local-agent-dashboard 0.0.0-stage → 0.3.2

package/src/adapters/agents/log-state.js

@@ -0,0 +1,165 @@
+import { basename } from 'node:path';
+const object = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const text = (value) => typeof value === 'string' ? value : '';
+const cleanLabel = (value, fallback) => text(value).replace(/[\u0000-\u001f\u007f]/g, ' ').trim().slice(0, 120) || fallback;
+const time = (value, now) => {
+    const at = typeof value === 'string' ? Date.parse(value) : NaN;
+    return Number.isFinite(at) && at <= now + 60_000 ? at : 0;
+};
+function finish(task) {
+    task.reviewKey = `${task.provider}:${task.id}:${task.turnId}:${task.status}:${task.updatedAt}`;
+    return task;
+}
+function base(id, provider, now) {
+    return { id, provider, title: `${provider === 'codex' ? 'Codex' : 'Claude'} · ${id.slice(-8)}`, project: '未知项目', status: 'unknown', evidence: '缺少明确生命周期事件', updatedAt: 0, observedAt: now, turnId: '', reviewKey: '' };
+}
+// A terminal record is authoritative; command exits/retry diagnostics are not.
+// The collector copies only this boolean, never the raw error message/details.
+export function codexTerminalFailure(payload) {
+    const error = object(payload.error);
+    return payload.terminalFailure === true || Object.keys(error).length > 0 || typeof payload.error === 'string' && payload.error.trim().length > 0;
+}
+export function projectCodex(records, filename, now = Date.now(), previous) {
+    const metadata = object(records.find(r => object(r).type === 'session_meta'));
+    const meta = object(metadata.payload);
+    // Fail closed: without the header we cannot distinguish child agents from user threads.
+    if (!Object.keys(meta).length || meta.parent_thread_id || typeof meta.source === 'object' ||
+        (meta.thread_source && !['user', 'agent_created_thread', 'automation'].includes(meta.thread_source)))
+        return null;
+    const id = text(meta.id) || text(meta.session_id) || basename(filename, '.jsonl');
+    const task = previous?.id === id ? { ...previous, observedAt: now } : base(id, 'codex', now);
+    task.applicationId = meta.originator === 'Codex Desktop' ? 'codex-desktop' : 'codex-unidentified';
+    task.project = cleanLabel(basename(text(meta.cwd)), '未知项目');
+    const pendingInputs = new Set(previous?.pendingInputIds ?? []);
+    let sawLifecycle = !!previous && previous.status !== 'unknown';
+    for (const value of records) {
+        const r = object(value), p = object(r.payload), at = time(r.timestamp, now);
+        if (!at)
+            continue;
+        const type = text(p.type);
+        if (r.type === 'event_msg' && type === 'task_started') {
+            if (at < task.updatedAt && text(p.turn_id) !== task.turnId)
+                continue;
+            pendingInputs.clear();
+            task.status = 'active';
+            task.turnId = text(p.turn_id) || String(at);
+            task.evidence = 'task_started';
+            sawLifecycle = true;
+        }
+        else if (r.type === 'event_msg' && (type === 'task_complete' || type === 'turn_aborted')) {
+            if (p.turn_id && task.turnId && p.turn_id !== task.turnId)
+                continue;
+            task.turnId ||= text(p.turn_id) || String(at);
+            pendingInputs.clear();
+            task.status = type === 'task_complete' ? codexTerminalFailure(p) ? 'failed' : 'ended' : 'interrupted';
+            task.evidence = task.status === 'failed' ? 'task_complete with explicit error' : type;
+            sawLifecycle = true;
+        }
+        if (r.type === 'event_msg' && ['input_requested', 'input_resolved'].includes(type) && at >= task.updatedAt && ['active', 'attention'].includes(task.status)) {
+            if (type === 'input_requested' && pendingInputs.size < 8)
+                pendingInputs.add(text(p.call_id));
+            else if (type === 'input_resolved')
+                pendingInputs.delete(text(p.call_id));
+            task.status = pendingInputs.size ? 'attention' : 'active';
+            task.evidence = pendingInputs.size ? 'explicit request_user_input pending' : 'input reply observed';
+            task.updatedAt = at;
+        }
+        if (sawLifecycle && task.status === 'active')
+            task.updatedAt = Math.max(task.updatedAt, at);
+        else if (r.type === 'event_msg' && ['task_complete', 'turn_aborted'].includes(type))
+            task.updatedAt = Math.max(task.updatedAt, at);
+    }
+    task.pendingInputIds = [...pendingInputs];
+    return finish(task);
+}
+export function projectClaude(records, filename, now = Date.now(), previous) {
+    const first = records.map(object).find(r => r.sessionId || r.session_id);
+    if (first?.isSidechain)
+        return previous ?? null;
+    if (!first && !previous)
+        return null;
+    const task = previous ? { ...previous, observedAt: now } : base(text(first.sessionId) || text(first.session_id) || basename(filename, '.jsonl'), 'claude', now);
+    task.applicationId = 'claude-code';
+    const questions = new Set(previous?.pendingQuestions ?? []);
+    let lifecycle = !!previous;
+    for (const value of records) {
+        const r = object(value);
+        if (r.isSidechain)
+            continue;
+        if (r.cwd)
+            task.project = cleanLabel(basename(text(r.cwd)), task.project);
+        if (r.type === 'ai-title' && text(r.aiTitle).trim()) {
+            task.title = cleanLabel(r.aiTitle, task.title);
+            task.titleOrigin = 'native';
+        }
+        const at = time(r.timestamp, now);
+        if (!at)
+            continue;
+        const m = object(r.message);
+        const content = Array.isArray(m.content) ? m.content.map(object) : [];
+        if (r.type === 'user') {
+            const results = content.filter(c => c.type === 'tool_result');
+            if (results.length) {
+                for (const c of results)
+                    questions.delete(text(c.tool_use_id));
+                if (task.status === 'attention' && !questions.size) {
+                    task.status = 'active';
+                    task.evidence = '问题已收到对应 tool_result';
+                }
+            }
+            else if (!r.isMeta && (typeof m.content === 'string' || content.some(c => c.type === 'text'))) {
+                // Claude may never append ai-title (not merely append it late). Retain only
+                // a bounded first ordinary user line, never commands/attachments or bodies.
+                if (!task.titleOrigin) {
+                    const prompt = typeof m.content === 'string' ? m.content : text(content.find(c => c.type === 'text')?.text);
+                    const line = prompt.trim().split(/\r?\n/, 1)[0] ?? '';
+                    if (line && !/^[</]/.test(line)) {
+                        task.title = cleanLabel(line, task.title);
+                        task.titleOrigin = 'prompt';
+                    }
+                }
+                task.turnId = text(r.uuid) || text(r.promptId) || String(at);
+                task.status = 'active';
+                task.evidence = 'user message';
+                questions.clear();
+                lifecycle = true;
+            }
+        }
+        else if (r.type === 'assistant') {
+            lifecycle = true;
+            task.turnId ||= text(r.parentUuid) || String(at);
+            for (const c of content) {
+                if (c.type === 'tool_use' && ['AskUserQuestion', 'ExitPlanMode'].includes(text(c.name)))
+                    questions.add(text(c.id));
+            }
+            if (questions.size) {
+                task.status = 'attention';
+                task.evidence = '等待交互工具的对应结果';
+            }
+            else if (m.stop_reason === 'end_turn') {
+                task.status = 'ended';
+                task.evidence = 'assistant stop_reason=end_turn';
+            }
+            else {
+                task.status = 'active';
+                task.evidence = 'assistant / tool_use';
+            }
+        }
+        else if (r.type === 'system' && r.subtype === 'turn_duration' && !questions.size) {
+            task.status = 'ended';
+            task.evidence = 'system turn_duration';
+            lifecycle = true;
+        }
+        if (lifecycle && (['user', 'assistant'].includes(r.type) || (r.type === 'system' && r.subtype === 'turn_duration')))
+            task.updatedAt = Math.max(task.updatedAt, at);
+    }
+    task.pendingQuestions = [...questions];
+    return finish(task);
+}
+export function ageTask(task, now = Date.now()) {
+    const age = now - task.updatedAt;
+    if ((task.status === 'active' && age > 5 * 60_000) || (task.status === 'attention' && age > 30 * 60_000)) {
+        return { ...task, status: 'unknown', evidence: `上次事件：${task.evidence}；当前状态待确认` };
+    }
+    return task;
+}

package/src/adapters/agents/native-unread.js

@@ -0,0 +1,45 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+const MAX_BYTES = 8 * 1024 * 1024;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+export function parseNativeUnread(value) {
+    const state = record(record(value)?.['electron-thread-read-state-v1']);
+    if (state?.version !== 1)
+        return null;
+    const identities = record(state.unreadByIdentity);
+    if (!identities || Object.keys(identities).length !== 1)
+        return null;
+    const [identity] = Object.keys(identities);
+    if (!/^[a-f\d]{64}$/.test(identity))
+        return null;
+    const hosts = record(identities[identity]);
+    if (!hosts || Object.keys(hosts).length !== 1)
+        return null;
+    const [host] = Object.keys(hosts);
+    if (!/^local:[a-f\d]{64}$/.test(host))
+        return null;
+    const ids = hosts[host];
+    if (!Array.isArray(ids) || ids.length > 10000 || ids.some(id => typeof id !== 'string' || !/^[a-f\d]{8}(?:-[a-f\d]{4}){3}-[a-f\d]{12}$/i.test(id)))
+        return null;
+    return new Set(ids);
+}
+export async function readNativeUnread(file) {
+    try {
+        const handle = await open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const info = await handle.stat();
+            if (!info.isFile() || info.size > MAX_BYTES)
+                return null;
+            const buffer = Buffer.alloc(info.size + 1), result = await handle.read(buffer, 0, buffer.length, 0);
+            if (result.bytesRead !== info.size)
+                return null;
+            return parseNativeUnread(JSON.parse(buffer.subarray(0, result.bytesRead).toString('utf8')));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}

package/src/application/pairing.js

@@ -0,0 +1,83 @@
+import { randomBytes, randomUUID, createHash, timingSafeEqual } from 'node:crypto';
+const secret = () => randomBytes(32).toString('base64url');
+export const hash = (s) => createHash('sha256').update(s).digest('hex');
+const equal = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+export class ProtocolError extends Error {
+    status;
+    code;
+    constructor(status, code) { super(code); this.status = status; this.code = code; }
+}
+export class Pairing {
+    invite;
+    requests = new Map();
+    devices = new Map();
+    revokeListeners = new Set();
+    now;
+    onRevoke;
+    constructor(now = Date.now, onRevoke = () => { }) { this.now = now; this.onRevoke = onRevoke; }
+    createInvite() {
+        this.requests.clear();
+        return this.invite = { secret: secret(), expiresAt: this.now() + 120_000, consumed: false };
+    }
+    request(invitation, challenge, name) {
+        const i = this.invite;
+        if (!i || i.consumed || i.expiresAt <= this.now() || !equal(hash(invitation), hash(i.secret)))
+            throw new ProtocolError(410, 'invite_expired');
+        if (!/^[A-Za-z0-9_-]{43}$/.test(challenge) || !name.trim() || name.length > 60 || /[\x00-\x1f]/.test(name))
+            throw new ProtocolError(400, 'invalid_request');
+        const challengeHash = hash(challenge);
+        const previous = [...this.requests.values()].find(r => r.challengeHash === challengeHash);
+        if (previous)
+            return this.publicRequest(previous);
+        if ([...this.requests.values()].filter(r => r.state === 'pending').length >= 8)
+            throw new ProtocolError(429, 'pairing_busy');
+        const id = randomUUID(), code = hash(`${id}:${challenge}`).slice(0, 8).toUpperCase();
+        const r = { id, name, challengeHash, code, expiresAt: i.expiresAt, state: 'pending' };
+        this.requests.set(id, r);
+        return this.publicRequest(r);
+    }
+    publicRequest(r) { return { requestId: r.id, name: r.name, code: r.code, expiresAt: r.expiresAt, state: r.state }; }
+    approve(id, code) {
+        const r = this.requests.get(id);
+        if (!r || r.code !== code || r.expiresAt <= this.now() || r.state !== 'pending' || this.invite?.consumed)
+            throw new ProtocolError(409, 'request_changed');
+        r.state = 'approved';
+        for (const other of this.requests.values())
+            if (other.id !== id)
+                other.state = 'rejected';
+    }
+    claim(id, challenge) {
+        const r = this.requests.get(id);
+        if (!r || !equal(hash(challenge), r.challengeHash))
+            throw new ProtocolError(403, 'challenge_rejected');
+        if (r.expiresAt <= this.now() || this.invite?.consumed || ['claimed', 'rejected'].includes(r.state))
+            throw new ProtocolError(410, 'pairing_expired');
+        if (r.state === 'pending')
+            return { state: 'pending' };
+        if (this.devices.size >= 64)
+            throw new ProtocolError(429, 'device_limit');
+        const token = secret(), deviceId = randomUUID();
+        this.devices.set(deviceId, { id: deviceId, name: r.name, tokenHash: hash(token), createdAt: this.now(), revoked: false });
+        r.state = 'claimed';
+        this.invite.consumed = true;
+        return { state: 'paired', deviceId, token };
+    }
+    authenticate(token) {
+        const d = [...this.devices.values()].find(d => !d.revoked && equal(d.tokenHash, hash(token)));
+        if (!d)
+            throw new ProtocolError(401, 'repair_required');
+        return d;
+    }
+    subscribeRevoke(listener) { this.revokeListeners.add(listener); return () => this.revokeListeners.delete(listener); }
+    revoke(id) { const d = this.devices.get(id); if (!d)
+        throw new ProtocolError(404, 'unknown_device'); d.revoked = true; this.onRevoke(id); for (const listener of this.revokeListeners)
+        listener(id); }
+    ack(d, instanceId, revision) {
+        if (d.revoked)
+            throw new ProtocolError(401, 'repair_required');
+        if (!d.issued || instanceId !== d.issued.instanceId || revision !== d.issued.revision || (d.ack?.instanceId === instanceId && d.ack.revision > revision))
+            throw new ProtocolError(409, 'snapshot_mismatch');
+        d.ack = { instanceId, revision, receivedAt: this.now() };
+    }
+    status() { return { requests: [...this.requests.values()].filter(r => r.expiresAt > this.now()).map(r => this.publicRequest(r)), devices: [...this.devices.values()].map(d => ({ id: d.id, name: d.name, revoked: d.revoked, createdAt: d.createdAt, ack: d.ack, online: !!d.ack && this.now() - d.ack.receivedAt < 15000 })) }; }
+}

package/src/application/snapshots.js

@@ -0,0 +1,40 @@
+import { createHash, randomUUID } from 'node:crypto';
+export class Snapshots {
+    instanceId = randomUUID();
+    revision = 0;
+    signature = '';
+    inFlight = null;
+    last;
+    collect;
+    constructor(collect) { this.collect = collect; }
+    async get() {
+        if (this.last && Date.now() - this.last.generatedAt < 1500)
+            return this.last;
+        return this.inFlight ??= this.build().finally(() => { this.inFlight = null; });
+    }
+    async build() {
+        const raw = await this.collect();
+        const rows = raw.tasks.filter(t => t.provider !== 'codex' || t.applicationId === 'codex-desktop' || raw.mode === 'demo').map(t => ({
+            key: createHash('sha256').update(`${t.provider}:${t.id}`).digest('hex').slice(0, 32),
+            applicationId: t.applicationId ?? (t.provider === 'codex' ? 'codex-desktop' : 'claude-code'), title: t.title,
+            lifecycle: { active: 'running', attention: 'running', ended: 'completed', interrupted: 'cancelled', failed: 'failed', unknown: 'unknown' }[t.status],
+            ...(t.status === 'attention' ? { runningPhase: 'awaiting_feedback' } : t.status === 'active' ? { runningPhase: 'executing' } : {}),
+            ...(t.status === 'ended' ? { readState: t.provider === 'codex' && t.applicationId === 'codex-desktop' && t.nativeUnread && !t.sourceStale ? 'unread' : 'unconfirmed' } : {}),
+            activityAt: t.updatedAt || null, freshness: t.sourceStale ? 'stale' : 'fresh',
+        }));
+        const sources = raw.sources.map(s => ({ applicationId: s.provider === 'codex' ? 'codex-desktop' : 'claude-code',
+            displayName: s.provider === 'codex' ? 'Codex Desktop' : 'Claude Code',
+            health: s.errors ? 'unavailable' : 'partial',
+            capabilities: { lifecycle: 'partial', approvalWaiting: 'unsupported', feedbackWaiting: s.provider === 'claude' ? 'unverified' : 'partial', terminalFailure: s.provider === 'codex' ? 'partial' : 'unsupported', desktopViewing: s.provider === 'codex' && s.nativeUnreadAvailable ? 'partial' : 'unsupported' },
+            evidence: raw.mode === 'demo' ? 'synthetic' : s.provider === 'codex' ? 'local-log' : 'local-log-unverified',
+            coverage: `最近 ${raw.hours} 小时 / 最多 64 份日志；${s.coverage}；${s.provider === 'codex' && s.nativeUnreadAvailable ? '原生线程未读标记部分支持，缺失标记不证明已读' : '查看状态未接入'}；${s.files ?? 0} 份文件${s.errors ? '；采集不可用，保留旧数据' : ''}${s.capped ? '；已截断' : ''}${s.incompleteLines ? '；存在不完整行' : ''}`,
+            excludedUnidentified: s.provider === 'codex' ? raw.tasks.filter(t => t.applicationId === 'codex-unidentified').length : 0,
+        }));
+        const signature = createHash('sha256').update(JSON.stringify({ rows, sources, mode: raw.mode })).digest('hex');
+        if (signature !== this.signature) {
+            this.signature = signature;
+            this.revision++;
+        }
+        return this.last = { schemaVersion: 1, instanceId: this.instanceId, revision: this.revision, generatedAt: Date.now(), mode: raw.mode, sources, rows };
+    }
+}

package/src/cli.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { userRuntimeRoot } from "./infrastructure/runtime-root.js";
+import { qrExecutable } from "./infrastructure/qr.js";
+const args = process.argv.slice(2);
+const metadata = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+const command = Object.keys(metadata.bin ?? {})[0] ?? 'local-agent-dashboard';
+const value = (key) => { const i = args.indexOf(key); if (i < 0)
+    return undefined; if (!args[i + 1] || args[i + 1].startsWith('--'))
+    throw Error(`${key} 需要参数`); return args[i + 1]; };
+async function run() {
+    if (args.includes('--help') || args.includes('-h')) {
+        console.log(`Agent Signal ${metadata.version}\n用法：${command} [--demo] [--no-open] [--state-dir <目录>] [--port <端口>] [--lan-port <端口>] [--hours <1..168>] [--lan <IPv4,IPv4>]\n默认打开本机任务/配置页；在“连接手机”中应用网卡后启用 LAN TLS。\n--doctor 检查依赖；--version 查看版本。\n运行数据：${userRuntimeRoot()}\n依赖：macOS 13+、Node >=22.18、OpenSSL 3（可用 brew install openssl@3）。\n手机使用独立 Android APK；扫码后仍须电脑批准。`);
+        return;
+    }
+    if (args.includes('--version')) {
+        console.log(metadata.version);
+        return;
+    }
+    const allowed = new Set(['--demo', '--no-open', '--doctor', '--state-dir', '--port', '--lan-port', '--hours', '--lan', '--url-file']);
+    for (let i = 0; i < args.length; i++) {
+        if (!allowed.has(args[i]))
+            throw Error(`未知参数：${args[i]}`);
+        if (['--state-dir', '--port', '--lan-port', '--hours', '--lan', '--url-file'].includes(args[i])) {
+            value(args[i]);
+            i++;
+        }
+    }
+    if (process.platform !== 'darwin')
+        throw Error('当前电脑服务包仅支持 macOS；Android APK 单独下载。');
+    const openssl = process.env.AGENT_SIGNAL_OPENSSL ?? ['/opt/homebrew/opt/openssl@3/bin/openssl', '/usr/local/opt/openssl@3/bin/openssl'].find(p => existsSync(p)) ?? 'openssl';
+    let version;
+    try {
+        version = execFileSync(openssl, ['version'], { encoding: 'utf8', timeout: 5000 }).trim();
+    }
+    catch {
+        throw Error('找不到 OpenSSL 3，请先安装：brew install openssl@3；也可设置 AGENT_SIGNAL_OPENSSL。');
+    }
+    if (!/^OpenSSL 3\./.test(version))
+        throw Error('需要 OpenSSL 3；请安装 brew install openssl@3。');
+    process.env.AGENT_SIGNAL_OPENSSL = openssl;
+    if (!existsSync(qrExecutable()))
+        throw Error('二维码组件缺失，请重新下载完整服务端包。');
+    const runtime = resolve(value('--state-dir') ?? userRuntimeRoot());
+    if (args.includes('--doctor')) {
+        console.log(`依赖检查通过：Node ${process.version}；${version}\n数据目录：${runtime}\n二维码组件：可用`);
+        return;
+    }
+    const { main } = await import("./composition/main.js");
+    await main({ runtimeRoot: runtime, openBrowser: true });
+}
+run().catch(e => { console.error(`Agent Signal：${e.message}`); process.exitCode = 1; });

package/src/collector.js

@@ -0,0 +1,2 @@
+// Compatibility entry for the original probe.
+export * from "./adapters/agents/log-collector.js";

package/src/composition/main.js

@@ -0,0 +1,165 @@
+import { networkInterfaces, hostname } from 'node:os';
+import { readFile, writeFile, mkdir, unlink } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { join, resolve } from 'node:path';
+import { X509Certificate } from 'node:crypto';
+import { Collector, demoSnapshot } from "../adapters/agents/log-collector.js";
+import { Snapshots } from "../application/snapshots.js";
+import { Pairing } from "../application/pairing.js";
+import { certificates } from "../infrastructure/certificates.js";
+import { pairingLink } from "../infrastructure/pairing-link.js";
+import { spawn } from 'node:child_process';
+import { qr } from "../infrastructure/qr.js";
+import { createLan, tlsPolicy } from "../transport/lan/server.js";
+import { createDashboard } from "../server.js";
+export function interfaces() { return Object.entries(networkInterfaces()).flatMap(([name, addresses]) => (addresses ?? []).filter(a => a.family === 'IPv4' && !a.internal).map(a => ({ name, address: a.address }))); }
+export async function main(options = {}) {
+    const args = process.argv.slice(2), value = (key) => { const i = args.indexOf(key); return i < 0 ? undefined : args[i + 1]; };
+    const port = Number(value('--port') ?? 0), lanPort = Number(value('--lan-port') ?? 63982), hours = Number(value('--hours') ?? 24);
+    if (![port, lanPort].every(p => Number.isInteger(p) && p >= 0 && p <= 65535) || !Number.isFinite(hours) || hours < 1 || hours > 168)
+        throw new Error('端口或 hours 参数无效');
+    const initial = value('--lan')?.split(',') ?? [];
+    const runtime = options.runtimeRoot ?? (value('--state-dir') ? resolve(value('--state-dir')) : fileURLToPath(new URL('../../.runtime/', import.meta.url)));
+    let interfacesConfigured = args.includes('--lan');
+    await mkdir(runtime, { recursive: true, mode: 0o700 });
+    const lock = join(runtime, 'host.lock');
+    try {
+        await writeFile(lock, String(process.pid), { flag: 'wx', mode: 0o600 });
+    }
+    catch {
+        const pid = Number(await readFile(lock, 'utf8'));
+        if (!Number.isInteger(pid) || pid < 1)
+            throw new Error('未知 writer 锁；请检查 .runtime/host.lock');
+        try {
+            process.kill(pid, 0);
+            throw new Error('已有采集服务 writer 正在运行');
+        }
+        catch (e) {
+            if (e.code !== 'ESRCH')
+                throw e;
+        }
+        await unlink(lock);
+        await writeFile(lock, String(process.pid), { flag: 'wx', mode: 0o600 });
+    }
+    const collector = new Collector({ hours });
+    const snapshots = new Snapshots(() => args.includes('--demo') ? demoSnapshot() : collector.snapshot());
+    const pairing = new Pairing();
+    const lanServers = new Map();
+    let localServer;
+    let identity;
+    let addresses = [], endpoints = [], servicePort = lanPort, changing = false, stopping = false;
+    let certificateWarning = '';
+    const close = (s) => { s.closeAllConnections(); s.close(); };
+    async function chooseInterfaces(next) {
+        const available = interfaces();
+        if (changing || stopping || next.length > 8 || new Set(next).size !== next.length || next.some(a => typeof a !== 'string' || !available.some(i => i.address === a)))
+            throw new Error('请选择本机现有的明确 IPv4 地址');
+        changing = true;
+        const additions = new Map();
+        try {
+            if (next.length) {
+                const renewed = await certificates(join(runtime, 'identity'), next);
+                if (identity && renewed.computerId !== identity.computerId)
+                    throw new Error('电脑根已改变，需要明确重新配对');
+                for (const address of next)
+                    if (!lanServers.has(address)) {
+                        const server = createLan(renewed, pairing, snapshots, () => [`${address}:${servicePort}`]);
+                        additions.set(address, server);
+                        await new Promise((done, reject) => { server.once('error', reject); server.listen(servicePort, address, () => { servicePort = server.address().port; done(); }); });
+                    }
+                // A failure to bind any new interface leaves every prior listener/context intact.
+                for (const [address, server] of lanServers)
+                    if (next.includes(address))
+                        server.setSecureContext({ key: renewed.key, cert: renewed.cert, ...tlsPolicy });
+                identity = renewed;
+                certificateWarning = '';
+            }
+            for (const [address, server] of lanServers)
+                if (!next.includes(address)) {
+                    close(server);
+                    lanServers.delete(address);
+                }
+            for (const [address, server] of additions)
+                lanServers.set(address, server);
+            addresses = [...next];
+            endpoints = next.map(a => `https://${a}:${servicePort}`);
+            return { endpoints };
+        }
+        catch (e) {
+            for (const s of additions.values())
+                close(s);
+            throw e;
+        }
+        finally {
+            changing = false;
+        }
+    }
+    const renewal = setInterval(async () => {
+        if (changing || stopping || !identity || !addresses.length || Date.parse(new X509Certificate(identity.cert).validTo) - Date.now() > 2 * 86400000)
+            return;
+        try {
+            await chooseInterfaces(addresses);
+        }
+        catch {
+            certificateWarning = '服务证书续签失败；不会关闭验证。请检查电脑身份文件及 OpenSSL。';
+        }
+    }, 3600000);
+    renewal.unref();
+    try {
+        await chooseInterfaces(initial);
+        const local = createDashboard(() => snapshots.get(), async (action, input) => {
+            if (action === 'status')
+                return { ...pairing.status(), available: interfaces(), selectedAddresses: addresses, interfacesConfigured, endpoints, computerId: identity?.computerId, name: hostname(), restartRequiresApproval: true, certificateWarning };
+            if (action === 'interfaces') {
+                if (!Array.isArray(input.addresses))
+                    throw new Error('invalid addresses');
+                const result = await chooseInterfaces(input.addresses);
+                interfacesConfigured = true;
+                return result;
+            }
+            if (action === 'invite') {
+                if (!identity || !endpoints.length || changing)
+                    throw new Error('LAN disabled or changing');
+                const i = pairing.createInvite();
+                const descriptor = JSON.stringify({ protocol: 1, computerId: identity.computerId, name: hostname().slice(0, 60), endpoints, ca: identity.caDer, fingerprint: identity.fingerprint, invitation: i.secret, expiresAt: i.expiresAt });
+                const link = pairingLink(descriptor);
+                return { expiresAt: i.expiresAt, descriptor, link, image: `data:image/png;base64,${(await qr(link)).toString('base64')}` };
+            }
+            if (action === 'approve') {
+                pairing.approve(String(input.requestId), String(input.code));
+                return { approved: true };
+            }
+            if (action === 'revoke') {
+                pairing.revoke(String(input.deviceId));
+                return { revoked: true };
+            }
+            throw new Error('unknown action');
+        });
+        localServer = local.server;
+        await new Promise((done, reject) => { local.server.once('error', reject); local.server.listen(port, '127.0.0.1', done); });
+        const url = `http://127.0.0.1:${local.server.address().port}/`;
+        if (value('--url-file'))
+            await writeFile(value('--url-file'), `${url}\n`, { flag: 'wx', mode: 0o600 });
+        if ((options.openBrowser ?? !options.runtimeRoot) && !args.includes('--no-open') && process.platform === 'darwin') {
+            const browser = spawn('/usr/bin/open', [url + '#tasks'], { stdio: 'ignore' });
+            browser.on('error', () => { });
+            browser.unref();
+        }
+        console.log(`Agent Signal（${args.includes('--demo') ? '明确模拟模式' : '只读原生日志'}）\n电脑本机管理：${url}\n${endpoints.length ? `LAN TLS：${endpoints.join(', ')}\n首版每次重启需重新批准手机；运行中切换地址保留授权。` : 'LAN 未开启。请在电脑管理页明确选择地址后启用。手机仅使用 Android App。'}`);
+    }
+    catch (e) {
+        clearInterval(renewal);
+        for (const s of lanServers.values())
+            close(s);
+        if (localServer)
+            close(localServer);
+        await unlink(lock);
+        throw e;
+    }
+    const stop = async () => { if (stopping)
+        return; stopping = true; clearInterval(renewal); for (const s of lanServers.values())
+        close(s); if (localServer)
+        close(localServer); await unlink(lock); };
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+}

package/src/domain/sessions.js

@@ -0,0 +1,31 @@
+// The result version is an evidence binding, never a wall-clock approximation.
+export function reduceSession(s, e) {
+    if (e.type === 'title')
+        return { ...s, title: e.title ?? s.title };
+    if (e.type === 'viewed')
+        return e.turn === s.turn && s.lifecycle === 'completed' && !!e.version && e.version === s.resultVersion ? { ...s, readState: 'read' } : s;
+    if (e.type === 'started')
+        return e.at < (s.activityAt ?? 0) ? s : { ...s, turn: e.turn, lifecycle: 'running', runningPhase: 'executing', activityAt: e.at, readState: undefined, resultVersion: undefined };
+    if (s.turn !== e.turn || e.at < (s.activityAt ?? 0))
+        return s;
+    if (e.type === 'activity' && s.lifecycle !== 'running')
+        return s;
+    return { ...s, activityAt: e.at, lifecycle: { completed: 'completed', failed: 'failed', cancelled: 'cancelled' }[e.type] ?? s.lifecycle,
+        runningPhase: e.type === 'waiting' ? e.phase : s.runningPhase,
+        ...(e.type === 'completed' ? { readState: 'unconfirmed', resultVersion: e.version } : {}) };
+}
+export function queue(r) { return r.lifecycle === 'running' ? 'running' : r.lifecycle === 'failed' ? 'failed' : r.lifecycle === 'completed' && r.readState === 'unread' ? 'completed_unread' : null; }
+export function select(rows, applications, filter = 'all') {
+    const selected = rows.filter(r => applications.includes(r.applicationId));
+    const counts = { running: 0, completed_unread: 0, failed: 0, awaiting_approval: 0, awaiting_feedback: 0, unconfirmed: 0 };
+    for (const r of selected) {
+        const q = queue(r);
+        if (q)
+            counts[q]++;
+        if (q === 'running' && r.runningPhase && r.runningPhase !== 'executing')
+            counts[r.runningPhase]++;
+        if (r.lifecycle === 'completed' && r.readState === 'unconfirmed')
+            counts.unconfirmed++;
+    }
+    return { counts, rows: selected.filter(r => filter === 'all' || queue(r) === filter || (r.lifecycle === 'running' && r.runningPhase === filter)).sort((a, b) => (b.activityAt ?? -1) - (a.activityAt ?? -1) || a.key.localeCompare(b.key)) };
+}

package/src/infrastructure/certificates.js

@@ -0,0 +1,52 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile, chmod, lstat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { X509Certificate, randomBytes, createHash } from 'node:crypto';
+import { isIP } from 'node:net';
+const run = promisify(execFile);
+export async function certificates(root, addresses, openssl = process.env.AGENT_SIGNAL_OPENSSL ?? ['/opt/homebrew/opt/openssl@3/bin/openssl', '/usr/local/opt/openssl@3/bin/openssl'].find(p => existsSync(p)) ?? 'openssl') {
+    if (!addresses.length || addresses.length > 8 || addresses.some(a => isIP(a) !== 4))
+        throw new Error('Explicit IPv4 addresses required');
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    if ((await lstat(root)).isSymbolicLink())
+        throw new Error('Identity directory cannot be a symlink');
+    await chmod(root, 0o700);
+    const caKey = join(root, 'ca.key'), caFile = join(root, 'ca.pem');
+    const exists = async (p) => { try {
+        if ((await lstat(p)).isSymbolicLink())
+            throw new Error('Identity symlink rejected');
+        return true;
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return false;
+        throw e;
+    } };
+    const hasKey = await exists(caKey), hasCA = await exists(caFile);
+    if (hasKey !== hasCA)
+        throw new Error('Incomplete identity; explicit new pairing identity required');
+    if (!hasKey) {
+        await run(openssl, ['genpkey', '-algorithm', 'EC', '-pkeyopt', 'ec_paramgen_curve:P-256', '-out', caKey]);
+        await chmod(caKey, 0o600);
+        await run(openssl, ['req', '-new', '-x509', '-key', caKey, '-sha256', '-days', '730', '-subj', '/CN=Agent Signal private CA', '-addext', 'basicConstraints=critical,CA:TRUE,pathlen:0', '-addext', 'keyUsage=critical,keyCertSign,cRLSign', '-out', caFile]);
+        await chmod(caFile, 0o600);
+    }
+    const ca = await readFile(caFile, 'utf8'), parsedCA = new X509Certificate(ca);
+    if (!parsedCA.ca || Date.parse(parsedCA.validTo) < Date.now() + 86400000 || !parsedCA.verify(parsedCA.publicKey))
+        throw new Error('Root invalid/expiring; explicit re-pair required');
+    // Unique generation directory: never update a live key/certificate pair piecemeal.
+    const generation = join(root, `leaf-${randomBytes(8).toString('hex')}`);
+    await mkdir(generation, { mode: 0o700 });
+    const keyFile = join(generation, 'server.key'), csr = join(generation, 'server.csr'), certFile = join(generation, 'server.pem'), config = join(generation, 'extensions.cnf');
+    await writeFile(config, `basicConstraints=critical,CA:FALSE\nkeyUsage=critical,digitalSignature\nextendedKeyUsage=serverAuth\nsubjectAltName=${addresses.map(a => `IP:${a}`).join(',')}\n`, { mode: 0o600 });
+    await run(openssl, ['genpkey', '-algorithm', 'EC', '-pkeyopt', 'ec_paramgen_curve:P-256', '-out', keyFile]);
+    await chmod(keyFile, 0o600);
+    await run(openssl, ['req', '-new', '-key', keyFile, '-subj', '/CN=Agent Signal LAN', '-out', csr]);
+    await run(openssl, ['x509', '-req', '-in', csr, '-CA', caFile, '-CAkey', caKey, '-set_serial', `0x${randomBytes(16).toString('hex')}`, '-days', '7', '-sha256', '-extfile', config, '-out', certFile]);
+    await run(openssl, ['verify', '-purpose', 'sslserver', '-CAfile', caFile, certFile]);
+    const key = await readFile(keyFile, 'utf8'), cert = await readFile(certFile, 'utf8');
+    const fingerprint = createHash('sha256').update(parsedCA.raw).digest('hex');
+    return { key, cert, ca, caDer: parsedCA.raw.toString('base64'), fingerprint, computerId: fingerprint, addresses };
+}