wave-code 1.5.1 → 1.6.0

package/src/remote/remoteControlService.ts

@@ -49,6 +49,7 @@ import {
   type RelaySocketFactory,
 } from "./relayClient.js";
 import type { RemoteControlEndpoint } from "./remoteControlConfig.js";
+import { resultForRemote } from "../stdio/uiPayload.js";
 
 /**
  * Methods the remote channel accepts.
@@ -131,7 +132,7 @@ export const REMOTE_ALLOWED_METHODS: ReadonlySet<string> = new Set([
   "renameSession",
   "compact",
   "getSlashCommands",
-  // 发起新会话（spec ui/remote-control.md「Web 端也能发起新会话」）：白名单
+  // 发起新会话（spec remote/remote-web.md「Web 端也能发起新会话」）：白名单
   // 从「只碰已存在的会话」显式扩到「可在选定目录建会话」。initialize 在下方
   // 收敛入参——放行的是「建一条会话」这个能力，不是它的整张参数表。
   "initialize",
@@ -151,14 +152,17 @@ export const REMOTE_ALLOWED_METHODS: ReadonlySet<string> = new Set([
   // 排队消息三动作里的两条（「立即发送」= sendMessage{force} + 删这条）。
   "updateQueuedMessage",
   "deleteQueuedMessageById",
-  // 后台任务与工作流：读输出 / 停止（不毁文件，回执即可）。
-  // 注意这里没有 `backgroundCurrentTask`（把当前这轮转为后台）：页面上唯一的入口
-  // 是 Ctrl/Cmd+B，手机键盘没有这个键 —— 放行一个页面根本调不到的方法，只是把
-  // 暴露面放大，与本清单「跟页面能力一致」的判据相反。
+  // 后台任务与工作流：读输出 / 停止 / 把本轮转到后台（不毁文件，回执即可）。
+  // `backgroundCurrentTask` 曾经因为「页面上唯一的入口是 Ctrl/Cmd+B，手机键盘
+  // 没有这个键」而不在此列：放行一个页面根本调不到的方法，只是把暴露面放大，
+  // 与本清单「跟页面能力一致」的判据相反。2026-10-30 助手消息上出现了后台按钮
+  // （spec: task-background-execution.md「前台工具后台化」场景 3–6），页面上有了
+  // 调用方，这条判据随之满足。
   "getBackgroundTaskOutput",
   "stopBackgroundTask",
   "getWorkflowRuns",
   "stopWorkflowRun",
+  "backgroundCurrentTask",
   // `@` 文件建议与历史提示词：都只读，锚在信封 sessionId 的 workdir 上。
   "searchFiles",
   "getPromptHistory",
@@ -184,6 +188,33 @@ export const REMOTE_ALLOWED_METHODS: ReadonlySet<string> = new Set([
   // 的任何东西（那个能力本来就在 `initialize` 里）。
   "getRecentWorkdirs",
   "rememberRecentWorkdir",
+  // ── 第六批：点消息里的图片路径看原图（spec「点消息里的图片路径看原图」）──
+  // 读：`getImagePreview` 把**一个路径**变成一张压缩到单帧预算内的图。
+  // 这是第一个收调用方 path 的读方法，所以边界是显式的三道而不是目录前缀：
+  // ① 页面只对图片扩展名给点击入口，路径来自对话内容（没有手输入口）；
+  // ② 宿主解码后按**真实容器**判型（`imagePreview.ts` 的 ALLOWED_SOURCE_FORMATS），
+  //    扩展名只是路由提示，指向文本文件的软链在这一道被挡下；
+  // ③ 只读、不写不删，回包体积被压缩档位限住。
+  // **不按目录限制**是刻意的：真机截图落在 `/tmp`，限目录等于打掉主场景
+  // （见规格边界情况那条「边界画在内容类型上，不画在目录上」）。
+  "getImagePreview",
+  // 读：`getTextPreview` 是同一个形态的第二条（spec「点消息里的文件路径看内容」）
+  // ——把**一个路径**变成它开头那段文本。它**不设扩展名白名单**：判据是「读出来
+  // 是不是文本」（含 NUL 或大部分解不出即拒），不是「名字像不像文本」。
+  // 为什么这条通道不必也不该加路径限制：`sendMessage` + `permissionResponse` 已在
+  // 白名单里，持页面者让模型 Read 同一个路径拿到的就是同一份内容——任何这里加的
+  // 目录/扩展名限制都是假防护，只挡住更好用的入口（见规格边界情况那条）。
+  "getTextPreview",
+  // ── 第七批：`/resume`，接着磁盘上的历史会话聊（spec remote/remote-web.md
+  // 「手机端也能接着磁盘上的历史会话聊」）──
+  // 读：`listAllSessions` 枚举这台机器**所有项目目录**下的主会话（跨工作目录），
+  // 页面按最近活跃时间取前 200 条（帧预算是硬约束，见规格场景 2）。
+  // **`restoreSession` 仍然不放行**：它是「原地载入」——把承接进程里某条正在跑的
+  // 会话换成另一条（在桌面端就等于换掉用户正看着的那个 pane），与「手机只当控制
+  // 面」相冲。页面打开一条磁盘会话走的是**新建**路径
+  // （`initialize { workdir, restoreSessionId }`）：恢复出来的是一条新会话，没有
+  // 任何已有会话被替换，见 `pickInitializeParams` 的注释。
+  "listAllSessions",
 ]);
 
 /**
@@ -206,10 +237,22 @@ export const REMOTE_HOST_UNSUPPORTED = -32011;
 
 /**
  * The only `initialize` shape the remote channel may request: create a session
- * in a chosen directory, with an optional permission mode. Everything else in
- * its parameter surface (model / apiKey / tools / plugins / mcpServers /
- * restoreSessionId …) is dropped, not validated — a whitelisted method must
- * not smuggle in knobs the whitelist never approved.
+ * in a chosen directory, with an optional permission mode, and — since
+ * `/resume` (spec remote/remote-web.md「手机端也能接着磁盘上的历史会话聊」) — an
+ * optional `restoreSessionId` that seeds that **new** session from a transcript
+ * already on disk. Everything else in its parameter surface (model / apiKey /
+ * tools / plugins / mcpServers …) is dropped, not validated — a whitelisted
+ * method must not smuggle in knobs the whitelist never approved.
+ *
+ * Why `restoreSessionId` belongs here and not on the old "no re-attach" rule:
+ * that rule was about **switching** between live sessions (the page does that
+ * with `getMessages` on its own `sessionId`, never by re-binding the host's
+ * agent). `/resume` is a different act — the target is a transcript nobody is
+ * running, which the process cannot serve until a session exists for it. The
+ * write is therefore "start a new session seeded from this history", exactly
+ * the same capability as `initialize { workdir }` (which the page has had since
+ * 「Web 端也能发起新会话」), and the session it creates is a fresh one: no live
+ * session is replaced.
  *
  * `entrypoint` is stamped here rather than picked: it describes the CHANNEL, not
  * the caller's request, and must not be spoofable (the page cannot claim to be
@@ -224,6 +267,9 @@ function pickInitializeParams(params: unknown): Record<string, unknown> {
   if (typeof p.permissionMode === "string" && p.permissionMode) {
     picked.permissionMode = p.permissionMode;
   }
+  if (typeof p.restoreSessionId === "string" && p.restoreSessionId) {
+    picked.restoreSessionId = p.restoreSessionId;
+  }
   return picked;
 }
 
@@ -579,13 +625,15 @@ export class RemoteControlService implements RemoteControlController {
     }
 
     // `initialize` is whitelisted for exactly one shape: create a session in a
-    // chosen directory (and optionally set its permission mode). Its full
+    // chosen directory, optionally set its permission mode, and optionally seed
+    // it from a transcript on disk (`restoreSessionId`, `/resume`). Its full
     // parameter surface — apiKey / baseURL / model / tools / plugins /
     // mcpServers … — would let the page reshape the machine-side agent, so
-    // everything outside the two allowed keys is dropped here rather than
-    // trusted to the caller (spec 「Web 端也能发起新会话」场景 5). Re-attach
-    // (`restoreSessionId`) is NOT part of the whitelisted shape: the page
-    // switches sessions via `getMessages`, not by re-binding the host agent.
+    // everything outside those three keys is dropped here rather than trusted to
+    // the caller (spec 「Web 端也能发起新会话」场景 5、「手机端也能接着磁盘上
+    // 的历史会话聊」场景 4). Switching between *live* sessions still goes
+    // through `getMessages` on the page's own `sessionId`, never by re-binding
+    // an existing host agent.
     const requestParams =
       frame.method === "initialize"
         ? pickInitializeParams(frame.params)
@@ -624,10 +672,13 @@ export class RemoteControlService implements RemoteControlController {
     method: string,
     result: unknown,
   ): void {
+    // The page's copy: user image bytes never go over the relay
+    // (spec remote/remote-channel.md「远端通道只开一个白名单」场景 10).
+    const forRemote = resultForRemote(result);
     const envelope: RelayEnvelope = {
       id: replyId,
       method: "result",
-      params: { result },
+      params: { result: forRemote },
     };
     const bytes = frameBytes(envelope);
     if (bytes <= REMOTE_MAX_FRAME_BYTES) {
@@ -635,7 +686,7 @@ export class RemoteControlService implements RemoteControlController {
       return;
     }
 
-    const page = asMessagePage(result);
+    const page = asMessagePage(forRemote);
     if (page) {
       const kept = trailingCountThatFits(
         page.messages.length,

package/src/remote/remoteNotifications.ts

@@ -23,6 +23,7 @@ import type {
   AgentCallbacks,
   BackgroundTask,
   BackgroundTaskSummary,
+  NoticeLevel,
   PermissionMode,
   ToolBlockUpdateCallbackParams,
   ToolPermissionContext,
@@ -87,7 +88,7 @@ export const remoteWire = {
     return rest;
   },
 
-  errorBlockAdded: (error: string) => ({ error }),
+  noticeAdded: (notice: { level: NoticeLevel; content: string }) => notice,
 
   loadingChange: (loading: boolean, latestTotalTokens?: number) => ({
     loading,
@@ -174,7 +175,7 @@ export function remoteNotifications(
     | "onAssistantContentUpdated"
     | "onAssistantReasoningUpdated"
     | "onToolBlockUpdated"
-    | "onErrorBlockAdded"
+    | "onNoticeAdded"
   >
 > {
   return {
@@ -193,8 +194,8 @@ export function remoteNotifications(
     onToolBlockUpdated: (params) => {
       notify("toolBlockUpdated", remoteWire.toolBlockUpdated(params));
     },
-    onErrorBlockAdded: (error: string) => {
-      notify("errorBlockAdded", remoteWire.errorBlockAdded(error));
+    onNoticeAdded: (notice) => {
+      notify("noticeAdded", remoteWire.noticeAdded(notice));
     },
   };
 }

package/src/remote/textPreview.ts

@@ -0,0 +1,155 @@
+/**
+ * On-demand text preview for the remote-control page.
+ *
+ * ## Why this exists
+ *
+ * Same missing channel as {@link readImagePreview}: the phone has no file
+ * system, so "the agent wrote it to `/tmp/build.log`" is a path the user can
+ * read nowhere. The image channel solved that for pictures; this one solves it
+ * for everything else (spec `remote/remote-web.md`「点消息里的文件路径看内容」).
+ *
+ * ## The one gate
+ *
+ * The image channel is authorised by decoding: only a real raster container is
+ * served, so a `/tmp/x.png` that is really a text file dies before any bytes
+ * leave. Text has no equivalent — "it is text" is close to "anything can be
+ * read" — so by decision (2026-11-01) this channel does **not** filter by
+ * extension. What is left is: judge by *content* (a NUL byte or a mostly
+ * undecodable payload means binary), never write, never delete, and cap what
+ * one reply can carry. The consequences are spelled out in the spec's
+ * 「文本预览不设扩展名白名单」 boundary note — read that before widening this.
+ *
+ * ## Why the cap is not the frame budget
+ *
+ * {@link TEXT_PREVIEW_MAX_BYTES} is 256 KiB: a single frame could carry roughly
+ * twice that, but one screen of phone text is a few KiB, so anything past this
+ * only makes the overlay slower to render. The cap is applied as "read this
+ * much, then say you truncated", never as "refuse the file".
+ */
+import { open, stat } from "node:fs/promises";
+
+/** Never read more than this for one preview; the rest is reported as cut. */
+export const TEXT_PREVIEW_MAX_BYTES = 256 * 1024;
+
+/** The bytes are not text (NUL byte, or mostly undecodable as UTF-8). */
+export const TEXT_PREVIEW_NOT_TEXT = -32016;
+/** The path could not be read (missing, permission, a directory). */
+export const TEXT_PREVIEW_READ_FAILED = -32017;
+
+/**
+ * Share of U+FFFD above which the payload is treated as binary rather than as
+ * text with a bad encoding. A GBK log that is otherwise readable stays under
+ * this; a JPEG/ELF renamed to `.log` lands far above it.
+ */
+const MAX_REPLACEMENT_RATIO = 0.1;
+
+export interface TextPreviewResult {
+  /** The path that was asked for, echoed for the page's header. */
+  path: string;
+  content: string;
+  /** Size of the file on disk, for the "只显示前 X" line. */
+  bytes: number;
+  /** Bytes actually decoded (≤ {@link TEXT_PREVIEW_MAX_BYTES}). */
+  returnedBytes: number;
+  /** True when the file is larger than what was returned. */
+  truncated: boolean;
+  /** True when the decoded text contains replacement characters. */
+  encodingIssue: boolean;
+}
+
+function fail(code: number, message: string): Error {
+  const error = new Error(message) as Error & { code?: number };
+  error.code = code;
+  return error;
+}
+
+/**
+ * Read the head of one file from **this machine** and decode it as UTF-8.
+ *
+ * Throws an `Error` carrying one of the `TEXT_PREVIEW_*` codes; the remote
+ * error reply turns it into one visible line on the page.
+ */
+export async function readTextPreview(
+  filePath: string,
+): Promise<TextPreviewResult> {
+  if (typeof filePath !== "string" || filePath.trim() === "") {
+    throw fail(TEXT_PREVIEW_READ_FAILED, "getTextPreview requires a path");
+  }
+
+  let size: number;
+  try {
+    const info = await stat(filePath);
+    if (!info.isFile()) {
+      throw fail(TEXT_PREVIEW_READ_FAILED, `Not a file: ${filePath}`);
+    }
+    size = info.size;
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      "code" in error &&
+      typeof error.code === "number"
+    ) {
+      throw error;
+    }
+    throw fail(TEXT_PREVIEW_READ_FAILED, `Could not read ${filePath}`);
+  }
+
+  const readBytes = Math.min(size, TEXT_PREVIEW_MAX_BYTES);
+  let source: Buffer;
+  try {
+    const handle = await open(filePath, "r");
+    try {
+      const buffer = Buffer.allocUnsafe(readBytes);
+      let filled = 0;
+      // `read` may return short; loop until the head we asked for is in hand.
+      while (filled < readBytes) {
+        const { bytesRead } = await handle.read(
+          buffer,
+          filled,
+          readBytes - filled,
+          filled,
+        );
+        if (bytesRead === 0) break;
+        filled += bytesRead;
+      }
+      source = buffer.subarray(0, filled);
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    throw fail(TEXT_PREVIEW_READ_FAILED, `Could not read ${filePath}`);
+  }
+
+  // The gate: content, not the name. UTF-16 files carry NUL bytes and are
+  // rejected here too — this channel promises UTF-8, and saying so is better
+  // than showing a screen of interleaved NULs.
+  if (source.includes(0)) {
+    throw fail(TEXT_PREVIEW_NOT_TEXT, `${filePath} is not a text file`);
+  }
+
+  const truncated = size > source.length;
+  // With `stream: true` the decoder holds back an incomplete trailing sequence
+  // instead of turning it into U+FFFD, so a cut never produces a broken last
+  // character (场景 5：按字节截断、退回最近的字符边界).
+  const content = new TextDecoder("utf-8").decode(source, {
+    stream: truncated,
+  });
+
+  let replacements = 0;
+  for (const char of content) {
+    if (char === "\uFFFD") replacements++;
+  }
+  const length = content.length;
+  if (length > 0 && replacements / length > MAX_REPLACEMENT_RATIO) {
+    throw fail(TEXT_PREVIEW_NOT_TEXT, `${filePath} is not a text file`);
+  }
+
+  return {
+    path: filePath,
+    content,
+    bytes: size,
+    returnedBytes: source.length,
+    truncated,
+    encodingIssue: replacements > 0,
+  };
+}