termdock 1.4.43 → 1.4.46

package/dist/server/notifications/pushService.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import webpush from 'web-push';
+import { getViewingPushClientIds } from './pushViewers.js';
 const storeDirectory = path.join(os.homedir(), '.termdock');
 const storePath = path.join(storeDirectory, 'push-notifications.json');
 let store = null;
@@ -20,7 +21,14 @@ function readStore() {
             && typeof parsed.vapid?.publicKey === 'string'
             && typeof parsed.vapid?.privateKey === 'string'
             && Array.isArray(parsed.subscriptions)) {
-            store = parsed;
+            // Subscriptions written before exitEnabled existed default to opt-out.
+            store = {
+                ...parsed,
+                subscriptions: parsed.subscriptions.map((entry) => ({
+                    ...entry,
+                    exitEnabled: entry.exitEnabled === true,
+                })),
+            };
         }
     }
     catch {
@@ -34,7 +42,11 @@ function readStore() {
         };
         persistStore(store);
     }
-    webpush.setVapidDetails('mailto:push@termdock.local', store.vapid.publicKey, store.vapid.privateKey);
+    // VAPID subject must be a mailto: or https: contact URI. Configurable for
+    // self-hosters; defaults to the project repository instead of a fake mailbox.
+    const vapidSubject = process.env.TERMDOCK_VAPID_SUBJECT?.trim()
+        || 'https://github.com/Jovines/termdock';
+    webpush.setVapidDetails(vapidSubject, store.vapid.publicKey, store.vapid.privateKey);
     return store;
 }
 export function getVapidPublicKey() {
@@ -67,10 +79,43 @@ export function removePushSubscription(clientId, endpoint) {
     if (current.subscriptions.length !== previousLength)
         persistStore(current);
 }
-async function sendPayload(payload) {
+function isZhLocale(locale) {
+    return locale.toLowerCase().startsWith('zh');
+}
+/**
+ * Localized push copy, mirroring the client-side getAgentNotificationText in
+ * useTerminalStore.ts so both delivery paths read the same for one locale.
+ */
+export function agentNotificationText(locale, kind, agentName) {
+    if (isZhLocale(locale)) {
+        if (kind === 'waiting')
+            return { title: `${agentName} 需要你的处理`, body: '点按返回对应会话' };
+        if (kind === 'done')
+            return { title: `${agentName} 已完成`, body: '点按查看结果' };
+        return { title: `${agentName} 已退出`, body: '点按查看结果' };
+    }
+    if (kind === 'waiting')
+        return { title: `${agentName} needs your input`, body: 'Tap to return to the session' };
+    if (kind === 'done')
+        return { title: `${agentName} finished`, body: 'Tap to see the result' };
+    return { title: `${agentName} exited`, body: 'Tap to see the result' };
+}
+export function terminalExitText(locale, exitCode) {
+    if (isZhLocale(locale)) {
+        return {
+            title: '终端会话已退出',
+            body: exitCode !== null ? `进程已退出(代码 ${exitCode}),点按查看` : '进程已退出,点按查看',
+        };
+    }
+    return {
+        title: 'Terminal session ended',
+        body: exitCode !== null ? `Process exited (code ${exitCode}). Tap to view.` : 'Process exited. Tap to view.',
+    };
+}
+async function sendPayload(options) {
     const current = readStore();
     const invalidEndpoints = new Set();
-    await Promise.all(current.subscriptions.filter((entry) => entry.aiEnabled).map(async (entry) => {
+    await Promise.all(current.subscriptions.filter((entry) => (options.enabled(entry) && !options.skipClientIds?.has(entry.clientId))).map(async (entry) => {
         try {
             const subscription = {
                 endpoint: entry.endpoint,
@@ -78,12 +123,12 @@ async function sendPayload(payload) {
                 keys: entry.keys,
             };
             await webpush.sendNotification(subscription, JSON.stringify({
-                ...payload,
+                ...options.build(entry.locale),
                 alertStyle: entry.alertStyle,
                 locale: entry.locale,
             }), {
-                TTL: 60 * 60,
-                urgency: payload.kind === 'waiting' ? 'high' : 'normal',
+                TTL: options.ttlSeconds ?? 60 * 60,
+                urgency: options.urgency ?? 'normal',
             });
         }
         catch (error) {
@@ -104,39 +149,80 @@ async function sendPayload(payload) {
 export function notifyAgentTransition(sessionId, previous, current) {
     if (!shouldNotifyAgentTransition(previous, current))
         return;
-    const agentExited = current.agentStatus === null && previous?.agentStatus === 'working';
-    const kind = agentExited ? 'exited' : current.agentStatus;
+    const agentExited = (current.agentStatus === null || current.agentStatus === 'idle')
+        && (previous?.agentStatus === 'working' || previous?.agentStatus === 'waiting');
+    const kind = (agentExited ? 'exited' : current.agentStatus);
     const agentName = current.agent?.displayName ?? previous?.agent?.displayName ?? 'Agent';
-    const title = kind === 'waiting'
-        ? `${agentName} 需要你的处理`
-        : kind === 'done'
-            ? `${agentName} 已完成`
-            : `${agentName} 已退出`;
     void sendPayload({
-        kind,
-        title,
-        body: current.agentMessage ?? (kind === 'waiting' ? '点按返回对应会话' : '点按查看结果'),
-        // Same tag for all transitions of one session → new notification
-        // replaces the old one (key behaviour on iOS where getNotifications()
-        // is unavailable for programmatic cleanup).
-        tag: `agent:${sessionId}`,
-        // Per-transition key so the 5 s dedup window only suppresses
-        // duplicate deliveries of the same transition, not later ones.
-        dedupKey: `agent:${sessionId}:${kind}:${current.agentActivity}`,
-        sessionId,
-        url: `/?session=${encodeURIComponent(sessionId)}`,
+        enabled: (entry) => entry.aiEnabled,
+        skipClientIds: getViewingPushClientIds(sessionId),
+        urgency: kind === 'waiting' ? 'high' : 'normal',
+        ttlSeconds: kind === 'waiting' ? 24 * 60 * 60 : 60 * 60,
+        build: (locale) => {
+            const text = agentNotificationText(locale, kind, agentName);
+            return {
+                kind,
+                title: text.title,
+                body: current.agentMessage ?? text.body,
+                // Same tag for all transitions of one session → new notification
+                // replaces the old one (key behaviour on iOS where getNotifications()
+                // is unavailable for programmatic cleanup).
+                tag: `agent:${sessionId}`,
+                // Per-transition key so the 5 s dedup window only suppresses
+                // duplicate deliveries of the same transition, not later ones.
+                dedupKey: `agent:${sessionId}:${kind}:${current.agentActivity}`,
+                sessionId,
+                url: `/?session=${encodeURIComponent(sessionId)}`,
+            };
+        },
+    });
+}
+/**
+ * Push for a terminal process that exited on its own (not a user-initiated
+ * close — those dispose the exit listener before killing the pty). Sessions
+ * with a live agent are covered by notifyAgentTransition instead, so the
+ * caller skips those to avoid double notifications for one event.
+ */
+export function notifyTerminalExit(sessionId, exitCode) {
+    void sendPayload({
+        enabled: (entry) => entry.exitEnabled,
+        skipClientIds: getViewingPushClientIds(sessionId),
+        build: (locale) => {
+            const text = terminalExitText(locale, exitCode);
+            return {
+                kind: 'exit',
+                title: text.title,
+                body: text.body,
+                tag: `exit:${sessionId}`,
+                dedupKey: `exit:${sessionId}:${exitCode ?? 'signal'}`,
+                sessionId,
+                url: `/?session=${encodeURIComponent(sessionId)}`,
+            };
+        },
     });
 }
 export function shouldNotifyAgentTransition(previous, current) {
     if (!previous)
         return false;
-    const needsAttention = current.reviewed !== true
-        && (current.agentStatus === 'waiting' || current.agentStatus === 'done');
-    const attentionChanged = previous.agentStatus !== current.agentStatus
-        || previous.agentActivity !== current.agentActivity
-        || previous.reviewed === true;
-    const agentExited = current.agentStatus === null
-        && previous.agentStatus === 'working'
-        && current.reviewed !== true;
-    return (needsAttention && attentionChanged) || agentExited;
+    // Only status or activity changes carry new information. A `reviewed` flip
+    // is the user's own acknowledgement (or a stop stamping an unread turn) and
+    // must not re-notify by itself — the previous reviewed-based gate here
+    // silently suppressed every mid-turn waiting event, because reviewed stays
+    // true while an agent is working or waiting and only `stop` clears it.
+    const stateChanged = previous.agentStatus !== current.agentStatus
+        || previous.agentActivity !== current.agentActivity;
+    if (!stateChanged)
+        return false;
+    if (current.agentStatus === 'waiting' || current.agentStatus === 'done') {
+        // waiting: any new wait event (entering waiting, or a new activity round
+        // while waiting) deserves a push. done: only entering done — a second
+        // stop for the same turn, or an ack-only broadcast, must stay silent.
+        return current.agentStatus === 'waiting' || previous.agentStatus !== 'done';
+    }
+    // Agent exited: from working or waiting (including a hook-emitted
+    // session-end that lands on 'idle' before the process poll clears the
+    // session). done → exit is deliberately silent — the completion was
+    // already notified.
+    return (current.agentStatus === null || current.agentStatus === 'idle')
+        && (previous.agentStatus === 'working' || previous.agentStatus === 'waiting');
 }

package/dist/server/notifications/pushViewers.js

@@ -0,0 +1,44 @@
+/**
+ * Tracks which push-subscribed clients are actively viewing which terminal
+ * session, so agent-transition pushes can skip the very client that is
+ * already looking at the session (its notification would be redundant).
+ *
+ * The per-terminal WebSocket reports viewing state (session active + document
+ * visible + window focused + stream ready — deliberately NOT textarea focus,
+ * since mobile users routinely watch output with the keyboard dismissed) on
+ * every change, including a viewing=false when the user switches sessions,
+ * backgrounds the app, or the window blurs — and the WS close handler clears
+ * the entry when the connection dies (e.g. the iOS PWA was killed without a
+ * clean viewing=false).
+ */
+const viewingSessionsByClient = new Map();
+export function setClientViewingSession(pushClientId, sessionId, viewing) {
+    if (!pushClientId || !sessionId)
+        return;
+    if (!viewing) {
+        const sessions = viewingSessionsByClient.get(pushClientId);
+        if (!sessions)
+            return;
+        sessions.delete(sessionId);
+        if (sessions.size === 0)
+            viewingSessionsByClient.delete(pushClientId);
+        return;
+    }
+    let sessions = viewingSessionsByClient.get(pushClientId);
+    if (!sessions) {
+        sessions = new Set();
+        viewingSessionsByClient.set(pushClientId, sessions);
+    }
+    sessions.add(sessionId);
+}
+/** Push subscription clientIds currently looking at the given session. */
+export function getViewingPushClientIds(sessionId) {
+    const result = new Set();
+    if (!sessionId)
+        return result;
+    for (const [pushClientId, sessions] of viewingSessionsByClient) {
+        if (sessions.has(sessionId))
+            result.add(pushClientId);
+    }
+    return result;
+}

package/dist/server/ptyHost.js

@@ -148,6 +148,10 @@ function handleControl(msg) {
         case 'attach':
             attachChannel(msg.id, msg.since);
             return;
+        case 'ping':
+            // 服务端心跳：host 事件循环活着就立即回 pong；连续不回 = wedge。
+            send({ op: 'pong', t: msg.t });
+            return;
         case 'resize': {
             const ch = channels.get(msg.id);
             if (ch && !ch.exited) {
@@ -235,8 +239,15 @@ function shutdown() {
         fs.unlinkSync(SOCKET_PATH);
     }
     catch { /* already gone */ }
+    try {
+        fs.unlinkSync(pidFilePath());
+    }
+    catch { /* already gone */ }
     process.exit(0);
 }
+function pidFilePath() {
+    return `${SOCKET_PATH}.pid`;
+}
 function main() {
     fs.mkdirSync(path.dirname(SOCKET_PATH), { recursive: true, mode: 0o700 });
     // Stale socket from a crashed host: only our own pid could own it, and we
@@ -251,6 +262,12 @@ function main() {
             fs.chmodSync(SOCKET_PATH, 0o600);
         }
         catch { /* best effort */ }
+        // 写 pid 文件：服务端检测到这个 host wedge（心跳超时）时需要知道
+        // 杀谁——host 是 detached 的，pid 没法靠父子关系找回。
+        try {
+            fs.writeFileSync(pidFilePath(), String(process.pid), { mode: 0o600 });
+        }
+        catch { /* best effort */ }
         console.log(`[pty-host] listening on ${SOCKET_PATH} (pid ${process.pid})`);
     });
     // The host is meant to run forever; a dropped server connection is normal

package/dist/server/ptyhost/manager.js

@@ -17,6 +17,16 @@ import { FRAME_CONTROL, FRAME_DATA, FRAME_INPUT, FRAME_REPLAY, PTY_HOST_PROTOCOL
 const HOST_STARTUP_TIMEOUT_MS = 5_000;
 const HOST_STARTUP_POLL_MS = 50;
 const RECONNECT_DELAY_MS = 500;
+/** connect + helloAck 的总等待上限。host 活着但 wedge（内核 backlog 收下
+ * 连接、事件循环不回包）时，没有这个上限 promise 会永不 settle——且
+ * ensureConnected 的 connecting 锁存器会让之后所有调用挂在同一个
+ * promise 上，表现为"一次卡住、之后全部卡住"。 */
+const CONNECT_HANDSHAKE_TIMEOUT_MS = 4_000;
+/** spawn 发出后等 host 回 spawned 的上限。 */
+const SPAWN_RESPONSE_TIMEOUT_MS = 10_000;
+/** 心跳：连续 HEARTBEAT_MISS_LIMIT 个间隔没有 pong 判定 host wedge。 */
+const HEARTBEAT_INTERVAL_MS = 15_000;
+const HEARTBEAT_MISS_LIMIT = 2;
 function hostSocketDir() {
     return path.join(os.homedir(), '.termdock', 'pty-hosts');
 }
@@ -143,6 +153,9 @@ export class PtyHostManager {
     helloResolve = null;
     pendingSpawns = new Map();
     reconnectTimer = null;
+    heartbeatTimer = null;
+    lastPongAt = 0;
+    killingWedgedHost = null;
     stopped = false;
     /** Resolve when the host is connected + handshaken; returns live channels. */
     ensureConnected() {
@@ -157,12 +170,20 @@ export class PtyHostManager {
             return await this.connectOnce();
         }
         catch (error) {
-            if (error.code !== 'ENOENT'
-                && error.code !== 'ECONNREFUSED') {
+            const code = error.code;
+            if (code === 'ENOENT' || code === 'ECONNREFUSED') {
+                this.spawnHostDaemon();
+            }
+            else if (code === 'PTY_HOST_HANDSHAKE_TIMEOUT') {
+                // host 活着但 wedge（accept 连接不回 helloAck）：杀掉再重生。
+                console.warn('[pty-host] handshake timed out — replacing wedged host:', ptyHostSocketPath());
+                await this.killWedgedHost();
+                this.spawnHostDaemon();
+            }
+            else {
                 throw error;
             }
         }
-        this.spawnHostDaemon();
         const deadline = Date.now() + HOST_STARTUP_TIMEOUT_MS;
         let lastError = null;
         while (Date.now() < deadline) {
@@ -176,6 +197,66 @@ export class PtyHostManager {
         }
         throw new Error(`pty-host did not start listening in time: ${lastError?.message ?? lastError}`);
     }
+    /** 杀掉 wedge 的 host（SIGTERM → 1s 后 SIGKILL）并清理 socket/pid 文件。
+     * 等旧 host 确实死了才返回——否则旧 host 的 SIGTERM shutdown 可能删掉
+     * 新 host 刚 bind 的 socket 文件。并发调用共享同一次 kill。 */
+    killWedgedHost() {
+        if (!this.killingWedgedHost) {
+            this.killingWedgedHost = this.doKillWedgedHost().finally(() => {
+                this.killingWedgedHost = null;
+            });
+        }
+        return this.killingWedgedHost;
+    }
+    async doKillWedgedHost() {
+        const sockPath = ptyHostSocketPath();
+        const pidPath = `${sockPath}.pid`;
+        let pid = null;
+        try {
+            const parsed = Number(fs.readFileSync(pidPath, 'utf8').trim());
+            if (Number.isInteger(parsed) && parsed > 1)
+                pid = parsed;
+        }
+        catch { /* 无 pid 文件（host 早于该特性）——只能放弃精准击杀 */ }
+        if (pid) {
+            const alive = () => {
+                try {
+                    process.kill(pid, 0);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            };
+            console.warn(`[pty-host] killing wedged host (pid ${pid})`);
+            try {
+                process.kill(pid, 'SIGTERM');
+            }
+            catch { /* already gone */ }
+            let deadline = Date.now() + 1_000;
+            while (alive() && Date.now() < deadline) {
+                await new Promise((r) => setTimeout(r, 50));
+            }
+            if (alive()) {
+                try {
+                    process.kill(pid, 'SIGKILL');
+                }
+                catch { /* already gone */ }
+                deadline = Date.now() + 1_000;
+                while (alive() && Date.now() < deadline) {
+                    await new Promise((r) => setTimeout(r, 50));
+                }
+            }
+        }
+        try {
+            fs.unlinkSync(sockPath);
+        }
+        catch { /* gone */ }
+        try {
+            fs.unlinkSync(pidPath);
+        }
+        catch { /* gone */ }
+    }
     spawnHostDaemon() {
         const { command, args } = resolveHostEntry();
         fs.mkdirSync(hostSocketDir(), { recursive: true, mode: 0o700 });
@@ -192,7 +273,14 @@ export class PtyHostManager {
     connectOnce() {
         return new Promise((resolvePromise, rejectPromise) => {
             const conn = net.createConnection(ptyHostSocketPath());
+            const timer = setTimeout(() => {
+                const error = new Error('pty-host handshake timed out');
+                error.code = 'PTY_HOST_HANDSHAKE_TIMEOUT';
+                conn.destroy();
+                rejectPromise(error);
+            }, CONNECT_HANDSHAKE_TIMEOUT_MS);
             const onError = (error) => {
+                clearTimeout(timer);
                 conn.destroy();
                 rejectPromise(error);
             };
@@ -200,11 +288,42 @@ export class PtyHostManager {
             conn.once('connect', () => {
                 conn.removeListener('error', onError);
                 this.attachConnection(conn);
-                this.helloResolve = resolvePromise;
+                this.helloResolve = (channels) => {
+                    clearTimeout(timer);
+                    // handleDisconnect 会用 [] 兜底调用这里——连接已死时不开心跳。
+                    if (this.conn === conn && !conn.destroyed)
+                        this.startHeartbeat();
+                    resolvePromise(channels);
+                };
                 conn.write(encodeControl({ op: 'hello', v: PTY_HOST_PROTOCOL_VERSION }));
             });
         });
     }
+    startHeartbeat() {
+        this.stopHeartbeat();
+        this.lastPongAt = Date.now();
+        this.heartbeatTimer = setInterval(() => {
+            if (!this.conn || this.conn.destroyed) {
+                this.stopHeartbeat();
+                return;
+            }
+            if (Date.now() - this.lastPongAt > HEARTBEAT_INTERVAL_MS * HEARTBEAT_MISS_LIMIT) {
+                // host 事件循环 wedge：杀旧 host（新 host 由重连路径 respawn）。
+                console.warn('[pty-host] heartbeat missed — host appears wedged, replacing it:', ptyHostSocketPath());
+                this.stopHeartbeat();
+                this.conn.destroy();
+                void this.killWedgedHost();
+                return;
+            }
+            this.send({ op: 'ping', t: Date.now() });
+        }, HEARTBEAT_INTERVAL_MS);
+    }
+    stopHeartbeat() {
+        if (this.heartbeatTimer) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = null;
+        }
+    }
     attachConnection(conn) {
         if (this.conn && !this.conn.destroyed)
             this.conn.destroy();
@@ -264,6 +383,9 @@ export class PtyHostManager {
             case 'replayEnd':
                 this.clients.get(control.id)?.handleReplayEnd(control.offset);
                 return;
+            case 'pong':
+                this.lastPongAt = Date.now();
+                return;
             case 'exit': {
                 const client = this.clients.get(control.id);
                 if (client) {
@@ -276,6 +398,7 @@ export class PtyHostManager {
         }
     }
     handleDisconnect() {
+        this.stopHeartbeat();
         this.helloResolve?.([]);
         this.helloResolve = null;
         for (const pending of this.pendingSpawns.values()) {
@@ -336,8 +459,26 @@ export class PtyHostManager {
         await this.ensureConnected();
         const client = new PtyHostClient(this, id);
         this.clients.set(id, client);
+        let spawnTimer = null;
         const spawned = new Promise((resolvePromise, rejectPromise) => {
-            this.pendingSpawns.set(id, { resolve: resolvePromise, reject: rejectPromise });
+            // host wedge 时 spawned 永远不会来——必须有超时，否则这里永挂。
+            spawnTimer = setTimeout(() => {
+                const error = new Error('pty-host spawn timed out');
+                error.code = 'PTY_HOST_SPAWN_TIMEOUT';
+                rejectPromise(error);
+            }, SPAWN_RESPONSE_TIMEOUT_MS);
+            this.pendingSpawns.set(id, {
+                resolve: (result) => {
+                    if (spawnTimer)
+                        clearTimeout(spawnTimer);
+                    resolvePromise(result);
+                },
+                reject: (error) => {
+                    if (spawnTimer)
+                        clearTimeout(spawnTimer);
+                    rejectPromise(error);
+                },
+            });
         });
         this.send({ op: 'spawn', id, spec });
         try {
@@ -351,6 +492,12 @@ export class PtyHostManager {
         }
         catch (error) {
             this.clients.delete(id);
+            this.pendingSpawns.delete(id);
+            // spawn 超时 ≈ host wedge：断连触发 handleDisconnect 的自愈重连。
+            if (error.code === 'PTY_HOST_SPAWN_TIMEOUT') {
+                console.warn('[pty-host] spawn timed out — host may be wedged, dropping connection:', ptyHostSocketPath());
+                this.conn?.destroy();
+            }
             throw error;
         }
     }

package/dist/server/quota/tokenDiscovery.js

@@ -142,8 +142,33 @@ export function discoverCodexTokens() {
     return discoverCodexFromEnv();
 }
 // ── Kimi ─────────────────────────────────────────────────────────────
+/** Kimi Code CLI stores OAuth device-code credentials here (`kimi login`). */
+function discoverKimiFromCredentials() {
+    const credPath = path.join(HOME, '.kimi-code', 'credentials', 'kimi-code.json');
+    try {
+        const raw = fs.readFileSync(credPath, 'utf-8');
+        const cred = JSON.parse(raw);
+        if (typeof cred.access_token !== 'string' || !cred.access_token.trim()) {
+            return [];
+        }
+        // expires_at: epoch seconds (or ms on some versions); expired → skip so
+        // the env/opencode fallbacks still get a chance.
+        const exp = Number(cred.expires_at);
+        if (Number.isFinite(exp) && exp > 0) {
+            const expMs = exp > 1e12 ? exp : exp * 1000;
+            if (Date.now() >= expMs)
+                return [];
+        }
+        return [{ token: cred.access_token.trim(), source: 'kimi-code credentials' }];
+    }
+    catch {
+        return [];
+    }
+}
 export function discoverKimiTokens() {
     const results = [];
+    // Priority: kimi-code OAuth credentials > env > legacy config > OpenCode auth
+    results.push(...discoverKimiFromCredentials());
     // Check KIMI_API_KEY env
     const envKey = process.env.KIMI_API_KEY;
     if (envKey?.trim()) {

package/dist/server/routes/filesystem.js

@@ -2455,8 +2455,10 @@ router.get('/read', async (req, res) => {
             throwIfAborted(controller.signal, 'fs.read');
             const stat = await fs.promises.stat(resolvedPath);
             throwIfAborted(controller.signal, 'fs.read');
-            if (stat.isDirectory()) {
-                throw new Error('Path is a directory, not a file');
+            // 只允许常规文件：FIFO / unix socket / 设备文件的 open() 会永久占住
+            // 一个 libuv 线程且不可取消（线程池耗尽 = 整个服务 IO 假死）。
+            if (!stat.isFile()) {
+                throw new Error('Path is not a regular file');
             }
             const bytesToRead = Math.min(stat.size, MAX_FILE_SIZE);
             const truncated = stat.size > bytesToRead;

package/dist/server/routes/notifications.js

@@ -17,6 +17,7 @@ router.get('/status', (req, res) => {
                 endpoint: subscription.endpoint,
                 expirationTime: subscription.expirationTime,
                 aiEnabled: subscription.aiEnabled,
+                exitEnabled: subscription.exitEnabled,
                 alertStyle: subscription.alertStyle,
                 locale: subscription.locale,
                 updatedAt: subscription.updatedAt,
@@ -26,7 +27,7 @@ router.get('/status', (req, res) => {
 });
 router.post('/subscribe', (req, res) => {
     const clientId = clientIdFromRequest(req);
-    const { subscription, aiEnabled, alertStyle, locale } = req.body ?? {};
+    const { subscription, aiEnabled, exitEnabled, alertStyle, locale } = req.body ?? {};
     if (!clientId
         || typeof subscription?.endpoint !== 'string'
         || subscription.endpoint.length > 4096
@@ -49,19 +50,24 @@ router.post('/subscribe', (req, res) => {
             auth: subscription.keys.auth,
         },
         aiEnabled: aiEnabled !== false,
+        exitEnabled: exitEnabled === true,
         alertStyle,
         locale: typeof locale === 'string' ? locale.slice(0, 32) : 'zh-CN',
     });
     res.json({ ok: true, updatedAt: saved.updatedAt });
 });
 router.post('/preferences', (req, res) => {
-    const { aiEnabled, alertStyle, locale } = req.body ?? {};
-    if (typeof aiEnabled !== 'boolean' || !validAlertStyle(alertStyle)) {
+    const { aiEnabled, exitEnabled, alertStyle, locale } = req.body ?? {};
+    if (typeof aiEnabled !== 'boolean'
+        || (exitEnabled !== undefined && typeof exitEnabled !== 'boolean')
+        || !validAlertStyle(alertStyle)) {
         res.status(400).json({ error: 'Invalid notification preferences' });
         return;
     }
     const updated = updatePushPreferences(clientIdFromRequest(req), {
         aiEnabled,
+        // Optional so stale cached clients don't wipe the newer toggle.
+        ...(typeof exitEnabled === 'boolean' ? { exitEnabled } : {}),
         alertStyle,
         locale: typeof locale === 'string' ? locale.slice(0, 32) : 'zh-CN',
     });