specrails-desktop 2.53.0 → 2.55.0

package/client/dist/index.html

@@ -204,7 +204,7 @@
         .specrails-splash__mark .pill { opacity: 1; }
       }
     </style>
-    <script type="module" crossorigin src="/assets/index-Cn-T8bgL.js"></script>
+    <script type="module" crossorigin src="/assets/index-BfAZg5DG.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-CNC7AqOf.js">
     <link rel="modulepreload" crossorigin href="/assets/jsx-runtime-zu2_FqZY.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-DiWzBDP9.js">

package/docs/ci-cd.md

@@ -41,6 +41,10 @@ The macOS job retains `artifacts/chromium-signing/` as the `chromium-signing-mac
 
 ## Credentials and external requirements
 
+### Recover an already published Desktop download channel
+
+If native builds and GitHub publication succeed but Hostinger installer uploads fail, run **Recover Desktop download channel** on `main` with the existing stable version (for example `2.54.0`). It requires successful main CI and successful native builds for that exact release commit, then streams all three published installers and verifies their sizes and GitHub SHA-256 digests. It atomically replaces only `latest/manifest.json` over verified FTPS, pointing downloads to the existing version-specific GitHub assets. It refuses version downgrades, verifies the public manifest after publication, and does not rebuild, delete installers, or alter the signed Tauri updater. Normal releases continue to use the regular distribution workflow.
+
 - `RELEASE_PAT` must be authorized for release-please's pull requests and releases. It also permits tag pushes to trigger publication workflows; events created with the repository's ordinary `GITHUB_TOKEN` generally do not trigger another workflow.
 - Publication uses one of two credentials. When the `NPM_TOKEN` secret is set, it must authenticate an account with publishing permission for `specrails-desktop` (npm now requires such tokens to be granular with *bypass 2FA*, and they expire within 90 days); the workflow checks authentication and gives an explicit error before publishing. When the secret is empty, the job publishes through npm **trusted publishing**: it installs npm 11, removes the empty token line that `setup-node` writes, and lets npm exchange the job's OIDC identity (`id-token: write`) for a short-lived publish grant. That path only works once the package's *Trusted publisher* on npmjs.com names this repository (`fjpulidop/specrails-desktop`) and workflow file (`npm-publish.yml`, no environment); registry configuration is never changed from here. Provenance does **not** grant publishing permission in either mode. An npm `E404` during publication is npm's answer to an unauthorized publish and does not identify which token or permission failed; an `E403` mentioning two-factor authentication means the stored token lacks *bypass 2FA*. [npm publishing and provenance](https://docs.github.com/en/actions/tutorials/publish-packages/publish-nodejs-packages).
 - Existing Apple signing/notarization and Tauri updater signing secrets remain required. Installer build steps retain their platform-specific checks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.53.0",
+  "version": "2.55.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/agent-chat-manager.js

@@ -194,6 +194,9 @@ class AgentChatManager {
             })),
         };
     }
+    notifyConversationCreated(conversationId) {
+        this._broadcast({ type: 'agent_conversation_created', conversationId, timestamp: new Date().toISOString() });
+    }
     _startLifecycle(conversationId) {
         const startedAt = new Date().toISOString();
         this._turnStartedAt.set(conversationId, startedAt);
@@ -400,13 +403,20 @@ class AgentChatManager {
         const currentMessageId = options.queueId ? (0, agent_input_store_1.getAgentInput)(this._db, conversationId, options.queueId)?.messageId : null;
         const historyBlock = (0, agent_context_resolver_1.buildAgentHistoryBlock)((0, agent_input_store_1.decorateAgentInputMessages)(this._db, (0, agent_store_1.listAgentMessages)(this._db, conversationId))
             .filter((message) => message.id !== currentMessageId && message.delivery_status !== 'cancelled' && message.delivery_status !== 'interrupted'));
-        if (options.queueId) {
-            if (!(0, agent_input_store_1.deliverAgentInput)(this._db, conversationId, options.queueId, 'sent'))
-                return;
-        }
-        else {
-            (0, agent_store_1.addAgentMessage)(this._db, { conversationId, role: 'user', content: userText, attachmentIds, contextRefs: options.contextRefs });
-        }
+        const message = options.queueId
+            ? (0, agent_input_store_1.deliverAgentInput)(this._db, conversationId, options.queueId, 'sent')
+            : (0, agent_store_1.addAgentMessage)(this._db, { conversationId, role: 'user', content: userText, attachmentIds, contextRefs: options.contextRefs });
+        if (!message)
+            return;
+        // Queued turns were announced by the drain loop. Direct turns must also
+        // reach every open client, including Desktop when Companion sent the input.
+        if (!currentMessageId)
+            this._broadcast({
+                type: 'agent_input_started', conversationId, queueId: options.queueId ?? null,
+                messageId: message.id, text: message.content, timestamp: message.created_at,
+                contextRefs: options.contextRefs ?? [], attachmentIds: attachmentIds ?? [],
+                deliveryReceipt: 'sent',
+            });
         this._autoTitle(conversationId, conversation.title);
         // Providers WITHOUT a --system-prompt flag (codex, gemini) drop opts.systemPrompt
         // for chat turns, so the attachment prompt-injection note would never reach them —

package/server/dist/agent-chat-router.js

@@ -199,6 +199,7 @@ function createAgentChatRouter(deps) {
             // Off-catalog values fall back to null (= no provider-specific override).
             reasoningEffort: validEffort(provider, effectiveModel, body.reasoningEffort) ?? null,
         });
+        manager.notifyConversationCreated(conversation.id);
         res.status(201).json({ conversation });
     });
     router.get('/conversations/:id', (req, res) => {

package/server/dist/mobile/mobile-code.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relativeCodePath = relativeCodePath;
+exports.createMobileCodeRouter = createMobileCodeRouter;
+const express_1 = require("express");
+const mobile_redact_1 = require("./mobile-redact");
+const id = /^[A-Za-z0-9_-]{1,160}$/;
+function relativeCodePath(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 4096
+        && !/^[\\/]|^[A-Za-z]:|[\x00-\x1f\\]/.test(value)
+        && !value.split('/').some(part => part === '..' || part === '.' || part === '');
+}
+const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+/** Project ACL/auth run on the parent router. Desktop remains authoritative for
+ * repository membership, realpath confinement, deny-list and gitignore rules.
+ * Only this explicit source DTO preserves source text verbatim: applying the
+ * generic absolute-path scrubber to code would silently corrupt its contents.
+ */
+function createMobileCodeRouter(upstream) {
+    const router = (0, express_1.Router)();
+    for (const operation of ['tree', 'find', 'file']) {
+        router.get(`/projects/:pid/repositories/:rid/code/${operation}`, async (req, res) => {
+            const pid = req.params.pid, rid = req.params.rid;
+            if (!id.test(pid) || !id.test(rid)) {
+                res.status(400).json({ error: 'Invalid parameter' });
+                return;
+            }
+            const query = new URLSearchParams();
+            if (operation === 'tree') {
+                query.set('filter', 'all');
+                query.set('limit', '200');
+                if (req.query.cursor !== undefined) {
+                    if (typeof req.query.cursor !== 'string' || req.query.cursor.length > 4096) {
+                        res.status(400).json({ error: 'Invalid cursor' });
+                        return;
+                    }
+                    query.set('cursor', req.query.cursor);
+                }
+            }
+            else if (operation === 'find') {
+                if (typeof req.query.q !== 'string' || !req.query.q.trim() || req.query.q.length > 256) {
+                    res.status(400).json({ error: 'Invalid query' });
+                    return;
+                }
+                query.set('q', req.query.q);
+                query.set('limit', '50');
+            }
+            else {
+                if (!relativeCodePath(req.query.path)) {
+                    res.status(400).json({ error: 'Invalid relative path' });
+                    return;
+                }
+                query.set('path', req.query.path);
+                for (const key of ['startLine', 'startColumn']) {
+                    const value = req.query[key] ?? '1';
+                    if (typeof value !== 'string' || !/^[1-9]\d{0,8}$/.test(value)) {
+                        res.status(400).json({ error: 'Invalid range' });
+                        return;
+                    }
+                    query.set(key, value);
+                }
+                query.set('endLine', String(Number(query.get('startLine')) + 199));
+                if (req.query.expectedHash !== undefined) {
+                    if (typeof req.query.expectedHash !== 'string' || !/^[a-f0-9]{64}$/i.test(req.query.expectedHash)) {
+                        res.status(400).json({ error: 'Invalid hash' });
+                        return;
+                    }
+                    query.set('expectedHash', req.query.expectedHash);
+                }
+            }
+            try {
+                const response = await upstream('GET', `/api/projects/${encodeURIComponent(pid)}/repositories/${encodeURIComponent(rid)}/code/${operation}?${query}`);
+                if (response.status < 200 || response.status >= 300) {
+                    res.status(response.status).json((0, mobile_redact_1.redact)(response.json));
+                    return;
+                }
+                const data = record(response.json);
+                if (operation === 'file') {
+                    if (!relativeCodePath(data.path) || data.path !== req.query.path || typeof data.content !== 'string') {
+                        res.status(502).json({ error: 'Invalid source response' });
+                        return;
+                    }
+                    res.json({ relativePath: data.path, content: data.content, language: data.language,
+                        fileHash: data.fileHash, startLine: data.startLine, startColumn: data.startColumn,
+                        endLine: data.endLine, totalLines: data.totalLines, nextLine: data.nextLine, nextColumn: data.nextColumn });
+                }
+                else {
+                    const rows = data[operation === 'tree' ? 'entries' : 'matches'];
+                    res.json({ entries: (Array.isArray(rows) ? rows : []).map(record).filter(row => relativeCodePath(row.path)).map(row => ({
+                            relativePath: row.path, kind: row.kind === 'dir' ? 'dir' : 'file', sizeBytes: row.sizeBytes,
+                        })), nextCursor: operation === 'tree' ? data.nextCursor : null, truncated: data.truncated === true });
+                }
+            }
+            catch {
+                res.status(502).json({ error: 'Code explorer unavailable' });
+            }
+        });
+    }
+    return router;
+}

package/server/dist/mobile/mobile-missions.js

@@ -4,6 +4,7 @@ exports.MISSION_ACCESS_REASON = exports.MOBILE_PROTOCOL_VERSION = void 0;
 exports.mobileCapabilities = mobileCapabilities;
 exports.missionSnapshot = missionSnapshot;
 exports.createMobileMissionsRouter = createMobileMissionsRouter;
+const feature_flags_1 = require("../feature-flags");
 const node_string_decoder_1 = require("node:string_decoder");
 const express_1 = require("express");
 const agent_store_1 = require("../agent-store");
@@ -17,7 +18,7 @@ exports.MOBILE_PROTOCOL_VERSION = 2;
 exports.MISSION_ACCESS_REASON = 'Mission agents can access more than their pinned project. Missions require an all-projects device grant; your permitted Specs and Rails remain available.';
 function mobileCapabilities(db, deviceId) {
     const missions = process.env.SPECRAILS_AGENT_CHAT !== 'false' && (0, mobile_devices_1.getAllowedProjects)(db, deviceId) === null;
-    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true },
+    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)() },
         ...(!missions ? { missionsUnavailableReason: process.env.SPECRAILS_AGENT_CHAT === 'false' ? 'Missions are disabled on Desktop.' : exports.MISSION_ACCESS_REASON } : {}) };
 }
 function conversationView(value) {
@@ -56,7 +57,7 @@ function missionSnapshot(value) {
             try {
                 const parsed = record(JSON.parse(raw));
                 if (parsed.kind === 'pr_decision')
-                    card = { ...pick(parsed, ['kind', 'railIndex', 'ticketIds', 'decision', 'implementationOutcome', 'deliveryOutcome', 'prNumber']), repositoryDeliveries: (Array.isArray(parsed.repositoryDeliveries) ? parsed.repositoryDeliveries : []).slice(0, 30).map(value => pick(value, ['repositoryId', 'repositoryName', 'decision'])) };
+                    card = { ...pick(parsed, ['kind', 'railIndex', 'ticketIds', 'decision', 'implementationOutcome', 'deliveryOutcome', 'prNumber', 'railName', 'phase', 'statusDetail', 'baseBranch']), runIds: (Array.isArray(parsed.runIds) ? parsed.runIds : []).filter(id => typeof id === 'string' && ID.test(id)).slice(0, 30), runtime: pick(parsed.runtime, ['status', 'currentStep', 'pendingApproval']), repositoryDeliveries: (Array.isArray(parsed.repositoryDeliveries) ? parsed.repositoryDeliveries : []).slice(0, 30).map(value => pick(value, ['repositoryId', 'repositoryName', 'decision'])) };
             }
             catch { /* Non-card system rows do not expose internal provider payloads. */ }
         }
@@ -65,7 +66,7 @@ function missionSnapshot(value) {
             break;
         }
         const content = record(message).role === 'system' ? '' : take(raw, 40_000);
-        bounded.unshift({ ...pick(message, ['id', 'role', 'created_at', 'delivery_status', 'delivery_receipt']), content, ...(card ? { card } : {}) });
+        bounded.unshift({ ...pick(message, ['id', 'role', 'created_at', 'delivery_status', 'delivery_receipt']), content, intents: (Array.isArray(record(message).intents) ? record(message).intents : []).slice(0, 30).map(value => pick(value, ['kind', 'proposalIndex', 'status', 'railIndex', 'runIds'])), ...(card ? { card } : {}) });
     }
     return { conversation: conversationView(data.conversation), messages: bounded, truncated,
         pendingMessages, pendingTruncated: pending.length > 50,
@@ -90,7 +91,12 @@ function createMobileMissionsRouter({ db, upstream }) {
             res.status(400).json({ error: 'A valid provider is required' });
             return;
         }
-        void send(res, 'GET', `/api/agent/models?provider=${encodeURIComponent(provider)}`);
+        const model = segment(req.query.model);
+        if (model.length > 200) {
+            res.status(400).json({ error: 'Invalid model' });
+            return;
+        }
+        void send(res, 'GET', `/api/agent/models?provider=${encodeURIComponent(provider)}${model ? `&model=${encodeURIComponent(model)}` : ''}`);
     });
     router.get('/projects/:pid/repositories', (req, res) => {
         const pid = segment(req.params.pid);
@@ -175,6 +181,22 @@ function createMobileMissionsRouter({ db, upstream }) {
         }
         void send(res, 'POST', `${id.base}/send`, { text: b.text, queueId: b.queueId, deliveryMode: b.deliveryMode ?? 'queue' }, data => pick(data, ['accepted', 'queued', 'duplicate', 'removed', 'deliveryMode']));
     });
+    router.patch('/projects/:pid/missions/:cid/messages/:mid/intent', (req, res) => {
+        const id = identity(req, res);
+        if (!id)
+            return;
+        const mid = segment(req.params.mid), b = record(req.body);
+        if (!ID.test(mid) || b.kind !== 'rail-launch' || !Number.isSafeInteger(b.proposalIndex) || Number(b.proposalIndex) < 0 || Number(b.proposalIndex) > 100) {
+            res.status(400).json({ error: 'Invalid proposal' });
+            return;
+        }
+        const message = db.prepare('SELECT conversation_id FROM agent_messages WHERE id = ?').get(mid);
+        if (!message || message.conversation_id !== segment(req.params.cid)) {
+            res.status(404).json({ error: 'Message not found in this mission' });
+            return;
+        }
+        void send(res, 'PATCH', `${id.base}/messages/${encodeURIComponent(mid)}/intent`, pick(b, ['kind', 'proposalIndex', 'status', 'railIndex', 'runIds', 'prDeliveryId']), data => ({ message: pick(record(data).message, ['id', 'intents']) }));
+    });
     router.post('/projects/:pid/missions/:cid/abort', (req, res) => { const id = identity(req, res); if (id)
         void send(res, 'POST', `${id.base}/abort`, {}); });
     for (const action of ['edit', 'steer', 'remove']) {

package/server/dist/mobile/mobile-router.js

@@ -8,6 +8,7 @@ const mobile_redact_1 = require("./mobile-redact");
 const mobile_auth_1 = require("./mobile-auth");
 const mobile_devices_1 = require("./mobile-devices");
 const mobile_missions_1 = require("./mobile-missions");
+const mobile_code_1 = require("./mobile-code");
 // The gateway's authenticated REST surface: the `/v1/*` allow-list. Each route
 // forwards, in-process, via a REAL loopback HTTP request to
 // http://127.0.0.1:<desktopPort> with the master token injected server-side as
@@ -187,6 +188,23 @@ function createMobileRouter(deps) {
             return;
         void forward(res, 'DELETE', `/api/projects/${encodeURIComponent(pid)}/tickets/${encodeURIComponent(tid)}`, '');
     });
+    v1.post('/projects/:pid/rails', (req, res) => {
+        const pid = seg(req.params.pid);
+        if (!validate(res, [pid, PID_RE]))
+            return;
+        const name = req.body?.name;
+        if (name != null && (typeof name !== 'string' || name.length > 60)) {
+            res.status(400).json({ error: 'Invalid rail name' });
+            return;
+        }
+        void forward(res, 'POST', `/api/projects/${encodeURIComponent(pid)}/rails`, '', { name: name ?? null });
+    });
+    v1.get('/projects/:pid/profiles', (req, res) => {
+        const pid = seg(req.params.pid), provider = seg(req.query.provider);
+        if (!validate(res, [pid, PID_RE], [provider, PID_RE]))
+            return;
+        void forward(res, 'GET', `/api/projects/${encodeURIComponent(pid)}/profiles`, `?provider=${encodeURIComponent(provider)}`);
+    });
     v1.put('/projects/:pid/rails/:i/tickets', (req, res) => {
         const pid = seg(req.params.pid), i = seg(req.params.i);
         if (!validate(res, [pid, PID_RE], [i, NUM_RE]))
@@ -219,6 +237,33 @@ function createMobileRouter(deps) {
             // provider. This gateway only narrows to the cross-provider enum.
             narrowed.reasoning_effort = b.reasoning_effort;
         }
+        if (b.targetPrNumber !== undefined) {
+            if (!Number.isSafeInteger(b.targetPrNumber) || Number(b.targetPrNumber) < 1) {
+                res.status(400).json({ error: 'Invalid PR number' });
+                return;
+            }
+            narrowed.targetPrNumber = b.targetPrNumber;
+        }
+        if (b.baseBranch !== undefined) {
+            if (typeof b.baseBranch !== 'string' || !b.baseBranch.trim() || b.baseBranch.length > 200) {
+                res.status(400).json({ error: 'Invalid base branch' });
+                return;
+            }
+            narrowed.baseBranch = b.baseBranch;
+        }
+        if (b.originConversationId !== undefined) {
+            if (typeof b.originConversationId !== 'string' || !PID_RE.test(b.originConversationId)) {
+                res.status(400).json({ error: 'Invalid mission' });
+                return;
+            }
+            const conversation = deps.db.prepare('SELECT pinned_project_id FROM agent_conversations WHERE id = ?').get(b.originConversationId);
+            if (!conversation || conversation.pinned_project_id !== pid || (0, mobile_devices_1.getAllowedProjects)(deps.db, req.mobileDevice.id) !== null) {
+                res.status(403).json({ error: 'Mission is not accessible' });
+                return;
+            }
+            narrowed.originConversationId = b.originConversationId;
+            narrowed.originSurface = 'agent-chat';
+        }
         if (typeof b.interactive === 'boolean')
             narrowed.interactive = b.interactive;
         if (b.repositoryIds !== undefined) {
@@ -404,12 +449,14 @@ function createMobileRouter(deps) {
             narrowed.acceptanceCriteria = b.acceptanceCriteria.filter((x) => typeof x === 'string');
         void forward(res, 'POST', `/api/projects/${encodeURIComponent(pid)}/tickets/from-draft`, '', narrowed);
     });
-    v1.use((0, mobile_missions_1.createMobileMissionsRouter)({ db: deps.db, upstream: async (method, path, body) => {
-            const response = await fetch(internalBase + path, { method, signal: AbortSignal.timeout(30_000),
-                headers: { 'x-desktop-token': (0, auth_1.loadOrGenerateToken)(), ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
-                ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
-            return { status: response.status, json: await response.json() };
-        } }));
+    const mobileUpstream = async (method, path, body) => {
+        const response = await fetch(internalBase + path, { method, signal: AbortSignal.timeout(30_000),
+            headers: { 'x-desktop-token': (0, auth_1.loadOrGenerateToken)(), ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
+        return { status: response.status, json: await response.json() };
+    };
+    v1.use((0, mobile_missions_1.createMobileMissionsRouter)({ db: deps.db, upstream: mobileUpstream }));
+    v1.use((0, mobile_code_1.createMobileCodeRouter)(mobileUpstream));
     router.use('/v1', v1);
     // Any unmatched gateway path → 404 JSON (NEVER falls through to a SPA handler;
     // the gateway serves JSON/WS only, no static client).
@@ -421,8 +468,12 @@ function createMobileRouter(deps) {
 /** The allow-list, exported for the CI drift test (asserts each entry resolves
  *  against a real internal route, and that no traversal param is accepted). */
 exports.MOBILE_ALLOWLIST = [
+    { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/tree' },
+    { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/find' },
+    { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/file' },
     { method: 'GET', path: '/v1/capabilities' },
     { method: 'GET', path: '/v1/mission-models' },
+    { method: 'PATCH', path: '/v1/projects/:pid/missions/:cid/messages/:mid/intent' },
     { method: 'GET', path: '/v1/projects/:pid/repositories' },
     { method: 'GET', path: '/v1/projects/:pid/missions' },
     { method: 'POST', path: '/v1/projects/:pid/missions' },
@@ -445,6 +496,9 @@ exports.MOBILE_ALLOWLIST = [
     { method: 'GET', path: '/v1/projects/:pid/loop-runs/:id' },
     { method: 'GET', path: '/v1/projects/:pid/queue' },
     { method: 'GET', path: '/v1/projects/:pid/rails' },
+    { method: 'POST', path: '/v1/projects/:pid/rails' },
+    { method: 'GET', path: '/v1/projects/:pid/profiles' },
+    { method: 'PUT', path: '/v1/projects/:pid/rails/:i/name' },
     { method: 'GET', path: '/v1/projects/:pid/activity' },
     { method: 'GET', path: '/v1/projects/:pid/stats' },
     { method: 'GET', path: '/v1/projects/:pid/state' },

package/server/dist/mobile/mobile-signal-reconnect.js

@@ -22,6 +22,7 @@ class MobileSignalReconnect {
     _deps;
     _timeoutMs;
     _timer = null;
+    _attempts = new Map();
     _busy = false;
     _epoch = 0;
     _requests = new Set();
@@ -34,9 +35,11 @@ class MobileSignalReconnect {
             return;
         this._timer = setInterval(() => void this.poll(), intervalMs);
         this._timer.unref?.();
+        void this.poll();
     }
     stop() {
         this._epoch++;
+        this._attempts.clear();
         for (const controller of this._requests)
             controller.abort();
         this._requests.clear();
@@ -61,6 +64,14 @@ class MobileSignalReconnect {
                     if (epoch !== this._epoch)
                         return;
                     if (req !== null) {
+                        let requestId = null;
+                        try {
+                            const value = JSON.parse(req);
+                            if (typeof value?.requestId === 'string' && /^[a-zA-Z0-9_-]{8,80}$/.test(value.requestId))
+                                requestId = value.requestId;
+                        }
+                        catch { /* legacy request */ }
+                        this._attempts.set(room, requestId);
                         const offer = await this._deps.makeOffer(room);
                         if (epoch !== this._epoch)
                             return;
@@ -68,7 +79,7 @@ class MobileSignalReconnect {
                             // BUG-AUTH-01: never publish `offer.secret` to the public mailbox.
                             // The reconnecting companion authenticates with its existing device
                             // token; the secret would only help an eavesdropper.
-                            await this._post(room, 'offer', JSON.stringify({ sdp: offer.sdp, hub: offer.hubInstanceId, name: offer.hubName }));
+                            await this._post(room, 'offer', JSON.stringify({ sdp: offer.sdp, hub: offer.hubInstanceId, name: offer.hubName, ...(requestId ? { requestId } : {}) }));
                         }
                     }
                     // A phone's answer waiting? → complete the connection.
@@ -80,8 +91,11 @@ class MobileSignalReconnect {
                     if (ans) {
                         try {
                             const parsed = JSON.parse(ans);
-                            if (typeof parsed.sdp === 'string')
-                                await this._deps.acceptAnswer(room, parsed.sdp);
+                            const expected = this._attempts.get(room);
+                            if (expected && parsed.requestId !== expected)
+                                continue;
+                            if (typeof parsed.sdp === 'string' && await this._deps.acceptAnswer(room, parsed.sdp))
+                                this._attempts.delete(room);
                         }
                         catch {
                             /* malformed answer — ignore */