.kind === "session")
+        return (boundedTrimmedString(value.sessionId, MAX_ID_LENGTH) &&
+            keys.every((key) => key === "kind" || key === "sessionId"));
+    return (value.kind === "room" &&
+        boundedTrimmedString(value.roomId, MAX_ID_LENGTH) &&
+        keys.every((key) => key === "kind" || key === "roomId"));
+}
 function optionalAttachments(value) {
     return (value === undefined ||
         (Array.isArray(value) && value.length <= MAX_MOBILE_ATTACHMENTS && value.every(isAttachment)));

package/dist/mobile-remote/mobile-upload-service.d.ts

@@ -3,6 +3,8 @@ import type { MobileImageBase } from "./types.js";
 export { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export declare const MOBILE_UPLOAD_TTL_MS: number;
 export declare const MAX_MOBILE_UPLOAD_TICKETS_PER_DEVICE = 16;
+/** Upper bound for an image waiting behind a long turn in the Host FIFO. */
+export declare const MOBILE_UPLOAD_QUEUE_RETENTION_MS: number;
 export declare const MAX_MOBILE_UPLOAD_CLAIM_ATTEMPTS = 3;
 export interface MobileUploadServiceOptions {
     rootDir: string;
@@ -43,6 +45,13 @@ export declare class MobileUploadService {
     private receivePut;
     /** Atomically move a ready upload into a request-owned lease. */
     claim(deviceId: string, uploadId: string): ClaimedMobileUpload;
+    /**
+     * Keep a ready upload alive for a Host-queued turn that has not run yet. The
+     * extension is bounded; the per-device ticket cap still limits retained files.
+     */
+    retain(deviceId: string, uploadId: string, durationMs?: number): void;
+    /** Drop an unclaimed upload of a cancelled queued turn immediately. */
+    discard(deviceId: string, uploadId: string): Promise<void>;
     /** Release a failed staging/dispatch attempt for a bounded retry. */
     release(deviceId: string, uploadId: string, claimId: string): Promise<void>;
     /** Finalize a successful turn; only the active claim owner may consume it. */

package/dist/mobile-remote/mobile-upload-service.js

@@ -8,6 +8,8 @@ import { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export const MOBILE_UPLOAD_TTL_MS = 5 * 60 * 1000;
 export const MAX_MOBILE_UPLOAD_TICKETS_PER_DEVICE = 16;
+/** Upper bound for an image waiting behind a long turn in the Host FIFO. */
+export const MOBILE_UPLOAD_QUEUE_RETENTION_MS = 12 * 60 * 60 * 1000;
 export const MAX_MOBILE_UPLOAD_CLAIM_ATTEMPTS = 3;
 const IMAGE_MIMES = new Set([
     "image/png",
@@ -286,6 +288,29 @@ export class MobileUploadService {
             sha256: record.sha256,
         };
     }
+    /**
+     * Keep a ready upload alive for a Host-queued turn that has not run yet. The
+     * extension is bounded; the per-device ticket cap still limits retained files.
+     */
+    retain(deviceId, uploadId, durationMs = MOBILE_UPLOAD_QUEUE_RETENTION_MS) {
+        if (this.revokedDevices.has(deviceId))
+            throw new Error("upload device was revoked");
+        const record = this.uploads.get(uploadId);
+        if (!record || record.expiresAt <= this.now() || record.deviceId !== deviceId)
+            throw new Error("upload is not ready or no longer exists");
+        if (record.status !== "ready")
+            throw new Error("upload is already claimed or not ready");
+        const until = this.now() + Math.min(durationMs, MOBILE_UPLOAD_QUEUE_RETENTION_MS);
+        if (until > record.expiresAt)
+            record.expiresAt = until;
+    }
+    /** Drop an unclaimed upload of a cancelled queued turn immediately. */
+    async discard(deviceId, uploadId) {
+        const record = this.uploads.get(uploadId);
+        if (!record || record.deviceId !== deviceId || record.status === "claimed")
+            return;
+        await this.expire(uploadId, record);
+    }
     /** Release a failed staging/dispatch attempt for a bounded retry. */
     async release(deviceId, uploadId, claimId) {
         const record = this.assertClaimOwner(deviceId, uploadId, claimId);

package/dist/mobile-remote/remote-host-manager.d.ts

@@ -6,6 +6,7 @@ import type { MobileServerEvent } from "./types.js";
 import type { MobileUploadService } from "./mobile-upload-service.js";
 import type { DesktopWebHttpApi } from "../desktop-web/http-api.js";
 import type { RelayLocalTarget } from "../remote-relay/connector.js";
+import { type AccountRelayAccessProvider } from "./account-relay-access.js";
 /**
  * Pick the Mac's real LAN IPv4 so a phone on the same Wi-Fi can reach the
  * remote host. We bind to a concrete LAN address (NOT 0.0.0.0) per the design's
@@ -22,11 +23,11 @@ export interface RemoteHostStartOptions {
      * "lan" (default) keeps the existing LAN behaviour unchanged. "tunnel" binds
      * 127.0.0.1 (cloudflared connects to loopback) and inserts a passcode gate in
      * front of ordinary HTTP routes and the WS upgrade. Host-verified Panel asset
-     * capabilities use their own short-lived authorization. "relay" also requires an
-     * initialized passcode and a stable HTTPS origin before pairing/WS upgrades.
+     * capabilities use their own short-lived authorization. "relay" requires a
+     * passcode or main-owned account handoff provider and a stable HTTPS origin.
      */
     mode?: "lan" | "tunnel" | "relay";
-    /** Required and initialized in relay mode; public gate for tunnel mode too. */
+    /** Public passcode gate; account handoffs may independently authorize relay mode. */
     passcode?: AccessPasscode;
 }
 export interface RemoteHostStarted {
@@ -44,6 +45,10 @@ export interface RemoteHostManagerOptions {
     outputJournalPageFrames?: 2048;
     /** Selected-session Host implements verified display views and bounded detail parts. */
     historyView?: boolean;
+    /** The attached command Host resolves native text connections per authorized Session. */
+    nativeModelSelection?: boolean;
+    /** The attached command Host owns a pending-turn FIFO (queue.* events, chat.queued). */
+    turnQueue?: boolean;
     onClientEvent: (event: unknown, ws: WebSocket) => void | Promise<void>;
     /**
      * Absolute path to the built mobile app (out/mobile). Defaults to the
@@ -83,11 +88,23 @@ export declare class RemoteHostManager extends EventEmitter {
     private passcode?;
     private socketAccessValidity;
     private accessSweep?;
+    private readonly accountAccess;
+    private accountSocketDevices;
     /** Where the built mobile app lives (out/mobile). */
     private readonly mobileRootDir;
     /** Dev proxy target for /mobile (HMR); undefined in prod. */
     private readonly mobileDevUrl?;
+    private turnQueueEnabled;
     constructor(opts: RemoteHostManagerOptions);
+    /** Install main-owned directory redemption; replacing it synchronously revokes old sessions. */
+    setAccountRelayAccess(provider?: AccountRelayAccessProvider): void;
+    /** The attached command Host installed a pending-turn FIFO; advertise it on (re)auth. */
+    advertiseTurnQueue(): void;
+    /** A paired (or live account) device that has not been revoked or removed. */
+    isTrustedDevice(deviceId: string): boolean;
+    private get turnQueueAdvertised();
+    private relayRequestOrigin;
+    private relayJson;
     /** Device ids with at least one live socket right now. */
     onlineDeviceIds(): string[];
     /** Register a live socket for a device; emits `online-change` only when the
@@ -118,7 +135,7 @@ export declare class RemoteHostManager extends EventEmitter {
      * trusted-device store (which rejects revoked devices), so the remote host
      * never executes tools itself — it only gates transport.
      */
-    handleClientEvent(input: unknown): MobileServerEvent | undefined;
+    handleClientEvent(input: unknown, accountDeviceId?: string): MobileServerEvent | undefined;
     /** Broadcast a server event to every connected, authenticated mobile socket. */
     broadcast(event: MobileServerEvent): void;
     /** Send a server event to ONLY the sockets belonging to one device. Used for

package/dist/mobile-remote/remote-host-manager.js

@@ -1,3 +1,4 @@
+import { stampApprovalClock } from "./approval-clock.js";
 import { createServer } from "node:http";
 import { networkInterfaces } from "node:os";
 import { EventEmitter } from "node:events";
@@ -8,6 +9,7 @@ import { serveMobile } from "./mobile-static.js";
 import { PairingTokenManager } from "./pairing.js";
 import { parseMobileClientEvent } from "./mobile-client-event-validator.js";
 import { isRelayOrigin } from "../remote-relay/protocol.js";
+import { AccountRelayAccessGate, readRelayHandoff, } from "./account-relay-access.js";
 /** Outbound bytes one paired socket may leave unread before it is retired. */
 const MAX_SOCKET_BACKLOG_BYTES = 4 * 1024 * 1024;
 /** The query suffix ("" or "?…") when the raw request target is exactly the
@@ -69,18 +71,62 @@ export class RemoteHostManager extends EventEmitter {
     passcode;
     socketAccessValidity = new WeakMap();
     accessSweep;
+    accountAccess;
+    accountSocketDevices = new WeakMap();
     /** Where the built mobile app lives (out/mobile). */
     mobileRootDir;
     /** Dev proxy target for /mobile (HMR); undefined in prod. */
     mobileDevUrl;
+    turnQueueEnabled = false;
     constructor(opts) {
         super();
         this.opts = opts;
+        this.accountAccess = new AccountRelayAccessGate(opts.devices, (id) => this.revokeDevice(id));
         // Bundled main is out/main/index.mjs → mobile app is the sibling out/mobile.
         const here = dirname(fileURLToPath(import.meta.url));
         this.mobileRootDir = opts.mobileRootDir ?? resolve(here, "../mobile");
         this.mobileDevUrl = opts.mobileDevUrl ?? process.env.MOBILE_DEV_URL;
     }
+    /** Install main-owned directory redemption; replacing it synchronously revokes old sessions. */
+    setAccountRelayAccess(provider) {
+        this.accountAccess.setProvider(provider);
+    }
+    /** The attached command Host installed a pending-turn FIFO; advertise it on (re)auth. */
+    advertiseTurnQueue() {
+        this.turnQueueEnabled = true;
+    }
+    /** A paired (or live account) device that has not been revoked or removed. */
+    isTrustedDevice(deviceId) {
+        try {
+            return this.opts.devices
+                .listDevices()
+                .some((device) => device.id === deviceId && !device.revokedAt);
+        }
+        catch {
+            // An unreadable store proves nothing; fail closed.
+            return false;
+        }
+    }
+    get turnQueueAdvertised() {
+        return this.turnQueueEnabled || this.opts.turnQueue === true;
+    }
+    relayRequestOrigin(request, requireOrigin = false) {
+        return !!(this.publicBaseUrl &&
+            request.headers.host === new URL(this.publicBaseUrl).host &&
+            (request.headers.origin === this.publicBaseUrl ||
+                (!requireOrigin && request.headers.origin === undefined)) &&
+            request.headers["sec-fetch-site"] !== "cross-site");
+    }
+    relayJson(response, status, body) {
+        if (response.writableEnded || response.destroyed)
+            return;
+        response.writeHead(status, {
+            "content-type": "application/json; charset=utf-8",
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff",
+        });
+        response.end(JSON.stringify(body));
+    }
     /** Device ids with at least one live socket right now. */
     onlineDeviceIds() {
         return [...this.onlineCounts.keys()];
@@ -129,11 +175,13 @@ export class RemoteHostManager extends EventEmitter {
     async startOnce(options) {
         const relay = options.mode === "relay";
         const publicAccess = relay || options.mode === "tunnel";
-        if (publicAccess && !options.passcode?.isSet()) {
+        if (publicAccess && !options.passcode?.isSet() && !(relay && this.accountAccess.available)) {
             throw new Error(`${relay ? "Relay" : "Tunnel"} mode requires an initialized access passcode`);
         }
         if (relay)
             this.publicBaseUrl = undefined;
+        // Keep the gate object even when account auto-start precedes passcode setup.
+        // Its current configuration is consulted for each HTTP/WS admission.
         this.passcode = publicAccess ? options.passcode : undefined;
         const gate = this.passcode;
         this.opts.webApi?.start();
@@ -148,11 +196,47 @@ export class RemoteHostManager extends EventEmitter {
                 req.resume();
                 return;
             }
+            if (relay && pathname === "/api/v1/relay/session") {
+                if (req.method !== "POST" ||
+                    !this.accountAccess.available ||
+                    !this.relayRequestOrigin(req, true)) {
+                    this.relayJson(res, 403, { error: "Account relay session is unavailable" });
+                    req.resume();
+                    return;
+                }
+                const lifetime = this.relayLifetime;
+                void readRelayHandoff(req)
+                    .then((handoff) => {
+                    if (!lifetime || lifetime.signal.aborted || lifetime !== this.relayLifetime)
+                        throw new Error("Relay Host stopped");
+                    return this.accountAccess.exchange(handoff);
+                })
+                    .then((session) => this.relayJson(res, 200, session))
+                    .catch(() => this.relayJson(res, 401, { error: "Account relay handoff expired or invalid" }));
+                return;
+            }
             const serve = () => {
                 // All ordinary routes retain the tunnel passcode gate. Only a Host-verified
                 // short-lived Panel asset capability may use independent authorization.
-                if (gate && !gate.gate(req, res))
+                const account = relay && this.relayRequestOrigin(req) ? this.accountAccess.capture(req) : undefined;
+                if (!account) {
+                    if (relay && (req.headers["x-codeshell-host-access"] !== undefined || !gate?.isSet())) {
+                        this.relayJson(res, 401, { error: "Account relay authorization is required" });
+                        req.resume();
+                        return;
+                    }
+                    if (gate && !gate.gate(req, res))
+                        return;
+                }
+                if (relay && pathname === "/api/v1/relay/projects") {
+                    if (req.method !== "GET" || !account) {
+                        this.relayJson(res, 401, { error: "Account relay authorization is required" });
+                        req.resume();
+                        return;
+                    }
+                    void this.accountAccess.projects(account).then((projects) => this.relayJson(res, 200, projects), () => this.relayJson(res, 401, { error: "Account relay authorization expired" }));
                     return;
+                }
                 if (req.url === "/health") {
                     res.writeHead(200, { "content-type": "application/json" });
                     res.end(JSON.stringify({ ok: true }));
@@ -166,7 +250,11 @@ export class RemoteHostManager extends EventEmitter {
                         return;
                     }
                     void this.opts.webApi
-                        .handle(req, res, { baseUrl, isAccessAuthorized: gate?.captureValidity() })
+                        .handle(req, res, {
+                        baseUrl,
+                        isAccessAuthorized: account?.isAuthorized ?? gate?.captureValidity(),
+                        ...(account ? { accessDeviceId: account.deviceId } : {}),
+                    })
                         .then((handled) => {
                         if (!handled && !res.writableEnded) {
                             res.writeHead(404);
@@ -234,13 +322,13 @@ export class RemoteHostManager extends EventEmitter {
         // In tunnel mode we must gate the WS handshake too. `noServer` lets us run
         // the passcode check during the HTTP `upgrade` event before completing the
         // handshake; in lan mode behaviour is unchanged (the same path/server bind).
-        this.wss = gate
+        this.wss = publicAccess
             ? new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 })
             : new WebSocketServer({ server, path: "/ws", maxPayload: 1024 * 1024 });
         // ws re-emits its HTTP server's bind errors. Without an error listener a
         // handled EADDRINUSE rejection still becomes an uncaught EventEmitter error.
         this.wss.on("error", (error) => this.emit("host-error", error));
-        if (gate) {
+        if (publicAccess) {
             server.on("upgrade", (req, socket, head) => {
                 let isWebSocketPath = false;
                 try {
@@ -253,21 +341,23 @@ export class RemoteHostManager extends EventEmitter {
                     socket.destroy();
                     return;
                 }
-                if (relay &&
-                    (!this.publicBaseUrl ||
-                        req.headers.origin !== this.publicBaseUrl ||
-                        req.headers.host !== new URL(this.publicBaseUrl).host)) {
+                if (relay && !this.relayRequestOrigin(req, true)) {
                     socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
                     return;
                 }
-                if (!gate.allows(req)) {
+                const account = relay ? this.accountAccess.capture(req) : undefined;
+                if (!account &&
+                    ((relay && req.headers["x-codeshell-host-access"] !== undefined) ||
+                        !gate?.allows(req))) {
                     socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
                     socket.destroy();
                     return;
                 }
-                const isAccessAuthorized = gate.captureValidity();
+                const isAccessAuthorized = account?.isAuthorized ?? gate.captureValidity();
                 this.wss.handleUpgrade(req, socket, head, (ws) => {
                     this.socketAccessValidity.set(ws, isAccessAuthorized);
+                    if (account)
+                        this.accountSocketDevices.set(ws, account.deviceId);
                     this.wss.emit("connection", ws, req);
                 });
             });
@@ -298,12 +388,19 @@ export class RemoteHostManager extends EventEmitter {
                     this.sendBounded(ws, JSON.stringify({ type: "error", message: "Invalid client event" }));
                     return;
                 }
+                const accountDevice = this.accountSocketDevices.get(ws);
+                if (accountDevice &&
+                    (event.type === "pair.complete" ||
+                        (event.type === "auth.device" && event.deviceId !== accountDevice))) {
+                    this.sendBounded(ws, JSON.stringify({ type: "auth.failed", message: "Account device mismatch" }));
+                    return;
+                }
                 // Pairing/auth are handled inline and bind device identity to this
                 // socket. Everything else is gated: an unauthenticated socket cannot
                 // send chat/approval/run/job events (design §6.1).
                 let reply;
                 try {
-                    reply = this.handleClientEvent(event);
+                    reply = this.handleClientEvent(event, accountDevice);
                 }
                 catch {
                     this.sendBounded(ws, JSON.stringify({ type: "error", message: "Client event failed" }));
@@ -390,7 +487,7 @@ export class RemoteHostManager extends EventEmitter {
             url: `http://${bindHost}:${port}`,
             mode: options.mode ?? "lan",
         };
-        if (gate) {
+        if (publicAccess) {
             const sockets = this.wss;
             // Idle public tabs must also relinquish viewer-owned state after rotation.
             // Traffic is checked synchronously in both directions, without rehashing
@@ -453,7 +550,7 @@ export class RemoteHostManager extends EventEmitter {
      * trusted-device store (which rejects revoked devices), so the remote host
      * never executes tools itself — it only gates transport.
      */
-    handleClientEvent(input) {
+    handleClientEvent(input, accountDeviceId) {
         const event = parseMobileClientEvent(input);
         if (!event)
             return { type: "error", message: "Invalid client event" };
@@ -474,13 +571,19 @@ export class RemoteHostManager extends EventEmitter {
             return {
                 type: "pair.ok",
                 device,
-                ...(this.opts.outputJournal
+                ...(this.opts.outputJournal || this.opts.nativeModelSelection || this.turnQueueAdvertised
                     ? {
                         capabilities: {
-                            outputJournal: 1,
-                            ...(this.opts.historyView ? { historyView: 1 } : {}),
-                            ...(this.opts.legacyBasePages ? { legacyBasePages: 1 } : {}),
-                            ...(this.opts.outputJournalPageFrames === 2048
+                            ...(this.opts.outputJournal ? { outputJournal: 1 } : {}),
+                            ...(this.opts.nativeModelSelection ? { nativeModelSelection: 1 } : {}),
+                            ...(this.turnQueueAdvertised ? { turnQueue: 1 } : {}),
+                            ...(this.opts.outputJournal && this.opts.historyView
+                                ? { historyView: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.legacyBasePages
+                                ? { legacyBasePages: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.outputJournalPageFrames === 2048
                                 ? { outputJournalPageFrames: 2048 }
                                 : {}),
                         },
@@ -489,6 +592,8 @@ export class RemoteHostManager extends EventEmitter {
             };
         }
         if (event.type === "auth.device") {
+            if (this.opts.devices.isEphemeralDevice(event.deviceId) && event.deviceId !== accountDeviceId)
+                return { type: "auth.failed", message: "Account device requires its Host access grant" };
             let device;
             try {
                 device = this.opts.devices.authenticate(event.deviceId, event.secretHash);
@@ -501,13 +606,19 @@ export class RemoteHostManager extends EventEmitter {
             return {
                 type: "auth.ok",
                 device,
-                ...(this.opts.outputJournal
+                ...(this.opts.outputJournal || this.opts.nativeModelSelection || this.turnQueueAdvertised
                     ? {
                         capabilities: {
-                            outputJournal: 1,
-                            ...(this.opts.historyView ? { historyView: 1 } : {}),
-                            ...(this.opts.legacyBasePages ? { legacyBasePages: 1 } : {}),
-                            ...(this.opts.outputJournalPageFrames === 2048
+                            ...(this.opts.outputJournal ? { outputJournal: 1 } : {}),
+                            ...(this.opts.nativeModelSelection ? { nativeModelSelection: 1 } : {}),
+                            ...(this.turnQueueAdvertised ? { turnQueue: 1 } : {}),
+                            ...(this.opts.outputJournal && this.opts.historyView
+                                ? { historyView: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.legacyBasePages
+                                ? { legacyBasePages: 1 }
+                                : {}),
+                            ...(this.opts.outputJournal && this.opts.outputJournalPageFrames === 2048
                                 ? { outputJournalPageFrames: 2048 }
                                 : {}),
                         },
@@ -548,6 +659,7 @@ export class RemoteHostManager extends EventEmitter {
     }
     /** Preserve the full worker envelope while retaining exact authenticated-tab routing. */
     sendRawToViewer(viewerId, payload) {
+        payload = stampApprovalClock(payload);
         for (const client of this.wss?.clients ?? []) {
             if (client.readyState === client.OPEN &&
                 this.authed.has(client) &&
@@ -561,6 +673,7 @@ export class RemoteHostManager extends EventEmitter {
     }
     /** Send a raw JSON-RPC worker line to ONLY one authenticated device. */
     sendRawToDevice(deviceId, payload) {
+        payload = stampApprovalClock(payload);
         for (const client of this.wss?.clients ?? []) {
             if (client.readyState === client.OPEN && this.authed.get(client) === deviceId) {
                 this.sendBounded(client, payload);
@@ -571,6 +684,7 @@ export class RemoteHostManager extends EventEmitter {
      *  every authenticated mobile socket. Unauthenticated sockets are skipped so
      *  a half-paired client never sees session output. */
     broadcastRaw(payload) {
+        payload = stampApprovalClock(payload);
         for (const client of this.wss?.clients ?? []) {
             if (client.readyState === client.OPEN && this.authed.has(client)) {
                 this.sendBounded(client, payload);
@@ -604,7 +718,7 @@ export class RemoteHostManager extends EventEmitter {
         this.releaseSocket(client);
         // Distinct from paired-device rejection (4401/4403): the browser keeps its
         // identity and offers a fresh HTTP challenge instead of silently retrying.
-        client.close(4407, "Access passcode changed");
+        client.close(4407, "Host access expired");
         const deadline = setTimeout(() => client.terminate(), 1000);
         deadline.unref();
         client.once("close", () => clearTimeout(deadline));
@@ -637,6 +751,8 @@ export class RemoteHostManager extends EventEmitter {
     }
     /** Call after revoking/removing a trusted device to release both transports immediately. */
     revokeDevice(deviceId) {
+        if (this.accountAccess.revokeDevice(deviceId))
+            return;
         void this.opts.uploads?.revokeDevice(deviceId).catch((error) => {
             this.emit("host-error", error instanceof Error ? error.message : String(error));
         });
@@ -652,6 +768,7 @@ export class RemoteHostManager extends EventEmitter {
         // Listeners synchronously fence and destroy outbound sockets before the
         // loopback listener can close or its port can be reused by another Host.
         this.relayLifetime?.abort();
+        this.accountAccess.clear();
         if (this.stopping)
             return this.stopping;
         const attempt = Promise.resolve()

package/dist/mobile-remote/resident-agent.d.ts

@@ -87,7 +87,13 @@ export interface ResidentAgentOptions {
 export declare class ResidentAgentProcess {
     private readonly opts;
     private child?;
+    /** The most recently spawned process, kept after stop() so a caller can
+     * wait for it to actually exit before starting a replacement. */
+    private lastChild?;
+    private spawned?;
     constructor(opts: ResidentAgentOptions);
+    /** Exact argv for one resident process. Pure → unit-testable. */
+    static argsFor(opts: Pick<ResidentAgentOptions, "permissionMode" | "resumeSessionId" | "appendSystemPrompt">): string[];
     start(): void;
     /** Feed one user turn. Returns false if the process isn't running. */
     send(text: string): boolean;
@@ -95,4 +101,12 @@ export declare class ResidentAgentProcess {
     respondControl(requestId: string, decision: ControlDecision): void;
     isRunning(): boolean;
     stop(): void;
+    /** Resolves once the spawned process exists; rejects when the spawn failed. */
+    whenStarted(): Promise<void>;
+    /**
+     * Stop, then resolve true only after the last spawned process has exited.
+     * A process already retired by a pipe error is still waited for: it may be
+     * alive for up to the SIGKILL grace period.
+     */
+    stopAndWait(timeoutMs: number): Promise<boolean>;
 }