@cjhyy/code-shell-server 0.9.52 → 0.10.1

package/dist/headless-worker-env.js

@@ -0,0 +1,15 @@
+/** Desktop host clients that have no IPC peer in a headless worker. */
+const HEADLESS_WORKER_HOST_ENV_KEYS = [
+    "CODE_SHELL_REMOTE_LINK_CLIENT_SECRET",
+    "CODE_SHELL_OPERATION_BATCH_ACCESS",
+    "CODE_SHELL_MODEL_REQUEST_SIGNING",
+    "CODE_SHELL_WORKSPACE_ACCESS",
+    "CODE_SHELL_HOST_MCP_SERVERS",
+];
+/** Preserve the caller's environment while disabling Desktop-only host access. */
+export function headlessWorkerEnv(base, extra = {}) {
+    const env = { ...base };
+    for (const key of HEADLESS_WORKER_HOST_ENV_KEYS)
+        env[key] = undefined;
+    return { ...env, CODE_SHELL_CREDENTIAL_ACCESS: "local", ...extra };
+}

package/dist/hub/approval-lease.js

@@ -9,8 +9,13 @@ export class ApprovalLeases {
         this.now = now;
     }
     add(approval) {
-        if (this.entries.has(approval.requestId))
+        const existing = this.entries.get(approval.requestId);
+        if (existing) {
+            // A republished request (the user kept a question open) replaces its
+            // payload for later snapshots; the holder lease is unchanged.
+            existing.approval = approval;
             return;
+        }
         if (this.entries.size >= 256)
             throw new Error("too many pending approvals");
         this.entries.set(approval.requestId, {

package/dist/hub/run-replay.js

@@ -1,4 +1,4 @@
-import { OutputCoverage } from "@cjhyy/code-shell-web";
+import { OutputCoverage } from "@cjhyy/code-shell-web/output-coverage";
 import { randomUUID } from "node:crypto";
 /**
  * A refresh can happen before the worker persists its current assistant text.

package/dist/hub/session-management.js

@@ -2,7 +2,7 @@ import { SessionFileError, readSessionFileSync, sessionListStorage, } from "@cjh
 import { listSessionEntries } from "@cjhyy/code-shell-core/internal";
 import { join, resolve } from "node:path";
 import { SessionManager } from "@cjhyy/code-shell-core";
-import { replayTranscript, transcriptUserDisplay } from "@cjhyy/code-shell-web";
+import { replayTranscript, transcriptUserDisplay } from "@cjhyy/code-shell-web/transcript-replay";
 import { createSessionTitlesStore, SessionTitleConflictError } from "../session-titles-store.js";
 import { hubJson } from "./uploads.js";
 const ROOT = "/api/v1/sessions";

package/dist/index.account.d.ts

@@ -0,0 +1,12 @@
+/** Optional native account authority. No Electron or renderer dependencies. */
+export * from "./account/types.js";
+export * from "./account/manager.js";
+export * from "./account/http.js";
+export * from "./account/store.js";
+export * from "./account/links.js";
+export * from "./account/profile.js";
+export * from "./account/cloud-contract.js";
+export * from "./account/cloud-types.js";
+export * from "./account/feature-service.js";
+export * from "./account/native-store.js";
+export * from "./account/cli.js";

package/dist/index.account.js

@@ -0,0 +1,12 @@
+/** Optional native account authority. No Electron or renderer dependencies. */
+export * from "./account/types.js";
+export * from "./account/manager.js";
+export * from "./account/http.js";
+export * from "./account/store.js";
+export * from "./account/links.js";
+export * from "./account/profile.js";
+export * from "./account/cloud-contract.js";
+export * from "./account/cloud-types.js";
+export * from "./account/feature-service.js";
+export * from "./account/native-store.js";
+export * from "./account/cli.js";

package/dist/index.mobile-remote.d.ts

@@ -1,5 +1,6 @@
 /** Mobile HTTP/WebSocket transport, rooms, uploads, pairing, and tunnels. */
 export * from "./mobile-remote/access-passcode.js";
+export type { AccountRelayAccessProvider, AccountRelayBinding, AccountRelayProject, } from "./mobile-remote/account-relay-access.js";
 export * from "./mobile-remote/cloudflared-binary.js";
 export * from "./mobile-remote/codex-parse.js";
 export * from "./mobile-remote/codex-room-agent.js";
@@ -17,5 +18,6 @@ export * from "./mobile-remote/resident-agent.js";
 export * from "./mobile-remote/room-manager.js";
 export * from "./mobile-remote/trusted-device-store.js";
 export * from "./mobile-remote/tunnel-manager.js";
+export * from "./mobile-remote/turn-queue.js";
 export * from "./mobile-remote/types.js";
 export * from "./mobile-remote/viewer-identity.js";

package/dist/index.mobile-remote.js

@@ -17,5 +17,6 @@ export * from "./mobile-remote/resident-agent.js";
 export * from "./mobile-remote/room-manager.js";
 export * from "./mobile-remote/trusted-device-store.js";
 export * from "./mobile-remote/tunnel-manager.js";
+export * from "./mobile-remote/turn-queue.js";
 export * from "./mobile-remote/types.js";
 export * from "./mobile-remote/viewer-identity.js";

package/dist/index.worker.d.ts

@@ -1,2 +1,3 @@
 /** Transport-agnostic stdio worker bridge for Node hosts. */
 export * from "./worker-bridge-core.js";
+export { headlessWorkerEnv } from "./headless-worker-env.js";

package/dist/index.worker.js

@@ -1,2 +1,3 @@
 /** Transport-agnostic stdio worker bridge for Node hosts. */
 export * from "./worker-bridge-core.js";
+export { headlessWorkerEnv } from "./headless-worker-env.js";

package/dist/mobile-remote/account-relay-access.d.ts

@@ -0,0 +1,59 @@
+import type { IncomingMessage } from "node:http";
+import type { TrustedDeviceStore } from "./trusted-device-store.js";
+export interface AccountRelayBinding {
+    authorizationId: string;
+    accountId: string;
+    rootSessionId: string;
+    hostId: string;
+    environmentId: string;
+    leaseId: string;
+    expiresAt: number;
+}
+export interface AccountRelayProject {
+    id: string;
+    name: string;
+    path: string;
+}
+/** Main owns device credentials and redeems only against its configured directory. */
+export interface AccountRelayAccessProvider {
+    hostId: string;
+    environmentId: string;
+    accountId?: string;
+    redeem: (handoff: string) => Promise<AccountRelayBinding>;
+    listProjects: () => Promise<AccountRelayProject[]>;
+}
+export interface CapturedAccountRelayAccess {
+    deviceId: string;
+    isAuthorized: () => boolean;
+}
+/** Independent entrance gate; an account credential is never a Host credential. */
+export declare class AccountRelayAccessGate {
+    private readonly devices;
+    private readonly onRevoke;
+    private provider?;
+    private readonly grants;
+    private readonly consumed;
+    private readonly pending;
+    private generation;
+    constructor(devices: TrustedDeviceStore, onRevoke: (deviceId: string) => void);
+    setProvider(provider?: AccountRelayAccessProvider): void;
+    get available(): boolean;
+    clear(): void;
+    revokeDevice(deviceId: string): boolean;
+    private retire;
+    exchange(handoff: string): Promise<{
+        hostAccessToken: string;
+        deviceId: string;
+        secretHash: string;
+        expiresAt: number;
+        hostId: string;
+        environmentId: string;
+    }>;
+    capture(request: IncomingMessage): CapturedAccountRelayAccess | undefined;
+    projects(access: CapturedAccountRelayAccess): Promise<{
+        hostId: string;
+        environmentId: string;
+        projects: AccountRelayProject[];
+    }>;
+}
+export declare function readRelayHandoff(request: IncomingMessage): Promise<string>;

package/dist/mobile-remote/account-relay-access.js

@@ -0,0 +1,174 @@
+import { createHash, randomBytes } from "node:crypto";
+/** Independent entrance gate; an account credential is never a Host credential. */
+export class AccountRelayAccessGate {
+    devices;
+    onRevoke;
+    provider;
+    grants = new Map();
+    consumed = new Map();
+    pending = new Set();
+    generation = 0;
+    constructor(devices, onRevoke) {
+        this.devices = devices;
+        this.onRevoke = onRevoke;
+    }
+    setProvider(provider) {
+        this.clear();
+        this.provider = provider;
+    }
+    get available() {
+        return !!this.provider;
+    }
+    clear() {
+        this.generation++;
+        for (const token of this.grants.keys())
+            this.retire(token);
+        this.consumed.clear();
+        this.pending.clear();
+    }
+    revokeDevice(deviceId) {
+        let revoked = false;
+        for (const [token, grant] of this.grants)
+            if (grant.deviceId === deviceId) {
+                this.retire(token);
+                revoked = true;
+            }
+        return revoked;
+    }
+    retire(token) {
+        const grant = this.grants.get(token);
+        if (!grant)
+            return;
+        this.grants.delete(token);
+        clearTimeout(grant.timer);
+        this.devices.removeEphemeralDevice(grant.deviceId);
+        this.onRevoke(grant.deviceId);
+    }
+    async exchange(handoff) {
+        const provider = this.provider;
+        const generation = this.generation;
+        const digest = createHash("sha256").update(handoff).digest("hex");
+        for (const [key, expiresAt] of this.consumed)
+            if (expiresAt <= Date.now())
+                this.consumed.delete(key);
+        if (!provider ||
+            this.grants.size + this.pending.size >= 128 ||
+            this.pending.has(digest) ||
+            this.consumed.has(digest))
+            throw new Error("Account relay handoff is unavailable");
+        this.pending.add(digest);
+        try {
+            const binding = await provider.redeem(handoff);
+            const now = Date.now();
+            if (this.provider !== provider ||
+                this.generation !== generation ||
+                !binding ||
+                typeof binding !== "object" ||
+                ![
+                    binding.authorizationId,
+                    binding.accountId,
+                    binding.rootSessionId,
+                    binding.hostId,
+                    binding.environmentId,
+                    binding.leaseId,
+                ].every((value) => typeof value === "string" &&
+                    value.length > 0 &&
+                    value.length <= 512 &&
+                    !value.includes("\0")) ||
+                binding.hostId !== provider.hostId ||
+                binding.environmentId !== provider.environmentId ||
+                (provider.accountId !== undefined && binding.accountId !== provider.accountId) ||
+                !Number.isSafeInteger(binding.expiresAt) ||
+                binding.expiresAt <= now ||
+                binding.expiresAt > now + 10 * 60_000)
+                throw new Error("Account relay handoff target is invalid");
+            this.consumed.set(digest, binding.expiresAt);
+            const hostAccessToken = randomBytes(32).toString("base64url");
+            const secretHash = randomBytes(32).toString("base64url");
+            const device = this.devices.addEphemeralDevice({
+                name: "Account device session",
+                secretHash,
+                expiresAt: binding.expiresAt,
+            });
+            const timer = setTimeout(() => this.retire(hostAccessToken), binding.expiresAt - now);
+            timer.unref();
+            this.grants.set(hostAccessToken, {
+                provider,
+                deviceId: device.id,
+                expiresAt: binding.expiresAt,
+                timer,
+            });
+            return {
+                hostAccessToken,
+                deviceId: device.id,
+                secretHash,
+                expiresAt: binding.expiresAt,
+                hostId: binding.hostId,
+                environmentId: binding.environmentId,
+            };
+        }
+        finally {
+            // A retired generation cannot release a newer redemption of the same handoff.
+            if (this.generation === generation)
+                this.pending.delete(digest);
+        }
+    }
+    capture(request) {
+        const token = request.headers["x-codeshell-host-access"];
+        if (typeof token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(token))
+            return;
+        const grant = this.grants.get(token);
+        if (!grant)
+            return;
+        const isAuthorized = () => this.provider === grant.provider &&
+            this.grants.get(token) === grant &&
+            this.devices.isEphemeralDevice(grant.deviceId) &&
+            grant.expiresAt > Date.now();
+        if (!isAuthorized()) {
+            this.retire(token);
+            return;
+        }
+        return { deviceId: grant.deviceId, isAuthorized };
+    }
+    async projects(access) {
+        const provider = this.provider;
+        if (!provider || !access.isAuthorized())
+            throw new Error("Account relay access expired");
+        const projects = await provider.listProjects();
+        if (this.provider !== provider || !access.isAuthorized())
+            throw new Error("Account relay access expired");
+        return { hostId: provider.hostId, environmentId: provider.environmentId, projects };
+    }
+}
+export async function readRelayHandoff(request) {
+    if (request.headers["content-type"]?.split(";", 1)[0]?.trim() !== "application/json")
+        throw new Error("Invalid relay handoff");
+    const declared = Number(request.headers["content-length"] ?? 0);
+    if (!Number.isFinite(declared) || declared > 8192)
+        throw new Error("Invalid relay handoff");
+    const chunks = [];
+    let bytes = 0;
+    const timeout = setTimeout(() => request.destroy(), 10_000);
+    timeout.unref();
+    try {
+        for await (const chunk of request) {
+            bytes += Buffer.byteLength(chunk);
+            if (bytes > 8192)
+                throw new Error("Invalid relay handoff");
+            chunks.push(Buffer.from(chunk));
+        }
+        const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!input ||
+            typeof input !== "object" ||
+            Array.isArray(input) ||
+            Object.keys(input).length !== 1 ||
+            !("handoff" in input) ||
+            typeof input.handoff !== "string" ||
+            !/^[A-Za-z0-9_-]{32,4096}$/.test(input.handoff))
+            throw new Error("Invalid relay handoff");
+        return input.handoff;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}

package/dist/mobile-remote/approval-clock.d.ts

@@ -0,0 +1,3 @@
+/** Timestamp at delivery, including reconnect replay, so a phone never compares
+ * a worker deadline directly with its own potentially skewed wall clock. */
+export declare function stampApprovalClock(line: string, now?: number): string;

package/dist/mobile-remote/approval-clock.js

@@ -0,0 +1,15 @@
+/** Timestamp at delivery, including reconnect replay, so a phone never compares
+ * a worker deadline directly with its own potentially skewed wall clock. */
+export function stampApprovalClock(line, now = Date.now()) {
+    if (!line.includes("agent/approvalRequest"))
+        return line;
+    try {
+        const message = JSON.parse(line);
+        if (message?.method !== "agent/approvalRequest" || !Number.isFinite(message.params?.expiresAt))
+            return line;
+        return JSON.stringify({ ...message, serverTime: now });
+    }
+    catch {
+        return line;
+    }
+}

package/dist/mobile-remote/codex-room-agent.d.ts

@@ -74,6 +74,8 @@ export interface CodexRoomAgentOptions {
 export declare class CodexRoomAgent implements RoomAgent {
     private readonly opts;
     private child?;
+    /** Last turn process, kept so stopAndWait() can prove it exited. */
+    private lastChild?;
     private threadId?;
     private started;
     constructor(opts: CodexRoomAgentOptions);
@@ -84,5 +86,9 @@ export declare class CodexRoomAgent implements RoomAgent {
      *  process is currently alive (turns are ephemeral). */
     isRunning(): boolean;
     stop(): void;
+    /** A turn's `codex exec` child may still be alive after turn_end was parsed. */
+    isBusy(): boolean;
+    /** Stop, then resolve true only once the last turn process has exited. */
+    stopAndWait(timeoutMs: number): Promise<boolean>;
 }
 export {};

package/dist/mobile-remote/codex-room-agent.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { releaseStdioAfterExit, stopRoomProcess } from "./room-process-stop.js";
+import { releaseStdioAfterExit, stopRoomProcess, stopRoomProcessAndWait, } from "./room-process-stop.js";
 import { createInterface } from "node:readline";
 import { pathWithCommonBins } from "./path-bins.js";
 import { parseCodexJsonLine, extractThreadId } from "./codex-parse.js";
@@ -85,6 +85,8 @@ export function sealEventOnExit(opts) {
 export class CodexRoomAgent {
     opts;
     child;
+    /** Last turn process, kept so stopAndWait() can prove it exited. */
+    lastChild;
     threadId;
     started = false;
     constructor(opts) {
@@ -109,6 +111,7 @@ export class CodexRoomAgent {
             stdio: ["pipe", "pipe", "pipe"],
         });
         this.child = child;
+        this.lastChild = child;
         // Settle on `close` so trailing output is read, without waiting on grandchildren.
         releaseStdioAfterExit(child);
         if (child.stdout) {
@@ -210,4 +213,17 @@ export class CodexRoomAgent {
         if (child)
             stopRoomProcess(child);
     }
+    /** A turn's `codex exec` child may still be alive after turn_end was parsed. */
+    isBusy() {
+        return Boolean(this.child);
+    }
+    /** Stop, then resolve true only once the last turn process has exited. */
+    stopAndWait(timeoutMs) {
+        this.started = false;
+        const child = this.child ?? this.lastChild;
+        this.child = undefined;
+        if (!child)
+            return Promise.resolve(true);
+        return stopRoomProcessAndWait(child, timeoutMs);
+    }
 }

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -44,6 +44,7 @@ export function parseMobileClientEvent(value) {
                         (typeof event.modelTraceSource === "string" &&
                             /^panel:[a-z][a-z0-9-]{0,63}$/.test(event.modelTraceSource))) &&
                     optionalBoundedString(event.clientMessageId, MAX_ID_LENGTH) &&
+                    optionalQueueFlag(event.queue) &&
                     optionalAttachments(event.attachments);
             break;
         case "attachment.upload.begin":
@@ -137,6 +138,14 @@ export function parseMobileClientEvent(value) {
                     optionalMember(event.scope, SCOPES) &&
                     optionalMember(event.pathScope, PATH_SCOPES);
             break;
+        case "approval.keepWaiting":
+            valid =
+                boundedString(event.approvalId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.sessionId, MAX_ID_LENGTH) &&
+                    optionalBoundedString(event.connectionId, MAX_ID_LENGTH) &&
+                    (event.generation === undefined ||
+                        (Number.isSafeInteger(event.generation) && event.generation >= 0));
+            break;
         case "session.list":
             valid =
                 optionalBoundedString(event.requestId, 128) &&
@@ -196,8 +205,23 @@ export function parseMobileClientEvent(value) {
                 boundedString(event.roomId, MAX_ID_LENGTH) &&
                     boundedOptionalEmptyString(event.text, MAX_MESSAGE_LENGTH) &&
                     optionalBoundedString(event.clientMessageId, MAX_ID_LENGTH) &&
+                    optionalQueueFlag(event.queue) &&
                     optionalAttachments(event.attachments);
             break;
+        case "queue.sync":
+        case "queue.clear":
+        case "queue.resume":
+            valid =
+                queueTarget(event.target) &&
+                    Object.keys(event).every((key) => key === "type" || key === "target");
+            break;
+        case "queue.cancel":
+        case "queue.retry":
+            valid =
+                queueTarget(event.target) &&
+                    boundedString(event.entryId, MAX_ID_LENGTH) &&
+                    Object.keys(event).every((key) => ["type", "target", "entryId"].includes(key));
+            break;
         case "room.history":
             valid =
                 boundedString(event.roomId, MAX_ID_LENGTH) &&
@@ -227,7 +251,8 @@ export function parseMobileClientEvent(value) {
                 boundedString(event.sessionId, MAX_ID_LENGTH) &&
                     boundedPath(event.cwd) &&
                     member(event.mode, PERMISSION_MODES) &&
-                    optionalMember(event.kind, KINDS);
+                    optionalMember(event.kind, KINDS) &&
+                    optionalBoundedString(event.requestId, MAX_ID_LENGTH);
             break;
         case "ccRoom.subscribeTranscript":
             valid =
@@ -297,6 +322,20 @@ function optionalPositiveInteger(value) {
 function isBoundedHistoryLimit(value) {
     return isPositiveInteger(value) && value <= MAX_HISTORY_LIMIT;
 }
+function optionalQueueFlag(value) {
+    return value === undefined || value === true;
+}
+function queueTarget(value) {
+    if (!isRecord(value))
+        return false;
+    const keys = Object.keys(value);
+    if (value.kind === "session")
+        return (boundedTrimmedString(value.sessionId, MAX_ID_LENGTH) &&
+            keys.every((key) => key === "kind" || key === "sessionId"));
+    return (value.kind === "room" &&
+        boundedTrimmedString(value.roomId, MAX_ID_LENGTH) &&
+        keys.every((key) => key === "kind" || key === "roomId"));
+}
 function optionalAttachments(value) {
     return (value === undefined ||
         (Array.isArray(value) && value.length <= MAX_MOBILE_ATTACHMENTS && value.every(isAttachment)));

package/dist/mobile-remote/mobile-upload-service.d.ts

@@ -3,6 +3,8 @@ import type { MobileImageBase } from "./types.js";
 export { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export declare const MOBILE_UPLOAD_TTL_MS: number;
 export declare const MAX_MOBILE_UPLOAD_TICKETS_PER_DEVICE = 16;
+/** Upper bound for an image waiting behind a long turn in the Host FIFO. */
+export declare const MOBILE_UPLOAD_QUEUE_RETENTION_MS: number;
 export declare const MAX_MOBILE_UPLOAD_CLAIM_ATTEMPTS = 3;
 export interface MobileUploadServiceOptions {
     rootDir: string;
@@ -43,6 +45,13 @@ export declare class MobileUploadService {
     private receivePut;
     /** Atomically move a ready upload into a request-owned lease. */
     claim(deviceId: string, uploadId: string): ClaimedMobileUpload;
+    /**
+     * Keep a ready upload alive for a Host-queued turn that has not run yet. The
+     * extension is bounded; the per-device ticket cap still limits retained files.
+     */
+    retain(deviceId: string, uploadId: string, durationMs?: number): void;
+    /** Drop an unclaimed upload of a cancelled queued turn immediately. */
+    discard(deviceId: string, uploadId: string): Promise<void>;
     /** Release a failed staging/dispatch attempt for a bounded retry. */
     release(deviceId: string, uploadId: string, claimId: string): Promise<void>;
     /** Finalize a successful turn; only the active claim owner may consume it. */

package/dist/mobile-remote/mobile-upload-service.js

@@ -8,6 +8,8 @@ import { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export { MAX_MOBILE_IMAGE_BYTES } from "./mobile-limits.js";
 export const MOBILE_UPLOAD_TTL_MS = 5 * 60 * 1000;
 export const MAX_MOBILE_UPLOAD_TICKETS_PER_DEVICE = 16;
+/** Upper bound for an image waiting behind a long turn in the Host FIFO. */
+export const MOBILE_UPLOAD_QUEUE_RETENTION_MS = 12 * 60 * 60 * 1000;
 export const MAX_MOBILE_UPLOAD_CLAIM_ATTEMPTS = 3;
 const IMAGE_MIMES = new Set([
     "image/png",
@@ -286,6 +288,29 @@ export class MobileUploadService {
             sha256: record.sha256,
         };
     }
+    /**
+     * Keep a ready upload alive for a Host-queued turn that has not run yet. The
+     * extension is bounded; the per-device ticket cap still limits retained files.
+     */
+    retain(deviceId, uploadId, durationMs = MOBILE_UPLOAD_QUEUE_RETENTION_MS) {
+        if (this.revokedDevices.has(deviceId))
+            throw new Error("upload device was revoked");
+        const record = this.uploads.get(uploadId);
+        if (!record || record.expiresAt <= this.now() || record.deviceId !== deviceId)
+            throw new Error("upload is not ready or no longer exists");
+        if (record.status !== "ready")
+            throw new Error("upload is already claimed or not ready");
+        const until = this.now() + Math.min(durationMs, MOBILE_UPLOAD_QUEUE_RETENTION_MS);
+        if (until > record.expiresAt)
+            record.expiresAt = until;
+    }
+    /** Drop an unclaimed upload of a cancelled queued turn immediately. */
+    async discard(deviceId, uploadId) {
+        const record = this.uploads.get(uploadId);
+        if (!record || record.deviceId !== deviceId || record.status === "claimed")
+            return;
+        await this.expire(uploadId, record);
+    }
     /** Release a failed staging/dispatch attempt for a bounded retry. */
     async release(deviceId, uploadId, claimId) {
         const record = this.assertClaimOwner(deviceId, uploadId, claimId);

package/dist/mobile-remote/remote-host-manager.d.ts

@@ -6,6 +6,7 @@ import type { MobileServerEvent } from "./types.js";
 import type { MobileUploadService } from "./mobile-upload-service.js";
 import type { DesktopWebHttpApi } from "../desktop-web/http-api.js";
 import type { RelayLocalTarget } from "../remote-relay/connector.js";
+import { type AccountRelayAccessProvider } from "./account-relay-access.js";
 /**
  * Pick the Mac's real LAN IPv4 so a phone on the same Wi-Fi can reach the
  * remote host. We bind to a concrete LAN address (NOT 0.0.0.0) per the design's
@@ -22,11 +23,11 @@ export interface RemoteHostStartOptions {
      * "lan" (default) keeps the existing LAN behaviour unchanged. "tunnel" binds
      * 127.0.0.1 (cloudflared connects to loopback) and inserts a passcode gate in
      * front of ordinary HTTP routes and the WS upgrade. Host-verified Panel asset
-     * capabilities use their own short-lived authorization. "relay" also requires an
-     * initialized passcode and a stable HTTPS origin before pairing/WS upgrades.
+     * capabilities use their own short-lived authorization. "relay" requires a
+     * passcode or main-owned account handoff provider and a stable HTTPS origin.
      */
     mode?: "lan" | "tunnel" | "relay";
-    /** Required and initialized in relay mode; public gate for tunnel mode too. */
+    /** Public passcode gate; account handoffs may independently authorize relay mode. */
     passcode?: AccessPasscode;
 }
 export interface RemoteHostStarted {
@@ -46,6 +47,8 @@ export interface RemoteHostManagerOptions {
     historyView?: boolean;
     /** The attached command Host resolves native text connections per authorized Session. */
     nativeModelSelection?: boolean;
+    /** The attached command Host owns a pending-turn FIFO (queue.* events, chat.queued). */
+    turnQueue?: boolean;
     onClientEvent: (event: unknown, ws: WebSocket) => void | Promise<void>;
     /**
      * Absolute path to the built mobile app (out/mobile). Defaults to the
@@ -85,11 +88,23 @@ export declare class RemoteHostManager extends EventEmitter {
     private passcode?;
     private socketAccessValidity;
     private accessSweep?;
+    private readonly accountAccess;
+    private accountSocketDevices;
     /** Where the built mobile app lives (out/mobile). */
     private readonly mobileRootDir;
     /** Dev proxy target for /mobile (HMR); undefined in prod. */
     private readonly mobileDevUrl?;
+    private turnQueueEnabled;
     constructor(opts: RemoteHostManagerOptions);
+    /** Install main-owned directory redemption; replacing it synchronously revokes old sessions. */
+    setAccountRelayAccess(provider?: AccountRelayAccessProvider): void;
+    /** The attached command Host installed a pending-turn FIFO; advertise it on (re)auth. */
+    advertiseTurnQueue(): void;
+    /** A paired (or live account) device that has not been revoked or removed. */
+    isTrustedDevice(deviceId: string): boolean;
+    private get turnQueueAdvertised();
+    private relayRequestOrigin;
+    private relayJson;
     /** Device ids with at least one live socket right now. */
     onlineDeviceIds(): string[];
     /** Register a live socket for a device; emits `online-change` only when the
@@ -120,7 +135,7 @@ export declare class RemoteHostManager extends EventEmitter {
      * trusted-device store (which rejects revoked devices), so the remote host
      * never executes tools itself — it only gates transport.
      */
-    handleClientEvent(input: unknown): MobileServerEvent | undefined;
+    handleClientEvent(input: unknown, accountDeviceId?: string): MobileServerEvent | undefined;
     /** Broadcast a server event to every connected, authenticated mobile socket. */
     broadcast(event: MobileServerEvent): void;
     /** Send a server event to ONLY the sockets belonging to one device. Used for