@surething/cockpit 1.0.233 → 1.0.235

package/dist/{chunk-VHFWPI2X.mjs → chunk-IQXDXTI7.mjs}

@@ -250,6 +250,33 @@ async function getSessionPreview(cwd, sessionId) {
     searchText
   };
 }
+async function getGlobalSessionsSnapshot(limit = 15) {
+  const state = await readJsonFile(GLOBAL_STATE_FILE, { sessions: [] });
+  for (const s of state.sessions) {
+    if (!s.status) {
+      const legacy = s;
+      s.status = legacy.isLoading ? "loading" : "normal";
+    }
+  }
+  state.sessions.sort((a, b) => b.lastActive - a.lastActive);
+  const recent = state.sessions.slice(0, limit);
+  return Promise.all(
+    recent.map(async (session) => {
+      if (session.status === "loading" && session.lastUserMessage) return session;
+      try {
+        const preview = await getSessionPreview(session.cwd, session.sessionId);
+        return {
+          ...session,
+          lastUserMessage: preview.lastUserMessage ?? session.lastUserMessage,
+          firstMessages: preview.firstMessages,
+          lastMessages: preview.lastMessages
+        };
+      } catch {
+        return session;
+      }
+    })
+  );
+}
 function filterCommandTags(text) {
   let filtered = text.replace(/<command-[^>]*>[\s\S]*?<\/command-[^>]*>/g, "");
   filtered = filtered.replace(/<local-command-[^>]*>[\s\S]*?<\/local-command-[^>]*>/g, "");
@@ -512,7 +539,7 @@ function fanout(state, ev) {
     }
   }
 }
-function startRun(key, cwd, promptText) {
+function startRun(key, cwd, promptText, runId) {
   const prev = registry.get(key);
   if (prev?.status === "running") return false;
   const prevSeq = prev?.seq ?? seqByKey.get(key) ?? 0;
@@ -520,18 +547,22 @@ function startRun(key, cwd, promptText) {
     if (prev.evictTimer) clearTimeout(prev.evictTimer);
     for (const k of prev.keys) registry.delete(k);
   }
+  const startedAt = Date.now();
   registry.set(key, {
     keys: /* @__PURE__ */ new Set([key]),
     cwd,
     status: "running",
     seq: prevSeq,
     events: [],
-    updatedAt: Date.now()
+    startedAt,
+    updatedAt: startedAt
   });
   if (promptText) {
     appendRun(key, {
       type: "user",
       _human: true,
+      ...runId ? { _turnId: runId } : {},
+      _ts: startedAt,
       message: { role: "user", content: promptText }
     });
   }
@@ -577,7 +608,7 @@ function markRunIdle(key, status = "idle") {
 function getRunSnapshot(key) {
   const r = registry.get(key);
   if (!r) return null;
-  return { status: r.status, seq: r.seq, events: r.events.slice() };
+  return { status: r.status, seq: r.seq, events: r.events.slice(), startedAt: r.startedAt };
 }
 function isRunActive(key) {
   return registry.get(key)?.status === "running";
@@ -616,7 +647,7 @@ function addRunListener(key, cb) {
 export {
   updateGlobalState,
   getSessionTitle,
-  getSessionPreview,
+  getGlobalSessionsSnapshot,
   startRun,
   appendRun,
   rekeyRun,

package/dist/scheduledTasks.mjs

@@ -10,7 +10,7 @@ import {
   setRunAbort,
   startRun,
   updateGlobalState
-} from "./chunk-VHFWPI2X.mjs";
+} from "./chunk-IQXDXTI7.mjs";
 import {
   AgentError,
   AppRuntime,
@@ -1697,7 +1697,7 @@ async function dispatchChat(spec, body, request) {
   let currentKey = sessionId || runId;
   let actualSessionId = sessionId;
   let isClosed = false;
-  if (!startRun(currentKey, cwd || "", promptText)) {
+  if (!startRun(currentKey, cwd || "", promptText, runId)) {
     return { ok: false, status: 409, error: "run already active" };
   }
   setRunAbort(currentKey, () => {
@@ -2593,7 +2593,7 @@ import { streamText, stepCountIs } from "ai";
 import { randomUUID as randomUUID3 } from "crypto";
 
 // packages/feature/agent/src/server/engines/ollama/session.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync, mkdirSync as mkdirSync2, appendFileSync } from "fs";
+import { readFileSync as readFileSync3, existsSync, mkdirSync as mkdirSync2, appendFileSync } from "fs";
 import { join as join3 } from "path";
 var SESSIONS_ROOT = join3(COCKPIT_DIR, "ollama-sessions");
 function getSessionDir(cwd) {
@@ -2606,22 +2606,16 @@ function readSessionMessages(cwd, sessionId) {
   const path2 = getSessionPath(cwd, sessionId);
   if (!existsSync(path2)) return [];
   const lines = readFileSync3(path2, "utf-8").split("\n").filter(Boolean);
-  const legacyMessages = [];
   const transcriptEntries = [];
   for (const line of lines) {
     try {
       const obj = JSON.parse(line);
-      if (typeof obj.role === "string" && "content" in obj) {
-        legacyMessages.push(obj);
-        continue;
-      }
       if (typeof obj.type === "string") {
         transcriptEntries.push(obj);
       }
     } catch {
     }
   }
-  if (transcriptEntries.length === 0) return legacyMessages;
   const toolNameById = /* @__PURE__ */ new Map();
   const toolCallIds = /* @__PURE__ */ new Set();
   const toolResultIds = /* @__PURE__ */ new Set();
@@ -16516,7 +16510,7 @@ function date4(params) {
 config(en_default());
 
 // packages/feature/agent/src/server/engines/ollama/tools.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { writeFile, mkdir, readdir, stat, unlink } from "fs/promises";
 import { isAbsolute, join as join4 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -16638,7 +16632,7 @@ function createTools(context) {
       execute: async ({ file_path, content }) => {
         try {
           if (!isAbsolute(file_path)) return "Error: file_path must be an absolute path.";
-          writeFileSync4(file_path, content, "utf-8");
+          writeFileSync3(file_path, content, "utf-8");
           return `File written: ${file_path}`;
         } catch (err) {
           return `Error writing file: ${err.message}`;
@@ -16669,7 +16663,7 @@ function createTools(context) {
             return `Error: old_string not found in ${file_path}. The file may have changed.`;
           }
           const updated = replace_all ? content.split(old_string).join(new_string) : content.replace(old_string, new_string);
-          writeFileSync4(file_path, updated, "utf-8");
+          writeFileSync3(file_path, updated, "utf-8");
           return `File edited: ${file_path}`;
         } catch (err) {
           return `Error editing file: ${err.message}`;
@@ -17252,7 +17246,7 @@ ${block.think}
 import { spawn as spawn3 } from "child_process";
 import { randomUUID as randomUUID5 } from "crypto";
 import { createInterface as createInterface2 } from "readline";
-import { writeFileSync as writeFileSync5, unlinkSync as unlinkSync2, mkdirSync as mkdirSync3, existsSync as existsSync2 } from "fs";
+import { writeFileSync as writeFileSync4, unlinkSync as unlinkSync2, mkdirSync as mkdirSync3, existsSync as existsSync2 } from "fs";
 import { join as join6 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 var MEDIA_EXT = {
@@ -17267,7 +17261,7 @@ function writeImagesToTemp(images) {
   return images.map((img, i) => {
     const ext = MEDIA_EXT[img.media_type] || ".png";
     const filePath = join6(dir, `img-${Date.now()}-${i}${ext}`);
-    writeFileSync5(filePath, Buffer.from(img.data, "base64"));
+    writeFileSync4(filePath, Buffer.from(img.data, "base64"));
     return filePath;
   });
 }

package/dist/wsServer.mjs

@@ -1,8 +1,8 @@
 import {
   addRunListener,
-  getRunSnapshot,
-  getSessionPreview
-} from "./chunk-VHFWPI2X.mjs";
+  getGlobalSessionsSnapshot,
+  getRunSnapshot
+} from "./chunk-IQXDXTI7.mjs";
 import {
   addExitListener,
   addOutputListener,
@@ -32,8 +32,7 @@ import {
   Schedule_exports,
   Stream_exports,
   ValidationError,
-  WSError,
-  readJsonFile
+  WSError
 } from "./chunk-GFI4IHYM.mjs";
 import "./chunk-7P6ASYW6.mjs";
 
@@ -110,34 +109,10 @@ function getDefaultPath() {
 // src/lib/effect/globalStateHandler.ts
 var HEARTBEAT_INTERVAL = Schedule_exports.spaced("30 seconds");
 var sendGlobalState = (conn) => Effect_exports.gen(function* () {
-  const state = yield* Effect_exports.tryPromise({
-    try: () => readJsonFile(GLOBAL_STATE_FILE, { sessions: [] }),
+  const sessions = yield* Effect_exports.tryPromise({
+    try: () => getGlobalSessionsSnapshot(),
     catch: (cause) => new FSError({ path: GLOBAL_STATE_FILE, op: "read", cause })
   });
-  for (const s of state.sessions) {
-    if (!s.status) {
-      const legacy = s;
-      s.status = legacy.isLoading ? "loading" : "normal";
-    }
-  }
-  state.sessions.sort((a, b) => b.lastActive - a.lastActive);
-  const recent = state.sessions.slice(0, 15);
-  const sessions = yield* Effect_exports.forEach(
-    recent,
-    (session) => session.status === "loading" && session.lastUserMessage ? Effect_exports.succeed(session) : Effect_exports.tryPromise({
-      try: () => getSessionPreview(session.cwd, session.sessionId),
-      catch: () => void 0
-    }).pipe(
-      Effect_exports.map((preview) => ({
-        ...session,
-        lastUserMessage: preview.lastUserMessage ?? session.lastUserMessage,
-        firstMessages: preview.firstMessages,
-        lastMessages: preview.lastMessages
-      })),
-      Effect_exports.orElseSucceed(() => session)
-    ),
-    { concurrency: "unbounded" }
-  );
   yield* conn.send({ type: "global-state", data: { sessions } });
 });
 var watchStateFile = (trigger) => Effect_exports.acquireRelease(
@@ -1211,6 +1186,9 @@ var handleSessionStream = (conn, sessionId) => Effect_exports.gen(function* () {
       type: "run-snapshot",
       status: snap.status,
       seq: snap.seq,
+      // Turn time-boundary: lets clients cut the in-flight turn's disk image by
+      // message timestamp instead of by prompt text (see useLiveStream).
+      startedAt: snap.startedAt,
       events: snap.events
     });
   } else {

package/next.config.mjs

@@ -12,8 +12,9 @@ const nextConfig = {
   // dev 和 prod 使用不同输出目录，避免 Turbopack 热更新影响 prod
   distDir: dev ? '.next' : '.next-prod',
   // Allow loading dev resources (HMR, /_next/*) through tunnels — needed to test
-  // the mobile /m route on a real phone via ngrok. Dev-only; wildcards cover the
-  // rotating ngrok hostnames so we don't have to edit this each session.
+  // the mobile /m route on a real phone via ngrok / Cloudflare quick tunnels.
+  // Dev-only; wildcards cover the rotating tunnel hostnames so we don't have to
+  // edit this each session.
   ...(dev
     ? {
         allowedDevOrigins: [
@@ -21,6 +22,7 @@ const nextConfig = {
           '*.ngrok-free.app',
           '*.ngrok.app',
           '*.ngrok.io',
+          '*.trycloudflare.com',
         ],
       }
     : {}),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@surething/cockpit",
-  "version": "1.0.233",
-  "description": "Claude Code GUI for parallel AI coding — drive Claude (default), Codex, DeepSeek, Kimi, or local Ollama in tabs. Multi-project sessions, terminal, browser & DB bubbles, code review, slash modes. Local-first, MIT.",
+  "version": "1.0.235",
+  "description": "The open-source Claude Code GUI — an IDE-like workbench for parallel AI coding. Drive Claude (default), Codex, DeepSeek, Kimi, or local Ollama in tabs. Terminal, browser & DB bubbles, code review. Self-host on a shared dev box — a seat for every teammate. Local-first, MIT.",
   "author": "Robert",
   "license": "MIT",
   "repository": {
@@ -38,9 +38,10 @@
     "ai-code-review",
     "agent-sdk",
     "coding-agent",
-    "parallel-ai",
+    "self-hosted",
+    "web-ide",
+    "remote-development",
     "multi-project-ai",
-    "cockpit",
     "opencockpit",
     "cursor-alternative",
     "aider-alternative",

package/public/boot.js

@@ -14,7 +14,15 @@
     var onMobileRoute = path === '/m' || path.indexOf('/m/') === 0;
     var forceDesktop = false;
     try { forceDesktop = !!localStorage.getItem('cockpit-force-desktop'); } catch (_e) {}
+    // Never redirect inside an iframe: the desktop shell embeds /project in a
+    // frame that is 42px (sidebar) narrower than the window, so a tablet-width
+    // top page (e.g. 768px iPad) would otherwise nest the mobile UI inside the
+    // desktop shell — and drop the sessionId in the process. The media query is
+    // only meaningful for the top-level viewport.
+    var isTopWindow = true;
+    try { isTopWindow = window.self === window.top; } catch (_e) {}
     if (
+      isTopWindow &&
       !onMobileRoute &&
       !forceDesktop &&
       window.matchMedia &&

package/server.mjs

@@ -1,4 +1,5 @@
 import { createServer } from 'http';
+import { createGzip, constants as zlibConstants } from 'zlib';
 import { exec, execSync } from 'child_process';
 import { networkInterfaces, homedir } from 'os';
 import { writeFileSync, mkdirSync, readFileSync, realpathSync } from 'fs';
@@ -53,17 +54,22 @@ async function ensureSingleInstance() {
 }
 
 // ============================================
-// 进程生命周期防护
+// Process lifecycle guards
 //
-// 1) 父进程死亡后 stdout/stderr 管道断裂，Next.js 的 uncaughtException handler
-//    会尝试 console.log 报错 → 写 stdout → EPIPE → 再次触发 handler → CPU 死循环
-//    在管道错误升级为 uncaughtException 之前拦截，直接退出。
+// 1) When the parent process dies, the stdout/stderr pipes break. Next.js's
+//    uncaughtException handler then tries to console.log the error → writes
+//    to stdout → EPIPE → triggers the handler again → CPU spin loop.
+//    Intercept pipe errors before they escalate to uncaughtException and
+//    exit immediately.
 //
-// 2) Next.js 在 dev 模式下会在自己的子进程里跑 `next-server` worker（turbopack）。
-//    如果父进程被异常杀掉（npm reinstall、Ctrl+C 后 npm 包了一层、IDE 杀任务等），
-//    next-server 子进程不会跟着死，而是会失去父进程后**重新绑定到 next 自带的默认
-//    端口 3000**，然后把后续 `npm run dev` 卡死（Next 通过 .next/dev/logs 检测到
-//    "已有 dev server 在跑"而拒绝再启）。所以父进程退出前必须显式杀掉所有直接子进程。
+// 2) In dev mode Next.js runs a `next-server` worker (turbopack) in its own
+//    child process. If the parent is killed abnormally (npm reinstall,
+//    Ctrl+C through an npm wrapper, IDE killing the task, etc.), the
+//    next-server child doesn't die with it — having lost its parent it
+//    **re-binds to Next's default port 3000** and then wedges every later
+//    `npm run dev` (Next detects "a dev server is already running" via
+//    .next/dev/logs and refuses to start). So the parent must explicitly
+//    kill all direct children before exiting.
 // ============================================
 // Assigned once the server-side bundle is loaded (see app.prepare below). Lets the
 // synchronous exit hook flush live PTY scrollback to disk so a graceful restart
@@ -75,7 +81,8 @@ function killChildren() {
   if (_cleanupRan) return;
   _cleanupRan = true;
   if (process.platform === 'win32') {
-    // Windows: 走 wmic 列出子 PID 再逐个 taskkill /F /T，避免 /T 把自己也带走
+    // Windows: list child PIDs via wmic, then taskkill /F /T each one —
+    // running /T on ourselves would take this process down too
     try {
       const out = execSync(`wmic process where (ParentProcessId=${process.pid}) get ProcessId /value`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
       const pids = (out.match(/ProcessId=(\d+)/g) || []).map(s => s.split('=')[1]).filter(Boolean);
@@ -85,34 +92,39 @@ function killChildren() {
     } catch {}
     return;
   }
-  // POSIX: pkill -P 只杀直接子进程，不递归（next-server 等都是直接子进程，足够）
-  // pkill 在没有匹配到任何进程时返回 1，不当作错误
+  // POSIX: pkill -P kills direct children only, no recursion (next-server
+  // and friends are all direct children — enough).
+  // pkill exits 1 when nothing matches; not treated as an error.
   try { execSync(`pkill -TERM -P ${process.pid}`, { stdio: 'ignore' }); } catch {}
 }
 
-// 正常退出路径（包括所有的 process.exit() 调用）—— Node 保证此 handler 同步执行。
-// 所有信号/异常路径最终都走 process.exit() → 触发 'exit' → 这一个点覆盖全部优雅退出。
-// 先把活着的 PTY 滚动缓冲同步落盘，再杀子进程（flush 读的是本进程内存，与子进程无关）。
+// Normal exit path (including every process.exit() call) — Node guarantees
+// this handler runs synchronously. All signal/exception paths ultimately go
+// through process.exit() → 'exit' fires → this single hook covers every
+// graceful shutdown. Flush live PTY scrollback to disk first, then kill the
+// children (the flush reads this process's own memory — independent of them).
 process.on('exit', () => {
   try { flushRunningSync?.(); } catch {}
   killChildren();
 });
 
-// 信号路径 —— 先杀子进程再退出，并让 shell 看到正确的退出码
+// Signal paths — kill children first, then exit with the code the shell expects
 const cleanupAndExit = (code) => () => { killChildren(); process.exit(code); };
 process.on('SIGINT',  cleanupAndExit(130));
 process.on('SIGTERM', cleanupAndExit(143));
 process.on('SIGQUIT', cleanupAndExit(131));
 process.on('SIGHUP',  cleanupAndExit(0));
 
-// 未捕获异常 —— 不能让 Next.js 的默认 handler 再走 console.log 触发 EPIPE 死循环
+// Uncaught exceptions — don't let Next.js's default handler console.log its
+// way back into the EPIPE spin loop
 process.on('uncaughtException', (err) => {
   try { console.error('uncaughtException:', err); } catch {}
   killChildren();
   process.exit(1);
 });
 
-// stdout/stderr 管道断裂 → 立刻退出（exit handler 会顺手清子进程）
+// Broken stdout/stderr pipe → exit immediately (the exit handler cleans up
+// the children on the way out)
 process.stdout.on('error', (err) => {
   if (err.code === 'EPIPE' || err.code === 'ERR_STREAM_DESTROYED') process.exit(0);
 });
@@ -134,7 +146,7 @@ app.prepare().then(async () => {
   flushRunningSync = httpApi.flushAllRunningSync || null;
   const { scheduledTaskManager } = await import(dev ? '@cockpit/feature-agent/server/scheduledTasks' : './dist/scheduledTasks.mjs');
 
-  // 初始化定时任务管理器
+  // Initialize the scheduled-task manager
   scheduledTaskManager.setOnTaskFired((task) => {
     broadcastToGlobalState({ type: 'task-fired', taskId: task.id, cwd: task.cwd, tabId: task.tabId, sessionId: task.sessionId });
   });
@@ -176,10 +188,92 @@ app.prepare().then(async () => {
     return false;
   };
 
+  // ============================================
+  // /api/* JSON gzip — Next's built-in compression only runs under
+  // `next start`; with this custom server, API JSON goes out uncompressed
+  // (fine locally at <10ms, but behind a tunnel like ngrok a 200KB+
+  // session-by-path response means seconds of latency). Transparently wrap
+  // application/json responses in gzip; SSE / HTML / static assets (which
+  // Next already compresses) are untouched.
+  // ============================================
+  const gzipJsonResponse = (req, res) => {
+    if (!/\bgzip\b/i.test(String(req.headers['accept-encoding'] || ''))) return;
+    const origWriteHead = res.writeHead.bind(res);
+    const origWrite = res.write.bind(res);
+    const origEnd = res.end.bind(res);
+    let gzip = null;
+    let decided = false;
+
+    // Decide at first output (writeHead/write/end): only compress JSON that
+    // isn't already encoded.
+    const decide = () => {
+      if (decided) return;
+      decided = true;
+      const ct = String(res.getHeader('content-type') || '');
+      if (!ct.includes('application/json') || res.getHeader('content-encoding')) return;
+      res.removeHeader('content-length');
+      res.setHeader('content-encoding', 'gzip');
+      const vary = String(res.getHeader('vary') || '');
+      if (!/\baccept-encoding\b/i.test(vary)) {
+        res.setHeader('vary', vary ? `${vary}, Accept-Encoding` : 'Accept-Encoding');
+      }
+      gzip = createGzip({ flush: zlibConstants.Z_SYNC_FLUSH });
+      gzip.on('data', (chunk) => origWrite(chunk));
+      gzip.on('end', () => origEnd());
+      gzip.on('error', () => { try { origEnd(); } catch {} });
+    };
+
+    // writeHead accepts headers in three shapes: object, flat array
+    // [k1,v1,k2,v2,...] (what Next uses internally), and nested array
+    // [[k,v],...]. Normalize all of them through setHeader before deciding
+    // on compression.
+    const applyHeaders = (h) => {
+      if (!h) return;
+      if (Array.isArray(h)) {
+        const pairs = Array.isArray(h[0])
+          ? h
+          : Array.from({ length: h.length >> 1 }, (_, i) => [h[i * 2], h[i * 2 + 1]]);
+        for (const [k, v] of pairs) {
+          if (k === undefined || v === undefined) continue;
+          const key = String(k);
+          const prev = res.getHeader(key);
+          // Merge duplicate headers (e.g. set-cookie) into an array instead of overwriting
+          res.setHeader(key, prev === undefined ? v : [].concat(prev, v));
+        }
+      } else {
+        for (const [k, v] of Object.entries(h)) {
+          if (v !== undefined) res.setHeader(k, v);
+        }
+      }
+    };
+
+    res.writeHead = (status, arg2, arg3) => {
+      applyHeaders(typeof arg2 === 'object' ? arg2 : arg3);
+      decide();
+      return typeof arg2 === 'string' ? origWriteHead(status, arg2) : origWriteHead(status);
+    };
+    res.write = (chunk, ...args) => {
+      decide();
+      if (gzip) { gzip.write(chunk); return true; }
+      return origWrite(chunk, ...args);
+    };
+    res.end = (chunk, ...args) => {
+      decide();
+      if (gzip) {
+        if (chunk && typeof chunk !== 'function') gzip.write(chunk);
+        gzip.end();
+        return res;
+      }
+      return origEnd(chunk, ...args);
+    };
+  };
+
   const server = createServer(async (req, res) => {
     if (applyHttpGate(req, res)) return;
+    if (req.url?.startsWith('/api/')) gzipJsonResponse(req, res);
 
-    // /api/browser/* 必须在自定义 server 中处理（与 WS 共享 BrowserBridge 内存）
+    // /api/browser/* must be handled inside the custom server (it shares
+    // BrowserBridge memory with the WS side)
     if (req.url?.startsWith('/api/browser/') && req.method === 'POST') {
       const handled = await handleBrowserApi(req, res);
       if (handled) return;
@@ -207,19 +301,20 @@ app.prepare().then(async () => {
     }
   });
 
-  // COCKPIT_HOST: 默认 127.0.0.1（本地），云沙盒等场景设为 0.0.0.0
+  // COCKPIT_HOST: defaults to 127.0.0.1 (local-only); set 0.0.0.0 for cloud
+  // sandboxes and similar environments
   const host = process.env.COCKPIT_HOST || '127.0.0.1';
   server.listen(port, host, () => {
     const url = `http://localhost:${port}`;
     console.log(`> Ready on ${url}`);
 
-    // 写入 server.json 供 CLI 子命令读取端口
+    // Write server.json so CLI subcommands can read the port
     try {
       mkdirSync(cockpitHome, { recursive: true });
       writeFileSync(join(cockpitHome, 'server.json'), JSON.stringify({ pid: process.pid, port }, null, 2));
     } catch {}
 
-    // prod 模式自动打开浏览器（--no-open 禁用）
+    // Auto-open the browser in prod mode (disable with --no-open)
     if (!dev && !process.env.COCKPIT_NO_OPEN) {
       const openProject = process.env.COCKPIT_OPEN_PROJECT;
       const openUrl = openProject ? `${url}/?cwd=${encodeURIComponent(openProject)}` : url;
@@ -229,8 +324,8 @@ app.prepare().then(async () => {
   });
 
   // ============================================
-  // Share Server - LAN 分享评审服务
-  // 路由白名单：仅开放 /review/* 和相关资源
+  // Share Server — LAN review-sharing service.
+  // Route allowlist: only /review/* and its supporting assets are exposed.
   // ============================================
   const sharePort = port + 1000; // dev 3456→4456, prod 3457→4457
 
@@ -260,8 +355,9 @@ app.prepare().then(async () => {
     // Token gate first (share is also covered). Read the gate BEFORE we inject
     // x-forwarded-for below, so the injection can't fool the local check.
     if (applyHttpGate(req, res)) return;
+    if (req.url?.startsWith('/api/')) gzipJsonResponse(req, res);
     if (isShareAllowed(req.url || '')) {
-      // 注入客户端真实 IP，供 /api/review/identify 使用
+      // Inject the client's real IP for /api/review/identify
       const clientIp = req.socket.remoteAddress || '';
       req.headers['x-forwarded-for'] = clientIp;
       handle(req, res);

package/.next-prod/server/chunks/7003.js

@@ -1 +0,0 @@
-"use strict";exports.id=7003,exports.ids=[7003],exports.modules={7939:(a,b,c)=>{c.d(b,{$A:()=>M,A0:()=>X,An:()=>$,BF:()=>I,Ct:()=>Q,Eu:()=>H,Ex:()=>u,GB:()=>r,JE:()=>Z,JY:()=>L,Ki:()=>C,Kk:()=>R,Kv:()=>j,LN:()=>k,Mx:()=>D,N9:()=>ac,O0:()=>B,Sr:()=>J,Tb:()=>s,Ux:()=>ab,Wd:()=>Y,aO:()=>m,at:()=>y,ec:()=>o,eg:()=>V,h9:()=>x,i4:()=>G,iK:()=>p,im:()=>T,iy:()=>P,jp:()=>t,lT:()=>z,lq:()=>F,ls:()=>K,mT:()=>w,n6:()=>n,oK:()=>O,oZ:()=>S,of:()=>E,po:()=>N,tP:()=>q,th:()=>v,v4:()=>l,vI:()=>W,yw:()=>U});var d=c(21820),e=c(33873),f=c(79748),g=c(29021),h=c(79646);let i=(0,d.homedir)(),j=process.env.COCKPIT_HOME?(0,e.resolve)(process.env.COCKPIT_HOME.replace(/^~(?=$|\/)/,i)):(0,e.join)(i,".cockpit"),k=(0,e.join)(j,"projects"),l=(0,e.join)(j,"state.json"),m=(0,e.join)(j,"pinned-sessions.json"),n=(0,e.join)(j,"push-subscriptions.json"),o=(0,e.join)(j,"note.md"),p=(0,e.join)(j,"scheduled-tasks.json"),q=(0,e.join)(j,"settings.json"),r=(0,e.join)(j,"skills.json"),s=(0,e.join)(j,"review"),t=(0,e.join)(s,"_signal");function u(){try{(0,g.existsSync)(s)||(0,g.mkdirSync)(s,{recursive:!0}),(0,g.writeFileSync)(t,Date.now().toString())}catch{}}let v=(0,e.join)(i,".claude"),w=(0,e.join)(v,"projects"),x=(0,e.join)(i,".claude2"),y=(0,e.join)(x,"projects"),z=(0,e.join)(j,"deepseek"),A=(0,e.join)(z,"projects");function B(a){return a.replace(/[/.]/g,"-")}function C(a){return(0,e.join)(k,B(a))}function D(a){return(0,e.join)(C(a),"session.json")}function E(a){return(0,e.join)(C(a),"recent-files.json")}function F(a){return(0,e.join)(C(a),"expanded-paths.json")}function G(a){return(0,e.join)(C(a),"comments.json")}function H(a){return(0,e.join)(C(a),"services.json")}function I(a){return(0,e.join)(C(a),"note.md")}function J(a,b){return(0,e.join)(C(a),`terminal-history-${b}.jsonl`)}function K(a,b){return(0,e.join)(C(a),`terminal-output-${b}.txt`)}function L(a,b){let c=b?`terminal-env-${b}.json`:"terminal-env-global.json";return(0,e.join)(C(a),c)}function M(){return(0,e.join)(j,"terminal-aliases.json")}function N(){return(0,e.join)(j,"services.json")}function O(a){return(0,e.join)(C(a),"project-settings.json")}function P(a,b){return(0,e.join)(C(a),`terminal-bubble-order-${b}.json`)}function Q(a){return(0,e.join)(s,`${a}.json`)}function R(a,b){return(0,e.join)((0,e.join)(w,B(a)),`${b}.jsonl`)}function S(a,b){return(0,e.join)((0,e.join)(y,B(a)),`${b}.jsonl`)}function T(a,b){return(0,e.join)((0,e.join)(A,B(a)),`${b}.jsonl`)}function U(a,b){return(0,e.join)((0,e.join)(j,"ollama-sessions",B(a)),`${b}.jsonl`)}function V(a){let b=(0,e.join)(i,".codex","sessions");if(!(0,g.existsSync)(b))return null;try{let c=(0,h.execSync)(`find ${JSON.stringify(b)} -name "*${a}.jsonl" -type f 2>/dev/null`,{encoding:"utf8",timeout:3e3}).trim();if(c)return c.split("\n")[0]}catch{}return null}function W(a){let b=(0,e.join)(i,".kimi","sessions");if(!(0,g.existsSync)(b))return null;try{for(let c of(0,g.readdirSync)(b)){let d=(0,e.join)(b,c,a,"context.jsonl");if((0,g.existsSync)(d))return d}}catch{}return null}async function X(a){(0,g.existsSync)(a)||await (0,f.mkdir)(a,{recursive:!0})}async function Y(a){let b=(0,e.join)(a,"..");await X(b)}async function Z(a,b){try{let b=await (0,f.readFile)(a,"utf-8");return JSON.parse(b)}catch{return b}}async function $(a,b){await Y(a),await (0,f.writeFile)(a,JSON.stringify(b,null,2),"utf-8")}let _=globalThis,aa=_.__cockpitFileLocks??(_.__cockpitFileLocks=new Map);function ab(a,b){let c=(aa.get(a)??Promise.resolve()).then(b),d=c.then(()=>{},()=>{});return aa.set(a,d),d.then(()=>{aa.get(a)===d&&aa.delete(a)}),c}function ac(a,b,c){return ab(a,async()=>{let d=await Z(a,b),e=await c(d);return await $(a,e),e})}},38433:(a,b,c)=>{c.d(b,{SG:()=>m,a_:()=>l,hO:()=>k,lG:()=>j});var d=c(51181),e=c.n(d),f=c(7939);let g=null,h="https://github.com/Surething-io/cockpit";async function i(){if(g)return g;let a=await (0,f.Ux)(f.tP,async()=>{let a=await (0,f.JE)(f.tP,{});if(a.push?.publicKey&&a.push?.privateKey){let b=!function(a){if(!a||a.includes("localhost"))return!1;if(a.startsWith("https://"))return!0;let b=/^mailto:[^\s@]+@([^\s@]+)$/.exec(a);return!!b&&b[1].includes(".")}(a.push.subject)?h:a.push.subject;return b!==a.push.subject&&await (0,f.An)(f.tP,{...a,push:{...a.push,subject:b}}),{publicKey:a.push.publicKey,privateKey:a.push.privateKey,subject:b}}let b=e().generateVAPIDKeys(),c={publicKey:b.publicKey,privateKey:b.privateKey,subject:h};return await (0,f.An)(f.tP,{...a,push:c}),c});return e().setVapidDetails(a.subject,a.publicKey,a.privateKey),g=a,a}async function j(){return(await i()).publicKey}async function k(a){await (0,f.Ux)(f.n6,async()=>{let b=await (0,f.JE)(f.n6,{subscriptions:[]});b.subscriptions.some(b=>b.endpoint===a.endpoint)||(b.subscriptions.push(a),await (0,f.An)(f.n6,b))})}async function l(a){await (0,f.Ux)(f.n6,async()=>{let b=await (0,f.JE)(f.n6,{subscriptions:[]}),c=b.subscriptions.filter(b=>b.endpoint!==a);c.length!==b.subscriptions.length&&await (0,f.An)(f.n6,{subscriptions:c})})}async function m(a){try{await i()}catch{return{sent:0,pruned:0}}let b=await (0,f.JE)(f.n6,{subscriptions:[]});if(0===b.subscriptions.length)return{sent:0,pruned:0};let c=JSON.stringify(a),d=[],g=0;return await Promise.all(b.subscriptions.map(async a=>{try{await e().sendNotification(a,c),g++}catch(c){let b=c?.statusCode;if(404===b||410===b)d.push(a.endpoint);else{let d=a.endpoint;try{d=new URL(a.endpoint).host}catch{}console.error(`[push] send failed (${b??"?"}) to ${d}: ${c?.body||c?.message||"unknown"}`)}}})),d.length&&await (0,f.Ux)(f.n6,async()=>{let a=await (0,f.JE)(f.n6,{subscriptions:[]});await (0,f.An)(f.n6,{subscriptions:a.subscriptions.filter(a=>!d.includes(a.endpoint))})}),{sent:g,pruned:d.length}}},72891:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{OZ:()=>o,RL:()=>n,k9:()=>p,ok:()=>l});var e=c(37625),f=c(52693),g=c(18412),h=c(89705),i=c(94506),j=c(770),k=a([i]);i=(k.then?(await k)():k)[0];let l=(a,b=200)=>new Response(JSON.stringify(a),{status:b,headers:{"content-type":"application/json"}}),m=a=>{let b=e.od(a);if(f.Ru(b)){let a=b.value,c=(0,j.Sh)(a);return new Response(JSON.stringify({error:(a=>{let b=a.message;if("string"==typeof b&&b.length>0)return b;let c=a.cause;if(c instanceof Error&&c.message.length>0)return c.message;switch(a._tag){case"ValidationError":return`Invalid ${a.field}: ${a.reason}`;case"NotFoundError":return`${a.resource} not found: ${a.id}`;case"PermissionError":return`Permission denied: ${a.action} on ${a.resource}`;case"DBError":return`${a.db} ${a.op} failed`;case"FSError":return`${a.op} ${a.path} failed`;case"WSError":return`${a.proto} ${a.kind} failed`;case"AgentError":return`${a.provider} ${a.kind} failed`;default:return a._tag}})(a),tag:a._tag}),{status:c,headers:{"content-type":"application/json"}})}return console.error("[handler] uncaught defect:\n"+e.j9(a)),new Response(JSON.stringify({error:"Internal Server Error",tag:"InternalError"}),{status:500,headers:{"content-type":"application/json"}})},n=a=>async b=>{let c=await i.s9.runPromiseExit(a(b));return g.YW(c,{onFailure:a=>m(a),onSuccess:a=>a})},o=a=>async(b,c)=>{let d=await c.params,e=await i.s9.runPromiseExit(a(b,d));return g.YW(e,{onFailure:a=>m(a),onSuccess:a=>a})},p=a=>h.$mh({try:()=>a.json(),catch:()=>new j.yI({field:"body",reason:"invalid JSON"})});d()}catch(a){d(a)}})}};