@co0ontty/wand 4.43.0 → 4.44.0

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "c05b4f15f592f2c4f335df60c46208a7e0ea82fc",
-  "builtAt": "2026-08-22T00:47:50.129Z",
-  "version": "4.43.0",
+  "commit": "1fe712a2510fcedc297a8256f101b7c1638cf552",
+  "builtAt": "2026-08-22T02:47:13.556Z",
+  "version": "4.44.0",
   "channel": "stable"
 }

package/dist/cli.js

@@ -177,6 +177,7 @@ async function main() {
         case "session:read":
         case "session:send":
         case "session:wait":
+        case "inbox:list":
         case "mission:list":
         case "mission:create":
         case "mission:diff":
@@ -224,6 +225,7 @@ Commands:
 
 Agent runtime:
   wand session:list         List sessions as JSON
+  wand inbox:list           List mission inbox items as JSON
   wand session:read <id>    Read a complete session snapshot
   wand session:send <id> <text>
   wand session:wait <id> [--timeout 900]
@@ -260,6 +262,7 @@ async function runAgentCliCommand(command, args, configPath) {
         return value;
     };
     switch (command) {
+        case "inbox:list": return output(await api.get("/api/inbox"));
         case "session:list": return output(await api.get("/api/sessions"));
         case "session:read": {
             const id = required(args[1], "wand session:read <id>");

package/dist/missions.d.ts

@@ -1,4 +1,4 @@
-import type { CreateMissionInput, CreateReviewCommentInput, MissionDetails, MissionDiff, MissionReviewComment } from "./mission-types.js";
+import type { AgentActivityItem, CreateMissionInput, CreateReviewCommentInput, MissionDetails, MissionDiff, MissionReviewComment } from "./mission-types.js";
 import type { SessionRegistry } from "./session-registry.js";
 import type { StructuredSessionManager } from "./structured-session-manager.js";
 import type { WandStorage } from "./storage.js";
@@ -16,6 +16,8 @@ export declare class Missions {
     get(id: string): MissionDetails | null;
     create(input: CreateMissionInput): MissionDetails;
     ingest(event: ProcessEvent): void;
+    inbox(): AgentActivityItem[];
+    markInboxRead(sessionId?: string): void;
     diff(missionId: string, attemptId: string): MissionDiff;
     addReviewComment(missionId: string, attemptId: string, input: CreateReviewCommentInput): MissionReviewComment;
     sendReview(missionId: string, attemptId: string, commentIds?: string[]): MissionReviewComment[];

package/dist/missions.js

@@ -165,8 +165,26 @@ export class Missions {
             error: state === "failed" ? snapshot.structuredState?.lastError ?? "任务执行失败" : null,
             updatedAt,
         });
+        this.storage.upsertAgentActivity({
+            sessionId: event.sessionId,
+            missionId: attempt.missionId,
+            attemptId: attempt.id,
+            state,
+            title: snapshot.title?.trim() || snapshot.summary?.trim() || firstPromptLine(this.storage.getMission(attempt.missionId)?.prompt ?? ""),
+            summary: sessionSummary(snapshot),
+            provider: snapshot.provider ?? attempt.provider,
+            cwd: snapshot.cwd,
+            updatedAt,
+            readAt: null,
+        });
         this.refreshMissionStatus(attempt.missionId);
     }
+    inbox() {
+        return this.storage.listAgentActivity();
+    }
+    markInboxRead(sessionId) {
+        this.storage.markAgentActivityRead(sessionId);
+    }
     diff(missionId, attemptId) {
         const attempt = this.requireAttempt(missionId, attemptId);
         if (!attempt.worktreePath || !attempt.baseRef)

package/dist/password-manager.d.ts

@@ -77,6 +77,10 @@ export interface PasswordGeneratorOptions {
     digits?: boolean;
     symbols?: boolean;
 }
+/** AES-256-GCM at-rest wrapper. Legacy plaintext values pass through on read. */
+export declare function encryptVaultSecret(plaintext: string, secret: string): string;
+export declare function decryptVaultSecret(value: string | undefined, secret: string | null): string | undefined;
+export declare function isEncryptedVaultSecret(value: string | undefined): boolean;
 export declare function generatePassword(options?: PasswordGeneratorOptions): string;
 export declare function generateTotpCode(secret: string, timeMs?: number, digits?: number, period?: number): string;
 export declare function decodeTotpSecret(secret: string): Buffer;

package/dist/password-manager.js

@@ -240,6 +240,43 @@ export function buildPasswordSecurityReport(items, now = Date.now()) {
         issues: issues.sort((a, b) => issueRank(b.severity) - issueRank(a.severity)),
     };
 }
+const VAULT_CIPHER_PREFIX = "enc:v1:";
+function deriveVaultKey(secret) {
+    return crypto.createHash("sha256").update(secret, "utf8").digest();
+}
+/** AES-256-GCM at-rest wrapper. Legacy plaintext values pass through on read. */
+export function encryptVaultSecret(plaintext, secret) {
+    if (!plaintext || !secret)
+        return plaintext;
+    if (plaintext.startsWith(VAULT_CIPHER_PREFIX))
+        return plaintext;
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv("aes-256-gcm", deriveVaultKey(secret), iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return `${VAULT_CIPHER_PREFIX}${iv.toString("base64url")}.${cipher.getAuthTag().toString("base64url")}.${encrypted.toString("base64url")}`;
+}
+export function decryptVaultSecret(value, secret) {
+    if (!value)
+        return undefined;
+    if (!value.startsWith(VAULT_CIPHER_PREFIX))
+        return value;
+    if (!secret)
+        return undefined;
+    try {
+        const [ivB64, tagB64, dataB64] = value.slice(VAULT_CIPHER_PREFIX.length).split(".");
+        if (!ivB64 || !tagB64 || !dataB64)
+            return undefined;
+        const decipher = crypto.createDecipheriv("aes-256-gcm", deriveVaultKey(secret), Buffer.from(ivB64, "base64url"));
+        decipher.setAuthTag(Buffer.from(tagB64, "base64url"));
+        return Buffer.concat([decipher.update(Buffer.from(dataB64, "base64url")), decipher.final()]).toString("utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isEncryptedVaultSecret(value) {
+    return typeof value === "string" && value.startsWith(VAULT_CIPHER_PREFIX);
+}
 export function generatePassword(options = {}) {
     const length = clampInteger(options.length ?? 20, 8, 80);
     const lower = "abcdefghijkmnopqrstuvwxyz";

package/dist/server-file-routes.js

@@ -7,7 +7,7 @@ import process from "node:process";
 import { promisify } from "node:util";
 import { getErrorMessage } from "./error-utils.js";
 import { asyncRoute } from "./express-async.js";
-import { isBlockedFolderPath, isPathWithinBase, normalizeFolderPath } from "./middleware/path-safety.js";
+import { isBlockedFolderPath, normalizeFolderPath } from "./middleware/path-safety.js";
 import { parseBoundedInteger } from "./request-limits.js";
 const execAsync = promisify(exec);
 const DIRECTORY_MAX_ITEMS = 200;
@@ -493,15 +493,21 @@ export function registerFileRoutes(app, deps) {
     }));
     app.get("/api/file-search", asyncRoute(async (req, res) => {
         const query = typeof req.query.q === "string" ? req.query.q.trim().slice(0, 256) : "";
-        const cwd = typeof req.query.cwd === "string" ? req.query.cwd : process.cwd();
+        const cwd = typeof req.query.cwd === "string" ? req.query.cwd : defaultCwd;
         const maxDepth = parseBoundedInteger(req.query.depth, 5, 0, 8);
         const maxResults = parseBoundedInteger(req.query.limit, 50, 1, 200);
         const ignoredDirectories = new Set([".git", "node_modules", ".next", "dist", "build", "coverage", ".wand-uploads"]);
         const maxVisitedEntries = 20_000;
-        const allowedBase = process.cwd();
-        const resolvedCwd = path.resolve(allowedBase, cwd);
-        if (!isPathWithinBase(resolvedCwd, allowedBase)) {
-            res.status(403).json({ error: "访问被拒绝：路径必须在项目目录内。" });
+        let resolvedCwd;
+        try {
+            resolvedCwd = normalizeFolderPath(cwd);
+        }
+        catch {
+            res.status(400).json({ error: "无效的搜索目录。" });
+            return;
+        }
+        if (isBlockedFolderPath(resolvedCwd)) {
+            res.status(403).json({ error: "访问被拒绝：不能搜索系统目录。" });
             return;
         }
         if (!query) {

package/dist/server-mission-routes.js

@@ -6,9 +6,11 @@ function sendMissionError(res, error) {
 }
 export function registerMissionRoutes(app, missions) {
     app.get("/api/inbox", (_req, res) => {
-        res.json({ items: [] });
+        res.json({ items: missions.inbox() });
     });
-    app.post("/api/inbox/read", (_req, res) => {
+    app.post("/api/inbox/read", (req, res) => {
+        const sessionId = typeof req.body?.sessionId === "string" ? req.body.sessionId.trim() : "";
+        missions.markInboxRead(sessionId || undefined);
         res.json({ ok: true });
     });
     app.get("/api/missions", (_req, res) => {

package/dist/server-session-routes.js

@@ -1067,7 +1067,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
                 return;
             }
             const newSnapshot = await startResumedPtySession(processes, storage, existingSession, sessionId, defaultMode, body);
-            res.status(201).json(newSnapshot);
+            res.status(201).json(sessionResponseDTO(newSnapshot));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法恢复会话。") });
@@ -1316,6 +1316,50 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
             res.status(400).json({ error: getErrorMessage(error, "无法按 Qoder 会话 ID 恢复会话。") });
         }
     });
+    const resumeNamedStructuredSession = (req, res, spec) => {
+        const sessionId = String(req.params.sessionId || "").trim();
+        const body = req.body;
+        try {
+            if (!isSafeProviderSessionId(sessionId)) {
+                res.status(400).json({ error: `${spec.label} 会话 ID 格式无效。` });
+                return;
+            }
+            const cwd = body.cwd?.trim();
+            if (!cwd) {
+                res.status(400).json({ error: "无法确定工作目录 (cwd)，无法恢复。" });
+                return;
+            }
+            const snapshot = structured.createSession({
+                cwd,
+                mode: parseExecutionMode(body.mode, defaultMode),
+                provider: spec.provider,
+                runner: spec.runner,
+                worktreeEnabled: body.worktreeEnabled === true,
+                claudeSessionId: sessionId,
+                workspaceId: resolveWorkspaceIdForNewSession(storage, cwd),
+                ...parseSessionCreationOrigin(body),
+            });
+            onSessionCreated?.(cwd);
+            res.status(201).json({ resumedClaudeSessionId: sessionId, ...sessionResponseDTO(snapshot) });
+        }
+        catch (error) {
+            res.status(400).json({ error: getErrorMessage(error, `无法按 ${spec.label} 会话 ID 恢复会话。`) });
+        }
+    };
+    app.post("/api/grok-sessions/:sessionId/resume", (req, res) => {
+        resumeNamedStructuredSession(req, res, {
+            provider: "grok",
+            runner: "grok-cli-headless",
+            label: "Grok",
+        });
+    });
+    app.post("/api/pi-sessions/:sessionId/resume", (req, res) => {
+        resumeNamedStructuredSession(req, res, {
+            provider: "pi",
+            runner: "pi-cli-json",
+            label: "Pi",
+        });
+    });
     app.post("/api/sessions/:id/resize", (req, res) => {
         const body = req.body;
         try {
@@ -1333,7 +1377,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
     app.post("/api/sessions/:id/approve-permission", (req, res) => {
         try {
             if (sessions.ownerOf(req.params.id) === "structured") {
-                res.status(400).json({ error: "结构化会话不需要终端权限操作。" });
+                res.status(404).json({ error: "结构化会话没有运行时授权请求。" });
                 return;
             }
             const snapshot = sessions.get(req.params.id);
@@ -1341,7 +1385,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
                 res.status(400).json({ error: "Codex provider 不支持权限批准操作。" });
                 return;
             }
-            res.json(processes.approvePermission(req.params.id));
+            res.json(sessionResponseDTO(processes.approvePermission(req.params.id)));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法批准该授权请求。") });
@@ -1350,7 +1394,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
     app.post("/api/sessions/:id/deny-permission", (req, res) => {
         try {
             if (sessions.ownerOf(req.params.id) === "structured") {
-                res.status(400).json({ error: "结构化会话不需要终端权限操作。" });
+                res.status(404).json({ error: "结构化会话没有运行时授权请求。" });
                 return;
             }
             const snapshot = sessions.get(req.params.id);
@@ -1358,7 +1402,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
                 res.status(400).json({ error: "Codex provider 不支持权限拒绝操作。" });
                 return;
             }
-            res.json(processes.denyPermission(req.params.id));
+            res.json(sessionResponseDTO(processes.denyPermission(req.params.id)));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法拒绝该授权请求。") });
@@ -1367,7 +1411,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
     app.post("/api/sessions/:id/toggle-auto-approve", (req, res) => {
         try {
             if (sessions.ownerOf(req.params.id) === "structured") {
-                res.status(400).json({ error: "结构化会话不需要切换终端自动批准。" });
+                res.status(404).json({ error: "结构化会话没有运行时授权请求。" });
                 return;
             }
             const snapshot = sessions.get(req.params.id);
@@ -1375,7 +1419,7 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
                 res.status(400).json({ error: "Codex provider 不支持自动批准切换。" });
                 return;
             }
-            res.json(processes.toggleAutoApprove(req.params.id));
+            res.json(sessionResponseDTO(processes.toggleAutoApprove(req.params.id)));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法切换自动批准状态。") });
@@ -1391,10 +1435,10 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
                 return;
             }
             if (sessions.ownerOf(req.params.id) === "structured") {
-                res.json(structured.resolveEscalation(req.params.id, requestId, resolution));
+                res.status(404).json({ error: "结构化会话没有运行时授权请求。" });
                 return;
             }
-            res.json(processes.resolveEscalation(req.params.id, requestId, resolution));
+            res.json(sessionResponseDTO(processes.resolveEscalation(req.params.id, requestId, resolution)));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法处理该授权请求。") });
@@ -1403,10 +1447,10 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
     app.post("/api/sessions/:id/stop", (req, res) => {
         try {
             if (sessions.ownerOf(req.params.id) === "structured") {
-                res.json(structured.stop(req.params.id));
+                res.json(sessionResponseDTO(structured.stop(req.params.id)));
                 return;
             }
-            res.json(processes.stop(req.params.id));
+            res.json(sessionResponseDTO(processes.stop(req.params.id)));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法停止会话。") });
@@ -1423,8 +1467,9 @@ export function registerSessionRoutes(app, processes, structured, storage, defau
     });
 }
 export function registerClaudeHistoryRoutes(app, processes, _structured, storage, _sessionRegistry) {
-    // Kept as an empty compatibility endpoint for older native clients. Wand no
-    // longer imports provider-native history into its session list.
+    // Intentional compatibility stub: older native clients still GET these
+    // endpoints. Wand no longer imports provider-native history into its session
+    // list, so the supported response remains an empty array.
     app.get("/api/claude-history", (_req, res) => {
         res.json([]);
     });
@@ -1595,6 +1640,11 @@ export function registerClaudeHistoryRoutes(app, processes, _structured, storage
             remove: (ids) => processes.deleteQoderHistoryFiles(ids),
         },
     ];
+    for (const provider of ["grok", "pi"]) {
+        app.get(`/api/${provider}-history`, (_req, res) => {
+            res.json([]);
+        });
+    }
     for (const config of externalHistoryProviders) {
         app.get(`/api/${config.provider}-history`, (_req, res) => {
             res.json([]);

package/dist/server-update-routes.js

@@ -36,7 +36,7 @@ export function registerPublicUpdateRoutes(app, deps) {
         });
     }));
     app.get("/android/download", asyncRoute(async (req, res) => {
-        const channel = req.query.channel === "stable" ? "stable" : "beta";
+        const channel = req.query.channel === "beta" ? "beta" : "stable";
         const asset = await deps.resolveAndroidDownload(channel);
         if (!asset) {
             res.status(404).json({ error: "当前没有可下载的 APK 文件。" });

package/dist/server.js

@@ -37,10 +37,11 @@ import { computeRelaunch } from "./relaunch.js";
 import { RuntimeConfigState } from "./runtime-config.js";
 import { isServiceInstalled } from "./tui/commands.js";
 import { checkManagedServiceUpdatePreflight, } from "./update-helper.js";
+import { toSessionDetailDTO } from "./session-transport.js";
 import { registerUploadRoutes } from "./upload-routes.js";
 import { optimizePrompt, PromptOptimizeError } from "./prompt-optimizer.js";
 import { resolveDatabasePath, WandStorage } from "./storage.js";
-import { DEFAULT_BROWSER_EXTENSION_BASE_URL, buildPasswordSecurityReport, generatePassword, generateTotpCode, normalizePasswordItemType, } from "./password-manager.js";
+import { buildPasswordSecurityReport, generatePassword, generateTotpCode, normalizePasswordItemType, } from "./password-manager.js";
 import { deepRepairRuntimePath, formatPathRepairSummary, repairRuntimePath } from "./path-repair.js";
 import { DistributionManager } from "./distribution-manager.js";
 import { isLogBusActive, wandTuiLog } from "./tui/log-bus.js";
@@ -254,10 +255,19 @@ function authenticateBearerAppToken(req, storage, config) {
         return null;
     }
 }
-function appTokenLoginPayload(storage, config) {
+function resolveRequestServerUrl(req, config, useHttps) {
+    const requestProtocol = getPublicRequestProtocol(req, useHttps ? "https" : "http");
+    const requestHost = getPublicRequestHost(req, config);
+    const originHeader = firstHeaderValue(req.headers.origin);
+    const browserOrigin = isBrowserExtensionOrigin(originHeader)
+        ? undefined
+        : normalizePublicOrigin(originHeader);
+    return resolveAppConnectOrigin(browserOrigin ?? `${requestProtocol}://${requestHost}`, config);
+}
+function appTokenLoginPayload(req, storage, config, useHttps) {
     return {
         appToken: generateAppToken(getEffectivePassword(storage, config), config.appSecret ?? ""),
-        serverUrl: DEFAULT_BROWSER_EXTENSION_BASE_URL,
+        serverUrl: resolveRequestServerUrl(req, config, useHttps),
     };
 }
 // ── App connection token helpers ──
@@ -563,7 +573,7 @@ export async function startServer(config, configPath, options = {}) {
         res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
         res.type("html").send(renderApp(configPath));
     });
-    app.get("/api/structured-chat-avatar/:role", asyncRoute(async (req, res) => {
+    app.get("/api/structured-chat-avatar/:role", requireAuth, asyncRoute(async (req, res) => {
         const role = req.params.role === "user" || req.params.role === "assistant"
             ? req.params.role
             : null;
@@ -662,7 +672,7 @@ export async function startServer(config, configPath, options = {}) {
         res.json({
             ok: true,
             principal,
-            ...(client === "browser-extension" ? appTokenLoginPayload(storage, config) : {}),
+            ...(client === "browser-extension" ? appTokenLoginPayload(req, storage, config, useHttps) : {}),
         });
     });
     app.post("/api/logout", (req, res) => {
@@ -700,17 +710,28 @@ export async function startServer(config, configPath, options = {}) {
         "/api/config",
         "/api/models",
         "/api/sessions",
+        "/api/session-list",
         "/api/session-directories",
         "/api/structured-sessions",
         "/api/commands",
         "/api/claude-skills",
         "/api/claude-history",
         "/api/codex-history",
+        "/api/opencode-history",
+        "/api/qoder-history",
+        "/api/grok-history",
+        "/api/pi-history",
         "/api/claude-sessions",
         "/api/codex-sessions",
+        "/api/opencode-sessions",
+        "/api/qoder-sessions",
+        "/api/grok-sessions",
+        "/api/pi-sessions",
         "/api/optimize-prompt",
         "/api/inbox",
         "/api/missions",
+        "/api/workspaces",
+        "/api/workspace-tasks",
     ], requireSessions);
     app.use([
         "/api/directory",
@@ -720,6 +741,13 @@ export async function startServer(config, configPath, options = {}) {
         "/api/file-preview",
         "/api/file-raw",
         "/api/file-write",
+        "/api/file-create",
+        "/api/dir-create",
+        "/api/file-rename",
+        "/api/file-delete",
+        "/api/quick-paths",
+        "/api/validate-path",
+        "/api/file-search",
     ], requireFiles);
     app.use("/api/browser-extension", requirePasswordVault);
     // ── Config & Session info ──
@@ -774,10 +802,10 @@ export async function startServer(config, configPath, options = {}) {
             res.status(400).json({ error: getErrorMessage(error, "无法读取 skills。") });
         }
     });
-    app.get("/api/browser-extension/status", (_req, res) => {
+    app.get("/api/browser-extension/status", (req, res) => {
         res.json({
             ok: true,
-            serverUrl: DEFAULT_BROWSER_EXTENSION_BASE_URL,
+            serverUrl: resolveRequestServerUrl(req, config, useHttps),
             features: {
                 loginAutofill: true,
                 saveLogins: true,
@@ -1044,7 +1072,7 @@ export async function startServer(config, configPath, options = {}) {
                     ...origin,
                 }));
             recordRecentPath(storage, snapshot.cwd);
-            res.status(201).json(snapshot);
+            res.status(201).json(toSessionDetailDTO(snapshot));
         }
         catch (error) {
             res.status(400).json({ error: getErrorMessage(error, "无法启动命令。请检查命令是否安装。") });
@@ -1098,7 +1126,7 @@ export async function startServer(config, configPath, options = {}) {
             concurrencyLimit: 10,
         },
     });
-    const wsManager = new WsBroadcastManager(wss, () => config.cardDefaults ?? {}, useHttps, authService);
+    const wsManager = new WsBroadcastManager(wss, () => config.cardDefaults ?? {}, useHttps, authService, (req) => authenticateBearerAppToken(req, storage, config) !== null);
     wsManager.setup({
         getSession: (id) => sessionRegistry.get(id),
         getTerminalState: (id) => processes.getTerminalState(id),

package/dist/session-transport.d.ts

@@ -3,6 +3,8 @@ export declare const SESSION_TRANSPORT_OUTPUT_LIMIT = 200000;
 export type SessionBaseDTO = Omit<SessionSnapshot, "output" | "messages" | "title" | "ptyOutputSeq" | "ptyLaunchMarkerToken"> & {
     /** Canonical server-resolved title. Clients must not invent their own fallback. */
     title: string;
+    /** Alias of claudeSessionId; that field stores every provider's native resume id. */
+    providerSessionId?: string | null;
 };
 export interface SessionListItemDTO extends SessionBaseDTO {
     /** Kept for compatibility with clients that initialize terminal state from the list. */

package/dist/session-transport.js

@@ -45,7 +45,9 @@ function sessionBase(snapshot) {
         pendingEscalation: snapshot.pendingEscalation,
         lastEscalationResult: snapshot.lastEscalationResult,
         claudeSessionId: snapshot.claudeSessionId,
+        providerSessionId: snapshot.claudeSessionId,
         queuedMessages: snapshot.queuedMessages,
+        queuedMessageSkills: snapshot.queuedMessageSkills,
         structuredState: snapshot.structuredState,
         resumedFromSessionId: snapshot.resumedFromSessionId,
         autoRecovered: snapshot.autoRecovered,
@@ -54,7 +56,10 @@ function sessionBase(snapshot) {
         summary: snapshot.summary,
         title: resolveSessionDisplayTitle(snapshot),
         description: snapshot.description,
+        titleGenerating: snapshot.titleGenerating,
         currentTaskTitle: snapshot.currentTaskTitle,
+        workspaceId: snapshot.workspaceId,
+        workspaceTaskId: snapshot.workspaceTaskId,
         selectedModel: snapshot.selectedModel,
         thinkingEffort: snapshot.thinkingEffort,
         ptyCols: snapshot.ptyCols,

package/dist/storage.d.ts

@@ -98,6 +98,8 @@ export declare class WandStorage {
     getAppSecret(): string | null;
     /** Persist appSecret in database (DB is the authoritative source after first migration) */
     setAppSecret(value: string): void;
+    private encryptStoredPassword;
+    private decryptPasswordItem;
     ensureDefaultPasswordVault(): void;
     listPasswordVaults(): PasswordVault[];
     createPasswordVault(nameInput: unknown): PasswordVault;

package/dist/storage.js

@@ -3,7 +3,7 @@ import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { normalizeSessionDirectory } from "./session-directory-tree.js";
-import { DEFAULT_PASSWORD_VAULT_ID, DEFAULT_PASSWORD_VAULT_NAME, itemMatchesFilter, normalizePasswordItemInput, normalizeVaultName, nowIso, } from "./password-manager.js";
+import { DEFAULT_PASSWORD_VAULT_ID, DEFAULT_PASSWORD_VAULT_NAME, decryptVaultSecret, encryptVaultSecret, itemMatchesFilter, normalizePasswordItemInput, normalizeVaultName, nowIso, } from "./password-manager.js";
 function safeJsonParse(raw) {
     if (!raw)
         return undefined;
@@ -987,6 +987,15 @@ export class WandStorage {
     setAppSecret(value) {
         this.setConfigValue("appSecret", value);
     }
+    encryptStoredPassword(password) {
+        if (!password)
+            return null;
+        const secret = this.getAppSecret();
+        return secret ? encryptVaultSecret(password, secret) : password;
+    }
+    decryptPasswordItem(item) {
+        return { ...item, password: decryptVaultSecret(item.password, this.getAppSecret()) };
+    }
     // ============ Browser Extension Password Vault Methods ============
     ensureDefaultPasswordVault() {
         const now = nowIso();
@@ -1030,7 +1039,8 @@ export class WandStorage {
         const limit = typeof filter.limit === "number" && Number.isFinite(filter.limit)
             ? Math.max(1, Math.min(200, Math.floor(filter.limit)))
             : 100;
-        return rows.map(mapPasswordItemRow).filter((item) => itemMatchesFilter(item, filter)).slice(0, limit);
+        return rows.map((row) => this.decryptPasswordItem(mapPasswordItemRow(row)))
+            .filter((item) => itemMatchesFilter(item, filter)).slice(0, limit);
     }
     getPasswordItem(id) {
         const row = this.db
@@ -1039,7 +1049,7 @@ export class WandStorage {
          FROM password_items
          WHERE id = ? AND archived = 0`)
             .get(id);
-        return row ? mapPasswordItemRow(row) : null;
+        return row ? this.decryptPasswordItem(mapPasswordItemRow(row)) : null;
     }
     createPasswordItem(input) {
         this.ensureDefaultPasswordVault();
@@ -1055,7 +1065,7 @@ export class WandStorage {
            id, vault_id, type, title, username, password, urls, notes, fields, tags, favorite, archived,
            created_at, updated_at, last_used_at, password_updated_at
          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, NULL, ?)`)
-            .run(id, vaultId, normalized.type, normalized.title, normalized.username ?? null, normalized.password ?? null, JSON.stringify(normalized.urls), normalized.notes ?? null, JSON.stringify(normalized.fields), JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, now, passwordUpdatedAt ?? null);
+            .run(id, vaultId, normalized.type, normalized.title, normalized.username ?? null, this.encryptStoredPassword(normalized.password), JSON.stringify(normalized.urls), normalized.notes ?? null, JSON.stringify(normalized.fields), JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, now, passwordUpdatedAt ?? null);
         return this.getPasswordItem(id);
     }
     updatePasswordItem(id, input) {
@@ -1086,7 +1096,7 @@ export class WandStorage {
          SET vault_id = ?, type = ?, title = ?, username = ?, password = ?, urls = ?, notes = ?,
              fields = ?, tags = ?, favorite = ?, updated_at = ?, password_updated_at = ?
          WHERE id = ? AND archived = 0`)
-            .run(vaultId, normalized.type, normalized.title, normalized.username ?? null, normalized.password ?? null, JSON.stringify(normalized.urls), normalized.notes ?? null, JSON.stringify(normalized.fields), JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, passwordUpdatedAt, id);
+            .run(vaultId, normalized.type, normalized.title, normalized.username ?? null, this.encryptStoredPassword(normalized.password), JSON.stringify(normalized.urls), normalized.notes ?? null, JSON.stringify(normalized.fields), JSON.stringify(normalized.tags), normalized.favorite ? 1 : 0, now, passwordUpdatedAt, id);
         return this.getPasswordItem(id);
     }
     touchPasswordItem(id) {
@@ -1416,6 +1426,8 @@ const SCHEMA_MIGRATIONS = [
     ["queued_message_skills", "ALTER TABLE command_sessions ADD COLUMN queued_message_skills TEXT"],
     ["structured_state", "ALTER TABLE command_sessions ADD COLUMN structured_state TEXT"],
     ["resumed_from_session_id", "ALTER TABLE command_sessions ADD COLUMN resumed_from_session_id TEXT"],
+    // Legacy column: never written by current persist helpers. Kept because
+    // schema migrations are additive-only and must not DROP columns.
     ["resumed_to_session_id", "ALTER TABLE command_sessions ADD COLUMN resumed_to_session_id TEXT"],
     ["auto_recovered", "ALTER TABLE command_sessions ADD COLUMN auto_recovered INTEGER NOT NULL DEFAULT 0"],
     ["worktree_enabled", "ALTER TABLE command_sessions ADD COLUMN worktree_enabled INTEGER NOT NULL DEFAULT 0"],

package/dist/structured-session-manager.js

@@ -255,7 +255,9 @@ export class StructuredSessionManager {
                     provider,
                     runner,
                     model: snapshot.structuredState?.model ?? snapshot.selectedModel ?? undefined,
-                    lastError: snapshot.structuredState?.lastError ?? null,
+                    lastError: snapshot.status === "running"
+                        ? "服务重启，上一轮已中断。"
+                        : snapshot.structuredState?.lastError ?? null,
                     inFlight: false,
                     activeRequestId: null,
                 },

package/dist/types.d.ts

@@ -539,7 +539,7 @@ export interface SessionSnapshot {
         resolution: EscalationResolution;
         reason: string;
     } | null;
-    /** Claude Code 会话 ID，用于 --resume 恢复会话 */
+    /** Native resume id for every provider (Claude UUID, Codex thread, OpenCode ses_*, …). Wire alias: providerSessionId. */
     claudeSessionId: string | null;
     /** Structured conversation messages derived from PTY output. */
     messages?: ConversationTurn[];

package/dist/ws-broadcast.d.ts

@@ -2,6 +2,7 @@
  * WebSocket broadcast manager for process events.
  * Handles debounced output events, backpressure control, and client subscriptions.
  */
+import type { IncomingMessage } from "node:http";
 import { WebSocketServer } from "ws";
 import type { CardExpandDefaults, SessionSnapshot, ProcessEvent } from "./types.js";
 import { type AuthService } from "./auth.js";
@@ -26,7 +27,8 @@ export declare class WsBroadcastManager {
     private getCardDefaults;
     private useHttps;
     private authService?;
-    constructor(wss: WebSocketServer, getCardDefaults?: () => CardExpandDefaults, useHttps?: boolean, authService?: Pick<AuthService, "validateSession">);
+    private authenticateRequest?;
+    constructor(wss: WebSocketServer, getCardDefaults?: () => CardExpandDefaults, useHttps?: boolean, authService?: Pick<AuthService, "validateSession">, authenticateRequest?: (req: IncomingMessage) => boolean);
     /** Immediately disconnect all authenticated clients after global revocation. */
     disconnectAll(): void;
     /** Stop timers, discard deferred output, and terminate every client. */

package/dist/ws-broadcast.js

@@ -39,11 +39,13 @@ export class WsBroadcastManager {
     getCardDefaults;
     useHttps;
     authService;
-    constructor(wss, getCardDefaults, useHttps = false, authService) {
+    authenticateRequest;
+    constructor(wss, getCardDefaults, useHttps = false, authService, authenticateRequest) {
         this.wss = wss;
         this.getCardDefaults = getCardDefaults ?? (() => ({}));
         this.useHttps = useHttps;
         this.authService = authService;
+        this.authenticateRequest = authenticateRequest;
     }
     /** Immediately disconnect all authenticated clients after global revocation. */
     disconnectAll() {
@@ -79,7 +81,8 @@ export class WsBroadcastManager {
                 return;
             }
             const sessionToken = readSessionCookie(req, this.useHttps);
-            if (!sessionToken || !this.authService?.validateSession(sessionToken)) {
+            const cookieOk = !!sessionToken && !!this.authService?.validateSession(sessionToken);
+            if (!cookieOk && !this.authenticateRequest?.(req)) {
                 ws.close(1008, "Unauthorized");
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@co0ontty/wand",
-  "version": "4.43.0",
+  "version": "4.44.0",
   "description": "A web console for Claude Code, Codex, OpenCode, and other local CLI tools.",
   "type": "module",
   "bin": {