dsh-remote-control 1.1.0 → 2.0.0

package/dist/bundle/index.js

@@ -4501,7 +4501,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash3 } = __require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash4 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -5182,7 +5182,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -5551,7 +5551,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash3 } = __require("crypto");
+    var { createHash: createHash4 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -5858,7 +5858,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -7486,10 +7486,10 @@ var require_segments = __commonJS({
       const segs = getSegmentsFromString(data, Utils.isKanjiModeEnabled());
       const nodes = buildNodes(segs);
       const graph = buildGraph(nodes, version2);
-      const path5 = dijkstra.find_path(graph.map, "start", "end");
+      const path6 = dijkstra.find_path(graph.map, "start", "end");
       const optimizedSegs = [];
-      for (let i = 1; i < path5.length - 1; i++) {
-        optimizedSegs.push(graph.table[path5[i]].node);
+      for (let i = 1; i < path6.length - 1; i++) {
+        optimizedSegs.push(graph.table[path6[i]].node);
       }
       return exports.fromArray(mergeSegments(optimizedSegs));
     };
@@ -9966,7 +9966,7 @@ var require_png2 = __commonJS({
       });
       png.pack();
     };
-    exports.renderToFile = function renderToFile(path5, qrData, options, cb) {
+    exports.renderToFile = function renderToFile(path6, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
@@ -9977,7 +9977,7 @@ var require_png2 = __commonJS({
         called = true;
         cb.apply(null, args);
       };
-      const stream = fs.createWriteStream(path5);
+      const stream = fs.createWriteStream(path6);
       stream.on("error", done);
       stream.on("close", done);
       exports.renderToFileStream(stream, qrData, options);
@@ -10039,14 +10039,14 @@ var require_utf8 = __commonJS({
       }
       return output2;
     };
-    exports.renderToFile = function renderToFile(path5, qrData, options, cb) {
+    exports.renderToFile = function renderToFile(path6, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
       }
       const fs = __require("fs");
       const utf82 = exports.render(qrData, options);
-      fs.writeFile(path5, utf82, cb);
+      fs.writeFile(path6, utf82, cb);
     };
   }
 });
@@ -10167,7 +10167,7 @@ var require_svg_tag = __commonJS({
       return str;
     }
     function qrToPath(data, size, margin) {
-      let path5 = "";
+      let path6 = "";
       let moveBy = 0;
       let newRow = false;
       let lineLength = 0;
@@ -10178,19 +10178,19 @@ var require_svg_tag = __commonJS({
         if (data[i]) {
           lineLength++;
           if (!(i > 0 && col > 0 && data[i - 1])) {
-            path5 += newRow ? svgCmd("M", col + margin, 0.5 + row + margin) : svgCmd("m", moveBy, 0);
+            path6 += newRow ? svgCmd("M", col + margin, 0.5 + row + margin) : svgCmd("m", moveBy, 0);
             moveBy = 0;
             newRow = false;
           }
           if (!(col + 1 < size && data[i + 1])) {
-            path5 += svgCmd("h", lineLength);
+            path6 += svgCmd("h", lineLength);
             lineLength = 0;
           }
         } else {
           moveBy++;
         }
       }
-      return path5;
+      return path6;
     }
     exports.render = function render(qrData, options, cb) {
       const opts = Utils.getOptions(options);
@@ -10198,10 +10198,10 @@ var require_svg_tag = __commonJS({
       const data = qrData.modules.data;
       const qrcodesize = size + opts.margin * 2;
       const bg = !opts.color.light.a ? "" : "<path " + getColorAttrib(opts.color.light, "fill") + ' d="M0 0h' + qrcodesize + "v" + qrcodesize + 'H0z"/>';
-      const path5 = "<path " + getColorAttrib(opts.color.dark, "stroke") + ' d="' + qrToPath(data, size, opts.margin) + '"/>';
+      const path6 = "<path " + getColorAttrib(opts.color.dark, "stroke") + ' d="' + qrToPath(data, size, opts.margin) + '"/>';
       const viewBox = 'viewBox="0 0 ' + qrcodesize + " " + qrcodesize + '"';
       const width = !opts.width ? "" : 'width="' + opts.width + '" height="' + opts.width + '" ';
-      const svgTag = '<svg xmlns="http://www.w3.org/2000/svg" ' + width + viewBox + ' shape-rendering="crispEdges">' + bg + path5 + "</svg>\n";
+      const svgTag = '<svg xmlns="http://www.w3.org/2000/svg" ' + width + viewBox + ' shape-rendering="crispEdges">' + bg + path6 + "</svg>\n";
       if (typeof cb === "function") {
         cb(null, svgTag);
       }
@@ -10215,7 +10215,7 @@ var require_svg = __commonJS({
   "../../node_modules/.pnpm/qrcode@1.5.4/node_modules/qrcode/lib/renderer/svg.js"(exports) {
     var svgTagRenderer = require_svg_tag();
     exports.render = svgTagRenderer.render;
-    exports.renderToFile = function renderToFile(path5, qrData, options, cb) {
+    exports.renderToFile = function renderToFile(path6, qrData, options, cb) {
       if (typeof cb === "undefined") {
         cb = options;
         options = void 0;
@@ -10223,7 +10223,7 @@ var require_svg = __commonJS({
       const fs = __require("fs");
       const svgTag = exports.render(qrData, options);
       const xmlStr = '<?xml version="1.0" encoding="utf-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">' + svgTag;
-      fs.writeFile(path5, xmlStr, cb);
+      fs.writeFile(path6, xmlStr, cb);
     };
   }
 });
@@ -10285,7 +10285,7 @@ var require_canvas = __commonJS({
 var require_browser = __commonJS({
   "../../node_modules/.pnpm/qrcode@1.5.4/node_modules/qrcode/lib/browser.js"(exports) {
     var canPromise = require_can_promise();
-    var QRCode3 = require_qrcode();
+    var QRCode2 = require_qrcode();
     var CanvasRenderer = require_canvas();
     var SvgRenderer = require_svg_tag();
     function renderCanvas(renderFunc, canvas, text, opts, cb) {
@@ -10328,7 +10328,7 @@ var require_browser = __commonJS({
         }
         return new Promise(function(resolve, reject) {
           try {
-            const data = QRCode3.create(text, opts);
+            const data = QRCode2.create(text, opts);
             resolve(renderFunc(data, canvas, opts));
           } catch (e) {
             reject(e);
@@ -10336,13 +10336,13 @@ var require_browser = __commonJS({
         });
       }
       try {
-        const data = QRCode3.create(text, opts);
+        const data = QRCode2.create(text, opts);
         cb(null, renderFunc(data, canvas, opts));
       } catch (e) {
         cb(e);
       }
     }
-    exports.create = QRCode3.create;
+    exports.create = QRCode2.create;
     exports.toCanvas = renderCanvas.bind(null, CanvasRenderer.render);
     exports.toDataURL = renderCanvas.bind(null, CanvasRenderer.renderToDataURL);
     exports.toString = renderCanvas.bind(null, function(data, _, opts) {
@@ -10355,7 +10355,7 @@ var require_browser = __commonJS({
 var require_server = __commonJS({
   "../../node_modules/.pnpm/qrcode@1.5.4/node_modules/qrcode/lib/server.js"(exports) {
     var canPromise = require_can_promise();
-    var QRCode3 = require_qrcode();
+    var QRCode2 = require_qrcode();
     var PngRenderer = require_png2();
     var Utf8Renderer = require_utf8();
     var TerminalRenderer = require_terminal2();
@@ -10381,8 +10381,8 @@ var require_server = __commonJS({
         cb
       };
     }
-    function getTypeFromFilename(path5) {
-      return path5.slice((path5.lastIndexOf(".") - 1 >>> 0) + 2).toLowerCase();
+    function getTypeFromFilename(path6) {
+      return path6.slice((path6.lastIndexOf(".") - 1 >>> 0) + 2).toLowerCase();
     }
     function getRendererFromType(type) {
       switch (type) {
@@ -10412,7 +10412,7 @@ var require_server = __commonJS({
       if (!params.cb) {
         return new Promise(function(resolve, reject) {
           try {
-            const data = QRCode3.create(text, params.opts);
+            const data = QRCode2.create(text, params.opts);
             return renderFunc(data, params.opts, function(err, data2) {
               return err ? reject(err) : resolve(data2);
             });
@@ -10422,13 +10422,13 @@ var require_server = __commonJS({
         });
       }
       try {
-        const data = QRCode3.create(text, params.opts);
+        const data = QRCode2.create(text, params.opts);
         return renderFunc(data, params.opts, params.cb);
       } catch (e) {
         params.cb(e);
       }
     }
-    exports.create = QRCode3.create;
+    exports.create = QRCode2.create;
     exports.toCanvas = require_browser().toCanvas;
     exports.toString = function toString(text, opts, cb) {
       const params = checkParams(text, opts, cb);
@@ -10446,17 +10446,17 @@ var require_server = __commonJS({
       const renderer = getRendererFromType(params.opts.type);
       return render(renderer.renderToBuffer, text, params);
     };
-    exports.toFile = function toFile(path5, text, opts, cb) {
-      if (typeof path5 !== "string" || !(typeof text === "string" || typeof text === "object")) {
+    exports.toFile = function toFile(path6, text, opts, cb) {
+      if (typeof path6 !== "string" || !(typeof text === "string" || typeof text === "object")) {
         throw new Error("Invalid argument");
       }
       if (arguments.length < 3 && !canPromise()) {
         throw new Error("Too few arguments provided");
       }
       const params = checkParams(text, opts, cb);
-      const type = params.opts.type || getTypeFromFilename(path5);
+      const type = params.opts.type || getTypeFromFilename(path6);
       const renderer = getRendererFromType(type);
-      const renderToFile = renderer.renderToFile.bind(null, path5);
+      const renderToFile = renderer.renderToFile.bind(null, path6);
       return render(renderToFile, text, params);
     };
     exports.toFileStream = function toFileStream(stream, text, opts) {
@@ -10655,10 +10655,9 @@ var init_mock_kernel = __esm({
 });
 
 // src/index.ts
-import { execFile } from "node:child_process";
-import { randomBytes as randomBytes4 } from "node:crypto";
+import path5 from "node:path";
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/crypto/bytes.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/crypto/bytes.js
 import { Buffer as Buffer2 } from "node:buffer";
 var encoder = new TextEncoder();
 var decoder = new TextDecoder("utf-8", { fatal: false });
@@ -10685,7 +10684,7 @@ function concat(parts) {
   return out;
 }
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/crypto/keys.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/crypto/keys.js
 import { createHash, randomBytes } from "node:crypto";
 var KDF_NAMESPACE = "dsh-rc/v1";
 var UNIT_SEPARATOR = 31;
@@ -10715,7 +10714,7 @@ function randomNonce() {
   return new Uint8Array(randomBytes(NONCE_BYTES));
 }
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/crypto/record.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/crypto/record.js
 var import_tweetnacl = __toESM(require_nacl_fast(), 1);
 var MAC_BYTES = 16;
 var MIN_RECORD_BYTES = NONCE_BYTES + MAC_BYTES;
@@ -10748,7 +10747,7 @@ function open(key, record2) {
   }
 }
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/identity/pairing.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/identity/pairing.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 var URI_PREFIX = "dshr:";
 var TOKEN_RE = /^\d{6}$/;
@@ -11594,10 +11593,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path6) {
+  if (!path6)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path6.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11937,11 +11936,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path6, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path6);
     return iss;
   });
 }
@@ -12391,16 +12390,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path5 = []) => {
+  const processError = (error63, path6 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -12439,17 +12438,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path5 = []) => {
+  const processError = (error63, path6 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -12488,8 +12487,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path5) {
+  const path6 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path6) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -29591,13 +29590,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path5 = ref.slice(1).split("/").filter(Boolean);
-  if (path5.length === 0) {
+  const path6 = ref.slice(1).split("/").filter(Boolean);
+  if (path6.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path5[0] === defsKey) {
-    const key = path5[1] === void 0 ? void 0 : decodeJSONPointerSegment(path5[1]);
+  if (path6[0] === defsKey) {
+    const key = path6[1] === void 0 ? void 0 : decodeJSONPointerSegment(path6[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -30446,7 +30445,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/wire/frames.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/wire/frames.js
 var PAIRING_TOKEN_RE = /^\d{6}$/;
 var nonEmpty = external_exports.string().min(1);
 var pairingToken = external_exports.string().regex(PAIRING_TOKEN_RE);
@@ -30469,8 +30468,7 @@ var helloFrame = external_exports.object({
 });
 var pairBeginFrame = external_exports.object({
   t: external_exports.literal("pair-begin"),
-  pairingToken,
-  hostLabel: external_exports.string().max(128).optional()
+  pairingToken
 });
 var pairClaimFrame = external_exports.object({
   t: external_exports.literal("pair-begin-client"),
@@ -30606,7 +30604,7 @@ function parseRelayFrameText(raw) {
   }
 }
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/wire/payloads.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/wire/payloads.js
 var SESSION_STATES = [
   "idle",
   "running",
@@ -30671,6 +30669,13 @@ var evPermissionRequest = external_exports.object({
   options: external_exports.array(choiceOption).optional(),
   expiresAt: external_exports.string().optional()
 });
+var evPermissionResolved = external_exports.object({
+  t: external_exports.literal("ev.permission_resolved"),
+  requestId: nonEmpty2,
+  sessionId: nonEmpty2.optional(),
+  /** 谁收的场。手机只按"要不要收掉这张卡"读它，所以不做必填。 */
+  by: external_exports.enum(["desktop", "cancelled"]).optional()
+});
 var questionItem = external_exports.object({
   id: nonEmpty2,
   question: nonEmpty2,
@@ -30681,7 +30686,23 @@ var evQuestionRequest = external_exports.object({
   t: external_exports.literal("ev.question_request"),
   sessionId: nonEmpty2.optional(),
   requestId: nonEmpty2,
-  questions: external_exports.array(questionItem)
+  questions: external_exports.array(questionItem),
+  /**
+   * 这张提问卡什么时候作废（ISO 字符串）。
+   *
+   * 为什么审批有而提问没有过：主机侧的提问等待本来就带超时（`questionTimeoutMs`，默认 300s），
+   * 但手机上那张卡**没有任何倒计时**——用户看不见自己按的按钮什么时候失效，
+   * 而这违反伞仓 `docs/PRODUCT.md` §3 第 3 条「超时必须可见」。
+   * 与审批那条同一个形状：可选、ISO 字符串、由主机每次发问时现算。
+   */
+  expiresAt: external_exports.string().optional()
+});
+var evQuestionResolved = external_exports.object({
+  t: external_exports.literal("ev.question_resolved"),
+  requestId: nonEmpty2,
+  sessionId: nonEmpty2.optional(),
+  /** 谁收的场。手机只按"要不要收掉这张卡"读它，所以不做必填。 */
+  by: external_exports.enum(["desktop", "cancelled"]).optional()
 });
 var evRunState = external_exports.object({
   t: external_exports.literal("ev.run_state"),
@@ -30698,6 +30719,24 @@ var evKeepAwakeState = external_exports.object({
   backend: nonEmpty2,
   reason: external_exports.string().optional()
 });
+var modelOption = external_exports.object({
+  /** 机器名（回传用），例如 `deepseek-chat`。 */
+  value: nonEmpty2,
+  /** 给人看的名字；缺省时小程序自己截断 `value`。 */
+  label: external_exports.string().optional(),
+  provider: external_exports.string().optional()
+});
+var evModel = external_exports.object({
+  t: external_exports.literal("ev.model"),
+  provider: nonEmpty2.optional(),
+  model: nonEmpty2,
+  /** 主机能不能换。false 时小程序**不许**渲染成可点的下拉。 */
+  canSwitch: external_exports.boolean(),
+  /** 候选清单；`canSwitch` 为 true 时至少一项。 */
+  options: external_exports.array(modelOption).optional(),
+  /** 不能切时给手机一句人话，直接显示，不要让小程序自己编措辞。 */
+  reason: external_exports.string().optional()
+});
 var evResult = external_exports.object({
   t: external_exports.literal("ev.result"),
   cmdId: external_exports.string(),
@@ -30719,9 +30758,12 @@ var evPayload = external_exports.discriminatedUnion("t", [
   evMessageDelta,
   evToolEvent,
   evPermissionRequest,
+  evPermissionResolved,
   evQuestionRequest,
+  evQuestionResolved,
   evRunState,
   evKeepAwakeState,
+  evModel,
   evResult,
   evSessionHistory
 ]);
@@ -30809,14 +30851,17 @@ var PAYLOAD_TYPES = {
   evMessageDelta: "ev.message_delta",
   evToolEvent: "ev.tool_event",
   evPermissionRequest: "ev.permission_request",
+  evPermissionResolved: "ev.permission_resolved",
   evQuestionRequest: "ev.question_request",
+  evQuestionResolved: "ev.question_resolved",
   evRunState: "ev.run_state",
   evKeepAwakeState: "ev.keep_awake_state",
+  evModel: "ev.model",
   evResult: "ev.result",
   evSessionHistory: "ev.session_history"
 };
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/wire/outbound.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/wire/outbound.js
 function sessionChanged(sessions, reason) {
   return { t: PAYLOAD_TYPES.evSessionChanged, sessions, ...reason === void 0 ? {} : { reason } };
 }
@@ -30829,15 +30874,31 @@ function toolEvent(args) {
 function permissionRequest(args) {
   return { t: PAYLOAD_TYPES.evPermissionRequest, ...args };
 }
+function permissionResolved(args) {
+  return { t: PAYLOAD_TYPES.evPermissionResolved, ...args };
+}
 function questionRequest(args) {
   return { t: PAYLOAD_TYPES.evQuestionRequest, ...args };
 }
+function questionResolved(args) {
+  return { t: PAYLOAD_TYPES.evQuestionResolved, ...args };
+}
 function runState(args) {
   return { t: PAYLOAD_TYPES.evRunState, ...args };
 }
 function keepAwakeState(args) {
   return { t: PAYLOAD_TYPES.evKeepAwakeState, ...args };
 }
+function model(args) {
+  const payload = { t: PAYLOAD_TYPES.evModel, model: args.model, canSwitch: args.canSwitch };
+  if (args.provider !== void 0)
+    payload.provider = args.provider;
+  if (args.canSwitch && args.options?.length)
+    payload.options = args.options;
+  if (args.reason !== void 0)
+    payload.reason = args.reason;
+  return payload;
+}
 function result(cmdId, ok, extras = {}) {
   const { message, data } = extras;
   return {
@@ -30859,7 +30920,7 @@ function sessionHistory(args) {
   };
 }
 
-// ../../node_modules/.pnpm/dsh-remote-wire@1.0.0/node_modules/dsh-remote-wire/dist/src/platform/sleep.js
+// ../../node_modules/.pnpm/dsh-remote-wire@1.2.0/node_modules/dsh-remote-wire/dist/src/platform/sleep.js
 function detectBackend(platform) {
   if (platform === "darwin")
     return "caffeinate";
@@ -31135,7 +31196,7 @@ var HostRuntime = class {
       this.clock.clearTimeout(this.mergeTimer);
       this.mergeTimer = void 0;
     }
-    for (const [id, item] of [...this.pending]) this.settle(id, void 0);
+    for (const [id] of [...this.pending]) this.settle(id, void 0);
   }
   /** 手机发来的命令。`conversationId` 是配对通道 id，与载荷里的 sessionId 不是一回事（F3）。 */
   async handleCommand(cmd, conversationId) {
@@ -31245,6 +31306,25 @@ var HostRuntime = class {
   get stats() {
     return { ...this.outboundCount };
   }
+  /**
+   * 有几件事正挂在手机上等回答，以及**最久的那件已经等了多久**（秒）。
+   *
+   * 为什么这条要出到界面上（而不只是内部状态）：一张挂起的审批阻塞着远端一条正在跑的回合，
+   * 而回合阻塞着用户的下班时间。桌面那颗 pill 原来在"已配对 + 有东西在等"时仍然只说
+   * `已配对`——那是这整条链上唯一看得见它的地方，等于没有。判据见伞仓 docs/PRODUCT.md §3。
+   *
+   * `oldestSec` 用 `clock.now()` 而不是 `Date.now()`： FakeClock 要能演"等了 4 分钟"，
+   * 否则这条时长在测试里永远是 0，也就永远不会红。
+   */
+  get waiting() {
+    const now = this.clock.now();
+    let oldest = 0;
+    for (const item of this.pending.values()) {
+      const age = Math.max(0, Math.floor((now - item.askedAt) / 1e3));
+      if (age > oldest) oldest = age;
+    }
+    return { count: this.pending.size, oldestSec: oldest };
+  }
   countOutbound(payload, sent) {
     const key = payload.t.replace(/^ev\./, "");
     this.outboundCount[key] = (this.outboundCount[key] ?? 0) + 1;
@@ -31322,8 +31402,40 @@ var HostRuntime = class {
     }
     this.broadcast(sessionChanged(this.sessions, reason));
     this.broadcast(keepAwakeState(this.sleep.snapshot()));
+    this.broadcastModel();
     return this.sessions;
   }
+  /**
+   * 广播当前模型。
+   *
+   * 跟着 `pushSessions` 一起发而不是单独起一条：模型与防休眠都是**全局状态**，
+   * 而 `pushSessions` 已经是"状态变了就推一次"的唯一入口，另开一条推送路径
+   * 必然出现「会话更新了但模型没更新」这种半同步状态。
+   *
+   * **读不到就不发**（而不是发一个 `model: ''`）：`ev.model` 的 `model` 是必填的
+   * 非空串，硬塞空串会让手机把「不知道用什么模型」显示成「模型名为空」——
+   * 后者看起来像 bug，前者只是没显示。内核缺 `currentSelection` 时真机上是常态
+   * （见 carrier 的 modelFace 探测）。
+   */
+  broadcastModel() {
+    let selection;
+    try {
+      selection = this.kernel.modelSelection?.();
+    } catch {
+      return;
+    }
+    if (!selection?.model) return;
+    const face = this.kernel.modelOptions?.();
+    this.broadcast(
+      model({
+        model: selection.model,
+        provider: selection.provider,
+        canSwitch: Boolean(face?.canSwitch),
+        options: face?.options,
+        reason: face?.canSwitch ? void 0 : face?.reason ?? "\u4E3B\u673A\u5185\u6838\u672A\u63D0\u4F9B\u5207\u6362\u6A21\u578B\u7684\u80FD\u529B"
+      })
+    );
+  }
   refreshLoop() {
     if (this.stopped) return;
     void this.pushSessions("refresh");
@@ -31337,24 +31449,33 @@ var HostRuntime = class {
    * **没有在线对端就返回 `'decline'`**，让适配器去调平台的 `next()` 把决定权交还桌面 UI；
    * 超时同样返回 `'decline'`（我们已经把卡片发出去了，但手机迟迟没点，
    * 与其替用户决定，不如让桌面去决定）。
+   *
+   * 返回值只说明"手机这一侧算出了什么"，**不代表这张卡是手机答掉的**：
+   * 桌面与手机是同时被问的（见 `carrier-services.ts` 的 `participate`），
+   * 所以收尾时要按"有没有真的有人在手机上点过"决定要不要把卡收回去。
    */
   async onApprovalRequest(info) {
     const conversationId = this.pickConversation(info.sessionId);
-    if (!conversationId || !this.transport.hasPeer(conversationId)) return "decline";
+    if (!conversationId || !this.transport.hasClient(conversationId)) return "decline";
     const id = `ap_${randomUUID().slice(0, 8)}`;
     this.sleep.hold(id);
     const answered = await new Promise((resolve) => {
       const timer = this.clock.setTimeout(() => {
-        this.pending.delete(id);
-        resolve("decline");
+        this.settle(id, "decline", "timeout");
       }, this.options.approvalTimeoutMs);
       this.pending.set(id, {
         conversationId,
         sessionId: info.sessionId,
         resolve: (value) => resolve(value === void 0 ? "decline" : value),
-        timer
+        timer,
+        kind: "approval",
+        askedAt: this.clock.now()
       });
-      info.signal?.addEventListener("abort", () => this.settle(id, "cancelled"), { once: true });
+      info.signal?.addEventListener(
+        "abort",
+        () => this.settle(id, "cancelled", info.signal?.reason === "desktop" ? "desktop" : "withdrawn"),
+        { once: true }
+      );
       this.replyTo(
         conversationId,
         permissionRequest({
@@ -31362,7 +31483,8 @@ var HostRuntime = class {
           sessionId: info.sessionId,
           action: info.action,
           ...info.reason === void 0 ? {} : { reason: info.reason },
-          options: APPROVAL_OPTIONS
+          options: APPROVAL_OPTIONS,
+          expiresAt: new Date(Date.now() + this.options.approvalTimeoutMs).toISOString()
         })
       );
     });
@@ -31371,28 +31493,36 @@ var HostRuntime = class {
   }
   async onQuestionRequest(info) {
     const conversationId = this.pickConversation(info.sessionId);
-    if (!conversationId || !this.transport.hasPeer(conversationId)) return null;
+    if (!conversationId || !this.transport.hasClient(conversationId)) return null;
     const id = `q_${randomUUID().slice(0, 8)}`;
     this.sleep.hold(id);
     const answer = await new Promise((resolve) => {
       const timer = this.clock.setTimeout(() => {
-        this.pending.delete(id);
-        resolve(null);
+        this.settle(id, null, "timeout");
       }, this.options.questionTimeoutMs);
       this.pending.set(id, {
         conversationId,
         sessionId: info.sessionId,
         resolve: (value) => resolve(value ?? null),
         timer,
-        options: info.questions
+        options: info.questions,
+        kind: "question",
+        askedAt: this.clock.now()
       });
-      info.signal?.addEventListener("abort", () => this.settle(id, null), { once: true });
+      info.signal?.addEventListener(
+        "abort",
+        () => this.settle(id, null, info.signal?.reason === "desktop" ? "desktop" : "withdrawn"),
+        { once: true }
+      );
       this.replyTo(
         conversationId,
         questionRequest({
           requestId: id,
           sessionId: info.sessionId,
-          questions: info.questions
+          questions: info.questions,
+          // 提问这张卡以前**没有**到期时刻：主机 300 秒就判"没答上"，而手机上看不见任何倒计时，
+          // 用户不知道自己按的按钮什么时候作废（伞仓 docs/PRODUCT.md §3 第 3 条）。
+          expiresAt: new Date(Date.now() + this.options.questionTimeoutMs).toISOString()
         })
       );
     });
@@ -31424,13 +31554,45 @@ var HostRuntime = class {
     this.settle(requestId, value);
     return true;
   }
-  settle(id, value) {
+  settle(id, value, voidAs) {
     const item = this.pending.get(id);
     if (!item) return;
     this.pending.delete(id);
     this.clock.clearTimeout(item.timer);
+    if (voidAs) this.voidStaleCard(id, item, voidAs);
     item.resolve(value);
   }
+  /**
+   * 让手机上那张已经作废的卡片**当场**收掉：先按 `requestId` 发一条精确帧，
+   * 再补一帧 `ev.run_state` 兜住"手机上装的是老版小程序"这一档。
+   *
+   * 为什么要两条而不是一条：`ev.permission_resolved` / `ev.question_resolved` 是按
+   * `requestId` 收单的（一次答完不会误收别的会话、别的请求那张卡），但**用户手机上现在装的
+   * 那一版还不认这两帧**——小程序的分发是一串 `if (p.t === …)`，认不出来的 `t` 静默忽略。
+   * 而 `ev.run_state` 正好是它早就认的那条"挂着的审批/提问作废"信号
+   * （`pages/chat/chat.js` 的 `_onRunState` 同时清 `pendingPermission` 与 `pendingQuestion`，
+   * 并停掉那条还在走的本地倒数）。所以两条都发：新版手机收到精确帧就精收一张，
+   * 老版手机靠 `run_state` 也能当场收卡，不用等用户重新上传小程序。
+   *
+   * 内核**不会**为"审批/提问被别人答掉了"发状态跳变（这一回合自始至终是 running），
+   * 所以这一帧只能由我们补发；补的是**当前真相**而不是硬编码 `running`——
+   * 手机上那个"思考中"跟着这一帧走，发错方向会一直错到下一次真实跳变。
+   * 读不到真相时退回缓存快照，再退 `idle`：宁可少一个转圈，不能凭空多一个转圈。
+   */
+  voidStaleCard(requestId, item, reason) {
+    const by = reason === "desktop" ? "desktop" : "cancelled";
+    this.replyTo(
+      item.conversationId,
+      item.kind === "approval" ? permissionResolved({ requestId, sessionId: item.sessionId, by }) : questionResolved({ requestId, sessionId: item.sessionId, by })
+    );
+    const emit = (running) => {
+      this.broadcast(runState({ sessionId: item.sessionId, state: running ? "running" : "idle" }));
+      this.log("pending card voided", { requestId, reason, kind: item.kind, state: running ? "running" : "idle" });
+    };
+    void this.kernel.runState(item.sessionId).then((truth) => emit(truth.running)).catch(() => {
+      emit(this.sessions.some((session) => session.id === item.sessionId && session.running === true));
+    });
+  }
   /**
    * 挑一条配对通道把这轮交互发出去。
    *
@@ -31442,7 +31604,7 @@ var HostRuntime = class {
   pickConversation(_sessionId) {
     const ids = this.transport.conversationIds();
     if (ids.length === 0) return void 0;
-    return ids.find((id) => this.transport.hasPeer(id)) ?? ids[0];
+    return ids.find((id) => this.transport.hasClient(id)) ?? ids[0];
   }
   log(message, fields) {
     this.options.log?.(message, fields);
@@ -31604,6 +31766,10 @@ var DEFAULT_PRUNE_POLICY = {
   // 一天没有任何收发就认为这条通道不会再被用（手机真回来时会重新扫码，
   // 而且它会先撞上 `unknown_session` → 中文提示，而不是"永远转圈"）。
   idleTtlMs: 24 * 3600 * 1e3,
+  // 恢复出来的会话不按上面那条剪：默认给 7 天，与中继的 `DRC_CONV_IDLE_TTL_MS`
+  // （`config.ts` 的 7×24h）逐字对齐 —— 中继忘掉它的那天本来就得重扫，
+  // 主机提前剪只是把同一次重扫提前到用户还没察觉的时间点，反而更难解释。
+  restoredIdleTtlMs: 7 * 24 * 3600 * 1e3,
   maxConversations: 64
 };
 var ConversationBook = class {
@@ -31621,13 +31787,48 @@ var ConversationBook = class {
       kH2C: derivePskKey(args.psk, H2C, args.id),
       psk: args.psk,
       seqHost: 0,
-      generation: args.generation,
       createdAt: args.now,
       lastActivityAt: args.now
     };
     this.byId.set(args.id, conversation);
     return conversation;
   }
+  /**
+   * 从落盘记录恢复会话（跨进程续用，见 `shell/pair-store.ts`）。
+   *
+   * 两条刻意的选择：
+   *
+   * - **`clientIds` 一律置空**：那是"此刻谁连着"的瞬时态，进程刚起来时没有人连着主机。
+   *   填了旧值会让主机一启动就往每条会话广播，而手机端还没重连 ——
+   *   那些帧全被中继计成丢帧（`relay.ts` 的 `broadcast` 闸门当初就是为这个加的）。
+   *   手机回来发的第一帧会经 `RelayClient.onEncrypted` 把它重新登记进来。
+   * - **`restored: true`**：让剪枝对这条会话用另一条 TTL，理由见该字段的注释。
+   *
+   * 返回真正恢复出来的会话 id：**同一条 id 重复出现时后者覆盖前者**，
+   * 而一条形状不合的记录整条丢弃（宁可少一条通道，也不要一条解不开的）。
+   */
+  restore(records, now) {
+    const restored = [];
+    for (const record2 of records) {
+      const conversation = this.open({ id: record2.id, psk: record2.psk, now });
+      conversation.seqHost = record2.seqHost;
+      conversation.createdAt = record2.createdAt;
+      conversation.lastActivityAt = record2.lastActivityAt;
+      conversation.restored = true;
+      restored.push(record2.id);
+    }
+    return restored;
+  }
+  /** 导出可落盘的记录（**不含 clientIds**，理由见 `restore`）。 */
+  snapshot() {
+    return [...this.byId.values()].map((conversation) => ({
+      id: conversation.id,
+      psk: conversation.psk,
+      seqHost: conversation.seqHost,
+      createdAt: conversation.createdAt,
+      lastActivityAt: conversation.lastActivityAt
+    }));
+  }
   /** 有实际收发就记一笔活跃（剪枝只看这个时刻）。未知通道返回 false，不顺手建条目。 */
   touch(id, now) {
     const conversation = this.byId.get(id);
@@ -31641,33 +31842,43 @@ var ConversationBook = class {
   has(id) {
     return this.byId.has(id);
   }
+  /**
+   * 这条会话**现在有没有活着的客户端**。
+   *
+   * 与 `has()` 是两件事，而且必须分开：`has()` 是"我手里有这条通道的密钥"，
+   * 手机回前台时要用同一个 `convId` 回来，所以密钥**必须留着**（D3）；
+   * 但"有密钥"不等于"现在有人能收到"。
+   *
+   * 原来只有 `has()` 一个判据，于是 `hasPeer()` 答的是"有密钥"，广播就照着它发——
+   * 真机后果：手机断开之后（会话默认 7 天 TTL）主机每 15 秒仍往这条空会话发
+   * `session_changed` / `model` / `keep_awake_state` 三帧，中继每一帧计一次丢帧，
+   * 实测 45 秒涨 9、`/healthz` 的 `droppedFrames` 因此被这一路噪声主导（5737）。
+   */
+  hasClient(id) {
+    const conversation = this.byId.get(id);
+    return conversation !== void 0 && conversation.clientIds.size > 0;
+  }
   close(id) {
     return this.byId.delete(id);
   }
-  /** 中继重启（generation 变化）时把旧会话全部丢掉：它们再也解不开了。 */
-  closeBefore(generation) {
-    const dropped = [];
-    for (const [id, conversation] of [...this.byId]) {
-      if (conversation.generation < generation) {
-        this.byId.delete(id);
-        dropped.push(id);
-      }
-    }
-    return dropped;
-  }
   /**
    * 按策略剪枝，返回被剪掉的 id（调用方负责通知中继与上层，见
    * `RelayClient.pruneConversations`）。
    *
-   * 两条规则都做，因为它们是两种不同的失控：
+   * 三条规则，因为它们是三种不同的失控：
    * - 空闲超 TTL：一条通道一天没有任何收发，就不会再有人用它了；
+   * - **恢复出来的会话走另一条 TTL**（`restoredIdleTtlMs`）：见 `Conversation.restored`
+   *   与 `DEFAULT_PRUNE_POLICY.restoredIdleTtlMs` 的理由 —— 它不该按"新配对却没人用"的
+   *   标准剪掉，否则长假之后主机一启动就把唯一那条通道清了，免扫码重连白做；
    * - 超出硬上界：从**最不活跃**的开始剪。没有这条，一个每天配一次对的用户
    *   会在两周内攒下 260 条密钥，并且每次广播都对它们逐个密封一遍。
    */
   pruneStale(now, policy = DEFAULT_PRUNE_POLICY) {
     const dropped = [];
+    const restoredTtl = policy.restoredIdleTtlMs ?? policy.idleTtlMs;
     for (const [id, conversation] of [...this.byId]) {
-      if (now - conversation.lastActivityAt > policy.idleTtlMs) {
+      const ttl = conversation.restored ? restoredTtl : policy.idleTtlMs;
+      if (now - conversation.lastActivityAt > ttl) {
         this.byId.delete(id);
         dropped.push(id);
       }
@@ -31684,6 +31895,25 @@ var ConversationBook = class {
   ids() {
     return [...this.byId.keys()];
   }
+  /**
+   * 当前**真正连着**的客户端数（去重后的 clientId，不是会话数）。
+   *
+   * 为什么必须单独算：一条会话（convId）对应一次配对，而**同一部手机**在
+   * 「解除配对再重新配对」之后会开一条新会话 —— 于是 `size`（会话数）会增长，
+   * 手机却还是那一台。把 `size` 当成"有几部手机"报出去，用户解除配对后看到
+   * 数字反而变大，会以为解配没生效。
+   *
+   * 反过来也算不准：会话被剪掉了但手机还在（`pruneStale`），
+   * 所以这个数只保证"不比会话数更离谱"，不保证等于真实在线数 ——
+   * 界面上它只该当"有手机连着没有"的粗判据，不该当精确计数。
+   */
+  clientCount() {
+    const ids = /* @__PURE__ */ new Set();
+    for (const conversation of this.byId.values()) {
+      for (const clientId of conversation.clientIds) ids.add(clientId);
+    }
+    return ids.size;
+  }
   get size() {
     return this.byId.size;
   }
@@ -31850,6 +32080,14 @@ var RelayClient = class {
   options;
   conversations = new ConversationBook();
   socket;
+  /**
+   * **主机侧连接代号**：每收到一次 `hello-ok` 就 +1。
+   *
+   * 它现在**只**喂给 `PairingWindow`（"中继的 pending-pair 表是不是清空了"），
+   * 绝不用来清会话 —— 理由见文件头。它递增本身没有权威性（中继不回代次），
+   * 所以配对窗口用它判"换码"是保守正确的：中继真重启时代次一定变了，
+   * 中继没重启时多换一张码的代价只是浪费一个 6 位码。
+   */
   generation = 0;
   attempts = 0;
   stopped = false;
@@ -31863,6 +32101,39 @@ var RelayClient = class {
   get conversationCount() {
     return this.conversations.size;
   }
+  /**
+   * 当前连着的**手机台数**（去重的 clientId）。
+   *
+   * 与 `conversationCount` 分开是因为「解除配对 → 重新配对」会开一条新会话，
+   * 手机却还是那一台：拿会话数当手机数报，用户解完配对看到数字变大，
+   * 会以为解配没生效。
+   */
+  get clientCount() {
+    return this.conversations.clientCount();
+  }
+  /** 本轮已连上的中继代号（`status.json` 与配对窗口都读它）。 */
+  get relayGeneration() {
+    return this.generation;
+  }
+  /**
+   * 恢复上次进程留下的会话（密钥来自 `pair-store`）。
+   *
+   * **恢复出来的会话里 `clientIds` 是空的**（见 `ConversationBook.restore`），所以
+   * `conversationCount > 0` 而 `clientCount === 0` 是这一阶段的正常形态：
+   * 密钥还在、手机还没回来。调用方据此知道**不能**等 `onPeerJoined` 才启动内核订阅
+   * —— 否则主机重启后手机能连上、主机却不订阅任何事件，表现与配对丢失一模一样。
+   */
+  restoreConversations(records) {
+    const restored = this.conversations.restore(records, this.options.clock.now());
+    if (restored.length > 0) {
+      this.options.log("conversations restored from disk", {
+        count: restored.length,
+        // 记一下有没有手机已经登记进来了：恢复阶段应当恒为 0。
+        clients: this.conversations.clientCount()
+      });
+    }
+    return restored;
+  }
   connect() {
     if (this.stopped) return;
     this.closeSocket();
@@ -31937,23 +32208,34 @@ var RelayClient = class {
       this.options.log("pruned stale conversations", { count: dropped.length, remaining: this.conversations.size });
     return dropped;
   }
-  /** 向一条配对会话发一条载荷；返回 false = 这条会话已经没了或没人接。 */
+  /** 向一条配对会话发一条载荷；返回 false = 这条会话已经没了，或**现在没有活着的客户端**。 */
   send(conversationId, payload) {
     const conversation = this.conversations.get(conversationId);
     if (!conversation) return false;
+    if (conversation.clientIds.size === 0) return false;
     const record2 = seal(conversation.kH2C, payload);
     conversation.lastActivityAt = this.options.clock.now();
+    this.options.onBookActivity?.();
     return this.raw({ t: "enc", sessionId: conversationId, seq: ++conversation.seqHost, ciphertext: record2.ciphertext });
   }
   broadcast(payload) {
     let sent = 0;
     for (const id of this.conversations.ids()) {
+      if (!this.conversations.hasClient(id)) continue;
       if (this.send(id, payload)) sent += 1;
     }
     return sent;
   }
-  hasPeer(conversationId) {
-    return this.conversations.has(conversationId);
+  /**
+   * 这条会话**现在**有没有能收到东西的手机。
+   *
+   * 原来这个方法叫 `hasPeer`、答的是"我手里有没有这条通道的密钥"——两者在手机上线时恰好
+   * 同真，所以错误一直藏着：手机断开后审批仍然"发得出去"（发进一条空会话），
+   * 桌面那一半要等满 180 秒才拿到决定权。名字换成 `hasClient` 是为了让下一次
+   * 想写 `conversations.has()` 的人当场看见这两个概念不是一回事。
+   */
+  hasClient(conversationId) {
+    return this.conversations.hasClient(conversationId);
   }
   conversationIds() {
     return this.conversations.ids();
@@ -31979,6 +32261,7 @@ var RelayClient = class {
     this.voided.add(conversationId);
     this.undecryptable.delete(conversationId);
     this.conversations.close(conversationId);
+    this.options.onStructuralChange?.();
     this.raw({ t: "session-leave", sessionId: conversationId });
     this.options.onConversationGone(conversationId);
   }
@@ -32001,18 +32284,24 @@ var RelayClient = class {
     switch (frame.t) {
       case "hello-ok": {
         this.generation += 1;
-        const dropped = this.conversations.closeBefore(this.generation);
-        for (const id of dropped) this.options.onConversationGone(id);
         this.emitState("online");
         this.raw({ t: "resync", sessionIds: this.conversations.ids() });
-        this.options.log("relay online", { generation: this.generation, conversations: this.conversations.size });
+        this.options.log("relay online", {
+          generation: this.generation,
+          conversations: this.conversations.size,
+          clients: this.conversations.clientCount()
+        });
         return;
       }
       case "pair-ready":
         this.options.onPairReady(frame.pairingToken, frame.ttlMs);
         return;
       case "peer-joined": {
-        if (!frame.pairingToken) return;
+        if (!frame.pairingToken) {
+          const conversation = this.conversations.get(frame.sessionId);
+          if (conversation && frame.clientId) conversation.clientIds.add(frame.clientId);
+          return;
+        }
         const slot = this.options.lookupPairingSlot(frame.pairingToken);
         if (!slot) {
           this.options.log("peer-joined without a known pairing token", { sessionId: frame.sessionId });
@@ -32021,9 +32310,10 @@ var RelayClient = class {
         this.conversations.open({
           id: frame.sessionId,
           psk: slot.psk,
-          generation: this.generation,
           now: this.options.clock.now()
         });
+        this.options.onStructuralChange?.();
+        if (frame.clientId) this.conversations.get(frame.sessionId)?.clientIds.add(frame.clientId);
         this.voided.delete(frame.sessionId);
         this.raw({ t: "resync", sessionIds: this.conversations.ids() });
         this.emitState("online");
@@ -32031,6 +32321,7 @@ var RelayClient = class {
         return;
       }
       case "peer-left":
+        if (frame.clientId) this.conversations.get(frame.sessionId)?.clientIds.delete(frame.clientId);
         this.options.onClientLeft(frame.sessionId, frame.clientId);
         this.emitState("online");
         return;
@@ -32063,6 +32354,7 @@ var RelayClient = class {
       this.voidConversation(frame.sessionId);
       return;
     }
+    if (frame.clientId) conversation.clientIds.add(frame.clientId);
     const records = frame.items ?? (frame.ciphertext === void 0 ? [] : [{ ciphertext: frame.ciphertext }]);
     let decryptedAny = false;
     for (const record2 of records) {
@@ -32081,8 +32373,11 @@ var RelayClient = class {
       decryptedAny = true;
       this.options.onCommand(frame.sessionId, cmd, frame.clientId);
     }
-    if (decryptedAny) conversation.lastActivityAt = this.options.clock.now();
-    if (decryptedAny) this.undecryptable.delete(frame.sessionId);
+    if (decryptedAny) {
+      conversation.lastActivityAt = this.options.clock.now();
+      this.options.onBookActivity?.();
+      this.undecryptable.delete(frame.sessionId);
+    }
   }
   /** 两次解不开就作废（与手机端"两帧解不开就丢配对"对称，避免一端永久静默）。 */
   noteUndecryptable(conversationId) {
@@ -32119,7 +32414,10 @@ var RelayClient = class {
     this.options.onState({
       relay,
       ...problem === void 0 ? {} : { problem },
-      clients: this.conversations.size,
+      // 之前这里写的是 `conversations.size`，把"会话数"顶替成了"客户端数"：
+      // 一部手机解配再重配就多一条会话，于是这个字段会**变大** ——
+      // 拿它回答"现在有几台手机连着"会得出相反的结论。
+      clients: this.conversations.clientCount(),
       conversations: this.conversations.size,
       generation: this.generation
     });
@@ -32231,7 +32529,7 @@ var WATERFALL_EVENTS = [
   "tools/post-execute",
   "tools/code-dispatch-log"
 ];
-var WATERFALL_PARTICIPANTS = ["approval/request"];
+var WATERFALL_PARTICIPANTS = ["approval/request", "user-questions/request"];
 var allowed = new Set(SUBSCRIBABLE_EVENTS);
 var participants = new Set(WATERFALL_PARTICIPANTS);
 function canParticipate(name) {
@@ -32266,11 +32564,45 @@ function guardedSubscribe(on, name, listener, warn) {
 }
 
 // src/platform/carrier-services.ts
+var PARTICIPATE_OPTIONS = { global: true, prepend: true };
+var PARTICIPATED_EVENTS = ["approval/request", "user-questions/request"];
+function fuseSignals(platform, ours) {
+  if (!platform) return ours;
+  const any2 = AbortSignal.any;
+  if (typeof any2 === "function") return any2.call(AbortSignal, [platform, ours]);
+  const fused = new AbortController();
+  for (const source of [platform, ours]) {
+    if (fused.signal.aborted) break;
+    if (source.aborted) {
+      fused.abort(source.reason);
+      break;
+    }
+    source.addEventListener("abort", () => fused.abort(source.reason), { once: true });
+  }
+  return fused.signal;
+}
 var MAX_TITLE_BATCH_DEFAULT = 25;
 var TITLE_TIMEOUT_DEFAULT = 4e3;
 var HISTORY_TIMEOUT_DEFAULT = 15e3;
 var CREATE_TIMEOUT_DEFAULT = 8e3;
 var LIST_LIMIT_DEFAULT = 100;
+var MODEL_FACE_METHODS = [
+  "currentSelection",
+  "list",
+  "listModels",
+  "available",
+  "availableModels",
+  "selections",
+  "options",
+  "get",
+  "set",
+  "select",
+  "setSelection",
+  "setDefault",
+  "update"
+];
+var MODEL_LIST_METHODS = /* @__PURE__ */ new Set(["list", "listModels", "available", "availableModels", "selections", "options"]);
+var MODEL_SET_METHODS = /* @__PURE__ */ new Set(["set", "select", "setSelection", "setDefault", "update"]);
 function createServicesKernel(services, options) {
   const log = (message, fields = {}) => options.log?.(message, fields);
   const titleCache = /* @__PURE__ */ new Map();
@@ -32279,8 +32611,25 @@ function createServicesKernel(services, options) {
   const unmappedEventTypes = /* @__PURE__ */ new Set();
   const injectedUserMessages = /* @__PURE__ */ new Map();
   const listenerErrors = /* @__PURE__ */ new Map();
-  let approvalFace = "not-attached";
-  let questionsFace = "pending";
+  const faces = {
+    "approval/request": {
+      registered: "not-attached",
+      calls: 0,
+      last: "not-called",
+      desktopVoided: 0,
+      handoff: "unknown"
+    },
+    "user-questions/request": {
+      registered: "not-attached",
+      calls: 0,
+      last: "not-called",
+      desktopVoided: 0,
+      handoff: "unknown"
+    }
+  };
+  let approvalAsked = 0;
+  let approvalDecided = "not-seen";
+  const modelMethods = [];
   const fn = (owner, name) => {
     if (!owner) return void 0;
     const value = owner[name];
@@ -32304,22 +32653,22 @@ function createServicesKernel(services, options) {
       return void 0;
     }
   }
+  function firstLiveAgent() {
+    const list = fn(services.agents, "list");
+    if (list) {
+      try {
+        const all = list.call(services.agents);
+        if (Array.isArray(all) && all.length) return all[0];
+      } catch {
+      }
+    }
+    return void 0;
+  }
   function agentStatus(sessionId) {
     const agent = liveAgent(sessionId);
     const status = agent?.status;
     return typeof status === "string" ? status : "idle";
   }
-  function sessionWorkspace(sessionId) {
-    const get = fn(services.sessions, "get");
-    if (!get || sessionId === "") return void 0;
-    try {
-      const session = get.call(services.sessions, sessionId);
-      const cwd = session?.header?.cwd ?? session?.cwd;
-      return typeof cwd === "string" && cwd !== "" ? cwd : void 0;
-    } catch {
-      return void 0;
-    }
-  }
   function toSummary(record2, archived) {
     const cached2 = titleCache.get(record2.id);
     const running = agentStatus(record2.id) === "running";
@@ -32479,6 +32828,27 @@ function createServicesKernel(services, options) {
       return void 0;
     }
   }
+  function probeModelFace() {
+    const owner = services.agentDefaultModel;
+    if (!owner) return { hits: [], canList: false, canSet: false };
+    const hits = [];
+    for (const name of MODEL_FACE_METHODS) {
+      if (fn(owner, name)) hits.push(name);
+    }
+    modelMethods.length = 0;
+    modelMethods.push(...hits);
+    return {
+      hits,
+      canList: hits.some((n) => MODEL_LIST_METHODS.has(n)),
+      canSet: hits.some((n) => MODEL_SET_METHODS.has(n))
+    };
+  }
+  function modelFaceSummary() {
+    if (!services.agentDefaultModel) return "absent";
+    const { hits, canList, canSet } = probeModelFace();
+    if (!hits.length) return `none (tried=${MODEL_FACE_METHODS.length})`;
+    return `${canList ? "list" : "no-list"}+${canSet ? "set" : "no-set"} via=${hits.join(",")}`.slice(0, 180);
+  }
   async function sendPrompt(sessionId, text) {
     const agent = liveAgent(sessionId);
     if (!agent) return { ok: false, message: `\u4F1A\u8BDD\u6CA1\u6709\u6D3B\u7684 agent\uFF08agents.get(${sessionId}) \u4E3A\u7A7A\uFF0C\u8BF7\u5148\u6062\u590D\u4F1A\u8BDD\uFF09` };
@@ -32603,6 +32973,8 @@ function createServicesKernel(services, options) {
     if (!sessionId || !type) return;
     seenEventTypes.add(type);
     const data = event?.data ?? {};
+    if (type === "approval/asked") approvalAsked += 1;
+    if (type === "approval/decided") approvalDecided = String(data.outcome ?? "?");
     for (const mapped of sessionEventKernelEvents({ sessionId, type, seq: event?.seq, data })) {
       if (mapped.kind === "title") titleCache.set(sessionId, { title: mapped.title, at: options.clock.now() });
       onEvent(mapped);
@@ -32629,59 +33001,34 @@ function createServicesKernel(services, options) {
     sink = next;
     const disposers = [];
     const on = services.on;
-    if (typeof on === "function") {
-      const name = "approval/request";
-      if (canParticipate(name)) {
-        const listener = (...args) => participate(args);
-        try {
-          const disposer = on.call(services, name, listener);
-          approvalFace = "registered";
-          disposers.push(() => {
-            if (typeof disposer === "function") disposer();
-            else if (typeof services.off === "function") services.off(name, listener);
-          });
-        } catch (error62) {
-          approvalFace = `failed: ${messageOf3(error62)}`.slice(0, 80);
-          log("approval/request participation failed", { message: messageOf3(error62) });
-        }
-      } else {
-        approvalFace = "refused by guard";
-      }
-    } else {
-      approvalFace = "no on()";
-    }
-    const questions = services.userQuestions;
-    if (!options.takeOverQuestions) {
-      questionsFace = "not-taken-over";
-    } else if (!questions || typeof questions.registerProvider !== "function") {
-      questionsFace = `no registerProvider (keys=${questions ? shapeOf(questions) : "service absent"})`.slice(0, 120);
-    }
-    if (options.takeOverQuestions && questions && typeof questions.registerProvider === "function") {
-      const provider = {
-        ask: async (request) => {
-          const agent = request.agent;
-          const sessionId = String(agent?.session?.id ?? request.sessionId ?? "");
-          const items = Array.isArray(request.questions) ? request.questions : [];
-          const mapped = items.map((item, index) => mapQuestion(item, index));
-          const answer = await sink?.question({
-            sessionId,
-            questions: mapped,
-            ...request.signal ? { signal: request.signal } : {}
-          });
-          if (!answer) {
-            throw new Error("\u624B\u673A\u7AEF\u672A\u5E94\u7B54\u8FD9\u6B21\u63D0\u95EE\uFF08\u672A\u914D\u5BF9\u3001\u4E0D\u5728\u7EBF\u6216\u5DF2\u8D85\u65F6\uFF09");
-          }
-          return { answers: answer.answers };
-        }
+    if (typeof on !== "function") {
+      for (const name of PARTICIPATED_EVENTS) faces[name].registered = "no on()";
+      return () => {
+        sink = void 0;
       };
+    }
+    for (const name of PARTICIPATED_EVENTS) {
+      const face = faces[name];
+      if (!canParticipate(name)) {
+        face.registered = "refused by guard";
+        continue;
+      }
+      const listener = (...args) => participate(name, args);
       try {
-        const dispose = questions.registerProvider.call(questions, provider);
-        if (typeof dispose === "function") disposers.push(dispose);
-        questionsFace = "registered";
-        log("question provider taken over from the desktop UI");
+        const disposer = on.call(
+          services,
+          name,
+          listener,
+          PARTICIPATE_OPTIONS
+        );
+        face.registered = "registered";
+        disposers.push(() => {
+          if (typeof disposer === "function") disposer();
+          else if (typeof services.off === "function") services.off(name, listener);
+        });
       } catch (error62) {
-        questionsFace = `failed: ${messageOf3(error62)}`.slice(0, 80);
-        log("question provider registration failed", { message: messageOf3(error62) });
+        face.registered = `failed: ${messageOf3(error62)}`.slice(0, 80);
+        log(`${name} participation failed`, { message: messageOf3(error62) });
       }
     }
     return () => {
@@ -32694,23 +33041,103 @@ function createServicesKernel(services, options) {
       }
     };
   }
-  async function participate(args) {
+  async function participate(event, args) {
+    const isApproval = event === "approval/request";
+    const face = faces[event];
+    face.calls += 1;
     const request = args.find(
-      (arg) => arg && typeof arg === "object" && typeof arg.toolName === "string"
+      (arg) => Boolean(arg) && typeof arg === "object" && (isApproval ? typeof arg.toolName === "string" : Array.isArray(arg.questions))
     );
     const next = args.find((arg) => typeof arg === "function");
     const sessionId = String(request?.agent?.session?.id ?? "");
     if (!sink || !sessionId || !servicesPeers()) {
-      return String(await next?.() ?? "unavailable");
+      face.last = "handed-back(no phone target)";
+      const value = await next?.();
+      return isApproval ? String(value ?? "unavailable") : value;
+    }
+    const controller = new AbortController();
+    const platform = request?.signal;
+    if (platform) {
+      if (platform.aborted) controller.abort("platform");
+      else platform.addEventListener("abort", () => controller.abort("platform"), { once: true });
+    }
+    const canceller = new AbortController();
+    let handedOff = false;
+    if (request) {
+      try {
+        const fused = fuseSignals(platform, canceller.signal);
+        request.signal = fused;
+        handedOff = request.signal === fused;
+        face.handoff = handedOff ? "fused" : "ignored";
+      } catch (error62) {
+        face.handoff = `failed: ${messageOf3(error62)}`.slice(0, 80);
+      }
     }
-    const decision = await sink.approval({
+    const finish = (reason) => {
+      if (!canceller.signal.aborted) canceller.abort(reason);
+    };
+    const desktop = Promise.resolve().then(() => next?.()).then(
+      (value) => (
+        // `undefined` 是"这个参与者没认领"（会把整条链冲掉），不是答案；
+        // `'unavailable'` 是审批那条链末端的"没人可问"，也不是答案。
+        value === void 0 || isApproval && value === "unavailable" ? { answered: false, value } : { answered: true, value }
+      ),
+      (error62) => ({ answered: false, error: error62 })
+    );
+    const asked = isApproval ? sink.approval({
       sessionId,
       action: String(request?.toolName ?? "\u5DE5\u5177\u8C03\u7528"),
       ...request?.reason ? { reason: String(request.reason) } : {},
-      ...request?.signal ? { signal: request.signal } : {}
+      signal: controller.signal
+    }) : sink.question({
+      sessionId,
+      questions: (request?.questions ?? []).map((item, index) => mapQuestion(item, index)),
+      signal: controller.signal
+    });
+    const phone = asked.then(
+      (value) => (
+        // 每一支都**带着自己是谁**回来：`'rejected'` 这个词手机和桌面都可能给出，
+        // 只比数值就没法知道该收哪一张卡（第一版就是这么错的）。
+        isApproval ? value === "allowed-once" || value === "rejected" ? { answered: true, value } : { answered: false, value } : value === null || value === void 0 ? { answered: false, value } : { answered: true, value }
+      ),
+      // runtime 抛了（未配对、不在线、被撤）同样不算答案。
+      () => ({ answered: false })
+    );
+    const pending = new Promise(() => {
     });
-    if (decision === "decline") return String(await next?.() ?? "unavailable");
-    return decision;
+    const winner = await Promise.race([
+      phone.then((chain) => chain.answered ? { src: "phone", chain } : pending),
+      desktop.then((chain) => chain.answered ? { src: "desktop", chain } : pending),
+      Promise.all([phone, desktop]).then(([, chain]) => ({ src: "desktop", chain }))
+    ]);
+    if (!winner.chain.answered) {
+      controller.abort("desktop");
+      finish("settled-without-answer");
+      if (isApproval) {
+        face.last = "handed-back(neither answered)";
+        return "unavailable";
+      }
+      face.last = "no-answer";
+      if (winner.chain.error !== void 0) throw winner.chain.error;
+      throw new Error("\u624B\u673A\u7AEF\u672A\u5E94\u7B54\u8FD9\u6B21\u63D0\u95EE\uFF08\u672A\u914D\u5BF9\u3001\u4E0D\u5728\u7EBF\u6216\u5DF2\u8D85\u65F6\uFF09");
+    }
+    if (winner.src === "desktop") controller.abort("desktop");
+    if (winner.src === "phone") {
+      finish("answered-by-phone");
+      if (handedOff) face.desktopVoided += 1;
+    } else {
+      finish("answered-by-desktop");
+    }
+    face.last = `${winner.src === "phone" ? "answered-by-phone" : "answered-by-desktop"}(${describeOutcome(
+      isApproval,
+      winner.chain.value
+    )})`;
+    return winner.chain.value;
+  }
+  function describeOutcome(isApproval, value) {
+    if (isApproval) return String(value);
+    const answers = value?.answers;
+    return Array.isArray(answers) ? `${answers.length} \u9879` : typeof value;
   }
   function servicesPeers() {
     return sink !== void 0;
@@ -32746,10 +33173,25 @@ function createServicesKernel(services, options) {
     subscribe,
     attachInteractionSink,
     ensureRunnable,
-    sessionWorkspace,
     // 与发指令/续跑走同一条读取路径：这里原来还有一份实现，而且是 `current()` 裸调用
     // （不带 receiver；真要用 this 的服务方法会当场抛），两份迟早分叉。
     modelSelection: currentSelection,
+    /**
+     * 可切换模型清单。**这一代内核给不出清单也换不了**（`agentDefaultModel` 上只有
+     * `currentSelection`），所以这里报 `canSwitch: false` 并附一句人话。
+     *
+     * 报false 而不是省略这个方法：省略会被 core 当成"只读"但**说不出原因**，
+     * 手机上就只剩一个置灰的模型名，用户不知道是主机不支持还是自己哪里做错了。
+     */
+    modelOptions() {
+      const { hits, canList, canSet } = probeModelFace();
+      return {
+        // 两个都要有才算能切：只有 list 没有 set 时手机上会列出候选却点了没反应，
+        // 那比"换不了"更糟。
+        canSwitch: canList && canSet,
+        reason: canList && canSet ? void 0 : `\u4E3B\u673A\u5185\u6838\u53EA\u63D0\u4F9B\u8BFB\u53D6\uFF08\u547D\u4E2D\uFF1A${hits.join(",") || "\u65E0"}\uFF09`
+      };
+    },
     describe() {
       return {
         carrier: "services",
@@ -32761,22 +33203,47 @@ function createServicesKernel(services, options) {
         // 新建会话只依赖这一条。和 historyFace 同理：真机上"新建没反应"第一件要分清的事
         // 是宿主没有这个能力，还是我们没调对。
         createFace: typeof fn(services.sessionController?.commands, "create") === "function" ? "commands.create" : `absent (keys=${shapeOf(services.sessionController)})`.slice(0, 120),
-        // 二维码落点依赖这一条。它缺席时 PNG 会退回 ~/.dsh/，卡片上的路径会跟着变——
-        // 用户看到"图不在工作区"时，第一件事就是看这个字段是不是 absent。
-        workspaceFace: typeof fn(services.sessions, "get") === "function" ? "sessions.get" : `absent (keys=${shapeOf(services.sessions)})`.slice(0, 120),
+        // 第二条换模型的可能路径：命令控制器上自带的方法（`setModel` / `switchModel`…），
+        // 以及活agent 自己暴露的模型字段。前者能列出来就说明这条路通不通。
+        commandsFace: shapeOf(services.sessionController?.commands),
+        agentModelFields: (() => {
+          const first = firstLiveAgent();
+          if (!first) return "no-live-agent";
+          return Object.keys(first).filter((k) => /model|provider|preset/i.test(k)).slice(0, 8).join(",") || "none";
+        })(),
         agents: typeof services.agents === "object",
         agentDefaultModel: typeof services.agentDefaultModel === "object",
+        // 模型面到底有没有"写"的能力（能列可选、能切换）。手机上模型下拉该不该置灰，
+        // 取决于这个而不是取决于"读得到当前值" —— 读得到只够显示一行文字。
+        modelFace: modelFaceSummary(),
         workspaceRegistry: typeof services.workspaceRegistry === "object",
         userQuestions: typeof services.userQuestions === "object",
+        // 这个键**已经不生效**了：提问现在跟审批一样是 waterfall 参与者，两端同弹、
+        // 谁先答谁算，不再有"接管/取代桌面"这回事（那条 `registerProvider` 单提供者
+        // 路线在这一代宿主上根本不存在）。这里照实把配置值报出来，真正的状态看
+        // `questionsFace`。（删键要动 config.ts/index.ts，那两棵树此刻有并行会话在飞的改动。）
         takeOverQuestions: options.takeOverQuestions === true,
+        takeOverQuestionsInert: options.takeOverQuestions === true,
         archivedSessions: archivedIds().size,
         hasOn: typeof services.on === "function",
         // 真机排错的第一现场：内核到底发了哪些事件类型、其中哪些我们没认。
         eventTypes: [...seenEventTypes].slice(-24).join("|"),
         unmappedEventTypes: [...unmappedEventTypes].join("|"),
         injectedUserMessages: [...injectedUserMessages].map(([kind, count]) => `${count}\xD7${kind}`).join("|") || "none",
-        approvalFace,
-        questionsFace,
+        approvalFace: faces["approval/request"].registered,
+        approvalCalls: faces["approval/request"].calls,
+        approvalLast: faces["approval/request"].last,
+        approvalAsked,
+        approvalDecided,
+        approvalDesktopVoided: faces["approval/request"].desktopVoided,
+        approvalSignalHandoff: faces["approval/request"].handoff,
+        // 提问那一条与审批同构，所以读数也同一套：登记结果 / 被派发几次 / 最后走到哪一步 /
+        // 手机先答时撤销了几次下游 signal / 那份 signal 换没换成功。
+        questionsFace: faces["user-questions/request"].registered,
+        questionsCalls: faces["user-questions/request"].calls,
+        questionsLast: faces["user-questions/request"].last,
+        questionsDesktopVoided: faces["user-questions/request"].desktopVoided,
+        questionsSignalHandoff: faces["user-questions/request"].handoff,
         listenerErrors: [...listenerErrors].slice(0, 4).map(([key, count]) => `${count}\xD7${key}`).join(" | ") || "none"
       };
     }
@@ -32798,17 +33265,19 @@ function sessionEventKernelEvents(input2) {
   switch (type) {
     case "turn/start":
       return [{ kind: "run-state", sessionId, state: "running" }];
-    case "assistant/message":
+    case "assistant/message": {
+      const text = stripToolCallXml(textOf(data));
       return [
         {
           kind: "delta",
           sessionId,
           messageId: messageIdOf(data, input2.seq),
-          text: textOf(data),
+          text,
           role: "assistant",
           done: true
         }
       ];
+    }
     case "user/message": {
       if (!isHumanUserMessage(data)) return [];
       return [
@@ -32831,8 +33300,8 @@ function sessionEventKernelEvents(input2) {
           callId: String(data.callId ?? data.id ?? `tool_${input2.seq ?? 0}`),
           phase: argsRaw === void 0 || argsRaw === null ? "started" : "args",
           tool: typeof data.name === "string" ? data.name : void 0,
-          title: typeof data.title === "string" ? data.title : previewOf(argsRaw),
-          ...argsRaw === void 0 ? {} : { argsPreview: previewOf(argsRaw) }
+          title: typeof data.title === "string" ? data.title : argsTitle(argsRaw),
+          ...argsRaw === void 0 ? {} : { argsPreview: argsPreviewOf(argsRaw) }
         }
       ];
     }
@@ -32983,9 +33452,67 @@ function messageIdOf(data, seq) {
   if (typeof id === "string" && id) return id;
   return `msg_${String(seq ?? Date.now())}`;
 }
-function previewOf(value) {
+var TOOL_CALL_BLOCK = /<tool_call>\s*<function=[\s\S]*?<\/tool_call>/g;
+var TOOL_CALL_UNCLOSED = /<tool_call>\s*<function=[\s\S]*$/;
+function stripToolCallXml(text) {
+  const stripped = text.replace(TOOL_CALL_BLOCK, "").replace(TOOL_CALL_UNCLOSED, "");
+  return stripped.trim() === "" ? "" : stripped;
+}
+function argsTitle(argsRaw) {
+  const parsed = tryParseJson(argsRaw);
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    const record2 = parsed;
+    for (const key of ["description", "prompt", "command", "path", "file_path", "pattern", "query", "url"]) {
+      const value = record2[key];
+      if (typeof value === "string" && value.trim()) return oneLine(value);
+    }
+  }
+  return previewOf(argsRaw);
+}
+function argsPreviewOf(argsRaw) {
+  const parsed = tryParseJson(argsRaw);
+  if (parsed !== void 0) {
+    try {
+      return previewOf(JSON.stringify(parsed, null, 2));
+    } catch {
+    }
+  }
+  return previewOf(argsRaw);
+}
+function tryParseJson(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+}
+function oneLine(text) {
+  const flat = text.replace(/\s+/g, " ").trim();
+  return flat.length > 120 ? `${flat.slice(0, 120)}\u2026` : flat;
+}
+function readableText(value) {
   if (value === void 0 || value === null) return void 0;
-  const text = typeof value === "string" ? value : safeJson(value);
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) {
+    const parts = value.map((part) => readableText(part)).filter((part) => typeof part === "string" && part.length > 0);
+    return parts.length > 0 ? parts.join("\n") : void 0;
+  }
+  if (typeof value === "object") {
+    const record2 = value;
+    for (const key of ["content", "text", "output", "stdout", "stderr", "message", "result", "error"]) {
+      if (record2[key] === void 0 || record2[key] === null) continue;
+      const nested = readableText(record2[key]);
+      if (nested !== void 0 && nested !== "") return nested;
+    }
+    if (typeof record2.type === "string" && record2.type !== "text") return void 0;
+    return safeJson(record2);
+  }
+  return safeJson(value);
+}
+function previewOf(value) {
+  const text = readableText(value);
   if (!text) return void 0;
   return text.length > 200 ? `${text.slice(0, 200)}\u2026` : text;
 }
@@ -33049,7 +33576,6 @@ function createOneShotTimers(clock) {
 
 // src/shell/status.ts
 import { mkdirSync, renameSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import path from "node:path";
 var StatusFile = class {
   constructor(file2, clock, refreshMs = 3e3) {
@@ -33061,7 +33587,6 @@ var StatusFile = class {
   clock;
   refreshMs;
   timer;
-  lastWritten = 0;
   write(snapshot) {
     if (!this.file) return;
     try {
@@ -33075,7 +33600,6 @@ var StatusFile = class {
         }
       );
       renameSync(tmp, this.file);
-      this.lastWritten = this.clock.now();
     } catch {
     }
   }
@@ -33104,48 +33628,176 @@ var StatusFile = class {
       this.timer = void 0;
     }
   }
-  /** 此刻是否在按节拍刷新（测试与 status 自身的 `refreshing` 字段读它）。 */
-  get refreshing() {
-    return this.timer !== void 0;
+};
+
+// src/shell/host-id.ts
+import { randomBytes as randomBytes4 } from "node:crypto";
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import path2 from "node:path";
+var HOST_ID = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
+function newHostId() {
+  return `drc-${randomBytes4(6).toString("hex")}`;
+}
+function resolveHostId(dir, configured) {
+  if (configured) return configured;
+  if (!dir) return newHostId();
+  const file2 = path2.join(dir, "host-id");
+  let existing;
+  try {
+    existing = readFileSync(file2, "utf8").trim();
+  } catch {
+    existing = void 0;
   }
-  get path() {
-    return this.file;
+  if (existing !== void 0 && HOST_ID.test(existing)) return existing;
+  const fresh = newHostId();
+  try {
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync2(file2, `${fresh}
+`, {
+      encoding: "utf8",
+      mode: 384,
+      flag: existing === void 0 ? "wx" : "w"
+    });
+    chmodSync(file2, 384);
+    return fresh;
+  } catch {
+    try {
+      const raced = readFileSync(file2, "utf8").trim();
+      if (HOST_ID.test(raced)) return raced;
+    } catch {
+    }
+    return fresh;
   }
-};
-function pairingImagePath(statusFile, workspaceDir) {
+}
+
+// src/shell/pair-store.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import path3 from "node:path";
+var storedConversationSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  /** 配对 PSK（base64）。两把方向密钥在恢复时由它现派生，不落盘。 */
+  psk: external_exports.string().min(1),
+  /** host→client 方向的本地序号。中继会重新编号，客户端从不读它（F13），
+   *  但保留它能让恢复后的编号不跳号，便于对拍排查。 */
+  seqHost: external_exports.number().int().nonnegative(),
+  createdAt: external_exports.number().finite().nonnegative(),
+  lastActivityAt: external_exports.number().finite().nonnegative()
+});
+var storeSchema = external_exports.object({
+  version: external_exports.literal(1),
+  /** 这个文件属于哪台主机：换了主机身份就不该认（凭据不该跨身份复用）。 */
+  hostId: external_exports.string().min(1),
+  savedAt: external_exports.number().finite().nonnegative(),
+  conversations: external_exports.array(storedConversationSchema)
+});
+function safeSegment(hostId) {
+  const cleaned = hostId.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 48);
+  const tag = createHash2("sha256").update(hostId).digest("hex").slice(0, 8);
+  return `${cleaned || "host"}-${tag}`;
+}
+function defaultPairStoreFile(statusFile, hostId) {
   if (!statusFile) return "";
-  if (workspaceDir) return path.join(workspaceDir, ".dsh", "pairing-qr.png");
-  return path.join(homedir(), ".dsh", "pairing-qr.png");
+  return path3.join(path3.dirname(statusFile), `conversations-${safeSegment(hostId)}.json`);
 }
-function writePrivateFile(file2, data) {
-  if (!file2) return false;
+var PairStore = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  /** 上一次成功写盘的时刻，供 status.json 回答"这份落盘是什么时候的"。 */
+  savedAt = 0;
+  /** 上次 save 之后发生过任何变化（含只改了 lastActivityAt）。 */
+  dirty = false;
+  get file() {
+    return this.options.file;
+  }
+  get lastSavedAt() {
+    return this.savedAt;
+  }
+  /** 有没有待落盘的变更。status 的 3 秒 tick 用它决定是否真写盘。 */
+  get hasPendingChanges() {
+    return this.dirty;
+  }
+  /** 只标脏，不写盘。高频变动（每次广播都动 `seqHost`）走这条。 */
+  markDirty() {
+    this.dirty = true;
+  }
+  /**
+   * 读回本机的会话记录。
+   *
+   * 三种"读不出来"都归到**空簿 + 一条日志**，绝不抛（红线：插件起不来比丢配对更糟）：
+   * 文件不存在（第一次跑）、JSON 坏了（半写/被手改）、形状不认识（版本升级）。
+   * `hostId` 不匹配也算读不出来：那份文件属于另一台主机。
+   */
+  load() {
+    const { file: file2, hostId, log } = this.options;
+    if (!file2) return [];
+    let raw;
+    try {
+      raw = readFileSync2(file2, "utf8");
+    } catch {
+      return [];
+    }
+    const parsed = storeSchema.safeParse(safeJsonParse(raw));
+    if (!parsed.success) {
+      log?.("pair-store unreadable, starting with an empty book", {
+        reason: parsed.error.issues[0]?.message?.slice(0, 80) ?? "shape mismatch"
+      });
+      return [];
+    }
+    if (parsed.data.hostId !== hostId) {
+      log?.("pair-store belongs to another host, starting with an empty book", {
+        fileHostId: parsed.data.hostId.slice(0, 24)
+      });
+      return [];
+    }
+    this.savedAt = parsed.data.savedAt;
+    return parsed.data.conversations;
+  }
+  /**
+   * 写盘。**结构性的变化（新建/作废会话）必须立刻调这个**；
+   * 只改了 `lastActivityAt`/`seqHost` 的场合走 {@link markDirty}，由 3 秒 tick 批量落。
+   *
+   * 失败只记日志：写不进盘（目录只读、磁盘满）时，本次运行仍能正常收发，
+   * 只是下次重启要重新扫码 —— 那是可接受的退化，让插件崩掉不是。
+   */
+  save(conversations, now) {
+    const { file: file2, hostId, log } = this.options;
+    if (!file2) return false;
+    const body = JSON.stringify({ version: 1, hostId, savedAt: now, conversations }) + "\n";
+    const tmp = `${file2}.tmp-${process.pid}`;
+    try {
+      mkdirSync3(path3.dirname(file2), { recursive: true });
+      writeFileSync3(tmp, body, { encoding: "utf8", mode: 384 });
+      chmodSync2(tmp, 384);
+      renameSync2(tmp, file2);
+      this.savedAt = now;
+      this.dirty = false;
+      return true;
+    } catch (error62) {
+      log?.("pair-store save failed (pairing will need a rescan after the next restart)", {
+        message: String(error62?.message ?? error62).slice(0, 120)
+      });
+      try {
+        unlinkSync(tmp);
+      } catch {
+      }
+      return false;
+    }
+  }
+};
+function safeJsonParse(raw) {
   try {
-    mkdirSync(path.dirname(file2), { recursive: true });
-    writeFileSync(file2, data, { mode: 384 });
-    return true;
+    return JSON.parse(raw);
   } catch {
-    return false;
+    return void 0;
   }
 }
 
-// src/shell/pairing-text.ts
-var PAIR_UNAVAILABLE_TEXT = "\u4E2D\u7EE7\u8FD8\u6CA1\u8FDE\u4E0A\uFF0C\u6682\u65F6\u65E0\u6CD5\u914D\u5BF9\u3002\u770B status.json \u7684 relayProblem\u3002";
-function pairingPairText(view) {
-  const ttlSec = Math.max(0, Math.round((view.expiresAt - view.now) / 1e3));
-  const lines = [`\u914D\u5BF9\u7801 ${view.token} \xB7 ${ttlSec} \u79D2\u5185\u6709\u6548 \xB7 \u4E00\u6B21\u6027`, "\u5C0F\u7A0B\u5E8F\u91CC\u626B\u7801\uFF0C\u6216\u624B\u8F93\u8FD9 6 \u4F4D\u6570\u5B57\u3002"];
-  if (view.qrImage && view.imageFile) {
-    lines.push("", `\u4E8C\u7EF4\u7801\u4F1A\u81EA\u52A8\u5F39\u51FA\u5230\u53F3\u680F\uFF1B\u6CA1\u5F39\u51FA\u5C31\u6253\u5F00\u8FD9\u5F20 PNG \u518D\u626B\uFF1A${view.imageFile}`);
-  } else if (view.terminalQr) {
-    lines.push("", view.terminalQr);
-  }
-  lines.push("", view.qr);
-  if (!view.qrImage) lines.push("", "\uFF08\u5982\u9700\u56FE\u7247\u7248\uFF1A\u628A patch \u91CC\u7684 qrImage \u8BBE\u4E3A true\uFF09");
-  return lines.join("\n");
-}
-
 // src/shell/config.ts
-import { homedir as homedir2 } from "node:os";
-import path2 from "node:path";
+import { homedir } from "node:os";
+import path4 from "node:path";
 var DEFAULT_CONFIG = {
   enabled: true,
   serverUrl: "ws://127.0.0.1:8787",
@@ -33155,35 +33807,32 @@ var DEFAULT_CONFIG = {
   hostLabel: "dsh-host",
   keepAwake: { enabled: true, idleReleaseSec: 300, keepDisplay: false },
   mockBridge: false,
-  statusFile: path2.join(homedir2(), ".dsh", "dsh-remote-control", "status.json"),
+  statusFile: path4.join(homedir(), ".dsh", "dsh-remote-control", "status.json"),
   unarchiveOnPrompt: true,
   pairOnStartSec: 0,
   pairTtlMs: 12e4,
-  // **默认走图片**。2026-10-02 取证推翻了原判断（原判断：文本二维码在任何等宽渲染器下
-  // 都能扫，图片是可有可无的旁路）：
-  //   · DSH 命令卡的等宽输出块是 `white-space: pre` + `line-height: 1.6`（app bundle 里
-  //     的那条规则，实测行间留白约占行高 37%），每两行模块之间被塞进一条整行宽的缝隙，
-  //     半块二维码被横切成条。
-  //   · 用用户真机贴出来的那段输出做受控实验：把字号行距调到 1.0 时 zxing 解得出来，
-  //     调到 ≥1.15 就扫不出来；而 DSH 固定 1.6。也就是说"文本码能扫"在**唯一宿主**上不成立。
-  //   · 而 ANSI 反色救不了：TerminalBlock 把每行渲染成内联 span，背景只覆盖字形盒，
-  //     不覆盖行间留白（见 dsh-client-ui-primitives 的 parseAnsiLines/renderLine）。
-  // 图片是自包含位图矩阵，跟宿主的行高、字体、配色都无关——这才是"扫得出来"的那条路。
-  qrImage: true,
-  // 写图片 ≠ 替用户打开查看器：仍然默认关（原话「不要用打开一个图片的方式」）。
-  qrOpen: false,
-  qrAnsi: false,
-  qrStyle: "half",
   carrierGraceMs: 5e3,
   takeOverQuestions: false,
   approvalTimeoutSec: 180,
   listingRefreshSec: 15,
   conversationIdleTtlSec: 86400,
-  // 图默认落在会话工作区（`<workspace>/.dsh/sidebar-qr.png`），这里只是**兜底位**：
-  // 会话 → 工作区解析不出来时才用它。故意不写进 patch YAML——把某个人的家目录
-  // 焊进分发包是错的（拆分版同一理由）。
-  sidebarQr: { enabled: true, imageFile: path2.join(homedir2(), ".dsh", "sidebar-qr.png"), refreshMs: 2e3 }
+  // 恢复出来的会话按 7 天剪，与中继的 DRC_CONV_IDLE_TTL_MS 对齐（理由见该字段注释）。
+  restoredIdleTtlSec: 604800,
+  // 密钥簿落盘：默认跟着 statusFile 走（见 `resolvePairStoreFile`）。
+  pairStoreFile: "",
+  // 配对的唯一入口。关掉它 = 这台主机**没有**配对入口（`/drc pair` 与文本二维码都在
+  // 2026-10-03 删掉了），所以 index.ts 会把它记成一条 warn 而不是安静地什么都不做。
+  pill: { enabled: true }
 };
+var PAIR_STORE_OFF = "off";
+function resolvePairStoreFile(config2, hostId) {
+  if (config2.pairStoreFile === PAIR_STORE_OFF) return "";
+  const configured = config2.pairStoreFile.trim();
+  if (!configured) return defaultPairStoreFile(config2.statusFile, hostId);
+  if (configured.startsWith("/")) return configured;
+  if (!config2.statusFile) return configured;
+  return path4.join(path4.dirname(config2.statusFile), configured);
+}
 var loopback = /^wss?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/;
 var wsUrl = /^wss?:\/\/.+/;
 function envSeconds(value) {
@@ -33200,23 +33849,16 @@ function readConfig(injected, env = process.env) {
     ...DEFAULT_CONFIG,
     ...injected ?? {},
     keepAwake: { ...DEFAULT_CONFIG.keepAwake, ...injected?.keepAwake ?? {} },
-    // 折进来的那一半同样是**逐键合并**：patch 里只写 `sidebarQr.refreshMs` 时，
-    // enabled 与 imageFile 必须仍取默认值，而不是被整个对象覆盖成 undefined。
-    sidebarQr: { ...DEFAULT_CONFIG.sidebarQr, ...injected?.sidebarQr ?? {} }
+    // 逐键合并：patch 里只写 `pill.enabled` 时不能把整个对象覆盖掉（虽然它现在只有一个键，
+    // 但"注入对象整体替换默认对象"这个形状在 keepAwake 上已经坑过一次）。
+    pill: { ...DEFAULT_CONFIG.pill, ...injected?.pill ?? {} }
   };
   const fromEnv = (name) => env[name];
   if (fromEnv("DRC_SERVER_URL")) merged.serverUrl = env.DRC_SERVER_URL;
   if (fromEnv("DRC_HOST_LABEL")) merged.hostLabel = env.DRC_HOST_LABEL;
   if (fromEnv("DRC_HOST_ID")) merged.hostId = env.DRC_HOST_ID;
   if (fromEnv("DRC_PAIR_ON_START_SEC")) merged.pairOnStartSec = envSeconds(env.DRC_PAIR_ON_START_SEC);
-  if (fromEnv("DRC_QR_IMAGE")) merged.qrImage = envFlag(env.DRC_QR_IMAGE, merged.qrImage);
-  if (fromEnv("DRC_QR_OPEN")) merged.qrOpen = envFlag(env.DRC_QR_OPEN, merged.qrOpen);
-  if (fromEnv("DRC_QR_ANSI")) merged.qrAnsi = envFlag(env.DRC_QR_ANSI, merged.qrAnsi);
-  if (fromEnv("DRC_SIDEBAR_QR")) merged.sidebarQr.enabled = envFlag(env.DRC_SIDEBAR_QR, merged.sidebarQr.enabled);
-  if (fromEnv("DRC_QR_STYLE")) {
-    const style = env.DRC_QR_STYLE;
-    if (["ascii", "block", "half"].includes(style)) merged.qrStyle = style;
-  }
+  if (fromEnv("DRC_PILL")) merged.pill.enabled = envFlag(env.DRC_PILL, merged.pill.enabled);
   if (fromEnv("DRC_MOCK_BRIDGE") === "1") merged.mockBridge = true;
   if (fromEnv("DRC_TAKE_OVER_QUESTIONS") === "1") merged.takeOverQuestions = true;
   if (merged.hostTokenEnv) merged.hostToken = env[merged.hostTokenEnv] ?? merged.hostToken;
@@ -33267,21 +33909,6 @@ function validateConfig(config2) {
     problems.push({ level: "warn", field: "pairOnStartSec", message: "\u5FC5\u987B\u662F\u975E\u8D1F\u7684\u6709\u9650\u79D2\u6570\uFF0C\u5DF2\u6298\u56DE 0\uFF08\u5173\u95ED\u81EA\u52A8\u53D1\u7801\uFF09" });
     config2.pairOnStartSec = 0;
   }
-  if (config2.qrOpen && !config2.qrImage) {
-    problems.push({
-      level: "warn",
-      field: "qrOpen",
-      message: "qrOpen \u9700\u8981 qrImage=true \u624D\u4F1A\u5199\u56FE\u7247\u6587\u4EF6\uFF1B\u73B0\u5728\u53EA\u51FA\u6587\u672C\u4E8C\u7EF4\u7801\uFF08\u6587\u672C\u7801\u5728 DSH \u547D\u4EE4\u5361\u91CC\u626B\u4E0D\u51FA\u6765\uFF0C\u89C1 config.ts \u9ED8\u8BA4\u503C\u6CE8\u91CA\uFF09"
-    });
-  }
-  if (!["ascii", "block", "half"].includes(config2.qrStyle)) {
-    problems.push({
-      level: "warn",
-      field: "qrStyle",
-      message: `qrStyle \u53EA\u8BA4 ascii/block/half\uFF0C\u6536\u5230 ${JSON.stringify(config2.qrStyle)}\uFF0C\u5DF2\u9000\u56DE half`
-    });
-    config2.qrStyle = "half";
-  }
   if (!secondsSchema.safeParse(config2.conversationIdleTtlSec).success || config2.conversationIdleTtlSec <= 0) {
     problems.push({
       level: "warn",
@@ -33290,6 +33917,14 @@ function validateConfig(config2) {
     });
     config2.conversationIdleTtlSec = 86400;
   }
+  if (!secondsSchema.safeParse(config2.restoredIdleTtlSec).success || config2.restoredIdleTtlSec <= 0) {
+    problems.push({
+      level: "warn",
+      field: "restoredIdleTtlSec",
+      message: '\u5FC5\u987B\u662F\u6B63\u6570\u79D2\uFF1B\u8FD9\u91CC\u4E0D\u63A5\u53D7"\u6C38\u4E0D\u526A\u679D"\uFF08\u65E0\u754C\u7684 PSK \u7C3F\u662F\u590D\u6838 \u{1F7E1}8 \u7684\u539F\u59CB\u7F3A\u9677\uFF09\uFF0C\u5DF2\u5939\u56DE 604800'
+    });
+    config2.restoredIdleTtlSec = 604800;
+  }
   if (config2.pairOnStartSec > 0) {
     problems.push({
       level: "warn",
@@ -33307,77 +33942,18 @@ function validateConfig(config2) {
       message: "\u63D0\u95EE\u63A5\u7BA1\u4F1A**\u53D6\u4EE3\u684C\u9762 UI \u7684\u63D0\u95EE\u80FD\u529B**\uFF08ctx.userQuestions \u53EA\u5141\u8BB8\u4E00\u4E2A\u6D3B\u8DC3 provider\uFF09\uFF1B\u624B\u673A\u7AEF\u4E0D\u5728\u7EBF\u65F6\u63D0\u95EE\u4F1A\u76F4\u63A5\u5931\u8D25"
     });
   }
-  if (typeof config2.sidebarQr.imageFile !== "string" || config2.sidebarQr.imageFile === "") {
-    problems.push({
-      level: "warn",
-      field: "sidebarQr.imageFile",
-      message: "\u4E3A\u7A7A\u5C31\u65E0\u5904\u843D\u515C\u5E95\u56FE\uFF0C\u5DF2\u5939\u56DE ~/.dsh/sidebar-qr.png\uFF08\u5DE5\u4F5C\u533A\u89E3\u6790\u5F97\u51FA\u6765\u65F6\u672C\u6765\u4E5F\u7528\u4E0D\u5230\u5B83\uFF09"
-    });
-    config2.sidebarQr.imageFile = DEFAULT_CONFIG.sidebarQr.imageFile;
-  } else if (!path2.isAbsolute(config2.sidebarQr.imageFile)) {
-    problems.push({
-      level: "warn",
-      field: "sidebarQr.imageFile",
-      message: `\u4E0D\u662F\u7EDD\u5BF9\u8DEF\u5F84\uFF08${config2.sidebarQr.imageFile}\uFF09\uFF0C\u5DE5\u4F5C\u533A\u89E3\u6790\u4E0D\u51FA\u6765\u65F6\u4F1A\u88AB\u89E3\u6790\u5230\u8FDB\u7A0B\u5DE5\u4F5C\u76EE\u5F55\u4E0B`
-    });
-  }
-  if (!secondsSchema.safeParse(config2.sidebarQr.refreshMs).success || config2.sidebarQr.refreshMs < 200) {
-    problems.push({
-      level: "warn",
-      field: "sidebarQr.refreshMs",
-      message: "\u5FC5\u987B\u662F \u2265200 \u7684\u6709\u9650\u6BEB\u79D2\u6570\uFF0C\u5DF2\u5939\u56DE 2000\uFF08\u539F\u503C " + JSON.stringify(config2.sidebarQr.refreshMs) + "\uFF09"
-    });
-    config2.sidebarQr.refreshMs = DEFAULT_CONFIG.sidebarQr.refreshMs;
-  }
   return problems;
 }
-function redactSecret(value) {
+function redact(value) {
   if (value.length <= 8) return "****";
   return `${value.slice(0, 4)}\u2026${value.slice(-2)}(${value.length})`;
 }
 
+// src/pill/routes.ts
+import { createHash as createHash3 } from "node:crypto";
+
 // src/platform/qr.ts
 var import_qrcode = __toESM(require_lib(), 1);
-async function qrMatrix(text, ecc = "M", quietZone = 2) {
-  const qr = import_qrcode.default.create(text, { errorCorrectionLevel: ecc });
-  const size = qr.modules.size;
-  const total = size + quietZone * 2;
-  const out = [];
-  for (let y = 0; y < total; y++) {
-    const row = [];
-    for (let x = 0; x < total; x++) {
-      const mx = x - quietZone;
-      const my = y - quietZone;
-      const dark = mx >= 0 && mx < size && my >= 0 && my < size && Boolean(qr.modules.get(my, mx));
-      row.push(dark);
-    }
-    out.push(row);
-  }
-  return out;
-}
-async function renderTerminalQr(text, options = {}) {
-  const { ecc = "M", quietZone = 2, style = "ascii", ansi = false } = options;
-  const matrix = await qrMatrix(text, ecc, quietZone);
-  let body;
-  if (style === "half") {
-    const lines = [];
-    for (let y = 0; y < matrix.length; y += 2) {
-      const top = matrix[y];
-      const bottom = matrix[y + 1] ?? top.map(() => false);
-      let line = "";
-      for (let x = 0; x < top.length; x++) {
-        line += top[x] && bottom[x] ? "\u2588" : top[x] ? "\u2580" : bottom[x] ? "\u2584" : " ";
-      }
-      lines.push(line);
-    }
-    body = lines.join("\n");
-  } else {
-    const dark = style === "ascii" ? "##" : "\u2588\u2588";
-    const light = style === "ascii" ? ".." : "  ";
-    body = matrix.map((row) => row.map((cell) => cell ? dark : light).join("")).join("\n");
-  }
-  return ansi ? `\x1B[30;107m${body}\x1B[0m` : body;
-}
 async function qrPng(text, options = {}) {
   return import_qrcode.default.toBuffer(text, {
     errorCorrectionLevel: options.ecc ?? "M",
@@ -33387,112 +33963,19 @@ async function qrPng(text, options = {}) {
   });
 }
 
-// src/presentation/sidebar.ts
-import path4 from "node:path";
-
-// src/presentation/presenter.ts
-var import_qrcode2 = __toESM(require_lib(), 1);
-import { createHash as createHash2 } from "node:crypto";
-import { mkdirSync as mkdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import path3 from "node:path";
-function toEpochMs(value) {
-  if (typeof value === "number") return Number.isFinite(value) ? value : 0;
-  if (typeof value === "string") {
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? parsed : 0;
-  }
-  return 0;
-}
-var PairingPresenter = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  value = { state: "none" };
-  artifact = null;
-  rendering = false;
-  snapshot() {
-    return this.value;
-  }
-  /**
-   * 当前这一版的 PNG 字节；没有可看的码时是 null。
-   *
-   * **路由必须先拿它落盘成功，再回答 `ready`**——反过来就等于把用户送到一个不存在的
-   * 文件上（右栏会弹出一张破图，比不弹更糟）。
-   */
-  current() {
-    return this.value.state === "ready" ? this.artifact : null;
-  }
-  /**
-   * 看一眼当前的码。
-   *
-   * 三种结果：
-   * - 没有码 / 码已过期 → `none`（右栏不该被一张废码顶开）；
-   * - 码没变 → 只更新 `expiresAt`（同一版码的过期时间可能被服务端 TTL 改写）；
-   * - 码变了 → 渲染成功后认这一版；渲染抛错就是 `none`（宁可不弹，也不弹一张上一版的图）。
-   */
-  async observe(pairing) {
-    const qr = typeof pairing?.qr === "string" && pairing.qr !== "" ? pairing.qr : null;
-    const expiresAt = toEpochMs(pairing?.expiresAt);
-    if (qr === null || expiresAt <= this.deps.now()) {
-      this.value = { state: "none" };
-      this.artifact = null;
-      return;
-    }
-    const epoch = this.deps.digest(qr);
-    if (this.artifact?.epoch !== epoch) {
-      if (this.rendering) return;
-      this.rendering = true;
-      try {
-        const buffer = await this.deps.render(qr);
-        this.artifact = { epoch, buffer };
-      } catch (error62) {
-        this.artifact = null;
-        this.deps.log("\u4E8C\u7EF4\u7801\u6E32\u67D3\u5931\u8D25", { message: String(error62?.message ?? error62).slice(0, 200) });
-      } finally {
-        this.rendering = false;
-      }
-    }
-    this.value = this.artifact?.epoch === epoch ? { state: "ready", epoch, expiresAt } : { state: "none" };
-  }
-};
-function liveDeps(log) {
-  return {
-    now: () => Date.now(),
-    render: (qr) => import_qrcode2.default.toBuffer(qr, { errorCorrectionLevel: "M", margin: 4, scale: 8, type: "png" }),
-    digest: (qr) => createHash2("sha256").update(qr).digest("hex").slice(0, 16),
-    log
-  };
-}
-function writePrivatePng(file2, data) {
-  if (!file2) return false;
-  try {
-    mkdirSync2(path3.dirname(file2), { recursive: true });
-    const tmp = `${file2}.tmp-${process.pid}`;
-    writeFileSync2(tmp, data, { mode: 384 });
-    renameSync2(tmp, file2);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/presentation/address.ts
-var FILE_ADDRESS_PREFIX = "dsh-resource://file/";
-function encodeSegment(segment) {
-  return encodeURIComponent(segment).replace(/%3A/gi, ":");
-}
-function sessionFileAddress(sessionId, filePath) {
-  const normalized = filePath.replace(/\\/g, "/");
-  const encoded = normalized.split("/").map(encodeSegment).join("/");
-  return `${FILE_ADDRESS_PREFIX}session/${encodeSegment(sessionId)}/${encoded}`;
-}
-function isUsableSessionId(value) {
-  return typeof value === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(value);
+// src/pill/routes.ts
+var PAIR_NEW_ROUTE = "/plugins/dsh-remote-control/pairing/new";
+var PAIR_IMAGE_ROUTE = "/plugins/dsh-remote-control/pairing.png";
+var PAIR_STATUS_ROUTE = "/plugins/dsh-remote-control/status";
+var PAIR_UNPAIR_ROUTE = "/plugins/dsh-remote-control/unpair";
+var PAIR_MARKER_HEADER = "x-drc-pair";
+var PAIR_MARKER_VALUE = "1";
+function pairingEpoch(qr) {
+  return createHash3("sha256").update(qr).digest("hex").slice(0, 16);
+}
+async function renderPairingPng(qr) {
+  return qrPng(qr);
 }
-
-// src/presentation/route.ts
-var PAIRING_ROUTE = "/plugins/dsh-remote-control/pairing";
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
 function hostnameOf(host) {
   const trimmed = host.trim().toLowerCase();
@@ -33513,161 +33996,227 @@ function hostIsLoopback(host) {
   if (host === void 0 || host.trim() === "") return false;
   return LOOPBACK_HOSTS.has(hostnameOf(host));
 }
-function originIsLoopback(origin) {
-  if (origin === void 0) return true;
+function originIsLoopbackOrAbsent(origin) {
+  if (origin === void 0 || origin.trim() === "") return true;
+  return originLooksLikeTheHostItself(origin);
+}
+function originLooksLikeTheHostItself(origin) {
   try {
-    const { hostname: hostname3 } = new URL(origin);
-    return LOOPBACK_HOSTS.has(hostname3) || hostname3 === "::1";
+    const url2 = new URL(origin);
+    if (url2.protocol !== "http:" && url2.protocol !== "https:") return origin.trim() !== "null";
+    return LOOPBACK_HOSTS.has(url2.hostname);
   } catch {
     return false;
   }
 }
+function rejectedBy(request) {
+  if (!hostIsLoopback(request.headers.host)) return "host-not-loopback";
+  if (request.headers[PAIR_MARKER_HEADER] !== PAIR_MARKER_VALUE) return "pair-marker-missing";
+  const origin = request.headers.origin;
+  if (origin !== void 0 && origin.trim() !== "" && !originLooksLikeTheHostItself(origin)) return "origin-not-trusted";
+  return void 0;
+}
 function json2(response, status, body) {
   const payload = JSON.stringify(body);
   response.writeHead(status, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) });
   response.end(payload);
 }
-function pairingHandler(options) {
-  return async (request, response) => {
-    if (request.method !== "GET") {
+function pairNewHandler(deps) {
+  return (request, response) => {
+    if (request.method !== "POST") {
       json2(response, 405, { error: "method not allowed" });
       return;
     }
-    if (!hostIsLoopback(request.headers.host) || !originIsLoopback(request.headers.origin)) {
-      json2(response, 403, { error: "request-not-trusted" });
+    const guard = rejectedBy(request);
+    if (guard) {
+      deps.log("\u53D1\u7801\u8BF7\u6C42\u88AB\u5B88\u536B\u62D2", { guard });
+      json2(response, 403, { error: "request-not-trusted", guard });
       return;
     }
     try {
-      const url2 = new URL(request.url ?? "/", "http://dsh.invalid");
-      const sessionId = url2.searchParams.get("session");
-      const snapshot = options.snapshot();
-      if (snapshot.state !== "ready") {
-        json2(response, 200, { state: "none" });
-        return;
-      }
-      if (!isUsableSessionId(sessionId)) {
-        json2(response, 400, { state: "none", error: "session parameter required" });
-        return;
-      }
-      const target = options.target(sessionId);
-      if (!target.persist()) {
-        json2(response, 200, { state: "none" });
+      const pairing = deps.ensureFresh();
+      if (!pairing) {
+        json2(response, 200, { state: "unavailable", reason: "relay-offline" });
         return;
       }
+      deps.log("\u914D\u5BF9\u7801\u7ECF\u72B6\u6001\u680F\u53D1\u51FA", { token: pairing.token });
       json2(response, 200, {
         state: "ready",
-        epoch: snapshot.epoch,
-        address: sessionFileAddress(sessionId, target.file),
-        expiresAt: snapshot.expiresAt
+        epoch: pairingEpoch(pairing.qr),
+        token: pairing.token,
+        expiresInMs: Math.max(0, pairing.expiresAt - Date.now())
       });
     } catch (error62) {
       json2(response, 500, { error: String(error62?.message ?? error62).slice(0, 200) });
     }
   };
 }
-function registerPairingRoute(webServer, options) {
-  return webServer.register({ kind: "exact", path: PAIRING_ROUTE, handler: pairingHandler(options) });
-}
-
-// src/presentation/sidebar.ts
-function startSidebarQr(ctx, deps) {
-  const { config: config2, log } = deps;
-  const probe = {};
-  const presenter = new PairingPresenter(liveDeps(log));
-  let web;
-  let timer;
-  let unregister;
-  let started = false;
-  let stopped = false;
-  let written = null;
-  const targetFor = (sessionId) => {
-    let workspace;
+function pairImageHandler(deps) {
+  return async (request, response) => {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      json2(response, 405, { error: "method not allowed" });
+      return;
+    }
+    if (!hostIsLoopback(request.headers.host) || !originIsLoopbackOrAbsent(request.headers.origin)) {
+      json2(response, 403, { error: "request-not-trusted" });
+      return;
+    }
     try {
-      workspace = deps.workspaceOf(sessionId);
+      const pairing = deps.current();
+      if (!pairing) {
+        response.writeHead(204);
+        response.end();
+        return;
+      }
+      const png = await renderPairingPng(pairing.qr);
+      response.writeHead(200, {
+        "Content-Type": "image/png",
+        "Content-Length": png.length,
+        // 一张码会被就地换掉（半程刷新、被手机用掉），所以绝不许缓存。
+        // ETag 给的是这一版的哈希，pill 拿它判断要不要重画，省掉撕票式的刷新。
+        "Cache-Control": "no-store",
+        ETag: `"${pairingEpoch(pairing.qr)}"`
+      });
+      response.end(request.method === "HEAD" ? void 0 : png);
     } catch (error62) {
-      log("\u4F1A\u8BDD\u5DE5\u4F5C\u533A\u89E3\u6790\u5931\u8D25", { message: String(error62?.message ?? error62).slice(0, 160) });
-      workspace = void 0;
+      json2(response, 500, { error: String(error62?.message ?? error62).slice(0, 200) });
     }
-    const file2 = workspace ? path4.join(workspace, ".dsh", "sidebar-qr.png") : config2.imageFile;
-    return {
-      file: file2,
-      persist: () => {
-        const artifact = presenter.current();
-        if (!artifact) return false;
-        if (written && written.epoch === artifact.epoch && written.file === file2) return true;
-        if (!writePrivatePng(file2, artifact.buffer)) {
-          log("\u4E8C\u7EF4\u7801\u843D\u76D8\u5931\u8D25", { file: file2 });
-          return false;
-        }
-        written = { epoch: artifact.epoch, file: file2 };
-        return true;
-      }
-    };
   };
-  const tick = async () => {
-    let pairing = null;
+}
+function pillStatusHandler(deps) {
+  return (request, response) => {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      json2(response, 405, { error: "method not allowed" });
+      return;
+    }
+    if (!hostIsLoopback(request.headers.host) || !originIsLoopbackOrAbsent(request.headers.origin)) {
+      json2(response, 403, { error: "request-not-trusted" });
+      return;
+    }
     try {
-      const raw = deps.pairing();
-      pairing = raw && typeof raw === "object" ? raw : null;
+      const status = deps.status();
+      json2(response, 200, {
+        relay: status.relay,
+        paired: status.paired,
+        serverUrl: status.serverUrl,
+        version: status.version,
+        waiting: status.waiting,
+        waitingOldestSec: status.waitingOldestSec
+      });
     } catch (error62) {
-      log("read pairing state failed", { message: String(error62?.message ?? error62).slice(0, 160) });
+      json2(response, 500, { error: String(error62?.message ?? error62).slice(0, 200) });
+    }
+  };
+}
+function unpairHandler(deps) {
+  return (request, response) => {
+    if (request.method !== "POST") {
+      json2(response, 405, { error: "method not allowed" });
+      return;
+    }
+    const guard = rejectedBy(request);
+    if (guard) {
+      deps.log("\u89E3\u914D\u8BF7\u6C42\u88AB\u5B88\u536B\u62D2", { guard });
+      json2(response, 403, { error: "request-not-trusted", guard });
       return;
     }
     try {
-      await presenter.observe(pairing);
+      const unpaired = deps.unpair();
+      deps.log("\u7ECF\u72B6\u6001\u680F\u9000\u51FA\u914D\u5BF9", { unpaired });
+      json2(response, 200, { state: "ok", unpaired });
     } catch (error62) {
-      log("observe failed", { message: String(error62?.message ?? error62).slice(0, 160) });
+      json2(response, 500, { error: String(error62?.message ?? error62).slice(0, 200) });
     }
   };
+}
+function registerPillRoutes(webServer, deps) {
+  const off = [];
+  const definitions = [
+    { kind: "exact", path: PAIR_NEW_ROUTE, handler: pairNewHandler(deps) },
+    { kind: "exact", path: PAIR_IMAGE_ROUTE, handler: pairImageHandler(deps) },
+    { kind: "exact", path: PAIR_STATUS_ROUTE, handler: pillStatusHandler(deps) },
+    { kind: "exact", path: PAIR_UNPAIR_ROUTE, handler: unpairHandler(deps) }
+  ];
+  try {
+    for (const definition of definitions) off.push(webServer.register(definition));
+  } catch (error62) {
+    for (const unregister of off.splice(0)) {
+      try {
+        unregister();
+      } catch {
+      }
+    }
+    throw error62;
+  }
+  return () => {
+    for (const unregister of off) {
+      try {
+        unregister();
+      } catch {
+      }
+    }
+  };
+}
+
+// src/pill/start.ts
+function startPill(ctx, deps) {
+  const { log } = deps;
+  const probe = {};
+  let web;
+  let unregister;
+  let started = false;
+  let stopped = false;
   const tryStart = () => {
     if (started || stopped || !web) return;
     started = true;
     try {
-      unregister = registerPairingRoute(web, {
-        snapshot: () => presenter.snapshot(),
-        target: targetFor
+      unregister = registerPillRoutes(web, {
+        ensureFresh: () => deps.ensureFresh(),
+        current: () => deps.current(),
+        status: () => deps.status(),
+        unpair: () => deps.unpair(),
+        log
       });
-      probe.route = "registered";
+      probe.routes = "registered";
     } catch (error62) {
-      probe.route = `register threw: ${String(error62?.message ?? error62).slice(0, 80)}`;
-      log("route registration failed", { message: String(error62?.message ?? error62).slice(0, 200) });
+      probe.routes = `register threw: ${String(error62?.message ?? error62).slice(0, 80)}`;
       started = false;
+      log("pill \u8DEF\u7531\u6CE8\u518C\u5931\u8D25\uFF08\u914D\u5BF9\u94FE\u8DEF\u4E0D\u53D7\u5F71\u54CD\uFF09", {
+        message: String(error62?.message ?? error62).slice(0, 200)
+      });
       return;
     }
-    timer = setInterval(() => void tick(), config2.refreshMs);
-    timer.unref?.();
-    void tick();
-    log("sidebar started", { fallbackImageFile: config2.imageFile, refreshMs: config2.refreshMs });
+    log("pill routes started");
   };
-  const pickFrom = (source, name) => {
+  const acceptWebServer = (value, via) => {
+    if (!value || typeof value !== "object") return false;
+    if (typeof value.register !== "function") {
+      probe.webServer = "object without register()";
+      return false;
+    }
+    web = value;
+    probe.webServer = via;
+    tryStart();
+    return true;
+  };
+  const pickFrom = (source) => {
     if (!source || typeof source !== "object") return void 0;
     const asContext = source;
     if (typeof asContext.get === "function") {
       try {
-        const got = asContext.get(name, true);
+        const got = asContext.get("webServer", true);
         if (got) return got;
       } catch {
       }
     }
     try {
-      return source[name];
+      return source["webServer"];
     } catch {
       return void 0;
     }
   };
-  const acceptWebServer = (value, via) => {
-    if (!value || typeof value !== "object") return false;
-    if (typeof value.register !== "function") {
-      probe.webServer = "object without register()";
-      return false;
-    }
-    web = value;
-    probe.webServer = via;
-    tryStart();
-    return true;
-  };
-  if (!config2.enabled) {
-    probe.sidebar = "disabled";
+  if (!deps.enabled) {
+    probe.pill = "disabled";
   } else {
     try {
       const found = ctx.get?.("webServer", true);
@@ -33679,12 +34228,9 @@ function startSidebarQr(ctx, deps) {
     try {
       ctx.inject?.(["webServer"], ((...args) => {
         try {
-          let value;
           for (const candidate of [args[0], ...args, ctx]) {
-            value = pickFrom(candidate, "webServer");
-            if (value) break;
+            if (acceptWebServer(pickFrom(candidate), "via inject")) return;
           }
-          if (acceptWebServer(value, "via inject")) return;
           probe.webServer = `${probe.webServer ?? "none"} (inject fired, empty)`;
         } catch (error62) {
           probe["injectThrew:webServer"] = String(error62?.message ?? error62).slice(0, 160);
@@ -33697,20 +34243,26 @@ function startSidebarQr(ctx, deps) {
   const stop = () => {
     if (stopped) return;
     stopped = true;
-    if (timer !== void 0) {
-      clearInterval(timer);
-      timer = void 0;
-    }
+    const off = unregister;
+    unregister = void 0;
     try {
-      unregister?.();
+      off?.();
     } catch {
     }
-    unregister = void 0;
-    if (started) log("sidebar stopped");
+    if (started) log("pill routes stopped");
+  };
+  return {
+    stop,
+    probe,
+    get available() {
+      return started && probe.routes === "registered";
+    }
   };
-  return { stop, probe };
 }
 
+// src/version.ts
+var PLUGIN_VERSION = true ? "2.0.0" : "dev";
+
 // src/index.ts
 var SERVICE_NAMES = [
   "sessions",
@@ -33740,11 +34292,7 @@ function apply(ctx, injected = {}) {
       get state() {
         return handle?.state() ?? { relay: "offline", carrier: "none", reason: "not-started" };
       },
-      createPairing: () => handle?.createPairing() ?? null,
-      // presentation 那一半要按会话解析落点（右栏那张图放哪），而"会话 → 工作区"这点
-      // 平台知识只在本插件里有。**在这里开一个口，而不是让那一半自己去探内核服务**：
-      // 两份探测迟早分叉，而分叉的表现是"卡片说 A 地、右栏读 B 地"，很难查。
-      sessionWorkspace: (sessionId) => handle?.sessionWorkspace(sessionId)
+      createPairing: () => handle?.createPairing() ?? null
     });
   } catch {
   }
@@ -33769,7 +34317,7 @@ function applyInner(ctx, injected) {
   const clock = systemClock;
   const oneShot = createOneShotTimers(clock);
   const status = new StatusFile(config2.statusFile, clock);
-  const problems = validateConfig(config2);
+  const hostId = resolveHostId(config2.statusFile ? path5.dirname(config2.statusFile) : "", config2.hostId);
   const log = (message, fields = {}) => {
     try {
       process.stdout.write(
@@ -33779,6 +34327,10 @@ function applyInner(ctx, injected) {
     } catch {
     }
   };
+  const pairStoreFile = resolvePairStoreFile(config2, hostId);
+  const pairStore = new PairStore({ file: pairStoreFile, hostId, log });
+  const restoredAtBoot = pairStoreFile ? pairStore.load() : [];
+  const problems = validateConfig(config2);
   for (const problem of problems) {
     log(`config ${problem.level}`, { field: problem.field, message: problem.message });
   }
@@ -33807,7 +34359,7 @@ function applyInner(ctx, injected) {
   let runtime;
   let relay;
   let startedCarrier = "";
-  let sidebar;
+  let pillRoutes;
   let lastRelayState = "connecting";
   let lastRelayProblem;
   let lastRelayGeneration = 0;
@@ -33818,8 +34370,8 @@ function applyInner(ctx, injected) {
     broadcast(payload) {
       return relay ? relay.broadcast(payload) : 0;
     },
-    hasPeer(conversationId) {
-      return relay?.hasPeer(conversationId) ?? false;
+    hasClient(conversationId) {
+      return relay?.hasClient(conversationId) ?? false;
     },
     conversationIds() {
       return relay?.conversationIds() ?? [];
@@ -33834,7 +34386,7 @@ function applyInner(ctx, injected) {
     startedCarrier = port.carrier;
     relay = new RelayClient({
       url: config2.serverUrl,
-      hostId: config2.hostId || `h_${randomBytes4(3).toString("hex")}`,
+      hostId,
       label: config2.hostLabel,
       token: config2.hostToken,
       clock,
@@ -33845,6 +34397,9 @@ function applyInner(ctx, injected) {
         pairingWindow.applyServerTtl(token, ttlMs);
       },
       onPeerJoined: (conversationId, pairingToken2) => {
+        for (const id of relay?.conversationIds() ?? []) {
+          if (id !== conversationId) relay?.voidConversation(id);
+        }
         runtime?.start();
         void runtime?.pushSessions("peer-joined");
         if (pairingToken2) {
@@ -33865,7 +34420,23 @@ function applyInner(ctx, injected) {
       },
       // 配对通道长存（D3）之后必须自己剪枝：中继那边的空闲 TTL 是 7 天，
       // 不剪就是无界的 PSK 簿 + 每次广播对废弃通道逐个密封。
-      prunePolicy: { idleTtlMs: config2.conversationIdleTtlSec * 1e3, maxConversations: MAX_CONVERSATIONS }
+      // 两条 TTL 分开：新配对的按 24 小时剪，从盘上恢复的按 `restoredIdleTtlSec`
+      // （默认 7 天，与中继对齐）—— 理由见 config.ts 与 keys.ts 的 `Conversation.restored`。
+      prunePolicy: {
+        idleTtlMs: config2.conversationIdleTtlSec * 1e3,
+        restoredIdleTtlMs: config2.restoredIdleTtlSec * 1e3,
+        maxConversations: MAX_CONVERSATIONS
+      },
+      // 结构性变化（新配对 / 作废）立刻落盘。只改了 seqHost 与 lastActivityAt 的场合
+      // 由 status 的 3 秒 tick 批量落（见下面 `pairStore.markDirty()` 那一段）——
+      // 挂在这里等于每广播一次写一次盘。
+      onStructuralChange: () => {
+        if (!pairStoreFile || !relay) return;
+        pairStore.save(relay.conversations.snapshot(), clock.now());
+      },
+      onBookActivity: () => {
+        pairStore.markDirty();
+      }
     });
     runtime = new HostRuntime(port, transport, sleep, clock, {
       listingRefreshMs: config2.listingRefreshSec * 1e3,
@@ -33873,11 +34444,20 @@ function applyInner(ctx, injected) {
       approvalTimeoutMs: config2.approvalTimeoutSec * 1e3,
       log: (message, fields) => log(message, fields)
     });
+    const restoredIds = relay.restoreConversations(restoredAtBoot);
+    if (restoredIds.length > 0) {
+      runtime.start();
+      log("runtime started from restored conversations", { conversations: restoredIds.length });
+    }
     relay.connect();
     pairingWindow.tick();
     status.start(() => {
       pairingWindow.tick();
       relay?.pruneConversations();
+      if (pairStoreFile && pairStore.hasPendingChanges && relay) {
+        pairStore.save(relay.conversations.snapshot(), clock.now());
+      }
+      slots.prune();
       return state();
     });
   };
@@ -33902,23 +34482,60 @@ function applyInner(ctx, injected) {
       carrier: startedCarrier || (config2.mockBridge ? "mock" : "probing"),
       serverUrl: config2.serverUrl,
       hostLabel: config2.hostLabel,
+      // 主机身份。中继日志里认的就是它，所以"手机连不上/丢帧涨"第一件事是看这个值
+      // 在两次重启之间有没有变（变了就是身份没稳住，见 shell/host-id.ts）。
+      hostId,
       relay: relay ? relayState() : "idle",
       relayProblem: relayProblem(),
       conversations: relay?.conversationCount ?? 0,
+      /**
+       * 当前连着的手机台数（去重的 clientId）。
+       *
+       * 为什么必须与 `conversations` 分开报：「解除配对 → 重新配对」会开一条**新会话**，
+       * 而手机还是那一台。所以拿会话数回答"几台手机连着"，用户解完配对看到数字反而变大 ——
+       * 那个现象与"我的解配没生效"完全一致，最容易让人把解配按钮当坏的。
+       * `pendingPairs` 是另一个东西：那是**还挂着、还没被用掉的配对码**。
+       */
+      pairedClients: relay?.clientCount ?? 0,
       pendingPairs: slots.size,
+      /**
+       * 密钥簿落盘的排障面。
+       *
+       * `restored` 是"本次启动从盘上恢复了几条会话"——它与 `conversations` 的差值
+       * 就是"落盘没生效"的判据：`conversations > 0 && restored === 0 && pairStore.enabled`
+       * 意味着这些会话是本次运行新配出来的（正常），反过来
+       * `restored > 0` 而 `conversations === 0` 才是异常。
+       *
+       * **`lastSavedAt` 与路径都不含 PSK**：这份快照会被外部脚本读，
+       * 文件路径本身也不是凭据（里面的内容才是）。
+       */
+      pairStore: {
+        enabled: pairStoreFile !== "",
+        file: pairStoreFile || void 0,
+        restored: restoredAtBoot.length,
+        lastSavedAt: pairStoreFile && pairStore.lastSavedAt > 0 ? new Date(pairStore.lastSavedAt).toISOString() : void 0
+      },
       pairing: describeActivePairing(),
       keepAwake: snapshot,
       kernel: kernel?.describe() ?? null,
       // 出站计数：手机上"没收到 X"的第一现场对比点（插件没发 vs 发了但路上丢了）。
       outbound: runtime?.stats ?? null,
       probe,
-      // 右栏那一半为什么没起，是"二维码不弹"唯一的排查入口：这里直接把软探测的结果带出来。
-      sidebar: sidebar?.probe ?? { webServer: "not-started" },
+      // 配对入口（那颗 pill 的四条路由）为什么没起，是"配不了对"唯一的排查入口：
+      // 这里直接把软探测的结果带出来。
+      pill: pillRoutes?.probe ?? { webServer: "not-started" },
       // token 永远不出现真值；这条有测试锁住。
       hostToken: void 0,
-      hostTokenShape: config2.hostToken ? redactSecret(config2.hostToken) : void 0,
+      hostTokenShape: config2.hostToken ? redact(config2.hostToken) : void 0,
       mockBridgeForced: config2.mockBridge,
-      problems: problems.map((problem) => `${problem.level}:${problem.field}`),
+      problems: [
+        ...problems.map((problem) => `${problem.level}:${problem.field}`),
+        // **每次快照现判，不在 apply 里 push 一次**。`webServer` 可能是 `ctx.inject` 的回调
+        // 晚到才拿到的，apply 返回那一刻 `available` 还是 false——留在 apply 里就会写出
+        // `routes:"registered"` 与 `problems:["warn:pill"]` 并存的假警报
+        // （2026-10-03 真机重启后实测抓到）。为什么没挂上从同一个快照的 `pill` 探针读。
+        ...pillRoutes?.available ? [] : ["warn:pill"]
+      ],
       ...config2.pairOnStartSec > 0 ? { pairOnStartWarn: "status.json \u91CC\u5E26\u7740\u4ECD\u7136\u6709\u6548\u7684\u914D\u5BF9\u7801\u4E0E PSK" } : {}
     };
   };
@@ -33951,6 +34568,33 @@ function applyInner(ctx, injected) {
     return created;
   };
   const createPairing = () => wrappedPublish();
+  function currentPairing() {
+    const shown = active.pairing;
+    if (!shown) return null;
+    if (!slots.resolveFor(shown.token)) return null;
+    return { qr: shown.qr, token: shown.token, expiresAt: shown.expiresAt };
+  }
+  function ensureFreshPairing() {
+    const fresh = currentPairing() ?? createPairing();
+    if (!fresh) return null;
+    return { qr: fresh.qr, token: fresh.token, expiresAt: fresh.expiresAt };
+  }
+  function pillStatus() {
+    const waiting = runtime?.waiting ?? { count: 0, oldestSec: 0 };
+    return {
+      relay: relay ? relayState() : "idle",
+      paired: relay?.clientCount ?? 0,
+      serverUrl: config2.serverUrl,
+      version: PLUGIN_VERSION,
+      waiting: waiting.count,
+      waitingOldestSec: waiting.oldestSec
+    };
+  }
+  function unpairAll() {
+    const ids = relay?.conversationIds() ?? [];
+    for (const id of ids) relay?.voidConversation(id);
+    return ids.length;
+  }
   const pairingWindow = new PairingWindow(
     {
       clock,
@@ -33967,7 +34611,6 @@ function applyInner(ctx, injected) {
   );
   const collected = {};
   const hasServices = () => typeof collected.sessions === "object" && collected.sessions !== null;
-  const apiProxyOf = () => collected.apiProxy;
   const probe = {};
   const injectFired = [];
   let hasGet = true;
@@ -33985,9 +34628,6 @@ function applyInner(ctx, injected) {
       start(createServicesKernel(collected, { log, takeOverQuestions: config2.takeOverQuestions, clock }));
       return;
     }
-    if (typeof ctx.get?.("apiProxy", true) === "object") {
-      log("apiProxy present but unsupported by this build", { hint: "\u53EA\u505A\u8BCA\u65AD\u8BB0\u5F55\uFF0C\u4E0D\u63A5\u8FD9\u6761\u8F7D\u4F53" });
-    }
   };
   const requiredMember = { sessions: "list", sessionQuery: "listSessions", agents: "get" };
   const keysOf = (value) => {
@@ -34199,23 +34839,6 @@ function applyInner(ctx, injected) {
     } catch {
     }
   }
-  try {
-    const proxy = ctx.get?.("apiProxy", true);
-    if (proxy) collected.apiProxy = proxy;
-  } catch {
-  }
-  try {
-    ctx.inject?.(["apiProxy"], ((scoped) => {
-      const value = scoped?.get?.("apiProxy", true);
-      if (!value) return;
-      collected.apiProxy = value;
-      if (!decided) {
-        oneShot.schedule(tryStart, config2.carrierGraceMs);
-      }
-      tryStart();
-    }));
-  } catch {
-  }
   tryStart();
   if (!runtime && config2.mockBridge) {
     decided = true;
@@ -34224,94 +34847,21 @@ function applyInner(ctx, injected) {
   }
   if (!runtime) {
     status.write({ ...state(), carrier: "none", reason: "no-carrier", probe });
-    log("no kernel carrier available", { hint: "\u9700\u8981 sessions/apiProxy \u670D\u52A1\uFF0C\u6216\u628A mockBridge \u6253\u5F00\u505A\u5F00\u53D1" });
-  }
-  const workspaceOfInvocation = (invocation) => {
-    const agent = invocation?.agent;
-    const sessionId = typeof agent?.session?.id === "string" ? agent.session.id : "";
-    if (sessionId === "") return void 0;
-    try {
-      return kernel?.sessionWorkspace?.(sessionId);
-    } catch {
-      return void 0;
-    }
-  };
-  const commandDefinition = {
-    name: "drc",
-    description: "DSH \u8FDC\u7A0B\u63A7\u5236\uFF1A\u53D1\u5E03\u914D\u5BF9\u4E8C\u7EF4\u7801\u3001\u67E5\u770B\u4E2D\u7EE7\u4E0E\u5185\u6838\u63A5\u5408\u72B6\u6001",
-    input: { hint: "pair | status | unpair" },
-    handler: async (invocation) => {
-      const argument = String(invocation.rawInput ?? "").trim().toLowerCase();
-      if (argument.startsWith("pair")) {
-        const pairing = createPairing();
-        if (!pairing) return { kind: "success", text: PAIR_UNAVAILABLE_TEXT };
-        const workspaceDir = workspaceOfInvocation(invocation);
-        const imageFile = config2.qrImage ? pairingImagePath(config2.statusFile, workspaceDir) : "";
-        if (imageFile) writePairingImage(imageFile, pairing.qr, config2, log);
-        const terminal = config2.qrImage ? void 0 : await renderTerminalQr(pairing.qr, { style: config2.qrStyle, ansi: config2.qrAnsi });
-        return {
-          kind: "success",
-          text: pairingPairText({
-            token: pairing.token,
-            qr: pairing.qr,
-            expiresAt: pairing.expiresAt,
-            now: clock.now(),
-            qrImage: config2.qrImage,
-            imageFile,
-            terminalQr: terminal
-          })
-        };
-      }
-      if (argument.startsWith("unpair")) {
-        for (const id of relay?.conversationIds() ?? []) relay?.voidConversation(id);
-        return { kind: "success", text: '\u5DF2\u89E3\u9664\u6240\u6709\u914D\u5BF9\uFF1B\u624B\u673A\u7AEF\u4F1A\u663E\u793A"\u4E3B\u673A\u5DF2\u65AD\u5F00\uFF0C\u8BF7\u91CD\u65B0\u914D\u5BF9"\u3002' };
-      }
-      return { kind: "success", text: JSON.stringify(state(), null, 2) };
-    }
-  };
-  let commandsTaken = false;
-  const takeCommands = (source) => {
-    if (commandsTaken || !source || typeof source !== "object") return;
-    const holder = source;
-    if (typeof holder.register !== "function") return;
-    holder.register(commandDefinition);
-    commandsTaken = true;
-    probe.commands = "registered";
-  };
-  try {
-    takeCommands(ctx.commands);
-  } catch {
-  }
-  try {
-    takeCommands(ctx.get?.("commands", true));
-  } catch {
-  }
-  try {
-    const child = ctx.inject?.(["commands"], ((...cbArgs) => {
-      for (const candidate of [cbArgs[0], ...cbArgs, ctx]) {
-        takeCommands(pickFrom(candidate, "commands"));
-        if (commandsTaken) break;
-      }
-    }));
-    if (child !== void 0) injectChildren.push(["commands", child]);
-  } catch {
+    log("no kernel carrier available", { hint: "\u9700\u8981 sessions \u670D\u52A1\uFF0C\u6216\u628A mockBridge \u6253\u5F00\u505A\u5F00\u53D1" });
   }
   try {
-    sidebar = startSidebarQr(ctx, {
-      config: config2.sidebarQr,
-      pairing: () => describeActivePairing(),
-      workspaceOf(sessionId) {
-        try {
-          return kernel?.sessionWorkspace?.(sessionId);
-        } catch {
-          return void 0;
-        }
-      },
+    pillRoutes = startPill(ctx, {
+      enabled: config2.pill.enabled,
+      // 四条路由要的四件事：幂等发码、只读看当前码、读连接状态、退出配对。
+      ensureFresh: () => ensureFreshPairing(),
+      current: () => currentPairing(),
+      status: () => pillStatus(),
+      unpair: () => unpairAll(),
       log
     });
   } catch (error62) {
-    sidebar = void 0;
-    log("sidebar start threw\uFF08\u914D\u5BF9\u94FE\u8DEF\u4E0D\u53D7\u5F71\u54CD\uFF09", {
+    pillRoutes = void 0;
+    log("pill start threw\uFF08\u914D\u5BF9\u94FE\u8DEF\u4E0D\u53D7\u5F71\u54CD\uFF09", {
       message: String(error62?.message ?? error62).slice(0, 200)
     });
   }
@@ -34319,37 +34869,19 @@ function applyInner(ctx, injected) {
     config: config2,
     state,
     createPairing,
-    sessionWorkspace(sessionId) {
-      try {
-        return kernel?.sessionWorkspace?.(sessionId);
-      } catch {
-        return void 0;
-      }
-    },
     stop() {
       oneShot.cancelAll();
-      sidebar?.stop();
+      pillRoutes?.stop();
       status.stop();
+      if (pairStoreFile && relay && pairStore.hasPendingChanges) {
+        pairStore.save(relay.conversations.snapshot(), clock.now());
+      }
       runtime?.stop();
       relay?.stop();
       sleep.stop();
     }
   };
 }
-function writePairingImage(file2, qrText, config2, log) {
-  if (!config2.qrImage || !file2) return;
-  qrPng(qrText).then((buffer) => {
-    if (!writePrivateFile(file2, buffer)) {
-      log("qr png write failed", { file: file2 });
-      return;
-    }
-    if (!config2.qrOpen) return;
-    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", "", file2] : [file2];
-    execFile(opener, args, () => {
-    });
-  }).catch((error62) => log("qr png render failed", { message: String(error62?.message ?? error62) }));
-}
 export {
   DEFAULT_CONFIG,
   apply,