gestalt-mobile 0.10.0 → 0.12.0

package/dist/server/server/platform/events/websocket-heartbeat.js

@@ -3,12 +3,16 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-export function installWebSocketHeartbeat(socket, intervalMs = 25_000) {
+export function installWebSocketHeartbeat(socket, intervalMs = 25_000, isAuthorized = () => true) {
     let alive = true;
     socket.on('pong', () => {
         alive = true;
     });
     const interval = setInterval(() => {
+        if (!isAuthorized()) {
+            socket.terminate();
+            return;
+        }
         if (!alive) {
             socket.terminate();
             return;

package/dist/server/server/platform/http/authorization-boundary.js

@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { parseAuthorizationSessionId } from '../../features/auth/domain/identifiers.js';
+import { problem } from './problem.js';
+const publicApi = new Set([
+    'GET /api/auth/status',
+    'POST /api/auth/login/options',
+    'POST /api/auth/login/verify',
+    'POST /api/auth/logout',
+    'POST /api/auth/register/options',
+    'POST /api/auth/register/verify',
+]);
+export function registerAuthorizationBoundary(app, deps) {
+    app.addHook('onRequest', async (request, reply) => {
+        if (!request.url.startsWith('/api/'))
+            return;
+        if (isUnsafe(request.method) && request.headers.origin !== deps.publicOrigin)
+            return reply
+                .code(403)
+                .type('application/problem+json')
+                .send(problem('ORIGIN_NOT_ALLOWED', 403, 'The request origin is not allowed.'));
+        if (publicApi.has(`${request.method} ${request.routeOptions.url}`))
+            return;
+        if (authorizationSessionDevice(request.headers.cookie, deps) !== null)
+            return;
+        return reply
+            .code(401)
+            .type('application/problem+json')
+            .send(problem('AUTH_REQUIRED', 401, 'Authentication is required.'));
+    });
+}
+/** Shared by HTTP and raw WebSocket upgrades; the opaque cookie is never logged. */
+export function authorizationSessionDevice(cookieHeader, deps) {
+    const token = cookieValue(cookieHeader, 'gestalt_mobile_session');
+    const session = parseAuthorizationSessionId(token);
+    return session === null
+        ? null
+        : deps.repository.sessionDevice(session, deps.clock.now().toISOString());
+}
+function cookieValue(header, name) {
+    if (!header)
+        return undefined;
+    let found;
+    for (const part of header.split(';')) {
+        const [key, ...value] = part.trim().split('=');
+        if (key !== name)
+            continue;
+        const candidate = value.join('=');
+        if (!candidate || found !== undefined)
+            return undefined;
+        found = candidate;
+    }
+    return found;
+}
+function isUnsafe(method) {
+    return method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+}

package/dist/server/server/platform/plans/filesystem-plan-status-source.js

@@ -50,13 +50,21 @@ export class FilesystemPlanStatusSource {
     async remove(sessionId, identity) {
         const statusPath = this.activeStatusPaths.get(sessionId);
         const signal = statusPath ? await this.readStatusForRollback(statusPath) : undefined;
-        if (statusPath)
-            await this.statusRemovalFilesystem.rm(statusPath, { force: true });
+        if (statusPath) {
+            try {
+                await this.statusRemovalFilesystem.rm(statusPath, { force: true });
+            }
+            catch (error) {
+                this.leases.get(sessionId)?.allowRepeatedUpdate();
+                throw error;
+            }
+        }
         try {
             if (identity)
                 await this.dismiss(sessionId, identity);
         }
         catch (error) {
+            this.leases.get(sessionId)?.allowRepeatedUpdate();
             if (signal !== undefined && statusPath)
                 await this.restoreStatus(statusPath, signal);
             throw error;
@@ -147,6 +155,7 @@ class ActiveLease {
     debounce;
     closed = false;
     activeStatusPath;
+    lastEmittedUpdate;
     constructor(statusDirectory, sessionId, workspacePath, listener, planReadFilesystem, isDismissed, onActiveStatusPath, onClose) {
         this.statusDirectory = statusDirectory;
         this.sessionId = sessionId;
@@ -164,7 +173,7 @@ class ActiveLease {
             void this.consumeChanges();
         }
         catch {
-            this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+            this.emitUnavailable();
         }
     }
     close() {
@@ -180,6 +189,9 @@ class ActiveLease {
         if (this.activeStatusPath)
             await rm(this.activeStatusPath, { force: true });
     }
+    allowRepeatedUpdate() {
+        this.lastEmittedUpdate = undefined;
+    }
     async consumeChanges() {
         try {
             for await (const event of this.watcher) {
@@ -197,7 +209,7 @@ class ActiveLease {
         }
         catch {
             if (!this.closed)
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
         }
     }
     pendingStatusPath;
@@ -233,7 +245,7 @@ class ActiveLease {
         }
         catch {
             if (!this.closed)
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
         }
     }
     async refresh(statusPath, parsedSignal) {
@@ -260,13 +272,18 @@ class ActiveLease {
                     const previousStatusPath = this.activeStatusPath;
                     this.activeStatusPath = statusPath;
                     this.onActiveStatusPath(statusPath);
-                    this.listener({ kind: 'updated', plan: result.plan, identity, planPath, reason: signal.reason });
+                    const update = { kind: 'updated', plan: result.plan, identity, planPath, reason: signal.reason };
+                    const serializedUpdate = JSON.stringify(update);
+                    if (serializedUpdate !== this.lastEmittedUpdate) {
+                        this.lastEmittedUpdate = serializedUpdate;
+                        this.listener(update);
+                    }
                     if (previousStatusPath && previousStatusPath !== statusPath)
                         await rm(previousStatusPath, { force: true }).catch(() => { });
                 }
             }
             else if (!this.closed) {
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
             }
         }
         catch (error) {
@@ -275,9 +292,13 @@ class ActiveLease {
                 statusPath !== this.activeStatusPath)
                 return;
             if (!this.closed)
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
         }
     }
+    emitUnavailable() {
+        this.lastEmittedUpdate = undefined;
+        this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+    }
 }
 function parseSignal(source) {
     try {

package/dist/server/server/platform/plans/filesystem-workspace-plan-catalog.js

@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { lstat, readdir, readFile, realpath, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+import { parseSupervisedPlan } from '../../features/plans/application/parse-supervised-plan.js';
+const maximumPlans = 100;
+const maximumBytes = 1_048_576;
+/**
+ * Bounded, passive access to direct `.gestalt/*.org` children. Every path is
+ * revalidated after discovery so a workspace cannot escape through symlinks or
+ * replacement races.
+ */
+export class FilesystemWorkspacePlanCatalog {
+    filesystem;
+    constructor(filesystem = { lstat, readdir, readFile, realpath, stat }) {
+        this.filesystem = filesystem;
+    }
+    async list(workspacePath) {
+        const directory = await this.directory(workspacePath);
+        if (!directory)
+            return [];
+        let names;
+        try {
+            names = (await this.filesystem.readdir(directory, { encoding: 'utf8' }))
+                .filter((name) => isPlanName(name))
+                .sort((left, right) => left.localeCompare(right));
+        }
+        catch {
+            return [];
+        }
+        const entries = [];
+        for (const name of names.slice(0, maximumPlans)) {
+            const result = await this.readFromDirectory(workspacePath, directory, name);
+            if (result.kind !== 'available')
+                continue;
+            entries.push(toEntry(name, result.plan));
+        }
+        return entries;
+    }
+    async read(workspacePath, planName) {
+        if (!isPlanName(planName))
+            return { kind: 'missing' };
+        const directory = await this.directory(workspacePath);
+        if (!directory)
+            return { kind: 'missing' };
+        return this.readFromDirectory(workspacePath, directory, planName);
+    }
+    async directory(workspacePath) {
+        if (!isAbsolute(workspacePath))
+            return null;
+        const workspace = resolve(workspacePath);
+        const directory = join(workspace, '.gestalt');
+        try {
+            const metadata = await this.filesystem.lstat(directory);
+            if (!metadata.isDirectory() || metadata.isSymbolicLink())
+                return null;
+            const [canonicalWorkspace, canonicalDirectory] = await Promise.all([
+                this.filesystem.realpath(workspace),
+                this.filesystem.realpath(directory),
+            ]);
+            return dirname(canonicalDirectory) === canonicalWorkspace ? canonicalDirectory : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async readFromDirectory(workspacePath, directory, planName) {
+        const path = join(directory, planName);
+        try {
+            const before = await this.filesystem.lstat(path);
+            if (!before.isFile() || before.isSymbolicLink() || before.size > maximumBytes)
+                return { kind: 'unavailable' };
+            const canonical = await this.filesystem.realpath(path);
+            if (dirname(canonical) !== directory || basename(canonical) !== planName)
+                return { kind: 'unavailable' };
+            const source = await this.filesystem.readFile(canonical, 'utf8');
+            const after = await this.filesystem.stat(canonical);
+            if (!after.isFile() || after.size !== before.size || after.ino !== before.ino || after.dev !== before.dev)
+                return { kind: 'unavailable' };
+            const parsed = parseSupervisedPlan({ source, planPath: canonical, workspacePath });
+            return parsed.kind === 'available' ? parsed : { kind: 'unavailable' };
+        }
+        catch (error) {
+            return error.code === 'ENOENT'
+                ? { kind: 'missing' }
+                : { kind: 'unavailable' };
+        }
+    }
+}
+function isPlanName(value) {
+    return (value.endsWith('.org') &&
+        value !== '.org' &&
+        !isAbsolute(value) &&
+        basename(value) === value &&
+        !value.includes('\\') &&
+        value !== '.' &&
+        value !== '..');
+}
+function toEntry(planName, plan) {
+    return {
+        planName,
+        title: plan.title,
+        ...(plan.subtitle === undefined ? {} : { subtitle: plan.subtitle }),
+        ...(plan.date === undefined ? {} : { date: plan.date }),
+        ...(plan.keywords === undefined ? {} : { keywords: plan.keywords }),
+        totalSteps: plan.totalSteps,
+        doneSteps: plan.doneSteps,
+        allDone: plan.allDone,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gestalt-mobile",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Mobile-first web relay for durable Codex development sessions",
   "keywords": [
     "codex",
@@ -33,7 +33,7 @@
   },
   "scripts": {
     "dev": "node scripts/dev.mjs",
-    "dev:server": "tsx watch src/server/main.ts -- --cwd ..",
+    "dev:server": "tsx watch src/server/main.ts -- --cwd .. --public-origin http://localhost:5173",
     "start": "node dist/server/server/main.js",
     "dev:client": "vite",
     "build": "npm run build:server && npm run build:client",
@@ -55,8 +55,12 @@
     "license:apply": "node scripts/apply-license-headers.mjs"
   },
   "dependencies": {
+    "@fastify/cookie": "11.1.2",
     "@fastify/static": "^10.1.0",
+    "@simplewebauthn/browser": "13.3.0",
+    "@simplewebauthn/server": "13.3.2",
     "fastify": "^5.10.0",
+    "qrcode": "^1.5.4",
     "ws": "^8.21.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
@@ -66,6 +70,7 @@
     "@sveltejs/vite-plugin-svelte": "^7.2.0",
     "@testing-library/svelte": "^5.4.2",
     "@types/node": "^24.13.3",
+    "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",
     "eslint": "^10.7.0",
     "jsdom": "^29.1.1",