dsh-deeppilot 0.3.0 → 0.5.0

package/lib/index.js

@@ -1,9 +1,8 @@
 import { createRequire } from "node:module";
 import { createServer } from "node:http";
-import { createPrivateKey, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
-import { access, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, sign, timingSafeEqual, verify } from "node:crypto";
+import { access, chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
-import z from "@deepseek-ai/schemastery";
 import { WebSocketServer } from "ws";
 import { homedir, networkInterfaces } from "node:os";
 import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
@@ -13,6 +12,129 @@ import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { request } from "node:https";
+import z from "@deepseek-ai/schemastery";
+import { isIP } from "node:net";
+//#region src/device-auth.ts
+const PAIRING_CODE_TTL_MS = 3e5;
+const AUTH_CHALLENGE_TTL_MS = 3e4;
+const DEVICE_SCOPES = [
+	"sessions.read",
+	"prompt.send",
+	"sessions.manage",
+	"interactions.respond",
+	"notifications.register"
+];
+const DEFAULT_DEVICE_SCOPES = DEVICE_SCOPES;
+async function loadOrCreateHostAudience(path) {
+	try {
+		const existing = (await readFile(path, "utf8")).trim();
+		if (/^deeppilot:[A-Za-z0-9_-]{22}$/.test(existing)) return existing;
+		throw new Error(`host audience is malformed at ${path}`);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const audience = "deeppilot:" + randomBytes(16).toString("base64url");
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, audience + "\n", { mode: 384 });
+	return audience;
+}
+function b64urlText(value) {
+	return Buffer.from(value, "utf8").toString("base64url");
+}
+/**
+* Cross-language signature input. Text fields are base64url encoded before
+* joining so names cannot create ambiguous separators. Decimal timestamps
+* and cursor values are finite integers, or `-` when the cursor is absent.
+*/
+function canonicalAuthChallenge(fields) {
+	const cursor = fields.resumeCursor === void 0 ? "-" : String(fields.resumeCursor);
+	return Buffer.from([
+		"deeppilot-auth-v2",
+		`device-id:${b64urlText(fields.deviceId)}`,
+		`nonce:${fields.nonce}`,
+		`audience:${b64urlText(fields.audience)}`,
+		`issued-at:${fields.issuedAt}`,
+		`expires-at:${fields.expiresAt}`,
+		`device-name:${b64urlText(fields.deviceName)}`,
+		`app-version:${b64urlText(fields.appVersion)}`,
+		`resume-cursor:${cursor}`
+	].join("\n"), "utf8");
+}
+/** Accept only an uncompressed ANSI X9.63 P-256 public key (65 bytes). */
+function parseP256PublicKey(encoded) {
+	const raw = Buffer.from(encoded, "base64url");
+	if (raw.length !== 65 || raw[0] !== 4) throw new TypeError("publicKey must be an uncompressed P-256 X9.63 key");
+	const spkiPrefix = Buffer.from("3059301306072a8648ce3d020106082a8648ce3d030107034200", "hex");
+	const key = createPublicKey({
+		key: Buffer.concat([spkiPrefix, raw]),
+		format: "der",
+		type: "spki"
+	});
+	if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") throw new TypeError("publicKey must use P-256");
+	return {
+		key,
+		raw
+	};
+}
+function deviceIdForPublicKey(publicKey) {
+	const { raw } = parseP256PublicKey(publicKey);
+	return createHash("sha256").update(raw).digest("base64url");
+}
+function fingerprintForPublicKey(publicKey) {
+	const { raw } = parseP256PublicKey(publicKey);
+	return createHash("sha256").update(raw).digest("hex");
+}
+function verifyAuthProof(publicKey, fields, signature) {
+	try {
+		const { key } = parseP256PublicKey(publicKey);
+		const der = Buffer.from(signature, "base64url");
+		if (der.length < 64 || der.length > 80) return false;
+		return verify("sha256", canonicalAuthChallenge(fields), key, der);
+	} catch {
+		return false;
+	}
+}
+function normalizeDeviceScopes(value) {
+	if (!Array.isArray(value)) return [...DEFAULT_DEVICE_SCOPES];
+	const allowed = new Set(DEVICE_SCOPES);
+	return [...new Set(value.filter((scope) => typeof scope === "string" && allowed.has(scope)))];
+}
+/** One active, single-use pairing grant per plugin runtime. */
+var PairingCodeManager = class {
+	active = null;
+	issue(now = Date.now()) {
+		const grant = {
+			code: randomBytes(24).toString("base64url"),
+			expiresAt: now + PAIRING_CODE_TTL_MS
+		};
+		this.active = grant;
+		return { ...grant };
+	}
+	consume(presented, now = Date.now()) {
+		const active = this.active;
+		if (active === null || now > active.expiresAt) {
+			this.active = null;
+			return false;
+		}
+		const expected = Buffer.from(active.code);
+		const actual = Buffer.from(presented);
+		const matches = expected.length === actual.length && timingSafeEqual(expected, actual);
+		if (matches) this.active = null;
+		return matches;
+	}
+	invalidate() {
+		this.active = null;
+	}
+};
+function createAuthChallenge(audience, now = Date.now()) {
+	return {
+		nonce: randomBytes(24).toString("base64url"),
+		audience,
+		issuedAt: now,
+		expiresAt: now + AUTH_CHALLENGE_TTL_MS
+	};
+}
+//#endregion
 //#region src/token.ts
 /** Expand a leading ~ using the process home directory. */
 function expandHome(p) {
@@ -29,6 +151,16 @@ function dshDataRoot() {
 function bridgeDataDir() {
 	return resolve(dshDataRoot(), "deeppilot");
 }
+/** Create or repair the canonical secret-bearing directory as owner-only. */
+async function ensurePrivateBridgeDataDir() {
+	const target = bridgeDataDir();
+	await mkdir(target, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(target, 448);
+	return target;
+}
 /**
 * Move the pre-DeepPilot data directory as one atomic directory rename.
 * Existing canonical data always wins; secrets are never merged or replaced.
@@ -50,46 +182,6 @@ async function migrateLegacyBridgeDataDir() {
 		throw error;
 	}
 }
-/**
-* Load the pairing token from disk or generate and persist a fresh one.
-* The file is written 0600; the token never appears in logs.
-*/
-async function loadOrCreateToken(tokenPath) {
-	const full = expandHome(tokenPath);
-	try {
-		const existing = (await readFile(full, "utf8")).trim();
-		if (existing.length >= 32) return existing;
-	} catch {}
-	const token = randomBytes(32).toString("base64url");
-	await mkdir(dirname(full), { recursive: true });
-	await writeFile(full, token + "\n", { mode: 384 });
-	return token;
-}
-/**
-* Generate a fresh pairing token and replace the stored one, invalidating
-* every copy of the old secret. The write goes to a same-directory temp file
-* renamed over the target so a crash can never leave a truncated token file.
-*/
-async function writeNewToken(tokenPath) {
-	const full = expandHome(tokenPath);
-	const token = randomBytes(32).toString("base64url");
-	await mkdir(dirname(full), { recursive: true });
-	const temp = `${full}.${randomBytes(6).toString("hex")}.tmp`;
-	await writeFile(temp, token + "\n", { mode: 384 });
-	await rename(temp, full);
-	return token;
-}
-/** Constant-time token comparison; both sides are high-entropy secrets. */
-function tokenMatches(presented, expected) {
-	if (!presented) return false;
-	const a = Buffer.from(presented);
-	const b = Buffer.from(expected);
-	if (a.length !== b.length) {
-		timingSafeEqual(b, b);
-		return false;
-	}
-	return timingSafeEqual(a, b);
-}
 /** Hex shape of an APNs device token as delivered by iOS (usually 64 chars). */
 const APNS_TOKEN_PATTERN = /^[0-9a-f]{32,512}$/;
 function isValidApnsToken(token) {
@@ -117,32 +209,57 @@ var DeviceStore = class DeviceStore {
 		}
 		return store;
 	}
-	touch(record, now) {
-		const existing = this.devices.get(record.deviceId);
-		if (existing) {
-			existing.lastSeenTs = now;
-			existing.deviceName = record.deviceName || existing.deviceName;
-			existing.appVersion = record.appVersion || existing.appVersion;
-		} else {
-			if (this.devices.size >= 64) {
-				let oldestId;
-				let oldestTs = Number.POSITIVE_INFINITY;
-				for (const [id, value] of this.devices) if (value.lastSeenTs < oldestTs) {
-					oldestTs = value.lastSeenTs;
-					oldestId = id;
-				}
-				if (oldestId !== void 0) this.devices.delete(oldestId);
-			}
-			this.devices.set(record.deviceId, {
-				...record,
-				firstSeenTs: now,
-				lastSeenTs: now
-			});
-		}
+	/** Register one public key after a valid, single-use pairing grant. */
+	register(record, now) {
+		const deviceId = deviceIdForPublicKey(record.publicKey);
+		const existing = this.devices.get(deviceId);
+		if (!existing && this.devices.size >= 64) throw new Error("device registry is full");
+		const next = {
+			deviceId,
+			deviceName: record.deviceName,
+			appVersion: record.appVersion,
+			publicKey: record.publicKey,
+			fingerprint: fingerprintForPublicKey(record.publicKey),
+			scopes: normalizeDeviceScopes(record.scopes),
+			firstSeenTs: existing?.firstSeenTs ?? now,
+			lastSeenTs: now,
+			...existing?.apns ? { apns: existing.apns } : {}
+		};
+		this.devices.set(deviceId, next);
+		this.flush();
+		return structuredClone(next);
+	}
+	/** Return an active cryptographic identity. */
+	authorized(deviceId) {
+		const record = this.devices.get(deviceId);
+		if (!record?.publicKey || record.revokedAt !== void 0) return void 0;
+		return record;
+	}
+	markAuthenticated(deviceId, deviceName, appVersion, now) {
+		const record = this.authorized(deviceId);
+		if (!record) return;
+		record.deviceName = deviceName || record.deviceName;
+		record.appVersion = appVersion || record.appVersion;
+		record.lastSeenTs = now;
+		this.flush();
+	}
+	revoke(deviceId, now) {
+		const record = this.devices.get(deviceId);
+		if (!record || record.revokedAt !== void 0) return false;
+		record.revokedAt = now;
+		delete record.apns;
+		this.flush();
+		return true;
+	}
+	setScopes(deviceId, scopes) {
+		const record = this.authorized(deviceId);
+		if (!record) return null;
+		record.scopes = normalizeDeviceScopes(scopes);
 		this.flush();
+		return [...record.scopes];
 	}
 	list() {
-		return [...this.devices.values()];
+		return [...this.devices.values()].map((record) => structuredClone(record));
 	}
 	/**
 	* Store (or refresh) the APNs registration of a paired device. Idempotent:
@@ -152,17 +269,8 @@ var DeviceStore = class DeviceStore {
 	setPushToken(deviceId, token, environment, categories, now) {
 		const normalized = token.toLowerCase();
 		if (!isValidApnsToken(normalized)) return;
-		let record = this.devices.get(deviceId);
-		if (!record) {
-			record = {
-				deviceId,
-				deviceName: "unknown",
-				appVersion: "unknown",
-				firstSeenTs: now,
-				lastSeenTs: now
-			};
-			this.devices.set(deviceId, record);
-		}
+		const record = this.authorized(deviceId);
+		if (!record) return;
 		const next = {
 			token: normalized,
 			environment,
@@ -185,15 +293,6 @@ var DeviceStore = class DeviceStore {
 		delete record.apns;
 		this.flush();
 	}
-	/**
-	* Drop every paired-device record. Used by token rotation: devices paired
-	* under the old token can no longer authenticate, so keeping their rows
-	* would paint a misleading "still paired" picture.
-	*/
-	clear() {
-		this.devices.clear();
-		this.flush();
-	}
 	/** Serialized so concurrent touches can never interleave half-written JSON. */
 	flush() {
 		const next = this.flushTail.then(() => this.writeFile());
@@ -207,7 +306,7 @@ var DeviceStore = class DeviceStore {
 	async writeFile() {
 		const full = expandHome(this.filePath);
 		const body = JSON.stringify({
-			version: 1,
+			version: 2,
 			devices: this.list()
 		}, null, 2);
 		try {
@@ -219,43 +318,83 @@ var DeviceStore = class DeviceStore {
 	}
 };
 //#endregion
-//#region src/connection.ts
-const AUTH_TIMEOUT_MS = 5e3;
+//#region src/connection-policy.ts
+const AUTH_TIMEOUT_MS = 35e3;
 const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
 	"image/png",
 	"image/jpeg",
 	"image/webp",
 	"image/gif"
 ]);
-const MAX_PROMPT_IMAGES = 4;
-const MAX_BASE64_CHARS_PER_IMAGE = 8388608;
-/** Bounds a single prompt's text; the frame itself is capped by ws maxPayload. */
-const MAX_PROMPT_TEXT_CHARS = 262144;
-const MAX_DEVICE_ID_CHARS = 128;
-const MAX_DEVICE_NAME_CHARS = 64;
-const MAX_APP_VERSION_CHARS = 32;
 function sanitizeDeviceField(value, maxChars) {
 	return (typeof value === "string" ? value : String(value ?? "")).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, maxChars);
 }
-function helloTokenAccepted(transportAuthenticated, presentedToken, expectedToken) {
-	return transportAuthenticated === true || tokenMatches(presentedToken, expectedToken);
+function requiredScope(type) {
+	if (type === "c2s.ping" || type === "c2s.resume") return void 0;
+	if (type === "c2s.session.sendPrompt") return "prompt.send";
+	if (type === "c2s.approval.respond" || type === "c2s.question.respond") return "interactions.respond";
+	if (type === "c2s.push.register") return "notifications.register";
+	if (type === "c2s.workspace.create" || type === "c2s.session.create" || type === "c2s.session.rename" || type === "c2s.session.archive" || type === "c2s.session.cancel" || type === "c2s.session.selectModel") return "sessions.manage";
+	if (type.startsWith("c2s.")) return "sessions.read";
+}
+function sanitizeImageName(value) {
+	return value.replace(/[\u0000-\u001F\u007F]/g, "").trim().slice(0, 120);
+}
+/** Error code for a failed approval/question response outcome. */
+function pendingResponseErrorCode(reason) {
+	switch (reason) {
+		case "not-pending": return "E_NOT_FOUND";
+		case "bad-response": return "E_PROTOCOL";
+		case "transport": return "E_INTERNAL";
+	}
+}
+/** Human-readable failure detail; `question not pending` must only ever mean
+* "nothing pending", never "the host rejected the answer". */
+function pendingResponseMessage(kind, reason) {
+	switch (reason) {
+		case "not-pending": return kind + " not pending";
+		case "bad-response": return kind + " answer rejected by host: answer does not match the asked questions";
+		case "transport": return "host connection failed while answering " + kind;
+	}
+}
+function managementErrorCode(kind) {
+	switch (kind) {
+		case "unsupported": return "E_UNSUPPORTED";
+		case "not-found": return "E_NOT_FOUND";
+		case "busy": return "E_BUSY";
+		case "invalid": return "E_PROTOCOL";
+		case "internal": return "E_INTERNAL";
+	}
 }
+//#endregion
+//#region src/connection.ts
 /**
 * One connected phone. Implements BridgeSink so the HostBridge can push
-* projected frames and replays. Bearer/query credentials may authenticate the
-* HTTP upgrade; otherwise the first hello frame is verified here.
+* projected frames and replays. Every socket starts anonymous, receives one
+* server challenge, and must prove possession of a registered P-256 key.
 */
 var BridgeConnection = class {
 	ws;
 	deps;
 	authenticated = false;
+	authenticationSettled = false;
+	closed = false;
 	helloTimer;
 	openSessions = /* @__PURE__ */ new Set();
+	/**
+	* Realtime events that arrive while a session's history snapshot is in
+	* flight. The wire contract requires tail first; sending these immediately
+	* lets the later tail roll the client back over messages it just rendered.
+	*/
+	openingSessionEvents = /* @__PURE__ */ new Map();
 	/** Sanitized device identity from hello; needed for push registration. */
 	deviceId;
+	scopes = /* @__PURE__ */ new Set();
+	authChallenge;
 	constructor(ws, deps) {
 		this.ws = ws;
 		this.deps = deps;
+		this.authChallenge = createAuthChallenge(deps.audience);
 		ws.on("message", (data) => {
 			this.onMessage(String(data));
 		});
@@ -265,18 +404,50 @@ var BridgeConnection = class {
 		});
 		ws.on("error", () => {});
 		this.helloTimer = setTimeout(() => {
-			if (!this.authenticated) this.close(4402, "auth timeout");
+			if (!this.authenticated) {
+				this.settleAuthentication(false, "timeout");
+				this.close(4402, "auth timeout");
+			}
 		}, AUTH_TIMEOUT_MS);
+		this.helloTimer.unref();
+		this.send("s2c.auth.challenge", this.authChallenge);
 	}
 	/** Hard-drop the socket (server-side stale sweep). */
 	terminate() {
 		this.ws.terminate();
 	}
+	/** Protocol-compliant idle timeout: let the peer observe a normal 1001 close. */
+	closeIdle() {
+		this.close(1001, "idle timeout");
+	}
+	/** Announce an orderly plugin/data-plane shutdown before closing the socket. */
+	closeForServerStop() {
+		this.fail(void 0, "E_INTERNAL", "server stopping");
+		this.close(1001, "server stopping");
+	}
+	/** Used by dependency-lifecycle cleanup to avoid closing a replacement bridge. */
+	isAttachedTo(bridge) {
+		return this.deps.bridge === bridge;
+	}
 	/** Device identity once hello succeeded; undefined before that. */
 	get connectedDeviceId() {
 		return this.authenticated ? this.deviceId : void 0;
 	}
 	push(type, payload, seq) {
+		if (type === "s2c.session.event") {
+			const sessionId = payload?.sessionId;
+			if (typeof sessionId === "string") {
+				const buffered = this.openingSessionEvents.get(sessionId);
+				if (buffered) {
+					buffered.push({
+						type,
+						payload,
+						...seq !== void 0 ? { seq } : {}
+					});
+					return;
+				}
+			}
+		}
 		if (this.deps.debug === true) this.deps.log("push " + type + " seq=" + String(seq));
 		this.send(type, payload, void 0, seq);
 	}
@@ -293,13 +464,23 @@ var BridgeConnection = class {
 		return this.deps.bridge.currentCursor();
 	}
 	onClose() {
+		if (this.closed) return;
+		this.closed = true;
+		if (!this.authenticationSettled) this.settleAuthentication(false, "closed");
 		if (this.helloTimer !== void 0) clearTimeout(this.helloTimer);
 		for (const id of this.openSessions) this.deps.bridge.markSinkClosed(this, id);
 		this.openSessions.clear();
+		this.openingSessionEvents.clear();
 		this.deps.bridge.dropSinkSessions(this);
 		if (this.authenticated) this.deps.bridge.removeSink(this);
 	}
+	settleAuthentication(ok, reason) {
+		if (this.authenticationSettled) return;
+		this.authenticationSettled = true;
+		this.deps.onAuthenticationSettled?.(ok, reason);
+	}
 	close(code, reason) {
+		if (this.closed) return;
 		try {
 			this.ws.close(code, reason);
 		} catch {
@@ -308,14 +489,19 @@ var BridgeConnection = class {
 	}
 	send(type, payload, id, seq) {
 		const envelope = {
-			v: 1,
+			v: 2,
 			type,
 			ts: Date.now(),
 			...id !== void 0 ? { id } : {},
 			...seq !== void 0 ? { seq } : {},
 			payload
 		};
-		if (this.ws.readyState === this.ws.OPEN) this.ws.send(JSON.stringify(envelope));
+		if (this.ws.readyState !== this.ws.OPEN) return;
+		if (this.ws.bufferedAmount > 4194304) {
+			this.close(1013, "client too slow");
+			return;
+		}
+		this.ws.send(JSON.stringify(envelope));
 	}
 	fail(id, code, message) {
 		this.send("s2c.error", {
@@ -330,6 +516,10 @@ var BridgeConnection = class {
 	}
 	async onMessage(raw) {
 		this.lastActivity = Date.now();
+		if (!this.authenticated && raw.length > 65536) {
+			this.close(1009, "pre-auth frame too large");
+			return;
+		}
 		let env;
 		try {
 			env = JSON.parse(raw);
@@ -337,7 +527,7 @@ var BridgeConnection = class {
 			this.fail(void 0, "E_PROTOCOL", "frame is not valid JSON");
 			return;
 		}
-		if (env.v !== 1) {
+		if (env.v !== 2) {
 			this.fail(env.id, "E_UNSUPPORTED", "unsupported protocol version");
 			this.close(4500, "protocol version mismatch");
 			return;
@@ -347,13 +537,18 @@ var BridgeConnection = class {
 				this.send("s2c.pong", { serverTime: Date.now() }, env.id);
 				return;
 			}
-			if (env.type === "c2s.hello.auth") {
-				await this.hello(env);
+			if (env.type === "c2s.auth.prove") {
+				await this.prove(env);
 				return;
 			}
 			this.fail(env.id, "E_PROTOCOL", "authenticate first");
 			return;
 		}
+		const required = requiredScope(env.type);
+		if (required !== void 0 && !this.scopes.has(required)) {
+			this.fail(env.id, "E_FORBIDDEN", `scope ${required} required`);
+			return;
+		}
 		switch (env.type) {
 			case "c2s.ping":
 				this.send("s2c.pong", { serverTime: Date.now() }, env.id);
@@ -402,18 +597,23 @@ var BridgeConnection = class {
 				const p = env.payload;
 				if (!p?.sessionId || typeof p.sessionId !== "string") return this.fail(env.id, "E_PROTOCOL", "sessionId required");
 				const sessionId = p.sessionId;
-				this.openSessions.add(sessionId);
-				this.deps.bridge.markSinkOpen(this, sessionId);
+				const bufferedEvents = [];
+				this.openingSessionEvents.set(sessionId, bufferedEvents);
 				if (!await this.deps.bridge.openSession(this, sessionId, p.tailCount ?? 100)) {
-					this.openSessions.delete(sessionId);
-					this.deps.bridge.markSinkClosed(this, sessionId);
+					if (this.openingSessionEvents.get(sessionId) === bufferedEvents) this.openingSessionEvents.delete(sessionId);
 					return this.fail(env.id, "E_NOT_FOUND", "session history unavailable");
 				}
+				if (this.openingSessionEvents.get(sessionId) !== bufferedEvents) return;
+				this.openSessions.add(sessionId);
+				this.deps.bridge.markSinkOpen(this, sessionId);
+				this.openingSessionEvents.delete(sessionId);
+				for (const frame of bufferedEvents) this.push(frame.type, frame.payload, frame.seq);
 				return;
 			}
 			case "c2s.session.close": {
 				const p = env.payload;
 				if (!p?.sessionId) return this.fail(env.id, "E_PROTOCOL", "sessionId required");
+				this.openingSessionEvents.delete(p.sessionId);
 				this.openSessions.delete(p.sessionId);
 				this.deps.bridge.markSinkClosed(this, p.sessionId);
 				this.send("s2c.ack", {}, env.id);
@@ -474,7 +674,9 @@ var BridgeConnection = class {
 			case "c2s.session.history": {
 				const p = env.payload;
 				if (!p?.sessionId || typeof p.beforeSeq !== "number") return this.fail(env.id, "E_PROTOCOL", "sessionId and beforeSeq required");
-				if (!await this.deps.bridge.historyPage(this, p.sessionId, p.beforeSeq, Math.min(p.limit ?? 100, 500))) this.fail(env.id, "E_NOT_FOUND", "history unavailable");
+				const page = await this.deps.bridge.historyPage(p.sessionId, p.beforeSeq, Math.min(p.limit ?? 100, 500));
+				if (!page) return this.fail(env.id, "E_NOT_FOUND", "history unavailable");
+				this.send("s2c.history.page", page, env.id);
 				return;
 			}
 			case "c2s.session.attachment": {
@@ -524,15 +726,15 @@ var BridgeConnection = class {
 				const text = typeof p?.text === "string" ? p.text : "";
 				const rawImages = Array.isArray(p?.images) ? p.images : [];
 				if (!p?.sessionId || text.trim().length === 0 && rawImages.length === 0) return this.fail(env.id, "E_PROTOCOL", "sessionId and text or images required");
-				if (text.length > MAX_PROMPT_TEXT_CHARS) return this.fail(env.id, "E_PROTOCOL", "prompt text too long");
-				if (rawImages.length > MAX_PROMPT_IMAGES) return this.fail(env.id, "E_PROTOCOL", "too many images");
+				if (text.length > 262144) return this.fail(env.id, "E_PROTOCOL", "prompt text too long");
+				if (rawImages.length > 4) return this.fail(env.id, "E_PROTOCOL", "too many images");
 				const images = [];
 				for (const image of rawImages) {
-					if (!IMAGE_MEDIA_TYPES.has(String(image?.mediaType)) || typeof image?.data !== "string" || image.data.length === 0 || image.data.length > MAX_BASE64_CHARS_PER_IMAGE) return this.fail(env.id, "E_PROTOCOL", "invalid image attachment");
+					if (!IMAGE_MEDIA_TYPES.has(String(image?.mediaType)) || typeof image?.data !== "string" || image.data.length === 0 || image.data.length > 8388608) return this.fail(env.id, "E_PROTOCOL", "invalid image attachment");
 					images.push({
 						mediaType: image.mediaType,
 						data: image.data,
-						...typeof image.name === "string" && image.name.trim().length > 0 ? { name: image.name.trim().slice(0, 120) } : {}
+						...typeof image.name === "string" && sanitizeImageName(image.name).length > 0 ? { name: sanitizeImageName(image.name) } : {}
 					});
 				}
 				const userSeq = await this.deps.bridge.sendPrompt(p.sessionId, text, images);
@@ -579,40 +781,51 @@ var BridgeConnection = class {
 			default: this.fail(env.id, "E_PROTOCOL", "unknown type: " + env.type);
 		}
 	}
-	async hello(env) {
+	async prove(env) {
 		const p = env.payload ?? {};
-		if (!helloTokenAccepted(this.deps.transportAuthenticated, p.token, this.deps.expectedToken)) {
-			this.fail(env.id, "E_AUTH", "token missing or invalid");
-			this.close(4401, "invalid token");
-			return;
-		}
 		if (!p.deviceId) {
 			this.fail(env.id, "E_PROTOCOL", "deviceId required");
 			this.close(4403, "deviceId required");
 			return;
 		}
-		const deviceId = sanitizeDeviceField(p.deviceId, MAX_DEVICE_ID_CHARS);
+		const deviceId = sanitizeDeviceField(p.deviceId, 128);
 		if (!deviceId) {
 			this.fail(env.id, "E_PROTOCOL", "deviceId required");
 			this.close(4403, "deviceId required");
 			return;
 		}
-		const deviceName = sanitizeDeviceField(p.deviceName, MAX_DEVICE_NAME_CHARS) || "unknown";
-		const appVersion = sanitizeDeviceField(p.appVersion, MAX_APP_VERSION_CHARS) || "unknown";
+		const deviceName = sanitizeDeviceField(p.deviceName, 64) || "unknown";
+		const appVersion = sanitizeDeviceField(p.appVersion, 32) || "unknown";
+		const challenge = this.authChallenge;
+		const record = this.deps.devices.authorized(deviceId);
+		const resumeCursor = typeof p.resumeCursor === "number" && Number.isInteger(p.resumeCursor) && p.resumeCursor >= 0 ? p.resumeCursor : void 0;
+		const challengeMatches = p.nonce === challenge.nonce && p.audience === challenge.audience && p.issuedAt === challenge.issuedAt && p.expiresAt === challenge.expiresAt && Date.now() <= challenge.expiresAt;
+		if (!(record?.publicKey !== void 0 && typeof p.signature === "string" && challengeMatches && verifyAuthProof(record.publicKey, {
+			deviceId,
+			deviceName,
+			appVersion,
+			resumeCursor,
+			...challenge
+		}, p.signature)) || record === void 0) {
+			this.fail(env.id, "E_AUTH", "device proof missing or invalid");
+			this.settleAuthentication(false, "invalid-proof");
+			this.close(4401, "invalid device proof");
+			return;
+		}
+		this.settleAuthentication(true, "success");
 		this.authenticated = true;
 		this.deviceId = deviceId;
+		this.scopes = new Set(record.scopes ?? []);
 		if (this.helloTimer !== void 0) clearTimeout(this.helloTimer);
-		this.deps.devices.touch({
-			deviceId,
-			deviceName,
-			appVersion
-		}, Date.now());
-		this.deps.log("device paired: " + deviceName + " (" + deviceId + ")");
-		const cursor = typeof p.resumeCursor === "number" && p.resumeCursor >= 0 ? p.resumeCursor : void 0;
+		this.deps.devices.markAuthenticated(deviceId, deviceName, appVersion, Date.now());
+		this.deps.onDeviceAuthenticated?.(deviceId);
+		const cursor = resumeCursor;
 		const canResume = cursor !== void 0 && this.deps.bridge.canResumeFrom(cursor);
 		this.send("s2c.welcome", {
-			protocolVersion: 1,
+			protocolVersion: 2,
 			serverVersion: this.deps.serverVersion,
+			deviceId,
+			scopes: [...this.scopes],
 			capabilities: this.deps.bridge.capabilities,
 			cursor: this.deps.bridge.currentCursor(),
 			resumed: canResume
@@ -624,34 +837,8 @@ var BridgeConnection = class {
 		}
 	}
 };
-/** Error code for a failed approval/question response outcome. */
-function pendingResponseErrorCode(reason) {
-	switch (reason) {
-		case "not-pending": return "E_NOT_FOUND";
-		case "bad-response": return "E_PROTOCOL";
-		case "transport": return "E_INTERNAL";
-	}
-}
-/** Human-readable failure detail; `question not pending` must only ever mean
-* "nothing pending", never "the host rejected the answer". */
-function pendingResponseMessage(kind, reason) {
-	switch (reason) {
-		case "not-pending": return kind + " not pending";
-		case "bad-response": return kind + " answer rejected by host: answer does not match the asked questions";
-		case "transport": return "host connection failed while answering " + kind;
-	}
-}
-function managementErrorCode(kind) {
-	switch (kind) {
-		case "unsupported": return "E_UNSUPPORTED";
-		case "not-found": return "E_NOT_FOUND";
-		case "busy": return "E_BUSY";
-		case "invalid": return "E_PROTOCOL";
-		case "internal": return "E_INTERNAL";
-	}
-}
 //#endregion
-//#region src/host-bridge.ts
+//#region src/host-api.ts
 /**
 * Subagent sessions are host-internal workers of a parent conversation.
 * They must never surface on the phone: not in the project/session list,
@@ -662,117 +849,586 @@ function isSubagentRow(row) {
 }
 function unwrapStreamItem(item) {
 	const nested = item.payload;
-	if (nested && typeof nested === "object" && typeof nested.type === "string") return nested.rpcId || !item.rpcId ? nested : {
+	if (nested && typeof nested === "object" && typeof nested.type === "string") return item.rpcId ? {
 		...nested,
 		rpcId: item.rpcId
-	};
+	} : nested;
 	return item;
 }
-const MAX_RING_DEFAULT = 2e3;
-/**
-* Process-wide bridge state: session mirror, pending approvals/questions,
-* and the per-device replay ring. Consumes the in-process mux/host streams
-* and fans projected pushes out to every registered sink.
-*/
-let BRIDGE_SEQ = 0;
-var HostBridge = class {
-	apiProxy;
-	historyBufferMax;
-	id = ++BRIDGE_SEQ;
-	summaries = /* @__PURE__ */ new Map();
-	approvals = /* @__PURE__ */ new Map();
-	questions = /* @__PURE__ */ new Map();
-	archivedSessionIds = /* @__PURE__ */ new Set();
-	subagentSessionIds = /* @__PURE__ */ new Set();
-	sinks = /* @__PURE__ */ new Set();
-	ring = [];
-	cursor = 0;
-	abort = new AbortController();
-	constructor(apiProxy, historyBufferMax = MAX_RING_DEFAULT) {
-		this.apiProxy = apiProxy;
-		this.historyBufferMax = historyBufferMax;
-	}
-	pushOutlet;
-	/**
-	* Wire the offline-push fan-out. Present ⇒ welcome advertises the `push`
-	* capability and notify-worthy events are mirrored to APNs.
-	*/
-	setPushOutlet(outlet) {
-		this.pushOutlet = outlet;
+//#endregion
+//#region src/host-event-projection.ts
+const MAX_MESSAGE_PROJECTION_BYTES = 262144;
+/** One durable host event sequence becomes exactly one phone message row.
+* Keep the last projection when a host history response repeats an event. */
+function canonicalSessionMessages(messages) {
+	const bySequence = /* @__PURE__ */ new Map();
+	for (const message of messages) bySequence.set(message.seq, message);
+	return [...bySequence.values()].sort((a, b) => a.seq - b.seq);
+}
+function limitSessionPageMessages(messages) {
+	const canonical = canonicalSessionMessages(messages);
+	let bytes = 2;
+	const kept = [];
+	for (let index = canonical.length - 1; index >= 0; index -= 1) {
+		const message = canonical[index];
+		const candidateBytes = jsonBytes(message) + (kept.length > 0 ? 1 : 0);
+		if (bytes + candidateBytes > 921600) break;
+		kept.unshift(message);
+		bytes += candidateBytes;
 	}
-	get capabilities() {
-		return {
-			historyPaging: true,
-			replay: true,
-			approvals: true,
-			questions: true,
-			pendingSnapshot: true,
-			models: typeof this.apiProxy.sessions.models === "function" && typeof this.apiProxy.sessions.selectModel === "function",
-			sessionManagement: typeof this.apiProxy.sessions.rename === "function" && typeof this.apiProxy.workspace?.archiveSession === "function",
-			projectSelection: typeof this.apiProxy.workspace?.list === "function" && typeof this.apiProxy.workspace?.create === "function",
-			push: this.pushOutlet?.isAvailable() === true
+	return {
+		messages: kept,
+		dropped: canonical.length - kept.length
+	};
+}
+function projectEvent(sessionId, event) {
+	switch (event.type) {
+		case "turn/start": return {
+			kind: "turn.start",
+			data: {}
 		};
-	}
-	diagnostic(message) {
-		console.log("[deeppilot] " + message);
-	}
-	currentCursor() {
-		return this.cursor;
-	}
-	addSink(sink) {
-		this.sinks.add(sink);
-	}
-	removeSink(sink) {
-		this.sinks.delete(sink);
-	}
-	/** Whether the ring still holds everything after the cursor. */
-	canResumeFrom(cursor) {
-		const oldest = this.ring.length > 0 ? this.ring[0].seq : this.cursor + 1;
-		return cursor <= this.cursor && cursor + 1 >= oldest;
-	}
-	sinkSessions = /* @__PURE__ */ new Map();
-	lastAssistantText = /* @__PURE__ */ new Map();
-	/** Mark a sink as actively viewing a session (suppresses its turn notifications). */
-	markSinkOpen(sink, sessionId) {
-		let set = this.sinkSessions.get(sink);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			this.sinkSessions.set(sink, set);
-		}
-		set.add(sessionId);
-	}
-	markSinkClosed(sink, sessionId) {
-		this.sinkSessions.get(sink)?.delete(sessionId);
-	}
-	dropSinkSessions(sink) {
-		this.sinkSessions.delete(sink);
-	}
-	isViewedBy(sink, sessionId) {
-		return this.sinkSessions.get(sink)?.has(sessionId) ?? false;
-	}
+		case "turn/end": return {
+			kind: "turn.end",
+			data: { ok: event.data?.reason?.kind === "completed" }
+		};
+		case "user/message": return {
+			kind: "message.final",
+			data: { ...limitMessageProjection({
+				seq: event.seq,
+				role: userRoleOf(event.data),
+				text: messageText(event.data),
+				...attachmentProjection(event.data),
+				...contextProjectionOf(event.data),
+				ts: tsOf(event)
+			}) }
+		};
+		case "assistant/chunk":
+			if (chunkTypeOf(event.data) === "reasoning-delta") return {
+				kind: "thinking.delta",
+				data: limitRealtimeText({
+					text: chunkText(event.data),
+					ts: tsOf(event)
+				})
+			};
+			return {
+				kind: "message.delta",
+				data: limitRealtimeText({
+					text: chunkText(event.data),
+					ts: tsOf(event)
+				})
+			};
+		case "assistant/message": {
+			const text = messageText(event.data);
+			const thinking = messageThinking(event.data);
+			if (!text.trim() && !thinking.trim()) return null;
+			return {
+				kind: "message.final",
+				data: { ...limitMessageProjection({
+					seq: event.seq,
+					role: "assistant",
+					text,
+					...thinking ? { thinking } : {},
+					ts: tsOf(event)
+				}) }
+			};
+		}
+		case "tool/call": {
+			const data = event.data;
+			return {
+				kind: "tool.start",
+				data: {
+					seq: event.seq,
+					role: "tool",
+					tool: {
+						name: String(data?.name ?? "tool"),
+						state: "running",
+						summary: summarizeArgs(data?.arguments),
+						...data?.callId ? { callId: String(data.callId) } : {}
+					},
+					ts: tsOf(event)
+				}
+			};
+		}
+		case "tool/result": {
+			const data = event.data;
+			return {
+				kind: "tool.end",
+				data: {
+					seq: event.seq,
+					role: "tool",
+					ok: !event.data || data?.error === void 0,
+					...data?.callId ? { callId: String(data.callId) } : {},
+					ts: tsOf(event)
+				}
+			};
+		}
+		default: return null;
+	}
+}
+function tsOf(event) {
+	return typeof event.time === "number" ? event.time : Date.now();
+}
+/** Read the durable message source off one user/message payload. Handles both
+* bare-message payloads and older `{message: {...}}` wrappers; undefined when
+* the shape carries no readable source (legacy hosts). */
+function userMessageSource(data) {
+	if (!data || typeof data !== "object") return void 0;
+	const obj = data;
+	if (obj.source && typeof obj.source === "object") return obj.source;
+	if (obj.message && typeof obj.message === "object" && obj.message.source && typeof obj.message.source === "object") return obj.message.source;
+}
+/** Wire role for one user/message payload. A payload without any readable
+* source degrades to 'user' so history written by older hosts stays visible;
+* a present source follows the host's own trajectory rule — anything whose
+* `kind` is not 'user' is injected context and projects as 'system'. */
+function userRoleOf(data) {
+	const source = userMessageSource(data);
+	if (!source) return "user";
+	return source.kind === "user" ? "user" : "system";
+}
+/** Producer name of one injected-context source, mirroring how the DSH client
+* runtime derives its trajectory label: plugin name, skill name, instruction
+* paths, session-reference labels, or the raw kind as fallback. */
+function contextLabelOf(source) {
+	const kind = typeof source.kind === "string" ? source.kind : "";
+	const joined = (member) => {
+		const list = source[member];
+		if (!Array.isArray(list)) return void 0;
+		const names = list.flatMap((entry) => {
+			if (!entry || typeof entry !== "object") return [];
+			const record = entry;
+			return [typeof record.label === "string" ? record.label : typeof record.path === "string" ? record.path : ""];
+		}).filter((name) => name.length > 0);
+		return names.length > 0 ? names.join(", ") : void 0;
+	};
+	switch (kind) {
+		case "session-reference": return joined("references") ?? (kind || void 0);
+		case "agent-instructions": return joined("changes") ?? (kind || void 0);
+		case "plugin": return typeof source.plugin === "string" && source.plugin.length > 0 ? source.plugin : kind || void 0;
+		case "skill-invocation": return typeof source.name === "string" && source.name.length > 0 ? source.name : kind || void 0;
+		default: return kind || void 0;
+	}
+}
+/** Semantic ContextForm declared by the producer ('snapshot', 'notice', …);
+* anything unrecognized stays undefined so clients render it opaque. */
+function contextFormOf(source) {
+	if (typeof source.form !== "string" || source.form.length === 0) return void 0;
+	return [
+		"instructions",
+		"catalog",
+		"snapshot",
+		"notice",
+		"relay",
+		"recall"
+	].includes(source.form) ? source.form : void 0;
+}
+/** Optional `context` metadata for one system row; {} on user rows. */
+function contextProjectionOf(data) {
+	if (userRoleOf(data) !== "system") return {};
+	const source = userMessageSource(data);
+	if (!source) return {};
+	const label = contextLabelOf(source);
+	const form = contextFormOf(source);
+	if (!label && !form) return {};
+	return { context: {
+		...label ? { label } : {},
+		...form ? { form } : {}
+	} };
+}
+/** Extract plain text from user/assistant message payloads across shapes. */
+function messageText(data) {
+	if (typeof data === "string") return data;
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (typeof obj.text === "string") return obj.text;
+	if (obj.message && typeof obj.message === "object") return messageText(obj.message);
+	return contentText(obj.content);
+}
+function contentText(content) {
+	if (typeof content === "string") return content;
+	if (Array.isArray(content)) return content.map((part) => {
+		if (typeof part === "string") return part;
+		if (part && typeof part === "object") {
+			const piece = part;
+			if (piece.type === "text" && typeof piece.text === "string") return piece.text;
+		}
+		return "";
+	}).join("");
+	return "";
+}
+function messageAttachments(data) {
+	if (!data || typeof data !== "object") return [];
+	const obj = data;
+	if (obj.message && typeof obj.message === "object") return messageAttachments(obj.message);
+	if (!Array.isArray(obj.content)) return [];
+	return obj.content.flatMap((part) => {
+		if (!part || typeof part !== "object") return [];
+		const block = part;
+		if (block.type !== "image" || !block.attachment) return [];
+		const attachmentId = typeof block.attachment.attachmentId === "string" && block.attachment.attachmentId.length > 0 ? block.attachment.attachmentId : void 0;
+		const width = typeof block.attachment.width === "number" && Number.isFinite(block.attachment.width) ? block.attachment.width : void 0;
+		const height = typeof block.attachment.height === "number" && Number.isFinite(block.attachment.height) ? block.attachment.height : void 0;
+		return [{
+			kind: "image",
+			...typeof block.attachment.name === "string" ? { name: block.attachment.name } : {},
+			...typeof block.attachment.mediaType === "string" ? { mediaType: block.attachment.mediaType } : {},
+			...attachmentId ? { attachmentId } : {},
+			...width !== void 0 ? { width } : {},
+			...height !== void 0 ? { height } : {}
+		}];
+	});
+}
+function attachmentProjection(data) {
+	const attachments = messageAttachments(data);
+	return attachments.length > 0 ? { attachments } : {};
+}
+/** Extract reasoning ("thinking") text from assistant message payloads. */
+function messageThinking(data) {
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (obj.message && typeof obj.message === "object") return messageThinking(obj.message);
+	return reasoningContent(obj.content);
+}
+function reasoningContent(content) {
+	if (!Array.isArray(content)) return "";
+	return content.map((part) => {
+		if (part && typeof part === "object") {
+			const piece = part;
+			if (piece.type === "reasoning" && typeof piece.text === "string") return piece.text;
+		}
+		return "";
+	}).join("");
+}
+/** Stream chunk type of an assistant/chunk payload ('' when unwrapped). */
+function chunkTypeOf(data) {
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (obj.chunk && typeof obj.chunk === "object") return String(obj.chunk.type ?? "");
+	return "text-delta";
+}
+function chunkText(data) {
+	if (!data || typeof data !== "object") return "";
+	const obj = data;
+	if (obj.chunk && typeof obj.chunk === "object") {
+		const inner = obj.chunk;
+		if ((inner.type === "text-delta" || inner.type === "reasoning-delta") && typeof inner.text === "string") return inner.text;
+		return "";
+	}
+	const direct = data;
+	return typeof direct.text === "string" ? direct.text : "";
+}
+function summarizeArgs(raw) {
+	if (typeof raw !== "string" || raw.length === 0) return "";
+	try {
+		const parsed = JSON.parse(raw);
+		const parts = [];
+		for (const [key, value] of Object.entries(parsed)) if (typeof value === "string") parts.push(key + "=" + truncate(value.replace(/\s+/g, " "), 60));
+		return truncate(parts.join(" "), 90);
+	} catch {
+		return truncate(raw, 90);
+	}
+}
+function truncate(text, max) {
+	return text.length <= max ? text : text.slice(0, max - 1) + "…";
+}
+function projectHistory(events) {
+	const messages = [];
+	const toolByCall = /* @__PURE__ */ new Map();
+	for (const entry of events) {
+		const event = entry.event;
+		const base = {
+			seq: event.seq,
+			ts: tsOf(event)
+		};
+		switch (event.type) {
+			case "user/message":
+				messages.push({
+					...base,
+					role: userRoleOf(event.data),
+					text: messageText(event.data),
+					...attachmentProjection(event.data),
+					...contextProjectionOf(event.data)
+				});
+				break;
+			case "assistant/message": {
+				const text = messageText(event.data);
+				const thinking = messageThinking(event.data);
+				if (!text.trim() && !thinking.trim()) break;
+				messages.push({
+					...base,
+					role: "assistant",
+					text,
+					...thinking ? { thinking } : {}
+				});
+				break;
+			}
+			case "tool/call": {
+				const data = event.data;
+				const row = {
+					...base,
+					role: "tool",
+					tool: {
+						name: String(data?.name ?? "tool"),
+						state: "running",
+						summary: summarizeArgs(data?.arguments)
+					}
+				};
+				messages.push(row);
+				if (data?.callId) toolByCall.set(String(data.callId), row);
+				break;
+			}
+			case "tool/result": {
+				const data = event.data;
+				const callId = data?.callId ? String(data.callId) : void 0;
+				const target = callId ? toolByCall.get(callId) : void 0;
+				const failed = data?.error !== void 0;
+				const summary = failed ? "失败" : summarizeResult(data?.message?.content);
+				if (target?.tool) target.tool = {
+					...target.tool,
+					state: failed ? "error" : "ok",
+					summary
+				};
+				else messages.push({
+					...base,
+					role: "tool",
+					tool: {
+						name: "result",
+						state: failed ? "error" : "ok",
+						summary
+					}
+				});
+				break;
+			}
+		}
+	}
+	return canonicalSessionMessages(messages.map(limitMessageProjection));
+}
+/**
+* Enforce PROTOCOL.md's per-message 256 KB ceiling by UTF-8 JSON byte size.
+* Keep structural identity and attachment references intact; progressively
+* shorten human-readable fields until the serialized projection fits.
+*/
+function limitMessageProjection(message) {
+	if (jsonBytes(message) <= 262144) return message;
+	const next = {
+		...message,
+		...message.tool ? { tool: {
+			...message.tool,
+			name: truncateUtf8(message.tool.name, 4096),
+			summary: truncateUtf8(message.tool.summary, 65536)
+		} } : {},
+		...message.attachments ? { attachments: message.attachments.slice(0, 16).map((attachment) => ({
+			...attachment,
+			...attachment.name ? { name: truncateUtf8(attachment.name, 4096) } : {},
+			...attachment.mediaType ? { mediaType: truncateUtf8(attachment.mediaType, 256) } : {},
+			...attachment.attachmentId ? { attachmentId: truncateUtf8(attachment.attachmentId, 4096) } : {}
+		})) } : {},
+		...message.context ? { context: {
+			...message.context.label ? { label: truncateUtf8(message.context.label, 8192) } : {},
+			...message.context.form ? { form: truncateUtf8(message.context.form, 256) } : {}
+		} } : {},
+		truncated: true
+	};
+	const textFields = [];
+	if (typeof next.text === "string") textFields.push({
+		get: () => next.text ?? "",
+		set: (value) => {
+			next.text = value;
+		}
+	});
+	if (typeof next.thinking === "string") textFields.push({
+		get: () => next.thinking ?? "",
+		set: (value) => {
+			next.thinking = value;
+		}
+	});
+	if (next.tool) textFields.push({
+		get: () => next.tool?.summary ?? "",
+		set: (value) => {
+			if (next.tool) next.tool.summary = value;
+		}
+	});
+	if (next.context?.label) textFields.push({
+		get: () => next.context?.label ?? "",
+		set: (value) => {
+			if (next.context) next.context.label = value;
+		}
+	});
+	while (jsonBytes(next) > MAX_MESSAGE_PROJECTION_BYTES) {
+		const largest = textFields.map((field) => ({
+			field,
+			bytes: Buffer.byteLength(field.get(), "utf8")
+		})).sort((a, b) => b.bytes - a.bytes)[0];
+		if (largest && largest.bytes > 0) {
+			largest.field.set(truncateUtf8(largest.field.get(), Math.floor(largest.bytes / 2)));
+			continue;
+		}
+		if (next.attachments && next.attachments.length > 0) {
+			next.attachments = next.attachments.slice(0, -1);
+			continue;
+		}
+		break;
+	}
+	return next;
+}
+function limitRealtimeText(data) {
+	if (jsonBytes(data) <= 262144) return data;
+	let text = data.text;
+	const next = {
+		...data,
+		truncated: true
+	};
+	while (jsonBytes(next) > 262144 && text.length > 0) {
+		text = truncateUtf8(text, Math.floor(Buffer.byteLength(text, "utf8") / 2));
+		next.text = text;
+	}
+	return next;
+}
+function jsonBytes(value) {
+	return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function truncateUtf8(value, maxBytes) {
+	if (maxBytes <= 0) return "";
+	if (Buffer.byteLength(value, "utf8") <= maxBytes) return value;
+	let low = 0;
+	let high = value.length;
+	while (low < high) {
+		const mid = Math.ceil((low + high) / 2);
+		const candidate = value.slice(0, mid);
+		if (Buffer.byteLength(candidate, "utf8") <= maxBytes) low = mid;
+		else high = mid - 1;
+	}
+	let end = low;
+	if (end > 0 && /[\uD800-\uDBFF]/.test(value[end - 1])) end -= 1;
+	return value.slice(0, end);
+}
+function summarizeResult(content) {
+	return truncate(contentText(content).replace(/\s+/g, " ").trim(), 90);
+}
+//#endregion
+//#region src/host-bridge.ts
+const MAX_RING_DEFAULT = 2e3;
+/**
+* Process-wide bridge state: session mirror, pending approvals/questions,
+* and the per-device replay ring. Consumes the in-process mux/host streams
+* and fans projected pushes out to every registered sink.
+*/
+let BRIDGE_SEQ = 0;
+var HostBridge = class {
+	apiProxy;
+	historyBufferMax;
+	id = ++BRIDGE_SEQ;
+	summaries = /* @__PURE__ */ new Map();
+	approvals = /* @__PURE__ */ new Map();
+	questions = /* @__PURE__ */ new Map();
+	archivedSessionIds = /* @__PURE__ */ new Set();
+	subagentSessionIds = /* @__PURE__ */ new Set();
+	sinks = /* @__PURE__ */ new Set();
+	ring = [];
+	cursor = 0;
+	userReceiptSeq = 0;
+	abort = new AbortController();
+	started = false;
+	disposed = false;
+	constructor(apiProxy, historyBufferMax = MAX_RING_DEFAULT) {
+		this.apiProxy = apiProxy;
+		this.historyBufferMax = historyBufferMax;
+	}
+	pushOutlet;
+	/**
+	* Wire the offline-push fan-out. Present ⇒ welcome advertises the `push`
+	* capability and notify-worthy events are mirrored to APNs.
+	*/
+	setPushOutlet(outlet) {
+		this.pushOutlet = outlet;
+	}
+	get capabilities() {
+		return {
+			historyPaging: true,
+			replay: true,
+			approvals: true,
+			questions: true,
+			pendingSnapshot: true,
+			notifyAllCategories: true,
+			models: typeof this.apiProxy.sessions.models === "function" && typeof this.apiProxy.sessions.selectModel === "function",
+			sessionManagement: typeof this.apiProxy.sessions.rename === "function" && typeof this.apiProxy.workspace?.archiveSession === "function",
+			projectSelection: typeof this.apiProxy.workspace?.list === "function" && typeof this.apiProxy.workspace?.create === "function",
+			push: this.pushOutlet?.isAvailable() === true
+		};
+	}
+	diagnostic(message) {
+		console.log("[deeppilot] " + message);
+	}
+	currentCursor() {
+		return this.cursor;
+	}
+	addSink(sink) {
+		this.sinks.add(sink);
+	}
+	removeSink(sink) {
+		this.sinks.delete(sink);
+	}
+	/** Whether the ring still holds everything after the cursor. */
+	canResumeFrom(cursor) {
+		const oldest = this.ring.length > 0 ? this.ring[0].seq : this.cursor + 1;
+		return cursor <= this.cursor && cursor + 1 >= oldest;
+	}
+	sinkSessions = /* @__PURE__ */ new Map();
+	lastAssistantText = /* @__PURE__ */ new Map();
+	/** Mark a sink as actively viewing a session (suppresses its turn notifications). */
+	markSinkOpen(sink, sessionId) {
+		let set = this.sinkSessions.get(sink);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.sinkSessions.set(sink, set);
+		}
+		set.add(sessionId);
+	}
+	markSinkClosed(sink, sessionId) {
+		this.sinkSessions.get(sink)?.delete(sessionId);
+	}
+	dropSinkSessions(sink) {
+		this.sinkSessions.delete(sink);
+	}
+	isViewedBy(sink, sessionId) {
+		return this.sinkSessions.get(sink)?.has(sessionId) ?? false;
+	}
+	/** F-9: when a notification-worthy event fires, mirror it to every
+	*  online device that is not currently viewing the session (the s2c.notify
+	*  frame counts toward the seq cursor and joins the replay ring per
+	*  PROTOCOL §6 + §7), then fan the same payload out to offline devices
+	*  holding an APNs token. */
+	emitNotify(args) {
+		if (this.subagentSessionIds.has(args.sessionId)) return;
+		const body = args.body.length > 120 ? args.body.slice(0, 119) + "…" : args.body;
+		this.record("s2c.notify", {
+			notificationId: args.notificationId,
+			category: args.category,
+			sessionId: args.sessionId,
+			title: args.title,
+			body,
+			ts: Date.now()
+		}, (sink) => this.isViewedBy(sink, args.sessionId));
+		this.fanOutPush({
+			notificationId: args.notificationId,
+			category: args.category,
+			sessionId: args.sessionId,
+			title: args.title,
+			body
+		});
+	}
 	/** F-9: when a turn completes, notify every device not viewing the session. */
 	emitTurnCompletedNotify(sessionId, ok) {
 		if (this.subagentSessionIds.has(sessionId)) return;
 		const row = this.summaries.get(sessionId);
 		const title = ok ? "任务完成" : "任务异常结束";
 		const body = this.lastAssistantText.get(sessionId) ?? row?.title ?? "";
-		const truncatedBody = body.length > 120 ? body.slice(0, 119) + "…" : body;
-		const category = ok ? "turn.completed" : "session.error";
-		const notificationId = "n-" + (this.cursor + 1);
-		this.record("s2c.notify", {
-			notificationId,
-			category,
+		this.emitNotify({
 			sessionId,
+			category: ok ? "turn.completed" : "session.error",
 			title,
-			body: truncatedBody,
-			ts: Date.now()
-		}, (sink) => this.isViewedBy(sink, sessionId));
-		this.fanOutPush({
-			notificationId,
-			category,
-			sessionId,
-			title,
-			body: truncatedBody
+			body,
+			notificationId: "n-" + (this.cursor + 1)
 		});
 	}
 	/**
@@ -804,6 +1460,7 @@ var HostBridge = class {
 		return true;
 	}
 	record(type, payload, except) {
+		if (this.disposed) return;
 		this.cursor += 1;
 		const entry = {
 			seq: this.cursor,
@@ -819,13 +1476,19 @@ var HostBridge = class {
 	}
 	/** Start consuming host + mux streams. Idempotent; aborts on dispose(). */
 	start() {
+		if (this.started || this.disposed) return;
+		this.started = true;
 		this.runHostStream();
 		this.runMuxStream();
 		this.refreshSummaries();
 	}
 	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
 		this.abort.abort();
 		this.sinks.clear();
+		this.sinkSessions.clear();
+		this.pushOutlet = void 0;
 	}
 	async runHostStream() {
 		try {
@@ -898,27 +1561,28 @@ var HostBridge = class {
 				if (!p.approvalId || !frame.rpcId) break;
 				const toolName = String(p.toolName ?? "tool");
 				const summary = String(p.reason ?? "");
+				const sessionId = String(p.sessionId ?? "");
 				this.approvals.set(p.approvalId, {
 					rpcId: frame.rpcId,
-					sessionId: String(p.sessionId ?? ""),
+					sessionId,
 					toolName,
 					reason: summary
 				});
 				this.record("s2c.pending.approval", {
 					requestId: p.approvalId,
-					sessionId: String(p.sessionId ?? ""),
+					sessionId,
 					toolName,
 					summary,
 					riskLevel: riskOf(toolName)
 				});
-				this.fanOutPush({
-					notificationId: "apr-" + p.approvalId,
+				this.emitNotify({
+					sessionId,
 					category: "approval.required",
-					sessionId: String(p.sessionId ?? ""),
 					title: "需要批准",
-					body: toolName + ": " + summary
+					body: toolName + ": " + summary,
+					notificationId: "apr-" + p.approvalId
 				});
-				this.bumpPendingFlags(String(p.sessionId ?? ""));
+				this.bumpPendingFlags(sessionId);
 				break;
 			}
 			case "approval/resolved": {
@@ -945,12 +1609,12 @@ var HostBridge = class {
 					sessionId,
 					questions: p?.questions ?? []
 				});
-				this.fanOutPush({
-					notificationId: requestId,
-					category: "question.asked",
+				this.emitNotify({
 					sessionId,
+					category: "question.asked",
 					title: "有问题需要回答",
-					body: firstQuestionText(p?.questions)
+					body: firstQuestionText(p?.questions),
+					notificationId: requestId
 				});
 				this.bumpPendingFlags(sessionId);
 				break;
@@ -1005,7 +1669,7 @@ var HostBridge = class {
 			this.subagentSessionIds = subagentIds;
 			this.summaries = next;
 			const removedIds = [...previousIds].filter((id) => !next.has(id));
-			for (const id of removedIds) this.lastAssistantText.delete(id);
+			for (const id of this.lastAssistantText.keys()) if (!next.has(id)) this.lastAssistantText.delete(id);
 			this.record("s2c.sessions.delta", {
 				upserted: [...next.values()],
 				removedIds
@@ -1103,13 +1767,14 @@ var HostBridge = class {
 			});
 			if (!response.result || !response.result.ok) return false;
 			const result = response.result.value;
-			const messages = projectHistory(result.events ?? []);
+			const page = limitSessionPageMessages(projectHistory(result.events ?? []));
+			const messages = page.messages;
 			const oldestSeq = messages.length > 0 ? messages[0].seq : 0;
 			sink.push("s2c.session.tail", {
 				sessionId,
 				messages,
 				oldestSeq,
-				hasMore: Boolean(result.hasMore)
+				hasMore: Boolean(result.hasMore) || page.dropped > 0
 			});
 			this.deriveTitleFallback(sessionId, messages);
 			return true;
@@ -1117,7 +1782,7 @@ var HostBridge = class {
 			return false;
 		}
 	}
-	async historyPage(sink, sessionId, beforeSeq, limit) {
+	async historyPage(sessionId, beforeSeq, limit) {
 		try {
 			const response = await this.apiProxy.sessions.history({
 				rpcId: randomUUID(),
@@ -1127,17 +1792,16 @@ var HostBridge = class {
 					maxMessages: clampTail(limit)
 				}
 			});
-			if (!response.result || !response.result.ok) return false;
+			if (!response.result || !response.result.ok) return null;
 			const result = response.result.value;
-			const messages = projectHistory(result.events ?? []);
-			sink.push("s2c.history.page", {
+			const page = limitSessionPageMessages(projectHistory(result.events ?? []).filter((message) => message.seq < beforeSeq));
+			return {
 				sessionId,
-				messages,
-				hasMore: Boolean(result.hasMore)
-			});
-			return true;
+				messages: page.messages,
+				hasMore: page.messages.length > 0 && (Boolean(result.hasMore) || page.dropped > 0)
+			};
 		} catch {
-			return false;
+			return null;
 		}
 	}
 	/** Result of one attachment read-back for the phone. */
@@ -1501,466 +2165,217 @@ var HostBridge = class {
 				kind: "internal",
 				message: "prompt returned no result"
 			};
-			if (!response.result.ok) return hostSessionManagementError(response.result.error);
-			const row = this.summaries.get(sessionId);
-			if (row) {
-				row.lastActivityTs = Date.now();
-				this.pushSummary(row);
-			}
-			return {
-				ok: true,
-				value: Date.now()
-			};
-		} catch (error) {
-			return {
-				ok: false,
-				kind: "internal",
-				message: String(error)
-			};
-		}
-	}
-	async respondApproval(requestId, decision, reason) {
-		const pending = this.approvals.get(requestId);
-		if (!pending) return {
-			ok: false,
-			reason: "not-pending"
-		};
-		this.approvals.delete(requestId);
-		const outcome = decision === "allow" ? "allowed-once" : "rejected";
-		const denialReason = typeof reason === "string" ? reason.trim().slice(0, 500) : "";
-		try {
-			const receipt = await this.apiProxy.respond({
-				type: "client-response",
-				rpcId: pending.rpcId,
-				result: {
-					ok: true,
-					value: {
-						sessionId: pending.sessionId,
-						approvalId: requestId,
-						outcome,
-						...denialReason.length > 0 ? { reason: denialReason } : {}
-					}
-				}
-			});
-			if (!Boolean(receipt?.accepted)) {
-				const failure = receiptFailureReason(receipt);
-				if (failure !== "not-pending" && !this.approvals.has(requestId)) this.approvals.set(requestId, pending);
-				return {
-					ok: false,
-					reason: failure
-				};
-			}
-			this.bumpPendingFlags(pending.sessionId);
-			return { ok: true };
-		} catch {
-			if (!this.approvals.has(requestId)) this.approvals.set(requestId, pending);
-			return {
-				ok: false,
-				reason: "transport"
-			};
-		}
-	}
-	async respondQuestion(requestId, answers) {
-		const pending = this.questions.get(requestId);
-		if (!pending) return {
-			ok: false,
-			reason: "not-pending"
-		};
-		this.questions.delete(requestId);
-		try {
-			const receipt = await this.apiProxy.respond({
-				type: "client-response",
-				rpcId: pending.rpcId,
-				result: {
-					ok: true,
-					value: {
-						sessionId: pending.sessionId,
-						answer: { answers: normalizeAnswerItems(answers, pending.questions) }
-					}
-				}
-			});
-			if (!Boolean(receipt?.accepted)) {
-				const failure = receiptFailureReason(receipt);
-				if (failure !== "not-pending" && !this.questions.has(requestId)) this.questions.set(requestId, pending);
-				return {
-					ok: false,
-					reason: failure
-				};
-			}
-			this.bumpPendingFlags(pending.sessionId);
-			return { ok: true };
-		} catch {
-			if (!this.questions.has(requestId)) this.questions.set(requestId, pending);
-			return {
-				ok: false,
-				reason: "transport"
-			};
-		}
-	}
-};
-/**
-* The host validates question answers strictly (core dsh-user-questions via
-* apiProxy): a present-but-empty `custom` fails `matchesQuestions`, and a
-* single-select question rejects `custom` combined with a selection. Clients
-* may send lenient shapes (the phone historically always attached
-* `"custom": ""`, which made EVERY option-only answer fail), so normalize to
-* exactly what the host accepts before forwarding.
-*/
-function normalizeAnswerItems(raw, questions) {
-	if (!Array.isArray(raw)) return [];
-	const askedById = /* @__PURE__ */ new Map();
-	if (Array.isArray(questions)) {
-		for (const q of questions) if (typeof q === "object" && q !== null && typeof q.id === "string") askedById.set(q.id, q);
-	}
-	const items = [];
-	for (const entry of raw) {
-		if (typeof entry !== "object" || entry === null) continue;
-		const r = entry;
-		if (typeof r.id !== "string") continue;
-		const selected = [...new Set(Array.isArray(r.selected) ? r.selected.filter((s) => typeof s === "string") : [])];
-		const customText = typeof r.custom === "string" ? r.custom : "";
-		let custom;
-		if (customText.trim().length > 0) custom = customText;
-		if (custom !== void 0 && selected.length > 0 && askedById.get(r.id)?.multiSelect !== true) custom = void 0;
-		items.push({
-			id: r.id,
-			selected,
-			...custom !== void 0 ? { custom } : {}
-		});
-	}
-	return items;
-}
-/** Map an apiProxy respond receipt onto the failure vocabulary. */
-function receiptFailureReason(receipt) {
-	return receipt?.reason === "not-pending" ? "not-pending" : "bad-response";
-}
-function clampTail(n) {
-	if (!Number.isFinite(n)) return 100;
-	return Math.max(10, Math.min(500, Math.floor(n)));
-}
-function localTimeZone() {
-	try {
-		return new Intl.DateTimeFormat().resolvedOptions().timeZone || void 0;
-	} catch {
-		return;
-	}
-}
-function riskOf(toolName) {
-	if (/bash|pwsh|terminal/.test(toolName)) return "write";
-	if (/edit|write|str_replace|create/.test(toolName)) return "write";
-	if (/delete|remove|kill/.test(toolName)) return "destructive";
-	return "read";
-}
-/** First question's text for the push banner; the questions payload shape is
-* host-version dependent, so extract defensively. */
-function firstQuestionText(questions) {
-	if (!Array.isArray(questions) || questions.length === 0) return "Agent 等待你的输入";
-	const first = questions[0];
-	return String(first?.question ?? "").trim() || "Agent 等待你的输入";
-}
-const TODO_STATUSES = /* @__PURE__ */ new Set([
-	"pending",
-	"in_progress",
-	"completed"
-]);
-/** Validate a host todo projection once; progress counts and the full
-* checklist both derive from this sanitized list so they never disagree. */
-function sanitizeTodoItems(items) {
-	if (!items) return [];
-	return items.map((i) => ({
-		content: String(i.content ?? "").trim(),
-		status: String(i.status ?? "")
-	})).filter((i) => i.content.length > 0 && TODO_STATUSES.has(i.status)).slice(0, 100).map((i) => ({
-		content: i.content,
-		status: i.status
-	}));
-}
-function toSummary(row, approvals, questions, workspace) {
-	const values = row.projections?.values ?? {};
-	const todos = Array.isArray(values.todos) ? values.todos : null;
-	let pendingApproval = false;
-	for (const pending of approvals.values()) if (pending.sessionId === row.sessionId) pendingApproval = true;
-	let pendingQuestion = false;
-	for (const pending of questions.values()) if (pending.sessionId === row.sessionId) pendingQuestion = true;
-	const cwd = typeof row.cwd === "string" ? row.cwd : "";
-	const label = workspace?.title ?? (cwd ? cwd.split("/").filter(Boolean).pop() : void 0);
-	const todoItems = sanitizeTodoItems(todos);
-	return {
-		id: row.sessionId,
-		title: typeof values.title === "string" ? values.title : "",
-		status: row.running ? "running" : row.blank ? "unknown" : "idle",
-		lastActivityTs: Number(row.updatedAt ?? Date.now()),
-		todos: todoItems.length > 0 ? {
-			done: todoItems.filter((i) => i.status === "completed").length,
-			total: todoItems.length
-		} : null,
-		todoItems: todoItems.length > 0 ? todoItems : null,
-		pendingApproval,
-		pendingQuestion,
-		workspaceLabel: label ?? null,
-		workspaceId: workspace?.workspaceId ?? null,
-		workspacePath: workspace?.path ?? (cwd || null)
-	};
-}
-function projectWorkspace(workspace) {
-	return {
-		id: String(workspace.workspaceId),
-		title: String(workspace.title),
-		path: String(workspace.path),
-		sessionIds: (workspace.sessionIds ?? []).map(String)
-	};
-}
-/** Project one raw session event into a protocol push, when it maps to one. */
-function projectEvent(sessionId, event) {
-	switch (event.type) {
-		case "turn/start": return {
-			kind: "turn.start",
-			data: {}
-		};
-		case "turn/end": return {
-			kind: "turn.end",
-			data: { ok: event.data?.reason?.kind === "completed" }
-		};
-		case "user/message": return {
-			kind: "message.final",
-			data: {
-				seq: event.seq,
-				role: userRoleOf(event.data),
-				text: messageText(event.data),
-				...attachmentProjection(event.data),
-				...contextProjectionOf(event.data),
-				ts: tsOf(event)
-			}
-		};
-		case "assistant/chunk":
-			if (chunkTypeOf(event.data) === "reasoning-delta") return {
-				kind: "thinking.delta",
-				data: {
-					text: chunkText(event.data),
-					ts: tsOf(event)
-				}
-			};
-			return {
-				kind: "message.delta",
-				data: {
-					text: chunkText(event.data),
-					ts: tsOf(event)
-				}
-			};
-		case "assistant/message": {
-			const text = messageText(event.data);
-			const thinking = messageThinking(event.data);
-			if (!text.trim() && !thinking.trim()) return null;
+			if (!response.result.ok) return hostSessionManagementError(response.result.error);
+			const row = this.summaries.get(sessionId);
+			if (row) {
+				row.lastActivityTs = Date.now();
+				this.pushSummary(row);
+			}
+			this.userReceiptSeq += 1;
 			return {
-				kind: "message.final",
-				data: {
-					seq: event.seq,
-					role: "assistant",
-					text,
-					...thinking ? { thinking } : {},
-					ts: tsOf(event)
-				}
+				ok: true,
+				value: this.userReceiptSeq
 			};
-		}
-		case "tool/call": {
-			const data = event.data;
+		} catch (error) {
 			return {
-				kind: "tool.start",
-				data: {
-					seq: event.seq,
-					role: "tool",
-					tool: {
-						name: String(data?.name ?? "tool"),
-						state: "running",
-						summary: summarizeArgs(data?.arguments),
-						...data?.callId ? { callId: String(data.callId) } : {}
-					},
-					ts: tsOf(event)
-				}
+				ok: false,
+				kind: "internal",
+				message: String(error)
 			};
 		}
-		case "tool/result": {
-			const data = event.data;
-			return {
-				kind: "tool.end",
-				data: {
-					seq: event.seq,
-					role: "tool",
-					ok: !event.data || data?.error === void 0,
-					...data?.callId ? { callId: String(data.callId) } : {},
-					ts: tsOf(event)
+	}
+	async respondApproval(requestId, decision, reason) {
+		const pending = this.approvals.get(requestId);
+		if (!pending) return {
+			ok: false,
+			reason: "not-pending"
+		};
+		this.approvals.delete(requestId);
+		const outcome = decision === "allow" ? "allowed-once" : "rejected";
+		const denialReason = typeof reason === "string" ? reason.trim().slice(0, 500) : "";
+		try {
+			const receipt = await this.apiProxy.respond({
+				type: "client-response",
+				rpcId: pending.rpcId,
+				result: {
+					ok: true,
+					value: {
+						sessionId: pending.sessionId,
+						approvalId: requestId,
+						outcome,
+						...denialReason.length > 0 ? { reason: denialReason } : {}
+					}
 				}
+			});
+			if (!Boolean(receipt?.accepted)) {
+				const failure = receiptFailureReason(receipt);
+				if (failure !== "not-pending" && !this.approvals.has(requestId)) this.approvals.set(requestId, pending);
+				return {
+					ok: false,
+					reason: failure
+				};
+			}
+			this.bumpPendingFlags(pending.sessionId);
+			return { ok: true };
+		} catch {
+			if (!this.approvals.has(requestId)) this.approvals.set(requestId, pending);
+			return {
+				ok: false,
+				reason: "transport"
 			};
 		}
-		default: return null;
-	}
-}
-function tsOf(event) {
-	return typeof event.time === "number" ? event.time : Date.now();
-}
-/** Read the durable message source off one user/message payload. Handles both
-* bare-message payloads and older `{message: {...}}` wrappers; undefined when
-* the shape carries no readable source (legacy hosts). */
-function userMessageSource(data) {
-	if (!data || typeof data !== "object") return void 0;
-	const obj = data;
-	if (obj.source && typeof obj.source === "object") return obj.source;
-	if (obj.message && typeof obj.message === "object" && obj.message.source && typeof obj.message.source === "object") return obj.message.source;
-}
-/** Wire role for one user/message payload. A payload without any readable
-* source degrades to 'user' so history written by older hosts stays visible;
-* a present source follows the host's own trajectory rule — anything whose
-* `kind` is not 'user' is injected context and projects as 'system'. */
-function userRoleOf(data) {
-	const source = userMessageSource(data);
-	if (!source) return "user";
-	return source.kind === "user" ? "user" : "system";
-}
-/** Producer name of one injected-context source, mirroring how the DSH client
-* runtime derives its trajectory label: plugin name, skill name, instruction
-* paths, session-reference labels, or the raw kind as fallback. */
-function contextLabelOf(source) {
-	const kind = typeof source.kind === "string" ? source.kind : "";
-	const joined = (member) => {
-		const list = source[member];
-		if (!Array.isArray(list)) return void 0;
-		const names = list.flatMap((entry) => {
-			if (!entry || typeof entry !== "object") return [];
-			const record = entry;
-			return [typeof record.label === "string" ? record.label : typeof record.path === "string" ? record.path : ""];
-		}).filter((name) => name.length > 0);
-		return names.length > 0 ? names.join(", ") : void 0;
-	};
-	switch (kind) {
-		case "session-reference": return joined("references") ?? (kind || void 0);
-		case "agent-instructions": return joined("changes") ?? (kind || void 0);
-		case "plugin": return typeof source.plugin === "string" && source.plugin.length > 0 ? source.plugin : kind || void 0;
-		case "skill-invocation": return typeof source.name === "string" && source.name.length > 0 ? source.name : kind || void 0;
-		default: return kind || void 0;
 	}
+	async respondQuestion(requestId, answers) {
+		const pending = this.questions.get(requestId);
+		if (!pending) return {
+			ok: false,
+			reason: "not-pending"
+		};
+		this.questions.delete(requestId);
+		try {
+			const receipt = await this.apiProxy.respond({
+				type: "client-response",
+				rpcId: pending.rpcId,
+				result: {
+					ok: true,
+					value: {
+						sessionId: pending.sessionId,
+						answer: { answers: normalizeAnswerItems(answers, pending.questions) }
+					}
+				}
+			});
+			if (!Boolean(receipt?.accepted)) {
+				const failure = receiptFailureReason(receipt);
+				if (failure !== "not-pending" && !this.questions.has(requestId)) this.questions.set(requestId, pending);
+				return {
+					ok: false,
+					reason: failure
+				};
+			}
+			this.bumpPendingFlags(pending.sessionId);
+			return { ok: true };
+		} catch {
+			if (!this.questions.has(requestId)) this.questions.set(requestId, pending);
+			return {
+				ok: false,
+				reason: "transport"
+			};
+		}
+	}
+};
+/**
+* The host validates question answers strictly (core dsh-user-questions via
+* apiProxy): a present-but-empty `custom` fails `matchesQuestions`, and a
+* single-select question rejects `custom` combined with a selection. Clients
+* may send lenient shapes (the phone historically always attached
+* `"custom": ""`, which made EVERY option-only answer fail), so normalize to
+* exactly what the host accepts before forwarding.
+*/
+function normalizeAnswerItems(raw, questions) {
+	if (!Array.isArray(raw)) return [];
+	const askedById = /* @__PURE__ */ new Map();
+	if (Array.isArray(questions)) {
+		for (const q of questions) if (typeof q === "object" && q !== null && typeof q.id === "string") askedById.set(q.id, q);
+	}
+	const items = [];
+	for (const entry of raw) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const r = entry;
+		if (typeof r.id !== "string") continue;
+		const selected = [...new Set(Array.isArray(r.selected) ? r.selected.filter((s) => typeof s === "string") : [])];
+		const customText = typeof r.custom === "string" ? r.custom : "";
+		let custom;
+		if (customText.trim().length > 0) custom = customText;
+		if (custom !== void 0 && selected.length > 0 && askedById.get(r.id)?.multiSelect !== true) custom = void 0;
+		items.push({
+			id: r.id,
+			selected,
+			...custom !== void 0 ? { custom } : {}
+		});
+	}
+	return items;
 }
-/** Semantic ContextForm declared by the producer ('snapshot', 'notice', …);
-* anything unrecognized stays undefined so clients render it opaque. */
-function contextFormOf(source) {
-	if (typeof source.form !== "string" || source.form.length === 0) return void 0;
-	return [
-		"instructions",
-		"catalog",
-		"snapshot",
-		"notice",
-		"relay",
-		"recall"
-	].includes(source.form) ? source.form : void 0;
-}
-/** Optional `context` metadata for one system row; {} on user rows. */
-function contextProjectionOf(data) {
-	if (userRoleOf(data) !== "system") return {};
-	const source = userMessageSource(data);
-	if (!source) return {};
-	const label = contextLabelOf(source);
-	const form = contextFormOf(source);
-	if (!label && !form) return {};
-	return { context: {
-		...label ? { label } : {},
-		...form ? { form } : {}
-	} };
-}
-/** Extract plain text from user/assistant message payloads across shapes. */
-function messageText(data) {
-	if (typeof data === "string") return data;
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (typeof obj.text === "string") return obj.text;
-	if (obj.message && typeof obj.message === "object") return messageText(obj.message);
-	return contentText(obj.content);
-}
-function contentText(content) {
-	if (typeof content === "string") return content;
-	if (Array.isArray(content)) return content.map((part) => {
-		if (typeof part === "string") return part;
-		if (part && typeof part === "object") {
-			const piece = part;
-			if (piece.type === "text" && typeof piece.text === "string") return piece.text;
-		}
-		return "";
-	}).join("");
-	return "";
-}
-function messageAttachments(data) {
-	if (!data || typeof data !== "object") return [];
-	const obj = data;
-	if (obj.message && typeof obj.message === "object") return messageAttachments(obj.message);
-	if (!Array.isArray(obj.content)) return [];
-	return obj.content.flatMap((part) => {
-		if (!part || typeof part !== "object") return [];
-		const block = part;
-		if (block.type !== "image" || !block.attachment) return [];
-		const attachmentId = typeof block.attachment.attachmentId === "string" && block.attachment.attachmentId.length > 0 ? block.attachment.attachmentId : void 0;
-		const width = typeof block.attachment.width === "number" && Number.isFinite(block.attachment.width) ? block.attachment.width : void 0;
-		const height = typeof block.attachment.height === "number" && Number.isFinite(block.attachment.height) ? block.attachment.height : void 0;
-		return [{
-			kind: "image",
-			...typeof block.attachment.name === "string" ? { name: block.attachment.name } : {},
-			...typeof block.attachment.mediaType === "string" ? { mediaType: block.attachment.mediaType } : {},
-			...attachmentId ? { attachmentId } : {},
-			...width !== void 0 ? { width } : {},
-			...height !== void 0 ? { height } : {}
-		}];
-	});
-}
-function attachmentProjection(data) {
-	const attachments = messageAttachments(data);
-	return attachments.length > 0 ? { attachments } : {};
-}
-/** Extract reasoning ("thinking") text from assistant message payloads. */
-function messageThinking(data) {
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (obj.message && typeof obj.message === "object") return messageThinking(obj.message);
-	return reasoningContent(obj.content);
-}
-function reasoningContent(content) {
-	if (!Array.isArray(content)) return "";
-	return content.map((part) => {
-		if (part && typeof part === "object") {
-			const piece = part;
-			if (piece.type === "reasoning" && typeof piece.text === "string") return piece.text;
-		}
-		return "";
-	}).join("");
-}
-/** Stream chunk type of an assistant/chunk payload ('' when unwrapped). */
-function chunkTypeOf(data) {
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (obj.chunk && typeof obj.chunk === "object") return String(obj.chunk.type ?? "");
-	return "text-delta";
+/** Map an apiProxy respond receipt onto the failure vocabulary. */
+function receiptFailureReason(receipt) {
+	return receipt?.reason === "not-pending" ? "not-pending" : "bad-response";
 }
-function chunkText(data) {
-	if (!data || typeof data !== "object") return "";
-	const obj = data;
-	if (obj.chunk && typeof obj.chunk === "object") {
-		const inner = obj.chunk;
-		if ((inner.type === "text-delta" || inner.type === "reasoning-delta") && typeof inner.text === "string") return inner.text;
-		return "";
-	}
-	const direct = data;
-	return typeof direct.text === "string" ? direct.text : "";
+function clampTail(n) {
+	if (!Number.isFinite(n)) return 100;
+	return Math.max(10, Math.min(500, Math.floor(n)));
 }
-function summarizeArgs(raw) {
-	if (typeof raw !== "string" || raw.length === 0) return "";
+function localTimeZone() {
 	try {
-		const parsed = JSON.parse(raw);
-		const parts = [];
-		for (const [key, value] of Object.entries(parsed)) if (typeof value === "string") parts.push(key + "=" + truncate(value.replace(/\s+/g, " "), 60));
-		return truncate(parts.join(" "), 90);
+		return new Intl.DateTimeFormat().resolvedOptions().timeZone || void 0;
 	} catch {
-		return truncate(raw, 90);
+		return;
 	}
 }
-function truncate(text, max) {
-	return text.length <= max ? text : text.slice(0, max - 1) + "…";
+function riskOf(toolName) {
+	if (/bash|pwsh|terminal/.test(toolName)) return "write";
+	if (/edit|write|str_replace|create/.test(toolName)) return "write";
+	if (/delete|remove|kill/.test(toolName)) return "destructive";
+	return "read";
+}
+/** First question's text for the push banner; the questions payload shape is
+* host-version dependent, so extract defensively. */
+function firstQuestionText(questions) {
+	if (!Array.isArray(questions) || questions.length === 0) return "Agent 等待你的输入";
+	const first = questions[0];
+	return String(first?.question ?? "").trim() || "Agent 等待你的输入";
+}
+const TODO_STATUSES = /* @__PURE__ */ new Set([
+	"pending",
+	"in_progress",
+	"completed"
+]);
+/** Validate a host todo projection once; progress counts and the full
+* checklist both derive from this sanitized list so they never disagree. */
+function sanitizeTodoItems(items) {
+	if (!items) return [];
+	return items.map((i) => ({
+		content: String(i.content ?? "").trim(),
+		status: String(i.status ?? "")
+	})).filter((i) => i.content.length > 0 && TODO_STATUSES.has(i.status)).slice(0, 100).map((i) => ({
+		content: i.content,
+		status: i.status
+	}));
+}
+function toSummary(row, approvals, questions, workspace) {
+	const values = row.projections?.values ?? {};
+	const todos = Array.isArray(values.todos) ? values.todos : null;
+	let pendingApproval = false;
+	for (const pending of approvals.values()) if (pending.sessionId === row.sessionId) pendingApproval = true;
+	let pendingQuestion = false;
+	for (const pending of questions.values()) if (pending.sessionId === row.sessionId) pendingQuestion = true;
+	const cwd = typeof row.cwd === "string" ? row.cwd : "";
+	const label = workspace?.title ?? (cwd ? cwd.split("/").filter(Boolean).pop() : void 0);
+	const todoItems = sanitizeTodoItems(todos);
+	return {
+		id: row.sessionId,
+		title: typeof values.title === "string" ? values.title : "",
+		status: row.running ? "running" : "idle",
+		lastActivityTs: Number(row.updatedAt ?? Date.now()),
+		todos: todoItems.length > 0 ? {
+			done: todoItems.filter((i) => i.status === "completed").length,
+			total: todoItems.length
+		} : null,
+		todoItems: todoItems.length > 0 ? todoItems : null,
+		pendingApproval,
+		pendingQuestion,
+		workspaceLabel: label ?? null,
+		workspaceId: workspace?.workspaceId ?? null,
+		workspacePath: workspace?.path ?? (cwd || null)
+	};
+}
+function projectWorkspace(workspace) {
+	return {
+		id: String(workspace.workspaceId),
+		title: String(workspace.title),
+		path: String(workspace.path),
+		sessionIds: (workspace.sessionIds ?? []).map(String)
+	};
 }
+/** Project one raw session event into a protocol push, when it maps to one. */
 function hostModelError(error) {
 	const message = error.message ?? error.code;
 	switch (error.code) {
@@ -2061,80 +2476,364 @@ function projectSessionModels(value) {
 	};
 }
 /** Project a history page (raw events) into MessageProjection rows. */
-function projectHistory(events) {
-	const messages = [];
-	const toolByCall = /* @__PURE__ */ new Map();
-	for (const entry of events) {
-		const event = entry.event;
-		const base = {
-			seq: event.seq,
-			ts: tsOf(event)
+//#endregion
+//#region src/dsh012-api-proxy.ts
+/**
+* Compatibility façade for the DSH 0.1.2 controller API.
+*
+* DeepPilot's phone protocol deliberately speaks one stable in-process
+* `apiProxy` vocabulary. Harness 0.1.2 removed that service in favor of
+* direct Session/Workspace controllers plus scoped Cordis interaction events.
+* This adapter rebuilds the small subset the bridge needs from those public
+* controllers, keeping the protocol implementation isolated from the Host API
+* migration. It is intentionally Host-only.
+*/
+/** Direct-controller facade with the exact legacy shape HostBridge consumes. */
+var Dsh012ApiProxy = class {
+	ctx;
+	session;
+	workspaceController;
+	directoryPicker;
+	interactions = /* @__PURE__ */ new Map();
+	constructor(ctx) {
+		this.ctx = ctx;
+		const session = ctx.get("sessionController");
+		if (session === void 0) throw new Error("dsh 0.1.2 sessionController is unavailable");
+		this.session = session;
+		this.workspaceController = ctx.get("workspaceController");
+		this.directoryPicker = ctx.get("directoryPickerController");
+	}
+	sessions = {
+		list: async () => this.call(async () => {
+			return { items: (await this.session.list({}, new AbortController().signal)).items.map(toPhoneSessionRow).filter((row) => !isSubagentRow(row)) };
+		}),
+		history: async (request) => this.call(async () => {
+			const sessionId = request.payload.sessionId;
+			let inspected;
+			try {
+				inspected = await this.session.inspect(sessionId);
+			} catch (error) {
+				console.warn(`[deeppilot] session history unavailable for ${JSON.stringify(sessionId)}: ${toError(error).code}: ${toError(error).message}`);
+				throw error;
+			}
+			const before = request.payload?.beforeSeq;
+			const limit = Math.max(1, request.payload?.maxMessages ?? 100);
+			const source = inspected.events.filter((event) => typeof event === "object" && event !== null && typeof event.type === "string" && typeof event.seq === "number").filter((event) => before === void 0 || event.seq < before);
+			let end = source.length;
+			let events = [];
+			while (end > 0 && projectHistory(events).length < limit) {
+				const start = Math.max(0, end - limit);
+				events = [...source.slice(start, end).map((event) => ({ event })), ...events];
+				end = start;
+			}
+			let trimmed = false;
+			while (events.length > 0 && projectHistory(events).length > limit) {
+				events = events.slice(1);
+				trimmed = true;
+			}
+			return {
+				events,
+				hasMore: end > 0 || trimmed
+			};
+		}),
+		prompt: async (request) => this.call(() => this.session.prompt({
+			...request.payload,
+			requestId: request.rpcId ?? randomUUID()
+		}, new AbortController().signal)),
+		create: async (request) => this.call(() => this.session.create(request.payload ?? {})),
+		models: async (request) => this.call(async () => projectModels(await this.session.modelCatalog(), String(request.payload?.sessionId ?? ""), await this.session.list({}, new AbortController().signal))),
+		selectModel: async (request) => this.call(() => this.session.selectModel(request.payload ?? {})),
+		rename: async (request) => this.call(() => this.session.rename(request.payload)),
+		cancel: async (request) => this.call(() => this.session.cancel(request.payload)),
+		attachment: async (request) => this.call(() => this.session.attachment(request.payload))
+	};
+	workspace = {
+		list: async () => this.call(async () => {
+			if (this.workspaceController === void 0) throw unavailable("workspace controller unavailable");
+			const baseline = await readWorkspaceBaseline(this.workspaceController);
+			return {
+				items: baseline.items.map(toWorkspaceView),
+				archivedSessionIds: baseline.archivedSessionIds.map(String)
+			};
+		}),
+		create: async (request) => this.call(async () => {
+			if (this.workspaceController === void 0) throw unavailable("workspace controller unavailable");
+			const value = await this.workspaceController.create(request.payload);
+			return {
+				workspace: toWorkspaceView(value.workspace),
+				created: value.created === true
+			};
+		}),
+		archiveSession: async (request) => this.call(async () => {
+			if (this.workspaceController === void 0) throw unavailable("workspace controller unavailable");
+			return { archivedSessionIds: [...(await this.workspaceController.archiveSession(request.payload)).archivedSessionIds] };
+		})
+	};
+	host = {
+		listDirectory: async (request, signal) => this.call(async () => {
+			if (this.directoryPicker === void 0) throw unavailable("directory picker unavailable");
+			return await this.directoryPicker.list(request.payload?.path, signal ?? new AbortController().signal);
+		}),
+		pickDirectory: async (_request, signal) => this.call(async () => {
+			if (this.directoryPicker === void 0) throw unavailable("directory picker unavailable");
+			return { path: await this.directoryPicker.pick(signal ?? new AbortController().signal) };
+		})
+	};
+	events = {
+		mux: (_request, signal) => this.mux(signal),
+		host: (_request, signal) => this.hostEvents(signal)
+	};
+	async respond(message) {
+		const pending = this.interactions.get(message.rpcId);
+		if (pending === void 0) return {
+			accepted: false,
+			reason: "not-pending"
 		};
-		switch (event.type) {
-			case "user/message":
-				messages.push({
-					...base,
-					role: userRoleOf(event.data),
-					text: messageText(event.data),
-					...attachmentProjection(event.data),
-					...contextProjectionOf(event.data)
+		if (!message.result.ok) return {
+			accepted: false,
+			reason: "bad-response"
+		};
+		this.interactions.delete(message.rpcId);
+		pending.resolve(pending.map(message.result.value));
+		return { accepted: true };
+	}
+	async *mux(signal) {
+		const queue = new AsyncFrameQueue(signal);
+		const offEvent = this.ctx.on("session/event", ((session, event) => {
+			queue.push({
+				type: "session/event",
+				sessionId: String(session.id),
+				event
+			});
+		}), { global: true });
+		const offProjection = this.ctx.get("sessionProjections")?.onChanged?.((session, key, value) => {
+			queue.push({
+				type: "session/projection",
+				sessionId: String(session.id),
+				key,
+				value
+			});
+		});
+		const offApproval = this.ctx.on("approval/request", ((request) => {
+			const rpcId = randomUUID();
+			const sessionId = String(request.agent?.session?.id ?? request.agent?.id ?? "");
+			const response = deferred();
+			const abort = () => response.resolve("cancelled");
+			request.signal?.addEventListener("abort", abort, { once: true });
+			this.interactions.set(rpcId, {
+				resolve: response.resolve,
+				map: (value) => {
+					const outcome = value?.outcome;
+					return outcome === "allowed-once" || outcome === "rejected" ? outcome : "unavailable";
+				}
+			});
+			queue.push({
+				type: "approval/requested",
+				rpcId,
+				sessionId,
+				approvalId: rpcId,
+				toolName: String(request.toolName ?? "tool"),
+				reason: String(request.reason ?? "")
+			});
+			return response.promise.finally(() => {
+				request.signal?.removeEventListener("abort", abort);
+				this.interactions.delete(rpcId);
+				queue.push({
+					type: "approval/resolved",
+					approvalId: rpcId
 				});
-				break;
-			case "assistant/message": {
-				const text = messageText(event.data);
-				const thinking = messageThinking(event.data);
-				if (!text.trim() && !thinking.trim()) break;
-				messages.push({
-					...base,
-					role: "assistant",
-					text,
-					...thinking ? { thinking } : {}
+			});
+		}), { global: true });
+		const offQuestion = this.ctx.on("user-questions/request", ((request) => {
+			const rpcId = randomUUID();
+			const sessionId = String(request.agent?.session?.id ?? request.agent?.id ?? "");
+			const response = deferred();
+			const abort = () => response.reject(/* @__PURE__ */ new Error("question cancelled"));
+			request.signal?.addEventListener("abort", abort, { once: true });
+			this.interactions.set(rpcId, {
+				resolve: response.resolve,
+				map: (value) => value?.answer ?? value
+			});
+			queue.push({
+				type: "question/requested",
+				rpcId,
+				sessionId,
+				questions: request.questions ?? []
+			});
+			return response.promise.finally(() => {
+				request.signal?.removeEventListener("abort", abort);
+				this.interactions.delete(rpcId);
+				queue.push({
+					type: "question/resolved",
+					questionRpcId: rpcId
 				});
-				break;
-			}
-			case "tool/call": {
-				const data = event.data;
-				const row = {
-					...base,
-					role: "tool",
-					tool: {
-						name: String(data?.name ?? "tool"),
-						state: "running",
-						summary: summarizeArgs(data?.arguments)
-					}
-				};
-				messages.push(row);
-				if (data?.callId) toolByCall.set(String(data.callId), row);
-				break;
-			}
-			case "tool/result": {
-				const data = event.data;
-				const callId = data?.callId ? String(data.callId) : void 0;
-				const target = callId ? toolByCall.get(callId) : void 0;
-				const failed = data?.error !== void 0;
-				const summary = failed ? "失败" : summarizeResult(data?.message?.content);
-				if (target?.tool) target.tool = {
-					...target.tool,
-					state: failed ? "error" : "ok",
-					summary
-				};
-				else messages.push({
-					...base,
-					role: "tool",
-					tool: {
-						name: "result",
-						state: failed ? "error" : "ok",
-						summary
-					}
+			});
+		}), { global: true });
+		try {
+			yield* queue.iterate();
+		} finally {
+			offEvent();
+			offProjection?.();
+			offApproval();
+			offQuestion();
+			queue.close();
+		}
+	}
+	async *hostEvents(signal) {
+		const queue = new AsyncFrameQueue(signal);
+		const listen = (event, type, project) => this.ctx.on(event, ((...args) => queue.push({
+			type,
+			...project?.(...args) ?? {}
+		})), { global: true });
+		const off = [
+			listen("api-session/added", "host/session-added"),
+			listen("api-session/removed", "host/session-removed"),
+			listen("api-session/status", "host/session-status", (sessionId, running) => ({
+				sessionId: String(sessionId),
+				running: running === true
+			})),
+			listen("api-session/activity", "host/session-added")
+		];
+		const workspaceAbort = new AbortController();
+		const stop = () => workspaceAbort.abort();
+		signal.addEventListener("abort", stop, { once: true });
+		this.workspaceController === void 0 || (async () => {
+			try {
+				for await (const frame of this.workspaceController.follow(workspaceAbort.signal)) if (frame.type === "archived") queue.push({
+					type: "host/archived-sessions-changed",
+					archivedSessionIds: frame.archivedSessionIds
 				});
-				break;
+				else if (frame.type !== "baseline") queue.push({ type: "host/workspace-changed" });
+			} catch {}
+		})();
+		try {
+			yield* queue.iterate();
+		} finally {
+			for (const dispose of off) dispose();
+			signal.removeEventListener("abort", stop);
+			workspaceAbort.abort();
+			queue.close();
+		}
+	}
+	async call(invoke) {
+		try {
+			return { result: {
+				ok: true,
+				value: await invoke()
+			} };
+		} catch (error) {
+			return { result: {
+				ok: false,
+				error: toError(error)
+			} };
+		}
+	}
+};
+function deferred() {
+	let resolve;
+	let reject;
+	return {
+		promise: new Promise((ok, fail) => {
+			resolve = ok;
+			reject = fail;
+		}),
+		resolve,
+		reject
+	};
+}
+var AsyncFrameQueue = class {
+	frames = [];
+	wake;
+	closed = false;
+	constructor(signal) {
+		signal.addEventListener("abort", () => this.close(), { once: true });
+	}
+	push(frame) {
+		if (!this.closed) {
+			this.frames.push(frame);
+			this.wake?.();
+		}
+	}
+	close() {
+		if (!this.closed) {
+			this.closed = true;
+			this.wake?.();
+		}
+	}
+	async *iterate() {
+		while (!this.closed) {
+			const frame = this.frames.shift();
+			if (frame !== void 0) {
+				yield frame;
+				continue;
 			}
+			await new Promise((resolve) => {
+				this.wake = resolve;
+			});
+			this.wake = void 0;
 		}
 	}
-	return messages.sort((a, b) => a.seq - b.seq);
+};
+function unavailable(message) {
+	return Object.assign(new Error(message), { code: "directory-picker-unavailable" });
 }
-function summarizeResult(content) {
-	return truncate(contentText(content).replace(/\s+/g, " ").trim(), 90);
+function toError(error) {
+	const value = error;
+	return {
+		code: typeof value?.code === "string" ? value.code : "internal",
+		message: typeof value?.message === "string" ? value.message : String(error)
+	};
+}
+function toPhoneSessionRow(value) {
+	const row = value;
+	return {
+		sessionId: String(row.sessionId ?? ""),
+		updatedAt: Number(row.updatedAt ?? Date.now()),
+		running: row.running === true,
+		...row.blank === true ? { blank: true } : {},
+		...typeof row.cwd === "string" ? { cwd: row.cwd } : {},
+		...typeof row.origin === "string" ? { origin: row.origin } : {},
+		...typeof row.parentSessionId === "string" ? { parentSessionId: row.parentSessionId } : {},
+		...row.projections && typeof row.projections === "object" ? { projections: row.projections } : {}
+	};
+}
+function toWorkspaceView(value) {
+	const row = value;
+	return {
+		workspaceId: String(row.workspaceId ?? ""),
+		title: String(row.title ?? ""),
+		path: String(row.path ?? ""),
+		sessionIds: Array.isArray(row.sessionIds) ? row.sessionIds.map(String) : []
+	};
+}
+async function readWorkspaceBaseline(controller) {
+	const abort = new AbortController();
+	const iterator = controller.follow(abort.signal)[Symbol.asyncIterator]();
+	try {
+		const baseline = (await iterator.next()).value;
+		if (baseline?.type !== "baseline") throw new Error("workspace follow did not provide a baseline");
+		return {
+			items: (baseline.value?.items ?? []).map(toWorkspaceView),
+			archivedSessionIds: (baseline.value?.archivedSessionIds ?? []).map(String)
+		};
+	} finally {
+		abort.abort();
+		await iterator.return?.();
+	}
+}
+async function projectModels(catalog, sessionId, list) {
+	const value = catalog;
+	const selected = (list.items.map(toPhoneSessionRow).find((item) => item.sessionId === sessionId)?.projections?.values?.modelSelection)?.next;
+	return {
+		current: {
+			provider: String(selected?.provider ?? value.default?.provider ?? ""),
+			model: String(selected?.model ?? value.default?.model ?? ""),
+			...typeof selected?.reasoningEffort === "string" ? { reasoningEffort: selected.reasoningEffort } : {}
+		},
+		routable: true,
+		groups: Array.isArray(value.groups) ? value.groups : [],
+		failures: Array.isArray(value.failures) ? value.failures : []
+	};
 }
 //#endregion
 //#region src/report-service.ts
@@ -2145,26 +2844,31 @@ function summarizeResult(content) {
 */
 var DeepPilotReportService = class extends TypertRemoteService {
 	snapshot;
-	pairingToken;
-	rotatePairingToken;
+	pairingStarter;
+	deviceRevoker;
+	deviceScopeUpdater;
 	relayTester;
 	pushTester;
-	constructor(ctx, snapshot, pairingToken, rotatePairingToken, relayTester, pushTester) {
+	constructor(ctx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester) {
 		super(ctx, "deeppilotReport", { namespace: "deeppilot" });
 		this.snapshot = snapshot;
-		this.pairingToken = pairingToken;
-		this.rotatePairingToken = rotatePairingToken;
+		this.pairingStarter = pairingStarter;
+		this.deviceRevoker = deviceRevoker;
+		this.deviceScopeUpdater = deviceScopeUpdater;
 		this.relayTester = relayTester;
 		this.pushTester = pushTester;
 	}
 	async report() {
 		return this.snapshot();
 	}
-	async revealToken() {
-		return this.pairingToken();
+	async beginPairing() {
+		return this.pairingStarter();
 	}
-	async rotateToken() {
-		return this.rotatePairingToken();
+	async revokeDevice(deviceId) {
+		return this.deviceRevoker(deviceId);
+	}
+	async setDeviceScopes(deviceId, scopes) {
+		return this.deviceScopeUpdater(deviceId, scopes);
 	}
 	async testRelay() {
 		return this.relayTester();
@@ -2179,14 +2883,9 @@ var DeepPilotReportService = class extends TypertRemoteService {
 const REPORT_REMOTE_PACKAGE = "dsh-deeppilot";
 /** Canonical `<namespace>/<method>` endpoint of the report Remote. */
 const REPORT_ENDPOINT = "deeppilot/report";
-/** Explicit, user-triggered endpoint for revealing the pairing secret. */
-const REVEAL_TOKEN_ENDPOINT = "deeppilot/revealToken";
-/**
-* Explicit, user-triggered endpoint that replaces the pairing secret. The old
-* token stops working immediately; the fresh one is returned so the page can
-* show/QR it right away.
-*/
-const ROTATE_TOKEN_ENDPOINT = "deeppilot/rotateToken";
+const BEGIN_PAIRING_ENDPOINT = "deeppilot/beginPairing";
+const REVOKE_DEVICE_ENDPOINT = "deeppilot/revokeDevice";
+const SET_DEVICE_SCOPES_ENDPOINT = "deeppilot/setDeviceScopes";
 function reject(field) {
 	throw new TypeError(`deeppilot/report result: invalid ${field}`);
 }
@@ -2195,9 +2894,16 @@ function str(source, key, field) {
 	if (typeof value !== "string") reject(field);
 	return value;
 }
-function num(source, key, field) {
+/**
+* Non-negative integer: counters and timestamps (activeConnections,
+* historyBufferMax, updatedAt, lastSeenTs, protocolVersion, etc.). A bare
+* `typeof number` check accepts 1.5, -1, and 1e20 — all of which then
+* surface verbatim on the settings page and break any sort or arithmetic
+* the UI does.
+*/
+function int(source, key, field) {
 	const value = source[key];
-	if (typeof value !== "number" || !Number.isFinite(value)) reject(field);
+	if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value < 0) reject(field);
 	return value;
 }
 function bool(source, key, field) {
@@ -2218,15 +2924,18 @@ function parseDevice(value) {
 		if (environment !== "development" && environment !== "production") reject("device.apns.environment");
 		apns = {
 			environment,
-			updatedAt: num(a, "updatedAt", "device.apns.updatedAt")
+			updatedAt: int(a, "updatedAt", "device.apns.updatedAt")
 		};
 	}
 	return {
 		deviceId: str(s, "deviceId", "device.deviceId"),
 		deviceName: str(s, "deviceName", "device.deviceName"),
 		appVersion: str(s, "appVersion", "device.appVersion"),
-		firstSeenTs: num(s, "firstSeenTs", "device.firstSeenTs"),
-		lastSeenTs: num(s, "lastSeenTs", "device.lastSeenTs"),
+		firstSeenTs: int(s, "firstSeenTs", "device.firstSeenTs"),
+		lastSeenTs: int(s, "lastSeenTs", "device.lastSeenTs"),
+		fingerprint: str(s, "fingerprint", "device.fingerprint"),
+		scopes: normalizeDeviceScopes(s.scopes),
+		...s.revokedAt !== void 0 ? { revokedAt: int(s, "revokedAt", "device.revokedAt") } : {},
 		...apns ? { apns } : {}
 	};
 }
@@ -2256,7 +2965,7 @@ function parseRemote(value) {
 		...typeof publicURL === "string" ? { publicURL } : {},
 		...typeof authURL === "string" ? { authURL } : {},
 		...typeof message === "string" ? { message } : {},
-		updatedAt: num(s, "updatedAt", "remote.updatedAt")
+		updatedAt: int(s, "updatedAt", "remote.updatedAt")
 	};
 }
 function parseRelayTestStep(value) {
@@ -2264,7 +2973,9 @@ function parseRelayTestStep(value) {
 	const id = str(st, "id", "step.id");
 	if (id !== "health" && id !== "enroll") reject("step.id");
 	const latencyMs = st.latencyMs;
-	if (latencyMs !== void 0 && typeof latencyMs !== "number") reject("step.latencyMs");
+	if (latencyMs !== void 0) {
+		if (typeof latencyMs !== "number" || !Number.isFinite(latencyMs) || !Number.isInteger(latencyMs) || latencyMs < 0) reject("step.latencyMs");
+	}
 	return {
 		id,
 		ok: bool(st, "ok", "step.ok"),
@@ -2307,7 +3018,7 @@ function parsePushTestResult(value) {
 			environment: str(r, "environment", "result.environment"),
 			outcome: str(r, "outcome", "result.outcome"),
 			...typeof reason === "string" && reason.length > 0 ? { reason } : {},
-			...typeof tokenFingerprint === "string" && /^[0-9a-f]{1,32}$/.test(tokenFingerprint) ? { tokenFingerprint } : {}
+			...typeof tokenFingerprint === "string" && /^[0-9a-f]{10}$/.test(tokenFingerprint) ? { tokenFingerprint } : {}
 		};
 	});
 	const message = s.message;
@@ -2326,16 +3037,16 @@ function parseReport(value) {
 	if (!Array.isArray(lanAddresses) || lanAddresses.some((value) => typeof value !== "string")) reject("lanAddresses");
 	const releaseUrl = s.releaseUrl;
 	return {
-		protocolVersion: num(s, "protocolVersion", "protocolVersion"),
+		protocolVersion: int(s, "protocolVersion", "protocolVersion"),
 		serverVersion: str(s, "serverVersion", "serverVersion"),
 		pluginVersion: str(s, "pluginVersion", "pluginVersion"),
 		...s.updateAvailable === true ? { updateAvailable: true } : {},
 		...typeof releaseUrl === "string" && releaseUrl.length > 0 ? { releaseUrl } : {},
 		enabled: bool(s, "enabled", "enabled"),
-		tokenPath: str(s, "tokenPath", "tokenPath"),
-		tokenReady: bool(s, "tokenReady", "tokenReady"),
-		activeConnections: num(s, "activeConnections", "activeConnections"),
-		historyBufferMax: num(s, "historyBufferMax", "historyBufferMax"),
+		identityPath: str(s, "identityPath", "identityPath"),
+		pairingReady: bool(s, "pairingReady", "pairingReady"),
+		activeConnections: int(s, "activeConnections", "activeConnections"),
+		historyBufferMax: int(s, "historyBufferMax", "historyBufferMax"),
 		debug: bool(s, "debug", "debug"),
 		lanAddresses,
 		remote: parseRemote(s.remote),
@@ -2345,14 +3056,33 @@ function parseReport(value) {
 const reportSchema = { parse: parseReport };
 const relayTestSchema = { parse: parseRelayTestResult };
 const pushTestSchema = { parse: parsePushTestResult };
-const pairingTokenSchema = { parse(value) {
-	if (typeof value !== "string" || value.length < 32) throw new TypeError("deeppilot/revealToken result: invalid token");
+const pairingGrantSchema = { parse(value) {
+	const s = rec(value, "pairing grant");
+	const code = str(s, "code", "pairingGrant.code");
+	if (code.length < 32) reject("pairingGrant.code");
+	return {
+		code,
+		expiresAt: int(s, "expiresAt", "pairingGrant.expiresAt"),
+		audience: str(s, "audience", "pairingGrant.audience")
+	};
+} };
+const deviceIdSchema = { parse(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value)) reject("deviceId");
 	return value;
 } };
+const scopesSchema = { parse(value) {
+	if (!Array.isArray(value) || value.some((scope) => typeof scope !== "string" || !DEVICE_SCOPES.includes(scope))) reject("scopes");
+	return normalizeDeviceScopes(value);
+} };
 const REPORT_HOST_CONTRIBUTION = {
 	package: REPORT_REMOTE_PACKAGE,
 	face: "host",
 	schemas: [],
+	model: {
+		services: [],
+		events: [],
+		objects: []
+	},
 	invocations: [
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#${REPORT_ENDPOINT}`,
@@ -2368,29 +3098,72 @@ const REPORT_HOST_CONTRIBUTION = {
 			}
 		},
 		{
-			id: `${REPORT_REMOTE_PACKAGE}#${REVEAL_TOKEN_ENDPOINT}`,
+			id: `${REPORT_REMOTE_PACKAGE}#${BEGIN_PAIRING_ENDPOINT}`,
 			service: "deeppilotReport",
 			namespace: "deeppilot",
-			method: "revealToken",
+			method: "beginPairing",
 			invocation: { kind: "direct" },
 			parameters: [],
 			result: {
 				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PairingToken`,
-				schema: pairingTokenSchema
+				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PairingGrantSnapshot`,
+				schema: pairingGrantSchema
 			}
 		},
 		{
-			id: `${REPORT_REMOTE_PACKAGE}#${ROTATE_TOKEN_ENDPOINT}`,
+			id: `${REPORT_REMOTE_PACKAGE}#${REVOKE_DEVICE_ENDPOINT}`,
 			service: "deeppilotReport",
 			namespace: "deeppilot",
-			method: "rotateToken",
+			method: "revokeDevice",
 			invocation: { kind: "direct" },
-			parameters: [],
+			parameters: [{
+				name: "deviceId",
+				wire: "deviceId",
+				source: "json",
+				codec: {
+					mode: "strict",
+					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceId`,
+					schema: deviceIdSchema
+				}
+			}],
+			result: {
+				mode: "strict",
+				typeSymbol: `${REPORT_REMOTE_PACKAGE}#Boolean`,
+				schema: { parse(value) {
+					if (typeof value !== "boolean") reject("boolean");
+					return value;
+				} }
+			}
+		},
+		{
+			id: `${REPORT_REMOTE_PACKAGE}#${SET_DEVICE_SCOPES_ENDPOINT}`,
+			service: "deeppilotReport",
+			namespace: "deeppilot",
+			method: "setDeviceScopes",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "deviceId",
+				wire: "deviceId",
+				source: "json",
+				codec: {
+					mode: "strict",
+					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceId`,
+					schema: deviceIdSchema
+				}
+			}, {
+				name: "scopes",
+				wire: "scopes",
+				source: "json",
+				codec: {
+					mode: "strict",
+					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceScopes`,
+					schema: scopesSchema
+				}
+			}],
 			result: {
 				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PairingToken`,
-				schema: pairingTokenSchema
+				typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceScopes`,
+				schema: scopesSchema
 			}
 		},
 		{
@@ -2427,9 +3200,9 @@ const REPORT_HOST_CONTRIBUTION = {
 * Provide the report service and register its Remote descriptor. Rides an
 * optional `typert` inject: profiles without the web stack never activate it.
 */
-function applyReportRemote(ctx, snapshot, pairingToken, rotatePairingToken, relayTester, pushTester) {
+function applyReportRemote(ctx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester) {
 	ctx.inject(["typert"], (remoteCtx) => {
-		new DeepPilotReportService(remoteCtx, snapshot, pairingToken, rotatePairingToken, relayTester, pushTester);
+		new DeepPilotReportService(remoteCtx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester);
 		const unregister = remoteCtx.typert.register(REPORT_HOST_CONTRIBUTION);
 		remoteCtx.effect(() => () => void unregister(), "dsh-deeppilot: report remote");
 	});
@@ -2541,10 +3314,9 @@ async function runRelayProbe(options) {
 			});
 		}
 	}
-	const executed = steps.filter((step) => step.ok !== void 0);
 	return {
 		url: base,
-		overall: steps.length > 0 && steps.some((step) => step.id === "health" && step.ok) && executed.every((step) => step.ok) ? "ok" : "failed",
+		overall: steps.length > 0 && steps.some((step) => step.id === "health" && step.ok) && steps.every((step) => step.ok) ? "ok" : "failed",
 		tokenIssued,
 		steps
 	};
@@ -2566,6 +3338,10 @@ async function runRelayProbe(options) {
 * Privacy: logs carry outcomes and masked token prefixes only — never message
 * bodies or full tokens.
 */
+/** Classify Apple's reason without losing recoverable configuration errors. */
+function classifyApnsReason(reason) {
+	return reason === "Unregistered" || reason === "ExpiredToken" ? "invalid-token" : "failed";
+}
 const PROVIDER_TOKEN_TTL_MS = 3e6;
 const REQUEST_TIMEOUT_MS = 1e4;
 /** base64url without padding. */
@@ -2606,7 +3382,10 @@ function apnsPayload(notification) {
 }
 /** collapse-id accepts ≤64 bytes of ASCII; keep it stable per session+event. */
 function collapseIdFor(notification) {
-	return `${notification.category}:${notification.sessionId}`.replace(/[^a-zA-Z0-9.:-]/g, "").slice(0, 64);
+	const raw = `${notification.category}:${notification.sessionId}`;
+	const readable = raw.replace(/[^a-zA-Z0-9.:-]/g, "");
+	const digest = createHash("sha256").update(raw, "utf8").digest("hex").slice(0, 12);
+	return `${readable.slice(0, 51)}:${digest}`;
 }
 function authorityFor(environment) {
 	return environment === "production" ? "api.push.apple.com" : "api.sandbox.push.apple.com";
@@ -2721,7 +3500,8 @@ var ApnsClient = class {
 						reason = String(JSON.parse(responseBody).reason ?? "");
 					} catch {}
 					if (status !== 200 && !reason) reason = "HTTP " + String(status);
-					if (reason === "Unregistered" || reason === "BadDeviceToken") return settle("invalid-token", reason);
+					const outcome = classifyApnsReason(reason);
+					if (outcome === "invalid-token") return settle(outcome, reason);
 					if (this.debug) this.log(`apns rejected status=${status} reason=${reason}`);
 					settle("failed", reason);
 				});
@@ -2840,6 +3620,9 @@ var RelayClient = class {
 		}
 	}
 };
+function normalizeFunnelConnectionLimit(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 16 ? value : 8;
+}
 //#endregion
 //#region src/remote-supervisor.ts
 const RESTART_DELAYS_MS = [
@@ -2850,6 +3633,14 @@ const RESTART_DELAYS_MS = [
 	16e3,
 	3e4
 ];
+/**
+* Throttle for configuration-level failures (helper binary missing, state dir
+* unwritable). The environment will not self-heal between attempts, so the
+* previous "1s..30s exponential" backoff was a CPU/for-loop on a misconfigured
+* Host. 60s matches the APNs sender-failure throttle on the host plugin
+* (index.ts SENDER_FAILURE_RETRY_MS) and the relay enrollment throttle.
+*/
+const UNAVAILABLE_RETRY_MS = 6e4;
 const DEFAULT_REMOTE_HOSTNAME = "dsh-deeppilot";
 /** Preserve custom node names while migrating every pre-DeepPilot default. */
 function normalizeRemoteHostname(value) {
@@ -2861,6 +3652,20 @@ function normalizeRemoteHostname(value) {
 	].includes(hostname.toLowerCase())) return DEFAULT_REMOTE_HOSTNAME;
 	return hostname;
 }
+function tunnelHelperArguments(originURL, statePath, options) {
+	return [
+		"--origin",
+		originURL,
+		"--hostname",
+		normalizeRemoteHostname(options.hostname),
+		"--state-dir",
+		statePath,
+		"--port",
+		String(options.funnelPort ?? 443),
+		"--max-connections-per-source",
+		String(normalizeFunnelConnectionLimit(options.maxConnectionsPerSource))
+	];
+}
 /** Parse one helper IPC line without ever evaluating or interpolating it. */
 function parseHelperEvent(line) {
 	try {
@@ -2882,6 +3687,15 @@ function parseHelperEvent(line) {
 		return null;
 	}
 }
+function isTailscaleAuthURL(value) {
+	if (!value) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && (url.hostname === "login.tailscale.com" || url.hostname.endsWith(".login.tailscale.com"));
+	} catch {
+		return false;
+	}
+}
 /** Translate Node's platform/architecture names to the GOOS/GOARCH directory
 *  names used by the committed helper matrix. */
 function bundledHelperPlatformDir(platform = process.platform, arch = process.arch) {
@@ -2953,6 +3767,7 @@ var RemoteSupervisor = class {
 				phase: "unavailable",
 				message
 			});
+			this.scheduleRestart(originURL, "unavailable");
 			return;
 		}
 		try {
@@ -2966,6 +3781,7 @@ var RemoteSupervisor = class {
 				phase: "unavailable",
 				message: `cannot create remote state dir: ${String(error)}`
 			});
+			this.scheduleRestart(originURL, "unavailable");
 			return;
 		}
 		if (this.stopping) return;
@@ -2973,16 +3789,7 @@ var RemoteSupervisor = class {
 			phase: "starting",
 			message: void 0
 		});
-		const child = spawn(helper, [
-			"--origin",
-			originURL,
-			"--hostname",
-			normalizeRemoteHostname(this.options.hostname),
-			"--state-dir",
-			statePath,
-			"--port",
-			String(this.options.funnelPort ?? 443)
-		], {
+		const child = spawn(helper, tunnelHelperArguments(originURL, statePath, this.options), {
 			stdio: [
 				"ignore",
 				"pipe",
@@ -3035,7 +3842,7 @@ var RemoteSupervisor = class {
 				phase: "error",
 				message: detail || `helper exited (${signal ?? String(code)})`
 			});
-			this.scheduleRestart(originURL);
+			this.scheduleRestart(originURL, "crash");
 		});
 	}
 	async dispose() {
@@ -3069,20 +3876,24 @@ var RemoteSupervisor = class {
 	acceptLine(line) {
 		const event = parseHelperEvent(line);
 		if (event === null || event.phase === void 0) return;
+		if (event.phase === "login_required") {
+			if (this.statusValue.phase === "online" || !isTailscaleAuthURL(event.authURL)) return;
+		}
 		if (event.phase === "online") this.restartAttempt = 0;
 		this.setStatus({
 			...event,
 			phase: event.phase
 		});
 	}
-	scheduleRestart(originURL) {
+	scheduleRestart(originURL, kind = "crash") {
 		if (this.stopping || this.restartTimer !== void 0) return;
-		const delay = RESTART_DELAYS_MS[Math.min(this.restartAttempt, RESTART_DELAYS_MS.length - 1)];
-		this.restartAttempt += 1;
+		const delay = kind === "unavailable" ? UNAVAILABLE_RETRY_MS : RESTART_DELAYS_MS[Math.min(this.restartAttempt, RESTART_DELAYS_MS.length - 1)];
+		if (kind === "crash") this.restartAttempt += 1;
 		this.restartTimer = setTimeout(() => {
 			this.restartTimer = void 0;
 			this.start(originURL);
 		}, delay);
+		this.restartTimer.unref?.();
 	}
 	setStatus(next) {
 		const cleared = next.phase === "online" ? {
@@ -3324,48 +4135,41 @@ var UpdateChecker = class {
 	dispose() {}
 };
 //#endregion
-//#region src/index.ts
-/**
-* dsh-deeppilot — data bridge between the DSH host and DeepPilot
-* clients. Registers exactly one WebSocket upgrade route (/phone) plus an
-* optional health probe (/phone/health) on the existing web server. The web
-* UI is never touched.
-*
-* Data plane: an in-process HostBridge consumes apiProxy.events.mux()/host()
-* streams, mirrors session summaries, tracks pending approvals/questions,
-* and fans projected protocol-v1 pushes out to every connected device.
-*
-* Protocol: src/protocol.ts, v1. The private app repository carries the
-* matching normative document and Swift models.
-*/
-const name = "deeppilot";
-/** No eager service requirement: profiles without a web stack simply skip. */
-const inject = [];
+//#region src/config.ts
 /** Operator-run relay used by distributed builds; overridable via config. */
 const DEFAULT_RELAY_URL = "https://pilot.hailab.dev";
 const Config = z.object({
 	enabled: z.boolean().default(true),
-	authTokenPath: z.string().default(join(bridgeDataDir(), "auth-token")),
-	devicesPath: z.string().default(join(bridgeDataDir(), "devices.json")),
+	devicesPath: z.string().default(join(bridgeDataDir(), "devices-v2.json")),
 	historyBufferMax: z.natural().min(100).default(2e3),
 	debug: z.boolean().default(false),
 	remote: z.object({
 		enabled: z.boolean().default(false),
-		provider: z.string().default("tailscale-funnel"),
+		provider: z.union(["tailscale-funnel"]).default("tailscale-funnel"),
 		hostname: z.string().default(DEFAULT_REMOTE_HOSTNAME),
 		statePath: z.string().default(join(bridgeDataDir(), "tailscale")),
 		helperPath: z.string().default(""),
-		funnelPort: z.natural().default(443)
+		funnelPort: z.union([
+			443,
+			8443,
+			1e4
+		]).default(443),
+		maxConnectionsPerSource: z.natural().min(1).max(16).default(8).description("Funnel 每个来源允许的并发连接数（1–16，修改后远程连接会短暂重连）")
 	}).default({
 		enabled: false,
 		provider: "tailscale-funnel",
 		hostname: DEFAULT_REMOTE_HOSTNAME,
 		statePath: join(bridgeDataDir(), "tailscale"),
 		helperPath: "",
-		funnelPort: 443
+		funnelPort: 443,
+		maxConnectionsPerSource: 8
 	}),
 	push: z.object({
-		provider: z.string().default("none"),
+		provider: z.union([
+			"none",
+			"apns",
+			"relay"
+		]).default("none"),
 		teamId: z.string().default(""),
 		keyId: z.string().default(""),
 		keyPath: z.string().default(join(bridgeDataDir(), "apns", "AuthKey.p8")),
@@ -3382,6 +4186,203 @@ const Config = z.object({
 		relayToken: ""
 	})
 });
+/**
+* Cordis hands the second argument in different shapes depending on host
+* composition: a reactive options getter, the resolved config value, or
+* nothing when the patch row omits `config`. Normalize all of them.
+*/
+function normalizeOptions(options) {
+	if (typeof options === "function") return options();
+	if (options && typeof options === "object") return options;
+	return Config(void 0) ?? {};
+}
+//#endregion
+//#region src/phone-http.ts
+const CLIENT_IP_HEADER = "x-deeppilot-client-ip";
+function rejectUpgrade(socket, status, reason, retryAfterSeconds) {
+	const body = JSON.stringify({ error: reason });
+	const statusText = {
+		401: "Unauthorized",
+		429: "Too Many Requests",
+		500: "Internal Server Error",
+		503: "Service Unavailable"
+	};
+	const retryAfter = status === 429 && retryAfterSeconds !== void 0 ? `Retry-After: ${Math.max(1, Math.ceil(retryAfterSeconds))}\r\n` : "";
+	socket.end("HTTP/1.1 " + status + " " + (statusText[status] ?? "Error") + "\r\n" + retryAfter + "Content-Type: application/json\r\nContent-Length: " + Buffer.byteLength(body) + "\r\nConnection: close\r\n\r\n" + body);
+}
+function normalizedAddress(value) {
+	if (!value) return null;
+	const normalized = value.startsWith("::ffff:") ? value.slice(7) : value;
+	return isIP(normalized) === 0 ? null : normalized;
+}
+function isLoopback(value) {
+	const address = normalizedAddress(value);
+	return address === "127.0.0.1" || address === "::1";
+}
+/**
+* Resolve a stable rate-limit key. The helper-supplied address is trusted only
+* on the private loopback hop; direct clients cannot spoof it.
+*/
+function requestClientIdentity(req) {
+	if (isLoopback(req.socket.remoteAddress)) {
+		const forwarded = req.headers[CLIENT_IP_HEADER];
+		const address = normalizedAddress(Array.isArray(forwarded) ? forwarded[0] : forwarded);
+		if (address !== null) return address;
+	}
+	return normalizedAddress(req.socket.remoteAddress) ?? "unknown";
+}
+//#endregion
+//#region src/auth-rate-limit.ts
+const DEFAULT_AUTH_RATE_POLICY = {
+	windowMs: 6e4,
+	attemptsPerSource: 12,
+	globalAttempts: 120,
+	maxUnauthenticatedPerSource: 2,
+	failureWindowMs: 6e5,
+	failuresBeforeBlock: 5,
+	blockMs: 9e5,
+	maxSources: 4096
+};
+const noop = () => {};
+/** Bounded in-memory protection for anonymous authentication attempts. */
+var AuthRateLimiter = class {
+	policy;
+	sources = /* @__PURE__ */ new Map();
+	globalAttempts = [];
+	constructor(policy = DEFAULT_AUTH_RATE_POLICY) {
+		this.policy = policy;
+	}
+	admit(source, now = Date.now()) {
+		const state = this.source(source, now);
+		if (state === null) return {
+			ok: false,
+			retryAfterMs: this.policy.windowMs,
+			release: noop
+		};
+		this.prune(state, now);
+		state.lastSeen = now;
+		if (state.blockedUntil > now) return {
+			ok: false,
+			retryAfterMs: state.blockedUntil - now,
+			release: noop
+		};
+		if (state.active >= this.policy.maxUnauthenticatedPerSource) return {
+			ok: false,
+			retryAfterMs: this.policy.windowMs,
+			release: noop
+		};
+		if (state.attempts.length >= this.policy.attemptsPerSource) return {
+			ok: false,
+			retryAfterMs: state.attempts[0] + this.policy.windowMs - now,
+			release: noop
+		};
+		this.globalAttempts = this.globalAttempts.filter((ts) => ts > now - this.policy.windowMs);
+		if (this.globalAttempts.length >= this.policy.globalAttempts) return {
+			ok: false,
+			retryAfterMs: this.globalAttempts[0] + this.policy.windowMs - now,
+			release: noop
+		};
+		state.attempts.push(now);
+		this.globalAttempts.push(now);
+		state.active += 1;
+		let released = false;
+		return {
+			ok: true,
+			retryAfterMs: 0,
+			release: () => {
+				if (released) return;
+				released = true;
+				state.active = Math.max(0, state.active - 1);
+			}
+		};
+	}
+	recordFailure(source, now = Date.now()) {
+		const state = this.source(source, now);
+		if (state === null) return {
+			blocked: true,
+			newlyBlocked: false,
+			retryAfterMs: this.policy.blockMs
+		};
+		this.prune(state, now);
+		state.lastSeen = now;
+		const wasBlocked = state.blockedUntil > now;
+		state.failures.push(now);
+		if (state.failures.length >= this.policy.failuresBeforeBlock) state.blockedUntil = Math.max(state.blockedUntil, now + this.policy.blockMs);
+		return {
+			blocked: state.blockedUntil > now,
+			newlyBlocked: !wasBlocked && state.blockedUntil > now,
+			retryAfterMs: Math.max(0, state.blockedUntil - now)
+		};
+	}
+	recordSuccess(source, now = Date.now()) {
+		const state = this.sources.get(source);
+		if (state === void 0) return;
+		state.failures = [];
+		state.blockedUntil = 0;
+		state.lastSeen = now;
+	}
+	source(source, now) {
+		const existing = this.sources.get(source);
+		if (existing !== void 0) return existing;
+		if (this.sources.size >= this.policy.maxSources) this.pruneSources(now);
+		if (this.sources.size >= this.policy.maxSources) return null;
+		const state = {
+			attempts: [],
+			failures: [],
+			blockedUntil: 0,
+			active: 0,
+			lastSeen: now
+		};
+		this.sources.set(source, state);
+		return state;
+	}
+	prune(state, now) {
+		state.attempts = state.attempts.filter((ts) => ts > now - this.policy.windowMs);
+		state.failures = state.failures.filter((ts) => ts > now - this.policy.failureWindowMs);
+		if (state.blockedUntil <= now) state.blockedUntil = 0;
+	}
+	pruneSources(now) {
+		const staleBefore = now - Math.max(this.policy.failureWindowMs, this.policy.blockMs);
+		for (const [source, state] of this.sources) {
+			this.prune(state, now);
+			if (state.active === 0 && state.blockedUntil === 0 && state.lastSeen < staleBefore) this.sources.delete(source);
+		}
+	}
+};
+//#endregion
+//#region src/push-policy.ts
+/** Prune only when the provider supplies an authoritative token-lifecycle verdict. */
+function shouldPrunePushToken(outcome, reason) {
+	return outcome === "invalid-token" && (reason === "Unregistered" || reason === "ExpiredToken");
+}
+/**
+* Zero-touch relay self-heal: HTTP 401 means the relay no longer honors the
+* cached credential. Only auto-enrolled cells with a still-current token may
+* re-derive it; an explicitly configured relay token remains user-owned
+* configuration and is never silently rewritten.
+*/
+function shouldReEnrollRelayToken(transport, outcome, reason, opts) {
+	return transport === "relay" && outcome === "failed" && reason === "HTTP 401" && opts.hasEnrollKey && opts.usedCellToken && opts.tokenStillCurrent;
+}
+//#endregion
+//#region src/index.ts
+/**
+* dsh-deeppilot — data bridge between the DSH host and DeepPilot
+* clients. Registers exactly one WebSocket upgrade route (/phone) plus an
+* optional health probe (/phone/health) on the existing web server. The web
+* UI is never touched.
+*
+* Data plane: an in-process HostBridge consumes a local compatibility façade
+* over DSH 0.1.2 Session/Workspace controllers, mirrors session summaries,
+* tracks pending approvals/questions, and fans projected protocol-v2 pushes
+* out to every connected device.
+*
+* Protocol: PROTOCOL.md is normative; src/protocol.ts and the private app's
+* Swift models mirror that v2 contract.
+*/
+const name = "deeppilot";
+/** No eager service requirement: profiles without a web stack simply skip. */
+const inject = [];
 const SERVER_VERSION = readOwnPackageVersion();
 const MAX_CLIENT_CONNECTIONS = 16;
 /**
@@ -3406,38 +4407,13 @@ function readOwnPackageVersion() {
 	if (typeof envVersion === "string" && envVersion.length > 0) return envVersion;
 	return "0.0.0+unknown";
 }
-function rejectUpgrade(socket, status, reason) {
-	const body = JSON.stringify({ error: reason });
-	socket.end("HTTP/1.1 " + status + " Forbidden\r\nContent-Type: application/json\r\nContent-Length: " + Buffer.byteLength(body) + "\r\nConnection: close\r\n\r\n" + body);
-}
-/** Authorization is preferred; the query form remains for older app builds. */
-function requestToken(req) {
-	const authorization = req.headers.authorization;
-	if (typeof authorization === "string") {
-		const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
-		if (match?.[1]) return match[1];
-	}
-	try {
-		return new URL(req.url ?? "/", "http://phone.local").searchParams.get("token");
-	} catch {
-		return null;
-	}
-}
-/**
-* Cordis hands the second argument in different shapes depending on host
-* composition: a reactive options getter, the resolved config value, or
-* nothing when the patch row omits `config`. Normalize all of them.
-*/
-function normalizeOptions(options) {
-	if (typeof options === "function") return options();
-	if (options && typeof options === "object") return options;
-	return Config(void 0) ?? {};
-}
 function apply(ctx, options) {
 	const cfg = normalizeOptions(options);
 	const log = (message) => {
 		console.log("[deeppilot] " + message);
 	};
+	const auditSalt = randomBytes(32);
+	const auditLabel = (value) => createHash("sha256").update(auditSalt).update(value).digest("hex").slice(0, 12);
 	/**
 	* Settings-section source: while a settings service is attached this holds
 	* the user-edited section value; otherwise the composition defaults. Read
@@ -3461,16 +4437,22 @@ function apply(ctx, options) {
 	const dataDir = bridgeDataDir();
 	const pushRelayPath = join(dataDir, "push-relay.json");
 	const enrollmentCell = {};
+	let enrollmentWriteTail = Promise.resolve();
 	function persistEnrollment() {
-		(async () => {
+		const snapshot = JSON.stringify({
+			version: 1,
+			...enrollmentCell
+		}, null, 2) + "\n";
+		enrollmentWriteTail = enrollmentWriteTail.then(async () => {
+			const tempPath = pushRelayPath + "." + randomBytes(6).toString("hex") + ".tmp";
 			try {
 				await mkdir(dataDir, { recursive: true });
-				await writeFile(pushRelayPath, JSON.stringify({
-					version: 1,
-					...enrollmentCell
-				}, null, 2) + "\n", { mode: 384 });
-			} catch {}
-		})();
+				await writeFile(tempPath, snapshot, { mode: 384 });
+				await rename(tempPath, pushRelayPath);
+			} catch {
+				await unlink(tempPath).catch(() => {});
+			}
+		});
 	}
 	/** Fired from BridgeConnection when an app presents its built-in key. */
 	const handlePushEnrollKey = async (enrollKey) => {
@@ -3483,12 +4465,12 @@ function apply(ctx, options) {
 			}
 		}
 		persistEnrollment();
-		const url = (currentConfig().push?.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+		const url = (currentConfig().push?.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 		await ensureRelayEnrolled(url);
 	};
+	const pairingCodes = new PairingCodeManager();
 	const auth = {
-		token: null,
-		tokenPath: cfg.authTokenPath ?? join(dataDir, "auth-token"),
+		audience: null,
 		devices: null
 	};
 	const ready = (async () => {
@@ -3499,13 +4481,13 @@ function apply(ctx, options) {
 			} catch (error) {
 				log("legacy plugin-state migration skipped: " + String(error));
 			}
-			auth.tokenPath = cfg.authTokenPath ?? join(dataDir, "auth-token");
-			auth.token = await loadOrCreateToken(auth.tokenPath);
-			auth.devices = await DeviceStore.load(cfg.devicesPath ?? join(dataDir, "devices.json"));
+			await ensurePrivateBridgeDataDir();
+			auth.audience = await loadOrCreateHostAudience(join(dataDir, "host-id"));
+			auth.devices = await DeviceStore.load(cfg.devicesPath ?? join(dataDir, "devices-v2.json"));
 			{
 				const rows = auth.devices.list();
 				const registered = rows.filter((row) => row.apns !== void 0).length;
-				log(`device registry loaded from ${expandHome(cfg.devicesPath ?? join(dataDir, "devices.json"))}: ${rows.length} device(s), ${registered} push registration(s)`);
+				log(`device registry loaded from ${expandHome(cfg.devicesPath ?? join(dataDir, "devices-v2.json"))}: ${rows.length} device(s), ${registered} push registration(s)`);
 			}
 			try {
 				const raw = JSON.parse(await readFile(pushRelayPath, "utf8"));
@@ -3517,44 +4499,22 @@ function apply(ctx, options) {
 		} catch (error) {
 			log("auth material unavailable, bridge degraded: " + String(error));
 			return {
-				token: null,
+				audience: null,
 				devices: null
 			};
 		}
 		return {
-			token: auth.token,
+			audience: auth.audience,
 			devices: auth.devices
 		};
 	})();
-	/**
-	* Replace the pairing secret: persist a fresh token, clear the paired-device
-	* registry, and drop every live phone socket. Handshake-time auth means an
-	* already-open socket would otherwise outlive its token; terminating forces
-	* each device to re-pair with the new secret. The old token is invalid the
-	* moment the file is rewritten.
-	*
-	* Serialized through rotateTail so two overlapping invocations can never
-	* return a token that a later write already invalidated.
-	*/
-	const doRotate = async () => {
-		const { devices } = await ready;
-		if (auth.token === null || devices === null) throw new Error("pairing token unavailable");
-		auth.token = await writeNewToken(auth.tokenPath);
-		devices.clear();
-		let dropped = 0;
-		for (const connection of connections) {
-			connection.terminate();
-			dropped += 1;
-		}
-		connections.clear();
-		log(`pairing token rotated; ${dropped} live phone connection(s) dropped`);
-		return auth.token;
-	};
-	let rotateTail = Promise.resolve();
-	const rotatePairingToken = () => {
-		const next = rotateTail.then(doRotate);
-		rotateTail = next.catch(() => {});
-		return next;
+	const beginPairing = async () => {
+		await ready;
+		if (auth.audience === null || auth.devices === null) throw new Error("device authentication unavailable");
+		return {
+			...pairingCodes.issue(),
+			audience: auth.audience
+		};
 	};
 	/**
 	* Settings-page push self-test: force one synthetic notification down the
@@ -3615,12 +4575,23 @@ function apply(ctx, options) {
 		};
 	};
 	const connections = /* @__PURE__ */ new Set();
+	const closeConnectionsForBridge = (bridge) => {
+		for (const connection of connections) {
+			if (!connection.isAttachedTo(bridge)) continue;
+			connection.closeForServerStop();
+			connections.delete(connection);
+		}
+	};
+	const closeAllConnections = () => {
+		for (const connection of connections) connection.closeForServerStop();
+		connections.clear();
+	};
 	const resolvePushConfig = (config) => {
 		const push = config.push ?? {};
 		const configured = push.provider ?? "none";
 		const effectiveProvider = configured === "none" && enrollmentCell.autoRelay === true ? "relay" : configured;
 		if (effectiveProvider === "relay") {
-			const url = (push.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+			const url = (push.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 			const token = (push.relayToken ?? "").trim() || enrollmentCell.token || "";
 			if (!/^https:\/\//i.test(url)) return {
 				ok: false,
@@ -3782,7 +4753,8 @@ function apply(ctx, options) {
 	*  - each device is delivered on ITS registered environment (the build
 	*    kind it self-reported), so sandbox and production devices coexist;
 	*  - the device's per-category switches suppress muted categories;
-	*  - Unregistered/BadDeviceToken outcomes prune the stored token.
+	*  - only APNs' terminal Unregistered/ExpiredToken verdicts prune storage;
+	*    BadDeviceToken may be an environment mismatch and stays diagnosable.
 	*/
 	const makePushOutlet = () => ({
 		isAvailable: () => {
@@ -3795,7 +4767,7 @@ function apply(ctx, options) {
 			(async () => {
 				let resolved = resolvePushConfig(currentConfig());
 				if (!resolved.ok && resolved.reason === "relay token not enrolled yet") {
-					const relayUrl = (currentConfig().push?.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+					const relayUrl = (currentConfig().push?.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 					await ensureRelayEnrolled(relayUrl);
 					resolved = resolvePushConfig(currentConfig());
 				}
@@ -3825,6 +4797,10 @@ function apply(ctx, options) {
 					log(`push(${transport}) ${notification.category}: no offline targets (connected=${connectedIds.size}, tokenized=${tokenized})`);
 					return;
 				}
+				const relayUrl = resolved.value.kind === "relay" ? resolved.value.url : void 0;
+				const relayTokenUsed = resolved.value.kind === "relay" ? resolved.value.token : void 0;
+				const usedCellToken = relayTokenUsed !== void 0 && relayTokenUsed === enrollmentCell.token;
+				const hasEnrollKey = Boolean(enrollmentCell.enrollKey);
 				for (const device of candidates) {
 					const registration = device.apns;
 					send({
@@ -3833,9 +4809,20 @@ function apply(ctx, options) {
 						notification
 					}).then(({ outcome, reason }) => {
 						log(`push(${transport}) ${notification.category} → "${device.deviceName}" [${registration.environment}] = ${outcome}${reason ? " (" + reason + ")" : ""}`);
-						if (outcome === "invalid-token") {
+						if (shouldPrunePushToken(outcome, reason)) {
 							devices.clearPushToken(device.deviceId);
 							log(`push: pruned stale token of "${device.deviceName}" (${reason ?? "unknown"}) — app re-registers on next launch`);
+							return;
+						}
+						if (relayUrl !== void 0 && shouldReEnrollRelayToken(transport, outcome, reason, {
+							usedCellToken,
+							hasEnrollKey,
+							tokenStillCurrent: enrollmentCell.token === relayTokenUsed
+						})) {
+							enrollmentCell.token = void 0;
+							persistEnrollment();
+							log("push relay credential rejected (HTTP 401); re-enrolling");
+							ensureRelayEnrolled(relayUrl);
 						}
 					}).catch(() => {});
 				}
@@ -3859,17 +4846,20 @@ function apply(ctx, options) {
 	updateChecker.scheduleInitial();
 	const updateInfo = () => updateChecker.get();
 	applyReportRemote(ctx, async () => {
-		let tokenReady = false;
+		let pairingReady = false;
 		let devices = [];
 		try {
 			await ready;
-			tokenReady = auth.token !== null;
-			devices = (auth.devices?.list() ?? []).map(({ deviceId, deviceName, appVersion, firstSeenTs, lastSeenTs, apns }) => ({
+			pairingReady = auth.audience !== null && auth.devices !== null;
+			devices = (auth.devices?.list() ?? []).filter((device) => device.publicKey !== void 0 && device.fingerprint !== void 0).map(({ deviceId, deviceName, appVersion, firstSeenTs, lastSeenTs, fingerprint, scopes, revokedAt, apns }) => ({
 				deviceId,
 				deviceName,
 				appVersion,
 				firstSeenTs,
 				lastSeenTs,
+				fingerprint,
+				scopes: normalizeDeviceScopes(scopes),
+				...revokedAt !== void 0 ? { revokedAt } : {},
 				...apns ? { apns: {
 					environment: apns.environment,
 					updatedAt: apns.updatedAt
@@ -3878,14 +4868,14 @@ function apply(ctx, options) {
 		} catch {}
 		const update = updateInfo();
 		return {
-			protocolVersion: 1,
+			protocolVersion: 2,
 			serverVersion: SERVER_VERSION,
 			pluginVersion: update.currentVersion,
 			...update.available ? { updateAvailable: true } : {},
 			...update.releaseUrl !== null ? { releaseUrl: update.releaseUrl } : {},
 			enabled: currentConfig().enabled === true,
-			tokenPath: expandHome(currentConfig().authTokenPath ?? join(bridgeDataDir(), "auth-token")),
-			tokenReady,
+			identityPath: expandHome(currentConfig().devicesPath ?? join(bridgeDataDir(), "devices-v2.json")),
+			pairingReady,
 			activeConnections: connections.size,
 			historyBufferMax: currentConfig().historyBufferMax ?? 2e3,
 			debug: currentConfig().debug === true,
@@ -3893,11 +4883,32 @@ function apply(ctx, options) {
 			remote: remoteStatus(),
 			devices
 		};
+	}, beginPairing, async (deviceId) => {
+		const { devices } = await ready;
+		if (!devices) throw new Error("device registry unavailable");
+		const revoked = devices.revoke(deviceId, Date.now());
+		if (revoked) {
+			for (const connection of [...connections]) {
+				if (connection.connectedDeviceId !== deviceId) continue;
+				connection.terminate();
+				connections.delete(connection);
+			}
+			log(`device revoked id=${auditLabel(deviceId)}`);
+		}
+		return revoked;
+	}, async (deviceId, scopes) => {
+		const { devices } = await ready;
+		if (!devices) throw new Error("device registry unavailable");
+		const updated = devices.setScopes(deviceId, scopes);
+		if (updated === null) throw new Error("active device not found");
+		for (const connection of [...connections]) {
+			if (connection.connectedDeviceId !== deviceId) continue;
+			connection.terminate();
+			connections.delete(connection);
+		}
+		log(`device scopes updated id=${auditLabel(deviceId)} scopes=${updated.join(",")}`);
+		return updated;
 	}, async () => {
-		await ready;
-		if (auth.token === null) throw new Error("pairing token unavailable");
-		return auth.token;
-	}, rotatePairingToken, async () => {
 		const push = currentConfig().push ?? {};
 		const configured = push.provider ?? "none";
 		if ((configured === "none" && enrollmentCell.autoRelay === true ? "relay" : configured) !== "relay") return {
@@ -3910,7 +4921,7 @@ function apply(ctx, options) {
 				message: `当前推送模式不是中继（provider=${configured}）。启用方式二选一：① 零配置——在 ios/project.yml 填写 DSPushEnrollKey（与服务器 RELAY_ENROLL_KEY 一致）并重新安装 App，打开 App 即自动启用；② 手动——将 push.provider 设为 relay 并填入 relayToken`
 			}]
 		};
-		const url = (push.relayUrl ?? "").trim() || DEFAULT_RELAY_URL;
+		const url = (push.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 		if (!/^https:\/\//i.test(url)) return {
 			url,
 			overall: "failed",
@@ -3940,6 +4951,103 @@ function apply(ctx, options) {
 		return await runPushSelfTest();
 	});
 	const state = {};
+	let pendingUpgrades = 0;
+	const authRateLimiter = new AuthRateLimiter();
+	const readJSONBody = async (req, maxBytes = 16384) => {
+		const chunks = [];
+		let size = 0;
+		for await (const chunk of req) {
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			size += buffer.length;
+			if (size > maxBytes) throw new Error("request body too large");
+			chunks.push(buffer);
+		}
+		return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	};
+	const handlePair = async (req, res) => {
+		res.setHeader("Content-Type", "application/json");
+		if (!enabledNow()) {
+			res.statusCode = 503;
+			res.end(JSON.stringify({
+				ok: false,
+				error: "bridge disabled"
+			}));
+			return;
+		}
+		if (req.method !== "POST") {
+			res.statusCode = 405;
+			res.setHeader("Allow", "POST");
+			res.end(JSON.stringify({
+				ok: false,
+				error: "POST required"
+			}));
+			return;
+		}
+		const source = requestClientIdentity(req);
+		const admission = authRateLimiter.admit(source);
+		if (!admission.ok) {
+			res.statusCode = 429;
+			res.setHeader("Retry-After", String(Math.max(1, Math.ceil(admission.retryAfterMs / 1e3))));
+			res.end(JSON.stringify({
+				ok: false,
+				error: "pairing rate limited"
+			}));
+			return;
+		}
+		try {
+			const { devices, audience } = await ready;
+			if (!devices || !audience) throw new Error("device authentication unavailable");
+			const raw = await readJSONBody(req);
+			if (raw === null || typeof raw !== "object" || raw.v !== 2) throw new TypeError("protocol v2 required");
+			const code = typeof raw.code === "string" ? raw.code : "";
+			const publicKey = typeof raw.publicKey === "string" ? raw.publicKey : "";
+			const deviceName = sanitizeDeviceField(raw.deviceName, 64) || "unknown";
+			const appVersion = sanitizeDeviceField(raw.appVersion, 32) || "unknown";
+			const deviceId = deviceIdForPublicKey(publicKey);
+			if (devices.list().length >= 64 && devices.authorized(deviceId) === void 0) {
+				res.statusCode = 409;
+				res.end(JSON.stringify({
+					ok: false,
+					error: "device registry is full"
+				}));
+				return;
+			}
+			if (!pairingCodes.consume(code)) {
+				const failure = authRateLimiter.recordFailure(source);
+				res.statusCode = failure.blocked ? 429 : 401;
+				if (failure.retryAfterMs > 0) res.setHeader("Retry-After", String(Math.max(1, Math.ceil(failure.retryAfterMs / 1e3))));
+				res.end(JSON.stringify({
+					ok: false,
+					error: failure.blocked ? "pairing rate limited" : "pairing code invalid or expired"
+				}));
+				return;
+			}
+			const record = devices.register({
+				publicKey,
+				deviceName,
+				appVersion,
+				scopes: normalizeDeviceScopes(raw.scopes)
+			}, Date.now());
+			authRateLimiter.recordSuccess(source);
+			log(`device paired id=${auditLabel(record.deviceId)} source=${auditLabel(source)}`);
+			res.statusCode = 201;
+			res.end(JSON.stringify({
+				ok: true,
+				v: 2,
+				deviceId: record.deviceId,
+				audience,
+				scopes: record.scopes ?? []
+			}));
+		} catch (error) {
+			res.statusCode = error instanceof SyntaxError || error instanceof TypeError ? 400 : 503;
+			res.end(JSON.stringify({
+				ok: false,
+				error: error instanceof Error ? error.message : "pairing failed"
+			}));
+		} finally {
+			admission.release();
+		}
+	};
 	const handleUpgrade = (req, socket, head) => {
 		(async () => {
 			try {
@@ -3947,44 +5055,69 @@ function apply(ctx, options) {
 					rejectUpgrade(socket, 503, "bridge disabled");
 					return;
 				}
-				if (connections.size >= MAX_CLIENT_CONNECTIONS) {
+				if (connections.size + pendingUpgrades >= MAX_CLIENT_CONNECTIONS) {
 					rejectUpgrade(socket, 429, "too many connections");
 					return;
 				}
-				const { devices } = await ready;
-				const token = auth.token;
-				if (!token || !devices) {
-					rejectUpgrade(socket, 503, "bridge degraded");
-					return;
-				}
-				const presentedToken = requestToken(req);
-				if (presentedToken !== null && !tokenMatches(presentedToken, token)) {
-					rejectUpgrade(socket, 401, "invalid token");
-					return;
-				}
-				const bridge = state.bridge;
-				if (!bridge) {
-					rejectUpgrade(socket, 503, "bridge not ready");
-					return;
-				}
-				if (auth.token !== token) {
-					rejectUpgrade(socket, 401, "invalid token");
-					return;
+				pendingUpgrades += 1;
+				try {
+					const { devices, audience } = await ready;
+					if (!audience || !devices) {
+						rejectUpgrade(socket, 503, "bridge degraded");
+						return;
+					}
+					const source = requestClientIdentity(req);
+					const admission = authRateLimiter.admit(source);
+					if (!admission.ok) {
+						rejectUpgrade(socket, 429, "authentication rate limited", admission.retryAfterMs / 1e3);
+						return;
+					}
+					const bridge = state.bridge;
+					if (!bridge) {
+						admission.release();
+						rejectUpgrade(socket, 503, "bridge not ready");
+						return;
+					}
+					try {
+						wss.handleUpgrade(req, socket, head, (ws) => {
+							if (auth.audience !== audience || state.bridge !== bridge) {
+								admission.release();
+								ws.close(1012, "bridge changed");
+								return;
+							}
+							try {
+								const connection = new BridgeConnection(ws, {
+									bridge,
+									devices,
+									serverVersion: SERVER_VERSION,
+									audience,
+									log,
+									debug: currentConfig().debug === true,
+									onClosed: (closed) => connections.delete(closed),
+									onAuthenticationSettled: (ok) => {
+										admission.release();
+										if (ok) authRateLimiter.recordSuccess(source);
+										else if (authRateLimiter.recordFailure(source).newlyBlocked) log(`authentication source blocked source=${auditLabel(source)}`);
+									},
+									onDeviceAuthenticated: (deviceId) => {
+										log(`device authenticated id=${auditLabel(deviceId)} source=${auditLabel(source)}`);
+									},
+									onPushEnrollKey: handlePushEnrollKey
+								});
+								connections.add(connection);
+							} catch (error) {
+								admission.release();
+								ws.close(1011, "connection setup failed");
+								throw error;
+							}
+						});
+					} catch (error) {
+						admission.release();
+						throw error;
+					}
+				} finally {
+					pendingUpgrades -= 1;
 				}
-				wss.handleUpgrade(req, socket, head, (ws) => {
-					const connection = new BridgeConnection(ws, {
-						bridge,
-						devices,
-						serverVersion: SERVER_VERSION,
-						expectedToken: token,
-						transportAuthenticated: presentedToken !== null,
-						log,
-						debug: currentConfig().debug === true,
-						onClosed: (closed) => connections.delete(closed),
-						onPushEnrollKey: handlePushEnrollKey
-					});
-					connections.add(connection);
-				});
 			} catch (error) {
 				log("upgrade failed: " + String(error));
 				rejectUpgrade(socket, 500, "internal error");
@@ -3994,9 +5127,8 @@ function apply(ctx, options) {
 	const handleHealth = async (req, res) => {
 		try {
 			await ready;
-			const token = auth.token;
 			res.setHeader("Content-Type", "application/json");
-			if (!token) {
+			if (!auth.audience || !auth.devices) {
 				res.statusCode = 503;
 				res.end(JSON.stringify({
 					ok: false,
@@ -4004,16 +5136,11 @@ function apply(ctx, options) {
 				}));
 				return;
 			}
-			if (!tokenMatches(requestToken(req), token)) {
-				res.statusCode = 401;
-				res.end(JSON.stringify({ ok: false }));
-				return;
-			}
 			res.statusCode = 200;
 			res.end(JSON.stringify({
 				ok: true,
 				enabled: enabledNow(),
-				protocolVersion: 1,
+				protocolVersion: 2,
 				serverVersion: SERVER_VERSION,
 				dataPlane: Boolean(state.bridge)
 			}));
@@ -4022,15 +5149,17 @@ function apply(ctx, options) {
 			res.end(JSON.stringify({ ok: false }));
 		}
 	};
-	ctx.inject(["apiProxy"], (sub) => {
+	ctx.inject(["sessionController"], (sub) => {
 		if (currentConfig().enabled !== true) {
 			log("bridge disabled; data plane stays inactive");
 			return;
 		}
 		const apiCtx = sub;
-		const proxy = apiCtx.apiProxy;
-		if (!proxy) {
-			log("apiProxy service absent; data plane stays inactive");
+		let proxy;
+		try {
+			proxy = new Dsh012ApiProxy(apiCtx);
+		} catch (error) {
+			log("dsh 0.1.2 session bridge unavailable: " + String(error));
 			return;
 		}
 		const bridge = new HostBridge(proxy, cfg.historyBufferMax);
@@ -4038,7 +5167,11 @@ function apply(ctx, options) {
 		state.bridge = bridge;
 		bridge.start();
 		log("data plane active (mux + host streams)");
-		apiCtx.effect(() => () => bridge.dispose(), "deeppilot: host streams");
+		apiCtx.effect(() => () => {
+			closeConnectionsForBridge(bridge);
+			if (state.bridge === bridge) state.bridge = void 0;
+			bridge.dispose();
+		}, "deeppilot: host streams");
 	});
 	ctx.inject(["webServer"], (sub) => {
 		const webCtx = sub;
@@ -4056,11 +5189,16 @@ function apply(ctx, options) {
 			path: "/phone/health",
 			handler: handleHealth
 		}), "deeppilot: /phone/health");
+		webCtx.effect(() => web.register({
+			kind: "exact",
+			path: "/phone/pair",
+			handler: handlePair
+		}), "deeppilot: /phone/pair");
 		const sweep = setInterval(() => {
 			const now = Date.now();
 			for (const connection of connections) if (connection.isStale(now, 6e4)) {
 				log("dropping stale connection");
-				connection.terminate();
+				connection.closeIdle();
 				connections.delete(connection);
 			}
 		}, 3e4);
@@ -4071,6 +5209,7 @@ function apply(ctx, options) {
 				path = new URL(req.url ?? "/", "http://phone.local").pathname;
 			} catch {}
 			if (path === "/phone/health") handleHealth(req, res);
+			else if (path === "/phone/pair") handlePair(req, res);
 			else {
 				res.statusCode = 404;
 				res.end("not found");
@@ -4102,7 +5241,8 @@ function apply(ctx, options) {
 				hostname: normalizeRemoteHostname(remoteConfig.hostname),
 				statePath: remoteConfig.statePath?.trim() || join(dataDir, "tailscale"),
 				helperPath,
-				funnelPort: remotePort
+				funnelPort: remotePort,
+				maxConnectionsPerSource: normalizeFunnelConnectionLimit(remoteConfig.maxConnectionsPerSource)
 			};
 			const nextKey = JSON.stringify(next);
 			if (nextKey === appliedRemoteKey) return;
@@ -4116,6 +5256,7 @@ function apply(ctx, options) {
 				statePath: next.statePath,
 				...next.helperPath ? { helperPath: next.helperPath } : {},
 				funnelPort: next.funnelPort,
+				maxConnectionsPerSource: next.maxConnectionsPerSource,
 				log
 			});
 			remoteSupervisor = supervisor;
@@ -4146,8 +5287,23 @@ function apply(ctx, options) {
 		if (enabledNow()) log("/phone WebSocket registered");
 		else log("bridge disabled; /phone refuses connections until re-enabled and restarted");
 	});
+	ctx.effect(() => async () => {
+		closeAllConnections();
+		const bridge = state.bridge;
+		state.bridge = void 0;
+		bridge?.dispose();
+		const sender = cachedSender;
+		cachedSender = void 0;
+		updateChecker.dispose();
+		const wssClosed = new Promise((resolve) => wss.close(() => resolve()));
+		await Promise.allSettled([
+			enrollmentWriteTail,
+			sender?.dispose?.() ?? Promise.resolve(),
+			wssClosed
+		]);
+	}, "deeppilot: process resources");
 }
 //#endregion
-export { Config, HostBridge, apply, inject, name, requestToken };
+export { Config, HostBridge, apply, inject, name, shouldPrunePushToken, shouldReEnrollRelayToken };
 
 //# sourceMappingURL=index.js.map