dominds 1.25.19 → 1.26.1

package/dist/docs/cli-usage.md

@@ -4,7 +4,9 @@ Chinese version: [中文版](./cli-usage.zh.md)
 
 The `dominds` CLI provides a unified entry point, but the **primary interaction experience is the Web UI** (the default `dominds` command). This guide focuses on the Web UI workflow.
 
-> Note: In this document, **rtws (runtime workspace)** refers to the runtime root directory Dominds uses (by default `process.cwd()`, switchable via `-C <abs-dir>`; `-C` only accepts absolute paths).
+> Note: In this document, **rtws (runtime workspace)** refers to the runtime root directory Dominds uses (by default the directory where `dominds` is launched, switchable via `-C <dir>`). Relative `-C` paths are resolved against the original launch directory by the `dominds` supervisor before the runner starts.
+
+> Process model: in production, `dominds` is a lightweight supervisor. It parses global options such as `-C`, starts `dominds-runner` in the resolved rtws, keeps the terminal stdio attached to the runner, and restarts long-running WebUI runners after crashes with exponential backoff starting at 1 second and capped at 30 minutes. Self-update restarts are coordinated by this supervisor, so the old runner can fully exit and release server resources before the new runner starts; if the old runner does not exit after a restart request, the supervisor terminates it before starting the next runner. Development WebUI runs (`NODE_ENV=dev` or `--mode dev`, including `dev-server.sh`) bypass the supervisor and are managed by the development launcher instead.
 
 > Note: `dominds tui` / `dominds run` are currently reserved subcommand names and do not have a stable implementation yet. As a result, this guide does not document TUI options or detailed usage.
 
@@ -18,6 +20,7 @@ The `dominds` CLI provides a unified entry point, but the **primary interaction
     - [Web UI Interface](#web-ui-interface)
     - [Text User Interface (TUI) (Not Implemented Yet)](#text-user-interface-tui-not-implemented-yet)
     - [Minds Reader](#minds-reader)
+    - [Certificate Tools](#certificate-tools)
     - [rtws Creation](#rtws-creation)
   - [Usage Examples](#usage-examples)
   - [Dialog Storage](#dialog-storage)
@@ -32,6 +35,7 @@ The `dominds` package provides a unified CLI with subcommands:
 | `dominds` or `dominds webui`      | Start Web UI (default, recommended)                           | Web UI         |
 | `dominds tui` or `dominds run`    | Terminal UI (planned; no stable implementation at the moment) | N/A            |
 | `dominds read`                    | Read and inspect rtws/team minds configuration                | CLI            |
+| `dominds cert`                    | Create and inspect local WebUI HTTPS certificates             | CLI            |
 | `dominds create` or `dominds new` | Create a new rtws (runtime workspace) from a template         | CLI            |
 | `dominds help`                    | Show help message                                             | CLI            |
 | `dominds --version`               | Show version information                                      | CLI            |
@@ -54,6 +58,10 @@ dominds webui -C /path/to/my-rtws
 # Minds reader: inspect team configuration
 dominds read [options] [member-id]
 
+# Certificate tools: create/inspect local HTTPS certificates
+dominds cert create [--host <host>] [--days <days>] [--force]
+dominds cert status [--host <host>] [--port <port>] [--origin]
+
 # rtws creation: scaffold a new runtime workspace
 dominds create <template> [directory]
 dominds new <template> [directory]  # alias for create
@@ -83,7 +91,7 @@ Start the web-based user interface for the current rtws. This provides a graphic
 
 - `-p, --port <port>` - Port to listen on; a bare port binds strictly, suffix `+` tries higher ports, and suffix `-` tries lower ports (omitting `--port` is equivalent to `5666-`)
 - `-h, --host <host>` - Host to bind to (default: localhost)
-- `-C, --cwd <abs-dir>` - Change to rtws directory before starting; absolute paths only
+- `-C, --cwd <dir>` - Change to rtws directory before starting; relative paths are resolved against the original launch directory
 - `--help` - Show help message
 
 **Examples:**
@@ -93,6 +101,7 @@ dominds
 dominds webui -p 8080
 dominds webui -p 8080+
 dominds webui -C /path/to/my-rtws
+dominds -C ux-rtws webui
 ```
 
 **Common use cases:**
@@ -122,7 +131,7 @@ Read and inspect agent prompts/configuration for the rtws. This is commonly used
 
 **Options:**
 
-- `-C, --cwd <abs-dir>` - Change to rtws directory before reading; absolute paths only
+- `-C, --cwd <dir>` - Change to rtws directory before reading; relative paths are resolved against the original launch directory
 - `--only-prompt` - Show only system prompts
 - `--only-mem` - Show only memory
 - `--help` - Show help message
@@ -137,6 +146,34 @@ dominds read --only-prompt
 dominds read --only-mem
 ```
 
+### Certificate Tools
+
+```bash
+dominds cert create [--host <host>] [--days <days>] [--force]
+dominds cert status [--host <host>] [--port <port>] [--origin]
+```
+
+Create or inspect local HTTPS certificates for the Dominds WebUI. Certificates live in `~/.dominds/certs/` and match DNS/IP hostnames, not ports; one certificate covers every WebUI port on that host.
+
+**Options:**
+
+- `--host <host>` - Certificate SAN hostname or IP; repeatable for certificate creation; defaults to one or more detected non-loopback LAN hosts
+- `--days <days>` - Certificate validity in days (default: 3650, or 10 years)
+- `--force` - Overwrite existing generated files
+- `--port <port>` - Port used when formatting `status --origin`
+- `--origin` - Print only the effective origin; HTTPS when a cert matches, HTTP otherwise
+
+**Examples:**
+
+```bash
+dominds cert create
+dominds cert create --host 192.168.1.10 --host my-host.local
+dominds cert status
+dominds cert status --port 5666 --origin
+```
+
+`localhost`, `loopback`, `127.0.0.0/8`, `169.254.0.0/16`, `::1`, `fe80::/10`, `0.0.0.0`, and `::` are not certificate hosts. `0.0.0.0` / `::` only mean bind-all; certificate matching uses detected non-loopback LAN hosts.
+
 ### rtws Creation
 
 ```bash

package/dist/docs/cli-usage.zh.md

@@ -4,7 +4,9 @@
 
 `dominds` 提供统一的命令行入口，但**主要交互界面是 Web UI**（默认命令 `dominds`）。本文档以 Web UI 工作流为主。
 
-> 注：本文统一使用 **rtws（运行时工作区）** 表示 Dominds 运行时使用的根目录（默认等于 `process.cwd()`，可通过 `-C <abs-dir>` 切换；`-C` 只接受绝对路径）。
+> 注：本文统一使用 **rtws（运行时工作区）** 表示 Dominds 运行时使用的根目录（默认是启动 `dominds` 时所在目录，可通过 `-C <dir>` 切换）。相对路径形式的 `-C` 由 `dominds` supervisor 按原始启动目录解析为绝对路径，再启动 runner。
+
+> 进程模型：生产模式下，`dominds` 是轻量 supervisor，负责解析 `-C` 等全局选项、在解析后的 rtws 中启动 `dominds-runner`、让 runner 继承当前终端 stdio，并在长期运行的 WebUI runner 崩溃后用指数退避保活重启（初始 1 秒，最长 30 分钟）。self-update 重启也由 supervisor 协调，因此旧 runner 可以完整退出并释放 server 资源，再启动新版 runner；如果旧 runner 在发出重启请求后仍不退出，supervisor 会终止它再启动下一轮 runner。开发模式 WebUI（`NODE_ENV=dev` 或 `--mode dev`，包括 `dev-server.sh`）不走 supervisor，由开发启动器自行管理。
 
 > 说明：`dominds tui` / `dominds run` 相关功能目前尚未提供稳定实现（子命令名保留用于未来规划），因此本指南不再展开 TUI 的命令选项与用法细节。
 
@@ -18,6 +20,7 @@
     - [Web UI 界面](#web-ui-界面)
     - [文本用户界面 (TUI)（尚未实现）](#文本用户界面-tui尚未实现)
     - [Minds 阅读器](#minds-阅读器)
+    - [证书工具](#证书工具)
     - [rtws 创建](#rtws-创建)
   - [使用示例](#使用示例)
   - [对话存储](#对话存储)
@@ -32,6 +35,7 @@
 | `dominds` 或 `dominds webui`      | 启动 Web UI（默认、推荐）                | Web UI   |
 | `dominds tui` 或 `dominds run`    | 终端界面（规划中；当前版本暂不提供稳定） | N/A      |
 | `dominds read`                    | 读取/分析团队 minds 配置                 | CLI      |
+| `dominds cert`                    | 创建/检查本机 WebUI HTTPS 证书           | CLI      |
 | `dominds create` 或 `dominds new` | 从模板创建新 rtws（运行时工作区）        | CLI      |
 | `dominds help`                    | 显示帮助消息                             | CLI      |
 | `dominds --version`               | 显示版本信息                             | CLI      |
@@ -54,6 +58,10 @@ dominds webui -C /path/to/my-rtws
 # Minds 阅读器：分析团队配置
 dominds read [options] [member-id]
 
+# 证书工具：创建/检查本机 HTTPS 证书
+dominds cert create [--host <host>] [--days <days>] [--force]
+dominds cert status [--host <host>] [--port <port>] [--origin]
+
 # rtws 创建：搭建新项目/运行时工作区
 dominds create <template> [directory]
 dominds new <template> [directory]  # create 的别名
@@ -83,7 +91,7 @@ dominds webui [options]
 
 - `-p, --port <port>` - 监听端口；裸端口严格绑定，后缀 `+` 向更大端口自动尝试，后缀 `-` 向更小端口自动尝试（未指定时等价于 `5666-`）
 - `-h, --host <host>` - 绑定的主机（默认：localhost）
-- `-C, --cwd <abs-dir>` - 启动前更改 rtws 目录；只接受绝对路径
+- `-C, --cwd <dir>` - 启动前更改 rtws 目录；相对路径按原始启动目录解析
 - `--help` - 显示帮助消息
 
 **示例：**
@@ -100,6 +108,7 @@ dominds webui -p 8080+
 
 # 在特定 rtws 启动 Web UI
 dominds webui -C /path/to/my-rtws
+dominds -C ux-rtws webui
 ```
 
 **常见用途：**
@@ -129,7 +138,7 @@ dominds read [options] [member-id]
 
 **选项：**
 
-- `-C, --cwd <abs-dir>` - 读取前更改 rtws 目录；只接受绝对路径
+- `-C, --cwd <dir>` - 读取前更改 rtws 目录；相对路径按原始启动目录解析
 - `--only-prompt` - 仅显示系统提示词
 - `--only-mem` - 仅显示内存
 - `--help` - 显示帮助消息
@@ -144,6 +153,34 @@ dominds read --only-prompt
 dominds read --only-mem
 ```
 
+### 证书工具
+
+```bash
+dominds cert create [--host <host>] [--days <days>] [--force]
+dominds cert status [--host <host>] [--port <port>] [--origin]
+```
+
+创建或检查 Dominds WebUI 的本机 HTTPS 证书。证书保存在 `~/.dominds/certs/`，按 DNS/IP 主机名匹配，不绑定端口；同一张证书可覆盖该主机上的所有 WebUI 端口。
+
+**选项：**
+
+- `--host <host>` - 证书 SAN 主机名或 IP；创建证书时可重复指定；未指定时使用检测到的一个或多个非 loopback LAN 主机
+- `--days <days>` - 证书有效天数（默认：3650，即 10 年）
+- `--force` - 覆盖已有的同名生成文件
+- `--port <port>` - `status --origin` 输出 URL 时使用的端口
+- `--origin` - 仅输出有效访问 origin；找到证书时输出 HTTPS，否则输出 HTTP
+
+**示例：**
+
+```bash
+dominds cert create
+dominds cert create --host 192.168.1.10 --host my-host.local
+dominds cert status
+dominds cert status --port 5666 --origin
+```
+
+`localhost`、`loopback`、`127.0.0.0/8`、`169.254.0.0/16`、`::1`、`fe80::/10`、`0.0.0.0`、`::` 不会作为 HTTPS 证书主机。`0.0.0.0` / `::` 只表示绑定所有地址，匹配证书时会使用检测到的非 loopback LAN 主机。
+
 ### rtws 创建
 
 ```bash

package/dist/docs/dialog-persistence.md

@@ -4,7 +4,7 @@ Chinese version: [中文版](./dialog-persistence.zh.md)
 
 This document describes the persistence layer and storage mechanisms for the Dominds dialog system, including file system conventions, data structures, and storage patterns.
 
-> Note: In this document, **rtws (runtime workspace)** refers to Dominds' runtime root directory (by default `process.cwd()`, switchable via `-C <abs-dir>`; `-C` only accepts absolute paths).
+> Note: In this document, **rtws (runtime workspace)** refers to Dominds' runtime root directory (by default the directory where `dominds` is launched, switchable via `-C <dir>`; relative `-C` paths are resolved against the original launch directory).
 
 ## Current Implementation Status
 

package/dist/docs/dominds-terminology.md

@@ -264,8 +264,8 @@ Example / 示例（概念）:
 
 ### rtws（运行时工作区）
 
-- EN: **rtws** (runtime workspace) is the directory Dominds treats as its runtime root (by default it is `process.cwd()`, and can be changed via `-C <abs-dir>`; `-C` only accepts absolute paths). Files like `.minds/` and `.dialogs/` live under the rtws.
-- ZH: **rtws（运行时工作区）**是 Dominds 运行时使用的根目录（默认等于 `process.cwd()`，可通过 `-C <abs-dir>` 切换；`-C` 只接受绝对路径）。诸如 `.minds/`、`.dialogs/` 等运行态目录均位于 rtws 下。
+- EN: **rtws** (runtime workspace) is the directory Dominds treats as its runtime root (by default it is the directory where `dominds` is launched, and can be changed via `-C <dir>`; relative `-C` paths are resolved against the original launch directory). Files like `.minds/` and `.dialogs/` live under the rtws.
+- ZH: **rtws（运行时工作区）**是 Dominds 运行时使用的根目录（默认是启动 `dominds` 时所在目录，可通过 `-C <dir>` 切换；相对路径形式的 `-C` 按原始启动目录解析）。诸如 `.minds/`、`.dialogs/` 等运行态目录均位于 rtws 下。
 
 - EN: Wording rule: when the meaning is **rtws**, prefer writing “rtws (runtime workspace)” (or just “rtws” after the first mention) rather than the ambiguous generic “workspace”.
 - ZH: 用词规则：当语义指向 **rtws** 时，优先写“rtws（运行时工作区）”（或在已定义后只写“rtws”），避免在对外提示/文档中只写“工作区”从而与其他语境的 workspace/workdir 混淆。

package/dist/llm/kernel-driver/drive.js

@@ -259,6 +259,10 @@ function resolveReminderContextFollowingDialogState(prompt, currentTurnDialogMsg
         return 'none';
     return prompt.origin === 'user' ? 'user_message' : 'runtime_notice';
 }
+function resolveReminderContextHealthState(snapshot) {
+    const remediationLevel = getContextHealthRemediationLevel(snapshot);
+    return remediationLevel === undefined ? 'normal' : remediationLevel;
+}
 async function resolveReminderContextFooterState(args) {
     const latest = await persistence_1.DialogPersistence.loadDialogLatest(args.dlg.id, args.dlg.status);
     const deferredReplyReassertion = latest?.deferredReplyReassertion;
@@ -273,6 +277,7 @@ async function resolveReminderContextFooterState(args) {
         followingDialogState: resolveReminderContextFollowingDialogState(args.prompt, args.currentTurnDialogMsgsForContext),
         pendingUserInterjectionReply,
         interDialogReplyObligation,
+        contextHealthState: resolveReminderContextHealthState(args.dlg.getLastContextHealth()),
     };
 }
 function splitDialogMsgsForReminderInsertion(args) {
@@ -715,8 +720,8 @@ const TELLASK_SPECIAL_VIRTUAL_TOOLS = [
     },
 ];
 const CONTEXT_HEALTH_TOOL_RESULT_VISIBLE_BYTE_LIMIT = 2000;
-const CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_ZH = '这次函数返回内容太大，清理头脑之前当前不可见。';
-const CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_EN = 'This function returned too much content, so it is not visible before clear_mind.';
+const CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_ZH = '这次函数返回内容太大，清理头脑之前不会显示给你。';
+const CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_EN = 'This function returned too much content. It will not be shown to you before you clear your mind.';
 function getContextHealthRemediationLevel(snapshot) {
     if (snapshot?.kind !== 'available') {
         return undefined;
@@ -736,9 +741,9 @@ function formatContextHealthLargeToolReturnUnavailable(args) {
             return [
                 CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_ZH,
                 '',
-                '不要重试获取这类大段输出。现在先做两件事：',
+                '不要再尝试获取各种大段的输出，都不会显示给你。现在先做两件事：',
                 '1. 把需要回传给主线对话的结论、证据定位和风险整理清楚。',
-                '2. 若还有恢复工作会丢的信息，写入提醒项。',
+                '2. 对于下一程恢复工作需要的信息，写入提醒项。',
                 '',
                 '然后尽快完成当前支线回复；如果你有 clear_mind({})，再调用它开启新一程。',
                 '',
@@ -748,9 +753,9 @@ function formatContextHealthLargeToolReturnUnavailable(args) {
         return [
             CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_ZH,
             '',
-            '不要重试获取这类大段输出。现在先做两件事：',
-            '1. 把下一程还需要知道的信息写入差遣牒合适章节。',
-            '2. 把差遣牒没有覆盖、但恢复工作会丢的信息写入提醒项。',
+            '不要再尝试获取各种大段的输出，都不会显示给你。现在先做两件事：',
+            '1. 把下一程对话需要知道的此程细节信息写入差遣牒合适章节。',
+            '2. 对于不适合差遣牒章节覆盖、但下一程恢复工作需要的信息写入提醒项。',
             '',
             '然后调用 clear_mind({}) 开启新一程。',
             '',
@@ -761,11 +766,11 @@ function formatContextHealthLargeToolReturnUnavailable(args) {
         return [
             CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_EN,
             '',
-            'Do not retry fetching this kind of large output. Do two things now:',
-            '1. Organize the conclusion, evidence pointers, and risks that need to go back to the Main Dialog.',
-            '2. If any resume-critical details would otherwise be lost, write them into reminders.',
+            'Do not try again to fetch any kind of large output; it still will not be shown. Do two things now:',
+            '1. Organize the conclusions, evidence pointers, and risks that need to go back to the Mainline dialog.',
+            '2. Write any details needed to resume the next course into reminders.',
             '',
-            'Then finish the current Side Dialog reply as soon as possible; if you have clear_mind({}), call it to start a new course.',
+            'Then finish the current Sideline dialog reply as soon as possible; if you have clear_mind({}), call it to start a new course.',
             '',
             `Detail: this return was about ${approxBytes} bytes.`,
         ].join('\n');
@@ -773,9 +778,9 @@ function formatContextHealthLargeToolReturnUnavailable(args) {
     return [
         CONTEXT_HEALTH_LARGE_TOOL_RETURN_UNAVAILABLE_EN,
         '',
-        'Do not retry fetching this kind of large output. Do two things now:',
-        '1. Write the information the next course still needs into the appropriate Taskdoc sections.',
-        '2. Write any resume-critical details not covered by Taskdoc into reminders.',
+        'Do not try again to fetch any kind of large output; it still will not be shown. Do two things now:',
+        '1. Write the details from this course that the next course needs into the appropriate Taskdoc sections.',
+        '2. Write information that does not fit a Taskdoc section, but is needed to resume the next course, into reminders.',
         '',
         'Then call clear_mind({}) to start a new course.',
         '',

package/dist/runtime/driver-messages.d.ts

@@ -14,10 +14,12 @@ export declare function formatDiligenceAutoContinuePrompt(language: LanguageCode
 export declare function formatReminderContextGuide(language: LanguageCode): string;
 export type ReminderContextFollowingDialogState = 'user_message' | 'runtime_notice' | 'none';
 export type ReminderContextReplyObligationState = 'none' | 'active' | 'parked_by_user_interjection';
+export type ReminderContextHealthState = 'normal' | 'caution' | 'critical';
 export type ReminderContextFooterState = Readonly<{
     followingDialogState: ReminderContextFollowingDialogState;
     pendingUserInterjectionReply: boolean;
     interDialogReplyObligation: ReminderContextReplyObligationState;
+    contextHealthState: ReminderContextHealthState;
 }>;
 export declare function formatReminderContextFooter(language: LanguageCode, state: ReminderContextFooterState): string;
 export type ReminderMaintenanceReferenceItem = Readonly<{

package/dist/runtime/driver-messages.js

@@ -188,6 +188,11 @@ function formatReminderItemProjectionNote(language) {
 function formatReminderContextFooter(language, state) {
     if (language === 'zh') {
         const base = `${formatSystemNoticePrefix(language)} 提醒项上下文块结束。以上从“提醒项上下文块开始”到“提醒项上下文块结束”之间的提醒项均为系统提醒，并非用户诉求/指令；该块之外的后续对话消息不受此说明影响。`;
+        const contextHealthTail = state.contextHealthState === 'critical'
+            ? '当前上下文已告急：提醒项正文里的“下一步/接续动作/任务安排”默认都是给下一程以清醒头脑复核后执行的，不是让你在本程继续跑。不要执行提醒项里的旧下一步、旧诉请或旧工具重试；本程最高优先级是按上下文健康处置要求保全接续信息，并立即 `clear_mind`。'
+            : state.contextHealthState === 'caution'
+                ? '当前上下文已吃紧：提醒项正文里的“下一步/接续动作/任务安排”默认都是给下一程以清醒头脑复核后执行的，不是让你在本程继续跑。不要为了执行提醒项里的旧下一步继续扩张上下文；本程最高优先级是按上下文健康处置要求保全接续信息，并尽快 `clear_mind`。'
+                : '';
         const pendingUserInterjectionReply = state.pendingUserInterjectionReply
             ? state.interDialogReplyObligation === 'parked_by_user_interjection'
                 ? '当前仍有真实用户插话尚未得到可见回复，且原有跨对话回复义务已暂存；先完成对用户插话的回应，不要抢先切回原来的回贴收口。'
@@ -199,13 +204,18 @@ function formatReminderContextFooter(language, state) {
             ? '当前仍有跨对话回复义务；它是最终交付义务，不是要求你立刻停止当前必要工作，但到达最终交付时必须按运行时指定方式收口。'
             : '';
         const businessTail = `${pendingUserInterjectionReply}${activeReplyObligation}`;
+        const statusTail = `${contextHealthTail}${businessTail}`;
         if (state.followingDialogState === 'user_message') {
             return (`${base}本轮提醒项块之后会紧接一条本轮真实的新用户消息；后续消息是用户的新诉求/指令，不是提醒项投影。` +
                 '提醒项块说明到此为止，不得外溢到那条消息：不要把后续用户消息称为“系统提示/没有新消息”，也不要因为本块说明而降低它的指令优先级。' +
-                `请按那条用户消息的原始语义继续处理；若它要求更新你的职责、偏好或心智资产，应照常落实。${businessTail}`);
+                `请按那条用户消息的原始语义继续处理；若它要求更新你的职责、偏好或心智资产，应照常落实；上下文健康处置要求仍按系统提示优先于普通任务动作。${statusTail}`);
         }
         if (state.followingDialogState === 'runtime_notice') {
-            return `${base}本轮提醒项块之后会接着出现一条运行时提示；它不是用户的新诉求/指令，请按其中的运行时要求继续推进。${businessTail}`;
+            return `${base}本轮提醒项块之后会接着出现一条运行时提示；它不是用户的新诉求/指令，请按其中的运行时要求继续推进。${statusTail}`;
+        }
+        if (state.contextHealthState !== 'normal') {
+            return (`${base}本轮没有新的用户消息或运行时提示；这是工具调用后的自动续推。` +
+                `不要把“没有新消息”理解为空系统提示。${statusTail}`);
         }
         return (`${base}本轮没有新的用户消息或运行时提示；这是工具调用后的自动续推。` +
             '请基于已有任务状态判断下一步：若已有明确、相关且有价值的动作，就继续执行；若当前确实只能等待外部结果或用户输入，不要为了避免“等待”而寻找无关小事。' +
@@ -214,6 +224,11 @@ function formatReminderContextFooter(language, state) {
     const base = `${formatSystemNoticePrefix(language)} Reminder context block ends. The reminder items between ` +
         '"Reminder context block begins" and "Reminder context block ends" are system reminders, ' +
         'not user requests/instructions; this reminder-block guidance does not apply to subsequent dialog messages outside this block. ';
+    const contextHealthTail = state.contextHealthState === 'critical'
+        ? 'Context health is critical: any "next step", continuation action, or task plan inside reminders is meant for the next course to review and run with a clear head, not for this course to keep executing. Do not perform old next steps, old inter-dialog requests, or old tool retries from reminders; this course must first preserve the continuation details required by the context-health guidance, then call `clear_mind` immediately. '
+        : state.contextHealthState === 'caution'
+            ? 'Context health is tight: any "next step", continuation action, or task plan inside reminders is meant for the next course to review and run with a clear head, not for this course to keep executing. Do not expand context by performing old next steps from reminders; this course must first preserve the continuation details required by the context-health guidance, then call `clear_mind` soon. '
+            : '';
     const pendingUserInterjectionReply = state.pendingUserInterjectionReply
         ? state.interDialogReplyObligation === 'parked_by_user_interjection'
             ? "There is still a real user interjection without a visible reply, and the earlier inter-dialog reply obligation is parked; finish answering the user's interjection first, and do not switch back to closing the earlier reply yet. "
@@ -225,13 +240,18 @@ function formatReminderContextFooter(language, state) {
         ? 'An inter-dialog reply obligation is still active; it is a final delivery obligation, not a demand to stop necessary current work immediately, but final delivery must close through the runtime-specified path. '
         : '';
     const businessTail = `${pendingUserInterjectionReply}${activeReplyObligation}`;
+    const statusTail = `${contextHealthTail}${businessTail}`;
     if (state.followingDialogState === 'user_message') {
         return (`${base}A real new user message for this round immediately follows this reminder block; the following message is a new user request/instruction, not a reminder projection. ` +
             'The reminder-block guidance ends here and must not spill over onto that message: do not label the following user message as a "system notice" or "no new message", and do not lower its instruction priority because of this block. ' +
-            `Handle that user message according to its original meaning; if it asks you to update your responsibilities, preferences, or mind assets, carry that out normally. ${businessTail}`);
+            `Handle that user message according to its original meaning; if it asks you to update your responsibilities, preferences, or mind assets, carry that out normally. Context-health remediation still takes system-guided priority over ordinary task actions. ${statusTail}`);
     }
     if (state.followingDialogState === 'runtime_notice') {
-        return `${base}A runtime notice follows this reminder block in this round; it is not a new user request/instruction, so follow that runtime guidance and continue the work. ${businessTail}`;
+        return `${base}A runtime notice follows this reminder block in this round; it is not a new user request/instruction, so follow that runtime guidance and continue the work. ${statusTail}`;
+    }
+    if (state.contextHealthState !== 'normal') {
+        return (`${base}There is no new user message or runtime notice in this round; this is an automatic continuation after a tool call. ` +
+            `Do not interpret the absence of a new message as an empty system notice. ${statusTail}`);
     }
     return (`${base}There is no new user message or runtime notice in this round; this is an automatic continuation after a tool call. ` +
         'Judge the next step from the existing task state: if there is a clear, relevant, valuable action, continue with it; if the work genuinely can only wait for an external result or user input, do not invent unrelated work just to avoid "waiting". ' +

package/dist/server/auth.d.ts

@@ -37,7 +37,14 @@ export declare function isAuthEnabled(auth: AuthConfig): auth is Extract<AuthCon
 export declare function getHttpAuthCheck(req: IncomingMessage, auth: AuthConfig): AuthCheckResult;
 export declare function getHttpAuthCheckAllowUrlParam(req: IncomingMessage, auth: AuthConfig, requestUrl: URL): AuthCheckResult;
 export declare function getWebSocketAuthCheck(req: IncomingMessage, auth: AuthConfig): AuthCheckResult;
+export type ServerUrlScheme = 'http' | 'https';
+export declare function formatServerOrigin(params: {
+    scheme: ServerUrlScheme;
+    host: string;
+    port: number;
+}): string;
 export declare function formatAutoAuthUrl(params: {
+    scheme?: ServerUrlScheme;
     host: string;
     port: number;
     authKey: string;

package/dist/server/auth.js

@@ -53,6 +53,7 @@ exports.isAuthEnabled = isAuthEnabled;
 exports.getHttpAuthCheck = getHttpAuthCheck;
 exports.getHttpAuthCheckAllowUrlParam = getHttpAuthCheckAllowUrlParam;
 exports.getWebSocketAuthCheck = getWebSocketAuthCheck;
+exports.formatServerOrigin = formatServerOrigin;
 exports.formatAutoAuthUrl = formatAutoAuthUrl;
 const crypto = __importStar(require("crypto"));
 function computeAuthConfig(params) {
@@ -129,14 +130,24 @@ function getWebSocketAuthCheck(req, auth) {
         ? { kind: 'ok' }
         : { kind: 'unauthorized', reason: 'invalid' };
 }
+function formatServerOrigin(params) {
+    const visibleHost = normalizeHostForUrl(params.host, params.scheme);
+    return `${params.scheme}://${visibleHost}:${params.port}`;
+}
 function formatAutoAuthUrl(params) {
-    const visibleHost = normalizeHostForUrl(params.host);
-    return `http://${visibleHost}:${params.port}/?auth=${encodeURIComponent(params.authKey)}`;
+    return `${formatServerOrigin({
+        scheme: params.scheme ?? 'http',
+        host: params.host,
+        port: params.port,
+    })}/?auth=${encodeURIComponent(params.authKey)}`;
 }
-function normalizeHostForUrl(host) {
+function normalizeHostForUrl(host, scheme) {
     // Binding to 0.0.0.0/:: is common, but not a browsable "host".
-    if (host === '0.0.0.0' || host === '::')
+    // For HTTPS, preserve the certificate-matched bind host to avoid creating a hostname mismatch.
+    if (scheme === 'http' && (host === '0.0.0.0' || host === '::'))
         return 'localhost';
+    if (host.includes(':') && !host.startsWith('['))
+        return `[${host}]`;
     return host;
 }
 function generateAuthKey() {

package/dist/server/certificates.d.ts

@@ -0,0 +1,61 @@
+export declare const DEFAULT_SELF_SIGNED_CERT_DAYS = 3650;
+export type HttpsCertificateMaterial = {
+    cert: string;
+    key: string;
+    certPath: string;
+    keyPath: string;
+    matchedHost: string;
+    matchedHostPriority: number;
+    validTo: Date;
+};
+export type CertificateLookupEndpoint = Readonly<{
+    bindHost: string;
+    urlHost: string;
+}>;
+export type CertificateLookupDiagnostic = {
+    level: 'warn';
+    code: 'invalid_cert_file' | 'missing_key_file' | 'invalid_key_pair' | 'expired_or_not_yet_valid';
+    message: string;
+    certPath: string;
+    keyPath?: string;
+} | {
+    level: 'warn';
+    code: 'multiple_matching_certs';
+    message: string;
+    host: string;
+    certPaths: readonly string[];
+};
+export type CertificateLookupResult = {
+    kind: 'found';
+    certsDirAbs: string;
+    endpoint: CertificateLookupEndpoint;
+    certificate: HttpsCertificateMaterial;
+    diagnostics: readonly CertificateLookupDiagnostic[];
+} | {
+    kind: 'not_found';
+    certsDirAbs: string;
+    endpoint: CertificateLookupEndpoint;
+    diagnostics: readonly CertificateLookupDiagnostic[];
+};
+export type CreatedSelfSignedCertificate = {
+    host: string;
+    hosts: readonly string[];
+    days: number;
+    certsDirAbs: string;
+    certPath: string;
+    keyPath: string;
+    metadataPath: string;
+};
+export declare function getDefaultDomindsCertsDir(): string;
+export declare function findAutoHttpsCertificateForHost(params: {
+    host: string;
+    certsDirAbs?: string;
+    now?: Date;
+}): Promise<CertificateLookupResult>;
+export declare function createSelfSignedCertificate(params: {
+    host?: string;
+    altHosts?: readonly string[];
+    days?: number;
+    certsDirAbs?: string;
+    force?: boolean;
+}): Promise<CreatedSelfSignedCertificate>;