dsh-deeppilot 0.4.0 → 0.5.0

package/lib/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { createServer } from "node:http";
-import { createHash, createPrivateKey, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
-import { access, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, sign, timingSafeEqual, verify } from "node:crypto";
+import { access, chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { WebSocketServer } from "ws";
 import { homedir, networkInterfaces } from "node:os";
@@ -13,6 +13,128 @@ import { constants } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { request } from "node:https";
 import z from "@deepseek-ai/schemastery";
+import { isIP } from "node:net";
+//#region src/device-auth.ts
+const PAIRING_CODE_TTL_MS = 3e5;
+const AUTH_CHALLENGE_TTL_MS = 3e4;
+const DEVICE_SCOPES = [
+	"sessions.read",
+	"prompt.send",
+	"sessions.manage",
+	"interactions.respond",
+	"notifications.register"
+];
+const DEFAULT_DEVICE_SCOPES = DEVICE_SCOPES;
+async function loadOrCreateHostAudience(path) {
+	try {
+		const existing = (await readFile(path, "utf8")).trim();
+		if (/^deeppilot:[A-Za-z0-9_-]{22}$/.test(existing)) return existing;
+		throw new Error(`host audience is malformed at ${path}`);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const audience = "deeppilot:" + randomBytes(16).toString("base64url");
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, audience + "\n", { mode: 384 });
+	return audience;
+}
+function b64urlText(value) {
+	return Buffer.from(value, "utf8").toString("base64url");
+}
+/**
+* Cross-language signature input. Text fields are base64url encoded before
+* joining so names cannot create ambiguous separators. Decimal timestamps
+* and cursor values are finite integers, or `-` when the cursor is absent.
+*/
+function canonicalAuthChallenge(fields) {
+	const cursor = fields.resumeCursor === void 0 ? "-" : String(fields.resumeCursor);
+	return Buffer.from([
+		"deeppilot-auth-v2",
+		`device-id:${b64urlText(fields.deviceId)}`,
+		`nonce:${fields.nonce}`,
+		`audience:${b64urlText(fields.audience)}`,
+		`issued-at:${fields.issuedAt}`,
+		`expires-at:${fields.expiresAt}`,
+		`device-name:${b64urlText(fields.deviceName)}`,
+		`app-version:${b64urlText(fields.appVersion)}`,
+		`resume-cursor:${cursor}`
+	].join("\n"), "utf8");
+}
+/** Accept only an uncompressed ANSI X9.63 P-256 public key (65 bytes). */
+function parseP256PublicKey(encoded) {
+	const raw = Buffer.from(encoded, "base64url");
+	if (raw.length !== 65 || raw[0] !== 4) throw new TypeError("publicKey must be an uncompressed P-256 X9.63 key");
+	const spkiPrefix = Buffer.from("3059301306072a8648ce3d020106082a8648ce3d030107034200", "hex");
+	const key = createPublicKey({
+		key: Buffer.concat([spkiPrefix, raw]),
+		format: "der",
+		type: "spki"
+	});
+	if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") throw new TypeError("publicKey must use P-256");
+	return {
+		key,
+		raw
+	};
+}
+function deviceIdForPublicKey(publicKey) {
+	const { raw } = parseP256PublicKey(publicKey);
+	return createHash("sha256").update(raw).digest("base64url");
+}
+function fingerprintForPublicKey(publicKey) {
+	const { raw } = parseP256PublicKey(publicKey);
+	return createHash("sha256").update(raw).digest("hex");
+}
+function verifyAuthProof(publicKey, fields, signature) {
+	try {
+		const { key } = parseP256PublicKey(publicKey);
+		const der = Buffer.from(signature, "base64url");
+		if (der.length < 64 || der.length > 80) return false;
+		return verify("sha256", canonicalAuthChallenge(fields), key, der);
+	} catch {
+		return false;
+	}
+}
+function normalizeDeviceScopes(value) {
+	if (!Array.isArray(value)) return [...DEFAULT_DEVICE_SCOPES];
+	const allowed = new Set(DEVICE_SCOPES);
+	return [...new Set(value.filter((scope) => typeof scope === "string" && allowed.has(scope)))];
+}
+/** One active, single-use pairing grant per plugin runtime. */
+var PairingCodeManager = class {
+	active = null;
+	issue(now = Date.now()) {
+		const grant = {
+			code: randomBytes(24).toString("base64url"),
+			expiresAt: now + PAIRING_CODE_TTL_MS
+		};
+		this.active = grant;
+		return { ...grant };
+	}
+	consume(presented, now = Date.now()) {
+		const active = this.active;
+		if (active === null || now > active.expiresAt) {
+			this.active = null;
+			return false;
+		}
+		const expected = Buffer.from(active.code);
+		const actual = Buffer.from(presented);
+		const matches = expected.length === actual.length && timingSafeEqual(expected, actual);
+		if (matches) this.active = null;
+		return matches;
+	}
+	invalidate() {
+		this.active = null;
+	}
+};
+function createAuthChallenge(audience, now = Date.now()) {
+	return {
+		nonce: randomBytes(24).toString("base64url"),
+		audience,
+		issuedAt: now,
+		expiresAt: now + AUTH_CHALLENGE_TTL_MS
+	};
+}
+//#endregion
 //#region src/token.ts
 /** Expand a leading ~ using the process home directory. */
 function expandHome(p) {
@@ -29,6 +151,16 @@ function dshDataRoot() {
 function bridgeDataDir() {
 	return resolve(dshDataRoot(), "deeppilot");
 }
+/** Create or repair the canonical secret-bearing directory as owner-only. */
+async function ensurePrivateBridgeDataDir() {
+	const target = bridgeDataDir();
+	await mkdir(target, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(target, 448);
+	return target;
+}
 /**
 * Move the pre-DeepPilot data directory as one atomic directory rename.
 * Existing canonical data always wins; secrets are never merged or replaced.
@@ -50,63 +182,6 @@ async function migrateLegacyBridgeDataDir() {
 		throw error;
 	}
 }
-/**
-* Load the pairing token from disk or generate and persist a fresh one.
-* The file is written 0600; the token never appears in logs.
-*/
-async function loadOrCreateToken(tokenPath) {
-	const full = expandHome(tokenPath);
-	try {
-		const existing = (await readFile(full, "utf8")).trim();
-		if (existing.length >= 32) return existing;
-		await preserveCorruptSidecar(full);
-		throw new Error(`pairing token is malformed at ${full} (length=${existing.length}); original preserved as ${full}.corrupt`);
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-	}
-	const token = randomBytes(32).toString("base64url");
-	await mkdir(dirname(full), { recursive: true });
-	await writeFile(full, token + "\n", { mode: 384 });
-	return token;
-}
-/**
-* Copy a malformed auth-token file to `<path>.corrupt` so a future operator
-* can inspect what was on disk at the moment of corruption. Best-effort:
-* a copy failure (permissions, full disk, ...) must not block the loud
-* throw that actually surfaces the issue.
-*/
-async function preserveCorruptSidecar(full) {
-	try {
-		const original = await readFile(full);
-		const sidecar = `${full}.corrupt`;
-		await writeFile(sidecar, original, { mode: 384 });
-	} catch {}
-}
-/**
-* Generate a fresh pairing token and replace the stored one, invalidating
-* every copy of the old secret. The write goes to a same-directory temp file
-* renamed over the target so a crash can never leave a truncated token file.
-*/
-async function writeNewToken(tokenPath) {
-	const full = expandHome(tokenPath);
-	const token = randomBytes(32).toString("base64url");
-	await mkdir(dirname(full), { recursive: true });
-	const temp = `${full}.${randomBytes(6).toString("hex")}.tmp`;
-	await writeFile(temp, token + "\n", { mode: 384 });
-	await rename(temp, full);
-	return token;
-}
-/** Constant-time token comparison; both sides are high-entropy secrets. */
-function tokenMatches(presented, expected) {
-	if (!presented) return false;
-	const b = Buffer.from(expected);
-	if (Buffer.byteLength(presented, "utf8") !== b.length) {
-		timingSafeEqual(b, b);
-		return false;
-	}
-	const a = Buffer.from(presented);
-	return timingSafeEqual(a, b);
-}
 /** Hex shape of an APNs device token as delivered by iOS (usually 64 chars). */
 const APNS_TOKEN_PATTERN = /^[0-9a-f]{32,512}$/;
 function isValidApnsToken(token) {
@@ -134,32 +209,57 @@ var DeviceStore = class DeviceStore {
 		}
 		return store;
 	}
-	touch(record, now) {
-		const existing = this.devices.get(record.deviceId);
-		if (existing) {
-			existing.lastSeenTs = now;
-			existing.deviceName = record.deviceName || existing.deviceName;
-			existing.appVersion = record.appVersion || existing.appVersion;
-		} else {
-			if (this.devices.size >= 64) {
-				let oldestId;
-				let oldestTs = Number.POSITIVE_INFINITY;
-				for (const [id, value] of this.devices) if (value.lastSeenTs < oldestTs) {
-					oldestTs = value.lastSeenTs;
-					oldestId = id;
-				}
-				if (oldestId !== void 0) this.devices.delete(oldestId);
-			}
-			this.devices.set(record.deviceId, {
-				...record,
-				firstSeenTs: now,
-				lastSeenTs: now
-			});
-		}
+	/** Register one public key after a valid, single-use pairing grant. */
+	register(record, now) {
+		const deviceId = deviceIdForPublicKey(record.publicKey);
+		const existing = this.devices.get(deviceId);
+		if (!existing && this.devices.size >= 64) throw new Error("device registry is full");
+		const next = {
+			deviceId,
+			deviceName: record.deviceName,
+			appVersion: record.appVersion,
+			publicKey: record.publicKey,
+			fingerprint: fingerprintForPublicKey(record.publicKey),
+			scopes: normalizeDeviceScopes(record.scopes),
+			firstSeenTs: existing?.firstSeenTs ?? now,
+			lastSeenTs: now,
+			...existing?.apns ? { apns: existing.apns } : {}
+		};
+		this.devices.set(deviceId, next);
 		this.flush();
+		return structuredClone(next);
+	}
+	/** Return an active cryptographic identity. */
+	authorized(deviceId) {
+		const record = this.devices.get(deviceId);
+		if (!record?.publicKey || record.revokedAt !== void 0) return void 0;
+		return record;
+	}
+	markAuthenticated(deviceId, deviceName, appVersion, now) {
+		const record = this.authorized(deviceId);
+		if (!record) return;
+		record.deviceName = deviceName || record.deviceName;
+		record.appVersion = appVersion || record.appVersion;
+		record.lastSeenTs = now;
+		this.flush();
+	}
+	revoke(deviceId, now) {
+		const record = this.devices.get(deviceId);
+		if (!record || record.revokedAt !== void 0) return false;
+		record.revokedAt = now;
+		delete record.apns;
+		this.flush();
+		return true;
+	}
+	setScopes(deviceId, scopes) {
+		const record = this.authorized(deviceId);
+		if (!record) return null;
+		record.scopes = normalizeDeviceScopes(scopes);
+		this.flush();
+		return [...record.scopes];
 	}
 	list() {
-		return [...this.devices.values()];
+		return [...this.devices.values()].map((record) => structuredClone(record));
 	}
 	/**
 	* Store (or refresh) the APNs registration of a paired device. Idempotent:
@@ -169,17 +269,8 @@ var DeviceStore = class DeviceStore {
 	setPushToken(deviceId, token, environment, categories, now) {
 		const normalized = token.toLowerCase();
 		if (!isValidApnsToken(normalized)) return;
-		let record = this.devices.get(deviceId);
-		if (!record) {
-			record = {
-				deviceId,
-				deviceName: "unknown",
-				appVersion: "unknown",
-				firstSeenTs: now,
-				lastSeenTs: now
-			};
-			this.devices.set(deviceId, record);
-		}
+		const record = this.authorized(deviceId);
+		if (!record) return;
 		const next = {
 			token: normalized,
 			environment,
@@ -202,15 +293,6 @@ var DeviceStore = class DeviceStore {
 		delete record.apns;
 		this.flush();
 	}
-	/**
-	* Drop every paired-device record. Used by token rotation: devices paired
-	* under the old token can no longer authenticate, so keeping their rows
-	* would paint a misleading "still paired" picture.
-	*/
-	clear() {
-		this.devices.clear();
-		this.flush();
-	}
 	/** Serialized so concurrent touches can never interleave half-written JSON. */
 	flush() {
 		const next = this.flushTail.then(() => this.writeFile());
@@ -224,7 +306,7 @@ var DeviceStore = class DeviceStore {
 	async writeFile() {
 		const full = expandHome(this.filePath);
 		const body = JSON.stringify({
-			version: 1,
+			version: 2,
 			devices: this.list()
 		}, null, 2);
 		try {
@@ -237,7 +319,7 @@ var DeviceStore = class DeviceStore {
 };
 //#endregion
 //#region src/connection-policy.ts
-const AUTH_TIMEOUT_MS = 5e3;
+const AUTH_TIMEOUT_MS = 35e3;
 const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
 	"image/png",
 	"image/jpeg",
@@ -247,8 +329,13 @@ const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
 function sanitizeDeviceField(value, maxChars) {
 	return (typeof value === "string" ? value : String(value ?? "")).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, maxChars);
 }
-function helloTokenAccepted(transportAuthenticated, presentedToken, expectedToken) {
-	return transportAuthenticated === true || tokenMatches(presentedToken, expectedToken);
+function requiredScope(type) {
+	if (type === "c2s.ping" || type === "c2s.resume") return void 0;
+	if (type === "c2s.session.sendPrompt") return "prompt.send";
+	if (type === "c2s.approval.respond" || type === "c2s.question.respond") return "interactions.respond";
+	if (type === "c2s.push.register") return "notifications.register";
+	if (type === "c2s.workspace.create" || type === "c2s.session.create" || type === "c2s.session.rename" || type === "c2s.session.archive" || type === "c2s.session.cancel" || type === "c2s.session.selectModel") return "sessions.manage";
+	if (type.startsWith("c2s.")) return "sessions.read";
 }
 function sanitizeImageName(value) {
 	return value.replace(/[\u0000-\u001F\u007F]/g, "").trim().slice(0, 120);
@@ -283,21 +370,31 @@ function managementErrorCode(kind) {
 //#region src/connection.ts
 /**
 * One connected phone. Implements BridgeSink so the HostBridge can push
-* projected frames and replays. Bearer/query credentials may authenticate the
-* HTTP upgrade; otherwise the first hello frame is verified here.
+* projected frames and replays. Every socket starts anonymous, receives one
+* server challenge, and must prove possession of a registered P-256 key.
 */
 var BridgeConnection = class {
 	ws;
 	deps;
 	authenticated = false;
+	authenticationSettled = false;
 	closed = false;
 	helloTimer;
 	openSessions = /* @__PURE__ */ new Set();
+	/**
+	* Realtime events that arrive while a session's history snapshot is in
+	* flight. The wire contract requires tail first; sending these immediately
+	* lets the later tail roll the client back over messages it just rendered.
+	*/
+	openingSessionEvents = /* @__PURE__ */ new Map();
 	/** Sanitized device identity from hello; needed for push registration. */
 	deviceId;
+	scopes = /* @__PURE__ */ new Set();
+	authChallenge;
 	constructor(ws, deps) {
 		this.ws = ws;
 		this.deps = deps;
+		this.authChallenge = createAuthChallenge(deps.audience);
 		ws.on("message", (data) => {
 			this.onMessage(String(data));
 		});
@@ -307,8 +404,13 @@ var BridgeConnection = class {
 		});
 		ws.on("error", () => {});
 		this.helloTimer = setTimeout(() => {
-			if (!this.authenticated) this.close(4402, "auth timeout");
+			if (!this.authenticated) {
+				this.settleAuthentication(false, "timeout");
+				this.close(4402, "auth timeout");
+			}
 		}, AUTH_TIMEOUT_MS);
+		this.helloTimer.unref();
+		this.send("s2c.auth.challenge", this.authChallenge);
 	}
 	/** Hard-drop the socket (server-side stale sweep). */
 	terminate() {
@@ -332,6 +434,20 @@ var BridgeConnection = class {
 		return this.authenticated ? this.deviceId : void 0;
 	}
 	push(type, payload, seq) {
+		if (type === "s2c.session.event") {
+			const sessionId = payload?.sessionId;
+			if (typeof sessionId === "string") {
+				const buffered = this.openingSessionEvents.get(sessionId);
+				if (buffered) {
+					buffered.push({
+						type,
+						payload,
+						...seq !== void 0 ? { seq } : {}
+					});
+					return;
+				}
+			}
+		}
 		if (this.deps.debug === true) this.deps.log("push " + type + " seq=" + String(seq));
 		this.send(type, payload, void 0, seq);
 	}
@@ -350,12 +466,19 @@ var BridgeConnection = class {
 	onClose() {
 		if (this.closed) return;
 		this.closed = true;
+		if (!this.authenticationSettled) this.settleAuthentication(false, "closed");
 		if (this.helloTimer !== void 0) clearTimeout(this.helloTimer);
 		for (const id of this.openSessions) this.deps.bridge.markSinkClosed(this, id);
 		this.openSessions.clear();
+		this.openingSessionEvents.clear();
 		this.deps.bridge.dropSinkSessions(this);
 		if (this.authenticated) this.deps.bridge.removeSink(this);
 	}
+	settleAuthentication(ok, reason) {
+		if (this.authenticationSettled) return;
+		this.authenticationSettled = true;
+		this.deps.onAuthenticationSettled?.(ok, reason);
+	}
 	close(code, reason) {
 		if (this.closed) return;
 		try {
@@ -366,7 +489,7 @@ var BridgeConnection = class {
 	}
 	send(type, payload, id, seq) {
 		const envelope = {
-			v: 1,
+			v: 2,
 			type,
 			ts: Date.now(),
 			...id !== void 0 ? { id } : {},
@@ -404,7 +527,7 @@ var BridgeConnection = class {
 			this.fail(void 0, "E_PROTOCOL", "frame is not valid JSON");
 			return;
 		}
-		if (env.v !== 1) {
+		if (env.v !== 2) {
 			this.fail(env.id, "E_UNSUPPORTED", "unsupported protocol version");
 			this.close(4500, "protocol version mismatch");
 			return;
@@ -414,13 +537,18 @@ var BridgeConnection = class {
 				this.send("s2c.pong", { serverTime: Date.now() }, env.id);
 				return;
 			}
-			if (env.type === "c2s.hello.auth") {
-				await this.hello(env);
+			if (env.type === "c2s.auth.prove") {
+				await this.prove(env);
 				return;
 			}
 			this.fail(env.id, "E_PROTOCOL", "authenticate first");
 			return;
 		}
+		const required = requiredScope(env.type);
+		if (required !== void 0 && !this.scopes.has(required)) {
+			this.fail(env.id, "E_FORBIDDEN", `scope ${required} required`);
+			return;
+		}
 		switch (env.type) {
 			case "c2s.ping":
 				this.send("s2c.pong", { serverTime: Date.now() }, env.id);
@@ -469,18 +597,23 @@ var BridgeConnection = class {
 				const p = env.payload;
 				if (!p?.sessionId || typeof p.sessionId !== "string") return this.fail(env.id, "E_PROTOCOL", "sessionId required");
 				const sessionId = p.sessionId;
-				this.openSessions.add(sessionId);
-				this.deps.bridge.markSinkOpen(this, sessionId);
+				const bufferedEvents = [];
+				this.openingSessionEvents.set(sessionId, bufferedEvents);
 				if (!await this.deps.bridge.openSession(this, sessionId, p.tailCount ?? 100)) {
-					this.openSessions.delete(sessionId);
-					this.deps.bridge.markSinkClosed(this, sessionId);
+					if (this.openingSessionEvents.get(sessionId) === bufferedEvents) this.openingSessionEvents.delete(sessionId);
 					return this.fail(env.id, "E_NOT_FOUND", "session history unavailable");
 				}
+				if (this.openingSessionEvents.get(sessionId) !== bufferedEvents) return;
+				this.openSessions.add(sessionId);
+				this.deps.bridge.markSinkOpen(this, sessionId);
+				this.openingSessionEvents.delete(sessionId);
+				for (const frame of bufferedEvents) this.push(frame.type, frame.payload, frame.seq);
 				return;
 			}
 			case "c2s.session.close": {
 				const p = env.payload;
 				if (!p?.sessionId) return this.fail(env.id, "E_PROTOCOL", "sessionId required");
+				this.openingSessionEvents.delete(p.sessionId);
 				this.openSessions.delete(p.sessionId);
 				this.deps.bridge.markSinkClosed(this, p.sessionId);
 				this.send("s2c.ack", {}, env.id);
@@ -541,7 +674,9 @@ var BridgeConnection = class {
 			case "c2s.session.history": {
 				const p = env.payload;
 				if (!p?.sessionId || typeof p.beforeSeq !== "number") return this.fail(env.id, "E_PROTOCOL", "sessionId and beforeSeq required");
-				if (!await this.deps.bridge.historyPage(this, p.sessionId, p.beforeSeq, Math.min(p.limit ?? 100, 500))) this.fail(env.id, "E_NOT_FOUND", "history unavailable");
+				const page = await this.deps.bridge.historyPage(p.sessionId, p.beforeSeq, Math.min(p.limit ?? 100, 500));
+				if (!page) return this.fail(env.id, "E_NOT_FOUND", "history unavailable");
+				this.send("s2c.history.page", page, env.id);
 				return;
 			}
 			case "c2s.session.attachment": {
@@ -646,13 +781,8 @@ var BridgeConnection = class {
 			default: this.fail(env.id, "E_PROTOCOL", "unknown type: " + env.type);
 		}
 	}
-	async hello(env) {
+	async prove(env) {
 		const p = env.payload ?? {};
-		if (!helloTokenAccepted(this.deps.transportAuthenticated, p.token, this.deps.expectedToken)) {
-			this.fail(env.id, "E_AUTH", "token missing or invalid");
-			this.close(4401, "invalid token");
-			return;
-		}
 		if (!p.deviceId) {
 			this.fail(env.id, "E_PROTOCOL", "deviceId required");
 			this.close(4403, "deviceId required");
@@ -666,20 +796,36 @@ var BridgeConnection = class {
 		}
 		const deviceName = sanitizeDeviceField(p.deviceName, 64) || "unknown";
 		const appVersion = sanitizeDeviceField(p.appVersion, 32) || "unknown";
+		const challenge = this.authChallenge;
+		const record = this.deps.devices.authorized(deviceId);
+		const resumeCursor = typeof p.resumeCursor === "number" && Number.isInteger(p.resumeCursor) && p.resumeCursor >= 0 ? p.resumeCursor : void 0;
+		const challengeMatches = p.nonce === challenge.nonce && p.audience === challenge.audience && p.issuedAt === challenge.issuedAt && p.expiresAt === challenge.expiresAt && Date.now() <= challenge.expiresAt;
+		if (!(record?.publicKey !== void 0 && typeof p.signature === "string" && challengeMatches && verifyAuthProof(record.publicKey, {
+			deviceId,
+			deviceName,
+			appVersion,
+			resumeCursor,
+			...challenge
+		}, p.signature)) || record === void 0) {
+			this.fail(env.id, "E_AUTH", "device proof missing or invalid");
+			this.settleAuthentication(false, "invalid-proof");
+			this.close(4401, "invalid device proof");
+			return;
+		}
+		this.settleAuthentication(true, "success");
 		this.authenticated = true;
 		this.deviceId = deviceId;
+		this.scopes = new Set(record.scopes ?? []);
 		if (this.helloTimer !== void 0) clearTimeout(this.helloTimer);
-		this.deps.devices.touch({
-			deviceId,
-			deviceName,
-			appVersion
-		}, Date.now());
-		this.deps.log("device paired: " + deviceName + " (" + deviceId + ")");
-		const cursor = typeof p.resumeCursor === "number" && p.resumeCursor >= 0 ? p.resumeCursor : void 0;
+		this.deps.devices.markAuthenticated(deviceId, deviceName, appVersion, Date.now());
+		this.deps.onDeviceAuthenticated?.(deviceId);
+		const cursor = resumeCursor;
 		const canResume = cursor !== void 0 && this.deps.bridge.canResumeFrom(cursor);
 		this.send("s2c.welcome", {
-			protocolVersion: 1,
+			protocolVersion: 2,
 			serverVersion: this.deps.serverVersion,
+			deviceId,
+			scopes: [...this.scopes],
 			capabilities: this.deps.bridge.capabilities,
 			cursor: this.deps.bridge.currentCursor(),
 			resumed: canResume
@@ -712,6 +858,29 @@ function unwrapStreamItem(item) {
 //#endregion
 //#region src/host-event-projection.ts
 const MAX_MESSAGE_PROJECTION_BYTES = 262144;
+/** One durable host event sequence becomes exactly one phone message row.
+* Keep the last projection when a host history response repeats an event. */
+function canonicalSessionMessages(messages) {
+	const bySequence = /* @__PURE__ */ new Map();
+	for (const message of messages) bySequence.set(message.seq, message);
+	return [...bySequence.values()].sort((a, b) => a.seq - b.seq);
+}
+function limitSessionPageMessages(messages) {
+	const canonical = canonicalSessionMessages(messages);
+	let bytes = 2;
+	const kept = [];
+	for (let index = canonical.length - 1; index >= 0; index -= 1) {
+		const message = canonical[index];
+		const candidateBytes = jsonBytes(message) + (kept.length > 0 ? 1 : 0);
+		if (bytes + candidateBytes > 921600) break;
+		kept.unshift(message);
+		bytes += candidateBytes;
+	}
+	return {
+		messages: kept,
+		dropped: canonical.length - kept.length
+	};
+}
 function projectEvent(sessionId, event) {
 	switch (event.type) {
 		case "turn/start": return {
@@ -1032,7 +1201,7 @@ function projectHistory(events) {
 			}
 		}
 	}
-	return messages.sort((a, b) => a.seq - b.seq).map(limitMessageProjection);
+	return canonicalSessionMessages(messages.map(limitMessageProjection));
 }
 /**
 * Enforce PROTOCOL.md's per-message 256 KB ceiling by UTF-8 JSON byte size.
@@ -1598,13 +1767,14 @@ var HostBridge = class {
 			});
 			if (!response.result || !response.result.ok) return false;
 			const result = response.result.value;
-			const messages = projectHistory(result.events ?? []);
+			const page = limitSessionPageMessages(projectHistory(result.events ?? []));
+			const messages = page.messages;
 			const oldestSeq = messages.length > 0 ? messages[0].seq : 0;
 			sink.push("s2c.session.tail", {
 				sessionId,
 				messages,
 				oldestSeq,
-				hasMore: Boolean(result.hasMore)
+				hasMore: Boolean(result.hasMore) || page.dropped > 0
 			});
 			this.deriveTitleFallback(sessionId, messages);
 			return true;
@@ -1612,7 +1782,7 @@ var HostBridge = class {
 			return false;
 		}
 	}
-	async historyPage(sink, sessionId, beforeSeq, limit) {
+	async historyPage(sessionId, beforeSeq, limit) {
 		try {
 			const response = await this.apiProxy.sessions.history({
 				rpcId: randomUUID(),
@@ -1622,17 +1792,16 @@ var HostBridge = class {
 					maxMessages: clampTail(limit)
 				}
 			});
-			if (!response.result || !response.result.ok) return false;
+			if (!response.result || !response.result.ok) return null;
 			const result = response.result.value;
-			const messages = projectHistory(result.events ?? []);
-			sink.push("s2c.history.page", {
+			const page = limitSessionPageMessages(projectHistory(result.events ?? []).filter((message) => message.seq < beforeSeq));
+			return {
 				sessionId,
-				messages,
-				hasMore: Boolean(result.hasMore)
-			});
-			return true;
+				messages: page.messages,
+				hasMore: page.messages.length > 0 && (Boolean(result.hasMore) || page.dropped > 0)
+			};
 		} catch {
-			return false;
+			return null;
 		}
 	}
 	/** Result of one attachment read-back for the phone. */
@@ -2308,6 +2477,365 @@ function projectSessionModels(value) {
 }
 /** Project a history page (raw events) into MessageProjection rows. */
 //#endregion
+//#region src/dsh012-api-proxy.ts
+/**
+* Compatibility façade for the DSH 0.1.2 controller API.
+*
+* DeepPilot's phone protocol deliberately speaks one stable in-process
+* `apiProxy` vocabulary. Harness 0.1.2 removed that service in favor of
+* direct Session/Workspace controllers plus scoped Cordis interaction events.
+* This adapter rebuilds the small subset the bridge needs from those public
+* controllers, keeping the protocol implementation isolated from the Host API
+* migration. It is intentionally Host-only.
+*/
+/** Direct-controller facade with the exact legacy shape HostBridge consumes. */
+var Dsh012ApiProxy = class {
+	ctx;
+	session;
+	workspaceController;
+	directoryPicker;
+	interactions = /* @__PURE__ */ new Map();
+	constructor(ctx) {
+		this.ctx = ctx;
+		const session = ctx.get("sessionController");
+		if (session === void 0) throw new Error("dsh 0.1.2 sessionController is unavailable");
+		this.session = session;
+		this.workspaceController = ctx.get("workspaceController");
+		this.directoryPicker = ctx.get("directoryPickerController");
+	}
+	sessions = {
+		list: async () => this.call(async () => {
+			return { items: (await this.session.list({}, new AbortController().signal)).items.map(toPhoneSessionRow).filter((row) => !isSubagentRow(row)) };
+		}),
+		history: async (request) => this.call(async () => {
+			const sessionId = request.payload.sessionId;
+			let inspected;
+			try {
+				inspected = await this.session.inspect(sessionId);
+			} catch (error) {
+				console.warn(`[deeppilot] session history unavailable for ${JSON.stringify(sessionId)}: ${toError(error).code}: ${toError(error).message}`);
+				throw error;
+			}
+			const before = request.payload?.beforeSeq;
+			const limit = Math.max(1, request.payload?.maxMessages ?? 100);
+			const source = inspected.events.filter((event) => typeof event === "object" && event !== null && typeof event.type === "string" && typeof event.seq === "number").filter((event) => before === void 0 || event.seq < before);
+			let end = source.length;
+			let events = [];
+			while (end > 0 && projectHistory(events).length < limit) {
+				const start = Math.max(0, end - limit);
+				events = [...source.slice(start, end).map((event) => ({ event })), ...events];
+				end = start;
+			}
+			let trimmed = false;
+			while (events.length > 0 && projectHistory(events).length > limit) {
+				events = events.slice(1);
+				trimmed = true;
+			}
+			return {
+				events,
+				hasMore: end > 0 || trimmed
+			};
+		}),
+		prompt: async (request) => this.call(() => this.session.prompt({
+			...request.payload,
+			requestId: request.rpcId ?? randomUUID()
+		}, new AbortController().signal)),
+		create: async (request) => this.call(() => this.session.create(request.payload ?? {})),
+		models: async (request) => this.call(async () => projectModels(await this.session.modelCatalog(), String(request.payload?.sessionId ?? ""), await this.session.list({}, new AbortController().signal))),
+		selectModel: async (request) => this.call(() => this.session.selectModel(request.payload ?? {})),
+		rename: async (request) => this.call(() => this.session.rename(request.payload)),
+		cancel: async (request) => this.call(() => this.session.cancel(request.payload)),
+		attachment: async (request) => this.call(() => this.session.attachment(request.payload))
+	};
+	workspace = {
+		list: async () => this.call(async () => {
+			if (this.workspaceController === void 0) throw unavailable("workspace controller unavailable");
+			const baseline = await readWorkspaceBaseline(this.workspaceController);
+			return {
+				items: baseline.items.map(toWorkspaceView),
+				archivedSessionIds: baseline.archivedSessionIds.map(String)
+			};
+		}),
+		create: async (request) => this.call(async () => {
+			if (this.workspaceController === void 0) throw unavailable("workspace controller unavailable");
+			const value = await this.workspaceController.create(request.payload);
+			return {
+				workspace: toWorkspaceView(value.workspace),
+				created: value.created === true
+			};
+		}),
+		archiveSession: async (request) => this.call(async () => {
+			if (this.workspaceController === void 0) throw unavailable("workspace controller unavailable");
+			return { archivedSessionIds: [...(await this.workspaceController.archiveSession(request.payload)).archivedSessionIds] };
+		})
+	};
+	host = {
+		listDirectory: async (request, signal) => this.call(async () => {
+			if (this.directoryPicker === void 0) throw unavailable("directory picker unavailable");
+			return await this.directoryPicker.list(request.payload?.path, signal ?? new AbortController().signal);
+		}),
+		pickDirectory: async (_request, signal) => this.call(async () => {
+			if (this.directoryPicker === void 0) throw unavailable("directory picker unavailable");
+			return { path: await this.directoryPicker.pick(signal ?? new AbortController().signal) };
+		})
+	};
+	events = {
+		mux: (_request, signal) => this.mux(signal),
+		host: (_request, signal) => this.hostEvents(signal)
+	};
+	async respond(message) {
+		const pending = this.interactions.get(message.rpcId);
+		if (pending === void 0) return {
+			accepted: false,
+			reason: "not-pending"
+		};
+		if (!message.result.ok) return {
+			accepted: false,
+			reason: "bad-response"
+		};
+		this.interactions.delete(message.rpcId);
+		pending.resolve(pending.map(message.result.value));
+		return { accepted: true };
+	}
+	async *mux(signal) {
+		const queue = new AsyncFrameQueue(signal);
+		const offEvent = this.ctx.on("session/event", ((session, event) => {
+			queue.push({
+				type: "session/event",
+				sessionId: String(session.id),
+				event
+			});
+		}), { global: true });
+		const offProjection = this.ctx.get("sessionProjections")?.onChanged?.((session, key, value) => {
+			queue.push({
+				type: "session/projection",
+				sessionId: String(session.id),
+				key,
+				value
+			});
+		});
+		const offApproval = this.ctx.on("approval/request", ((request) => {
+			const rpcId = randomUUID();
+			const sessionId = String(request.agent?.session?.id ?? request.agent?.id ?? "");
+			const response = deferred();
+			const abort = () => response.resolve("cancelled");
+			request.signal?.addEventListener("abort", abort, { once: true });
+			this.interactions.set(rpcId, {
+				resolve: response.resolve,
+				map: (value) => {
+					const outcome = value?.outcome;
+					return outcome === "allowed-once" || outcome === "rejected" ? outcome : "unavailable";
+				}
+			});
+			queue.push({
+				type: "approval/requested",
+				rpcId,
+				sessionId,
+				approvalId: rpcId,
+				toolName: String(request.toolName ?? "tool"),
+				reason: String(request.reason ?? "")
+			});
+			return response.promise.finally(() => {
+				request.signal?.removeEventListener("abort", abort);
+				this.interactions.delete(rpcId);
+				queue.push({
+					type: "approval/resolved",
+					approvalId: rpcId
+				});
+			});
+		}), { global: true });
+		const offQuestion = this.ctx.on("user-questions/request", ((request) => {
+			const rpcId = randomUUID();
+			const sessionId = String(request.agent?.session?.id ?? request.agent?.id ?? "");
+			const response = deferred();
+			const abort = () => response.reject(/* @__PURE__ */ new Error("question cancelled"));
+			request.signal?.addEventListener("abort", abort, { once: true });
+			this.interactions.set(rpcId, {
+				resolve: response.resolve,
+				map: (value) => value?.answer ?? value
+			});
+			queue.push({
+				type: "question/requested",
+				rpcId,
+				sessionId,
+				questions: request.questions ?? []
+			});
+			return response.promise.finally(() => {
+				request.signal?.removeEventListener("abort", abort);
+				this.interactions.delete(rpcId);
+				queue.push({
+					type: "question/resolved",
+					questionRpcId: rpcId
+				});
+			});
+		}), { global: true });
+		try {
+			yield* queue.iterate();
+		} finally {
+			offEvent();
+			offProjection?.();
+			offApproval();
+			offQuestion();
+			queue.close();
+		}
+	}
+	async *hostEvents(signal) {
+		const queue = new AsyncFrameQueue(signal);
+		const listen = (event, type, project) => this.ctx.on(event, ((...args) => queue.push({
+			type,
+			...project?.(...args) ?? {}
+		})), { global: true });
+		const off = [
+			listen("api-session/added", "host/session-added"),
+			listen("api-session/removed", "host/session-removed"),
+			listen("api-session/status", "host/session-status", (sessionId, running) => ({
+				sessionId: String(sessionId),
+				running: running === true
+			})),
+			listen("api-session/activity", "host/session-added")
+		];
+		const workspaceAbort = new AbortController();
+		const stop = () => workspaceAbort.abort();
+		signal.addEventListener("abort", stop, { once: true });
+		this.workspaceController === void 0 || (async () => {
+			try {
+				for await (const frame of this.workspaceController.follow(workspaceAbort.signal)) if (frame.type === "archived") queue.push({
+					type: "host/archived-sessions-changed",
+					archivedSessionIds: frame.archivedSessionIds
+				});
+				else if (frame.type !== "baseline") queue.push({ type: "host/workspace-changed" });
+			} catch {}
+		})();
+		try {
+			yield* queue.iterate();
+		} finally {
+			for (const dispose of off) dispose();
+			signal.removeEventListener("abort", stop);
+			workspaceAbort.abort();
+			queue.close();
+		}
+	}
+	async call(invoke) {
+		try {
+			return { result: {
+				ok: true,
+				value: await invoke()
+			} };
+		} catch (error) {
+			return { result: {
+				ok: false,
+				error: toError(error)
+			} };
+		}
+	}
+};
+function deferred() {
+	let resolve;
+	let reject;
+	return {
+		promise: new Promise((ok, fail) => {
+			resolve = ok;
+			reject = fail;
+		}),
+		resolve,
+		reject
+	};
+}
+var AsyncFrameQueue = class {
+	frames = [];
+	wake;
+	closed = false;
+	constructor(signal) {
+		signal.addEventListener("abort", () => this.close(), { once: true });
+	}
+	push(frame) {
+		if (!this.closed) {
+			this.frames.push(frame);
+			this.wake?.();
+		}
+	}
+	close() {
+		if (!this.closed) {
+			this.closed = true;
+			this.wake?.();
+		}
+	}
+	async *iterate() {
+		while (!this.closed) {
+			const frame = this.frames.shift();
+			if (frame !== void 0) {
+				yield frame;
+				continue;
+			}
+			await new Promise((resolve) => {
+				this.wake = resolve;
+			});
+			this.wake = void 0;
+		}
+	}
+};
+function unavailable(message) {
+	return Object.assign(new Error(message), { code: "directory-picker-unavailable" });
+}
+function toError(error) {
+	const value = error;
+	return {
+		code: typeof value?.code === "string" ? value.code : "internal",
+		message: typeof value?.message === "string" ? value.message : String(error)
+	};
+}
+function toPhoneSessionRow(value) {
+	const row = value;
+	return {
+		sessionId: String(row.sessionId ?? ""),
+		updatedAt: Number(row.updatedAt ?? Date.now()),
+		running: row.running === true,
+		...row.blank === true ? { blank: true } : {},
+		...typeof row.cwd === "string" ? { cwd: row.cwd } : {},
+		...typeof row.origin === "string" ? { origin: row.origin } : {},
+		...typeof row.parentSessionId === "string" ? { parentSessionId: row.parentSessionId } : {},
+		...row.projections && typeof row.projections === "object" ? { projections: row.projections } : {}
+	};
+}
+function toWorkspaceView(value) {
+	const row = value;
+	return {
+		workspaceId: String(row.workspaceId ?? ""),
+		title: String(row.title ?? ""),
+		path: String(row.path ?? ""),
+		sessionIds: Array.isArray(row.sessionIds) ? row.sessionIds.map(String) : []
+	};
+}
+async function readWorkspaceBaseline(controller) {
+	const abort = new AbortController();
+	const iterator = controller.follow(abort.signal)[Symbol.asyncIterator]();
+	try {
+		const baseline = (await iterator.next()).value;
+		if (baseline?.type !== "baseline") throw new Error("workspace follow did not provide a baseline");
+		return {
+			items: (baseline.value?.items ?? []).map(toWorkspaceView),
+			archivedSessionIds: (baseline.value?.archivedSessionIds ?? []).map(String)
+		};
+	} finally {
+		abort.abort();
+		await iterator.return?.();
+	}
+}
+async function projectModels(catalog, sessionId, list) {
+	const value = catalog;
+	const selected = (list.items.map(toPhoneSessionRow).find((item) => item.sessionId === sessionId)?.projections?.values?.modelSelection)?.next;
+	return {
+		current: {
+			provider: String(selected?.provider ?? value.default?.provider ?? ""),
+			model: String(selected?.model ?? value.default?.model ?? ""),
+			...typeof selected?.reasoningEffort === "string" ? { reasoningEffort: selected.reasoningEffort } : {}
+		},
+		routable: true,
+		groups: Array.isArray(value.groups) ? value.groups : [],
+		failures: Array.isArray(value.failures) ? value.failures : []
+	};
+}
+//#endregion
 //#region src/report-service.ts
 /**
 * The Typert receiver the Gateway resolves for the DeepPilot Bridge report.
@@ -2316,26 +2844,31 @@ function projectSessionModels(value) {
 */
 var DeepPilotReportService = class extends TypertRemoteService {
 	snapshot;
-	pairingToken;
-	rotatePairingToken;
+	pairingStarter;
+	deviceRevoker;
+	deviceScopeUpdater;
 	relayTester;
 	pushTester;
-	constructor(ctx, snapshot, pairingToken, rotatePairingToken, relayTester, pushTester) {
+	constructor(ctx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester) {
 		super(ctx, "deeppilotReport", { namespace: "deeppilot" });
 		this.snapshot = snapshot;
-		this.pairingToken = pairingToken;
-		this.rotatePairingToken = rotatePairingToken;
+		this.pairingStarter = pairingStarter;
+		this.deviceRevoker = deviceRevoker;
+		this.deviceScopeUpdater = deviceScopeUpdater;
 		this.relayTester = relayTester;
 		this.pushTester = pushTester;
 	}
 	async report() {
 		return this.snapshot();
 	}
-	async revealToken() {
-		return this.pairingToken();
+	async beginPairing() {
+		return this.pairingStarter();
+	}
+	async revokeDevice(deviceId) {
+		return this.deviceRevoker(deviceId);
 	}
-	async rotateToken() {
-		return this.rotatePairingToken();
+	async setDeviceScopes(deviceId, scopes) {
+		return this.deviceScopeUpdater(deviceId, scopes);
 	}
 	async testRelay() {
 		return this.relayTester();
@@ -2350,14 +2883,9 @@ var DeepPilotReportService = class extends TypertRemoteService {
 const REPORT_REMOTE_PACKAGE = "dsh-deeppilot";
 /** Canonical `<namespace>/<method>` endpoint of the report Remote. */
 const REPORT_ENDPOINT = "deeppilot/report";
-/** Explicit, user-triggered endpoint for revealing the pairing secret. */
-const REVEAL_TOKEN_ENDPOINT = "deeppilot/revealToken";
-/**
-* Explicit, user-triggered endpoint that replaces the pairing secret. The old
-* token stops working immediately; the fresh one is returned so the page can
-* show/QR it right away.
-*/
-const ROTATE_TOKEN_ENDPOINT = "deeppilot/rotateToken";
+const BEGIN_PAIRING_ENDPOINT = "deeppilot/beginPairing";
+const REVOKE_DEVICE_ENDPOINT = "deeppilot/revokeDevice";
+const SET_DEVICE_SCOPES_ENDPOINT = "deeppilot/setDeviceScopes";
 function reject(field) {
 	throw new TypeError(`deeppilot/report result: invalid ${field}`);
 }
@@ -2405,6 +2933,9 @@ function parseDevice(value) {
 		appVersion: str(s, "appVersion", "device.appVersion"),
 		firstSeenTs: int(s, "firstSeenTs", "device.firstSeenTs"),
 		lastSeenTs: int(s, "lastSeenTs", "device.lastSeenTs"),
+		fingerprint: str(s, "fingerprint", "device.fingerprint"),
+		scopes: normalizeDeviceScopes(s.scopes),
+		...s.revokedAt !== void 0 ? { revokedAt: int(s, "revokedAt", "device.revokedAt") } : {},
 		...apns ? { apns } : {}
 	};
 }
@@ -2512,8 +3043,8 @@ function parseReport(value) {
 		...s.updateAvailable === true ? { updateAvailable: true } : {},
 		...typeof releaseUrl === "string" && releaseUrl.length > 0 ? { releaseUrl } : {},
 		enabled: bool(s, "enabled", "enabled"),
-		tokenPath: str(s, "tokenPath", "tokenPath"),
-		tokenReady: bool(s, "tokenReady", "tokenReady"),
+		identityPath: str(s, "identityPath", "identityPath"),
+		pairingReady: bool(s, "pairingReady", "pairingReady"),
 		activeConnections: int(s, "activeConnections", "activeConnections"),
 		historyBufferMax: int(s, "historyBufferMax", "historyBufferMax"),
 		debug: bool(s, "debug", "debug"),
@@ -2525,14 +3056,33 @@ function parseReport(value) {
 const reportSchema = { parse: parseReport };
 const relayTestSchema = { parse: parseRelayTestResult };
 const pushTestSchema = { parse: parsePushTestResult };
-const pairingTokenSchema = { parse(value) {
-	if (typeof value !== "string" || value.length < 32) throw new TypeError("deeppilot/revealToken result: invalid token");
+const pairingGrantSchema = { parse(value) {
+	const s = rec(value, "pairing grant");
+	const code = str(s, "code", "pairingGrant.code");
+	if (code.length < 32) reject("pairingGrant.code");
+	return {
+		code,
+		expiresAt: int(s, "expiresAt", "pairingGrant.expiresAt"),
+		audience: str(s, "audience", "pairingGrant.audience")
+	};
+} };
+const deviceIdSchema = { parse(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value)) reject("deviceId");
 	return value;
 } };
+const scopesSchema = { parse(value) {
+	if (!Array.isArray(value) || value.some((scope) => typeof scope !== "string" || !DEVICE_SCOPES.includes(scope))) reject("scopes");
+	return normalizeDeviceScopes(value);
+} };
 const REPORT_HOST_CONTRIBUTION = {
 	package: REPORT_REMOTE_PACKAGE,
 	face: "host",
 	schemas: [],
+	model: {
+		services: [],
+		events: [],
+		objects: []
+	},
 	invocations: [
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#${REPORT_ENDPOINT}`,
@@ -2548,29 +3098,72 @@ const REPORT_HOST_CONTRIBUTION = {
 			}
 		},
 		{
-			id: `${REPORT_REMOTE_PACKAGE}#${REVEAL_TOKEN_ENDPOINT}`,
+			id: `${REPORT_REMOTE_PACKAGE}#${BEGIN_PAIRING_ENDPOINT}`,
 			service: "deeppilotReport",
 			namespace: "deeppilot",
-			method: "revealToken",
+			method: "beginPairing",
 			invocation: { kind: "direct" },
 			parameters: [],
 			result: {
 				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PairingToken`,
-				schema: pairingTokenSchema
+				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PairingGrantSnapshot`,
+				schema: pairingGrantSchema
 			}
 		},
 		{
-			id: `${REPORT_REMOTE_PACKAGE}#${ROTATE_TOKEN_ENDPOINT}`,
+			id: `${REPORT_REMOTE_PACKAGE}#${REVOKE_DEVICE_ENDPOINT}`,
 			service: "deeppilotReport",
 			namespace: "deeppilot",
-			method: "rotateToken",
+			method: "revokeDevice",
 			invocation: { kind: "direct" },
-			parameters: [],
+			parameters: [{
+				name: "deviceId",
+				wire: "deviceId",
+				source: "json",
+				codec: {
+					mode: "strict",
+					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceId`,
+					schema: deviceIdSchema
+				}
+			}],
 			result: {
 				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PairingToken`,
-				schema: pairingTokenSchema
+				typeSymbol: `${REPORT_REMOTE_PACKAGE}#Boolean`,
+				schema: { parse(value) {
+					if (typeof value !== "boolean") reject("boolean");
+					return value;
+				} }
+			}
+		},
+		{
+			id: `${REPORT_REMOTE_PACKAGE}#${SET_DEVICE_SCOPES_ENDPOINT}`,
+			service: "deeppilotReport",
+			namespace: "deeppilot",
+			method: "setDeviceScopes",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "deviceId",
+				wire: "deviceId",
+				source: "json",
+				codec: {
+					mode: "strict",
+					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceId`,
+					schema: deviceIdSchema
+				}
+			}, {
+				name: "scopes",
+				wire: "scopes",
+				source: "json",
+				codec: {
+					mode: "strict",
+					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceScopes`,
+					schema: scopesSchema
+				}
+			}],
+			result: {
+				mode: "strict",
+				typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceScopes`,
+				schema: scopesSchema
 			}
 		},
 		{
@@ -2607,9 +3200,9 @@ const REPORT_HOST_CONTRIBUTION = {
 * Provide the report service and register its Remote descriptor. Rides an
 * optional `typert` inject: profiles without the web stack never activate it.
 */
-function applyReportRemote(ctx, snapshot, pairingToken, rotatePairingToken, relayTester, pushTester) {
+function applyReportRemote(ctx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester) {
 	ctx.inject(["typert"], (remoteCtx) => {
-		new DeepPilotReportService(remoteCtx, snapshot, pairingToken, rotatePairingToken, relayTester, pushTester);
+		new DeepPilotReportService(remoteCtx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester);
 		const unregister = remoteCtx.typert.register(REPORT_HOST_CONTRIBUTION);
 		remoteCtx.effect(() => () => void unregister(), "dsh-deeppilot: report remote");
 	});
@@ -3027,6 +3620,9 @@ var RelayClient = class {
 		}
 	}
 };
+function normalizeFunnelConnectionLimit(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 16 ? value : 8;
+}
 //#endregion
 //#region src/remote-supervisor.ts
 const RESTART_DELAYS_MS = [
@@ -3056,6 +3652,20 @@ function normalizeRemoteHostname(value) {
 	].includes(hostname.toLowerCase())) return DEFAULT_REMOTE_HOSTNAME;
 	return hostname;
 }
+function tunnelHelperArguments(originURL, statePath, options) {
+	return [
+		"--origin",
+		originURL,
+		"--hostname",
+		normalizeRemoteHostname(options.hostname),
+		"--state-dir",
+		statePath,
+		"--port",
+		String(options.funnelPort ?? 443),
+		"--max-connections-per-source",
+		String(normalizeFunnelConnectionLimit(options.maxConnectionsPerSource))
+	];
+}
 /** Parse one helper IPC line without ever evaluating or interpolating it. */
 function parseHelperEvent(line) {
 	try {
@@ -3179,16 +3789,7 @@ var RemoteSupervisor = class {
 			phase: "starting",
 			message: void 0
 		});
-		const child = spawn(helper, [
-			"--origin",
-			originURL,
-			"--hostname",
-			normalizeRemoteHostname(this.options.hostname),
-			"--state-dir",
-			statePath,
-			"--port",
-			String(this.options.funnelPort ?? 443)
-		], {
+		const child = spawn(helper, tunnelHelperArguments(originURL, statePath, this.options), {
 			stdio: [
 				"ignore",
 				"pipe",
@@ -3539,8 +4140,7 @@ var UpdateChecker = class {
 const DEFAULT_RELAY_URL = "https://pilot.hailab.dev";
 const Config = z.object({
 	enabled: z.boolean().default(true),
-	authTokenPath: z.string().default(join(bridgeDataDir(), "auth-token")),
-	devicesPath: z.string().default(join(bridgeDataDir(), "devices.json")),
+	devicesPath: z.string().default(join(bridgeDataDir(), "devices-v2.json")),
 	historyBufferMax: z.natural().min(100).default(2e3),
 	debug: z.boolean().default(false),
 	remote: z.object({
@@ -3553,14 +4153,16 @@ const Config = z.object({
 			443,
 			8443,
 			1e4
-		]).default(443)
+		]).default(443),
+		maxConnectionsPerSource: z.natural().min(1).max(16).default(8).description("Funnel 每个来源允许的并发连接数（1–16，修改后远程连接会短暂重连）")
 	}).default({
 		enabled: false,
 		provider: "tailscale-funnel",
 		hostname: DEFAULT_REMOTE_HOSTNAME,
 		statePath: join(bridgeDataDir(), "tailscale"),
 		helperPath: "",
-		funnelPort: 443
+		funnelPort: 443,
+		maxConnectionsPerSource: 8
 	}),
 	push: z.object({
 		provider: z.union([
@@ -3596,7 +4198,8 @@ function normalizeOptions(options) {
 }
 //#endregion
 //#region src/phone-http.ts
-function rejectUpgrade(socket, status, reason) {
+const CLIENT_IP_HEADER = "x-deeppilot-client-ip";
+function rejectUpgrade(socket, status, reason, retryAfterSeconds) {
 	const body = JSON.stringify({ error: reason });
 	const statusText = {
 		401: "Unauthorized",
@@ -3604,23 +4207,149 @@ function rejectUpgrade(socket, status, reason) {
 		500: "Internal Server Error",
 		503: "Service Unavailable"
 	};
-	const authenticate = status === 401 ? "WWW-Authenticate: Bearer realm=\"deeppilot\"\r\n" : "";
-	socket.end("HTTP/1.1 " + status + " " + (statusText[status] ?? "Error") + "\r\n" + authenticate + "Content-Type: application/json\r\nContent-Length: " + Buffer.byteLength(body) + "\r\nConnection: close\r\n\r\n" + body);
+	const retryAfter = status === 429 && retryAfterSeconds !== void 0 ? `Retry-After: ${Math.max(1, Math.ceil(retryAfterSeconds))}\r\n` : "";
+	socket.end("HTTP/1.1 " + status + " " + (statusText[status] ?? "Error") + "\r\n" + retryAfter + "Content-Type: application/json\r\nContent-Length: " + Buffer.byteLength(body) + "\r\nConnection: close\r\n\r\n" + body);
 }
-/** Authorization is preferred; the query form remains for older app builds. */
-function requestToken(req) {
-	const authorization = req.headers.authorization;
-	if (typeof authorization === "string") {
-		const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
-		if (match?.[1]) return match[1];
-	}
-	try {
-		return new URL(req.url ?? "/", "http://phone.local").searchParams.get("token");
-	} catch {
-		return null;
+function normalizedAddress(value) {
+	if (!value) return null;
+	const normalized = value.startsWith("::ffff:") ? value.slice(7) : value;
+	return isIP(normalized) === 0 ? null : normalized;
+}
+function isLoopback(value) {
+	const address = normalizedAddress(value);
+	return address === "127.0.0.1" || address === "::1";
+}
+/**
+* Resolve a stable rate-limit key. The helper-supplied address is trusted only
+* on the private loopback hop; direct clients cannot spoof it.
+*/
+function requestClientIdentity(req) {
+	if (isLoopback(req.socket.remoteAddress)) {
+		const forwarded = req.headers[CLIENT_IP_HEADER];
+		const address = normalizedAddress(Array.isArray(forwarded) ? forwarded[0] : forwarded);
+		if (address !== null) return address;
 	}
+	return normalizedAddress(req.socket.remoteAddress) ?? "unknown";
 }
 //#endregion
+//#region src/auth-rate-limit.ts
+const DEFAULT_AUTH_RATE_POLICY = {
+	windowMs: 6e4,
+	attemptsPerSource: 12,
+	globalAttempts: 120,
+	maxUnauthenticatedPerSource: 2,
+	failureWindowMs: 6e5,
+	failuresBeforeBlock: 5,
+	blockMs: 9e5,
+	maxSources: 4096
+};
+const noop = () => {};
+/** Bounded in-memory protection for anonymous authentication attempts. */
+var AuthRateLimiter = class {
+	policy;
+	sources = /* @__PURE__ */ new Map();
+	globalAttempts = [];
+	constructor(policy = DEFAULT_AUTH_RATE_POLICY) {
+		this.policy = policy;
+	}
+	admit(source, now = Date.now()) {
+		const state = this.source(source, now);
+		if (state === null) return {
+			ok: false,
+			retryAfterMs: this.policy.windowMs,
+			release: noop
+		};
+		this.prune(state, now);
+		state.lastSeen = now;
+		if (state.blockedUntil > now) return {
+			ok: false,
+			retryAfterMs: state.blockedUntil - now,
+			release: noop
+		};
+		if (state.active >= this.policy.maxUnauthenticatedPerSource) return {
+			ok: false,
+			retryAfterMs: this.policy.windowMs,
+			release: noop
+		};
+		if (state.attempts.length >= this.policy.attemptsPerSource) return {
+			ok: false,
+			retryAfterMs: state.attempts[0] + this.policy.windowMs - now,
+			release: noop
+		};
+		this.globalAttempts = this.globalAttempts.filter((ts) => ts > now - this.policy.windowMs);
+		if (this.globalAttempts.length >= this.policy.globalAttempts) return {
+			ok: false,
+			retryAfterMs: this.globalAttempts[0] + this.policy.windowMs - now,
+			release: noop
+		};
+		state.attempts.push(now);
+		this.globalAttempts.push(now);
+		state.active += 1;
+		let released = false;
+		return {
+			ok: true,
+			retryAfterMs: 0,
+			release: () => {
+				if (released) return;
+				released = true;
+				state.active = Math.max(0, state.active - 1);
+			}
+		};
+	}
+	recordFailure(source, now = Date.now()) {
+		const state = this.source(source, now);
+		if (state === null) return {
+			blocked: true,
+			newlyBlocked: false,
+			retryAfterMs: this.policy.blockMs
+		};
+		this.prune(state, now);
+		state.lastSeen = now;
+		const wasBlocked = state.blockedUntil > now;
+		state.failures.push(now);
+		if (state.failures.length >= this.policy.failuresBeforeBlock) state.blockedUntil = Math.max(state.blockedUntil, now + this.policy.blockMs);
+		return {
+			blocked: state.blockedUntil > now,
+			newlyBlocked: !wasBlocked && state.blockedUntil > now,
+			retryAfterMs: Math.max(0, state.blockedUntil - now)
+		};
+	}
+	recordSuccess(source, now = Date.now()) {
+		const state = this.sources.get(source);
+		if (state === void 0) return;
+		state.failures = [];
+		state.blockedUntil = 0;
+		state.lastSeen = now;
+	}
+	source(source, now) {
+		const existing = this.sources.get(source);
+		if (existing !== void 0) return existing;
+		if (this.sources.size >= this.policy.maxSources) this.pruneSources(now);
+		if (this.sources.size >= this.policy.maxSources) return null;
+		const state = {
+			attempts: [],
+			failures: [],
+			blockedUntil: 0,
+			active: 0,
+			lastSeen: now
+		};
+		this.sources.set(source, state);
+		return state;
+	}
+	prune(state, now) {
+		state.attempts = state.attempts.filter((ts) => ts > now - this.policy.windowMs);
+		state.failures = state.failures.filter((ts) => ts > now - this.policy.failureWindowMs);
+		if (state.blockedUntil <= now) state.blockedUntil = 0;
+	}
+	pruneSources(now) {
+		const staleBefore = now - Math.max(this.policy.failureWindowMs, this.policy.blockMs);
+		for (const [source, state] of this.sources) {
+			this.prune(state, now);
+			if (state.active === 0 && state.blockedUntil === 0 && state.lastSeen < staleBefore) this.sources.delete(source);
+		}
+	}
+};
+//#endregion
 //#region src/push-policy.ts
 /** Prune only when the provider supplies an authoritative token-lifecycle verdict. */
 function shouldPrunePushToken(outcome, reason) {
@@ -3643,12 +4372,13 @@ function shouldReEnrollRelayToken(transport, outcome, reason, opts) {
 * optional health probe (/phone/health) on the existing web server. The web
 * UI is never touched.
 *
-* Data plane: an in-process HostBridge consumes apiProxy.events.mux()/host()
-* streams, mirrors session summaries, tracks pending approvals/questions,
-* and fans projected protocol-v1 pushes out to every connected device.
+* Data plane: an in-process HostBridge consumes a local compatibility façade
+* over DSH 0.1.2 Session/Workspace controllers, mirrors session summaries,
+* tracks pending approvals/questions, and fans projected protocol-v2 pushes
+* out to every connected device.
 *
 * Protocol: PROTOCOL.md is normative; src/protocol.ts and the private app's
-* Swift models mirror that v1 contract.
+* Swift models mirror that v2 contract.
 */
 const name = "deeppilot";
 /** No eager service requirement: profiles without a web stack simply skip. */
@@ -3682,6 +4412,8 @@ function apply(ctx, options) {
 	const log = (message) => {
 		console.log("[deeppilot] " + message);
 	};
+	const auditSalt = randomBytes(32);
+	const auditLabel = (value) => createHash("sha256").update(auditSalt).update(value).digest("hex").slice(0, 12);
 	/**
 	* Settings-section source: while a settings service is attached this holds
 	* the user-edited section value; otherwise the composition defaults. Read
@@ -3736,9 +4468,9 @@ function apply(ctx, options) {
 		const url = (currentConfig().push?.relayUrl ?? "").trim() || "https://pilot.hailab.dev";
 		await ensureRelayEnrolled(url);
 	};
+	const pairingCodes = new PairingCodeManager();
 	const auth = {
-		token: null,
-		tokenPath: cfg.authTokenPath ?? join(dataDir, "auth-token"),
+		audience: null,
 		devices: null
 	};
 	const ready = (async () => {
@@ -3749,13 +4481,13 @@ function apply(ctx, options) {
 			} catch (error) {
 				log("legacy plugin-state migration skipped: " + String(error));
 			}
-			auth.tokenPath = cfg.authTokenPath ?? join(dataDir, "auth-token");
-			auth.token = await loadOrCreateToken(auth.tokenPath);
-			auth.devices = await DeviceStore.load(cfg.devicesPath ?? join(dataDir, "devices.json"));
+			await ensurePrivateBridgeDataDir();
+			auth.audience = await loadOrCreateHostAudience(join(dataDir, "host-id"));
+			auth.devices = await DeviceStore.load(cfg.devicesPath ?? join(dataDir, "devices-v2.json"));
 			{
 				const rows = auth.devices.list();
 				const registered = rows.filter((row) => row.apns !== void 0).length;
-				log(`device registry loaded from ${expandHome(cfg.devicesPath ?? join(dataDir, "devices.json"))}: ${rows.length} device(s), ${registered} push registration(s)`);
+				log(`device registry loaded from ${expandHome(cfg.devicesPath ?? join(dataDir, "devices-v2.json"))}: ${rows.length} device(s), ${registered} push registration(s)`);
 			}
 			try {
 				const raw = JSON.parse(await readFile(pushRelayPath, "utf8"));
@@ -3765,48 +4497,24 @@ function apply(ctx, options) {
 				if (raw.autoRelay === true) enrollmentCell.autoRelay = true;
 			} catch {}
 		} catch (error) {
-			const message = String(error);
-			if (message.includes("pairing token is malformed at")) console.warn("[deeppilot] " + message);
-			log("auth material unavailable, bridge degraded: " + message);
+			log("auth material unavailable, bridge degraded: " + String(error));
 			return {
-				token: null,
+				audience: null,
 				devices: null
 			};
 		}
 		return {
-			token: auth.token,
+			audience: auth.audience,
 			devices: auth.devices
 		};
 	})();
-	/**
-	* Replace the pairing secret: persist a fresh token, clear the paired-device
-	* registry, and drop every live phone socket. Handshake-time auth means an
-	* already-open socket would otherwise outlive its token; terminating forces
-	* each device to re-pair with the new secret. The old token is invalid the
-	* moment the file is rewritten.
-	*
-	* Serialized through rotateTail so two overlapping invocations can never
-	* return a token that a later write already invalidated.
-	*/
-	const doRotate = async () => {
-		const { devices } = await ready;
-		if (auth.token === null || devices === null) throw new Error("pairing token unavailable");
-		auth.token = await writeNewToken(auth.tokenPath);
-		devices.clear();
-		let dropped = 0;
-		for (const connection of connections) {
-			connection.terminate();
-			dropped += 1;
-		}
-		connections.clear();
-		log(`pairing token rotated; ${dropped} live phone connection(s) dropped`);
-		return auth.token;
-	};
-	let rotateTail = Promise.resolve();
-	const rotatePairingToken = () => {
-		const next = rotateTail.then(doRotate);
-		rotateTail = next.catch(() => {});
-		return next;
+	const beginPairing = async () => {
+		await ready;
+		if (auth.audience === null || auth.devices === null) throw new Error("device authentication unavailable");
+		return {
+			...pairingCodes.issue(),
+			audience: auth.audience
+		};
 	};
 	/**
 	* Settings-page push self-test: force one synthetic notification down the
@@ -4138,17 +4846,20 @@ function apply(ctx, options) {
 	updateChecker.scheduleInitial();
 	const updateInfo = () => updateChecker.get();
 	applyReportRemote(ctx, async () => {
-		let tokenReady = false;
+		let pairingReady = false;
 		let devices = [];
 		try {
 			await ready;
-			tokenReady = auth.token !== null;
-			devices = (auth.devices?.list() ?? []).map(({ deviceId, deviceName, appVersion, firstSeenTs, lastSeenTs, apns }) => ({
+			pairingReady = auth.audience !== null && auth.devices !== null;
+			devices = (auth.devices?.list() ?? []).filter((device) => device.publicKey !== void 0 && device.fingerprint !== void 0).map(({ deviceId, deviceName, appVersion, firstSeenTs, lastSeenTs, fingerprint, scopes, revokedAt, apns }) => ({
 				deviceId,
 				deviceName,
 				appVersion,
 				firstSeenTs,
 				lastSeenTs,
+				fingerprint,
+				scopes: normalizeDeviceScopes(scopes),
+				...revokedAt !== void 0 ? { revokedAt } : {},
 				...apns ? { apns: {
 					environment: apns.environment,
 					updatedAt: apns.updatedAt
@@ -4157,14 +4868,14 @@ function apply(ctx, options) {
 		} catch {}
 		const update = updateInfo();
 		return {
-			protocolVersion: 1,
+			protocolVersion: 2,
 			serverVersion: SERVER_VERSION,
 			pluginVersion: update.currentVersion,
 			...update.available ? { updateAvailable: true } : {},
 			...update.releaseUrl !== null ? { releaseUrl: update.releaseUrl } : {},
 			enabled: currentConfig().enabled === true,
-			tokenPath: expandHome(currentConfig().authTokenPath ?? join(bridgeDataDir(), "auth-token")),
-			tokenReady,
+			identityPath: expandHome(currentConfig().devicesPath ?? join(bridgeDataDir(), "devices-v2.json")),
+			pairingReady,
 			activeConnections: connections.size,
 			historyBufferMax: currentConfig().historyBufferMax ?? 2e3,
 			debug: currentConfig().debug === true,
@@ -4172,11 +4883,32 @@ function apply(ctx, options) {
 			remote: remoteStatus(),
 			devices
 		};
+	}, beginPairing, async (deviceId) => {
+		const { devices } = await ready;
+		if (!devices) throw new Error("device registry unavailable");
+		const revoked = devices.revoke(deviceId, Date.now());
+		if (revoked) {
+			for (const connection of [...connections]) {
+				if (connection.connectedDeviceId !== deviceId) continue;
+				connection.terminate();
+				connections.delete(connection);
+			}
+			log(`device revoked id=${auditLabel(deviceId)}`);
+		}
+		return revoked;
+	}, async (deviceId, scopes) => {
+		const { devices } = await ready;
+		if (!devices) throw new Error("device registry unavailable");
+		const updated = devices.setScopes(deviceId, scopes);
+		if (updated === null) throw new Error("active device not found");
+		for (const connection of [...connections]) {
+			if (connection.connectedDeviceId !== deviceId) continue;
+			connection.terminate();
+			connections.delete(connection);
+		}
+		log(`device scopes updated id=${auditLabel(deviceId)} scopes=${updated.join(",")}`);
+		return updated;
 	}, async () => {
-		await ready;
-		if (auth.token === null) throw new Error("pairing token unavailable");
-		return auth.token;
-	}, rotatePairingToken, async () => {
 		const push = currentConfig().push ?? {};
 		const configured = push.provider ?? "none";
 		if ((configured === "none" && enrollmentCell.autoRelay === true ? "relay" : configured) !== "relay") return {
@@ -4220,6 +4952,102 @@ function apply(ctx, options) {
 	});
 	const state = {};
 	let pendingUpgrades = 0;
+	const authRateLimiter = new AuthRateLimiter();
+	const readJSONBody = async (req, maxBytes = 16384) => {
+		const chunks = [];
+		let size = 0;
+		for await (const chunk of req) {
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			size += buffer.length;
+			if (size > maxBytes) throw new Error("request body too large");
+			chunks.push(buffer);
+		}
+		return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	};
+	const handlePair = async (req, res) => {
+		res.setHeader("Content-Type", "application/json");
+		if (!enabledNow()) {
+			res.statusCode = 503;
+			res.end(JSON.stringify({
+				ok: false,
+				error: "bridge disabled"
+			}));
+			return;
+		}
+		if (req.method !== "POST") {
+			res.statusCode = 405;
+			res.setHeader("Allow", "POST");
+			res.end(JSON.stringify({
+				ok: false,
+				error: "POST required"
+			}));
+			return;
+		}
+		const source = requestClientIdentity(req);
+		const admission = authRateLimiter.admit(source);
+		if (!admission.ok) {
+			res.statusCode = 429;
+			res.setHeader("Retry-After", String(Math.max(1, Math.ceil(admission.retryAfterMs / 1e3))));
+			res.end(JSON.stringify({
+				ok: false,
+				error: "pairing rate limited"
+			}));
+			return;
+		}
+		try {
+			const { devices, audience } = await ready;
+			if (!devices || !audience) throw new Error("device authentication unavailable");
+			const raw = await readJSONBody(req);
+			if (raw === null || typeof raw !== "object" || raw.v !== 2) throw new TypeError("protocol v2 required");
+			const code = typeof raw.code === "string" ? raw.code : "";
+			const publicKey = typeof raw.publicKey === "string" ? raw.publicKey : "";
+			const deviceName = sanitizeDeviceField(raw.deviceName, 64) || "unknown";
+			const appVersion = sanitizeDeviceField(raw.appVersion, 32) || "unknown";
+			const deviceId = deviceIdForPublicKey(publicKey);
+			if (devices.list().length >= 64 && devices.authorized(deviceId) === void 0) {
+				res.statusCode = 409;
+				res.end(JSON.stringify({
+					ok: false,
+					error: "device registry is full"
+				}));
+				return;
+			}
+			if (!pairingCodes.consume(code)) {
+				const failure = authRateLimiter.recordFailure(source);
+				res.statusCode = failure.blocked ? 429 : 401;
+				if (failure.retryAfterMs > 0) res.setHeader("Retry-After", String(Math.max(1, Math.ceil(failure.retryAfterMs / 1e3))));
+				res.end(JSON.stringify({
+					ok: false,
+					error: failure.blocked ? "pairing rate limited" : "pairing code invalid or expired"
+				}));
+				return;
+			}
+			const record = devices.register({
+				publicKey,
+				deviceName,
+				appVersion,
+				scopes: normalizeDeviceScopes(raw.scopes)
+			}, Date.now());
+			authRateLimiter.recordSuccess(source);
+			log(`device paired id=${auditLabel(record.deviceId)} source=${auditLabel(source)}`);
+			res.statusCode = 201;
+			res.end(JSON.stringify({
+				ok: true,
+				v: 2,
+				deviceId: record.deviceId,
+				audience,
+				scopes: record.scopes ?? []
+			}));
+		} catch (error) {
+			res.statusCode = error instanceof SyntaxError || error instanceof TypeError ? 400 : 503;
+			res.end(JSON.stringify({
+				ok: false,
+				error: error instanceof Error ? error.message : "pairing failed"
+			}));
+		} finally {
+			admission.release();
+		}
+	};
 	const handleUpgrade = (req, socket, head) => {
 		(async () => {
 			try {
@@ -4233,44 +5061,60 @@ function apply(ctx, options) {
 				}
 				pendingUpgrades += 1;
 				try {
-					const { devices } = await ready;
-					const token = auth.token;
-					if (!token || !devices) {
+					const { devices, audience } = await ready;
+					if (!audience || !devices) {
 						rejectUpgrade(socket, 503, "bridge degraded");
 						return;
 					}
-					const presentedToken = requestToken(req);
-					if (presentedToken !== null && !tokenMatches(presentedToken, token)) {
-						rejectUpgrade(socket, 401, "invalid token");
+					const source = requestClientIdentity(req);
+					const admission = authRateLimiter.admit(source);
+					if (!admission.ok) {
+						rejectUpgrade(socket, 429, "authentication rate limited", admission.retryAfterMs / 1e3);
 						return;
 					}
 					const bridge = state.bridge;
 					if (!bridge) {
+						admission.release();
 						rejectUpgrade(socket, 503, "bridge not ready");
 						return;
 					}
-					if (auth.token !== token) {
-						rejectUpgrade(socket, 401, "invalid token");
-						return;
-					}
-					wss.handleUpgrade(req, socket, head, (ws) => {
-						if (auth.token !== token || state.bridge !== bridge) {
-							ws.close(1012, "bridge changed");
-							return;
-						}
-						const connection = new BridgeConnection(ws, {
-							bridge,
-							devices,
-							serverVersion: SERVER_VERSION,
-							expectedToken: token,
-							transportAuthenticated: presentedToken !== null,
-							log,
-							debug: currentConfig().debug === true,
-							onClosed: (closed) => connections.delete(closed),
-							onPushEnrollKey: handlePushEnrollKey
+					try {
+						wss.handleUpgrade(req, socket, head, (ws) => {
+							if (auth.audience !== audience || state.bridge !== bridge) {
+								admission.release();
+								ws.close(1012, "bridge changed");
+								return;
+							}
+							try {
+								const connection = new BridgeConnection(ws, {
+									bridge,
+									devices,
+									serverVersion: SERVER_VERSION,
+									audience,
+									log,
+									debug: currentConfig().debug === true,
+									onClosed: (closed) => connections.delete(closed),
+									onAuthenticationSettled: (ok) => {
+										admission.release();
+										if (ok) authRateLimiter.recordSuccess(source);
+										else if (authRateLimiter.recordFailure(source).newlyBlocked) log(`authentication source blocked source=${auditLabel(source)}`);
+									},
+									onDeviceAuthenticated: (deviceId) => {
+										log(`device authenticated id=${auditLabel(deviceId)} source=${auditLabel(source)}`);
+									},
+									onPushEnrollKey: handlePushEnrollKey
+								});
+								connections.add(connection);
+							} catch (error) {
+								admission.release();
+								ws.close(1011, "connection setup failed");
+								throw error;
+							}
 						});
-						connections.add(connection);
-					});
+					} catch (error) {
+						admission.release();
+						throw error;
+					}
 				} finally {
 					pendingUpgrades -= 1;
 				}
@@ -4283,9 +5127,8 @@ function apply(ctx, options) {
 	const handleHealth = async (req, res) => {
 		try {
 			await ready;
-			const token = auth.token;
 			res.setHeader("Content-Type", "application/json");
-			if (!token) {
+			if (!auth.audience || !auth.devices) {
 				res.statusCode = 503;
 				res.end(JSON.stringify({
 					ok: false,
@@ -4293,16 +5136,11 @@ function apply(ctx, options) {
 				}));
 				return;
 			}
-			if (!tokenMatches(requestToken(req), token)) {
-				res.statusCode = 401;
-				res.end(JSON.stringify({ ok: false }));
-				return;
-			}
 			res.statusCode = 200;
 			res.end(JSON.stringify({
 				ok: true,
 				enabled: enabledNow(),
-				protocolVersion: 1,
+				protocolVersion: 2,
 				serverVersion: SERVER_VERSION,
 				dataPlane: Boolean(state.bridge)
 			}));
@@ -4311,15 +5149,17 @@ function apply(ctx, options) {
 			res.end(JSON.stringify({ ok: false }));
 		}
 	};
-	ctx.inject(["apiProxy"], (sub) => {
+	ctx.inject(["sessionController"], (sub) => {
 		if (currentConfig().enabled !== true) {
 			log("bridge disabled; data plane stays inactive");
 			return;
 		}
 		const apiCtx = sub;
-		const proxy = apiCtx.apiProxy;
-		if (!proxy) {
-			log("apiProxy service absent; data plane stays inactive");
+		let proxy;
+		try {
+			proxy = new Dsh012ApiProxy(apiCtx);
+		} catch (error) {
+			log("dsh 0.1.2 session bridge unavailable: " + String(error));
 			return;
 		}
 		const bridge = new HostBridge(proxy, cfg.historyBufferMax);
@@ -4349,6 +5189,11 @@ function apply(ctx, options) {
 			path: "/phone/health",
 			handler: handleHealth
 		}), "deeppilot: /phone/health");
+		webCtx.effect(() => web.register({
+			kind: "exact",
+			path: "/phone/pair",
+			handler: handlePair
+		}), "deeppilot: /phone/pair");
 		const sweep = setInterval(() => {
 			const now = Date.now();
 			for (const connection of connections) if (connection.isStale(now, 6e4)) {
@@ -4364,6 +5209,7 @@ function apply(ctx, options) {
 				path = new URL(req.url ?? "/", "http://phone.local").pathname;
 			} catch {}
 			if (path === "/phone/health") handleHealth(req, res);
+			else if (path === "/phone/pair") handlePair(req, res);
 			else {
 				res.statusCode = 404;
 				res.end("not found");
@@ -4395,7 +5241,8 @@ function apply(ctx, options) {
 				hostname: normalizeRemoteHostname(remoteConfig.hostname),
 				statePath: remoteConfig.statePath?.trim() || join(dataDir, "tailscale"),
 				helperPath,
-				funnelPort: remotePort
+				funnelPort: remotePort,
+				maxConnectionsPerSource: normalizeFunnelConnectionLimit(remoteConfig.maxConnectionsPerSource)
 			};
 			const nextKey = JSON.stringify(next);
 			if (nextKey === appliedRemoteKey) return;
@@ -4409,6 +5256,7 @@ function apply(ctx, options) {
 				statePath: next.statePath,
 				...next.helperPath ? { helperPath: next.helperPath } : {},
 				funnelPort: next.funnelPort,
+				maxConnectionsPerSource: next.maxConnectionsPerSource,
 				log
 			});
 			remoteSupervisor = supervisor;
@@ -4456,6 +5304,6 @@ function apply(ctx, options) {
 	}, "deeppilot: process resources");
 }
 //#endregion
-export { Config, HostBridge, apply, inject, name, requestToken, shouldPrunePushToken, shouldReEnrollRelayToken };
+export { Config, HostBridge, apply, inject, name, shouldPrunePushToken, shouldReEnrollRelayToken };
 
 //# sourceMappingURL=index.js.map