@xopcai/xopc 0.0.421 → 0.0.422

package/dist/src/phone/runtime.js

@@ -7,8 +7,10 @@ import { nativePhoneOutput, updatePhoneFeedback } from "./task-feedback.js";
 import { PhoneFrameCache, PhoneOperationBudget } from "./live-state.js";
 import { PhoneInteractiveSession } from "./interactive-session.js";
 import { LocalScrcpyProvider } from "./scrcpy.js";
+import { pendingPhoneAssistance, phoneAssistance, updatePhoneCheckpoint } from "./assistance.js";
 import { AdbPhoneDriver, resolveAdbPath } from "./adb-driver.js";
 import { CloudPhones } from "./cloud-phones.js";
+import { PhoneLocationEnvironment } from "./location-environment.js";
 import { WirelessPhones } from "./wireless.js";
 import { advancePhonePlan, buildPhonePlan, createPhonePlanState } from "./planning.js";
 import { canDispatchPhoneAction, observationSignature, phoneCompletionSatisfied } from "./reliability.js";
@@ -29,10 +31,47 @@ var PhoneRuntime = class {
 	reconnecting = /* @__PURE__ */ new Map();
 	reconnectAfter = /* @__PURE__ */ new Map();
 	cloudPhones;
+	locationEnvironment;
+	get environment() {
+		return this.locationEnvironment ??= new PhoneLocationEnvironment(this.repository, {
+			adapter: (device) => this.cloud.locationAdapter(device),
+			exclusive: (phoneId, owner, cleanup, action) => this.withEnvironmentLock(phoneId, owner, cleanup, action)
+		});
+	}
+	async withEnvironmentLock(phoneId, owner, cleanup, action) {
+		const device = this.repository.get(phoneId);
+		if (this.deviceOpenings.has(phoneId)) throw new PhoneError("PHONE_DEVICE_BUSY", "Phone environment is busy", 409);
+		const session = [...this.sessions.values()].find((value) => value.device.id === phoneId && value.report.status !== "closed");
+		if (session && cleanup && ![
+			"closed",
+			"cancelled",
+			"completed"
+		].includes(session.report.status)) await this.stop(session.report.owner, "pause");
+		if (session && !cleanup && (session.report.owner !== owner || session.active && !this.locationEnvironment?.hasVerified(phoneId, owner))) throw new PhoneError("PHONE_DEVICE_BUSY", "Pause the phone task before sharing location", 409);
+		const opening = new AbortController();
+		this.deviceOpenings.set(phoneId, opening);
+		let lease;
+		try {
+			if (session) {
+				this.repository.renew(device.serial, session.lease);
+				const result = await this.io(session, action);
+				session.report.controlEpoch++;
+				session.frames.invalidate();
+				this.publish(session);
+				return result;
+			}
+			lease = this.repository.acquire(device.serial);
+			return await action();
+		} finally {
+			if (lease) this.repository.release(device.serial, lease);
+			if (this.deviceOpenings.get(phoneId) === opening) this.deviceOpenings.delete(phoneId);
+		}
+	}
 	get cloud() {
 		return this.cloudPhones ??= new CloudPhones(this.repository);
 	}
 	sessions = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Map();
 	lastDevices = /* @__PURE__ */ new Map();
 	openings = /* @__PURE__ */ new Map();
 	deviceOpenings = /* @__PURE__ */ new Map();
@@ -159,6 +198,75 @@ var PhoneRuntime = class {
 		const report = this.sessions.get(owner)?.report;
 		return report && structuredClone(report);
 	}
+	checkpoint(session) {
+		const { sessionId, deviceId, deviceName, owner, agentId, modelRef, executionMode } = session.report;
+		return {
+			report: {
+				sessionId,
+				deviceId,
+				deviceName,
+				owner,
+				agentId,
+				modelRef,
+				executionMode
+			},
+			deviceRevision: session.device.revision,
+			task: structuredClone(session.report.task),
+			usage: {
+				actions: session.report.actions - (session.report.humanActions ?? 0) - (session.taskStart?.actions ?? 0),
+				modelRequests: session.report.modelRequests - (session.taskStart?.modelRequests ?? 0),
+				activeDurationMs: (session.taskActiveMs ?? 0) + (session.budget?.elapsedMs ?? 0)
+			}
+		};
+	}
+	async restoreAssistance(checkpoint, context, signal, assistanceId) {
+		const { owner, deviceId, agentId, modelRef } = checkpoint.report;
+		if (context.agentId !== agentId || context.modelRef !== modelRef || this.repository.get(deviceId).revision !== checkpoint.deviceRevision) throw new PhoneError("PHONE_BINDING_CHANGED", "Phone or Agent settings changed. Inspect the task before restarting.", 409);
+		const existing = this.sessions.get(owner);
+		if (existing && existing.report.status !== "closed") {
+			this.guard(existing, context);
+			if (existing.report.deviceId !== deviceId || existing.report.task && existing.report.task.taskId !== checkpoint.task.taskId) throw new PhoneError("PHONE_ASSISTANCE_CHANGED", "Another phone task is active", 409);
+			if (existing.report.task) {
+				existing.report.assistanceId = assistanceId ?? existing.report.assistanceId;
+				return this.publish(existing);
+			}
+			if (existing.active || existing.human) throw this.busy(deviceId, existing);
+		}
+		if (!existing || existing.report.status === "closed") await this.execute(owner, {
+			op: "open",
+			deviceId,
+			mode: "control"
+		}, {
+			...context,
+			assistanceId
+		}, signal);
+		const session = this.sessions.get(owner);
+		session.report.task = structuredClone(checkpoint.task);
+		session.taskPending = true;
+		session.report.executionMode = checkpoint.task.executionMode;
+		session.report.actions = checkpoint.usage.actions;
+		session.report.modelRequests = checkpoint.usage.modelRequests;
+		session.taskStart = {
+			actions: 0,
+			modelRequests: 0
+		};
+		session.taskActiveMs = checkpoint.usage.activeDurationMs;
+		session.report.status = "needs_user";
+		session.report.stopReason = "user_takeover";
+		session.report.assistanceId = assistanceId;
+		session.report.controlOwner = "none";
+		session.report.controlEpoch++;
+		return this.publish(session);
+	}
+	subscribe(owner, listener) {
+		const listeners = this.listeners.get(owner) ?? /* @__PURE__ */ new Set();
+		listeners.add(listener);
+		this.listeners.set(owner, listeners);
+		return () => {
+			listeners.delete(listener);
+			if (!listeners.size) this.listeners.delete(owner);
+		};
+	}
 	deviceContext(id, config) {
 		const session = [...this.sessions.values()].find((session) => session.device.id === id && session.report.status !== "closed");
 		if (!session) throw new PhoneError("PHONE_SESSION_NOT_FOUND", "Phone is not connected", 404);
@@ -195,6 +303,19 @@ var PhoneRuntime = class {
 			await this.stop(owner, "cancel");
 			return;
 		}
+		const wait = phoneAssistance(owner);
+		if (wait && [
+			"open",
+			"queued",
+			"resuming"
+		].includes(wait.status) && session.report.task?.taskId === wait.checkpoint.task.taskId && session.report.status !== "completed") {
+			if (!session.human) {
+				session.report.status = "needs_user";
+				session.report.controlOwner = "none";
+				this.publish(session);
+			}
+			return;
+		}
 		if (!session.human && ![
 			"paused",
 			"needs_user",
@@ -210,10 +331,20 @@ var PhoneRuntime = class {
 			activeDurationMs: session.segmentUsage.activeDurationMs + (session.budget?.elapsedMs ?? 0)
 		}, session.report.feedback);
 		session.report.updatedAt = Date.now();
+		if (session.report.task) updatePhoneCheckpoint(session.report.owner, this.checkpoint(session));
 		this.repository.report(session.report);
+		for (const listener of this.listeners.get(session.report.owner) ?? []) try {
+			listener(structuredClone(session.report));
+		} catch {
+			log.warn({
+				conversationId: session.report.owner,
+				phase: "report_listener"
+			}, "Phone progress listener failed");
+		}
 		return structuredClone(session.report);
 	}
-	guard(session, context) {
+	guard(session, context, requireLocation = true) {
+		if (requireLocation) this.locationEnvironment?.assertAllowed(session.device.id, session.report.owner);
 		if (!context.config.phone.enabled || context.toolDenied) throw new PhoneError("PHONE_DISABLED", "Phone Use is disabled for this agent");
 		if (context.modelRef !== session.modelRef || resolveAdbPath(context.config.phone.adbPath) !== session.adbPath) throw new PhoneError("PHONE_BINDING_CHANGED", "Phone model or execution configuration changed; reopen the phone");
 		if (context.validateBinding && !context.validateBinding()) throw new PhoneError("PHONE_BINDING_CHANGED", "Agent model or tool policy changed; reopen the phone");
@@ -226,6 +357,26 @@ var PhoneRuntime = class {
 	}
 	async execute(owner, raw, context, signal = new AbortController().signal) {
 		const input = PhoneInputSchema.parse(raw);
+		if (input.op === "request_user") {
+			const session = this.sessions.get(owner);
+			if (!session?.report.task || terminal.has(session.report.status)) throw new PhoneError("PHONE_OPEN_REQUIRED", "Start a phone task before requesting user assistance", 409);
+			this.guard(session, context);
+			if (session.human || session.active || session.switching) throw new PhoneError("PHONE_SESSION_BUSY", "Wait for the current phone operation before requesting user assistance", 409);
+			if (session.report.status === "outcome_unknown") throw new PhoneError("PHONE_DISPATCH_UNKNOWN", "Inspect the previous input before continuing", 409);
+			session.controller.abort();
+			session.prediction?.abort();
+			session.budget?.pause();
+			session.report.status = "needs_user";
+			session.report.stopReason = "user_takeover";
+			session.report.message = input.reason;
+			session.report.controlOwner = "none";
+			session.report.controlEpoch++;
+			session.report.verified = false;
+			session.report.assistanceId = context.onNeedsUser?.(this.checkpoint(session));
+			this.publish(session);
+			await session.stream?.revoke();
+			return this.publish(session);
+		}
 		if (input.op === "close") return this.finishTask(owner);
 		if ([
 			"cancel",
@@ -247,6 +398,7 @@ var PhoneRuntime = class {
 		signal.throwIfAborted();
 		if (input.op === "open") {
 			const requestedDevice = input.deviceId ?? context.preferredDeviceId ?? this.repository.defaultDevice();
+			if (requestedDevice && this.repository.get(requestedDevice).connection) await this.environment.recover(requestedDevice);
 			if (requestedDevice && this.deviceOpenings.has(requestedDevice)) throw this.busy(requestedDevice);
 			if (this.openings.has(owner)) throw new PhoneError("PHONE_SESSION_BUSY", "A phone is already being opened", 409);
 			const opening = new AbortController();
@@ -258,6 +410,8 @@ var PhoneRuntime = class {
 				if (this.sessions.size >= 50 && ![...this.sessions.values()].some((session) => session.device.id === requestedDevice)) throw new PhoneError("PHONE_CAPACITY", "Disconnect an idle phone in the global phone panel before opening another", 409);
 				const previous = this.sessions.get(owner);
 				const deviceId = requestedDevice;
+				const waiting = pendingPhoneAssistance().find((wait) => wait.checkpoint.report.deviceId === deviceId);
+				if (waiting && waiting.id !== context.assistanceId) throw new PhoneError("PHONE_PAUSED", "This phone has a pending user handoff. Complete or cancel that task before opening another.", 409);
 				if (!deviceId) throw new PhoneError("PHONE_DEVICE_REQUIRED", "Choose a registered phone in Phone Use settings");
 				if (previous && !terminal.has(previous.report.status) && previous.device.id !== deviceId) {
 					if (previous.active || previous.human || previous.report.controlOwner !== "none" || !["ready", "completed"].includes(previous.report.status)) throw this.busy(previous.device.id, previous);
@@ -483,6 +637,7 @@ var PhoneRuntime = class {
 		if (session.active) throw new PhoneError("PHONE_SESSION_BUSY", "A phone operation is already running", 409);
 		this.guard(session, context);
 		if (input.op === "resume") {
+			if (session.report.status === "needs_user") throw new PhoneError("PHONE_PAUSED", "User assistance is required. Wait for explicit handback in the phone panel", 409);
 			if (session.modeHandbackRequired) throw new PhoneError("PHONE_PAUSED", "Inspect the phone and explicitly hand back in the phone panel after changing execution mode", 409);
 			if (session.report.steps.at(-1)?.dispatch === "unknown") throw new PhoneError("PHONE_DISPATCH_UNKNOWN", "Inspect the previous input before continuing; do not retry automatically", 409);
 			session.controller = new AbortController();
@@ -669,7 +824,10 @@ var PhoneRuntime = class {
 				session.report.status = "ready";
 				session.taskPending = false;
 			}
-			if (session.report.status === "completed") session.taskPending = false;
+			if (session.report.status === "completed") {
+				session.taskPending = false;
+				await this.locationEnvironment?.releaseOwner(owner);
+			}
 			if (!terminal.has(session.report.status) && !session.human && !["paused", "needs_user"].includes(session.report.status)) {
 				session.report.controlOwner = "none";
 				session.report.controlEpoch++;
@@ -745,6 +903,7 @@ var PhoneRuntime = class {
 		if (this.deviceOpenings.has(session.device.id)) throw this.busy(session.device.id, session);
 		if (session.human || session.report.status === "needs_user" || session.report.steps.at(-1)?.dispatch === "unknown") throw this.busy(session.device.id, session);
 		if (session.active) await this.stop(owner, "pause");
+		await this.locationEnvironment?.releaseOwner(owner);
 		session.controller = new AbortController();
 		session.report.controlOwner = "none";
 		session.report.controlEpoch++;
@@ -1034,11 +1193,9 @@ var PhoneRuntime = class {
 						session.report.controlOwner = "none";
 						session.report.controlEpoch++;
 						session.budget?.pause();
-						this.publish(session);
-						await this.waitForAgent(session, signal);
-						observation.frame.fill(0);
-						observation = await this.observe(session, signal);
-						continue;
+						session.report.assistanceId = context.onNeedsUser?.(this.checkpoint(session));
+						await session.stream?.revoke();
+						return this.publish(session);
 					}
 					return this.publish(session);
 				}
@@ -1175,6 +1332,7 @@ var PhoneRuntime = class {
 				session.report.currentAction = void 0;
 				session.report.stopReason = failure.code === "PHONE_TEXT_INPUT_UNAVAILABLE" ? "text_input_required" : "text_input_unconfirmed";
 				session.budget?.pause();
+				session.report.assistanceId = context.onNeedsUser?.(this.checkpoint(session));
 				await session.stream?.revoke();
 				return this.publish(session);
 			}
@@ -1299,8 +1457,9 @@ var PhoneRuntime = class {
 	}
 	async dispatch(session, action, observation, context, signal, epoch = session.report.controlEpoch, resetTask = false, settingsPage) {
 		return this.io(session, async () => {
+			if (session.human) session.authorizeHuman?.();
 			signal.throwIfAborted();
-			this.guard(session, context);
+			this.guard(session, context, !session.human);
 			if (epoch !== session.report.controlEpoch || session.report.controlOwner === "none" || session.report.handoff !== "idle") return false;
 			if (session.human && Date.now() > (session.humanExpiresAt ?? 0)) throw new PhoneError("PHONE_CONTROL_REQUIRED", "Manual control expired", 409);
 			if (!session.human && session.report.actions - (session.report.humanActions ?? 0) >= context.config.phone.maxActionsPerSession) throw new PhoneError("PHONE_ACTION_LIMIT", "Phone action limit reached");
@@ -1410,6 +1569,7 @@ var PhoneRuntime = class {
 		await session.active?.catch(() => {});
 		await session.io.catch(() => {});
 		if (op === "close") this.repository.release(session.device.serial, session.lease);
+		if (op !== "pause") await this.locationEnvironment?.releaseOwner(owner);
 		if (op === "cancel") {
 			session.controller = new AbortController();
 			session.report.status = "ready";
@@ -1447,10 +1607,10 @@ var PhoneRuntime = class {
 	async capture(session, signal) {
 		return this.io(session, async () => {
 			signal.throwIfAborted();
-			this.guard(session, session.context);
+			this.guard(session, session.context, false);
 			const observation = await (session.driver.capture ?? session.driver.observe).call(session.driver, session.device.serial, signal);
 			try {
-				this.guard(session, session.context);
+				this.guard(session, session.context, false);
 				this.allowedScreen(session, observation);
 				if (!terminal.has(session.report.status)) session.frames.set(observation);
 				return observation;
@@ -1499,7 +1659,7 @@ var PhoneRuntime = class {
 					continue;
 				}
 				try {
-					this.guard(session, session.context);
+					this.guard(session, session.context, false);
 					const idleLimit = session.context.config.phone.idleDisconnectMs;
 					if (idleLimit && !session.active && !session.human && session.report.controlOwner === "none" && Date.now() - Math.max(session.viewedAt, session.report.updatedAt) >= idleLimit) {
 						this.stopDevice(session.device.id);
@@ -1528,7 +1688,7 @@ var PhoneRuntime = class {
 		if (!session || session.report.sessionId !== id) throw new PhoneError("PHONE_SESSION_NOT_FOUND", "Phone session not found", 404);
 		if (context.agentId !== session.report.agentId) throw new PhoneError("PHONE_ACCESS_CHANGED", "Agent binding changed", 403);
 		if (!terminal.has(session.report.status)) try {
-			this.guard(session, context);
+			this.guard(session, context, false);
 		} catch (error) {
 			session.frames.clear();
 			throw error;
@@ -1584,11 +1744,12 @@ var PhoneRuntime = class {
 			}
 			session.stream = new PhoneInteractiveSession(provider, async () => {
 				if (terminal.has(session.report.status)) throw new PhoneError("PHONE_VIDEO_ENDED", "Phone session ended", 409);
-				this.guard(session, session.context);
+				this.guard(session, session.context, false);
 				const app = await provider.foreground(AbortSignal.timeout(2e3));
 				if (!phoneAllowsApp(session.device, app)) throw new PhoneError("PHONE_APP_DENIED", "Current page is outside the authorized applications", 403);
 				session.viewedAt = Date.now();
 			}, (client, epoch) => {
+				session.authorizeHuman?.();
 				if (terminal.has(session.report.status) || session.report.handoff !== "idle" || session.report.controlOwner !== "human" || session.human !== client || session.report.controlEpoch !== epoch || Date.now() > (session.humanExpiresAt ?? 0)) throw new PhoneError("PHONE_CONTROL_CHANGED", "Manual control is no longer available", 409);
 				session.humanExpiresAt = Date.now() + 15e3;
 				if ((session.report.humanActions ?? 0) >= 1200) throw new PhoneError("PHONE_ACTION_LIMIT", "Manual input limit reached; reopen the session");
@@ -1615,10 +1776,10 @@ var PhoneRuntime = class {
 			throw error;
 		}
 	}
-	async disconnectVideo(owner, id, client) {
+	async disconnectVideo(owner, id, client, epoch) {
 		const session = this.sessions.get(owner);
 		if (!session || session.report.sessionId !== id) return;
-		if (session.human === client) {
+		if (session.human === client && (epoch === void 0 || session.report.controlEpoch === epoch)) {
 			session.human = void 0;
 			session.report.controlOwner = "none";
 			session.report.controlEpoch++;
@@ -1648,7 +1809,7 @@ var PhoneRuntime = class {
 			session.preview ??= (async () => {
 				const observation = await this.capture(session, signal);
 				try {
-					this.guard(session, context);
+					this.guard(session, context, false);
 					this.allowedScreen(session, observation);
 				} catch (error) {
 					session.frames.clear();
@@ -1661,7 +1822,7 @@ var PhoneRuntime = class {
 			});
 			await session.preview;
 		}
-		this.guard(session, context);
+		this.guard(session, context, false);
 		const frame = session.frames.get();
 		if (!frame) throw new PhoneError("PHONE_OPEN_REQUIRED", "Phone session ended", 409);
 		return {
@@ -1669,7 +1830,8 @@ var PhoneRuntime = class {
 			frame: Buffer.from(frame.frame)
 		};
 	}
-	async liveControl(owner, id, context, client, input) {
+	async liveControl(owner, id, context, client, input, authorize) {
+		authorize?.();
 		const session = this.liveSession(owner, id, context);
 		if (session.switching) throw new PhoneError("PHONE_SESSION_BUSY", "Phone execution mode is changing", 409);
 		if (this.deviceOpenings.has(session.device.id)) throw this.busy(session.device.id, session);
@@ -1691,8 +1853,9 @@ var PhoneRuntime = class {
 			"heartbeat"
 		].includes(input.op)) throw new PhoneError("PHONE_SESSION_LIMIT", "Phone control request limit reached; reopen the session");
 		const result = session.commands.catch(() => {}).then(async () => {
+			authorize?.();
 			if (terminal.has(session.report.status)) throw new PhoneError("PHONE_OPEN_REQUIRED", "Phone session ended", 409);
-			this.guard(session, context);
+			this.guard(session, context, input.op === "handback");
 			if (session.switching) throw new PhoneError("PHONE_SESSION_BUSY", "Phone execution mode is changing", 409);
 			if (input.epoch !== session.report.controlEpoch) throw new PhoneError("PHONE_CONTROL_CHANGED", "Control changed. Refresh before trying again.", 409);
 			if (session.human && session.human !== client) throw new PhoneError("PHONE_CONTROL_BUSY", "Another browser window controls this phone", 409);
@@ -1719,6 +1882,8 @@ var PhoneRuntime = class {
 				if (session.controller.signal.aborted && !session.active) session.controller = new AbortController();
 				session.human = void 0;
 				if (input.op === "takeover") {
+					authorize?.();
+					session.authorizeHuman = authorize;
 					session.human = client;
 					session.humanExpiresAt = Date.now() + 15e3;
 					session.report.controlOwner = "human";
@@ -1759,6 +1924,7 @@ var PhoneRuntime = class {
 				} finally {
 					observation?.frame.fill(0);
 				}
+				authorize?.();
 				session.report.controlOwner = session.active || session.taskPending ? "agent" : "none";
 				session.report.status = session.active ? "running" : "ready";
 				session.report.handoff = "idle";
@@ -1820,10 +1986,26 @@ var PhoneRuntime = class {
 		});
 		return result;
 	}
+	/** Called only for an explicit completion message from the controlling conversation's user. */
+	async completeAssistanceForUser(owner, context) {
+		const session = this.sessions.get(owner);
+		if (!session) throw new PhoneError("PHONE_OPEN_REQUIRED", "Reconnect the phone before continuing", 409);
+		this.guard(session, context);
+		if (session.report.controlOwner === "agent" && session.report.status === "ready") return;
+		await this.liveControl(owner, session.report.sessionId, context, session.human ?? `phone-user:${owner}`, {
+			op: "handback",
+			epoch: session.report.controlEpoch,
+			operationId: randomUUID()
+		});
+	}
 	async stopDevice(id) {
 		this.deviceOpenings.get(id)?.abort();
 		await Promise.all(this.reports().filter((report) => report.deviceId === id).map((report) => this.stop(report.owner, "close")));
-		this.cloudPhones?.disconnect(id);
+		try {
+			await this.locationEnvironment?.releaseDevice(id);
+		} finally {
+			this.cloudPhones?.disconnect(id);
+		}
 	}
 	async shutdown() {
 		this.wireless.close();
@@ -1831,6 +2013,7 @@ var PhoneRuntime = class {
 		await Promise.allSettled(this.reconnecting.values());
 		for (const controller of this.openings.values()) controller.abort();
 		await Promise.all([...this.sessions.keys()].map((owner) => this.stop(owner, "close")));
+		await this.locationEnvironment?.close();
 		this.cloudPhones?.close();
 		this.sessions.clear();
 		this.lastDevices.clear();

package/dist/src/phone/stream-gateway.d.ts

@@ -2,6 +2,9 @@ import type { IncomingMessage } from 'node:http';
 import type { Socket } from 'node:net';
 import type { PhoneInteractiveSession } from './interactive-session.js';
 type Claim = {
+    deviceId?: string;
+    readOnly?: boolean;
+    inputEpoch?: number;
     origin: string;
     principal: string;
     expiresAt: number;
@@ -12,6 +15,7 @@ type Claim = {
 };
 export declare class PhoneStreamGateway {
     private principalActive;
+    private connections;
     private tickets;
     private wss;
     constructor(principalActive?: (principal: string) => boolean);
@@ -21,6 +25,7 @@ export declare class PhoneStreamGateway {
     };
     handleUpgrade(req: IncomingMessage, socket: Socket, head: Buffer): boolean;
     private connection;
+    disconnectPrincipal(principal: string): void;
     close(): void;
 }
 export {};

package/dist/src/phone/stream-gateway.js

@@ -1,6 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { PhoneError, init_contracts } from "./contracts.js";
+import { verifyDeviceConnectionProof } from "../gateway/security/device-request-proof.js";
 import { PhonePointerSchema } from "./live-provider.js";
 import { createRequire } from "node:module";
 import { createHash, randomBytes } from "node:crypto";
@@ -16,6 +17,7 @@ const releaseSchema = z.object({
 	epoch: z.number().int().positive()
 }).strict();
 var PhoneStreamGateway = class {
+	connections = /* @__PURE__ */ new Map();
 	tickets = /* @__PURE__ */ new Map();
 	wss = new WebSocketServer({
 		noServer: true,
@@ -42,10 +44,11 @@ var PhoneStreamGateway = class {
 	handleUpgrade(req, socket, head) {
 		if (new URL(req.url ?? "/", "http://gateway.local").pathname !== "/api/phone/live/v1/ws") return false;
 		const protocols = (req.headers["sec-websocket-protocol"] ?? "").split(",").map((value) => value.trim());
-		const key = hash(protocols.find((value) => /^[\w-]{43}$/.test(value)) ?? "");
+		const ticket = protocols.find((value) => /^[\w-]{43}$/.test(value)) ?? "";
+		const key = hash(ticket);
 		const claim = this.tickets.get(key);
 		this.tickets.delete(key);
-		if (!protocols.includes("xopc-phone-v1") || !claim || claim.expiresAt < Date.now() || req.headers.origin !== claim.origin || !this.principalActive(claim.principal) || this.wss.clients.size >= 16) {
+		if (!protocols.includes("xopc-phone-v1") || !claim || claim.expiresAt < Date.now() || (claim.deviceId ? !verifyDeviceConnectionProof(claim.deviceId, ticket, "/api/phone/live/v1/ws", typeof req.headers["x-xopc-proof"] === "string" ? req.headers["x-xopc-proof"] : void 0) : req.headers.origin !== claim.origin) || !this.principalActive(claim.principal) || this.wss.clients.size >= 16) {
 			socket.destroy();
 			return true;
 		}
@@ -55,6 +58,7 @@ var PhoneStreamGateway = class {
 		return true;
 	}
 	async connection(ws, claim) {
+		this.connections.set(ws, claim);
 		let stream;
 		let unsubscribe;
 		let disposed = false;
@@ -83,7 +87,13 @@ var PhoneStreamGateway = class {
 			if (ws.readyState === ws.OPEN) ws.ping();
 			if (!validating) {
 				validating = true;
-				claim.validate().catch(() => ws.close(4403, "Phone access changed")).finally(() => {
+				claim.validate().catch((error) => {
+					log.warn({
+						phase: "stream_revalidate",
+						errorCode: error instanceof PhoneError ? error.code : "PHONE_ACCESS_CHANGED"
+					}, "Phone video authorization changed");
+					ws.close(4403, "Phone access changed");
+				}).finally(() => {
 					validating = false;
 				});
 			}
@@ -91,6 +101,7 @@ var PhoneStreamGateway = class {
 		const cleanup = async () => {
 			if (disposed) return;
 			disposed = true;
+			this.connections.delete(ws);
 			clearInterval(timer);
 			unsubscribe?.();
 			await claim.disconnect().catch(() => {});
@@ -102,57 +113,76 @@ var PhoneStreamGateway = class {
 		ws.on("pong", () => {
 			lastSeen = Date.now();
 		});
+		let inputs = Promise.resolve();
+		let queuedInputs = 0;
 		ws.on("message", (bytes, binary) => {
-			try {
-				if (binary) throw new Error("Unexpected binary input");
-				const input = JSON.parse(bytes.toString());
-				if (input.type === "ping") {
+			if (disposed || ws.readyState !== ws.OPEN) return;
+			if (queuedInputs >= 32) {
+				ws.close(4408, "Input queue full");
+				return;
+			}
+			queuedInputs++;
+			inputs = inputs.then(async () => {
+				try {
+					if (disposed || ws.readyState !== ws.OPEN) return;
+					if (binary) throw new Error("Unexpected binary input");
+					const input = JSON.parse(bytes.toString());
+					if (input.type === "ping") {
+						lastSeen = Date.now();
+						send({ type: "pong" });
+						return;
+					}
+					if (!stream || disposed) throw new Error("Phone video not ready");
+					if (!this.principalActive(claim.principal)) throw new PhoneError("PHONE_ACCESS_REVOKED", "Phone authorization expired", 403);
+					await claim.validate();
+					if (disposed || ws.readyState !== ws.OPEN) return;
+					if (claim.readOnly) throw new PhoneError("PHONE_OBSERVE_ONLY", "This stream is read only", 403);
+					const epoch = input.epoch;
+					if (claim.inputEpoch !== void 0 && epoch !== claim.inputEpoch) throw new PhoneError("PHONE_CONTROL_CHANGED", "Control changed", 409);
+					const cancel = releaseSchema.safeParse(input);
+					if (cancel.success) {
+						stream.authorizeClient(claim.client, cancel.data.epoch);
+						stream.revoke().catch(() => ws.close(4411, "Touch release failed"));
+						return;
+					}
+					const pointer = PhonePointerSchema.parse(input);
+					if (Date.now() - windowAt > 1e3) {
+						windowAt = Date.now();
+						events = 0;
+					}
+					if (++events > 120) throw new Error("Input rate exceeded");
 					lastSeen = Date.now();
-					send({ type: "pong" });
-					return;
-				}
-				if (!stream || disposed) throw new Error("Phone video not ready");
-				const cancel = releaseSchema.safeParse(input);
-				if (cancel.success) {
-					stream.authorizeClient(claim.client, cancel.data.epoch);
-					stream.revoke().catch(() => ws.close(4411, "Touch release failed"));
-					return;
-				}
-				const pointer = PhonePointerSchema.parse(input);
-				if (Date.now() - windowAt > 1e3) {
-					windowAt = Date.now();
-					events = 0;
-				}
-				if (++events > 120) throw new Error("Input rate exceeded");
-				lastSeen = Date.now();
-				const startedAt = performance.now();
-				stream.input(claim.client, pointer).then(() => send({
-					type: "ack",
-					seq: pointer.seq,
-					phase: "transport-written",
-					durationMs: performance.now() - startedAt
-				}), (error) => {
-					const code = error instanceof PhoneError ? error.code : "PHONE_INPUT_FAILED";
-					log.warn({
-						phase: "input_dispatch",
-						errorCode: code
-					}, "Phone input channel closed after refused input");
+					const startedAt = performance.now();
+					await stream.input(claim.client, pointer).then(() => send({
+						type: "ack",
+						seq: pointer.seq,
+						phase: "transport-written",
+						durationMs: performance.now() - startedAt
+					}), (error) => {
+						const code = error instanceof PhoneError ? error.code : "PHONE_INPUT_FAILED";
+						log.warn({
+							phase: "input_dispatch",
+							errorCode: code
+						}, "Phone input channel closed after refused input");
+						fail(code);
+						ws.close(4409, "Input rejected");
+					});
+				} catch (error) {
+					const code = error instanceof PhoneError ? error.code : "PHONE_INVALID_INPUT";
+					log.info({
+						phase: "input_validation",
+						errorCode: code,
+						issues: error instanceof z.ZodError ? error.issues.map((issue) => ({
+							path: issue.path.join("."),
+							code: issue.code
+						})) : void 0
+					}, "Phone input refused");
 					fail(code);
-					ws.close(4409, "Input rejected");
-				});
-			} catch (error) {
-				const code = error instanceof PhoneError ? error.code : "PHONE_INVALID_INPUT";
-				log.info({
-					phase: "input_validation",
-					errorCode: code,
-					issues: error instanceof z.ZodError ? error.issues.map((issue) => ({
-						path: issue.path.join("."),
-						code: issue.code
-					})) : void 0
-				}, "Phone input refused");
-				fail(code);
-				ws.close(4400, "Invalid input");
-			}
+					ws.close(4400, "Invalid input");
+				}
+			}).finally(() => {
+				queuedInputs--;
+			});
 		});
 		try {
 			await claim.validate();
@@ -200,6 +230,10 @@ var PhoneStreamGateway = class {
 			ws.close(4411, "Phone video unavailable");
 		}
 	}
+	disconnectPrincipal(principal) {
+		for (const [key, claim] of this.tickets) if (claim.principal === principal) this.tickets.delete(key);
+		for (const [ws, claim] of this.connections) if (claim.principal === principal) ws.close(4403, "Phone authorization changed");
+	}
 	close() {
 		this.tickets.clear();
 		for (const ws of this.wss.clients) ws.terminate();