@wardby/cli 0.5.3 → 0.7.0

package/dist/native-worker/warm-pool.js

@@ -0,0 +1,283 @@
+/**
+ * The native sandbox warm pool (phase 6, docs/native-sandbox.md): up to NATIVE_SANDBOX_WARM_POOL_SIZE
+ * idle workers, each already isolated (on Kubernetes: attested and probed from inside), holding no
+ * run data and no capability. A run claims one with a compare-and-swap on its row
+ * (warm-pool-ledger.ts), its input arrives by exec only after the claim, and the worker is
+ * destroyed after that one run like any other. With no idle worker, or any doubt about the one it
+ * claimed, a run cold-launches exactly as without a pool.
+ *
+ * Maintenance runs in the process that calls the executor's `launch()`: every tick it reaps rows
+ * whose runs have ended, retires idle workers that are too old, of another spec, gone, or over the
+ * size (only ever unclaimed ones), and replenishes the deficit. Claims work from any process.
+ */
+import { randomBytes } from "node:crypto";
+import { logger } from "../core/logger.js";
+import { nativeWarmWorkerName } from "./docker-isolation.js";
+const poolLog = logger.child({ module: "native-warm-pool" });
+export const NATIVE_SANDBOX_WARM_DELIVERY_FAILED = "native_sandbox_warm_delivery_failed";
+/** A pool worker waits this much longer than the max age, so a claim never meets one about to exit. */
+const WAIT_MARGIN_MS = 5 * 60_000;
+/** How long another configuration's idle worker is left alone before it is retired (rolling updates). */
+const OTHER_SPEC_GRACE_MS = 60_000;
+/** How long a removed worker that may hold a capability has to be confirmed gone before a cold launch. */
+const GONE_TIMEOUT_MS = 30_000;
+const runEnded = (status) => status !== "pending" && status !== "running";
+/** A ManagedWorkerLauncher that hands a run a warm worker when it can, and cold-launches otherwise. */
+export class PooledWorkerLauncher {
+    options;
+    networkReadyAtLaunch;
+    waitMs;
+    specHash;
+    timer;
+    ticking;
+    /** The one pass queued behind a running one: a tick asked for mid-pass sees state from after the ask. */
+    queued;
+    warming = new Set();
+    /** Tokens this process is still starting: never reaped as abandoned, however slow. */
+    warmingHere = new Set();
+    /** The first pass (orphan sweep included) has run. */
+    swept = false;
+    constructor(options) {
+        this.options = options;
+        this.networkReadyAtLaunch = options.launcher.networkReadyAtLaunch;
+        this.waitMs = options.maxAgeMs + WAIT_MARGIN_MS;
+        this.specHash = options.launcher.warmSpecHash(this.waitMs);
+    }
+    get cold() {
+        return this.options.launcher;
+    }
+    now() {
+        return this.options.now?.() ?? Date.now();
+    }
+    sleep(ms) {
+        return (this.options.sleep ?? ((t) => new Promise((resolve) => setTimeout(resolve, t))))(ms);
+    }
+    async launch(input, launchOptions) {
+        const runId = input.runId;
+        const claimed = this.options.size > 0
+            ? await this.options.ledger
+                .claim(runId, this.specHash, new Date(this.now() - this.options.maxAgeMs))
+                .catch((err) => {
+                poolLog.warn({ err, runId }, "warm pool claim failed; launching cold");
+                return null;
+            })
+            : null;
+        if (!claimed) {
+            if (this.options.size > 0)
+                poolLog.info({ runId, event: "miss" }, "no idle warm worker; launching cold");
+            this.nudge();
+            return this.cold.launch(input, launchOptions);
+        }
+        const token = claimed.id;
+        this.nudge();
+        const intact = await this.cold.reattestWarm(token, this.waitMs).catch(() => false);
+        if (!intact) {
+            poolLog.warn({ runId, worker: claimed.name, event: "fallback" }, "claimed warm worker failed re-attest");
+            await this.discard(token);
+            return this.cold.launch(input, launchOptions);
+        }
+        try {
+            await this.cold.deliver(token, input);
+        }
+        catch (err) {
+            // The worker may hold the capability now: it must be gone before another worker gets it.
+            poolLog.warn({ err, runId, worker: claimed.name, event: "fallback" }, "warm delivery failed");
+            await this.cold.removeWarm(token).catch(() => { });
+            const gone = await this.confirmGone(token);
+            if (!gone) {
+                throw new Error(`${NATIVE_SANDBOX_WARM_DELIVERY_FAILED}: the run's input could not be delivered to its warm worker, which could not be confirmed stopped.`, { cause: err });
+            }
+            await this.options.ledger.remove(token);
+            return this.cold.launch(input, launchOptions);
+        }
+        if (this.networkReadyAtLaunch === false)
+            await this.options.onDelivered?.(runId);
+        poolLog.info({ runId, worker: claimed.name, event: "claimed" }, "run claimed a warm worker");
+        return this.cold.warmHandle(token);
+    }
+    async confirmGone(token) {
+        const until = this.now() + GONE_TIMEOUT_MS;
+        for (;;) {
+            const state = await this.cold.inspectWarm(token).catch(() => undefined);
+            if (state?.state === "missing")
+                return true;
+            if (this.now() >= until)
+                return false;
+            await this.sleep(1_000);
+        }
+    }
+    /** Removes a pool worker and its row. */
+    async discard(token) {
+        await this.cold.removeWarm(token).catch((err) => {
+            poolLog.warn({ err, token }, "removing a warm worker failed; the next tick retries");
+        });
+        await this.options.ledger.remove(token);
+    }
+    async claimedToken(runId) {
+        return (await this.options.ledger.forRun(runId))?.id;
+    }
+    handle(runId) {
+        const token = this.claimedToken(runId);
+        const handle = token.then((t) => (t ? this.cold.warmHandle(t) : this.cold.handle(runId)));
+        return {
+            exited: handle.then((h) => h.exited),
+            kill: () => void handle.then((h) => h.kill()),
+        };
+    }
+    async inspect(runId) {
+        const token = await this.claimedToken(runId);
+        return token ? this.cold.inspectWarm(token) : this.cold.inspect(runId);
+    }
+    async kill(runId) {
+        const token = await this.claimedToken(runId);
+        return token ? this.cold.killWarm(token) : this.cold.kill(runId);
+    }
+    async remove(runId) {
+        const token = await this.claimedToken(runId);
+        if (!token)
+            return this.cold.remove(runId);
+        await this.cold.removeWarm(token);
+        await this.options.ledger.remove(token);
+    }
+    listWorkers() {
+        return this.cold.listWorkers();
+    }
+    removeByWorkerName(name) {
+        return this.cold.removeByWorkerName(name);
+    }
+    get resolveGatewayUrl() {
+        return this.cold.resolveGatewayUrl?.bind(this.cold);
+    }
+    /**
+     * Starts maintenance: one pass now, then one every interval. At size 0 a pass is a single count
+     * of pool rows until one appears: a replica still running a bigger size during a rolling update
+     * can refill the pool after this replica's first pass, and only a later pass retires those.
+     */
+    async start() {
+        await this.tick();
+        this.swept = true;
+        if (!this.timer) {
+            this.timer = setInterval(() => this.nudge(), this.options.intervalMs ?? 15_000);
+            this.timer.unref?.();
+        }
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    /** Asks for a pass soon, only in the process running maintenance: a short-lived CLI never warms workers. */
+    nudge() {
+        if (this.timer)
+            void this.tick();
+    }
+    /** One maintenance pass; resolves once reaping and retiring are done (warming continues behind it). */
+    tick() {
+        if (this.ticking) {
+            this.queued ??= this.ticking.then(() => {
+                this.queued = undefined;
+                return this.tick();
+            });
+            return this.queued;
+        }
+        this.ticking = this.maintain()
+            .catch((err) => poolLog.warn({ err }, "warm pool maintenance failed"))
+            .finally(() => {
+            this.ticking = undefined;
+        });
+        return this.ticking;
+    }
+    /** Resolves once every worker this process is warming has settled (tests, shutdown). */
+    async settled() {
+        while (this.warming.size > 0)
+            await Promise.allSettled([...this.warming]);
+    }
+    async maintain() {
+        const { ledger, size } = this.options;
+        // With no pool configured, a pass costs one count until another replica leaves rows behind.
+        if (size === 0 && this.swept && (await ledger.count()) === 0)
+            return;
+        // Listed before the rows are read: a row always exists before its worker, so a worker listed
+        // here with no row below is an orphan, never one another replica is still creating.
+        const live = new Set(await this.cold.listWarm());
+        const rows = await ledger.workers();
+        const now = this.now();
+        const bornAfter = now - this.options.maxAgeMs;
+        const keepIdle = [];
+        for (const row of rows) {
+            live.delete(row.id);
+            if (row.status === "claimed") {
+                if (!row.run || runEnded(row.run.status))
+                    await this.discard(row.id);
+            }
+            else if (row.status === "warming") {
+                if (row.createdAt.getTime() < now - this.options.warmTimeoutMs - 60_000 && !this.warmingHere.has(row.id)) {
+                    await this.discard(row.id);
+                    poolLog.info({ worker: row.name, event: "reaped" }, "abandoned warming worker removed");
+                }
+            }
+            else if (row.status === "retiring") {
+                await this.discard(row.id);
+            }
+            else if (row.specHash !== this.specHash) {
+                // Another configuration's worker is never claimed here. It is retired once it is past the
+                // grace, not at once: during a rolling update the old and new replicas would otherwise
+                // retire each other's fresh workers and refill their own, over and over.
+                if (row.createdAt.getTime() < now - OTHER_SPEC_GRACE_MS)
+                    await this.retire(row, "stale");
+            }
+            else {
+                const stale = row.createdAt.getTime() <= bornAfter;
+                const running = !stale && (await this.cold.inspectWarm(row.id).catch(() => undefined))?.state === "running";
+                if (running)
+                    keepIdle.push(row);
+                else
+                    await this.retire(row, stale ? "stale" : "gone");
+            }
+        }
+        // Over the size (it was lowered): retire the oldest idle workers first.
+        keepIdle.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
+        for (const row of keepIdle.slice(0, Math.max(0, keepIdle.length - size)))
+            await this.retire(row, "excess");
+        for (const orphan of live) {
+            await this.cold.removeWarm(orphan).catch(() => { });
+            poolLog.info({ token: orphan, event: "reaped" }, "orphan warm worker removed");
+        }
+        if (size > 0)
+            await this.replenish();
+    }
+    async retire(row, reason) {
+        // Only an idle worker is retired: the compare-and-swap loses to a claim.
+        if (!(await this.options.ledger.retire(row.id)))
+            return;
+        await this.discard(row.id);
+        poolLog.info({ worker: row.name, reason, event: "retired" }, "warm worker retired");
+    }
+    async replenish() {
+        const newToken = this.options.newToken ?? (() => randomBytes(10).toString("hex"));
+        const reserved = await this.options.ledger.reserve(this.specHash, this.options.size, newToken, nativeWarmWorkerName);
+        for (const { id, name } of reserved) {
+            this.warmingHere.add(id);
+            const started = this.now();
+            const warming = this.cold
+                .startWarm(id, this.waitMs)
+                .then(async () => {
+                if (await this.options.ledger.markIdle(id)) {
+                    poolLog.info({ worker: name, ms: this.now() - started, event: "warmed" }, "warm worker ready");
+                }
+                else {
+                    await this.discard(id);
+                }
+            })
+                .catch(async (err) => {
+                poolLog.warn({ err, worker: name }, "starting a warm worker failed");
+                await this.options.ledger.remove(id).catch(() => { });
+            })
+                .finally(() => {
+                this.warmingHere.delete(id);
+                this.warming.delete(warming);
+            });
+            this.warming.add(warming);
+        }
+    }
+}

package/dist/native-worker/worker.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The worker side of the native sandbox contract: runs the unchanged
+ * NativeEngine with an EngineRunContext whose every outside effect is a
+ * gateway call. User tools run here, in QuickJS, with their privileged
+ * bridges (fetch, datastore, secrets, console) served by the gateway; built-in
+ * tools run on the gateway. Worker-safe: no database, provider adapter, or
+ * credential is reachable from this module's imports (worker-imports.test.ts).
+ */
+import type { LlmStreamEvent } from "../providers/llm/types.js";
+import { type GatewayRequest, type WorkerInput } from "./protocol.js";
+/** How the worker reaches the gateway. Errors arrive as GatewayError. */
+export interface GatewayTransport {
+    call(request: GatewayRequest): Promise<unknown>;
+    stream(request: GatewayRequest): AsyncIterable<LlmStreamEvent>;
+}
+/** Runs one native run to its result and reports it with `finish`. Resolves when done. */
+export declare function runNativeWorker(input: WorkerInput, transport: GatewayTransport): Promise<void>;

package/dist/native-worker/worker.js

@@ -0,0 +1,141 @@
+/**
+ * The worker side of the native sandbox contract: runs the unchanged
+ * NativeEngine with an EngineRunContext whose every outside effect is a
+ * gateway call. User tools run here, in QuickJS, with their privileged
+ * bridges (fetch, datastore, secrets, console) served by the gateway; built-in
+ * tools run on the gateway. Worker-safe: no database, provider adapter, or
+ * credential is reachable from this module's imports (worker-imports.test.ts).
+ */
+import { NativeEngine } from "../core/engine-native.js";
+import { computeCost } from "../providers/llm/pricing-core.js";
+import { PRIVILEGED_BRIDGE_NAMES } from "../sandbox/host-functions.js";
+import { runUserToolCall } from "../sandbox/user-tool.js";
+import { rememberSecretValue } from "./stderr-redaction.js";
+import { GatewayError, NATIVE_WORKER_PROTOCOL_VERSION, } from "./protocol.js";
+const isPending = (value) => typeof value === "object" && value !== null && value.pending === true;
+/** Runs one native run to its result and reports it with `finish`. Resolves when done. */
+export async function runNativeWorker(input, transport) {
+    let sequence = 0;
+    const nextCallId = (kind) => `${kind}-${++sequence}`;
+    const request = (method, params) => ({
+        v: NATIVE_WORKER_PROTOCOL_VERSION,
+        runId: input.runId,
+        callId: nextCallId(method),
+        method,
+        params,
+    });
+    const call = (method, params) => transport.call(request(method, params));
+    // Set when the gateway refuses a model call for budget: the run ends budget_exhausted, as in
+    // process, not failed.
+    let budgetRefused = false;
+    const llm = {
+        stream: (req) => (async function* () {
+            try {
+                yield* transport.stream(request("llm.stream", { request: req }));
+            }
+            catch (err) {
+                if (err instanceof GatewayError && err.code === "budget_exhausted")
+                    budgetRefused = true;
+                throw err;
+            }
+        })(),
+        countTokens: async (model, messages, tools) => (await call("llm.countTokens", {
+            model,
+            messages: messages,
+            ...(tools ? { tools } : {}),
+        })),
+        // Local and exact: the run's pinned entry, the same computeCost the gateway's adapters use.
+        priceUsd: (_model, usage) => computeCost(input.pricing, usage),
+    };
+    const builtins = new Set(input.builtinTools);
+    let invocations = 0;
+    const remoteHost = (tool) => {
+        const invocation = `t${++invocations}`;
+        return Object.fromEntries(PRIVILEGED_BRIDGE_NAMES.map((bridge) => [
+            bridge,
+            async (argsJson) => {
+                try {
+                    const result = await call("host.call", { tool, invocation, bridge, argsJson });
+                    // A secret value now lives in this process: keep it out of everything it writes to stderr.
+                    if (bridge === "__bridge_secretsGet" && typeof result === "string")
+                        rememberSecretValue(result);
+                    return result;
+                }
+                catch (err) {
+                    // A bridge failure reaches the tool as the same error message it would see in-process.
+                    if (err instanceof GatewayError && err.code === "bridge_error")
+                        throw new Error(err.message, { cause: err });
+                    throw err;
+                }
+            },
+        ]));
+    };
+    const runSandboxTool = async (name, argsJson) => {
+        if (builtins.has(name)) {
+            // A long-running built-in (a delegation) answers `pending`; ask again with the same callId,
+            // which the gateway resumes wherever it got to — on any replica.
+            const builtinRequest = request("builtin.call", { name, argsJson });
+            let result = await transport.call(builtinRequest);
+            while (isPending(result))
+                result = await transport.call(builtinRequest);
+            return result;
+        }
+        const tool = input.userTools[name];
+        if (!tool) {
+            return JSON.stringify({ error: "unknown_tool", message: `No tool named "${name}" is attached to this agent.` });
+        }
+        const host = remoteHost(name);
+        return runUserToolCall(tool, argsJson, () => host);
+    };
+    let textSeq = 0;
+    let textSent = Promise.resolve();
+    const concurrent = new Set(input.runsConcurrently);
+    const ctx = {
+        agent: input.agent,
+        tools: input.tools,
+        providers: { llm },
+        runSandboxTool,
+        ...(concurrent.size > 0 ? { runsConcurrently: (toolName) => concurrent.has(toolName) } : {}),
+        onText: (delta) => {
+            // One text call at a time: the gateway admits each call asynchronously, so concurrent ones
+            // can arrive out of order, and it drops any delta older than the last one it delivered.
+            const seq = textSeq++;
+            textSent = textSent.then(() => call("text", { seq, delta }).then(() => { }, () => {
+                // Streamed text is for live observers only; the final text travels with `finish`.
+            }));
+        },
+        onProgress: async (progress) => {
+            await call("progress", { turns: progress.turns, usage: progress.usage });
+        },
+    };
+    let result;
+    try {
+        result = await new NativeEngine().run(ctx);
+    }
+    catch (err) {
+        // A gateway failure (a delegation that could not be created, say) ends the run as failed with
+        // its code, not as an opaque worker exit. run_not_drivable means the run already ended.
+        if (!(err instanceof GatewayError) || err.code === "run_not_drivable")
+            throw err;
+        await textSent;
+        await call("finish", {
+            status: "failed",
+            finalText: "",
+            turns: 0,
+            // `internal` wraps raw exception text on some transports, so only its code (and the cause
+            // code the gateway carried with it, if any) is persisted, never its message.
+            error: err.code === "internal"
+                ? `native_sandbox_gateway_error: internal${err.causeCode ? `: ${err.causeCode}` : ""}`
+                : `native_sandbox_gateway_error: ${err.code}: ${err.message.slice(0, 1024)}`,
+        });
+        return;
+    }
+    // Live text reaches observers before the run is reported finished.
+    await textSent;
+    await call("finish", {
+        status: budgetRefused && result.status === "failed" ? "budget_exhausted" : result.status,
+        finalText: result.finalText,
+        turns: result.turns,
+        ...(result.error !== undefined ? { error: result.error } : {}),
+    });
+}

package/dist/observability/metrics.js

@@ -133,8 +133,13 @@ export class WardbyMetrics {
     }
     observeProxyAudit = (event) => {
         this.proxyAuditEvents.inc({ event: event.type });
-        if (event.reservationUsd !== undefined)
+        // A completed reply repeats its request's hold (for the overshoot audit): count it once, when held.
+        // A refused request carries the hold that did not fit, which was never reserved.
+        if (event.reservationUsd !== undefined &&
+            event.type !== "response.completed" &&
+            event.type !== "request.rejected") {
             this.proxyBudgetReserved.inc(event.reservationUsd);
+        }
         if (event.type !== "response.completed")
             return;
         if (event.costUsd !== undefined)

package/dist/providers/auth/authorization-server.d.ts

@@ -1,8 +1,11 @@
+import type { MobileConfig } from "../../config/mobile.js";
 export interface SelfHostedAuthConfig {
     canonicalUri: string;
     signingKey: string;
     credentialHashKey: string;
     maxClients?: number;
+    /** Mobile sign-in: its one private-use redirect is accepted only while enabled. */
+    mobile?: MobileConfig;
 }
 export interface RegisterClientParams {
     redirectUris: string[];

package/dist/providers/auth/index.js

@@ -20,11 +20,13 @@ export function buildAuthProvider(kind, config, db) {
         }
         if (config.credentialHashKey.toLowerCase() === process.env.SECRET_APP_KEY?.toLowerCase())
             throw new Error("Credential and encryption keys must be distinct.");
+        logger.info({ module: "auth", mobileEnabled: config.mobile.enabled, mobileRedirectUri: config.mobile.redirectUri }, "self-hosted OAuth mobile sign-in");
         return new SelfHostedAuthProvider({
             canonicalUri: config.audience,
             signingKey: config.signingKey,
             credentialHashKey: config.credentialHashKey,
             maxClients: config.maxClients,
+            mobile: config.mobile,
         }, db);
     }
     return new DelegatingAuthProvider(config);

package/dist/providers/auth/self-hosted.d.ts

@@ -11,6 +11,10 @@ export type { AuthorizeParams, RegisterClientParams, SelfHostedAuthConfig, Token
  * scheme, host, path, query — must match exactly, with no userinfo or fragment.
  */
 export declare function redirectMatches(registered: readonly string[], requested: string): boolean;
+/** The mobile app's redirect while WARDBY_MOBILE_ENABLED is off. The message is safe to show to the client. */
+export declare class MobileDisabledError extends Error {
+    constructor();
+}
 export declare class SelfHostedAuthProvider implements AuthProvider {
     readonly db: PrismaClient;
     readonly credentials: Credentials;
@@ -49,9 +53,9 @@ export declare class SelfHostedAuthProvider implements AuthProvider {
             createdAt: Date;
             id: string;
             state: string | null;
-            clientId: string;
-            expiresAt: Date;
             resource: string;
+            expiresAt: Date;
+            clientId: string;
             consumedAt: Date | null;
             redirectUri: string;
             codeChallenge: string;
@@ -74,6 +78,14 @@ export declare class SelfHostedAuthProvider implements AuthProvider {
     private withinCanonical;
     private exchange;
     private rotate;
+    /**
+     * Whether `redirectUri` is a mobile (non-web, non-loopback) redirect this
+     * server refuses now. Only the currently configured mobile redirect, while
+     * mobile sign-in is enabled, passes - so a client registered under an earlier
+     * WARDBY_MOBILE_REDIRECT_URI is refused whether mobile is on or off.
+     * Web and loopback redirects are never affected.
+     */
+    private refusedRedirect;
     private issue;
     private revokeFamily;
     revoke(token: string, clientId: string): Promise<void>;

package/dist/providers/auth/self-hosted.js

@@ -7,6 +7,7 @@ import { SCOPES_SUPPORTED, limitScope } from "../../mcp/auth/resource-server.js"
 import { canonicalUrl } from "../../mcp/transport/http-limits.js";
 import { Credentials, DAY, decodeKey, lockUser } from "../../mcp/auth/self-hosted/credentials.js";
 import { Sessions } from "../../mcp/auth/self-hosted/session.js";
+import { MOBILE_DISABLED } from "../../config/mobile.js";
 const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
 /**
  * Whether `requested` is one of a client's registered redirect URIs. A native
@@ -43,7 +44,21 @@ export function redirectMatches(registered, requested) {
         }
     });
 }
-function validRedirect(value) {
+/** The mobile app's redirect while WARDBY_MOBILE_ENABLED is off. The message is safe to show to the client. */
+export class MobileDisabledError extends Error {
+    constructor() {
+        super(`${MOBILE_DISABLED}: mobile sign-in is not enabled on this server (WARDBY_MOBILE_ENABLED).`);
+        this.name = "MobileDisabledError";
+    }
+}
+/**
+ * A registrable redirect: https, loopback http, or exactly the configured
+ * mobile redirect (RFC 8252 §7.1). This checks format only; whether mobile
+ * sign-in is enabled is enforced in each flow.
+ */
+function validRedirect(value, mobileRedirect) {
+    if (mobileRedirect !== undefined && value === mobileRedirect)
+        return true;
     try {
         const u = new URL(value);
         return (!value.includes("#") &&
@@ -55,9 +70,16 @@ function validRedirect(value) {
         return false;
     }
 }
-const registration = z
+const registration = (mobileRedirect) => z
     .object({
-    redirectUris: z.array(z.string().min(1).max(2048).refine(validRedirect)).min(1).max(10),
+    redirectUris: z
+        .array(z
+        .string()
+        .min(1)
+        .max(2048)
+        .refine((value) => validRedirect(value, mobileRedirect)))
+        .min(1)
+        .max(10),
     clientName: z.string().max(100).optional(),
     grantTypes: z
         .array(z.enum(["authorization_code", "refresh_token"]))
@@ -114,7 +136,9 @@ export class SelfHostedAuthProvider {
         };
     }
     async registerClient(params) {
-        const p = registration.parse(params);
+        const p = registration(this.config.mobile?.redirectUri).parse(params);
+        if (p.redirectUris.some((uri) => this.refusedRedirect(uri)))
+            throw new MobileDisabledError();
         return this.db.$transaction(async (tx) => {
             await tx.$queryRawUnsafe("SELECT 1 AS locked FROM pg_advisory_xact_lock(7412901)");
             if ((await tx.oAuthClient.count()) >= (this.config.maxClients ?? 1000))
@@ -143,6 +167,8 @@ export class SelfHostedAuthProvider {
         if (!redirectMatches(metadata?.redirect_uris ?? [], p.redirectUri) ||
             !metadata?.grant_types?.includes("authorization_code"))
             throw new Error("Invalid client or redirect.");
+        if (this.refusedRedirect(p.redirectUri))
+            throw new MobileDisabledError();
         const scope = limitScope(p.scope, SCOPES_SUPPORTED);
         const request = await this.db.oAuthAuthorizationRequest.create({
             data: {
@@ -258,6 +284,8 @@ export class SelfHostedAuthProvider {
         if (!/^[A-Za-z0-9._~-]{43,128}$/.test(p.codeVerifier) ||
             createHash("sha256").update(p.codeVerifier).digest("base64url") !== code.codeChallenge)
             throw new Error("Invalid grant: PKCE verifier mismatch.");
+        if (this.refusedRedirect(code.redirectUri))
+            throw new MobileDisabledError();
         return this.db.$transaction(async (tx) => {
             const user = await lockUser(tx, code.userId);
             const consumed = await tx.oAuthAuthorizationCode.updateMany({
@@ -305,6 +333,13 @@ export class SelfHostedAuthProvider {
                 await this.revokeFamily(tx, grant.familyId);
                 return "refresh token reused; family revoked";
             }
+            // Not token reuse: refuse without revoking, so the family works again
+            // once mobile sign-in is re-enabled. This checks every redirect the
+            // client registered, not just the one its code used: a client registered
+            // with both an https and a mobile redirect is refused while mobile is off.
+            const redirects = grant.family.client.metadata.redirect_uris ?? [];
+            if (redirects.some((uri) => this.refusedRedirect(uri)))
+                return MOBILE_DISABLED;
             const result = await this.issue(tx, grant.family, user.principal.subject);
             await tx.oAuthGrant.update({
                 where: { id: grant.id },
@@ -312,10 +347,25 @@ export class SelfHostedAuthProvider {
             });
             return result;
         });
+        if (result === MOBILE_DISABLED)
+            throw new MobileDisabledError();
         if (typeof result === "string")
             throw new Error(`Invalid grant: ${result}.`);
         return result;
     }
+    /**
+     * Whether `redirectUri` is a mobile (non-web, non-loopback) redirect this
+     * server refuses now. Only the currently configured mobile redirect, while
+     * mobile sign-in is enabled, passes - so a client registered under an earlier
+     * WARDBY_MOBILE_REDIRECT_URI is refused whether mobile is on or off.
+     * Web and loopback redirects are never affected.
+     */
+    refusedRedirect(redirectUri) {
+        if (validRedirect(redirectUri))
+            return false;
+        const mobile = this.config.mobile;
+        return !(mobile?.enabled === true && redirectUri === mobile.redirectUri);
+    }
     async issue(tx, family, subject) {
         const refresh = this.credentials.create("rvr");
         await tx.oAuthGrant.create({