termdock 1.4.322 → 1.4.324

package/dist/client/sw.js

@@ -1 +1 @@
-if(!self.define){let e,s={};const n=(n,i)=>(n=new URL(n+".js",i).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(i,a)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let r={};const c=e=>n(e,o),d={module:{uri:o},exports:r,require:c};s[o]=Promise.all(i.map(e=>d[e]||c(e))).then(e=>(a(...e),r))}}define(["./workbox-9845bf53"],function(e){"use strict";importScripts("sw-encrypted-background.js","sw-notifications.js","sw-secure-api.js","sw-downloads.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"index.html",revision:"033016787a43249e62a30135b9e6aa98"},{url:"assets/app-CfqF7_nh.js",revision:null},{url:"assets/react-XDCjal2T.js",revision:null},{url:"assets/dnd-BCFAPC0L.js",revision:null},{url:"assets/terminal-C7X98Amf.js",revision:null},{url:"assets/index-B4bEMUyn.css",revision:null},{url:"icons/agents/opencode.svg",revision:"851c2931d95821ba2b39b68587b48976"},{url:"icons/agents/kimi.svg",revision:"5366c710f4f763022fe159a69cf17409"},{url:"icons/agents/grok.svg",revision:"cd745b0b964545bc7a6b4f36021c3298"},{url:"icons/agents/goose.svg",revision:"c79b927278983c19098d77b4b0c11ab3"},{url:"icons/agents/gemini.svg",revision:"7a64f6d6f80a908255e9c0256903882e"},{url:"icons/agents/droid.svg",revision:"f28723b8c5c115e0908ba3c72613e256"},{url:"icons/agents/cursor.svg",revision:"a1528f3d3cda497f75a5db28defb19de"},{url:"icons/agents/copilot.svg",revision:"dd52e96c1eac0b6ec4bedcd0ddd3b52d"},{url:"icons/agents/codex.svg",revision:"608e55babb0b217e1f2da287342b46d3"},{url:"icons/agents/claude.svg",revision:"08af0225b7acdd8e8f573f3247e5e1c3"},{url:"icons/agents/amp.svg",revision:"af12f8b33faa81e4d46ea7b93c7e43f3"},{url:"apple-touch-icon-180x180.png",revision:"628c2e2f28a9b545aa57be1352025643"},{url:"boot-logo.png",revision:"2e3a25efd9b0b8ca1eab53b5f2284556"},{url:"favicon.ico",revision:"2994debfa6f59a0898e24eb0c54d64b5"},{url:"ipad-status-bar.js",revision:"3a8080edb8a5cc658a7908f6ad69537f"},{url:"maskable-icon-512x512.png",revision:"4d489331fd81f0713c400b26426442b9"},{url:"pwa-192x192.png",revision:"4d6f899888cfb8ccd7a1fd3c9e583ad2"},{url:"pwa-512x512.png",revision:"0885dd7ec8932e7f878b013d51a380a4"},{url:"robots.txt",revision:"d9339907142917dee4aac78494ac9cfe"},{url:"sw-downloads.js",revision:"48dab2e78bd93b4eee27fca487eccfde"},{url:"sw-notifications.js",revision:"fde578590ea8b0540d488ef448b48f45"},{url:"sw-secure-api.js",revision:"cf2bdbd03d41d66d60344c0b5a1075de"},{url:"manifest.webmanifest",revision:"83f9a43b74c236012adafb077fb6d774"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("index.html"),{denylist:[/^\/api\//,/^\/__termdock-download\//,/^\/health$/]})),e.registerRoute(/\/assets\/.*\.(?:js|css)$/,new e.CacheFirst({cacheName:"termdock-lazy-assets-v1",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:96,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/terminal\/[^/]+-[a-f0-9]{12}\.woff2$/,new e.CacheFirst({cacheName:"termdock-fonts-v2",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:384,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/.*\.(?:woff2|ttf)$/,new e.StaleWhileRevalidate({cacheName:"termdock-fonts-v1",plugins:[new e.ExpirationPlugin({maxEntries:24,maxAgeSeconds:2592e3})]}),"GET")});
+if(!self.define){let e,s={};const n=(n,i)=>(n=new URL(n+".js",i).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(i,a)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let c={};const r=e=>n(e,o),d={module:{uri:o},exports:c,require:r};s[o]=Promise.all(i.map(e=>d[e]||r(e))).then(e=>(a(...e),c))}}define(["./workbox-9845bf53"],function(e){"use strict";importScripts("sw-encrypted-background.js","sw-notifications.js","sw-secure-api.js","sw-downloads.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"index.html",revision:"f9b108bacc5daf8e78dac614880ef432"},{url:"assets/app-DCFOZi_L.js",revision:null},{url:"assets/react-XDCjal2T.js",revision:null},{url:"assets/dnd-BCFAPC0L.js",revision:null},{url:"assets/terminal-C7X98Amf.js",revision:null},{url:"assets/index-Ctz-IDjR.css",revision:null},{url:"icons/agents/opencode.svg",revision:"851c2931d95821ba2b39b68587b48976"},{url:"icons/agents/kimi.svg",revision:"5366c710f4f763022fe159a69cf17409"},{url:"icons/agents/grok.svg",revision:"cd745b0b964545bc7a6b4f36021c3298"},{url:"icons/agents/goose.svg",revision:"c79b927278983c19098d77b4b0c11ab3"},{url:"icons/agents/gemini.svg",revision:"7a64f6d6f80a908255e9c0256903882e"},{url:"icons/agents/droid.svg",revision:"f28723b8c5c115e0908ba3c72613e256"},{url:"icons/agents/cursor.svg",revision:"a1528f3d3cda497f75a5db28defb19de"},{url:"icons/agents/copilot.svg",revision:"dd52e96c1eac0b6ec4bedcd0ddd3b52d"},{url:"icons/agents/codex.svg",revision:"608e55babb0b217e1f2da287342b46d3"},{url:"icons/agents/claude.svg",revision:"08af0225b7acdd8e8f573f3247e5e1c3"},{url:"icons/agents/amp.svg",revision:"af12f8b33faa81e4d46ea7b93c7e43f3"},{url:"apple-touch-icon-180x180.png",revision:"628c2e2f28a9b545aa57be1352025643"},{url:"boot-logo.png",revision:"2e3a25efd9b0b8ca1eab53b5f2284556"},{url:"favicon.ico",revision:"2994debfa6f59a0898e24eb0c54d64b5"},{url:"ipad-status-bar.js",revision:"3a8080edb8a5cc658a7908f6ad69537f"},{url:"maskable-icon-512x512.png",revision:"4d489331fd81f0713c400b26426442b9"},{url:"pwa-192x192.png",revision:"4d6f899888cfb8ccd7a1fd3c9e583ad2"},{url:"pwa-512x512.png",revision:"0885dd7ec8932e7f878b013d51a380a4"},{url:"robots.txt",revision:"d9339907142917dee4aac78494ac9cfe"},{url:"sw-downloads.js",revision:"48dab2e78bd93b4eee27fca487eccfde"},{url:"sw-notifications.js",revision:"fde578590ea8b0540d488ef448b48f45"},{url:"sw-secure-api.js",revision:"cf2bdbd03d41d66d60344c0b5a1075de"},{url:"manifest.webmanifest",revision:"83f9a43b74c236012adafb077fb6d774"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("index.html"),{denylist:[/^\/api\//,/^\/__termdock-download\//,/^\/health$/]})),e.registerRoute(/\/assets\/.*\.(?:js|css)$/,new e.CacheFirst({cacheName:"termdock-lazy-assets-v1",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:96,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/terminal\/[^/]+-[a-f0-9]{12}\.woff2$/,new e.CacheFirst({cacheName:"termdock-fonts-v2",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:384,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/.*\.(?:woff2|ttf)$/,new e.StaleWhileRevalidate({cacheName:"termdock-fonts-v1",plugins:[new e.ExpirationPlugin({maxEntries:24,maxAgeSeconds:2592e3})]}),"GET")});

package/dist/server/agent/collaborationGroupRoutes.js

@@ -9,6 +9,21 @@ export function collaborationGroupRoutes(options) {
         res.json({ federationVersion: 1, capabilities: { groupRevision: 1, groupPromotion: 1, groupMove: 1, serverCollaboration: options.save ? 1 : undefined },
             groups: options.store.list(), sessions: options.sessions() });
     });
+    for (const [verb, archived] of [['archive', true], ['unarchive', false]]) {
+        router.post(`/collaboration-groups/:groupId/${verb}`, (req, res) => {
+            try {
+                const body = req.body ?? {};
+                if (Object.keys(body).some(key => !['expectedUpdatedAt', 'idempotencyKey'].includes(key)))
+                    throw new CollaborationError('INVALID_GROUP_ARCHIVE_REQUEST', 'Only expectedUpdatedAt and idempotencyKey are accepted', 400);
+                const result = options.store.setLocalGroupArchived(req.params.groupId, archived, body.expectedUpdatedAt, body.idempotencyKey);
+                res.json(result);
+            }
+            catch (error) {
+                res.status(error instanceof CollaborationError ? error.httpStatus : 500).json({ code: error instanceof CollaborationError ? error.code : 'GROUP_ARCHIVE_FAILED',
+                    ...(error instanceof CollaborationError && error.details ? error.details : {}), error: error instanceof Error ? error.message : 'Group archive operation failed' });
+            }
+        });
+    }
     router.post('/collaboration-groups', async (req, res) => {
         try {
             const body = req.body ?? {};

package/dist/server/agent/collaborationStore.js

@@ -82,6 +82,7 @@ export class CollaborationStore {
     historyAvailable = true;
     groupCreationAvailable = true;
     groupRenamesAvailable = true;
+    groupArchivesAvailable = true;
     /** `drawId` is the random source behind newCollaborationId. It is a
      *  constructor seam so tests can force a collision and prove the guard
      *  below actually skips it; production always uses the CSPRNG default. */
@@ -126,6 +127,16 @@ export class CollaborationStore {
                         && typeof value.applied.name === 'string' && !!value.applied.name.trim() && value.applied.name.length <= 256
                         && !COLLAB_NAME_FORBIDDEN.test(value.applied.name) && Number.isSafeInteger(value.applied.updatedAt) && value.applied.updatedAt >= 0));
             this.document.localGroupRenames = this.groupRenamesAvailable ? renames ?? {} : {};
+            const archives = parsed.localGroupArchives;
+            this.groupArchivesAvailable = [1, 2].includes(parsed.version ?? 0) && Array.isArray(parsed.groups)
+                && (parsed.localGroupArchivesComplete === undefined || parsed.localGroupArchivesComplete === true)
+                && (archives === undefined || archives !== null && typeof archives === 'object' && !Array.isArray(archives)
+                    && Object.entries(archives).every(([key, value]) => /^[a-f0-9]{64}$/.test(key) && value && typeof value.hash === 'string' && /^[a-f0-9]{64}$/.test(value.hash)
+                        && value.applied && typeof value.applied.id === 'string' && /^[a-zA-Z0-9._-]{1,80}$/.test(value.applied.id)
+                        && typeof value.applied.name === 'string' && !!value.applied.name.trim() && value.applied.name.length <= 256
+                        && !COLLAB_NAME_FORBIDDEN.test(value.applied.name) && Number.isSafeInteger(value.applied.updatedAt) && value.applied.updatedAt >= 0
+                        && (value.applied.archivedAt === undefined || Number.isSafeInteger(value.applied.archivedAt) && value.applied.archivedAt >= 0)));
+            this.document.localGroupArchives = this.groupArchivesAvailable ? archives ?? {} : {};
             this.document.sequence = Math.max(parsed.sequence ?? 0, this.document.sequence ?? 0);
             this.document.idempotency = parsed.idempotency ?? {};
             this.document.consumers = parsed.consumers ?? {};
@@ -138,10 +149,12 @@ export class CollaborationStore {
             this.historyAvailable = error.code === 'ENOENT';
             this.groupCreationAvailable = this.historyAvailable;
             this.groupRenamesAvailable = this.historyAvailable;
+            this.groupArchivesAvailable = this.historyAvailable;
         }
         this.document.terminalHistoryComplete = this.historyAvailable;
         this.document.localGroupRequestsComplete = this.groupCreationAvailable;
         this.document.localGroupRenamesComplete = this.groupRenamesAvailable;
+        this.document.localGroupArchivesComplete = this.groupArchivesAvailable;
         this.persistedDocument = JSON.stringify(this.document);
     }
     list() {
@@ -248,7 +261,54 @@ export class CollaborationStore {
             throw new CollaborationError('GROUP_NOT_LOCAL', 'Administrator metadata operations require a local group', 409);
         if (!Number.isSafeInteger(group.updatedAt) || group.updatedAt < 0)
             throw new CollaborationError('GROUP_STATE_UNCONFIRMED', 'Group revision is unavailable', 409);
-        return { id: group.id, name: group.name, updatedAt: group.updatedAt };
+        return { id: group.id, name: group.name, updatedAt: group.updatedAt, ...(group.archivedAt !== undefined ? { archivedAt: group.archivedAt } : {}) };
+    }
+    listLocalGroupMetadata(includeArchived = false) {
+        return this.list().filter(group => !group.federated && (includeArchived || group.archivedAt === undefined))
+            .map(group => ({ id: group.id, name: group.name, updatedAt: group.updatedAt,
+            ...(group.archivedAt !== undefined ? { archivedAt: group.archivedAt } : {}) }));
+    }
+    /** Archive is a reversible discovery flag; it never changes membership or message routing. */
+    setLocalGroupArchived(id, archived, expectedUpdatedAt, key) {
+        if (typeof id !== 'string' || !/^[a-zA-Z0-9._-]{1,80}$/.test(id))
+            throw new CollaborationError('INVALID_GROUP_ID', 'An exact group ID is required', 400);
+        if (typeof archived !== 'boolean')
+            throw new CollaborationError('INVALID_GROUP_ARCHIVE_REQUEST', 'Archive state must be explicit', 400);
+        if (!Number.isSafeInteger(expectedUpdatedAt) || expectedUpdatedAt < 0)
+            throw new CollaborationError('INVALID_GROUP_VERSION', 'expected_updated_at must be a non-negative safe integer', 400);
+        const requestKey = localGroupRequestKey(key);
+        if (!this.groupArchivesAvailable)
+            throw new CollaborationError('GROUP_ARCHIVE_STATE_UNCONFIRMED', 'Archive journal is unavailable; reconcile persisted state before changing group visibility', 409);
+        const hash = crypto.createHash('sha256').update(JSON.stringify(['archive-local-group', id, archived, expectedUpdatedAt])).digest('hex');
+        const previous = this.document.localGroupArchives?.[requestKey];
+        if (previous) {
+            if (previous.hash !== hash)
+                throw new CollaborationError('IDEMPOTENCY_CONFLICT', 'This administrator archive key was used with different parameters', 409);
+            const target = this.getGroup(id);
+            if (!target || target.deleted || target.federated)
+                throw new CollaborationError('GROUP_ARCHIVE_TARGET_UNAVAILABLE', 'Original local archive target is unavailable; no replacement is created', 409);
+            const group = this.getLocalGroupMetadata(id);
+            this.persist(true);
+            return { group, applied: { ...previous.applied }, replayed: true };
+        }
+        const current = this.getLocalGroupMetadata(id);
+        if (current.updatedAt !== expectedUpdatedAt)
+            throw new CollaborationError('GROUP_CHANGED', 'Group changed; read its current revision before deciding again', 409, { currentUpdatedAt: current.updatedAt });
+        if (Object.keys(this.document.localGroupArchives ?? {}).length >= 2000)
+            throw new CollaborationError('GROUP_ARCHIVE_LIMIT', 'Administrator archive journal has reached its 2000-record limit', 409);
+        const target = this.getGroup(id);
+        const currentlyArchived = target.archivedAt !== undefined;
+        const changed = currentlyArchived !== archived;
+        const updatedAt = changed ? Math.max(Date.now(), current.updatedAt + 1) : current.updatedAt;
+        if (!Number.isSafeInteger(updatedAt))
+            throw new CollaborationError('GROUP_STATE_UNCONFIRMED', 'Group revision cannot advance safely', 409);
+        const archivedAt = archived ? currentlyArchived ? target.archivedAt : Date.now() : undefined;
+        const applied = { id, name: target.name, updatedAt, ...(archivedAt !== undefined ? { archivedAt } : {}) };
+        this.document = { ...this.document, groups: this.document.groups.map(group => group.id === id
+                ? { ...group, updatedAt, ...(archivedAt !== undefined ? { archivedAt } : { archivedAt: undefined }) } : group),
+            localGroupArchives: { ...this.document.localGroupArchives, [requestKey]: { hash, applied } } };
+        this.persist(true);
+        return { group: { ...applied }, applied: { ...applied }, replayed: false };
     }
     /** Display metadata and its original receipt share a durable commit. */
     renameLocalGroup(id, value, expectedUpdatedAt, key) {
@@ -282,7 +342,8 @@ export class CollaborationStore {
         const updatedAt = name === current.name ? current.updatedAt : Math.max(Date.now(), current.updatedAt + 1);
         if (!Number.isSafeInteger(updatedAt))
             throw new CollaborationError('GROUP_STATE_UNCONFIRMED', 'Group revision cannot advance safely', 409);
-        const applied = { id, name, updatedAt };
+        const target = this.getGroup(id);
+        const applied = { id, name, updatedAt, ...(target.archivedAt !== undefined ? { archivedAt: target.archivedAt } : {}) };
         this.document = { ...this.document, groups: this.document.groups.map(group => group.id === id ? { ...group, name, updatedAt } : group),
             localGroupRenames: { ...this.document.localGroupRenames, [requestKey]: { hash, applied } } };
         this.persist(true);

package/dist/server/agent/collaborationTaskRoutes.js

@@ -1,6 +1,7 @@
 import { Router } from 'express';
 import { CollaborationError } from './collaborationProtocol.js';
 import { assertPeerRegistrationAuthority } from './collaborationPeerTransport.js';
+import { hasEncryptedServiceAccess } from '../federation/requestContext.js';
 export function collaborationTaskRoutes(options) {
     const router = Router();
     const groupId = (value) => {
@@ -15,8 +16,11 @@ export function collaborationTaskRoutes(options) {
         if (!tasks || !peers)
             throw new CollaborationError('TASK_SERVICE_STARTING', '任务服务正在启动，请稍后重试', 503);
         if (!options.agent) {
+            // Reading the inbox does not register peers or create durable authority.
+            // Open-mode full-service viewers may read; mutations still require admin.
             try {
-                assertPeerRegistrationAuthority(req);
+                if (!(['GET', 'HEAD'].includes(req.method) && hasEncryptedServiceAccess(req)))
+                    assertPeerRegistrationAuthority(req);
             }
             catch {
                 throw new CollaborationError('TASK_PERMISSION_DENIED', '当前连接无权处理协作任务', 403);

package/dist/server/agent/integrationCli.js

@@ -26,6 +26,14 @@ export const INTEGRATION_HELP = `td integration — local scoped integration adm
     GROUP_CHANGED, GROUP_NOT_FOUND, GROUP_NOT_LOCAL, GROUP_STATE_UNCONFIRMED,
     GROUP_RENAME_TARGET_UNAVAILABLE, GROUP_RENAME_STATE_UNCONFIRMED,
     GROUP_RENAME_LIMIT, ADMIN_LOCAL_GROUP_RENAME_UNSUPPORTED.
+  group archive|unarchive <exact-group-id> --expected-updated-at <N> --idempotency-key <key>
+    Administrator only; minimum CLI/running service 1.4.323; admin_local_group_archive=true.
+    Reversible discovery metadata only. Default groups list hides archived groups;
+    groups --include-archived lists them. group get always includes archivedAt when set.
+    Membership, principals, sessions, runtime, messages and history are unchanged.
+    Retry uncertain results with the same operation, revision and key; GROUP_CHANGED
+    requires rereading current metadata and choosing a new key. Archive receipts are
+    retained separately from the immutable group-create snapshot.
   group create --name <name> --idempotency-key <key>
     Administrator only; create an empty local group without a terminal source.
     Minimum CLI/running service 1.4.318; admin_local_group_create=true.
@@ -125,29 +133,33 @@ export async function runIntegrationAdmin(argv, port, adminToken, write) {
             return 0;
         }
         const socketPath = integrationSocketPath(port);
-        if (action === 'group' && ['get', 'rename'].includes(argv[1])) {
+        if (action === 'group' && ['get', 'rename', 'archive', 'unarchive'].includes(argv[1])) {
             const operation = argv[1], id = argv[2], args = {};
-            const usage = 'Usage: td integration group get <exact-id> | group rename <exact-id> --name <name> --expected-updated-at <N> --idempotency-key <key>';
+            const usage = 'Usage: td integration group get <exact-id> | group rename <exact-id> --name <name> --expected-updated-at <N> --idempotency-key <key> | group archive|unarchive <exact-id> --expected-updated-at <N> --idempotency-key <key>';
             if (!id || !/^[a-zA-Z0-9._-]{1,80}$/.test(id))
                 throw new CollaborationError('INVALID_GROUP_ID', usage, 400);
             if (operation === 'get' && argv.length !== 3)
                 throw new CollaborationError('INVALID_GROUP_RENAME_REQUEST', usage, 400);
-            if (operation === 'rename') {
+            if (operation !== 'get') {
                 for (let i = 3; i < argv.length; i += 2) {
-                    if (!['--name', '--expected-updated-at', '--idempotency-key'].includes(argv[i]) || !argv[i + 1] || Object.hasOwn(args, argv[i]))
-                        throw new CollaborationError('INVALID_GROUP_RENAME_REQUEST', usage, 400);
+                    const allowed = operation === 'rename' ? ['--name', '--expected-updated-at', '--idempotency-key'] : ['--expected-updated-at', '--idempotency-key'];
+                    if (!allowed.includes(argv[i]) || !argv[i + 1] || Object.hasOwn(args, argv[i]))
+                        throw new CollaborationError(operation === 'rename' ? 'INVALID_GROUP_RENAME_REQUEST' : 'INVALID_GROUP_ARCHIVE_REQUEST', usage, 400);
                     args[argv[i]] = argv[i + 1];
                 }
-                if (Object.keys(args).length !== 3 || !args['--name']?.trim() || !args['--idempotency-key']?.trim())
-                    throw new CollaborationError('INVALID_GROUP_RENAME_REQUEST', usage, 400);
+                if (operation === 'rename' ? Object.keys(args).length !== 3 || !args['--name']?.trim() || !args['--idempotency-key']?.trim()
+                    : Object.keys(args).length !== 2 || !args['--idempotency-key']?.trim())
+                    throw new CollaborationError(operation === 'rename' ? 'INVALID_GROUP_RENAME_REQUEST' : 'INVALID_GROUP_ARCHIVE_REQUEST', usage, 400);
                 if (!/^(0|[1-9][0-9]*)$/.test(args['--expected-updated-at']) || !Number.isSafeInteger(Number(args['--expected-updated-at'])))
                     throw new CollaborationError('INVALID_GROUP_VERSION', usage, 400);
             }
             const capabilities = parsed(await request(socketPath, 'GET', '/admin/capabilities', undefined, headers(undefined, adminToken)));
-            if (capabilities.admin_local_group_rename !== true)
-                throw new CollaborationError('ADMIN_LOCAL_GROUP_RENAME_UNSUPPORTED', 'CLI and running service must support administrator group metadata operations (minimum 1.4.319)', 409);
-            const body = operation === 'rename' ? { name: args['--name'], expected_updated_at: Number(args['--expected-updated-at']), idempotency_key: args['--idempotency-key'] } : undefined;
-            write(JSON.stringify(parsed(await request(socketPath, body ? 'POST' : 'GET', `/admin/groups/${encodeURIComponent(id)}${body ? '/rename' : ''}`, body, headers(undefined, adminToken)))));
+            const isArchive = operation === 'archive' || operation === 'unarchive';
+            if (capabilities[isArchive ? 'admin_local_group_archive' : 'admin_local_group_rename'] !== true)
+                throw new CollaborationError(isArchive ? 'ADMIN_LOCAL_GROUP_ARCHIVE_UNSUPPORTED' : 'ADMIN_LOCAL_GROUP_RENAME_UNSUPPORTED', `CLI and running service must support this operation (minimum 1.4.${isArchive ? '323' : '319'})`, 409);
+            const body = operation === 'get' ? undefined : { ...(operation === 'rename' ? { name: args['--name'] } : {}), expected_updated_at: Number(args['--expected-updated-at']), idempotency_key: args['--idempotency-key'] };
+            const suffix = operation === 'get' ? '' : `/${operation}`;
+            write(JSON.stringify(parsed(await request(socketPath, body ? 'POST' : 'GET', `/admin/groups/${encodeURIComponent(id)}${suffix}`, body, headers(undefined, adminToken)))));
             return 0;
         }
         if (action === 'group') {
@@ -213,16 +225,22 @@ export async function runIntegrationAdmin(argv, port, adminToken, write) {
             write(JSON.stringify(parsed(await request(socketPath, 'GET', `/admin/sessions/${encodeURIComponent(argv[1])}/restore-diagnostics`, undefined, headers(undefined, adminToken)))));
             return 0;
         }
-        for (let index = 1; index < argv.length; index += 2) {
-            const flag = argv[index];
-            if (!['--file', '--credential-file'].includes(flag) || !argv[index + 1] || options[flag])
-                throw new Error('Invalid integration arguments');
-            options[flag] = argv[index + 1];
-        }
+        if (action !== 'groups' && action !== 'list')
+            for (let index = 1; index < argv.length; index += 2) {
+                const flag = argv[index];
+                if (!['--file', '--credential-file'].includes(flag) || !argv[index + 1] || options[flag])
+                    throw new Error('Invalid integration arguments');
+                options[flag] = argv[index + 1];
+            }
         if (action === 'groups' || action === 'list') {
-            if (argv.length !== 1)
-                throw new Error('Unexpected arguments');
-            write(JSON.stringify(parsed(await request(socketPath, 'GET', action === 'groups' ? '/admin/groups' : '/admin/principals', undefined, headers(undefined, adminToken)))));
+            if (action === 'list' && argv.length !== 1 || action === 'groups' && argv.length > 2 || action === 'groups' && argv.length === 2 && argv[1] !== '--include-archived')
+                throw new Error('Usage: td integration groups [--include-archived] | list');
+            if (action === 'groups' && argv[1] === '--include-archived') {
+                const capabilities = parsed(await request(socketPath, 'GET', '/admin/capabilities', undefined, headers(undefined, adminToken)));
+                if (capabilities.admin_local_group_archive !== true)
+                    throw new CollaborationError('ADMIN_LOCAL_GROUP_ARCHIVE_UNSUPPORTED', 'CLI and running service must support archived group discovery (minimum 1.4.323)', 409);
+            }
+            write(JSON.stringify(parsed(await request(socketPath, 'GET', action === 'groups' ? `/admin/groups${argv[1] ? '?include_archived=true' : ''}` : '/admin/principals', undefined, headers(undefined, adminToken)))));
             return 0;
         }
         if (action === 'update') {

package/dist/server/agent/integrationServer.js

@@ -68,7 +68,7 @@ export class IntegrationRuntime {
             if (!expected.length || given.length !== expected.length || !timingSafeEqual(given, expected))
                 integrationError('INTEGRATION_ADMIN_REQUIRED', 'Local administration credential is required', 401);
         };
-        app.get('/admin/groups', run(req => { admin(req); return { groups: options.messages.list().filter(g => !g.federated).map(g => ({ id: g.id, name: g.name, updatedAt: g.updatedAt })) }; }));
+        app.get('/admin/groups', run(req => { admin(req); return { groups: options.messages.listLocalGroupMetadata(req.query.include_archived === 'true') }; }));
         app.get('/admin/groups/:id', run(req => { admin(req); return { group: options.messages.getLocalGroupMetadata(req.params.id) }; }));
         app.post('/admin/groups/:id/rename', run(req => {
             admin(req);
@@ -78,6 +78,22 @@ export class IntegrationRuntime {
             }
             return options.messages.renameLocalGroup(req.params.id, body.name, body.expected_updated_at, body.idempotency_key);
         }));
+        app.post('/admin/groups/:id/archive', run(req => {
+            admin(req);
+            const body = req.body;
+            if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(key => !['expected_updated_at', 'idempotency_key'].includes(key))) {
+                integrationError('INVALID_GROUP_ARCHIVE_REQUEST', 'Specify only expected_updated_at and idempotency_key');
+            }
+            return options.messages.setLocalGroupArchived(req.params.id, true, body.expected_updated_at, body.idempotency_key);
+        }));
+        app.post('/admin/groups/:id/unarchive', run(req => {
+            admin(req);
+            const body = req.body;
+            if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(key => !['expected_updated_at', 'idempotency_key'].includes(key))) {
+                integrationError('INVALID_GROUP_ARCHIVE_REQUEST', 'Specify only expected_updated_at and idempotency_key');
+            }
+            return options.messages.setLocalGroupArchived(req.params.id, false, body.expected_updated_at, body.idempotency_key);
+        }));
         app.post('/admin/groups', run(req => {
             admin(req);
             const body = req.body;
@@ -254,6 +270,7 @@ export class IntegrationRuntime {
             session_close: true, session_close_min_version: '1.4.315',
             admin_local_group_create: true, admin_local_group_create_min_version: '1.4.318',
             admin_local_group_rename: true, admin_local_group_rename_min_version: '1.4.319',
+            admin_local_group_archive: true, admin_local_group_archive_min_version: '1.4.323',
             integration_policy_update: true,
             session_restore_diagnostics: true,
             native_identity_linux_flock_owner: process.platform === 'linux',

package/dist/server/federation/packets.js

@@ -8,6 +8,16 @@ export class AsyncQueue {
     constructor(limit = 64) {
         this.limit = limit;
     }
+    /** Try to enqueue without changing the fail-closed behavior of push(). */
+    tryPush(value) {
+        if (this.ended)
+            throw new Error('Channel closed');
+        if (this.items.length >= this.limit)
+            return false;
+        this.items.push(value);
+        this.wake?.();
+        return true;
+    }
     push(value) {
         if (this.ended)
             throw new Error('Channel closed');
@@ -18,7 +28,9 @@ export class AsyncQueue {
         this.items.push(value);
         this.wake?.();
     }
+    get size() { return this.items.length; }
     end(error) { this.ended = true; this.error ??= error; this.wake?.(); }
+    clear() { this.items.length = 0; }
     async *[Symbol.asyncIterator]() {
         while (true) {
             if (this.error)
@@ -35,7 +47,13 @@ export class AsyncQueue {
         }
     }
 }
+export class PacketQueueBackpressureError extends Error {
+    code = 'PACKET_QUEUE_BACKPRESSURE';
+    constructor(message = 'Record queue capacity exceeded') { super(message); this.name = 'PacketQueueBackpressureError'; }
+}
 const MAX_PACKET = 2 * 1024 * 1024;
+const MAX_BUFFERED_PACKET_BYTES = MAX_PACKET * 2 + 8;
+const READ_BLOCK_BYTES = 64 * 1024;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder('utf-8', { fatal: true });
 /** Application records live entirely inside Noise; transport routing never sees them. */
@@ -43,24 +61,31 @@ export class PacketChannel {
     duplex;
     outgoing = new AsyncQueue(256);
     outgoingBytes = 0;
+    queuedBytesById = new Map();
+    closed = false;
     get hasPendingWrites() { return this.outgoingBytes > 0; }
+    queuedBytesFor(id) { return this.queuedBytesById.get(id) ?? 0; }
     done;
     constructor(duplex) {
         this.duplex = duplex;
         const self = this;
         this.done = duplex.sink((async function* () {
-            for await (const bytes of self.outgoing) {
+            for await (const packet of self.outgoing) {
                 try {
-                    yield bytes;
+                    yield packet.bytes;
                 }
                 finally {
-                    self.outgoingBytes -= bytes.byteLength;
+                    self.releaseQueuedPacket(packet);
                 }
             }
         })());
-        void this.done.catch(error => this.close(error instanceof Error ? error : new Error('Transport failed')));
+        void this.done.then(() => this.discardPending(), error => this.discardPending(error instanceof Error ? error : new Error('Transport failed')));
     }
     send(packet) {
+        // The item-count cap protects against floods of tiny records. Check it
+        // before encoding and keep this queue alive when it is temporarily full.
+        if (this.outgoing.size >= 256)
+            throw new PacketQueueBackpressureError('Record queue item limit exceeded');
         const body = encoder.encode(JSON.stringify(packet));
         if (body.length > MAX_PACKET)
             throw new Error('Record too large');
@@ -68,40 +93,166 @@ export class PacketChannel {
         new DataView(bytes.buffer).setUint32(0, body.length);
         bytes.set(body, 4);
         if (this.outgoingBytes + bytes.byteLength > 4 * 1024 * 1024)
-            throw new Error('Record queue byte budget exceeded');
+            throw new PacketQueueBackpressureError('Record queue byte budget exceeded');
+        const queued = { id: packet.id, bytes };
+        if (!this.outgoing.tryPush(queued))
+            throw new PacketQueueBackpressureError('Record queue item limit exceeded');
         this.outgoingBytes += bytes.byteLength;
-        try {
-            this.outgoing.push(bytes);
-        }
-        catch (error) {
-            this.outgoingBytes -= bytes.byteLength;
-            throw error;
-        }
+        this.queuedBytesById.set(packet.id, this.queuedBytesFor(packet.id) + bytes.byteLength);
+    }
+    releaseQueuedPacket(packet) {
+        this.outgoingBytes = Math.max(0, this.outgoingBytes - packet.bytes.byteLength);
+        const current = this.queuedBytesById.get(packet.id);
+        if (current === undefined)
+            return;
+        const remaining = current - packet.bytes.byteLength;
+        if (remaining > 0)
+            this.queuedBytesById.set(packet.id, remaining);
+        else
+            this.queuedBytesById.delete(packet.id);
+    }
+    close(error) {
+        // Closing the duplex stops transport delivery, so queued records cannot
+        // be described as drained. Discard them and release their accounting.
+        this.discardPending(error);
+    }
+    abort(error) {
+        this.discardPending(error);
+    }
+    discardPending(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.outgoing.clear();
+        this.outgoing.end(error);
+        this.outgoingBytes = 0;
+        this.queuedBytesById.clear();
+        this.duplex.close?.(error);
     }
-    close(error) { this.outgoing.end(error); this.duplex.close?.(error); }
     async *read() {
-        let pending = new Uint8Array(0);
+        const segments = [];
+        let firstSegment = 0;
+        let bufferedBytes = 0;
+        let spareBlock;
+        const parseFrame = (frame) => {
+            const packet = JSON.parse(decoder.decode(frame.subarray(4)));
+            if (!packet || typeof packet !== 'object' || typeof packet.id !== 'string' || typeof packet.type !== 'string')
+                throw new Error('Invalid record');
+            return packet;
+        };
+        const append = (chunk) => {
+            let offset = 0;
+            while (offset < chunk.byteLength) {
+                let tail = segments[segments.length - 1];
+                if (!tail || tail.end === tail.bytes.byteLength) {
+                    tail = { bytes: spareBlock ?? new Uint8Array(READ_BLOCK_BYTES), start: 0, end: 0 };
+                    spareBlock = undefined;
+                    segments.push(tail);
+                }
+                const take = Math.min(chunk.byteLength - offset, tail.bytes.byteLength - tail.end);
+                tail.bytes.set(chunk.subarray(offset, offset + take), tail.end);
+                tail.end += take;
+                offset += take;
+            }
+            bufferedBytes += chunk.byteLength;
+        };
+        const byteAt = (offset) => {
+            let index = firstSegment;
+            let position = offset;
+            while (index < segments.length) {
+                const segment = segments[index];
+                if (!segment) {
+                    index++;
+                    continue;
+                }
+                const available = segment.end - segment.start;
+                if (position < available)
+                    return segment.bytes[segment.start + position];
+                position -= available;
+                index++;
+            }
+            throw new Error('Incomplete record header');
+        };
+        const advance = (length) => {
+            bufferedBytes -= length;
+            while (length > 0) {
+                const segment = segments[firstSegment];
+                if (!segment) {
+                    firstSegment++;
+                    continue;
+                }
+                const take = Math.min(length, segment.end - segment.start);
+                segment.start += take;
+                length -= take;
+                if (segment.start === segment.end) {
+                    if (!spareBlock && segment.bytes.byteLength === READ_BLOCK_BYTES)
+                        spareBlock = segment.bytes;
+                    segments[firstSegment] = undefined;
+                    firstSegment++;
+                }
+            }
+            if (bufferedBytes === 0) {
+                segments.length = 0;
+                firstSegment = 0;
+                spareBlock = undefined;
+            }
+            else if (firstSegment >= 64 && firstSegment * 2 >= segments.length) {
+                segments.splice(0, firstSegment);
+                firstSegment = 0;
+            }
+        };
+        const recordBytes = (length) => {
+            const first = segments[firstSegment];
+            if (!first)
+                throw new Error('Incomplete record body');
+            const available = first.end - first.start;
+            if (available >= length) {
+                const result = first.bytes.subarray(first.start, first.start + length);
+                advance(length);
+                return result;
+            }
+            const result = new Uint8Array(length);
+            let index = firstSegment;
+            let written = 0;
+            while (written < length) {
+                const segment = segments[index];
+                if (!segment) {
+                    index++;
+                    continue;
+                }
+                const take = Math.min(length - written, segment.end - segment.start);
+                result.set(segment.bytes.subarray(segment.start, segment.start + take), written);
+                written += take;
+                index++;
+            }
+            advance(length);
+            return result;
+        };
         for await (const chunk of this.duplex.source) {
-            if (pending.length + chunk.length > MAX_PACKET * 2 + 8)
+            if (bufferedBytes + chunk.byteLength > MAX_BUFFERED_PACKET_BYTES)
                 throw new Error('Record buffer exceeded');
-            const next = new Uint8Array(pending.length + chunk.length);
-            next.set(pending);
-            next.set(chunk, pending.length);
-            pending = next;
-            while (pending.length >= 4) {
-                const size = new DataView(pending.buffer, pending.byteOffset, 4).getUint32(0);
+            if (bufferedBytes === 0 && chunk.byteLength >= 5) {
+                const size = ((chunk[0] * 0x1000000) + (chunk[1] << 16) + (chunk[2] << 8) + chunk[3]) >>> 0;
+                if (size > MAX_PACKET || size === 0)
+                    throw new Error('Invalid record size');
+                if (chunk.byteLength === size + 4) {
+                    yield parseFrame(chunk);
+                    continue;
+                }
+            }
+            if (chunk.byteLength)
+                append(chunk);
+            while (bufferedBytes >= 4) {
+                const size = ((byteAt(0) * 0x1000000) + (byteAt(1) << 16) + (byteAt(2) << 8) + byteAt(3)) >>> 0;
                 if (size > MAX_PACKET || size === 0)
                     throw new Error('Invalid record size');
-                if (pending.length < size + 4)
+                if (bufferedBytes < size + 4)
                     break;
-                const packet = JSON.parse(decoder.decode(pending.subarray(4, size + 4)));
-                if (!packet || typeof packet !== 'object' || typeof packet.id !== 'string' || typeof packet.type !== 'string')
-                    throw new Error('Invalid record');
-                yield packet;
-                pending = pending.slice(size + 4);
+                const frame = recordBytes(size + 4);
+                yield parseFrame(frame);
             }
         }
-        if (pending.length)
+        if (bufferedBytes)
             throw new Error('Truncated record');
     }
 }

package/dist/server/federation/requestContext.js

@@ -1,10 +1,15 @@
 // Object identity is deliberately used instead of a remotely forgeable header.
 const verified = new WeakSet();
 const subjects = new WeakMap();
-export function markEncryptedRequest(request, subjectId) {
+const serviceAccess = new WeakSet();
+export function markEncryptedRequest(request, subjectId, fullService = false) {
     verified.add(request);
     if (subjectId)
         subjects.set(request, subjectId);
+    if (fullService)
+        serviceAccess.add(request);
 }
 export function isEncryptedRequest(request) { return verified.has(request); }
 export function encryptedRequestSubject(request) { return subjects.get(request); }
+/** Set only by the target's authenticated internal dispatcher, never a page header. */
+export function hasEncryptedServiceAccess(request) { return serviceAccess.has(request); }