@linxin666/dsh-remote-web-ui 0.1.18 → 0.1.20

package/lib/types/loopback.js

@@ -0,0 +1,68 @@
+// Generated by scripts/sync-shared.mjs from shared/host/loopback.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Loopback trust fence shared by the host route families: socket address,
+ * Host header, and browser same-origin markers. Packages receive this file as
+ * a generated copy via scripts/sync-shared.mjs; edit the shared source and
+ * re-run the sync instead of editing a copy.
+ *
+ * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
+ * remote-web-ui gate), localhost hostnames, plus the browser same-origin
+ * markers (sec-fetch-site and Origin) for the request-level fence.
+ * @module dsh-web-ui-shared/host/loopback
+ */
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export function isIPv4Loopback(v4) {
+    const parts = v4.split('.');
+    return parts.length === 4
+        && parts[0] === '127'
+        && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address) {
+    if (address === undefined)
+        return false;
+    const normalized = address.toLowerCase();
+    if (normalized === '::1')
+        return true;
+    if (normalized.startsWith('::ffff:'))
+        return isIPv4Loopback(normalized.slice('::ffff:'.length));
+    return isIPv4Loopback(normalized);
+}
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '[::1]')
+        return true;
+    return isIPv4Loopback(hostname);
+}
+/**
+ * Request-level trust fence: a loopback socket address AND a loopback Host
+ * header, plus browser same-origin markers. The socket address is
+ * authoritative; X-Forwarded-For is never trusted.
+ */
+export function isLoopbackRequest(request) {
+    if (!isLoopbackAddress(request.socket.remoteAddress))
+        return false;
+    const host = request.headers.host;
+    if (typeof host !== 'string')
+        return false;
+    let hostUrl;
+    try {
+        hostUrl = new URL('http://' + host);
+    }
+    catch {
+        return false;
+    }
+    if (!isLoopbackHostname(hostUrl.hostname))
+        return false;
+    if (request.headers['sec-fetch-site'] === 'cross-site')
+        return false;
+    const origin = request.headers.origin;
+    if (origin === undefined)
+        return true;
+    try {
+        return new URL(origin).host === hostUrl.host;
+    }
+    catch {
+        return false;
+    }
+}

package/lib/types/mobile/api.js

@@ -4,7 +4,7 @@
  * (type-only imports; the wire schemas stay in the bundle only through the
  * rpc/mux layers).
  */
-import { callUnary } from "./rpc.js";
+import { callUnary } from './rpc.js';
 /** The workspace roster (session ids come back per workspace). */
 export async function listWorkspaces() {
     const { items } = await callUnary('workspace.list', {});

package/lib/types/mobile/index.js

@@ -8,9 +8,9 @@ import { jsx as _jsx } from "react/jsx-runtime";
  *   chat (history paged on demand + live mux stream + prompt input).
  */
 import { createRoot } from 'react-dom/client';
-import { App } from "./views/App.js";
-import { mobileCss } from "./mobile-styles.js";
-import { initMobileTheme } from "./mobile-theme.js";
+import { App } from './views/App.js';
+import { mobileCss } from './mobile-styles.js';
+import { initMobileTheme } from './mobile-theme.js';
 // Apply the persisted (or default light) theme before first paint, so the
 // page never flashes the wrong palette.
 initMobileTheme();

package/lib/types/mobile/markdown.d.ts

@@ -13,10 +13,12 @@
 export declare function escapeHtml(text: string): string;
 /**
  * Guard a raw link/image target against dangerous protocols. Returns the
- * (trimmed) raw string when safe, else null. Only http:, https:, mailto:
- * and fragment anchors (#...) are allowed; anything with another scheme
- * — javascript:, data:, vbscript:, etc. — is rejected so the value never
- * reaches dangerouslySetInnerHTML.
+ * (trimmed) raw string when safe, else null. Only http:, https:, mailto:,
+ * fragment anchors (#...) and strictly relative paths are allowed; anything
+ * with another scheme — javascript:, data:, vbscript:, etc. — or a
+ * protocol-relative //host target (the browser resolves it against the
+ * current scheme, reaching an arbitrary origin) is rejected so the value
+ * never reaches dangerouslySetInnerHTML.
  */
 export declare function safeUrl(raw: string): string | null;
 /** Inline pass: code spans, bold, italic, strikethrough, images, links. */

package/lib/types/mobile/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../../src/mobile/markdown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,sCAAsC;AACtC,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQlD;AAgBD,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqFjD;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA+HrD"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../../src/mobile/markdown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,sCAAsC;AACtC,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASlD;AAgBD,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqFjD;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA+HrD"}

package/lib/types/mobile/markdown.js

@@ -20,10 +20,12 @@ export function escapeHtml(text) {
 }
 /**
  * Guard a raw link/image target against dangerous protocols. Returns the
- * (trimmed) raw string when safe, else null. Only http:, https:, mailto:
- * and fragment anchors (#...) are allowed; anything with another scheme
- * — javascript:, data:, vbscript:, etc. — is rejected so the value never
- * reaches dangerouslySetInnerHTML.
+ * (trimmed) raw string when safe, else null. Only http:, https:, mailto:,
+ * fragment anchors (#...) and strictly relative paths are allowed; anything
+ * with another scheme — javascript:, data:, vbscript:, etc. — or a
+ * protocol-relative //host target (the browser resolves it against the
+ * current scheme, reaching an arbitrary origin) is rejected so the value
+ * never reaches dangerouslySetInnerHTML.
  */
 export function safeUrl(raw) {
     const trimmed = raw.trim();
@@ -31,6 +33,8 @@ export function safeUrl(raw) {
         return null;
     if (trimmed.startsWith('#'))
         return trimmed;
+    if (trimmed.startsWith('//'))
+        return null;
     const scheme = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(trimmed);
     if (scheme === null)
         return trimmed;

package/lib/types/mobile/markdown.test.js

@@ -4,7 +4,7 @@
  * stripped, and code fences never parse their content.
  */
 import { describe, expect, it } from 'vitest';
-import { escapeHtml, renderInline, renderMarkdown, safeUrl } from "./markdown.js";
+import { escapeHtml, renderInline, renderMarkdown, safeUrl } from './markdown.js';
 describe('safeUrl', () => {
     it('allows http/https/mailto/fragments and scheme-less targets', () => {
         expect(safeUrl('https://example.com/a')).toBe('https://example.com/a');
@@ -20,6 +20,10 @@ describe('safeUrl', () => {
         expect(safeUrl('')).toBeNull();
         expect(safeUrl('   ')).toBeNull();
     });
+    it('rejects protocol-relative targets that escape the origin', () => {
+        expect(safeUrl('//attacker.example/x')).toBeNull();
+        expect(safeUrl('  //attacker.example/track.png')).toBeNull();
+    });
 });
 describe('renderInline', () => {
     it('renders code, bold, italic, strikethrough and links', () => {

package/lib/types/mobile/messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/mobile/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAA;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,sFAAsF;IACtF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAC1B;AA6eD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAS7G"}
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/mobile/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAA;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,sFAAsF;IACtF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAC1B;AA6eD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAsB7G"}

package/lib/types/mobile/messages.js

@@ -497,5 +497,18 @@ export function foldEvents(events, existing) {
             continue;
         applyEvent(state, event);
     }
-    return [...state.messages].sort((a, b) => a.seq - b.seq || (a.id < b.id ? -1 : 1));
+    // Incremental tails (the live-stream hot path) are appended in seq order
+    // or updated in place, so the list is usually ordered already — verify in
+    // O(n) and skip the O(n log n) re-sort when it is.
+    const out = state.messages;
+    let ordered = true;
+    for (let index = 1; index < out.length; index += 1) {
+        const prev = out[index - 1];
+        const current = out[index];
+        if (prev.seq > current.seq || (prev.seq === current.seq && prev.id >= current.id)) {
+            ordered = false;
+            break;
+        }
+    }
+    return ordered ? out : [...out].sort((a, b) => a.seq - b.seq || (a.id < b.id ? -1 : 1));
 }

package/lib/types/mobile/messages.test.js

@@ -1,6 +1,6 @@
 /** foldEvents: message-list folding from a session event stream. */
 import { describe, expect, it } from 'vitest';
-import { foldEvents } from "./messages.js";
+import { foldEvents } from './messages.js';
 /** Assemble one event with an auto-incrementing seq / time. */
 function makeEvent(type, data, seq, time = seq * 1_000) {
     return { type, seq, time, data };

package/lib/types/mobile/mobile-theme.test.js

@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 /** mobile-theme: light default, persisted dark toggle, document wiring. */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { getMobileTheme, setMobileTheme, subscribeMobileTheme, toggleMobileTheme, } from "./mobile-theme.js";
+import { getMobileTheme, setMobileTheme, subscribeMobileTheme, toggleMobileTheme, } from './mobile-theme.js';
 const STORAGE_KEY = 'dsh.remote.theme';
 /** jsdom in this setup ships a bare localStorage object; install a real fake. */
 function makeStorage() {
@@ -54,7 +54,7 @@ describe('mobile-theme', () => {
     it('boot reads the stored theme and initMobileTheme applies it', async () => {
         storage.setItem(STORAGE_KEY, 'dark');
         vi.resetModules();
-        const fresh = await import("./mobile-theme.js");
+        const fresh = await import('./mobile-theme.js');
         expect(fresh.getMobileTheme()).toBe('dark');
         fresh.initMobileTheme();
         expect(document.documentElement.dataset.theme).toBe('dark');

package/lib/types/mobile/mux.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mux.d.ts","sourceRoot":"","sources":["../../../src/mobile/mux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2CAA2C,CAAA;AAGzE,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAEpE,kCAAkC;AAClC,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,CAAA;IAChD;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IACxD,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAA;IACrD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1C,KAAK,IAAI,IAAI,CAAA;CACd;AAuBD;;;;;GAKG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6C;IACxE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IACjE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAE5B,wEAAwE;IACxE,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAAI;IACtB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAQ;IACxB,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;IAC1D,+FAA+F;IAC/F,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,OAAO,CAAQ;IACvB,iFAAiF;IACjF,OAAO,CAAC,UAAU,CAAI;IAEtB;;;OAGG;gBACS,GAAG,SAAsB,EAAE,OAAO,GAAE,gBAAqB;IASrE,+EAA+E;IAC/E,KAAK,IAAI,IAAI;IAOb,sBAAsB;IACtB,IAAI,IAAI,IAAI;IASZ,sEAAsE;IACtE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAKxD;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAY5C,OAAO,CAAC,OAAO;IAqBf;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,IAAI;IAkBZ,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,WAAW;IAInB;;;;OAIG;YACW,QAAQ;IAsBtB,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,IAAI;IAUZ,OAAO,CAAC,WAAW;CAapB"}
+{"version":3,"file":"mux.d.ts","sourceRoot":"","sources":["../../../src/mobile/mux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2CAA2C,CAAA;AAGzE,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAEpE,kCAAkC;AAClC,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,CAAA;IAChD;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IACxD,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAA;IACrD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1C,KAAK,IAAI,IAAI,CAAA;CACd;AAuBD;;;;;GAKG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6C;IACxE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IACjE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAE5B,wEAAwE;IACxE,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAAI;IACtB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAQ;IACxB,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;IAC1D,+FAA+F;IAC/F,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,OAAO,CAAQ;IACvB,iFAAiF;IACjF,OAAO,CAAC,UAAU,CAAI;IAEtB;;;OAGG;IACH,YAAY,GAAG,SAAsB,EAAE,OAAO,GAAE,gBAAqB,EAOpE;IAED,+EAA+E;IAC/E,KAAK,IAAI,IAAI,CAKZ;IAED,sBAAsB;IACtB,IAAI,IAAI,IAAI,CAOX;IAED,sEAAsE;IACtE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI,CAGvD;IAED;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAU3C;IAED,OAAO,CAAC,OAAO;IAqBf;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,IAAI;IAkBZ,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,WAAW;IAInB;;;;OAIG;YACW,QAAQ;IAsBtB,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,IAAI;IAUZ,OAAO,CAAC,WAAW;CAapB"}

package/lib/types/mobile/mux.js

@@ -25,7 +25,7 @@
  */
 import { muxFrameSchema } from '@deepseek-ai/dsh-host-apiproxy/api/events.schema';
 import { serverRequestSchema } from '@deepseek-ai/dsh-host-apiproxy/api/rpc.schema';
-import { history as fetchHistory } from "./api.js";
+import { history as fetchHistory } from './api.js';
 /** Browser default source factory. */
 function browserSource(url) {
     // The DOM EventSource is structurally compatible; the `this`-typed handler

package/lib/types/mobile/mux.test.js

@@ -1,6 +1,6 @@
 /** mux: live-event client, SSE delivery + stall-driven polling fallback. */
 import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { MuxClient } from "./mux.js";
+import { MuxClient } from './mux.js';
 /** Create an EventSource factory that records every opened source. */
 function makeSources() {
     const sources = [];

package/lib/types/mobile/rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../../src/mobile/rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0EAA0E;AAC1E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,kEAAkE;AAClE,qBAAa,YAAa,SAAQ,KAAK;IACrC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;gBAErC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAKrD;AAID,8EAA8E;AAC9E,wBAAgB,SAAS,IAAI,MAAM,CAMlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAmCZ"}
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../../src/mobile/rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,0EAA0E;AAC1E,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,kEAAkE;AAClE,qBAAa,YAAa,SAAQ,KAAK;IACrC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAEjD,YAAY,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAInD;CACF;AAID,8EAA8E;AAC9E,wBAAgB,SAAS,IAAI,MAAM,CAMlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAmCZ"}

package/lib/types/mobile/theme-toggle.js

@@ -6,7 +6,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * mode); the choice persists across visits.
  */
 import { useSyncExternalStore } from 'react';
-import { getMobileTheme, subscribeMobileTheme, toggleMobileTheme } from "./mobile-theme.js";
+import { getMobileTheme, subscribeMobileTheme, toggleMobileTheme } from './mobile-theme.js';
 /** Sun glyph: circle + eight rays (inline SVG, no emoji). */
 function SunIcon() {
     return (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.8", strokeLinecap: "round", "aria-hidden": true, children: [_jsx("circle", { cx: "12", cy: "12", r: "4.2" }), _jsx("path", { d: "M12 2.5v2.4M12 19.1v2.4M2.5 12h2.4M19.1 12h2.4M5 5l1.7 1.7M17.3 17.3 19 19M19 5l-1.7 1.7M6.7 17.3 5 19" })] }));

package/lib/types/mobile/views/App.d.ts

@@ -14,17 +14,6 @@ export interface SessionView {
     running: boolean;
     blank: boolean;
 }
-/** One rendered chat message (produced by the fold). */
-export interface RenderMessage {
-    id: string;
-    kind: 'user' | 'assistant';
-    text: string;
-    seq: number;
-    time: number;
-    pending?: boolean;
-    failed?: boolean;
-    toolSummary?: string;
-}
 /** Read the optional workspace target carried from the pairing QR flow. */
 export declare function mobileWorkspaceTarget(search: string): string | undefined;
 /** Map a list row to the surface model; the title comes from projections when present. */

package/lib/types/mobile/views/App.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/App.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA2B,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAazF,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxE;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAA;CACnD,GAAG,WAAW,CAad;AAED,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;GAGG;AACH,wBAAgB,GAAG,gCA4DlB;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKhD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIjE;AAED,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,4CAEtF;AAED,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,CAAA"}
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../../../src/mobile/views/App.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA2B,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAazF,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;CACf;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxE;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAA;CACnD,GAAG,WAAW,CAad;AAED,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;GAGG;AACH,wBAAgB,GAAG,gCA4DlB;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKhD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIjE;AAED,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,4CAEtF;AAED,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,CAAA"}

package/lib/types/mobile/views/App.js

@@ -6,12 +6,12 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * affordance, and every piece of data is fetched on demand.
  */
 import { useCallback, useEffect, useRef, useState } from 'react';
-import { history as fetchHistory, listSessions, listWorkspaces, prompt } from "../api.js";
-import { MuxClient } from "../mux.js";
-import { RpcCallError, RpcTransportError } from "../rpc.js";
-import { ChatView } from "./ChatView.js";
-import { SessionListView } from "./SessionListView.js";
-import { WorkspaceView as WorkspaceRoster } from "./WorkspaceView.js";
+import { history as fetchHistory, listSessions, listWorkspaces, prompt } from '../api.js';
+import { MuxClient } from '../mux.js';
+import { RpcCallError, RpcTransportError } from '../rpc.js';
+import { ChatView } from './ChatView.js';
+import { SessionListView } from './SessionListView.js';
+import { WorkspaceView as WorkspaceRoster } from './WorkspaceView.js';
 /** Read the optional workspace target carried from the pairing QR flow. */
 export function mobileWorkspaceTarget(search) {
     const value = new URLSearchParams(search).get('workspace');

package/lib/types/mobile/views/ChatView.js

@@ -12,12 +12,12 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *   permission pickers, both as bottom sheets.
  */
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { loadHistory, prompt } from "./App.js";
-import { errorText, formatTime, staleHostHint } from "./App.js";
-import { fetchMobilePreferences, models, selectModel, sendCommand } from "../api.js";
-import { foldEvents } from "../messages.js";
-import { renderMarkdown } from "../markdown.js";
-import { ThemeToggle } from "../theme-toggle.js";
+import { loadHistory, prompt } from './App.js';
+import { errorText, formatTime, staleHostHint } from './App.js';
+import { fetchMobilePreferences, models, selectModel, sendCommand } from '../api.js';
+import { foldEvents } from '../messages.js';
+import { renderMarkdown } from '../markdown.js';
+import { ThemeToggle } from '../theme-toggle.js';
 /**
  * Hard cap on live events buffered while the initial history tail page is in
  * flight. Beyond this the oldest buffered event is dropped and a follow-up

package/lib/types/mobile/views/ChatView.test.js

@@ -3,7 +3,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 /** ChatView: collapsible message folds, toolbar chips, and the bottom sheets. */
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
-import { ChatView, MAX_TAIL_BUFFER_EVENTS } from "./ChatView.js";
+import { ChatView, MAX_TAIL_BUFFER_EVENTS } from './ChatView.js';
 // The api module is fully mocked; App.tsx's history wrapper is overridden to
 // feed fixed history pages, its pure helpers (errorText / formatTime) stay real.
 vi.mock('../api.ts', () => ({
@@ -20,8 +20,8 @@ vi.mock('./App.tsx', async (importOriginal) => {
         prompt: vi.fn(async () => { }),
     };
 });
-import { fetchMobilePreferences, models, selectModel, sendCommand } from "../api.js";
-import { loadHistory, prompt } from "./App.js";
+import { fetchMobilePreferences, models, selectModel, sendCommand } from '../api.js';
+import { loadHistory, prompt } from './App.js';
 const session = {
     sessionId: 's-1',
     title: '测试会话',

package/lib/types/mobile/views/SessionListView.js

@@ -12,9 +12,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * the new chat — the same "new session opens" flow as the desktop UI.
  */
 import { useCallback, useEffect, useRef, useState } from 'react';
-import { createSession, listSessions, listWorkspaces } from "../api.js";
-import { errorText, formatTime, staleHostHint, toSessionView } from "./App.js";
-import { ThemeToggle } from "../theme-toggle.js";
+import { createSession, listSessions, listWorkspaces } from '../api.js';
+import { errorText, formatTime, staleHostHint, toSessionView } from './App.js';
+import { ThemeToggle } from '../theme-toggle.js';
 /** Rows that belong to the opened workspace (its owned session id set). */
 function ownedItems(page, workspace) {
     const owned = new Set(workspace.sessionIds);

package/lib/types/mobile/views/SessionListView.test.js

@@ -3,14 +3,14 @@ import { jsx as _jsx } from "react/jsx-runtime";
 /** SessionListView: owned-row filtering, incremental pages, session creation. */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
-import { SessionListView } from "./SessionListView.js";
+import { SessionListView } from './SessionListView.js';
 // The api module is fully mocked; the view's App.tsx helpers stay real.
 vi.mock('../api.ts', () => ({
     listSessions: vi.fn(),
     listWorkspaces: vi.fn(),
     createSession: vi.fn(),
 }));
-import { createSession, listSessions, listWorkspaces } from "../api.js";
+import { createSession, listSessions, listWorkspaces } from '../api.js';
 const listSessionsMock = vi.mocked(listSessions);
 const listWorkspacesMock = vi.mocked(listWorkspaces);
 const createSessionMock = vi.mocked(createSession);

package/lib/types/mobile/views/WorkspaceView.js

@@ -6,9 +6,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * until a workspace is opened).
  */
 import { useEffect, useState } from 'react';
-import { listWorkspaces } from "../api.js";
-import { errorText } from "./App.js";
-import { ThemeToggle } from "../theme-toggle.js";
+import { listWorkspaces } from '../api.js';
+import { errorText } from './App.js';
+import { ThemeToggle } from '../theme-toggle.js';
 /**
  * Render the workspace roster.
  * @param props - the pick action.

package/lib/types/mobile/views/WorkspaceView.test.js

@@ -3,12 +3,12 @@ import { jsx as _jsx } from "react/jsx-runtime";
 /** Mobile workspace landing: roster rendering and QR deep-link selection. */
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { cleanup, render, screen, waitFor } from '@testing-library/react';
-import { mobileWorkspaceTarget } from "./App.js";
-import { WorkspaceView } from "./WorkspaceView.js";
+import { mobileWorkspaceTarget } from './App.js';
+import { WorkspaceView } from './WorkspaceView.js';
 vi.mock('../api.ts', () => ({
     listWorkspaces: vi.fn(),
 }));
-import { listWorkspaces } from "../api.js";
+import { listWorkspaces } from '../api.js';
 const listWorkspacesMock = vi.mocked(listWorkspaces);
 const workspaces = [
     {

package/lib/types/mobile-api.d.ts

@@ -34,7 +34,7 @@ export interface MobileApiDeps {
 }
 /** Mobile API route paths. */
 export declare const MOBILE_API_PATHS: {
-    readonly events: "/m/api/events.mux";
+    readonly events: '/m/api/events.mux';
 };
 /**
  * Build the mobile data-channel routes.

package/lib/types/mobile-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA6InE"}
+{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAiDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;aAC3B,MAAM,EAAE,mBAAmB;CACnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA4InE"}

package/lib/types/mobile-api.js

@@ -19,7 +19,8 @@
  *   unary channel), gated identically.
  */
 import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc';
-import { readCookie } from "./gate.js";
+import { readBoundedJson, writeJson } from './http.js';
+import { readCookie } from './gate.js';
 /** Methods the phone surface may call. Everything else is refused. */
 const MOBILE_ALLOWLIST = new Set([
     'workspace.list',
@@ -95,10 +96,6 @@ export function makeMobileApiRoutes(deps) {
     const gateOk = (req) => {
         return touchDeviceFor(req);
     };
-    const writeJson = (res, status, body) => {
-        res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
-        res.end(JSON.stringify(body));
-    };
     const handleMethod = async (req, res) => {
         if (req.method !== 'POST') {
             res.writeHead(405);
@@ -143,7 +140,12 @@ export function makeMobileApiRoutes(deps) {
             return;
         }
         try {
-            const response = await dispatch(apiProxy, method, parsed?.payload, rpcId);
+            // Cancel the host-side work when the phone goes away mid-call (the
+            // response stream closing before we answer means nobody is listening).
+            const abort = new AbortController();
+            res.on('close', () => { if (!res.writableEnded)
+                abort.abort(); });
+            const response = await dispatch(apiProxy, method, parsed?.payload, rpcId, abort.signal);
             writeJson(res, 200, response);
         }
         catch (error) {
@@ -222,19 +224,10 @@ export function makeMobileApiRoutes(deps) {
 }
 /** Read a request body as JSON (bounded). */
 async function readJsonBody(req) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        const buffer = chunk;
-        size += buffer.length;
-        if (size > 64 * 1024)
-            throw new Error('body too large');
-        chunks.push(buffer);
-    }
-    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    return readBoundedJson(req, 64 * 1024);
 }
 /** Dispatch one allowlisted method through the host ApiProxy. */
-async function dispatch(apiProxy, method, payload, rpcId) {
+async function dispatch(apiProxy, method, payload, rpcId, signal) {
     const request = { rpcId: RpcId(rpcId), payload };
     if (method === 'session.list') {
         const full = await apiProxy.sessions.list(request);
@@ -285,7 +278,7 @@ async function dispatch(apiProxy, method, payload, rpcId) {
     if (method === 'session.history')
         return wrap(await apiProxy.sessions.history(request));
     if (method === 'session.search')
-        return wrap(await apiProxy.sessions.search(request, new AbortController().signal));
+        return wrap(await apiProxy.sessions.search(request, signal ?? new AbortController().signal));
     if (method === 'session.prompt')
         return wrap(await apiProxy.sessions.prompt(request));
     if (method === 'session.models')

package/lib/types/mobile-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAwD/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAmC7C"}
+{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAwD/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAyC7C"}

package/lib/types/mobile-routes.js

@@ -67,19 +67,25 @@ export function makeMobileRoutes() {
     const handlePage = (_req, res) => {
         writeStatic(res, 200, 'text/html', pageHtml('/m/mobile.js'));
     };
+    // The bundle is immutable for the process lifetime (a rebuild requires a
+    // host restart), so the ~456KB body is read from disk once, not per phone.
+    let bundleBody;
     const handleBundle = async (_req, res) => {
-        const path = mobileBundlePath();
-        if (!existsSync(path)) {
-            writeStatic(res, 503, 'text/plain', 'mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build');
-            return;
-        }
-        try {
-            const body = await readFile(path, 'utf8');
-            writeStatic(res, 200, 'text/javascript', body);
-        }
-        catch {
-            writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle');
+        if (bundleBody === undefined) {
+            const path = mobileBundlePath();
+            if (!existsSync(path)) {
+                writeStatic(res, 503, 'text/plain', 'mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build');
+                return;
+            }
+            try {
+                bundleBody = await readFile(path, 'utf8');
+            }
+            catch {
+                writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle');
+                return;
+            }
         }
+        writeStatic(res, 200, 'text/javascript', bundleBody);
     };
     const handleIcon = async (_req, res) => {
         const path = appleTouchIconPath();

package/lib/types/mount-once.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export declare function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T;
+//# sourceMappingURL=mount-once.d.ts.map

package/lib/types/mount-once.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-once.d.ts","sourceRoot":"","sources":["../../src/mount-once.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;GAcG;AAaH;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAW9F"}