@makerbi/remodex 1.5.8 → 2.0.0

package/bin/remodex.js

@@ -120,7 +120,7 @@ async function main({
         ok: true,
         currentVersion: version,
         plistPath: result?.plistPath,
-        pairingSession: result?.pairingSession,
+        pairingSession: sanitizePairingSessionForOutput(result?.pairingSession),
       },
       message: "[remodex] macOS bridge service is running.",
       jsonOutput,
@@ -141,7 +141,7 @@ async function main({
         ok: true,
         currentVersion: version,
         plistPath: result?.plistPath,
-        pairingSession: result?.pairingSession,
+        pairingSession: sanitizePairingSessionForOutput(result?.pairingSession),
       },
       message: "[remodex] macOS bridge service restarted.",
       jsonOutput,
@@ -156,10 +156,20 @@ async function main({
       consoleImpl,
       exitImpl,
     });
-    consoleImpl.log("[remodex] Refreshing bridge pairing QR...");
     const result = await deps.startMacOSBridgeService({
       waitForPairing: true,
     });
+    if (jsonOutput) {
+      emitJson({
+        ok: true,
+        currentVersion: version,
+        plistPath: result?.plistPath,
+        pairingSession: result?.pairingSession,
+      });
+      return;
+    }
+
+    consoleImpl.log("[remodex] Refreshing bridge pairing QR...");
     deps.printMacOSBridgePairingQr({
       pairingSession: result.pairingSession,
     });
@@ -193,7 +203,7 @@ async function main({
     });
     if (jsonOutput) {
       emitJson({
-        ...deps.getMacOSBridgeServiceStatus(),
+        ...sanitizeBridgeServiceStatusForOutput(deps.getMacOSBridgeServiceStatus()),
         currentVersion: version,
       });
       return;
@@ -272,7 +282,7 @@ async function main({
     "Usage: remodex up | remodex run [--extra-device|--extra-devices=N] | remodex start | remodex restart | "
     + "remodex qr | remodex pair | remodex stop | remodex status | "
     + "remodex reset-pairing | remodex resume | remodex watch [threadId] | remodex --version | "
-    + "append --json to start/restart/stop/status/reset-pairing/resume for machine-readable output"
+    + "append --json to start/restart/qr/pair/stop/status/reset-pairing/resume for machine-readable output"
   );
   exitImpl(1);
 }
@@ -361,6 +371,47 @@ function emitJson(payload) {
   process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
 }
 
+// Keeps machine-readable CLI output useful without exposing relay endpoints or live pairing payloads.
+function sanitizeBridgeServiceStatusForOutput(status = {}) {
+  const sanitized = {
+    ...status,
+    daemonConfig: sanitizeDaemonConfigForOutput(status.daemonConfig),
+    pairingSession: sanitizePairingSessionForOutput(status.pairingSession),
+  };
+  return sanitized;
+}
+
+function sanitizeDaemonConfigForOutput(config) {
+  if (!config || typeof config !== "object") {
+    return config || null;
+  }
+  const { relayUrl, pushServiceUrl, ...rest } = config;
+  return {
+    ...rest,
+    relayConfigured: Boolean(relayUrl),
+    pushServiceConfigured: Boolean(pushServiceUrl),
+  };
+}
+
+function sanitizePairingSessionForOutput(pairingSession) {
+  if (!pairingSession || typeof pairingSession !== "object") {
+    return pairingSession || null;
+  }
+  const payload = pairingSession.pairingPayload || {};
+  return {
+    createdAt: pairingSession.createdAt,
+    pairingCode: pairingSession.pairingCode,
+    pairingPayload: {
+      v: payload.v,
+      expiresAt: payload.expiresAt,
+      hasRelay: Boolean(payload.relay),
+      hasSessionId: Boolean(payload.sessionId),
+      hasMacIdentityPublicKey: Boolean(payload.macIdentityPublicKey),
+      displayName: payload.displayName,
+    },
+  };
+}
+
 function assertMacOSCommand(name, {
   platform = process.platform,
   consoleImpl = console,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makerbi/remodex",
-  "version": "1.5.8",
+  "version": "2.0.0",
   "description": "Local bridge between Codex and the Remodex mobile app. Run `remodex up` to start.",
   "repository": {
     "type": "git",

package/src/bridge.js

@@ -5,7 +5,7 @@
 // Depends on: ws, crypto, os, ./bridge-status, ./codex-desktop-refresher, ./codex-transport, ./rollout-watch, ./voice-handler
 
 const WebSocket = require("ws");
-const { randomBytes, randomUUID } = require("crypto");
+const { createHash, randomBytes, randomUUID } = require("crypto");
 const { execFile, spawn } = require("child_process");
 const fs = require("fs");
 const path = require("path");
@@ -46,6 +46,7 @@ const { createPushNotificationTracker } = require("./push-notification-tracker")
 const { resolveCodexGeneratedImagesRoot } = require("./codex-home");
 const {
   loadOrCreateBridgeDeviceState,
+  rememberLastSeenClientDeviceKind,
   rememberLastSeenPhoneAppVersion,
   resolveBridgeRelaySession,
 } = require("./secure-device-state");
@@ -238,6 +239,7 @@ function startBridge({
     requestId: null,
     startedAt: 0,
   };
+  let activePhoneSummary = null;
   const secureTransport = createBridgeSecureTransport({
     sessionId,
     relayUrl: relayBaseUrl,
@@ -247,6 +249,13 @@ function startBridge({
       deviceState = nextDeviceState;
       sendRelayRegistrationUpdate(nextDeviceState);
     },
+    onSecureSessionReady(session) {
+      activePhoneSummary = buildActivePhoneSummary(session, deviceState);
+      const lastPublishedBridgeStatus = bridgeStatusPublisher.latest();
+      if (lastPublishedBridgeStatus) {
+        publishBridgeStatus(lastPublishedBridgeStatus);
+      }
+    },
   });
   let primaryRelayChannel = null;
   // Keeps one stable sender identity across reconnects so buffered replay state
@@ -420,6 +429,9 @@ function startBridge({
 
     lastConnectionStatus = status;
     lastConnectionError = lastError;
+    if (status !== "connected") {
+      activePhoneSummary = null;
+    }
     publishBridgeStatus({
       state: "running",
       connectionStatus: status,
@@ -1529,6 +1541,20 @@ function startBridge({
   function bridgeManagedInitializeCompatibilityError(params) {
     const clientInfo = params && typeof params === "object" ? params.clientInfo : null;
     const clientName = normalizeNonEmptyString(clientInfo?.name);
+    const clientDeviceKind = classifyClientDeviceKind(clientName);
+    if (clientDeviceKind) {
+      deviceState = rememberLastSeenClientDeviceKind(deviceState, clientDeviceKind);
+      if (activePhoneSummary?.connected) {
+        activePhoneSummary = {
+          ...activePhoneSummary,
+          deviceKind: clientDeviceKind,
+        };
+        const lastPublishedBridgeStatus = bridgeStatusPublisher.latest();
+        if (lastPublishedBridgeStatus) {
+          publishBridgeStatus(lastPublishedBridgeStatus);
+        }
+      }
+    }
     if (clientName !== "codexmobile_ios") {
       return null;
     }
@@ -1697,7 +1723,11 @@ function startBridge({
   }
 
   function publishBridgeStatus(status) {
-    bridgeStatusPublisher.publish(status);
+    bridgeStatusPublisher.publish({
+      ...status,
+      activeDevice: activePhoneSummary,
+      activePhone: activePhoneSummary,
+    });
   }
 
   // Refreshes the relay's trusted-mac index after the QR bootstrap locks in a phone identity.
@@ -1950,6 +1980,47 @@ function buildMacRegistration(deviceState, pairingSession) {
   };
 }
 
+function buildActivePhoneSummary(session, deviceState = null) {
+  const phoneFingerprint = shortFingerprint(session?.phoneDeviceId);
+  if (!phoneFingerprint) {
+    return null;
+  }
+
+  return {
+    connected: true,
+    phoneFingerprint,
+    deviceKind: normalizeNonEmptyString(deviceState?.lastSeenDeviceKind) || null,
+    handshakeMode: normalizeNonEmptyString(session?.handshakeMode) || null,
+    keyEpoch: Number.isFinite(session?.keyEpoch) ? session.keyEpoch : null,
+    updatedAt: new Date().toISOString(),
+  };
+}
+
+function classifyClientDeviceKind(clientName) {
+  const normalized = normalizeNonEmptyString(clientName).toLowerCase();
+  if (!normalized) {
+    return null;
+  }
+  if (normalized.includes("android")) {
+    return "android";
+  }
+  if (normalized.includes("ios") || normalized.includes("iphone")) {
+    return "iphone";
+  }
+  if (normalized.includes("macos") || normalized.includes("mac")) {
+    return "mac";
+  }
+  return null;
+}
+
+function shortFingerprint(value) {
+  const normalized = normalizeNonEmptyString(value);
+  if (!normalized) {
+    return null;
+  }
+  return createHash("sha256").update(normalized).digest("hex").slice(0, 8);
+}
+
 function shutdown(codex, getSocket, beforeExit = () => {}, { exitCode = 0 } = {}) {
   beforeExit();
 
@@ -2553,6 +2624,10 @@ function compactEmergencySingleTurnForRelay(turn, maxChars, maxItems) {
     "created_at",
     "completedAt",
     "completed_at",
+    "timeZoneIdentifier",
+    "timeZone",
+    "timezone",
+    "time_zone",
     "status",
     "role",
     "kind",
@@ -3822,8 +3897,16 @@ function compactHistoryItemForRelay(item, maxChars) {
     turn_id: typeof item?.turn_id === "string" ? item.turn_id : undefined,
     createdAt: relayScalarHistoryMetadata(item?.createdAt),
     created_at: relayScalarHistoryMetadata(item?.created_at),
+    startedAt: relayScalarHistoryMetadata(item?.startedAt),
+    started_at: relayScalarHistoryMetadata(item?.started_at),
+    completedAt: relayScalarHistoryMetadata(item?.completedAt),
+    completed_at: relayScalarHistoryMetadata(item?.completed_at),
     timestamp: relayScalarHistoryMetadata(item?.timestamp),
     time: relayScalarHistoryMetadata(item?.time),
+    timeZoneIdentifier: relayScalarHistoryMetadata(item?.timeZoneIdentifier),
+    timeZone: relayScalarHistoryMetadata(item?.timeZone),
+    timezone: relayScalarHistoryMetadata(item?.timezone),
+    time_zone: relayScalarHistoryMetadata(item?.time_zone),
     relayPayloadTruncated: true,
   };
   const tailText = maxChars > 0 ? firstRelayTextTail(item, maxChars) : "";

package/src/git-handler.js

@@ -20,9 +20,11 @@ const GITHUB_CLI_TIMEOUT_MS = 120_000;
 const GIT_DRAFT_PATCH_MAX_BYTES = 80_000;
 const EMPTY_TREE_HASH = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 const DEFAULT_GIT_WRITER_MODEL = "gpt-5.4-mini";
+const STATUS_UPSTREAM_FETCH_TTL_MS = 15_000;
 
 let runStructuredCodexJsonImpl = runStructuredCodexJson;
 let runGitHubCliImpl = runGitHubCli;
+const statusUpstreamFetchCache = new Map();
 
 function resolveGitWriterModel(rawModel) {
   const trimmed = typeof rawModel === "string" ? rawModel.trim() : "";
@@ -172,9 +174,43 @@ async function gitStatus(cwd) {
     return nonRepositoryStatus(cwd);
   }
 
-  const [porcelain, branchInfo, repoRoot] = await Promise.all([
+  const snapshot = await readGitStatusSnapshot(cwd);
+  const { ahead, behind } = await freshBranchInfoForStatus(cwd, snapshot);
+  const dirty = snapshot.files.length > 0;
+  const noUpstream = snapshot.tracking === null && !snapshot.detached;
+  const hasHeadCommit = await refExists(cwd, "HEAD").catch(() => false);
+  const hasPushRemote = await pushRemoteAvailable(cwd, snapshot.tracking).catch(() => false);
+  const publishedToRemote = !snapshot.detached && !!snapshot.branch && await remoteBranchExists(cwd, snapshot.branch).catch(() => false);
+  const localOnlyCommitCount = await countLocalOnlyCommits(cwd, { detached: snapshot.detached }).catch(() => 0);
+  const state = computeState(dirty, ahead, behind, snapshot.detached, noUpstream);
+  const canPush = hasPushRemote && hasHeadCommit && (ahead > 0 || noUpstream) && !snapshot.detached;
+  const diff = await repoDiffTotals(cwd, {
+    tracking: snapshot.tracking,
+    fileLines: snapshot.fileLines,
+  }).catch(() => ({ additions: 0, deletions: 0, binaryFiles: 0 }));
+
+  return {
+    isRepo: true,
+    repoRoot: snapshot.repoRoot,
+    branch: snapshot.branch,
+    tracking: snapshot.tracking,
+    dirty,
+    hasHeadCommit,
+    hasPushRemote,
+    ahead,
+    behind,
+    localOnlyCommitCount,
+    state,
+    canPush,
+    publishedToRemote,
+    files: snapshot.files,
+    diff,
+  };
+}
+
+async function readGitStatusSnapshot(cwd) {
+  const [porcelain, repoRoot] = await Promise.all([
     git(cwd, "status", "--porcelain=v1", "-b"),
-    revListCounts(cwd).catch(() => ({ ahead: 0, behind: 0 })),
     resolveRepoRoot(cwd).catch(() => null),
   ]);
 
@@ -184,45 +220,27 @@ async function gitStatus(cwd) {
 
   const branch = parseBranchFromStatus(branchLine);
   const tracking = parseTrackingFromStatus(branchLine);
+  const detached = branchLine.includes("HEAD detached") || branchLine.includes("no branch");
   const files = fileLines.map((line) => ({
     path: line.substring(3).trim(),
     status: line.substring(0, 2).trim(),
   }));
 
-  const dirty = files.length > 0;
-  const { ahead, behind } = branchInfo;
-  const detached = branchLine.includes("HEAD detached") || branchLine.includes("no branch");
-  const noUpstream = tracking === null && !detached;
-  const hasHeadCommit = await refExists(cwd, "HEAD").catch(() => false);
-  const hasPushRemote = await pushRemoteAvailable(cwd, tracking).catch(() => false);
-  const publishedToRemote = !detached && !!branch && await remoteBranchExists(cwd, branch).catch(() => false);
-  const localOnlyCommitCount = await countLocalOnlyCommits(cwd, { detached }).catch(() => 0);
-  const state = computeState(dirty, ahead, behind, detached, noUpstream);
-  const canPush = hasPushRemote && hasHeadCommit && (ahead > 0 || noUpstream) && !detached;
-  const diff = await repoDiffTotals(cwd, {
-    tracking,
-    fileLines,
-  }).catch(() => ({ additions: 0, deletions: 0, binaryFiles: 0 }));
-
   return {
-    isRepo: true,
     repoRoot,
     branch,
     tracking,
-    dirty,
-    hasHeadCommit,
-    hasPushRemote,
-    ahead,
-    behind,
-    localOnlyCommitCount,
-    state,
-    canPush,
-    publishedToRemote,
+    detached,
+    fileLines,
     files,
-    diff,
   };
 }
 
+async function freshBranchInfoForStatus(cwd, snapshot) {
+  await refreshStatusUpstreamIfNeeded(cwd, snapshot.tracking, snapshot.repoRoot).catch(() => false);
+  return await revListCounts(cwd).catch(() => ({ ahead: 0, behind: 0 }));
+}
+
 async function gitInit(cwd) {
   if (await isInsideGitWorkTree(cwd)) {
     throw gitError("already_git_repository", "This folder is already inside a Git repository.");
@@ -2506,6 +2524,52 @@ async function revListCounts(cwd) {
   };
 }
 
+// Keeps Update eligibility based on the current upstream ref, not stale local fetch data.
+async function refreshStatusUpstreamIfNeeded(cwd, tracking, repoRoot) {
+  const parsedTracking = parseTrackingRef(tracking);
+  if (!parsedTracking) {
+    return false;
+  }
+
+  const cacheKey = `${repoRoot || cwd}\0${parsedTracking.remote}\0${parsedTracking.branch}`;
+  const now = Date.now();
+  const lastFetchAt = statusUpstreamFetchCache.get(cacheKey) || 0;
+  if (now - lastFetchAt < STATUS_UPSTREAM_FETCH_TTL_MS) {
+    return false;
+  }
+
+  statusUpstreamFetchCache.set(cacheKey, now);
+  if (statusUpstreamFetchCache.size > 200) {
+    statusUpstreamFetchCache.clear();
+    statusUpstreamFetchCache.set(cacheKey, now);
+  }
+
+  await git(
+    cwd,
+    "fetch",
+    "--quiet",
+    parsedTracking.remote,
+    `+refs/heads/${parsedTracking.branch}:refs/remotes/${parsedTracking.remote}/${parsedTracking.branch}`
+  );
+  return true;
+}
+
+function parseTrackingRef(tracking) {
+  if (typeof tracking !== "string") {
+    return null;
+  }
+
+  const separatorIndex = tracking.indexOf("/");
+  if (separatorIndex <= 0 || separatorIndex === tracking.length - 1) {
+    return null;
+  }
+
+  return {
+    remote: tracking.slice(0, separatorIndex),
+    branch: tracking.slice(separatorIndex + 1),
+  };
+}
+
 function parseBranchFromStatus(line) {
   // "## main...origin/main" or "## main" or "## HEAD (no branch)"
   const match = line.match(/^## (.+?)(?:\.{3}|$)/);

package/src/ios-app-compatibility.js

@@ -4,10 +4,10 @@
 // Exports: version comparison + bridge/iPhone compatibility helpers
 // Depends on: none
 
-const MINIMUM_SUPPORTED_IOS_APP_VERSION = "1.5";
-const IOS_APP_COMPATIBILITY_GATE_BRIDGE_VERSION = "1.3.9";
-const LEGACY_BRIDGE_VERSION_FOR_IOS_1_0 = "1.3.7";
-const LEGACY_BRIDGE_DOWNGRADE_COMMAND = `npm install -g remodex@${LEGACY_BRIDGE_VERSION_FOR_IOS_1_0}`;
+const MINIMUM_SUPPORTED_IOS_APP_VERSION = "2.0";
+const IOS_APP_COMPATIBILITY_GATE_BRIDGE_VERSION = "2.0.0";
+const LEGACY_BRIDGE_VERSION_FOR_IOS_1_X = "1.5.1";
+const LEGACY_BRIDGE_DOWNGRADE_COMMAND = `npm install -g @makerbi/remodex@${LEGACY_BRIDGE_VERSION_FOR_IOS_1_X}`;
 const NOTICE_BOX_WIDTH = 74;
 
 function buildIOSAppCompatibilitySnapshot({
@@ -80,7 +80,7 @@ function buildSnapshot({
     isCompatible,
     requiresAppUpdate,
     minimumSupportedIOSAppVersion: MINIMUM_SUPPORTED_IOS_APP_VERSION,
-    legacyBridgeVersion: LEGACY_BRIDGE_VERSION_FOR_IOS_1_0,
+    legacyBridgeVersion: LEGACY_BRIDGE_VERSION_FOR_IOS_1_X,
     downgradeCommand: LEGACY_BRIDGE_DOWNGRADE_COMMAND,
     message,
   };
@@ -108,7 +108,7 @@ function buildLegacyIOSAppCompatibilityMessage({
   return `Remodex bridge ${normalizedBridgeVersion} requires Remodex iPhone `
     + `${MINIMUM_SUPPORTED_IOS_APP_VERSION} or later. `
     + `Update the iPhone app from the App Store first, or install Remodex bridge `
-    + `${LEGACY_BRIDGE_VERSION_FOR_IOS_1_0} to keep using iPhone ${normalizedIOSAppVersion}.`;
+    + `${LEGACY_BRIDGE_VERSION_FOR_IOS_1_X} to keep using iPhone ${normalizedIOSAppVersion}.`;
 }
 
 function buildCachedIOSAppCompatibilityWarning({
@@ -232,7 +232,7 @@ function splitVersionParts(value) {
 
 module.exports = {
   LEGACY_BRIDGE_DOWNGRADE_COMMAND,
-  LEGACY_BRIDGE_VERSION_FOR_IOS_1_0,
+  LEGACY_BRIDGE_VERSION_FOR_IOS_1_X,
   IOS_APP_COMPATIBILITY_GATE_BRIDGE_VERSION,
   MINIMUM_SUPPORTED_IOS_APP_VERSION,
   buildCachedIOSAppCompatibilityWarning,

package/src/macos-launch-agent.js

@@ -5,13 +5,14 @@
 // Depends on: child_process, fs, os, path, ./bridge, ./daemon-state, ./codex-desktop-refresher, ./qr, ./secure-device-state
 
 const { execFileSync } = require("child_process");
+const { createHash } = require("crypto");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
 const { startBridge } = require("./bridge");
 const { readBridgeConfig } = require("./codex-desktop-refresher");
 const { printQR } = require("./qr");
-const { resetBridgeTrustState } = require("./secure-device-state");
+const { readBridgeDeviceState, resetBridgeTrustState } = require("./secure-device-state");
 const {
   clearBridgeStatus,
   clearPairingSession,
@@ -276,6 +277,7 @@ function getMacOSBridgeServiceStatus({
     daemonConfig: sanitizedDaemonConfigForStatus(readDaemonConfig({ env, fsImpl })),
     bridgeStatus: readBridgeStatus({ env, fsImpl }),
     pairingSession: readPairingSession({ env, fsImpl }),
+    trustedDevice: buildTrustedDeviceSummary(readBridgeDeviceState()),
     stdoutLogPath: resolveBridgeStdoutLogPath({ env }),
     stderrLogPath: resolveBridgeStderrLogPath({ env }),
   };
@@ -301,12 +303,18 @@ function printMacOSBridgeServiceStatus(options = {}) {
   const bridgeState = status.bridgeStatus?.state || "unknown";
   const connectionStatus = status.bridgeStatus?.connectionStatus || "unknown";
   const pairingCreatedAt = status.pairingSession?.createdAt || "none";
+  const activeDevice = status.bridgeStatus?.activeDevice || status.bridgeStatus?.activePhone;
+  const trustedPhoneCount = status.trustedDevice?.trustedPhoneCount || 0;
+  const activeDeviceName = formatDeviceKind(activeDevice?.deviceKind) || "device";
+  const trustedDeviceName = formatDeviceKind(status.trustedDevice?.lastSeenDeviceKind) || "device";
   console.log(`[remodex] Service label: ${status.label}`);
   console.log(`[remodex] Installed: ${status.installed ? "yes" : "no"}`);
   console.log(`[remodex] Launchd loaded: ${status.launchdLoaded ? "yes" : "no"}`);
   console.log(`[remodex] PID: ${status.launchdPid || status.bridgeStatus?.pid || "unknown"}`);
   console.log(`[remodex] Bridge state: ${bridgeState}`);
   console.log(`[remodex] Connection: ${connectionStatus}`);
+  console.log(`[remodex] Active ${activeDeviceName}: ${activeDevice?.connected ? activeDevice.phoneFingerprint || "yes" : "no"}`);
+  console.log(`[remodex] Trusted ${trustedDeviceName}: ${trustedPhoneCount > 0 ? "yes" : "no"}`);
   console.log(`[remodex] Pairing payload: ${pairingCreatedAt}`);
   console.log(`[remodex] Stdout log: ${status.stdoutLogPath}`);
   console.log(`[remodex] Stderr log: ${status.stderrLogPath}`);
@@ -628,7 +636,44 @@ function normalizeNonEmptyString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : "";
 }
 
+function buildTrustedDeviceSummary(deviceState) {
+  const trustedPhoneEntries = Object.entries(deviceState?.trustedPhones || {})
+    .filter(([phoneDeviceId, publicKey]) => normalizeNonEmptyString(phoneDeviceId) && normalizeNonEmptyString(publicKey));
+  const firstTrustedPhoneId = trustedPhoneEntries[0]?.[0] || "";
+  const lastSeenPhoneAppVersion = normalizeNonEmptyString(deviceState?.lastSeenPhoneAppVersion) || null;
+  return {
+    macDeviceFingerprint: shortFingerprint(deviceState?.macDeviceId),
+    trustedPhoneCount: trustedPhoneEntries.length,
+    trustedPhoneFingerprint: shortFingerprint(firstTrustedPhoneId),
+    lastSeenDeviceKind: normalizeNonEmptyString(deviceState?.lastSeenDeviceKind) || (lastSeenPhoneAppVersion ? "iphone" : null),
+    lastSeenPhoneAppVersion,
+  };
+}
+
+function formatDeviceKind(deviceKind) {
+  const normalized = normalizeNonEmptyString(deviceKind).toLowerCase();
+  if (normalized === "iphone") {
+    return "iPhone";
+  }
+  if (normalized === "android") {
+    return "Android";
+  }
+  if (normalized === "mac") {
+    return "Mac";
+  }
+  return "";
+}
+
+function shortFingerprint(value) {
+  const normalized = normalizeNonEmptyString(value);
+  if (!normalized) {
+    return null;
+  }
+  return createHash("sha256").update(normalized).digest("hex").slice(0, 8);
+}
+
 module.exports = {
+  buildTrustedDeviceSummary,
   buildLaunchAgentPlist,
   getMacOSBridgeServiceStatus,
   mergeBridgeStatusForDaemon,

package/src/qr.js

@@ -9,7 +9,6 @@ const qrcode = require("qrcode-terminal");
 
 const SHORT_PAIRING_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
 const SHORT_PAIRING_CODE_LENGTH = 10;
-
 // Generates a short-lived human-friendly pairing token for reconnect flows.
 function createShortPairingCode({
   length = SHORT_PAIRING_CODE_LENGTH,
@@ -50,7 +49,7 @@ function printQR(pairingSessionOrPayload, options = {}) {
   console.log("\nScan this QR with the iPhone:\n");
   qrcode.generate(payload, { small: true });
   if (pairingCode) {
-    console.log("Or paste this pairing code in the iPhone app:\n");
+    console.log("Or enter this pairing code in the iPhone app:\n");
     console.log(pairingCode);
   }
   console.log(`\nSession ID: ${sessionIdShort || "(none)"}`);
@@ -58,9 +57,7 @@ function printQR(pairingSessionOrPayload, options = {}) {
   console.log(`Expires: ${new Date(pairingPayload.expiresAt).toISOString()}\n`);
 
   if (shouldPrintPairingJson({ env, explicitValue: options.printPairingJson })) {
-    // Opt-in only: this is the same bearer-like payload as the QR scan target.
-    console.log("Pairing JSON (debug only; same sensitive bytes as the QR):\n");
-    console.log(`${payload}\n`);
+    console.log("Pairing JSON debug output is disabled because the payload contains private relay metadata.\n");
   }
 }
 

package/src/secure-device-state.js

@@ -1,7 +1,7 @@
 // FILE: secure-device-state.js
-// Purpose: Persists canonical bridge identity, trusted-phone state, and last seen iPhone app version for local QR pairing.
+// Purpose: Persists canonical bridge identity, trusted mobile state, and last seen companion metadata for local QR pairing.
 // Layer: CLI helper
-// Exports: loadOrCreateBridgeDeviceState, readBridgeDeviceState, resetBridgeDeviceState, resetBridgeTrustState, rememberTrustedPhone, rememberLastSeenPhoneAppVersion, getTrustedPhonePublicKey, resolveBridgeRelaySession
+// Exports: loadOrCreateBridgeDeviceState, readBridgeDeviceState, resetBridgeDeviceState, resetBridgeTrustState, rememberTrustedPhone, rememberLastSeenPhoneAppVersion, rememberLastSeenClientDeviceKind, getTrustedPhonePublicKey, resolveBridgeRelaySession
 // Depends on: fs, os, path, crypto, child_process
 
 const fs = require("fs");
@@ -153,6 +153,22 @@ function rememberLastSeenPhoneAppVersion(state, phoneAppVersion, { persist = tru
   return nextState;
 }
 
+function rememberLastSeenClientDeviceKind(state, deviceKind, { persist = true } = {}) {
+  const normalizedDeviceKind = normalizeDeviceKind(deviceKind);
+  if (!normalizedDeviceKind) {
+    return state;
+  }
+
+  const nextState = normalizeBridgeDeviceState({
+    ...state,
+    lastSeenDeviceKind: normalizedDeviceKind,
+  });
+  if (persist) {
+    writeBridgeDeviceState(nextState);
+  }
+  return nextState;
+}
+
 function getTrustedPhonePublicKey(state, phoneDeviceId) {
   const normalizedDeviceId = normalizeNonEmptyString(phoneDeviceId);
   if (!normalizedDeviceId) {
@@ -176,6 +192,7 @@ function createBridgeDeviceState() {
     macIdentityPublicKey: base64UrlToBase64(publicJwk.x),
     macIdentityPrivateKey: base64UrlToBase64(privateJwk.d),
     trustedPhones: {},
+    lastSeenDeviceKind: null,
     lastSeenPhoneAppVersion: null,
   };
 }
@@ -385,6 +402,8 @@ function normalizeBridgeDeviceState(rawState) {
   const macIdentityPublicKey = normalizeNonEmptyString(rawState?.macIdentityPublicKey);
   const macIdentityPrivateKey = normalizeNonEmptyString(rawState?.macIdentityPrivateKey);
   const lastSeenPhoneAppVersion = normalizeNonEmptyString(rawState?.lastSeenPhoneAppVersion) || null;
+  const lastSeenDeviceKind = normalizeDeviceKind(rawState?.lastSeenDeviceKind)
+    || inferLegacyDeviceKind({ lastSeenPhoneAppVersion });
 
   if (!macDeviceId || !macIdentityPublicKey || !macIdentityPrivateKey) {
     throw new Error("Bridge device state is incomplete");
@@ -408,6 +427,7 @@ function normalizeBridgeDeviceState(rawState) {
     macIdentityPublicKey,
     macIdentityPrivateKey,
     trustedPhones,
+    lastSeenDeviceKind,
     lastSeenPhoneAppVersion,
   };
 }
@@ -430,6 +450,24 @@ function recoverBridgeDeviceIdentity(state, { fallbackState = null } = {}) {
   return nextState;
 }
 
+function normalizeDeviceKind(value) {
+  const normalized = normalizeNonEmptyString(value).toLowerCase();
+  if (normalized === "ios" || normalized === "iphone") {
+    return "iphone";
+  }
+  if (normalized === "android") {
+    return "android";
+  }
+  if (normalized === "mac" || normalized === "macos" || normalized === "darwin") {
+    return "mac";
+  }
+  return normalized || null;
+}
+
+function inferLegacyDeviceKind({ lastSeenPhoneAppVersion } = {}) {
+  return lastSeenPhoneAppVersion ? "iphone" : null;
+}
+
 function bridgeStatesEqual(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
@@ -475,6 +513,7 @@ module.exports = {
   getTrustedPhonePublicKey,
   loadOrCreateBridgeDeviceState,
   readBridgeDeviceState,
+  rememberLastSeenClientDeviceKind,
   rememberLastSeenPhoneAppVersion,
   rememberTrustedPhone,
   resetBridgeDeviceState,

package/src/secure-transport.js

@@ -39,6 +39,7 @@ function createBridgeSecureTransport({
   deviceState,
   displayName = "",
   onTrustedPhoneUpdate = null,
+  onSecureSessionReady = null,
   persistTrustedPhone = true,
 }) {
   let currentDeviceState = deviceState;
@@ -382,7 +383,13 @@ function createBridgeSecureTransport({
       activeSession.firstOutboundSeq = nextBridgeOutboundSeq;
     }
 
+    const completedHandshakeMode = pendingHandshake.handshakeMode;
     pendingHandshake = null;
+    onSecureSessionReady?.({
+      phoneDeviceId: activeSession.phoneDeviceId,
+      handshakeMode: completedHandshakeMode,
+      keyEpoch: activeSession.keyEpoch,
+    });
     sendControlMessage({
       kind: "secureReady",
       sessionId,

package/src/session-jsonl-history.js

@@ -1,5 +1,6 @@
 // FILE: session-jsonl-history.js
-// Purpose: Reconstructs a small thread/turns/list page from local Codex session JSONL files.
+// Purpose: Reconstructs a small thread/turns/list page from local Codex session JSONL files,
+// including desktop-local timestamp metadata for mobile history rendering.
 
 const fs = require("fs");
 const { buildApplyPatchFileChangeItem } = require("./apply-patch-changes");
@@ -83,6 +84,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
   let activeTurnId = "";
   let sessionThreadId = normalizeString(threadId);
   let sessionCwd = "";
+  let sessionTimeZone = "";
   const skippedCallIds = new Set();
   const toolCallsByCallId = new Map();
   const pendingUserMessages = [];
@@ -115,6 +117,26 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
         || normalizeString(payload?.thread_id)
         || normalizeString(payload?.threadId);
       sessionCwd ||= normalizeString(payload?.cwd);
+      sessionTimeZone ||= normalizeString(payload?.timezone)
+        || normalizeString(payload?.timeZone)
+        || normalizeString(payload?.time_zone);
+      continue;
+    }
+
+    if (entry?.type === "turn_context") {
+      const payload = objectValue(entry.payload);
+      sessionCwd = normalizeString(payload?.cwd) || sessionCwd;
+      sessionTimeZone = normalizeString(payload?.timezone)
+        || normalizeString(payload?.timeZone)
+        || normalizeString(payload?.time_zone)
+        || sessionTimeZone;
+      activeTurnId = normalizeString(payload?.turn_id)
+        || normalizeString(payload?.turnId)
+        || activeTurnId;
+      if (activeTurnId) {
+        const turn = ensureTurn(turns, turnsById, activeTurnId, sessionThreadId, entry.timestamp);
+        applyHistoryTimeZone(turn, sessionTimeZone);
+      }
       continue;
     }
 
@@ -127,6 +149,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
           || activeTurnId
           || `turn-line-${index + 1}`;
         const turn = ensureTurn(turns, turnsById, activeTurnId, sessionThreadId, entry.timestamp);
+        applyHistoryTimeZone(turn, sessionTimeZone);
         flushPendingUserMessagesToTurn(turn, pendingUserMessages);
         continue;
       }
@@ -139,6 +162,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
           sessionThreadId,
           entry.timestamp
         );
+        applyHistoryTimeZone(turn, sessionTimeZone);
         turn.status = "completed";
         activeTurnId = "";
         continue;
@@ -162,6 +186,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
           toolCallsByCallId,
         });
         if (item) {
+          applyHistoryTimeZone(item, sessionTimeZone);
           turn.items.push(item);
         }
         continue;
@@ -170,6 +195,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
       if (eventType === "user_message") {
         const explicitTurnId = normalizeString(payload?.turn_id) || normalizeString(payload?.turnId);
         const item = createUserMessageHistoryItem(payload, index + 1, entry.timestamp);
+        applyHistoryTimeZone(item, sessionTimeZone);
         if (!explicitTurnId && !activeTurnId) {
           pushPendingUserMessage(pendingUserMessages, item);
           continue;
@@ -182,6 +208,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
           sessionThreadId,
           entry.timestamp
         );
+        applyHistoryTimeZone(turn, sessionTimeZone);
         addHistoryItemToTurn(turn, item);
         continue;
       }
@@ -207,6 +234,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
         sessionThreadId,
         entry.timestamp
       );
+      applyHistoryTimeZone(turn, sessionTimeZone);
       const item = normalizeResponseItemForHistory(payload, index + 1, {
         cwd: sessionCwd,
         toolCallsByCallId,
@@ -222,6 +250,7 @@ function parseSessionJsonlTurns(content, { threadId = "" } = {}) {
         if (itemTimestamp && !item.timestamp) {
           item.timestamp = itemTimestamp;
         }
+        applyHistoryTimeZone(item, sessionTimeZone);
         addHistoryItemToTurn(turn, item);
       }
     }
@@ -336,6 +365,12 @@ function historyItemTimestamp(item, fallbackTimestamp = "") {
   return firstNonEmptyString([
     normalizeString(item?.createdAt),
     normalizeString(item?.created_at),
+    normalizeString(item?.startedAt),
+    normalizeString(item?.started_at),
+    normalizeString(item?.completedAt),
+    normalizeString(item?.completed_at),
+    normalizeString(item?.endedAt),
+    normalizeString(item?.ended_at),
     normalizeString(item?.timestamp),
     normalizeString(item?.time),
     normalizeString(fallbackTimestamp),
@@ -379,6 +414,7 @@ function flushPendingUserMessagesToTurn(turn, pendingUserMessages) {
   }
 
   for (const item of pendingUserMessages.splice(0)) {
+    applyHistoryTimeZone(item, normalizeString(turn.timeZone) || normalizeString(turn.timezone));
     addHistoryItemToTurn(turn, item);
   }
 }
@@ -403,6 +439,23 @@ function ensureTurn(turns, turnsById, turnId, threadId, timestamp) {
   return turn;
 }
 
+function applyHistoryTimeZone(target, timeZone) {
+  const normalizedTimeZone = normalizeString(timeZone);
+  if (!target || !normalizedTimeZone) {
+    return target;
+  }
+  if (!target.timeZoneIdentifier) {
+    target.timeZoneIdentifier = normalizedTimeZone;
+  }
+  if (!target.timeZone) {
+    target.timeZone = normalizedTimeZone;
+  }
+  if (!target.timezone) {
+    target.timezone = normalizedTimeZone;
+  }
+  return target;
+}
+
 function normalizeResponseItemForHistory(payload, lineNumber, { cwd = "", toolCallsByCallId = new Map() } = {}) {
   const type = normalizeHistoryItemType(payload.type);
   if (!type) {

package/src/voice-handler.js

@@ -8,7 +8,8 @@ const OPENAI_TRANSCRIPTIONS_URL = "https://api.openai.com/v1/audio/transcription
 const CHATGPT_TRANSCRIPTIONS_URL = "https://chatgpt.com/backend-api/transcribe";
 const DEFAULT_TRANSCRIPTION_MODEL = "gpt-4o-mini-transcribe";
 const MAX_AUDIO_BYTES = 10 * 1024 * 1024;
-const MAX_DURATION_MS = 120_000;
+const MAX_DURATION_SECONDS = 150;
+const MAX_DURATION_MS = MAX_DURATION_SECONDS * 1_000;
 
 function createVoiceHandler({
   sendCodexRequest,
@@ -95,7 +96,7 @@ async function transcribeVoice(
     throw voiceError("invalid_duration", "Voice messages must include a positive duration.");
   }
   if (durationMs > MAX_DURATION_MS) {
-    throw voiceError("duration_too_long", "Voice messages are limited to 120 seconds.");
+    throw voiceError("duration_too_long", `Voice messages are limited to ${MAX_DURATION_SECONDS} seconds.`);
   }
 
   const audioBuffer = decodeAudioBase64(params.audioBase64);
@@ -283,7 +284,36 @@ function normalizeBase64(value) {
 }
 
 function isLikelyBase64(value) {
-  return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value);
+  if (typeof value !== "string" || value.length === 0 || value.length % 4 !== 0) {
+    return false;
+  }
+
+  const paddingStart = value.indexOf("=");
+  if (paddingStart !== -1) {
+    const paddingLength = value.length - paddingStart;
+    if (paddingLength > 2) {
+      return false;
+    }
+    for (let i = paddingStart; i < value.length; i += 1) {
+      if (value[i] !== "=") {
+        return false;
+      }
+    }
+  }
+
+  // Avoid one giant regex: V8 can overflow its stack on multi-MB voice clips.
+  const dataEnd = paddingStart === -1 ? value.length : paddingStart;
+  for (let i = 0; i < dataEnd; i += 1) {
+    const code = value.charCodeAt(i);
+    const isUppercase = code >= 65 && code <= 90;
+    const isLowercase = code >= 97 && code <= 122;
+    const isDigit = code >= 48 && code <= 57;
+    if (!isUppercase && !isLowercase && !isDigit && value[i] !== "+" && value[i] !== "/") {
+      return false;
+    }
+  }
+
+  return true;
 }
 
 function hasRiffWaveHeader(buffer) {