dsh-cindy-host 0.1.23 → 0.1.26

package/README.md

@@ -1,178 +1,28 @@
 # DSH Cindy Host
 
-A DSH-to-Cindy host adapter. The console demo projects a DSH conversation list and safe lifecycle/status activity to a replaceable sink; the DSH bundle additionally carries the Cindy session, the DeviceLink relay, and the 「Cindy 手机连接」 settings card that lets the Cindy mobile client reach this Host.
+A Host-side adapter connecting Cindy desktop and mobile clients to DeepSeek Harness.
 
-## Quick Start（从 npm 安装）
+## Install
 
-需要 **Node.js 22 或更高版本**。下面将插件安装到默认 Web profile：
-
-```bash
-# 从 npm 安装当前发布版本
-bunx @deepseek-ai/dsh plugin --profile web add dsh-cindy-host
-
-# pnpm 10 需要显式批准 keytar 的构建脚本
-bunx @deepseek-ai/dsh plugin --profile web approve-builds
-```
-
-在批准列表中选择 `keytar`，然后**重启 DSH Web**。重启后可在 **设置 → Plugins** 找到「Cindy 手机连接」：使用手机号和验证码登录，再开启手机连接。
-
-有关 `keytar` 的编译环境、失败降级与替代配置，请见[安装与原生模块说明](#安装与原生模块说明)。
-
-## Console demo scope
-
-- Conversation list: opaque session ID, title, phase, update time.
-- Activity feed: added, removed, and status summaries only.
-- Safe recovery: stream failure emits a generic stale marker and refreshes the list baseline.
-
-The projection deliberately excludes message bodies, prompt input, tool calls/results, approval/question payloads, file paths/content, credentials, and command sending. The Cindy transport consumes only what the projection already produced.
-
-## Run
-
-Requires Node 22 or newer. There are no package dependencies for the fixture demo.
-
-```sh
-npm test
-npm run demo
-```
-
-## Cindy login MVP
-
-The Host can request a verification code and exchange it for a Cindy session. It never prints tokens; the host runtime stores a session in the operating-system credential store for refresh. It defaults to the China mainland Cindy auth endpoint (`https://auth.cindy.com.cn`):
+Requires Node.js 22 or newer. Use the DSH plugin manager, or:
 
 ```sh
-npm run login
-```
-
-`CINDY_AUTH_BASE_URL` remains an optional override for an explicit non-mainland environment.
-
-The command displays only the newly generated Host device handle on success, and persists the session so the settings card picks up the same login.
-
-## Cindy phone link (Settings → Cindy 手机连接)
-
-The bundle adds its own page, **设置 → Cindy 手机连接**, registered into the
-shell's `settings.section` slot — a feature owning its settings page is the
-documented seat for this, so no shell change was needed. Turning **连接手机** on
-signs this Host in to Cindy, joins the DeviceLink relay, and makes the Host show
-up in the Cindy mobile client's device list; turning it off closes the socket,
-stops the projection, and forgets every device and subscriber.
-
-The page shows the five states the Host can be in (未连接 / 登录中 / 等待手机连接 /
-已连接 / 连接失败), collects the Cindy verification-code login when no session
-exists yet, and lists the connected devices with their name and `deviceId`.
-
-There is **no QR code**: Cindy has no pairing protocol, and its own "connect your
-phone" QR is just the regional app-download page. The four protocol questions and
-their source evidence are recorded in
-[Cindy phone link](doc/cindy-phone-link.md), together with the design.
-
-## 手机大文件下载（0.1.10 起）
-
-原 Export 入口按 inline → peer → OSS 回退。**0.1.11 起 OSS 兜底也支持最多2 GiB（含边界）**，流式上传，不再受旧512 MiB上限限制；约1.3 GB真实文件已经OSS下载到手机。实际手机P2P连接问题仍待定位，本次不宣称直连已修复。需更新/重启Host后生效，不含手机上传或断点续传。验证于DSH 0.1.5-rc.2 / Node 24.12.0；Node要求≥22，keytar为原生依赖。详见[文件传输说明](doc/file-transfer.md)。
-
-## 手机任务图标（0.1.12 起）
-
-DSH Host 仍只有一种执行 harness；手机任务行把 Cindy 的三种 `agentKind` 用作模型图标别名：DeepSeek 来源任意模型显示 Pi，GPT 模型显示 Codex，其他来源已知模型显示 Claude；**0.1.13 起**无法确认来源的图标改为 Claude，Pi 只保留给确认是 DeepSeek 的来源（0.1.12 的未知来源仍显示 Pi）。手机新建时选择的 agent 平台不会更换 DSH harness，实际模型和来源仍以 DSH 会话选择为准；手机的 agent 筛选、标签和最近会话默认项也会跟随图标 kind。手机端无需更新，但 Host 安装新版后必须重启才生效。
-
-## Safe isolated DSH smoke test
-
-Do **not** add this package to the DSH profile you use every day. Use a disposable `DSH_HOME`; it gives the smoke profile its own bundles, settings, and credentials. These PowerShell commands run from this repository:
-
-```powershell
-# Every following dsh command in this terminal uses only this disposable home.
-$env:DSH_HOME = Join-Path (Get-Location) '.sandbox/dsh-home'
-
-# Create an isolated Web profile without starting a server, then add this local bundle.
-dsh --profile cindy-smoke --from-default-profile web --dump-config
-dsh plugin --profile cindy-smoke add .
-
-# Gate 1: parse and compose the profile only. Do not continue if this fails.
-dsh --profile cindy-smoke --dump-config
-
-# Gate 2: start a separate UI without opening a browser or sharing port 3080.
-# transportEnabled is false by default, so this cannot log in or connect to Cindy.
-dsh --profile cindy-smoke --no-open --port 3081
-```
-
-Run `npm test` before Gate 1. A clean Gate 2 must show a running DSH host on port 3081 and no Cindy authentication prompt. Stop it with `Ctrl+C`; removing `.sandbox/dsh-home` removes the whole test profile and its credentials. Do not enable `transportEnabled` until the mount, RPC, and lifecycle smoke checks are clean.
-
-**Never start port 3081 with `--profile web` and the normal `DSH_HOME`.** A second process then shares the production Host's DeviceLink identity; the relay may route a phone's `maker:input:enqueue` to the wrong process, where resuming a session owned by the 3080 process fails with `SessionAlreadyOwnedError` and appears as `[INTERNAL] DSH Host failed to serve this channel`. It can also make the phone's queue/sync status oscillate. Use only the isolated `cindy-smoke` profile above, and check both `/api/dsh-cindy-host/status` endpoints for duplicate `status.host.deviceId` before testing phone sends.
-
-With Gate 2 running, two Host surfaces answer over loopback:
-
+dsh plugin --profile desktop add dsh-cindy-host@0.1.26
 ```
-GET /api/dsh-cindy-host/status   # the card's only source of truth
-```
-
-The card itself is served as the `dsh-cindy-host` entry of
-`window.__DSH_BOOT__`; `npm test` renders it with React so its markup and state
-rules are covered without a browser.
-
-## DSH API compatibility boundary
-
-`DshHostSource` has contract tests for the older public `InProcessApiClient(toFetchHandler(ctx.apiProxy))` adapter. Current DSH Web (`0.1.5-rc.2`) does not mount `apiProxy`; it exposes Typert remotes instead. Therefore this bundle mounts safely without a live DSH source when `apiProxy` is absent, and the isolated smoke test validates composition/lifecycle only.
-
-**DSH's own packages are `peerDependencies`, never `dependencies`** — the host supplies them, and a plugin that installs its own copy drags a whole DSH generation into the profile and stops the profile from booting. That is what `0.1.1` did; see [`doc/publishing.md`](doc/publishing.md) §5.4 and §5.6 for the measured failure and the rule.
 
-## 安装与原生模块说明
+Reload the Host plugin (or restart DSH) after installation, then refresh Settings → Cindy 手机连接. Keep your existing Cindy sign-in and device identity. Do not run two Host processes with the same device identity.
 
-[Quick Start](#quick-start从-npm-安装) 已给出从 npm 安装、批准构建脚本和重启的最短路径。本节说明其中 `keytar` 构建步骤的原因与替代方案。
-
-### 为什么要批准 `keytar`？
-
-`keytar` 将 Cindy 登录会话保存在系统凭据库（Windows 凭据管理器、macOS Keychain 或 Linux Secret Service），因此需要下载预编译二进制；没有适配的预编译包时，会回退到本机编译。对 pnpm 10 而言，这一步需要显式批准构建脚本。
-
-- Windows 通常需要 **VS Build Tools**（含 C++ 工作负载）；macOS 需要 Xcode Command Line Tools；Linux 需要 `libsecret-1-dev` 等构建依赖。
-- 如果未批准或编译失败，插件仍会安装并挂载；仅 Cindy 登录和凭据存储不可用，并会给出明确错误。
-- 不要使用 `0.1.1` 或更早版本的 tarball；它们会向 profile 装入不兼容的一代 DSH 依赖。请始终从 npm 安装当前版本。
-
-发布、干净 profile 验证和替代的 `onlyBuiltDependencies` 配置见 [`doc/publishing.md`](doc/publishing.md) §5.2。
-
-## 发布指南
-
-- [doc/publishing.md](doc/publishing.md) —— **插件发布**：把本插件做成别人/别的 profile 能装上的 npm 包（bundle 三要素、三种消费方式、包内容白名单、干净 profile 验证、撤版）。
-- [doc/releasing.md](doc/releasing.md) —— **改动上线**：门禁 → claw 留证 → 脱敏 → 部署（重启才是生效点） → 回滚。
-
-## 仓库治理
-
-分支 `main`，远端 `origin` = <https://github.com/chanyuenpang/dsh-cindy-host>（公开）。`v0.1.1`
-已打 tag、推远端，并以 GitHub Release 形式附 tarball 分发（**不进 npm registry**，见
-[`doc/publishing.md`](doc/publishing.md) §5.5）。
-
-**入库的内容**：`src/`（插件与运行时）、`lib/`（设置页客户端入口）、`test/`（单测）、
-`tools/`（验收脚本与活体探针）、`doc/`、`package.json` / `package-lock.json`、
-`cordis.patch.yml`，以及 claw 的**项目记忆** `.claw/{tasks,adr,truth}/` 与 `.claw/project.json`。
-
-**不入库的内容**（见 `.gitignore`）：
-
-- `node_modules/`；
-- `.sandbox/` —— 沙箱用的 DSH home，带它自己的凭据与会话存储。
-  注意：`.sandbox/dsh-home/profiles/<profile>/node_modules/dsh-cindy-host` 是指向本仓库的
-  **junction**（不是副本），所以任何**跟随链接递归**的工具（`git status --ignored`、部分索引器）
-  会绕圈并报 `Filename too long`。普通 `git add/status` 因为整目录被忽略不会进去；不要据此
-  「清理」出一个递归副本，磁盘上并没有重复的仓库。
-- `.claw/runtime/`、`.claw/logs/`、`.claw/memory.sqlite*` —— claw 守护进程的运行时状态；
-- 仓库根目录的一次性探测残留（`.claw-*.txt|log|mjs|cjs|report`）与 agent 生成的图片。
-
-**验证入口**：
-
-```bash
-npm test                                                              # 单测（463 项）
-npm run audit:channels                                                # 通道判定表（served 52 / declined 140 / unclassified 0）
-node tools/acceptance.mjs --base http://127.0.0.1:3080 --with-prompts # 端到端（105 项）
-npm run verify                                                        # 上面三者的串行组合
-```
+DSH provides its own session/settings services. DSH 0.1 and 0.2 paths are retained; this release is verified with the DSH 0.2.1-rc.3 desktop runtime. Optional keytar supports OS-backed credentials; without its native binary, sign-in reports an unavailable credential store instead of preventing mounting.
 
-`tools/probe-*.mjs` 是活体探针（分页耗时、媒体缩图、todo 投影、会话日志、历史视图形状），
-它们只读本地 DSH 状态，用来把「手机上看到什么」量化成数字。
+## 0.1.26
 
-## Documents
+- Edit the Host display name in Settings → Cindy 手机连接 → 主机名称. Names are saved locally, support Unicode and are limited to 64 UTF-16 code units. Online names synchronize without forcing a relay reconnect. Local save and cloud sync are reported separately. Device ID and OS computer name do not change.
+- Queue UI content is plain text as expected by current Cindy rendering.
+- Recent durable-consumption evidence prevents late acknowledgments or stale snapshots from restoring already-consumed messages to pending/steering. This bounded record is per runtime, not a persistent message store.
+- Host status reports pluginVersion separately from its Cindy compatibility identity.
 
-- [Research](doc/research.md)
-- [Architecture](doc/architecture.md)
-- [Development plan](doc/development-plan.md)
-- [Cindy phone link](doc/cindy-phone-link.md)
-- [Projection read probe](doc/projection-read-probe.md)
+These changes are Host-only; no modified Cindy client is required. Advanced optional features remain unavailable rather than returning fabricated success. Automated checks are not a claim that every new-client feature is supported or every live incident is resolved.
 
-## Next boundary
+## Rollback
 
-Cindy device-link integration requires a separate design and security review. It must not be added by swapping the console sink without defining identity, opt-in, topic contracts, and privacy policy.
+Reinstall dsh-cindy-host@0.1.25 and reload the Host plugin. Preserve profile settings, device ID and the OS credential store.

package/lib/client.js

@@ -64,11 +64,22 @@ window.__ModuleLoader__.load({
           signIn: "登录",
           signingIn: "登录中…",
           logout: "退出登录",
-          devices: "已连接设备",
+          devices: "账号设备",
           deviceOffline: "离线",
           deviceOnline: "在线",
           unknownPlatform: "未知平台",
           hostDevice: "本机设备",
+          hostName: "主机名称",
+          hostNameHint: "用于 Cindy 设备列表，最多 64 个字符，不影响系统计算机名或设备连接。",
+          saveName: "保存名称",
+          savingName: "保存中…",
+          nameSaved: "主机名称已保存到本机。",
+          nameSaveFailed: "保存失败，请重试",
+          nameInvalid: "请输入 1–64 个字符，不能包含换行或控制字符",
+          nameSyncPending: "连接 Cindy 后会同步名称。",
+          nameSyncing: "正在同步到 Cindy…",
+          nameSynced: "名称已同步到 Cindy。",
+          nameSyncFailed: "本机名称已保存，但 Cindy 同步失败；请检查网络或登录状态，重新开关连接后重试。",
           noDevices: "还没有手机连上这台 Host。",
           unavailable: "Cindy Host 设置命名空间不可用，请确认插件已在本机加载。",
           statusUnavailable: "读取 Host 状态失败，正在重试…",
@@ -101,11 +112,22 @@ window.__ModuleLoader__.load({
           signIn: "Sign in",
           signingIn: "Signing in…",
           logout: "Sign out",
-          devices: "Connected devices",
+          devices: "Account devices",
           deviceOffline: "offline",
           deviceOnline: "online",
           unknownPlatform: "unknown platform",
           hostDevice: "This Host",
+          hostName: "Host name",
+          hostNameHint: "Shown in Cindy. Up to 64 characters; does not change your computer name or device identity.",
+          saveName: "Save name",
+          savingName: "Saving…",
+          nameSaved: "Host name saved locally.",
+          nameSaveFailed: "Could not save. Please try again.",
+          nameInvalid: "Enter 1–64 characters without line breaks or control characters.",
+          nameSyncPending: "The name will sync when connected to Cindy.",
+          nameSyncing: "Syncing to Cindy…",
+          nameSynced: "Name synced to Cindy.",
+          nameSyncFailed: "Saved locally, but Cindy sync failed. Check your network or sign-in, then turn the connection off and on to retry.",
           noDevices: "No phone has reached this Host yet.",
           unavailable: "The Cindy Host settings namespace is unavailable on this deployment.",
           statusUnavailable: "Reading Host status failed; retrying…",
@@ -180,6 +202,7 @@ window.__ModuleLoader__.load({
         devices: status && Array.isArray(status.devices) ? status.devices : [],
         login,
         host: (status && status.host) || null,
+        deviceName: typeof value.deviceName === "string" && value.deviceName.trim() ? value.deviceName.trim() : "DSH Host",
         showLogin: login.required === true,
         showReconnect: (status ? status.state : "disconnected") === "failed" && login.required !== true,
       };
@@ -234,6 +257,15 @@ window.__ModuleLoader__.load({
       return value.length > 4 ? "***" + value.slice(-4) : "***";
     }
 
+    function validHostName(value) {
+      return typeof value === "string" && value.trim().length > 0 && value.trim().length <= 64 && !/[\u0000-\u001f\u007f-\u009f]/.test(value);
+    }
+
+    async function writeHostName(scope, value) {
+      if (!validHostName(value)) throw new Error(TEXT.nameInvalid);
+      if (await scope.set("deviceName", value.trim()) === false) throw new Error(TEXT.nameSaveFailed);
+    }
+
     /** POST JSON to the Host API and always resolve to a parsed body. */
     async function postJson(path, body) {
       const response = await fetch(API + path, {
@@ -450,8 +482,55 @@ window.__ModuleLoader__.load({
       );
     }
 
+    /** Keep an unsaved draft independent of status polling and settings snapshots. */
+    function HostNameForm({ scope, value, writable, busy = false, sync }) {
+      const [draft, setDraft] = react.useState(null);
+      const [saving, setSaving] = react.useState(false);
+      const [error, setError] = react.useState(null);
+      const [saved, setSaved] = react.useState(false);
+      const savingRef = react.useRef(false);
+      const text = draft === null ? value : draft;
+      const valid = validHostName(text);
+      const disabled = !writable || busy || saving;
+      const save = async (event) => {
+        event.preventDefault();
+        if (disabled || savingRef.current || !valid || text.trim() === value) return;
+        savingRef.current = true;
+        setSaving(true);
+        setError(null);
+        setSaved(false);
+        try {
+          await writeHostName(scope, text);
+          setDraft(null);
+          setSaved(true);
+        } catch { setError(TEXT.nameSaveFailed); }
+        finally { savingRef.current = false; setSaving(false); }
+      };
+      const syncText = sync?.name === value ? {
+        pending: TEXT.nameSyncPending, syncing: TEXT.nameSyncing,
+        synced: TEXT.nameSynced, failed: TEXT.nameSyncFailed,
+      }[sync.state] : null;
+      return h("form", { style: styles.form, onSubmit: save },
+        h("label", { style: styles.field },
+          h("span", { style: styles.label }, TEXT.hostName),
+          h("input", { style: Object.assign({}, styles.input, { minWidth: 0 }),
+            value: text, maxLength: 64, disabled,
+            onChange: (event) => { setDraft(event.target.value); setSaved(false); setError(null); },
+          }),
+        ),
+        h("span", { style: styles.hint }, TEXT.hostNameHint),
+        draft !== null && !valid ? h("p", { style: styles.error, role: "alert" }, TEXT.nameInvalid) : null,
+        h("button", { type: "submit", style: Object.assign({}, styles.buttonGhost, { alignSelf: "flex-start" }),
+          disabled: disabled || !valid || text.trim() === value }, saving ? TEXT.savingName : TEXT.saveName),
+        error ? h("p", { style: styles.error, role: "alert" }, error) : null,
+        saved ? h("p", { style: styles.ok, role: "status" }, TEXT.nameSaved) : null,
+        syncText ? h("p", { style: sync.state === "failed" ? styles.error : styles.hint, role: "status" }, syncText) : null,
+      );
+    }
+
     /** One device row: a name the user recognizes plus the id they can quote. */
-    function DeviceRow({ device }) {
+    function DeviceRow({ device, onDelete, busy = false }) {
+      const [confirming, setConfirming] = react.useState(false);
       const online = device.online === true;
       return h(
         "div",
@@ -460,8 +539,15 @@ window.__ModuleLoader__.load({
         h(
           "span",
           { style: styles.deviceMeta },
-          (online ? TEXT.deviceOnline : TEXT.deviceOffline) + " · " + platformText(device.platform) + " · " + device.deviceId,
+          (online ? TEXT.deviceOnline : TEXT.deviceOffline) + " · " + platformText(device.platform) + " · " + device.deviceId + (device.lastSeenAt ? " · " + device.lastSeenAt : ""),
         ),
+        onDelete ? h("div", null,
+          confirming && device.online === false ? h("div", null,
+            h("span", { style: styles.hint }, "从账号中删除此设备？这会移除该设备记录，并非仅隐藏。"),
+            h("button", { type: "button", disabled: busy, onClick: () => onDelete(device.deviceId) }, "确认删除"),
+            h("button", { type: "button", disabled: busy, onClick: () => setConfirming(false) }, "取消"),
+          ) : h("button", { type: "button", disabled: busy || device.online !== false, title: online ? "在线设备不能删除，请先断开" : "删除离线设备", onClick: () => setConfirming(true) }, "删除设备"),
+        ) : null,
       );
     }
 
@@ -533,6 +619,12 @@ window.__ModuleLoader__.load({
           }
         }, [refresh]);
 
+        const onDeleteDevice = (deviceId) => guard(async () => {
+          const result = await postJson("/devices/delete", { deviceId });
+          if (!result.ok) { setError(result.message || "删除失败，请刷新重试"); return; }
+          if (result.status) setStatus(result.status);
+        });
+
         const onSendCode = ({ kind, identifier }) =>
           guard(async () => {
             setNotice(null);
@@ -622,6 +714,8 @@ window.__ModuleLoader__.load({
                 view.message ? h("span", { style: styles.hint }, "· " + view.message) : null,
               ),
 
+          h(HostNameForm, { scope, value: view.deviceName, writable: view.writable, busy, sync: status && status.nameSync }),
+
           view.login.authenticated === true
             ? h(
                 "div",
@@ -647,12 +741,12 @@ window.__ModuleLoader__.load({
             "div",
             { style: styles.deviceList },
             h("span", { style: styles.label }, TEXT.devices),
-            view.devices.length > 0 ? view.devices.map((device) => h(DeviceRow, { key: device.deviceId, device })) : h("span", { style: styles.hint }, TEXT.noDevices),
+            view.devices.length > 0 ? view.devices.map((device) => h(DeviceRow, { key: device.deviceId, device, busy, onDelete: view.login.authenticated && device.deviceId !== view.host?.deviceId ? onDeleteDevice : null })) : h("span", { style: styles.hint }, TEXT.noDevices),
             view.host && view.host.deviceId
               ? h(
                   "span",
                   { style: styles.deviceMeta },
-                  TEXT.hostDevice + ": " + (view.host.deviceName || "DSH Host") + " · " + view.host.deviceId,
+                  TEXT.hostDevice + ": " + (view.host.deviceName || "DSH Host") + " · " + view.host.deviceId + (view.host.appVersion ? " · Cindy " + view.host.appVersion : ""),
                 )
               : null,
           ),
@@ -757,7 +851,7 @@ window.__ModuleLoader__.load({
     // Test seam: the presentation helpers and sub-components, so the markup
     // rules can be rendered and asserted without a browser. Not part of the
     // plugin contract — the runner reads only `apply` and `inject`.
-    exports.__internals = { TEXT, NAMESPACE, API, SECTION_ORDER, resolveCardView, bindSettingsPage, stateText, stateColor, platformText, writeSwitch, readStatus, maskIdentifier, Switch, LoginForm, DeviceRow, createCindySettingsPage };
+    exports.__internals = { TEXT, NAMESPACE, API, SECTION_ORDER, resolveCardView, bindSettingsPage, stateText, stateColor, platformText, writeSwitch, validHostName, writeHostName, HostNameForm, readStatus, maskIdentifier, Switch, LoginForm, DeviceRow, createCindySettingsPage };
     return module.exports;
   },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.23",
+  "version": "0.1.26",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",
@@ -25,8 +25,7 @@
     "cordis.patch.yml",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE",
-    "doc"
+    "LICENSE"
   ],
   "type": "module",
   "main": "./src/dsh-plugin.js",

package/src/dsh-plugin.js

@@ -55,6 +55,7 @@ const HostSettingsSchema = Schema.object({
   remoteControlEnabled: Schema.boolean().default(DEFAULT_HOST_SETTINGS.remoteControlEnabled),
   controllers: Schema.dict(ControllerSchema).default({}),
   deviceId: Schema.string().default(DEFAULT_HOST_SETTINGS.deviceId),
+  deviceName: Schema.string().default(DEFAULT_HOST_SETTINGS.deviceName),
   sessionFlags: Schema.dict(SessionFlagSchema).default({}),
 });
 

package/src/host-authorization.js

@@ -14,6 +14,8 @@
  *    which is exactly the trap this file now documents.
  */
 
+import { HOST_APP_VERSION } from './host-version.js';
+
 const CHANNELS = ['device-link:subscribe', 'local-db:sessions:list'];
 
 /**
@@ -43,7 +45,7 @@ export function acceptLink(frame, acceptedControllers, capabilities = HOST_CAPAB
     id: frame.id,
     dst: frame.src,
     payload: {
-      appVersion: '0.1.0',
+      appVersion: HOST_APP_VERSION,
       allowlistHash: computeAllowlistHash(),
       ...(capabilities.length === 0 ? {} : { capabilities: [...capabilities] }),
     },

package/src/host-device-delete.js

@@ -0,0 +1,50 @@
+/** Delete only a known offline peer; credential renewal belongs to the Host owner. */
+export async function deleteAccountDevice({ deviceId, session, snapshot, url, fetchImpl, refreshSession, getSnapshot = () => snapshot }) {
+  const fail = (statusCode, message) => ({ ok: false, statusCode, message });
+  const validate = () => {
+    if (typeof deviceId !== 'string' || !deviceId.trim()) return fail(400, '设备 ID 无效');
+    if (!session?.accessToken) return fail(401, '现有登录态不可用，请检查凭据存储');
+    const current = getSnapshot();
+    if (deviceId === session.deviceId || deviceId === current.host?.deviceId) return fail(409, '不能删除当前主机');
+    const device = current.devices.find(row => row.deviceId === deviceId);
+    if (!device) return fail(404, '设备不在当前列表中，请刷新');
+    if (device.online !== false) return fail(409, '在线设备不能删除，请先将该设备断开');
+    return null;
+  };
+  const invalid = validate();
+  if (invalid) return invalid;
+  try {
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const response = await fetchImpl(url + '/' + encodeURIComponent(deviceId), {
+        method: 'DELETE', headers: { Authorization: 'Bearer ' + session.accessToken, accept: 'application/json', 'Content-Type': 'application/json' },
+        signal: AbortSignal.timeout(15000),
+      });
+      const body = await response.json().catch(() => null);
+      if (response.status === 401 && attempt === 0 && refreshSession) {
+        const renewed = await refreshSession(session);
+        if (renewed) {
+          session = renewed;
+          const invalid = validate();
+          if (invalid) return invalid;
+          continue;
+        }
+      }
+      if (!response.ok) {
+        const messages = {
+          401: '登录态已过期，未删除设备，也未清除凭据',
+          403: '服务拒绝删除：当前账号无权删除此设备',
+          404: '服务未找到该设备，请刷新设备列表',
+          405: '当前服务不支持设备删除接口',
+          409: '服务拒绝删除：设备状态冲突，请刷新设备列表',
+          429: '删除请求过于频繁，请稍后重试',
+        };
+        const code = response.status >= 400 && response.status <= 599 ? response.status : 502;
+        return fail(code, messages[code] ?? ('设备删除服务请求失败（HTTP ' + code + '），请稍后重试'));
+      }
+      if (body?.deleted !== true || body.deviceId !== deviceId) return fail(502, '服务未确认删除，请刷新设备列表');
+      return { ok: true, deviceId, deleted: true };
+    }
+  } catch {
+    return fail(502, '无法确认删除结果，请检查网络并刷新列表');
+  }
+}

package/src/host-device-name.js

@@ -0,0 +1,55 @@
+/** Serialize account display-name writes; no token refresh or relay reconnect. */
+export function createDeviceNameSync({ url, fetchImpl = fetch }) {
+  let desired = null;
+  let flight = null;
+  let controller = null;
+  let revision = 0;
+  let state = { state: 'idle', name: null };
+
+  function update(input) {
+    desired = input;
+    revision++;
+    state = { state: input?.name ? 'pending' : 'idle', name: input?.name ?? null };
+    if (!flight) drain();
+  }
+
+  function drain() {
+    if (!desired?.name || !desired.session?.accessToken || !desired.deviceId) return;
+    flight = (async () => {
+      while (desired?.name && desired.session?.accessToken && desired.deviceId) {
+        const input = desired;
+        const version = revision;
+        controller = new AbortController();
+        state = { state: 'syncing', name: input.name };
+        let ok = false;
+        try {
+          const response = await fetchImpl(url + '/' + encodeURIComponent(input.deviceId), {
+            method: 'PATCH',
+            headers: { Authorization: 'Bearer ' + input.session.accessToken, 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({ name: input.name }),
+            signal: AbortSignal.any([controller.signal, AbortSignal.timeout(8000)]),
+          });
+          const body = await response.json();
+          ok = response.ok && body?.deviceId === input.deviceId && body.name === input.name;
+        } catch { /* A local save is not proof of a remote rename. */ }
+        if (version !== revision) continue;
+        state = { state: ok ? 'synced' : 'failed', name: input.name };
+        break;
+      }
+    })().finally(() => {
+      flight = null;
+      controller = null;
+      // An update can arrive after the last await but before this finalizer.
+      if (state.state === 'pending' && desired?.session?.accessToken) drain();
+    });
+  }
+
+  function reset(name = null) {
+    revision++;
+    desired = name ? { name } : null;
+    controller?.abort();
+    state = { state: name ? 'pending' : 'idle', name };
+  }
+
+  return { update, reset, snapshot: () => ({ ...state }) };
+}

package/src/host-input-queue.js

@@ -21,6 +21,9 @@ const DSH_MODEL = 'pi';
 const DSH_EFFORT = 'default';
 const DSH_PERMISSION_MODE = 'default';
 
+/** Bound recent durable-consumption evidence; this is not a second queue store. */
+export const RETIRED_INPUT_LIMIT = 2048;
+
 /**
  * The session's working directory, from whichever row shape was handed in.
  *
@@ -93,8 +96,10 @@ export function toQueuedRemoteMessage(item, session) {
     permissionMode: DSH_PERMISSION_MODE,
     workingDir,
     createOpts,
-    // The controller's validator requires a user-role chat message.
-    chatMessage: { role: 'user', clientId, content },
+    // This is a rendered ChatMessage, not the agent's raw SDK content blocks.
+    // Desktop promotes it directly into the transcript as the queue drains;
+    // its quote/navigation parsers require a string. Keep rich persistence above.
+    chatMessage: { role: 'user', clientId, content: text },
   };
 }
 
@@ -132,7 +137,7 @@ export function queuedRowFromController({ clientId, text, session }) {
     permissionMode: DSH_PERMISSION_MODE,
     workingDir,
     createOpts,
-    chatMessage: { role: 'user', clientId, content: [{ type: 'text', text: value }] },
+    chatMessage: { role: 'user', clientId, content: value },
   };
 }
 
@@ -145,6 +150,22 @@ export function createInputQueueTracker() {
   const queues = new Map();
   /** sessionId -> SessionJob[] */
   const jobs = new Map();
+  // Durable consumption can beat prompt acceptance/ACK and stale control reads.
+  // Keep proof long enough that those late observations cannot revive a spinner.
+  const retired = new Map();
+  const retirementKey = (sessionId, clientId) => JSON.stringify([sessionId, clientId]);
+  const isRetired = (sessionId, clientId) => retired.has(retirementKey(sessionId, clientId));
+  const itemRetired = (sessionId, item) => isRetired(sessionId,
+    typeof item?.rpcId === 'string' && item.rpcId !== '' ? item.rpcId : String(item?.id ?? ''));
+
+  function retire(sessionId, clientId) {
+    if (typeof sessionId !== 'string' || !sessionId || typeof clientId !== 'string' || !clientId) return;
+    const key = retirementKey(sessionId, clientId);
+    retired.delete(key);
+    retired.set(key, true);
+    while (retired.size > RETIRED_INPUT_LIMIT) retired.delete(retired.keys().next().value);
+    mirror(sessionId, clientId, { kind: 'remove' });
+  }
   /**
    * sessionId -> controller-owned queue UI state.
    *
@@ -230,7 +251,7 @@ export function createInputQueueTracker() {
   function markItem(sessionId, item, placement) {
     if (typeof sessionId !== 'string' || sessionId === '') return;
     const id = item?.id === undefined || item?.id === null ? null : String(item.id);
-    if (id === null) return;
+    if (id === null || itemRetired(sessionId, item)) return;
     const items = queues.get(sessionId) ?? [];
     const others = items.filter((entry) => String(entry?.id) !== id);
     queues.set(sessionId, [...others, { ...item, id, placement }]);
@@ -274,7 +295,8 @@ export function createInputQueueTracker() {
 
   /** Rebuild one session's queue state. */
   function setItems(sessionId, items) {
-    if (Array.isArray(items) && items.length > 0) queues.set(sessionId, items);
+    const pending = Array.isArray(items) ? items.filter((item) => !itemRetired(sessionId, item)) : [];
+    if (pending.length > 0) queues.set(sessionId, pending);
     else queues.delete(sessionId);
   }
 
@@ -291,7 +313,7 @@ export function createInputQueueTracker() {
       queues.clear();
       jobs.clear();
       for (const [sessionId, items] of Object.entries(frame.value?.queues ?? {})) {
-        if (Array.isArray(items)) queues.set(sessionId, items);
+        setItems(sessionId, items);
       }
       for (const [sessionId, entries] of Object.entries(frame.value?.jobs ?? {})) {
         if (Array.isArray(entries)) jobs.set(sessionId, entries);
@@ -340,7 +362,7 @@ export function createInputQueueTracker() {
     const seen = new Set();
     for (const item of source) {
       const row = toQueuedRemoteMessage(item, session);
-      if (row === null) continue;
+      if (row === null || isRetired(sessionId, row.clientId)) continue;
       seen.add(row.clientId);
       // DSH next-step (steering) is still an inbox wait, not a consumed message.
       // Cindy supports the same id in both fields: the body survives re-entry
@@ -348,7 +370,7 @@ export function createInputQueueTracker() {
       if (item?.placement === 'queued' || item?.placement === 'steering') pendingQueue.push(row);
       if (item?.placement === 'steering') steeringQueueClientIds.push(row.clientId);
     }
-    if (pending !== null && !seen.has(pending.clientId)) pendingQueue.push(pending);
+    if (pending !== null && !seen.has(pending.clientId) && !isRetired(sessionId, pending.clientId)) pendingQueue.push(pending);
 
     const state = uiFor(sessionId);
     return {
@@ -375,6 +397,7 @@ export function createInputQueueTracker() {
     queues.clear();
     jobs.clear();
     ui.clear();
+    retired.clear();
   }
 
   return {
@@ -383,6 +406,8 @@ export function createInputQueueTracker() {
     jobsFor,
     projectionFor,
     clear,
+    /** Only a durable message event is proof of consumption; cancellation is not. */
+    retire,
     /** Whether DSH is holding this item; decides steer-promotion vs a new send. */
     hasItem: (sessionId, itemId) => itemOf(sessionId, itemId) !== undefined,
     /**