gestalt-mobile 0.9.0 → 0.11.0

package/dist/server/server/platform/codex/json-rpc-client.js

@@ -4,6 +4,38 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 import { createInterface } from 'node:readline';
+export const CODEX_THREAD_NOT_FOUND = 'CODEX_THREAD_NOT_FOUND';
+export const CODEX_JSON_RPC_ERROR = 'CODEX_JSON_RPC_ERROR';
+/** A bounded representation of an app-server JSON-RPC failure. */
+export class CodexJsonRpcError extends Error {
+    code;
+    kind;
+    constructor(code, message, kind = classifyCodexJsonRpcError(code, message)) {
+        super(boundMessage(message));
+        this.code = code;
+        this.kind = kind;
+        this.name = 'CodexJsonRpcError';
+    }
+}
+/**
+ * Codex 0.146 reports a rollout removed by an upgrade as -32600.  Keep the
+ * message match deliberately narrow: other invalid-request responses must not
+ * be treated as permission to replace a durable thread.
+ */
+export function isMissingCodexThreadRollout(error) {
+    return error instanceof CodexJsonRpcError && error.kind === CODEX_THREAD_NOT_FOUND;
+}
+function classifyCodexJsonRpcError(code, message) {
+    return code === -32600 && /^no rollout found for thread id\b/i.test(message)
+        ? CODEX_THREAD_NOT_FOUND
+        : CODEX_JSON_RPC_ERROR;
+}
+function boundMessage(message) {
+    return message
+        .replace(/((?:authorization|token|api[_ -]?key|password)\s*[:=]\s*)\S+/gi, '$1[REDACTED]')
+        .replace(/(authentication failed:\s*).*/i, '$1[REDACTED]')
+        .slice(0, 256);
+}
 export class JsonRpcClient {
     output;
     sequence = 0;
@@ -59,8 +91,10 @@ export class JsonRpcClient {
             if (!pending)
                 return;
             this.pending.delete(message.id);
-            if (message.error)
-                pending.reject(message.error);
+            if (message.error) {
+                const error = message.error;
+                pending.reject(new CodexJsonRpcError(typeof error.code === 'number' ? error.code : undefined, typeof error.message === 'string' ? error.message : 'JSON_RPC_ERROR'));
+            }
             else
                 pending.resolve(message.result);
         }

package/dist/server/server/platform/codex/session-runtime.js

@@ -6,6 +6,7 @@
 import { RelaySession, } from '../../features/sessions/model/relay-session.js';
 import { randomUUID } from 'node:crypto';
 import { createPlanMeasurementSnapshot, } from '../../features/plans/application/measurement-snapshot.js';
+import { canRebindMissingRollout, rebindMissingRollout, } from '../../features/sessions/restore-session/use-case.js';
 import { gestaltQuizDynamicTool } from '../../../shared/contracts/quiz.js';
 export class CodexSessionRuntime {
     launch;
@@ -43,22 +44,13 @@ export class CodexSessionRuntime {
                 clientInfo: { name: 'gestalt-mobile', version: '0.1.0' },
                 capabilities: { experimentalApi: true },
             });
-            const result = (await process.rpc.request('thread/start', {
-                cwd: session.workspacePath,
-                approvalPolicy: settings.approvalPolicy ?? 'on-request',
-                dynamicTools: [gestaltQuizDynamicTool],
-                ...(settings.model ? { model: settings.model } : {}),
-                ...(settings.sandbox ? { sandbox: settings.sandbox } : {}),
-            }));
-            if (!result.thread?.id)
-                throw new Error('CODEX_THREAD_ID_MISSING');
+            const startedThreadId = await this.startThread(process, session, settings);
             this.processes.set(session.id, process);
-            this.threadIds.set(session.id, result.thread.id);
-            return RelaySession.rehydrate(session).bindThread(result.thread.id, now).snapshot;
+            this.threadIds.set(session.id, startedThreadId);
+            return RelaySession.rehydrate(session).bindThread(startedThreadId, now).snapshot;
         }
         catch (error) {
-            process.close();
-            this.releasePlanStatus(session.id);
+            this.discardProcess(session.id, process);
             throw error;
         }
     }
@@ -68,6 +60,8 @@ export class CodexSessionRuntime {
         this.processes.get(sessionId)?.close();
         this.processes.delete(sessionId);
         this.threadIds.delete(sessionId);
+        this.clearPendingRequests(sessionId);
+        this.planMeasurementTokens.delete(sessionId);
         this.releasePlanStatus(sessionId);
     }
     async release(sessionId) {
@@ -156,6 +150,9 @@ export class CodexSessionRuntime {
         };
     }
     async restore(session, now) {
+        return (await this.restoreWithOutcome(session, now)).session;
+    }
+    async restoreWithOutcome(session, now) {
         if (!session.threadId)
             throw new Error('CODEX_THREAD_ID_MISSING');
         const process = await this.launchForSession(session);
@@ -167,18 +164,31 @@ export class CodexSessionRuntime {
                 clientInfo: { name: 'gestalt-mobile', version: '0.1.0' },
                 capabilities: { experimentalApi: true },
             });
-            await process.rpc.request('thread/resume', {
-                threadId: session.threadId,
-                cwd: session.workspacePath,
-                dynamicTools: [gestaltQuizDynamicTool],
-            });
+            let result;
+            try {
+                await process.rpc.request('thread/resume', {
+                    threadId: session.threadId,
+                    cwd: session.workspacePath,
+                    dynamicTools: [gestaltQuizDynamicTool],
+                });
+                result = {
+                    session: RelaySession.rehydrate(session).restore(now).snapshot,
+                    historyUnavailable: false,
+                    replacementCreated: false,
+                };
+            }
+            catch (error) {
+                if (!canRebindMissingRollout(session, error))
+                    throw error;
+                const replacementThreadId = await this.startThread(process, session, { model: session.model });
+                result = rebindMissingRollout(session, error, replacementThreadId, now);
+            }
             this.processes.set(session.id, process);
-            this.threadIds.set(session.id, session.threadId);
-            return RelaySession.rehydrate(session).restore(now).snapshot;
+            this.threadIds.set(session.id, result.session.threadId);
+            return result;
         }
         catch (error) {
-            process.close();
-            this.releasePlanStatus(session.id);
+            this.discardProcess(session.id, process);
             throw error;
         }
     }
@@ -192,12 +202,44 @@ export class CodexSessionRuntime {
         this.exitUnsubscribers.set(sessionId, process.onExit?.(() => {
             this.processes.delete(sessionId);
             this.threadIds.delete(sessionId);
+            this.clearPendingRequests(sessionId);
             this.planMeasurementTokens.delete(sessionId);
             this.exitUnsubscribers.delete(sessionId);
             this.releasePlanStatus(sessionId);
             this.onProcessExit?.(sessionId);
         }) ?? (() => { }));
     }
+    async startThread(process, session, settings = {}) {
+        const result = (await process.rpc.request('thread/start', this.threadStartParams(session, settings)));
+        if (typeof result.thread?.id !== 'string' || !result.thread.id) {
+            throw new Error('CODEX_THREAD_ID_MISSING');
+        }
+        return result.thread.id;
+    }
+    threadStartParams(session, settings) {
+        return {
+            cwd: session.workspacePath,
+            approvalPolicy: settings.approvalPolicy ?? 'on-request',
+            dynamicTools: [gestaltQuizDynamicTool],
+            ...(settings.model ? { model: settings.model } : {}),
+            ...(settings.sandbox ? { sandbox: settings.sandbox } : {}),
+        };
+    }
+    discardProcess(sessionId, process) {
+        this.exitUnsubscribers.get(sessionId)?.();
+        this.exitUnsubscribers.delete(sessionId);
+        process.close();
+        this.clearPendingRequests(sessionId);
+        this.planMeasurementTokens.delete(sessionId);
+        this.releasePlanStatus(sessionId);
+    }
+    clearPendingRequests(sessionId) {
+        const prefix = `${sessionId}:`;
+        for (const key of this.pendingRequests.keys()) {
+            if (key.startsWith(prefix))
+                this.pendingRequests.delete(key);
+        }
+    }
     async launchForSession(session) {
         const lease = this.planStatusSource
             ? await this.planStatusSource.open({ id: session.id, workspacePath: session.workspacePath }, (update) => this.onPlanStatus?.(session.id, update))

package/dist/server/server/platform/events/websocket-heartbeat.js

@@ -3,12 +3,16 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-export function installWebSocketHeartbeat(socket, intervalMs = 25_000) {
+export function installWebSocketHeartbeat(socket, intervalMs = 25_000, isAuthorized = () => true) {
     let alive = true;
     socket.on('pong', () => {
         alive = true;
     });
     const interval = setInterval(() => {
+        if (!isAuthorized()) {
+            socket.terminate();
+            return;
+        }
         if (!alive) {
             socket.terminate();
             return;

package/dist/server/server/platform/http/authorization-boundary.js

@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+import { parseAuthorizationSessionId } from '../../features/auth/domain/identifiers.js';
+import { problem } from './problem.js';
+const publicApi = new Set([
+    'GET /api/auth/status',
+    'POST /api/auth/login/options',
+    'POST /api/auth/login/verify',
+    'POST /api/auth/logout',
+    'POST /api/auth/register/options',
+    'POST /api/auth/register/verify',
+]);
+export function registerAuthorizationBoundary(app, deps) {
+    app.addHook('onRequest', async (request, reply) => {
+        if (!request.url.startsWith('/api/'))
+            return;
+        if (isUnsafe(request.method) && request.headers.origin !== deps.publicOrigin)
+            return reply
+                .code(403)
+                .type('application/problem+json')
+                .send(problem('ORIGIN_NOT_ALLOWED', 403, 'The request origin is not allowed.'));
+        if (publicApi.has(`${request.method} ${request.routeOptions.url}`))
+            return;
+        if (authorizationSessionDevice(request.headers.cookie, deps) !== null)
+            return;
+        return reply
+            .code(401)
+            .type('application/problem+json')
+            .send(problem('AUTH_REQUIRED', 401, 'Authentication is required.'));
+    });
+}
+/** Shared by HTTP and raw WebSocket upgrades; the opaque cookie is never logged. */
+export function authorizationSessionDevice(cookieHeader, deps) {
+    const token = cookieValue(cookieHeader, 'gestalt_mobile_session');
+    const session = parseAuthorizationSessionId(token);
+    return session === null
+        ? null
+        : deps.repository.sessionDevice(session, deps.clock.now().toISOString());
+}
+function cookieValue(header, name) {
+    if (!header)
+        return undefined;
+    let found;
+    for (const part of header.split(';')) {
+        const [key, ...value] = part.trim().split('=');
+        if (key !== name)
+            continue;
+        const candidate = value.join('=');
+        if (!candidate || found !== undefined)
+            return undefined;
+        found = candidate;
+    }
+    return found;
+}
+function isUnsafe(method) {
+    return method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+}

package/dist/server/server/platform/plans/filesystem-plan-status-source.js

@@ -5,6 +5,7 @@
  */
 import { chmod, mkdir, readFile, readdir, rename, rm, stat, watch, writeFile, realpath, } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
+import { isPlanSignalReason } from '../../../shared/contracts/plan-signal.js';
 import { basename, dirname, join } from 'node:path';
 import { parseSupervisedPlan } from '../../features/plans/application/parse-supervised-plan.js';
 import { isPlanPathWithinWorkspace } from '../../features/plans/application/parse-supervised-plan.js';
@@ -49,13 +50,21 @@ export class FilesystemPlanStatusSource {
     async remove(sessionId, identity) {
         const statusPath = this.activeStatusPaths.get(sessionId);
         const signal = statusPath ? await this.readStatusForRollback(statusPath) : undefined;
-        if (statusPath)
-            await this.statusRemovalFilesystem.rm(statusPath, { force: true });
+        if (statusPath) {
+            try {
+                await this.statusRemovalFilesystem.rm(statusPath, { force: true });
+            }
+            catch (error) {
+                this.leases.get(sessionId)?.allowRepeatedUpdate();
+                throw error;
+            }
+        }
         try {
             if (identity)
                 await this.dismiss(sessionId, identity);
         }
         catch (error) {
+            this.leases.get(sessionId)?.allowRepeatedUpdate();
             if (signal !== undefined && statusPath)
                 await this.restoreStatus(statusPath, signal);
             throw error;
@@ -146,6 +155,7 @@ class ActiveLease {
     debounce;
     closed = false;
     activeStatusPath;
+    lastEmittedUpdate;
     constructor(statusDirectory, sessionId, workspacePath, listener, planReadFilesystem, isDismissed, onActiveStatusPath, onClose) {
         this.statusDirectory = statusDirectory;
         this.sessionId = sessionId;
@@ -163,7 +173,7 @@ class ActiveLease {
             void this.consumeChanges();
         }
         catch {
-            this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+            this.emitUnavailable();
         }
     }
     close() {
@@ -179,6 +189,9 @@ class ActiveLease {
         if (this.activeStatusPath)
             await rm(this.activeStatusPath, { force: true });
     }
+    allowRepeatedUpdate() {
+        this.lastEmittedUpdate = undefined;
+    }
     async consumeChanges() {
         try {
             for await (const event of this.watcher) {
@@ -196,7 +209,7 @@ class ActiveLease {
         }
         catch {
             if (!this.closed)
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
         }
     }
     pendingStatusPath;
@@ -232,7 +245,7 @@ class ActiveLease {
         }
         catch {
             if (!this.closed)
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
         }
     }
     async refresh(statusPath, parsedSignal) {
@@ -259,13 +272,18 @@ class ActiveLease {
                     const previousStatusPath = this.activeStatusPath;
                     this.activeStatusPath = statusPath;
                     this.onActiveStatusPath(statusPath);
-                    this.listener({ kind: 'updated', plan: result.plan, identity, planPath, reason: signal.reason });
+                    const update = { kind: 'updated', plan: result.plan, identity, planPath, reason: signal.reason };
+                    const serializedUpdate = JSON.stringify(update);
+                    if (serializedUpdate !== this.lastEmittedUpdate) {
+                        this.lastEmittedUpdate = serializedUpdate;
+                        this.listener(update);
+                    }
                     if (previousStatusPath && previousStatusPath !== statusPath)
                         await rm(previousStatusPath, { force: true }).catch(() => { });
                 }
             }
             else if (!this.closed) {
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
             }
         }
         catch (error) {
@@ -274,9 +292,13 @@ class ActiveLease {
                 statusPath !== this.activeStatusPath)
                 return;
             if (!this.closed)
-                this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+                this.emitUnavailable();
         }
     }
+    emitUnavailable() {
+        this.lastEmittedUpdate = undefined;
+        this.listener({ kind: 'unavailable', code: 'PLAN_STATUS_UNAVAILABLE' });
+    }
 }
 function parseSignal(source) {
     try {
@@ -298,9 +320,6 @@ function parseSignal(source) {
         return null;
     }
 }
-function isPlanSignalReason(value) {
-    return value === 'authoring-start' || value === 'work-start' || value === 'checkpoint' || value === 'update';
-}
 function isRfc3339Utc(value) {
     return (typeof value === 'string' &&
         /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/.test(value) &&

package/dist/server/shared/contracts/plan-signal.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+/** Every reason published by the bundled org-plan helper. */
+export const planSignalReasons = [
+    'authoring-start',
+    'work-start',
+    'checkpoint',
+    'update',
+    'supervision-start',
+    'resync',
+];
+export function isPlanSignalReason(value) {
+    return typeof value === 'string' && planSignalReasons.includes(value);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gestalt-mobile",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Mobile-first web relay for durable Codex development sessions",
   "keywords": [
     "codex",
@@ -33,7 +33,7 @@
   },
   "scripts": {
     "dev": "node scripts/dev.mjs",
-    "dev:server": "tsx watch src/server/main.ts -- --cwd ..",
+    "dev:server": "tsx watch src/server/main.ts -- --cwd .. --public-origin http://localhost:5173",
     "start": "node dist/server/server/main.js",
     "dev:client": "vite",
     "build": "npm run build:server && npm run build:client",
@@ -45,6 +45,7 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "test": "vitest run",
+    "test:open-profile-smoke": "tsx scripts/open-profile-smoke.ts",
     "test:watch": "vitest",
     "test:package": "node scripts/smoke-packed-cli.mjs",
     "test:e2e": "playwright test",
@@ -54,8 +55,12 @@
     "license:apply": "node scripts/apply-license-headers.mjs"
   },
   "dependencies": {
+    "@fastify/cookie": "11.1.2",
     "@fastify/static": "^10.1.0",
+    "@simplewebauthn/browser": "13.3.0",
+    "@simplewebauthn/server": "13.3.2",
     "fastify": "^5.10.0",
+    "qrcode": "^1.5.4",
     "ws": "^8.21.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
@@ -65,6 +70,7 @@
     "@sveltejs/vite-plugin-svelte": "^7.2.0",
     "@testing-library/svelte": "^5.4.2",
     "@types/node": "^24.13.3",
+    "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",
     "eslint": "^10.7.0",
     "jsdom": "^29.1.1",