@co0ontty/wand 0.2.1 → 0.4.0

package/dist/server.js

@@ -1,26 +1,62 @@
 import express from "express";
-import { readdir } from "node:fs/promises";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { existsSync } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import path from "node:path";
 import process from "node:process";
-import { WebSocketServer, WebSocket } from "ws";
+import { WebSocketServer } from "ws";
 const execAsync = promisify(exec);
+const SERVER_MODULE_DIR = path.dirname(new URL(import.meta.url).pathname);
+const RUNTIME_ROOT_DIR = path.resolve(SERVER_MODULE_DIR, "..");
+import { ensureAvatarSeed, getAvatarSvg } from "./avatar.js";
 import { createSession, revokeSession, setAuthStorage, validateSession } from "./auth.js";
 import { ensureCertificates } from "./cert.js";
 import { isExecutionMode, resolveConfigDir } from "./config.js";
-import { ProcessManager } from "./process-manager.js";
+import { ProcessManager, SessionInputError } from "./process-manager.js";
 import { resolveDatabasePath, WandStorage } from "./storage.js";
-import { renderApp } from "./web-ui.js";
+import { renderApp } from "./web-ui/index.js";
 import { parseMessages } from "./message-parser.js";
+import { generatePwaManifest, generateServiceWorker } from "./pwa.js";
+import { WsBroadcastManager } from "./ws-broadcast.js";
+import { checkRateLimit, recordFailedLogin, resetRateLimit } from "./middleware/rate-limit.js";
+import { isPathWithinBase, isBlockedFolderPath, normalizeFolderPath } from "./middleware/path-safety.js";
+// ── Error helpers ──
 function getErrorMessage(error, fallback) {
     return error instanceof Error ? error.message : fallback;
 }
-/**
- * Check if a directory is inside a git repository
- */
+function getInputErrorResponse(error, sessionId) {
+    if (error instanceof SessionInputError) {
+        const statusCode = error.code === "SESSION_NOT_FOUND" ? 404 : 409;
+        return {
+            statusCode,
+            payload: {
+                error: error.message,
+                errorCode: error.code,
+                sessionId,
+                sessionStatus: error.sessionStatus ?? null,
+            },
+        };
+    }
+    return {
+        statusCode: 400,
+        payload: {
+            error: getErrorMessage(error, "会话已结束，请启动新会话。"),
+            errorCode: "INPUT_SEND_FAILED",
+            sessionId,
+            sessionStatus: null,
+        },
+    };
+}
+function getInputDebugMeta(error) {
+    if (error instanceof Error) {
+        return { name: error.name, message: error.message, stack: error.stack };
+    }
+    return { error };
+}
+// ── Git helpers ──
 async function isGitRepo(dirPath) {
     try {
         await execAsync("git rev-parse --is-inside-work-tree", { cwd: dirPath });
@@ -30,9 +66,6 @@ async function isGitRepo(dirPath) {
         return false;
     }
 }
-/**
- * Get the git repository root directory
- */
 async function getGitRepoRoot(dirPath) {
     try {
         const { stdout } = await execAsync("git rev-parse --show-toplevel", { cwd: dirPath });
@@ -42,20 +75,12 @@ async function getGitRepoRoot(dirPath) {
         return null;
     }
 }
-/**
- * Get git status for all files in a directory
- * Returns a map of relative file paths to their git status
- */
 async function getGitStatusMap(gitRoot) {
     const statusMap = new Map();
     try {
-        // Get git status in porcelain format (stable for parsing)
-        // -uno: don't list untracked files (we'll get them separately)
         const { stdout: stagedStdout } = await execAsync("git status --porcelain -uno", { cwd: gitRoot });
-        // Get untracked files separately
         const { stdout: untrackedStdout } = await execAsync("git ls-files --others --exclude-standard", { cwd: gitRoot });
-        // Parse staged/unstaged changes
-        const lines = stagedStdout.split("\n").filter(line => line.trim());
+        const lines = stagedStdout.split("\n").filter((line) => line.trim());
         for (const line of lines) {
             if (line.length < 4)
                 continue;
@@ -65,7 +90,6 @@ async function getGitStatusMap(gitRoot) {
             if (!filePath)
                 continue;
             const status = {};
-            // Parse staged status
             if (stagedChar === "M")
                 status.staged = "modified";
             else if (stagedChar === "A")
@@ -74,15 +98,13 @@ async function getGitStatusMap(gitRoot) {
                 status.staged = "deleted";
             else if (stagedChar === "R")
                 status.staged = "renamed";
-            // Parse unstaged status
             if (unstagedChar === "M")
                 status.unstaged = "modified";
             else if (unstagedChar === "D")
                 status.unstaged = "deleted";
             statusMap.set(filePath, status);
         }
-        // Parse untracked files
-        const untrackedFiles = untrackedStdout.split("\n").filter(line => line.trim());
+        const untrackedFiles = untrackedStdout.split("\n").filter((line) => line.trim());
         for (const filePath of untrackedFiles) {
             const existing = statusMap.get(filePath);
             if (existing) {
@@ -94,72 +116,69 @@ async function getGitStatusMap(gitRoot) {
         }
         return statusMap;
     }
-    catch (error) {
-        // Git command failed, return empty map
+    catch {
         return statusMap;
     }
 }
-/**
- * Enrich file entries with git status
- */
 async function enrichWithGitStatus(items, dirPath) {
     try {
         const gitRoot = await getGitRepoRoot(dirPath);
-        if (!gitRoot) {
+        if (!gitRoot)
             return items;
-        }
         const gitStatusMap = await getGitStatusMap(gitRoot);
         return items.map((item) => {
-            // Get path relative to git root
             const relativePath = path.relative(gitRoot, item.path);
-            // Normalize path separators for cross-platform compatibility
-            const normalizedPath = relativePath.replace(/\\/g, '/');
+            const normalizedPath = relativePath.replace(/\\/g, "/");
             const gitStatus = gitStatusMap.get(normalizedPath);
-            return {
-                ...item,
-                gitStatus: gitStatus || undefined
-            };
+            return { ...item, gitStatus: gitStatus || undefined };
         });
     }
     catch {
         return items;
     }
 }
-// Simple in-memory rate limiter for login attempts
-const loginAttempts = new Map();
-const RATE_LIMIT_WINDOW = 15 * 60 * 1000; // 15 minutes
-const RATE_LIMIT_MAX = 10; // 10 attempts per window
-function checkRateLimit(ip) {
-    const now = Date.now();
-    const record = loginAttempts.get(ip);
-    if (!record || now > record.resetAt) {
-        return true;
-    }
-    return record.count < RATE_LIMIT_MAX;
-}
-function recordFailedLogin(ip) {
-    const now = Date.now();
-    const record = loginAttempts.get(ip);
-    if (!record || now > record.resetAt) {
-        loginAttempts.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW });
+// ── Auth helpers ──
+function requireAuth(req, res, next) {
+    if (!validateSession(readSessionCookie(req))) {
+        res.status(401).json({ error: "未授权，请先登录。" });
         return;
     }
-    record.count++;
+    next();
 }
-function resetRateLimit(ip) {
-    loginAttempts.delete(ip);
+function readSessionCookie(req) {
+    const cookie = req.headers.cookie;
+    if (!cookie)
+        return undefined;
+    const match = cookie.split(";").map((part) => part.trim()).find((part) => part.startsWith("wand_session="));
+    return match?.slice("wand_session=".length);
 }
-function cleanupRateLimiter() {
-    const now = Date.now();
-    for (const [ip, record] of loginAttempts.entries()) {
-        if (now > record.resetAt) {
-            loginAttempts.delete(ip);
-        }
+function normalizeMode(input, fallback) {
+    return isExecutionMode(input) ? input : fallback;
+}
+async function listPathSuggestions(input, fallbackCwd) {
+    const normalizedInput = input.trim();
+    const baseInput = normalizedInput || fallbackCwd;
+    const resolvedInput = path.resolve(process.cwd(), baseInput);
+    const endsWithSeparator = /[\\/]$/.test(normalizedInput);
+    let searchDir = resolvedInput;
+    let partialName = "";
+    if (!endsWithSeparator) {
+        searchDir = path.dirname(resolvedInput);
+        partialName = path.basename(resolvedInput);
     }
+    const entries = await readdir(searchDir, { withFileTypes: true });
+    return entries
+        .filter((entry) => entry.isDirectory())
+        .filter((entry) => !partialName || entry.name.toLowerCase().startsWith(partialName.toLowerCase()))
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .slice(0, 8)
+        .map((entry) => ({
+        path: path.join(searchDir, entry.name),
+        name: entry.name,
+        isDirectory: true,
+    }));
 }
-// Cleanup rate limiter every 5 minutes
-setInterval(cleanupRateLimiter, 5 * 60 * 1000);
-// Catch-all for unexpected startup errors
+// ── Startup error handling ──
 process.on("uncaughtException", (err) => {
     wandError("服务器异常", err.message, "请检查配置是否正确，或尝试重启服务。");
     process.exit(1);
@@ -168,7 +187,6 @@ process.on("unhandledRejection", (reason) => {
     const msg = reason instanceof Error ? reason.message : String(reason);
     wandError("未处理的异步错误", msg);
 });
-// ── Friendly error / warn / info helpers ──────────────────────────────────
 function wandError(label, message, suggestion) {
     process.stderr.write(`\n✗ [wand] ${label}：${message}\n`);
     if (suggestion)
@@ -180,97 +198,96 @@ function wandWarn(message, hint) {
     if (hint)
         process.stderr.write(`  提示：${hint}\n`);
 }
-function wandInfo(message) {
-    process.stdout.write(`ℹ️  [wand] ${message}\n`);
+function parseStoredPathList(raw) {
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+const HIDDEN_CLAUDE_SESSIONS_KEY = "hidden_claude_sessions";
+function getHiddenClaudeSessionIds(storage) {
+    return new Set(parseStoredPathList(storage.getConfigValue(HIDDEN_CLAUDE_SESSIONS_KEY)));
+}
+function saveHiddenClaudeSessionIds(storage, hidden) {
+    storage.setConfigValue(HIDDEN_CLAUDE_SESSIONS_KEY, JSON.stringify(Array.from(hidden)));
+}
+const MAX_RECENT_PATHS = 10;
+// ── File language detection ──
+function getLanguageFromExt(ext, filePath) {
+    const map = {
+        ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx",
+        ".json": "json", ".html": "html", ".htm": "html",
+        ".css": "css", ".scss": "scss", ".less": "less",
+        ".py": "python", ".rb": "ruby", ".go": "go", ".rs": "rust",
+        ".java": "java", ".c": "c", ".cpp": "cpp", ".h": "c", ".hpp": "cpp",
+        ".cs": "csharp", ".swift": "swift", ".kt": "kotlin", ".scala": "scala",
+        ".php": "php", ".sh": "bash", ".bash": "bash", ".zsh": "bash",
+        ".yaml": "yaml", ".yml": "yaml", ".toml": "toml", ".ini": "ini",
+        ".xml": "xml", ".sql": "sql", ".graphql": "graphql",
+        ".md": "markdown", ".markdown": "markdown", ".mdown": "markdown",
+        ".mkd": "markdown", ".mkdn": "markdown",
+        ".dockerfile": "dockerfile", ".gitignore": "plaintext",
+        ".diff": "diff", ".patch": "diff", ".proto": "protobuf",
+        ".env": "bash", ".editorconfig": "ini",
+        ".mdx": "markdown", ".vue": "html", ".svelte": "html",
+    };
+    const baseName = path.basename(filePath).toLowerCase();
+    if (baseName === "dockerfile")
+        return "dockerfile";
+    if (baseName === ".gitignore")
+        return "plaintext";
+    return map[ext] || "plaintext";
 }
+// ── Main server ──
 export async function startServer(config, configPath) {
     const app = express();
     const storage = new WandStorage(resolveDatabasePath(configPath));
     setAuthStorage(storage);
-    const processes = new ProcessManager(config, storage, resolveConfigDir(configPath));
-    const useHttps = config.https !== false; // Default to true
+    const configDir = resolveConfigDir(configPath);
+    const avatarSeed = await ensureAvatarSeed(configDir);
+    const processes = new ProcessManager(config, storage, configDir);
+    const useHttps = config.https === true;
     const protocol = useHttps ? "https" : "http";
+    const nodeModulesDir = path.join(RUNTIME_ROOT_DIR, "node_modules");
     app.use(express.json({ limit: "1mb" }));
-    app.use("/vendor/xterm", express.static(path.resolve(process.cwd(), "node_modules/xterm")));
-    app.use("/vendor/xterm-addon-fit", express.static(path.resolve(process.cwd(), "node_modules/@xterm/addon-fit")));
+    app.use("/vendor/xterm", express.static(path.join(nodeModulesDir, "xterm")));
+    app.use("/vendor/xterm-addon-fit", express.static(path.join(nodeModulesDir, "@xterm", "addon-fit")));
+    // ── Web UI and PWA endpoints ──
     app.get("/", (_req, res) => {
+        res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
         res.type("html").send(renderApp(configPath));
     });
-    // PWA manifest
     app.get("/manifest.json", (_req, res) => {
-        res.type("json").send(JSON.stringify({
-            name: "Wand Console",
-            short_name: "Wand",
-            description: "Local CLI Console for Vibe Coding",
-            start_url: "/",
-            display: "standalone",
-            background_color: "#f6f1e8",
-            theme_color: "#c5653d",
-            orientation: "any",
-            icons: [
-                { src: "/icon-192.png", sizes: "192x192", type: "image/png", purpose: "any maskable" },
-                { src: "/icon-512.png", sizes: "512x512", type: "image/png", purpose: "any maskable" }
-            ],
-            categories: ["developer tools", "productivity"],
-            shortcuts: [
-                { name: "New Session", short_name: "New", url: "/?action=new", description: "Start a new CLI session" }
-            ]
-        }));
-    });
-    // PWA icons (SVG data URL converted to simple PNG-like response)
-    const iconSvg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 192">
-    <defs><linearGradient id="g" x1="0%" y1="0%" x2="100%" y2="100%">
-      <stop offset="0%" style="stop-color:#d77a52"/>
-      <stop offset="100%" style="stop-color:#a95130"/>
-    </linearGradient></defs>
-    <rect width="192" height="192" rx="38" fill="url(#g)"/>
-    <text x="96" y="128" text-anchor="middle" font-family="system-ui,sans-serif" font-size="88" font-weight="700" fill="white">W</text>
-  </svg>`;
+        res.setHeader("Content-Type", "application/manifest+json");
+        res.send(generatePwaManifest());
+    });
+    app.get("/icon.svg", (_req, res) => {
+        res.type("image/svg+xml").send(getAvatarSvg(avatarSeed, 192));
+    });
+    const iconsDir = path.resolve(existsSync(path.join(SERVER_MODULE_DIR, "web-ui", "content"))
+        ? path.join(SERVER_MODULE_DIR, "web-ui", "content")
+        : path.join(RUNTIME_ROOT_DIR, "src", "web-ui", "content"));
     app.get("/icon-192.png", (_req, res) => {
-        res.type("svg").send(iconSvg);
+        res.type("image/svg+xml").send(getAvatarSvg(avatarSeed, 192));
     });
     app.get("/icon-512.png", (_req, res) => {
-        res.type("svg").send(iconSvg);
+        res.type("image/svg+xml").send(getAvatarSvg(avatarSeed, 512));
     });
-    // Service Worker for offline support
     app.get("/sw.js", (_req, res) => {
-        res.type("javascript").send(`
-const CACHE_NAME = 'wand-v1';
-const STATIC_ASSETS = [
-  '/',
-  '/vendor/xterm/css/xterm.css',
-  '/vendor/xterm/lib/xterm.js',
-  '/vendor/xterm-addon-fit/lib/addon-fit.js'
-];
-
-self.addEventListener('install', (event) => {
-  event.waitUntil(caches.open(CACHE_NAME).then((cache) => cache.addAll(STATIC_ASSETS)));
-  self.skipWaiting();
-});
-
-self.addEventListener('activate', (event) => {
-  event.waitUntil(caches.keys().then((keys) => Promise.all(keys.filter((k) => k !== CACHE_NAME).map((k) => caches.delete(k)))));
-  self.clients.claim();
-});
-
-self.addEventListener('fetch', (event) => {
-  const url = new URL(event.request.url);
-  // API calls should always go to network
-  if (url.pathname.startsWith('/api/')) {
-    event.respondWith(fetch(event.request).catch(() => new Response(JSON.stringify({ error: 'Offline' }), { status: 503, headers: { 'Content-Type': 'application/json' } })));
-    return;
-  }
-  // Static assets: cache first, network fallback
-  event.respondWith(caches.match(event.request).then((cached) => cached || fetch(event.request).then((response) => {
-    if (response.ok && event.request.method === 'GET') {
-      const clone = response.clone();
-      caches.open(CACHE_NAME).then((cache) => cache.put(event.request, clone));
-    }
-    return response;
-  }).catch(() => caches.match('/'))));
-});
-`);
+        res.setHeader("Content-Type", "application/javascript");
+        res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+        res.setHeader("Service-Worker-Allowed", "/");
+        res.send(generateServiceWorker());
     });
+    app.get("/offline", (_req, res) => {
+        res.type("html").send(renderApp(configPath));
+    });
+    // ── Auth routes ──
     app.post("/api/login", (req, res) => {
         const clientIp = req.ip || req.socket.remoteAddress || "unknown";
         if (!checkRateLimit(clientIp)) {
@@ -278,7 +295,6 @@ self.addEventListener('fetch', (event) => {
             return;
         }
         const { password } = req.body;
-        // Check password: prefer database password, fallback to config password
         const dbPassword = storage.getPassword();
         const effectivePassword = dbPassword ?? config.password;
         if (password !== effectivePassword) {
@@ -292,7 +308,7 @@ self.addEventListener('fetch', (event) => {
             httpOnly: true,
             sameSite: "strict",
             secure: useHttps,
-            maxAge: 1000 * 60 * 60 * 12
+            maxAge: 1000 * 60 * 60 * 12,
         });
         res.json({ ok: true });
     });
@@ -301,7 +317,6 @@ self.addEventListener('fetch', (event) => {
         res.clearCookie("wand_session");
         res.json({ ok: true });
     });
-    // Set password endpoint (requires auth)
     app.post("/api/set-password", requireAuth, (req, res) => {
         const { password } = req.body;
         if (!password || password.length < 6) {
@@ -312,18 +327,143 @@ self.addEventListener('fetch', (event) => {
         res.json({ ok: true });
     });
     app.use("/api", requireAuth);
+    // ── Config & Session info ──
     app.get("/api/config", (_req, res) => {
         res.json({
             host: config.host,
             port: config.port,
             defaultMode: config.defaultMode,
             defaultCwd: config.defaultCwd,
-            commandPresets: config.commandPresets
+            commandPresets: config.commandPresets,
         });
     });
     app.get("/api/sessions", (_req, res) => {
         res.json(processes.list());
     });
+    app.get("/api/claude-history", (_req, res) => {
+        try {
+            const sessions = processes.listClaudeHistorySessions();
+            const hidden = getHiddenClaudeSessionIds(storage);
+            const filtered = hidden.size > 0
+                ? sessions.filter((s) => !s.claudeSessionId || !hidden.has(s.claudeSessionId))
+                : sessions;
+            res.json(filtered);
+        }
+        catch (error) {
+            res.status(500).json({ error: getErrorMessage(error, "无法扫描 Claude 历史会话。") });
+        }
+    });
+    app.delete("/api/claude-history/:claudeSessionId", (req, res) => {
+        const claudeSessionId = req.params.claudeSessionId?.trim();
+        if (!claudeSessionId) {
+            res.status(400).json({ error: "会话 ID 不能为空。" });
+            return;
+        }
+        const hidden = getHiddenClaudeSessionIds(storage);
+        if (!hidden.has(claudeSessionId)) {
+            hidden.add(claudeSessionId);
+            saveHiddenClaudeSessionIds(storage, hidden);
+        }
+        res.json({ ok: true });
+    });
+    app.delete("/api/claude-history", (req, res) => {
+        const cwd = typeof req.query.cwd === "string" ? req.query.cwd.trim() : "";
+        if (!cwd) {
+            res.status(400).json({ error: "目录不能为空。" });
+            return;
+        }
+        try {
+            const sessions = processes.listClaudeHistorySessions();
+            const hidden = getHiddenClaudeSessionIds(storage);
+            let added = 0;
+            for (const session of sessions) {
+                if (!session.claudeSessionId || session.cwd !== cwd) {
+                    continue;
+                }
+                if (hidden.has(session.claudeSessionId)) {
+                    continue;
+                }
+                hidden.add(session.claudeSessionId);
+                added += 1;
+            }
+            if (added > 0) {
+                saveHiddenClaudeSessionIds(storage, hidden);
+            }
+            res.json({ ok: true, deleted: added });
+        }
+        catch (error) {
+            res.status(500).json({ error: getErrorMessage(error, "无法删除该目录下的历史会话。") });
+        }
+    });
+    app.post("/api/claude-history/batch-delete", express.json(), (req, res) => {
+        const claudeSessionIds = Array.isArray(req.body?.claudeSessionIds)
+            ? req.body.claudeSessionIds.filter((value) => typeof value === "string" && value.trim().length > 0)
+            : [];
+        if (claudeSessionIds.length === 0) {
+            res.status(400).json({ error: "至少提供一个历史会话 ID。" });
+            return;
+        }
+        try {
+            const hidden = getHiddenClaudeSessionIds(storage);
+            let added = 0;
+            for (const claudeSessionId of claudeSessionIds) {
+                if (hidden.has(claudeSessionId)) {
+                    continue;
+                }
+                hidden.add(claudeSessionId);
+                added += 1;
+            }
+            if (added > 0) {
+                saveHiddenClaudeSessionIds(storage, hidden);
+            }
+            res.json({ ok: true, deleted: added });
+        }
+        catch (error) {
+            res.status(500).json({ error: getErrorMessage(error, "无法批量删除历史会话。") });
+        }
+    });
+    app.post("/api/sessions/batch-delete", express.json(), (req, res) => {
+        const sessionIds = Array.isArray(req.body?.sessionIds)
+            ? req.body.sessionIds.filter((value) => typeof value === "string" && value.trim().length > 0)
+            : [];
+        if (sessionIds.length === 0) {
+            res.status(400).json({ error: "至少提供一个会话 ID。" });
+            return;
+        }
+        let deleted = 0;
+        const failed = [];
+        for (const sessionId of sessionIds) {
+            try {
+                processes.delete(sessionId);
+                deleted += 1;
+            }
+            catch {
+                failed.push(sessionId);
+            }
+        }
+        if (deleted === 0 && failed.length > 0) {
+            res.status(400).json({ error: "无法批量删除会话。", failed });
+            return;
+        }
+        res.json({ ok: true, deleted, failed });
+    });
+    app.get("/api/sessions/:id", (req, res) => {
+        const snapshot = processes.get(req.params.id);
+        if (!snapshot) {
+            res.status(404).json({ error: "未找到该会话，可能已被删除。" });
+            return;
+        }
+        if (req.query.format === "chat") {
+            const messages = snapshot.messages && snapshot.messages.length > 0
+                ? snapshot.messages
+                : parseMessages(snapshot.output);
+            res.json({ ...snapshot, messages });
+        }
+        else {
+            res.json(snapshot);
+        }
+    });
+    // ── Path suggestion ──
     app.get("/api/path-suggestions", async (req, res) => {
         const query = typeof req.query.q === "string" ? req.query.q : "";
         try {
@@ -334,13 +474,13 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "无法加载路径建议。") });
         }
     });
+    // ── File browsing ──
     app.get("/api/directory", async (req, res) => {
         const q = typeof req.query.q === "string" ? req.query.q : "";
         const includeGitStatus = req.query.gitStatus === "true";
         const targetPath = path.resolve(process.cwd(), q);
-        // Security check: ensure the resolved path is within the current working directory
         const allowedBase = process.cwd();
-        if (!targetPath.startsWith(allowedBase)) {
+        if (!isPathWithinBase(targetPath, allowedBase)) {
             res.status(403).json({ error: "访问被拒绝：路径必须在项目目录内。" });
             return;
         }
@@ -348,7 +488,6 @@ self.addEventListener('fetch', (event) => {
             const entries = await readdir(targetPath, { withFileTypes: true });
             let items = entries
                 .sort((a, b) => {
-                // Directories first, then alphabetically
                 if (a.isDirectory() && !b.isDirectory())
                     return -1;
                 if (!a.isDirectory() && b.isDirectory())
@@ -359,9 +498,8 @@ self.addEventListener('fetch', (event) => {
                 .map((entry) => ({
                 path: path.join(targetPath, entry.name),
                 name: entry.name,
-                type: entry.isDirectory() ? "dir" : "file"
+                type: entry.isDirectory() ? "dir" : "file",
             }));
-            // Enrich with git status if requested
             if (includeGitStatus) {
                 items = await enrichWithGitStatus(items, targetPath);
             }
@@ -371,53 +509,84 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "无法读取目录。可能原因：路径不存在或权限不足。") });
         }
     });
-    // Folder picker API - starts from /tmp by default, supports navigation
-    app.get("/api/folders", async (req, res) => {
-        const q = typeof req.query.q === "string" ? req.query.q : "/tmp";
-        const targetPath = path.resolve(q);
-        // Security check: prevent accessing sensitive system paths
-        const blockedPaths = ['/etc', '/root', '/boot'];
-        for (const blocked of blockedPaths) {
-            if (targetPath.startsWith(blocked)) {
-                res.status(403).json({ error: "访问被拒绝：无法访问系统敏感目录。" });
+    const MAX_FILE_SIZE = 512 * 1024;
+    app.get("/api/file-preview", async (req, res) => {
+        const filePath = typeof req.query.path === "string" ? req.query.path : "";
+        if (!filePath) {
+            res.status(400).json({ error: "Missing path parameter" });
+            return;
+        }
+        const resolvedPath = path.resolve(filePath);
+        const allowedBase = process.cwd();
+        if (!isPathWithinBase(resolvedPath, allowedBase)) {
+            res.status(403).json({ error: "Access denied" });
+            return;
+        }
+        try {
+            const fileStat = await stat(resolvedPath);
+            if (fileStat.isDirectory()) {
+                res.status(400).json({ error: "Cannot preview a directory" });
+                return;
+            }
+            if (fileStat.size > MAX_FILE_SIZE) {
+                res.status(413).json({ error: "File too large", truncated: true, size: fileStat.size, maxSize: MAX_FILE_SIZE });
                 return;
             }
+            const ext = path.extname(filePath).toLowerCase();
+            const previewableExts = [
+                ".md", ".markdown", ".mdown", ".mkd", ".mkdn",
+                ".ts", ".tsx", ".js", ".jsx", ".json", ".html", ".css", ".scss", ".less",
+                ".py", ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
+                ".cs", ".swift", ".kt", ".scala", ".php", ".sh", ".bash", ".zsh",
+                ".yaml", ".yml", ".toml", ".ini", ".cfg", ".conf", ".env",
+                ".xml", ".sql", ".graphql", ".proto",
+                ".dockerfile", ".gitignore", ".env", ".editorconfig",
+                ".mdx", ".vue", ".svelte",
+                ".txt", ".log", ".diff", ".patch",
+            ];
+            const isText = previewableExts.includes(ext) ||
+                ext === "" ||
+                [".gitignore", "dockerfile", ".env.local", ".env.development"].some((e) => filePath.toLowerCase().endsWith(e));
+            if (!isText) {
+                res.status(415).json({ error: "Unsupported file type", ext });
+                return;
+            }
+            const content = await readFile(resolvedPath, "utf-8");
+            const lang = getLanguageFromExt(ext, filePath);
+            res.json({ path: resolvedPath, name: path.basename(filePath), ext, lang, content, size: fileStat.size });
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "Failed to read file") });
+        }
+    });
+    app.get("/api/folders", async (req, res) => {
+        const q = typeof req.query.q === "string" ? req.query.q : "/tmp";
+        const targetPath = normalizeFolderPath(q);
+        if (isBlockedFolderPath(targetPath)) {
+            res.status(403).json({ error: "访问被拒绝：无法访问系统敏感目录。" });
+            return;
         }
         try {
             const entries = await readdir(targetPath, { withFileTypes: true });
             const items = [];
-            // Add parent directory navigation (..)
             const parentPath = path.dirname(targetPath);
             if (parentPath !== targetPath) {
-                items.push({
-                    path: parentPath,
-                    name: "..",
-                    type: "parent",
-                    isParent: true
-                });
+                items.push({ path: parentPath, name: "..", type: "parent", isParent: true });
             }
-            // Add subdirectories
             entries
                 .filter((entry) => entry.isDirectory())
                 .sort((a, b) => a.name.localeCompare(b.name))
                 .slice(0, 100)
                 .forEach((entry) => {
-                items.push({
-                    path: path.join(targetPath, entry.name),
-                    name: entry.name,
-                    type: "dir"
-                });
-            });
-            res.json({
-                currentPath: targetPath,
-                items: items
+                items.push({ path: path.join(targetPath, entry.name), name: entry.name, type: "dir" });
             });
+            res.json({ currentPath: targetPath, items });
         }
         catch (error) {
-            if (error.code === 'ENOENT') {
+            if (error.code === "ENOENT") {
                 res.status(404).json({ error: "路径不存在：" + q, currentPath: q, items: [] });
             }
-            else if (error.code === 'EACCES') {
+            else if (error.code === "EACCES") {
                 res.status(403).json({ error: "权限不足，无法访问：" + q, currentPath: q, items: [] });
             }
             else {
@@ -425,21 +594,19 @@ self.addEventListener('fetch', (event) => {
             }
         }
     });
-    // Quick paths API - returns common paths for quick access
-    app.get("/api/quick-paths", async (req, res) => {
-        const home = process.env.HOME || process.env.USERPROFILE || '/home';
-        const quickPaths = [
+    app.get("/api/quick-paths", async (_req, res) => {
+        const home = process.env.HOME || process.env.USERPROFILE || "/home";
+        res.json([
             { path: "/tmp", name: "临时目录", icon: "🗑️" },
             { path: home, name: "主目录", icon: "🏠" },
             { path: process.cwd(), name: "当前目录", icon: "📂" },
-            { path: "/", name: "根目录", icon: "📁" }
-        ];
-        res.json(quickPaths);
+            { path: "/", name: "根目录", icon: "📁" },
+        ]);
     });
     app.get("/api/favorite-paths", (_req, res) => {
         const stored = storage.getConfigValue("favorite_paths");
-        const favorites = stored ? JSON.parse(stored) : [];
-        res.json(favorites);
+        const favorites = parseStoredPathList(stored);
+        res.json(favorites.filter((f) => !isBlockedFolderPath(normalizeFolderPath(f.path))));
     });
     app.post("/api/favorite-paths", (req, res) => {
         const { path: favPath, name, icon } = req.body;
@@ -447,18 +614,22 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: "路径不能为空。" });
             return;
         }
+        const resolvedFavoritePath = normalizeFolderPath(favPath);
+        if (isBlockedFolderPath(resolvedFavoritePath)) {
+            res.status(403).json({ error: "访问被拒绝：无法收藏系统敏感目录。" });
+            return;
+        }
         const stored = storage.getConfigValue("favorite_paths");
-        const favorites = stored ? JSON.parse(stored) : [];
-        // Check if already exists
-        if (favorites.some((f) => f.path === favPath)) {
+        const favorites = parseStoredPathList(stored);
+        if (favorites.some((f) => normalizeFolderPath(f.path) === resolvedFavoritePath)) {
             res.status(400).json({ error: "该路径已在收藏列表中。" });
             return;
         }
         const newFavorite = {
-            path: favPath,
-            name: name || path.basename(favPath),
+            path: resolvedFavoritePath,
+            name: name || path.basename(resolvedFavoritePath),
             icon: icon || "⭐",
-            addedAt: new Date().toISOString()
+            addedAt: new Date().toISOString(),
         };
         favorites.push(newFavorite);
         storage.setConfigValue("favorite_paths", JSON.stringify(favorites));
@@ -471,7 +642,7 @@ self.addEventListener('fetch', (event) => {
             return;
         }
         const stored = storage.getConfigValue("favorite_paths");
-        const favorites = stored ? JSON.parse(stored) : [];
+        const favorites = parseStoredPathList(stored);
         const index = favorites.findIndex((f) => f.path === delPath);
         if (index === -1) {
             res.status(404).json({ error: "未找到该收藏路径。" });
@@ -481,11 +652,10 @@ self.addEventListener('fetch', (event) => {
         storage.setConfigValue("favorite_paths", JSON.stringify(favorites));
         res.json({ ok: true });
     });
-    const MAX_RECENT_PATHS = 10;
     app.get("/api/recent-paths", (_req, res) => {
         const stored = storage.getConfigValue("recent_paths");
-        const recent = stored ? JSON.parse(stored) : [];
-        res.json(recent);
+        const recent = parseStoredPathList(stored);
+        res.json(recent.filter((item) => !isBlockedFolderPath(normalizeFolderPath(item.path))));
     });
     app.post("/api/recent-paths", (req, res) => {
         const { path: usedPath } = req.body;
@@ -493,23 +663,24 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: "路径不能为空。" });
             return;
         }
+        const resolvedRecentPath = normalizeFolderPath(usedPath);
+        if (isBlockedFolderPath(resolvedRecentPath)) {
+            res.status(403).json({ error: "访问被拒绝：无法保存系统敏感目录。" });
+            return;
+        }
         const stored = storage.getConfigValue("recent_paths");
-        let recent = stored ? JSON.parse(stored) : [];
-        // Remove existing entry for this path (to update position)
-        recent = recent.filter((r) => r.path !== usedPath);
-        // Add to front
+        let recent = parseStoredPathList(stored);
+        recent = recent.filter((r) => normalizeFolderPath(r.path) !== resolvedRecentPath);
         const newRecent = {
-            path: usedPath,
-            name: path.basename(usedPath),
-            lastUsedAt: new Date().toISOString()
+            path: resolvedRecentPath,
+            name: path.basename(resolvedRecentPath),
+            lastUsedAt: new Date().toISOString(),
         };
         recent.unshift(newRecent);
-        // Keep only last N entries
         recent = recent.slice(0, MAX_RECENT_PATHS);
         storage.setConfigValue("recent_paths", JSON.stringify(recent));
         res.json(newRecent);
     });
-    // ============ Path Validation API ============
     app.get("/api/validate-path", async (req, res) => {
         const inputPath = typeof req.query.path === "string" ? req.query.path : "";
         if (!inputPath.trim()) {
@@ -517,18 +688,21 @@ self.addEventListener('fetch', (event) => {
             return;
         }
         try {
-            const resolvedPath = path.resolve(inputPath);
-            const stats = await import("node:fs/promises").then(fs => fs.stat(resolvedPath));
+            const resolvedPath = normalizeFolderPath(inputPath);
+            if (isBlockedFolderPath(resolvedPath)) {
+                res.json({ valid: false, error: "访问被拒绝：无法访问系统敏感目录。", resolvedPath });
+                return;
+            }
+            const stats = await import("node:fs/promises").then((fs) => fs.stat(resolvedPath));
             if (!stats.isDirectory()) {
                 res.json({ valid: false, error: "路径不是目录", resolvedPath });
                 return;
             }
-            // Check read permission
             try {
                 await readdir(resolvedPath);
                 res.json({ valid: true, resolvedPath, name: path.basename(resolvedPath) });
             }
-            catch (permError) {
+            catch {
                 res.json({ valid: false, error: "没有读取权限", resolvedPath });
             }
         }
@@ -545,16 +719,14 @@ self.addEventListener('fetch', (event) => {
             }
         }
     });
-    // File search API - supports fuzzy matching across directory tree
     app.get("/api/file-search", async (req, res) => {
         const query = typeof req.query.q === "string" ? req.query.q : "";
         const cwd = typeof req.query.cwd === "string" ? req.query.cwd : process.cwd();
         const maxDepth = typeof req.query.depth === "string" ? parseInt(req.query.depth, 10) : 5;
         const maxResults = typeof req.query.limit === "string" ? parseInt(req.query.limit, 10) : 50;
-        // Security check: ensure cwd is within allowed base
         const allowedBase = process.cwd();
         const resolvedCwd = path.resolve(allowedBase, cwd);
-        if (!resolvedCwd.startsWith(allowedBase)) {
+        if (!isPathWithinBase(resolvedCwd, allowedBase)) {
             res.status(403).json({ error: "访问被拒绝：路径必须在项目目录内。" });
             return;
         }
@@ -565,7 +737,6 @@ self.addEventListener('fetch', (event) => {
         try {
             const results = [];
             const queryLower = query.toLowerCase();
-            // Recursive search function
             async function searchDir(dirPath, currentDepth) {
                 if (currentDepth > maxDepth || results.length >= maxResults)
                     return;
@@ -573,29 +744,25 @@ self.addEventListener('fetch', (event) => {
                 for (const entry of entries) {
                     if (results.length >= maxResults)
                         break;
-                    // Skip hidden files and node_modules
                     if (entry.name.startsWith(".") || entry.name === "node_modules")
                         continue;
                     const entryPath = path.join(dirPath, entry.name);
                     const nameLower = entry.name.toLowerCase();
-                    // Check if name matches query (fuzzy match)
                     const matchIndex = nameLower.indexOf(queryLower);
                     if (matchIndex !== -1) {
                         results.push({
                             path: entryPath,
                             name: entry.name,
                             type: entry.isDirectory() ? "dir" : "file",
-                            matchScore: matchIndex // Lower score = better match (appears earlier in name)
+                            matchScore: matchIndex,
                         });
                     }
-                    // Recurse into directories
                     if (entry.isDirectory()) {
                         await searchDir(entryPath, currentDepth + 1);
                     }
                 }
             }
             await searchDir(resolvedCwd, 0);
-            // Sort by match score (earlier match = better) and then alphabetically
             results.sort((a, b) => {
                 if (a.matchScore !== b.matchScore)
                     return a.matchScore - b.matchScore;
@@ -607,23 +774,7 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "搜索失败。可能原因：路径不存在或权限不足。") });
         }
     });
-    app.get("/api/sessions/:id", (req, res) => {
-        const snapshot = processes.get(req.params.id);
-        if (!snapshot) {
-            res.status(404).json({ error: "未找到该会话，可能已被删除。" });
-            return;
-        }
-        if (req.query.format === "chat") {
-            // Prefer structured messages from JSON chat mode, fall back to PTY parsing
-            const messages = snapshot.messages && snapshot.messages.length > 0
-                ? snapshot.messages
-                : parseMessages(snapshot.output);
-            res.json({ ...snapshot, messages });
-        }
-        else {
-            res.json(snapshot);
-        }
-    });
+    // ── Session control ──
     app.post("/api/commands", (req, res) => {
         const body = req.body;
         if (!body.command?.trim()) {
@@ -636,17 +787,103 @@ self.addEventListener('fetch', (event) => {
             res.status(201).json(snapshot);
         }
         catch (error) {
-            res.status(400).json({ error: getErrorMessage(error, "无法启动命令。请检查命令是否正确安装。") });
+            res.status(400).json({ error: getErrorMessage(error, "无法启动命令。请检查命令是否安装。") });
+        }
+    });
+    app.post("/api/sessions/:id/resume", (req, res) => {
+        const sessionId = req.params.id;
+        const body = req.body;
+        try {
+            const existingSession = processes.get(sessionId) || storage.getSession(sessionId);
+            if (!existingSession) {
+                res.status(404).json({ error: "会话不存在。" });
+                return;
+            }
+            const claudeSessionId = existingSession.claudeSessionId;
+            if (!claudeSessionId) {
+                res.status(400).json({ error: "此会话没有 Claude 会话 ID，无法恢复。" });
+                return;
+            }
+            const command = existingSession.command.trim();
+            if (!/^claude\b/.test(command)) {
+                res.status(400).json({ error: "只有 Claude 命令支持恢复功能。" });
+                return;
+            }
+            const newMode = body.mode
+                ? normalizeMode(body.mode, config.defaultMode)
+                : normalizeMode(existingSession.mode, config.defaultMode);
+            const resumeCommand = `${command} --resume ${claudeSessionId}`;
+            const newSnapshot = processes.start(resumeCommand, existingSession.cwd, newMode, undefined, { resumedFromSessionId: sessionId });
+            storage.saveSession({ ...existingSession, resumedToSessionId: newSnapshot.id });
+            res.status(201).json({ resumedFromSessionId: sessionId, ...newSnapshot });
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "无法恢复会话。") });
+        }
+    });
+    app.post("/api/claude-sessions/:claudeSessionId/resume", (req, res) => {
+        const claudeSessionId = String(req.params.claudeSessionId || "").trim();
+        const body = req.body;
+        try {
+            if (!claudeSessionId) {
+                res.status(400).json({ error: "Claude 会话 ID 不能为空。" });
+                return;
+            }
+            const existingSession = storage.getLatestSessionByClaudeSessionId(claudeSessionId);
+            if (existingSession) {
+                const command = existingSession.command.trim();
+                if (!/^claude\b/.test(command)) {
+                    res.status(400).json({ error: "只有 Claude 命令支持按 Claude Session ID 恢复。" });
+                    return;
+                }
+                if (!existingSession.cwd || !processes.hasClaudeSessionFile(existingSession.cwd, claudeSessionId)) {
+                    res.status(400).json({ error: "对应的 Claude 历史会话文件不存在，无法恢复。" });
+                    return;
+                }
+                const newMode = body.mode
+                    ? normalizeMode(body.mode, config.defaultMode)
+                    : normalizeMode(existingSession.mode, config.defaultMode);
+                const resumeCommand = `${command} --resume ${claudeSessionId}`;
+                const newSnapshot = processes.start(resumeCommand, existingSession.cwd, newMode, undefined, { resumedFromSessionId: existingSession.id });
+                storage.saveSession({ ...existingSession, resumedToSessionId: newSnapshot.id });
+                res.status(201).json({ resumedFromSessionId: existingSession.id, resumedClaudeSessionId: claudeSessionId, ...newSnapshot });
+            }
+            else {
+                // No existing wand session — resume directly with cwd from request body
+                const cwd = body.cwd?.trim();
+                if (!cwd) {
+                    res.status(400).json({ error: "未找到对应的会话记录，请提供工作目录 (cwd)。" });
+                    return;
+                }
+                const newMode = normalizeMode(body.mode, config.defaultMode);
+                const resumeCommand = `claude --resume ${claudeSessionId}`;
+                const newSnapshot = processes.start(resumeCommand, cwd, newMode);
+                res.status(201).json({ resumedClaudeSessionId: claudeSessionId, ...newSnapshot });
+            }
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "无法按 Claude 会话 ID 恢复会话。") });
         }
     });
     app.post("/api/sessions/:id/input", (req, res) => {
         const body = req.body;
+        const sessionId = req.params.id;
+        const input = body.input ?? "";
+        const view = body.view;
+        console.error("[wand] Input request received", { sessionId, inputLength: input.length, view: view ?? "chat" });
         try {
-            const snapshot = processes.sendInput(req.params.id, body.input ?? "", body.view);
+            const snapshot = processes.sendInput(sessionId, input, view);
+            console.error("[wand] Input request succeeded", { sessionId, status: snapshot.status, inputLength: input.length, view: view ?? "chat" });
             res.json(snapshot);
         }
         catch (error) {
-            res.status(400).json({ error: getErrorMessage(error, "会话已结束，请启动新会话。") });
+            const response = getInputErrorResponse(error, sessionId);
+            console.error("[wand] Input request failed", {
+                sessionId, inputLength: input.length, view: view ?? "chat",
+                responseStatus: response.statusCode, responsePayload: response.payload,
+                error: getInputDebugMeta(error),
+            });
+            res.status(response.statusCode).json(response.payload);
         }
     });
     app.post("/api/sessions/:id/resize", (req, res) => {
@@ -659,10 +896,35 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "无法调整终端大小。") });
         }
     });
+    app.post("/api/sessions/:id/approve-permission", (req, res) => {
+        try {
+            res.json(processes.approvePermission(req.params.id));
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "无法批准该授权请求。") });
+        }
+    });
+    app.post("/api/sessions/:id/deny-permission", (req, res) => {
+        try {
+            res.json(processes.denyPermission(req.params.id));
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "无法拒绝该授权请求。") });
+        }
+    });
+    app.post("/api/sessions/:id/escalations/:requestId/resolve", (req, res) => {
+        try {
+            const { requestId } = req.params;
+            const body = req.body;
+            res.json(processes.resolveEscalation(req.params.id, requestId, body.resolution));
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, "无法处理该授权请求。") });
+        }
+    });
     app.post("/api/sessions/:id/stop", (req, res) => {
         try {
-            const snapshot = processes.stop(req.params.id);
-            res.json(snapshot);
+            res.json(processes.stop(req.params.id));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法停止会话。") });
@@ -677,8 +939,7 @@ self.addEventListener('fetch', (event) => {
             res.status(400).json({ error: getErrorMessage(error, "无法删除会话。") });
         }
     });
-    await processes.runStartupCommands();
-    // Create server (HTTP or HTTPS) - useHttps and protocol already defined above
+    // ── WebSocket broadcast layer ──
     const server = useHttps
         ? (() => {
             const ssl = ensureCertificates(resolveConfigDir(configPath));
@@ -686,129 +947,13 @@ self.addEventListener('fetch', (event) => {
         })()
         : createHttpServer(app);
     const wss = new WebSocketServer({ server, path: "/ws" });
-    const wsClients = new Set();
-    const MAX_QUEUE_SIZE = 500; // Max messages in queue before applying backpressure
-    const OUTPUT_DEBOUNCE_MS = 50; // Debounce PTY output updates to reduce flicker
-    // Output debounce cache - batch rapid output events per session
-    const outputDebounceCache = new Map();
-    // Process send queue for a WebSocket client
-    function processWsQueue(client) {
-        if (client.sendInProgress || client.sendQueue.length === 0 || client.backpressurePaused) {
-            return;
-        }
-        client.sendInProgress = true;
-        const message = client.sendQueue.shift();
-        if (client.ws.readyState === WebSocket.OPEN) {
-            client.ws.send(message, (err) => {
-                client.sendInProgress = false;
-                if (err) {
-                    // Error sending, drop message
-                    return;
-                }
-                // Check backpressure threshold
-                const threshold = MAX_QUEUE_SIZE * 0.8;
-                if (client.backpressurePaused && client.sendQueue.length < threshold) {
-                    client.backpressurePaused = false;
-                }
-                // Continue processing queue
-                processWsQueue(client);
-            });
-        }
-        else {
-            client.sendInProgress = false;
-        }
-    }
-    // Broadcast process events to WebSocket clients with debouncing and backpressure control
+    const wsManager = new WsBroadcastManager(wss);
+    wsManager.setup((id) => processes.get(id));
+    // Wire process events to WebSocket broadcast
     processes.on("process", (event) => {
-        // Debounce output events to reduce flicker during rapid streaming
-        if (event.type === "output") {
-            const existing = outputDebounceCache.get(event.sessionId);
-            if (existing) {
-                clearTimeout(existing.timer);
-            }
-            const timer = setTimeout(() => {
-                outputDebounceCache.delete(event.sessionId);
-                broadcastEvent(event);
-            }, OUTPUT_DEBOUNCE_MS);
-            outputDebounceCache.set(event.sessionId, { event, timer });
-            return;
-        }
-        // Non-output events (started, ended, status) are sent immediately
-        broadcastEvent(event);
+        wsManager.emitEvent(event);
     });
-    function broadcastEvent(event) {
-        const message = JSON.stringify(event);
-        for (const client of wsClients) {
-            if (client.ws.readyState === WebSocket.OPEN) {
-                // Apply backpressure if queue is too large
-                if (client.sendQueue.length >= MAX_QUEUE_SIZE) {
-                    client.backpressurePaused = true;
-                    continue;
-                }
-                if (!client.backpressurePaused) {
-                    client.sendQueue.push(message);
-                    processWsQueue(client);
-                }
-            }
-        }
-    }
-    wss.on("connection", (ws, req) => {
-        const sessionToken = readSessionCookie(req);
-        if (!sessionToken || !validateSession(sessionToken)) {
-            ws.close(1008, "Unauthorized");
-            return;
-        }
-        const client = {
-            ws,
-            sendQueue: [],
-            sendInProgress: false,
-            backpressurePaused: false,
-            lastOutputBySession: new Map()
-        };
-        wsClients.add(client);
-        ws.on("close", () => {
-            wsClients.delete(client);
-        });
-        ws.on("error", () => {
-            // Already closed, ignore
-        });
-        ws.on("message", (data) => {
-            try {
-                const msg = JSON.parse(data.toString());
-                // Handle subscribe/unsubscribe for specific sessions
-                if (msg.type === "subscribe" && msg.sessionId) {
-                    // Client wants updates for a specific session
-                    const snapshot = processes.get(msg.sessionId);
-                    if (snapshot) {
-                        // Send full session snapshot including messages for reconnection recovery
-                        ws.send(JSON.stringify({
-                            type: "init",
-                            sessionId: msg.sessionId,
-                            data: {
-                                ...snapshot,
-                                // Ensure messages are included for chat mode recovery
-                                messages: snapshot.messages,
-                                // Include full output for terminal mode recovery
-                                output: snapshot.output
-                            }
-                        }));
-                    }
-                    else {
-                        // Session not found - might be deleted or never existed
-                        ws.send(JSON.stringify({
-                            type: "error",
-                            sessionId: msg.sessionId,
-                            error: "Session not found"
-                        }));
-                    }
-                }
-            }
-            catch {
-                // Ignore malformed messages
-            }
-        });
-    });
-    // Start server
+    // ── Start listening ──
     await new Promise((resolve, reject) => {
         server.listen(config.port, config.host, () => {
             const listenAddr = config.host === "0.0.0.0" ? "0.0.0.0 (所有接口)" : config.host;
@@ -824,52 +969,9 @@ self.addEventListener('fetch', (event) => {
             reject(err);
         });
     });
-    // Print security warnings
     if (!storage.hasCustomPassword() && config.password === "change-me") {
         wandWarn("正在使用默认密码（change-me），任何能访问本机的人都可以登录。", "修改方法：在界面右上角「设置」中修改密码，或运行：node dist/cli.js config:set password <你的新密码>");
     }
-}
-function requireAuth(req, res, next) {
-    if (!validateSession(readSessionCookie(req))) {
-        res.status(401).json({ error: "未授权，请先登录。" });
-        return;
-    }
-    next();
-}
-function normalizeMode(input, fallback) {
-    return isExecutionMode(input) ? input : fallback;
-}
-function readSessionCookie(req) {
-    const cookie = req.headers.cookie;
-    if (!cookie) {
-        return undefined;
-    }
-    const match = cookie
-        .split(";")
-        .map((part) => part.trim())
-        .find((part) => part.startsWith("wand_session="));
-    return match?.slice("wand_session=".length);
-}
-async function listPathSuggestions(input, fallbackCwd) {
-    const normalizedInput = input.trim();
-    const baseInput = normalizedInput || fallbackCwd;
-    const resolvedInput = path.resolve(process.cwd(), baseInput);
-    const endsWithSeparator = /[\\/]$/.test(normalizedInput);
-    let searchDir = resolvedInput;
-    let partialName = "";
-    if (!endsWithSeparator) {
-        searchDir = path.dirname(resolvedInput);
-        partialName = path.basename(resolvedInput);
-    }
-    const entries = await readdir(searchDir, { withFileTypes: true });
-    return entries
-        .filter((entry) => entry.isDirectory())
-        .filter((entry) => !partialName || entry.name.toLowerCase().startsWith(partialName.toLowerCase()))
-        .sort((a, b) => a.name.localeCompare(b.name))
-        .slice(0, 8)
-        .map((entry) => ({
-        path: path.join(searchDir, entry.name),
-        name: entry.name,
-        isDirectory: true
-    }));
+    // Start configured background sessions after the server is already reachable.
+    processes.runStartupCommands();
 }