@makerbi/remodex 1.5.8 → 2.0.1

package/src/git-handler.js

@@ -20,9 +20,11 @@ const GITHUB_CLI_TIMEOUT_MS = 120_000;
 const GIT_DRAFT_PATCH_MAX_BYTES = 80_000;
 const EMPTY_TREE_HASH = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 const DEFAULT_GIT_WRITER_MODEL = "gpt-5.4-mini";
+const STATUS_UPSTREAM_FETCH_TTL_MS = 15_000;
 
 let runStructuredCodexJsonImpl = runStructuredCodexJson;
 let runGitHubCliImpl = runGitHubCli;
+const statusUpstreamFetchCache = new Map();
 
 function resolveGitWriterModel(rawModel) {
   const trimmed = typeof rawModel === "string" ? rawModel.trim() : "";
@@ -172,9 +174,43 @@ async function gitStatus(cwd) {
     return nonRepositoryStatus(cwd);
   }
 
-  const [porcelain, branchInfo, repoRoot] = await Promise.all([
+  const snapshot = await readGitStatusSnapshot(cwd);
+  const { ahead, behind } = await freshBranchInfoForStatus(cwd, snapshot);
+  const dirty = snapshot.files.length > 0;
+  const noUpstream = snapshot.tracking === null && !snapshot.detached;
+  const hasHeadCommit = await refExists(cwd, "HEAD").catch(() => false);
+  const hasPushRemote = await pushRemoteAvailable(cwd, snapshot.tracking).catch(() => false);
+  const publishedToRemote = !snapshot.detached && !!snapshot.branch && await remoteBranchExists(cwd, snapshot.branch).catch(() => false);
+  const localOnlyCommitCount = await countLocalOnlyCommits(cwd, { detached: snapshot.detached }).catch(() => 0);
+  const state = computeState(dirty, ahead, behind, snapshot.detached, noUpstream);
+  const canPush = hasPushRemote && hasHeadCommit && (ahead > 0 || noUpstream) && !snapshot.detached;
+  const diff = await repoDiffTotals(cwd, {
+    tracking: snapshot.tracking,
+    fileLines: snapshot.fileLines,
+  }).catch(() => ({ additions: 0, deletions: 0, binaryFiles: 0 }));
+
+  return {
+    isRepo: true,
+    repoRoot: snapshot.repoRoot,
+    branch: snapshot.branch,
+    tracking: snapshot.tracking,
+    dirty,
+    hasHeadCommit,
+    hasPushRemote,
+    ahead,
+    behind,
+    localOnlyCommitCount,
+    state,
+    canPush,
+    publishedToRemote,
+    files: snapshot.files,
+    diff,
+  };
+}
+
+async function readGitStatusSnapshot(cwd) {
+  const [porcelain, repoRoot] = await Promise.all([
     git(cwd, "status", "--porcelain=v1", "-b"),
-    revListCounts(cwd).catch(() => ({ ahead: 0, behind: 0 })),
     resolveRepoRoot(cwd).catch(() => null),
   ]);
 
@@ -184,45 +220,27 @@ async function gitStatus(cwd) {
 
   const branch = parseBranchFromStatus(branchLine);
   const tracking = parseTrackingFromStatus(branchLine);
+  const detached = branchLine.includes("HEAD detached") || branchLine.includes("no branch");
   const files = fileLines.map((line) => ({
     path: line.substring(3).trim(),
     status: line.substring(0, 2).trim(),
   }));
 
-  const dirty = files.length > 0;
-  const { ahead, behind } = branchInfo;
-  const detached = branchLine.includes("HEAD detached") || branchLine.includes("no branch");
-  const noUpstream = tracking === null && !detached;
-  const hasHeadCommit = await refExists(cwd, "HEAD").catch(() => false);
-  const hasPushRemote = await pushRemoteAvailable(cwd, tracking).catch(() => false);
-  const publishedToRemote = !detached && !!branch && await remoteBranchExists(cwd, branch).catch(() => false);
-  const localOnlyCommitCount = await countLocalOnlyCommits(cwd, { detached }).catch(() => 0);
-  const state = computeState(dirty, ahead, behind, detached, noUpstream);
-  const canPush = hasPushRemote && hasHeadCommit && (ahead > 0 || noUpstream) && !detached;
-  const diff = await repoDiffTotals(cwd, {
-    tracking,
-    fileLines,
-  }).catch(() => ({ additions: 0, deletions: 0, binaryFiles: 0 }));
-
   return {
-    isRepo: true,
     repoRoot,
     branch,
     tracking,
-    dirty,
-    hasHeadCommit,
-    hasPushRemote,
-    ahead,
-    behind,
-    localOnlyCommitCount,
-    state,
-    canPush,
-    publishedToRemote,
+    detached,
+    fileLines,
     files,
-    diff,
   };
 }
 
+async function freshBranchInfoForStatus(cwd, snapshot) {
+  await refreshStatusUpstreamIfNeeded(cwd, snapshot.tracking, snapshot.repoRoot).catch(() => false);
+  return await revListCounts(cwd).catch(() => ({ ahead: 0, behind: 0 }));
+}
+
 async function gitInit(cwd) {
   if (await isInsideGitWorkTree(cwd)) {
     throw gitError("already_git_repository", "This folder is already inside a Git repository.");
@@ -2506,6 +2524,52 @@ async function revListCounts(cwd) {
   };
 }
 
+// Keeps Update eligibility based on the current upstream ref, not stale local fetch data.
+async function refreshStatusUpstreamIfNeeded(cwd, tracking, repoRoot) {
+  const parsedTracking = parseTrackingRef(tracking);
+  if (!parsedTracking) {
+    return false;
+  }
+
+  const cacheKey = `${repoRoot || cwd}\0${parsedTracking.remote}\0${parsedTracking.branch}`;
+  const now = Date.now();
+  const lastFetchAt = statusUpstreamFetchCache.get(cacheKey) || 0;
+  if (now - lastFetchAt < STATUS_UPSTREAM_FETCH_TTL_MS) {
+    return false;
+  }
+
+  statusUpstreamFetchCache.set(cacheKey, now);
+  if (statusUpstreamFetchCache.size > 200) {
+    statusUpstreamFetchCache.clear();
+    statusUpstreamFetchCache.set(cacheKey, now);
+  }
+
+  await git(
+    cwd,
+    "fetch",
+    "--quiet",
+    parsedTracking.remote,
+    `+refs/heads/${parsedTracking.branch}:refs/remotes/${parsedTracking.remote}/${parsedTracking.branch}`
+  );
+  return true;
+}
+
+function parseTrackingRef(tracking) {
+  if (typeof tracking !== "string") {
+    return null;
+  }
+
+  const separatorIndex = tracking.indexOf("/");
+  if (separatorIndex <= 0 || separatorIndex === tracking.length - 1) {
+    return null;
+  }
+
+  return {
+    remote: tracking.slice(0, separatorIndex),
+    branch: tracking.slice(separatorIndex + 1),
+  };
+}
+
 function parseBranchFromStatus(line) {
   // "## main...origin/main" or "## main" or "## HEAD (no branch)"
   const match = line.match(/^## (.+?)(?:\.{3}|$)/);

package/src/ios-app-compatibility.js

@@ -4,10 +4,10 @@
 // Exports: version comparison + bridge/iPhone compatibility helpers
 // Depends on: none
 
-const MINIMUM_SUPPORTED_IOS_APP_VERSION = "1.5";
-const IOS_APP_COMPATIBILITY_GATE_BRIDGE_VERSION = "1.3.9";
-const LEGACY_BRIDGE_VERSION_FOR_IOS_1_0 = "1.3.7";
-const LEGACY_BRIDGE_DOWNGRADE_COMMAND = `npm install -g remodex@${LEGACY_BRIDGE_VERSION_FOR_IOS_1_0}`;
+const MINIMUM_SUPPORTED_IOS_APP_VERSION = "2.0";
+const IOS_APP_COMPATIBILITY_GATE_BRIDGE_VERSION = "2.0.0";
+const LEGACY_BRIDGE_VERSION_FOR_IOS_1_X = "1.5.1";
+const LEGACY_BRIDGE_DOWNGRADE_COMMAND = `npm install -g @makerbi/remodex@${LEGACY_BRIDGE_VERSION_FOR_IOS_1_X}`;
 const NOTICE_BOX_WIDTH = 74;
 
 function buildIOSAppCompatibilitySnapshot({
@@ -80,7 +80,7 @@ function buildSnapshot({
     isCompatible,
     requiresAppUpdate,
     minimumSupportedIOSAppVersion: MINIMUM_SUPPORTED_IOS_APP_VERSION,
-    legacyBridgeVersion: LEGACY_BRIDGE_VERSION_FOR_IOS_1_0,
+    legacyBridgeVersion: LEGACY_BRIDGE_VERSION_FOR_IOS_1_X,
     downgradeCommand: LEGACY_BRIDGE_DOWNGRADE_COMMAND,
     message,
   };
@@ -108,7 +108,7 @@ function buildLegacyIOSAppCompatibilityMessage({
   return `Remodex bridge ${normalizedBridgeVersion} requires Remodex iPhone `
     + `${MINIMUM_SUPPORTED_IOS_APP_VERSION} or later. `
     + `Update the iPhone app from the App Store first, or install Remodex bridge `
-    + `${LEGACY_BRIDGE_VERSION_FOR_IOS_1_0} to keep using iPhone ${normalizedIOSAppVersion}.`;
+    + `${LEGACY_BRIDGE_VERSION_FOR_IOS_1_X} to keep using iPhone ${normalizedIOSAppVersion}.`;
 }
 
 function buildCachedIOSAppCompatibilityWarning({
@@ -232,7 +232,7 @@ function splitVersionParts(value) {
 
 module.exports = {
   LEGACY_BRIDGE_DOWNGRADE_COMMAND,
-  LEGACY_BRIDGE_VERSION_FOR_IOS_1_0,
+  LEGACY_BRIDGE_VERSION_FOR_IOS_1_X,
   IOS_APP_COMPATIBILITY_GATE_BRIDGE_VERSION,
   MINIMUM_SUPPORTED_IOS_APP_VERSION,
   buildCachedIOSAppCompatibilityWarning,

package/src/macos-launch-agent.js

@@ -5,13 +5,14 @@
 // Depends on: child_process, fs, os, path, ./bridge, ./daemon-state, ./codex-desktop-refresher, ./qr, ./secure-device-state
 
 const { execFileSync } = require("child_process");
+const { createHash } = require("crypto");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
 const { startBridge } = require("./bridge");
 const { readBridgeConfig } = require("./codex-desktop-refresher");
 const { printQR } = require("./qr");
-const { resetBridgeTrustState } = require("./secure-device-state");
+const { readBridgeDeviceState, resetBridgeTrustState } = require("./secure-device-state");
 const {
   clearBridgeStatus,
   clearPairingSession,
@@ -276,6 +277,7 @@ function getMacOSBridgeServiceStatus({
     daemonConfig: sanitizedDaemonConfigForStatus(readDaemonConfig({ env, fsImpl })),
     bridgeStatus: readBridgeStatus({ env, fsImpl }),
     pairingSession: readPairingSession({ env, fsImpl }),
+    trustedDevice: buildTrustedDeviceSummary(readBridgeDeviceState()),
     stdoutLogPath: resolveBridgeStdoutLogPath({ env }),
     stderrLogPath: resolveBridgeStderrLogPath({ env }),
   };
@@ -301,12 +303,18 @@ function printMacOSBridgeServiceStatus(options = {}) {
   const bridgeState = status.bridgeStatus?.state || "unknown";
   const connectionStatus = status.bridgeStatus?.connectionStatus || "unknown";
   const pairingCreatedAt = status.pairingSession?.createdAt || "none";
+  const activeDevice = status.bridgeStatus?.activeDevice || status.bridgeStatus?.activePhone;
+  const trustedPhoneCount = status.trustedDevice?.trustedPhoneCount || 0;
+  const activeDeviceName = formatDeviceKind(activeDevice?.deviceKind) || "device";
+  const trustedDeviceName = formatDeviceKind(status.trustedDevice?.lastSeenDeviceKind) || "device";
   console.log(`[remodex] Service label: ${status.label}`);
   console.log(`[remodex] Installed: ${status.installed ? "yes" : "no"}`);
   console.log(`[remodex] Launchd loaded: ${status.launchdLoaded ? "yes" : "no"}`);
   console.log(`[remodex] PID: ${status.launchdPid || status.bridgeStatus?.pid || "unknown"}`);
   console.log(`[remodex] Bridge state: ${bridgeState}`);
   console.log(`[remodex] Connection: ${connectionStatus}`);
+  console.log(`[remodex] Active ${activeDeviceName}: ${activeDevice?.connected ? activeDevice.phoneFingerprint || "yes" : "no"}`);
+  console.log(`[remodex] Trusted ${trustedDeviceName}: ${trustedPhoneCount > 0 ? "yes" : "no"}`);
   console.log(`[remodex] Pairing payload: ${pairingCreatedAt}`);
   console.log(`[remodex] Stdout log: ${status.stdoutLogPath}`);
   console.log(`[remodex] Stderr log: ${status.stderrLogPath}`);
@@ -628,7 +636,44 @@ function normalizeNonEmptyString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : "";
 }
 
+function buildTrustedDeviceSummary(deviceState) {
+  const trustedPhoneEntries = Object.entries(deviceState?.trustedPhones || {})
+    .filter(([phoneDeviceId, publicKey]) => normalizeNonEmptyString(phoneDeviceId) && normalizeNonEmptyString(publicKey));
+  const firstTrustedPhoneId = trustedPhoneEntries[0]?.[0] || "";
+  const lastSeenPhoneAppVersion = normalizeNonEmptyString(deviceState?.lastSeenPhoneAppVersion) || null;
+  return {
+    macDeviceFingerprint: shortFingerprint(deviceState?.macDeviceId),
+    trustedPhoneCount: trustedPhoneEntries.length,
+    trustedPhoneFingerprint: shortFingerprint(firstTrustedPhoneId),
+    lastSeenDeviceKind: normalizeNonEmptyString(deviceState?.lastSeenDeviceKind) || (lastSeenPhoneAppVersion ? "iphone" : null),
+    lastSeenPhoneAppVersion,
+  };
+}
+
+function formatDeviceKind(deviceKind) {
+  const normalized = normalizeNonEmptyString(deviceKind).toLowerCase();
+  if (normalized === "iphone") {
+    return "iPhone";
+  }
+  if (normalized === "android") {
+    return "Android";
+  }
+  if (normalized === "mac") {
+    return "Mac";
+  }
+  return "";
+}
+
+function shortFingerprint(value) {
+  const normalized = normalizeNonEmptyString(value);
+  if (!normalized) {
+    return null;
+  }
+  return createHash("sha256").update(normalized).digest("hex").slice(0, 8);
+}
+
 module.exports = {
+  buildTrustedDeviceSummary,
   buildLaunchAgentPlist,
   getMacOSBridgeServiceStatus,
   mergeBridgeStatusForDaemon,

package/src/qr.js

@@ -9,7 +9,6 @@ const qrcode = require("qrcode-terminal");
 
 const SHORT_PAIRING_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
 const SHORT_PAIRING_CODE_LENGTH = 10;
-
 // Generates a short-lived human-friendly pairing token for reconnect flows.
 function createShortPairingCode({
   length = SHORT_PAIRING_CODE_LENGTH,
@@ -50,7 +49,7 @@ function printQR(pairingSessionOrPayload, options = {}) {
   console.log("\nScan this QR with the iPhone:\n");
   qrcode.generate(payload, { small: true });
   if (pairingCode) {
-    console.log("Or paste this pairing code in the iPhone app:\n");
+    console.log("Or enter this pairing code in the iPhone app:\n");
     console.log(pairingCode);
   }
   console.log(`\nSession ID: ${sessionIdShort || "(none)"}`);
@@ -58,9 +57,7 @@ function printQR(pairingSessionOrPayload, options = {}) {
   console.log(`Expires: ${new Date(pairingPayload.expiresAt).toISOString()}\n`);
 
   if (shouldPrintPairingJson({ env, explicitValue: options.printPairingJson })) {
-    // Opt-in only: this is the same bearer-like payload as the QR scan target.
-    console.log("Pairing JSON (debug only; same sensitive bytes as the QR):\n");
-    console.log(`${payload}\n`);
+    console.log("Pairing JSON debug output is disabled because the payload contains private relay metadata.\n");
   }
 }
 

package/src/rollout-live-mirror.js

@@ -18,6 +18,10 @@ const DEFAULT_POLL_INTERVAL_MS = 700;
 const DEFAULT_LOOKUP_TIMEOUT_MS = 5_000;
 const DEFAULT_IDLE_TIMEOUT_MS = 60_000;
 const DEFAULT_ACTIVITY_HEARTBEAT_MS = 5_000;
+const DEFAULT_BOOTSTRAP_REPLAY_BATCH_INTERVAL_MS = 0;
+const BOOTSTRAP_REPLAY_CHUNK_SIZE = 50;
+const BOOTSTRAP_REPLAY_CHUNK_MAX_BYTES = 128 * 1024;
+const BOOTSTRAP_REPLAY_CACHE_LIMIT = 32;
 const DESKTOP_RESUME_METHODS = new Set(["thread/read", "thread/resume"]);
 
 // Observes desktop-authored rollout files and replays the currently active run as
@@ -29,12 +33,16 @@ function createRolloutLiveMirrorController({
   now = () => Date.now(),
   setIntervalFn = setInterval,
   clearIntervalFn = clearInterval,
+  setTimeoutFn = setTimeout,
+  clearTimeoutFn = clearTimeout,
   pollIntervalMs = DEFAULT_POLL_INTERVAL_MS,
   lookupTimeoutMs = DEFAULT_LOOKUP_TIMEOUT_MS,
   idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS,
   activityHeartbeatMs = DEFAULT_ACTIVITY_HEARTBEAT_MS,
+  bootstrapReplayBatchIntervalMs = DEFAULT_BOOTSTRAP_REPLAY_BATCH_INTERVAL_MS,
 } = {}) {
   const mirrorsByThreadId = new Map();
+  const bootstrapReplayCache = new Map();
 
   function observeInbound(rawMessage) {
     const request = safeParseJSON(rawMessage);
@@ -63,10 +71,14 @@ function createRolloutLiveMirrorController({
       now,
       setIntervalFn,
       clearIntervalFn,
+      setTimeoutFn,
+      clearTimeoutFn,
       pollIntervalMs,
       lookupTimeoutMs,
       idleTimeoutMs,
       activityHeartbeatMs,
+      bootstrapReplayBatchIntervalMs,
+      bootstrapReplayCache,
       onStop() {
         if (mirrorsByThreadId.get(threadId) === mirror) {
           mirrorsByThreadId.delete(threadId);
@@ -99,14 +111,19 @@ function createThreadRolloutLiveMirror({
   now,
   setIntervalFn,
   clearIntervalFn,
+  setTimeoutFn,
+  clearTimeoutFn,
   pollIntervalMs,
   lookupTimeoutMs,
   idleTimeoutMs,
   activityHeartbeatMs,
+  bootstrapReplayBatchIntervalMs,
+  bootstrapReplayCache,
   onStop = () => {},
 }) {
   const startedAt = now();
   const state = createMirrorState(threadId);
+  const bootstrapReplayTimeouts = new Set();
 
   let isStopped = false;
   let rolloutPath = null;
@@ -151,6 +168,10 @@ function createThreadRolloutLiveMirror({
           state,
           fsModule,
           sendApplicationResponse,
+          bootstrapReplayCache,
+          setTimeoutFn,
+          bootstrapReplayBatchIntervalMs,
+          pendingTimeouts: bootstrapReplayTimeouts,
         });
         lastSize = fileSize;
         lastActivityAt = currentTime;
@@ -216,6 +237,10 @@ function createThreadRolloutLiveMirror({
 
     isStopped = true;
     clearIntervalFn(intervalId);
+    for (const timeout of bootstrapReplayTimeouts) {
+      clearTimeoutFn(timeout);
+    }
+    bootstrapReplayTimeouts.clear();
     onStop();
   }
 
@@ -231,6 +256,10 @@ function bootstrapFromExistingRollout({
   state,
   fsModule,
   sendApplicationResponse,
+  bootstrapReplayCache,
+  setTimeoutFn = setTimeout,
+  bootstrapReplayBatchIntervalMs = DEFAULT_BOOTSTRAP_REPLAY_BATCH_INTERVAL_MS,
+  pendingTimeouts,
 }) {
   const initialContents = readFileSlice(rolloutPath, 0, fileSize, fsModule);
   if (!initialContents) {
@@ -261,7 +290,7 @@ function bootstrapFromExistingRollout({
     const taskEventType = parsed?.type === "event_msg"
       ? readString(parsed?.payload?.type)
       : "";
-    if (taskEventType === "user_message") {
+    if (taskEventType === "user_message" && !insideActiveRun) {
       pendingUserPreludeLine = line;
     }
     if (taskEventType === "task_started") {
@@ -273,6 +302,7 @@ function bootstrapFromExistingRollout({
       if (pendingUserPreludeLine) {
         activeRunLines.push(pendingUserPreludeLine);
       }
+      pendingUserPreludeLine = null;
       activeRunLines.push(line);
       continue;
     }
@@ -282,7 +312,7 @@ function bootstrapFromExistingRollout({
     }
 
     activeRunLines.push(line);
-    if (taskEventType === "task_complete") {
+    if (isRolloutTerminalTaskEvent(taskEventType)) {
       insideActiveRun = false;
       activeTurnId = "";
       activeRunLines.length = 0;
@@ -296,7 +326,33 @@ function bootstrapFromExistingRollout({
   }
 
   state.isDesktopOrigin = true;
-  processRolloutLines(activeRunLines, state, sendApplicationResponse);
+  const replayId = bootstrapReplayId(state.threadId, rolloutPath, initialContents);
+  const cachedBatches = bootstrapReplayCache?.get(replayId);
+  const replayNotifications = cachedBatches ? null : [];
+  // Rebuild local mirror state from the already-written run while collecting
+  // every notification into bounded catch-up batches for the phone.
+  processRolloutLines(activeRunLines, state, (rawNotification) => {
+    if (cachedBatches) {
+      return;
+    }
+    const notification = safeParseJSON(rawNotification);
+    if (notification) {
+      replayNotifications.push(notification);
+    }
+  });
+  const batches = cachedBatches || chunkBootstrapReplayNotifications(replayNotifications);
+  rememberBootstrapReplayBatches(bootstrapReplayCache, replayId, batches);
+  emitBootstrapReplayBatches(state, replayId, batches, sendApplicationResponse, {
+    setTimeoutFn,
+    batchIntervalMs: bootstrapReplayBatchIntervalMs,
+    pendingTimeouts,
+  });
+}
+
+function isRolloutTerminalTaskEvent(eventType) {
+  return eventType === "task_complete"
+    || eventType === "turn_aborted"
+    || eventType === "task_aborted";
 }
 
 function processRolloutLines(lines, state, sendApplicationResponse) {
@@ -322,6 +378,106 @@ function processRolloutLines(lines, state, sendApplicationResponse) {
   }
 }
 
+function emitBootstrapReplayBatches(
+  state,
+  replayId,
+  batches,
+  sendApplicationResponse,
+  {
+    setTimeoutFn = setTimeout,
+    batchIntervalMs = DEFAULT_BOOTSTRAP_REPLAY_BATCH_INTERVAL_MS,
+    pendingTimeouts,
+  } = {}
+) {
+  if (!Array.isArray(batches) || batches.length === 0) {
+    return;
+  }
+
+  const sendBatch = (batch, batchIndex) => {
+    sendApplicationResponse(JSON.stringify(createNotification("remodex/rollout/bootstrapReplay", {
+      threadId: state.threadId,
+      replayId,
+      batchIndex,
+      batchCount: batches.length,
+      notifications: batch,
+    })));
+  };
+
+  for (let batchIndex = 0; batchIndex < batches.length; batchIndex += 1) {
+    const batch = batches[batchIndex];
+    if (batchIndex === 0) {
+      sendBatch(batch, batchIndex);
+      continue;
+    }
+
+    if (batchIntervalMs <= 0) {
+      sendBatch(batch, batchIndex);
+      continue;
+    }
+
+    const timeout = setTimeoutFn(() => {
+      pendingTimeouts?.delete(timeout);
+      sendBatch(batch, batchIndex);
+    }, batchIndex * batchIntervalMs);
+    pendingTimeouts?.add(timeout);
+  }
+}
+
+function chunkBootstrapReplayNotifications(notifications) {
+  const batches = [];
+  let batch = [];
+  let batchBytes = 0;
+
+  for (const notification of notifications) {
+    const notificationBytes = Buffer.byteLength(JSON.stringify(notification), "utf8");
+    const shouldStartNextBatch = batch.length > 0
+      && (
+        batch.length >= BOOTSTRAP_REPLAY_CHUNK_SIZE
+        || batchBytes + notificationBytes > BOOTSTRAP_REPLAY_CHUNK_MAX_BYTES
+      );
+    if (shouldStartNextBatch) {
+      batches.push(batch);
+      batch = [];
+      batchBytes = 0;
+    }
+
+    batch.push(notification);
+    batchBytes += notificationBytes;
+  }
+
+  if (batch.length > 0) {
+    batches.push(batch);
+  }
+  return batches;
+}
+
+function bootstrapReplayId(threadId, rolloutPath, contents) {
+  return crypto
+    .createHash("sha256")
+    .update(readString(threadId))
+    .update("\0")
+    .update(readString(rolloutPath))
+    .update("\0")
+    .update(String(contents || ""))
+    .digest("hex")
+    .slice(0, 24);
+}
+
+function rememberBootstrapReplayBatches(cache, replayId, batches) {
+  if (!cache || cache.has(replayId)) {
+    return;
+  }
+
+  cache.set(replayId, batches);
+  while (cache.size > BOOTSTRAP_REPLAY_CACHE_LIMIT) {
+    const oldestKey = cache.keys().next().value;
+    if (!oldestKey) {
+      break;
+    }
+    cache.delete(oldestKey);
+  }
+}
+
 function synthesizeNotificationsFromRolloutEntry(entry, state) {
   if (entry?.type === "session_meta") {
     populateSessionMetaState(state, entry.payload);

package/src/secure-device-state.js

@@ -1,7 +1,7 @@
 // FILE: secure-device-state.js
-// Purpose: Persists canonical bridge identity, trusted-phone state, and last seen iPhone app version for local QR pairing.
+// Purpose: Persists canonical bridge identity, trusted mobile state, and last seen companion metadata for local QR pairing.
 // Layer: CLI helper
-// Exports: loadOrCreateBridgeDeviceState, readBridgeDeviceState, resetBridgeDeviceState, resetBridgeTrustState, rememberTrustedPhone, rememberLastSeenPhoneAppVersion, getTrustedPhonePublicKey, resolveBridgeRelaySession
+// Exports: loadOrCreateBridgeDeviceState, readBridgeDeviceState, resetBridgeDeviceState, resetBridgeTrustState, rememberTrustedPhone, rememberLastSeenPhoneAppVersion, rememberLastSeenClientDeviceKind, getTrustedPhonePublicKey, resolveBridgeRelaySession
 // Depends on: fs, os, path, crypto, child_process
 
 const fs = require("fs");
@@ -153,6 +153,22 @@ function rememberLastSeenPhoneAppVersion(state, phoneAppVersion, { persist = tru
   return nextState;
 }
 
+function rememberLastSeenClientDeviceKind(state, deviceKind, { persist = true } = {}) {
+  const normalizedDeviceKind = normalizeDeviceKind(deviceKind);
+  if (!normalizedDeviceKind) {
+    return state;
+  }
+
+  const nextState = normalizeBridgeDeviceState({
+    ...state,
+    lastSeenDeviceKind: normalizedDeviceKind,
+  });
+  if (persist) {
+    writeBridgeDeviceState(nextState);
+  }
+  return nextState;
+}
+
 function getTrustedPhonePublicKey(state, phoneDeviceId) {
   const normalizedDeviceId = normalizeNonEmptyString(phoneDeviceId);
   if (!normalizedDeviceId) {
@@ -176,6 +192,7 @@ function createBridgeDeviceState() {
     macIdentityPublicKey: base64UrlToBase64(publicJwk.x),
     macIdentityPrivateKey: base64UrlToBase64(privateJwk.d),
     trustedPhones: {},
+    lastSeenDeviceKind: null,
     lastSeenPhoneAppVersion: null,
   };
 }
@@ -385,6 +402,8 @@ function normalizeBridgeDeviceState(rawState) {
   const macIdentityPublicKey = normalizeNonEmptyString(rawState?.macIdentityPublicKey);
   const macIdentityPrivateKey = normalizeNonEmptyString(rawState?.macIdentityPrivateKey);
   const lastSeenPhoneAppVersion = normalizeNonEmptyString(rawState?.lastSeenPhoneAppVersion) || null;
+  const lastSeenDeviceKind = normalizeDeviceKind(rawState?.lastSeenDeviceKind)
+    || inferLegacyDeviceKind({ lastSeenPhoneAppVersion });
 
   if (!macDeviceId || !macIdentityPublicKey || !macIdentityPrivateKey) {
     throw new Error("Bridge device state is incomplete");
@@ -408,6 +427,7 @@ function normalizeBridgeDeviceState(rawState) {
     macIdentityPublicKey,
     macIdentityPrivateKey,
     trustedPhones,
+    lastSeenDeviceKind,
     lastSeenPhoneAppVersion,
   };
 }
@@ -430,6 +450,24 @@ function recoverBridgeDeviceIdentity(state, { fallbackState = null } = {}) {
   return nextState;
 }
 
+function normalizeDeviceKind(value) {
+  const normalized = normalizeNonEmptyString(value).toLowerCase();
+  if (normalized === "ios" || normalized === "iphone") {
+    return "iphone";
+  }
+  if (normalized === "android") {
+    return "android";
+  }
+  if (normalized === "mac" || normalized === "macos" || normalized === "darwin") {
+    return "mac";
+  }
+  return normalized || null;
+}
+
+function inferLegacyDeviceKind({ lastSeenPhoneAppVersion } = {}) {
+  return lastSeenPhoneAppVersion ? "iphone" : null;
+}
+
 function bridgeStatesEqual(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
@@ -475,6 +513,7 @@ module.exports = {
   getTrustedPhonePublicKey,
   loadOrCreateBridgeDeviceState,
   readBridgeDeviceState,
+  rememberLastSeenClientDeviceKind,
   rememberLastSeenPhoneAppVersion,
   rememberTrustedPhone,
   resetBridgeDeviceState,

package/src/secure-transport.js

@@ -39,6 +39,7 @@ function createBridgeSecureTransport({
   deviceState,
   displayName = "",
   onTrustedPhoneUpdate = null,
+  onSecureSessionReady = null,
   persistTrustedPhone = true,
 }) {
   let currentDeviceState = deviceState;
@@ -382,7 +383,13 @@ function createBridgeSecureTransport({
       activeSession.firstOutboundSeq = nextBridgeOutboundSeq;
     }
 
+    const completedHandshakeMode = pendingHandshake.handshakeMode;
     pendingHandshake = null;
+    onSecureSessionReady?.({
+      phoneDeviceId: activeSession.phoneDeviceId,
+      handshakeMode: completedHandshakeMode,
+      keyEpoch: activeSession.keyEpoch,
+    });
     sendControlMessage({
       kind: "secureReady",
       sessionId,