dsh-zen-remote 2.4.1 → 2.4.3

package/src/client/settings/SettingsSection.tsx

@@ -386,6 +386,16 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
   // MS-7: the paired-server pool, in pairing order (empty on a legacy body),
   // and the cap the counters and the red alert read.
   const serverRows: readonly ClientServerView[] = clientView?.servers ?? []
+  // #56: the 立即重连 entries key off the REAL offline state, never the
+  // presence of a scheduled retry — the ladder can legitimately sit
+  // offline with no timer armed (a handshake a retry joined just died),
+  // and gating on nextRetryAt disabled every manual entrance in exactly
+  // that state. View 'unreachable' is the wire 'offline' (T55 alias);
+  // online / connecting / unpaired / revoked / incompatible stay closed,
+  // matching the route's offline-only contract.
+  const entryReconnectable = (server: ClientServerView): boolean => server.state === 'unreachable'
+  const anyReconnectable = clientView !== undefined
+    && (serverRows.length > 0 ? serverRows.some(entryReconnectable) : clientView.state === 'unreachable')
   const maxServers = clientView?.maxServers ?? MAX_PAIRED_SERVERS
   // RD-3: the remote drop guard's browser-side counters, read at render
   // time — no snapshot state of its own: the initial mount, the 15s
@@ -1386,7 +1396,7 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
                   <Button
                     variant="ghost"
                     size="sm"
-                    disabled={entryBusy !== null || server.nextRetryAt === undefined}
+                    disabled={entryBusy !== null || !entryReconnectable(server)}
                     onClick={() => { void runEntryReconnect(server.entryId) }}
                   >
                     {entryBusy === server.entryId ? t('settings.client.reconnectBusy') : t('settings.client.reconnect')}
@@ -1415,14 +1425,14 @@ function SettingsSectionPage({ config, shares, t }: SettingsSectionProps) {
             <p className="zr-settings-status-line" style={{ flex: 1 }} data-down={clientView !== undefined && (clientView.state === 'unreachable' || clientView.state === 'unexpected' || clientView.state === 'revoked' || clientView.state === 'invalid-url' || clientView.state === 'incompatible') ? 'true' : undefined}>
               {clientView === undefined ? '' : clientStatusText(clientView, now, t)}
             </p>
-            {/* T43 立即重连: the response carrying a nextRetryAt is the one
-                honest "the relay is offline with a retry armed" signal — the
-                probe word underneath may be unreachable or unexpected; the
-                route 409s anything else anyway (T43-fix). */}
+            {/* T43 立即重连（#56 重订资格）：按钮看真实 offline 状态
+                （'unreachable' = wire 'offline'），不再要求 nextRetryAt ——
+                梯子可能恰好没有计时器在排（刚加入的握手死掉），那正是
+                最需要手动入口的时刻；路由对非 offline 本就 409。 */}
             <Button
               variant="outline"
               size="sm"
-              disabled={clientView === undefined || clientView.nextRetryAt === undefined || reconnectBusy}
+              disabled={clientView === undefined || !anyReconnectable || reconnectBusy}
               onClick={() => { void runReconnect() }}
             >
               {reconnectBusy ? t('settings.client.reconnectBusy') : t('settings.client.reconnect')}

package/src/intercept.ts

@@ -155,6 +155,9 @@ export const CLIENT_METHOD_FIELDS: Readonly<Record<string, readonly SessionField
   // it is restored like the parent before forwarding
   'subagents/prompt': ['request.parentSessionId', 'request.childSessionId'],
   'subagents/interruptByParent': ['parentSessionId', 'childSessionId'],
+  // 0.2.2-rc.2 rename: only the child id travels (no parent, no mode).
+  // interruptByParent stays for 0.2.2-rc.1 (npm latest).
+  'subagents/interruptByUser': ['childSessionId'],
   // attachments and @ references (T31) — the top-level agentId IS the session
   // id (the gateway's agent lookup resolves it through the session-keyed
   // agent registry).
@@ -186,6 +189,8 @@ export const CLIENT_METHOD_FIELDS: Readonly<Record<string, readonly SessionField
   'workspaceFiles/read': ['workspaceFileScopeId'],
   'workspaceFiles/readBytes': ['workspaceFileScopeId'],
   'workspaceFiles/stat': ['workspaceFileScopeId'],
+  // 0.2.2-rc.2: official sidebar-files search bar. Same scope id.
+  'workspaceFiles/search': ['workspaceFileScopeId'],
   // Office document preview (2.2.6) — client side of relay-access.ts's entry:
   // `render` is located by the SAME `workspaceFileScopeId` lookup (the session
   // id). It MUST stay identical to the server table
@@ -194,6 +199,9 @@ export const CLIENT_METHOD_FIELDS: Readonly<Record<string, readonly SessionField
   // the relay is ever asked. `generation` stays unregistered: no virtual id
   // rides it, so it answers locally (see the server table's note).
   'officeToPdf/render': ['workspaceFileScopeId'],
+  // 0.2.2-rc.2 successor of officeToPdf/render (same scope id, same
+  // PDF-bytes result). officeToPdf/render stays for 0.2.2-rc.1.
+  'officeKit/render': ['workspaceFileScopeId'],
   // terminal (T41a) — opens SERVER-side by explicit user request (SPEC story
   // 45); the boundary is the standing one (shared session + paired desktop
   // client), no extra switch. The terminal and attachment ids in these calls
@@ -214,6 +222,8 @@ export const CLIENT_METHOD_FIELDS: Readonly<Record<string, readonly SessionField
   // the retain/list half locates by a plain top-level json sessionId
   'terminal/list': ['sessionId'],
   'terminal/retain': ['sessionId'],
+  // 0.2.2-rc.2 live Agent-terminal roster stream (same sessionId as list).
+  'terminal/watch': ['sessionId'],
   // session/* — the global control stream and the unscoped list: merged with
   // the relay's filtered answer by the T23b-2 routes below (never refused on
   // arguments — a stray id in them is unowned data).
@@ -288,7 +298,7 @@ export type DispatchEnvelope =
  * Everything else — `session/prompt|cancel|rename|selectModel|updateQueue`
  * (send, cancel, rename, model switch, inbox mutation), `session/create` /
  * `session/fork` (T31: new sessions on the server), `subagents/prompt` /
- * `subagents/interruptByParent` (T31: prompt/interrupt a remote subagent),
+ * `subagents/interruptByParent` / `subagents/interruptByUser` (T31: prompt/interrupt a remote subagent),
  * `fileUploads/upload` (T31: attachments into a remote session), `job/kill`,
  * `messageFeedback/put|delete`, the workspace session-list mutations, and
  * the T41a mutations (`goals/edit|pause|resume|clear`, `commands/execute`,
@@ -335,15 +345,20 @@ export const REMOTE_READ_METHODS: ReadonlySet<string> = new Set([
   'workspaceFiles/read',
   'workspaceFiles/readBytes',
   'workspaceFiles/stat',
+  // 0.2.2-rc.2: official sidebar-files search — a pure Host-side walk.
+  'workspaceFiles/search',
   // officeToPdf (2.2.6): a pure read — it converts one already-readable file
   // into PDF bytes on the server (writing only its own scratch space, like
   // any preview). Offline it answers `remote-offline`, never the write
-  // message.
+  // message. officeKit/render is the 0.2.2-rc.2 successor (same shape).
   'officeToPdf/render',
+  'officeKit/render',
   'terminal/environment',
   'terminal/shells',
   'terminal/list',
   'terminal/retain',
+  // 0.2.2-rc.2: live Agent-terminal roster (WebTerminalInfo[]); read-only.
+  'terminal/watch',
 ])
 
 /** Whether `endpoint` (a client-table method) is a remote WRITE: anything
@@ -1012,13 +1027,13 @@ function restoreRegisteredFields(fields: readonly SessionField[], args: unknown)
  *   `rewriteFrame` untouched.
  * - everything else in the table (`session/prompt|cancel|rename|updateQueue|
  *   attachment`, `job/kill`, `skills/list`, `schedule/list`, `subagents/prompt`
- *   (`{messageId}`), `subagents/interruptByParent` (`{accepted}`),
+ *   (`{messageId}`), `subagents/interruptByParent` / `subagents/interruptByUser` (`{accepted}`),
  *   `fileUploads/upload` (receipt + attachment ids, not session ids),
  *   `fileReferences/list` (`{path,kind}` rows), `goals/get|edit|pause|resume|
  *   clear` (GoalView/GoalRef ids are GOAL ids), `commands/list|execute`
  *   (`commandId` is a command id), `agentPresets/select` (a preset id
- *   string), `workspaceFiles/list|read|readBytes|stat` (paths, versions,
- *   text/bytes), `terminal/*` (terminal ids, attachment ids, controller ids
+ *   string), `workspaceFiles/list|read|readBytes|stat|search` (paths, versions,
+ *   text/bytes, search matches), `terminal/*` (terminal ids, attachment ids, controller ids
  *   — client-side identity, never session ids)) has NO
  *   session id in its result — verified. THREE of them still get a
  *   T52 rewrite of the model-catalog PROVIDER ids their results carry (never

package/src/invoke-binary.ts

@@ -18,12 +18,14 @@ export const BINARY_MARKER = '$zr-u8'
 
 /** 结果里带二进制的方法（`namespace/method`）。请求侧参数不带二进制
  * （readBytes 的参数是 scope/paths），故只有结果方向需要标记。
- * `officeToPdf/render`（2.2.6）返回的 `data` 是整份 PDF 字节：同一个
- * JSON 通道会把 typed array 压扁，客户端严格编解码当场拒绝——登记进来
- * 后服务端按同一标记写出、客户端按同一标记还原。 */
+ * `officeToPdf/render`（2.2.6）与其 0.2.2-rc.2 后继 `officeKit/render`
+ * 返回的 `data` 是整份 PDF 字节：同一个 JSON 通道会把 typed array 压扁，
+ * 客户端严格编解码当场拒绝——登记进来后服务端按同一标记写出、客户端按
+ * 同一标记还原。 */
 export const INVOKE_BINARY_RESULT_METHODS: ReadonlySet<string> = new Set([
   'workspaceFiles/readBytes',
   'officeToPdf/render',
+  'officeKit/render',
 ])
 
 /** 深度上限：与其余 walker（share-store 祖先链、会话引用扫描）一致。 */

package/src/relay-access.ts

@@ -60,7 +60,7 @@
  *   half — every one takes `agent` as its first parameter, wire `agentId`,
  *   source `lookup: 'agent'`, wireTypeSymbol `SessionId` (the same shape
  *   T31 verified for fileUploads/fileReferences).
- * - `workspaceFiles/list|changes|read|readBytes|stat` carry a TOP-LEVEL
+ * - `workspaceFiles/list|changes|read|readBytes|stat|search` carry a TOP-LEVEL
  *   `workspaceFileScopeId`: the host registers the `workspaceFileScope`
  *   lookup with wireTypeSymbol `SessionId` and resolves it by session —
  *   `sessions.get(sessionId).header.cwd` is only the BASE for relative
@@ -68,8 +68,9 @@
  *   not a containment: absolute paths anywhere the server process can read
  *   are served (see the registry note below). The field itself is
  *   share-checked like any session id.
- * - `terminal/list` and `terminal/retain` take a plain TOP-LEVEL json
- *   `sessionId` (source `'json'`, not a lookup) — same check.
+ * - `terminal/list`, `terminal/retain` and (0.2.2-rc.2) `terminal/watch`
+ *   take a plain TOP-LEVEL json `sessionId` (source `'json'`, not a
+ *   lookup) — same check.
  * - `sessionFeedback/record` carries `request.sessionId` — a plain B-type.
  * - `sessionReferenceResolver/candidates` (@ mentions) answers with EVERY
  *   server session — title, cwd, and a ready-made `dsh-session:` mention
@@ -84,6 +85,12 @@
  *   does not descend from the claimed parent fails its own check, so the
  *   "shared parent + foreign child" decoy refuses here before DSH's own
  *   lineage validation is ever reached.
+ * - `subagents/interruptByUser` (0.2.2-rc.2, the rename of
+ *   `interruptByParent`) takes only the top-level `childSessionId` — the
+ *   user addresses the target Session directly, with no parent or mode.
+ *   The child is still share-checked through the same `parentOf`
+ *   inheritance. `interruptByParent` stays registered so a 0.2.2-rc.1 host
+ *   (npm `latest`) keeps working.
  *
  * PROMPT TEXT REFERENCES ARE CHECKED TOO: a prompt whose text carries a
  * canonical `dsh-session:<base64url(id)>` address makes DSH inject that
@@ -230,6 +237,10 @@ const RELAY_METHODS: Record<string, RelayMethod> = {
   // refuses before DSH is ever asked
   'subagents/prompt': { fields: ['request.parentSessionId', 'request.childSessionId'] },
   'subagents/interruptByParent': { fields: ['parentSessionId', 'childSessionId'] },
+  // 0.2.2-rc.2 renamed interruptByParent → interruptByUser and dropped
+  // parentSessionId / mode. The child still borrows its ancestor's share
+  // through parentOf. interruptByParent stays for 0.2.2-rc.1 (npm latest).
+  'subagents/interruptByUser': { fields: ['childSessionId'] },
   // attachments and @ references (T31) — the top-level agentId resolves
   // through the agent registry keyed by session id, so it IS the session id
   'fileUploads/upload': { fields: ['agentId'] },
@@ -265,6 +276,12 @@ const RELAY_METHODS: Record<string, RelayMethod> = {
   'workspaceFiles/read': { fields: ['workspaceFileScopeId'] },
   'workspaceFiles/readBytes': { fields: ['workspaceFileScopeId'] },
   'workspaceFiles/stat': { fields: ['workspaceFileScopeId'] },
+  // 0.2.2-rc.2: official sidebar-files search bar
+  // (`remote.workspaceFiles.search(sessionId, request)`). Same
+  // workspaceFileScopeId ownership as list/stat; the Host walks the
+  // workspace and returns matches. A remote session without this entry
+  // gets `forbidden-method` on every search.
+  'workspaceFiles/search': { fields: ['workspaceFileScopeId'] },
   // Office document preview (2.2.6, remote Word/Excel/PPT). The document
   // preview's Office renderer does NOT convert on the client: it asks the
   // HOST's LibreOffice to turn doc/docx/xls/xlsx/ppt/pptx into PDF
@@ -288,6 +305,13 @@ const RELAY_METHODS: Record<string, RelayMethod> = {
   // INVOKE_BINARY_RESULT_METHODS — without that marker the JSON channel
   // flattens the typed array and the client's strict codec rejects it.
   'officeToPdf/render': { fields: ['workspaceFileScopeId'] },
+  // 0.2.2-rc.2 replaces officeToPdf with officeKit (same
+  // workspaceFileScopeId, same RenderedDocumentBytes result, same
+  // generation sibling left unregistered — RT dsh-office-kit
+  // lib/typert.remote-client.d.ts). The official document-preview plugin
+  // now calls `scope.remote.officeKit.render`. officeToPdf/render stays
+  // for 0.2.2-rc.1 (npm latest). Also in INVOKE_BINARY_RESULT_METHODS.
+  'officeKit/render': { fields: ['workspaceFileScopeId'] },
   // terminal (T41a) — opens SERVER-side by explicit user request (SPEC story
   // 45). What the client gets is a shell running AS THE SERVER USER, WITHOUT
   // the agent sandbox or approval restrictions (RT dsh-api-terminal-controller
@@ -313,6 +337,11 @@ const RELAY_METHODS: Record<string, RelayMethod> = {
   // the retain/list half locates by a plain top-level json sessionId
   'terminal/list': { fields: ['sessionId'] },
   'terminal/retain': { fields: ['sessionId'], stream: true },
+  // 0.2.2-rc.2: live roster stream the official sidebar uses to open and
+  // close Agent terminal tabs (`ctx.webTerminals.watch` →
+  // `remote.watch(sessionId)`). Same top-level sessionId as list/retain;
+  // frames are WebTerminalInfo[] (read-only).
+  'terminal/watch': { fields: ['sessionId'], stream: true },
   // session/* — the global control stream and the unscoped list
   'session/control': { fields: [], stream: true, streamFilter: 'control' },
   'session/list': { fields: [], resultFilter: 'session-list' },

package/src/relay-client.ts

@@ -1338,7 +1338,19 @@ export function createRelayClient(options: CreateRelayClientOptions): RelayClien
     })()
     connectInFlight = attempt
     const clear = (): void => {
-      if (connectInFlight === attempt) connectInFlight = undefined
+      if (connectInFlight !== attempt) return
+      connectInFlight = undefined
+      // #56: a fired retry (or a manual / network-restored reconnect) that
+      // JOINED this attempt started no attempt of its own — when this one
+      // dies and a concurrent transport failure already moved the state to
+      // 'offline' mid-flight, the catch's 'connecting' restore never runs,
+      // so nobody re-arms the ladder. The settle is the one place every
+      // joiner's failure funnels through: re-arm here or the client sits
+      // offline forever with no timer and no UI way back (the settings page
+      // used to key its 立即重连 buttons on nextRetryAt). scheduleRetry's
+      // own guards (stopped, one timer at a time) keep this a no-op on every
+      // path that already armed the next wait.
+      if (state === 'offline') scheduleRetry()
     }
     attempt.then(clear, clear)
     return attempt