@openchambery/web 1.19.10-beta.1 → 1.19.10

package/server/lib/assistants/service.test.js

@@ -5,6 +5,10 @@ import { describe, expect, it, vi } from 'vitest';
 import { createRequire } from 'node:module';
 import { createAssistantsService } from './service.js';
 import { assistantContractFixtures } from './contracts.js';
+import {
+  CLEAR_CHAT_HISTORY_CONFIRM_BUBBLE,
+  NEW_CONVERSATION_CONFIRM_BUBBLE,
+} from './contact-tools.js';
 
 const require = createRequire(import.meta.url);
 const root = () => fs.mkdtempSync(path.join(os.tmpdir(), 'assistants-'));
@@ -97,7 +101,7 @@ describe('assistants service', () => {
     service.close();
   });
 
-  it('new_conversation clears contact history without calling OpenCode session/new', async () => {
+  it('new_conversation clears LLM memory while keeping the full transcript', async () => {
     const directory = root();
     let creates = 0;
     let lastHistory = null;
@@ -109,7 +113,7 @@ describe('assistants service', () => {
         if (userText === '开新对话') {
           const tool = tools.find((item) => item.name === 'new_conversation');
           const result = await tool.execute('reset_1', {});
-          return { text: result.content[0].text, bubbles: [result.content[0].text] };
+          return { text: result.content[0].text, bubbles: [result.content[0].text], reset: true };
         }
         return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
       },
@@ -125,13 +129,16 @@ describe('assistants service', () => {
     expect(creates).toBe(1);
     const page = service.contactMessages(assistant.id, { limit: 50 });
     expect(page.messages.map((message) => ({ role: message.role, text: message.text }))).toEqual([
+      { role: 'user', text: 'remember this secret' },
+      { role: 'assistant', text: 'reply:remember this secret' },
+      { role: 'user', text: 'and this too' },
+      { role: 'assistant', text: 'reply:and this too' },
       { role: 'user', text: '开新对话' },
-      { role: 'assistant', text: 'Started a new conversation. Previous contact messages are cleared.' },
+      { role: 'assistant', text: NEW_CONVERSATION_CONFIRM_BUBBLE },
     ]);
     await settleSend(service, assistant.id, { messageID: 'fresh_1', parts: [{ type: 'text', text: 'what did I say before?' }] });
     expect(lastHistory.map((item) => item.content)).toEqual([
-      '开新对话',
-      'Started a new conversation. Previous contact messages are cleared.',
+      NEW_CONVERSATION_CONFIRM_BUBBLE,
     ]);
     expect(lastHistory.some((item) => item.content.includes('remember this secret'))).toBe(false);
     service.close();
@@ -144,13 +151,14 @@ describe('assistants service', () => {
         if (userText === '开新对话') {
           await tools.find((item) => item.name === 'new_conversation').execute('reset_leftover', {});
           return {
-            text: 'Started a new conversation. Previous contact messages are cleared.\n\nI still see your dot.png and note.txt.',
+            text: `${NEW_CONVERSATION_CONFIRM_BUBBLE}\n\nI still see your dot.png and note.txt.`,
             bubbles: [
-              'Started a new conversation. Previous contact messages are cleared.',
+              NEW_CONVERSATION_CONFIRM_BUBBLE,
               'I still see your dot.png and note.txt.',
               'Those attachments are still in context.',
             ],
             cards: [{ type: 'card', cardType: 'session', sessionID: 'ses_stale', directory: '/repo', title: 'Old', status: 'busy' }],
+            reset: true,
           };
         }
         return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
@@ -168,30 +176,281 @@ describe('assistants service', () => {
     await settleSend(service, assistant.id, { messageID: 'reset_leftover', parts: [{ type: 'text', text: '开新对话' }] });
     const page = service.contactMessages(assistant.id, { limit: 50 });
     expect(page.messages.map((message) => ({ role: message.role, text: message.text }))).toEqual([
+      { role: 'user', text: 'look at these' },
+      { role: 'assistant', text: 'reply:look at these' },
       { role: 'user', text: '开新对话' },
-      { role: 'assistant', text: 'Started a new conversation. Previous contact messages are cleared.' },
+      { role: 'assistant', text: NEW_CONVERSATION_CONFIRM_BUBBLE },
     ]);
     expect(page.messages.some((message) => message.text.includes('dot.png') || message.text.includes('note.txt'))).toBe(false);
-    expect(page.messages.some((message) => message.cards?.length > 0)).toBe(false);
+    expect(page.messages.filter((message) => message.cards?.length > 0)).toHaveLength(0);
     service.close();
   });
 
-  it('resetContact empties the transcript for a fresh UI refetch without createNew', async () => {
+  it('clear_chat_history and resetContact delete the transcript without createNew', async () => {
     const directory = root();
     let creates = 0;
     const service = setup(directory, {
       create: async () => ({ data: { id: `ses_${++creates}` } }),
+    }, {
+      runContactTurn: async ({ userText, tools }) => {
+        if (userText === '清空聊天记录' || userText === '清除聊天记录') {
+          const tool = tools.find((item) => item.name === 'clear_chat_history');
+          const result = await tool.execute('wipe_1', {});
+          if (result.details?.error) {
+            return { text: result.content[0].text, bubbles: [result.content[0].text] };
+          }
+          return {
+            text: result.content[0].text,
+            bubbles: [result.content[0].text],
+            reset: true,
+            historyCleared: true,
+            messages: [{
+              role: 'toolResult',
+              toolName: 'clear_chat_history',
+              details: result.details,
+            }],
+          };
+        }
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
     });
     const assistant = service.createAssistant(assistantInput);
     await service.ensure(assistant.id);
     await settleSend(service, assistant.id, { messageID: 'keep_1', parts: [{ type: 'text', text: 'hello' }] });
     expect(service.contactMessages(assistant.id, { limit: 50 }).messages.length).toBeGreaterThan(0);
-    expect(service.resetContact(assistant.id)).toEqual({ assistantID: assistant.id, reset: true });
+    expect(service.resetContact(assistant.id)).toEqual({
+      assistantID: assistant.id,
+      reset: true,
+      historyCleared: true,
+    });
     expect(creates).toBe(1);
     expect(service.contactMessages(assistant.id, { limit: 50 })).toMatchObject({
       messages: [],
       complete: true,
     });
+    await settleSend(service, assistant.id, { messageID: 'again_1', parts: [{ type: 'text', text: 'hello again' }] });
+    await settleSend(service, assistant.id, { messageID: 'wipe_1', parts: [{ type: 'text', text: '清空聊天记录' }] });
+    expect(service.contactMessages(assistant.id, { limit: 50 }).messages.map((message) => ({
+      role: message.role,
+      text: message.text,
+    }))).toEqual([
+      { role: 'user', text: '清空聊天记录' },
+      { role: 'assistant', text: CLEAR_CHAT_HISTORY_CONFIRM_BUBBLE },
+    ]);
+    await settleSend(service, assistant.id, { messageID: 'again_2', parts: [{ type: 'text', text: 'hello third' }] });
+    await settleSend(service, assistant.id, { messageID: 'wipe_2', parts: [{ type: 'text', text: '清除聊天记录' }] });
+    expect(service.contactMessages(assistant.id, { limit: 50 }).messages.map((message) => ({
+      role: message.role,
+      text: message.text,
+    }))).toEqual([
+      { role: 'user', text: '清除聊天记录' },
+      { role: 'assistant', text: CLEAR_CHAT_HISTORY_CONFIRM_BUBBLE },
+    ]);
+    service.close();
+  });
+
+  it('rejects malicious clear_chat_history without explicit wipe intent and keeps transcript', async () => {
+    const directory = root();
+    const wipeAttempts = [];
+    const service = setup(directory, {}, {
+      runContactTurn: async ({ userText, tools }) => {
+        if (userText === '清除记忆' || userText === '不要清除聊天记录') {
+          const tool = tools.find((item) => item.name === 'clear_chat_history');
+          const result = await tool.execute(`malicious_${userText}`, {});
+          wipeAttempts.push({
+            userText,
+            error: result.details?.error || null,
+            historyCleared: result.details?.historyCleared === true,
+          });
+          return {
+            text: `blocked:${userText}`,
+            bubbles: [`blocked:${userText}`],
+            messages: [{
+              role: 'toolResult',
+              toolName: 'clear_chat_history',
+              details: result.details,
+            }],
+          };
+        }
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
+    });
+    const assistant = service.createAssistant(assistantInput);
+    await settleSend(service, assistant.id, { messageID: 'seed_keep', parts: [{ type: 'text', text: 'keep-me' }] });
+    await settleSend(service, assistant.id, { messageID: 'bad_memory', parts: [{ type: 'text', text: '清除记忆' }] });
+    await settleSend(service, assistant.id, { messageID: 'bad_negation', parts: [{ type: 'text', text: '不要清除聊天记录' }] });
+    expect(wipeAttempts).toEqual([
+      { userText: '清除记忆', error: 'validation_error', historyCleared: false },
+      { userText: '不要清除聊天记录', error: 'validation_error', historyCleared: false },
+    ]);
+    const texts = service.contactMessages(assistant.id, { limit: 50 }).messages.map((message) => message.text);
+    expect(texts).toContain('keep-me');
+    expect(texts).toContain('清除记忆');
+    expect(texts).toContain('不要清除聊天记录');
+    expect(texts).not.toContain(CLEAR_CHAT_HISTORY_CONFIRM_BUBBLE);
+    service.close();
+  });
+
+  it('loads LLM history at turn start so queued turns respect a prior clear-memory', async () => {
+    const directory = root();
+    const histories = [];
+    let releaseClear;
+    const clearGate = new Promise((resolve) => { releaseClear = resolve; });
+    const service = setup(directory, {}, {
+      runContactTurn: async ({ history, userText, tools }) => {
+        histories.push({ userText, history: history.map((item) => item.content) });
+        if (userText === '开新对话') {
+          await tools.find((item) => item.name === 'new_conversation').execute('queued_clear', {});
+          releaseClear();
+          return { text: 'cleared', bubbles: ['cleared'], reset: true };
+        }
+        if (userText === 'queued after clear') {
+          await clearGate;
+        }
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
+    });
+    const assistant = service.createAssistant(assistantInput);
+    await settleSend(service, assistant.id, { messageID: 'seed_1', parts: [{ type: 'text', text: 'seed secret' }] });
+    const clearSend = service.send(assistant.id, { messageID: 'clear_q', parts: [{ type: 'text', text: '开新对话' }] });
+    const queuedSend = service.send(assistant.id, { messageID: 'queued_q', parts: [{ type: 'text', text: 'queued after clear' }] });
+    await Promise.all([clearSend, queuedSend]);
+    await service.whenContactTurnSettled('clear_q');
+    await service.whenContactTurnSettled('queued_q');
+    const queuedHistory = histories.find((entry) => entry.userText === 'queued after clear')?.history || [];
+    expect(queuedHistory.some((content) => content.includes('seed secret'))).toBe(false);
+    expect(service.contactMessages(assistant.id, { limit: 50 }).messages.some((message) => message.text === 'seed secret')).toBe(true);
+    service.close();
+  });
+
+  it('clear-memory watermark does not permanently exclude later-admitted queued users', async () => {
+    const directory = root();
+    const histories = [];
+    let releaseClear;
+    const clearGate = new Promise((resolve) => { releaseClear = resolve; });
+    const service = setup(directory, {}, {
+      runContactTurn: async ({ history, userText, tools }) => {
+        histories.push({ userText, history: history.map((item) => item.content) });
+        if (userText === '开新对话') {
+          await tools.find((item) => item.name === 'new_conversation').execute('waterline_clear', {});
+          releaseClear();
+          return { text: NEW_CONVERSATION_CONFIRM_BUBBLE, bubbles: [NEW_CONVERSATION_CONFIRM_BUBBLE], reset: true };
+        }
+        if (userText === 'queued keep me') {
+          await clearGate;
+        }
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
+    });
+    const assistant = service.createAssistant(assistantInput);
+    await settleSend(service, assistant.id, { messageID: 'seed_w', parts: [{ type: 'text', text: 'seed secret' }] });
+    const clearSend = service.send(assistant.id, { messageID: 'clear_w', parts: [{ type: 'text', text: '开新对话' }] });
+    const queuedSend = service.send(assistant.id, { messageID: 'queued_w', parts: [{ type: 'text', text: 'queued keep me' }] });
+    await Promise.all([clearSend, queuedSend]);
+    await service.whenContactTurnSettled('clear_w');
+    await service.whenContactTurnSettled('queued_w');
+    await settleSend(service, assistant.id, { messageID: 'follow_w', parts: [{ type: 'text', text: 'follow after queue' }] });
+    const followHistory = histories.find((entry) => entry.userText === 'follow after queue')?.history || [];
+    expect(followHistory.some((content) => content.includes('seed secret'))).toBe(false);
+    expect(followHistory.some((content) => content.includes('queued keep me'))).toBe(true);
+    expect(followHistory.some((content) => content.includes('reply:queued keep me'))).toBe(true);
+    service.close();
+  });
+
+  it('does not inject later-admitted queued user messages into the current turn history', async () => {
+    const directory = root();
+    const histories = [];
+    let releaseFirst;
+    const firstGate = new Promise((resolve) => { releaseFirst = resolve; });
+    const service = setup(directory, {}, {
+      runContactTurn: async ({ history, userText }) => {
+        histories.push({ userText, history: history.map((item) => item.content) });
+        if (userText === 'first turn') {
+          await firstGate;
+        }
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
+    });
+    const assistant = service.createAssistant(assistantInput);
+    await settleSend(service, assistant.id, { messageID: 'seed_hist', parts: [{ type: 'text', text: 'seed prior' }] });
+    const firstSend = service.send(assistant.id, { messageID: 'first_q', parts: [{ type: 'text', text: 'first turn' }] });
+    const queuedSend = service.send(assistant.id, { messageID: 'queued_later', parts: [{ type: 'text', text: 'queued later secret' }] });
+    await Promise.all([firstSend, queuedSend]);
+    // Let the first lane turn observe history while the queued user row is already admitted.
+    releaseFirst();
+    await service.whenContactTurnSettled('first_q');
+    await service.whenContactTurnSettled('queued_later');
+    const firstHistory = histories.find((entry) => entry.userText === 'first turn')?.history || [];
+    expect(firstHistory.some((content) => content.includes('seed prior'))).toBe(true);
+    expect(firstHistory.some((content) => content.includes('queued later secret'))).toBe(false);
+    const queuedHistory = histories.find((entry) => entry.userText === 'queued later secret')?.history || [];
+    expect(queuedHistory.some((content) => content.includes('first turn'))).toBe(true);
+    expect(queuedHistory.some((content) => content.includes('reply:first turn'))).toBe(true);
+    service.close();
+  });
+
+  it('persists clear-memory across restart and isolates assistants', async () => {
+    const directory = root();
+    const service = setup(directory, {}, {
+      runContactTurn: async ({ userText, tools }) => {
+        if (userText === '开新对话') {
+          await tools.find((item) => item.name === 'new_conversation').execute('persist_clear', {});
+          return { text: 'cleared', bubbles: ['cleared'], reset: true };
+        }
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
+    });
+    const first = service.createAssistant(assistantInput);
+    const second = service.createAssistant({ ...assistantInput, name: 'B' });
+    await settleSend(service, first.id, { messageID: 'a1', parts: [{ type: 'text', text: 'alpha secret' }] });
+    await settleSend(service, second.id, { messageID: 'b1', parts: [{ type: 'text', text: 'beta secret' }] });
+    await settleSend(service, first.id, { messageID: 'a_clear', parts: [{ type: 'text', text: '开新对话' }] });
+    expect(service.clearContactMemory(second.id)).toMatchObject({
+      assistantID: second.id,
+      memoryCleared: true,
+      reset: true,
+    });
+    service.close();
+    const histories = [];
+    const restarted = setup(directory, {}, {
+      runContactTurn: async ({ history, userText }) => {
+        histories.push({ assistantHint: userText, history: history.map((item) => item.content) });
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
+    });
+    const assistants = restarted.snapshot().assistants;
+    const a = assistants.find((item) => item.name === 'A');
+    const b = assistants.find((item) => item.name === 'B');
+    await settleSend(restarted, a.id, { messageID: 'a_next', parts: [{ type: 'text', text: 'after restart a' }] });
+    await settleSend(restarted, b.id, { messageID: 'b_next', parts: [{ type: 'text', text: 'after restart b' }] });
+    const aHistory = histories.find((entry) => entry.assistantHint === 'after restart a')?.history || [];
+    const bHistory = histories.find((entry) => entry.assistantHint === 'after restart b')?.history || [];
+    expect(aHistory.some((content) => content.includes('alpha secret'))).toBe(false);
+    expect(bHistory.some((content) => content.includes('beta secret'))).toBe(false);
+    expect(restarted.contactMessages(a.id, { limit: 50 }).messages.some((message) => message.text === 'alpha secret')).toBe(true);
+    expect(restarted.contactMessages(b.id, { limit: 50 }).messages.some((message) => message.text === 'beta secret')).toBe(true);
+    restarted.close();
+  });
+
+  it('exposes clearContactMemory without wiping GET transcript rows', async () => {
+    const directory = root();
+    let lastHistory = null;
+    const service = setup(directory, {}, {
+      runContactTurn: async ({ history, userText }) => {
+        lastHistory = history;
+        return { text: `reply:${userText}`, bubbles: [`reply:${userText}`] };
+      },
+    });
+    const assistant = service.createAssistant(assistantInput);
+    await settleSend(service, assistant.id, { messageID: 'api_1', parts: [{ type: 'text', text: 'visible forever' }] });
+    expect(service.clearContactMemory(assistant.id)).toMatchObject({
+      assistantID: assistant.id,
+      reset: true,
+      memoryCleared: true,
+    });
+    expect(service.contactMessages(assistant.id, { limit: 50 }).messages.some((message) => message.text === 'visible forever')).toBe(true);
+    await settleSend(service, assistant.id, { messageID: 'api_2', parts: [{ type: 'text', text: 'next' }] });
+    expect(lastHistory.some((item) => item.content.includes('visible forever'))).toBe(false);
     service.close();
   });
 

package/server/lib/llm/DOCUMENTATION.md

@@ -83,6 +83,12 @@ an empty success. The 502 body includes `{ error, message }`.
 
 ## Ownership
 
+The hidden generator agent explicitly describes application-owned tool calls:
+it emits `openchamber-tool` JSON for the contact harness to execute and receives
+the results on subsequent requests. Native OpenCode tool permissions remain
+denied. Capability statements and execution errors must follow the supplied
+application tool catalog and actual results.
+
 The Assistant contact harness owns system prompt, OpenChamber transcript,
 bubble splitting, and OpenChamber API tools (`assign_session`). Those tools
 deliver through contact **cards**, not this completions payload. The gateway

package/server/lib/llm/generate.js

@@ -15,7 +15,10 @@ permissions:
     effect: deny
 ---
 
-You are a text generator. Reply with only the requested text. Do not use tools.
+You generate responses for an application-owned assistant. Follow the supplied system instructions and response format.
+The application executes its registered tools, including openchamber-tool JSON fences in your response, and supplies their results on the next request.
+Emit the requested application tool call when an action requires one. Your native tool permissions describe this generator process; the application's supplied tool catalog describes the assistant's capabilities.
+Report execution and failures from supplied tool results only.
 `;
 
 const isMissing = (result) =>

package/server/lib/llm/generate.test.js

@@ -72,7 +72,12 @@ describe('generateOpenCodeText', () => {
       modelID: 'gpt-5-nano',
       messages: [{ role: 'user', content: 'hi' }],
       clientFactory: createOpencodeClient,
-      ensureTempDirectory: async () => '/tmp/openchamber-llm',
+      ensureTempDirectory: async ({ agentMarkdown }) => {
+        expect(agentMarkdown).toContain('openchamber-tool JSON fences')
+        expect(agentMarkdown).toContain('effect: deny')
+        expect(agentMarkdown).toContain('Report execution and failures from supplied tool results only.')
+        return '/tmp/openchamber-llm'
+      },
       detect: async () => ({ available: false, mode: 'throwaway-session' }),
     })
 

package/server/lib/opencode/DOCUMENTATION.md

@@ -352,6 +352,7 @@ When adding or changing Host HTTP APIs that mobile/desktop clients reach over Pr
 - `registerOpenChamberRoutes(app, dependencies)`: registers OpenChamber endpoints:
   - `GET /api/openchamber/update-check`
   - `POST /api/openchamber/update-install`
+    - Standalone web/CLI package installer. Electron-hosted servers return `403` before package-manager work; their owning desktop application manages updates. The desktop instance menu offers this action only for SSH-managed hosts, excluding Relay/imported connections.
   - `GET /api/zen/models`
   - session-index routes (see `session-index/DOCUMENTATION.md`)
   - transcript-cache routes under `/api/openchamber/transcript-cache` (see `transcript-cache/DOCUMENTATION.md`)

package/server/lib/opencode/openchamber-routes.js

@@ -60,6 +60,9 @@ export const registerOpenChamberRoutes = (app, dependencies) => {
   });
 
   app.post('/api/openchamber/update-install', async (_req, res) => {
+    if (process.versions?.electron) {
+      return res.status(403).json({ error: 'Update this instance from its desktop application.' });
+    }
     try {
       const { spawn: spawnChild } = await import('child_process');
       const {

package/server/lib/opencode/openchamber-routes.test.js

@@ -0,0 +1,43 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { registerOpenChamberRoutes } from './openchamber-routes.js';
+import { checkForUpdates } from '../package-manager.js';
+
+vi.mock('../session-index/routes.js', () => ({ registerSessionIndexRoutes: vi.fn() }));
+vi.mock('../transcript-cache/routes.js', () => ({ registerTranscriptCacheRoutes: vi.fn() }));
+vi.mock('../config-sync/routes.js', () => ({ registerConfigSyncRoutes: vi.fn() }));
+vi.mock('../package-manager.js', () => ({
+  checkForUpdates: vi.fn(),
+  getUpdateCommand: vi.fn(),
+  detectPackageManagerDetails: vi.fn(),
+}));
+
+describe('remote update installation runtime boundary', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(checkForUpdates).mockResolvedValue({ available: false });
+  });
+
+  const createApp = (versions) => {
+    const app = express();
+    registerOpenChamberRoutes(app, { express, process: { versions, env: {} } });
+    return app;
+  };
+
+  it('rejects the web installer in an Electron-hosted server before any update work', async () => {
+    const response = await request(createApp({ electron: '40.0.0' }))
+      .post('/api/openchamber/update-install');
+    expect(response.status).toBe(403);
+    expect(response.body.error).toMatch(/desktop application/i);
+    expect(checkForUpdates).not.toHaveBeenCalled();
+  });
+
+  it('preserves the standalone web server update path', async () => {
+    const response = await request(createApp({ node: '24.0.0' }))
+      .post('/api/openchamber/update-install');
+    expect(response.status).toBe(400);
+    expect(response.body.error).toBe('No update available');
+    expect(checkForUpdates).toHaveBeenCalledOnce();
+  });
+});

package/server/lib/relay/DOCUMENTATION.md

@@ -61,6 +61,7 @@ See also `packages/web/server/lib/opencode/DOCUMENTATION.md` (“Catalog / OpenC
 - The tunnel is **transport only**. The OpenChamber server still authenticates every tunneled request exactly as it authenticates a direct remote client. The relay path grants reachability, not authorization.
 - A paired **desktop** client is a device-fleet operator: through the tunnel it can create pairing links, list every paired device, and revoke other devices (parity with the SSH attach flow, where the connecting desktop authenticates as the operator). Mobile (and any other) paired clients stay scoped to their own record. Re-pointing the Host relay endpoint set from a remote bearer remains forbidden — a paired desktop may name any endpoint the host already has, but adding/removing endpoints (including `relayUrl` in pairing requests for a new domain) is an owner-UI / local-desktop-shell action.
 - Clients carry their normal credential. HTTP and SSE requests authenticate with the client's bearer token (a header). **WebSocket upgrades cannot send headers**, so they authenticate with a short-lived URL-scoped token minted beforehand and passed as a query parameter. This asymmetry is important when adding new WebSocket features (see the skill).
+- Desktop switch preflight calls `/auth/session` with the saved bearer over a pinned tunnel before adopting it. `/health` and cached reachability badges provide transport information only. Failed or timed-out probes close their temporary tunnel and preserve the active runtime; successful switch probes transfer ownership of the authenticated tunnel to the runtime.
 - The host authenticates itself to the relay with a signed handshake using its long-lived signing key.
 - Enabling the relay is explicit opt-in and disabled by default; disabling it severs all relay reachability immediately.
 

package/dist/assets/MarkdownRenderer-CqYd9loP.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/MarkstreamRendererImpl-BAEStQuf.js","assets/rolldown-runtime-C0FnF6B9.js","assets/vendor-base-ui-CnHfUmDN.js","assets/vendor-react-DLPElpoQ.js","assets/vendor-markstream-react-DX55XLGO.js","assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js","assets/vendor-markstream-core-Cm34iPLL.js","assets/vendor-floating-ui-dom-BHhLtF5l.js","assets/vendor-floating-ui-core-Co1I1lFV.js","assets/vendor-reactuses-core-DDoDDyM9.js","assets/vendor-lodash-es-DfLbG5Af.js","assets/vendor-js-cookie-hSOiFTtX.js","assets/useMobileNavigationStore-DYJ6I8FV.js","assets/useUIStore-CuaA8-Hp.js","assets/vendor-zustand-B4dlGEM2.js","assets/persistence-DdUac14I.js","assets/vendor-pathe-vBmvQE8f.js","assets/vendor-tanstack-query-core-BWz0ose6.js","assets/platform-B4KKLnZ5.js","assets/vendor-opencode-sdk-C07HQypa.js","assets/vendor-tanstack-react-query-D7pys_c9.js","assets/vendor-sonner-DVzioF3d.js","assets/clipboard-DJ4nQEuY.js","assets/store-BDFdnk6l.js","assets/useAssistantUIStore-me6s63b2.js","assets/vendor-fuse.js-DB5wDJbI.js","assets/utils-BiK3tBGM.js","assets/vendor-class-variance-authority-BLUaYARZ.js","assets/vendor-tailwind-merge-BicNWLTg.js","assets/useThemeSystem-DMzWVJaW.js","assets/useRuntimeAPIs-DSLXJybW.js","assets/url-Pk6tQ1EZ.js","assets/useEffectiveDirectory-D36udiNq.js","assets/markdownHeightCache-CYDlisxr.js","assets/MarkdownRendererImpl-uH_cfmYV.js","assets/vendor-katex--B5dHUyk.js","assets/markdownTheme-DyJ4Gfcj.js","assets/vendor-pierre-diffs-DX7XTPG3.js","assets/vendor-hast-util-to-html-B0p1k5Xa.js","assets/vendor-character-entities-legacy-Wut6vMuj.js","assets/vendor-character-entities-html4-DlN_yAFd.js","assets/vendor-ccount-CyGsA0u7.js","assets/vendor-comma-separated-tokens-B9ouxNNS.js","assets/vendor-oniguruma-to-es-CrHzjjSU.js","assets/vendor-oniguruma-parser-D2DIvhSP.js","assets/vendor-diff-Dq7CZNim.js","assets/vendor-lru_map-DpDied8H.js","assets/markdown-worker-CTsrtpPh.js","assets/FadeInOnReveal-CTlNE4Hg.js","assets/vendor-morphdom-BbKiNDAu.js","assets/vendor-beautiful-mermaid-DykqIK5D.js","assets/vendor-dompurify-CeJNOzik.js","assets/vendor-marked-WVekxjAN.js","assets/vendor-remend-C3cXc-tf.js","assets/MarkstreamRendererImpl-DKhVy3nF.css"])))=>i.map(i=>d[i]);
-import{o as e}from"./rolldown-runtime-C0FnF6B9.js";import{a as t}from"./vendor-zustand-B4dlGEM2.js";import{nt as n,rt as r}from"./vendor-base-ui-CnHfUmDN.js";import{o as i}from"./vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js";import{n as a}from"./vendor-react-DLPElpoQ.js";import{t as o}from"./utils-BiK3tBGM.js";import{a as s,n as c,t as l}from"./markdownHeightCache-CYDlisxr.js";var u=a(),d=e(r(),1),f=`openchamber:chunk-import-reload`,p=250,m=3e4,h=[/Importing a module script failed/i,/Failed to fetch dynamically imported module/i,/error loading dynamically imported module/i,/Loading chunk \S+ failed/i,/ChunkLoadError/i];function g(e){if(e instanceof Error)return`${e.name}\n${e.message}\n${e.stack??``}`;if(typeof e==`string`)return e;try{return JSON.stringify(e)}catch{return String(e)}}function _(e){let t=g(e);return h.some(e=>e.test(t))}function v(e){return`1.19.10-beta.1:${g(e).slice(0,500)}`}function y(e){if(typeof window>`u`)return;let t=Date.now(),n=v(e),r=null;try{let e=window.sessionStorage.getItem(f);if(e)try{r=JSON.parse(e)}catch{r=null}}catch{return}let i=typeof r?.timestamp==`number`?r.timestamp:0;if(!(r?.signature===n&&t-i<m)){try{window.sessionStorage.setItem(f,JSON.stringify({signature:n,timestamp:t}))}catch{return}console.error(`[refresh-debug] chunk-import-reload`,{error:g(e).slice(0,1e3)}),window.setTimeout(()=>{window.location.reload()},0)}}async function b(e,t={}){let n=t.retries??1,r;for(let t=0;t<=n;t+=1)try{return await e()}catch(e){if(r=e,!_(e)||t>=n)break;await new Promise(e=>setTimeout(e,p*(t+1)))}throw _(r)&&y(r),r}var x=e=>(0,d.lazy)(()=>b(e)),S=(e,t)=>{try{let n=t??(typeof localStorage>`u`?null:localStorage);return n?n.getItem(e)===`1`:!1}catch{return!1}},C=(e,t)=>{try{let n=t??(typeof localStorage>`u`?null:localStorage);return!n||n.getItem(e)!==`0`}catch{return!0}},w=(e,t)=>{try{typeof localStorage<`u`&&localStorage.setItem(e,t?`1`:`0`)}catch{}},T=`oc:legend-timeline`,E=e=>S(T,e),D=`oc:markstream-react`,O=e=>C(D,e),k=t(e=>({legendTimelineEnabled:E(),setLegendTimelineEnabled:t=>{w(T,t),e({legendTimelineEnabled:t})},markstreamReactEnabled:O(),setMarkstreamReactEnabled:t=>{w(D,t),e({markstreamReactEnabled:t})}})),A=null,j=()=>(A??=i(()=>import(`./MarkstreamRendererImpl-BAEStQuf.js`),__vite__mapDeps([0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54])).catch(e=>{throw A=null,e}),A),M=()=>{j().catch(()=>void 0)},N=null,P=()=>(N??=i(()=>import(`./MarkdownRendererImpl-uH_cfmYV.js`).then(e=>e.n),__vite__mapDeps([34,1,13,14,2,15,16,3,17,18,19,5,35,9,10,11,22,23,12,20,21,24,25,26,27,28,29,36,37,38,39,40,41,42,43,44,45,46,30,31,47,33,32,48,49,50,51,52,53])).catch(e=>{throw N=null,e}),N),F=()=>{P().catch(()=>void 0),O()&&M()},I=class extends d.Component{state={hasError:!1};static getDerivedStateFromError(){return{hasError:!0}}componentDidCatch(e){console.warn(`[markstream-react] falling back to the current Markdown renderer`,e)}render(){return this.state.hasError?this.props.fallback:this.props.children}},L=d.createContext(!0),R=()=>d.useContext(L),z=n(),B=x(()=>P().then(e=>({default:e.MarkdownRenderer}))),V=x(()=>j().then(e=>({default:e.MarkstreamRenderer}))),H=x(()=>P().then(e=>({default:e.SimpleMarkdownRenderer}))),U=e=>e===`tool`?`markdown-content markdown-tool`:e===`reasoning`?`markdown-content markdown-reasoning`:`markdown-content leading-relaxed`,W=e=>{let t=(0,u.c)(15),n=k(q),r=typeof e.content==`string`?e.content:``,i=typeof e.variant==`string`?e.variant:`assistant`,a;t[0]!==r||t[1]!==n||t[2]!==e.reserveMeasuredHeight||t[3]!==i?(a=e.reserveMeasuredHeight?c(l(r,n?`markstream:${i}`:i)):void 0,t[0]=r,t[1]=n,t[2]=e.reserveMeasuredHeight,t[3]=i,t[4]=a):a=t[4];let d=a,f;t[5]!==e.className||t[6]!==e.variant?(f=o(`relative break-words w-full min-w-0`,U(e.variant),typeof e.className==`string`?e.className:void 0),t[5]=e.className,t[6]=e.variant,t[7]=f):f=t[7];let p;t[8]!==r||t[9]!==e.animated||t[10]!==d?(p=(0,z.jsx)(s,{animated:e.animated,content:r,reservedHeight:d}),t[8]=r,t[9]=e.animated,t[10]=d,t[11]=p):p=t[11];let m;return t[12]!==f||t[13]!==p?(m=(0,z.jsx)(`div`,{className:f,"aria-busy":`true`,"data-markdown-hydration":`deferred`,"data-markdown-ready":`false`,children:p}),t[12]=f,t[13]=p,t[14]=m):m=t[14],m},G=e=>{let t=(0,u.c)(9),n=R(),r=k(J);if(!n&&e.isStreaming!==!0){let n;return t[0]===e?n=t[1]:(n=(0,z.jsx)(W,{...e,animated:!1,reserveMeasuredHeight:!0}),t[0]=e,t[1]=n),n}let i;t[2]===e?i=t[3]:(i=(0,z.jsx)(d.Suspense,{fallback:(0,z.jsx)(W,{...e,reserveMeasuredHeight:!0}),children:(0,z.jsx)(B,{...e})}),t[2]=e,t[3]=i);let a=i;if(!r)return a;let o;t[4]===e?o=t[5]:(o=(0,z.jsx)(d.Suspense,{fallback:(0,z.jsx)(W,{...e,reserveMeasuredHeight:!0}),children:(0,z.jsx)(V,{...e})}),t[4]=e,t[5]=o);let s;return t[6]!==a||t[7]!==o?(s=(0,z.jsx)(I,{fallback:a,children:o}),t[6]=a,t[7]=o,t[8]=s):s=t[8],s},K=e=>{let t=(0,u.c)(4);if(!R()){let n;return t[0]===e?n=t[1]:(n=(0,z.jsx)(W,{...e,animated:!1}),t[0]=e,t[1]=n),n}let n;return t[2]===e?n=t[3]:(n=(0,z.jsx)(d.Suspense,{fallback:(0,z.jsx)(W,{...e}),children:(0,z.jsx)(H,{...e})}),t[2]=e,t[3]=n),n};function q(e){return e.markstreamReactEnabled}function J(e){return e.markstreamReactEnabled}export{k as a,F as i,K as n,x as o,L as r,G as t};