gestalt-mobile 0.35.3 → 0.35.5

package/dist/server/server/composition.contracts.js

@@ -152,13 +152,13 @@ const autopilotPlanText = (childState = 'TODO') => `#+TITLE: Autopilot fixture
 const completedAutopilotPlanText = () => autopilotPlanText('DONE')
     .replace('* WIP [#A] Parent', '* DONE [#A] Parent')
     .replace(':REVIEW_STATUS: UNREVIEWED', ':REVIEW_STATUS: REVIEWED');
-async function installAutopilotPlan(app, sessionId, workspacePath, name, childState = 'TODO') {
+async function installAutopilotPlan(app, sessionId, workspacePath, name, childState = 'TODO', reason = 'supervision-start') {
     const planPath = join(workspacePath, `${name}.org`);
     await writeFile(planPath, autopilotPlanText(childState));
     await writeFile(planStatusFilePath(planStatusDirectoryPath(workspacePath, sessionId), planPath), JSON.stringify({
         schemaVersion: 1,
         planPath,
-        reason: 'supervision-start',
+        reason,
         updatedAt: new Date().toISOString(),
     }));
     await expect
@@ -2242,6 +2242,37 @@ describe('production composition', () => {
         });
     });
     describeCompositionConcern('lifecycle', () => {
+        it('retains an authored plan without starting supervision', async () => {
+            const root = await mkdtemp(join(tmpdir(), 'gestalt-mobile-root-'));
+            const dataDir = await mkdtemp(join(tmpdir(), 'gestalt-mobile-state-'));
+            ownTemporaryPaths(root, dataDir);
+            const workspacePath = join(root, 'workspace');
+            await mkdir(workspacePath);
+            const handles = [];
+            const app = await composeAuthorizedApp({
+                root,
+                dataDir,
+                relyingParty,
+                installedCodexVersion: 'codex-cli 0.144.3',
+                startAppServers: true,
+                launchAppServer: liveAppServer(handles),
+                profiles: {
+                    list: async () => [],
+                    require: async () => ({
+                        name: 'default',
+                        state: 'ok',
+                        status: 'ready',
+                    }),
+                },
+            });
+            const sessionId = await createComposedSession(app);
+            await installAutopilotPlan(app, sessionId, workspacePath, 'authored-only', 'TODO', 'authoring-start');
+            expect((await app.inject(`/api/sessions/${sessionId}`)).json()).toMatchObject({
+                autopilot: { enabled: false, state: 'disabled' },
+            });
+            expect(handles.flatMap((handle) => handle.requests.filter((request) => request.method === 'turn/start'))).toHaveLength(0);
+            await app.close();
+        });
         it('rejects a wait lease when automatic continuation is unavailable', async () => {
             const root = await mkdtemp(join(tmpdir(), 'gestalt-mobile-root-'));
             const dataDir = await mkdtemp(join(tmpdir(), 'gestalt-mobile-state-'));

package/dist/server/server/composition.js

@@ -588,7 +588,7 @@ export async function composeRelayApp(options) {
             if (rawInteraction.kind === 'autopilotWaitLease') {
                 const lease = rawInteraction.payload;
                 const rootOwned = origin.kind === 'root' && origin.physicalTurnId === session.activeTurnId;
-                const accepted = rootOwned &&
+                const registration = rootOwned &&
                     (lease.version === 2
                         ? autopilot.registerProactiveWait(sessionId, {
                             id: lease.reportId,
@@ -602,10 +602,12 @@ export async function composeRelayApp(options) {
                             leaseId: lease.leaseId,
                             wakeConditions: lease.wakeConditions,
                         }));
-                if (!accepted) {
-                    if (rootOwned)
+                if (registration !== true) {
+                    if (rootOwned && registration === false)
                         autopilot.rejectProbe(sessionId);
-                    return (runtime?.resolveServerRequest(sessionId, rawInteraction.requestId, autopilotWaitLeaseToolResponse(false)) === true);
+                    return (runtime?.resolveServerRequest(sessionId, rawInteraction.requestId, autopilotWaitLeaseToolResponse(false, registration === 'wakeAlreadySatisfied'
+                        ? 'wakeAlreadySatisfied'
+                        : 'automaticContinuationUnavailable')) === true);
                 }
                 return (runtime?.resolveServerRequest(sessionId, rawInteraction.requestId, autopilotWaitLeaseToolResponse()) === true);
             }

package/dist/server/server/features/autopilot/application/policy.js

@@ -3,8 +3,8 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-export const AUTOPILOT_PROMPT_VERSION = 'v9';
-export const AUTOPILOT_CONTINUATION_PROMPT = 'Inspect the active supervised Org Plan. Refer to every L1 as L<a> and each nested L2 as L<a>.<b>, using one-based positions. Spawn exactly one executor per L1 and pass the exact literal task_name l<a>: l1 for L1, l2 for L2, and so on. Never create an L2-specific task name or append a title, role, nickname, plan name, or generated label. A validated DONE L2 and an accepted L1 are mandatory answer boundaries. The corresponding gestalt_org_plan_checkpoint call must be the last tool call of that root turn: immediately emit exactly one boundary final and end the turn, without followup_task, review, executor launch, or later milestone work. On this later Autopilot turn, resume the same executor after an L2 boundary or launch the next executor after an accepted-L1 boundary. Treat a status question as an interruption: answer briefly, then perform the applicable continuation in the same turn. Before sending any blocker response or yielding because progress cannot continue safely, call gestalt_org_plan_attention for the matching decision-table blocker; never rely on blocker prose as the signal. Do not call it for routine progress or a recoverable failure. Before yielding for known long work, call gestalt_autopilot_wait_lease version 2 with relevant observable wake conditions and a bounded maxWaitMs; it is one episode, so reassess before registering another in a later turn. For GitHub PR CI, start an owned gh pr checks --watch process and lease processExited plus processResultAvailable while it runs. When the Autopilot probe is active, register the compatible wait lease, declare genuine attention, or immediately do actionable work; never acknowledge waiting in prose. Do not send a status-only response.';
+export const AUTOPILOT_PROMPT_VERSION = 'v10';
+export const AUTOPILOT_CONTINUATION_PROMPT = 'Inspect the active supervised Org Plan. Refer to every L1 as L<a> and each nested L2 as L<a>.<b>, using one-based positions. Spawn exactly one executor per L1 and pass the exact literal task_name l<a>: l1 for L1, l2 for L2, and so on. Never create an L2-specific task name or append a title, role, nickname, plan name, or generated label. A validated DONE L2 and an accepted L1 are mandatory answer boundaries. The corresponding gestalt_org_plan_checkpoint call must be the last tool call of that root turn: immediately emit exactly one boundary final and end the turn, without followup_task, review, executor launch, or later milestone work. Roll up commentary, files, verification, and commands since the previous boundary into that one answer; all later milestone activity belongs to a new root turn. On this later Autopilot turn, resume the same executor after an L2 boundary or launch the next executor after an accepted-L1 boundary. Treat a status question as an interruption: answer briefly, then perform the applicable continuation in the same turn. Before sending any blocker response or yielding because progress cannot continue safely, call gestalt_org_plan_attention for the matching decision-table blocker; never rely on blocker prose as the signal. Do not call it for routine progress or a recoverable failure. Before yielding for known long work, call gestalt_autopilot_wait_lease version 2 with relevant observable wake conditions and a bounded maxWaitMs; it is one episode, so reassess before registering another in a later turn. Yield only when its response contains accepted:true; accepted:false means no continuation was registered and requires same-turn supervision. For GitHub PR CI, start an owned gh pr checks --watch process and lease processExited plus processResultAvailable while it runs. When the Autopilot probe is active, register the compatible wait lease, declare genuine attention, or immediately do actionable work; never acknowledge waiting in prose. Do not send a status-only response.';
 export const AUTOPILOT_EXECUTOR_CONTINUATION_PROMPT = 'Continue the same assigned Org L1 from its durable state. A prior turn ending did not complete the objective. Consume any supplied process result and take the next legal L2 action. Whenever an L2 reaches DONE, return its concise structured evidence and end the executor turn so the root can publish that mandatory answer boundary. Also report at the L1 review boundary or through structured attention.';
 /** Builds a physical launch instruction while keeping durable L1 identity canonical. */
 export function autopilotExecutorLaunchPrompt(identity) {

package/dist/server/server/features/autopilot/application/service.js

@@ -162,6 +162,24 @@ export class AutopilotCoordinator {
             report.maxWaitMs > AUTOPILOT_WAIT_MAX_MS)
             return false;
         const now = this.deps.now();
+        if (this.executorWakeAlreadySatisfied(sessionId, state, report.wakeConditions)) {
+            // The executor edge is already visible. Fence every pending automatic
+            // callback before returning control to the still-active root; otherwise
+            // a scheduled executor resume could race same-turn supervision.
+            const cancelled = this.cancelScheduledControl(state, now);
+            this.persist({
+                ...state,
+                generation: state.generation + 1,
+                ...(cancelled ? { lastControlId: null } : {}),
+                nextEvaluationAt: null,
+                updatedAt: now,
+            }, cancelled);
+            this.timers.get(sessionId)?.();
+            this.timers.delete(sessionId);
+            this.completionTimers.get(sessionId)?.();
+            this.completionTimers.delete(sessionId);
+            return 'wakeAlreadySatisfied';
+        }
         const resumeAt = new Date(Date.parse(now) + report.maxWaitMs).toISOString();
         const protocol = state.supervision ?? startSupervisionProtocol(this.progressKey(sessionId));
         const nextProtocol = registerProtocolWait(protocol, { ...report, resumeAt });
@@ -185,6 +203,19 @@ export class AutopilotCoordinator {
         this.armWaitDeadline(sessionId, report.leaseId, resumeAt);
         return true;
     }
+    /** Prevents an edge-triggered executor lease from parking after its edge. */
+    executorWakeAlreadySatisfied(sessionId, state, wakeConditions) {
+        if (!wakeConditions.includes('executorChanged'))
+            return false;
+        if (this.completionTimers.has(sessionId))
+            return true;
+        const retained = this.deps.plan(sessionId);
+        const activity = this.deps.activity(sessionId);
+        if (!retained || activity?.confidence !== 'fresh')
+            return false;
+        const executor = this.currentExecutor(sessionId, retained.plan, state.consecutiveNoProgress, state.executor);
+        return Boolean(executor && !this.authoritativeExecutorActive(state, retained.plan, activity));
+    }
     /** Fails closed only for the currently active bounded probe. */
     rejectProbe(sessionId) {
         const state = this.deps.store.find(sessionId);
@@ -1074,6 +1105,10 @@ export class AutopilotCoordinator {
         this.completionTimers.delete(sessionId);
         this.executorTimers.get(sessionId)?.();
         this.executorTimers.delete(sessionId);
+        this.cancelScheduledExecutorCommands(sessionId);
+    }
+    /** Cancels executor authority while allowing a delivered stale callback to audit itself. */
+    cancelScheduledExecutorCommands(sessionId) {
         const state = this.deps.store.find(sessionId);
         const executor = state?.executor;
         if (state && executor?.commands?.some((command) => command.status === 'scheduled'))

package/dist/server/server/features/plans/application/parse-supervised-plan.js

@@ -201,9 +201,10 @@ function measurementFor(heading) {
         if (value === undefined)
             continue;
         if (property.endsWith('_AT')) {
-            if (!isUtcIsoInstant(value))
+            const instant = normalizeUtcIsoInstant(value);
+            if (!instant)
                 return null;
-            measurement[field] = value;
+            measurement[field] = instant;
             continue;
         }
         if (!/^\d+$/.test(value))
@@ -215,14 +216,38 @@ function measurementFor(heading) {
     }
     return Object.keys(measurement).length === 0 ? undefined : measurement;
 }
-function isUtcIsoInstant(value) {
-    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value))
-        return false;
+function normalizeUtcIsoInstant(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{3}))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+    if (!match)
+        return null;
+    const [, yearValue, monthValue, dayValue, hourValue, minuteValue, secondValue, , zone] = match;
+    const [year, month, day, hour, minute, second] = [
+        yearValue,
+        monthValue,
+        dayValue,
+        hourValue,
+        minuteValue,
+        secondValue,
+    ].map(Number);
+    const offset = zone === 'Z' ? null : zone.slice(1).split(':').map(Number);
+    if (year < 1 ||
+        month < 1 ||
+        month > 12 ||
+        day < 1 ||
+        day > new Date(Date.UTC(year, month, 0)).getUTCDate() ||
+        hour > 23 ||
+        minute > 59 ||
+        second > 59 ||
+        (offset && (offset[0] > 23 || offset[1] > 59)))
+        return null;
     const instant = new Date(value);
     if (Number.isNaN(instant.getTime()))
-        return false;
-    const canonical = instant.toISOString();
-    return value === canonical || value === canonical.replace('.000Z', 'Z');
+        return null;
+    if (zone === 'Z') {
+        const canonical = instant.toISOString();
+        return value === canonical || value === canonical.replace('.000Z', 'Z') ? value : null;
+    }
+    return instant.toISOString().replace('.000Z', 'Z');
 }
 function descriptionFor(heading) {
     const fields = heading.level === 1 ? ['Effort', 'Goal', 'Notes'] : ['Why', 'Change', 'Tests', 'Done when'];

package/dist/server/shared/contracts/autopilot-wait-lease.js

@@ -74,7 +74,7 @@ export function parseAutopilotWaitLease(value) {
         maxWaitMs: value.maxWaitMs,
     };
 }
-export function autopilotWaitLeaseToolResponse(accepted = true) {
+export function autopilotWaitLeaseToolResponse(accepted = true, reason = 'automaticContinuationUnavailable') {
     return {
         success: true,
         contentItems: [
@@ -82,7 +82,7 @@ export function autopilotWaitLeaseToolResponse(accepted = true) {
                 type: 'inputText',
                 text: accepted
                     ? '{"accepted":true}'
-                    : '{"accepted":false,"reason":"automaticContinuationUnavailable","next":"continueSameTurn"}',
+                    : JSON.stringify({ accepted: false, reason, next: 'continueSameTurn' }),
             },
         ],
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gestalt-mobile",
-  "version": "0.35.3",
+  "version": "0.35.5",
   "description": "Mobile-first web relay for durable Codex development sessions",
   "keywords": [
     "codex",