@yoooclaw/phone-notifications 1.11.12 → 1.11.14

package/dist/index.cjs

@@ -5574,7 +5574,7 @@ function readBuildInjectedVersion() {
   if (false) {
     return void 0;
   }
-  const version = "1.11.12".trim();
+  const version = "1.11.14".trim();
   return version || void 0;
 }
 function readPluginVersionFromPackageJson() {
@@ -12303,19 +12303,72 @@ var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
-// src/tunnel/relay-client.ts
-function previewText(text, max = 500) {
+// src/tunnel/utils.ts
+function previewText(text, max = 200) {
+  if (!text) return "";
   return text.length <= max ? text : `${text.substring(0, max)}\u2026`;
 }
-var HANDSHAKE_TIMEOUT_MS = 15e3;
-var CONNECT_WATCHDOG_MS = 2e4;
 function maskSecret(value) {
   if (!value) return "empty";
   if (value.length <= 8) {
-    return `${value.slice(0, 2)}\u2026${value.slice(-2)}`;
+    return `${value.slice(0, 2)}...${value.slice(-2)}`;
+  }
+  return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function redactUrlSecrets(rawUrl) {
+  try {
+    const url = new URL(rawUrl);
+    for (const key of ["apiKey", "token", "access_token"]) {
+      const value = url.searchParams.get(key);
+      if (value) {
+        url.searchParams.set(key, maskSecret(value));
+      }
+    }
+    return url.toString();
+  } catch {
+    return rawUrl.replace(
+      /([?&](?:apiKey|token|access_token)=)([^&]+)/gi,
+      (_match, prefix, value) => {
+        let decoded = value;
+        try {
+          decoded = decodeURIComponent(value);
+        } catch {
+        }
+        return `${prefix}${maskSecret(decoded)}`;
+      }
+    );
   }
-  return `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
 }
+function findHeaderValue(headers, key) {
+  if (!headers) return void 0;
+  const lowerKey = key.toLowerCase();
+  for (const [headerKey, headerValue] of Object.entries(headers)) {
+    if (headerKey.toLowerCase() === lowerKey) {
+      return headerValue;
+    }
+  }
+  return void 0;
+}
+function summarizeRequestHeaders(headers) {
+  const contentType = findHeaderValue(headers, "content-type");
+  const requestId = findHeaderValue(headers, "x-request-id");
+  const parts = [];
+  if (contentType) {
+    parts.push(`contentType=${contentType}`);
+  }
+  if (requestId) {
+    parts.push(`xRequestId=${previewText(requestId, 120)}`);
+  }
+  return parts.length ? `, ${parts.join(", ")}` : "";
+}
+
+// src/tunnel/relay-client.ts
+function previewText2(text, max = 500) {
+  return text.length <= max ? text : `${text.substring(0, max)}\u2026`;
+}
+var HANDSHAKE_TIMEOUT_MS = 15e3;
+var CONNECT_WATCHDOG_MS = 2e4;
+var SEND_SKIPPED_LOG_INTERVAL_MS = 3e4;
 var RelayClient = class {
   constructor(opts) {
     this.opts = opts;
@@ -12326,9 +12379,12 @@ var RelayClient = class {
   reconnectTimer = null;
   handlers = [];
   connectedHandlers = [];
+  disconnectedHandlers = [];
   aborted = false;
   lastInboundAt = 0;
   stopPromise = null;
+  skippedSendLogLastAt = null;
+  skippedSendLogSuppressed = 0;
   /** 写连接状态到磁盘 */
   writeStatus(state, lastDisconnectReason) {
     if (!this.opts.statusFilePath) return;
@@ -12352,6 +12408,10 @@ var RelayClient = class {
   onConnected(handler) {
     this.connectedHandlers.push(handler);
   }
+  /** 注册 Relay 连接断开后的回调 */
+  onDisconnected(handler) {
+    this.disconnectedHandlers.push(handler);
+  }
   /** 当前是否已连上 Relay */
   isConnected() {
     return this.ws?.readyState === wrapper_default.OPEN;
@@ -12425,29 +12485,43 @@ var RelayClient = class {
   }
   /** 发送出站帧 */
   send(frame) {
-    if (this.ws?.readyState === wrapper_default.OPEN) {
+    const ws = this.ws;
+    if (ws?.readyState === wrapper_default.OPEN) {
       const payload = JSON.stringify(frame);
       this.opts.logger.info(
         `Relay tunnel: \u25B6 send frame type=${frame.type}, id=${"id" in frame ? frame.id : "N/A"} (${payload.length} chars)`
       );
-      this.ws.send(payload);
+      try {
+        ws.send(payload);
+      } catch (err2) {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        this.opts.logger.warn(
+          `Relay tunnel: send failed, forcing reconnect: ${message}`
+        );
+        this.forceReconnectFromSocket(ws, `send-failed: ${message}`);
+      }
     } else {
-      this.opts.logger.warn(
-        `Relay tunnel: \u25B6 send skipped, ws not open (readyState=${this.ws?.readyState ?? "null"}), frame type=${frame.type}`
-      );
+      this.logSendSkipped("send", `frame type=${frame.type}`);
     }
   }
   /** 原样透传文本到 Relay（用于 Gateway WS 响应直接回传） */
   sendRaw(text) {
-    if (this.ws?.readyState === wrapper_default.OPEN) {
+    const ws = this.ws;
+    if (ws?.readyState === wrapper_default.OPEN) {
       this.opts.logger.info(
         `Relay tunnel: \u25B6 sendRaw (${text.length} chars): ${text.length <= 500 ? text : text.substring(0, 500) + "\u2026"}`
       );
-      this.ws.send(text);
+      try {
+        ws.send(text);
+      } catch (err2) {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        this.opts.logger.warn(
+          `Relay tunnel: sendRaw failed, forcing reconnect: ${message}`
+        );
+        this.forceReconnectFromSocket(ws, `sendRaw-failed: ${message}`);
+      }
     } else {
-      this.opts.logger.warn(
-        `Relay tunnel: \u25B6 sendRaw skipped, ws not open (readyState=${this.ws?.readyState ?? "null"})`
-      );
+      this.logSendSkipped("sendRaw");
     }
   }
   /** 启动连接，带自动重连，直到 abortSignal 触发 */
@@ -12473,7 +12547,7 @@ var RelayClient = class {
     this.cleanup(true);
     const rawApiKey = this.opts.apiKey.startsWith("Bearer ") ? this.opts.apiKey.slice("Bearer ".length) : this.opts.apiKey;
     this.opts.logger.info(
-      `Relay tunnel: connecting to ${this.opts.tunnelUrl} (attempt=${this.reconnectAttempt}, heartbeat=${this.opts.heartbeatSec}s, apiKey=${maskSecret(rawApiKey)})`
+      `Relay tunnel: connecting to ${redactUrlSecrets(this.opts.tunnelUrl)} (attempt=${this.reconnectAttempt}, heartbeat=${this.opts.heartbeatSec}s, apiKey=${maskSecret(rawApiKey)})`
     );
     this.writeStatus("connecting");
     return new Promise((resolve) => {
@@ -12496,33 +12570,20 @@ var RelayClient = class {
         handshakeTimeout: HANDSHAKE_TIMEOUT_MS
       });
       this.ws = ws;
-      let connectWatchdog = setTimeout(() => {
-        connectWatchdog = null;
-        if (this.ws !== ws || ws.readyState === wrapper_default.OPEN) {
-          return;
-        }
-        this.opts.logger.warn(
-          `Relay tunnel: connect watchdog fired (readyState=${ws.readyState}, attempt=${this.reconnectAttempt}), forcing terminate`
-        );
-        try {
-          ws.terminate();
-        } catch {
-        }
-        if (this.ws === ws) {
-          setTimeout(() => {
-            if (this.ws === ws) {
-              this.opts.logger.warn(
-                "Relay tunnel: terminate did not emit close, forcing reconnect"
-              );
-              this.stopHeartbeat();
-              this.ws = null;
-              this.writeStatus("disconnected", "watchdog-force");
-              this.scheduleReconnect();
-              settle();
-            }
-          }, 1e3);
-        }
-      }, CONNECT_WATCHDOG_MS);
+      let connectWatchdog = setTimeout(
+        () => {
+          connectWatchdog = null;
+          if (this.ws !== ws || ws.readyState === wrapper_default.OPEN) {
+            return;
+          }
+          this.opts.logger.warn(
+            `Relay tunnel: connect watchdog fired (readyState=${ws.readyState}, attempt=${this.reconnectAttempt}), forcing reconnect`
+          );
+          this.forceReconnectFromSocket(ws, "connect-watchdog-timeout");
+          settle();
+        },
+        CONNECT_WATCHDOG_MS
+      );
       const clearConnectWatchdog = () => {
         if (connectWatchdog) {
           clearTimeout(connectWatchdog);
@@ -12567,7 +12628,7 @@ var RelayClient = class {
         const reasonStr = reason.toString();
         const lastInboundAgoMs = this.lastInboundAt ? Date.now() - this.lastInboundAt : null;
         const isCurrentSocket = this.ws === ws;
-        const logMessage = `Relay tunnel: disconnected (code=${code}, reason=${previewText(reasonStr, 200)}, lastInboundAgoMs=${lastInboundAgoMs ?? "N/A"}, reconnectAttempt=${this.reconnectAttempt})`;
+        const logMessage = `Relay tunnel: disconnected (code=${code}, reason=${previewText2(reasonStr, 200)}, lastInboundAgoMs=${lastInboundAgoMs ?? "N/A"}, reconnectAttempt=${this.reconnectAttempt})`;
         if (this.aborted || !isCurrentSocket) {
           this.opts.logger.info(logMessage);
         } else {
@@ -12576,17 +12637,20 @@ var RelayClient = class {
         if (isCurrentSocket) {
           this.stopHeartbeat();
           this.ws = null;
-          this.writeStatus("disconnected", `code=${code}, reason=${reasonStr}`);
+          const disconnectReason = `code=${code}, reason=${reasonStr}`;
+          this.writeStatus("disconnected", disconnectReason);
+          this.emitDisconnected(disconnectReason);
           this.scheduleReconnect();
         }
         settle();
       });
       ws.on("error", (err2) => {
+        clearConnectWatchdog();
         this.opts.logger.error(
-          `Relay tunnel: WebSocket error: ${err2.message} (readyState=${ws.readyState}, reconnectAttempt=${this.reconnectAttempt}, url=${wsUrl.toString()})`
+          `Relay tunnel: WebSocket error: ${err2.message} (readyState=${ws.readyState}, reconnectAttempt=${this.reconnectAttempt}, url=${redactUrlSecrets(wsUrl.toString())})`
         );
         if (this.ws === ws) {
-          this.scheduleReconnect();
+          this.forceReconnectFromSocket(ws, `error: ${err2.message}`);
         }
         settle();
       });
@@ -12601,6 +12665,15 @@ var RelayClient = class {
       });
     }
   }
+  emitDisconnected(reason) {
+    for (const handler of this.disconnectedHandlers) {
+      Promise.resolve(handler(reason)).catch((err2) => {
+        this.opts.logger.warn(
+          `Relay tunnel: onDisconnected handler failed: ${err2 instanceof Error ? err2.message : String(err2)}`
+        );
+      });
+    }
+  }
   handleMessage(data) {
     const text = typeof data === "string" ? data : Buffer.isBuffer(data) ? data.toString() : String(data);
     this.markInboundActivity();
@@ -12608,14 +12681,14 @@ var RelayClient = class {
       return;
     }
     this.opts.logger.info(
-      `Relay tunnel: \u2605 received message (${text.length} chars): ${previewText(text)}`
+      `Relay tunnel: \u2605 received message (${text.length} chars): ${previewText2(text)}`
     );
     let frame;
     try {
       frame = JSON.parse(text);
     } catch {
       this.opts.logger.warn(
-        `Relay tunnel: received invalid frame, ignoring (preview=${previewText(text, 200)})`
+        `Relay tunnel: received invalid frame, ignoring (preview=${previewText2(text, 200)})`
       );
       return;
     }
@@ -12651,7 +12724,8 @@ var RelayClient = class {
     return this.opts.heartbeatSec * 3 * 1e3;
   }
   sendHeartbeat() {
-    if (this.ws?.readyState !== wrapper_default.OPEN) {
+    const ws = this.ws;
+    if (ws?.readyState !== wrapper_default.OPEN) {
       return;
     }
     const idleMs = Date.now() - this.lastInboundAt;
@@ -12660,20 +12734,28 @@ var RelayClient = class {
       this.opts.logger.warn(
         `Relay tunnel: heartbeat timeout, no inbound activity for ${idleMs}ms (threshold=${timeoutMs}ms)`
       );
-      try {
-        this.ws.terminate();
-      } catch {
-      }
+      this.forceReconnectFromSocket(ws, `heartbeat-timeout idleMs=${idleMs}`);
       return;
     }
     this.opts.logger.info('Relay tunnel: \u2192 heartbeat "ping"');
     try {
-      this.ws.send("ping");
-    } catch {
+      ws.send("ping");
+    } catch (err2) {
+      const message = err2 instanceof Error ? err2.message : String(err2);
+      this.opts.logger.warn(
+        `Relay tunnel: heartbeat text ping failed, forcing reconnect: ${message}`
+      );
+      this.forceReconnectFromSocket(ws, `heartbeat-send-failed: ${message}`);
+      return;
     }
     try {
-      this.ws.ping();
-    } catch {
+      ws.ping();
+    } catch (err2) {
+      const message = err2 instanceof Error ? err2.message : String(err2);
+      this.opts.logger.warn(
+        `Relay tunnel: heartbeat control ping failed, forcing reconnect: ${message}`
+      );
+      this.forceReconnectFromSocket(ws, `heartbeat-ping-failed: ${message}`);
     }
   }
   markInboundActivity() {
@@ -12700,6 +12782,35 @@ var RelayClient = class {
       this.ws = null;
     }
   }
+  forceReconnectFromSocket(ws, reason) {
+    if (this.aborted || this.ws !== ws) return;
+    this.stopHeartbeat();
+    this.ws = null;
+    this.writeStatus("disconnected", reason);
+    this.emitDisconnected(reason);
+    this.scheduleReconnect();
+    try {
+      if (ws.readyState !== wrapper_default.CLOSED) {
+        ws.terminate();
+      }
+    } catch {
+    }
+  }
+  logSendSkipped(kind, detail) {
+    const now = Date.now();
+    const shouldLog = this.skippedSendLogLastAt === null || now - this.skippedSendLogLastAt >= SEND_SKIPPED_LOG_INTERVAL_MS;
+    if (!shouldLog) {
+      this.skippedSendLogSuppressed++;
+      return;
+    }
+    const suppressedSuffix = this.skippedSendLogSuppressed > 0 ? `, suppressed=${this.skippedSendLogSuppressed}` : "";
+    const detailSuffix = detail ? `, ${detail}` : "";
+    this.opts.logger.warn(
+      `Relay tunnel: \u25B6 ${kind} skipped, ws not open (readyState=${this.ws?.readyState ?? "null"}${detailSuffix}${suppressedSuffix})`
+    );
+    this.skippedSendLogLastAt = now;
+    this.skippedSendLogSuppressed = 0;
+  }
   scheduleReconnect() {
     if (this.aborted) return;
     if (this.reconnectTimer) {
@@ -12727,36 +12838,6 @@ var RelayClient = class {
 
 // src/tunnel/proxy.ts
 var import_node_crypto5 = require("crypto");
-
-// src/tunnel/utils.ts
-function previewText2(text, max = 200) {
-  if (!text) return "";
-  return text.length <= max ? text : `${text.substring(0, max)}\u2026`;
-}
-function findHeaderValue(headers, key) {
-  if (!headers) return void 0;
-  const lowerKey = key.toLowerCase();
-  for (const [headerKey, headerValue] of Object.entries(headers)) {
-    if (headerKey.toLowerCase() === lowerKey) {
-      return headerValue;
-    }
-  }
-  return void 0;
-}
-function summarizeRequestHeaders(headers) {
-  const contentType = findHeaderValue(headers, "content-type");
-  const requestId = findHeaderValue(headers, "x-request-id");
-  const parts = [];
-  if (contentType) {
-    parts.push(`contentType=${contentType}`);
-  }
-  if (requestId) {
-    parts.push(`xRequestId=${previewText2(requestId, 120)}`);
-  }
-  return parts.length ? `, ${parts.join(", ")}` : "";
-}
-
-// src/tunnel/proxy.ts
 init_host();
 
 // src/tunnel/device-identity.ts
@@ -12995,7 +13076,7 @@ async function handleHttpRequest(opts, frame) {
   localHeaders[RELAY_INTERNAL_HTTP_HEADER] = "1";
   const authAttempts = buildLocalGatewayAuthAttempts(opts, localHeaders);
   opts.logger.info(
-    `TunnelProxy: HTTP id=${frame.id} ${frame.method} ${frame.path} \u2192 ${url.toString()}${summarizeRequestHeaders(frame.headers)}, authAttempts=${authAttempts.map((a) => a.label).join(" -> ")}, body=${previewText2(frame.body)}`
+    `TunnelProxy: HTTP id=${frame.id} ${frame.method} ${frame.path} \u2192 ${url.toString()}${summarizeRequestHeaders(frame.headers)}, authAttempts=${authAttempts.map((a) => a.label).join(" -> ")}, body=${previewText(frame.body)}`
   );
   try {
     for (let attemptIndex = 0; attemptIndex < authAttempts.length; attemptIndex++) {
@@ -13006,13 +13087,14 @@ async function handleHttpRequest(opts, frame) {
       const res = await fetch(url.toString(), {
         method: frame.method,
         headers: attempt.headers,
+        signal: opts.abortSignal,
         body: frame.method !== "GET" && frame.method !== "HEAD" ? frame.body : void 0
       });
       const hasFallback = attemptIndex < authAttempts.length - 1;
       if (res.status === 401 && hasFallback) {
         const body = await res.text();
         opts.logger.warn(
-          `TunnelProxy: HTTP id=${frame.id} local gateway auth via ${attempt.label} returned 401 after ${Date.now() - startedAtMs}ms, retrying next credential${body ? `, body=${previewText2(body)}` : ""}`
+          `TunnelProxy: HTTP id=${frame.id} local gateway auth via ${attempt.label} returned 401 after ${Date.now() - startedAtMs}ms, retrying next credential${body ? `, body=${previewText(body)}` : ""}`
         );
         continue;
       }
@@ -13053,7 +13135,7 @@ async function sendHttpResponse(opts, params) {
   }
   const body = await res.text();
   opts.logger.info(
-    `TunnelProxy: HTTP id=${frameId} response body=${previewText2(body)}`
+    `TunnelProxy: HTTP id=${frameId} response body=${previewText(body)}`
   );
   const headers = {};
   res.headers.forEach((value, key) => {
@@ -13074,6 +13156,9 @@ async function streamResponse(opts, requestId, res, startedAtMs) {
   opts.logger.info(`TunnelProxy: stream start id=${requestId}`);
   try {
     while (true) {
+      if (opts.abortSignal?.aborted) {
+        throw new DOMException("relay tunnel disconnected", "AbortError");
+      }
       const { done, value } = await reader.read();
       if (done) break;
       chunkCount++;
@@ -13111,6 +13196,7 @@ async function streamResponse(opts, requestId, res, startedAtMs) {
 }
 
 // src/tunnel/ws-proxy.ts
+var GATEWAY_WS_HANDSHAKE_TIMEOUT_MS = 1e4;
 var WsProxy = class {
   constructor(opts) {
     this.opts = opts;
@@ -13121,14 +13207,15 @@ var WsProxy = class {
     return this.connections.size;
   }
   cleanup() {
-    for (const [id, ws] of this.connections) {
+    const connections = [...this.connections.entries()];
+    this.connections.clear();
+    for (const [id, ws] of connections) {
       this.opts.logger.info(`WsProxy: closing WS id=${id}`);
       try {
         ws.close();
       } catch {
       }
     }
-    this.connections.clear();
   }
   handleWsOpen(frame) {
     const wsUrl = this.opts.gatewayBaseUrl.replace(/^http/, "ws") + mapPath(frame.path);
@@ -13136,11 +13223,72 @@ var WsProxy = class {
       `TunnelProxy: WS open id=${frame.id}, path=${frame.path} \u2192 ${wsUrl}`
     );
     try {
+      const existing = this.connections.get(frame.id);
+      if (existing) {
+        this.opts.logger.warn(
+          `TunnelProxy: WS id=${frame.id} already exists, closing previous gateway connection`
+        );
+        try {
+          existing.close(1e3, "replaced by new relay ws_open");
+        } catch {
+        }
+      }
       const ws = new wrapper_default(wsUrl, {
-        headers: frame.headers
+        headers: frame.headers,
+        handshakeTimeout: GATEWAY_WS_HANDSHAKE_TIMEOUT_MS
       });
+      this.connections.set(frame.id, ws);
+      let notifiedClosed = false;
+      let connectTimer = setTimeout(
+        () => {
+          connectTimer = null;
+          if (this.connections.get(frame.id) !== ws || ws.readyState === wrapper_default.OPEN) {
+            return;
+          }
+          this.opts.logger.warn(
+            `TunnelProxy: WS id=${frame.id} connect timed out after ${GATEWAY_WS_HANDSHAKE_TIMEOUT_MS}ms`
+          );
+          notifyClosed(1011, "gateway websocket connect timeout");
+          try {
+            if (typeof ws.terminate === "function") {
+              ws.terminate();
+            } else {
+              ws.close();
+            }
+          } catch {
+          }
+        },
+        GATEWAY_WS_HANDSHAKE_TIMEOUT_MS
+      );
+      const clearConnectTimer = () => {
+        if (connectTimer) {
+          clearTimeout(connectTimer);
+          connectTimer = null;
+        }
+      };
+      const notifyClosed = (code, reason) => {
+        if (notifiedClosed) return;
+        notifiedClosed = true;
+        clearConnectTimer();
+        if (this.connections.get(frame.id) === ws) {
+          this.connections.delete(frame.id);
+        }
+        this.opts.client.send({
+          type: "ws_close",
+          id: frame.id,
+          code,
+          reason
+        });
+      };
       ws.on("open", () => {
-        this.connections.set(frame.id, ws);
+        clearConnectTimer();
+        if (this.connections.get(frame.id) !== ws) {
+          try {
+            ws.close(1e3, "stale relay ws_open");
+          } catch {
+          }
+          return;
+        }
         this.opts.logger.info(
           `TunnelProxy: WS id=${frame.id} connected to gateway, active=${this.connections.size}`
         );
@@ -13150,6 +13298,9 @@ var WsProxy = class {
         });
       });
       ws.on("message", (data) => {
+        if (this.connections.get(frame.id) !== ws) {
+          return;
+        }
         const text = typeof data === "string" ? data : Buffer.isBuffer(data) ? data.toString() : String(data);
         this.opts.logger.info(
           `TunnelProxy: WS id=${frame.id} \u2190 gateway data (${text.length} chars): ${text.substring(0, 200)}`
@@ -13161,28 +13312,33 @@ var WsProxy = class {
         });
       });
       ws.on("close", (code, reason) => {
-        this.connections.delete(frame.id);
+        clearConnectTimer();
+        const reasonText = reason.toString();
+        const isCurrent = this.connections.get(frame.id) === ws;
+        if (isCurrent) {
+          this.connections.delete(frame.id);
+        }
         this.opts.logger.info(
-          `TunnelProxy: WS id=${frame.id} closed by gateway (code=${code}, reason=${reason.toString()}), active=${this.connections.size}`
+          `TunnelProxy: WS id=${frame.id} closed by gateway (code=${code}, reason=${reasonText}), active=${this.connections.size}`
         );
-        this.opts.client.send({
-          type: "ws_close",
-          id: frame.id,
-          code,
-          reason: reason.toString()
-        });
+        if (isCurrent) {
+          notifyClosed(code, reasonText);
+        }
       });
       ws.on("error", (err2) => {
+        clearConnectTimer();
         this.opts.logger.warn(
           `TunnelProxy: WS id=${frame.id} error: ${err2.message}, active=${this.connections.size}`
         );
-        this.connections.delete(frame.id);
-        this.opts.client.send({
-          type: "ws_close",
-          id: frame.id,
-          code: 1011,
-          reason: err2.message
-        });
+        if (this.connections.get(frame.id) === ws) {
+          notifyClosed(1011, err2.message);
+        }
+        try {
+          if (typeof ws.terminate === "function") {
+            ws.terminate();
+          }
+        } catch {
+        }
       });
     } catch (err2) {
       this.opts.logger.error(
@@ -13232,6 +13388,8 @@ var WsProxy = class {
 var RELAY_TUNNEL_GATEWAY_CLIENT_INSTANCE_ID = "phone-notifications-relay-tunnel";
 var MAX_AUTO_PAIRING_APPROVALS = 3;
 var RECENT_ABORTED_CHAT_RUN_TTL_MS = 6e4;
+var GATEWAY_RPC_HANDSHAKE_TIMEOUT_MS = 1e4;
+var MAX_GATEWAY_WS_PENDING = 200;
 var approveDevicePairingPromise = null;
 var approveDevicePairingWarned = false;
 function formatErrorMessage(err2) {
@@ -13283,6 +13441,8 @@ var TunnelProxy = class {
   gatewayWsReady = false;
   /** 收到本地自动配对成功后，在 close 回调里触发重连 */
   gatewayWsReconnectRequested = false;
+  /** 本地自动配对审批进行中，期间 Gateway 关闭连接时先保留 pending 请求。 */
+  gatewayWsPairingApprovalPending = false;
   /** 防止配对失败时无限重连 */
   gatewayWsAutoPairingApprovals = 0;
   /** 等待 Gateway WS 握手完成后发送的帧队列 */
@@ -13291,6 +13451,8 @@ var TunnelProxy = class {
   gatewayReqMetaById = /* @__PURE__ */ new Map();
   /** 最近由用户手动中断的 chat.run，用于过滤 runtime 误补发的 synthetic failure。 */
   recentAbortedChatRuns = /* @__PURE__ */ new Map();
+  /** Relay 断开或服务停止时要中断的 HTTP 代理请求。 */
+  httpAbortControllers = /* @__PURE__ */ new Map();
   /** 设备身份，用于 Gateway connect 握手 */
   deviceIdentity;
   stateDir;
@@ -13304,7 +13466,7 @@ var TunnelProxy = class {
     );
     switch (frame.type) {
       case "request":
-        await handleHttpRequest(this.opts, frame);
+        await this.handleRequestFrame(frame);
         break;
       case "req":
         this.handleReqFrame(frame);
@@ -13332,35 +13494,73 @@ var TunnelProxy = class {
       `TunnelProxy: cleanup, closing ${this.wsProxy.activeCount} active WS connections, gatewayWs=${!!this.gatewayWs}`
     );
     this.wsProxy.cleanup();
-    if (this.gatewayWs) {
-      try {
-        this.gatewayWs.close();
-      } catch {
-      }
-      this.gatewayWs = null;
+    for (const [id, controller] of this.httpAbortControllers) {
+      this.opts.logger.info(`TunnelProxy: aborting HTTP proxy id=${id}`);
+      controller.abort();
     }
+    this.httpAbortControllers.clear();
+    const gatewayWs = this.gatewayWs;
+    this.gatewayWs = null;
     this.gatewayWsReady = false;
     this.gatewayWsConnecting = false;
     this.gatewayWsReconnectRequested = false;
+    this.gatewayWsPairingApprovalPending = false;
     this.gatewayWsAutoPairingApprovals = 0;
     this.gatewayWsPending = [];
     this.gatewayReqMetaById.clear();
     this.recentAbortedChatRuns.clear();
+    if (gatewayWs) {
+      try {
+        gatewayWs.close();
+      } catch {
+      }
+    }
   }
   // ─── Gateway RPC WebSocket ───
-  pushGatewayPending(payload, reason) {
-    this.gatewayWsPending.push(payload);
+  async handleRequestFrame(frame) {
+    const controller = new AbortController();
+    this.httpAbortControllers.set(frame.id, controller);
+    try {
+      await handleHttpRequest(
+        {
+          ...this.opts,
+          abortSignal: controller.signal
+        },
+        frame
+      );
+    } finally {
+      this.httpAbortControllers.delete(frame.id);
+    }
+  }
+  pushGatewayPending(entry, reason) {
+    if (this.gatewayWsPending.length >= MAX_GATEWAY_WS_PENDING) {
+      this.opts.logger.error(
+        `TunnelProxy: gateway WS pending queue overflow (${this.gatewayWsPending.length}/${MAX_GATEWAY_WS_PENDING}); failing ${entry.reqId ? `req id=${entry.reqId}` : "raw frame"}`
+      );
+      this.failGatewayPendingEntry(
+        entry,
+        "GATEWAY_RPC_QUEUE_FULL",
+        "local gateway RPC queue is full"
+      );
+      return false;
+    }
+    this.gatewayWsPending.push(entry);
     this.opts.logger.info(
       `TunnelProxy: gateway WS pending queue size=${this.gatewayWsPending.length} (${reason})`
     );
+    return true;
   }
   /** 将未知帧原样转发到 Gateway WS */
   forwardRawToGateway(payload) {
-    this.ensureGatewayWs();
     if (this.gatewayWsReady && this.gatewayWs?.readyState === wrapper_default.OPEN) {
-      this.gatewayWs.send(payload);
+      this.sendGatewayPayload(this.gatewayWs, { payload }, "raw frame");
     } else {
-      this.pushGatewayPending(payload, "raw frame queued before gateway WS ready");
+      if (this.pushGatewayPending(
+        { payload },
+        "raw frame queued before gateway WS ready"
+      )) {
+        this.ensureGatewayWs();
+      }
     }
   }
   /** 处理 Relay 转发的 Gateway RPC 请求帧，原样通过 WebSocket 发给本地 Gateway */
@@ -13373,17 +13573,99 @@ var TunnelProxy = class {
     this.opts.logger.info(
       `TunnelProxy: req id=${frame.id} method=${frame.method} \u2192 gateway WS (${payload.length} chars)`
     );
-    this.ensureGatewayWs();
     if (this.gatewayWsReady && this.gatewayWs?.readyState === wrapper_default.OPEN) {
-      this.gatewayWs.send(payload);
+      this.sendGatewayPayload(
+        this.gatewayWs,
+        { payload, reqId: frame.id },
+        `req id=${frame.id}`
+      );
     } else {
       this.opts.logger.info(
         `TunnelProxy: req id=${frame.id} queued, gateway WS not ready yet`
       );
-      this.pushGatewayPending(
-        payload,
+      if (this.pushGatewayPending(
+        { payload, reqId: frame.id },
         `req id=${frame.id} queued before gateway WS handshake`
+      )) {
+        this.ensureGatewayWs();
+      }
+    }
+  }
+  sendGatewayRpcError(id, code, message) {
+    this.gatewayReqMetaById.delete(id);
+    this.opts.client.sendRaw(
+      JSON.stringify({
+        type: "res",
+        id,
+        ok: false,
+        error: {
+          code,
+          message
+        }
+      })
+    );
+  }
+  failGatewayPendingEntry(entry, code, message) {
+    if (!entry.reqId) return;
+    this.sendGatewayRpcError(entry.reqId, code, message);
+  }
+  failGatewayPending(code, message) {
+    if (this.gatewayWsPending.length === 0) return;
+    const pending = this.gatewayWsPending;
+    this.gatewayWsPending = [];
+    this.opts.logger.warn(
+      `TunnelProxy: failing ${pending.length} pending gateway RPC frame(s): ${message}`
+    );
+    for (const entry of pending) {
+      this.failGatewayPendingEntry(entry, code, message);
+    }
+  }
+  failGatewayInflight(code, message) {
+    if (this.gatewayReqMetaById.size === 0) return;
+    const ids = [...this.gatewayReqMetaById.keys()];
+    this.opts.logger.warn(
+      `TunnelProxy: failing ${ids.length} in-flight gateway RPC request(s): ${message}`
+    );
+    for (const id of ids) {
+      this.sendGatewayRpcError(id, code, message);
+    }
+  }
+  failAllGatewayRequests(code, message) {
+    this.failGatewayPending(code, message);
+    this.failGatewayInflight(code, message);
+  }
+  sendGatewayPayload(ws, entry, context) {
+    try {
+      ws.send(entry.payload);
+      return true;
+    } catch (err2) {
+      const message = formatErrorMessage(err2);
+      this.opts.logger.warn(
+        `TunnelProxy: RPC WS send failed for ${context}: ${message}`
       );
+      this.failGatewayPendingEntry(
+        entry,
+        "GATEWAY_RPC_SEND_FAILED",
+        `local gateway RPC send failed: ${message}`
+      );
+      this.failGatewayInflight(
+        "GATEWAY_RPC_SEND_FAILED",
+        "local gateway RPC connection closed after send failure"
+      );
+      if (this.gatewayWs === ws) {
+        this.gatewayWs = null;
+        this.gatewayWsReady = false;
+        this.gatewayWsConnecting = false;
+      }
+      try {
+        if (typeof ws.terminate === "function") {
+          ws.terminate();
+        } else {
+          ws.close();
+        }
+      } catch {
+      }
+      return false;
     }
   }
   // ─── Gateway connect auth helpers ───
@@ -13463,13 +13745,16 @@ var TunnelProxy = class {
       );
       return false;
     }
+    this.gatewayWsPairingApprovalPending = true;
     try {
       const approveDevicePairing = await loadApproveDevicePairing(this.opts.logger);
       if (!approveDevicePairing) {
+        this.gatewayWsPairingApprovalPending = false;
         return false;
       }
       const approved = await approveDevicePairing(requestId, this.hostStateDir);
       if (!approved) {
+        this.gatewayWsPairingApprovalPending = false;
         this.opts.logger.warn(
           `TunnelProxy: gateway pairing request ${requestId} not found in host state ${this.hostStateDir}`
         );
@@ -13477,11 +13762,13 @@ var TunnelProxy = class {
       }
       this.gatewayWsAutoPairingApprovals += 1;
       this.gatewayWsReconnectRequested = true;
+      this.gatewayWsPairingApprovalPending = false;
       this.opts.logger.info(
         `TunnelProxy: auto-approved local gateway pairing request ${requestId} (reason=${reason || "not-paired"}, hostStateDir=${this.hostStateDir}, approval=${this.gatewayWsAutoPairingApprovals}/${MAX_AUTO_PAIRING_APPROVALS})`
       );
       return true;
     } catch (err2) {
+      this.gatewayWsPairingApprovalPending = false;
       this.opts.logger.warn(
         `TunnelProxy: failed to auto-approve gateway pairing request ${requestId}: ${err2?.message ?? String(err2)}`
       );
@@ -13610,9 +13897,56 @@ var TunnelProxy = class {
     this.opts.logger.info(
       `TunnelProxy: RPC WS connecting to gateway ${wsUrl} (pending=${this.gatewayWsPending.length})`
     );
-    const ws = new wrapper_default(wsUrl);
+    let ws;
+    try {
+      ws = new wrapper_default(wsUrl, {
+        handshakeTimeout: GATEWAY_RPC_HANDSHAKE_TIMEOUT_MS
+      });
+    } catch (err2) {
+      const message = formatErrorMessage(err2);
+      this.gatewayWsConnecting = false;
+      this.opts.logger.error(
+        `TunnelProxy: RPC WS failed to create gateway connection: ${message}`
+      );
+      this.failAllGatewayRequests(
+        "GATEWAY_RPC_CONNECT_FAILED",
+        `local gateway RPC connect failed: ${message}`
+      );
+      return;
+    }
+    this.gatewayWs = ws;
+    let handshakeTimer = setTimeout(
+      () => {
+        handshakeTimer = null;
+        if (this.gatewayWs !== ws || this.gatewayWsReady) return;
+        this.opts.logger.warn(
+          `TunnelProxy: RPC WS handshake timed out after ${GATEWAY_RPC_HANDSHAKE_TIMEOUT_MS}ms (pending=${this.gatewayWsPending.length})`
+        );
+        this.gatewayWs = null;
+        this.gatewayWsReady = false;
+        this.gatewayWsConnecting = false;
+        this.failAllGatewayRequests(
+          "GATEWAY_RPC_HANDSHAKE_TIMEOUT",
+          "local gateway RPC handshake timed out"
+        );
+        try {
+          if (typeof ws.terminate === "function") {
+            ws.terminate();
+          } else {
+            ws.close();
+          }
+        } catch {
+        }
+      },
+      GATEWAY_RPC_HANDSHAKE_TIMEOUT_MS
+    );
+    const clearHandshakeTimer = () => {
+      if (handshakeTimer) {
+        clearTimeout(handshakeTimer);
+        handshakeTimer = null;
+      }
+    };
     ws.on("open", () => {
-      this.gatewayWs = ws;
       this.opts.logger.info(
         `TunnelProxy: RPC WS tcp connected, waiting for connect.challenge (pending=${this.gatewayWsPending.length})`
       );
@@ -13644,6 +13978,7 @@ var TunnelProxy = class {
         return;
       }
       if (frame.type === "res" && frame.ok === true && frame.payload?.type === "hello-ok") {
+        clearHandshakeTimer();
         this.storeIssuedDeviceToken({
           fallbackRole: "operator",
           fallbackScopes: ["operator.admin"],
@@ -13656,10 +13991,14 @@ var TunnelProxy = class {
         this.opts.logger.info(
           `TunnelProxy: RPC WS handshake done (hello-ok), flushing ${this.gatewayWsPending.length} pending frames`
         );
-        for (const pending of this.gatewayWsPending) {
-          ws.send(pending);
-        }
+        const pending = this.gatewayWsPending;
         this.gatewayWsPending = [];
+        for (let i = 0; i < pending.length; i++) {
+          const entry = pending[i];
+          if (!this.sendGatewayPayload(ws, entry, entry.reqId ?? "pending frame")) {
+            return;
+          }
+        }
         return;
       }
       if (frame.type === "res" && frame.ok === false && !this.gatewayWsReady) {
@@ -13678,7 +14017,12 @@ var TunnelProxy = class {
           return;
         }
         this.opts.logger.error(
-          `TunnelProxy: RPC WS handshake failed (pending=${this.gatewayWsPending.length}): ${previewText2(JSON.stringify(frame.error), 500)}`
+          `TunnelProxy: RPC WS handshake failed (pending=${this.gatewayWsPending.length}): ${previewText(JSON.stringify(frame.error), 500)}`
+        );
+        clearHandshakeTimer();
+        this.failAllGatewayRequests(
+          "GATEWAY_RPC_HANDSHAKE_FAILED",
+          `local gateway RPC handshake failed: ${previewText(JSON.stringify(frame.error), 500)}`
         );
         ws.close();
         return;
@@ -13689,10 +14033,12 @@ var TunnelProxy = class {
       }
     });
     ws.on("close", (code, reason) => {
+      clearHandshakeTimer();
       const wasReady = this.gatewayWsReady;
       const pendingCount = this.gatewayWsPending.length;
       const reasonText = reason.toString();
       const shouldReconnect = this.gatewayWsReconnectRequested && pendingCount > 0;
+      const shouldHoldForPairing = this.gatewayWsPairingApprovalPending && pendingCount > 0;
       this.opts.logger.info(
         `TunnelProxy: RPC WS closed by gateway (code=${code}, reason=${reasonText}, ready=${wasReady}, pending=${pendingCount}, activeWs=${this.wsProxy.activeCount})`
       );
@@ -13708,17 +14054,36 @@ var TunnelProxy = class {
           `TunnelProxy: retrying RPC WS after local pairing approval (pending=${this.gatewayWsPending.length})`
         );
         queueMicrotask(() => this.ensureGatewayWs());
+      } else if (!shouldHoldForPairing && (pendingCount > 0 || this.gatewayReqMetaById.size > 0)) {
+        this.failAllGatewayRequests(
+          "GATEWAY_RPC_DISCONNECTED",
+          `local gateway RPC disconnected: code=${code}, reason=${reasonText}`
+        );
       }
     });
     ws.on("error", (err2) => {
+      clearHandshakeTimer();
       this.opts.logger.warn(
         `TunnelProxy: RPC WS error: ${err2.message} (ready=${this.gatewayWsReady}, pending=${this.gatewayWsPending.length}, activeWs=${this.wsProxy.activeCount})`
       );
+      const shouldFailRequests = this.gatewayWs === ws && (this.gatewayWsPending.length > 0 || this.gatewayReqMetaById.size > 0);
       this.gatewayWsConnecting = false;
       if (this.gatewayWs === ws) {
         this.gatewayWs = null;
         this.gatewayWsReady = false;
       }
+      if (shouldFailRequests) {
+        this.failAllGatewayRequests(
+          "GATEWAY_RPC_ERROR",
+          `local gateway RPC error: ${err2.message}`
+        );
+      }
+      try {
+        if (typeof ws.terminate === "function") {
+          ws.terminate();
+        }
+      } catch {
+      }
     });
   }
   handleConnectChallenge(ws, frame) {
@@ -13854,7 +14219,7 @@ function createTunnelService(opts) {
           JSON.stringify({
             pid: process.pid,
             startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            tunnelUrl: opts.tunnelUrl
+            tunnelUrl: redactUrlSecrets(opts.tunnelUrl)
           }) + "\n"
         );
         lockFilePath = filePath;
@@ -13920,7 +14285,7 @@ function createTunnelService(opts) {
       const { logger } = opts;
       const baseStateDir = (0, import_node_path24.join)(ctx.stateDir, "plugins", "phone-notifications");
       logger.info(
-        `Relay tunnel: starting (pid=${process.pid}, url=${opts.tunnelUrl}, heartbeat=${opts.heartbeatSec ?? DEFAULT_HEARTBEAT_SEC}s, backoff=${opts.reconnectBackoffMs ?? DEFAULT_RECONNECT_BACKOFF_MS}ms, gateway=${opts.gatewayBaseUrl}, hasGatewayToken=${!!opts.gatewayToken}, hasGatewayPwd=${!!opts.gatewayPassword})`
+        `Relay tunnel: starting (pid=${process.pid}, url=${redactUrlSecrets(opts.tunnelUrl)}, heartbeat=${opts.heartbeatSec ?? DEFAULT_HEARTBEAT_SEC}s, backoff=${opts.reconnectBackoffMs ?? DEFAULT_RECONNECT_BACKOFF_MS}ms, gateway=${opts.gatewayBaseUrl}, hasGatewayToken=${!!opts.gatewayToken}, hasGatewayPwd=${!!opts.gatewayPassword})`
       );
       const statusFilePath = (0, import_node_path24.join)(baseStateDir, "tunnel-status.json");
       const lockPath = (0, import_node_path24.join)(baseStateDir, "relay-tunnel.lock");
@@ -13950,6 +14315,12 @@ function createTunnelService(opts) {
         client.onConnected(() => {
           emitPendingPluginUpdate("relay connected");
         });
+        client.onDisconnected((reason) => {
+          logger.warn(
+            `Relay tunnel: relay disconnected, cleaning local proxy state (${reason})`
+          );
+          proxy?.cleanup();
+        });
         abortController = new AbortController();
         client.connectWithAutoReconnect(abortController.signal).catch((err2) => {
           releaseLock();
@@ -14072,10 +14443,18 @@ function resolveLocalGatewayAuth(params) {
     gatewayPassword: envGatewayPassword ?? configGatewayPassword
   };
 }
+var DISABLED_TAILSCALE_MODES = /* @__PURE__ */ new Set([
+  "off",
+  "disabled",
+  "disable",
+  "none",
+  "false",
+  "no"
+]);
 function resolveExclusiveTunnelHint(params) {
   const configData = readHostGatewayConfig(params);
   const tailscaleMode = trimToUndefined2(configData?.gateway?.tailscale?.mode);
-  if (tailscaleMode) {
+  if (tailscaleMode && !DISABLED_TAILSCALE_MODES.has(tailscaleMode.toLowerCase())) {
     return `gateway.tailscale.mode=${tailscaleMode}`;
   }
   const remoteUrl = trimToUndefined2(configData?.gateway?.remote?.url);