dsh-deeppilot 0.3.0 → 0.4.0

package/lib/index.js

@@ -1,9 +1,8 @@
 import { createRequire } from "node:module";
 import { createServer } from "node:http";
-import { createPrivateKey, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
-import { access, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { createHash, createPrivateKey, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
+import { access, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import z from "@deepseek-ai/schemastery";
 import { WebSocketServer } from "ws";
 import { homedir, networkInterfaces } from "node:os";
 import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
@@ -13,6 +12,7 @@ import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { request } from "node:https";
+import z from "@deepseek-ai/schemastery";
 //#region src/token.ts
 /** Expand a leading ~ using the process home directory. */
 function expandHome(p) {
@@ -59,13 +59,30 @@ async function loadOrCreateToken(tokenPath) {
 	try {
 		const existing = (await readFile(full, "utf8")).trim();
 		if (existing.length >= 32) return existing;
-	} catch {}
+		await preserveCorruptSidecar(full);
+		throw new Error(`pairing token is malformed at ${full} (length=${existing.length}); original preserved as ${full}.corrupt`);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
 	const token = randomBytes(32).toString("base64url");
 	await mkdir(dirname(full), { recursive: true });
 	await writeFile(full, token + "\n", { mode: 384 });
 	return token;
 }
 /**
+* Copy a malformed auth-token file to `<path>.corrupt` so a future operator
+* can inspect what was on disk at the moment of corruption. Best-effort:
+* a copy failure (permissions, full disk, ...) must not block the loud
+* throw that actually surfaces the issue.
+*/
+async function preserveCorruptSidecar(full) {
+	try {
+		const original = await readFile(full);
+		const sidecar = `${full}.corrupt`;
+		await writeFile(sidecar, original, { mode: 384 });
+	} catch {}
+}
+/**
 * Generate a fresh pairing token and replace the stored one, invalidating
 * every copy of the old secret. The write goes to a same-directory temp file
 * renamed over the target so a crash can never leave a truncated token file.
@@ -82,12 +99,12 @@ async function writeNewToken(tokenPath) {
 /** Constant-time token comparison; both sides are high-entropy secrets. */
 function tokenMatches(presented, expected) {
 	if (!presented) return false;
-	const a = Buffer.from(presented);
 	const b = Buffer.from(expected);
-	if (a.length !== b.length) {
+	if (Buffer.byteLength(presented, "utf8") !== b.length) {
 		timingSafeEqual(b, b);
 		return false;
 	}
+	const a = Buffer.from(presented);
 	return timingSafeEqual(a, b);
 }
 /** Hex shape of an APNs device token as delivered by iOS (usually 64 chars). */
@@ -219,7 +236,7 @@ var DeviceStore = class DeviceStore {
 	}
 };
 //#endregion
-//#region src/connection.ts
+//#region src/connection-policy.ts
 const AUTH_TIMEOUT_MS = 5e3;
 const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
 	"image/png",
@@ -227,19 +244,43 @@ const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
 	"image/webp",
 	"image/gif"
 ]);
-const MAX_PROMPT_IMAGES = 4;
-const MAX_BASE64_CHARS_PER_IMAGE = 8388608;
-/** Bounds a single prompt's text; the frame itself is capped by ws maxPayload. */
-const MAX_PROMPT_TEXT_CHARS = 262144;
-const MAX_DEVICE_ID_CHARS = 128;
-const MAX_DEVICE_NAME_CHARS = 64;
-const MAX_APP_VERSION_CHARS = 32;
 function sanitizeDeviceField(value, maxChars) {
 	return (typeof value === "string" ? value : String(value ?? "")).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, maxChars);
 }
 function helloTokenAccepted(transportAuthenticated, presentedToken, expectedToken) {
 	return transportAuthenticated === true || tokenMatches(presentedToken, expectedToken);
 }
+function sanitizeImageName(value) {
+	return value.replace(/[\u0000-\u001F\u007F]/g, "").trim().slice(0, 120);
+}
+/** Error code for a failed approval/question response outcome. */
+function pendingResponseErrorCode(reason) {
+	switch (reason) {
+		case "not-pending": return "E_NOT_FOUND";
+		case "bad-response": return "E_PROTOCOL";
+		case "transport": return "E_INTERNAL";
+	}
+}
+/** Human-readable failure detail; `question not pending` must only ever mean
+* "nothing pending", never "the host rejected the answer". */
+function pendingResponseMessage(kind, reason) {
+	switch (reason) {
+		case "not-pending": return kind + " not pending";
+		case "bad-response": return kind + " answer rejected by host: answer does not match the asked questions";
+		case "transport": return "host connection failed while answering " + kind;
+	}
+}
+function managementErrorCode(kind) {
+	switch (kind) {
+		case "unsupported": return "E_UNSUPPORTED";
+		case "not-found": return "E_NOT_FOUND";
+		case "busy": return "E_BUSY";
+		case "invalid": return "E_PROTOCOL";
+		case "internal": return "E_INTERNAL";
+	}
+}
+//#endregion
+//#region src/connection.ts
 /**
 * One connected phone. Implements BridgeSink so the HostBridge can push
 * projected frames and replays. Bearer/query credentials may authenticate the
@@ -249,6 +290,7 @@ var BridgeConnection = class {
 	ws;
 	deps;
 	authenticated = false;
+	closed = false;
 	helloTimer;
 	openSessions = /* @__PURE__ */ new Set();
 	/** Sanitized device identity from hello; needed for push registration. */
@@ -272,6 +314,19 @@ var BridgeConnection = class {
 	terminate() {
 		this.ws.terminate();
 	}
+	/** Protocol-compliant idle timeout: let the peer observe a normal 1001 close. */
+	closeIdle() {
+		this.close(1001, "idle timeout");
+	}
+	/** Announce an orderly plugin/data-plane shutdown before closing the socket. */
+	closeForServerStop() {
+		this.fail(void 0, "E_INTERNAL", "server stopping");
+		this.close(1001, "server stopping");
+	}
+	/** Used by dependency-lifecycle cleanup to avoid closing a replacement bridge. */
+	isAttachedTo(bridge) {
+		return this.deps.bridge === bridge;
+	}
 	/** Device identity once hello succeeded; undefined before that. */
 	get connectedDeviceId() {
 		return this.authenticated ? this.deviceId : void 0;
@@ -293,6 +348,8 @@ var BridgeConnection = class {
 		return this.deps.bridge.currentCursor();
 	}
 	onClose() {
+		if (this.closed) return;
+		this.closed = true;
 		if (this.helloTimer !== void 0) clearTimeout(this.helloTimer);
 		for (const id of this.openSessions) this.deps.bridge.markSinkClosed(this, id);
 		this.openSessions.clear();
@@ -300,6 +357,7 @@ var BridgeConnection = class {
 		if (this.authenticated) this.deps.bridge.removeSink(this);
 	}
 	close(code, reason) {
+		if (this.closed) return;
 		try {
 			this.ws.close(code, reason);
 		} catch {
@@ -315,7 +373,12 @@ var BridgeConnection = class {
 			...seq !== void 0 ? { seq } : {},
 			payload
 		};
-		if (this.ws.readyState === this.ws.OPEN) this.ws.send(JSON.stringify(envelope));
+		if (this.ws.readyState !== this.ws.OPEN) return;
+		if (this.ws.bufferedAmount > 4194304) {
+			this.close(1013, "client too slow");
+			return;
+		}
+		this.ws.send(JSON.stringify(envelope));
 	}
 	fail(id, code, message) {
 		this.send("s2c.error", {
@@ -330,6 +393,10 @@ var BridgeConnection = class {
 	}
 	async onMessage(raw) {
 		this.lastActivity = Date.now();
+		if (!this.authenticated && raw.length > 65536) {
+			this.close(1009, "pre-auth frame too large");
+			return;
+		}
 		let env;
 		try {
 			env = JSON.parse(raw);
@@ -524,15 +591,15 @@ var BridgeConnection = class {
 				const text = typeof p?.text === "string" ? p.text : "";
 				const rawImages = Array.isArray(p?.images) ? p.images : [];
 				if (!p?.sessionId || text.trim().length === 0 && rawImages.length === 0) return this.fail(env.id, "E_PROTOCOL", "sessionId and text or images required");
-				if (text.length > MAX_PROMPT_TEXT_CHARS) return this.fail(env.id, "E_PROTOCOL", "prompt text too long");
-				if (rawImages.length > MAX_PROMPT_IMAGES) return this.fail(env.id, "E_PROTOCOL", "too many images");
+				if (text.length > 262144) return this.fail(env.id, "E_PROTOCOL", "prompt text too long");
+				if (rawImages.length > 4) return this.fail(env.id, "E_PROTOCOL", "too many images");
 				const images = [];
 				for (const image of rawImages) {
-					if (!IMAGE_MEDIA_TYPES.has(String(image?.mediaType)) || typeof image?.data !== "string" || image.data.length === 0 || image.data.length > MAX_BASE64_CHARS_PER_IMAGE) return this.fail(env.id, "E_PROTOCOL", "invalid image attachment");
+					if (!IMAGE_MEDIA_TYPES.has(String(image?.mediaType)) || typeof image?.data !== "string" || image.data.length === 0 || image.data.length > 8388608) return this.fail(env.id, "E_PROTOCOL", "invalid image attachment");
 					images.push({
 						mediaType: image.mediaType,
 						data: image.data,
-						...typeof image.name === "string" && image.name.trim().length > 0 ? { name: image.name.trim().slice(0, 120) } : {}
+						...typeof image.name === "string" && sanitizeImageName(image.name).length > 0 ? { name: sanitizeImageName(image.name) } : {}
 					});
 				}
 				const userSeq = await this.deps.bridge.sendPrompt(p.sessionId, text, images);
@@ -591,14 +658,14 @@ var BridgeConnection = class {
 			this.close(4403, "deviceId required");
 			return;
 		}
-		const deviceId = sanitizeDeviceField(p.deviceId, MAX_DEVICE_ID_CHARS);
+		const deviceId = sanitizeDeviceField(p.deviceId, 128);
 		if (!deviceId) {
 			this.fail(env.id, "E_PROTOCOL", "deviceId required");
 			this.close(4403, "deviceId required");
 			return;
 		}
-		const deviceName = sanitizeDeviceField(p.deviceName, MAX_DEVICE_NAME_CHARS) || "unknown";
-		const appVersion = sanitizeDeviceField(p.appVersion, MAX_APP_VERSION_CHARS) || "unknown";
+		const deviceName = sanitizeDeviceField(p.deviceName, 64) || "unknown";
+		const appVersion = sanitizeDeviceField(p.appVersion, 32) || "unknown";
 		this.authenticated = true;
 		this.deviceId = deviceId;
 		if (this.helloTimer !== void 0) clearTimeout(this.helloTimer);
@@ -624,34 +691,8 @@ var BridgeConnection = class {
 		}
 	}
 };
-/** Error code for a failed approval/question response outcome. */
-function pendingResponseErrorCode(reason) {
-	switch (reason) {
-		case "not-pending": return "E_NOT_FOUND";
-		case "bad-response": return "E_PROTOCOL";
-		case "transport": return "E_INTERNAL";
-	}
-}
-/** Human-readable failure detail; `question not pending` must only ever mean
-* "nothing pending", never "the host rejected the answer". */
-function pendingResponseMessage(kind, reason) {
-	switch (reason) {
-		case "not-pending": return kind + " not pending";
-		case "bad-response": return kind + " answer rejected by host: answer does not match the asked questions";
-		case "transport": return "host connection failed while answering " + kind;
-	}
-}
-function managementErrorCode(kind) {
-	switch (kind) {
-		case "unsupported": return "E_UNSUPPORTED";
-		case "not-found": return "E_NOT_FOUND";
-		case "busy": return "E_BUSY";
-		case "invalid": return "E_PROTOCOL";
-		case "internal": return "E_INTERNAL";
-	}
-}
 //#endregion
-//#region src/host-bridge.ts
+//#region src/host-api.ts
 /**
 * Subagent sessions are host-internal workers of a parent conversation.
 * They must never surface on the phone: not in the project/session list,
@@ -662,170 +703,623 @@ function isSubagentRow(row) {
 }
 function unwrapStreamItem(item) {
 	const nested = item.payload;
-	if (nested && typeof nested === "object" && typeof nested.type === "string") return nested.rpcId || !item.rpcId ? nested : {
+	if (nested && typeof nested === "object" && typeof nested.type === "string") return item.rpcId ? {
 		...nested,
 		rpcId: item.rpcId
-	};
+	} : nested;
 	return item;
 }
-const MAX_RING_DEFAULT = 2e3;
-/**
-* Process-wide bridge state: session mirror, pending approvals/questions,
-* and the per-device replay ring. Consumes the in-process mux/host streams
-* and fans projected pushes out to every registered sink.
-*/
-let BRIDGE_SEQ = 0;
-var HostBridge = class {
-	apiProxy;
-	historyBufferMax;
-	id = ++BRIDGE_SEQ;
-	summaries = /* @__PURE__ */ new Map();
-	approvals = /* @__PURE__ */ new Map();
-	questions = /* @__PURE__ */ new Map();
-	archivedSessionIds = /* @__PURE__ */ new Set();
-	subagentSessionIds = /* @__PURE__ */ new Set();
-	sinks = /* @__PURE__ */ new Set();
-	ring = [];
-	cursor = 0;
-	abort = new AbortController();
-	constructor(apiProxy, historyBufferMax = MAX_RING_DEFAULT) {
-		this.apiProxy = apiProxy;
-		this.historyBufferMax = historyBufferMax;
-	}
-	pushOutlet;
-	/**
-	* Wire the offline-push fan-out. Present ⇒ welcome advertises the `push`
-	* capability and notify-worthy events are mirrored to APNs.
-	*/
-	setPushOutlet(outlet) {
-		this.pushOutlet = outlet;
-	}
-	get capabilities() {
-		return {
-			historyPaging: true,
-			replay: true,
-			approvals: true,
-			questions: true,
-			pendingSnapshot: true,
-			models: typeof this.apiProxy.sessions.models === "function" && typeof this.apiProxy.sessions.selectModel === "function",
-			sessionManagement: typeof this.apiProxy.sessions.rename === "function" && typeof this.apiProxy.workspace?.archiveSession === "function",
-			projectSelection: typeof this.apiProxy.workspace?.list === "function" && typeof this.apiProxy.workspace?.create === "function",
-			push: this.pushOutlet?.isAvailable() === true
+//#endregion
+//#region src/host-event-projection.ts
+const MAX_MESSAGE_PROJECTION_BYTES = 262144;
+function projectEvent(sessionId, event) {
+	switch (event.type) {
+		case "turn/start": return {
+			kind: "turn.start",
+			data: {}
 		};
-	}
-	diagnostic(message) {
-		console.log("[deeppilot] " + message);
-	}
-	currentCursor() {
-		return this.cursor;
-	}
-	addSink(sink) {
-		this.sinks.add(sink);
-	}
-	removeSink(sink) {
-		this.sinks.delete(sink);
-	}
-	/** Whether the ring still holds everything after the cursor. */
-	canResumeFrom(cursor) {
-		const oldest = this.ring.length > 0 ? this.ring[0].seq : this.cursor + 1;
-		return cursor <= this.cursor && cursor + 1 >= oldest;
-	}
-	sinkSessions = /* @__PURE__ */ new Map();
-	lastAssistantText = /* @__PURE__ */ new Map();
-	/** Mark a sink as actively viewing a session (suppresses its turn notifications). */
-	markSinkOpen(sink, sessionId) {
-		let set = this.sinkSessions.get(sink);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			this.sinkSessions.set(sink, set);
-		}
-		set.add(sessionId);
-	}
-	markSinkClosed(sink, sessionId) {
-		this.sinkSessions.get(sink)?.delete(sessionId);
-	}
-	dropSinkSessions(sink) {
-		this.sinkSessions.delete(sink);
-	}
-	isViewedBy(sink, sessionId) {
-		return this.sinkSessions.get(sink)?.has(sessionId) ?? false;
-	}
-	/** F-9: when a turn completes, notify every device not viewing the session. */
-	emitTurnCompletedNotify(sessionId, ok) {
-		if (this.subagentSessionIds.has(sessionId)) return;
-		const row = this.summaries.get(sessionId);
-		const title = ok ? "任务完成" : "任务异常结束";
-		const body = this.lastAssistantText.get(sessionId) ?? row?.title ?? "";
-		const truncatedBody = body.length > 120 ? body.slice(0, 119) + "…" : body;
-		const category = ok ? "turn.completed" : "session.error";
-		const notificationId = "n-" + (this.cursor + 1);
-		this.record("s2c.notify", {
-			notificationId,
-			category,
-			sessionId,
-			title,
-			body: truncatedBody,
-			ts: Date.now()
-		}, (sink) => this.isViewedBy(sink, sessionId));
-		this.fanOutPush({
-			notificationId,
-			category,
-			sessionId,
-			title,
-			body: truncatedBody
-		});
-	}
-	/**
-	* Mirror one notification-worthy event to offline devices. Fire-and-forget:
-	* push failures must never block or break the WS data plane.
-	*/
-	fanOutPush(notification) {
-		try {
-			this.pushOutlet?.fanOut(notification);
-		} catch {}
-	}
-	/** Remember the latest assistant text so notifications can quote it. */
-	captureAssistantText(sessionId, event) {
-		if (event.type !== "assistant/message") return;
-		const text = messageText(event.data).trim();
-		if (text.length > 0) this.lastAssistantText.set(sessionId, text.slice(-160));
-	}
-	/**
-	* Replay buffered pushes after the given cursor; false when the gap is
-	* unrecoverable. Frames go to `target` only — replaying into every sink
-	* duplicated the whole window onto devices that never asked for it.
-	*/
-	resumeFrom(cursor, target) {
-		const oldest = this.ring.length > 0 ? this.ring[0].seq : this.cursor + 1;
-		if (cursor + 1 < oldest) return false;
-		const receivers = target !== void 0 ? [target] : [...this.sinks];
-		for (const entry of this.ring) if (entry.seq > cursor) for (const sink of receivers) sink.replay([entry]);
-		for (const sink of receivers) sink.replayDone();
-		return true;
-	}
-	record(type, payload, except) {
-		this.cursor += 1;
-		const entry = {
-			seq: this.cursor,
-			type,
-			payload
+		case "turn/end": return {
+			kind: "turn.end",
+			data: { ok: event.data?.reason?.kind === "completed" }
 		};
-		this.ring.push(entry);
-		if (this.ring.length > this.historyBufferMax) this.ring.splice(0, this.ring.length - this.historyBufferMax);
-		for (const sink of this.sinks) {
-			if (except && except(sink)) continue;
-			sink.push(type, payload, entry.seq);
+		case "user/message": return {
+			kind: "message.final",
+			data: { ...limitMessageProjection({
+				seq: event.seq,
+				role: userRoleOf(event.data),
+				text: messageText(event.data),
+				...attachmentProjection(event.data),
+				...contextProjectionOf(event.data),
+				ts: tsOf(event)
+			}) }
+		};
+		case "assistant/chunk":
+			if (chunkTypeOf(event.data) === "reasoning-delta") return {
+				kind: "thinking.delta",
+				data: limitRealtimeText({
+					text: chunkText(event.data),
+					ts: tsOf(event)
+				})
+			};
+			return {
+				kind: "message.delta",
+				data: limitRealtimeText({
+					text: chunkText(event.data),
+					ts: tsOf(event)
+				})
+			};
+		case "assistant/message": {
+			const text = messageText(event.data);
+			const thinking = messageThinking(event.data);
+			if (!text.trim() && !thinking.trim()) return null;
+			return {
+				kind: "message.final",
+				data: { ...limitMessageProjection({
+					seq: event.seq,
+					role: "assistant",
+					text,
+					...thinking ? { thinking } : {},
+					ts: tsOf(event)
+				}) }
+			};
+		}
+		case "tool/call": {
+			const data = event.data;
+			return {
+				kind: "tool.start",
+				data: {
+					seq: event.seq,
+					role: "tool",
+					tool: {
+						name: String(data?.name ?? "tool"),
+						state: "running",
+						summary: summarizeArgs(data?.arguments),
+						...data?.callId ? { callId: String(data.callId) } : {}
+					},
+					ts: tsOf(event)
+				}
+			};
+		}
+		case "tool/result": {
+			const data = event.data;
+			return {
+				kind: "tool.end",
+				data: {
+					seq: event.seq,
+					role: "tool",
+					ok: !event.data || data?.error === void 0,
+					...data?.callId ? { callId: String(data.callId) } : {},
+					ts: tsOf(event)
+				}
+			};
+		}
+		default: return null;
+	}
+}
+function tsOf(event) {
+	return typeof event.time === "number" ? event.time : Date.now();
+}
+/** Read the durable message source off one user/message payload. Handles both
+* bare-message payloads and older `{message: {...}}` wrappers; undefined when
+* the shape carries no readable source (legacy hosts). */
+function userMessageSource(data) {
+	if (!data || typeof data !== "object") return void 0;
+	const obj = data;
+	if (obj.source && typeof obj.source === "object") return obj.source;
+	if (obj.message && typeof obj.message === "object" && obj.message.source && typeof obj.message.source === "object") return obj.message.source;
+}
+/** Wire role for one user/message payload. A payload without any readable
+* source degrades to 'user' so history written by older hosts stays visible;
+* a present source follows the host's own trajectory rule — anything whose
+* `kind` is not 'user' is injected context and projects as 'system'. */
+function userRoleOf(data) {
+	const source = userMessageSource(data);
+	if (!source) return "user";
+	return source.kind === "user" ? "user" : "system";
+}
+/** Producer name of one injected-context source, mirroring how the DSH client
+* runtime derives its trajectory label: plugin name, skill name, instruction
+* paths, session-reference labels, or the raw kind as fallback. */
+function contextLabelOf(source) {
+	const kind = typeof source.kind === "string" ? source.kind : "";
+	const joined = (member) => {
+		const list = source[member];
+		if (!Array.isArray(list)) return void 0;
+		const names = list.flatMap((entry) => {
+			if (!entry || typeof entry !== "object") return [];
+			const record = entry;
+			return [typeof record.label === "string" ? record.label : typeof record.path === "string" ? record.path : ""];
+		}).filter((name) => name.length > 0);
+		return names.length > 0 ? names.join(", ") : void 0;
+	};
+	switch (kind) {
+		case "session-reference": return joined("references") ?? (kind || void 0);
+		case "agent-instructions": return joined("changes") ?? (kind || void 0);
+		case "plugin": return typeof source.plugin === "string" && source.plugin.length > 0 ? source.plugin : kind || void 0;
+		case "skill-invocation": return typeof source.name === "string" && source.name.length > 0 ? source.name : kind || void 0;
+		default: return kind || void 0;
+	}
+}
+/** Semantic ContextForm declared by the producer ('snapshot', 'notice', …);
+* anything unrecognized stays undefined so clients render it opaque. */
+function contextFormOf(source) {
+	if (typeof source.form !== "string" || source.form.length === 0) return void 0;
+	return [
+		"instructions",
+		"catalog",
+		"snapshot",
+		"notice",
+		"relay",
+		"recall"
+	].includes(source.form) ? source.form : void 0;
+}
+/** Optional `context` metadata for one system row; {} on user rows. */
+function contextProjectionOf(data) {
+	if (userRoleOf(data) !== "system") return {};
+	const source = userMessageSource(data);
+	if (!source) return {};
+	const label = contextLabelOf(source);
+	const form = contextFormOf(source);
+	if (!label && !form) return {};
+	return { context: {
+		...label ? { label } : {},
+		...form ? { form } : {}
+	} };
+}
+/** Extract plain text from user/assistant message payloads across shapes. */
+function messageText(data) {
+	if (typeof data === "string") return data;
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (typeof obj.text === "string") return obj.text;
+	if (obj.message && typeof obj.message === "object") return messageText(obj.message);
+	return contentText(obj.content);
+}
+function contentText(content) {
+	if (typeof content === "string") return content;
+	if (Array.isArray(content)) return content.map((part) => {
+		if (typeof part === "string") return part;
+		if (part && typeof part === "object") {
+			const piece = part;
+			if (piece.type === "text" && typeof piece.text === "string") return piece.text;
+		}
+		return "";
+	}).join("");
+	return "";
+}
+function messageAttachments(data) {
+	if (!data || typeof data !== "object") return [];
+	const obj = data;
+	if (obj.message && typeof obj.message === "object") return messageAttachments(obj.message);
+	if (!Array.isArray(obj.content)) return [];
+	return obj.content.flatMap((part) => {
+		if (!part || typeof part !== "object") return [];
+		const block = part;
+		if (block.type !== "image" || !block.attachment) return [];
+		const attachmentId = typeof block.attachment.attachmentId === "string" && block.attachment.attachmentId.length > 0 ? block.attachment.attachmentId : void 0;
+		const width = typeof block.attachment.width === "number" && Number.isFinite(block.attachment.width) ? block.attachment.width : void 0;
+		const height = typeof block.attachment.height === "number" && Number.isFinite(block.attachment.height) ? block.attachment.height : void 0;
+		return [{
+			kind: "image",
+			...typeof block.attachment.name === "string" ? { name: block.attachment.name } : {},
+			...typeof block.attachment.mediaType === "string" ? { mediaType: block.attachment.mediaType } : {},
+			...attachmentId ? { attachmentId } : {},
+			...width !== void 0 ? { width } : {},
+			...height !== void 0 ? { height } : {}
+		}];
+	});
+}
+function attachmentProjection(data) {
+	const attachments = messageAttachments(data);
+	return attachments.length > 0 ? { attachments } : {};
+}
+/** Extract reasoning ("thinking") text from assistant message payloads. */
+function messageThinking(data) {
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (obj.message && typeof obj.message === "object") return messageThinking(obj.message);
+	return reasoningContent(obj.content);
+}
+function reasoningContent(content) {
+	if (!Array.isArray(content)) return "";
+	return content.map((part) => {
+		if (part && typeof part === "object") {
+			const piece = part;
+			if (piece.type === "reasoning" && typeof piece.text === "string") return piece.text;
+		}
+		return "";
+	}).join("");
+}
+/** Stream chunk type of an assistant/chunk payload ('' when unwrapped). */
+function chunkTypeOf(data) {
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (obj.chunk && typeof obj.chunk === "object") return String(obj.chunk.type ?? "");
+	return "text-delta";
+}
+function chunkText(data) {
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (obj.chunk && typeof obj.chunk === "object") {
+		const inner = obj.chunk;
+		if ((inner.type === "text-delta" || inner.type === "reasoning-delta") && typeof inner.text === "string") return inner.text;
+		return "";
+	}
+	const direct = data;
+	return typeof direct.text === "string" ? direct.text : "";
+}
+function summarizeArgs(raw) {
+	if (typeof raw !== "string" || raw.length === 0) return "";
+	try {
+		const parsed = JSON.parse(raw);
+		const parts = [];
+		for (const [key, value] of Object.entries(parsed)) if (typeof value === "string") parts.push(key + "=" + truncate(value.replace(/\s+/g, " "), 60));
+		return truncate(parts.join(" "), 90);
+	} catch {
+		return truncate(raw, 90);
+	}
+}
+function truncate(text, max) {
+	return text.length <= max ? text : text.slice(0, max - 1) + "…";
+}
+function projectHistory(events) {
+	const messages = [];
+	const toolByCall = /* @__PURE__ */ new Map();
+	for (const entry of events) {
+		const event = entry.event;
+		const base = {
+			seq: event.seq,
+			ts: tsOf(event)
+		};
+		switch (event.type) {
+			case "user/message":
+				messages.push({
+					...base,
+					role: userRoleOf(event.data),
+					text: messageText(event.data),
+					...attachmentProjection(event.data),
+					...contextProjectionOf(event.data)
+				});
+				break;
+			case "assistant/message": {
+				const text = messageText(event.data);
+				const thinking = messageThinking(event.data);
+				if (!text.trim() && !thinking.trim()) break;
+				messages.push({
+					...base,
+					role: "assistant",
+					text,
+					...thinking ? { thinking } : {}
+				});
+				break;
+			}
+			case "tool/call": {
+				const data = event.data;
+				const row = {
+					...base,
+					role: "tool",
+					tool: {
+						name: String(data?.name ?? "tool"),
+						state: "running",
+						summary: summarizeArgs(data?.arguments)
+					}
+				};
+				messages.push(row);
+				if (data?.callId) toolByCall.set(String(data.callId), row);
+				break;
+			}
+			case "tool/result": {
+				const data = event.data;
+				const callId = data?.callId ? String(data.callId) : void 0;
+				const target = callId ? toolByCall.get(callId) : void 0;
+				const failed = data?.error !== void 0;
+				const summary = failed ? "失败" : summarizeResult(data?.message?.content);
+				if (target?.tool) target.tool = {
+					...target.tool,
+					state: failed ? "error" : "ok",
+					summary
+				};
+				else messages.push({
+					...base,
+					role: "tool",
+					tool: {
+						name: "result",
+						state: failed ? "error" : "ok",
+						summary
+					}
+				});
+				break;
+			}
+		}
+	}
+	return messages.sort((a, b) => a.seq - b.seq).map(limitMessageProjection);
+}
+/**
+* Enforce PROTOCOL.md's per-message 256 KB ceiling by UTF-8 JSON byte size.
+* Keep structural identity and attachment references intact; progressively
+* shorten human-readable fields until the serialized projection fits.
+*/
+function limitMessageProjection(message) {
+	if (jsonBytes(message) <= 262144) return message;
+	const next = {
+		...message,
+		...message.tool ? { tool: {
+			...message.tool,
+			name: truncateUtf8(message.tool.name, 4096),
+			summary: truncateUtf8(message.tool.summary, 65536)
+		} } : {},
+		...message.attachments ? { attachments: message.attachments.slice(0, 16).map((attachment) => ({
+			...attachment,
+			...attachment.name ? { name: truncateUtf8(attachment.name, 4096) } : {},
+			...attachment.mediaType ? { mediaType: truncateUtf8(attachment.mediaType, 256) } : {},
+			...attachment.attachmentId ? { attachmentId: truncateUtf8(attachment.attachmentId, 4096) } : {}
+		})) } : {},
+		...message.context ? { context: {
+			...message.context.label ? { label: truncateUtf8(message.context.label, 8192) } : {},
+			...message.context.form ? { form: truncateUtf8(message.context.form, 256) } : {}
+		} } : {},
+		truncated: true
+	};
+	const textFields = [];
+	if (typeof next.text === "string") textFields.push({
+		get: () => next.text ?? "",
+		set: (value) => {
+			next.text = value;
+		}
+	});
+	if (typeof next.thinking === "string") textFields.push({
+		get: () => next.thinking ?? "",
+		set: (value) => {
+			next.thinking = value;
+		}
+	});
+	if (next.tool) textFields.push({
+		get: () => next.tool?.summary ?? "",
+		set: (value) => {
+			if (next.tool) next.tool.summary = value;
+		}
+	});
+	if (next.context?.label) textFields.push({
+		get: () => next.context?.label ?? "",
+		set: (value) => {
+			if (next.context) next.context.label = value;
+		}
+	});
+	while (jsonBytes(next) > MAX_MESSAGE_PROJECTION_BYTES) {
+		const largest = textFields.map((field) => ({
+			field,
+			bytes: Buffer.byteLength(field.get(), "utf8")
+		})).sort((a, b) => b.bytes - a.bytes)[0];
+		if (largest && largest.bytes > 0) {
+			largest.field.set(truncateUtf8(largest.field.get(), Math.floor(largest.bytes / 2)));
+			continue;
+		}
+		if (next.attachments && next.attachments.length > 0) {
+			next.attachments = next.attachments.slice(0, -1);
+			continue;
+		}
+		break;
+	}
+	return next;
+}
+function limitRealtimeText(data) {
+	if (jsonBytes(data) <= 262144) return data;
+	let text = data.text;
+	const next = {
+		...data,
+		truncated: true
+	};
+	while (jsonBytes(next) > 262144 && text.length > 0) {
+		text = truncateUtf8(text, Math.floor(Buffer.byteLength(text, "utf8") / 2));
+		next.text = text;
+	}
+	return next;
+}
+function jsonBytes(value) {
+	return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function truncateUtf8(value, maxBytes) {
+	if (maxBytes <= 0) return "";
+	if (Buffer.byteLength(value, "utf8") <= maxBytes) return value;
+	let low = 0;
+	let high = value.length;
+	while (low < high) {
+		const mid = Math.ceil((low + high) / 2);
+		const candidate = value.slice(0, mid);
+		if (Buffer.byteLength(candidate, "utf8") <= maxBytes) low = mid;
+		else high = mid - 1;
+	}
+	let end = low;
+	if (end > 0 && /[\uD800-\uDBFF]/.test(value[end - 1])) end -= 1;
+	return value.slice(0, end);
+}
+function summarizeResult(content) {
+	return truncate(contentText(content).replace(/\s+/g, " ").trim(), 90);
+}
+//#endregion
+//#region src/host-bridge.ts
+const MAX_RING_DEFAULT = 2e3;
+/**
+* Process-wide bridge state: session mirror, pending approvals/questions,
+* and the per-device replay ring. Consumes the in-process mux/host streams
+* and fans projected pushes out to every registered sink.
+*/
+let BRIDGE_SEQ = 0;
+var HostBridge = class {
+	apiProxy;
+	historyBufferMax;
+	id = ++BRIDGE_SEQ;
+	summaries = /* @__PURE__ */ new Map();
+	approvals = /* @__PURE__ */ new Map();
+	questions = /* @__PURE__ */ new Map();
+	archivedSessionIds = /* @__PURE__ */ new Set();
+	subagentSessionIds = /* @__PURE__ */ new Set();
+	sinks = /* @__PURE__ */ new Set();
+	ring = [];
+	cursor = 0;
+	userReceiptSeq = 0;
+	abort = new AbortController();
+	started = false;
+	disposed = false;
+	constructor(apiProxy, historyBufferMax = MAX_RING_DEFAULT) {
+		this.apiProxy = apiProxy;
+		this.historyBufferMax = historyBufferMax;
+	}
+	pushOutlet;
+	/**
+	* Wire the offline-push fan-out. Present ⇒ welcome advertises the `push`
+	* capability and notify-worthy events are mirrored to APNs.
+	*/
+	setPushOutlet(outlet) {
+		this.pushOutlet = outlet;
+	}
+	get capabilities() {
+		return {
+			historyPaging: true,
+			replay: true,
+			approvals: true,
+			questions: true,
+			pendingSnapshot: true,
+			notifyAllCategories: true,
+			models: typeof this.apiProxy.sessions.models === "function" && typeof this.apiProxy.sessions.selectModel === "function",
+			sessionManagement: typeof this.apiProxy.sessions.rename === "function" && typeof this.apiProxy.workspace?.archiveSession === "function",
+			projectSelection: typeof this.apiProxy.workspace?.list === "function" && typeof this.apiProxy.workspace?.create === "function",
+			push: this.pushOutlet?.isAvailable() === true
+		};
+	}
+	diagnostic(message) {
+		console.log("[deeppilot] " + message);
+	}
+	currentCursor() {
+		return this.cursor;
+	}
+	addSink(sink) {
+		this.sinks.add(sink);
+	}
+	removeSink(sink) {
+		this.sinks.delete(sink);
+	}
+	/** Whether the ring still holds everything after the cursor. */
+	canResumeFrom(cursor) {
+		const oldest = this.ring.length > 0 ? this.ring[0].seq : this.cursor + 1;
+		return cursor <= this.cursor && cursor + 1 >= oldest;
+	}
+	sinkSessions = /* @__PURE__ */ new Map();
+	lastAssistantText = /* @__PURE__ */ new Map();
+	/** Mark a sink as actively viewing a session (suppresses its turn notifications). */
+	markSinkOpen(sink, sessionId) {
+		let set = this.sinkSessions.get(sink);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.sinkSessions.set(sink, set);
+		}
+		set.add(sessionId);
+	}
+	markSinkClosed(sink, sessionId) {
+		this.sinkSessions.get(sink)?.delete(sessionId);
+	}
+	dropSinkSessions(sink) {
+		this.sinkSessions.delete(sink);
+	}
+	isViewedBy(sink, sessionId) {
+		return this.sinkSessions.get(sink)?.has(sessionId) ?? false;
+	}
+	/** F-9: when a notification-worthy event fires, mirror it to every
+	*  online device that is not currently viewing the session (the s2c.notify
+	*  frame counts toward the seq cursor and joins the replay ring per
+	*  PROTOCOL §6 + §7), then fan the same payload out to offline devices
+	*  holding an APNs token. */
+	emitNotify(args) {
+		if (this.subagentSessionIds.has(args.sessionId)) return;
+		const body = args.body.length > 120 ? args.body.slice(0, 119) + "…" : args.body;
+		this.record("s2c.notify", {
+			notificationId: args.notificationId,
+			category: args.category,
+			sessionId: args.sessionId,
+			title: args.title,
+			body,
+			ts: Date.now()
+		}, (sink) => this.isViewedBy(sink, args.sessionId));
+		this.fanOutPush({
+			notificationId: args.notificationId,
+			category: args.category,
+			sessionId: args.sessionId,
+			title: args.title,
+			body
+		});
+	}
+	/** F-9: when a turn completes, notify every device not viewing the session. */
+	emitTurnCompletedNotify(sessionId, ok) {
+		if (this.subagentSessionIds.has(sessionId)) return;
+		const row = this.summaries.get(sessionId);
+		const title = ok ? "任务完成" : "任务异常结束";
+		const body = this.lastAssistantText.get(sessionId) ?? row?.title ?? "";
+		this.emitNotify({
+			sessionId,
+			category: ok ? "turn.completed" : "session.error",
+			title,
+			body,
+			notificationId: "n-" + (this.cursor + 1)
+		});
+	}
+	/**
+	* Mirror one notification-worthy event to offline devices. Fire-and-forget:
+	* push failures must never block or break the WS data plane.
+	*/
+	fanOutPush(notification) {
+		try {
+			this.pushOutlet?.fanOut(notification);
+		} catch {}
+	}
+	/** Remember the latest assistant text so notifications can quote it. */
+	captureAssistantText(sessionId, event) {
+		if (event.type !== "assistant/message") return;
+		const text = messageText(event.data).trim();
+		if (text.length > 0) this.lastAssistantText.set(sessionId, text.slice(-160));
+	}
+	/**
+	* Replay buffered pushes after the given cursor; false when the gap is
+	* unrecoverable. Frames go to `target` only — replaying into every sink
+	* duplicated the whole window onto devices that never asked for it.
+	*/
+	resumeFrom(cursor, target) {
+		const oldest = this.ring.length > 0 ? this.ring[0].seq : this.cursor + 1;
+		if (cursor + 1 < oldest) return false;
+		const receivers = target !== void 0 ? [target] : [...this.sinks];
+		for (const entry of this.ring) if (entry.seq > cursor) for (const sink of receivers) sink.replay([entry]);
+		for (const sink of receivers) sink.replayDone();
+		return true;
+	}
+	record(type, payload, except) {
+		if (this.disposed) return;
+		this.cursor += 1;
+		const entry = {
+			seq: this.cursor,
+			type,
+			payload
+		};
+		this.ring.push(entry);
+		if (this.ring.length > this.historyBufferMax) this.ring.splice(0, this.ring.length - this.historyBufferMax);
+		for (const sink of this.sinks) {
+			if (except && except(sink)) continue;
+			sink.push(type, payload, entry.seq);
 		}
 	}
 	/** Start consuming host + mux streams. Idempotent; aborts on dispose(). */
 	start() {
+		if (this.started || this.disposed) return;
+		this.started = true;
 		this.runHostStream();
 		this.runMuxStream();
 		this.refreshSummaries();
 	}
 	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
 		this.abort.abort();
 		this.sinks.clear();
+		this.sinkSessions.clear();
+		this.pushOutlet = void 0;
 	}
 	async runHostStream() {
 		try {
@@ -898,27 +1392,28 @@ var HostBridge = class {
 				if (!p.approvalId || !frame.rpcId) break;
 				const toolName = String(p.toolName ?? "tool");
 				const summary = String(p.reason ?? "");
+				const sessionId = String(p.sessionId ?? "");
 				this.approvals.set(p.approvalId, {
 					rpcId: frame.rpcId,
-					sessionId: String(p.sessionId ?? ""),
+					sessionId,
 					toolName,
 					reason: summary
 				});
 				this.record("s2c.pending.approval", {
 					requestId: p.approvalId,
-					sessionId: String(p.sessionId ?? ""),
+					sessionId,
 					toolName,
 					summary,
 					riskLevel: riskOf(toolName)
 				});
-				this.fanOutPush({
-					notificationId: "apr-" + p.approvalId,
+				this.emitNotify({
+					sessionId,
 					category: "approval.required",
-					sessionId: String(p.sessionId ?? ""),
 					title: "需要批准",
-					body: toolName + ": " + summary
+					body: toolName + ": " + summary,
+					notificationId: "apr-" + p.approvalId
 				});
-				this.bumpPendingFlags(String(p.sessionId ?? ""));
+				this.bumpPendingFlags(sessionId);
 				break;
 			}
 			case "approval/resolved": {
@@ -945,12 +1440,12 @@ var HostBridge = class {
 					sessionId,
 					questions: p?.questions ?? []
 				});
-				this.fanOutPush({
-					notificationId: requestId,
-					category: "question.asked",
+				this.emitNotify({
 					sessionId,
+					category: "question.asked",
 					title: "有问题需要回答",
-					body: firstQuestionText(p?.questions)
+					body: firstQuestionText(p?.questions),
+					notificationId: requestId
 				});
 				this.bumpPendingFlags(sessionId);
 				break;
@@ -1005,7 +1500,7 @@ var HostBridge = class {
 			this.subagentSessionIds = subagentIds;
 			this.summaries = next;
 			const removedIds = [...previousIds].filter((id) => !next.has(id));
-			for (const id of removedIds) this.lastAssistantText.delete(id);
+			for (const id of this.lastAssistantText.keys()) if (!next.has(id)) this.lastAssistantText.delete(id);
 			this.record("s2c.sessions.delta", {
 				upserted: [...next.values()],
 				removedIds
@@ -1507,9 +2002,10 @@ var HostBridge = class {
 				row.lastActivityTs = Date.now();
 				this.pushSummary(row);
 			}
+			this.userReceiptSeq += 1;
 			return {
 				ok: true,
-				value: Date.now()
+				value: this.userReceiptSeq
 			};
 		} catch (error) {
 			return {
@@ -1563,404 +2059,154 @@ var HostBridge = class {
 	async respondQuestion(requestId, answers) {
 		const pending = this.questions.get(requestId);
 		if (!pending) return {
-			ok: false,
-			reason: "not-pending"
-		};
-		this.questions.delete(requestId);
-		try {
-			const receipt = await this.apiProxy.respond({
-				type: "client-response",
-				rpcId: pending.rpcId,
-				result: {
-					ok: true,
-					value: {
-						sessionId: pending.sessionId,
-						answer: { answers: normalizeAnswerItems(answers, pending.questions) }
-					}
-				}
-			});
-			if (!Boolean(receipt?.accepted)) {
-				const failure = receiptFailureReason(receipt);
-				if (failure !== "not-pending" && !this.questions.has(requestId)) this.questions.set(requestId, pending);
-				return {
-					ok: false,
-					reason: failure
-				};
-			}
-			this.bumpPendingFlags(pending.sessionId);
-			return { ok: true };
-		} catch {
-			if (!this.questions.has(requestId)) this.questions.set(requestId, pending);
-			return {
-				ok: false,
-				reason: "transport"
-			};
-		}
-	}
-};
-/**
-* The host validates question answers strictly (core dsh-user-questions via
-* apiProxy): a present-but-empty `custom` fails `matchesQuestions`, and a
-* single-select question rejects `custom` combined with a selection. Clients
-* may send lenient shapes (the phone historically always attached
-* `"custom": ""`, which made EVERY option-only answer fail), so normalize to
-* exactly what the host accepts before forwarding.
-*/
-function normalizeAnswerItems(raw, questions) {
-	if (!Array.isArray(raw)) return [];
-	const askedById = /* @__PURE__ */ new Map();
-	if (Array.isArray(questions)) {
-		for (const q of questions) if (typeof q === "object" && q !== null && typeof q.id === "string") askedById.set(q.id, q);
-	}
-	const items = [];
-	for (const entry of raw) {
-		if (typeof entry !== "object" || entry === null) continue;
-		const r = entry;
-		if (typeof r.id !== "string") continue;
-		const selected = [...new Set(Array.isArray(r.selected) ? r.selected.filter((s) => typeof s === "string") : [])];
-		const customText = typeof r.custom === "string" ? r.custom : "";
-		let custom;
-		if (customText.trim().length > 0) custom = customText;
-		if (custom !== void 0 && selected.length > 0 && askedById.get(r.id)?.multiSelect !== true) custom = void 0;
-		items.push({
-			id: r.id,
-			selected,
-			...custom !== void 0 ? { custom } : {}
-		});
-	}
-	return items;
-}
-/** Map an apiProxy respond receipt onto the failure vocabulary. */
-function receiptFailureReason(receipt) {
-	return receipt?.reason === "not-pending" ? "not-pending" : "bad-response";
-}
-function clampTail(n) {
-	if (!Number.isFinite(n)) return 100;
-	return Math.max(10, Math.min(500, Math.floor(n)));
-}
-function localTimeZone() {
-	try {
-		return new Intl.DateTimeFormat().resolvedOptions().timeZone || void 0;
-	} catch {
-		return;
-	}
-}
-function riskOf(toolName) {
-	if (/bash|pwsh|terminal/.test(toolName)) return "write";
-	if (/edit|write|str_replace|create/.test(toolName)) return "write";
-	if (/delete|remove|kill/.test(toolName)) return "destructive";
-	return "read";
-}
-/** First question's text for the push banner; the questions payload shape is
-* host-version dependent, so extract defensively. */
-function firstQuestionText(questions) {
-	if (!Array.isArray(questions) || questions.length === 0) return "Agent 等待你的输入";
-	const first = questions[0];
-	return String(first?.question ?? "").trim() || "Agent 等待你的输入";
-}
-const TODO_STATUSES = /* @__PURE__ */ new Set([
-	"pending",
-	"in_progress",
-	"completed"
-]);
-/** Validate a host todo projection once; progress counts and the full
-* checklist both derive from this sanitized list so they never disagree. */
-function sanitizeTodoItems(items) {
-	if (!items) return [];
-	return items.map((i) => ({
-		content: String(i.content ?? "").trim(),
-		status: String(i.status ?? "")
-	})).filter((i) => i.content.length > 0 && TODO_STATUSES.has(i.status)).slice(0, 100).map((i) => ({
-		content: i.content,
-		status: i.status
-	}));
-}
-function toSummary(row, approvals, questions, workspace) {
-	const values = row.projections?.values ?? {};
-	const todos = Array.isArray(values.todos) ? values.todos : null;
-	let pendingApproval = false;
-	for (const pending of approvals.values()) if (pending.sessionId === row.sessionId) pendingApproval = true;
-	let pendingQuestion = false;
-	for (const pending of questions.values()) if (pending.sessionId === row.sessionId) pendingQuestion = true;
-	const cwd = typeof row.cwd === "string" ? row.cwd : "";
-	const label = workspace?.title ?? (cwd ? cwd.split("/").filter(Boolean).pop() : void 0);
-	const todoItems = sanitizeTodoItems(todos);
-	return {
-		id: row.sessionId,
-		title: typeof values.title === "string" ? values.title : "",
-		status: row.running ? "running" : row.blank ? "unknown" : "idle",
-		lastActivityTs: Number(row.updatedAt ?? Date.now()),
-		todos: todoItems.length > 0 ? {
-			done: todoItems.filter((i) => i.status === "completed").length,
-			total: todoItems.length
-		} : null,
-		todoItems: todoItems.length > 0 ? todoItems : null,
-		pendingApproval,
-		pendingQuestion,
-		workspaceLabel: label ?? null,
-		workspaceId: workspace?.workspaceId ?? null,
-		workspacePath: workspace?.path ?? (cwd || null)
-	};
-}
-function projectWorkspace(workspace) {
-	return {
-		id: String(workspace.workspaceId),
-		title: String(workspace.title),
-		path: String(workspace.path),
-		sessionIds: (workspace.sessionIds ?? []).map(String)
-	};
-}
-/** Project one raw session event into a protocol push, when it maps to one. */
-function projectEvent(sessionId, event) {
-	switch (event.type) {
-		case "turn/start": return {
-			kind: "turn.start",
-			data: {}
-		};
-		case "turn/end": return {
-			kind: "turn.end",
-			data: { ok: event.data?.reason?.kind === "completed" }
-		};
-		case "user/message": return {
-			kind: "message.final",
-			data: {
-				seq: event.seq,
-				role: userRoleOf(event.data),
-				text: messageText(event.data),
-				...attachmentProjection(event.data),
-				...contextProjectionOf(event.data),
-				ts: tsOf(event)
-			}
-		};
-		case "assistant/chunk":
-			if (chunkTypeOf(event.data) === "reasoning-delta") return {
-				kind: "thinking.delta",
-				data: {
-					text: chunkText(event.data),
-					ts: tsOf(event)
-				}
-			};
-			return {
-				kind: "message.delta",
-				data: {
-					text: chunkText(event.data),
-					ts: tsOf(event)
-				}
-			};
-		case "assistant/message": {
-			const text = messageText(event.data);
-			const thinking = messageThinking(event.data);
-			if (!text.trim() && !thinking.trim()) return null;
-			return {
-				kind: "message.final",
-				data: {
-					seq: event.seq,
-					role: "assistant",
-					text,
-					...thinking ? { thinking } : {},
-					ts: tsOf(event)
-				}
-			};
-		}
-		case "tool/call": {
-			const data = event.data;
-			return {
-				kind: "tool.start",
-				data: {
-					seq: event.seq,
-					role: "tool",
-					tool: {
-						name: String(data?.name ?? "tool"),
-						state: "running",
-						summary: summarizeArgs(data?.arguments),
-						...data?.callId ? { callId: String(data.callId) } : {}
-					},
-					ts: tsOf(event)
+			ok: false,
+			reason: "not-pending"
+		};
+		this.questions.delete(requestId);
+		try {
+			const receipt = await this.apiProxy.respond({
+				type: "client-response",
+				rpcId: pending.rpcId,
+				result: {
+					ok: true,
+					value: {
+						sessionId: pending.sessionId,
+						answer: { answers: normalizeAnswerItems(answers, pending.questions) }
+					}
 				}
-			};
-		}
-		case "tool/result": {
-			const data = event.data;
+			});
+			if (!Boolean(receipt?.accepted)) {
+				const failure = receiptFailureReason(receipt);
+				if (failure !== "not-pending" && !this.questions.has(requestId)) this.questions.set(requestId, pending);
+				return {
+					ok: false,
+					reason: failure
+				};
+			}
+			this.bumpPendingFlags(pending.sessionId);
+			return { ok: true };
+		} catch {
+			if (!this.questions.has(requestId)) this.questions.set(requestId, pending);
 			return {
-				kind: "tool.end",
-				data: {
-					seq: event.seq,
-					role: "tool",
-					ok: !event.data || data?.error === void 0,
-					...data?.callId ? { callId: String(data.callId) } : {},
-					ts: tsOf(event)
-				}
+				ok: false,
+				reason: "transport"
 			};
 		}
-		default: return null;
 	}
-}
-function tsOf(event) {
-	return typeof event.time === "number" ? event.time : Date.now();
-}
-/** Read the durable message source off one user/message payload. Handles both
-* bare-message payloads and older `{message: {...}}` wrappers; undefined when
-* the shape carries no readable source (legacy hosts). */
-function userMessageSource(data) {
-	if (!data || typeof data !== "object") return void 0;
-	const obj = data;
-	if (obj.source && typeof obj.source === "object") return obj.source;
-	if (obj.message && typeof obj.message === "object" && obj.message.source && typeof obj.message.source === "object") return obj.message.source;
-}
-/** Wire role for one user/message payload. A payload without any readable
-* source degrades to 'user' so history written by older hosts stays visible;
-* a present source follows the host's own trajectory rule — anything whose
-* `kind` is not 'user' is injected context and projects as 'system'. */
-function userRoleOf(data) {
-	const source = userMessageSource(data);
-	if (!source) return "user";
-	return source.kind === "user" ? "user" : "system";
-}
-/** Producer name of one injected-context source, mirroring how the DSH client
-* runtime derives its trajectory label: plugin name, skill name, instruction
-* paths, session-reference labels, or the raw kind as fallback. */
-function contextLabelOf(source) {
-	const kind = typeof source.kind === "string" ? source.kind : "";
-	const joined = (member) => {
-		const list = source[member];
-		if (!Array.isArray(list)) return void 0;
-		const names = list.flatMap((entry) => {
-			if (!entry || typeof entry !== "object") return [];
-			const record = entry;
-			return [typeof record.label === "string" ? record.label : typeof record.path === "string" ? record.path : ""];
-		}).filter((name) => name.length > 0);
-		return names.length > 0 ? names.join(", ") : void 0;
-	};
-	switch (kind) {
-		case "session-reference": return joined("references") ?? (kind || void 0);
-		case "agent-instructions": return joined("changes") ?? (kind || void 0);
-		case "plugin": return typeof source.plugin === "string" && source.plugin.length > 0 ? source.plugin : kind || void 0;
-		case "skill-invocation": return typeof source.name === "string" && source.name.length > 0 ? source.name : kind || void 0;
-		default: return kind || void 0;
+};
+/**
+* The host validates question answers strictly (core dsh-user-questions via
+* apiProxy): a present-but-empty `custom` fails `matchesQuestions`, and a
+* single-select question rejects `custom` combined with a selection. Clients
+* may send lenient shapes (the phone historically always attached
+* `"custom": ""`, which made EVERY option-only answer fail), so normalize to
+* exactly what the host accepts before forwarding.
+*/
+function normalizeAnswerItems(raw, questions) {
+	if (!Array.isArray(raw)) return [];
+	const askedById = /* @__PURE__ */ new Map();
+	if (Array.isArray(questions)) {
+		for (const q of questions) if (typeof q === "object" && q !== null && typeof q.id === "string") askedById.set(q.id, q);
 	}
+	const items = [];
+	for (const entry of raw) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const r = entry;
+		if (typeof r.id !== "string") continue;
+		const selected = [...new Set(Array.isArray(r.selected) ? r.selected.filter((s) => typeof s === "string") : [])];
+		const customText = typeof r.custom === "string" ? r.custom : "";
+		let custom;
+		if (customText.trim().length > 0) custom = customText;
+		if (custom !== void 0 && selected.length > 0 && askedById.get(r.id)?.multiSelect !== true) custom = void 0;
+		items.push({
+			id: r.id,
+			selected,
+			...custom !== void 0 ? { custom } : {}
+		});
+	}
+	return items;
 }
-/** Semantic ContextForm declared by the producer ('snapshot', 'notice', …);
-* anything unrecognized stays undefined so clients render it opaque. */
-function contextFormOf(source) {
-	if (typeof source.form !== "string" || source.form.length === 0) return void 0;
-	return [
-		"instructions",
-		"catalog",
-		"snapshot",
-		"notice",
-		"relay",
-		"recall"
-	].includes(source.form) ? source.form : void 0;
-}
-/** Optional `context` metadata for one system row; {} on user rows. */
-function contextProjectionOf(data) {
-	if (userRoleOf(data) !== "system") return {};
-	const source = userMessageSource(data);
-	if (!source) return {};
-	const label = contextLabelOf(source);
-	const form = contextFormOf(source);
-	if (!label && !form) return {};
-	return { context: {
-		...label ? { label } : {},
-		...form ? { form } : {}
-	} };
-}
-/** Extract plain text from user/assistant message payloads across shapes. */
-function messageText(data) {
-	if (typeof data === "string") return data;
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (typeof obj.text === "string") return obj.text;
-	if (obj.message && typeof obj.message === "object") return messageText(obj.message);
-	return contentText(obj.content);
-}
-function contentText(content) {
-	if (typeof content === "string") return content;
-	if (Array.isArray(content)) return content.map((part) => {
-		if (typeof part === "string") return part;
-		if (part && typeof part === "object") {
-			const piece = part;
-			if (piece.type === "text" && typeof piece.text === "string") return piece.text;
-		}
-		return "";
-	}).join("");
-	return "";
-}
-function messageAttachments(data) {
-	if (!data || typeof data !== "object") return [];
-	const obj = data;
-	if (obj.message && typeof obj.message === "object") return messageAttachments(obj.message);
-	if (!Array.isArray(obj.content)) return [];
-	return obj.content.flatMap((part) => {
-		if (!part || typeof part !== "object") return [];
-		const block = part;
-		if (block.type !== "image" || !block.attachment) return [];
-		const attachmentId = typeof block.attachment.attachmentId === "string" && block.attachment.attachmentId.length > 0 ? block.attachment.attachmentId : void 0;
-		const width = typeof block.attachment.width === "number" && Number.isFinite(block.attachment.width) ? block.attachment.width : void 0;
-		const height = typeof block.attachment.height === "number" && Number.isFinite(block.attachment.height) ? block.attachment.height : void 0;
-		return [{
-			kind: "image",
-			...typeof block.attachment.name === "string" ? { name: block.attachment.name } : {},
-			...typeof block.attachment.mediaType === "string" ? { mediaType: block.attachment.mediaType } : {},
-			...attachmentId ? { attachmentId } : {},
-			...width !== void 0 ? { width } : {},
-			...height !== void 0 ? { height } : {}
-		}];
-	});
+/** Map an apiProxy respond receipt onto the failure vocabulary. */
+function receiptFailureReason(receipt) {
+	return receipt?.reason === "not-pending" ? "not-pending" : "bad-response";
 }
-function attachmentProjection(data) {
-	const attachments = messageAttachments(data);
-	return attachments.length > 0 ? { attachments } : {};
+function clampTail(n) {
+	if (!Number.isFinite(n)) return 100;
+	return Math.max(10, Math.min(500, Math.floor(n)));
 }
-/** Extract reasoning ("thinking") text from assistant message payloads. */
-function messageThinking(data) {
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (obj.message && typeof obj.message === "object") return messageThinking(obj.message);
-	return reasoningContent(obj.content);
+function localTimeZone() {
+	try {
+		return new Intl.DateTimeFormat().resolvedOptions().timeZone || void 0;
+	} catch {
+		return;
+	}
 }
-function reasoningContent(content) {
-	if (!Array.isArray(content)) return "";
-	return content.map((part) => {
-		if (part && typeof part === "object") {
-			const piece = part;
-			if (piece.type === "reasoning" && typeof piece.text === "string") return piece.text;
-		}
-		return "";
-	}).join("");
+function riskOf(toolName) {
+	if (/bash|pwsh|terminal/.test(toolName)) return "write";
+	if (/edit|write|str_replace|create/.test(toolName)) return "write";
+	if (/delete|remove|kill/.test(toolName)) return "destructive";
+	return "read";
 }
-/** Stream chunk type of an assistant/chunk payload ('' when unwrapped). */
-function chunkTypeOf(data) {
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (obj.chunk && typeof obj.chunk === "object") return String(obj.chunk.type ?? "");
-	return "text-delta";
+/** First question's text for the push banner; the questions payload shape is
+* host-version dependent, so extract defensively. */
+function firstQuestionText(questions) {
+	if (!Array.isArray(questions) || questions.length === 0) return "Agent 等待你的输入";
+	const first = questions[0];
+	return String(first?.question ?? "").trim() || "Agent 等待你的输入";
 }
-function chunkText(data) {
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (obj.chunk && typeof obj.chunk === "object") {
-		const inner = obj.chunk;
-		if ((inner.type === "text-delta" || inner.type === "reasoning-delta") && typeof inner.text === "string") return inner.text;
-		return "";
-	}
-	const direct = data;
-	return typeof direct.text === "string" ? direct.text : "";
+const TODO_STATUSES = /* @__PURE__ */ new Set([
+	"pending",
+	"in_progress",
+	"completed"
+]);
+/** Validate a host todo projection once; progress counts and the full
+* checklist both derive from this sanitized list so they never disagree. */
+function sanitizeTodoItems(items) {
+	if (!items) return [];
+	return items.map((i) => ({
+		content: String(i.content ?? "").trim(),
+		status: String(i.status ?? "")
+	})).filter((i) => i.content.length > 0 && TODO_STATUSES.has(i.status)).slice(0, 100).map((i) => ({
+		content: i.content,
+		status: i.status
+	}));
 }
-function summarizeArgs(raw) {
-	if (typeof raw !== "string" || raw.length === 0) return "";
-	try {
-		const parsed = JSON.parse(raw);
-		const parts = [];
-		for (const [key, value] of Object.entries(parsed)) if (typeof value === "string") parts.push(key + "=" + truncate(value.replace(/\s+/g, " "), 60));
-		return truncate(parts.join(" "), 90);
-	} catch {
-		return truncate(raw, 90);
-	}
+function toSummary(row, approvals, questions, workspace) {
+	const values = row.projections?.values ?? {};
+	const todos = Array.isArray(values.todos) ? values.todos : null;
+	let pendingApproval = false;
+	for (const pending of approvals.values()) if (pending.sessionId === row.sessionId) pendingApproval = true;
+	let pendingQuestion = false;
+	for (const pending of questions.values()) if (pending.sessionId === row.sessionId) pendingQuestion = true;
+	const cwd = typeof row.cwd === "string" ? row.cwd : "";
+	const label = workspace?.title ?? (cwd ? cwd.split("/").filter(Boolean).pop() : void 0);
+	const todoItems = sanitizeTodoItems(todos);
+	return {
+		id: row.sessionId,
+		title: typeof values.title === "string" ? values.title : "",
+		status: row.running ? "running" : "idle",
+		lastActivityTs: Number(row.updatedAt ?? Date.now()),
+		todos: todoItems.length > 0 ? {
+			done: todoItems.filter((i) => i.status === "completed").length,
+			total: todoItems.length
+		} : null,
+		todoItems: todoItems.length > 0 ? todoItems : null,
+		pendingApproval,
+		pendingQuestion,
+		workspaceLabel: label ?? null,
+		workspaceId: workspace?.workspaceId ?? null,
+		workspacePath: workspace?.path ?? (cwd || null)
+	};
 }
-function truncate(text, max) {
-	return text.length <= max ? text : text.slice(0, max - 1) + "…";
+function projectWorkspace(workspace) {
+	return {
+		id: String(workspace.workspaceId),
+		title: String(workspace.title),
+		path: String(workspace.path),
+		sessionIds: (workspace.sessionIds ?? []).map(String)
+	};
 }
+/** Project one raw session event into a protocol push, when it maps to one. */
 function hostModelError(error) {
 	const message = error.message ?? error.code;
 	switch (error.code) {
@@ -2061,81 +2307,6 @@ function projectSessionModels(value) {
 	};
 }
 /** Project a history page (raw events) into MessageProjection rows. */
-function projectHistory(events) {
-	const messages = [];
-	const toolByCall = /* @__PURE__ */ new Map();
-	for (const entry of events) {
-		const event = entry.event;
-		const base = {
-			seq: event.seq,
-			ts: tsOf(event)
-		};
-		switch (event.type) {
-			case "user/message":
-				messages.push({
-					...base,
-					role: userRoleOf(event.data),
-					text: messageText(event.data),
-					...attachmentProjection(event.data),
-					...contextProjectionOf(event.data)
-				});
-				break;
-			case "assistant/message": {
-				const text = messageText(event.data);
-				const thinking = messageThinking(event.data);
-				if (!text.trim() && !thinking.trim()) break;
-				messages.push({
-					...base,
-					role: "assistant",
-					text,
-					...thinking ? { thinking } : {}
-				});
-				break;
-			}
-			case "tool/call": {
-				const data = event.data;
-				const row = {
-					...base,
-					role: "tool",
-					tool: {
-						name: String(data?.name ?? "tool"),
-						state: "running",
-						summary: summarizeArgs(data?.arguments)
-					}
-				};
-				messages.push(row);
-				if (data?.callId) toolByCall.set(String(data.callId), row);
-				break;
-			}
-			case "tool/result": {
-				const data = event.data;
-				const callId = data?.callId ? String(data.callId) : void 0;
-				const target = callId ? toolByCall.get(callId) : void 0;
-				const failed = data?.error !== void 0;
-				const summary = failed ? "失败" : summarizeResult(data?.message?.content);
-				if (target?.tool) target.tool = {
-					...target.tool,
-					state: failed ? "error" : "ok",
-					summary
-				};
-				else messages.push({
-					...base,
-					role: "tool",
-					tool: {
-						name: "result",
-						state: failed ? "error" : "ok",
-						summary
-					}
-				});
-				break;
-			}
-		}
-	}
-	return messages.sort((a, b) => a.seq - b.seq);
-}
-function summarizeResult(content) {
-	return truncate(contentText(content).replace(/\s+/g, " ").trim(), 90);
-}
 //#endregion
 //#region src/report-service.ts
 /**
@@ -2195,9 +2366,16 @@ function str(source, key, field) {
 	if (typeof value !== "string") reject(field);
 	return value;
 }
-function num(source, key, field) {
+/**
+* Non-negative integer: counters and timestamps (activeConnections,
+* historyBufferMax, updatedAt, lastSeenTs, protocolVersion, etc.). A bare
+* `typeof number` check accepts 1.5, -1, and 1e20 — all of which then
+* surface verbatim on the settings page and break any sort or arithmetic
+* the UI does.
+*/
+function int(source, key, field) {
 	const value = source[key];
-	if (typeof value !== "number" || !Number.isFinite(value)) reject(field);
+	if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) reject(field);
 	return value;
 }
 function bool(source, key, field) {
@@ -2218,15 +2396,15 @@ function parseDevice(value) {
 		if (environment !== "development" && environment !== "production") reject("device.apns.environment");
 		apns = {
 			environment,
-			updatedAt: num(a, "updatedAt", "device.apns.updatedAt")
+			updatedAt: int(a, "updatedAt", "device.apns.updatedAt")
 		};
 	}
 	return {
 		deviceId: str(s, "deviceId", "device.deviceId"),
 		deviceName: str(s, "deviceName", "device.deviceName"),
 		appVersion: str(s, "appVersion", "device.appVersion"),
-		firstSeenTs: num(s, "firstSeenTs", "device.firstSeenTs"),
-		lastSeenTs: num(s, "lastSeenTs", "device.lastSeenTs"),
+		firstSeenTs: int(s, "firstSeenTs", "device.firstSeenTs"),
+		lastSeenTs: int(s, "lastSeenTs", "device.lastSeenTs"),
 		...apns ? { apns } : {}
 	};
 }
@@ -2256,7 +2434,7 @@ function parseRemote(value) {
 		...typeof publicURL === "string" ? { publicURL } : {},
 		...typeof authURL === "string" ? { authURL } : {},
 		...typeof message === "string" ? { message } : {},
-		updatedAt: num(s, "updatedAt", "remote.updatedAt")
+		updatedAt: int(s, "updatedAt", "remote.updatedAt")
 	};
 }
 function parseRelayTestStep(value) {
@@ -2264,7 +2442,9 @@ function parseRelayTestStep(value) {
 	const id = str(st, "id", "step.id");
 	if (id !== "health" && id !== "enroll") reject("step.id");
 	const latencyMs = st.latencyMs;
-	if (latencyMs !== void 0 && typeof latencyMs !== "number") reject("step.latencyMs");
+	if (latencyMs !== void 0) {
+		if (typeof latencyMs !== "number" || !Number.isFinite(latencyMs) || !Number.isInteger(latencyMs) || latencyMs < 0) reject("step.latencyMs");
+	}
 	return {
 		id,
 		ok: bool(st, "ok", "step.ok"),
@@ -2307,7 +2487,7 @@ function parsePushTestResult(value) {
 			environment: str(r, "environment", "result.environment"),
 			outcome: str(r, "outcome", "result.outcome"),
 			...typeof reason === "string" && reason.length > 0 ? { reason } : {},
-			...typeof tokenFingerprint === "string" && /^[0-9a-f]{1,32}$/.test(tokenFingerprint) ? { tokenFingerprint } : {}
+			...typeof tokenFingerprint === "string" && /^[0-9a-f]{10}$/.test(tokenFingerprint) ? { tokenFingerprint } : {}
 		};
 	});
 	const message = s.message;
@@ -2326,7 +2506,7 @@ function parseReport(value) {
 	if (!Array.isArray(lanAddresses) || lanAddresses.some((value) => typeof value !== "string")) reject("lanAddresses");
 	const releaseUrl = s.releaseUrl;
 	return {
-		protocolVersion: num(s, "protocolVersion", "protocolVersion"),
+		protocolVersion: int(s, "protocolVersion", "protocolVersion"),
 		serverVersion: str(s, "serverVersion", "serverVersion"),
 		pluginVersion: str(s, "pluginVersion", "pluginVersion"),
 		...s.updateAvailable === true ? { updateAvailable: true } : {},
@@ -2334,8 +2514,8 @@ function parseReport(value) {
 		enabled: bool(s, "enabled", "enabled"),
 		tokenPath: str(s, "tokenPath", "tokenPath"),
 		tokenReady: bool(s, "tokenReady", "tokenReady"),
-		activeConnections: num(s, "activeConnections", "activeConnections"),
-		historyBufferMax: num(s, "historyBufferMax", "historyBufferMax"),
+		activeConnections: int(s, "activeConnections", "activeConnections"),
+		historyBufferMax: int(s, "historyBufferMax", "historyBufferMax"),
 		debug: bool(s, "debug", "debug"),
 		lanAddresses,
 		remote: parseRemote(s.remote),
@@ -2541,10 +2721,9 @@ async function runRelayProbe(options) {
 			});
 		}
 	}
-	const executed = steps.filter((step) => step.ok !== void 0);
 	return {
 		url: base,
-		overall: steps.length > 0 && steps.some((step) => step.id === "health" && step.ok) && executed.every((step) => step.ok) ? "ok" : "failed",
+		overall: steps.length > 0 && steps.some((step) => step.id === "health" && step.ok) && steps.every((step) => step.ok) ? "ok" : "failed",
 		tokenIssued,
 		steps
 	};
@@ -2566,6 +2745,10 @@ async function runRelayProbe(options) {
 * Privacy: logs carry outcomes and masked token prefixes only — never message
 * bodies or full tokens.
 */
+/** Classify Apple's reason without losing recoverable configuration errors. */
+function classifyApnsReason(reason) {
+	return reason === "Unregistered" || reason === "ExpiredToken" ? "invalid-token" : "failed";
+}
 const PROVIDER_TOKEN_TTL_MS = 3e6;
 const REQUEST_TIMEOUT_MS = 1e4;
 /** base64url without padding. */
@@ -2606,7 +2789,10 @@ function apnsPayload(notification) {
 }
 /** collapse-id accepts ≤64 bytes of ASCII; keep it stable per session+event. */
 function collapseIdFor(notification) {
-	return `${notification.category}:${notification.sessionId}`.replace(/[^a-zA-Z0-9.:-]/g, "").slice(0, 64);
+	const raw = `${notification.category}:${notification.sessionId}`;
+	const readable = raw.replace(/[^a-zA-Z0-9.:-]/g, "");
+	const digest = createHash("sha256").update(raw, "utf8").digest("hex").slice(0, 12);
+	return `${readable.slice(0, 51)}:${digest}`;
 }
 function authorityFor(environment) {
 	return environment === "production" ? "api.push.apple.com" : "api.sandbox.push.apple.com";
@@ -2721,7 +2907,8 @@ var ApnsClient = class {
 						reason = String(JSON.parse(responseBody).reason ?? "");
 					} catch {}
 					if (status !== 200 && !reason) reason = "HTTP " + String(status);
-					if (reason === "Unregistered" || reason === "BadDeviceToken") return settle("invalid-token", reason);
+					const outcome = classifyApnsReason(reason);
+					if (outcome === "invalid-token") return settle(outcome, reason);
 					if (this.debug) this.log(`apns rejected status=${status} reason=${reason}`);
 					settle("failed", reason);
 				});
@@ -2850,6 +3037,14 @@ const RESTART_DELAYS_MS = [
 	16e3,
 	3e4
 ];
+/**
+* Throttle for configuration-level failures (helper binary missing, state dir
+* unwritable). The environment will not self-heal between attempts, so the
+* previous "1s..30s exponential" backoff was a CPU/for-loop on a misconfigured
+* Host. 60s matches the APNs sender-failure throttle on the host plugin
+* (index.ts SENDER_FAILURE_RETRY_MS) and the relay enrollment throttle.
+*/
+const UNAVAILABLE_RETRY_MS = 6e4;
 const DEFAULT_REMOTE_HOSTNAME = "dsh-deeppilot";
 /** Preserve custom node names while migrating every pre-DeepPilot default. */
 function normalizeRemoteHostname(value) {
@@ -2882,6 +3077,15 @@ function parseHelperEvent(line) {
 		return null;
 	}
 }
+function isTailscaleAuthURL(value) {
+	if (!value) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && (url.hostname === "login.tailscale.com" || url.hostname.endsWith(".login.tailscale.com"));
+	} catch {
+		return false;
+	}
+}
 /** Translate Node's platform/architecture names to the GOOS/GOARCH directory
 *  names used by the committed helper matrix. */
 function bundledHelperPlatformDir(platform = process.platform, arch = process.arch) {
@@ -2953,6 +3157,7 @@ var RemoteSupervisor = class {
 				phase: "unavailable",
 				message
 			});
+			this.scheduleRestart(originURL, "unavailable");
 			return;
 		}
 		try {
@@ -2966,6 +3171,7 @@ var RemoteSupervisor = class {
 				phase: "unavailable",
 				message: `cannot create remote state dir: ${String(error)}`
 			});
+			this.scheduleRestart(originURL, "unavailable");
 			return;
 		}
 		if (this.stopping) return;
@@ -3035,7 +3241,7 @@ var RemoteSupervisor = class {
 				phase: "error",
 				message: detail || `helper exited (${signal ?? String(code)})`
 			});
-			this.scheduleRestart(originURL);
+			this.scheduleRestart(originURL, "crash");
 		});
 	}
 	async dispose() {
@@ -3069,20 +3275,24 @@ var RemoteSupervisor = class {
 	acceptLine(line) {
 		const event = parseHelperEvent(line);
 		if (event === null || event.phase === void 0) return;
+		if (event.phase === "login_required") {
+			if (this.statusValue.phase === "online" || !isTailscaleAuthURL(event.authURL)) return;
+		}
 		if (event.phase === "online") this.restartAttempt = 0;
 		this.setStatus({
 			...event,
 			phase: event.phase
 		});
 	}
-	scheduleRestart(originURL) {
+	scheduleRestart(originURL, kind = "crash") {
 		if (this.stopping || this.restartTimer !== void 0) return;
-		const delay = RESTART_DELAYS_MS[Math.min(this.restartAttempt, RESTART_DELAYS_MS.length - 1)];
-		this.restartAttempt += 1;
+		const delay = kind === "unavailable" ? UNAVAILABLE_RETRY_MS : RESTART_DELAYS_MS[Math.min(this.restartAttempt, RESTART_DELAYS_MS.length - 1)];
+		if (kind === "crash") this.restartAttempt += 1;
 		this.restartTimer = setTimeout(() => {
 			this.restartTimer = void 0;
 			this.start(originURL);
 		}, delay);
+		this.restartTimer.unref?.();
 	}
 	setStatus(next) {
 		const cleared = next.phase === "online" ? {
@@ -3324,23 +3534,7 @@ var UpdateChecker = class {
 	dispose() {}
 };
 //#endregion
-//#region src/index.ts
-/**
-* dsh-deeppilot — data bridge between the DSH host and DeepPilot
-* clients. Registers exactly one WebSocket upgrade route (/phone) plus an
-* optional health probe (/phone/health) on the existing web server. The web
-* UI is never touched.
-*
-* Data plane: an in-process HostBridge consumes apiProxy.events.mux()/host()
-* streams, mirrors session summaries, tracks pending approvals/questions,
-* and fans projected protocol-v1 pushes out to every connected device.
-*
-* Protocol: src/protocol.ts, v1. The private app repository carries the
-* matching normative document and Swift models.
-*/
-const name = "deeppilot";
-/** No eager service requirement: profiles without a web stack simply skip. */
-const inject = [];
+//#region src/config.ts
 /** Operator-run relay used by distributed builds; overridable via config. */
 const DEFAULT_RELAY_URL = "https://pilot.hailab.dev";
 const Config = z.object({
@@ -3351,11 +3545,15 @@ const Config = z.object({
 	debug: z.boolean().default(false),
 	remote: z.object({
 		enabled: z.boolean().default(false),
-		provider: z.string().default("tailscale-funnel"),
+		provider: z.union(["tailscale-funnel"]).default("tailscale-funnel"),
 		hostname: z.string().default(DEFAULT_REMOTE_HOSTNAME),
 		statePath: z.string().default(join(bridgeDataDir(), "tailscale")),
 		helperPath: z.string().default(""),
-		funnelPort: z.natural().default(443)
+		funnelPort: z.union([
+			443,
+			8443,
+			1e4
+		]).default(443)
 	}).default({
 		enabled: false,
 		provider: "tailscale-funnel",
@@ -3365,7 +3563,11 @@ const Config = z.object({
 		funnelPort: 443
 	}),
 	push: z.object({
-		provider: z.string().default("none"),
+		provider: z.union([
+			"none",
+			"apns",
+			"relay"
+		]).default("none"),
 		teamId: z.string().default(""),
 		keyId: z.string().default(""),
 		keyPath: z.string().default(join(bridgeDataDir(), "apns", "AuthKey.p8")),
@@ -3382,6 +3584,75 @@ const Config = z.object({
 		relayToken: ""
 	})
 });
+/**
+* Cordis hands the second argument in different shapes depending on host
+* composition: a reactive options getter, the resolved config value, or
+* nothing when the patch row omits `config`. Normalize all of them.
+*/
+function normalizeOptions(options) {
+	if (typeof options === "function") return options();
+	if (options && typeof options === "object") return options;
+	return Config(void 0) ?? {};
+}
+//#endregion
+//#region src/phone-http.ts
+function rejectUpgrade(socket, status, reason) {
+	const body = JSON.stringify({ error: reason });
+	const statusText = {
+		401: "Unauthorized",
+		429: "Too Many Requests",
+		500: "Internal Server Error",
+		503: "Service Unavailable"
+	};
+	const authenticate = status === 401 ? "WWW-Authenticate: Bearer realm=\"deeppilot\"\r\n" : "";
+	socket.end("HTTP/1.1 " + status + " " + (statusText[status] ?? "Error") + "\r\n" + authenticate + "Content-Type: application/json\r\nContent-Length: " + Buffer.byteLength(body) + "\r\nConnection: close\r\n\r\n" + body);
+}
+/** Authorization is preferred; the query form remains for older app builds. */
+function requestToken(req) {
+	const authorization = req.headers.authorization;
+	if (typeof authorization === "string") {
+		const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
+		if (match?.[1]) return match[1];
+	}
+	try {
+		return new URL(req.url ?? "/", "http://phone.local").searchParams.get("token");
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/push-policy.ts
+/** Prune only when the provider supplies an authoritative token-lifecycle verdict. */
+function shouldPrunePushToken(outcome, reason) {
+	return outcome === "invalid-token" && (reason === "Unregistered" || reason === "ExpiredToken");
+}
+/**
+* Zero-touch relay self-heal: HTTP 401 means the relay no longer honors the
+* cached credential. Only auto-enrolled cells with a still-current token may
+* re-derive it; an explicitly configured relay token remains user-owned
+* configuration and is never silently rewritten.
+*/
+function shouldReEnrollRelayToken(transport, outcome, reason, opts) {
+	return transport === "relay" && outcome === "failed" && reason === "HTTP 401" && opts.hasEnrollKey && opts.usedCellToken && opts.tokenStillCurrent;
+}
+//#endregion
+//#region src/index.ts
+/**
+* dsh-deeppilot — data bridge between the DSH host and DeepPilot
+* clients. Registers exactly one WebSocket upgrade route (/phone) plus an
+* optional health probe (/phone/health) on the existing web server. The web
+* UI is never touched.
+*
+* Data plane: an in-process HostBridge consumes apiProxy.events.mux()/host()
+* streams, mirrors session summaries, tracks pending approvals/questions,
+* and fans projected protocol-v1 pushes out to every connected device.
+*
+* Protocol: PROTOCOL.md is normative; src/protocol.ts and the private app's
+* Swift models mirror that v1 contract.
+*/
+const name = "deeppilot";
+/** No eager service requirement: profiles without a web stack simply skip. */
+const inject = [];
 const SERVER_VERSION = readOwnPackageVersion();
 const MAX_CLIENT_CONNECTIONS = 16;
 /**
@@ -3406,33 +3677,6 @@ function readOwnPackageVersion() {
 	if (typeof envVersion === "string" && envVersion.length > 0) return envVersion;
 	return "0.0.0+unknown";
 }
-function rejectUpgrade(socket, status, reason) {
-	const body = JSON.stringify({ error: reason });
-	socket.end("HTTP/1.1 " + status + " Forbidden\r\nContent-Type: application/json\r\nContent-Length: " + Buffer.byteLength(body) + "\r\nConnection: close\r\n\r\n" + body);
-}
-/** Authorization is preferred; the query form remains for older app builds. */
-function requestToken(req) {
-	const authorization = req.headers.authorization;
-	if (typeof authorization === "string") {
-		const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
-		if (match?.[1]) return match[1];
-	}
-	try {
-		return new URL(req.url ?? "/", "http://phone.local").searchParams.get("token");
-	} catch {
-		return null;
-	}
-}
-/**
-* Cordis hands the second argument in different shapes depending on host
-* composition: a reactive options getter, the resolved config value, or
-* nothing when the patch row omits `config`. Normalize all of them.
-*/
-function normalizeOptions(options) {
-	if (typeof options === "function") return options();
-	if (options && typeof options === "object") return options;
-	return Config(void 0) ?? {};
-}
 function apply(ctx, options) {
 	const cfg = normalizeOptions(options);
 	const log = (message) => {
@@ -3461,16 +3705,22 @@ function apply(ctx, options) {
 	const dataDir = bridgeDataDir();
 	const pushRelayPath = join(dataDir, "push-relay.json");
 	const enrollmentCell = {};
+	let enrollmentWriteTail = Promise.resolve();
 	function persistEnrollment() {
-		(async () => {
+		const snapshot = JSON.stringify({
+			version: 1,
+			...enrollmentCell
+		}, null, 2) + "\n";
+		enrollmentWriteTail = enrollmentWriteTail.then(async () => {
+			const tempPath = pushRelayPath + "." + randomBytes(6).toString("hex") + ".tmp";
 			try {
 				await mkdir(dataDir, { recursive: true });
-				await writeFile(pushRelayPath, JSON.stringify({
-					version: 1,
-					...enrollmentCell
-				}, null, 2) + "\n", { mode: 384 });
-			} catch {}
-		})();
+				await writeFile(tempPath, snapshot, { mode: 384 });
+				await rename(tempPath, pushRelayPath);
+			} catch {
+				await unlink(tempPath).catch(() => {});
+			}
+		});
 	}
 	/** Fired from BridgeConnection when an app presents its built-in key. */
 	const handlePushEnrollKey = async (enrollKey) => {
@@ -3483,7 +3733,7 @@ function apply(ctx, options) {
 			}
 		}
 		persistEnrollment();
-		const url = (currentConfig().push?.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+		const url = (currentConfig().push?.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 		await ensureRelayEnrolled(url);
 	};
 	const auth = {
@@ -3515,7 +3765,9 @@ function apply(ctx, options) {
 				if (raw.autoRelay === true) enrollmentCell.autoRelay = true;
 			} catch {}
 		} catch (error) {
-			log("auth material unavailable, bridge degraded: " + String(error));
+			const message = String(error);
+			if (message.includes("pairing token is malformed at")) console.warn("[deeppilot] " + message);
+			log("auth material unavailable, bridge degraded: " + message);
 			return {
 				token: null,
 				devices: null
@@ -3615,12 +3867,23 @@ function apply(ctx, options) {
 		};
 	};
 	const connections = /* @__PURE__ */ new Set();
+	const closeConnectionsForBridge = (bridge) => {
+		for (const connection of connections) {
+			if (!connection.isAttachedTo(bridge)) continue;
+			connection.closeForServerStop();
+			connections.delete(connection);
+		}
+	};
+	const closeAllConnections = () => {
+		for (const connection of connections) connection.closeForServerStop();
+		connections.clear();
+	};
 	const resolvePushConfig = (config) => {
 		const push = config.push ?? {};
 		const configured = push.provider ?? "none";
 		const effectiveProvider = configured === "none" && enrollmentCell.autoRelay === true ? "relay" : configured;
 		if (effectiveProvider === "relay") {
-			const url = (push.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+			const url = (push.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 			const token = (push.relayToken ?? "").trim() || enrollmentCell.token || "";
 			if (!/^https:\/\//i.test(url)) return {
 				ok: false,
@@ -3782,7 +4045,8 @@ function apply(ctx, options) {
 	*  - each device is delivered on ITS registered environment (the build
 	*    kind it self-reported), so sandbox and production devices coexist;
 	*  - the device's per-category switches suppress muted categories;
-	*  - Unregistered/BadDeviceToken outcomes prune the stored token.
+	*  - only APNs' terminal Unregistered/ExpiredToken verdicts prune storage;
+	*    BadDeviceToken may be an environment mismatch and stays diagnosable.
 	*/
 	const makePushOutlet = () => ({
 		isAvailable: () => {
@@ -3795,7 +4059,7 @@ function apply(ctx, options) {
 			(async () => {
 				let resolved = resolvePushConfig(currentConfig());
 				if (!resolved.ok && resolved.reason === "relay token not enrolled yet") {
-					const relayUrl = (currentConfig().push?.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+					const relayUrl = (currentConfig().push?.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 					await ensureRelayEnrolled(relayUrl);
 					resolved = resolvePushConfig(currentConfig());
 				}
@@ -3825,6 +4089,10 @@ function apply(ctx, options) {
 					log(`push(${transport}) ${notification.category}: no offline targets (connected=${connectedIds.size}, tokenized=${tokenized})`);
 					return;
 				}
+				const relayUrl = resolved.value.kind === "relay" ? resolved.value.url : void 0;
+				const relayTokenUsed = resolved.value.kind === "relay" ? resolved.value.token : void 0;
+				const usedCellToken = relayTokenUsed !== void 0 && relayTokenUsed === enrollmentCell.token;
+				const hasEnrollKey = Boolean(enrollmentCell.enrollKey);
 				for (const device of candidates) {
 					const registration = device.apns;
 					send({
@@ -3833,9 +4101,20 @@ function apply(ctx, options) {
 						notification
 					}).then(({ outcome, reason }) => {
 						log(`push(${transport}) ${notification.category} → "${device.deviceName}" [${registration.environment}] = ${outcome}${reason ? " (" + reason + ")" : ""}`);
-						if (outcome === "invalid-token") {
+						if (shouldPrunePushToken(outcome, reason)) {
 							devices.clearPushToken(device.deviceId);
 							log(`push: pruned stale token of "${device.deviceName}" (${reason ?? "unknown"}) — app re-registers on next launch`);
+							return;
+						}
+						if (relayUrl !== void 0 && shouldReEnrollRelayToken(transport, outcome, reason, {
+							usedCellToken,
+							hasEnrollKey,
+							tokenStillCurrent: enrollmentCell.token === relayTokenUsed
+						})) {
+							enrollmentCell.token = void 0;
+							persistEnrollment();
+							log("push relay credential rejected (HTTP 401); re-enrolling");
+							ensureRelayEnrolled(relayUrl);
 						}
 					}).catch(() => {});
 				}
@@ -3910,7 +4189,7 @@ function apply(ctx, options) {
 				message: `当前推送模式不是中继（provider=${configured}）。启用方式二选一：① 零配置——在 ios/project.yml 填写 DSPushEnrollKey（与服务器 RELAY_ENROLL_KEY 一致）并重新安装 App，打开 App 即自动启用；② 手动——将 push.provider 设为 relay 并填入 relayToken`
 			}]
 		};
-		const url = (push.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+		const url = (push.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 		if (!/^https:\/\//i.test(url)) return {
 			url,
 			overall: "failed",
@@ -3940,6 +4219,7 @@ function apply(ctx, options) {
 		return await runPushSelfTest();
 	});
 	const state = {};
+	let pendingUpgrades = 0;
 	const handleUpgrade = (req, socket, head) => {
 		(async () => {
 			try {
@@ -3947,44 +4227,53 @@ function apply(ctx, options) {
 					rejectUpgrade(socket, 503, "bridge disabled");
 					return;
 				}
-				if (connections.size >= MAX_CLIENT_CONNECTIONS) {
+				if (connections.size + pendingUpgrades >= MAX_CLIENT_CONNECTIONS) {
 					rejectUpgrade(socket, 429, "too many connections");
 					return;
 				}
-				const { devices } = await ready;
-				const token = auth.token;
-				if (!token || !devices) {
-					rejectUpgrade(socket, 503, "bridge degraded");
-					return;
-				}
-				const presentedToken = requestToken(req);
-				if (presentedToken !== null && !tokenMatches(presentedToken, token)) {
-					rejectUpgrade(socket, 401, "invalid token");
-					return;
-				}
-				const bridge = state.bridge;
-				if (!bridge) {
-					rejectUpgrade(socket, 503, "bridge not ready");
-					return;
-				}
-				if (auth.token !== token) {
-					rejectUpgrade(socket, 401, "invalid token");
-					return;
-				}
-				wss.handleUpgrade(req, socket, head, (ws) => {
-					const connection = new BridgeConnection(ws, {
-						bridge,
-						devices,
-						serverVersion: SERVER_VERSION,
-						expectedToken: token,
-						transportAuthenticated: presentedToken !== null,
-						log,
-						debug: currentConfig().debug === true,
-						onClosed: (closed) => connections.delete(closed),
-						onPushEnrollKey: handlePushEnrollKey
+				pendingUpgrades += 1;
+				try {
+					const { devices } = await ready;
+					const token = auth.token;
+					if (!token || !devices) {
+						rejectUpgrade(socket, 503, "bridge degraded");
+						return;
+					}
+					const presentedToken = requestToken(req);
+					if (presentedToken !== null && !tokenMatches(presentedToken, token)) {
+						rejectUpgrade(socket, 401, "invalid token");
+						return;
+					}
+					const bridge = state.bridge;
+					if (!bridge) {
+						rejectUpgrade(socket, 503, "bridge not ready");
+						return;
+					}
+					if (auth.token !== token) {
+						rejectUpgrade(socket, 401, "invalid token");
+						return;
+					}
+					wss.handleUpgrade(req, socket, head, (ws) => {
+						if (auth.token !== token || state.bridge !== bridge) {
+							ws.close(1012, "bridge changed");
+							return;
+						}
+						const connection = new BridgeConnection(ws, {
+							bridge,
+							devices,
+							serverVersion: SERVER_VERSION,
+							expectedToken: token,
+							transportAuthenticated: presentedToken !== null,
+							log,
+							debug: currentConfig().debug === true,
+							onClosed: (closed) => connections.delete(closed),
+							onPushEnrollKey: handlePushEnrollKey
+						});
+						connections.add(connection);
 					});
-					connections.add(connection);
-				});
+				} finally {
+					pendingUpgrades -= 1;
+				}
 			} catch (error) {
 				log("upgrade failed: " + String(error));
 				rejectUpgrade(socket, 500, "internal error");
@@ -4038,7 +4327,11 @@ function apply(ctx, options) {
 		state.bridge = bridge;
 		bridge.start();
 		log("data plane active (mux + host streams)");
-		apiCtx.effect(() => () => bridge.dispose(), "deeppilot: host streams");
+		apiCtx.effect(() => () => {
+			closeConnectionsForBridge(bridge);
+			if (state.bridge === bridge) state.bridge = void 0;
+			bridge.dispose();
+		}, "deeppilot: host streams");
 	});
 	ctx.inject(["webServer"], (sub) => {
 		const webCtx = sub;
@@ -4060,7 +4353,7 @@ function apply(ctx, options) {
 			const now = Date.now();
 			for (const connection of connections) if (connection.isStale(now, 6e4)) {
 				log("dropping stale connection");
-				connection.terminate();
+				connection.closeIdle();
 				connections.delete(connection);
 			}
 		}, 3e4);
@@ -4146,8 +4439,23 @@ function apply(ctx, options) {
 		if (enabledNow()) log("/phone WebSocket registered");
 		else log("bridge disabled; /phone refuses connections until re-enabled and restarted");
 	});
+	ctx.effect(() => async () => {
+		closeAllConnections();
+		const bridge = state.bridge;
+		state.bridge = void 0;
+		bridge?.dispose();
+		const sender = cachedSender;
+		cachedSender = void 0;
+		updateChecker.dispose();
+		const wssClosed = new Promise((resolve) => wss.close(() => resolve()));
+		await Promise.allSettled([
+			enrollmentWriteTail,
+			sender?.dispose?.() ?? Promise.resolve(),
+			wssClosed
+		]);
+	}, "deeppilot: process resources");
 }
 //#endregion
-export { Config, HostBridge, apply, inject, name, requestToken };
+export { Config, HostBridge, apply, inject, name, requestToken, shouldPrunePushToken, shouldReEnrollRelayToken };
 
 //# sourceMappingURL=index.js.map