dsh-cindy-host 0.1.20

package/src/login.js

@@ -0,0 +1,31 @@
+import { loginWithPhone } from "./cindy-login.js";
+import { saveSession } from "./credential-store.js";
+
+if (process.argv.includes("--help")) {
+  console.log("Usage: CINDY_AUTH_BASE_URL=https://auth.example npm run login");
+  process.exit(0);
+}
+
+const authBaseUrl = process.env.CINDY_AUTH_BASE_URL || readFlag("--auth-base-url");
+const clientType = process.env.CINDY_CLIENT_TYPE || "desktop";
+
+try {
+  const session = await loginWithPhone({ authBaseUrl, clientType });
+  // Persist so the settings card sees the same session the terminal just made.
+  // Best-effort: a host with no OS credential store still gets a usable handle.
+  try {
+    await saveSession(session);
+  } catch {
+    console.error("Cindy logged in, but the OS credential store is unavailable; the settings card will not see this session");
+  }
+  // Deliberately expose only the non-secret local device handle.
+  console.log(JSON.stringify({ status: "authenticated", deviceId: session.deviceId }, null, 2));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : "Cindy login failed");
+  process.exitCode = 1;
+}
+
+function readFlag(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}

package/src/logout.js

@@ -0,0 +1,3 @@
+import { clearSession } from './auth-session.js';
+await clearSession();
+console.log('{"status":"signed-out"}');

package/src/projection-read-model-sink.js

@@ -0,0 +1,6 @@
+export class ProjectionReadModelSink {
+  constructor(model, onActivity = () => {}) { this.model = model; this.onActivity = onActivity; }
+  async replaceConversations(rows) { this.model.rows = new Map(rows.map((row) => [row.sessionId, row])); }
+  async appendActivity(item) { this.onActivity(item); }
+  async markStale() {}
+}

package/src/projection.js

@@ -0,0 +1,43 @@
+import { toActivityItem, toConversationRow } from "./contracts.js";
+
+export class ReadOnlyProjection {
+  constructor(sink) {
+    this.sink = sink;
+    this.source = null;
+    this.unsubscribe = null;
+    this.rebasing = false;
+  }
+
+  async start(source) {
+    this.source = source;
+    await this.rebaseline();
+    this.unsubscribe = source.onEvent((event) => this.apply(event));
+  }
+
+  async stop() {
+    if (this.unsubscribe) this.unsubscribe();
+    this.unsubscribe = null;
+  }
+
+  async apply(event) {
+    if (event.kind === "stream-failed") return this.recover();
+    const item = toActivityItem(event);
+    if (item) await this.sink.appendActivity(item);
+  }
+
+  async recover() {
+    if (this.rebasing) return;
+    this.rebasing = true;
+    try {
+      await this.sink.markStale();
+      await this.rebaseline();
+    } finally {
+      this.rebasing = false;
+    }
+  }
+
+  async rebaseline() {
+    const sessions = await this.source.listSessions();
+    await this.sink.replaceConversations(sessions.map(toConversationRow));
+  }
+}

package/src/session-flags.js

@@ -0,0 +1,160 @@
+/**
+ * The three session actions DSH itself has no concept of: archive, delete, pin.
+ *
+ * A controller's session list offers 删除 / 归档 / 置顶 / 重命名, and all four are
+ * the *same* write (`local-db:sessions:patch-meta`, see
+ * `Cindy/apps/desktop/src/renderer/lib/sessionService.ts` and
+ * `Cindy/apps/mobile/src/session/useSessionListActions.ts`). Only 重命名 has a DSH
+ * counterpart — DSH sessions are a log-backed store with no archived, hidden or
+ * pinned state — so this module is the Host's own bookkeeping for the other three.
+ *
+ * Three consequences are deliberate and must stay visible:
+ *
+ * 1. **删除 hides, it does not destroy.** The session is removed from what this
+ *    Host's controllers see; DSH's log and the desk's own DSH UI are untouched. A
+ *    Host that deleted DSH data on a phone tap would be a far worse failure than a
+ *    hidden row, and the user can always restore from the archive view.
+ * 2. **The flags outlive the process.** They live in this plugin's settings section
+ *    (`sessionFlags`), so an archived session does not silently reappear on the
+ *    next start — a hide that forgets is worse than no hide at all.
+ * 3. **An unknown session id can still be flagged.** The controller's write is
+ *    authoritative about what it wants; its own cached row is what it is editing.
+ */
+
+/** The statuses the controller's filter understands. */
+const STATUSES = new Set(['active', 'archived', 'deleted']);
+
+/**
+ * Normalize one stored entry, dropping anything malformed.
+ *
+ * Settings survive upgrades and hand edits, so a bad entry must cost one row's
+ * flag rather than the whole list.
+ */
+function normalizeEntry(value) {
+  if (value === null || typeof value !== 'object') return null;
+  const entry = {};
+  if (typeof value.status === 'string' && STATUSES.has(value.status) && value.status !== 'active') entry.status = value.status;
+  // An empty string is not a pin. Settings round-trips can hand one back (a `null`
+  // written by an older build becomes `''` in YAML), and keeping it would leave an
+  // entry behind for every session the user ever unpinned.
+  if (typeof value.pinnedAt === 'string' && value.pinnedAt !== '') entry.pinnedAt = value.pinnedAt;
+  return Object.keys(entry).length === 0 ? null : entry;
+}
+
+/**
+ * Build the flag store over a settings-backed snapshot.
+ *
+ * @param options - `initial` is the settings section's value; `persist` is awaited
+ *   with the whole snapshot after every change (the settings service owns the write,
+ *   so this module never touches storage itself).
+ * @returns the flag store the channel layer and the row projection share.
+ */
+export function createSessionFlags({ initial, persist } = {}) {
+  /** sessionId -> `{ status?: 'archived'|'deleted', pinnedAt?: string }`. */
+  const entries = new Map();
+
+  /**
+   * Adopt the settings section's value as the truth.
+   *
+   * Called whenever settings change (including once at start). It deliberately does
+   * **not** persist: the settings service is the writer here, and a replace that
+   * wrote back would loop through `scope.watch`.
+   */
+  function replace(value) {
+    entries.clear();
+    if (value === null || typeof value !== 'object') return;
+    for (const [sessionId, raw] of Object.entries(value)) {
+      const entry = normalizeEntry(raw);
+      if (entry !== null && sessionId !== '') entries.set(sessionId, entry);
+    }
+  }
+
+  replace(initial);
+
+  /** The stored flags for one session, or undefined when it carries none. */
+  function flagsFor(sessionId) {
+    return entries.get(String(sessionId));
+  }
+
+  /** The whole store, in the shape the settings section stores. */
+  function snapshot() {
+    const out = {};
+    for (const [sessionId, entry] of entries) out[sessionId] = { ...entry };
+    return out;
+  }
+
+  /**
+   * Record one metadata write and hand back what it did.
+   *
+   * @param sessionId - the session the controller is editing.
+   * @param patch - the controller's `{ status?, pinnedAt? }`, verbatim.
+   * @returns `{ status, pinnedAt }` — the effective values the reply row must carry.
+   *   `pinnedAt` is null for an unpinned session, and the caller echoes it only when
+   *   the controller asked for it (an unpin is a real patch: it is what clears the
+   *   pin on every other device).
+   */
+  async function apply(sessionId, patch) {
+    const id = String(sessionId);
+    const next = { ...(entries.get(id) ?? {}) };
+
+    if (patch.status !== undefined) {
+      if (typeof patch.status !== 'string' || !STATUSES.has(patch.status)) throw new Error(`unsupported session status ${String(patch.status)}`);
+      // `active` is the absence of a flag, not a flag: restoring a session must
+      // leave nothing behind, or the store would grow an entry per restored row.
+      if (patch.status === 'active') delete next.status;
+      else next.status = patch.status;
+    }
+
+    if (patch.pinnedAt !== undefined) {
+      // `null` is the controller's unpin — `swipeActionPatch('archive')` sends
+      // `{ status: 'archived', pinnedAt: null }`, and 取消置顶 sends the same field
+      // alone. Deleting the key is the whole unpin: this store is the *only* source
+      // of a pin (DSH has none), so there is no stale value to come back.
+      if (patch.pinnedAt === null || patch.pinnedAt === '') delete next.pinnedAt;
+      else if (typeof patch.pinnedAt === 'string') next.pinnedAt = patch.pinnedAt;
+      else throw new Error('pinnedAt must be an ISO string or null');
+    }
+
+    if (Object.keys(next).length === 0) entries.delete(id);
+    else entries.set(id, next);
+
+    if (typeof persist === 'function') await persist(snapshot());
+
+    return { status: next.status ?? 'active', pinnedAt: next.pinnedAt ?? null };
+  }
+
+  /**
+   * Fold the flags onto one source row.
+   *
+   * The source row is deliberately **not** copied when it carries no flags: the
+   * overwhelming majority of rows do not, and `toCindySessionListRow` is the single
+   * place that decides the wire shape.
+   */
+  function project(row) {
+    if (row === null || typeof row !== 'object') return row;
+    const entry = entries.get(String(row.id));
+    if (entry === undefined) return row;
+    const next = { ...row };
+    if (entry.status !== undefined) next.status = entry.status;
+    if (typeof entry.pinnedAt === 'string' && entry.pinnedAt !== '') next.pinnedAt = entry.pinnedAt;
+    return next;
+  }
+
+  function projectAll(rows) {
+    const list = Array.isArray(rows) ? rows : [];
+    return list.map((row) => project(row));
+  }
+
+  /**
+   * Whether a row is hidden from this Host's controllers.
+   *
+   * Archived and deleted both drop out of the live surfaces (`maker:list-active`):
+   * a row the phone does not show must not be able to light its running badge.
+   */
+  function isHidden(sessionId) {
+    const entry = entries.get(String(sessionId));
+    return entry?.status === 'archived' || entry?.status === 'deleted';
+  }
+
+  return { replace, apply, project, projectAll, isHidden, snapshot, flagsFor };
+}

package/src/session-publisher.js

@@ -0,0 +1,123 @@
+/**
+ * Send one list-level push to the controllers holding the `sessions` topic.
+ *
+ * @param ws - the relay socket.
+ * @param subscribers - the devices holding the topic.
+ * @param channel - the push channel.
+ * @param payload - the channel's payload.
+ * @param record - called with the channel and its watcher count.
+ *
+ * `record` exists because these pushes bypass the session-scoped path that keeps
+ * `recentPushes`/`pushTotals`. Without it the list-level pushes — the very ones a
+ * session list's running badge depends on — were invisible in diagnostics, so
+ * "did we tell the controller the turn ended?" could not be answered at all.
+ */
+export function publish(ws, subscribers, channel, payload, record) {
+  if (typeof record === 'function') record(channel, subscribers.size, payload);
+  for (const dst of subscribers) ws.send(JSON.stringify({ v: 1, kind: 'push', dst, payload: { channel, payload } }));
+}
+
+/**
+ * The controller's live-activity phase for one lifecycle item, or null.
+ *
+ * The mapping is by **kind as well as phase**, because DSH reuses `idle` for two
+ * different facts: a turn that just finished (`session-status`) and a session
+ * that has simply never run (`session-added`). Only the first is a completion.
+ *
+ * The fallback matters more than it looks. This used to end in `: 'running'`, so
+ * every phase it did not name — `idle` above all — announced a running turn. The
+ * controller sets `isRunning: true` for `running` and only converges it to false
+ * for `completed`/`error`, so a finished turn left the session list spinning
+ * until something else happened to correct it.
+ *
+ * @param item - one lifecycle item from the projection sink.
+ * @returns the controller's phase, or null when the item claims nothing.
+ */
+export function activityPhaseFor(item) {
+  if (item === null || typeof item !== 'object') return null;
+  // A session appearing or a subscription opening says nothing about a turn.
+  if (item.kind === 'session-added' || item.kind === 'session-removed' || item.kind === 'session-subscribed') return null;
+  switch (item.phase) {
+    case 'waiting': return 'needs-interaction';
+    case 'running': return 'running';
+    case 'completed': return 'completed';
+    case 'error': return 'error';
+    // A turn that ended: the only thing that tells the controller to stop.
+    case 'idle': return 'completed';
+    // `active` is DSH's bare "something happened" tick, not a statement that a
+    // turn is live — `api-session/status` is that authority. Claiming `running`
+    // for it meant a tick arriving *after* a turn ended told the controller the
+    // session was busy again, with no later terminal event to undo it: the
+    // spinner never stopped. An unknown phase is the same kind of non-claim.
+    default: return null;
+  }
+}
+
+export function publishActivity(ws, subscribers, item, record) {
+  const phase = activityPhaseFor(item);
+  // An item this Host cannot place is not a claim about the session's state.
+  if (phase === null) return;
+  publish(ws, subscribers, 'local-db:sessions:activity', { sessionId: item.sessionId, phase, compactDetail: '', attention: phase === 'needs-interaction' }, record);
+}
+
+/**
+ * Publish one lifecycle item to the list subscribers.
+ * @param ws - the relay socket.
+ * @param subscribers - the devices holding the `sessions` topic.
+ * @param item - one lifecycle item from the projection sink.
+ * @param record - called with each channel and its watcher count.
+ */
+export function publishLifecycle(ws, subscribers, item, record) {
+  if (item.kind === 'session-added') publish(ws, subscribers, 'local-db:sessions:created', { sessionId: item.sessionId }, record);
+  else if (item.kind === 'session-status') publish(ws, subscribers, 'local-db:sessions:patched', { sessionId: item.sessionId, patch: { updatedAt: item.occurredAt } }, record);
+  publishActivity(ws, subscribers, item, record);
+}
+
+/**
+ * The per-session turn event that starts and stops the controller's spinner.
+ *
+ * The controller clears "thinking" on a terminal `maker:event` and on nothing
+ * else: `maker:status-changed` only retires a *closed* session, and the
+ * list-level activity push belongs to the `sessions` topic, which a controller
+ * viewing a single session does not hold. Without this, a finished turn left the
+ * phone spinning forever — the answer had arrived and the composer still said
+ * 思考中.
+ *
+ * `maker:event` is session-scoped, so it must go to `session:<id>` watchers
+ * rather than to the list subscribers.
+ * @param item - one lifecycle item from the projection sink.
+ * @returns the channel and payload, or null when the item says nothing about a turn.
+ */
+/** Cindy status events require both the running flag and a displayable string. */
+export function runningStatusEvent(status = 'running') {
+  return { type: 'status', data: { isRunning: true, status } };
+}
+
+export function turnEventFor(item) {
+  const sessionId = item?.sessionId;
+  if (typeof sessionId !== 'string' || sessionId === '') return null;
+  if (item.kind !== 'session-status') return null;
+  switch (item.phase) {
+    // A turn (or a wait for the user) is live.
+    case 'running':
+      return { channel: 'maker:event', payload: { sessionId, event: runningStatusEvent() } };
+    case 'waiting':
+      return { channel: 'maker:event', payload: { sessionId, event: runningStatusEvent('waiting on input') } };
+    // A failure is unambiguous.
+    case 'error':
+      return { channel: 'maker:event', payload: { sessionId, event: { type: 'done' } } };
+    // `idle` is deliberately NOT an ending here.
+    //
+    // This flag flaps: `api-session/status` reports `running: false` for a moment
+    // between a prompt being accepted and its turn really starting, so treating it
+    // as the end sent a `done` **31 ms after a live turn began** — the controller
+    // finalized its streaming rows and stopped its timer while the agent was still
+    // generating. Real endings come from DSH's own `turn/end` event (driven by the
+    // plugin), with the durable-message reconcile as the fallback if one is lost.
+    //
+    // `active` is the same kind of non-claim: it is a bare "something happened"
+    // tick, not a statement about a turn.
+    default:
+      return null;
+  }
+}

package/src/session-read-model.js

@@ -0,0 +1,6 @@
+import { toConversationRow } from './contracts.js';
+export class SessionReadModel {
+  constructor() { this.rows = new Map(); }
+  replace(sessions) { this.rows = new Map(sessions.map((session) => { const row = toConversationRow(session); return [row.sessionId, row]; })); }
+  list() { return [...this.rows.values()]; }
+}