@linxin666/dsh-remote-web-ui 0.3.6 → 0.3.9

package/lib/types/mobile/views/WorkspaceView.test.js

@@ -1,183 +0,0 @@
-import { jsx as _jsx } from "react/jsx-runtime";
-// @vitest-environment jsdom
-/** Mobile workspace landing: roster rendering and QR deep-link selection. */
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { cleanup, render, screen, waitFor, fireEvent } from '@testing-library/react';
-import { mobileWorkspaceTarget } from "./App.js";
-import { WorkspaceView } from "./WorkspaceView.js";
-vi.mock('../api.ts', () => ({
-    listWorkspaces: vi.fn(),
-    listDirectory: vi.fn(),
-    createWorkspace: vi.fn(),
-}));
-import { listWorkspaces, listDirectory, createWorkspace } from "../api.js";
-const listWorkspacesMock = vi.mocked(listWorkspaces);
-const listDirectoryMock = vi.mocked(listDirectory);
-const createWorkspaceMock = vi.mocked(createWorkspace);
-const workspaces = [
-    {
-        workspaceId: 'ws-1',
-        path: '/tmp/first',
-        title: 'First',
-        sessionIds: [],
-        createdAt: '2026-01-01T00:00:00.000Z',
-        updatedAt: '2026-01-01T00:00:00.000Z',
-    },
-    {
-        workspaceId: 'ws-2',
-        path: '/tmp/second',
-        title: 'Second',
-        sessionIds: [],
-        createdAt: '2026-01-01T00:00:00.000Z',
-        updatedAt: '2026-01-01T00:00:00.000Z',
-    },
-];
-afterEach(() => {
-    cleanup();
-    vi.clearAllMocks();
-});
-describe('mobile workspace deep link', () => {
-    it('reads a non-empty workspace target from the query', () => {
-        expect(mobileWorkspaceTarget('?workspace=ws-2')).toBe('ws-2');
-        expect(mobileWorkspaceTarget('?workspace=')).toBeUndefined();
-        expect(mobileWorkspaceTarget('')).toBeUndefined();
-    });
-    it('opens the targeted workspace as soon as the roster loads', async () => {
-        listWorkspacesMock.mockResolvedValue(workspaces);
-        const onPick = vi.fn();
-        render(_jsx(WorkspaceView, { initialWorkspaceId: "ws-2", onPick: onPick }));
-        await waitFor(() => expect(onPick).toHaveBeenCalledWith(workspaces[1]));
-        expect(onPick).toHaveBeenCalledTimes(1);
-    });
-    it('falls back to the roster when the target no longer exists', async () => {
-        listWorkspacesMock.mockResolvedValue(workspaces);
-        const onPick = vi.fn();
-        render(_jsx(WorkspaceView, { initialWorkspaceId: "missing", onPick: onPick }));
-        expect(await screen.findByText('First')).toBeTruthy();
-        expect(await screen.findByText('Second')).toBeTruthy();
-        expect(onPick).not.toHaveBeenCalled();
-    });
-});
-describe('mobile workspace creation', () => {
-    it('shows new workspace button and navigates to directory browser', async () => {
-        listWorkspacesMock.mockResolvedValue(workspaces);
-        listDirectoryMock.mockResolvedValue({
-            path: '/home/user',
-            home: '/home/user',
-            crumbs: [{ name: '', path: '/', hidden: false }, { name: 'home', path: '/home', hidden: false }, { name: 'user', path: '/home/user', hidden: false }],
-            entries: [
-                { name: 'projects', path: '/home/user/projects', hidden: false },
-                { name: '.config', path: '/home/user/.config', hidden: true }
-            ],
-            truncated: false
-        });
-        const onPick = vi.fn();
-        render(_jsx(WorkspaceView, { onPick: onPick }));
-        // Wait for workspaces to load
-        const createBtn = await screen.findByText('+ 新建工作区');
-        // Click create button
-        fireEvent.click(createBtn);
-        // Verify directory browser renders
-        expect(await screen.findByText('选择目录')).toBeTruthy();
-        // Verify crumbs
-        expect(await screen.findByText('user')).toBeTruthy();
-        // Verify entries
-        expect(await screen.findByText('projects')).toBeTruthy();
-        expect(await screen.findByText('.config')).toBeTruthy();
-    });
-    it('navigates into directory and allows breadcrumb navigation', async () => {
-        listWorkspacesMock.mockResolvedValue(workspaces);
-        // Initial dir
-        listDirectoryMock.mockResolvedValueOnce({
-            path: '/home/user',
-            home: '/home/user',
-            crumbs: [{ name: '', path: '/', hidden: false }, { name: 'home', path: '/home', hidden: false }, { name: 'user', path: '/home/user', hidden: false }],
-            entries: [{ name: 'projects', path: '/home/user/projects', hidden: false }],
-            truncated: false
-        });
-        const onPick = vi.fn();
-        render(_jsx(WorkspaceView, { onPick: onPick }));
-        // Open dir browser
-        fireEvent.click(await screen.findByText('+ 新建工作区'));
-        // Wait for first dir listing
-        const projBtn = await screen.findByText('projects');
-        // Prepare next listing
-        listDirectoryMock.mockResolvedValueOnce({
-            path: '/home/user/projects',
-            home: '/home/user',
-            crumbs: [
-                { name: '', path: '/', hidden: false },
-                { name: 'home', path: '/home', hidden: false },
-                { name: 'user', path: '/home/user', hidden: false },
-                { name: 'projects', path: '/home/user/projects', hidden: false }
-            ],
-            entries: [{ name: 'foo', path: '/home/user/projects/foo', hidden: false }],
-            truncated: false
-        });
-        // Click into folder
-        fireEvent.click(projBtn);
-        // Verify new contents load
-        expect(await screen.findByText('foo')).toBeTruthy();
-        // Check breadcrumb
-        const homeCrumb = screen.getByText('home');
-        expect(homeCrumb).toBeTruthy();
-        // Click breadcrumb
-        listDirectoryMock.mockResolvedValueOnce({
-            path: '/home',
-            home: '/home/user',
-            crumbs: [{ name: '', path: '/', hidden: false }, { name: 'home', path: '/home', hidden: false }],
-            entries: [{ name: 'user', path: '/home/user', hidden: false }],
-            truncated: false
-        });
-        fireEvent.click(homeCrumb);
-        expect(await screen.findByText('user')).toBeTruthy();
-    });
-    it('creates workspace successfully', async () => {
-        listWorkspacesMock.mockResolvedValue(workspaces);
-        listDirectoryMock.mockResolvedValue({
-            path: '/home/user/projects/foo',
-            home: '/home/user',
-            crumbs: [{ name: '', path: '/', hidden: false }, { name: 'foo', path: '/home/user/projects/foo', hidden: false }],
-            entries: [],
-            truncated: false
-        });
-        const newWorkspace = { ...workspaces[0], workspaceId: 'ws-new', title: 'foo' };
-        createWorkspaceMock.mockResolvedValue({
-            workspace: newWorkspace,
-            created: true
-        });
-        const onPick = vi.fn();
-        render(_jsx(WorkspaceView, { onPick: onPick }));
-        fireEvent.click(await screen.findByText('+ 新建工作区'));
-        const selectBtn = await screen.findByText('选择此目录');
-        fireEvent.click(selectBtn);
-        expect(await screen.findByText('创建中…')).toBeTruthy();
-        await waitFor(() => {
-            expect(createWorkspaceMock).toHaveBeenCalledWith('/home/user/projects/foo');
-            expect(onPick).toHaveBeenCalledWith(newWorkspace);
-        });
-    });
-    it('handles errors from directory listing and workspace creation', async () => {
-        listWorkspacesMock.mockResolvedValue(workspaces);
-        listDirectoryMock.mockRejectedValue(new Error('Permission denied'));
-        const onPick = vi.fn();
-        render(_jsx(WorkspaceView, { onPick: onPick }));
-        fireEvent.click(await screen.findByText('+ 新建工作区'));
-        // Verify error from listing
-        expect(await screen.findByText('Permission denied')).toBeTruthy();
-        // Retry with success
-        listDirectoryMock.mockResolvedValue({
-            path: '/home',
-            home: '/home/user',
-            crumbs: [],
-            entries: [],
-            truncated: false
-        });
-        fireEvent.click(screen.getByText('重试'));
-        const selectBtn = await screen.findByText('选择此目录');
-        // Fail creation
-        createWorkspaceMock.mockRejectedValue(new Error('Already exists'));
-        fireEvent.click(selectBtn);
-        expect(await screen.findByText('Already exists')).toBeTruthy();
-    });
-});

package/lib/types/mobile-api.d.ts

@@ -1,65 +0,0 @@
-/**
- * The mobile surface's data channel: `/m/api` proxies the host ApiProxy
- * service for the standalone phone page. The phone's RPC calls ride THIS
- * prefix instead of the connection plugin's `/api` — so the tunneled Host
- * never needs to enter the connection trust fence (a distributable plugin
- * cannot change that fence), and this plugin's own pairing gate is the
- * access control instead.
- *
- * Security model:
- * - Every request must carry a live paired-device cookie (the same gate
- *   semantic as the LAN fence), enforced before any host call.
- * - Only an explicit allowlist of methods is proxied ON THIS PREFIX. The
- *   allowlist constrains the /m/api proxy alone: the same paired-device
- *   cookie also passes the global api/gate, so a paired device is a
- *   full-control credential for the host /api surface outside the SDK's
- *   loopback-pinned privileged set (settings/credentials/agentPreset/host
- *   actions/llm.discoverModels). Pairing is full device trust.
- * - `session.list` is paged here (the host API returns everything; this
- *   layer slices stable pages) so the phone never transfers the whole list.
- * - The live mux stream is bridged over Server-Sent Events on the same
- *   prefix (one-directional push; answers to questions/approvals ride the
- *   unary channel), gated identically.
- */
-import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
-import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy';
-import type { PendingTracker } from './mobile-pending.ts';
-import type { PairingService } from './pairing.ts';
-/** Route-family dependencies. */
-export interface MobileApiDeps {
-    /** The pairing service (device gate + cookie name). */
-    service: PairingService;
-    /** The host ApiProxy service (injected by the plugin). */
-    apiProxy: ApiProxy;
-    /** The pending tracker. */
-    pendingTracker: PendingTracker;
-    /** The resolved mobile composer preference (live per request). */
-    mobileEnterToSend: () => boolean;
-    /** SSE keep-alive ping cadence for the mux stream (default 15000 ms; test seam). */
-    eventsHeartbeatMs?: number;
-    /**
-     * Optional command dispatcher for executing slash commands on the mobile
-     * surface. When absent, `mobile.command` returns an error; the mobile UI
-     * can still fall back to `session.prompt` (which sends the line to the
-     * model, not the command registry).
-     */
-    commandDispatcher?: {
-        execute(sessionId: string, line: string, signal: AbortSignal): Promise<{
-            ok: true;
-            result: unknown;
-        } | {
-            error: string;
-        }>;
-    };
-}
-/** Mobile API route paths. */
-export declare const MOBILE_API_PATHS: {
-    readonly events: "/m/api/events.mux";
-};
-/**
- * Build the mobile data-channel routes.
- * @param deps - pairing service + apiProxy.
- * @returns the routes to register on webServer.
- */
-export declare function makeMobileApiRoutes(deps: MobileApiDeps): WebRoute[];
-//# sourceMappingURL=mobile-api.d.ts.map

package/lib/types/mobile-api.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgElD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,2BAA2B;IAC3B,cAAc,EAAE,cAAc,CAAA;IAC9B,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE;QAClB,OAAO,CACL,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAC9D,CAAA;CACF;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA2NnE"}

package/lib/types/mobile-api.js

@@ -1,404 +0,0 @@
-/**
- * The mobile surface's data channel: `/m/api` proxies the host ApiProxy
- * service for the standalone phone page. The phone's RPC calls ride THIS
- * prefix instead of the connection plugin's `/api` — so the tunneled Host
- * never needs to enter the connection trust fence (a distributable plugin
- * cannot change that fence), and this plugin's own pairing gate is the
- * access control instead.
- *
- * Security model:
- * - Every request must carry a live paired-device cookie (the same gate
- *   semantic as the LAN fence), enforced before any host call.
- * - Only an explicit allowlist of methods is proxied ON THIS PREFIX. The
- *   allowlist constrains the /m/api proxy alone: the same paired-device
- *   cookie also passes the global api/gate, so a paired device is a
- *   full-control credential for the host /api surface outside the SDK's
- *   loopback-pinned privileged set (settings/credentials/agentPreset/host
- *   actions/llm.discoverModels). Pairing is full device trust.
- * - `session.list` is paged here (the host API returns everything; this
- *   layer slices stable pages) so the phone never transfers the whole list.
- * - The live mux stream is bridged over Server-Sent Events on the same
- *   prefix (one-directional push; answers to questions/approvals ride the
- *   unary channel), gated identically.
- */
-import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc';
-import { readBoundedJson, writeJson } from "./http.js";
-import { readCookie } from "./gate.js";
-/**
- * Methods the phone surface may call. Everything else is refused HERE — but
- * note the paired-device cookie also passes the global api/gate for the full
- * ApiProxy surface (gate.ts), so a paired phone is a full-control credential:
- * the allowlist only constrains this /m/api proxy, not the cookie's reach.
- * stop() revokes every device; the loopback panel can also revoke one
- * device at a time.
- */
-const MOBILE_ALLOWLIST = new Set([
-    'host.listDirectory',
-    'workspace.create',
-    'workspace.list',
-    'agentPreset.list',
-    'session.create',
-    'session.list',
-    'session.history',
-    'session.search',
-    'session.prompt',
-    'session.models',
-    'session.selectModel',
-    'session.rename',
-    'session.cancel',
-]);
-/**
- * Locally answered display-preference method (the phone's read-only
- * surface preferences; never proxied to the host ApiProxy and never a
- * settings-domain write).
- */
-const MOBILE_PREFERENCES_METHOD = 'mobile.preferences';
-const MOBILE_PENDING_METHOD = 'mobile.pending';
-const MOBILE_RESPOND_METHOD = 'mobile.respond';
-/** Execute a slash command through the host command registry (#1125). */
-const MOBILE_COMMAND_METHOD = 'mobile.command';
-/** One session.list page (thin phones load incrementally). */
-const SESSION_PAGE_SIZE = 20;
-/** SSE keep-alive ping cadence for the live mux stream (single connection). */
-const DEFAULT_EVENTS_HEARTBEAT_MS = 15_000;
-/** Encode one list position as an opaque continuation cursor. */
-function sessionListCursor(updatedAt, sessionId) {
-    return `${updatedAt}:${sessionId}`;
-}
-/** Parse a cursor; malformed cursors mean "start over" (safe failure mode). */
-function parseSessionListCursor(cursor) {
-    const separator = cursor.indexOf(':');
-    if (separator < 0)
-        return undefined;
-    const updatedAt = Number(cursor.slice(0, separator));
-    if (!Number.isFinite(updatedAt))
-        return undefined;
-    return { updatedAt, sessionId: cursor.slice(separator + 1) };
-}
-/** Whether a row comes strictly after the cursor position. */
-function afterCursor(row, position) {
-    return row.updatedAt < position.updatedAt
-        || (row.updatedAt === position.updatedAt && row.sessionId > position.sessionId);
-}
-/** Mobile API route paths. */
-export const MOBILE_API_PATHS = {
-    events: '/m/api/events.mux',
-};
-/** The mobile-api prefix (every other path under it is a method name). */
-const MOBILE_API_PREFIX = '/m/api';
-/** Method extraction: the prefix plus one slash. */
-const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
-/**
- * Build the mobile data-channel routes.
- * @param deps - pairing service + apiProxy.
- * @returns the routes to register on webServer.
- */
-export function makeMobileApiRoutes(deps) {
-    const { service, apiProxy, mobileEnterToSend } = deps;
-    const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
-    /**
-     * Refresh the paired device's presence and report whether it is live.
-     * The mobile surface (unlike the desktop Web UI) has no `/api/pair/heartbeat`
-     * sender, so any activity on the mobile channel — a gated RPC, or the live
-     * SSE stream staying open — must count as presence. Without this, an
-     * idle-but-connected phone ages past `offlineAfterMs` and the desktop panel
-     * wrongly reports it as disconnected.
-     */
-    const touchDeviceFor = (req) => {
-        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-        if (deviceId === undefined)
-            return false;
-        return service.touchDevice(deviceId);
-    };
-    /** The phone gate: a live paired-device cookie, or nothing else proceeds. */
-    const gateOk = (req) => {
-        return touchDeviceFor(req);
-    };
-    const handleMethod = async (req, res) => {
-        if (req.method !== 'POST') {
-            res.writeHead(405);
-            res.end();
-            return;
-        }
-        if (!gateOk(req)) {
-            writeJson(res, 403, { ok: false, error: { code: 'unpaired', message: 'mobile session is not paired' } });
-            return;
-        }
-        const pathname = new URL(req.url ?? '/', 'http://x').pathname;
-        if (!pathname.startsWith(MOBILE_API_METHOD_PREFIX)) {
-            writeJson(res, 404, { ok: false, error: { code: 'not-found', message: 'unknown mobile api path' } });
-            return;
-        }
-        const method = pathname.slice(MOBILE_API_METHOD_PREFIX.length);
-        const local = method === MOBILE_PREFERENCES_METHOD
-            || method === MOBILE_PENDING_METHOD
-            || method === MOBILE_RESPOND_METHOD
-            || method === MOBILE_COMMAND_METHOD;
-        if (!MOBILE_ALLOWLIST.has(method) && !local) {
-            writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: `method ${method} is not exposed to the mobile surface` } });
-            return;
-        }
-        let envelope;
-        try {
-            envelope = await readBoundedJson(req, 64 * 1024);
-        }
-        catch {
-            writeJson(res, 400, { ok: false, error: { code: 'bad-request', message: 'invalid json body' } });
-            return;
-        }
-        const parsed = envelope;
-        const rpcId = typeof parsed?.rpcId === 'string' ? parsed.rpcId : '';
-        if (rpcId === '') {
-            writeJson(res, 400, { ok: false, error: { code: 'bad-request', message: 'missing rpcId' } });
-            return;
-        }
-        if (local) {
-            if (method === MOBILE_PREFERENCES_METHOD) {
-                writeJson(res, 200, {
-                    type: 'server-response',
-                    rpcId,
-                    result: { ok: true, value: { mobileEnterToSend: mobileEnterToSend() } },
-                });
-            }
-            else if (method === MOBILE_PENDING_METHOD) {
-                const payload = parsed.payload;
-                writeJson(res, 200, {
-                    type: 'server-response',
-                    rpcId,
-                    result: { ok: true, value: deps.pendingTracker.pending(payload?.sessionId) },
-                });
-            }
-            else if (method === MOBILE_RESPOND_METHOD) {
-                const payload = parsed.payload;
-                try {
-                    const receipt = await apiProxy.respond({
-                        type: 'client-response',
-                        rpcId: RpcId(payload.rpcId),
-                        result: { ok: true, value: payload.response },
-                    });
-                    writeJson(res, 200, {
-                        type: 'server-response',
-                        rpcId,
-                        result: { ok: true, value: receipt },
-                    });
-                }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    writeJson(res, 200, {
-                        type: 'server-response',
-                        rpcId,
-                        result: { ok: false, error: { code: 'internal', message } },
-                    });
-                }
-            }
-            else if (method === MOBILE_COMMAND_METHOD) {
-                const payload = parsed.payload;
-                const sessionId = payload?.sessionId;
-                const line = payload?.line;
-                if (typeof sessionId !== 'string' || typeof line !== 'string') {
-                    writeJson(res, 200, {
-                        type: 'server-response',
-                        rpcId,
-                        result: { ok: false, error: { code: 'bad-request', message: 'missing sessionId or line' } },
-                    });
-                }
-                else if (deps.commandDispatcher === undefined) {
-                    writeJson(res, 200, {
-                        type: 'server-response',
-                        rpcId,
-                        result: { ok: false, error: { code: 'unavailable', message: 'command dispatcher is not available' } },
-                    });
-                }
-                else {
-                    try {
-                        const abort = new AbortController();
-                        res.on('close', () => { if (!res.writableEnded)
-                            abort.abort(); });
-                        const outcome = await deps.commandDispatcher.execute(sessionId, line, abort.signal);
-                        if ('error' in outcome) {
-                            writeJson(res, 200, {
-                                type: 'server-response',
-                                rpcId,
-                                result: { ok: false, error: { code: outcome.error, message: outcome.error } },
-                            });
-                        }
-                        else {
-                            writeJson(res, 200, {
-                                type: 'server-response',
-                                rpcId,
-                                result: { ok: true, value: { matched: true, result: outcome.result } },
-                            });
-                        }
-                    }
-                    catch (error) {
-                        const message = error instanceof Error ? error.message : String(error);
-                        writeJson(res, 200, {
-                            type: 'server-response',
-                            rpcId,
-                            result: { ok: false, error: { code: 'internal', message } },
-                        });
-                    }
-                }
-            }
-            return;
-        }
-        try {
-            // Cancel the host-side work when the phone goes away mid-call (the
-            // response stream closing before we answer means nobody is listening).
-            const abort = new AbortController();
-            res.on('close', () => { if (!res.writableEnded)
-                abort.abort(); });
-            const response = await dispatch(apiProxy, method, parsed?.payload, rpcId, abort.signal);
-            writeJson(res, 200, response);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            writeJson(res, 200, {
-                type: 'server-response',
-                rpcId,
-                result: { ok: false, error: { code: 'internal', message } },
-            });
-        }
-    };
-    /** Bridge the host mux stream over SSE: one `data:` frame per mux frame. */
-    const handleEvents = async (req, res) => {
-        if (req.method !== 'GET') {
-            res.writeHead(405);
-            res.end();
-            return;
-        }
-        if (!gateOk(req)) {
-            writeJson(res, 403, {
-                ok: false,
-                error: { code: 'unpaired', message: 'mobile session is not paired' },
-            });
-            return;
-        }
-        res.writeHead(200, {
-            'content-type': 'text/event-stream; charset=utf-8',
-            'cache-control': 'no-cache',
-            connection: 'keep-alive',
-        });
-        const controller = new AbortController();
-        let closed = false;
-        const heartbeat = setInterval(() => {
-            if (closed)
-                return;
-            // An open SSE stream proves the phone is still live even while the agent
-            // idles (no RPC traffic), so refresh presence alongside the transport
-            // keepalive — otherwise an idle phone drifts to "disconnected".
-            touchDeviceFor(req);
-            try {
-                res.write(': ping\n\n');
-            }
-            catch {
-                // The write failed; the close handler tears the subscription down.
-            }
-        }, eventsHeartbeatMs);
-        const onClose = () => {
-            if (closed)
-                return;
-            closed = true;
-            controller.abort();
-            clearInterval(heartbeat);
-        };
-        res.on('close', onClose);
-        req.on('close', onClose);
-        try {
-            const frames = apiProxy.events.mux({ rpcId: RpcId(`mobile-mux-${Date.now().toString(36)}`), payload: {} }, controller.signal);
-            for await (const frame of frames) {
-                if (closed)
-                    break;
-                deps.pendingTracker.onFrame(frame);
-                res.write(`data: ${JSON.stringify(frame)}\n\n`);
-            }
-        }
-        catch {
-            // The stream ended or errored; the EventSource reconnects.
-        }
-        finally {
-            controller.abort();
-            clearInterval(heartbeat);
-        }
-        if (!closed)
-            res.end();
-    };
-    return [
-        { kind: 'prefix', path: MOBILE_API_PREFIX, handler: handleMethod },
-        { kind: 'exact', path: MOBILE_API_PATHS.events, handler: handleEvents },
-    ];
-}
-/** Dispatch one allowlisted method through the host ApiProxy. */
-async function dispatch(apiProxy, method, payload, rpcId, signal) {
-    const request = { rpcId: RpcId(rpcId), payload };
-    if (method === 'session.list') {
-        const full = await apiProxy.sessions.list(request);
-        // The error path must carry the same 'server-response' envelope the
-        // success path builds, or the phone's callUnary throws a transport error
-        // and masks the real business error.
-        if (!full.result.ok)
-            return { type: 'server-response', rpcId, result: full.result };
-        const items = full.result.value.items;
-        const cursor = payload?.cursor;
-        // Every call pages (the first call with no cursor IS the first page):
-        // the phone must never transfer the whole session list at once.
-        // One stable page over (updatedAt desc, sessionId asc); pages never skip
-        // or repeat a row while the list changes between calls.
-        items.sort((a, b) => b.updatedAt - a.updatedAt
-            || (a.sessionId < b.sessionId ? -1 : a.sessionId > b.sessionId ? 1 : 0));
-        const position = cursor === undefined ? undefined : parseSessionListCursor(cursor);
-        const from = position === undefined ? 0 : items.findIndex(row => afterCursor(row, position));
-        const start = from < 0 ? items.length : from;
-        const page = items.slice(start, start + SESSION_PAGE_SIZE);
-        const last = page[page.length - 1];
-        const nextCursor = last !== undefined && start + page.length < items.length
-            ? sessionListCursor(last.updatedAt, last.sessionId)
-            : undefined;
-        return {
-            type: 'server-response',
-            rpcId,
-            result: {
-                ok: true,
-                value: {
-                    items: page,
-                    hasMore: nextCursor !== undefined,
-                    ...(nextCursor !== undefined ? { nextCursor } : {}),
-                },
-            },
-        };
-    }
-    // The ApiProxy unary methods resolve to the internal response shape
-    // ({ rpcId, result }) without the transport envelope the phone's callUnary
-    // requires — wrap every pass-through in the same 'server-response'
-    // envelope session.list builds above.
-    const wrap = (response) => ({
-        type: 'server-response',
-        rpcId,
-        result: response.result,
-    });
-    if (method === 'workspace.list')
-        return wrap(await apiProxy.workspace.list(request));
-    if (method === 'workspace.create')
-        return wrap(await apiProxy.workspace.create(request));
-    if (method === 'host.listDirectory')
-        return wrap(await apiProxy.host.listDirectory(request, signal ?? new AbortController().signal));
-    if (method === 'agentPreset.list')
-        return wrap(await apiProxy.agentPresets.list(request));
-    if (method === 'session.create')
-        return wrap(await apiProxy.sessions.create(request));
-    if (method === 'session.history')
-        return wrap(await apiProxy.sessions.history(request));
-    if (method === 'session.search')
-        return wrap(await apiProxy.sessions.search(request, signal ?? new AbortController().signal));
-    if (method === 'session.prompt')
-        return wrap(await apiProxy.sessions.prompt(request));
-    if (method === 'session.models')
-        return wrap(await apiProxy.sessions.models(request));
-    if (method === 'session.selectModel')
-        return wrap(await apiProxy.sessions.selectModel(request));
-    if (method === 'session.rename')
-        return wrap(await apiProxy.sessions.rename(request));
-    if (method === 'session.cancel')
-        return wrap(await apiProxy.sessions.cancel(request));
-    throw new Error(`unhandled allowlisted method ${method}`);
-}