gestalt-mobile 0.35.1 → 0.35.2

package/dist/server/server/platform/codex/session-runtime.js

@@ -35,6 +35,8 @@ class SessionResource {
     spawnedAgentModels = new Map();
     attemptedAgentModelRecovery = new Set();
     ownedChildProcesses = new Map();
+    /** Retries from a durable Autopilot issued command reuse this opaque action id. */
+    completedProcessActions = new Map();
     turnThreads = new Map();
     childThreads = new Set();
     constructor(sessionId, process, planStatusLease, planMeasurementToken, unregister, onDisposed) {
@@ -84,6 +86,7 @@ export class CodexSessionRuntime {
     planMeasurementBaseUrl;
     maxPendingRequests;
     readerCwd;
+    serverResponseListeners = new Set();
     constructor(launch, 
     // Kept as an ignored compatibility slot while callers migrate from the old
     // correlated-map constructor shape.  Live ownership is `sessions` only.
@@ -170,18 +173,40 @@ export class CodexSessionRuntime {
     resolveServerRequest(sessionId, requestId, result) {
         const resource = this.sessions.get(sessionId);
         const pending = resource?.pendingRequests.get(requestId);
-        if (!resource || !pending)
+        if (!resource || !pending || pending.settling)
             return false;
-        resource.pendingRequests.delete(requestId);
+        pending.settling = true;
         pending.resolve(result);
         return true;
     }
+    rejectServerRequest(sessionId, requestId, error) {
+        const resource = this.sessions.get(sessionId);
+        const pending = resource?.pendingRequests.get(requestId);
+        if (!pending || pending.settling)
+            return false;
+        pending.settling = true;
+        pending.reject(error);
+        return true;
+    }
+    /**
+     * A response may already be queued in a blocked writable stream.  Release
+     * the local holder without accepting any eventual late write as success.
+     */
+    abandonServerRequest(sessionId, requestId) {
+        const resource = this.sessions.get(sessionId);
+        return resource?.pendingRequests.delete(requestId) === true;
+    }
+    onServerResponseSettled(listener) {
+        this.serverResponseListeners.add(listener);
+        return () => this.serverResponseListeners.delete(listener);
+    }
     /** Distinguishes an offline relay writer from a live writer that cleared a request. */
     attentionWriterState(sessionId, requestId) {
         const resource = this.sessions.get(sessionId);
         if (!resource || !resource.active)
             return 'unavailable';
-        return resource.pendingRequests.has(requestId) ? 'available' : 'cleared';
+        const pending = resource.pendingRequests.get(requestId);
+        return pending && !pending.settling ? 'available' : 'cleared';
     }
     async startTurn(session, text, clientUserMessageId, now) {
         const resource = this.sessions.get(session.id);
@@ -193,18 +218,22 @@ export class CodexSessionRuntime {
             ...(clientUserMessageId ? { clientUserMessageId } : {}),
             ...(session.model ? { model: session.model } : {}),
         }));
+        resource.turnThreads.set(result, session.threadId);
         return RelaySession.rehydrate(session).startTurn(result, now).snapshot;
     }
     async startExecutorTurn(session, childThreadId, text, clientUserMessageId) {
         const resource = this.sessions.get(session.id);
         if (!resource)
             throw new Error('CODEX_SESSION_NOT_RUNNING');
-        return decodeTurnStart(await resource.process.rpc.request('turn/start', {
+        const result = decodeTurnStart(await resource.process.rpc.request('turn/start', {
             threadId: childThreadId,
             input: [{ type: 'text', text, text_elements: [] }],
             clientUserMessageId,
             ...(session.model ? { model: session.model } : {}),
         }));
+        if (resource.turnThreads.has(result) || resource.turnThreads.size < 256)
+            resource.turnThreads.set(result, childThreadId);
+        return result;
     }
     /** The sole authoritative in-process ownership probe.  It never launches a child. */
     ownsWriter(sessionId) {
@@ -241,6 +270,19 @@ export class CodexSessionRuntime {
             throw new Error('CODEX_SESSION_NOT_RUNNING');
         await resource.process.rpc.request('turn/interrupt', { threadId: session.threadId, turnId });
     }
+    async interruptExecutor(session, threadId) {
+        const resource = this.sessions.get(session.id);
+        if (!resource)
+            throw new Error('CODEX_SESSION_NOT_RUNNING');
+        const history = await this.decodeHistory(resource.process, threadId, resource);
+        if (!history.activeTurnId)
+            return false;
+        await resource.process.rpc.request('turn/interrupt', {
+            threadId,
+            turnId: history.activeTurnId,
+        });
+        return true;
+    }
     async queueTurnInput(session, turnId, text, clientUserMessageId) {
         const resource = this.sessions.get(session.id);
         if (!resource || !session.threadId)
@@ -419,15 +461,36 @@ export class CodexSessionRuntime {
             process.state !== 'result-consumed' &&
             process.state !== 'terminated-for-budget');
     }
-    consumeChildProcessResult(sessionId, childThreadId, processId) {
-        this.sessions
-            .get(sessionId)
-            ?.ownedChildProcesses.delete(childProcessKey(childThreadId, processId));
+    consumeChildProcessResult(sessionId, childThreadId, processId, actionId) {
+        const owned = this.sessions.get(sessionId);
+        if (!owned || (actionId && owned.completedProcessActions.has(actionId)))
+            return;
+        owned.ownedChildProcesses.delete(childProcessKey(childThreadId, processId));
+        if (actionId)
+            owned.completedProcessActions.set(actionId, true);
     }
-    async terminateChildProcess(session, childThreadId, processId) {
+    async terminateChildProcess(session, childThreadId, processId, actionId, expected) {
         const owned = this.sessions.get(session.id);
         if (!owned)
             return false;
+        if (actionId && owned.completedProcessActions.has(actionId))
+            return owned.completedProcessActions.get(actionId);
+        // The action journal is deliberately runtime-local.  After an app-server
+        // restart, reconcile the live terminal list before repeating termination:
+        // a process id (and OS pid) can already name a later command instance.
+        // Absence of this exact instance means the target has already converged;
+        // never send a second terminate RPC merely to rediscover that fact.
+        if (expected) {
+            const active = await this.listChildBackgroundTerminals(owned, { id: childThreadId });
+            const current = active.find((candidate) => candidate.processId === processId &&
+                candidate.itemId === expected.itemId &&
+                (expected.osPid === undefined || candidate.osPid === expected.osPid));
+            if (!current) {
+                if (actionId)
+                    owned.completedProcessActions.set(actionId, true);
+                return true;
+            }
+        }
         const result = await owned.process.rpc.request('thread/backgroundTerminals/terminate', {
             threadId: childThreadId,
             processId,
@@ -439,6 +502,8 @@ export class CodexSessionRuntime {
             if (process)
                 owned.ownedChildProcesses.set(key, { ...process, state: 'terminated-for-budget' });
         }
+        if (actionId)
+            owned.completedProcessActions.set(actionId, terminated);
         return terminated;
     }
     async listChildBackgroundTerminals(owned, child) {
@@ -739,13 +804,25 @@ export class CodexSessionRuntime {
                 this.onNotification?.(session.id, notification, this.resolveNotificationOrigin(resource, notification));
             });
             const requestUnsubscribe = process.rpc.onServerRequest((request) => this.holdServerRequest(resource, request));
+            const responseUnsubscribe = process.rpc.onServerResponseSettled?.((settlement) => {
+                const requestId = String(settlement.id);
+                if (!resource.pendingRequests.delete(requestId))
+                    return;
+                this.serverResponseListeners.forEach((listener) => listener(resource.sessionId, requestId, settlement.outcome));
+            });
             if (!resource.active) {
                 notificationUnsubscribe();
                 requestUnsubscribe();
+                responseUnsubscribe?.();
                 throw new Error('CODEX_SESSION_PROCESS_EXITED');
             }
             // The resource's private unsubscribe list is populated before it is published.
-            resource.attach([notificationUnsubscribe, requestUnsubscribe, exitUnsubscribe]);
+            resource.attach([
+                notificationUnsubscribe,
+                requestUnsubscribe,
+                ...(responseUnsubscribe ? [responseUnsubscribe] : []),
+                exitUnsubscribe,
+            ]);
             return resource;
         }
         catch (error) {

package/dist/server/shared/contracts/autopilot-recovery.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+/** Safe, shared UI copy for the bounded checkpoint transport recovery path. */
+export const checkpointHandoffRecoveryMessage = 'Checkpoint handoff failed. Autopilot is reconnecting this session automatically. If it cannot recover, restore or reopen the session.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gestalt-mobile",
-  "version": "0.35.1",
+  "version": "0.35.2",
   "description": "Mobile-first web relay for durable Codex development sessions",
   "keywords": [
     "codex",