ds-harness-remote 0.4.12 → 0.4.13

package/dist/index.js

@@ -4059,6 +4059,13 @@ var MAX_DEVICE_NAME_LENGTH = 128;
 var MAX_DEVICE_PLATFORM_LENGTH = 64;
 var MAX_DEVICE_VERSION_LENGTH = 64;
 var MAX_AUTH_TOKEN_LENGTH = 8 * 1024;
+var HOST_REGISTRATION_CODE_TTL_MS = 10 * 6e4;
+var MAX_ACTIVE_TRANSFERS_PER_DIRECTION = 2;
+var TRANSFER_IDLE_MS = 2 * 6e4;
+var MAX_RPC_TEXT_INPUT_BYTES = 64 * 1024;
+var MAX_FILEVIEWER_RANGE_BYTES = 512 * 1024;
+var MIN_REPLAY_WINDOW_MS = 15 * 6e4;
+var MAX_ALPHA_STREAMS_PER_CONNECTION = 16;
 var SECURE_FRAGMENT_MAGIC = new Uint8Array([68, 83, 72, 70]);
 var SECURE_FRAGMENT_VERSION = 1;
 var SECURE_FRAGMENT_HEADER_BYTES = 17;
@@ -4116,6 +4123,52 @@ var rpcMethods = [
   "codex.app.transfer.read",
   "codex.app.transfer.close"
 ];
+var errorCodes = [
+  // Protocol / Version
+  "INVALID_MESSAGE",
+  "UNSUPPORTED_VERSION",
+  "CAPABILITY_NOT_SUPPORTED",
+  "METHOD_NOT_FOUND",
+  "METHOD_NOT_ALLOWED",
+  "REQUEST_CONFLICT",
+  "FRAME_TOO_LARGE",
+  "RATE_LIMITED",
+  // Auth / Device
+  "AUTH_REQUIRED",
+  "AUTH_INVALID",
+  "ACCOUNT_AUTH_REQUIRED",
+  "TOKEN_EXPIRED",
+  "DEVICE_NOT_FOUND",
+  "DEVICE_REVOKED",
+  "DEVICE_OWNERSHIP_REQUIRED",
+  "MEMBERSHIP_REQUIRED",
+  "PEER_IDENTITY_MISMATCH",
+  "HOST_REGISTRATION_CODE_NOT_FOUND",
+  "HOST_REGISTRATION_CODE_EXPIRED",
+  "HOST_REGISTRATION_CODE_CONSUMED",
+  // Connection / Transport
+  "HOST_OFFLINE",
+  "CONNECTION_NOT_FOUND",
+  "CONNECTION_FAILED",
+  "CONNECTION_REPLACED",
+  "P2P_FAILED",
+  "TURN_UNAVAILABLE",
+  "RELAY_UNAVAILABLE",
+  "SLOW_CONSUMER",
+  "SECURE_CHANNEL_FAILED",
+  // Harness
+  "HARNESS_UNAVAILABLE",
+  "HARNESS_VERSION_INCOMPATIBLE",
+  "RESPONSE_TOO_LARGE",
+  "SESSION_NOT_FOUND",
+  "SESSION_NOT_READY",
+  "AGENT_BUSY",
+  "PERMISSION_DENIED",
+  "PERMISSION_NOT_PENDING",
+  "RPC_TIMEOUT",
+  "FULL_RESYNC_REQUIRED",
+  "INTERNAL_ERROR"
+];
 var selectedTransports = ["lan", "p2p", "turn", "relay"];
 function normalizeSdpMLineIndex(value) {
   if (value === void 0)
@@ -4140,6 +4193,7 @@ function acceptNegotiatedCapabilities(offered, negotiated) {
 var rpcMethodSchema = external_exports.enum(rpcMethods);
 var messageTypeSchema = external_exports.enum(messageTypes);
 var controlFrameTypeSchema = external_exports.enum(controlFrameTypes);
+var errorCodeSchema = external_exports.enum(errorCodes);
 var uniqueStrings = (values) => new Set(values).size === values.length;
 var uniqueNumbers = (values) => new Set(values).size === values.length;
 var utf8Length = (value) => new TextEncoder().encode(value).byteLength;
@@ -4181,6 +4235,10 @@ var hostRegistrationCodeRequestSchema = external_exports.object({
   code: external_exports.string().regex(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/u),
   device: hostDeviceDescriptorSchema
 }).strict();
+var registerOwnedRoleRequestSchema = external_exports.object({
+  v: external_exports.literal(PROTOCOL_VERSION),
+  device: accountDeviceDescriptorSchema
+}).strict();
 var deviceRefreshRequestSchema = external_exports.object({
   deviceId: deviceIdSchema,
   refreshToken: authTokenSchema
@@ -13958,6 +14016,120 @@ async function waitForResponder(inner, noise) {
 
 // src/control-route.ts
 var CONTROL_RPC_PREFIX = "/ds-harness-remote";
+var ENDPOINT_SEGMENT_PATTERN = /^[A-Za-z0-9_$.-]+$/;
+var INVALID_REQUEST_RPC_ID = "invalid-request";
+function registerControlRoute(connection, handler, webServer) {
+  if (webServer !== void 0 && connection.requestRejection !== void 0) {
+    const dispose = webServer.register({
+      kind: "prefix",
+      path: CONTROL_RPC_PREFIX,
+      handler: (req, res) => handleControlRequest(connection, handler, req, res)
+    });
+    return async () => {
+      await dispose();
+    };
+  }
+  return connection.rpc.handle(CONTROL_RPC_PREFIX, handler, {
+    authority: "loopback"
+  });
+}
+async function handleControlRequest(connection, handler, req, res) {
+  const rejection = connection.requestRejection?.(req);
+  if (rejection !== void 0) {
+    res.writeHead(rejection);
+    res.end(rejection === 401 ? "unauthorized" : "forbidden");
+    return;
+  }
+  const endpoint = endpointFromPath(CONTROL_RPC_PREFIX, new URL(req.url ?? "/", "http://dsh.internal").pathname);
+  if (req.method !== "POST" || endpoint === void 0) {
+    writeText(res, 404, "not found");
+    return;
+  }
+  if (contentType(req.headers) !== "application/json") {
+    writeText(res, 415, "content type must be application/json");
+    return;
+  }
+  let body;
+  try {
+    body = await readJsonBody(req);
+  } catch {
+    writeText(res, 400, "body is not JSON");
+    return;
+  }
+  const message = clientRequest(body);
+  if (message === void 0) {
+    writeJson(res, 200, errorResponse(rpcId(body), {
+      code: "gateway/bad-request",
+      message: "invalid client-request message",
+      details: { issues: [] }
+    }));
+    return;
+  }
+  if (message.method !== endpoint) {
+    writeJson(res, 200, errorResponse(message.rpcId, {
+      code: "gateway/bad-request",
+      message: `method ${JSON.stringify(message.method)} does not match endpoint ${JSON.stringify(endpoint)}`,
+      details: { issues: [] }
+    }));
+    return;
+  }
+  try {
+    const result = await handler(endpoint, message.payload, requestSignal(req));
+    writeJson(res, 200, fullResponse(message.rpcId, result));
+  } catch (error) {
+    writeText(res, 500, `handler failure: ${String(error)}`);
+  }
+}
+function endpointFromPath(channel, pathname) {
+  if (!pathname.startsWith(`${channel}/`)) return void 0;
+  const endpoint = pathname.slice(channel.length + 1);
+  if (endpoint.split("/").some((segment) => segment === "" || segment === "." || segment === ".." || !ENDPOINT_SEGMENT_PATTERN.test(segment))) {
+    return void 0;
+  }
+  return endpoint;
+}
+function contentType(headers) {
+  const raw = headers["content-type"];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  return value?.split(";", 1)[0]?.trim().toLowerCase();
+}
+async function readJsonBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function requestSignal(req) {
+  const abort = new AbortController();
+  req.on("close", () => {
+    if (!req.complete) abort.abort();
+  });
+  return abort.signal;
+}
+function clientRequest(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const record6 = value;
+  if (record6.type !== "client-request" || typeof record6.rpcId !== "string" || typeof record6.method !== "string") return void 0;
+  return { type: "client-request", rpcId: record6.rpcId, method: record6.method, payload: record6.payload };
+}
+function rpcId(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return INVALID_REQUEST_RPC_ID;
+  const record6 = value;
+  return typeof record6.rpcId === "string" ? record6.rpcId : INVALID_REQUEST_RPC_ID;
+}
+function errorResponse(rpcId2, error) {
+  return fullResponse(rpcId2, { ok: false, error });
+}
+function fullResponse(rpcId2, result) {
+  return { type: "server-response", rpcId: rpcId2, result };
+}
+function writeJson(res, status2, body) {
+  res.writeHead(status2, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeText(res, status2, body) {
+  res.writeHead(status2);
+  res.end(body);
+}
 
 // src/ids.ts
 import { randomBytes as randomBytes6 } from "node:crypto";
@@ -14310,11 +14482,168 @@ function base64ToBytes2(value) {
   return bytes;
 }
 
+// src/session-format-compat.ts
+function normalizeLegacySessionGatewayValue(endpoint, value) {
+  if (endpoint === "session/page") return normalizePage(value);
+  if (endpoint === "session/follow") return normalizeFollowFrame(value);
+  return value;
+}
+function normalizeFollowFrame(value) {
+  if (!isRecord3(value)) return value;
+  if (value.type === "snapshot") {
+    return {
+      ...value,
+      header: normalizeHeader(value.header),
+      records: normalizeRecords(value.records),
+      ...value.assistantStream === void 0 ? { assistantStream: { revision: 0 } } : {}
+    };
+  }
+  return normalizeEntry(value);
+}
+function normalizePage(value) {
+  if (!isRecord3(value)) return value;
+  return { ...value, records: normalizeRecords(value.records) };
+}
+function normalizeRecords(value) {
+  if (!Array.isArray(value)) return value;
+  const records = [];
+  let previousSeq;
+  for (const record6 of value) {
+    if (!isEventEntry(record6)) continue;
+    const seq = entrySeq(record6);
+    if (previousSeq !== void 0 && seq !== void 0 && seq > previousSeq + 1) {
+      for (let fillerSeq = previousSeq + 1; fillerSeq < seq; fillerSeq += 1) {
+        records.push(createLegacyGapRecord(fillerSeq, record6));
+      }
+    }
+    records.push(normalizeEntry(record6));
+    if (seq !== void 0) previousSeq = seq;
+  }
+  return records;
+}
+function normalizeEntry(value) {
+  if (!isEventEntry(value)) return value;
+  return { ...value, event: normalizeEvent(value.event) };
+}
+function entrySeq(value) {
+  if (!isEventEntry(value)) return void 0;
+  return isEventSeq(value.event.seq) ? value.event.seq : void 0;
+}
+function createLegacyGapRecord(seq, nextRecord) {
+  return {
+    type: "event",
+    event: {
+      type: "legacy/session-gap",
+      seq,
+      time: eventTime(nextRecord),
+      ignorable: true,
+      data: {}
+    }
+  };
+}
+function eventTime(value) {
+  if (!isEventEntry(value)) return 0;
+  return typeof value.event.time === "number" && Number.isSafeInteger(value.event.time) ? value.event.time : 0;
+}
+function isEventEntry(value) {
+  return isRecord3(value) && value.type === "event" && isRecord3(value.event);
+}
+function normalizeHeader(value) {
+  if (!isRecord3(value)) return value;
+  const next = {
+    ...value,
+    version: 3,
+    ...value.delegationDepth === void 0 ? { delegationDepth: 0 } : {}
+  };
+  return next.agentPreset === "code" ? { ...next, agentPreset: "ptc" } : next;
+}
+function normalizeEvent(value) {
+  if (!isRecord3(value)) return value;
+  let next = value;
+  const type = normalizeEventType(value.type);
+  if (type !== value.type) next = { ...next, type };
+  if (type === "assistant/message" && Object.hasOwn(next, "sourceEventSeqs")) {
+    const { sourceEventSeqs: _sourceEventSeqs, ...rest } = next;
+    next = rest;
+  }
+  const data = normalizeEventData(type, next.data);
+  if (data !== next.data) next = { ...next, data };
+  const surfaceOp = normalizeSurfaceOp(next.surfaceOp);
+  if (surfaceOp !== next.surfaceOp) next = { ...next, surfaceOp };
+  return next;
+}
+function normalizeEventType(value) {
+  if (value === "tool/code-dispatch-start") return "tool/ptc-dispatch-start";
+  if (value === "tool/code-dispatch") return "tool/ptc-dispatch";
+  return value;
+}
+function normalizeEventData(type, value) {
+  if (!isRecord3(value)) return value;
+  if (type === "request/header") return normalizeRequestHeaderData(value);
+  if (type === "agent-preset/selected" && value.agentPreset === "code") return { ...value, agentPreset: "ptc" };
+  if (type === "user/message") return normalizeMessage(value);
+  if (type === "agent/inbox/spliced" && Array.isArray(value.inserted)) {
+    return { ...value, inserted: value.inserted.map((item) => normalizeMessage(item)) };
+  }
+  if (type === "session/title-llm-request" && Array.isArray(value.messages)) {
+    return { ...value, messages: value.messages.map((item) => normalizeMessage(item)) };
+  }
+  return value;
+}
+function normalizeRequestHeaderData(value) {
+  if (!isRecord3(value.header)) return value;
+  const header = normalizeRequestHeader(value.header);
+  return header === value.header ? value : { ...value, header };
+}
+function normalizeRequestHeader(value) {
+  let changed = false;
+  const next = {};
+  for (const [key, field] of Object.entries(value)) {
+    if (key === "system") {
+      changed = true;
+      continue;
+    }
+    if (key === "tools" && Array.isArray(field) && field.length === 0) {
+      changed = true;
+      continue;
+    }
+    if (key === "adapterDefaults" && isRecord3(field) && Object.keys(field).length === 0) {
+      changed = true;
+      continue;
+    }
+    next[key] = field;
+  }
+  return changed ? next : value;
+}
+function normalizeMessage(value) {
+  if (!isRecord3(value) || !isRecord3(value.source)) return value;
+  if (value.source.kind !== "plugin" || value.source.plugin !== "tools-code-mode") return value;
+  return { ...value, source: { ...value.source, plugin: "tools-ptc" } };
+}
+function normalizeSurfaceOp(value) {
+  if (!isRecord3(value) || value.op !== "replace") return value;
+  const { start, end, ...rest } = value;
+  if (start === void 0 && end === void 0) return value;
+  return {
+    ...rest,
+    op: "replace",
+    ...start === void 0 ? {} : { startSeq: start },
+    ...end === void 0 ? {} : { endSeq: end }
+  };
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isEventSeq(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
+}
+
 // src/remote-typert-gateway.ts
 var DIRECT_REMOTE_CALL_BYTES2 = 2 * 1024 * 1024;
 var RemoteTypertGateway2 = class {
-  constructor(client) {
+  constructor(client, compatibility) {
     this.client = client;
+    this.compatibility = compatibility;
   }
   async invoke(request) {
     const result = await this.dispatch(
@@ -14339,7 +14668,11 @@ var RemoteTypertGateway2 = class {
         response = await this.callTransferred(encoded, signal);
       }
     }
-    return parseRpcResult(response);
+    const result = parseRpcResult(response);
+    if (result.ok && this.compatibility === "legacy-to-v3") {
+      return { ...result, value: normalizeLegacySessionGatewayValue(endpoint, result.value) };
+    }
+    return result;
   }
   async open(endpoint, payload, signal) {
     const streamId = uuidV7();
@@ -14358,11 +14691,13 @@ var RemoteTypertGateway2 = class {
       unsubscribeClose();
       throw error;
     }
-    return this.iterate(streamId, queue, unsubscribe, unsubscribeClose, signal, onAbort);
+    return this.iterate(streamId, endpoint, queue, unsubscribe, unsubscribeClose, signal, onAbort);
   }
-  async *iterate(streamId, queue, unsubscribe, unsubscribeClose, signal, onAbort) {
+  async *iterate(streamId, endpoint, queue, unsubscribe, unsubscribeClose, signal, onAbort) {
     try {
-      yield* queue;
+      for await (const value of queue) {
+        yield this.compatibility === "legacy-to-v3" ? normalizeLegacySessionGatewayValue(endpoint, value) : value;
+      }
     } finally {
       signal.removeEventListener("abort", onAbort);
       unsubscribe();
@@ -14482,16 +14817,16 @@ function routeStreamEvent2(event, streamId, queue) {
     queue.fail(remoteFailure({
       code: typeof failure2?.code === "string" ? failure2.code : "internal",
       message: typeof failure2?.message === "string" ? failure2.message : "The remote Harness stream failed.",
-      details: isRecord3(failure2?.details) ? failure2.details : {}
+      details: isRecord4(failure2?.details) ? failure2.details : {}
     }));
   } else {
     queue.close();
   }
 }
 function parseRpcResult(value) {
-  if (!isRecord3(value)) throw new Error("The remote Host returned an invalid Gateway result.");
+  if (!isRecord4(value)) throw new Error("The remote Host returned an invalid Gateway result.");
   if (value.ok === true) return Object.hasOwn(value, "value") ? { ok: true, value: value.value } : { ok: true };
-  if (value.ok !== false || !isRecord3(value.error) || typeof value.error.code !== "string" || typeof value.error.message !== "string" || !isRecord3(value.error.details)) {
+  if (value.ok !== false || !isRecord4(value.error) || typeof value.error.code !== "string" || typeof value.error.message !== "string" || !isRecord4(value.error.details)) {
     throw new Error("The remote Host returned an invalid Gateway failure.");
   }
   return {
@@ -14525,7 +14860,7 @@ function base64ToBytes3(value) {
   if (bytesToBase643(bytes) !== value) throw new Error("The remote Host returned non-canonical Harness Remote transfer data.");
   return bytes;
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasErrorCode(error, code) {
@@ -15446,7 +15781,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       this.broadcastRcHost({ type: "host/session-status", sessionId, running: args[1] });
     } else if (event === "api-session/removed" && sessionId !== void 0) {
       this.broadcastRcHost({ type: "host/session-removed", sessionId });
-    } else if (event === "api-session/added" && isRecord4(args[0])) {
+    } else if (event === "api-session/added" && isRecord5(args[0])) {
       const summary = args[0];
       this.broadcastRcHost({
         type: "host/session-added",
@@ -15831,7 +16166,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   createApiProxy() {
     const call = (endpoint) => async (request, signal) => {
-      const payload = endpoint === "session.prompt" && isRecord4(request.payload) ? { ...request.payload, requestId: String(request.rpcId) } : request.payload;
+      const payload = endpoint === "session.prompt" && isRecord5(request.payload) ? { ...request.payload, requestId: String(request.rpcId) } : request.payload;
       const result = await this.dispatch(rcEndpoint(endpoint), { args: { request: payload } }, signal ?? new AbortController().signal);
       return {
         rpcId: request.rpcId,
@@ -15915,8 +16250,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       queue.close();
     }
   }
-  broadcastRcMux(payload, rpcId = `codex-mux:${Date.now()}:${Math.random()}`) {
-    for (const queue of this.rcMuxStreams) queue.push({ rpcId, payload });
+  broadcastRcMux(payload, rpcId2 = `codex-mux:${Date.now()}:${Math.random()}`) {
+    for (const queue of this.rcMuxStreams) queue.push({ rpcId: rpcId2, payload });
   }
   broadcastRcHost(payload) {
     const frame = { rpcId: `codex-host:${Date.now()}:${Math.random()}`, payload };
@@ -16356,7 +16691,7 @@ function collectImageBlocks(value, output = []) {
     for (const item of value) collectImageBlocks(item, output);
     return output;
   }
-  if (!isRecord4(value)) return output;
+  if (!isRecord5(value)) return output;
   if (value.type === "image") output.push(value);
   for (const [key, child] of Object.entries(value)) {
     if (key === "attachment") continue;
@@ -16686,7 +17021,7 @@ function codexPromptInput(content) {
   if (content.length === 0 || content.length > MAX_CODEX_PROMPT_PARTS) return void 0;
   const input2 = [];
   for (const value of content) {
-    if (!isRecord4(value)) return void 0;
+    if (!isRecord5(value)) return void 0;
     if (value.type === "text") {
       if (typeof value.text !== "string" || value.text.length === 0 || value.text.length > MAX_CODEX_PROMPT_TEXT) return void 0;
       input2.push({ type: "text", text: value.text });
@@ -16939,12 +17274,12 @@ function errorCode(error) {
   return "code" in error && typeof error.code === "string" ? error.code : void 0;
 }
 function errorDetails(error) {
-  return "details" in error && isRecord4(error.details) ? error.details : {};
+  return "details" in error && isRecord5(error.details) ? error.details : {};
 }
 function record2(value) {
-  return isRecord4(value) ? value : {};
+  return isRecord5(value) ? value : {};
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function array(value) {
@@ -17158,7 +17493,7 @@ function normalizeServerUrl(value) {
 }
 
 // src/version.ts
-var PLUGIN_VERSION = "0.4.12";
+var PLUGIN_VERSION = "0.4.13";
 
 // src/server-api.ts
 var TERMINAL_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/u;
@@ -17677,7 +18012,7 @@ var TypertGatewaySwitch = class {
     if (normalized !== void 0) return normalized;
     const source = error instanceof Error ? error : new Error("The Harness Gateway rejected the request.");
     const code = "code" in source && typeof source.code === "string" ? source.code : "internal";
-    const details = "details" in source && isRecord5(source.details) ? source.details : {};
+    const details = "details" in source && isRecord6(source.details) ? source.details : {};
     return { code, message: source.message, details };
   }
 };
@@ -17686,7 +18021,7 @@ function requestFromCarrier(endpoint, payload, signal) {
   if (segments.length !== 2 || segments.some((segment) => segment.length === 0)) {
     throw new Error("The Harness Gateway endpoint is invalid.");
   }
-  if (!isRecord5(payload) || !isRecord5(payload.args)) {
+  if (!isRecord6(payload) || !isRecord6(payload.args)) {
     throw new Error("The Harness Gateway payload is invalid.");
   }
   return { namespace: segments[0], method: segments[1], args: payload.args, signal };
@@ -17701,7 +18036,7 @@ function isLocalOnlyEndpoint(endpoint) {
 function isRemoteCommandMethod(method) {
   return REMOTE_COMMAND_METHODS.includes(method);
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -18805,10 +19140,8 @@ var ClientModeRuntime = class {
       fingerprint: this.identity.fingerprint
     });
   }
-  registerControl(connection) {
-    return connection.rpc.handle(CONTROL_RPC_PREFIX, (endpoint, payload, signal) => this.handleControl(endpoint, payload, signal), {
-      authority: "loopback"
-    });
+  registerControl(connection, webServer) {
+    return registerControlRoute(connection, (endpoint, payload, signal) => this.handleControl(endpoint, payload, signal), webServer);
   }
   status() {
     const targetStatus = this.gatewaySwitch.supportsCarrier() ? this.gatewaySwitch.status() : this.proxySwitch?.status() ?? this.gatewaySwitch.status();
@@ -18989,9 +19322,9 @@ var ClientModeRuntime = class {
   async openRemoteWorkspace(targetDeviceId, path, signal) {
     if (path.trim() === "") throw new ClientModeError("INVALID_MESSAGE", "A remote working directory is required.");
     const remote = await this.ensureConnected(targetDeviceId, signal);
-    this.assertRemoteCompatible(remote);
+    const transport = this.selectHarnessRemoteTransport(remote);
     let workspace;
-    if (remote.features.remoteGateway) {
+    if (transport === "remoteGateway") {
       workspace = await new RemoteTypertGateway2(remote.client).invoke({
         namespace: "workspace",
         method: "create",
@@ -19007,7 +19340,7 @@ var ClientModeRuntime = class {
       workspace = unwrapNativeResult(response);
     }
     await this.closeCodexVirtual();
-    this.selectRemoteTarget(remote);
+    this.selectRemoteTarget(remote, transport);
     const workspaceId = workspaceRecordId(workspace.workspace);
     this.pendingWorkspaceSelection = { targetDeviceId: remote.target.deviceId, workspaceId };
     this.logger.info("Remote workspace opened", { targetDeviceId: shortId(remote.target.deviceId) });
@@ -19027,7 +19360,7 @@ var ClientModeRuntime = class {
     if (!remote.features.codex) {
       throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The selected Host does not provide CodeX workspaces.");
     }
-    this.assertRemoteCompatible(remote);
+    this.assertLocalHarnessCarrierAvailable();
     const virtual = CodexVirtualHarness.remote(remote.client, {
       deviceId: remote.target.deviceId,
       name: remote.target.name
@@ -19060,7 +19393,7 @@ var ClientModeRuntime = class {
     if (!remote.features.codex) {
       throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The selected Host does not provide CodeX workspaces.");
     }
-    this.assertRemoteCompatible(remote);
+    this.assertLocalHarnessCarrierAvailable();
     const result = record3(await new CodexRemoteClient(remote.client).request("project/create", {
       name: remoteWorkspaceTitle(trimmedPath),
       roots: [{ path: trimmedPath }],
@@ -19148,10 +19481,10 @@ var ClientModeRuntime = class {
       }
     }
     stream.unsubscribe = remote.client.onEvent((event) => {
-      if (event.event === "codex.app.frame" && isRecord6(event.data) && event.data.streamId === value.streamId) {
+      if (event.event === "codex.app.frame" && isRecord7(event.data) && event.data.streamId === value.streamId) {
         this.appendCodexFrame(stream, event.data);
       }
-      if (event.event === "codex.app.stream.closed" && isRecord6(event.data) && event.data.streamId === value.streamId) {
+      if (event.event === "codex.app.stream.closed" && isRecord7(event.data) && event.data.streamId === value.streamId) {
         stream.closed = typeof event.data.reason === "string" ? event.data.reason : "closed";
         stream.wake();
       }
@@ -19178,7 +19511,7 @@ var ClientModeRuntime = class {
     stream.wake();
   };
   appendCodexFrame(stream, data) {
-    if (!isRecord6(data) || !isRecord6(data.frame) || typeof data.frame.method !== "string") return;
+    if (!isRecord7(data) || !isRecord7(data.frame) || typeof data.frame.method !== "string") return;
     if (stream.frames.length >= 256) {
       stream.closed = "overflow";
     } else {
@@ -19235,18 +19568,25 @@ var ClientModeRuntime = class {
       await stream.close();
     }));
   }
-  selectRemoteTarget(remote) {
+  selectRemoteTarget(remote, transport = this.selectHarnessRemoteTransport(remote)) {
     const target = { deviceId: remote.target.deviceId, name: remote.target.name };
-    if (this.gatewaySwitch.supportsCarrier()) {
-      this.gatewaySwitch.selectRemote(new RemoteTypertGateway2(remote.client), void 0, target);
+    if (transport === "remoteGateway") {
+      this.gatewaySwitch.selectRemote(this.remoteTypertGateway(remote), void 0, target);
       return;
     }
-    this.proxySwitch.selectRemote(new RemoteHarnessApiProxy(remote.client).api, target);
+    this.proxySwitch?.selectRemote(new RemoteHarnessApiProxy(remote.client).api, target);
     this.gatewaySwitch.selectRemote((request) => invokeRemoteCommand(remote.client, request), {
       execute: true,
       list: remote.features.commandList
     }, target);
   }
+  remoteTypertGateway(remote) {
+    const localSessionGeneration = harnessSessionGeneration(this.host?.localHarnessVersion?.());
+    return new RemoteTypertGateway2(
+      remote.client,
+      localSessionGeneration === "v3" && remote.features.sessionFormat !== 3 ? "legacy-to-v3" : void 0
+    );
+  }
   selectCodexTarget(virtual, remote) {
     const target = { deviceId: remote.target.deviceId, name: remote.target.name };
     if (this.gatewaySwitch.supportsCarrier()) {
@@ -19262,20 +19602,29 @@ var ClientModeRuntime = class {
     await virtual?.close();
   }
   assertRemoteCompatible(remote) {
+    this.selectHarnessRemoteTransport(remote);
+  }
+  selectHarnessRemoteTransport(remote) {
     const localRemoteGateway = this.gatewaySwitch.supportsCarrier();
+    const localSessionGeneration = harnessSessionGeneration(this.host?.localHarnessVersion?.());
     if (localRemoteGateway && remote.features.remoteGateway) {
-      const localSessionGeneration = harnessSessionGeneration(this.host?.localHarnessVersion?.());
-      const remoteSessionGeneration = remote.features.sessionFormat === 3 ? "v3" : "legacy";
-      if (localSessionGeneration === remoteSessionGeneration) return;
+      if (localSessionGeneration === "v3" || remote.features.sessionFormat !== 3) return "remoteGateway";
       throw new ClientModeError(
         "HARNESS_VERSION_INCOMPATIBLE",
-        `The local and remote Harness Session formats differ (${localSessionGeneration} vs ${remoteSessionGeneration}).`
+        "The selected Host uses Harness Session V3, but this Client uses the legacy Typert Remote session format."
       );
     }
-    if (!localRemoteGateway && this.proxySwitch !== void 0 && remote.features.apiProxy) return;
+    if (this.proxySwitch !== void 0 && remote.features.apiProxy) return "apiProxy";
     throw new ClientModeError(
       "HARNESS_VERSION_INCOMPATIBLE",
-      localRemoteGateway ? "The selected Host does not provide the Harness v0.1.2 Typert Remote Gateway transport." : "The selected Host does not provide the legacy Harness ApiProxy transport."
+      localRemoteGateway ? "The selected Host does not provide a compatible Harness Typert Remote Gateway transport." : "The selected Host does not provide the legacy Harness ApiProxy transport."
+    );
+  }
+  assertLocalHarnessCarrierAvailable() {
+    if (this.gatewaySwitch.supportsCarrier() || this.proxySwitch !== void 0) return;
+    throw new ClientModeError(
+      "HARNESS_VERSION_INCOMPATIBLE",
+      "This Client does not provide a compatible Harness carrier for the selected remote workspace."
     );
   }
   async connect(targetDeviceId, signal) {
@@ -19654,20 +20003,20 @@ function record3(value) {
   }
   return value;
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function ok2(value) {
   return { ok: true, value };
 }
 async function invokeRemoteCommand(client, request) {
-  const rpcId = uuidV7();
+  const rpcId2 = uuidV7();
   const response = await client.rpc("harness.api.call", {
     method: `${request.namespace}.${request.method}`,
-    rpcId,
+    rpcId: rpcId2,
     payload: request.args
   }, request.signal);
-  if (response.rpcId !== rpcId) {
+  if (response.rpcId !== rpcId2) {
     throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid command response.");
   }
   return unwrapNativeResult(response);
@@ -19679,11 +20028,11 @@ async function readRemoteWorkspaceBaseline(gateway, signal) {
   const iterator = source[Symbol.asyncIterator]();
   try {
     const first = await iterator.next();
-    if (first.done || !isRecord6(first.value) || first.value.type !== "baseline" || !isRecord6(first.value.value) || !Array.isArray(first.value.value.items)) {
+    if (first.done || !isRecord7(first.value) || first.value.type !== "baseline" || !isRecord7(first.value.value) || !Array.isArray(first.value.value.items)) {
       throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid Workspace baseline.");
     }
     return first.value.value.items.map((item) => {
-      if (!isRecord6(item) || typeof item.workspaceId !== "string" || typeof item.path !== "string" || typeof item.title !== "string") {
+      if (!isRecord7(item) || typeof item.workspaceId !== "string" || typeof item.path !== "string" || typeof item.title !== "string") {
         throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid Workspace row.");
       }
       return { workspaceId: item.workspaceId, path: item.path, title: item.title };
@@ -19748,19 +20097,20 @@ async function probeRemoteHostFeatures(client, clientVersion) {
     if (error instanceof Error && "code" in error && error.code === "METHOD_NOT_FOUND") return fallback;
     throw error;
   }
-  if (!isRecord6(value) || !Array.isArray(value.capabilities) || value.capabilities.some((capability) => typeof capability !== "string")) {
+  if (!isRecord7(value) || !Array.isArray(value.capabilities) || value.capabilities.some((capability) => typeof capability !== "string")) {
     throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned invalid transport capabilities.");
   }
   const capabilities = new Set(value.capabilities);
   const apiProxy = capabilities.has("harness.api.v1");
   const remoteV1 = capabilities.has("harness.remote.v1");
   const remoteV3 = capabilities.has("harness.remote.v3");
+  const codex = capabilities.has("codex.appserver.v1");
   if (remoteV1 && remoteV3) {
     throw new ClientModeError("INVALID_MESSAGE", "The remote Host advertised conflicting Harness Session formats.");
   }
   const sessionFormat = remoteV3 ? 3 : void 0;
   const remoteGateway = remoteV3 || remoteV1;
-  if (!apiProxy && !remoteGateway) {
+  if (!apiProxy && !remoteGateway && !codex) {
     throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The remote Host exposes no supported Harness transport.");
   }
   return {
@@ -19769,7 +20119,7 @@ async function probeRemoteHostFeatures(client, clientVersion) {
     apiProxy,
     remoteGateway,
     ...sessionFormat === void 0 ? {} : { sessionFormat },
-    codex: capabilities.has("codex.appserver.v1")
+    codex
   };
 }
 async function waitForCodexFrames(stream, signal) {
@@ -20086,10 +20436,8 @@ var PluginControlRuntime = class {
     this.client = client;
     this.host = host;
   }
-  register(connection) {
-    return connection.rpc.handle(CONTROL_RPC_PREFIX, (endpoint, payload, signal) => this.handle(endpoint, payload, signal), {
-      authority: "loopback"
-    });
+  register(connection, webServer) {
+    return registerControlRoute(connection, (endpoint, payload, signal) => this.handle(endpoint, payload, signal), webServer);
   }
   async handle(endpoint, payload, signal) {
     try {
@@ -20303,11 +20651,11 @@ function editableConfig(config) {
     }
   };
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function record4(value) {
-  if (!isRecord7(value)) throw new ClientModeError("INVALID_MESSAGE", "The control request payload is invalid.");
+  if (!isRecord8(value)) throw new ClientModeError("INVALID_MESSAGE", "The control request payload is invalid.");
   return value;
 }
 function ok3(value) {
@@ -20628,7 +20976,7 @@ var RpcRouter = class {
       });
       return createRpcResponse(request.id, result);
     } catch (error) {
-      const response = errorResponse(request.id, error);
+      const response = errorResponse2(request.id, error);
       this.logger?.warn("host rpc failed", {
         method: request.payload.method,
         durationMs: Math.round(performance.now() - startedAt),
@@ -20727,7 +21075,7 @@ var RpcRouter = class {
     return this.codex;
   }
 };
-function errorResponse(requestId, error) {
+function errorResponse2(requestId, error) {
   const code = safeErrorCode(error);
   if (error instanceof RpcError) return createRpcError(requestId, code, error.message, error.details, error.retryable);
   return createRpcError(
@@ -21920,8 +22268,8 @@ var HARNESS_API_ALLOWLIST = [
   "credentials.unset"
 ];
 var NATIVE_CALL_TIMEOUT_MS = 3e4;
-var MAX_ACTIVE_API_TRANSFERS = 2;
-var API_TRANSFER_IDLE_MS = 2 * 6e4;
+var MAX_ACTIVE_API_TRANSFERS = MAX_ACTIVE_TRANSFERS_PER_DIRECTION;
+var API_TRANSFER_IDLE_MS = TRANSFER_IDLE_MS;
 var INLINE_TRANSFER_RESPONSE_BYTES = 2 * 1024 * 1024;
 var SESSION_HISTORY_PAGE_SIZES = [50, 30, 20, 12, 6, 3, 1];
 var HarnessApiBridge = class {
@@ -21998,9 +22346,9 @@ var HarnessApiBridge = class {
     const value = await listRemoteDirectory(payload.path, signal);
     return { rpcId: params.rpcId, result: { ok: true, value } };
   }
-  describeFallback(rpcId) {
+  describeFallback(rpcId2) {
     return {
-      rpcId,
+      rpcId: rpcId2,
       result: {
         ok: true,
         value: {
@@ -22218,8 +22566,8 @@ var HarnessApiBridge = class {
     }
   }
   deleteRespondable(value) {
-    for (const [rpcId, correlation] of this.respondable) {
-      if (correlation === value) this.respondable.delete(rpcId);
+    for (const [rpcId2, correlation] of this.respondable) {
+      if (correlation === value) this.respondable.delete(rpcId2);
     }
   }
 };
@@ -22406,9 +22754,9 @@ function sanitizeModelDiscoveryResponse(response, settingsNs) {
   if (typeof result === "object" && result !== null && "ok" in result && result.ok === true) return response;
   return modelDiscoveryFailure(response.rpcId, settingsNs);
 }
-function modelDiscoveryFailure(rpcId, settingsNs) {
+function modelDiscoveryFailure(rpcId2, settingsNs) {
   return {
-    rpcId,
+    rpcId: rpcId2,
     result: {
       ok: false,
       error: {
@@ -22468,15 +22816,15 @@ function frameSessionId(frame) {
   const payload = frame.payload;
   return typeof payload.sessionId === "string" && payload.sessionId.length > 0 ? payload.sessionId : void 0;
 }
-function callSessionHistory(callWithTimeout, payload, rpcId) {
+function callSessionHistory(callWithTimeout, payload, rpcId2) {
   const fallbackPageSizes = sessionHistoryFallbackPageSizes(payloadMaxMessages(payload));
-  return callHistoryWithRetry(callWithTimeout, payload, rpcId, fallbackPageSizes);
+  return callHistoryWithRetry(callWithTimeout, payload, rpcId2, fallbackPageSizes);
 }
-async function callHistoryWithRetry(callWithTimeout, payload, rpcId, pageSizes) {
+async function callHistoryWithRetry(callWithTimeout, payload, rpcId2, pageSizes) {
   for (const maxMessages of pageSizes) {
     const requestPayload = historyRequestPayload(payload, maxMessages);
     const response = await callWithTimeout(requestPayload);
-    const request = createRpcResponse(rpcId, response.result);
+    const request = createRpcResponse(rpcId2, response.result);
     if (encodeMessage(request).byteLength <= MAX_SECURE_MESSAGE_BYTES) return response;
     if (maxMessages === pageSizes[pageSizes.length - 1]) {
       throw new RpcError(
@@ -22582,9 +22930,8 @@ var transferReadSchema2 = external_exports.object({
 var directoryListSchema2 = external_exports.object({
   path: external_exports.string().min(1).max(4096).optional()
 }).strict();
-var MAX_ACTIVE_STREAMS = 16;
-var MAX_ACTIVE_TRANSFERS = 2;
-var TRANSFER_IDLE_MS = 2 * 6e4;
+var MAX_ACTIVE_STREAMS = MAX_ALPHA_STREAMS_PER_CONNECTION;
+var MAX_ACTIVE_TRANSFERS = MAX_ACTIVE_TRANSFERS_PER_DIRECTION;
 var INLINE_TRANSFER_RESPONSE_BYTES2 = 2 * 1024 * 1024;
 var HARNESS_REMOTE_ALLOWLIST = [
   "$events",
@@ -22884,13 +23231,13 @@ function needsDirectoryFallback(result) {
 }
 function requestArgs(payload) {
   const root = record5(payload);
-  const args = isRecord8(root.args) ? root.args : root;
+  const args = isRecord9(root.args) ? root.args : root;
   return record5(args.request ?? args._request ?? args);
 }
 function record5(value) {
-  return isRecord8(value) ? value : {};
+  return isRecord9(value) ? value : {};
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -23084,7 +23431,7 @@ var CodexAppServerClient = class {
       this.handleProcessFailure("CODEX_INVALID_RESPONSE", new Error("Codex App Server emitted invalid JSON."));
       return;
     }
-    if (!isRecord9(value)) {
+    if (!isRecord10(value)) {
       this.handleProcessFailure("CODEX_INVALID_RESPONSE", new Error("Codex App Server emitted an invalid message."));
       return;
     }
@@ -23129,12 +23476,12 @@ var CodexAppServerClient = class {
   }
 };
 function safeUpstreamError(value) {
-  if (!isRecord9(value) || typeof value.message !== "string") return "Codex App Server rejected the request.";
+  if (!isRecord10(value) || typeof value.message !== "string") return "Codex App Server rejected the request.";
   const message = value.message.toLowerCase();
   if (message.includes("active writer")) return "Codex thread already has an active writer.";
   return message.includes("not initialized") ? "Codex App Server is not initialized." : "Codex App Server rejected the request.";
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -23266,9 +23613,8 @@ var transferChunkSchema3 = external_exports.object({
 }).strict();
 var transferIdSchema3 = external_exports.object({ transferId: external_exports.string().uuid() }).strict();
 var transferReadSchema3 = external_exports.object({ transferId: external_exports.string().uuid(), index: external_exports.number().int().nonnegative() }).strict();
-var MAX_ACTIVE_STREAMS2 = 16;
-var MAX_ACTIVE_TRANSFERS2 = 2;
-var TRANSFER_IDLE_MS2 = 2 * 6e4;
+var MAX_ACTIVE_STREAMS2 = MAX_ALPHA_STREAMS_PER_CONNECTION;
+var MAX_ACTIVE_TRANSFERS2 = MAX_ACTIVE_TRANSFERS_PER_DIRECTION;
 var INLINE_TRANSFER_RESPONSE_BYTES3 = 2 * 1024 * 1024;
 var CodexPeerBridge = class {
   constructor(domain, context, publish, logger) {
@@ -23482,7 +23828,7 @@ var CodexPeerBridge = class {
     await this.domain.detachPeer(this.context.connectionId);
   }
   pruneTransfers() {
-    const staleBefore = Date.now() - TRANSFER_IDLE_MS2;
+    const staleBefore = Date.now() - TRANSFER_IDLE_MS;
     for (const [id2, transfer] of this.incomingTransfers) {
       if (transfer.touchedAt < staleBefore) this.incomingTransfers.delete(id2);
     }
@@ -23504,15 +23850,15 @@ function decodeCanonicalBase643(value) {
   }
   return decoded;
 }
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function safeErrorCode2(error) {
-  if (isRecord10(error) && typeof error.code === "string") return error.code;
+  if (isRecord11(error) && typeof error.code === "string") return error.code;
   return "UNKNOWN";
 }
 function safeMethod(input2) {
-  return isRecord10(input2) && typeof input2.method === "string" ? input2.method : "invalid";
+  return isRecord11(input2) && typeof input2.method === "string" ? input2.method : "invalid";
 }
 function concatChunks3(chunks, totalBytes) {
   const output = new Uint8Array(totalBytes);
@@ -23929,14 +24275,14 @@ var CodexRemoteDomain = class {
       await this.assertResultThreadAllowed(result);
       if (codexPermissionPresetFromResponse(result) !== params.permissionPreset) {
         await this.callUpstream("thread/settings/update", { threadId, ...settings });
-        result = { ...isRecord11(result) ? result : {}, ...settings, sandbox: settings.sandboxPolicy };
+        result = { ...isRecord12(result) ? result : {}, ...settings, sandbox: settings.sandboxPolicy };
       }
     }
     await this.publishPermission(threadId, result);
     return result;
   }
   async publishPermission(threadId, value) {
-    const source = isRecord11(value) ? value : {};
+    const source = isRecord12(value) ? value : {};
     const threadSettings = { approvalPolicy: source.approvalPolicy, sandboxPolicy: source.sandboxPolicy ?? source.sandbox };
     await this.handleInbound({ kind: "notification", method: "thread/settings/updated", params: { threadId, threadSettings } });
   }
@@ -24032,9 +24378,9 @@ var CodexRemoteDomain = class {
         itemsView,
         ...cursor2 === void 0 ? {} : { cursor: cursor2 }
       });
-      const pageResult = isRecord11(result) ? result : {};
+      const pageResult = isRecord12(result) ? result : {};
       for (const rawTurn of array2(pageResult.data)) {
-        if (!isRecord11(rawTurn)) continue;
+        if (!isRecord12(rawTurn)) continue;
         const turnId = typeof rawTurn.id === "string" ? rawTurn.id : void 0;
         const items = rawTurn.itemsView === "full" || turnId === void 0 ? array2(rawTurn.items) : await this.readThreadItems(connectionId, threadId, turnId, array2(rawTurn.items));
         turns.push({ ...rawTurn, items });
@@ -24056,9 +24402,9 @@ var CodexRemoteDomain = class {
           sortDirection: "asc",
           ...cursor2 === void 0 ? {} : { cursor: cursor2 }
         });
-        const pageResult = isRecord11(result) ? result : {};
+        const pageResult = isRecord12(result) ? result : {};
         for (const entry of array2(pageResult.data)) {
-          if (isRecord11(entry) && entry.item !== void 0) items.push(entry.item);
+          if (isRecord12(entry) && entry.item !== void 0) items.push(entry.item);
         }
         cursor2 = typeof pageResult.nextCursor === "string" && pageResult.nextCursor.length > 0 ? pageResult.nextCursor : void 0;
         if (cursor2 === void 0) break;
@@ -24122,7 +24468,7 @@ var CodexRemoteDomain = class {
     return [...this.peers.values()].some((peer) => peer.hasThreadSubscription(threadId));
   }
   resolveUpstreamApproval(params) {
-    if (!isRecord11(params) || typeof params.requestId !== "string" && typeof params.requestId !== "number") return;
+    if (!isRecord12(params) || typeof params.requestId !== "string" && typeof params.requestId !== "number") return;
     for (const [handle, approval] of this.approvals) {
       if (approval.upstreamId === params.requestId) this.approvals.delete(handle);
     }
@@ -24339,24 +24685,24 @@ function codexBinaryCandidates(configured, hostPlatform = process.platform, user
   ])];
 }
 function parseCallEnvelope(input2) {
-  if (!isRecord11(input2) || typeof input2.method !== "string" || !("params" in input2) || Object.keys(input2).some((key) => key !== "method" && key !== "params")) {
+  if (!isRecord12(input2) || typeof input2.method !== "string" || !("params" in input2) || Object.keys(input2).some((key) => key !== "method" && key !== "params")) {
     throw new RpcError("INVALID_MESSAGE", "The Codex call envelope is invalid.");
   }
   return { method: input2.method, params: input2.params };
 }
 function parseRespond(input2) {
-  if (!isRecord11(input2) || typeof input2.requestHandle !== "string" || !["accept", "decline", "cancel"].includes(String(input2.decision)) || Object.keys(input2).some((key) => key !== "requestHandle" && key !== "decision")) {
+  if (!isRecord12(input2) || typeof input2.requestHandle !== "string" || !["accept", "decline", "cancel"].includes(String(input2.decision)) || Object.keys(input2).some((key) => key !== "requestHandle" && key !== "decision")) {
     throw new RpcError("INVALID_MESSAGE", "The Codex approval response is invalid.");
   }
   return input2;
 }
 function accountCanRun(result) {
-  if (!isRecord11(result) || typeof result.requiresOpenaiAuth !== "boolean") return false;
-  return result.requiresOpenaiAuth === false || isRecord11(result.account);
+  if (!isRecord12(result) || typeof result.requiresOpenaiAuth !== "boolean") return false;
+  return result.requiresOpenaiAuth === false || isRecord12(result.account);
 }
 function sanitizeAccount(result) {
-  if (!isRecord11(result)) throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned invalid account state.");
-  const account = isRecord11(result.account) ? result.account : void 0;
+  if (!isRecord12(result)) throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned invalid account state.");
+  const account = isRecord12(result.account) ? result.account : void 0;
   return {
     authenticated: account !== void 0 || result.requiresOpenaiAuth === false,
     requiresOpenaiAuth: result.requiresOpenaiAuth === true,
@@ -24369,11 +24715,11 @@ function sanitizeAccount(result) {
   };
 }
 function sanitizeThreadList(result) {
-  if (!isRecord11(result) || !Array.isArray(result.data)) {
+  if (!isRecord12(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread list.");
   }
   const data = result.data.flatMap((value) => {
-    if (!isRecord11(value) || typeof value.id !== "string") return [];
+    if (!isRecord12(value) || typeof value.id !== "string") return [];
     return [{
       id: value.id,
       ...typeof value.sessionId === "string" ? { sessionId: value.sessionId } : {},
@@ -24385,7 +24731,7 @@ function sanitizeThreadList(result) {
       ...typeof value.updatedAt === "number" && Number.isFinite(value.updatedAt) ? { updatedAt: value.updatedAt } : {},
       ...typeof value.archived === "boolean" ? { archived: value.archived } : {},
       ...typeof value.isPinned === "boolean" ? { isPinned: value.isPinned } : {},
-      ...isRecord11(value.status) ? { status: value.status } : {}
+      ...isRecord12(value.status) ? { status: value.status } : {}
     }];
   });
   return {
@@ -24395,18 +24741,18 @@ function sanitizeThreadList(result) {
   };
 }
 function filterThreadListByWorkspaceAuthority(result, authority) {
-  if (!isRecord11(result) || !Array.isArray(result.data)) {
+  if (!isRecord12(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread list.");
   }
   return {
     ...result,
-    data: result.data.map((record6) => isRecord11(record6) ? record6 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByWorkspaceAuthority(thread, authority))
+    data: result.data.map((record6) => isRecord12(record6) ? record6 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByWorkspaceAuthority(thread, authority))
   };
 }
 function sanitizeProject(value) {
-  if (!isRecord11(value) || typeof value.id !== "string" || typeof value.name !== "string") return void 0;
+  if (!isRecord12(value) || typeof value.id !== "string" || typeof value.name !== "string") return void 0;
   const roots = Array.isArray(value.roots) ? value.roots.flatMap((root) => {
-    const path = isRecord11(root) && typeof root.path === "string" && root.path.length > 0 ? root.path : void 0;
+    const path = isRecord12(root) && typeof root.path === "string" && root.path.length > 0 ? root.path : void 0;
     return path === void 0 || !isAbsolute3(path) ? [] : [{ path }];
   }) : [];
   if (roots.length === 0) return void 0;
@@ -24420,7 +24766,7 @@ function sanitizeProject(value) {
   };
 }
 function sanitizeProjectList(result) {
-  if (!isRecord11(result) || !Array.isArray(result.data)) {
+  if (!isRecord12(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid project list.");
   }
   const data = result.data.flatMap((value) => sanitizeProject(value) ?? []);
@@ -24430,7 +24776,7 @@ function sanitizeProjectList(result) {
   };
 }
 function sanitizeProjectCreate(result) {
-  const project = isRecord11(result) ? sanitizeProject(result.project) : void 0;
+  const project = isRecord12(result) ? sanitizeProject(result.project) : void 0;
   if (project === void 0) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid created project.");
   }
@@ -24462,19 +24808,19 @@ function codexDirectoryCrumbs(root, path) {
   return crumbs2;
 }
 function extractThread(result) {
-  return isRecord11(result) && isRecord11(result.thread) ? result.thread : void 0;
+  return isRecord12(result) && isRecord12(result.thread) ? result.thread : void 0;
 }
 function extractTurnId(result) {
-  if (!isRecord11(result)) return void 0;
+  if (!isRecord12(result)) return void 0;
   if (typeof result.turnId === "string" && result.turnId.length > 0) return result.turnId;
-  if (isRecord11(result.turn) && typeof result.turn.id === "string" && result.turn.id.length > 0) return result.turn.id;
+  if (isRecord12(result.turn) && typeof result.turn.id === "string" && result.turn.id.length > 0) return result.turn.id;
   return void 0;
 }
 function extractThreadId(params) {
-  if (!isRecord11(params)) return void 0;
+  if (!isRecord12(params)) return void 0;
   if (typeof params.threadId === "string") return params.threadId;
-  if (isRecord11(params.thread) && typeof params.thread.id === "string") return params.thread.id;
-  if (isRecord11(params.turn) && typeof params.turn.threadId === "string") return params.turn.threadId;
+  if (isRecord12(params.thread) && typeof params.thread.id === "string") return params.thread.id;
+  if (isRecord12(params.turn) && typeof params.turn.threadId === "string") return params.turn.threadId;
   return void 0;
 }
 function optionalInteger2(value) {
@@ -24516,13 +24862,13 @@ function mapCodexImageInputs(params) {
   return {
     ...params,
     input: params.input.map((value) => {
-      if (!isRecord11(value) || value.type !== "image" || typeof value.mediaType !== "string" || typeof value.data !== "string") return value;
+      if (!isRecord12(value) || value.type !== "image" || typeof value.mediaType !== "string" || typeof value.data !== "string") return value;
       return { type: "image", url: `data:${value.mediaType};base64,${value.data}` };
     })
   };
 }
 function sanitizeApprovalParams(params, requestHandle) {
-  if (!isRecord11(params)) return { requestHandle };
+  if (!isRecord12(params)) return { requestHandle };
   const safe = { ...params };
   delete safe.proposedExecpolicyAmendment;
   delete safe.additionalPermissions;
@@ -24553,7 +24899,7 @@ function isProjectListFallbackError(error) {
 function canTryNextBinary(error) {
   return !(error instanceof RpcError) || !["CODEX_AUTH_REQUIRED", "CODEX_CLOSED"].includes(error.code);
 }
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function array2(value) {
@@ -24838,7 +25184,8 @@ var HostPluginRuntime = class {
         harnessSessionGeneration(this.harnessVersion) === "v3" ? "harness.remote.v3" : "harness.remote.v1",
         "harness.remote.transfer.v1"
       );
-    } else if (this.apiProxy !== void 0) {
+    }
+    if (this.apiProxy !== void 0) {
       capabilities.push("harness.api.v1", "harness.api.transfer.v1");
     }
     if (this.fileViewerHost?.() !== void 0) capabilities.push("fileviewer.read.v1");
@@ -25293,7 +25640,7 @@ function remoteStatusLines(target) {
     `Device: ${status2.deviceId ?? "not initialized"}`,
     `Authorization: ${status2.authorized ? status2.account === void 0 ? "logged in" : `logged in (${status2.account})` : "logged out"}`,
     `Server connection: ${connection}`,
-    `Harness Remote API: ${capabilities.has("harness.api.v1") ? "available (ApiProxy)" : capabilities.has("harness.remote.v1") ? "available (Typert Remote)" : "unavailable"}`,
+    `Harness Remote API: ${capabilities.has("harness.api.v1") ? "available (ApiProxy)" : capabilities.has("harness.remote.v3") ? "available (Typert Remote Session V3)" : capabilities.has("harness.remote.v1") ? "available (Typert Remote)" : "unavailable"}`,
     `Remote clients: ${diagnostics.activeConnections}`,
     `Codex Remote: ${codex.enabled ? codex.state : "disabled"}`,
     "",
@@ -25566,6 +25913,7 @@ function apply(ctx, input2 = {}) {
   const activateWhenCarrierReady = (runtimeContext) => {
     const gateway = runtimeContext.get("typertGateway");
     const connection = runtimeContext.get("connection");
+    const webServer = runtimeContext.get("webServer");
     let disposePendingControl;
     const installPendingControl = () => {
       if (connection === void 0 || disposePendingControl !== void 0) return;
@@ -25577,7 +25925,7 @@ function apply(ctx, input2 = {}) {
           void 0,
           void 0
         );
-        return control.register(connection);
+        return control.register(connection, webServer);
       }, "dsh-remote pending control");
     };
     const startActiveRuntime = async (activeContext) => {
@@ -25611,13 +25959,14 @@ async function activate(ctx, input2, tuiBinding) {
     reportSettingsMigration(ctx, await migration);
   }
   const connection = ctx.get("connection");
+  const webServer = ctx.get("webServer");
   const resolvedConfig = resolveConfig(settingsScope?.get() ?? input2);
   const config = connection === void 0 && resolvedConfig.serverUrl === void 0 ? { ...resolvedConfig, serverUrl: DEFAULT_REMOTE_SERVER_URL } : resolvedConfig;
   const defaultIdentityDirectory = new IdentityStore().directory;
   if (!config.enabled) {
     if (connection !== void 0) {
       const controlRuntime2 = new PluginControlRuntime(config, defaultIdentityDirectory, settingsScope, void 0, void 0);
-      ctx.effect(() => controlRuntime2.register(connection), "dsh-remote disabled control");
+      ctx.effect(() => controlRuntime2.register(connection, webServer), "dsh-remote disabled control");
     }
     return;
   }
@@ -25676,7 +26025,7 @@ async function activate(ctx, input2, tuiBinding) {
   if (tuiBinding !== void 0) tuiBinding.target = tuiTarget;
   await disableLegacyLoaderEntries(ctx, logger);
   await ctx.effect(async () => {
-    const disposeControl = controlRuntime?.register(connection);
+    const disposeControl = controlRuntime?.register(connection, webServer);
     try {
       await runtime.start();
       if (clientRuntime !== void 0) {