@walkhi/code-relax 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/src/lan-socket-server.mjs

@@ -6,12 +6,18 @@ import { createFileUploadSession, FILE_CHUNK_BYTES, MAX_FILE_BYTES, MAX_FILE_COU
 
 // One authenticated connection carries requests and explicitly owned subscriptions.
 // The dispatcher is shared business routing, not an HTTP loopback proxy.
-export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false, uploadsRoot }) {
+export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false, onDeviceAuthorizationsChanged, uploadsRoot }) {
   // Allow four individually valid images to reach the aggregate-size validator,
   // so an oversized composition returns an error instead of dropping the connection.
   const wss = new WebSocketServer({ noServer: true, maxPayload: 48 * 1024 * 1024, perMessageDeflate: false });
   const uploadWss = new WebSocketServer({ noServer: true, maxPayload: 512 * 1024, perMessageDeflate: false });
   const activeUploads = new Set();
+  const deviceConnections = new Map();
+  const stopWatching = onDeviceAuthorizationsChanged?.(() => {
+    for (const connection of deviceConnections.values()) {
+      if (!authorizeDevice(connection.clientId, connection.credential)) connection.revoke();
+    }
+  });
   server.on('upgrade', (request, socket, head) => {
     const origin = request.headers.origin;
     const upload = request.url === '/api/file-transfer' && Boolean(uploadsRoot);
@@ -32,20 +38,26 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     target.handleUpgrade(request, socket, head, ws => target.emit('connection', ws));
   });
   uploadWss.on('connection', ws => {
-    let authenticated = false, identity = '', upload;
+    let authenticated = false, stopped = false, identity = '', upload;
     let pending = Promise.resolve();
     const authTimer = setTimeout(() => ws.close(1008, 'Authentication required'), 5000);
-    const reply = value => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(value)); };
+    const reply = value => { if (!stopped && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(value)); };
     ws.on('error', () => {});
-    ws.on('close', () => {
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      deviceConnections.delete(ws);
       clearTimeout(authTimer);
       void pending.finally(async () => {
         await upload?.close();
         if (identity) activeUploads.delete(identity);
       });
-    });
+    };
+    ws.on('close', stop);
     ws.on('message', (bytes, binary) => {
+      if (stopped || ws.readyState !== WebSocket.OPEN) return;
       pending = pending.then(async () => {
+        if (stopped || ws.readyState !== WebSocket.OPEN) return;
         if (binary || bytes.length > 512 * 1024) throw new Error('无效的上传分片');
         const message = JSON.parse(bytes.toString());
         if (!authenticated) {
@@ -56,6 +68,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
             if (supplied.length === expected.length && crypto.timingSafeEqual(supplied, expected)) identity = 'local-token';
           }
           if (!identity || activeUploads.has(identity) || activeUploads.size >= 2) throw new Error('上传身份无效或工作站已有上传任务');
+          if (message.type === 'device-auth') deviceConnections.set(ws, {
+            clientId: message.clientId, credential: message.credential,
+            revoke() { stop(); ws.close(4401, 'Device authorization revoked'); },
+          });
           activeUploads.add(identity); authenticated = true; clearTimeout(authTimer);
           upload = createFileUploadSession(uploadsRoot);
           reply({ type: 'ready', maxFileBytes: MAX_FILE_BYTES, maxFileCount: MAX_FILE_COUNT,
@@ -67,10 +83,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     });
   });
   wss.on('connection', ws => {
-    let authenticated = false, alive = true;
+    let authenticated = false, alive = true, stopped = false;
     const active = new Map();
     const send = value => {
-      if (ws.readyState !== WebSocket.OPEN) return;
+      if (stopped || ws.readyState !== WebSocket.OPEN) return;
       if (ws.bufferedAmount > 64 * 1024 * 1024) { ws.close(1013, 'Client too slow'); return; }
       ws.send(JSON.stringify(value));
     };
@@ -81,12 +97,17 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     }, 30000);
     ws.on('pong', () => { alive = true; });
     ws.on('error', () => {}); // close rejects requests and releases every subscription.
-    ws.on('close', () => {
-      clearTimeout(authTimer); clearInterval(heartbeat);
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      deviceConnections.delete(ws);
+      clearTimeout(authTimer); clearInterval(heartbeat);
       for (const reply of active.values()) reply.end();
       active.clear();
-    });
-    ws.on('message', async (bytes, binary) => {
+    };
+    ws.on('close', stop);
+    ws.on('message', async (bytes, binary) => {
+      if (stopped || ws.readyState !== WebSocket.OPEN) return;
       let message;
       try { if (binary) throw new Error(); message = JSON.parse(bytes.toString()); }
       catch { ws.close(1008, 'Invalid JSON'); return; }
@@ -103,6 +124,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
         if (!accepted) {
           ws.close(1008, 'Authentication failed'); return;
         }
+        if (message.type === 'device-auth') deviceConnections.set(ws, {
+          clientId: message.clientId, credential: message.credential,
+          revoke() { stop(); ws.close(4401, 'Device authorization revoked'); },
+        });
         authenticated = true; clearTimeout(authTimer); send({ type: 'ready', version: 1 }); return;
       }
       const { id, type } = message;
@@ -186,6 +211,7 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     });
   });
   return { close() {
+    stopWatching?.();
     for (const ws of wss.clients) ws.terminate(); wss.close();
     for (const ws of uploadWss.clients) ws.terminate(); uploadWss.close();
   } };

package/dist/src/self-relay/admin-server.mjs

@@ -2,6 +2,7 @@ import http from 'node:http';
 import fs from 'node:fs';
 import { adminPage } from './admin-page.mjs';
 import { startAdminCloud } from './admin-cloud.mjs';
+import { MAX_ADMIN_REQUEST_BYTES } from './admin-state.mjs';
 
 function reply(response, status, body, type = 'application/json; charset=utf-8') {
   const bytes = typeof body === 'string' ? body : JSON.stringify(body);
@@ -53,7 +54,7 @@ export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.
       let size = 0;
       for await (const chunk of request) {
         size += chunk.length;
-        if (size > 4096) { reply(response, 413, { error: 'Admin request too large' }); return; }
+        if (size > MAX_ADMIN_REQUEST_BYTES) { reply(response, 413, { error: 'Admin request too large' }); return; }
         chunks.push(chunk);
       }
       const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {

package/dist/src/self-relay/admin-state.mjs

@@ -2,6 +2,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 
+// 80 title + 2000 body UTF-16 units fit even when every unit uses a six-byte JSON escape.
+export const MAX_ADMIN_REQUEST_BYTES = 16 * 1024;
+
 export function relayAdminState(file, initialMaxRelaySessions, { initial, persist } = {}) {
   let value = initial ? validate(initial) : { version: 3, maxRelaySessions: initialMaxRelaySessions, announcement: null, announcements: [] };
   if (file && fs.existsSync(file)) value = validate(JSON.parse(fs.readFileSync(file, 'utf8')));

package/dist/src/self-relay/lan-authorizations.mjs

@@ -1,11 +1,23 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { EventEmitter } from 'node:events';
 import { digest, matches } from './wire.mjs';
 import { validId } from './device-store.mjs';
 
 const recordPath = stateRoot => path.join(stateRoot, 'lan-device-authorizations.json');
 const validHash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const authorizationChanges = new EventEmitter();
+const authorizationKey = stateRoot => {
+  const resolved = path.resolve(stateRoot);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+};
+
+export function onLanAuthorizationsChanged(stateRoot, listener) {
+  const key = authorizationKey(stateRoot);
+  authorizationChanges.on(key, listener);
+  return () => authorizationChanges.off(key, listener);
+}
 
 export function saveLanAuthorizations(stateRoot, hostId, clients, revision) {
   if (!validId(hostId) || !Array.isArray(clients) || clients.length > 16 ||
@@ -17,6 +29,7 @@ export function saveLanAuthorizations(stateRoot, hostId, clients, revision) {
     fs.writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: 'wx' });
     fs.renameSync(temporary, file);
   } finally { fs.rmSync(temporary, { force: true }); }
+  authorizationChanges.emit(authorizationKey(stateRoot));
 }
 export function authorizeLanDevice(stateRoot, clientId, credential) {
   if (!validId(clientId)) return false;

package/dist/src/self-relay/lifecycle.mjs

@@ -50,21 +50,9 @@ async function createRelayRuntime(stateRoot) {
   let health = await serviceHealth(session());
   if (health?.status !== 'ok') throw new Error('桌面服务尚未运行，请先执行 relax start --json。');
   const stored = await credentialStore('load');
-  let identities = stored.record || { version: 2, devices: {} };
+  const identities = stored.record || { version: 2, devices: {} };
   const validIdentity = (id, item) => /^[\w-]{16,128}$/.test(id) && item?.id === id &&
     validSecret(item.secret) && typeof item.registered === 'boolean';
-  if (identities.version === 1 && identities.servers && typeof identities.servers === 'object' && !Array.isArray(identities.servers)) {
-    const devices = {};
-    for (const [url, item] of Object.entries(identities.servers)) {
-      relayAddress(url);
-      if (!validIdentity(item?.id, item) || devices[item.id]) throw new Error('本机设备身份损坏，未自动覆盖');
-      devices[item.id] = item;
-    }
-    const previous = identities.servers[config.url];
-    identities = { version: 2, devices };
-    await credentialStore('save', identities);
-    if (!config.deviceId && previous) config.deviceId = previous.id;
-  }
   if (identities.version !== 2 || !identities.devices || typeof identities.devices !== 'object' || Array.isArray(identities.devices) ||
       Object.entries(identities.devices).some(([id, item]) => !validIdentity(id, item))) throw new Error('本机设备身份损坏，未自动覆盖');
   if (!config.deviceId) {
@@ -115,7 +103,7 @@ async function createRelayRuntime(stateRoot) {
   };
   async function shutdown() {
     if (closing) return;
-    closing = true; clearTimeout(retryTimer);
+    closing = true; online = false; attachedCount = 0; clearTimeout(retryTimer);
     connector?.events.removeAllListeners(); connector?.close();
   }
   async function saveInvitation(message) {
@@ -139,7 +127,9 @@ async function createRelayRuntime(stateRoot) {
     try {
       const bridge = session();
       await refreshHealth();
+      if (closing) return;
       const lanCandidates = await currentLanCandidates();
+      if (closing) return;
       connector?.events.removeAllListeners(); connector?.close();
       const current = connector = connectBridgeRelay({ relayUrl: config.url, identity,
         usageCacheFile: path.join(stateRoot, 'relay-usage-tasks.json'),
@@ -162,6 +152,7 @@ async function createRelayRuntime(stateRoot) {
         if (![1008, 4401, 4406, 4409, 4429].includes(event.code)) scheduleRetry();
       });
       const registration = await current.ready;
+      if (closing) return;
       if (registration.protocolVersion !== 7 || registration.room !== identity.id) {
         current.events.removeAllListeners(); current.close(); throw Object.assign(new Error('中继服务器尚未升级设备授权协议，未使用临时配对降级。'), { code: 4401 });
       }
@@ -170,11 +161,14 @@ async function createRelayRuntime(stateRoot) {
         identities.devices[identity.id] = registeredIdentity;
         await credentialStore('save', identities); identity = registeredIdentity;
       }
+      if (closing) return;
       current.assertConnected();
       online = true; attempts = 0; paired = registration.paired; clientCount = registration.clientCount || 0; lastError = '';
       saveLanAuthorizations(stateRoot, identity.id, registration.clients || [], registration.revision);
-      await saveInvitation(registration); audit('relay-connected', { paired });
+      await saveInvitation(registration);
+      if (!closing) audit('relay-connected', { paired });
     } catch (error) {
+      if (closing) return;
       online = false; lastError = error.message; audit('connect-failed', { message: error.message });
       if (![1008, 4401, 4406, 4409, 4429].includes(error.code)) retryAfterAttempt = true;
       else { clearTimeout(retryTimer); retryTimer = undefined; }

package/dist/src/self-relay/server.mjs

@@ -8,7 +8,7 @@ import { WebSocketServer } from 'ws';
 import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
 import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
 import { validProbeSignal } from './p2p-probe.mjs';
-import { relayAdminState } from './admin-state.mjs';
+import { MAX_ADMIN_REQUEST_BYTES, relayAdminState } from './admin-state.mjs';
 import { openRelayMysql } from './mysql-state.mjs';
 import { openEmailAccounts } from './email-accounts.mjs';
 import { usageMeter, usageReport } from './usage-meter.mjs';
@@ -33,6 +33,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   const accounts = accountConfigFile ? openEmailAccounts(database.pool, accountConfigFile) : null;
   const meter = accounts ? usageMeter(database.pool) : null;
   const cancelledAccountIds = new Set();
+  const accountCancellationWork = new Map();
   const diagnostics = database?.schemaVersions.includes('006_relay_diagnostics')
     ? relayDiagnostics(database.pool, error => log({ event: 'relay-diagnostic-error', message: error.message })) : null;
   const adminAccessFile = '/etc/codex-relay/admin-access.json';
@@ -145,6 +146,38 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
     response.end(value);
   }
+  function cancelAccountConnections(userId, token) {
+    const pending = accountCancellationWork.get(userId);
+    if (pending) return pending;
+    if (cancelledAccountIds.has(userId)) return Promise.resolve();
+    cancelledAccountIds.add(userId);
+    const work = (async () => {
+      try { await accounts.cancelAccount(token); }
+      catch (failure) { cancelledAccountIds.delete(userId); throw failure; }
+      for (const room of rooms.values()) {
+        for (const [key, arm] of room.usageArms || []) if (arm.userId === userId) room.usageArms.delete(key);
+        for (const [key, task] of room.usageTasks || []) if (task.userId === userId) room.usageTasks.delete(key);
+        for (const [clientId, connection] of room.connections) {
+          if (connection.userId !== userId) continue;
+          releaseRelay(connection); room.connections.delete(clientId);
+          if (room.host) send(room.host, { type: 'detach', session: connection.session });
+          connection.ws.close(4431, 'Account cancelled');
+        }
+        for (const [clientId, observer] of room.observers) {
+          if (observer.userId !== userId) continue;
+          room.observers.delete(clientId); observer.ws.close(4431, 'Account cancelled');
+        }
+        for (const [clientId, upload] of room.uploadClients) {
+          if (upload.userId !== userId) continue;
+          room.uploadClients.delete(clientId);
+          if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session: upload.session });
+          upload.ws.close(4431, 'Account cancelled');
+        }
+      }
+    })().finally(() => accountCancellationWork.delete(userId));
+    accountCancellationWork.set(userId, work);
+    return work;
+  }
   async function handleAccount(request, response, target) {
     try {
       if (target.pathname === '/account/config' && request.method === 'GET') {
@@ -160,29 +193,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       }
       if (target.pathname === '/account/me' && request.method === 'DELETE') {
         const user = await accounts.current(bearer);
-        cancelledAccountIds.add(user.id);
-        try { await accounts.cancelAccount(bearer); }
-        catch (failure) { cancelledAccountIds.delete(user.id); throw failure; }
-        for (const room of rooms.values()) {
-          for (const [key, arm] of room.usageArms || []) if (arm.userId === user.id) room.usageArms.delete(key);
-          for (const [key, task] of room.usageTasks || []) if (task.userId === user.id) room.usageTasks.delete(key);
-          for (const [clientId, connection] of room.connections) {
-            if (connection.userId !== user.id) continue;
-            releaseRelay(connection); room.connections.delete(clientId);
-            if (room.host) send(room.host, { type: 'detach', session: connection.session });
-            connection.ws.close(4431, 'Account cancelled');
-          }
-          for (const [clientId, observer] of room.observers) {
-            if (observer.userId !== user.id) continue;
-            room.observers.delete(clientId); observer.ws.close(4431, 'Account cancelled');
-          }
-          for (const [clientId, upload] of room.uploadClients) {
-            if (upload.userId !== user.id) continue;
-            room.uploadClients.delete(clientId);
-            if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session: upload.session });
-            upload.ws.close(4431, 'Account cancelled');
-          }
-        }
+        await cancelAccountConnections(user.id, bearer);
         accountReply(response, 200, { ok: true }); return;
       }
       if (request.method !== 'POST' || request.headers['content-type'] !== 'application/json') {
@@ -247,7 +258,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     if (!['PUT', 'DELETE'].includes(request.method || '') || request.headers['content-type'] !== 'application/json' ||
         request.headers['x-code-relax-admin'] !== '1') { adminReply(response, 405, { error: 'Unsupported admin request' }); return; }
     try {
-      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, 4096));
+      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, MAX_ADMIN_REQUEST_BYTES));
       if (target.pathname === '/admin/api/settings' && request.method === 'PUT') {
         const state = await adminState.setMaxRelaySessions(body.maxRelaySessions);
         log({ event: 'admin-relay-limit-updated', maxRelaySessions: state.maxRelaySessions });

package/dist/src/server.mjs

@@ -18,7 +18,7 @@ import { runtimePaths } from './platform/windows/runtime-paths.mjs';
 import { openControl } from './service-control.mjs';
 import { writeRecord, readRecord } from './service-lifecycle.mjs';
 import { ExecutionHealth } from './execution-health.mjs';
-import { authorizeLanDevice } from './self-relay/lan-authorizations.mjs';
+import { authorizeLanDevice, onLanAuthorizationsChanged } from './self-relay/lan-authorizations.mjs';
 import { createRelayManager } from './self-relay/lifecycle.mjs';
 import { generateAndSetThreadTitle } from './thread-title-generation.mjs';
 import { desktopHost } from './platform/windows/desktop-host.mjs';
@@ -521,7 +521,8 @@ async function handleRequest(request, response) {
 const server = http.createServer(handleRequest);
 const lanSocket = attachLanSocket(server, { token: options.token, dispatch: handleRequest,
   uploadsRoot,
-  authorizeDevice: (clientId, credential) => authorizeLanDevice(stateRoot, clientId, credential),
+  authorizeDevice: (clientId, credential) => authorizeLanDevice(stateRoot, clientId, credential),
+  onDeviceAuthorizationsChanged: listener => onLanAuthorizationsChanged(stateRoot, listener),
 });
 
 let control;

package/dist/src/service-restart.mjs

@@ -4,36 +4,69 @@ import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
 import { startBackground } from './background-process.mjs';
-import { lifecycle, readRecord } from './service-lifecycle.mjs';
+import { lifecycle, readRecord, writeRecord } from './service-lifecycle.mjs';
 import * as host from './platform/windows/service-host.mjs';
+import { desktopHost } from './platform/windows/desktop-host.mjs';
 
 const script = fileURLToPath(import.meta.url);
+const sameProcess = (expected, actual) => expected && actual && expected.pid === actual.pid &&
+  expected.created === actual.created && expected.executable === actual.executable;
+async function processIdentity(pid) {
+  const current = await desktopHost.process(pid);
+  return current ? { pid: current.pid, created: current.created, executable: current.executable } : null;
+}
 
 export async function requestServiceRestart(stateRoot) {
   const lock = path.join(stateRoot, 'service-restart.lock');
   const operationId = randomUUID();
-  let handle;
+  const owner = await processIdentity(process.pid);
+  if (!owner) throw new Error('无法确认服务重启请求进程。');
+  const previous = readRecord(lock);
+  if (previous) {
+    const actual = previous.owner?.pid ? await processIdentity(previous.owner.pid) : null;
+    if (sameProcess(previous.owner, actual) || readRecord(lock)?.operationId !== previous.operationId) {
+      throw new Error('工作站服务已在重启中。');
+    }
+    fs.rmSync(lock);
+  }
+  const temporary = `${lock}.${operationId}.tmp`;
   try {
-    handle = fs.openSync(lock, 'wx', 0o600);
-    fs.writeFileSync(handle, JSON.stringify({ operationId, requestedAt: new Date().toISOString() }));
+    fs.writeFileSync(temporary, JSON.stringify({ operationId, owner, requestedAt: new Date().toISOString() }),
+      { flag: 'wx', mode: 0o600 });
+    // Publish a complete record exclusively; a crash cannot leave a half-written lock.
+    fs.linkSync(temporary, lock);
   } catch (error) {
     if (error.code === 'EEXIST') throw new Error('工作站服务已在重启中。');
     throw error;
-  } finally { if (handle !== undefined) fs.closeSync(handle); }
+  } finally { fs.rmSync(temporary, { force: true }); }
   try {
     const log = path.join(stateRoot, 'service-restart.log');
-    await startBackground(process.execPath, [script, '--worker', stateRoot, operationId], process.env, [log, log]);
+    const pid = await startBackground(process.execPath, [script, '--worker', stateRoot, operationId], process.env, [log, log]);
+    const worker = await processIdentity(pid);
+    if (!worker) throw new Error('服务重启进程未启动。');
+    const current = readRecord(lock);
+    if (current?.operationId !== operationId) throw new Error('服务重启实例已失效。');
+    writeRecord(lock, { ...current, owner: worker });
     return { operationId, status: 'scheduled', message: '工作站服务重启已安排。' };
   } catch (error) {
-    fs.rmSync(lock, { force: true }); throw error;
+    const current = readRecord(lock);
+    if (current?.operationId === operationId && sameProcess(current.owner, owner)) fs.rmSync(lock, { force: true });
+    throw error;
   }
 }
 
 async function run(stateRoot, operationId) {
   const lock = path.join(stateRoot, 'service-restart.lock');
-  if (readRecord(lock)?.operationId !== operationId) throw new Error('服务重启实例已失效。');
-  const service = lifecycle({ stateRoot, host });
   try {
+    const deadline = Date.now() + 30000;
+    while (true) {
+      const record = readRecord(lock);
+      if (record?.operationId !== operationId) throw new Error('服务重启实例已失效。');
+      if (record.owner?.pid === process.pid) break;
+      if (Date.now() >= deadline) throw new Error('服务重启进程交接超时。');
+      await delay(100);
+    }
+    const service = lifecycle({ stateRoot, host });
     await delay(1000);
     await service.stop();
     await service.start();

package/dist/src/shared-app-server.mjs

@@ -211,7 +211,11 @@ export class SharedAppServer extends EventEmitter {
       this.emit('turn', { thread: record.thread, turn, sequence,
         immediate: ['turn/completed', 'item/completed'].includes(method) });
     }
-    if (method === 'turn/completed') record.thread.turns = record.thread.turns.slice(-10);
+    if (method === 'turn/completed' && record.thread.turns.length > 10) {
+      record.thread.turns = record.thread.turns.slice(-10);
+      // Native cursors are opaque; obtain a matching boundary before the next snapshot.
+      record.historyTrimmed = true;
+    }
     if (['turn/completed', 'thread/status/changed'].includes(method)) this.releaseInactiveThread(id);
   }
 
@@ -220,21 +224,25 @@ export class SharedAppServer extends EventEmitter {
     const slot = this.slot(threadId);
     slot.readers++;
     const task = slot.tail.then(async () => {
-      let record = this.threads.get(threadId);
-      if (record?.readOnly || record?.needsReload) {
-        this.threads.delete(threadId);
-        this.contexts.delete(threadId);
-        record = null;
-      }
-      if (!record) {
+      let record = this.threads.get(threadId);
+      // Snapshot refreshes must not reset the sequence or tokens of live subscribers.
+      const previous = record?.readOnly ? null : record;
+      if (record?.readOnly || record?.needsReload) this.contexts.delete(threadId);
+      if (!record || record.readOnly || record.needsReload || record.historyTrimmed) {
         let result;
         try {
-          result = await this.request('thread/resume', { threadId, excludeTurns: true,
-            initialTurnsPage: { limit: 1, sortDirection: 'desc', itemsView: 'notLoaded' } }, value => {
-            if (!Array.isArray(value.initialTurnsPage?.data)) throw new Error('Codex 内核未返回分页历史。');
-            record = { thread: { ...value.thread, turns: [...value.initialTurnsPage.data].reverse().map(turn => ({ ...turn, items: [] })) },
-              nextCursor: value.initialTurnsPage.nextCursor ?? null, sequence: 0, recoverAfter: 0,
-              changes: new Map(), changeBytes: 0, tokens: new Map(), hydrating: true };
+          result = await this.request('thread/resume', { threadId, excludeTurns: true,
+            initialTurnsPage: { limit: 1, sortDirection: 'desc', itemsView: 'notLoaded' } }, value => {
+            if (!Array.isArray(value.initialTurnsPage?.data)) throw new Error('Codex 内核未返回分页历史。');
+            const retained = new Map((previous?.thread.turns || []).map(turn => [turn.id, turn]));
+            record = { thread: { ...value.thread, turns: [...value.initialTurnsPage.data].reverse().map(turn => ({
+              ...turn, items: retained.get(turn.id)?.items || [],
+              ...(retained.get(turn.id)?.itemPage ? { itemPage: retained.get(turn.id).itemPage } : {}),
+            })) },
+              nextCursor: value.initialTurnsPage.nextCursor ?? null,
+              sequence: previous?.sequence ?? 0, recoverAfter: previous?.recoverAfter ?? 0,
+              changes: previous?.changes ?? new Map(), changeBytes: previous?.changeBytes ?? 0,
+              tokens: previous?.tokens ?? new Map(), hydrating: true };
             this.threads.set(threadId, record);
             return value;
           });
@@ -346,7 +354,7 @@ export class SharedAppServer extends EventEmitter {
       if (!token || token.expires <= Date.now() || token.sequence !== requested.after) token = undefined;
     }
     let snapshot = false, catchup;
-    if (!record || !token) {
+    if (!record || !token || (record.historyTrimmed && requested.after < record.recoverAfter)) {
       const fresh = await this.timeline(threadId);
       record = this.threads.get(threadId); token = record.tokens.get(fresh.sync.id);
       requested = { id: fresh.sync.id, epoch: fresh.sync.epoch, after: fresh.sync.seq };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@walkhi/code-relax",
-  "version": "0.1.0-beta.25",
+  "version": "0.1.0-beta.26",
   "license": "UNLICENSED",
   "type": "module",
   "scripts": {