relmio 0.6.0 → 0.7.0

package/docs/local-endpoints.md

@@ -20,6 +20,16 @@ This is a documentation-backed engineering boundary, not legal advice or a
 guarantee that a particular account or use case is permitted. Review the
 agreements and policies that apply to your account.
 
+## ChatGPT/Codex sign-in lifetime
+
+ChatGPT/Codex sign-in tokens expire, but the official Codex client refreshes
+them automatically during active use before they expire, so active sessions
+usually continue without another browser login. The official [OpenAI
+authentication documentation](https://learn.chatgpt.com/docs/auth) does not
+publish a fixed 10-day lifetime; do not plan around one. This provider
+credential is separate from Relmio's local capability, which remains valid
+until you rotate it.
+
 ## Requirements
 
 - macOS, Linux, or Linux under WSL2. Native Windows is not supported because
@@ -40,7 +50,8 @@ project on the local computer.
 ## Install with the browser wizard
 
 1. Start Relmio on the computer that will run the endpoint. Use one of the
-   commands in the [README](../README.md#quick-install), or run:
+   commands on the [hosted install page](https://relmio.vercel.app/install),
+   or run:
 
    ```bash
    npx --yes --ignore-scripts relmio@latest
@@ -129,8 +140,9 @@ For a quick private test:
 
 ```bash
 export RELMIO_LOCAL_KEY="<capability shown once by the wizard>"
-curl http://127.0.0.1:12435/v1/models \
-  -H "Authorization: Bearer $RELMIO_LOCAL_KEY"
+printf 'Authorization: Bearer %s\n' "$RELMIO_LOCAL_KEY" |
+  curl http://127.0.0.1:12435/v1/models --header @-
+unset RELMIO_LOCAL_KEY
 ```
 
 The upstream key is passed only over stdin to a transient, network-disabled
@@ -179,12 +191,15 @@ official verification URL, enter the device code, and complete authentication.
 Relmio starts the login through the official Codex App Server account method;
 it never returns the resulting ChatGPT access or refresh tokens.
 
-A compatible Codex CLI can connect like this:
+A compatible Codex CLI can connect like this. Read the capability without
+putting it in the command line:
 
 ```bash
-export CODEX_REMOTE_TOKEN="<capability shown once by the wizard>"
+read -r -s CODEX_REMOTE_TOKEN
+printf '\n'
 codex --remote ws://127.0.0.1:14500 \
   --remote-auth-token-env CODEX_REMOTE_TOKEN
+unset CODEX_REMOTE_TOKEN
 ```
 
 This is not an OpenAI `/v1` endpoint. A client must implement the official
@@ -221,14 +236,19 @@ Protocol: Relmio Codex Chat HTTP
 ```
 
 After completing the same official Codex device-code sign-in, a local backend
-can start a conversation with:
+can start a conversation with. Read the bearer rather than placing it in a
+shell command:
 
 ```bash
-export RELMIO_CODEX_CHAT_KEY="<capability shown once by the wizard>"
-curl http://127.0.0.1:14501/chat \
-  -H "Authorization: Bearer $RELMIO_CODEX_CHAT_KEY" \
-  -H "Content-Type: application/json" \
-  --data '{"input":"Reply with a short hello."}'
+read -r -s RELMIO_CODEX_CHAT_KEY
+printf '\n'
+printf 'Authorization: Bearer %s\n' "$RELMIO_CODEX_CHAT_KEY" |
+  curl --fail-with-body --silent --show-error \
+    --request POST http://127.0.0.1:14501/chat \
+    --header @- \
+    --header "Content-Type: application/json" \
+    --data '{"input":"Reply with a short hello."}'
+unset RELMIO_CODEX_CHAT_KEY
 ```
 
 The response contains only the App Server thread ID and final conversational
@@ -262,6 +282,27 @@ LAN, multi-user, or production service. It enforces bounded request bodies,
 output, concurrency, process lifetime, and sanitized failures, but those
 controls do not create a general-purpose API entitlement.
 
+### In-wizard Chat Adapter tester
+
+The Ready screen for an installed Chat Adapter includes a narrow local tester.
+It is intended for a literal `http://127.0.0.1:PORT` adapter address only. The
+browser never calls the adapter: it calls the local wizard's existing
+same-origin, `X-Setup-Token` protected APIs, and the wizard makes the
+server-side `POST /chat` request without an `Origin` header.
+
+When the user secures the displayed client credential, the browser clears the
+input and encrypts it with the tester's short-lived RSA-OAEP SHA-256 public
+key. The private key exists only in local server memory, expires after a few
+minutes, has a bounded session count, and can be invalidated with **Forget
+tester**. The browser retains only ciphertext and key ID for the test session;
+it keeps prompts and transcript only in current-page memory and DOM.
+
+This reduces accidental credential transit and storage exposure. It is not
+encryption at rest or end-to-end encryption, and it cannot protect against a
+compromised browser, extension, or local machine. The tester rejects redirects,
+non-loopback URLs, malformed or oversized data, concurrent key use, and
+adapter failures with redacted messages.
+
 ## Network and container boundary
 
 Every local Compose project publishes exactly one host mapping:

package/docs/reference.md

@@ -0,0 +1,77 @@
+# Reference
+
+## Chat Adapter test commands
+
+The experimental Chat Adapter is a loopback-only, Relmio-specific `POST /chat`
+service for trusted local backends or development servers. It is not OpenAI
+`/v1` and it rejects browser `Origin` headers.
+
+Set the endpoint, then read the one-time credential without typing the literal
+credential into shell history:
+
+```bash
+export RELMIO_CHAT_BASE_URL="http://127.0.0.1:14501"
+read -r -s RELMIO_CHAT_CLIENT_CREDENTIAL
+printf '\n'
+```
+
+Start a conversation:
+
+```bash
+printf 'Authorization: Bearer %s\n' "$RELMIO_CHAT_CLIENT_CREDENTIAL" |
+  curl --fail-with-body --silent --show-error \
+    --request POST "$RELMIO_CHAT_BASE_URL/chat" \
+    --header @- \
+    --header "Content-Type: application/json" \
+    --data '{"input":"Reply with exactly: adapter works"}'
+```
+
+Copy the returned `conversationId`, then send a continuation:
+
+```bash
+export RELMIO_CONVERSATION_ID="CONVERSATION_ID_FROM_THE_PREVIOUS_RESPONSE"
+printf 'Authorization: Bearer %s\n' "$RELMIO_CHAT_CLIENT_CREDENTIAL" |
+  curl --fail-with-body --silent --show-error \
+    --request POST "$RELMIO_CHAT_BASE_URL/chat" \
+    --header @- \
+    --header "Content-Type: application/json" \
+    --data "{\"input\":\"Continue with one short sentence.\",\"conversationId\":\"$RELMIO_CONVERSATION_ID\"}"
+```
+
+Unset the shell credential when finished:
+
+```bash
+unset RELMIO_CHAT_CLIENT_CREDENTIAL
+```
+
+## Raw Codex App Server command
+
+The raw Codex App Server transport is JSON-RPC over WebSocket, experimental,
+and high-trust. It is for trusted native clients only; it is not an
+OpenAI-compatible `/v1` endpoint. Read the one-time local capability into a
+named environment variable rather than placing it in the command:
+
+```bash
+read -r -s RELMIO_CODEX_CLIENT_CREDENTIAL
+printf '\n'
+codex --remote ws://127.0.0.1:14500 \
+  --remote-auth-token-env RELMIO_CODEX_CLIENT_CREDENTIAL
+unset RELMIO_CODEX_CLIENT_CREDENTIAL
+```
+
+Keep that capability private. A trusted Codex client can control the isolated
+container and may be able to recover its ChatGPT session credential.
+
+## Local wizard tester API
+
+The browser never contacts the adapter directly. While the local wizard is
+running, its same-origin, `X-Setup-Token` protected APIs are:
+
+| Method | Route | Purpose |
+| --- | --- | --- |
+| `POST` | `/api/local/chat-test/key` | Issue one ephemeral RSA-OAEP public key |
+| `POST` | `/api/local/chat-test/message` | Send encrypted credential and one bounded chat turn |
+| `POST` | `/api/local/chat-test/reset` | Invalidate the tester key and clear the browser transcript |
+
+The local proxy accepts only a literal `http://127.0.0.1:PORT` adapter base
+URL and appends `/chat` itself.

package/docs/security.md

@@ -6,6 +6,16 @@ key, a Codex/ChatGPT session, and generated local capabilities. Treat every one
 of these values as password-equivalent. Read this page before offering the
 wizard to another person.
 
+## ChatGPT/Codex sign-in lifetime
+
+ChatGPT/Codex sign-in tokens expire, but the official Codex client refreshes
+them automatically during active use before they expire, so active sessions
+usually continue without another browser login. The official [OpenAI
+authentication documentation](https://learn.chatgpt.com/docs/auth) does not
+publish a fixed 10-day lifetime; do not plan around one. This provider
+credential is separate from Relmio's local capability, which remains valid
+until you rotate it.
+
 ## Trust model
 
 The design assumes:
@@ -112,6 +122,30 @@ shared, or production service.
   resource limits; and uses root plus only `CHOWN` long enough to atomically
   make the stdin-seeded volume entry readable by the non-root gateway.
 
+### In-wizard Chat Adapter tester
+
+The Ready screen's Chat Adapter tester is a deliberately narrow convenience
+path, not a browser CORS exception. Its browser calls stay same-origin to the
+setup-token-protected wizard. Only the local wizard server calls the adapter,
+using a server-side `POST /chat` request without an `Origin` header.
+
+The tester accepts only a literal `http://127.0.0.1:PORT` base URL and appends
+`/chat` itself. It refuses `localhost`, IPv6, LAN/private/public addresses,
+credentials, query strings, fragments, redirects, malformed JSON, oversized
+payloads, excessive IDs/ciphertext, concurrent key use, and preview mode. The
+server bounds timeout and response size, validates the upstream shape, and
+returns only a conversation ID plus output with generic redacted errors.
+
+Before a test, the browser obtains an ephemeral RSA-OAEP SHA-256 public key
+from the local wizard, clears the credential input, and retains only ciphertext
+and key ID in page memory. The matching private key remains only in the local
+server's in-memory, time-limited, bounded session map and can be invalidated
+explicitly. Prompts and transcript are not persisted server-side.
+
+This is not encryption at rest or end-to-end encryption. It reduces accidental
+credential transit and storage exposure, but cannot protect a compromised
+browser, extension, or local machine.
+
 ## What “private” means here
 
 Port `10531` is not reachable from the public internet or VPS host through a

package/docs/troubleshooting.md

@@ -9,6 +9,39 @@ wizard or any manual VPS command. The documented commands are sidecar-only and
 do not delete, restart, or rebuild n8n, but they still access your VPS and write
 files there.
 
+## Docker is not running
+
+Start Docker Desktop or Docker Engine and wait until `docker info` and
+`docker compose version` both succeed. Close any stale Relmio wizard tab, start
+one fresh wizard session, and review the local plan again. Do not restart or
+rebuild unrelated containers while checking the local endpoint.
+
+## Authentication fails
+
+Close stale wizard and device-code tabs, keep the newest Relmio terminal open,
+and use only the complete wizard URL printed by that active process. Start one
+fresh ChatGPT device-code attempt and complete the newest code. A ChatGPT
+subscription credential is valid only for the Codex targets; the generic
+OpenAI-compatible `/v1` target requires a separately billed Platform API key.
+ChatGPT/Codex sign-in tokens expire, but the official Codex client refreshes
+them automatically during active use before they expire, so active sessions
+usually continue without another browser login. The official [OpenAI
+authentication documentation](https://learn.chatgpt.com/docs/auth) does not
+publish a fixed 10-day lifetime; do not plan around one. This provider
+credential is separate from Relmio's local capability, which remains valid
+until you rotate it. If Relmio reports the credential is invalid or refresh no
+longer succeeds, select **Start ChatGPT sign-in** again in the active local
+wizard. The VPS sidecar flow labels that action **Refresh ChatGPT sign-in**.
+
+## Local image build failed
+
+The local wizard intentionally does not show Docker build output, filesystem
+paths, or stderr in the browser. Confirm Docker Desktop or Docker Engine is
+running, check that the local disk has room for the image, and confirm your
+network can reach the image registry. Then close the old wizard, start one new
+wizard session, review a fresh plan, and retry. Do not delete an existing
+managed endpoint or rebuild unrelated containers as a workaround.
+
 ## Hosted chat browser extension
 
 The hosted demo at [relmio.vercel.app](https://relmio.vercel.app/) needs the

package/docs/vps-and-n8n.md

@@ -0,0 +1,30 @@
+# VPS and n8n
+
+Relmio installs a separate sidecar project at
+`/docker/n8n-openai-oauth`. It does not edit, rebuild, recreate, stop, or
+restart your existing n8n Compose project or image. The sidecar has no host
+port: n8n reaches it over the shared Docker network at
+`http://n8n-openai-oauth:10531/v1`.
+
+## Wizard route
+
+1. Run the local wizard and complete the fresh ChatGPT sign-in on your own
+   computer.
+2. Enter your VPS address and compare the presented SSH host fingerprint with
+   your provider before authorizing password authentication.
+3. Select an already-running n8n container and one of its existing shared
+   networks.
+4. Review the exact plan. Remote writes begin only after final confirmation.
+5. In n8n, use the private sidecar hostname rather than `127.0.0.1`.
+
+The n8n credential's required API-key field uses `local-only` only as a UI
+placeholder; it is not an OpenAI Platform API key.
+
+## Follow-on guides
+
+- [Configure n8n nodes](./n8n-configuration.md) has copy-ready AI Agent and
+  HTTP Request recipes.
+- [Beginner manual installation](./manual-install.md) is the auditable fallback
+  when the wizard cannot be used.
+- [Troubleshooting](./troubleshooting.md) includes connection, Docker-network,
+  and browser sign-in recovery steps.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relmio",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Install private local OpenAI API and Codex endpoints with explicit provider credential boundaries, plus the existing isolated n8n sidecar.",
   "keywords": [
     "relmio",

package/src/services/local-chat-test.js

@@ -0,0 +1,361 @@
+import {
+  constants,
+  generateKeyPair as generateKeyPairCallback,
+  privateDecrypt,
+  randomUUID,
+} from "node:crypto";
+import { promisify } from "node:util";
+
+const generateKeyPair = promisify(generateKeyPairCallback);
+
+const MAX_SESSIONS = 8;
+const KEY_TTL_MS = 5 * 60 * 1_000;
+const REQUEST_TIMEOUT_MS = 120_000;
+const MAX_ENDPOINT_LENGTH = 64;
+const MAX_CIPHERTEXT_LENGTH = 4_096;
+const MAX_INPUT_LENGTH = 8_192;
+const MAX_CONVERSATION_ID_LENGTH = 160;
+const MAX_RESPONSE_BYTES = 16 * 1_024;
+const MAX_OUTPUT_LENGTH = 12 * 1_024;
+
+function requestError(message, statusCode = 400) {
+  return Object.assign(new Error(message), { statusCode });
+}
+
+function expiredKeyError() {
+  return requestError(
+    "This test credential has expired or was forgotten. Secure it again.",
+    409,
+  );
+}
+
+function adapterError(statusCode = 502) {
+  return requestError("The local adapter test could not be completed.", statusCode);
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function isBoundedText(value, maximumLength) {
+  return (
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= maximumLength &&
+    !/[\u0000-\u001f\u007f]/u.test(value)
+  );
+}
+
+export function parseLocalAdapterBaseUrl(value) {
+  if (typeof value !== "string" || value.length > MAX_ENDPOINT_LENGTH) {
+    throw requestError("Enter a valid local adapter address.");
+  }
+
+  const match = /^http:\/\/127\.0\.0\.1:([1-9]\d{0,4})\/?$/u.exec(value);
+  if (!match) {
+    throw requestError("Enter a valid local adapter address.");
+  }
+
+  const port = Number(match[1]);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {
+    throw requestError("Enter a valid local adapter address.");
+  }
+
+  return `http://127.0.0.1:${port}`;
+}
+
+function validateMessageRequest(request) {
+  if (!isPlainObject(request)) {
+    throw requestError("Enter a valid local adapter test request.");
+  }
+  const endpointBaseUrl = parseLocalAdapterBaseUrl(request.endpointBaseUrl);
+  if (!isBoundedText(request.keyId, 128)) {
+    throw expiredKeyError();
+  }
+  if (
+    typeof request.encryptedCredential !== "string" ||
+    request.encryptedCredential.length < 32 ||
+    request.encryptedCredential.length > MAX_CIPHERTEXT_LENGTH ||
+    !/^[A-Za-z0-9+/]+={0,2}$/u.test(request.encryptedCredential)
+  ) {
+    throw requestError("Secure the client credential again before testing.");
+  }
+  if (!isBoundedText(request.input, MAX_INPUT_LENGTH)) {
+    throw requestError("Enter a shorter chat message.");
+  }
+  if (
+    request.conversationId !== undefined &&
+    !isBoundedText(request.conversationId, MAX_CONVERSATION_ID_LENGTH)
+  ) {
+    throw requestError("Start a new conversation and try again.");
+  }
+
+  return {
+    endpointBaseUrl,
+    keyId: request.keyId,
+    encryptedCredential: request.encryptedCredential,
+    input: request.input,
+    ...(request.conversationId !== undefined
+      ? { conversationId: request.conversationId }
+      : {}),
+  };
+}
+
+function decodeCiphertext(value) {
+  const decoded = Buffer.from(value, "base64");
+  if (
+    decoded.length === 0 ||
+    decoded.toString("base64") !== value
+  ) {
+    decoded.fill(0);
+    throw requestError("Secure the client credential again before testing.");
+  }
+  return decoded;
+}
+
+async function readBoundedResponse(response) {
+  const contentLength = response.headers?.get?.("content-length");
+  if (
+    contentLength !== null &&
+    contentLength !== undefined &&
+    (!/^\d+$/u.test(contentLength) || Number(contentLength) > MAX_RESPONSE_BYTES)
+  ) {
+    throw adapterError();
+  }
+
+  const reader = response.body?.getReader?.();
+  if (!reader) {
+    throw adapterError();
+  }
+
+  const chunks = [];
+  let bytes = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      const chunk = Buffer.from(value);
+      bytes += chunk.length;
+      if (bytes > MAX_RESPONSE_BYTES) {
+        chunk.fill(0);
+        throw adapterError();
+      }
+      chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  } finally {
+    for (const chunk of chunks) {
+      chunk.fill(0);
+    }
+    reader.releaseLock?.();
+  }
+}
+
+function parseAdapterResponse(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw adapterError();
+  }
+  if (
+    !isPlainObject(value) ||
+    !isBoundedText(value.conversationId, MAX_CONVERSATION_ID_LENGTH) ||
+    !isBoundedText(value.output, MAX_OUTPUT_LENGTH)
+  ) {
+    throw adapterError();
+  }
+  return {
+    conversationId: value.conversationId,
+    output: value.output,
+  };
+}
+
+function isTimeout(error) {
+  return error?.name === "AbortError" || error?.name === "TimeoutError";
+}
+
+export function createLocalChatTestService({
+  fetchImpl = fetch,
+  now = () => Date.now(),
+  keyTtlMs = KEY_TTL_MS,
+  maxSessions = MAX_SESSIONS,
+  requestTimeoutMs = REQUEST_TIMEOUT_MS,
+} = {}) {
+  const sessions = new Map();
+  let pendingKeyIssuances = 0;
+
+  function expireSession(keyId, session) {
+    if (sessions.get(keyId) !== session) {
+      return;
+    }
+    clearTimeout(session.expiryTimer);
+    session.abortController?.abort();
+    session.privateKey = undefined;
+    sessions.delete(keyId);
+  }
+
+  function discardExpiredSessions() {
+    const currentTime = now();
+    for (const [keyId, session] of sessions) {
+      if (session.expiresAt <= currentTime) {
+        expireSession(keyId, session);
+      }
+    }
+  }
+
+  function resetAllSessions() {
+    for (const [keyId, session] of sessions) {
+      expireSession(keyId, session);
+    }
+  }
+
+  function getLiveSession(keyId) {
+    discardExpiredSessions();
+    const session = sessions.get(keyId);
+    if (!session || session.expiresAt <= now()) {
+      if (session) {
+        expireSession(keyId, session);
+      }
+      throw expiredKeyError();
+    }
+    return session;
+  }
+
+  return {
+    async issueKey() {
+      discardExpiredSessions();
+      if (sessions.size + pendingKeyIssuances >= maxSessions) {
+        throw requestError(
+          "Too many open tester sessions. Forget one or wait for it to expire.",
+          429,
+        );
+      }
+      pendingKeyIssuances += 1;
+      try {
+        const { publicKey, privateKey } = await generateKeyPair("rsa", {
+          modulusLength: 2_048,
+          publicExponent: 0x10001,
+        });
+        const keyId = randomUUID();
+        const expiresAt = now() + keyTtlMs;
+        const session = {
+          abortController: null,
+          expiresAt,
+          expiryTimer: null,
+          inFlight: false,
+          privateKey,
+        };
+        sessions.set(keyId, session);
+        session.expiryTimer = setTimeout(
+          () => expireSession(keyId, session),
+          keyTtlMs,
+        );
+        session.expiryTimer.unref?.();
+        return {
+          keyId,
+          publicKeyJwk: publicKey.export({ format: "jwk" }),
+          algorithm: "RSA-OAEP-256",
+          expiresAt: new Date(expiresAt).toISOString(),
+        };
+      } finally {
+        pendingKeyIssuances -= 1;
+      }
+    },
+
+    async message(untrustedRequest) {
+      const request = validateMessageRequest(untrustedRequest);
+      const session = getLiveSession(request.keyId);
+      if (session.inFlight) {
+        throw requestError("Wait for the current test message to finish.", 409);
+      }
+      session.inFlight = true;
+      let encryptedCredential;
+      let decryptedCredential;
+      let authorization;
+      let timeout;
+      try {
+        encryptedCredential = decodeCiphertext(request.encryptedCredential);
+        try {
+          decryptedCredential = privateDecrypt(
+            {
+              key: session.privateKey,
+              padding: constants.RSA_PKCS1_OAEP_PADDING,
+              oaepHash: "sha256",
+            },
+            encryptedCredential,
+          );
+        } catch {
+          throw requestError("Secure the client credential again before testing.");
+        }
+        if (
+          decryptedCredential.length === 0 ||
+          decryptedCredential.length > 512 ||
+          /[\r\n\u0000]/u.test(decryptedCredential.toString("utf8"))
+        ) {
+          throw requestError("Secure the client credential again before testing.");
+        }
+        authorization = `Bearer ${decryptedCredential.toString("utf8")}`;
+
+        let response;
+        try {
+          session.abortController = new AbortController();
+          timeout = setTimeout(
+            () => session.abortController?.abort(),
+            requestTimeoutMs,
+          );
+          response = await fetchImpl(`${request.endpointBaseUrl}/chat`, {
+            method: "POST",
+            headers: {
+              Accept: "application/json",
+              Authorization: authorization,
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+              input: request.input,
+              ...(request.conversationId !== undefined
+                ? { conversationId: request.conversationId }
+                : {}),
+            }),
+            redirect: "error",
+            signal: session.abortController.signal,
+          });
+        } catch (error) {
+          throw adapterError(isTimeout(error) ? 504 : 502);
+        }
+        if (!response?.ok || response.status < 200 || response.status >= 300) {
+          throw adapterError();
+        }
+        return parseAdapterResponse(await readBoundedResponse(response));
+      } finally {
+        clearTimeout(timeout);
+        authorization = undefined;
+        encryptedCredential?.fill(0);
+        decryptedCredential?.fill(0);
+        session.abortController = null;
+        session.inFlight = false;
+      }
+    },
+
+    async reset(request) {
+      if (!isPlainObject(request) || !isBoundedText(request.keyId, 128)) {
+        throw requestError("Choose a valid tester session to forget.");
+      }
+      const session = sessions.get(request.keyId);
+      if (session) {
+        expireSession(request.keyId, session);
+      }
+      return { forgotten: true };
+    },
+
+    resetAll() {
+      resetAllSessions();
+    },
+
+    dispose() {
+      resetAllSessions();
+    },
+  };
+}