gestalt-mobile 0.12.0 → 0.13.0

package/dist/server/server/features/git/register-routes.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { registerCheckoutBranch } from './checkout-branch/endpoint.js';
+import { registerCloneRepository } from './clone-repository/endpoint.js';
+import { registerGetGitSummary } from './get-summary/endpoint.js';
+import { registerPullRebase } from './pull-rebase/endpoint.js';
+import { registerPushUpstream } from './push-upstream/endpoint.js';
+import { registerRefreshGit } from './refresh/endpoint.js';
+export function registerGitRoutes(app, deps) {
+    const git = deps.gitSummary;
+    if (!git)
+        return;
+    registerGetGitSummary(app, { workspaces: git.workspaces, inspect: git.inspect });
+    registerPushUpstream(app, {
+        workspaces: git.workspaces,
+        inspect: git.inspectForPush ?? git.inspect,
+        push: git.push,
+        idempotency: git.idempotency,
+    });
+    registerRefreshGit(app, {
+        workspaces: git.workspaces,
+        refresh: git.refresh,
+        idempotency: git.idempotency,
+    });
+    if (git.pull && git.checkout) {
+        registerPullRebase(app, { workspaces: git.workspaces, pull: git.pull });
+        registerCheckoutBranch(app, { workspaces: git.workspaces, checkout: git.checkout });
+    }
+    if (git.clone)
+        registerCloneRepository(app, { workspaces: git.workspaces, clone: git.clone });
+}

package/dist/server/server/features/plans/register-routes.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { registerClosePlan } from './close-plan/endpoint.js';
+import { registerGetPlanMeasurement } from './get-measurement/endpoint.js';
+import { registerGetPlan } from './get-plan/endpoint.js';
+import { registerGetWorkspacePlan } from './get-workspace-plan/endpoint.js';
+import { registerListWorkspacePlans } from './list-workspace-plans/endpoint.js';
+export function registerPlanRoutes(app, deps) {
+    if (deps.planRoutes) {
+        registerGetPlan(app, deps.planRoutes);
+        registerClosePlan(app, deps.planRoutes);
+    }
+    if (deps.workspacePlanRoutes) {
+        registerListWorkspacePlans(app, deps.workspacePlanRoutes);
+        registerGetWorkspacePlan(app, deps.workspacePlanRoutes);
+    }
+    if (deps.planMeasurementRoutes)
+        registerGetPlanMeasurement(app, deps.planMeasurementRoutes);
+}

package/dist/server/server/features/sessions/promote-recent-thread/endpoint.js

@@ -9,7 +9,7 @@ const requestSchema = z.object({
     cwd: z.string().startsWith('/'),
 });
 export function registerPromoteRecentThread(app, deps) {
-    app.post('/api/sessions/recent-threads/open', async (request, reply) => {
+    app.post('/api/sessions/recent-threads/open', { bodyLimit: 8 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         if (!parsed.success)
             return reply.code(400).send({ code: 'INVALID_RECENT_THREAD' });

package/dist/server/server/features/sessions/register-routes.js

@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { authorizationSessionDevice } from '../../platform/http/authorization-boundary.js';
+import { stopSession } from './lifecycle/use-case.js';
+import { registerForgetSession } from './forget-session/endpoint.js';
+import { registerGetHistory } from './get-history/endpoint.js';
+import { registerGetSession } from './get-session/endpoint.js';
+import { registerInterruptTurn } from './interrupt-turn/endpoint.js';
+import { registerListRecentThreads } from './list-recent-threads/endpoint.js';
+import { registerListSessions } from './list-sessions/endpoint.js';
+import { registerPromoteRecentThread } from './promote-recent-thread/endpoint.js';
+import { registerReleaseSession } from './release-session/endpoint.js';
+import { registerRestoreSession } from './restore-session/endpoint.js';
+import { registerRespondInteraction } from './respond-interaction/endpoint.js';
+import { registerSelectModel } from './select-model/endpoint.js';
+import { registerSessionEvents } from './session-events/endpoint.js';
+import { registerStartSession } from './start-session/endpoint.js';
+import { registerStartTurn } from './start-turn/endpoint.js';
+import { registerStopSession } from './stop-session/endpoint.js';
+export function registerSessionRoutes(app, deps) {
+    const sessions = deps.sessionRoutes;
+    if (deps.recentThreads) {
+        registerListRecentThreads(app, {
+            ...deps.recentThreads,
+            metadata: (threadId) => {
+                const session = sessions?.list?.().find((candidate) => candidate.threadId === threadId);
+                if (!session)
+                    return null;
+                return {
+                    ...(session.model === undefined ? {} : { model: session.model }),
+                    ...(session.effectiveSkillSelection?.selectedProfileName === undefined
+                        ? {}
+                        : { skillProfile: session.effectiveSkillSelection.selectedProfileName }),
+                    ...(session.lastOrgPlan === undefined
+                        ? {}
+                        : { orgPlanFilename: session.lastOrgPlan.filename }),
+                };
+            },
+        });
+    }
+    if (sessions) {
+        registerStartSession(app, {
+            ...sessions,
+            reportFailure: (operation, error) => deps.logger.error(`${operation} failed: ${safeErrorLabel(error)}`),
+        });
+        registerGetSession(app, sessions.find);
+        if (sessions.list)
+            registerListSessions(app, { list: sessions.list });
+        if (sessions.readHistory)
+            registerGetHistory(app, {
+                find: sessions.find,
+                read: sessions.readHistory,
+                currentSequence: sessions.currentSequence ?? (() => 0),
+            });
+        if (sessions.startTurn)
+            registerStartTurn(app, {
+                find: sessions.find,
+                start: sessions.startTurn,
+                save: sessions.save,
+                onStarted: sessions.onTurnStarted,
+            });
+        if (sessions.models)
+            registerSelectModel(app, {
+                find: sessions.find,
+                models: () => sessions.models.list(),
+                now: sessions.now,
+                save: sessions.save,
+            });
+        if (sessions.interruptTurn)
+            registerInterruptTurn(app, { find: sessions.find, interrupt: sessions.interruptTurn });
+        if (sessions.restore)
+            registerRestoreSession(app, {
+                find: sessions.find,
+                restore: sessions.restore,
+                save: sessions.save,
+                idempotency: sessions.idempotency,
+            });
+        if (deps.recentThreads && sessions.promoteRecent)
+            registerPromoteRecentThread(app, {
+                list: () => deps.recentThreads.list(),
+                promote: sessions.promoteRecent,
+            });
+        if (sessions.release && sessions.close)
+            registerReleaseSession(app, {
+                find: sessions.find,
+                release: sessions.release,
+                save: sessions.save,
+                close: sessions.close,
+                idempotency: sessions.idempotency,
+            });
+        if (sessions.remove && sessions.close)
+            registerForgetSession(app, {
+                find: sessions.find,
+                close: sessions.close,
+                remove: sessions.remove,
+            });
+        if (sessions.close)
+            registerStopSession(app, {
+                find: sessions.find,
+                stop: (session) => stopSession(session, sessions.now()),
+                save: sessions.save,
+                close: sessions.close,
+                idempotency: sessions.idempotency,
+            });
+        if (sessions.replyInteraction && deps.interactions)
+            registerRespondInteraction(app, {
+                exists: (id) => sessions.find(id) !== null,
+                resolve: (sessionId, requestId, resolvedAt) => deps.interactions.resolve(sessionId, requestId, resolvedAt),
+                validate: deps.interactions.validate,
+                reply: sessions.replyInteraction,
+                resolved: sessions.interactionResolved,
+                now: sessions.now,
+            });
+    }
+    if (deps.sessionEvents)
+        registerSessionEvents(app, {
+            ...deps.sessionEvents,
+            ...(deps.auth
+                ? {
+                    publicOrigin: deps.auth.relyingParty.publicOrigin,
+                    authorized: (cookieHeader) => authorizationSessionDevice(cookieHeader, deps.auth) !== null,
+                }
+                : {}),
+        });
+}
+function safeErrorLabel(error) {
+    if (typeof error === 'object' && error !== null && 'code' in error) {
+        const code = error.code;
+        if (typeof code === 'string' && /^[A-Z0-9_]+$/.test(code))
+            return code;
+    }
+    if (error instanceof Error && /^[A-Z0-9_]+$/.test(error.message))
+        return error.message;
+    return error instanceof Error ? error.name : 'UNKNOWN_ERROR';
+}

package/dist/server/server/features/sessions/respond-interaction/endpoint.js

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 export function registerRespondInteraction(app, deps) {
-    app.post('/api/sessions/:id/interactions/:requestId', async (request, reply) => {
+    app.post('/api/sessions/:id/interactions/:requestId', { bodyLimit: 64 * 1024 }, async (request, reply) => {
         const { id, requestId } = request.params;
         if (!deps.exists(id))
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });

package/dist/server/server/features/sessions/select-model/endpoint.js

@@ -5,7 +5,7 @@
  */
 import { RelaySession } from '../model/relay-session.js';
 export function registerSelectModel(app, deps) {
-    app.post('/api/sessions/:id/model', async (request, reply) => {
+    app.post('/api/sessions/:id/model', { bodyLimit: 4 * 1024 }, async (request, reply) => {
         const session = deps.find(request.params.id);
         if (!session)
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });

package/dist/server/server/features/sessions/start-session/endpoint.js

@@ -9,7 +9,7 @@ import { startSession } from './use-case.js';
 import { SkillProfileError } from '../../skills/model/errors.js';
 import { problem } from '../../../platform/http/problem.js';
 export function registerStartSession(app, deps) {
-    app.post('/api/sessions', async (request, reply) => {
+    app.post('/api/sessions', { bodyLimit: 4 * 1024 }, async (request, reply) => {
         const key = idempotencyKey(request.headers);
         const prior = key ? deps.idempotency?.get('start-session', key) : null;
         if (prior)
@@ -31,7 +31,10 @@ export function registerStartSession(app, deps) {
         catch (error) {
             deps.reportFailure?.('start-session', error);
             if (error instanceof SkillProfileError)
-                return reply.code(400).type('application/problem+json').send(problem(error.code, 400, error.code === 'UNKNOWN_SKILL_PROFILE'
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem(error.code, 400, error.code === 'UNKNOWN_SKILL_PROFILE'
                     ? 'The selected skill profile does not exist.'
                     : 'The selected skill profile is invalid.'));
             throw error;

package/dist/server/server/features/sessions/start-turn/endpoint.js

@@ -4,7 +4,8 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 export function registerStartTurn(app, deps) {
-    app.post('/api/sessions/:id/turns', async (request, reply) => {
+    // Text is capped at 100,000 characters; leave room for JSON encoding only.
+    app.post('/api/sessions/:id/turns', { bodyLimit: 128 * 1024 }, async (request, reply) => {
         const session = deps.find(request.params.id);
         if (!session)
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });

package/dist/server/server/features/skills/register-routes.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { registerDeleteSkillProfile } from './delete-profile/endpoint.js';
+import { registerListAvailableSkills } from './list-available/endpoint.js';
+import { registerListSkillProfiles } from './list-profiles/endpoint.js';
+import { registerReplaceSkillProfile } from './replace-profile/endpoint.js';
+export function registerSkillRoutes(app, deps) {
+    if (!deps.skills)
+        return;
+    registerListAvailableSkills(app, deps.skills);
+    registerListSkillProfiles(app, deps.skills);
+    registerReplaceSkillProfile(app, deps.skills);
+    registerDeleteSkillProfile(app, deps.skills);
+}

package/dist/server/server/features/skills/replace-profile/endpoint.js

@@ -7,14 +7,23 @@ import { z } from 'zod';
 import { createSkillProfile, normalizeSkillProfileName } from '../model/skill-profile.js';
 import { SkillProfileError } from '../model/errors.js';
 import { problem } from '../../../platform/http/problem.js';
-const requestSchema = z.object({ version: z.literal(1), name: z.string(), skills: z.array(z.object({ name: z.string(), path: z.string(), enabled: z.boolean() }).strict()) }).strict();
+const requestSchema = z
+    .object({
+    version: z.literal(1),
+    name: z.string(),
+    skills: z.array(z.object({ name: z.string(), path: z.string(), enabled: z.boolean() }).strict()),
+})
+    .strict();
 export function registerReplaceSkillProfile(app, deps) {
-    app.put('/api/skill-profiles/:name', async (request, reply) => {
+    app.put('/api/skill-profiles/:name', { bodyLimit: 64 * 1024 }, async (request, reply) => {
         const body = requestSchema.safeParse(request.body);
         try {
             const name = normalizeSkillProfileName(request.params.name);
             if (!body.success || normalizeSkillProfileName(body.data.name) !== name)
-                return reply.code(400).type('application/problem+json').send(problem('INVALID_SKILL_PROFILE', 400, 'The route and body profile names must match.'));
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem('INVALID_SKILL_PROFILE', 400, 'The route and body profile names must match.'));
             const profile = createSkillProfile(body.data);
             const existed = await deps.readGlobalProfile(name);
             await deps.replaceGlobalProfile(profile);
@@ -22,8 +31,14 @@ export function registerReplaceSkillProfile(app, deps) {
         }
         catch (error) {
             if (error instanceof SkillProfileError)
-                return reply.code(400).type('application/problem+json').send(problem('INVALID_SKILL_PROFILE', 400, 'The skill profile could not be stored.'));
-            return reply.code(500).type('application/problem+json').send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'The skill profile could not be stored.', true));
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem('INVALID_SKILL_PROFILE', 400, 'The skill profile could not be stored.'));
+            return reply
+                .code(500)
+                .type('application/problem+json')
+                .send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'The skill profile could not be stored.', true));
         }
     });
 }

package/dist/server/server/platform/auth/sqlite-authorization-store.js

@@ -9,6 +9,7 @@ import { dirname, join, resolve } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { authorizedDeviceId, localOwnerId, passkeyCeremonyId, webAuthnCredentialId, } from '../../features/auth/domain/identifiers.js';
 import { deviceNickname } from '../../features/auth/domain/device-nickname.js';
+import { CeremonyCapacityError } from '../../features/auth/domain/errors.js';
 const OWNER_ID = localOwnerId('local-owner');
 const SCHEMA_VERSION = 1;
 const SQLITE_BUSY_TIMEOUT_MS = 5_000;
@@ -234,10 +235,28 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
             throw error;
         }
     }
-    saveCeremony(token, ceremony) {
-        this.db
-            .prepare('INSERT INTO auth_ceremonies (token_hash, purpose, challenge, expected_origin, rp_id, expires_at, ticket_hash) VALUES (?, ?, ?, ?, ?, ?, ?)')
-            .run(hash(token), ceremony.purpose, ceremony.challenge, ceremony.expectedOrigin, ceremony.rpId, ceremony.expiresAt, ceremony.enrollmentTicket ? hash(ceremony.enrollmentTicket) : null);
+    saveCeremony(token, ceremony, now) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            // Admission and cleanup share one immediate transaction, so separate
+            // processes cannot both observe the same remaining slot.
+            this.db.prepare('DELETE FROM auth_ceremonies WHERE consumed_at IS NOT NULL').run();
+            if (now)
+                this.db.prepare('DELETE FROM auth_ceremonies WHERE expires_at <= ?').run(now);
+            const active = this.db
+                .prepare('SELECT count(*) AS count FROM auth_ceremonies WHERE consumed_at IS NULL')
+                .get();
+            if (active.count >= 64)
+                throw new CeremonyCapacityError('Ceremony capacity reached');
+            this.db
+                .prepare('INSERT INTO auth_ceremonies (token_hash, purpose, challenge, expected_origin, rp_id, expires_at, ticket_hash) VALUES (?, ?, ?, ?, ?, ?, ?)')
+                .run(hash(token), ceremony.purpose, ceremony.challenge, ceremony.expectedOrigin, ceremony.rpId, ceremony.expiresAt, ceremony.enrollmentTicket ? hash(ceremony.enrollmentTicket) : null);
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
     }
     consumeCeremony(token, now) {
         this.db.exec('BEGIN IMMEDIATE');
@@ -286,8 +305,12 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
         this.db.exec('BEGIN IMMEDIATE');
         try {
             const creator = hash(creatorSession);
-            this.db.prepare('DELETE FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL').run(creator);
-            this.db.prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at, creator_session_hash) VALUES (?, ?, NULL, ?)').run(hash(token), expiresAt, creator);
+            this.db
+                .prepare('DELETE FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL')
+                .run(creator);
+            this.db
+                .prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at, creator_session_hash) VALUES (?, ?, NULL, ?)')
+                .run(hash(token), expiresAt, creator);
             this.db.exec('COMMIT');
         }
         catch (error) {

package/dist/server/server/platform/codex/normalizer.js

@@ -5,29 +5,52 @@
  */
 import { relative } from 'node:path';
 export function normalizeCodexNotification(sessionId, sequence, occurredAt, notification, workspacePath) {
-    if (notification.method === 'item/agentMessage/delta')
+    const decoded = decodeNotification(notification);
+    if (!decoded)
+        return null;
+    if (decoded.method === 'item/agentMessage/delta')
         return {
             sessionId,
             sequence,
             occurredAt,
             type: 'agentMessageDelta',
-            payload: { text: notification.params?.delta ?? '' },
+            payload: { text: decoded.params.delta },
         };
-    if (notification.method === 'turn/completed')
+    if (decoded.method === 'turn/completed')
         return {
             sessionId,
             sequence,
             occurredAt,
             type: 'turnCompleted',
-            payload: notification.params ?? {},
+            payload: decoded.params,
         };
-    if (notification.method === 'item/started' || notification.method === 'item/completed') {
-        const activity = safeActivity(notification.params?.item, workspacePath);
+    if (decoded.method === 'item/started' || decoded.method === 'item/completed') {
+        const activity = safeActivity(decoded.params.item, workspacePath);
         if (activity)
             return { sessionId, sequence, occurredAt, type: 'activity.updated', payload: activity };
     }
     return null;
 }
+/** Strictly decode only consumed notification shapes; unknown/future methods stay isolated. */
+export function decodeNotification(input) {
+    if (input.method === 'item/agentMessage/delta') {
+        const params = record(input.params);
+        return typeof params?.delta === 'string' && params.delta.length <= 64_000
+            ? { method: input.method, params: { delta: params.delta } } : null;
+    }
+    if (input.method === 'turn/completed') {
+        const params = record(input.params);
+        const turn = record(params?.turn);
+        if (!turn || typeof turn.id !== 'string' || turn.id.length > 256)
+            return null;
+        return { method: input.method, params: { ...(typeof params?.threadId === 'string' && params.threadId.length <= 256 ? { threadId: params.threadId } : {}), turn: { id: turn.id, ...(typeof turn.status === 'string' && turn.status.length <= 64 ? { status: turn.status } : {}) } } };
+    }
+    if (input.method === 'item/started' || input.method === 'item/completed') {
+        const params = record(input.params);
+        return params && 'item' in params ? { method: input.method, params: { item: params.item } } : null;
+    }
+    return null;
+}
 function safeActivity(item, workspacePath) {
     if (!item || typeof item !== 'object')
         return null;
@@ -79,3 +102,6 @@ function reasoningSummary(parts) {
         return [];
     });
 }
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}

package/dist/server/server/platform/codex/protocol-compatibility.js

@@ -6,7 +6,25 @@
 export function protocolCompatibility(installedVersion, protocolVersion) {
     if (!installedVersion)
         return { compatible: false, code: 'CODEX_NOT_FOUND' };
-    if (installedVersion !== protocolVersion)
+    const installed = parseCoreVersion(installedVersion);
+    const expected = protocolVersion ? parseCoreVersion(protocolVersion) : undefined;
+    // 0.x is pre-1.0: the minor is the core wire contract.  Patch releases and
+    // newer compatible minors are accepted only within a small forward window;
+    // optional APIs are negotiated independently at runtime.
+    if (!installed || !expected || !coreCompatible(installed, expected))
         return { compatible: false, code: 'CODEX_PROTOCOL_MISMATCH' };
     return { compatible: true };
 }
+function parseCoreVersion(value) {
+    const match = /\b(\d+)\.(\d+)(?:\.(\d+))?\b/.exec(value);
+    if (!match)
+        return undefined;
+    return { major: Number(match[1]), minor: Number(match[2]) };
+}
+function coreCompatible(installed, expected) {
+    if (installed.major !== expected.major)
+        return false;
+    if (installed.major !== 0)
+        return installed.minor === expected.minor;
+    return installed.minor >= expected.minor && installed.minor <= expected.minor + 4;
+}

package/dist/server/server/platform/codex/server-request.js

@@ -5,6 +5,8 @@
  */
 import { GESTALT_QUIZ_TOOL_NAME, parseQuiz } from '../../../shared/contracts/quiz.js';
 export function toPendingInteraction(input) {
+    if (!Number.isSafeInteger(input.id) || !isRecord(input.params))
+        return null;
     if (input.method === 'item/tool/call') {
         if (!isRecord(input.params) || input.params.tool !== GESTALT_QUIZ_TOOL_NAME)
             return null;