dsh-remote-control 1.1.0 → 1.2.0

package/dist/bundle/index.js

@@ -7486,10 +7486,10 @@ var require_segments = __commonJS({
       const segs = getSegmentsFromString(data, Utils.isKanjiModeEnabled());
       const nodes = buildNodes(segs);
       const graph = buildGraph(nodes, version2);
-      const path5 = dijkstra.find_path(graph.map, "start", "end");
+      const path3 = dijkstra.find_path(graph.map, "start", "end");
       const optimizedSegs = [];
-      for (let i = 1; i < path5.length - 1; i++) {
-        optimizedSegs.push(graph.table[path5[i]].node);
+      for (let i = 1; i < path3.length - 1; i++) {
+        optimizedSegs.push(graph.table[path3[i]].node);
       }
       return exports.fromArray(mergeSegments(optimizedSegs));
     };
@@ -9966,7 +9966,7 @@ var require_png2 = __commonJS({
       });
       png.pack();
     };
-    exports.renderToFile = function renderToFile(path5, qrData, options, cb) {
+    exports.renderToFile = function renderToFile(path3, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
@@ -9977,7 +9977,7 @@ var require_png2 = __commonJS({
         called = true;
         cb.apply(null, args);
       };
-      const stream = fs.createWriteStream(path5);
+      const stream = fs.createWriteStream(path3);
       stream.on("error", done);
       stream.on("close", done);
       exports.renderToFileStream(stream, qrData, options);
@@ -10039,14 +10039,14 @@ var require_utf8 = __commonJS({
       }
       return output2;
     };
-    exports.renderToFile = function renderToFile(path5, qrData, options, cb) {
+    exports.renderToFile = function renderToFile(path3, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
       }
       const fs = __require("fs");
       const utf82 = exports.render(qrData, options);
-      fs.writeFile(path5, utf82, cb);
+      fs.writeFile(path3, utf82, cb);
     };
   }
 });
@@ -10167,7 +10167,7 @@ var require_svg_tag = __commonJS({
       return str;
     }
     function qrToPath(data, size, margin) {
-      let path5 = "";
+      let path3 = "";
       let moveBy = 0;
       let newRow = false;
       let lineLength = 0;
@@ -10178,19 +10178,19 @@ var require_svg_tag = __commonJS({
         if (data[i]) {
           lineLength++;
           if (!(i > 0 && col > 0 && data[i - 1])) {
-            path5 += newRow ? svgCmd("M", col + margin, 0.5 + row + margin) : svgCmd("m", moveBy, 0);
+            path3 += newRow ? svgCmd("M", col + margin, 0.5 + row + margin) : svgCmd("m", moveBy, 0);
             moveBy = 0;
             newRow = false;
           }
           if (!(col + 1 < size && data[i + 1])) {
-            path5 += svgCmd("h", lineLength);
+            path3 += svgCmd("h", lineLength);
             lineLength = 0;
           }
         } else {
           moveBy++;
         }
       }
-      return path5;
+      return path3;
     }
     exports.render = function render(qrData, options, cb) {
       const opts = Utils.getOptions(options);
@@ -10198,10 +10198,10 @@ var require_svg_tag = __commonJS({
       const data = qrData.modules.data;
       const qrcodesize = size + opts.margin * 2;
       const bg = !opts.color.light.a ? "" : "<path " + getColorAttrib(opts.color.light, "fill") + ' d="M0 0h' + qrcodesize + "v" + qrcodesize + 'H0z"/>';
-      const path5 = "<path " + getColorAttrib(opts.color.dark, "stroke") + ' d="' + qrToPath(data, size, opts.margin) + '"/>';
+      const path3 = "<path " + getColorAttrib(opts.color.dark, "stroke") + ' d="' + qrToPath(data, size, opts.margin) + '"/>';
       const viewBox = 'viewBox="0 0 ' + qrcodesize + " " + qrcodesize + '"';
       const width = !opts.width ? "" : 'width="' + opts.width + '" height="' + opts.width + '" ';
-      const svgTag = '<svg xmlns="http://www.w3.org/2000/svg" ' + width + viewBox + ' shape-rendering="crispEdges">' + bg + path5 + "</svg>\n";
+      const svgTag = '<svg xmlns="http://www.w3.org/2000/svg" ' + width + viewBox + ' shape-rendering="crispEdges">' + bg + path3 + "</svg>\n";
       if (typeof cb === "function") {
         cb(null, svgTag);
       }
@@ -10215,7 +10215,7 @@ var require_svg = __commonJS({
   "../../node_modules/.pnpm/qrcode@1.5.4/node_modules/qrcode/lib/renderer/svg.js"(exports) {
     var svgTagRenderer = require_svg_tag();
     exports.render = svgTagRenderer.render;
-    exports.renderToFile = function renderToFile(path5, qrData, options, cb) {
+    exports.renderToFile = function renderToFile(path3, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
@@ -10223,7 +10223,7 @@ var require_svg = __commonJS({
       const fs = __require("fs");
       const svgTag = exports.render(qrData, options);
       const xmlStr = '<?xml version="1.0" encoding="utf-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">' + svgTag;
-      fs.writeFile(path5, xmlStr, cb);
+      fs.writeFile(path3, xmlStr, cb);
     };
   }
 });
@@ -10285,7 +10285,7 @@ var require_canvas = __commonJS({
 var require_browser = __commonJS({
   "../../node_modules/.pnpm/qrcode@1.5.4/node_modules/qrcode/lib/browser.js"(exports) {
     var canPromise = require_can_promise();
-    var QRCode3 = require_qrcode();
+    var QRCode2 = require_qrcode();
     var CanvasRenderer = require_canvas();
     var SvgRenderer = require_svg_tag();
     function renderCanvas(renderFunc, canvas, text, opts, cb) {
@@ -10328,7 +10328,7 @@ var require_browser = __commonJS({
         }
         return new Promise(function(resolve, reject) {
           try {
-            const data = QRCode3.create(text, opts);
+            const data = QRCode2.create(text, opts);
             resolve(renderFunc(data, canvas, opts));
           } catch (e) {
             reject(e);
@@ -10336,13 +10336,13 @@ var require_browser = __commonJS({
         });
       }
       try {
-        const data = QRCode3.create(text, opts);
+        const data = QRCode2.create(text, opts);
         cb(null, renderFunc(data, canvas, opts));
       } catch (e) {
         cb(e);
       }
     }
-    exports.create = QRCode3.create;
+    exports.create = QRCode2.create;
     exports.toCanvas = renderCanvas.bind(null, CanvasRenderer.render);
     exports.toDataURL = renderCanvas.bind(null, CanvasRenderer.renderToDataURL);
     exports.toString = renderCanvas.bind(null, function(data, _, opts) {
@@ -10355,7 +10355,7 @@ var require_browser = __commonJS({
 var require_server = __commonJS({
   "../../node_modules/.pnpm/qrcode@1.5.4/node_modules/qrcode/lib/server.js"(exports) {
     var canPromise = require_can_promise();
-    var QRCode3 = require_qrcode();
+    var QRCode2 = require_qrcode();
     var PngRenderer = require_png2();
     var Utf8Renderer = require_utf8();
     var TerminalRenderer = require_terminal2();
@@ -10381,8 +10381,8 @@ var require_server = __commonJS({
         cb
       };
     }
-    function getTypeFromFilename(path5) {
-      return path5.slice((path5.lastIndexOf(".") - 1 >>> 0) + 2).toLowerCase();
+    function getTypeFromFilename(path3) {
+      return path3.slice((path3.lastIndexOf(".") - 1 >>> 0) + 2).toLowerCase();
     }
     function getRendererFromType(type) {
       switch (type) {
@@ -10412,7 +10412,7 @@ var require_server = __commonJS({
       if (!params.cb) {
         return new Promise(function(resolve, reject) {
           try {
-            const data = QRCode3.create(text, params.opts);
+            const data = QRCode2.create(text, params.opts);
             return renderFunc(data, params.opts, function(err, data2) {
               return err ? reject(err) : resolve(data2);
             });
@@ -10422,13 +10422,13 @@ var require_server = __commonJS({
         });
       }
       try {
-        const data = QRCode3.create(text, params.opts);
+        const data = QRCode2.create(text, params.opts);
         return renderFunc(data, params.opts, params.cb);
       } catch (e) {
         params.cb(e);
       }
     }
-    exports.create = QRCode3.create;
+    exports.create = QRCode2.create;
     exports.toCanvas = require_browser().toCanvas;
     exports.toString = function toString(text, opts, cb) {
       const params = checkParams(text, opts, cb);
@@ -10446,17 +10446,17 @@ var require_server = __commonJS({
       const renderer = getRendererFromType(params.opts.type);
       return render(renderer.renderToBuffer, text, params);
     };
-    exports.toFile = function toFile(path5, text, opts, cb) {
-      if (typeof path5 !== "string" || !(typeof text === "string" || typeof text === "object")) {
+    exports.toFile = function toFile(path3, text, opts, cb) {
+      if (typeof path3 !== "string" || !(typeof text === "string" || typeof text === "object")) {
         throw new Error("Invalid argument");
       }
       if (arguments.length < 3 && !canPromise()) {
         throw new Error("Too few arguments provided");
       }
       const params = checkParams(text, opts, cb);
-      const type = params.opts.type || getTypeFromFilename(path5);
+      const type = params.opts.type || getTypeFromFilename(path3);
       const renderer = getRendererFromType(type);
-      const renderToFile = renderer.renderToFile.bind(null, path5);
+      const renderToFile = renderer.renderToFile.bind(null, path3);
       return render(renderToFile, text, params);
     };
     exports.toFileStream = function toFileStream(stream, text, opts) {
@@ -10655,7 +10655,6 @@ var init_mock_kernel = __esm({
 });
 
 // src/index.ts
-import { execFile } from "node:child_process";
 import { randomBytes as randomBytes4 } from "node:crypto";
 
 // ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/crypto/bytes.js
@@ -11594,10 +11593,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path3) {
+  if (!path3)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path3.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11937,11 +11936,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path3, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path3);
     return iss;
   });
 }
@@ -12391,16 +12390,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path5 = []) => {
+  const processError = (error63, path3 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -12439,17 +12438,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path5 = []) => {
+  const processError = (error63, path3 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -12488,8 +12487,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path5) {
+  const path3 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path3) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -29591,13 +29590,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path5 = ref.slice(1).split("/").filter(Boolean);
-  if (path5.length === 0) {
+  const path3 = ref.slice(1).split("/").filter(Boolean);
+  if (path3.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path5[0] === defsKey) {
-    const key = path5[1] === void 0 ? void 0 : decodeJSONPointerSegment(path5[1]);
+  if (path3[0] === defsKey) {
+    const key = path3[1] === void 0 ? void 0 : decodeJSONPointerSegment(path3[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -31135,7 +31134,7 @@ var HostRuntime = class {
       this.clock.clearTimeout(this.mergeTimer);
       this.mergeTimer = void 0;
     }
-    for (const [id, item] of [...this.pending]) this.settle(id, void 0);
+    for (const [id] of [...this.pending]) this.settle(id, void 0);
   }
   /** 手机发来的命令。`conversationId` 是配对通道 id，与载荷里的 sessionId 不是一回事（F3）。 */
   async handleCommand(cmd, conversationId) {
@@ -32309,17 +32308,6 @@ function createServicesKernel(services, options) {
     const status = agent?.status;
     return typeof status === "string" ? status : "idle";
   }
-  function sessionWorkspace(sessionId) {
-    const get = fn(services.sessions, "get");
-    if (!get || sessionId === "") return void 0;
-    try {
-      const session = get.call(services.sessions, sessionId);
-      const cwd = session?.header?.cwd ?? session?.cwd;
-      return typeof cwd === "string" && cwd !== "" ? cwd : void 0;
-    } catch {
-      return void 0;
-    }
-  }
   function toSummary(record2, archived) {
     const cached2 = titleCache.get(record2.id);
     const running = agentStatus(record2.id) === "running";
@@ -32746,7 +32734,6 @@ function createServicesKernel(services, options) {
     subscribe,
     attachInteractionSink,
     ensureRunnable,
-    sessionWorkspace,
     // 与发指令/续跑走同一条读取路径：这里原来还有一份实现，而且是 `current()` 裸调用
     // （不带 receiver；真要用 this 的服务方法会当场抛），两份迟早分叉。
     modelSelection: currentSelection,
@@ -32761,9 +32748,6 @@ function createServicesKernel(services, options) {
         // 新建会话只依赖这一条。和 historyFace 同理：真机上"新建没反应"第一件要分清的事
         // 是宿主没有这个能力，还是我们没调对。
         createFace: typeof fn(services.sessionController?.commands, "create") === "function" ? "commands.create" : `absent (keys=${shapeOf(services.sessionController)})`.slice(0, 120),
-        // 二维码落点依赖这一条。它缺席时 PNG 会退回 ~/.dsh/，卡片上的路径会跟着变——
-        // 用户看到"图不在工作区"时，第一件事就是看这个字段是不是 absent。
-        workspaceFace: typeof fn(services.sessions, "get") === "function" ? "sessions.get" : `absent (keys=${shapeOf(services.sessions)})`.slice(0, 120),
         agents: typeof services.agents === "object",
         agentDefaultModel: typeof services.agentDefaultModel === "object",
         workspaceRegistry: typeof services.workspaceRegistry === "object",
@@ -33049,7 +33033,6 @@ function createOneShotTimers(clock) {
 
 // src/shell/status.ts
 import { mkdirSync, renameSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import path from "node:path";
 var StatusFile = class {
   constructor(file2, clock, refreshMs = 3e3) {
@@ -33061,7 +33044,6 @@ var StatusFile = class {
   clock;
   refreshMs;
   timer;
-  lastWritten = 0;
   write(snapshot) {
     if (!this.file) return;
     try {
@@ -33075,7 +33057,6 @@ var StatusFile = class {
         }
       );
       renameSync(tmp, this.file);
-      this.lastWritten = this.clock.now();
     } catch {
     }
   }
@@ -33104,47 +33085,10 @@ var StatusFile = class {
       this.timer = void 0;
     }
   }
-  /** 此刻是否在按节拍刷新（测试与 status 自身的 `refreshing` 字段读它）。 */
-  get refreshing() {
-    return this.timer !== void 0;
-  }
-  get path() {
-    return this.file;
-  }
 };
-function pairingImagePath(statusFile, workspaceDir) {
-  if (!statusFile) return "";
-  if (workspaceDir) return path.join(workspaceDir, ".dsh", "pairing-qr.png");
-  return path.join(homedir(), ".dsh", "pairing-qr.png");
-}
-function writePrivateFile(file2, data) {
-  if (!file2) return false;
-  try {
-    mkdirSync(path.dirname(file2), { recursive: true });
-    writeFileSync(file2, data, { mode: 384 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/shell/pairing-text.ts
-var PAIR_UNAVAILABLE_TEXT = "\u4E2D\u7EE7\u8FD8\u6CA1\u8FDE\u4E0A\uFF0C\u6682\u65F6\u65E0\u6CD5\u914D\u5BF9\u3002\u770B status.json \u7684 relayProblem\u3002";
-function pairingPairText(view) {
-  const ttlSec = Math.max(0, Math.round((view.expiresAt - view.now) / 1e3));
-  const lines = [`\u914D\u5BF9\u7801 ${view.token} \xB7 ${ttlSec} \u79D2\u5185\u6709\u6548 \xB7 \u4E00\u6B21\u6027`, "\u5C0F\u7A0B\u5E8F\u91CC\u626B\u7801\uFF0C\u6216\u624B\u8F93\u8FD9 6 \u4F4D\u6570\u5B57\u3002"];
-  if (view.qrImage && view.imageFile) {
-    lines.push("", `\u4E8C\u7EF4\u7801\u4F1A\u81EA\u52A8\u5F39\u51FA\u5230\u53F3\u680F\uFF1B\u6CA1\u5F39\u51FA\u5C31\u6253\u5F00\u8FD9\u5F20 PNG \u518D\u626B\uFF1A${view.imageFile}`);
-  } else if (view.terminalQr) {
-    lines.push("", view.terminalQr);
-  }
-  lines.push("", view.qr);
-  if (!view.qrImage) lines.push("", "\uFF08\u5982\u9700\u56FE\u7247\u7248\uFF1A\u628A patch \u91CC\u7684 qrImage \u8BBE\u4E3A true\uFF09");
-  return lines.join("\n");
-}
 
 // src/shell/config.ts
-import { homedir as homedir2 } from "node:os";
+import { homedir } from "node:os";
 import path2 from "node:path";
 var DEFAULT_CONFIG = {
   enabled: true,
@@ -33155,34 +33099,18 @@ var DEFAULT_CONFIG = {
   hostLabel: "dsh-host",
   keepAwake: { enabled: true, idleReleaseSec: 300, keepDisplay: false },
   mockBridge: false,
-  statusFile: path2.join(homedir2(), ".dsh", "dsh-remote-control", "status.json"),
+  statusFile: path2.join(homedir(), ".dsh", "dsh-remote-control", "status.json"),
   unarchiveOnPrompt: true,
   pairOnStartSec: 0,
   pairTtlMs: 12e4,
-  // **默认走图片**。2026-10-02 取证推翻了原判断（原判断：文本二维码在任何等宽渲染器下
-  // 都能扫，图片是可有可无的旁路）：
-  //   · DSH 命令卡的等宽输出块是 `white-space: pre` + `line-height: 1.6`（app bundle 里
-  //     的那条规则，实测行间留白约占行高 37%），每两行模块之间被塞进一条整行宽的缝隙，
-  //     半块二维码被横切成条。
-  //   · 用用户真机贴出来的那段输出做受控实验：把字号行距调到 1.0 时 zxing 解得出来，
-  //     调到 ≥1.15 就扫不出来；而 DSH 固定 1.6。也就是说"文本码能扫"在**唯一宿主**上不成立。
-  //   · 而 ANSI 反色救不了：TerminalBlock 把每行渲染成内联 span，背景只覆盖字形盒，
-  //     不覆盖行间留白（见 dsh-client-ui-primitives 的 parseAnsiLines/renderLine）。
-  // 图片是自包含位图矩阵，跟宿主的行高、字体、配色都无关——这才是"扫得出来"的那条路。
-  qrImage: true,
-  // 写图片 ≠ 替用户打开查看器：仍然默认关（原话「不要用打开一个图片的方式」）。
-  qrOpen: false,
-  qrAnsi: false,
-  qrStyle: "half",
   carrierGraceMs: 5e3,
   takeOverQuestions: false,
   approvalTimeoutSec: 180,
   listingRefreshSec: 15,
   conversationIdleTtlSec: 86400,
-  // 图默认落在会话工作区（`<workspace>/.dsh/sidebar-qr.png`），这里只是**兜底位**：
-  // 会话 → 工作区解析不出来时才用它。故意不写进 patch YAML——把某个人的家目录
-  // 焊进分发包是错的（拆分版同一理由）。
-  sidebarQr: { enabled: true, imageFile: path2.join(homedir2(), ".dsh", "sidebar-qr.png"), refreshMs: 2e3 }
+  // 配对的唯一入口。关掉它 = 这台主机**没有**配对入口（`/drc pair` 与文本二维码都在
+  // 2026-10-03 删掉了），所以 index.ts 会把它记成一条 warn 而不是安静地什么都不做。
+  pill: { enabled: true }
 };
 var loopback = /^wss?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/;
 var wsUrl = /^wss?:\/\/.+/;
@@ -33200,23 +33128,16 @@ function readConfig(injected, env = process.env) {
     ...DEFAULT_CONFIG,
     ...injected ?? {},
     keepAwake: { ...DEFAULT_CONFIG.keepAwake, ...injected?.keepAwake ?? {} },
-    // 折进来的那一半同样是**逐键合并**：patch 里只写 `sidebarQr.refreshMs` 时，
-    // enabled 与 imageFile 必须仍取默认值，而不是被整个对象覆盖成 undefined。
-    sidebarQr: { ...DEFAULT_CONFIG.sidebarQr, ...injected?.sidebarQr ?? {} }
+    // 逐键合并：patch 里只写 `pill.enabled` 时不能把整个对象覆盖掉（虽然它现在只有一个键，
+    // 但"注入对象整体替换默认对象"这个形状在 keepAwake 上已经坑过一次）。
+    pill: { ...DEFAULT_CONFIG.pill, ...injected?.pill ?? {} }
   };
   const fromEnv = (name) => env[name];
   if (fromEnv("DRC_SERVER_URL")) merged.serverUrl = env.DRC_SERVER_URL;
   if (fromEnv("DRC_HOST_LABEL")) merged.hostLabel = env.DRC_HOST_LABEL;
   if (fromEnv("DRC_HOST_ID")) merged.hostId = env.DRC_HOST_ID;
   if (fromEnv("DRC_PAIR_ON_START_SEC")) merged.pairOnStartSec = envSeconds(env.DRC_PAIR_ON_START_SEC);
-  if (fromEnv("DRC_QR_IMAGE")) merged.qrImage = envFlag(env.DRC_QR_IMAGE, merged.qrImage);
-  if (fromEnv("DRC_QR_OPEN")) merged.qrOpen = envFlag(env.DRC_QR_OPEN, merged.qrOpen);
-  if (fromEnv("DRC_QR_ANSI")) merged.qrAnsi = envFlag(env.DRC_QR_ANSI, merged.qrAnsi);
-  if (fromEnv("DRC_SIDEBAR_QR")) merged.sidebarQr.enabled = envFlag(env.DRC_SIDEBAR_QR, merged.sidebarQr.enabled);
-  if (fromEnv("DRC_QR_STYLE")) {
-    const style = env.DRC_QR_STYLE;
-    if (["ascii", "block", "half"].includes(style)) merged.qrStyle = style;
-  }
+  if (fromEnv("DRC_PILL")) merged.pill.enabled = envFlag(env.DRC_PILL, merged.pill.enabled);
   if (fromEnv("DRC_MOCK_BRIDGE") === "1") merged.mockBridge = true;
   if (fromEnv("DRC_TAKE_OVER_QUESTIONS") === "1") merged.takeOverQuestions = true;
   if (merged.hostTokenEnv) merged.hostToken = env[merged.hostTokenEnv] ?? merged.hostToken;
@@ -33267,21 +33188,6 @@ function validateConfig(config2) {
     problems.push({ level: "warn", field: "pairOnStartSec", message: "\u5FC5\u987B\u662F\u975E\u8D1F\u7684\u6709\u9650\u79D2\u6570\uFF0C\u5DF2\u6298\u56DE 0\uFF08\u5173\u95ED\u81EA\u52A8\u53D1\u7801\uFF09" });
     config2.pairOnStartSec = 0;
   }
-  if (config2.qrOpen && !config2.qrImage) {
-    problems.push({
-      level: "warn",
-      field: "qrOpen",
-      message: "qrOpen \u9700\u8981 qrImage=true \u624D\u4F1A\u5199\u56FE\u7247\u6587\u4EF6\uFF1B\u73B0\u5728\u53EA\u51FA\u6587\u672C\u4E8C\u7EF4\u7801\uFF08\u6587\u672C\u7801\u5728 DSH \u547D\u4EE4\u5361\u91CC\u626B\u4E0D\u51FA\u6765\uFF0C\u89C1 config.ts \u9ED8\u8BA4\u503C\u6CE8\u91CA\uFF09"
-    });
-  }
-  if (!["ascii", "block", "half"].includes(config2.qrStyle)) {
-    problems.push({
-      level: "warn",
-      field: "qrStyle",
-      message: `qrStyle \u53EA\u8BA4 ascii/block/half\uFF0C\u6536\u5230 ${JSON.stringify(config2.qrStyle)}\uFF0C\u5DF2\u9000\u56DE half`
-    });
-    config2.qrStyle = "half";
-  }
   if (!secondsSchema.safeParse(config2.conversationIdleTtlSec).success || config2.conversationIdleTtlSec <= 0) {
     problems.push({
       level: "warn",
@@ -33307,77 +33213,18 @@ function validateConfig(config2) {
       message: "\u63D0\u95EE\u63A5\u7BA1\u4F1A**\u53D6\u4EE3\u684C\u9762 UI \u7684\u63D0\u95EE\u80FD\u529B**\uFF08ctx.userQuestions \u53EA\u5141\u8BB8\u4E00\u4E2A\u6D3B\u8DC3 provider\uFF09\uFF1B\u624B\u673A\u7AEF\u4E0D\u5728\u7EBF\u65F6\u63D0\u95EE\u4F1A\u76F4\u63A5\u5931\u8D25"
     });
   }
-  if (typeof config2.sidebarQr.imageFile !== "string" || config2.sidebarQr.imageFile === "") {
-    problems.push({
-      level: "warn",
-      field: "sidebarQr.imageFile",
-      message: "\u4E3A\u7A7A\u5C31\u65E0\u5904\u843D\u515C\u5E95\u56FE\uFF0C\u5DF2\u5939\u56DE ~/.dsh/sidebar-qr.png\uFF08\u5DE5\u4F5C\u533A\u89E3\u6790\u5F97\u51FA\u6765\u65F6\u672C\u6765\u4E5F\u7528\u4E0D\u5230\u5B83\uFF09"
-    });
-    config2.sidebarQr.imageFile = DEFAULT_CONFIG.sidebarQr.imageFile;
-  } else if (!path2.isAbsolute(config2.sidebarQr.imageFile)) {
-    problems.push({
-      level: "warn",
-      field: "sidebarQr.imageFile",
-      message: `\u4E0D\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF08${config2.sidebarQr.imageFile}\uFF09\uFF0C\u5DE5\u4F5C\u533A\u89E3\u6790\u4E0D\u51FA\u6765\u65F6\u4F1A\u88AB\u89E3\u6790\u5230\u8FDB\u7A0B\u5DE5\u4F5C\u76EE\u5F55\u4E0B`
-    });
-  }
-  if (!secondsSchema.safeParse(config2.sidebarQr.refreshMs).success || config2.sidebarQr.refreshMs < 200) {
-    problems.push({
-      level: "warn",
-      field: "sidebarQr.refreshMs",
-      message: "\u5FC5\u987B\u662F \u2265200 \u7684\u6709\u9650\u6BEB\u79D2\u6570\uFF0C\u5DF2\u5939\u56DE 2000\uFF08\u539F\u503C " + JSON.stringify(config2.sidebarQr.refreshMs) + "\uFF09"
-    });
-    config2.sidebarQr.refreshMs = DEFAULT_CONFIG.sidebarQr.refreshMs;
-  }
   return problems;
 }
-function redactSecret(value) {
+function redact(value) {
   if (value.length <= 8) return "****";
   return `${value.slice(0, 4)}\u2026${value.slice(-2)}(${value.length})`;
 }
 
+// src/pill/routes.ts
+import { createHash as createHash2 } from "node:crypto";
+
 // src/platform/qr.ts
 var import_qrcode = __toESM(require_lib(), 1);
-async function qrMatrix(text, ecc = "M", quietZone = 2) {
-  const qr = import_qrcode.default.create(text, { errorCorrectionLevel: ecc });
-  const size = qr.modules.size;
-  const total = size + quietZone * 2;
-  const out = [];
-  for (let y = 0; y < total; y++) {
-    const row = [];
-    for (let x = 0; x < total; x++) {
-      const mx = x - quietZone;
-      const my = y - quietZone;
-      const dark = mx >= 0 && mx < size && my >= 0 && my < size && Boolean(qr.modules.get(my, mx));
-      row.push(dark);
-    }
-    out.push(row);
-  }
-  return out;
-}
-async function renderTerminalQr(text, options = {}) {
-  const { ecc = "M", quietZone = 2, style = "ascii", ansi = false } = options;
-  const matrix = await qrMatrix(text, ecc, quietZone);
-  let body;
-  if (style === "half") {
-    const lines = [];
-    for (let y = 0; y < matrix.length; y += 2) {
-      const top = matrix[y];
-      const bottom = matrix[y + 1] ?? top.map(() => false);
-      let line = "";
-      for (let x = 0; x < top.length; x++) {
-        line += top[x] && bottom[x] ? "\u2588" : top[x] ? "\u2580" : bottom[x] ? "\u2584" : " ";
-      }
-      lines.push(line);
-    }
-    body = lines.join("\n");
-  } else {
-    const dark = style === "ascii" ? "##" : "\u2588\u2588";
-    const light = style === "ascii" ? ".." : "  ";
-    body = matrix.map((row) => row.map((cell) => cell ? dark : light).join("")).join("\n");
-  }
-  return ansi ? `\x1B[30;107m${body}\x1B[0m` : body;
-}
 async function qrPng(text, options = {}) {
   return import_qrcode.default.toBuffer(text, {
     errorCorrectionLevel: options.ecc ?? "M",
@@ -33387,112 +33234,18 @@ async function qrPng(text, options = {}) {
   });
 }
 
-// src/presentation/sidebar.ts
-import path4 from "node:path";
-
-// src/presentation/presenter.ts
-var import_qrcode2 = __toESM(require_lib(), 1);
-import { createHash as createHash2 } from "node:crypto";
-import { mkdirSync as mkdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import path3 from "node:path";
-function toEpochMs(value) {
-  if (typeof value === "number") return Number.isFinite(value) ? value : 0;
-  if (typeof value === "string") {
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? parsed : 0;
-  }
-  return 0;
-}
-var PairingPresenter = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  value = { state: "none" };
-  artifact = null;
-  rendering = false;
-  snapshot() {
-    return this.value;
-  }
-  /**
-   * 当前这一版的 PNG 字节；没有可看的码时是 null。
-   *
-   * **路由必须先拿它落盘成功，再回答 `ready`**——反过来就等于把用户送到一个不存在的
-   * 文件上（右栏会弹出一张破图，比不弹更糟）。
-   */
-  current() {
-    return this.value.state === "ready" ? this.artifact : null;
-  }
-  /**
-   * 看一眼当前的码。
-   *
-   * 三种结果：
-   * - 没有码 / 码已过期 → `none`（右栏不该被一张废码顶开）；
-   * - 码没变 → 只更新 `expiresAt`（同一版码的过期时间可能被服务端 TTL 改写）；
-   * - 码变了 → 渲染成功后认这一版；渲染抛错就是 `none`（宁可不弹，也不弹一张上一版的图）。
-   */
-  async observe(pairing) {
-    const qr = typeof pairing?.qr === "string" && pairing.qr !== "" ? pairing.qr : null;
-    const expiresAt = toEpochMs(pairing?.expiresAt);
-    if (qr === null || expiresAt <= this.deps.now()) {
-      this.value = { state: "none" };
-      this.artifact = null;
-      return;
-    }
-    const epoch = this.deps.digest(qr);
-    if (this.artifact?.epoch !== epoch) {
-      if (this.rendering) return;
-      this.rendering = true;
-      try {
-        const buffer = await this.deps.render(qr);
-        this.artifact = { epoch, buffer };
-      } catch (error62) {
-        this.artifact = null;
-        this.deps.log("\u4E8C\u7EF4\u7801\u6E32\u67D3\u5931\u8D25", { message: String(error62?.message ?? error62).slice(0, 200) });
-      } finally {
-        this.rendering = false;
-      }
-    }
-    this.value = this.artifact?.epoch === epoch ? { state: "ready", epoch, expiresAt } : { state: "none" };
-  }
-};
-function liveDeps(log) {
-  return {
-    now: () => Date.now(),
-    render: (qr) => import_qrcode2.default.toBuffer(qr, { errorCorrectionLevel: "M", margin: 4, scale: 8, type: "png" }),
-    digest: (qr) => createHash2("sha256").update(qr).digest("hex").slice(0, 16),
-    log
-  };
-}
-function writePrivatePng(file2, data) {
-  if (!file2) return false;
-  try {
-    mkdirSync2(path3.dirname(file2), { recursive: true });
-    const tmp = `${file2}.tmp-${process.pid}`;
-    writeFileSync2(tmp, data, { mode: 384 });
-    renameSync2(tmp, file2);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/presentation/address.ts
-var FILE_ADDRESS_PREFIX = "dsh-resource://file/";
-function encodeSegment(segment) {
-  return encodeURIComponent(segment).replace(/%3A/gi, ":");
-}
-function sessionFileAddress(sessionId, filePath) {
-  const normalized = filePath.replace(/\\/g, "/");
-  const encoded = normalized.split("/").map(encodeSegment).join("/");
-  return `${FILE_ADDRESS_PREFIX}session/${encodeSegment(sessionId)}/${encoded}`;
+// src/pill/routes.ts
+var PAIR_NEW_ROUTE = "/plugins/dsh-remote-control/pairing/new";
+var PAIR_IMAGE_ROUTE = "/plugins/dsh-remote-control/pairing.png";
+var PAIR_STATUS_ROUTE = "/plugins/dsh-remote-control/status";
+var PAIR_MARKER_HEADER = "x-drc-pair";
+var PAIR_MARKER_VALUE = "1";
+function pairingEpoch(qr) {
+  return createHash2("sha256").update(qr).digest("hex").slice(0, 16);
+}
+async function renderPairingPng(qr) {
+  return qrPng(qr);
 }
-function isUsableSessionId(value) {
-  return typeof value === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(value);
-}
-
-// src/presentation/route.ts
-var PAIRING_ROUTE = "/plugins/dsh-remote-control/pairing";
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
 function hostnameOf(host) {
   const trimmed = host.trim().toLowerCase();
@@ -33513,161 +33266,202 @@ function hostIsLoopback(host) {
   if (host === void 0 || host.trim() === "") return false;
   return LOOPBACK_HOSTS.has(hostnameOf(host));
 }
-function originIsLoopback(origin) {
-  if (origin === void 0) return true;
+function originIsLoopbackOrAbsent(origin) {
+  if (origin === void 0 || origin.trim() === "") return true;
+  return originLooksLikeTheHostItself(origin);
+}
+function originLooksLikeTheHostItself(origin) {
   try {
-    const { hostname: hostname3 } = new URL(origin);
-    return LOOPBACK_HOSTS.has(hostname3) || hostname3 === "::1";
+    const url2 = new URL(origin);
+    if (url2.protocol !== "http:" && url2.protocol !== "https:") return origin.trim() !== "null";
+    return LOOPBACK_HOSTS.has(url2.hostname);
   } catch {
     return false;
   }
 }
+function rejectedBy(request) {
+  if (!hostIsLoopback(request.headers.host)) return "host-not-loopback";
+  if (request.headers[PAIR_MARKER_HEADER] !== PAIR_MARKER_VALUE) return "pair-marker-missing";
+  const origin = request.headers.origin;
+  if (origin !== void 0 && origin.trim() !== "" && !originLooksLikeTheHostItself(origin)) return "origin-not-trusted";
+  return void 0;
+}
 function json2(response, status, body) {
   const payload = JSON.stringify(body);
   response.writeHead(status, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) });
   response.end(payload);
 }
-function pairingHandler(options) {
-  return async (request, response) => {
-    if (request.method !== "GET") {
+function pairNewHandler(deps) {
+  return (request, response) => {
+    if (request.method !== "POST") {
       json2(response, 405, { error: "method not allowed" });
       return;
     }
-    if (!hostIsLoopback(request.headers.host) || !originIsLoopback(request.headers.origin)) {
-      json2(response, 403, { error: "request-not-trusted" });
+    const guard = rejectedBy(request);
+    if (guard) {
+      deps.log("\u53D1\u7801\u8BF7\u6C42\u88AB\u5B88\u536B\u62D2", { guard });
+      json2(response, 403, { error: "request-not-trusted", guard });
       return;
     }
     try {
-      const url2 = new URL(request.url ?? "/", "http://dsh.invalid");
-      const sessionId = url2.searchParams.get("session");
-      const snapshot = options.snapshot();
-      if (snapshot.state !== "ready") {
-        json2(response, 200, { state: "none" });
-        return;
-      }
-      if (!isUsableSessionId(sessionId)) {
-        json2(response, 400, { state: "none", error: "session parameter required" });
-        return;
-      }
-      const target = options.target(sessionId);
-      if (!target.persist()) {
-        json2(response, 200, { state: "none" });
+      const pairing = deps.ensureFresh();
+      if (!pairing) {
+        json2(response, 200, { state: "unavailable", reason: "relay-offline" });
         return;
       }
+      deps.log("\u914D\u5BF9\u7801\u7ECF\u72B6\u6001\u680F\u53D1\u51FA", { token: pairing.token });
       json2(response, 200, {
         state: "ready",
-        epoch: snapshot.epoch,
-        address: sessionFileAddress(sessionId, target.file),
-        expiresAt: snapshot.expiresAt
+        epoch: pairingEpoch(pairing.qr),
+        token: pairing.token,
+        expiresInMs: Math.max(0, pairing.expiresAt - Date.now())
       });
     } catch (error62) {
       json2(response, 500, { error: String(error62?.message ?? error62).slice(0, 200) });
     }
   };
 }
-function registerPairingRoute(webServer, options) {
-  return webServer.register({ kind: "exact", path: PAIRING_ROUTE, handler: pairingHandler(options) });
-}
-
-// src/presentation/sidebar.ts
-function startSidebarQr(ctx, deps) {
-  const { config: config2, log } = deps;
-  const probe = {};
-  const presenter = new PairingPresenter(liveDeps(log));
-  let web;
-  let timer;
-  let unregister;
-  let started = false;
-  let stopped = false;
-  let written = null;
-  const targetFor = (sessionId) => {
-    let workspace;
+function pairImageHandler(deps) {
+  return async (request, response) => {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      json2(response, 405, { error: "method not allowed" });
+      return;
+    }
+    if (!hostIsLoopback(request.headers.host) || !originIsLoopbackOrAbsent(request.headers.origin)) {
+      json2(response, 403, { error: "request-not-trusted" });
+      return;
+    }
     try {
-      workspace = deps.workspaceOf(sessionId);
+      const pairing = deps.current();
+      if (!pairing) {
+        response.writeHead(204);
+        response.end();
+        return;
+      }
+      const png = await renderPairingPng(pairing.qr);
+      response.writeHead(200, {
+        "Content-Type": "image/png",
+        "Content-Length": png.length,
+        // 一张码会被就地换掉（半程刷新、被手机用掉），所以绝不许缓存。
+        // ETag 给的是这一版的哈希，pill 拿它判断要不要重画，省掉撕票式的刷新。
+        "Cache-Control": "no-store",
+        ETag: `"${pairingEpoch(pairing.qr)}"`
+      });
+      response.end(request.method === "HEAD" ? void 0 : png);
     } catch (error62) {
-      log("\u4F1A\u8BDD\u5DE5\u4F5C\u533A\u89E3\u6790\u5931\u8D25", { message: String(error62?.message ?? error62).slice(0, 160) });
-      workspace = void 0;
+      json2(response, 500, { error: String(error62?.message ?? error62).slice(0, 200) });
     }
-    const file2 = workspace ? path4.join(workspace, ".dsh", "sidebar-qr.png") : config2.imageFile;
-    return {
-      file: file2,
-      persist: () => {
-        const artifact = presenter.current();
-        if (!artifact) return false;
-        if (written && written.epoch === artifact.epoch && written.file === file2) return true;
-        if (!writePrivatePng(file2, artifact.buffer)) {
-          log("\u4E8C\u7EF4\u7801\u843D\u76D8\u5931\u8D25", { file: file2 });
-          return false;
-        }
-        written = { epoch: artifact.epoch, file: file2 };
-        return true;
-      }
-    };
   };
-  const tick = async () => {
-    let pairing = null;
-    try {
-      const raw = deps.pairing();
-      pairing = raw && typeof raw === "object" ? raw : null;
-    } catch (error62) {
-      log("read pairing state failed", { message: String(error62?.message ?? error62).slice(0, 160) });
+}
+function pillStatusHandler(deps) {
+  return (request, response) => {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      json2(response, 405, { error: "method not allowed" });
+      return;
+    }
+    if (!hostIsLoopback(request.headers.host) || !originIsLoopbackOrAbsent(request.headers.origin)) {
+      json2(response, 403, { error: "request-not-trusted" });
       return;
     }
     try {
-      await presenter.observe(pairing);
+      const status = deps.status();
+      json2(response, 200, {
+        relay: status.relay,
+        paired: status.paired,
+        hostLabel: status.hostLabel,
+        serverUrl: status.serverUrl
+      });
     } catch (error62) {
-      log("observe failed", { message: String(error62?.message ?? error62).slice(0, 160) });
+      json2(response, 500, { error: String(error62?.message ?? error62).slice(0, 200) });
+    }
+  };
+}
+function registerPillRoutes(webServer, deps) {
+  const off = [];
+  const definitions = [
+    { kind: "exact", path: PAIR_NEW_ROUTE, handler: pairNewHandler(deps) },
+    { kind: "exact", path: PAIR_IMAGE_ROUTE, handler: pairImageHandler(deps) },
+    { kind: "exact", path: PAIR_STATUS_ROUTE, handler: pillStatusHandler(deps) }
+  ];
+  try {
+    for (const definition of definitions) off.push(webServer.register(definition));
+  } catch (error62) {
+    for (const unregister of off.splice(0)) {
+      try {
+        unregister();
+      } catch {
+      }
+    }
+    throw error62;
+  }
+  return () => {
+    for (const unregister of off) {
+      try {
+        unregister();
+      } catch {
+      }
     }
   };
+}
+
+// src/pill/start.ts
+function startPill(ctx, deps) {
+  const { log } = deps;
+  const probe = {};
+  let web;
+  let unregister;
+  let started = false;
+  let stopped = false;
   const tryStart = () => {
     if (started || stopped || !web) return;
     started = true;
     try {
-      unregister = registerPairingRoute(web, {
-        snapshot: () => presenter.snapshot(),
-        target: targetFor
+      unregister = registerPillRoutes(web, {
+        ensureFresh: () => deps.ensureFresh(),
+        current: () => deps.current(),
+        status: () => deps.status(),
+        log
       });
-      probe.route = "registered";
+      probe.routes = "registered";
     } catch (error62) {
-      probe.route = `register threw: ${String(error62?.message ?? error62).slice(0, 80)}`;
-      log("route registration failed", { message: String(error62?.message ?? error62).slice(0, 200) });
+      probe.routes = `register threw: ${String(error62?.message ?? error62).slice(0, 80)}`;
       started = false;
+      log("pill \u8DEF\u7531\u6CE8\u518C\u5931\u8D25\uFF08\u914D\u5BF9\u94FE\u8DEF\u4E0D\u53D7\u5F71\u54CD\uFF09", {
+        message: String(error62?.message ?? error62).slice(0, 200)
+      });
       return;
     }
-    timer = setInterval(() => void tick(), config2.refreshMs);
-    timer.unref?.();
-    void tick();
-    log("sidebar started", { fallbackImageFile: config2.imageFile, refreshMs: config2.refreshMs });
+    log("pill routes started");
   };
-  const pickFrom = (source, name) => {
+  const acceptWebServer = (value, via) => {
+    if (!value || typeof value !== "object") return false;
+    if (typeof value.register !== "function") {
+      probe.webServer = "object without register()";
+      return false;
+    }
+    web = value;
+    probe.webServer = via;
+    tryStart();
+    return true;
+  };
+  const pickFrom = (source) => {
     if (!source || typeof source !== "object") return void 0;
     const asContext = source;
     if (typeof asContext.get === "function") {
       try {
-        const got = asContext.get(name, true);
+        const got = asContext.get("webServer", true);
         if (got) return got;
       } catch {
       }
     }
     try {
-      return source[name];
+      return source["webServer"];
     } catch {
       return void 0;
     }
   };
-  const acceptWebServer = (value, via) => {
-    if (!value || typeof value !== "object") return false;
-    if (typeof value.register !== "function") {
-      probe.webServer = "object without register()";
-      return false;
-    }
-    web = value;
-    probe.webServer = via;
-    tryStart();
-    return true;
-  };
-  if (!config2.enabled) {
-    probe.sidebar = "disabled";
+  if (!deps.enabled) {
+    probe.pill = "disabled";
   } else {
     try {
       const found = ctx.get?.("webServer", true);
@@ -33679,12 +33473,9 @@ function startSidebarQr(ctx, deps) {
     try {
       ctx.inject?.(["webServer"], ((...args) => {
         try {
-          let value;
           for (const candidate of [args[0], ...args, ctx]) {
-            value = pickFrom(candidate, "webServer");
-            if (value) break;
+            if (acceptWebServer(pickFrom(candidate), "via inject")) return;
           }
-          if (acceptWebServer(value, "via inject")) return;
           probe.webServer = `${probe.webServer ?? "none"} (inject fired, empty)`;
         } catch (error62) {
           probe["injectThrew:webServer"] = String(error62?.message ?? error62).slice(0, 160);
@@ -33697,18 +33488,21 @@ function startSidebarQr(ctx, deps) {
   const stop = () => {
     if (stopped) return;
     stopped = true;
-    if (timer !== void 0) {
-      clearInterval(timer);
-      timer = void 0;
-    }
+    const off = unregister;
+    unregister = void 0;
     try {
-      unregister?.();
+      off?.();
     } catch {
     }
-    unregister = void 0;
-    if (started) log("sidebar stopped");
+    if (started) log("pill routes stopped");
+  };
+  return {
+    stop,
+    probe,
+    get available() {
+      return started && probe.routes === "registered";
+    }
   };
-  return { stop, probe };
 }
 
 // src/index.ts
@@ -33740,11 +33534,7 @@ function apply(ctx, injected = {}) {
       get state() {
         return handle?.state() ?? { relay: "offline", carrier: "none", reason: "not-started" };
       },
-      createPairing: () => handle?.createPairing() ?? null,
-      // presentation 那一半要按会话解析落点（右栏那张图放哪），而"会话 → 工作区"这点
-      // 平台知识只在本插件里有。**在这里开一个口，而不是让那一半自己去探内核服务**：
-      // 两份探测迟早分叉，而分叉的表现是"卡片说 A 地、右栏读 B 地"，很难查。
-      sessionWorkspace: (sessionId) => handle?.sessionWorkspace(sessionId)
+      createPairing: () => handle?.createPairing() ?? null
     });
   } catch {
   }
@@ -33807,7 +33597,7 @@ function applyInner(ctx, injected) {
   let runtime;
   let relay;
   let startedCarrier = "";
-  let sidebar;
+  let pillRoutes;
   let lastRelayState = "connecting";
   let lastRelayProblem;
   let lastRelayGeneration = 0;
@@ -33912,13 +33702,21 @@ function applyInner(ctx, injected) {
       // 出站计数：手机上"没收到 X"的第一现场对比点（插件没发 vs 发了但路上丢了）。
       outbound: runtime?.stats ?? null,
       probe,
-      // 右栏那一半为什么没起，是"二维码不弹"唯一的排查入口：这里直接把软探测的结果带出来。
-      sidebar: sidebar?.probe ?? { webServer: "not-started" },
+      // 配对入口（那颗 pill 的三条路由）为什么没起，是"配不了对"唯一的排查入口：
+      // 这里直接把软探测的结果带出来。
+      pill: pillRoutes?.probe ?? { webServer: "not-started" },
       // token 永远不出现真值；这条有测试锁住。
       hostToken: void 0,
-      hostTokenShape: config2.hostToken ? redactSecret(config2.hostToken) : void 0,
+      hostTokenShape: config2.hostToken ? redact(config2.hostToken) : void 0,
       mockBridgeForced: config2.mockBridge,
-      problems: problems.map((problem) => `${problem.level}:${problem.field}`),
+      problems: [
+        ...problems.map((problem) => `${problem.level}:${problem.field}`),
+        // **每次快照现判，不在 apply 里 push 一次**。`webServer` 可能是 `ctx.inject` 的回调
+        // 晚到才拿到的，apply 返回那一刻 `available` 还是 false——留在 apply 里就会写出
+        // `routes:"registered"` 与 `problems:["warn:pill"]` 并存的假警报
+        // （2026-10-03 真机重启后实测抓到）。为什么没挂上从同一个快照的 `pill` 探针读。
+        ...pillRoutes?.available ? [] : ["warn:pill"]
+      ],
       ...config2.pairOnStartSec > 0 ? { pairOnStartWarn: "status.json \u91CC\u5E26\u7740\u4ECD\u7136\u6709\u6548\u7684\u914D\u5BF9\u7801\u4E0E PSK" } : {}
     };
   };
@@ -33951,6 +33749,25 @@ function applyInner(ctx, injected) {
     return created;
   };
   const createPairing = () => wrappedPublish();
+  function currentPairing() {
+    const shown = active.pairing;
+    if (!shown) return null;
+    if (!slots.resolveFor(shown.token)) return null;
+    return { qr: shown.qr, token: shown.token, expiresAt: shown.expiresAt };
+  }
+  function ensureFreshPairing() {
+    const fresh = currentPairing() ?? createPairing();
+    if (!fresh) return null;
+    return { qr: fresh.qr, token: fresh.token, expiresAt: fresh.expiresAt };
+  }
+  function pillStatus() {
+    return {
+      relay: relay ? relayState() : "idle",
+      paired: relay?.conversationCount ?? 0,
+      hostLabel: config2.hostLabel,
+      serverUrl: config2.serverUrl
+    };
+  }
   const pairingWindow = new PairingWindow(
     {
       clock,
@@ -33967,7 +33784,6 @@ function applyInner(ctx, injected) {
   );
   const collected = {};
   const hasServices = () => typeof collected.sessions === "object" && collected.sessions !== null;
-  const apiProxyOf = () => collected.apiProxy;
   const probe = {};
   const injectFired = [];
   let hasGet = true;
@@ -33985,9 +33801,6 @@ function applyInner(ctx, injected) {
       start(createServicesKernel(collected, { log, takeOverQuestions: config2.takeOverQuestions, clock }));
       return;
     }
-    if (typeof ctx.get?.("apiProxy", true) === "object") {
-      log("apiProxy present but unsupported by this build", { hint: "\u53EA\u505A\u8BCA\u65AD\u8BB0\u5F55\uFF0C\u4E0D\u63A5\u8FD9\u6761\u8F7D\u4F53" });
-    }
   };
   const requiredMember = { sessions: "list", sessionQuery: "listSessions", agents: "get" };
   const keysOf = (value) => {
@@ -34199,23 +34012,6 @@ function applyInner(ctx, injected) {
     } catch {
     }
   }
-  try {
-    const proxy = ctx.get?.("apiProxy", true);
-    if (proxy) collected.apiProxy = proxy;
-  } catch {
-  }
-  try {
-    ctx.inject?.(["apiProxy"], ((scoped) => {
-      const value = scoped?.get?.("apiProxy", true);
-      if (!value) return;
-      collected.apiProxy = value;
-      if (!decided) {
-        oneShot.schedule(tryStart, config2.carrierGraceMs);
-      }
-      tryStart();
-    }));
-  } catch {
-  }
   tryStart();
   if (!runtime && config2.mockBridge) {
     decided = true;
@@ -34224,44 +34020,29 @@ function applyInner(ctx, injected) {
   }
   if (!runtime) {
     status.write({ ...state(), carrier: "none", reason: "no-carrier", probe });
-    log("no kernel carrier available", { hint: "\u9700\u8981 sessions/apiProxy \u670D\u52A1\uFF0C\u6216\u628A mockBridge \u6253\u5F00\u505A\u5F00\u53D1" });
+    log("no kernel carrier available", { hint: "\u9700\u8981 sessions \u670D\u52A1\uFF0C\u6216\u628A mockBridge \u6253\u5F00\u505A\u5F00\u53D1" });
+  }
+  try {
+    pillRoutes = startPill(ctx, {
+      enabled: config2.pill.enabled,
+      // 三条路由要的三件事：幂等发码、只读看当前码、读连接状态。
+      ensureFresh: () => ensureFreshPairing(),
+      current: () => currentPairing(),
+      status: () => pillStatus(),
+      log
+    });
+  } catch (error62) {
+    pillRoutes = void 0;
+    log("pill start threw\uFF08\u914D\u5BF9\u94FE\u8DEF\u4E0D\u53D7\u5F71\u54CD\uFF09", {
+      message: String(error62?.message ?? error62).slice(0, 200)
+    });
   }
-  const workspaceOfInvocation = (invocation) => {
-    const agent = invocation?.agent;
-    const sessionId = typeof agent?.session?.id === "string" ? agent.session.id : "";
-    if (sessionId === "") return void 0;
-    try {
-      return kernel?.sessionWorkspace?.(sessionId);
-    } catch {
-      return void 0;
-    }
-  };
   const commandDefinition = {
     name: "drc",
-    description: "DSH \u8FDC\u7A0B\u63A7\u5236\uFF1A\u53D1\u5E03\u914D\u5BF9\u4E8C\u7EF4\u7801\u3001\u67E5\u770B\u4E2D\u7EE7\u4E0E\u5185\u6838\u63A5\u5408\u72B6\u6001",
-    input: { hint: "pair | status | unpair" },
+    description: "DSH \u8FDC\u7A0B\u63A7\u5236\uFF1A\u914D\u5BF9\u8BF7\u70B9\u72B6\u6001\u680F\u7684 dsh-remote-control\uFF1B/drc status \u770B\u8FDE\u63A5\u4E0E\u95EE\u9898\uFF0C/drc unpair \u89E3\u914D",
+    input: { hint: "status | unpair" },
     handler: async (invocation) => {
       const argument = String(invocation.rawInput ?? "").trim().toLowerCase();
-      if (argument.startsWith("pair")) {
-        const pairing = createPairing();
-        if (!pairing) return { kind: "success", text: PAIR_UNAVAILABLE_TEXT };
-        const workspaceDir = workspaceOfInvocation(invocation);
-        const imageFile = config2.qrImage ? pairingImagePath(config2.statusFile, workspaceDir) : "";
-        if (imageFile) writePairingImage(imageFile, pairing.qr, config2, log);
-        const terminal = config2.qrImage ? void 0 : await renderTerminalQr(pairing.qr, { style: config2.qrStyle, ansi: config2.qrAnsi });
-        return {
-          kind: "success",
-          text: pairingPairText({
-            token: pairing.token,
-            qr: pairing.qr,
-            expiresAt: pairing.expiresAt,
-            now: clock.now(),
-            qrImage: config2.qrImage,
-            imageFile,
-            terminalQr: terminal
-          })
-        };
-      }
       if (argument.startsWith("unpair")) {
         for (const id of relay?.conversationIds() ?? []) relay?.voidConversation(id);
         return { kind: "success", text: '\u5DF2\u89E3\u9664\u6240\u6709\u914D\u5BF9\uFF1B\u624B\u673A\u7AEF\u4F1A\u663E\u793A"\u4E3B\u673A\u5DF2\u65AD\u5F00\uFF0C\u8BF7\u91CD\u65B0\u914D\u5BF9"\u3002' };
@@ -34296,39 +34077,13 @@ function applyInner(ctx, injected) {
     if (child !== void 0) injectChildren.push(["commands", child]);
   } catch {
   }
-  try {
-    sidebar = startSidebarQr(ctx, {
-      config: config2.sidebarQr,
-      pairing: () => describeActivePairing(),
-      workspaceOf(sessionId) {
-        try {
-          return kernel?.sessionWorkspace?.(sessionId);
-        } catch {
-          return void 0;
-        }
-      },
-      log
-    });
-  } catch (error62) {
-    sidebar = void 0;
-    log("sidebar start threw\uFF08\u914D\u5BF9\u94FE\u8DEF\u4E0D\u53D7\u5F71\u54CD\uFF09", {
-      message: String(error62?.message ?? error62).slice(0, 200)
-    });
-  }
   return {
     config: config2,
     state,
     createPairing,
-    sessionWorkspace(sessionId) {
-      try {
-        return kernel?.sessionWorkspace?.(sessionId);
-      } catch {
-        return void 0;
-      }
-    },
     stop() {
       oneShot.cancelAll();
-      sidebar?.stop();
+      pillRoutes?.stop();
       status.stop();
       runtime?.stop();
       relay?.stop();
@@ -34336,20 +34091,6 @@ function applyInner(ctx, injected) {
     }
   };
 }
-function writePairingImage(file2, qrText, config2, log) {
-  if (!config2.qrImage || !file2) return;
-  qrPng(qrText).then((buffer) => {
-    if (!writePrivateFile(file2, buffer)) {
-      log("qr png write failed", { file: file2 });
-      return;
-    }
-    if (!config2.qrOpen) return;
-    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", "", file2] : [file2];
-    execFile(opener, args, () => {
-    });
-  }).catch((error62) => log("qr png render failed", { message: String(error62?.message ?? error62) }));
-}
 export {
   DEFAULT_CONFIG,
   apply,