create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/public/m/app.js

@@ -136,6 +136,10 @@
       health: null,
       healthTest: null,
     },
+    // WP-2 (docs/external-causality-kill-session-loss-2026-10-27.html §5 D-5, §6, §8 WP-2): the
+    // last `host-dead` frame, or null. Mirrors the desktop banner's fact shape so both surfaces
+    // render the same policy text/actions.
+    hostDead: null,
     detailScrollLock: {
       locked: false,
       scrollY: 0,
@@ -159,7 +163,7 @@
       itemsContext: null,
       itemElements: [],
     },
-    projects: [],
+    projects: [], projectsError: false, // projectsError (D-6): this device's /api/projects read FAILED — never "no projects"
     // WP-5 (S-16/AC-5c): the machine registry, mirrored field for field from the desktop client —
     // same GET /api/machines rows, same reachable/unknown/unhealthy card states, same chip facts.
     // Empty until the hub answers; with zero machines nothing machine-shaped renders at all.
@@ -805,6 +809,70 @@
     banner.hidden = false;
   }
 
+  // WP-2 (docs/external-causality-kill-session-loss-2026-10-27.html §5 D-5, §6, §8 WP-2, AC-2a/2e):
+  // the phone half of the dead-adopted-host notice. Text and button come from the SAME policy module
+  // the desktop banner uses (public/js/restart-banner-policy.js), so the two surfaces can never
+  // disagree; the notice reuses the app-reload-banner styling rather than a second system.
+  function hostDeadCopy(fact) {
+    const policy = window.RestartBannerPolicy;
+    if (policy && typeof policy.decideRestartBanner === 'function') {
+      const decision = policy.decideRestartBanner({ hostDead: fact });
+      return { text: decision.text, showButton: decision.actions.includes('resume') };
+    }
+    // Fail soft to the same strings if the policy script did not load (offline shell).
+    const total = Math.max(0, Number(fact.sessionCount) || 0);
+    const remaining = Math.max(0, Number(fact.remaining) || 0);
+    return {
+      text: remaining > 0
+        ? `${total} sessions lost with their host. Resume ${remaining} sessions`
+        : `${total} sessions lost with their host, ${total} resumed`,
+      showButton: remaining > 0,
+    };
+  }
+
+  function renderHostDeadBanner() {
+    const banner = $('host-dead-banner');
+    if (!banner) return null;
+    const fact = state.hostDead;
+    if (!fact || !fact.hostId) { banner.hidden = true; return null; }
+    const copy = hostDeadCopy(fact);
+    const msg = $('host-dead-msg');
+    if (msg) { msg.textContent = copy.text; msg.title = copy.text; }
+    const btn = $('host-dead-resume-btn');
+    if (btn) btn.hidden = !copy.showButton;
+    banner.hidden = false;
+    return copy;
+  }
+
+  function applyHostDead(msg) {
+    const hostId = String((msg && msg.hostId) || '');
+    if (!hostId) { state.hostDead = null; renderHostDeadBanner(); return null; }
+    const sessionCount = Math.max(0, Number(msg.sessionCount) || 0);
+    const resumedCount = Array.isArray(msg.resumed) ? msg.resumed.length : 0;
+    state.hostDead = {
+      hostId,
+      at: Number(msg.at) || 0,
+      reason: String((msg && msg.reason) || ''),
+      sessionCount,
+      remaining: Math.max(0, sessionCount - resumedCount),
+      fingerprint: `${hostId}|${Number(msg.at) || 0}`,
+    };
+    renderHostDeadBanner();
+    return state.hostDead;
+  }
+
+  function resumeHostDeadSessions() {
+    const fact = state.hostDead;
+    if (!fact || !fact.hostId) return Promise.resolve(null);
+    return api('/api/sessions/resume-deferred', { method: 'POST', body: { hostId: fact.hostId } })
+      .then((data) => {
+        // The server re-broadcasts `host-dead` to every viewer after the drain; applyHostDead
+        // renders that frame, so nothing is cleared locally (phone = desktop parity).
+        return data;
+      })
+      .catch((err) => { toast(err?.message || 'Could not resume the lost sessions.', 'error'); return null; });
+  }
+
   function requestInstalledUpdateReload(opts = {}) {
     const server = normalizeAppVersionInfo(opts.server) || state.appRuntime.latest;
     state.appRuntime.latest = server || state.appRuntime.latest;
@@ -1305,9 +1373,21 @@
       handleMobileAuthError: (err, lease) => { if (lease && !privateLeaseCurrent(lease)) throw privateScopeChangedError(); handleMobileAuthError(err); },
       privateScopeChangedError,
     });
-    return mobilePrivateApi.request(path, options);
+    try {
+      return await mobilePrivateApi.request(path, options);
+    } catch (err) {
+      // WP-1b (§8 step 3): a failed api() already carries `status` and a body-derived `code`, but the
+      // parsed JSON is named `payload`; the child viewer's safeErrorText reads `body`. Attach the ONE
+      // parsed object under that name too, and change nothing else about the error.
+      if (err && typeof err === 'object' && err.body === undefined && err.payload !== undefined) err.body = err.payload;
+      throw err;
+    }
   }
 
+  // §6.4 operator stop (phone half): the shared module owns the sheet and the per-task Stop control; this
+  // app supplies the detail view's own card and its ONE authenticated request path (never a raw fetch).
+  window.BackgroundWork?.installPhoneStop?.({ request: (path, options) => api(path, options), currentCard: () => (state.activeSession ? displayStatusCard(state.activeSession) : null) });
+
   function privateScopeChangedError() {
     return Object.assign(new Error('Private phone data is paused. Verify this phone and CTM identity, then retry.'), { code: 'private_scope_changed' });
   }
@@ -1791,6 +1871,18 @@
       .trim();
   }
 
+  // WP-3 (codex-native-subagent-pick-enforcement-2026-10-28.html §5 D-6, §6, §9 S-8): the phone half of
+  // the PASSIVE native-subagents-off chip — the SAME shared pure rule the desktop lead row reads,
+  // gated to Codex cards. Static label: no click handler, no new WS message.
+  function nativeSubagentChipHtml(card) {
+    const shared = window.CTMCodingModelPresentation;
+    if (!shared || typeof shared.nativeSubagentChip !== 'function') return '';
+    if (workflowRoutingAgent(card) !== 'codex') return '';
+    const pick = (card && (card.subagent_pick || (card.meta && card.meta.subagent_pick))) || null;
+    const chip = shared.nativeSubagentChip(pick);
+    return chip ? `<span class="model-chip model-chip-native-off" title="${esc(chip.title)}">${esc(chip.text)}</span>` : '';
+  }
+
   // WP1C: a generic card's model chip is the SHARED owner/ledger-qualified label (the same presenter
   // the header and the sheet read) — never the raw card.model. Without the shared resolver a carrier
   // declaring ANY authority field fails closed; a legacy card keeps its raw label.
@@ -1799,12 +1891,12 @@
     const shared = window.CTMCodingModelPresentation;
     if (shared && typeof shared.cardModelLabel === 'function') {
       const qualified = shared.cardModelLabel(card, raw, modelDisplayLabel);
-      return qualified ? `<span class="model-chip">${esc(qualified)}</span>` : '';
+      return (qualified ? `<span class="model-chip">${esc(qualified)}</span>` : '') + nativeSubagentChipHtml(card);
     }
     const declares = (source) => !!source
       && ['model_owner', 'model_observation_health', 'model_switch_event'].some((key) => Object.hasOwn(source, key));
-    if (declares(card) || declares(card && card.meta)) return '';
-    return raw ? `<span class="model-chip">${esc(raw)}</span>` : '';
+    if (declares(card) || declares(card && card.meta)) return nativeSubagentChipHtml(card);
+    return (raw ? `<span class="model-chip">${esc(raw)}</span>` : '') + nativeSubagentChipHtml(card);
   }
 
   function modelProviderLabel(provider) {
@@ -2058,13 +2150,37 @@
       .join('');
   }
 
+  // WP-3b (§8 WP-3): the landing queue's chip TEXT for the phone. This must produce byte-identical
+  // strings to public/index.html's landingChipText for the same input — that is the phone parity
+  // rule — so the two formatters change together. Nothing here is HTML; the callers escape.
+  function landingEtaText(etaSeconds) {
+    return typeof etaSeconds === 'number' && Number.isFinite(etaSeconds)
+      ? `${Math.round(etaSeconds / 60)}m` : '';
+  }
+  function landingQueueText(landing) {
+    if (!landing || typeof landing !== 'object') return '';
+    if (typeof landing.position === 'number' && Number.isFinite(landing.position)) {
+      const total = Number.isFinite(Number(landing.total)) ? Number(landing.total) : 0;
+      const eta = landingEtaText(landing.eta_s);
+      return `⇡#${landing.position}/${total}${eta ? ` · ${eta}` : ''}`;
+    }
+    const state = typeof landing.state === 'string' ? landing.state.trim() : '';
+    return state ? `⇡${state}` : '';
+  }
+  // The conflict radar is not on the row, same as desktop: it lives in the details Radar row.
+  function landingChipText(card) {
+    return landingQueueText(card && card.workspaceTracking ? card.workspaceTracking.landing : null);
+  }
+
   function sessionDiffTags(card, opts = {}) {
     const diff = sessionWorktreeDiff(card);
-    if (!diff) return '';
+    const landingText = landingChipText(card);
+    if (!diff && !landingText) return '';
     const chips = [];
     const interactive = !!opts.interactive;
-    const actionTarget = interactive ? worktreeFinishTarget(card, diff) : null;
-    if (diff.dirtyFiles > 0) {
+    // A landing-only chip has no worktree diff to finish, so every `diff.` read below is guarded.
+    const actionTarget = interactive && diff ? worktreeFinishTarget(card, diff) : null;
+    if (diff && diff.dirtyFiles > 0) {
       const label = pluralize(diff.dirtyFiles, 'file');
       const title = diff.isMain
         ? `${diff.branch}: ${pluralize(diff.dirtyFiles, 'uncommitted file')} on main`
@@ -2074,7 +2190,7 @@
         ? `<button class="session-diff-chip session-diff-chip-action files" type="button"${worktreeFinishDataset(actionTarget)} title="${esc(actionTitle)}" aria-label="${esc(actionTitle)}">${esc(label)}</button>`
         : `<span class="session-diff-chip files" title="${esc(title)}" aria-label="${esc(title)}">${esc(label)}</span>`);
     }
-    if (diff.unmergedCommits > 0) {
+    if (diff && diff.unmergedCommits > 0) {
       const label = pluralize(diff.unmergedCommits, 'commit');
       // netContentDiffers === false → commits exist but merging changes nothing (integrated/
       // superseded). Dim the chip + clarify the title so it's distinct from real unmerged work.
@@ -2090,7 +2206,13 @@
         ? `<button class="session-diff-chip session-diff-chip-action ${commitsCls}" type="button"${worktreeFinishDataset(actionTarget)} title="${esc(actionTitle)}" aria-label="${esc(actionTitle)}">${esc(label)}</button>`
         : `<span class="session-diff-chip ${commitsCls}" title="${esc(title)}" aria-label="${esc(title)}">${esc(label)}</span>`);
     }
-    const label = diff.isMain ? `Main branch changes for ${diff.branch}` : `Branch diff for ${diff.branch}`;
+    if (landingText) {
+      // Same text as the desktop queue part.
+      chips.push(`<span class="session-diff-chip landing" title="${esc(landingText)}" aria-label="${esc(landingText)}">${esc(landingText)}</span>`);
+    }
+    const label = diff
+      ? (diff.isMain ? `Main branch changes for ${diff.branch}` : `Branch diff for ${diff.branch}`)
+      : `Landing queue${landingText ? `: ${landingText}` : ''}`;
     return `<span class="session-diff-tags" aria-label="${esc(label)}">${chips.join('')}</span>`;
   }
 
@@ -2233,7 +2355,18 @@
   async function retireWorkers(body) {
     const calls = [api('/api/sessions/workers/retire', { method: 'POST', body })];
     if (body && body.lead) calls.push(api('/api/sessions/' + encodeURIComponent(body.lead) + '/native-subagents/clear', { method: 'POST' }));
-    await Promise.all(calls);
+    try {
+      await Promise.all(calls);
+    } catch (err) {
+      // WP-1b (§8 step 5): a box-owned lead's clear is forwarded by the hub; an unreachable box names
+      // itself through the phone's existing transient-message toast. Any other failure is rethrown
+      // unchanged for the caller's own .catch.
+      if (err?.code === 'machine_unreachable' || err?.body?.code === 'machine_unreachable') {
+        toast(`${err?.body?.machineName || 'The machine that owns this session'} is unreachable. Retry when ready.`);
+        return;
+      }
+      throw err;
+    }
     scheduleRefresh(0);
   }
 
@@ -2433,6 +2566,15 @@
     return `<span class="row-diff-mark ${cls}" title="${esc(titles.join('; '))}">${esc(sessionDiffCountText(diff))}</span>`;
   }
 
+  // WP-3b phone parity: the landing queue also rides the SESSION ROW mark, not just the worktree
+  // sheet chip, matching the desktop badge on the session list row. Text is byte-identical to
+  // `landingChipText` (and therefore to the desktop `landingChipText`).
+  function sessionLandingMark(card) {
+    const landingText = landingChipText(card);
+    if (!landingText) return '';
+    return `<span class="row-diff-mark landing" title="${esc(landingText)}">${esc(landingText)}</span>`;
+  }
+
   // A session row (home + Agents): title and ONE pill, one meta line, at most one button (Wake, parked/deferred only).
   function sessionRow(card, opts = {}) {
     const bucket = cardBucket(card);
@@ -2464,11 +2606,11 @@
         <span class="session-main">
           <span class="session-title-line">
             <span class="session-title">${esc(card.title || card.id || 'Session')}</span>
-            ${opts.worker === true ? cardModelChip(card) : ''}
+            ${opts.worker === true ? cardModelChip(card) : nativeSubagentChipHtml(card)}
             ${phoneMachineChip(card)}
             ${pill}
           </span>
-          <span class="session-meta"><span class="session-meta-text">${esc(meta)}</span>${sessionDiffMark(card)}</span>
+          <span class="session-meta"><span class="session-meta-text">${esc(meta)}</span>${sessionDiffMark(card)}${sessionLandingMark(card)}</span>
           ${searchMatch}
         </span>
         ${action ? `<span class="row-actions">${action}</span>` : ''}
@@ -4961,8 +5103,8 @@
 
   async function loadProjects() {
     const lease = mobilePrivateLease; if (!mobilePrivateReady || !privateLeaseCurrent(lease)) return;
-    try { const data = await api('/api/projects'); if (privateLeaseCurrent(lease)) state.projects = Array.isArray(data) ? data : (Array.isArray(data.projects) ? data.projects : []); }
-    catch { if (privateLeaseCurrent(lease)) state.projects = []; }
+    try { const data = await api('/api/projects'); if (privateLeaseCurrent(lease)) { state.projects = Array.isArray(data) ? data : (Array.isArray(data.projects) ? data.projects : []); state.projectsError = false; } }
+    catch { if (privateLeaseCurrent(lease)) { state.projects = []; state.projectsError = true; } }
   }
 
   function pushSupported() {
@@ -5641,6 +5783,10 @@
   }
 
   function dispatchMobileWsMessage(msg) {
+    // WP-2 (docs/external-causality-kill-session-loss-2026-10-27.html §5 D-5, §6, §8 WP-2, AC-2a):
+    // an adopted host died with sessions still attached — the phone shows the SAME notice and the
+    // SAME Resume button as the desktop banner (PHONE = DESKTOP parity).
+    if (msg.type === 'host-dead') { applyHostDead(msg); return; }
     if (msg.type === 'error') {
       // A machine create refused at the hub names the box and the page that fixes it; show it and
       // stop. 'hello'/'pong'/… are unaffected, and no other frame type is touched.
@@ -5727,6 +5873,12 @@
       phoneModelPicker?.delegatePrefsChanged();
       return;
     }
+    // WP-4 (R-5/R-13, AC-2g): a box session's gated op was refused, or its ask was answered. The
+    // phone shows the same banner the desktop shows (phone = desktop parity), in the session detail.
+    if (msg.type === 'hub-bridge-pending' || msg.type === 'hub-bridge-pending-cleared') {
+      phoneAccessOnFrame(msg);
+      return;
+    }
     if (msg.type === 'remote-submission-status') {
       applyRemoteSubmissionStatus(msg);
       return;
@@ -7094,6 +7246,8 @@
     setDetailSessionChromeVisible(true);
     state.activeSession = card;
     state.activeStreamSessionId = card.id;
+    // WP-4 AC-2g: an ask already open for this session is shown before any frame arrives.
+    phoneAccessSeedBanners().catch(() => {});
     phonePresence.onDetailOpened(); // D-9: a new detail view starts its own idle clock
     render();
     resetDetailTimeline(card.id);
@@ -7145,6 +7299,7 @@
     if (state.approvalSheet && state.approvalSheet.sessionId !== '') closeApprovalRequestSheet();
     state.activeSession = null;
     state.activeStreamSessionId = null;
+    phoneAccessPaintBanner(); // AC-2g: an ask's banner belongs to the session the detail view showed
     setDetailSessionChromeVisible(true);
     resetDetailTimeline(null);
     clearChoiceStillWaitingTimer();
@@ -7571,6 +7726,11 @@
     return card?.agentCapabilities || card?.capabilities || {};
   }
 
+  // WP-11 phone parity (AC-15c): an image attach is a CAPABILITY gate — a dsh card whose live child
+  // did not advertise image prompt support refuses; a card with no capability record is unchanged.
+  const MOBILE_IMAGE_ATTACH_UNAVAILABLE = 'Images are unavailable: this DeepSeek Harness agent did not advertise image prompt support.';
+  function sessionImageAttachAllowed(card) { return cardCapabilities(card).input?.attachments !== false; }
+
   function walleIdentityText(card) {
     return [
       card?.agent,
@@ -7722,6 +7882,8 @@
       if (/codex|openai|gpt-|o[1345]/.test(value)) return 'codex';
       if (/gemini|google/.test(value)) return 'gemini';
       if (/cursor/.test(value)) return 'cursor';
+      // WP-7 (S-59): DeepSeek Harness (dsh) — the phone chip must read the same agent as desktop.
+      if (/deepseek|(^|[-_/])dsh($|[-_/\s])/.test(value)) return 'dsh';
     }
     return '';
   }
@@ -7885,34 +8047,6 @@
     `;
   }
 
-  function normalizeSessionMessagesPayload(data) {
-    if (Array.isArray(data)) {
-      return {
-        messages: data,
-        hasMore: false,
-        nextOffset: data.length,
-        total: data.length,
-        pageKind: 'messages',
-        conversationBudget: null,
-      };
-    }
-    const messages = Array.isArray(data?.messages)
-      ? data.messages
-      : (Array.isArray(data?.data) ? data.data : (Array.isArray(data?.items) ? data.items : []));
-    return {
-      messages,
-      hasMore: !!(data?.has_more || data?.hasMore),
-      nextOffset: Number.isFinite(Number(data?.next_offset ?? data?.nextOffset))
-        ? Number(data?.next_offset ?? data?.nextOffset)
-        : messages.length,
-      total: Number.isFinite(Number(data?.total)) ? Number(data.total) : messages.length,
-      pageKind: String(data?.page_kind || data?.pageKind || ''),
-      conversationBudget: data?.conversationBudget && typeof data.conversationBudget === 'object'
-        ? data.conversationBudget
-        : null,
-    };
-  }
-
   function stripToolTokensForClassification(text) {
     return String(text || '').replace(/\[Tool(?: result)?:\s*[^\]]+\]/g, '').trim();
   }
@@ -7970,7 +8104,7 @@
       timeoutMs: MOBILE_DETAIL_REQUEST_TIMEOUT_MS,
     });
     if (!privateLeaseCurrent(lease)) throw privateScopeChangedError();
-    return normalizeSessionMessagesPayload(data);
+    return window.CTMMobilePrivateApi.normalizeSessionMessagesPayload(data);
   }
 
   async function loadSessionMessagesWindow(card, opts = {}) {
@@ -11311,6 +11445,7 @@
       agentOf: phoneModelAgent,
       currentModelOf: (card) => (card ? String(card.model_id || card.model || '') : ''),
       modelSourceOf: (card) => String(card?.model_source || ''),
+      modelProviderOf: (card) => String(card?.model_provider || card?.meta?.model_provider || ''),
       leadEffortOf: (card) => String(card?.model_effort || card?.meta?.model_effort || ''),
       modelStateOf: (card) => card?.model_state || card?.modelState || card?.meta?.model_state || null,
       isOnScreen: (id) => state.activeSession?.id === id,
@@ -11780,21 +11915,23 @@
     if (!mobilePrivateReady || !privateLeaseCurrent(lease)) return;
     const list = Array.from(files || []).filter(Boolean);
     if (!list.length) return;
+    // WP-11 phone parity (AC-15c): refuse the image attach BEFORE any upload, and say why.
+    if (requestedKind === 'image' && !sessionImageAttachAllowed(state.activeSession)) {
+      setAttachmentComposerStatus(MOBILE_IMAGE_ATTACH_UNAVAILABLE, 'error', composerElement('input'));
+      return;
+    }
     const sessionId = state.activeSession?.id || '';
     const statusInput = composerElement('input');
     setAttachmentComposerStatus(`Attaching ${list.length} item${list.length === 1 ? '' : 's'}...`, '', statusInput);
     const pending = list.map((file) => ({
       id: `att-${++state.attachmentSeq}`,
       kind: attachmentKindForFile(file, requestedKind),
-      originalName: sanitizeAttachmentFilename(file.name,
-        requestedKind === 'image' ? 'phone-image.png' : 'phone-attachment.bin'),
+      originalName: sanitizeAttachmentFilename(file.name, requestedKind === 'image' ? 'phone-image.png' : 'phone-attachment.bin'),
       size: file.size || 0,
       status: 'queued',
       progress: 0,
       error: '',
-      requestId: globalThis.crypto && typeof globalThis.crypto.randomUUID === 'function'
-        ? globalThis.crypto.randomUUID()
-        : `mobile-upload-${Date.now()}-${Math.random().toString(16).slice(2)}`,
+      requestId: globalThis.crypto && typeof globalThis.crypto.randomUUID === 'function' ? globalThis.crypto.randomUUID() : `mobile-upload-${Date.now()}-${Math.random().toString(16).slice(2)}`,
       _uploadFile: file,
       previewUrl: attachmentKindForFile(file, requestedKind) === 'image' ? URL.createObjectURL(file) : '',
     }));
@@ -11817,23 +11954,15 @@
     }));
     if (!privateLeaseCurrent(lease)) return;
     if (state.activeSession?.id !== sessionId) {
-      const staleIds = new Set(pending.map((item) => item.id));
-      state.composerAttachments = state.composerAttachments.filter((item) => !staleIds.has(item.id));
-      for (const item of pending) {
-        if (item.previewUrl) {
-          try { URL.revokeObjectURL(item.previewUrl); } catch { /* expected: preview URLs may already be revoked */ }
-        }
-      }
-      renderComposerAttachments();
-      updateComposerState();
-      setComposerStatus('', '', statusInput);
+      const staleIds = new Set(pending.map((item) => item.id)); state.composerAttachments = state.composerAttachments.filter((item) => !staleIds.has(item.id));
+      for (const item of pending) if (item.previewUrl) { try { URL.revokeObjectURL(item.previewUrl); } catch { /* expected: preview URLs may already be revoked */ } }
+      renderComposerAttachments(); updateComposerState(); setComposerStatus('', '', statusInput);
       return;
     }
     renderComposerAttachments();
     updateComposerState();
-    if (failures.length) {
-      setAttachmentComposerStatus(failures[0], 'error', statusInput);
-    } else {
+    if (failures.length) setAttachmentComposerStatus(failures[0], 'error', statusInput);
+    else {
       const names = pending.map((item) => item.originalName).join(', ');
       setAttachmentComposerStatus(`Attached ${names}.`, 'ok', statusInput);
     }
@@ -11978,7 +12107,8 @@
       option.disabled = state.composerSending || !state.activeSession;
     });
     document.querySelectorAll('[data-send-menu-attach]').forEach((option) => {
-      option.disabled = state.composerSending || !state.activeSession;
+      const attachAllowed = option.dataset.sendMenuAttach !== 'image' || sessionImageAttachAllowed(state.activeSession); // WP-11/AC-15c: the image option is capability-gated
+      option.disabled = state.composerSending || !state.activeSession || !attachAllowed; if (option.dataset.sendMenuAttach === 'image') option.title = attachAllowed ? 'Attach image' : MOBILE_IMAGE_ATTACH_UNAVAILABLE;
     });
     document.querySelectorAll('[data-walle-attach]').forEach((option) => {
       option.disabled = state.composerSending || !state.activeSession;
@@ -11992,6 +12122,8 @@
     if (/codex/.test(text)) return 'codex';
     if (/gemini/.test(text)) return 'gemini';
     if (/opencode|open-code/.test(text)) return 'opencode';
+    // WP-7 (S-59): D-3 command word (never a substring such as `/x/dshell`).
+    if (/^(?:\S*\/)?dsh(?:\s|$)/.test(text) || /deepseek/.test(text)) return 'dsh';
     if (/wall[- ]?e|walle/.test(text)) return 'walle';
     return text.trim();
   }
@@ -12046,6 +12178,8 @@
     const cwd = card.cwd || card.project || card.projectPath || '';
     if (agent) params.set('agent', agent);
     if (cwd) params.set('cwd', cwd);
+    // remote-agent-skills WP-9 (S-9): a session on another machine gets that machine's skill list.
+    if (card.id) params.set('sessionId', String(card.id));
     return `/api/skills/autocomplete?${params.toString()}`;
   }
 
@@ -13453,6 +13587,7 @@
       api,
       toast,
       loadMachines: (options) => loadMachines(options),
+      afterRender: () => { phoneAccessMount(); phoneAccessTrustAllMount(); },
       openNewSessionSheet: (instanceId) => openNewSessionMachine(instanceId),
       confirm: (message) => window.confirm(message),
       now: () => Date.now(),
@@ -13463,7 +13598,305 @@
   // Renders (or re-renders) the Machines section inside #more-content. more.js owns that container and
   // rewrites it wholesale, so this runs again after each of its renders and the section node is reused.
   function renderPhoneMachinesCard() {
-    return phoneMachines()?.render($('more-content')) || null;
+    const node = phoneMachines()?.render($('more-content')) || null;
+    // WP-4 (AC-4d): PHONE = DESKTOP PARITY — the same Access block the desktop card renders (trust
+    // select, active grants + Revoke, open asks + the 4-way grant card / Deny, the last 20 audit lines). The card
+    // markup itself is public/m/machines.js's; this mounts the access section into each rendered card.
+    phoneAccessBind();
+    phoneAccessTrustAllMount();
+    loadPhoneAccess(state.machines).then(() => { phoneAccessMount(); phoneAccessTrustAllMount(); }).catch(() => {});
+    return node;
+  }
+
+  // ── WP-4 phone access block (R-11 trust, R-4 grants, R-5 pending, R-9 audit, R-13/AC-4d) ───────
+  // The phone twin of the desktop Machines page's Access block: the SAME shared markup, texts and
+  // request bodies (public/js/machine-pool-shared.js — loaded by public/m/index.html before this
+  // file), driven through the same routes, so a phone card and a desktop card can never disagree
+  // about who may use this Mac. Only the class prefix and the delegated wiring are the phone's own.
+  const PHONE_ACCESS_OPTS = { esc, classes: MACHINE_ACCESS_CLASSES_PHONE };
+  const phoneAccessState = { trust: null, grants: [], pending: [], audit: {}, pendingIndex: {} };
+
+  /** R-11: a machine's effective policy — its own row, else the file default (shared rule). */
+  function phoneAccessTrustValueFor(instanceId) {
+    return machineEffectiveTrust(phoneAccessState.trust, instanceId);
+  }
+
+  function phoneAccessGrantsFor(instanceId) {
+    return machineAccessRowsFor(phoneAccessState.grants, instanceId);
+  }
+
+  function phoneAccessPendingFor(instanceId) {
+    return machineAccessRowsFor(phoneAccessState.pending, instanceId);
+  }
+
+  function phoneAccessApply(trust, grants) {
+    phoneAccessState.trust = trust && typeof trust === 'object'
+      ? {
+        v: 1,
+        default: MACHINES_PAGE_TRUST_VALUES.indexOf(String(trust.default || '')) !== -1 ? String(trust.default) : MACHINES_PAGE_TRUST_DEFAULT,
+        machines: (trust.machines && typeof trust.machines === 'object') ? trust.machines : {},
+      }
+      : null;
+    const rows = (grants && Array.isArray(grants.grants)) ? grants.grants : [];
+    const pending = (grants && Array.isArray(grants.pending)) ? grants.pending : [];
+    phoneAccessState.grants = rows;
+    phoneAccessState.pending = pending;
+    phoneAccessState.pendingIndex = {};
+    for (const row of pending) {
+      if (row && row.id) phoneAccessState.pendingIndex[String(row.id)] = row;
+    }
+    return true;
+  }
+
+  /** Trust + grants + one audit read per member. A hub without the routes leaves the block empty. */
+  async function loadPhoneAccess(machines) {
+    try {
+      const [trust, grants] = await Promise.all([api('/api/hub-bridge/trust'), api('/api/hub-bridge/grants')]);
+      phoneAccessApply(trust, grants);
+    } catch {
+      phoneAccessApply(null, null);
+    }
+    const list = Array.isArray(machines) ? machines : (Array.isArray(state.machines) ? state.machines : []);
+    await Promise.all(list.filter((m) => m && m.instanceId).map(async (machine) => {
+      const id = String(machine.instanceId);
+      try {
+        const out = await api(`/api/hub-bridge/audit?machineId=${encodeURIComponent(id)}&limit=${MACHINES_PAGE_AUDIT_LIMIT}`);
+        phoneAccessState.audit[id] = (out && Array.isArray(out.entries)) ? out.entries : [];
+      } catch {
+        phoneAccessState.audit[id] = [];
+      }
+    }));
+    return phoneAccessState;
+  }
+
+  function phoneAccessTrustAllHtml() {
+    return machineTrustAllHtml(phoneAccessState.trust, PHONE_ACCESS_OPTS);
+  }
+
+  function phoneAccessBlockHtml(machine) {
+    const id = String((machine && machine.instanceId) || '');
+    if (!id) return '';
+    return machineAccessBlockHtml(id, {
+      trust: phoneAccessState.trust,
+      grants: phoneAccessGrantsFor(id),
+      pending: phoneAccessPendingFor(id),
+      audit: Array.isArray(phoneAccessState.audit[id]) ? phoneAccessState.audit[id] : [],
+      now: phoneMachinesNow(),
+    }, PHONE_ACCESS_OPTS);
+  }
+
+  function phoneAccessPendingRow(pendingId) {
+    return phoneAccessState.pendingIndex[String(pendingId || '')] || null;
+  }
+
+  /** Answer the ask: POST the grant its data-grant key names — the ask's own tier, scope and duration. */
+  async function phoneAccessAllow(instanceId, pendingId, grant) {
+    const row = phoneAccessPendingRow(pendingId);
+    if (!row) { toast('That request is gone.'); return false; }
+    try {
+      await api(...hubBridgeAnswerCall(row, instanceId, grant));
+    } catch {
+      toast('Could not allow that request.');
+      return false;
+    }
+    await phoneAccessRefresh();
+    return true;
+  }
+
+  async function phoneAccessDeny(pendingId) {
+    const key = String(pendingId || '');
+    if (!key) return false;
+    try {
+      await api(hubBridgeDenyPath(key), { method: 'POST', body: {} });
+    } catch {
+      toast('Could not deny that request.');
+      return false;
+    }
+    await phoneAccessRefresh();
+    return true;
+  }
+
+  async function phoneAccessRevoke(instanceId, callerSessionId, tier) {
+    try {
+      await api('/api/hub-bridge/grants', { method: 'DELETE', body: hubBridgeRevokeBody(instanceId, callerSessionId, tier) });
+    } catch {
+      toast('Could not revoke that grant.');
+      return false;
+    }
+    await phoneAccessRefresh();
+    return true;
+  }
+
+  async function phoneAccessTrustChange(instanceId, value) {
+    try {
+      await api('/api/hub-bridge/trust', { method: 'PUT', body: hubBridgeTrustBody(instanceId, value) });
+    } catch {
+      toast('Could not save that setting.');
+      return false;
+    }
+    await phoneAccessRefresh();
+    return true;
+  }
+
+  async function phoneAccessTrustAll(on) {
+    try {
+      await api('/api/hub-bridge/trust', { method: 'PUT', body: hubBridgeTrustAllBody(on) });
+    } catch {
+      toast('Could not save that setting.');
+      return false;
+    }
+    await phoneAccessRefresh();
+    return true;
+  }
+
+  async function phoneAccessRefresh() {
+    await loadPhoneAccess(state.machines);
+    phoneAccessMount();
+    return true;
+  }
+
+  /** Mount (or repaint) the access section on every member card the phone Machines page rendered. */
+  function phoneAccessMount() {
+    const content = $('more-content');
+    if (!content || typeof content.querySelectorAll !== 'function') return 0;
+    const cards = content.querySelectorAll('.mp-card[data-machine-id]') || [];
+    let mounted = 0;
+    for (let i = 0; i < cards.length; i += 1) {
+      const card = cards[i];
+      // This Mac is not a pool member: R-11's policy is per OTHER machine. The phone's self card
+      // (`mp-self`, public/m/machines.js) DOES carry an instance id, so the skip is by class — the
+      // same rule as the desktop page, whose self card has no trust select at all.
+      if (String(card.className || '').split(/\s+/).includes('mp-self')) continue;
+      const id = String((card.getAttribute && card.getAttribute('data-machine-id')) || card.dataset?.machineId || '');
+      if (!id) continue;
+      // The shared template IS the `.mp-access` element (machineAccessBlockHtml), so it goes inside a
+      // plain mount node that a repaint rewrites — never inside another `.mp-access`.
+      let node = typeof card.querySelector === 'function' ? card.querySelector('.mp-access-mount') : null;
+      if (!node) {
+        node = document.createElement('div');
+        node.className = 'mp-access-mount';
+        card.appendChild(node);
+      }
+      node.innerHTML = phoneAccessBlockHtml({ instanceId: id });
+      mounted += 1;
+    }
+    return mounted;
+  }
+
+  // ONE delegated pair of listeners for the whole phone surface: the More container is rewritten
+  // wholesale and the session detail is a different subtree, so per-node listeners would be lost. The
+  // hooks are the shared ones (public/js/machine-pool-shared.js), so the phone and the desktop bind
+  // the same markup. Capture phase, so a control inside a card never also opens the card.
+  function phoneAccessBind() {
+    if (typeof document === 'undefined' || typeof document.addEventListener !== 'function') return false;
+    if (document.__ctmPhoneAccessBound) return false;
+    document.__ctmPhoneAccessBound = true;
+    document.addEventListener('change', (event) => {
+      const node = event.target && typeof event.target.closest === 'function'
+        ? event.target.closest(HUB_BRIDGE_TRUST_HOOK) : null;
+      if (!node || typeof node.getAttribute !== 'function') return;
+      if (node.hasAttribute && node.hasAttribute('data-hub-bridge-trust-all')) { phoneAccessTrustAll(!!event.target.checked); return; }
+      phoneAccessTrustChange(node.getAttribute('data-hub-bridge-trust'), event.target.value);
+    }, true);
+    document.addEventListener('click', (event) => {
+      const node = event.target && typeof event.target.closest === 'function'
+        ? event.target.closest(HUB_BRIDGE_ACTION_HOOK) : null;
+      if (!node || typeof node.getAttribute !== 'function') return;
+      if (typeof event.stopPropagation === 'function') event.stopPropagation();
+      const action = node.getAttribute('data-hub-bridge');
+      if (action === 'allow') phoneAccessAllow(node.getAttribute('data-machine-id'), node.getAttribute('data-pending-id'), node.getAttribute('data-grant'));
+      else if (action === 'deny') phoneAccessDeny(node.getAttribute('data-pending-id'));
+      else if (action === 'revoke') phoneAccessRevoke(node.getAttribute('data-machine-id'), node.getAttribute('data-session-id'), node.getAttribute('data-tier'));
+    }, true);
+    return true;
+  }
+
+  // ── AC-2g on the phone: the same banner sentence, in the session detail ─────────────────────────
+  /** The open ask that belongs to the session the detail view is showing, if there is one. */
+  function phoneAccessBannerRow() {
+    const sid = String(state.activeSession?.id || '');
+    if (!sid) return null;
+    for (const key of Object.keys(phoneAccessState.pendingIndex)) {
+      const row = phoneAccessState.pendingIndex[key];
+      if (row && String(row.callerSessionId || '') === sid) return row;
+    }
+    return null;
+  }
+
+  /** The detail view's banner slot: beside #detail-alert, above the message list. */
+  function phoneAccessBannerHost() {
+    const alert = $('detail-alert');
+    const messages = $('detail-messages');
+    const host = (alert && alert.parentNode) || (messages && messages.parentNode) || null;
+    return { host, before: (messages && messages.parentNode === host) ? messages : null };
+  }
+
+  function phoneAccessPaintBanner() {
+    const slot = phoneAccessBannerHost();
+    if (!slot.host || typeof document === 'undefined' || typeof document.createElement !== 'function') return 0;
+    const row = phoneAccessBannerRow();
+    const existing = typeof slot.host.querySelector === 'function' ? slot.host.querySelector('.mp-approval-banner') : null;
+    if (!row) {
+      if (existing && existing.parentNode) existing.parentNode.removeChild(existing);
+      return 0;
+    }
+    let node = existing;
+    if (!node) {
+      node = document.createElement('section');
+      node.className = 'detail-alert mp-approval-banner';
+      if (typeof slot.host.insertBefore === 'function' && slot.before) slot.host.insertBefore(node, slot.before);
+      else if (typeof slot.host.appendChild === 'function') slot.host.appendChild(node);
+    }
+    node.hidden = false;
+    node.setAttribute('data-pending-id', String(row.id || ''));
+    node.innerHTML = hubBridgeBannerHtml(row, PHONE_ACCESS_OPTS);
+    return 1;
+  }
+
+  /** Re-read the open asks when the detail view opens, so a banner is there before any frame. */
+  async function phoneAccessSeedBanners() {
+    try {
+      const grants = await api('/api/hub-bridge/grants');
+      phoneAccessApply(phoneAccessState.trust, grants);
+    } catch {
+      // HANDLE: an unreadable hub seeds nothing; the next frame or card open re-reads.
+    }
+    phoneAccessPaintBanner();
+    return true;
+  }
+
+  /** The phone's half of the R-5 fan-out: repaint the banner, and the Access block when it is on screen. */
+  function phoneAccessOnFrame(msg) {
+    const type = String((msg && msg.type) || '');
+    if (type === 'hub-bridge-pending') {
+      const row = msg && msg.pending;
+      if (row && row.id) phoneAccessState.pendingIndex[String(row.id)] = row;
+    } else if (type === 'hub-bridge-pending-cleared') {
+      for (const id of ((msg && Array.isArray(msg.ids)) ? msg.ids : [])) delete phoneAccessState.pendingIndex[String(id || '')];
+    } else {
+      return false;
+    }
+    phoneAccessPaintBanner();
+    const content = $('more-content');
+    if (content && typeof content.querySelectorAll === 'function' && content.querySelectorAll('.mp-card').length) {
+      phoneAccessRefresh().catch(() => {});
+    }
+    return true;
+  }
+
+  // The page-level "Trust all my machines" switch lives in the Machines header, which m/machines.js
+  // renders; app.js has no header hook, so the switch is mounted beside the section card. Kept in the
+  // module scope so the phone twin of the desktop header control has ONE home.
+  function phoneAccessTrustAllMount() {
+    const card = $('phone-machines-card');
+    if (!card || typeof card.appendChild !== 'function') return false;
+    if (typeof card.querySelector === 'function' && card.querySelector('.mp-access-trust-all')) return true;
+    if (typeof document === 'undefined' || typeof document.createElement !== 'function') return false;
+    const wrap = document.createElement('div');
+    wrap.className = 'mp-toolbar';
+    wrap.innerHTML = phoneAccessTrustAllHtml();
+    card.appendChild(wrap);
+    return true;
   }
 
   // ── WP-6 item 3: the picker — <select> at N <= 4, the search sheet above it ─────────────────────
@@ -13684,7 +14117,7 @@
       return;
     }
     if (String($('new-session-machine')?.value || '').trim() !== machine) return;
-    select.innerHTML = phoneProjectOptionsHtml(rows);
+    select.innerHTML = phoneProjectOptionsHtml(rows); if (state.projectsError && (await loadProjects(), state.projectsError)) return phoneMachineSetHint(`Couldn't read the project lists right now — pick the folder on ${name}.`, true); // D-6: retry this device's list; a failed read is UNKNOWN, never "no checkout"
     const match = phoneSameRepoProject(state.projects, state.newSessionLocalCwd, rows);
     if (match) {
       select.value = match;
@@ -13704,6 +14137,9 @@
     const agentLabel = agentSelect.selectedOptions?.[0]?.textContent?.trim() || agent;
     const prompt = $('new-session-prompt').value.trim();
     const isWalle = agent === 'walle';
+    // WP-7 (S-60): the DeepSeek Harness is a conv-only ACP agent — same create frame as desktop
+    // (`cmd:'dsh'`, `agentType:'dsh'`, no CLI args). Its first turn is typed in the composer.
+    const isDsh = agent === 'dsh';
     const cmd = agent === 'codex'
       ? 'codex'
       : agent === 'gemini'
@@ -13712,12 +14148,12 @@
           ? undefined
           : isWalle
             ? 'walle'
-            : 'claude';
-    const args = prompt && !isWalle ? [prompt] : [];
+            : isDsh ? 'dsh' : 'claude';
+    const args = prompt && !isWalle && !isDsh ? [prompt] : [];
     // WP-5 (S-12/S-16): the machine chosen in the sheet travels with the create frame as `machine`;
     // '' is this Mac and the field is omitted, so a local create frame is unchanged.
     const machine = ($('new-session-machine')?.value || '').trim();
-    const request = Object.freeze({ cwd, agent, agentLabel, prompt, isWalle, cmd, args: Object.freeze(args.slice()), machine });
+    const request = Object.freeze({ cwd, agent, agentLabel, prompt, isWalle, isDsh, cmd, args: Object.freeze(args.slice()), machine });
     const action = async () => {
       if (!privateLeaseCurrent(lease) || state.pendingStepUp?.action !== action) throw privateScopeChangedError();
       const id = randomId();
@@ -13730,6 +14166,7 @@
         });
         if (request.prompt) payload.initialMessage = request.prompt;
       }
+      if (request.isDsh) Object.assign(payload, { label: request.agentLabel || 'DeepSeek Harness', agentType: 'dsh' });
       await sendWs(payload);
       if (!privateLeaseCurrent(lease) || state.pendingStepUp?.action !== action) throw privateScopeChangedError();
       $('new-session-sheet').hidden = true;
@@ -13892,6 +14329,8 @@
     });
     $('refresh-btn').addEventListener('click', refresh);
     $('app-reload-now-btn')?.addEventListener('click', () => reloadForInstalledUpdate('banner'));
+    // WP-2 (AC-2b): the same one action the desktop banner's Resume button posts.
+    $('host-dead-resume-btn')?.addEventListener('click', () => { void resumeHostDeadSessions(); });
     $('detail-back').addEventListener('click', (event) => {
       event.preventDefault();
       event.stopPropagation();