dsh-deeppilot 0.7.0 → 0.8.0

package/lib/index.js

@@ -203,7 +203,7 @@ function validateRequest(type, value) {
 		"c2s.workspaces.list",
 		"c2s.directory.pick"
 	]);
-	if (value === void 0 && (type === "c2s.session.create" || type === "c2s.directory.list")) value = {};
+	if (value === void 0 && (type === "c2s.session.create" || type === "c2s.directory.list" || type === "c2s.device.revoke")) value = {};
 	if (value == null && empty.has(type)) return;
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return "payload must be an object";
 	const p = value;
@@ -213,6 +213,7 @@ function validateRequest(type, value) {
 	if (type.startsWith("c2s.session.") && type !== "c2s.session.create" && !text(p.sessionId)) return "invalid sessionId";
 	if (type === "c2s.session.create" && (!optional("workspaceId", (v) => text(v)) || !optional("cwd", (v) => text(v, 32768)) || p.workspaceId !== void 0 && p.cwd !== void 0)) return "invalid workspace selection";
 	if (type === "c2s.directory.list" && !optional("path", (v) => text(v, 32768, false))) return "invalid path";
+	if (type === "c2s.device.revoke" && !optional("deviceId", (v) => text(v))) return "invalid deviceId";
 	if (type === "c2s.workspace.create" && !text(p.path, 32768)) return "invalid path";
 	if (type === "c2s.session.open" && !optional("tailCount", (v) => integer(v, 1, 1e4))) return "invalid tailCount";
 	if (type === "c2s.session.history" && (!integer(p.beforeSeq, 0, Number.MAX_SAFE_INTEGER) || !optional("limit", (v) => integer(v, 1, 500)))) return "invalid history range";
@@ -530,6 +531,7 @@ var DeviceStore = class DeviceStore {
 		}
 		const current = record.apns;
 		if (current && current.token === next.token && current.environment === next.environment && JSON.stringify(current.categories ?? {}) === JSON.stringify(next.categories ?? {})) return;
+		this.detachDuplicateToken("apns", normalized, deviceId);
 		record.apns = next;
 		this.flush();
 	}
@@ -566,10 +568,12 @@ var DeviceStore = class DeviceStore {
 	setWidgetPushToken(deviceId, token, environment, now) {
 		const record = this.authorized(deviceId);
 		if (!record || !isValidApnsToken(token)) return;
+		const normalized = token.toLowerCase();
 		const previous = record.widgetApns;
-		if (previous?.token === token && previous.environment === environment && now - previous.updatedAt < 36e5) return;
+		if (previous?.token === normalized && previous.environment === environment && now - previous.updatedAt < 36e5) return;
+		this.detachDuplicateToken("widgetApns", normalized, deviceId);
 		record.widgetApns = {
-			token,
+			token: normalized,
 			environment,
 			updatedAt: now
 		};
@@ -582,6 +586,22 @@ var DeviceStore = class DeviceStore {
 		delete record.widgetApns;
 		this.flush();
 	}
+	/**
+	* One physical device owns one APNs token, but a re-pair or a botched unbind
+	* can leave the same token attached to a second deviceId. Registering it
+	* under `keepDeviceId` detaches it from every other record — only that one
+	* token field, never the other record's pairing key or scopes. No flush of
+	* its own: the caller batches it with the write that follows, so a single
+	* registry write covers both changes.
+	*/
+	detachDuplicateToken(field, token, keepDeviceId) {
+		for (const record of this.devices.values()) {
+			if (record.deviceId === keepDeviceId) continue;
+			if (field === "apns") {
+				if (record.apns?.token === token) delete record.apns;
+			} else if (record.widgetApns?.token === token) delete record.widgetApns;
+		}
+	}
 	/** Serialized so concurrent touches can never interleave half-written JSON. */
 	flush() {
 		const next = this.flushTail.then(() => this.writeFile());
@@ -640,6 +660,7 @@ function isEnvelope(value) {
 function requiredScope(type) {
 	if (typeof type !== "string") return void 0;
 	if (type === "c2s.ping" || type === "c2s.resume") return void 0;
+	if (type === "c2s.device.revoke") return void 0;
 	if (type === "c2s.session.sendPrompt" || type === "c2s.session.delivery") return "prompt.send";
 	if (type === "c2s.pending.list") return "interactions.respond";
 	if (type === "c2s.approval.respond" || type === "c2s.question.respond") return "interactions.respond";
@@ -712,6 +733,12 @@ var BridgeConnection = class {
 	authenticated = false;
 	authenticationSettled = false;
 	closed = false;
+	/**
+	* Set the moment c2s.device.revoke tears this device down. `ws.close()` is
+	* asynchronous, so frames that arrive while the 4401 close is in flight must
+	* already be refused — a revoked device may not keep driving the bridge.
+	*/
+	revoked = false;
 	helloTimer;
 	openSessions = /* @__PURE__ */ new Set();
 	/**
@@ -868,6 +895,7 @@ var BridgeConnection = class {
 	}
 	async onMessage(raw) {
 		this.lastActivity = Date.now();
+		if (this.revoked) return;
 		if (!this.authenticated && raw.length > 65536) {
 			this.close(1009, "pre-auth frame too large");
 			return;
@@ -906,7 +934,9 @@ var BridgeConnection = class {
 			"c2s.sessions.list",
 			"c2s.pending.list",
 			"c2s.widget.push.register"
-		].includes(env.type)) return this.fail(env.id, "E_FORBIDDEN", "widget connection is read-only");
+		].includes(env.type)) {
+			if (env.type !== "c2s.device.revoke") return this.fail(env.id, "E_FORBIDDEN", "widget connection is read-only");
+		}
 		const required = requiredScope(env.type);
 		if (required !== void 0 && !this.scopes.has(required)) {
 			this.fail(env.id, "E_FORBIDDEN", `scope ${required} required`);
@@ -1164,6 +1194,23 @@ var BridgeConnection = class {
 				this.send("s2c.ack", {}, env.id);
 				return;
 			}
+			case "c2s.device.revoke": {
+				const p = env.payload;
+				if (p?.deviceId !== void 0 && typeof p.deviceId !== "string") return this.fail(env.id, "E_PROTOCOL", "deviceId must be a string");
+				if (typeof p?.deviceId === "string" && p.deviceId !== this.deviceId) return this.fail(env.id, "E_FORBIDDEN", "deviceId does not match the authenticated device");
+				if (this.widgetClient) return this.fail(env.id, "E_FORBIDDEN", "widget connection cannot revoke its device");
+				const deviceId = this.deviceId;
+				this.deps.devices.revoke(deviceId, Date.now());
+				this.revoked = true;
+				try {
+					await this.deps.onDeviceRevoke?.(deviceId, this);
+				} catch (error) {
+					if (this.deps.debug === true) this.deps.log("device revoke hook failed: " + String(error));
+				}
+				this.send("s2c.ack", { revoked: true }, env.id);
+				this.close(4401, "device revoked");
+				return;
+			}
 			case "c2s.liveActivity.unregister": {
 				const p = env.payload;
 				if (this.pendingLiveActivityId === p.activityId) {
@@ -1238,6 +1285,7 @@ var BridgeConnection = class {
 		}
 	}
 	async prove(env) {
+		if (this.revoked) return;
 		const p = env.payload ?? {};
 		if (!p.deviceId) {
 			this.fail(env.id, "E_PROTOCOL", "deviceId required");
@@ -1891,7 +1939,8 @@ var HostBridge = class {
 			projectSelection: typeof this.apiProxy.workspace?.list === "function" && typeof this.apiProxy.workspace?.create === "function",
 			push: this.pushOutlet?.isAvailable() === true,
 			widgetPush: true,
-			liveActivityPush: true
+			liveActivityPush: true,
+			deviceRevoke: true
 		};
 	}
 	diagnostic(message) {
@@ -2430,11 +2479,38 @@ var HostBridge = class {
 				hasMore: Boolean(result.hasMore) || page.dropped > 0
 			});
 			this.deriveTitleFallback(sessionId, messages);
+			if (this.apiProxy.supportsProjections === true) this.refreshProjections(sessionId);
 			return true;
 		} catch {
 			return false;
 		}
 	}
+	/**
+	* Pull one session's projection baseline (DSH 0.1.7+) and fold every key
+	* through applyProjection — unknown keys are ignored there, `null` means the
+	* session no longer exists, and any failure degrades to a diagnostic: opening
+	* a session must never fail because a baseline could not be read.
+	*/
+	async refreshProjections(sessionId) {
+		try {
+			const response = await this.apiProxy.sessions.projections?.({
+				rpcId: randomUUID(),
+				payload: { sessionId }
+			});
+			if (this.disposed) return;
+			const result = response?.result;
+			if (!result) return;
+			if (!result.ok) {
+				this.diagnostic("sessions.projections failed: " + result.error.code);
+				return;
+			}
+			const baseline = result.value;
+			if (baseline === null || baseline === void 0) return;
+			for (const [key, value] of Object.entries(baseline.values ?? {})) this.applyProjection(sessionId, key, value);
+		} catch (error) {
+			this.diagnostic("sessions.projections threw: " + String(error?.message ?? error));
+		}
+	}
 	async historyPage(sessionId, beforeSeq, limit) {
 		try {
 			const response = await this.apiProxy.sessions.history({
@@ -3391,6 +3467,14 @@ var Dsh012ApiProxy = class {
 		this.shouldSurfaceInteraction = options.shouldSurfaceInteraction ?? (() => true);
 	}
 	/**
+	* Whether the host controller implements `session.projections` (added in
+	* DSH 0.1.7). HostBridge gates its open-time baseline refresh on this so
+	* older hosts keep their current list-row-hint behaviour with no RPC noise.
+	*/
+	get supportsProjections() {
+		return typeof this.session.projections === "function";
+	}
+	/**
 	* Decide whether this Gateway Client can surface a phone card. The decision
 	* fails open to false so a broken device registry delegates this delivery
 	* while the official Web Client remains able to answer.
@@ -3444,7 +3528,12 @@ var Dsh012ApiProxy = class {
 		selectModel: async (request) => this.call(() => this.session.selectModel(request.payload ?? {})),
 		rename: async (request) => this.call(() => this.session.rename(request.payload)),
 		cancel: async (request) => this.call(() => this.session.cancel(request.payload)),
-		attachment: async (request) => this.call(() => this.session.attachment(request.payload))
+		attachment: async (request) => this.call(() => this.session.attachment(request.payload)),
+		projections: async (request) => this.call(() => {
+			const read = this.session.projections;
+			if (typeof read !== "function") throw unavailable("session projections unavailable");
+			return read.call(this.session, request.payload);
+		})
 	};
 	workspace = {
 		list: async () => this.call(async () => {
@@ -4018,6 +4107,35 @@ const scopesSchema = { parse(value) {
 	if (!Array.isArray(value) || value.some((scope) => typeof scope !== "string" || !DEVICE_SCOPES.includes(scope))) reject("scopes");
 	return normalizeDeviceScopes(value);
 } };
+const booleanSchema = { parse(value) {
+	if (typeof value !== "boolean") reject("boolean");
+	return value;
+} };
+/**
+* One strict boundary codec carrying both generation shapes of the supported
+* `0.1.x` host family.
+*
+* Through `0.1.6-alpha.1` a descriptor published the schema value itself and
+* every consumer parsed through `codec.schema.parse(value)`. `0.1.6-alpha.2`
+* switched to a lazily materialized process-realm factory: `TypertRegistry`
+* now rejects a strict codec without `create()`, and the Gateway parses
+* through `codec.create().parse(value)`.
+*
+* Publishing both keys — `create()` returning the same hand-written,
+* dependency-free codec — keeps one package valid across the entire declared
+* peer range instead of forking the wire contract per host generation. The
+* cast is required because each generation's `TypertCodec` declares only its
+* own key, so a fresh object literal carrying both fails excess-property
+* checking against either one.
+*/
+function strictCodec(typeSymbol, schema) {
+	return {
+		mode: "strict",
+		typeSymbol,
+		schema,
+		create: () => schema
+	};
+}
 const REPORT_HOST_CONTRIBUTION = {
 	package: REPORT_REMOTE_PACKAGE,
 	face: "host",
@@ -4035,11 +4153,7 @@ const REPORT_HOST_CONTRIBUTION = {
 			method: "report",
 			invocation: { kind: "direct" },
 			parameters: [],
-			result: {
-				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeepPilotReport`,
-				schema: reportSchema
-			}
+			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#DeepPilotReport`, reportSchema)
 		},
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#${BEGIN_PAIRING_ENDPOINT}`,
@@ -4048,11 +4162,7 @@ const REPORT_HOST_CONTRIBUTION = {
 			method: "beginPairing",
 			invocation: { kind: "direct" },
 			parameters: [],
-			result: {
-				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PairingGrantSnapshot`,
-				schema: pairingGrantSchema
-			}
+			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#PairingGrantSnapshot`, pairingGrantSchema)
 		},
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#${REVOKE_DEVICE_ENDPOINT}`,
@@ -4064,20 +4174,9 @@ const REPORT_HOST_CONTRIBUTION = {
 				name: "deviceId",
 				wire: "deviceId",
 				source: "json",
-				codec: {
-					mode: "strict",
-					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceId`,
-					schema: deviceIdSchema
-				}
+				codec: strictCodec(`${REPORT_REMOTE_PACKAGE}#DeviceId`, deviceIdSchema)
 			}],
-			result: {
-				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#Boolean`,
-				schema: { parse(value) {
-					if (typeof value !== "boolean") reject("boolean");
-					return value;
-				} }
-			}
+			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#Boolean`, booleanSchema)
 		},
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#${SET_DEVICE_SCOPES_ENDPOINT}`,
@@ -4089,26 +4188,14 @@ const REPORT_HOST_CONTRIBUTION = {
 				name: "deviceId",
 				wire: "deviceId",
 				source: "json",
-				codec: {
-					mode: "strict",
-					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceId`,
-					schema: deviceIdSchema
-				}
+				codec: strictCodec(`${REPORT_REMOTE_PACKAGE}#DeviceId`, deviceIdSchema)
 			}, {
 				name: "scopes",
 				wire: "scopes",
 				source: "json",
-				codec: {
-					mode: "strict",
-					typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceScopes`,
-					schema: scopesSchema
-				}
+				codec: strictCodec(`${REPORT_REMOTE_PACKAGE}#DeviceScopes`, scopesSchema)
 			}],
-			result: {
-				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#DeviceScopes`,
-				schema: scopesSchema
-			}
+			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#DeviceScopes`, scopesSchema)
 		},
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#deeppilot/testRelay`,
@@ -4117,11 +4204,7 @@ const REPORT_HOST_CONTRIBUTION = {
 			method: "testRelay",
 			invocation: { kind: "direct" },
 			parameters: [],
-			result: {
-				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#RelayTestResult`,
-				schema: relayTestSchema
-			}
+			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#RelayTestResult`, relayTestSchema)
 		},
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#deeppilot/testPush`,
@@ -4130,11 +4213,7 @@ const REPORT_HOST_CONTRIBUTION = {
 			method: "testPush",
 			invocation: { kind: "direct" },
 			parameters: [],
-			result: {
-				mode: "strict",
-				typeSymbol: `${REPORT_REMOTE_PACKAGE}#PushTestResult`,
-				schema: pushTestSchema
-			}
+			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#PushTestResult`, pushTestSchema)
 		}
 	]
 };
@@ -5289,18 +5368,18 @@ function localListenError(error, port) {
 /** Operator-run relay used by distributed builds; overridable via config. */
 const DEFAULT_RELAY_URL = "https://pilot.hailab.dev";
 const Config = z.object({
-	enabled: z.boolean().default(true),
+	enabled: live(z.boolean().default(true)),
 	devicesPath: z.string().default(join(bridgeDataDir(), "devices-v2.json")),
 	historyBufferMax: z.natural().min(100).default(2e3),
-	debug: z.boolean().default(false),
-	local: z.object({
+	debug: live(z.boolean().default(false)),
+	local: live(z.object({
 		enabled: z.boolean().default(true),
 		port: z.natural().min(MIN_LOCAL_PORT).max(MAX_LOCAL_PORT).default(DEFAULT_LOCAL_PORT).description("DeepPilot 局域网独立端口（仅 TLS；默认 3098，修改后本地连接会短暂重连）")
 	}).default({
 		enabled: true,
 		port: DEFAULT_LOCAL_PORT
-	}),
-	remote: z.object({
+	})),
+	remote: live(z.object({
 		enabled: z.boolean().default(false),
 		provider: z.union(["tailscale-funnel"]).default("tailscale-funnel"),
 		hostname: z.string().default(DEFAULT_REMOTE_HOSTNAME),
@@ -5320,7 +5399,7 @@ const Config = z.object({
 		helperPath: "",
 		funnelPort: 443,
 		maxConnectionsPerSource: 8
-	}),
+	})),
 	push: z.object({
 		provider: z.union([
 			"none",
@@ -5346,14 +5425,50 @@ const Config = z.object({
 	})
 });
 /**
+* Declare one live-update (volatile) config node when the host supports it.
+*
+* DSH 0.1.7's schemastery adds `Schema#volatile()`; the schemas this package
+* typechecks against (3.18.x line) do not have the method, so the call goes
+* through a structural check instead of a direct chain — a direct
+* `.volatile()` would both fail typecheck today and throw at import on an
+* older host, killing plugin activation.
+*/
+function live(node) {
+	const schema = node;
+	if (typeof schema.volatile === "function") return schema.volatile();
+	if (typeof schema.extra === "function") return schema.extra("volatile", true);
+	return node;
+}
+/**
+* Deep-unwrap live-update (volatile) references to plain values.
+*
+* On a 0.1.7 host, `apply()`'s options — and even a direct `Config(raw)` call
+* — carry `{ get() }` reference objects for volatile fields. Every consumer of
+* `currentConfig()` compares plain values (`=== true`, numeric bounds, object
+* fields), and schemastery refuses to re-parse a reference, so normalization
+* unwraps on the way in and on the way out. A JSON-shaped config value cannot
+* carry a function, so the `get` check cannot false-positive; plain input
+* passes through unchanged, keeping older-host behavior identical.
+*/
+function plainConfig(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (typeof value.get === "function") return plainConfig(value.get());
+	if (Array.isArray(value)) return value.map(plainConfig);
+	const plain = {};
+	for (const [key, item] of Object.entries(value)) plain[key] = plainConfig(item);
+	return plain;
+}
+/**
 * Cordis hands the second argument in different shapes depending on host
 * composition: a reactive options getter, the resolved config value, or
-* nothing when the patch row omits `config`. Normalize all of them.
+* nothing when the patch row omits `config`. Normalize all of them — and
+* unwrap volatile references so the returned Config is plain data on every
+* host generation.
 */
 function normalizeOptions(options) {
-	if (typeof options === "function") return options();
-	if (options && typeof options === "object") return options;
-	return Config(void 0) ?? {};
+	if (typeof options === "function") return plainConfig(options());
+	if (options && typeof options === "object") return plainConfig(options);
+	return plainConfig(Config(void 0) ?? {});
 }
 //#endregion
 //#region src/phone-http.ts
@@ -5955,8 +6070,13 @@ function apply(ctx, options) {
 		})
 	};
 	ctx.inject(["settings"], (settingsCtx) => {
+		if (typeof settingsCtx.settings?.installSection !== "function") return;
 		settingsCtx.settings.installSection(ctx, "deeppilot", Config, normalizeOptions(void 0), settingsHooks);
 	});
+	ctx.on("loader/volatile-update", () => queueMicrotask(() => {
+		scheduleLocalReconcile?.();
+		scheduleRemoteReconcile?.();
+	}));
 	if (currentConfig().enabled !== true) log("disabled via settings; bridge stays inactive (rumors of /phone below are skipped)");
 	const dataDir = bridgeDataDir();
 	const pushRelayPath = join(dataDir, "push-relay.json");
@@ -6110,6 +6230,28 @@ function apply(ctx, options) {
 		for (const connection of connections) connection.closeForServerStop();
 		connections.clear();
 	};
+	/**
+	* Unbind one device. Single path shared by the settings page (report-service
+	* revokeDevice) and the wire-level c2s.device.revoke frame: mark the registry
+	* tombstone (which also drops every APNs/WidgetKit/LiveActivity token, so the
+	* push fan-out can no longer select it) and hard-drop its live sockets.
+	* `except` is the connection that sent the revoke frame — it closes itself
+	* with 4401 after acking, so it is not terminated here.
+	*/
+	const revokeDevice = async (deviceId, except) => {
+		const { devices } = await ready;
+		if (!devices) throw new Error("device registry unavailable");
+		const revoked = devices.revoke(deviceId, Date.now());
+		if (revoked) {
+			for (const connection of [...connections]) {
+				if (connection === except || connection.connectedDeviceId !== deviceId) continue;
+				connection.terminate();
+				connections.delete(connection);
+			}
+			log(`device revoked id=${auditLabel(deviceId)}`);
+		}
+		return revoked;
+	};
 	const resolvePushConfig = (config) => {
 		const push = config.push ?? {};
 		const configured = push.provider ?? "none";
@@ -6500,18 +6642,7 @@ function apply(ctx, options) {
 			devices
 		};
 	}, beginPairing, async (deviceId) => {
-		const { devices } = await ready;
-		if (!devices) throw new Error("device registry unavailable");
-		const revoked = devices.revoke(deviceId, Date.now());
-		if (revoked) {
-			for (const connection of [...connections]) {
-				if (connection.connectedDeviceId !== deviceId) continue;
-				connection.terminate();
-				connections.delete(connection);
-			}
-			log(`device revoked id=${auditLabel(deviceId)}`);
-		}
-		return revoked;
+		return await revokeDevice(deviceId);
 	}, async (deviceId, scopes) => {
 		const { devices } = await ready;
 		if (!devices) throw new Error("device registry unavailable");
@@ -6720,7 +6851,8 @@ function apply(ctx, options) {
 									onDeviceAuthenticated: (deviceId) => {
 										log(`device authenticated id=${auditLabel(deviceId)} source=${auditLabel(source)}`);
 									},
-									onPushEnrollKey: handlePushEnrollKey
+									onPushEnrollKey: handlePushEnrollKey,
+									onDeviceRevoke: (deviceId, except) => revokeDevice(deviceId, except)
 								});
 								connections.add(connection);
 							} catch (error) {