gestalt-mobile 0.12.0 → 0.14.0

package/dist/server/server/features/skills/list-available/endpoint.js

@@ -7,13 +7,22 @@ import { z } from 'zod';
 import { applySkillSelectionSnapshot } from '../model/skill-profile.js';
 import { SkillProfileError } from '../model/errors.js';
 import { problem } from '../../../platform/http/problem.js';
-const querySchema = z.object({ workspaceId: z.string().min(1), profile: z.string().min(1), refresh: z.enum(['true']).optional() }).strict();
+const querySchema = z
+    .object({
+    workspaceId: z.string().min(1),
+    profile: z.string().min(1),
+    refresh: z.enum(['true']).optional(),
+})
+    .strict();
 /** Register the workspace-scoped skill discovery REPR slice. */
 export function registerListAvailableSkills(app, deps) {
     app.get('/api/skills', async (request, reply) => {
         const parsed = querySchema.safeParse(request.query);
         if (!parsed.success)
-            return reply.code(400).type('application/problem+json').send(problem('INVALID_SKILL_REQUEST', 400, 'workspaceId and profile are required.'));
+            return reply
+                .code(400)
+                .type('application/problem+json')
+                .send(problem('INVALID_SKILL_REQUEST', 400, 'workspaceId and profile are required.'));
         try {
             const [workspace, profile] = await Promise.all([
                 deps.workspaces.resolve(parsed.data.workspaceId),
@@ -52,10 +61,19 @@ export function registerListAvailableSkills(app, deps) {
             };
         }
         catch (error) {
-            if (error instanceof Error && (error.message === 'WORKSPACE_NOT_FOUND' || error.message === 'PROFILE_NOT_FOUND'))
-                return reply.code(404).type('application/problem+json').send(problem(error.message, 404, 'The requested catalog entry was not found.'));
-            const code = error instanceof SkillProfileError && error.code === 'INVALID_SKILL_PROFILE' ? 'INVALID_SKILL_PROFILE' : 'SKILL_DISCOVERY_FAILED';
-            return reply.code(502).type('application/problem+json').send(problem(code, 502, 'Skill discovery could not be completed.', true));
+            if (error instanceof Error &&
+                (error.message === 'WORKSPACE_NOT_FOUND' || error.message === 'PROFILE_NOT_FOUND'))
+                return reply
+                    .code(404)
+                    .type('application/problem+json')
+                    .send(problem(error.message, 404, 'The requested catalog entry was not found.'));
+            const code = error instanceof SkillProfileError && error.code === 'INVALID_SKILL_PROFILE'
+                ? 'INVALID_SKILL_PROFILE'
+                : 'SKILL_DISCOVERY_FAILED';
+            return reply
+                .code(502)
+                .type('application/problem+json')
+                .send(problem(code, 502, 'Skill discovery could not be completed.', true));
         }
     });
 }

package/dist/server/server/features/skills/list-profiles/endpoint.js

@@ -8,21 +8,45 @@ export function registerListSkillProfiles(app, deps) {
     app.get('/api/skill-profiles', async (_request, reply) => {
         try {
             const names = await deps.listGlobalProfileNames();
-            const profiles = await Promise.all(names.sort((a, b) => a.localeCompare(b)).map(async (name) => {
+            const profiles = await Promise.all(names
+                .sort((a, b) => a.localeCompare(b))
+                .map(async (name) => {
                 try {
                     const profile = await deps.readGlobalProfile(name);
                     return profile
-                        ? { name: profile.name, version: profile.version, path: deps.profilePath(name), skills: profile.skills }
-                        : { name, path: deps.profilePath(name), error: { code: 'INVALID_SKILL_PROFILE', message: 'Profile disappeared while reading.' } };
+                        ? {
+                            name: profile.name,
+                            version: profile.version,
+                            path: deps.profilePath(name),
+                            skills: profile.skills,
+                        }
+                        : {
+                            name,
+                            path: deps.profilePath(name),
+                            error: {
+                                code: 'INVALID_SKILL_PROFILE',
+                                message: 'Profile disappeared while reading.',
+                            },
+                        };
                 }
                 catch (error) {
-                    return { name, path: deps.profilePath(name), error: { code: 'INVALID_SKILL_PROFILE', message: error instanceof Error ? error.message : 'Invalid profile.' } };
+                    return {
+                        name,
+                        path: deps.profilePath(name),
+                        error: {
+                            code: 'INVALID_SKILL_PROFILE',
+                            message: error instanceof Error ? error.message : 'Invalid profile.',
+                        },
+                    };
                 }
             }));
             return { profiles };
         }
         catch {
-            return reply.code(500).type('application/problem+json').send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'Skill profiles could not be read.', true));
+            return reply
+                .code(500)
+                .type('application/problem+json')
+                .send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'Skill profiles could not be read.', true));
         }
     });
 }

package/dist/server/server/features/skills/model/skill-profile.js

@@ -37,7 +37,20 @@ export const availableSkillSchema = z
         defaultPrompt: z.string().optional(),
     })
         .optional(),
-    dependencies: z.object({ tools: z.array(z.object({ type: z.string(), value: z.string(), description: z.string().optional(), transport: z.string().optional(), command: z.string().optional(), url: z.string().optional() })).optional() }).optional(),
+    dependencies: z
+        .object({
+        tools: z
+            .array(z.object({
+            type: z.string(),
+            value: z.string(),
+            description: z.string().optional(),
+            transport: z.string().optional(),
+            command: z.string().optional(),
+            url: z.string().optional(),
+        }))
+            .optional(),
+    })
+        .optional(),
     scope: z.string().optional(),
 })
     .strict();
@@ -53,7 +66,10 @@ const profileDocumentSchema = z
  * is deliberately narrow so a profile name can never become a path traversal.
  */
 export function normalizeSkillProfileName(value) {
-    const normalized = value.trim().toLowerCase().replace(/[\s_]+/g, '-');
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/[\s_]+/g, '-');
     if (!profileNamePattern.test(normalized)) {
         throw new SkillProfileError('INVALID_SKILL_PROFILE', 'Invalid skill profile name.');
     }
@@ -136,7 +152,11 @@ export function compileSkillOverride(input) {
 }
 /** Construct the single profile contract shared by global and project YAML files. */
 export function createSkillProfile(input) {
-    return { version: 1, name: normalizeSkillProfileName(input.name), skills: createSkillSelection(input.skills) };
+    return {
+        version: 1,
+        name: normalizeSkillProfileName(input.name),
+        skills: createSkillSelection(input.skills),
+    };
 }
 /** Parse the version-1 YAML document without performing filesystem access. */
 export function parseSkillProfileYaml(source) {

package/dist/server/server/features/skills/register-routes.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { registerDeleteSkillProfile } from './delete-profile/endpoint.js';
+import { registerListAvailableSkills } from './list-available/endpoint.js';
+import { registerListSkillProfiles } from './list-profiles/endpoint.js';
+import { registerReplaceSkillProfile } from './replace-profile/endpoint.js';
+export function registerSkillRoutes(app, deps) {
+    if (!deps.skills)
+        return;
+    registerListAvailableSkills(app, deps.skills);
+    registerListSkillProfiles(app, deps.skills);
+    registerReplaceSkillProfile(app, deps.skills);
+    registerDeleteSkillProfile(app, deps.skills);
+}

package/dist/server/server/features/skills/replace-profile/endpoint.js

@@ -7,14 +7,23 @@ import { z } from 'zod';
 import { createSkillProfile, normalizeSkillProfileName } from '../model/skill-profile.js';
 import { SkillProfileError } from '../model/errors.js';
 import { problem } from '../../../platform/http/problem.js';
-const requestSchema = z.object({ version: z.literal(1), name: z.string(), skills: z.array(z.object({ name: z.string(), path: z.string(), enabled: z.boolean() }).strict()) }).strict();
+const requestSchema = z
+    .object({
+    version: z.literal(1),
+    name: z.string(),
+    skills: z.array(z.object({ name: z.string(), path: z.string(), enabled: z.boolean() }).strict()),
+})
+    .strict();
 export function registerReplaceSkillProfile(app, deps) {
-    app.put('/api/skill-profiles/:name', async (request, reply) => {
+    app.put('/api/skill-profiles/:name', { bodyLimit: 64 * 1024 }, async (request, reply) => {
         const body = requestSchema.safeParse(request.body);
         try {
             const name = normalizeSkillProfileName(request.params.name);
             if (!body.success || normalizeSkillProfileName(body.data.name) !== name)
-                return reply.code(400).type('application/problem+json').send(problem('INVALID_SKILL_PROFILE', 400, 'The route and body profile names must match.'));
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem('INVALID_SKILL_PROFILE', 400, 'The route and body profile names must match.'));
             const profile = createSkillProfile(body.data);
             const existed = await deps.readGlobalProfile(name);
             await deps.replaceGlobalProfile(profile);
@@ -22,8 +31,14 @@ export function registerReplaceSkillProfile(app, deps) {
         }
         catch (error) {
             if (error instanceof SkillProfileError)
-                return reply.code(400).type('application/problem+json').send(problem('INVALID_SKILL_PROFILE', 400, 'The skill profile could not be stored.'));
-            return reply.code(500).type('application/problem+json').send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'The skill profile could not be stored.', true));
+                return reply
+                    .code(400)
+                    .type('application/problem+json')
+                    .send(problem('INVALID_SKILL_PROFILE', 400, 'The skill profile could not be stored.'));
+            return reply
+                .code(500)
+                .type('application/problem+json')
+                .send(problem('SKILL_PROFILE_PERSISTENCE_FAILED', 500, 'The skill profile could not be stored.', true));
         }
     });
 }

package/dist/server/server/platform/auth/simple-webauthn-adapter.js

@@ -19,7 +19,11 @@ export class SimpleWebAuthnAdapter {
             challenge: new Uint8Array(input.challenge),
             attestationType: 'none',
             excludeCredentials: input.excludeCredentialIds.map((id) => ({ id })),
-            authenticatorSelection: { residentKey: 'required', requireResidentKey: true, userVerification: 'required' },
+            authenticatorSelection: {
+                residentKey: 'required',
+                requireResidentKey: true,
+                userVerification: 'required',
+            },
             supportedAlgorithmIDs: [-7, -257],
         });
     }
@@ -63,13 +67,29 @@ export class SimpleWebAuthnAdapter {
         const value = input;
         let result;
         try {
-            result = await verifyAuthenticationResponse({ response: value.response, expectedChallenge: Buffer.from(value.challenge).toString('base64url'), expectedOrigin: value.expectedOrigin, expectedRPID: value.rpId, requireUserVerification: true, credential: { id: value.credential.id, publicKey: new Uint8Array(value.credential.publicKey), counter: value.credential.counter, transports: [...value.credential.transports] } });
+            result = await verifyAuthenticationResponse({
+                response: value.response,
+                expectedChallenge: Buffer.from(value.challenge).toString('base64url'),
+                expectedOrigin: value.expectedOrigin,
+                expectedRPID: value.rpId,
+                requireUserVerification: true,
+                credential: {
+                    id: value.credential.id,
+                    publicKey: new Uint8Array(value.credential.publicKey),
+                    counter: value.credential.counter,
+                    transports: [...value.credential.transports],
+                },
+            });
         }
         catch {
             throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
         }
         if (!result.verified || !result.authenticationInfo?.userVerified)
             throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
-        return { credentialId: webAuthnCredentialId(value.response.id), counter: result.authenticationInfo.newCounter, userVerified: result.authenticationInfo.userVerified };
+        return {
+            credentialId: webAuthnCredentialId(value.response.id),
+            counter: result.authenticationInfo.newCounter,
+            userVerified: result.authenticationInfo.userVerified,
+        };
     }
 }

package/dist/server/server/platform/auth/sqlite-authorization-store.js

@@ -9,6 +9,7 @@ import { dirname, join, resolve } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { authorizedDeviceId, localOwnerId, passkeyCeremonyId, webAuthnCredentialId, } from '../../features/auth/domain/identifiers.js';
 import { deviceNickname } from '../../features/auth/domain/device-nickname.js';
+import { CeremonyCapacityError } from '../../features/auth/domain/errors.js';
 const OWNER_ID = localOwnerId('local-owner');
 const SCHEMA_VERSION = 1;
 const SQLITE_BUSY_TIMEOUT_MS = 5_000;
@@ -234,10 +235,28 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
             throw error;
         }
     }
-    saveCeremony(token, ceremony) {
-        this.db
-            .prepare('INSERT INTO auth_ceremonies (token_hash, purpose, challenge, expected_origin, rp_id, expires_at, ticket_hash) VALUES (?, ?, ?, ?, ?, ?, ?)')
-            .run(hash(token), ceremony.purpose, ceremony.challenge, ceremony.expectedOrigin, ceremony.rpId, ceremony.expiresAt, ceremony.enrollmentTicket ? hash(ceremony.enrollmentTicket) : null);
+    saveCeremony(token, ceremony, now) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            // Admission and cleanup share one immediate transaction, so separate
+            // processes cannot both observe the same remaining slot.
+            this.db.prepare('DELETE FROM auth_ceremonies WHERE consumed_at IS NOT NULL').run();
+            if (now)
+                this.db.prepare('DELETE FROM auth_ceremonies WHERE expires_at <= ?').run(now);
+            const active = this.db
+                .prepare('SELECT count(*) AS count FROM auth_ceremonies WHERE consumed_at IS NULL')
+                .get();
+            if (active.count >= 64)
+                throw new CeremonyCapacityError('Ceremony capacity reached');
+            this.db
+                .prepare('INSERT INTO auth_ceremonies (token_hash, purpose, challenge, expected_origin, rp_id, expires_at, ticket_hash) VALUES (?, ?, ?, ?, ?, ?, ?)')
+                .run(hash(token), ceremony.purpose, ceremony.challenge, ceremony.expectedOrigin, ceremony.rpId, ceremony.expiresAt, ceremony.enrollmentTicket ? hash(ceremony.enrollmentTicket) : null);
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
     }
     consumeCeremony(token, now) {
         this.db.exec('BEGIN IMMEDIATE');
@@ -286,8 +305,12 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
         this.db.exec('BEGIN IMMEDIATE');
         try {
             const creator = hash(creatorSession);
-            this.db.prepare('DELETE FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL').run(creator);
-            this.db.prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at, creator_session_hash) VALUES (?, ?, NULL, ?)').run(hash(token), expiresAt, creator);
+            this.db
+                .prepare('DELETE FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL')
+                .run(creator);
+            this.db
+                .prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at, creator_session_hash) VALUES (?, ?, NULL, ?)')
+                .run(hash(token), expiresAt, creator);
             this.db.exec('COMMIT');
         }
         catch (error) {

package/dist/server/server/platform/catalog/profile-command.js

@@ -18,5 +18,12 @@ export function profileAppServerCommand(_profile, availability = localAvailabili
         : { command: 'codex', args: ['app-server', '--stdio'] };
     return skillsConfig === undefined
         ? base
-        : { ...base, args: [...base.args, '--config', `skills.config = [${skillsConfig.map((entry) => `{ path = ${JSON.stringify(entry.path)}, enabled = ${entry.enabled} }`).join(', ')}]`] };
+        : {
+            ...base,
+            args: [
+                ...base.args,
+                '--config',
+                `skills.config = [${skillsConfig.map((entry) => `{ path = ${JSON.stringify(entry.path)}, enabled = ${entry.enabled} }`).join(', ')}]`,
+            ],
+        };
 }

package/dist/server/server/platform/codex/normalizer.js

@@ -5,29 +5,68 @@
  */
 import { relative } from 'node:path';
 export function normalizeCodexNotification(sessionId, sequence, occurredAt, notification, workspacePath) {
-    if (notification.method === 'item/agentMessage/delta')
+    const decoded = decodeNotification(notification);
+    if (!decoded)
+        return null;
+    if (decoded.method === 'item/agentMessage/delta')
         return {
             sessionId,
             sequence,
             occurredAt,
             type: 'agentMessageDelta',
-            payload: { text: notification.params?.delta ?? '' },
+            payload: { text: decoded.params.delta },
         };
-    if (notification.method === 'turn/completed')
+    if (decoded.method === 'turn/completed')
         return {
             sessionId,
             sequence,
             occurredAt,
             type: 'turnCompleted',
-            payload: notification.params ?? {},
+            payload: decoded.params,
         };
-    if (notification.method === 'item/started' || notification.method === 'item/completed') {
-        const activity = safeActivity(notification.params?.item, workspacePath);
+    if (decoded.method === 'item/started' || decoded.method === 'item/completed') {
+        const activity = safeActivity(decoded.params.item, workspacePath);
         if (activity)
             return { sessionId, sequence, occurredAt, type: 'activity.updated', payload: activity };
     }
     return null;
 }
+/** Strictly decode only consumed notification shapes; unknown/future methods stay isolated. */
+export function decodeNotification(input) {
+    if (input.method === 'item/agentMessage/delta') {
+        const params = record(input.params);
+        return typeof params?.delta === 'string' && params.delta.length <= 64_000
+            ? { method: input.method, params: { delta: params.delta } }
+            : null;
+    }
+    if (input.method === 'turn/completed') {
+        const params = record(input.params);
+        const turn = record(params?.turn);
+        if (!turn || typeof turn.id !== 'string' || turn.id.length > 256)
+            return null;
+        return {
+            method: input.method,
+            params: {
+                ...(typeof params?.threadId === 'string' && params.threadId.length <= 256
+                    ? { threadId: params.threadId }
+                    : {}),
+                turn: {
+                    id: turn.id,
+                    ...(typeof turn.status === 'string' && turn.status.length <= 64
+                        ? { status: turn.status }
+                        : {}),
+                },
+            },
+        };
+    }
+    if (input.method === 'item/started' || input.method === 'item/completed') {
+        const params = record(input.params);
+        return params && 'item' in params
+            ? { method: input.method, params: { item: params.item } }
+            : null;
+    }
+    return null;
+}
 function safeActivity(item, workspacePath) {
     if (!item || typeof item !== 'object')
         return null;
@@ -79,3 +118,8 @@ function reasoningSummary(parts) {
         return [];
     });
 }
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}

package/dist/server/server/platform/codex/protocol-compatibility.js

@@ -6,7 +6,25 @@
 export function protocolCompatibility(installedVersion, protocolVersion) {
     if (!installedVersion)
         return { compatible: false, code: 'CODEX_NOT_FOUND' };
-    if (installedVersion !== protocolVersion)
+    const installed = parseCoreVersion(installedVersion);
+    const expected = protocolVersion ? parseCoreVersion(protocolVersion) : undefined;
+    // 0.x is pre-1.0: the minor is the core wire contract.  Patch releases and
+    // newer compatible minors are accepted only within a small forward window;
+    // optional APIs are negotiated independently at runtime.
+    if (!installed || !expected || !coreCompatible(installed, expected))
         return { compatible: false, code: 'CODEX_PROTOCOL_MISMATCH' };
     return { compatible: true };
 }
+function parseCoreVersion(value) {
+    const match = /\b(\d+)\.(\d+)(?:\.(\d+))?\b/.exec(value);
+    if (!match)
+        return undefined;
+    return { major: Number(match[1]), minor: Number(match[2]) };
+}
+function coreCompatible(installed, expected) {
+    if (installed.major !== expected.major)
+        return false;
+    if (installed.major !== 0)
+        return installed.minor === expected.minor;
+    return installed.minor >= expected.minor && installed.minor <= expected.minor + 4;
+}

package/dist/server/server/platform/codex/server-request.js

@@ -5,6 +5,8 @@
  */
 import { GESTALT_QUIZ_TOOL_NAME, parseQuiz } from '../../../shared/contracts/quiz.js';
 export function toPendingInteraction(input) {
+    if (!Number.isSafeInteger(input.id) || !isRecord(input.params))
+        return null;
     if (input.method === 'item/tool/call') {
         if (!isRecord(input.params) || input.params.tool !== GESTALT_QUIZ_TOOL_NAME)
             return null;