> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase01-session05-websocket-hydration-and-archive-export-privacy/tasks.md). # Task Checklist **Session ID**: `phase01-session05-websocket-hydration-and-archive-export-privacy` **Total Tasks**: 24 **Estimated Duration**: 3-4 hours **Created**: 2026-05-29 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[SNNMM]` = Session reference (NN=phase number, MM=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 3 | 3 | 0 | | Foundation | 6 | 6 | 0 | | Implementation | 10 | 10 | 0 | | Testing | 5 | 5 | 0 | | **Total** | **24** | **24** | **0** | *** ## Setup (3 tasks) Initial analysis and baseline confirmation. * [x] T001 \[S0105] Verify Session 04 prerequisites, WebSocket docs, and current route validation baseline (`.spec_system/specs/phase01-session04-server-routes-and-authorization-boundaries/validation.md`) * [x] T002 \[S0105] Map WebSocket, export, and archive expectations from session sources into implementation notes (`.spec_system/specs/phase01-session05-websocket-hydration-and-archive-export-privacy/implementation-notes.md`) * [x] T003 \[S0105] Identify focused server, web, and protocol verification commands before code changes (`.spec_system/specs/phase01-session05-websocket-hydration-and-archive-export-privacy/implementation-notes.md`) *** ## Foundation (6 tasks) Core validators, privacy helpers, and contract anchors. ### apps/server * [x] T004 \[S0105] \[P] Create WebSocket client-message validator with schema-validated input and explicit error mapping (`apps/server/src/ws/clientMessageValidation.ts`) * [x] T005 \[S0105] \[P] Create session privacy helper for prompt, path, command, token, and URL redaction with deterministic placeholders (`apps/server/src/lib/sessionPrivacy.ts`) * [x] T006 \[S0105] Wire archive privacy boundary into session archive without crashing on filesystem or serialization failures (`apps/server/src/lib/sessionArchive.ts`) ### packages/protocol * [x] T007 \[S0105] \[P] Lock client-message and hydration contract expectations in protocol tests (`packages/protocol/tests/events.test.ts`) * [x] T008 \[S0105] \[P] Document protocol ownership of client-message and hydration event shapes (`packages/protocol/README_protocol.md`) ### apps/web * [x] T009 \[S0105] \[P] Define replay-link privacy and malformed-entry guards for bounded shared payloads (`apps/web/src/lib/replayLink.ts`) *** ## Implementation (10 tasks) Main runtime hardening and documentation updates. ### apps/server * [x] T010 \[S0105] Validate raw WebSocket message JSON before dispatch with malformed-message no-crash behavior (`apps/server/src/ws/handlers.ts`) * [x] T011 \[S0105] Harden `permission_response` and `plan_approval` socket messages with duplicate-trigger prevention while in-flight (`apps/server/src/ws/handlers.ts`) * [x] T012 \[S0105] Harden `post_notice` socket messages with bounded body, validated severity, and target array limits (`apps/server/src/ws/handlers.ts`) * [x] T013 \[S0105] Harden `collect_scroll` and `hero_state_override` socket messages with validated IDs and state enums (`apps/server/src/ws/handlers.ts`) * [x] T014 \[S0105] Apply session privacy redaction to CSV export columns while preserving deterministic headers (`apps/server/src/lib/exportSession.ts`) * [x] T015 \[S0105] Apply session privacy redaction to JSON export payloads while preserving top-level schema version and counts (`apps/server/src/lib/exportSession.ts`) * [x] T016 \[S0105] Validate export route options through shared request validation without echoing raw invalid payloads (`apps/server/src/routes/export.ts`) * [x] T017 \[S0105] Ensure broadcaster archive writes use the local archive boundary with cleanup on scope exit for acquired socket resources (`apps/server/src/ws/broadcaster.ts`) ### apps/web * [x] T018 \[S0105] Drop malformed incoming WebSocket frames before applying store reducers with explicit closed/offline fallback behavior (`apps/web/src/store/useWsClient.ts`) * [x] T019 \[S0105] Preserve export download behavior while reading privacy/schema headers and reporting failure paths through toasts (`apps/web/src/lib/exportSession.ts`) *** ## Testing (5 tasks) Focused verification and contract coverage. ### apps/server * [x] T020 \[S0105] \[P] Add WebSocket hydration, valid client-message, malformed-message, duplicate-response, and disconnect tests (`apps/server/tests/websocket.test.ts`) * [x] T021 \[S0105] \[P] Extend export helper and route tests for redaction, schema stability, invalid options, and no raw input echo (`apps/server/tests/exportSession.test.ts`, `apps/server/tests/exportRoute.test.ts`) ### apps/web * [x] T022 \[S0105] \[P] Add web tests for malformed frame drops, replay privacy boundaries, and export header/error behavior (`apps/web/tests/wsClientPrivacy.test.ts`) ### docs * [x] T023 \[S0105] \[P] Update API, contract, privacy, and server docs for WebSocket, archive, replay, and export privacy status (`docs/api/event-api-hook-contracts.md`) ### verification * [x] T024 \[S0105] Run focused server/web/protocol tests, typechecks, Biome checks, ASCII validation, LF validation, and record results (`.spec_system/specs/phase01-session05-websocket-hydration-and-archive-export-privacy/implementation-notes.md`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing * [x] All files ASCII-encoded * [x] implementation-notes.md updated * [x] Ready for the validate workflow step *** ## Next Steps Run the validate workflow step to verify session completeness. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase01-session05-websocket-hydration-and-archive-export-privacy/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.