paseo-plugin-zcode-provider 0.2.0 → 0.4.0

package/server/vendor/zcode/packages/shared/src/off-peak-execution.ts

@@ -0,0 +1,73 @@
+import { z } from "zod";
+import { modelExecutionSchema } from "./model-execution.js";
+
+const identity = { executionId: z.string().min(1), offPeakTaskId: z.string().min(1) };
+export const offPeakLifecycleStateSchema = z.enum([
+  "running_idle",
+  "waiting_background",
+  "waiting_ticket",
+  "running_user",
+  "completed",
+  "cancelled",
+]);
+export const offPeakOutcomeSchema = z.enum(["succeeded", "failed", "stopped"]);
+export const offPeakLifecycleEventSchema = z.discriminatedUnion("type", [
+  z
+    .object({ ...identity, type: z.literal("state_changed"), state: offPeakLifecycleStateSchema })
+    .strict(),
+  z.object({ ...identity, type: z.literal("user_takeover") }).strict(),
+  z
+    .object({
+      ...identity,
+      type: z.literal("ticket_needed"),
+      renewalId: z.number().int().positive(),
+      expiredTicketId: z.string().min(1),
+    })
+    .strict(),
+  z
+    .object({ ...identity, type: z.literal("ticket_released"), ticketId: z.string().min(1) })
+    .strict(),
+  z.object({ ...identity, type: z.literal("completed"), outcome: offPeakOutcomeSchema }).strict(),
+]);
+const notificationOptions = offPeakLifecycleEventSchema.options.map((schema) =>
+  schema.extend({ sessionId: z.string().min(1) }),
+);
+export const offPeakLifecycleNotificationSchema = z.discriminatedUnion("type", [
+  notificationOptions[0]!,
+  ...notificationOptions.slice(1),
+]);
+export const offPeakControlParamsSchema = z.discriminatedUnion("action", [
+  z
+    .object({
+      sessionId: z.string().min(1),
+      executionId: z.string().min(1),
+      action: z.literal("replace_ticket"),
+      renewalId: z.number().int().positive(),
+      ticketId: z.string().min(1),
+      requestAuth: modelExecutionSchema.shape.requestAuth.unwrap(),
+    })
+    .strict(),
+  z
+    .object({
+      sessionId: z.string().min(1),
+      executionId: z.string().min(1),
+      action: z.literal("cancel"),
+    })
+    .strict(),
+]);
+export const offPeakControlResultSchema = z.object({ accepted: z.boolean() }).strict();
+export type OffPeakLifecycleEvent = z.infer<typeof offPeakLifecycleEventSchema>;
+export type OffPeakLifecycleNotification = z.infer<typeof offPeakLifecycleNotificationSchema>;
+export type OffPeakLifecycleState = z.infer<typeof offPeakLifecycleStateSchema>;
+export type OffPeakOutcome = z.infer<typeof offPeakOutcomeSchema>;
+export type OffPeakControlParams = z.infer<typeof offPeakControlParamsSchema>;
+export type OffPeakControlResult = z.infer<typeof offPeakControlResultSchema>;
+/** 闲时允许 Agent/Bash/SendMessage；工作流运行器和递归派发尚不归本票据管理。 */
+export const OFF_PEAK_EXECUTION_TOOL_DENYLIST = [
+  "OffPeakCreate",
+  "Workflow",
+  "CreateWorkflow",
+  "AmendWorkflow",
+  "ResumeWorkflowRun",
+  "EvalWorkflowSnippet",
+] as const;

package/server/vendor/zcode/packages/shared/src/protocol.ts

@@ -4,7 +4,9 @@ import type { ProviderFamilyDomain } from "./model-provider-family.js";
 import type { ProviderFamilyConnectionSelectionSettings } from "./provider-family-connection-selection.js";
 import type { ZCodeProvider } from "./zcode-task-types-core.js";
 import type { WorkspacePurpose } from "./workspacePurpose.js";
+import type { DynamicWorkflowMode } from "./dynamic-workflow-feature.js";
 import type { EmbeddedBrowserViewportPreference } from "./browser-use/command-metadata.js";
+import type { AppToolSearchMode } from "./app-runtime-preferences.js";
 
 // ── Domain types ──
 
@@ -156,14 +158,30 @@ export interface DockerRemoteTargetSnapshot {
   container: string;
 }
 
+export interface ServerRemoteTargetSnapshot {
+  kind: "server";
+  url: string;
+  name?: string;
+  workspacePath?: string;
+  serverId?: string;
+  /**
+   * Server token 不写入 setting.json。
+   * 这里只保存 credentialService 的键名，恢复时再读取真实 token。
+   */
+  tokenCredentialKey?: string;
+}
+
 export type RemoteTargetSnapshot =
   | SSHRemoteTargetSnapshot
   | WSLRemoteTargetSnapshot
-  | DockerRemoteTargetSnapshot;
+  | DockerRemoteTargetSnapshot
+  | ServerRemoteTargetSnapshot;
 
 export interface RemoteWorkspaceSessionSnapshot {
   /** 远程 workspace 的真实绝对路径 */
   workspacePath: string;
+  /** 用户可见的 workspace 分类；旧远端快照缺失时按 project 兼容读取。 */
+  workspacePurpose?: WorkspacePurpose;
   /** 发起远程连接时的本机 workspace 路径，仅用于 MCP filesystem 路径改写。 */
   localWorkspacePath?: string;
   /** 远程 workspace 的稳定身份键（authority + canonicalPath）。 */
@@ -272,16 +290,24 @@ export interface AppSettings {
    * 关闭后按钮不再渲染，且不因重启或版本更新自愈，仅能在设置页重新开启。
    */
   computerUseComposerEntryHidden?: boolean;
-  /** 自动归档已完成旧任务的总开关 */
+  /** 自动归档旧会话的总开关 */
   taskAutoArchiveEnabled?: boolean;
+  /** 自动归档修复后的一次性关闭标记；只用于设置迁移，不参与归档判断。 */
+  taskAutoArchiveResetVersion?: 1;
   /** 自动归档阈值；当任务最后更新时间早于该天数时允许被归档 */
   taskAutoArchiveOlderThanDays?: number;
-  /** Windows 桌面端关闭窗口时隐藏到托盘；其它平台忽略 */
+  /** 桌面端关闭窗口时隐藏到托盘驻留（Windows/Linux；spec：docs/desktop/linux-close-to-tray.md） */
   closeToTrayOnWindows?: boolean;
   /** 存在执行中的闲时任务时阻止系统闲置休眠（手动开关，防不了合盖）。 */
   keepAwakeWhileRunning?: boolean;
   /** Windows 关闭到托盘默认值是否已执行过一次性迁移；只用于设置迁移，不参与业务判断。 */
   closeToTrayOnWindowsMigrationInitialized?: boolean;
+  /**
+   * Linux 关闭到托盘默认值（关）是否已执行过一次性归位迁移。
+   * shared 迁移无平台概念、曾把存量 Linux 用户归为 true，而 Linux 此前无设置入口，
+   * main 进程 bootstrap 借此标记把首次启动的 Linux 用户一次性归位为默认关。
+   */
+  closeToTrayLinuxMigrationInitialized?: boolean;
   /** 桌面端全局页面缩放档位；用于重启后恢复界面缩放，Web/手机端忽略。 */
   desktopZoomLevel?: number;
   /** 桌面主窗口最近一次非最大化宽高及最大化状态；Web/手机端忽略。 */
@@ -311,6 +337,13 @@ export interface AppSettings {
   askUserQuestionAutoResolutionEnabled?: boolean;
   /** 是否完整保留 Model I/O；开启后不轮转、不限额重置、不压缩或裁剪，鉴权信息仍会脱敏。 */
   modelIoFullRetentionEnabled?: boolean;
+  /**
+   * 用户选的动态工作流模式（docs/dynamic-workflow/launch.md「The user's choice」）。缺席 = 跟随服务端
+   * 提供的模式；只在功能已提供时生效。选回提供的模式时删除该字段，未改动的安装继续跟随服务端翻转。
+   */
+  dynamicWorkflowMode?: DynamicWorkflowMode;
+  /** 已启用的内置 Agent CLI；UI 对外仍展示为“Install”，底层语义保持为启用内置能力。 */
+  enabledBuiltinAgentCliProviders?: ZCodeProvider[];
   /** 设置页中每个 Provider Family 当前唯一的结构化连接选择。 */
   providerFamilyConnectionSelections?: ProviderFamilyConnectionSelectionSettings;
   /** 用户通过 WelcomeScreen 成功连接后确认的 ZAI / BigModel provider family 运行域。 */
@@ -321,6 +354,8 @@ export interface AppSettings {
   providerFamilyDomainMigrated?: boolean;
   /** 新建或冷恢复 Session 是否为 Bash 注入 bfs/ugrep 增强；默认启用。 */
   nativeSearchEnhancementsEnabled?: boolean;
+  /** 新建或冷恢复时读取；已有 Runtime 保持原策略。 */
+  toolSearchMode?: AppToolSearchMode;
   /** 新建或冷恢复 Session 是否启用 Memory；默认关闭。 */
   memoryEnabled?: boolean;
   onboardingOccupation?:
@@ -340,8 +375,31 @@ export interface AppSettings {
     | "other"
     | null;
   proactiveSuggestionsEnabled?: boolean;
-  /** 上次关闭时的完整 workspace 会话（含本地与远端 workspace） */
+  /** 新版只保存活动执行目录；不表达项目/连接成员，null 表示明确清空。 */
+  lastActiveWorkspace?: PersistedWorkspaceSessionEntry | null;
+  /** Host 从项目/本机入口派生，供旧版降级读取；新版不作为入口真相。 */
   lastWorkspaceSession?: PersistedWorkspaceSessionEntry[];
+  /** 每个 Source Server 已解析的 canonical conversation backing workspace。 */
+  remoteConversationWorkspaceBySourceServerId?: Record<
+    string,
+    {
+      workspacePath: string;
+      lastResolvedAt: number;
+    }
+  >;
+  /** R3 控制端已识别的 Source Server；运行态仍由远端 Server 权威提供。 */
+  sourceServers?: import("./source-server/contracts.js").SourceServerRecord[];
+  /** R3 到达 Source Server 的线路；只保存 credential key，不保存 secret。 */
+  connectionProfiles?: import("./source-server/contracts.js").ConnectionProfile[];
+  /** R3 workspace 打开历史；连接线路与 workspace 实体分离。 */
+  sourceServerWorkspaceHistory?: import("./source-server/contracts.js").SourceServerWorkspaceHistoryEntry[];
+  /** 桌面端启动时是否执行 Source Server 静默重连；缺失按 true 兼容旧设置。 */
+  remoteStartupAutoReconnectEnabled?: boolean;
+  sourceServerDirectoryMigrationVersion?: 1;
+  /** 旧客户端只接受 2；保留回滚兼容，新介绍不使用该字段判断已读。 */
+  remoteBoundaryOnboardingVersion?: 2;
+  /** 仅表示用户明确确认持续运行介绍。 */
+  remoteBoundaryIntroAcknowledgedVersion?: 1;
   /** 上次关闭时激活的 tab 索引 */
   lastActiveTabIndex?: number;
   /** 每个 workspace 的最后活跃 taskId，下次打开自动恢复 */
@@ -364,6 +422,22 @@ export interface AppSettings {
   skippedElectronUpdateVersions?: Partial<Record<ElectronReleaseChannel, string>>;
   /** 首次启动设置同步提示是否已消费；只表示弹窗不再出现，不代表导入成功。 */
   settingsSyncFirstRunPromptHandled?: boolean;
+  /** 外部 Web 远控 relay 的非敏感设备身份；passHash 必须存 credentialService。 */
+  /** V2 非敏感注册身份；JWT 和一次性 token 不持久化于 AppSettings。 */
+  webRemoteControlRelayV2Device?: {
+    deviceSid: string;
+    userId: string;
+    endpointOrigin: string;
+  };
+  webRemoteControlExternalRelayDevice?: {
+    deviceSid: string;
+  };
+  /** 上次成功开启 Web 远控时的目标；缺失表示用户已明确关闭，不自动恢复。 */
+  webRemoteControlLastEnabledContext?: {
+    workspacePath: string;
+    workspaceIdentity?: string;
+    initialTaskId?: string;
+  };
   /** 设置页里的临时 endpoint override；正式/测试默认 base url 由 ZCODE_BASE_URL env 管理。 */
   zcodeEndpointOrigin?: string;
 }

package/server/vendor/zcode/packages/shared/src/remoteTarget.ts

@@ -0,0 +1,65 @@
+import type { RemoteAssetInstallMode } from "./remoteAssetInstallMode.js";
+import type { RemoteResourcePackageSelection } from "./remoteResourcePackages.js";
+
+export interface SSHConnectOptions {
+  kind: "ssh";
+  host: string;
+  port?: number;
+  username: string;
+  sshConfigAlias?: string;
+  password?: string;
+  privateKeyPath?: string;
+  privateKeyPassphrase?: string;
+  assetInstallMode?: RemoteAssetInstallMode;
+  resourcePackages?: RemoteResourcePackageSelection;
+}
+
+export interface WSLConnectOptions {
+  kind: "wsl";
+  distro?: string;
+  user?: string;
+}
+
+export interface DockerConnectOptions {
+  kind: "docker";
+  container: string;
+}
+
+export interface ServerConnectOptions {
+  kind: "server";
+  /** 已运行的 zcode-server HTTP(S)/WS(S) 入口。 */
+  url: string;
+  /** 用户可读名称，仅用于展示。 */
+  name?: string;
+  /** 临时连接凭据；持久化时必须转成 credential key。 */
+  token?: string;
+  /** 服务端默认工作区路径，可被连接流程中的 workspacePath 覆盖。 */
+  workspacePath?: string;
+  /** 远端服务实例稳定标识，用于 workspaceIdentity authority。 */
+  serverId?: string;
+}
+
+export type RemoteTarget =
+  | SSHConnectOptions
+  | WSLConnectOptions
+  | DockerConnectOptions
+  | ServerConnectOptions;
+
+/** 删除只应存在于当前连接流程中的 secret，供长期内存状态和跨进程回包使用。 */
+export function stripRemoteTargetSecrets(target: RemoteTarget): RemoteTarget {
+  if (target.kind === "ssh") {
+    const {
+      password: _password,
+      privateKeyPassphrase: _privateKeyPassphrase,
+      ...sanitized
+    } = target;
+    return sanitized;
+  }
+
+  if (target.kind === "server") {
+    const { token: _token, ...sanitized } = target;
+    return sanitized;
+  }
+
+  return target;
+}

package/server/vendor/zcode/packages/shared/src/request-security-edition/verification-policy.ts

@@ -0,0 +1,46 @@
+export type RequestVerificationConfig = Readonly<Record<string, unknown>>;
+export type RequestVerificationProof = Record<never, never>;
+export type RequestVerificationClientConfig = Record<never, never>;
+export const requestVerificationReasons = ["model-request"] as const;
+export type RequestVerificationReason = (typeof requestVerificationReasons)[number];
+export const requestVerificationTimeoutMessage =
+  "Provider runtime headers request timed out. Please send your message again.";
+export const REQUEST_VERIFICATION_REQUIRED = "request_verification_unavailable";
+export function readRequestVerificationConfig(
+  _configs: RequestVerificationClientConfig | null | undefined,
+): RequestVerificationConfig | null {
+  return null;
+}
+export function requestVerificationClaimHeaders(
+  _proof: RequestVerificationProof,
+): Record<string, string> {
+  return {};
+}
+export function withoutRequestVerificationHeaders(
+  headers: Record<string, string> | undefined,
+): Record<string, string> {
+  return { ...headers };
+}
+export function allowRequestVerificationHeaders(
+  _headers: Record<string, string>,
+): Record<string, string> {
+  return {};
+}
+export function requiresRequestVerification(_access: { mode: string } | undefined): boolean {
+  return false;
+}
+export function isRequestVerificationMessage(_message: string): boolean {
+  return false;
+}
+export function summarizeRequestVerificationHeaders(
+  _headers: Record<string, string>,
+): Record<string, unknown> {
+  return {};
+}
+export function requestVerificationDiagnostics(
+  _input: Record<string, unknown>,
+): Record<string, unknown> {
+  return {};
+}
+
+export const requestVerificationInteractionAvailable = false;

package/server/vendor/zcode/packages/shared/src/server-remote.ts

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { compatibilityManifestSchema } from "./source-server/compatibility.js";
+
+export const SERVER_REMOTE_PROTOCOL_VERSION = 1;
+
+const serverRemoteWorkspaceInfoShape = {
+  path: z.string().trim().min(1),
+  label: z.string().trim().min(1).optional(),
+  workspaceIdentity: z.string().trim().min(1).optional(),
+};
+
+/** 客户端 wire 解析忽略同 protocolVersion 下新增的 optional 字段。 */
+export const serverRemoteWorkspaceInfoSchema = z.object(serverRemoteWorkspaceInfoShape);
+
+/** Server 构造自身出参时使用 strict schema，避免意外泄漏字段。 */
+export const serverRemoteWorkspaceInfoOutputSchema = z
+  .object(serverRemoteWorkspaceInfoShape)
+  .strict();
+
+const serverRemoteInfoBaseShape = {
+  serverId: z.string().trim().min(1),
+  name: z.string().trim().min(1).optional(),
+  version: z.string(),
+  protocolVersion: z.literal(SERVER_REMOTE_PROTOCOL_VERSION),
+  authRequired: z.boolean(),
+};
+
+export const serverRemoteInfoSchema = z.object({
+  ...serverRemoteInfoBaseShape,
+  workspaces: z.array(serverRemoteWorkspaceInfoSchema),
+  compatibility: compatibilityManifestSchema.strip().optional(),
+  migration: z.object({ failedPathCount: z.number().int().nonnegative() }).optional(),
+  identity: z
+    .object({
+      osUser: z.string().trim().min(1),
+      hostname: z.string().trim().min(1),
+    })
+    .optional(),
+  capabilities: z.object({
+    desktopContinuous: z.literal(true),
+    websocketRpc: z.literal(true),
+    virtualProjects: z.literal(true).optional(),
+    // 旧 Server 缺少新增 dynamic event，必须先声明能力再订阅，避免异常打进对端读循环。
+    processResourceTelemetry: z.boolean().optional(),
+  }),
+});
+
+export const serverRemoteInfoOutputSchema = z
+  .object({
+    ...serverRemoteInfoBaseShape,
+    workspaces: z.array(serverRemoteWorkspaceInfoOutputSchema),
+    compatibility: compatibilityManifestSchema.optional(),
+    migration: z.object({ failedPathCount: z.number().int().nonnegative() }).strict().optional(),
+    identity: z
+      .object({
+        osUser: z.string().trim().min(1),
+        hostname: z.string().trim().min(1),
+      })
+      .strict()
+      .optional(),
+    capabilities: z
+      .object({
+        desktopContinuous: z.literal(true),
+        websocketRpc: z.literal(true),
+        virtualProjects: z.literal(true).optional(),
+        // 输入和严格输出保持同一能力合同，否则新 Server 会在监听前被自身 schema 拒绝。
+        processResourceTelemetry: z.boolean().optional(),
+      })
+      .strict(),
+  })
+  .strict();
+
+export const serverRemoteAnonymousInfoSchema = z.object({
+  version: z.string(),
+  protocolVersion: z.literal(SERVER_REMOTE_PROTOCOL_VERSION),
+  authRequired: z.literal(true),
+  compatibility: compatibilityManifestSchema.strip().optional(),
+});
+
+export type ServerRemoteWorkspaceInfo = z.infer<typeof serverRemoteWorkspaceInfoSchema>;
+
+export type ServerRemoteInfo = z.infer<typeof serverRemoteInfoSchema>;
+
+export type ServerRemoteAnonymousInfo = z.infer<typeof serverRemoteAnonymousInfoSchema>;
+
+export const serverRemoteHostCapabilitySchema = z
+  .object({
+    capability: z.string().trim().min(1),
+    expiresAt: z.number().int().positive(),
+  })
+  .strict();
+
+export type ServerRemoteHostCapability = z.infer<typeof serverRemoteHostCapabilitySchema>;

package/server/vendor/zcode/packages/shared/src/source-server/compatibility.ts

@@ -0,0 +1,115 @@
+import { z } from "zod";
+import { ZCODE_VERSION } from "../version.js";
+
+declare const __ZCODE_MIN_COMPATIBLE_VERSION__: string;
+
+export const ZCODE_MIN_COMPATIBLE_VERSION =
+  typeof __ZCODE_MIN_COMPATIBLE_VERSION__ !== "undefined"
+    ? __ZCODE_MIN_COMPATIBLE_VERSION__
+    : ZCODE_VERSION;
+
+export const compatibilityManifestSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    productVersion: z.string().trim().min(1),
+    minCompatibleVersion: z.string().trim().min(1),
+  })
+  .strict();
+
+export type CompatibilityManifest = z.infer<typeof compatibilityManifestSchema>;
+
+export function createCompatibilityManifest(
+  productVersion = ZCODE_VERSION,
+  minCompatibleVersion = ZCODE_MIN_COMPATIBLE_VERSION,
+): CompatibilityManifest {
+  return compatibilityManifestSchema.parse({
+    schemaVersion: 1,
+    productVersion,
+    minCompatibleVersion,
+  });
+}
+
+export const ZCODE_COMPATIBILITY_MANIFEST = Object.freeze(createCompatibilityManifest());
+
+interface ParsedVersion {
+  major: number;
+  minor: number;
+  patch: number;
+  prerelease: string[];
+}
+
+function parseVersion(value: string): ParsedVersion {
+  const match = value
+    .trim()
+    .match(/^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u);
+  if (!match) throw new Error(`Invalid compatibility version: ${value}`);
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4]?.split(".") ?? [],
+  };
+}
+
+function compareIdentifier(left: string, right: string): number {
+  const leftNumeric = /^\d+$/u.test(left);
+  const rightNumeric = /^\d+$/u.test(right);
+  if (leftNumeric && rightNumeric) return Number(left) - Number(right);
+  if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1;
+  return left.localeCompare(right);
+}
+
+export function compareCompatibilityVersions(left: string, right: string): number {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  for (const key of ["major", "minor", "patch"] as const) {
+    if (a[key] !== b[key]) return a[key] - b[key];
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const leftIdentifier = a.prerelease[index];
+    const rightIdentifier = b.prerelease[index];
+    if (leftIdentifier === undefined || rightIdentifier === undefined) {
+      return leftIdentifier === rightIdentifier ? 0 : leftIdentifier === undefined ? -1 : 1;
+    }
+    const comparison = compareIdentifier(leftIdentifier, rightIdentifier);
+    if (comparison !== 0) return comparison;
+  }
+  return 0;
+}
+
+export interface SourceServerCompatibilityResult {
+  compatible: boolean;
+  updateAvailable: boolean;
+  newerEndpoint: "controller" | "server" | "equal";
+  upgradeTarget?: "controller" | "server";
+  newerVersion: string;
+  olderVersion: string;
+  requiredMinimumVersion: string;
+}
+
+export function evaluateSourceServerCompatibility(
+  controller: CompatibilityManifest,
+  server: CompatibilityManifest,
+): SourceServerCompatibilityResult {
+  const comparison = compareCompatibilityVersions(controller.productVersion, server.productVersion);
+  const newerEndpoint = comparison > 0 ? "controller" : comparison < 0 ? "server" : "equal";
+  const newer = comparison >= 0 ? controller : server;
+  const older = comparison >= 0 ? server : controller;
+  const compatible =
+    compareCompatibilityVersions(older.productVersion, newer.minCompatibleVersion) >= 0;
+  return {
+    compatible,
+    updateAvailable: comparison !== 0,
+    newerEndpoint,
+    ...(!compatible
+      ? { upgradeTarget: comparison >= 0 ? ("server" as const) : ("controller" as const) }
+      : {}),
+    newerVersion: newer.productVersion,
+    olderVersion: older.productVersion,
+    requiredMinimumVersion: newer.minCompatibleVersion,
+  };
+}