dsh-deeppilot 0.8.1 → 0.8.3

package/lib/index.js

@@ -180,13 +180,13 @@ var PromptDeliveryJournal = class {
 		}
 	}
 };
-const journals = /* @__PURE__ */ new Map();
+const journals$1 = /* @__PURE__ */ new Map();
 function openDeliveryJournal(path) {
 	if (!path) return new PromptDeliveryJournal();
-	let journal = journals.get(path);
+	let journal = journals$1.get(path);
 	if (!journal) {
 		journal = new PromptDeliveryJournal(path);
-		journals.set(path, journal);
+		journals$1.set(path, journal);
 	}
 	return journal;
 }
@@ -213,6 +213,29 @@ function validateRequest(type, value) {
 	if (type.startsWith("c2s.session.") && type !== "c2s.session.create" && !text(p.sessionId)) return "invalid sessionId";
 	if (type === "c2s.session.create" && (!optional("workspaceId", (v) => text(v)) || !optional("cwd", (v) => text(v, 32768)) || p.workspaceId !== void 0 && p.cwd !== void 0)) return "invalid workspace selection";
 	if (type === "c2s.directory.list" && !optional("path", (v) => text(v, 32768, false))) return "invalid path";
+	if (type === "c2s.schedule.list" && !text(p.sessionId)) return "invalid sessionId";
+	if (type === "c2s.schedule.history" && (!text(p.sessionId) || !text(p.id) || !integer(p.limit, 1, 100) || !optional("before", (v) => text(v)))) return "invalid schedule history";
+	if (type === "c2s.schedule.create") {
+		if (!validSendId(p.clientRequestId) || !text(p.sessionId) || !text(p.title, 120) || !text(p.prompt, 262144)) return "invalid schedule create fields";
+		if ([
+			"after_seconds",
+			"at",
+			"every_seconds",
+			"daily",
+			"weekly",
+			"cron"
+		].filter((key) => p[key] !== void 0).length !== 1) return "schedule requires exactly one selector";
+		if (p.after_seconds !== void 0 && !integer(p.after_seconds, 1, Number.MAX_SAFE_INTEGER)) return "invalid after_seconds";
+		if (p.every_seconds !== void 0 && !integer(p.every_seconds, 60, Number.MAX_SAFE_INTEGER)) return "invalid every_seconds";
+		if (p.at !== void 0 && typeof p.at !== "string" && (typeof p.at !== "object" || p.at === null || Array.isArray(p.at))) return "invalid at selector";
+	}
+	if (type === "c2s.schedule.update") {
+		if (!validSendId(p.clientRequestId) || !text(p.sessionId) || !text(p.id) || !p.expected || typeof p.expected !== "object" || Array.isArray(p.expected)) return "invalid schedule update fields";
+		if (!optional("title", (v) => text(v, 120)) || !optional("prompt", (v) => text(v, 262144))) return "invalid schedule update content";
+		if (p.change !== void 0 && (!p.change || typeof p.change !== "object" || Array.isArray(p.change))) return "invalid schedule timing change";
+	}
+	if (type === "c2s.schedule.delete" && (!validSendId(p.clientRequestId) || !text(p.sessionId) || !text(p.id))) return "invalid schedule delete fields";
+	if (type === "c2s.session.fork" && (!validSendId(p.clientRequestId) || !optional("atSeq", (v) => integer(v, 0, Number.MAX_SAFE_INTEGER)))) return "invalid session fork fields";
 	if (type === "c2s.device.revoke" && !optional("deviceId", (v) => text(v))) return "invalid deviceId";
 	if (type === "c2s.workspace.create" && !text(p.path, 32768)) return "invalid path";
 	if (type === "c2s.session.open" && !optional("tailCount", (v) => integer(v, 1, 1e4))) return "invalid tailCount";
@@ -256,6 +279,112 @@ function validateRequest(type, value) {
 	}
 }
 //#endregion
+//#region src/connection-policy.ts
+const AUTH_TIMEOUT_MS = 35e3;
+const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif"
+]);
+function sanitizeDeviceField(value, maxChars) {
+	return (typeof value === "string" ? value : String(value ?? "")).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, maxChars);
+}
+/**
+* Runtime shape guard for a frame after JSON.parse. The old `as Envelope`
+* cast alone let JSON `null` reach `env.v` and let a missing or mistyped
+* `type` reach `requiredScope()`'s string operations — one anonymous frame
+* could crash the host process. Reject anything that is not a plain object
+* with a numeric version and a non-empty string type, so field access below
+* is always safe. The payload is intentionally opaque here; each handler
+* validates its own payload shape.
+*/
+function isEnvelope(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const frame = value;
+	if (typeof frame.v !== "number") return false;
+	if (typeof frame.type !== "string" || frame.type.length === 0) return false;
+	if (frame.id !== void 0 && typeof frame.id !== "string") return false;
+	if (frame.ts !== void 0 && typeof frame.ts !== "number") return false;
+	if (frame.seq !== void 0 && typeof frame.seq !== "number") return false;
+	return true;
+}
+function requiredScope(type) {
+	if (typeof type !== "string") return void 0;
+	if (type === "c2s.ping" || type === "c2s.resume") return void 0;
+	if (type === "c2s.device.revoke") return void 0;
+	if (type === "c2s.session.sendPrompt" || type === "c2s.session.delivery") return "prompt.send";
+	if (type === "c2s.pending.list") return "interactions.respond";
+	if (type === "c2s.approval.respond" || type === "c2s.question.respond") return "interactions.respond";
+	if (type === "c2s.liveActivity.register" || type === "c2s.liveActivity.unregister") return "notifications.register";
+	if (type === "c2s.push.register" || type === "c2s.widget.push.register") return "notifications.register";
+	if (type.startsWith("c2s.schedule.")) return "schedule.manage";
+	if (type === "c2s.workspace.create" || type === "c2s.session.create" || type === "c2s.session.fork" || type === "c2s.session.rename" || type === "c2s.session.archive" || type === "c2s.session.unarchive" || type === "c2s.session.cancel" || type === "c2s.session.selectModel") return "sessions.manage";
+	if (type.startsWith("c2s.")) return "sessions.read";
+}
+/** Broadcast and replay authorization. Unknown frame types fail closed. */
+const PUSH_SCOPE_BY_TYPE = {
+	"s2c.session.event": "sessions.read",
+	"s2c.sessions.delta": "sessions.read",
+	"s2c.session.tail": "sessions.read",
+	"s2c.history.page": "sessions.read",
+	"s2c.pending.approval": "interactions.respond",
+	"s2c.pending.question": "interactions.respond",
+	"s2c.pending.cleared": "interactions.respond",
+	"s2c.schedule.changed": "schedule.manage"
+};
+function pushScopeFor(type, payload) {
+	const fixed = PUSH_SCOPE_BY_TYPE[type];
+	if (fixed !== void 0) return fixed;
+	if (type === "s2c.notify") {
+		const category = payload?.category;
+		if (category === "approval.required" || category === "question.asked") return "interactions.respond";
+		if (category === "turn.completed" || category === "session.error") return "sessions.read";
+	}
+}
+function sanitizeImageName(value) {
+	return value.replace(/[\u0000-\u001F\u007F]/g, "").trim().slice(0, 120);
+}
+function sanitizeDocumentField(value, maxChars) {
+	return value.replace(/[\u0000-\u001F\u007F]/g, " ").trim().slice(0, maxChars);
+}
+/** Error code for a failed approval/question response outcome. */
+function pendingResponseErrorCode(reason) {
+	switch (reason) {
+		case "not-pending": return "E_NOT_FOUND";
+		case "bad-response": return "E_PROTOCOL";
+		case "transport": return "E_INTERNAL";
+	}
+}
+/** Human-readable failure detail; `question not pending` must only ever mean
+* "nothing pending", never "the host rejected the answer". */
+function pendingResponseMessage(kind, reason) {
+	switch (reason) {
+		case "not-pending": return kind + " not pending";
+		case "bad-response": return kind + " answer rejected by host: answer does not match the asked questions";
+		case "transport": return "host connection failed while answering " + kind;
+	}
+}
+function scheduleManagementErrorCode(kind) {
+	switch (kind) {
+		case "unsupported": return "E_UNSUPPORTED";
+		case "not-found": return "E_NOT_FOUND";
+		case "invalid": return "E_PROTOCOL";
+		case "conflict":
+		case "busy": return "E_BUSY";
+		default: return "E_INTERNAL";
+	}
+}
+function managementErrorCode(kind) {
+	switch (kind) {
+		case "unsupported": return "E_UNSUPPORTED";
+		case "not-found": return "E_NOT_FOUND";
+		case "busy": return "E_BUSY";
+		case "invalid": return "E_PROTOCOL";
+		case "internal": return "E_INTERNAL";
+	}
+}
+//#endregion
 //#region src/device-auth.ts
 function getPairingCodeTtlMs() {
 	return Number(process.env.DEEPPILOT_PAIRING_TTL_MS) || 3e5;
@@ -266,7 +395,8 @@ const DEVICE_SCOPES = [
 	"prompt.send",
 	"sessions.manage",
 	"interactions.respond",
-	"notifications.register"
+	"notifications.register",
+	"schedule.manage"
 ];
 const DEFAULT_DEVICE_SCOPES = DEVICE_SCOPES;
 async function loadOrCreateHostAudience(path) {
@@ -426,6 +556,10 @@ async function migrateLegacyBridgeDataDir() {
 		throw error;
 	}
 }
+/** Name shown to the operator: a user label when present, otherwise the app-reported model name. */
+function deviceDisplayName(record) {
+	return record.customName?.trim() ? record.customName : record.deviceName;
+}
 /** Hex shape of an APNs device token as delivered by iOS (usually 64 chars). */
 const APNS_TOKEN_PATTERN = /^[0-9a-f]{32,512}$/;
 function isValidApnsToken(token) {
@@ -461,6 +595,7 @@ var DeviceStore = class DeviceStore {
 		const next = {
 			deviceId,
 			deviceName: record.deviceName,
+			...existing?.customName ? { customName: existing.customName } : {},
 			appVersion: record.appVersion,
 			publicKey: record.publicKey,
 			fingerprint: fingerprintForPublicKey(record.publicKey),
@@ -489,6 +624,28 @@ var DeviceStore = class DeviceStore {
 		record.lastSeenTs = now;
 		this.flush();
 	}
+	/**
+	* Set or clear the operator-facing device label. The phone-reported name is
+	* intentionally left untouched so a reconnect cannot erase this value.
+	* Returns the effective display name, or null when the device is not active.
+	*/
+	async setCustomName(deviceId, customName) {
+		const record = this.authorized(deviceId);
+		if (!record) return null;
+		const normalized = customName === null ? "" : sanitizeDeviceField(customName, 64);
+		if (normalized === (record.customName ?? "")) return deviceDisplayName(record);
+		const previous = record.customName;
+		if (normalized === "") delete record.customName;
+		else record.customName = normalized;
+		try {
+			await this.flush();
+		} catch (error) {
+			if (previous === void 0) delete record.customName;
+			else record.customName = previous;
+			throw error;
+		}
+		return deviceDisplayName(record);
+	}
 	revoke(deviceId, now) {
 		const record = this.devices.get(deviceId);
 		if (!record || record.revokedAt !== void 0) return false;
@@ -627,100 +784,6 @@ var DeviceStore = class DeviceStore {
 	}
 };
 //#endregion
-//#region src/connection-policy.ts
-const AUTH_TIMEOUT_MS = 35e3;
-const IMAGE_MEDIA_TYPES = /* @__PURE__ */ new Set([
-	"image/png",
-	"image/jpeg",
-	"image/webp",
-	"image/gif"
-]);
-function sanitizeDeviceField(value, maxChars) {
-	return (typeof value === "string" ? value : String(value ?? "")).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, maxChars);
-}
-/**
-* Runtime shape guard for a frame after JSON.parse. The old `as Envelope`
-* cast alone let JSON `null` reach `env.v` and let a missing or mistyped
-* `type` reach `requiredScope()`'s string operations — one anonymous frame
-* could crash the host process. Reject anything that is not a plain object
-* with a numeric version and a non-empty string type, so field access below
-* is always safe. The payload is intentionally opaque here; each handler
-* validates its own payload shape.
-*/
-function isEnvelope(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const frame = value;
-	if (typeof frame.v !== "number") return false;
-	if (typeof frame.type !== "string" || frame.type.length === 0) return false;
-	if (frame.id !== void 0 && typeof frame.id !== "string") return false;
-	if (frame.ts !== void 0 && typeof frame.ts !== "number") return false;
-	if (frame.seq !== void 0 && typeof frame.seq !== "number") return false;
-	return true;
-}
-function requiredScope(type) {
-	if (typeof type !== "string") return void 0;
-	if (type === "c2s.ping" || type === "c2s.resume") return void 0;
-	if (type === "c2s.device.revoke") return void 0;
-	if (type === "c2s.session.sendPrompt" || type === "c2s.session.delivery") return "prompt.send";
-	if (type === "c2s.pending.list") return "interactions.respond";
-	if (type === "c2s.approval.respond" || type === "c2s.question.respond") return "interactions.respond";
-	if (type === "c2s.liveActivity.register" || type === "c2s.liveActivity.unregister") return "notifications.register";
-	if (type === "c2s.push.register" || type === "c2s.widget.push.register") return "notifications.register";
-	if (type === "c2s.workspace.create" || type === "c2s.session.create" || type === "c2s.session.rename" || type === "c2s.session.archive" || type === "c2s.session.unarchive" || type === "c2s.session.cancel" || type === "c2s.session.selectModel") return "sessions.manage";
-	if (type.startsWith("c2s.")) return "sessions.read";
-}
-/** Broadcast and replay authorization. Unknown frame types fail closed. */
-const PUSH_SCOPE_BY_TYPE = {
-	"s2c.session.event": "sessions.read",
-	"s2c.sessions.delta": "sessions.read",
-	"s2c.session.tail": "sessions.read",
-	"s2c.history.page": "sessions.read",
-	"s2c.pending.approval": "interactions.respond",
-	"s2c.pending.question": "interactions.respond",
-	"s2c.pending.cleared": "interactions.respond"
-};
-function pushScopeFor(type, payload) {
-	const fixed = PUSH_SCOPE_BY_TYPE[type];
-	if (fixed !== void 0) return fixed;
-	if (type === "s2c.notify") {
-		const category = payload?.category;
-		if (category === "approval.required" || category === "question.asked") return "interactions.respond";
-		if (category === "turn.completed" || category === "session.error") return "sessions.read";
-	}
-}
-function sanitizeImageName(value) {
-	return value.replace(/[\u0000-\u001F\u007F]/g, "").trim().slice(0, 120);
-}
-function sanitizeDocumentField(value, maxChars) {
-	return value.replace(/[\u0000-\u001F\u007F]/g, " ").trim().slice(0, maxChars);
-}
-/** Error code for a failed approval/question response outcome. */
-function pendingResponseErrorCode(reason) {
-	switch (reason) {
-		case "not-pending": return "E_NOT_FOUND";
-		case "bad-response": return "E_PROTOCOL";
-		case "transport": return "E_INTERNAL";
-	}
-}
-/** Human-readable failure detail; `question not pending` must only ever mean
-* "nothing pending", never "the host rejected the answer". */
-function pendingResponseMessage(kind, reason) {
-	switch (reason) {
-		case "not-pending": return kind + " not pending";
-		case "bad-response": return kind + " answer rejected by host: answer does not match the asked questions";
-		case "transport": return "host connection failed while answering " + kind;
-	}
-}
-function managementErrorCode(kind) {
-	switch (kind) {
-		case "unsupported": return "E_UNSUPPORTED";
-		case "not-found": return "E_NOT_FOUND";
-		case "busy": return "E_BUSY";
-		case "invalid": return "E_PROTOCOL";
-		case "internal": return "E_INTERNAL";
-	}
-}
-//#endregion
 //#region src/connection.ts
 /**
 * One connected phone. Implements BridgeSink so the HostBridge can push
@@ -942,6 +1005,7 @@ var BridgeConnection = class {
 			this.fail(env.id, "E_FORBIDDEN", `scope ${required} required`);
 			return;
 		}
+		if (env.type.startsWith("c2s.schedule.") && !this.scopes.has("sessions.read")) return this.fail(env.id, "E_FORBIDDEN", "scope sessions.read required");
 		const invalid = validateRequest(env.type, env.payload);
 		if (invalid) return this.fail(env.id, "E_PROTOCOL", invalid);
 		switch (env.type) {
@@ -1027,6 +1091,24 @@ var BridgeConnection = class {
 				this.send("s2c.ack", { sessionId: newId }, env.id);
 				return;
 			}
+			case "c2s.session.fork": {
+				const p = env.payload;
+				if (!this.deps.bridge.capabilities.sessionFork) return this.fail(env.id, "E_UNSUPPORTED", "session fork unavailable on this host version");
+				const result = await this.deps.bridge.forkSession(this.deviceId, {
+					sessionId: p.sessionId,
+					clientRequestId: p.clientRequestId,
+					...p.atSeq !== void 0 ? { atSeq: p.atSeq } : {}
+				});
+				if (!result.ok) return this.fail(env.id, scheduleManagementErrorCode(result.kind), result.message);
+				this.send("s2c.session.forked", {
+					clientRequestId: p.clientRequestId,
+					sourceSessionId: p.sessionId,
+					sessionId: result.value.sessionId,
+					...p.atSeq !== void 0 ? { atSeq: p.atSeq } : {},
+					...result.replayed ? { replayed: true } : {}
+				}, env.id);
+				return;
+			}
 			case "c2s.session.rename": {
 				const p = env.payload;
 				const title = typeof p?.title === "string" ? p.title.trim() : "";
@@ -1133,6 +1215,67 @@ var BridgeConnection = class {
 				this.send("s2c.ack", this.deps.bridge.promptDeliveries.lookup(this.deviceId, p.sessionId, p.clientSendId), env.id);
 				return;
 			}
+			case "c2s.schedule.list": {
+				const p = env.payload;
+				if (!this.deps.bridge.capabilities.schedules) return this.fail(env.id, "E_UNSUPPORTED", "schedules unavailable on this host version");
+				const result = await this.deps.bridge.listSchedules(p.sessionId);
+				if (!result.ok) return this.fail(env.id, scheduleManagementErrorCode(result.kind), result.message);
+				this.send("s2c.schedule.snapshot", {
+					sessionId: p.sessionId,
+					tasks: result.value
+				}, env.id);
+				return;
+			}
+			case "c2s.schedule.history": {
+				const p = env.payload;
+				if (!this.deps.bridge.capabilities.schedules) return this.fail(env.id, "E_UNSUPPORTED", "schedules unavailable on this host version");
+				const result = await this.deps.bridge.scheduleHistory(p.sessionId, p.id, p.limit, p.before);
+				if (!result.ok) return this.fail(env.id, scheduleManagementErrorCode(result.kind), result.message);
+				this.send("s2c.schedule.history", {
+					sessionId: p.sessionId,
+					history: result.value
+				}, env.id);
+				return;
+			}
+			case "c2s.schedule.create": {
+				if (!this.deps.bridge.capabilities.schedules) return this.fail(env.id, "E_UNSUPPORTED", "schedules unavailable on this host version");
+				const p = env.payload;
+				const result = await this.deps.bridge.createSchedule(this.deviceId, p);
+				if (!result.ok) return this.fail(env.id, scheduleManagementErrorCode(result.kind), result.message);
+				this.send("s2c.schedule.updated", {
+					clientRequestId: p.clientRequestId,
+					sessionId: p.sessionId,
+					task: result.value,
+					...result.replayed ? { replayed: true } : {}
+				}, env.id);
+				return;
+			}
+			case "c2s.schedule.update": {
+				if (!this.deps.bridge.capabilities.schedules) return this.fail(env.id, "E_UNSUPPORTED", "schedules unavailable on this host version");
+				const p = env.payload;
+				const result = await this.deps.bridge.updateSchedule(this.deviceId, p);
+				if (!result.ok) return this.fail(env.id, scheduleManagementErrorCode(result.kind), result.message);
+				this.send("s2c.schedule.updated", {
+					clientRequestId: p.clientRequestId,
+					sessionId: p.sessionId,
+					task: result.value,
+					...result.replayed ? { replayed: true } : {}
+				}, env.id);
+				return;
+			}
+			case "c2s.schedule.delete": {
+				if (!this.deps.bridge.capabilities.schedules) return this.fail(env.id, "E_UNSUPPORTED", "schedules unavailable on this host version");
+				const p = env.payload;
+				const result = await this.deps.bridge.deleteSchedule(this.deviceId, p);
+				if (!result.ok) return this.fail(env.id, scheduleManagementErrorCode(result.kind), result.message);
+				this.send("s2c.schedule.updated", {
+					clientRequestId: p.clientRequestId,
+					sessionId: p.sessionId,
+					deleted: true,
+					...result.replayed ? { replayed: true } : {}
+				}, env.id);
+				return;
+			}
 			case "c2s.session.sendPrompt": {
 				const p = env.payload;
 				const text = typeof p?.text === "string" ? p.text : "";
@@ -1881,6 +2024,213 @@ function summarizeResult(content) {
 	return truncate(contentText(content).replace(/\s+/g, " ").trim(), 90);
 }
 //#endregion
+//#region src/mutation-journal.ts
+const RETENTION_MS = 6048e5;
+const CAPACITY = 1e4;
+/**
+* Small durable at-most-once journal for non-prompt mutations.
+*
+* Only a hash of the request content is persisted. The successful value is
+* kept in memory for the current process so a concurrent retry can receive the
+* same response; after a restart a replay is acknowledged and the client
+* refetches the authoritative resource. This avoids duplicating reminder
+* prompts or conversation data in a second journal.
+*/
+var MutationJournal = class {
+	path;
+	persistValues;
+	entries = Object.create(null);
+	inFlight = /* @__PURE__ */ new Map();
+	healthy = true;
+	constructor(path, persistValues = false) {
+		this.path = path;
+		this.persistValues = persistValues;
+		if (!path || !existsSync(path)) return;
+		try {
+			if (statSync(path).size > 4194304) throw new Error("oversized mutation journal");
+			const parsed = JSON.parse(readFileSync(path, "utf8"));
+			if (parsed.version !== 1 || !Array.isArray(parsed.entries) || parsed.entries.length > CAPACITY) throw new Error("invalid mutation journal");
+			for (const value of parsed.entries) {
+				if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid mutation entry");
+				const entry = value;
+				if (typeof entry.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(entry.fingerprint) || typeof entry.createdAt !== "number" || !Number.isFinite(entry.createdAt) || ![
+					"accepted",
+					"rejected",
+					"unknown"
+				].includes(String(entry.status))) throw new Error("invalid mutation entry");
+				if (entry.status === "rejected" && !isMutationErrorCode(entry.code)) throw new Error("invalid mutation code");
+				const key = String(value.key);
+				if (!/^[a-f0-9]{64}$/.test(key)) throw new Error("invalid mutation key");
+				this.entries[key] = {
+					fingerprint: entry.fingerprint,
+					createdAt: entry.createdAt,
+					status: entry.status,
+					...isMutationErrorCode(entry.code) ? { code: entry.code } : {},
+					...this.persistValues && entry.value !== void 0 ? { value: entry.value } : {}
+				};
+			}
+		} catch {
+			this.healthy = false;
+		}
+	}
+	key(deviceId, id) {
+		return createHash("sha256").update(JSON.stringify([deviceId, id])).digest("hex");
+	}
+	expired(id, now = Date.now()) {
+		const age = now - Number(id.slice(0, 13));
+		return age > RETENTION_MS || age < -3e5;
+	}
+	save() {
+		if (!this.path) return;
+		mkdirSync(dirname(this.path), {
+			recursive: true,
+			mode: 448
+		});
+		const temp = this.path + "." + randomUUID() + ".tmp";
+		const fd = openSync(temp, "wx", 384);
+		try {
+			writeFileSync(fd, JSON.stringify({
+				version: 1,
+				entries: Object.entries(this.entries).map(([key, entry]) => ({
+					key,
+					...entry
+				}))
+			}));
+			fsyncSync(fd);
+		} finally {
+			closeSync(fd);
+		}
+		renameSync(temp, this.path);
+		const dir = openSync(dirname(this.path), "r");
+		try {
+			fsyncSync(dir);
+		} finally {
+			closeSync(dir);
+		}
+	}
+	async dispatch(deviceId, id, content, operation) {
+		if (!validSendId(id)) return {
+			ok: false,
+			code: "E_PROTOCOL",
+			message: "invalid clientRequestId"
+		};
+		const key = this.key(deviceId, id);
+		const fingerprint = createHash("sha256").update(JSON.stringify(content)).digest("hex");
+		const existing = this.entries[key];
+		if (existing !== void 0) {
+			if (existing.fingerprint !== fingerprint) return {
+				ok: false,
+				code: "E_PROTOCOL",
+				message: "clientRequestId was reused with different content",
+				replayed: true
+			};
+			if (existing.status === "accepted") return {
+				ok: true,
+				value: existing.value,
+				replayed: true
+			};
+			if (existing.status === "rejected" && existing.code !== void 0) return {
+				ok: false,
+				code: existing.code,
+				replayed: true
+			};
+			return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "mutation outcome is unknown; do not retry automatically",
+				replayed: true
+			};
+		}
+		if (!this.healthy) return {
+			ok: false,
+			code: "E_INTERNAL",
+			message: "mutation journal unavailable"
+		};
+		if (this.expired(id)) return {
+			ok: false,
+			code: "E_PROTOCOL",
+			message: "clientRequestId is outside the retry window"
+		};
+		const now = Date.now();
+		for (const [entryKey, entry] of Object.entries(this.entries)) if (now - entry.createdAt > 6051e5 && !this.inFlight.has(entryKey)) delete this.entries[entryKey];
+		if (Object.keys(this.entries).length >= CAPACITY) return {
+			ok: false,
+			code: "E_BUSY",
+			message: "mutation journal is full"
+		};
+		const entry = {
+			fingerprint,
+			createdAt: Number(id.slice(0, 13)),
+			status: "unknown"
+		};
+		this.entries[key] = entry;
+		try {
+			this.save();
+		} catch {
+			this.healthy = false;
+			return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "mutation journal could not persist the request"
+			};
+		}
+		const run = (async () => {
+			try {
+				const result = await operation();
+				if (result.ok) {
+					entry.status = "accepted";
+					if (this.persistValues) entry.value = result.value;
+					return result;
+				}
+				entry.status = "rejected";
+				entry.code = result.code;
+				return {
+					ok: false,
+					code: result.code,
+					message: result.message
+				};
+			} catch {
+				return {
+					ok: false,
+					code: "E_INTERNAL",
+					message: "mutation outcome is unknown; do not retry automatically"
+				};
+			} finally {
+				try {
+					this.save();
+				} catch {
+					this.healthy = false;
+				}
+			}
+		})();
+		this.inFlight.set(key, run);
+		try {
+			return await run;
+		} finally {
+			this.inFlight.delete(key);
+		}
+	}
+};
+function isMutationErrorCode(value) {
+	return typeof value === "string" && [
+		"E_PROTOCOL",
+		"E_NOT_FOUND",
+		"E_BUSY",
+		"E_UNSUPPORTED",
+		"E_INTERNAL"
+	].includes(value);
+}
+const journals = /* @__PURE__ */ new Map();
+function openMutationJournal(path, persistValues = false) {
+	if (!path) return new MutationJournal(void 0, persistValues);
+	let journal = journals.get(path);
+	if (!journal) {
+		journal = new MutationJournal(path, persistValues);
+		journals.set(path, journal);
+	}
+	return journal;
+}
+//#endregion
 //#region src/host-bridge.ts
 const MAX_RING_DEFAULT = 2e3;
 /**
@@ -1910,10 +2260,14 @@ var HostBridge = class {
 	started = false;
 	disposed = false;
 	promptDeliveries;
-	constructor(apiProxy, historyBufferMax = MAX_RING_DEFAULT, deliveryJournalPath) {
+	scheduleMutations;
+	forkMutations;
+	constructor(apiProxy, historyBufferMax = MAX_RING_DEFAULT, deliveryJournalPath, scheduleJournalPath, forkJournalPath) {
 		this.apiProxy = apiProxy;
 		this.historyBufferMax = historyBufferMax;
 		this.promptDeliveries = openDeliveryJournal(deliveryJournalPath);
+		this.scheduleMutations = openMutationJournal(scheduleJournalPath);
+		this.forkMutations = openMutationJournal(forkJournalPath, true);
 	}
 	pushOutlet;
 	widgetFingerprint = "";
@@ -1935,8 +2289,10 @@ var HostBridge = class {
 			notifyAllCategories: true,
 			models: typeof this.apiProxy.sessions.models === "function" && typeof this.apiProxy.sessions.selectModel === "function",
 			sessionManagement: typeof this.apiProxy.sessions.rename === "function" && typeof this.apiProxy.workspace?.archiveSession === "function",
+			sessionFork: typeof this.apiProxy.sessions.fork === "function",
 			sessionRestore: typeof this.apiProxy.workspace?.unarchiveSession === "function",
 			projectSelection: typeof this.apiProxy.workspace?.list === "function" && typeof this.apiProxy.workspace?.create === "function",
+			schedules: typeof this.apiProxy.schedule?.list === "function" && typeof this.apiProxy.schedule?.create === "function",
 			push: this.pushOutlet?.isAvailable() === true,
 			widgetPush: true,
 			liveActivityPush: true,
@@ -2145,6 +2501,9 @@ var HostBridge = class {
 				this.refreshSummaries();
 				break;
 			}
+			case "host/schedule-changed":
+				this.record("s2c.schedule.changed", {});
+				break;
 			case "host/session-status": {
 				const p = frame;
 				const row = this.summaries.get(String(p.sessionId));
@@ -2479,26 +2838,26 @@ var HostBridge = class {
 				hasMore: Boolean(result.hasMore) || page.dropped > 0
 			});
 			this.deriveTitleFallback(sessionId, messages);
-			if (this.apiProxy.supportsProjections === true) this.refreshProjections(sessionId);
+			this.refreshProjections(sessionId);
 			return true;
 		} catch {
 			return false;
 		}
 	}
 	/**
-	* Pull one session's projection baseline (DSH 0.1.7+) and fold every key
+	* Pull one session's projection baseline and fold every key
 	* through applyProjection — unknown keys are ignored there, `null` means the
 	* session no longer exists, and any failure degrades to a diagnostic: opening
 	* a session must never fail because a baseline could not be read.
 	*/
 	async refreshProjections(sessionId) {
 		try {
-			const response = await this.apiProxy.sessions.projections?.({
+			const response = await this.apiProxy.sessions.projections({
 				rpcId: randomUUID(),
 				payload: { sessionId }
 			});
 			if (this.disposed) return;
-			const result = response?.result;
+			const result = response.result;
 			if (!result) return;
 			if (!result.ok) {
 				this.diagnostic("sessions.projections failed: " + result.error.code);
@@ -2901,6 +3260,267 @@ var HostBridge = class {
 			return null;
 		}
 	}
+	async forkSession(deviceId, payload) {
+		const fork = this.apiProxy.sessions.fork;
+		if (typeof fork !== "function") return {
+			ok: false,
+			kind: "unsupported",
+			message: "session fork unavailable on this host version"
+		};
+		if (!this.summaries.has(payload.sessionId)) return {
+			ok: false,
+			kind: "not-found",
+			message: "session not found"
+		};
+		if (this.archivedSessionIds.has(payload.sessionId) || this.subagentSessionIds.has(payload.sessionId)) return {
+			ok: false,
+			kind: "invalid",
+			message: "archived or subagent sessions cannot be forked"
+		};
+		const result = await this.forkMutations.dispatch(deviceId, payload.clientRequestId, {
+			sessionId: payload.sessionId,
+			...payload.atSeq !== void 0 ? { atSeq: payload.atSeq } : {}
+		}, async () => {
+			const response = await fork.call(this.apiProxy.sessions, {
+				rpcId: randomUUID(),
+				payload: {
+					sessionId: payload.sessionId,
+					...payload.atSeq !== void 0 ? { atSeq: payload.atSeq } : {}
+				}
+			});
+			if (!response.result) return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "session fork returned no result"
+			};
+			if (!response.result.ok) return scheduleMutationError(response.result.error);
+			return {
+				ok: true,
+				value: { sessionId: response.result.value.sessionId }
+			};
+		});
+		if (result.ok) {
+			await this.refreshSummaries();
+			return {
+				ok: true,
+				value: result.value,
+				replayed: result.replayed
+			};
+		}
+		return {
+			ok: false,
+			kind: scheduleErrorKind(result.code),
+			message: result.message ?? result.code,
+			replayed: result.replayed
+		};
+	}
+	async listSchedules(sessionId) {
+		const schedule = this.apiProxy.schedule;
+		if (schedule === void 0) return {
+			ok: false,
+			kind: "unsupported",
+			message: "schedules unavailable on this host version"
+		};
+		try {
+			const response = await schedule.list({
+				rpcId: randomUUID(),
+				payload: { sessionId }
+			});
+			if (!response.result) return {
+				ok: false,
+				kind: "internal",
+				message: "schedule list returned no result"
+			};
+			if (!response.result.ok) return scheduleHostError(response.result.error);
+			return {
+				ok: true,
+				value: response.result.value.tasks
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				kind: "internal",
+				message: String(error)
+			};
+		}
+	}
+	async scheduleHistory(sessionId, id, limit, before) {
+		const schedule = this.apiProxy.schedule;
+		if (schedule === void 0) return {
+			ok: false,
+			kind: "unsupported",
+			message: "schedules unavailable on this host version"
+		};
+		try {
+			const response = await schedule.history({
+				rpcId: randomUUID(),
+				payload: {
+					sessionId,
+					id,
+					limit,
+					...before !== void 0 ? { before } : {}
+				}
+			});
+			if (!response.result) return {
+				ok: false,
+				kind: "internal",
+				message: "schedule history returned no result"
+			};
+			if (!response.result.ok) return scheduleHostError(response.result.error);
+			return {
+				ok: true,
+				value: response.result.value.history
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				kind: "internal",
+				message: String(error)
+			};
+		}
+	}
+	async createSchedule(deviceId, payload) {
+		const schedule = this.apiProxy.schedule;
+		if (schedule === void 0) return {
+			ok: false,
+			kind: "unsupported",
+			message: "schedules unavailable on this host version"
+		};
+		const { clientRequestId, sessionId, ...request } = payload;
+		const result = await this.scheduleMutations.dispatch(deviceId, clientRequestId, {
+			sessionId,
+			request
+		}, async () => {
+			const response = await schedule.create({
+				rpcId: randomUUID(),
+				payload: {
+					sessionId,
+					...request
+				}
+			});
+			if (!response.result) return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "schedule create returned no result"
+			};
+			if (!response.result.ok) return scheduleMutationError(response.result.error);
+			return {
+				ok: true,
+				value: response.result.value
+			};
+		});
+		if (result.ok) {
+			this.record("s2c.schedule.changed", {});
+			return {
+				ok: true,
+				value: result.value,
+				replayed: result.replayed
+			};
+		}
+		return {
+			ok: false,
+			kind: scheduleErrorKind(result.code),
+			message: result.message ?? result.code,
+			replayed: result.replayed
+		};
+	}
+	async updateSchedule(deviceId, payload) {
+		const schedule = this.apiProxy.schedule;
+		if (schedule === void 0) return {
+			ok: false,
+			kind: "unsupported",
+			message: "schedules unavailable on this host version"
+		};
+		const { clientRequestId, ...request } = payload;
+		const result = await this.scheduleMutations.dispatch(deviceId, clientRequestId, request, async () => {
+			const response = await schedule.update({
+				rpcId: randomUUID(),
+				payload: request
+			});
+			if (!response.result) return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "schedule update returned no result"
+			};
+			if (!response.result.ok) return scheduleMutationError(response.result.error);
+			const value = response.result.value;
+			if (value.updated !== true || value.record === void 0) return {
+				ok: false,
+				code: scheduleCodeToError(value.code),
+				message: value.code ?? "schedule update rejected"
+			};
+			return {
+				ok: true,
+				value: value.record
+			};
+		});
+		if (result.ok) {
+			this.record("s2c.schedule.changed", {});
+			return {
+				ok: true,
+				value: result.value,
+				replayed: result.replayed
+			};
+		}
+		return {
+			ok: false,
+			kind: scheduleErrorKind(result.code),
+			message: result.message ?? result.code,
+			replayed: result.replayed
+		};
+	}
+	async deleteSchedule(deviceId, payload) {
+		const schedule = this.apiProxy.schedule;
+		if (schedule === void 0) return {
+			ok: false,
+			kind: "unsupported",
+			message: "schedules unavailable on this host version"
+		};
+		const result = await this.scheduleMutations.dispatch(deviceId, payload.clientRequestId, {
+			sessionId: payload.sessionId,
+			id: payload.id
+		}, async () => {
+			const response = await schedule.delete({
+				rpcId: randomUUID(),
+				payload: {
+					sessionId: payload.sessionId,
+					id: payload.id
+				}
+			});
+			if (!response.result) return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "schedule delete returned no result"
+			};
+			if (!response.result.ok) return scheduleMutationError(response.result.error);
+			if (response.result.value.deleted !== true) return {
+				ok: false,
+				code: "E_NOT_FOUND",
+				message: response.result.value.code ?? "schedule not found"
+			};
+			return {
+				ok: true,
+				value: {
+					id: response.result.value.id,
+					deleted: true
+				}
+			};
+		});
+		if (result.ok) {
+			this.record("s2c.schedule.changed", {});
+			return {
+				ok: true,
+				value: result.value,
+				replayed: result.replayed
+			};
+		}
+		return {
+			ok: false,
+			kind: scheduleErrorKind(result.code),
+			message: result.message ?? result.code,
+			replayed: result.replayed
+		};
+	}
 	async sendPrompt(sessionId, text, images = [], documents = []) {
 		try {
 			const content = [];
@@ -3228,6 +3848,72 @@ function hostModelError(error) {
 		};
 	}
 }
+function scheduleHostError(error) {
+	const message = error.message ?? error.code;
+	switch (error.code) {
+		case "schedule_not_found":
+		case "delivery_cursor_not_found": return {
+			ok: false,
+			kind: "not-found",
+			message
+		};
+		case "schedule_conflict": return {
+			ok: false,
+			kind: "conflict",
+			message
+		};
+		case "invalid_prompt":
+		case "invalid_selector":
+		case "invalid_rule":
+		case "invalid_time_zone":
+		case "not_future":
+		case "time_out_of_range":
+		case "frequency_too_high": return {
+			ok: false,
+			kind: "invalid",
+			message
+		};
+		case "schedule_ended": return {
+			ok: false,
+			kind: "invalid",
+			message
+		};
+		default: return {
+			ok: false,
+			kind: "internal",
+			message
+		};
+	}
+}
+function scheduleMutationError(error) {
+	const result = scheduleHostError(error);
+	if (result.ok) return {
+		ok: false,
+		code: "E_INTERNAL",
+		message: "unexpected schedule result"
+	};
+	return {
+		ok: false,
+		code: result.kind === "not-found" ? "E_NOT_FOUND" : result.kind === "conflict" ? "E_BUSY" : result.kind === "invalid" ? "E_PROTOCOL" : result.kind === "unsupported" ? "E_UNSUPPORTED" : "E_INTERNAL",
+		message: result.message
+	};
+}
+function scheduleCodeToError(code) {
+	if (code === "schedule_not_found") return "E_NOT_FOUND";
+	if (code === "schedule_conflict") return "E_BUSY";
+	if (code === "schedule_ended") return "E_PROTOCOL";
+	if (code === "invalid_prompt" || code === "invalid_selector" || code === "invalid_rule" || code === "invalid_time_zone" || code === "not_future" || code === "time_out_of_range" || code === "frequency_too_high") return "E_PROTOCOL";
+	return "E_INTERNAL";
+}
+function scheduleErrorKind(code) {
+	switch (code) {
+		case "E_NOT_FOUND": return "not-found";
+		case "E_BUSY": return "conflict";
+		case "E_PROTOCOL": return "invalid";
+		case "E_UNSUPPORTED": return "unsupported";
+		default: return "internal";
+	}
+}
 function hostSessionManagementError(error) {
 	const message = error.message ?? error.code;
 	switch (error.code) {
@@ -3303,9 +3989,9 @@ function projectSessionModels(value) {
 }
 /** Project a history page (raw events) into MessageProjection rows. */
 //#endregion
-//#region src/dsh012-remote-interactions.ts
+//#region src/dsh-remote-interactions.ts
 /**
-* Resident DSH 0.1.2-alpha.3 Remote Events client for phone interactions.
+* Resident DSH Remote Events client for phone interactions.
 *
 * The Host-side `approval/request` and `user-questions/request` events are
 * owned once by DSH API Remotes. API Gateway then fans each pending waterfall
@@ -3313,6 +3999,10 @@ function projectSessionModels(value) {
 * that official Client plane in-process instead of registering a competing
 * Host waterfall listener or replacing the official Web composer.
 */
+/** The rc.2 Client sends relative RPC paths to its in-process carrier. */
+function inProcessRemoteRequest(input, init) {
+	return new Request(new URL(input, "http://localhost/"), init);
+}
 let clientFaces;
 /**
 * Load DSH's browser-distributed Client faces into a tiny Host-side module
@@ -3369,32 +4059,9 @@ function createAgentScope(ctx, identity) {
 		}
 	});
 }
-/**
-* Arity of the Host's published `wireStream.open`. 0.1.7-alpha.1 declares
-* `(endpoint, payload, uplink, peer, signal)`; every earlier generation
-* declares `(endpoint, payload, signal)`. Both are plain arrow functions with
-* no default or rest parameters, so `length` is a reliable contract selector —
-* unlike a capability probe, it opens no trial stream. A future signature that
-* rest-parameterizes (reporting `0`) falls back to the 3-argument call, which
-* every generation through `0.1.6-*` accepts.
-*/
-function hostWireStreamArity(open) {
-	return open.length;
-}
-/**
-* Open one Host logical stream on whichever `wireStream.open` contract the
-* running Host publishes. DeepPilot's carrier owns the Host in process and has
-* no Client-to-Host uplink, so the 5-argument form sends `undefined` for both
-* `uplink` and `peer` — the documented "operator's in-process carrier" case.
-*/
-function openHostStream(gateway, endpoint, payload, signal) {
-	const open = gateway.wireStream.open;
-	if (hostWireStreamArity(open) >= 5) return open(endpoint, payload, void 0, void 0, signal);
-	return open(endpoint, payload, signal);
-}
 function inProcessStream(gateway, endpoint, payload, signal) {
 	return (async function* () {
-		yield* await openHostStream(gateway, endpoint, payload, signal);
+		yield* await gateway.wireStream.open(endpoint, payload, void 0, void 0, signal);
 	})();
 }
 /**
@@ -3404,16 +4071,16 @@ function inProcessStream(gateway, endpoint, payload, signal) {
 * The returned disposer tears down the Remote Events generation, all pending
 * listeners, and every lazily minted Agent scope.
 */
-async function startDsh012RemoteInteractions(hostCtx, handlers) {
+async function startDshRemoteInteractions(hostCtx, handlers) {
 	const connection = hostCtx.get("connection");
 	const gateway = hostCtx.get("typertGateway");
-	if (connection === void 0) throw new Error("dsh 0.1.2-alpha.3 Host connection is unavailable");
-	if (gateway === void 0) throw new Error("dsh 0.1.2-alpha.3 typertGateway is unavailable");
+	if (connection === void 0) throw new Error("DSH Host connection is unavailable");
+	if (gateway === void 0) throw new Error("DSH typertGateway is unavailable");
 	const faces = await loadClientFaces();
 	const client = new Context();
 	const fetchHandler = connection.createSharedFetchHandler("/api");
 	const transport = {
-		fetch: (input, init) => fetchHandler.fetch(new Request(input, init)),
+		fetch: (input, init) => fetchHandler.fetch(inProcessRemoteRequest(input, init)),
 		openStream: (endpoint, payload, signal) => inProcessStream(gateway, endpoint, payload, signal),
 		ownsHost: true
 	};
@@ -3460,42 +4127,89 @@ async function startDsh012RemoteInteractions(hostCtx, handlers) {
 	}
 }
 //#endregion
-//#region src/dsh012-api-proxy.ts
+//#region src/dsh-api-proxy.ts
 /**
-* Compatibility façade for the DSH 0.1.2 controller API.
+* Adapter for the DSH rc.2 controller API.
 *
 * DeepPilot's phone protocol deliberately speaks one stable in-process
-* `apiProxy` vocabulary. Harness 0.1.2 removed that service in favor of
-* direct Session/Workspace controllers plus Gateway-backed Remote Events.
-* This adapter rebuilds the small subset the bridge needs from those public
-* controllers and joins the official Client interaction plane in-process,
-* keeping the phone protocol isolated from the Host API migration.
+* `apiProxy` vocabulary. This adapter maps it to the current public
+* Session/Workspace controllers and Gateway-backed Remote Events, keeping
+* the phone protocol isolated from the Host API.
 */
-/** Direct-controller facade with the exact legacy shape HostBridge consumes. */
-var Dsh012ApiProxy = class {
+/** Direct-controller adapter with the shape HostBridge consumes. */
+var DshApiProxy = class {
 	ctx;
 	session;
 	workspaceController;
+	scheduleController;
 	directoryPicker;
 	interactions = /* @__PURE__ */ new Map();
 	shouldSurfaceInteraction;
+	scheduleApi;
 	constructor(ctx, options = {}) {
 		this.ctx = ctx;
 		const session = ctx.get("sessionController");
-		if (session === void 0) throw new Error("dsh 0.1.2 sessionController is unavailable");
+		if (session === void 0) throw new Error("DSH sessionController is unavailable");
 		this.session = session;
 		this.workspaceController = ctx.get("workspaceController");
-		if (typeof this.workspaceController?.unarchiveSession !== "function") delete this.workspace?.unarchiveSession;
+		this.scheduleController = ctx.get("schedule");
+		if (this.workspaceController === void 0) delete this.workspace?.unarchiveSession;
 		this.directoryPicker = ctx.get("directoryPickerController");
 		this.shouldSurfaceInteraction = options.shouldSurfaceInteraction ?? (() => true);
+		this.scheduleApi = this.scheduleController === void 0 ? void 0 : this.createScheduleApi();
 	}
-	/**
-	* Whether the host controller implements `session.projections` (added in
-	* DSH 0.1.7). HostBridge gates its open-time baseline refresh on this so
-	* older hosts keep their current list-row-hint behaviour with no RPC noise.
-	*/
-	get supportsProjections() {
-		return typeof this.session.projections === "function";
+	get schedule() {
+		return this.scheduleApi;
+	}
+	createScheduleApi() {
+		const controller = this.scheduleController;
+		return {
+			list: async (request) => this.call(async () => ({
+				sessionId: request.payload.sessionId,
+				tasks: (await controller.list({ sessionId: request.payload.sessionId })).map(toScheduleTask)
+			})),
+			history: async (request) => this.call(async () => {
+				const value = await controller.history({
+					sessionId: request.payload.sessionId,
+					id: request.payload.id,
+					limit: request.payload.limit,
+					...request.payload.before !== void 0 ? { before: request.payload.before } : {}
+				});
+				if (typeof value.code === "string") throw Object.assign(new Error(String(value.code)), { code: value.code });
+				return {
+					sessionId: request.payload.sessionId,
+					history: toScheduleHistory(value)
+				};
+			}),
+			create: async (request) => this.call(async () => {
+				const { sessionId, ...createRequest } = request.payload;
+				return toScheduleTask(await controller.create(sessionId, createRequest));
+			}),
+			update: async (request) => this.call(async () => {
+				const payload = request.payload;
+				const result = await controller.update({
+					...payload,
+					expected: toScheduleExpected(payload.expected)
+				});
+				return {
+					id: String(result.id ?? payload.id),
+					updated: result.updated === true,
+					...result.record !== void 0 ? { record: toScheduleTask(result.record) } : {},
+					...typeof result.code === "string" ? { code: result.code } : {}
+				};
+			}),
+			delete: async (request) => this.call(async () => {
+				const result = await controller.delete({
+					sessionId: request.payload.sessionId,
+					id: request.payload.id
+				});
+				return {
+					id: String(result.id),
+					deleted: result.deleted === true,
+					...result.code !== void 0 ? { code: String(result.code) } : {}
+				};
+			})
+		};
 	}
 	/**
 	* Decide whether this Gateway Client can surface a phone card. The decision
@@ -3547,16 +4261,13 @@ var Dsh012ApiProxy = class {
 			requestId: request.rpcId ?? randomUUID()
 		}, new AbortController().signal)),
 		create: async (request) => this.call(() => this.session.create(request.payload ?? {})),
+		fork: async (request) => this.call(() => this.session.fork(request.payload)),
 		models: async (request) => this.call(async () => projectModels(await this.session.modelCatalog(), String(request.payload?.sessionId ?? ""), await this.session.list({}, new AbortController().signal))),
 		selectModel: async (request) => this.call(() => this.session.selectModel(request.payload ?? {})),
 		rename: async (request) => this.call(() => this.session.rename(request.payload)),
 		cancel: async (request) => this.call(() => this.session.cancel(request.payload)),
 		attachment: async (request) => this.call(() => this.session.attachment(request.payload)),
-		projections: async (request) => this.call(() => {
-			const read = this.session.projections;
-			if (typeof read !== "function") throw unavailable("session projections unavailable");
-			return read.call(this.session, request.payload);
-		})
+		projections: async (request) => this.call(() => this.session.projections(request.payload))
 	};
 	workspace = {
 		list: async () => this.call(async () => {
@@ -3581,9 +4292,7 @@ var Dsh012ApiProxy = class {
 		}),
 		unarchiveSession: async (request) => this.call(async () => {
 			if (this.workspaceController === void 0) throw unavailable("workspace controller unavailable");
-			const unarchive = this.workspaceController.unarchiveSession;
-			if (typeof unarchive !== "function") throw unavailable("session restore unavailable on this host version");
-			return { archivedSessionIds: [...(await unarchive.call(this.workspaceController, request.payload)).archivedSessionIds] };
+			return { archivedSessionIds: [...(await this.workspaceController.unarchiveSession(request.payload)).archivedSessionIds] };
 		})
 	};
 	host = {
@@ -3634,7 +4343,7 @@ var Dsh012ApiProxy = class {
 		});
 		let disposeInteractions;
 		try {
-			disposeInteractions = await startDsh012RemoteInteractions(this.ctx, {
+			disposeInteractions = await startDshRemoteInteractions(this.ctx, {
 				approval: (sessionId, request, next) => this.answerApproval(queue, sessionId, request, next),
 				question: (sessionId, request, next) => this.answerQuestion(queue, sessionId, request, next)
 			});
@@ -3719,7 +4428,8 @@ var Dsh012ApiProxy = class {
 				sessionId: String(sessionId),
 				running: running === true
 			})),
-			listen("api-session/activity", "host/session-added")
+			listen("api-session/activity", "host/session-added"),
+			listen("schedule/changed", "host/schedule-changed")
 		];
 		const workspaceAbort = new AbortController();
 		const stop = () => workspaceAbort.abort();
@@ -3833,6 +4543,60 @@ function toWorkspaceView(value) {
 		sessionIds: Array.isArray(row.sessionIds) ? row.sessionIds.map(String) : []
 	};
 }
+function toScheduleExpected(value) {
+	const { state: _state, deliveryMode: _deliveryMode, ...record } = value !== null && typeof value === "object" ? value : {};
+	return record;
+}
+function toScheduleTask(value) {
+	const row = value;
+	const kind = [
+		"after",
+		"at",
+		"every",
+		"daily",
+		"weekly",
+		"cron"
+	].includes(String(row.kind)) ? String(row.kind) : "at";
+	const optionalNumber = (key) => typeof row[key] === "number" && Number.isFinite(row[key]) ? row[key] : void 0;
+	return {
+		id: String(row.id ?? ""),
+		kind,
+		title: String(row.title ?? ""),
+		prompt: String(row.prompt ?? ""),
+		scheduledAt: String(row.scheduledAt ?? ""),
+		state: row.state === "overdue" ? "overdue" : "scheduled",
+		deliveryMode: "host",
+		...optionalNumber("afterSeconds") !== void 0 ? { afterSeconds: optionalNumber("afterSeconds") } : {},
+		...optionalNumber("everySeconds") !== void 0 ? { everySeconds: optionalNumber("everySeconds") } : {},
+		...typeof row.time === "string" ? { time: row.time } : {},
+		...typeof row.timeZone === "string" ? { timeZone: row.timeZone } : {},
+		...Array.isArray(row.weekdays) ? { weekdays: row.weekdays.filter((day) => typeof day === "number") } : {},
+		...typeof row.expression === "string" ? { expression: row.expression } : {}
+	};
+}
+function toScheduleHistory(value) {
+	const row = value;
+	const records = Array.isArray(row.records) ? row.records : [];
+	return {
+		id: String(row.id ?? ""),
+		records: records.map((entry) => {
+			const item = entry;
+			return {
+				scheduledAt: String(item.scheduledAt ?? ""),
+				deliveredAt: String(item.deliveredAt ?? ""),
+				messageId: String(item.messageId ?? ""),
+				...typeof item.prompt === "string" ? { prompt: item.prompt } : {}
+			};
+		}),
+		earlierRecordsUnavailable: row.earlierRecordsUnavailable === true,
+		...typeof row.earlierRecordsPruned === "boolean" ? { earlierRecordsPruned: row.earlierRecordsPruned } : {},
+		retention: {
+			days: Number(row.retention?.days ?? 0),
+			records: Number(row.retention?.records ?? 0)
+		},
+		...typeof row.nextBefore === "string" ? { nextBefore: row.nextBefore } : {}
+	};
+}
 async function readWorkspaceBaseline(controller) {
 	const abort = new AbortController();
 	const iterator = controller.follow(abort.signal)[Symbol.asyncIterator]();
@@ -3873,14 +4637,16 @@ var DeepPilotReportService = class extends TypertRemoteService {
 	snapshot;
 	pairingStarter;
 	deviceRevoker;
+	deviceRenamer;
 	deviceScopeUpdater;
 	relayTester;
 	pushTester;
-	constructor(ctx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester) {
+	constructor(ctx, snapshot, pairingStarter, deviceRevoker, deviceRenamer, deviceScopeUpdater, relayTester, pushTester) {
 		super(ctx, "deeppilotReport", { namespace: "deeppilot" });
 		this.snapshot = snapshot;
 		this.pairingStarter = pairingStarter;
 		this.deviceRevoker = deviceRevoker;
+		this.deviceRenamer = deviceRenamer;
 		this.deviceScopeUpdater = deviceScopeUpdater;
 		this.relayTester = relayTester;
 		this.pushTester = pushTester;
@@ -3894,6 +4660,9 @@ var DeepPilotReportService = class extends TypertRemoteService {
 	async revokeDevice(deviceId) {
 		return this.deviceRevoker(deviceId);
 	}
+	async setDeviceName(deviceId, customName) {
+		return this.deviceRenamer(deviceId, customName);
+	}
 	async setDeviceScopes(deviceId, scopes) {
 		return this.deviceScopeUpdater(deviceId, scopes);
 	}
@@ -3912,6 +4681,7 @@ const REPORT_REMOTE_PACKAGE = "dsh-deeppilot";
 const REPORT_ENDPOINT = "deeppilot/report";
 const BEGIN_PAIRING_ENDPOINT = "deeppilot/beginPairing";
 const REVOKE_DEVICE_ENDPOINT = "deeppilot/revokeDevice";
+const SET_DEVICE_NAME_ENDPOINT = "deeppilot/setDeviceName";
 const SET_DEVICE_SCOPES_ENDPOINT = "deeppilot/setDeviceScopes";
 function reject(field) {
 	throw new TypeError(`deeppilot/report result: invalid ${field}`);
@@ -3954,9 +4724,12 @@ function parseDevice(value) {
 			updatedAt: int(a, "updatedAt", "device.apns.updatedAt")
 		};
 	}
+	const customName = s.customName;
+	if (customName !== void 0 && (typeof customName !== "string" || customName.length === 0 || customName.length > 64 || customName.trim() !== customName || /[\u0000-\u001f\u007f-\u009f]/u.test(customName))) reject("device.customName");
 	return {
 		deviceId: str(s, "deviceId", "device.deviceId"),
 		deviceName: str(s, "deviceName", "device.deviceName"),
+		...typeof customName === "string" ? { customName } : {},
 		appVersion: str(s, "appVersion", "device.appVersion"),
 		firstSeenTs: int(s, "firstSeenTs", "device.firstSeenTs"),
 		lastSeenTs: int(s, "lastSeenTs", "device.lastSeenTs"),
@@ -4126,6 +4899,13 @@ const deviceIdSchema = { parse(value) {
 	if (typeof value !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value)) reject("deviceId");
 	return value;
 } };
+const customNameSchema = { parse(value) {
+	if (value === null) return null;
+	if (typeof value !== "string") reject("customName");
+	const trimmed = value.trim();
+	if (trimmed.length === 0 || trimmed.length > 64 || /[\u0000-\u001f\u007f-\u009f]/u.test(value)) reject("customName");
+	return trimmed;
+} };
 const scopesSchema = { parse(value) {
 	if (!Array.isArray(value) || value.some((scope) => typeof scope !== "string" || !DEVICE_SCOPES.includes(scope))) reject("scopes");
 	return normalizeDeviceScopes(value);
@@ -4134,28 +4914,11 @@ const booleanSchema = { parse(value) {
 	if (typeof value !== "boolean") reject("boolean");
 	return value;
 } };
-/**
-* One strict boundary codec carrying both generation shapes of the supported
-* `0.1.x` host family.
-*
-* Through `0.1.6-alpha.1` a descriptor published the schema value itself and
-* every consumer parsed through `codec.schema.parse(value)`. `0.1.6-alpha.2`
-* switched to a lazily materialized process-realm factory: `TypertRegistry`
-* now rejects a strict codec without `create()`, and the Gateway parses
-* through `codec.create().parse(value)`.
-*
-* Publishing both keys — `create()` returning the same hand-written,
-* dependency-free codec — keeps one package valid across the entire declared
-* peer range instead of forking the wire contract per host generation. The
-* cast is required because each generation's `TypertCodec` declares only its
-* own key, so a fresh object literal carrying both fails excess-property
-* checking against either one.
-*/
+/** The rc.2 Gateway materializes each strict codec through `create()`. */
 function strictCodec(typeSymbol, schema) {
 	return {
 		mode: "strict",
 		typeSymbol,
-		schema,
 		create: () => schema
 	};
 }
@@ -4201,6 +4964,25 @@ const REPORT_HOST_CONTRIBUTION = {
 			}],
 			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#Boolean`, booleanSchema)
 		},
+		{
+			id: `${REPORT_REMOTE_PACKAGE}#${SET_DEVICE_NAME_ENDPOINT}`,
+			service: "deeppilotReport",
+			namespace: "deeppilot",
+			method: "setDeviceName",
+			invocation: { kind: "direct" },
+			parameters: [{
+				name: "deviceId",
+				wire: "deviceId",
+				source: "json",
+				codec: strictCodec(`${REPORT_REMOTE_PACKAGE}#DeviceId`, deviceIdSchema)
+			}, {
+				name: "customName",
+				wire: "customName",
+				source: "json",
+				codec: strictCodec(`${REPORT_REMOTE_PACKAGE}#CustomDeviceName`, customNameSchema)
+			}],
+			result: strictCodec(`${REPORT_REMOTE_PACKAGE}#CustomDeviceName`, customNameSchema)
+		},
 		{
 			id: `${REPORT_REMOTE_PACKAGE}#${SET_DEVICE_SCOPES_ENDPOINT}`,
 			service: "deeppilotReport",
@@ -4246,9 +5028,9 @@ const REPORT_HOST_CONTRIBUTION = {
 * Provide the report service and register its Remote descriptor. Rides an
 * optional `typert` inject: profiles without the web stack never activate it.
 */
-function applyReportRemote(ctx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester) {
+function applyReportRemote(ctx, snapshot, pairingStarter, deviceRevoker, deviceRenamer, deviceScopeUpdater, relayTester, pushTester) {
 	ctx.inject(["typert"], (remoteCtx) => {
-		new DeepPilotReportService(remoteCtx, snapshot, pairingStarter, deviceRevoker, deviceScopeUpdater, relayTester, pushTester);
+		new DeepPilotReportService(remoteCtx, snapshot, pairingStarter, deviceRevoker, deviceRenamer, deviceScopeUpdater, relayTester, pushTester);
 		const unregister = remoteCtx.typert.register(REPORT_HOST_CONTRIBUTION);
 		remoteCtx.effect(() => () => void unregister(), "dsh-deeppilot: report remote");
 	});
@@ -5391,18 +6173,18 @@ function localListenError(error, port) {
 /** Operator-run relay used by distributed builds; overridable via config. */
 const DEFAULT_RELAY_URL = "https://pilot.hailab.dev";
 const Config = z.object({
-	enabled: live(z.boolean().default(true)),
+	enabled: z.boolean().default(true).volatile(),
 	devicesPath: z.string().default(join(bridgeDataDir(), "devices-v2.json")),
 	historyBufferMax: z.natural().min(100).default(2e3),
-	debug: live(z.boolean().default(false)),
-	local: live(z.object({
+	debug: z.boolean().default(false).volatile(),
+	local: z.object({
 		enabled: z.boolean().default(true),
 		port: z.natural().min(MIN_LOCAL_PORT).max(MAX_LOCAL_PORT).default(DEFAULT_LOCAL_PORT).description("DeepPilot 局域网独立端口（仅 TLS；默认 3098，修改后本地连接会短暂重连）")
 	}).default({
 		enabled: true,
 		port: DEFAULT_LOCAL_PORT
-	})),
-	remote: live(z.object({
+	}).volatile(),
+	remote: z.object({
 		enabled: z.boolean().default(false),
 		provider: z.union(["tailscale-funnel"]).default("tailscale-funnel"),
 		hostname: z.string().default(DEFAULT_REMOTE_HOSTNAME),
@@ -5422,7 +6204,7 @@ const Config = z.object({
 		helperPath: "",
 		funnelPort: 443,
 		maxConnectionsPerSource: 8
-	})),
+	}).volatile(),
 	push: z.object({
 		provider: z.union([
 			"none",
@@ -5448,21 +6230,6 @@ const Config = z.object({
 	})
 });
 /**
-* Declare one live-update (volatile) config node when the host supports it.
-*
-* DSH 0.1.7's schemastery adds `Schema#volatile()`; the schemas this package
-* typechecks against (3.18.x line) do not have the method, so the call goes
-* through a structural check instead of a direct chain — a direct
-* `.volatile()` would both fail typecheck today and throw at import on an
-* older host, killing plugin activation.
-*/
-function live(node) {
-	const schema = node;
-	if (typeof schema.volatile === "function") return schema.volatile();
-	if (typeof schema.extra === "function") return schema.extra("volatile", true);
-	return node;
-}
-/**
 * Deep-unwrap live-update (volatile) references to plain values.
 *
 * On a 0.1.7 host, `apply()`'s options — and even a direct `Config(raw)` call
@@ -5470,8 +6237,7 @@ function live(node) {
 * `currentConfig()` compares plain values (`=== true`, numeric bounds, object
 * fields), and schemastery refuses to re-parse a reference, so normalization
 * unwraps on the way in and on the way out. A JSON-shaped config value cannot
-* carry a function, so the `get` check cannot false-positive; plain input
-* passes through unchanged, keeping older-host behavior identical.
+* carry a function, so the `get` check cannot false-positive.
 */
 function plainConfig(value) {
 	if (value === null || typeof value !== "object") return value;
@@ -5485,8 +6251,7 @@ function plainConfig(value) {
 * Cordis hands the second argument in different shapes depending on host
 * composition: a reactive options getter, the resolved config value, or
 * nothing when the patch row omits `config`. Normalize all of them — and
-* unwrap volatile references so the returned Config is plain data on every
-* host generation.
+* unwrap volatile references so the returned Config is plain data.
 */
 function normalizeOptions(options) {
 	if (typeof options === "function") return plainConfig(options());
@@ -6024,8 +6789,8 @@ async function writePrivate(path, contents) {
 * devices) and loopback Funnel-origin listeners. The web UI and the rest of
 * DSH's API are never exposed by these listeners.
 *
-* Data plane: an in-process HostBridge consumes a local compatibility façade
-* over DSH 0.1.2 Session/Workspace controllers, mirrors session summaries,
+* Data plane: an in-process HostBridge consumes a local adapter over DSH
+* Session/Workspace controllers, mirrors session summaries,
 * tracks pending approvals/questions, and fans projected protocol-v2 pushes
 * out to every connected device.
 *
@@ -6066,36 +6831,10 @@ function apply(ctx, options) {
 	};
 	const auditSalt = randomBytes(32);
 	const auditLabel = (value) => createHash("sha256").update(auditSalt).update(value).digest("hex").slice(0, 12);
-	/**
-	* Settings-section source: while a settings service is attached this holds
-	* the user-edited section value; otherwise the composition defaults. Read
-	* through currentConfig() everywhere (normalizeOptions prefers it).
-	*/
-	let liveSource;
 	let scheduleRemoteReconcile;
 	let scheduleLocalReconcile;
-	const currentConfig = () => {
-		if (liveSource !== void 0) return normalizeOptions(liveSource());
-		return normalizeOptions(options);
-	};
+	const currentConfig = () => normalizeOptions(options);
 	const enabledNow = () => currentConfig().enabled === true;
-	const settingsHooks = {
-		setSource: (source) => {
-			liveSource = source;
-			queueMicrotask(() => {
-				scheduleLocalReconcile?.();
-				scheduleRemoteReconcile?.();
-			});
-		},
-		onChange: () => queueMicrotask(() => {
-			scheduleLocalReconcile?.();
-			scheduleRemoteReconcile?.();
-		})
-	};
-	ctx.inject(["settings"], (settingsCtx) => {
-		if (typeof settingsCtx.settings?.installSection !== "function") return;
-		settingsCtx.settings.installSection(ctx, "deeppilot", Config, normalizeOptions(void 0), settingsHooks);
-	});
 	ctx.on("loader/volatile-update", () => queueMicrotask(() => {
 		scheduleLocalReconcile?.();
 		scheduleRemoteReconcile?.();
@@ -6226,7 +6965,7 @@ function apply(ctx, options) {
 				notification
 			});
 			return {
-				name: device.deviceName,
+				name: deviceDisplayName(device),
 				environment: registration.environment,
 				outcome,
 				tokenFingerprint: registration.token.slice(0, 10),
@@ -6534,11 +7273,11 @@ function apply(ctx, options) {
 					if (!registration) return false;
 					if (connectedIds.has(device.deviceId)) return false;
 					if (!mayReceivePush(device, notification)) {
-						if (currentConfig().debug === true) log(`push skip "${device.deviceName}": notification permission not granted`);
+						if (currentConfig().debug === true) log(`push skip "${deviceDisplayName(device)}": notification permission not granted`);
 						return false;
 					}
 					if (registration.categories?.[notification.category] === false) {
-						if (currentConfig().debug === true) log(`push skip "${device.deviceName}": category ${notification.category} muted`);
+						if (currentConfig().debug === true) log(`push skip "${deviceDisplayName(device)}": category ${notification.category} muted`);
 						return false;
 					}
 					return true;
@@ -6559,10 +7298,10 @@ function apply(ctx, options) {
 						environment: registration.environment,
 						notification
 					}).then(({ outcome, reason }) => {
-						log(`push(${transport}) ${notification.category} → "${device.deviceName}" [${registration.environment}] = ${outcome}${reason ? " (" + reason + ")" : ""}`);
+						log(`push(${transport}) ${notification.category} → "${deviceDisplayName(device)}" [${registration.environment}] = ${outcome}${reason ? " (" + reason + ")" : ""}`);
 						if (shouldPrunePushToken(outcome, reason)) {
 							devices.clearPushToken(device.deviceId);
-							log(`push: pruned stale token of "${device.deviceName}" (${reason ?? "unknown"}) — app re-registers on next launch`);
+							log(`push: pruned stale token of "${deviceDisplayName(device)}" (${reason ?? "unknown"}) — app re-registers on next launch`);
 							return;
 						}
 						if (relayUrl !== void 0 && shouldReEnrollRelayToken(transport, outcome, reason, {
@@ -6630,9 +7369,13 @@ function apply(ctx, options) {
 		try {
 			await ready;
 			pairingReady = auth.audience !== null && auth.devices !== null;
-			devices = (auth.devices?.list() ?? []).filter((device) => device.publicKey !== void 0 && device.fingerprint !== void 0).map(({ deviceId, deviceName, appVersion, firstSeenTs, lastSeenTs, fingerprint, scopes, revokedAt, apns }) => ({
+			devices = (auth.devices?.list() ?? []).filter((device) => device.publicKey !== void 0 && device.fingerprint !== void 0).map(({ deviceId, deviceName, customName, appVersion, firstSeenTs, lastSeenTs, fingerprint, scopes, revokedAt, apns }) => ({
 				deviceId,
-				deviceName,
+				deviceName: deviceDisplayName({
+					deviceName,
+					customName
+				}),
+				...customName ? { customName } : {},
 				appVersion,
 				firstSeenTs,
 				lastSeenTs,
@@ -6666,6 +7409,13 @@ function apply(ctx, options) {
 		};
 	}, beginPairing, async (deviceId) => {
 		return await revokeDevice(deviceId);
+	}, async (deviceId, customName) => {
+		const { devices } = await ready;
+		if (!devices) throw new Error("device registry unavailable");
+		if (await devices.setCustomName(deviceId, customName) === null) throw new Error("active device not found");
+		const normalized = customName === null ? "" : sanitizeDeviceField(customName, 64);
+		log(`device custom name updated id=${auditLabel(deviceId)} custom=${String(normalized.length > 0)}`);
+		return normalized === "" ? null : normalized;
 	}, async (deviceId, scopes) => {
 		const { devices } = await ready;
 		if (!devices) throw new Error("device registry unavailable");
@@ -7105,12 +7855,12 @@ function apply(ctx, options) {
 		const apiCtx = sub;
 		let proxy;
 		try {
-			proxy = new Dsh012ApiProxy(apiCtx, { shouldSurfaceInteraction: hasPairedPhoneSurface });
+			proxy = new DshApiProxy(apiCtx, { shouldSurfaceInteraction: hasPairedPhoneSurface });
 		} catch (error) {
-			log("dsh 0.1.2 session bridge unavailable: " + String(error));
+			log("DSH session bridge unavailable: " + String(error));
 			return;
 		}
-		const bridge = new HostBridge(proxy, cfg.historyBufferMax, join(dataDir, "prompt-deliveries-v1.json"));
+		const bridge = new HostBridge(proxy, cfg.historyBufferMax, join(dataDir, "prompt-deliveries-v1.json"), join(dataDir, "schedule-mutations-v1.json"), join(dataDir, "fork-mutations-v1.json"));
 		bridge.setPushOutlet(makePushOutlet());
 		state.bridge = bridge;
 		bridge.start();