ds-harness-remote 0.4.25 → 0.4.27

package/dist/index.js

@@ -9,7 +9,7 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
   BRAND: () => BRAND,
@@ -121,7 +121,7 @@ __export(external_exports, {
   void: () => voidType
 });
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -255,7 +255,7 @@ var getParsedType = (data2) => {
   }
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -373,7 +373,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -476,7 +476,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -485,7 +485,7 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data: data2, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -595,14 +595,14 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4646,22 +4646,22 @@ function headerPairs(headers) {
   return Object.entries(headers).flatMap(([name2, value]) => value === void 0 ? [] : (Array.isArray(value) ? value : [value]).map((item) => [name2, item]));
 }
 var LoopbackHost = class {
-  handles = /* @__PURE__ */ new Map();
-  ports;
-  closed = false;
-  timer;
-  constructor(ports) {
-    this.ports = [...ports];
+  constructor(getPorts, onClose) {
+    this.onClose = onClose;
+    this.ports = [...getPorts()];
     this.timer = setInterval(() => {
       for (const [id4, handle] of this.handles) if (Date.now() - handle.touched > 6e4) this.close(id4);
     }, 1e4);
     this.timer.unref();
   }
+  handles = /* @__PURE__ */ new Map();
+  ports;
+  closed = false;
+  timer;
   setPorts(ports) {
     this.ports = [...ports];
-  }
-  hasPorts() {
-    return this.ports.length > 0;
+    const allowed = new Set(ports);
+    for (const [id4, handle] of this.handles) if (!allowed.has(handle.port)) this.close(id4);
   }
   async call(input2) {
     if (this.closed) throw new RpcError("TRANSPORT_CLOSED", "Preview connection closed.");
@@ -4678,10 +4678,13 @@ var LoopbackHost = class {
       );
       if (this.handles.has(value.id)) throw new RpcError("REQUEST_CONFLICT", "Preview handle is already in use.");
       if (this.handles.size >= LOOPBACK_MAX_CONNECTIONS) throw new RpcError("RATE_LIMITED", "Too many active preview requests.");
+      let openedHandle;
       try {
-        return value.op === "http.open" ? await this.openHttp(value) : await this.openWs(value);
+        const opening = value.op === "http.open" ? this.openHttp(value) : this.openWs(value);
+        openedHandle = this.handles.get(value.id);
+        return await opening;
       } catch {
-        this.close(value.id);
+        this.close(value.id, openedHandle);
         throw new RpcError("LOOPBACK_UNAVAILABLE", "The allowed loopback service did not respond. Check that it is running on the Host.");
       }
     }
@@ -4712,6 +4715,7 @@ var LoopbackHost = class {
             response.once("close", ready);
             response.once("error", fail4);
           });
+          if (this.handles.get(value.id) !== handle) throw new Error("closed");
           chunk = response.read(Math.min(response.readableLength || LOOPBACK_CHUNK_BYTES, LOOPBACK_CHUNK_BYTES));
           if (chunk === null && response.readableLength > 0) chunk = response.read(Math.min(response.readableLength, LOOPBACK_CHUNK_BYTES));
         }
@@ -4719,10 +4723,10 @@ var LoopbackHost = class {
         if (done && !response.complete) throw new Error("truncated");
         handle.total += chunk?.length ?? 0;
         if (handle.total > 64 * 1024 * 1024) throw new Error("size");
-        if (done) this.close(value.id);
+        if (done) this.close(value.id, handle);
         return { data: chunk?.toString("base64") ?? "", done };
       } catch {
-        this.close(value.id);
+        this.close(value.id, handle);
         throw new RpcError("LOOPBACK_READ_FAILED", "Preview response ended or exceeded its limit; reload to retry.");
       } finally {
         handle.reading = false;
@@ -4762,7 +4766,7 @@ var LoopbackHost = class {
           }
           handle.bytes -= bytes;
           const closed = handle.closed && handle.messages.length === 0;
-          if (closed) this.close(value.id);
+          if (closed) this.close(value.id, handle);
           return { messages, closed };
         } finally {
           handle.reading = false;
@@ -4772,12 +4776,15 @@ var LoopbackHost = class {
     throw new RpcError("INVALID_MESSAGE", "Preview handle kind does not match the operation.");
   }
   closeAll() {
+    if (this.closed) return;
     this.closed = true;
     clearInterval(this.timer);
     for (const id4 of this.handles.keys()) this.close(id4);
+    this.onClose?.();
   }
-  close(id4) {
+  close(id4, expected) {
     const handle = this.handles.get(id4);
+    if (expected !== void 0 && handle !== expected) return;
     this.handles.delete(id4);
     if (handle?.kind === "http") {
       handle.response?.destroy();
@@ -4785,6 +4792,8 @@ var LoopbackHost = class {
     }
     if (handle?.kind === "ws") {
       handle.closed = true;
+      handle.messages = [];
+      handle.bytes = 0;
       handle.wake?.();
       handle.socket.terminate();
     }
@@ -4794,6 +4803,7 @@ var LoopbackHost = class {
     if ((body?.length ?? 0) > LOOPBACK_MAX_BODY_BYTES) throw new Error("body limit");
     return new Promise((resolve4, reject) => {
       const headers = Object.fromEntries(cleanHeaders(value.headers));
+      let handle;
       const request = httpRequest({
         hostname: "127.0.0.1",
         port: value.port,
@@ -4803,8 +4813,7 @@ var LoopbackHost = class {
         agent: false,
         maxHeaderSize: 32 * 1024
       }, (response) => {
-        const handle = this.handles.get(value.id);
-        if (handle?.kind !== "http") {
+        if (this.handles.get(value.id) !== handle) {
           response.destroy();
           return;
         }
@@ -4821,7 +4830,8 @@ var LoopbackHost = class {
         clearTimeout(timer);
         reject(new Error("upstream"));
       });
-      this.handles.set(value.id, { kind: "http", request, reading: false, total: 0, touched: Date.now() });
+      handle = { kind: "http", port: value.port, request, reading: false, total: 0, touched: Date.now() };
+      this.handles.set(value.id, handle);
       request.end(body);
     });
   }
@@ -4834,13 +4844,14 @@ var LoopbackHost = class {
         maxPayload: LOOPBACK_MAX_WS_BYTES,
         perMessageDeflate: false
       });
-      const handle = { kind: "ws", socket, messages: [], bytes: 0, reading: false, closed: false, touched: Date.now() };
+      const handle = { kind: "ws", port: value.port, socket, messages: [], bytes: 0, reading: false, closed: false, touched: Date.now() };
       this.handles.set(value.id, handle);
       socket.once("open", () => resolve4({ protocol: socket.protocol }));
       socket.on("message", (data2, binary) => {
+        if (handle.closed) return;
         const message = { data: Buffer.from(data2).toString("base64"), binary };
         if (handle.bytes + message.data.length > 1024 * 1024 || handle.messages.length >= 256) {
-          this.close(value.id);
+          this.close(value.id, handle);
           return;
         }
         handle.messages.push(message);
@@ -6950,6 +6961,9 @@ var AdaptiveTransport = class extends BaseTransport {
   negotiatedCapabilities = ["transport.relay"];
   controlFrameLimits = {};
   connectedAt;
+  heartbeatIntervalMs;
+  lastControlReceivedAt;
+  lastControlSentAt;
   lastRtcDiagnostics;
   constructor(url, options) {
     super();
@@ -7026,6 +7040,9 @@ var AdaptiveTransport = class extends BaseTransport {
     return {
       ...this.connectionId === void 0 ? {} : { connectionId: this.connectionId },
       ...this.connectedAt === void 0 ? {} : { connectedAt: this.connectedAt },
+      ...this.heartbeatIntervalMs === void 0 ? {} : { heartbeatIntervalMs: this.heartbeatIntervalMs },
+      ...this.lastControlReceivedAt === void 0 ? {} : { lastControlReceivedAt: this.lastControlReceivedAt },
+      ...this.lastControlSentAt === void 0 ? {} : { lastControlSentAt: this.lastControlSentAt },
       controlChannelUrl: this.url,
       controlChannelState: socketState(this.socket?.readyState),
       preferredTransports: this.options.forceRelay === true ? ["relay"] : [...this.options.preferredTransports ?? DEFAULT_PREFERRED_TRANSPORTS],
@@ -7074,10 +7091,12 @@ var AdaptiveTransport = class extends BaseTransport {
       if (typeof raw !== "string")
         throw new Error("Adaptive control frames must be text JSON");
       const frame = decodeControlFrame(raw, this.controlFrameLimits);
+      this.lastControlReceivedAt = Date.now();
       if (frame.type === "hello.ack") {
         const payload = frame.payload;
         if (payload.protocol !== PROTOCOL_VERSION)
           throw new Error("Server selected an unsupported protocol version");
+        this.heartbeatIntervalMs = payload.heartbeatIntervalMs;
         const offered = this.options.capabilities ?? DEFAULT_CAPABILITIES;
         this.negotiatedCapabilities = acceptNegotiatedCapabilities(offered, payload.capabilities);
         this.controlFrameLimits = {
@@ -7297,6 +7316,7 @@ var AdaptiveTransport = class extends BaseTransport {
     if (this.socket?.readyState !== WebSocket.OPEN)
       throw new Error("adaptive control socket is not open");
     this.socket.send(encodeControlFrame(createControlFrame(type, payload), this.controlFrameLimits));
+    this.lastControlSentAt = Date.now();
   }
   finishConnection() {
     this.clearHandshake();
@@ -7466,11 +7486,11 @@ var ApiProxySwitch = class {
   }
 };
 
-// ../../node_modules/.pnpm/@noble+ciphers@1.3.0/node_modules/@noble/ciphers/esm/cryptoNode.js
+// ../crypto/node_modules/@noble/ciphers/esm/cryptoNode.js
 import * as nc from "node:crypto";
 var crypto = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
 
-// ../../node_modules/.pnpm/@noble+ciphers@1.3.0/node_modules/@noble/ciphers/esm/webcrypto.js
+// ../crypto/node_modules/@noble/ciphers/esm/webcrypto.js
 function randomBytes2(bytesLength = 32) {
   if (crypto && typeof crypto.getRandomValues === "function") {
     return crypto.getRandomValues(new Uint8Array(bytesLength));
@@ -7481,11 +7501,11 @@ function randomBytes2(bytesLength = 32) {
   throw new Error("crypto.getRandomValues must be defined");
 }
 
-// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/cryptoNode.js
+// ../../node_modules/@noble/hashes/esm/cryptoNode.js
 import * as nc2 from "node:crypto";
 var crypto2 = nc2 && typeof nc2 === "object" && "webcrypto" in nc2 ? nc2.webcrypto : nc2 && typeof nc2 === "object" && "randomBytes" in nc2 ? nc2 : void 0;
 
-// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/utils.js
+// ../../node_modules/@noble/hashes/esm/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
 }
@@ -7612,7 +7632,7 @@ function randomBytes3(bytesLength = 32) {
   throw new Error("crypto.getRandomValues must be defined");
 }
 
-// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/_md.js
+// ../../node_modules/@noble/hashes/esm/_md.js
 function setBigUint64(view, byteOffset, value, isLE3) {
   if (typeof view.setBigUint64 === "function")
     return view.setBigUint64(byteOffset, value, isLE3);
@@ -7734,7 +7754,7 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/_u64.js
+// ../../node_modules/@noble/hashes/esm/_u64.js
 var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
 var _32n = /* @__PURE__ */ BigInt(32);
 function fromBig(n, le = false) {
@@ -7769,7 +7789,7 @@ var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0
 var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
 var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-// ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/sha2.js
+// ../../node_modules/@noble/hashes/esm/sha2.js
 var K512 = /* @__PURE__ */ (() => split([
   "0x428a2f98d728ae22",
   "0x7137449123ef65cd",
@@ -7969,7 +7989,7 @@ var SHA512 = class extends HashMD {
 };
 var sha512 = /* @__PURE__ */ createHasher(() => new SHA512());
 
-// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/utils.js
+// ../../node_modules/@noble/curves/esm/utils.js
 var _0n = /* @__PURE__ */ BigInt(0);
 var _1n = /* @__PURE__ */ BigInt(1);
 function _abool2(value, title = "") {
@@ -8082,7 +8102,7 @@ function memoized(fn) {
   };
 }
 
-// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/modular.js
+// ../../node_modules/@noble/curves/esm/abstract/modular.js
 var _0n2 = BigInt(0);
 var _1n2 = BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -8408,7 +8428,7 @@ function Field(ORDER, bitLenOrOpts, isLE3 = false, opts = {}) {
   return Object.freeze(f);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/curve.js
+// ../../node_modules/@noble/curves/esm/abstract/curve.js
 var _0n3 = BigInt(0);
 var _1n3 = BigInt(1);
 function negateCt(condition, item) {
@@ -8671,7 +8691,7 @@ function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
   return { CURVE, Fp: Fp2, Fn: Fn2 };
 }
 
-// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/edwards.js
+// ../../node_modules/@noble/curves/esm/abstract/edwards.js
 var _0n4 = BigInt(0);
 var _1n4 = BigInt(1);
 var _2n2 = BigInt(2);
@@ -9222,7 +9242,7 @@ function twistedEdwards(c) {
   return _eddsa_new_output_to_legacy(c, EDDSA);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/montgomery.js
+// ../../node_modules/@noble/curves/esm/abstract/montgomery.js
 var _0n5 = BigInt(0);
 var _1n5 = BigInt(1);
 var _2n3 = BigInt(2);
@@ -9342,7 +9362,7 @@ function montgomery(curveDef) {
   };
 }
 
-// ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/ed25519.js
+// ../../node_modules/@noble/curves/esm/ed25519.js
 var _0n6 = /* @__PURE__ */ BigInt(0);
 var _1n6 = BigInt(1);
 var _2n4 = BigInt(2);
@@ -9577,7 +9597,7 @@ _RistrettoPoint.ZERO = /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.
 _RistrettoPoint.Fp = /* @__PURE__ */ (() => Fp)();
 _RistrettoPoint.Fn = /* @__PURE__ */ (() => Fn)();
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/constants.js
+// ../../node_modules/@lukeburns/clatterjs/dist/constants.js
 var MAX_KEY_LEN = 32;
 var MAX_TAG_LEN = 16;
 var MAX_MESSAGE_LEN = 65535;
@@ -9587,7 +9607,7 @@ var MAX_TOKENS_PER_HS_MESSAGE = 8;
 var MAX_HS_MESSAGES_PER_ROLE = 8;
 var HYBRID_DUAL_LAYER = new TextEncoder().encode("clatter.hybrid_dual_layer.outer");
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/errors.js
+// ../../node_modules/@lukeburns/clatterjs/dist/errors.js
 var CipherError = class extends Error {
   code;
   constructor(code, message) {
@@ -9623,7 +9643,7 @@ var TransportError = class extends Error {
   }
 };
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/handshakePattern.js
+// ../../node_modules/@lukeburns/clatterjs/dist/handshakePattern.js
 function checkMsgLens(initiator, responder) {
   for (const g of initiator) {
     if (g.length > MAX_TOKENS_PER_HS_MESSAGE) {
@@ -9792,7 +9812,7 @@ var HandshakePattern = class _HandshakePattern {
   }
 };
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/cipherState.js
+// ../../node_modules/@lukeburns/clatterjs/dist/cipherState.js
 var U64_MAX = 0xfffffffffffffffn;
 var CipherState = class {
   C;
@@ -9864,7 +9884,7 @@ var CipherStates = class {
   }
 };
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/symmetricState.js
+// ../../node_modules/@lukeburns/clatterjs/dist/symmetricState.js
 function deriveCipherKey(temp, C) {
   return temp.slice(0, C.keyLen);
 }
@@ -9951,7 +9971,7 @@ function concat(a, b) {
   return o;
 }
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/transportState.js
+// ../../node_modules/@lukeburns/clatterjs/dist/transportState.js
 function mapCipher(e) {
   if (e instanceof TransportError)
     return e;
@@ -10113,7 +10133,7 @@ var TransportState = class {
   }
 };
 
-// ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/_u64.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/hashes/_u64.js
 var U32_MASK642 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
 var _32n2 = /* @__PURE__ */ BigInt(32);
 function fromBig2(n, le = false) {
@@ -10158,7 +10178,7 @@ var add4H2 = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) |
 var add5L2 = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
 var add5H2 = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-// ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/utils.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/hashes/utils.js
 function isBytes2(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -10333,7 +10353,7 @@ var oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/_md.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/hashes/_md.js
 function Chi2(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -10464,7 +10484,7 @@ var SHA512_IV2 = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/sha2.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/hashes/sha2.js
 var SHA256_K = /* @__PURE__ */ Uint32Array.from([
   1116352408,
   1899447441,
@@ -10861,7 +10881,7 @@ var sha5122 = /* @__PURE__ */ createHasher2(
   /* @__PURE__ */ oidNist(3)
 );
 
-// ../../node_modules/.pnpm/@noble+curves@2.3.0/node_modules/@noble/curves/utils.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/curves/utils.js
 function aarray(item, title, inner = () => {
 }) {
   if (!Array.isArray(item))
@@ -10980,7 +11000,7 @@ function validateObject2(object, fields = {}, optFields = {}, title = "object")
   iter(optFields, true);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/modular.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/curves/abstract/modular.js
 var _0n8 = /* @__PURE__ */ BigInt(0);
 var _1n8 = /* @__PURE__ */ BigInt(1);
 var _2n5 = /* @__PURE__ */ BigInt(2);
@@ -11409,7 +11429,7 @@ function Field2(ORDER, opts = {}) {
   return new _Field(ORDER, opts);
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/curve.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/curves/abstract/curve.js
 var _0n9 = /* @__PURE__ */ BigInt(0);
 var _1n9 = /* @__PURE__ */ BigInt(1);
 var _4n3 = /* @__PURE__ */ BigInt(4);
@@ -11796,7 +11816,7 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/edwards.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/curves/abstract/edwards.js
 var _0n10 = /* @__PURE__ */ BigInt(0);
 var _1n10 = /* @__PURE__ */ BigInt(1);
 var _2n6 = /* @__PURE__ */ BigInt(2);
@@ -12090,7 +12110,7 @@ function edwards2(params, extraOpts = {}) {
   return Point;
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/montgomery.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/curves/abstract/montgomery.js
 var _0n11 = /* @__PURE__ */ BigInt(0);
 var _1n11 = /* @__PURE__ */ BigInt(1);
 var _2n7 = /* @__PURE__ */ BigInt(2);
@@ -12237,7 +12257,7 @@ function montgomery2(curveDef) {
   });
 }
 
-// ../../node_modules/.pnpm/@noble+curves@2.3.0/node_modules/@noble/curves/ed25519.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/curves/ed25519.js
 var _0n12 = /* @__PURE__ */ BigInt(0);
 var _1n12 = /* @__PURE__ */ BigInt(1);
 var _2n8 = /* @__PURE__ */ BigInt(2);
@@ -12323,7 +12343,7 @@ var x255192 = /* @__PURE__ */ (() => {
   });
 })();
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/dhX25519.js
+// ../../node_modules/@lukeburns/clatterjs/dist/dhX25519.js
 var PK = 32;
 var X25519_NAME = "25519";
 function x25519Keygen(rng) {
@@ -12337,12 +12357,12 @@ function dhPubKeyLen() {
   return PK;
 }
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/protocolNames.js
+// ../../node_modules/@lukeburns/clatterjs/dist/protocolNames.js
 function nqProtocolName(patternName, cipher, hash) {
   return `Noise_${patternName}_${X25519_NAME}_${cipher.name}_${hash.name}`;
 }
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/nqHandshake.js
+// ../../node_modules/@lukeburns/clatterjs/dist/nqHandshake.js
 var PK2 = () => dhPubKeyLen();
 var NqHandshake = class {
   pattern;
@@ -12715,7 +12735,7 @@ function raiseInv() {
   throw new HandshakeError("InvalidState");
 }
 
-// ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/_blake.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/hashes/_blake.js
 var BSIGMA = /* @__PURE__ */ Uint8Array.from([
   0,
   1,
@@ -12990,7 +13010,7 @@ function G2s(a, b, c, d, x) {
   return { a, b, c, d };
 }
 
-// ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/blake2.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/hashes/blake2.js
 var B2B_IV = /* @__PURE__ */ Uint32Array.from([
   4089235720,
   1779033703,
@@ -13423,7 +13443,7 @@ var _BLAKE2s = class extends _BLAKE2 {
 };
 var blake2s = /* @__PURE__ */ createHasher2((opts) => new _BLAKE2s(opts));
 
-// ../../node_modules/.pnpm/@noble+hashes@2.3.0/node_modules/@noble/hashes/hmac.js
+// ../../node_modules/@lukeburns/clatterjs/node_modules/@noble/hashes/hmac.js
 var _HMAC = class {
   oHash;
   iHash;
@@ -13500,7 +13520,7 @@ var hmac = /* @__PURE__ */ (() => {
   return hmac_;
 })();
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/crypto/hash.js
+// ../../node_modules/@lukeburns/clatterjs/dist/crypto/hash.js
 function makeHash(name2, hash, hashLen, blockLen) {
   const doHash = (data2) => hash.create().update(data2).digest();
   const hmac1 = (key, data2) => hmac(hash, key, data2);
@@ -13535,7 +13555,7 @@ var sha512H = makeHash("SHA512", sha5122, 64, 128);
 var blake2bH = makeHash("BLAKE2b", blake2b, 64, 128);
 var blake2sH = makeHash("BLAKE2s", blake2s, 32, 64);
 
-// ../../node_modules/.pnpm/@noble+ciphers@2.3.0/node_modules/@noble/ciphers/utils.js
+// ../../node_modules/@noble/ciphers/utils.js
 function isBytes4(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -13702,7 +13722,7 @@ function copyBytes4(bytes) {
   return Uint8Array.from(abytes4(bytes));
 }
 
-// ../../node_modules/.pnpm/@noble+ciphers@2.3.0/node_modules/@noble/ciphers/_arx.js
+// ../../node_modules/@noble/ciphers/_arx.js
 var encodeStr = (str) => Uint8Array.from(str.split(""), (c) => c.charCodeAt(0));
 var sigma16_32 = /* @__PURE__ */ (() => swap32IfBE2(u322(encodeStr("expand 16-byte k"))))();
 var sigma32_32 = /* @__PURE__ */ (() => swap32IfBE2(u322(encodeStr("expand 32-byte k"))))();
@@ -13829,7 +13849,7 @@ function createCipher(core, opts) {
   };
 }
 
-// ../../node_modules/.pnpm/@noble+ciphers@2.3.0/node_modules/@noble/ciphers/_poly1305.js
+// ../../node_modules/@noble/ciphers/_poly1305.js
 function u8to16(a, i) {
   return a[i++] & 255 | (a[i++] & 255) << 8;
 }
@@ -14080,7 +14100,7 @@ var Poly1305 = class {
 };
 var poly1305 = /* @__PURE__ */ wrapMacConstructor(32, (key) => new Poly1305(key));
 
-// ../../node_modules/.pnpm/@noble+ciphers@2.3.0/node_modules/@noble/ciphers/chacha.js
+// ../../node_modules/@noble/ciphers/chacha.js
 function chachaCore(s2, k, n, out, cnt, rounds = 20) {
   let y00 = s2[0], y01 = s2[1], y02 = s2[2], y03 = s2[3], y04 = k[0], y05 = k[1], y06 = k[2], y07 = k[3], y08 = k[4], y09 = k[5], y10 = k[6], y11 = k[7], y12 = cnt, y13 = n[0], y14 = n[1], y15 = n[2];
   let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;
@@ -14230,7 +14250,7 @@ var chacha20poly1305 = /* @__PURE__ */ wrapCipher(
   /* @__PURE__ */ _poly1305_aead(chacha20)
 );
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/crypto/cipher.js
+// ../../node_modules/@lukeburns/clatterjs/dist/crypto/cipher.js
 var U64_MAX2 = 0xfffffffffffffffn;
 function chachaNonce(n) {
   const b = new Uint8Array(12);
@@ -14292,7 +14312,7 @@ var chachaPoly = /* @__PURE__ */ (() => {
   };
 })();
 
-// ../../node_modules/.pnpm/@lukeburns+clatterjs@1.0.0/node_modules/@lukeburns/clatterjs/dist/noiseNq.js
+// ../../node_modules/@lukeburns/clatterjs/dist/noiseNq.js
 function noiseIk() {
   return new HandshakePattern("IK", [], [
     1
@@ -14736,7 +14756,7 @@ function uuidV7(now = Date.now()) {
 }
 
 // src/harness-version.ts
-import { readFile } from "node:fs/promises";
+import { readFile, realpath as realpathEntrypoint } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join } from "node:path";
 var LEGACY_PLACEHOLDER_VERSION = "0.0.1";
@@ -14771,7 +14791,13 @@ async function readHarnessManifestVersion(manifestPath) {
 }
 async function readHarnessDistributionVersion(entrypoint = process.argv[1]) {
   if (entrypoint === void 0 || !isAbsolute(entrypoint)) return void 0;
-  let directory = dirname(entrypoint);
+  let resolvedEntrypoint = entrypoint;
+  try {
+    resolvedEntrypoint = await realpathEntrypoint(entrypoint);
+  } catch {
+  }
+  if (!isAbsolute(resolvedEntrypoint)) return void 0;
+  let directory = dirname(resolvedEntrypoint);
   for (let depth = 0; depth < 8; depth += 1) {
     const version = await readHarnessManifestVersion(join(directory, "package.json"));
     if (version !== void 0) return version;
@@ -14780,7 +14806,7 @@ async function readHarnessDistributionVersion(entrypoint = process.argv[1]) {
     directory = parent;
   }
   try {
-    return await readHarnessManifestVersion(createRequire(entrypoint).resolve(`${HARNESS_PACKAGE_NAME}/package.json`));
+    return await readHarnessManifestVersion(createRequire(resolvedEntrypoint).resolve(`${HARNESS_PACKAGE_NAME}/package.json`));
   } catch {
     return void 0;
   }
@@ -18277,6 +18303,7 @@ var entryConfigSchema = s.object({
   serverUrl: s.string(),
   deviceName: s.string(),
   terminal: s.object({ enabled: s.boolean() }),
+  hostControl: s.object({ enabled: s.boolean() }),
   loopback: s.object({ ports: s.array(s.number()) }),
   forceRelay: s.boolean(),
   logLevel: s.union(["debug", "info", "warn", "error"]),
@@ -18313,6 +18340,7 @@ var configSchema = external_exports.object({
   serverUrl: external_exports.string().url().optional(),
   deviceName: external_exports.string().trim().min(1).max(80).optional(),
   terminal: external_exports.object({ enabled: external_exports.boolean().optional() }).strict().optional(),
+  hostControl: external_exports.object({ enabled: external_exports.boolean().optional() }).strict().optional(),
   loopback: external_exports.object({ ports: external_exports.array(external_exports.number().int().min(1024).max(65535)).max(16).optional() }).strict().optional(),
   forceRelay: external_exports.boolean().optional(),
   logLevel: external_exports.enum(["debug", "info", "warn", "error"]).optional(),
@@ -18338,7 +18366,8 @@ function resolveConfig(input2 = {}, env = process.env) {
     role: parsed.role ?? "host",
     ...serverUrl === void 0 ? {} : { serverUrl },
     deviceName: parsed.deviceName ?? hostname(),
-    terminal: { enabled: parsed.terminal?.enabled ?? env.DSH_REMOTE_TERMINAL_ENABLED === "true" },
+    hostControl: { enabled: parsed.hostControl?.enabled ?? true },
+    terminal: { enabled: parsed.terminal?.enabled ?? (env.DSH_REMOTE_TERMINAL_ENABLED === void 0 || env.DSH_REMOTE_TERMINAL_ENABLED === "true") },
     loopback: { ports: [...new Set(parsed.loopback?.ports ?? [])] },
     forceRelay: parsed.forceRelay ?? false,
     logLevel: parsed.logLevel ?? "info",
@@ -18378,7 +18407,7 @@ function normalizeServerUrl(value) {
 }
 
 // src/version.ts
-var PLUGIN_VERSION = "0.4.25";
+var PLUGIN_VERSION = "0.4.27";
 
 // src/server-api.ts
 var TERMINAL_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/u;
@@ -18407,6 +18436,11 @@ var HostServerApi = class {
       ...this.credentials.account === void 0 ? {} : { account: this.credentials.account }
     };
   }
+  /** Check the persisted device credential without issuing or refreshing one. */
+  async hasStoredAuthorization() {
+    const identity = this.requireIdentity();
+    return await this.store.load(this.baseUrl, identity.deviceId) !== void 0;
+  }
   async clearAuthorization() {
     this.credentials = void 0;
     this.credentialsPromise = void 0;
@@ -20052,6 +20086,13 @@ var REMOTE_COMMAND_LIST_MIN_VERSION = [0, 3, 16];
 var REMOTE_FILE_VIEWER_MIN_VERSION = [0, 3, 17];
 var DIRECT_WEBRTC_NEGOTIATE_TIMEOUT_MS = 12e3;
 var DIRECT_LAN_PROGRESS_DISPLAY_MS = 1400;
+var HOST_AUTHORIZATION_ERRORS = /* @__PURE__ */ new Set([
+  "ACCOUNT_AUTH_REQUIRED",
+  "AUTH_INVALID",
+  "DEVICE_OWNERSHIP_REQUIRED",
+  "DEVICE_REVOKED",
+  "TOKEN_EXPIRED"
+]);
 var ClientModeRuntime = class {
   constructor(config, identities, server, apiProxy, typertGateway, logger, host, rtcFactoryProvider = loadNodeRtcFactory) {
     this.config = config;
@@ -20084,6 +20125,27 @@ var ClientModeRuntime = class {
       deviceId: shortId(this.identity.deviceId),
       fingerprint: this.identity.fingerprint
     });
+    if (this.config.hostControl?.enabled !== false && this.host !== void 0 && this.server.hasStoredAuthorization !== void 0) {
+      try {
+        if (await this.server.hasStoredAuthorization() && (this.host.hasStoredAuthorization === void 0 || !await this.host.hasStoredAuthorization())) {
+          await this.authorizeHostByDefault();
+        }
+      } catch (error) {
+        this.logger.warn("automatic Host authorization failed", { code: safeErrorCode(error) });
+      }
+    }
+  }
+  async authorizeHostByDefault() {
+    try {
+      if (this.host === void 0) return;
+      if (this.config.hostControl?.enabled === false) return;
+      if (this.host.hostStatus().authorized) return;
+      if (this.host.hasStoredAuthorization !== void 0 && await this.host.hasStoredAuthorization()) return;
+      const credentials = await this.server.authenticate(this.requireIdentity());
+      await this.host.authorizeHostAsOwned(credentials.accessToken, credentials.account);
+    } catch (error) {
+      this.logger.warn("automatic Host authorization failed", { code: safeErrorCode(error) });
+    }
   }
   registerControl(connection, webServer) {
     return registerControlRoute(connection, (endpoint, payload, signal) => this.handleControl(endpoint, payload, signal), webServer);
@@ -20143,6 +20205,7 @@ var ClientModeRuntime = class {
     };
   }
   async devices() {
+    this.assertHostAuthorizationForDeviceDiscovery();
     this.requireIdentity();
     const serverDevices = await this.server.listDevices();
     const remoteDevices = serverDevices.filter((device) => device.deviceId !== this.host?.hostStatus().deviceId);
@@ -20152,6 +20215,20 @@ var ClientModeRuntime = class {
       return { ...device, ...presence };
     }));
   }
+  /**
+   * Device discovery is exposed through the local app control route. When this
+   * installation also runs a Host, keep that route closed after the Host's
+   * Server credential has become terminally invalid. The Client credential can
+   * remain usable for a short time after a revoke, so checking only
+   * `ClientServerApi.listDevices()` would otherwise leak the device directory
+   * from a Host that the user has already been told to re-authorize.
+   */
+  assertHostAuthorizationForDeviceDiscovery() {
+    const status2 = this.host?.hostStatus();
+    if (status2 === void 0 || status2.error === void 0 || !HOST_AUTHORIZATION_ERRORS.has(status2.error)) return;
+    const message = status2.error === "DEVICE_REVOKED" ? "The local Host was revoked on the Server. Sign out and authorize this Host again." : "The local Host authorization is no longer valid. Sign out and authorize this Host again.";
+    throw new ClientModeError(status2.error, message);
+  }
   async authorizeClientWithAccount(email, password) {
     let authorization;
     try {
@@ -20162,6 +20239,7 @@ var ClientModeRuntime = class {
       this.server.bindIdentity(this.identity);
       authorization = await this.server.authorizeWithAccount(this.identity, email, password);
     }
+    await this.authorizeHostByDefault();
     this.logger.info("Client account authorized");
     return authorization;
   }
@@ -20176,6 +20254,7 @@ var ClientModeRuntime = class {
       return this.identity;
     });
     if (result.status === "complete") this.logger.info("Client account authorized with QR login");
+    if (result.status === "complete") await this.authorizeHostByDefault();
     return result;
   }
   async clearClientAuthorization() {
@@ -21509,6 +21588,16 @@ var PluginControlRuntime = class {
       if (endpoint === "settings.acp.add") return ok3(await this.addAcp(payload));
       if (endpoint === "settings.acp.remove") return ok3(await this.removeAcp(payload));
       if (endpoint === "settings.logout") return ok3(await this.logout());
+      if (endpoint === "host.authorization.set" && this.client !== void 0) {
+        const value = record5(payload);
+        if (typeof value.enabled !== "boolean") throw new ClientModeError("INVALID_MESSAGE", "Host authorization state is required.");
+        const status2 = await this.client.setHostAuthorization(value.enabled);
+        if (this.settings !== void 0) {
+          const current = resolveConfig(this.settings.get());
+          await this.settings.replace(editableConfig({ ...current, hostControl: { enabled: value.enabled } }));
+        }
+        return ok3(status2);
+      }
       if (endpoint === "host.reconnect") {
         if (this.host === void 0) throw new ClientModeError("METHOD_NOT_ALLOWED", "This plugin is not running as a Host.");
         this.host.reconnectHost();
@@ -21566,6 +21655,9 @@ var PluginControlRuntime = class {
       }
       authorization = await api.authorizeWithAccount(identity, value.email, value.password);
     }
+    if (value.role === "client" && resolveConfig(this.settings.get()).hostControl?.enabled !== false) {
+      await this.client?.authorizeHostByDefault();
+    }
     await this.settings.replace(editableConfig(next));
     return {
       status: "authorized",
@@ -21612,7 +21704,7 @@ var PluginControlRuntime = class {
     const current = editableConfig(resolveConfig(this.settings.get()));
     const next = resolveConfig({
       ...current,
-      terminal: { enabled: value.terminalEnabled === void 0 ? current.terminal?.enabled ?? false : value.terminalEnabled },
+      terminal: { enabled: value.terminalEnabled === void 0 ? current.terminal?.enabled ?? true : value.terminalEnabled },
       loopback: { ports: value.ports === void 0 ? current.loopback?.ports ?? [] : value.ports }
     });
     await this.settings.replace(editableConfig(next));
@@ -21760,6 +21852,7 @@ function editableConfig(config) {
     role: config.role,
     ...config.serverUrl === void 0 ? {} : { serverUrl: config.serverUrl },
     terminal: config.terminal,
+    hostControl: config.hostControl ?? { enabled: true },
     loopback: config.loopback,
     forceRelay: config.forceRelay,
     logLevel: config.logLevel,
@@ -22540,6 +22633,13 @@ var HostServerConnection = class {
         if (TERMINAL_AUTH_ERRORS.has(code)) {
           this.logger.warn(code === "CONNECTION_REPLACED" ? "Another instance is using this Host identity. Stop it or use a separate DSH_HOME; automatic reconnect is paused." : code === "SERVER_CREDENTIALS_BUSY" ? "Credential refresh is locked. Stop other instances; after a crash, stop all instances before removing server-credentials.json.refresh-lock and authorizing again." : "Host authorization failed. Run /remote login or authorize this Host again in Remote settings.");
         }
+        if (code === "DEVICE_REVOKED") {
+          try {
+            await this.api.clearAuthorization();
+          } catch (clearError) {
+            this.logger.error("failed to clear revoked Host authorization", { code: errorCode2(clearError) });
+          }
+        }
         if (TERMINAL_AUTH_ERRORS.has(code) || !this.config.reconnect.enabled) return;
       }
       if (this.stopped) return;
@@ -24657,6 +24757,7 @@ function isRecord10(value) {
 
 // src/codex/domain.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
+import { accessSync, constants, existsSync as existsSync2, readFileSync } from "node:fs";
 import { readdir as readdir2, realpath, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { basename as basename3, isAbsolute as isAbsolute3, join as join5, relative, resolve as resolve2 } from "node:path";
@@ -26105,7 +26206,26 @@ var CodexRemoteDomain = class {
 };
 function codexBinaryCandidates(configured, hostPlatform = process.platform, userHome = homedir3()) {
   if (configured !== "codex" || hostPlatform !== "darwin") return [configured];
+  const bundledCandidates = [
+    "/Applications/ChatGPT.app",
+    join5(userHome, "Applications", "ChatGPT.app")
+  ].flatMap((chatGptApp) => {
+    const codexCli = join5(chatGptApp, "Contents", "Resources", "codex-cli");
+    try {
+      const manifest = JSON.parse(readFileSync(join5(codexCli, "codex-package.json"), "utf8"));
+      if (!isRecord13(manifest) || typeof manifest.entrypoint !== "string" || manifest.entrypoint.length === 0) {
+        return [];
+      }
+      const candidate = join5(codexCli, manifest.entrypoint);
+      if (!existsSync2(candidate)) return [];
+      accessSync(candidate, constants.X_OK);
+      return [candidate];
+    } catch {
+      return [];
+    }
+  });
   return [.../* @__PURE__ */ new Set([
+    ...bundledCandidates,
     "/Applications/ChatGPT.app/Contents/Resources/codex",
     join5(userHome, "Applications", "ChatGPT.app", "Contents", "Resources", "codex"),
     configured
@@ -26926,7 +27046,7 @@ var HostPluginRuntime = class {
     this.fileViewerHost = fileViewerHost;
     this.terminalSpawner = terminalSpawner;
     this.terminalEnabled = config.terminal.enabled;
-    this.loopback = new LoopbackHost(config.loopback.ports);
+    this.loopbackPorts = [...config.loopback.ports];
     this.codex = new CodexRemoteDomain(config.codex, logger);
     this.connections = new ConnectionController(this.identities, (context, send) => {
       const harnessApi = this.apiProxy === void 0 ? void 0 : new HarnessApiBridge(
@@ -26969,7 +27089,8 @@ var HostPluginRuntime = class {
         () => this.hostCapabilities(),
         codex,
         acp,
-        this.loopback
+        // Handles and their lifetime belong to this connection; only policy is shared.
+        this.createLoopbackHost()
       );
     }, this.logger);
     if (config.serverUrl !== void 0) {
@@ -26978,8 +27099,9 @@ var HostPluginRuntime = class {
   }
   connections;
   terminalOwners = /* @__PURE__ */ new Map();
+  loopbackHosts = /* @__PURE__ */ new Set();
   terminalEnabled;
-  loopback;
+  loopbackPorts;
   identity;
   serverApi;
   serverConnection;
@@ -26993,7 +27115,14 @@ var HostPluginRuntime = class {
     this.terminalEnabled = enabled;
   }
   setLoopbackPorts(ports) {
-    this.loopback.setPorts(ports);
+    this.loopbackPorts = [...ports];
+    for (const loopback of this.loopbackHosts) loopback.setPorts(this.loopbackPorts);
+  }
+  createLoopbackHost() {
+    let loopback;
+    loopback = new LoopbackHost(() => this.loopbackPorts, () => this.loopbackHosts.delete(loopback));
+    this.loopbackHosts.add(loopback);
+    return loopback;
   }
   async start() {
     if (this.closed) throw new Error("remote runtime is closed");
@@ -27036,6 +27165,9 @@ var HostPluginRuntime = class {
       connectedClients: this.listConnectedClients()
     };
   }
+  async hasStoredAuthorization() {
+    return this.serverApi?.hasStoredAuthorization() ?? false;
+  }
   listConnectedClients() {
     return this.connections.connectedPeers().map((peer) => {
       const trusted = this.identities.trustedPeer(peer.deviceId);
@@ -27219,7 +27351,7 @@ var HostPluginRuntime = class {
   }
   hostCapabilities() {
     const capabilities = [];
-    if (this.loopback.hasPorts()) capabilities.push("loopback.http-ws.v1");
+    if (this.loopbackPorts.length > 0) capabilities.push("loopback.http-ws.v1");
     if (this.localGateway?.supportsCarrier === true) {
       capabilities.push(
         harnessSessionGeneration(this.harnessVersion) === "v3" ? "harness.remote.v3" : "harness.remote.v1",