@remodex/rmx 1.0.2

package/src/android-remote/store.ts

@@ -0,0 +1,466 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import {
+  atomicWriteFile,
+  getConfigDir,
+  hardenExistingSecret,
+} from "../config";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
+import { hardenSecretDir } from "../lib/windows-secret-acl";
+
+const ANDROID_REMOTE_STATE_VERSION = 1;
+const ANDROID_REMOTE_STATE_MAX_BYTES = 1024 * 1024;
+const CLIENT_ID_PATTERN = /^[a-zA-Z0-9._-]{1,128}$/;
+const STORED_MODEL_OPTION_IDS = new Set([
+  "effort",
+  "reasoningEffort",
+  "serviceTier",
+]);
+
+export type AndroidRemoteSettings = {
+  controlEnabled: boolean;
+  keepAwake: boolean;
+  tunnelMode: "quick" | "named";
+  namedTunnelHostname?: string;
+};
+
+/**
+ * Stored client data is deliberately separate from every existing Remodex token class.
+ * `credentialDigest` is private store data and must never appear in a management response.
+ */
+export type AndroidRemoteStoredClient = {
+  id: string;
+  label: string;
+  deviceType: "mobile";
+  os: string;
+  address?: string;
+  scopes: string[];
+  createdAt: string;
+  lastSeenAt?: string;
+  credentialExpiresAt?: string;
+  credentialDigest: string;
+};
+
+/**
+ * Codex creates the durable task id, while Remodex creates a temporary task id
+ * before the first prompt is sent. This small mapping keeps the Android task id
+ * stable after Remodex restarts. It never contains prompts or transcript data.
+ */
+export type AndroidRemoteThreadAlias = {
+  remoteThreadId: string;
+  nativeThreadId: string;
+  projectId: string;
+  title: string;
+  cwd: string;
+  instanceId?: string;
+  model: string;
+  runtimeMode: "approval-required" | "auto-accept-edits" | "full-access";
+  interactionMode: "default" | "plan";
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type AndroidRemoteTaskSelectionSource = "android" | "desktop" | "migration";
+
+/**
+ * Durable model state for one Codex task.
+ *
+ * This is intentionally provider/model metadata only. Provider credentials stay
+ * in the normal Remodex credential stores and are never projected to Android.
+ */
+export type AndroidRemoteTaskSelection = {
+  nativeThreadId: string;
+  remoteThreadId: string;
+  providerInstanceId: string;
+  model: string;
+  options?: unknown;
+  /** Hash of the model capability row used to validate the stored options. */
+  capabilityVersion?: string;
+  revision: number;
+  source: AndroidRemoteTaskSelectionSource;
+  updateId: string;
+  updatedAt: string;
+};
+
+export type AndroidRemoteTaskSelectionWrite = Omit<AndroidRemoteTaskSelection, "revision"> & {
+  expectedRevision?: number;
+};
+
+export type AndroidRemoteTaskSelectionWriteResult = {
+  applied: boolean;
+  duplicate: boolean;
+  stale: boolean;
+  selection: AndroidRemoteTaskSelection;
+  state: AndroidRemoteState;
+};
+
+export type AndroidRemoteState = {
+  version: 1;
+  settings: AndroidRemoteSettings;
+  clients: AndroidRemoteStoredClient[];
+  threadAliases: AndroidRemoteThreadAlias[];
+  taskSelections: AndroidRemoteTaskSelection[];
+};
+
+export interface AndroidRemoteStore {
+  /** Present only for a filesystem-backed store. Tests and memory stores omit it. */
+  readonly stateRoot?: string;
+  read(): AndroidRemoteState;
+  updateSettings(patch: Partial<AndroidRemoteSettings>): AndroidRemoteState;
+  upsertClient(client: AndroidRemoteStoredClient): AndroidRemoteState;
+  updateClientMetadata(id: string, patch: { label?: string; os?: string }): AndroidRemoteState;
+  touchClient(id: string, patch: { address?: string; lastSeenAt: string }): AndroidRemoteState;
+  revokeClient(id: string): { removed: boolean; state: AndroidRemoteState };
+  upsertThreadAlias(alias: AndroidRemoteThreadAlias): AndroidRemoteState;
+  removeThreadAlias(remoteThreadId: string): AndroidRemoteState;
+  upsertTaskSelection(selection: AndroidRemoteTaskSelectionWrite): AndroidRemoteTaskSelectionWriteResult;
+  removeTaskSelection(threadId: string): AndroidRemoteState;
+}
+
+export const DEFAULT_ANDROID_REMOTE_SETTINGS: Readonly<AndroidRemoteSettings> = {
+  controlEnabled: false,
+  keepAwake: false,
+  tunnelMode: "quick",
+};
+
+function defaultState(): AndroidRemoteState {
+  return {
+    version: ANDROID_REMOTE_STATE_VERSION,
+    settings: { ...DEFAULT_ANDROID_REMOTE_SETTINGS },
+    clients: [],
+    threadAliases: [],
+    taskSelections: [],
+  };
+}
+
+function stringValue(value: unknown, maxLength: number): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 && trimmed.length <= maxLength ? trimmed : null;
+}
+
+function storedClient(value: unknown): AndroidRemoteStoredClient | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const row = value as Record<string, unknown>;
+  const id = stringValue(row.id, 128);
+  const label = stringValue(row.label, 160);
+  const os = stringValue(row.os, 64);
+  const createdAt = stringValue(row.createdAt, 64);
+  const credentialDigest = stringValue(row.credentialDigest, 256);
+  if (!id || !CLIENT_ID_PATTERN.test(id) || !label || !os || !createdAt || !credentialDigest) return null;
+  if (row.deviceType !== "mobile") return null;
+  const scopes = Array.isArray(row.scopes)
+    ? row.scopes.flatMap(scope => {
+        const parsed = stringValue(scope, 96);
+        return parsed ? [parsed] : [];
+      }).slice(0, 32)
+    : [];
+  const address = stringValue(row.address, 256) ?? undefined;
+  const lastSeenAt = stringValue(row.lastSeenAt, 64) ?? undefined;
+  const credentialExpiresAt = stringValue(row.credentialExpiresAt, 64) ?? undefined;
+  return {
+    id,
+    label,
+    deviceType: "mobile",
+    os,
+    scopes,
+    createdAt,
+    credentialDigest,
+    ...(address ? { address } : {}),
+    ...(lastSeenAt ? { lastSeenAt } : {}),
+    ...(credentialExpiresAt ? { credentialExpiresAt } : {}),
+  };
+}
+
+function storedThreadAlias(value: unknown): AndroidRemoteThreadAlias | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const row = value as Record<string, unknown>;
+  const remoteThreadId = stringValue(row.remoteThreadId, 128);
+  const nativeThreadId = stringValue(row.nativeThreadId, 128);
+  const projectId = stringValue(row.projectId, 128);
+  const title = stringValue(row.title, 256);
+  const cwd = stringValue(row.cwd, 4096);
+  const instanceId = stringValue(row.instanceId, 64) ?? undefined;
+  const model = stringValue(row.model, 256);
+  const createdAt = stringValue(row.createdAt, 64);
+  const updatedAt = stringValue(row.updatedAt, 64);
+  const runtimeMode = row.runtimeMode;
+  const interactionMode = row.interactionMode;
+  if (!remoteThreadId || !nativeThreadId || !projectId || !title || !cwd || !model
+    || !createdAt || !updatedAt) return null;
+  if (!CLIENT_ID_PATTERN.test(remoteThreadId) || !CLIENT_ID_PATTERN.test(nativeThreadId)
+    || !CLIENT_ID_PATTERN.test(projectId)) return null;
+  if (runtimeMode !== "approval-required" && runtimeMode !== "auto-accept-edits"
+    && runtimeMode !== "full-access") return null;
+  if (interactionMode !== "default" && interactionMode !== "plan") return null;
+  return {
+    remoteThreadId,
+    nativeThreadId,
+    projectId,
+    title,
+    cwd,
+    ...(instanceId ? { instanceId } : {}),
+    model,
+    runtimeMode,
+    interactionMode,
+    createdAt,
+    updatedAt,
+  };
+}
+
+function storedModelOptions(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.flatMap(candidate => {
+      if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) return [];
+      const row = candidate as Record<string, unknown>;
+      const id = stringValue(row.id, 64);
+      const optionValue = row.value;
+      if (!id || !STORED_MODEL_OPTION_IDS.has(id)
+        || (typeof optionValue !== "string" && typeof optionValue !== "boolean"
+        && typeof optionValue !== "number")) return [];
+      return [{ id, value: typeof optionValue === "string" ? optionValue.slice(0, 256) : optionValue }];
+    }).slice(0, 32);
+  }
+  if (!value || typeof value !== "object") return undefined;
+  const entries = Object.entries(value as Record<string, unknown>).flatMap(([rawId, optionValue]) => {
+    const id = stringValue(rawId, 64);
+    if (!id || !STORED_MODEL_OPTION_IDS.has(id)
+      || (typeof optionValue !== "string" && typeof optionValue !== "boolean"
+      && typeof optionValue !== "number")) return [];
+    return [[id, typeof optionValue === "string" ? optionValue.slice(0, 256) : optionValue] as const];
+  }).slice(0, 32);
+  return Object.fromEntries(entries);
+}
+
+function storedTaskSelection(value: unknown): AndroidRemoteTaskSelection | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const row = value as Record<string, unknown>;
+  const nativeThreadId = stringValue(row.nativeThreadId, 128);
+  const remoteThreadId = stringValue(row.remoteThreadId, 128);
+  const providerInstanceId = stringValue(row.providerInstanceId, 64);
+  const model = stringValue(row.model, 256);
+  const updateId = stringValue(row.updateId, 128);
+  const updatedAt = stringValue(row.updatedAt, 64);
+  const capabilityVersion = stringValue(row.capabilityVersion, 128) ?? undefined;
+  const revision = typeof row.revision === "number" && Number.isSafeInteger(row.revision)
+    ? row.revision
+    : 0;
+  const source = row.source;
+  if (!nativeThreadId || !remoteThreadId || !providerInstanceId || !model || !updateId
+    || !updatedAt || revision < 1) return null;
+  if (!CLIENT_ID_PATTERN.test(nativeThreadId) || !CLIENT_ID_PATTERN.test(remoteThreadId)
+    || !CLIENT_ID_PATTERN.test(providerInstanceId)) return null;
+  if (source !== "android" && source !== "desktop" && source !== "migration") return null;
+  const options = storedModelOptions(row.options);
+  return {
+    nativeThreadId,
+    remoteThreadId,
+    providerInstanceId,
+    model,
+    ...(options !== undefined ? { options } : {}),
+    ...(capabilityVersion ? { capabilityVersion } : {}),
+    revision,
+    source,
+    updateId,
+    updatedAt,
+  };
+}
+
+function sameTaskSelection(
+  left: Pick<AndroidRemoteTaskSelection, "nativeThreadId" | "remoteThreadId" | "providerInstanceId" | "model" | "options" | "capabilityVersion">,
+  right: Pick<AndroidRemoteTaskSelection, "nativeThreadId" | "remoteThreadId" | "providerInstanceId" | "model" | "options" | "capabilityVersion">,
+): boolean {
+  return left.nativeThreadId === right.nativeThreadId
+    && left.remoteThreadId === right.remoteThreadId
+    && left.providerInstanceId === right.providerInstanceId
+    && left.model === right.model
+    && left.capabilityVersion === right.capabilityVersion
+    && JSON.stringify(left.options ?? null) === JSON.stringify(right.options ?? null);
+}
+
+function parseState(value: unknown): AndroidRemoteState {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return defaultState();
+  const root = value as Record<string, unknown>;
+  const rawSettings = root.settings && typeof root.settings === "object" && !Array.isArray(root.settings)
+    ? root.settings as Record<string, unknown>
+    : {};
+  return {
+    version: ANDROID_REMOTE_STATE_VERSION,
+    settings: {
+      controlEnabled: rawSettings.controlEnabled === true,
+      keepAwake: rawSettings.keepAwake === true,
+      tunnelMode: rawSettings.tunnelMode === "named" ? "named" : "quick",
+      ...(stringValue(rawSettings.namedTunnelHostname, 253)
+        ? { namedTunnelHostname: stringValue(rawSettings.namedTunnelHostname, 253)! }
+        : {}),
+    },
+    clients: Array.isArray(root.clients)
+      ? root.clients.flatMap(client => {
+          const parsed = storedClient(client);
+          return parsed ? [parsed] : [];
+        }).slice(0, 256)
+      : [],
+    threadAliases: Array.isArray(root.threadAliases)
+      ? root.threadAliases.flatMap(alias => {
+          const parsed = storedThreadAlias(alias);
+          return parsed ? [parsed] : [];
+        }).slice(-1024)
+      : [],
+    taskSelections: Array.isArray(root.taskSelections)
+      ? root.taskSelections.flatMap(selection => {
+          const parsed = storedTaskSelection(selection);
+          return parsed ? [parsed] : [];
+        }).slice(-4096)
+      : [],
+  };
+}
+
+function ensureStateDirectory(root: string): void {
+  assertNotRealHomeUnderTest(root);
+  if (!existsSync(root)) mkdirSync(root, { recursive: true, mode: 0o700 });
+  try { chmodSync(root, 0o700); } catch { /* platform may ignore chmod */ }
+  if (process.platform === "win32") hardenSecretDir(root, { required: false });
+}
+
+export function androidRemoteStatePath(root = getConfigDir()): string {
+  return join(root, "android-remote.json");
+}
+
+export function createAndroidRemoteStore(root = getConfigDir()): AndroidRemoteStore {
+  const path = androidRemoteStatePath(root);
+
+  const read = (): AndroidRemoteState => {
+    try {
+      if (!existsSync(path)) return defaultState();
+      hardenExistingSecret(path);
+      if (statSync(path).size > ANDROID_REMOTE_STATE_MAX_BYTES) return defaultState();
+      return parseState(JSON.parse(readFileSync(path, "utf8")));
+    } catch {
+      // Fail closed. Invalid local state never enables remote control or admits a client.
+      return defaultState();
+    }
+  };
+
+  const write = (state: AndroidRemoteState): AndroidRemoteState => {
+    ensureStateDirectory(root);
+    atomicWriteFile(path, `${JSON.stringify(state, null, 2)}\n`);
+    return state;
+  };
+
+  return {
+    stateRoot: root,
+    read,
+    updateSettings(patch) {
+      const current = read();
+      return write({
+        ...current,
+        settings: {
+          controlEnabled: patch.controlEnabled ?? current.settings.controlEnabled,
+          keepAwake: patch.keepAwake ?? current.settings.keepAwake,
+          tunnelMode: patch.tunnelMode ?? current.settings.tunnelMode,
+          ...(patch.namedTunnelHostname !== undefined
+            ? patch.namedTunnelHostname.trim().length > 0
+              ? { namedTunnelHostname: patch.namedTunnelHostname.trim() }
+              : {}
+            : current.settings.namedTunnelHostname
+              ? { namedTunnelHostname: current.settings.namedTunnelHostname }
+              : {}),
+        },
+      });
+    },
+    upsertClient(client) {
+      const parsed = storedClient(client);
+      if (!parsed) throw new TypeError("invalid Android Remote client");
+      const current = read();
+      const clients = current.clients.filter(row => row.id !== parsed.id);
+      clients.push(parsed);
+      return write({ ...current, clients: clients.slice(-256) });
+    },
+    updateClientMetadata(id, patch) {
+      const current = read();
+      let changed = false;
+      const clients = current.clients.map(client => {
+        if (client.id !== id) return client;
+        const label = patch.label?.trim().slice(0, 160);
+        const os = patch.os?.trim().slice(0, 64);
+        changed = true;
+        return {
+          ...client,
+          ...(label ? { label } : {}),
+          ...(os ? { os } : {}),
+        };
+      });
+      return changed ? write({ ...current, clients }) : current;
+    },
+    touchClient(id, patch) {
+      const current = read();
+      let changed = false;
+      const clients = current.clients.map(client => {
+        if (client.id !== id) return client;
+        changed = true;
+        return {
+          ...client,
+          lastSeenAt: patch.lastSeenAt,
+          ...(patch.address ? { address: patch.address } : {}),
+        };
+      });
+      return changed ? write({ ...current, clients }) : current;
+    },
+    revokeClient(id) {
+      const current = read();
+      const clients = current.clients.filter(client => client.id !== id);
+      if (clients.length === current.clients.length) return { removed: false, state: current };
+      return { removed: true, state: write({ ...current, clients }) };
+    },
+    upsertThreadAlias(alias) {
+      const parsed = storedThreadAlias(alias);
+      if (!parsed) throw new TypeError("invalid Android Remote task mapping");
+      const current = read();
+      const threadAliases = current.threadAliases.filter(row =>
+        row.remoteThreadId !== parsed.remoteThreadId && row.nativeThreadId !== parsed.nativeThreadId);
+      threadAliases.push(parsed);
+      return write({ ...current, threadAliases: threadAliases.slice(-1024) });
+    },
+    removeThreadAlias(remoteThreadId) {
+      const current = read();
+      const threadAliases = current.threadAliases.filter(row => row.remoteThreadId !== remoteThreadId);
+      return threadAliases.length === current.threadAliases.length
+        ? current
+        : write({ ...current, threadAliases });
+    },
+    upsertTaskSelection(input) {
+      const current = read();
+      const existing = current.taskSelections.find(row =>
+        row.nativeThreadId === input.nativeThreadId || row.remoteThreadId === input.remoteThreadId);
+      if (existing?.updateId === input.updateId) {
+        return { applied: false, duplicate: true, stale: false, selection: existing, state: current };
+      }
+      const expectedRevision = input.expectedRevision;
+      if (expectedRevision !== undefined && expectedRevision !== (existing?.revision ?? 0)) {
+        if (!existing) throw new TypeError("invalid Android Remote task selection revision");
+        return { applied: false, duplicate: false, stale: true, selection: existing, state: current };
+      }
+      const candidate = storedTaskSelection({
+        ...input,
+        revision: (existing?.revision ?? 0) + 1,
+      });
+      if (!candidate) throw new TypeError("invalid Android Remote task selection");
+      if (existing && sameTaskSelection(existing, candidate)) {
+        return { applied: false, duplicate: true, stale: false, selection: existing, state: current };
+      }
+      const taskSelections = current.taskSelections.filter(row =>
+        row.nativeThreadId !== candidate.nativeThreadId && row.remoteThreadId !== candidate.remoteThreadId);
+      taskSelections.push(candidate);
+      const state = write({ ...current, taskSelections: taskSelections.slice(-4096) });
+      return { applied: true, duplicate: false, stale: false, selection: candidate, state };
+    },
+    removeTaskSelection(threadId) {
+      const current = read();
+      const taskSelections = current.taskSelections.filter(row =>
+        row.nativeThreadId !== threadId && row.remoteThreadId !== threadId);
+      return taskSelections.length === current.taskSelections.length
+        ? current
+        : write({ ...current, taskSelections });
+    },
+  };
+}

package/src/android-remote/thread-reconciliation.ts

@@ -0,0 +1,133 @@
+type JsonRecord = Record<string, unknown>;
+
+export type CodexThreadListCandidate = {
+  thread: JsonRecord;
+  archived: boolean;
+};
+
+export type CanonicalCodexThread = {
+  thread: JsonRecord;
+  archived: boolean;
+};
+
+function stringValue(value: unknown): string {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function finiteNumber(value: unknown): number | null {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+
+function timestamp(thread: JsonRecord, key: "createdAt" | "updatedAt" | "recencyAt"): number {
+  return finiteNumber(thread[key]) ?? Number.NEGATIVE_INFINITY;
+}
+
+function candidateRecency(candidate: CodexThreadListCandidate): number {
+  const recencyAt = finiteNumber(candidate.thread.recencyAt);
+  if (recencyAt !== null) return recencyAt;
+  const updatedAt = finiteNumber(candidate.thread.updatedAt);
+  if (updatedAt !== null) return updatedAt;
+  return timestamp(candidate.thread, "createdAt");
+}
+
+function compareCandidates(
+  left: CodexThreadListCandidate,
+  right: CodexThreadListCandidate,
+): number {
+  const recency = candidateRecency(left) - candidateRecency(right);
+  if (recency !== 0) return recency;
+  const updated = timestamp(left.thread, "updatedAt") - timestamp(right.thread, "updatedAt");
+  if (updated !== 0) return updated;
+  const created = timestamp(left.thread, "createdAt") - timestamp(right.thread, "createdAt");
+  if (created !== 0) return created;
+  return stringValue(left.thread.path).localeCompare(stringValue(right.thread.path));
+}
+
+function maximumTimestamp(
+  candidates: readonly CodexThreadListCandidate[],
+  key: "updatedAt" | "recencyAt",
+): number | undefined {
+  const values = candidates
+    .map(candidate => finiteNumber(candidate.thread[key]))
+    .filter((value): value is number => value !== null);
+  return values.length > 0 ? Math.max(...values) : undefined;
+}
+
+function minimumCreatedAt(candidates: readonly CodexThreadListCandidate[]): number | undefined {
+  const values = candidates
+    .map(candidate => finiteNumber(candidate.thread.createdAt))
+    .filter((value): value is number => value !== null);
+  return values.length > 0 ? Math.min(...values) : undefined;
+}
+
+function sourcePaths(candidates: readonly CodexThreadListCandidate[]): string[] {
+  const paths = new Set<string>();
+  for (const candidate of [...candidates].sort(compareCandidates)) {
+    const path = stringValue(candidate.thread.path);
+    if (path) paths.add(path);
+  }
+  return [...paths];
+}
+
+/**
+ * Codex can retain more than one physical rollout for one logical thread
+ * (resume/revert/history repair). Android has one row per logical thread, so
+ * reconcile those physical records before applying aliases or projecting UI.
+ */
+export function canonicalizeCodexThreadCandidates(
+  candidates: readonly CodexThreadListCandidate[],
+): CanonicalCodexThread[] {
+  const grouped = new Map<string, CodexThreadListCandidate[]>();
+  for (const candidate of candidates) {
+    const id = stringValue(candidate.thread.id);
+    if (!id) continue;
+    const rows = grouped.get(id) ?? [];
+    rows.push(candidate);
+    grouped.set(id, rows);
+  }
+
+  const canonical: CanonicalCodexThread[] = [];
+  for (const rows of grouped.values()) {
+    const active = rows.filter(candidate => !candidate.archived);
+    const selectable = active.length > 0 ? active : rows;
+    const preferred = [...selectable].sort(compareCandidates).at(-1)!;
+    const paths = sourcePaths(rows);
+    const createdAt = minimumCreatedAt(rows);
+    const updatedAt = maximumTimestamp(rows, "updatedAt");
+    const recencyAt = maximumTimestamp(rows, "recencyAt");
+    const preferredPath = stringValue(preferred.thread.path);
+    canonical.push({
+      archived: active.length === 0,
+      thread: {
+        ...preferred.thread,
+        ...(createdAt === undefined ? {} : { createdAt }),
+        ...(updatedAt === undefined ? {} : { updatedAt }),
+        ...(recencyAt === undefined ? {} : { recencyAt }),
+        ...(paths.length > 0
+          ? {
+              path: preferredPath || paths.at(-1),
+              androidRemoteSourcePaths: paths,
+            }
+          : {}),
+      },
+    });
+  }
+
+  return canonical.sort((left, right) => compareCandidates(right, left));
+}
+
+export function codexThreadSourcePaths(thread: JsonRecord): string[] {
+  const paths = new Set<string>();
+  if (Array.isArray(thread.androidRemoteSourcePaths)) {
+    for (const value of thread.androidRemoteSourcePaths) {
+      const path = stringValue(value);
+      if (path) paths.add(path);
+    }
+  }
+  const primary = stringValue(thread.path);
+  if (primary) {
+    paths.delete(primary);
+    paths.add(primary);
+  }
+  return [...paths];
+}