dsh-mobile 0.8.7 → 0.8.9

package/lib/index.d.mts

@@ -1351,10 +1351,21 @@ export declare class MobileAccessGateway {
   private proxyHttpOnce;
   private abortSessionResources;
   private broadcastExtensionChange;
-  /** Fan a completed task to every phone holding this gateway's event stream. */
+  /**
+   * Fan a completed task to every phone holding this gateway's event stream.
+   *
+   * `sessionId` and `turn` always stay; `title`/`body` are optional and are
+   * emitted together so an older App ignores them and falls back to its own
+   * localized text. This layer re-bounds the strings (code-point safe) instead
+   * of trusting the caller; redaction is deliberately owned only by the
+   * task-events derivation, not repeated here, because this method is also
+   * callable by fixtures that bypass the watcher.
+   */
   broadcastTaskEvent(event: {
     readonly sessionId: string;
     readonly turn: number;
+    readonly title?: string;
+    readonly body?: string;
   }): void;
   /** Notify only the device whose persistent credential was revoked by the Host. */
   private broadcastDeviceRevoked;
@@ -2761,13 +2772,22 @@ export declare function irohGatewayConfig(template: ResolvedGatewayConfig, endpo
  * The exact moment a run ends is known only on the Host (the phone page can
  * merely infer it from UI state), so this module watches the public
  * `session/event` bus for completed root turns and hands them to a hub that
- * fans out to every live mobile gateway. Phones render the text locally, so
- * no user content crosses this boundary — only opaque session and turn ids.
+ * fans out to every live mobile gateway.
+ *
+ * Phones still render the final notification locally, but the event carries an
+ * optional, already-bounded title/body derived from the Session title and the
+ * turn's first non-empty assistant line. The Android background service uses
+ * that text when present and falls back to its localized strings when the
+ * fields are absent, so older Apps that ignore the new fields keep working.
  */
 /** A completed root turn worth announcing on paired phones. */
 interface TaskCompletionEvent {
   readonly sessionId: string;
   readonly turn: number;
+  /** Bounded Session title; present only with a bounded body. */
+  readonly title?: string;
+  /** Bounded first non-empty assistant line of the turn; present only with a title. */
+  readonly body?: string;
 }
 /** Minimal session shape read off the `session/event` bus. */
 interface TaskEventSession {
@@ -2793,6 +2813,8 @@ interface TaskEventWatcherOptions {
   /** Trailing debounce per session that merges turn-boundary bursts. */
   readonly debounceMs?: number;
   readonly onTaskCompleted: (event: TaskCompletionEvent) => void;
+  /** Read the Session's display title (normally `sessionProjections.stateOf(session, 'title')`). */
+  readonly readSessionTitle?: ((session: TaskEventSession) => unknown) | undefined;
   readonly log?: (event: string, fields: Readonly<Record<string, string | number | boolean>>) => void;
 }
 export declare const TASK_EVENT_DEBOUNCE_MS = 1000;

package/lib/index.mjs

@@ -1864,6 +1864,200 @@ var MobileAccessGatewayController = class {
 		return run;
 	}
 };
+// src/task-events.ts
+const TASK_EVENT_DEBOUNCE_MS = 1e3;
+/**
+* Wire bounds for the optional title/body. They mirror the Android bridge
+* policy constants (`NativeBridgePolicy.TASK_NOTIFICATION_TITLE_CHARS` = 80,
+* `TASK_NOTIFICATION_BODY_CHARS` = 200) so the App never truncates a plugin
+* value again with a different unit.
+*/
+const TASK_ANNOUNCEMENT_LIMITS = Object.freeze({
+	title: 80,
+	body: 200
+});
+/** Bounded number of Sessions whose pending assistant line is retained. */
+const MAX_PENDING_TEXT = 128;
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function turnNumber(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function turnData(value) {
+	const data = record(value);
+	if (data === void 0) return {
+		turn: 0,
+		completed: false
+	};
+	const reason = data.reason;
+	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
+	return {
+		turn: turnNumber(data.turn),
+		completed
+	};
+}
+const CONTROL_CHARACTERS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu;
+/**
+* Any first line matching one of these is discarded whole rather than
+* partially rewritten. A partial path replacement is how a username or file
+* name leaks: e.g. a Windows path with a space used to leave the tail behind.
+* The body comes from a user-visible assistant message, not from logs, but a
+* model can still quote a path, a URL, a JWT/AWS key or a PEM header.
+*/
+const SENSITIVE_TEXT_PATTERNS = [
+	/\b(?:https?|file):\/\/\S+/iu,
+	/[A-Za-z]:[\\/][^\r\n"']*/u,
+	/\\\\[^\s"']+/u,
+	/~[\\/][^\r\n"']*/u,
+	/(?:^|[\s"'(])\/(?:[^\s/"']+\/)+[^\s"']*/u,
+	/(?:^|\s)\/[A-Za-z0-9._-]+(?=\s|$)/u,
+	/\beyJ[\w-]{8,}/u,
+	/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/u,
+	/-----BEGIN [A-Z ]*PRIVATE KEY-----/u,
+	/\b(?:password|passphrase|token|secret)\s+(?:is|was)\s+\S+/iu,
+	/\b(?:sk|rk|pk)-[A-Za-z0-9_-]{12,}\b/u,
+	/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{16,}\b/u,
+	/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/iu,
+	/\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/iu,
+	/\b(?:api[_-]?key|access[_-]?token|token|secret|password|passwd)\s*[:=]\s*['"]?[^\s'"]{4,}/iu
+];
+function boundedText$1(value, limit) {
+	if (typeof value !== "string") return void 0;
+	const normalized = value.normalize("NFC").replace(CONTROL_CHARACTERS, " ").replace(/\s+/gu, " ").trim();
+	if (normalized === "") return void 0;
+	if (SENSITIVE_TEXT_PATTERNS.some((pattern) => pattern.test(normalized))) return void 0;
+	const characters = Array.from(normalized);
+	return characters.length > limit ? characters.slice(0, limit).join("").trim() : normalized;
+}
+/**
+* Build the optional wire text. Both fields are present or both are absent:
+* a title without a body (or vice versa) would make the App mix plugin text
+* with its fixed fallback strings.
+*/
+function taskAnnouncementText(title, body) {
+	const boundedTitle = boundedText$1(title, TASK_ANNOUNCEMENT_LIMITS.title);
+	const boundedBody = boundedText$1(body, TASK_ANNOUNCEMENT_LIMITS.body);
+	if (boundedTitle === void 0 || boundedBody === void 0) return void 0;
+	return Object.freeze({
+		title: boundedTitle,
+		body: boundedBody
+	});
+}
+/** Extract the concatenated text parts of an assistant message event. */
+function assistantMessageText(event) {
+	const content = record(record(event.data)?.message)?.content;
+	if (typeof content === "string") return content === "" ? void 0 : content;
+	if (!Array.isArray(content)) return void 0;
+	let text = "";
+	for (const part of content) {
+		const block = record(part);
+		if (block?.type === "text" && typeof block.text === "string") text += block.text;
+	}
+	return text === "" ? void 0 : text;
+}
+function firstNonEmptyLine(value) {
+	if (value === void 0) return void 0;
+	for (const line of value.split(/\r\n|\r|\n/gu)) {
+		const trimmed = line.trim();
+		if (trimmed !== "") return trimmed;
+	}
+}
+function sessionTitle(reader, session) {
+	if (reader === void 0) return void 0;
+	try {
+		const value = reader(session);
+		return typeof value === "string" && value.trim() !== "" ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Subscribe to completed root turns. Subagent turns are skipped so one task
+* announces once, and rapid turn boundaries collapse into a single event.
+* Returns a disposer that also drops pending debounces.
+*/
+function watchTaskCompletions(ctx, options) {
+	const debounceMs = options.debounceMs ?? 1e3;
+	const pending = /* @__PURE__ */ new Map();
+	/** First non-empty assistant line of the latest turn per root Session. */
+	const assistantLines = /* @__PURE__ */ new Map();
+	const rememberLine = (sessionId, turn, line) => {
+		if (assistantLines.size >= MAX_PENDING_TEXT && !assistantLines.has(sessionId)) {
+			const oldest = assistantLines.keys().next();
+			if (!oldest.done) assistantLines.delete(oldest.value);
+		}
+		const existing = assistantLines.get(sessionId);
+		if (existing === void 0 || existing.turn !== turn) assistantLines.set(sessionId, {
+			turn,
+			line
+		});
+	};
+	const disposeListener = ctx.on("session/event", (session, event) => {
+		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
+		const sessionId = String(session.id);
+		if (event.type === "turn/start") {
+			assistantLines.delete(sessionId);
+			return;
+		}
+		if (event.type === "assistant/message") {
+			const turn = turnNumber(record(event.data)?.turn);
+			const line = firstNonEmptyLine(assistantMessageText(event));
+			if (line !== void 0) rememberLine(sessionId, turn, line);
+			return;
+		}
+		if (event.type !== "turn/end") return;
+		const { turn, completed } = turnData(event.data);
+		if (!completed) {
+			assistantLines.delete(sessionId);
+			return;
+		}
+		const pendingLine = assistantLines.get(sessionId);
+		const announcement = taskAnnouncementText(sessionTitle(options.readSessionTitle, session), pendingLine?.turn === turn ? pendingLine.line : void 0);
+		assistantLines.delete(sessionId);
+		const previous = pending.get(sessionId);
+		if (previous !== void 0) clearTimeout(previous);
+		pending.set(sessionId, setTimeout(() => {
+			pending.delete(sessionId);
+			options.log?.("task-completed-announced", {
+				sessionId,
+				turn
+			});
+			options.onTaskCompleted(Object.freeze({
+				sessionId,
+				turn,
+				...announcement === void 0 ? {} : announcement
+			}));
+		}, debounceMs));
+	});
+	return () => {
+		disposeListener();
+		for (const timer of pending.values()) clearTimeout(timer);
+		pending.clear();
+		assistantLines.clear();
+	};
+}
+/** One subscription feeding every live gateway; gateways register on start. */
+var TaskEventHub = class {
+	sinks = /* @__PURE__ */ new Set();
+	/** Register a sink; returns its disposer. */
+	add(sink) {
+		this.sinks.add(sink);
+		return () => {
+			this.sinks.delete(sink);
+		};
+	}
+	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
+	broadcast(event) {
+		for (const sink of [...this.sinks]) try {
+			sink.broadcastTaskEvent(event);
+		} catch {}
+	}
+	/** Visible for tests. */
+	get size() {
+		return this.sinks.size;
+	}
+};
 function unwrapBrackets(hostname) {
 	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
 }
@@ -2040,7 +2234,8 @@ function cookie(name, value, options) {
 }
 /** Enforce direct CIDR, exact Host, and browser same-origin facts. */
 function assertExternalTrust(request, policy, requireOrigin) {
-	if (!addressAllowed(request.socket.remoteAddress, policy.cidrs) || !policy.acceptsHost(request.headers.host)) throw new HttpError(403, "forbidden");
+	if (!addressAllowed(request.socket.remoteAddress, policy.cidrs)) throw new HttpError(403, "source_network_untrusted");
+	if (!policy.acceptsHost(request.headers.host)) throw new HttpError(403, "forbidden");
 	const origin = request.headers.origin;
 	if (origin !== void 0 && !policy.acceptsOrigin(origin)) throw new HttpError(403, "forbidden");
 	const site = request.headers["sec-fetch-site"];
@@ -9377,14 +9572,28 @@ var MobileAccessGateway = class {
 		this.extensionEventRevision += 1;
 		for (const listener of this.extensionEventListeners) listener(this.extensionEventRevision);
 	}
-	/** Fan a completed task to every phone holding this gateway's event stream. */
+	/**
+	* Fan a completed task to every phone holding this gateway's event stream.
+	*
+	* `sessionId` and `turn` always stay; `title`/`body` are optional and are
+	* emitted together so an older App ignores them and falls back to its own
+	* localized text. This layer re-bounds the strings (code-point safe) instead
+	* of trusting the caller; redaction is deliberately owned only by the
+	* task-events derivation, not repeated here, because this method is also
+	* callable by fixtures that bypass the watcher.
+	*/
 	broadcastTaskEvent(event) {
 		if (this.closing) return;
-		const payload = JSON.stringify({
+		const payload = {
 			sessionId: String(event.sessionId),
 			turn: Number(event.turn) || 0
-		});
-		for (const listener of this.taskEventListeners) listener(payload);
+		};
+		if (typeof event.title === "string" && event.title !== "" && typeof event.body === "string" && event.body !== "") {
+			payload.title = Array.from(event.title).slice(0, TASK_ANNOUNCEMENT_LIMITS.title).join("");
+			payload.body = Array.from(event.body).slice(0, TASK_ANNOUNCEMENT_LIMITS.body).join("");
+		}
+		const serialized = JSON.stringify(payload);
+		for (const listener of this.taskEventListeners) listener(serialized);
 	}
 	/** Notify only the device whose persistent credential was revoked by the Host. */
 	broadcastDeviceRevoked(deviceId) {
@@ -16900,83 +17109,6 @@ function irohGatewayConfig(template, endpointId, stateFile, tls, listenPort = 0)
 		pairingTtlMs: 3e5
 	});
 }
-// src/task-events.ts
-const TASK_EVENT_DEBOUNCE_MS = 1e3;
-function turnNumber(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
-}
-function turnData(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return {
-		turn: 0,
-		completed: false
-	};
-	const record = value;
-	const reason = record.reason;
-	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
-	return {
-		turn: turnNumber(record.turn),
-		completed
-	};
-}
-/**
-* Subscribe to completed root turns. Subagent turns are skipped so one task
-* announces once, and rapid turn boundaries collapse into a single event.
-* Returns a disposer that also drops pending debounces.
-*/
-function watchTaskCompletions(ctx, options) {
-	const debounceMs = options.debounceMs ?? 1e3;
-	const pending = /* @__PURE__ */ new Map();
-	const disposeListener = ctx.on("session/event", (session, event) => {
-		if (event.type !== "turn/end") return;
-		const { turn, completed } = turnData(event.data);
-		if (!completed) return;
-		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
-		const sessionId = String(session.id);
-		options.log?.("task-completed-observed", {
-			sessionId,
-			turn
-		});
-		const previous = pending.get(sessionId);
-		if (previous !== void 0) clearTimeout(previous);
-		pending.set(sessionId, setTimeout(() => {
-			pending.delete(sessionId);
-			options.log?.("task-completed-announced", {
-				sessionId,
-				turn
-			});
-			options.onTaskCompleted(Object.freeze({
-				sessionId,
-				turn
-			}));
-		}, debounceMs));
-	});
-	return () => {
-		disposeListener();
-		for (const timer of pending.values()) clearTimeout(timer);
-		pending.clear();
-	};
-}
-/** One subscription feeding every live gateway; gateways register on start. */
-var TaskEventHub = class {
-	sinks = /* @__PURE__ */ new Set();
-	/** Register a sink; returns its disposer. */
-	add(sink) {
-		this.sinks.add(sink);
-		return () => {
-			this.sinks.delete(sink);
-		};
-	}
-	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
-	broadcast(event) {
-		for (const sink of [...this.sinks]) try {
-			sink.broadcastTaskEvent(event);
-		} catch {}
-	}
-	/** Visible for tests. */
-	get size() {
-		return this.sinks.size;
-	}
-};
 // src/diagnostic-network-context.ts
 function addressKind(address) {
 	if (isIP(address) === 4) {
@@ -21333,6 +21465,74 @@ const OUTCOME_COALESCE_MS = 1e3;
 const ATTENTION_TTL_MS = 3e5;
 const OUTCOME_TTL_MS = 18e5;
 const ATTEMPT_TIMEOUT_MS = 1e4;
+// src/mobile-push/ownership.ts
+const MAX_OWNERSHIP_DEPTH = 64;
+/**
+* Read the durable header from the object a public event delivered.
+*
+* A `session/event` observer receives the Session itself, whose header lives on
+* the live Agent; a request can carry an Agent-shaped identity without the
+* Session attached. Resolve both through the public registry instead of
+* assuming one shape.
+*/
+function durableHeader(registry, agent) {
+	const direct = agent.session?.header;
+	if (direct !== void 0) return direct;
+	return registry?.get?.(agent.id)?.session?.header;
+}
+/**
+* Find the owning parent recorded by the durable Session header.
+*
+* Only a header that explicitly classifies the Session as a subagent child
+* creates ownership. Historical ordinary forks may retain a `parentSession`
+* source id, so the field alone is not evidence of ownership.
+*/
+function owningParentId(registry, agent) {
+	const header = durableHeader(registry, agent);
+	if (header?.origin !== "subagent") return void 0;
+	const parent = header.parentSession;
+	return typeof parent === "string" && parent.length > 0 ? parent : void 0;
+}
+/** The public ownership walk available before DSH 0.2.2-rc.2, when it exists. */
+function legacyOwnerOf(registry) {
+	if (typeof registry?.list !== "function" || typeof registry.isOwnedBy !== "function") return void 0;
+	return (id) => (registry?.list?.() ?? []).find((candidate) => registry?.isOwnedBy?.(id, candidate) === true);
+}
+/**
+* Whether this Agent is a runtime child that must not notify on its own.
+*
+* Without the removed registry ownership API, the live parent Agent recorded
+* by the header is the public evidence; an orphan does not count as owned,
+* matching the earlier walk that stopped at a missing owner.
+*/
+function isPushRuntimeChild(registry, agent) {
+	const ownerOf = legacyOwnerOf(registry);
+	if (ownerOf !== void 0) return ownerOf(agent.id) !== void 0;
+	const parentId = owningParentId(registry, agent);
+	return parentId !== void 0 && registry?.get?.(parentId) !== void 0;
+}
+/**
+* Resolve the root Session a notification should target.
+*
+* Uses the removed `isOwnedBy` walk when the host still exposes it, and the
+* durable subagent header ancestry otherwise. A child whose parent Agent is no
+* longer live remains its own root, matching the previous behavior.
+*/
+function pushRootAgent(registry, agent) {
+	const ownerOf = legacyOwnerOf(registry);
+	let current = agent;
+	for (let count = 0; count < MAX_OWNERSHIP_DEPTH; count++) {
+		let parent;
+		if (ownerOf !== void 0) parent = ownerOf(current.id);
+		else {
+			const parentId = owningParentId(registry, current);
+			parent = parentId === void 0 ? void 0 : registry?.get?.(parentId);
+		}
+		if (parent === void 0 || parent.id === current.id) return current;
+		current = parent;
+	}
+	return current;
+}
 // src/mobile-push/requests.ts
 var RequestLifetimes = class {
 	#records = /* @__PURE__ */ new Map();
@@ -21494,15 +21694,7 @@ var RequestLifetimes = class {
 		return rec;
 	}
 	#root(agent) {
-		const registry = this.#ctx.agents;
-		if (!registry?.isOwnedBy || !registry.get || !registry.list) return agent;
-		let current = agent;
-		for (let count = 0; count < 64; count++) {
-			const parent = registry.list().find((candidate) => registry.isOwnedBy?.(current.id, candidate));
-			if (!parent) break;
-			current = parent;
-		}
-		return current;
+		return pushRootAgent(this.#ctx.agents, agent);
 	}
 	#arm(rec) {
 		if (rec.timer) return;
@@ -21677,20 +21869,10 @@ var OutcomeLifetimes = class {
 		}
 	}
 	#isRuntimeChild(agent) {
-		const registry = this.#ctx.agents;
-		if (!registry?.isOwnedBy || !registry.list) return false;
-		return registry.list().some((owner) => registry.isOwnedBy?.(agent.id, owner));
+		return isPushRuntimeChild(this.#ctx.agents, agent);
 	}
 	#root(agent) {
-		const registry = this.#ctx.agents;
-		if (!registry?.isOwnedBy || !registry.list) return agent;
-		let current = agent;
-		for (let count = 0; count < 64; count++) {
-			const owner = registry.list().find((candidate) => registry.isOwnedBy?.(current.id, candidate));
-			if (!owner) return current;
-			current = owner;
-		}
-		return current;
+		return pushRootAgent(this.#ctx.agents, agent);
 	}
 };
 // src/mobile-push/reconcile.ts
@@ -21967,7 +22149,7 @@ var PushReconciler = class {
 };
 // src/mobile-push/host.ts
 function hasContract(ctx) {
-	return typeof ctx.on === "function" && typeof ctx.sessionProjections?.stateOf === "function" && typeof ctx.sessionProjections.snapshot === "function" && typeof ctx.sessionProjections.register === "function" && typeof ctx.sessionQuery?.observeSession === "function" && typeof ctx.agents?.get === "function" && typeof ctx.agents.list === "function" && typeof ctx.agents.roots === "function" && typeof ctx.agents.isOwnedBy === "function" && ctx.userQuestions !== void 0 && ctx.approval !== void 0;
+	return typeof ctx.on === "function" && typeof ctx.sessionProjections?.stateOf === "function" && typeof ctx.sessionProjections.snapshot === "function" && typeof ctx.sessionProjections.register === "function" && typeof ctx.sessionQuery?.observeSession === "function" && typeof ctx.agents?.get === "function" && typeof ctx.agents.list === "function" && ctx.userQuestions !== void 0 && ctx.approval !== void 0;
 }
 const MAINTENANCE_INTERVAL_MS = 3e4;
 function createPushHost(ctx) {
@@ -24123,6 +24305,7 @@ var PushDelivery = class {
 		if (this.#closed) return;
 		if (this.#wakeTimer) clearTimeout(this.#wakeTimer);
 		this.#wakeTimer = void 0;
+		if (this.#active >= 4) return;
 		this.#pruneDeferred();
 		let nextAt = Number.POSITIVE_INFINITY;
 		try {
@@ -24901,6 +25084,9 @@ async function apply(ctx, config) {
 	const taskEventHub = new TaskEventHub();
 	const disposeTaskEvents = watchTaskCompletions(ctx, {
 		onTaskCompleted: (event) => taskEventHub.broadcast(event),
+		readSessionTitle: (session) => {
+			return (ctx.get?.("sessionProjections"))?.stateOf?.(session, "title");
+		},
 		log(event, fields) {
 			logger.info("task event=%s fields=%o", event, fields);
 		}