codepilotios · Jul 19, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
 
       - name: Gateway tests
         working-directory: gateway
-        run: python3 -m unittest test_codex_phone_gateway.py
+        run: python3 -m unittest test_codex_phone_gateway.py test_remote_desktop_gateway.py
 
       - name: Fastlane syntax
         run: ruby -c ios/CodexPhone/fastlane/Fastfile

diff --git a/.gitignore b/.gitignore
@@ -17,6 +17,7 @@ __pycache__/
 .pytest_cache/
 
 # Local runtime state and secrets
+.private/
 .agents/
 .superpowers/
 AGENTS.md

diff --git a/README.md b/README.md
@@ -58,7 +58,7 @@ See:
 - [Support](docs/SUPPORT.md)
 - [Changelog](docs/CHANGELOG.md)
 - [App Store Metadata Draft](docs/APP_STORE_METADATA_DRAFT.md)
-- [Screenshot Plan](docs/SCREENSHOTS.md)
+- [Screenshot Plan](metadata/screenshots/README.md)
 - [Security](docs/SECURITY.md)
 - [Architecture](docs/ARCHITECTURE.md)
 - [Troubleshooting](docs/TROUBLESHOOTING.md)

diff --git a/Tests/CodexAccountSwitcherTests/RemoteDesktopCoordinatorTests.swift b/Tests/CodexAccountSwitcherTests/RemoteDesktopCoordinatorTests.swift
@@ -29,9 +29,9 @@ final class RemoteDesktopCoordinatorTests: XCTestCase {
 
         let pending = try coordinator.beginPairing(
             deviceID: "phone-1",
-            name: "Tony's iPhone",
+            name: "Test iPhone",
             publicKeyRawRepresentation: publicKey,
-            macName: "Mac mini"
+            macName: "Test Mac"
         )
 
         XCTAssertEqual(coordinator.snapshot.pendingPairing?.deviceID, "phone-1")
@@ -42,9 +42,9 @@ final class RemoteDesktopCoordinatorTests: XCTestCase {
 
         let approvalPending = try coordinator.beginPairing(
             deviceID: "phone-1",
-            name: "Tony's iPhone",
+            name: "Test iPhone",
             publicKeyRawRepresentation: publicKey,
-            macName: "Mac mini"
+            macName: "Test Mac"
         )
         _ = try coordinator.verifyPendingPairing(
             challengeID: approvalPending.challenge.id,
@@ -104,9 +104,9 @@ final class RemoteDesktopCoordinatorTests: XCTestCase {
         let key = P256.Signing.PrivateKey()
         let challenge = coordinator.pairingStore.issueChallenge(
             deviceID: "phone-1",
-            name: "Tony's iPhone",
+            name: "Test iPhone",
             publicKeyRawRepresentation: key.publicKey.rawRepresentation,
-            macName: "Mac mini"
+            macName: "Test Mac"
         )
         let approval = try coordinator.pairingStore.verifyChallenge(
             challenge,

diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md
@@ -18,7 +18,7 @@ Public beta for Codex CLI users who want iPhone visibility, file uploads, turn c
 
 CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI coding users who already run Codex CLI on a Mac.
 
-Use the iPhone app to check active account status, follow threads, upload files, steer or stop supported turns, receive turn-finished notifications, and connect through your own same-network or Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service.
+Use the iPhone app to check active account status, follow threads, upload files, steer or stop supported turns, receive turn-finished notifications, and connect through your own Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service.
 
 The beta is focused on setup clarity, connection reliability, privacy-safe diagnostics, and practical remote workflows for existing Codex CLI users. Some internals still use Codex-specific names while the public CodePilot product surface is prepared for broader provider support later.
 
@@ -32,7 +32,7 @@ Codex, coding agent, developer tools, Mac, iPhone, remote coding, AI coding, Tes
 
 Install CodePilot on a Mac that already runs Codex CLI, create a saved account profile, start the gateway, connect the iPhone app with the gateway URL and token, and verify thread visibility, file upload, turn control, notifications, and setup recovery messages.
 
-Please report whether you used same-network access or Cloudflare Tunnel. Remove account names, gateway URLs, tokens, hostnames, local paths, private prompts, screenshots, and logs containing private data before sharing feedback.
+Please include the connection and recovery flow you tested. Remove account names, gateway URLs, tokens, hostnames, local paths, private prompts, screenshots, and logs containing private data before sharing feedback.
 
 ## Support URL
 
@@ -50,7 +50,7 @@ Use only sanitized demo data:
 - Example hostnames such as `codepilot.example.com`.
 - No tokens, auth details, private prompts, local paths, Apple identifiers, personal account names, private screenshots, or live desktop contents.
 
-See [Screenshot Plan](SCREENSHOTS.md).
+See the [App Store screenshot checklist](../metadata/screenshots/README.md).
 
 ## Approval Gates
 

diff --git a/docs/PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md b/docs/PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md
@@ -323,7 +323,7 @@ curl -fsS -X POST http://127.0.0.1:8787/codexphone/api/build
 curl -fsS http://127.0.0.1:8787/codexphone/api/status
 ```
 
-Wait until `current.state == "complete"`, then verify the manifest and IPA from `https://ota.sprenkeling.co` return HTTP 200.
+Wait until `current.state == "complete"`, then verify the manifest and IPA from the configured OTA domain return HTTP 200.
 
 - [ ] **Step 8: Commit**
 
@@ -497,8 +497,8 @@ Expected: `current.state` becomes `complete`.
 Run:
 
 ```sh
-curl -I https://ota.sprenkeling.co/codexphone/manifest.plist
-curl -I https://ota.sprenkeling.co/codexphone/CodePilot.ipa
+curl -I https://ota.example.com/codexphone/manifest.plist
+curl -I https://ota.example.com/codexphone/CodePilot.ipa
 ```
 
 Expected: HTTP 200 or the exact current generated manifest/IPA paths return HTTP 200.

diff --git a/docs/superpowers/plans/2026-06-27-secure-remote-desktop.md b/docs/superpowers/plans/2026-06-27-secure-remote-desktop.md
@@ -632,11 +632,11 @@ Verify pairing approval, Face ID session start, Wi-Fi direct path, cellular TURN
 Run:
 
 ```bash
-cd ios
+cd /path/to/ios-release-worktree
 python3 scripts/dke_ota_build.py build --app codexphone --branch release
 ```
 
-Expected: status reaches `complete`; output reports bundle ID `com.tony.codexphone`; both public manifest and IPA return HTTP 200; the OTA install updates the configured CodePilot app rather than creating another instance.
+Expected: status reaches `complete`; output reports the canonical CodePilot iOS bundle ID; both public manifest and IPA return HTTP 200; the OTA install updates the configured CodePilot app rather than creating another instance.
 
 - [ ] **Step 7: Commit**
 

diff --git a/docs/superpowers/plans/2026-07-01-codepilot-launch-agent-system.md b/docs/superpowers/plans/2026-07-01-codepilot-launch-agent-system.md
@@ -15,14 +15,14 @@
 - Agents must not invent credentials, create accounts with fake identity, spam communities, or bypass platform rules.
 - Reddit promotion must be transparent: disclose the creator relationship and follow subreddit rules.
 - Anything involving App Store submission, payments, pricing, legal terms, public claims, or user data policy requires explicit human approval.
-- Agents should ping Tony in the current Codex thread only when intervention is necessary.
+- Agents should ping the maintainer in the current Codex thread only when intervention is necessary.
 - Routine findings should become GitHub issues, PRs, docs updates, or release notes without a ping.
 - Every code change must be tested before being marked complete.
 - Every iOS app change must trigger the project OTA build process before completion.
 
 ## Escalation Rules
 
-Ping Tony only for:
+Ping the maintainer only for:
 
 - Apple, Cloudflare, GitHub, Reddit, or payment-provider authentication.
 - App Store Connect agreements, pricing, tax, banking, privacy, age rating, export compliance, or review submission approval.
@@ -31,7 +31,7 @@ Ping Tony only for:
 - A public post, launch announcement, paid promotion, or subreddit submission that needs final approval.
 - A product decision that affects subscription value, pricing, usage limits, or public positioning.
 
-Do not ping Tony for:
+Do not ping the maintainer for:
 
 - Routine dependency updates that pass tests.
 - GitHub issue triage.
@@ -146,7 +146,7 @@ Do not ping Tony for:
 - Track feedback and convert real product problems into GitHub issues.
 - Maintain a transparent creator profile.
 
-**Important constraint:** The agent can prepare the Reddit account plan, profile text, and posts, but Tony must create or approve any Reddit account and final posts. Creating accounts and posting must comply with Reddit rules and subreddit rules.
+**Important constraint:** The agent can prepare the Reddit account plan, profile text, and posts, but the maintainer must create or approve any Reddit account and final posts. Creating accounts and posting must comply with Reddit rules and subreddit rules.
 
 **Outputs:**
 
@@ -216,7 +216,7 @@ Do not ping Tony for:
 
 4. **Prepare community launch**
    - Community Growth Agent drafts Reddit account profile and launch posts.
-   - Tony approves account/posting strategy.
+   - Maintainer approves account/posting strategy.
    - Agent schedules staged, rule-compliant posts.
 
 5. **Start beta loop**
@@ -229,7 +229,7 @@ Do not ping Tony for:
    - Revenue Agent proposes tiers and pricing.
    - Presence Agent updates website and App Store copy.
    - Security Agent signs off on public release.
-   - Tony approves pricing, legal, and App Store submission.
+   - Maintainer approves pricing, legal, and App Store submission.
 
 ## Proposed Recurring Automations
 

diff --git a/gateway/test_codex_phone_gateway.py b/gateway/test_codex_phone_gateway.py
@@ -2235,7 +2235,7 @@ def test_start_turn_rejects_second_running_turn_in_same_thread(self):
             }
 
         old_run_turn = GatewayState.run_turn
-        GatewayState.run_turn = lambda self, job_id, thread, prompt, attachments, resume_existing=True: None
+        GatewayState.run_turn = lambda self, job_id, thread, prompt, attachments, resume_existing=True, reasoning_effort=None: None
         try:
             state = GatewayState(Path("/tmp/codex"), "token", Path("/missing-codex"), False)
             state.get_thread = lambda thread_id: {
@@ -2265,7 +2265,7 @@ def test_start_turn_allows_running_turn_in_different_thread(self):
             }
 
         old_run_turn = GatewayState.run_turn
-        GatewayState.run_turn = lambda self, job_id, thread, prompt, attachments, resume_existing=True: None
+        GatewayState.run_turn = lambda self, job_id, thread, prompt, attachments, resume_existing=True, reasoning_effort=None: None
         try:
             state = GatewayState(Path("/tmp/codex"), "token", Path("/missing-codex"), False)
             state.get_thread = lambda thread_id: {

diff --git a/ios/CodexPhone/fastlane/Fastfile b/ios/CodexPhone/fastlane/Fastfile
@@ -52,10 +52,15 @@ platform :ios do
   def codex_phone_beta_description
     ENV.fetch(
       "BETA_APP_DESCRIPTION",
-      "CodePilot lets you securely connect an iPhone to your own Mac gateway for remote coding sessions, thread management, usage status, file upload, and remote desktop control."
+      "CodePilot connects an iPhone to your own Mac gateway for remote coding sessions, thread management, usage status, file upload, file previews, and local Mac web links. Remote Desktop is not included in this beta."
     )
   end
 
+  def codex_phone_testflight_changelog
+    notes_path = File.expand_path("../../../metadata/testflight/0.1/en-US.md", __dir__)
+    File.read(notes_path)
+  end
+
   def codex_phone_beta_review_info
     info = {
       contact_email: codex_phone_feedback_email,
@@ -77,7 +82,7 @@ platform :ios do
       "default" => {
         feedback_email: codex_phone_feedback_email,
         description: codex_phone_beta_description,
-        privacy_policy_url: ENV.fetch("APP_PRIVACY_POLICY_URL", "https://codepilotios.github.io/CodePilot/privacy.html"),
+        privacy_policy_url: ENV.fetch("APP_PRIVACY_POLICY_URL"),
         marketing_url: ENV.fetch("APP_MARKETING_URL", "https://github.com/codepilotios/CodePilot")
       }
     }
@@ -183,7 +188,7 @@ platform :ios do
       beta_app_review_info: codex_phone_beta_review_info,
       localized_app_info: codex_phone_localized_app_info,
       demo_account_required: false,
-      changelog: options[:changelog] || "CodePilot remote client update."
+      changelog: options[:changelog] || codex_phone_testflight_changelog
     )
   end
 
@@ -198,7 +203,7 @@ platform :ios do
       ipa: ipa_path,
       skip_waiting_for_build_processing: true,
       distribute_external: false,
-      changelog: options[:changelog] || "CodePilot remote client update."
+      changelog: options[:changelog] || codex_phone_testflight_changelog
     )
   end
 
@@ -222,7 +227,7 @@ platform :ios do
       beta_app_review_info: codex_phone_beta_review_info,
       localized_app_info: codex_phone_localized_app_info,
       demo_account_required: false,
-      changelog: options[:changelog] || "CodePilot remote client update."
+      changelog: options[:changelog] || codex_phone_testflight_changelog
     )
   end
 

diff --git a/metadata/screenshots/README.md b/metadata/screenshots/README.md
@@ -0,0 +1,20 @@
+# App Store Screenshot Checklist
+
+No App Store-ready screenshots are currently present in the repository.
+
+The minimum practical submission set is 1–10 screenshots for the 6.9-inch iPhone display. Use an accepted portrait canvas such as 1320×2868, 1290×2796, or 1260×2736 pixels. Export PNG or JPEG files without alpha or transparency. No iPad set is required for the current iPhone-only target.
+
+Prepare approved screenshots for:
+
+- First connection screen with the Cloudflare connection choice.
+- Gateway health or setup status after a successful connection.
+- Total-credit status with synthetic account names and balances.
+- Total Credit Live Activity on a supported Lock Screen or Dynamic Island.
+- Thread list or active turn view.
+- File preview from a local Mac path.
+- Local Mac web page opened through the gateway.
+- Error recovery state with non-sensitive copy.
+
+Do not include Remote Desktop in the 0.1 screenshot set while its paired-device and session-authorization protections remain release-blocked.
+
+All screenshots must avoid real tokens, private hostnames, private account names, private file paths, private emails, and personal identifiers.
diff --git a/metadata/testflight/0.1/en-US.md b/metadata/testflight/0.1/en-US.md
@@ -0,0 +1,24 @@
+# CodePilot 0.1 TestFlight Notes
+
+## What To Test
+
+Test CodePilot from your iPhone while your Mac gateway handles coding turns, account status, file previews, and local Mac web links.
+
+- First connection with a Cloudflare gateway URL.
+- Gateway token entry and recovery copy for 401, 403, 502, and offline states.
+- Account status, account switching, and stale-auth recovery.
+- Total available credit across configured accounts, including refresh timing and per-account breakdowns.
+- Total Credit Live Activity updates on the Lock Screen and Dynamic Island.
+- Reset-credit confirmation and refresh behavior for the selected account.
+- Starting, following, steering, and stopping a coding turn.
+- File preview links from local paths, Markdown links, and file URLs.
+- Local Mac web URL opening through the gateway.
+
+Remote Desktop is not included in this beta while its paired-device and session-authorization protections are being completed.
+
+## Beta Requirements
+
+- CodePilot Mac app installed and running.
+- CodePilot gateway reachable from the iPhone.
+- Valid gateway token copied from the Mac setup flow.
+- Live Activities enabled when testing total-credit updates.
diff --git a/metadata/version/0.1/en-US.json b/metadata/version/0.1/en-US.json
@@ -0,0 +1,13 @@
+{
+  "locale": "en-US",
+  "version": "0.1",
+  "name": "CodePilot",
+  "subtitle": "Mac coding agent from iPhone",
+  "keywords": "coding,assistant,developer,remote,mac,iphone,automation",
+  "promotionalText": "Connect your iPhone to your Mac gateway for beta testing, remote turns, file previews, and local Mac web links.",
+  "description": "CodePilot connects your iPhone to a Mac running Codex CLI and the CodePilot gateway, so you can monitor and steer coding-agent work away from your desk.\n\nUse CodePilot to start and follow turns, switch configured accounts, inspect gateway status, preview files, and open local Mac web URLs through the gateway.\n\nThis beta is intended for developers who already run Codex CLI, the CodePilot Mac app, and the gateway. You will need a reachable gateway URL and token from your Mac setup. Remote Desktop is excluded from this beta while its paired-device and session-authorization protections are completed.",
+  "whatsNew": "See your total remaining Codex credit at a glance with a Live Activity, and use an available reset credit for the account you choose without returning to your Mac.\n\nNew:\n- Track combined available credit across configured accounts from the Lock Screen and Dynamic Island.\n- Use a rate-limit reset credit for a specific account after a clear confirmation.\n\nImproved:\n- Clearer gateway recovery when a token is missing, the gateway is offline, or authentication needs attention.\n- Better file previews for local paths and Markdown links.\n- Clearer account status and turn controls.\n\nFixed:\n- More stable gateway event formatting, turn-state handling, and background-session cleanup.\n- More reliable per-account credit refresh and reset state after manual account switches.",
+  "supportUrl": "TODO: maintainer-provided support URL",
+  "privacyPolicyUrl": "TODO: maintainer-provided privacy policy URL",
+  "reviewNotes": "TODO: add maintainer-approved review notes, demo prerequisites, and any required compliance details before upload."
+}