wave-code 1.6.0 → 1.6.2

package/src/remote/relayClient.ts

@@ -137,14 +137,38 @@ export function isStaleIdentityError(
   return error !== undefined && RELAY_STALE_IDENTITY_ERRORS.includes(error);
 }
 
-/** Retry cadence. Flat 2s: the relay is a well-known host, not a flaky peer —
- * exponential backoff would only delay a laptop waking from sleep. */
-export const RELAY_RETRY_DELAY_MS = 2_000;
-/** Attempts for an ordinary drop (relay restart, network blip). */
-export const RELAY_MAX_ATTEMPTS = 5;
-/** Separate, smaller budget for `4001`: the host announced itself but had no
- * session ready. Retrying a real outage five times buys nothing. */
-export const RELAY_MAX_UNAVAILABLE_ATTEMPTS = 3;
+/**
+ * Retry cadence: exponential from 2s, doubling, capped at 60s.
+ *
+ * 2s to start keeps the first retry where the old flat cadence put it (a laptop
+ * waking from sleep should not wait out a grown backoff); the 60s ceiling is
+ * what stops a genuinely offline relay from being dialled every second.
+ */
+export const RELAY_RETRY_BASE_DELAY_MS = 2_000;
+export const RELAY_RETRY_MAX_DELAY_MS = 60_000;
+/**
+ * How long a dropped link keeps trying before it gives up and reports `error`.
+ *
+ * This is the number that decides whether the daemon survives a deploy, and it
+ * used to be about eleven seconds (six dials, flat 2s) — shorter than any
+ * realistic restart, so a routine relay release killed every connected machine
+ * for good (2026-11-09: the relay was deployed at 13:50, the host stopped
+ * retrying seconds later, and remote control stayed dead for seven hours until
+ * someone ran `wave remote-control on` by hand). Ten minutes covers a slow
+ * release (image pull, readiness probe, load-balancer drain) with margin while
+ * still being a bound: a link that has not come back in ten minutes is much
+ * more likely facing a real outage than a rollout, and stopping is what makes
+ * `status` say something a human can act on.
+ */
+export const RELAY_RETRY_WINDOW_MS = 10 * 60 * 1000;
+/**
+ * Share of a scheduled wait that is randomized away ("equal jitter": the delay
+ * lands in `[50%, 100%]` of the schedule). A relay restart drops every machine
+ * at the same instant, and an unjittered schedule makes them all dial in
+ * lockstep afterwards; half-random rather than fully-random keeps the backoff
+ * growing instead of letting a still-restarting relay be dialled immediately.
+ */
+export const RELAY_RETRY_JITTER = 0.5;
 /** Idle keepalive. Browsers cannot send WebSocket control pings, and the relay
  * faces the phone anyway, so this is an application-level frame. */
 export const RELAY_PING_INTERVAL_MS = 30_000;
@@ -202,7 +226,23 @@ export interface RelayClientOptions {
    * nothing about that. Nothing is retried from here either way.
    */
   onStaleIdentity?: (info: { error: string }) => void;
-  /** The connection is gone for good — `4003`, or the retry budget ran out. */
+  /**
+   * A dial attempt is over and another is scheduled — reported so the caller can
+   * say *why* the link is down, how long the wait is, and how much of the retry
+   * window is left before it gives up.
+   */
+  onRetry?: (info: {
+    /** What ended the attempt (`relay connection lost (1006)`, …). */
+    reason: string;
+    /** Failed attempts in a row since the last completed handshake. */
+    attempt: number;
+    /** How long until the next dial. */
+    delayMs: number;
+    /** How much of `RELAY_RETRY_WINDOW_MS` is still ahead. */
+    remainingMs: number;
+  }) => void;
+  /** The connection is gone for good — `4003`, a takeover, or the retry window
+   * running out (`RELAY_RETRY_WINDOW_MS`). */
   onFatal?: (reason: string) => void;
 }
 
@@ -211,9 +251,17 @@ export class RelayClient {
   private socket: RelaySocket | undefined;
   private retryTimer: ReturnType<typeof setTimeout> | undefined;
   private pingTimer: ReturnType<typeof setInterval> | undefined;
+  /** Failed dials in a row; drives the backoff curve. Reset by a completed
+   * handshake, never by a socket that merely opened (a relay that accepts TCP
+   * and closes immediately would otherwise pin the delay at its first step). */
   private attempts = 0;
-  private unavailableAttempts = 0;
   private stopped = false;
+  /**
+   * When the current outage started — the first drop since the last completed
+   * handshake. `undefined` while the link is healthy, which is what makes the
+   * retry window a per-outage budget rather than a lifetime one.
+   */
+  private outageStartedAt: number | undefined;
   /** Why the relay refused us, kept so the `4003` that follows can say more. */
   private authError: { error: string } | undefined;
   /**
@@ -375,8 +423,10 @@ export class RelayClient {
     socket.onopen = () => {
       if (this.socket !== socket) return;
       this.state = "open";
-      this.attempts = 0;
-      this.unavailableAttempts = 0;
+      // Neither the attempt counter nor the retry window is cleared here: an
+      // open socket that never completes the handshake is a failing dial, not a
+      // working link. `auth_ok` is where both reset (a relay that accepts TCP
+      // and closes at once would otherwise keep the backoff at its first step).
       // The relay authenticates the runner before it will fan anything out, and
       // it reads the version from the top level of this same frame. Ten seconds
       // without it and the relay closes with `auth_timeout` (4003). This is the
@@ -432,10 +482,11 @@ export class RelayClient {
     if (code === RELAY_CLOSE_UNAVAILABLE && reason === RELAY_CLOSE_REPLACED) {
       // Another process on this machine dialled in and the relay handed the
       // channel over to it. Retrying would take the channel back, and then the
-      // other side would retry too: the two would replace each other every two
-      // seconds, forever — every successful connect resets the retry budget, so
-      // neither ever exceeds it. So this side steps down for good; dialling
-      // again from here is an explicit user action and takes the channel back.
+      // other side would retry too: the two would replace each other for as
+      // long as both stay inside the retry window — and every successful
+      // handshake starts a fresh one, so neither would ever run out. So this
+      // side steps down for good; dialling again from here is an explicit user
+      // action and takes the channel back.
       this.stopped = true;
       this.state = "closed";
       this.options.onFatal?.(
@@ -462,31 +513,58 @@ export class RelayClient {
       return;
     }
 
-    if (code === RELAY_CLOSE_UNAVAILABLE) {
-      this.unavailableAttempts += 1;
-      if (this.unavailableAttempts > RELAY_MAX_UNAVAILABLE_ATTEMPTS) {
-        this.stopped = true;
-        this.state = "closed";
-        this.options.onFatal?.("relay reported the host unavailable (4001)");
-        return;
-      }
-    } else {
-      this.attempts += 1;
-      if (this.attempts > RELAY_MAX_ATTEMPTS) {
-        this.stopped = true;
-        this.state = "closed";
-        this.options.onFatal?.(
-          `relay connection lost${code === undefined ? "" : ` (${code})`}`,
-        );
-        return;
-      }
+    // Everything else — a relay restart, a network blip, sleep/wake, a `4001`
+    // "host not ready yet" — is transient and shares one budget: the retry
+    // window (see `RELAY_RETRY_WINDOW_MS`). 4001 used to have a smaller budget
+    // of its own, but it is the *same* condition from here: the relay exists and
+    // will serve this host once it is ready.
+    this.scheduleRetry(
+      code === undefined
+        ? "relay connection lost"
+        : `relay connection lost (${code})`,
+    );
+  }
+
+  /**
+   * Back off, then dial again — until the retry window runs out.
+   *
+   * The window is per outage: it starts at the first drop after a completed
+   * handshake and is cleared by the next `auth_ok`, so a link that comes back
+   * and drops again gets the full ten minutes each time rather than spending a
+   * lifetime allowance.
+   */
+  private scheduleRetry(reason: string): void {
+    const now = Date.now();
+    this.outageStartedAt ??= now;
+    const elapsed = now - this.outageStartedAt;
+    if (elapsed >= RELAY_RETRY_WINDOW_MS) {
+      this.stopped = true;
+      this.state = "closed";
+      this.options.onFatal?.(
+        `${reason}; gave up after ${String(Math.round(RELAY_RETRY_WINDOW_MS / 60_000))}m`,
+      );
+      return;
     }
 
+    this.attempts += 1;
+    const ceiling = Math.min(
+      RELAY_RETRY_BASE_DELAY_MS * 2 ** Math.min(this.attempts - 1, 16),
+      RELAY_RETRY_MAX_DELAY_MS,
+    );
+    const delayMs = Math.round(
+      ceiling * (1 - RELAY_RETRY_JITTER + Math.random() * RELAY_RETRY_JITTER),
+    );
     this.state = "closed";
+    this.options.onRetry?.({
+      reason,
+      attempt: this.attempts,
+      delayMs,
+      remainingMs: RELAY_RETRY_WINDOW_MS - elapsed,
+    });
     this.retryTimer = setTimeout(() => {
       this.retryTimer = undefined;
       if (!this.stopped) this.connect();
-    }, RELAY_RETRY_DELAY_MS);
+    }, delayMs);
     this.retryTimer.unref?.();
   }
 
@@ -510,15 +588,12 @@ export class RelayClient {
     } catch {
       // Already gone.
     }
+    // A phone that reads slowly is not evidence of an outage, so this drop
+    // neither grows the backoff nor spends the retry window: the link itself is
+    // fine, only its reader is behind.
     this.attempts = 0;
-    this.state = "closed";
-    if (!this.stopped) {
-      this.retryTimer = setTimeout(() => {
-        this.retryTimer = undefined;
-        if (!this.stopped) this.connect();
-      }, RELAY_RETRY_DELAY_MS);
-      this.retryTimer.unref?.();
-    }
+    this.outageStartedAt = undefined;
+    this.scheduleRetry("the subscriber fell behind and the link was dropped");
   }
 
   /**
@@ -532,6 +607,10 @@ export class RelayClient {
       case "auth_ok":
         this.authError = undefined;
         this.authed = true;
+        // The link works, so this is where the schedule starts over: the next
+        // drop gets a fresh backoff curve and a fresh ten minutes.
+        this.attempts = 0;
+        this.outageStartedAt = undefined;
         // Before anything the callback sends: parked frames are older, and the
         // phone has to see them in the order they were produced.
         this.flushOutbox();

package/src/remote/remoteControlCliHost.ts

@@ -249,10 +249,19 @@ export class RemoteControlCliHost implements RemoteControlHost {
       decision?: unknown;
     };
     if (typeof p.requestId !== "string" || !p.decision) return;
-    this.session.respondPermission(
-      p.requestId,
-      p.decision as PermissionDecision,
-    );
+    const decision = p.decision as PermissionDecision;
+    this.session.respondPermission(p.requestId, decision);
+    // 不带反馈的拒绝 = 用户在页面上关掉了确认卡（关闭键 / Esc），本轮就此结束：
+    // 与桌面端 / VS Code / JetBrains 的 `denied → abortMessage()`、以及 Claude
+    // Code 的 `cancelAndAbort`（无 feedback 直接 abort 整轮）同一条语义。少了这
+    // 一步，手机上关掉提问弹窗后模型会拿着「用户拒绝了操作」继续往下做，而同一
+    // 张卡在桌面端关掉就停（spec ui/confirm-ui.md 场景 2 / 5、remote-web.md
+    // 场景 24）。**带 message 的拒绝不中断**——那是用户给出理由后拒绝这一次工具
+    // 调用，模型要照反馈继续或改问。
+    const rejectionFeedback = decision.message?.trim();
+    if (decision.behavior === "deny" && !rejectionFeedback) {
+      this.session.abort();
+    }
   }
 
   /**
@@ -388,10 +397,17 @@ export class RemoteControlCliHost implements RemoteControlHost {
     messages: Message[];
     contextUsagePercent: number;
     reset?: boolean;
+    anchorLost?: boolean;
+    hasMore?: boolean;
   }> {
     const contextUsagePercent = this.session.contextUsagePercent();
     const window: MessageWindow = {};
     if (typeof p.since === "string") window.since = p.since;
+    // 上翻取更早的锚点（spec ui/message-rendering-system.md「首屏一页，上翻按需
+    // 取更早」，远控页自 2026-11-06 起也翻）。少这一行，`{before, limit}` 会被当成
+    // 「只要一页尾巴」——回的是同一段尾部、`hasMore` 仍是 true，页面每次滚到顶都
+    // 白要一次，永远翻不动。
+    if (typeof p.before === "string") window.before = p.before;
     if (p.limit !== undefined) window.limit = Number(p.limit);
 
     let normalized: MessageWindow | undefined;

package/src/remote/remoteControlService.ts

@@ -482,6 +482,18 @@ export class RemoteControlService implements RemoteControlController {
         if (generation !== this.generation) return;
         this.refreshIdentity(info.error);
       },
+      onRetry: (info) => {
+        if (generation !== this.generation) return;
+        // A drop the client is already healing is `connecting`, never `error`:
+        // there is nothing for the user to fix yet, and calling it an error
+        // sends them hunting for a fault that is fixing itself. What they
+        // cannot guess is the deadline — how long this keeps trying before it
+        // does give up — so that is what the message carries.
+        this.setStatus({
+          state: "connecting",
+          message: `${info.reason}; retrying in ${formatDelay(info.delayMs)} (attempt ${String(info.attempt)}, ${formatWindowLeft(info.remainingMs)} left)`,
+        });
+      },
       onFatal: (message) => {
         if (generation !== this.generation) return;
         this.setStatus({ state: "error", message });
@@ -696,7 +708,7 @@ export class RemoteControlService implements RemoteControlController {
       // Not even one message fits: there is nothing to send that the phone
       // could render, and an empty list would only make it re-ask forever.
       if (kept > 0) {
-        this.send(pageFrame(replyId, page, kept));
+        this.send(pageFrame(replyId, page, kept, kept < page.messages.length));
         return;
       }
     }
@@ -824,6 +836,21 @@ export class RemoteControlService implements RemoteControlController {
   }
 }
 
+/** `2s` / `60s` — a wait the user reads, rounded to what the schedule says. */
+function formatDelay(ms: number): string {
+  if (ms < 60_000) return `${String(Math.round(ms / 1000))}s`;
+  return `${String(Math.round(ms / 60_000))}m`;
+}
+
+/**
+ * How much of the retry window is still ahead, rounded **up**: reporting `0m
+ * left` while a dial is still scheduled would read as "already gave up".
+ */
+function formatWindowLeft(ms: number): string {
+  if (ms >= 60_000) return `${String(Math.ceil(ms / 60_000))}m`;
+  return `${String(Math.max(0, Math.round(ms / 1000)))}s`;
+}
+
 function describeRpcError(err: unknown): { code: number; message: string } {
   const code =
     err && typeof err === "object" && "code" in err
@@ -859,13 +886,19 @@ function pageFrame(
   replyId: number | string,
   page: MessagePage,
   count: number,
+  droppedEarlier = false,
 ): RelayEnvelope {
+  // 裁掉的是**最早**那几条，所以只要真裁过，「更早的还在」就必然成立——哪怕
+  // 宿主那一页说的 `hasMore: false`（上翻取到这条会话最早那一页时正是如此）。
+  // 不在这里改这个字段，页面会照着 false 把上翻开关关掉，被裁掉的几条就再也
+  // 翻不回来了；页大小因此只能是「大概几条」，**条数永远不是终止判据**。
+  const rest = droppedEarlier ? { ...page.rest, hasMore: true } : page.rest;
   return {
     id: replyId,
     method: "result",
     params: {
       result: {
-        ...page.rest,
+        ...rest,
         messages: page.messages.slice(-count),
       },
     },

package/src/remote/remoteNotifications.ts

@@ -28,6 +28,7 @@ import type {
   ToolBlockUpdateCallbackParams,
   ToolPermissionContext,
 } from "wave-agent-sdk";
+import { getAutoCompactThreshold } from "wave-agent-sdk";
 import { toolBlockUpdateForUi } from "../stdio/uiPayload.js";
 
 /**
@@ -45,9 +46,25 @@ type StreamDelta = Parameters<
  * push and its `getSessionInfo` read). 0 when the cap is unknown, so a caller
  * that has one reads a number rather than a special case.
  */
-export function percentOf(tokens: number, maxInputTokens: number): number {
-  if (!maxInputTokens || maxInputTokens <= 0) return 0;
-  return Math.min(100, Math.round((tokens / maxInputTokens) * 100));
+export function percentOf(
+  tokens: number,
+  contextWindow: number,
+  maxOutputTokens = 32_000,
+): number {
+  if (!Number.isFinite(contextWindow) || contextWindow <= 0) return 0;
+  const calculatedThreshold = getAutoCompactThreshold(
+    contextWindow,
+    Number.isFinite(maxOutputTokens) && maxOutputTokens > 0
+      ? maxOutputTokens
+      : 32_000,
+  );
+  // Some host tests auto-mock the SDK barrel wholesale. Keep the wire helper
+  // usable in that environment without changing production's shared formula.
+  const threshold =
+    Number.isFinite(calculatedThreshold) && calculatedThreshold > 0
+      ? calculatedThreshold
+      : contextWindow;
+  return Math.min(100, Math.round((tokens / threshold) * 100));
 }
 
 /** The shapes both hosts put on the wire, keyed by the method they ride under. */
@@ -95,8 +112,12 @@ export const remoteWire = {
     ...(latestTotalTokens === undefined ? {} : { latestTotalTokens }),
   }),
 
-  contextUsage: (latestTotalTokens: number, maxInputTokens: number) => ({
-    percent: percentOf(latestTotalTokens, maxInputTokens),
+  contextUsage: (
+    latestTotalTokens: number,
+    contextWindow: number,
+    maxOutputTokens = 32_000,
+  ) => ({
+    percent: percentOf(latestTotalTokens, contextWindow, maxOutputTokens),
   }),
 
   permissionModeChange: (mode: PermissionMode) => ({ mode }),

package/src/stdio/agentBridge.ts

@@ -60,6 +60,7 @@ import {
   updateUserPreferenceSettings,
   type UserPreferenceSettings,
   type UserPreferenceSettingsView,
+  type AccountCredential,
   type SubagentConfiguration,
   type SkillMetadata,
   type PluginReloadResult,
@@ -838,6 +839,25 @@ export class AgentBridge {
       if (entry) {
         this.pendingPermissions.delete(p.requestId);
         entry.resolve(p.decision);
+        // 不带反馈的拒绝 = 用户关掉了确认卡（关闭键 / Esc），本轮在用户这边就
+        // 结束：与桌面端 / VS Code / JetBrains 的 `denied → abortMessage()` 是
+        // 同一条语义，也与 Claude Code 的 `cancelAndAbort`（无 feedback 直接
+        // abort 整轮）一致。**带 message 的拒绝不中断**——那是用户给出理由后
+        // 拒绝这一次工具调用，模型要照反馈继续或改问（spec
+        // ui/confirm-ui.md 场景 2 / 5、remote/remote-web.md 场景 24）。
+        // 中断本身不阻塞回包，失败（会话正被重建 / 已销毁）也不影响这次拒绝
+        // 已经生效，因此静默。
+        const rejectionFeedback = p.decision?.message?.trim();
+        if (
+          p.decision?.behavior === "deny" &&
+          !rejectionFeedback &&
+          entry.sessionId
+        ) {
+          const session = this.sessions.get(entry.sessionId);
+          if (session && !session.transitioning) {
+            void session.agent.abortMessage();
+          }
+        }
       }
     }
   }
@@ -1345,11 +1365,12 @@ export class AgentBridge {
    */
   private emitContextUsage(agent: Agent): void {
     const tokens = agent.latestTotalTokens;
-    const max = agent.getMaxInputTokens();
+    const max = agent.getContextWindow();
+    const maxOutput = agent.getMaxOutputTokens?.() ?? 32_000;
     if (tokens > 0 && max > 0) {
       this.emit(
         "contextUsage",
-        remoteWire.contextUsage(tokens, max),
+        remoteWire.contextUsage(tokens, max, maxOutput),
         agent.sessionId,
       );
     }
@@ -1364,9 +1385,10 @@ export class AgentBridge {
    */
   private contextUsagePercentOf(agent: Agent): number | undefined {
     const tokens = agent.latestTotalTokens;
-    const max = agent.getMaxInputTokens();
+    const max = agent.getContextWindow();
+    const maxOutput = agent.getMaxOutputTokens?.() ?? 32_000;
     if (tokens > 0 && max > 0) {
-      return percentOf(tokens, max);
+      return percentOf(tokens, max, maxOutput);
     }
     return undefined;
   }
@@ -2790,20 +2812,77 @@ export class AgentBridge {
   }
 
   // ── Auth (global) ────────────────────────────────────────────
+  /**
+   * 认证状态 + **凭据形态**（spec desktop-account.md「账户卡片 · 认证方式」）。
+   *
+   * `isAuthenticated` 只回答「有没有 SSO token」；宿主据此渲染卡片与发送入口会
+   * 把「key 写在 settings.json 里」的人判成没有凭据（卡片显示登录按钮、输入框
+   * 被锁）。故同一次查询里一并给出 `credential`，优先级与 SDK 的
+   * `resolveGatewayConfig` 对齐：企业账号 > 自定义网关 > 无凭据。
+   */
   private async getAuthStatus(): Promise<{
     isAuthenticated: boolean;
+    credential: AccountCredential;
     user: { id: string; email?: string } | undefined;
     serverUrl: string;
   }> {
     const authService = AuthService.getInstance();
     await authService.checkAndRefreshTokenIfNeeded();
+    const isAuthenticated = authService.isSSOAuthenticated();
     return {
-      isAuthenticated: authService.isSSOAuthenticated(),
+      isAuthenticated,
+      credential: this.resolveCredential(isAuthenticated),
       user: authService.getAuthUser(),
       serverUrl: authService.getServerUrl(),
     };
   }
 
+  /**
+   * 凭据形态。**判据只有这一处**——消费方（宿主 / webview）不得自己读配置推断。
+   *
+   * 网关层的取值顺序与 `resolveGatewayConfig` 一致：
+   * - 无 SSO：先问一个活着的会话的 `getGatewayConfig()`（与真实请求同源，已合并
+   *   用户 / 项目 / 远端三层 `env`），没有会话时退回「用户级 settings.json 的
+   *   `env`（`loadUserConfigEnv`）→ OS 环境变量」。
+   * - 有 SSO：**不能**用 `getGatewayConfig()`（它此时返回 SSO 凭据），回落的那份
+   *   网关只能从配置层读——卡片要靠它给「退出登录」项写后果。
+   *
+   * 注意 `setEnvironmentVars` 只把 `WAVE_SERVER_URL` 镜像进 `process.env`，网关
+   * 凭据留在会话快照里，所以只看 `process.env` 会把配好的人判成无凭据。
+   */
+  private resolveCredential(isAuthenticated: boolean): AccountCredential {
+    const gateway = isAuthenticated
+      ? this.configuredGatewayCredential()
+      : (this.sessionGatewayCredential() ?? this.configuredGatewayCredential());
+    if (isAuthenticated) {
+      // 企业账号生效中；`gateway` 仅表示「退出登录后会落到的那份」。
+      return gateway ? { kind: "sso", gateway } : { kind: "sso" };
+    }
+    return gateway ? { kind: "gateway", gateway } : { kind: "none" };
+  }
+
+  /** 活着的会话真正解析出来的网关配置（无 SSO 时它就是要发出去的那一份）。 */
+  private sessionGatewayCredential(): { host: string | null } | null {
+    for (const entry of this.sessions.values()) {
+      const gateway = entry.agent.getGatewayConfig();
+      if (gateway.apiKey) return { host: hostOfBaseUrl(gateway.baseURL) };
+    }
+    return null;
+  }
+
+  /**
+   * 配置层的网关凭据：用户级 settings.json 的 `env` 优先于 OS 环境变量（与
+   * `resolveGatewayConfig` 的 `env（settings.json）> process.env` 同序）。
+   */
+  private configuredGatewayCredential(): { host: string | null } | null {
+    const userEnv = loadUserConfigEnv();
+    const pick = (key: "WAVE_API_KEY" | "WAVE_BASE_URL"): string | undefined =>
+      userEnv[key]?.trim() || process.env[key]?.trim() || undefined;
+    const apiKey = pick("WAVE_API_KEY");
+    if (!apiKey) return null;
+    return { host: hostOfBaseUrl(pick("WAVE_BASE_URL")) };
+  }
+
   private async getAccountInfo(): Promise<{
     /**
      * 计费结论（套餐两根条 + 到期日 + 降级原因），形状见 codechat `GET /api/v1/account` → `billing`
@@ -3285,11 +3364,12 @@ export class AgentBridge {
         // request (fresh total) and on session restore (the persisted total),
         // so the webview button shows real usage without waiting for a turn —
         // aligned with the CLI, which reads the same callback (spec 场景 5/6).
-        const max = ctx.agent?.getMaxInputTokens() ?? 0;
+        const max = ctx.agent?.getContextWindow() ?? 0;
+        const maxOutput = ctx.agent?.getMaxOutputTokens?.() ?? 32_000;
         if (max > 0) {
           this.emit(
             "contextUsage",
-            remoteWire.contextUsage(tokens, max),
+            remoteWire.contextUsage(tokens, max, maxOutput),
             ctx.registeredSessionId,
           );
         }
@@ -3355,6 +3435,13 @@ export class AgentBridge {
       onMcpServersChange: (servers: McpServerStatus[]) => {
         this.emit("mcpServersChange", { servers }, ctx.registeredSessionId);
       },
+      onQuotaHeaders: (headers: Record<string, string>) => {
+        // 额度响应头（codechat proxy 每次模型调用都发，spec:
+        // desktop/desktop-account.md「额度响应头」）：桌面端宿主据此刷新账户卡片的
+        // 用量读数，是 60s 轮询删除后的主要刷新源。原样透传 —— 字段解析与映射都
+        // 在消费方。不进 remoteWire：远程页不渲染账户卡片。
+        this.emit("quotaHeaders", { headers }, ctx.registeredSessionId);
+      },
       onNotificationMessageAdded: (params) => {
         // The LAST matching message, not the first: one task can notify more
         // than once under the same task id (a workflow warns about its size
@@ -3488,6 +3575,19 @@ function isSessionRecoveryError(error: unknown): boolean {
   );
 }
 
+/**
+ * `baseURL` → 网关主机名（`api.example.com`）。缺省 / 不可解析一律 null（卡片读
+ * 「默认端点」）——这里只做展示，不做任何可用性判断。
+ */
+function hostOfBaseUrl(baseURL: string | undefined): string | null {
+  if (!baseURL) return null;
+  try {
+    return new URL(baseURL).host || null;
+  } catch {
+    return null;
+  }
+}
+
 /** Read a text file, returning "" when it does not exist. */
 async function readTextFileSafe(filePath: string): Promise<string> {
   try {

package/src/stdio/startupStage.ts

@@ -0,0 +1,22 @@
+/**
+ * 首次启动的进度上报（spec `ui/stdio-transport.md`「首次启动的进度文案」）。
+ *
+ * 走的是同一条 stdout 上的 JSON-RPC 通知通道（一条一行），只是没有 `sessionId`
+ * ——这些阶段发生在任何会话存在之前。宿主侧 `NotificationRouter` 的全局处理器
+ * 收下它，把它变成加载动画下方那一行文案。
+ *
+ * **旁路**：通知发不出去（stdout 已关、宿主已经退出）不是启动错误，写失败一律
+ * 吞掉；上报也不参与任何完成条件，没有宿主消费时启动照旧。
+ */
+
+import type { StartupStage } from "wave-agent-sdk";
+
+export function reportStartupStage(stage: StartupStage): void {
+  try {
+    process.stdout.write(
+      `${JSON.stringify({ method: "startupStage", params: { stage } })}\n`,
+    );
+  } catch {
+    // 见文件头：上报失败不影响启动。
+  }
+}

package/src/stdio-cli.ts

@@ -8,6 +8,7 @@
 
 import { ensureRuntimeDeps, setTelemetryStdoutProtected } from "wave-agent-sdk";
 import { StdioServer } from "./stdio/stdioServer.js";
+import { reportStartupStage } from "./stdio/startupStage.js";
 import { createRemoteControlSinkFactory } from "./remote/remoteControlSink.js";
 import { logger } from "./utils/logger.js";
 
@@ -64,7 +65,11 @@ export async function startStdioCli(): Promise<void> {
   // answering any RPC (see cli.tsx). Blocking here is what closes the race: the
   // host's `initialize` — and with it the webview's initial state — only lands
   // once a pasted image can be handled. Failures are non-fatal.
-  await ensureRuntimeDeps();
+  //
+  // The ~25MB this can pull is the longest silent stretch of a first launch, so
+  // it is reported (a warm cache reports nothing: `ensureRuntimeDeps` only
+  // fires `onStage` when something is actually missing).
+  await ensureRuntimeDeps({ onStage: reportStartupStage });
   // Registered here (stdio mode only): the interactive CLI keeps Node's
   // default behavior so the terminal shows the crash stack directly.
   process.on("uncaughtException", (error) =>
@@ -79,6 +84,9 @@ export async function startStdioCli(): Promise<void> {
     // same machine — is what serves a paired phone.
     createRemoteSink: createRemoteControlSinkFactory(process.cwd()),
   });
+  // Last startup stage: from here the process is up and what the user is waiting
+  // for is `initialize` (and, on the restore path, the transcript replay).
+  reportStartupStage("startingSession");
   server.start();
 
   // Keep the process alive — readline on stdin handles the event loop.

package/src/utils/oneLine.ts

@@ -0,0 +1,10 @@
+/**
+ * Collapse every run of whitespace (newlines included) into a single space.
+ *
+ * Terminal pickers render one row per entry, so text that arrives with hard
+ * line breaks must be flattened *before* it is truncated — a skill description
+ * carrying a `TRIGGER when:` block would otherwise turn one row into six and
+ * make the whole menu grow, shrink and jitter as the selection moves.
+ */
+export const toOneLine = (text: string): string =>
+  text.replace(/\s+/g, " ").trim();