dsh-deeppilot 0.7.1 → 0.8.1

package/lib/index.d.ts

@@ -264,6 +264,13 @@ interface SessionsApiLike {
     };
     data: string;
   }>>;
+  /** DSH 0.1.7+: complete projection baseline for one session; null when the session is gone. */
+  projections?(req: RpcRequestLike<{
+    sessionId: string;
+  }>): Promise<RpcResponseLike<{
+    asOfSeq: number;
+    values: Record<string, unknown>;
+  } | null>>;
 }
 interface WorkspaceApiLike {
   list?(req: RpcRequestLike<Record<string, never>>): Promise<RpcResponseLike<{
@@ -439,6 +446,12 @@ interface ApiProxyLike {
   sessions: SessionsApiLike;
   workspace?: WorkspaceApiLike;
   host?: HostApiLike;
+  /**
+   * DSH 0.1.7 added `session.projections`. Absent/false keeps the bridge on
+   * its existing list-row projection hints — the call is gated on this flag so
+   * older hosts never see a failing RPC.
+   */
+  supportsProjections?: boolean;
   respond(message: {
     type: 'client-response';
     rpcId: string;
@@ -552,6 +565,7 @@ declare class HostBridge {
     push: boolean;
     widgetPush: boolean;
     liveActivityPush: boolean;
+    deviceRevoke: boolean;
   };
   diagnostic(message: string): void;
   currentCursor(): number;
@@ -624,6 +638,13 @@ declare class HostBridge {
   private loadApprovalArguments;
   /** Tail history for an opened session; pushes s2c.session.tail to the sink. */
   openSession(sink: BridgeSink, sessionId: string, tailCount: number): Promise<boolean>;
+  /**
+   * Pull one session's projection baseline (DSH 0.1.7+) and fold every key
+   * through applyProjection — unknown keys are ignored there, `null` means the
+   * session no longer exists, and any failure degrades to a diagnostic: opening
+   * a session must never fail because a baseline could not be read.
+   */
+  private refreshProjections;
   historyPage(sessionId: string, beforeSeq: number, limit: number): Promise<{
     sessionId: string;
     messages: MessageProjection[];
@@ -722,103 +743,103 @@ interface Config {
     relayToken?: string;
   };
 }
-declare const Config: z<Schemastery.ObjectS<{
-  enabled: z<boolean, boolean>;
-  devicesPath: z<string, string>;
-  historyBufferMax: z<number, number>;
-  debug: z<boolean, boolean>;
-  local: z<Schemastery.ObjectS<{
-    enabled: z<boolean, boolean>;
-    port: z<number, number>;
-  }>, Schemastery.ObjectT<{
-    enabled: z<boolean, boolean>;
-    port: z<number, number>;
-  }>>;
-  remote: z<Schemastery.ObjectS<{
-    enabled: z<boolean, boolean>;
-    provider: z<"tailscale-funnel", "tailscale-funnel">;
-    hostname: z<string, string>;
-    statePath: z<string, string>;
-    helperPath: z<string, string>;
-    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000>;
-    maxConnectionsPerSource: z<number, number>;
-  }>, Schemastery.ObjectT<{
-    enabled: z<boolean, boolean>;
-    provider: z<"tailscale-funnel", "tailscale-funnel">;
-    hostname: z<string, string>;
-    statePath: z<string, string>;
-    helperPath: z<string, string>;
-    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000>;
-    maxConnectionsPerSource: z<number, number>;
-  }>>;
-  push: z<Schemastery.ObjectS<{
-    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay">;
-    contentMode: z<"generic" | "preview", "generic" | "preview">;
-    teamId: z<string, string>;
-    keyId: z<string, string>;
-    keyPath: z<string, string>;
-    bundleId: z<string, string>;
-    relayUrl: z<string, string>;
-    relayToken: z<string, string>;
-  }>, Schemastery.ObjectT<{
-    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay">;
-    contentMode: z<"generic" | "preview", "generic" | "preview">;
-    teamId: z<string, string>;
-    keyId: z<string, string>;
-    keyPath: z<string, string>;
-    bundleId: z<string, string>;
-    relayUrl: z<string, string>;
-    relayToken: z<string, string>;
-  }>>;
-}>, Schemastery.ObjectT<{
-  enabled: z<boolean, boolean>;
-  devicesPath: z<string, string>;
-  historyBufferMax: z<number, number>;
-  debug: z<boolean, boolean>;
-  local: z<Schemastery.ObjectS<{
-    enabled: z<boolean, boolean>;
-    port: z<number, number>;
-  }>, Schemastery.ObjectT<{
-    enabled: z<boolean, boolean>;
-    port: z<number, number>;
-  }>>;
-  remote: z<Schemastery.ObjectS<{
-    enabled: z<boolean, boolean>;
-    provider: z<"tailscale-funnel", "tailscale-funnel">;
-    hostname: z<string, string>;
-    statePath: z<string, string>;
-    helperPath: z<string, string>;
-    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000>;
-    maxConnectionsPerSource: z<number, number>;
-  }>, Schemastery.ObjectT<{
-    enabled: z<boolean, boolean>;
-    provider: z<"tailscale-funnel", "tailscale-funnel">;
-    hostname: z<string, string>;
-    statePath: z<string, string>;
-    helperPath: z<string, string>;
-    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000>;
-    maxConnectionsPerSource: z<number, number>;
-  }>>;
-  push: z<Schemastery.ObjectS<{
-    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay">;
-    contentMode: z<"generic" | "preview", "generic" | "preview">;
-    teamId: z<string, string>;
-    keyId: z<string, string>;
-    keyPath: z<string, string>;
-    bundleId: z<string, string>;
-    relayUrl: z<string, string>;
-    relayToken: z<string, string>;
-  }>, Schemastery.ObjectT<{
-    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay">;
-    contentMode: z<"generic" | "preview", "generic" | "preview">;
-    teamId: z<string, string>;
-    keyId: z<string, string>;
-    keyPath: z<string, string>;
-    bundleId: z<string, string>;
-    relayUrl: z<string, string>;
-    relayToken: z<string, string>;
-  }>>;
-}>>;
+declare const Config: z<Schemastery.ObjectS<NoInfer<{
+  enabled: z<boolean, boolean, "defined">;
+  devicesPath: z<string, string, "defined">;
+  historyBufferMax: z<number, number, "defined">;
+  debug: z<boolean, boolean, "defined">;
+  local: z<Schemastery.ObjectS<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    port: z<number, number, "defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    port: z<number, number, "defined">;
+  }>>, "defined">;
+  remote: z<Schemastery.ObjectS<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    provider: z<"tailscale-funnel", "tailscale-funnel", "defined">;
+    hostname: z<string, string, "defined">;
+    statePath: z<string, string, "defined">;
+    helperPath: z<string, string, "defined">;
+    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000, "defined">;
+    maxConnectionsPerSource: z<number, number, "defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    provider: z<"tailscale-funnel", "tailscale-funnel", "defined">;
+    hostname: z<string, string, "defined">;
+    statePath: z<string, string, "defined">;
+    helperPath: z<string, string, "defined">;
+    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000, "defined">;
+    maxConnectionsPerSource: z<number, number, "defined">;
+  }>>, "defined">;
+  push: z<Schemastery.ObjectS<NoInfer<{
+    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay", "defined">;
+    contentMode: z<"generic" | "preview", "generic" | "preview", "defined">;
+    teamId: z<string, string, "defined">;
+    keyId: z<string, string, "defined">;
+    keyPath: z<string, string, "defined">;
+    bundleId: z<string, string, "defined">;
+    relayUrl: z<string, string, "defined">;
+    relayToken: z<string, string, "defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay", "defined">;
+    contentMode: z<"generic" | "preview", "generic" | "preview", "defined">;
+    teamId: z<string, string, "defined">;
+    keyId: z<string, string, "defined">;
+    keyPath: z<string, string, "defined">;
+    bundleId: z<string, string, "defined">;
+    relayUrl: z<string, string, "defined">;
+    relayToken: z<string, string, "defined">;
+  }>>, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+  enabled: z<boolean, boolean, "defined">;
+  devicesPath: z<string, string, "defined">;
+  historyBufferMax: z<number, number, "defined">;
+  debug: z<boolean, boolean, "defined">;
+  local: z<Schemastery.ObjectS<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    port: z<number, number, "defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    port: z<number, number, "defined">;
+  }>>, "defined">;
+  remote: z<Schemastery.ObjectS<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    provider: z<"tailscale-funnel", "tailscale-funnel", "defined">;
+    hostname: z<string, string, "defined">;
+    statePath: z<string, string, "defined">;
+    helperPath: z<string, string, "defined">;
+    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000, "defined">;
+    maxConnectionsPerSource: z<number, number, "defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    enabled: z<boolean, boolean, "defined">;
+    provider: z<"tailscale-funnel", "tailscale-funnel", "defined">;
+    hostname: z<string, string, "defined">;
+    statePath: z<string, string, "defined">;
+    helperPath: z<string, string, "defined">;
+    funnelPort: z<443 | 8443 | 10000, 443 | 8443 | 10000, "defined">;
+    maxConnectionsPerSource: z<number, number, "defined">;
+  }>>, "defined">;
+  push: z<Schemastery.ObjectS<NoInfer<{
+    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay", "defined">;
+    contentMode: z<"generic" | "preview", "generic" | "preview", "defined">;
+    teamId: z<string, string, "defined">;
+    keyId: z<string, string, "defined">;
+    keyPath: z<string, string, "defined">;
+    bundleId: z<string, string, "defined">;
+    relayUrl: z<string, string, "defined">;
+    relayToken: z<string, string, "defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    provider: z<"apns" | "none" | "relay", "apns" | "none" | "relay", "defined">;
+    contentMode: z<"generic" | "preview", "generic" | "preview", "defined">;
+    teamId: z<string, string, "defined">;
+    keyId: z<string, string, "defined">;
+    keyPath: z<string, string, "defined">;
+    bundleId: z<string, string, "defined">;
+    relayUrl: z<string, string, "defined">;
+    relayToken: z<string, string, "defined">;
+  }>>, "defined">;
+}>>, "plain">;
 //#endregion
 //#region src/push-policy.d.ts
 /** Prune only when the provider supplies an authoritative token-lifecycle verdict. */

package/lib/index.js

@@ -203,7 +203,7 @@ function validateRequest(type, value) {
 		"c2s.workspaces.list",
 		"c2s.directory.pick"
 	]);
-	if (value === void 0 && (type === "c2s.session.create" || type === "c2s.directory.list")) value = {};
+	if (value === void 0 && (type === "c2s.session.create" || type === "c2s.directory.list" || type === "c2s.device.revoke")) value = {};
 	if (value == null && empty.has(type)) return;
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return "payload must be an object";
 	const p = value;
@@ -213,6 +213,7 @@ function validateRequest(type, value) {
 	if (type.startsWith("c2s.session.") && type !== "c2s.session.create" && !text(p.sessionId)) return "invalid sessionId";
 	if (type === "c2s.session.create" && (!optional("workspaceId", (v) => text(v)) || !optional("cwd", (v) => text(v, 32768)) || p.workspaceId !== void 0 && p.cwd !== void 0)) return "invalid workspace selection";
 	if (type === "c2s.directory.list" && !optional("path", (v) => text(v, 32768, false))) return "invalid path";
+	if (type === "c2s.device.revoke" && !optional("deviceId", (v) => text(v))) return "invalid deviceId";
 	if (type === "c2s.workspace.create" && !text(p.path, 32768)) return "invalid path";
 	if (type === "c2s.session.open" && !optional("tailCount", (v) => integer(v, 1, 1e4))) return "invalid tailCount";
 	if (type === "c2s.session.history" && (!integer(p.beforeSeq, 0, Number.MAX_SAFE_INTEGER) || !optional("limit", (v) => integer(v, 1, 500)))) return "invalid history range";
@@ -530,6 +531,7 @@ var DeviceStore = class DeviceStore {
 		}
 		const current = record.apns;
 		if (current && current.token === next.token && current.environment === next.environment && JSON.stringify(current.categories ?? {}) === JSON.stringify(next.categories ?? {})) return;
+		this.detachDuplicateToken("apns", normalized, deviceId);
 		record.apns = next;
 		this.flush();
 	}
@@ -566,10 +568,12 @@ var DeviceStore = class DeviceStore {
 	setWidgetPushToken(deviceId, token, environment, now) {
 		const record = this.authorized(deviceId);
 		if (!record || !isValidApnsToken(token)) return;
+		const normalized = token.toLowerCase();
 		const previous = record.widgetApns;
-		if (previous?.token === token && previous.environment === environment && now - previous.updatedAt < 36e5) return;
+		if (previous?.token === normalized && previous.environment === environment && now - previous.updatedAt < 36e5) return;
+		this.detachDuplicateToken("widgetApns", normalized, deviceId);
 		record.widgetApns = {
-			token,
+			token: normalized,
 			environment,
 			updatedAt: now
 		};
@@ -582,6 +586,22 @@ var DeviceStore = class DeviceStore {
 		delete record.widgetApns;
 		this.flush();
 	}
+	/**
+	* One physical device owns one APNs token, but a re-pair or a botched unbind
+	* can leave the same token attached to a second deviceId. Registering it
+	* under `keepDeviceId` detaches it from every other record — only that one
+	* token field, never the other record's pairing key or scopes. No flush of
+	* its own: the caller batches it with the write that follows, so a single
+	* registry write covers both changes.
+	*/
+	detachDuplicateToken(field, token, keepDeviceId) {
+		for (const record of this.devices.values()) {
+			if (record.deviceId === keepDeviceId) continue;
+			if (field === "apns") {
+				if (record.apns?.token === token) delete record.apns;
+			} else if (record.widgetApns?.token === token) delete record.widgetApns;
+		}
+	}
 	/** Serialized so concurrent touches can never interleave half-written JSON. */
 	flush() {
 		const next = this.flushTail.then(() => this.writeFile());
@@ -640,6 +660,7 @@ function isEnvelope(value) {
 function requiredScope(type) {
 	if (typeof type !== "string") return void 0;
 	if (type === "c2s.ping" || type === "c2s.resume") return void 0;
+	if (type === "c2s.device.revoke") return void 0;
 	if (type === "c2s.session.sendPrompt" || type === "c2s.session.delivery") return "prompt.send";
 	if (type === "c2s.pending.list") return "interactions.respond";
 	if (type === "c2s.approval.respond" || type === "c2s.question.respond") return "interactions.respond";
@@ -712,6 +733,12 @@ var BridgeConnection = class {
 	authenticated = false;
 	authenticationSettled = false;
 	closed = false;
+	/**
+	* Set the moment c2s.device.revoke tears this device down. `ws.close()` is
+	* asynchronous, so frames that arrive while the 4401 close is in flight must
+	* already be refused — a revoked device may not keep driving the bridge.
+	*/
+	revoked = false;
 	helloTimer;
 	openSessions = /* @__PURE__ */ new Set();
 	/**
@@ -868,6 +895,7 @@ var BridgeConnection = class {
 	}
 	async onMessage(raw) {
 		this.lastActivity = Date.now();
+		if (this.revoked) return;
 		if (!this.authenticated && raw.length > 65536) {
 			this.close(1009, "pre-auth frame too large");
 			return;
@@ -906,7 +934,9 @@ var BridgeConnection = class {
 			"c2s.sessions.list",
 			"c2s.pending.list",
 			"c2s.widget.push.register"
-		].includes(env.type)) return this.fail(env.id, "E_FORBIDDEN", "widget connection is read-only");
+		].includes(env.type)) {
+			if (env.type !== "c2s.device.revoke") return this.fail(env.id, "E_FORBIDDEN", "widget connection is read-only");
+		}
 		const required = requiredScope(env.type);
 		if (required !== void 0 && !this.scopes.has(required)) {
 			this.fail(env.id, "E_FORBIDDEN", `scope ${required} required`);
@@ -1164,6 +1194,23 @@ var BridgeConnection = class {
 				this.send("s2c.ack", {}, env.id);
 				return;
 			}
+			case "c2s.device.revoke": {
+				const p = env.payload;
+				if (p?.deviceId !== void 0 && typeof p.deviceId !== "string") return this.fail(env.id, "E_PROTOCOL", "deviceId must be a string");
+				if (typeof p?.deviceId === "string" && p.deviceId !== this.deviceId) return this.fail(env.id, "E_FORBIDDEN", "deviceId does not match the authenticated device");
+				if (this.widgetClient) return this.fail(env.id, "E_FORBIDDEN", "widget connection cannot revoke its device");
+				const deviceId = this.deviceId;
+				this.deps.devices.revoke(deviceId, Date.now());
+				this.revoked = true;
+				try {
+					await this.deps.onDeviceRevoke?.(deviceId, this);
+				} catch (error) {
+					if (this.deps.debug === true) this.deps.log("device revoke hook failed: " + String(error));
+				}
+				this.send("s2c.ack", { revoked: true }, env.id);
+				this.close(4401, "device revoked");
+				return;
+			}
 			case "c2s.liveActivity.unregister": {
 				const p = env.payload;
 				if (this.pendingLiveActivityId === p.activityId) {
@@ -1238,6 +1285,7 @@ var BridgeConnection = class {
 		}
 	}
 	async prove(env) {
+		if (this.revoked) return;
 		const p = env.payload ?? {};
 		if (!p.deviceId) {
 			this.fail(env.id, "E_PROTOCOL", "deviceId required");
@@ -1891,7 +1939,8 @@ var HostBridge = class {
 			projectSelection: typeof this.apiProxy.workspace?.list === "function" && typeof this.apiProxy.workspace?.create === "function",
 			push: this.pushOutlet?.isAvailable() === true,
 			widgetPush: true,
-			liveActivityPush: true
+			liveActivityPush: true,
+			deviceRevoke: true
 		};
 	}
 	diagnostic(message) {
@@ -2430,11 +2479,38 @@ var HostBridge = class {
 				hasMore: Boolean(result.hasMore) || page.dropped > 0
 			});
 			this.deriveTitleFallback(sessionId, messages);
+			if (this.apiProxy.supportsProjections === true) this.refreshProjections(sessionId);
 			return true;
 		} catch {
 			return false;
 		}
 	}
+	/**
+	* Pull one session's projection baseline (DSH 0.1.7+) and fold every key
+	* through applyProjection — unknown keys are ignored there, `null` means the
+	* session no longer exists, and any failure degrades to a diagnostic: opening
+	* a session must never fail because a baseline could not be read.
+	*/
+	async refreshProjections(sessionId) {
+		try {
+			const response = await this.apiProxy.sessions.projections?.({
+				rpcId: randomUUID(),
+				payload: { sessionId }
+			});
+			if (this.disposed) return;
+			const result = response?.result;
+			if (!result) return;
+			if (!result.ok) {
+				this.diagnostic("sessions.projections failed: " + result.error.code);
+				return;
+			}
+			const baseline = result.value;
+			if (baseline === null || baseline === void 0) return;
+			for (const [key, value] of Object.entries(baseline.values ?? {})) this.applyProjection(sessionId, key, value);
+		} catch (error) {
+			this.diagnostic("sessions.projections threw: " + String(error?.message ?? error));
+		}
+	}
 	async historyPage(sessionId, beforeSeq, limit) {
 		try {
 			const response = await this.apiProxy.sessions.history({
@@ -3293,9 +3369,32 @@ function createAgentScope(ctx, identity) {
 		}
 	});
 }
+/**
+* Arity of the Host's published `wireStream.open`. 0.1.7-alpha.1 declares
+* `(endpoint, payload, uplink, peer, signal)`; every earlier generation
+* declares `(endpoint, payload, signal)`. Both are plain arrow functions with
+* no default or rest parameters, so `length` is a reliable contract selector —
+* unlike a capability probe, it opens no trial stream. A future signature that
+* rest-parameterizes (reporting `0`) falls back to the 3-argument call, which
+* every generation through `0.1.6-*` accepts.
+*/
+function hostWireStreamArity(open) {
+	return open.length;
+}
+/**
+* Open one Host logical stream on whichever `wireStream.open` contract the
+* running Host publishes. DeepPilot's carrier owns the Host in process and has
+* no Client-to-Host uplink, so the 5-argument form sends `undefined` for both
+* `uplink` and `peer` — the documented "operator's in-process carrier" case.
+*/
+function openHostStream(gateway, endpoint, payload, signal) {
+	const open = gateway.wireStream.open;
+	if (hostWireStreamArity(open) >= 5) return open(endpoint, payload, void 0, void 0, signal);
+	return open(endpoint, payload, signal);
+}
 function inProcessStream(gateway, endpoint, payload, signal) {
 	return (async function* () {
-		yield* await gateway.wireStream.open(endpoint, payload, signal);
+		yield* await openHostStream(gateway, endpoint, payload, signal);
 	})();
 }
 /**
@@ -3391,6 +3490,14 @@ var Dsh012ApiProxy = class {
 		this.shouldSurfaceInteraction = options.shouldSurfaceInteraction ?? (() => true);
 	}
 	/**
+	* Whether the host controller implements `session.projections` (added in
+	* DSH 0.1.7). HostBridge gates its open-time baseline refresh on this so
+	* older hosts keep their current list-row-hint behaviour with no RPC noise.
+	*/
+	get supportsProjections() {
+		return typeof this.session.projections === "function";
+	}
+	/**
 	* Decide whether this Gateway Client can surface a phone card. The decision
 	* fails open to false so a broken device registry delegates this delivery
 	* while the official Web Client remains able to answer.
@@ -3444,7 +3551,12 @@ var Dsh012ApiProxy = class {
 		selectModel: async (request) => this.call(() => this.session.selectModel(request.payload ?? {})),
 		rename: async (request) => this.call(() => this.session.rename(request.payload)),
 		cancel: async (request) => this.call(() => this.session.cancel(request.payload)),
-		attachment: async (request) => this.call(() => this.session.attachment(request.payload))
+		attachment: async (request) => this.call(() => this.session.attachment(request.payload)),
+		projections: async (request) => this.call(() => {
+			const read = this.session.projections;
+			if (typeof read !== "function") throw unavailable("session projections unavailable");
+			return read.call(this.session, request.payload);
+		})
 	};
 	workspace = {
 		list: async () => this.call(async () => {
@@ -5279,18 +5391,18 @@ function localListenError(error, port) {
 /** Operator-run relay used by distributed builds; overridable via config. */
 const DEFAULT_RELAY_URL = "https://pilot.hailab.dev";
 const Config = z.object({
-	enabled: z.boolean().default(true),
+	enabled: live(z.boolean().default(true)),
 	devicesPath: z.string().default(join(bridgeDataDir(), "devices-v2.json")),
 	historyBufferMax: z.natural().min(100).default(2e3),
-	debug: z.boolean().default(false),
-	local: z.object({
+	debug: live(z.boolean().default(false)),
+	local: live(z.object({
 		enabled: z.boolean().default(true),
 		port: z.natural().min(MIN_LOCAL_PORT).max(MAX_LOCAL_PORT).default(DEFAULT_LOCAL_PORT).description("DeepPilot 局域网独立端口（仅 TLS；默认 3098，修改后本地连接会短暂重连）")
 	}).default({
 		enabled: true,
 		port: DEFAULT_LOCAL_PORT
-	}),
-	remote: z.object({
+	})),
+	remote: live(z.object({
 		enabled: z.boolean().default(false),
 		provider: z.union(["tailscale-funnel"]).default("tailscale-funnel"),
 		hostname: z.string().default(DEFAULT_REMOTE_HOSTNAME),
@@ -5310,7 +5422,7 @@ const Config = z.object({
 		helperPath: "",
 		funnelPort: 443,
 		maxConnectionsPerSource: 8
-	}),
+	})),
 	push: z.object({
 		provider: z.union([
 			"none",
@@ -5336,14 +5448,50 @@ const Config = z.object({
 	})
 });
 /**
+* Declare one live-update (volatile) config node when the host supports it.
+*
+* DSH 0.1.7's schemastery adds `Schema#volatile()`; the schemas this package
+* typechecks against (3.18.x line) do not have the method, so the call goes
+* through a structural check instead of a direct chain — a direct
+* `.volatile()` would both fail typecheck today and throw at import on an
+* older host, killing plugin activation.
+*/
+function live(node) {
+	const schema = node;
+	if (typeof schema.volatile === "function") return schema.volatile();
+	if (typeof schema.extra === "function") return schema.extra("volatile", true);
+	return node;
+}
+/**
+* Deep-unwrap live-update (volatile) references to plain values.
+*
+* On a 0.1.7 host, `apply()`'s options — and even a direct `Config(raw)` call
+* — carry `{ get() }` reference objects for volatile fields. Every consumer of
+* `currentConfig()` compares plain values (`=== true`, numeric bounds, object
+* fields), and schemastery refuses to re-parse a reference, so normalization
+* unwraps on the way in and on the way out. A JSON-shaped config value cannot
+* carry a function, so the `get` check cannot false-positive; plain input
+* passes through unchanged, keeping older-host behavior identical.
+*/
+function plainConfig(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (typeof value.get === "function") return plainConfig(value.get());
+	if (Array.isArray(value)) return value.map(plainConfig);
+	const plain = {};
+	for (const [key, item] of Object.entries(value)) plain[key] = plainConfig(item);
+	return plain;
+}
+/**
 * Cordis hands the second argument in different shapes depending on host
 * composition: a reactive options getter, the resolved config value, or
-* nothing when the patch row omits `config`. Normalize all of them.
+* nothing when the patch row omits `config`. Normalize all of them — and
+* unwrap volatile references so the returned Config is plain data on every
+* host generation.
 */
 function normalizeOptions(options) {
-	if (typeof options === "function") return options();
-	if (options && typeof options === "object") return options;
-	return Config(void 0) ?? {};
+	if (typeof options === "function") return plainConfig(options());
+	if (options && typeof options === "object") return plainConfig(options);
+	return plainConfig(Config(void 0) ?? {});
 }
 //#endregion
 //#region src/phone-http.ts
@@ -5945,8 +6093,13 @@ function apply(ctx, options) {
 		})
 	};
 	ctx.inject(["settings"], (settingsCtx) => {
+		if (typeof settingsCtx.settings?.installSection !== "function") return;
 		settingsCtx.settings.installSection(ctx, "deeppilot", Config, normalizeOptions(void 0), settingsHooks);
 	});
+	ctx.on("loader/volatile-update", () => queueMicrotask(() => {
+		scheduleLocalReconcile?.();
+		scheduleRemoteReconcile?.();
+	}));
 	if (currentConfig().enabled !== true) log("disabled via settings; bridge stays inactive (rumors of /phone below are skipped)");
 	const dataDir = bridgeDataDir();
 	const pushRelayPath = join(dataDir, "push-relay.json");
@@ -6100,6 +6253,28 @@ function apply(ctx, options) {
 		for (const connection of connections) connection.closeForServerStop();
 		connections.clear();
 	};
+	/**
+	* Unbind one device. Single path shared by the settings page (report-service
+	* revokeDevice) and the wire-level c2s.device.revoke frame: mark the registry
+	* tombstone (which also drops every APNs/WidgetKit/LiveActivity token, so the
+	* push fan-out can no longer select it) and hard-drop its live sockets.
+	* `except` is the connection that sent the revoke frame — it closes itself
+	* with 4401 after acking, so it is not terminated here.
+	*/
+	const revokeDevice = async (deviceId, except) => {
+		const { devices } = await ready;
+		if (!devices) throw new Error("device registry unavailable");
+		const revoked = devices.revoke(deviceId, Date.now());
+		if (revoked) {
+			for (const connection of [...connections]) {
+				if (connection === except || connection.connectedDeviceId !== deviceId) continue;
+				connection.terminate();
+				connections.delete(connection);
+			}
+			log(`device revoked id=${auditLabel(deviceId)}`);
+		}
+		return revoked;
+	};
 	const resolvePushConfig = (config) => {
 		const push = config.push ?? {};
 		const configured = push.provider ?? "none";
@@ -6490,18 +6665,7 @@ function apply(ctx, options) {
 			devices
 		};
 	}, beginPairing, async (deviceId) => {
-		const { devices } = await ready;
-		if (!devices) throw new Error("device registry unavailable");
-		const revoked = devices.revoke(deviceId, Date.now());
-		if (revoked) {
-			for (const connection of [...connections]) {
-				if (connection.connectedDeviceId !== deviceId) continue;
-				connection.terminate();
-				connections.delete(connection);
-			}
-			log(`device revoked id=${auditLabel(deviceId)}`);
-		}
-		return revoked;
+		return await revokeDevice(deviceId);
 	}, async (deviceId, scopes) => {
 		const { devices } = await ready;
 		if (!devices) throw new Error("device registry unavailable");
@@ -6710,7 +6874,8 @@ function apply(ctx, options) {
 									onDeviceAuthenticated: (deviceId) => {
 										log(`device authenticated id=${auditLabel(deviceId)} source=${auditLabel(source)}`);
 									},
-									onPushEnrollKey: handlePushEnrollKey
+									onPushEnrollKey: handlePushEnrollKey,
+									onDeviceRevoke: (deviceId, except) => revokeDevice(deviceId, except)
 								});
 								connections.add(connection);
 							} catch (error) {