@polderlabs/bizar-omp 0.7.8 → 0.7.10

package/dist/omp/daemon-service.js

@@ -1,9 +1,11 @@
 import { createServer } from "node:http";
 import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 import { deferred } from "./daemon.js";
 import { randomBytes } from "node:crypto";
-import { mkdirSync, statSync } from "node:fs";
-import { resolve } from "node:path";
+import { mkdirSync, realpathSync, statSync } from "node:fs";
+import { readdir } from "node:fs/promises";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
 import { listOmbSessions, ombSessionDisplayName, ombSessionJournalPath, readOmbSessionMessages } from "./omb-sessions.js";
 import { ombSessionName } from "./tmux.js";
 import { DAEMON_PROTOCOL_VERSION, DaemonError, daemonStateDir, writeSnapshot } from "./daemon.js";
@@ -11,8 +13,11 @@ import { captureOmbSessionConsole, createOmbSession, deleteOmbSession, forgetOmb
 import { DASHBOARD_PATH, dashboardPageHtml } from "./dashboard-html.js";
 import { OMB_APPROVAL_MODES, OMB_THINKING_LEVELS, loadOmbSettings, saveOmbSettings } from "./omb-settings.js";
 import { startTray, stopTray } from "./tray.js";
+import { acquireMobileSessionLease, listClaimsDetailed } from "../cli/mobile-claim.js";
+import { expandDirectoryPath } from "../cli/directory-selector.js";
 import { deleteCustomOmpProvider, listCustomOmpProviders, OMP_PROVIDER_APIS, saveCustomOmpProvider, } from "./omp-provider-config.js";
 const SCAN_INTERVAL_MS = 5_000;
+const MOBILE_HOST_ENTRY = fileURLToPath(new URL("../../mobile/packages/host/dist/cli/main.js", import.meta.url));
 export const DASHBOARD_MAX_BODY_BYTES = 64 * 1024;
 export const DASHBOARD_BODY_TIMEOUT_MS = 10_000;
 /** One-time dashboard access codes live a short while and are never reused. */
@@ -25,6 +30,86 @@ class DashboardRequestError extends Error {
         this.status = status;
     }
 }
+const MOBILE_PROJECT_ID_TTL_MS = 10 * 60_000;
+const MOBILE_PROJECT_LIMIT = 512;
+const MOBILE_PROJECT_CHOICES_LIMIT = MOBILE_PROJECT_LIMIT * 4;
+const MOBILE_PROJECT_DEPTH = 5;
+const IGNORED_PROJECT_DIRECTORIES = new Set([".git", "node_modules", ".cache", ".turbo", ".next", ".venv", "venv"]);
+/** A mobile delete is allowed only after one authoritative fresh scan proves
+ * the exact host-owned generation is fully stopped and no longer observable. */
+export function isSafeMobileSessionRemoval(session) {
+    return session.authorityKnown && session.hosted && session.state === "stopped" && !session.attached && !session.uncertainLiveness && session.processObserved !== true;
+}
+/** Discover only directories the local OMB Hub already treats as project choices. */
+async function discoverMobileProjectDirectories(cwd, projectsFolder, sessions) {
+    const candidates = new Map();
+    const add = (path, suggestedLabel) => {
+        try {
+            if (!isDirectory(path))
+                return;
+            const canonical = realpathSync(path);
+            if (!candidates.has(canonical))
+                candidates.set(canonical, suggestedLabel ?? "");
+        }
+        catch { /* A project removed after the hub scan is omitted. */ }
+    };
+    const current = (() => { try {
+        return realpathSync(cwd);
+    }
+    catch {
+        return resolve(cwd);
+    } })();
+    add(current);
+    const rootPath = projectsFolder.trim() ? expandDirectoryPath(projectsFolder, cwd) : "";
+    let canonicalRoot = "";
+    if (rootPath) {
+        add(rootPath, "Projects folder");
+        try {
+            canonicalRoot = realpathSync(rootPath);
+        }
+        catch {
+            canonicalRoot = "";
+        }
+        if (canonicalRoot) {
+            const visit = async (directory, depth) => {
+                if (depth >= MOBILE_PROJECT_DEPTH || candidates.size >= MOBILE_PROJECT_LIMIT)
+                    return;
+                let entries;
+                try {
+                    entries = await readdir(directory, { withFileTypes: true });
+                }
+                catch {
+                    return;
+                }
+                for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+                    if (!entry.isDirectory() || entry.name.startsWith(".") || IGNORED_PROJECT_DIRECTORIES.has(entry.name))
+                        continue;
+                    const path = resolve(directory, entry.name);
+                    const label = relative(canonicalRoot, path).replaceAll("\\", "/");
+                    add(path, label);
+                    if (candidates.size >= MOBILE_PROJECT_LIMIT)
+                        break;
+                    await visit(path, depth + 1);
+                }
+            };
+            await visit(canonicalRoot, 0);
+        }
+    }
+    for (const session of sessions) {
+        if (session.cwd !== "?")
+            add(session.cwd, session.project);
+        if (candidates.size >= MOBILE_PROJECT_LIMIT)
+            break;
+    }
+    return [...candidates.entries()].slice(0, MOBILE_PROJECT_LIMIT).map(([path, suggested]) => {
+        const currentProject = path === current;
+        const fromRoot = canonicalRoot === "" ? "" : relative(canonicalRoot, path);
+        const insideRoot = canonicalRoot !== "" && (fromRoot === "" || (fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`) && !isAbsolute(fromRoot)));
+        const relativeLabel = insideRoot && path !== canonicalRoot ? relative(canonicalRoot, path).replaceAll("\\", "/") : "";
+        const label = (currentProject ? `${basename(path)} (current)` : relativeLabel || suggested || basename(path)).replace(/[\u0000-\u001f\u007f]/g, "�").slice(0, 120);
+        return { cwd: path, label, current: currentProject };
+    });
+}
 /**
  * Session fields the browser needs. The scan records the pane command, the pid,
  * and the native-session flag for the hub, but none of them reach the page: the
@@ -309,6 +394,18 @@ function dashboardSession(session) {
         displayName: session.displayName ?? ombSessionDisplayName(session),
     };
 }
+function mobileHubSettings(settings) {
+    return {
+        version: settings.version,
+        projectsFolderConfigured: settings.projectsFolder.trim() !== "",
+        agentsScope: settings.agentsScope,
+        sessionFilter: settings.sessionFilter,
+        autoAttachLatest: settings.autoAttachLatest,
+        mouseScrolling: settings.mouseScrolling,
+        showStoppedSessions: settings.showStoppedSessions,
+        trayEnabled: settings.trayEnabled,
+    };
+}
 /**
  * Long-running half of the daemon: an authenticated HTTP boundary on
  * 127.0.0.1 plus a scan loop that keeps the on-disk snapshot fresh. Spawned
@@ -318,6 +415,7 @@ function dashboardSession(session) {
 export function startDaemonService(options = {}) {
     const log = options.log ?? (() => { });
     const intervalMs = options.intervalMs ?? SCAN_INTERVAL_MS;
+    const bodyTimeoutMs = options.bodyTimeoutMs ?? DASHBOARD_BODY_TIMEOUT_MS;
     const env = options.env ?? process.env;
     const token = randomBytes(24).toString("hex");
     mkdirSync(daemonStateDir(env), { recursive: true, mode: 0o700 });
@@ -326,6 +424,11 @@ export function startDaemonService(options = {}) {
     let scanInFlight;
     let lastScanAt;
     let lastScanError;
+    let mobileHost;
+    let mobileOutput = "";
+    let mobilePair;
+    let mobileExit;
+    const mobileProjectChoices = new Map();
     const ready = deferred();
     async function scan(force = false) {
         if (scanInFlight) {
@@ -357,25 +460,46 @@ export function startDaemonService(options = {}) {
         }
     }
     async function requireCurrentSession(name, body) {
-        if (!sessions.some(candidate => candidate.name === name))
-            throw new DashboardRequestError(404, "unknown session");
         const generation = typeof body.generation === "string" ? body.generation : "";
         if (!generation)
             throw new DashboardRequestError(400, "generation is required");
         let fresh;
         try {
-            fresh = await listOmbSessions(process.cwd(), env, { includeStopped: true, requireMultiplexer: true });
+            fresh = await listOmbSessions(process.cwd(), env, { includeStopped: true, includeAllStopped: true, requireMultiplexer: true });
         }
         catch {
             throw new DashboardRequestError(503, "session authority is unavailable");
         }
-        const current = fresh.find(candidate => candidate.name === name);
-        if (!current || current.generation !== generation)
+        const matches = fresh.filter(candidate => candidate.name === name);
+        if (matches.length === 0)
+            throw new DashboardRequestError(404, "unknown session");
+        if (matches.length !== 1 || matches[0]?.generation !== generation)
             throw new DashboardRequestError(409, "session changed externally");
+        const current = matches[0];
         if (!current.authorityKnown)
             throw new DashboardRequestError(503, "session authority is unavailable");
         return current;
     }
+    async function withUnclaimedSession(name, generation, action) {
+        let lease;
+        try {
+            lease = acquireMobileSessionLease(name, env);
+        }
+        catch {
+            throw new DashboardRequestError(409, "session ownership is changing");
+        }
+        try {
+            const claims = listClaimsDetailed(env);
+            if (claims.unreadable.length > 0 || claims.claims.some(claim => claim.session === name)) {
+                throw new DashboardRequestError(409, "session is claimed for mobile ownership");
+            }
+            const current = await requireCurrentSession(name, { generation });
+            return await action(current);
+        }
+        finally {
+            lease.release();
+        }
+    }
     // Dashboard access codes: the bearer token must never land in browser
     // history, so `omb dashboard` mints a code, the page trades that code for the
     // token once, and the token is kept in sessionStorage only.
@@ -416,12 +540,39 @@ export function startDaemonService(options = {}) {
             throw new DashboardRequestError(413, "request body is too large");
         const chunks = [];
         let size = 0;
-        for await (const chunk of req) {
-            const buffer = Buffer.from(chunk);
-            size += buffer.length;
-            if (size > DASHBOARD_MAX_BODY_BYTES)
-                throw new DashboardRequestError(413, "request body is too large");
-            chunks.push(buffer);
+        // Size alone is not a bound: a client can hold the connection open and
+        // trickle bytes forever. The dashboard session exchange is unauthenticated
+        // and reads the body before checking any token, so without a deadline a
+        // local caller can pin a socket indefinitely.
+        let deadline;
+        const expiry = new Promise((_, reject) => {
+            deadline = setTimeout(() => reject(new DashboardRequestError(408, "request body timed out")), bodyTimeoutMs);
+            deadline.unref?.();
+        });
+        try {
+            // Racing the read against the deadline is what bounds it; the timer alone
+            // only fires once the read loop is idle between chunks.
+            await Promise.race([
+                (async () => {
+                    for await (const chunk of req) {
+                        const buffer = Buffer.from(chunk);
+                        size += buffer.length;
+                        if (size > DASHBOARD_MAX_BODY_BYTES)
+                            throw new DashboardRequestError(413, "request body is too large");
+                        chunks.push(buffer);
+                    }
+                })(),
+                expiry,
+            ]);
+        }
+        catch (error) {
+            // The socket is deliberately not destroyed here: the handler still needs
+            // to write the status the client is waiting for, and tearing the
+            // connection down first would surface as a bare "socket hang up".
+            throw error;
+        }
+        finally {
+            clearTimeout(deadline);
         }
         if (!chunks.length)
             return {};
@@ -491,6 +642,286 @@ export function startDaemonService(options = {}) {
             res.end('{"error":"unauthorized"}\n');
             return;
         }
+        if (path === "/mobile/pair" && req.method === "POST") {
+            const reuseMobileHost = Boolean(mobileHost && !mobileExit && mobilePair);
+            if (!mobileHost || mobileHost.exitCode !== null || mobileHost.signalCode !== null) {
+                mobilePair = undefined;
+                mobileOutput = "";
+                mobileExit = undefined;
+                const entry = env.BIZAROMP_MOBILE_ENTRY || MOBILE_HOST_ENTRY;
+                mobileHost = spawn(process.execPath, [entry, "pair", "--json"], {
+                    cwd: process.cwd(),
+                    env: { ...env, BIZAR_OMB_DAEMON_PORT: String(service.port), BIZAR_OMB_DAEMON_TOKEN: token },
+                    stdio: ["pipe", "pipe", "pipe"],
+                });
+                mobileHost.on("error", error => { mobileExit = { code: 1, signal: null }; log(`mobile host failed to start: ${error.message}`); });
+                mobileHost.stdout?.setEncoding("utf8");
+                mobileHost.stderr?.setEncoding("utf8");
+                mobileHost.stdout?.on("data", (chunk) => {
+                    mobileOutput = (mobileOutput + String(chunk)).slice(-64 * 1024);
+                    const start = Math.max(mobileOutput.lastIndexOf("{\n  \"deepLink\""), mobileOutput.lastIndexOf("{\"deepLink\""));
+                    if (start >= 0) {
+                        try {
+                            const prettyEnd = mobileOutput.indexOf("\n}", start);
+                            const lineEnd = mobileOutput.indexOf("\n", start);
+                            const end = prettyEnd >= 0 ? prettyEnd + 2 : lineEnd;
+                            if (end >= 0)
+                                mobilePair = JSON.parse(mobileOutput.slice(start, end));
+                        }
+                        catch { /* wait for complete JSON */ }
+                    }
+                });
+                mobileHost.stderr?.on("data", (chunk) => { log(`mobile host: ${String(chunk).trim().slice(0, 1000)}`); });
+                mobileHost.on("exit", (code, signal) => { mobileExit = { code, signal }; });
+            }
+            else if (reuseMobileHost) {
+                // Every explicit `omb mobile pair` gets a fresh one-time token. The
+                // host renews only its pairing window over this private pipe; restarting
+                // it here would tear down authenticated sockets and re-provision a
+                // Quick Tunnel with a different public hostname.
+                mobilePair = undefined;
+                mobileOutput = "";
+                if (!mobileHost.stdin?.write("pair\n")) {
+                    json(res, 503, { error: "mobile host could not renew its pairing window" });
+                    return;
+                }
+            }
+            const deadline = Date.now() + 60_000;
+            while (!mobilePair && !mobileExit && Date.now() < deadline)
+                await new Promise(resolve => setTimeout(resolve, 50));
+            if (!mobilePair) {
+                json(res, 503, { error: mobileExit ? `mobile host exited (${mobileExit.code ?? mobileExit.signal})` : "mobile pairing startup timed out" });
+                return;
+            }
+            json(res, 200, mobilePair);
+            return;
+        }
+        if (path === "/mobile/status" && req.method === "GET") {
+            json(res, 200, {
+                running: Boolean(mobileHost && !mobileExit),
+                pid: mobileHost?.pid ?? null,
+                hostId: typeof mobilePair?.hostId === "string" ? mobilePair.hostId : null,
+                endpoint: typeof mobilePair?.endpoint === "string" ? mobilePair.endpoint : null,
+                hostKeyFingerprint: typeof mobilePair?.hostKeyFingerprint === "string" ? mobilePair.hostKeyFingerprint : null,
+                pairingExpiresAt: typeof mobilePair?.expiresAt === "number" ? mobilePair.expiresAt : null,
+            });
+            return;
+        }
+        if (path === "/mobile/projects" && req.method === "GET") {
+            let knownSessions;
+            try {
+                knownSessions = await listOmbSessions(process.cwd(), env, { includeStopped: true, includeAllStopped: true, requireMultiplexer: true });
+            }
+            catch {
+                json(res, 503, { authorityKnown: false, reason: "session authority is unavailable", projects: [] });
+                return;
+            }
+            const settings = loadOmbSettings(env);
+            const discovered = await discoverMobileProjectDirectories(process.cwd(), settings.projectsFolder, knownSessions);
+            const now = Date.now();
+            for (const [id, choice] of mobileProjectChoices)
+                if (choice.expiresAt <= now)
+                    mobileProjectChoices.delete(id);
+            const projects = discovered.map(project => {
+                while (mobileProjectChoices.size >= MOBILE_PROJECT_CHOICES_LIMIT) {
+                    const oldest = mobileProjectChoices.keys().next().value;
+                    if (oldest === undefined)
+                        break;
+                    mobileProjectChoices.delete(oldest);
+                }
+                const id = randomBytes(24).toString("base64url");
+                mobileProjectChoices.set(id, { ...project, expiresAt: now + MOBILE_PROJECT_ID_TTL_MS });
+                return { id, label: project.label, current: project.current };
+            });
+            json(res, 200, { authorityKnown: true, projectsFolderConfigured: Boolean(settings.projectsFolder.trim()), projects });
+            return;
+        }
+        if (path === "/mobile/settings" && req.method === "GET") {
+            json(res, 200, mobileHubSettings(loadOmbSettings(env)));
+            return;
+        }
+        if (path === "/mobile/settings" && req.method === "PATCH") {
+            const body = await readBody(req);
+            const version = body.version;
+            const allowedKeys = new Set(["version", "agentsScope", "sessionFilter", "autoAttachLatest", "mouseScrolling", "showStoppedSessions", "trayEnabled"]);
+            const keys = Object.keys(body);
+            if (keys.some(key => !allowedKeys.has(key)) || typeof version !== "number" || !Number.isSafeInteger(version) || version < 0 || keys.length < 2) {
+                json(res, 400, { error: "invalid OMB Hub settings update" });
+                return;
+            }
+            const previous = loadOmbSettings(env);
+            const next = { ...previous };
+            if (body.agentsScope !== undefined) {
+                if (body.agentsScope !== "cwd" && body.agentsScope !== "all") {
+                    json(res, 400, { error: "agentsScope is invalid" });
+                    return;
+                }
+                next.agentsScope = body.agentsScope;
+            }
+            if (body.sessionFilter !== undefined) {
+                if (body.sessionFilter !== "active" && body.sessionFilter !== "stopped" && body.sessionFilter !== "all") {
+                    json(res, 400, { error: "sessionFilter is invalid" });
+                    return;
+                }
+                next.sessionFilter = body.sessionFilter;
+            }
+            for (const key of ["autoAttachLatest", "mouseScrolling", "showStoppedSessions", "trayEnabled"]) {
+                if (body[key] !== undefined && typeof body[key] !== "boolean") {
+                    json(res, 400, { error: `${key} must be a boolean` });
+                    return;
+                }
+                if (typeof body[key] === "boolean")
+                    next[key] = body[key];
+            }
+            if (previous.version !== version) {
+                json(res, 409, { error: "settings changed externally", settings: mobileHubSettings(previous) });
+                return;
+            }
+            let saved;
+            try {
+                saved = saveOmbSettings(next, env);
+            }
+            catch (error) {
+                if (error instanceof Error && error.message === "settings changed externally") {
+                    json(res, 409, { error: "settings changed externally", settings: mobileHubSettings(loadOmbSettings(env)) });
+                    return;
+                }
+                throw error;
+            }
+            if (previous.mouseScrolling !== next.mouseScrolling) {
+                await Promise.all(sessions.filter(session => session.hosted !== false && session.state !== "stopped")
+                    .map(session => setOmbSessionMouse(session.name, next.mouseScrolling, session.cwd === "?" ? process.cwd() : session.cwd, env)));
+            }
+            if (previous.trayEnabled !== next.trayEnabled) {
+                if (next.trayEnabled)
+                    await startTray(env);
+                else
+                    await stopTray(env);
+            }
+            await scan(true);
+            json(res, 200, { ok: true, settings: mobileHubSettings(saved) });
+            return;
+        }
+        if (path === "/mobile/sessions/create" && req.method === "POST") {
+            const body = await readBody(req);
+            const projectId = typeof body.projectId === "string" ? body.projectId : "";
+            const task = typeof body.task === "string" ? body.task.trim() : "";
+            const requestedId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
+            if (!/^[A-Za-z0-9_-]{32}$/.test(projectId) || ("cwd" in body) || task.length > 20_000 || (body.sessionId !== undefined && (typeof body.sessionId !== "string" || requestedId.length > 120 || !/^[A-Za-z0-9 _.-]*$/.test(requestedId)))) {
+                json(res, 400, { error: "invalid OMB session creation request" });
+                return;
+            }
+            const choice = mobileProjectChoices.get(projectId);
+            mobileProjectChoices.delete(projectId);
+            if (!choice || choice.expiresAt <= Date.now()) {
+                json(res, 409, { error: "project choice expired; refresh the project list" });
+                return;
+            }
+            let currentCwd;
+            try {
+                currentCwd = realpathSync(choice.cwd);
+            }
+            catch {
+                json(res, 409, { error: "selected project is no longer available" });
+                return;
+            }
+            if (currentCwd !== choice.cwd || !isDirectory(currentCwd)) {
+                json(res, 409, { error: "selected project changed; refresh the project list" });
+                return;
+            }
+            const sessionId = requestedId || `mobile-${Date.now().toString(36)}-${randomBytes(5).toString("hex")}`;
+            const sessionName = ombSessionName(currentCwd, sessionId, env.PI_PROFILE);
+            let fresh;
+            try {
+                fresh = await listOmbSessions(process.cwd(), env, { includeStopped: true, includeAllStopped: true, requireMultiplexer: true });
+            }
+            catch {
+                json(res, 503, { error: "session authority is unavailable" });
+                return;
+            }
+            if (fresh.some(session => session.name === sessionName)) {
+                json(res, 409, { error: "a session with that name already exists" });
+                return;
+            }
+            const settings = loadOmbSettings(env);
+            const args = [];
+            if (settings.defaultModel)
+                args.push("--model", settings.defaultModel);
+            if (settings.defaultThinking)
+                args.push("--thinking", settings.defaultThinking);
+            if (settings.defaultApprovalMode)
+                args.push("--approval-mode", settings.defaultApprovalMode);
+            if (task)
+                args.push(task);
+            const created = await createOmbSession(currentCwd, args, env, sessionId);
+            if (created.code !== 0) {
+                json(res, 409, { error: "OMP could not start the OMB session" });
+                return;
+            }
+            await scan(true);
+            json(res, 200, { ok: true });
+            return;
+        }
+        if (path === "/mobile/stop" && req.method === "POST") {
+            if (mobileHost && !mobileExit)
+                mobileHost.kill("SIGTERM");
+            json(res, 200, { ok: true });
+            return;
+        }
+        if (path === "/mobile/sessions/rename" && req.method === "POST") {
+            const body = await readBody(req);
+            const name = typeof body.name === "string" ? body.name : "";
+            const generation = typeof body.generation === "string" ? body.generation : "";
+            const newId = typeof body.newId === "string" ? body.newId.trim() : "";
+            if (!/^[A-Za-z0-9-]{1,64}$/.test(name) || !/^[a-f0-9]{32}$/.test(generation) || !newId || newId.length > 120 || /[\\/\u0000-\u001f\u007f]/.test(newId)) {
+                json(res, 400, { error: "invalid OMB session identity or label" });
+                return;
+            }
+            const outcome = await withUnclaimedSession(name, generation, async (current) => {
+                if (!current.hosted || current.state === "unknown" || current.uncertainLiveness) {
+                    throw new DashboardRequestError(409, "session cannot be renamed in its current state");
+                }
+                const projectCwd = current.cwd === "?" ? process.cwd() : current.cwd;
+                const nextName = ombSessionName(projectCwd, newId, env.PI_PROFILE);
+                const code = await renameOmbSession(name, nextName, projectCwd, env);
+                if (code !== 0)
+                    throw new DashboardRequestError(409, "session could not be renamed");
+                return { ok: true };
+            });
+            await scan(true);
+            json(res, 200, outcome);
+            return;
+        }
+        if (path === "/mobile/sessions/delete" && req.method === "POST") {
+            const body = await readBody(req);
+            const name = typeof body.name === "string" ? body.name : "";
+            const generation = typeof body.generation === "string" ? body.generation : "";
+            if (!/^[A-Za-z0-9-]{1,64}$/.test(name) || !/^[a-f0-9]{32}$/.test(generation)) {
+                json(res, 400, { error: "invalid OMB session identity" });
+                return;
+            }
+            const outcome = await withUnclaimedSession(name, generation, async (current) => {
+                // Mobile removal is destructive.  It is only safe for a fresh,
+                // host-owned row whose multiplexer and process observations prove that
+                // the exact generation is stopped and unattached.  In particular,
+                // hosted rows must not be treated as removable merely because their
+                // liveness is not uncertain: an active hosted OMP session can still be
+                // the one writer for a native session.
+                if (!isSafeMobileSessionRemoval(current)) {
+                    throw new DashboardRequestError(409, "session liveness is not safe to remove");
+                }
+                const projectCwd = current.cwd === "?" ? process.cwd() : current.cwd;
+                const code = current.hosted
+                    ? await deleteOmbSession(name, projectCwd, env)
+                    : forgetOmbSession(name, env);
+                if (code !== 0)
+                    throw new DashboardRequestError(409, "session removal could not be confirmed");
+                return { ok: true };
+            });
+            await scan(true);
+            json(res, 200, outcome);
+            return;
+        }
         if (path === "/dash/code" && req.method === "POST") {
             json(res, 200, { code: mintDashCode(), path: DASHBOARD_PATH, port: service.port, expiresInMs: DASH_CODE_TTL_MS });
             return;
@@ -905,7 +1336,8 @@ export function startDaemonService(options = {}) {
             const name = decodeURIComponent(deleteMatch[1]);
             const body = await readBody(req);
             const current = await requireCurrentSession(name, body);
-            const code = current.hosted === false ? forgetOmbSession(name, env) : await deleteOmbSession(name, process.cwd(), env);
+            const projectCwd = current.cwd === "?" ? process.cwd() : current.cwd;
+            const code = current.hosted === false ? forgetOmbSession(name, env) : await deleteOmbSession(name, projectCwd, env);
             await scan(true);
             json(res, code === 0 ? 200 : 500, { code });
             return;
@@ -936,6 +1368,12 @@ export function startDaemonService(options = {}) {
         close: async () => {
             if (scanTimer)
                 clearInterval(scanTimer);
+            if (mobileHost && !mobileExit) {
+                mobileHost.kill("SIGTERM");
+                await Promise.race([new Promise(resolve => mobileHost?.once("exit", () => resolve())), new Promise(resolve => setTimeout(resolve, 5_000))]);
+                if (!mobileExit)
+                    mobileHost.kill("SIGKILL");
+            }
             // Run every SSE cleanup so poll/keepalive timers drop the response
             // reference immediately — otherwise the timers themselves keep the
             // socket (and therefore server.close()) alive past shutdown.