gestalt-mobile 0.14.0 → 0.16.0

package/dist/client/icons/gestalt-mobile-maskable.svg

@@ -0,0 +1,10 @@
+<!--
+Copyright (C) 2026 Dyne.org foundation
+Designed by Denis Roio <jaromil@dyne.org>
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<svg xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 512 512">
+  <rect width="512" height="512" fill="#141414" />
+  <image href="../branding/p_glogo_white.svg" x="102" y="102" width="308" height="308" />
+</svg>

package/dist/client/icons/gestalt-mobile.svg

@@ -0,0 +1,10 @@
+<!--
+Copyright (C) 2026 Dyne.org foundation
+Designed by Denis Roio <jaromil@dyne.org>
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<svg xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 512 512">
+  <rect width="512" height="512" fill="#141414" />
+  <image href="../branding/p_glogo_white.svg" x="64" y="64" width="384" height="384" />
+</svg>

package/dist/client/index.html

@@ -10,9 +10,14 @@ SPDX-License-Identifier: AGPL-3.0-or-later
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="color-scheme" content="light dark" />
-    <title>Codex Relay</title>
-    <script type="module" crossorigin src="/assets/index-tMyOolAm.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-C5qFcFUg.css">
+    <meta name="theme-color" content="#141414" />
+    <meta name="application-name" content="Gestalt Mobile" />
+    <link rel="manifest" href="/manifest.webmanifest" />
+    <link rel="icon" href="/icons/gestalt-mobile-192.png" />
+    <link rel="apple-touch-icon" href="/icons/gestalt-mobile-180.png" />
+    <title>Gestalt Mobile</title>
+    <script type="module" crossorigin src="/assets/index-DK64debX.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BOHLkK8Y.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/client/manifest.webmanifest

@@ -0,0 +1,32 @@
+{
+  "id": "/",
+  "name": "Gestalt Mobile",
+  "short_name": "Gestalt",
+  "description": "A mobile interface for durable Codex development sessions.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#141414",
+  "theme_color": "#141414",
+  "categories": ["productivity", "utilities"],
+  "icons": [
+    {
+      "src": "/icons/gestalt-mobile-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/gestalt-mobile-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/gestalt-mobile-maskable-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ]
+}

package/dist/client/service-worker.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+// Installability only: authenticated relay data must always remain network-fresh.
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()));

package/dist/server/server/composition.js

@@ -124,10 +124,15 @@ export async function composeRelayApp(options) {
             }
             events.publish(journal.append(sessionId, normalized.type, normalized.payload, normalized.occurredAt));
         }, (sessionId, request) => {
-            const interaction = toPendingInteraction(request);
+            const rawInteraction = toPendingInteraction(request);
             const session = withPendingInteractions(sessions.find(sessionId));
-            if (!interaction || !session)
+            if (!rawInteraction || !session)
                 return false;
+            const interaction = {
+                ...rawInteraction,
+                turnId: session.activeTurnId,
+                requestedAt: new Date().toISOString(),
+            };
             interactions.add(sessionId, interaction);
             const updated = RelaySession.rehydrate(session).requestInteraction(interaction, new Date().toISOString()).snapshot;
             sessions.save(updated);
@@ -305,8 +310,11 @@ export async function composeRelayApp(options) {
                 replyInteraction: runtime
                     ? (sessionId, requestId, value) => runtime.resolveServerRequest(sessionId, requestId, value)
                     : undefined,
-                interactionResolved: (sessionId, requestId, occurredAt) => {
-                    events.publish(journal.append(sessionId, 'interaction.resolved', { requestId }, occurredAt));
+                interactionResolved: (sessionId, requestId, occurredAt, outcome) => {
+                    const interaction = interactions
+                        .snapshot(sessionId)
+                        .find((item) => item.requestId === requestId);
+                    events.publish(journal.append(sessionId, 'interaction.resolved', { requestId, turnId: interaction?.turnId ?? null, resolvedAt: occurredAt, outcome }, occurredAt));
                 },
             },
             sessionEvents: {
@@ -341,7 +349,10 @@ export async function composeRelayApp(options) {
                 }
                 : {}),
             interactions: {
-                resolve: (sessionId, requestId, resolvedAt) => interactions.resolve(sessionId, requestId, resolvedAt),
+                resolve: (sessionId, requestId, resolvedAt, outcome) => interactions.resolve(sessionId, requestId, resolvedAt, outcome),
+                alreadyResolved: (sessionId, requestId) => interactions.resolved(sessionId, requestId),
+                snapshot: (sessionId) => interactions.snapshot(sessionId),
+                pending: (sessionId, requestId) => interactions.find(sessionId, requestId) !== null,
                 validate: (sessionId, requestId, value) => {
                     const interaction = interactions.find(sessionId, requestId);
                     if (!interaction)

package/dist/server/server/features/auth/application/ports.js

@@ -3,6 +3,12 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-/** Expected proof failure; adapters must translate library-specific failures to this type. */
+/** Expected proof failure; adapters translate library details to a safe diagnostic category. */
 export class PasskeyVerificationError extends Error {
+    reason;
+    constructor(reason = 'VERIFIER_REJECTED') {
+        super('PASSKEY_VERIFICATION_FAILED');
+        this.reason = reason;
+        this.name = 'PasskeyVerificationError';
+    }
 }

package/dist/server/server/features/auth/login/verify/endpoint.js

@@ -50,7 +50,7 @@ export function registerLoginVerification(app, deps) {
                 },
             });
             if (!verified.userVerified || verified.credentialId !== device.credentialId)
-                throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+                throw new PasskeyVerificationError('USER_VERIFICATION_REQUIRED');
             const session = deps.identifiers.sessionId();
             if (Buffer.from(session, 'base64url').length !== 32)
                 throw new Error('AUTHORIZATION_RANDOMNESS_INVALID');

package/dist/server/server/features/auth/register/verify/endpoint.js

@@ -35,11 +35,20 @@ export function registerRegistrationVerification(app, deps) {
     app.post('/api/auth/register/verify', { bodyLimit: 128 * 1024 }, async (request, reply) => {
         const parsed = requestSchema.safeParse(request.body);
         const token = request.cookies.gestalt_mobile_registration;
-        if (!parsed.success || typeof token !== 'string')
+        if (!parsed.success) {
+            deps.reportVerificationFailure?.('INVALID_RESPONSE_SHAPE');
             return reply
                 .code(400)
                 .type('application/problem+json')
                 .send(problem('INVALID_REGISTRATION_REQUEST', 400, 'The registration request is invalid.'));
+        }
+        if (typeof token !== 'string') {
+            deps.reportVerificationFailure?.('MISSING_CEREMONY_COOKIE');
+            return reply
+                .code(400)
+                .type('application/problem+json')
+                .send(problem('REGISTRATION_COOKIE_MISSING', 400, 'The registration cookie is missing.'));
+        }
         let nickname;
         try {
             nickname = deviceNickname(parsed.data.nickname);
@@ -54,11 +63,13 @@ export function registerRegistrationVerification(app, deps) {
         }
         const now = deps.clock.now();
         const ceremony = deps.repository.readCeremony(passkeyCeremonyId(token), now.toISOString());
-        if (!ceremony || ceremony.purpose !== 'registration')
+        if (!ceremony || ceremony.purpose !== 'registration') {
+            deps.reportVerificationFailure?.('CEREMONY_NOT_AVAILABLE');
             return reply
                 .code(400)
                 .type('application/problem+json')
                 .send(problem('REGISTRATION_NOT_AVAILABLE', 400, 'Registration could not be completed.'));
+        }
         try {
             const verified = await deps.webauthn.verifyRegistration({
                 response: parsed.data.response,
@@ -67,7 +78,7 @@ export function registerRegistrationVerification(app, deps) {
                 rpId: ceremony.rpId,
             });
             if (!verified.userVerified)
-                throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+                throw new PasskeyVerificationError('USER_VERIFICATION_REQUIRED');
             const device = {
                 id: deps.identifiers.deviceId(),
                 credentialId: verified.credentialId,
@@ -101,11 +112,15 @@ export function registerRegistrationVerification(app, deps) {
             return reply.code(201).send(successSchema.parse({ status: 'authenticated' }));
         }
         catch (error) {
-            if (error instanceof PasskeyVerificationError || error instanceof AuthorizationDomainError)
+            if (error instanceof PasskeyVerificationError || error instanceof AuthorizationDomainError) {
+                deps.reportVerificationFailure?.(error instanceof PasskeyVerificationError
+                    ? `WEBAUTHN_${error.reason}`
+                    : 'AUTHORIZATION_REJECTED');
                 return reply
                     .code(400)
                     .type('application/problem+json')
                     .send(problem('REGISTRATION_VERIFICATION_FAILED', 400, 'Registration could not be completed.'));
+            }
             throw error;
         }
     });

package/dist/server/server/features/auth/register-routes.js

@@ -24,7 +24,10 @@ export function registerAuthRoutes(app, deps) {
             ceremonyAttempts: deps.auth.ceremonyAttempts ?? new ExpiringCeremonyAttemptGate(),
         };
         registerRegistrationOptions(app, auth);
-        registerRegistrationVerification(app, deps.auth);
+        registerRegistrationVerification(app, {
+            ...deps.auth,
+            reportVerificationFailure: (reason) => deps.logger.warn(`Passkey registration verification failed: ${reason}`),
+        });
         registerLoginOptions(app, auth);
         registerLoginVerification(app, deps.auth);
         registerAuthStatus(app, deps.auth);

package/dist/server/server/features/sessions/get-history/endpoint.js

@@ -3,12 +3,18 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-import { toChatItems } from './history-mapper.js';
+import { toChatItems, toChatTurns } from './history-mapper.js';
+/**
+ * ChatSnapshot is a lower-bound cut: baseSequence is sampled before the
+ * upstream read, therefore every event with a higher sequence remains eligible
+ * for ordered replay even when its effect is already visible in the snapshot.
+ */
 export function registerGetHistory(app, deps) {
     app.get('/api/sessions/:id/history', async (request, reply) => {
         const session = deps.find(request.params.id);
         if (!session)
             return reply.code(404).send({ code: 'SESSION_NOT_FOUND' });
+        const baseSequence = deps.currentSequence(session.id);
         let history;
         try {
             history = await deps.read(session);
@@ -33,10 +39,15 @@ export function registerGetHistory(app, deps) {
             });
         }
         const items = toChatItems(history.turns);
-        return reply.send({
+        const snapshot = {
             items,
+            turns: toChatTurns(history.turns),
             activeTurnId: history.activeTurnId,
-            currentSequence: deps.currentSequence(session.id),
-        });
+            interactions: deps.interactions?.(session.id) ?? [],
+            baseSequence,
+            // Temporary compatibility for clients which have not adopted ChatSnapshot.
+            currentSequence: baseSequence,
+        };
+        return reply.send(snapshot);
     });
 }

package/dist/server/server/features/sessions/get-history/history-mapper.js

@@ -3,6 +3,15 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
+/** Canonical grouping preserves the upstream Codex turn identity across reloads. */
+export function toChatTurns(turns) {
+    return turns.map((turn, index) => ({
+        id: turn.id ?? `history-turn-${index}`,
+        items: turn.items.flatMap((item) => toChatItem(item, occurredAt(item, turn))),
+        startedAt: turn.startedAt,
+        completedAt: turn.completedAt,
+    }));
+}
 export function toChatItems(turns) {
     return turns.flatMap((turn) => turn.items.flatMap((item) => toChatItem(item, occurredAt(item, turn))));
 }

package/dist/server/server/features/sessions/register-routes.js

@@ -54,6 +54,7 @@ export function registerSessionRoutes(app, deps) {
                 find: sessions.find,
                 read: sessions.readHistory,
                 currentSequence: sessions.currentSequence ?? (() => 0),
+                interactions: deps.interactions?.snapshot,
             });
         if (sessions.startTurn)
             registerStartTurn(app, {
@@ -61,6 +62,7 @@ export function registerSessionRoutes(app, deps) {
                 start: sessions.startTurn,
                 save: sessions.save,
                 onStarted: sessions.onTurnStarted,
+                idempotency: sessions.idempotency,
             });
         if (sessions.models)
             registerSelectModel(app, {
@@ -108,8 +110,10 @@ export function registerSessionRoutes(app, deps) {
         if (sessions.replyInteraction && deps.interactions)
             registerRespondInteraction(app, {
                 exists: (id) => sessions.find(id) !== null,
-                resolve: (sessionId, requestId, resolvedAt) => deps.interactions.resolve(sessionId, requestId, resolvedAt),
+                resolve: (sessionId, requestId, resolvedAt, outcome) => deps.interactions.resolve(sessionId, requestId, resolvedAt, outcome),
                 validate: deps.interactions.validate,
+                pending: deps.interactions.pending,
+                alreadyResolved: deps.interactions.alreadyResolved,
                 reply: sessions.replyInteraction,
                 resolved: sessions.interactionResolved,
                 now: sessions.now,

package/dist/server/server/features/sessions/respond-interaction/endpoint.js

@@ -11,14 +11,30 @@ export function registerRespondInteraction(app, deps) {
         const value = request.body;
         if (typeof value !== 'object' || value === null || Array.isArray(value))
             return reply.code(400).send({ code: 'INTERACTION_RESPONSE_INVALID' });
+        const recorded = deps.alreadyResolved?.(id, requestId);
+        if (recorded)
+            return reply.code(202).send({ accepted: true, ...recorded });
+        if (deps.pending && !deps.pending(id, requestId))
+            return reply.code(409).send({ code: 'INTERACTION_NOT_PENDING' });
         if (deps.validate && !deps.validate(id, requestId, value))
             return reply.code(400).send({ code: 'INTERACTION_RESPONSE_INVALID' });
         if (!deps.reply(id, requestId, value))
             return reply.code(409).send({ code: 'INTERACTION_NOT_PENDING' });
         const resolvedAt = deps.now();
-        if (!deps.resolve(id, requestId, resolvedAt))
+        const outcome = safeOutcome(value);
+        if (!deps.resolve(id, requestId, resolvedAt, outcome))
             return reply.code(409).send({ code: 'INTERACTION_NOT_PENDING' });
-        deps.resolved?.(id, requestId, resolvedAt);
-        return reply.code(202).send({ accepted: true });
+        deps.resolved?.(id, requestId, resolvedAt, outcome);
+        return reply.code(202).send({ accepted: true, resolvedAt, outcome });
     });
 }
+function safeOutcome(value) {
+    if (typeof value !== 'object' || value === null)
+        return 'answered';
+    const decision = value.decision;
+    if (decision === 'approved' || decision === 'accept')
+        return 'approved';
+    if (decision === 'denied' || decision === 'decline')
+        return 'denied';
+    return 'answered';
+}

package/dist/server/server/features/sessions/session-events/endpoint.js

@@ -24,25 +24,60 @@ export function registerSessionEvents(app, deps) {
         }
         server.handleUpgrade(request, socket, head, (connection) => {
             const sessionId = match[1];
+            let lastSentSequence = after;
             const send = (event) => {
-                if (isSlowClient(connection.bufferedAmount))
+                // A subscription intentionally overlaps the durable replay.  The sequence
+                // is the authoritative identity of an event, so a bounded high-water mark
+                // de-duplicates both replay overlap and stale live callbacks.
+                if (event.sessionId !== sessionId ||
+                    !Number.isSafeInteger(event.sequence) ||
+                    event.sequence < 1)
+                    return;
+                if (event.sequence <= lastSentSequence)
+                    return;
+                lastSentSequence = event.sequence;
+                if (isSlowClient(deps.bufferedAmount?.(connection) ?? connection.bufferedAmount))
                     return connection.close(1013, 'slow client');
                 connection.send(JSON.stringify({ type: 'relay.event', event }));
             };
-            const replay = replayOrResync(deps.since(sessionId, after), after);
-            if (replay.kind === 'resync') {
-                const currentSequence = deps.since(sessionId, 0).at(-1)?.sequence ?? after;
-                connection.send(JSON.stringify({ type: 'relay.resyncRequired', currentSequence }));
+            let unsubscribe;
+            let removeHeartbeat;
+            let replaying = true;
+            const liveDuringReplay = [];
+            const cleanup = () => {
+                removeHeartbeat?.();
+                removeHeartbeat = undefined;
+                unsubscribe?.();
+                unsubscribe = undefined;
+            };
+            try {
+                // Subscribe before reading the journal: every event after this point is
+                // either in replay or delivered live, and the sequence de-duplicates it.
+                unsubscribe = deps.subscribe(sessionId, (event) => {
+                    if (replaying)
+                        liveDuringReplay.push(event);
+                    else
+                        send(event);
+                });
+                const replay = replayOrResync(deps.since(sessionId, after), after);
+                if (replay.kind === 'resync') {
+                    const currentSequence = deps.since(sessionId, 0).at(-1)?.sequence ?? after;
+                    connection.send(JSON.stringify({ type: 'relay.resyncRequired', currentSequence }));
+                    cleanup();
+                    connection.close();
+                    return;
+                }
+                replay.events.forEach(send);
+                replaying = false;
+                liveDuringReplay.sort((left, right) => left.sequence - right.sequence).forEach(send);
+            }
+            catch {
+                cleanup();
                 connection.close();
                 return;
             }
-            replay.events.forEach(send);
-            const unsubscribe = deps.subscribe(sessionId, send);
-            const removeHeartbeat = installWebSocketHeartbeat(connection, deps.heartbeatIntervalMs ?? 25_000, () => deps.authorized?.(request.headers.cookie) ?? true);
-            connection.on('close', () => {
-                removeHeartbeat();
-                unsubscribe();
-            });
+            removeHeartbeat = installWebSocketHeartbeat(connection, deps.heartbeatIntervalMs ?? 25_000, () => deps.authorized?.(request.headers.cookie) ?? true);
+            connection.on('close', cleanup);
         });
     });
     app.addHook('onClose', async () => server.close());

package/dist/server/server/features/sessions/start-turn/endpoint.js

@@ -3,7 +3,11 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
+import { createHash } from 'node:crypto';
 export function registerStartTurn(app, deps) {
+    const inflight = new Map();
+    // Durable idempotency results are session-scoped and replay for as long as the
+    // store retains them; a reused key with a different prompt is rejected.
     // Text is capped at 100,000 characters; leave room for JSON encoding only.
     app.post('/api/sessions/:id/turns', { bodyLimit: 128 * 1024 }, async (request, reply) => {
         const session = deps.find(request.params.id);
@@ -14,9 +18,43 @@ export function registerStartTurn(app, deps) {
             return reply.code(400).send({ code: 'TURN_INPUT_TOO_LONG' });
         if (!text || session.state !== 'ready')
             return reply.code(409).send({ code: 'SESSION_NOT_READY' });
+        const key = request.headers['idempotency-key'];
+        if (typeof key === 'string' && key && deps.idempotency) {
+            const scope = `start-turn:${session.id}`;
+            const fingerprint = createHash('sha256').update(text).digest('hex');
+            const cached = deps.idempotency.get(scope, key);
+            if (cached)
+                return replay(cached, fingerprint, reply);
+            const inflightKey = `${scope}:${key}`;
+            const operation = inflight.get(inflightKey) ??
+                (async () => {
+                    const started = await deps.start(session, text);
+                    deps.save(started);
+                    deps.onStarted?.(started);
+                    const result = {
+                        statusCode: 202,
+                        body: JSON.stringify({ fingerprint, response: started }),
+                    };
+                    deps.idempotency.put(scope, key, result.statusCode, result.body);
+                    return result;
+                })();
+            inflight.set(inflightKey, operation);
+            try {
+                return replay(await operation, fingerprint, reply);
+            }
+            finally {
+                inflight.delete(inflightKey);
+            }
+        }
         const started = await deps.start(session, text);
         deps.save(started);
         deps.onStarted?.(started);
         return reply.code(202).send(started);
     });
 }
+function replay(result, fingerprint, reply) {
+    const cached = JSON.parse(result.body);
+    if (cached.fingerprint !== fingerprint)
+        return reply.code(409).send({ code: 'IDEMPOTENCY_KEY_REUSED' });
+    return reply.code(result.statusCode).send(cached.response);
+}

package/dist/server/server/platform/auth/simple-webauthn-adapter.js

@@ -7,6 +7,32 @@ import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthe
 import { PasskeyVerificationError } from '../../features/auth/application/ports.js';
 import { webAuthnCredentialId } from '../../features/auth/domain/identifiers.js';
 const transports = new Set(['ble', 'hybrid', 'internal', 'nfc', 'usb']);
+function verificationFailure(error) {
+    const message = error instanceof Error ? error.message.toLowerCase() : '';
+    if (message.includes('challenge'))
+        return 'CHALLENGE_MISMATCH';
+    if (message.includes('origin'))
+        return 'ORIGIN_MISMATCH';
+    if (message.includes('rp id') || message.includes('rpid'))
+        return 'RP_ID_MISMATCH';
+    if (message.includes('user presence'))
+        return 'USER_PRESENCE_REQUIRED';
+    if (message.includes('user verification'))
+        return 'USER_VERIFICATION_REQUIRED';
+    if (message.includes('credential id') || message.includes('base64'))
+        return 'CREDENTIAL_ENCODING_INVALID';
+    if (message.includes('alg') || message.includes('cose'))
+        return 'ALGORITHM_UNSUPPORTED';
+    if (message.includes('public key') ||
+        message.includes('aaguid') ||
+        message.includes('authenticator data'))
+        return 'CREDENTIAL_MATERIAL_MISSING';
+    if (message.includes('attestation'))
+        return 'ATTESTATION_UNSUPPORTED';
+    if (message.includes('signature'))
+        return 'SIGNATURE_INVALID';
+    return 'VERIFIER_REJECTED';
+}
 /** Translates SimpleWebAuthn DTOs at the platform boundary. */
 export class SimpleWebAuthnAdapter {
     async registrationOptions(input) {
@@ -47,11 +73,11 @@ export class SimpleWebAuthnAdapter {
                 supportedAlgorithmIDs: [-7, -257],
             });
         }
-        catch {
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        catch (error) {
+            throw new PasskeyVerificationError(verificationFailure(error));
         }
         if (!result.verified || !result.registrationInfo?.userVerified)
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+            throw new PasskeyVerificationError('VERIFIER_REJECTED');
         const credential = result.registrationInfo.credential;
         return {
             credentialId: webAuthnCredentialId(credential.id),
@@ -81,11 +107,11 @@ export class SimpleWebAuthnAdapter {
                 },
             });
         }
-        catch {
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+        catch (error) {
+            throw new PasskeyVerificationError(verificationFailure(error));
         }
         if (!result.verified || !result.authenticationInfo?.userVerified)
-            throw new PasskeyVerificationError('PASSKEY_VERIFICATION_FAILED');
+            throw new PasskeyVerificationError('VERIFIER_REJECTED');
         return {
             credentialId: webAuthnCredentialId(value.response.id),
             counter: result.authenticationInfo.newCounter,

package/dist/server/server/platform/codex/session-runtime.js

@@ -180,6 +180,7 @@ export class CodexSessionRuntime {
         const activeTurn = rawTurns.find((turn) => turn.status === 'inProgress' && typeof turn.id === 'string');
         return {
             turns: rawTurns.map((turn) => ({
+                ...(typeof turn.id === 'string' ? { id: turn.id } : {}),
                 items: turn.items ?? [],
                 startedAt: typeof turn.startedAt === 'number' ? turn.startedAt : null,
                 completedAt: typeof turn.completedAt === 'number' ? turn.completedAt : null,

package/dist/server/server/platform/persistence/migrate.js

@@ -3,7 +3,7 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-const schema = `CREATE TABLE IF NOT EXISTS relay_sessions (id TEXT PRIMARY KEY, workspace_id TEXT NOT NULL, workspace_path TEXT NOT NULL, profile TEXT NOT NULL, model TEXT, branch TEXT, thread_id TEXT, state TEXT NOT NULL, desired_state TEXT NOT NULL, active_turn_id TEXT, protocol_version TEXT, failure_count INTEGER NOT NULL DEFAULT 0, effective_skill_selection_json TEXT, last_org_plan_json TEXT, next_sequence INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS pending_interactions (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, request_id TEXT NOT NULL, kind TEXT NOT NULL, payload_json TEXT NOT NULL, resolved_at TEXT, PRIMARY KEY (session_id, request_id)); CREATE TABLE IF NOT EXISTS session_events (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, sequence INTEGER NOT NULL, occurred_at TEXT NOT NULL, type TEXT NOT NULL, payload_json TEXT NOT NULL, PRIMARY KEY (session_id, sequence)); CREATE TABLE IF NOT EXISTS idempotency_results (scope TEXT NOT NULL, key TEXT NOT NULL, status_code INTEGER NOT NULL, body_json TEXT NOT NULL, PRIMARY KEY (scope, key));`;
+const schema = `CREATE TABLE IF NOT EXISTS relay_sessions (id TEXT PRIMARY KEY, workspace_id TEXT NOT NULL, workspace_path TEXT NOT NULL, profile TEXT NOT NULL, model TEXT, branch TEXT, thread_id TEXT, state TEXT NOT NULL, desired_state TEXT NOT NULL, active_turn_id TEXT, protocol_version TEXT, failure_count INTEGER NOT NULL DEFAULT 0, effective_skill_selection_json TEXT, last_org_plan_json TEXT, next_sequence INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS pending_interactions (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, request_id TEXT NOT NULL, kind TEXT NOT NULL, payload_json TEXT NOT NULL, turn_id TEXT, requested_at TEXT, resolved_at TEXT, outcome TEXT, PRIMARY KEY (session_id, request_id)); CREATE TABLE IF NOT EXISTS session_events (session_id TEXT NOT NULL REFERENCES relay_sessions(id) ON DELETE CASCADE, sequence INTEGER NOT NULL, occurred_at TEXT NOT NULL, type TEXT NOT NULL, payload_json TEXT NOT NULL, PRIMARY KEY (session_id, sequence)); CREATE TABLE IF NOT EXISTS idempotency_results (scope TEXT NOT NULL, key TEXT NOT NULL, status_code INTEGER NOT NULL, body_json TEXT NOT NULL, PRIMARY KEY (scope, key));`;
 export function migrate(database) {
     database.exec(schema);
     const columns = database.prepare('PRAGMA table_info(relay_sessions)').all();
@@ -15,4 +15,13 @@ export function migrate(database) {
         database.exec('ALTER TABLE relay_sessions ADD COLUMN model TEXT');
     if (!columns.some((column) => column.name === 'branch'))
         database.exec('ALTER TABLE relay_sessions ADD COLUMN branch TEXT');
+    const interactionColumns = database
+        .prepare('PRAGMA table_info(pending_interactions)')
+        .all();
+    if (!interactionColumns.some((column) => column.name === 'turn_id'))
+        database.exec('ALTER TABLE pending_interactions ADD COLUMN turn_id TEXT');
+    if (!interactionColumns.some((column) => column.name === 'requested_at'))
+        database.exec('ALTER TABLE pending_interactions ADD COLUMN requested_at TEXT');
+    if (!interactionColumns.some((column) => column.name === 'outcome'))
+        database.exec('ALTER TABLE pending_interactions ADD COLUMN outcome TEXT');
 }