specrails-desktop 2.63.2 → 2.64.1

package/server/dist/mobile/mobile-admin-router.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMobileAdminRouter = createMobileAdminRouter;
 const express_1 = require("express");
 const mobile_devices_1 = require("./mobile-devices");
+const desktop_db_1 = require("../desktop-db");
 const DEVICE_ID_RE = /^[A-Za-z0-9-]{1,64}$/;
 function createMobileAdminRouter(deps) {
     const router = (0, express_1.Router)();
@@ -37,10 +38,25 @@ function createMobileAdminRouter(deps) {
         const changed = (0, mobile_devices_1.revokeDevice)(desktopDb, id);
         if (changed) {
             gateway.bridge?.closeForDevice(id);
+            void gateway.closePreviewsForDevice(id).catch(() => { });
             deps.broadcast({ type: 'mobile.device_revoked', deviceId: id, timestamp: new Date().toISOString() });
         }
         res.json({ ok: changed });
     });
+    // —— Companion app previews (Desktop indicator) ——
+    router.get('/previews', (_req, res) => {
+        const previews = gateway.preview?.listDeviceSessions() ?? [];
+        res.json({ previews: previews.map((p) => ({ ...p, projectName: (0, desktop_db_1.getProject)(desktopDb, p.projectId)?.name ?? p.projectId })) });
+    });
+    router.delete('/previews/:projectId/:sessionId', async (req, res) => {
+        const projectId = typeof req.params.projectId === 'string' ? req.params.projectId : '';
+        const sessionId = typeof req.params.sessionId === 'string' ? req.params.sessionId : '';
+        if (!/^[A-Za-z0-9_-]{1,160}$/.test(projectId) || !/^[A-Za-z0-9_-]{1,160}$/.test(sessionId)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        res.json({ ok: (await gateway.preview?.endFromDesktop(projectId, sessionId)) ?? false });
+    });
     router.post('/cert/rotate', async (_req, res) => {
         const status = await gateway.rotateCert();
         res.json(status);

package/server/dist/mobile/mobile-gateway.js

@@ -17,6 +17,7 @@ const mobile_webrtc_peer_1 = require("./mobile-webrtc-peer");
 const mobile_signal_reconnect_1 = require("./mobile-signal-reconnect");
 const mobile_webrtc_1 = require("./mobile-webrtc");
 const agent_store_1 = require("../modules/agents/runtime/agent-store");
+const mobile_preview_1 = require("./mobile-preview");
 // Lifecycle owner of the second HTTPS+WSS listener (default :4202), hard-isolated
 // from the main server. Off by default; started on enable or boot-if-enabled.
 const DEFAULT_PORT = 4202;
@@ -47,12 +48,28 @@ class MobileGateway {
     _running = false;
     _boundPort = DEFAULT_PORT;
     _portOverride;
+    _preview;
     constructor(deps) {
         this._db = deps.desktopDb;
         this._desktopPort = deps.desktopPort;
         this._broadcast = deps.broadcast;
         this._bindHost = deps.bindHost ?? '0.0.0.0';
         this._portOverride = deps.port;
+        this._preview = deps.preview
+            ? new mobile_preview_1.MobilePreviewService({
+                ...deps.preview,
+                openChannel: (deviceId, label) => this._webrtc?.openChannel(deviceId, label) ?? null,
+                onChange: () => this._broadcast({ type: 'mobile.previews_changed', timestamp: new Date().toISOString() }),
+            })
+            : null;
+    }
+    get preview() {
+        return this._preview;
+    }
+    /** A revoked device loses its peer mapping and every preview it owns. */
+    async closePreviewsForDevice(deviceId) {
+        this._webrtc?.forgetDevice(deviceId);
+        await this._preview?.closeForDevice(deviceId);
     }
     get bridge() {
         return this._bridge;
@@ -139,6 +156,7 @@ class MobileGateway {
             db: this._db,
             desktopPort: this._desktopPort,
             currentFingerprint: () => this._cert.fingerprint,
+            ...(this._preview ? { preview: this._preview } : {}),
         }));
         const server = https_1.default.createServer({ cert: this._cert.certPem, key: this._cert.keyPem }, app);
         // BUG-MOBILE-02: scope each socket's subscribe to the device's granted

package/server/dist/mobile/mobile-missions.js

@@ -16,9 +16,11 @@ const record = (value) => value && typeof value === 'object' && !Array.isArray(v
 const pick = (value, keys) => Object.fromEntries(Object.entries(record(value)).filter(([key]) => keys.includes(key)));
 exports.MOBILE_PROTOCOL_VERSION = 2;
 exports.MISSION_ACCESS_REASON = 'Mission agents can access more than their pinned project. Missions require an all-projects device grant; your permitted Specs and Rails remain available.';
-function mobileCapabilities(db, deviceId) {
+function mobileCapabilities(db, deviceId, opts = {}) {
     const missions = process.env.SPECRAILS_AGENT_CHAT !== 'false' && (0, mobile_devices_1.getAllowedProjects)(db, deviceId) === null;
-    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)() },
+    // App preview targets come from mission processes, so it inherits the
+    // mission grant and additionally needs Desktop's browser capture.
+    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)(), appPreview: missions && opts.appPreview === true },
         ...(!missions ? { missionsUnavailableReason: process.env.SPECRAILS_AGENT_CHAT === 'false' ? 'Missions are disabled on Desktop.' : exports.MISSION_ACCESS_REASON } : {}) };
 }
 function conversationView(value) {
@@ -72,7 +74,7 @@ function missionSnapshot(value) {
         pendingMessages, pendingTruncated: pending.length > 50,
         live: { ...pick(live, ['isStreaming', 'startedAt']), streamingText, textTruncated: streamingText.length < liveRaw.length } };
 }
-function createMobileMissionsRouter({ db, upstream }) {
+function createMobileMissionsRouter({ db, upstream, appPreview }) {
     const router = (0, express_1.Router)();
     const segment = (value) => typeof value === 'string' ? value : '';
     const send = async (res, method, path, body, shape) => {
@@ -84,7 +86,7 @@ function createMobileMissionsRouter({ db, upstream }) {
             res.status(502).json({ error: 'Desktop is unreachable. Retry when connected.' });
         }
     };
-    router.get('/capabilities', (req, res) => res.json(mobileCapabilities(db, req.mobileDevice.id)));
+    router.get('/capabilities', (req, res) => res.json(mobileCapabilities(db, req.mobileDevice.id, { appPreview: appPreview?.() ?? false })));
     router.get('/mission-models', (req, res) => {
         const provider = segment(req.query.provider);
         if (!/^[a-z0-9_-]{1,40}$/.test(provider)) {

package/server/dist/mobile/mobile-preview-channel.js

@@ -0,0 +1,179 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreviewInboundLimiter = exports.PreviewChannelClient = exports.PREVIEW_INBOUND_MAX_BYTES = exports.PREVIEW_INBOUND_MAX_PER_MINUTE = exports.PREVIEW_MAX_MESSAGE_BYTES = exports.PREVIEW_CHUNK_HEADER_BYTES = exports.PREVIEW_CHANNEL_PREFIX = void 0;
+exports.encodeFrameChunks = encodeFrameChunks;
+exports.parsePreviewInbound = parsePreviewInbound;
+// Companion app preview: one WebRTC DataChannel per browser session, labelled
+// `preview:<sessionId>`, opened by Desktop on the device's EXISTING peer (a new
+// channel on an established SCTP association needs no SDP renegotiation). It is
+// separate from the `mobile` RPC channel so JPEG frames never queue ahead of RPC.
+//
+// Wire format (Desktop → Companion):
+//   - text:   JSON control (`ready`, `nav`, `popup`, `closed`) — always small.
+//   - binary: screencast frame fragments, each `u32 frameSeq | u16 index |
+//             u16 count` (big-endian) + payload. A frame renders only once all
+//             of its fragments arrived; a newer `frameSeq` discards an older
+//             incomplete one.
+// Wire format (Companion → Desktop): JSON text `{type:'input', event}` and
+// `{type:'navigate', action, url?}`.
+exports.PREVIEW_CHANNEL_PREFIX = 'preview:';
+exports.PREVIEW_CHUNK_HEADER_BYTES = 8;
+/** Same per-message budget the `mobile` channel's text chunking proved safe
+ *  across werift, libwebrtc (native companion) and browsers (web companion). */
+exports.PREVIEW_MAX_MESSAGE_BYTES = 16000;
+const MAX_CHUNKS = 0xffff;
+const WS_OPEN = 1;
+const WS_CLOSED = 3;
+/** Mirrors the PTY-tuned cap of `/ws/browser/:id` (BUG-MOBILE-07). */
+exports.PREVIEW_INBOUND_MAX_PER_MINUTE = 6000;
+exports.PREVIEW_INBOUND_MAX_BYTES = 64 * 1024;
+/** Split one JPEG frame into header-prefixed binary fragments. */
+function encodeFrameChunks(frameSeq, frame, maxMessageBytes = exports.PREVIEW_MAX_MESSAGE_BYTES) {
+    const payload = maxMessageBytes - exports.PREVIEW_CHUNK_HEADER_BYTES;
+    if (payload <= 0)
+        throw new RangeError('maxMessageBytes too small');
+    const count = Math.max(1, Math.ceil(frame.length / payload));
+    if (count > MAX_CHUNKS)
+        throw new RangeError('frame too large');
+    const seq = frameSeq >>> 0;
+    const chunks = [];
+    for (let index = 0; index < count; index++) {
+        const part = frame.subarray(index * payload, (index + 1) * payload);
+        const chunk = Buffer.allocUnsafe(exports.PREVIEW_CHUNK_HEADER_BYTES + part.length);
+        chunk.writeUInt32BE(seq, 0);
+        chunk.writeUInt16BE(index, 4);
+        chunk.writeUInt16BE(count, 6);
+        part.copy(chunk, exports.PREVIEW_CHUNK_HEADER_BYTES);
+        chunks.push(chunk);
+    }
+    return chunks;
+}
+/**
+ * Presents a preview DataChannel to `BrowserCaptureManager` as a
+ * `BrowserWsClient`, so attach/detach, popup state and the newest-wins
+ * screencast fan-out (which checks `bufferedAmount` BEFORE handing over a
+ * frame) are reused unchanged. A frame is always sent whole: conflation runs
+ * per frame, never per fragment, so a partial frame never goes out.
+ */
+class PreviewChannelClient {
+    channel;
+    frameSeq = 0;
+    constructor(channel) {
+        this.channel = channel;
+    }
+    get readyState() {
+        return this.channel.readyState === 'open' ? WS_OPEN : WS_CLOSED;
+    }
+    get bufferedAmount() {
+        return this.channel.bufferedAmount;
+    }
+    send(data) {
+        if (typeof data === 'string') {
+            this.channel.send(data);
+            return;
+        }
+        const seq = this.frameSeq;
+        this.frameSeq = (this.frameSeq + 1) >>> 0;
+        for (const chunk of encodeFrameChunks(seq, data))
+            this.channel.send(chunk);
+    }
+    close(_code, reason) {
+        try {
+            if (this.channel.readyState === 'open')
+                this.channel.send(JSON.stringify({ type: 'closed', reason: reason ?? 'session_closed' }));
+        }
+        catch { /* the channel is already going away */ }
+        try {
+            this.channel.close();
+        }
+        catch { /* ignore */ }
+    }
+}
+exports.PreviewChannelClient = PreviewChannelClient;
+const finite = (value) => typeof value === 'number' && Number.isFinite(value);
+const modifiers = (value) => Number.isInteger(value) && value >= 0 && value <= 15 ? value : undefined;
+const BUTTONS = new Set(['left', 'middle', 'right']);
+function parseEvent(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const e = raw;
+    switch (e.type) {
+        case 'mouse': {
+            if (!['move', 'down', 'up'].includes(e.action) || !finite(e.x) || !finite(e.y) || e.x < 0 || e.y < 0)
+                return null;
+            const button = typeof e.button === 'string' && BUTTONS.has(e.button) ? e.button : undefined;
+            const clickCount = Number.isInteger(e.clickCount) && e.clickCount >= 1 && e.clickCount <= 3 ? e.clickCount : undefined;
+            return { type: 'mouse', action: e.action, x: e.x, y: e.y, ...(button ? { button } : {}), ...(clickCount ? { clickCount } : {}), ...(modifiers(e.modifiers) !== undefined ? { modifiers: modifiers(e.modifiers) } : {}) };
+        }
+        case 'wheel': {
+            if (!finite(e.x) || !finite(e.y) || !finite(e.deltaX) || !finite(e.deltaY) || e.x < 0 || e.y < 0)
+                return null;
+            const clamp = (v) => Math.max(-10_000, Math.min(10_000, v));
+            return { type: 'wheel', x: e.x, y: e.y, deltaX: clamp(e.deltaX), deltaY: clamp(e.deltaY), ...(modifiers(e.modifiers) !== undefined ? { modifiers: modifiers(e.modifiers) } : {}) };
+        }
+        case 'key': {
+            if (!['down', 'up'].includes(e.action) || typeof e.key !== 'string' || e.key.length === 0 || e.key.length > 32)
+                return null;
+            const code = typeof e.code === 'string' && e.code.length <= 32 ? e.code : undefined;
+            const text = typeof e.text === 'string' && e.text.length <= 8 ? e.text : undefined;
+            return { type: 'key', action: e.action, key: e.key, ...(code ? { code } : {}), ...(text !== undefined ? { text } : {}), ...(modifiers(e.modifiers) !== undefined ? { modifiers: modifiers(e.modifiers) } : {}) };
+        }
+        case 'resize': {
+            if (!finite(e.width) || !finite(e.height) || e.width <= 0 || e.height <= 0)
+                return null;
+            return { type: 'resize', width: e.width, height: e.height, ...(finite(e.deviceScaleFactor) ? { deviceScaleFactor: e.deviceScaleFactor } : {}) };
+        }
+        default:
+            return null;
+    }
+}
+/** Validate one inbound control message; anything malformed is dropped. */
+function parsePreviewInbound(text) {
+    if (text.length > exports.PREVIEW_INBOUND_MAX_BYTES)
+        return null;
+    let msg;
+    try {
+        msg = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!msg || typeof msg !== 'object')
+        return null;
+    if (msg.type === 'input') {
+        const event = parseEvent(msg.event);
+        return event ? { type: 'input', event } : null;
+    }
+    if (msg.type === 'navigate') {
+        const action = msg.action ?? 'goto';
+        if (!['goto', 'back', 'forward', 'reload'].includes(action))
+            return null;
+        if (action === 'goto' && (typeof msg.url !== 'string' || msg.url.length > 2048))
+            return null;
+        return { type: 'navigate', action: action, ...(action === 'goto' ? { url: msg.url } : {}) };
+    }
+    return null;
+}
+/** Sliding one-minute message budget for one channel. */
+class PreviewInboundLimiter {
+    now;
+    maxPerMinute;
+    windowStart = 0;
+    count = 0;
+    constructor(now = Date.now, maxPerMinute = exports.PREVIEW_INBOUND_MAX_PER_MINUTE) {
+        this.now = now;
+        this.maxPerMinute = maxPerMinute;
+    }
+    take() {
+        const at = this.now();
+        if (at - this.windowStart >= 60_000) {
+            this.windowStart = at;
+            this.count = 0;
+        }
+        if (this.count >= this.maxPerMinute)
+            return false;
+        this.count += 1;
+        return true;
+    }
+}
+exports.PreviewInboundLimiter = PreviewInboundLimiter;

package/server/dist/mobile/mobile-preview.js

@@ -0,0 +1,366 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MobilePreviewService = exports.PreviewError = void 0;
+exports.createMobilePreviewRouter = createMobilePreviewRouter;
+const express_1 = require("express");
+const browser_capture_types_1 = require("../modules/browser/runtime/browser-capture-types");
+const preview_origins_1 = require("../modules/browser/domain/preview-origins");
+const agent_store_1 = require("../modules/agents/runtime/agent-store");
+const mobile_missions_1 = require("./mobile-missions");
+const mobile_preview_channel_1 = require("./mobile-preview-channel");
+class PreviewError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'PreviewError';
+    }
+}
+exports.PreviewError = PreviewError;
+/**
+ * Companion app-preview use cases. Owns only the channel bindings; sessions,
+ * budgets and the origin policy live in BrowserCaptureManager, targets in the
+ * process-log source. A binding is replaced on re-attach (new peer after a
+ * Wi-Fi drop) and detached — never killed — when its channel closes, so the
+ * idle sweep reclaims abandoned previews.
+ */
+class MobilePreviewService {
+    deps;
+    bindings = new Map();
+    now;
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.now ?? Date.now;
+    }
+    available() {
+        return this.deps.enabled();
+    }
+    /** Targets of a mission's running processes. */
+    targetsForMission(projectId, chatId) {
+        if (!this.available())
+            return [];
+        return this.deps.targets.list(projectId).filter((target) => target.chatId === chatId);
+    }
+    async open(device, projectId, input) {
+        const browser = this.requireBrowser(projectId);
+        const target = this.deps.targets.forProcess(projectId, input.processId);
+        if (!target || target.chatId !== input.chatId)
+            throw new PreviewError(404, 'preview_target_gone', 'This process is no longer running or announced no URL.');
+        const origin = (0, preview_origins_1.previewOrigin)(input.url);
+        if (!origin || !target.urls.some((url) => (0, preview_origins_1.previewOrigin)(url) === origin)) {
+            throw new PreviewError(400, 'preview_url_not_announced', 'Only URLs announced by this process can be previewed.');
+        }
+        let meta;
+        try {
+            meta = await browser.create({ initialUrl: input.url, owner: { kind: 'device', deviceId: device.id, deviceName: device.name }, viewport: input.viewport });
+        }
+        catch (err) {
+            throw translateBrowserError(err);
+        }
+        try {
+            const opened = { sessionId: meta.id, channel: this.bind(projectId, device.id, browser, meta.id), url: input.url };
+            this.changed();
+            return opened;
+        }
+        catch (err) {
+            await browser.kill(meta.id);
+            throw err;
+        }
+    }
+    /** Re-attach a live session after the peer reconnected. */
+    attach(device, projectId, sessionId) {
+        const browser = this.requireBrowser(projectId);
+        this.requireOwner(browser, device.id, sessionId);
+        return { sessionId, channel: this.bind(projectId, device.id, browser, sessionId) };
+    }
+    async navigate(device, projectId, sessionId, action, url) {
+        const browser = this.requireBrowser(projectId);
+        this.requireOwner(browser, device.id, sessionId);
+        try {
+            const result = await browser.navigateAsDevice(sessionId, device.id, action, url);
+            if (!result)
+                throw new PreviewError(404, 'preview_session_closed', 'This preview session has ended.');
+            return { url: result.url, title: result.title };
+        }
+        catch (err) {
+            throw translateBrowserError(err);
+        }
+    }
+    async close(device, projectId, sessionId) {
+        const browser = this.requireBrowser(projectId);
+        this.requireOwner(browser, device.id, sessionId);
+        this.unbind(sessionId);
+        await browser.kill(sessionId);
+        this.changed();
+    }
+    /** Live device-owned sessions across projects (Desktop indicator). */
+    listDeviceSessions() {
+        if (!this.available())
+            return [];
+        const sessions = [];
+        for (const browser of this.deps.allBrowsers()) {
+            for (const meta of browser.listSessions()) {
+                if (meta.owner.kind !== 'device')
+                    continue;
+                sessions.push({ projectId: meta.projectId, sessionId: meta.id, deviceId: meta.owner.deviceId, deviceName: meta.owner.deviceName,
+                    url: meta.url, title: meta.title, createdAt: meta.createdAt });
+            }
+        }
+        return sessions.sort((a, b) => b.createdAt - a.createdAt);
+    }
+    /** The Desktop user ends a phone's preview; the viewer shows "session closed". */
+    async endFromDesktop(projectId, sessionId) {
+        const browser = this.deps.browserFor(projectId);
+        if (!browser || browser.sessionOwner(sessionId)?.kind !== 'device')
+            return false;
+        // Kill first so the attached channel client receives `closed` before the
+        // binding is dropped.
+        const killed = await browser.kill(sessionId);
+        this.unbind(sessionId);
+        if (killed)
+            this.changed();
+        return killed;
+    }
+    /** Device revoked/unpaired: end every preview it owns, in every project. */
+    async closeForDevice(deviceId) {
+        for (const [sessionId, binding] of [...this.bindings])
+            if (binding.deviceId === deviceId)
+                this.unbind(sessionId);
+        for (const browser of this.deps.allBrowsers()) {
+            try {
+                await browser.killDeviceSessions(deviceId);
+            }
+            catch { /* best-effort per project */ }
+        }
+        this.changed();
+    }
+    changed() {
+        try {
+            this.deps.onChange?.();
+        }
+        catch { /* a notification failure never fails the use case */ }
+    }
+    requireBrowser(projectId) {
+        if (!this.available())
+            throw new PreviewError(404, 'preview_unavailable', 'App preview requires browser capture to be enabled on Desktop.');
+        const browser = this.deps.browserFor(projectId);
+        if (!browser)
+            throw new PreviewError(404, 'unknown_project', 'Unknown project');
+        return browser;
+    }
+    requireOwner(browser, deviceId, sessionId) {
+        const owner = browser.sessionOwner(sessionId);
+        // A session of another device or of Desktop is indistinguishable from a
+        // missing one: never confirm its existence to this device.
+        if (!owner || owner.kind !== 'device' || owner.deviceId !== deviceId) {
+            throw new PreviewError(404, 'preview_session_closed', 'This preview session has ended.');
+        }
+    }
+    bind(projectId, deviceId, browser, sessionId) {
+        const label = `${mobile_preview_channel_1.PREVIEW_CHANNEL_PREFIX}${sessionId}`;
+        const channel = this.deps.openChannel(deviceId, label);
+        if (!channel)
+            throw new PreviewError(409, 'preview_requires_webrtc', 'Reconnect Companion to Desktop to preview apps.');
+        this.unbind(sessionId);
+        const client = new mobile_preview_channel_1.PreviewChannelClient(channel);
+        const binding = { projectId, deviceId, channel, client };
+        this.bindings.set(sessionId, binding);
+        const limiter = new mobile_preview_channel_1.PreviewInboundLimiter(this.now);
+        const current = () => this.bindings.get(sessionId) === binding;
+        channel.onOpen(() => {
+            if (!current())
+                return;
+            void browser.attach(sessionId, client).then((meta) => {
+                if (!meta)
+                    client.close(1000, 'session_closed');
+            });
+        });
+        channel.onMessage((data) => {
+            if (!current() || !limiter.take())
+                return;
+            const msg = (0, mobile_preview_channel_1.parsePreviewInbound)(typeof data === 'string' ? data : data.toString('utf8'));
+            if (!msg)
+                return;
+            if (msg.type === 'input') {
+                void browser.handleInput(sessionId, msg.event).catch(() => { });
+            }
+            else {
+                void browser.navigateAsDevice(sessionId, deviceId, msg.action, msg.url).catch(() => {
+                    // A rejected or failed navigation keeps the current page; tell the
+                    // viewer so it can restore its address field.
+                    try {
+                        channel.send(JSON.stringify({ type: 'nav_rejected' }));
+                    }
+                    catch { /* ignore */ }
+                });
+            }
+        });
+        channel.onClose(() => {
+            browser.detach(sessionId, client);
+            if (current())
+                this.bindings.delete(sessionId);
+        });
+        return label;
+    }
+    unbind(sessionId) {
+        const binding = this.bindings.get(sessionId);
+        if (!binding)
+            return;
+        this.bindings.delete(sessionId);
+        try {
+            binding.channel.close();
+        }
+        catch { /* ignore */ }
+    }
+}
+exports.MobilePreviewService = MobilePreviewService;
+function translateBrowserError(err) {
+    if (err instanceof PreviewError)
+        return err;
+    if (err instanceof browser_capture_types_1.BrowserNavigationRejectedError)
+        return new PreviewError(400, 'preview_url_not_announced', 'Only URLs announced by this project can be opened in a preview.');
+    if (err instanceof browser_capture_types_1.BrowserLimitExceededError)
+        return new PreviewError(429, 'preview_limit', `Up to ${err.limit} phones can preview this project at once. Close another preview and retry.`);
+    return new PreviewError(502, 'preview_failed', 'Desktop could not open the preview. Retry in a moment.');
+}
+const ID = /^[A-Za-z0-9_-]{1,160}$/;
+const ACTIONS = new Set(['goto', 'back', 'forward', 'reload']);
+function viewportFrom(raw) {
+    if (!raw || typeof raw !== 'object')
+        return undefined;
+    const v = raw;
+    const ok = (n) => typeof n === 'number' && Number.isFinite(n) && n > 0;
+    if (!ok(v.width) || !ok(v.height))
+        return undefined;
+    return { width: v.width, height: v.height, ...(ok(v.deviceScaleFactor) ? { deviceScaleFactor: v.deviceScaleFactor } : {}) };
+}
+/**
+ * Gateway routes. Preview targets come from mission processes, so they follow
+ * the mission rule: an all-projects device grant (`mobile-mission-control`).
+ */
+function createMobilePreviewRouter({ db, preview }) {
+    const router = (0, express_1.Router)();
+    const segment = (value) => typeof value === 'string' ? value : '';
+    const device = (req) => {
+        const row = req.mobileDevice;
+        return { id: row.id, name: row.name };
+    };
+    const fail = (res, err) => {
+        if (err instanceof PreviewError) {
+            res.status(err.status).json({ error: err.message, code: err.code });
+            return;
+        }
+        res.status(500).json({ error: 'Preview failed', code: 'preview_failed' });
+    };
+    const gate = (req, res) => {
+        const pid = segment(req.params.pid);
+        if (!ID.test(pid)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return null;
+        }
+        if (!(0, mobile_missions_1.mobileCapabilities)(db, device(req).id).features.missions) {
+            res.status(403).json({ error: mobile_missions_1.MISSION_ACCESS_REASON });
+            return null;
+        }
+        if (!preview.available()) {
+            res.status(404).json({ error: 'App preview is unavailable on Desktop.', code: 'preview_unavailable' });
+            return null;
+        }
+        return pid;
+    };
+    const mission = (res, pid, cid) => {
+        if (!ID.test(cid)) {
+            res.status(400).json({ error: 'Invalid mission identity' });
+            return false;
+        }
+        const conversation = (0, agent_store_1.getAgentConversation)(db, cid);
+        if (!conversation || conversation.pinned_project_id !== pid) {
+            res.status(404).json({ error: 'Mission not found in this project' });
+            return false;
+        }
+        return true;
+    };
+    router.get('/projects/:pid/missions/:cid/preview-targets', (req, res) => {
+        const pid = gate(req, res);
+        if (!pid)
+            return;
+        const cid = segment(req.params.cid);
+        if (!mission(res, pid, cid))
+            return;
+        res.json({ targets: preview.targetsForMission(pid, cid).map(({ processId, urls }) => ({ processId, urls })) });
+    });
+    router.post('/projects/:pid/preview-sessions', async (req, res) => {
+        const pid = gate(req, res);
+        if (!pid)
+            return;
+        const body = (req.body ?? {});
+        const cid = segment(body.missionId), processId = segment(body.processId), url = segment(body.url);
+        if (!mission(res, pid, cid))
+            return;
+        if (!ID.test(processId) || !url || url.length > 2048) {
+            res.status(400).json({ error: 'processId and url are required' });
+            return;
+        }
+        try {
+            res.status(201).json(await preview.open(device(req), pid, { chatId: cid, processId, url, viewport: viewportFrom(body.viewport) }));
+        }
+        catch (err) {
+            fail(res, err);
+        }
+    });
+    router.post('/projects/:pid/preview-sessions/:sid/attach', (req, res) => {
+        const pid = gate(req, res);
+        if (!pid)
+            return;
+        const sid = segment(req.params.sid);
+        if (!ID.test(sid)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        try {
+            res.json(preview.attach(device(req), pid, sid));
+        }
+        catch (err) {
+            fail(res, err);
+        }
+    });
+    router.post('/projects/:pid/preview-sessions/:sid/navigate', async (req, res) => {
+        const pid = gate(req, res);
+        if (!pid)
+            return;
+        const sid = segment(req.params.sid);
+        const body = (req.body ?? {});
+        const action = segment(body.action) || 'goto';
+        const url = typeof body.url === 'string' ? body.url : undefined;
+        if (!ID.test(sid) || !ACTIONS.has(action) || (action === 'goto' && (!url || url.length > 2048))) {
+            res.status(400).json({ error: 'Invalid navigation' });
+            return;
+        }
+        try {
+            res.json(await preview.navigate(device(req), pid, sid, action, url));
+        }
+        catch (err) {
+            fail(res, err);
+        }
+    });
+    router.delete('/projects/:pid/preview-sessions/:sid', async (req, res) => {
+        const pid = gate(req, res);
+        if (!pid)
+            return;
+        const sid = segment(req.params.sid);
+        if (!ID.test(sid)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        try {
+            await preview.close(device(req), pid, sid);
+            res.json({ ok: true });
+        }
+        catch (err) {
+            fail(res, err);
+        }
+    });
+    return router;
+}