termdock 1.4.351 → 1.4.353

package/dist/server/routes/android.js

@@ -1,3 +1,5 @@
+import { encryptedRequestResources, encryptedRequestSubject, hasEncryptedServiceAccess } from '../federation/requestContext.js';
+import { directoryResource } from '../federation/resourceAccess.js';
 import { Router } from 'express';
 import { connectDevice, disconnectDevice, listDevices, resolveAdbBinary } from '../android/adb.js';
 import { createScrcpySession, resolveScrcpyBinaries } from '../android/scrcpy.js';
@@ -10,7 +12,7 @@ const DEBUG_ANDROID = process.env.TERMDOCK_ANDROID_DEBUG === '1';
 export function isValidAndroidSerial(serial) {
     return serial.length <= 128 && SERIAL_PATTERN.test(serial);
 }
-router.get('/devices', async (_req, res) => {
+router.get('/devices', async (req, res) => {
     try {
         const devices = await listDevices();
         let scrcpyVersion = null;
@@ -21,7 +23,8 @@ router.get('/devices', async (_req, res) => {
         catch {
             scrcpyVersion = null;
         }
-        res.json({ adbAvailable, scrcpyVersion, devices });
+        const shared = encryptedRequestResources(req);
+        res.json({ adbAvailable, scrcpyVersion, devices: shared && !hasEncryptedServiceAccess(req) ? devices.filter(d => shared.android?.some(a => a.serial === d.serial)) : devices });
     }
     catch (error) {
         res.status(503).json({ error: error instanceof Error ? error.message : 'ADB_UNAVAILABLE', code: 'ADB_UNAVAILABLE' });
@@ -48,6 +51,32 @@ router.post('/disconnect', async (req, res) => {
         res.status(400).json({ error: message, code: message });
     }
 });
+const recordingOwners = new WeakMap();
+router.use('/recordings', async (req, res, next) => {
+    const resources = encryptedRequestResources(req);
+    if (!resources || hasEncryptedServiceAccess(req)) {
+        next();
+        return;
+    }
+    const subject = encryptedRequestSubject(req);
+    if (!subject) {
+        res.sendStatus(403);
+        return;
+    }
+    try {
+        const id = /^\/([^/]+)(?:\/(?:stop|save))?$/.exec(req.path)?.[1];
+        const serial = id ? (await androidRecordings.info(id, subject)).serial : req.method === 'GET' ? req.query.serial : req.body?.serial;
+        if (typeof serial !== 'string' || !resources.android?.some(device => device.serial === serial))
+            throw new Error('PHONE_NOT_SHARED');
+        if (req.body?.directory !== undefined && (typeof req.body.directory !== 'string' || !directoryResource(resources, req.body.directory, true)))
+            throw new Error('DIRECTORY_NOT_SHARED');
+        recordingOwners.set(req, subject);
+        next();
+    }
+    catch {
+        res.status(403).json({ error: '此手机或录像未获授权', code: 'SHARE_ACCESS_DENIED' });
+    }
+});
 router.get('/recordings', async (req, res) => {
     const serial = typeof req.query.serial === 'string' ? req.query.serial : '';
     if (!isValidAndroidSerial(serial)) {
@@ -55,7 +84,7 @@ router.get('/recordings', async (req, res) => {
         return;
     }
     try {
-        res.json({ recordings: await androidRecordings.list(serial) });
+        res.json({ recordings: await androidRecordings.list(serial, recordingOwners.get(req)) });
     }
     catch (error) {
         res.status(500).json({ error: String(error) });
@@ -68,7 +97,7 @@ router.post('/recordings', async (req, res) => {
         return;
     }
     try {
-        res.json(await androidRecordings.start(serial));
+        res.json(await androidRecordings.start(serial, recordingOwners.get(req)));
     }
     catch (error) {
         res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
@@ -76,7 +105,7 @@ router.post('/recordings', async (req, res) => {
 });
 router.post('/recordings/:id/stop', async (req, res) => {
     try {
-        res.json(await androidRecordings.stop(req.params.id));
+        res.json(await androidRecordings.stop(req.params.id, recordingOwners.get(req)));
     }
     catch (error) {
         res.status(400).json({ error: String(error) });
@@ -86,7 +115,7 @@ router.post('/recordings/:id/save', async (req, res) => {
     try {
         const directory = req.body?.directory === undefined ? undefined
             : await (req.pathValidator ?? pathValidator).validateAsync(req.body.directory);
-        res.json({ path: await androidRecordings.save(req.params.id, directory) });
+        res.json({ path: await androidRecordings.save(req.params.id, directory, recordingOwners.get(req)) });
     }
     catch (error) {
         res.status(400).json({ error: error instanceof Error ? error.message : String(error) });
@@ -94,7 +123,7 @@ router.post('/recordings/:id/save', async (req, res) => {
 });
 router.delete('/recordings/:id', async (req, res) => {
     try {
-        await androidRecordings.discard(req.params.id);
+        await androidRecordings.discard(req.params.id, recordingOwners.get(req));
         res.json({ ok: true });
     }
     catch (error) {

package/dist/server/routes/computer.js

@@ -1,3 +1,4 @@
+import { VncReadOnlyFilter } from './vncReadOnly.js';
 import { Router } from 'express';
 import { isDeepStrictEqual } from 'node:util';
 import { hostname } from 'node:os';
@@ -99,13 +100,14 @@ export function stopComputerBridges() {
  * The eight-record receive window applies TCP backpressure without dropping bytes. */
 export function handleComputerWebSocket(socket, host, options) {
     if (options?.protocol === 'rdp') {
-        handleRdpWebSocket(socket, host, Number(options.port ?? 3389));
+        handleRdpWebSocket(socket, host, Number(options.port ?? 3389), options.readOnly);
         return;
     }
     if (options?.protocol && options.protocol !== 'vnc') {
         socket.close(4400, 'COMPUTER_INVALID_PROTOCOL');
         return;
     }
+    const filter = options?.readOnly ? new VncReadOnlyFilter() : undefined;
     let closed = false;
     let tcp;
     let sent = 0;
@@ -138,6 +140,13 @@ export function handleComputerWebSocket(socket, host, options) {
                 break;
             if (sent === acked)
                 lastAckAt = Date.now();
+            try {
+                filter?.serverData(bytes);
+            }
+            catch {
+                finish(4403, 'COMPUTER_READ_ONLY_PROTOCOL');
+                return;
+            }
             socket.send(JSON.stringify({ type: 'data', seq: ++sent, data: bytes.toString('base64') }));
             if (closed)
                 break;
@@ -164,13 +173,14 @@ export function handleComputerWebSocket(socket, host, options) {
                 const bytes = Buffer.from(message.data, 'base64');
                 if (!bytes.length || bytes.length > 64 * 1024 || tcp.writableLength + bytes.length > 1024 * 1024)
                     throw new Error('INPUT_LIMIT');
-                tcp.write(bytes);
+                for (const permitted of filter ? filter.clientData(bytes) : [bytes])
+                    tcp.write(permitted);
             }
             else
                 throw new Error('INVALID_MESSAGE');
         }
-        catch {
-            finish(4400, 'COMPUTER_INVALID_MESSAGE');
+        catch (error) {
+            finish(4400, error instanceof Error && error.message === 'COMPUTER_READ_ONLY_PROTOCOL' ? error.message : 'COMPUTER_INVALID_MESSAGE');
         }
     });
     void (async () => {

package/dist/server/routes/filesystem.js

@@ -1,3 +1,4 @@
+import { sharedFileBoundary } from './sharedFiles.js';
 import { getHideGitIgnoredRootsSetting, getGitIgnoreExceptionsSetting } from '../utils/settings.js';
 import { readRecentCommitHistory } from '../utils/recentCommitHistory.js';
 import { AUTH_COOKIE, isSessionValid } from '../utils/authProtection.js';
@@ -26,6 +27,7 @@ import { convertHeicPreview, HEIC_PREVIEW_MIME_TYPES, isHeicPreviewPath } from '
 import { getWatchErrorCode, diffWatchSnapshots, enqueueLatestWatchEvent, inspectLinuxInotifyUsage, isWatchResourceExhaustion, normalizeDirectoryWatchRoots, resolveDirectWatchEventPath, WATCH_IGNORED_NAMES, WATCH_RESOURCE_BACKOFF_MS, } from '../utils/fileWatchPolicy.js';
 import { isResponseWritable, writeResponseChunk } from '../utils/httpResponse.js';
 const router = Router();
+router.use(sharedFileBoundary);
 const MAX_FILE_SIZE = 1024 * 1024; // 1MB
 const MAX_IMAGE_PREVIEW_SIZE = 20 * 1024 * 1024; // 20MB
 const MAX_HTML_PREVIEW_SIZE = 20 * 1024 * 1024; // 20MB
@@ -5057,9 +5059,9 @@ router.post('/open-in-file-browser', async (req, res) => {
         res.status(500).json({ error: message, code: 'OPEN_FILE_BROWSER_FAILED' });
     }
 });
-router.post('/upload', async (req, res) => {
+export async function handleFileUpload(req, res, destinationDirectory) {
     try {
-        const dir = typeof req.query.dir === 'string' ? req.query.dir : '';
+        const dir = destinationDirectory ?? (typeof req.query.dir === 'string' ? req.query.dir : '');
         if (!dir) {
             res.status(400).json({ error: 'Missing dir query parameter', code: 'MISSING_DIR' });
             return;
@@ -5203,7 +5205,8 @@ router.post('/upload', async (req, res) => {
         const message = error instanceof Error ? error.message : 'Upload failed';
         res.status(500).json({ error: message, code: 'UPLOAD_FAILED' });
     }
-});
+}
+router.post('/upload', (req, res) => handleFileUpload(req, res));
 async function createUniqueUploadFile(filePath) {
     const ext = path.extname(filePath);
     const base = filePath.slice(0, filePath.length - ext.length);

package/dist/server/routes/rdp.js

@@ -19,7 +19,7 @@ export function rdpBackendAvailable() {
 }
 /** Only this server builds guacd's handshake. Credentials arrive inside the
  * authenticated encrypted logical socket, never query strings or logs. */
-export function handleRdpWebSocket(socket, host, port) {
+export function handleRdpWebSocket(socket, host, port, readOnly = false) {
     let closed = false;
     let started = false;
     let ready = false;
@@ -119,7 +119,7 @@ export function handleRdpWebSocket(socket, host, port) {
                     width: String(Math.max(640, Math.min(2560, Number(message.width) || 1280))),
                     height: String(Math.max(480, Math.min(1600, Number(message.height) || 800))),
                     'color-depth': '32', 'disable-audio': 'true', 'enable-drive': 'false',
-                    'disable-copy': 'false', 'disable-paste': 'false', 'server-layout': 'en-us-qwerty', 'resize-method': 'display-update',
+                    'read-only': String(readOnly), 'disable-copy': String(readOnly), 'disable-paste': String(readOnly), 'server-layout': 'en-us-qwerty', 'resize-method': 'display-update',
                 };
                 void resolveComputerHost(host).then(async (address) => {
                     if (closed)
@@ -174,7 +174,8 @@ export function handleRdpWebSocket(socket, host, port) {
                     throw new Error('INVALID_INSTRUCTION');
                 if (message.opcode === 'size' && (message.args.length !== 2 || message.args.some((value, index) => !/^\d{1,4}$/.test(value) || Number(value) < (index ? 480 : 640) || Number(value) > (index ? 1600 : 2560))))
                     throw new Error('INVALID_SIZE');
-                tcp.write(guacamoleInstruction(message.opcode, ...message.args));
+                if (!readOnly || ['sync', 'ack', 'nop', 'disconnect'].includes(message.opcode))
+                    tcp.write(guacamoleInstruction(message.opcode, ...message.args));
             }
             else
                 throw new Error('INVALID_MESSAGE');

package/dist/server/routes/sharedFiles.js

@@ -0,0 +1,51 @@
+import { Router } from 'express';
+import { constants, promises as fs } from 'node:fs';
+import { encryptedRequestResources, hasEncryptedServiceAccess } from '../federation/requestContext.js';
+import { resourceHttpAllowed } from '../federation/resourceAccess.js';
+import { pathValidator } from '../utils/pathValidator.js';
+/** Applied before filesystem handlers as a second boundary on their exact URL. */
+export const sharedFileBoundary = Router();
+sharedFileBoundary.use((req, res, next) => {
+    const resources = encryptedRequestResources(req);
+    if (resources && !hasEncryptedServiceAccess(req) && !resourceHttpAllowed(resources, req.method, req.originalUrl)) {
+        res.status(403).json({ error: '此路径或操作未获分享授权', code: 'SHARE_ACCESS_DENIED' });
+        return;
+    }
+    next();
+});
+sharedFileBoundary.put('/write', async (req, res) => {
+    let handle;
+    try {
+        const requested = typeof req.query.path === 'string' ? req.query.path : '';
+        if (typeof req.body?.content !== 'string' || Buffer.byteLength(req.body.content) > 1024 * 1024 || typeof req.body?.original !== 'string') {
+            res.status(400).json({ error: '仅支持修改 1 MB 以内的文本文件' });
+            return;
+        }
+        const resolved = await pathValidator.validatePathAsync(requested);
+        handle = await fs.open(resolved, constants.O_RDWR | constants.O_NOFOLLOW);
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024) {
+            res.status(403).json({ error: '此文件无法安全修改' });
+            return;
+        }
+        const before = await handle.readFile('utf8');
+        if (before.includes('\0') || before !== req.body.original) {
+            res.status(409).json({ error: '文件已更新，请重新打开后再编辑' });
+            return;
+        }
+        // Explicit position is required after readFile advances the descriptor.
+        const bytes = Buffer.from(req.body.content);
+        let written = 0;
+        while (written < bytes.length)
+            written += (await handle.write(bytes, written, bytes.length - written, written)).bytesWritten;
+        await handle.truncate(bytes.length);
+        await handle.sync();
+        res.json({ ok: true });
+    }
+    catch {
+        res.status(400).json({ error: '无法保存文件，请确认目录授权和文件状态' });
+    }
+    finally {
+        await handle?.close();
+    }
+});

package/dist/server/routes/terminal.js

@@ -1,3 +1,7 @@
+import { sessionViewModeRoutes, SessionViewModeStore } from '../agent/sessionViewModeRoutes.js';
+import { sessionAttachmentRoutes } from '../agent/sessionAttachmentRoutes.js';
+import { TodoStore, TodoError } from '../todos/store.js';
+import { TodoRunner, todoRoutes } from '../todos/routes.js';
 import { TerminalInputQueue } from '../utils/terminalInputQueue.js';
 import { copyTmuxSelection } from '../utils/tmuxCopySelection.js';
 import { isConfirmedEmptyTmuxServer } from '../utils/tmuxEmptyServerProbe.js';
@@ -66,6 +70,7 @@ import { prepareSupervisionEnable } from '../utils/enableSupervision.js';
 import { buildServerHealthState, dismissServerHealth } from '../utils/serverHealth.js';
 import { collaborationRoutes } from '../agent/collaborationRoutes.js';
 import { extrasFromBody } from '../agent/collaborationProtocol.js';
+import { sessionChatRoutes } from '../agent/sessionChatRoutes.js';
 import { CollaborationStore } from '../agent/collaborationStore.js';
 import { COLLAB_NAME_FORBIDDEN, formatCollaborationDelivery } from '../agent/collaborationPrompt.js';
 import { ambiguousIdMessage } from '../agent/collaborationProtocol.js';
@@ -93,7 +98,7 @@ import { clearPluginAgents, registerPluginAgents } from '../agent/registry.js';
 import { notifyAgentTransition, notifyTerminalExit } from '../notifications/pushService.js';
 import { setClientViewingSession } from '../notifications/pushViewers.js';
 import { getQuotaStatus, refreshQuota, startQuotaManager, } from '../quota/QuotaManager.js';
-import { TermdockAutoUpdateManager } from '../utils/autoUpdate.js';
+import { TermdockAutoUpdateManager, TermdockUpdateStateChangedError } from '../utils/autoUpdate.js';
 import { AUTO_TITLE_LONG_RUNNING_DELAY_MS, AUTO_TITLE_MIN_CONTEXT_CHARS, cleanTerminalContext, generateAgentTitle, hasSubstantiveAutoTitleContext, isLongRunningAutoTitleTurnEligible, isNewAgentSessionId, isAutoTitleReevaluationDue, shouldReplaceAutoTitle, } from '../agent/autoTitle.js';
 import { getTitleNamerCatalog, invalidateTitleNamerCatalog, probePluginTitleNamer } from '../agent/titleNamerCatalog.js';
 import { RenderedTerminalContext } from '../agent/renderedTerminalContext.js';
@@ -105,6 +110,7 @@ const router = express.Router();
 const execFileAsync = promisify(execFile);
 const TERMDOCK_DIR = `${os.homedir()}/.termdock`;
 const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`);
+const todoStore = new TodoStore(`${TERMDOCK_DIR}/todos.json`);
 export const collaborationTaskStore = new CollaborationTaskStore(`${TERMDOCK_DIR}/collaboration-tasks.json`);
 export const collaborationStore = new CollaborationStore(`${TERMDOCK_DIR}/collaboration-groups.json`);
 const collaborationRouting = new CollaborationRoutingStore(`${TERMDOCK_DIR}/collaboration-routing.json`);
@@ -1210,7 +1216,20 @@ async function markAllPersistedTmuxSessionsDetached() {
             console.warn('[session-inventory] failed to list tmux sessions for clear-all:', errorMessage);
         }
     }
-    await Promise.all(Array.from(tmuxSessionNames).map((tmuxSessionName) => setTmuxOption(tmuxSessionName, TERMDOCK_GUI_DETACHED_AT_OPTION, detachedAt)));
+    await Promise.all(Array.from(tmuxSessionNames).map((tmuxSessionName) => markTmuxSessionClosed(tmuxSessionName, detachedAt)));
+}
+// Record user intent before removing either the backend or its inventory entry.
+// Unlike display metadata, failure here must stop the close: otherwise a later
+// scan mistakes the surviving tmux process for an unexpectedly lost GUI session.
+async function markTmuxSessionClosed(name, closedAt = String(Date.now())) {
+    try {
+        await runTmux(['set-option', '-t', name, TERMDOCK_GUI_DETACHED_AT_OPTION, closedAt]);
+    }
+    catch (error) {
+        const message = getErrorMessage(error);
+        if (!isTmuxSessionMissingMessage(message) && !isTmuxServerMissingMessage(message))
+            throw error;
+    }
 }
 function getClientSessionView(inventory, frontendSessionId) {
     const session = inventory.clientSessions.find((entry) => entry.sessionId === frontendSessionId);
@@ -6590,6 +6609,28 @@ router.get('/session-inventory', async (_req, res) => {
         res.status(500).json({ error: errorMessage || 'Failed to build session inventory' });
     }
 });
+const todoRuntime = {
+    async validate(config, req) {
+        const launcher = (await listDetectedAgentLaunchers()).find(agent => agent.slug === config.agentSlug);
+        if (!launcher)
+            throw new TodoError('请选择当前服务可用的 Agent');
+        const command = config.command || launcher.command;
+        const cwd = await resolveWorkingDirectory(req ?? {}, config.cwd || os.homedir());
+        return { ...config, command, cwd };
+    },
+    async launch(run, prompt, onSession, req) {
+        const opened = await openInventorySession(req ?? {}, {
+            name: `${run.kind === 'collect' ? '收集' : '待办'} · ${run.name}`.slice(0, 120), customName: true, mode: 'tmux', cwd: run.config.cwd,
+        });
+        const sessionId = opened.session.sessionId;
+        onSession(sessionId);
+        const launchGuard = await beginAgentLaunchCheck(sessionId, run.config.agentSlug);
+        await writeAutomaticTerminalPrompt(sessionId, run.config.command, undefined, launchGuard);
+        await deliverAutomationPromptWhenReady(opened.terminalSession.sessionId, prompt);
+    },
+};
+const todoRunner = new TodoRunner(todoStore, todoRuntime);
+router.use('/operations/todos', todoRoutes(todoStore, todoRunner, todoRuntime));
 router.get('/operations/automations', (_req, res) => {
     res.json({ automations: automationStore.list(), runs: automationStore.listRuns() });
 });
@@ -6713,6 +6754,12 @@ export function collaborationLocalActivity() {
     });
 }
 export function deliverPeerCollaboration(sessionId) { void tryDeliverCollaborationInbox(sessionId); }
+router.use(sessionViewModeRoutes(new SessionViewModeStore(`${TERMDOCK_DIR}/session-view-modes.json`), resolveStableFederationSessionId));
+router.use(sessionAttachmentRoutes(`${TERMDOCK_DIR}/chat-attachments`, resolveStableFederationSessionId));
+router.use(sessionChatRoutes({ store: collaborationStore, resolve: id => {
+        const stable = resolveStableFederationSessionId(id);
+        return stable ? collaborationDirectorySessions().find(s => s.sessionId === stable) : undefined;
+    }, deliver: deliverPeerCollaboration }));
 router.use('/operations/collaboration-tasks', collaborationTaskRoutes({ agent: false, store: collaborationStore, resolveSession: resolveFrontendSessionId }));
 router.use('/operations/orchestration/tasks', collaborationTaskRoutes({ agent: true, store: collaborationStore, resolveSession: resolveFrontendSessionId }));
 router.use('/operations', collaborationGroupRoutes({ store: collaborationStore,
@@ -7519,12 +7566,12 @@ router.delete('/session-inventory/sessions/:frontendSessionId', async (req, res)
         return res.status(400).json({ error: 'frontendSessionId is required' });
     }
     const removedSession = globalSessionState.sessions.find((session) => session.sessionId === frontendSessionId) ?? null;
+    if (removedSession?.mode === 'tmux' && removedSession.tmuxSessionName) {
+        await markTmuxSessionClosed(removedSession.tmuxSessionName);
+    }
     archiveAgentResumeRecord(removedSession, 'closed');
     const changed = removeGlobalSessionRecord(frontendSessionId);
     if (changed) {
-        if (removedSession?.mode === 'tmux' && removedSession.tmuxSessionName) {
-            await setTmuxOption(removedSession.tmuxSessionName, TERMDOCK_GUI_DETACHED_AT_OPTION, String(Date.now()));
-        }
         await persistGlobalStateNow();
         broadcastClientState();
     }
@@ -7651,13 +7698,20 @@ router.post('/update/check', async (_req, res) => {
         res.status(503).json({ error: error instanceof Error ? error.message : String(error) });
     }
 });
-router.post('/update/restart', async (_req, res) => {
+router.post('/update/restart', async (req, res) => {
     try {
-        const state = npmAutoUpdateManager.confirmRestart();
+        const version = req.body?.version;
+        if (version !== undefined && typeof version !== 'string')
+            return res.status(400).json({ error: 'Invalid update version' });
+        const state = npmAutoUpdateManager.confirmRestart(version);
         res.status(202).json(state);
     }
     catch (error) {
-        res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+        res.status(409).json({
+            error: error instanceof Error ? error.message : String(error),
+            code: error instanceof TermdockUpdateStateChangedError ? 'UPDATE_STATE_CHANGED' : 'UPDATE_RESTART_FAILED',
+            state: npmAutoUpdateManager.getState(),
+        });
     }
 });
 // 「服务最近出过什么事」：红点与设置面板的唯一数据源。
@@ -8742,16 +8796,30 @@ router.post('/:sessionId/tmux', async (req, res) => {
         return res.status(500).json({ error: errorMessage || 'Failed to execute tmux action' });
     }
 });
-router.delete('/:sessionId', (req, res) => {
+router.delete('/:sessionId', async (req, res) => {
     const { sessionId } = req.params;
     const session = terminalSessions.get(sessionId);
-    if (!session) {
-        return res.json({ success: true, alreadyGone: true });
-    }
+    const records = globalSessionState.sessions.filter(record => record.backendSessionId === sessionId);
     try {
-        cleanupSession(sessionId, { killProcess: true });
+        const tmuxNames = new Set(records.flatMap(record => record.mode === 'tmux' && record.tmuxSessionName ? [record.tmuxSessionName] : []));
+        if (session?.mode === 'tmux' && session.tmuxSessionName)
+            tmuxNames.add(session.tmuxSessionName);
+        for (const name of tmuxNames)
+            await markTmuxSessionClosed(name);
+        if (session)
+            cleanupSession(sessionId, { killProcess: true });
+        // Complete the close on the server even if the page exits before its second
+        // DELETE (inventory removal). A stale/missing wrapper can still own a record.
+        for (const record of records) {
+            archiveAgentResumeRecord(record, 'closed');
+            removeGlobalSessionRecord(record.sessionId);
+        }
+        if (records.length) {
+            await persistGlobalStateNow();
+            broadcastClientState();
+        }
         console.log(`Closed terminal session: ${sessionId}`);
-        res.json({ success: true });
+        res.json({ success: true, ...(!session ? { alreadyGone: true } : {}) });
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
@@ -9587,6 +9655,7 @@ const reconcileTimer = setInterval(() => {
 // Don't keep the event loop alive for housekeeping.
 reconcileTimer.unref?.();
 const automationTimer = setInterval(() => {
+    void todoRunner.tick().catch(error => console.warn('[todo-collector]', getErrorMessage(error)));
     for (const automation of automationStore.due()) {
         void runAgentAutomation(automation).catch((error) => {
             console.warn(`[automation] ${automation.id} failed:`, getErrorMessage(error));

package/dist/server/routes/vncReadOnly.js

@@ -0,0 +1,134 @@
+/** Stateful RFB client filter. Handshake bytes are length-delimited; after
+ * ClientInit only framebuffer negotiation/requests pass. Never scan raw bytes
+ * for opcodes: credentials and fragmented records can contain any byte. */
+export class VncReadOnlyFilter {
+    client = Buffer.alloc(0);
+    server = Buffer.alloc(0);
+    stage = 'version';
+    serverStage = 'version';
+    security = 0;
+    authBytes = 0;
+    offered = [];
+    serverData(bytes) {
+        if (this.serverStage === 'done')
+            return;
+        this.server = Buffer.concat([this.server, bytes]);
+        if (this.server.length > 65536)
+            throw new Error('COMPUTER_INVALID_MESSAGE');
+        if (this.serverStage === 'version' && this.server.length >= 12) {
+            this.server = this.server.subarray(12);
+            this.serverStage = 'security';
+        }
+        if (this.serverStage === 'security' && this.server.length >= 1 && this.server.length >= 1 + this.server[0]) {
+            this.offered = [...this.server.subarray(1, 1 + this.server[0])];
+            this.server = this.server.subarray(1 + this.server[0]);
+            this.serverStage = 'challenge';
+        }
+        if (this.serverStage === 'challenge' && this.security === 30 && this.server.length >= 4) {
+            const length = this.server.readUInt16BE(2);
+            if (length < 16 || length > 512)
+                throw new Error('COMPUTER_INVALID_MESSAGE');
+            this.authBytes = 128 + length;
+            this.serverStage = 'done';
+            this.server = Buffer.alloc(0);
+        }
+        else if (this.serverStage === 'challenge' && [1, 2].includes(this.security)) {
+            this.serverStage = 'done';
+            this.server = Buffer.alloc(0);
+        }
+    }
+    clientData(bytes) {
+        this.client = Buffer.concat([this.client, bytes]);
+        if (this.client.length > 1024 * 1024)
+            throw new Error('COMPUTER_INVALID_MESSAGE');
+        const output = [];
+        const consume = (n, forward = true) => { if (forward)
+            output.push(this.client.subarray(0, n)); this.client = this.client.subarray(n); };
+        while (this.client.length) {
+            if (this.stage === 'version') {
+                if (this.client.length < 12)
+                    break;
+                // 3.8 has explicit security selection/results; fail closed for legacy.
+                if (this.client.subarray(0, 12).toString() !== 'RFB 003.008\n')
+                    throw new Error('COMPUTER_READ_ONLY_PROTOCOL');
+                consume(12);
+                this.stage = 'security';
+            }
+            else if (this.stage === 'security') {
+                this.security = this.client[0];
+                if (![1, 2, 30].includes(this.security) || !this.offered.includes(this.security))
+                    throw new Error('COMPUTER_READ_ONLY_PROTOCOL');
+                this.authBytes = this.security === 2 ? 16 : 0;
+                consume(1);
+                this.stage = this.security === 1 ? 'init' : 'auth';
+                this.serverData(Buffer.alloc(0));
+            }
+            else if (this.stage === 'auth') {
+                if (!this.authBytes || this.client.length < this.authBytes)
+                    break;
+                consume(this.authBytes);
+                this.stage = 'init';
+            }
+            else if (this.stage === 'init') {
+                if (this.client[0] !== 1)
+                    throw new Error('COMPUTER_READ_ONLY_PROTOCOL');
+                consume(1);
+                this.stage = 'messages';
+            }
+            else {
+                const type = this.client[0];
+                let length;
+                if (type === 0)
+                    length = 20;
+                else if (type === 2) {
+                    if (this.client.length < 4)
+                        break;
+                    length = 4 + 4 * this.client.readUInt16BE(2);
+                }
+                else if (type === 3 || type === 150)
+                    length = 10;
+                else if (type === 4)
+                    length = 8;
+                else if (type === 5)
+                    length = 6;
+                else if (type === 6) {
+                    if (this.client.length < 8)
+                        break;
+                    length = 8 + Math.abs(this.client.readInt32BE(4));
+                }
+                else if (type === 248) {
+                    if (this.client.length < 9)
+                        break;
+                    length = 9 + this.client[8];
+                }
+                else if (type === 251) {
+                    if (this.client.length < 8)
+                        break;
+                    length = 8 + 16 * this.client[6];
+                }
+                else if (type === 255)
+                    length = 12;
+                else
+                    throw new Error('COMPUTER_READ_ONLY_PROTOCOL');
+                if (length > 1024 * 1024)
+                    throw new Error('COMPUTER_INVALID_MESSAGE');
+                if (this.client.length < length)
+                    break;
+                if (type === 2) {
+                    // Do not advertise clipboard extensions to a view-only client.
+                    const encodings = [];
+                    for (let i = 4; i < length; i += 4)
+                        if (this.client.readUInt32BE(i) !== 0xc0a1e5ce)
+                            encodings.push(this.client.subarray(i, i + 4));
+                    const header = Buffer.from([2, 0, 0, 0]);
+                    header.writeUInt16BE(encodings.length, 2);
+                    output.push(Buffer.concat([header, ...encodings]));
+                    consume(length, false);
+                }
+                else
+                    consume(length, [0, 3, 150, 248].includes(type));
+            }
+        }
+        return output;
+    }
+}

package/dist/server/shared/shareResources.js

@@ -0,0 +1,37 @@
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const text = (v, max) => typeof v === 'string' && v.length > 0 && v.length <= max && !/[\x00-\x1f\x7f]/.test(v);
+export function validShareResources(value) {
+    if (!record(value) || Object.keys(value).some(key => !['android', 'computers', 'directories'].includes(key)))
+        return false;
+    return Object.entries(value).every(([key, items]) => Array.isArray(items) && items.length <= 64 && items.every(item => {
+        if (!record(item))
+            return false;
+        if (key === 'android')
+            return Object.keys(item).every(k => ['serial', 'access'].includes(k)) && text(item.serial, 128) && /^(?:[0-9a-zA-Z_.:\-]+|\[[0-9a-fA-F:.]+\]:\d{1,5})$/.test(item.serial) && ['view', 'control'].includes(String(item.access));
+        if (key === 'computers')
+            return Object.keys(item).every(k => ['host', 'protocol', 'port', 'access'].includes(k)) && text(item.host, 253) && /^[a-zA-Z0-9:.\-]+$/.test(item.host) && ['vnc', 'rdp'].includes(String(item.protocol)) && Number.isInteger(item.port) && Number(item.port) > 0 && Number(item.port) <= 65535 && (item.protocol !== 'vnc' || item.port === 5900) && ['view', 'control'].includes(String(item.access));
+        return Object.keys(item).every(k => ['path', 'access'].includes(k)) && text(item.path, 4096) && (item.path.startsWith('/') || /^[A-Za-z]:[\\/]/.test(item.path)) && ['read', 'write'].includes(String(item.access));
+    }));
+}
+export function resourceSubset(child, parent) {
+    return (!child?.android?.length || child.android.every(c => parent?.android?.some(p => p.serial === c.serial && (p.access === 'control' || c.access === 'view'))))
+        && (!child?.computers?.length || child.computers.every(c => parent?.computers?.some(p => p.host === c.host && p.protocol === c.protocol && p.port === c.port && (p.access === 'control' || c.access === 'view'))))
+        && (!child?.directories?.length || child.directories.every(c => parent?.directories?.some(p => p.path === c.path && (p.access === 'write' || c.access === 'read'))));
+}
+export function mergeShareResources(resources) {
+    const android = new Map(), computers = new Map(), directories = new Map();
+    for (const r of resources) {
+        for (const item of r?.android ?? [])
+            if (android.get(item.serial)?.access !== 'control')
+                android.set(item.serial, item);
+        for (const item of r?.computers ?? []) {
+            const key = JSON.stringify([item.host.toLowerCase(), item.protocol, item.port]);
+            if (computers.get(key)?.access !== 'control')
+                computers.set(key, item);
+        }
+        for (const item of r?.directories ?? [])
+            if (directories.get(item.path)?.access !== 'write')
+                directories.set(item.path, item);
+    }
+    return { android: [...android.values()], computers: [...computers.values()], directories: [...directories.values()] };
+}