gestalt-mobile 0.9.0 → 0.11.0

package/dist/server/server/app.js

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import fastifyStatic from '@fastify/static';
+import fastifyCookie from '@fastify/cookie';
 import fastify, {} from 'fastify';
 import { registerGetHealth } from './features/health/get-health/endpoint.js';
 import { registerGetBootstrap } from './features/catalog/get-bootstrap/endpoint.js';
@@ -33,22 +34,60 @@ import { registerGetPlan } from './features/plans/get-plan/endpoint.js';
 import { registerClosePlan } from './features/plans/close-plan/endpoint.js';
 import { registerGetPlanMeasurement } from './features/plans/get-measurement/endpoint.js';
 import { registerProblemHandler } from './platform/http/problem-handler.js';
+import { authorizationSessionDevice, registerAuthorizationBoundary, } from './platform/http/authorization-boundary.js';
 import { registerListAvailableSkills, } from './features/skills/list-available/endpoint.js';
 import { registerListSkillProfiles, } from './features/skills/list-profiles/endpoint.js';
 import { registerReplaceSkillProfile, } from './features/skills/replace-profile/endpoint.js';
 import { registerDeleteSkillProfile, } from './features/skills/delete-profile/endpoint.js';
+import { registerRegistrationOptions } from './features/auth/register/options/endpoint.js';
+import { registerRegistrationVerification } from './features/auth/register/verify/endpoint.js';
+import { registerLoginOptions } from './features/auth/login/options/endpoint.js';
+import { registerLoginVerification } from './features/auth/login/verify/endpoint.js';
+import { registerAuthStatus, registerDisabledAuthStatus, } from './features/auth/status/endpoint.js';
+import { registerLogout } from './features/auth/logout/endpoint.js';
+import { registerListAuthorizedDevices } from './features/auth/devices/list/endpoint.js';
+import { registerRenameAuthorizedDevice } from './features/auth/devices/rename/endpoint.js';
+import { registerRevokeAuthorizedDevice } from './features/auth/devices/revoke/endpoint.js';
+import { registerCreateEnrollmentTicket } from './features/auth/enrollment-tickets/endpoint.js';
+import { registerEnrollmentTicketStatus } from './features/auth/enrollment-tickets/status/endpoint.js';
+import { registerCancelEnrollmentTicket } from './features/auth/enrollment-tickets/cancel/endpoint.js';
 export async function buildApp(deps) {
     const app = fastify({ logger: false });
+    await app.register(fastifyCookie);
     if (deps.staticDir)
         await app.register(fastifyStatic, { root: deps.staticDir });
+    if (deps.auth)
+        registerAuthorizationBoundary(app, {
+            repository: deps.auth.repository,
+            clock: deps.auth.clock,
+            publicOrigin: deps.auth.relyingParty.publicOrigin,
+        });
     registerGetHealth(app, deps.health);
+    if (deps.auth) {
+        registerRegistrationOptions(app, deps.auth);
+        registerRegistrationVerification(app, deps.auth);
+        registerLoginOptions(app, deps.auth);
+        registerLoginVerification(app, deps.auth);
+        registerAuthStatus(app, deps.auth);
+        registerLogout(app, deps.auth);
+        registerListAuthorizedDevices(app, deps.auth);
+        registerRenameAuthorizedDevice(app, deps.auth);
+        registerRevokeAuthorizedDevice(app, deps.auth);
+        registerCreateEnrollmentTicket(app, deps.auth);
+        registerEnrollmentTicketStatus(app, deps.auth);
+        registerCancelEnrollmentTicket(app, deps.auth);
+    }
+    else if (deps.passkeyAuthDisabled)
+        registerDisabledAuthStatus(app);
     if (deps.bootstrap)
         registerGetBootstrap(app, deps.bootstrap);
     if (deps.recentThreads)
         registerListRecentThreads(app, {
             ...deps.recentThreads,
             metadata: (threadId) => {
-                const session = deps.sessionRoutes?.list?.().find((candidate) => candidate.threadId === threadId);
+                const session = deps.sessionRoutes
+                    ?.list?.()
+                    .find((candidate) => candidate.threadId === threadId);
                 if (!session)
                     return null;
                 return {
@@ -56,7 +95,9 @@ export async function buildApp(deps) {
                     ...(session.effectiveSkillSelection?.selectedProfileName === undefined
                         ? {}
                         : { skillProfile: session.effectiveSkillSelection.selectedProfileName }),
-                    ...(session.lastOrgPlan === undefined ? {} : { orgPlanFilename: session.lastOrgPlan.filename }),
+                    ...(session.lastOrgPlan === undefined
+                        ? {}
+                        : { orgPlanFilename: session.lastOrgPlan.filename }),
                 };
             },
         });
@@ -138,7 +179,15 @@ export async function buildApp(deps) {
             });
     }
     if (deps.sessionEvents)
-        registerSessionEvents(app, deps.sessionEvents);
+        registerSessionEvents(app, {
+            ...deps.sessionEvents,
+            ...(deps.auth
+                ? {
+                    publicOrigin: deps.auth.relyingParty.publicOrigin,
+                    authorized: (cookieHeader) => authorizationSessionDevice(cookieHeader, deps.auth) !== null,
+                }
+                : {}),
+        });
     if (deps.planRoutes) {
         registerGetPlan(app, deps.planRoutes);
         registerClosePlan(app, deps.planRoutes);

package/dist/server/server/cli.js

@@ -21,6 +21,8 @@ Options:
   --cwd <path>       Workspace root (default: current directory)
   --host <address>   Listen address (default: 127.0.0.1)
   --port <number>    Listen port (default: 3000)
+  --public-origin <origin> Exact HTTPS browser origin for passkeys (localhost may use HTTP)
+  --disable-passkey-auth Disable passkey access control (unsafe on shared or network hosts)
   --data-dir <path>  Directory for persistent application data
   --skills <profile> Use a global skill profile for every session
   --skills list      List saved global skill profiles without starting the server
@@ -135,6 +137,8 @@ export async function runCli(dependencies = {}) {
     if (invocation.command === 'list')
         return listSkillProfiles(skillProfiles, stdout, stderr);
     const config = invocation.config;
+    if (!config.passkeyAuthEnabled)
+        stderr.write('WARNING: Passkey access control is disabled; anyone who can reach this server has full access.\n');
     let explicitSkillProfile;
     try {
         explicitSkillProfile = config.skillsProfile
@@ -152,6 +156,8 @@ export async function runCli(dependencies = {}) {
     const app = await (dependencies.compose ?? composeRelayApp)({
         root: config.root,
         dataDir: config.dataDir,
+        relyingParty: config.relyingParty,
+        passkeyAuthEnabled: config.passkeyAuthEnabled,
         staticDir: packagedClientDir(moduleUrl),
         profiles: new CodexProfileCatalog(),
         installedCodexVersion: await (dependencies.probeCodexVersion ?? probeCodexVersion)(),

package/dist/server/server/composition.js

@@ -3,7 +3,7 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-import { randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
@@ -17,6 +17,9 @@ import { CodexSessionRuntime } from './platform/codex/session-runtime.js';
 import { normalizeCodexNotification } from './platform/codex/normalizer.js';
 import { migrate } from './platform/persistence/migrate.js';
 import { openRelayDatabase } from './platform/persistence/sqlite.js';
+import { SqliteAuthorizationStore } from './platform/auth/sqlite-authorization-store.js';
+import { SimpleWebAuthnAdapter } from './platform/auth/simple-webauthn-adapter.js';
+import { authorizationSessionId, authorizedDeviceId } from './features/auth/domain/identifiers.js';
 import { SqliteSessionRepository } from './platform/persistence/sqlite-session-repository.js';
 import { SqliteEventJournal } from './platform/persistence/sqlite-event-journal.js';
 import { SqlitePendingInteractionStore } from './platform/persistence/sqlite-pending-interaction-store.js';
@@ -40,14 +43,30 @@ import { SupervisedPlanRegistry } from './features/plans/application/supervised-
 import { FilesystemPlanStatusSource } from './platform/plans/filesystem-plan-status-source.js';
 import { checkpointPlanMeasurement } from './platform/plans/plan-measurement-command.js';
 import { PlanMeasurementRefresh } from './platform/plans/plan-measurement-refresh.js';
+import { createRelyingPartyConfig, } from './config.js';
 const generatedProtocolVersion = 'codex-cli 0.144.3';
 export async function composeRelayApp(options) {
+    const passkeyAuthEnabled = options.passkeyAuthEnabled ?? true;
+    const relyingParty = createRelyingPartyConfig(options.relyingParty.publicOrigin);
+    if (relyingParty.rpId !== options.relyingParty.rpId ||
+        relyingParty.rpName !== options.relyingParty.rpName)
+        throw new Error('Invalid WebAuthn relying-party configuration');
+    const authorizationRandom = options.authorizationRandomBytes ?? randomBytes;
+    const ownerHandle = passkeyAuthEnabled ? authorizationRandom(32) : undefined;
+    if (ownerHandle && ownerHandle.length !== 32)
+        throw new Error('Authorization randomness must return exactly 32 bytes');
     const root = resolve(options.root);
     const databasePath = options.dataDir
         ? join(resolve(options.dataDir), 'relay.sqlite')
         : resolveStateDatabasePath(root, process.env.XDG_STATE_HOME ?? join(homedir(), '.local', 'state'));
     const database = openRelayDatabase(databasePath);
-    migrate(database);
+    try {
+        migrate(database);
+    }
+    catch (error) {
+        database.close();
+        throw error;
+    }
     const sessions = new SqliteSessionRepository(database);
     const journal = new SqliteEventJournal(database);
     const interactions = new SqlitePendingInteractionStore(database);
@@ -158,164 +177,206 @@ export async function composeRelayApp(options) {
         });
         recoverExitedSession = (sessionId) => supervisor.recover(sessionId);
     }
-    const app = await buildApp({
-        health: {
-            async read() {
-                return {
-                    status: protocol.compatible ? 'ok' : 'degraded',
-                    version: '0.1.0',
-                    codex: {
-                        installedVersion: options.installedCodexVersion,
-                        protocolVersion: generatedProtocolVersion,
-                        compatible: protocol.compatible,
+    let authorization;
+    if (passkeyAuthEnabled) {
+        try {
+            authorization = new SqliteAuthorizationStore(options.homeDirectory ?? homedir(), relyingParty);
+            authorization.initializeOwner(ownerHandle);
+        }
+        catch (error) {
+            database.close();
+            throw error;
+        }
+    }
+    let app;
+    try {
+        app = await buildApp({
+            ...(authorization ? { auth: {
+                    repository: authorization,
+                    clock: { now: options.authorizationClock ?? (() => new Date()) },
+                    random: {
+                        bytes: (length) => {
+                            const value = authorizationRandom(length);
+                            if (length !== 32 || value.length !== 32)
+                                throw new Error('Authorization randomness must return exactly 32 bytes');
+                            return value;
+                        },
                     },
-                };
-            },
-        },
-        skills: {
-            workspaces,
-            profiles: options.profiles,
-            catalog: editorSkillCatalog,
-            selections: skillProfiles,
-            listGlobalProfileNames: () => skillProfiles.listGlobalProfileNames(),
-            readGlobalProfile: (name) => skillProfiles.readGlobalProfile(name),
-            replaceGlobalProfile: (profile) => skillProfiles.replaceGlobalProfile(profile),
-            deleteGlobalProfile: (name) => skillProfiles.deleteGlobalProfile(name),
-            profilePath: (name) => skillProfiles.globalProfilePath(name),
-        },
-        logger: console,
-        staticDir: options.staticDir,
-        recentThreads,
-        bootstrap: {
-            workspaces,
-            profiles: options.profiles,
-            models,
-            sessions: {
-                list: () => sessions.list().map((session) => withPendingInteractions(session)),
-            },
-            protocolCompatible: protocol.compatible,
-        },
-        sessionRoutes: {
-            createId: randomUUID,
-            now: () => new Date().toISOString(),
-            save: saveSession,
-            find: (id) => withPendingInteractions(sessions.find(id)),
-            list: () => sessions.list().map((session) => withPendingInteractions(session)),
-            workspaces,
-            profiles: options.profiles,
-            skillProfiles,
-            skillCatalog,
-            defaultSkillProfile: options.explicitSkillProfile,
-            activate: runtime
-                ? async (session, settings) => runtime.start(session, new Date().toISOString(), settings)
-                : undefined,
-            startTurn: runtime
-                ? async (session, text) => runtime.startTurn(session, text, new Date().toISOString())
-                : undefined,
-            onTurnStarted: (session) => planMeasurementRefresh?.refreshNow(session.id),
-            models,
-            readHistory: runtime ? (session) => runtime.readHistory(session) : undefined,
-            currentSequence: (sessionId) => journal.since(sessionId, 0).at(-1)?.sequence ?? 0,
-            interruptTurn: runtime
-                ? (session, turnId) => runtime.interruptTurn(session, turnId)
-                : undefined,
-            restore: runtime
-                ? (session) => runtime.restore(session, new Date().toISOString())
-                : undefined,
-            promoteRecent: runtime
-                ? (thread) => promoteRecentThread(thread, {
-                    createId: randomUUID,
-                    now: () => new Date().toISOString(),
-                    list: () => sessions.list(),
-                    save: saveSession,
-                    restore: (session) => runtime.restore(session, new Date().toISOString()),
-                })
-                : undefined,
-            release: (session) => RelaySession.rehydrate(session).release(new Date().toISOString()).snapshot,
-            remove: (id) => sessions.remove(id),
-            idempotency,
-            close: runtime
-                ? (id) => {
-                    planMeasurementRefresh?.stop(id);
-                    return runtime.release(id);
-                }
-                : undefined,
-            replyInteraction: runtime
-                ? (sessionId, requestId, value) => runtime.resolveServerRequest(sessionId, requestId, value)
-                : undefined,
-            interactionResolved: (sessionId, requestId, occurredAt) => {
-                events.publish(journal.append(sessionId, 'interaction.resolved', { requestId }, occurredAt));
+                    identifiers: {
+                        sessionId: () => {
+                            const value = authorizationRandom(32);
+                            if (value.length !== 32)
+                                throw new Error('Authorization randomness must return exactly 32 bytes');
+                            return authorizationSessionId(Buffer.from(value).toString('base64url'));
+                        },
+                        deviceId: () => authorizedDeviceId(randomUUID()),
+                    },
+                    webauthn: options.authorizationWebauthn ?? new SimpleWebAuthnAdapter(),
+                    relyingParty,
+                } } : { passkeyAuthDisabled: true }),
+            health: {
+                async read() {
+                    return {
+                        status: protocol.compatible ? 'ok' : 'degraded',
+                        version: '0.1.0',
+                        codex: {
+                            installedVersion: options.installedCodexVersion,
+                            protocolVersion: generatedProtocolVersion,
+                            compatible: protocol.compatible,
+                        },
+                    };
+                },
             },
-        },
-        sessionEvents: {
-            exists: (id) => sessions.find(id) !== null,
-            since: (id, after) => journal.since(id, after),
-            subscribe: (id, listener) => events.subscribe(id, listener),
-        },
-        planRoutes: {
-            exists: (id) => sessions.find(id) !== null,
-            find: (id) => supervisedPlans.find(id),
-            removeStatus: (id) => planStatusSource.remove(id, supervisedPlans.identity(id) ?? undefined),
-            clear: (id) => supervisedPlans.clear(id),
-            closed: (id) => {
-                planMeasurementRefresh?.stop(id);
-                const occurredAt = new Date().toISOString();
-                events.publish(journal.append(id, 'plan.closed', {}, occurredAt));
+            skills: {
+                workspaces,
+                profiles: options.profiles,
+                catalog: editorSkillCatalog,
+                selections: skillProfiles,
+                listGlobalProfileNames: () => skillProfiles.listGlobalProfileNames(),
+                readGlobalProfile: (name) => skillProfiles.readGlobalProfile(name),
+                replaceGlobalProfile: (profile) => skillProfiles.replaceGlobalProfile(profile),
+                deleteGlobalProfile: (name) => skillProfiles.deleteGlobalProfile(name),
+                profilePath: (name) => skillProfiles.globalProfilePath(name),
             },
-        },
-        ...(runtime
-            ? {
-                planMeasurementRoutes: {
-                    exists: (id) => sessions.find(id) !== null,
-                    authorize: (id, authorization) => runtime.authorizePlanMeasurement(id, authorization),
-                    read: async (id) => {
-                        const session = sessions.find(id);
-                        if (!session)
-                            throw new Error('CODEX_SESSION_NOT_RUNNING');
-                        return runtime.readPlanMeasurement(session);
-                    },
+            logger: console,
+            staticDir: options.staticDir,
+            recentThreads,
+            bootstrap: {
+                workspaces,
+                profiles: options.profiles,
+                models,
+                sessions: {
+                    list: () => sessions.list().map((session) => withPendingInteractions(session)),
                 },
-            }
-            : {}),
-        interactions: {
-            resolve: (sessionId, requestId, resolvedAt) => interactions.resolve(sessionId, requestId, resolvedAt),
-            validate: (sessionId, requestId, value) => {
-                const interaction = interactions.find(sessionId, requestId);
-                if (!interaction)
-                    return false;
-                if (interaction.kind === 'quiz')
-                    return isValidQuizInteractionResponse(interaction.payload, value);
-                return isValidInteractionResponse(interaction.kind, value);
+                protocolCompatible: protocol.compatible,
             },
-        },
-        gitSummary: {
-            workspaces,
-            inspect: async (path) => {
-                const summary = await gitSummaries.inspect(path);
-                const fetchedAt = gitFetches.lastSuccessfulAt(path);
-                return { ...summary, fetchedAt: fetchedAt ? new Date(fetchedAt).toISOString() : null };
+            sessionRoutes: {
+                createId: randomUUID,
+                now: () => new Date().toISOString(),
+                save: saveSession,
+                find: (id) => withPendingInteractions(sessions.find(id)),
+                list: () => sessions.list().map((session) => withPendingInteractions(session)),
+                workspaces,
+                profiles: options.profiles,
+                skillProfiles,
+                skillCatalog,
+                defaultSkillProfile: options.explicitSkillProfile,
+                activate: runtime
+                    ? async (session, settings) => runtime.start(session, new Date().toISOString(), settings)
+                    : undefined,
+                startTurn: runtime
+                    ? async (session, text) => runtime.startTurn(session, text, new Date().toISOString())
+                    : undefined,
+                onTurnStarted: (session) => planMeasurementRefresh?.refreshNow(session.id),
+                models,
+                readHistory: runtime ? (session) => runtime.readHistory(session) : undefined,
+                currentSequence: (sessionId) => journal.since(sessionId, 0).at(-1)?.sequence ?? 0,
+                interruptTurn: runtime
+                    ? (session, turnId) => runtime.interruptTurn(session, turnId)
+                    : undefined,
+                restore: runtime
+                    ? (session) => runtime.restoreWithOutcome(session, new Date().toISOString())
+                    : undefined,
+                promoteRecent: runtime
+                    ? (thread) => promoteRecentThread(thread, {
+                        createId: randomUUID,
+                        now: () => new Date().toISOString(),
+                        list: () => sessions.list(),
+                        save: saveSession,
+                        restore: (session) => runtime.restore(session, new Date().toISOString()),
+                    })
+                    : undefined,
+                release: (session) => RelaySession.rehydrate(session).release(new Date().toISOString()).snapshot,
+                remove: (id) => sessions.remove(id),
+                idempotency,
+                close: runtime
+                    ? (id) => {
+                        planMeasurementRefresh?.stop(id);
+                        return runtime.release(id);
+                    }
+                    : undefined,
+                replyInteraction: runtime
+                    ? (sessionId, requestId, value) => runtime.resolveServerRequest(sessionId, requestId, value)
+                    : undefined,
+                interactionResolved: (sessionId, requestId, occurredAt) => {
+                    events.publish(journal.append(sessionId, 'interaction.resolved', { requestId }, occurredAt));
+                },
             },
-            inspectForPush: inspectGit,
-            push: async (path, upstream) => {
-                await pushUpstream(path, upstream);
-                gitSummaries.invalidate(path);
+            sessionEvents: {
+                exists: (id) => sessions.find(id) !== null,
+                since: (id, after) => journal.since(id, after),
+                subscribe: (id, listener) => events.subscribe(id, listener),
             },
-            refresh: async (path) => {
-                await gitFetches.refresh(path);
-                gitSummaries.invalidate(path);
+            planRoutes: {
+                exists: (id) => sessions.find(id) !== null,
+                find: (id) => supervisedPlans.find(id),
+                removeStatus: (id) => planStatusSource.remove(id, supervisedPlans.identity(id) ?? undefined),
+                clear: (id) => supervisedPlans.clear(id),
+                closed: (id) => {
+                    planMeasurementRefresh?.stop(id);
+                    const occurredAt = new Date().toISOString();
+                    events.publish(journal.append(id, 'plan.closed', {}, occurredAt));
+                },
             },
-            pull: async (path) => {
-                await pullRebase(path);
-                gitSummaries.invalidate(path);
+            ...(runtime
+                ? {
+                    planMeasurementRoutes: {
+                        exists: (id) => sessions.find(id) !== null,
+                        authorize: (id, authorization) => runtime.authorizePlanMeasurement(id, authorization),
+                        read: async (id) => {
+                            const session = sessions.find(id);
+                            if (!session)
+                                throw new Error('CODEX_SESSION_NOT_RUNNING');
+                            return runtime.readPlanMeasurement(session);
+                        },
+                    },
+                }
+                : {}),
+            interactions: {
+                resolve: (sessionId, requestId, resolvedAt) => interactions.resolve(sessionId, requestId, resolvedAt),
+                validate: (sessionId, requestId, value) => {
+                    const interaction = interactions.find(sessionId, requestId);
+                    if (!interaction)
+                        return false;
+                    if (interaction.kind === 'quiz')
+                        return isValidQuizInteractionResponse(interaction.payload, value);
+                    return isValidInteractionResponse(interaction.kind, value);
+                },
             },
-            checkout: async (path, branch) => {
-                await checkoutBranch(path, branch);
-                gitSummaries.invalidate(path);
+            gitSummary: {
+                workspaces,
+                inspect: async (path) => {
+                    const summary = await gitSummaries.inspect(path);
+                    const fetchedAt = gitFetches.lastSuccessfulAt(path);
+                    return { ...summary, fetchedAt: fetchedAt ? new Date(fetchedAt).toISOString() : null };
+                },
+                inspectForPush: inspectGit,
+                push: async (path, upstream) => {
+                    await pushUpstream(path, upstream);
+                    gitSummaries.invalidate(path);
+                },
+                refresh: async (path) => {
+                    await gitFetches.refresh(path);
+                    gitSummaries.invalidate(path);
+                },
+                pull: async (path) => {
+                    await pullRebase(path);
+                    gitSummaries.invalidate(path);
+                },
+                checkout: async (path, branch) => {
+                    await checkoutBranch(path, branch);
+                    gitSummaries.invalidate(path);
+                },
+                clone: cloneRepository,
+                idempotency,
             },
-            clone: cloneRepository,
-            idempotency,
-        },
-    });
+        });
+    }
+    catch (error) {
+        authorization?.close();
+        database.close();
+        throw error;
+    }
     const restoreActiveSessions = async () => {
         if (!runtime)
             return;
@@ -341,6 +402,7 @@ export async function composeRelayApp(options) {
         runtime?.stopAll();
         planStatusSource.closeAll();
         database.close();
+        authorization?.close();
     });
     return app;
 }

package/dist/server/server/config.js

@@ -4,16 +4,32 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { resolve } from 'node:path';
+import { isIP } from 'node:net';
 export class CliUsageError extends Error {
     exitCode = 2;
 }
-const optionNames = new Set(['--cwd', '--host', '--port', '--data-dir', '--skills']);
+const optionNames = new Set([
+    '--cwd',
+    '--host',
+    '--port',
+    '--data-dir',
+    '--public-origin',
+    '--skills',
+]);
+const flagNames = new Set(['--disable-passkey-auth']);
 export function parseConfig(args, cwd = process.cwd()) {
     const values = new Map();
+    const flags = new Set();
     for (let index = 0; index < args.length; index += 1) {
         const option = args[index];
         if (!option.startsWith('--'))
             throw new CliUsageError(`Unexpected argument: ${option}`);
+        if (flagNames.has(option)) {
+            if (flags.has(option))
+                throw new CliUsageError(`Duplicate option: ${option}`);
+            flags.add(option);
+            continue;
+        }
         if (!optionNames.has(option))
             throw new CliUsageError(`Unknown option: ${option}`);
         if (values.has(option))
@@ -28,11 +44,57 @@ export function parseConfig(args, cwd = process.cwd()) {
     const port = Number(portValue);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
         throw new CliUsageError(`Invalid --port: ${portValue}`);
+    const host = values.get('--host') ?? '127.0.0.1';
+    const passkeyAuthEnabled = !flags.has('--disable-passkey-auth');
+    const publicOrigin = values.has('--public-origin')
+        ? normalizePublicOrigin(values.get('--public-origin'))
+        : defaultPublicOrigin(host, port, passkeyAuthEnabled);
     return {
-        host: values.get('--host') ?? '127.0.0.1',
+        host,
         port,
+        passkeyAuthEnabled,
+        relyingParty: createRelyingPartyConfig(publicOrigin),
         root: resolve(cwd, values.get('--cwd') ?? '.'),
         dataDir: values.get('--data-dir'),
         skillsProfile: values.get('--skills'),
     };
 }
+export function normalizePublicOrigin(value) {
+    if (!/^[a-z][a-z\d+.-]*:\/\/[^/?#\s\\\\]+\/?$/i.test(value))
+        throw new CliUsageError('--public-origin must be a bare origin without a path, query, or fragment');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliUsageError(`Invalid --public-origin: ${value}`);
+    }
+    if (url.username || url.password)
+        throw new CliUsageError('--public-origin must not include credentials');
+    if (url.pathname !== '/' || url.search || url.hash)
+        throw new CliUsageError('--public-origin must be a bare origin without a path, query, or fragment');
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    if (isIP(hostname))
+        throw new CliUsageError('--public-origin must use a hostname, not an IP address');
+    if (url.protocol === 'http:' && url.hostname === 'localhost')
+        return url.origin;
+    if (url.protocol !== 'https:')
+        throw new CliUsageError('--public-origin must use HTTPS, except for http://localhost');
+    return url.origin;
+}
+export function createRelyingPartyConfig(publicOrigin) {
+    const normalizedOrigin = normalizePublicOrigin(publicOrigin);
+    return {
+        publicOrigin: normalizedOrigin,
+        rpId: new URL(normalizedOrigin).hostname,
+        rpName: 'Gestalt Mobile',
+    };
+}
+function defaultPublicOrigin(host, port, passkeyAuthEnabled) {
+    if (passkeyAuthEnabled && !isLoopbackHost(host))
+        throw new CliUsageError('--public-origin is required when --host is not a loopback address');
+    return `http://localhost:${port}`;
+}
+function isLoopbackHost(host) {
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+}

package/dist/server/server/features/auth/application/ports.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+/** Expected proof failure; adapters must translate library-specific failures to this type. */
+export class PasskeyVerificationError extends Error {
+}