@dev-anywhere/proxy 0.2.0 → 0.2.2

package/dist/serve.js

@@ -6,7 +6,7 @@ import {
   StreamJsonEventSchema,
   disposeSeqCounter,
   getSeqCounterFor
-} from "./chunk-4YQ2JUM7.js";
+} from "./chunk-ENA4NCWK.js";
 import {
   decidePtySemanticTransition,
   extractOscSequences,
@@ -35,7 +35,7 @@ import {
   serializeControl,
   serializeIpc,
   serializeWorkerMsg
-} from "./chunk-NBRBO5GS.js";
+} from "./chunk-NZZXBVO2.js";
 import {
   buildProviderEnv,
   loadConfig,
@@ -65,7 +65,7 @@ import {
 
 // src/serve.ts
 import { createServer as createServer2 } from "net";
-import { unlinkSync as unlinkSync4, writeFileSync as writeFileSync3, chmodSync, rmSync as rmSync2 } from "fs";
+import { unlinkSync as unlinkSync4, writeFileSync as writeFileSync4, chmodSync, rmSync as rmSync2 } from "fs";
 
 // src/serve/session-manager.ts
 import { readFileSync, existsSync } from "fs";
@@ -219,7 +219,18 @@ var SessionManager = class {
     this.sessions.delete(id);
     this.save();
     serviceLogger.info({ sessionId: id, mode: session.mode, pid }, "Session terminated");
-    this.onSessionRemoved?.(id, context);
+    try {
+      this.onSessionRemoved?.(id, context);
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
+      serviceLogger.warn(
+        {
+          sessionId: id,
+          err: { message: error.message, stack: error.stack, cause: error.cause }
+        },
+        "onSessionRemoved callback threw; session already removed from registry"
+      );
+    }
     return { success: true, pid };
   }
   terminateAll() {
@@ -957,7 +968,7 @@ function extractConversationText(msg) {
   return null;
 }
 async function extractTitleAndCwd(filePath) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     const rl = createInterface({
       input: createReadStream(filePath, { encoding: "utf-8" }),
       crlfDelay: Infinity
@@ -985,10 +996,10 @@ async function extractTitleAndCwd(filePath) {
       }
     });
     rl.on("close", () => {
-      if (!resolved) resolve3({ title, cwd });
-      else resolve3({ title, cwd });
+      if (!resolved) resolve5({ title, cwd });
+      else resolve5({ title, cwd });
     });
-    rl.on("error", () => resolve3({ title, cwd }));
+    rl.on("error", () => resolve5({ title, cwd }));
   });
 }
 async function collectJsonlFiles(root) {
@@ -1010,7 +1021,7 @@ async function collectJsonlFiles(root) {
   return files;
 }
 async function extractCodexTitleAndCwd(filePath) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     const rl = createInterface({
       input: createReadStream(filePath, { encoding: "utf-8" }),
       crlfDelay: Infinity
@@ -1034,8 +1045,8 @@ async function extractCodexTitleAndCwd(filePath) {
       } catch {
       }
     });
-    rl.on("close", () => resolve3({ id, title, cwd }));
-    rl.on("error", () => resolve3({ id, title, cwd }));
+    rl.on("close", () => resolve5({ id, title, cwd }));
+    rl.on("error", () => resolve5({ id, title, cwd }));
   });
 }
 function extractCodexUserText(payload) {
@@ -1600,7 +1611,7 @@ var WorkerRegistry = class {
     return workerPid;
   }
   connect(sessionId, sockPath) {
-    return new Promise((resolve3) => {
+    return new Promise((resolve5) => {
       const sock = connect(sockPath);
       sock.on("connect", () => {
         this.sockets.set(sessionId, sock);
@@ -1616,9 +1627,9 @@ var WorkerRegistry = class {
         );
         sock.on("close", () => this.onDisconnect(sessionId));
         sock.on("error", () => this.onDisconnect(sessionId));
-        resolve3(sock);
+        resolve5(sock);
       });
-      sock.on("error", () => resolve3(null));
+      sock.on("error", () => resolve5(null));
     });
   }
   // 枚举 DATA_DIR 下所有 session 目录，尝试连接存活的 worker.sock；失败则清理 stale socket。
@@ -2034,7 +2045,6 @@ function saveClipboardImageUpload(request, options = {}) {
   if (!extension) {
     return {
       success: false,
-      path: "",
       error: "\u4E0D\u652F\u6301\u8FD9\u79CD\u56FE\u7247\u683C\u5F0F",
       errorCode: ControlErrorCode.UNKNOWN
     };
@@ -2060,34 +2070,228 @@ function saveClipboardImageUpload(request, options = {}) {
   } catch (err) {
     return {
       success: false,
-      path: "",
       error: err instanceof Error ? err.message : String(err),
       errorCode: ControlErrorCode.UNKNOWN
     };
   }
 }
 
-// src/serve/image-preview.ts
+// src/serve/file-download.ts
 import { readFileSync as readFileSync5, realpathSync, statSync as statSync2 } from "fs";
+import { extname, isAbsolute as isAbsolute3, resolve as resolve2 } from "path";
+var MAX_FILE_DOWNLOAD_BYTES = 100 * 1024 * 1024;
+var EXT_MIME_MAP = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".bmp": "image/bmp",
+  ".pdf": "application/pdf",
+  ".json": "application/json",
+  ".xml": "application/xml",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".log": "text/plain",
+  ".csv": "text/csv",
+  ".js": "application/javascript",
+  ".mjs": "application/javascript",
+  ".ts": "application/typescript",
+  ".tsx": "application/typescript",
+  ".zip": "application/zip",
+  ".tar": "application/x-tar",
+  ".gz": "application/gzip",
+  ".mp4": "video/mp4",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav"
+};
+function guessMimeType(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  return EXT_MIME_MAP[ext] ?? "application/octet-stream";
+}
+function resolveDownloadPath(rawPath, cwd) {
+  const candidate = isAbsolute3(rawPath) ? resolve2(rawPath) : resolve2(cwd, rawPath);
+  return realpathSync(candidate);
+}
+function errorCode(err) {
+  if (err instanceof Error && "errorCode" in err && typeof err.errorCode === "string") {
+    return err.errorCode;
+  }
+  return classifyPathError(err);
+}
+function loadFileDownload(request, options) {
+  try {
+    const resolvedPath = resolveDownloadPath(request.path, options.cwd);
+    const stat2 = statSync2(resolvedPath);
+    if (!stat2.isFile()) {
+      return {
+        success: false,
+        sessionId: request.sessionId,
+        path: request.path,
+        error: "\u8DEF\u5F84\u4E0D\u662F\u666E\u901A\u6587\u4EF6",
+        errorCode: ControlErrorCode.INVALID_PATH
+      };
+    }
+    const maxBytes = options.maxBytes ?? MAX_FILE_DOWNLOAD_BYTES;
+    if (stat2.size > maxBytes) {
+      return {
+        success: false,
+        sessionId: request.sessionId,
+        path: request.path,
+        error: `\u6587\u4EF6\u8D85\u8FC7 ${Math.round(maxBytes / 1024 / 1024)}MB \u9650\u5236`,
+        errorCode: ControlErrorCode.UNKNOWN
+      };
+    }
+    const buffer = readFileSync5(resolvedPath);
+    return {
+      success: true,
+      sessionId: request.sessionId,
+      path: request.path,
+      mimeType: guessMimeType(resolvedPath),
+      dataBase64: buffer.toString("base64"),
+      size: buffer.length
+    };
+  } catch (err) {
+    return {
+      success: false,
+      sessionId: request.sessionId,
+      path: request.path,
+      error: err instanceof Error ? err.message : String(err),
+      errorCode: errorCode(err)
+    };
+  }
+}
+
+// src/serve/file-upload.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, statSync as statSync3, writeFileSync as writeFileSync2 } from "fs";
+import { basename, isAbsolute as isAbsolute4, join as join6, relative as relative2, resolve as resolve3 } from "path";
+import { nanoid as nanoid4 } from "nanoid";
+var MAX_FILE_UPLOAD_BYTES = 100 * 1024 * 1024;
+var MAX_FILE_UPLOAD_BASE64_LENGTH = Math.ceil(MAX_FILE_UPLOAD_BYTES / 3) * 4;
+var SAFE_FILENAME_RE = /^[A-Za-z0-9._-]+$/;
+function normalizeBase642(input) {
+  return input.replace(/^data:[^;]+;base64,/i, "").replace(/\s/g, "");
+}
+function decodeBase64File(dataBase64) {
+  const normalized = normalizeBase642(dataBase64);
+  if (normalized.length > MAX_FILE_UPLOAD_BASE64_LENGTH) {
+    throw new Error("\u6587\u4EF6\u8D85\u8FC7 100MB \u9650\u5236");
+  }
+  if (!normalized || !/^[A-Za-z0-9+/]*={0,2}$/.test(normalized)) {
+    throw new Error("\u6587\u4EF6\u6570\u636E\u4E0D\u662F\u6709\u6548\u7684 base64");
+  }
+  const buffer = Buffer.from(normalized, "base64");
+  if (buffer.length === 0) throw new Error("\u6587\u4EF6\u6570\u636E\u4E3A\u7A7A");
+  if (buffer.length > MAX_FILE_UPLOAD_BYTES) {
+    throw new Error("\u6587\u4EF6\u8D85\u8FC7 100MB \u9650\u5236");
+  }
+  return buffer;
+}
+function sanitizeFileName(fileName, fallbackPrefix, suffix) {
+  const base = basename(fileName).trim();
+  if (base && SAFE_FILENAME_RE.test(base)) return base;
+  const extMatch = base.match(/\.([A-Za-z0-9]{1,6})$/);
+  const ext = extMatch ? `.${extMatch[1]}` : "";
+  return `${fallbackPrefix}-${suffix}${ext}`;
+}
+function resolveChildDir2(rootPath, ...segments) {
+  const root = resolve3(rootPath);
+  const target = resolve3(root, ...segments);
+  const rel = relative2(root, target);
+  if (!rel || rel.startsWith("..") || isAbsolute4(rel)) {
+    throw new Error("\u4F1A\u8BDD\u8DEF\u5F84\u65E0\u6548");
+  }
+  return target;
+}
+function normalizeGitignoreLine2(line) {
+  return line.trim().replace(/^\/+/, "").replace(/\/+$/, "");
+}
+function ensureProjectUploadIgnored(cwd) {
+  const gitignorePath = join6(cwd, ".gitignore");
+  if (!existsSync5(gitignorePath)) return;
+  try {
+    const current = readFileSync6(gitignorePath, "utf-8");
+    const alreadyIgnored = current.split(/\r?\n/).some((line) => normalizeGitignoreLine2(line) === ".dev-anywhere");
+    if (alreadyIgnored) return;
+    const separator = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+    writeFileSync2(gitignorePath, `${current}${separator}.dev-anywhere/
+`);
+  } catch {
+  }
+}
+function trySaveProjectUpload(options) {
+  if (!options.cwd) return null;
+  try {
+    const cwd = resolve3(options.cwd);
+    if (!statSync3(cwd).isDirectory()) return null;
+    const uploadsRoot = resolve3(cwd, ".dev-anywhere", "uploads");
+    const uploadDir = resolveChildDir2(uploadsRoot, options.sessionId);
+    const path = join6(uploadDir, options.fileName);
+    mkdirSync2(uploadDir, { recursive: true });
+    writeFileSync2(path, options.buffer, { mode: 384 });
+    ensureProjectUploadIgnored(cwd);
+    return { success: true, path: relative2(cwd, path) };
+  } catch (err) {
+    serviceLogger.warn(
+      { sessionId: options.sessionId, cwd: options.cwd, error: String(err) },
+      "Project upload write failed; falling back to data dir"
+    );
+    return null;
+  }
+}
+async function saveFileUpload(request, options = {}) {
+  try {
+    const buffer = decodeBase64File(request.dataBase64);
+    const now = options.now ?? Date.now;
+    const suffix = options.randomSuffix?.() ?? nanoid4(6);
+    const stamped = new Date(now()).toISOString().replace(/[-:T.Z]/g, "").slice(0, 14);
+    const fileName = sanitizeFileName(request.fileName, `upload-${stamped}`, suffix);
+    const projectResult = trySaveProjectUpload({
+      cwd: options.cwd,
+      sessionId: request.sessionId,
+      fileName,
+      buffer
+    });
+    if (projectResult) return projectResult;
+    const dataDir = options.dataDir ?? DATA_DIR;
+    const uploadDir = resolveChildDir2(dataDir, request.sessionId, "uploads");
+    const path = join6(uploadDir, fileName);
+    mkdirSync2(uploadDir, { recursive: true });
+    writeFileSync2(path, buffer, { mode: 384 });
+    return { success: true, path };
+  } catch (err) {
+    return {
+      success: false,
+      error: err instanceof Error ? err.message : String(err),
+      errorCode: ControlErrorCode.UNKNOWN
+    };
+  }
+}
+
+// src/serve/image-preview.ts
+import { readFileSync as readFileSync7, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
 import { tmpdir } from "os";
-import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve2 } from "path";
+import { isAbsolute as isAbsolute5, relative as relative3, resolve as resolve4 } from "path";
 var MAX_IMAGE_PREVIEW_BYTES = 10 * 1024 * 1024;
 function isInsideRoot(realFilePath, realRootPath) {
-  const rel = relative2(realRootPath, realFilePath);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+  const rel = relative3(realRootPath, realFilePath);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
 }
 function allowedRoots(options) {
   return [options.cwd, options.tmpDir ?? tmpdir(), ...options.previewRoots ?? []].map((root) => root.trim()).filter(Boolean).flatMap((root) => {
     try {
-      return [realpathSync(root)];
+      return [realpathSync2(root)];
     } catch {
       return [];
     }
   });
 }
 function resolvePreviewPath(rawPath, options) {
-  const candidate = isAbsolute3(rawPath) ? resolve2(rawPath) : resolve2(options.cwd, rawPath);
-  const realCandidate = realpathSync(candidate);
+  const candidate = isAbsolute5(rawPath) ? resolve4(rawPath) : resolve4(options.cwd, rawPath);
+  const realCandidate = realpathSync2(candidate);
   if (!allowedRoots(options).some((root) => isInsideRoot(realCandidate, root))) {
     throw Object.assign(new Error("\u56FE\u7247\u8DEF\u5F84\u4E0D\u5728\u5141\u8BB8\u9884\u89C8\u7684\u76EE\u5F55\u5185"), {
       errorCode: ControlErrorCode.INVALID_PATH
@@ -2110,7 +2314,7 @@ function detectImageMime(buffer) {
   }
   return void 0;
 }
-function errorCode(err) {
+function errorCode2(err) {
   if (err instanceof Error && "errorCode" in err && typeof err.errorCode === "string") {
     return err.errorCode;
   }
@@ -2119,7 +2323,7 @@ function errorCode(err) {
 function loadImagePreview(request, options) {
   try {
     const resolvedPath = resolvePreviewPath(request.path, options);
-    const stat2 = statSync2(resolvedPath);
+    const stat2 = statSync4(resolvedPath);
     if (!stat2.isFile()) {
       return {
         success: false,
@@ -2139,7 +2343,7 @@ function loadImagePreview(request, options) {
         errorCode: ControlErrorCode.UNKNOWN
       };
     }
-    const buffer = readFileSync5(resolvedPath);
+    const buffer = readFileSync7(resolvedPath);
     const mimeType = detectImageMime(buffer);
     if (!mimeType) {
       return {
@@ -2164,7 +2368,7 @@ function loadImagePreview(request, options) {
       sessionId: request.sessionId,
       path: request.path,
       error: err instanceof Error ? err.message : String(err),
-      errorCode: errorCode(err)
+      errorCode: errorCode2(err)
     };
   }
 }
@@ -2248,7 +2452,6 @@ var RelayInputHandlers = class {
           requestId,
           sessionId,
           success: false,
-          path: "",
           error: "\u4F1A\u8BDD\u4E0D\u5B58\u5728",
           errorCode: ControlErrorCode.SESSION_NOT_FOUND
         })
@@ -2310,7 +2513,92 @@ var RelayInputHandlers = class {
         ...result
       })
     );
-    serviceLogger.info({ sessionId, success: result.success }, "Image preview handled");
+    if (result.success) {
+      serviceLogger.info({ sessionId, path, size: result.size }, "Image preview handled");
+    } else {
+      serviceLogger.warn(
+        { sessionId, path, errorCode: result.errorCode, error: result.error },
+        "Image preview failed"
+      );
+    }
+  }
+  onFileDownloadRequest(msg) {
+    const { sessionId, requestId, path } = msg;
+    if (!sessionId || !path) return;
+    const session = this.deps.sessionManager.getSession(sessionId);
+    if (!session) {
+      this.deps.relayConnection.sendRaw(
+        serializeControl({
+          type: "file_download_response",
+          requestId,
+          sessionId,
+          success: false,
+          path,
+          error: "\u4F1A\u8BDD\u4E0D\u5B58\u5728",
+          errorCode: ControlErrorCode.SESSION_NOT_FOUND
+        })
+      );
+      serviceLogger.warn({ sessionId }, "File download rejected: session not found");
+      return;
+    }
+    const result = loadFileDownload({ sessionId, path }, { cwd: session.cwd });
+    this.deps.relayConnection.sendRaw(
+      serializeControl({
+        type: "file_download_response",
+        requestId,
+        ...result
+      })
+    );
+    if (result.success) {
+      serviceLogger.info(
+        { sessionId, path, size: result.size },
+        "File download handled"
+      );
+    } else {
+      serviceLogger.warn(
+        { sessionId, path, errorCode: result.errorCode, error: result.error },
+        "File download failed"
+      );
+    }
+  }
+  async onFileUploadRequest(msg) {
+    const { sessionId, requestId, mimeType, dataBase64, fileName } = msg;
+    if (!sessionId) return;
+    const session = this.deps.sessionManager.getSession(sessionId);
+    if (!session) {
+      this.deps.relayConnection.sendRaw(
+        serializeControl({
+          type: "file_upload_response",
+          requestId,
+          sessionId,
+          success: false,
+          error: "\u4F1A\u8BDD\u4E0D\u5B58\u5728",
+          errorCode: ControlErrorCode.SESSION_NOT_FOUND
+        })
+      );
+      serviceLogger.warn({ sessionId }, "File upload rejected: session not found");
+      return;
+    }
+    const result = await saveFileUpload(
+      { sessionId, mimeType, dataBase64, fileName },
+      { cwd: session.cwd }
+    );
+    this.deps.relayConnection.sendRaw(
+      serializeControl({
+        type: "file_upload_response",
+        requestId,
+        sessionId,
+        ...result
+      })
+    );
+    if (result.success) {
+      serviceLogger.info({ sessionId, fileName, path: result.path }, "File upload handled");
+    } else {
+      serviceLogger.warn(
+        { sessionId, fileName, errorCode: result.errorCode, error: result.error },
+        "File upload failed"
+      );
+    }
   }
 };
 
@@ -2505,14 +2793,14 @@ var RelayPermissionHandlers = class {
 
 // src/serve/relay-resource-handlers.ts
 import { homedir as homedir4 } from "os";
-import { accessSync, constants, statSync as statSync3 } from "fs";
+import { accessSync, constants, statSync as statSync5 } from "fs";
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function validateExecutablePath(path) {
   const normalized = path.trim();
   if (!normalized.startsWith("/")) throw new Error("CLI \u8DEF\u5F84\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84");
-  const stat2 = statSync3(normalized);
+  const stat2 = statSync5(normalized);
   if (!stat2.isFile()) throw new Error("CLI \u8DEF\u5F84\u4E0D\u662F\u53EF\u6267\u884C\u6587\u4EF6");
   accessSync(normalized, constants.X_OK);
   return normalized;
@@ -2620,9 +2908,9 @@ var RelayResourceHandlers = class {
 };
 
 // src/serve/relay-session-create-handler.ts
-import { rmSync, statSync as statSync4 } from "fs";
-import { isAbsolute as isAbsolute4 } from "path";
-import { nanoid as nanoid4 } from "nanoid";
+import { rmSync, statSync as statSync6 } from "fs";
+import { isAbsolute as isAbsolute6 } from "path";
+import { nanoid as nanoid5 } from "nanoid";
 
 // src/serve/hosted-pty-registry.ts
 import * as pty from "node-pty";
@@ -2873,11 +3161,11 @@ function validateSessionCwd(cwd) {
     return { message: "\u8BF7\u8F93\u5165\u5DE5\u4F5C\u76EE\u5F55", code: ControlErrorCode.INVALID_PATH };
   }
   const trimmed = cwd.trim();
-  if (!isAbsolute4(trimmed)) {
+  if (!isAbsolute6(trimmed)) {
     return { message: "\u5DE5\u4F5C\u76EE\u5F55\u5FC5\u987B\u662F\u7EDD\u5BF9\u8DEF\u5F84", code: ControlErrorCode.INVALID_PATH };
   }
   try {
-    const stat2 = statSync4(trimmed);
+    const stat2 = statSync6(trimmed);
     return stat2.isDirectory() ? null : { message: "\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u76EE\u5F55", code: ControlErrorCode.PATH_NOT_DIRECTORY };
   } catch (err) {
     return {
@@ -2940,7 +3228,7 @@ var RelaySessionCreateHandler = class {
     const resumeSessionId = msg.resumeSessionId;
     const streamDelta = false;
     const name = tildify(sessionCwd);
-    const pendingId = nanoid4();
+    const pendingId = nanoid5();
     const hook = this.deps.createHookContext(pendingId, provider);
     const workerPid = this.deps.workerRegistry.spawn(pendingId, {
       cwd: sessionCwd,
@@ -3033,7 +3321,7 @@ var RelaySessionCreateHandler = class {
       return;
     }
     const resumeSessionId = msg.resumeSessionId;
-    const pendingId = nanoid4();
+    const pendingId = nanoid5();
     const name = tildify(cwd);
     const hook = this.deps.createHookContext(pendingId, provider);
     try {
@@ -3226,6 +3514,12 @@ var RelayRouter = class {
       case "image_preview_request":
         this.inputHandlers.onImagePreviewRequest(msg);
         return;
+      case "file_download_request":
+        this.inputHandlers.onFileDownloadRequest(msg);
+        return;
+      case "file_upload_request":
+        void this.inputHandlers.onFileUploadRequest(msg);
+        return;
       case "tool_approve":
         this.permissionHandlers.onToolApprove(msg);
         return;
@@ -3468,11 +3762,11 @@ var PermissionBroker = class {
     if (this.pending.has(request.requestId)) {
       return Promise.resolve(DUPLICATE_DECISION);
     }
-    return new Promise((resolve3) => {
+    return new Promise((resolve5) => {
       this.pending.set(request.requestId, {
         ...request,
         source: "hook",
-        resolve: resolve3,
+        resolve: resolve5,
         createdAt: Date.now()
       });
     });
@@ -3811,11 +4105,32 @@ function createEventBridge(deps) {
     deps.relayConnection.sendRaw(serializeControl({ type: "agent_status", sessionId, payload }));
   };
   const cleanupSessionResources = (sessionId) => {
-    deps.controlHandlers.cleanup(sessionId);
-    deps.agentStatusRegistry.delete(sessionId);
-    disposeSeqCounter(sessionId);
-    deps.permissionBroker.cleanupSession(sessionId, "Session closed");
-    broadcastSessionList(deps.relayConnection, deps.sessionManager);
+    const safe = (fn, step) => {
+      try {
+        fn();
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        serviceLogger.warn(
+          {
+            sessionId,
+            step,
+            err: { message: error.message, stack: error.stack, cause: error.cause }
+          },
+          "Session cleanup step failed; continuing"
+        );
+      }
+    };
+    safe(() => deps.controlHandlers.cleanup(sessionId), "controlHandlers.cleanup");
+    safe(() => deps.agentStatusRegistry.delete(sessionId), "agentStatusRegistry.delete");
+    safe(() => disposeSeqCounter(sessionId), "disposeSeqCounter");
+    safe(
+      () => deps.permissionBroker.cleanupSession(sessionId, "Session closed"),
+      "permissionBroker.cleanupSession"
+    );
+    safe(
+      () => broadcastSessionList(deps.relayConnection, deps.sessionManager),
+      "broadcastSessionList"
+    );
   };
   return {
     changeSessionState: changeState,
@@ -3827,14 +4142,14 @@ function createEventBridge(deps) {
 
 // src/serve/service-files.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync8, unlinkSync as unlinkSync2 } from "fs";
 import { hostname } from "os";
 import { connect as connect2 } from "net";
 function tryConnectSocket(sockPath) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     const s = connect2(sockPath);
-    s.on("connect", () => resolve3(s));
-    s.on("error", () => resolve3(null));
+    s.on("connect", () => resolve5(s));
+    s.on("error", () => resolve5(null));
   });
 }
 function isProcessAlive(pid) {
@@ -3846,7 +4161,7 @@ function isProcessAlive(pid) {
   }
 }
 async function cleanupStaleResources() {
-  if (existsSync5(SOCK_PATH)) {
+  if (existsSync6(SOCK_PATH)) {
     const existing = await tryConnectSocket(SOCK_PATH);
     if (existing) {
       existing.destroy();
@@ -3859,8 +4174,8 @@ async function cleanupStaleResources() {
     unlinkSync2(SOCK_PATH);
     serviceLogger.info("Removed stale socket file");
   }
-  if (existsSync5(PID_PATH)) {
-    const pidStr = readFileSync6(PID_PATH, "utf-8").trim();
+  if (existsSync6(PID_PATH)) {
+    const pidStr = readFileSync8(PID_PATH, "utf-8").trim();
     const pid = parseInt(pidStr, 10);
     if (!isNaN(pid) && isProcessAlive(pid)) {
       const msg = `Another service is already running with PID ${pid}`;
@@ -4141,8 +4456,14 @@ function handleTerminalConnection(socket, deps) {
       relayConnection.sendBinary(encodeBinaryFrame(sessionId, outputSeq, data));
     },
     (err, line) => {
+      const cause = err instanceof Error ? err.cause : void 0;
       serviceLogger.warn(
-        { err: err.message, lineLen: line.length },
+        {
+          err: err.message,
+          cause: cause instanceof Error ? cause.message : cause,
+          lineLen: line.length,
+          linePreview: line.slice(0, 200)
+        },
         "Terminal IPC message dropped (parse/schema error)"
       );
     }
@@ -4186,7 +4507,7 @@ function handleTerminalConnection(socket, deps) {
 
 // src/serve/hook-registry.ts
 import { createHash, randomBytes } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync9, renameSync, writeFileSync as writeFileSync3 } from "fs";
 import { dirname } from "path";
 import { z } from "zod";
 var PersistedHookSessionBindingSchema = z.object({
@@ -4247,10 +4568,10 @@ var HookRegistry = class {
     }
   }
   load() {
-    if (!this.persistPath || !existsSync6(this.persistPath)) return;
+    if (!this.persistPath || !existsSync7(this.persistPath)) return;
     try {
       const parsed = PersistedHookRegistrySchema.parse(
-        JSON.parse(readFileSync7(this.persistPath, "utf8"))
+        JSON.parse(readFileSync9(this.persistPath, "utf8"))
       );
       this.bindingsBySession.clear();
       for (const binding of parsed.bindings) {
@@ -4266,9 +4587,9 @@ var HookRegistry = class {
   save() {
     if (!this.persistPath) return;
     try {
-      mkdirSync2(dirname(this.persistPath), { recursive: true });
+      mkdirSync3(dirname(this.persistPath), { recursive: true });
       const tmpPath = `${this.persistPath}.${process.pid}.${Date.now()}.tmp`;
-      writeFileSync2(
+      writeFileSync3(
         tmpPath,
         JSON.stringify(
           {
@@ -4314,7 +4635,7 @@ var HookServer = class {
         this.writeJson(res, 500, { error: "internal_error" });
       });
     });
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve5, reject) => {
       const onError = (err) => {
         this.server?.off("listening", onListening);
         reject(err);
@@ -4322,7 +4643,7 @@ var HookServer = class {
       const onListening = () => {
         this.server?.off("error", onError);
         serviceLogger.info({ host: this.host, port: this.options.port }, "Hook server listening");
-        resolve3();
+        resolve5();
       };
       this.server.once("error", onError);
       this.server.once("listening", onListening);
@@ -4333,8 +4654,8 @@ var HookServer = class {
     if (!this.server) return Promise.resolve();
     const server = this.server;
     this.server = null;
-    return new Promise((resolve3, reject) => {
-      server.close((err) => err ? reject(err) : resolve3());
+    return new Promise((resolve5, reject) => {
+      server.close((err) => err ? reject(err) : resolve5());
     });
   }
   getListeningPort() {
@@ -4448,7 +4769,7 @@ var HookServer = class {
     this.writeJson(res, 200, payload);
   }
   readBody(req) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve5, reject) => {
       let body = "";
       let size = 0;
       req.setEncoding("utf8");
@@ -4461,7 +4782,7 @@ var HookServer = class {
         }
         body += chunk;
       });
-      req.on("end", () => resolve3(body));
+      req.on("end", () => resolve5(body));
       req.on("error", reject);
     });
   }
@@ -4808,7 +5129,7 @@ async function startService(options) {
     });
   });
   server.listen(SOCK_PATH, () => {
-    writeFileSync3(PID_PATH, String(process.pid));
+    writeFileSync4(PID_PATH, String(process.pid));
     chmodSync(SOCK_PATH, 384);
     serviceLogger.info({ pid: process.pid, sock: SOCK_PATH }, "Service started");
   });