myrlin-workbook 0.9.9 → 0.9.11

package/.planning/PROJECT.md

@@ -0,0 +1,124 @@
+# Myrlin Mobile
+
+## What This Is
+
+A React Native (Expo) mobile app that provides full control over Myrlin's Workbook servers from iOS and Android. Connects to self-hosted Myrlin servers via QR code pairing or manual URL entry. Every feature available on the web GUI (100+ features) is accessible on mobile with native platform interactions (share sheet, haptics, push notifications, biometric auth, camera).
+
+## Core Value
+
+A Myrlin user can monitor, control, and interact with all their Claude Code sessions from their phone with the same capability as the desktop web interface, plus native mobile advantages (push notifications, QR pairing, haptics, camera, share sheet).
+
+## Requirements
+
+### Validated
+
+- ✓ Web GUI feature set (100+ features) - existing, serves as the spec
+- ✓ Express REST API (60+ endpoints) - existing backend the mobile app connects to
+- ✓ SSE real-time event system - existing, mobile subscribes to same stream
+- ✓ WebSocket terminal protocol - existing, mobile terminal connects via same WS
+- ✓ Bearer token authentication - existing auth system
+- ✓ 13 theme system (Catppuccin + community) - existing, port to React Native
+- ✓ Cost tracking with JSONL parsing - existing server-side calculation
+
+### Active
+
+- [ ] Full feature parity mobile app (95 mapped features)
+- [ ] Hybrid terminal (WebView xterm.js renderer + native interaction chrome)
+- [ ] QR code server pairing (new server endpoint + mobile camera)
+- [ ] Push notifications (new server push endpoints + Expo notifications)
+- [ ] Multi-server support (connect phone to multiple Myrlin servers)
+- [ ] Biometric app lock (Face ID / fingerprint)
+- [ ] Native share sheet integration
+- [ ] Voice input for terminal (iOS dictation + speech recognition)
+- [ ] Image upload from camera/gallery to terminal sessions
+- [ ] Offline graceful degradation (cached state, reconnection queue)
+- [ ] Maestro visual test suite for every screen
+
+### Out of Scope
+
+- myrlin.io relay service - Phase 2+ paid feature, requires separate backend infrastructure
+- Multi-user team sync - requires coordination server, deferred to paid tier
+- Desktop app (Electron) - mobile only for now
+- Apple Watch companion - unnecessary complexity for v1
+- Widget / Live Activities - nice-to-have for v2, not v1
+- Offline terminal (local Claude) - not possible, terminal requires server connection
+
+## Context
+
+### Existing Codebase (Brownfield)
+
+Myrlin's Workbook v0.9.9 is a mature Node.js application:
+
+- **Backend:** Express server with 60+ REST endpoints, WebSocket PTY management, SSE event streaming
+- **Frontend:** Vanilla JS SPA (16,000+ lines), xterm.js terminals, 4100 lines CSS
+- **State:** JSON persistence in `~/.myrlin/`, atomic writes with backup/recovery
+- **Auth:** Bearer tokens, password-based, one-time startup tokens
+- **Cost:** Worker thread JSONL parsing, per-model pricing
+- **Themes:** 13 themes (4 Catppuccin official + 9 community), CSS custom properties
+
+The mobile app is a NEW client connecting to the EXISTING server. No server rewrite needed, only new endpoints for QR pairing and push notifications.
+
+### Design Document
+
+Full design with all contracts, types, component specs, and screen specifications:
+`docs/plans/2026-03-28-myrlin-mobile-design.md`
+
+### Development Environment
+
+- **Build machine:** Mac Mini (Tailscale: 100.111.181.106)
+- **Xcode:** Required for iOS Simulator and builds
+- **Apple Developer:** Active account (Shuttle project on TestFlight Build 8)
+- **Testing:** Maestro on iOS Simulator, Storybook for components, Expo Go on physical iPhone
+
+### Target Platforms
+
+- **iOS first** (iPhone, iOS 16+)
+- **Android within 2 weeks** of iOS launch (Android 13+)
+- **Cross-platform:** Single React Native codebase via Expo
+
+## Constraints
+
+- **Framework:** React Native (Expo SDK 52+), must use expo-router for navigation
+- **Agent model:** ALL build agents must use Opus with deep thinking, no exceptions
+- **Orchestration:** Two-tier only (orchestrator -> workers), no manager middle layer
+- **Terminal:** Hybrid WebView approach (xterm.js renderer + native chrome), pluggable interface
+- **Modularity:** Every screen, component, and service must be independently swappable
+- **Testing:** Maestro flow tests required for every screen, Storybook stories for every shared component
+- **Font:** Plus Jakarta Sans (sans), JetBrains Mono (mono), matching web app
+- **Theme:** All 13 themes must render identically to web CSS
+- **Monorepo:** Source lives in `mobile/` directory within myrlin-workbook repo
+- **No em dashes:** NEVER use em dashes or double hyphens in any output
+
+## Current Milestone: v1.1 Server Mobile Support
+
+**Goal:** Make the Myrlin server production-ready for mobile clients with persistent auth, device management, enhanced push notifications, optimized sync, and a desktop QR pairing UI.
+
+**Target features:**
+- Persistent device tokens that survive server restarts
+- Device registry with lifecycle management (pair, track, revoke, expire)
+- Enhanced QR pairing with LAN/Tailscale/tunnel URL auto-detection
+- Desktop web UI: "Pair Mobile" modal with QR code and device management
+- Push notification retry, batching, per-device preferences, rich payloads
+- SSE optimization with heartbeat, device filtering, workspace subscriptions
+- Initial sync endpoint for fast mobile bootstrap
+- Session pagination for power users with 100+ sessions
+- Token refresh for long-lived mobile sessions
+- Server info endpoint for capability discovery
+
+**Self-hosting:** All features are 100% local. Only external dependency is Expo Push API (free relay to Apple/Google push servers, identical to how Nextcloud and Home Assistant handle mobile push). No myrlin.io, no cloud database, no external auth.
+
+## Key Decisions
+
+| Decision | Rationale | Outcome |
+|----------|-----------|---------|
+| React Native (Expo) over Flutter | JS/TS ecosystem matches existing codebase, Expo handles build tooling, OTA updates, largest component ecosystem | - Pending |
+| Hybrid terminal (WebView + native) | xterm.js is battle-tested for ANSI rendering; native chrome gives iOS share sheet, haptics, keyboard | - Pending |
+| Monorepo over separate repo | Shared types, single git history, easier API contract sync | - Pending |
+| QR pairing first, relay later | Free tier needs no external service; relay requires myrlin.io infrastructure | - Pending |
+| Zustand + TanStack Query | Zustand for local UI state, TanStack Query for server data with SSE cache sync | - Pending |
+| Maestro for visual QA | YAML-based, runs on iOS Simulator, takes real screenshots, agent-writable | - Pending |
+| Bottom tabs (5) over drawer | iOS convention, familiar navigation, badges for running counts | - Pending |
+| Two-tier orchestration | Manager middle layer degrades context fidelity; direct briefing preserves contracts | - Pending |
+
+---
+*Last updated: 2026-03-29 after milestone v1.1 start*

package/.planning/REQUIREMENTS.md

@@ -0,0 +1,230 @@
+# Requirements: Myrlin Server Mobile Support (v1.1)
+
+**Defined:** 2026-03-29
+**Core Value:** Self-hosted Myrlin server fully supports mobile clients with persistent auth, device management, push notifications, and optimized data sync, with zero external dependencies beyond Expo Push relay.
+
+## v1.1 Requirements
+
+### Token Persistence
+
+- [x] **TOKN-01**: Paired device tokens persist across server restarts (stored in state file)
+- [x] **TOKN-02**: Server reloads all valid device tokens into active set on startup
+- [x] **TOKN-03**: Expired device tokens (> 90 days) are automatically cleaned up on startup
+- [x] **TOKN-04**: Token validation uses timing-safe comparison (existing pattern)
+- [x] **TOKN-05**: Token refresh endpoint allows mobile to get new token before expiration
+- [x] **TOKN-06**: Refreshed tokens immediately replace old tokens in active set and state
+
+### Device Registry
+
+- [x] **DEVC-01**: Server stores paired device metadata (deviceId, name, platform, appVersion, pairedAt, lastSeenAt, expiresAt)
+- [x] **DEVC-02**: Device lastSeenAt updates on each authenticated API request (debounced)
+- [x] **DEVC-03**: GET /api/devices returns list of all paired devices with online status
+- [x] **DEVC-04**: DELETE /api/devices/:deviceId revokes device token and closes active connections
+- [x] **DEVC-05**: PUT /api/devices/:deviceId updates device name and push preferences
+- [x] **DEVC-06**: POST /api/devices/:deviceId/test-push sends test notification to device
+
+### Pairing Enhancement
+
+- [x] **PAIR-01**: POST /api/auth/pair returns deviceId and server capabilities in response
+- [x] **PAIR-02**: Pair endpoint stores device metadata (name, platform, appVersion) in pairedDevices
+- [x] **PAIR-03**: GET /api/auth/pairing-code detects LAN IP from network interfaces
+- [x] **PAIR-04**: GET /api/auth/pairing-code detects Tailscale IP (100.x.x.x) if present
+- [x] **PAIR-05**: GET /api/auth/pairing-code uses configured tunnel URL if available
+- [x] **PAIR-06**: QR payload includes all available URLs so mobile can try each
+- [x] **PAIR-07**: Server info endpoint (GET /api/server-info) returns capabilities, URLs, and stats without auth
+
+### CORS and Network
+
+- [x] **CORS-01**: CORS allows requests from any origin when a valid Bearer token is present
+- [x] **CORS-02**: CORS preflight (OPTIONS) responds correctly for mobile clients
+- [x] **CORS-03**: Content-Security-Policy updated to allow mobile WebSocket connections from any host
+
+### Push Notifications
+
+- [x] **PUSH-01**: Push dispatch retries failed sends with exponential backoff (max 3 attempts)
+- [x] **PUSH-02**: Push events are batched in a 2-second window (5 events in 1s = 1 summary push)
+- [x] **PUSH-03**: Per-device push preferences (sessionComplete, needsInput, conflicts, taskReview) stored in device record
+- [x] **PUSH-04**: Push dispatch checks device preferences before sending
+- [x] **PUSH-05**: Push payloads include deep link route data for mobile navigation
+- [x] **PUSH-06**: Push includes badge count (running sessions) for iOS
+- [x] **PUSH-07**: Stale push tokens (DeviceNotRegistered) are automatically cleaned from device registry
+- [x] **PUSH-08**: GET /api/push/preferences returns device's notification preferences
+- [x] **PUSH-09**: PUT /api/push/preferences updates device's notification preferences
+- [x] **PUSH-10**: Push dispatched for: session complete, needs input, file conflicts, task ready for review
+
+### SSE Enhancement
+
+- [x] **SSE-01**: SSE sends heartbeat comment (`: heartbeat`) every 30 seconds
+- [x] **SSE-02**: SSE client registry tracks device metadata (deviceId, subscriptions)
+- [x] **SSE-03**: SSE supports deviceId query param for device-specific filtering
+- [x] **SSE-04**: SSE filters workspace-scoped events by device's workspace subscriptions
+- [x] **SSE-05**: Global events (settings, server status) always sent regardless of subscriptions
+- [x] **SSE-06**: Dead SSE connections cleaned up within 60 seconds
+
+### Workspace Subscriptions
+
+- [x] **WSUB-01**: POST /api/devices/:deviceId/subscriptions sets workspace subscription list
+- [x] **WSUB-02**: GET /api/devices/:deviceId/subscriptions returns current subscriptions
+- [x] **WSUB-03**: Subscriptions stored in device record in pairedDevices
+- [x] **WSUB-04**: Empty subscription list means "receive all events" (default)
+
+### Initial Sync
+
+- [x] **SYNC-01**: GET /api/mobile/sync returns all bootstrap data in single response
+- [x] **SYNC-02**: Sync response includes workspaces, sessions (sparse), groups, templates, settings, stats, device info
+- [x] **SYNC-03**: Sessions in sync response use sparse fields (id, name, status, workspaceId, topic, tags, lastActive, pid)
+- [x] **SYNC-04**: Sync response includes syncVersion number for future delta sync
+
+### Session Pagination
+
+- [x] **PAGE-01**: GET /api/sessions supports limit and offset query parameters
+- [x] **PAGE-02**: GET /api/sessions supports status filter (running, stopped, error, idle, all)
+- [x] **PAGE-03**: GET /api/sessions supports sort (lastActive, name, created) and order (asc, desc)
+- [x] **PAGE-04**: GET /api/sessions supports search query param (substring match on name/topic)
+- [x] **PAGE-05**: GET /api/sessions supports workspaceId filter
+- [x] **PAGE-06**: Paginated response includes total count, hasMore flag
+- [x] **PAGE-07**: Default limit is 50, max 100, for backward compatibility unpaginated requests still work
+
+### Desktop Web UI
+
+- [x] **DWUI-01**: "Pair Mobile" button visible in header bar
+- [x] **DWUI-02**: Pair Mobile modal shows QR code generated from /api/auth/pairing-code
+- [x] **DWUI-03**: QR code auto-refreshes every 4 minutes (tokens expire at 5)
+- [x] **DWUI-04**: Modal shows all detected connection URLs (LAN, Tailscale, tunnel)
+- [x] **DWUI-05**: Modal shows paired devices list with name, platform, last seen, push status
+- [x] **DWUI-06**: Each paired device has a "Revoke" button with confirmation
+- [x] **DWUI-07**: Each paired device has a "Test Push" button
+- [x] **DWUI-08**: QR code rendered as SVG using qrcode library
+
+### Scrollback and Logs
+
+- [x] **SCRL-01**: GET /api/sessions/:id/scrollback returns paginated terminal scrollback
+- [x] **SCRL-02**: Scrollback supports lines and from parameters (from=end for last N lines)
+- [x] **SCRL-03**: GET /api/sessions/:id/logs supports limit and offset pagination
+
+### Error Standards
+
+- [ ] **ERRR-01**: Mobile-facing endpoints return structured errors with machine-readable code
+- [ ] **ERRR-02**: Rate limit responses include Retry-After header
+- [ ] **ERRR-03**: All responses include X-API-Version header (value: 1)
+
+### Testing
+
+- [x] **MTST-01**: Integration tests for token persistence across simulated restart
+- [x] **MTST-02**: Integration tests for device CRUD (pair, list, update, revoke)
+- [x] **MTST-03**: Integration tests for push retry, batching, and preference filtering
+- [x] **MTST-04**: Integration tests for SSE heartbeat and workspace filtering
+- [x] **MTST-05**: Integration tests for session pagination with various filters
+- [x] **MTST-06**: Integration tests for initial sync endpoint response shape
+
+## Future Requirements (v1.2+)
+
+### Delta Sync
+- **DSYN-01**: GET /api/mobile/delta returns only changes since a given timestamp
+- **DSYN-02**: Server maintains circular buffer of last 1000 state changes
+
+### Offline Bundle
+- **OFFL-01**: GET /api/mobile/offline-bundle returns compressed state snapshot
+- **OFFL-02**: POST /api/mobile/offline-sync uploads queued mutations for merge
+
+### Connection Quality
+- **CQAL-01**: POST /api/devices/:deviceId/connection-quality reports network conditions
+- **CQAL-02**: Server adjusts SSE event frequency based on reported quality
+
+## Out of Scope
+
+| Feature | Reason |
+|---------|--------|
+| myrlin.io relay service | Separate infrastructure, paid tier scope |
+| Multi-user auth (per-user tokens) | v2 feature, requires identity system |
+| End-to-end encryption | Adds complexity, LAN/Tailscale already encrypted in transit |
+| Custom push notification sounds | Low value, use system defaults |
+| Advanced per-device rate limiting | Basic IP rate limiting sufficient for v1.1 |
+| Certificate pinning | Overkill for self-hosted LAN/Tailscale use case |
+
+## Traceability
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| TOKN-01 | Phase 8 | Complete |
+| TOKN-02 | Phase 8 | Complete |
+| TOKN-03 | Phase 8 | Complete |
+| TOKN-04 | Phase 8 | Complete |
+| TOKN-05 | Phase 12 | Complete |
+| TOKN-06 | Phase 12 | Complete |
+| DEVC-01 | Phase 8 | Complete |
+| DEVC-02 | Phase 8 | Complete |
+| DEVC-03 | Phase 8 | Complete |
+| DEVC-04 | Phase 8 | Complete |
+| DEVC-05 | Phase 8 | Complete |
+| DEVC-06 | Phase 8 | Complete |
+| PAIR-01 | Phase 9 | Complete |
+| PAIR-02 | Phase 9 | Complete |
+| PAIR-03 | Phase 9 | Complete |
+| PAIR-04 | Phase 9 | Complete |
+| PAIR-05 | Phase 9 | Complete |
+| PAIR-06 | Phase 9 | Complete |
+| PAIR-07 | Phase 9 | Complete |
+| CORS-01 | Phase 8 | Complete |
+| CORS-02 | Phase 8 | Complete |
+| CORS-03 | Phase 8 | Complete |
+| PUSH-01 | Phase 10 | Complete |
+| PUSH-02 | Phase 10 | Complete |
+| PUSH-03 | Phase 10 | Complete |
+| PUSH-04 | Phase 10 | Complete |
+| PUSH-05 | Phase 10 | Complete |
+| PUSH-06 | Phase 10 | Complete |
+| PUSH-07 | Phase 10 | Complete |
+| PUSH-08 | Phase 10 | Complete |
+| PUSH-09 | Phase 10 | Complete |
+| PUSH-10 | Phase 10 | Complete |
+| SSE-01 | Phase 11 | Complete |
+| SSE-02 | Phase 11 | Complete |
+| SSE-03 | Phase 11 | Complete |
+| SSE-04 | Phase 11 | Complete |
+| SSE-05 | Phase 11 | Complete |
+| SSE-06 | Phase 11 | Complete |
+| WSUB-01 | Phase 11 | Complete |
+| WSUB-02 | Phase 11 | Complete |
+| WSUB-03 | Phase 11 | Complete |
+| WSUB-04 | Phase 11 | Complete |
+| SYNC-01 | Phase 11 | Complete |
+| SYNC-02 | Phase 11 | Complete |
+| SYNC-03 | Phase 11 | Complete |
+| SYNC-04 | Phase 11 | Complete |
+| PAGE-01 | Phase 12 | Complete |
+| PAGE-02 | Phase 12 | Complete |
+| PAGE-03 | Phase 12 | Complete |
+| PAGE-04 | Phase 12 | Complete |
+| PAGE-05 | Phase 12 | Complete |
+| PAGE-06 | Phase 12 | Complete |
+| PAGE-07 | Phase 12 | Complete |
+| DWUI-01 | Phase 9 | Complete |
+| DWUI-02 | Phase 9 | Complete |
+| DWUI-03 | Phase 9 | Complete |
+| DWUI-04 | Phase 9 | Complete |
+| DWUI-05 | Phase 9 | Complete |
+| DWUI-06 | Phase 9 | Complete |
+| DWUI-07 | Phase 9 | Complete |
+| DWUI-08 | Phase 9 | Complete |
+| SCRL-01 | Phase 12 | Complete |
+| SCRL-02 | Phase 12 | Complete |
+| SCRL-03 | Phase 12 | Complete |
+| ERRR-01 | Phase 13 | Pending |
+| ERRR-02 | Phase 13 | Pending |
+| ERRR-03 | Phase 13 | Pending |
+| MTST-01 | Phase 8 | Complete |
+| MTST-02 | Phase 8 | Complete |
+| MTST-03 | Phase 10 | Complete |
+| MTST-04 | Phase 11 | Complete |
+| MTST-05 | Phase 12 | Complete |
+| MTST-06 | Phase 11 | Complete |
+
+**Coverage:**
+- v1.1 requirements: 73 total (13 categories)
+- Mapped to phases: 73/73
+- Unmapped: 0
+
+---
+*Requirements defined: 2026-03-29*
+*Last updated: 2026-03-29 after roadmap creation (traceability populated)*

package/.planning/STATE.md

@@ -0,0 +1,116 @@
+---
+gsd_state_version: 1.0
+milestone: v1.0
+milestone_name: Mobile App
+status: completed
+stopped_at: Completed 13-01-PLAN.md - v1.1 milestone complete
+last_updated: "2026-03-29T08:59:32.532Z"
+last_activity: 2026-03-29 - Completed Plan 13-01 (structured errors, Retry-After, X-API-Version)
+progress:
+  total_phases: 13
+  completed_phases: 13
+  total_plans: 38
+  completed_plans: 38
+  percent: 100
+---
+
+# Project State
+
+## Project Reference
+
+See: .planning/PROJECT.md (updated 2026-03-29)
+
+**Core value:** Self-hosted Myrlin server fully supports mobile clients with persistent auth, device management, push notifications, and optimized data sync.
+**Current focus:** All phases complete. v1.1 Server Mobile Support done.
+
+## Current Position
+
+Phase: 13 of 13 (Error Standards and Hardening)
+Plan: 1 of 1 in current phase (COMPLETE)
+Status: Milestone Complete
+Last activity: 2026-03-29 - Completed Plan 13-01 (structured errors, Retry-After, X-API-Version)
+
+Progress: [██████████] 100% (38/38 plans)
+
+## Performance Metrics
+
+**Velocity (from v1.0):**
+- Total plans completed: 23
+- Average duration: 4.7m
+- Total execution time: ~1.8 hours
+
+**v1.1 metrics:**
+
+| Phase | Plan | Duration | Tasks | Files |
+|-------|------|----------|-------|-------|
+| 08    | 01   | 3min     | 2     | 4     |
+| Phase 08 P02 | 2min | 2 tasks | 2 files |
+| Phase 08 P03 | 4min | 2 tasks | 2 files |
+| 11    | 01   | 3min     | 1     | 1     |
+| Phase 09 P01 | 2min | 2 tasks | 2 files |
+| Phase 10 P01 | 2min | 2 tasks | 1 files |
+| 12    | 01   | 3min     | 2     | 2     |
+| Phase 10 P02 | 3min | 2 tasks | 1 files |
+| Phase 12 P02 | 3min | 2 tasks | 4 files |
+| Phase 11 P02 | 2min | 2 tasks | 2 files |
+| Phase 09 P02 | 4min | 3 tasks | 5 files |
+| 11    | 03   | 5min     | 2     | 2     |
+| Phase 10 P03 | 3min | 1 tasks | 1 files |
+| Phase 12 P03 | 2min | 1 tasks | 1 files |
+| 13    | 01   | 3min     | 1     | 2     |
+
+## Accumulated Context
+
+### Decisions
+
+- v1.1 Roadmap: 6 phases (8-13), standard granularity, derived from design doc phases A-F
+- v1.1 Roadmap: Phase 8 is critical path; Phases 9, 10, 11, 12 can run in parallel after Phase 8
+- v1.1 Roadmap: Testing requirements distributed across phases (each phase tests its own work)
+- v1.1 Roadmap: Token refresh (TOKN-05/06) placed in Phase 12 (API Enhancement) not Phase 8 (avoids scope creep on critical path)
+- v1.1 Roadmap: ERRR requirements isolated in Phase 13 (applies uniformly to all endpoints after they exist)
+
+- 08-01: Device tokens stored plaintext (matches pushDevices pattern; hashing deferred to Phase 12)
+- 08-01: CORS preflight allows Authorization from any origin (OPTIONS cannot carry Bearer)
+- 08-01: lastSeenAt debounced at 60s per device
+- [Phase 08]: SSE clients migrated from Set to Map for device online detection
+- [Phase 08]: Test push sends to single device via Expo API, not broadcast
+- [Phase 08]: Module-level reload pattern for testing restart survival (faster than full server restart)
+
+- 11-01: SSE heartbeat uses comment syntax (`: heartbeat`) not data events, avoids triggering onmessage
+- 11-01: All SSE timers call .unref() so Node process exits cleanly
+- 11-01: GLOBAL_EVENT_TYPES kept module-scoped (not exported), Plan 11-02 uses it in same file
+- [Phase 09]: Tailscale detection uses 100.x.x.x prefix match; primary URL order: custom > tunnel > lan > local
+- [Phase 10]: 10-01: Per-device retry (not batch POST) so one stale token does not block others
+- [Phase 10]: 10-01: Module-level Map + setTimeout for 2-second push batching window
+- 12-01: Dual-mode endpoint detection (mode param = legacy, pagination params = new response shape)
+- 12-01: Default no-params returns legacy { sessions } for backward compat with existing GUI
+- [Phase 10]: shouldNotify defaults to true for unknown event types and missing preferences (fail-open)
+- [Phase 12]: Scrollback joins buffer chunks then splits by newline for accurate line counting
+- [Phase 12]: Token refresh only for device tokens (403 for browser tokens) as security boundary
+- [Phase 11]: Empty or null subscriptions = receive all events (backward compat with desktop)
+- [Phase 11]: workspace:created added to GLOBAL_EVENT_TYPES so new workspaces reach all clients
+- [Phase 11]: SSE client subscriptions updated in-place on POST, no reconnection needed
+- [Phase 09]: Client-side QR generation via esbuild-bundled qrcode browser build to vendor/
+- [Phase 09]: QR SVG uses theme --text color with transparent bg for all theme compat
+- [Phase 11]: Sparse session fields: id, name, workspaceId, status, topic, tags, lastActive, pid, resumeSessionId
+- [Phase 11]: syncVersion=1 for future delta sync; totalCost=0 in sync to avoid expensive JSONL parsing
+- [Phase 11]: SSE integration tests spawn real server on port 3463 (matching pairing test pattern)
+- [Phase 10]: setTimeout mocked to fire immediately for retry tests; batching tests flush manually with 50ms settle
+- [Phase 12]: Direct store method testing for pagination (no HTTP server) for speed and isolation
+- [Phase 13]: Error codes use uppercase snake_case (RATE_LIMITED, UNAUTHORIZED, INVALID_PASSWORD)
+- [Phase 13]: isRateLimited() returns { limited, retryAfter } object for Retry-After header calculation
+- [Phase 13]: structuredError helper exported from server.js for reuse by other route modules
+
+### Pending Todos
+
+None yet.
+
+### Blockers/Concerns
+
+- Phase 2 and Phase 7 from v1.0 show as in-progress in prior state (may need completion before v1.1 starts)
+
+## Session Continuity
+
+Last session: 2026-03-29T08:58:30Z
+Stopped at: Completed 13-01-PLAN.md - v1.1 milestone complete
+Resume file: None

package/.planning/config.json

@@ -0,0 +1,17 @@
+{
+  "mode": "yolo",
+  "granularity": "standard",
+  "parallelization": true,
+  "commit_docs": true,
+  "model_profile": "quality",
+  "workflow": {
+    "research": true,
+    "plan_check": true,
+    "verifier": true,
+    "nyquist_validation": true,
+    "auto_advance": true,
+    "_auto_verify": true,
+    "_qa_agent": true,
+    "_opus_override": "ALL agents must use model: opus. Non-negotiable per project rules."
+  }
+}