viveworker 0.7.0-beta.3 → 0.8.0

package/scripts/viveworker-bridge.mjs

@@ -21,6 +21,12 @@ import { renderMarkdownHtml } from "./lib/markdown-render.mjs";
 import { buildAgentCard, handleA2ARequest, resolveA2ATaskDecision, completeA2ATask, failA2ATask } from "./a2a-handler.mjs";
 import { registerWithRelay, startRelayPolling, stopRelayPolling, postRelayResult, getRelayStatus, updatePublicTasksFlag } from "./a2a-relay-client.mjs";
 import { createMoltbookClient, readScoutState, writeScoutState, rollScoutDayIfNeeded, markPostSeen, recordComposeAttempt, writeDraft, readDraft, deleteDraft, listPendingDrafts, solveVerificationPuzzle, solvePuzzleWithLLM, recordPuzzleAttempt, listInboxItems } from "./moltbook-api.mjs";
+import { startRemotePairingRelay, DEFAULT_RELAY_URL } from "./lib/remote-pairing/orchestrator.mjs";
+import { restartRemotePairingRelay, persistRemotePairingEnv, getRemotePairingStatus } from "./lib/remote-pairing/control.mjs";
+import { appendRemotePairingAuditEvent, readRemotePairingAuditEvents } from "./lib/remote-pairing/audit.mjs";
+import { loadPairings, removePairingPersisted, addPairingPersisted, rotateRelayTokenPersisted, buildPairing, REMOTE_PAIRINGS_FILE } from "./lib/remote-pairing/pairings.mjs";
+import { ensureIdentityKeypair } from "./lib/remote-pairing/keys.mjs";
+import { fingerprintIdentity, bytesToHex } from "./lib/remote-pairing/keys-core.mjs";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -42,6 +48,8 @@ const listSupportedPayments = typeof hazbaseAuth.listSupportedPayments === "func
   ? hazbaseAuth.listSupportedPayments.bind(hazbaseAuth)
   : async () => ({ networks: [], defaultNetwork: "base-sepolia" });
 const appPackageVersion = readPackageVersion();
+const WEB_APP_BUILD_ID = "20260428-remote-token-refresh";
+const WEB_APP_SCRIPT_URL = `/app.js?v=${WEB_APP_BUILD_ID}`;
 const sessionCookieName = "viveworker_session";
 const deviceCookieName = "viveworker_device";
 const historyKinds = new Set(["completion", "assistant_final", "plan_ready", "approval", "plan", "choice", "info", "moltbook_reply", "moltbook_draft", "thread_share", "a2a_task", "a2a_task_result"]);
@@ -52,6 +60,7 @@ const DEFAULT_DEVICE_TRUST_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const MAX_PAIRED_DEVICES = 200;
 const PAIRING_RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
 const PAIRING_RATE_LIMIT_MAX_ATTEMPTS = 8;
+const REMOTE_PAIRING_RELAY_TOKEN_ROTATION_MS = 30 * 24 * 60 * 60 * 1000;
 const DEFAULT_COMPLETION_REPLY_IMAGE_MAX_BYTES = 15 * 1024 * 1024;
 const DEFAULT_COMPLETION_REPLY_UPLOAD_TTL_MS = 24 * 60 * 60 * 1000;
 const MAX_COMPLETION_REPLY_IMAGE_COUNT = 4;
@@ -209,6 +218,7 @@ const cli = parseCliArgs(process.argv.slice(2));
 const envFile = resolveEnvFile(cli.envFile);
 loadEnvFile(envFile);
 loadEnvFile(path.join(os.homedir(), ".viveworker", "a2a.env"));
+loadEnvFile(path.join(os.homedir(), ".viveworker", "remote-pairing.env"));
 await maybeRotateStartupPairingEnv(envFile);
 
 const config = buildConfig(cli);
@@ -261,6 +271,7 @@ const runtime = {
   recentCodeEvents: [],
   pairingAttemptsByRemoteAddress: new Map(),
   ipcClient: null,
+  remotePairingHandle: null,
   stopping: false,
   // In-memory cache for the `/api/share/status` endpoint. A 30s TTL avoids
   // hammering the share worker on every settings-page render. Purely runtime —
@@ -475,6 +486,11 @@ function buildSessionLocalePayload(config, state, deviceId) {
     a2aShareEnabled: Boolean(config.a2aRelayUserId && config.a2aApiKey),
     a2aExecutors: runtime.a2aAvailableExecutors || { codex: false, claude: false },
     a2aExecutorPreference: state.a2aExecutorPreference || "ask",
+    // Remote pairing is always "available" — the row appears in Settings →
+    // Integrations regardless of whether the relay is currently enabled, so
+    // users can find the toggle. The actual enabled/connected state is read
+    // from /api/remote-pairing/status.
+    remotePairingAvailable: true,
   };
 }
 
@@ -680,7 +696,7 @@ function withNotificationIcon(kind, title) {
 
 function normalizeTimelineOutcome(value) {
   const normalized = cleanText(value || "").toLowerCase();
-  return ["pending", "approved", "rejected", "implemented", "dismissed", "submitted"].includes(normalized)
+  return ["pending", "approved", "rejected", "failed", "implemented", "dismissed", "submitted"].includes(normalized)
     ? normalized
     : "";
 }
@@ -808,6 +824,21 @@ function normalizeTimelineFileRefs(rawFileRefs) {
   return deduped;
 }
 
+function filterTimelineFileRefsForImagePaths(fileRefs, imagePaths) {
+  const normalizedRefs = normalizeTimelineFileRefs(fileRefs);
+  const normalizedImages = normalizeTimelineImagePaths(imagePaths);
+  if (normalizedRefs.length === 0 || normalizedImages.length === 0) {
+    return normalizedRefs;
+  }
+
+  const imageRefKeys = new Set();
+  for (const imagePath of normalizedImages) {
+    imageRefKeys.add(imagePath);
+    imageRefKeys.add(path.basename(imagePath));
+  }
+  return normalizedRefs.filter((fileRef) => !imageRefKeys.has(fileRef) && !imageRefKeys.has(path.basename(fileRef)));
+}
+
 function cleanTimelineFileRef(value) {
   let normalized = cleanText(value || "");
   if (!normalized) {
@@ -2874,7 +2905,8 @@ function normalizeHistoryItem(raw) {
   const title =
     (!isFallbackTimelineTitle(rawTitle, kind, threadId) ? rawTitle : "") ||
     (threadLabel ? formatTitle(kindTitle(DEFAULT_LOCALE, kind), threadLabel) : kindTitle(DEFAULT_LOCALE, kind));
-  const messageText = normalizeTimelineMessageText(raw.messageText ?? "");
+  const rawMessageText = raw.messageText ?? "";
+  const messageText = normalizeTimelineMessageText(rawMessageText);
   const summary = normalizeNotificationText(raw.summary ?? "") || formatNotificationBody(messageText, 100) || "";
   const createdAtMs = Number(raw.createdAtMs) || Date.now();
   if (!stableId || !historyKinds.has(kind) || !title) {
@@ -2882,6 +2914,14 @@ function normalizeHistoryItem(raw) {
   }
 
   const outcome = normalizeTimelineOutcome(raw.outcome ?? "") || inferTimelineOutcome(kind, summary, messageText);
+  const imagePaths = normalizeTimelineImagePaths([
+    ...(Array.isArray(raw.imagePaths ?? raw.localImagePaths) ? (raw.imagePaths ?? raw.localImagePaths) : []),
+    ...extractTimelineImagePaths(rawMessageText),
+  ]);
+  const fileRefs = filterTimelineFileRefsForImagePaths(
+    normalizeTimelineFileRefs(raw.fileRefs ?? extractTimelineFileRefs(messageText)),
+    imagePaths
+  );
 
   const normalized = {
     stableId,
@@ -2892,8 +2932,8 @@ function normalizeHistoryItem(raw) {
     threadLabel,
     summary,
     messageText,
-    imagePaths: normalizeTimelineImagePaths(raw.imagePaths ?? raw.localImagePaths ?? []),
-    fileRefs: normalizeTimelineFileRefs(raw.fileRefs ?? extractTimelineFileRefs(messageText)),
+    imagePaths,
+    fileRefs,
     diffText: normalizeTimelineDiffText(raw.diffText ?? ""),
     diffSource: normalizeTimelineDiffSource(raw.diffSource ?? ""),
     diffAvailable: raw.diffAvailable === true || Boolean(raw.diffText),
@@ -2993,6 +3033,70 @@ function normalizeTimelineEntries(rawItems, maxItems) {
   return deduped;
 }
 
+// Cheap structural diff used by record* helpers to decide whether a rebuilt
+// timeline / history / code-events array actually changed in a way worth
+// persisting. The previous implementation `JSON.stringify(a) !== JSON.stringify(b)`
+// allocated several megabytes of intermediate strings on every call when the
+// projection included `diffText` (5+ KB per file_event × ~250 entries × 2
+// sides), which dominated scavenger GC time in busy sessions and showed up as
+// a 25% CPU sink in `JsonStringifier::Serialize_*` under V8 sampling. Walking
+// the arrays in lockstep and bailing on the first mismatched primitive lets
+// the common "fresh entry prepended" case exit on the very first stableId
+// compare with zero allocations.
+//
+// Field semantics:
+// - String / number / boolean fields use value-equality via `===` (works
+//   across object reconstruction by `normalizeTimelineEntry`).
+// - `Array` fields (e.g. `previousFileRefs`) shallow-compare lengths and the
+//   `path` of each element rather than serializing.
+// - `null` / `undefined` are treated as equal to each other but distinct from
+//   any defined value.
+function timelineProjectionChanged(nextItems, previousItems, fieldKeys) {
+  const a = Array.isArray(nextItems) ? nextItems : [];
+  const b = Array.isArray(previousItems) ? previousItems : [];
+  if (a.length !== b.length) {
+    return true;
+  }
+  for (let i = 0; i < a.length; i++) {
+    const ai = a[i];
+    const bi = b[i];
+    if (ai === bi) continue;
+    if (!ai || !bi) return true;
+    for (let k = 0; k < fieldKeys.length; k++) {
+      const key = fieldKeys[k];
+      const av = ai[key];
+      const bv = bi[key];
+      if (av === bv) continue;
+      if (av == null && bv == null) continue;
+      if (Array.isArray(av) && Array.isArray(bv)) {
+        if (av.length !== bv.length) return true;
+        let arrayDiffers = false;
+        for (let j = 0; j < av.length; j++) {
+          const aj = av[j];
+          const bj = bv[j];
+          if (aj === bj) continue;
+          if (!aj || !bj) {
+            arrayDiffers = true;
+            break;
+          }
+          // Most array-of-object fields here are fileRef-shaped: identity is
+          // captured by `path`. Falling back to JSON for unrecognised shapes
+          // is unnecessary — a path mismatch (or a null path either side) is
+          // sufficient to mark the projection changed.
+          if (aj.path !== bj.path) {
+            arrayDiffers = true;
+            break;
+          }
+        }
+        if (arrayDiffers) return true;
+        continue;
+      }
+      return true;
+    }
+  }
+  return false;
+}
+
 function isCodeEventEntry(raw) {
   if (!isPlainObject(raw)) {
     return false;
@@ -3063,7 +3167,8 @@ function normalizeTimelineEntry(raw) {
   }
 
   const threadId = cleanText(raw.threadId ?? extractConversationIdFromStableId(stableId) ?? "");
-  const messageText = normalizeTimelineMessageText(raw.messageText ?? "");
+  const rawMessageText = raw.messageText ?? "";
+  const messageText = normalizeTimelineMessageText(rawMessageText);
   const fileEventType = normalizeTimelineFileEventType(raw.fileEventType ?? "");
   const diffText = normalizeTimelineDiffText(raw.diffText ?? "");
   const diffSource = normalizeTimelineDiffSource(raw.diffSource ?? "");
@@ -3098,6 +3203,14 @@ function normalizeTimelineEntry(raw) {
     threadLabel ||
     kindTitle(DEFAULT_LOCALE, kind);
   const outcome = normalizeTimelineOutcome(raw.outcome ?? "") || inferTimelineOutcome(kind, summary, messageText);
+  const imagePaths = normalizeTimelineImagePaths([
+    ...(Array.isArray(raw.imagePaths ?? raw.localImagePaths) ? (raw.imagePaths ?? raw.localImagePaths) : []),
+    ...extractTimelineImagePaths(rawMessageText),
+  ]);
+  const fileRefs = filterTimelineFileRefsForImagePaths(
+    normalizeTimelineFileRefs(raw.fileRefs ?? extractTimelineFileRefs(messageText)),
+    imagePaths
+  );
 
   const normalized = {
     stableId,
@@ -3110,8 +3223,8 @@ function normalizeTimelineEntry(raw) {
     messageText,
     fileEventType,
     previousFileRefs: normalizeTimelineFileRefs(raw.previousFileRefs ?? []),
-    imagePaths: normalizeTimelineImagePaths(raw.imagePaths ?? raw.localImagePaths ?? []),
-    fileRefs: normalizeTimelineFileRefs(raw.fileRefs ?? extractTimelineFileRefs(messageText)),
+    imagePaths,
+    fileRefs,
     diffText,
     diffSource,
     diffAvailable: raw.diffAvailable === true || Boolean(diffText),
@@ -3158,35 +3271,21 @@ function recordTimelineEntry({ config, runtime, state, entry }) {
     [normalized, ...runtime.recentTimelineEntries.filter((item) => item.stableId !== normalized.stableId)],
     config.maxTimelineEntries
   );
-  const changed =
-    JSON.stringify(
-      nextItems.map((item) => [
-        item.stableId,
-        item.title,
-        item.createdAtMs,
-        item.diffAvailable,
-        item.diffSource,
-        item.diffAddedLines,
-        item.diffRemovedLines,
-        item.diffText,
-        item.previousFileRefs,
-        item.cwd,
-      ])
-    ) !==
-    JSON.stringify(
-      runtime.recentTimelineEntries.map((item) => [
-        item.stableId,
-        item.title,
-        item.createdAtMs,
-        item.diffAvailable,
-        item.diffSource,
-        item.diffAddedLines,
-        item.diffRemovedLines,
-        item.diffText,
-        item.previousFileRefs,
-        item.cwd,
-      ])
-    );
+  // Note: diffText is intentionally omitted from the projection — the
+  // line-count fields (`diffAddedLines` / `diffRemovedLines`) are a sufficient
+  // proxy for "diff content changed" and avoid materialising a megabyte-class
+  // intermediate string on every record call.
+  const changed = timelineProjectionChanged(nextItems, runtime.recentTimelineEntries, [
+    "stableId",
+    "title",
+    "createdAtMs",
+    "diffAvailable",
+    "diffSource",
+    "diffAddedLines",
+    "diffRemovedLines",
+    "previousFileRefs",
+    "cwd",
+  ]);
   runtime.recentTimelineEntries = nextItems;
   state.recentTimelineEntries = nextItems;
   return changed;
@@ -3205,35 +3304,19 @@ function recordCodeEvent({ config, runtime, state, entry }) {
     [normalized, ...runtime.recentCodeEvents.filter((item) => item.stableId !== normalized.stableId)],
     config.maxCodeEvents
   );
-  const changed =
-    JSON.stringify(
-      nextItems.map((item) => [
-        item.stableId,
-        item.title,
-        item.createdAtMs,
-        item.diffAvailable,
-        item.diffSource,
-        item.diffAddedLines,
-        item.diffRemovedLines,
-        item.diffText,
-        item.previousFileRefs,
-        item.cwd,
-      ])
-    ) !==
-    JSON.stringify(
-      runtime.recentCodeEvents.map((item) => [
-        item.stableId,
-        item.title,
-        item.createdAtMs,
-        item.diffAvailable,
-        item.diffSource,
-        item.diffAddedLines,
-        item.diffRemovedLines,
-        item.diffText,
-        item.previousFileRefs,
-        item.cwd,
-      ])
-    );
+  // See `recordTimelineEntry` for the rationale on dropping `diffText` from
+  // the projection — same megabyte-stringify hot path; same line-count proxy.
+  const changed = timelineProjectionChanged(nextItems, runtime.recentCodeEvents, [
+    "stableId",
+    "title",
+    "createdAtMs",
+    "diffAvailable",
+    "diffSource",
+    "diffAddedLines",
+    "diffRemovedLines",
+    "previousFileRefs",
+    "cwd",
+  ]);
   runtime.recentCodeEvents = nextItems;
   state.recentCodeEvents = nextItems;
   if (changed) {
@@ -3257,37 +3340,19 @@ function syncRecentCodeEventsFromTimeline({ config, runtime, state }) {
     ],
     config.maxCodeEvents
   );
-  const changed =
-    JSON.stringify(
-      nextItems.map((item) => [
-        item.stableId,
-        item.title,
-        item.createdAtMs,
-        item.threadLabel,
-        item.diffAvailable,
-        item.diffSource,
-        item.diffAddedLines,
-        item.diffRemovedLines,
-        item.diffText,
-        item.previousFileRefs,
-        item.cwd,
-      ])
-    ) !==
-    JSON.stringify(
-      runtime.recentCodeEvents.map((item) => [
-        item.stableId,
-        item.title,
-        item.createdAtMs,
-        item.threadLabel,
-        item.diffAvailable,
-        item.diffSource,
-        item.diffAddedLines,
-        item.diffRemovedLines,
-        item.diffText,
-        item.previousFileRefs,
-        item.cwd,
-      ])
-    );
+  // See `recordTimelineEntry` for the rationale on dropping `diffText`.
+  const changed = timelineProjectionChanged(nextItems, runtime.recentCodeEvents, [
+    "stableId",
+    "title",
+    "createdAtMs",
+    "threadLabel",
+    "diffAvailable",
+    "diffSource",
+    "diffAddedLines",
+    "diffRemovedLines",
+    "previousFileRefs",
+    "cwd",
+  ]);
   runtime.recentCodeEvents = nextItems;
   state.recentCodeEvents = nextItems;
   if (changed) {
@@ -3353,9 +3418,11 @@ function recordHistoryItem({ config, runtime, state, item }) {
     [normalized, ...runtime.recentHistoryItems.filter((entry) => entry.stableId !== normalized.stableId)],
     config.maxHistoryItems
   );
-  const changed =
-    JSON.stringify(nextItems.map((entry) => [entry.stableId, entry.title, entry.createdAtMs])) !==
-    JSON.stringify(runtime.recentHistoryItems.map((entry) => [entry.stableId, entry.title, entry.createdAtMs]));
+  const changed = timelineProjectionChanged(nextItems, runtime.recentHistoryItems, [
+    "stableId",
+    "title",
+    "createdAtMs",
+  ]);
   runtime.recentHistoryItems = nextItems;
   state.recentHistoryItems = nextItems;
   return changed;
@@ -3784,7 +3851,7 @@ async function scanOnce({ config, runtime, state }) {
   if (config.webUiEnabled) {
     let claudeTranscriptChanged = false;
     if (now - runtime.lastClaudeScanAt >= config.directoryScanIntervalMs) {
-      runtime.claudeKnownFiles = await listClaudeTranscriptFiles(config.claudeProjectsDir);
+      runtime.claudeKnownFiles = await listClaudeTranscriptFiles(config.claudeProjectsDir, config.claudeTranscriptMaxAgeMs);
       runtime.lastClaudeScanAt = now;
     }
     let claudeSessionTitlesChanged = false;
@@ -4122,7 +4189,16 @@ async function refreshClaudeSessionTitles(runtime) {
   return changed;
 }
 
-async function listClaudeTranscriptFiles(claudeProjectsDir) {
+async function listClaudeTranscriptFiles(claudeProjectsDir, maxAgeMs = 0) {
+  // ~/.claude/projects can accumulate thousands of .jsonl files (one per
+  // session, never garbage-collected by Claude Code itself). Returning all of
+  // them means processClaudeTranscriptFile fs.stat()s each every poll
+  // iteration — for a long-time user that's 3000+ stats every 2.5 s, all but
+  // a handful of which are guaranteed-cold. Filter by mtime here so the
+  // per-iteration working set tracks "active sessions", not "total sessions
+  // ever". maxAgeMs=0 disables filtering for callers who explicitly want
+  // everything (none in the bridge today).
+  const cutoffMs = maxAgeMs > 0 ? Date.now() - maxAgeMs : 0;
   try {
     const result = [];
     const entries = await fs.readdir(claudeProjectsDir, { withFileTypes: true });
@@ -4133,7 +4209,17 @@ async function listClaudeTranscriptFiles(claudeProjectsDir) {
         const files = await fs.readdir(projectPath, { withFileTypes: true });
         for (const file of files) {
           if (!file.isFile() || !file.name.endsWith(".jsonl")) continue;
-          result.push(path.join(projectPath, file.name));
+          const fullPath = path.join(projectPath, file.name);
+          if (cutoffMs > 0) {
+            try {
+              const stat = await fs.stat(fullPath);
+              if (stat.mtimeMs < cutoffMs) continue;
+            } catch {
+              // skip unreadable file (vanished or permissioned out)
+              continue;
+            }
+          }
+          result.push(fullPath);
         }
       } catch {
         // skip unreadable project dirs
@@ -5144,8 +5230,8 @@ async function readRecentRolloutUserMessagesWithImages({ filePath, maxBytes }) {
 async function querySqliteTimelineRows({ logsDbFile, cursorId, minTsSec = 0 }) {
   const conditions = [
     `id > ${Math.max(0, Number(cursorId) || 0)}`,
-    `target = 'codex_api::endpoint::responses_websocket'`,
-    `feedback_log_body LIKE '%websocket event: {"type":"response.output_item.done"%'`,
+    `target IN ('codex_api::endpoint::responses_websocket', 'codex_api::sse::responses')`,
+    `(feedback_log_body LIKE '%websocket event: {"type":"response.output_item.done"%' OR feedback_log_body LIKE '%SSE event: {"type":"response.output_item.done"%')`,
     `feedback_log_body LIKE '%"type":"message"%'`,
     `feedback_log_body LIKE '%"role":"assistant"%'`,
   ];
@@ -5155,28 +5241,50 @@ async function querySqliteTimelineRows({ logsDbFile, cursorId, minTsSec = 0 }) {
   }
 
   const sql = `
-    SELECT id, ts, thread_id, feedback_log_body
+    SELECT
+      logs.id,
+      logs.ts,
+      logs.thread_id,
+      logs.feedback_log_body,
+      (
+        SELECT ctx.feedback_log_body
+        FROM logs AS ctx
+        WHERE ctx.id < logs.id
+          AND ctx.id >= logs.id - 5
+          AND ctx.target = 'codex_otel.log_only'
+          AND ctx.feedback_log_body LIKE '%conversation.id=%'
+        ORDER BY ctx.id DESC
+        LIMIT 1
+      ) AS context_log_body
     FROM logs
     WHERE ${conditions.join("\n      AND ")}
-    ORDER BY id ASC
+    ORDER BY logs.id ASC
     LIMIT ${SQLITE_COMPLETION_BATCH_SIZE}
   `;
 
   return runSqliteJsonQuery(logsDbFile, sql);
 }
 
-function buildSqliteTimelineEntry({ row, config, runtime }) {
-  const body = String(row?.feedback_log_body ?? "");
-  const marker = "websocket event: ";
-  const markerIndex = body.indexOf(marker);
-  if (markerIndex === -1) {
-    return null;
+function parseResponsesEventPayload(body) {
+  const raw = String(body || "");
+  for (const marker of ["websocket event: ", "SSE event: "]) {
+    const markerIndex = raw.indexOf(marker);
+    if (markerIndex === -1) {
+      continue;
+    }
+    try {
+      return JSON.parse(raw.slice(markerIndex + marker.length));
+    } catch {
+      return null;
+    }
   }
+  return null;
+}
 
-  let payload;
-  try {
-    payload = JSON.parse(body.slice(markerIndex + marker.length));
-  } catch {
+function buildSqliteTimelineEntry({ row, config, runtime }) {
+  const body = String(row?.feedback_log_body ?? "");
+  const payload = parseResponsesEventPayload(body);
+  if (!payload) {
     return null;
   }
 
@@ -5200,7 +5308,12 @@ function buildSqliteTimelineEntry({ row, config, runtime }) {
     return null;
   }
 
-  const threadId = cleanText(row.thread_id || extractThreadIdFromLogBody(body));
+  const contextLogBody = String(row?.context_log_body ?? "");
+  const threadId = cleanText(
+    row.thread_id ||
+    extractThreadIdFromLogBody(body) ||
+    extractThreadIdFromLogBody(contextLogBody)
+  );
   if (!threadId) {
     return null;
   }
@@ -5328,6 +5441,25 @@ async function findReplyUploadFallback(config, sourcePath, usedPaths = new Set()
   return candidates[0]?.filePath || "";
 }
 
+function isFileAccessDeniedError(error) {
+  const code = cleanText(error?.code || "");
+  return code === "EACCES" || code === "EPERM";
+}
+
+async function copyFileWithSystemCp(sourcePath, destinationPath) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("/bin/cp", ["-p", sourcePath, destinationPath], { stdio: "ignore" });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) {
+        resolve(true);
+        return;
+      }
+      reject(new Error(`cp exited with ${signal || code}`));
+    });
+  });
+}
+
 async function copyTimelineAttachmentToPersistentDir(config, sourcePath) {
   const normalizedSourcePath = resolvePath(cleanText(sourcePath || ""));
   if (!normalizedSourcePath) {
@@ -5344,6 +5476,16 @@ async function copyTimelineAttachmentToPersistentDir(config, sourcePath) {
     await fs.copyFile(normalizedSourcePath, destinationPath);
     return destinationPath;
   } catch (error) {
+    if (isFileAccessDeniedError(error)) {
+      try {
+        await copyFileWithSystemCp(normalizedSourcePath, destinationPath);
+        return destinationPath;
+      } catch (fallbackError) {
+        await fs.rm(destinationPath, { force: true }).catch(() => {});
+        console.warn(`[timeline-image-copy-skipped] ${error?.message || error}; cp fallback failed: ${fallbackError?.message || fallbackError}`);
+        return "";
+      }
+    }
     console.warn(`[timeline-image-copy-skipped] ${error?.message || error}`);
     return "";
   }
@@ -5356,8 +5498,12 @@ async function normalizePersistedTimelineImagePaths({ config, state, imagePaths
   }
 
   const aliases = isPlainObject(state.timelineImagePathAliases) ? state.timelineImagePathAliases : (state.timelineImagePathAliases = {});
+  const copyFailures = isPlainObject(state.timelineImagePathCopyFailures)
+    ? state.timelineImagePathCopyFailures
+    : (state.timelineImagePathCopyFailures = {});
   const usedFallbacks = new Set();
   const nextPaths = [];
+  const copyRetryMs = 10 * 60 * 1000;
 
   for (const rawPath of normalizedImagePaths) {
     const normalizedPath = cleanText(rawPath || "");
@@ -5367,24 +5513,38 @@ async function normalizePersistedTimelineImagePaths({ config, state, imagePaths
 
     const aliasedPath = cleanText(aliases[normalizedPath] || "");
     if (aliasedPath) {
-      try {
-        await fs.access(aliasedPath);
-        nextPaths.push(aliasedPath);
-        continue;
-      } catch {
-        // Fall through and repair below.
+      if (aliasedPath.startsWith(`${config.timelineAttachmentsDir}${path.sep}`)) {
+        try {
+          await fs.access(aliasedPath);
+          nextPaths.push(aliasedPath);
+          continue;
+        } catch {
+          // Fall through and repair below.
+        }
       }
     }
 
+    const lastCopyFailureMs = Math.max(0, Number(copyFailures[normalizedPath]) || 0);
+    if (
+      lastCopyFailureMs > 0 &&
+      Date.now() - lastCopyFailureMs < copyRetryMs &&
+      !normalizedPath.startsWith(`${config.timelineAttachmentsDir}${path.sep}`)
+    ) {
+      nextPaths.push(normalizedPath);
+      continue;
+    }
+
     let existingSourcePath = normalizedPath;
     try {
       await fs.access(existingSourcePath);
-    } catch {
-      existingSourcePath = await findReplyUploadFallback(config, normalizedPath, usedFallbacks);
-      if (!existingSourcePath) {
-        continue;
+    } catch (error) {
+      if (!isFileAccessDeniedError(error)) {
+        existingSourcePath = await findReplyUploadFallback(config, normalizedPath, usedFallbacks);
+        if (!existingSourcePath) {
+          continue;
+        }
+        usedFallbacks.add(existingSourcePath);
       }
-      usedFallbacks.add(existingSourcePath);
     }
 
     let persistentPath = existingSourcePath;
@@ -5392,6 +5552,11 @@ async function normalizePersistedTimelineImagePaths({ config, state, imagePaths
       persistentPath = await copyTimelineAttachmentToPersistentDir(config, existingSourcePath) || existingSourcePath;
     }
 
+    if (persistentPath === existingSourcePath && !existingSourcePath.startsWith(`${config.timelineAttachmentsDir}${path.sep}`)) {
+      copyFailures[normalizedPath] = Date.now();
+    } else {
+      delete copyFailures[normalizedPath];
+    }
     aliases[normalizedPath] = persistentPath;
     nextPaths.push(persistentPath);
   }
@@ -5738,8 +5903,8 @@ async function processScannedEvent({ config, runtime, state, event }) {
 async function querySqliteCompletionRows({ logsDbFile, cursorId, minTsSec = 0 }) {
   const conditions = [
     `id > ${Math.max(0, Number(cursorId) || 0)}`,
-    `target = 'codex_api::endpoint::responses_websocket'`,
-    `feedback_log_body LIKE '%websocket event: {"type":"response.output_item.done"%'`,
+    `target IN ('codex_api::endpoint::responses_websocket', 'codex_api::sse::responses')`,
+    `(feedback_log_body LIKE '%websocket event: {"type":"response.output_item.done"%' OR feedback_log_body LIKE '%SSE event: {"type":"response.output_item.done"%')`,
     `feedback_log_body LIKE '%"type":"message"%'`,
     `feedback_log_body LIKE '%"role":"assistant"%'`,
     `feedback_log_body LIKE '%"phase":"final_answer"%'`,
@@ -5750,10 +5915,24 @@ async function querySqliteCompletionRows({ logsDbFile, cursorId, minTsSec = 0 })
   }
 
   const sql = `
-    SELECT id, ts, thread_id, feedback_log_body
+    SELECT
+      logs.id,
+      logs.ts,
+      logs.thread_id,
+      logs.feedback_log_body,
+      (
+        SELECT ctx.feedback_log_body
+        FROM logs AS ctx
+        WHERE ctx.id < logs.id
+          AND ctx.id >= logs.id - 5
+          AND ctx.target = 'codex_otel.log_only'
+          AND ctx.feedback_log_body LIKE '%conversation.id=%'
+        ORDER BY ctx.id DESC
+        LIMIT 1
+      ) AS context_log_body
     FROM logs
     WHERE ${conditions.join("\n      AND ")}
-    ORDER BY id ASC
+    ORDER BY logs.id ASC
     LIMIT ${SQLITE_COMPLETION_BATCH_SIZE}
   `;
 
@@ -5799,16 +5978,8 @@ async function runSqliteJsonQuery(dbFile, sql) {
 
 function buildSqliteCompletionEvent({ row, config, runtime }) {
   const body = String(row?.feedback_log_body ?? "");
-  const marker = "websocket event: ";
-  const markerIndex = body.indexOf(marker);
-  if (markerIndex === -1) {
-    return null;
-  }
-
-  let payload;
-  try {
-    payload = JSON.parse(body.slice(markerIndex + marker.length));
-  } catch {
+  const payload = parseResponsesEventPayload(body);
+  if (!payload) {
     return null;
   }
 
@@ -5821,7 +5992,12 @@ function buildSqliteCompletionEvent({ row, config, runtime }) {
     return null;
   }
 
-  const threadId = cleanText(row.thread_id || extractThreadIdFromLogBody(body));
+  const contextLogBody = String(row?.context_log_body ?? "");
+  const threadId = cleanText(
+    row.thread_id ||
+    extractThreadIdFromLogBody(body) ||
+    extractThreadIdFromLogBody(contextLogBody)
+  );
   const turnId = cleanText(extractTurnIdFromLogBody(body) || item.id || row.id);
   if (!threadId || !turnId) {
     return null;
@@ -8214,6 +8390,12 @@ function normalizeIpcErrorMessage(errorValue) {
   return cleanText(String(errorValue ?? "")) || "ipc-request-failed";
 }
 
+function isStartTurnAckTimeout(errorValue) {
+  const message = normalizeIpcErrorMessage(errorValue);
+  return message === "thread-follower-start-turn-timeout" ||
+    message === "turn/start-timeout";
+}
+
 function buildDefaultCollaborationMode(threadState) {
   // Fallback turns must leave Plan mode unless the caller explicitly opts in.
   return buildRequestedCollaborationMode(threadState, "default");
@@ -8905,6 +9087,14 @@ function deriveClaudeSdkCliThreadLabel(messageText, conversationId = "") {
   if (/^You are scoring Moltbook posts? for an AI agent\b/iu.test(single)) {
     return "Moltbook scoring";
   }
+  if (/^You are drafting a reply on behalf of the agent described below\b/iu.test(single) ||
+      /\bYou are replying to the following post on Moltbook\b/iu.test(single)) {
+    return "Moltbook reply drafting";
+  }
+  if (/^You are composing an original post on Moltbook\b/iu.test(single) ||
+      /\bAvailable submolts:\s*general,\s*builds,\s*tooling,\s*agents,\s*infrastructure\b.*\bSUBMOLT:\s*.*\bTITLE:\s*.*\bINTENT:\s*/iu.test(single)) {
+    return "Moltbook post drafting";
+  }
   if (/^Codex from another agent:/iu.test(single)) {
     return truncate(cleanText(single.replace(/^Codex from another agent:\s*/iu, "")), 90) || "Cross-agent task";
   }
@@ -8925,6 +9115,46 @@ function isHiddenClaudeInternalScoringText(text) {
   return /^You are scoring Moltbook posts? for an AI agent\b/iu.test(single);
 }
 
+function isMoltbookHarnessThreadLabel(text) {
+  const single = cleanText(stripNotificationMarkup(stripEnvironmentContextBlocks(text || "")));
+  if (!single) {
+    return false;
+  }
+  return (
+    single === "Moltbook reply drafting" ||
+    single === "Moltbook post drafting" ||
+    /^You are drafting a reply on behalf of the agent described below\b/iu.test(single) ||
+    /^You are composing an original post on Moltbook\b/iu.test(single) ||
+    /\bYou are replying to the following post on Moltbook\b/iu.test(single) ||
+    /\bAvailable submolts:\s*general,\s*builds,\s*tooling,\s*agents,\s*infrastructure\b.*\bSUBMOLT:\s*.*\bTITLE:\s*.*\bINTENT:\s*/iu.test(single)
+  );
+}
+
+function isHiddenMoltbookHarnessPromptText(text) {
+  const single = cleanText(stripNotificationMarkup(stripEnvironmentContextBlocks(text || "")));
+  if (!single) {
+    return false;
+  }
+  return (
+    /^You are drafting a reply on behalf of the agent described below\b/iu.test(single) ||
+    /^You are composing an original post on Moltbook\b/iu.test(single) ||
+    /\bYou are replying to the following post on Moltbook\b/iu.test(single) ||
+    /\bAvailable submolts:\s*general,\s*builds,\s*tooling,\s*agents,\s*infrastructure\b.*\bSUBMOLT:\s*.*\bTITLE:\s*.*\bINTENT:\s*/iu.test(single)
+  );
+}
+
+function isHiddenMoltbookHarnessOutputText(text) {
+  const single = cleanText(stripNotificationMarkup(stripEnvironmentContextBlocks(text || "")));
+  if (!single) {
+    return false;
+  }
+  return (
+    /^INTENT:\s+.+\s+---\s+.+/isu.test(single) ||
+    /^SUBMOLT:\s+.+\s+TITLE:\s+.+\s+INTENT:\s+.+\s+---\s+.+/isu.test(single) ||
+    single === "NO_MATCH"
+  );
+}
+
 function isHiddenCodexApprovalAssessmentText(text) {
   const single = cleanText(stripNotificationMarkup(stripEnvironmentContextBlocks(text || "")));
   if (!single) {
@@ -8934,7 +9164,7 @@ function isHiddenCodexApprovalAssessmentText(text) {
 }
 
 function shouldHideInternalTimelineItem(item) {
-  return shouldHideClaudeInternalItem(item) || shouldHideCodexInternalApprovalItem(item);
+  return shouldHideClaudeInternalItem(item) || shouldHideCodexInternalApprovalItem(item) || shouldHideMoltbookHarnessItem(item);
 }
 
 function shouldHideClaudeInternalItem(item) {
@@ -8956,6 +9186,29 @@ function shouldHideClaudeInternalItem(item) {
   );
 }
 
+function shouldHideMoltbookHarnessItem(item) {
+  if (!isPlainObject(item)) {
+    return false;
+  }
+  const provider = normalizeProvider(item.provider);
+  if (provider !== "claude" && provider !== "codex") {
+    return false;
+  }
+
+  return (
+    isMoltbookHarnessThreadLabel(item.threadLabel) ||
+    isMoltbookHarnessThreadLabel(item.title) ||
+    isHiddenMoltbookHarnessPromptText(item.messageText) ||
+    isHiddenMoltbookHarnessPromptText(item.summary) ||
+    isHiddenMoltbookHarnessPromptText(item.detailText) ||
+    isHiddenMoltbookHarnessPromptText(item.message) ||
+    isHiddenMoltbookHarnessOutputText(item.messageText) ||
+    isHiddenMoltbookHarnessOutputText(item.summary) ||
+    isHiddenMoltbookHarnessOutputText(item.detailText) ||
+    isHiddenMoltbookHarnessOutputText(item.message)
+  );
+}
+
 function shouldSuppressInternalScannedEvent(event) {
   if (!isPlainObject(event)) {
     return false;
@@ -9774,6 +10027,16 @@ function base64UrlDecode(value) {
   return Buffer.from(String(value), "base64url").toString("utf8");
 }
 
+function constantTimeStringEqual(a, b) {
+  // Pad-then-compare so the timing leak is bounded by the longer string's
+  // length rather than the matching prefix. Caller still gets a clean
+  // boolean — no behavioural difference from `===`.
+  const left = Buffer.from(String(a ?? ""), "utf8");
+  const right = Buffer.from(String(b ?? ""), "utf8");
+  if (left.length !== right.length) return false;
+  return crypto.timingSafeEqual(left, right);
+}
+
 function signSessionPayload(payload, secret) {
   const encoded = base64UrlEncode(JSON.stringify(payload));
   const signature = crypto.createHmac("sha256", secret).update(encoded).digest("base64url");
@@ -10100,6 +10363,35 @@ function buildDeviceSummary({ config, state, deviceId, record, currentDeviceId,
   };
 }
 
+function inferLegacyRelayDeviceId(state, config, pairing) {
+  const active = activeTrustedDevices(state, config);
+  if (active.length === 1) {
+    return active[0].deviceId;
+  }
+
+  const addedAtMs = Number(pairing?.addedAtMs) || 0;
+  if (addedAtMs <= 0) {
+    return "";
+  }
+  const nearby = active.filter(({ record }) => {
+    const pairedAtMs = Number(record?.pairedAtMs) || 0;
+    return pairedAtMs > 0 && Math.abs(pairedAtMs - addedAtMs) <= 10 * 60 * 1000;
+  });
+  return nearby.length === 1 ? nearby[0].deviceId : "";
+}
+
+function resolveRelaySessionDeviceId(state, config, pairing, fallbackDeviceId) {
+  const explicit = cleanText(pairing?.deviceId || "");
+  if (explicit) {
+    return explicit;
+  }
+  const inferred = inferLegacyRelayDeviceId(state, config, pairing);
+  if (inferred) {
+    return inferred;
+  }
+  return cleanText(pairing?.phoneFingerprint || "") || cleanText(fallbackDeviceId || "") || null;
+}
+
 // Shared between `/api/session` and `/api/bootstrap` so both return an
 // identical session shape.
 function buildSessionPayload({ config, state, session }) {
@@ -10110,6 +10402,7 @@ function buildSessionPayload({ config, state, session }) {
     webPushEnabled: config.webPushEnabled,
     httpsEnabled: config.nativeApprovalPublicBaseUrl.startsWith("https://"),
     appVersion: appPackageVersion,
+    webAppBuildId: WEB_APP_BUILD_ID,
     deviceId: session.deviceId || null,
     temporaryPairing: session.temporaryPairing === true,
     ...buildSessionLocalePayload(config, state, session.deviceId),
@@ -10143,6 +10436,38 @@ function readSession(req, config, state) {
     };
   }
 
+  // Relay-dispatched requests authenticate via the Noise channel
+  // binding + pairing identity, set on the synthetic IncomingMessage by
+  // scripts/lib/remote-pairing/http-dispatch.mjs. They have no cookies
+  // (HttpOnly session cookie can't be forwarded by the PWA's JS layer,
+  // and the RPC frame doesn't carry browser cookies), so the cookie
+  // path below would always 401 them.
+  //
+  // Trust model: only this process's relay orchestrator can attach this
+  // marker — it's set on a synthetic req object that never leaves the
+  // bridge. An attacker would need code-exec inside the bridge to forge
+  // it, which is past the threat model anyway. The orchestrator only
+  // dispatches requests for pairings whose Noise IK handshake succeeded
+  // against the bridge's static key, so reaching this branch implies
+  // the phone proved possession of `pairing.phonePub`.
+  const relay = req.viveworker;
+  if (relay?.fromRelay && relay.pairing?.pairingId) {
+    const relayDeviceId = resolveRelaySessionDeviceId(state, config, relay.pairing, deviceId);
+    return {
+      authenticated: true,
+      sessionId: `relay:${relay.pairing.pairingId}`,
+      pairedAtMs: Number(relay.pairing.addedAtMs) || Date.now(),
+      // Relay sessions live only as long as the underlying Noise channel
+      // — there's no cookie expiry to track. 0 = "no fixed expiry, the
+      // transport layer manages liveness".
+      expiresAtMs: 0,
+      deviceId: relayDeviceId,
+      fromRelay: true,
+      pairingId: relay.pairing.pairingId,
+      relayPhoneFingerprint: relay.pairing.phoneFingerprint || "",
+    };
+  }
+
   const token = parseCookies(req)[sessionCookieName];
   const payload = token ? verifySessionToken(token, config.sessionSecret) : null;
   if (!payload) {
@@ -10440,8 +10765,15 @@ function validatePairingPayload(payload, config, state) {
 
   const code = cleanText(payload?.code ?? "").toUpperCase();
   const token = cleanText(payload?.token ?? "");
-  const matchesCode = code && cleanText(config.pairingCode).toUpperCase() === code;
-  const matchesToken = token && cleanText(config.pairingToken) === token;
+  // Constant-time compare both sides — even with the 8/15min lockout the
+  // pairing token is long enough that a measurable timing prefix-attack
+  // could meaningfully reduce the brute-force search space.
+  const matchesCode =
+    !!code &&
+    constantTimeStringEqual(cleanText(config.pairingCode).toUpperCase(), code);
+  const matchesToken =
+    !!token &&
+    constantTimeStringEqual(cleanText(config.pairingToken), token);
   if (matchesToken) {
     return { ok: true, credential: `token:${token}` };
   }
@@ -10601,6 +10933,16 @@ function requestOrigin(req) {
 }
 
 function requireTrustedMutationOrigin(req, res, config) {
+  // Relay-dispatched requests have no Origin / Referer (the PWA's RPC
+  // frame doesn't synthesize one) and a non-loopback synthetic
+  // remoteAddress, so they would always 403 here. They're authenticated
+  // by the Noise channel binding instead — no browser-side CSRF surface
+  // exists because an attacker can't establish a Noise channel without
+  // the pairing's static key. See readSession() for the trust-model
+  // notes.
+  if (req.viveworker?.fromRelay) {
+    return true;
+  }
   const origin = requestOrigin(req);
   if (!origin) {
     if (isLoopbackRequest(req)) {
@@ -11248,7 +11590,7 @@ function buildTimelineResponse(runtime, state, config, locale) {
     threadLabel: entry.threadLabel,
     summary: entry.summary,
     fileEventType: normalizeTimelineFileEventType(entry.fileEventType ?? ""),
-    imageUrls: buildTimelineEntryImageUrls(entry),
+    imageUrls: buildTimelineEntryImageUrls(entry, config),
     fileRefs: normalizeTimelineFileRefs(entry.fileRefs ?? []),
     diffAvailable: Boolean(entry.diffAvailable),
     diffAddedLines: Math.max(0, Number(entry.diffAddedLines) || 0),
@@ -11294,6 +11636,7 @@ function buildPendingApprovalDetail(runtime, state, approval, locale) {
       : approvalKind === "hazbase_wallet_payment"
         ? [
             { label: t(locale, "server.action.payWithWallet"), tone: "primary", url: `/api/payments/x402/hazbase-wallet/${encodeURIComponent(approval.token)}/pay`, body: { hazbaseReauth: true } },
+            { label: t(locale, "server.action.reject"), tone: "danger", url: `/api/items/approval/${encodeURIComponent(approval.token)}/decline`, body: {} },
           ]
         : [
             { label: t(locale, "server.action.approve"), tone: "primary", url: `/api/items/approval/${encodeURIComponent(approval.token)}/accept`, body: {} },
@@ -11756,7 +12099,35 @@ function buildHistoryDetail(item, locale, runtime = null) {
   };
 }
 
-function buildTimelineEntryImageUrls(entry) {
+function signTimelineEntryImageUrl(config, token, index, filePath) {
+  const secret = cleanText(config?.sessionSecret || "");
+  const normalizedToken = cleanText(token || "");
+  const normalizedPath = filePath ? path.resolve(String(filePath)) : "";
+  const normalizedIndex = Math.max(0, Number(index) || 0);
+  if (!secret || !normalizedToken || !normalizedPath) {
+    return "";
+  }
+  return crypto
+    .createHmac("sha256", secret)
+    .update(`${normalizedToken}\n${normalizedIndex}\n${normalizedPath}`)
+    .digest("base64url");
+}
+
+function isValidTimelineEntryImageSignature(config, url, token, index, filePath) {
+  const provided = cleanText(url?.searchParams?.get("imageToken") || "");
+  if (!provided) {
+    return false;
+  }
+  const expected = signTimelineEntryImageUrl(config, token, index, filePath);
+  if (!expected) {
+    return false;
+  }
+  const left = Buffer.from(provided, "utf8");
+  const right = Buffer.from(expected, "utf8");
+  return left.length === right.length && crypto.timingSafeEqual(left, right);
+}
+
+function buildTimelineEntryImageUrls(entry, config = null) {
   const imagePaths = normalizeTimelineImagePaths(entry?.imagePaths ?? []);
   if (imagePaths.length === 0) {
     return [];
@@ -11765,10 +12136,14 @@ function buildTimelineEntryImageUrls(entry) {
   if (!token) {
     return [];
   }
-  return imagePaths.map((_, index) => `/api/timeline/${encodeURIComponent(token)}/images/${index}`);
+  return imagePaths.map((filePath, index) => {
+    const imageToken = signTimelineEntryImageUrl(config, token, index, filePath);
+    const suffix = imageToken ? `?imageToken=${encodeURIComponent(imageToken)}` : "";
+    return `/api/timeline/${encodeURIComponent(token)}/images/${index}${suffix}`;
+  });
 }
 
-function buildTimelineMessageDetail(entry, locale, runtime = null) {
+function buildTimelineMessageDetail(entry, locale, runtime = null, config = null) {
   return {
     kind: entry.kind,
     token: entry.token,
@@ -11777,7 +12152,7 @@ function buildTimelineMessageDetail(entry, locale, runtime = null) {
     threadLabel: entry.threadLabel || "",
     createdAtMs: Number(entry.createdAtMs) || 0,
     messageHtml: renderMessageHtml(entry.messageText, `<p>${escapeHtml(t(locale, "detail.detailUnavailable"))}</p>`),
-    imageUrls: buildTimelineEntryImageUrls(entry),
+    imageUrls: buildTimelineEntryImageUrls(entry, config),
     fileRefs: normalizeTimelineFileRefs(entry.fileRefs ?? []),
     previousContext: buildInterruptedTimelineContext(runtime, entry, locale),
     interruptNotice: interruptedDetailNotice(entry.messageText, locale),
@@ -12269,6 +12644,18 @@ async function handleCompletionReply({
   );
   let lastError = null;
   const ownerClientId = runtime.threadOwnerClientIds.get(conversationId) ?? null;
+  const finalizeReplyAccepted = async () => {
+    if (timelineImageAliases.length > 0) {
+      const aliases = isPlainObject(state.timelineImagePathAliases)
+        ? state.timelineImagePathAliases
+        : (state.timelineImagePathAliases = {});
+      for (const [sourcePath, persistentPath] of timelineImageAliases) {
+        aliases[sourcePath] = persistentPath;
+      }
+      await saveState(config.stateFile, state);
+    }
+    scheduleBestEffortFileCleanup(stagedWorkspaceImagePaths);
+  };
 
   for (const candidate of turnCandidates) {
     try {
@@ -12291,18 +12678,19 @@ async function handleCompletionReply({
       console.log(
         `[completion-reply] success candidate=${candidate.name} transport=${cleanText(candidate.transport || "thread-follower")}`
       );
-      if (timelineImageAliases.length > 0) {
-        const aliases = isPlainObject(state.timelineImagePathAliases)
-          ? state.timelineImagePathAliases
-          : (state.timelineImagePathAliases = {});
-        for (const [sourcePath, persistentPath] of timelineImageAliases) {
-          aliases[sourcePath] = persistentPath;
-        }
-        await saveState(config.stateFile, state);
-      }
-      scheduleBestEffortFileCleanup(stagedWorkspaceImagePaths);
+      await finalizeReplyAccepted();
       return;
     } catch (error) {
+      if (isStartTurnAckTimeout(error)) {
+        // Codex can create the turn but fail to send the bridge an ACK before
+        // its internal follower timeout fires. Retrying risks duplicate user
+        // turns, so treat this as accepted and let the timeline catch up.
+        console.log(
+          `[completion-reply] accepted candidate=${candidate.name} transport=${cleanText(candidate.transport || "thread-follower")} ack-timeout=${normalizeIpcErrorMessage(error)}`
+        );
+        await finalizeReplyAccepted();
+        return;
+      }
       lastError = error;
       console.log(
         `[completion-reply] failed candidate=${candidate.name} transport=${cleanText(candidate.transport || "thread-follower")} error=${normalizeIpcErrorMessage(error)} raw=${inspect(error?.ipcError ?? error, { depth: 6, breakLength: 160 })}`
@@ -13082,7 +13470,7 @@ async function buildApiItemDetail({ config, runtime, state, kind, token, locale
   if (timelineMessageKinds.has(kind)) {
     const entry = timelineEntryByToken(runtime, token, kind);
     if (!entry) return null;
-    const detail = buildTimelineMessageDetail(entry, locale, runtime);
+    const detail = buildTimelineMessageDetail(entry, locale, runtime, config);
     // Add reply support for Codex assistant_final entries only (replaces completion reply).
     // Check directly against timeline entries (not history items) to avoid
     // maxHistoryItems eviction issues.
@@ -13283,8 +13671,11 @@ async function buildApiItemDetail({ config, runtime, state, kind, token, locale
   return historyItem ? buildHistoryDetail(historyItem, locale, runtime) : null;
 }
 
-function resolveTimelineEntryImagePath(runtime, token, index) {
-  const entry = timelineEntryByToken(runtime, token);
+function resolveTimelineEntryImagePath(runtime, state, token, index) {
+  const normalizedToken = cleanText(token || "");
+  const entry = timelineEntryByToken(runtime, normalizedToken)
+    || (state?.recentTimelineEntries ?? []).find((candidate) => cleanText(candidate?.token || "") === normalizedToken)
+    || null;
   if (!entry) {
     return "";
   }
@@ -13480,11 +13871,125 @@ function buildWebAppHtml({ pairToken }) {
     <link rel="apple-touch-icon" href="/icons/apple-touch-icon.png">
     <link rel="icon" type="image/png" sizes="192x192" href="/icons/viveworker-icon-192.png">
     <link rel="stylesheet" href="/app.css">
+    <style>
+      .boot-splash {
+        position: fixed;
+        inset: 0;
+        z-index: 9999;
+        display: grid;
+        place-items: center;
+        padding: max(1.2rem, env(safe-area-inset-top)) 1rem max(1.2rem, env(safe-area-inset-bottom));
+        color: #f5fbff;
+        background:
+          radial-gradient(circle at 50% 18%, rgba(47, 143, 103, 0.22), transparent 30%),
+          radial-gradient(circle at 78% 78%, rgba(79, 131, 216, 0.14), transparent 28%),
+          linear-gradient(180deg, #081015 0%, #091015 100%);
+        transition: opacity 220ms ease, visibility 220ms ease;
+      }
+      .boot-splash__card {
+        width: min(20rem, 82vw);
+        display: grid;
+        justify-items: center;
+        gap: 0.9rem;
+        text-align: center;
+      }
+      .boot-splash__logo {
+        width: clamp(5.4rem, 28vw, 7rem);
+        height: clamp(5.4rem, 28vw, 7rem);
+        border-radius: 28%;
+        background:
+          radial-gradient(circle at 76% 24%, rgba(125, 211, 252, 0.22), transparent 30%),
+          linear-gradient(180deg, rgba(23, 52, 72, 0.96), rgba(9, 17, 23, 0.96));
+        box-shadow: 0 24px 60px rgba(0, 0, 0, 0.32);
+      }
+      .boot-splash__title {
+        margin: 0.25rem 0 0;
+        font-family: "Avenir Next", "SF Pro Rounded", "SF Pro Text", "Helvetica Neue", sans-serif;
+        font-size: clamp(1.65rem, 8vw, 2.4rem);
+        line-height: 1;
+        letter-spacing: -0.04em;
+      }
+      .boot-splash__status {
+        margin: 0;
+        color: rgba(205, 220, 231, 0.72);
+        font-family: "Avenir Next", "SF Pro Rounded", "SF Pro Text", "Helvetica Neue", sans-serif;
+        font-size: 0.9rem;
+        letter-spacing: 0.02em;
+        min-height: 1.25em;
+        transition: opacity 160ms ease, transform 160ms ease;
+      }
+      .boot-splash__hint {
+        max-width: 15rem;
+        margin: -0.35rem 0 0;
+        color: rgba(178, 196, 210, 0.58);
+        font-family: "Avenir Next", "SF Pro Rounded", "SF Pro Text", "Helvetica Neue", sans-serif;
+        font-size: 0.78rem;
+        line-height: 1.45;
+        opacity: 0;
+        transform: translateY(-0.2rem);
+        transition: opacity 220ms ease, transform 220ms ease;
+      }
+      .boot-splash__hint.is-visible {
+        opacity: 1;
+        transform: translateY(0);
+      }
+      .boot-splash__dots {
+        display: inline-grid;
+        grid-auto-flow: column;
+        gap: 0.34rem;
+        margin-top: 0.15rem;
+      }
+      .boot-splash__dots span {
+        width: 0.42rem;
+        height: 0.42rem;
+        border-radius: 999px;
+        background: rgba(142, 215, 255, 0.88);
+        animation: viveworker-boot-dot 980ms ease-in-out infinite;
+      }
+      .boot-splash__dots span:nth-child(2) { animation-delay: 140ms; }
+      .boot-splash__dots span:nth-child(3) { animation-delay: 280ms; }
+      .viveworker-ready .boot-splash {
+        opacity: 0;
+        visibility: hidden;
+      }
+      @keyframes viveworker-boot-dot {
+        0%, 80%, 100% { transform: translateY(0); opacity: 0.42; }
+        40% { transform: translateY(-0.28rem); opacity: 1; }
+      }
+      @media (prefers-reduced-motion: reduce) {
+        .boot-splash,
+        .boot-splash__status,
+        .boot-splash__hint,
+        .boot-splash__dots span {
+          transition: none;
+          animation: none;
+        }
+      }
+    </style>
     <title>viveworker</title>
   </head>
   <body>
+    <div id="boot-splash" class="boot-splash" role="status" aria-live="polite" aria-label="viveworker is starting">
+      <div class="boot-splash__card">
+        <img class="boot-splash__logo" src="/icons/viveworker-v-pulse.svg" alt="" width="112" height="112" decoding="async">
+        <h1 class="boot-splash__title">viveworker</h1>
+        <p id="boot-splash-status" class="boot-splash__status">Checking your trusted Wi-Fi...</p>
+        <p id="boot-splash-hint" class="boot-splash__hint" hidden>The first remote connection can take tens of seconds.</p>
+        <span class="boot-splash__dots" aria-hidden="true"><span></span><span></span><span></span></span>
+      </div>
+    </div>
     <div id="app"></div>
-    <script type="module" src="/app.js"></script>
+    <script>
+      (() => {
+        const isJa = (navigator.language || "").toLowerCase().startsWith("ja");
+        const message = isJa ? "同じWi-Fi内のPCを確認中..." : "Checking your trusted Wi-Fi...";
+        const status = document.getElementById("boot-splash-status");
+        const splash = document.getElementById("boot-splash");
+        if (status) status.textContent = message;
+        if (splash) splash.setAttribute("aria-label", \`viveworker \${message}\`);
+      })();
+    </script>
+    <script type="module" src="${WEB_APP_SCRIPT_URL}"></script>
   </body>
 </html>`;
 }
@@ -13493,10 +13998,132 @@ function resolvePagePairingToken({ req, config, state, requestedToken }) {
   return resolveManifestPairingToken({ config, state, requestedToken });
 }
 
+function normalizeBootTraceEvent(event) {
+  if (!event || typeof event !== "object" || Array.isArray(event)) {
+    return null;
+  }
+  const normalized = {
+    tMs: Math.max(0, Math.min(600_000, Math.round(Number(event.tMs) || 0))),
+    type: cleanText(event.type || "").slice(0, 80),
+  };
+  if (!normalized.type) {
+    return null;
+  }
+  const phase = cleanText(event.phase || "").slice(0, 80);
+  const stateValue = cleanText(event.state || "").slice(0, 80);
+  const previousState = cleanText(event.previousState || "").slice(0, 80);
+  const reason = cleanText(event.reason || "").slice(0, 120);
+  const urlPath = cleanText(event.url || "").split("?")[0].slice(0, 120);
+  if (phase) normalized.phase = phase;
+  if (stateValue) normalized.state = stateValue;
+  if (previousState) normalized.previousState = previousState;
+  if (reason) normalized.reason = reason;
+  if (urlPath) normalized.url = urlPath;
+  if (event.sticky === true || event.sticky === false) normalized.sticky = event.sticky;
+  if (Number.isFinite(Number(event.code))) normalized.code = Math.round(Number(event.code));
+  if (event.resumed === true || event.resumed === false) normalized.resumed = event.resumed;
+  return normalized;
+}
+
+function formatBootTraceEvent(event) {
+  const parts = [`${event.tMs}ms`, event.type];
+  if (event.phase) parts.push(event.phase);
+  if (event.state) {
+    parts.push(event.previousState ? `${event.previousState}->${event.state}` : event.state);
+  }
+  if (event.url) parts.push(event.url);
+  if (event.reason) parts.push(`reason=${event.reason}`);
+  if (event.sticky === true) parts.push("sticky=1");
+  if (event.code) parts.push(`code=${event.code}`);
+  if (event.resumed === true || event.resumed === false) parts.push(`resumed=${event.resumed ? 1 : 0}`);
+  return parts.join(":");
+}
+
+function logRemotePairingBootTrace(body, session, req) {
+  const traceId = cleanText(body?.traceId || "").slice(0, 80) || "unknown";
+  const reason = cleanText(body?.reason || "").slice(0, 80) || "unknown";
+  const appBuildId = cleanText(body?.appBuildId || "").slice(0, 80) || "unknown";
+  const totalMs = Math.max(0, Math.min(600_000, Math.round(Number(body?.totalMs) || 0)));
+  const remoteRouteSeen = body?.remoteRouteSeen === true;
+  const eventList = Array.isArray(body?.events) ? body.events : [];
+  const events = eventList
+    .slice(-90)
+    .map(normalizeBootTraceEvent)
+    .filter(Boolean);
+  const phases = events
+    .filter((event) => event.type === "route" && event.phase)
+    .map((event) => `${event.tMs}:${event.phase}`)
+    .join(" > ");
+  const transport = events
+    .filter((event) => event.phase === "remote-transport-state" || event.phase === "remote-transport-error")
+    .map((event) => {
+      if (event.phase === "remote-transport-error") return `${event.tMs}:error(${event.reason || "unknown"})`;
+      return `${event.tMs}:${event.previousState || "?"}->${event.state || "?"}${event.reason ? `(${event.reason})` : ""}`;
+    })
+    .join(" > ");
+  const deviceId = cleanText(session?.deviceId || "").slice(0, 60) || "unknown";
+  const ua = requestUserAgent(req).slice(0, 90);
+
+  console.log(
+    `[remote-pairing-boot] trace=${traceId} device=${deviceId} reason=${reason} ` +
+    `total=${totalMs}ms remote=${remoteRouteSeen ? 1 : 0} build=${appBuildId} ` +
+    `events=${events.length} ua=${JSON.stringify(ua)}`
+  );
+  if (phases) {
+    console.log(`[remote-pairing-boot-phases] trace=${traceId} ${phases}`);
+  }
+  if (transport) {
+    console.log(`[remote-pairing-boot-transport] trace=${traceId} ${transport}`);
+  }
+  if (totalMs >= 5_000 || remoteRouteSeen) {
+    console.log(`[remote-pairing-boot-detail] trace=${traceId} ${events.map(formatBootTraceEvent).join(" | ")}`);
+  }
+}
+
+function recordRemotePairingAudit(event) {
+  appendRemotePairingAuditEvent({
+    atMs: Date.now(),
+    ...event,
+  }).catch((err) => {
+    console.warn(`[remote-pairing-audit] write failed: ${err?.message}`);
+  });
+}
+
+function remotePairingAuditFieldsForPairing(pairing) {
+  if (!pairing) return {};
+  return {
+    pairingId: redactShortId(pairing.pairingId),
+    phoneFingerprint: pairing.phoneFingerprint || "",
+    label: pairing.label || "",
+    deviceId: pairing.deviceId || "",
+  };
+}
+
+function redactShortId(value) {
+  const text = cleanText(value || "").slice(0, 80);
+  return text ? `${text.slice(0, 6)}…` : "";
+}
+
+function relayHostForAudit(value) {
+  try {
+    return new URL(value || DEFAULT_RELAY_URL).host;
+  } catch {
+    return "";
+  }
+}
+
+function shouldAutoRotateRemotePairingToken(pairing, now = Date.now()) {
+  if (!pairing) return false;
+  const updatedAt = Number(pairing.relayTokenUpdatedAtMs) || 0;
+  if (!updatedAt) return true;
+  return now - updatedAt >= REMOTE_PAIRING_RELAY_TOKEN_ROTATION_MS;
+}
+
 function createNativeApprovalServer({ config, runtime, state }) {
   const requestHandler = async (req, res) => {
     try {
       const url = new URL(req.url, config.nativeApprovalPublicBaseUrl);
+      refreshPairingConfigFromEnvFile(config);
 
       if (url.pathname === "/health") {
         return writeJson(res, 200, { ok: true });
@@ -13549,7 +14176,16 @@ function createNativeApprovalServer({ config, runtime, state }) {
         url.pathname === "/i18n.js" ||
         url.pathname === "/hazbase-passkey.js" ||
         url.pathname === "/sw.js" ||
-        url.pathname.startsWith("/icons/")
+        url.pathname.startsWith("/icons/") ||
+        // Remote-pairing PWA modules + their generated crypto bundle.
+        // The bundle is auto-built by scripts/build-remote-pairing-bundle.mjs
+        // and the per-module wrappers under web/remote-pairing/ import from it.
+        // resolveWebAsset() still enforces the webRoot containment check, so
+        // a wide-prefix allowlist here is safe against path traversal.
+        url.pathname.startsWith("/remote-pairing/") ||
+        url.pathname === "/remote-pairing.bundle.js" ||
+        url.pathname === "/remote-pairing.bundle.js.map" ||
+        url.pathname === "/remote-pairing.bundle.js.LEGAL.txt"
       ) {
         const served = await serveWebAsset(res, url.pathname, req);
         if (served) {
@@ -13725,9 +14361,10 @@ function createNativeApprovalServer({ config, runtime, state }) {
         }
         const sessionPayload = buildSessionPayload({ config, state, session });
         if (!session.authenticated) {
-          return writeJson(res, 200, { session: sessionPayload });
+          return writeJson(res, 200, { appBuildId: WEB_APP_BUILD_ID, session: sessionPayload });
         }
         return writeJson(res, 200, {
+          appBuildId: WEB_APP_BUILD_ID,
           session: sessionPayload,
           inbox: buildInboxFastResponse(runtime, state, config, localeInfo.locale),
           timeline: buildTimelineResponse(runtime, state, config, localeInfo.locale),
@@ -14454,17 +15091,523 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
         return writeJson(res, 200, { ok: true, acceptPublicTasks: accept });
       }
 
-      // ─── Thread sharing ──────────────────────────────────────────────
+      // ─── Remote pairing (off-LAN PWA relay) ──────────────────────────
 
-      function buildThreadShareContent(shareType, body) {
-        if (shareType === "plan_review") {
-          const sections = [];
-          if (body.context) sections.push(`## Context\n${body.context}`);
-          if (body.plan) sections.push(`## Plan\n${body.plan}`);
-          if (Array.isArray(body.files) && body.files.length) {
-            sections.push(`## Relevant files\n${body.files.map((f) => `- ${f}`).join("\n")}`);
-          }
-          sections.push(`## Instruction\n${body.instruction || "共有されたプランの内容を把握し、実現可能性や改善点を検討してください。"}`);
+      // GET /api/remote-pairing/status — settings UI bootstrap.
+      //
+      // Returns the current orchestrator state plus the (read-only) list of
+      // pairings on disk. Sessions only exist when `enabled: true`; when the
+      // relay is off we still surface the pairings so the user can revoke
+      // before re-enabling.
+      if (url.pathname === "/api/remote-pairing/status" && req.method === "GET") {
+        const session = requireApiSession(req, res, config, state);
+        if (!session) return;
+        const status = getRemotePairingStatus(runtime);
+        let pairings = [];
+        let auditEvents = [];
+        try {
+          const list = await loadPairings();
+          pairings = list.map((p) => ({
+            pairingId: p.pairingId,
+            label: p.label || "",
+            phonePub: p.phonePub,
+            phoneFingerprint: p.phoneFingerprint,
+            deviceId: p.deviceId || null,
+            addedAtMs: p.addedAtMs ?? null,
+            relayTokenUpdatedAtMs: p.relayTokenUpdatedAtMs ?? null,
+            lastSeenAtMs: p.lastSeenAtMs ?? null,
+          }));
+        } catch (err) {
+          console.warn(`[remote-pairing] status: failed to load pairings: ${err?.message}`);
+        }
+        try {
+          auditEvents = await readRemotePairingAuditEvents({ limit: 12 });
+        } catch (err) {
+          console.warn(`[remote-pairing] status: failed to load audit log: ${err?.message}`);
+        }
+        return writeJson(res, 200, {
+          enabled: status.enabled,
+          relayUrl: status.relayUrl,
+          configuredRelayUrl: config.remotePairingRelayUrl || "",
+          identityFingerprint: status.identityFingerprint,
+          identityPubHex: status.identityPubHex,
+          sessions: status.sessions,
+          pairings,
+          auditEvents,
+          pairingsFile: REMOTE_PAIRINGS_FILE,
+        });
+      }
+
+      // POST /api/remote-pairing/boot-trace — PWA cold-start timing.
+      //
+      // This is intentionally diagnostics-only: it does not mutate state and
+      // only logs a sanitized, capped phase timeline so off-LAN boot latency
+      // can be debugged without attaching Safari Web Inspector to the phone.
+      if (url.pathname === "/api/remote-pairing/boot-trace" && req.method === "POST") {
+        const session = requireApiSession(req, res, config, state);
+        if (!session) return;
+        let body;
+        try {
+          body = await parseJsonBody(req);
+        } catch (err) {
+          return writeJson(res, 400, { error: "invalid-json-body", message: err.message });
+        }
+        try {
+          logRemotePairingBootTrace(body, session, req);
+        } catch (err) {
+          console.warn(`[remote-pairing-boot] failed to log trace: ${err?.message}`);
+        }
+        return writeJson(res, 200, { ok: true });
+      }
+
+      // POST /api/remote-pairing/toggle — flip on/off without restart.
+      //
+      // Body: { enabled: boolean }
+      // Persists to ~/.viveworker/remote-pairing.env (so the next bridge
+      // launch starts in the new state) and hot-restarts the orchestrator.
+      // The same approval server's request handler is reused, so cookies /
+      // session auth behave identically over LAN HTTP and the relay.
+      if (url.pathname === "/api/remote-pairing/toggle" && req.method === "POST") {
+        const session = requireMutatingApiSession(req, res, config, state);
+        if (!session) return;
+        let body;
+        try {
+          body = await parseJsonBody(req);
+        } catch (err) {
+          return writeJson(res, 400, { error: "invalid-json-body", message: err.message });
+        }
+        if (typeof body?.enabled !== "boolean") {
+          return writeJson(res, 400, { error: "enabled-required", message: "body.enabled must be a boolean" });
+        }
+        if (typeof requestHandler !== "function") {
+          return writeJson(res, 503, { error: "request-handler-unavailable" });
+        }
+        const next = body.enabled;
+        config.remotePairingEnabled = next;
+        recordRemotePairingAudit({
+          type: next ? "relay_enabled" : "relay_disabled",
+          outcome: "info",
+          deviceId: session.deviceId || "",
+          relayHost: relayHostForAudit(config.remotePairingRelayUrl || DEFAULT_RELAY_URL),
+        });
+        try {
+          await persistRemotePairingEnv({ enabled: next });
+        } catch (err) {
+          // Persistence failure shouldn't roll back the in-memory config —
+          // the user can retry from the UI and the runtime is still in the
+          // intended state. Surface the error clearly.
+          console.error(`[remote-pairing] env persist failed: ${err?.message}`);
+        }
+        try {
+          await restartRemotePairingRelay({
+            runtime,
+            config,
+            requestListener: requestHandler,
+            logger: console,
+            auditEventSink: recordRemotePairingAudit,
+          });
+        } catch (err) {
+          console.error(`[remote-pairing] hot-restart failed: ${err?.message}`);
+          return writeJson(res, 500, { error: "restart-failed", message: err.message });
+        }
+        const status = getRemotePairingStatus(runtime);
+        return writeJson(res, 200, {
+          ok: true,
+          enabled: status.enabled,
+          relayUrl: status.relayUrl,
+          identityFingerprint: status.identityFingerprint,
+          sessions: status.sessions,
+        });
+      }
+
+      // POST /api/remote-pairing/relay-url — change the relay endpoint.
+      //
+      // Body: { relayUrl: string | null }
+      //   - empty string / null  → falls back to DEFAULT_RELAY_URL
+      //   - non-empty string     → must be wss://, except ws:// loopback for local dev
+      // Persists + hot-restarts (only restarts if currently enabled, since
+      // a dormant handle has nothing to reconnect).
+      if (url.pathname === "/api/remote-pairing/relay-url" && req.method === "POST") {
+        const session = requireMutatingApiSession(req, res, config, state);
+        if (!session) return;
+        let body;
+        try {
+          body = await parseJsonBody(req);
+        } catch (err) {
+          return writeJson(res, 400, { error: "invalid-json-body", message: err.message });
+        }
+        const raw = body?.relayUrl;
+        const relayUrlResult = normalizeRemotePairingRelayUrl(raw ?? "");
+        if (!relayUrlResult.ok) {
+          return writeJson(res, 400, {
+            error: "invalid-relay-url",
+            message: relayUrlResult.message,
+          });
+        }
+        const normalized = relayUrlResult.value;
+        config.remotePairingRelayUrl = normalized;
+        recordRemotePairingAudit({
+          type: "relay_url_changed",
+          outcome: "info",
+          deviceId: session.deviceId || "",
+          relayHost: relayHostForAudit(normalized || DEFAULT_RELAY_URL),
+        });
+        try {
+          await persistRemotePairingEnv({ relayUrl: normalized || null });
+        } catch (err) {
+          console.error(`[remote-pairing] env persist failed: ${err?.message}`);
+        }
+        if (config.remotePairingEnabled && typeof requestHandler === "function") {
+          try {
+            await restartRemotePairingRelay({
+              runtime,
+              config,
+              requestListener: requestHandler,
+              logger: console,
+              auditEventSink: recordRemotePairingAudit,
+            });
+          } catch (err) {
+            console.error(`[remote-pairing] hot-restart failed: ${err?.message}`);
+            return writeJson(res, 500, { error: "restart-failed", message: err.message });
+          }
+        }
+        const status = getRemotePairingStatus(runtime);
+        return writeJson(res, 200, {
+          ok: true,
+          enabled: status.enabled,
+          relayUrl: status.relayUrl,
+          configuredRelayUrl: config.remotePairingRelayUrl || "",
+        });
+      }
+
+      // POST /api/remote-pairing/revoke — drop a pairing by phonePub.
+      //
+      // Body: { phonePub: string }  (64-char hex, the phone's static X25519 pub)
+      // Removes the entry from `~/.viveworker/remote-pairings.json` and
+      // calls reloadNow() so the orchestrator tears the live session down.
+      // No-op if the pub isn't on file (idempotent).
+      if (url.pathname === "/api/remote-pairing/revoke" && req.method === "POST") {
+        const session = requireMutatingApiSession(req, res, config, state);
+        if (!session) return;
+        let body;
+        try {
+          body = await parseJsonBody(req);
+        } catch (err) {
+          return writeJson(res, 400, { error: "invalid-json-body", message: err.message });
+        }
+        const phonePub = typeof body?.phonePub === "string" ? body.phonePub.trim().toLowerCase() : "";
+        if (!/^[0-9a-f]{64}$/u.test(phonePub)) {
+          return writeJson(res, 400, {
+            error: "invalid-phone-pub",
+            message: "phonePub must be a 64-char hex string",
+          });
+        }
+        let beforeLen = 0;
+        let afterLen = 0;
+        let removedPairing = null;
+        try {
+          const before = await loadPairings();
+          beforeLen = before.length;
+          removedPairing = before.find((p) => p.phonePub === phonePub) || null;
+          const after = await removePairingPersisted(phonePub);
+          afterLen = after.length;
+        } catch (err) {
+          return writeJson(res, 500, { error: "revoke-failed", message: err.message });
+        }
+        const removed = beforeLen !== afterLen;
+        if (removed && runtime.remotePairingHandle) {
+          try {
+            await runtime.remotePairingHandle.reloadNow();
+          } catch (err) {
+            console.warn(`[remote-pairing] reloadNow after revoke failed: ${err?.message}`);
+          }
+        }
+        if (removed) {
+          recordRemotePairingAudit({
+            type: "pairing_revoked",
+            outcome: "info",
+            deviceId: session.deviceId || "",
+            ...remotePairingAuditFieldsForPairing(removedPairing),
+          });
+        }
+        return writeJson(res, 200, { ok: true, removed, remaining: afterLen });
+      }
+
+      // POST /api/remote-pairing/rotate-token — rotate the relay capability
+      // for the current LAN-reachable paired phone. This endpoint is also
+      // denied inside the relay dispatcher, so an off-LAN phone cannot rotate
+      // itself into a split-brain state where the bridge updated but the PWA
+      // failed to persist the new token.
+      if (url.pathname === "/api/remote-pairing/rotate-token" && req.method === "POST") {
+        const session = requireMutatingApiSession(req, res, config, state);
+        if (!session) return;
+        let body;
+        try {
+          body = await parseJsonBody(req);
+        } catch (err) {
+          return writeJson(res, 400, { error: "invalid-json-body", message: err.message });
+        }
+        const phonePub = typeof body?.phonePub === "string" ? body.phonePub.trim().toLowerCase() : "";
+        if (!/^[0-9a-f]{64}$/u.test(phonePub)) {
+          return writeJson(res, 400, {
+            error: "invalid-phone-pub",
+            message: "phonePub must be a 64-char hex string",
+          });
+        }
+
+        let current = [];
+        try {
+          current = await loadPairings();
+        } catch (err) {
+          return writeJson(res, 500, { error: "load-pairings-failed", message: err.message });
+        }
+        const existing = current.find((p) => p.phonePub === phonePub) || null;
+        if (!existing) {
+          return writeJson(res, 404, { error: "pairing-not-found" });
+        }
+        if (existing.deviceId && session.deviceId && existing.deviceId !== session.deviceId) {
+          recordRemotePairingAudit({
+            type: "token_rotate_denied",
+            outcome: "failure",
+            deviceId: session.deviceId || "",
+            reason: "device mismatch",
+            ...remotePairingAuditFieldsForPairing(existing),
+          });
+          return writeJson(res, 403, { error: "device-mismatch" });
+        }
+
+        let rotated;
+        try {
+          ({ rotated } = await rotateRelayTokenPersisted(phonePub));
+        } catch (err) {
+          recordRemotePairingAudit({
+            type: "token_rotate_failed",
+            outcome: "failure",
+            deviceId: session.deviceId || "",
+            reason: err.message,
+            ...remotePairingAuditFieldsForPairing(existing),
+          });
+          return writeJson(res, 500, { error: "rotate-token-failed", message: err.message });
+        }
+        if (!rotated) {
+          return writeJson(res, 404, { error: "pairing-not-found" });
+        }
+
+        if (runtime.remotePairingHandle) {
+          try {
+            await runtime.remotePairingHandle.reloadNow();
+          } catch (err) {
+            console.warn(`[remote-pairing] reloadNow after token rotation failed: ${err?.message}`);
+          }
+        }
+
+        let bridgeKeypair;
+        try {
+          bridgeKeypair = await ensureIdentityKeypair();
+        } catch (err) {
+          return writeJson(res, 500, {
+            error: "bridge-keypair-failed",
+            message: err.message,
+          });
+        }
+        const relayUrl = (config.remotePairingRelayUrl || "").trim() || DEFAULT_RELAY_URL;
+        recordRemotePairingAudit({
+          type: "token_rotated",
+          outcome: "success",
+          deviceId: session.deviceId || "",
+          relayHost: relayHostForAudit(relayUrl),
+          ...remotePairingAuditFieldsForPairing(rotated),
+        });
+
+        return writeJson(res, 200, {
+          ok: true,
+          pairingId: rotated.pairingId,
+          relayToken: rotated.relayToken,
+          phonePub: rotated.phonePub,
+          phoneFingerprint: rotated.phoneFingerprint,
+          deviceId: rotated.deviceId || null,
+          bridgePubHex: bytesToHex(bridgeKeypair.pub),
+          bridgeFingerprint: fingerprintIdentity(bridgeKeypair.pub),
+          relayUrl,
+          label: rotated.label,
+          addedAtMs: rotated.addedAtMs,
+          relayTokenUpdatedAtMs: rotated.relayTokenUpdatedAtMs ?? null,
+        });
+      }
+
+      // POST /api/remote-pairing/lan-enroll — finalize a LAN pairing by
+      // exchanging X25519 static pubkeys so the same phone can later reach
+      // the bridge via the relay (when off-LAN).
+      //
+      // Body: { phonePubHex: string (64-hex), label?: string (≤200 chars) }
+      // Returns: { ok, pairingId, relayToken, phonePub, phoneFingerprint, bridgePubHex,
+      //            bridgeFingerprint, relayUrl, label, addedAtMs }
+      //
+      // Side effects:
+      //   - Adds (or refreshes) the phone in ~/.viveworker/remote-pairings.json.
+      //     Idempotent on phonePub: re-pairing the same device keeps the
+      //     existing pairingId so the relay slot doesn't churn (any in-flight
+      //     remote session for that phone stays valid).
+      //   - Triggers runtime.remotePairingHandle.reloadNow() so the
+      //     orchestrator spawns a session for the new phone immediately
+      //     when the relay is currently on. Safe no-op when the relay is off
+      //     — the next toggle-on will pick up the new entry from disk.
+      //   - Calls ensureIdentityKeypair(), which generates the bridge's
+      //     static keypair on first run. After this endpoint succeeds the
+      //     bridge always has a stable identity.
+      //
+      // Auth: requires an authenticated session. The natural caller is the
+      // LAN-paired phone right after /api/session/pair succeeds — the
+      // session cookie set by that endpoint is what gates this one.
+      if (url.pathname === "/api/remote-pairing/lan-enroll" && req.method === "POST") {
+        const session = requireMutatingApiSession(req, res, config, state);
+        if (!session) return;
+        let body;
+        try {
+          body = await parseJsonBody(req);
+        } catch (err) {
+          return writeJson(res, 400, { error: "invalid-json-body", message: err.message });
+        }
+        const phonePubHex = typeof body?.phonePubHex === "string"
+          ? body.phonePubHex.trim().toLowerCase()
+          : "";
+        if (!/^[0-9a-f]{64}$/u.test(phonePubHex)) {
+          return writeJson(res, 400, {
+            error: "invalid-phone-pub",
+            message: "phonePubHex must be a 64-char hex string",
+          });
+        }
+        // Cap label at 200 chars — the persisted JSON has no hard limit but
+        // long strings make the settings UI ugly and there's no legitimate
+        // reason for a device label to exceed this.
+        const label = typeof body?.label === "string"
+          ? body.label.trim().slice(0, 200)
+          : "";
+
+        // Idempotent re-enroll: if the same phone re-pairs (e.g. user
+        // cleared site data on the phone, regenerated the keypair, then
+        // happened to land on the same hex — vanishingly unlikely; far more
+        // commonly: same keypair, fresh label), keep the original pairingId.
+        let existingPairings = [];
+        try {
+          existingPairings = await loadPairings();
+        } catch (err) {
+          return writeJson(res, 500, {
+            error: "load-pairings-failed",
+            message: err.message,
+          });
+        }
+        const existing = existingPairings.find((p) => p.phonePub === phonePubHex);
+        const pairingId = existing?.pairingId || crypto.randomUUID();
+        const autoRotateToken = shouldAutoRotateRemotePairingToken(existing);
+        const relayToken = autoRotateToken ? undefined : existing?.relayToken || undefined;
+        const relayTokenUpdatedAtMs = autoRotateToken ? Date.now() : existing?.relayTokenUpdatedAtMs;
+
+        // Bridge identity — generates on first call. We can't lean on
+        // runtime.remotePairingHandle here because the relay may be OFF
+        // (in which case the handle is dormant and identityKeypair is
+        // null), but enrollment still has to expose a stable bridge pub
+        // so the phone can store it.
+        let bridgeKeypair;
+        try {
+          bridgeKeypair = await ensureIdentityKeypair();
+        } catch (err) {
+          return writeJson(res, 500, {
+            error: "bridge-keypair-failed",
+            message: err.message,
+          });
+        }
+
+        let entry;
+        try {
+          entry = buildPairing({
+            pairingId,
+            relayToken,
+            relayTokenUpdatedAtMs,
+            phonePub: phonePubHex,
+            label,
+            deviceId: session.deviceId,
+          });
+        } catch (err) {
+          return writeJson(res, 400, {
+            error: "build-pairing-failed",
+            message: err.message,
+          });
+        }
+
+        try {
+          await addPairingPersisted(entry);
+        } catch (err) {
+          return writeJson(res, 500, {
+            error: "save-pairings-failed",
+            message: err.message,
+          });
+        }
+
+        // Kick the orchestrator if it's running so the new pairing's
+        // session spawns without waiting for the fs.watch debounce. When
+        // the relay is off this is a no-op (dormant handle's reloadNow is
+        // safe to call).
+        if (runtime.remotePairingHandle) {
+          try {
+            await runtime.remotePairingHandle.reloadNow();
+          } catch (err) {
+            console.warn(`[remote-pairing] reloadNow after lan-enroll failed: ${err?.message}`);
+          }
+        }
+        recordRemotePairingAudit({
+          type: existing ? "pairing_refreshed" : "pairing_enrolled",
+          outcome: "success",
+          deviceId: session.deviceId || "",
+          relayHost: relayHostForAudit(config.remotePairingRelayUrl || DEFAULT_RELAY_URL),
+          ...remotePairingAuditFieldsForPairing(entry),
+        });
+        if (existing && autoRotateToken) {
+          recordRemotePairingAudit({
+            type: "token_auto_rotated",
+            outcome: "success",
+            deviceId: session.deviceId || "",
+            relayHost: relayHostForAudit(config.remotePairingRelayUrl || DEFAULT_RELAY_URL),
+            reason: existing.relayTokenUpdatedAtMs ? "scheduled LAN refresh" : "legacy token metadata",
+            ...remotePairingAuditFieldsForPairing(entry),
+          });
+        }
+
+        const bridgePubHex = bytesToHex(bridgeKeypair.pub);
+        const bridgeFingerprint = fingerprintIdentity(bridgeKeypair.pub);
+        // Relay URL: explicit config value > orchestrator default. We
+        // surface the resolved URL (not the configured one) so the phone
+        // doesn't have to know about the fallback chain.
+        const relayUrl = (config.remotePairingRelayUrl || "").trim() || DEFAULT_RELAY_URL;
+
+        return writeJson(res, 200, {
+          ok: true,
+          pairingId: entry.pairingId,
+          relayToken: entry.relayToken,
+          phonePub: entry.phonePub,
+          phoneFingerprint: entry.phoneFingerprint,
+          deviceId: entry.deviceId || null,
+          bridgePubHex,
+          bridgeFingerprint,
+          relayUrl,
+          label: entry.label,
+          addedAtMs: entry.addedAtMs,
+          relayTokenUpdatedAtMs: entry.relayTokenUpdatedAtMs ?? null,
+          relayTokenRotated: existing ? autoRotateToken : false,
+        });
+      }
+
+      // ─── Thread sharing ──────────────────────────────────────────────
+
+      function buildThreadShareContent(shareType, body) {
+        if (shareType === "plan_review") {
+          const sections = [];
+          if (body.context) sections.push(`## Context\n${body.context}`);
+          if (body.plan) sections.push(`## Plan\n${body.plan}`);
+          if (Array.isArray(body.files) && body.files.length) {
+            sections.push(`## Relevant files\n${body.files.map((f) => `- ${f}`).join("\n")}`);
+          }
+          sections.push(`## Instruction\n${body.instruction || "共有されたプランの内容を把握し、実現可能性や改善点を検討してください。"}`);
           return sections.join("\n\n");
         }
         if (shareType === "handoff") {
@@ -15028,9 +16171,13 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
           const result = await completeHazbaseWalletPaymentApproval({ config, runtime, state, approval });
           return writeJson(res, 200, result);
         } catch (error) {
-          approval.resolving = false;
+          const failure = await finalizeHazbaseWalletPaymentFailure({ config, runtime, state, approval, error });
           console.error(`[hazbase-wallet-payment-error] ${approval.requestKey} | ${error?.stack || error?.message || error}`);
-          return writeJson(res, Number(error?.statusCode) || 500, { error: error?.code || error?.message || "hazbase-wallet-payment-failed" });
+          return writeJson(res, Number(error?.statusCode) || 500, {
+            error: failure.error,
+            approvalFinalized: true,
+            retryable: true,
+          });
         }
       }
 
@@ -15799,18 +16946,20 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
 
       const apiTimelineImageMatch = url.pathname.match(/^\/api\/timeline\/([^/]+)\/images\/(\d+)$/u);
       if (apiTimelineImageMatch && req.method === "GET") {
-        const session = requireApiSession(req, res, config, state);
-        if (!session) {
-          return;
-        }
         const token = decodeURIComponent(apiTimelineImageMatch[1]);
         const index = Number(apiTimelineImageMatch[2]) || 0;
-        const filePath = resolveTimelineEntryImagePath(runtime, token, index);
+        const filePath = resolveTimelineEntryImagePath(runtime, state, token, index);
         if (!filePath) {
           res.statusCode = 404;
           res.end("not-found");
           return;
         }
+        if (!isValidTimelineEntryImageSignature(config, url, token, index, filePath)) {
+          const session = requireApiSession(req, res, config, state);
+          if (!session) {
+            return;
+          }
+        }
         try {
           const body = await fs.readFile(filePath);
           res.statusCode = 200;
@@ -15922,7 +17071,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
         if (approval.resolved || approval.resolving) {
           return writeJson(res, 409, { error: "approval-already-handled" });
         }
-        if (approval.kind === "hazbase_wallet_payment") {
+        if (approval.kind === "hazbase_wallet_payment" && decision !== "decline") {
           console.warn(`[hazbase-wallet-payment-generic-decision-blocked] ${approval.requestKey} | ${decision}`);
           return writeJson(res, 409, { error: "hazbase-wallet-payment-requires-wallet-pay-route" });
         }
@@ -15936,6 +17085,10 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
           return writeJson(res, 200, { ok: true, decision });
         } catch (error) {
           approval.resolving = false;
+          if (res.headersSent || res.writableEnded) {
+            console.error(`[approval-decision-post-write-error] ${approval.requestKey} | ${error.message}`);
+            return;
+          }
           return writeJson(res, 500, { error: error.message });
         }
       }
@@ -16520,7 +17673,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
       if (approval.resolved || approval.resolving) {
         return writeApprovalHandled(res, req, approval.title, 409, config.defaultLocale);
       }
-      if (approval.kind === "hazbase_wallet_payment") {
+      if (approval.kind === "hazbase_wallet_payment" && decision !== "decline") {
         console.warn(`[hazbase-wallet-payment-native-decision-blocked] ${approval.requestKey} | ${decision}`);
         if (requestWantsHtml(req)) {
           return writeHtml(
@@ -16559,6 +17712,10 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
         });
       } catch (error) {
         approval.resolving = false;
+        if (res.headersSent || res.writableEnded) {
+          console.error(`[native-approval-decision-post-write-error] ${approval.requestKey} | ${error.message}`);
+          return;
+        }
         if (requestWantsHtml(req)) {
           return writeHtml(
             res,
@@ -16573,6 +17730,9 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
         return writeJson(res, 500, { error: error.message });
       }
     } catch (error) {
+      if (res.headersSent || res.writableEnded) {
+        return;
+      }
       if (requestWantsHtml(req)) {
         return writeHtml(
           res,
@@ -16588,14 +17748,22 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
     }
   };
 
+  let server;
   if (config.webPushEnabled) {
-    return createHttpsServer({
+    server = createHttpsServer({
       cert: readFileSync(config.tlsCertFile, "utf8"),
       key: readFileSync(config.tlsKeyFile, "utf8"),
     }, requestHandler);
+  } else {
+    server = createHttpServer(requestHandler);
   }
-
-  return createHttpServer(requestHandler);
+  // Expose the handler on the server so the remote-pairing relay client can
+  // reuse it: RPC frames arriving over the encrypted relay channel get
+  // wrapped in synthetic req/res objects and dispatched through the SAME
+  // listener LAN HTTP requests use, so authn/authz/cookies/CSRF behave
+  // identically off-LAN.
+  server.requestHandler = requestHandler;
+  return server;
 }
 
 function requestWantsHtml(req) {
@@ -17899,6 +19067,7 @@ function buildConfig(cli) {
   const codexHome = resolvePath(process.env.CODEX_HOME || path.join(os.homedir(), ".codex"));
   const stateFile = resolvePath(process.env.STATE_FILE || path.join(workspaceRoot, ".viveworker-state.json"));
   return {
+    envFile: resolveEnvFile(cli.envFile),
     dryRun: cli.dryRun || truthy(process.env.DRY_RUN),
     once: cli.once,
     codexHome,
@@ -17913,6 +19082,12 @@ function buildConfig(cli) {
     a2aRelayUserId: cleanText(process.env.A2A_RELAY_USER_ID || ""),
     a2aRelaySecret: cleanText(process.env.A2A_RELAY_SECRET || ""),
     a2aRelayRegisterSecret: cleanText(process.env.A2A_RELAY_REGISTER_SECRET || ""),
+    // Remote-pairing relay (PWA off-LAN). Off by default — bridges that
+    // never leave the trusted LAN don't need to open an outbound connection
+    // to the relay. Toggle with REMOTE_PAIRING_ENABLED=true in
+    // ~/.viveworker/remote-pairing.env (or any source loadEnvFile reads).
+    remotePairingEnabled: boolEnv("REMOTE_PAIRING_ENABLED", false),
+    remotePairingRelayUrl: remotePairingRelayUrlFromEnv(),
     // share.viveworker.com — HTML hosting backed by the same A2A credentials.
     // Override for staging / self-hosted deployments via VIVEWORKER_SHARE_URL.
     a2aShareUrl: stripTrailingSlash(
@@ -17969,6 +19144,12 @@ function buildConfig(cli) {
     maxCodeEvents: numberEnv("MAX_CODE_EVENTS", 1000),
     maxTimelineThreads: numberEnv("MAX_TIMELINE_THREADS", 20),
     maxReadBytes: numberEnv("MAX_READ_BYTES", 2 * 1024 * 1024),
+    // Cap how far back the bridge looks for Claude transcripts. Default 7 days
+    // covers a long pause without dragging the long tail of dead sessions
+    // (which can easily reach thousands of files) into the per-iteration
+    // stat loop. Set to 0 to disable filtering and scan everything (the
+    // legacy behavior).
+    claudeTranscriptMaxAgeMs: numberEnv("CLAUDE_TRANSCRIPT_MAX_AGE_DAYS", 7) * 24 * 60 * 60 * 1000,
     maxMessageChars: numberEnv("MAX_MESSAGE_CHARS", 320),
     maxCommandChars: numberEnv("MAX_COMMAND_CHARS", 220),
     maxJustificationChars: numberEnv("MAX_JUSTIFICATION_CHARS", 220),
@@ -18012,18 +19193,31 @@ function buildConfig(cli) {
 }
 
 
+function inferHazbaseDeviceBindingIdFromAccounts(accounts) {
+  const list = Array.isArray(accounts) ? accounts : [];
+  for (const entry of list) {
+    const deviceBindingId = cleanText(
+      entry?.primaryDeviceBindingId || entry?.deviceBindingId || entry?.ownerDeviceBindingId || ""
+    );
+    if (deviceBindingId) return deviceBindingId;
+  }
+  return "";
+}
+
 function normalizeHazbaseState(raw) {
   const value = raw && typeof raw === "object" ? raw : {};
+  const accounts = Array.isArray(value.accounts) ? value.accounts : [];
+  const deviceBindingId = cleanText(value.deviceBindingId ?? "") || inferHazbaseDeviceBindingIdFromAccounts(accounts);
   return {
     email: cleanText(value.email ?? ""),
     accessToken: cleanText(value.accessToken ?? ""),
     sessionId: cleanText(value.sessionId ?? ""),
     userId: cleanText(value.userId ?? ""),
-    deviceBindingId: cleanText(value.deviceBindingId ?? ""),
+    deviceBindingId,
     credentialId: cleanText(value.credentialId ?? ""),
     highTrustToken: cleanText(value.highTrustToken ?? ""),
     highTrustExpiresAt: cleanText(value.highTrustExpiresAt ?? ""),
-    accounts: Array.isArray(value.accounts) ? value.accounts : [],
+    accounts,
     sessionInvalid: value.sessionInvalid === true,
     sessionInvalidReason: cleanText(value.sessionInvalidReason ?? ""),
     sessionInvalidAt: cleanText(value.sessionInvalidAt ?? ""),
@@ -18032,19 +19226,30 @@ function normalizeHazbaseState(raw) {
 
 function isHazbaseInvalidAppSessionError(error) {
   const details = error?.details && typeof error.details === "object" ? error.details : {};
-  const statusCode = Number(error?.statusCode || error?.status || details.statusCode || 0);
-  const text = [
+  const rawText = [
     error?.code,
     error?.message,
     details.errorCode,
     details.code,
     details.error,
     details.message,
+    typeof error?.details === "string" ? error.details : "",
+  ]
+    .map((entry) => cleanText(entry || ""))
+    .filter(Boolean)
+    .join(" ");
+  const statusCode = Number(error?.statusCode || error?.status || details.statusCode || 0) ||
+    (/statusCode["']?\s*[:=]\s*401/u.test(rawText) || /\b401\b/u.test(rawText) ? 401 : 0);
+  const text = [
+    rawText,
   ]
     .map((entry) => cleanText(entry || "").toLowerCase())
     .filter(Boolean)
     .join(" ");
-  return statusCode === 401 && text.includes("invalid app session");
+  return statusCode === 401 && (
+    text.includes("invalid app session") ||
+    text.includes("invalid_app_session")
+  );
 }
 
 function markHazbaseSessionInvalid(state, reason = "invalid_app_session") {
@@ -18274,6 +19479,51 @@ function resolveHazbaseAccountForChain(accounts, chainId) {
 }
 
 
+async function finalizeHazbaseWalletPaymentFailure({ config, runtime, state, approval, error }) {
+  const errorCode = cleanText(error?.code || error?.message || "hazbase-wallet-payment-failed") || "hazbase-wallet-payment-failed";
+  if (approval.resolved) {
+    return { paid: false, decision: "failed", error: errorCode };
+  }
+
+  const payload = {
+    paid: false,
+    decision: "failed",
+    error: errorCode,
+    paymentRequestId: approval.paymentRequestId || approval.requestId || "",
+  };
+
+  approval.resolved = true;
+  approval.resolving = false;
+  runtime.nativeApprovalsByToken.delete(approval.token);
+  runtime.nativeApprovalsByRequestKey.delete(approval.requestKey);
+  approval.resolveClaudeWaiter?.(payload);
+
+  const statusMessage = t(config.defaultLocale, "server.message.paymentFailed", { reason: errorCode });
+  const stateChanged = recordActionHistoryItem({
+    config,
+    runtime,
+    state,
+    kind: "approval",
+    stableId: `approval:${approval.requestKey}:${Date.now()}`,
+    token: approval.token,
+    title: approval.title,
+    threadLabel: approval.threadLabel || "",
+    messageText: `${statusMessage}\n\n${approval.messageText}`,
+    summary: statusMessage,
+    fileRefs: [],
+    diffText: "",
+    diffSource: "",
+    diffAvailable: false,
+    diffAddedLines: 0,
+    diffRemovedLines: 0,
+    outcome: "failed",
+    provider: approval.provider || "viveworker",
+  });
+  if (stateChanged) await saveState(config.stateFile, state);
+  console.log(`[hazbase-wallet-payment-failed] ${approval.requestKey} | ${errorCode}`);
+  return payload;
+}
+
 async function completeHazbaseWalletPaymentApproval({ config, runtime, state, approval }) {
   const hazbase = normalizeHazbaseState(state.hazbase);
   if (!hazbase.accessToken) throw codedError("hazbase-auth-required", 401);
@@ -18476,32 +19726,70 @@ function resolveEnvFile(explicitPath) {
   return path.join(workspaceRoot, "viveworker.env");
 }
 
-function loadEnvFile(filePath) {
-  try {
-    const text = readFileSync(filePath, "utf8");
-    for (const rawLine of text.split(/\r?\n/u)) {
-      const line = rawLine.trim();
-      if (!line || line.startsWith("#")) {
-        continue;
-      }
+function parseEnvText(text) {
+  const output = {};
+  for (const rawLine of String(text || "").split(/\r?\n/u)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
 
-      const separator = line.indexOf("=");
-      if (separator === -1) {
-        continue;
-      }
+    const separator = line.indexOf("=");
+    if (separator === -1) {
+      continue;
+    }
 
-      const key = line.slice(0, separator).trim();
-      let value = line.slice(separator + 1).trim();
-      if ((value.startsWith("\"") && value.endsWith("\"")) || (value.startsWith("'") && value.endsWith("'"))) {
-        value = value.slice(1, -1);
-      }
-      process.env[key] = value;
+    const key = line.slice(0, separator).trim();
+    let value = line.slice(separator + 1).trim();
+    if ((value.startsWith("\"") && value.endsWith("\"")) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
     }
+    output[key] = value;
+  }
+  return output;
+}
+
+function loadEnvFile(filePath) {
+  try {
+    Object.assign(process.env, parseEnvText(readFileSync(filePath, "utf8")));
   } catch {
     // Optional env file.
   }
 }
 
+function refreshPairingConfigFromEnvFile(config) {
+  if (!config?.envFile) {
+    return false;
+  }
+
+  let entries;
+  try {
+    entries = parseEnvText(readFileSync(config.envFile, "utf8"));
+  } catch {
+    return false;
+  }
+
+  const nextCode = entries.PAIRING_CODE ?? "";
+  const nextToken = entries.PAIRING_TOKEN ?? "";
+  const nextExpiresAtMs = Number(entries.PAIRING_EXPIRES_AT_MS) || 0;
+  if (
+    config.pairingCode === nextCode &&
+    config.pairingToken === nextToken &&
+    Number(config.pairingExpiresAtMs) === nextExpiresAtMs
+  ) {
+    return false;
+  }
+
+  config.pairingCode = nextCode;
+  config.pairingToken = nextToken;
+  config.pairingExpiresAtMs = nextExpiresAtMs;
+  process.env.PAIRING_CODE = nextCode;
+  process.env.PAIRING_TOKEN = nextToken;
+  process.env.PAIRING_EXPIRES_AT_MS = String(nextExpiresAtMs);
+  console.log(`[pairing] refreshed credentials from ${config.envFile}`);
+  return true;
+}
+
 async function maybeRotateStartupPairingEnv(envFile) {
   if (!truthy(process.env.AUTH_REQUIRED)) {
     return;
@@ -19183,8 +20471,11 @@ function refreshResolvedThreadLabels({ config, runtime, state }) {
   );
 
   if (
-    JSON.stringify(nextHistoryItems.map((item) => [item.stableId, item.title, item.threadLabel])) !==
-    JSON.stringify(runtime.recentHistoryItems.map((item) => [item.stableId, item.title, item.threadLabel]))
+    timelineProjectionChanged(nextHistoryItems, runtime.recentHistoryItems, [
+      "stableId",
+      "title",
+      "threadLabel",
+    ])
   ) {
     runtime.recentHistoryItems = nextHistoryItems;
     state.recentHistoryItems = nextHistoryItems;
@@ -19225,8 +20516,11 @@ function refreshResolvedThreadLabels({ config, runtime, state }) {
   );
 
   if (
-    JSON.stringify(nextTimelineEntries.map((entry) => [entry.stableId, entry.title, entry.threadLabel])) !==
-    JSON.stringify(runtime.recentTimelineEntries.map((entry) => [entry.stableId, entry.title, entry.threadLabel]))
+    timelineProjectionChanged(nextTimelineEntries, runtime.recentTimelineEntries, [
+      "stableId",
+      "title",
+      "threadLabel",
+    ])
   ) {
     runtime.recentTimelineEntries = nextTimelineEntries;
     state.recentTimelineEntries = nextTimelineEntries;
@@ -19261,8 +20555,11 @@ function refreshResolvedThreadLabels({ config, runtime, state }) {
   );
 
   if (
-    JSON.stringify(nextCodeEvents.map((entry) => [entry.stableId, entry.title, entry.threadLabel])) !==
-    JSON.stringify(runtime.recentCodeEvents.map((entry) => [entry.stableId, entry.title, entry.threadLabel]))
+    timelineProjectionChanged(nextCodeEvents, runtime.recentCodeEvents, [
+      "stableId",
+      "title",
+      "threadLabel",
+    ])
   ) {
     runtime.recentCodeEvents = nextCodeEvents;
     state.recentCodeEvents = nextCodeEvents;
@@ -19348,21 +20645,68 @@ function isInlineImagePlaceholderText(value) {
   return cleanText(stripInlineImagePlaceholderMarkup(value)) === "" && /<\/?image\b/iu.test(String(value || ""));
 }
 
+function stripCodexUserAttachmentEnvelope(value) {
+  const source = String(value || "");
+  if (!/Files mentioned by the user:/iu.test(source) || !/My request for Codex:/iu.test(source)) {
+    return source;
+  }
+
+  const marker = source.match(/\bMy request for Codex:\s*/iu);
+  if (!marker || marker.index == null) {
+    return source;
+  }
+  return source.slice(marker.index + marker[0].length).trim();
+}
+
 function normalizeTimelineMessageText(value, locale = DEFAULT_LOCALE) {
-  return normalizeLongText(replaceTurnAbortedMarkup(stripInlineImagePlaceholderMarkup(value), locale));
+  return normalizeLongText(
+    replaceTurnAbortedMarkup(
+      stripCodexUserAttachmentEnvelope(stripInlineImagePlaceholderMarkup(value)),
+      locale
+    )
+  );
+}
+
+function extractTimelineImagePaths(value) {
+  const source = String(value || "");
+  if (!/Files mentioned by the user:/iu.test(source)) {
+    return [];
+  }
+
+  const paths = [];
+  for (const match of source.matchAll(/(\/Users\/[^\n\r]+?\.(?:png|jpe?g|webp|gif|heic|heif))(?:\s|$)/giu)) {
+    const filePath = cleanText(match[1] || "");
+    if (filePath) {
+      paths.push(filePath);
+    }
+  }
+  return normalizeTimelineImagePaths(paths);
 }
 
 function normalizeTimelineImagePaths(value) {
   if (!Array.isArray(value)) {
     return [];
   }
-  return value
-    .map((entry) => cleanText(entry || ""))
-    .filter(Boolean);
+  const output = [];
+  const seen = new Set();
+  for (const entry of value) {
+    const normalized = cleanText(entry || "");
+    if (!normalized || seen.has(normalized)) {
+      continue;
+    }
+    seen.add(normalized);
+    output.push(normalized);
+  }
+  return output;
 }
 
 function normalizeNotificationText(value, locale = DEFAULT_LOCALE) {
-  return normalizeLongText(replaceTurnAbortedMarkup(stripNotificationMarkup(value), locale))
+  return normalizeLongText(
+    replaceTurnAbortedMarkup(
+      stripCodexUserAttachmentEnvelope(stripNotificationMarkup(value)),
+      locale
+    )
+  )
     .replace(/\n{2,}/gu, "\n")
     .trim();
 }
@@ -19423,6 +20767,65 @@ function cleanText(value) {
   return String(value || "").replace(/\s+/gu, " ").trim();
 }
 
+function normalizeRemotePairingRelayUrl(value) {
+  const trimmed = cleanText(value);
+  if (!trimmed) {
+    return { ok: true, value: "" };
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return {
+      ok: false,
+      message: "relayUrl must be a valid URL",
+    };
+  }
+
+  if (parsed.username || parsed.password) {
+    return {
+      ok: false,
+      message: "relayUrl must not include credentials",
+    };
+  }
+
+  if (parsed.protocol === "wss:") {
+    return { ok: true, value: trimmed };
+  }
+
+  if (parsed.protocol === "ws:" && isLoopbackRelayHost(parsed.hostname)) {
+    return { ok: true, value: trimmed };
+  }
+
+  return {
+    ok: false,
+    message: "relayUrl must use wss://; ws:// is allowed only for localhost or loopback development",
+  };
+}
+
+function isLoopbackRelayHost(hostname) {
+  const host = String(hostname || "").toLowerCase().replace(/^\[|\]$/gu, "");
+  return (
+    host === "localhost" ||
+    host.endsWith(".localhost") ||
+    host === "::1" ||
+    /^127(?:\.\d{1,3}){3}$/u.test(host)
+  );
+}
+
+function remotePairingRelayUrlFromEnv() {
+  const raw = process.env.REMOTE_PAIRING_RELAY_URL || "";
+  const result = normalizeRemotePairingRelayUrl(raw);
+  if (result.ok) {
+    return result.value;
+  }
+  if (cleanText(raw)) {
+    console.warn(`[remote-pairing] ignoring REMOTE_PAIRING_RELAY_URL: ${result.message}`);
+  }
+  return "";
+}
+
 function extractTitleOnlyJsonTitle(value) {
   const rawText = String(value ?? "").trim();
   if (!rawText) {
@@ -19697,6 +21100,37 @@ async function main() {
   process.on("SIGINT", handleSignal);
   process.on("SIGTERM", handleSignal);
 
+  // Belt-and-suspenders: a stray ERR_HTTP_HEADERS_SENT inside an async
+  // request handler used to escape as an UnhandledPromiseRejection and crash
+  // the process under launchd, triggering a restart loop that then re-ran all
+  // the startup backfills (state.json parse, rollout/transcript replay) and
+  // burned CPU + memory for ~30s per cycle. The targeted catch-handler guards
+  // around handleNativeApprovalDecision cover the known sites; this top-level
+  // filter swallows the same class of error from any new site we haven't
+  // audited yet so the process keeps serving instead of dying.
+  const isBenignHttpError = (err) =>
+    err && typeof err === "object" && (
+      err.code === "ERR_HTTP_HEADERS_SENT" ||
+      err.code === "ERR_STREAM_WRITE_AFTER_END" ||
+      err.code === "ERR_STREAM_DESTROYED" ||
+      err.code === "ECONNRESET" ||
+      err.code === "EPIPE"
+    );
+  process.on("uncaughtException", (err) => {
+    if (isBenignHttpError(err)) {
+      console.warn(`[uncaught-http] ${err.code} ${err.message}`);
+      return;
+    }
+    console.error(`[uncaught] ${err?.stack || err}`);
+  });
+  process.on("unhandledRejection", (reason) => {
+    if (isBenignHttpError(reason)) {
+      console.warn(`[unhandled-http] ${reason.code} ${reason.message}`);
+      return;
+    }
+    console.error(`[unhandled] ${reason?.stack || reason}`);
+  });
+
   try {
     if (config.webPushEnabled) {
       webPush.setVapidDetails(
@@ -19816,6 +21250,38 @@ async function main() {
       }
     }
 
+    // --- Remote-pairing relay (PWA off-LAN) ---
+    // Optional. When enabled, the bridge keeps an outbound WebSocket open per
+    // paired phone (`~/.viveworker/remote-pairings.json`) to the remote-pairing
+    // relay (Cloudflare Worker + Durable Object). RPC frames arriving over
+    // those channels are dispatched through the same `requestHandler` LAN HTTP
+    // uses, so cookies / auth / CSRF behave identically off-LAN.
+    //
+    // If disabled (default), the orchestrator returns a dormant handle and
+    // does no I/O. Pairings file changes are auto-reloaded via fs.watch — no
+    // outer loop needed here.
+    if (approvalServer && approvalServer.requestHandler) {
+      try {
+        runtime.remotePairingHandle = await startRemotePairingRelay({
+          enabled: config.remotePairingEnabled,
+          relayUrl: config.remotePairingRelayUrl || undefined,
+          requestListener: approvalServer.requestHandler,
+          logger: console,
+          auditEventSink: recordRemotePairingAudit,
+        });
+        const status = runtime.remotePairingHandle.getStatus();
+        if (status.enabled) {
+          console.log(
+            `[remote-pairing] connected relay=${status.relayUrl} ` +
+            `identity=${status.identityFingerprint} ` +
+            `paired=${status.sessions.length}`
+          );
+        }
+      } catch (err) {
+        console.error(`[remote-pairing] startup failed: ${err?.message}`);
+      }
+    }
+
     let lastA2aEnvCheckAt = 0;
     const A2A_ENV_CHECK_INTERVAL_MS = 30_000; // check every 30 seconds
 
@@ -19902,6 +21368,13 @@ async function main() {
 
     stopRelayPolling();
 
+    if (runtime.remotePairingHandle) {
+      try {
+        runtime.remotePairingHandle.close();
+      } catch {}
+      runtime.remotePairingHandle = null;
+    }
+
     if (runtime.ipcClient) {
       runtime.ipcClient.stop();
     }