@walkhi/code-relax 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/shared/file-citations.cjs

@@ -0,0 +1,82 @@
+(function (root, factory) {
+  const api = factory();
+  if (typeof module === 'object' && module.exports) module.exports = api;
+  else root.CodexFileCitations = api;
+})(globalThis, function () {
+  const prefix = ':codex-file-citation{';
+
+  function parse(source, start) {
+    if (!source.startsWith(prefix, start)) return null;
+    const attributes = Object.create(null);
+    let position = start + prefix.length;
+    while (position < source.length) {
+      while (/[ \t]/.test(source[position] || '')) position++;
+      if (source[position] === '}') return { attributes, end: position + 1 };
+      const key = /^[A-Za-z_][\w-]*/.exec(source.slice(position));
+      if (!key) return null;
+      position += key[0].length;
+      const afterKey = position;
+      while (/[ \t]/.test(source[position] || '')) position++;
+      let value = '';
+      const assigned = source[position] === '=';
+      if (assigned) {
+        position++;
+        while (/[ \t]/.test(source[position] || '')) position++;
+        const quote = source[position];
+        if (quote === '"' || quote === "'") {
+          position++;
+          while (position < source.length && source[position] !== quote) {
+            if (/[\r\n]/.test(source[position])) return null;
+            if (source[position] === '\\' && source[position + 1] === quote) position++;
+            value += source[position++];
+          }
+          if (source[position++] !== quote) return null;
+        } else {
+          const match = /^[^\s{}"']+/.exec(source.slice(position));
+          if (!match) return null;
+          value = match[0];
+          position += value.length;
+        }
+      }
+      attributes[key[0]] = value;
+      if ((assigned || position === afterKey) && source[position] !== '}' && !/[ \t]/.test(source[position] || '')) return null;
+    }
+    return null;
+  }
+
+  function positiveLine(value) {
+    const line = /^\d+$/.test(value || '') ? Number(value) : 0;
+    return Number.isSafeInteger(line) && line > 0 ? line : null;
+  }
+
+  function install(markdown) {
+    markdown.inline.ruler.before('text', 'codex_file_citation', (state, silent) => {
+      if (!state.env?.allowFileCitations || state.linkLevel > 0) return false;
+      const result = parse(state.src, state.pos);
+      const attributes = result?.attributes;
+      const path = attributes?.path?.trim();
+      if (!path || /[\0\r\n]/.test(path)) return false;
+      const local = /^(?:[a-z]:[\\/]|\/(?!\/))/i.test(path);
+      if (!local && !/^https?:\/\//i.test(path)) return false;
+      const line = local ? positiveLine(attributes.lineRangeStart ?? attributes.line_range_start) : null;
+      const end = local ? positiveLine(attributes.lineRangeEnd ?? attributes.line_range_end) : null;
+      const reference = local ? encodeURI(path) + (line ? `:${line}` : '') : path;
+      const href = markdown.normalizeLink(reference);
+      if (!markdown.validateLink(href)) return false;
+      if (!silent) {
+        const link = state.push('link_open', 'a', 1);
+        link.attrSet('href', href);
+        link.attrSet('title', path);
+        link.meta = { fileCitation: { path, line, end: line && end >= line ? end : null, purpose: attributes.purpose } };
+        const label = state.push('text', '', 0);
+        label.content = local ? path.split(/[\\/]/).filter(Boolean).at(-1) || path
+          : attributes.label || attributes.title || path;
+        state.push('link_close', 'a', -1);
+      }
+      state.pos = result.end;
+      return true;
+    });
+  }
+
+  return Object.freeze({ install });
+});

package/dist/src/lan-socket-server.mjs

@@ -6,12 +6,18 @@ import { createFileUploadSession, FILE_CHUNK_BYTES, MAX_FILE_BYTES, MAX_FILE_COU
 
 // One authenticated connection carries requests and explicitly owned subscriptions.
 // The dispatcher is shared business routing, not an HTTP loopback proxy.
-export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false, uploadsRoot }) {
+export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false, onDeviceAuthorizationsChanged, uploadsRoot }) {
   // Allow four individually valid images to reach the aggregate-size validator,
   // so an oversized composition returns an error instead of dropping the connection.
   const wss = new WebSocketServer({ noServer: true, maxPayload: 48 * 1024 * 1024, perMessageDeflate: false });
   const uploadWss = new WebSocketServer({ noServer: true, maxPayload: 512 * 1024, perMessageDeflate: false });
   const activeUploads = new Set();
+  const deviceConnections = new Map();
+  const stopWatching = onDeviceAuthorizationsChanged?.(() => {
+    for (const connection of deviceConnections.values()) {
+      if (!authorizeDevice(connection.clientId, connection.credential)) connection.revoke();
+    }
+  });
   server.on('upgrade', (request, socket, head) => {
     const origin = request.headers.origin;
     const upload = request.url === '/api/file-transfer' && Boolean(uploadsRoot);
@@ -32,20 +38,26 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     target.handleUpgrade(request, socket, head, ws => target.emit('connection', ws));
   });
   uploadWss.on('connection', ws => {
-    let authenticated = false, identity = '', upload;
+    let authenticated = false, stopped = false, identity = '', upload;
     let pending = Promise.resolve();
     const authTimer = setTimeout(() => ws.close(1008, 'Authentication required'), 5000);
-    const reply = value => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(value)); };
+    const reply = value => { if (!stopped && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(value)); };
     ws.on('error', () => {});
-    ws.on('close', () => {
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      deviceConnections.delete(ws);
       clearTimeout(authTimer);
       void pending.finally(async () => {
         await upload?.close();
         if (identity) activeUploads.delete(identity);
       });
-    });
+    };
+    ws.on('close', stop);
     ws.on('message', (bytes, binary) => {
+      if (stopped || ws.readyState !== WebSocket.OPEN) return;
       pending = pending.then(async () => {
+        if (stopped || ws.readyState !== WebSocket.OPEN) return;
         if (binary || bytes.length > 512 * 1024) throw new Error('无效的上传分片');
         const message = JSON.parse(bytes.toString());
         if (!authenticated) {
@@ -56,6 +68,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
             if (supplied.length === expected.length && crypto.timingSafeEqual(supplied, expected)) identity = 'local-token';
           }
           if (!identity || activeUploads.has(identity) || activeUploads.size >= 2) throw new Error('上传身份无效或工作站已有上传任务');
+          if (message.type === 'device-auth') deviceConnections.set(ws, {
+            clientId: message.clientId, credential: message.credential,
+            revoke() { stop(); ws.close(4401, 'Device authorization revoked'); },
+          });
           activeUploads.add(identity); authenticated = true; clearTimeout(authTimer);
           upload = createFileUploadSession(uploadsRoot);
           reply({ type: 'ready', maxFileBytes: MAX_FILE_BYTES, maxFileCount: MAX_FILE_COUNT,
@@ -67,10 +83,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     });
   });
   wss.on('connection', ws => {
-    let authenticated = false, alive = true;
+    let authenticated = false, alive = true, stopped = false;
     const active = new Map();
     const send = value => {
-      if (ws.readyState !== WebSocket.OPEN) return;
+      if (stopped || ws.readyState !== WebSocket.OPEN) return;
       if (ws.bufferedAmount > 64 * 1024 * 1024) { ws.close(1013, 'Client too slow'); return; }
       ws.send(JSON.stringify(value));
     };
@@ -81,12 +97,17 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     }, 30000);
     ws.on('pong', () => { alive = true; });
     ws.on('error', () => {}); // close rejects requests and releases every subscription.
-    ws.on('close', () => {
-      clearTimeout(authTimer); clearInterval(heartbeat);
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      deviceConnections.delete(ws);
+      clearTimeout(authTimer); clearInterval(heartbeat);
       for (const reply of active.values()) reply.end();
       active.clear();
-    });
-    ws.on('message', async (bytes, binary) => {
+    };
+    ws.on('close', stop);
+    ws.on('message', async (bytes, binary) => {
+      if (stopped || ws.readyState !== WebSocket.OPEN) return;
       let message;
       try { if (binary) throw new Error(); message = JSON.parse(bytes.toString()); }
       catch { ws.close(1008, 'Invalid JSON'); return; }
@@ -103,6 +124,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
         if (!accepted) {
           ws.close(1008, 'Authentication failed'); return;
         }
+        if (message.type === 'device-auth') deviceConnections.set(ws, {
+          clientId: message.clientId, credential: message.credential,
+          revoke() { stop(); ws.close(4401, 'Device authorization revoked'); },
+        });
         authenticated = true; clearTimeout(authTimer); send({ type: 'ready', version: 1 }); return;
       }
       const { id, type } = message;
@@ -186,6 +211,7 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     });
   });
   return { close() {
+    stopWatching?.();
     for (const ws of wss.clients) ws.terminate(); wss.close();
     for (const ws of uploadWss.clients) ws.terminate(); uploadWss.close();
   } };

package/dist/src/self-relay/admin-server.mjs

@@ -2,6 +2,7 @@ import http from 'node:http';
 import fs from 'node:fs';
 import { adminPage } from './admin-page.mjs';
 import { startAdminCloud } from './admin-cloud.mjs';
+import { MAX_ADMIN_REQUEST_BYTES } from './admin-state.mjs';
 
 function reply(response, status, body, type = 'application/json; charset=utf-8') {
   const bytes = typeof body === 'string' ? body : JSON.stringify(body);
@@ -53,7 +54,7 @@ export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.
       let size = 0;
       for await (const chunk of request) {
         size += chunk.length;
-        if (size > 4096) { reply(response, 413, { error: 'Admin request too large' }); return; }
+        if (size > MAX_ADMIN_REQUEST_BYTES) { reply(response, 413, { error: 'Admin request too large' }); return; }
         chunks.push(chunk);
       }
       const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {

package/dist/src/self-relay/admin-state.mjs

@@ -2,6 +2,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 
+// 80 title + 2000 body UTF-16 units fit even when every unit uses a six-byte JSON escape.
+export const MAX_ADMIN_REQUEST_BYTES = 16 * 1024;
+
 export function relayAdminState(file, initialMaxRelaySessions, { initial, persist } = {}) {
   let value = initial ? validate(initial) : { version: 3, maxRelaySessions: initialMaxRelaySessions, announcement: null, announcements: [] };
   if (file && fs.existsSync(file)) value = validate(JSON.parse(fs.readFileSync(file, 'utf8')));

package/dist/src/self-relay/lan-authorizations.mjs

@@ -1,11 +1,23 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { EventEmitter } from 'node:events';
 import { digest, matches } from './wire.mjs';
 import { validId } from './device-store.mjs';
 
 const recordPath = stateRoot => path.join(stateRoot, 'lan-device-authorizations.json');
 const validHash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const authorizationChanges = new EventEmitter();
+const authorizationKey = stateRoot => {
+  const resolved = path.resolve(stateRoot);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+};
+
+export function onLanAuthorizationsChanged(stateRoot, listener) {
+  const key = authorizationKey(stateRoot);
+  authorizationChanges.on(key, listener);
+  return () => authorizationChanges.off(key, listener);
+}
 
 export function saveLanAuthorizations(stateRoot, hostId, clients, revision) {
   if (!validId(hostId) || !Array.isArray(clients) || clients.length > 16 ||
@@ -17,6 +29,7 @@ export function saveLanAuthorizations(stateRoot, hostId, clients, revision) {
     fs.writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: 'wx' });
     fs.renameSync(temporary, file);
   } finally { fs.rmSync(temporary, { force: true }); }
+  authorizationChanges.emit(authorizationKey(stateRoot));
 }
 export function authorizeLanDevice(stateRoot, clientId, credential) {
   if (!validId(clientId)) return false;

package/dist/src/self-relay/lifecycle.mjs

@@ -50,21 +50,9 @@ async function createRelayRuntime(stateRoot) {
   let health = await serviceHealth(session());
   if (health?.status !== 'ok') throw new Error('桌面服务尚未运行，请先执行 relax start --json。');
   const stored = await credentialStore('load');
-  let identities = stored.record || { version: 2, devices: {} };
+  const identities = stored.record || { version: 2, devices: {} };
   const validIdentity = (id, item) => /^[\w-]{16,128}$/.test(id) && item?.id === id &&
     validSecret(item.secret) && typeof item.registered === 'boolean';
-  if (identities.version === 1 && identities.servers && typeof identities.servers === 'object' && !Array.isArray(identities.servers)) {
-    const devices = {};
-    for (const [url, item] of Object.entries(identities.servers)) {
-      relayAddress(url);
-      if (!validIdentity(item?.id, item) || devices[item.id]) throw new Error('本机设备身份损坏，未自动覆盖');
-      devices[item.id] = item;
-    }
-    const previous = identities.servers[config.url];
-    identities = { version: 2, devices };
-    await credentialStore('save', identities);
-    if (!config.deviceId && previous) config.deviceId = previous.id;
-  }
   if (identities.version !== 2 || !identities.devices || typeof identities.devices !== 'object' || Array.isArray(identities.devices) ||
       Object.entries(identities.devices).some(([id, item]) => !validIdentity(id, item))) throw new Error('本机设备身份损坏，未自动覆盖');
   if (!config.deviceId) {
@@ -115,7 +103,7 @@ async function createRelayRuntime(stateRoot) {
   };
   async function shutdown() {
     if (closing) return;
-    closing = true; clearTimeout(retryTimer);
+    closing = true; online = false; attachedCount = 0; clearTimeout(retryTimer);
     connector?.events.removeAllListeners(); connector?.close();
   }
   async function saveInvitation(message) {
@@ -139,7 +127,9 @@ async function createRelayRuntime(stateRoot) {
     try {
       const bridge = session();
       await refreshHealth();
+      if (closing) return;
       const lanCandidates = await currentLanCandidates();
+      if (closing) return;
       connector?.events.removeAllListeners(); connector?.close();
       const current = connector = connectBridgeRelay({ relayUrl: config.url, identity,
         usageCacheFile: path.join(stateRoot, 'relay-usage-tasks.json'),
@@ -162,6 +152,7 @@ async function createRelayRuntime(stateRoot) {
         if (![1008, 4401, 4406, 4409, 4429].includes(event.code)) scheduleRetry();
       });
       const registration = await current.ready;
+      if (closing) return;
       if (registration.protocolVersion !== 7 || registration.room !== identity.id) {
         current.events.removeAllListeners(); current.close(); throw Object.assign(new Error('中继服务器尚未升级设备授权协议，未使用临时配对降级。'), { code: 4401 });
       }
@@ -170,11 +161,14 @@ async function createRelayRuntime(stateRoot) {
         identities.devices[identity.id] = registeredIdentity;
         await credentialStore('save', identities); identity = registeredIdentity;
       }
+      if (closing) return;
       current.assertConnected();
       online = true; attempts = 0; paired = registration.paired; clientCount = registration.clientCount || 0; lastError = '';
       saveLanAuthorizations(stateRoot, identity.id, registration.clients || [], registration.revision);
-      await saveInvitation(registration); audit('relay-connected', { paired });
+      await saveInvitation(registration);
+      if (!closing) audit('relay-connected', { paired });
     } catch (error) {
+      if (closing) return;
       online = false; lastError = error.message; audit('connect-failed', { message: error.message });
       if (![1008, 4401, 4406, 4409, 4429].includes(error.code)) retryAfterAttempt = true;
       else { clearTimeout(retryTimer); retryTimer = undefined; }

package/dist/src/self-relay/server.mjs

@@ -8,7 +8,7 @@ import { WebSocketServer } from 'ws';
 import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
 import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
 import { validProbeSignal } from './p2p-probe.mjs';
-import { relayAdminState } from './admin-state.mjs';
+import { MAX_ADMIN_REQUEST_BYTES, relayAdminState } from './admin-state.mjs';
 import { openRelayMysql } from './mysql-state.mjs';
 import { openEmailAccounts } from './email-accounts.mjs';
 import { usageMeter, usageReport } from './usage-meter.mjs';
@@ -33,6 +33,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   const accounts = accountConfigFile ? openEmailAccounts(database.pool, accountConfigFile) : null;
   const meter = accounts ? usageMeter(database.pool) : null;
   const cancelledAccountIds = new Set();
+  const accountCancellationWork = new Map();
   const diagnostics = database?.schemaVersions.includes('006_relay_diagnostics')
     ? relayDiagnostics(database.pool, error => log({ event: 'relay-diagnostic-error', message: error.message })) : null;
   const adminAccessFile = '/etc/codex-relay/admin-access.json';
@@ -145,6 +146,38 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
     response.end(value);
   }
+  function cancelAccountConnections(userId, token) {
+    const pending = accountCancellationWork.get(userId);
+    if (pending) return pending;
+    if (cancelledAccountIds.has(userId)) return Promise.resolve();
+    cancelledAccountIds.add(userId);
+    const work = (async () => {
+      try { await accounts.cancelAccount(token); }
+      catch (failure) { cancelledAccountIds.delete(userId); throw failure; }
+      for (const room of rooms.values()) {
+        for (const [key, arm] of room.usageArms || []) if (arm.userId === userId) room.usageArms.delete(key);
+        for (const [key, task] of room.usageTasks || []) if (task.userId === userId) room.usageTasks.delete(key);
+        for (const [clientId, connection] of room.connections) {
+          if (connection.userId !== userId) continue;
+          releaseRelay(connection); room.connections.delete(clientId);
+          if (room.host) send(room.host, { type: 'detach', session: connection.session });
+          connection.ws.close(4431, 'Account cancelled');
+        }
+        for (const [clientId, observer] of room.observers) {
+          if (observer.userId !== userId) continue;
+          room.observers.delete(clientId); observer.ws.close(4431, 'Account cancelled');
+        }
+        for (const [clientId, upload] of room.uploadClients) {
+          if (upload.userId !== userId) continue;
+          room.uploadClients.delete(clientId);
+          if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session: upload.session });
+          upload.ws.close(4431, 'Account cancelled');
+        }
+      }
+    })().finally(() => accountCancellationWork.delete(userId));
+    accountCancellationWork.set(userId, work);
+    return work;
+  }
   async function handleAccount(request, response, target) {
     try {
       if (target.pathname === '/account/config' && request.method === 'GET') {
@@ -160,29 +193,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       }
       if (target.pathname === '/account/me' && request.method === 'DELETE') {
         const user = await accounts.current(bearer);
-        cancelledAccountIds.add(user.id);
-        try { await accounts.cancelAccount(bearer); }
-        catch (failure) { cancelledAccountIds.delete(user.id); throw failure; }
-        for (const room of rooms.values()) {
-          for (const [key, arm] of room.usageArms || []) if (arm.userId === user.id) room.usageArms.delete(key);
-          for (const [key, task] of room.usageTasks || []) if (task.userId === user.id) room.usageTasks.delete(key);
-          for (const [clientId, connection] of room.connections) {
-            if (connection.userId !== user.id) continue;
-            releaseRelay(connection); room.connections.delete(clientId);
-            if (room.host) send(room.host, { type: 'detach', session: connection.session });
-            connection.ws.close(4431, 'Account cancelled');
-          }
-          for (const [clientId, observer] of room.observers) {
-            if (observer.userId !== user.id) continue;
-            room.observers.delete(clientId); observer.ws.close(4431, 'Account cancelled');
-          }
-          for (const [clientId, upload] of room.uploadClients) {
-            if (upload.userId !== user.id) continue;
-            room.uploadClients.delete(clientId);
-            if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session: upload.session });
-            upload.ws.close(4431, 'Account cancelled');
-          }
-        }
+        await cancelAccountConnections(user.id, bearer);
         accountReply(response, 200, { ok: true }); return;
       }
       if (request.method !== 'POST' || request.headers['content-type'] !== 'application/json') {
@@ -247,7 +258,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     if (!['PUT', 'DELETE'].includes(request.method || '') || request.headers['content-type'] !== 'application/json' ||
         request.headers['x-code-relax-admin'] !== '1') { adminReply(response, 405, { error: 'Unsupported admin request' }); return; }
     try {
-      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, 4096));
+      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, MAX_ADMIN_REQUEST_BYTES));
       if (target.pathname === '/admin/api/settings' && request.method === 'PUT') {
         const state = await adminState.setMaxRelaySessions(body.maxRelaySessions);
         log({ event: 'admin-relay-limit-updated', maxRelaySessions: state.maxRelaySessions });

package/dist/src/server.mjs

@@ -7,7 +7,8 @@ import { fileURLToPath } from 'node:url';
 import vm from 'node:vm';
 import sharp from 'sharp';
 import { attachLanSocket } from './lan-socket-server.mjs';
-import fileMentions from '../shared/file-mentions.cjs';
+import fileMentions from '../shared/file-mentions.cjs';
+import fileCitations from '../shared/file-citations.cjs';
 import { validateInlineImage } from './message-images.mjs';
 import { ThreadWriterConflictError } from './shared-app-server.mjs';
 import { ManagedAppServer, managedAppServerUrl } from './managed-app-server.mjs';
@@ -18,7 +19,7 @@ import { runtimePaths } from './platform/windows/runtime-paths.mjs';
 import { openControl } from './service-control.mjs';
 import { writeRecord, readRecord } from './service-lifecycle.mjs';
 import { ExecutionHealth } from './execution-health.mjs';
-import { authorizeLanDevice } from './self-relay/lan-authorizations.mjs';
+import { authorizeLanDevice, onLanAuthorizationsChanged } from './self-relay/lan-authorizations.mjs';
 import { createRelayManager } from './self-relay/lifecycle.mjs';
 import { generateAndSetThreadTitle } from './thread-title-generation.mjs';
 import { desktopHost } from './platform/windows/desktop-host.mjs';
@@ -29,7 +30,10 @@ import { TurnModelHistory } from './turn-model-history.mjs';
 
 const turnModelHistory = new TurnModelHistory();
 
-const MAX_ATTACHMENT_BYTES = 16 * 1024 * 1024;
+const MAX_ATTACHMENT_BYTES = 16 * 1024 * 1024;
+const MAX_FILE_DOWNLOAD_BYTES = 16 * 1024 * 1024;
+// Each Base64 response fits the 8 MiB relay limit; full chunks have no padding.
+const FILE_DOWNLOAD_CHUNK_BYTES = 3 * 1024 * 1024;
 const MAX_CACHED_ATTACHMENTS = 32;
 const MAX_CACHED_FILES = 64;
 const MAX_CONTEXT_TAIL_BYTES = 4 * 1024 * 1024;
@@ -48,16 +52,25 @@ const ALLOWED_MODELS = new Set([
 ]);
 const ALLOWED_THINKING = new Set(['low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
 
-class RequestError extends Error {
+class RequestError extends Error {
   constructor(statusCode, message, details) {
     super(message);
     this.statusCode = statusCode;
     this.details = details;
     this.code = details?.code;
   }
-}
-
-function readRuntimeVersion() {
+}
+
+function downloadOffset(rawOffset, size) {
+  const offset = Number(rawOffset);
+  if (!/^(0|[1-9]\d*)$/.test(rawOffset || '') || !Number.isSafeInteger(offset) ||
+      offset > size || offset % FILE_DOWNLOAD_CHUNK_BYTES !== 0) {
+    throw new RequestError(400, '无效的文件下载位置。');
+  }
+  return offset;
+}
+
+function readRuntimeVersion() {
   let directory = path.dirname(fileURLToPath(import.meta.url));
   while (true) {
     const manifest = readRecord(path.join(directory, 'package.json'));
@@ -77,7 +90,8 @@ const { codexDataRoot, stateRoot, sessionsRoot, uploadsRoot } = runtimePaths();
 const markdownItScript = fs.readFileSync(path.join(webRoot, 'vendor', 'markdown-it.umd.min.js'));
 const markdownSandbox = { atob };
 vm.runInNewContext(markdownItScript.toString(), markdownSandbox);
-const imageMarkdown = markdownSandbox.markdownit({ html: false });
+const imageMarkdown = markdownSandbox.markdownit({ html: false });
+fileCitations.install(imageMarkdown);
 const attachmentCache = new Map();
 const fileCache = new Map();
 const fileCapabilitySecret = crypto.randomBytes(32);
@@ -229,9 +243,18 @@ async function handleRequest(request, response) {
         } catch {}
       }
       if (!image) throw new RequestError(404, '这张图片已失效，无法从工作站重新读取。');
-      const thumbnail = url.searchParams.get('variant') === 'thumbnail';
-      const asset = thumbnail ? await attachmentThumbnail(image) : { buffer: image.buffer, mimeType: image.mimeType };
-      sendJson(response, 200, { url: `data:${asset.mimeType};base64,${asset.buffer.toString('base64')}` });
+      if (url.searchParams.get('variant') === 'thumbnail') {
+        const asset = await attachmentThumbnail(image);
+        sendJson(response, 200, { url: `data:${asset.mimeType};base64,${asset.buffer.toString('base64')}` });
+        return;
+      }
+      const size = image.buffer.length;
+      if (size > MAX_ATTACHMENT_BYTES) throw new RequestError(413, '图片超过下载上限（16 MiB），无法下载。');
+      if (!size) throw new RequestError(400, '图片为空，无法下载。');
+      const offset = downloadOffset(url.searchParams.get('offset'), size);
+      const data = image.buffer.subarray(offset, Math.min(size, offset + FILE_DOWNLOAD_CHUNK_BYTES));
+      sendJson(response, 200, { name: image.name || '图片', size, offset, mimeType: image.mimeType,
+        dataBase64: data.toString('base64') });
       return;
     }
 
@@ -239,14 +262,34 @@ async function handleRequest(request, response) {
     if (request.method === 'GET' && fileMatch) {
       const file = fileCache.get(fileMatch[1]);
       if (!file) throw new RequestError(404, '文件授权已失效，请重新读取对话。');
-      let stat;
-      try { stat = fs.statSync(file.path); } catch { throw new RequestError(404, '电脑上的文件已不存在。'); }
-      if (!stat.isFile() || stat.size !== file.size || stat.mtimeMs !== file.mtimeMs) {
-        fileCache.delete(fileMatch[1]);
-        throw new RequestError(409, '电脑上的文件已发生变化，请重新读取对话。');
-      }
-      if (stat.size > MAX_ATTACHMENT_BYTES) throw new RequestError(413, '暂只支持下载不超过 16 MiB 的文件。');
-      sendJson(response, 200, { name: file.name, size: file.size, dataBase64: fs.readFileSync(file.path).toString('base64') });
+      const offset = downloadOffset(url.searchParams.get('offset'), file.size);
+      let handle;
+      try { handle = fs.openSync(file.path, 'r'); }
+      catch (error) {
+        if (error.code === 'ENOENT') throw new RequestError(404, '电脑上的文件已不存在。');
+        throw error;
+      }
+      try {
+        const validate = () => {
+          const stat = fs.fstatSync(handle);
+          if (!stat.isFile() || stat.size !== file.size || stat.mtimeMs !== file.mtimeMs) {
+            fileCache.delete(fileMatch[1]);
+            throw new RequestError(409, '电脑上的文件已发生变化，请重新读取对话。');
+          }
+          if (stat.size > MAX_FILE_DOWNLOAD_BYTES) throw new RequestError(413, '文件超过下载上限（16 MiB），无法下载。');
+          if (!stat.size) throw new RequestError(400, '文件为空，无法下载。');
+        };
+        validate();
+        const data = Buffer.alloc(Math.min(FILE_DOWNLOAD_CHUNK_BYTES, file.size - offset));
+        let bytesRead = 0;
+        while (bytesRead < data.length) {
+          const count = fs.readSync(handle, data, bytesRead, data.length - bytesRead, offset + bytesRead);
+          if (!count) throw new RequestError(409, '电脑上的文件读取不完整，请重新读取对话。');
+          bytesRead += count;
+        }
+        validate();
+        sendJson(response, 200, { name: file.name, size: file.size, offset, dataBase64: data.toString('base64') });
+      } finally { fs.closeSync(handle); }
       return;
     }
 
@@ -521,7 +564,8 @@ async function handleRequest(request, response) {
 const server = http.createServer(handleRequest);
 const lanSocket = attachLanSocket(server, { token: options.token, dispatch: handleRequest,
   uploadsRoot,
-  authorizeDevice: (clientId, credential) => authorizeLanDevice(stateRoot, clientId, credential),
+  authorizeDevice: (clientId, credential) => authorizeLanDevice(stateRoot, clientId, credential),
+  onDeviceAuthorizationsChanged: listener => onLanAuthorizationsChanged(stateRoot, listener),
 });
 
 let control;
@@ -1055,8 +1099,8 @@ function markdownImageAssets(text) {
   const assets = Object.create(null);
   function visit(tokens) {
     for (const token of tokens) {
-      const value = token.type === 'image' ? token.attrGet('src')
-        : token.type === 'link_open' ? token.attrGet('href') : null;
+      const value = token.type === 'image' ? token.attrGet('src')
+        : token.type === 'link_open' && !token.meta?.fileCitation ? token.attrGet('href') : null;
       if (value && !Object.hasOwn(assets, value)) {
         let localPath;
         try { localPath = decodeURIComponent(value); } catch { continue; }
@@ -1068,10 +1112,10 @@ function markdownImageAssets(text) {
           if (asset.available) assets[value] = asset;
         }
       }
-      if (token.children) visit(token.children);
+      if (token.children && token.type !== 'image') visit(token.children);
     }
   }
-  visit(imageMarkdown.parse(text, {}));
+  visit(imageMarkdown.parse(text, { allowFileCitations: true }));
   return assets;
 }
 
@@ -1092,10 +1136,10 @@ function markdownFileAssets(text) {
           }
         }
       }
-      if (token.children) visit(token.children);
+      if (token.children && token.type !== 'image') visit(token.children);
     }
   }
-  visit(imageMarkdown.parse(text, {}));
+  visit(imageMarkdown.parse(text, { allowFileCitations: true }));
   return assets;
 }
 
@@ -1103,7 +1147,7 @@ function rememberLocalFile(filePath) {
   try {
     const resolved = path.resolve(filePath);
     const stat = fs.statSync(resolved);
-    if (!stat.isFile() || stat.size > MAX_ATTACHMENT_BYTES) return null;
+    if (!stat.isFile()) return null;
     const id = crypto.createHmac('sha256', fileCapabilitySecret)
       .update(resolved).update('\0').update(String(stat.size)).update('\0').update(String(stat.mtimeMs)).digest('hex');
     if (!fileCache.has(id)) {

package/dist/src/service-restart.mjs

@@ -4,36 +4,69 @@ import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
 import { startBackground } from './background-process.mjs';
-import { lifecycle, readRecord } from './service-lifecycle.mjs';
+import { lifecycle, readRecord, writeRecord } from './service-lifecycle.mjs';
 import * as host from './platform/windows/service-host.mjs';
+import { desktopHost } from './platform/windows/desktop-host.mjs';
 
 const script = fileURLToPath(import.meta.url);
+const sameProcess = (expected, actual) => expected && actual && expected.pid === actual.pid &&
+  expected.created === actual.created && expected.executable === actual.executable;
+async function processIdentity(pid) {
+  const current = await desktopHost.process(pid);
+  return current ? { pid: current.pid, created: current.created, executable: current.executable } : null;
+}
 
 export async function requestServiceRestart(stateRoot) {
   const lock = path.join(stateRoot, 'service-restart.lock');
   const operationId = randomUUID();
-  let handle;
+  const owner = await processIdentity(process.pid);
+  if (!owner) throw new Error('无法确认服务重启请求进程。');
+  const previous = readRecord(lock);
+  if (previous) {
+    const actual = previous.owner?.pid ? await processIdentity(previous.owner.pid) : null;
+    if (sameProcess(previous.owner, actual) || readRecord(lock)?.operationId !== previous.operationId) {
+      throw new Error('工作站服务已在重启中。');
+    }
+    fs.rmSync(lock);
+  }
+  const temporary = `${lock}.${operationId}.tmp`;
   try {
-    handle = fs.openSync(lock, 'wx', 0o600);
-    fs.writeFileSync(handle, JSON.stringify({ operationId, requestedAt: new Date().toISOString() }));
+    fs.writeFileSync(temporary, JSON.stringify({ operationId, owner, requestedAt: new Date().toISOString() }),
+      { flag: 'wx', mode: 0o600 });
+    // Publish a complete record exclusively; a crash cannot leave a half-written lock.
+    fs.linkSync(temporary, lock);
   } catch (error) {
     if (error.code === 'EEXIST') throw new Error('工作站服务已在重启中。');
     throw error;
-  } finally { if (handle !== undefined) fs.closeSync(handle); }
+  } finally { fs.rmSync(temporary, { force: true }); }
   try {
     const log = path.join(stateRoot, 'service-restart.log');
-    await startBackground(process.execPath, [script, '--worker', stateRoot, operationId], process.env, [log, log]);
+    const pid = await startBackground(process.execPath, [script, '--worker', stateRoot, operationId], process.env, [log, log]);
+    const worker = await processIdentity(pid);
+    if (!worker) throw new Error('服务重启进程未启动。');
+    const current = readRecord(lock);
+    if (current?.operationId !== operationId) throw new Error('服务重启实例已失效。');
+    writeRecord(lock, { ...current, owner: worker });
     return { operationId, status: 'scheduled', message: '工作站服务重启已安排。' };
   } catch (error) {
-    fs.rmSync(lock, { force: true }); throw error;
+    const current = readRecord(lock);
+    if (current?.operationId === operationId && sameProcess(current.owner, owner)) fs.rmSync(lock, { force: true });
+    throw error;
   }
 }
 
 async function run(stateRoot, operationId) {
   const lock = path.join(stateRoot, 'service-restart.lock');
-  if (readRecord(lock)?.operationId !== operationId) throw new Error('服务重启实例已失效。');
-  const service = lifecycle({ stateRoot, host });
   try {
+    const deadline = Date.now() + 30000;
+    while (true) {
+      const record = readRecord(lock);
+      if (record?.operationId !== operationId) throw new Error('服务重启实例已失效。');
+      if (record.owner?.pid === process.pid) break;
+      if (Date.now() >= deadline) throw new Error('服务重启进程交接超时。');
+      await delay(100);
+    }
+    const service = lifecycle({ stateRoot, host });
     await delay(1000);
     await service.stop();
     await service.start();

package/dist/src/shared-app-server.mjs

@@ -211,7 +211,11 @@ export class SharedAppServer extends EventEmitter {
       this.emit('turn', { thread: record.thread, turn, sequence,
         immediate: ['turn/completed', 'item/completed'].includes(method) });
     }
-    if (method === 'turn/completed') record.thread.turns = record.thread.turns.slice(-10);
+    if (method === 'turn/completed' && record.thread.turns.length > 10) {
+      record.thread.turns = record.thread.turns.slice(-10);
+      // Native cursors are opaque; obtain a matching boundary before the next snapshot.
+      record.historyTrimmed = true;
+    }
     if (['turn/completed', 'thread/status/changed'].includes(method)) this.releaseInactiveThread(id);
   }
 
@@ -220,21 +224,25 @@ export class SharedAppServer extends EventEmitter {
     const slot = this.slot(threadId);
     slot.readers++;
     const task = slot.tail.then(async () => {
-      let record = this.threads.get(threadId);
-      if (record?.readOnly || record?.needsReload) {
-        this.threads.delete(threadId);
-        this.contexts.delete(threadId);
-        record = null;
-      }
-      if (!record) {
+      let record = this.threads.get(threadId);
+      // Snapshot refreshes must not reset the sequence or tokens of live subscribers.
+      const previous = record?.readOnly ? null : record;
+      if (record?.readOnly || record?.needsReload) this.contexts.delete(threadId);
+      if (!record || record.readOnly || record.needsReload || record.historyTrimmed) {
         let result;
         try {
-          result = await this.request('thread/resume', { threadId, excludeTurns: true,
-            initialTurnsPage: { limit: 1, sortDirection: 'desc', itemsView: 'notLoaded' } }, value => {
-            if (!Array.isArray(value.initialTurnsPage?.data)) throw new Error('Codex 内核未返回分页历史。');
-            record = { thread: { ...value.thread, turns: [...value.initialTurnsPage.data].reverse().map(turn => ({ ...turn, items: [] })) },
-              nextCursor: value.initialTurnsPage.nextCursor ?? null, sequence: 0, recoverAfter: 0,
-              changes: new Map(), changeBytes: 0, tokens: new Map(), hydrating: true };
+          result = await this.request('thread/resume', { threadId, excludeTurns: true,
+            initialTurnsPage: { limit: 1, sortDirection: 'desc', itemsView: 'notLoaded' } }, value => {
+            if (!Array.isArray(value.initialTurnsPage?.data)) throw new Error('Codex 内核未返回分页历史。');
+            const retained = new Map((previous?.thread.turns || []).map(turn => [turn.id, turn]));
+            record = { thread: { ...value.thread, turns: [...value.initialTurnsPage.data].reverse().map(turn => ({
+              ...turn, items: retained.get(turn.id)?.items || [],
+              ...(retained.get(turn.id)?.itemPage ? { itemPage: retained.get(turn.id).itemPage } : {}),
+            })) },
+              nextCursor: value.initialTurnsPage.nextCursor ?? null,
+              sequence: previous?.sequence ?? 0, recoverAfter: previous?.recoverAfter ?? 0,
+              changes: previous?.changes ?? new Map(), changeBytes: previous?.changeBytes ?? 0,
+              tokens: previous?.tokens ?? new Map(), hydrating: true };
             this.threads.set(threadId, record);
             return value;
           });
@@ -346,7 +354,7 @@ export class SharedAppServer extends EventEmitter {
       if (!token || token.expires <= Date.now() || token.sequence !== requested.after) token = undefined;
     }
     let snapshot = false, catchup;
-    if (!record || !token) {
+    if (!record || !token || (record.historyTrimmed && requested.after < record.recoverAfter)) {
       const fresh = await this.timeline(threadId);
       record = this.threads.get(threadId); token = record.tokens.get(fresh.sync.id);
       requested = { id: fresh.sync.id, epoch: fresh.sync.epoch, after: fresh.sync.seq };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@walkhi/code-relax",
-  "version": "0.1.0-beta.25",
+  "version": "0.1.0-beta.27",
   "license": "UNLICENSED",
   "type": "module",
   "scripts": {