@shawnstack/quickforge 1.7.3 → 1.7.4

package/server/routes/agent.mjs

@@ -1,4 +1,5 @@
 import { sendJson, readJsonBody, decodeSegment } from '../utils/response.mjs'
+import { logger } from '../utils/logger.mjs'
 import {
   createAgent,
   runPrompt,
@@ -96,6 +97,30 @@ export async function handleAgentApi(req, res, url) {
     return
   }
 
+  // POST /api/agents/:sessionId/restore — restore once and return the authoritative state
+  if (req.method === 'POST' && subPath === 'restore') {
+    const startedAt = performance.now()
+    const session = await restoreAgent(sessionId)
+    if (!session) {
+      const error = new Error('Session not found')
+      error.statusCode = 404
+      throw error
+    }
+    const state = getSessionState(sessionId)
+    if (!state) {
+      const error = new Error('Session not found')
+      error.statusCode = 404
+      throw error
+    }
+    logger.debug(`Restored session ${sessionId} for client`, {
+      sessionId,
+      messageCount: state.messages?.length ?? 0,
+      durationMs: Math.round((performance.now() - startedAt) * 10) / 10,
+    })
+    sendJson(res, 200, state)
+    return
+  }
+
   // GET /api/agents/:sessionId/state — get session state
   if (req.method === 'GET' && subPath === 'state') {
     let state = getSessionState(sessionId)
@@ -141,6 +166,9 @@ export async function handleAgentApi(req, res, url) {
       status: session.status,
       scope: session.scope,
       title: session.title,
+      source: session.source || undefined,
+      channelId: session.channelId || undefined,
+      channelName: session.channelName || undefined,
       accessMode: session.accessMode,
       yoloMode: session.yoloMode,
     })

package/server/routes/channels.mjs

@@ -1,4 +1,8 @@
+import { promises as fs } from 'node:fs'
+import { logger } from '../utils/logger.mjs'
 import { sendJson, decodeSegment, readJsonBody } from '../utils/response.mjs'
+import { channelLogsDirectory } from '../channels/channel-logs.mjs'
+import { openPathInFileManager } from '../utils/platform.mjs'
 import {
   channelEvents,
   getChannelStatus,
@@ -25,6 +29,24 @@ function assertActionHeader(req) {
   }
 }
 
+function assertEventHeader(req) {
+  if (req.headers['x-quickforge-action'] !== 'channel-event') {
+    const error = new Error('Forbidden event')
+    error.statusCode = 403
+    throw error
+  }
+}
+
+async function readChannelEvent(req) {
+  const event = await readJsonBody(req, 256 * 1024)
+  if (!event || event.type !== 'sessions-changed' || typeof event.sessionId !== 'string' || !event.sessionId.trim()) {
+    const error = new Error('Invalid channel event')
+    error.statusCode = 400
+    throw error
+  }
+  return event
+}
+
 async function readActionOptions(req) {
   if (!['POST', 'PUT', 'PATCH'].includes(req.method || '')) return {}
   const contentType = String(req.headers['content-type'] || '')
@@ -46,6 +68,15 @@ export async function handleChannelsApi(req, res, url, context = {}) {
     return
   }
 
+  if (req.method === 'POST' && pathname === '/api/channels/events') {
+    assertLocal(context)
+    assertEventHeader(req)
+    const event = await readChannelEvent(req)
+    channelEvents.emit('channel_event', event)
+    sendJson(res, 202, { ok: true })
+    return
+  }
+
   if (parts.length < 3 || parts[0] !== 'api' || parts[1] !== 'channels') {
     const error = new Error('Not found')
     error.statusCode = 404
@@ -67,6 +98,22 @@ export async function handleChannelsApi(req, res, url, context = {}) {
 
   assertLocal(context)
 
+  if (req.method === 'POST' && subPath.length === 1 && subPath[0] === 'open-logs') {
+    assertActionHeader(req)
+    getChannelStatus(channelId)
+    if (!context.logsDir) {
+      const error = new Error('Channel log directory is unavailable')
+      error.statusCode = 500
+      throw error
+    }
+    const directory = channelLogsDirectory(context.logsDir, channelId)
+    await fs.mkdir(directory, { recursive: true })
+    await (context.openPathInFileManager ?? openPathInFileManager)(directory)
+    logger.info('Opened channel log directory.', { channelId })
+    sendJson(res, 200, { ok: true })
+    return
+  }
+
   if (req.method === 'POST' && subPath[0] === 'start') {
     assertActionHeader(req)
     sendJson(res, 202, await startChannel(channelId, await readActionOptions(req)))

package/server/routes/lan-access.mjs

@@ -1,10 +1,13 @@
 import { sendJson, readJsonBody } from '../utils/response.mjs'
 import { getLanUrls } from '../utils/network.mjs'
 import { logger } from '../utils/logger.mjs'
+import { parseCookies } from '../share-store.mjs'
 import {
   issueLanAccessToken,
   lanAccessCookieName,
   readLanAccessStatus,
+  revokeLanAccessToken,
+  revokeLanAccessTokenById,
   revokeLanAccessTokens,
   updateLanAccessSettings,
 } from '../lan-access-store.mjs'
@@ -102,36 +105,242 @@ export function renderLanUnlockPage(res) {
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
+  <meta name="theme-color" content="#171717" media="(prefers-color-scheme: dark)" />
+  <link rel="icon" href="/favicon.svg" />
   <title>QuickForge 局域网访问</title>
   <style>
-    :root { color-scheme: light dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #0f172a; color: #e5e7eb; }
-    main { width: min(420px, calc(100vw - 32px)); border: 1px solid rgba(148,163,184,.3); border-radius: 20px; padding: 28px; background: rgba(15,23,42,.92); box-shadow: 0 24px 80px rgba(0,0,0,.35); }
-    h1 { margin: 0 0 8px; font-size: 22px; }
-    p { margin: 0 0 18px; color: #94a3b8; line-height: 1.6; }
-    label { display: block; margin-bottom: 8px; font-size: 14px; font-weight: 600; }
-    input { width: 100%; box-sizing: border-box; height: 42px; border-radius: 10px; border: 1px solid #334155; background: #020617; color: #f8fafc; padding: 0 12px; font-size: 15px; }
-    button { width: 100%; height: 42px; margin-top: 14px; border: 0; border-radius: 10px; background: #2563eb; color: white; font-weight: 700; cursor: pointer; }
-    button:disabled { opacity: .6; cursor: default; }
-    .error { min-height: 20px; margin-top: 12px; color: #fca5a5; font-size: 13px; }
+    :root {
+      color-scheme: light dark;
+      font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
+        "Helvetica Neue", Arial, "Noto Sans", "PingFang SC", "Microsoft YaHei", sans-serif;
+      --background: #ffffff;
+      --foreground: #171717;
+      --muted-foreground: #737373;
+      --border: #e5e5e5;
+      --input-border: #dedede;
+      --surface: #ffffff;
+      --surface-muted: #fafafa;
+      --primary: #171717;
+      --primary-hover: #292929;
+      --primary-foreground: #fafafa;
+      --danger: #dc2626;
+      --shadow: 0 10px 26px -18px rgba(15, 23, 42, .48);
+    }
+    * { box-sizing: border-box; }
+    html, body { margin: 0; min-width: 0; min-height: 100%; }
+    body {
+      min-height: 100vh;
+      min-height: 100dvh;
+      display: grid;
+      place-items: center;
+      padding: 32px 20px;
+      background: var(--background);
+      color: var(--foreground);
+      -webkit-font-smoothing: antialiased;
+    }
+    main { width: min(100%, 440px); }
+    .intro { display: flex; align-items: center; gap: 13px; margin-bottom: 30px; }
+    .brand-mark {
+      display: grid;
+      width: 46px;
+      height: 46px;
+      flex: 0 0 auto;
+      place-items: center;
+      border: 1px solid var(--border);
+      border-radius: 13px;
+      background: var(--surface);
+      box-shadow: var(--shadow);
+    }
+    .brand-mark img { width: 29px; height: 29px; }
+    .eyebrow {
+      margin: 0 0 2px;
+      color: var(--muted-foreground);
+      font-size: 11px;
+      font-weight: 600;
+      letter-spacing: .1em;
+    }
+    h1 { margin: 0; font-size: 20px; font-weight: 600; letter-spacing: -.02em; line-height: 1.35; }
+    .subtitle { margin: 3px 0 0; color: var(--muted-foreground); font-size: 14px; line-height: 1.5; }
+    form {
+      padding: 22px;
+      border: 1px solid var(--border);
+      border-radius: 16px;
+      background: var(--surface);
+      box-shadow: var(--shadow);
+    }
+    label { display: block; margin-bottom: 9px; font-size: 14px; font-weight: 500; }
+    .input-wrap { position: relative; }
+    .input-icon {
+      position: absolute;
+      top: 50%;
+      left: 13px;
+      width: 17px;
+      height: 17px;
+      color: var(--muted-foreground);
+      pointer-events: none;
+      transform: translateY(-50%);
+    }
+    input {
+      width: 100%;
+      height: 44px;
+      border: 1px solid var(--input-border);
+      border-radius: 12px;
+      outline: none;
+      background: var(--surface);
+      color: var(--foreground);
+      padding: 0 13px 0 40px;
+      font: inherit;
+      font-size: 14px;
+      transition: border-color 150ms ease, box-shadow 150ms ease;
+    }
+    input::placeholder { color: var(--muted-foreground); opacity: .7; }
+    input:hover { border-color: color-mix(in srgb, var(--foreground) 24%, var(--border)); }
+    input:focus {
+      border-color: color-mix(in srgb, var(--foreground) 30%, var(--border));
+      box-shadow: var(--shadow);
+    }
+    input[aria-invalid="true"] { border-color: color-mix(in srgb, var(--danger) 60%, var(--border)); }
+    button {
+      width: 100%;
+      height: 44px;
+      margin-top: 18px;
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      gap: 8px;
+      border: 0;
+      border-radius: 12px;
+      background: var(--primary);
+      color: var(--primary-foreground);
+      font: inherit;
+      font-size: 14px;
+      font-weight: 500;
+      cursor: pointer;
+      transition: background-color 150ms ease, opacity 150ms ease;
+    }
+    button:hover:not(:disabled) { background: var(--primary-hover); }
+    button:active:not(:disabled) { opacity: .88; }
+    button:focus-visible { outline: 2px solid color-mix(in srgb, var(--foreground) 28%, transparent); outline-offset: 3px; }
+    button:disabled { cursor: default; opacity: .62; }
+    .button-icon { width: 16px; height: 16px; }
+    .spinner { display: none; width: 15px; height: 15px; animation: spin .8s linear infinite; }
+    button.is-loading .button-icon { display: none; }
+    button.is-loading .spinner { display: block; }
+    .error {
+      min-height: 20px;
+      margin: 10px 0 -2px;
+      color: var(--danger);
+      font-size: 13px;
+      line-height: 20px;
+    }
+    .note {
+      display: flex;
+      gap: 9px;
+      margin: 17px 3px 0;
+      color: var(--muted-foreground);
+      font-size: 12px;
+      line-height: 1.65;
+    }
+    .note svg { width: 15px; height: 15px; flex: 0 0 auto; margin-top: 2px; }
+    @keyframes spin { to { transform: rotate(360deg); } }
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --background: #171717;
+        --foreground: #fafafa;
+        --muted-foreground: #a3a3a3;
+        --border: #353535;
+        --input-border: #404040;
+        --surface: #1d1d1d;
+        --surface-muted: #262626;
+        --primary: #e5e5e5;
+        --primary-hover: #fafafa;
+        --primary-foreground: #171717;
+        --danger: #f87171;
+        --shadow: 0 10px 26px -18px rgba(0, 0, 0, .9);
+      }
+    }
+    @media (max-width: 480px) {
+      body { place-items: start center; padding-top: max(28px, 8vh); }
+      .intro { margin-bottom: 24px; }
+      form { padding: 20px; }
+    }
+    @media (prefers-reduced-motion: reduce) {
+      *, *::before, *::after { scroll-behavior: auto !important; transition: none !important; }
+    }
   </style>
 </head>
 <body>
   <main>
-    <h1>QuickForge 局域网访问</h1>
-    <p>请输入本机设置中配置的局域网访问密码。</p>
-    <label for="password">访问密码</label>
-    <input id="password" type="password" autocomplete="current-password" autofocus />
-    <button id="submit" type="button">进入 QuickForge</button>
-    <div id="error" class="error" role="alert"></div>
+    <header class="intro">
+      <div class="brand-mark" aria-hidden="true"><img src="/favicon.svg" alt="" /></div>
+      <div>
+        <p class="eyebrow">QUICKFORGE</p>
+        <h1>验证局域网访问</h1>
+        <p class="subtitle">输入主机端设置的访问密码，继续进入工作区。</p>
+      </div>
+    </header>
+
+    <form id="unlock-form">
+      <label for="password">访问密码</label>
+      <div class="input-wrap">
+        <svg class="input-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true">
+          <rect x="4.5" y="10" width="15" height="10" rx="2.5"></rect>
+          <path d="M8 10V7.5a4 4 0 0 1 8 0V10"></path>
+        </svg>
+        <input
+          id="password"
+          type="password"
+          autocomplete="current-password"
+          placeholder="请输入访问密码"
+          aria-describedby="error"
+          aria-invalid="false"
+          autofocus
+        />
+      </div>
+      <button id="submit" type="submit">
+        <svg class="spinner" viewBox="0 0 24 24" fill="none" aria-hidden="true">
+          <circle cx="12" cy="12" r="9" stroke="currentColor" stroke-opacity=".25" stroke-width="3"></circle>
+          <path d="M21 12a9 9 0 0 0-9-9" stroke="currentColor" stroke-width="3" stroke-linecap="round"></path>
+        </svg>
+        <span id="button-label">进入 QuickForge</span>
+        <svg class="button-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true">
+          <path d="M5 12h14M13 6l6 6-6 6" stroke-linecap="round" stroke-linejoin="round"></path>
+        </svg>
+      </button>
+      <p id="error" class="error" role="alert" aria-live="polite"></p>
+    </form>
+
+    <p class="note">
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true">
+        <path d="M12 3 5 6v5c0 4.6 2.9 8.4 7 10 4.1-1.6 7-5.4 7-10V6l-7-3Z" stroke-linejoin="round"></path>
+        <path d="m9.5 12 1.7 1.7 3.6-3.7" stroke-linecap="round" stroke-linejoin="round"></path>
+      </svg>
+      <span>密码仅用于验证本次局域网访问，不会保存在此设备。</span>
+    </p>
   </main>
   <script>
+    const form = document.getElementById('unlock-form')
     const password = document.getElementById('password')
     const button = document.getElementById('submit')
+    const buttonLabel = document.getElementById('button-label')
     const error = document.getElementById('error')
-    async function unlock() {
+
+    password.addEventListener('input', () => {
+      error.textContent = ''
+      password.setAttribute('aria-invalid', 'false')
+    })
+
+    form.addEventListener('submit', async (event) => {
+      event.preventDefault()
+      if (button.disabled) return
+
       error.textContent = ''
+      password.setAttribute('aria-invalid', 'false')
       button.disabled = true
+      button.classList.add('is-loading')
+      buttonLabel.textContent = '正在验证…'
+
       try {
         const response = await fetch('/api/lan-access/unlock', {
           method: 'POST',
@@ -143,12 +352,14 @@ export function renderLanUnlockPage(res) {
         window.location.reload()
       } catch (err) {
         error.textContent = err instanceof Error ? err.message : '密码错误'
+        password.setAttribute('aria-invalid', 'true')
+        password.focus()
       } finally {
         button.disabled = false
+        button.classList.remove('is-loading')
+        buttonLabel.textContent = '进入 QuickForge'
       }
-    }
-    button.addEventListener('click', unlock)
-    password.addEventListener('keydown', (event) => { if (event.key === 'Enter') unlock() })
+    })
   </script>
 </body>
 </html>`
@@ -186,7 +397,10 @@ export async function handleLanAccessApi(req, res, url, context = {}) {
     assertNotLocked(req)
     const body = await readJsonBody(req, 1024)
     try {
-      const result = await issueLanAccessToken(body?.password)
+      const result = await issueLanAccessToken(body?.password, {
+        remoteAddress: req.socket.remoteAddress,
+        userAgent: req.headers['user-agent'],
+      })
       setLanCookie(res, result.token, result.maxAge)
       clearFailures(req)
       logger.info('LAN access unlock succeeded.', { remoteAddress: req.socket.remoteAddress })
@@ -202,11 +416,22 @@ export async function handleLanAccessApi(req, res, url, context = {}) {
   }
 
   if (req.method === 'POST' && pathname === '/api/lan-access/logout') {
+    const token = parseCookies(req.headers.cookie).get(lanAccessCookieName())
+    await revokeLanAccessToken(token)
     clearLanCookie(res)
     sendJson(res, 200, { ok: true })
     return
   }
 
+  if (req.method === 'POST' && pathname === '/api/lan-access/revoke') {
+    requireLocal(context)
+    const body = await readJsonBody(req, 1024)
+    const status = await revokeLanAccessTokenById(body?.id)
+    logger.info('LAN access session revoked.', { sessionId: body?.id })
+    sendJson(res, 200, { ok: true, ...status })
+    return
+  }
+
   if (req.method === 'POST' && pathname === '/api/lan-access/revoke-all') {
     requireLocal(context)
     const status = await revokeLanAccessTokens()

package/server/routes/models.mjs

@@ -1,4 +1,4 @@
-import { streamSimple } from '@earendil-works/pi-ai/compat'
+import { streamSimpleWithAiHttpLogging } from '../ai-http-logger.mjs'
 import { sendJson, readJsonBody } from '../utils/response.mjs'
 import { readStore } from '../storage.mjs'
 import { logger } from '../utils/logger.mjs'
@@ -22,7 +22,7 @@ async function getApiKey(provider) {
 // API key is valid. Returns { ok: true } on success; throws on failure.
 async function probeModelConnection(model, apiKeyOverride) {
   const apiKey = apiKeyOverride || (await getApiKey(model?.provider))
-  const stream = streamSimple(
+  const stream = streamSimpleWithAiHttpLogging(
     model,
     {
       systemPrompt: 'You are a connectivity test. Reply with a single word.',
@@ -39,7 +39,10 @@ async function probeModelConnection(model, apiKeyOverride) {
       maxRetryDelayMs: 30000,
     },
   )
-  await stream.result()
+  const message = await stream.result()
+  if (message?.stopReason === 'error' || message?.stopReason === 'aborted') {
+    throw new Error(message.errorMessage || `Model request ${message.stopReason}`)
+  }
   return { ok: true }
 }
 

package/server/routes/project.mjs

@@ -8,7 +8,25 @@ import { getWorkspaceRoot, setWorkspaceRoot } from '../utils/workspace.mjs'
 import { selectDirectoryDialog, openPathInFileManager, openPathInIDEA, openPathInVSCode } from '../utils/platform.mjs'
 import path from 'node:path'
 
-export async function handleProjectApi(req, res, url) {
+function assertLocalExternalAction(context) {
+  if (context.isLocalRequest === true) return
+  const error = new Error('Opening applications is only allowed from this computer')
+  error.statusCode = 403
+  throw error
+}
+
+export async function handleProjectApi(req, res, url, context = {}) {
+  const externalAction = req.method === 'POST' && (
+    url.pathname === '/api/project/select-directory'
+    || (url.pathname.startsWith('/api/project/') && (
+      url.pathname.endsWith('/open-in-explorer')
+      || url.pathname.endsWith('/open-in-vscode')
+      || url.pathname.endsWith('/open-in-idea')
+    ))
+    || url.pathname === '/api/project/open-path'
+  )
+  if (externalAction) assertLocalExternalAction(context)
+
   const config = await readProjectConfig()
 
   if (req.method === 'GET' && url.pathname === '/api/project') {

package/server/routes/scheduled-tasks.mjs

@@ -1,4 +1,4 @@
-import { streamSimple } from '@earendil-works/pi-ai/compat'
+import { streamSimpleWithAiHttpLogging } from '../ai-http-logger.mjs'
 import { DEFAULT_AI_MAX_RETRIES } from '../ai-provider-options.mjs'
 import { readJsonBody, sendJson, decodeSegment } from '../utils/response.mjs'
 import { readStore, atomicUpdate } from '../storage.mjs'
@@ -154,7 +154,7 @@ async function parseScheduledTaskInstructionWithAi(instruction, model, thinkingL
 示例输出：{"title":"生成日报","instruction":"生成销售日报","cronExpression":"0 9 * * *","scheduleRule":"每天 09:00","question":""}`
 
   try {
-    const stream = streamSimple(
+    const stream = streamSimpleWithAiHttpLogging(
       model,
       {
         systemPrompt,

package/server/routes/static.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url'
 
 const __filename = fileURLToPath(import.meta.url)
 const projectRoot = path.resolve(path.dirname(__filename), '../..')
+const androidApkPath = path.join(projectRoot, 'android', 'app', 'build', 'outputs', 'apk', 'debug', 'app-debug.apk')
 
 function getContentType(filePath) {
   const extension = path.extname(filePath).toLowerCase()
@@ -45,7 +46,31 @@ function shouldFallbackToIndex(url, pathname) {
   return !path.extname(pathname)
 }
 
+function cacheControlFor(filePath) {
+  if (filePath.endsWith('index.html')) return 'no-cache'
+  if (path.extname(filePath).toLowerCase() === '.apk') return 'no-cache'
+  return 'public, max-age=31536000, immutable'
+}
+
 export async function serveStatic(req, res, url) {
+  if (url.pathname === '/downloads/quickforge-android.apk') {
+    try {
+      const data = await fs.readFile(androidApkPath)
+      res.writeHead(200, {
+        'content-type': 'application/vnd.android.package-archive',
+        'content-length': data.length,
+        'content-disposition': 'attachment; filename="quickforge-android.apk"',
+        'cache-control': 'no-cache',
+        'x-content-type-options': 'nosniff',
+      })
+      res.end(data)
+    } catch {
+      res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })
+      res.end('Android APK not found. Run npm run android:build first.')
+    }
+    return
+  }
+
   const distDir = path.join(projectRoot, 'dist')
   const requested = decodeURIComponent(requestPathname(url))
   const normalized = path.normalize(requested).replace(/^([.][.][/])+/, '').replace(/^[/\\]+/, '')
@@ -74,7 +99,7 @@ export async function serveStatic(req, res, url) {
     const data = await fs.readFile(filePath)
     res.writeHead(200, {
       'content-type': getContentType(filePath),
-      'cache-control': filePath.endsWith('index.html') ? 'no-cache' : 'public, max-age=31536000, immutable',
+      'cache-control': cacheControlFor(filePath),
     })
     res.end(data)
   } catch {

package/server/routes/system.mjs

@@ -36,6 +36,12 @@ export async function handleSystemApi(req, res, url, context) {
   }
 
   if (req.method === 'POST' && url.pathname === '/api/system/restart') {
+    if (!context.isLocalRequest) {
+      const error = new Error('Restart is only allowed from this computer')
+      error.statusCode = 403
+      throw error
+    }
+
     if (req.headers['x-quickforge-action'] !== 'restart') {
       const error = new Error('Forbidden action')
       error.statusCode = 403
@@ -59,6 +65,11 @@ export async function handleSystemApi(req, res, url, context) {
     }
 
     if (req.method === 'PUT') {
+      if (!context.isLocalRequest) {
+        const error = new Error('Terminal shell settings can only be changed from this computer')
+        error.statusCode = 403
+        throw error
+      }
       const body = await readJsonBody(req, 64 * 1024) || {}
       if (Array.isArray(body.profiles) || typeof body.defaultProfileId === 'string') {
         sendJson(res, 200, await context.updateTerminalShellConfig(body))

package/server/routes/terminal.mjs

@@ -59,7 +59,7 @@ export async function handleTerminalApi(req, res, url, options = {}) {
   await assertLocalTerminalRequest(req, options.isLocalRequest)
 
   if (req.method === 'GET' && url.pathname === '/api/terminal/capabilities') {
-    sendJson(res, 200, { ...await terminalCapabilities(), ...await platformInfo() })
+    sendJson(res, 200, { ...await terminalCapabilities(), ...await platformInfo() }, 'private, max-age=300')
     return
   }
 
@@ -137,7 +137,12 @@ async function handleTerminalUpgradeAsync(req, socket, head, url, options = {})
         attachTerminalClient(sessionId, ws)
       } catch (err) {
         try {
-          ws.send(JSON.stringify({ type: 'error', message: err?.message || 'Terminal connection failed' }), () => ws.close())
+          ws.send(JSON.stringify({
+            type: 'error',
+            code: err?.statusCode === 404 ? 'SESSION_NOT_FOUND' : 'TERMINAL_CONNECTION_FAILED',
+            message: err?.message || 'Terminal connection failed',
+            retryable: err?.statusCode !== 404,
+          }), () => ws.close())
         } catch {
           ws.close()
         }