dsh-deeppilot 0.9.15 → 0.9.17

package/lib/index.js

@@ -3,6 +3,7 @@ import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomB
 import { access, appendFile, chmod, mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { WebSocketServer } from "ws";
+import { deflateRawSync } from "node:zlib";
 import { homedir, networkInterfaces } from "node:os";
 import { closeSync, constants, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
@@ -292,6 +293,23 @@ function sanitizeImageName(value) {
 function sanitizeDocumentField(value, maxChars) {
 	return value.replace(/[\u0000-\u001F\u007F]/g, " ").trim().slice(0, maxChars);
 }
+/**
+* 解析关注集合：字符串数组、去重、去空、超长 ID 丢弃，最多取前 16 个。
+* 不合法时返回 undefined。auth.prove 上宁可退回全量广播也不因优化字段拒绝认证；
+* c2s.session.watch 由行校验先拒绝非法载荷。
+*/
+function parseWatchSessions(value) {
+	if (!Array.isArray(value)) return void 0;
+	const ids = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		if (typeof item !== "string") continue;
+		const id = item.trim();
+		if (id.length === 0 || id.length > 256) continue;
+		ids.add(id);
+		if (ids.size >= 16) break;
+	}
+	return [...ids];
+}
 /** 二进制模式下导出与附件的单块字节数。连接在发送缓冲降到 256 KiB 以下才发
 *  下一块，缓冲峰值约 512 KiB，远低于 4 MiB 的慢客户端断开线。 */
 const BINARY_CHUNK_BYTES = 262144;
@@ -305,6 +323,13 @@ function encodeBinaryFrame(header, body) {
 	frame.set(body, 5 + headerBytes.length);
 	return frame;
 }
+function encodeCompressedFrame(json) {
+	const deflated = deflateRawSync(Buffer.from(json, "utf8"), { level: 1 });
+	const frame = Buffer.allocUnsafe(1 + deflated.length);
+	frame.writeUInt8(2, 0);
+	deflated.copy(frame, 1);
+	return frame;
+}
 // src/auth-rate-limit.ts
 const DEFAULT_AUTH_RATE_POLICY = {
 	windowMs: 6e4,
@@ -1943,7 +1968,8 @@ function projectEvent(sessionId, event) {
 						state: "running",
 						summary: summarizeArgs(data?.arguments),
 						...data?.callId ? { callId: String(data.callId) } : {},
-						...editField(data?.name, data?.arguments)
+						...editField(data?.name, data?.arguments),
+						...targetField(data?.name, data?.arguments)
 					},
 					ts: tsOf(event)
 				}
@@ -2114,6 +2140,40 @@ function attachmentProjection(data) {
 	const attachments = messageAttachments(data);
 	return attachments.length > 0 ? { attachments } : {};
 }
+/**
+* 取出一条事件里手机能看到的图片引用，供附件读回补全参数。
+*
+* 范围与投影保持一致：只看 user/message 与成功的 tool/result——手机只会拿到这两
+* 类行上的 attachmentId，不在投影里的图片也不该被读回。
+* 职责：DSH 0.2.2 起宿主读图接口要完整引用，且不再核对会话是否引用过这张图；
+* Bridge 用这里收集的引用同时完成「补全参数」和「会话归属校验」。
+*/
+function eventImageRefs(event) {
+	let message;
+	if (event.type === "user/message") message = event.data;
+	else if (event.type === "tool/result") {
+		const data = event.data;
+		if (data?.error !== void 0) return [];
+		message = data?.message;
+	} else return [];
+	if (!message || typeof message !== "object") return [];
+	const inner = message.message;
+	const content = (inner && typeof inner === "object" ? inner : message).content;
+	if (!Array.isArray(content)) return [];
+	const refs = [];
+	for (const part of content) {
+		const block = part;
+		if (!block || block.type !== "image") continue;
+		const ref = block.attachment;
+		if (!ref || typeof ref !== "object") continue;
+		if (typeof ref.attachmentId !== "string" || ref.attachmentId.length === 0) continue;
+		refs.push({
+			...ref,
+			attachmentId: ref.attachmentId
+		});
+	}
+	return refs;
+}
 /** Extract reasoning ("thinking") text from assistant message payloads. */
 function messageThinking(data) {
 	if (!data || typeof data !== "object") return "";
@@ -2153,6 +2213,125 @@ function editField(name, raw) {
 	const edit = toolEditOf(name, raw);
 	return edit ? { edit } : {};
 }
+function targetField(name, raw) {
+	const target = toolTargetOf(name, raw);
+	return target ? { target } : {};
+}
+/** `tool.target.value` / `scope` 的 UTF-8 上限。 */
+const MAX_TOOL_TARGET_VALUE_BYTES = 1024;
+/** 读写文件类工具：路径即操作对象。 */
+const PATH_TARGET_TOOLS = /* @__PURE__ */ new Set([
+	"read",
+	"write",
+	"edit",
+	"str_replace_editor"
+]);
+/** 搜索类工具：搜索式为主值，搜索目录为范围。 */
+const PATTERN_TARGET_TOOLS = /* @__PURE__ */ new Set(["grep", "glob"]);
+/** 网页类工具：有网址给网址，否则给查询词。 */
+const WEB_TARGET_TOOLS = /* @__PURE__ */ new Set(["web_fetch", "web_search"]);
+/** 协作类工具：对象是另一个智能体或后台任务，按工具各取一个能认出对象的参数。 */
+const TEXT_TARGET_KEYS = {
+	send_message: ["target", "agent_id"],
+	spawn_teammate: ["name"],
+	subagent: ["description"],
+	job_output: ["job_id"]
+};
+/**
+* 从工具调用的原始参数里挑出操作对象，归一化成 `ToolTargetProjection`。
+*
+* 为什么需要它：`tool.summary` 在结果回来后被替换成结果摘要（read 变成文件正文片段），
+* 客户端从此拿不到「读的是哪个文件」。target 只在调用时生成一次，结果合并时不动。
+* 规则表之外的工具、无法解析或缺少对应参数时返回 undefined，客户端退回 summary。
+* 参数名只在这里出现，客户端不依赖宿主工具参数命名。
+*/
+function toolTargetOf(name, raw) {
+	if (typeof name !== "string" || typeof raw !== "string" || raw.length === 0) return void 0;
+	let args;
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+		args = parsed;
+	} catch {
+		return;
+	}
+	/** 取第一个非空字符串参数。 */
+	const pick = (...keys) => {
+		for (const key of keys) {
+			const value = args[key];
+			if (typeof value === "string" && value.trim().length > 0) return value.trim();
+		}
+	};
+	if (PATH_TARGET_TOOLS.has(name)) {
+		const path = pick("file_path", "path");
+		return path ? {
+			kind: "path",
+			value: boundPath(path)
+		} : void 0;
+	}
+	if (name === "bash") {
+		const command = pick("command");
+		if (!command) return void 0;
+		const label = pick("description");
+		return {
+			kind: "command",
+			value: boundText(command, MAX_TOOL_TARGET_VALUE_BYTES),
+			...label ? { label: boundText(label, 256) } : {}
+		};
+	}
+	if (PATTERN_TARGET_TOOLS.has(name)) {
+		const pattern = pick("pattern");
+		if (!pattern) return void 0;
+		const scope = pick("path");
+		return {
+			kind: "pattern",
+			value: boundText(pattern, MAX_TOOL_TARGET_VALUE_BYTES),
+			...scope ? { scope: boundPath(scope) } : {}
+		};
+	}
+	if (WEB_TARGET_TOOLS.has(name)) {
+		const url = pick("url");
+		if (url) return {
+			kind: "url",
+			value: boundText(url, MAX_TOOL_TARGET_VALUE_BYTES)
+		};
+		const query = pick("query");
+		return query ? {
+			kind: "text",
+			value: boundText(query, MAX_TOOL_TARGET_VALUE_BYTES)
+		} : void 0;
+	}
+	const keys = TEXT_TARGET_KEYS[name];
+	if (keys) {
+		const text = pick(...keys);
+		return text ? {
+			kind: "text",
+			value: boundText(text, MAX_TOOL_TARGET_VALUE_BYTES)
+		} : void 0;
+	}
+}
+/** 命令 / 文本：空白折叠成单个空格（手机上只显示一行），超限砍结尾加「…」。 */
+function boundText(value, maxBytes) {
+	const flat = value.replace(/\s+/g, " ");
+	if (Buffer.byteLength(flat, "utf8") <= maxBytes) return flat;
+	return truncateUtf8(flat, maxBytes - Buffer.byteLength("…", "utf8")) + "…";
+}
+/** 路径：超限时砍开头、保留结尾（如 `…/Views/A.swift`），保证文件名完整可认。 */
+function boundPath(value) {
+	const maxBytes = MAX_TOOL_TARGET_VALUE_BYTES;
+	if (Buffer.byteLength(value, "utf8") <= maxBytes) return value;
+	const budget = maxBytes - Buffer.byteLength("…", "utf8");
+	let low = 0;
+	let high = value.length;
+	while (low < high) {
+		const mid = Math.ceil((low + high) / 2);
+		if (Buffer.byteLength(value.slice(value.length - mid), "utf8") <= budget) low = mid;
+		else high = mid - 1;
+	}
+	let start = value.length - low;
+	if (start < value.length && /[\uDC00-\uDFFF]/.test(value[start])) start += 1;
+	return "…" + value.slice(start);
+}
 function summarizeArgs(raw) {
 	if (typeof raw !== "string" || raw.length === 0) return "";
 	try {
@@ -2166,15 +2345,22 @@ function summarizeArgs(raw) {
 }
 /** 宿主的文件编辑工具名（DSH `dsh-tool-str-replace-editor`）。 */
 const EDITOR_TOOL_NAME = "str_replace_editor";
+/** 宿主的字符串替换工具（`file_path` / `old_string` / `new_string` / `replace_all`），实际会话里最常用。 */
+const EDIT_TOOL_NAME = "edit";
+/** 宿主的整文件写入工具（`file_path` / `content`）。 */
+const WRITE_TOOL_NAME = "write";
 /**
 * 把编辑类工具调用的原始参数归一化成 `ToolEditProjection`。
 *
-* 只认 `str_replace_editor` 的 `str_replace` / `create` / `insert`（`view` 不改文件），
-* 其他工具或无法解析的参数返回 undefined，工具行保持原样。与 iOS `ToolEditDiff.parse`
-* 的解析口径一致：`new_str` 缺失视为删除（空串）。
+* 认三种宿主工具，其他工具或无法解析的参数返回 undefined，工具行保持原样：
+* - `edit`：`old_string` → `new_string` 为 `replace`；`old_string` 为空串视为新建（`create`）。
+* - `write`：`content` 为写入后的文件全文，记作 `create`（宿主覆盖已有文件时也一样，原文拿不到）。
+* - `str_replace_editor`：`str_replace` / `create` / `insert`（`view` 不改文件）。
+* 与 iOS `ToolEditDiff.parse` 的解析口径一致：新文本缺失视为删除（空串）。
 */
 function toolEditOf(name, raw) {
-	if (name !== EDITOR_TOOL_NAME || typeof raw !== "string" || raw.length === 0) return void 0;
+	if (name !== EDITOR_TOOL_NAME && name !== EDIT_TOOL_NAME && name !== WRITE_TOOL_NAME) return void 0;
+	if (typeof raw !== "string" || raw.length === 0) return void 0;
 	let args;
 	try {
 		const parsed = JSON.parse(raw);
@@ -2183,6 +2369,10 @@ function toolEditOf(name, raw) {
 	} catch {
 		return;
 	}
+	if (name === EDIT_TOOL_NAME || name === WRITE_TOOL_NAME) {
+		const edit = plainEditOf(name, args);
+		return edit ? boundedEdit(edit) : void 0;
+	}
 	const path = args.path;
 	if (typeof path !== "string" || path.length === 0) return void 0;
 	let edit;
@@ -2215,6 +2405,32 @@ function toolEditOf(name, raw) {
 			break;
 		default: return;
 	}
+	return boundedEdit(edit);
+}
+/** `edit` / `write` 的参数（路径键为 `file_path`）。 */
+function plainEditOf(name, args) {
+	const path = args.file_path;
+	if (typeof path !== "string" || path.length === 0) return void 0;
+	if (name === WRITE_TOOL_NAME) return typeof args.content === "string" ? {
+		path,
+		operation: "create",
+		newText: args.content
+	} : void 0;
+	if (typeof args.old_string !== "string") return void 0;
+	const newText = typeof args.new_string === "string" ? args.new_string : "";
+	return args.old_string.length === 0 ? {
+		path,
+		operation: "create",
+		newText
+	} : {
+		path,
+		operation: "replace",
+		oldText: args.old_string,
+		newText
+	};
+}
+/** 任一侧正文超过上限时两侧都不发，只留路径、操作与 truncated。 */
+function boundedEdit(edit) {
 	return [edit.oldText, edit.newText].some((text) => text !== void 0 && Buffer.byteLength(text, "utf8") > 16384) ? withoutEditBodies(edit) : edit;
 }
 /** 去掉改动正文，只留路径、操作与 truncated 标记（超限或整条消息超限时用）。 */
@@ -2229,7 +2445,12 @@ function withoutEditBodies(edit) {
 function truncate(text, max) {
 	return text.length <= max ? text : text.slice(0, max - 1) + "…";
 }
-function projectHistory(events) {
+/**
+* `touched`（可选，增量 tail 用）：记录每一行最后一次被哪个事件改动，键为行的 seq。
+* 行由自身事件生成时等于它的 seq；工具结果合并回较早的工具调用行时更新为结果事件的
+* seq。增量 tail 据此找出「sinceSeq 之后改动过的行」，而不只是 seq 更大的行。
+*/
+function projectHistory(events, touched) {
 	const messages = [];
 	const toolByCall = /* @__PURE__ */ new Map();
 	for (const entry of events) {
@@ -2238,6 +2459,7 @@ function projectHistory(events) {
 			seq: event.seq,
 			ts: tsOf(event)
 		};
+		touched?.set(event.seq, Math.max(touched.get(event.seq) ?? event.seq, event.seq));
 		switch (event.type) {
 			case "system/message": break;
 			case "user/message":
@@ -2270,7 +2492,8 @@ function projectHistory(events) {
 						name: String(data?.name ?? "tool"),
 						state: "running",
 						summary: summarizeArgs(data?.arguments),
-						...editField(data?.name, data?.arguments)
+						...editField(data?.name, data?.arguments),
+						...targetField(data?.name, data?.arguments)
 					}
 				};
 				messages.push(row);
@@ -2291,6 +2514,7 @@ function projectHistory(events) {
 						summary
 					};
 					if (attachments.attachments) Object.assign(target, attachments);
+					touched?.set(target.seq, Math.max(touched.get(target.seq) ?? target.seq, event.seq));
 				} else messages.push({
 					...base,
 					role: "tool",
@@ -2611,12 +2835,13 @@ const sessionRows = [
 			const invalid = requireSessionId(checked.value);
 			if (invalid) return invalid;
 			if (!isOptionalField(checked.value, "tailCount", (v) => isInteger(v, 1, 1e4))) return reject$1("E_PROTOCOL", "invalid tailCount");
+			if (!isOptionalField(checked.value, "sinceSeq", (v) => typeof v === "number" && Number.isFinite(v) && v >= 0)) return reject$1("E_PROTOCOL", "invalid sinceSeq");
 			return checked;
 		},
 		handle: async (ctx, payload) => {
 			const sessionId = payload.sessionId;
 			const buffered = ctx.bufferOpenEvents(sessionId);
-			if (!await ctx.bridge.openSession(ctx, sessionId, payload.tailCount ?? 100)) {
+			if (!await ctx.bridge.openSession(ctx, sessionId, payload.tailCount ?? 100, payload.sinceSeq)) {
 				ctx.discardOpenBuffer(sessionId, buffered);
 				return ctx.fail("E_NOT_FOUND", "session history unavailable");
 			}
@@ -2638,6 +2863,24 @@ const sessionRows = [
 			ctx.send("s2c.ack", {});
 		}
 	},
+	{
+		type: "c2s.session.watch",
+		stage: "authenticated",
+		scopes: READ,
+		capability: "sessionInterest",
+		doc: "PROTOCOL.md c2s.session.watch",
+		validate: (payload) => {
+			const checked = payloadObject(payload);
+			if (!checked.ok) return checked;
+			const ids = checked.value.sessionIds;
+			if (!Array.isArray(ids) || ids.length > 16 || !ids.every((id) => isText(id, 256))) return reject$1("E_PROTOCOL", `sessionIds must be an array of at most 16 session ids`);
+			return checked;
+		},
+		handle: (ctx, payload) => {
+			ctx.setWatchedSessions(parseWatchSessions(payload.sessionIds) ?? []);
+			ctx.send("s2c.ack", {});
+		}
+	},
 	{
 		type: "c2s.session.create",
 		stage: "authenticated",
@@ -3061,128 +3304,153 @@ const categories = [
 	"security-privacy-permission",
 	"other"
 ];
-const commandRows = [...[
-	"commands",
-	"permissions",
-	"feedback",
-	"command"
-].map((name) => ({
-	type: `c2s.session.${name}`,
-	stage: "authenticated",
-	capability: "commands",
-	scopes: name === "commands" || name === "permissions" ? ["sessions.read"] : ["prompt.send"],
-	doc: `PROTOCOL.md c2s.session.${name}`,
-	validate: (value) => {
-		const result = sessionPayload(value);
-		if (!result.ok) return result;
-		const p = result.value;
-		if (name === "command") {
-			if (typeof p.line !== "string" || p.line.length > 65536 || !/^\/[a-z][a-z0-9_-]*(?:\s|$)/.test(p.line)) return reject$1("E_PROTOCOL", "指令格式无效");
-			if (p.expectedDefinitionId !== void 0 && (typeof p.expectedDefinitionId !== "string" || !p.expectedDefinitionId || p.expectedDefinitionId.length > 512)) return reject$1("E_PROTOCOL", "指令定义标识无效");
-			const attachments = p.attachments ?? [];
-			if (!Array.isArray(attachments) || attachments.length > 4) return reject$1("E_PROTOCOL", "附件数量无效");
-			for (const item of attachments) if (!item || !["image", "document"].includes(item.type) || typeof item.name !== "string" || item.name.length > 512 || typeof item.mediaType !== "string" || typeof item.data !== "string" || item.data.length > 16777216 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(item.data) || item.type === "image" && ![
-				"image/png",
-				"image/jpeg",
-				"image/webp",
-				"image/gif"
-			].includes(item.mediaType)) return reject$1("E_PROTOCOL", "附件格式无效");
-			return {
-				ok: true,
-				value: {
-					...p,
-					attachments
-				}
-			};
+const commandRows = [
+	...[
+		"commands",
+		"permissions",
+		"feedback",
+		"command"
+	].map((name) => ({
+		type: `c2s.session.${name}`,
+		stage: "authenticated",
+		capability: "commands",
+		scopes: name === "commands" || name === "permissions" ? ["sessions.read"] : ["prompt.send"],
+		doc: `PROTOCOL.md c2s.session.${name}`,
+		validate: (value) => {
+			const result = sessionPayload(value);
+			if (!result.ok) return result;
+			const p = result.value;
+			if (name === "command") {
+				if (typeof p.line !== "string" || p.line.length > 65536 || !/^\/[a-z][a-z0-9_-]*(?:\s|$)/.test(p.line)) return reject$1("E_PROTOCOL", "指令格式无效");
+				if (p.expectedDefinitionId !== void 0 && (typeof p.expectedDefinitionId !== "string" || !p.expectedDefinitionId || p.expectedDefinitionId.length > 512)) return reject$1("E_PROTOCOL", "指令定义标识无效");
+				const attachments = p.attachments ?? [];
+				if (!Array.isArray(attachments) || attachments.length > 4) return reject$1("E_PROTOCOL", "附件数量无效");
+				for (const item of attachments) if (!item || !["image", "document"].includes(item.type) || typeof item.name !== "string" || item.name.length > 512 || typeof item.mediaType !== "string" || typeof item.data !== "string" || item.data.length > 16777216 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(item.data) || item.type === "image" && ![
+					"image/png",
+					"image/jpeg",
+					"image/webp",
+					"image/gif"
+				].includes(item.mediaType)) return reject$1("E_PROTOCOL", "附件格式无效");
+				return {
+					ok: true,
+					value: {
+						...p,
+						attachments
+					}
+				};
+			}
+			if (name === "feedback" && (typeof p.text !== "string" || p.text.length > 65536 || p.category !== void 0 && !categories.includes(String(p.category)))) return reject$1("E_PROTOCOL", "反馈内容无效");
+			return result;
+		},
+		handle: async (ctx, payload) => {
+			const operation = name === "commands" ? "list" : name === "command" ? "execute" : name;
+			const result = await ctx.bridge.commandOperation(operation, payload);
+			if (!result.ok) return ctx.fail(result.code, result.message);
+			const type = name === "commands" ? "s2c.session.commands" : name === "permissions" ? "s2c.session.permissions" : name === "command" ? "s2c.session.commandResult" : "s2c.ack";
+			ctx.send(type, {
+				sessionId: payload.sessionId,
+				...result.value
+			});
+		}
+	})),
+	{
+		type: "c2s.session.references",
+		stage: "authenticated",
+		scopes: ["sessions.read"],
+		capability: "references",
+		doc: "PROTOCOL.md c2s.session.references",
+		validate: (value) => {
+			const result = sessionPayload(value);
+			if (!result.ok) return result;
+			if (typeof result.value.query !== "string" || result.value.query.length > 1024 || /[\r\n]/.test(result.value.query)) return reject$1("E_PROTOCOL", "引用查询无效");
+			return result;
+		},
+		handle: async (ctx, payload) => {
+			const result = await ctx.bridge.referenceCandidates(payload.sessionId, payload.query, ctx.signal);
+			if (!result.ok) return ctx.fail(result.code, result.message);
+			ctx.send("s2c.session.references", {
+				sessionId: payload.sessionId,
+				query: payload.query,
+				...result.value
+			});
 		}
-		if (name === "feedback" && (typeof p.text !== "string" || p.text.length > 65536 || p.category !== void 0 && !categories.includes(String(p.category)))) return reject$1("E_PROTOCOL", "反馈内容无效");
-		return result;
-	},
-	handle: async (ctx, payload) => {
-		const operation = name === "commands" ? "list" : name === "command" ? "execute" : name;
-		const result = await ctx.bridge.commandOperation(operation, payload);
-		if (!result.ok) return ctx.fail(result.code, result.message);
-		const type = name === "commands" ? "s2c.session.commands" : name === "permissions" ? "s2c.session.permissions" : name === "command" ? "s2c.session.commandResult" : "s2c.ack";
-		ctx.send(type, {
-			sessionId: payload.sessionId,
-			...result.value
-		});
-	}
-})), {
-	type: "c2s.session.export",
-	stage: "authenticated",
-	scopes: ["sessions.read"],
-	capability: "commands",
-	conditionalCapabilities: ["sessionMarkdown"],
-	doc: "PROTOCOL.md c2s.session.export",
-	validate: (value) => {
-		const result = sessionPayload(value);
-		if (!result.ok) return result;
-		if (result.value.format !== void 0 && result.value.format !== "zip" && result.value.format !== "markdown") return reject$1("E_PROTOCOL", "导出格式无效");
-		if (result.value.binary !== void 0 && typeof result.value.binary !== "boolean") return reject$1("E_PROTOCOL", "传输方式无效");
-		return result;
 	},
-	handle: async (ctx, payload) => {
-		const format = payload.format;
-		if (format === "markdown" && ctx.bridge.capabilities.sessionMarkdown !== true) return ctx.fail("E_UNSUPPORTED", "当前主机不支持导出对话正文");
-		const signal = AbortSignal.any([ctx.signal ?? new AbortController().signal, AbortSignal.timeout(6e5)]);
-		let reader;
-		const cancel = () => {
-			reader?.cancel().catch(() => {});
-		};
-		try {
-			reader = (format === void 0 ? await ctx.bridge.exportSession(payload.sessionId, signal) : await ctx.bridge.exportSession(payload.sessionId, signal, format)).body.getReader();
-			signal.addEventListener("abort", cancel, { once: true });
-			const binary = payload.binary === true && ctx.sendBinary !== void 0;
-			let index = 0, bytes = 0;
-			const sendChunk = async (chunk) => {
-				bytes += chunk.length;
-				await ctx.waitForWritable?.();
-				if (binary) ctx.sendBinary("s2c.session.export.chunk", { index: index++ }, chunk);
-				else ctx.send("s2c.session.export.chunk", {
-					index: index++,
-					data: Buffer.from(chunk).toString("base64")
-				});
+	{
+		type: "c2s.session.export",
+		stage: "authenticated",
+		scopes: ["sessions.read"],
+		capability: "commands",
+		conditionalCapabilities: ["sessionMarkdown"],
+		doc: "PROTOCOL.md c2s.session.export",
+		validate: (value) => {
+			const result = sessionPayload(value);
+			if (!result.ok) return result;
+			if (result.value.format !== void 0 && result.value.format !== "zip" && result.value.format !== "markdown") return reject$1("E_PROTOCOL", "导出格式无效");
+			if (result.value.binary !== void 0 && typeof result.value.binary !== "boolean") return reject$1("E_PROTOCOL", "传输方式无效");
+			return result;
+		},
+		handle: async (ctx, payload) => {
+			const format = payload.format;
+			if (format === "markdown" && ctx.bridge.capabilities.sessionMarkdown !== true) return ctx.fail("E_UNSUPPORTED", "当前主机不支持导出对话正文");
+			const signal = AbortSignal.any([ctx.signal ?? new AbortController().signal, AbortSignal.timeout(6e5)]);
+			let reader;
+			const cancel = () => {
+				reader?.cancel().catch(() => {});
 			};
-			let carry;
-			while (true) {
-				signal.throwIfAborted();
-				const next = await reader.read();
-				if (next.done) break;
-				if (!binary) {
-					for (let offset = 0; offset < next.value.length; offset += 49152) await sendChunk(next.value.subarray(offset, offset + 49152));
-					continue;
-				}
-				carry = carry ? Buffer.concat([carry, next.value]) : Buffer.from(next.value);
-				while (carry.length >= BINARY_CHUNK_BYTES) {
-					await sendChunk(carry.subarray(0, BINARY_CHUNK_BYTES));
-					carry = carry.subarray(BINARY_CHUNK_BYTES);
+			try {
+				reader = (format === void 0 ? await ctx.bridge.exportSession(payload.sessionId, signal) : await ctx.bridge.exportSession(payload.sessionId, signal, format)).body.getReader();
+				signal.addEventListener("abort", cancel, { once: true });
+				const binary = payload.binary === true && ctx.sendBinary !== void 0;
+				let index = 0, bytes = 0;
+				const sendChunk = async (chunk) => {
+					bytes += chunk.length;
+					await ctx.waitForWritable?.();
+					if (binary) ctx.sendBinary("s2c.session.export.chunk", { index: index++ }, chunk);
+					else ctx.send("s2c.session.export.chunk", {
+						index: index++,
+						data: Buffer.from(chunk).toString("base64")
+					});
+				};
+				let carry;
+				while (true) {
+					signal.throwIfAborted();
+					const next = await reader.read();
+					if (next.done) break;
+					if (!binary) {
+						for (let offset = 0; offset < next.value.length; offset += 49152) await sendChunk(next.value.subarray(offset, offset + 49152));
+						continue;
+					}
+					carry = carry ? Buffer.concat([carry, next.value]) : Buffer.from(next.value);
+					while (carry.length >= BINARY_CHUNK_BYTES) {
+						await sendChunk(carry.subarray(0, BINARY_CHUNK_BYTES));
+						carry = carry.subarray(BINARY_CHUNK_BYTES);
+					}
 				}
+				signal.throwIfAborted();
+				if (carry !== void 0 && carry.length > 0) await sendChunk(carry);
+				ctx.send("s2c.ack", {
+					sessionId: payload.sessionId,
+					fileName: format === "markdown" ? "dsh-session.md" : "dsh-session-log.zip",
+					chunks: index,
+					bytes,
+					...format === void 0 ? {} : { mediaType: format === "markdown" ? "text/markdown; charset=utf-8" : "application/zip" }
+				});
+			} catch (error) {
+				const failure = hostFailureOf(error, "command/export-cancelled");
+				const message = failure.code === "command/export-cancelled" ? "会话日志导出失败，请重试" : failure.message;
+				const mapped = wireErrorOf("command", {
+					...failure,
+					message
+				});
+				ctx.fail(mapped.code, mapped.message);
+			} finally {
+				signal.removeEventListener("abort", cancel);
+				await reader?.cancel().catch(() => {});
+				reader?.releaseLock();
 			}
-			signal.throwIfAborted();
-			if (carry !== void 0 && carry.length > 0) await sendChunk(carry);
-			ctx.send("s2c.ack", {
-				sessionId: payload.sessionId,
-				fileName: format === "markdown" ? "dsh-session.md" : "dsh-session-log.zip",
-				chunks: index,
-				bytes,
-				...format === void 0 ? {} : { mediaType: format === "markdown" ? "text/markdown; charset=utf-8" : "application/zip" }
-			});
-		} catch (error) {
-			const failure = hostFailureOf(error, "command/export-cancelled");
-			const message = failure.code === "command/export-cancelled" ? "会话日志导出失败，请重试" : failure.message;
-			const mapped = wireErrorOf("command", {
-				...failure,
-				message
-			});
-			ctx.fail(mapped.code, mapped.message);
-		} finally {
-			signal.removeEventListener("abort", cancel);
-			await reader?.cancel().catch(() => {});
-			reader?.releaseLock();
 		}
 	}
-}];
+];
 // src/plugin-update.ts
 const PACKAGE = "dsh-deeppilot";
 const PHASES = [
@@ -3588,9 +3856,8 @@ var PluginUpdater = class {
 				record.restartPhase = "rolled-back";
 				return this.transition(record, "restart-required", "目标安装失败，旧版已重新安装；请在电脑端重启 DSH 后确认恢复");
 			}
-			if (restored.application === "applied" && (restored.version === void 0 || restored.version === record.fromVersion)) {
+			if (restored.version === void 0 || restored.version === record.fromVersion) {
 				if ((await this.listBundles()).find((bundle) => bundle.name === PACKAGE)?.version === record.fromVersion) return this.transition(record, "rolled-back", "目标安装失败，宿主已自动恢复旧版本");
-				return this.transition(record, "failed", "宿主已尝试回滚，但无法核对实际旧版本，请在电脑端检查插件");
 			}
 			return this.transition(record, "failed", "目标安装失败，宿主恢复旧版也未完成，请在电脑端检查插件");
 		}
@@ -4076,6 +4343,8 @@ var ConnectionGate = class {
 			scopes: this.scopes,
 			widgetClient: this.widgetClient,
 			resumeCursor: this.widgetClient ? void 0 : resumeCursor,
+			watchSessions: this.widgetClient ? void 0 : parseWatchSessions(p.watchSessions),
+			acceptsDeflate: Array.isArray(p.acceptEncoding) && p.acceptEncoding.includes("deflate-raw"),
 			deviceName,
 			appVersion
 		});
@@ -4130,6 +4399,7 @@ var ConnectionGate = class {
 			fail: (code, message) => host.fail(env.id, code, message),
 			close: (code, reason) => host.close(code, reason),
 			canReceive: (scope) => host.canReceive(scope),
+			accepts: (type, payload) => host.accepts(type, payload),
 			push: (type, payload, seq) => host.push(type, payload, seq),
 			lastCursor: () => host.lastCursor(),
 			replay: (entries) => host.replay(entries),
@@ -4139,6 +4409,7 @@ var ConnectionGate = class {
 			discardOpenBuffer: (sessionId, buffer) => host.discardOpenBuffer(sessionId, buffer),
 			flushOpenBuffer: (sessionId, buffer) => host.flushOpenBuffer(sessionId, buffer),
 			closeOpenSession: (sessionId) => host.closeOpenSession(sessionId),
+			setWatchedSessions: (sessionIds) => host.setWatchedSessions(sessionIds),
 			nextLiveActivityGeneration: () => host.nextLiveActivityGeneration(),
 			get liveActivityGeneration() {
 				return host.liveActivityGeneration;
@@ -4175,6 +4446,14 @@ var BridgeConnection = class {
 	*/
 	openingSessionEvents = /* @__PURE__ */ new Map();
 	openSessions = /* @__PURE__ */ new Set();
+	/**
+	* 关注集合（能力 `sessionInterest`）：客户端本机有缓存、需要保持最新的会话。
+	* undefined = 旧客户端从未声明，照旧收全部会话事件。来源：auth.prove 的
+	* `watchSessions`（须在重放前生效）与之后的 c2s.session.watch（整体替换）。
+	*/
+	watchedSessions;
+	/** 客户端认证时声明接受 deflate-raw（能力 `compressedFrames`）；认证前一律文本帧。 */
+	compressDownlink = false;
 	liveActivityRegistrationGeneration = 0;
 	pendingLiveActivityId;
 	lastActivity = Date.now();
@@ -4230,6 +4509,8 @@ var BridgeConnection = class {
 			fail: (id, code, message) => connection.fail(id, code, message),
 			close: (code, reason) => connection.close(code, reason),
 			canReceive: (scope) => connection.canReceive(scope),
+			accepts: (type, payload) => connection.accepts(type, payload),
+			setWatchedSessions: (sessionIds) => connection.setWatchedSessions(sessionIds),
 			push: (type, payload, seq) => connection.push(type, payload, seq),
 			lastCursor: () => connection.lastCursor(),
 			replay: (entries) => connection.replay(entries),
@@ -4315,7 +4596,23 @@ var BridgeConnection = class {
 	canReceive(scope) {
 		return this.identity?.scopes.has(scope) ?? false;
 	}
+	/**
+	* 关注过滤：只管按会话投递的两类帧。正在打开（tail 未发出、事件进缓冲）、
+	* 已打开或在关注集合里的会话放行；未声明关注集合的连接全部放行。
+	*/
+	accepts(type, payload) {
+		if (this.watchedSessions === void 0) return true;
+		if (type !== "s2c.session.event" && type !== "s2c.session.queue") return true;
+		const sessionId = payload?.sessionId;
+		if (typeof sessionId !== "string") return true;
+		return this.openSessions.has(sessionId) || this.openingSessionEvents.has(sessionId) || this.watchedSessions.has(sessionId);
+	}
+	/** c2s.session.watch：整体替换关注集合；也让从未声明的连接切到按关注投递。 */
+	setWatchedSessions(sessionIds) {
+		this.watchedSessions = new Set(sessionIds);
+	}
 	push(type, payload, seq) {
+		if (!this.accepts(type, payload)) return;
 		if (type === "s2c.notify") payload = {
 			...payload,
 			hostAudience: this.deps.audience
@@ -4352,8 +4649,11 @@ var BridgeConnection = class {
 	/** 认证成功：门只做安全判定，欢迎与重放归连接（数据面）。 */
 	onAuthenticated(identity) {
 		this.identity = identity;
+		if (identity.watchSessions !== void 0) this.watchedSessions = new Set(identity.watchSessions);
+		this.compressDownlink = identity.acceptsDeflate;
 		const cursor = identity.resumeCursor;
 		const canResume = cursor !== void 0 && this.deps.bridge.canResumeFrom(cursor);
+		const routes = identity.widgetClient ? void 0 : this.deps.routes?.();
 		this.send("s2c.welcome", {
 			protocolVersion: 2,
 			serverVersion: this.deps.serverVersion,
@@ -4361,7 +4661,8 @@ var BridgeConnection = class {
 			scopes: [...identity.scopes],
 			capabilities: this.deps.bridge.capabilities,
 			cursor: this.deps.bridge.currentCursor(),
-			resumed: canResume
+			resumed: canResume,
+			...routes !== void 0 ? { routes } : {}
 		});
 		if (!identity.widgetClient) this.deps.bridge.addSink(this);
 		if (cursor !== void 0) {
@@ -4411,7 +4712,16 @@ var BridgeConnection = class {
 			this.close(1013, "client too slow");
 			return;
 		}
-		this.ws.send(body === void 0 ? JSON.stringify(envelope) : encodeBinaryFrame(envelope, body));
+		if (body !== void 0) {
+			this.ws.send(encodeBinaryFrame(envelope, body));
+			return;
+		}
+		const json = JSON.stringify(envelope);
+		if (this.compressDownlink && Buffer.byteLength(json) > 8192) {
+			this.ws.send(encodeCompressedFrame(json));
+			return;
+		}
+		this.ws.send(json);
 	}
 	fail(id, code, message) {
 		this.send("s2c.error", {
@@ -5495,7 +5805,9 @@ function pushContent(notification, mode) {
 * Relay connectivity self-test used by the settings page "测试中继" button.
 *
 * Two steps mirror what zero-touch enrollment actually does:
-*   1. health  — GET {url}/healthz        → is the relay reachable?
+*   1. health  — GET {url}/healthz        → is the relay reachable? The
+*      relay's `version` (relay 0.2.0+) is appended to the message for
+*      troubleshooting; it never affects the verdict.
 *   2. enroll  — POST {url}/v1/enroll     → does the shared key grant a token?
 *
 * The enroll step doubles as a repair path: a token it issues is handed back
@@ -5505,6 +5817,16 @@ function pushContent(notification, mode) {
 * Transport is injectable (`fetchImpl`) so tests never touch the network.
 */
 const DEFAULT_TIMEOUT_MS = 6e3;
+/**
+* semver-shaped characters only, bounded: the value comes from a remote
+* server and is rendered verbatim in the settings page.
+*/
+const RELAY_VERSION_PATTERN = /^[0-9A-Za-z.+-]{1,32}$/;
+/** Display-only relay version from a /healthz body; undefined for older relays or unsafe values. */
+function relayVersionOf(body) {
+	const version = body?.version;
+	return typeof version === "string" && RELAY_VERSION_PATTERN.test(version) ? version : void 0;
+}
 async function requestJson(fetchImpl, url, init, timeoutMs) {
 	const response = await fetchImpl(url, {
 		...init,
@@ -5529,13 +5851,16 @@ async function runRelayProbe(options) {
 		const startedAt = Date.now();
 		const { status, body } = await requestJson(fetchImpl, `${base}/healthz`, { method: "GET" }, timeoutMs);
 		const latencyMs = Date.now() - startedAt;
-		if (status === 200 && body?.ok === true) steps.push({
-			id: "health",
-			ok: true,
-			message: "中继服务可达",
-			latencyMs
-		});
-		else steps.push({
+		if (status === 200 && body?.ok === true) {
+			const version = relayVersionOf(body);
+			const message = version ? `中继服务可达（版本 ${version}）` : "中继服务可达";
+			steps.push({
+				id: "health",
+				ok: true,
+				message,
+				latencyMs
+			});
+		} else steps.push({
 			id: "health",
 			ok: false,
 			message: `中继响应异常（HTTP ${status}）`,
@@ -6279,7 +6604,7 @@ var TransportReconciler = class {
 function createLocalTransport(deps) {
 	return new TransportReconciler({
 		keyOf: (config) => ({
-			enabled: config.enabled === true && config.local?.enabled !== false,
+			enabled: config.enabled === true,
 			port: normalizeLocalPort(config.local?.port)
 		}),
 		skipWhenDisabled: true,
@@ -6347,7 +6672,7 @@ function createLocalTransport(deps) {
 			};
 		}
 	}, deps.config, deps.log, {
-		phase: deps.config().enabled === true && deps.config().local?.enabled !== false ? "starting" : "disabled",
+		phase: deps.config().enabled === true ? "starting" : "disabled",
 		port: normalizeLocalPort(deps.config().local?.port),
 		endpoints: [],
 		updatedAt: Date.now()
@@ -7146,6 +7471,7 @@ const HOST_CAPABILITY_PROBES = {
 	models: (proxy) => typeof proxy.sessions.models === "function",
 	skills: (proxy) => typeof proxy.sessions.skills === "function",
 	commands: (proxy) => typeof proxy.commands?.list === "function" && typeof proxy.commands?.execute === "function",
+	references: (proxy) => typeof proxy.references?.list === "function",
 	sessionManagement: (proxy) => typeof proxy.sessions.rename === "function" && typeof proxy.workspace?.archiveSession === "function",
 	sessionFork: (proxy) => typeof proxy.sessions.fork === "function",
 	sessionRestore: (proxy) => typeof proxy.workspace?.unarchiveSession === "function",
@@ -7166,6 +7492,10 @@ function capabilityBits(proxy, pushOutlet) {
 		historyPaging: true,
 		replay: true,
 		binaryFrames: true,
+		sessionInterest: true,
+		compressedFrames: true,
+		incrementalTail: true,
+		routeHints: true,
 		approvals: true,
 		questions: true,
 		pendingSnapshot: true,
@@ -7174,6 +7504,7 @@ function capabilityBits(proxy, pushOutlet) {
 		models: HOST_CAPABILITY_PROBES.models(proxy),
 		skills: HOST_CAPABILITY_PROBES.skills(proxy),
 		commands: HOST_CAPABILITY_PROBES.commands(proxy),
+		references: HOST_CAPABILITY_PROBES.references(proxy),
 		sessionManagement: HOST_CAPABILITY_PROBES.sessionManagement(proxy),
 		sessionFork: HOST_CAPABILITY_PROBES.sessionFork(proxy),
 		sessionRestore: HOST_CAPABILITY_PROBES.sessionRestore(proxy),
@@ -7441,8 +7772,75 @@ var AssistantStream = class {
 		this.attempts.clear();
 	}
 };
+// src/image-ref-index.ts
+/** 缓存条目上限：引用只有几十字节，4096 条足够覆盖手机近期能看到的图片。 */
+const MAX_CACHED_IMAGE_REFS = 4096;
+var ImageRefIndex = class {
+	maxEntries;
+	/** 键为 `sessionId\0attachmentId`；Map 的插入顺序即 LRU 顺序。 */
+	refs = /* @__PURE__ */ new Map();
+	/** 同一会话的并发回查共用一次扫描（冷启动时多张缩略图会同时请求）。 */
+	scans = /* @__PURE__ */ new Map();
+	constructor(maxEntries = MAX_CACHED_IMAGE_REFS) {
+		this.maxEntries = maxEntries;
+	}
+	/** 记下一批事件里的图片引用；对非图片事件是空操作。 */
+	remember(sessionId, events) {
+		for (const event of events) for (const ref of eventImageRefs(event)) this.put(sessionId, ref);
+	}
+	/** 只查缓存，不触发扫描。 */
+	peek(sessionId, attachmentId) {
+		const key = keyOf(sessionId, attachmentId);
+		const ref = this.refs.get(key);
+		if (ref) {
+			this.refs.delete(key);
+			this.refs.set(key, ref);
+		}
+		return ref;
+	}
+	/** 缓存优先；未命中时扫描会话历史后再查一次。找不到返回 undefined。 */
+	async resolve(sessionId, attachmentId, readPage) {
+		const cached = this.peek(sessionId, attachmentId);
+		if (cached) return cached;
+		let scan = this.scans.get(sessionId);
+		if (!scan) {
+			scan = this.scan(sessionId, readPage).finally(() => this.scans.delete(sessionId));
+			this.scans.set(sessionId, scan);
+		}
+		await scan;
+		return this.peek(sessionId, attachmentId);
+	}
+	async scan(sessionId, readPage) {
+		let beforeSeq;
+		for (let page = 0; page < 20; page++) {
+			const result = await readPage(sessionId, beforeSeq);
+			if (!result || result.events.length === 0) return;
+			this.remember(sessionId, result.events);
+			const oldest = Math.min(...result.events.map((event) => event.seq));
+			if (!result.hasMore || !Number.isFinite(oldest) || beforeSeq !== void 0 && oldest >= beforeSeq) return;
+			beforeSeq = oldest;
+		}
+	}
+	put(sessionId, ref) {
+		const key = keyOf(sessionId, ref.attachmentId);
+		this.refs.delete(key);
+		this.refs.set(key, ref);
+		while (this.refs.size > this.maxEntries) {
+			const oldest = this.refs.keys().next().value;
+			if (oldest === void 0) break;
+			this.refs.delete(oldest);
+		}
+	}
+};
+function keyOf(sessionId, attachmentId) {
+	return `${sessionId}\u0000${attachmentId}`;
+}
 // src/host-bridge.ts
 const MAX_RING_DEFAULT = 2e3;
+/** 补发量超过它就改发 s2c.resync（经 Funnel 实测吞吐 40～80 KB/s，约 6～12 秒）。 */
+const REPLAY_RESYNC_BYTES = 524288;
+/** 只改了用量统计的列表推送，同一会话这段时间内最多推一次（第二批 P5）。 */
+const SUMMARY_STATS_THROTTLE_MS = 5e3;
 /**
 * Process-wide bridge state: session mirror, pending approvals/questions,
 * and the per-device replay ring. Consumes the in-process mux/host streams
@@ -7455,6 +7853,13 @@ var HostBridge = class {
 	log;
 	id = ++BRIDGE_SEQ;
 	summaries = /* @__PURE__ */ new Map();
+	/**
+	* 列表推送节流（连接传输第二批 P5）。每个会话最近一次推出去的摘要指纹，
+	* 用来丢掉内容完全相同的重复推送；只改了 `stats` 的变化按 SUMMARY_STATS_THROTTLE_MS
+	* 合并，状态、标题、任务清单、待处理标记、活动描述的变化照旧立即推。
+	*/
+	summaryPushed = /* @__PURE__ */ new Map();
+	summaryStatsTimers = /* @__PURE__ */ new Map();
 	activeTools = /* @__PURE__ */ new Map();
 	approvals = /* @__PURE__ */ new Map();
 	questions = /* @__PURE__ */ new Map();
@@ -7478,6 +7883,8 @@ var HostBridge = class {
 	abort = new AbortController();
 	started = false;
 	disposed = false;
+	/** attachmentId → 宿主完整图片引用，供 attachmentData 补全 DSH 0.2.2+ 的读图参数。 */
+	imageRefs = new ImageRefIndex();
 	promptDeliveries;
 	scheduleMutations;
 	forkMutations;
@@ -7647,16 +8054,35 @@ var HostBridge = class {
 	* reader without interactions.respond never gets the missed approval
 	* frames back (R1/P2).
 	*/
+	/**
+	* 按序补发游标之后的帧。先按权限与关注集合筛出该 sink 真正会收到的帧，
+	* 估算字节数超过 REPLAY_RESYNC_BYTES 时改发 `s2c.resync`：补发是同步一次性
+	* 写出的，经 Funnel 时插件这侧看不到积压，大补发会把之后所有请求响应堵在
+	* 链路上（实测 450 帧堵 37 秒）。重新同步让客户端只拉列表和正在看的会话。
+	*/
 	resumeFrom(cursor, target) {
 		const oldest = this.ring.length > 0 ? this.ring[0].seq : this.cursor + 1;
 		if (cursor + 1 < oldest) return false;
 		const receivers = target !== void 0 ? [target] : [...this.sinks];
-		for (const entry of this.ring) if (entry.seq > cursor) for (const sink of receivers) {
-			const need = pushScopeFor(entry.type, entry.payload);
-			if (need === void 0 || !sink.canReceive(need)) continue;
-			sink.replay([entry]);
+		for (const sink of receivers) {
+			const window = [];
+			let bytes = 0;
+			for (const entry of this.ring) {
+				if (entry.seq <= cursor) continue;
+				const need = pushScopeFor(entry.type, entry.payload);
+				if (need === void 0 || !sink.canReceive(need)) continue;
+				if (sink.accepts && !sink.accepts(entry.type, entry.payload)) continue;
+				window.push(entry);
+				bytes += Buffer.byteLength(JSON.stringify(entry.payload) ?? "");
+			}
+			if (bytes > 524288) {
+				this.log?.(`resume window ${bytes}B over ${REPLAY_RESYNC_BYTES}B; sending resync`);
+				sink.resync();
+				continue;
+			}
+			for (const entry of window) sink.replay([entry]);
+			sink.replayDone();
 		}
-		for (const sink of receivers) sink.replayDone();
 		return true;
 	}
 	refreshLiveActivities() {
@@ -7745,6 +8171,8 @@ var HostBridge = class {
 		if (this.disposed) return;
 		this.disposed = true;
 		this.abort.abort();
+		for (const timer of this.summaryStatsTimers.values()) clearTimeout(timer);
+		this.summaryStatsTimers.clear();
 		this.assistantStream.dispose();
 		this.sinks.clear();
 		this.sinkSessions.clear();
@@ -7833,6 +8261,7 @@ var HostBridge = class {
 				this.noteActivity(sessionId, event);
 				if (event.type === "user/message") this.quietCompletion.noteUserMessage(sessionId, userMessageSourceKind(event.data), event.seq);
 				this.captureAssistantText(sessionId, event);
+				this.imageRefs.remember(sessionId, [event]);
 				const projection = projectEvent(sessionId, event);
 				this.captureActivity(sessionId, event, projection?.data.tool);
 				if (projection) this.record("s2c.session.event", {
@@ -7856,6 +8285,7 @@ var HostBridge = class {
 				const p = frame;
 				if (!p.sessionId) break;
 				if (p.key === "workingDirectory" || p.key === "agentPreset") this.record("s2c.skills.changed", { sessionId: p.sessionId });
+				if (p.key === "permissions") this.record("s2c.commands.changed", { sessionId: p.sessionId });
 				if (p.key === "modelSelection") {
 					const next = p.value?.next;
 					const current = next && typeof next.provider === "string" && typeof next.model === "string" ? {
@@ -7999,6 +8429,8 @@ var HostBridge = class {
 			this.archivedSummaries = nextArchived;
 			const removedIds = [...previousIds].filter((id) => !next.has(id));
 			for (const id of this.lastAssistantText.keys()) if (!next.has(id)) this.lastAssistantText.delete(id);
+			for (const id of removedIds) this.forgetSummaryPush(id);
+			for (const row of next.values()) this.noteSummaryPushed(row);
 			this.record("s2c.sessions.delta", {
 				upserted: [...next.values()],
 				removedIds
@@ -8118,11 +8550,62 @@ var HostBridge = class {
 		this.pushSummary(row);
 	}
 	pushSummary(row) {
+		const full = JSON.stringify(row);
+		const previous = this.summaryPushed.get(row.id);
+		if (previous?.full === full) return;
+		const withoutStats = JSON.stringify({
+			...row,
+			stats: void 0
+		});
+		const now = Date.now();
+		if (previous !== void 0 && previous.withoutStats === withoutStats && now - previous.at < 5e3) {
+			if (!this.summaryStatsTimers.has(row.id)) {
+				const timer = setTimeout(() => {
+					this.summaryStatsTimers.delete(row.id);
+					const latest = this.summaries.get(row.id);
+					if (latest && !this.disposed) this.pushSummary(latest);
+				}, SUMMARY_STATS_THROTTLE_MS - (now - previous.at));
+				timer.unref?.();
+				this.summaryStatsTimers.set(row.id, timer);
+			}
+			return;
+		}
+		const pending = this.summaryStatsTimers.get(row.id);
+		if (pending !== void 0) {
+			clearTimeout(pending);
+			this.summaryStatsTimers.delete(row.id);
+		}
+		this.summaryPushed.set(row.id, {
+			full,
+			withoutStats,
+			at: now
+		});
 		this.record("s2c.sessions.delta", {
 			upserted: [row],
 			removedIds: []
 		});
 	}
+	noteSummaryPushed(row) {
+		const pending = this.summaryStatsTimers.get(row.id);
+		if (pending !== void 0) {
+			clearTimeout(pending);
+			this.summaryStatsTimers.delete(row.id);
+		}
+		this.summaryPushed.set(row.id, {
+			full: JSON.stringify(row),
+			withoutStats: JSON.stringify({
+				...row,
+				stats: void 0
+			}),
+			at: Date.now()
+		});
+	}
+	forgetSummaryPush(sessionId) {
+		const pending = this.summaryStatsTimers.get(sessionId);
+		if (pending !== void 0) clearTimeout(pending);
+		this.summaryStatsTimers.delete(sessionId);
+		this.summaryPushed.delete(sessionId);
+	}
 	listSessions() {
 		return [...this.summaries.values()].sort((a, b) => b.lastActivityTs - a.lastActivityTs);
 	}
@@ -8186,7 +8669,7 @@ var HostBridge = class {
 		} catch {}
 	}
 	/** Tail history for an opened session; pushes s2c.session.tail to the sink. */
-	async openSession(sink, sessionId, tailCount) {
+	async openSession(sink, sessionId, tailCount, sinceSeq) {
 		try {
 			const response = await this.apiProxy.sessions.history({
 				rpcId: randomUUID(),
@@ -8197,14 +8680,27 @@ var HostBridge = class {
 			});
 			if (!response.result || !response.result.ok) return false;
 			const result = response.result.value;
-			const page = limitSessionPageMessages(projectHistory(result.events ?? []));
+			const events = result.events ?? [];
+			this.imageRefs.remember(sessionId, events.map((row) => row.event));
+			const touched = /* @__PURE__ */ new Map();
+			const projected = projectHistory(events, touched);
+			const page = limitSessionPageMessages(projected);
 			const messages = page.messages;
 			const oldestSeq = messages.length > 0 ? messages[0].seq : 0;
-			sink.push("s2c.session.tail", {
+			const hasMore = Boolean(result.hasMore) || page.dropped > 0;
+			const delta = sinceSeq === void 0 ? void 0 : incrementalTail(events, projected, touched, sinceSeq);
+			sink.push("s2c.session.tail", delta === void 0 ? {
 				sessionId,
 				messages,
 				oldestSeq,
-				hasMore: Boolean(result.hasMore) || page.dropped > 0
+				hasMore
+			} : {
+				sessionId,
+				messages: delta,
+				oldestSeq,
+				hasMore,
+				incremental: true,
+				sinceSeq
 			});
 			this.deriveTitleFallback(sessionId, messages);
 			this.refreshProjections(sessionId).then(() => this.pushQueueSnapshot(sink, sessionId));
@@ -8257,6 +8753,7 @@ var HostBridge = class {
 			});
 			if (!response.result || !response.result.ok) return null;
 			const result = response.result.value;
+			this.imageRefs.remember(sessionId, (result.events ?? []).map((row) => row.event));
 			const page = limitSessionPageMessages(projectHistory(result.events ?? []).filter((message) => message.seq < beforeSeq));
 			return {
 				sessionId,
@@ -8267,16 +8764,27 @@ var HostBridge = class {
 			return null;
 		}
 	}
-	/** Result of one attachment read-back for the phone. */
+	/**
+	* Result of one attachment read-back for the phone.
+	*
+	* 宿主读图参数有两代：DSH ≤ 0.2.1 收 `{sessionId, attachmentId}` 并自己在会话日志里
+	* 找引用；DSH 0.2.2 起改收 `{sessionId, attachment: 完整引用}`，且不再核对会话。
+	* 控制器是直接注入的实例、不经参数 schema 校验，所以两代字段一起传：旧宿主读前者，
+	* 新宿主读后者。完整引用来自 imageRefs（本会话投影过的图片）；找不到时不带
+	* `attachment`，旧宿主照常自查，新宿主读不到即回 null（E_NOT_FOUND）——手机因此
+	* 读不到不属于该会话的图片。
+	*/
 	async attachmentData(sessionId, attachmentId) {
 		const read = this.apiProxy.sessions.attachment;
 		if (typeof read !== "function") return null;
 		try {
+			const ref = await this.imageRefs.resolve(sessionId, attachmentId, (id, beforeSeq) => this.readHistoryEvents(id, beforeSeq));
 			const response = await read.call(this.apiProxy.sessions, {
 				rpcId: randomUUID(),
 				payload: {
 					sessionId,
-					attachmentId
+					attachmentId,
+					...ref ? { attachment: ref } : {}
 				}
 			});
 			if (!response.result || !response.result.ok) return null;
@@ -8290,6 +8798,27 @@ var HostBridge = class {
 			return null;
 		}
 	}
+	/** 图片引用回查用的原始历史页：只取事件，不投影、不推给手机。 */
+	async readHistoryEvents(sessionId, beforeSeq) {
+		try {
+			const response = await this.apiProxy.sessions.history({
+				rpcId: randomUUID(),
+				payload: {
+					sessionId,
+					...beforeSeq === void 0 ? {} : { beforeSeq },
+					maxMessages: 500
+				}
+			});
+			if (!response.result || !response.result.ok) return null;
+			const result = response.result.value;
+			return {
+				events: (result.events ?? []).map((row) => row.event),
+				hasMore: Boolean(result.hasMore)
+			};
+		} catch {
+			return null;
+		}
+	}
 	async commandOperation(operation, payload) {
 		const api = this.apiProxy.commands;
 		if (!api) return {
@@ -8311,6 +8840,42 @@ var HostBridge = class {
 			return wireErrorOf("command", hostFailureOf(error, "command/invalid-response"));
 		}
 	}
+	/**
+	* 输入框 `@` 引用候选。两类候选的单类失败已在 reference-api 内吸收为空列表，
+	* 这里只处理「两类都不可用」与代理层意外异常。
+	*/
+	async referenceCandidates(sessionId, query, signal) {
+		const api = this.apiProxy.references;
+		if (!api) return {
+			ok: false,
+			code: "E_UNSUPPORTED",
+			message: "当前主机不支持引用文件或会话"
+		};
+		try {
+			const response = await api.list({
+				rpcId: randomUUID(),
+				payload: {
+					sessionId,
+					query
+				}
+			}, signal);
+			if (response.result?.ok && response.result.value) return {
+				ok: true,
+				value: response.result.value
+			};
+			return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "无法读取引用候选"
+			};
+		} catch {
+			return {
+				ok: false,
+				code: "E_INTERNAL",
+				message: "无法读取引用候选"
+			};
+		}
+	}
 	async exportSession(sessionId, signal, format) {
 		const api = this.apiProxy.commands;
 		if (!api) throw Object.assign(/* @__PURE__ */ new Error("当前主机不支持日志导出"), { code: "command/export-unsupported" });
@@ -8487,6 +9052,7 @@ var HostBridge = class {
 			this.archivedSessionIds = new Set((response.result.value.archivedSessionIds ?? []).map(String));
 			this.summaries.delete(sessionId);
 			this.lastAssistantText.delete(sessionId);
+			this.forgetSummaryPush(sessionId);
 			this.record("s2c.sessions.delta", {
 				upserted: [],
 				removedIds: [sessionId]
@@ -9769,6 +10335,25 @@ function receiptFailureReason(receipt) {
 * 区间与 wire 行校验（tailCount 1..10000、limit 1..500）共用投影 module 的
 * 常量——「一页能要多少条消息」本是一条规则，原先散在三处。
 */
+/**
+* 增量 tail（能力 `incrementalTail`）：返回 sinceSeq 之后改动过的行；不能保证完整时
+* 返回 undefined，调用方回退全量。三种回退：
+* - 窗口没覆盖到 sinceSeq（最旧事件比它新）：中间可能有事件没取到；
+* - sinceSeq 比窗口里最新事件还新：客户端的视图和主机对不上（例如历史被改写）；
+* - 增量本身超过单页 900 KB 预算。
+*/
+function incrementalTail(events, projected, touched, sinceSeq) {
+	if (events.length === 0) return void 0;
+	let oldest = Infinity;
+	let newest = -Infinity;
+	for (const { event } of events) {
+		if (event.seq < oldest) oldest = event.seq;
+		if (event.seq > newest) newest = event.seq;
+	}
+	if (oldest > sinceSeq || sinceSeq > newest) return void 0;
+	const limited = limitSessionPageMessages(projected.filter((message) => (touched.get(message.seq) ?? message.seq) > sinceSeq));
+	return limited.dropped > 0 ? void 0 : limited.messages;
+}
 function clampTail(n) {
 	if (!Number.isFinite(n)) return 100;
 	return Math.max(10, Math.min(500, Math.floor(n)));
@@ -10504,6 +11089,115 @@ var DshCommandApi = class {
 		return response;
 	}
 };
+/** 补全是交互式请求，慢于此值的结果对用户已无意义。 */
+const REFERENCE_TIMEOUT_MS = 5e3;
+const SESSION_MENTION = /^@\[[^\n]*\]\(dsh-session:[A-Za-z0-9_-]+\)$/;
+var DshReferenceApi = class {
+	ctx;
+	peer;
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	get gatewayReady() {
+		return typeof this.ctx.get("typertGateway")?.invoke === "function";
+	}
+	get filesAvailable() {
+		return this.gatewayReady && this.ctx.get("fileReferences") !== void 0;
+	}
+	get sessionsAvailable() {
+		return this.gatewayReady && this.ctx.get("sessionReferenceResolver") !== void 0;
+	}
+	get available() {
+		return this.filesAvailable || this.sessionsAvailable;
+	}
+	owner() {
+		const connection = this.ctx.get("connection");
+		return this.peer ??= connection?.createPeer?.({
+			principal: { kind: "owner" },
+			interactions: "none"
+		}) ?? connection?.operator;
+	}
+	async invoke(namespace, method, args, signal) {
+		return unwrapRemote(await this.ctx.get("typertGateway").invoke({
+			namespace,
+			method,
+			args,
+			peer: this.owner(),
+			signal
+		}));
+	}
+	/**
+	* 并行读两类候选。单类失败（超时、旧主机没有对应 Remote）只让该类为空，
+	* 不拖垮另一类；两类都不可用由调用方在能力位上拦下。
+	*/
+	async list(sessionId, query, signal) {
+		const bounded = AbortSignal.any([signal ?? new AbortController().signal, AbortSignal.timeout(REFERENCE_TIMEOUT_MS)]);
+		const filesAvailable = this.filesAvailable;
+		const sessionsAvailable = this.sessionsAvailable;
+		const [files, sessions] = await Promise.all([filesAvailable ? this.invoke("fileReferences", "list", {
+			agentId: sessionId,
+			query
+		}, bounded).then(fileItems, () => []) : Promise.resolve([]), sessionsAvailable ? this.invoke("sessionReferenceResolver", "candidates", {
+			agentId: sessionId,
+			query
+		}, bounded).then(sessionItems, () => []) : Promise.resolve([])]);
+		return {
+			files: {
+				available: filesAvailable,
+				items: files
+			},
+			sessions: {
+				available: sessionsAvailable,
+				items: sessions
+			}
+		};
+	}
+};
+/**
+* 网关对不同 Remote 的返回形态不一：有的直接给值（如 `commands/list`），有的给
+* `RemoteResult {ok, value | error}`（如 `sessionFeedback/record`）。两种都接受，失败抛出。
+*/
+function unwrapRemote(result) {
+	if (result && typeof result === "object" && !Array.isArray(result) && typeof result.ok === "boolean") {
+		if (result.ok) return result.value;
+		throw Object.assign(new Error(result.error?.message ?? "reference lookup failed"), { code: result.error?.code });
+	}
+	return result;
+}
+/** 只保留形状合法的行；主机排序原样保留。 */
+function fileItems(rows) {
+	if (!Array.isArray(rows)) return [];
+	const items = [];
+	for (const row of rows) {
+		if (items.length >= 30) break;
+		const path = row?.path;
+		const kind = row?.kind;
+		if (typeof path !== "string" || !path || path.length > 4096 || kind !== "file" && kind !== "directory") continue;
+		items.push({
+			path,
+			kind
+		});
+	}
+	return items;
+}
+/** 标签优先用主机给的显示标题（子代理的创建标签），与规范 mention 里的文字一致。 */
+function sessionItems(rows) {
+	if (!Array.isArray(rows)) return [];
+	const items = [];
+	for (const row of rows) {
+		if (items.length >= 10) break;
+		const r = row;
+		const label = typeof r?.displayTitle === "string" && r.displayTitle ? r.displayTitle : r?.label;
+		if (typeof r?.sessionId !== "string" || !r.sessionId || typeof label !== "string" || !label || typeof r.mention !== "string" || r.mention.length > 4096 || !SESSION_MENTION.test(r.mention)) continue;
+		items.push({
+			sessionId: r.sessionId,
+			label,
+			mention: r.mention,
+			sameWorkspace: r.sameWorkspace === true
+		});
+	}
+	return items;
+}
 // src/dsh-api-proxy.ts
 /**
 * Adapter for the DSH rc.2 controller API.
@@ -10545,6 +11239,12 @@ var DshApiProxy = class {
 			export: (request, signal) => this.commandApi.export(request.payload.sessionId, signal, request.payload.format)
 		};
 	}
+	referenceApi;
+	/** 引用服务可能晚于桥接层挂载：每次读取都按当前服务判定，不缓存缺席。 */
+	get references() {
+		if (!this.referenceApi.available) return void 0;
+		return { list: (request, signal) => this.call(() => this.referenceApi.list(request.payload.sessionId, request.payload.query, signal)) };
+	}
 	session;
 	workspaceController;
 	scheduleController;
@@ -10555,6 +11255,7 @@ var DshApiProxy = class {
 	constructor(ctx, options = {}) {
 		this.ctx = ctx;
 		this.commandApi = new DshCommandApi(ctx);
+		this.referenceApi = new DshReferenceApi(ctx);
 		const session = ctx.get("sessionController");
 		if (session === void 0) throw new Error("DSH sessionController is unavailable");
 		this.session = session;
@@ -12091,6 +12792,25 @@ function requestClientIdentity(req) {
 	}
 	return normalizedAddress(req.socket.remoteAddress) ?? "unknown";
 }
+// src/welcome-routes.ts
+/**
+* welcome.routes（能力 routeHints）的纯计算：局域网监听在线且有指纹时给 RFC1918 地址
+* （顺序沿用 localLANIPv4Addresses 的物理网卡优先），Funnel 在线时给公网地址；两者都没有
+* 时返回 undefined，welcome 不带该字段。
+*/
+function welcomeRoutes(local, remote, addresses) {
+	const lanAddresses = addresses.filter(isPrivateIPv4);
+	const lan = local.phase === "online" && local.tlsFingerprint && lanAddresses.length > 0 ? {
+		urls: localEndpointURLs(lanAddresses, local.port),
+		tlsFingerprint: local.tlsFingerprint
+	} : void 0;
+	const remoteURL = remote.phase === "online" ? remote.publicURL : void 0;
+	if (lan === void 0 && remoteURL === void 0) return void 0;
+	return {
+		...lan ? { lan } : {},
+		...remoteURL ? { remote: { url: remoteURL } } : {}
+	};
+}
 // src/lan-tls.ts
 const LAN_TLS_COMMON_NAME = "dsh-deeppilot";
 const LAN_TLS_KEY_FILE = "key.pem";
@@ -12733,6 +13453,7 @@ function apply(ctx, options) {
 						try {
 							const connection = new BridgeConnection(ws, {
 								bridge,
+								routes: phoneRoutes,
 								devices,
 								serverVersion: SERVER_VERSION,
 								audience,
@@ -12821,6 +13542,12 @@ function apply(ctx, options) {
 		dataDir,
 		log
 	});
+	/**
+	* welcome.routes（能力 routeHints）：手机据此在同一 Wi-Fi 下先走局域网、在外走 Funnel。
+	* 局域网只给 RFC1918 地址（不含 tailnet 的 100.64/10：手机未入 tailnet 时只会白等超时），
+	* 物理网卡优先；Funnel 只在 online 时给。每次 welcome 现算：地址与 Funnel 状态都会变。
+	*/
+	const phoneRoutes = () => welcomeRoutes(localTransport.status(), remoteTransport.status(), localLANIPv4Addresses());
 	const localStatus = (addresses) => {
 		const state = localTransport.status();
 		return {