gestalt-mobile 0.12.0 → 0.13.0

package/dist/server/server/platform/codex/session-runtime.js

@@ -9,9 +9,49 @@ import { createPlanMeasurementSnapshot, } from '../../features/plans/application
 import { canRebindMissingRollout, rebindMissingRollout, } from '../../features/sessions/restore-session/use-case.js';
 import { gestaltQuizDynamicTool } from '../../../shared/contracts/quiz.js';
 import { threadPlanName } from './thread-plan-name.js';
+/** One private owner for every resource acquired for a live Codex child. */
+class SessionResource {
+    sessionId;
+    process;
+    planStatusLease;
+    planMeasurementToken;
+    unregister;
+    onDisposed;
+    disposed = false;
+    pendingRequests = new Map();
+    threadId;
+    pendingThreadName;
+    writtenThreadName;
+    capabilities = new Map();
+    constructor(sessionId, process, planStatusLease, planMeasurementToken, unregister, onDisposed) {
+        this.sessionId = sessionId;
+        this.process = process;
+        this.planStatusLease = planStatusLease;
+        this.planMeasurementToken = planMeasurementToken;
+        this.unregister = unregister;
+        this.onDisposed = onDisposed;
+    }
+    dispose() {
+        if (this.disposed)
+            return false;
+        this.disposed = true;
+        for (const pending of this.pendingRequests.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(new Error('CODEX_SERVER_REQUEST_CANCELLED'));
+        }
+        this.pendingRequests.clear();
+        for (const unsubscribe of this.unregister)
+            unsubscribe();
+        this.process.close();
+        this.planStatusLease?.close();
+        this.onDisposed();
+        return true;
+    }
+    get active() { return !this.disposed; }
+    attach(unregister) { this.unregister = unregister; }
+}
 export class CodexSessionRuntime {
     launch;
-    processes;
     onNotification;
     onServerRequest;
     onProcessExit;
@@ -19,9 +59,13 @@ export class CodexSessionRuntime {
     planStatusSource;
     onPlanStatus;
     planMeasurementBaseUrl;
-    constructor(launch, processes = new Map(), onNotification, onServerRequest, onProcessExit, resolveSkills, planStatusSource, onPlanStatus, planMeasurementBaseUrl) {
+    requestTimeoutMs;
+    maxPendingRequests;
+    constructor(launch, 
+    // Kept as an ignored compatibility slot while callers migrate from the old
+    // correlated-map constructor shape.  Live ownership is `sessions` only.
+    _legacyProcesses = undefined, onNotification, onServerRequest, onProcessExit, resolveSkills, planStatusSource, onPlanStatus, planMeasurementBaseUrl, requestTimeoutMs = 30_000, maxPendingRequests = 64) {
         this.launch = launch;
-        this.processes = processes;
         this.onNotification = onNotification;
         this.onServerRequest = onServerRequest;
         this.onProcessExit = onProcessExit;
@@ -29,53 +73,37 @@ export class CodexSessionRuntime {
         this.planStatusSource = planStatusSource;
         this.onPlanStatus = onPlanStatus;
         this.planMeasurementBaseUrl = planMeasurementBaseUrl;
+        this.requestTimeoutMs = requestTimeoutMs;
+        this.maxPendingRequests = maxPendingRequests;
+        void _legacyProcesses;
     }
-    pendingRequests = new Map();
-    exitUnsubscribers = new Map();
-    threadIds = new Map();
-    planStatusLeases = new Map();
-    planMeasurementTokens = new Map();
-    pendingThreadNames = new Map();
-    writtenThreadNames = new Map();
+    sessions = new Map();
     async start(session, now, settings = {}) {
-        const process = await this.launchForSession(session);
+        const resource = await this.createResource(session);
         try {
-            process.rpc.onNotification((notification) => this.onNotification?.(session.id, notification));
-            process.rpc.onServerRequest((request) => this.holdServerRequest(session.id, request));
-            this.attachExitHandler(session.id, process);
-            await process.rpc.request('initialize', {
+            await resource.process.rpc.request('initialize', {
                 clientInfo: { name: 'gestalt-mobile', version: '0.1.0' },
                 capabilities: { experimentalApi: true },
             });
-            const startedThreadId = await this.startThread(process, session, settings);
-            this.processes.set(session.id, process);
-            this.threadIds.set(session.id, startedThreadId);
+            const startedThreadId = await this.startThread(resource.process, session, settings);
+            resource.threadId = startedThreadId;
+            this.sessions.set(session.id, resource);
             await this.writePendingThreadName(session.id);
             return RelaySession.rehydrate(session).bindThread(startedThreadId, now).snapshot;
         }
         catch (error) {
-            this.discardProcess(session.id, process);
+            resource.dispose();
             throw error;
         }
     }
     stop(sessionId) {
-        this.exitUnsubscribers.get(sessionId)?.();
-        this.exitUnsubscribers.delete(sessionId);
-        this.processes.get(sessionId)?.close();
-        this.processes.delete(sessionId);
-        this.threadIds.delete(sessionId);
-        this.pendingThreadNames.delete(sessionId);
-        this.writtenThreadNames.delete(sessionId);
-        this.clearPendingRequests(sessionId);
-        this.planMeasurementTokens.delete(sessionId);
-        this.releasePlanStatus(sessionId);
+        this.sessions.get(sessionId)?.dispose();
     }
     async release(sessionId) {
-        const process = this.processes.get(sessionId);
-        const threadId = this.threadIds.get(sessionId);
-        if (process && threadId) {
+        const resource = this.sessions.get(sessionId);
+        if (resource?.threadId) {
             try {
-                await process.rpc.request('thread/unsubscribe', { threadId });
+                await resource.process.rpc.request('thread/unsubscribe', { threadId: resource.threadId });
             }
             catch {
                 // Closing the child still releases relay ownership if Codex has already exited.
@@ -85,66 +113,63 @@ export class CodexSessionRuntime {
     }
     /** Releases all relay-owned app-server children during graceful shutdown. */
     stopAll() {
-        for (const sessionId of [...this.processes.keys()])
-            this.stop(sessionId);
-        for (const sessionId of [...this.planStatusLeases.keys()])
-            this.releasePlanStatus(sessionId);
+        for (const resource of [...this.sessions.values()])
+            resource.dispose();
     }
     resolveServerRequest(sessionId, requestId, result) {
-        const key = `${sessionId}:${requestId}`;
-        const resolve = this.pendingRequests.get(key);
-        if (!resolve)
+        const resource = this.sessions.get(sessionId);
+        const pending = resource?.pendingRequests.get(requestId);
+        if (!resource || !pending)
             return false;
-        this.pendingRequests.delete(key);
-        resolve(result);
+        resource.pendingRequests.delete(requestId);
+        clearTimeout(pending.timer);
+        pending.resolve(result);
         return true;
     }
     async startTurn(session, text, now) {
-        const process = this.processes.get(session.id);
-        if (!process || !session.threadId)
+        const resource = this.sessions.get(session.id);
+        if (!resource || !session.threadId)
             throw new Error('CODEX_SESSION_NOT_RUNNING');
-        const result = (await process.rpc.request('turn/start', {
+        const result = decodeTurnStart(await resource.process.rpc.request('turn/start', {
             threadId: session.threadId,
             input: [{ type: 'text', text, text_elements: [] }],
             ...(session.model ? { model: session.model } : {}),
         }));
-        if (!result.turn?.id)
-            throw new Error('CODEX_TURN_ID_MISSING');
-        return RelaySession.rehydrate(session).startTurn(result.turn.id, now).snapshot;
+        return RelaySession.rehydrate(session).startTurn(result, now).snapshot;
     }
     async interruptTurn(session, turnId) {
-        const process = this.processes.get(session.id);
-        if (!process || !session.threadId)
+        const resource = this.sessions.get(session.id);
+        if (!resource || !session.threadId)
             throw new Error('CODEX_SESSION_NOT_RUNNING');
-        await process.rpc.request('turn/interrupt', { threadId: session.threadId, turnId });
+        await resource.process.rpc.request('turn/interrupt', { threadId: session.threadId, turnId });
     }
     async readPlanMeasurement(session) {
-        const process = this.processes.get(session.id);
-        if (!process || !session.threadId)
+        const resource = this.sessions.get(session.id);
+        if (!resource || !session.threadId)
             throw new Error('CODEX_SESSION_NOT_RUNNING');
         const [rateLimits, thread] = await Promise.all([
-            process.rpc.request('account/rateLimits/read', {}),
-            process.rpc.request('thread/read', { threadId: session.threadId, includeTurns: true }),
+            resource.process.rpc.request('account/rateLimits/read', {}),
+            resource.process.rpc.request('thread/read', { threadId: session.threadId, includeTurns: true }),
         ]);
         return createPlanMeasurementSnapshot({
             capturedAt: new Date().toISOString(),
-            rateLimits: rateLimitWindows(rateLimits),
+            rateLimits: rateLimitWindows(decodeRateLimits(rateLimits)),
             tokenUsage: threadTokenUsage(thread),
         });
     }
     authorizePlanMeasurement(sessionId, authorization) {
-        const token = this.planMeasurementTokens.get(sessionId);
+        const token = this.sessions.get(sessionId)?.planMeasurementToken;
         return Boolean(token && authorization === `Bearer ${token}`);
     }
     async readHistory(session) {
-        const process = this.processes.get(session.id);
-        if (!process || !session.threadId)
+        const resource = this.sessions.get(session.id);
+        if (!resource || !session.threadId)
             throw new Error('CODEX_SESSION_NOT_RUNNING');
-        const result = (await process.rpc.request('thread/read', {
+        const result = decodeThreadRead(await resource.process.rpc.request('thread/read', {
             threadId: session.threadId,
             includeTurns: true,
         }));
-        const rawTurns = result.thread?.turns ?? [];
+        const rawTurns = result;
         const activeTurn = rawTurns.find((turn) => turn.status === 'inProgress' && typeof turn.id === 'string');
         return {
             turns: rawTurns.map((turn) => ({
@@ -161,18 +186,15 @@ export class CodexSessionRuntime {
     async restoreWithOutcome(session, now) {
         if (!session.threadId)
             throw new Error('CODEX_THREAD_ID_MISSING');
-        const process = await this.launchForSession(session);
+        const resource = await this.createResource(session);
         try {
-            process.rpc.onNotification((notification) => this.onNotification?.(session.id, notification));
-            process.rpc.onServerRequest((request) => this.holdServerRequest(session.id, request));
-            this.attachExitHandler(session.id, process);
-            await process.rpc.request('initialize', {
+            await resource.process.rpc.request('initialize', {
                 clientInfo: { name: 'gestalt-mobile', version: '0.1.0' },
                 capabilities: { experimentalApi: true },
             });
             let result;
             try {
-                await process.rpc.request('thread/resume', {
+                await resource.process.rpc.request('thread/resume', {
                     threadId: session.threadId,
                     cwd: session.workspacePath,
                     dynamicTools: [gestaltQuizDynamicTool],
@@ -186,63 +208,64 @@ export class CodexSessionRuntime {
             catch (error) {
                 if (!canRebindMissingRollout(session, error))
                     throw error;
-                const replacementThreadId = await this.startThread(process, session, { model: session.model });
+                const replacementThreadId = await this.startThread(resource.process, session, { model: session.model });
                 result = rebindMissingRollout(session, error, replacementThreadId, now);
             }
-            this.processes.set(session.id, process);
-            this.threadIds.set(session.id, result.session.threadId);
+            resource.threadId = result.session.threadId;
+            this.sessions.get(session.id)?.dispose();
+            this.sessions.set(session.id, resource);
             await this.writePendingThreadName(session.id);
             return result;
         }
         catch (error) {
-            this.discardProcess(session.id, process);
+            resource.dispose();
             throw error;
         }
     }
     /** Best-effort metadata only: failures never affect plan or session execution. */
     async syncThreadPlanName(sessionId, plan) {
-        this.pendingThreadNames.set(sessionId, threadPlanName(plan));
+        const resource = this.sessions.get(sessionId);
+        if (!resource)
+            return;
+        resource.pendingThreadName = threadPlanName(plan);
         await this.writePendingThreadName(sessionId);
     }
     async writePendingThreadName(sessionId) {
-        const process = this.processes.get(sessionId);
-        const threadId = this.threadIds.get(sessionId);
-        const name = this.pendingThreadNames.get(sessionId);
-        if (!process || !threadId || !name || this.writtenThreadNames.get(sessionId) === name)
+        const resource = this.sessions.get(sessionId);
+        const threadId = resource?.threadId;
+        const name = resource?.pendingThreadName;
+        if (!resource || !threadId || !name || resource.writtenThreadName === name || resource.capabilities.get('thread/name/set') === false)
             return;
         try {
-            await process.rpc.request('thread/name/set', { threadId, name });
-            this.writtenThreadNames.set(sessionId, name);
+            await resource.process.rpc.request('thread/name/set', { threadId, name });
+            if (resource.active) {
+                resource.capabilities.set('thread/name/set', true);
+                resource.writtenThreadName = name;
+            }
         }
-        catch {
+        catch (error) {
+            if (isMethodNotFound(error))
+                resource.capabilities.set('thread/name/set', false);
             // Unsupported servers and transient failures are bounded metadata failures.
         }
     }
-    holdServerRequest(sessionId, request) {
-        if (!this.onServerRequest?.(sessionId, request)) {
+    holdServerRequest(resource, request) {
+        if (!resource.active || !this.onServerRequest?.(resource.sessionId, request)) {
             return Promise.reject(new Error('CODEX_SERVER_REQUEST_UNSUPPORTED'));
         }
-        return new Promise((resolve) => this.pendingRequests.set(`${sessionId}:${request.id}`, resolve));
-    }
-    attachExitHandler(sessionId, process) {
-        this.exitUnsubscribers.set(sessionId, process.onExit?.(() => {
-            this.processes.delete(sessionId);
-            this.threadIds.delete(sessionId);
-            this.pendingThreadNames.delete(sessionId);
-            this.writtenThreadNames.delete(sessionId);
-            this.clearPendingRequests(sessionId);
-            this.planMeasurementTokens.delete(sessionId);
-            this.exitUnsubscribers.delete(sessionId);
-            this.releasePlanStatus(sessionId);
-            this.onProcessExit?.(sessionId);
-        }) ?? (() => { }));
+        if (resource.pendingRequests.size >= this.maxPendingRequests)
+            return Promise.reject(new Error('CODEX_SERVER_REQUEST_LIMIT'));
+        const requestId = String(request.id);
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                if (resource.pendingRequests.delete(requestId))
+                    reject(new Error('CODEX_SERVER_REQUEST_TIMEOUT'));
+            }, this.requestTimeoutMs);
+            resource.pendingRequests.set(requestId, { resolve, reject, timer });
+        });
     }
     async startThread(process, session, settings = {}) {
-        const result = (await process.rpc.request('thread/start', this.threadStartParams(session, settings)));
-        if (typeof result.thread?.id !== 'string' || !result.thread.id) {
-            throw new Error('CODEX_THREAD_ID_MISSING');
-        }
-        return result.thread.id;
+        return decodeThreadStart(await process.rpc.request('thread/start', this.threadStartParams(session, settings)));
     }
     threadStartParams(session, settings) {
         return {
@@ -253,31 +276,13 @@ export class CodexSessionRuntime {
             ...(settings.sandbox ? { sandbox: settings.sandbox } : {}),
         };
     }
-    discardProcess(sessionId, process) {
-        this.exitUnsubscribers.get(sessionId)?.();
-        this.exitUnsubscribers.delete(sessionId);
-        process.close();
-        this.clearPendingRequests(sessionId);
-        this.planMeasurementTokens.delete(sessionId);
-        this.releasePlanStatus(sessionId);
-    }
-    clearPendingRequests(sessionId) {
-        const prefix = `${sessionId}:`;
-        for (const key of this.pendingRequests.keys()) {
-            if (key.startsWith(prefix))
-                this.pendingRequests.delete(key);
-        }
-    }
-    async launchForSession(session) {
+    async createResource(session) {
         const lease = this.planStatusSource
             ? await this.planStatusSource.open({ id: session.id, workspacePath: session.workspacePath }, (update) => this.onPlanStatus?.(session.id, update))
             : undefined;
-        if (lease)
-            this.planStatusLeases.set(session.id, lease);
         try {
             const token = randomUUID();
-            this.planMeasurementTokens.set(session.id, token);
-            return this.launch({
+            const process = this.launch({
                 profile: session.profile,
                 cwd: session.workspacePath,
                 skillsConfig: await this.resolveSkills?.(session),
@@ -297,16 +302,31 @@ export class CodexSessionRuntime {
                     }
                     : {}),
             });
+            const resource = new SessionResource(session.id, process, lease, token, [], () => {
+                if (this.sessions.get(session.id) === resource)
+                    this.sessions.delete(session.id);
+            });
+            const notificationUnsubscribe = process.rpc.onNotification((notification) => {
+                if (resource.active)
+                    this.onNotification?.(session.id, notification);
+            });
+            const requestUnsubscribe = process.rpc.onServerRequest((request) => this.holdServerRequest(resource, request));
+            const exitUnsubscribe = process.onExit?.(() => {
+                if (resource.dispose())
+                    this.onProcessExit?.(session.id);
+            }) ?? (() => { });
+            // The resource's private unsubscribe list is populated before it is published.
+            resource.attach([notificationUnsubscribe, requestUnsubscribe, exitUnsubscribe]);
+            return resource;
         }
         catch (error) {
-            this.releasePlanStatus(session.id);
+            lease?.close();
             throw error;
         }
     }
-    releasePlanStatus(sessionId) {
-        this.planStatusLeases.get(sessionId)?.close();
-        this.planStatusLeases.delete(sessionId);
-    }
+}
+function isMethodNotFound(error) {
+    return Boolean(error && typeof error === 'object' && error.code === -32601);
 }
 function rateLimitWindows(value) {
     const limits = asRecord(value)?.rateLimits;
@@ -321,6 +341,16 @@ function rateLimitWindows(value) {
             : [];
     });
 }
+function decodeRateLimits(value) {
+    const limits = asRecord(value)?.rateLimits;
+    if (!Array.isArray(limits) || limits.length > 32)
+        return undefined;
+    const decoded = limits.flatMap((limit) => {
+        const record = asRecord(limit);
+        return typeof record?.windowDurationMins === 'number' && Number.isFinite(record.windowDurationMins) && typeof record.usedPercent === 'number' && Number.isFinite(record.usedPercent) ? [{ windowDurationMins: record.windowDurationMins, usedPercent: record.usedPercent }] : [];
+    });
+    return decoded.length === limits.length ? { rateLimits: decoded } : undefined;
+}
 function threadTokenUsage(value) {
     const turns = asRecord(asRecord(value)?.thread)?.turns;
     if (!Array.isArray(turns))
@@ -346,3 +376,41 @@ function threadTokenUsage(value) {
 function asRecord(value) {
     return value && typeof value === 'object' ? value : undefined;
 }
+function decodeThreadStart(value) {
+    const id = asRecord(asRecord(value)?.thread)?.id;
+    if (typeof id !== 'string' || !id || id.length > 256)
+        throw new Error('CODEX_THREAD_ID_MISSING');
+    return id;
+}
+function decodeTurnStart(value) {
+    const id = asRecord(asRecord(value)?.turn)?.id;
+    if (typeof id !== 'string' || !id || id.length > 256)
+        throw new Error('CODEX_TURN_ID_MISSING');
+    return id;
+}
+function decodeThreadRead(value) {
+    const turns = asRecord(asRecord(value)?.thread)?.turns;
+    if (!Array.isArray(turns) || turns.length > 10_000)
+        throw new Error('CODEX_THREAD_READ_MALFORMED');
+    return turns.map((turn) => {
+        const record = asRecord(turn);
+        if (!record)
+            throw new Error('CODEX_THREAD_READ_MALFORMED');
+        return { id: boundedString(record.id), status: boundedString(record.status), startedAt: typeof record.startedAt === 'number' ? record.startedAt : undefined, completedAt: typeof record.completedAt === 'number' ? record.completedAt : undefined, items: Array.isArray(record.items) ? record.items.flatMap(decodeHistoryItem) : undefined };
+    });
+}
+function boundedString(value, max = 64_000) { return typeof value === 'string' && value.length <= max ? value : undefined; }
+function decodeHistoryItem(value) {
+    const item = asRecord(value);
+    const id = boundedString(item?.id, 256);
+    const type = boundedString(item?.type, 64);
+    if (!item || !id || !type)
+        return [];
+    if (type === 'agentMessage')
+        return [{ id, type, ...(boundedString(item.text) ? { text: boundedString(item.text) } : {}), ...(boundedString(item.phase, 64) ? { phase: boundedString(item.phase, 64) } : {}) }];
+    if (type === 'plan' && boundedString(item.text))
+        return [{ id, type, text: boundedString(item.text) }];
+    if (type === 'commandExecution' && boundedString(item.command) && boundedString(item.status, 64))
+        return [{ id, type, command: boundedString(item.command), status: boundedString(item.status, 64), ...(typeof item.exitCode === 'number' ? { exitCode: item.exitCode } : {}) }];
+    return [];
+}

package/dist/server/server/platform/http/problem-handler.js

@@ -3,6 +3,7 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
+import { problem as createProblem } from './problem.js';
 export function registerProblemHandler(app, serveSpa = false) {
     app.setNotFoundHandler((request, reply) => {
         if (serveSpa && request.method === 'GET' && !request.url.startsWith('/api/')) {
@@ -19,6 +20,15 @@ export function registerProblemHandler(app, serveSpa = false) {
         return reply.code(404).type('application/problem+json').send(problem);
     });
     app.setErrorHandler((error, _request, reply) => {
+        if (typeof error === 'object' &&
+            error !== null &&
+            'code' in error &&
+            error.code === 'FST_ERR_CTP_BODY_TOO_LARGE') {
+            return reply
+                .code(413)
+                .type('application/problem+json')
+                .send(createProblem('PAYLOAD_TOO_LARGE', 413, 'The request body exceeds this endpoint limit.'));
+        }
         const problem = {
             type: 'urn:gestalt-mobile:error:internal',
             title: 'Internal server error',

package/dist/server/server/platform/http/problem-reply.js

@@ -0,0 +1,10 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { problem } from './problem.js';
+/** Send the established RFC 7807-compatible response without deciding its semantics. */
+export function sendProblem(reply, code, status, detail) {
+    return reply.code(status).type('application/problem+json').send(problem(code, status, detail));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gestalt-mobile",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Mobile-first web relay for durable Codex development sessions",
   "keywords": [
     "codex",
@@ -45,6 +45,7 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "test": "vitest run",
+    "audit:prod": "npm audit --omit=dev --audit-level=high",
     "test:open-profile-smoke": "tsx scripts/open-profile-smoke.ts",
     "test:watch": "vitest",
     "test:package": "node scripts/smoke-packed-cli.mjs",