termdock 1.4.350 → 1.4.351

package/dist/client/sw.js

@@ -1 +1 @@
-if(!self.define){let e,s={};const n=(n,i)=>(n=new URL(n+".js",i).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(i,a)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let c={};const r=e=>n(e,o),d={module:{uri:o},exports:c,require:r};s[o]=Promise.all(i.map(e=>d[e]||r(e))).then(e=>(a(...e),c))}}define(["./workbox-9845bf53"],function(e){"use strict";importScripts("sw-encrypted-background.js","sw-notifications.js","sw-secure-api.js","sw-downloads.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"index.html",revision:"3168c3a96b6b28066432b083cbf3a4ef"},{url:"assets/app-CKAFlgMD.js",revision:null},{url:"assets/react-XDCjal2T.js",revision:null},{url:"assets/dnd-BCFAPC0L.js",revision:null},{url:"assets/terminal-Dea8wJF3.js",revision:null},{url:"assets/index-DtPsPZ7W.css",revision:null},{url:"icons/agents/opencode.svg",revision:"851c2931d95821ba2b39b68587b48976"},{url:"icons/agents/kimi.svg",revision:"5366c710f4f763022fe159a69cf17409"},{url:"icons/agents/grok.svg",revision:"cd745b0b964545bc7a6b4f36021c3298"},{url:"icons/agents/goose.svg",revision:"c79b927278983c19098d77b4b0c11ab3"},{url:"icons/agents/gemini.svg",revision:"7a64f6d6f80a908255e9c0256903882e"},{url:"icons/agents/droid.svg",revision:"f28723b8c5c115e0908ba3c72613e256"},{url:"icons/agents/cursor.svg",revision:"a1528f3d3cda497f75a5db28defb19de"},{url:"icons/agents/copilot.svg",revision:"dd52e96c1eac0b6ec4bedcd0ddd3b52d"},{url:"icons/agents/codex.svg",revision:"608e55babb0b217e1f2da287342b46d3"},{url:"icons/agents/claude.svg",revision:"08af0225b7acdd8e8f573f3247e5e1c3"},{url:"icons/agents/amp.svg",revision:"af12f8b33faa81e4d46ea7b93c7e43f3"},{url:"apple-touch-icon-180x180.png",revision:"628c2e2f28a9b545aa57be1352025643"},{url:"boot-logo.png",revision:"2e3a25efd9b0b8ca1eab53b5f2284556"},{url:"favicon.ico",revision:"2994debfa6f59a0898e24eb0c54d64b5"},{url:"ipad-status-bar.js",revision:"3a8080edb8a5cc658a7908f6ad69537f"},{url:"maskable-icon-512x512.png",revision:"4d489331fd81f0713c400b26426442b9"},{url:"pwa-192x192.png",revision:"4d6f899888cfb8ccd7a1fd3c9e583ad2"},{url:"pwa-512x512.png",revision:"0885dd7ec8932e7f878b013d51a380a4"},{url:"robots.txt",revision:"d9339907142917dee4aac78494ac9cfe"},{url:"sw-downloads.js",revision:"48dab2e78bd93b4eee27fca487eccfde"},{url:"sw-notifications.js",revision:"fde578590ea8b0540d488ef448b48f45"},{url:"sw-secure-api.js",revision:"cf2bdbd03d41d66d60344c0b5a1075de"},{url:"manifest.webmanifest",revision:"83f9a43b74c236012adafb077fb6d774"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("index.html"),{denylist:[/^\/api\//,/^\/__termdock-download\//,/^\/health$/]})),e.registerRoute(/\/assets\/.*\.(?:js|css)$/,new e.CacheFirst({cacheName:"termdock-lazy-assets-v1",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:96,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/terminal\/[^/]+-[a-f0-9]{12}\.woff2$/,new e.CacheFirst({cacheName:"termdock-fonts-v2",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:384,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/.*\.(?:woff2|ttf)$/,new e.StaleWhileRevalidate({cacheName:"termdock-fonts-v1",plugins:[new e.ExpirationPlugin({maxEntries:24,maxAgeSeconds:2592e3})]}),"GET")});
+if(!self.define){let e,s={};const n=(n,i)=>(n=new URL(n+".js",i).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(i,a)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let r={};const c=e=>n(e,o),d={module:{uri:o},exports:r,require:c};s[o]=Promise.all(i.map(e=>d[e]||c(e))).then(e=>(a(...e),r))}}define(["./workbox-9845bf53"],function(e){"use strict";importScripts("sw-encrypted-background.js","sw-notifications.js","sw-secure-api.js","sw-downloads.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"index.html",revision:"270d2f459f6b98922d3ae5ee4fe240ba"},{url:"assets/app-BB0CAQ8D.js",revision:null},{url:"assets/react-XDCjal2T.js",revision:null},{url:"assets/dnd-BCFAPC0L.js",revision:null},{url:"assets/terminal-Dea8wJF3.js",revision:null},{url:"assets/index-3lPto_1X.css",revision:null},{url:"icons/agents/opencode.svg",revision:"851c2931d95821ba2b39b68587b48976"},{url:"icons/agents/kimi.svg",revision:"5366c710f4f763022fe159a69cf17409"},{url:"icons/agents/grok.svg",revision:"cd745b0b964545bc7a6b4f36021c3298"},{url:"icons/agents/goose.svg",revision:"c79b927278983c19098d77b4b0c11ab3"},{url:"icons/agents/gemini.svg",revision:"7a64f6d6f80a908255e9c0256903882e"},{url:"icons/agents/droid.svg",revision:"f28723b8c5c115e0908ba3c72613e256"},{url:"icons/agents/cursor.svg",revision:"a1528f3d3cda497f75a5db28defb19de"},{url:"icons/agents/copilot.svg",revision:"dd52e96c1eac0b6ec4bedcd0ddd3b52d"},{url:"icons/agents/codex.svg",revision:"608e55babb0b217e1f2da287342b46d3"},{url:"icons/agents/claude.svg",revision:"08af0225b7acdd8e8f573f3247e5e1c3"},{url:"icons/agents/amp.svg",revision:"af12f8b33faa81e4d46ea7b93c7e43f3"},{url:"apple-touch-icon-180x180.png",revision:"628c2e2f28a9b545aa57be1352025643"},{url:"boot-logo.png",revision:"2e3a25efd9b0b8ca1eab53b5f2284556"},{url:"favicon.ico",revision:"2994debfa6f59a0898e24eb0c54d64b5"},{url:"ipad-status-bar.js",revision:"3a8080edb8a5cc658a7908f6ad69537f"},{url:"maskable-icon-512x512.png",revision:"4d489331fd81f0713c400b26426442b9"},{url:"pwa-192x192.png",revision:"4d6f899888cfb8ccd7a1fd3c9e583ad2"},{url:"pwa-512x512.png",revision:"0885dd7ec8932e7f878b013d51a380a4"},{url:"robots.txt",revision:"d9339907142917dee4aac78494ac9cfe"},{url:"sw-downloads.js",revision:"48dab2e78bd93b4eee27fca487eccfde"},{url:"sw-notifications.js",revision:"fde578590ea8b0540d488ef448b48f45"},{url:"sw-secure-api.js",revision:"cf2bdbd03d41d66d60344c0b5a1075de"},{url:"manifest.webmanifest",revision:"83f9a43b74c236012adafb077fb6d774"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("index.html"),{denylist:[/^\/api\//,/^\/__termdock-download\//,/^\/health$/]})),e.registerRoute(/\/assets\/.*\.(?:js|css)$/,new e.CacheFirst({cacheName:"termdock-lazy-assets-v1",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:96,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/terminal\/[^/]+-[a-f0-9]{12}\.woff2$/,new e.CacheFirst({cacheName:"termdock-fonts-v2",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:384,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/.*\.(?:woff2|ttf)$/,new e.StaleWhileRevalidate({cacheName:"termdock-fonts-v1",plugins:[new e.ExpirationPlugin({maxEntries:24,maxAgeSeconds:2592e3})]}),"GET")});

package/dist/server/agent/collaborationRoutes.js

@@ -162,6 +162,8 @@ export function collaborationRoutes({ store, resolveSession, deliver, rebind, di
     };
     router.get('/capabilities', run((_req, res) => {
         res.json({ protocol_version: 2, server_version: getTermdockVersion(), limits: COLLAB_LIMITS,
+            relay_authorization_errors: true, relay_authorization_errors_min_version: '1.4.351',
+            relay_self_target_guard: true, relay_self_target_guard_min_version: '1.4.351',
             route_diagnostics: !!diagnoseRoute, route_identity_recovery: !!diagnoseRoute, route_identity_recovery_min_version: '1.4.321',
             agent_launch_generation_consistency: true, agent_launch_generation_consistency_min_version: '1.4.322',
             terminal_input_check_diagnostics: true,

package/dist/server/entry.js

@@ -485,6 +485,7 @@ export function startServer(options = {}) {
     const desktopTargets = () => desktopDirectTargets(path.join(homedir(), '.termdock', 'desktop.json'), federationServiceId);
     const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true || collaborationTransport?.canRoute(subjectId, targetServiceId) === true, desktopTargets, () => activeRouteIds());
     const relayRouter = new RelayRouter({
+        isLocalTarget: id => id === federationServiceId,
         authenticate: context => context,
         allowRegister: (principal, serviceId) => routeAccess.allowRegister(principal, serviceId),
         allowRoute: (principal, serviceId) => routeAccess.allowRoute(principal, serviceId),

package/dist/server/federation/relay.js

@@ -211,7 +211,8 @@ export class RelayRouter {
             s.provider.streams.delete(s.providerId);
             send(s.provider.ws, { type: 'close', streamId: s.providerId, reason }, this.limits);
         }
-        send(s.owner.ws, { type: 'close', streamId: s.ownerId, reason }, this.limits);
+        send(s.owner.ws, { type: 'close', streamId: s.ownerId, reason,
+            ...(!this.canRoute(s.owner, s.serviceId) ? { code: 'RELAY_AUTHORIZATION_REQUIRED' } : {}) }, this.limits);
     }
     providerFailed(s, reason) {
         if (s.owner.streams.get(s.ownerId) !== s)
@@ -240,7 +241,19 @@ export class RelayRouter {
                 provider.streams.delete(s.providerId);
                 continue;
             }
-            s.deadline = setTimeout(() => this.providerFailed(s, 'Target timeout'), Math.min(this.limits.connectTimeoutMs, s.expires - Date.now()));
+            const deadline = Math.min(Date.now() + this.limits.connectTimeoutMs, s.expires);
+            const expire = () => {
+                // Timers can fire just before their absolute deadline. Do not fail a
+                // provider early and start a backup beyond the original route budget.
+                const remaining = deadline - Date.now();
+                if (remaining > 0) {
+                    s.deadline = setTimeout(expire, remaining);
+                    s.deadline.unref?.();
+                    return;
+                }
+                this.providerFailed(s, 'Target timeout');
+            };
+            s.deadline = setTimeout(expire, Math.max(0, deadline - Date.now()));
             s.deadline.unref?.();
             return true;
         }
@@ -264,10 +277,15 @@ export class RelayRouter {
             return;
         }
         if (f.type === 'open') {
+            if (this.options.isLocalTarget?.(f.serviceId)) {
+                send(peer.ws, { type: 'close', streamId: f.streamId, reason: 'Cannot relay to the entry itself', code: 'RELAY_SELF_TARGET' }, this.limits);
+                return;
+            }
             if (peer.streams.has(f.streamId))
                 throw new Error('Duplicate stream');
             if (!this.canRoute(peer, f.serviceId) || !this.hasRoute(f.serviceId)) {
-                send(peer.ws, { type: 'close', streamId: f.streamId, reason: 'Route unavailable or denied' }, this.limits);
+                send(peer.ws, { type: 'close', streamId: f.streamId, reason: 'Route unavailable or denied',
+                    ...(!this.canRoute(peer, f.serviceId) ? { code: 'RELAY_AUTHORIZATION_REQUIRED' } : {}) }, this.limits);
                 return;
             }
             if (peer.streams.size >= this.limits.maxStreams)

package/dist/server/federation/runtime.js

@@ -389,7 +389,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                     }
                     else if (packet.type === 'permissions') {
                         const grants = store.listEffective({ subjectId, serviceId });
-                        send({ type: 'result', id: packet.id, subjectId, serviceId, fullService: full(subjectId), grants, httpWindow: MAX_TRANSFER_WINDOW, binaryChunks: true, webTransport: options.webTransport?.() });
+                        send({ type: 'result', id: packet.id, subjectId, serviceId, fullService: full(subjectId), grants, httpWindow: MAX_TRANSFER_WINDOW, binaryChunks: true, relayAuthorizationErrors: true, relaySelfTargetGuard: true, webTransport: options.webTransport?.() });
                     }
                     else if (packet.type === 'session-list') {
                         const inventory = await sessionInventory();
@@ -411,6 +411,8 @@ export async function createFederationRuntime(app, directory, handlers, options
                         send({ type: 'result', id: packet.id, serviceId: subjectId, ...options.issueSelfRelayTicket(subjectId) });
                     }
                     else if (packet.type === 'route-invite-create') {
+                        if (packet.serviceId === serviceId)
+                            throw new Error('RELAY_SELF_TARGET');
                         check('authorization.manage');
                         if (!options.createRouteInvitation || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)
                             throw new Error('ROUTE_NOT_AVAILABLE');
@@ -433,6 +435,8 @@ export async function createFederationRuntime(app, directory, handlers, options
                         send({ type: 'result', id: packet.id, canManage, grants: canManage ? all : all.filter(grant => grant.subjectId === subjectId) });
                     }
                     else if (packet.type === 'route-grant') {
+                        if (packet.serviceId === serviceId)
+                            throw new Error('RELAY_SELF_TARGET');
                         check('authorization.manage');
                         if (!options.grantRouteAccess || typeof packet.serviceId !== 'string' || typeof packet.subjectId !== 'string')
                             throw new Error('ROUTE_NOT_AVAILABLE');
@@ -447,6 +451,8 @@ export async function createFederationRuntime(app, directory, handlers, options
                         send({ type: 'result', id: packet.id, revoked: options.revokeRouteAccess(packet.grantId) });
                     }
                     else if (packet.type === 'route-ticket') {
+                        if (packet.serviceId === serviceId)
+                            throw new Error('RELAY_SELF_TARGET');
                         if (typeof packet.serviceId !== 'string' || !options.hasRouteGrant?.(subjectId, packet.serviceId))
                             throw new Error('AUTHORIZATION_DENIED');
                         if (!options.issueRouteTicket || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)

package/dist/server/federation/socketDuplex.js

@@ -13,8 +13,8 @@ export function socketDuplex(socket) {
             close(new Error('Encrypted transport rejected frame'));
         }
     });
-    socket.addEventListener('close', () => input.end());
-    socket.addEventListener('error', () => input.end(new Error('Encrypted transport disconnected')));
+    socket.addEventListener('close', () => input.end(socket.transportFailure));
+    socket.addEventListener('error', () => input.end(socket.transportFailure || new Error('Encrypted transport disconnected')));
     return {
         source: input, close,
         async sink(source) {
@@ -28,7 +28,7 @@ export function socketDuplex(socket) {
                             await new Promise(resolve => setTimeout(resolve, 10));
                         }
                         if (socket.readyState !== 1)
-                            throw new Error('Encrypted transport closed');
+                            throw socket.transportFailure || new Error('Encrypted transport closed');
                         socket.send(chunk.subarray(offset, offset + 64 * 1024));
                     }
                 }

package/dist/server/utils/version.js

@@ -9,6 +9,8 @@ export const TERMDOCK_CAPABILITIES = [
     'desktop-service-discovery',
     'filesystem',
     'local-api',
+    'relay-access-recovery-v1',
+    'relay-self-target-guard-v1',
     'terminal-ws',
     'tmux',
 ];

package/docs/integrations.md

@@ -1485,3 +1485,26 @@ td integration close-diagnostics <原TD-session-id>
 需要更新的是**提供页面资源的入口服务**到 npm **1.4.350**，并让浏览器/PWA 实际加载新 bundle；CLI 文件版本或远端目标已经升级不能修复仍在运行的旧前端。正式包通过 `pinBundledRuntimeClientDist` 为当前运行进程固定页面快照，单独安装新包不会热替换旧进程提供的页面；按原 HTTPS/auth/supervisor 方式在维护窗重启该入口的 TD 服务，再核验资源，不手改快照。实际目标可保持原兼容版本（本轮场景349），无需为了此目录读取重启目标 Agent/DevBox。没有新 capability：这属于页面逻辑修复，以入口 /api/meta 版本与所服务主 JS 字节/手机实际脚本版本核验。已安装旧 SW 的 iPhone PWA 需等待更新后完全关闭重开；不清除配对/设备身份/授权数据作为修复。
 
 回归包含已接入 relay 的 active/entry 复用、点选复核、同 pin 备用地址、无活动通道时既有 relay 临时连接、借用与自有连接清理、不同目标/已关闭通道拒借、权限错误/pin 错误保留、不自动反向授权、不切服务、首次无 Service Worker 与断线不回退边界。另运行完整加密传输、拖放/预览/取消/通知桥接相关现有发布回归。维护机验证不冒充真实 iPhone/macOS 私有网络：正式手机原窗口“工作服务→可中转服务列表→原终端继续可用”仍由现场验收，不操作或重启 Arena。
+
+
+## 1.4.351：授权恢复与自中转防护
+
+授权与网络失败分开处理。`ConnectionAccessError.code` 只使用固定值：`RELAY_AUTHORIZATION_REQUIRED` 表示认证入口没有给当前设备有效中转授权，`TARGET_AUTHORIZATION_REQUIRED` 表示目标 permissions 没有有效访问授权，`PERMISSION_DENIED` 表示权限范围不足，`TARGET_IDENTITY_MISMATCH` 表示实际身份不匹配，`RELAY_SELF_TARGET` 表示入口被用作自身的中转目标。安全上下文仅含原目标、原入口 pin 与规范化入口 origin，不含 ticket、凭据或正文。没有确证时不显示“已撤销/已过期”；超时、失联和旧版模糊的 `Route unavailable or denied` 不推断成授权失效。
+
+入口 `route-ticket` 的明确权限拒绝会绑定原入口与最终目标。中转 close 帧新增可选稳定 `code`；浏览器在 WebSocket 建连、Noise、已建立通道断开及权限检查路径保留它，不再全部吞成普通连接错误。旧客户端忽略新增字段；新客户端也识别旧入口明确的 `Authorization revoked`，但只显示中性“没有有效中转授权”。旧入口未提供确证的失败继续显示网络问题，不能承诺能精确分类所有旧版错误。没有扩大任意 HTTP/WS 代理或增加多跳。
+
+同一目标会先尝试其它已保存、已有授权的路线；某一入口缺权限不立即阻断其它入口，但目标自身的明确拒绝不能借另一入口绕过。所有候选失败后保留身份/授权原因，暂停该目标自动重试。目标按自己的 pin 绑定，别的服务和工作空间不因此阻断。暂停为当前页面内存状态，重新打开页面会重新核对；不删除服务、路线、原终端或草稿，不重放业务写入。已打开的终端组件保留并在恢复提示期间失去输入焦点，避免隐藏界面继续输入。
+
+恢复界面说明哪一个入口到哪一个目标需要处理，提供“重新授权”或“登录目标服务”、“查看连接设置”和“取消”。取消不写权限，也可以返回恢复选项。中转恢复进入原目标/原入口的专用核对页：打开页只读，入口管理权限不足时仅说明需要该入口管理员或对应备用连接邀请；不会借入口密码自动换取广泛权限。已有管理权限者必须明确点击“授权此设备并重新连接”才调用原有目标限定 route-grant，然后重新读取同一设备的有效中转权限；仅写入成功不足以续连。目标登录使用既有目标登录页，不要求登录错误的入口。最终再读目标 permissions 才续接；晚到的旧页面/旧目标/旧 client 结果拒绝成为恢复成功。身份不匹配及范围不足只提供核对设置/联系管理员，不提供扩大授权的捷径。
+
+自动连接、后台重连、登录预连中的反向路线发现不再隐式 route-grant。发现地址不是授权，管理员权限也不是用户恢复被撤销路线的同意。用户明确点击已有授权/邀请入口时仍沿原契约执行。相关恢复过程不创建 Agent、任务或替代业务会话，不自动补 Enter。
+
+“可中转的服务”按实际握手入口的 `targetPeerId` 过滤同身份候选，并按候选 `serviceId` 去重；不按名称、IP、页面 origin 或 BOOT_SERVICE_ID 推断身份。同名不同身份仍保留，同身份的其它地址仍可作为直连备用地址。prepare/inspect/grant/invitation、历史自入口 intent 以及新连接保存均拒绝自中转，不删除用户历史。服务端保留目录过滤，并在 route-grant/ticket/invite-create 与实际 relay open 再拒绝自己的真实身份。另一个服务发布它自身给本入口的合法 self-relay 保持不变。这个防御不代表已证明某台手机曾收到后端自项。
+
+前端恢复界面和中性错误保留最低为 **1.4.351**。入口服务 1.4.351 支持完整稳定错误码与服务端自目标防护；最终目标服务可保持原兼容版本。本次实际 PWA 页面来自维护 Linux，不能把“工作=Mac”或 npm CLI 文件版本当成静态来源。发布后按原维护流程核对页面主 JS、实际服务版本和当前入口能力；不要为此重启目标 Agent/DevBox/Arena。需要入口新协议时，由入口所有者协调该入口的维护窗；不改运行快照或清 PWA 身份存储。
+
+能力探测：`/api/meta.capabilities` 含 `relay-access-recovery-v1`、`relay-self-target-guard-v1`；`td collab --session <自身ID> capabilities --json` 回读 `relay_authorization_errors=true`、`relay_self_target_guard=true`，两者 `_min_version=1.4.351`。认证 Noise `permissions` 同时返回 `relayAuthorizationErrors` 与 `relaySelfTargetGuard` 布尔。它们只描述此服务端能力，不证明手机已加载新页面或当前设备获授权。
+
+回归包括真实 Noise/中转授权撤回后的错误传播、网络与授权区分、其它合法路线成功、目标拒绝不绕过、零权限写入的展示/取消、窄中转授权明确确认及写后重读、管理员拒绝、精确目标登录、原终端/草稿保留、旧 client/目标/页面晚回执、同身份多地址/重复项/同名不同身份及 self-relay 兼容。发布工作流纳入相关服务管理组件与工作空间测试。原有总路由预算测试曾在未改动 350 基线复现计时器提前触发导致多试备用 provider；本版按原绝对 deadline 重核，不放宽超时预算或修改断言。
+
+维护机浏览器在 390×844 和 1280×800 的隔离夹具复核恢复选择、取消、无管理权限、指定目标登录与成功后的界面；夹具只记录读/写计数、不连接真实业务。真实 iPhone PWA/macOS 的授权失效交互仍由现场在安全夹具或自然失败中验收，不为测试撤销已恢复手机的正式授权。全仓前端 tsc 若被既有测试文件语法阻断应单列，生产源码类型检查、完整构建和发布回归独立报告，不修改无关测试。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.350",
+  "version": "1.4.351",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.350",
+  "version": "1.4.351",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-ObG1OGq7e7fMFQmYoPxPp3jRodEusYHulVNa5mT1aW8=",
-  "serverBundleHash": "sha256-2vXkNt6WtThYWY+7lOPI2qTULTqt2YLY6DEiMlTBb7k=",
-  "clientBundleHash": "sha256-dkLWMFf8+J1om0XjZtTEwhMb841CelOyfQlNnjtMxdA=",
+  "serverBundleHash": "sha256-9lfdVPuWoovGTXbZZCfstC1hVwb5x1Zf4yVu6qbbd9U=",
+  "clientBundleHash": "sha256-8em3ElG96RS1z3DO1XVTJ6daULNrNLIupJyA6j8G6Is=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }

package/dist/client/assets/CollaborationTaskContent-CG7g1LMH.js

@@ -1,2 +0,0 @@
-import{bA as r}from"./app-CKAFlgMD.js";import{b as m}from"./dnd-BCFAPC0L.js";import{b as n}from"./RightSidebar-DiECnX5D.js";import"./react-XDCjal2T.js";import"./terminal-Dea8wJF3.js";import"./App-TPJoJbGD.js";import"./gestureArbiter-sdzs-66-.js";import"./triangle-alert-BzBDJvJX.js";import"./referenceLongPress-B9K9yPKR.js";import"./DiffReview-Cnnt3TMK.js";import"./sparkles-e9SkpP7a.js";import"./DiffViewer-Dh40XiCM.js";import"./ChangeWalkthroughPanel-DN7BCzqC.js";function g({content:o}){const e=m.useMemo(()=>n(o.split(`
-`),null,null),[o]);return r.jsx("div",{className:"min-w-0 space-y-3 break-words text-sm leading-6 text-foreground [&_h1]:text-lg [&_h2]:text-base [&_h3]:text-sm [&_pre]:max-w-full [&_table]:text-xs",children:e.map((t,i)=>r.jsx("div",{className:"min-w-0",children:typeof t.content=="function"?t.content(null):t.content},i))})}export{g as default};