ds-harness-remote 0.4.3 → 0.4.4

package/dist/index.js

@@ -538,18 +538,18 @@ var ParseStatus = class _ParseStatus {
     if (this.value !== "aborted")
       this.value = "aborted";
   }
-  static mergeArray(status, results) {
+  static mergeArray(status2, results) {
     const arrayValue = [];
     for (const s2 of results) {
       if (s2.status === "aborted")
         return INVALID;
       if (s2.status === "dirty")
-        status.dirty();
+        status2.dirty();
       arrayValue.push(s2.value);
     }
-    return { status: status.value, value: arrayValue };
+    return { status: status2.value, value: arrayValue };
   }
-  static async mergeObjectAsync(status, pairs) {
+  static async mergeObjectAsync(status2, pairs) {
     const syncPairs = [];
     for (const pair of pairs) {
       const key = await pair.key;
@@ -559,9 +559,9 @@ var ParseStatus = class _ParseStatus {
         value
       });
     }
-    return _ParseStatus.mergeObjectSync(status, syncPairs);
+    return _ParseStatus.mergeObjectSync(status2, syncPairs);
   }
-  static mergeObjectSync(status, pairs) {
+  static mergeObjectSync(status2, pairs) {
     const finalObject = {};
     for (const pair of pairs) {
       const { key, value } = pair;
@@ -570,14 +570,14 @@ var ParseStatus = class _ParseStatus {
       if (value.status === "aborted")
         return INVALID;
       if (key.status === "dirty")
-        status.dirty();
+        status2.dirty();
       if (value.status === "dirty")
-        status.dirty();
+        status2.dirty();
       if (key.value !== "__proto__" && (typeof value.value !== "undefined" || pair.alwaysSet)) {
         finalObject[key.value] = value.value;
       }
     }
-    return { status: status.value, value: finalObject };
+    return { status: status2.value, value: finalObject };
   }
 };
 var INVALID = Object.freeze({
@@ -1037,7 +1037,7 @@ var ZodString = class _ZodString extends ZodType {
       });
       return INVALID;
     }
-    const status = new ParseStatus();
+    const status2 = new ParseStatus();
     let ctx = void 0;
     for (const check of this._def.checks) {
       if (check.kind === "min") {
@@ -1051,7 +1051,7 @@ var ZodString = class _ZodString extends ZodType {
             exact: false,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "max") {
         if (input2.data.length > check.value) {
@@ -1064,7 +1064,7 @@ var ZodString = class _ZodString extends ZodType {
             exact: false,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "length") {
         const tooBig = input2.data.length > check.value;
@@ -1090,7 +1090,7 @@ var ZodString = class _ZodString extends ZodType {
               message: check.message
             });
           }
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "email") {
         if (!emailRegex.test(input2.data)) {
@@ -1100,7 +1100,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "emoji") {
         if (!emojiRegex) {
@@ -1113,7 +1113,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "uuid") {
         if (!uuidRegex.test(input2.data)) {
@@ -1123,7 +1123,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "nanoid") {
         if (!nanoidRegex.test(input2.data)) {
@@ -1133,7 +1133,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "cuid") {
         if (!cuidRegex.test(input2.data)) {
@@ -1143,7 +1143,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "cuid2") {
         if (!cuid2Regex.test(input2.data)) {
@@ -1153,7 +1153,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "ulid") {
         if (!ulidRegex.test(input2.data)) {
@@ -1163,7 +1163,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "url") {
         try {
@@ -1175,7 +1175,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "regex") {
         check.regex.lastIndex = 0;
@@ -1187,7 +1187,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "trim") {
         input2.data = input2.data.trim();
@@ -1199,7 +1199,7 @@ var ZodString = class _ZodString extends ZodType {
             validation: { includes: check.value, position: check.position },
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "toLowerCase") {
         input2.data = input2.data.toLowerCase();
@@ -1213,7 +1213,7 @@ var ZodString = class _ZodString extends ZodType {
             validation: { startsWith: check.value },
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "endsWith") {
         if (!input2.data.endsWith(check.value)) {
@@ -1223,7 +1223,7 @@ var ZodString = class _ZodString extends ZodType {
             validation: { endsWith: check.value },
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "datetime") {
         const regex = datetimeRegex(check);
@@ -1234,7 +1234,7 @@ var ZodString = class _ZodString extends ZodType {
             validation: "datetime",
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "date") {
         const regex = dateRegex;
@@ -1245,7 +1245,7 @@ var ZodString = class _ZodString extends ZodType {
             validation: "date",
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "time") {
         const regex = timeRegex(check);
@@ -1256,7 +1256,7 @@ var ZodString = class _ZodString extends ZodType {
             validation: "time",
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "duration") {
         if (!durationRegex.test(input2.data)) {
@@ -1266,7 +1266,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "ip") {
         if (!isValidIP(input2.data, check.version)) {
@@ -1276,7 +1276,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "jwt") {
         if (!isValidJWT(input2.data, check.alg)) {
@@ -1286,7 +1286,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "cidr") {
         if (!isValidCidr(input2.data, check.version)) {
@@ -1296,7 +1296,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "base64") {
         if (!base64Regex.test(input2.data)) {
@@ -1306,7 +1306,7 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "base64url") {
         if (!base64urlRegex.test(input2.data)) {
@@ -1316,13 +1316,13 @@ var ZodString = class _ZodString extends ZodType {
             code: ZodIssueCode.invalid_string,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else {
         util.assertNever(check);
       }
     }
-    return { status: status.value, value: input2.data };
+    return { status: status2.value, value: input2.data };
   }
   _regex(regex, validation, message) {
     return this.refinement((data) => regex.test(data), {
@@ -1598,7 +1598,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
       return INVALID;
     }
     let ctx = void 0;
-    const status = new ParseStatus();
+    const status2 = new ParseStatus();
     for (const check of this._def.checks) {
       if (check.kind === "int") {
         if (!util.isInteger(input2.data)) {
@@ -1609,7 +1609,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
             received: "float",
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "min") {
         const tooSmall = check.inclusive ? input2.data < check.value : input2.data <= check.value;
@@ -1623,7 +1623,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
             exact: false,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "max") {
         const tooBig = check.inclusive ? input2.data > check.value : input2.data >= check.value;
@@ -1637,7 +1637,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
             exact: false,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "multipleOf") {
         if (floatSafeRemainder(input2.data, check.value) !== 0) {
@@ -1647,7 +1647,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
             multipleOf: check.value,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "finite") {
         if (!Number.isFinite(input2.data)) {
@@ -1656,13 +1656,13 @@ var ZodNumber = class _ZodNumber extends ZodType {
             code: ZodIssueCode.not_finite,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else {
         util.assertNever(check);
       }
     }
-    return { status: status.value, value: input2.data };
+    return { status: status2.value, value: input2.data };
   }
   gte(value, message) {
     return this.setLimit("min", value, true, errorUtil.toString(message));
@@ -1827,7 +1827,7 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
       return this._getInvalidInput(input2);
     }
     let ctx = void 0;
-    const status = new ParseStatus();
+    const status2 = new ParseStatus();
     for (const check of this._def.checks) {
       if (check.kind === "min") {
         const tooSmall = check.inclusive ? input2.data < check.value : input2.data <= check.value;
@@ -1840,7 +1840,7 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
             inclusive: check.inclusive,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "max") {
         const tooBig = check.inclusive ? input2.data > check.value : input2.data >= check.value;
@@ -1853,7 +1853,7 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
             inclusive: check.inclusive,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "multipleOf") {
         if (input2.data % check.value !== BigInt(0)) {
@@ -1863,13 +1863,13 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
             multipleOf: check.value,
             message: check.message
           });
-          status.dirty();
+          status2.dirty();
         }
       } else {
         util.assertNever(check);
       }
     }
-    return { status: status.value, value: input2.data };
+    return { status: status2.value, value: input2.data };
   }
   _getInvalidInput(input2) {
     const ctx = this._getOrReturnCtx(input2);
@@ -2027,7 +2027,7 @@ var ZodDate = class _ZodDate extends ZodType {
       });
       return INVALID;
     }
-    const status = new ParseStatus();
+    const status2 = new ParseStatus();
     let ctx = void 0;
     for (const check of this._def.checks) {
       if (check.kind === "min") {
@@ -2041,7 +2041,7 @@ var ZodDate = class _ZodDate extends ZodType {
             minimum: check.value,
             type: "date"
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (check.kind === "max") {
         if (input2.data.getTime() > check.value) {
@@ -2054,14 +2054,14 @@ var ZodDate = class _ZodDate extends ZodType {
             maximum: check.value,
             type: "date"
           });
-          status.dirty();
+          status2.dirty();
         }
       } else {
         util.assertNever(check);
       }
     }
     return {
-      status: status.value,
+      status: status2.value,
       value: new Date(input2.data.getTime())
     };
   }
@@ -2247,7 +2247,7 @@ ZodVoid.create = (params) => {
 };
 var ZodArray = class _ZodArray extends ZodType {
   _parse(input2) {
-    const { ctx, status } = this._processInputParams(input2);
+    const { ctx, status: status2 } = this._processInputParams(input2);
     const def = this._def;
     if (ctx.parsedType !== ZodParsedType.array) {
       addIssueToContext(ctx, {
@@ -2270,7 +2270,7 @@ var ZodArray = class _ZodArray extends ZodType {
           exact: true,
           message: def.exactLength.message
         });
-        status.dirty();
+        status2.dirty();
       }
     }
     if (def.minLength !== null) {
@@ -2283,7 +2283,7 @@ var ZodArray = class _ZodArray extends ZodType {
           exact: false,
           message: def.minLength.message
         });
-        status.dirty();
+        status2.dirty();
       }
     }
     if (def.maxLength !== null) {
@@ -2296,20 +2296,20 @@ var ZodArray = class _ZodArray extends ZodType {
           exact: false,
           message: def.maxLength.message
         });
-        status.dirty();
+        status2.dirty();
       }
     }
     if (ctx.common.async) {
       return Promise.all([...ctx.data].map((item, i) => {
         return def.type._parseAsync(new ParseInputLazyPath(ctx, item, ctx.path, i));
       })).then((result2) => {
-        return ParseStatus.mergeArray(status, result2);
+        return ParseStatus.mergeArray(status2, result2);
       });
     }
     const result = [...ctx.data].map((item, i) => {
       return def.type._parseSync(new ParseInputLazyPath(ctx, item, ctx.path, i));
     });
-    return ParseStatus.mergeArray(status, result);
+    return ParseStatus.mergeArray(status2, result);
   }
   get element() {
     return this._def.type;
@@ -2398,7 +2398,7 @@ var ZodObject = class _ZodObject extends ZodType {
       });
       return INVALID;
     }
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     const { shape, keys: shapeKeys } = this._getCached();
     const extraKeys = [];
     if (!(this._def.catchall instanceof ZodNever && this._def.unknownKeys === "strip")) {
@@ -2433,7 +2433,7 @@ var ZodObject = class _ZodObject extends ZodType {
             code: ZodIssueCode.unrecognized_keys,
             keys: extraKeys
           });
-          status.dirty();
+          status2.dirty();
         }
       } else if (unknownKeys === "strip") {
       } else {
@@ -2467,10 +2467,10 @@ var ZodObject = class _ZodObject extends ZodType {
         }
         return syncPairs;
       }).then((syncPairs) => {
-        return ParseStatus.mergeObjectSync(status, syncPairs);
+        return ParseStatus.mergeObjectSync(status2, syncPairs);
       });
     } else {
-      return ParseStatus.mergeObjectSync(status, pairs);
+      return ParseStatus.mergeObjectSync(status2, pairs);
     }
   }
   get shape() {
@@ -2948,7 +2948,7 @@ function mergeValues(a, b) {
 }
 var ZodIntersection = class extends ZodType {
   _parse(input2) {
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     const handleParsed = (parsedLeft, parsedRight) => {
       if (isAborted(parsedLeft) || isAborted(parsedRight)) {
         return INVALID;
@@ -2961,9 +2961,9 @@ var ZodIntersection = class extends ZodType {
         return INVALID;
       }
       if (isDirty(parsedLeft) || isDirty(parsedRight)) {
-        status.dirty();
+        status2.dirty();
       }
-      return { status: status.value, value: merged.data };
+      return { status: status2.value, value: merged.data };
     };
     if (ctx.common.async) {
       return Promise.all([
@@ -3001,7 +3001,7 @@ ZodIntersection.create = (left, right, params) => {
 };
 var ZodTuple = class _ZodTuple extends ZodType {
   _parse(input2) {
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     if (ctx.parsedType !== ZodParsedType.array) {
       addIssueToContext(ctx, {
         code: ZodIssueCode.invalid_type,
@@ -3029,7 +3029,7 @@ var ZodTuple = class _ZodTuple extends ZodType {
         exact: false,
         type: "array"
       });
-      status.dirty();
+      status2.dirty();
     }
     const items = [...ctx.data].map((item, itemIndex) => {
       const schema = this._def.items[itemIndex] || this._def.rest;
@@ -3039,10 +3039,10 @@ var ZodTuple = class _ZodTuple extends ZodType {
     }).filter((x) => !!x);
     if (ctx.common.async) {
       return Promise.all(items).then((results) => {
-        return ParseStatus.mergeArray(status, results);
+        return ParseStatus.mergeArray(status2, results);
       });
     } else {
-      return ParseStatus.mergeArray(status, items);
+      return ParseStatus.mergeArray(status2, items);
     }
   }
   get items() {
@@ -3074,7 +3074,7 @@ var ZodRecord = class _ZodRecord extends ZodType {
     return this._def.valueType;
   }
   _parse(input2) {
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     if (ctx.parsedType !== ZodParsedType.object) {
       addIssueToContext(ctx, {
         code: ZodIssueCode.invalid_type,
@@ -3094,9 +3094,9 @@ var ZodRecord = class _ZodRecord extends ZodType {
       });
     }
     if (ctx.common.async) {
-      return ParseStatus.mergeObjectAsync(status, pairs);
+      return ParseStatus.mergeObjectAsync(status2, pairs);
     } else {
-      return ParseStatus.mergeObjectSync(status, pairs);
+      return ParseStatus.mergeObjectSync(status2, pairs);
     }
   }
   get element() {
@@ -3127,7 +3127,7 @@ var ZodMap = class extends ZodType {
     return this._def.valueType;
   }
   _parse(input2) {
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     if (ctx.parsedType !== ZodParsedType.map) {
       addIssueToContext(ctx, {
         code: ZodIssueCode.invalid_type,
@@ -3154,11 +3154,11 @@ var ZodMap = class extends ZodType {
             return INVALID;
           }
           if (key.status === "dirty" || value.status === "dirty") {
-            status.dirty();
+            status2.dirty();
           }
           finalMap.set(key.value, value.value);
         }
-        return { status: status.value, value: finalMap };
+        return { status: status2.value, value: finalMap };
       });
     } else {
       const finalMap = /* @__PURE__ */ new Map();
@@ -3169,11 +3169,11 @@ var ZodMap = class extends ZodType {
           return INVALID;
         }
         if (key.status === "dirty" || value.status === "dirty") {
-          status.dirty();
+          status2.dirty();
         }
         finalMap.set(key.value, value.value);
       }
-      return { status: status.value, value: finalMap };
+      return { status: status2.value, value: finalMap };
     }
   }
 };
@@ -3187,7 +3187,7 @@ ZodMap.create = (keyType, valueType, params) => {
 };
 var ZodSet = class _ZodSet extends ZodType {
   _parse(input2) {
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     if (ctx.parsedType !== ZodParsedType.set) {
       addIssueToContext(ctx, {
         code: ZodIssueCode.invalid_type,
@@ -3207,7 +3207,7 @@ var ZodSet = class _ZodSet extends ZodType {
           exact: false,
           message: def.minSize.message
         });
-        status.dirty();
+        status2.dirty();
       }
     }
     if (def.maxSize !== null) {
@@ -3220,7 +3220,7 @@ var ZodSet = class _ZodSet extends ZodType {
           exact: false,
           message: def.maxSize.message
         });
-        status.dirty();
+        status2.dirty();
       }
     }
     const valueType = this._def.valueType;
@@ -3230,10 +3230,10 @@ var ZodSet = class _ZodSet extends ZodType {
         if (element.status === "aborted")
           return INVALID;
         if (element.status === "dirty")
-          status.dirty();
+          status2.dirty();
         parsedSet.add(element.value);
       }
-      return { status: status.value, value: parsedSet };
+      return { status: status2.value, value: parsedSet };
     }
     const elements = [...ctx.data.values()].map((item, i) => valueType._parse(new ParseInputLazyPath(ctx, item, ctx.path, i)));
     if (ctx.common.async) {
@@ -3564,15 +3564,15 @@ var ZodEffects = class extends ZodType {
     return this._def.schema._def.typeName === ZodFirstPartyTypeKind.ZodEffects ? this._def.schema.sourceType() : this._def.schema;
   }
   _parse(input2) {
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     const effect = this._def.effect || null;
     const checkCtx = {
       addIssue: (arg) => {
         addIssueToContext(ctx, arg);
         if (arg.fatal) {
-          status.abort();
+          status2.abort();
         } else {
-          status.dirty();
+          status2.dirty();
         }
       },
       get path() {
@@ -3584,7 +3584,7 @@ var ZodEffects = class extends ZodType {
       const processed = effect.transform(ctx.data, checkCtx);
       if (ctx.common.async) {
         return Promise.resolve(processed).then(async (processed2) => {
-          if (status.value === "aborted")
+          if (status2.value === "aborted")
             return INVALID;
           const result = await this._def.schema._parseAsync({
             data: processed2,
@@ -3595,12 +3595,12 @@ var ZodEffects = class extends ZodType {
             return INVALID;
           if (result.status === "dirty")
             return DIRTY(result.value);
-          if (status.value === "dirty")
+          if (status2.value === "dirty")
             return DIRTY(result.value);
           return result;
         });
       } else {
-        if (status.value === "aborted")
+        if (status2.value === "aborted")
           return INVALID;
         const result = this._def.schema._parseSync({
           data: processed,
@@ -3611,7 +3611,7 @@ var ZodEffects = class extends ZodType {
           return INVALID;
         if (result.status === "dirty")
           return DIRTY(result.value);
-        if (status.value === "dirty")
+        if (status2.value === "dirty")
           return DIRTY(result.value);
         return result;
       }
@@ -3636,17 +3636,17 @@ var ZodEffects = class extends ZodType {
         if (inner.status === "aborted")
           return INVALID;
         if (inner.status === "dirty")
-          status.dirty();
+          status2.dirty();
         executeRefinement(inner.value);
-        return { status: status.value, value: inner.value };
+        return { status: status2.value, value: inner.value };
       } else {
         return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((inner) => {
           if (inner.status === "aborted")
             return INVALID;
           if (inner.status === "dirty")
-            status.dirty();
+            status2.dirty();
           return executeRefinement(inner.value).then(() => {
-            return { status: status.value, value: inner.value };
+            return { status: status2.value, value: inner.value };
           });
         });
       }
@@ -3664,13 +3664,13 @@ var ZodEffects = class extends ZodType {
         if (result instanceof Promise) {
           throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
         }
-        return { status: status.value, value: result };
+        return { status: status2.value, value: result };
       } else {
         return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
           if (!isValid(base))
             return INVALID;
           return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
-            status: status.value,
+            status: status2.value,
             value: result
           }));
         });
@@ -3849,7 +3849,7 @@ var ZodBranded = class extends ZodType {
 };
 var ZodPipeline = class _ZodPipeline extends ZodType {
   _parse(input2) {
-    const { status, ctx } = this._processInputParams(input2);
+    const { status: status2, ctx } = this._processInputParams(input2);
     if (ctx.common.async) {
       const handleAsync = async () => {
         const inResult = await this._def.in._parseAsync({
@@ -3860,7 +3860,7 @@ var ZodPipeline = class _ZodPipeline extends ZodType {
         if (inResult.status === "aborted")
           return INVALID;
         if (inResult.status === "dirty") {
-          status.dirty();
+          status2.dirty();
           return DIRTY(inResult.value);
         } else {
           return this._def.out._parseAsync({
@@ -3880,7 +3880,7 @@ var ZodPipeline = class _ZodPipeline extends ZodType {
       if (inResult.status === "aborted")
         return INVALID;
       if (inResult.status === "dirty") {
-        status.dirty();
+        status2.dirty();
         return {
           status: "dirty",
           value: inResult.value
@@ -4631,6 +4631,39 @@ function projectCodexThread(value) {
     ...typeof value.isPinned === "boolean" ? { pinned: value.isPinned } : {}
   };
 }
+function deriveCodexCwdWorkspaces(values) {
+  const byPath = /* @__PURE__ */ new Map();
+  const usedIds = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const session = projectCodexThread(value);
+    if (session === void 0 || session.cwd === void 0 || session.cwd.length === 0)
+      continue;
+    const path = session.cwd;
+    if (!isAbsoluteWorkspacePath(path))
+      continue;
+    const key = normalizeWorkspacePath(path);
+    const existing = byPath.get(key);
+    if (existing !== void 0) {
+      existing.createdAt = earliestTimestamp(existing.createdAt, session.createdAt);
+      existing.updatedAt = Math.max(existing.updatedAt, session.updatedAt);
+      continue;
+    }
+    const baseId = `cwd-${hashWorkspacePath(key)}`;
+    let id2 = baseId;
+    for (let suffix = 2; usedIds.has(id2); suffix += 1)
+      id2 = `${baseId}-${suffix}`;
+    usedIds.add(id2);
+    byPath.set(key, {
+      id: id2,
+      name: workspaceBasename(path),
+      path,
+      position: byPath.size,
+      createdAt: session.createdAt,
+      updatedAt: session.updatedAt
+    });
+  }
+  return [...byPath.values()];
+}
 function projectCodexHistory(thread) {
   if (!isRecord(thread) || typeof thread.id !== "string" || !Array.isArray(thread.turns))
     return [];
@@ -4884,6 +4917,31 @@ function boundedText(value) {
   return value.length <= MAX_DISPLAY_ITEM_TEXT ? value : `${value.slice(0, MAX_DISPLAY_ITEM_TEXT)}
 \u2026`;
 }
+function normalizeWorkspacePath(value) {
+  return value.replace(/[\\/]+$/u, "") || value;
+}
+function isAbsoluteWorkspacePath(value) {
+  return value.startsWith("/") || /^\\\\[^\\]+\\[^\\]+/u.test(value) || /^[A-Za-z]:[\\/]/u.test(value);
+}
+function workspaceBasename(value) {
+  const normalized = normalizeWorkspacePath(value);
+  return normalized.split(/[\\/]/u).at(-1) || value;
+}
+function earliestTimestamp(left, right) {
+  if (left <= 0)
+    return right;
+  if (right <= 0)
+    return left;
+  return Math.min(left, right);
+}
+function hashWorkspacePath(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(36);
+}
 function normalizeTimestamp(value) {
   if (typeof value !== "number" || !Number.isFinite(value) || value <= 0)
     return 0;
@@ -4976,13 +5034,13 @@ var RemoteClientCore = class {
     if (signal?.aborted)
       throw rpcAbortedError(method, signal.reason);
     const request = createRpcRequest(method, params);
-    const result = new Promise((resolve2, reject) => {
+    const result = new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         this.rejectPending(request.id, new RemoteClientError("RPC_TIMEOUT", `RPC ${method} timed out after ${this.timeoutMs}ms`));
       }, this.timeoutMs);
       const pending = {
         method,
-        resolve: resolve2,
+        resolve: resolve3,
         reject,
         timer
       };
@@ -5546,8 +5604,8 @@ var RtcDataChannelTransport = class {
     if (this.connectPromise !== void 0)
       return this.connectPromise;
     this.armAbort(signal);
-    this.connectPromise = new Promise((resolve2, reject) => {
-      this.openResolve = resolve2;
+    this.connectPromise = new Promise((resolve3, reject) => {
+      this.openResolve = resolve3;
       this.openReject = reject;
       this.negotiateTimer = setTimeout(() => {
         void this.failOpenAfterStats(new RtcConnectError("RTC_CONNECT_TIMEOUT", `WebRTC negotiation timed out after ${this.negotiateTimeoutMs}ms.`));
@@ -5762,9 +5820,9 @@ var RtcDataChannelTransport = class {
       if (this.closed || this.opened)
         return;
       this.opened = true;
-      const resolve2 = this.openResolve;
+      const resolve3 = this.openResolve;
       this.clearNegotiation();
-      void this.resolveSelectedTransport().then(() => resolve2?.());
+      void this.resolveSelectedTransport().then(() => resolve3?.());
     };
     channel.onmessage = (event) => {
       if (this.closed || !this.opened)
@@ -6158,7 +6216,7 @@ function asError(error) {
   return error instanceof Error ? error : new RtcConnectError("RTC_FAILED", "WebRTC negotiation failed.");
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 
 // ../webrtc/dist/adaptive-transport.js
@@ -6196,8 +6254,8 @@ var AdaptiveTransport = class extends BaseTransport {
     this.socket = new WebSocket(this.url);
     this.controlFrameLimits = {};
     this.socket.binaryType = "arraybuffer";
-    await new Promise((resolve2, reject) => {
-      this.readyResolve = resolve2;
+    await new Promise((resolve3, reject) => {
+      this.readyResolve = resolve3;
       this.readyReject = reject;
       this.handshakeTimer = setTimeout(() => this.failConnection(new Error("Adaptive control handshake timed out")), this.options.handshakeTimeoutMs ?? 15e3);
       const socket = this.socket;
@@ -13774,7 +13832,7 @@ var ClientSecureTransport = class {
   }
 };
 async function waitForResponder(inner, noise) {
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     let settled = false;
     const timer = setTimeout(() => finish(new Error("Noise IK handshake timed out.")), 1e4);
     const unsubscribe = inner.onHandshake((step, data) => {
@@ -13793,7 +13851,7 @@ async function waitForResponder(inner, noise) {
       settled = true;
       clearTimeout(timer);
       unsubscribe();
-      if (error === void 0) resolve2();
+      if (error === void 0) resolve3();
       else reject(error);
     };
     void inner.sendHandshake(1, noise.writeHandshake()).catch((error) => {
@@ -14051,7 +14109,7 @@ var AsyncFrameQueue = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve2) => this.waiters.push(resolve2));
+      const next = await new Promise((resolve3) => this.waiters.push(resolve3));
       if (next.done) return;
       yield next.value;
     }
@@ -14239,7 +14297,7 @@ var AsyncValueQueue = class {
         if (this.error !== void 0) throw this.error;
         return;
       }
-      const next = await new Promise((resolve2) => this.waiters.push(resolve2));
+      const next = await new Promise((resolve3) => this.waiters.push(resolve3));
       if (next.done) {
         if (this.error !== void 0) throw this.error;
         return;
@@ -14479,7 +14537,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
         case "commands/list":
           return ok(this.commandList(args));
         case "commands/execute":
-          return ok(this.executeCommand(args));
+          return ok(await this.executeCommand(args, signal));
         default:
           return fail("method-not-found", `CodeX virtual Harness does not implement ${endpoint}.`);
       }
@@ -14553,6 +14611,10 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   permissionSelection(sessionId) {
     return this.selectedPermissions.get(sessionId) ?? CODEX_DEFAULT_PERMISSION;
   }
+  setPermissionSelection(sessionId, preset) {
+    this.selectedPermissions.set(sessionId, preset);
+    this.publishProjection(sessionId, "permissions", codexPermissionsProjection(preset), this.nextProjectionSeq());
+  }
   commandList(args) {
     nativeThreadId(requiredString(args.agentId, "agentId"));
     return [{
@@ -14561,9 +14623,9 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       input: { hint: "<preset>" }
     }];
   }
-  executeCommand(args) {
+  async executeCommand(args, signal) {
     const sessionId = requiredString(args.agentId, "agentId");
-    nativeThreadId(sessionId);
+    const threadId = nativeThreadId(sessionId);
     const line = requiredString(args.line, "command line").trim();
     if (!Array.isArray(args.images)) throw new Error("The CodeX command image list is required.");
     const match = /^\/permission(?:\s+([\s\S]*))?$/u.exec(line);
@@ -14582,9 +14644,10 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       commandId,
       result: { kind: "error", text: `unknown preset "${requested}" (available: workspace-write, danger-full-access)` }
     };
-    this.selectedPermissions.set(sessionId, requested);
-    this.publishProjection(sessionId, "permissions", codexPermissionsProjection(requested), this.nextProjectionSeq());
-    return { commandId, result: { kind: "success", text: `preset ${requested}` } };
+    const result = await this.client.request("thread/resume", { threadId, permissionPreset: requested }, signal);
+    const effective = codexPermissionPresetFromResponse(result) ?? requested;
+    this.setPermissionSelection(sessionId, effective);
+    return { commandId, result: { kind: "success", text: `preset ${effective}` } };
   }
   sessionTitle(sessionId) {
     const session = this.catalog?.sessions.find((item) => item.id === sessionId);
@@ -14728,7 +14791,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       queue,
       nextSeq: history.cursor + 1,
       turn: history.nextTurn,
-      stepOpen: false,
+      stepOpen: history.activeTurnId !== void 0,
       startedItems: /* @__PURE__ */ new Set(),
       completedItems: /* @__PURE__ */ new Set(),
       streamedBlocks: /* @__PURE__ */ new Map(),
@@ -14737,7 +14800,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       liveItems: /* @__PURE__ */ new Map(),
       liveToolOutput: /* @__PURE__ */ new Map(),
       liveToolResultSeq: /* @__PURE__ */ new Map(),
-      requestId: this.pendingRequestIds.get(sessionId)
+      requestId: this.pendingRequestIds.get(sessionId),
+      ...history.activeTurnId === void 0 ? {} : { activeTurnId: history.activeTurnId }
     };
     this.follows.add(follow);
     queue.push({
@@ -14786,6 +14850,11 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       this.publishProjection(follow.sessionId, "title", title, seq);
       return;
     }
+    if (frame.method === "thread/settings/updated") {
+      const preset = codexPermissionPresetFromResponse(params);
+      if (preset !== void 0) this.setPermissionSelection(follow.sessionId, preset);
+      return;
+    }
     if (frame.method === "turn/started") {
       const turn = record(params.turn);
       this.resetLiveTurn(follow);
@@ -14840,8 +14909,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
         const item = record(value);
         const content = string(item.step);
         if (content === void 0) return [];
-        const status = item.status === "inProgress" ? "in_progress" : item.status === "completed" ? "completed" : "pending";
-        return [{ content, status }];
+        const status2 = item.status === "inProgress" ? "in_progress" : item.status === "completed" ? "completed" : "pending";
+        return [{ content, status: status2 }];
       });
       this.pushEvent(follow, "todo/write", { todos });
       return;
@@ -14871,10 +14940,10 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       return;
     }
     if (frame.method === "thread/status/changed") {
-      const status = record(params.status);
-      const running = status.type === "active";
+      const status2 = record(params.status);
+      const running = status2.type === "active";
       this.emitRemoteEvent("api-session/status", [follow.sessionId, running]);
-      if (status.type === "systemError") {
+      if (status2.type === "systemError") {
         this.broadcastRcHost({
           type: "host/agent-error",
           sessionId: follow.sessionId,
@@ -15168,12 +15237,13 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     if (cwd === void 0) return failure("workspace-not-found", "The CodeX virtual Workspace was not found.");
     const directory = await this.models(signal);
     const selection = directory.default;
-    const permissionPreset2 = CODEX_DEFAULT_PERMISSION;
+    const requestedPreset = CODEX_DEFAULT_PERMISSION;
     const result = record(await this.client.request("thread/start", {
       cwd,
       model: selection.model,
-      permissionPreset: permissionPreset2
+      permissionPreset: requestedPreset
     }, signal));
+    const permissionPreset2 = codexPermissionPresetFromResponse(result) ?? requestedPreset;
     const thread = { ...record(result.thread), cwd, turns: array(record(result.thread).turns) };
     const projected = projectCodexThread(thread);
     if (projected === void 0) return failure("internal", "CodeX returned an invalid Thread.");
@@ -15194,11 +15264,12 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   async forkSession(request, signal) {
     const sessionId = requiredString(request.sessionId, "sessionId");
-    const permissionPreset2 = this.permissionSelection(sessionId);
+    let permissionPreset2 = this.selectedPermissions.get(sessionId);
     const result = record(await this.client.request("thread/fork", {
       threadId: nativeThreadId(sessionId),
-      permissionPreset: permissionPreset2
+      ...permissionPreset2 === void 0 ? {} : { permissionPreset: permissionPreset2 }
     }, signal));
+    permissionPreset2 = codexPermissionPresetFromResponse(result) ?? permissionPreset2 ?? CODEX_DEFAULT_PERMISSION;
     const projected = projectCodexThread(record(result.thread));
     if (projected === void 0) return failure("internal", "CodeX returned an invalid forked Thread.");
     this.selectedModels.set(projected.id, this.modelSelection(sessionId, await this.models(signal)));
@@ -15215,14 +15286,20 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     if (input2 === void 0) return failure("attachment-error", "CodeX virtual Sessions accept text and pasted PNG, JPEG, WebP, or GIF images only.");
     const threadId = nativeThreadId(sessionId);
     const selection = this.modelSelection(sessionId, await this.models(signal));
-    const permissionPreset2 = this.permissionSelection(sessionId);
+    let permissionPreset2 = this.selectedPermissions.get(sessionId);
     const isFreshBlankThread = this.blankThreads.has(threadId) || this.pendingThreads.has(threadId);
     await this.ensureRcFollow(sessionId);
-    if (!isFreshBlankThread) await this.client.request("thread/resume", {
-      threadId,
-      model: selection.model,
-      permissionPreset: permissionPreset2
-    }, signal);
+    if (!isFreshBlankThread) {
+      const resumeResult = await this.client.request("thread/resume", {
+        threadId,
+        model: selection.model
+      }, signal);
+      const serverPreset = codexPermissionPresetFromResponse(resumeResult);
+      if (permissionPreset2 === void 0 && serverPreset !== void 0) {
+        permissionPreset2 = serverPreset;
+        this.setPermissionSelection(sessionId, serverPreset);
+      }
+    }
     this.pendingRequestIds.set(sessionId, string(request.requestId) ?? "");
     const mode = request.mode === "steer" ? "turn/steer" : "turn/start";
     if (mode === "turn/steer") {
@@ -15234,7 +15311,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
         threadId,
         input: input2,
         ...codexModelParams(selection),
-        permissionPreset: permissionPreset2
+        ...permissionPreset2 === void 0 ? {} : { permissionPreset: permissionPreset2 }
       }, signal);
     }
     this.blankThreads.delete(threadId);
@@ -15376,7 +15453,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       queue: new AsyncValueQueue2(controller.signal),
       nextSeq: history.cursor + 1,
       turn: history.nextTurn,
-      stepOpen: false,
+      stepOpen: history.activeTurnId !== void 0,
       startedItems: /* @__PURE__ */ new Set(),
       completedItems: /* @__PURE__ */ new Set(),
       streamedBlocks: /* @__PURE__ */ new Map(),
@@ -15386,7 +15463,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       liveToolOutput: /* @__PURE__ */ new Map(),
       liveToolResultSeq: /* @__PURE__ */ new Map(),
       requestId: this.pendingRequestIds.get(sessionId),
-      rcOnly: true
+      rcOnly: true,
+      ...history.activeTurnId === void 0 ? {} : { activeTurnId: history.activeTurnId }
     };
     this.follows.add(follow);
     try {
@@ -15520,7 +15598,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
 };
 async function loadCatalog(client, signal, pendingThreads) {
-  const projects = await loadCodexProjects(client, signal);
+  let projects = await loadCodexProjects(client, signal);
   const threads = [];
   let cursor2;
   for (let page = 0; page < MAX_CODEX_PAGES; page += 1) {
@@ -15545,6 +15623,16 @@ async function loadCatalog(client, signal, pendingThreads) {
       else threads.unshift(thread);
     }
   }
+  if (projects.length === 0) {
+    projects = deriveCodexCwdWorkspaces(threads).map((workspace) => ({
+      id: workspace.id,
+      name: workspace.name,
+      roots: [{ path: workspace.path }],
+      position: workspace.position,
+      createdAt: workspace.createdAt,
+      updatedAt: workspace.updatedAt
+    }));
+  }
   const projected = threads.map((thread) => {
     const session = projectCodexThread(thread);
     return session === void 0 ? void 0 : { thread, session };
@@ -15653,6 +15741,7 @@ function projectCodexNativeHistory(thread, sessionId) {
   const entries = [];
   let seq = 0;
   let turnNumber = 0;
+  const active = activeTurnId(thread.turns);
   const append = (type, data, time = Date.now(), view, sourceEventSeqs) => {
     const eventSeq = seq++;
     entries.push({
@@ -15672,6 +15761,7 @@ function projectCodexNativeHistory(thread, sessionId) {
   for (const rawTurn of array(thread.turns)) {
     const turn = record(rawTurn);
     turnNumber += 1;
+    const turnActive = isActiveCodexTurn(turn);
     const time = normalizeTime(turn.createdAt) || normalizeTime(turn.startedAt) || normalizeTime(thread.createdAt) || Date.now();
     append("turn/start", { turn: turnNumber }, time);
     append("step/start", { turn: turnNumber, step: 1 }, time);
@@ -15689,6 +15779,7 @@ function projectCodexNativeHistory(thread, sessionId) {
         if (event.type === "tool/call") toolCallSeq = eventSeq;
       }
     }
+    if (turnActive) continue;
     append("step/end", { turn: turnNumber, step: 1 }, normalizeTime(turn.updatedAt) || normalizeTime(turn.completedAt) || time);
     append("turn/end", {
       turn: turnNumber,
@@ -15705,7 +15796,8 @@ function projectCodexNativeHistory(thread, sessionId) {
     },
     entries,
     lastSeq: seq - 1,
-    nextTurn: turnNumber
+    nextTurn: turnNumber,
+    ...active === void 0 ? {} : { activeTurnId: active }
   };
 }
 function paginateCodexNativeHistory(history, request) {
@@ -15729,7 +15821,8 @@ function paginateCodexNativeHistory(history, request) {
     cursor: history.lastSeq,
     nextTurn: history.nextTurn,
     records: window.filter((entry) => entry.event.seq >= cut),
-    hasMore: window.some((entry) => entry.event.seq < cut)
+    hasMore: window.some((entry) => entry.event.seq < cut),
+    ...history.activeTurnId === void 0 ? {} : { activeTurnId: history.activeTurnId }
   };
 }
 function itemEvents(item, turn, step, requestId, selection = modelSelection(), sessionId = CODEX_SESSION_PREFIX) {
@@ -16242,6 +16335,22 @@ function codexImageLimitsProjection() {
 function isCodexPermissionPreset(value) {
   return value === "workspace-write" || value === "danger-full-access";
 }
+function codexPermissionPresetFromResponse(value) {
+  const root = record(value);
+  return codexPermissionPresetFromPolicyRecord(root) ?? codexPermissionPresetFromPolicyRecord(record(root.threadSettings));
+}
+function codexPermissionPresetFromPolicyRecord(value) {
+  const sandbox = value.sandbox ?? value.sandboxPolicy;
+  if (value.approvalPolicy === "never" && isDangerFullAccessSandbox(sandbox)) return "danger-full-access";
+  if (value.approvalPolicy === "on-request" && isWorkspaceWriteSandbox(sandbox)) return "workspace-write";
+  return void 0;
+}
+function isDangerFullAccessSandbox(value) {
+  return value === "danger-full-access" || record(value).type === "dangerFullAccess";
+}
+function isWorkspaceWriteSandbox(value) {
+  return value === "workspace-write" || record(value).type === "workspaceWrite";
+}
 function modelCatalog(directory) {
   return {
     default: directory.default,
@@ -16382,6 +16491,17 @@ function nativeThreadId(sessionId) {
   }
   return sessionId.slice(CODEX_SESSION_PREFIX.length);
 }
+function activeTurnId(value) {
+  if (!Array.isArray(value)) return void 0;
+  for (let index = value.length - 1; index >= 0; index -= 1) {
+    const turn = record(value[index]);
+    if (isActiveCodexTurn(turn) && typeof turn.id === "string" && turn.id.length > 0) return turn.id;
+  }
+  return void 0;
+}
+function isActiveCodexTurn(turn) {
+  return turn.status === "inProgress" || turn.status === "running";
+}
 function carrierArgs(payload) {
   return record(record(payload).args);
 }
@@ -16464,7 +16584,7 @@ function optionalPositiveInteger(value) {
 function isCodexNativeHistoryPage(value, sessionId) {
   const page = record(value);
   const header = record(page.header);
-  return header.id === sessionId && integer(page.cursor) !== void 0 && integer(page.nextTurn) !== void 0 && Array.isArray(page.records) && typeof page.hasMore === "boolean";
+  return header.id === sessionId && integer(page.cursor) !== void 0 && integer(page.nextTurn) !== void 0 && Array.isArray(page.records) && typeof page.hasMore === "boolean" && (page.activeTurnId === void 0 || typeof page.activeTurnId === "string");
 }
 function truncateCodePoints(value, maximum) {
   return [...value].slice(0, maximum).join("");
@@ -16541,7 +16661,7 @@ var AsyncValueQueue2 = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve2) => this.waiters.push(resolve2));
+      const next = await new Promise((resolve3) => this.waiters.push(resolve3));
       if (next.done) return;
       yield next.value;
     }
@@ -16554,6 +16674,7 @@ import { platform } from "node:os";
 // src/config.ts
 import { hostname } from "node:os";
 import s from "@deepseek-ai/schemastery";
+var DEFAULT_REMOTE_SERVER_URL = "https://dsh.r2049.cn";
 var Config = s.object({
   enabled: s.boolean(),
   role: s.union(["host", "client", "both"]),
@@ -16643,9 +16764,10 @@ function normalizeServerUrl(value) {
 }
 
 // src/version.ts
-var PLUGIN_VERSION = "0.4.3";
+var PLUGIN_VERSION = "0.4.4";
 
 // src/server-api.ts
+var TERMINAL_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/u;
 var HostServerApi = class {
   constructor(serverUrl, store, fetchImplementation = fetch, role = "host") {
     this.store = store;
@@ -16694,20 +16816,20 @@ var HostServerApi = class {
     if (account.length === 0 || password.length === 0) {
       throw new ServerApiError("INVALID_MESSAGE", "Email and password are required.", false);
     }
-    const login = validateWebLogin(await this.publicRequest("/api/v1/auth/login", {
+    const login2 = validateWebLogin(await this.publicRequest("/api/v1/auth/login", {
       method: "POST",
       body: JSON.stringify({ email: account, password })
     }));
     await this.register(identity, {
-      accountToken: login.token,
-      account: login.account,
+      accountToken: login2.token,
+      account: login2.account,
       authorizationMethod: "account"
     });
     return {
       method: "account",
-      account: login.account,
-      expiresAt: login.expiresAt,
-      isAdmin: login.isAdmin
+      account: login2.account,
+      expiresAt: login2.expiresAt,
+      isAdmin: login2.isAdmin
     };
   }
   async startOAuthQrLogin(provider = "zhihu") {
@@ -16715,10 +16837,11 @@ var HostServerApi = class {
       method: "POST",
       body: "{}"
     }), "QR login");
-    if (typeof value.qrId !== "string" || value.qrId.length < 20 || typeof value.scanUrl !== "string" || !value.scanUrl.startsWith(`${this.baseUrl}/`) || !Number.isSafeInteger(value.expiresIn) || provider === "github" && value.provider !== "github" || value.provider !== void 0 && value.provider !== provider) {
+    const scanUrl = normalizeOAuthScanUrl(value.scanUrl, this.baseUrl);
+    if (typeof value.qrId !== "string" || value.qrId.length < 20 || scanUrl === void 0 || !Number.isSafeInteger(value.expiresIn) || provider === "github" && value.provider !== "github" || value.provider !== void 0 && value.provider !== provider) {
       throw new ServerApiError("INVALID_MESSAGE", "The Server returned an invalid QR login session.", false);
     }
-    return { qrId: value.qrId, scanUrl: value.scanUrl, expiresIn: value.expiresIn };
+    return { qrId: value.qrId, scanUrl, expiresIn: value.expiresIn };
   }
   async pollOAuthQrLogin(identity, qrId, recoverIdentity) {
     this.bindIdentity(identity);
@@ -16933,17 +17056,26 @@ var HostServerApi = class {
     return this.identity;
   }
 };
+function normalizeOAuthScanUrl(value, baseUrl) {
+  if (typeof value !== "string" || TERMINAL_CONTROL_CHARACTERS.test(value)) return void 0;
+  try {
+    const normalized = new URL(value).href;
+    return normalized.startsWith(`${baseUrl}/`) ? normalized : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var ClientServerApi = class extends HostServerApi {
   constructor(serverUrl, store, fetchImplementation = fetch) {
     super(serverUrl, store, fetchImplementation, "client");
   }
 };
 var ServerApiError = class extends Error {
-  constructor(code, message, retryable, status) {
+  constructor(code, message, retryable, status2) {
     super(message);
     this.code = code;
     this.retryable = retryable;
-    this.status = status;
+    this.status = status2;
   }
 };
 function validateTokens(value) {
@@ -16974,12 +17106,12 @@ async function parseBody(response) {
     throw new ServerApiError("INVALID_MESSAGE", "The Server returned invalid JSON.", false, response.status);
   }
 }
-function mapStatus(status) {
-  if (status === 401) return "AUTH_INVALID";
-  if (status === 403) return "AUTH_REQUIRED";
-  if (status === 404) return "DEVICE_NOT_FOUND";
-  if (status === 429) return "RATE_LIMITED";
-  return status >= 500 ? "CONNECTION_FAILED" : "INVALID_MESSAGE";
+function mapStatus(status2) {
+  if (status2 === 401) return "AUTH_INVALID";
+  if (status2 === 403) return "AUTH_REQUIRED";
+  if (status2 === 404) return "DEVICE_NOT_FOUND";
+  if (status2 === 429) return "RATE_LIMITED";
+  return status2 >= 500 ? "CONNECTION_FAILED" : "INVALID_MESSAGE";
 }
 function parseHostDevice(value) {
   const item = requireRecord(value, "host device");
@@ -17281,10 +17413,10 @@ function isUsableExternalNode(candidate, requireFrom) {
 }
 function isExecutableFile(candidate) {
   try {
-    const stat4 = statSync(candidate);
-    if (!stat4.isFile()) return false;
+    const stat6 = statSync(candidate);
+    if (!stat6.isFile()) return false;
     if (process.platform === "win32") return true;
-    return (stat4.mode & 73) !== 0;
+    return (stat6.mode & 73) !== 0;
   } catch {
     return false;
   }
@@ -17373,8 +17505,8 @@ var ExternalNativePeerConnection = class {
   request(method, payload) {
     if (this.closed) return Promise.reject(new Error("native rtc helper is closed"));
     const id2 = this.nextRequestId++;
-    const promise = new Promise((resolve2, reject) => {
-      this.pending.set(id2, { resolve: resolve2, reject });
+    const promise = new Promise((resolve3, reject) => {
+      this.pending.set(id2, { resolve: resolve3, reject });
     });
     this.write({ id: id2, method, payload });
     return promise;
@@ -18168,10 +18300,10 @@ function parseRouteTarget(value) {
 async function detectRouteHostIpv4(target, timeoutMs) {
   const socket = createSocket("udp4");
   try {
-    return await new Promise((resolve2, reject) => {
+    return await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         cleanup();
-        resolve2(void 0);
+        resolve3(void 0);
       }, timeoutMs);
       const cleanup = () => {
         clearTimeout(timer);
@@ -18185,7 +18317,7 @@ async function detectRouteHostIpv4(target, timeoutMs) {
       socket.connect(target.port, target.host, () => {
         cleanup();
         const address = socket.address();
-        resolve2(typeof address === "string" ? void 0 : address.address);
+        resolve3(typeof address === "string" ? void 0 : address.address);
       });
     });
   } finally {
@@ -19139,7 +19271,7 @@ async function probeRemoteHostFeatures(client, clientVersion) {
 }
 async function waitForCodexFrames(stream, signal) {
   if (signal?.aborted) throw new ClientModeError("RPC_ABORTED", "The Codex event poll was cancelled.");
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     const previousWake = stream.wake;
     const timer = setTimeout(done, 25e3);
     const onAbort = () => {
@@ -19153,7 +19285,7 @@ async function waitForCodexFrames(stream, signal) {
     }
     function done() {
       cleanup();
-      resolve2();
+      resolve3();
     }
     stream.wake = () => {
       previousWake();
@@ -20368,7 +20500,7 @@ var HostServerConnection = class {
     this.controlFrameLimits = {};
     let acknowledged = false;
     let messageQueue = Promise.resolve();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       let settled = false;
       const helloTimer = setTimeout(() => socket.close(4001, "hello timeout"), 1e4);
       const finish = (error) => {
@@ -20377,7 +20509,7 @@ var HostServerConnection = class {
         clearTimeout(helloTimer);
         this.online = false;
         if (this.socket === socket) this.socket = void 0;
-        void this.dropTunnels().finally(() => error === void 0 ? resolve2() : reject(error));
+        void this.dropTunnels().finally(() => error === void 0 ? resolve3() : reject(error));
       };
       socket.onopen = () => {
         this.sendControl("hello", {
@@ -20895,14 +21027,14 @@ var HostServerConnection = class {
   waitBeforeRetry(baseDelay) {
     const spread = baseDelay * this.config.reconnect.jitter;
     const delay = Math.max(0, Math.round(baseDelay - spread + Math.random() * spread * 2));
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const timer = setTimeout(() => {
         this.retryWake = void 0;
-        resolve2();
+        resolve3();
       }, delay);
       this.retryWake = () => {
         clearTimeout(timer);
-        resolve2();
+        resolve3();
       };
     });
   }
@@ -21868,7 +22000,7 @@ function historyRequestPayload(payload, maxMessages) {
   return { ...payload, maxMessages };
 }
 function withTimeout(promise, ms, message) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const timer = setTimeout(() => {
       reject(new RpcError("TIMEOUT", message, void 0, true));
     }, ms);
@@ -21876,7 +22008,7 @@ function withTimeout(promise, ms, message) {
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve2(value);
+        resolve3(value);
       },
       (error) => {
         clearTimeout(timer);
@@ -22206,8 +22338,9 @@ function concatChunks2(chunks, totalBytes) {
 
 // src/codex/domain.ts
 import { randomUUID } from "node:crypto";
+import { realpath, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { isAbsolute as isAbsolute3, join as join5 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join5, resolve as resolve2 } from "node:path";
 
 // src/codex/app-server.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -22280,15 +22413,15 @@ var CodexAppServerClient = class {
     const child = this.process;
     this.process = void 0;
     if (child === void 0 || child.exitCode !== null || child.killed) return;
-    await new Promise((resolve2) => {
+    await new Promise((resolve3) => {
       const timer = setTimeout(() => {
         child.kill("SIGKILL");
-        resolve2();
+        resolve3();
       }, 2e3);
       timer.unref?.();
       child.once("exit", () => {
         clearTimeout(timer);
-        resolve2();
+        resolve3();
       });
       child.kill("SIGTERM");
     });
@@ -22344,13 +22477,13 @@ var CodexAppServerClient = class {
   }
   request(method, params, timeoutMs) {
     const id2 = this.nextId++;
-    const result = new Promise((resolve2, reject) => {
+    const result = new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id2);
         reject(new CodexAppServerError("CODEX_REQUEST_TIMEOUT", "Codex App Server request timed out."));
       }, timeoutMs);
       timer.unref?.();
-      this.pending.set(id2, { resolve: resolve2, reject, timer });
+      this.pending.set(id2, { resolve: resolve3, reject, timer });
     });
     try {
       this.write({ id: id2, method, params });
@@ -22825,6 +22958,8 @@ function concatChunks3(chunks, totalBytes) {
 // src/codex/domain.ts
 var APPROVAL_TTL_MS = 5 * 6e4;
 var DEFAULT_RESTART_DELAYS_MS = [1e3, 2e3, 4e3, 8e3, 15e3];
+var CODEX_PAGE_LIMIT2 = 100;
+var MAX_CODEX_PAGES2 = 32;
 var CODEX_HISTORY_PAGE_LIMIT = 25;
 var MAX_CODEX_HISTORY_PAGES = 64;
 var CodexRemoteDomain = class {
@@ -22838,6 +22973,7 @@ var CodexRemoteDomain = class {
   unsubscribeInbound;
   unsubscribeUnavailable;
   peers = /* @__PURE__ */ new Map();
+  peerDeviceIds = /* @__PURE__ */ new Map();
   turnOwners = /* @__PURE__ */ new Map();
   approvals = /* @__PURE__ */ new Map();
   approvalExpiryTimer;
@@ -22877,6 +23013,7 @@ var CodexRemoteDomain = class {
     if (!this.config.enabled) return void 0;
     const bridge = new CodexPeerBridge(this, context, publish, this.logger);
     this.peers.set(context.connectionId, bridge);
+    this.peerDeviceIds.set(context.connectionId, context.peerDeviceId);
     return bridge;
   }
   async call(connectionId, input2) {
@@ -22890,19 +23027,19 @@ var CodexRemoteDomain = class {
       return sanitizeProjectList(await this.callUpstream(call.method, call.params));
     }
     if (call.method === "thread/list") {
-      return filterThreadListByProjectAuthority(
-        sanitizeThreadList(await this.callUpstream(call.method, call.params)),
-        await this.readProjectAuthority()
+      const result = sanitizeThreadList(await this.callUpstream(call.method, call.params));
+      return filterThreadListByWorkspaceAuthority(
+        result,
+        await this.readWorkspaceAuthority(result.data)
       );
     }
     if (call.method === "thread/start") {
       const cwd = await this.requireCodexWorkspacePath(call.params.cwd);
-      const permission = codexPermission(call.params);
+      const permission = codexPermission(call.params, "workspace-write");
       const result = await this.callUpstream(call.method, {
         ...permission.params,
         cwd,
-        approvalPolicy: permission.approvalPolicy,
-        sandbox: permission.sandbox,
+        ...codexThreadPermissionParams(permission),
         serviceName: "deepseek_harness_remote"
       });
       if (extractThread(result)?.id === void 0) {
@@ -22913,7 +23050,7 @@ var CodexRemoteDomain = class {
     const threadId = threadIdFromParams(call.params);
     if (call.method === "dsh/sessionHistory") {
       const thread = await this.readThreadForHistory(connectionId, threadId);
-      return paginateCodexNativeHistory(
+      const page = paginateCodexNativeHistory(
         projectCodexNativeHistory(thread, `codex:${threadId}`),
         {
           beforeSeq: optionalInteger2(call.params.beforeSeq),
@@ -22921,6 +23058,8 @@ var CodexRemoteDomain = class {
           maxMessages: optionalInteger2(call.params.maxMessages)
         }
       );
+      const activeTurnId2 = typeof page.activeTurnId === "string" ? page.activeTurnId : this.turnOwners.get(threadId)?.turnId;
+      return activeTurnId2 === void 0 ? page : { ...page, activeTurnId: activeTurnId2 };
     }
     const allowedThread = threadId === void 0 ? void 0 : await this.readKnownThread(threadId);
     if (call.method === "thread/read") {
@@ -22933,39 +23072,38 @@ var CodexRemoteDomain = class {
       return this.callUpstream(call.method, call.params);
     }
     let claimed = false;
+    let previousOwner;
     if (isThreadMutation(call.method) && threadId !== void 0) {
-      claimed = this.claimTurn(threadId, connectionId, call.method);
+      const claim = this.claimTurn(
+        threadId,
+        connectionId,
+        call.method,
+        typeof call.params.turnId === "string" ? call.params.turnId : void 0
+      );
+      claimed = claim.claimed;
+      previousOwner = claim.previous;
     }
     try {
       const permission = codexPermission(call.params);
       const upstreamParams = call.method === "thread/resume" && allowedThread !== void 0 ? {
         ...permission.params,
         ...allowedThread.cwd === void 0 ? {} : { cwd: allowedThread.cwd },
-        approvalPolicy: permission.approvalPolicy,
-        sandbox: permission.sandbox,
+        ...codexThreadPermissionParams(permission),
         excludeTurns: true
       } : call.method === "thread/fork" && allowedThread !== void 0 ? {
         ...permission.params,
         ...allowedThread.cwd === void 0 ? {} : { cwd: allowedThread.cwd },
-        approvalPolicy: permission.approvalPolicy,
-        sandbox: permission.sandbox
+        ...codexThreadPermissionParams(permission)
       } : call.method === "turn/start" ? {
         ...permission.params,
         ...allowedThread?.cwd === void 0 ? {} : { cwd: allowedThread.cwd },
-        approvalPolicy: permission.approvalPolicy,
-        sandboxPolicy: permission.sandbox === "danger-full-access" ? { type: "dangerFullAccess" } : {
-          type: "workspaceWrite",
-          writableRoots: allowedThread?.cwd === void 0 ? [] : [allowedThread.cwd],
-          networkAccess: false,
-          excludeTmpdirEnvVar: false,
-          excludeSlashTmp: false
-        }
+        ...codexTurnPermissionParams(permission, allowedThread?.cwd)
       } : permission.params;
       let result;
       try {
         result = await this.callUpstream(call.method, upstreamParams);
       } catch (error) {
-        if (call.method === "thread/resume" && allowedThread !== void 0 && error instanceof RpcError && error.code === "CODEX_UPSTREAM_ERROR") {
+        if (call.method === "thread/resume" && allowedThread !== void 0 && error instanceof RpcError && error.code === "CODEX_UPSTREAM_ERROR" && call.params.permissionPreset === void 0) {
           return { thread: allowedThread.thread };
         }
         throw error;
@@ -22973,9 +23111,15 @@ var CodexRemoteDomain = class {
       if (call.method === "thread/resume" || call.method === "thread/fork" || call.method === "thread/unarchive") {
         await this.assertResultThreadAllowed(result);
       }
+      if (call.method === "turn/start" && threadId !== void 0) {
+        this.rememberTurnId(threadId, connectionId, extractTurnId(result));
+      }
       return result;
     } catch (error) {
-      if (claimed && threadId !== void 0) this.turnOwners.delete(threadId);
+      if (claimed && threadId !== void 0) {
+        if (previousOwner === void 0) this.turnOwners.delete(threadId);
+        else this.turnOwners.set(threadId, previousOwner);
+      }
       throw mapAppServerError(error);
     }
   }
@@ -22994,8 +23138,9 @@ var CodexRemoteDomain = class {
   async detachPeer(connectionId) {
     const bridge = this.peers.get(connectionId);
     if (bridge !== void 0) this.peers.delete(connectionId);
+    this.peerDeviceIds.delete(connectionId);
     for (const [threadId, owner] of this.turnOwners) {
-      if (owner === connectionId) this.turnOwners.delete(threadId);
+      if (owner.connectionId === connectionId) this.turnOwners.delete(threadId);
     }
     const appServer = this.appServer;
     const pending = [...this.approvals.entries()].filter(([, approval]) => approval.connectionId === connectionId);
@@ -23014,6 +23159,7 @@ var CodexRemoteDomain = class {
     this.restartTimer = void 0;
     for (const bridge of [...this.peers.values()]) await bridge.closeAll();
     this.peers.clear();
+    this.peerDeviceIds.clear();
     this.turnOwners.clear();
     if (this.approvalExpiryTimer !== void 0) clearTimeout(this.approvalExpiryTimer);
     this.approvalExpiryTimer = void 0;
@@ -23133,6 +23279,13 @@ var CodexRemoteDomain = class {
     }
     const threadId = extractThreadId(message.params);
     if (message.method === "turn/completed" && threadId !== void 0) this.turnOwners.delete(threadId);
+    if (message.method === "turn/started" && threadId !== void 0) {
+      const owner = this.turnOwners.get(threadId);
+      const turnId = extractTurnId(message.params);
+      if (owner !== void 0) {
+        this.turnOwners.set(threadId, { ...owner, ...turnId === void 0 ? {} : { turnId } });
+      }
+    }
     if (message.method === "serverRequest/resolved") this.resolveUpstreamApproval(message.params);
     if (threadId === void 0) return;
     await Promise.all([...this.peers.values()].map((peer) => peer.publishInbound(threadId, {
@@ -23149,7 +23302,7 @@ var CodexRemoteDomain = class {
     }
     const threadId = extractThreadId(message.params);
     const owner = threadId === void 0 ? void 0 : this.turnOwners.get(threadId);
-    const peer = owner === void 0 ? void 0 : this.peers.get(owner);
+    const peer = owner === void 0 ? void 0 : this.peers.get(owner.connectionId);
     if (threadId === void 0 || owner === void 0 || peer === void 0 || !peer.hasThreadSubscription(threadId)) {
       await appServer.respond(message.id, { decision: "decline" });
       return;
@@ -23157,7 +23310,7 @@ var CodexRemoteDomain = class {
     const requestHandle = randomUUID();
     this.approvals.set(requestHandle, {
       upstreamId: message.id,
-      connectionId: owner,
+      connectionId: owner.connectionId,
       threadId,
       method: message.method,
       expiresAt: Date.now() + APPROVAL_TTL_MS
@@ -23176,7 +23329,7 @@ var CodexRemoteDomain = class {
     }
   }
   async readKnownThread(threadId) {
-    const authority = await this.readProjectAuthority();
+    const authority = await this.readWorkspaceAuthority();
     let result;
     try {
       result = await this.callUpstream("thread/read", { threadId, includeTurns: false });
@@ -23189,7 +23342,7 @@ var CodexRemoteDomain = class {
       return { thread: listed, ...typeof listed.cwd === "string" && listed.cwd.length > 0 ? { cwd: listed.cwd } : {} };
     }
     const thread = extractThread(result);
-    if (thread === void 0 || thread.id !== threadId || !isThreadAllowedByProjectAuthority(thread, authority)) {
+    if (thread === void 0 || thread.id !== threadId || !isThreadAllowedByWorkspaceAuthority(thread, authority)) {
       throw new RpcError("CODEX_THREAD_NOT_ALLOWED", "The Codex thread is not available through this Remote Host.");
     }
     return { thread, ...typeof thread.cwd === "string" && thread.cwd.length > 0 ? { cwd: thread.cwd } : {} };
@@ -23282,26 +23435,41 @@ var CodexRemoteDomain = class {
     if (thread === void 0 || typeof thread.id !== "string") {
       throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread.");
     }
-    if (!isThreadAllowedByProjectAuthority(thread, await this.readProjectAuthority())) {
+    if (!isThreadAllowedByWorkspaceAuthority(thread, await this.readWorkspaceAuthority())) {
       throw new RpcError("CODEX_THREAD_NOT_ALLOWED", "The Codex thread is not available through this Remote Host.");
     }
   }
-  claimTurn(threadId, connectionId, method) {
+  claimTurn(threadId, connectionId, method, turnId) {
     const owner = this.turnOwners.get(threadId);
+    const peerDeviceId = this.peerDeviceIds.get(connectionId) ?? connectionId;
+    const nextOwner = { connectionId, peerDeviceId, ...turnId === void 0 ? {} : { turnId } };
     if (method === "turn/interrupt") {
       if (owner === void 0) {
-        this.turnOwners.set(threadId, connectionId);
-        return true;
+        this.turnOwners.set(threadId, nextOwner);
+        return { claimed: true };
       }
-      if (owner !== connectionId) throw new RpcError("CODEX_TURN_OWNED", "Only the connection that started this Codex turn can interrupt it.");
-      return false;
+      if (owner.connectionId !== connectionId && owner.peerDeviceId !== peerDeviceId) {
+        throw new RpcError("CODEX_TURN_OWNED", "Only the connection that started this Codex turn can interrupt it.");
+      }
+      if (owner.connectionId !== connectionId) {
+        this.turnOwners.set(threadId, { ...owner, connectionId, peerDeviceId, ...turnId === void 0 ? {} : { turnId } });
+        return { claimed: true, previous: owner };
+      }
+      if (turnId !== void 0 && owner.turnId === void 0) this.turnOwners.set(threadId, { ...owner, turnId });
+      return { claimed: false };
     }
-    if (owner !== void 0 && owner !== connectionId) {
+    if (owner !== void 0 && owner.connectionId !== connectionId && owner.peerDeviceId !== peerDeviceId) {
       throw new RpcError("CODEX_TURN_OWNED", "Another Remote connection owns the active Codex turn.");
     }
-    if (owner === connectionId) return false;
-    this.turnOwners.set(threadId, connectionId);
-    return true;
+    if (owner?.connectionId === connectionId) return { claimed: false };
+    this.turnOwners.set(threadId, owner === void 0 ? nextOwner : { ...owner, connectionId, peerDeviceId });
+    return { claimed: true, previous: owner };
+  }
+  rememberTurnId(threadId, connectionId, turnId) {
+    if (turnId === void 0) return;
+    const owner = this.turnOwners.get(threadId);
+    if (owner === void 0 || owner.connectionId !== connectionId) return;
+    this.turnOwners.set(threadId, { ...owner, turnId });
   }
   hasSubscriber(threadId) {
     return [...this.peers.values()].some((peer) => peer.hasThreadSubscription(threadId));
@@ -23348,29 +23516,53 @@ var CodexRemoteDomain = class {
       throw mapAppServerError(error);
     }
   }
-  async readProjectAuthority() {
+  async readWorkspaceAuthority(listedThreads) {
     const projectIds = /* @__PURE__ */ new Set();
     const roots = [];
     let cursor2;
-    for (let page = 0; page < 32; page += 1) {
-      const result = sanitizeProjectList(await this.callUpstream("project/list", {
-        limit: 100,
-        ...cursor2 === void 0 ? {} : { cursor: cursor2 }
-      }));
-      for (const project of result.data) {
-        const projectRoots = project.roots.map((root) => root.path).filter((path) => isAbsolute3(path));
-        if (projectRoots.length === 0) continue;
-        projectIds.add(project.id);
-        roots.push(...projectRoots);
+    try {
+      for (let page = 0; page < MAX_CODEX_PAGES2; page += 1) {
+        const result = sanitizeProjectList(await this.callUpstream("project/list", {
+          limit: CODEX_PAGE_LIMIT2,
+          ...cursor2 === void 0 ? {} : { cursor: cursor2 }
+        }));
+        for (const project of result.data) {
+          const projectRoots = project.roots.map((root) => root.path).filter((path) => isAbsolute3(path));
+          if (projectRoots.length === 0) continue;
+          projectIds.add(project.id);
+          roots.push(...projectRoots);
+        }
+        cursor2 = typeof result.nextCursor === "string" && result.nextCursor.length > 0 ? result.nextCursor : void 0;
+        if (cursor2 === void 0) break;
       }
-      cursor2 = typeof result.nextCursor === "string" && result.nextCursor.length > 0 ? result.nextCursor : void 0;
-      if (cursor2 === void 0) break;
+    } catch (error) {
+      if (!isProjectListFallbackError(error)) throw error;
+    }
+    if (roots.length > 0) return { projectIds, roots };
+    const threads = listedThreads === void 0 ? [] : [...listedThreads];
+    if (listedThreads === void 0) {
+      cursor2 = void 0;
+      for (let page = 0; page < MAX_CODEX_PAGES2; page += 1) {
+        const result = sanitizeThreadList(await this.callUpstream("thread/list", {
+          limit: CODEX_PAGE_LIMIT2,
+          sortKey: "updated_at",
+          sortDirection: "desc",
+          archived: false,
+          ...cursor2 === void 0 ? {} : { cursor: cursor2 }
+        }));
+        threads.push(...result.data);
+        cursor2 = typeof result.nextCursor === "string" && result.nextCursor.length > 0 ? result.nextCursor : void 0;
+        if (cursor2 === void 0) break;
+      }
+    }
+    for (const workspace of deriveCodexCwdWorkspaces(threads)) {
+      if (isAbsolute3(workspace.path)) roots.push(workspace.path);
     }
     return { projectIds, roots };
   }
   async findKnownThreadInList(threadId, authority) {
     let cursor2;
-    for (let page = 0; page < 32; page += 1) {
+    for (let page = 0; page < MAX_CODEX_PAGES2; page += 1) {
       const result = sanitizeThreadList(await this.callUpstream("thread/list", {
         limit: 100,
         sortKey: "updated_at",
@@ -23380,7 +23572,7 @@ var CodexRemoteDomain = class {
       }));
       const thread = result.data.find((item) => item.id === threadId);
       if (thread !== void 0) {
-        return isThreadAllowedByProjectAuthority(thread, authority) ? thread : void 0;
+        return isThreadAllowedByWorkspaceAuthority(thread, authority) ? thread : void 0;
       }
       cursor2 = typeof result.nextCursor === "string" && result.nextCursor.length > 0 ? result.nextCursor : void 0;
       if (cursor2 === void 0) break;
@@ -23391,16 +23583,28 @@ var CodexRemoteDomain = class {
     if (!isAbsolute3(path)) {
       throw new RpcError("CODEX_PATH_NOT_ALLOWED", "The CodeX working directory is not available as a Workspace.");
     }
-    const paths = await this.listCodexProjectWorkspacePaths();
-    const canonical = paths.get(normalizeCodexPathForCompare(path));
-    if (canonical === void 0) {
+    const paths = await this.listCodexWorkspacePaths();
+    const lexicalCandidate = resolve2(path);
+    let candidate;
+    try {
+      candidate = await realpath(path);
+      if (!(await stat4(candidate)).isDirectory()) throw new Error("not a directory");
+    } catch {
       throw new RpcError("CODEX_PATH_NOT_ALLOWED", "The CodeX working directory is not available as a Workspace.");
     }
-    return canonical;
+    for (const root of paths.values()) {
+      try {
+        if (!containsCodexPath(resolve2(root), lexicalCandidate)) continue;
+        const canonicalRoot = await realpath(root);
+        if (containsCodexPath(canonicalRoot, candidate)) return lexicalCandidate;
+      } catch {
+      }
+    }
+    throw new RpcError("CODEX_PATH_NOT_ALLOWED", "The CodeX working directory is not available as a Workspace.");
   }
-  async listCodexProjectWorkspacePaths() {
+  async listCodexWorkspacePaths() {
     const paths = /* @__PURE__ */ new Map();
-    const authority = await this.readProjectAuthority();
+    const authority = await this.readWorkspaceAuthority();
     for (const root of authority.roots) paths.set(normalizeCodexPathForCompare(root), root);
     return paths;
   }
@@ -23469,13 +23673,13 @@ function sanitizeThreadList(result) {
     ...typeof result.backwardsCursor === "string" && result.backwardsCursor.length > 0 ? { backwardsCursor: result.backwardsCursor } : {}
   };
 }
-function filterThreadListByProjectAuthority(result, authority) {
+function filterThreadListByWorkspaceAuthority(result, authority) {
   if (!isRecord9(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread list.");
   }
   return {
     ...result,
-    data: result.data.map((record4) => isRecord9(record4) ? record4 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByProjectAuthority(thread, authority))
+    data: result.data.map((record4) => isRecord9(record4) ? record4 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByWorkspaceAuthority(thread, authority))
   };
 }
 function sanitizeProjectList(result) {
@@ -23503,7 +23707,7 @@ function sanitizeProjectList(result) {
     ...typeof result.nextCursor === "string" && result.nextCursor.length > 0 ? { nextCursor: result.nextCursor } : { nextCursor: null }
   };
 }
-function isThreadAllowedByProjectAuthority(thread, authority) {
+function isThreadAllowedByWorkspaceAuthority(thread, authority) {
   const projectId = typeof thread.projectId === "string" ? thread.projectId : void 0;
   if (projectId !== void 0 && authority.projectIds.has(projectId)) return true;
   const cwd = typeof thread.cwd === "string" ? thread.cwd : void 0;
@@ -23520,6 +23724,12 @@ function normalizeCodexPathForCompare(path) {
 function extractThread(result) {
   return isRecord9(result) && isRecord9(result.thread) ? result.thread : void 0;
 }
+function extractTurnId(result) {
+  if (!isRecord9(result)) return void 0;
+  if (typeof result.turnId === "string" && result.turnId.length > 0) return result.turnId;
+  if (isRecord9(result.turn) && typeof result.turn.id === "string" && result.turn.id.length > 0) return result.turn.id;
+  return void 0;
+}
 function extractThreadId(params) {
   if (!isRecord9(params)) return void 0;
   if (typeof params.threadId === "string") return params.threadId;
@@ -23530,15 +23740,37 @@ function extractThreadId(params) {
 function optionalInteger2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : void 0;
 }
-function codexPermission(params) {
+function codexPermission(params, fallbackPreset) {
   const { permissionPreset: permissionPreset2, ...rest } = params;
-  const fullAccess = permissionPreset2 === "danger-full-access";
+  const preset = permissionPreset2 === "workspace-write" || permissionPreset2 === "danger-full-access" ? permissionPreset2 : fallbackPreset;
+  if (preset === void 0) return { params: mapCodexImageInputs(rest) };
+  const fullAccess = preset === "danger-full-access";
   return {
     params: mapCodexImageInputs(rest),
     approvalPolicy: fullAccess ? "never" : "on-request",
     sandbox: fullAccess ? "danger-full-access" : "workspace-write"
   };
 }
+function codexThreadPermissionParams(permission) {
+  if (permission.approvalPolicy === void 0 || permission.sandbox === void 0) return {};
+  return {
+    approvalPolicy: permission.approvalPolicy,
+    sandbox: permission.sandbox
+  };
+}
+function codexTurnPermissionParams(permission, cwd) {
+  if (permission.approvalPolicy === void 0 || permission.sandbox === void 0) return {};
+  return {
+    approvalPolicy: permission.approvalPolicy,
+    sandboxPolicy: permission.sandbox === "danger-full-access" ? { type: "dangerFullAccess" } : {
+      type: "workspaceWrite",
+      writableRoots: cwd === void 0 ? [] : [cwd],
+      networkAccess: false,
+      excludeTmpdirEnvVar: false,
+      excludeSlashTmp: false
+    }
+  };
+}
 function mapCodexImageInputs(params) {
   if (!Array.isArray(params.input)) return params;
   return {
@@ -23575,6 +23807,9 @@ function errorCode3(error) {
 function isHistoryReadRecoverable(error) {
   return error instanceof RpcError && ["METHOD_NOT_ALLOWED", "METHOD_NOT_FOUND", "CODEX_UPSTREAM_ERROR", "CODEX_REQUEST_TIMEOUT", "CODEX_THREAD_BUSY"].includes(error.code);
 }
+function isProjectListFallbackError(error) {
+  return error instanceof RpcError && ["METHOD_NOT_ALLOWED", "METHOD_NOT_FOUND", "CODEX_UPSTREAM_ERROR"].includes(error.code);
+}
 function canTryNextBinary(error) {
   return !(error instanceof RpcError) || !["CODEX_AUTH_REQUIRED", "CODEX_CLOSED"].includes(error.code);
 }
@@ -23693,13 +23928,42 @@ var HostPluginRuntime = class {
     }
     this.serverConnection.reconnect();
   }
+  async startHostOAuthQrLogin(provider) {
+    if (this.serverApi === void 0) {
+      throw new ServerApiError("SERVER_NOT_CONFIGURED", "Remote Host Server is unavailable.", false);
+    }
+    return this.serverApi.startOAuthQrLogin(provider);
+  }
+  async pollHostOAuthQrLogin(qrId) {
+    if (this.serverApi === void 0) {
+      throw new ServerApiError("SERVER_NOT_CONFIGURED", "Remote Host Server is unavailable.", false);
+    }
+    const result = await this.serverApi.pollOAuthQrLogin(this.currentIdentity(), qrId, async () => {
+      await this.serverConnection?.stop();
+      this.identity = await this.identities.reset(this.config.deviceName);
+      this.serverApi.bindIdentity(this.identity);
+      this.serverConnection = this.createServerConnection(this.identity);
+      return this.identity;
+    });
+    if (result.status === "complete") {
+      this.serverConnection?.reconnect();
+      this.logger.info("Host account authorized through OAuth QR login");
+    }
+    return result;
+  }
   async clearHostAuthorization() {
     await this.serverConnection?.stop();
-    await this.serverApi?.revokeCurrentDevice();
+    let revokeFailure;
+    try {
+      await this.serverApi?.revokeCurrentDevice();
+    } catch (error) {
+      revokeFailure = error;
+    }
     this.identity = await this.identities.reset(this.config.deviceName);
     this.serverApi?.bindIdentity(this.identity);
     if (this.serverApi !== void 0) this.serverConnection = this.createServerConnection(this.identity);
     this.logger.info("Host authorization cleared");
+    if (revokeFailure !== void 0) throw revokeFailure;
   }
   async authorizeHostAsOwned(accessToken, account) {
     if (this.serverApi === void 0) {
@@ -23787,6 +24051,7 @@ var HostPluginRuntime = class {
       peerDeviceId: this.connections.peerDeviceId() === void 0 ? void 0 : shortId5(this.connections.peerDeviceId()),
       peerDeviceIds: this.connections.peerDeviceIds().map(shortId5),
       trustedPeers: this.identities.listTrustedPeers().length,
+      capabilities: this.hostCapabilities(),
       codex: this.codex.status()
     };
   }
@@ -23806,12 +24071,12 @@ var HostPluginRuntime = class {
   }
   async readHarnessVersion() {
     let reportedVersion;
-    let errorCode4;
+    let errorCode5;
     try {
       const response = await this.apiProxy?.host.describe({ rpcId: randomUUID2(), payload: {} });
       if (response === void 0) throw new Error("ApiProxy is unavailable");
       if (!response.result.ok) {
-        errorCode4 = response.result.error.code;
+        errorCode5 = response.result.error.code;
       } else {
         reportedVersion = normalizeHarnessVersion(response.result.value.version);
       }
@@ -23820,7 +24085,7 @@ var HostPluginRuntime = class {
     const distributionVersion = reportedVersion === void 0 || reportedVersion === "0.0.1" ? await readHarnessDistributionVersion() : void 0;
     const version = selectHarnessVersion(reportedVersion, distributionVersion);
     if (version !== void 0) return version;
-    this.logger.warn("Harness version is unavailable", errorCode4 === void 0 ? void 0 : { code: errorCode4 });
+    this.logger.warn("Harness version is unavailable", errorCode5 === void 0 ? void 0 : { code: errorCode5 });
     return void 0;
   }
   hostCapabilities() {
@@ -23857,6 +24122,618 @@ function isPlainRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/cli.ts
+import { stat as stat5 } from "node:fs/promises";
+import { hostname as hostname3 } from "node:os";
+import { join as join6 } from "node:path";
+var QR_POLL_INTERVAL_MS = 2e3;
+var TERMINAL_QR_MARGIN = 4;
+async function runCli(args = process.argv.slice(2), dependencies = {}) {
+  const runtime = resolveDependencies(dependencies);
+  const [command, ...rest] = args;
+  try {
+    if (command === "login") return await login(rest, runtime);
+    if (command === "status") return await status(rest, runtime);
+    if (command === "logout") return await logout(rest, runtime);
+    if (command === "help" || command === "--help" || command === "-h" || command === void 0) {
+      write(runtime.stdout, helpText());
+      return 0;
+    }
+    throw new CliUsageError(`Unknown command: ${command}`);
+  } catch (error) {
+    write(runtime.stderr, `${cliErrorMessage(error)}
+`);
+    if (error instanceof CliUsageError) write(runtime.stderr, `
+${helpText()}`);
+    return error instanceof CliUsageError ? 2 : 1;
+  }
+}
+async function login(args, runtime) {
+  if (args.length > 1) throw new CliUsageError("Usage: ds-harness-remote login [github|zhihu]");
+  const provider = args[0] ?? "zhihu";
+  if (provider !== "github" && provider !== "zhihu") {
+    throw new CliUsageError("Login provider must be github or zhihu.");
+  }
+  const context = await hostContext(runtime);
+  const session = await context.api.startOAuthQrLogin(provider);
+  const qr = await runtime.renderQr(session.scanUrl);
+  const providerName = provider === "github" ? "GitHub" : "Zhihu";
+  write(runtime.stdout, `Using ${providerName} QR login. ${alternativeProviderHint(provider)}
+`);
+  write(runtime.stdout, "Scan this QR code to authorize this Host:\n\n");
+  write(runtime.stdout, `${qr.trimEnd()}
+`);
+  write(runtime.stdout, `Authorization URL: ${terminalLink(session.scanUrl, runtime.stdout)}
+
+Waiting for authorization...
+`);
+  const deadline = runtime.now() + session.expiresIn * 1e3;
+  let identity = context.identity;
+  while (runtime.now() < deadline) {
+    let result;
+    try {
+      result = await context.api.pollOAuthQrLogin(identity, session.qrId, async () => {
+        identity = await context.identities.reset(context.deviceName);
+        return identity;
+      });
+    } catch (error) {
+      if (!(error instanceof ServerApiError) || !error.retryable) throw error;
+      await runtime.wait(Math.min(QR_POLL_INTERVAL_MS, Math.max(1, deadline - runtime.now())));
+      continue;
+    }
+    if (result.status === "complete") {
+      write(runtime.stdout, `${authorizedMessage(result.authorization)} Restart dsh-tui to bring the Remote Host online.
+`);
+      return 0;
+    }
+    if (result.status === "expired") break;
+    await runtime.wait(Math.min(QR_POLL_INTERVAL_MS, Math.max(1, deadline - runtime.now())));
+  }
+  write(runtime.stderr, "The QR login expired. Run the login command again to generate a new code.\n");
+  return 1;
+}
+async function status(args, runtime) {
+  if (args.length !== 0) throw new CliUsageError("Usage: ds-harness-remote status");
+  const serverUrl = selectedServer();
+  const root = new IdentityStore({ env: runtime.env }).directory;
+  const directory = serverStorageDirectory(root, serverUrl, "host");
+  const lines = [
+    "Remote Host status",
+    `Server: ${serverUrl}`,
+    "Host control: enabled (dsh-TUI default)"
+  ];
+  if (!await exists3(join6(directory, "device.json"))) {
+    lines.push("Device: not initialized", "Authorization: logged out", "Credential: unavailable");
+    write(runtime.stdout, `${lines.join("\n")}
+
+Run "ds-harness-remote login" or use "/remote login" in dsh-TUI.
+`);
+    return 0;
+  }
+  const identities = runtime.createIdentityStore({ directory, env: runtime.env });
+  const identity = await identities.loadOrCreate(hostname3());
+  const store = new ServerCredentialStore(directory);
+  const stored = await store.load(serverUrl, identity.deviceId);
+  lines.push(`Device: ${identity.name} (${identity.deviceId})`);
+  if (stored === void 0) {
+    lines.push("Authorization: logged out", "Credential: unavailable");
+    write(runtime.stdout, `${lines.join("\n")}
+
+Run "ds-harness-remote login" or use "/remote login" in dsh-TUI.
+`);
+    return 0;
+  }
+  lines.push(`Authorization: logged in (${authorizationLabel(stored.authorizationMethod)})`);
+  if (stored.account !== void 0) lines.push(`Account: ${stored.account}`);
+  const api = runtime.createHostApi(serverUrl, store);
+  api.bindIdentity(identity);
+  try {
+    await api.authenticate(identity);
+    lines.push("Credential: ready");
+    lines.push("Presence: published while dsh-tui is running");
+    write(runtime.stdout, `${lines.join("\n")}
+`);
+    return 0;
+  } catch (error) {
+    lines.push(`Credential: unavailable (${statusErrorCode(error)})`);
+    write(runtime.stdout, `${lines.join("\n")}
+`);
+    return 1;
+  }
+}
+async function logout(args, runtime) {
+  if (args.length !== 0) throw new CliUsageError("Usage: ds-harness-remote logout");
+  const serverUrl = selectedServer();
+  const root = new IdentityStore({ env: runtime.env }).directory;
+  const directory = serverStorageDirectory(root, serverUrl, "host");
+  if (!await exists3(join6(directory, "device.json"))) {
+    await new ServerCredentialStore(directory).clear();
+    write(runtime.stdout, "This Host is already logged out.\n");
+    return 0;
+  }
+  const deviceName = hostname3();
+  const identities = runtime.createIdentityStore({ directory, env: runtime.env });
+  const identity = await identities.loadOrCreate(deviceName);
+  const api = runtime.createHostApi(serverUrl, new ServerCredentialStore(directory));
+  api.bindIdentity(identity);
+  let revokeFailure;
+  try {
+    await api.revokeCurrentDevice();
+  } catch (error) {
+    revokeFailure = error;
+  }
+  await identities.reset(deviceName);
+  if (revokeFailure !== void 0) {
+    throw new Error(`Local Host credentials were cleared, but Server revocation failed: ${cliErrorMessage(revokeFailure)}`);
+  }
+  write(runtime.stdout, "Remote Host logged out and its local device identity was rotated. Restart dsh-tui.\n");
+  return 0;
+}
+async function hostContext(runtime) {
+  const serverUrl = selectedServer();
+  const root = new IdentityStore({ env: runtime.env }).directory;
+  const directory = serverStorageDirectory(root, serverUrl, "host");
+  const deviceName = hostname3();
+  const identities = runtime.createIdentityStore({ directory, env: runtime.env });
+  const identity = await identities.loadOrCreate(deviceName);
+  const api = runtime.createHostApi(serverUrl, new ServerCredentialStore(directory));
+  return { api, identities, identity, deviceName };
+}
+function selectedServer() {
+  return normalizeServerUrl(DEFAULT_REMOTE_SERVER_URL);
+}
+function resolveDependencies(input2) {
+  return {
+    env: input2.env ?? process.env,
+    stdout: input2.stdout ?? process.stdout,
+    stderr: input2.stderr ?? process.stderr,
+    now: input2.now ?? Date.now,
+    wait: input2.wait ?? ((milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds))),
+    renderQr: input2.renderQr ?? renderTerminalQr,
+    createIdentityStore: input2.createIdentityStore ?? ((options) => new IdentityStore(options)),
+    createHostApi: input2.createHostApi ?? ((serverUrl, store) => new HostServerApi(serverUrl, store))
+  };
+}
+async function renderTerminalQr(url) {
+  const { default: QRCode } = await import("qrcode");
+  const modules = QRCode.create(url, { errorCorrectionLevel: "M" }).modules;
+  const width = modules.size + TERMINAL_QR_MARGIN * 2;
+  const quietLine = `\x1B[47m${" ".repeat(width * 2)}\x1B[0m`;
+  const lines = Array.from({ length: TERMINAL_QR_MARGIN }, () => quietLine);
+  for (let row = 0; row < modules.size; row += 1) {
+    let line = `\x1B[47m${" ".repeat(TERMINAL_QR_MARGIN * 2)}`;
+    for (let column = 0; column < modules.size; column += 1) {
+      line += modules.get(row, column) === 1 ? "\x1B[40m  " : "\x1B[47m  ";
+    }
+    line += `\x1B[47m${" ".repeat(TERMINAL_QR_MARGIN * 2)}\x1B[0m`;
+    lines.push(line);
+  }
+  lines.push(...Array.from({ length: TERMINAL_QR_MARGIN }, () => quietLine));
+  return lines.join("\n");
+}
+async function renderCompactTerminalQr(url) {
+  const { default: QRCode } = await import("qrcode");
+  const modules = QRCode.create(url, { errorCorrectionLevel: "M" }).modules;
+  const size = modules.size + TERMINAL_QR_MARGIN * 2;
+  const lines = [];
+  const isBlack = (row, column) => {
+    const qrRow = row - TERMINAL_QR_MARGIN;
+    const qrColumn = column - TERMINAL_QR_MARGIN;
+    return qrRow >= 0 && qrRow < modules.size && qrColumn >= 0 && qrColumn < modules.size && modules.get(qrRow, qrColumn) === 1;
+  };
+  for (let row = 0; row < size; row += 2) {
+    let line = "\x1B[30;47m";
+    for (let column = 0; column < size; column += 1) {
+      const top = isBlack(row, column);
+      const bottom = isBlack(row + 1, column);
+      line += top ? bottom ? "\u2588" : "\u2580" : bottom ? "\u2584" : " ";
+    }
+    lines.push(`${line}\x1B[0m`);
+  }
+  return lines.join("\n");
+}
+function authorizedMessage(authorization) {
+  return authorization.account === void 0 ? "Remote Host login complete." : `Remote Host login complete for ${authorization.account}.`;
+}
+function alternativeProviderHint(provider) {
+  return provider === "zhihu" ? "GitHub is also supported: ds-harness-remote login github" : "Zhihu is also supported: ds-harness-remote login zhihu";
+}
+function authorizationLabel(method) {
+  if (method === "host_registration_code") return "Host registration code";
+  if (method === "owned_device") return "owned device";
+  return "account";
+}
+function statusErrorCode(error) {
+  return error instanceof ServerApiError ? error.code : "CONNECTION_FAILED";
+}
+function cliErrorMessage(error) {
+  const message = error instanceof Error ? error.message : "The Remote command failed.";
+  const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : void 0;
+  return code === void 0 ? message : `${message} (${code})`;
+}
+function helpText() {
+  return [
+    "Usage:",
+    "  ds-harness-remote login [github|zhihu]",
+    "  ds-harness-remote status",
+    "  ds-harness-remote logout",
+    "",
+    "Inside dsh-TUI, use /remote login, /remote status, or /remote logout.",
+    "login defaults to Zhihu and authorizes this computer as a Remote Host with a terminal QR code.",
+    `The Server is ${DEFAULT_REMOTE_SERVER_URL}.`,
+    "Host configuration is not exposed by this CLI yet. Restart dsh-tui after login or logout.",
+    ""
+  ].join("\n");
+}
+function write(target, value) {
+  target.write(value);
+}
+function terminalLink(url, target) {
+  if (target.isTTY !== true) return url;
+  return `\x1B]8;;${url}\x07${url}\x1B]8;;\x07`;
+}
+async function exists3(path) {
+  try {
+    await stat5(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+var CliUsageError = class extends Error {
+};
+
+// src/tui-command.ts
+var QR_POLL_INTERVAL_MS2 = 2e3;
+var REMOTE_LOGIN_SCENE_ID = "remote-login";
+var REMOTE_STATUS_SCENE_ID = "remote-status";
+function installTuiRemoteCommand(ctx, resolveTarget) {
+  const tuiContext = ctx;
+  const commands = tuiContext.get("commands", false);
+  if (commands === void 0) return;
+  const pluginHost = tuiContext.get("tuiPluginHost", false);
+  const trees = tuiContext.get("tuiCommandTrees", false);
+  const scenes = tuiContext.get("tuiScenes", false);
+  const login2 = new RemoteLoginController(resolveTarget);
+  const LoginScene = createRemoteLoginScene(login2);
+  const StatusScene = createRemoteStatusScene(resolveTarget);
+  tuiContext.effect(() => {
+    const definition = {
+      name: "remote",
+      description: "Manage Remote Host login and connection status",
+      input: { hint: "[status | login [github|zhihu] | logout]" },
+      recordInput: false,
+      handler: async ({ rawInput }) => {
+        const args = rawInput.trim().split(/\s+/u).filter(Boolean);
+        const command = args[0] ?? "status";
+        if (command === "status" && args.length <= 1) {
+          if (scenes?.open(REMOTE_STATUS_SCENE_ID) === true) return { kind: "success" };
+          return { kind: "success", text: formatRemoteStatusInline(resolveTarget()) };
+        }
+        if (command === "login" && args.length <= 2) {
+          const provider = args[1] ?? "zhihu";
+          if (provider !== "github" && provider !== "zhihu") {
+            return { kind: "error", text: "Usage: /remote login [github|zhihu]" };
+          }
+          if (scenes === void 0) {
+            return {
+              kind: "error",
+              text: `The Remote login screen is unavailable. Run "ds-harness-remote login ${provider}" outside dsh-TUI, then restart it.`
+            };
+          }
+          login2.start(provider);
+          if (!scenes.open(REMOTE_LOGIN_SCENE_ID)) {
+            login2.cancel();
+            return { kind: "error", text: "The Remote login screen is unavailable." };
+          }
+          return { kind: "success" };
+        }
+        if (command === "logout" && args.length === 1) {
+          const target = resolveTarget();
+          if (target === void 0) return remoteNotReady();
+          try {
+            await target.runtime.clearHostAuthorization();
+            return {
+              kind: "success",
+              text: "Remote Host logged out and its local device identity was rotated."
+            };
+          } catch (error) {
+            return {
+              kind: "error",
+              text: `Local Remote Host credentials were cleared, but Server revocation failed (${errorCode4(error)}).`
+            };
+          }
+        }
+        if (command === "config") {
+          return { kind: "error", text: "Host configuration is not supported yet." };
+        }
+        return { kind: "error", text: remoteCommandUsage() };
+      }
+    };
+    const disposeCommand = registerRemoteCommand(tuiContext, commands, pluginHost, definition);
+    const disposeTree = registerOptional(tuiContext, "command completion", () => trees?.register({
+      root: "remote",
+      descriptions: {
+        en: "Manage Remote Host login and connection status",
+        zh: "\u7BA1\u7406 Remote Host \u767B\u5F55\u548C\u8FDE\u63A5\u72B6\u6001"
+      },
+      children: remoteCommandChildren
+    }));
+    const disposeScene = registerOptional(tuiContext, "login scene", () => scenes?.register({
+      id: REMOTE_LOGIN_SCENE_ID,
+      title: "Remote Host login",
+      component: LoginScene
+    }, tuiContext));
+    const disposeStatusScene = registerOptional(tuiContext, "status scene", () => scenes?.register({
+      id: REMOTE_STATUS_SCENE_ID,
+      title: "Remote Host status",
+      component: StatusScene
+    }, tuiContext));
+    return () => {
+      login2.cancel();
+      disposeCommand();
+      disposeTree();
+      disposeScene();
+      disposeStatusScene();
+    };
+  }, "ds-harness-remote: dsh-tui /remote command");
+}
+function registerRemoteCommand(ctx, commands, pluginHost, definition) {
+  if (pluginHost === void 0) return commands.register(definition);
+  try {
+    return pluginHost.registerCommand(ctx, definition);
+  } catch (error) {
+    if (!hasErrorCode2(error, "COMPONENT_NOT_ADMITTED")) throw error;
+    ctx.logger.debug("dsh-TUI Remote command is using the legacy command registry because Component admission is unavailable");
+    return commands.register(definition);
+  }
+}
+function hasErrorCode2(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function registerOptional(ctx, feature, register) {
+  try {
+    return register() ?? (() => {
+    });
+  } catch (error) {
+    ctx.logger.warn(`dsh-TUI Remote ${feature} is unavailable`, { code: errorCode4(error) });
+    return () => {
+    };
+  }
+}
+function remoteCommandChildren(canonicalPath) {
+  if (canonicalPath.length === 1 && canonicalPath[0] === "remote") {
+    return [
+      {
+        name: "status",
+        description: "Show Remote Host authorization and connection status",
+        descriptions: { zh: "\u67E5\u770B Remote Host \u6388\u6743\u548C\u8FDE\u63A5\u72B6\u6001" }
+      },
+      {
+        name: "login",
+        description: "Authorize this Host with a GitHub or Zhihu QR code",
+        descriptions: { zh: "\u4F7F\u7528 GitHub \u6216\u77E5\u4E4E\u4E8C\u7EF4\u7801\u6388\u6743\u5F53\u524D Host" }
+      },
+      {
+        name: "logout",
+        description: "Revoke this Host and rotate its local identity",
+        descriptions: { zh: "\u64A4\u9500\u5F53\u524D Host \u5E76\u8F6E\u6362\u672C\u5730\u8EAB\u4EFD" }
+      }
+    ];
+  }
+  if (canonicalPath.length === 2 && canonicalPath[0] === "remote" && canonicalPath[1] === "login") {
+    return [
+      { name: "zhihu", description: "Sign in with Zhihu (default)", descriptions: { zh: "\u4F7F\u7528\u77E5\u4E4E\u767B\u5F55\uFF08\u9ED8\u8BA4\uFF09" } },
+      { name: "github", description: "Sign in with GitHub", descriptions: { zh: "\u4F7F\u7528 GitHub \u767B\u5F55" } }
+    ];
+  }
+  return [];
+}
+function remoteStatusLines(target) {
+  if (target === void 0) {
+    return ["Remote Host is disabled or still starting. Check the ds-harness-remote settings and retry."];
+  }
+  const { runtime, config } = target;
+  const status2 = runtime.hostStatus();
+  const diagnostics = runtime.diagnostics();
+  const codex = runtime.codexStatus();
+  const capabilities = new Set(diagnostics.capabilities);
+  const connection = status2.online ? "online" : status2.reconnecting ? "reconnecting" : status2.accountRequired ? "authorization required" : "offline";
+  return [
+    `Server: ${config.serverUrl ?? "not configured"}`,
+    "Host control: enabled",
+    `Device: ${status2.deviceId ?? "not initialized"}`,
+    `Authorization: ${status2.authorized ? status2.account === void 0 ? "logged in" : `logged in (${status2.account})` : "logged out"}`,
+    `Server connection: ${connection}`,
+    `Harness Remote API: ${capabilities.has("harness.api.v1") ? "available (ApiProxy)" : capabilities.has("harness.remote.v1") ? "available (Typert Remote)" : "unavailable"}`,
+    `Remote clients: ${diagnostics.activeConnections}`,
+    `Codex Remote: ${codex.enabled ? codex.state : "disabled"}`,
+    "",
+    "Commands: /remote login [github|zhihu] \xB7 /remote status \xB7 /remote logout"
+  ];
+}
+function formatRemoteStatusInline(target) {
+  return remoteStatusLines(target).filter(Boolean).join(" \xB7 ");
+}
+function remoteCommandUsage() {
+  return [
+    "Usage:",
+    "  /remote",
+    "  /remote status",
+    "  /remote login [github|zhihu]",
+    "  /remote logout"
+  ].join("\n");
+}
+function remoteNotReady() {
+  return {
+    kind: "error",
+    text: "Remote Host is disabled or still starting. Check the ds-harness-remote settings and retry."
+  };
+}
+var RemoteLoginController = class {
+  constructor(resolveTarget) {
+    this.resolveTarget = resolveTarget;
+  }
+  current = { phase: "idle", provider: "zhihu" };
+  listeners = /* @__PURE__ */ new Set();
+  attempt = 0;
+  snapshot = () => this.current;
+  subscribe = (listener) => {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  };
+  start(provider) {
+    const attempt = ++this.attempt;
+    this.update({ phase: "loading", provider });
+    void this.run(attempt, provider);
+  }
+  cancel() {
+    this.attempt += 1;
+  }
+  async run(attempt, provider) {
+    try {
+      const target = this.resolveTarget();
+      if (target === void 0) throw new Error("REMOTE_NOT_READY");
+      const session = await target.runtime.startHostOAuthQrLogin(provider);
+      const [qr, compactQr] = await Promise.all([
+        renderTerminalQr(session.scanUrl),
+        renderCompactTerminalQr(session.scanUrl)
+      ]);
+      if (attempt !== this.attempt) return;
+      this.update({ phase: "waiting", provider, qr, compactQr, scanUrl: session.scanUrl });
+      await this.poll(attempt, provider, session, target.runtime);
+    } catch (error) {
+      if (attempt !== this.attempt) return;
+      this.update({ phase: "error", provider, error: errorCode4(error) });
+    }
+  }
+  async poll(attempt, provider, session, runtime) {
+    const deadline = Date.now() + session.expiresIn * 1e3;
+    while (attempt === this.attempt && Date.now() < deadline) {
+      try {
+        const result = await runtime.pollHostOAuthQrLogin(session.qrId);
+        if (attempt !== this.attempt) return;
+        if (result.status === "complete") {
+          this.update({ phase: "complete", provider, account: result.authorization.account });
+          return;
+        }
+        if (result.status === "expired") break;
+      } catch (error) {
+        if (!(error instanceof ServerApiError) || !error.retryable) throw error;
+      }
+      await wait(Math.min(QR_POLL_INTERVAL_MS2, Math.max(1, deadline - Date.now())));
+    }
+    if (attempt === this.attempt) this.update({ phase: "expired", provider });
+  }
+  update(snapshot) {
+    this.current = snapshot;
+    for (const listener of this.listeners) listener(snapshot);
+  }
+};
+function createRemoteLoginScene(controller) {
+  return function RemoteLoginScene({ React, ui, close }) {
+    const [snapshot, setSnapshot] = React.useState(controller.snapshot());
+    const terminal = ui.useTerminalSize();
+    React.useEffect(() => {
+      const unsubscribe = controller.subscribe(setSnapshot);
+      return () => {
+        unsubscribe();
+        controller.cancel();
+      };
+    }, []);
+    ui.useInput((input2, key) => {
+      if (key.escape === true || input2.toLowerCase() === "q") {
+        controller.cancel();
+        close();
+      }
+    });
+    const provider = snapshot.provider === "github" ? "GitHub" : "Zhihu";
+    const other = snapshot.provider === "github" ? "/remote login zhihu" : "/remote login github";
+    const children = [
+      React.createElement(ui.Text, { key: "title", bold: true, color: "accent" }, "Remote Host login"),
+      React.createElement(ui.Text, { key: "provider" }, `Provider: ${provider} \xB7 You can also use ${other}`)
+    ];
+    if (snapshot.phase === "loading") {
+      children.push(React.createElement(ui.Text, { key: "loading", color: "subtle" }, "Creating authorization QR code\u2026"));
+    } else if (snapshot.phase === "waiting" && snapshot.qr !== void 0 && snapshot.scanUrl !== void 0) {
+      const fullRows = snapshot.qr.split("\n").length;
+      const fullColumns = printableWidth(snapshot.qr.split("\n")[0] ?? "");
+      const useFullQr = terminal.rows >= fullRows + 7 && terminal.columns >= fullColumns + 4;
+      const qr = useFullQr || snapshot.compactQr === void 0 ? snapshot.qr : snapshot.compactQr;
+      const qrRows = qr.split("\n").length;
+      const qrColumns = printableWidth(qr.split("\n")[0] ?? "");
+      if (terminal.rows < qrRows + 7 || terminal.columns < qrColumns + 4) {
+        children.push(React.createElement(
+          ui.Text,
+          { key: "size-warning", color: "warning" },
+          `Resize the terminal to at least ${qrColumns + 4} \xD7 ${qrRows + 7} if the QR code is clipped.`
+        ));
+      }
+      children.push(
+        React.createElement(ui.Text, { key: "scan" }, "Scan this QR code to authorize this Host:"),
+        React.createElement(ui.Text, { key: "qr", wrap: "truncate" }, qr),
+        React.createElement(ui.Text, { key: "url", color: "link", underline: true }, terminalLink2(snapshot.scanUrl)),
+        React.createElement(ui.Text, { key: "waiting", color: "subtle" }, "Waiting for authorization\u2026")
+      );
+    } else if (snapshot.phase === "complete") {
+      children.push(React.createElement(
+        ui.Text,
+        { key: "complete", color: "success" },
+        snapshot.account === void 0 ? "Remote Host login complete. The Host is reconnecting now." : `Remote Host login complete for ${snapshot.account}. The Host is reconnecting now.`
+      ));
+    } else if (snapshot.phase === "expired") {
+      children.push(React.createElement(ui.Text, { key: "expired", color: "warning" }, "The QR code expired. Close this screen and run /remote login again."));
+    } else if (snapshot.phase === "error") {
+      children.push(React.createElement(ui.Text, { key: "error", color: "error" }, `Remote Host login failed (${snapshot.error ?? "UNKNOWN"}).`));
+    }
+    children.push(React.createElement(ui.Text, { key: "close", color: "subtle" }, "Press Esc or q to return."));
+    return React.createElement(ui.Box, {
+      flexDirection: "column",
+      gap: 1,
+      paddingX: Math.max(0, Math.min(2, Math.floor((terminal.columns - 1) / 2)))
+    }, ...children);
+  };
+}
+function createRemoteStatusScene(resolveTarget) {
+  return function RemoteStatusScene({ React, ui, close }) {
+    const terminal = ui.useTerminalSize();
+    ui.useInput((input2, key) => {
+      if (key.escape === true || input2.toLowerCase() === "q") close();
+    });
+    const children = [
+      React.createElement(ui.Text, { key: "title", bold: true, color: "accent" }, "Remote Host status"),
+      ...remoteStatusLines(resolveTarget()).map((line, index) => React.createElement(
+        ui.Text,
+        { key: `status-${index}`, color: line === "" ? "subtle" : void 0 },
+        line === "" ? " " : line
+      )),
+      React.createElement(ui.Text, { key: "close", color: "subtle" }, "Press Esc or q to return.")
+    ];
+    return React.createElement(ui.Box, {
+      flexDirection: "column",
+      gap: 1,
+      paddingX: Math.max(0, Math.min(2, Math.floor((terminal.columns - 1) / 2)))
+    }, ...children);
+  };
+}
+function terminalLink2(url) {
+  return `\x1B]8;;${url}\x07${url}\x1B]8;;\x07`;
+}
+function printableWidth(value) {
+  return value.replace(/\u001B\[[0-9;]*m/gu, "").length;
+}
+function errorCode4(error) {
+  if (error instanceof ServerApiError) return error.code;
+  if (error instanceof Error && "code" in error && typeof error.code === "string") return error.code;
+  return "CONNECTION_FAILED";
+}
+function wait(milliseconds) {
+  return new Promise((resolve3) => setTimeout(resolve3, milliseconds));
+}
+
 // src/remote-file-content-provider.ts
 var REMOTE_FILE_SAVE_AS_MAX_BYTES = 100 * 1024 * 1024;
 var REMOTE_FILE_FAST_SAVE_AS_MAX_BYTES = 1024 * 1024 * 1024;
@@ -23936,15 +24813,18 @@ var legacyLoaderModuleNames = /* @__PURE__ */ new Set(["dsh-remote", "@dsh-remot
 var pluginSettingsNamespace = "ds-harness-remote";
 var legacySettingsNamespace = "dsh-remote";
 function apply(ctx, input2 = {}) {
-  ctx.inject(["settings", "connection", "typertGateway"], (runtimeContext) => {
+  const tuiCommandsAvailable = ctx.get("commands", false) !== void 0 && ctx.get("tuiScenes", false) !== void 0;
+  const tuiBinding = tuiCommandsAvailable ? {} : void 0;
+  if (tuiBinding !== void 0) installTuiRemoteCommand(ctx, () => tuiBinding.target);
+  ctx.inject(["settings", "typertGateway"], (runtimeContext) => {
     const gateway = runtimeContext.get("typertGateway");
-    if (runtimeContext.get("apiProxy") !== void 0 || new TypertGatewaySwitch(gateway).supportsCarrier()) {
-      return activate(runtimeContext, input2);
+    if (tuiCommandsAvailable || runtimeContext.get("apiProxy") !== void 0 || new TypertGatewaySwitch(gateway).supportsCarrier()) {
+      return activate(runtimeContext, input2, tuiBinding);
     }
     runtimeContext.inject(["apiProxy"], (legacyContext) => activate(legacyContext, input2));
   });
 }
-async function activate(ctx, input2) {
+async function activate(ctx, input2, tuiBinding) {
   const settings = ctx.get("settings");
   const settingsScope = settings?.register(pluginSettingsNamespace, Config, {
     base: input2,
@@ -23954,11 +24834,12 @@ async function activate(ctx, input2) {
     }
   });
   if (settings !== void 0 && settingsScope !== void 0) {
-    const migration = await migrateLegacySettings(settings, settingsScope);
-    if (migration === "migrated") ctx.logger.info("migrated legacy Remote settings namespace");
-    if (migration === "failed") ctx.logger.warn("failed to migrate legacy Remote settings namespace");
+    const migration = migrateLegacySettings(settings, settingsScope);
+    reportSettingsMigration(ctx, await migration);
   }
-  const config = resolveConfig(settingsScope?.get() ?? input2);
+  const connection = ctx.get("connection");
+  const resolvedConfig = resolveConfig(settingsScope?.get() ?? input2);
+  const config = connection === void 0 && resolvedConfig.serverUrl === void 0 ? { ...resolvedConfig, serverUrl: DEFAULT_REMOTE_SERVER_URL } : resolvedConfig;
   if (!config.enabled) return;
   const logger = new SafeLogger({
     debug: (message) => {
@@ -23978,13 +24859,11 @@ async function activate(ctx, input2) {
       console.error(message);
     }
   }, config.logLevel);
-  await disableLegacyLoaderEntries(ctx, logger);
   const defaultIdentityDirectory = new IdentityStore().directory;
   const hostIdentities = new IdentityStore({
     directory: config.serverUrl === void 0 ? defaultIdentityDirectory : serverStorageDirectory(defaultIdentityDirectory, config.serverUrl, "host")
   });
   const apiProxy = ctx.get("apiProxy");
-  const connection = ctx.get("connection");
   const nativeTypertGateway = ctx.get("typertGateway");
   const localTypertGateway = new TypertGatewaySwitch(nativeTypertGateway).local();
   const runtime = new HostPluginRuntime(
@@ -24014,6 +24893,9 @@ async function activate(ctx, input2) {
   const controlRuntime = connection === void 0 ? void 0 : new PluginControlRuntime(config, defaultIdentityDirectory, settingsScope, clientRuntime, hostControl);
   ctx.provide("dshRemote", runtime);
   if (clientRuntime !== void 0) ctx.provide("dshRemoteClient", clientRuntime);
+  const tuiTarget = { runtime, config };
+  if (tuiBinding !== void 0) tuiBinding.target = tuiTarget;
+  await disableLegacyLoaderEntries(ctx, logger);
   await ctx.effect(async () => {
     const disposeControl = controlRuntime?.register(connection);
     try {
@@ -24029,18 +24911,24 @@ async function activate(ctx, input2) {
         });
       }
     } catch (error) {
+      if (tuiBinding?.target === tuiTarget) tuiBinding.target = void 0;
       await disposeControl?.();
       await clientRuntime?.close();
       await runtime.close();
       throw error;
     }
     return async () => {
+      if (tuiBinding?.target === tuiTarget) tuiBinding.target = void 0;
       await disposeControl?.();
       await clientRuntime?.close();
       await runtime.close();
     };
   }, "dsh-remote lifecycle");
 }
+function reportSettingsMigration(ctx, migration) {
+  if (migration === "migrated") ctx.logger.info("migrated legacy Remote settings namespace");
+  if (migration === "failed") ctx.logger.warn("failed to migrate legacy Remote settings namespace");
+}
 async function migrateLegacySettings(settings, currentScope) {
   if (typeof settings.describe !== "function") return "skipped";
   try {
@@ -24131,6 +25019,7 @@ export {
   migrateLegacySettings,
   name,
   resolveConfig,
+  runCli,
   serverStorageDirectory
 };
 /*! Bundled license information: